@vendoai/store 0.1.0 → 0.4.1

package/dist/helpers/state.d.ts

@@ -0,0 +1,9 @@
+import type { AppId, Json, Principal } from "@vendoai/core";
+import { type VendoStore } from "../store.js";
+/** 02-store §3 */
+export declare function stateStore(store: VendoStore): {
+    get(principal: Principal, appId: AppId): Promise<Json | null>;
+    put(principal: Principal, appId: AppId, data: Json): Promise<void>;
+    delete(principal: Principal, appId: AppId): Promise<void>;
+};
+//# sourceMappingURL=state.d.ts.map

package/dist/helpers/state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.d.ts","sourceRoot":"","sources":["../../src/helpers/state.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE5D,OAAO,EAAS,KAAK,UAAU,EAAE,MAAM,aAAa,CAAC;AAGrD,kBAAkB;AAClB,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG;IAC7C,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IAC9D,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3D,CAmBA"}

package/dist/helpers/state.js

@@ -0,0 +1,22 @@
+import { putStateRow } from "./rows.js";
+import { dbFor } from "../store.js";
+import { requireJson } from "../validate.js";
+/** 02-store §3 */
+export function stateStore(store) {
+    const db = dbFor(store);
+    return {
+        async get(principal, appId) {
+            const result = await db.query("SELECT data FROM vendo_state WHERE app_id = $1 AND subject = $2", [appId, principal.subject]);
+            return result.rows[0]?.["data"] ?? null;
+        },
+        async put(principal, appId, data) {
+            const parsedData = requireJson(data, "state data");
+            // Shared write path with the routed seam (helpers/rows putStateRow).
+            await putStateRow(db, { appId, subject: principal.subject, data: parsedData });
+        },
+        async delete(principal, appId) {
+            await db.query("DELETE FROM vendo_state WHERE app_id = $1 AND subject = $2", [appId, principal.subject]);
+        },
+    };
+}
+//# sourceMappingURL=state.js.map

package/dist/helpers/state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.js","sourceRoot":"","sources":["../../src/helpers/state.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,KAAK,EAAmB,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAE7C,kBAAkB;AAClB,MAAM,UAAU,UAAU,CAAC,KAAiB;IAK1C,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IACxB,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK;YACxB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAC3B,iEAAiE,EACjE,CAAC,KAAK,EAAE,SAAS,CAAC,OAAO,CAAC,CAC3B,CAAC;YACF,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC;QAC1C,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI;YAC9B,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;YACnD,qEAAqE;YACrE,MAAM,WAAW,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK;YAC3B,MAAM,EAAE,CAAC,KAAK,CAAC,4DAA4D,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QAC3G,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/helpers/subjects.d.ts

@@ -0,0 +1,32 @@
+import { type VendoStore } from "../store.js";
+/** What an anonymous→signed-in merge moved (block-actions design §C). */
+export interface SubjectMergeReport {
+    apps: number;
+    threads: number;
+    states: number;
+    /** Rows whose slot the signed-in subject already owned — NEVER overwritten
+        (a merge cannot replace the target's data); the anonymous copy is dropped. */
+    skipped: number;
+}
+/** Block-actions design §C — anonymous→signed-in auto-merge. One of the two
+    sanctioned doors through 02-store §2's "rows never cross subjects": the
+    first authenticated request carrying a valid anonymous cookie adopts the
+    anonymous session's threads, apps (with their per-app record/blob
+    collections, which travel with app ownership), and state into the
+    signed-in subject.
+
+    Deliberately NOT migrated — consent does not transfer identities:
+      - grants and approvals (users re-approve as themselves),
+      - connected accounts (Composio keys them by subject; users reconnect),
+      - audit and run history (history is a record of what the anonymous
+        principal did; it is not rewritten).
+    The dropped rows are DELETED with the session (kill-list B3: anonymous rows
+    are disk rows now).
+
+    Idempotent: an anonymous subject that was never registered (or was already
+    merged) returns null and moves nothing. Nothing is ever stolen: apps and
+    threads are keyed by unique ids the write doors already refuse to flip
+    across subjects, and a state row that collides with one the signed-in
+    subject already owns is skipped, never overwritten. */
+export declare function adoptEphemeralSubject(store: VendoStore, from: string, to: string): Promise<SubjectMergeReport | null>;
+//# sourceMappingURL=subjects.d.ts.map

package/dist/helpers/subjects.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"subjects.d.ts","sourceRoot":"","sources":["../../src/helpers/subjects.ts"],"names":[],"mappings":"AAEA,OAAO,EAAS,KAAK,UAAU,EAAE,MAAM,aAAa,CAAC;AAErD,yEAAyE;AACzE,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf;qFACiF;IACjF,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;;;;;;;0DAmB0D;AAC1D,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,UAAU,EACjB,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAyEpC"}

package/dist/helpers/subjects.js

@@ -0,0 +1,78 @@
+import { isReservedSubject, VendoError } from "@vendoai/core";
+import { isEphemeralSubject } from "../sessions.js";
+import { dbFor } from "../store.js";
+/** Block-actions design §C — anonymous→signed-in auto-merge. One of the two
+    sanctioned doors through 02-store §2's "rows never cross subjects": the
+    first authenticated request carrying a valid anonymous cookie adopts the
+    anonymous session's threads, apps (with their per-app record/blob
+    collections, which travel with app ownership), and state into the
+    signed-in subject.
+
+    Deliberately NOT migrated — consent does not transfer identities:
+      - grants and approvals (users re-approve as themselves),
+      - connected accounts (Composio keys them by subject; users reconnect),
+      - audit and run history (history is a record of what the anonymous
+        principal did; it is not rewritten).
+    The dropped rows are DELETED with the session (kill-list B3: anonymous rows
+    are disk rows now).
+
+    Idempotent: an anonymous subject that was never registered (or was already
+    merged) returns null and moves nothing. Nothing is ever stolen: apps and
+    threads are keyed by unique ids the write doors already refuse to flip
+    across subjects, and a state row that collides with one the signed-in
+    subject already owns is skipped, never overwritten. */
+export async function adoptEphemeralSubject(store, from, to) {
+    if (from === to)
+        throw new VendoError("validation", "cannot merge a subject into itself");
+    if (isReservedSubject(to)) {
+        throw new VendoError("validation", "cannot merge an anonymous session into a reserved subject");
+    }
+    if (await isEphemeralSubject(store, to)) {
+        throw new VendoError("validation", "cannot merge an anonymous session into an ephemeral subject");
+    }
+    const db = dbFor(store);
+    // Claim-first serialization with the TTL sweep (sessions.ts): deleting the
+    // session row is the mutual-exclusion point. Losing the claim means the
+    // subject was never registered, was already merged, or a concurrent sweep
+    // owns it — this merge moves nothing. Winning it means no sweep can erase
+    // the subject's rows while they are moved. The trade: a transient failure
+    // MID-merge (after the claim) strands the unmoved remainder as unregistered
+    // rows a retry can no longer see — bounded by 02 §4's lingers-like-durable
+    // semantics (an explicit erase.bySubject still reaches them).
+    const claimed = await db.query("DELETE FROM vendo_sessions WHERE subject = $1 RETURNING 1", [from]);
+    if (claimed.rows[0] === undefined)
+        return null;
+    const report = { apps: 0, threads: 0, states: 0, skipped: 0 };
+    // Apps move by flipping the subject column. Ids are the vendo_apps PRIMARY
+    // KEY and the write doors refuse cross-subject flips, so `from`'s app ids
+    // can never collide with anyone else's rows. The app's record collections
+    // and blob namespaces (`app:<appId>:...`) are keyed by app id, not subject —
+    // they travel with the ownership flip untouched.
+    const movedApps = await db.query("UPDATE vendo_apps SET subject = $2 WHERE subject = $1 RETURNING id", [from, to]);
+    report.apps = movedApps.rows.length;
+    // Threads: same shape (unique PRIMARY KEY id, door-guarded).
+    const movedThreads = await db.query("UPDATE vendo_threads SET subject = $2 WHERE subject = $1 RETURNING id", [from, to]);
+    report.threads = movedThreads.rows.length;
+    // State is keyed (app_id, subject), so the signed-in subject may already
+    // hold a row for the same app — that existing row wins; the anonymous copy
+    // is skipped and dropped.
+    const movedStates = await db.query(`UPDATE vendo_state SET subject = $2 WHERE subject = $1
+       AND NOT EXISTS (
+         SELECT 1 FROM vendo_state existing
+         WHERE existing.app_id = vendo_state.app_id AND existing.subject = $2
+       )
+     RETURNING app_id`, [from, to]);
+    report.states = movedStates.rows.length;
+    const skippedStates = await db.query("DELETE FROM vendo_state WHERE subject = $1 RETURNING app_id", [from]);
+    report.skipped += skippedStates.rows.length;
+    // Everything else the anonymous subject accrued is deliberately dropped:
+    // grants, approvals, audit, and the run history of its (now adopted) apps.
+    await db.query("DELETE FROM vendo_grants WHERE subject = $1", [from]);
+    await db.query("DELETE FROM vendo_approvals WHERE subject = $1", [from]);
+    await db.query("DELETE FROM vendo_audit WHERE subject = $1", [from]);
+    if (report.apps > 0) {
+        await db.query("DELETE FROM vendo_runs WHERE app_id = ANY($1::text[])", [movedApps.rows.map((row) => String(row["id"]))]);
+    }
+    return report;
+}
+//# sourceMappingURL=subjects.js.map

package/dist/helpers/subjects.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"subjects.js","sourceRoot":"","sources":["../../src/helpers/subjects.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAE,KAAK,EAAmB,MAAM,aAAa,CAAC;AAYrD;;;;;;;;;;;;;;;;;;;0DAmB0D;AAC1D,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAAiB,EACjB,IAAY,EACZ,EAAU;IAEV,IAAI,IAAI,KAAK,EAAE;QAAE,MAAM,IAAI,UAAU,CAAC,YAAY,EAAE,oCAAoC,CAAC,CAAC;IAC1F,IAAI,iBAAiB,CAAC,EAAE,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,UAAU,CAAC,YAAY,EAAE,2DAA2D,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,MAAM,kBAAkB,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,UAAU,CAAC,YAAY,EAAE,6DAA6D,CAAC,CAAC;IACpG,CAAC;IACD,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IACxB,2EAA2E;IAC3E,wEAAwE;IACxE,0EAA0E;IAC1E,0EAA0E;IAC1E,0EAA0E;IAC1E,4EAA4E;IAC5E,2EAA2E;IAC3E,8DAA8D;IAC9D,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,KAAK,CAC5B,2DAA2D,EAC3D,CAAC,IAAI,CAAC,CACP,CAAC;IACF,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC/C,MAAM,MAAM,GAAuB,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAElF,2EAA2E;IAC3E,0EAA0E;IAC1E,0EAA0E;IAC1E,6EAA6E;IAC7E,iDAAiD;IACjD,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,KAAK,CAC9B,oEAAoE,EACpE,CAAC,IAAI,EAAE,EAAE,CAAC,CACX,CAAC;IACF,MAAM,CAAC,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC;IAEpC,6DAA6D;IAC7D,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC,KAAK,CACjC,uEAAuE,EACvE,CAAC,IAAI,EAAE,EAAE,CAAC,CACX,CAAC;IACF,MAAM,CAAC,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC;IAE1C,yEAAyE;IACzE,2EAA2E;IAC3E,0BAA0B;IAC1B,MAAM,WAAW,GAAG,MAAM,EAAE,CAAC,KAAK,CAChC;;;;;sBAKkB,EAClB,CAAC,IAAI,EAAE,EAAE,CAAC,CACX,CAAC;IACF,MAAM,CAAC,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC;IACxC,MAAM,aAAa,GAAG,MAAM,EAAE,CAAC,KAAK,CAClC,6DAA6D,EAC7D,CAAC,IAAI,CAAC,CACP,CAAC;IACF,MAAM,CAAC,OAAO,IAAI,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC;IAE5C,yEAAyE;IACzE,2EAA2E;IAC3E,MAAM,EAAE,CAAC,KAAK,CAAC,6CAA6C,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IACtE,MAAM,EAAE,CAAC,KAAK,CAAC,gDAAgD,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IACzE,MAAM,EAAE,CAAC,KAAK,CAAC,4CAA4C,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IACrE,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,EAAE,CAAC,KAAK,CACZ,uDAAuD,EACvD,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CACjD,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/helpers/threads.d.ts

@@ -0,0 +1,19 @@
+import type { Json, Principal, ThreadId } from "@vendoai/core";
+import { type VendoStore } from "../store.js";
+import type { ThreadRow } from "./types.js";
+/** 02-store §3 */
+export declare function threadStore(store: VendoStore): {
+    put(principal: Principal, thread: {
+        id: ThreadId;
+        messages: Json[];
+    }): Promise<ThreadRow>;
+    get(principal: Principal, id: ThreadId): Promise<ThreadRow | null>;
+    list(principal: Principal): Promise<Array<{
+        id: ThreadId;
+        createdAt: string;
+        updatedAt: string;
+    }>>;
+    delete(principal: Principal, id: ThreadId): Promise<void>;
+};
+export type { ThreadRow } from "./types.js";
+//# sourceMappingURL=threads.d.ts.map

package/dist/helpers/threads.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"threads.d.ts","sourceRoot":"","sources":["../../src/helpers/threads.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC/D,OAAO,EAAS,KAAK,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAK5C,kBAAkB;AAClB,wBAAgB,WAAW,CAAC,KAAK,EAAE,UAAU,GAAG;IAC9C,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE;QAAE,EAAE,EAAE,QAAQ,CAAC;QAAC,QAAQ,EAAE,IAAI,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAC1F,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IACnE,IAAI,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC;QAAE,EAAE,EAAE,QAAQ,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;IACnG,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3D,CAqCA;AAED,YAAY,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC"}

package/dist/helpers/threads.js

@@ -0,0 +1,38 @@
+import { dbFor } from "../store.js";
+import { putThreadRow, threadFromRow } from "./rows.js";
+import { iso, text } from "./utils.js";
+import { parseThreadData } from "../validate.js";
+/** 02-store §3 */
+export function threadStore(store) {
+    const db = dbFor(store);
+    return {
+        async put(principal, thread) {
+            const parsed = parseThreadData({ subject: principal.subject, messages: thread.messages }, thread.id);
+            // Threads never cross subjects (03 §5): the guarded upsert refuses a
+            // foreign-owned id atomically.
+            return putThreadRow(db, {
+                id: thread.id,
+                subject: parsed.subject,
+                messages: parsed.messages,
+            });
+        },
+        async get(principal, id) {
+            const result = await db.query(`SELECT id, subject, messages, title, created_at, updated_at, revision FROM vendo_threads
+         WHERE id = $1 AND subject = $2`, [id, principal.subject]);
+            return result.rows[0] ? threadFromRow(result.rows[0]) : null;
+        },
+        async list(principal) {
+            const result = await db.query(`SELECT id, created_at, updated_at FROM vendo_threads WHERE subject = $1
+         ORDER BY updated_at DESC, id DESC`, [principal.subject]);
+            return result.rows.map((row) => ({
+                id: text(row["id"]),
+                createdAt: iso(row["created_at"]),
+                updatedAt: iso(row["updated_at"]),
+            }));
+        },
+        async delete(principal, id) {
+            await db.query("DELETE FROM vendo_threads WHERE id = $1 AND subject = $2", [id, principal.subject]);
+        },
+    };
+}
+//# sourceMappingURL=threads.js.map

package/dist/helpers/threads.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"threads.js","sourceRoot":"","sources":["../../src/helpers/threads.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,EAAmB,MAAM,aAAa,CAAC;AAErD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AACxD,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEjD,kBAAkB;AAClB,MAAM,UAAU,WAAW,CAAC,KAAiB;IAM3C,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IACxB,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM;YACzB,MAAM,MAAM,GAAG,eAAe,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;YACrG,qEAAqE;YACrE,+BAA+B;YAC/B,OAAO,YAAY,CAAC,EAAE,EAAE;gBACtB,EAAE,EAAE,MAAM,CAAC,EAAE;gBACb,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;aAC1B,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE;YACrB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAC3B;wCACgC,EAChC,CAAC,EAAE,EAAE,SAAS,CAAC,OAAO,CAAC,CACxB,CAAC;YACF,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/D,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,SAAS;YAClB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAC3B;2CACmC,EACnC,CAAC,SAAS,CAAC,OAAO,CAAC,CACpB,CAAC;YACF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBAC/B,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACnB,SAAS,EAAE,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;gBACjC,SAAS,EAAE,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;aAClC,CAAC,CAAC,CAAC;QACN,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE;YACxB,MAAM,EAAE,CAAC,KAAK,CAAC,0DAA0D,EAAE,CAAC,EAAE,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QACtG,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/helpers/types.d.ts

@@ -0,0 +1,60 @@
+import type { AppDocument, AppId, ApprovalId, ApprovalRequest, IsoDateTime, Json, RunId, ThreadId, TriggerSource } from "@vendoai/core";
+/** 02-store §3 */
+export interface AppRow {
+    id: AppId;
+    subject: string;
+    enabled: boolean;
+    doc: AppDocument;
+    createdAt: IsoDateTime;
+    updatedAt: IsoDateTime;
+    /** Opaque write counter backing the routed atomic capability (01 §12); bumped
+     *  on every write. Wave 7 — arbitration for the machine lifecycle and the
+     *  schedule engine's fire claims (updateAppRow's read-mutate-CAS). */
+    revision?: string;
+}
+/** 02-store §3 */
+export interface ThreadRow {
+    id: ThreadId;
+    subject: string;
+    messages: Json[];
+    /** Precomputed listing title (03 §5); lets `list` skip loading the messages array. */
+    title?: string;
+    createdAt: IsoDateTime;
+    updatedAt: IsoDateTime;
+    /** Opaque write counter backing the routed atomic capability (01 §12); bumped
+     *  on every write. Absent only on projections that never carry it (listSelect). */
+    revision?: string;
+}
+/** 02-store §3 */
+export interface ApprovalRow {
+    id: ApprovalId;
+    subject: string;
+    request: ApprovalRequest;
+    status: "pending" | "approved" | "denied";
+    decidedAt?: IsoDateTime;
+    sessionId?: string;
+    consumedAt?: IsoDateTime;
+    createdAt: IsoDateTime;
+}
+/** 02-store §3 */
+export interface RunRow {
+    id: RunId;
+    appId: AppId;
+    trigger: {
+        kind: TriggerSource["kind"];
+        event?: string;
+    };
+    status: "running" | "ok" | "error" | "stopped" | "pending-approval";
+    record: Json;
+    startedAt: IsoDateTime;
+    finishedAt?: IsoDateTime;
+}
+/** 02-store §3 — one per-user-per-app state singleton row. */
+export interface StateRow {
+    appId: AppId;
+    subject: string;
+    data: Json;
+    createdAt: IsoDateTime;
+    updatedAt: IsoDateTime;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/helpers/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/helpers/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,WAAW,EACX,KAAK,EACL,UAAU,EACV,eAAe,EACf,WAAW,EACX,IAAI,EACJ,KAAK,EACL,QAAQ,EACR,aAAa,EACd,MAAM,eAAe,CAAC;AAEvB,kBAAkB;AAClB,MAAM,WAAW,MAAM;IACrB,EAAE,EAAE,KAAK,CAAC;IACV,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,EAAE,WAAW,CAAC;IACjB,SAAS,EAAE,WAAW,CAAC;IACvB,SAAS,EAAE,WAAW,CAAC;IACvB;;0EAEsE;IACtE,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,kBAAkB;AAClB,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,QAAQ,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,IAAI,EAAE,CAAC;IACjB,sFAAsF;IACtF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,WAAW,CAAC;IACvB,SAAS,EAAE,WAAW,CAAC;IACvB;uFACmF;IACnF,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,kBAAkB;AAClB,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,UAAU,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,eAAe,CAAC;IACzB,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,QAAQ,CAAC;IAC1C,SAAS,CAAC,EAAE,WAAW,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,WAAW,CAAC;IACzB,SAAS,EAAE,WAAW,CAAC;CACxB;AAED,kBAAkB;AAClB,MAAM,WAAW,MAAM;IACrB,EAAE,EAAE,KAAK,CAAC;IACV,KAAK,EAAE,KAAK,CAAC;IACb,OAAO,EAAE;QAAE,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACzD,MAAM,EAAE,SAAS,GAAG,IAAI,GAAG,OAAO,GAAG,SAAS,GAAG,kBAAkB,CAAC;IACpE,MAAM,EAAE,IAAI,CAAC;IACb,SAAS,EAAE,WAAW,CAAC;IACvB,UAAU,CAAC,EAAE,WAAW,CAAC;CAC1B;AAED,8DAA8D;AAC9D,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,KAAK,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,IAAI,CAAC;IACX,SAAS,EAAE,WAAW,CAAC;IACvB,SAAS,EAAE,WAAW,CAAC;CACxB"}

package/dist/helpers/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/helpers/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/helpers/types.ts"],"names":[],"mappings":""}

package/dist/helpers/utils.d.ts

@@ -0,0 +1,37 @@
+import { VendoError, type IsoDateTime } from "@vendoai/core";
+import type { Db } from "../db.js";
+export declare function iso(value: unknown): IsoDateTime;
+export declare function optionalIso(value: unknown): IsoDateTime | undefined;
+export declare function text(value: unknown): string;
+/** Keyset timestamps compare at millisecond precision. The timestamptz cursor
+ *  columns can hold microseconds — the §2 table map is public (direct host
+ *  SQL, vendo_state's DEFAULT now()), and caller-supplied ISO timestamps
+ *  (audit `at`, run `startedAt`) are z.string().datetime()-validated, which
+ *  accepts sub-ms digits — while cursors round-trip through JS Dates (ms).
+ *  Comparing at full precision against a truncated cursor silently skips rows
+ *  (DESC lists) or repeats them (ASC export), so every keyset predicate and
+ *  its ORDER BY route BOTH the column and the cursor parameter through this
+ *  same truncated expression. */
+export declare function cursorMs(expr: string): string;
+export declare function encodeCursor(date: IsoDateTime, id: string): string;
+export declare function decodeCursor(value: string): {
+    c: IsoDateTime;
+    i: string;
+};
+export declare function pageLimit(value: number | undefined): number;
+export declare function jsonParam(value: unknown): string;
+export declare function escapeLike(value: string): string;
+/** The owning appId of an app-scoped record collection or blob namespace, or
+ *  undefined for non-app-scoped scopes. */
+export declare function appScopeId(scope: string): string | undefined;
+/** 02-store §4 (STORE-1): the fail-closed refusal for app-scoped writes whose
+ *  owning app has no `vendo_apps` row — never existed, or its ephemeral
+ *  session was swept. */
+export declare function unknownAppError(appId: string): VendoError;
+/** Pre-check for non-row-creating verbs (delete, guarded mutations): a clean
+ *  error signal, not the no-orphan guarantee. Row-CREATING statements embed
+ *  the same condition in the statement itself (`WHERE EXISTS (SELECT 1 FROM
+ *  vendo_apps WHERE id = ...)`) so a sweep racing the write can never leave an
+ *  orphaned row — the guarantee is structural, not ordering care. */
+export declare function requireKnownApp(db: Db, appId: string | undefined): Promise<void>;
+//# sourceMappingURL=utils.d.ts.map

package/dist/helpers/utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../src/helpers/utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAqB,KAAK,WAAW,EAAE,MAAM,eAAe,CAAC;AAChF,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,UAAU,CAAC;AAEnC,wBAAgB,GAAG,CAAC,KAAK,EAAE,OAAO,GAAG,WAAW,CAK/C;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,WAAW,GAAG,SAAS,CAEnE;AAED,wBAAgB,IAAI,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAG3C;AAED;;;;;;;;iCAQiC;AACjC,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE7C;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAElE;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG;IAAE,CAAC,EAAE,WAAW,CAAC;IAAC,CAAC,EAAE,MAAM,CAAA;CAAE,CAoBzE;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAM3D;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEhD;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEhD;AAMD;2CAC2C;AAC3C,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAE5D;AAED;;yBAEyB;AACzB,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAEzD;AAED;;;;qEAIqE;AACrE,wBAAsB,eAAe,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAItF"}

package/dist/helpers/utils.js

@@ -0,0 +1,94 @@
+import { VendoError, isoDateTimeSchema } from "@vendoai/core";
+export function iso(value) {
+    if (!(typeof value === "string" || value instanceof Date)) {
+        throw new Error("Expected database timestamp");
+    }
+    return new Date(value).toISOString();
+}
+export function optionalIso(value) {
+    return value == null ? undefined : iso(value);
+}
+export function text(value) {
+    if (typeof value !== "string")
+        throw new Error("Expected database text");
+    return value;
+}
+/** Keyset timestamps compare at millisecond precision. The timestamptz cursor
+ *  columns can hold microseconds — the §2 table map is public (direct host
+ *  SQL, vendo_state's DEFAULT now()), and caller-supplied ISO timestamps
+ *  (audit `at`, run `startedAt`) are z.string().datetime()-validated, which
+ *  accepts sub-ms digits — while cursors round-trip through JS Dates (ms).
+ *  Comparing at full precision against a truncated cursor silently skips rows
+ *  (DESC lists) or repeats them (ASC export), so every keyset predicate and
+ *  its ORDER BY route BOTH the column and the cursor parameter through this
+ *  same truncated expression. */
+export function cursorMs(expr) {
+    return `date_trunc('milliseconds', ${expr})`;
+}
+export function encodeCursor(date, id) {
+    return Buffer.from(JSON.stringify({ c: date, i: id }), "utf8").toString("base64url");
+}
+export function decodeCursor(value) {
+    try {
+        const decoded = Buffer.from(value, "base64url");
+        if (decoded.toString("base64url") !== value)
+            throw new Error("non-canonical cursor");
+        const parsed = JSON.parse(decoded.toString("utf8"));
+        if (typeof parsed !== "object" || parsed === null
+            || Array.isArray(parsed)
+            || Object.keys(parsed).length !== 2
+            || !Object.prototype.hasOwnProperty.call(parsed, "c")
+            || !Object.prototype.hasOwnProperty.call(parsed, "i")
+            || typeof parsed.c !== "string"
+            || typeof parsed.i !== "string")
+            throw new Error("invalid cursor");
+        const timestamp = isoDateTimeSchema.safeParse(parsed.c);
+        if (!timestamp.success)
+            throw new Error("invalid cursor timestamp");
+        return { c: timestamp.data, i: parsed.i };
+    }
+    catch {
+        throw new VendoError("validation", "malformed cursor");
+    }
+}
+export function pageLimit(value) {
+    if (value === undefined)
+        return 100;
+    if (!Number.isInteger(value) || value < 1) {
+        throw new VendoError("validation", "limit must be a positive integer");
+    }
+    return Math.min(value, 1000);
+}
+export function jsonParam(value) {
+    return JSON.stringify(value);
+}
+export function escapeLike(value) {
+    return value.replace(/[\\%_]/g, "\\$&");
+}
+/** app:<appId>:… is the collection/namespace grammar for app-scoped record and
+ *  blob stores (01-core §12). The appId segment is colon-free by construction. */
+const APP_SCOPE = /^app:([^:]+):/;
+/** The owning appId of an app-scoped record collection or blob namespace, or
+ *  undefined for non-app-scoped scopes. */
+export function appScopeId(scope) {
+    return APP_SCOPE.exec(scope)?.[1];
+}
+/** 02-store §4 (STORE-1): the fail-closed refusal for app-scoped writes whose
+ *  owning app has no `vendo_apps` row — never existed, or its ephemeral
+ *  session was swept. */
+export function unknownAppError(appId) {
+    return new VendoError("not-found", `app ${appId} does not exist (its session may have expired)`);
+}
+/** Pre-check for non-row-creating verbs (delete, guarded mutations): a clean
+ *  error signal, not the no-orphan guarantee. Row-CREATING statements embed
+ *  the same condition in the statement itself (`WHERE EXISTS (SELECT 1 FROM
+ *  vendo_apps WHERE id = ...)`) so a sweep racing the write can never leave an
+ *  orphaned row — the guarantee is structural, not ordering care. */
+export async function requireKnownApp(db, appId) {
+    if (appId === undefined)
+        return;
+    const result = await db.query("SELECT 1 FROM vendo_apps WHERE id = $1", [appId]);
+    if (result.rows[0] === undefined)
+        throw unknownAppError(appId);
+}
+//# sourceMappingURL=utils.js.map

package/dist/helpers/utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../src/helpers/utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAoB,MAAM,eAAe,CAAC;AAGhF,MAAM,UAAU,GAAG,CAAC,KAAc;IAChC,IAAI,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,YAAY,IAAI,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,KAAc;IACjC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IACzE,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;iCAQiC;AACjC,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,OAAO,8BAA8B,IAAI,GAAG,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAiB,EAAE,EAAU;IACxD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACvF,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QAChD,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QACrF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY,CAAC;QAC/D,IACE,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;eAC1C,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;eACrB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC;eAChC,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC;eAClD,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC;eAClD,OAAQ,MAA0B,CAAC,CAAC,KAAK,QAAQ;eACjD,OAAQ,MAA0B,CAAC,CAAC,KAAK,QAAQ;YACpD,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACpC,MAAM,SAAS,GAAG,iBAAiB,CAAC,SAAS,CAAE,MAAwB,CAAC,CAAC,CAAC,CAAC;QAC3E,IAAI,CAAC,SAAS,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QACpE,OAAO,EAAE,CAAC,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,EAAG,MAAwB,CAAC,CAAC,EAAE,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,UAAU,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC;IACzD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAyB;IACjD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC;IACpC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,UAAU,CAAC,YAAY,EAAE,kCAAkC,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAc;IACtC,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,OAAO,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;AAC1C,CAAC;AAED;kFACkF;AAClF,MAAM,SAAS,GAAG,eAAe,CAAC;AAElC;2CAC2C;AAC3C,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,OAAO,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AACpC,CAAC;AAED;;yBAEyB;AACzB,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,OAAO,IAAI,UAAU,CAAC,WAAW,EAAE,OAAO,KAAK,gDAAgD,CAAC,CAAC;AACnG,CAAC;AAED;;;;qEAIqE;AACrE,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EAAM,EAAE,KAAyB;IACrE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO;IAChC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,wCAAwC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;IACjF,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC"}

package/dist/index.d.ts

@@ -1,11 +1,13 @@
-export { and, desc, eq } from "drizzle-orm";
-export { createVendoDatabase, migrateVendoDatabase } from "./db.js";
-export type { VendoDatabaseConfig, VendoDb } from "./db.js";
-export { vendo, automations, automationVersions, automationRuns, decisions, threads, threadMessages, savedVendos, connections, meta, } from "./schema.js";
-export { getMeta, setMeta } from "./meta.js";
-export { DrizzleAutomationStore, toIso } from "./automation-store.js";
-export { createDrizzleDecisionStore } from "./decision-store.js";
-export { createDrizzleThreadStore } from "./thread-store.js";
-export { createDrizzleSavedVendoStore } from "./vendo-registry.js";
-export { createDrizzleConnectionsStore } from "./connections-store.js";
-export type { DurableConnectionsStore, IntegrationCatalogEntry } from "./connections-store.js";
+/** @vendoai/store — persistence under everything (docs/contracts/02-store.md). */
+export { createStore, type VendoStore } from "./store.js";
+export { DEDICATED_RECORD_COLLECTIONS, RESERVED_COLLECTIONS, type ReservedCollection, } from "./routing.js";
+export { eraseStore, type EraseReport, type EraseTable } from "./erase.js";
+export { claimEphemeralSubject, listStaleEphemeralSubjects, registerEphemeralSubject, sweepEphemeralSubjects, } from "./sessions.js";
+export { envSecrets, secretStore, storeSecrets } from "./secrets.js";
+export { appStore, type AppRow } from "./helpers/apps.js";
+export { threadStore, type ThreadRow } from "./helpers/threads.js";
+export { grantStore } from "./helpers/grants.js";
+export { auditStore, type AuditQuery } from "./helpers/audit.js";
+export { runStore, type RunRow } from "./helpers/runs.js";
+export { adoptEphemeralSubject, type SubjectMergeReport, } from "./helpers/subjects.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,OAAO,EAAE,WAAW,EAAE,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAK1D,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EACpB,KAAK,kBAAkB,GACxB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,UAAU,EAAE,KAAK,WAAW,EAAE,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAC3E,OAAO,EACL,qBAAqB,EACrB,0BAA0B,EAC1B,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACrE,OAAO,EAAE,QAAQ,EAAE,KAAK,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,KAAK,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,QAAQ,EAAE,KAAK,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EACL,qBAAqB,EACrB,KAAK,kBAAkB,GACxB,MAAM,uBAAuB,CAAC"}

package/dist/index.js

@@ -1,15 +1,17 @@
-// Re-exported so consumers (e.g. vendo/server's vendos.ts) build queries
-// against the SAME drizzle-orm instance this package resolved — a consumer
-// declaring its own `drizzle-orm` dependency can land on a different
-// peer-hashed copy in pnpm's node_modules, which breaks structurally (the
-// `Column`/`SQL` classes carry a private field, so TS sees two incompatible
-// nominal types even though the runtime code is identical).
-export { and, desc, eq } from "drizzle-orm";
-export { createVendoDatabase, migrateVendoDatabase } from "./db.js";
-export { vendo, automations, automationVersions, automationRuns, decisions, threads, threadMessages, savedVendos, connections, meta, } from "./schema.js";
-export { getMeta, setMeta } from "./meta.js";
-export { DrizzleAutomationStore, toIso } from "./automation-store.js";
-export { createDrizzleDecisionStore } from "./decision-store.js";
-export { createDrizzleThreadStore } from "./thread-store.js";
-export { createDrizzleSavedVendoStore } from "./vendo-registry.js";
-export { createDrizzleConnectionsStore } from "./connections-store.js";
+/** @vendoai/store — persistence under everything (docs/contracts/02-store.md). */
+export { createStore } from "./store.js";
+// The reserved-collection map (02-store §2): exported so remote StoreAdapters
+// (the umbrella's hostedStore) can mirror this engine's per-collection
+// capability shape — claim on non-routed collections, atomic on generic
+// collections and vendo_threads — without re-deriving the routing table.
+export { DEDICATED_RECORD_COLLECTIONS, RESERVED_COLLECTIONS, } from "./routing.js";
+export { eraseStore } from "./erase.js";
+export { claimEphemeralSubject, listStaleEphemeralSubjects, registerEphemeralSubject, sweepEphemeralSubjects, } from "./sessions.js";
+export { envSecrets, secretStore, storeSecrets } from "./secrets.js";
+export { appStore } from "./helpers/apps.js";
+export { threadStore } from "./helpers/threads.js";
+export { grantStore } from "./helpers/grants.js";
+export { auditStore } from "./helpers/audit.js";
+export { runStore } from "./helpers/runs.js";
+export { adoptEphemeralSubject, } from "./helpers/subjects.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,OAAO,EAAE,WAAW,EAAmB,MAAM,YAAY,CAAC;AAC1D,8EAA8E;AAC9E,uEAAuE;AACvE,wEAAwE;AACxE,yEAAyE;AACzE,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,GAErB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,UAAU,EAAqC,MAAM,YAAY,CAAC;AAC3E,OAAO,EACL,qBAAqB,EACrB,0BAA0B,EAC1B,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACrE,OAAO,EAAE,QAAQ,EAAe,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAkB,MAAM,sBAAsB,CAAC;AACnE,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAmB,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,QAAQ,EAAe,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EACL,qBAAqB,GAEtB,MAAM,uBAAuB,CAAC"}

package/dist/records.d.ts

@@ -0,0 +1,7 @@
+import { type RecordStore } from "@vendoai/core";
+import type { Db } from "./db.js";
+export type DedicatedRecordTable = "vendo_mcp_clients" | "vendo_mcp_grants";
+export declare function requireRevision(value: string): void;
+/** 01-core §12 */
+export declare function createRecordStore(db: Db, collection: string, dedicatedTable?: DedicatedRecordTable): RecordStore;
+//# sourceMappingURL=records.d.ts.map

package/dist/records.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"records.d.ts","sourceRoot":"","sources":["../src/records.ts"],"names":[],"mappings":"AAAA,OAAO,EAML,KAAK,WAAW,EAEjB,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,SAAS,CAAC;AAclC,MAAM,MAAM,oBAAoB,GAAG,mBAAmB,GAAG,kBAAkB,CAAC;AA0B5E,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAEnD;AAWD,kBAAkB;AAClB,wBAAgB,iBAAiB,CAC/B,EAAE,EAAE,EAAE,EACN,UAAU,EAAE,MAAM,EAClB,cAAc,CAAC,EAAE,oBAAoB,GACpC,WAAW,CAqNb"}