@delali/sirannon-db 0.3.5 → 0.3.6-next.78

package/dist/backup/index.d.ts

@@ -1,8 +1,8 @@
-import { B as BackupDestination, g as BackupRunReport } from '../types-DTmi7pXp.js';
-export { h as BackupChain, i as BackupChainBase, j as BackupChainChange, k as BackupChainPosition, l as BackupChainRecord, m as BackupCycle, n as BackupCycleError, o as BackupCycleOptions, p as BackupCycleStatus, q as BackupFileReport, r as BackupGroupMembership, s as BackupGroupSource, t as BackupLogPosition, u as BackupNodePreference, v as BackupPiece, w as BackupProgress, x as BackupSkip, y as BackupSkipReason, z as BackupToDestinationOptions, C as BackupVerifyResult, E as DEFAULT_CHAIN_NAME, F as chainLogName, G as readBackupChains, H as verifyBackupRecord } from '../types-DTmi7pXp.js';
-export { B as BackupCapabilities, a as BackupChainLocation, b as BackupRestorePlan, c as BackupSafeToDeleteOptions, d as backupPiecesSafeToDelete, p as planBackupRestore } from '../database-backup-BwTNiBm2.js';
-import { B as BackupRestoreOptions, a as BackupRestoreReport } from '../restore-options-CcMukOLO.js';
-export { b as BackupRestoreProgress } from '../restore-options-CcMukOLO.js';
+import { B as BackupDestination, g as BackupRunReport } from '../types-BWyv_N18.js';
+export { h as BackupChain, i as BackupChainBase, j as BackupChainChange, k as BackupChainPosition, l as BackupChainRecord, m as BackupCycle, n as BackupCycleError, o as BackupCycleOptions, p as BackupCycleStatus, q as BackupFileReport, r as BackupGroupMembership, s as BackupGroupSource, t as BackupLogPosition, u as BackupNodePreference, v as BackupPiece, w as BackupProgress, x as BackupSkip, y as BackupSkipReason, z as BackupToDestinationOptions, C as BackupVerifyResult, F as DEFAULT_CHAIN_NAME, G as chainLogName, H as readBackupChains, I as verifyBackupRecord } from '../types-BWyv_N18.js';
+export { B as BackupCapabilities, a as BackupChainLocation, b as BackupRestorePlan, c as BackupSafeToDeleteOptions, d as backupPiecesSafeToDelete, p as planBackupRestore } from '../database-backup-BhM8yJ1A.js';
+import { B as BackupRestoreOptions, a as BackupRestoreReport } from '../restore-options-B6HV_5XT.js';
+export { b as BackupRestoreProgress } from '../restore-options-B6HV_5XT.js';
 import '../query-types-5B02ixH0.js';
 
 /** The byte and piece counts for one file that Sirannon assembles from a destination.

package/dist/backup/index.mjs

@@ -1,9 +1,11 @@
-export { assembleFromDestination, restoreBackup } from '../chunk-L6EX6K27.mjs';
-export { backupPiecesSafeToDelete, planBackupRestore } from '../chunk-YW7IKQ7T.mjs';
+export { assembleFromDestination, restoreBackup } from '../chunk-MO4APBYG.mjs';
+export { backupPiecesSafeToDelete, planBackupRestore } from '../chunk-W74HFQFD.mjs';
+import '../chunk-5DKWHT6K.mjs';
 export { verifyBackupRecord } from '../chunk-DX4WGJL7.mjs';
 import '../chunk-QGVRRKB2.mjs';
 import '../chunk-BUWJH3D3.mjs';
-export { DEFAULT_CHAIN_NAME, chainLogName, readBackupChains } from '../chunk-CZL4D3BM.mjs';
+export { DEFAULT_CHAIN_NAME, chainLogName, readBackupChains } from '../chunk-6CABU54O.mjs';
 import '../chunk-BGJ5JVYL.mjs';
 import '../chunk-HO2XTXVX.mjs';
+import '../chunk-5O4J6LQQ.mjs';
 import '../chunk-KINDFBQP.mjs';

package/dist/backup-scheduler/index.d.ts

@@ -1,5 +1,5 @@
-import { J as SQLiteConnection, K as BackupFileCopy, L as BackupRunRequest, g as BackupRunReport, O as BackupScheduleRequest } from '../types-DTmi7pXp.js';
-export { q as BackupFileReport, P as BackupScheduleOptions, R as RunExclusive } from '../types-DTmi7pXp.js';
+import { L as SQLiteConnection, O as BackupFileCopy, P as BackupRunRequest, g as BackupRunReport, Q as BackupScheduleRequest } from '../types-BWyv_N18.js';
+export { q as BackupFileReport, R as BackupScheduleOptions, U as RunExclusive } from '../types-BWyv_N18.js';
 import '../query-types-5B02ixH0.js';
 
 /** What a runtime supplies so that Sirannon can send a copy to a destination without writing a local file.

package/dist/backup-scheduler/index.mjs

@@ -1,5 +1,5 @@
-export { BackupScheduler } from '../chunk-BTUD6XQO.mjs';
-import '../chunk-W67A4H2E.mjs';
+export { BackupScheduler } from '../chunk-N3MHZV3B.mjs';
+import '../chunk-I4JY5QPA.mjs';
 import '../chunk-AHCMO4YL.mjs';
 import '../chunk-BUWJH3D3.mjs';
 import '../chunk-BGJ5JVYL.mjs';

package/dist/chunk-22TYGH7J.mjs

@@ -0,0 +1,55 @@
+// src/core/driver/statement-text.ts
+var SPACE = 32;
+var TAB = 9;
+var LINE_FEED = 10;
+var VERTICAL_TAB = 11;
+var FORM_FEED = 12;
+var CARRIAGE_RETURN = 13;
+var SEMICOLON = 59;
+var HYPHEN = 45;
+var SLASH = 47;
+var ASTERISK = 42;
+var NO_STATEMENT_MESSAGE = "The supplied SQL string contains no statements";
+function startsSqliteSpace(code) {
+  return code === SPACE || code === TAB || code === LINE_FEED || code === FORM_FEED || code === CARRIAGE_RETURN;
+}
+function continuesSqliteSpace(code) {
+  return startsSqliteSpace(code) || code === VERTICAL_TAB;
+}
+function holdsNoStatement(sql) {
+  const firstNul = sql.indexOf("\0");
+  const text = firstNul === -1 ? sql : sql.slice(0, firstNul);
+  let index = 0;
+  while (index < text.length) {
+    const code = text.charCodeAt(index);
+    if (startsSqliteSpace(code)) {
+      index++;
+      while (index < text.length && continuesSqliteSpace(text.charCodeAt(index))) index++;
+      continue;
+    }
+    if (code === SEMICOLON) {
+      index++;
+      continue;
+    }
+    const next = text.charCodeAt(index + 1);
+    if (code === HYPHEN && next === HYPHEN) {
+      const lineEnd = text.indexOf("\n", index + 2);
+      if (lineEnd === -1) return true;
+      index = lineEnd;
+      continue;
+    }
+    if (code === SLASH && next === ASTERISK && index + 2 < text.length) {
+      const commentEnd = text.indexOf("*/", index + 2);
+      if (commentEnd === -1) return true;
+      index = commentEnd + 2;
+      continue;
+    }
+    return false;
+  }
+  return true;
+}
+function assertHoldsStatement(sql) {
+  if (holdsNoStatement(sql)) throw new RangeError(NO_STATEMENT_MESSAGE);
+}
+
+export { assertHoldsStatement };

package/dist/{chunk-SB3MIFLG.mjs → chunk-2ZQOZFX7.mjs}

@@ -1,9 +1,9 @@
-import { selectOrdinaryTableName, deleteReplacedRowsOfTable, selectMinChangeSeqSql, selectMaxChangeSeq, deleteChangesBeforeUpToSeqSql, deleteAllReplacedRows, selectTableExists, ensureChangesTable, ensureReplacedRowsTable, ensureMetaTable, insertMetaValueIfAbsent, selectMetaValue, selectTriggerSql, selectChangesAfterSeqSql, selectTablesChangesInRangeSql, tableInfoRows, primaryKeyColumns, tableColumnsWithGenerated, tableIndexList, indexColumns, selectTableSql, TABLE_XINFO_HIDDEN, deleteExpiredDeviceCursors, selectMinDeviceCursorBoundary, SEQ_STRING_RE, selectIndexSql } from './chunk-RPWBYASV.mjs';
-import { CDC_TRIGGER_PREFIX, CHANGES_TABLE, isReservedIdentifier, META_TABLE, encodeTaggedValues, REPLACED_ROWS_TABLE, changedAtToEventTimestamp, decodeTaggedValues, DEVICE_CURSORS_TABLE, SAFE_INT_BOUND_TEXT } from './chunk-JFVEGN7J.mjs';
+import { selectOrdinaryTableName, deleteReplacedRowsOfTable, selectMinChangeSeqSql, selectMaxChangeSeq, deleteChangesBeforeUpToSeqSql, deleteAllReplacedRows, selectTableExists, ensureChangesTable, ensureReplacedRowsTable, ensureMetaTable, insertMetaValueIfAbsent, selectMetaValue, selectTriggerSql, selectChangesAfterSeqSql, selectTablesChangesInRangeSql, tableInfoRows, primaryKeyColumns, tableColumnsWithGenerated, tableIndexList, indexColumns, selectTableSql, TABLE_XINFO_HIDDEN, deleteExpiredDeviceCursors, selectMinDeviceCursorBoundary, SEQ_STRING_RE, selectIndexSql } from './chunk-MTOQ6QIS.mjs';
+import { CDC_TRIGGER_PREFIX, CHANGES_TABLE, isReservedIdentifier, META_TABLE, encodeTaggedValues, REPLACED_ROWS_TABLE, changedAtToEventTimestamp, decodeTaggedValues, DEVICE_CURSORS_TABLE, SAFE_INT_BOUND_TEXT } from './chunk-ZAUHAJ4G.mjs';
 import { tokenizeSql, isKeyword } from './chunk-SEL4A4WT.mjs';
-import { synchronousPragmaValue } from './chunk-YCMB6GR4.mjs';
 import { randomHex } from './chunk-BGJ5JVYL.mjs';
 import { invokeCallerCallback, reportCallerFailure, toError } from './chunk-HO2XTXVX.mjs';
+import { synchronousPragmaValue } from './chunk-YCMB6GR4.mjs';
 import { SirannonError, ForbiddenSqlError, CDCError, MigrationError } from './chunk-KINDFBQP.mjs';
 
 // src/core/bulk-load.ts
@@ -666,6 +666,28 @@ function buildJsonObject(columns, ref) {
 function escStr(name) {
   return name.replace(/'/g, "''");
 }
+async function installKeyChangeCaptureTriggers(conn, triggers, table, log, keys) {
+  const logOf = (row) => `INSERT INTO "${escId(log)}" VALUES (${keys.map((key) => `${row}.${key}`).join(", ")});`;
+  const on = `main."${escId(table)}"`;
+  await conn.exec(`CREATE TEMP TRIGGER "${escId(triggers.insert)}" AFTER INSERT ON ${on} BEGIN ${logOf("NEW")} END`);
+  await conn.exec(
+    `CREATE TEMP TRIGGER "${escId(triggers.update)}" AFTER UPDATE ON ${on} BEGIN ${logOf("OLD")} ${logOf("NEW")} END`
+  );
+  await conn.exec(`CREATE TEMP TRIGGER "${escId(triggers.delete)}" AFTER DELETE ON ${on} BEGIN ${logOf("OLD")} END`);
+}
+async function dropKeyChangeCaptureTriggers(conn, triggers) {
+  for (const name of [triggers.insert, triggers.update, triggers.delete]) {
+    await conn.exec(`DROP TRIGGER IF EXISTS temp."${escId(name)}"`);
+  }
+}
+async function dropMainSchemaTriggers(conn) {
+  const triggers = await (await conn.prepare("SELECT name, sql FROM main.sqlite_schema WHERE type = 'trigger' AND sql IS NOT NULL")).all();
+  for (const trigger of triggers) await conn.exec(`DROP TRIGGER main."${escId(trigger.name)}"`);
+  return triggers.map((trigger) => trigger.sql);
+}
+async function createMainSchemaTriggers(conn, statements) {
+  for (const statement of statements) await conn.exec(statement);
+}
 
 // src/core/cdc/change-tracker.ts
 var DEFAULT_RETENTION_MS = 36e5;
@@ -1155,7 +1177,7 @@ var SubscriptionBuilderImpl = class {
     return this.manager.subscribe(this.table, this.conditions, callback, options);
   }
 };
-function startPolling(conn, tracker, manager, intervalMs, onError, runExclusive, deviceRetention = {
+function startPolling(connection, tracker, manager, intervalMs, onError, runExclusive, deviceRetention = {
   cursorRetentionMs: DEFAULT_DEVICE_CURSOR_RETENTION_MS,
   maxChangesHeldForDevice: 0
 }) {
@@ -1170,7 +1192,7 @@ function startPolling(conn, tracker, manager, intervalMs, onError, runExclusive,
     if (polling) return;
     polling = true;
     try {
-      const events = await exclusive(() => tracker.poll(conn));
+      const events = await exclusive(() => tracker.poll(connection()));
       if (events.length > 0) {
         manager.dispatch(events);
       }
@@ -1180,6 +1202,7 @@ function startPolling(conn, tracker, manager, intervalMs, onError, runExclusive,
       if (tickCount >= CLEANUP_INTERVAL_TICKS) {
         tickCount = 0;
         await exclusive(async () => {
+          const conn = connection();
           await applyDeviceCursorBoundary(conn, tracker, deviceRetention);
           await tracker.cleanup(conn);
         });
@@ -1371,4 +1394,4 @@ var TransactionGrouper = class {
   }
 };
 
-export { ChangeTracker, DEVICE_SYNC_PUSHED_SEQ_META_KEY, PrimedSubscription, ROWID_ALIASES, SubscriptionBuilderImpl, SubscriptionManager, TransactionGrouper, applyDeviceCursorBoundary, dropCdcTriggers, ensureCdcEpoch, filteredChange, isBulkLoadDurability, migrationChecksum, migrationContentChecksum, needsResync, parseColumnDefinitions, reconcileMigrationChecksums, resolveDeviceRetentionPolicy, runBulkLoad, startPolling };
+export { ChangeTracker, DEVICE_SYNC_PUSHED_SEQ_META_KEY, PrimedSubscription, ROWID_ALIASES, SubscriptionBuilderImpl, SubscriptionManager, TransactionGrouper, applyDeviceCursorBoundary, createMainSchemaTriggers, dropCdcTriggers, dropKeyChangeCaptureTriggers, dropMainSchemaTriggers, ensureCdcEpoch, escId, filteredChange, installKeyChangeCaptureTriggers, isBulkLoadDurability, migrationChecksum, migrationContentChecksum, needsResync, parseColumnDefinitions, reconcileMigrationChecksums, resolveDeviceRetentionPolicy, runBulkLoad, startPolling };

package/dist/{chunk-UIDQGPJY.mjs → chunk-4O7WYZHN.mjs}

@@ -883,7 +883,7 @@ var AckPayload = {
   }
 };
 function createBaseHello() {
-  return { nodeId: "", role: "", groupId: "", primaryTerm: 0n, protocolVersion: "" };
+  return { nodeId: "", role: "", groupId: "", primaryTerm: 0n, protocolVersion: "", encrypted: false };
 }
 var Hello = {
   encode(message, writer = new BinaryWriter()) {
@@ -905,6 +905,9 @@ var Hello = {
     if (message.protocolVersion !== "") {
       writer.uint32(42).string(message.protocolVersion);
     }
+    if (message.encrypted !== false) {
+      writer.uint32(48).bool(message.encrypted);
+    }
     return writer;
   },
   decode(input, length) {
@@ -949,6 +952,13 @@ var Hello = {
           message.protocolVersion = reader.string();
           continue;
         }
+        case 6: {
+          if (tag !== 48) {
+            break;
+          }
+          message.encrypted = reader.bool();
+          continue;
+        }
       }
       if ((tag & 7) === 4 || tag === 0) {
         break;
@@ -963,7 +973,8 @@ var Hello = {
       role: isSet(object.role) ? globalThis.String(object.role) : "",
       groupId: isSet(object.groupId) ? globalThis.String(object.groupId) : isSet(object.group_id) ? globalThis.String(object.group_id) : "",
       primaryTerm: isSet(object.primaryTerm) ? BigInt(object.primaryTerm) : isSet(object.primary_term) ? BigInt(object.primary_term) : 0n,
-      protocolVersion: isSet(object.protocolVersion) ? globalThis.String(object.protocolVersion) : isSet(object.protocol_version) ? globalThis.String(object.protocol_version) : ""
+      protocolVersion: isSet(object.protocolVersion) ? globalThis.String(object.protocolVersion) : isSet(object.protocol_version) ? globalThis.String(object.protocol_version) : "",
+      encrypted: isSet(object.encrypted) ? globalThis.Boolean(object.encrypted) : false
     };
   },
   toJSON(message) {
@@ -983,6 +994,9 @@ var Hello = {
     if (message.protocolVersion !== "") {
       obj.protocolVersion = message.protocolVersion;
     }
+    if (message.encrypted !== false) {
+      obj.encrypted = message.encrypted;
+    }
     return obj;
   },
   create(base) {
@@ -995,6 +1009,7 @@ var Hello = {
     message.groupId = object.groupId ?? "";
     message.primaryTerm = object.primaryTerm ?? 0n;
     message.protocolVersion = object.protocolVersion ?? "";
+    message.encrypted = object.encrypted ?? false;
     return message;
   }
 };
@@ -2639,4 +2654,24 @@ function buildChannelCreds(options) {
   return credentials.createSsl(ca, key, cert);
 }
 
-export { ReplicationClient, ReplicationService, buildChannelCreds, buildServerCreds };
+// src/transport/grpc/hello.ts
+function localHello(t) {
+  return {
+    nodeId: t.localNodeId,
+    role: t.localRole,
+    groupId: t.localGroupId ?? "",
+    primaryTerm: t.localPrimaryTerm ?? 0n,
+    protocolVersion: t.localProtocolVersion ?? "",
+    encrypted: t.localEncrypted
+  };
+}
+function peerHelloFields(hello) {
+  return {
+    groupId: hello.groupId || void 0,
+    primaryTerm: hello.primaryTerm === 0n ? void 0 : hello.primaryTerm,
+    protocolVersion: hello.protocolVersion || void 0,
+    encrypted: hello.encrypted === true
+  };
+}
+
+export { ReplicationClient, ReplicationService, buildChannelCreds, buildServerCreds, localHello, peerHelloFields };

package/dist/{chunk-ZFFUVYYE.mjs → chunk-5DKWHT6K.mjs}

@@ -94,6 +94,54 @@ function getDotPath(issue) {
   return null;
 }
 // @__NO_SIDE_EFFECTS__
+function check(requirement, message$1) {
+  return {
+    kind: "validation",
+    type: "check",
+    reference: check,
+    async: false,
+    expects: null,
+    requirement,
+    message: message$1,
+    "~run"(dataset, config$1) {
+      if (dataset.typed && !this.requirement(dataset.value)) _addIssue(this, "input", dataset, config$1);
+      return dataset;
+    }
+  };
+}
+// @__NO_SIDE_EFFECTS__
+function maxLength(requirement, message$1) {
+  return {
+    kind: "validation",
+    type: "max_length",
+    reference: maxLength,
+    async: false,
+    expects: `<=${requirement}`,
+    requirement,
+    message: message$1,
+    "~run"(dataset, config$1) {
+      if (dataset.typed && dataset.value.length > this.requirement) _addIssue(this, "length", dataset, config$1, { received: `${dataset.value.length}` });
+      return dataset;
+    }
+  };
+}
+// @__NO_SIDE_EFFECTS__
+function minLength(requirement, message$1) {
+  return {
+    kind: "validation",
+    type: "min_length",
+    reference: minLength,
+    async: false,
+    expects: `>=${requirement}`,
+    requirement,
+    message: message$1,
+    "~run"(dataset, config$1) {
+      if (dataset.typed && dataset.value.length < this.requirement) _addIssue(this, "length", dataset, config$1, { received: `${dataset.value.length}` });
+      return dataset;
+    }
+  };
+}
+// @__NO_SIDE_EFFECTS__
 function regex(requirement, message$1) {
   return {
     kind: "validation",
@@ -163,6 +211,23 @@ function array(item, message$1) {
   });
 }
 // @__NO_SIDE_EFFECTS__
+function instance(class_, message$1) {
+  return _standardSchema({
+    kind: "schema",
+    type: "instance",
+    reference: instance,
+    expects: class_.name,
+    async: false,
+    class: class_,
+    message: message$1,
+    "~run"(dataset, config$1) {
+      if (dataset.value instanceof this.class) dataset.typed = true;
+      else _addIssue(this, "type", dataset, config$1);
+      return dataset;
+    }
+  });
+}
+// @__NO_SIDE_EFFECTS__
 function nullable(wrapped, default_) {
   return _standardSchema({
     kind: "schema",
@@ -383,6 +448,49 @@ function string(message$1) {
   });
 }
 // @__NO_SIDE_EFFECTS__
+function _subIssues(datasets) {
+  let issues;
+  if (datasets) for (const dataset of datasets) if (issues) for (const issue of dataset.issues) issues.push(issue);
+  else issues = dataset.issues;
+  return issues;
+}
+// @__NO_SIDE_EFFECTS__
+function union(options, message$1) {
+  return _standardSchema({
+    kind: "schema",
+    type: "union",
+    reference: union,
+    expects: /* @__PURE__ */ _joinExpects(options.map((option) => option.expects), "|"),
+    async: false,
+    options,
+    message: message$1,
+    "~run"(dataset, config$1) {
+      let validDataset;
+      let typedDatasets;
+      let untypedDatasets;
+      for (const schema of this.options) {
+        const optionDataset = schema["~run"]({ value: dataset.value }, config$1);
+        if (optionDataset.typed) if (optionDataset.issues) if (typedDatasets) typedDatasets.push(optionDataset);
+        else typedDatasets = [optionDataset];
+        else {
+          validDataset = optionDataset;
+          break;
+        }
+        else if (untypedDatasets) untypedDatasets.push(optionDataset);
+        else untypedDatasets = [optionDataset];
+      }
+      if (validDataset) return validDataset;
+      if (typedDatasets) {
+        if (typedDatasets.length === 1) return typedDatasets[0];
+        _addIssue(this, "type", dataset, config$1, { issues: /* @__PURE__ */ _subIssues(typedDatasets) });
+        dataset.typed = true;
+      } else if (untypedDatasets?.length === 1) return untypedDatasets[0];
+      else _addIssue(this, "type", dataset, config$1, { issues: /* @__PURE__ */ _subIssues(untypedDatasets) });
+      return dataset;
+    }
+  });
+}
+// @__NO_SIDE_EFFECTS__
 function unknown() {
   return _standardSchema({
     kind: "schema",
@@ -436,4 +544,4 @@ function summarize(issues) {
   return summary;
 }
 
-export { array, getDotPath, nullable, number, object, optional, picklist, pipe, record, regex, safeParse, string, summarize, unknown };
+export { array, check, getDotPath, instance, maxLength, minLength, nullable, number, object, optional, picklist, pipe, record, regex, safeParse, string, summarize, union, unknown };

package/dist/chunk-5O4J6LQQ.mjs

@@ -0,0 +1,35 @@
+import { SirannonError } from './chunk-KINDFBQP.mjs';
+
+// src/core/encryption/errors.ts
+var EncryptionError = class extends SirannonError {
+  /**
+   * Returns an error with an encryption code, and the failure that caused it when there is one.
+   *
+   * @param message - What failed, written without the key.
+   * @param code - The machine-readable code.
+   * @param cause - The failure that caused this error, such as the error that a key function threw.
+   */
+  constructor(message, code, cause) {
+    super(message, code);
+    this.name = "EncryptionError";
+    if (cause !== void 0) {
+      Object.defineProperty(this, "cause", { value: cause, enumerable: false, writable: true, configurable: true });
+    }
+  }
+};
+function keyRejected(path, cause) {
+  return new EncryptionError(
+    `The key failed the authentication check of the first page of the database ${path}. Either the key is wrong, or the file comes from another encryption scheme: the better-sqlite3 driver encrypts with AEGIS-256 and the Expo driver encrypts with SQLCipher 4, and neither opens the other's files`,
+    "ENCRYPTION_KEY_REJECTED",
+    cause
+  );
+}
+function refuseEncryptedOpen(driverName, options) {
+  if (options?.encryption === void 0) return;
+  throw new EncryptionError(
+    `The ${driverName} driver opens SQLite through a library that Sirannon cannot replace with an encrypting build, so it cannot open an encrypted database`,
+    "ENCRYPTION_UNSUPPORTED"
+  );
+}
+
+export { EncryptionError, keyRejected, refuseEncryptedOpen };

package/dist/{chunk-CZL4D3BM.mjs → chunk-6CABU54O.mjs}

@@ -20,11 +20,11 @@ function isBackupChainHead(value) {
 }
 function isBackupChainBase(value) {
   const base = value;
-  return base?.kind === "full" && typeof base.chainId === "string" && typeof base.name === "string" && typeof base.runId === "string" && isWholeNumber(base.finishedAt) && isWholeNumber(base.pieceCount) && isAtLeastOne(base.pieceBytes) && isWholeNumber(base.bytesWritten) && isTextOrAbsent(base.fingerprint);
+  return base?.kind === "full" && typeof base.chainId === "string" && typeof base.name === "string" && typeof base.runId === "string" && isWholeNumber(base.finishedAt) && isWholeNumber(base.pieceCount) && isAtLeastOne(base.pieceBytes) && isWholeNumber(base.bytesWritten) && isTextOrAbsent(base.fingerprint) && isTextOrAbsent(base.keyId);
 }
 function isBackupChainChange(value) {
   const change = value;
-  return change?.kind === "change" && typeof change.chainId === "string" && typeof change.name === "string" && typeof change.runId === "string" && isAtLeastOne(change.sequence) && isBackupChainPosition(change.position) && isWholeNumber(change.capturedAt) && isAtLeastOne(change.frameCount) && isWholeNumber(change.pieceCount) && isAtLeastOne(change.pieceBytes) && isWholeNumber(change.bytesWritten) && typeof change.checkpointed === "boolean" && isTextOrAbsent(change.fingerprint);
+  return change?.kind === "change" && typeof change.chainId === "string" && typeof change.name === "string" && typeof change.runId === "string" && isAtLeastOne(change.sequence) && isBackupChainPosition(change.position) && isWholeNumber(change.capturedAt) && isAtLeastOne(change.frameCount) && isWholeNumber(change.pieceCount) && isAtLeastOne(change.pieceBytes) && isWholeNumber(change.bytesWritten) && typeof change.checkpointed === "boolean" && isTextOrAbsent(change.fingerprint) && isTextOrAbsent(change.keyId);
 }
 
 // src/core/backup/chain.ts

package/dist/{chunk-JAQ2I4OT.mjs → chunk-A5ULJVK7.mjs}

@@ -1,6 +1,13 @@
 import { SirannonError } from './chunk-KINDFBQP.mjs';
 
 // src/core/driver/define.ts
+function boundFileSystem(files) {
+  return Object.freeze({
+    readStart: files.readStart.bind(files),
+    remove: files.remove.bind(files),
+    rename: files.rename.bind(files)
+  });
+}
 function defineDriver(config) {
   if (!config.capabilities || typeof config.open !== "function") {
     throw new SirannonError("Driver must define capabilities and open()", "INVALID_DRIVER");
@@ -9,22 +16,15 @@ function defineDriver(config) {
     throw new SirannonError("Driver worker entry must define a string specifier", "INVALID_DRIVER");
   }
   return Object.freeze({
-    capabilities: Object.freeze({ ...config.capabilities }),
+    capabilities: Object.freeze({ ...config.capabilities, encryption: config.capabilities.encryption === true }),
     open: config.open.bind(config),
     ...config.worker ? { worker: Object.freeze({ ...config.worker }) } : {},
     ...config.startWriterHost ? { startWriterHost: config.startWriterHost.bind(config) } : {},
     ...config.createWriterContext ? { createWriterContext: config.createWriterContext.bind(config) } : {},
     ...config.createBackupEngine ? { createBackupEngine: config.createBackupEngine.bind(config) } : {},
-    ...config.resolveExtensionPath ? { resolveExtensionPath: config.resolveExtensionPath.bind(config) } : {}
+    ...config.resolveExtensionPath ? { resolveExtensionPath: config.resolveExtensionPath.bind(config) } : {},
+    ...config.files ? { files: boundFileSystem(config.files) } : {}
   });
 }
 
-// src/core/backup/cycle-options.ts
-var DEFAULT_CAPTURE_INTERVAL_MS = 6e4;
-var DEFAULT_FULL_COPY_INTERVAL_MS = 24 * 60 * 60 * 1e3;
-var DEFAULT_BACKUP_NAME_PREFIX = "sirannon-backup";
-function defaultStagingDir(sourcePath) {
-  return `${sourcePath}-backup`;
-}
-
-export { DEFAULT_BACKUP_NAME_PREFIX, DEFAULT_CAPTURE_INTERVAL_MS, DEFAULT_FULL_COPY_INTERVAL_MS, defaultStagingDir, defineDriver };
+export { defineDriver };

package/dist/{chunk-RLBKZZ24.mjs → chunk-AC7TKWNH.mjs}

@@ -19,6 +19,7 @@ function registerPeer(connectedPeers, peerConnectedHandler, nodeId, role, metada
     role,
     primaryTerm: metadata.primaryTerm,
     protocolVersion: metadata.protocolVersion,
+    encrypted: metadata.encrypted === true,
     joinedAt: Date.now(),
     lastSeenAt: Date.now(),
     lastAckedSeq: 0n

package/dist/chunk-BKO4SCEC.mjs

@@ -0,0 +1,99 @@
+import { withRowCounts, rowCountsOf } from './chunk-E2GRX4ZD.mjs';
+import { EncryptionError } from './chunk-5O4J6LQQ.mjs';
+import { SirannonError } from './chunk-KINDFBQP.mjs';
+
+// src/core/encryption/page-errors.ts
+var PAGE_AUTHENTICATION_FAILURE_CODE = /^SQLITE_(CORRUPT|NOTADB)/;
+var PAGE_AUTHENTICATION_FAILURE_MESSAGE = /database disk image is malformed|file is not a database/i;
+var PAGE_CORRUPT_MESSAGE = "A page of the encrypted database failed its authentication check, so Sirannon returned no rows from it. The file was changed or damaged outside SQLite; restore it from a backup";
+function failsPageAuthentication(err) {
+  if (err instanceof SirannonError || typeof err !== "object" || err === null) return false;
+  const { code, message } = err;
+  if (typeof code === "string" && PAGE_AUTHENTICATION_FAILURE_CODE.test(code)) return true;
+  return typeof message === "string" && PAGE_AUTHENTICATION_FAILURE_MESSAGE.test(message);
+}
+function asPageError(err) {
+  if (!failsPageAuthentication(err)) return err;
+  return withRowCounts(new EncryptionError(PAGE_CORRUPT_MESSAGE, "ENCRYPTED_PAGE_CORRUPT", err), rowCountsOf(err));
+}
+async function guarded(call) {
+  try {
+    return await call();
+  } catch (err) {
+    throw asPageError(err);
+  }
+}
+function guardedStatement(statement) {
+  const { allRaw, allCounted, getCounted, allRawCounted } = statement;
+  const result = {
+    all: (...params) => guarded(() => statement.all(...params)),
+    get: (...params) => guarded(() => statement.get(...params)),
+    run: (...params) => guarded(() => statement.run(...params))
+  };
+  if (allRaw)
+    result.allRaw = (...params) => guarded(() => allRaw.call(statement, ...params));
+  if (allCounted) {
+    result.allCounted = (...params) => guarded(() => allCounted.call(statement, ...params));
+  }
+  if (getCounted) {
+    result.getCounted = (...params) => guarded(() => getCounted.call(statement, ...params));
+  }
+  if (allRawCounted) {
+    result.allRawCounted = (...params) => guarded(() => allRawCounted.call(statement, ...params));
+  }
+  return result;
+}
+function guardedOutcomes(outcomes) {
+  return outcomes.map((outcome) => {
+    if (outcome.ok || !failsPageAuthentication(outcome.error)) return outcome;
+    return {
+      ...outcome,
+      error: {
+        ...outcome.error,
+        message: PAGE_CORRUPT_MESSAGE,
+        name: "EncryptionError",
+        code: "ENCRYPTED_PAGE_CORRUPT"
+      }
+    };
+  });
+}
+function reportEncryptedPageFailures(connection) {
+  const guardedConnection = {
+    exec: (sql) => guarded(() => connection.exec(sql)),
+    prepare: async (sql) => guardedStatement(await guarded(() => connection.prepare(sql))),
+    transaction: (fn) => guarded(() => connection.transaction(() => fn(guardedConnection))),
+    close: () => connection.close(),
+    ...connection.copyRunsOffCallerThread === void 0 ? {} : { copyRunsOffCallerThread: connection.copyRunsOffCallerThread }
+  };
+  const {
+    loadExtension,
+    copyDatabase,
+    runBatch,
+    runBatchSummary,
+    runGroup,
+    startChangeCapture,
+    takeCapturedChanges,
+    stopChangeCapture,
+    applyCapturedChanges
+  } = connection;
+  if (loadExtension) guardedConnection.loadExtension = (path) => loadExtension.call(connection, path);
+  if (copyDatabase) guardedConnection.copyDatabase = (request) => guarded(() => copyDatabase.call(connection, request));
+  if (runBatch) guardedConnection.runBatch = (sql, batch) => guarded(() => runBatch.call(connection, sql, batch));
+  if (runBatchSummary) {
+    guardedConnection.runBatchSummary = (sql, batch) => guarded(() => runBatchSummary.call(connection, sql, batch));
+  }
+  if (runGroup) {
+    guardedConnection.runGroup = async (units, opening) => guardedOutcomes(await guarded(() => runGroup.call(connection, units, opening)));
+  }
+  if (startChangeCapture) guardedConnection.startChangeCapture = () => startChangeCapture.call(connection);
+  if (takeCapturedChanges) {
+    guardedConnection.takeCapturedChanges = () => guarded(() => takeCapturedChanges.call(connection));
+  }
+  if (stopChangeCapture) guardedConnection.stopChangeCapture = () => stopChangeCapture.call(connection);
+  if (applyCapturedChanges) {
+    guardedConnection.applyCapturedChanges = (changes) => guarded(() => applyCapturedChanges.call(connection, changes));
+  }
+  return guardedConnection;
+}
+
+export { reportEncryptedPageFailures };

package/dist/{chunk-KOTBP4AW.mjs → chunk-C7E4H6UN.mjs}

@@ -5,7 +5,13 @@ var stateByTransport = /* @__PURE__ */ new WeakMap();
 function stateFor(transport) {
   const existing = stateByTransport.get(transport);
   if (existing) return existing;
-  const created = { timers: /* @__PURE__ */ new Map(), delays: /* @__PURE__ */ new Map(), dialled: /* @__PURE__ */ new Map(), wanted: null };
+  const created = {
+    timers: /* @__PURE__ */ new Map(),
+    delays: /* @__PURE__ */ new Map(),
+    refusalDelays: /* @__PURE__ */ new Map(),
+    dialled: /* @__PURE__ */ new Map(),
+    wanted: null
+  };
   stateByTransport.set(transport, created);
   return created;
 }
@@ -21,6 +27,7 @@ function replaceWantedEndpoints(transport, endpoints) {
     clearTimeout(timer);
     state.timers.delete(endpoint);
     state.delays.delete(endpoint);
+    state.refusalDelays.delete(endpoint);
   }
   const aborts = [];
   for (const [endpoint, abort] of state.dialled) {
@@ -48,12 +55,24 @@ function releaseEndpoint(transport, endpoint) {
 function noteEndpointReachable(transport, endpoint) {
   stateFor(transport).delays.delete(endpoint);
 }
+function noteEndpointRefused(transport, endpoint) {
+  const state = stateFor(transport);
+  const previous = state.refusalDelays.get(endpoint);
+  state.refusalDelays.set(
+    endpoint,
+    previous === void 0 ? RECONNECT_MIN_DELAY_MS * 2 : Math.min(previous * 2, RECONNECT_MAX_DELAY_MS)
+  );
+}
+function noteEndpointServing(transport, endpoint) {
+  stateFor(transport).refusalDelays.delete(endpoint);
+}
 function scheduleEndpointRedial(transport, endpoint, redial) {
   if (!transport.connected) return;
   const state = stateFor(transport);
   if (state.timers.has(endpoint) || !isWanted(state, endpoint)) return;
-  const delayMs = state.delays.get(endpoint) ?? RECONNECT_MIN_DELAY_MS;
-  state.delays.set(endpoint, Math.min(delayMs * 2, RECONNECT_MAX_DELAY_MS));
+  const backoffMs = state.delays.get(endpoint) ?? RECONNECT_MIN_DELAY_MS;
+  state.delays.set(endpoint, Math.min(backoffMs * 2, RECONNECT_MAX_DELAY_MS));
+  const delayMs = Math.max(backoffMs, state.refusalDelays.get(endpoint) ?? 0);
   const timer = setTimeout(() => {
     state.timers.delete(endpoint);
     if (!transport.connected || !isWanted(state, endpoint)) return;
@@ -69,6 +88,7 @@ function stopEndpointDialling(transport) {
   }
   state.timers.clear();
   state.delays.clear();
+  state.refusalDelays.clear();
   state.wanted = null;
   const aborts = [...state.dialled.values()];
   state.dialled.clear();
@@ -77,4 +97,4 @@ function stopEndpointDialling(transport) {
   }
 }
 
-export { claimEndpoint, noteEndpointReachable, registerEndpointAbort, releaseEndpoint, replaceWantedEndpoints, scheduleEndpointRedial, stopEndpointDialling };
+export { claimEndpoint, noteEndpointReachable, noteEndpointRefused, noteEndpointServing, registerEndpointAbort, releaseEndpoint, replaceWantedEndpoints, scheduleEndpointRedial, stopEndpointDialling };