@delali/sirannon-db 0.3.6-next.77 → 0.3.6-next.78

package/dist/{chunk-G4AG3ESO.mjs → chunk-FBA7P4ZA.mjs}

@@ -1,34 +1,24 @@
 import { verifyBackupRecord } from './chunk-DX4WGJL7.mjs';
-import { BackupManager, BackupScheduler, DEFAULT_PIECE_BYTES, sendFileInPieces } from './chunk-BTUD6XQO.mjs';
-import { DEFAULT_BACKUP_NAME_PREFIX, defaultStagingDir, DEFAULT_CAPTURE_INTERVAL_MS, DEFAULT_FULL_COPY_INTERVAL_MS } from './chunk-JAQ2I4OT.mjs';
+import { BackupManager, BackupScheduler, sendFileInPieces } from './chunk-N3MHZV3B.mjs';
+import { DEFAULT_BACKUP_NAME_PREFIX, defaultStagingDir, DEFAULT_CAPTURE_INTERVAL_MS, DEFAULT_FULL_COPY_INTERVAL_MS } from './chunk-Y4SP7CRF.mjs';
+import { DEFAULT_PIECE_BYTES } from './chunk-I4JY5QPA.mjs';
 import { withLateGroupOutcomes, withLateRowCounts } from './chunk-K43WJORM.mjs';
-import { leftTransactionUnbegun, canCarryBegin, toWorkerGroupStatement, WORKER_CANCELLED_CODE, WORKER_COPY_STOPPED_CODE, deserializeError } from './chunk-75IBRE73.mjs';
+import { leftTransactionUnbegun, canCarryBegin, WORKER_CANCELLED_CODE, WORKER_COPY_STOPPED_CODE, deserializeError, toWorkerGroupStatement } from './chunk-75IBRE73.mjs';
 import { rowCountsOf, totalRowCounts } from './chunk-E2GRX4ZD.mjs';
-import { readCycleState, writeCycleState, removeCycleState, stagedCapturePath, captureAndCheckpointTurn } from './chunk-UHUDPQFI.mjs';
+import { readCycleState, writeCycleState, removeCycleState, stagedCapturePath, captureAndCheckpointTurn } from './chunk-OJXV4L3N.mjs';
 import { checkpointLog } from './chunk-QGVRRKB2.mjs';
 import { logPathFor } from './chunk-AHCMO4YL.mjs';
 import { reportQuietly } from './chunk-BUWJH3D3.mjs';
-import { DEFAULT_CHAIN_NAME, readBackupChains, appendChainRecord, appendChainHead, readChainHeadAt, readChainHeads } from './chunk-CZL4D3BM.mjs';
+import { DEFAULT_CHAIN_NAME, readBackupChains, appendChainRecord, appendChainHead, readChainHeadAt, readChainHeads } from './chunk-6CABU54O.mjs';
 import { destinationWithDeadline, DEFAULT_DESTINATION_TIMEOUT_MS, randomHex } from './chunk-BGJ5JVYL.mjs';
-import { SirannonError, ExtensionError } from './chunk-KINDFBQP.mjs';
+import { SirannonError } from './chunk-KINDFBQP.mjs';
 import { Worker } from 'worker_threads';
 import { existsSync } from 'fs';
 import { resolve, dirname, join, sep } from 'path';
 import { fileURLToPath, pathToFileURL } from 'url';
-import { AsyncLocalStorage } from 'async_hooks';
 import { mkdir, rm, stat } from 'fs/promises';
 import { createRequire } from 'module';
 
-// src/core/driver/extension.ts
-async function loadThroughRuntime(extensionPath, load) {
-  try {
-    load();
-  } catch (err) {
-    if (err instanceof SirannonError) throw err;
-    throw new ExtensionError(extensionPath, err instanceof Error ? err.message : String(err));
-  }
-}
-
 // src/core/driver/statement-cache.ts
 var STATEMENT_CACHE_CAPACITY = 128;
 function createStatementCache(prepare) {
@@ -50,63 +40,50 @@ function createStatementCache(prepare) {
   };
 }
 
-// src/core/driver/values.ts
-var SAFE_INT_BOUND = 9007199254740991n;
-function narrowSafeBigInt(value) {
-  if (typeof value === "bigint" && value >= -SAFE_INT_BOUND && value <= SAFE_INT_BOUND) {
-    return Number(value);
-  }
-  return value;
-}
-function narrowRowIntegers(row) {
-  if (row === null || typeof row !== "object") return row;
-  const obj = row;
-  for (const key of Object.keys(obj)) {
-    const value = obj[key];
-    if (typeof value === "bigint" && value >= -SAFE_INT_BOUND && value <= SAFE_INT_BOUND) {
-      obj[key] = Number(value);
-    }
-  }
-  return row;
-}
-function narrowRowsIntegers(rows) {
-  for (const row of rows) {
-    narrowRowIntegers(row);
-  }
-  return rows;
-}
-var EMPTY_BLOB_WITH_ALLOCATED_STORAGE = new Uint8Array(new ArrayBuffer(1), 0, 0);
-function bindableValue(value) {
-  if (typeof value === "boolean") return value ? 1n : 0n;
-  if (ArrayBuffer.isView(value) && value.byteLength === 0) return EMPTY_BLOB_WITH_ALLOCATED_STORAGE;
-  return value;
-}
-function isNamedParams(value) {
-  if (value === null || typeof value !== "object") return false;
-  const prototype = Object.getPrototypeOf(value);
-  return prototype === Object.prototype || prototype === null;
-}
-function bindableNamedParams(params) {
-  let bound;
-  for (const key of Object.keys(params)) {
-    const value = params[key];
-    const replacement = bindableValue(value);
-    if (replacement === value) continue;
-    bound ??= { ...params };
-    bound[key] = replacement;
-  }
-  return bound ?? params;
+// src/core/worker/host-connection.ts
+function countedCalls(request, sql) {
+  return {
+    allCounted: (...params) => request({ kind: "allCounted", sql, params }),
+    getCounted: (...params) => request({ kind: "getCounted", sql, params }),
+    allRawCounted: (...params) => request({ kind: "allRawCounted", sql, params })
+  };
 }
-function bindableParams(params) {
-  let bound;
-  for (let index = 0; index < params.length; index++) {
-    const value = params[index];
-    const replacement = isNamedParams(value) ? bindableNamedParams(value) : bindableValue(value);
-    if (replacement === value) continue;
-    bound ??= [...params];
-    bound[index] = replacement;
-  }
-  return bound ?? params;
+function workerHostConnection(request, countsRows, ownCalls) {
+  return {
+    exec: (sql) => request({ kind: "exec", sql }),
+    prepare: async (sql) => ({
+      all: (...params) => request({ kind: "all", sql, params }),
+      get: (...params) => request({ kind: "get", sql, params }),
+      run: (...params) => request({ kind: "run", sql, params }),
+      allRaw: (...params) => request({ kind: "allRaw", sql, params }),
+      ...countsRows ? countedCalls(request, sql) : {}
+    }),
+    runBatch: (sql, paramsBatch) => request({ kind: "runBatch", sql, paramsBatch }),
+    runBatchSummary: (sql, paramsBatch) => request({ kind: "runBatchSummary", sql, paramsBatch }),
+    runGroup: (units, opening) => request({
+      kind: "runGroup",
+      units: units.map((unit) => ({ statements: unit.statements.map(toWorkerGroupStatement) })),
+      ...opening === void 0 ? {} : { opening: toWorkerGroupStatement(opening) }
+    }),
+    copyRunsOffCallerThread: true,
+    copyDatabase: (copyRequest) => request(
+      {
+        kind: "copyDatabase",
+        destPath: copyRequest.destPath,
+        pagesPerStep: copyRequest.pagesPerStep,
+        ...copyRequest.stallTimeoutMs === void 0 ? {} : { stallTimeoutMs: copyRequest.stallTimeoutMs }
+      },
+      copyRequest.onStep
+    ),
+    startChangeCapture: async () => {
+      await request({ kind: "startChangeCapture" });
+    },
+    takeCapturedChanges: () => request({ kind: "takeCapturedChanges" }),
+    stopChangeCapture: async () => {
+      await request({ kind: "stopChangeCapture" });
+    },
+    ...ownCalls
+  };
 }
 
 // src/core/worker/late-replies.ts
@@ -233,11 +210,12 @@ var DEFAULT_WRITE_TIMEOUT_MS = 3e4;
 var DEFAULT_MAX_RESTARTS = 5;
 var CLOSE_GRACE_MS = 1e3;
 var WriterWorker = class _WriterWorker {
-  constructor(openRequest, timeoutMs, maxRestarts, countsRows) {
+  constructor(openRequest, timeoutMs, maxRestarts, countsRows, encryptionKey) {
     this.openRequest = openRequest;
     this.timeoutMs = timeoutMs;
     this.maxRestarts = maxRestarts;
     this.countsRows = countsRows;
+    this.encryptionKey = encryptionKey;
     this.connection = this.makeConnection();
   }
   worker = null;
@@ -260,7 +238,8 @@ var WriterWorker = class _WriterWorker {
       { kind: "open", entry, path, options },
       workerOptions?.writeTimeoutMs ?? DEFAULT_WRITE_TIMEOUT_MS,
       workerOptions?.maxRestarts ?? DEFAULT_MAX_RESTARTS,
-      workerOptions?.countsRows === true
+      workerOptions?.countsRows === true,
+      workerOptions?.encryptionKey
     );
     worker.spawn();
     try {
@@ -287,10 +266,23 @@ var WriterWorker = class _WriterWorker {
         this.fault(new SirannonError(`Writer worker exited with code ${code}`, "WRITER_WORKER_EXIT"));
       }
     });
-    this.ready = this.send(this.openRequest).then(() => this.reloadExtensionsOntoRestartedConnection());
+    this.ready = this.openOnWorker().then(() => this.reloadExtensionsOntoRestartedConnection());
     this.ready.catch(() => {
     });
   }
+  async openOnWorker() {
+    if (!this.encryptionKey) {
+      await this.send(this.openRequest);
+      return;
+    }
+    const key = await this.encryptionKey();
+    try {
+      const options = { ...this.openRequest.options, encryption: { key } };
+      await this.send({ ...this.openRequest, options }, void 0, [key.buffer]);
+    } finally {
+      if (key.buffer.byteLength > 0) key.fill(0);
+    }
+  }
   async reloadExtensionsOntoRestartedConnection() {
     for (const path of this.loadedExtensions) {
       await this.send({ kind: "loadExtension", path });
@@ -413,7 +405,7 @@ var WriterWorker = class _WriterWorker {
     }
     this.spawn();
   }
-  send(request, onStep) {
+  send(request, onStep, transfer = []) {
     const worker = this.worker;
     if (!worker) {
       return Promise.reject(
@@ -446,7 +438,7 @@ var WriterWorker = class _WriterWorker {
         ...onStep ? { onStep } : {}
       });
       try {
-        worker.postMessage(message);
+        worker.postMessage(message, transfer);
       } catch (err) {
         this.pending.delete(id);
         if (timer) clearTimeout(timer);
@@ -468,70 +460,38 @@ var WriterWorker = class _WriterWorker {
       return value;
     });
   }
-  countedCalls(sql) {
-    return {
-      allCounted: (...params) => this.request({ kind: "allCounted", sql, params }),
-      getCounted: (...params) => this.request({ kind: "getCounted", sql, params }),
-      allRawCounted: (...params) => this.request({ kind: "allRawCounted", sql, params })
-    };
-  }
   makeConnection() {
-    const conn = {
-      exec: (sql) => this.request({ kind: "exec", sql }),
-      prepare: async (sql) => ({
-        all: (...params) => this.request({ kind: "all", sql, params }),
-        get: (...params) => this.request({ kind: "get", sql, params }),
-        run: (...params) => this.request({ kind: "run", sql, params }),
-        allRaw: (...params) => this.request({ kind: "allRaw", sql, params }),
-        ...this.countsRows ? this.countedCalls(sql) : {}
-      }),
-      runBatch: (sql, paramsBatch) => this.request({ kind: "runBatch", sql, paramsBatch }),
-      runBatchSummary: (sql, paramsBatch) => this.request({
-        kind: "runBatchSummary",
-        sql,
-        paramsBatch
-      }),
-      runGroup: (units, opening) => this.request({
-        kind: "runGroup",
-        units: units.map((unit) => ({ statements: unit.statements.map(toWorkerGroupStatement) })),
-        ...opening === void 0 ? {} : { opening: toWorkerGroupStatement(opening) }
-      }),
-      copyRunsOffCallerThread: true,
-      copyDatabase: (request) => this.request(
-        {
-          kind: "copyDatabase",
-          destPath: request.destPath,
-          pagesPerStep: request.pagesPerStep,
-          ...request.stallTimeoutMs === void 0 ? {} : { stallTimeoutMs: request.stallTimeoutMs }
+    const conn = workerHostConnection(
+      (request, onStep) => this.request(request, onStep),
+      this.countsRows,
+      {
+        loadExtension: async (extensionPath) => {
+          await this.request({ kind: "loadExtension", path: extensionPath });
+          if (!this.loadedExtensions.includes(extensionPath)) this.loadedExtensions.push(extensionPath);
         },
-        request.onStep
-      ),
-      loadExtension: async (extensionPath) => {
-        await this.request({ kind: "loadExtension", path: extensionPath });
-        if (!this.loadedExtensions.includes(extensionPath)) this.loadedExtensions.push(extensionPath);
-      },
-      transaction: async (fn) => {
-        this.transactionOpen = true;
-        this.beginPending = true;
-        try {
-          const result = await fn(conn);
-          if (!this.beginPending) await conn.exec("COMMIT");
-          return result;
-        } catch (err) {
+        transaction: async (fn) => {
+          this.transactionOpen = true;
+          this.beginPending = true;
           try {
-            if (!this.beginPending) await conn.exec("ROLLBACK");
-          } catch {
+            const result = await fn(conn);
+            if (!this.beginPending) await conn.exec("COMMIT");
+            return result;
+          } catch (err) {
+            try {
+              if (!this.beginPending) await conn.exec("ROLLBACK");
+            } catch {
+            }
+            throw err;
+          } finally {
+            this.transactionOpen = false;
+            this.beginPending = false;
+            this.beginCarrier = null;
+            this.lostTransaction = null;
           }
-          throw err;
-        } finally {
-          this.transactionOpen = false;
-          this.beginPending = false;
-          this.beginCarrier = null;
-          this.lostTransaction = null;
-        }
-      },
-      close: () => this.close()
-    };
+        },
+        close: () => this.close()
+      }
+    );
     return conn;
   }
   async close() {
@@ -561,14 +521,6 @@ var WriterWorker = class _WriterWorker {
     this.pending.clear();
   }
 };
-function asyncLocalWriterContext() {
-  const held = new AsyncLocalStorage();
-  return {
-    run: (operation) => held.run(true, operation),
-    isActive: () => held.getStore() === true,
-    exit: (operation) => held.exit(operation)
-  };
-}
 
 // src/core/backup/preferred-node.ts
 function preferredBackupNode(membership, preference) {
@@ -928,6 +880,10 @@ async function confirmChainStillListed(grip) {
   grip.report(lost);
   return false;
 }
+function keyIdField(request) {
+  const keyId = request.keyId?.();
+  return keyId === void 0 ? {} : { keyId };
+}
 async function startChain(request, chainName, namePrefix, previousChainId) {
   const chainId = randomHex(8);
   const startedAt = Date.now();
@@ -954,7 +910,8 @@ async function startChain(request, chainName, namePrefix, previousChainId) {
     pieceCount: report.pieceCount,
     pieceBytes: report.pieceBytes,
     bytesWritten: report.bytesWritten,
-    ...report.fingerprint ? { fingerprint: report.fingerprint } : {}
+    ...report.fingerprint ? { fingerprint: report.fingerprint } : {},
+    ...keyIdField(request)
   };
   await appendChainRecord(request.destination, chainName, base, 0);
   const head = {
@@ -998,7 +955,8 @@ async function transferCapture(request, chainName, chainId, pending, recordIndex
     pieceBytes,
     bytesWritten: sent.bytesWritten,
     checkpointed: pending.cursor.checkpointed,
-    ...sent.fingerprint ? { fingerprint: sent.fingerprint } : {}
+    ...sent.fingerprint ? { fingerprint: sent.fingerprint } : {},
+    ...keyIdField(request)
   };
   await appendChainRecord(request.destination, chainName, record, recordIndex);
   return {
@@ -1286,6 +1244,13 @@ var BackupCycle = class {
       report: (err) => this.report(err)
     });
   }
+  /** Drops the chain that this stopped cycle extended, so that the next cycle starts a new chain with a full copy. */
+  forgetChain() {
+    return this.runTurn(async () => {
+      await this.discardState();
+      await removeCycleState(this.stagingDir);
+    });
+  }
   async discardState() {
     const pending = this.state?.pending;
     if (pending) await rm(stagedCapturePath(this.stagingDir, pending.sequence), { force: true });
@@ -1466,4 +1431,4 @@ function nodeBackupEngine(streaming) {
   };
 }
 
-export { WriterWorker, asyncLocalWriterContext, bindableParams, createStatementCache, loadThroughRuntime, narrowRowIntegers, narrowRowsIntegers, narrowSafeBigInt, nodeBackupEngine, nodeResolveExtensionPath, nodeStreamingSupport };
+export { WriterWorker, createStatementCache, nodeBackupEngine, nodeResolveExtensionPath, nodeStreamingSupport };

package/dist/{chunk-DKML5425.mjs → chunk-GBVB6WSC.mjs}

@@ -1,6 +1,6 @@
-import { IDENTIFIER_RE, selectCountTableRows, canonicaliseForChecksum, selectUserSchemaObjects, validateDdlSafety, selectUserTableNames, referencedTables } from './chunk-RPWBYASV.mjs';
+import { IDENTIFIER_RE, selectCountTableRows, canonicaliseForChecksum, selectUserSchemaObjects, validateDdlSafety, selectUserTableNames, referencedTables } from './chunk-MTOQ6QIS.mjs';
 import { ReplicationError } from './chunk-BLMRNSUG.mjs';
-import { INTERNAL_TABLE_PREFIX } from './chunk-JFVEGN7J.mjs';
+import { INTERNAL_TABLE_PREFIX } from './chunk-ZAUHAJ4G.mjs';
 import { createHash } from 'crypto';
 
 var DumpOps = class {

package/dist/chunk-I4JY5QPA.mjs

@@ -0,0 +1,51 @@
+import { SirannonError } from './chunk-KINDFBQP.mjs';
+
+// src/core/backup/start-guard.ts
+async function startCopyWithoutHoldingWriter(runExclusive, start) {
+  let begin;
+  let release;
+  const writerHeld = new Promise((resolve) => {
+    begin = resolve;
+  });
+  const firstStepDone = new Promise((resolve) => {
+    release = resolve;
+  });
+  const run = (async () => {
+    await writerHeld;
+    return start(release);
+  })();
+  run.then(release, release);
+  await runExclusive(async () => {
+    begin();
+    await firstStepDone;
+  });
+  return run;
+}
+
+// src/core/backup/report.ts
+var DEFAULT_PIECE_BYTES = 16 * 1024 * 1024;
+function defaultDestinationName() {
+  return `backup-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}.db`;
+}
+function assertPieceBytes(pieceBytes) {
+  if (!Number.isInteger(pieceBytes) || pieceBytes <= 0) {
+    throw new SirannonError(
+      `Piece size must be a positive whole number of bytes, and it was ${pieceBytes}`,
+      "BACKUP_ERROR"
+    );
+  }
+}
+async function readPageSize(conn) {
+  const stmt = await conn.prepare("PRAGMA page_size");
+  const row = await stmt.get();
+  const [pageSize] = row === void 0 ? [] : Object.values(row);
+  return pageSize === void 0 ? 0 : Number(pageSize);
+}
+async function readMainDatabasePath(conn) {
+  const stmt = await conn.prepare("PRAGMA database_list");
+  const rows = await stmt.all();
+  const main = rows.find((row) => row.name === "main");
+  return main?.file ?? "";
+}
+
+export { DEFAULT_PIECE_BYTES, assertPieceBytes, defaultDestinationName, readMainDatabasePath, readPageSize, startCopyWithoutHoldingWriter };

package/dist/{chunk-L6EX6K27.mjs → chunk-MO4APBYG.mjs}

@@ -1,8 +1,9 @@
-import { planBackupRestore } from './chunk-YW7IKQ7T.mjs';
+import { planBackupRestore, EncryptionKeyring } from './chunk-W74HFQFD.mjs';
 import { listStoredFilePieces, fetchStoredFile, checkpointLog } from './chunk-QGVRRKB2.mjs';
 import { reportQuietly, LOG_HEADER_BYTES, LOG_FRAME_HEADER_BYTES, readLogHeader, foldLogChecksum, MAGIC_WITH_LITTLE_ENDIAN_CONTENT, LOG_FORMAT_VERSION } from './chunk-BUWJH3D3.mjs';
-import { readBackupChains, DEFAULT_CHAIN_NAME } from './chunk-CZL4D3BM.mjs';
+import { readBackupChains, DEFAULT_CHAIN_NAME } from './chunk-6CABU54O.mjs';
 import { destinationWithDeadline, DEFAULT_DESTINATION_TIMEOUT_MS, randomHex } from './chunk-BGJ5JVYL.mjs';
+import { EncryptionError } from './chunk-5O4J6LQQ.mjs';
 import { SirannonError } from './chunk-KINDFBQP.mjs';
 import { rename, open, rm, stat } from 'fs/promises';
 
@@ -53,6 +54,7 @@ function assembleFromDestination(destination, report, destPath) {
   return assembleStoredFile(destination, { ...report, name: report.destinationName }, destPath);
 }
 var DATABASE_HEADER_BYTES = 100;
+var PLAINTEXT_HEADER = "SQLite format 3\0";
 var PAGE_SIZE_OFFSET = 16;
 var PAGE_SIZE_FOR_65536 = 1;
 var SMALLEST_PAGE_BYTES = 512;
@@ -71,6 +73,7 @@ async function readDatabaseHeader(path) {
     if (bytesRead < DATABASE_HEADER_BYTES) {
       throw restoreError(`The full copy assembled into '${path}' is too short to be a SQLite database`);
     }
+    if (buffer.toString("latin1", 0, PLAINTEXT_HEADER.length) !== PLAINTEXT_HEADER) return null;
     const stated = buffer.readUInt16BE(PAGE_SIZE_OFFSET);
     const pageSize = stated === PAGE_SIZE_FOR_65536 ? LARGEST_PAGE_BYTES : stated;
     if (pageSize < SMALLEST_PAGE_BYTES || pageSize > LARGEST_PAGE_BYTES || (pageSize & pageSize - 1) !== 0) {
@@ -332,16 +335,16 @@ async function readPageCount(conn) {
   const row = await stmt.get();
   return row ? Number(row.page_count) : 0;
 }
-async function countDatabasePages(driver, destPath) {
-  const conn = await driver.open(destPath, { walMode: false, walAutoCheckpoint: 0 });
+async function countDatabasePages(openRebuilt, destPath) {
+  const conn = await openRebuilt(destPath);
   try {
     return await readPageCount(conn);
   } finally {
     await conn.close();
   }
 }
-async function foldLogIntoDatabase(driver, destPath, databasePages) {
-  const conn = await driver.open(destPath, { walMode: false, walAutoCheckpoint: 0 });
+async function foldLogIntoDatabase(openRebuilt, destPath, databasePages) {
+  const conn = await openRebuilt(destPath);
   try {
     const reached = await readPageCount(conn);
     if (reached !== databasePages) {
@@ -375,7 +378,7 @@ async function applyChangeBatch(request) {
       });
     }
     const written = await writer.finish();
-    await foldLogIntoDatabase(request.driver, request.destPath, written.databasePages);
+    await foldLogIntoDatabase(request.openRebuilt, request.destPath, written.databasePages);
     return written.frameCount;
   } catch (err) {
     await writer.abandon();
@@ -385,6 +388,43 @@ async function applyChangeBatch(request) {
   }
 }
 
+// src/core/backup/restore-keyed.ts
+var KEY_FAILURE_CODES = /* @__PURE__ */ new Set(["ENCRYPTION_KEY_REJECTED", "ENCRYPTION_KEY_MISSING"]);
+function rebuiltDatabaseOpener(driver, encryption) {
+  const keyring = new EncryptionKeyring(encryption?.key ?? null);
+  return (path) => keyring.openWith((keyed) => driver.open(path, { walMode: false, walAutoCheckpoint: 0, ...keyed }));
+}
+function explainKeyFailure(err, base) {
+  if (!(err instanceof EncryptionError) || !KEY_FAILURE_CODES.has(err.code)) return err;
+  const heldUnder = base.keyId === void 0 ? "a key that came with no identifier" : `the key '${base.keyId}'`;
+  return new EncryptionError(
+    `The key that the restore opened with failed on the full copy '${base.name}', which holds ciphertext under ${heldUnder}`,
+    err.code === "ENCRYPTION_KEY_MISSING" ? "ENCRYPTION_KEY_MISSING" : "ENCRYPTION_KEY_REJECTED",
+    err
+  );
+}
+async function readText(conn, sql) {
+  const row = await (await conn.prepare(sql)).get();
+  return row === void 0 ? void 0 : Object.values(row)[0];
+}
+async function readRebuiltHeader(path, openRebuilt, base) {
+  const plaintext = await readDatabaseHeader(path);
+  if (plaintext !== null) return plaintext;
+  let conn;
+  try {
+    conn = await openRebuilt(path);
+  } catch (err) {
+    throw explainKeyFailure(err, base);
+  }
+  try {
+    const pageSize = Number(await readText(conn, "PRAGMA page_size"));
+    const journalMode = await readText(conn, "PRAGMA journal_mode");
+    return { pageSize, walMode: typeof journalMode === "string" && journalMode.toLowerCase() === "wal" };
+  } finally {
+    await conn.close();
+  }
+}
+
 // src/core/backup/restore-options.ts
 var DEFAULT_RESTORE_BATCH_SIZE = 16;
 var MAX_RESTORE_BATCH_SIZE = 4096;
@@ -410,12 +450,12 @@ async function removeDatabaseAndLog(path) {
   });
   await removeLogBeside(path);
 }
-async function foldLogIntoDatabase2(driver, path) {
+async function foldLogIntoDatabase2(openRebuilt, path) {
   const existing = await stat(path).catch(() => void 0);
   if (!existing) return true;
   const log = await stat(`${path}-wal`).catch(() => void 0);
   if (!log || log.size === 0) return true;
-  const conn = await driver.open(path, { walMode: false, walAutoCheckpoint: 0 }).catch(() => void 0);
+  const conn = await openRebuilt(path).catch(() => void 0);
   if (!conn) return false;
   const folded = await checkpointLog(conn).catch(() => void 0);
   await conn.close().catch(() => void 0);
@@ -452,6 +492,7 @@ async function restoreBackup(options) {
   await assertPathIsFree(destPath, options.replaceExisting === true);
   const buildPath = `${destPath}${BUILD_SUFFIX}`;
   await removeDatabaseAndLog(buildPath);
+  const openRebuilt = rebuiltDatabaseOpener(options.driver, options.encryption);
   let piecesFetched = 0;
   let bytesFetched = 0;
   let changesApplied = 0;
@@ -470,7 +511,7 @@ async function restoreBackup(options) {
       bytesFetched = bytes;
       reportProgress("full-copy");
     });
-    const header = await readDatabaseHeader(buildPath);
+    const header = await readRebuiltHeader(buildPath, openRebuilt, plan.base);
     if (!header.walMode && plan.changes.length > 0) {
       throw new SirannonError(
         `The full copy assembled into '${buildPath}' records no write-ahead log, so SQLite would ignore the change pieces rather than replay them`,
@@ -482,7 +523,7 @@ async function restoreBackup(options) {
       logSequence++;
       framesApplied += await applyChangeBatch({
         destination,
-        driver: options.driver,
+        openRebuilt,
         destPath: buildPath,
         pageSize: header.pageSize,
         logSequence,
@@ -496,8 +537,8 @@ async function restoreBackup(options) {
       changesApplied += batch.length;
       reportProgress("changes");
     }
-    await countDatabasePages(options.driver, buildPath);
-    const logFoldedIn = await foldLogIntoDatabase2(options.driver, destPath);
+    await countDatabasePages(openRebuilt, buildPath);
+    const logFoldedIn = await foldLogIntoDatabase2(openRebuilt, destPath);
     if (logFoldedIn) await removeLogBeside(destPath);
     else await removeDatabaseAndLog(destPath);
     await rename(buildPath, destPath);

package/dist/{chunk-RPWBYASV.mjs → chunk-MTOQ6QIS.mjs}

@@ -1,5 +1,5 @@
 import { ReplicationError, BatchValidationError } from './chunk-BLMRNSUG.mjs';
-import { CHANGES_TABLE, META_TABLE, MIGRATIONS_TABLE, REPLACED_ROWS_TABLE, APPLIED_CHANGES_TABLE, STAGED_PUSH_CHANGES_TABLE, COLUMN_VERSIONS_TABLE, DEVICE_CURSORS_TABLE, PEER_STATE_TABLE, SYNC_STATE_TABLE, STAGED_CHANGES_TABLE, isReservedIdentifier } from './chunk-JFVEGN7J.mjs';
+import { CHANGES_TABLE, META_TABLE, MIGRATIONS_TABLE, REPLACED_ROWS_TABLE, APPLIED_CHANGES_TABLE, STAGED_PUSH_CHANGES_TABLE, COLUMN_VERSIONS_TABLE, DEVICE_CURSORS_TABLE, PEER_STATE_TABLE, SYNC_STATE_TABLE, STAGED_CHANGES_TABLE, isReservedIdentifier } from './chunk-ZAUHAJ4G.mjs';
 import { SirannonError } from './chunk-KINDFBQP.mjs';
 
 // src/core/sync/hlc.ts

package/dist/chunk-MX77PGEN.mjs

@@ -0,0 +1,60 @@
+// src/core/driver/values.ts
+var SAFE_INT_BOUND = 9007199254740991n;
+function narrowSafeBigInt(value) {
+  if (typeof value === "bigint" && value >= -SAFE_INT_BOUND && value <= SAFE_INT_BOUND) {
+    return Number(value);
+  }
+  return value;
+}
+function narrowRowIntegers(row) {
+  if (row === null || typeof row !== "object") return row;
+  const obj = row;
+  for (const key of Object.keys(obj)) {
+    const value = obj[key];
+    if (typeof value === "bigint" && value >= -SAFE_INT_BOUND && value <= SAFE_INT_BOUND) {
+      obj[key] = Number(value);
+    }
+  }
+  return row;
+}
+function narrowRowsIntegers(rows) {
+  for (const row of rows) {
+    narrowRowIntegers(row);
+  }
+  return rows;
+}
+var EMPTY_BLOB_WITH_ALLOCATED_STORAGE = new Uint8Array(new ArrayBuffer(1), 0, 0);
+function bindableValue(value) {
+  if (typeof value === "boolean") return value ? 1n : 0n;
+  if (ArrayBuffer.isView(value) && value.byteLength === 0) return EMPTY_BLOB_WITH_ALLOCATED_STORAGE;
+  return value;
+}
+function isNamedParams(value) {
+  if (value === null || typeof value !== "object") return false;
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}
+function bindableNamedParams(params) {
+  let bound;
+  for (const key of Object.keys(params)) {
+    const value = params[key];
+    const replacement = bindableValue(value);
+    if (replacement === value) continue;
+    bound ??= { ...params };
+    bound[key] = replacement;
+  }
+  return bound ?? params;
+}
+function bindableParams(params) {
+  let bound;
+  for (let index = 0; index < params.length; index++) {
+    const value = params[index];
+    const replacement = isNamedParams(value) ? bindableNamedParams(value) : bindableValue(value);
+    if (replacement === value) continue;
+    bound ??= [...params];
+    bound[index] = replacement;
+  }
+  return bound ?? params;
+}
+
+export { bindableParams, isNamedParams, narrowRowIntegers, narrowRowsIntegers, narrowSafeBigInt };