@vendoai/store 0.1.0 → 0.4.0

package/dist/records.js

@@ -0,0 +1,208 @@
+import { canonicalJson, VendoError, } from "@vendoai/core";
+import { appScopeId, cursorMs, decodeCursor, encodeCursor, iso, jsonParam, pageLimit, requireKnownApp, text, unknownAppError, } from "./helpers/utils.js";
+function recordFromRow(row) {
+    const refs = row["refs"];
+    const revision = row["revision"];
+    if (revision !== undefined && !(typeof revision === "string" || typeof revision === "number" || typeof revision === "bigint")) {
+        throw new Error("Expected database revision");
+    }
+    return {
+        id: text(row["id"]),
+        data: row["data"],
+        ...(refs == null ? {} : { refs }),
+        createdAt: iso(row["created_at"]),
+        updatedAt: iso(row["updated_at"]),
+        ...(revision === undefined ? {} : { revision: String(revision) }),
+    };
+}
+function sameRecordValue(current, expected) {
+    return canonicalJson(current.data) === canonicalJson(expected.data)
+        && canonicalJson(current.refs ?? null) === canonicalJson(expected.refs ?? null);
+}
+export function requireRevision(value) {
+    if (!/^[1-9]\d*$/.test(value))
+        throw new VendoError("validation", "malformed record revision");
+}
+/** 01-core §12 */
+export function createRecordStore(db, collection, dedicatedTable) {
+    const table = dedicatedTable ?? "vendo_records";
+    const usesCollection = dedicatedTable === undefined;
+    const appId = appScopeId(collection);
+    // STORE-1: app-scoped collections fail WRITES closed when the owning app has
+    // no vendo_apps row — the app never existed, or its ephemeral session was
+    // swept (kill-list B3: swept sessions are erased from disk, apps included).
+    // Without this, a stale write would recreate rows no erase cascade could ever
+    // reach again. Row-CREATING statements carry the gate IN the statement
+    // (`appGate` below), so a sweep racing the write can never orphan a row —
+    // structural, not ordering care. Reads need no guard: an unknown app has no
+    // rows, so they come back empty (a stale client sees an expired session, not
+    // an error storm). Dedicated door tables are never app-scoped (appId is
+    // undefined there), so the gate is generic-path only.
+    const appGate = (param) => appId === undefined ? "" : `WHERE EXISTS (SELECT 1 FROM vendo_apps WHERE id = $${param})`;
+    const appGateParams = appId === undefined ? [] : [appId];
+    const getRecord = async (id) => {
+        const result = usesCollection
+            ? await db.query("SELECT id, data, refs, created_at, updated_at, revision FROM vendo_records WHERE collection = $1 AND id = $2", [collection, id])
+            : await db.query(`SELECT id, data, refs, created_at, updated_at FROM ${table} WHERE id = $1`, [id]);
+        return result.rows[0] ? recordFromRow(result.rows[0]) : null;
+    };
+    const compareAndMutate = async (expected, replacement) => {
+        const expectedId = expected.kind === "revision" ? expected.id : expected.record.id;
+        if (replacement !== undefined && replacement.id !== expectedId) {
+            throw new Error("Record comparison and replacement ids must match");
+        }
+        if (expected.kind === "revision")
+            requireRevision(expected.revision);
+        // UPDATE/DELETE never create rows, so the pre-check is only the error signal.
+        await requireKnownApp(db, appId);
+        const clauses = [];
+        const params = [];
+        if (usesCollection) {
+            if (expected.kind !== "revision")
+                throw new Error("Generic record comparisons require a revision");
+            params.push(collection, expected.id, expected.revision);
+            clauses.push("collection = $1", "id = $2", "revision = $3::bigint");
+            if (expected.value !== undefined) {
+                params.push(jsonParam(expected.value.data));
+                clauses.push(`data = $${params.length}::jsonb`);
+                params.push(expected.value.refs === undefined ? null : jsonParam(expected.value.refs));
+                clauses.push(`refs IS NOT DISTINCT FROM $${params.length}::jsonb`);
+            }
+        }
+        else {
+            if (expected.kind !== "value")
+                throw new Error("Dedicated record comparisons require an expected value");
+            params.push(expected.record.id, jsonParam(expected.record.data), expected.record.refs === undefined ? null : jsonParam(expected.record.refs));
+            clauses.push("id = $1", "data = $2::jsonb", "refs IS NOT DISTINCT FROM $3::jsonb");
+        }
+        const returning = `id, data, refs, created_at, updated_at${usesCollection ? ", revision" : ""}`;
+        if (replacement === undefined) {
+            const result = await db.query(`DELETE FROM ${table} WHERE ${clauses.join(" AND ")} RETURNING ${returning}`, params);
+            return result.rows[0] ? recordFromRow(result.rows[0]) : null;
+        }
+        params.push(jsonParam(replacement.data));
+        const dataParam = params.length;
+        params.push(replacement.refs === undefined ? null : jsonParam(replacement.refs));
+        const refsParam = params.length;
+        params.push(new Date().toISOString());
+        const updatedAtParam = params.length;
+        const result = await db.query(`UPDATE ${table}
+       SET data = $${dataParam}::jsonb, refs = $${refsParam}::jsonb, updated_at = $${updatedAtParam}${usesCollection ? ", revision = revision + 1" : ""}
+       WHERE ${clauses.join(" AND ")}
+       RETURNING ${returning}`, params);
+        return result.rows[0] ? recordFromRow(result.rows[0]) : null;
+    };
+    const atomic = {
+        async insertIfAbsent(record) {
+            const now = new Date().toISOString();
+            // Pre-check for the clean error signal; the statement's own gate is the
+            // structural guarantee (a gate lost to a racing sweep returns null —
+            // "not inserted" — never an orphan).
+            await requireKnownApp(db, appId);
+            const result = await db.query(`INSERT INTO vendo_records (collection, id, data, refs, created_at, updated_at, revision)
+         SELECT $1::text, $2::text, $3::jsonb, $4::jsonb, $5::timestamptz, $5::timestamptz, 1
+         ${appGate(6)}
+         ON CONFLICT (collection, id) DO NOTHING
+         RETURNING id, data, refs, created_at, updated_at, revision`, [collection, record.id, jsonParam(record.data), record.refs === undefined ? null : jsonParam(record.refs), now, ...appGateParams]);
+            return result.rows[0] ? recordFromRow(result.rows[0]) : null;
+        },
+        async compareAndSwap(record, expectedRevision) {
+            return await compareAndMutate({ kind: "revision", id: record.id, revision: expectedRevision }, record);
+        },
+    };
+    return {
+        get: getRecord,
+        async put(record) {
+            const now = new Date().toISOString();
+            const result = usesCollection
+                ? await db.query(`INSERT INTO vendo_records (collection, id, data, refs, created_at, updated_at, revision)
+           SELECT $1::text, $2::text, $3::jsonb, $4::jsonb, $5::timestamptz, $5::timestamptz, 1
+           ${appGate(6)}
+           ON CONFLICT (collection, id) DO UPDATE
+           SET data = EXCLUDED.data, refs = EXCLUDED.refs, updated_at = EXCLUDED.updated_at,
+               revision = vendo_records.revision + 1
+           RETURNING id, data, refs, created_at, updated_at, revision`, [collection, record.id, jsonParam(record.data), record.refs === undefined ? null : jsonParam(record.refs), now, ...appGateParams])
+                : await db.query(`INSERT INTO ${table} (id, data, refs, created_at, updated_at)
+           VALUES ($1, $2::jsonb, $3::jsonb, $4, $4)
+           ON CONFLICT (id) DO UPDATE
+           SET data = EXCLUDED.data, refs = EXCLUDED.refs, updated_at = EXCLUDED.updated_at
+           RETURNING id, data, refs, created_at, updated_at`, [record.id, jsonParam(record.data), record.refs === undefined ? null : jsonParam(record.refs), now]);
+            const row = result.rows[0];
+            if (row === undefined) {
+                // The upsert always returns a row unless the app-existence gate
+                // refused it (only present when appId is defined).
+                if (appId !== undefined)
+                    throw unknownAppError(appId);
+                throw new Error("record upsert returned no row");
+            }
+            return recordFromRow(row);
+        },
+        async claim(expected, replacement) {
+            const current = await getRecord(expected.id);
+            if (current === null || !sameRecordValue(current, expected))
+                return false;
+            let expectation;
+            if (usesCollection) {
+                if (current.revision === undefined)
+                    throw new Error("Generic record is missing its revision");
+                expectation = {
+                    kind: "revision",
+                    id: expected.id,
+                    revision: current.revision,
+                    value: expected,
+                };
+            }
+            else {
+                expectation = { kind: "value", record: expected };
+            }
+            const next = replacement === undefined
+                ? undefined
+                : {
+                    id: expected.id,
+                    data: replacement.data,
+                    ...(replacement.refs === undefined ? {} : { refs: replacement.refs }),
+                };
+            return await compareAndMutate(expectation, next) !== null;
+        },
+        async delete(id) {
+            // DELETE never creates rows, so the pre-check is only the error signal.
+            await requireKnownApp(db, appId);
+            if (usesCollection) {
+                await db.query("DELETE FROM vendo_records WHERE collection = $1 AND id = $2", [collection, id]);
+            }
+            else {
+                await db.query(`DELETE FROM ${table} WHERE id = $1`, [id]);
+            }
+        },
+        async list(query = {}) {
+            const limit = pageLimit(query.limit);
+            const clauses = usesCollection ? ["collection = $1"] : [];
+            const params = usesCollection ? [collection] : [];
+            if (query.refs !== undefined) {
+                params.push(jsonParam(query.refs));
+                clauses.push(`refs @> $${params.length}::jsonb`);
+            }
+            if (query.ids !== undefined) {
+                params.push(query.ids);
+                clauses.push(`id = ANY($${params.length}::text[])`);
+            }
+            if (query.cursor !== undefined) {
+                const cursor = decodeCursor(query.cursor);
+                params.push(cursor.c, cursor.i);
+                clauses.push(`(${cursorMs("created_at")}, id) < (${cursorMs(`$${params.length - 1}::timestamptz`)}, $${params.length})`);
+            }
+            params.push(limit + 1);
+            const result = await db.query(`SELECT id, data, refs, created_at, updated_at${usesCollection ? ", revision" : ""} FROM ${table}
+         ${clauses.length ? `WHERE ${clauses.join(" AND ")}` : ""}
+         ORDER BY ${cursorMs("created_at")} DESC, id DESC LIMIT $${params.length}`, params);
+            const rows = result.rows.slice(0, limit).map(recordFromRow);
+            const last = rows.at(-1);
+            return {
+                records: rows,
+                ...(result.rows.length > limit && last ? { cursor: encodeCursor(last.createdAt, last.id) } : {}),
+            };
+        },
+        ...(usesCollection ? { atomic } : {}),
+    };
+}
+//# sourceMappingURL=records.js.map

package/dist/records.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"records.js","sourceRoot":"","sources":["../src/records.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,UAAU,GAMX,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,UAAU,EACV,QAAQ,EACR,YAAY,EACZ,YAAY,EACZ,GAAG,EACH,SAAS,EACT,SAAS,EACT,eAAe,EACf,IAAI,EACJ,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAI5B,SAAS,aAAa,CAAC,GAA4B;IACjD,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAkC,CAAC;IAC1D,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC;IACjC,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,CAAC,OAAO,QAAQ,KAAK,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,CAAC,EAAE,CAAC;QAC9H,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnB,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC;QACjB,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QACjC,SAAS,EAAE,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACjC,SAAS,EAAE,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACjC,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;KAClE,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CACtB,OAAoB,EACpB,QAA4C;IAE5C,OAAO,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC;WAC9D,aAAa,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,aAAa,CAAC,QAAQ,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC;AACpF,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,YAAY,EAAE,2BAA2B,CAAC,CAAC;AACjG,CAAC;AAWD,kBAAkB;AAClB,MAAM,UAAU,iBAAiB,CAC/B,EAAM,EACN,UAAkB,EAClB,cAAqC;IAErC,MAAM,KAAK,GAAG,cAAc,IAAI,eAAe,CAAC;IAChD,MAAM,cAAc,GAAG,cAAc,KAAK,SAAS,CAAC;IACpD,MAAM,KAAK,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IACrC,6EAA6E;IAC7E,0EAA0E;IAC1E,4EAA4E;IAC5E,8EAA8E;IAC9E,uEAAuE;IACvE,0EAA0E;IAC1E,4EAA4E;IAC5E,6EAA6E;IAC7E,wEAAwE;IACxE,sDAAsD;IACtD,MAAM,OAAO,GAAG,CAAC,KAAa,EAAU,EAAE,CACxC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,sDAAsD,KAAK,GAAG,CAAC;IAC5F,MAAM,aAAa,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAEzD,MAAM,SAAS,GAAG,KAAK,EAAE,EAAU,EAA+B,EAAE;QAClE,MAAM,MAAM,GAAG,cAAc;YAC3B,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CACd,8GAA8G,EAC9G,CAAC,UAAU,EAAE,EAAE,CAAC,CACjB;YACD,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CACd,sDAAsD,KAAK,gBAAgB,EAC3E,CAAC,EAAE,CAAC,CACL,CAAC;QACJ,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/D,CAAC,CAAC;IAEF,MAAM,gBAAgB,GAAG,KAAK,EAC5B,QAA4B,EAC5B,WAAyB,EACI,EAAE;QAC/B,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACnF,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,CAAC,EAAE,KAAK,UAAU,EAAE,CAAC;YAC/D,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,QAAQ,CAAC,IAAI,KAAK,UAAU;YAAE,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACrE,8EAA8E;QAC9E,MAAM,eAAe,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAEjC,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAc,EAAE,CAAC;QAC7B,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,QAAQ,CAAC,IAAI,KAAK,UAAU;gBAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;YACnG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACxD,OAAO,CAAC,IAAI,CAAC,iBAAiB,EAAE,SAAS,EAAE,uBAAuB,CAAC,CAAC;YACpE,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBACjC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC5C,OAAO,CAAC,IAAI,CAAC,WAAW,MAAM,CAAC,MAAM,SAAS,CAAC,CAAC;gBAChD,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;gBACvF,OAAO,CAAC,IAAI,CAAC,8BAA8B,MAAM,CAAC,MAAM,SAAS,CAAC,CAAC;YACrE,CAAC;QACH,CAAC;aAAM,CAAC;YACN,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;YACzG,MAAM,CAAC,IAAI,CACT,QAAQ,CAAC,MAAM,CAAC,EAAE,EAClB,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAC/B,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAC5E,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,kBAAkB,EAAE,qCAAqC,CAAC,CAAC;QACrF,CAAC;QAED,MAAM,SAAS,GAAG,yCAAyC,cAAc,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QAChG,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAC3B,eAAe,KAAK,UAAU,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,SAAS,EAAE,EAC5E,MAAM,CACP,CAAC;YACF,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/D,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;QACzC,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;QACjF,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QACtC,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC;QACrC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAC3B,UAAU,KAAK;qBACA,SAAS,oBAAoB,SAAS,0BAA0B,cAAc,GAAG,cAAc,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,EAAE;eACxI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;mBACjB,SAAS,EAAE,EACxB,MAAM,CACP,CAAC;QACF,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/D,CAAC,CAAC;IAEF,MAAM,MAAM,GAAsB;QAChC,KAAK,CAAC,cAAc,CAAC,MAAM;YACzB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACrC,wEAAwE;YACxE,qEAAqE;YACrE,qCAAqC;YACrC,MAAM,eAAe,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;YACjC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAC3B;;WAEG,OAAO,CAAC,CAAC,CAAC;;oEAE+C,EAC5D,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,CAClI,CAAC;YACF,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/D,CAAC;QACD,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,gBAAgB;YAC3C,OAAO,MAAM,gBAAgB,CAC3B,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,EAC/D,MAAM,CACP,CAAC;QACJ,CAAC;KACF,CAAC;IAEF,OAAO;QACL,GAAG,EAAE,SAAS;QACd,KAAK,CAAC,GAAG,CAAC,MAAM;YACd,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACrC,MAAM,MAAM,GAAG,cAAc;gBAC3B,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CACd;;aAEG,OAAO,CAAC,CAAC,CAAC;;;;sEAI+C,EAC5D,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,CAClI;gBACD,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CACd,eAAe,KAAK;;;;4DAI8B,EAClD,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CACpG,CAAC;YACJ,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC3B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,gEAAgE;gBAChE,mDAAmD;gBACnD,IAAI,KAAK,KAAK,SAAS;oBAAE,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;gBACtD,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;YACnD,CAAC;YACD,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC;QAC5B,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,WAAW;YAC/B,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAC7C,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,QAAQ,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC1E,IAAI,WAA+B,CAAC;YACpC,IAAI,cAAc,EAAE,CAAC;gBACnB,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS;oBAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;gBAC9F,WAAW,GAAG;oBACZ,IAAI,EAAE,UAAU;oBAChB,EAAE,EAAE,QAAQ,CAAC,EAAE;oBACf,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,KAAK,EAAE,QAAQ;iBAChB,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,WAAW,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;YACpD,CAAC;YACD,MAAM,IAAI,GAAG,WAAW,KAAK,SAAS;gBACpC,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC;oBACA,EAAE,EAAE,QAAQ,CAAC,EAAE;oBACf,IAAI,EAAE,WAAW,CAAC,IAAI;oBACtB,GAAG,CAAC,WAAW,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,CAAC;iBACtE,CAAC;YACJ,OAAO,MAAM,gBAAgB,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,IAAI,CAAC;QAC5D,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,EAAE;YACb,wEAAwE;YACxE,MAAM,eAAe,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;YACjC,IAAI,cAAc,EAAE,CAAC;gBACnB,MAAM,EAAE,CAAC,KAAK,CAAC,6DAA6D,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC;YAClG,CAAC;iBAAM,CAAC;gBACN,MAAM,EAAE,CAAC,KAAK,CAAC,eAAe,KAAK,gBAAgB,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,QAAqB,EAAE;YAChC,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACrC,MAAM,OAAO,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,MAAM,MAAM,GAAc,cAAc,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC7B,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;gBACnC,OAAO,CAAC,IAAI,CAAC,YAAY,MAAM,CAAC,MAAM,SAAS,CAAC,CAAC;YACnD,CAAC;YACD,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;gBAC5B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBACvB,OAAO,CAAC,IAAI,CAAC,aAAa,MAAM,CAAC,MAAM,WAAW,CAAC,CAAC;YACtD,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC/B,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAC1C,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;gBAChC,OAAO,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,YAAY,CAAC,YAAY,QAAQ,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,eAAe,CAAC,MAAM,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;YAC3H,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YACvB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAC3B,gDAAgD,cAAc,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,SAAS,KAAK;WAC7F,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;oBAC7C,QAAQ,CAAC,YAAY,CAAC,yBAAyB,MAAM,CAAC,MAAM,EAAE,EAC1E,MAAM,CACP,CAAC;YACF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACzB,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjG,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtC,CAAC;AACJ,CAAC"}

package/dist/routing.d.ts

@@ -0,0 +1,7 @@
+import { type RecordStore } from "@vendoai/core";
+import type { Db } from "./db.js";
+export declare const RESERVED_COLLECTIONS: readonly ["vendo_grants", "vendo_approvals", "vendo_audit", "vendo_threads", "vendo_runs", "vendo_apps", "vendo_state"];
+export declare const DEDICATED_RECORD_COLLECTIONS: readonly ["vendo_mcp_clients", "vendo_mcp_grants"];
+export type ReservedCollection = typeof RESERVED_COLLECTIONS[number];
+export declare function createReservedRecordStore(db: Db, collection: string): RecordStore | undefined;
+//# sourceMappingURL=routing.d.ts.map

package/dist/routing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routing.d.ts","sourceRoot":"","sources":["../src/routing.ts"],"names":[],"mappings":"AAAA,OAAO,EAML,KAAK,WAAW,EAEjB,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,SAAS,CAAC;AAmClC,eAAO,MAAM,oBAAoB,yHAQvB,CAAC;AAEX,eAAO,MAAM,4BAA4B,oDAAqD,CAAC;AAE/F,MAAM,MAAM,kBAAkB,GAAG,OAAO,oBAAoB,CAAC,MAAM,CAAC,CAAC;AAsarE,wBAAgB,yBAAyB,CACvC,EAAE,EAAE,EAAE,EACN,UAAU,EAAE,MAAM,GACjB,WAAW,GAAG,SAAS,CAMzB"}

package/dist/routing.js

@@ -0,0 +1,393 @@
+import { VendoError, } from "@vendoai/core";
+import { createRecordStore, requireRevision } from "./records.js";
+import { appFromRow, approvalFromRow, grantFromRow, putAppRow, putApprovalRow, putAuditRow, putGrantRow, putRunRow, putStateRow, putThreadRow, runFromRow, stateRowFromRow, threadFromRow, } from "./helpers/rows.js";
+import { cursorMs, decodeCursor, encodeCursor, pageLimit } from "./helpers/utils.js";
+import { invalid, parseAppData, parseApprovalData, parseAuditEvent, parsePermissionGrant, parseRunData, parseThreadData, requireJson, requireMatchingId, requireRecordId, } from "./validate.js";
+export const RESERVED_COLLECTIONS = [
+    "vendo_grants",
+    "vendo_approvals",
+    "vendo_audit",
+    "vendo_threads",
+    "vendo_runs",
+    "vendo_apps",
+    "vendo_state",
+];
+export const DEDICATED_RECORD_COLLECTIONS = ["vendo_mcp_clients", "vendo_mcp_grants"];
+function refs(values) {
+    return Object.fromEntries(Object.entries(values).filter((entry) => entry[1] !== undefined));
+}
+function grantRecord(grant) {
+    return {
+        id: grant.id,
+        data: grant,
+        refs: refs({ subject: grant.subject, tool: grant.tool, app_id: grant.appId }),
+        createdAt: grant.grantedAt,
+        updatedAt: grant.revokedAt ?? grant.grantedAt,
+    };
+}
+function approvalRecord(row) {
+    const data = {
+        request: row.request,
+        status: row.status,
+        ...(row.decidedAt === undefined ? {} : { decidedAt: row.decidedAt }),
+        ...(row.sessionId === undefined ? {} : { sessionId: row.sessionId }),
+        ...(row.consumedAt === undefined ? {} : { consumedAt: row.consumedAt }),
+    };
+    return {
+        id: row.id,
+        data,
+        refs: { subject: row.subject, status: row.status },
+        createdAt: row.request.createdAt,
+        updatedAt: row.consumedAt ?? row.decidedAt ?? row.request.createdAt,
+    };
+}
+function auditRecord(event) {
+    return {
+        id: event.id,
+        data: event,
+        refs: refs({
+            subject: event.principal.subject,
+            kind: event.kind,
+            app_id: event.appId,
+            tool: event.tool,
+        }),
+        createdAt: event.at,
+        updatedAt: event.at,
+    };
+}
+function threadRecord(row) {
+    const data = {
+        subject: row.subject,
+        messages: row.messages,
+        ...(row.title === undefined || row.title === null ? {} : { title: row.title }),
+    };
+    return {
+        id: row.id,
+        data,
+        refs: { subject: row.subject },
+        createdAt: row.createdAt,
+        updatedAt: row.updatedAt,
+        // Present when the row carries the write counter (01 §12: opaque token when
+        // atomic is present); the messages-less listSelect projection omits it.
+        ...(row.revision === undefined ? {} : { revision: row.revision }),
+    };
+}
+function runRecord(row) {
+    const { id, ...data } = row;
+    return {
+        id,
+        data,
+        refs: { app_id: row.appId, status: row.status },
+        createdAt: row.startedAt,
+        updatedAt: row.finishedAt ?? row.startedAt,
+    };
+}
+function appRecord(row) {
+    const data = { subject: row.subject, enabled: row.enabled, doc: row.doc };
+    return {
+        id: row.id,
+        data,
+        // trigger_kind mirrors the persisted generated column (schema.ts) so the
+        // automations tick / emit query can filter on it.
+        refs: refs({ subject: row.subject, trigger_kind: row.doc.trigger?.on.kind }),
+        createdAt: row.createdAt,
+        updatedAt: row.updatedAt,
+        // Present when the row carries the write counter (01 §12: opaque token
+        // when atomic is present) — Wave 7's lifecycle/schedule-claim arbitration.
+        ...(row.revision === undefined ? {} : { revision: row.revision }),
+    };
+}
+function stateRecord(row) {
+    return {
+        id: `${row.appId}:${row.subject}`,
+        data: row.data,
+        refs: { app_id: row.appId, subject: row.subject },
+        createdAt: row.createdAt,
+        updatedAt: row.updatedAt,
+    };
+}
+/**
+ * apps writes state through `records("vendo_state")` with id `${appId}:${subject}`.
+ * App ids are `app_...` and never contain a colon, so the first colon splits id into
+ * its app_id and subject (subjects may themselves contain colons).
+ *
+ * The colon-free app-id shape is REQUIRED, not assumed: without it `<appId>:<subject>`
+ * is not uniquely decodable — (app_a:b, c) and (app_a, b:c) would both encode to
+ * "app_a:b:c" and collide on read/write/delete. The apps runtime mints colon-free
+ * ids; this enforces it at the door so a doctored id can never target another row.
+ */
+const APP_ID_SEGMENT = /^app_[^:]+$/;
+function splitStateId(id) {
+    const colon = id.indexOf(":");
+    if (colon === -1)
+        invalid(`vendo_state record id must be "<appId>:<subject>": ${id}`);
+    const appId = id.slice(0, colon);
+    if (!APP_ID_SEGMENT.test(appId)) {
+        invalid(`vendo_state record id must start with a colon-free app id ("app_..."): ${id}`);
+    }
+    const subject = id.slice(colon + 1);
+    // An empty subject ("app_x:") would route a state row to no principal — reject it
+    // (the apps runtime always writes a non-empty subject).
+    if (subject === "") {
+        invalid(`vendo_state record id must have a non-empty subject after the colon: ${id}`);
+    }
+    return { appId, subject };
+}
+function createTableRecordStore(db, config) {
+    return {
+        async get(id) {
+            requireRecordId(id);
+            const result = await db.query(`${config.select} WHERE id = $1`, [id]);
+            return result.rows[0] ? config.fromDb(result.rows[0]) : null;
+        },
+        async put(record) {
+            requireRecordId(record.id);
+            // Reserved collections derive refs from typed columns; caller refs never participate in writes.
+            return await config.put(record);
+        },
+        async delete(id) {
+            requireRecordId(id);
+            if (config.appendOnly === true) {
+                throw new VendoError("blocked", `${config.table} is append-only; rows are erased only via the store erase API (02-store §5)`);
+            }
+            config.validateId?.(id);
+            await db.query(`DELETE FROM ${config.table} WHERE id = $1`, [id]);
+        },
+        async list(query = {}) {
+            const limit = pageLimit(query.limit);
+            if (query.refs !== undefined) {
+                for (const key of Object.keys(query.refs)) {
+                    if (config.refs[key] === undefined)
+                        invalid(`Unknown ${config.table} ref key: ${key}`);
+                }
+            }
+            const params = [];
+            const clauses = [];
+            for (const [key, value] of Object.entries(query.refs ?? {})) {
+                params.push(value);
+                clauses.push(`${config.refs[key]} = $${params.length}`);
+            }
+            if (query.ids !== undefined) {
+                params.push(query.ids);
+                clauses.push(`id = ANY($${params.length}::text[])`);
+            }
+            if (query.cursor !== undefined) {
+                const cursor = decodeCursor(query.cursor);
+                params.push(cursor.c, cursor.i);
+                clauses.push(`(${cursorMs(config.cursorColumn)}, id) < (${cursorMs(`$${params.length - 1}::timestamptz`)}, $${params.length})`);
+            }
+            params.push(limit + 1);
+            const result = await db.query(`${config.listSelect ?? config.select}${clauses.length ? ` WHERE ${clauses.join(" AND ")}` : ""}
+         ORDER BY ${cursorMs(config.cursorColumn)} DESC, id DESC LIMIT $${params.length}`, params);
+            const records = result.rows.slice(0, limit).map(config.fromDb);
+            const last = records.at(-1);
+            return {
+                records,
+                ...(result.rows.length > limit && last ? { cursor: encodeCursor(last.createdAt, last.id) } : {}),
+            };
+        },
+        ...(config.atomic === undefined ? {} : { atomic: config.atomic }),
+    };
+}
+function configFor(db, collection) {
+    switch (collection) {
+        case "vendo_grants":
+            return {
+                table: collection,
+                select: "SELECT * FROM vendo_grants",
+                cursorColumn: "granted_at",
+                refs: { subject: "subject", tool: "tool", app_id: "app_id" },
+                fromDb: (row) => grantRecord(grantFromRow(row)),
+                async put(record) {
+                    const grant = parsePermissionGrant(record.data);
+                    requireMatchingId(record.id, grant.id, "permission grant id");
+                    // The guarded upsert refuses cross-subject flips (02 §2).
+                    await putGrantRow(db, grant);
+                    return grantRecord(grant);
+                },
+            };
+        case "vendo_approvals":
+            return {
+                table: collection,
+                select: "SELECT * FROM vendo_approvals",
+                cursorColumn: "created_at",
+                refs: { subject: "subject", status: "status" },
+                fromDb: (row) => approvalRecord(approvalFromRow(row)),
+                async put(record) {
+                    const data = parseApprovalData(record.data, record.id);
+                    const row = {
+                        id: data.request.id,
+                        subject: data.request.ctx.principal.subject,
+                        request: data.request,
+                        status: data.status,
+                        ...(data.decidedAt === undefined ? {} : { decidedAt: data.decidedAt }),
+                        ...(data.sessionId === undefined ? {} : { sessionId: data.sessionId }),
+                        ...(data.consumedAt === undefined ? {} : { consumedAt: data.consumedAt }),
+                        createdAt: data.request.createdAt,
+                    };
+                    await putApprovalRow(db, row);
+                    return approvalRecord(row);
+                },
+            };
+        case "vendo_audit":
+            return {
+                table: collection,
+                select: "SELECT * FROM vendo_audit",
+                appendOnly: true,
+                cursorColumn: "at",
+                refs: { subject: "subject", kind: "kind", app_id: "app_id", tool: "tool" },
+                fromDb: (row) => auditRecord(row["event"]),
+                async put(record) {
+                    const event = parseAuditEvent(record.data);
+                    requireMatchingId(record.id, event.id, "audit event id");
+                    // putAuditRow refuses to replace an existing row (append-only, 02 §2).
+                    await putAuditRow(db, event);
+                    return auditRecord(event);
+                },
+            };
+        case "vendo_threads":
+            return {
+                table: collection,
+                select: "SELECT * FROM vendo_threads",
+                // Listing derives only a title + timestamps; skip the (potentially large) messages
+                // column once a row carries a stored title. Legacy rows (title still NULL, written
+                // before the column existed) keep returning messages so the title stays derivable.
+                listSelect: `SELECT id, subject, title,
+           CASE WHEN title IS NULL THEN messages ELSE '[]'::jsonb END AS messages,
+           created_at, updated_at FROM vendo_threads`,
+                cursorColumn: "created_at",
+                refs: { subject: "subject" },
+                fromDb: (row) => threadRecord(threadFromRow(row)),
+                async put(record) {
+                    const data = parseThreadData(record.data, record.id);
+                    // The guarded upsert refuses cross-subject flips (03 §5).
+                    const row = await putThreadRow(db, { id: record.id, ...data });
+                    return threadRecord(row);
+                },
+                // ENG-310: guarded writes (01 §12) backed by the vendo_threads revision
+                // counter, so a concurrent-turn persist can read-merge-write without
+                // last-write-wins clobbering. Both verbs keep the same cross-subject
+                // refusal as put: a foreign-subject write NEVER lands (it just loses —
+                // insertIfAbsent finds the id taken, compareAndSwap's guarded WHERE
+                // fails — and returns null).
+                atomic: {
+                    async insertIfAbsent(record) {
+                        requireRecordId(record.id);
+                        const data = parseThreadData(record.data, record.id);
+                        const now = new Date().toISOString();
+                        const result = await db.query(`INSERT INTO vendo_threads (id, subject, messages, title, created_at, updated_at, revision)
+               VALUES ($1, $2, $3::jsonb, $4, $5, $5, 1)
+               ON CONFLICT (id) DO NOTHING
+               RETURNING id, subject, messages, title, created_at, updated_at, revision`, [record.id, data.subject, JSON.stringify(data.messages), data.title ?? null, now]);
+                        return result.rows[0]
+                            ? threadRecord(threadFromRow(result.rows[0]))
+                            : null;
+                    },
+                    async compareAndSwap(record, expectedRevision) {
+                        requireRecordId(record.id);
+                        requireRevision(expectedRevision);
+                        const data = parseThreadData(record.data, record.id);
+                        const now = new Date().toISOString();
+                        const result = await db.query(`UPDATE vendo_threads
+               SET messages = $3::jsonb, title = $4, updated_at = $5, revision = revision + 1
+               WHERE id = $1 AND subject = $2 AND revision = $6::bigint
+               RETURNING id, subject, messages, title, created_at, updated_at, revision`, [record.id, data.subject, JSON.stringify(data.messages), data.title ?? null, now, expectedRevision]);
+                        return result.rows[0]
+                            ? threadRecord(threadFromRow(result.rows[0]))
+                            : null;
+                    },
+                },
+            };
+        case "vendo_runs":
+            return {
+                table: collection,
+                select: "SELECT * FROM vendo_runs",
+                cursorColumn: "started_at",
+                refs: { app_id: "app_id", status: "status" },
+                fromDb: (row) => runRecord(runFromRow(row)),
+                async put(record) {
+                    const data = parseRunData(record.data, record.id);
+                    const row = { id: record.id, ...data };
+                    await putRunRow(db, row);
+                    return runRecord(row);
+                },
+            };
+        case "vendo_apps":
+            return {
+                table: collection,
+                select: "SELECT * FROM vendo_apps",
+                cursorColumn: "created_at",
+                refs: { subject: "subject", trigger_kind: "trigger_kind" },
+                fromDb: (row) => appRecord(appFromRow(row)),
+                async put(record) {
+                    const data = parseAppData(record.data, record.id);
+                    // The guarded upsert refuses cross-subject flips (02 §2).
+                    const row = await putAppRow(db, { id: record.id, ...data });
+                    return appRecord(row);
+                },
+                // Wave 7: guarded writes (01 §12) backed by the vendo_apps revision
+                // counter, so the machine lifecycle and the schedule engine's fire
+                // claims (updateAppRow's read-mutate-CAS) arbitrate racers on the dev
+                // store instead of degrading to read-then-put. Both verbs keep the
+                // same cross-subject refusal as put: a foreign-subject write NEVER
+                // lands (insertIfAbsent finds the id taken, compareAndSwap's guarded
+                // WHERE fails — and returns null). The doc's trigger_kind projection
+                // is a generated column, so guarded writes keep it for free.
+                atomic: {
+                    async insertIfAbsent(record) {
+                        requireRecordId(record.id);
+                        const data = parseAppData(record.data, record.id);
+                        const now = new Date().toISOString();
+                        const result = await db.query(`INSERT INTO vendo_apps (id, subject, enabled, doc, created_at, updated_at, revision)
+               VALUES ($1, $2, $3, $4::jsonb, $5, $5, 1)
+               ON CONFLICT (id) DO NOTHING
+               RETURNING id, subject, enabled, doc, created_at, updated_at, revision`, [record.id, data.subject, data.enabled, JSON.stringify(data.doc), now]);
+                        return result.rows[0]
+                            ? appRecord(appFromRow(result.rows[0]))
+                            : null;
+                    },
+                    async compareAndSwap(record, expectedRevision) {
+                        requireRecordId(record.id);
+                        requireRevision(expectedRevision);
+                        const data = parseAppData(record.data, record.id);
+                        const now = new Date().toISOString();
+                        const result = await db.query(`UPDATE vendo_apps
+               SET enabled = $3, doc = $4::jsonb, updated_at = $5, revision = revision + 1
+               WHERE id = $1 AND subject = $2 AND revision = $6::bigint
+               RETURNING id, subject, enabled, doc, created_at, updated_at, revision`, [record.id, data.subject, data.enabled, JSON.stringify(data.doc), now, expectedRevision]);
+                        return result.rows[0]
+                            ? appRecord(appFromRow(result.rows[0]))
+                            : null;
+                    },
+                },
+            };
+        case "vendo_state":
+            return {
+                table: collection,
+                // `id` is the generated (app_id || ':' || subject) column — a real,
+                // indexed column, so point lookups and id filters no longer seq-scan.
+                select: "SELECT id, app_id, subject, data, created_at, updated_at FROM vendo_state",
+                // Page on the STABLE created_at (like every other collection), not the
+                // mutable updated_at — a mid-sweep update must never skip an unvisited row.
+                cursorColumn: "created_at",
+                refs: { app_id: "app_id", subject: "subject" },
+                fromDb: (row) => stateRecord(stateRowFromRow(row)),
+                validateId: (id) => void splitStateId(id),
+                async put(record) {
+                    const { appId, subject } = splitStateId(record.id);
+                    const data = requireJson(record.data, "state data");
+                    // Shared persistent write path with stateStore.put (helpers/rows).
+                    return stateRecord(await putStateRow(db, { appId, subject, data }));
+                },
+            };
+    }
+}
+export function createReservedRecordStore(db, collection) {
+    if (DEDICATED_RECORD_COLLECTIONS.includes(collection)) {
+        return createRecordStore(db, collection, collection);
+    }
+    if (!RESERVED_COLLECTIONS.includes(collection))
+        return undefined;
+    return createTableRecordStore(db, configFor(db, collection));
+}
+//# sourceMappingURL=routing.js.map