@xnetjs/data 0.0.3 → 0.1.1

package/dist/store/index.d.ts

@@ -1,7 +1,7 @@
-import { g as NodeStorageAdapter, r as NodeChange, i as NodeId, h as NodeState, aa as NodeBatchPreflightResult, a3 as ImportNodesOptions, a5 as ApplyNodeBatchInput, a6 as ApplyNodeBatchResult, L as ListNodesOptions, ae as CountNodesOptions, a2 as SetNodeOptions, j as NodeQueryDescriptor, k as NodeQueryResult, S as SchemaIRI, a4 as RebuildNodeIndexesOptions } from '../types-Def-5Nka.js';
-export { av as ConflictResult, ay as ContentKeyCache, C as CreateNodeOptions, ab as DeterministicNodeBatchWriteInput, m as DeterministicNodeImportDraft, G as GetWithMigrationOptions, n as ImportDeterministicNodesOptions, o as ImportDeterministicNodesResult, s as MergeConflict, M as MigratedNodeState, az as MigrationInfo, aw as NodeBatchChangeEvent, u as NodeBatchChangeListener, a7 as NodeBatchIndexMode, a8 as NodeBatchNotificationMode, a9 as NodeBatchSyncMode, p as NodeBatchWriteInput, ac as NodeBatchWritePolicy, q as NodeBatchWriteResult, ad as NodeBatchWriteTimings, v as NodeChangeEvent, t as NodeChangeListener, ax as NodeContentCipher, a0 as NodePayload, ar as NodeQueryCursor, aq as NodeQueryCursorOrderEntry, ao as NodeQueryMaterializedViewOptions, as as NodeQueryOptions, N as NodeQueryPageCountMode, ap as NodeQueryPageOptions, au as NodeQueryParityCheckMetadata, at as NodeQueryPlanMetadata, am as NodeQuerySearchField, an as NodeQuerySearchFilter, al as NodeQuerySpatialFilter, af as NodeQuerySpatialPoint, ah as NodeQuerySpatialPointFields, ak as NodeQuerySpatialRadius, ag as NodeQuerySpatialRect, ai as NodeQuerySpatialRectFields, aj as NodeQuerySpatialWindow, f as NodeStoreOptions, bi as OperationNodeBatchWriteInput, $ as PropertyKey, bj as PropertyLookup, a1 as PropertyTimestamp, aR as SchemaLookup, c as SortDirection, d as SystemOrderField, aO as TEMP_ID_PREFIX, aS as TempIdResolution, T as TransactionOperation, l as TransactionResult, U as UpdateNodeOptions, aI as applyNodeQueryDescriptor, aA as createNodeQueryDescriptor, bk as createPropertyLookup, aQ as createSchemaLookup, aC as decodeNodeQueryCursor, aB as encodeNodeQueryCursor, aG as filterNodeQueryResults, aJ as getNodeQuerySearchTokens, aN as isTempId, aF as matchesNodeQueryDescriptor, aK as nodeQueryDescriptorNeedsBoundedReload, aD as nodeQueryDescriptorToOptions, aP as resolveTempIds, aE as serializeNodeQueryDescriptor, aH as sortNodeQueryResults, aM as withoutNodeQueryMaterializedView, aL as withoutNodeQueryPagination } from '../types-Def-5Nka.js';
-export { G as QUERY_AST_VERSION, r as QueryAST, n as QueryASTAggregate, A as QueryASTAggregateExecution, m as QueryASTAggregateFunction, y as QueryASTAggregateGroup, x as QueryASTAggregatePlan, z as QueryASTAggregateResult, d as QueryASTComparisonPredicate, e as QueryASTCompoundPredicate, a as QueryASTField, l as QueryASTIncludes, p as QueryASTNodeQuery, s as QueryASTNodeQueryOptions, f as QueryASTNotPredicate, c as QueryASTOperator, h as QueryASTOrderBy, i as QueryASTPage, B as QueryASTPlannerGate, g as QueryASTPredicate, q as QueryASTQuerySet, o as QueryASTQuerySetAggregate, j as QueryASTRelationDirection, k as QueryASTRelationInclude, t as QueryASTRelationIncludeOptions, w as QueryASTRelationIndexRequirement, b as QueryASTSchemaInput, u as QueryASTValidationError, v as QueryASTValidationResult, Q as QueryASTVersion, S as SavedViewDescriptor, F as SavedViewFeedDensity, E as SavedViewFeedLayout, C as SavedViewPresentationHint, D as SavedViewPresentationHintMode, V as and, a3 as avg, N as between, P as contains, a0 as count, a1 as countDistinct, a9 as dashboardQuerySet, Z as defineNodeQueryAST, a8 as defineQuerySetAST, ab as defineSavedViewDescriptor, H as eq, aj as evaluateQueryASTPlannerGate, af as executeQueryASTLoadedAggregates, ag as filterQueryASTLoadedRows, _ as follow, $ as from, ah as getQueryASTRelationIndexRequirements, a6 as groupBy, J as gt, K as gte, a7 as having, O as includesAny, U as isNotNull, T as isNull, L as lt, M as lte, ai as matchesQueryASTLoadedRow, a5 as max, a4 as min, I as neq, X as not, W as or, ae as planQueryASTAggregates, Y as queryOperators, aa as querySetCount, R as startsWith, a2 as sum, ac as validateQueryAST, ad as validateSavedViewDescriptor } from '../query-ast-CWo6_30h.js';
-export { N as NodeStore } from '../store-CvgiydME.js';
+import { g as NodeStorageAdapter, r as NodeChange, i as NodeId, h as NodeState, aa as NodeBatchPreflightResult, a3 as ImportNodesOptions, a5 as ApplyNodeBatchInput, a6 as ApplyNodeBatchResult, L as ListNodesOptions, ae as CountNodesOptions, a2 as SetNodeOptions, j as NodeQueryDescriptor, k as NodeQueryResult, S as SchemaIRI, a4 as RebuildNodeIndexesOptions, bi as NodeReadAuthorizer, bj as AuthorizationStateVersion } from '../types-S-BJAKyK.js';
+export { av as ConflictResult, ay as ContentKeyCache, C as CreateNodeOptions, ab as DeterministicNodeBatchWriteInput, m as DeterministicNodeImportDraft, G as GetWithMigrationOptions, n as ImportDeterministicNodesOptions, o as ImportDeterministicNodesResult, s as MergeConflict, M as MigratedNodeState, az as MigrationInfo, aw as NodeBatchChangeEvent, u as NodeBatchChangeListener, a7 as NodeBatchIndexMode, a8 as NodeBatchNotificationMode, a9 as NodeBatchSyncMode, p as NodeBatchWriteInput, ac as NodeBatchWritePolicy, q as NodeBatchWriteResult, ad as NodeBatchWriteTimings, v as NodeChangeEvent, t as NodeChangeListener, ax as NodeContentCipher, a0 as NodePayload, ar as NodeQueryCursor, aq as NodeQueryCursorOrderEntry, ao as NodeQueryMaterializedViewOptions, as as NodeQueryOptions, N as NodeQueryPageCountMode, ap as NodeQueryPageOptions, au as NodeQueryParityCheckMetadata, at as NodeQueryPlanMetadata, am as NodeQuerySearchField, an as NodeQuerySearchFilter, al as NodeQuerySpatialFilter, af as NodeQuerySpatialPoint, ah as NodeQuerySpatialPointFields, ak as NodeQuerySpatialRadius, ag as NodeQuerySpatialRect, ai as NodeQuerySpatialRectFields, aj as NodeQuerySpatialWindow, f as NodeStoreOptions, bk as OperationNodeBatchWriteInput, $ as PropertyKey, bl as PropertyLookup, a1 as PropertyTimestamp, aR as SchemaLookup, c as SortDirection, d as SystemOrderField, aO as TEMP_ID_PREFIX, aS as TempIdResolution, T as TransactionOperation, l as TransactionResult, U as UpdateNodeOptions, aI as applyNodeQueryDescriptor, aA as createNodeQueryDescriptor, bm as createPropertyLookup, aQ as createSchemaLookup, aC as decodeNodeQueryCursor, aB as encodeNodeQueryCursor, aG as filterNodeQueryResults, aJ as getNodeQuerySearchTokens, aN as isTempId, aF as matchesNodeQueryDescriptor, aK as nodeQueryDescriptorNeedsBoundedReload, aD as nodeQueryDescriptorToOptions, aP as resolveTempIds, aE as serializeNodeQueryDescriptor, aH as sortNodeQueryResults, aM as withoutNodeQueryMaterializedView, aL as withoutNodeQueryPagination } from '../types-S-BJAKyK.js';
+export { G as QUERY_AST_VERSION, r as QueryAST, n as QueryASTAggregate, A as QueryASTAggregateExecution, m as QueryASTAggregateFunction, y as QueryASTAggregateGroup, x as QueryASTAggregatePlan, z as QueryASTAggregateResult, d as QueryASTComparisonPredicate, e as QueryASTCompoundPredicate, a as QueryASTField, l as QueryASTIncludes, p as QueryASTNodeQuery, s as QueryASTNodeQueryOptions, f as QueryASTNotPredicate, c as QueryASTOperator, h as QueryASTOrderBy, i as QueryASTPage, B as QueryASTPlannerGate, g as QueryASTPredicate, q as QueryASTQuerySet, o as QueryASTQuerySetAggregate, j as QueryASTRelationDirection, k as QueryASTRelationInclude, t as QueryASTRelationIncludeOptions, w as QueryASTRelationIndexRequirement, b as QueryASTSchemaInput, u as QueryASTValidationError, v as QueryASTValidationResult, Q as QueryASTVersion, S as SavedViewDescriptor, F as SavedViewFeedDensity, E as SavedViewFeedLayout, C as SavedViewPresentationHint, D as SavedViewPresentationHintMode, V as and, a3 as avg, N as between, P as contains, a0 as count, a1 as countDistinct, a9 as dashboardQuerySet, Z as defineNodeQueryAST, a8 as defineQuerySetAST, ab as defineSavedViewDescriptor, H as eq, aj as evaluateQueryASTPlannerGate, af as executeQueryASTLoadedAggregates, ag as filterQueryASTLoadedRows, _ as follow, $ as from, ah as getQueryASTRelationIndexRequirements, a6 as groupBy, J as gt, K as gte, a7 as having, O as includesAny, U as isNotNull, T as isNull, L as lt, M as lte, ai as matchesQueryASTLoadedRow, a5 as max, a4 as min, I as neq, X as not, W as or, ae as planQueryASTAggregates, Y as queryOperators, aa as querySetCount, R as startsWith, a2 as sum, ac as validateQueryAST, ad as validateSavedViewDescriptor } from '../query-ast-C3m6kZYv.js';
+export { N as NodeStore } from '../store-DtIDjk7c.js';
 import { AuthAction, DID, AuthDenyReason, AuthDecision, ContentId } from '@xnetjs/core';
 import { SQLiteAdapter, SQLiteOperationStats } from '@xnetjs/sqlite';
 import '@xnetjs/crypto';
@@ -120,11 +120,30 @@ interface SQLiteNodeStorageAdapterOptions {
     adaptiveIndexing?: SQLiteAdaptiveIndexingOptions;
     queryVerification?: SQLiteQueryVerificationOptions;
     /**
-     * Collect EXPLAIN QUERY PLAN + index inventory per query. Costs extra
-     * round trips per query, so it is off unless explicitly enabled or the
-     * `xnet:query:debug` localStorage flag is set.
+     * Collect EXPLAIN QUERY PLAN + index inventory for queries. Costs extra
+     * round trips, so it is off unless explicitly enabled or the
+     * `xnet:query:debug` localStorage flag is set. Diagnostics are collected
+     * once per unique compiled SQL shape per session (invalidated when the
+     * adapter itself runs DDL) — per-execution collection convoyed the serial
+     * worker and delayed the very queries being measured by 18-20s at boot
+     * (2026-07-05 capture).
      */
     queryDiagnostics?: boolean;
+    /**
+     * Hydrate via SQL-side `json_group_object` aggregation — ONE row per node
+     * instead of one row per (node × property) — collapsing the boundary
+     * payload before it leaves SQLite (exploration 0264, Wave 2). Off by
+     * default while the mode is benchmarked; correctness is verified equal by
+     * the hydration test suite in both modes.
+     */
+    aggregatedHydration?: boolean;
+    /**
+     * Defer maintenance work (adaptive index creation) to an idle scheduler
+     * instead of running it inline on the query path. The web app passes a
+     * bootSettled-gated scheduler — no background work is free on the single
+     * serial SQLite worker (exploration 0260/0264). Default: run inline.
+     */
+    scheduleMaintenance?: (task: () => Promise<void> | void) => void;
 }
 /**
  * SQLite-backed storage adapter for NodeStore.
@@ -152,13 +171,34 @@ declare class SQLiteNodeStorageAdapter implements NodeStorageAdapter {
     private adaptiveIndexing;
     private queryVerification;
     private queryDiagnostics;
+    /** Hydrate one row per node via json_group_object (0264 Wave 2 flag). */
+    private aggregatedHydration;
+    /** Idle scheduler for maintenance work (adaptive index creation, 0264). */
+    private scheduleMaintenance?;
     private pendingQueryTelemetry;
     private pendingQueryTelemetryHits;
     private adaptiveIndexBudgetColumnsReady;
     private storageCapabilitiesPromise?;
+    /**
+     * Plan diagnostics memoized per compiled SQL shape (the string EXPLAINed),
+     * shared across executions AND concurrent callers. Cleared when this adapter
+     * creates/drops an adaptive index, since that changes plans. Debug mode must
+     * not distort what it measures: per-execution EXPLAIN + index-inventory
+     * round-trips convoyed the single serial worker at boot.
+     */
+    private compiledQueryDiagnosticsMemo;
     private spatialTablesState;
     private fullTextSearchTablesState;
     private writeQueue;
+    /**
+     * Read-authorization filter applied before persisting a materialized view's
+     * id list (exploration 0226). Wired by `NodeStore` when an auth evaluator is
+     * present; `undefined` means materialized views are computed unauthorized
+     * (the trusted single-user case).
+     */
+    private nodeReadAuthorizer?;
+    /** One-time guard: ensure the `auth_fingerprint` column exists on upgraded DBs. */
+    private materializationColumnsReady;
     constructor(db: SQLiteAdapter, options?: SQLiteNodeStorageAdapterOptions);
     getSQLiteAdapter(): SQLiteAdapter;
     open(): Promise<void>;
@@ -178,6 +218,37 @@ declare class SQLiteNodeStorageAdapter implements NodeStorageAdapter {
     getChanges(nodeId: NodeId): Promise<NodeChange[]>;
     getAllChanges(): Promise<NodeChange[]>;
     getChangesSince(sinceLamport: number): Promise<NodeChange[]>;
+    /**
+     * Compact the local change log (exploration 0254 / F3): delete only
+     * *superseded* history so the OPFS file shrinks (fast cold open) and the
+     * outbound-resync slice shrinks (cheap first sync), without affecting reads,
+     * outbound sync, hash-chain chaining, or convergence with peers that never
+     * compacted.
+     *
+     * A row is deleted iff ALL of:
+     *  - `lamport_time < wsafe` — below the confirmed-durable floor, so the hub
+     *    holds it and it is not part of the unconfirmed outbound tail (K1);
+     *  - it is NOT a node's hash-chain tip — we keep every row at a node's
+     *    `MAX(lamport_time)` (the whole tie group), so `getLastChange()` still
+     *    returns a real tip and the next write's `parentHash`/hash/signature are
+     *    byte-identical to an uncompacted peer's (K2);
+     *  - it backs NO currently-winning LWW value — its `(node_id, lamport_time,
+     *    author)` is not the provenance of any live `node_properties` row (K3).
+     *
+     * K3 is the load-bearing safety net: because every live projection value keeps
+     * its backing row, the retained log still materialises to — and can re-push —
+     * the exact current state, so a stranded/rolled-back peer never loses live
+     * data. Reads are unaffected (they read the materialized `nodes`/
+     * `node_properties`, never the log). Only rows are deleted, never rewritten
+     * (the hash + signature are immutable and unforgeable). Runs chunked inside
+     * the write lane, yields between chunks, and never throws.
+     */
+    pruneSupersededChanges(wsafe: number, options?: {
+        chunk?: number;
+        maxRows?: number;
+    }): Promise<{
+        deleted: number;
+    }>;
     getChangeByHash(hash: ContentId): Promise<NodeChange | null>;
     getLastChange(nodeId: NodeId): Promise<NodeChange | null>;
     getLastChangesByNodeId(nodeIds: readonly NodeId[]): Promise<Map<NodeId, NodeChange>>;
@@ -206,7 +277,19 @@ declare class SQLiteNodeStorageAdapter implements NodeStorageAdapter {
     private setLastLamportTimeInternal;
     private syncCursorKey;
     getSyncCursor(room: string): Promise<number>;
+    /**
+     * The lowest confirmed-durable sync cursor across every node-change room
+     * (`MIN` over the persisted `nodeSync:hwm:*` marks), or `null` when no room has
+     * ever confirmed. This is the safe compaction floor (exploration 0254): the
+     * hub durably holds every change at or below it. Returns `null` — never 0 — so
+     * a workspace that has never synced is left untouched.
+     */
+    getMinConfirmedSyncCursor(): Promise<number | null>;
     setSyncCursor(room: string, lamport: number): Promise<void>;
+    /** Namespace app-state keys so they can't collide with sync cursors. */
+    private appStateKey;
+    getAppState(key: string): Promise<string | null>;
+    setAppState(key: string, value: string): Promise<void>;
     getDocumentContent(nodeId: NodeId): Promise<Uint8Array | null>;
     setDocumentContent(nodeId: NodeId, content: Uint8Array): Promise<void>;
     private setDocumentContentInternal;
@@ -296,9 +379,49 @@ declare class SQLiteNodeStorageAdapter implements NodeStorageAdapter {
      */
     clear(): Promise<void>;
     private hydrateJoinedRows;
+    private buildHydrateChunkQuery;
     private hydrateNodesByIds;
+    /**
+     * Aggregated hydrate (exploration 0264, Wave 2): collapse the EAV rows to
+     * ONE row per node inside SQL via `json_group_object`, so the boundary
+     * ships N rows instead of N × properties. `value` is stored as JSON text
+     * in a BLOB — `json(CAST(… AS TEXT))` re-emits it as real JSON inside the
+     * aggregate (without the cast/wrap it would double-encode as a string).
+     */
+    private buildAggregatedHydrateChunkQuery;
+    /** Parse one-row-per-node aggregated hydrate results into NodeStates. */
+    private hydrateAggregatedRows;
+    /**
+     * Read (or refresh) a materialized view.
+     *
+     * A materialized view is a purely LOCAL, DERIVED cache: an ordered list of
+     * node ids (membership + order) plus bookkeeping. It is NEVER part of the
+     * change log and is NEVER synced — peers each derive their own. It therefore
+     * carries no authority and can be rebuilt or dropped at any time (a wiped
+     * cache only costs a recompute, never data). Content is re-hydrated from the
+     * live `nodes`/`node_properties` tables on every read, so the cache exposes
+     * nothing the underlying tables don't already, and a write to the schema
+     * (`invalidated_at`) or a grant change (`auth_fingerprint`) forces a
+     * re-materialization. See exploration 0226.
+     */
     private queryMaterializedView;
     private getMaterializedView;
+    /**
+     * Ensure the `auth_fingerprint` column exists. Fresh databases get it from
+     * the DDL; databases upgraded in place (the runtime applies the full DDL with
+     * `CREATE TABLE IF NOT EXISTS`, which cannot add a column) need this guard.
+     * Idempotent and memoized (exploration 0226).
+     */
+    private ensureMaterializationColumns;
+    setNodeReadAuthorizer(authorizer: NodeReadAuthorizer | undefined): void;
+    /**
+     * Reload-stable version of the authorization-relevant control-plane state:
+     * grants (`Grant` schema) and per-subject `/sys/authz/` resources. Ordinary
+     * data writes do not touch these, so a database's materialized views survive
+     * reloads and edits, but any grant change shifts `count`/`maxUpdatedAt` and
+     * forces an `'authz-changed'` refresh (exploration 0226).
+     */
+    getAuthorizationStateVersion(): Promise<AuthorizationStateVersion>;
     private refreshMaterializedView;
     private readMaterializedViewPage;
     private invalidateMaterializedViewsForSchema;
@@ -338,7 +461,14 @@ declare class SQLiteNodeStorageAdapter implements NodeStorageAdapter {
     flushQueryTelemetry(): Promise<void>;
     private writeQueryTelemetryRow;
     private isQueryDiagnosticsEnabled;
+    /**
+     * Throttled: one collection per unique compiled SQL shape per session.
+     * EXPLAIN plans depend on the statement, not the bound values, so keyset
+     * pages of the same query share one entry. Concurrent callers share the
+     * in-flight promise; failed collections are not memoized.
+     */
     private collectCompiledQueryDiagnostics;
+    private computeCompiledQueryDiagnostics;
     private getStorageCapabilities;
     private debugQueryPlan;
     private isQueryDebugEnabled;
@@ -362,9 +492,25 @@ declare class SQLiteNodeStorageAdapter implements NodeStorageAdapter {
     private getAdaptiveIndexColumns;
     private countCompiledNodeQuery;
     private compileNodeQuery;
+    /**
+     * A custom-property sort can push down when it is the descriptor's ONLY
+     * order key and no cursor/spatial/search accelerator is in play. Gated on
+     * the adaptive-indexing flag: the typed partial indexes on
+     * `node_property_scalars` make the join+order cheap, and the flag keeps
+     * the behavioural change opt-in while it soaks (exploration 0264).
+     */
+    private resolvePropertySortPushdown;
     private compileSqlQuery;
     private getCompiledPostFilterReason;
     private appendScalarPredicate;
+    /**
+     * ORDER BY for a pushed-down custom-property sort (0264). Mirrors the JS
+     * comparator in `applyNodeQueryDescriptor`: missing properties sort last
+     * ascending / first descending; typed value columns carry the order (for a
+     * homogeneous property exactly one is non-NULL). `n.id` breaks ties so the
+     * page boundary is a total order.
+     */
+    private buildPropertySortOrderBy;
     private buildSqlOrderBy;
     private hasOnlySystemOrdering;
     private serializePayload;

package/dist/store/index.js

@@ -49,7 +49,7 @@ import {
   sum,
   validateQueryAST,
   validateSavedViewDescriptor
-} from "../chunk-QVZXXJSP.js";
+} from "../chunk-EI5CY2FZ.js";
 import {
   applyNodeQueryDescriptor,
   createNodeQueryDescriptor,
@@ -64,10 +64,10 @@ import {
   sortNodeQueryResults,
   withoutNodeQueryMaterializedView,
   withoutNodeQueryPagination
-} from "../chunk-S4B5OPZU.js";
-import "../chunk-V6HZ3LF3.js";
-import "../chunk-O64EK5FK.js";
-import "../chunk-JESSJ5CZ.js";
+} from "../chunk-S5RP5RKY.js";
+import "../chunk-BY5O6LNC.js";
+import "../chunk-EBNMV2VO.js";
+import "../chunk-RL64OJJ5.js";
 export {
   MemoryNodeStorageAdapter,
   NodeStore,

package/dist/{store-CvgiydME.d.ts → store-DtIDjk7c.d.ts}

@@ -1,4 +1,4 @@
-import { e as StoreAuthAPI, f as NodeStoreOptions, g as NodeStorageAdapter, C as CreateNodeOptions, h as NodeState, i as NodeId, G as GetWithMigrationOptions, M as MigratedNodeState, U as UpdateNodeOptions, L as ListNodesOptions, j as NodeQueryDescriptor, k as NodeQueryResult, T as TransactionOperation, l as TransactionResult, m as DeterministicNodeImportDraft, n as ImportDeterministicNodesOptions, o as ImportDeterministicNodesResult, p as NodeBatchWriteInput, q as NodeBatchWriteResult, S as SchemaIRI, r as NodeChange, s as MergeConflict, t as NodeChangeListener, u as NodeBatchChangeListener } from './types-Def-5Nka.js';
+import { e as StoreAuthAPI, f as NodeStoreOptions, g as NodeStorageAdapter, C as CreateNodeOptions, h as NodeState, i as NodeId, G as GetWithMigrationOptions, M as MigratedNodeState, U as UpdateNodeOptions, L as ListNodesOptions, j as NodeQueryDescriptor, k as NodeQueryResult, T as TransactionOperation, l as TransactionResult, m as DeterministicNodeImportDraft, n as ImportDeterministicNodesOptions, o as ImportDeterministicNodesResult, p as NodeBatchWriteInput, q as NodeBatchWriteResult, S as SchemaIRI, r as NodeChange, s as MergeConflict, t as NodeChangeListener, u as NodeBatchChangeListener } from './types-S-BJAKyK.js';
 
 /**
  * NodeStore - Event-sourced storage for Nodes
@@ -323,6 +323,23 @@ declare class NodeStore {
     private assertAuthorized;
     private canReadNode;
     private filterReadableNodes;
+    /**
+     * Whether storage can safely materialize a view under read authorization
+     * (exploration 0226): it must both accept the read authorizer (to authorize
+     * the id list at refresh) and expose a reload-stable authorization-state
+     * version (to fingerprint cache validity). When either is missing the store
+     * falls back to the authorize-then-paginate path, which never caches.
+     */
+    private materializedAuthSupported;
+    /**
+     * A reload-stable fingerprint of the viewer's authorization context, folded
+     * from the subject DID and the control-plane (grant) state version. Stamped
+     * onto a materialized view so any grant change forces an `'authz-changed'`
+     * refresh — the cache can never serve rows a revoked viewer may no longer
+     * read. Returns `undefined` when authorization is off (materialized views run
+     * untouched, as in the trusted single-user case).
+     */
+    private authFingerprint;
     private applyListPagination;
     private getQueryFallbackReason;
     private assertAuthorizedBatch;

package/dist/{system-Q5I6STDC.js → system-ILHCZOVO.js}

@@ -15,9 +15,9 @@ import {
   parseSystemNamespaceResource,
   resolveSchemaAuthority,
   validateSchemaDefinitionNode
-} from "./chunk-V6HZ3LF3.js";
-import "./chunk-O64EK5FK.js";
-import "./chunk-JESSJ5CZ.js";
+} from "./chunk-BY5O6LNC.js";
+import "./chunk-EBNMV2VO.js";
+import "./chunk-RL64OJJ5.js";
 export {
   PresenceSummarySchema,
   SYSTEM_NAMESPACE_KINDS,

package/dist/{tag-C677GKQW.js → tag-SKCHM3U5.js}

@@ -4,9 +4,9 @@ import {
   TagSchema,
   isValidTagName,
   normalizeTagName
-} from "./chunk-YWN27MLD.js";
-import "./chunk-O64EK5FK.js";
-import "./chunk-JESSJ5CZ.js";
+} from "./chunk-6KLGA6IR.js";
+import "./chunk-EBNMV2VO.js";
+import "./chunk-RL64OJJ5.js";
 export {
   MAX_TAG_NAME_LENGTH,
   TAG_SCHEMA_IRI,

package/dist/{task-WQLMPN5U.js → task-7AOBP7WC.js}

@@ -3,11 +3,11 @@ import {
   TaskSchema,
   getTaskStatusCategory,
   isCompletedTaskStatus
-} from "./chunk-3RB2FMMO.js";
-import "./chunk-6OPZJ7MG.js";
-import "./chunk-ZICIXDEE.js";
-import "./chunk-O64EK5FK.js";
-import "./chunk-JESSJ5CZ.js";
+} from "./chunk-UQM3G5A2.js";
+import "./chunk-OCMSAKWV.js";
+import "./chunk-T5AZAOG5.js";
+import "./chunk-EBNMV2VO.js";
+import "./chunk-RL64OJJ5.js";
 export {
   TASK_STATUS_CATEGORIES,
   TaskSchema,

package/dist/task-view-NUGKELJP.js

@@ -0,0 +1,10 @@
+import {
+  TaskViewSchema
+} from "./chunk-4EYKGTSQ.js";
+import "./chunk-OCMSAKWV.js";
+import "./chunk-T5AZAOG5.js";
+import "./chunk-EBNMV2VO.js";
+import "./chunk-RL64OJJ5.js";
+export {
+  TaskViewSchema
+};

package/dist/transaction-ZDSEGDIR.js

@@ -0,0 +1,12 @@
+import {
+  TRANSACTION_SCHEMA_IRI,
+  TransactionSchema
+} from "./chunk-MBTUO3ZL.js";
+import "./chunk-OCMSAKWV.js";
+import "./chunk-T5AZAOG5.js";
+import "./chunk-EBNMV2VO.js";
+import "./chunk-RL64OJJ5.js";
+export {
+  TRANSACTION_SCHEMA_IRI,
+  TransactionSchema
+};

package/dist/transcription-PSCLDAGX.js

@@ -0,0 +1,12 @@
+import {
+  TRANSCRIPTION_SCHEMA_IRI,
+  TranscriptionSchema
+} from "./chunk-2ZNJWIQG.js";
+import "./chunk-OCMSAKWV.js";
+import "./chunk-T5AZAOG5.js";
+import "./chunk-EBNMV2VO.js";
+import "./chunk-RL64OJJ5.js";
+export {
+  TRANSCRIPTION_SCHEMA_IRI,
+  TranscriptionSchema
+};

package/dist/{types-Def-5Nka.d.ts → types-S-BJAKyK.d.ts}

@@ -220,6 +220,15 @@ interface NodeQueryDescriptor {
     spatial?: NodeQuerySpatialFilter;
     search?: NodeQuerySearchFilter;
     materializedView?: NodeQueryMaterializedViewOptions;
+    /**
+     * Authorization fingerprint stamped by `NodeStore` when a materialized view
+     * is read under an active read-authorization evaluator (exploration 0226).
+     * It is NOT part of the descriptor hash (it is stripped by
+     * `withoutNodeQueryMaterializedView`) — a change is reported as a distinct
+     * `'authz-changed'` refresh reason rather than `'descriptor-changed'`. Set
+     * internally by the store, never by callers.
+     */
+    authFingerprint?: string;
 }
 interface NodeQueryPlanMetadata {
     strategy: 'storage-query' | 'list-fallback' | 'auth-pushdown-candidates';
@@ -245,7 +254,7 @@ interface NodeQueryPlanMetadata {
     fullTextSearchQuery?: string;
     materializedViewId?: string;
     materializedCacheHit?: boolean;
-    materializedRefreshReason?: 'missing' | 'descriptor-changed' | 'invalidated' | 'expired' | 'force-refresh';
+    materializedRefreshReason?: 'missing' | 'descriptor-changed' | 'authz-changed' | 'invalidated' | 'expired' | 'force-refresh';
     materializedGeneratedAt?: number;
     materializedInvalidatedAt?: number;
     materializedRowCount?: number;
@@ -817,6 +826,21 @@ interface NodeState {
  * Implementations can use SQLite or memory.
  * The adapter stores Changes and materialized NodeState.
  */
+/**
+ * Filters a candidate node set down to the rows the current viewer may read.
+ * Only ever removes rows. Used by adapters to authorize a materialized view's
+ * id list once, at refresh time (exploration 0226).
+ */
+type NodeReadAuthorizer = (nodes: NodeState[]) => Promise<NodeState[]>;
+/**
+ * A reload-stable version of the authorization-relevant control-plane state.
+ * `count` and `maxUpdatedAt` over grants and `/sys/authz/` resources change
+ * whenever any grant is added, modified, or removed.
+ */
+interface AuthorizationStateVersion {
+    count: number;
+    maxUpdatedAt: number;
+}
 interface NodeStorageAdapter {
     /** Open/initialize the storage connection */
     open?(): Promise<void>;
@@ -869,6 +893,23 @@ interface NodeStorageAdapter {
     listNodes(options?: ListNodesOptions): Promise<NodeState[]>;
     countNodes(options?: CountNodesOptions): Promise<number>;
     queryNodes?(descriptor: NodeQueryDescriptor): Promise<NodeQueryResult>;
+    /**
+     * Inject the read-authorization filter the adapter applies before persisting
+     * a materialized view's id list (exploration 0226). `NodeStore` wires this to
+     * its `filterReadableNodes` so a materialization is authorized exactly once,
+     * at refresh time, and cache hits can be served without per-row re-checks.
+     * Pass `undefined` to clear it. Optional: adapters that don't implement it
+     * simply never materialize under authorization (the store falls back to the
+     * authorize-then-paginate path).
+     */
+    setNodeReadAuthorizer?(authorizer: NodeReadAuthorizer | undefined): void;
+    /**
+     * A cheap, reload-stable version stamp of the authorization-relevant state
+     * (grants + `/sys/authz/` resources). Folded into the materialized view's
+     * auth fingerprint so any grant change invalidates cached views across
+     * reloads. Optional; when absent the store will not materialize under authz.
+     */
+    getAuthorizationStateVersion?(): Promise<AuthorizationStateVersion>;
     /** Optional runtime operation counters for import diagnostics. */
     getOperationStats?(): Promise<SQLiteOperationStats | null> | SQLiteOperationStats | null;
     /** Reset optional runtime operation counters before a focused measurement. */
@@ -883,6 +924,16 @@ interface NodeStorageAdapter {
      */
     getSyncCursor?(room: string): Promise<number>;
     setSyncCursor?(room: string, lamport: number): Promise<void>;
+    /**
+     * Generic app-state key/value, stored in an FK-free table. Used for blobs
+     * that are *not* node documents (e.g. the sync registry's tracked-node set):
+     * writing those through {@link setDocumentContent} hits `yjs_state`'s
+     * `node_id → nodes(id)` foreign key and fails with SQLITE_CONSTRAINT_FOREIGNKEY
+     * (exploration 0227). Optional: callers fall back to document content when an
+     * adapter doesn't implement it.
+     */
+    getAppState?(key: string): Promise<string | null>;
+    setAppState?(key: string, value: string): Promise<void>;
     getDocumentContent(nodeId: NodeId): Promise<Uint8Array | null>;
     setDocumentContent(nodeId: NodeId, content: Uint8Array): Promise<void>;
 }
@@ -1522,4 +1573,4 @@ type InferNode<P extends Record<string, PropertyBuilder>> = {
     createdBy: DID;
 } & InferProperties<P>;
 
-export { type PropertyKey as $, createNodeId as A, type PropertyType as B, type CreateNodeOptions$1 as C, type DefinedSchema as D, type PropertyDefinition as E, type ValidationError as F, type GetWithMigrationOptions as G, type CreateNodeOptions as H, type InferCreateProps as I, type InferPropertyType as J, type InferProperties as K, type ListNodesOptions as L, type MigratedNodeState as M, type NodeQueryPageCountMode as N, type OfflineAuthPolicy as O, type PropertyBuilder as P, type InferNode as Q, type SchemaLens as R, type SchemaIRI as S, type TransactionOperation as T, type UpdateNodeOptions as U, type ValidationResult as V, type LensOperation as W, type MigrationResult as X, MigrationError as Y, LensRegistry as Z, lensRegistry as _, type Schema as a, type StoreAuthKeyManager as a$, type NodePayload as a0, type PropertyTimestamp as a1, type SetNodeOptions as a2, type ImportNodesOptions as a3, type RebuildNodeIndexesOptions as a4, type ApplyNodeBatchInput as a5, type ApplyNodeBatchResult as a6, type NodeBatchIndexMode as a7, type NodeBatchNotificationMode as a8, type NodeBatchSyncMode as a9, createNodeQueryDescriptor as aA, encodeNodeQueryCursor as aB, decodeNodeQueryCursor as aC, nodeQueryDescriptorToOptions as aD, serializeNodeQueryDescriptor as aE, matchesNodeQueryDescriptor as aF, filterNodeQueryResults as aG, sortNodeQueryResults as aH, applyNodeQueryDescriptor as aI, getNodeQuerySearchTokens as aJ, nodeQueryDescriptorNeedsBoundedReload as aK, withoutNodeQueryPagination as aL, withoutNodeQueryMaterializedView as aM, isTempId as aN, TEMP_ID_PREFIX as aO, resolveTempIds as aP, createSchemaLookup as aQ, type SchemaLookup as aR, type TempIdResolution as aS, StoreAuth as aT, GrantRateLimiter as aU, GRANT_SCHEMA_IRI as aV, isGrantActive as aW, DEFAULT_OFFLINE_POLICY as aX, mergeOfflinePolicy as aY, type StoreAuthOptions as aZ, type StoreAuthStore as a_, type NodeBatchPreflightResult as aa, type DeterministicNodeBatchWriteInput as ab, type NodeBatchWritePolicy as ac, type NodeBatchWriteTimings as ad, type CountNodesOptions as ae, type NodeQuerySpatialPoint as af, type NodeQuerySpatialRect as ag, type NodeQuerySpatialPointFields as ah, type NodeQuerySpatialRectFields as ai, type NodeQuerySpatialWindow as aj, type NodeQuerySpatialRadius as ak, type NodeQuerySpatialFilter as al, type NodeQuerySearchField as am, type NodeQuerySearchFilter as an, type NodeQueryMaterializedViewOptions as ao, type NodeQueryPageOptions as ap, type NodeQueryCursorOrderEntry as aq, type NodeQueryCursor as ar, type NodeQueryOptions as as, type NodeQueryPlanMetadata as at, type NodeQueryParityCheckMetadata as au, type ConflictResult as av, type NodeBatchChangeEvent as aw, type NodeContentCipher as ax, type ContentKeyCache as ay, type MigrationInfo as az, type ParsedSchemaIRI as b, type GrantInput as b0, type Grant as b1, StoreAuthError as b2, type StoreAuthErrorCode as b3, type GrantNode as b4, type GrantIndexStore as b5, type GrantIndexOptions as b6, type RevocationConsistency as b7, type RevocationConfig as b8, type GrantRateLimiterOptions as b9, type DocumentType as ba, DEFAULT_SCHEMA_VERSION as bb, parseSchemaIRI as bc, buildSchemaIRI as bd, normalizeSchemaIRI as be, getBaseSchemaIRI as bf, isSameSchema as bg, getSchemaVersion as bh, type OperationNodeBatchWriteInput as bi, type PropertyLookup as bj, createPropertyLookup as bk, type SortDirection as c, type SystemOrderField as d, type StoreAuthAPI as e, type NodeStoreOptions as f, type NodeStorageAdapter as g, type NodeState as h, type NodeId as i, type NodeQueryDescriptor as j, type NodeQueryResult as k, type TransactionResult as l, type DeterministicNodeImportDraft as m, type ImportDeterministicNodesOptions as n, type ImportDeterministicNodesResult as o, type NodeBatchWriteInput as p, type NodeBatchWriteResult as q, type NodeChange as r, type MergeConflict as s, type NodeChangeListener as t, type NodeBatchChangeListener as u, type NodeChangeEvent as v, GrantIndex as w, type Node as x, type DID as y, isNode as z };
+export { type PropertyKey as $, createNodeId as A, type PropertyType as B, type CreateNodeOptions$1 as C, type DefinedSchema as D, type PropertyDefinition as E, type ValidationError as F, type GetWithMigrationOptions as G, type CreateNodeOptions as H, type InferCreateProps as I, type InferPropertyType as J, type InferProperties as K, type ListNodesOptions as L, type MigratedNodeState as M, type NodeQueryPageCountMode as N, type OfflineAuthPolicy as O, type PropertyBuilder as P, type InferNode as Q, type SchemaLens as R, type SchemaIRI as S, type TransactionOperation as T, type UpdateNodeOptions as U, type ValidationResult as V, type LensOperation as W, type MigrationResult as X, MigrationError as Y, LensRegistry as Z, lensRegistry as _, type Schema as a, type StoreAuthKeyManager as a$, type NodePayload as a0, type PropertyTimestamp as a1, type SetNodeOptions as a2, type ImportNodesOptions as a3, type RebuildNodeIndexesOptions as a4, type ApplyNodeBatchInput as a5, type ApplyNodeBatchResult as a6, type NodeBatchIndexMode as a7, type NodeBatchNotificationMode as a8, type NodeBatchSyncMode as a9, createNodeQueryDescriptor as aA, encodeNodeQueryCursor as aB, decodeNodeQueryCursor as aC, nodeQueryDescriptorToOptions as aD, serializeNodeQueryDescriptor as aE, matchesNodeQueryDescriptor as aF, filterNodeQueryResults as aG, sortNodeQueryResults as aH, applyNodeQueryDescriptor as aI, getNodeQuerySearchTokens as aJ, nodeQueryDescriptorNeedsBoundedReload as aK, withoutNodeQueryPagination as aL, withoutNodeQueryMaterializedView as aM, isTempId as aN, TEMP_ID_PREFIX as aO, resolveTempIds as aP, createSchemaLookup as aQ, type SchemaLookup as aR, type TempIdResolution as aS, StoreAuth as aT, GrantRateLimiter as aU, GRANT_SCHEMA_IRI as aV, isGrantActive as aW, DEFAULT_OFFLINE_POLICY as aX, mergeOfflinePolicy as aY, type StoreAuthOptions as aZ, type StoreAuthStore as a_, type NodeBatchPreflightResult as aa, type DeterministicNodeBatchWriteInput as ab, type NodeBatchWritePolicy as ac, type NodeBatchWriteTimings as ad, type CountNodesOptions as ae, type NodeQuerySpatialPoint as af, type NodeQuerySpatialRect as ag, type NodeQuerySpatialPointFields as ah, type NodeQuerySpatialRectFields as ai, type NodeQuerySpatialWindow as aj, type NodeQuerySpatialRadius as ak, type NodeQuerySpatialFilter as al, type NodeQuerySearchField as am, type NodeQuerySearchFilter as an, type NodeQueryMaterializedViewOptions as ao, type NodeQueryPageOptions as ap, type NodeQueryCursorOrderEntry as aq, type NodeQueryCursor as ar, type NodeQueryOptions as as, type NodeQueryPlanMetadata as at, type NodeQueryParityCheckMetadata as au, type ConflictResult as av, type NodeBatchChangeEvent as aw, type NodeContentCipher as ax, type ContentKeyCache as ay, type MigrationInfo as az, type ParsedSchemaIRI as b, type GrantInput as b0, type Grant as b1, StoreAuthError as b2, type StoreAuthErrorCode as b3, type GrantNode as b4, type GrantIndexStore as b5, type GrantIndexOptions as b6, type RevocationConsistency as b7, type RevocationConfig as b8, type GrantRateLimiterOptions as b9, type DocumentType as ba, DEFAULT_SCHEMA_VERSION as bb, parseSchemaIRI as bc, buildSchemaIRI as bd, normalizeSchemaIRI as be, getBaseSchemaIRI as bf, isSameSchema as bg, getSchemaVersion as bh, type NodeReadAuthorizer as bi, type AuthorizationStateVersion as bj, type OperationNodeBatchWriteInput as bk, type PropertyLookup as bl, createPropertyLookup as bm, type SortDirection as c, type SystemOrderField as d, type StoreAuthAPI as e, type NodeStoreOptions as f, type NodeStorageAdapter as g, type NodeState as h, type NodeId as i, type NodeQueryDescriptor as j, type NodeQueryResult as k, type TransactionResult as l, type DeterministicNodeImportDraft as m, type ImportDeterministicNodesOptions as n, type ImportDeterministicNodesResult as o, type NodeBatchWriteInput as p, type NodeBatchWriteResult as q, type NodeChange as r, type MergeConflict as s, type NodeChangeListener as t, type NodeBatchChangeListener as u, type NodeChangeEvent as v, GrantIndex as w, type Node as x, type DID as y, isNode as z };

package/dist/user-widget-RLY2N46A.js

@@ -0,0 +1,8 @@
+import {
+  UserWidgetSchema
+} from "./chunk-53F4PRNC.js";
+import "./chunk-EBNMV2VO.js";
+import "./chunk-RL64OJJ5.js";
+export {
+  UserWidgetSchema
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xnetjs/data",
-  "version": "0.0.3",
+  "version": "0.1.1",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -57,12 +57,12 @@
     "nanoid": "^5.1.6",
     "y-protocols": "^1.0.6",
     "yjs": "^13.6.24",
-    "@xnetjs/core": "0.0.3",
-    "@xnetjs/crypto": "0.0.3",
-    "@xnetjs/identity": "0.0.3",
-    "@xnetjs/sqlite": "0.0.3",
-    "@xnetjs/storage": "0.0.3",
-    "@xnetjs/sync": "0.0.3"
+    "@xnetjs/core": "0.1.1",
+    "@xnetjs/crypto": "0.1.1",
+    "@xnetjs/identity": "0.1.1",
+    "@xnetjs/sqlite": "0.1.1",
+    "@xnetjs/storage": "0.1.1",
+    "@xnetjs/sync": "0.1.1"
   },
   "devDependencies": {
     "tsup": "^8.0.0",

package/dist/account-BZHETMC4.js

@@ -1,12 +0,0 @@
-import {
-  ACCOUNT_SCHEMA_IRI,
-  AccountSchema
-} from "./chunk-3JKW6TDE.js";
-import "./chunk-6OPZJ7MG.js";
-import "./chunk-ZICIXDEE.js";
-import "./chunk-O64EK5FK.js";
-import "./chunk-JESSJ5CZ.js";
-export {
-  ACCOUNT_SCHEMA_IRI,
-  AccountSchema
-};

package/dist/budget-WR2Q4YH3.js

@@ -1,12 +0,0 @@
-import {
-  BUDGET_SCHEMA_IRI,
-  BudgetSchema
-} from "./chunk-337E3ZOB.js";
-import "./chunk-6OPZJ7MG.js";
-import "./chunk-ZICIXDEE.js";
-import "./chunk-O64EK5FK.js";
-import "./chunk-JESSJ5CZ.js";
-export {
-  BUDGET_SCHEMA_IRI,
-  BudgetSchema
-};

package/dist/canvas-HFMMVQLD.js

@@ -1,10 +0,0 @@
-import {
-  CanvasSchema
-} from "./chunk-KPVBKKZS.js";
-import "./chunk-6OPZJ7MG.js";
-import "./chunk-ZICIXDEE.js";
-import "./chunk-O64EK5FK.js";
-import "./chunk-JESSJ5CZ.js";
-export {
-  CanvasSchema
-};

package/dist/channel-DXDYJ3ZH.js

@@ -1,12 +0,0 @@
-import {
-  CHANNEL_KINDS,
-  ChannelSchema
-} from "./chunk-ZMCO3O2Z.js";
-import "./chunk-6OPZJ7MG.js";
-import "./chunk-ZICIXDEE.js";
-import "./chunk-O64EK5FK.js";
-import "./chunk-JESSJ5CZ.js";
-export {
-  CHANNEL_KINDS,
-  ChannelSchema
-};

package/dist/chat-message-QUUQGXEW.js

@@ -1,10 +0,0 @@
-import {
-  ChatMessageSchema
-} from "./chunk-RSSZXCLL.js";
-import "./chunk-6OPZJ7MG.js";
-import "./chunk-ZICIXDEE.js";
-import "./chunk-O64EK5FK.js";
-import "./chunk-JESSJ5CZ.js";
-export {
-  ChatMessageSchema
-};

package/dist/comment-Y2Y3QYYI.js

@@ -1,10 +0,0 @@
-import {
-  CommentSchema
-} from "./chunk-4U4KBCDN.js";
-import "./chunk-6OPZJ7MG.js";
-import "./chunk-ZICIXDEE.js";
-import "./chunk-O64EK5FK.js";
-import "./chunk-JESSJ5CZ.js";
-export {
-  CommentSchema
-};

package/dist/dashboard-3DC6B4BJ.js

@@ -1,10 +0,0 @@
-import {
-  DashboardSchema
-} from "./chunk-2DSDH2ZH.js";
-import "./chunk-6OPZJ7MG.js";
-import "./chunk-ZICIXDEE.js";
-import "./chunk-O64EK5FK.js";
-import "./chunk-JESSJ5CZ.js";
-export {
-  DashboardSchema
-};

package/dist/database-DRGL5UYS.js

@@ -1,10 +0,0 @@
-import {
-  DatabaseSchema
-} from "./chunk-GR3NDMBY.js";
-import "./chunk-6OPZJ7MG.js";
-import "./chunk-ZICIXDEE.js";
-import "./chunk-O64EK5FK.js";
-import "./chunk-JESSJ5CZ.js";
-export {
-  DatabaseSchema
-};

package/dist/database-field-F47FY3XX.js

@@ -1,10 +0,0 @@
-import {
-  DatabaseFieldSchema
-} from "./chunk-UDUPQKRB.js";
-import "./chunk-6OPZJ7MG.js";
-import "./chunk-ZICIXDEE.js";
-import "./chunk-O64EK5FK.js";
-import "./chunk-JESSJ5CZ.js";
-export {
-  DatabaseFieldSchema
-};