@delali/sirannon-db 0.1.6 → 0.1.7

package/dist/server/index.mjs

@@ -1,7 +1,9 @@
-import { ChangeTracker, SubscriptionManager } from '../chunk-UTO3ZAFS.mjs';
-import '../chunk-GS7T5YMI.mjs';
-import { SirannonError } from '../chunk-O7BHI3CF.mjs';
+import { ChangeTracker, SubscriptionManager, changeMatchesFilter, isBulkLoadDurability } from '../chunk-HHRMRFFR.mjs';
+import '../chunk-CJLYFDP5.mjs';
+import { encodeTaggedValues, decodeTaggedValues, META_TABLE } from '../chunk-GEZUUIKV.mjs';
+import { SirannonError, CDCError, WriteOverloadError } from '../chunk-YPYVQJ4C.mjs';
 import uWS from 'uWebSockets.js';
+import { randomBytes } from 'crypto';
 
 // src/server/protocol.ts
 function toExecuteResponse(result) {
@@ -10,6 +12,147 @@ function toExecuteResponse(result) {
     lastInsertRowId: typeof result.lastInsertRowId === "bigint" ? result.lastInsertRowId.toString() : result.lastInsertRowId
   };
 }
+function loadDurabilityValidationError(value) {
+  if (value === void 0) return null;
+  if (!isBulkLoadDurability(value)) {
+    return `Field "durability" must be 'off' or 'normal' when provided`;
+  }
+  return null;
+}
+function loadCheckpointValidationError(value) {
+  if (value === void 0) return null;
+  if (typeof value !== "boolean") {
+    return 'Field "checkpoint" must be a boolean when provided';
+  }
+  return null;
+}
+function toBulkLoadOptions(source) {
+  if (source.durability === void 0 && source.checkpoint === void 0) return void 0;
+  const options = {};
+  if (source.durability !== void 0) options.durability = source.durability;
+  if (source.checkpoint !== void 0) options.checkpoint = source.checkpoint;
+  return options;
+}
+function decodeBoundParams(value, field) {
+  if (value === void 0 || value === null) return { ok: true, value: void 0 };
+  try {
+    return { ok: true, value: decodeTaggedValues(value) };
+  } catch {
+    return { ok: false, message: `Field "${field}" contains an invalid tagged value` };
+  }
+}
+function validateReadConcern(value) {
+  if (value === void 0) return { ok: true, value: void 0 };
+  if (!isPlainRecord(value)) {
+    return { ok: false, message: 'Field "readConcern" must be an object when provided' };
+  }
+  const keys = Object.keys(value);
+  if (keys.length !== 1 || !keys.includes("level")) {
+    return { ok: false, message: 'Field "readConcern" must contain only "level"' };
+  }
+  if (!isReadConcernLevel(value.level)) {
+    return { ok: false, message: 'Field "readConcern.level" is invalid' };
+  }
+  return { ok: true, value: { level: value.level } };
+}
+function validateWriteConcern(value) {
+  if (value === void 0) return { ok: true, value: void 0 };
+  if (!isPlainRecord(value)) {
+    return { ok: false, message: 'Field "writeConcern" must be an object when provided' };
+  }
+  const allowedKeys = /* @__PURE__ */ new Set(["level", "timeoutMs"]);
+  if (!Object.keys(value).every((key) => allowedKeys.has(key))) {
+    return { ok: false, message: 'Field "writeConcern" contains unsupported keys' };
+  }
+  if (!isWriteConcernLevel(value.level)) {
+    return { ok: false, message: 'Field "writeConcern.level" is invalid' };
+  }
+  const timeoutMs = value.timeoutMs;
+  if (timeoutMs !== void 0 && (typeof timeoutMs !== "number" || !Number.isSafeInteger(timeoutMs) || timeoutMs <= 0)) {
+    return { ok: false, message: 'Field "writeConcern.timeoutMs" must be a positive safe integer' };
+  }
+  return {
+    ok: true,
+    value: timeoutMs === void 0 ? { level: value.level } : { level: value.level, timeoutMs }
+  };
+}
+function isPlainRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isReadConcernLevel(value) {
+  return value === "local" || value === "majority" || value === "linearizable";
+}
+function isWriteConcernLevel(value) {
+  return value === "local" || value === "majority" || value === "all";
+}
+function transactionStatementsValidationError(value) {
+  if (!Array.isArray(value)) {
+    return 'Field "statements" is required and must be an array';
+  }
+  if (value.length === 0) {
+    return "Transaction requires at least one statement";
+  }
+  for (let i = 0; i < value.length; i++) {
+    const stmt = value[i];
+    if (typeof stmt !== "object" || stmt === null) {
+      return `Statement at index ${i} is missing a valid "sql" field`;
+    }
+    const sql = stmt.sql;
+    if (typeof sql !== "string" || sql.length === 0) {
+      return `Statement at index ${i} is missing a valid "sql" field`;
+    }
+    const params = stmt.params;
+    if (params !== void 0 && params !== null && typeof params !== "object") {
+      return `Statement at index ${i} has invalid "params"`;
+    }
+  }
+  return null;
+}
+function paramsBatchValidationError(value) {
+  if (!Array.isArray(value)) {
+    return 'Field "paramsBatch" is required and must be an array';
+  }
+  if (value.length === 0) {
+    return 'Field "paramsBatch" requires at least one parameter set';
+  }
+  for (let i = 0; i < value.length; i++) {
+    const entry = value[i];
+    if (typeof entry !== "object" || entry === null) {
+      return `Parameter set at index ${i} must be an object or array`;
+    }
+  }
+  return null;
+}
+
+// src/server/cors.ts
+function resolveCors(cors) {
+  if (!cors) return null;
+  if (cors === true) {
+    return {
+      origin: "*",
+      methods: "GET, POST, OPTIONS",
+      headers: "Content-Type, Authorization"
+    };
+  }
+  return {
+    origin: cors.origin ?? "*",
+    methods: cors.methods?.join(", ") ?? "GET, POST, OPTIONS",
+    headers: cors.headers?.join(", ") ?? "Content-Type, Authorization"
+  };
+}
+function matchOrigin(cors, requestOrigin) {
+  if (typeof cors.origin === "string") return cors.origin;
+  if (cors.origin.includes(requestOrigin)) return requestOrigin;
+  return null;
+}
+function writeCorsOrigin(res, cors, requestOrigin) {
+  const allowed = matchOrigin(cors, requestOrigin);
+  if (!allowed) return;
+  res.writeHeader("Access-Control-Allow-Origin", allowed);
+  if (allowed !== "*") {
+    res.writeHeader("Vary", "Origin");
+  }
+}
 
 // src/server/health.ts
 function handleLiveness() {
@@ -76,10 +219,11 @@ function readinessStatusForReplication(replication, current) {
   return current;
 }
 
-// src/server/http-handler.ts
+// src/server/http-common.ts
 function initAbortHandler(res) {
   const listeners = [];
   let aborted = false;
+  let claimed = false;
   res.onAborted(() => {
     aborted = true;
     for (const fn of listeners) fn();
@@ -94,6 +238,11 @@ function initAbortHandler(res) {
       } else {
         listeners.push(fn);
       }
+    },
+    claim() {
+      if (aborted || claimed) return false;
+      claimed = true;
+      return true;
     }
   };
 }
@@ -116,13 +265,16 @@ function readBody(res, maxBytes, abort) {
       totalLength += chunk.byteLength;
       if (totalLength > maxBytes) {
         done = true;
-        if (!abort.aborted) {
+        if (abort.claim()) {
           sendError(res, 413, "PAYLOAD_TOO_LARGE", "Request body exceeds size limit");
         }
         reject(new Error("Payload too large"));
         return;
       }
-      chunks.push(Buffer.from(chunk));
+      const bytes = new Uint8Array(chunk);
+      const copy = Buffer.allocUnsafe(bytes.byteLength);
+      copy.set(bytes);
+      chunks.push(copy);
       if (isLast) {
         done = true;
         resolve(Buffer.concat(chunks));
@@ -148,11 +300,15 @@ function sendJson(res, data) {
     res.writeStatus("200 OK").writeHeader("Content-Type", "application/json").end(payload);
   });
 }
-function sendError(res, status, code, message, details) {
+function sendError(res, status, code, message, details, headers) {
   const body = { error: details ? { code, message, details } : { code, message } };
   const payload = JSON.stringify(body);
   res.cork(() => {
-    res.writeStatus(`${status}`).writeHeader("Content-Type", "application/json").end(payload);
+    res.writeStatus(`${status}`);
+    if (headers) {
+      for (const [name, value] of Object.entries(headers)) res.writeHeader(name, value);
+    }
+    res.writeHeader("Content-Type", "application/json").end(payload);
   });
 }
 function httpStatusForError(err) {
@@ -160,9 +316,12 @@ function httpStatusForError(err) {
     case "DATABASE_NOT_FOUND":
       return 404;
     case "READ_ONLY":
+    case "FORBIDDEN_SQL":
       return 403;
     case "QUERY_ERROR":
     case "TRANSACTION_ERROR":
+    case "INVALID_DURABILITY":
+    case "INVALID_SYNCHRONOUS":
       return 400;
     case "STALE_PRIMARY":
     case "PROTOCOL_VERSION_MISMATCH":
@@ -178,16 +337,31 @@ function httpStatusForError(err) {
     case "NODE_NOT_IN_SYNC":
     case "NODE_DRAINING":
     case "UNSAFE_RECOVERY_REQUIRED":
+    case "WRITE_OVERLOADED":
       return 503;
     default:
       return 500;
   }
 }
-async function resolveExecutionTarget(res, sirannon, id, resolver) {
+function errorDetails(err) {
+  const details = err.details;
+  return details && Object.keys(details).length > 0 ? details : void 0;
+}
+function sendCaughtError(res, abort, err) {
+  if (abort.aborted) return;
+  if (err instanceof SirannonError) {
+    const headers = err instanceof WriteOverloadError ? { "Retry-After": `${Math.ceil(err.retryAfterMs / 1e3)}` } : void 0;
+    sendError(res, httpStatusForError(err), err.code, err.message, errorDetails(err), headers);
+  } else {
+    sendError(res, 500, "INTERNAL_ERROR", "An unexpected error occurred");
+  }
+}
+async function resolveExecutionTarget(res, abort, sirannon, id, resolver) {
   let target;
   try {
     target = resolver ? await resolver(id) : await sirannon.resolve(id);
   } catch (err) {
+    if (abort.aborted) return null;
     if (err instanceof SirannonError) {
       sendError(res, httpStatusForError(err), err.code, err.message);
     } else {
@@ -195,12 +369,51 @@ async function resolveExecutionTarget(res, sirannon, id, resolver) {
     }
     return null;
   }
+  if (abort.aborted) return null;
   if (!target) {
     sendError(res, 404, "DATABASE_NOT_FOUND", `Database '${id}' not found`);
     return null;
   }
   return target;
 }
+function parseReadConcern(res, value) {
+  const validation = validateReadConcern(value);
+  if (!validation.ok) {
+    sendError(res, 400, "INVALID_REQUEST", validation.message);
+    return { ok: false };
+  }
+  return validation;
+}
+function parseWriteConcern(res, value) {
+  const validation = validateWriteConcern(value);
+  if (!validation.ok) {
+    sendError(res, 400, "INVALID_REQUEST", validation.message);
+    return { ok: false };
+  }
+  return validation;
+}
+
+// src/server/wire-rows.ts
+async function queryWireRows(target, sql, params, options) {
+  if (target.queryForWire) {
+    return target.queryForWire(sql, params, options);
+  }
+  return encodeTaggedValues(await target.query(sql, params, options));
+}
+
+// src/server/http-handler.ts
+function decodeBatchParams(res, raw) {
+  const decoded = [];
+  for (const entry of raw) {
+    const result = decodeBoundParams(entry, "paramsBatch");
+    if (!result.ok) {
+      sendError(res, 400, "INVALID_REQUEST", result.message);
+      return null;
+    }
+    decoded.push(result.value);
+  }
+  return decoded;
+}
 function handleQuery(sirannon, resolveTarget) {
   return async (res, dbId, rawBody, abort) => {
     const body = parseBody(res, rawBody);
@@ -211,23 +424,24 @@ function handleQuery(sirannon, resolveTarget) {
     }
     const readConcern = parseReadConcern(res, body.readConcern);
     if (!readConcern.ok) return;
-    const target = await resolveExecutionTarget(res, sirannon, dbId, resolveTarget);
+    const params = decodeBoundParams(body.params, "params");
+    if (!params.ok) {
+      sendError(res, 400, "INVALID_REQUEST", params.message);
+      return;
+    }
+    const target = await resolveExecutionTarget(res, abort, sirannon, dbId, resolveTarget);
     if (!target) return;
     try {
-      const rows = await target.query(
+      const rows = await queryWireRows(
+        target,
         body.sql,
-        body.params,
+        params.value,
         readConcern.value ? { readConcern: readConcern.value } : void 0
       );
       if (abort.aborted) return;
       sendJson(res, { rows });
     } catch (err) {
-      if (abort.aborted) return;
-      if (err instanceof SirannonError) {
-        sendError(res, httpStatusForError(err), err.code, err.message, errorDetails(err));
-      } else {
-        sendError(res, 500, "INTERNAL_ERROR", "An unexpected error occurred");
-      }
+      sendCaughtError(res, abort, err);
     }
   };
 }
@@ -241,23 +455,23 @@ function handleExecute(sirannon, resolveTarget) {
     }
     const writeConcern = parseWriteConcern(res, body.writeConcern);
     if (!writeConcern.ok) return;
-    const target = await resolveExecutionTarget(res, sirannon, dbId, resolveTarget);
+    const params = decodeBoundParams(body.params, "params");
+    if (!params.ok) {
+      sendError(res, 400, "INVALID_REQUEST", params.message);
+      return;
+    }
+    const target = await resolveExecutionTarget(res, abort, sirannon, dbId, resolveTarget);
     if (!target) return;
     try {
       const result = await target.execute(
         body.sql,
-        body.params,
+        params.value,
         writeConcern.value ? { writeConcern: writeConcern.value } : void 0
       );
       if (abort.aborted) return;
       sendJson(res, toExecuteResponse(result));
     } catch (err) {
-      if (abort.aborted) return;
-      if (err instanceof SirannonError) {
-        sendError(res, httpStatusForError(err), err.code, err.message, errorDetails(err));
-      } else {
-        sendError(res, 500, "INTERNAL_ERROR", "An unexpected error occurred");
-      }
+      sendCaughtError(res, abort, err);
     }
   };
 }
@@ -265,35 +479,64 @@ function handleTransaction(sirannon, resolveTarget) {
   return async (res, dbId, rawBody, abort) => {
     const body = parseBody(res, rawBody);
     if (!body) return;
-    if (!Array.isArray(body.statements)) {
-      sendError(res, 400, "INVALID_REQUEST", 'Field "statements" is required and must be an array');
-      return;
-    }
-    if (body.statements.length === 0) {
-      sendError(res, 400, "INVALID_REQUEST", "Transaction requires at least one statement");
+    const statementsError = transactionStatementsValidationError(body.statements);
+    if (statementsError !== null) {
+      sendError(res, 400, "INVALID_REQUEST", statementsError);
       return;
     }
     const writeConcern = parseWriteConcern(res, body.writeConcern);
     if (!writeConcern.ok) return;
-    for (let i = 0; i < body.statements.length; i++) {
-      const stmt = body.statements[i];
-      if (!stmt.sql || typeof stmt.sql !== "string") {
-        sendError(res, 400, "INVALID_REQUEST", `Statement at index ${i} is missing a valid "sql" field`);
+    const statements = [];
+    for (const stmt of body.statements) {
+      const params = decodeBoundParams(stmt.params, "params");
+      if (!params.ok) {
+        sendError(res, 400, "INVALID_REQUEST", params.message);
         return;
       }
+      statements.push({ sql: stmt.sql, params: params.value });
     }
-    const target = await resolveExecutionTarget(res, sirannon, dbId, resolveTarget);
+    const target = await resolveExecutionTarget(res, abort, sirannon, dbId, resolveTarget);
+    if (!target) return;
+    const txOptions = writeConcern.value ? { writeConcern: writeConcern.value } : void 0;
+    try {
+      const results = target.executeTransaction ? await target.executeTransaction(statements, txOptions) : await target.transaction(async (tx) => {
+        const txResults = [];
+        for (const stmt of statements) {
+          txResults.push(await tx.execute(stmt.sql, stmt.params));
+        }
+        return txResults;
+      }, txOptions);
+      if (abort.aborted) return;
+      sendJson(res, {
+        results: results.map(toExecuteResponse)
+      });
+    } catch (err) {
+      sendCaughtError(res, abort, err);
+    }
+  };
+}
+function handleBatch(sirannon, resolveTarget) {
+  return async (res, dbId, rawBody, abort) => {
+    const body = parseBody(res, rawBody);
+    if (!body) return;
+    if (!body.sql || typeof body.sql !== "string") {
+      sendError(res, 400, "INVALID_REQUEST", 'Field "sql" is required and must be a string');
+      return;
+    }
+    const paramsBatchError = paramsBatchValidationError(body.paramsBatch);
+    if (paramsBatchError !== null) {
+      sendError(res, 400, "INVALID_REQUEST", paramsBatchError);
+      return;
+    }
+    const writeConcern = parseWriteConcern(res, body.writeConcern);
+    if (!writeConcern.ok) return;
+    const paramsBatch = decodeBatchParams(res, body.paramsBatch);
+    if (paramsBatch === null) return;
+    const target = await resolveExecutionTarget(res, abort, sirannon, dbId, resolveTarget);
     if (!target) return;
     try {
       const results = await target.transaction(
-        async (tx) => {
-          const txResults = [];
-          for (const stmt of body.statements) {
-            if (abort.aborted) throw new Error("Request aborted");
-            txResults.push(await tx.execute(stmt.sql, stmt.params));
-          }
-          return txResults;
-        },
+        async (tx) => tx.executeBatch(body.sql, paramsBatch),
         writeConcern.value ? { writeConcern: writeConcern.value } : void 0
       );
       if (abort.aborted) return;
@@ -301,66 +544,51 @@ function handleTransaction(sirannon, resolveTarget) {
         results: results.map(toExecuteResponse)
       });
     } catch (err) {
-      if (abort.aborted) return;
-      if (err instanceof SirannonError) {
-        sendError(res, httpStatusForError(err), err.code, err.message, errorDetails(err));
-      } else {
-        sendError(res, 500, "INTERNAL_ERROR", "An unexpected error occurred");
-      }
+      sendCaughtError(res, abort, err);
     }
   };
 }
-function parseReadConcern(res, value) {
-  if (value === void 0) return { ok: true, value: void 0 };
-  if (!isPlainRecord(value)) {
-    sendError(res, 400, "INVALID_REQUEST", 'Field "readConcern" must be an object when provided');
-    return { ok: false };
-  }
-  const keys = Object.keys(value);
-  if (keys.length !== 1 || !keys.includes("level")) {
-    sendError(res, 400, "INVALID_REQUEST", 'Field "readConcern" must contain only "level"');
-    return { ok: false };
-  }
-  if (!isReadConcernLevel(value.level)) {
-    sendError(res, 400, "INVALID_REQUEST", 'Field "readConcern.level" is invalid');
-    return { ok: false };
-  }
-  return { ok: true, value: { level: value.level } };
-}
-function parseWriteConcern(res, value) {
-  if (value === void 0) return { ok: true, value: void 0 };
-  if (!isPlainRecord(value)) {
-    sendError(res, 400, "INVALID_REQUEST", 'Field "writeConcern" must be an object when provided');
-    return { ok: false };
-  }
-  const allowedKeys = /* @__PURE__ */ new Set(["level", "timeoutMs"]);
-  if (!Object.keys(value).every((key) => allowedKeys.has(key))) {
-    sendError(res, 400, "INVALID_REQUEST", 'Field "writeConcern" contains unsupported keys');
-    return { ok: false };
-  }
-  if (!isWriteConcernLevel(value.level)) {
-    sendError(res, 400, "INVALID_REQUEST", 'Field "writeConcern.level" is invalid');
-    return { ok: false };
-  }
-  const timeoutMs = value.timeoutMs;
-  if (timeoutMs !== void 0 && (typeof timeoutMs !== "number" || !Number.isSafeInteger(timeoutMs) || timeoutMs <= 0)) {
-    sendError(res, 400, "INVALID_REQUEST", 'Field "writeConcern.timeoutMs" must be a positive safe integer');
-    return { ok: false };
-  }
-  return {
-    ok: true,
-    value: timeoutMs === void 0 ? { level: value.level } : { level: value.level, timeoutMs }
+function handleLoad(sirannon, resolveTarget) {
+  return async (res, dbId, rawBody, abort) => {
+    const body = parseBody(res, rawBody);
+    if (!body) return;
+    if (!body.sql || typeof body.sql !== "string") {
+      sendError(res, 400, "INVALID_REQUEST", 'Field "sql" is required and must be a string');
+      return;
+    }
+    const paramsBatchError = paramsBatchValidationError(body.paramsBatch);
+    if (paramsBatchError !== null) {
+      sendError(res, 400, "INVALID_REQUEST", paramsBatchError);
+      return;
+    }
+    const durabilityError = loadDurabilityValidationError(body.durability);
+    if (durabilityError !== null) {
+      sendError(res, 400, "INVALID_REQUEST", durabilityError);
+      return;
+    }
+    const checkpointError = loadCheckpointValidationError(body.checkpoint);
+    if (checkpointError !== null) {
+      sendError(res, 400, "INVALID_REQUEST", checkpointError);
+      return;
+    }
+    const paramsBatch = decodeBatchParams(res, body.paramsBatch);
+    if (paramsBatch === null) return;
+    const target = await resolveExecutionTarget(res, abort, sirannon, dbId, resolveTarget);
+    if (!target) return;
+    const bulkLoad = target.bulkLoad;
+    if (typeof bulkLoad !== "function") {
+      sendError(res, 501, "BULK_LOAD_UNSUPPORTED", "The execution target for this database does not support bulk load");
+      return;
+    }
+    try {
+      const summary = await bulkLoad.call(target, body.sql, paramsBatch, toBulkLoadOptions(body));
+      if (abort.aborted) return;
+      sendJson(res, summary);
+    } catch (err) {
+      sendCaughtError(res, abort, err);
+    }
   };
 }
-function isPlainRecord(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function isReadConcernLevel(value) {
-  return value === "local" || value === "majority" || value === "linearizable";
-}
-function isWriteConcernLevel(value) {
-  return value === "local" || value === "majority" || value === "all";
-}
 function handleClusterStatus(getClusterStatus) {
   return (res, dbId) => {
     if (!getClusterStatus) {
@@ -386,26 +614,421 @@ function toClusterStatusResponse(status) {
     primaryTerm: status.primaryTerm?.toString()
   };
 }
-function errorDetails(err) {
-  const details = err.details;
-  return details && Object.keys(details).length > 0 ? details : void 0;
+
+// src/server/request-hook.ts
+function decodeRemoteAddress(res) {
+  return Buffer.from(res.getRemoteAddressAsText()).toString();
+}
+function isRequestDenial(value) {
+  return typeof value === "object" && value !== null && "status" in value;
+}
+async function runOnRequest(res, abort, ctx, hook) {
+  try {
+    const result = await hook(ctx);
+    if (isRequestDenial(result)) {
+      if (abort.claim()) sendError(res, result.status, result.code, result.message);
+      return false;
+    }
+    return true;
+  } catch {
+    if (abort.claim()) sendError(res, 500, "HOOK_ERROR", "onRequest hook threw an error");
+    return false;
+  }
+}
+var EPOCH_KEY = "cdc_epoch";
+async function ensureCdcEpoch(conn) {
+  await conn.exec(`CREATE TABLE IF NOT EXISTS "${META_TABLE}" (key TEXT PRIMARY KEY, value TEXT NOT NULL)`);
+  const insert = await conn.prepare(`INSERT OR IGNORE INTO "${META_TABLE}" (key, value) VALUES (?, ?)`);
+  await insert.run(EPOCH_KEY, randomBytes(16).toString("hex"));
+  const select = await conn.prepare(`SELECT value FROM "${META_TABLE}" WHERE key = ?`);
+  const row = await select.get(EPOCH_KEY);
+  const value = row?.value;
+  if (typeof value !== "string" || value.length === 0) {
+    throw new CDCError("Failed to read the CDC epoch identifier");
+  }
+  return value;
+}
+
+// src/server/ws-cdc.ts
+var DEFAULT_POLL_INTERVAL_MS = 50;
+var CLEANUP_INTERVAL_TICKS = 100;
+var CdcContextRegistry = class {
+  sirannon;
+  retentionMs;
+  contexts = /* @__PURE__ */ new Map();
+  pending = /* @__PURE__ */ new Map();
+  closed = false;
+  constructor(sirannon, retentionMs) {
+    this.sirannon = sirannon;
+    this.retentionMs = retentionMs;
+  }
+  async ensure(databaseId, database) {
+    const existing = this.contexts.get(databaseId);
+    if (existing) return existing;
+    const pending = this.pending.get(databaseId);
+    if (pending) return pending;
+    const promise = this.createContext(database);
+    this.pending.set(databaseId, promise);
+    try {
+      const ctx = await promise;
+      if (this.closed) {
+        ctx.stopPolling();
+        await ctx.cdcConn.close().catch(() => {
+        });
+        throw new SirannonError("WebSocket handler is shut down", "HANDLER_CLOSED");
+      }
+      this.contexts.set(databaseId, ctx);
+      return ctx;
+    } finally {
+      this.pending.delete(databaseId);
+    }
+  }
+  get(databaseId) {
+    return this.contexts.get(databaseId);
+  }
+  maybeCleanup(databaseId) {
+    const ctx = this.contexts.get(databaseId);
+    if (!ctx || ctx.manager.size > 0) return;
+    ctx.stopPolling();
+    ctx.cdcConn.close().catch(() => {
+    });
+    this.contexts.delete(databaseId);
+  }
+  async closeAll() {
+    if (this.closed) return;
+    this.closed = true;
+    for (const ctx of this.contexts.values()) {
+      ctx.stopPolling();
+      try {
+        await ctx.cdcConn.close();
+      } catch {
+      }
+    }
+    this.contexts.clear();
+  }
+  async createContext(database) {
+    const cdcConn = await this.sirannon.driver.open(database.path, { walMode: true });
+    const tracker = new ChangeTracker(this.retentionMs === void 0 ? void 0 : { retention: this.retentionMs });
+    const manager = new SubscriptionManager();
+    let epoch = "";
+    try {
+      await tracker.advanceToLatest(cdcConn);
+      await database.runCdcMaintenance(async (writer) => {
+        epoch = await ensureCdcEpoch(writer);
+      });
+    } catch (err) {
+      await cdcConn.close().catch(() => {
+      });
+      throw err;
+    }
+    if (epoch === "") {
+      await cdcConn.close().catch(() => {
+      });
+      throw new SirannonError(`Database '${database.id}' is closed`, "DATABASE_CLOSED");
+    }
+    let polling = false;
+    let consecutiveErrors = 0;
+    let tickCount = 0;
+    const MAX_CONSECUTIVE_ERRORS = 10;
+    const stopPolling = () => {
+      clearInterval(interval);
+    };
+    const tick = async () => {
+      if (manager.size === 0) return;
+      if (polling) return;
+      polling = true;
+      try {
+        const events = await tracker.poll(cdcConn);
+        if (events.length > 0) {
+          manager.dispatch(events);
+        }
+        consecutiveErrors = 0;
+        tickCount++;
+        if (tickCount >= CLEANUP_INTERVAL_TICKS) {
+          tickCount = 0;
+          await database.runCdcMaintenance((writer) => tracker.cleanup(writer)).catch(() => {
+          });
+        }
+      } catch {
+        consecutiveErrors++;
+        if (consecutiveErrors >= MAX_CONSECUTIVE_ERRORS) {
+          stopPolling();
+        }
+      } finally {
+        polling = false;
+      }
+    };
+    const interval = setInterval(tick, DEFAULT_POLL_INTERVAL_MS);
+    interval.unref?.();
+    return { cdcConn, tracker, manager, stopPolling, epoch };
+  }
+};
+
+// src/server/ws-cdc-resume.ts
+var REPLAY_BATCH_SIZE = 1e3;
+var DEFAULT_PRIME_BUFFER_LIMIT = 1e4;
+var DEFAULT_PRIME_BUFFER_BYTES = 16 * 1048576;
+function approxEventBytes(event) {
+  let bytes = 0;
+  if (event.row) bytes += JSON.stringify(encodeTaggedValues(event.row)).length;
+  if (event.oldRow) bytes += JSON.stringify(encodeTaggedValues(event.oldRow)).length;
+  return bytes;
+}
+function needsResync(sinceSeq, minSeq, boundary) {
+  if (sinceSeq >= boundary) return false;
+  if (minSeq === null) return true;
+  return minSeq > sinceSeq + 1n;
+}
+var PrimedSubscription = class {
+  constructor(sinceSeq, deliver, onOverload, bufferLimit = DEFAULT_PRIME_BUFFER_LIMIT, bufferByteLimit = DEFAULT_PRIME_BUFFER_BYTES) {
+    this.sinceSeq = sinceSeq;
+    this.deliver = deliver;
+    this.onOverload = onOverload;
+    this.bufferLimit = bufferLimit;
+    this.bufferByteLimit = bufferByteLimit;
+  }
+  mode = "priming";
+  buffer = [];
+  bufferBytes = 0;
+  bufferLimit;
+  bufferByteLimit;
+  onLiveEvent(event) {
+    if (this.mode === "stopped") return;
+    if (this.mode === "live") {
+      this.emit(event);
+      return;
+    }
+    const nextBytes = this.bufferBytes + approxEventBytes(event);
+    if (this.buffer.length >= this.bufferLimit || nextBytes > this.bufferByteLimit) {
+      this.stop();
+      this.onOverload();
+      return;
+    }
+    this.buffer.push(event);
+    this.bufferBytes = nextBytes;
+  }
+  async replay(tracker, conn, table, filter, boundary) {
+    let cursor = this.sinceSeq;
+    while (this.mode === "priming" && cursor < boundary) {
+      const events = await tracker.readSince(conn, table, cursor, boundary, REPLAY_BATCH_SIZE);
+      if (events.length === 0) break;
+      for (const event of events) {
+        if (filter && !changeMatchesFilter(event, filter)) continue;
+        if (!this.emit(event)) return;
+      }
+      const lastEvent = events[events.length - 1];
+      if (lastEvent === void 0) break;
+      cursor = lastEvent.seq;
+      if (events.length < REPLAY_BATCH_SIZE) break;
+    }
+  }
+  goLive() {
+    if (this.mode !== "priming") return;
+    const pending = this.buffer;
+    this.buffer = [];
+    for (const event of pending) {
+      if (!this.emit(event)) return;
+    }
+    if (this.mode === "priming") {
+      this.mode = "live";
+    }
+  }
+  emit(event) {
+    if (this.mode === "stopped") return false;
+    if (event.seq <= this.sinceSeq) return true;
+    const outcome = this.deliver(event);
+    if (outcome === "dropped") {
+      this.stop();
+      return false;
+    }
+    return true;
+  }
+  stop() {
+    this.mode = "stopped";
+    this.buffer = [];
+    this.bufferBytes = 0;
+  }
+};
+
+// src/server/ws-connection.ts
+var WS_CLOSE_OVERLOADED = 4290;
+
+// src/server/ws-operations.ts
+function isValidParams(params) {
+  if (params === void 0 || params === null) return true;
+  return typeof params === "object";
+}
+function decodeBatchParams2(ctx, id, raw) {
+  const decoded = [];
+  for (const entry of raw) {
+    const result = decodeBoundParams(entry, "paramsBatch");
+    if (!result.ok) {
+      ctx.sendError(id, "INVALID_MESSAGE", result.message);
+      return null;
+    }
+    decoded.push(result.value);
+  }
+  return decoded;
+}
+async function handleQueryMessage(ctx, msg, id) {
+  if (typeof msg.sql !== "string") {
+    ctx.sendError(id, "INVALID_MESSAGE", 'Query message requires a "sql" string field');
+    return;
+  }
+  if (!isValidParams(msg.params)) {
+    ctx.sendError(id, "INVALID_MESSAGE", '"params" must be an object or array');
+    return;
+  }
+  const params = decodeBoundParams(msg.params, "params");
+  if (!params.ok) {
+    ctx.sendError(id, "INVALID_MESSAGE", params.message);
+    return;
+  }
+  try {
+    const rows = await queryWireRows(ctx.target, msg.sql, params.value);
+    ctx.sendResult(id, { rows });
+  } catch (err) {
+    ctx.sendCaughtError(id, err);
+  }
+}
+async function handleExecuteMessage(ctx, msg, id) {
+  if (typeof msg.sql !== "string") {
+    ctx.sendError(id, "INVALID_MESSAGE", 'Execute message requires a "sql" string field');
+    return;
+  }
+  if (!isValidParams(msg.params)) {
+    ctx.sendError(id, "INVALID_MESSAGE", '"params" must be an object or array');
+    return;
+  }
+  const params = decodeBoundParams(msg.params, "params");
+  if (!params.ok) {
+    ctx.sendError(id, "INVALID_MESSAGE", params.message);
+    return;
+  }
+  try {
+    const result = await ctx.target.execute(msg.sql, params.value);
+    ctx.sendResult(id, toExecuteResponse(result));
+  } catch (err) {
+    ctx.sendCaughtError(id, err);
+  }
+}
+async function handleTransactionMessage(ctx, msg, id) {
+  const statementsError = transactionStatementsValidationError(msg.statements);
+  if (statementsError !== null) {
+    ctx.sendError(id, "INVALID_MESSAGE", statementsError);
+    return;
+  }
+  const writeConcern = validateWriteConcern(msg.writeConcern);
+  if (!writeConcern.ok) {
+    ctx.sendError(id, "INVALID_MESSAGE", writeConcern.message);
+    return;
+  }
+  const validStatements = msg.statements;
+  const statements = [];
+  for (const stmt of validStatements) {
+    const params = decodeBoundParams(stmt.params, "params");
+    if (!params.ok) {
+      ctx.sendError(id, "INVALID_MESSAGE", params.message);
+      return;
+    }
+    statements.push({ sql: stmt.sql, params: params.value });
+  }
+  const txOptions = writeConcern.value ? { writeConcern: writeConcern.value } : void 0;
+  try {
+    const results = ctx.target.executeTransaction ? await ctx.target.executeTransaction(statements, txOptions) : await ctx.target.transaction(async (tx) => {
+      const txResults = [];
+      for (const stmt of statements) {
+        txResults.push(await tx.execute(stmt.sql, stmt.params));
+      }
+      return txResults;
+    }, txOptions);
+    ctx.sendResult(id, { results: results.map(toExecuteResponse) });
+  } catch (err) {
+    ctx.sendCaughtError(id, err);
+  }
+}
+async function handleBatchMessage(ctx, msg, id) {
+  if (typeof msg.sql !== "string") {
+    ctx.sendError(id, "INVALID_MESSAGE", 'Batch message requires a "sql" string field');
+    return;
+  }
+  const paramsBatchError = paramsBatchValidationError(msg.paramsBatch);
+  if (paramsBatchError !== null) {
+    ctx.sendError(id, "INVALID_MESSAGE", paramsBatchError);
+    return;
+  }
+  const writeConcern = validateWriteConcern(msg.writeConcern);
+  if (!writeConcern.ok) {
+    ctx.sendError(id, "INVALID_MESSAGE", writeConcern.message);
+    return;
+  }
+  const sql = msg.sql;
+  const paramsBatch = decodeBatchParams2(ctx, id, msg.paramsBatch);
+  if (paramsBatch === null) return;
+  try {
+    const results = await ctx.target.transaction(
+      async (tx) => tx.executeBatch(sql, paramsBatch),
+      writeConcern.value ? { writeConcern: writeConcern.value } : void 0
+    );
+    ctx.sendResult(id, { results: results.map(toExecuteResponse) });
+  } catch (err) {
+    ctx.sendCaughtError(id, err);
+  }
+}
+async function handleLoadMessage(ctx, msg, id) {
+  if (typeof msg.sql !== "string") {
+    ctx.sendError(id, "INVALID_MESSAGE", 'Load message requires a "sql" string field');
+    return;
+  }
+  const paramsBatchError = paramsBatchValidationError(msg.paramsBatch);
+  if (paramsBatchError !== null) {
+    ctx.sendError(id, "INVALID_MESSAGE", paramsBatchError);
+    return;
+  }
+  const durabilityError = loadDurabilityValidationError(msg.durability);
+  if (durabilityError !== null) {
+    ctx.sendError(id, "INVALID_MESSAGE", durabilityError);
+    return;
+  }
+  const checkpointError = loadCheckpointValidationError(msg.checkpoint);
+  if (checkpointError !== null) {
+    ctx.sendError(id, "INVALID_MESSAGE", checkpointError);
+    return;
+  }
+  const bulkLoad = ctx.target.bulkLoad;
+  if (typeof bulkLoad !== "function") {
+    ctx.sendError(id, "BULK_LOAD_UNSUPPORTED", "The execution target for this database does not support bulk load");
+    return;
+  }
+  const sql = msg.sql;
+  const paramsBatch = decodeBatchParams2(ctx, id, msg.paramsBatch);
+  if (paramsBatch === null) return;
+  const options = toBulkLoadOptions({
+    durability: msg.durability,
+    checkpoint: msg.checkpoint
+  });
+  try {
+    const summary = await bulkLoad.call(ctx.target, sql, paramsBatch, options);
+    ctx.sendResult(id, summary);
+  } catch (err) {
+    ctx.sendCaughtError(id, err);
+  }
 }
 
 // src/server/ws-handler.ts
-var DEFAULT_POLL_INTERVAL_MS = 50;
 var DEFAULT_MAX_PAYLOAD_LENGTH = 1048576;
 var WSHandler = class {
   sirannon;
   maxPayloadLength;
   resolveExecutionTarget;
   connections = /* @__PURE__ */ new Map();
-  cdcContexts = /* @__PURE__ */ new Map();
-  cdcPending = /* @__PURE__ */ new Map();
+  cdc;
   closed = false;
   constructor(sirannon, options) {
     this.sirannon = sirannon;
     this.maxPayloadLength = options?.maxPayloadLength ?? DEFAULT_MAX_PAYLOAD_LENGTH;
     this.resolveExecutionTarget = options?.resolveExecutionTarget;
+    this.cdc = new CdcContextRegistry(sirannon, options?.cdcRetentionMs);
   }
   async handleOpen(conn, databaseId) {
     if (this.closed) {
@@ -441,13 +1064,25 @@ var WSHandler = class {
       databaseId,
       database,
       executionTarget,
-      subscriptions: /* @__PURE__ */ new Map()
+      subscriptions: /* @__PURE__ */ new Map(),
+      overloaded: false
     });
   }
+  /**
+   * Tears down a connection whose outbound buffer overflowed. Closing lets the
+   * client reject in-flight requests and reconnect; guarding on `overloaded`
+   * keeps a burst of dropped frames from repeatedly re-closing the socket.
+   */
+  handleOverload(conn) {
+    const state = this.connections.get(conn);
+    if (!state || state.overloaded) return;
+    state.overloaded = true;
+    conn.close(WS_CLOSE_OVERLOADED, "Connection overloaded: backpressure limit exceeded");
+  }
   handleMessage(conn, data) {
     const state = this.connections.get(conn);
     if (!state) return;
-    if (data.length > this.maxPayloadLength) {
+    if (Buffer.byteLength(data) > this.maxPayloadLength) {
       this.sendError(conn, "", "PAYLOAD_TOO_LARGE", "Message exceeds maximum payload length");
       return;
     }
@@ -467,16 +1102,26 @@ var WSHandler = class {
       return;
     }
     if (typeof msg.id !== "string") {
-      this.sendError(conn, "", "INVALID_MESSAGE", 'Message must have a string "id" field');
+      const echoId = typeof msg.id === "number" || typeof msg.id === "bigint" ? String(msg.id) : "";
+      this.sendError(conn, echoId, "INVALID_MESSAGE", 'Message must have a string "id" field');
       return;
     }
     const id = msg.id;
     switch (msg.type) {
       case "query":
-        this.handleQuery(conn, state, msg, id);
+        handleQueryMessage(this.operationContext(conn, state), msg, id);
         break;
       case "execute":
-        this.handleExecute(conn, state, msg, id);
+        handleExecuteMessage(this.operationContext(conn, state), msg, id);
+        break;
+      case "transaction":
+        handleTransactionMessage(this.operationContext(conn, state), msg, id);
+        break;
+      case "batch":
+        handleBatchMessage(this.operationContext(conn, state), msg, id);
+        break;
+      case "load":
+        handleLoadMessage(this.operationContext(conn, state), msg, id);
         break;
       case "subscribe":
         this.handleSubscribe(conn, state, msg, id);
@@ -495,7 +1140,7 @@ var WSHandler = class {
       sub.unsubscribe();
     }
     state.subscriptions.clear();
-    this.maybeCleanupCDC(state.databaseId);
+    this.cdc.maybeCleanup(state.databaseId);
     this.connections.delete(conn);
   }
   get connectionCount() {
@@ -512,52 +1157,15 @@ var WSHandler = class {
       conn.close(1001, "Handler shutting down");
     }
     this.connections.clear();
-    for (const ctx of this.cdcContexts.values()) {
-      ctx.stopPolling();
-      try {
-        await ctx.cdcConn.close();
-      } catch {
-      }
-    }
-    this.cdcContexts.clear();
-  }
-  async handleQuery(conn, state, msg, id) {
-    if (typeof msg.sql !== "string") {
-      this.sendError(conn, id, "INVALID_MESSAGE", 'Query message requires a "sql" string field');
-      return;
-    }
-    if (!this.isValidParams(msg.params)) {
-      this.sendError(conn, id, "INVALID_MESSAGE", '"params" must be an object or array');
-      return;
-    }
-    try {
-      const params = msg.params ?? void 0;
-      const rows = await state.executionTarget.query(msg.sql, params);
-      this.send(conn, { type: "result", id, data: { rows } });
-    } catch (err) {
-      this.sendSirannonError(conn, id, err);
-    }
+    await this.cdc.closeAll();
   }
-  async handleExecute(conn, state, msg, id) {
-    if (typeof msg.sql !== "string") {
-      this.sendError(conn, id, "INVALID_MESSAGE", 'Execute message requires a "sql" string field');
-      return;
-    }
-    if (!this.isValidParams(msg.params)) {
-      this.sendError(conn, id, "INVALID_MESSAGE", '"params" must be an object or array');
-      return;
-    }
-    try {
-      const params = msg.params ?? void 0;
-      const result = await state.executionTarget.execute(msg.sql, params);
-      this.send(conn, {
-        type: "result",
-        id,
-        data: toExecuteResponse(result)
-      });
-    } catch (err) {
-      this.sendSirannonError(conn, id, err);
-    }
+  operationContext(conn, state) {
+    return {
+      target: state.executionTarget,
+      sendResult: (id, data) => this.send(conn, { type: "result", id, data }),
+      sendError: (id, code, message) => this.sendError(conn, id, code, message),
+      sendCaughtError: (id, err) => this.sendSirannonError(conn, id, err)
+    };
   }
   async handleSubscribe(conn, state, msg, id) {
     if (typeof msg.table !== "string") {
@@ -580,22 +1188,88 @@ var WSHandler = class {
       this.sendError(conn, id, "INVALID_MESSAGE", '"filter" must be a plain object');
       return;
     }
-    const filter = msg.filter ?? void 0;
-    let ctx = null;
+    const decodedFilter = decodeBoundParams(msg.filter, "filter");
+    if (!decodedFilter.ok) {
+      this.sendError(conn, id, "INVALID_MESSAGE", decodedFilter.message);
+      return;
+    }
+    const filter = decodedFilter.value;
+    let sinceSeq;
+    if (msg.sinceSeq !== void 0) {
+      if (typeof msg.sinceSeq !== "string" || !/^\d+$/.test(msg.sinceSeq)) {
+        this.sendError(conn, id, "INVALID_MESSAGE", '"sinceSeq" must be a non-negative integer string');
+        return;
+      }
+      sinceSeq = BigInt(msg.sinceSeq);
+    }
+    let clientEpoch;
+    if (msg.epoch !== void 0) {
+      if (typeof msg.epoch !== "string") {
+        this.sendError(conn, id, "INVALID_MESSAGE", '"epoch" must be a string');
+        return;
+      }
+      clientEpoch = msg.epoch;
+    }
+    if (sinceSeq === void 0) {
+      await this.subscribeLive(conn, state, id, msg.table, filter);
+      return;
+    }
+    await this.subscribeResuming(conn, state, id, msg.table, filter, sinceSeq, clientEpoch);
+  }
+  async subscribeLive(conn, state, id, table, filter) {
     try {
-      ctx = await this.ensureCDC(state.databaseId, state.database);
-      await ctx.tracker.watch(ctx.cdcConn, msg.table);
-      const sub = ctx.manager.subscribe(msg.table, filter, (event) => {
+      const ctx = await this.cdc.ensure(state.databaseId, state.database);
+      await ctx.tracker.watch(ctx.cdcConn, table);
+      const boundary = ctx.tracker.cursor;
+      const sub = ctx.manager.subscribe(table, filter, (event) => {
         this.sendChange(conn, id, event);
       });
       state.subscriptions.set(id, sub);
-      this.send(conn, { type: "subscribed", id });
+      this.send(conn, { type: "subscribed", id, seq: boundary.toString(), epoch: ctx.epoch });
     } catch (err) {
-      if (ctx?.manager.size === 0) {
-        this.maybeCleanupCDC(state.databaseId);
-      }
+      this.cdc.maybeCleanup(state.databaseId);
+      this.sendSirannonError(conn, id, err);
+    }
+  }
+  async subscribeResuming(conn, state, id, table, filter, sinceSeq, clientEpoch) {
+    let ctx;
+    let primed;
+    let boundary;
+    let resync;
+    try {
+      ctx = await this.cdc.ensure(state.databaseId, state.database);
+      await ctx.tracker.watch(ctx.cdcConn, table);
+      boundary = ctx.tracker.cursor;
+      primed = new PrimedSubscription(
+        sinceSeq,
+        (event) => this.sendChange(conn, id, event),
+        () => this.handleOverload(conn)
+      );
+      const sub = ctx.manager.subscribe(table, filter, (event) => primed.onLiveEvent(event));
+      state.subscriptions.set(id, sub);
+      const minSeq = await ctx.tracker.getMinSeq(ctx.cdcConn);
+      const foreignEpoch = clientEpoch !== void 0 && clientEpoch !== ctx.epoch;
+      resync = foreignEpoch || needsResync(sinceSeq, minSeq, boundary);
+      this.send(conn, {
+        type: "subscribed",
+        id,
+        seq: boundary.toString(),
+        epoch: ctx.epoch,
+        ...resync ? { resync: true } : {}
+      });
+    } catch (err) {
+      this.cdc.maybeCleanup(state.databaseId);
       this.sendSirannonError(conn, id, err);
+      return;
+    }
+    if (!resync) {
+      try {
+        await primed.replay(ctx.tracker, ctx.cdcConn, table, filter, boundary);
+      } catch {
+        this.send(conn, { type: "subscribed", id, seq: boundary.toString(), epoch: ctx.epoch, resync: true });
+      }
     }
+    primed.goLive();
   }
   handleUnsubscribe(conn, state, id) {
     const sub = state.subscriptions.get(id);
@@ -606,80 +1280,7 @@ var WSHandler = class {
     sub.unsubscribe();
     state.subscriptions.delete(id);
     this.send(conn, { type: "unsubscribed", id });
-    this.maybeCleanupCDC(state.databaseId);
-  }
-  async ensureCDC(databaseId, database) {
-    const existing = this.cdcContexts.get(databaseId);
-    if (existing) return existing;
-    const pending = this.cdcPending.get(databaseId);
-    if (pending) return pending;
-    const promise = this.createCDCContext(database);
-    this.cdcPending.set(databaseId, promise);
-    try {
-      const ctx = await promise;
-      if (this.closed) {
-        ctx.stopPolling();
-        await ctx.cdcConn.close().catch(() => {
-        });
-        throw new SirannonError("WebSocket handler is shut down", "HANDLER_CLOSED");
-      }
-      this.cdcContexts.set(databaseId, ctx);
-      return ctx;
-    } finally {
-      this.cdcPending.delete(databaseId);
-    }
-  }
-  async createCDCContext(database) {
-    const cdcConn = await this.sirannon.driver.open(database.path, { walMode: true });
-    const tracker = new ChangeTracker();
-    const manager = new SubscriptionManager();
-    try {
-      await tracker.advanceToLatest(cdcConn);
-    } catch (err) {
-      await cdcConn.close().catch(() => {
-      });
-      throw err;
-    }
-    let polling = false;
-    let consecutiveErrors = 0;
-    const MAX_CONSECUTIVE_ERRORS = 10;
-    const stopPolling = () => {
-      clearInterval(interval);
-    };
-    const tick = async () => {
-      if (manager.size === 0) return;
-      if (polling) return;
-      polling = true;
-      try {
-        const events = await tracker.poll(cdcConn);
-        if (events.length > 0) {
-          manager.dispatch(events);
-        }
-        consecutiveErrors = 0;
-      } catch {
-        consecutiveErrors++;
-        if (consecutiveErrors >= MAX_CONSECUTIVE_ERRORS) {
-          stopPolling();
-        }
-      } finally {
-        polling = false;
-      }
-    };
-    const interval = setInterval(tick, DEFAULT_POLL_INTERVAL_MS);
-    interval.unref?.();
-    return { cdcConn, tracker, manager, stopPolling };
-  }
-  maybeCleanupCDC(databaseId) {
-    const ctx = this.cdcContexts.get(databaseId);
-    if (!ctx || ctx.manager.size > 0) return;
-    ctx.stopPolling();
-    ctx.cdcConn.close().catch(() => {
-    });
-    this.cdcContexts.delete(databaseId);
-  }
-  isValidParams(params) {
-    if (params === void 0 || params === null) return true;
-    return typeof params === "object";
+    this.cdc.maybeCleanup(state.databaseId);
   }
   async resolveTarget(databaseId) {
     if (!this.resolveExecutionTarget) {
@@ -688,10 +1289,18 @@ var WSHandler = class {
     return await this.resolveExecutionTarget(databaseId) ?? null;
   }
   send(conn, msg) {
+    let data;
     try {
-      conn.send(JSON.stringify(msg));
+      data = JSON.stringify(msg);
     } catch {
+      this.handleOverload(conn);
+      return "dropped";
+    }
+    const outcome = conn.send(data);
+    if (outcome === "dropped") {
+      this.handleOverload(conn);
     }
+    return outcome;
   }
   sendError(conn, id, code, message) {
     this.send(conn, { type: "error", id, error: { code, message } });
@@ -702,14 +1311,14 @@ var WSHandler = class {
     this.sendError(conn, id, code, message);
   }
   sendChange(conn, subscriptionId, event) {
-    this.send(conn, {
+    return this.send(conn, {
       type: "change",
       id: subscriptionId,
       event: {
         type: event.type,
         table: event.table,
-        row: event.row,
-        oldRow: event.oldRow,
+        row: encodeTaggedValues(event.row),
+        oldRow: event.oldRow === void 0 ? void 0 : encodeTaggedValues(event.oldRow),
         seq: event.seq.toString(),
         timestamp: event.timestamp
       }
@@ -720,58 +1329,151 @@ function createWSHandler(sirannon, options) {
   return new WSHandler(sirannon, options);
 }
 
-// src/server/server.ts
-function resolveCors(cors) {
-  if (!cors) return null;
-  if (cors === true) {
-    return {
-      origin: "*",
-      methods: "GET, POST, OPTIONS",
-      headers: "Content-Type, Authorization"
-    };
-  }
-  return {
-    origin: cors.origin ?? "*",
-    methods: cors.methods?.join(", ") ?? "GET, POST, OPTIONS",
-    headers: cors.headers?.join(", ") ?? "Content-Type, Authorization"
-  };
-}
-function matchOrigin(cors, requestOrigin) {
-  if (cors.origin === "*") return "*";
-  if (typeof cors.origin === "string") return cors.origin;
-  if (cors.origin.includes(requestOrigin)) return requestOrigin;
-  return null;
-}
-function writeCorsOrigin(res, cors, requestOrigin) {
-  const allowed = matchOrigin(cors, requestOrigin);
-  if (!allowed) return;
-  res.writeHeader("Access-Control-Allow-Origin", allowed);
-  if (allowed !== "*") {
-    res.writeHeader("Vary", "Origin");
-  }
+// src/server/ws-route.ts
+function toSendOutcome(result) {
+  if (result === 2) return "dropped";
+  if (result === 0) return "buffered";
+  return "sent";
 }
 function selectWebSocketProtocol(header) {
   const [firstProtocol] = header.split(",");
   return firstProtocol?.trim() ?? "";
 }
-function decodeRemoteAddress(res) {
-  return Buffer.from(res.getRemoteAddressAsText()).toString();
+function registerWebSocketRoute(options) {
+  const { app, wsHandler, onRequestHook } = options;
+  app.ws("/db/:id", {
+    maxPayloadLength: options.maxBodyBytes,
+    maxBackpressure: options.maxBackpressureBytes,
+    idleTimeout: 120,
+    sendPingsAutomatically: true,
+    upgrade: (res, req, context) => {
+      const dbId = req.getParameter(0) ?? "";
+      const url = req.getUrl();
+      const method = req.getMethod();
+      const secWebSocketKey = req.getHeader("sec-websocket-key");
+      const secWebSocketProtocol = req.getHeader("sec-websocket-protocol");
+      const selectedWebSocketProtocol = selectWebSocketProtocol(secWebSocketProtocol);
+      const secWebSocketExtensions = req.getHeader("sec-websocket-extensions");
+      const headers = {};
+      req.forEach((key, value) => {
+        headers[key] = value;
+      });
+      const remoteAddress = decodeRemoteAddress(res);
+      const abort = initAbortHandler(res);
+      if (!onRequestHook) {
+        if (abort.claim()) {
+          res.upgrade(
+            { databaseId: dbId },
+            secWebSocketKey,
+            selectedWebSocketProtocol,
+            secWebSocketExtensions,
+            context
+          );
+        }
+        return;
+      }
+      const ctx = {
+        headers,
+        method,
+        path: url,
+        databaseId: dbId,
+        remoteAddress
+      };
+      runOnRequest(res, abort, ctx, onRequestHook).then((allowed) => {
+        if (!allowed || !abort.claim()) return;
+        res.upgrade(
+          { databaseId: dbId },
+          secWebSocketKey,
+          selectedWebSocketProtocol,
+          secWebSocketExtensions,
+          context
+        );
+      }).catch(() => {
+      });
+    },
+    open: (ws) => {
+      const userData = ws.getUserData();
+      const conn = {
+        send(data) {
+          try {
+            return toSendOutcome(ws.send(data, false));
+          } catch {
+            return "dropped";
+          }
+        },
+        close(code, reason) {
+          try {
+            ws.end(code, reason);
+          } catch {
+          }
+        }
+      };
+      userData.conn = conn;
+      wsHandler.handleOpen(conn, userData.databaseId).catch(() => {
+      });
+    },
+    message: (ws, message) => {
+      const userData = ws.getUserData();
+      if (!userData.conn) return;
+      const text = Buffer.from(message).toString("utf-8");
+      wsHandler.handleMessage(userData.conn, text);
+    },
+    dropped: (ws) => {
+      const userData = ws.getUserData();
+      if (userData.conn) {
+        wsHandler.handleOverload(userData.conn);
+      }
+    },
+    close: (ws) => {
+      const userData = ws.getUserData();
+      if (!userData.conn) return;
+      wsHandler.handleClose(userData.conn);
+      userData.conn = void 0;
+    }
+  });
 }
-function isRequestDenial(value) {
-  return typeof value === "object" && value !== null && "status" in value;
+
+// src/server/server.ts
+var DEFAULT_MAX_BODY_BYTES = 1048576;
+var DEFAULT_WS_BACKPRESSURE_BYTES = 16 * 1048576;
+var UWS_MAX_LIMIT_BYTES = 4294967295;
+function resolveMaxBodyBytes(value) {
+  if (value === void 0) return DEFAULT_MAX_BODY_BYTES;
+  if (typeof value !== "number" || !Number.isInteger(value) || value <= 0) {
+    throw new SirannonError(
+      "ServerOptions.maxBodyBytes must be a positive integer number of bytes",
+      "INVALID_MAX_BODY_BYTES"
+    );
+  }
+  if (value > UWS_MAX_LIMIT_BYTES) {
+    throw new SirannonError(
+      `ServerOptions.maxBodyBytes must be at most ${UWS_MAX_LIMIT_BYTES} bytes; uWebSockets.js stores the limit as an unsigned 32-bit integer and would silently wrap a larger value modulo 2^32`,
+      "INVALID_MAX_BODY_BYTES"
+    );
+  }
+  return value;
 }
-async function runOnRequest(res, ctx, hook) {
-  try {
-    const result = await hook(ctx);
-    if (isRequestDenial(result)) {
-      sendError(res, result.status, result.code, result.message);
-      return false;
-    }
-    return true;
-  } catch {
-    sendError(res, 500, "HOOK_ERROR", "onRequest hook threw an error");
-    return false;
+function resolveWsBackpressure(value, maxBodyBytes) {
+  const resolved = value ?? Math.max(DEFAULT_WS_BACKPRESSURE_BYTES, maxBodyBytes);
+  if (typeof resolved !== "number" || !Number.isInteger(resolved) || resolved <= 0) {
+    throw new SirannonError(
+      "ServerOptions.maxWebSocketBackpressureBytes must be a positive integer number of bytes",
+      "INVALID_WS_BACKPRESSURE"
+    );
+  }
+  if (resolved > UWS_MAX_LIMIT_BYTES) {
+    throw new SirannonError(
+      `ServerOptions.maxWebSocketBackpressureBytes must be at most ${UWS_MAX_LIMIT_BYTES} bytes; uWebSockets.js stores the limit as an unsigned 32-bit integer and would silently wrap a larger value modulo 2^32`,
+      "INVALID_WS_BACKPRESSURE"
+    );
+  }
+  if (resolved < maxBodyBytes) {
+    throw new SirannonError(
+      "ServerOptions.maxWebSocketBackpressureBytes must be at least maxBodyBytes so a single frame fits",
+      "INVALID_WS_BACKPRESSURE"
+    );
   }
+  return resolved;
 }
 var SirannonServer = class {
   app;
@@ -785,6 +1487,8 @@ var SirannonServer = class {
   getClusterStatus;
   sirannon;
   wsHandler;
+  maxBodyBytes;
+  maxWsBackpressureBytes;
   constructor(sirannon, options) {
     this.sirannon = sirannon;
     this.host = options?.host ?? "127.0.0.1";
@@ -794,7 +1498,13 @@ var SirannonServer = class {
     this.resolveExecutionTarget = options?.resolveExecutionTarget;
     this.getReplicationStatus = options?.getReplicationStatus;
     this.getClusterStatus = options?.getClusterStatus;
-    this.wsHandler = new WSHandler(sirannon, { resolveExecutionTarget: this.resolveExecutionTarget });
+    this.maxBodyBytes = resolveMaxBodyBytes(options?.maxBodyBytes);
+    this.maxWsBackpressureBytes = resolveWsBackpressure(options?.maxWebSocketBackpressureBytes, this.maxBodyBytes);
+    this.wsHandler = new WSHandler(sirannon, {
+      resolveExecutionTarget: this.resolveExecutionTarget,
+      maxPayloadLength: this.maxBodyBytes,
+      cdcRetentionMs: options?.cdcRetentionMs
+    });
     this.app = uWS.App();
     this.registerRoutes();
   }
@@ -845,98 +1555,20 @@ var SirannonServer = class {
       "/db/:id/transaction",
       this.wrapDbRoute(handleTransaction(this.sirannon, this.resolveExecutionTarget))
     );
+    this.app.post("/db/:id/batch", this.wrapDbRoute(handleBatch(this.sirannon, this.resolveExecutionTarget)));
+    this.app.post("/db/:id/load", this.wrapDbRoute(handleLoad(this.sirannon, this.resolveExecutionTarget)));
     this.registerWebSocketRoute();
     this.app.any("/*", (res) => {
       sendError(res, 404, "NOT_FOUND", "Route not found");
     });
   }
   registerWebSocketRoute() {
-    const wsHandler = this.wsHandler;
-    const onRequestHook = this.onRequestHook;
-    this.app.ws("/db/:id", {
-      maxPayloadLength: 1048576,
-      idleTimeout: 120,
-      sendPingsAutomatically: true,
-      upgrade: (res, req, context) => {
-        const dbId = req.getParameter(0) ?? "";
-        const url = req.getUrl();
-        const method = req.getMethod();
-        const secWebSocketKey = req.getHeader("sec-websocket-key");
-        const secWebSocketProtocol = req.getHeader("sec-websocket-protocol");
-        const selectedWebSocketProtocol = selectWebSocketProtocol(secWebSocketProtocol);
-        const secWebSocketExtensions = req.getHeader("sec-websocket-extensions");
-        const headers = {};
-        req.forEach((key, value) => {
-          headers[key] = value;
-        });
-        const remoteAddress = decodeRemoteAddress(res);
-        let aborted = false;
-        res.onAborted(() => {
-          aborted = true;
-        });
-        if (!onRequestHook) {
-          if (!aborted) {
-            res.upgrade(
-              { databaseId: dbId },
-              secWebSocketKey,
-              selectedWebSocketProtocol,
-              secWebSocketExtensions,
-              context
-            );
-          }
-          return;
-        }
-        const ctx = {
-          headers,
-          method,
-          path: url,
-          databaseId: dbId,
-          remoteAddress
-        };
-        runOnRequest(res, ctx, onRequestHook).then((allowed) => {
-          if (aborted || !allowed) return;
-          res.upgrade(
-            { databaseId: dbId },
-            secWebSocketKey,
-            selectedWebSocketProtocol,
-            secWebSocketExtensions,
-            context
-          );
-        }).catch(() => {
-        });
-      },
-      open: (ws) => {
-        const userData = ws.getUserData();
-        const conn = {
-          send(data) {
-            try {
-              ws.send(data, false);
-            } catch {
-            }
-          },
-          close(code, reason) {
-            try {
-              ws.end(code, reason);
-            } catch {
-            }
-          }
-        };
-        userData.conn = conn;
-        wsHandler.handleOpen(conn, userData.databaseId).catch(() => {
-        });
-      },
-      message: (ws, message) => {
-        const userData = ws.getUserData();
-        if (!userData.conn) return;
-        const text = Buffer.from(message).toString("utf-8");
-        wsHandler.handleMessage(userData.conn, text);
-      },
-      close: (ws) => {
-        const userData = ws.getUserData();
-        if (!userData.conn) return;
-        wsHandler.handleClose(userData.conn);
-        userData.conn = void 0;
-      }
+    registerWebSocketRoute({
+      app: this.app,
+      wsHandler: this.wsHandler,
+      onRequestHook: this.onRequestHook,
+      maxBodyBytes: this.maxBodyBytes,
+      maxBackpressureBytes: this.maxWsBackpressureBytes
     });
   }
   withCors(handler) {
@@ -950,7 +1582,7 @@ var SirannonServer = class {
   wrapDbRoute(handler) {
     const onRequestHook = this.onRequestHook;
     const corsHeaders = this.cors;
-    const MAX_BODY = 1048576;
+    const maxBody = this.maxBodyBytes;
     return (res, req) => {
       const dbId = req.getParameter(0) ?? "";
       const method = req.getMethod();
@@ -959,10 +1591,10 @@ var SirannonServer = class {
         writeCorsOrigin(res, corsHeaders, req.getHeader("origin"));
       }
       const abort = initAbortHandler(res);
-      const bodyPromise = readBody(res, MAX_BODY, abort);
+      const bodyPromise = readBody(res, maxBody, abort);
       if (!onRequestHook) {
         bodyPromise.then(async (rawBody) => {
-          if (abort.aborted) return;
+          if (!abort.claim()) return;
           try {
             await handler(res, dbId, rawBody, abort);
           } catch {
@@ -986,9 +1618,9 @@ var SirannonServer = class {
         databaseId: dbId,
         remoteAddress
       };
-      const hookPromise = runOnRequest(res, ctx, onRequestHook);
+      const hookPromise = runOnRequest(res, abort, ctx, onRequestHook);
       Promise.all([bodyPromise, hookPromise]).then(async ([rawBody, allowed]) => {
-        if (abort.aborted || !allowed) return;
+        if (!allowed || !abort.claim()) return;
         try {
           await handler(res, dbId, rawBody, abort);
         } catch {
@@ -1025,10 +1657,10 @@ var SirannonServer = class {
         databaseId: dbId,
         remoteAddress: decodeRemoteAddress(res)
       };
-      runOnRequest(res, ctx, onRequestHook).then((allowed) => {
-        if (allowed) {
-          handler(res, dbId);
-        }
+      const abort = initAbortHandler(res);
+      runOnRequest(res, abort, ctx, onRequestHook).then((allowed) => {
+        if (!allowed || !abort.claim()) return;
+        handler(res, dbId);
       }).catch(() => {
       });
     };