@cosmicdrift/kumiko-framework 0.328.0 → 0.329.0

package/dist/db/queries/event-store.js

@@ -0,0 +1,231 @@
+import { constraintOf, isLockNotAvailable, isTableAlreadyExists, isUniqueViolation, } from "../pg-error.js";
+import { asRawClient, unsafeReadRetrying } from "../query.js";
+// Gap-finality (event-dispatcher pending_gaps) needs every holder of an
+// event id to already have a *real* xact id by the time it inserts — Postgres
+// assigns those lazily on first write, so a bare INSERT alone doesn't
+// guarantee one exists yet for comparison against a later snapshot's
+// xmin/xmax. pg_current_xact_id() forces the allocation.
+export async function claimXactId(db) {
+    await asRawClient(db).unsafe(`SELECT pg_current_xact_id()`);
+}
+/** NOTIFY on commit — wakes LISTEN subscribers (event-dispatcher). */
+export async function notifyPgChannel(db, channel) {
+    await asRawClient(db).unsafe(`SELECT pg_notify($1, '')`, [channel]);
+}
+// Tenant-scoped partial unique index over metadata.idempotencyKey.
+// Expression index straight on the jsonb column — no dedicated key column,
+// so it needs no INSERT-path change and covers admin-api's raw appends too
+// (same metadata jsonb). CREATE ... IF NOT EXISTS makes this safe to call
+// on every boot, same "ensure" pattern as ensureSnapshotVersionColumn: heals
+// installs that predate the index without a table rebuild.
+//
+// CONCURRENTLY (not a plain CREATE): a non-concurrent build takes a SHARE
+// lock for the full table scan on kumiko_events — the hottest table in the
+// framework — blocking every append() for however long that scan takes on
+// an existing installation's event history. CONCURRENTLY avoids that at the
+// cost of needing to tolerate two failure modes a plain build doesn't have.
+// Neither CREATE nor DROP ... CONCURRENTLY may run inside a transaction —
+// no caller of this function (dev-server, schema-cli.ts, stack/db.ts) may
+// wrap it in one, or Postgres raises 25001.
+// undefined = index doesn't exist at all (nothing to drop, CREATE below
+// handles it); false = exists but INVALID (crashed mid-build, needs DROP +
+// rebuild); true = exists and valid.
+async function indexValidity(client) {
+    const rows = await client.unsafe(`SELECT i.indisvalid FROM pg_class c JOIN pg_index i ON i.indexrelid = c.oid ` +
+        `WHERE c.relname = 'events_idempotency_uq' AND i.indrelid = '"kumiko_events"'::regclass`);
+    return rows[0]?.indisvalid;
+}
+export async function ensureIdempotencyKeyIndex(db) {
+    const client = asRawClient(db);
+    try {
+        // 1) A prior CONCURRENTLY build that got killed mid-flight (crash, deploy
+        //    restart) leaves an INVALID index: the catalog entry exists, so
+        //    IF NOT EXISTS below would silently skip forever, but the index is
+        //    incomplete and not plannable for queries — it does NOT mean the
+        //    constraint enforces nothing; Postgres keeps maintaining an INVALID
+        //    index on every insert, it just refuses to use it for planning.
+        //    Detect + rebuild it. Scoped to kumiko_events specifically (indrelid),
+        //    not just the relname, so a same-named index in another schema can't
+        //    false-positive this DROP.
+        if ((await indexValidity(client)) === false) {
+            await client.unsafe(`DROP INDEX CONCURRENTLY IF EXISTS "events_idempotency_uq"`);
+        }
+        await client.unsafe(`CREATE UNIQUE INDEX CONCURRENTLY IF NOT EXISTS "events_idempotency_uq" ON "kumiko_events" ` +
+            `("tenant_id", (("metadata"->>'idempotencyKey'))) ` +
+            `WHERE "metadata"->>'idempotencyKey' IS NOT NULL`);
+    }
+    catch (e) {
+        if (isBenignConcurrentIndexBuildRace(e)) {
+            // "Benign" only means the losing side of a race, not that the index
+            // actually landed valid — a lock_timeout on the CREATE (55P03) backs
+            // off the same way a genuine duplicate-build race does, but leaves no
+            // valid index at all. Re-check before declaring victory instead of
+            // trusting the error class alone.
+            // skip: sibling pod already built a valid index — this race loser is done.
+            if ((await indexValidity(client)) === true)
+                return;
+            console.warn(`ensureIdempotencyKeyIndex: backed off on a "benign" race (${String(e)}) but ` +
+                `"events_idempotency_uq" is still missing/invalid afterward — likely a ` +
+                `lock_timeout during CREATE INDEX CONCURRENTLY, not an actual winner/loser race.`);
+            throw e;
+        }
+        throw duplicateIdempotencyKeyErrorOr(e);
+    }
+}
+// Two pods booting concurrently against the same DB (rolling deploy): both
+// see the index missing/invalid and both start a DROP/CREATE CONCURRENTLY
+// build. The loser typically does NOT get the plain duplicate-relation
+// no-op IF NOT EXISTS normally gives — it can instead see a unique-violation
+// on Postgres' own pg_class catalog insert (23505, constraint
+// pg_class_relname_nsp_index) or a lock-not-available (55P03) from the
+// racing DDL. Both are benign: the other pod's build wins and this one just
+// backs off. A 23505 against "events_idempotency_uq" itself is NOT this
+// race — see duplicateIdempotencyKeyErrorOr.
+function isBenignConcurrentIndexBuildRace(e) {
+    if (isTableAlreadyExists(e) || isLockNotAvailable(e))
+        return true;
+    return isUniqueViolation(e) && constraintOf(e) === "pg_class_relname_nsp_index";
+}
+// A 23505 against "events_idempotency_uq" means real duplicate
+// metadata->>'idempotencyKey' values for the same tenant already exist —
+// CONCURRENTLY still enforces uniqueness on live inserts against the
+// not-yet-valid index. That needs an operator to find + resolve the
+// duplicates, not a crash-loop on every subsequent boot, so re-throw a
+// distinguishable error instead of the raw driver error.
+function duplicateIdempotencyKeyErrorOr(e) {
+    if (isUniqueViolation(e) && constraintOf(e) === "events_idempotency_uq") {
+        return new Error("ensureIdempotencyKeyIndex: duplicate metadata->>'idempotencyKey' values exist for at least " +
+            "one tenant in kumiko_events — CREATE UNIQUE INDEX CONCURRENTLY cannot complete. Find and " +
+            "resolve the duplicate idempotencyKey rows, then restart to retry.", { cause: e });
+    }
+    return e;
+}
+/** INSERT … SELECT … WHERE EXISTS predecessor — stays raw (typed builder can't express this). */
+export async function insertSubsequentEventRow(db, params) {
+    const rows = (await asRawClient(db).unsafe(`INSERT INTO "kumiko_events" (
+       aggregate_id, aggregate_type, tenant_id, version,
+       type, event_version, payload, metadata, created_by
+     )
+     SELECT $1::uuid, $2, $3::uuid, $4,
+            $5, $6, $7::jsonb,
+            $8::jsonb, $9
+     WHERE EXISTS (
+       SELECT 1 FROM "kumiko_events"
+       WHERE aggregate_id = $1::uuid
+         AND version = $10
+         AND tenant_id = $3::uuid
+     )
+     RETURNING id, created_at`, [
+        params.aggregateId,
+        params.aggregateType,
+        params.tenantId,
+        params.newVersion,
+        params.type,
+        params.eventVersion,
+        params.payload,
+        params.metadata,
+        params.createdBy,
+        params.expectedVersion,
+    ]));
+    return rows[0];
+}
+export async function selectStreamMaxVersion(db, aggregateId, tenantId) {
+    const rows = (await unsafeReadRetrying(db, `SELECT MAX("version") AS v FROM "kumiko_events" WHERE "aggregate_id" = $1 AND "tenant_id" = $2`, [aggregateId, tenantId]));
+    return rows[0]?.v ?? 0;
+}
+/** MAX(version) for one aggregate stream — no tenant filter (seed idempotency). */
+export async function selectAggregateMaxVersion(db, aggregateId) {
+    const rows = (await unsafeReadRetrying(db, `SELECT MAX("version") AS v FROM "kumiko_events" WHERE "aggregate_id" = $1`, [aggregateId]));
+    return rows[0]?.v ?? 0;
+}
+export async function selectEventsHighWaterMark(db) {
+    const rows = (await unsafeReadRetrying(db, `SELECT COALESCE(MAX("id"), 0)::bigint AS max FROM "kumiko_events"`, []));
+    const raw = rows[0]?.max;
+    if (typeof raw === "bigint")
+        return raw;
+    if (raw === null || raw === undefined)
+        return 0n;
+    return BigInt(raw);
+}
+/** Head event id for lag metrics — alias for selectEventsHighWaterMark. */
+// @wrapper-known semantic-alias
+export async function selectEventsHeadId(db) {
+    return selectEventsHighWaterMark(db);
+}
+export async function selectNextEventIdAfter(db, afterId) {
+    const rows = (await unsafeReadRetrying(db, `SELECT "id" FROM "kumiko_events" WHERE "id" > $1 ORDER BY "id" ASC LIMIT 1`, [afterId]));
+    const row = rows[0];
+    if (!row)
+        return null;
+    return typeof row.id === "bigint" ? row.id : BigInt(row.id);
+}
+// kumiko_snapshots predates snapshot_version — idempotent heal for existing
+// installs, run from the same ensure path as table creation.
+export async function ensureSnapshotVersionColumn(db) {
+    await asRawClient(db).unsafe(`ALTER TABLE "kumiko_snapshots" ADD COLUMN IF NOT EXISTS "snapshot_version" integer NOT NULL DEFAULT 1`);
+}
+export async function upsertSnapshot(db, params) {
+    await asRawClient(db).unsafe(`INSERT INTO "kumiko_snapshots"
+       ("aggregate_id", "tenant_id", "aggregate_type", "version", "state", "snapshot_version")
+     VALUES ($1, $2, $3, $4, $5::jsonb, $6)
+     ON CONFLICT ("aggregate_id", "version") DO UPDATE SET
+       "state" = $5::jsonb,
+       "aggregate_type" = $3,
+       "snapshot_version" = $6,
+       "created_at" = now()`, [
+        params.aggregateId,
+        params.tenantId,
+        params.aggregateType,
+        params.version,
+        params.state,
+        params.snapshotVersion,
+    ]);
+}
+export async function upsertArchivedStream(db, params) {
+    await asRawClient(db).unsafe(`INSERT INTO "kumiko_archived_streams"
+       ("tenant_id", "aggregate_id", "aggregate_type", "archived_by", "reason")
+     VALUES ($1, $2, $3, $4, $5)
+     ON CONFLICT ("tenant_id", "aggregate_id") DO UPDATE SET
+       "archived_at" = now(),
+       "archived_by" = $4,
+       "aggregate_type" = $3,
+       "reason" = $5`, [params.tenantId, params.aggregateId, params.aggregateType, params.archivedBy, params.reason]);
+}
+// Per-consumer turn fetch: the plain `id > cursor` window plus any ranges the
+// consumer is still watching as pending gaps (ids invisible on an earlier
+// turn that may have become visible since). Raw SQL — the typed builder's
+// WhereObject is an AND of fields, it can't express this OR.
+export async function selectPendingAndNewEventRows(db, cursor, pendingRanges, batchSize) {
+    if (pendingRanges.length === 0) {
+        return unsafeReadRetrying(db, `SELECT * FROM "kumiko_events" WHERE "id" > $1 ORDER BY "id" ASC LIMIT $2`, [cursor, batchSize]);
+    }
+    return unsafeReadRetrying(db, 
+    // UNION ALL of two primary-key range scans: an `id > $1 OR EXISTS (…)`
+    // predicate can't use the index and would seq-scan kumiko_events per turn.
+    // Ranges sit below $1, so the branches never overlap.
+    `(SELECT e.* FROM unnest($2::bigint[], $3::bigint[]) AS g(f, t)
+       CROSS JOIN LATERAL (
+         SELECT * FROM "kumiko_events" WHERE "id" BETWEEN g.f AND g.t ORDER BY "id" ASC LIMIT $4
+       ) e)
+     UNION ALL
+     (SELECT * FROM "kumiko_events" WHERE "id" > $1 ORDER BY "id" ASC LIMIT $4)
+     ORDER BY "id" ASC LIMIT $4`, [
+        cursor,
+        pendingRanges.map((r) => r.from.toString()),
+        pendingRanges.map((r) => r.to.toString()),
+        batchSize,
+    ]);
+}
+// Smallest committed-and-visible id inside any pending range — lets
+// skipPoisonEvent (event-dispatcher-admin.ts) tell a live poison apart from
+// a still-invisible gap without pulling full rows.
+export async function selectSmallestVisibleIdInRanges(db, pendingRanges) {
+    if (pendingRanges.length === 0)
+        return null;
+    const rows = (await unsafeReadRetrying(db, `SELECT MIN("id")::text AS id FROM "kumiko_events"
+     WHERE EXISTS (
+       SELECT 1 FROM unnest($1::bigint[], $2::bigint[]) AS g(f, t) WHERE "id" BETWEEN g.f AND g.t
+     )`, [pendingRanges.map((r) => r.from.toString()), pendingRanges.map((r) => r.to.toString())]));
+    const id = rows[0]?.id;
+    return id === null || id === undefined ? null : BigInt(id);
+}

package/dist/db/queries/pii-backfill-state.d.ts

@@ -0,0 +1,7 @@
+import type { AnyDb } from "../query.js";
+export type PiiBackfillStateRow = {
+    readonly cursor: string;
+    readonly completed: boolean;
+};
+export declare function readPiiBackfillState(db: AnyDb, fingerprint: string): Promise<PiiBackfillStateRow | null>;
+export declare function persistPiiBackfillState(db: AnyDb, fingerprint: string, cursor: bigint, markCompleted: boolean): Promise<void>;

package/dist/db/queries/pii-backfill-state.js

@@ -0,0 +1,14 @@
+import { asRawClient } from "../query.js";
+export async function readPiiBackfillState(db, fingerprint) {
+    const rows = (await asRawClient(db).unsafe(`SELECT "cursor_event_id"::text AS "cursor", "completed_at" IS NOT NULL AS "completed"
+       FROM "kumiko_pii_backfill_state" WHERE "fingerprint" = $1`, [fingerprint]));
+    return rows[0] ?? null;
+}
+export async function persistPiiBackfillState(db, fingerprint, cursor, markCompleted) {
+    await asRawClient(db).unsafe(`INSERT INTO "kumiko_pii_backfill_state" ("fingerprint", "cursor_event_id", "completed_at", "updated_at")
+     VALUES ($1, $2::bigint, CASE WHEN $3::boolean THEN now() ELSE NULL END, now())
+     ON CONFLICT ("fingerprint") DO UPDATE SET
+       "cursor_event_id" = GREATEST("kumiko_pii_backfill_state"."cursor_event_id", EXCLUDED."cursor_event_id"),
+       "completed_at" = COALESCE("kumiko_pii_backfill_state"."completed_at", EXCLUDED."completed_at"),
+       "updated_at" = now()`, [fingerprint, cursor.toString(), markCompleted]);
+}

package/dist/db/queries/projection-rebuild.d.ts

@@ -0,0 +1,6 @@
+import type { AnyDb } from "../query.js";
+export declare function markProjectionRebuilding(db: AnyDb, projectionName: string): Promise<void>;
+export declare function selectEventsForProjectionRebuildBatch(db: AnyDb, aggregateTypes: readonly string[], eventTypes: readonly string[], afterId: bigint, limit: number): Promise<ReadonlyArray<Record<string, unknown>>>;
+export declare function countSubscribedEvents(db: AnyDb, aggregateTypes: readonly string[], eventTypes: readonly string[]): Promise<bigint>;
+export declare function finalizeProjectionRebuild(db: AnyDb, projectionName: string, lastProcessedEventId: bigint): Promise<void>;
+export declare function markProjectionRebuildFailed(db: AnyDb, projectionName: string, errorMessage: string): Promise<void>;

package/dist/db/queries/projection-rebuild.js

@@ -0,0 +1,65 @@
+import { asRawClient, unsafeReadRetrying } from "../query.js";
+export async function markProjectionRebuilding(db, projectionName) {
+    await asRawClient(db).unsafe(`INSERT INTO "kumiko_projections" ("name", "status") VALUES ($1, 'rebuilding')
+     ON CONFLICT ("name") DO UPDATE SET
+       "status" = 'rebuilding',
+       "last_error" = NULL,
+       "updated_at" = now()`, [projectionName]);
+}
+// Cursor-paged read for the live-tail catch-up loop: one batch of events
+// strictly newer than `afterId`, ascending. Each call is a fresh SELECT, so
+// under READ COMMITTED it sees events committed by concurrent writers since the
+// previous batch — that is what lets the rebuild drain the tail to ~0 lag.
+export async function selectEventsForProjectionRebuildBatch(db, aggregateTypes, eventTypes, afterId, limit) {
+    // Archived streams don't replay (Marten-aligned): their aggregates are
+    // frozen ops-tombstones — replaying them would resurrect rows (or, for
+    // stranded duplicate-aggregates like fw#832, collide on unique indexes).
+    return (await unsafeReadRetrying(db, `SELECT * FROM "kumiko_events" e
+     WHERE e."aggregate_type" = ANY($1::text[])
+       AND e."type" = ANY($2::text[])
+       AND e."id" > $3
+       AND NOT EXISTS (
+         SELECT 1 FROM "kumiko_archived_streams" a
+          WHERE a."tenant_id" = e."tenant_id" AND a."aggregate_id" = e."aggregate_id"
+       )
+     ORDER BY e."id" ASC
+     LIMIT $4`, [aggregateTypes, eventTypes, afterId, limit]));
+}
+// Total subscribed events in the log — same source/type filter as
+// selectEventsForProjectionRebuildBatch, no id cursor. Under the cutover fence
+// this is the ground-truth count the rebuild must have applied; a shortfall
+// means a lower-id event committed late and the id-cursor leapt past it (#443).
+export async function countSubscribedEvents(db, aggregateTypes, eventTypes) {
+    // Same archived-streams exclusion as the batch query — the #443 recompute
+    // compares this count against applied events; a filter mismatch would make
+    // every rebuild with an archived stream loop the full-re-replay forever.
+    const rows = (await unsafeReadRetrying(db, `SELECT count(*)::bigint AS n FROM "kumiko_events" e
+     WHERE e."aggregate_type" = ANY($1::text[])
+       AND e."type" = ANY($2::text[])
+       AND NOT EXISTS (
+         SELECT 1 FROM "kumiko_archived_streams" a
+          WHERE a."tenant_id" = e."tenant_id" AND a."aggregate_id" = e."aggregate_id"
+       )`, [aggregateTypes, eventTypes]));
+    const raw = rows[0]?.n;
+    if (typeof raw === "bigint")
+        return raw;
+    if (raw === null || raw === undefined)
+        return 0n;
+    return BigInt(raw);
+}
+export async function finalizeProjectionRebuild(db, projectionName, lastProcessedEventId) {
+    await asRawClient(db).unsafe(`UPDATE "kumiko_projections" SET
+       "last_processed_event_id" = $1,
+       "status" = 'idle',
+       "last_rebuild_at" = now(),
+       "last_error" = NULL,
+       "updated_at" = now()
+     WHERE "name" = $2`, [lastProcessedEventId, projectionName]);
+}
+export async function markProjectionRebuildFailed(db, projectionName, errorMessage) {
+    await asRawClient(db).unsafe(`INSERT INTO "kumiko_projections" ("name", "status", "last_error") VALUES ($1, 'failed', $2)
+     ON CONFLICT ("name") DO UPDATE SET
+       "status" = 'failed',
+       "last_error" = $2,
+       "updated_at" = now()`, [projectionName, errorMessage]);
+}

package/dist/db/queries/raw-sql.d.ts

@@ -0,0 +1,9 @@
+import type { AnyDb } from "../query.js";
+/** Escape hatch for caller-built SQL that may write (or lock). No closed-connection retry —
+ *  retrying an ambiguous write risks double-apply (#1358). Prefer {@link executeRawQueryRead}
+ *  for SELECT-only paths. */
+export declare function executeRawQuery<T = Record<string, unknown>>(db: AnyDb, sqlText: string, params?: readonly unknown[]): Promise<readonly T[]>;
+/** SELECT-only escape hatch with the #1163 closed-connection retry. Do not pass
+ *  INSERT/UPDATE/DELETE — retry re-executes the statement. */
+export declare function executeRawQueryRead<T = Record<string, unknown>>(db: AnyDb, sqlText: string, params?: readonly unknown[]): Promise<readonly T[]>;
+export declare function pingDatabase(db: AnyDb): Promise<void>;

package/dist/db/queries/raw-sql.js

@@ -0,0 +1,16 @@
+import { asRawClient, unsafeReadRetrying } from "../query.js";
+/** Escape hatch for caller-built SQL that may write (or lock). No closed-connection retry —
+ *  retrying an ambiguous write risks double-apply (#1358). Prefer {@link executeRawQueryRead}
+ *  for SELECT-only paths. */
+export async function executeRawQuery(db, sqlText, params = []) {
+    return (await asRawClient(db).unsafe(sqlText, params));
+}
+/** SELECT-only escape hatch with the #1163 closed-connection retry. Do not pass
+ *  INSERT/UPDATE/DELETE — retry re-executes the statement. */
+// @wrapper-known semantic-alias
+export async function executeRawQueryRead(db, sqlText, params = []) {
+    return unsafeReadRetrying(db, sqlText, params);
+}
+export async function pingDatabase(db) {
+    await asRawClient(db).unsafe("SELECT 1");
+}

package/dist/db/queries/seed-context.d.ts

@@ -0,0 +1,20 @@
+import type { AnyDb } from "../query.js";
+export type SeedUserRow = {
+    readonly id: string;
+    readonly email: string;
+    readonly tenantId: string;
+};
+export type SeedMembershipDbRow = {
+    readonly user_id: string;
+    readonly tenant_id: string;
+    readonly stream_tenant_id: string;
+    readonly roles: string;
+};
+export type SeedTenantDbRow = {
+    readonly id: string;
+    readonly name: string;
+    readonly tenant_key: string;
+};
+export declare function selectUserByEmail(db: AnyDb, email: string): Promise<SeedUserRow | null>;
+export declare function selectMembershipsOfUser(db: AnyDb, userId: string): Promise<readonly SeedMembershipDbRow[]>;
+export declare function selectAllTenants(db: AnyDb): Promise<readonly SeedTenantDbRow[]>;

package/dist/db/queries/seed-context.js

@@ -0,0 +1,25 @@
+import { unsafeReadRetrying } from "../query.js";
+export async function selectUserByEmail(db, email) {
+    const rows = (await unsafeReadRetrying(db, `SELECT id::text AS id, email, tenant_id::text AS tenant_id
+     FROM read_users
+     WHERE email = $1
+     LIMIT 1`, [email]));
+    const row = rows[0];
+    if (!row)
+        return null;
+    return { id: row.id, email: row.email, tenantId: row.tenant_id };
+}
+export async function selectMembershipsOfUser(db, userId) {
+    return (await unsafeReadRetrying(db, `SELECT m.user_id::text AS user_id,
+            m.tenant_id::text AS tenant_id,
+            e.tenant_id::text AS stream_tenant_id,
+            m.roles
+     FROM read_tenant_memberships m
+     JOIN kumiko_events e ON e.aggregate_id = m.id AND e.version = 1
+     WHERE m.user_id = $1`, [userId]));
+}
+export async function selectAllTenants(db) {
+    return (await unsafeReadRetrying(db, `SELECT id::text AS id, name, key AS tenant_key
+     FROM read_tenants
+     ORDER BY inserted_at`, []));
+}

package/dist/db/queries/shadow-swap.d.ts

@@ -0,0 +1,18 @@
+import type { DbConnection, DbTx } from "../connection.js";
+import type { EntityTableMeta } from "../entity-table-meta.js";
+import { type AnyDb } from "../query.js";
+export declare const PROJECTION_REBUILD_SCHEMA = "kumiko_rebuild";
+export declare function ensureRebuildSchema(db: AnyDb): Promise<void>;
+export declare function rebuildMetaOrThrow(table: unknown, projectionName: string): EntityTableMeta;
+export declare function assertLiveColumnsMatchMeta(db: DbConnection | DbTx, meta: EntityTableMeta, projectionName: string): Promise<void>;
+export declare function assertLiveTableHasNoRowLevelSecurity(tx: AnyDb, tableName: string, projectionName?: string): Promise<void>;
+export declare function buildShadowTable(tx: AnyDb, meta: EntityTableMeta): Promise<void>;
+export declare function fenceLiveTable(tx: AnyDb, tableName: string, lockTimeoutMs: number): Promise<void>;
+export declare function assertNoUnreachableLiveRows(tx: AnyDb, projectionName: string, tableName: string, aggregateTypes: readonly string[]): Promise<void>;
+export declare function assertNoBlindIndexLoss(tx: AnyDb, tableName: string, meta: EntityTableMeta, projectionName: string): Promise<void>;
+export type ColumnDriftResult = {
+    readonly rowCount: number;
+    readonly sample: readonly string[];
+};
+export declare function countColumnDrift(tx: AnyDb, tableName: string, meta: EntityTableMeta): Promise<ColumnDriftResult>;
+export declare function swapShadowIntoLive(tx: AnyDb, tableName: string): Promise<void>;