@fabrika/db 0.8.2 → 0.9.0-cloudflare.2

package/src/job-leases.ts

@@ -5,9 +5,10 @@
 // containers whose clocks disagree still agree on who holds a lease and when it expires.
 
 import type { LeaseFence } from './capability'
-import { runFixedStatement, type Session, sessionOf } from './database'
+import { runFixedStatement, type Session, sessionOf, type SqlDialect } from './database'
 import { DatabaseError, LeaseLostError, QueryRefusedError } from './errors'
 import { JOB_KICKS_TABLE, JOB_LEASES_TABLE } from './migrations'
+import { SQLITE_NOW_FORMAT } from './migrations-sqlite'
 import type { DataLayerRuntime } from './store'
 
 export type JobOutcome = 'succeeded' | 'failed'
@@ -82,69 +83,166 @@ export interface JobLeases {
 	state(job: string): Promise<JobLeaseState | null>
 }
 
+/** One framework statement in each dialect's text; a session runs the text of its own. */
+export type DialectTexts = Readonly<Record<SqlDialect, string>>
+
+/** SQLite's clock, as a stored timestamp: ISO text, so a comparison of two is a text comparison. */
+export const SQLITE_NOW = `strftime('${SQLITE_NOW_FORMAT}', 'now')`
+
+/** SQLite's clock moved by `ms`, an SQL expression of milliseconds (negative is earlier). */
+export function sqliteNowPlus(ms: string): string {
+	return `strftime('${SQLITE_NOW_FORMAT}', 'now', printf('%+.3f seconds', (${ms}) / 1000.0))`
+}
+
 const T = JOB_LEASES_TABLE
 const MS = `* interval '1 millisecond'`
+const N = SQLITE_NOW
+const SQLITE_RUN_MS = `cast(round((julianday('now') - julianday(last_started_at)) * 86400000) as integer)`
 const QUERY_CANCELED = '57014'
 const IDLE_TIMEOUT = '25P03'
 
 const STATE_COLUMNS =
 	'generation, holder, expires_at, attempt_deadline, first_seen_at, last_started_at, last_finished_at, last_status, last_succeeded_at, last_duration_ms, last_missed_reported_at'
 
-const SQL_NOW = 'select now() as now'
+const SQL_NOW: DialectTexts = {
+	postgres: 'select now() as now',
+	sqlite: `select ${N} as now`,
+}
 
-const SQL_REGISTER = `insert into ${T} (job, generation, holder, expires_at, attempt_deadline, first_seen_at)
-	values ($1, 0, null, now(), now(), now()) on conflict (job) do nothing`
+const SQL_REGISTER: DialectTexts = {
+	postgres: `insert into ${T} (job, generation, holder, expires_at, attempt_deadline, first_seen_at)
+	values ($1, 0, null, now(), now(), now()) on conflict (job) do nothing`,
+	sqlite: `insert into ${T} (job, generation, holder, expires_at, attempt_deadline, first_seen_at)
+	values (?1, 0, null, ${N}, ${N}, ${N}) on conflict (job) do nothing`,
+}
 
-const SQL_REAP = `update ${T} set holder = null, last_status = 'failed', last_finished_at = now(),
+const SQL_REAP: DialectTexts = {
+	postgres: `update ${T} set holder = null, last_status = 'failed', last_finished_at = now(),
 	last_duration_ms = (extract(epoch from now() - last_started_at) * 1000)::int
-	where job = $1 and holder is not null and expires_at <= now() returning job`
+	where job = $1 and holder is not null and expires_at <= now() returning job`,
+	sqlite: `update ${T} set holder = null, last_status = 'failed', last_finished_at = ${N},
+	last_duration_ms = ${SQLITE_RUN_MS}
+	where job = ?1 and holder is not null and expires_at <= ${N} returning job`,
+}
 
-const SQL_ACQUIRE = `insert into ${T} (job, generation, holder, expires_at, attempt_deadline, first_seen_at, last_started_at)
+const SQL_ACQUIRE: DialectTexts = {
+	postgres: `insert into ${T} (job, generation, holder, expires_at, attempt_deadline, first_seen_at, last_started_at)
 	values ($1, 1, $2, now() + $3::bigint ${MS}, now() + $4::bigint ${MS}, now(), now())
 	on conflict (job) do update set generation = ${T}.generation + 1, holder = excluded.holder, expires_at = excluded.expires_at,
 		attempt_deadline = excluded.attempt_deadline, last_started_at = excluded.last_started_at
-	where ${T}.holder is null returning generation`
+	where ${T}.holder is null returning generation`,
+	sqlite: `insert into ${T} (job, generation, holder, expires_at, attempt_deadline, first_seen_at, last_started_at)
+	values (?1, 1, ?2, ${sqliteNowPlus('?3')}, ${sqliteNowPlus('?4')}, ${N}, ${N})
+	on conflict (job) do update set generation = ${T}.generation + 1, holder = excluded.holder, expires_at = excluded.expires_at,
+		attempt_deadline = excluded.attempt_deadline, last_started_at = excluded.last_started_at
+	where ${T}.holder is null returning generation`,
+}
 
-const SQL_RENEW = `update ${T} set generation = generation + 1, holder = $4, expires_at = now() + $5::bigint ${MS},
+const SQL_RENEW: DialectTexts = {
+	postgres: `update ${T} set generation = generation + 1, holder = $4, expires_at = now() + $5::bigint ${MS},
 	attempt_deadline = now() + $6::bigint ${MS}
-	where job = $1 and generation = $2 and holder = $3 and expires_at > now() returning generation`
+	where job = $1 and generation = $2 and holder = $3 and expires_at > now() returning generation`,
+	sqlite: `update ${T} set generation = generation + 1, holder = ?4, expires_at = ${sqliteNowPlus('?5')},
+	attempt_deadline = ${sqliteNowPlus('?6')}
+	where job = ?1 and generation = ?2 and holder = ?3 and expires_at > ${N} returning generation`,
+}
 
-const SQL_FINISH = `update ${T} set holder = null, last_finished_at = now(), last_status = $4,
+const SQL_FINISH: DialectTexts = {
+	postgres: `update ${T} set holder = null, last_finished_at = now(), last_status = $4,
 	last_duration_ms = (extract(epoch from now() - last_started_at) * 1000)::int,
 	last_succeeded_at = case when $4 = 'succeeded' then now() else last_succeeded_at end
-	where job = $1 and generation = $2 and holder = $3 returning job`
+	where job = $1 and generation = $2 and holder = $3 returning job`,
+	sqlite: `update ${T} set holder = null, last_finished_at = ${N}, last_status = ?4,
+	last_duration_ms = ${SQLITE_RUN_MS},
+	last_succeeded_at = case when ?4 = 'succeeded' then ${N} else last_succeeded_at end
+	where job = ?1 and generation = ?2 and holder = ?3 returning job`,
+}
 
-// A free lease whose row no transaction holds (`skip locked`): an attempt's fence holds it `for share` while it writes.
-const SQL_TRY_ACQUIRE = `with free as (select job from ${T} where job = $1 and holder is null for update skip locked)
+const SQL_TRY_ACQUIRE: DialectTexts = {
+	// A free lease whose row no transaction holds (`skip locked`): an attempt's fence holds it `for share` while it writes.
+	postgres: `with free as (select job from ${T} where job = $1 and holder is null for update skip locked)
 	update ${T} set generation = ${T}.generation + 1, holder = $2, expires_at = now() + $3::bigint ${MS},
 		attempt_deadline = now() + $4::bigint ${MS}, last_started_at = now()
-	from free where ${T}.job = free.job returning ${T}.generation`
+	from free where ${T}.job = free.job returning ${T}.generation`,
+	// No lock to skip: while an attempt's fenced transaction is open, the Durable Object serves no kick.
+	sqlite: `update ${T} set generation = generation + 1, holder = ?2, expires_at = ${sqliteNowPlus('?3')},
+		attempt_deadline = ${sqliteNowPlus('?4')}, last_started_at = ${N}
+	where job = ?1 and holder is null returning generation`,
+}
 
 const K = JOB_KICKS_TABLE
 
-const SQL_MARK_PENDING = `insert into ${K} (job, pending) values ($1, true) on conflict (job) do update set pending = true where ${K}.pending = false`
+const SQL_MARK_PENDING: DialectTexts = {
+	postgres: `insert into ${K} (job, pending) values ($1, true) on conflict (job) do update set pending = true where ${K}.pending = false`,
+	sqlite: `insert into ${K} (job, pending) values (?1, 1) on conflict (job) do update set pending = 1 where ${K}.pending = 0`,
+}
 
-const SQL_TAKE_PENDING = `update ${K} set pending = false where job = $1 and pending returning job`
+const SQL_TAKE_PENDING: DialectTexts = {
+	postgres: `update ${K} set pending = false where job = $1 and pending returning job`,
+	sqlite: `update ${K} set pending = 0 where job = ?1 and pending = 1 returning job`,
+}
 
-const SQL_CLAIM_OVERDUE = `update ${T} set last_missed_reported_at = now()
+const SQL_CLAIM_OVERDUE: DialectTexts = {
+	postgres: `update ${T} set last_missed_reported_at = now()
 	where job = $1 and coalesce(last_succeeded_at, first_seen_at) < now() - 2 * $2::bigint ${MS}
 		and (last_missed_reported_at is null or last_missed_reported_at <= now() - $2::bigint ${MS})
-	returning last_succeeded_at, first_seen_at`
+	returning last_succeeded_at, first_seen_at`,
+	sqlite: `update ${T} set last_missed_reported_at = ${N}
+	where job = ?1 and coalesce(last_succeeded_at, first_seen_at) < ${sqliteNowPlus('-2 * ?2')}
+		and (last_missed_reported_at is null or last_missed_reported_at <= ${sqliteNowPlus('-?2')})
+	returning last_succeeded_at, first_seen_at`,
+}
 
-// Inside a mutation's transaction, so `clock_timestamp()`: `now()` is when the transaction began.
-const SQL_FENCE = `select pg_backend_pid() as pid, transaction_timestamp()::text as began,
+const SQL_STILL_HELD: DialectTexts = {
+	postgres: `select job from ${T} where job = $1 and generation = $2 and holder = $3 and attempt_deadline > clock_timestamp()`,
+	sqlite: `select job from ${T} where job = ?1 and generation = ?2 and holder = ?3 and attempt_deadline > ${N}`,
+}
+
+const SQL_FENCE: DialectTexts = {
+	// Inside a mutation's transaction, so `clock_timestamp()`: `now()` is when the transaction began.
+	postgres: `select pg_backend_pid() as pid, transaction_timestamp()::text as began,
 	greatest(1, ceil(extract(epoch from attempt_deadline - clock_timestamp()) * 1000))::int as remaining_ms
-	from ${T} where job = $1 and generation = $2 and holder = $3 and attempt_deadline > clock_timestamp() for share`
+	from ${T} where job = $1 and generation = $2 and holder = $3 and attempt_deadline > clock_timestamp() for share`,
+	// No lock: while the transaction is open the Durable Object serves no other event, so no takeover runs before it ends.
+	sqlite: SQL_STILL_HELD.sqlite,
+}
 
-// The attempt's remaining time bounds a statement and an idle wait alike: either past the deadline ends the transaction.
+// Postgres only. The attempt's remaining time bounds a statement and an idle wait alike: either past the deadline ends it.
 const SQL_TIMEOUTS = `select set_config('statement_timeout', $1, true), set_config('idle_in_transaction_session_timeout', $1, true)`
 
-const SQL_STILL_HELD = `select job from ${T} where job = $1 and generation = $2 and holder = $3 and attempt_deadline > clock_timestamp()`
-
-// Only the backend still in the transaction the fence opened: a pid the pool reused for other work is left alone.
+// Postgres only. Only the backend still in the transaction the fence opened: a pid the pool reused is left alone.
 const SQL_CANCEL = `select pg_cancel_backend(pid) from pg_stat_activity where pid = $1 and xact_start = $2::timestamptz`
 
-const SQL_STATE = `select now() as now, ${STATE_COLUMNS} from ${T} where job = $1`
+const SQL_STATE: DialectTexts = {
+	postgres: `select now() as now, ${STATE_COLUMNS} from ${T} where job = $1`,
+	sqlite: `select ${N} as now, ${STATE_COLUMNS} from ${T} where job = ?1`,
+}
+
+/** The columns that hold a time; SQLite answers each as ISO text, which the row's entry reads as a `Date`. */
+const TIMESTAMP_COLUMNS: ReadonlySet<string> = new Set([
+	'now',
+	'expires_at',
+	'attempt_deadline',
+	'first_seen_at',
+	'last_started_at',
+	'last_finished_at',
+	'last_succeeded_at',
+	'last_missed_reported_at',
+])
+
+const ISO_TIMESTAMP = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/
+
+/** A stored SQLite timestamp (`SQLITE_NOW_FORMAT`) as a `Date`, or `null`; anything else is refused. */
+export function sqliteTimestamp(value: unknown, what: string): Date | null {
+	if (value === null) {
+		return null
+	}
+	const parsed = typeof value === 'string' && ISO_TIMESTAMP.test(value) ? new Date(value) : undefined
+	if (parsed === undefined || Number.isNaN(parsed.getTime())) {
+		throw new QueryRefusedError('unexpected_row', `${what} is not a stored timestamp`)
+	}
+	return parsed
+}
 
 function record(row: unknown): Readonly<Record<string, unknown>> {
 	if (typeof row !== 'object' || row === null) {
@@ -153,8 +251,19 @@ function record(row: unknown): Readonly<Record<string, unknown>> {
 	return Object.fromEntries(Object.entries(row))
 }
 
-async function rows(session: Session, text: string, parameters: readonly (string | number | null)[]): Promise<Readonly<Record<string, unknown>>[]> {
-	return (await runFixedStatement(session, text, parameters)).map(record)
+async function rows(
+	session: Session,
+	texts: DialectTexts,
+	parameters: readonly (string | number | null)[],
+): Promise<Readonly<Record<string, unknown>>[]> {
+	const found = (await runFixedStatement(session, texts[session.dialect], parameters)).map(record)
+	return session.dialect === 'sqlite' ? found.map(sqliteRow) : found
+}
+
+function sqliteRow(row: Readonly<Record<string, unknown>>): Readonly<Record<string, unknown>> {
+	return Object.fromEntries(
+		Object.entries(row).map(([name, value]) => [name, TIMESTAMP_COLUMNS.has(name) ? sqliteTimestamp(value, `${T}.${name}`) : value]),
+	)
 }
 
 function integer(row: Readonly<Record<string, unknown>>, name: string): number {
@@ -254,7 +363,10 @@ function refuseEnded(fence: LeaseFence): void {
 	}
 }
 
-const SQL_CLOCK = 'select clock_timestamp() as now'
+const SQL_CLOCK: DialectTexts = {
+	postgres: 'select clock_timestamp() as now',
+	sqlite: `select ${N} as now`,
+}
 
 /**
  * The database's clock inside `session`'s transaction: a queue claim compares and moves `due` by it, so no process
@@ -275,6 +387,7 @@ const params = (fence: LeaseFence): (string | number)[] => [fence.job, fence.gen
  * stays locked `for share` until the commit (a takeover or a renewal waits), and every statement is bounded by the
  * attempt's remaining time. After it, just before the commit: the attempt still holds the lease within its deadline.
  * Otherwise the transaction rolls back with `LeaseLostError`; so does a statement the deadline or the runner cancelled.
+ * On SQLite only the two checks run: no other event reaches the Durable Object while the transaction is open.
  */
 export async function fencedTransaction<T>(session: Session, fence: LeaseFence, work: (transaction: Session) => Promise<T>): Promise<T> {
 	refuseEnded(fence)
@@ -285,12 +398,19 @@ export async function fencedTransaction<T>(session: Session, fence: LeaseFence,
 			if (held === undefined) {
 				throw lost(fence)
 			}
-			backend = { pid: integer(held, 'pid'), began: text(held, 'began') }
-			const running = inFlight.get(fence) ?? new Set<Backend>()
-			running.add(backend)
-			inFlight.set(fence, running)
+			// SQLite has no backend to cancel and no statement timeout: the check before the commit refuses a late attempt,
+			// and a Durable Object resets a transaction that runs past its own limit.
+			const postgres = transaction.dialect === 'postgres'
+			if (postgres) {
+				backend = { pid: integer(held, 'pid'), began: text(held, 'began') }
+				const running = inFlight.get(fence) ?? new Set<Backend>()
+				running.add(backend)
+				inFlight.set(fence, running)
+			}
 			refuseEnded(fence)
-			await rows(transaction, SQL_TIMEOUTS, [String(integer(held, 'remaining_ms'))])
+			if (postgres) {
+				await runFixedStatement(transaction, SQL_TIMEOUTS, [String(integer(held, 'remaining_ms'))])
+			}
 			const result = await work(transaction)
 			refuseEnded(fence)
 			if ((await rows(transaction, SQL_STILL_HELD, params(fence))).length === 0) {
@@ -368,11 +488,11 @@ export function jobLeases(runtime: () => DataLayerRuntime): JobLeases {
 		async cancelInFlight(fence: LeaseFence): Promise<void> {
 			ended.add(fence)
 			// The transaction rolls back and gives its connection back now, even while its work waits on something else;
-			// a statement still running is cancelled, so the ROLLBACK queued behind it runs.
+			// a statement still running is cancelled, so the ROLLBACK queued behind it runs. SQLite records no backend.
 			stopOf(fence).abort(lost(fence))
 			const running = [...(inFlight.get(fence) ?? [])]
 			for (const backend of running) {
-				await rows(session(), SQL_CANCEL, [backend.pid, backend.began])
+				await runFixedStatement(session(), SQL_CANCEL, [backend.pid, backend.began])
 			}
 		},
 

package/src/links.ts

@@ -57,5 +57,12 @@ export function linkValues(table: string, links: readonly Container[], grant: Re
 }
 
 export function linksPredicate(table: string, values: readonly LinkValue[]): OperationNode {
-	return allOf(values.map(({ link, value }) => equals(table, link.column, value)))
+	const terms: OperationNode[] = []
+	for (let index = 0; index < values.length; index++) {
+		const entry = values[index]
+		if (entry !== undefined) {
+			terms[terms.length] = equals(table, entry.link.column, entry.value)
+		}
+	}
+	return allOf(terms)
 }

package/src/migrations-sqlite.ts

@@ -0,0 +1,132 @@
+// @fabrika/db/migrations-sqlite — the framework's own tables in an application's SQLite database, a Cloudflare
+// Durable Object's (ADR-0065). The same tables and columns as the Postgres bundle in `migrations.ts`, without the
+// history a Postgres schema carries: no form files and no adoption of collection tables, which no SQLite database
+// ever had. Plain data, applied as the bundle `fabrika` before the application's `app` bundle.
+//
+// The SQLite forms of the column types, which every framework statement and the row reads rely on:
+// - a timestamp is TEXT in UTC, `YYYY-MM-DDTHH:MM:SS.sssZ`: what `strftime(SQLITE_NOW_FORMAT, 'now')` and
+//   `Date#toISOString()` both write, so text order is time order;
+// - a boolean is INTEGER 0 or 1; a UUID is TEXT; a BIGINT is INTEGER.
+
+import {
+	FILE_DELETIONS_TABLE,
+	FILES_TABLE,
+	FORM_ADMISSIONS_TABLE,
+	FORM_BYTES_TABLE,
+	FORM_CHALLENGES_TABLE,
+	type FrameworkMigration,
+	JOB_KICKS_TABLE,
+	JOB_LEASES_TABLE,
+	WEBHOOK_BINDINGS_TABLE,
+	WEBHOOK_DELIVERIES_TABLE,
+} from './migrations'
+
+/** The `strftime` format of a stored timestamp; `strftime(SQLITE_NOW_FORMAT, 'now')` is the database's clock. */
+export const SQLITE_NOW_FORMAT = '%Y-%m-%dT%H:%M:%fZ'
+
+export const SQLITE_FRAMEWORK_MIGRATIONS: readonly FrameworkMigration[] = Object.freeze([
+	Object.freeze({
+		name: '0001_framework.sql',
+		sql: `-- A binding admits deliveries for one scope value from one provider account, signed with its own secret.
+CREATE TABLE ${WEBHOOK_BINDINGS_TABLE} (
+	id TEXT PRIMARY KEY,
+	webhook TEXT NOT NULL,
+	scope_type TEXT NOT NULL,
+	scope_value TEXT NOT NULL,
+	account TEXT NOT NULL,
+	secret TEXT NOT NULL,
+	created_by TEXT NOT NULL,
+	created_at INTEGER NOT NULL
+) STRICT;
+
+-- GitHub signs no timestamp, so a recorded delivery id is the replay defence. A delivery is claimed with a lease and
+-- completed in its handler's transaction, which clears the lease.
+CREATE TABLE ${WEBHOOK_DELIVERIES_TABLE} (
+	binding_id TEXT NOT NULL REFERENCES ${WEBHOOK_BINDINGS_TABLE} (id) ON DELETE CASCADE,
+	delivery_id TEXT NOT NULL,
+	received_at INTEGER NOT NULL,
+	lease_until INTEGER,
+	PRIMARY KEY (binding_id, delivery_id)
+) STRICT;
+
+-- One row per job: the lease a run takes, fenced by its generation, and the outcome of the last run.
+CREATE TABLE ${JOB_LEASES_TABLE} (
+	job TEXT PRIMARY KEY,
+	generation INTEGER NOT NULL,
+	holder TEXT,
+	expires_at TEXT NOT NULL,
+	attempt_deadline TEXT NOT NULL,
+	first_seen_at TEXT NOT NULL,
+	last_started_at TEXT,
+	last_finished_at TEXT,
+	last_status TEXT,
+	last_succeeded_at TEXT,
+	last_duration_ms INTEGER,
+	last_missed_reported_at TEXT
+) STRICT;
+
+-- Whether a kick arrived after the job's current run started: that run runs the job once more after it succeeded.
+CREATE TABLE ${JOB_KICKS_TABLE} (
+	job TEXT PRIMARY KEY,
+	pending INTEGER NOT NULL CHECK (pending IN (0, 1))
+) STRICT;
+
+-- A form's admission counters, one row per form, bucket and minute; a row of a past minute is pruned by the next
+-- admission.
+CREATE TABLE ${FORM_ADMISSIONS_TABLE} (
+	form TEXT NOT NULL,
+	bucket TEXT NOT NULL,
+	window_start TEXT NOT NULL,
+	count INTEGER NOT NULL,
+	PRIMARY KEY (form, bucket, window_start)
+) STRICT;
+CREATE INDEX ${FORM_ADMISSIONS_TABLE}_window_start ON ${FORM_ADMISSIONS_TABLE} (window_start);
+
+-- The digest of each challenge token a form accepted, until the token could no longer verify: a replay is refused.
+CREATE TABLE ${FORM_CHALLENGES_TABLE} (
+	form TEXT NOT NULL,
+	token_digest TEXT NOT NULL,
+	expires_at TEXT NOT NULL,
+	PRIMARY KEY (form, token_digest)
+) STRICT;
+CREATE INDEX ${FORM_CHALLENGES_TABLE}_expires_at ON ${FORM_CHALLENGES_TABLE} (expires_at);
+
+-- The bytes a form's files may write per hour: one row per form and hour, which the next reservation of a later hour
+-- prunes.
+CREATE TABLE ${FORM_BYTES_TABLE} (
+	form TEXT NOT NULL,
+	window_start TEXT NOT NULL,
+	bytes INTEGER NOT NULL,
+	PRIMARY KEY (form, window_start)
+) STRICT;
+
+-- Every stored file: a value a table's file column references by id. A row is 'pending' from before its object
+-- (<kind>/<id>) is written until the first reference claims it, then 'quarantined' (a scanning kind) or 'live'.
+CREATE TABLE ${FILES_TABLE} (
+	id TEXT PRIMARY KEY,
+	kind TEXT NOT NULL,
+	status TEXT NOT NULL CONSTRAINT ${FILES_TABLE}_status CHECK (status IN ('pending', 'quarantined', 'live', 'rejected')),
+	object_key TEXT NOT NULL UNIQUE,
+	size INTEGER,
+	sha256 TEXT,
+	content_type TEXT NOT NULL,
+	name TEXT,
+	scope TEXT,
+	request TEXT,
+	created_at TEXT NOT NULL,
+	object_version TEXT,
+	scan_attempts INTEGER NOT NULL DEFAULT 0,
+	scan_after TEXT,
+	legacy TEXT
+) STRICT;
+CREATE INDEX ${FILES_TABLE}_created_at ON ${FILES_TABLE} (created_at) WHERE legacy IS NULL;
+CREATE INDEX ${FILES_TABLE}_scan ON ${FILES_TABLE} (scan_after) WHERE status = 'quarantined';
+
+-- An object whose file row is deleted, until the object is: the sweep finishes a deletion a crash interrupted.
+CREATE TABLE ${FILE_DELETIONS_TABLE} (
+	object_key TEXT PRIMARY KEY,
+	recorded_at TEXT NOT NULL
+) STRICT;
+`,
+	}),
+])

package/src/nodes.ts

@@ -38,6 +38,7 @@ import {
 	WhereNode,
 } from 'kysely'
 import { inSet, type NameSet, nameSet, namesOf } from './builtins'
+import type { SqlDialect } from './database'
 import type { Compare, Condition, Contains, JoinState, Primitive, SelectState } from './description'
 import { QueryRefusedError } from './errors'
 
@@ -49,31 +50,55 @@ export function equals(table: string, name: string, value: Primitive): Operation
 	return BinaryOperationNode.create(column(table, name), OperatorNode.create('='), ValueNode.create(value))
 }
 
+// The scope predicates are built through these, so they read their nodes by index, never through an iterator or a method.
 export function allOf(nodes: readonly OperationNode[]): OperationNode {
-	const [first, ...rest] = nodes
-	if (first === undefined) {
+	let joined = nodes[0]
+	if (joined === undefined) {
 		throw new QueryRefusedError('statement_shape', 'an empty conjunction')
 	}
-	return rest.reduce<OperationNode>((left, right) => AndNode.create(left, right), first)
+	for (let index = 1; index < nodes.length; index++) {
+		const node = nodes[index]
+		if (node !== undefined) {
+			joined = AndNode.create(joined, node)
+		}
+	}
+	return joined
 }
 
 /** One node, or the OR of several in a parenthesis: inside an AND, `a and b or c` would read as `(a and b) or c`. */
 export function anyOf(nodes: readonly OperationNode[]): OperationNode {
-	const [first, ...rest] = nodes
-	if (first === undefined) {
+	let joined = nodes[0]
+	if (joined === undefined) {
 		throw new QueryRefusedError('statement_shape', 'an empty disjunction')
 	}
-	return rest.length === 0 ? first : ParensNode.create(rest.reduce<OperationNode>((left, right) => OrNode.create(left, right), first))
+	for (let index = 1; index < nodes.length; index++) {
+		const node = nodes[index]
+		if (node !== undefined) {
+			joined = OrNode.create(joined, node)
+		}
+	}
+	return nodes.length === 1 ? joined : ParensNode.create(joined)
 }
 
 export function inList(table: string, name: string, values: readonly string[]): OperationNode {
 	return BinaryOperationNode.create(
 		column(table, name),
 		OperatorNode.create('in'),
-		ValueListNode.create(values.map((value) => ValueNode.create(value))),
+		ValueListNode.create(valueNodes(values)),
 	)
 }
 
+function valueNodes(values: readonly string[]): ValueNode[] {
+	const nodes: ValueNode[] = []
+	for (let index = 0; index < values.length; index++) {
+		const value = values[index]
+		if (value !== undefined) {
+			nodes[nodes.length] = ValueNode.create(value)
+		}
+	}
+	return nodes
+}
+
 /** The scope of a `Within` that is not limited to scope values. */
 export function everything(): OperationNode {
 	return ValueNode.createImmediate(true)
@@ -167,6 +192,15 @@ function joinedSelections(join: JoinState): SelectionNode[] {
 	return columns.map((name) => SelectionNode.create(AliasNode.create(column(child, name), IdentifierNode.create(`${child}.${name}`))))
 }
 
+/**
+ * One order term. Postgres sorts nulls last ascending and first descending; SQLite the other way, so on SQLite the term
+ * states Postgres's order and a keyset page (`orm.ts`) reads the same rows after its cursor on both.
+ */
+function orderItem(table: string, order: SelectState['orderBy'][number], dialect: SqlDialect): OrderByItemNode {
+	const item = OrderByItemNode.create(column(table, order.column), RawNode.createWithSql(order.direction))
+	return dialect === 'postgres' ? item : Object.freeze({ ...item, nulls: order.direction === 'asc' ? 'last' : 'first' })
+}
+
 /** `after` is a keyset page's position, ANDed to the caller's conditions inside their parenthesis. */
 export function selectNode(
 	state: SelectState,
@@ -174,12 +208,13 @@ export function selectNode(
 	scope: OperationNode,
 	after?: OperationNode,
 	days: NameSet = NO_DAYS,
+	dialect: SqlDialect = 'postgres',
 ): SelectQueryNode {
 	const table = state.table
 	const columns = state.columns ?? visible
 	const conditions = conditionsNode(table, state.conditions)
 	const filter = after === undefined ? conditions : conditions === undefined ? after : AndNode.create(conditions, ParensNode.create(after))
-	const orderBy = state.orderBy.map((order) => OrderByItemNode.create(column(table, order.column), RawNode.createWithSql(order.direction)))
+	const orderBy = state.orderBy.map((order) => orderItem(table, order, dialect))
 	const node: SelectQueryNode = {
 		kind: 'SelectQueryNode',
 		from: FromNode.create([TableNode.create(table)]),
@@ -352,6 +387,7 @@ export function claimNode(
 	due: { readonly due: string; readonly attempts: string; readonly now: Date; readonly maxAttempts: number },
 	scope: OperationNode,
 	days: NameSet,
+	dialect: SqlDialect = 'postgres',
 ): SelectQueryNode {
 	const table = state.table
 	const waiting = allOf([
@@ -359,7 +395,7 @@ export function claimNode(
 		BinaryOperationNode.create(column(table, due.due), OperatorNode.create('<='), ValueNode.create(due.now)),
 		BinaryOperationNode.create(column(table, due.attempts), OperatorNode.create('<'), ValueNode.create(due.maxAttempts)),
 	])
-	const node = selectNode(state, columns, scope, waiting, days)
+	const node = selectNode(state, columns, scope, waiting, days, dialect)
 	return Object.freeze({ ...node, endModifiers: [SelectModifierNode.create('ForUpdate'), SelectModifierNode.create('SkipLocked')] })
 }