@evolu/common 8.17.0 → 8.19.0

package/dist/src/local-first/Shared.js

@@ -111,10 +111,10 @@
  * whichever instance made it, even one disposed before the database worker
  * answered. When a relay frame stores new messages, the tenant requests a round
  * through each other transport claimed for the owner, so data learned from one
- * relay reaches the others, except through a route that skipped a message, as
- * described below. A closed transport reconciles when it opens, and a
- * replacement leader reconciles every transport again, because a response
- * reporting stored messages may have been lost.
+ * relay reaches the others, except through a route that skipped a message it
+ * received or could not send, as described below. A closed transport reconciles
+ * when it opens, and a replacement leader reconciles every transport again,
+ * because a response reporting stored messages may have been lost.
  *
  * Relays omit the sending socket when broadcasting an upload, so the uploader
  * also delivers it as local Broadcast frames to every other tenant with
@@ -178,17 +178,17 @@
  *   request, a replacement leader, or storing messages from another transport,
  *   unless the route skipped a message. No failed or aborted result has arrived
  *   on the route since.
- * - No result that skipped a received message has arrived on the route since a
- *   round was last requested through it, and since that request, no messages
- *   have been stored from another transport, directly or through a sibling copy
- *   uploaded outside this transport, and no sibling copy has failed to apply or
- *   skipped a message.
+ * - No result that skipped a received message or a stored change too large to
+ *   send has arrived on the route since a round was last requested through it,
+ *   and since that request, no messages have been stored from another
+ *   transport, directly or through a sibling copy uploaded outside this
+ *   transport, and no sibling copy has failed to apply or skipped a message.
  *
  * A route is settled when every condition except the last holds, so a complete
  * route is settled too. A settled route that is incomplete has ended its
- * reconciliation, but its relay may offer a message the database skipped, or
- * messages stored elsewhere may not have reached it; it is published as
- * {@link SettledSyncRoute}.
+ * reconciliation, but its relay may offer a message the database skipped, the
+ * database may store a change too large to send, or messages stored elsewhere
+ * may not have reached it; it is published as {@link SettledSyncRoute}.
  *
  * A reconciliation chain ends only with a converged result, a failure, an
  * abort, a dropped frame, or a continuation that finds the socket closed, and
@@ -207,20 +207,34 @@
  * while the database worker creates a round is logged there and fails the
  * round's routes with `SyncFailed` without a retry. A mutation that throws is
  * rolled back and reported as an {@link UnknownError} to the tab that made it,
- * or to every tab when its Evolu instance was disposed first. Other unexpected
- * SQLite exceptions remain unsupported and can panic the database worker. A
- * frame the relay silently drops, such as invalid data, leaves the count above
- * zero until the liveness rule below replaces the socket.
+ * or to every tab when its Evolu instance was disposed first. A received batch
+ * SQLite fails to store, for example on a full disk, is rolled back and fails
+ * its route with an `UnknownError`. Other unexpected SQLite exceptions remain
+ * unsupported and can panic the database worker. A frame the relay silently
+ * drops, such as invalid data, leaves the count above zero until the liveness
+ * rule below replaces the socket.
  *
- * A result that skipped a received message the database could not decrypt,
- * verify, or decode records the error on the route as its `skippedError`,
- * without ending its chain, so it requests no round, and the relay offers the
- * message again in every round through the route until the database stores a
- * message with that timestamp. The messages received elsewhere that the last
- * condition names request no round through such a route, even while a requested
- * round checks it again, because each round would download every skipped
- * message again. The next round that an explicit request, a reopen, a
- * replacement leader, or a failure sends through the route reconciles them.
+ * A result that skipped a message records the error on the route as its
+ * `skippedError`, without ending its chain, so it requests no round. A message
+ * is skipped in two cases:
+ *
+ * - The relay offers a message the database could not decrypt, verify, or decode.
+ *   The relay offers it again in every round through the route until the
+ *   database stores a message with that timestamp.
+ * - The database stores a change it cannot send, a
+ *   {@link ProtocolChangeTooLargeError}: one saved before `maxMutationSize`
+ *   existed, or a crafted one received from a relay. Every route through a
+ *   relay that lacks it skips it on every sync, so each such route stays
+ *   settled.
+ *
+ * The messages received elsewhere that the last condition names request no
+ * round through such a route, even while a requested round checks it again,
+ * because each round would download every skipped message again, or skip again
+ * a change too large to send. The next round that an explicit request, a
+ * reopen, a replacement leader, or a failure sends through the route reconciles
+ * them. So while the database stores a change too large to send, messages from
+ * other relays reach a route only through such a round, for example after a
+ * reconnect or {@link Evolu.requestSync}.
  *
  * ### Liveness
  *
@@ -842,8 +856,9 @@ export const initSharedWorker = (self) => async (run) => {
         };
         // Held while this worker runs. Its DbWorkers stop once they can take it,
         // because a Dispose posted right before this worker closes can be lost, as
-        // in Firefox. Taken before the build lock, so nothing delays the end of
-        // starting once that lock is held.
+        // in Firefox (https://bugzilla.mozilla.org/show_bug.cgi?id=2077609). Taken
+        // before the build lock, so nothing delays the end of starting once that
+        // lock is held.
         disposer.use(await run.ok(acquireLeaderLock(workerId)));
         // Released after every tenant is disposed and has told its DbWorker to
         // stop. Earlier releases take the same lock in their leader tab; see
@@ -1284,6 +1299,11 @@ const createEvoluTenant = ({ name, consoleLevel, sqliteSchema, encryptionKey, },
                         // tell tabs that connect later without starting another worker.
                         if (dbWorker.type === "Leading") {
                             assertNotSame(dbWorker.port, currentDbWorkerPort);
+                            // The leader may still hold the database lock: browsers deliver
+                            // a refusal before a worker requested later can lead, but the
+                            // tenant does not rely on that order. Tell it to dispose, so it
+                            // releases the lock.
+                            dbWorker.port.postMessage({ type: "Dispose" });
                             dbWorker.port[Symbol.dispose]();
                         }
                         currentDbWorkerPort[Symbol.dispose]();
@@ -1588,7 +1608,8 @@ const createEvoluTenant = ({ name, consoleLevel, sqliteSchema, encryptionKey, },
                         !hasQueuedWrite;
                     // Settling drops the failure, so the next one requests a round
                     // again. A route with a skip it is not rechecking settles without
-                    // completing, because its relay may offer the skipped message or
+                    // completing, because its relay may offer the skipped message, the
+                    // database may store a change too large to send, or the relay may
                     // lack messages stored elsewhere.
                     const pending = routeToPending(route.progress);
                     route.progress =
@@ -1684,11 +1705,12 @@ const createEvoluTenant = ({ name, consoleLevel, sqliteSchema, encryptionKey, },
                                 route.lastReceivedAt = now;
                             // A skipped message is recorded as the route's skip, not a
                             // failure, and does not end the round, whose response below is
-                            // still sent, so it requests no round. The relay offers the
-                            // message again in every later round, so the route stays
-                            // incomplete until a round requested through it settles without
-                            // skipping a message and without messages stored elsewhere since
-                            // that request.
+                            // still sent, so it requests no round. The relay offers a message
+                            // the database could not store again in every later round, and
+                            // every round skips a stored change too large to send again, so
+                            // the route stays incomplete until a round requested through it
+                            // settles without skipping a message and without messages stored
+                            // elsewhere since that request.
                             if (skippedError !== null)
                                 route.progress = {
                                     ...routeToPending(route.progress),
@@ -1712,12 +1734,14 @@ const createEvoluTenant = ({ name, consoleLevel, sqliteSchema, encryptionKey, },
                     }
                     else if (failure !== null || skippedError !== null) {
                         // A sibling's copy comes from this worker, not from a relay, so no
-                        // route shows its failure. It is a Broadcast, which carries no
-                        // relay error, so an error or a skip means a bug, such as
-                        // databases holding different keys for the owner, and is reported
-                        // as an unexpected failure. A Failed result was logged, which
-                        // reports it already. An error is the failure, which is never an
-                        // abort, and like a route, the report leaves out its frame.
+                        // route shows its failure. SQLite can fail to store it, for example
+                        // on a full disk, which returns an UnknownError. It is a Broadcast,
+                        // which carries no relay error, so any other error or a skip means
+                        // a bug, such as databases holding different keys for the owner.
+                        // Each is reported as an unexpected failure. A Failed result was
+                        // logged, which reports it already. An error is the failure, which
+                        // is never an abort, and like a route, the report leaves out its
+                        // frame.
                         const unexpected = error !== null ? failure : skippedError;
                         if (unexpected !== null)
                             deps.postConsoleEntryOrError({
@@ -1806,9 +1830,10 @@ const createEvoluTenant = ({ name, consoleLevel, sqliteSchema, encryptionKey, },
          * `except`, after messages from elsewhere were stored or a sibling copy was
          * not fully stored. Rounds toward the same transport coalesce whatever
          * their source. A route that skipped a message gets none, because its relay
-         * would offer that message again, and a route rechecking one stops
-         * rechecking, because its round may have read the database before this
-         * event. A later requested round through such a route reconciles it.
+         * would offer that message again or the round would skip a stored change
+         * too large to send again. A route rechecking one stops rechecking, because
+         * its round may have read the database before this event. A later requested
+         * round through such a route reconciles it.
          */
         const requestRoundsForReceivedMessages = (ownerId, { except, afterQueuedWrites, }) => {
             const keys = [];

package/dist/src/local-first/Storage.d.ts

@@ -5,6 +5,7 @@
  */
 import type { NonEmptyReadonlyArray } from "../Array.ts";
 import type { Brand } from "../Brand.ts";
+import type { UnknownError } from "../Error.ts";
 import type { RandomDep } from "../Random.ts";
 import type { SqliteDep } from "../Sqlite.ts";
 import type { Task } from "../Task.ts";
@@ -32,7 +33,10 @@ export interface StorageConfig {
      * asynchronous (for calling remote APIs).
      *
      * The callback returns a boolean rather than an error because error handling
-     * and logging are the responsibility of the callback implementation.
+     * and logging are the responsibility of the callback implementation. It must
+     * not throw or reject, because a throw is a defect that shuts the relay down
+     * for a supervisor to restart it; a callback calling a remote service catches
+     * its failure and returns whether to allow the write.
      *
      * Relay deployments configure this callback. Client applications observe a
      * denied relay write as a {@link ProtocolQuotaError} in the `failure` of that
@@ -81,10 +85,9 @@ export interface StorageConfig {
  * that satisfies this contract.
  *
  * {@link Storage.writeMessages} returns the {@link StorageWriteMessagesError}
- * that made it store none of a batch. Implementations return expected write
- * rejections without reporting them; the caller owns reporting. The client
- * protocol forwards these errors unchanged, while the relay protocol maps them
- * to wire error codes.
+ * that made it store none of a batch. Implementations return it without
+ * reporting it; the caller owns reporting. The client protocol forwards these
+ * errors unchanged, while the relay protocol maps them to wire error codes.
  *
  * The Storage API is synchronous because SQLite's synchronous API is the
  * fastest way to use SQLite. Synchronous bindings (like better-sqlite3) call
@@ -95,29 +98,55 @@ export interface StorageConfig {
  * for async validation logic before writing to storage. The write operation
  * itself remains synchronous.
  *
+ * Indexes count an owner's timestamps in order from 0, and none may exceed the
+ * owner's size from {@link Storage.getSize}. Sync reads the size once per
+ * message and derives every index from it.
+ *
  * @group Core
  */
 export interface Storage {
+    /** Returns the number of the owner's timestamps. */
     readonly getSize: (ownerId: OwnerIdBytes) => NonNegativeInt;
+    /**
+     * Returns the {@link Fingerprint} of the owner's timestamps from index `begin`
+     * up to, but not including, `end`, where `begin` is at most `end`.
+     */
     readonly fingerprint: (ownerId: OwnerIdBytes, begin: NonNegativeInt, end: NonNegativeInt) => Fingerprint;
     /**
      * Computes fingerprints with their upper bounds in one call.
      *
+     * Each bucket is the end index of a range that starts at the previous bucket,
+     * or at 0 for the first, so the buckets must be ascending.
+     *
      * This function can be replaced with many fingerprint/findLowerBound calls,
      * but implementations can leverage it for batching and more efficient
      * fingerprint computation.
      */
     readonly fingerprintRanges: (ownerId: OwnerIdBytes, buckets: ReadonlyArray<NonNegativeInt>, upperBound?: RangeUpperBound) => ReadonlyArray<FingerprintRange>;
+    /**
+     * Returns the index of the owner's first timestamp not below `upperBound`,
+     * counted from the owner's first timestamp, or `end` when there is none or
+     * `upperBound` is {@link InfiniteUpperBound}.
+     *
+     * `begin` must be 0 or the result for an earlier bound not above
+     * `upperBound`, and `end` the owner's size, so the result lies in [`begin`,
+     * `end`]. When `end` is 0 or equals `begin`, the result is `end`. Sync meets
+     * this because the protocol rejects range upper bounds that decrease.
+     */
     readonly findLowerBound: (ownerId: OwnerIdBytes, begin: NonNegativeInt, end: NonNegativeInt, upperBound: RangeUpperBound) => NonNegativeInt;
+    /**
+     * Calls `callback` with the owner's timestamps and their indexes from `begin`
+     * up to, but not including, `end`, where `begin` is at most `end`, until the
+     * callback returns `false`.
+     */
     readonly iterate: (ownerId: OwnerIdBytes, begin: NonNegativeInt, end: NonNegativeInt, callback: (timestamp: TimestampBytes, index: NonNegativeInt) => boolean) => void;
     /**
      * Validates the {@link OwnerWriteKey} for the given {@link Owner}.
      *
-     * Returns `true` if the write key is valid, `false` otherwise.
+     * Returns `true` if the write key is valid, `false` otherwise. A relay logs a
+     * throw and answers the request with {@link ProtocolWriteError}.
      */
     readonly validateWriteKey: (ownerId: OwnerIdBytes, writeKey: OwnerWriteKey) => boolean;
-    /** Sets the {@link OwnerWriteKey} for the given {@link Owner}. */
-    readonly setWriteKey: (ownerId: OwnerIdBytes, writeKey: OwnerWriteKey) => void;
     /**
      * Write encrypted {@link CrdtMessage}s to storage.
      *
@@ -131,7 +160,12 @@ export interface Storage {
      * protocol logic handling during sync operations.
      */
     readonly writeMessages: (ownerIdBytes: OwnerIdBytes, messages: NonEmptyReadonlyArray<EncryptedCrdtMessage>) => Task<void, StorageWriteMessagesError>;
-    /** Read encrypted {@link DbChange}s from storage. */
+    /**
+     * Read encrypted {@link DbChange}s from storage.
+     *
+     * The returned array must not be modified or reused later, because sync
+     * references it until it finishes its answer.
+     */
     readonly readDbChange: (ownerId: OwnerIdBytes, timestamp: TimestampBytes) => EncryptedDbChange;
     /** Delete all data for the given {@link Owner}. */
     readonly deleteOwner: (ownerId: OwnerIdBytes) => void;
@@ -152,7 +186,7 @@ export interface StorageDep {
 export interface StorageQuotaError extends OwnerError, Typed<"StorageQuotaError"> {
 }
 /**
- * Expected reasons why {@link Storage.writeMessages} stored none of a batch.
+ * Reasons why {@link Storage.writeMessages} stored none of a batch.
  *
  * The built-in relay storage stores opaque encrypted messages and rejects
  * batches over quota. The built-in client storage decrypts and validates
@@ -162,15 +196,38 @@ export interface StorageQuotaError extends OwnerError, Typed<"StorageQuotaError"
  * never a reason to reject a batch. The contract permits quota checks on either
  * side.
  *
+ * Both built-in storages return {@link UnknownError} when SQLite fails the
+ * write, for example on a full disk, after rolling it back.
+ *
  * @group Core
  */
-export type StorageWriteMessagesError = StorageQuotaError;
-/**
- * A cryptographic hash used for efficiently comparing collections of
- * {@link TimestampBytes}es.
- *
- * It consists of the first {@link fingerprintSize} bytes of the SHA-256 hash of
- * one or more timestamps.
+export type StorageWriteMessagesError = StorageQuotaError | UnknownError;
+/**
+ * A summary of a range of {@link TimestampBytes} for comparing ranges cheaply.
+ *
+ * It is the XOR of the first {@link fingerprintSize} bytes of the SHA-256 hash
+ * of each timestamp in the range, or {@link zeroFingerprint} for an empty
+ * range.
+ *
+ * XOR is linear, so fingerprints are not collision resistant: any 97 timestamps
+ * contain a nonempty subset whose fingerprints XOR to zero. Anyone who can
+ * write to a relay for an owner, which includes every collaborator of a
+ * {@link SharedOwner}, can store timestamps whose fingerprints XOR to the
+ * fingerprint of a chosen change. Two ranges that differ only by that change
+ * and those timestamps then compare equal, so sync skips them, and the change
+ * does not move between that relay and a peer. This was demonstrated end to
+ * end, and nothing reports it. {@link Evolu.requestSync} does not heal it,
+ * because the next round compares the same fingerprints. In protocol version 1,
+ * the only recovery is syncing through a relay that does not hold those
+ * timestamps. Binding the count or hashing the result changes every
+ * fingerprint, so it needs a new protocol version.
+ *
+ * A write-key holder can also store a change under a timestamp another device
+ * has not used yet, such as a later one with that device's NodeId, because
+ * relays accept timestamps from any time. A relay keeps the first change stored
+ * for a timestamp, so it does not store the device's change when it arrives,
+ * and peers that sync through that relay later get the stored one instead. A
+ * new fingerprint does not close this.
  *
  * @group Ranges
  */
@@ -275,6 +332,9 @@ export interface EncryptedCrdtMessage {
 /**
  * Encrypted DbChange
  *
+ * A 24-byte XChaCha20-Poly1305 nonce, the ciphertext length, and the ciphertext
+ * ending with its 16-byte Poly1305 tag, so at least 41 bytes.
+ *
  * @group Messages
  */
 export type EncryptedDbChange = Uint8Array & Brand<"EncryptedDbChange">;
@@ -367,7 +427,7 @@ export interface DbChange extends InferType<typeof DbChange> {
  *
  * @group SQLite
  */
-export interface BaseSqliteStorage extends Omit<Storage, "validateWriteKey" | "setWriteKey" | "writeMessages" | "readDbChange"> {
+export interface BaseSqliteStorage extends Omit<Storage, "validateWriteKey" | "writeMessages" | "readDbChange"> {
     /**
      * Inserts a timestamp for an owner into the skiplist-based storage.
      *
@@ -448,6 +508,8 @@ export declare const testFingerprintTimestamps: (timestamps: ReadonlyArray<Times
 /**
  * Reads the timestamp at a position within an owner's ordered timestamps.
  *
+ * Throws when `index` is not below the owner's size.
+ *
  * @group SQLite
  */
 export declare const getTimestampByIndex: (deps: SqliteDep) => (ownerId: OwnerIdBytes, index: NonNegativeInt) => TimestampBytes;

package/dist/src/local-first/Storage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Storage.d.ts","sourceRoot":"","sources":["../../../src/local-first/Storage.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAGzD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE9C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE9C,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAEvC,OAAO,EACL,OAAO,EAEP,EAAE,EACF,KAAK,SAAS,EAEd,cAAc,EACd,IAAI,EAGJ,KAAK,UAAU,EAGf,MAAM,EACN,KAAK,KAAK,EACV,KAAK,SAAS,EACd,KAAK,SAAS,EACf,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,KAAK,EAAS,UAAU,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAIpD,OAAO,EAGL,SAAS,EACT,cAAc,EACf,MAAM,gBAAgB,CAAC;AAExB;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkDG;IACH,QAAQ,CAAC,kBAAkB,EAAE,CAC3B,OAAO,EAAE,OAAO,EAChB,aAAa,EAAE,cAAc,KAC1B,SAAS,CAAC,OAAO,CAAC,CAAC;CACzB;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,YAAY,KAAK,cAAc,CAAC;IAE5D,QAAQ,CAAC,WAAW,EAAE,CACpB,OAAO,EAAE,YAAY,EACrB,KAAK,EAAE,cAAc,EACrB,GAAG,EAAE,cAAc,KAChB,WAAW,CAAC;IAEjB;;;;;;OAMG;IACH,QAAQ,CAAC,iBAAiB,EAAE,CAC1B,OAAO,EAAE,YAAY,EACrB,OAAO,EAAE,aAAa,CAAC,cAAc,CAAC,EACtC,UAAU,CAAC,EAAE,eAAe,KACzB,aAAa,CAAC,gBAAgB,CAAC,CAAC;IAErC,QAAQ,CAAC,cAAc,EAAE,CACvB,OAAO,EAAE,YAAY,EACrB,KAAK,EAAE,cAAc,EACrB,GAAG,EAAE,cAAc,EACnB,UAAU,EAAE,eAAe,KACxB,cAAc,CAAC;IAEpB,QAAQ,CAAC,OAAO,EAAE,CAChB,OAAO,EAAE,YAAY,EACrB,KAAK,EAAE,cAAc,EACrB,GAAG,EAAE,cAAc,EACnB,QAAQ,EAAE,CAAC,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,cAAc,KAAK,OAAO,KACpE,IAAI,CAAC;IAEV;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,CACzB,OAAO,EAAE,YAAY,EACrB,QAAQ,EAAE,aAAa,KACpB,OAAO,CAAC;IAEb,kEAAkE;IAClE,QAAQ,CAAC,WAAW,EAAE,CACpB,OAAO,EAAE,YAAY,EACrB,QAAQ,EAAE,aAAa,KACpB,IAAI,CAAC;IAEV;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,aAAa,EAAE,CACtB,YAAY,EAAE,YAAY,EAC1B,QAAQ,EAAE,qBAAqB,CAAC,oBAAoB,CAAC,KAClD,IAAI,CAAC,IAAI,EAAE,yBAAyB,CAAC,CAAC;IAE3C,qDAAqD;IACrD,QAAQ,CAAC,YAAY,EAAE,CACrB,OAAO,EAAE,YAAY,EACrB,SAAS,EAAE,cAAc,KACtB,iBAAiB,CAAC;IAEvB,mDAAmD;IACnD,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,EAAE,YAAY,KAAK,IAAI,CAAC;CACvD;AAED;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED;;;;GAIG;AACH,MAAM,WAAW,iBACf,SAAQ,UAAU,EAAE,KAAK,CAAC,mBAAmB,CAAC;CAAG;AAEnD;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,yBAAyB,GAAG,iBAAiB,CAAC;AAE1D;;;;;;;;GAQG;AACH,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG,KAAK,CAAC,aAAa,CAAC,CAAC;AAE5D;;;;GAIG;AACH,eAAO,MAAM,eAAe,kFAA2C,CAAC;AAExE;;;;GAIG;AACH,eAAO,MAAM,eAAe,EAEvB,WAAW,CAAC;AAEjB;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,UAAU,EAAE,eAAe,CAAC;CACtC;AAED;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG,cAAc,GAAG,kBAAkB,CAAC;AAElE;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,eAE9B,CAAC;AACF;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAAG,OAAO,kBAAkB,CAAC;AAE3D;;;;GAIG;AACH,eAAO,MAAM,SAAS;aACpB,WAAW,EAAE,CAAC;aACd,IAAI,EAAE,CAAC;aACP,UAAU,EAAE,CAAC;CACL,CAAC;AAEX;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,SAAS,CAAC,CAAC,MAAM,OAAO,SAAS,CAAC,CAAC;AAEnE;;;;GAIG;AACH,MAAM,WAAW,SAAU,SAAQ,SAAS;IAC1C,QAAQ,CAAC,IAAI,EAAE,OAAO,SAAS,CAAC,IAAI,CAAC;CACtC;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAiB,SAAQ,SAAS;IACjD,QAAQ,CAAC,IAAI,EAAE,OAAO,SAAS,CAAC,WAAW,CAAC;IAC5C,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;CACnC;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAgB,SAAQ,SAAS;IAChD,QAAQ,CAAC,IAAI,EAAE,OAAO,SAAS,CAAC,UAAU,CAAC;IAC3C,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;CACpD;AAED;;;;;GAKG;AACH,MAAM,MAAM,KAAK,GAAG,SAAS,GAAG,gBAAgB,GAAG,eAAe,CAAC;AAEnE;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;CACpC;AAED;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG,UAAU,GAAG,KAAK,CAAC,mBAAmB,CAAC,CAAC;AAExE;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;CAC3B;AAED;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,OAC5B,EAAE,UACE,MAAM,QACR,MAAM,KACX,WAYD,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,cAAc,w+BAA4C,CAAC;AACxE,MAAM,MAAM,cAAc,GAAG,OAAO,cAAc,CAAC,MAAM,CAAC;AAE1D;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,yjCAgB/B,CAAC;AACF,MAAM,MAAM,mBAAmB,GAAG,OAAO,mBAAmB,CAAC,MAAM,CAAC;AAEpE;;;;GAIG;AACH,MAAM,WAAW,wBAAyB,SAAQ,SAAS,CAAC,qBAAqB,CAAC;IAChF,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;IAC/B,QAAQ,CAAC,cAAc,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAChD;AAED;;;;;GAKG;AACH,eAAO,MAAM,QAAQ,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,OAAO,MAAM,CAAC;IAC9B,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,OAAO,mBAAmB,CAAC;IAC5C,QAAQ,CAAC,QAAQ,EAAE,OAAO,OAAO,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,SAAS,CAAC,OAAO,OAAO,EAAE,OAAO,IAAI,CAAC,CAAC,CAAC;CACtE,CAMC,CAAC;AACH,MAAM,WAAW,QAAS,SAAQ,SAAS,CAAC,OAAO,QAAQ,CAAC;CAAG;AAE/D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,WAAW,iBAAkB,SAAQ,IAAI,CAC7C,OAAO,EACP,kBAAkB,GAAG,aAAa,GAAG,eAAe,GAAG,cAAc,CACtE;IACC;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,EAAE,CACxB,OAAO,EAAE,YAAY,EACrB,SAAS,EAAE,cAAc,EACzB,QAAQ,EAAE,8BAA8B,KACrC,OAAO,CAAC;IAEb;;;OAGG;IACH,QAAQ,CAAC,qBAAqB,EAAE,CAC9B,YAAY,EAAE,YAAY,EAC1B,eAAe,EAAE,qBAAqB,CAAC,cAAc,CAAC,KACnD,aAAa,CAAC,cAAc,CAAC,CAAC;CACpC;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,iBAAiB,EAAE,iBAAiB,CAAC;CAC/C;AAED;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,SAAS,CAAC;AAEtD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,uBAAuB,SAC5B,iBAAiB,KACtB,iBA2FD,CAAC;AAMH;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,SAAU,SAAS,KAAG,IAgE/D,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,8BAA8B,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,CAAC;AAE7E;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,cAC1B,cAAc,kBACT,cAAc,iBACf,cAAc,KAC5B,CACD,QAAQ,EAAE,8BAA8B,EACxC,cAAc,EAAE,cAAc,EAC9B,aAAa,EAAE,cAAc,CAS9B,CAAC;AAoeF;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,cAC3B,cAAc,KACxB,WAGF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,eACxB,aAAa,CAAC,cAAc,CAAC,KACxC,WAUE,CAAC;AAkYN;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,SACvB,SAAS,eACN,YAAY,SAAS,cAAc,KAAG,cA4E/C,CAAC;AAEJ;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,SAC3B,SAAS,oBAEA,YAAY,oBACR,cAAc,KAC/B;IACD,QAAQ,CAAC,WAAW,EAAE,cAAc,GAAG,IAAI,CAAC;IAC5C,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,QAAQ,CAAC,aAAa,EAAE,cAAc,CAAC;CA6BxC,CAAC;AAEJ;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,SACpB,SAAS,oBAEA,YAAY,eACb,cAAc,kBACX,cAAc,iBACf,cAAc,KAC5B,IAYF,CAAC"}
+{"version":3,"file":"Storage.d.ts","sourceRoot":"","sources":["../../../src/local-first/Storage.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAGzD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEhD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE9C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE9C,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAEvC,OAAO,EACL,OAAO,EAEP,EAAE,EACF,KAAK,SAAS,EAEd,cAAc,EACd,IAAI,EAGJ,KAAK,UAAU,EAGf,MAAM,EACN,KAAK,KAAK,EACV,KAAK,SAAS,EACd,KAAK,SAAS,EACf,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C,OAAO,KAAK,EAAS,UAAU,EAAE,YAAY,EAAe,MAAM,YAAY,CAAC;AAC/E,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAIpD,OAAO,EAGL,SAAS,EACT,cAAc,EACf,MAAM,gBAAgB,CAAC;AAExB;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAqDG;IACH,QAAQ,CAAC,kBAAkB,EAAE,CAC3B,OAAO,EAAE,OAAO,EAChB,aAAa,EAAE,cAAc,KAC1B,SAAS,CAAC,OAAO,CAAC,CAAC;CACzB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,WAAW,OAAO;IACtB,oDAAoD;IACpD,QAAQ,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,YAAY,KAAK,cAAc,CAAC;IAE5D;;;OAGG;IACH,QAAQ,CAAC,WAAW,EAAE,CACpB,OAAO,EAAE,YAAY,EACrB,KAAK,EAAE,cAAc,EACrB,GAAG,EAAE,cAAc,KAChB,WAAW,CAAC;IAEjB;;;;;;;;;OASG;IACH,QAAQ,CAAC,iBAAiB,EAAE,CAC1B,OAAO,EAAE,YAAY,EACrB,OAAO,EAAE,aAAa,CAAC,cAAc,CAAC,EACtC,UAAU,CAAC,EAAE,eAAe,KACzB,aAAa,CAAC,gBAAgB,CAAC,CAAC;IAErC;;;;;;;;;OASG;IACH,QAAQ,CAAC,cAAc,EAAE,CACvB,OAAO,EAAE,YAAY,EACrB,KAAK,EAAE,cAAc,EACrB,GAAG,EAAE,cAAc,EACnB,UAAU,EAAE,eAAe,KACxB,cAAc,CAAC;IAEpB;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,CAChB,OAAO,EAAE,YAAY,EACrB,KAAK,EAAE,cAAc,EACrB,GAAG,EAAE,cAAc,EACnB,QAAQ,EAAE,CAAC,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,cAAc,KAAK,OAAO,KACpE,IAAI,CAAC;IAEV;;;;;OAKG;IACH,QAAQ,CAAC,gBAAgB,EAAE,CACzB,OAAO,EAAE,YAAY,EACrB,QAAQ,EAAE,aAAa,KACpB,OAAO,CAAC;IAEb;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,aAAa,EAAE,CACtB,YAAY,EAAE,YAAY,EAC1B,QAAQ,EAAE,qBAAqB,CAAC,oBAAoB,CAAC,KAClD,IAAI,CAAC,IAAI,EAAE,yBAAyB,CAAC,CAAC;IAE3C;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,EAAE,CACrB,OAAO,EAAE,YAAY,EACrB,SAAS,EAAE,cAAc,KACtB,iBAAiB,CAAC;IAEvB,mDAAmD;IACnD,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,EAAE,YAAY,KAAK,IAAI,CAAC;CACvD;AAED;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED;;;;GAIG;AACH,MAAM,WAAW,iBACf,SAAQ,UAAU,EAAE,KAAK,CAAC,mBAAmB,CAAC;CAAG;AAEnD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,yBAAyB,GAAG,iBAAiB,GAAG,YAAY,CAAC;AAEzE;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG,KAAK,CAAC,aAAa,CAAC,CAAC;AAE5D;;;;GAIG;AACH,eAAO,MAAM,eAAe,kFAA2C,CAAC;AAExE;;;;GAIG;AACH,eAAO,MAAM,eAAe,EAEvB,WAAW,CAAC;AAEjB;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,UAAU,EAAE,eAAe,CAAC;CACtC;AAED;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG,cAAc,GAAG,kBAAkB,CAAC;AAElE;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,eAE9B,CAAC;AACF;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAAG,OAAO,kBAAkB,CAAC;AAE3D;;;;GAIG;AACH,eAAO,MAAM,SAAS;aACpB,WAAW,EAAE,CAAC;aACd,IAAI,EAAE,CAAC;aACP,UAAU,EAAE,CAAC;CACL,CAAC;AAEX;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,SAAS,CAAC,CAAC,MAAM,OAAO,SAAS,CAAC,CAAC;AAEnE;;;;GAIG;AACH,MAAM,WAAW,SAAU,SAAQ,SAAS;IAC1C,QAAQ,CAAC,IAAI,EAAE,OAAO,SAAS,CAAC,IAAI,CAAC;CACtC;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAiB,SAAQ,SAAS;IACjD,QAAQ,CAAC,IAAI,EAAE,OAAO,SAAS,CAAC,WAAW,CAAC;IAC5C,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;CACnC;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAgB,SAAQ,SAAS;IAChD,QAAQ,CAAC,IAAI,EAAE,OAAO,SAAS,CAAC,UAAU,CAAC;IAC3C,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;CACpD;AAED;;;;;GAKG;AACH,MAAM,MAAM,KAAK,GAAG,SAAS,GAAG,gBAAgB,GAAG,eAAe,CAAC;AAEnE;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;CACpC;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,iBAAiB,GAAG,UAAU,GAAG,KAAK,CAAC,mBAAmB,CAAC,CAAC;AAExE;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;CAC3B;AAED;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,OAC5B,EAAE,UACE,MAAM,QACR,MAAM,KACX,WAYD,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,cAAc,w+BAA4C,CAAC;AACxE,MAAM,MAAM,cAAc,GAAG,OAAO,cAAc,CAAC,MAAM,CAAC;AAE1D;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,yjCAgB/B,CAAC;AACF,MAAM,MAAM,mBAAmB,GAAG,OAAO,mBAAmB,CAAC,MAAM,CAAC;AAEpE;;;;GAIG;AACH,MAAM,WAAW,wBAAyB,SAAQ,SAAS,CAAC,qBAAqB,CAAC;IAChF,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;IAC/B,QAAQ,CAAC,cAAc,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAChD;AAED;;;;;GAKG;AACH,eAAO,MAAM,QAAQ,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,OAAO,MAAM,CAAC;IAC9B,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,OAAO,mBAAmB,CAAC;IAC5C,QAAQ,CAAC,QAAQ,EAAE,OAAO,OAAO,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,SAAS,CAAC,OAAO,OAAO,EAAE,OAAO,IAAI,CAAC,CAAC,CAAC;CACtE,CAMC,CAAC;AACH,MAAM,WAAW,QAAS,SAAQ,SAAS,CAAC,OAAO,QAAQ,CAAC;CAAG;AAE/D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,WAAW,iBAAkB,SAAQ,IAAI,CAC7C,OAAO,EACP,kBAAkB,GAAG,eAAe,GAAG,cAAc,CACtD;IACC;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,EAAE,CACxB,OAAO,EAAE,YAAY,EACrB,SAAS,EAAE,cAAc,EACzB,QAAQ,EAAE,8BAA8B,KACrC,OAAO,CAAC;IAEb;;;OAGG;IACH,QAAQ,CAAC,qBAAqB,EAAE,CAC9B,YAAY,EAAE,YAAY,EAC1B,eAAe,EAAE,qBAAqB,CAAC,cAAc,CAAC,KACnD,aAAa,CAAC,cAAc,CAAC,CAAC;CACpC;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,iBAAiB,EAAE,iBAAiB,CAAC;CAC/C;AAED;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,SAAS,CAAC;AAEtD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,uBAAuB,SAC5B,iBAAiB,KACtB,iBAkGD,CAAC;AAMH;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,SAAU,SAAS,KAAG,IAgE/D,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,8BAA8B,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,CAAC;AAE7E;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,cAC1B,cAAc,kBACT,cAAc,iBACf,cAAc,KAC5B,CACD,QAAQ,EAAE,8BAA8B,EACxC,cAAc,EAAE,cAAc,EAC9B,aAAa,EAAE,cAAc,CAS9B,CAAC;AAoeF;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,cAC3B,cAAc,KACxB,WAGF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,eACxB,aAAa,CAAC,cAAc,CAAC,KACxC,WAUE,CAAC;AAqYN;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,SACvB,SAAS,eACN,YAAY,SAAS,cAAc,KAAG,cAgF/C,CAAC;AAEJ;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,SAC3B,SAAS,oBAEA,YAAY,oBACR,cAAc,KAC/B;IACD,QAAQ,CAAC,WAAW,EAAE,cAAc,GAAG,IAAI,CAAC;IAC5C,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,QAAQ,CAAC,aAAa,EAAE,cAAc,CAAC;CA6BxC,CAAC;AAEJ;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,SACpB,SAAS,oBAEA,YAAY,eACb,cAAc,kBACX,cAAc,iBACf,cAAc,KAC5B,IAYF,CAAC"}

package/dist/src/local-first/Storage.js

@@ -119,6 +119,10 @@ export const createBaseSqliteStorage = (deps) => ({
         // A batch can hold hundreds of thousands of timestamps, too many to spread
         // into concatBytes.
         const concatenatedTimestamps = concatByteArrays(timestampsBytes);
+        // A batch has no known size, so unlike the CTEs bounded by
+        // skiplistMaxLevel, the planner would make the owner's timestamps the outer
+        // loop. A cross join keeps the order as written, so each timestamp is
+        // looked up by primary key.
         const result = deps.sqlite.exec(sql `
       with recursive
         split_timestamps(timestampBytes, pos) as (
@@ -135,7 +139,7 @@ export const createBaseSqliteStorage = (deps) => ({
       select s.timestampBytes
       from
         split_timestamps s
-        join evolu_timestamp t
+        cross join evolu_timestamp t
           on t.ownerId = ${ownerIdBytes} and s.timestampBytes = t.t;
     `);
         return result.rows.map((row) => row.timestampBytes);
@@ -183,6 +187,9 @@ export const createBaseSqliteStorage = (deps) => ({
     deleteOwner: (ownerId) => {
         deps.sqlite.exec(sql `
       delete from evolu_timestamp where ownerId = ${ownerId};
+    `);
+        deps.sqlite.exec(sql `
+      delete from evolu_usage where ownerId = ${ownerId};
     `);
     },
 });
@@ -956,6 +963,8 @@ const fingerprint = (deps) => (ownerId, begin, end) => {
  */
 const fingerprintRanges = (deps) => (ownerId, buckets, upperBound = InfiniteUpperBound) => {
     const bucketsJson = JSON.stringify(buckets);
+    // A bucket past the owner's timestamps would descend below level 1
+    // forever, so the walk stops there and the bucket has no row.
     const result = deps.sqlite.exec(sql.prepared `
       with
         ml(ml) as (
@@ -1021,7 +1030,7 @@ const fingerprintRanges = (deps) => (ownerId, buckets, upperBound = InfiniteUppe
             c1
             left join evolu_timestamp as node
               on not c1.b and node.ownerId = ${ownerId} and node.t = c1.nt
-          where iif(c1.b, 1, c1.ic != c1.c)
+          where iif(c1.b, 1, c1.ic != c1.c) and c1.dl >= 1
         ),
         c2(h1, h2, t, rn) as (
           select
@@ -1053,6 +1062,7 @@ const fingerprintRanges = (deps) => (ownerId, buckets, upperBound = InfiniteUppe
       select b, cast(h1 as text) as h1, cast(h2 as text) as h2
       from c3;
     `);
+    assert(result.rows.length === buckets.length, "bucket out of range");
     const fingerprintRanges = result.rows.map((row, i, arr) => ({
         type: RangeType.Fingerprint,
         upperBound: i === arr.length - 1 ? upperBound : row.b,
@@ -1068,9 +1078,13 @@ const x = (a, b) => sql.raw(`(${a} | ${b}) - (${a} & ${b})`);
 /**
  * Reads the timestamp at a position within an owner's ordered timestamps.
  *
+ * Throws when `index` is not below the owner's size.
+ *
  * @group SQLite
  */
 export const getTimestampByIndex = (deps) => (ownerId, index) => {
+    // An index past the owner's timestamps would descend below level 1
+    // forever, so the walk stops there and finds no row.
     const result = deps.sqlite.exec(sql.prepared `
       with
         fi(b, cl, ic, pt, mt, nt, nc) as (
@@ -1136,13 +1150,15 @@ export const getTimestampByIndex = (deps) => (ownerId, index) => {
               )
             )
           from fi
-          where ic != ${index + 1}
+          where ic != ${index + 1} and cl >= 1
         )
       select pt
       from fi
       where ic == ${index + 1};
     `);
-    return result.rows[0].pt;
+    const row = result.rows.at(0);
+    assert(row, "index out of range");
+    return row.pt;
 };
 /**
  * Reads owner usage from SQLite and returns default bounds when absent.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@evolu/common",
-  "version": "8.17.0",
+  "version": "8.19.0",
   "description": "TypeScript library and local-first platform",
   "keywords": [
     "evolu",