@rindle/remote

A mutable holder for the current opaque affinity ticket, shared by the transport, the source, and the lease POST (see the module header).

An aggregate over a (correlated) subquery's rows (REDUCE-DESIGN.md). v1: count(*). Set on a related subquery (Ast.aggregate), it marks that relationship a count aggregate the builder lowers to a scalar-projected singular relationship (§9).

All children must hold.

Any relationship, for positions that only read its correlation / child table.

A field argument: its typed predicate, or a bare value (bare = eq sugar).

The minimal arg validator a shared mutator can carry so the SERVER can parse UNTRUSTED wire args before driving it (the client trusts its typed callsites and never calls this). Structural on purpose — a zod schema satisfies it as-is — so @rindle/client stays validator-library-agnostic.

The public ArrayView contract materialize() returns.

A single assembled (nested-by-name) row from POST /query (SSR-DESIGN.md §3.3): the cells under cols, each in-view relationship inlined by its alias (a nested array / object, or a scalar for a countAs aggregate). {@link Store.assembleSnapshot} converts these to the view's projected result shape.

The durable half of the splice for the mapped-table layout: the compacted body followed by whatever chunk rows have not been folded into it yet.

Chunks are ALWAYS the suffix after body — the closing checkpoint rewrites body and drops the chunks it absorbed in ONE transaction — so a reader never observes a torn state where a chunk both is and is not in the body.

Throw if ast references a local-only table ANYWHERE — the complete form of the {@link queries} root guard (Q1 / E3 client half). The root proxy get only sees the table accessed off the builder root; a local table reached through a relationship / sub / countAs / exists CHILD is passed as a value and never touches the proxy, so it is caught here instead: at .ast() for a server-scope builder, and again as an SSR backstop in ServerStore.preload. A server/named query may never name a local table (201-LOCAL-ONLY-TABLES-DESIGN.md §5).

The query AST. table is the only required field; the builder omits empty/false fields (matching the Rust skip_serializing_if), which the deserializer treats as absent.

A tier's ASYNCHRONOUS effect executor (the server transaction): every op is a Promise.

The seam the core talks to. Backend-agnostic: the same interface for the in-process WASM backend and a remote (network) backend. The core never knows which. A backend pushes a per-query {@link ChangeEvent} stream via {@link Backend.onEvent}; the remote backend additionally owns the epoch/seq/gap protocol and emits only clean, in-order events (so the ArrayView never sees the wire protocol).

Dev-only passive tap over a backend's authoritative server stream. Optional because in-process backends have no server stream, and older/custom backends may only expose the Store tap.

A dev-only authoritative server delta exposed by backends that can distinguish the upstream server stream from their local view/IVM stream. Flat remote backends surface clean {@link ChangeEvent}s; local-first normalized/optimistic backends surface the path-free {@link NormalizedEvent}s before they are folded into the local engine.

One transaction's flat changes (or the seq-0 hydrate snapshot). events apply in order.

A fan-out a generator mutator yields: run several effects "together". The server driver resolves them with Promise.all; the client driver runs them in array order (already synchronous). Results return in the same order on both tiers. Each result has its effect's shape: a row, query rows, undefined for a write, or an array for a nested batch. Cast the yielded result to that shape; the generator's declared next-type covers only point reads.

A paging lower bound (Bound, src/ast.rs). row is a partial wire row — the bound columns by name (only the sort columns are read by the engine's Skip comparator). exclusive ⇒ start after the bound row (Basis::After); else at it (Basis::At).

What a {@link Backend} pushes per query: the handshake (hello), the (possibly chunked) hydrate snapshot, then incremental batches. The core builds an ArrayView on hello, hydrates on snapshot, folds on batch — identically for any backend.

The phase of an {@link ArrayView.onChanges} delivery: the initial hydrate snapshot vs a later incremental batch — the same distinction a narrator draws (ChangeEvent snapshot/batch).

The system table's wire schema — appended to the client's expected schemas so the lmid query's hello passes CRIT#4 validation.

The replicated bookkeeping table carrying each client's high-water mutation id (lmid). Engine-hosted and served like any base table; reserved (never part of a user schema). Columns: [client_id, last_mutation_id], PK client_id.

A column descriptor. type drives the comparator + JSON parsing; __t is a phantom. A nullable column is a Col<T | null> — that is the ONLY thing nullability changes at the type level, so RowOf (and the field-condition factory) widen automatically.

optional is the runtime companion of that phantom: set by {@link ColBuilder.nullable}, it is what the write funnels read to make a nullable column omittable from an insert (filled with null, design 206 §6.2). It mirrors the engine's ColumnDef.optional (pragma_table_info.notnull == 0); absent ⇒ NOT NULL / required.

The chainable form returned by the column factories: a {@link Col} plus .nullable().

.nullable() widens the column's value type to T | null — its Row<…> field becomes T | null — and sets the runtime {@link Col.optional} marker so it may be omitted from an insert (design 206 §6.2). rindle schema gen emits .nullable() for every nullable (non-NOT NULL) SQL column; you can also call it by hand on a local-only table's columns. It is idempotent and stays chainable.

Per-column narrowings for {@link refineTable}: each entry must keep the column's kind and narrow its TS type (Col<T2> with T2 extends T) — json<Meta>() on a json column, a literal-union string<"a" | "b">() on a string column. Kind changes are rejected (cross-kind at compile time, same-phantom kind flips like string() on a json column at runtime).

name → columns, the resolved schema map carried in the {@link Schema} type.

Declared column type (from the typed schema) — drives the comparator + JSON parsing. "int64" is the exact-i64 column plane (design 226): the vocabulary exists from Stage C4 (codegen can name it), but no exact integer cell crosses this wire — and WireValue gains no bigint — until Stage E lands the browser bigint plane; until then the daemon refuses IVM queries whose footprint touches such a column.

The compare_values / compare_rows algorithm-contract version (=== the engine's wire_schema::COMPARATOR_VERSION). A remote subscriber hard-rejects a hello whose comparatorVersion differs — the total order is a code contract, not data, so a schema fingerprint can't cover it. Bump in lockstep with the Rust constant if the order changes.

v2 (design 226 Stage B): the engine's mixed Int/Float comparison became exact instead of f64-widening. No TS behavior change — every value a client can hold today is an f64 number, on which v1 and v2 order identically (the §8 gate keeps int64 cells out of the browser until Stage E) — but the contract the version names is the engine's.

number compare with f64::total_cmp semantics (NaN deterministic & last; -0 < +0).

Compare two rows by a resolved sort ([columnIndex, ascending] pairs). First non-equal column wins; a descending column negates.

UTF-8 bytewise string compare (=== SQLite BINARY / Rust &str Ord). Correct for supplementary-plane code points, where JS < / localeCompare (UTF-16) would disagree.

Compare two bare cells, dispatching on the runtime type (null sorts first).

A condition over row R. The runtime value is the wire {@link Condition}; R is a phantom brand so a condition for one table can't be .where()d onto another.

The filter tree — type-tagged; recursive. There is no generic NOT node (negation is via the negated operators and NOT EXISTS, matching src/ast.rs Condition).

Build an {@link AffinityTicketStore}, optionally persisted. Pure/in-memory when persist is omitted.

A MutationEnvelopeSender (the pushMutation option of RemoteOptimisticSource) that queues envelopes and delivers them as confirmed, in-order batches.

Convenience: a RemoteNormalizedSource over a ws URL or a custom transport.

Convenience: a RemoteOptimisticSource over a ws URL or a custom transport. A URL becomes a replaceable connection seeded at that endpoint (so a routed lease can still migrate it); a pre-built transport stays fixed.

Convenience: a Store backed by a remote server, over a ws URL or a custom transport.

Construct a {@link ServerStore} — the one-shot REST Store for server-side rendering.

Define a co-located, composable {@link Fragment}: a named selection over table. The returned value is callable (the build transform), so it threads through the existing sub/Rels spine — no GraphQL, no codegen, no schema change (design §3).

const UserAvatar = defineFragment(schema.user, (f) => f.select("id", "name", "avatarUrl"));
const CommentRow = defineFragment(schema.comment, (f) =>
  f.select("id", "body", "authorId")
   .sub("author", schema.user, { parent: ["authorId"], child: ["id"] }, UserAvatar));

Define ONE co-located, named query. Keep it next to the component that reads it (a *.queries.ts file), so a query lives where its fragments and its component live.

The returned value is callable on the client (it stamps its result with name + args, so the subscription SYNCS) and registerable on the server ({@link registerQueries }). The optional validate step turns untrusted wire args into the canonical args type — and that type flows to both the call signature and build, so the shape is written exactly once. validate runs on BOTH tiers (it builds the byte-identical authoritative AST on the server, and guards + guarantees the same AST on the client). If the server must DIVERGE from the client, define a second defineQuery with the same name for the server and register that one instead.

build may take a second CONTEXT parameter (see {@link QueryBuilder}). Context is off-wire: the client passes its session ctx at the callsite, the server injects its authoritative ctx — so a per-user query stays symmetric without ever trusting (or transmitting) a client-supplied identity.

// recentComments({ limit }) — validated, no ctx, byte-identical on both tiers
export const recentCommentsQuery = defineQuery(
  "recentComments",
  (raw): { limit: number } => ({ limit: validateFeedLimit(raw) }),
  ({ limit }) => q.comment.orderBy("createdAt", "desc").limit(limit).include(FeedItemFragment),
);

// myIssues({ limit }, ctx) — ctx-scoped; the wire still carries only { limit }
export const myIssuesQuery = defineQuery(
  "myIssues",
  (raw): { limit: number } => ({ limit: validateLimit(raw) }),
  ({ limit }, ctx: { user: string }) => q.issue.where.ownerId(ctx.user).limit(limit),
);
// client: myIssuesQuery({ limit: 20 }, { user: currentUser() })

Options for {@link defineQuery}.

A typed registry of named {@link Relationship}s — defineRelationships({ issueOwner: rel(...) }). A thin identity helper that names the bag and constrains its values; the keys are yours to choose.

One query's SSR snapshot, keyed by its viewKey ({@link stableKey} of the AST): the pre-projected first-paint rows plus the cvMin watermark they reflect (SSR-DESIGN.md §6.2). Serializable as-is into the HTML — rows are already JSON values (json columns parsed).

The whole dehydrated cache: every preloaded query's snapshot, keyed by viewKey. The server builds it with {@link Store.dehydrate}; the browser seeds it with {@link Store.hydrate}.

Drive a generator mutator ASYNCHRONOUSLY (the server, against the open transaction). Writes are awaited (harmless: a single interactive Postgres connection serializes statements anyway, and the daemon backend resolves them instantly), reads (point or query) suspend, and a batch fans out with Promise.all.

Drive a generator mutator SYNCHRONOUSLY (the client, inside the wasm write transaction). Each yielded write applies immediately; each read (point or query) is resolved and fed back; a batch runs in order.

When an {@link QueryEnsureCache.ensure} call may resolve.

• complete waits for the server-authoritative result (the default).
• present resolves as soon as the local view contains a result, while the remote retain keeps revalidating in the background. An authoritative empty result also resolves it, so a real not-found query never waits forever.

present deliberately does not add a partial {@link ResultType}: a locally useful answer and server authority are independent facts. While it resolves early, the view's result type remains unknown until the server says otherwise.

EXISTS by a named {@link Relationship} — correlation from the rel; the parent row type is the relationship's parent, so the condition lands on the matching .where(). EXISTS (<correlated subquery>) — a condition (use inside where/or/and).

EXISTS (<correlated subquery>) as a server-only, non-syncing gate (exists_noSync). Identical to {@link exists} for filtering parent visibility, but stamps the subquery system: "permissions", so the engine's normalized serializer prunes its witnesses from the footprint — the permission table's rows are never synced to the client and the client never re-evaluates the gate. Use this when building the server's query (the user's API server); the client holds its own un-gated query.

Options for exists / notExists.

Extend a generated/synced schema with client-authoritative local-only tables.

This is the ergonomic path for SQL-first apps: keep schema.gen.ts fully generated, define private UI tables in a tiny hand-written file, then hand the combined schema to the browser client. The added tables MUST be table(name, { local: true }): extendSchema deliberately refuses to append ordinary synced tables, because those need to come from daemon introspection (rindle schema gen) so the server and client cannot drift.

Build a simple condition from a field name + (predicate | bare value).

A positional change at one level of the view tree. A remove ships only the leaving row (the receiver already holds the subtree and locates it by key) — node is NEVER on the wire; it is an OPTIONAL client-side enrichment carrying the full removed subtree, attached by the ArrayView when a change consumer opts in (Store.subscribeChanges(_, { removedSubtree: true })), so a narrator can resolve a removed row's nested subs just as it can on an add.

A reusable, typed selection over a table — Relay's "fragment", promoted to a first-class value. Two verbs compose a fragment, on one axis — does its data belong to THIS row or to a related one:

• SAME node — q.include(Frag): merge its selection into this node. This is also how you root a fragment onto a base query — queries.t.where.id(x).include(Frag).
• CHILD node — q.sub(alias, child, corr, Frag): nest it under a relationship (sub's 4th arg).

A Fragment is therefore also a build transform ((q: Query<C>) => Query<C, Rels>); that call signature is the mechanism by which sub accepts a fragment as its build. Prefer include to root a fragment (canonical + merged) over calling it directly. It additionally carries its table (for {@link FragmentRef}/useFragment typing and masking). Composing fragments assembles ONE {@link Ast} → one materialization → one /query — the whole point (no request waterfall; design §1).

The data returned by useFragment(fragment, ref): the fragment's own selected columns plus immediate relationship values. Relationships whose builder is another fragment surface as opaque {@link FragmentRef}s, so child-owned payload is read only by the child fragment reader.

The opaque token a parent passes to a component that reads {@link FragmentData} for F.

The resume point a frame implies — what rides an SSE id: line so a reconnecting EventSource hands it straight back as Last-Event-ID. undefined for frames that are not a position.

The subscription handshake, sent once before any {@link Batch}.

The insert type of a table def: Insert<typeof issue> → { id: string; … assignee?: string | null }. The whole-table ergonomic form of {@link InsertOf} (the insert-side twin of {@link Row}).

The cell a full insert writes for column c: the given value, or null when a nullable column is omitted (design 206 §6.2). The caller's completeness check ({@link InsertPlan.required}) guarantees a non-nullable column is present, so its omission never reaches here.

The INSERT shape of a column map: {@link RowOf} with every NULLABLE column made OPTIONAL (?) — it may be omitted and is filled with null by both write funnels (design 206 §6.2/§7). NOT NULL columns stay required. The insert-side twin of {@link RowOf}, mirroring Drizzle's $inferInsert vs $inferSelect split.

Derive a table's {@link InsertPlan} from its column markers.

A table's insert-completeness plan, derived once from its Col markers and shared by BOTH write funnels — the client trackingTx and the server renderOp — so their required-sets can't drift (design 206 §6.1/§6.2). A NOT NULL column is required; a nullable column (.nullable() set Col.optional) may be omitted and is filled with null (see {@link insertCell}). PK columns are never nullable (introspection forces them non-null), so they are always required.

The exact-i64 column plane (design 226, BIGINT/INT8 decltype): typed bigint in application code. The vocabulary exists from Stage C4 so generated schemas can name it; no exact integer cell enters the browser IVM until Stage E — until then the daemon refuses IVM queries whose footprint touches the column, and the SQL plane carries it.

Runtime guard: is v a {@link Fragment} (a defineFragment value, not a plain build fn)?

True iff fn is a generator function (a shared/isomorphic mutator) rather than a plain function — the driver accepts both forms. Detected structurally (native GeneratorFunction).

Whether table is a {@link TableMeta.locallocal-only} table in schema (an unknown table reads as non-local). The single locality predicate the backends key off. BOTH variants — true and "session" — are local here; the persisted/ephemeral split matters only to the persistence plane ({@link persistedLocalTableNames}).

IS NOT NULL — the negation of {@link isNull}; V is inferred from the field, like {@link isNull}.

IS NULL — a field-agnostic null check. V is inferred from the field's expected Arg<V> (e.g. where.signedAt(isNull())), so it fits a column of any type without a cast.

The one shared effect factory (stateless — see {@link IsoTx}). Its methods just BUILD a {@link MutationOp}, so the single instance serves every schema; the generic {@link IsoTx} view is applied at the authoring site (a json<T> cell is a parsed object here and is stringified by the funnels, {@link toCell }), hence the cast — the runtime shape is schema-agnostic.

The tier-AGNOSTIC effect factory a generator mutator writes against. Every method just BUILDS an effect to yield — it performs no I/O and holds no state, so the single {@link isoTx} instance is shared by every mutator on both tiers; only the driver differs. insert/upsert/insertIgnore require non-nullable columns and permit nullable omissions, which become null. update/delete require the PK columns; update also names the columns to change.

The typed {@link IsoTx} for a given schema — IsoTxOf<typeof schema>. Use it to annotate a helper that a mutator body passes its tx to (e.g. const ensureUser = (tx: IsoTxOf<typeof schema>, …)), so the helper gets the same table/column/pk typing the defineMutators shared callback does.

Runtime guard: is v a {@link Relationship} value (not a table or a plain object)?

Whether name collides with an engine-reserved synthetic prefix ({@link RESERVED_TABLE_PREFIXES}).

A keyed row: column name → cell. The ergonomic write shape (validated against the schema at runtime). JSON columns carry their raw JSON string (a {@link WireValue}), never a parsed object.

An untagged literal (null | bool | number | string | array). Numbers are one f64.

The reserved server-query name every optimistic client subscribes at connect: the one-row system query CLIENT_MUTATIONS_TABLE WHERE client_id = <me>. The server derives the identity from the connection (args are ignored).

A stable fingerprint of the schema's PERSISTED local tables only — the persistence gate's schemaHash (207-LOCAL-TABLE-PERSISTENCE-DESIGN.md §3.3 / P7). Per local: true table: (name, ordered column names + types + optionality, pk columns). Column order is kept (rows are positional); tables are sorted by name so registration order can't skew it; synced-table AND local: "session" changes never move it (reshaping an ephemeral table must not wipe durable data). The value is the canonical descriptor itself, not a digest — local-table sets are tiny, and exactness (no collision can ever skip a P7 clear) beats compactness here.

The set of local-only table names in schema (201-LOCAL-ONLY-TABLES-DESIGN.md §4) — BOTH variants (true and "session"); every locality rule except persistence keys off this set.

The upstream named-mutator envelope (OPTIMISTIC-WRITES-DESIGN.md §8.1): the wire carries the name + JSON args, never code; mid totally orders a client's mutations.

What a generator mutator IS: yield tx.<op>() on every side effect; a yield tx.row() expression evaluates to the row. Neither sync nor async — the tier's driver decides, which is what lets one body run synchronously on the client and against a live async transaction on the server.

One structured write intent — the discriminated union that mirrors the write half of the client MutationTx 1:1. Keyed (column-name addressed), so it is independent of column order.

A room authority's verdict for a NON-applied mutation (RINDLE-REALTIME-QUERY-ENABLEMENT §3.3, the deopt handshake; Slice H-iv-b server half / H-v client half). Sent on the author's own socket for every mutation the room did NOT apply, always BEFORE the lmid ack that burns the mid (same-socket ordering only — the ack may reach the client through another path first, e.g. a replayed lmid snapshot). Applied mutations send NOTHING: silence + lmid coverage ⇒ applied.

• kind: "deopt" — the room's §3.3 commit gate refused the routed mutation (or its environment fell short, e.g. tx.query); the mid is burnt in the ROOM ledger with zero effects and the client re-enqueues the same logical mutation onto the daemon stream. name/args are echoed so the frame is SELF-CONTAINED: a client that already retired the entry (the burnt-mid confirm won the race, or the frame is a replay re-answer) re-invokes from the frame alone.
• kind: "rejected" — FINAL (authz/validation): the mid is burnt the same way and the prediction snaps back on the ordinary lmid release; no re-route.

reason may be absent on a re-answered frame whose record was seeded from journal replay (the verdict is journaled; the reason is not).

The minimal per-invocation context a shared mutator sees on BOTH tiers: the acting principal. The server injects its AUTHENTICATED user; the client injects its local user. (The server's own MutationContext is a superset of this.)

A single, co-located NAMED query (see {@link defineQuery}). It is:

• callable on the client — q(args, ctx?) validates + builds + stamps the result with its remote subscription identity (name + args — NOT ctx), so a component that imports it always SYNCS. There is no unstamped builder to import by accident.
• registerable on the server — it carries its queryName and a resolve that re-runs the SAME validator on untrusted wire args and builds the AUTHORITATIVE Query from the server's own ctx ({@link registerQueries registerQueries} in @rindle/api-server).

Ctx is the ctx parameter list mirrored from build — [], [ctx: C], or [ctx?: C]. It is never part of the wire identity.

A row named against its level's wire columns.

A schema-bound query-builder factory for portable client/server query definitions. SERVER scope: local-only tables are excluded (a named/remote query may never reference one).

One committed transaction's normalized ops (or the seq-0 hydrate snapshot). cv (the global commit version the frame reflects) is stamped by optimistic-protocol servers and rides through to the NormalizedEvent (OPTIMISTIC-WRITES-DESIGN.md §8.3).

A per-query NORMALIZED stream event — the path-free twin of {@link ChangeEvent}. The hello carries the flat per-table schemas (no nested view schema, §3); snapshot/batch carry table-tagged {@link NormalizedOp}s. The NormalizedSync layer folds these into the local engine's base tables.

cv (the global commit version the frame's data reflects — OPTIMISTIC-WRITES-DESIGN.md §8.3/§8.6) is present on sources that speak the optimistic protocol; the plain normalized path may omit it.

A tables set's content fingerprint — FNV-1a 64 over the canonical, length-prefixed byte stream of rindle-replica::normalize_protocol::normalized_fp (PK resolved to column NAMES), as 16-char lowercase hex (=== the Rust hex). tables MUST be sorted by name (the server's NormalizedPublisher guarantees it) so the fingerprint is order-stable.

The slim normalized handshake (§3), sent once before any {@link NormalizedBatch}.

A table-tagged, path-free row delta — the normalized wire payload (the path-free twin of {@link FlatChange}; NORMALIZED-CHANGES-DESIGN.md §3). Rows are positional (bare cells; a json column is its raw JSON string). op is the discriminant. Lives here (not in @rindle/normalized) so both the protocol (@rindle/remote) and the sync layer share one type.

The server side of the normalized local-first path (NORMALIZED-CHANGES-DESIGN.md §5/§7): registers queries and pushes each one's normalized footprint stream ({@link NormalizedEvent}s). Both the in-process native (@rindle/replica) source and the ws (@rindle/remote RemoteNormalizedSource) implement it; @rindle/normalized's NormalizedBackend consumes one, never knowing which — a sibling seam of {@link Backend} for the normalized composition.

Receiver side: validates a normalized frame stream (comparator at hello; per batch — epoch match, fingerprint match, strict in-order seq) and emits clean NormalizedEvents. It does NOT fold (the NormalizedSync layer does). Mirrors the flat {@link Subscriber }.

One base table's flat schema on the normalized hello (§3): column names (in order) + primary-key column indices. Wire rows are positional against columns.

The client's per-table flat schema (name + column order + PK indices), the shape a normalized hello advertises (NORMALIZED-CHANGES-DESIGN.md §3). Used to validate a server hello against the CLIENT's own typed schema so a column-order / PK skew is caught instead of silently transposing positional cells (CRIT#4). Sorted by name for stable ordering.

Local-only tables are omitted (201-LOCAL-ONLY-TABLES-DESIGN.md E1): the client never claims them to the server, the server never expects/ships them, and they stay out of the schema fingerprint (normalizedFp) so a local table can't skew it vs. the server's.

NOT EXISTS by a named {@link Relationship}. NOT EXISTS (<correlated subquery>).

NOT EXISTS (<correlated subquery>) as a server-only, non-syncing gate — the NOT EXISTS form of {@link existsNoSync} (a deny-style permission rule).

The subprotocol list to offer for one connection: the base protocol always, plus the held ticket (already an aff.<…> token) when one exists.

A no-op live backend for SSR (SSR-DESIGN.md §6.1): it opens no transport and never streams. registerQuery is inert, mutate rejects, and no ChangeEvent is pushed. Every view stays PENDING — reading its SSR {@link Store.seedAssembledseed} — and, lacking onResultType, reports complete (a backend with no server lifecycle leaves every view authoritative).

The one-shot read the server Store calls to preload a query. Two topologies inject different fns (SSR-DESIGN.md §6):

• Direct to the daemon (the trusted tier holds the daemon token): use ast — (i) => daemon.query(i).
• Through the application's API tier (the authority resolves names → ASTs, the loader never sends a raw AST): use name/args — (i) => fetch('/api/rindle/read', {name: i.name, args: i.args}).

ast is always present (the Store seeds the local view by its viewKey); name/args are present when the preloaded query came from defineQuery. This Store does not authenticate users or filter rows. The injected function must enforce access: either call the authenticated API route, or authorize and construct the AST before a privileged direct daemon read.

An authorized one-shot read result, as far as the server Store needs it: the assembled rows plus the cvMin baseline they reflect. (Matches @rindle/daemon-client's QueryOnceOutput, but @rindle/client stays dependency-free — inject the call.)

The server side of the OPTIMISTIC path (OPTIMISTIC-WRITES-DESIGN.md §8): the {@link NormalizedSource} stream with cv-tagged data frames, plus the connection-level {@link ProgressFrame} channel and the named-mutator upstream. The client buffers data frames by cv and applies all cv ≤ cvMin as one coherent release (§8.5).

At least one child must hold.

One (field, direction) ordering — serializes as the 2-tuple ["id", "asc"].

The subset of {@link localTableNames} eligible for the persistence plane — local: true only. A local: "session" table stays outside it: never persisted, never replicated across tabs (207-LOCAL-TABLE-PERSISTENCE-DESIGN.md §5.4).

The primary-key column union for table N of a schema, read from its __pk map P and narrowed to N's actual columns (falling back to all columns when P doesn't name N — e.g. the loose default schema). Feeds {@link PkOf}/{@link UpdateOf} in the typed mutator tx.

name → (some subset of its column names): the loose shape a {@link Schema}'s pk-map satisfies. The fallback when a schema wasn't built through {@link createSchema} — every column could be the pk.

name → its primary-key column union, derived from the tables array (the PK captured by the primaryKey(...) builder). Powers the mutator tx's typed update/delete/row pk args.

The exact PRIMARY-KEY columns of a table (each typed), required — the identity a delete/row, and the WHERE half of an update, take. PK is the table's pk-column union (the schema's __pk).

A value predicate (an operator applied to a value). V is a phantom for type-checking.

The connection-level progress frame (§8.6): advances the coherent-apply release point (cvMin). A pure release signal — mutation confirmation does NOT ride it: lmid is a row in {@link CLIENT_MUTATIONS_TABLE}, delivered through the client's own per-client system query ({@link LMID_QUERY_NAME}) like any data, so it is released by the same cvMin as the commit's effects (transactionally coherent by construction).

A protocol violation. All but a duplicate (handled silently) are unrecoverable for the current subscription — the RemoteBackend re-hydrates under a new epoch.

Sender side: stamps batches with the subscription epoch + schemaFp and drives the gap-free seq. The hydrate snapshot is seq 0; increments are seq 1, 2, …. An empty transaction emits no batch and consumes no seq (so a gap always means a lost batch).

One envelope's outcome from the API server's mutate endpoint.

A typed query entry over a schema: queries(schema).issue.where.closed(false)….

Scoping for {@link queries} (201-LOCAL-ONLY-TABLES-DESIGN.md §5).

What {@link IsoTx.query} accepts: a query handle whose .ast() lowers to the wire {@link Ast} — exactly what the typed query builder produces (newQueryBuilder(schema).<table>…, the tier-agnostic server-scope builder both tiers can construct because it performs no I/O). Structural so the seam need not carry the builder's heavy generics.

Build a Query (an Ast constructor) from already-validated args, plus an optional CONTEXT — the authenticated principal the query is scoped to. Ctx is off-wire: the client passes its own session ctx at the callsite, the server injects the AUTHORITATIVE ctx ({@link NamedQuery.resolve} via registerQueries), and the wire still carries only name + args. Both tiers run the same build, so whenever their ctx agrees the AST is byte-identical — and a client can never spoof it, since the server re-derives ctx from its trusted session and ignores anything the client claimed.

The ctx is a tuple so a query opts into it by how it types build's second parameter — and that shape becomes the call signature verbatim:

• (args) => Q — no ctx (q(args)).
• (args, ctx: C) => Q — ctx REQUIRED (q(args, ctx)); for always-authenticated queries.
• (args, ctx?: C) => Q — ctx OPTIONAL (q(args) or q(args, ctx)); sound only when "no ctx" is a real, SYMMETRIC state — i.e. the build yields the SAME broad AST whether ctx is absent or present-with-no-user (anonymous / SSR), since the server always forwards a ctx (possibly anonymous). Otherwise type ctx required so the type catches an omitted ctx.

A full-shape read a generator mutator yields — a where/orderBy/limit/join query over the state this mutator is mutating (read-your-writes, like {@link ReadEffect} but an arbitrary shape). Evaluates to {@link QueryResultRow}[] — ALWAYS an array of the matching rows, in the query's order, on BOTH tiers (a root .one() is not unwrapped here: take [0]). The single next-type is a row, so cast the yield ((yield tx.query(q)) as unknown as QueryResultRow[]), same as all.

Deduplicates route/intent preloads and holds their live view through the navigation handoff.

The cache materializes the real named query rather than retaining sync coverage alone: that is what makes until: "present" observable for overlapping queries already satisfied by local normalized rows. Once the server marks the query complete, the entry is kept briefly for a destination component to take its own retain, then released automatically.

The structural surface consumed by framework adapters such as @rindle/tanstack.

One live materialized view's read-only summary for a devtools pane (DEBUG-TOOLS-BROWSER-DESIGN §4.2 — "surface, not instrument"). All fields are already held by the {@link Store}; this is the single read-only accessor over the otherwise-private views/asts maps.

A row returned by a {@link QueryEffect}: column name → cell, plus each materialized relationship name → its nested row(s) — an array (a plural relationship) or a single row / null (a .one() relationship). Recursive. Presented identically on both tiers (a view.data row of the same query).

Turn raw, UNTRUSTED wire args into the canonical, typed args a query is built from. Its return type IS the query's args type — written once, it flows to both the client call signature and the build step, so there's no second place to restate the shape.

A point read a generator mutator yields; the driver resolves it and feeds the row back through gen.next(row). Read-your-writes on every tier: the client reads its local engine, and both server backends read the open transaction (the daemon via an interactive mutation session).

The realtime LABEL a named query may declare (RINDLE-REALTIME-QUERY-ENABLEMENT-DESIGN.md §2.1): which api-server room PROFILE the query wants to be served from, and how the query's args map to that profile's key args. This is the DECLARATION only — the serve decision (covering proof, lease routing) is the server's, and the final room key is minted server-side by the profile's own key under authoritative ctx, so a label can never place a query in a room the server didn't derive itself. Both tiers import the SAME defineQuery value, so they always agree which profile a query belongs to.

A table def acceptable to {@link refineSchema} over Schema<S>: its NAME must be one of S's tables (a def for an unknown table is a compile error at the call site).

C with the columns named in R re-typed to their refined Cols.

S with each table named in T re-typed to that def's (refined) columns. (The inner extends AnyCols guard is how the checker proves the remapped SchemaOf<T>[K] is a column map while T is still generic; it always holds for a concrete T.)

Swap {@link refineTable}-narrowed table defs into a generated schema, re-typing those tables for everything downstream of the schema (newQueryBuilder/queries roots, store row types).

Runtime-validated identity: each def must name a table already in the schema and match its runtime shape exactly (same columns, kinds, primary key, and locality) — refinement narrows TS types, never what's on the wire. Composes with {@link extendSchema} in either order.

Narrow a generated table's column TYPES without touching its runtime shape.

Returns the SAME def, re-typed (identity, after validating that every refined column exists and keeps its kind) — so conditions built from it, rel(...)s anchored on it, and Row<typeof t> all see the narrowed types. Pass the result to {@link refineSchema} so query roots narrow too.

Declare a relationship once: rel(issue, user, { ownerId: "id" }) means issue.ownerId → user.id. mapping is { [parentColumn]: childColumn } (a composite join is multiple entries). The parent table is used only to type-check the keys; pass the result to sub/countAs/exists.

A reusable, typed JOIN between two tables — the correlation declared once (design §4). Built with {@link rel}; parameterized by the parent columns PC (so a sub checks the relationship belongs to the query's table) and the child columns CC (which flow into the nested result type). Pass it to sub/countAs/exists in place of an explicit child + { parent, child } correlation.

How the source obtains its transport:

• a pre-built {@link Transport} (or { transport }) — FIXED: no endpoint migration, wsEndpoint on leases is ignored (in-process / tests / a single static daemon);
• { factory, endpoint? } — REPLACEABLE: transports are built on demand. An initial endpoint (a static wsUrl or an SSR-injected bootstrap) opens eagerly; otherwise the first lease's wsEndpoint opens it lazily, and a later lease naming a DIFFERENT endpoint migrates the whole session there.

The network identity for a named query subscription. The local AST remains local; remote normalized/optimistic sources use only this (name,args) pair upstream.

Table-name prefixes reserved by the engine for SYNTHETIC tables — __agg_<fnv> aggregate bases (AGGREGATE-SYNC-DESIGN.md §3.3) and _rindle_* system tables (e.g. the lmid table). A user table (synced OR local) under one of these would shadow a synthetic source — and since registerTable is idempotent-on-name and base tables register before synthetics, the later synthetic registration would silently no-op and the agg join would read the user table as the count (silent corruption, 201-LOCAL-ONLY-TABLES-DESIGN.md N1). The ban makes that structurally impossible — checked once, statically, at {@link createSchema}.

Lift one FlatChange into a {@link ResolvedChange} against the query's WireSchema, or null if its path doesn't resolve to a materialized level.

One resolved change: a FlatChange lifted out of positional/indexed wire form into names, using the query's WireSchema (from hello) as the sole position→name source.

A query's SERVER-CHANNEL state, surfaced on its {@link ArrayView } (FOLDED-MUTATIONS-DESIGN §7 — formerly conflated with pending-ness, OPTIMISTIC-WRITES-DESIGN.md §6):

• unknown — not hydrated: the server has not produced a first result for this query yet;
• complete — the server has answered. STAYS complete while a local mutation is pending (the prediction is the client's best current answer); reversion on rejection is an event (onRejected), not a downgrade of completeness;
• error — RESERVED for a future server-side, query-level error signal (see designs/101-QUERY-ERRORS-DESIGN.md); no longer produced by a pending mutation. "Is a prediction pending here?" is now a separate reactive axis (the backend's pending(qid) / onPending), not folded into this type. A backend with no server lifecycle (the in-process engine) leaves every view complete.

The row type of a table definition: Row<typeof issue> → { id: string; … }. The whole-table ergonomic form of {@link RowOf}, so app code derives its row interfaces from the schema instead of hand-maintaining a parallel twin.

Elementwise equality over positional bare-cell rows — THE row comparator for every JS-side diff (views, aggregate heads, the persistence mirror), exported so no caller grows a drifted private copy. Per cell: === keeps -0 === 0 (the engine's key semantics treat them equal); the Object.is arm makes a NaN cell equal itself (under !== alone, a NaN-bearing row never matches any copy of itself, so every diff re-emits it as a spurious edit forever).

Metadata key on a {@link TableDef} (a unique symbol, so no column name collides).

A WireSchema's content fingerprint — FNV-1a 64 over the canonical, length-prefixed byte stream of src/wire_schema.rs, rendered as 16-char lowercase hex (=== Rust SchemaFp Display). A string (not a JS number) so the full 64 bits survive JSON without precision loss.

name → columns, derived from the tables array (for typing store.query.<table>).

The server-side Store wrapper (SSR-DESIGN.md §6.2). Wraps a {@link Store} over a {@link OneShotBackend} and adds the loader-phase preload plus dehydrate. Pass .store to the React <Rindle> provider for the synchronous render; return .dehydrate() from the loader. Create one instance per request, with an authorized read function for that request's principal. Its snapshots seed views; they do not persist synced rows in the browser database.

The ASYNC server-side write surface a mutator runs against. Semantically the twin of the client's synchronous MutationTx write methods — same names, same keyed-row arguments — but every op is a Promise. Reads see this transaction's own writes on both Postgres and the daemon; the daemon opens an interactive transaction when a read is needed. Inserts require every non-nullable column and fill omitted nullable columns with null. Updates and deletes require the PK.

Co-locate a shared (generator) mutator with the validator for its args — pairing the arg SHAPE with the body that consumes it at ONE site, so neither tier restates it (the client derives its callsite type from Args; the server parses untrusted args through .args). Returns the SAME generator function with an args property attached (Object.assign mutates + returns it), so the registered value is byte-for-byte what the client drove before: {@link isGeneratorMutator} still detects it and it still satisfies ClientRegistry.

A generator (isomorphic) mutator, shared verbatim by both tiers: the client trusts typed args, the server parses untrusted args into Args before invoking.

A shared mutator that CARRIES its own arg validator, co-located at the def site (shared(schema, gen)). The client registers it exactly like a bare generator mutator — the .args validator is inert there (typed callsites skip the parse); the server ({@link runSharedMutation }, via the api-server's sharedApiMutators) reads .args to parse untrusted wire args before driving the SAME body.

The wire comparison operators (exact strings, src/ast.rs Op).

What a top-level .one() query materializes to: the single row (or null), not an array. A thin adapter over a {@link FlatArrayView} — all the folding is shared; only the result boundary unwraps (data[0] ?? null). Reference identity of the row is preserved.

Wrap a plural {@link FlatArrayView} as a {@link SingularArrayView} for a .one() query (the engine caps it to limit = 1, so the top list holds at most one node).

Merge the durable plane with the live tail.

durable is what the IVM view shows; produced is what a subscription has accumulated (the prefix it joined at, plus every chunk). Both are prefixes of the same response, so the merge is "take the longer" — no diffing, no overlap handling, no ranges.

The length comparison is the whole algorithm, which is why a caller MUST seed its accumulator with the text it joined at: a tail carrying only the chunks it received would read as shorter than the durable text and be discarded. useStreamedText does that for you.

A frozen snapshot of the Store's live query state for a devtools pane ({@link Store.__inspect}).

The value in the mapped status column while a stream is live.

One frame of a subscription. A subscription always begins with open and always ends with exactly one terminal frame — end, stale, or absent — after which the iterator completes.

stale and absent are the two "you are on the durable plane now" answers, and both are SAFE: the store holds everything below floorSeq and everything through durableSeq, so the reader's IVM view converges without the stream. Neither is an error.

How a stream ended.

• complete — the model finished.
• cancelled — the reader asked it to stop and the producer honoured it.
• error — the generation threw.
• interrupted — the host went away mid-generation. The one status that implies the store may be short of what was produced.

Read a named sub-row off a change's node by relationship alias (e.g. the guest under an rsvp) — the add node, or a remove's subtree when the consumer opted into it. The alias → wire slot mapping comes from the changed level's WireSchema. null when no node rode along.

The multiplexed wire messages (many queries over one connection, tagged by queryId). subscribe.mode selects the serializer (default flat); a normalized subscription gets nhello/nbatch back instead of hello/batch (NORMALIZED-CHANGES-DESIGN.md §6). Embedded servers receive {name,args}. Daemon/serverless deployments can instead receive an opaque leaseToken that the app API server minted after auth + named-query resolution.

The OPTIMISTIC path (OPTIMISTIC-WRITES-DESIGN.md §8) adds init (the connection identifies its stable clientID, so progress frames can carry that client's lmid) and pushMutation (one named-mutator envelope up); the server answers with the normalized frames (cv-stamped) plus connection-level progress frames.

Receiver side: validates a frame stream (comparator at hello; per batch — epoch match, schema-fp match, strict in-order seq) and emits the clean hello/snapshot/batch ChangeEvents. It does NOT fold (the core ArrayView does) — the §2.2 split.

A tier's SYNCHRONOUS effect executor (the browser wasm engine): apply a write, resolve a read — both immediate.

table("issue").columns({ id: string(), … }).primaryKey("id"). Pass { local: true } for a {@link TableMeta.locallocal-only} table (201-LOCAL-ONLY-TABLES-DESIGN.md).

Any table, for positions that only read its metadata. The field-factory part of a TableDef is invariant in C, so callers constrain on the [SCHEMA] meta only — to which every concrete TableDef<N, C> is assignable.

Read a table's metadata (columns / PK / name).

Options for {@link table}.

The SchemaSpec (columns + primaryKey indices) the wasm Db.registerTable wants.

Where a store persists the ticket across reloads. The browser backs this with sessionStorage (per-TAB, so two tabs can pin two regions — design §13); tests pass none (pure in-memory).

Encode a keyed-row cell to its wire {@link WireValue} for a column KIND — the one place both write funnels stringify a json<T> object (the typed mutator surface / design 206 §7). An already-stringified json value (a string) or any non-json cell passes through unchanged, so a mutator may pass EITHER a parsed object OR a JSON string. Mirrors store.positionalize.

Build a transport to a follower's public ws endpoint (READ-ROUTER-DESIGN.md §2.3). Default (endpoint) => new WsTransport(endpoint).

The UPDATE shape of a table: its {@link PkOfprimary-key columns} REQUIRED (they identify the row) plus every non-pk column OPTIONAL (?) and typed — a nullable one stays T | null (settable to null), a NOT NULL one is T. Omitted non-pk columns are left unchanged.

A column reference or a literal — type-tagged.

A per-view change listener ({@link ArrayView.onChanges}): the net FlatChange[] this view folded, the {@link ChangePhase} it arrived on, and the view's WireSchema (the position→name source for resolveChange). This is the DIFF the data channel ({@link ArrayView.subscribe}) discards — the seam a narrator drives off. The schema is passed (not closed over) because the first snapshot fires synchronously inside materialize, before the caller holds the view handle.

Per-level column types (parallel to the WireSchema), used to JSON.parse json columns on projection. Built by the Store from the typed schema; absent ⇒ no parsing (bare values).

A scalar-projection annotation on a relationship slot (REDUCE-DESIGN.md §9): a relationship aggregate (issue { commentCount: count(comments) }) lives as a singular one-row relationship whose child is the aggregate row; this tells the receiver to unwrap it into a scalar field — commentCount: 5 instead of commentCount: [{ count: 5 }].

A bare wire cell. (JSON columns arrive as their raw JSON string.)

The write transaction handed to store.write(tx => …). Rows are objects keyed by column; the Store positionalizes them (and stringifies json columns) before the backend sees them.

add takes an {@link InsertOf} row — a nullable column may be omitted (it is filled with null, design 206 §7). remove/edit take a full {@link RowOf} row: they identify an EXISTING row, so every column (nullable ones as their actual T | null value) must be present.

The base ws subprotocol the browser offers alongside its aff.* ticket; the fleet follower echoes it on the 101 (a strict browser closes a socket whose selected subprotocol it never offered, so the base is always offered in affinity mode). Inlined — NOT imported from @rindle/affinity's WS_SUBPROTOCOL — to keep that crate's node:crypto out of the browser bundle (the same duplicate-to-stay-bundle-clean discipline the lease wire types use). Keep the two spellings in lock-step.

A Transport over a WebSocket (text JSON frames). Messages sent before the socket opens are buffered and flushed on open (so registerQuery/mutate can be called eagerly). Reconnects with capped exponential backoff: if the socket drops (e.g. the daemon restarted) it reopens and fires onReconnect so the source rebuilds its subscriptions.

Everything a generator mutator may yield: a write {@link MutationOp}, a point {@link ReadEffect}, a full-query {@link QueryEffect}, or a {@link BatchEffect} fan-out.