@rindle/wasm

An aggregate over a (correlated) subquery's rows (REDUCE-DESIGN.md). v1: count(*). Set on a related subquery (Ast.aggregate), it marks that relationship a count aggregate the builder lowers to a scalar-projected singular relationship (§9).

All children must hold.

Any relationship, for positions that only read its correlation / child table.

A field argument: its typed predicate, or a bare value (bare = eq sugar).

The minimal arg validator a shared mutator can carry so the SERVER can parse UNTRUSTED wire args before driving it (the client trusts its typed callsites and never calls this). Structural on purpose — a zod schema satisfies it as-is — so @rindle/client stays validator-library-agnostic.

The public ArrayView contract materialize() returns.

A single assembled (nested-by-name) row from POST /query (SSR-DESIGN.md §3.3): the cells under cols, each in-view relationship inlined by its alias (a nested array / object, or a scalar for a countAs aggregate). {@link Store.assembleSnapshot} converts these to the view's projected result shape.

The durable half of the splice for the mapped-table layout: the compacted body followed by whatever chunk rows have not been folded into it yet.

Chunks are ALWAYS the suffix after body — the closing checkpoint rewrites body and drops the chunks it absorbed in ONE transaction — so a reader never observes a torn state where a chunk both is and is not in the body.

Throw if ast references a local-only table ANYWHERE — the complete form of the {@link queries} root guard (Q1 / E3 client half). The root proxy get only sees the table accessed off the builder root; a local table reached through a relationship / sub / countAs / exists CHILD is passed as a value and never touches the proxy, so it is caught here instead: at .ast() for a server-scope builder, and again as an SSR backstop in ServerStore.preload. A server/named query may never name a local table (201-LOCAL-ONLY-TABLES-DESIGN.md §5).

The query AST. table is the only required field; the builder omits empty/false fields (matching the Rust skip_serializing_if), which the deserializer treats as absent.

A tier's ASYNCHRONOUS effect executor (the server transaction): every op is a Promise.

The seam the core talks to. Backend-agnostic: the same interface for the in-process WASM backend and a remote (network) backend. The core never knows which. A backend pushes a per-query {@link ChangeEvent} stream via {@link Backend.onEvent}; the remote backend additionally owns the epoch/seq/gap protocol and emits only clean, in-order events (so the ArrayView never sees the wire protocol).

Dev-only passive tap over a backend's authoritative server stream. Optional because in-process backends have no server stream, and older/custom backends may only expose the Store tap.

A dev-only authoritative server delta exposed by backends that can distinguish the upstream server stream from their local view/IVM stream. Flat remote backends surface clean {@link ChangeEvent}s; local-first normalized/optimistic backends surface the path-free {@link NormalizedEvent}s before they are folded into the local engine.

A fan-out a generator mutator yields: run several effects "together". The server driver resolves them with Promise.all; the client driver runs them in array order (already synchronous). Results return in the same order on both tiers. Each result has its effect's shape: a row, query rows, undefined for a write, or an array for a nested batch. Cast the yielded result to that shape; the generator's declared next-type covers only point reads.

A paging lower bound (Bound, src/ast.rs). row is a partial wire row — the bound columns by name (only the sort columns are read by the engine's Skip comparator). exclusive ⇒ start after the bound row (Basis::After); else at it (Basis::At).

What a {@link Backend} pushes per query: the handshake (hello), the (possibly chunked) hydrate snapshot, then incremental batches. The core builds an ArrayView on hello, hydrates on snapshot, folds on batch — identically for any backend.

The phase of an {@link ArrayView.onChanges} delivery: the initial hydrate snapshot vs a later incremental batch — the same distinction a narrator draws (ChangeEvent snapshot/batch).

The system table's wire schema — appended to the client's expected schemas so the lmid query's hello passes CRIT#4 validation.

The replicated bookkeeping table carrying each client's high-water mutation id (lmid). Engine-hosted and served like any base table; reserved (never part of a user schema). Columns: [client_id, last_mutation_id], PK client_id.

A column descriptor. type drives the comparator + JSON parsing; __t is a phantom. A nullable column is a Col<T | null> — that is the ONLY thing nullability changes at the type level, so RowOf (and the field-condition factory) widen automatically.

optional is the runtime companion of that phantom: set by {@link ColBuilder.nullable}, it is what the write funnels read to make a nullable column omittable from an insert (filled with null, design 206 §6.2). It mirrors the engine's ColumnDef.optional (pragma_table_info.notnull == 0); absent ⇒ NOT NULL / required.

The chainable form returned by the column factories: a {@link Col} plus .nullable().

.nullable() widens the column's value type to T | null — its Row<…> field becomes T | null — and sets the runtime {@link Col.optional} marker so it may be omitted from an insert (design 206 §6.2). rindle schema gen emits .nullable() for every nullable (non-NOT NULL) SQL column; you can also call it by hand on a local-only table's columns. It is idempotent and stays chainable.

Per-column narrowings for {@link refineTable}: each entry must keep the column's kind and narrow its TS type (Col<T2> with T2 extends T) — json<Meta>() on a json column, a literal-union string<"a" | "b">() on a string column. Kind changes are rejected (cross-kind at compile time, same-phantom kind flips like string() on a json column at runtime).

name → columns, the resolved schema map carried in the {@link Schema} type.

Declared column type (from the typed schema) — drives the comparator + JSON parsing. "int64" is the exact-i64 column plane (design 226): the vocabulary exists from Stage C4 (codegen can name it), but no exact integer cell crosses this wire — and WireValue gains no bigint — until Stage E lands the browser bigint plane; until then the daemon refuses IVM queries whose footprint touches such a column.

The compare_values / compare_rows algorithm-contract version (=== the engine's wire_schema::COMPARATOR_VERSION). A remote subscriber hard-rejects a hello whose comparatorVersion differs — the total order is a code contract, not data, so a schema fingerprint can't cover it. Bump in lockstep with the Rust constant if the order changes.

v2 (design 226 Stage B): the engine's mixed Int/Float comparison became exact instead of f64-widening. No TS behavior change — every value a client can hold today is an f64 number, on which v1 and v2 order identically (the §8 gate keeps int64 cells out of the browser until Stage E) — but the contract the version names is the engine's.

number compare with f64::total_cmp semantics (NaN deterministic & last; -0 < +0).

Compare two rows by a resolved sort ([columnIndex, ascending] pairs). First non-equal column wins; a descending column negates.

UTF-8 bytewise string compare (=== SQLite BINARY / Rust &str Ord). Correct for supplementary-plane code points, where JS < / localeCompare (UTF-16) would disagree.

Compare two bare cells, dispatching on the runtime type (null sorts first).

A condition over row R. The runtime value is the wire {@link Condition}; R is a phantom brand so a condition for one table can't be .where()d onto another.

The filter tree — type-tagged; recursive. There is no generic NOT node (negation is via the negated operators and NOT EXISTS, matching src/ast.rs Condition).

Construct a {@link ServerStore} — the one-shot REST Store for server-side rendering.

Convenience: init the wasm + return a ready local {@link Store}.

Define a co-located, composable {@link Fragment}: a named selection over table. The returned value is callable (the build transform), so it threads through the existing sub/Rels spine — no GraphQL, no codegen, no schema change (design §3).

const UserAvatar = defineFragment(schema.user, (f) => f.select("id", "name", "avatarUrl"));
const CommentRow = defineFragment(schema.comment, (f) =>
  f.select("id", "body", "authorId")
   .sub("author", schema.user, { parent: ["authorId"], child: ["id"] }, UserAvatar));

Define ONE co-located, named query. Keep it next to the component that reads it (a *.queries.ts file), so a query lives where its fragments and its component live.

The returned value is callable on the client (it stamps its result with name + args, so the subscription SYNCS) and registerable on the server ({@link registerQueries }). The optional validate step turns untrusted wire args into the canonical args type — and that type flows to both the call signature and build, so the shape is written exactly once. validate runs on BOTH tiers (it builds the byte-identical authoritative AST on the server, and guards + guarantees the same AST on the client). If the server must DIVERGE from the client, define a second defineQuery with the same name for the server and register that one instead.

build may take a second CONTEXT parameter (see {@link QueryBuilder}). Context is off-wire: the client passes its session ctx at the callsite, the server injects its authoritative ctx — so a per-user query stays symmetric without ever trusting (or transmitting) a client-supplied identity.

// recentComments({ limit }) — validated, no ctx, byte-identical on both tiers
export const recentCommentsQuery = defineQuery(
  "recentComments",
  (raw): { limit: number } => ({ limit: validateFeedLimit(raw) }),
  ({ limit }) => q.comment.orderBy("createdAt", "desc").limit(limit).include(FeedItemFragment),
);

// myIssues({ limit }, ctx) — ctx-scoped; the wire still carries only { limit }
export const myIssuesQuery = defineQuery(
  "myIssues",
  (raw): { limit: number } => ({ limit: validateLimit(raw) }),
  ({ limit }, ctx: { user: string }) => q.issue.where.ownerId(ctx.user).limit(limit),
);
// client: myIssuesQuery({ limit: 20 }, { user: currentUser() })

Options for {@link defineQuery}.

A typed registry of named {@link Relationship}s — defineRelationships({ issueOwner: rel(...) }). A thin identity helper that names the bag and constrains its values; the keys are yours to choose.

One query's SSR snapshot, keyed by its viewKey ({@link stableKey} of the AST): the pre-projected first-paint rows plus the cvMin watermark they reflect (SSR-DESIGN.md §6.2). Serializable as-is into the HTML — rows are already JSON values (json columns parsed).

The whole dehydrated cache: every preloaded query's snapshot, keyed by viewKey. The server builds it with {@link Store.dehydrate}; the browser seeds it with {@link Store.hydrate}.

Drive a generator mutator ASYNCHRONOUSLY (the server, against the open transaction). Writes are awaited (harmless: a single interactive Postgres connection serializes statements anyway, and the daemon backend resolves them instantly), reads (point or query) suspend, and a batch fans out with Promise.all.

Drive a generator mutator SYNCHRONOUSLY (the client, inside the wasm write transaction). Each yielded write applies immediately; each read (point or query) is resolved and fed back; a batch runs in order.

When an {@link QueryEnsureCache.ensure} call may resolve.

• complete waits for the server-authoritative result (the default).
• present resolves as soon as the local view contains a result, while the remote retain keeps revalidating in the background. An authoritative empty result also resolves it, so a real not-found query never waits forever.

present deliberately does not add a partial {@link ResultType}: a locally useful answer and server authority are independent facts. While it resolves early, the view's result type remains unknown until the server says otherwise.

EXISTS by a named {@link Relationship} — correlation from the rel; the parent row type is the relationship's parent, so the condition lands on the matching .where(). EXISTS (<correlated subquery>) — a condition (use inside where/or/and).

EXISTS (<correlated subquery>) as a server-only, non-syncing gate (exists_noSync). Identical to {@link exists} for filtering parent visibility, but stamps the subquery system: "permissions", so the engine's normalized serializer prunes its witnesses from the footprint — the permission table's rows are never synced to the client and the client never re-evaluates the gate. Use this when building the server's query (the user's API server); the client holds its own un-gated query.

Options for exists / notExists.

Extend a generated/synced schema with client-authoritative local-only tables.

This is the ergonomic path for SQL-first apps: keep schema.gen.ts fully generated, define private UI tables in a tiny hand-written file, then hand the combined schema to the browser client. The added tables MUST be table(name, { local: true }): extendSchema deliberately refuses to append ordinary synced tables, because those need to come from daemon introspection (rindle schema gen) so the server and client cannot drift.

Build a simple condition from a field name + (predicate | bare value).

A positional change at one level of the view tree. A remove ships only the leaving row (the receiver already holds the subtree and locates it by key) — node is NEVER on the wire; it is an OPTIONAL client-side enrichment carrying the full removed subtree, attached by the ArrayView when a change consumer opts in (Store.subscribeChanges(_, { removedSubtree: true })), so a narrator can resolve a removed row's nested subs just as it can on an add.

A reusable, typed selection over a table — Relay's "fragment", promoted to a first-class value. Two verbs compose a fragment, on one axis — does its data belong to THIS row or to a related one:

• SAME node — q.include(Frag): merge its selection into this node. This is also how you root a fragment onto a base query — queries.t.where.id(x).include(Frag).
• CHILD node — q.sub(alias, child, corr, Frag): nest it under a relationship (sub's 4th arg).

A Fragment is therefore also a build transform ((q: Query<C>) => Query<C, Rels>); that call signature is the mechanism by which sub accepts a fragment as its build. Prefer include to root a fragment (canonical + merged) over calling it directly. It additionally carries its table (for {@link FragmentRef}/useFragment typing and masking). Composing fragments assembles ONE {@link Ast} → one materialization → one /query — the whole point (no request waterfall; design §1).

The data returned by useFragment(fragment, ref): the fragment's own selected columns plus immediate relationship values. Relationships whose builder is another fragment surface as opaque {@link FragmentRef}s, so child-owned payload is read only by the child fragment reader.

The opaque token a parent passes to a component that reads {@link FragmentData} for F.

The resume point a frame implies — what rides an SSE id: line so a reconnecting EventSource hands it straight back as Last-Event-ID. undefined for frames that are not a position.

Initialize the wasm module (idempotent). Call once at startup before new WasmBackend / createWasmStore. Browser/bundler: no args (the wasm is fetched). Node: the bytes are read from the package. Pass moduleOrPath to override (a WebAssembly.Module, URL, or bytes).

The insert type of a table def: Insert<typeof issue> → { id: string; … assignee?: string | null }. The whole-table ergonomic form of {@link InsertOf} (the insert-side twin of {@link Row}).

The cell a full insert writes for column c: the given value, or null when a nullable column is omitted (design 206 §6.2). The caller's completeness check ({@link InsertPlan.required}) guarantees a non-nullable column is present, so its omission never reaches here.

The INSERT shape of a column map: {@link RowOf} with every NULLABLE column made OPTIONAL (?) — it may be omitted and is filled with null by both write funnels (design 206 §6.2/§7). NOT NULL columns stay required. The insert-side twin of {@link RowOf}, mirroring Drizzle's $inferInsert vs $inferSelect split.

Derive a table's {@link InsertPlan} from its column markers.

A table's insert-completeness plan, derived once from its Col markers and shared by BOTH write funnels — the client trackingTx and the server renderOp — so their required-sets can't drift (design 206 §6.1/§6.2). A NOT NULL column is required; a nullable column (.nullable() set Col.optional) may be omitted and is filled with null (see {@link insertCell}). PK columns are never nullable (introspection forces them non-null), so they are always required.

The exact-i64 column plane (design 226, BIGINT/INT8 decltype): typed bigint in application code. The vocabulary exists from Stage C4 so generated schemas can name it; no exact integer cell enters the browser IVM until Stage E — until then the daemon refuses IVM queries whose footprint touches the column, and the SQL plane carries it.

Runtime guard: is v a {@link Fragment} (a defineFragment value, not a plain build fn)?

True iff fn is a generator function (a shared/isomorphic mutator) rather than a plain function — the driver accepts both forms. Detected structurally (native GeneratorFunction).

Whether table is a {@link TableMeta.locallocal-only} table in schema (an unknown table reads as non-local). The single locality predicate the backends key off. BOTH variants — true and "session" — are local here; the persisted/ephemeral split matters only to the persistence plane ({@link persistedLocalTableNames}).

IS NOT NULL — the negation of {@link isNull}; V is inferred from the field, like {@link isNull}.

IS NULL — a field-agnostic null check. V is inferred from the field's expected Arg<V> (e.g. where.signedAt(isNull())), so it fits a column of any type without a cast.

The one shared effect factory (stateless — see {@link IsoTx}). Its methods just BUILD a {@link MutationOp}, so the single instance serves every schema; the generic {@link IsoTx} view is applied at the authoring site (a json<T> cell is a parsed object here and is stringified by the funnels, {@link toCell }), hence the cast — the runtime shape is schema-agnostic.

The tier-AGNOSTIC effect factory a generator mutator writes against. Every method just BUILDS an effect to yield — it performs no I/O and holds no state, so the single {@link isoTx} instance is shared by every mutator on both tiers; only the driver differs. insert/upsert/insertIgnore require non-nullable columns and permit nullable omissions, which become null. update/delete require the PK columns; update also names the columns to change.

The typed {@link IsoTx} for a given schema — IsoTxOf<typeof schema>. Use it to annotate a helper that a mutator body passes its tx to (e.g. const ensureUser = (tx: IsoTxOf<typeof schema>, …)), so the helper gets the same table/column/pk typing the defineMutators shared callback does.

Runtime guard: is v a {@link Relationship} value (not a table or a plain object)?

Whether name collides with an engine-reserved synthetic prefix ({@link RESERVED_TABLE_PREFIXES}).

A keyed row: column name → cell. The ergonomic write shape (validated against the schema at runtime). JSON columns carry their raw JSON string (a {@link WireValue}), never a parsed object.

An untagged literal (null | bool | number | string | array). Numbers are one f64.

The reserved server-query name every optimistic client subscribes at connect: the one-row system query CLIENT_MUTATIONS_TABLE WHERE client_id = <me>. The server derives the identity from the connection (args are ignored).

A stable fingerprint of the schema's PERSISTED local tables only — the persistence gate's schemaHash (207-LOCAL-TABLE-PERSISTENCE-DESIGN.md §3.3 / P7). Per local: true table: (name, ordered column names + types + optionality, pk columns). Column order is kept (rows are positional); tables are sorted by name so registration order can't skew it; synced-table AND local: "session" changes never move it (reshaping an ephemeral table must not wipe durable data). The value is the canonical descriptor itself, not a digest — local-table sets are tiny, and exactness (no collision can ever skip a P7 clear) beats compactness here.

The set of local-only table names in schema (201-LOCAL-ONLY-TABLES-DESIGN.md §4) — BOTH variants (true and "session"); every locality rule except persistence keys off this set.

The upstream named-mutator envelope (OPTIMISTIC-WRITES-DESIGN.md §8.1): the wire carries the name + JSON args, never code; mid totally orders a client's mutations.

What a generator mutator IS: yield tx.<op>() on every side effect; a yield tx.row() expression evaluates to the row. Neither sync nor async — the tier's driver decides, which is what lets one body run synchronously on the client and against a live async transaction on the server.

One structured write intent — the discriminated union that mirrors the write half of the client MutationTx 1:1. Keyed (column-name addressed), so it is independent of column order.

A room authority's verdict for a NON-applied mutation (RINDLE-REALTIME-QUERY-ENABLEMENT §3.3, the deopt handshake; Slice H-iv-b server half / H-v client half). Sent on the author's own socket for every mutation the room did NOT apply, always BEFORE the lmid ack that burns the mid (same-socket ordering only — the ack may reach the client through another path first, e.g. a replayed lmid snapshot). Applied mutations send NOTHING: silence + lmid coverage ⇒ applied.

• kind: "deopt" — the room's §3.3 commit gate refused the routed mutation (or its environment fell short, e.g. tx.query); the mid is burnt in the ROOM ledger with zero effects and the client re-enqueues the same logical mutation onto the daemon stream. name/args are echoed so the frame is SELF-CONTAINED: a client that already retired the entry (the burnt-mid confirm won the race, or the frame is a replay re-answer) re-invokes from the frame alone.
• kind: "rejected" — FINAL (authz/validation): the mid is burnt the same way and the prediction snaps back on the ordinary lmid release; no re-route.

reason may be absent on a re-answered frame whose record was seeded from journal replay (the verdict is journaled; the reason is not).

The minimal per-invocation context a shared mutator sees on BOTH tiers: the acting principal. The server injects its AUTHENTICATED user; the client injects its local user. (The server's own MutationContext is a superset of this.)

A single, co-located NAMED query (see {@link defineQuery}). It is:

• callable on the client — q(args, ctx?) validates + builds + stamps the result with its remote subscription identity (name + args — NOT ctx), so a component that imports it always SYNCS. There is no unstamped builder to import by accident.
• registerable on the server — it carries its queryName and a resolve that re-runs the SAME validator on untrusted wire args and builds the AUTHORITATIVE Query from the server's own ctx ({@link registerQueries registerQueries} in @rindle/api-server).

Ctx is the ctx parameter list mirrored from build — [], [ctx: C], or [ctx?: C]. It is never part of the wire identity.

A row named against its level's wire columns.

A schema-bound query-builder factory for portable client/server query definitions. SERVER scope: local-only tables are excluded (a named/remote query may never reference one).

A per-query NORMALIZED stream event — the path-free twin of {@link ChangeEvent}. The hello carries the flat per-table schemas (no nested view schema, §3); snapshot/batch carry table-tagged {@link NormalizedOp}s. The NormalizedSync layer folds these into the local engine's base tables.

cv (the global commit version the frame's data reflects — OPTIMISTIC-WRITES-DESIGN.md §8.3/§8.6) is present on sources that speak the optimistic protocol; the plain normalized path may omit it.

A table-tagged, path-free row delta — the normalized wire payload (the path-free twin of {@link FlatChange}; NORMALIZED-CHANGES-DESIGN.md §3). Rows are positional (bare cells; a json column is its raw JSON string). op is the discriminant. Lives here (not in @rindle/normalized) so both the protocol (@rindle/remote) and the sync layer share one type.

The server side of the normalized local-first path (NORMALIZED-CHANGES-DESIGN.md §5/§7): registers queries and pushes each one's normalized footprint stream ({@link NormalizedEvent}s). Both the in-process native (@rindle/replica) source and the ws (@rindle/remote RemoteNormalizedSource) implement it; @rindle/normalized's NormalizedBackend consumes one, never knowing which — a sibling seam of {@link Backend} for the normalized composition.

One base table's flat schema on the normalized hello (§3): column names (in order) + primary-key column indices. Wire rows are positional against columns.

The client's per-table flat schema (name + column order + PK indices), the shape a normalized hello advertises (NORMALIZED-CHANGES-DESIGN.md §3). Used to validate a server hello against the CLIENT's own typed schema so a column-order / PK skew is caught instead of silently transposing positional cells (CRIT#4). Sorted by name for stable ordering.

Local-only tables are omitted (201-LOCAL-ONLY-TABLES-DESIGN.md E1): the client never claims them to the server, the server never expects/ships them, and they stay out of the schema fingerprint (normalizedFp) so a local table can't skew it vs. the server's.

NOT EXISTS by a named {@link Relationship}. NOT EXISTS (<correlated subquery>).

NOT EXISTS (<correlated subquery>) as a server-only, non-syncing gate — the NOT EXISTS form of {@link existsNoSync} (a deny-style permission rule).

A no-op live backend for SSR (SSR-DESIGN.md §6.1): it opens no transport and never streams. registerQuery is inert, mutate rejects, and no ChangeEvent is pushed. Every view stays PENDING — reading its SSR {@link Store.seedAssembledseed} — and, lacking onResultType, reports complete (a backend with no server lifecycle leaves every view authoritative).

The one-shot read the server Store calls to preload a query. Two topologies inject different fns (SSR-DESIGN.md §6):

• Direct to the daemon (the trusted tier holds the daemon token): use ast — (i) => daemon.query(i).
• Through the application's API tier (the authority resolves names → ASTs, the loader never sends a raw AST): use name/args — (i) => fetch('/api/rindle/read', {name: i.name, args: i.args}).

ast is always present (the Store seeds the local view by its viewKey); name/args are present when the preloaded query came from defineQuery. This Store does not authenticate users or filter rows. The injected function must enforce access: either call the authenticated API route, or authorize and construct the AST before a privileged direct daemon read.

An authorized one-shot read result, as far as the server Store needs it: the assembled rows plus the cvMin baseline they reflect. (Matches @rindle/daemon-client's QueryOnceOutput, but @rindle/client stays dependency-free — inject the call.)

The server side of the OPTIMISTIC path (OPTIMISTIC-WRITES-DESIGN.md §8): the {@link NormalizedSource} stream with cv-tagged data frames, plus the connection-level {@link ProgressFrame} channel and the named-mutator upstream. The client buffers data frames by cv and applies all cv ≤ cvMin as one coherent release (§8.5).

At least one child must hold.

One (field, direction) ordering — serializes as the 2-tuple ["id", "asc"].

The subset of {@link localTableNames} eligible for the persistence plane — local: true only. A local: "session" table stays outside it: never persisted, never replicated across tabs (207-LOCAL-TABLE-PERSISTENCE-DESIGN.md §5.4).

The primary-key column union for table N of a schema, read from its __pk map P and narrowed to N's actual columns (falling back to all columns when P doesn't name N — e.g. the loose default schema). Feeds {@link PkOf}/{@link UpdateOf} in the typed mutator tx.

name → (some subset of its column names): the loose shape a {@link Schema}'s pk-map satisfies. The fallback when a schema wasn't built through {@link createSchema} — every column could be the pk.

name → its primary-key column union, derived from the tables array (the PK captured by the primaryKey(...) builder). Powers the mutator tx's typed update/delete/row pk args.

The exact PRIMARY-KEY columns of a table (each typed), required — the identity a delete/row, and the WHERE half of an update, take. PK is the table's pk-column union (the schema's __pk).

A value predicate (an operator applied to a value). V is a phantom for type-checking.

The connection-level progress frame (§8.6): advances the coherent-apply release point (cvMin). A pure release signal — mutation confirmation does NOT ride it: lmid is a row in {@link CLIENT_MUTATIONS_TABLE}, delivered through the client's own per-client system query ({@link LMID_QUERY_NAME}) like any data, so it is released by the same cvMin as the commit's effects (transactionally coherent by construction).

A typed query entry over a schema: queries(schema).issue.where.closed(false)….

Scoping for {@link queries} (201-LOCAL-ONLY-TABLES-DESIGN.md §5).

What {@link IsoTx.query} accepts: a query handle whose .ast() lowers to the wire {@link Ast} — exactly what the typed query builder produces (newQueryBuilder(schema).<table>…, the tier-agnostic server-scope builder both tiers can construct because it performs no I/O). Structural so the seam need not carry the builder's heavy generics.

Build a Query (an Ast constructor) from already-validated args, plus an optional CONTEXT — the authenticated principal the query is scoped to. Ctx is off-wire: the client passes its own session ctx at the callsite, the server injects the AUTHORITATIVE ctx ({@link NamedQuery.resolve} via registerQueries), and the wire still carries only name + args. Both tiers run the same build, so whenever their ctx agrees the AST is byte-identical — and a client can never spoof it, since the server re-derives ctx from its trusted session and ignores anything the client claimed.

The ctx is a tuple so a query opts into it by how it types build's second parameter — and that shape becomes the call signature verbatim:

• (args) => Q — no ctx (q(args)).
• (args, ctx: C) => Q — ctx REQUIRED (q(args, ctx)); for always-authenticated queries.
• (args, ctx?: C) => Q — ctx OPTIONAL (q(args) or q(args, ctx)); sound only when "no ctx" is a real, SYMMETRIC state — i.e. the build yields the SAME broad AST whether ctx is absent or present-with-no-user (anonymous / SSR), since the server always forwards a ctx (possibly anonymous). Otherwise type ctx required so the type catches an omitted ctx.

A full-shape read a generator mutator yields — a where/orderBy/limit/join query over the state this mutator is mutating (read-your-writes, like {@link ReadEffect} but an arbitrary shape). Evaluates to {@link QueryResultRow}[] — ALWAYS an array of the matching rows, in the query's order, on BOTH tiers (a root .one() is not unwrapped here: take [0]). The single next-type is a row, so cast the yield ((yield tx.query(q)) as unknown as QueryResultRow[]), same as all.

Deduplicates route/intent preloads and holds their live view through the navigation handoff.

The cache materializes the real named query rather than retaining sync coverage alone: that is what makes until: "present" observable for overlapping queries already satisfied by local normalized rows. Once the server marks the query complete, the entry is kept briefly for a destination component to take its own retain, then released automatically.

The structural surface consumed by framework adapters such as @rindle/tanstack.

One live materialized view's read-only summary for a devtools pane (DEBUG-TOOLS-BROWSER-DESIGN §4.2 — "surface, not instrument"). All fields are already held by the {@link Store}; this is the single read-only accessor over the otherwise-private views/asts maps.

A row returned by a {@link QueryEffect}: column name → cell, plus each materialized relationship name → its nested row(s) — an array (a plural relationship) or a single row / null (a .one() relationship). Recursive. Presented identically on both tiers (a view.data row of the same query).

Turn raw, UNTRUSTED wire args into the canonical, typed args a query is built from. Its return type IS the query's args type — written once, it flows to both the client call signature and the build step, so there's no second place to restate the shape.

A point read a generator mutator yields; the driver resolves it and feeds the row back through gen.next(row). Read-your-writes on every tier: the client reads its local engine, and both server backends read the open transaction (the daemon via an interactive mutation session).

The realtime LABEL a named query may declare (RINDLE-REALTIME-QUERY-ENABLEMENT-DESIGN.md §2.1): which api-server room PROFILE the query wants to be served from, and how the query's args map to that profile's key args. This is the DECLARATION only — the serve decision (covering proof, lease routing) is the server's, and the final room key is minted server-side by the profile's own key under authoritative ctx, so a label can never place a query in a room the server didn't derive itself. Both tiers import the SAME defineQuery value, so they always agree which profile a query belongs to.

A table def acceptable to {@link refineSchema} over Schema<S>: its NAME must be one of S's tables (a def for an unknown table is a compile error at the call site).

C with the columns named in R re-typed to their refined Cols.

S with each table named in T re-typed to that def's (refined) columns. (The inner extends AnyCols guard is how the checker proves the remapped SchemaOf<T>[K] is a column map while T is still generic; it always holds for a concrete T.)

Swap {@link refineTable}-narrowed table defs into a generated schema, re-typing those tables for everything downstream of the schema (newQueryBuilder/queries roots, store row types).

Runtime-validated identity: each def must name a table already in the schema and match its runtime shape exactly (same columns, kinds, primary key, and locality) — refinement narrows TS types, never what's on the wire. Composes with {@link extendSchema} in either order.

Narrow a generated table's column TYPES without touching its runtime shape.

Returns the SAME def, re-typed (identity, after validating that every refined column exists and keeps its kind) — so conditions built from it, rel(...)s anchored on it, and Row<typeof t> all see the narrowed types. Pass the result to {@link refineSchema} so query roots narrow too.

Declare a relationship once: rel(issue, user, { ownerId: "id" }) means issue.ownerId → user.id. mapping is { [parentColumn]: childColumn } (a composite join is multiple entries). The parent table is used only to type-check the keys; pass the result to sub/countAs/exists.

A reusable, typed JOIN between two tables — the correlation declared once (design §4). Built with {@link rel}; parameterized by the parent columns PC (so a sub checks the relationship belongs to the query's table) and the child columns CC (which flow into the nested result type). Pass it to sub/countAs/exists in place of an explicit child + { parent, child } correlation.

The network identity for a named query subscription. The local AST remains local; remote normalized/optimistic sources use only this (name,args) pair upstream.

Table-name prefixes reserved by the engine for SYNTHETIC tables — __agg_<fnv> aggregate bases (AGGREGATE-SYNC-DESIGN.md §3.3) and _rindle_* system tables (e.g. the lmid table). A user table (synced OR local) under one of these would shadow a synthetic source — and since registerTable is idempotent-on-name and base tables register before synthetics, the later synthetic registration would silently no-op and the agg join would read the user table as the count (silent corruption, 201-LOCAL-ONLY-TABLES-DESIGN.md N1). The ban makes that structurally impossible — checked once, statically, at {@link createSchema}.

Lift one FlatChange into a {@link ResolvedChange} against the query's WireSchema, or null if its path doesn't resolve to a materialized level.

One resolved change: a FlatChange lifted out of positional/indexed wire form into names, using the query's WireSchema (from hello) as the sole position→name source.

A query's SERVER-CHANNEL state, surfaced on its {@link ArrayView } (FOLDED-MUTATIONS-DESIGN §7 — formerly conflated with pending-ness, OPTIMISTIC-WRITES-DESIGN.md §6):

• unknown — not hydrated: the server has not produced a first result for this query yet;
• complete — the server has answered. STAYS complete while a local mutation is pending (the prediction is the client's best current answer); reversion on rejection is an event (onRejected), not a downgrade of completeness;
• error — RESERVED for a future server-side, query-level error signal (see designs/101-QUERY-ERRORS-DESIGN.md); no longer produced by a pending mutation. "Is a prediction pending here?" is now a separate reactive axis (the backend's pending(qid) / onPending), not folded into this type. A backend with no server lifecycle (the in-process engine) leaves every view complete.

The row type of a table definition: Row<typeof issue> → { id: string; … }. The whole-table ergonomic form of {@link RowOf}, so app code derives its row interfaces from the schema instead of hand-maintaining a parallel twin.

Elementwise equality over positional bare-cell rows — THE row comparator for every JS-side diff (views, aggregate heads, the persistence mirror), exported so no caller grows a drifted private copy. Per cell: === keeps -0 === 0 (the engine's key semantics treat them equal); the Object.is arm makes a NaN cell equal itself (under !== alone, a NaN-bearing row never matches any copy of itself, so every diff re-emits it as a spurious edit forever).

Metadata key on a {@link TableDef} (a unique symbol, so no column name collides).

name → columns, derived from the tables array (for typing store.query.<table>).

One base-table row op of a coherent server delta (the §1.3 D), bare cells.

The server-side Store wrapper (SSR-DESIGN.md §6.2). Wraps a {@link Store} over a {@link OneShotBackend} and adds the loader-phase preload plus dehydrate. Pass .store to the React <Rindle> provider for the synchronous render; return .dehydrate() from the loader. Create one instance per request, with an authorized read function for that request's principal. Its snapshots seed views; they do not persist synced rows in the browser database.

The ASYNC server-side write surface a mutator runs against. Semantically the twin of the client's synchronous MutationTx write methods — same names, same keyed-row arguments — but every op is a Promise. Reads see this transaction's own writes on both Postgres and the daemon; the daemon opens an interactive transaction when a read is needed. Inserts require every non-nullable column and fill omitted nullable columns with null. Updates and deletes require the PK.

Co-locate a shared (generator) mutator with the validator for its args — pairing the arg SHAPE with the body that consumes it at ONE site, so neither tier restates it (the client derives its callsite type from Args; the server parses untrusted args through .args). Returns the SAME generator function with an args property attached (Object.assign mutates + returns it), so the registered value is byte-for-byte what the client drove before: {@link isGeneratorMutator} still detects it and it still satisfies ClientRegistry.

A generator (isomorphic) mutator, shared verbatim by both tiers: the client trusts typed args, the server parses untrusted args into Args before invoking.

A shared mutator that CARRIES its own arg validator, co-located at the def site (shared(schema, gen)). The client registers it exactly like a bare generator mutator — the .args validator is inert there (typed callsites skip the parse); the server ({@link runSharedMutation }, via the api-server's sharedApiMutators) reads .args to parse untrusted wire args before driving the SAME body.

The wire comparison operators (exact strings, src/ast.rs Op).

What a top-level .one() query materializes to: the single row (or null), not an array. A thin adapter over a {@link FlatArrayView} — all the folding is shared; only the result boundary unwraps (data[0] ?? null). Reference identity of the row is preserved.

Wrap a plural {@link FlatArrayView} as a {@link SingularArrayView} for a .one() query (the engine caps it to limit = 1, so the top list holds at most one node).

Merge the durable plane with the live tail.

durable is what the IVM view shows; produced is what a subscription has accumulated (the prefix it joined at, plus every chunk). Both are prefixes of the same response, so the merge is "take the longer" — no diffing, no overlap handling, no ranges.

The length comparison is the whole algorithm, which is why a caller MUST seed its accumulator with the text it joined at: a tail carrying only the chunks it received would read as shorter than the durable text and be discarded. useStreamedText does that for you.

A frozen snapshot of the Store's live query state for a devtools pane ({@link Store.__inspect}).

The value in the mapped status column while a stream is live.

One frame of a subscription. A subscription always begins with open and always ends with exactly one terminal frame — end, stale, or absent — after which the iterator completes.

stale and absent are the two "you are on the durable plane now" answers, and both are SAFE: the store holds everything below floorSeq and everything through durableSeq, so the reader's IVM view converges without the stream. Neither is an error.

How a stream ended.

• complete — the model finished.
• cancelled — the reader asked it to stop and the producer honoured it.
• error — the generation threw.
• interrupted — the host went away mid-generation. The one status that implies the store may be short of what was produced.

Read a named sub-row off a change's node by relationship alias (e.g. the guest under an rsvp) — the add node, or a remove's subtree when the consumer opted into it. The alias → wire slot mapping comes from the changed level's WireSchema. null when no node rode along.

A tier's SYNCHRONOUS effect executor (the browser wasm engine): apply a write, resolve a read — both immediate.

table("issue").columns({ id: string(), … }).primaryKey("id"). Pass { local: true } for a {@link TableMeta.locallocal-only} table (201-LOCAL-ONLY-TABLES-DESIGN.md).

Any table, for positions that only read its metadata. The field-factory part of a TableDef is invariant in C, so callers constrain on the [SCHEMA] meta only — to which every concrete TableDef<N, C> is assignable.

Read a table's metadata (columns / PK / name).

Options for {@link table}.

The SchemaSpec (columns + primaryKey indices) the wasm Db.registerTable wants.

Encode a keyed-row cell to its wire {@link WireValue} for a column KIND — the one place both write funnels stringify a json<T> object (the typed mutator surface / design 206 §7). An already-stringified json value (a string) or any non-json cell passes through unchanged, so a mutator may pass EITHER a parsed object OR a JSON string. Mirrors store.positionalize.

The UPDATE shape of a table: its {@link PkOfprimary-key columns} REQUIRED (they identify the row) plus every non-pk column OPTIONAL (?) and typed — a nullable one stays T | null (settable to null), a NOT NULL one is T. Omitted non-pk columns are left unchanged.

A column reference or a literal — type-tagged.

A per-view change listener ({@link ArrayView.onChanges}): the net FlatChange[] this view folded, the {@link ChangePhase} it arrived on, and the view's WireSchema (the position→name source for resolveChange). This is the DIFF the data channel ({@link ArrayView.subscribe}) discards — the seam a narrator drives off. The schema is passed (not closed over) because the first snapshot fires synchronously inside materialize, before the caller holds the view handle.

Per-level column types (parallel to the WireSchema), used to JSON.parse json columns on projection. Built by the Store from the typed schema; absent ⇒ no parsing (bare values).

A raw staged write transaction over the wasm engine — the surface an optimistic client mutator runs against (get reads the live state under this txn's staged overlay, so a read-dependent mutator sees its own writes; OPTIMISTIC-WRITES-DESIGN.md §4.1).

A scalar-projection annotation on a relationship slot (REDUCE-DESIGN.md §9): a relationship aggregate (issue { commentCount: count(comments) }) lives as a singular one-row relationship whose child is the aggregate row; this tells the receiver to unwrap it into a scalar field — commentCount: 5 instead of commentCount: [{ count: 5 }].

A bare wire cell. (JSON columns arrive as their raw JSON string.)

The write transaction handed to store.write(tx => …). Rows are objects keyed by column; the Store positionalizes them (and stringifies json columns) before the backend sees them.

add takes an {@link InsertOf} row — a nullable column may be omitted (it is filled with null, design 206 §7). remove/edit take a full {@link RowOf} row: they identify an EXISTING row, so every column (nullable ones as their actual T | null value) must be present.

Everything a generator mutator may yield: a write {@link MutationOp}, a point {@link ReadEffect}, a full-query {@link QueryEffect}, or a {@link BatchEffect} fan-out.