@happyvertical/smrt-core 0.40.70 → 0.42.0

package/dist/cascade.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cascade.js","names":[],"sources":["../src/cascade.ts"],"sourcesContent":["/**\n * App-side referential integrity for `SmrtObject.delete()` (#2371).\n *\n * SMRT emits **no** DB-level `FOREIGN KEY` constraints on any engine, so the\n * database will never clean up after a deleted row. Before this module,\n * `delete()` removed the object's own row and nothing else: junction rows,\n * polymorphic association rows, `_smrt_embeddings` and `_smrt_contexts` entries\n * were all left pointing at an id that no longer resolved, and\n * `@foreignKey(..., { onDelete })` was metadata nobody read.\n *\n * This module implements those semantics in the application layer. It mirrors\n * what a DB-level constraint would do, deliberately including the parts that\n * make it *unlike* a model-layer delete:\n *\n * - Cascaded rows are removed with set-based statements. Their `beforeDelete` /\n *   `afterDelete` hooks and interceptors do **not** run, and no change-feed\n *   tombstone is written for them — exactly as `ON DELETE CASCADE` behaves.\n *   Only the object `delete()` was called on runs the full lifecycle.\n * - When anything needs cascading, everything runs inside a single\n *   transaction when the adapter exposes one, so a partial cascade cannot\n *   survive a failure. A class with no typed references AND no registered\n *   polymorphic association class anywhere in the process skips the\n *   transaction — see {@link runCascadeDelete}. A `metaType` column can point\n *   at any class at runtime, so a polymorphic association class is always\n *   plausibly relevant; in an app with even one registered, this fast path is\n *   rare, not the common case.\n *\n * ## Which references are followed\n *\n * A reference is any `@foreignKey` / `@crossPackageRef` field on a registered\n * class whose target resolves to the deleted object's class (or one of its\n * registered STI ancestors), plus the polymorphic `(metaType, metaId)` pair on\n * {@link SmrtPolymorphicAssociation} subclasses.\n *\n * The action comes from the field's declared `onDelete`. When it is not\n * declared, the default is derived from the referencing class's natural key:\n *\n * | Reference | Default when `onDelete` is absent |\n * |---|---|\n * | Column is part of the referencing class's `conflictColumns`, and is not a `@tenantId()` field | `CASCADE` |\n * | Polymorphic `(metaType, metaId)` association row | `CASCADE` |\n * | Anything else, including every `@tenantId()` field | `NO ACTION` (legacy behaviour — the row is left alone) |\n *\n * The natural-key rule is what makes junction rows work without any\n * per-package annotation: a junction declares\n * `@smrt({ conflictColumns: ['content_id', 'asset_id', 'relationship'] })`, so\n * `content_id` identifies the row and the row cannot outlive the content it\n * links. An ordinary child (`Order.customerId`) is keyed by `(slug, context)`,\n * so it keeps today's behaviour unless it opts in with\n * `@foreignKey(Customer, { onDelete: 'CASCADE' })`.\n *\n * `@tenantId()` fields are excluded from the natural-key rule even though\n * `@happyvertical/smrt-tenancy` leads a tenant-scoped class's *default*\n * `conflictColumns` with the tenant column (#2360): the tenant column scopes\n * ownership, it does not identify the row the way a junction's foreign key\n * does, and it targets a class (`Tenant`) that is virtually always\n * referenced. Without this exclusion, deleting one `Tenant` row would\n * recursively CASCADE through every tenant-scoped table that has not\n * declared its own `conflictColumns` — the overwhelming majority. The field\n * is detected via the `__tenancy.isTenantIdField` marker `@tenantId()`\n * attaches to its own registration (`FieldMeta.__tenancy`, read structurally\n * so `smrt-core` never depends on `smrt-tenancy`). `@tenantId()` exposes no\n * `onDelete` option today, so this cannot currently be overridden per field.\n *\n * @see https://github.com/happyvertical/smrt/issues/2371\n * @module\n */\n\nimport { createLogger } from '@happyvertical/logger';\nimport type { DatabaseInterface } from '@happyvertical/sql';\nimport { classifyDatabaseError } from './db-errors.js';\nimport { ConfigurationError, DatabaseError } from './errors.js';\n// Type-only: erased at runtime, so it cannot re-enter the\n// `registry → object → cascade` import cycle.\nimport type { ObjectRegistry } from './registry.js';\nimport { chunkArray, IN_LIST_CHUNK_SIZE } from './utils/chunk.js';\nimport { toSnakeCase } from './utils/naming.js';\n\nconst logger = createLogger({ level: 'info' });\n\n/**\n * Referential action applied to rows pointing at a deleted object.\n *\n * Same vocabulary as SQL's `ON DELETE`, enforced by the framework instead of\n * the engine. `NO ACTION` means \"leave the rows alone\" — SMRT emits no\n * constraint, so nothing raises.\n */\nexport type OnDeleteAction = 'CASCADE' | 'SET NULL' | 'RESTRICT' | 'NO ACTION';\n\n/** Table holding framework-managed per-object memory entries. */\nconst CONTEXTS_TABLE = '_smrt_contexts';\n\n/** Table holding framework-managed per-object embedding vectors. */\nconst EMBEDDINGS_TABLE = '_smrt_embeddings';\n\n/**\n * Reserved `_smrt_contexts.owner_id` used by `SmrtCollection.remember()` for\n * collection-scoped memory. A real object id is a UUID and can never equal it,\n * but the guard keeps a malformed id from wiping every sibling's defaults.\n */\nconst COLLECTION_OWNER_SENTINEL = '__collection__';\n\n/**\n * Maximum number of cascade levels followed from the object `delete()` was\n * called on. A cycle between two classes that both declare `onDelete: 'CASCADE'`\n * is broken by the visited set; this bound catches unbounded *chains*.\n */\nconst MAX_CASCADE_DEPTH = 10;\n\n/** One reference that must be resolved before the target row can be removed. */\nexport interface CascadeReference {\n  /** Registered name of the class holding the referencing column. */\n  className: string;\n  /** Table holding the referencing rows. */\n  tableName: string;\n  /** Field name (camelCase) on the referencing class. */\n  fieldName: string;\n  /** Column (snake_case) holding the reference. */\n  column: string;\n  /** Resolved action, never `NO ACTION` (those are dropped from the plan). */\n  action: Exclude<OnDeleteAction, 'NO ACTION'>;\n  /** `true` when the action was declared rather than derived from the key. */\n  declared: boolean;\n}\n\n/** A polymorphic association table that can point at any class. */\nexport interface CascadePolymorphicReference {\n  /** Registered name of the association class. */\n  className: string;\n  /** Table holding the association rows. */\n  tableName: string;\n}\n\n/** Everything that must happen before rows of one class can be deleted. */\nexport interface CascadePlan {\n  /** Typed `@foreignKey` / `@crossPackageRef` references, action-resolved. */\n  references: CascadeReference[];\n  /** Polymorphic association tables that may point at this class. */\n  polymorphic: CascadePolymorphicReference[];\n  /** `meta_type` values that identify this class in an association row. */\n  metaTypes: string[];\n  /** `true` when nothing references this class and nothing has to be visited. */\n  isEmpty: boolean;\n}\n\n/**\n * Read-only slice of `ObjectRegistry` this module needs.\n *\n * Taking it as a parameter — rather than importing the registry as a value —\n * keeps `cascade.ts` out of the `registry → object → cascade` import cycle,\n * and lets tests drive the planner from a hand-built registry.\n */\nexport type CascadeRegistryView = Pick<\n  typeof ObjectRegistry,\n  | 'getRelationshipMap'\n  | 'getFields'\n  | 'getConflictColumns'\n  | 'getTableName'\n  | 'getSelfReferableNames'\n  | 'getClass'\n  | 'getSTIBase'\n  | 'getDescendants'\n>;\n\nconst CASCADE_ACTIONS = new Set<OnDeleteAction>([\n  'CASCADE',\n  'SET NULL',\n  'RESTRICT',\n  'NO ACTION',\n]);\n\n/**\n * Normalize a declared `onDelete` value.\n *\n * Accepts any casing and both `SET NULL` and `SET_NULL`, matching what the\n * schema generator has always carried in the manifest. Returns `undefined` for\n * an unset or unrecognized value so the caller can fall back to the default.\n */\nexport function normalizeOnDelete(value: unknown): OnDeleteAction | undefined {\n  if (typeof value !== 'string') return undefined;\n  const normalized = value.trim().toUpperCase().replace(/_/g, ' ');\n  return CASCADE_ACTIONS.has(normalized as OnDeleteAction)\n    ? (normalized as OnDeleteAction)\n    : undefined;\n}\n\nfunction isPolymorphicAssociationClass(fields: Map<string, unknown>): boolean {\n  // The three columns `SmrtPolymorphicAssociation` contributes. Requiring all\n  // of them keeps an unrelated class that happens to carry a `metaType` from\n  // being treated as an association table.\n  return fields.has('metaType') && fields.has('metaId') && fields.has('role');\n}\n\n/**\n * Build the cascade plan for one class.\n *\n * The plan is derived entirely from registry metadata, so it is valid for any\n * database the class is used against. It is rebuilt per delete rather than\n * cached: registration is incremental (manifests load lazily, tests register\n * classes between cases) and a stale plan would silently skip a table.\n *\n * @param registry - Registry view (`ObjectRegistry` satisfies it)\n * @param className - Class whose incoming references should be resolved\n */\nexport function buildCascadePlan(\n  registry: CascadeRegistryView,\n  className: string,\n): CascadePlan {\n  // `className` is normally already qualified (delete() passes\n  // getResolvedQualifiedName()), but a common same-package `@foreignKey('X')`\n  // still stores its target as the bare simple name `X`. That still matches:\n  // getSelfReferableNames() walks the full ancestor chain (self included) and\n  // adds each ancestor's *simple* name via `getClass(ancestor)?.name`, so the\n  // simple form is already in the seed set below, not just the loop's\n  // qualified-variant augmentation.\n  const targetNames = new Set(registry.getSelfReferableNames(className));\n  for (const name of [...targetNames]) {\n    const qualified = registry.getClass(name)?.qualifiedName;\n    if (qualified) targetNames.add(qualified);\n  }\n\n  const references: CascadeReference[] = [];\n  const polymorphic: CascadePolymorphicReference[] = [];\n\n  for (const [sourceClass, relationships] of registry.getRelationshipMap()) {\n    const fields = registry.getFields(sourceClass);\n\n    if (isPolymorphicAssociationClass(fields)) {\n      const tableName = registry.getTableName(sourceClass);\n      if (tableName) {\n        polymorphic.push({ className: sourceClass, tableName });\n      }\n    }\n\n    if (relationships.length === 0) continue;\n\n    let conflictColumns: Set<string> | undefined;\n\n    for (const relationship of relationships) {\n      if (\n        relationship.type !== 'foreignKey' &&\n        relationship.type !== 'crossPackageRef'\n      ) {\n        continue;\n      }\n      if (!targetNames.has(relationship.targetClass)) continue;\n\n      const tableName = registry.getTableName(sourceClass);\n      if (!tableName) continue;\n\n      const column = toSnakeCase(relationship.fieldName);\n      const declaredAction = normalizeOnDelete(relationship.options?.onDelete);\n\n      if (!conflictColumns) {\n        conflictColumns = new Set(registry.getConflictColumns(sourceClass));\n      }\n\n      // A `@tenantId()` field is a structural scoping marker, not a\n      // junction/ownership key — it lands in `conflictColumns` only because\n      // #2360 leads every tenant-scoped class's *default* natural key with\n      // the tenant column, not because the referencing row is *identified*\n      // by its tenant the way a junction row is identified by its parent.\n      // Without this guard, deleting a `Tenant` would silently CASCADE\n      // through the tenant column of every tenant-scoped class in the\n      // schema that has not declared its own `conflictColumns` — the\n      // overwhelming majority. `@tenantId()` exposes no `onDelete` today, so\n      // an explicit declaration can never widen this back to CASCADE; that\n      // is deliberate until tenant-delete cascade is an explicit decision.\n      const isTenantIdField =\n        relationship.options?.__tenancy?.isTenantIdField === true;\n\n      const action =\n        declaredAction ??\n        (!isTenantIdField && conflictColumns.has(column)\n          ? 'CASCADE'\n          : 'NO ACTION');\n\n      if (action === 'NO ACTION') continue;\n\n      if (\n        action === 'SET NULL' &&\n        fields.get(relationship.fieldName)?.required\n      ) {\n        // Fail on the declaration, not later on a NOT NULL violation from the\n        // engine — the message there names a column, not the decorator.\n        throw ConfigurationError.invalidConfiguration(\n          `${sourceClass}.${relationship.fieldName} onDelete: 'SET NULL'`,\n          relationship.fieldName,\n          \"a nullable field (mark it `nullable: true`, or use 'CASCADE' / 'RESTRICT')\",\n        );\n      }\n\n      references.push({\n        className: sourceClass,\n        tableName,\n        fieldName: relationship.fieldName,\n        column,\n        action,\n        declared: declaredAction !== undefined,\n      });\n    }\n  }\n\n  // Both forms are matched deliberately: an association row written before a\n  // class was package-qualified still carries the simple `meta_type`. The\n  // qualified form alone is unambiguous; the simple-name fallback can still\n  // match a same-simple-name sibling class's row if it also shares a\n  // `meta_id` — a real, not just theoretical, risk for a class declaring\n  // `idType: 'text'` (non-UUID, not guaranteed globally unique), the same gap\n  // `deleteSystemRows()` closed for `_smrt_contexts` / `_smrt_embeddings`\n  // (review fix) by adding a class-name filter. Closing it here needs the\n  // same STI-and-legacy-name-aware filter this module already builds for\n  // `deleteSystemRows()` narrowed further to registry-unambiguous simple\n  // names; tracked under #2419 alongside the other same-simple-name\n  // collision gaps rather than reworked here.\n  const metaTypes: string[] = [];\n  const qualified = registry.getClass(className)?.qualifiedName;\n  if (qualified) metaTypes.push(qualified);\n  const simple = registry.getClass(className)?.name ?? className;\n  if (!metaTypes.includes(simple)) metaTypes.push(simple);\n\n  return {\n    references,\n    polymorphic,\n    metaTypes,\n    isEmpty: references.length === 0 && polymorphic.length === 0,\n  };\n}\n\n/** Per-delete state shared by every level of the cascade. */\ninterface CascadeContext {\n  db: DatabaseInterface;\n  registry: CascadeRegistryView;\n  /** `table:id` pairs already expanded, so a reference cycle terminates. */\n  visited: Set<string>;\n  /** Tables touched by the cascade, for read-cache invalidation. */\n  affectedTables: Set<string>;\n  /**\n   * Qualified name of the class that owns each affected table, so the\n   * caller can resolve *that* class's own `@smrt({ cache })` config —\n   * cross-process cache invalidation is a per-class opt-in, and a table\n   * cascaded into belongs to a different class than the one `delete()` was\n   * called on.\n   */\n  affectedTableClasses: Map<string, string>;\n}\n\n/** Resolve a registry-recorded class name to its qualified form, when known. */\nfunction toQualifiedClassName(\n  registry: CascadeRegistryView,\n  className: string,\n): string {\n  return registry.getClass(className)?.qualifiedName ?? className;\n}\n\n/**\n * Every value `_smrt_contexts.owner_class` / `_smrt_embeddings.object_class`\n * could plausibly hold for a row belonging to an id of `className` (review\n * fix): both name forms (qualified + simple — older rows predate package\n * qualification) of `className` itself, plus every other member of its STI\n * hierarchy sharing its table. A CASCADE-collected id can belong to any\n * concrete STI subclass of the declaring reference, which stamps its own\n * (more specific) runtime class name at write time, not the reference's.\n *\n * Narrowing by this set — instead of matching by id alone — closes a\n * cross-class collision: two unrelated classes using `idType: 'text'`\n * (non-UUID, not guaranteed globally unique) could otherwise share an id\n * value and have one's `remember()`/embeddings rows deleted by the other's\n * cascade.\n */\nfunction ownerClassCandidates(\n  registry: CascadeRegistryView,\n  className: string,\n): string[] {\n  const stiBase = registry.getSTIBase(className) ?? className;\n  const members = new Set<string>([\n    className,\n    stiBase,\n    ...registry.getDescendants(stiBase),\n  ]);\n\n  const names = new Set<string>();\n  for (const member of members) {\n    names.add(member);\n    const registered = registry.getClass(member);\n    if (registered?.qualifiedName) names.add(registered.qualifiedName);\n    if (registered?.name) names.add(registered.name);\n  }\n  return [...names];\n}\n\n/**\n * Build the `where` clause matching `column` against one or more ids.\n *\n * A single id uses equality so the planner can use a plain index; multiple ids\n * use the adapter's `in` operator.\n */\nfunction idPredicate(column: string, ids: string[]): Record<string, unknown> {\n  return ids.length === 1 ? { [column]: ids[0] } : { [`${column} in`]: ids };\n}\n\n/**\n * Run a cascade statement against a *referencing* table, tolerating the\n * table (or an expected column) not existing in this database.\n *\n * The cascade plan is built from the in-process registry, which can carry a\n * class from any imported package — including one whose table this specific\n * database was never migrated to include (a partially adopted feature, a\n * package pulled in for its types, or, in a test process, a fixture some\n * other test file registered). A missing referencing table trivially has no\n * rows to act on, so the correct behaviour is identical to the table\n * existing and being empty — this must never abort an otherwise valid\n * delete. Any other failure (a real constraint violation, a lock timeout, a\n * genuine SQL error unrelated to the table's existence) still propagates.\n */\nasync function tolerateMissingTable<T>(\n  operation: () => Promise<T>,\n  fallback: T,\n  context: { table: string; action: string },\n): Promise<T> {\n  try {\n    return await operation();\n  } catch (error) {\n    if (classifyDatabaseError(error).kind === 'undefined_object') {\n      logger.warn(\n        `Cascade delete skipped ${context.action} on '${context.table}': ` +\n          'table or column not found in this database.',\n        { error: error instanceof Error ? error.message : String(error) },\n      );\n      return fallback;\n    }\n    throw error;\n  }\n}\n\nasync function selectIds(\n  db: DatabaseInterface,\n  tableName: string,\n  column: string,\n  ids: string[],\n): Promise<string[]> {\n  const found: string[] = [];\n  for (const batch of chunkArray(ids, IN_LIST_CHUNK_SIZE)) {\n    const rows = await tolerateMissingTable(\n      () => db.list(tableName, idPredicate(column, batch)),\n      [] as Record<string, unknown>[],\n      { table: tableName, action: 'CASCADE select' },\n    );\n    for (const row of rows) {\n      const id = row?.id;\n      if (typeof id === 'string' && id.length > 0) found.push(id);\n    }\n  }\n  return found;\n}\n\nasync function deleteByIds(\n  db: DatabaseInterface,\n  tableName: string,\n  ids: string[],\n): Promise<void> {\n  for (const batch of chunkArray(ids, IN_LIST_CHUNK_SIZE)) {\n    await tolerateMissingTable(\n      () => db.delete(tableName, idPredicate('id', batch)),\n      undefined,\n      { table: tableName, action: 'CASCADE delete' },\n    );\n  }\n}\n\n/**\n * Remove the framework-managed side rows owned by the given object ids.\n *\n * `_smrt_contexts` and `_smrt_embeddings` are keyed by `(owner_class, owner_id)`\n * and `(object_class, object_id)` respectively. Matched by id *and* class\n * (review fix): id alone would let two unrelated classes using\n * `idType: 'text'` (non-UUID, not guaranteed globally unique) collide on a\n * shared id value and delete each other's memory/embeddings rows. `classNames`\n * is the STI-hierarchy-expanded candidate set from\n * {@link ownerClassCandidates} — the class column stores the *runtime*\n * constructor name, which for an STI hierarchy is a concrete subclass rather\n * than the class the cascade was planned from, so a single exact name is not\n * enough.\n *\n * A missing system table is not an error — an application database may predate\n * the table, and losing derived rows must never fail an otherwise valid delete.\n */\nasync function deleteSystemRows(\n  db: DatabaseInterface,\n  ids: string[],\n  classNames: string[],\n): Promise<void> {\n  const ownerIds = ids.filter(\n    (id) =>\n      typeof id === 'string' &&\n      id.length > 0 &&\n      id !== COLLECTION_OWNER_SENTINEL,\n  );\n  if (ownerIds.length === 0 || classNames.length === 0) return;\n\n  for (const [table, idColumn, classColumn] of [\n    [CONTEXTS_TABLE, 'owner_id', 'owner_class'],\n    [EMBEDDINGS_TABLE, 'object_id', 'object_class'],\n  ] as const) {\n    for (const batch of chunkArray(ownerIds, IN_LIST_CHUNK_SIZE)) {\n      try {\n        await db.delete(table, {\n          ...idPredicate(idColumn, batch),\n          ...idPredicate(classColumn, classNames),\n        });\n      } catch (error) {\n        logger.warn(\n          `Failed to clean ${table} rows during cascade delete: ${\n            error instanceof Error ? error.message : String(error)\n          }`,\n        );\n      }\n    }\n  }\n}\n\n/**\n * Resolve every reference pointing at `ids` of `className`, recursively.\n *\n * Does **not** delete the rows identified by `ids` — the caller owns that, so\n * `SmrtObject.delete()` keeps issuing its own final statement and its own\n * lifecycle hooks.\n */\nasync function resolveReferences(\n  ctx: CascadeContext,\n  className: string,\n  tableName: string,\n  ids: string[],\n  depth: number,\n): Promise<void> {\n  const pending = ids.filter((id) => {\n    const key = `${tableName}:${id}`;\n    if (ctx.visited.has(key)) return false;\n    ctx.visited.add(key);\n    return true;\n  });\n  if (pending.length === 0) return;\n\n  if (depth > MAX_CASCADE_DEPTH) {\n    throw DatabaseError.constraintViolation(\n      `cascade delete from ${className} exceeded the maximum depth of ` +\n        `${MAX_CASCADE_DEPTH}; check for a chain of onDelete: 'CASCADE' ` +\n        'references that never terminates',\n      className,\n    );\n  }\n\n  const plan = buildCascadePlan(ctx.registry, className);\n\n  // RESTRICT first: refuse before anything has been mutated.\n  for (const reference of plan.references) {\n    if (reference.action !== 'RESTRICT') continue;\n    let remaining = 0;\n    for (const batch of chunkArray(pending, IN_LIST_CHUNK_SIZE)) {\n      remaining += await tolerateMissingTable(\n        () =>\n          ctx.db.count(\n            reference.tableName,\n            idPredicate(reference.column, batch),\n          ),\n        0,\n        { table: reference.tableName, action: 'RESTRICT check' },\n      );\n      if (remaining > 0) break;\n    }\n    if (remaining > 0) {\n      throw DatabaseError.constraintViolation(\n        `${reference.className}.${reference.fieldName} declares ` +\n          `onDelete: 'RESTRICT' and ${remaining} row(s) still reference this ` +\n          `${className}`,\n        reference.column,\n      );\n    }\n  }\n\n  for (const reference of plan.references) {\n    if (reference.action === 'SET NULL') {\n      for (const batch of chunkArray(pending, IN_LIST_CHUNK_SIZE)) {\n        await tolerateMissingTable(\n          () =>\n            ctx.db.update(\n              reference.tableName,\n              idPredicate(reference.column, batch),\n              { [reference.column]: null },\n            ),\n          undefined,\n          { table: reference.tableName, action: 'SET NULL' },\n        );\n      }\n      ctx.affectedTables.add(reference.tableName);\n      ctx.affectedTableClasses.set(\n        reference.tableName,\n        toQualifiedClassName(ctx.registry, reference.className),\n      );\n      continue;\n    }\n\n    if (reference.action !== 'CASCADE') continue;\n\n    const childIds = await selectIds(\n      ctx.db,\n      reference.tableName,\n      reference.column,\n      pending,\n    );\n    if (childIds.length === 0) continue;\n\n    await resolveReferences(\n      ctx,\n      reference.className,\n      reference.tableName,\n      childIds,\n      depth + 1,\n    );\n    await deleteSystemRows(\n      ctx.db,\n      childIds,\n      ownerClassCandidates(ctx.registry, reference.className),\n    );\n    await deleteByIds(ctx.db, reference.tableName, childIds);\n    ctx.affectedTables.add(reference.tableName);\n    ctx.affectedTableClasses.set(\n      reference.tableName,\n      toQualifiedClassName(ctx.registry, reference.className),\n    );\n  }\n\n  for (const association of plan.polymorphic) {\n    for (const batch of chunkArray(pending, IN_LIST_CHUNK_SIZE)) {\n      const where: Record<string, unknown> = {\n        ...idPredicate('meta_id', batch),\n      };\n      if (plan.metaTypes.length === 1) {\n        where.meta_type = plan.metaTypes[0];\n      } else {\n        where['meta_type in'] = plan.metaTypes;\n      }\n      const result = await tolerateMissingTable(\n        () => ctx.db.delete(association.tableName, where),\n        undefined,\n        {\n          table: association.tableName,\n          action: 'polymorphic association cleanup',\n        },\n      );\n      if ((result?.affected ?? 0) > 0) {\n        ctx.affectedTables.add(association.tableName);\n        ctx.affectedTableClasses.set(\n          association.tableName,\n          toQualifiedClassName(ctx.registry, association.className),\n        );\n      }\n    }\n  }\n}\n\n/** Outcome of a cascade run, returned so the caller can invalidate caches. */\nexport interface CascadeResult {\n  /** Tables whose rows were removed or nulled, excluding the target's own. */\n  affectedTables: Set<string>;\n  /**\n   * Qualified class name that owns each entry in {@link affectedTables},\n   * where resolvable — lets the caller check *that* class's own\n   * cross-process cache config rather than only its own.\n   */\n  affectedTableClasses: Map<string, string>;\n}\n\n/**\n * Resolve every reference to `ids` of `className` and clean their framework\n * side rows, then hand control back so the caller can delete the rows.\n *\n * Callers are expected to run this on a transaction-bound `db` — see\n * {@link runCascadeDelete}, which owns that decision.\n */\nexport async function cascadeReferencesTo(\n  db: DatabaseInterface,\n  registry: CascadeRegistryView,\n  target: { className: string; tableName: string; ids: string[] },\n): Promise<CascadeResult> {\n  const ctx: CascadeContext = {\n    db,\n    registry,\n    visited: new Set(),\n    affectedTables: new Set(),\n    affectedTableClasses: new Map(),\n  };\n  await resolveReferences(\n    ctx,\n    target.className,\n    target.tableName,\n    target.ids,\n    0,\n  );\n  await deleteSystemRows(\n    db,\n    target.ids,\n    ownerClassCandidates(registry, target.className),\n  );\n  return {\n    affectedTables: ctx.affectedTables,\n    affectedTableClasses: ctx.affectedTableClasses,\n  };\n}\n\ntype TransactionCapable = DatabaseInterface & {\n  transaction?: <T>(\n    this: DatabaseInterface,\n    callback: (tx: DatabaseInterface) => Promise<T>,\n  ) => Promise<T>;\n};\n\n/**\n * Run the cascade and the target row's own deletion atomically.\n *\n * When anything references the class and the adapter exposes `transaction()`,\n * the whole sequence runs inside one — including the caller's `deleteSelf`\n * statement, so a failure part-way through cannot leave the object deleted with\n * its junction rows intact (or vice versa). Adapters without transaction\n * support run the same statements sequentially; this is the documented\n * degradation, not a silent one.\n *\n * When nothing references the class there is nothing to keep consistent, and\n * the transaction is skipped — see the comment on that branch.\n *\n * @param db - Database the object is bound to\n * @param registry - Registry view used to build cascade plans\n * @param target - Class, table and id of the object being deleted\n * @param deleteSelf - Issues the target row's own `DELETE`, on the tx-bound db\n * @returns Tables affected by the cascade, for read-cache invalidation\n */\nexport async function runCascadeDelete(\n  db: DatabaseInterface,\n  registry: CascadeRegistryView,\n  target: {\n    className: string;\n    tableName: string;\n    /** An unsaved object has none; the cascade is then a no-op. */\n    id: string | null | undefined;\n  },\n  deleteSelf: (db: DatabaseInterface) => Promise<void>,\n): Promise<CascadeResult> {\n  const ids = target.id ? [target.id] : [];\n\n  // Nothing references this class AND no polymorphic association class is\n  // registered anywhere in the process. `plan.polymorphic` is unconditionally\n  // every registered `SmrtPolymorphicAssociation` subclass — a `metaType`\n  // column can point at any class at runtime, so there is no static metadata\n  // to scope it by, unlike a typed `@foreignKey`/`@crossPackageRef`. This\n  // branch is therefore common for a class with no incoming references in an\n  // app with no polymorphic associations at all, but rare — not \"the\n  // overwhelmingly common case\" — once even one polymorphic class exists\n  // anywhere in the process, since every delete's plan then carries it.\n  // Opening a transaction to wrap statements that cannot disagree with each\n  // other would cost two extra round trips, and on single-connection adapters\n  // it would serialize concurrent deletes behind the transaction queue. Order\n  // the two statements instead: the row goes first, so a failure leaves\n  // everything as it was, and the derived side rows follow under the\n  // best-effort contract they already carry.\n  if (buildCascadePlan(registry, target.className).isEmpty) {\n    await deleteSelf(db);\n    await deleteSystemRows(\n      db,\n      ids,\n      ownerClassCandidates(registry, target.className),\n    );\n    return { affectedTables: new Set(), affectedTableClasses: new Map() };\n  }\n\n  const run = async (bound: DatabaseInterface): Promise<CascadeResult> => {\n    const result = await cascadeReferencesTo(bound, registry, {\n      className: target.className,\n      tableName: target.tableName,\n      ids,\n    });\n    await deleteSelf(bound);\n    return result;\n  };\n\n  const transaction = (db as TransactionCapable).transaction;\n  if (typeof transaction !== 'function') {\n    return run(db);\n  }\n\n  return transaction.call<\n    DatabaseInterface,\n    [(tx: DatabaseInterface) => Promise<CascadeResult>],\n    Promise<CascadeResult>\n  >(db, run);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8EA,IAAM,SAAS,aAAa,EAAE,OAAO,OAAO,CAAC;;AAY7C,IAAM,iBAAiB;;AAGvB,IAAM,mBAAmB;;;;;;AAOzB,IAAM,4BAA4B;;;;;;AAOlC,IAAM,oBAAoB;AAyD1B,IAAM,kCAAkB,IAAI,IAAoB;CAC9C;CACA;CACA;CACA;AACF,CAAC;;;;;;;;AASD,SAAgB,kBAAkB,OAA4C;CAC5E,IAAI,OAAO,UAAU,UAAU,OAAO,KAAA;CACtC,MAAM,aAAa,MAAM,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,QAAQ,MAAM,GAAG;CAC/D,OAAO,gBAAgB,IAAI,UAA4B,IAClD,aACD,KAAA;AACN;AAEA,SAAS,8BAA8B,QAAuC;CAI5E,OAAO,OAAO,IAAI,UAAU,KAAK,OAAO,IAAI,QAAQ,KAAK,OAAO,IAAI,MAAM;AAC5E;;;;;;;;;;;;AAaA,SAAgB,iBACd,UACA,WACa;CAQb,MAAM,cAAc,IAAI,IAAI,SAAS,sBAAsB,SAAS,CAAC;CACrE,KAAK,MAAM,QAAQ,CAAC,GAAG,WAAW,GAAG;EACnC,MAAM,YAAY,SAAS,SAAS,IAAI,CAAC,EAAE;EAC3C,IAAI,WAAW,YAAY,IAAI,SAAS;CAC1C;CAEA,MAAM,aAAiC,CAAC;CACxC,MAAM,cAA6C,CAAC;CAEpD,KAAK,MAAM,CAAC,aAAa,kBAAkB,SAAS,mBAAmB,GAAG;EACxE,MAAM,SAAS,SAAS,UAAU,WAAW;EAE7C,IAAI,8BAA8B,MAAM,GAAG;GACzC,MAAM,YAAY,SAAS,aAAa,WAAW;GACnD,IAAI,WACF,YAAY,KAAK;IAAE,WAAW;IAAa;GAAU,CAAC;EAE1D;EAEA,IAAI,cAAc,WAAW,GAAG;EAEhC,IAAI;EAEJ,KAAK,MAAM,gBAAgB,eAAe;GACxC,IACE,aAAa,SAAS,gBACtB,aAAa,SAAS,mBAEtB;GAEF,IAAI,CAAC,YAAY,IAAI,aAAa,WAAW,GAAG;GAEhD,MAAM,YAAY,SAAS,aAAa,WAAW;GACnD,IAAI,CAAC,WAAW;GAEhB,MAAM,SAAS,YAAY,aAAa,SAAS;GACjD,MAAM,iBAAiB,kBAAkB,aAAa,SAAS,QAAQ;GAEvE,IAAI,CAAC,iBACH,kBAAkB,IAAI,IAAI,SAAS,mBAAmB,WAAW,CAAC;GAcpE,MAAM,kBACJ,aAAa,SAAS,WAAW,oBAAoB;GAEvD,MAAM,SACJ,mBACC,CAAC,mBAAmB,gBAAgB,IAAI,MAAM,IAC3C,YACA;GAEN,IAAI,WAAW,aAAa;GAE5B,IACE,WAAW,cACX,OAAO,IAAI,aAAa,SAAS,CAAC,EAAE,UAIpC,MAAM,mBAAmB,qBACvB,GAAG,YAAY,GAAG,aAAa,UAAU,wBACzC,aAAa,WACb,4EACF;GAGF,WAAW,KAAK;IACd,WAAW;IACX;IACA,WAAW,aAAa;IACxB;IACA;IACA,UAAU,mBAAmB,KAAA;GAC/B,CAAC;EACH;CACF;CAcA,MAAM,YAAsB,CAAC;CAC7B,MAAM,YAAY,SAAS,SAAS,SAAS,CAAC,EAAE;CAChD,IAAI,WAAW,UAAU,KAAK,SAAS;CACvC,MAAM,SAAS,SAAS,SAAS,SAAS,CAAC,EAAE,QAAQ;CACrD,IAAI,CAAC,UAAU,SAAS,MAAM,GAAG,UAAU,KAAK,MAAM;CAEtD,OAAO;EACL;EACA;EACA;EACA,SAAS,WAAW,WAAW,KAAK,YAAY,WAAW;CAC7D;AACF;;AAqBA,SAAS,qBACP,UACA,WACQ;CACR,OAAO,SAAS,SAAS,SAAS,CAAC,EAAE,iBAAiB;AACxD;;;;;;;;;;;;;;;;AAiBA,SAAS,qBACP,UACA,WACU;CACV,MAAM,UAAU,SAAS,WAAW,SAAS,KAAK;CAClD,MAAM,0BAAU,IAAI,IAAY;EAC9B;EACA;EACA,GAAG,SAAS,eAAe,OAAO;CACpC,CAAC;CAED,MAAM,wBAAQ,IAAI,IAAY;CAC9B,KAAK,MAAM,UAAU,SAAS;EAC5B,MAAM,IAAI,MAAM;EAChB,MAAM,aAAa,SAAS,SAAS,MAAM;EAC3C,IAAI,YAAY,eAAe,MAAM,IAAI,WAAW,aAAa;EACjE,IAAI,YAAY,MAAM,MAAM,IAAI,WAAW,IAAI;CACjD;CACA,OAAO,CAAC,GAAG,KAAK;AAClB;;;;;;;AAQA,SAAS,YAAY,QAAgB,KAAwC;CAC3E,OAAO,IAAI,WAAW,IAAI,GAAG,SAAS,IAAI,GAAG,IAAI,GAAG,GAAG,OAAO,OAAO,IAAI;AAC3E;;;;;;;;;;;;;;;AAgBA,eAAe,qBACb,WACA,UACA,SACY;CACZ,IAAI;EACF,OAAO,MAAM,UAAU;CACzB,SAAS,OAAO;EACd,IAAI,sBAAsB,KAAK,CAAC,CAAC,SAAS,oBAAoB;GAC5D,OAAO,KACL,0BAA0B,QAAQ,OAAO,OAAO,QAAQ,MAAM,iDAE9D,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,CAClE;GACA,OAAO;EACT;EACA,MAAM;CACR;AACF;AAEA,eAAe,UACb,IACA,WACA,QACA,KACmB;CACnB,MAAM,QAAkB,CAAC;CACzB,KAAK,MAAM,SAAS,WAAW,KAAA,GAAuB,GAAG;EACvD,MAAM,OAAO,MAAM,2BACX,GAAG,KAAK,WAAW,YAAY,QAAQ,KAAK,CAAC,GACnD,CAAC,GACD;GAAE,OAAO;GAAW,QAAQ;EAAiB,CAC/C;EACA,KAAK,MAAM,OAAO,MAAM;GACtB,MAAM,KAAK,KAAK;GAChB,IAAI,OAAO,OAAO,YAAY,GAAG,SAAS,GAAG,MAAM,KAAK,EAAE;EAC5D;CACF;CACA,OAAO;AACT;AAEA,eAAe,YACb,IACA,WACA,KACe;CACf,KAAK,MAAM,SAAS,WAAW,KAAA,GAAuB,GACpD,MAAM,2BACE,GAAG,OAAO,WAAW,YAAY,MAAM,KAAK,CAAC,GACnD,KAAA,GACA;EAAE,OAAO;EAAW,QAAQ;CAAiB,CAC/C;AAEJ;;;;;;;;;;;;;;;;;;AAmBA,eAAe,iBACb,IACA,KACA,YACe;CACf,MAAM,WAAW,IAAI,QAClB,OACC,OAAO,OAAO,YACd,GAAG,SAAS,KACZ,OAAO,yBACX;CACA,IAAI,SAAS,WAAW,KAAK,WAAW,WAAW,GAAG;CAEtD,KAAK,MAAM,CAAC,OAAO,UAAU,gBAAgB,CAC3C;EAAC;EAAgB;EAAY;CAAa,GAC1C;EAAC;EAAkB;EAAa;CAAc,CAChD,GACE,KAAK,MAAM,SAAS,WAAW,UAAA,GAA4B,GACzD,IAAI;EACF,MAAM,GAAG,OAAO,OAAO;GACrB,GAAG,YAAY,UAAU,KAAK;GAC9B,GAAG,YAAY,aAAa,UAAU;EACxC,CAAC;CACH,SAAS,OAAO;EACd,OAAO,KACL,mBAAmB,MAAM,+BACvB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GAEzD;CACF;AAGN;;;;;;;;AASA,eAAe,kBACb,KACA,WACA,WACA,KACA,OACe;CACf,MAAM,UAAU,IAAI,QAAQ,OAAO;EACjC,MAAM,MAAM,GAAG,UAAU,GAAG;EAC5B,IAAI,IAAI,QAAQ,IAAI,GAAG,GAAG,OAAO;EACjC,IAAI,QAAQ,IAAI,GAAG;EACnB,OAAO;CACT,CAAC;CACD,IAAI,QAAQ,WAAW,GAAG;CAE1B,IAAI,QAAQ,mBACV,MAAM,cAAc,oBAClB,uBAAuB,UAAU,iCAC5B,kBAAkB,8EAEvB,SACF;CAGF,MAAM,OAAO,iBAAiB,IAAI,UAAU,SAAS;CAGrD,KAAK,MAAM,aAAa,KAAK,YAAY;EACvC,IAAI,UAAU,WAAW,YAAY;EACrC,IAAI,YAAY;EAChB,KAAK,MAAM,SAAS,WAAW,SAAA,GAA2B,GAAG;GAC3D,aAAa,MAAM,2BAEf,IAAI,GAAG,MACL,UAAU,WACV,YAAY,UAAU,QAAQ,KAAK,CACrC,GACF,GACA;IAAE,OAAO,UAAU;IAAW,QAAQ;GAAiB,CACzD;GACA,IAAI,YAAY,GAAG;EACrB;EACA,IAAI,YAAY,GACd,MAAM,cAAc,oBAClB,GAAG,UAAU,UAAU,GAAG,UAAU,UAAU,qCAChB,UAAU,+BACnC,aACL,UAAU,MACZ;CAEJ;CAEA,KAAK,MAAM,aAAa,KAAK,YAAY;EACvC,IAAI,UAAU,WAAW,YAAY;GACnC,KAAK,MAAM,SAAS,WAAW,SAAA,GAA2B,GACxD,MAAM,2BAEF,IAAI,GAAG,OACL,UAAU,WACV,YAAY,UAAU,QAAQ,KAAK,GACnC,GAAG,UAAU,SAAS,KAAK,CAC7B,GACF,KAAA,GACA;IAAE,OAAO,UAAU;IAAW,QAAQ;GAAW,CACnD;GAEF,IAAI,eAAe,IAAI,UAAU,SAAS;GAC1C,IAAI,qBAAqB,IACvB,UAAU,WACV,qBAAqB,IAAI,UAAU,UAAU,SAAS,CACxD;GACA;EACF;EAEA,IAAI,UAAU,WAAW,WAAW;EAEpC,MAAM,WAAW,MAAM,UACrB,IAAI,IACJ,UAAU,WACV,UAAU,QACV,OACF;EACA,IAAI,SAAS,WAAW,GAAG;EAE3B,MAAM,kBACJ,KACA,UAAU,WACV,UAAU,WACV,UACA,QAAQ,CACV;EACA,MAAM,iBACJ,IAAI,IACJ,UACA,qBAAqB,IAAI,UAAU,UAAU,SAAS,CACxD;EACA,MAAM,YAAY,IAAI,IAAI,UAAU,WAAW,QAAQ;EACvD,IAAI,eAAe,IAAI,UAAU,SAAS;EAC1C,IAAI,qBAAqB,IACvB,UAAU,WACV,qBAAqB,IAAI,UAAU,UAAU,SAAS,CACxD;CACF;CAEA,KAAK,MAAM,eAAe,KAAK,aAC7B,KAAK,MAAM,SAAS,WAAW,SAAA,GAA2B,GAAG;EAC3D,MAAM,QAAiC,EACrC,GAAG,YAAY,WAAW,KAAK,EACjC;EACA,IAAI,KAAK,UAAU,WAAW,GAC5B,MAAM,YAAY,KAAK,UAAU;OAEjC,MAAM,kBAAkB,KAAK;EAU/B,MAAK,MARgB,2BACb,IAAI,GAAG,OAAO,YAAY,WAAW,KAAK,GAChD,KAAA,GACA;GACE,OAAO,YAAY;GACnB,QAAQ;EACV,CACF,EAAA,EACa,YAAY,KAAK,GAAG;GAC/B,IAAI,eAAe,IAAI,YAAY,SAAS;GAC5C,IAAI,qBAAqB,IACvB,YAAY,WACZ,qBAAqB,IAAI,UAAU,YAAY,SAAS,CAC1D;EACF;CACF;AAEJ;;;;;;;;AAqBA,eAAsB,oBACpB,IACA,UACA,QACwB;CACxB,MAAM,MAAsB;EAC1B;EACA;EACA,yBAAS,IAAI,IAAI;EACjB,gCAAgB,IAAI,IAAI;EACxB,sCAAsB,IAAI,IAAI;CAChC;CACA,MAAM,kBACJ,KACA,OAAO,WACP,OAAO,WACP,OAAO,KACP,CACF;CACA,MAAM,iBACJ,IACA,OAAO,KACP,qBAAqB,UAAU,OAAO,SAAS,CACjD;CACA,OAAO;EACL,gBAAgB,IAAI;EACpB,sBAAsB,IAAI;CAC5B;AACF;;;;;;;;;;;;;;;;;;;;AA4BA,eAAsB,iBACpB,IACA,UACA,QAMA,YACwB;CACxB,MAAM,MAAM,OAAO,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC;CAiBvC,IAAI,iBAAiB,UAAU,OAAO,SAAS,CAAC,CAAC,SAAS;EACxD,MAAM,WAAW,EAAE;EACnB,MAAM,iBACJ,IACA,KACA,qBAAqB,UAAU,OAAO,SAAS,CACjD;EACA,OAAO;GAAE,gCAAgB,IAAI,IAAI;GAAG,sCAAsB,IAAI,IAAI;EAAE;CACtE;CAEA,MAAM,MAAM,OAAO,UAAqD;EACtE,MAAM,SAAS,MAAM,oBAAoB,OAAO,UAAU;GACxD,WAAW,OAAO;GAClB,WAAW,OAAO;GAClB;EACF,CAAC;EACD,MAAM,WAAW,KAAK;EACtB,OAAO;CACT;CAEA,MAAM,cAAe,GAA0B;CAC/C,IAAI,OAAO,gBAAgB,YACzB,OAAO,IAAI,EAAE;CAGf,OAAO,YAAY,KAIjB,IAAI,GAAG;AACX"}

package/dist/change-feed.d.ts

@@ -1,6 +1,29 @@
 import { DatabaseInterface } from '@happyvertical/sql';
 /** Name of the append-only change-feed system table. */
 export declare const CHANGE_FEED_TABLE = "_smrt_changes";
+/**
+ * Tables the change-feed writer never records (issue #2376).
+ *
+ * The writer used to skip every table whose name started with `_smrt_`. That
+ * prefix stopped meaning "framework bookkeeping" once packages began naming
+ * their *domain* tables `_smrt_feature_overrides`, `_smrt_prompt_overrides`,
+ * `_smrt_subscription_plans`, `_smrt_report_schedules`, `_smrt_field_policies`
+ * and ~20 more: clients syncing those through `_changes` never saw an update.
+ *
+ * The exclusion is now an allowlist of tables the framework actually owns —
+ * the hand-written bookkeeping DDL ({@link SYSTEM_TABLE_NAMES}, which includes
+ * the feed's own table so it can never observe itself), the model-backed
+ * operational plumbing ({@link FRAMEWORK_OPERATIONAL_TABLES}), and the retired
+ * system tables that may still exist on older databases.
+ */
+export declare const CHANGE_FEED_EXCLUDED_TABLES: ReadonlySet<string>;
+/**
+ * Whether framework writes to `tableName` are recorded in the change feed.
+ *
+ * Exported so tooling and tests can reason about feed coverage without
+ * re-deriving the rule. See {@link CHANGE_FEED_EXCLUDED_TABLES}.
+ */
+export declare function isChangeFeedObservableTable(tableName: string): boolean;
 /** Interceptor name of the framework's change-feed writer. */
 export declare const CHANGE_FEED_INTERCEPTOR_NAME = "smrt-change-feed";
 /**
@@ -114,6 +137,13 @@ export interface ChangeFeedRetention {
     maxAgeMs?: number;
     /** Keep at most this many newest entries (by sequence). */
     maxRows?: number;
+    /**
+     * Count the entries the bounds select without deleting them (#2375).
+     *
+     * Lets the retention sweep and `smrt db:prune --dry-run` preview the exact
+     * same predicate the real prune would execute.
+     */
+    dryRun?: boolean;
 }
 /** Default page size for {@link getChangesSince}. */
 export declare const DEFAULT_CHANGES_LIMIT = 500;
@@ -288,7 +318,8 @@ export declare function getTableVersion(db: DatabaseInterface, table: string): P
  * larger than the slowest consumer's polling interval; consumers whose
  * cursor falls out of it are told to full-resync via `resyncRequired`.
  *
- * @returns The number of entries pruned (approximate under concurrent prunes).
+ * @returns The number of entries pruned — or, with `dryRun`, the number the
+ *   same bounds would prune (approximate under concurrent prunes).
  */
 export declare function pruneChangeFeed(db: DatabaseInterface, retention: ChangeFeedRetention): Promise<{
     pruned: number;
@@ -307,7 +338,8 @@ export declare function pruneChangeFeed(db: DatabaseInterface, retention: Change
  * - `beforeSave` stashes whether the instance was already persisted (this
  *   is what distinguishes `create` from `update` in the feed).
  * - `afterSave`/`afterDelete` append exactly one change entry per framework
- *   save/delete. `_smrt_*` system tables are skipped — the feed observes
+ *   save/delete. Framework-owned tables listed in
+ *   {@link CHANGE_FEED_EXCLUDED_TABLES} are skipped — the feed observes
  *   application data, not framework bookkeeping (and never itself).
  *
  * Failure policy: appends run after the user's write succeeded and must not

package/dist/change-feed.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"change-feed.d.ts","sourceRoot":"","sources":["../src/change-feed.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0FG;AAGH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAkB5D,wDAAwD;AACxD,eAAO,MAAM,iBAAiB,kBAAkB,CAAC;AAEjD,8DAA8D;AAC9D,eAAO,MAAM,4BAA4B,qBAAqB,CAAC;AAE/D;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE7D,oCAAoC;AACpC,MAAM,WAAW,eAAe;IAC9B,uEAAuE;IACvE,GAAG,EAAE,MAAM,CAAC;IACZ,yFAAyF;IACzF,KAAK,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,8DAA8D;IAC9D,SAAS,EAAE,eAAe,CAAC;IAC3B,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,gEAAgE;IAChE,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,2CAA2C;AAC3C,MAAM,WAAW,iBAAiB;IAChC;;;;;;;;;;;OAWG;IACH,KAAK,EAAE,MAAM,CAAC;IACd,0EAA0E;IAC1E,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,8CAA8C;AAC9C,MAAM,WAAW,cAAc;IAC7B,mDAAmD;IACnD,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B;;;;;OAKG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;;;;;;;;;OAgBG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,+DAA+D;AAC/D,MAAM,WAAW,iBAAiB;IAChC,gDAAgD;IAChD,KAAK,EAAE,MAAM,CAAC;IACd,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,gDAAgD;IAChD,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,8EAA8E;AAC9E,MAAM,WAAW,mBAAmB;IAClC,uDAAuD;IACvD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,qDAAqD;AACrD,eAAO,MAAM,qBAAqB,MAAM,CAAC;AAEzC,6DAA6D;AAC7D,eAAO,MAAM,iBAAiB,OAAQ,CAAC;AA+JvC;;;;;;;;;;;GAWG;AACH,wBAAsB,sCAAsC,CAC1D,EAAE,EAAE,iBAAiB,EACrB,OAAO,GAAE;IACP,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACd,GACL,OAAO,CAAC,IAAI,CAAC,CAcf;AAED,wBAAsB,qBAAqB,CACzC,EAAE,EAAE,iBAAiB,GACpB,OAAO,CAAC,IAAI,CAAC,CAuBf;AAMD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,YAAY,CAChC,EAAE,EAAE,iBAAiB,EACrB,KAAK,EAAE,iBAAiB,GACvB,OAAO,CAAC,MAAM,CAAC,CAoEjB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,cAAc,CAClC,EAAE,EAAE,iBAAiB,EACrB,KAAK,EAAE,iBAAiB,GACvB,OAAO,CAAC,IAAI,CAAC,CAGf;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAsB,eAAe,CACnC,EAAE,EAAE,iBAAiB,EACrB,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,cAAc,CAAC,CAmGzB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,2BAA2B,CAC/C,EAAE,EAAE,iBAAiB,EACrB,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,UAAU,CAAC,GAC3C,OAAO,CAAC,cAAc,CAAC,CAMzB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,wBAAsB,eAAe,CACnC,EAAE,EAAE,iBAAiB,EACrB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC,CA0BjB;AA4BD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,eAAe,CACnC,EAAE,EAAE,iBAAiB,EACrB,SAAS,EAAE,mBAAmB,GAC7B,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CA2C7B;AAmCD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,wBAAwB,IAAI,IAAI,CAuC/C;AAED,uDAAuD;AACvD,wBAAgB,0BAA0B,IAAI,OAAO,CAEpD;AAiGD;;GAEG;AACH,wBAAgB,uBAAuB,IAAI,IAAI,CAG9C"}
+{"version":3,"file":"change-feed.d.ts","sourceRoot":"","sources":["../src/change-feed.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0FG;AAGH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AA0B5D,wDAAwD;AACxD,eAAO,MAAM,iBAAiB,kBAAkB,CAAC;AAEjD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,2BAA2B,EAAE,WAAW,CAAC,MAAM,CAI1D,CAAC;AAEH;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAEtE;AAED,8DAA8D;AAC9D,eAAO,MAAM,4BAA4B,qBAAqB,CAAC;AAE/D;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE7D,oCAAoC;AACpC,MAAM,WAAW,eAAe;IAC9B,uEAAuE;IACvE,GAAG,EAAE,MAAM,CAAC;IACZ,yFAAyF;IACzF,KAAK,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,8DAA8D;IAC9D,SAAS,EAAE,eAAe,CAAC;IAC3B,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,gEAAgE;IAChE,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,2CAA2C;AAC3C,MAAM,WAAW,iBAAiB;IAChC;;;;;;;;;;;OAWG;IACH,KAAK,EAAE,MAAM,CAAC;IACd,0EAA0E;IAC1E,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,8CAA8C;AAC9C,MAAM,WAAW,cAAc;IAC7B,mDAAmD;IACnD,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B;;;;;OAKG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;;;;;;;;;OAgBG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,+DAA+D;AAC/D,MAAM,WAAW,iBAAiB;IAChC,gDAAgD;IAChD,KAAK,EAAE,MAAM,CAAC;IACd,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,gDAAgD;IAChD,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,8EAA8E;AAC9E,MAAM,WAAW,mBAAmB;IAClC,uDAAuD;IACvD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,qDAAqD;AACrD,eAAO,MAAM,qBAAqB,MAAM,CAAC;AAEzC,6DAA6D;AAC7D,eAAO,MAAM,iBAAiB,OAAQ,CAAC;AA+JvC;;;;;;;;;;;GAWG;AACH,wBAAsB,sCAAsC,CAC1D,EAAE,EAAE,iBAAiB,EACrB,OAAO,GAAE;IACP,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACd,GACL,OAAO,CAAC,IAAI,CAAC,CAcf;AAED,wBAAsB,qBAAqB,CACzC,EAAE,EAAE,iBAAiB,GACpB,OAAO,CAAC,IAAI,CAAC,CAuBf;AAMD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,YAAY,CAChC,EAAE,EAAE,iBAAiB,EACrB,KAAK,EAAE,iBAAiB,GACvB,OAAO,CAAC,MAAM,CAAC,CA4EjB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,cAAc,CAClC,EAAE,EAAE,iBAAiB,EACrB,KAAK,EAAE,iBAAiB,GACvB,OAAO,CAAC,IAAI,CAAC,CAGf;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAsB,eAAe,CACnC,EAAE,EAAE,iBAAiB,EACrB,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,cAAc,CAAC,CAmGzB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,2BAA2B,CAC/C,EAAE,EAAE,iBAAiB,EACrB,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,UAAU,CAAC,GAC3C,OAAO,CAAC,cAAc,CAAC,CAMzB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,wBAAsB,eAAe,CACnC,EAAE,EAAE,iBAAiB,EACrB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC,CA0BjB;AA4BD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,eAAe,CACnC,EAAE,EAAE,iBAAiB,EACrB,SAAS,EAAE,mBAAmB,GAC7B,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAuD7B;AAoCD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,wBAAwB,IAAI,IAAI,CAuC/C;AAED,uDAAuD;AACvD,wBAAgB,0BAA0B,IAAI,OAAO,CAEpD;AAmGD;;GAEG;AACH,wBAAgB,uBAAuB,IAAI,IAAI,CAG9C"}

package/dist/change-feed.js

@@ -1,9 +1,12 @@
 import { resolveDbCacheKey } from "./collection-cache.js";
+import { toSafeInteger } from "./utils/safe-integer.js";
 import { publishChangeSignal } from "./change-signals.js";
 import { resolveDispatchTenantScope } from "./dispatch/tenant-resolver.js";
+import { isEmbeddedDatabase, withEmbeddedWriteQueue } from "./embedded-write-queue.js";
 import { GlobalInterceptors } from "./interceptors.js";
 import { detectEngine } from "./schema/ddl/index.js";
-import { CREATE_SMRT_CHANGES_TABLE, ENSURE_POSTGRES_CHANGE_FEED_APPEND_FUNCTION, ENSURE_POSTGRES_CHANGE_FEED_SCHEMA, POSTGRES_CHANGE_FEED_APPEND_FUNCTION_IDENTITY, POSTGRES_CHANGE_FEED_APPEND_FUNCTION_NAME, REPLACE_POSTGRES_CHANGE_FEED_APPEND_FUNCTION } from "./system/schema.js";
+import { CREATE_SMRT_CHANGES_TABLE, ENSURE_POSTGRES_CHANGE_FEED_APPEND_FUNCTION, ENSURE_POSTGRES_CHANGE_FEED_SCHEMA, FRAMEWORK_OPERATIONAL_TABLES, POSTGRES_CHANGE_FEED_APPEND_FUNCTION_IDENTITY, POSTGRES_CHANGE_FEED_APPEND_FUNCTION_NAME, REPLACE_POSTGRES_CHANGE_FEED_APPEND_FUNCTION, RETIRED_SYSTEM_TABLES } from "./system/schema.js";
+import { SYSTEM_TABLE_NAMES } from "./schema/system-table-shapes.js";
 import { createLogger } from "@happyvertical/logger";
 //#region src/change-feed.ts
 /**
@@ -100,6 +103,35 @@ import { createLogger } from "@happyvertical/logger";
 var logger = createLogger({ level: "info" });
 /** Name of the append-only change-feed system table. */
 var CHANGE_FEED_TABLE = "_smrt_changes";
+/**
+* Tables the change-feed writer never records (issue #2376).
+*
+* The writer used to skip every table whose name started with `_smrt_`. That
+* prefix stopped meaning "framework bookkeeping" once packages began naming
+* their *domain* tables `_smrt_feature_overrides`, `_smrt_prompt_overrides`,
+* `_smrt_subscription_plans`, `_smrt_report_schedules`, `_smrt_field_policies`
+* and ~20 more: clients syncing those through `_changes` never saw an update.
+*
+* The exclusion is now an allowlist of tables the framework actually owns —
+* the hand-written bookkeeping DDL ({@link SYSTEM_TABLE_NAMES}, which includes
+* the feed's own table so it can never observe itself), the model-backed
+* operational plumbing ({@link FRAMEWORK_OPERATIONAL_TABLES}), and the retired
+* system tables that may still exist on older databases.
+*/
+var CHANGE_FEED_EXCLUDED_TABLES = /* @__PURE__ */ new Set([
+	...SYSTEM_TABLE_NAMES,
+	...FRAMEWORK_OPERATIONAL_TABLES,
+	...RETIRED_SYSTEM_TABLES
+]);
+/**
+* Whether framework writes to `tableName` are recorded in the change feed.
+*
+* Exported so tooling and tests can reason about feed coverage without
+* re-deriving the rule. See {@link CHANGE_FEED_EXCLUDED_TABLES}.
+*/
+function isChangeFeedObservableTable(tableName) {
+	return Boolean(tableName) && !CHANGE_FEED_EXCLUDED_TABLES.has(tableName);
+}
 /** Interceptor name of the framework's change-feed writer. */
 var CHANGE_FEED_INTERCEPTOR_NAME = "smrt-change-feed";
 /** Default page size for {@link getChangesSince}. */
@@ -266,7 +298,7 @@ async function appendChange(db, input) {
 		(/* @__PURE__ */ new Date()).toISOString()
 	];
 	for (let attempt = 1; attempt <= MAX_APPEND_ATTEMPTS; attempt++) try {
-		const row = getQueryRows(await db.query(sql, ...params))[0];
+		const row = getQueryRows(await withEmbeddedWriteQueue(db, isEmbeddedDatabase(db), () => db.query(sql, ...params)))[0];
 		if (!row) throw new Error("Change feed append returned no result row");
 		if (engine === "postgres" && row.error_code != null) {
 			const error = new Error(String(row.error_message || "PostgreSQL change-feed append failed"));
@@ -466,8 +498,7 @@ async function getTableVersion(db, table) {
 	return toSeqNumber(getQueryRows(await db.query(`SELECT MAX(seq) AS horizon FROM ${CHANGE_FEED_TABLE}`))[0]?.horizon);
 }
 function toSeqNumber(value) {
-	const parsed = typeof value === "number" ? value : Number(value ?? 0);
-	return Number.isFinite(parsed) ? parsed : 0;
+	return toSafeInteger(value ?? 0, "Change-feed sequence");
 }
 function rowToEntry(row) {
 	return {
@@ -503,10 +534,11 @@ function normalizeTimestamp(value) {
 * larger than the slowest consumer's polling interval; consumers whose
 * cursor falls out of it are told to full-resync via `resyncRequired`.
 *
-* @returns The number of entries pruned (approximate under concurrent prunes).
+* @returns The number of entries pruned — or, with `dryRun`, the number the
+*   same bounds would prune (approximate under concurrent prunes).
 */
 async function pruneChangeFeed(db, retention) {
-	const { maxAgeMs, maxRows } = retention;
+	const { maxAgeMs, maxRows, dryRun = false } = retention;
 	if (maxAgeMs == null && maxRows == null) throw new Error("pruneChangeFeed requires maxAgeMs and/or maxRows");
 	if (maxAgeMs != null && (!Number.isFinite(maxAgeMs) || maxAgeMs < 0)) throw new Error(`pruneChangeFeed maxAgeMs must be >= 0, got ${maxAgeMs}`);
 	if (maxRows != null && (!Number.isFinite(maxRows) || maxRows < 0)) throw new Error(`pruneChangeFeed maxRows must be >= 0, got ${maxRows}`);
@@ -514,19 +546,27 @@ async function pruneChangeFeed(db, retention) {
 	const horizon = toSeqNumber(getQueryRows(await db.query(`SELECT MAX(seq) AS horizon FROM ${CHANGE_FEED_TABLE}`))[0]?.horizon);
 	if (horizon === 0) return { pruned: 0 };
 	let pruned = 0;
+	let prunedThrough = 0;
 	if (maxRows != null) {
 		const pruneThrough = Math.min(horizon - Math.floor(maxRows), horizon - 1);
-		if (pruneThrough > 0) pruned += await deleteCounted(db, `seq <= ${p(1)}`, [pruneThrough]);
+		if (pruneThrough > 0) {
+			prunedThrough = pruneThrough;
+			pruned += await deleteCounted(db, `seq <= ${p(1)}`, [pruneThrough], dryRun);
+		}
 	}
 	if (maxAgeMs != null) {
 		const cutoff = new Date(Date.now() - maxAgeMs).toISOString();
-		pruned += await deleteCounted(db, `created_at < ${p(1)} AND seq < ${p(2)}`, [cutoff, horizon]);
+		pruned += await deleteCounted(db, `created_at < ${p(1)} AND seq < ${p(2)} AND seq > ${p(3)}`, [
+			cutoff,
+			horizon,
+			prunedThrough
+		], dryRun);
 	}
 	return { pruned };
 }
-async function deleteCounted(db, condition, params) {
+async function deleteCounted(db, condition, params, dryRun = false) {
 	const total = toSeqNumber(getQueryRows(await db.query(`SELECT COUNT(*) AS total FROM ${CHANGE_FEED_TABLE} WHERE ${condition}`, ...params))[0]?.total);
-	if (total > 0) await db.query(`DELETE FROM ${CHANGE_FEED_TABLE} WHERE ${condition}`, ...params);
+	if (total > 0 && !dryRun) await db.query(`DELETE FROM ${CHANGE_FEED_TABLE} WHERE ${condition}`, ...params);
 	return total;
 }
 var WAS_PERSISTED_KEY = "_smrtChangeFeedWasPersisted";
@@ -548,7 +588,8 @@ var warnedSignalPublishFailures = /* @__PURE__ */ new Set();
 * - `beforeSave` stashes whether the instance was already persisted (this
 *   is what distinguishes `create` from `update` in the feed).
 * - `afterSave`/`afterDelete` append exactly one change entry per framework
-*   save/delete. `_smrt_*` system tables are skipped — the feed observes
+*   save/delete. Framework-owned tables listed in
+*   {@link CHANGE_FEED_EXCLUDED_TABLES} are skipped — the feed observes
 *   application data, not framework bookkeeping (and never itself).
 *
 * Failure policy: appends run after the user's write succeeded and must not
@@ -584,7 +625,7 @@ async function appendForInstance(instance, operation) {
 	let table;
 	try {
 		table = instance.tableName;
-		if (!table || table.startsWith("_smrt_")) return;
+		if (!isChangeFeedObservableTable(table)) return;
 		db = instance.db;
 	} catch {
 		return;
@@ -639,6 +680,6 @@ function resetChangeFeedWarnings() {
 	warnedSignalPublishFailures.clear();
 }
 //#endregion
-export { CHANGE_FEED_INTERCEPTOR_NAME, CHANGE_FEED_TABLE, DEFAULT_CHANGES_LIMIT, MAX_CHANGES_LIMIT, appendChange, bumpChangeFeed, ensureChangeFeedTable, ensurePostgresChangeFeedAppendFunction, getChangesSince, getTableVersion, getTenantScopedChangesSince, pruneChangeFeed, registerChangeFeedWriter, resetChangeFeedWarnings, unregisterChangeFeedWriter };
+export { CHANGE_FEED_EXCLUDED_TABLES, CHANGE_FEED_INTERCEPTOR_NAME, CHANGE_FEED_TABLE, DEFAULT_CHANGES_LIMIT, MAX_CHANGES_LIMIT, appendChange, bumpChangeFeed, ensureChangeFeedTable, ensurePostgresChangeFeedAppendFunction, getChangesSince, getTableVersion, getTenantScopedChangesSince, isChangeFeedObservableTable, pruneChangeFeed, registerChangeFeedWriter, resetChangeFeedWarnings, unregisterChangeFeedWriter };
 
 //# sourceMappingURL=change-feed.js.map

package/dist/change-feed.js.map

@@ -1 +1 @@
-{"version":3,"file":"change-feed.js","names":[],"sources":["../src/change-feed.ts"],"sourcesContent":["/**\n * Adapter-agnostic change feed — the framework's change-observation spine\n * (issue #1758, parent PRD #1755).\n *\n * Every framework `save()`/`delete()` appends exactly one row to the\n * `_smrt_changes` system table (monotonic per-database sequence, table name,\n * row id, operation, tenant id, timestamp). Deletes are recorded as\n * tombstones (`operation: 'delete'`), distinguishable from updates. One read\n * interface — {@link getChangesSince} — returns changes after a cursor,\n * filterable by table and tenant, and serves three eventual consumers:\n * client delta pull, the SSE push channel, and the per-table version source\n * backing ETags.\n *\n * ## Cursor semantics (the precise guarantee)\n *\n * Sequences are allocated *inside* the append statement as\n * `COALESCE(MAX(seq), 0) + 1` over the feed table itself, with a retry on\n * primary-key conflict. `MAX(seq)` only observes committed rows, so a row\n * with sequence `N` can only be inserted while every row with sequence\n * `< N` is already committed (a conflicting in-flight allocation of the same\n * value blocks, then retries). Committed rows therefore always form a\n * contiguous run ending at `MAX(seq)` — the **committed horizon**. Sequence\n * order equals commit order; out-of-order commit visibility (the classic\n * MVCC race that makes native identity/serial columns unsafe as cursors\n * under concurrent writers) cannot occur.\n *\n * {@link getChangesSince} reads the committed horizon `H = MAX(seq)`, then\n * returns matching rows with `since < seq <= H` (bounded by `limit`), and a\n * `cursor` that is either `H` (page exhaustive) or the last returned `seq`\n * (page limited). Because no change can ever commit at or below an observed\n * horizon after it was observed, polling with returned cursors misses no\n * committed change and never returns the same change twice — under any\n * number of concurrent writers, identically on SQLite, Postgres and DuckDB.\n * This is the design reason the allocator is `MAX+1` rather than a native\n * AUTOINCREMENT/identity column: identity values are allocated before\n * commit, so a reader on Postgres could observe seq 101 while seq 100 is\n * still uncommitted and advance its cursor past it. (No shared\n * auto-increment mechanism exists in the system-table schema path either;\n * see `system/schema.ts`.)\n *\n * Contention note: appends serialize on the head of the log. Each append is\n * one small INSERT (issued from the write path *after* the user's row was\n * written), so the serialization window is one statement; conflicts resolve\n * with a bounded retry loop and are impossible on single-writer engines\n * (SQLite). PostgreSQL invokes that INSERT through the framework-owned\n * `_smrt_append_change` function so failure isolation remains one statement.\n *\n * ## Failure semantics\n *\n * A feed-write failure must never fail the user's write. The interceptor\n * wraps the append in a try/catch: on failure it logs a warning (deduped per\n * database) and continues. The trade-off is availability of the user's\n * write over completeness of the feed — consumers already need a\n * full-resync path for cursors older than the retention window, and the\n * same path covers a (rare) dropped feed row. PostgreSQL runs the INSERT in a\n * PL/pgSQL exception subtransaction and returns a caught SQLSTATE as data;\n * JavaScript only throws/logs after PostgreSQL has restored the caller's\n * transaction, so a swallowed append failure cannot surface later as 25P02.\n * The append still joins a caller-managed transaction on the same handle and\n * shares its fate (a rollback removes the change row with the data row).\n *\n * ## Known gaps (documented in the PRD)\n *\n * - Writes that bypass framework mutation paths (raw SQL) are invisible to\n *   the feed — the same accepted gap as the #1499 collection cache.\n *   {@link bumpChangeFeed} is the manual escape hatch: out-of-band writers\n *   append a synthetic change row for the affected table.\n * - **Spurious `update` entries**: `SmrtObject.save()` has no dirty-check,\n *   so a field-unchanged `.save()` still appends an `update` row. This is\n *   by design — the writer observes writes, not diffs (it has no old-row\n *   access), so the feed faithfully mirrors the write path. Diff-aware\n *   paths (`getOrUpsert()`'s diff guard, the sync-apply endpoint's no-op\n *   detection) short-circuit before `save()` and append nothing.\n *   Subscribers must tolerate spurious entries; they are convergent — a\n *   re-fetch returns identical data.\n *\n * ## Retention\n *\n * The log is append-only and grows with write volume. {@link pruneChangeFeed}\n * bounds it by age (`maxAgeMs`) and/or row count (`maxRows`); call it from a\n * scheduled job sized so the retention window comfortably exceeds the\n * slowest consumer's polling interval. Pruning deletes oldest-first and\n * always retains the newest entry, so retained sequences stay a contiguous\n * `[floor..horizon]` run — which is how {@link getChangesSince} *detects* a\n * consumer whose cursor predates the retained window and answers it with\n * `resyncRequired: true` plus a fresh resume cursor instead of silently\n * skipping the pruned changes.\n *\n * @see https://github.com/happyvertical/smrt/issues/1758\n * @packageDocumentation\n */\n\nimport { createLogger } from '@happyvertical/logger';\nimport type { DatabaseInterface } from '@happyvertical/sql';\nimport { publishChangeSignal } from './change-signals.js';\nimport { resolveDbCacheKey } from './collection-cache.js';\nimport { resolveDispatchTenantScope } from './dispatch/tenant-resolver.js';\nimport { GlobalInterceptors, type InterceptorContext } from './interceptors.js';\nimport type { SmrtObject } from './object.js';\nimport { detectEngine } from './schema/ddl/index.js';\nimport {\n  CREATE_SMRT_CHANGES_TABLE,\n  ENSURE_POSTGRES_CHANGE_FEED_APPEND_FUNCTION,\n  ENSURE_POSTGRES_CHANGE_FEED_SCHEMA,\n  POSTGRES_CHANGE_FEED_APPEND_FUNCTION_IDENTITY,\n  POSTGRES_CHANGE_FEED_APPEND_FUNCTION_NAME,\n  REPLACE_POSTGRES_CHANGE_FEED_APPEND_FUNCTION,\n} from './system/schema.js';\n\nconst logger = createLogger({ level: 'info' });\n\n/** Name of the append-only change-feed system table. */\nexport const CHANGE_FEED_TABLE = '_smrt_changes';\n\n/** Interceptor name of the framework's change-feed writer. */\nexport const CHANGE_FEED_INTERCEPTOR_NAME = 'smrt-change-feed';\n\n/**\n * Change operations recorded in the feed. Deletes are tombstones —\n * consumers can distinguish \"row changed\" from \"row is gone\" without\n * consulting the source table.\n */\nexport type ChangeOperation = 'create' | 'update' | 'delete';\n\n/** One entry of the change feed. */\nexport interface ChangeFeedEntry {\n  /** Strictly monotonic per-database sequence (the cursor dimension). */\n  seq: number;\n  /** Physical table the change happened in (STI children report the shared base table). */\n  table: string;\n  /**\n   * Primary key of the changed row, or `null` for table-level synthetic\n   * bumps recorded via {@link bumpChangeFeed} without a row id.\n   */\n  rowId: string | null;\n  /** What happened. `'delete'` entries double as tombstones. */\n  operation: ChangeOperation;\n  /** Tenant the changed row belongs to, or `null` for global/non-tenant rows. */\n  tenantId: string | null;\n  /** ISO-8601 timestamp recorded when the change was appended. */\n  timestamp: string;\n}\n\n/** Options for {@link getChangesSince}. */\nexport interface GetChangesOptions {\n  /**\n   * Cursor to read after. Only rows with `seq` strictly greater than `since`\n   * are returned; pass a previously returned {@link ChangeFeedPage.cursor} to\n   * poll.\n   *\n   * `0` reads from the start of the log only while it has not been pruned past\n   * the beginning. Once retention has raised the retained floor above the\n   * start, `since: 0` (like any cursor older than the retained window) can no\n   * longer be served incrementally — the read returns\n   * {@link ChangeFeedPage.resyncRequired} and the caller must do a full\n   * resync before resuming from {@link ChangeFeedPage.resyncCursor}.\n   */\n  since: number;\n  /** Restrict to these physical table names. Empty/omitted → all tables. */\n  tables?: string[];\n  /**\n   * Tenant visibility filter:\n   * - omitted/`undefined` → no tenant filter (all rows).\n   * - `null` → only global rows (`tenant_id IS NULL`).\n   * - `'<tenantId>'` → that tenant's rows **plus** global rows, matching the\n   *   DispatchBus read rule (`tenant_id = T OR tenant_id IS NULL`). A tenant\n   *   never sees another tenant's changes.\n   */\n  tenantId?: string | null;\n  /**\n   * Page size (default {@link DEFAULT_CHANGES_LIMIT}, capped at\n   * {@link MAX_CHANGES_LIMIT}). When a page fills up, the returned cursor\n   * stops at the last returned row so the next poll continues seamlessly.\n   */\n  limit?: number;\n}\n\n/** Result page of {@link getChangesSince}. */\nexport interface ChangeFeedPage {\n  /** Matching changes ordered by ascending `seq`. */\n  changes: ChangeFeedEntry[];\n  /**\n   * The next cursor. Monotonic: never lower than the `since` it was derived\n   * from. Equal to the committed horizon when the page was exhaustive, or to\n   * the last returned `seq` when the page hit `limit`. Feed the value back\n   * as `since` to observe every later change exactly once.\n   */\n  cursor: number;\n  /**\n   * Present (and `true`) when the supplied cursor cannot be served\n   * incrementally and the consumer must fall back to a full resync:\n   *\n   * - the cursor predates the retained window (entries at or below it were\n   *   pruned away — the changes between it and the retained floor are gone\n   *   for good), or\n   * - the cursor is ahead of the committed horizon / unknown to this\n   *   database (a foreign or reset cursor).\n   *\n   * When set, `changes` is empty and `cursor` echoes `since` unchanged.\n   * After its full data refetch, the consumer should resume polling from\n   * {@link resyncCursor}, the committed horizon observed by this read.\n   * Detection is computed on the **unfiltered** log: `tables`/`tenantId`\n   * filters legitimately hide rows and never trigger (or mask) a resync\n   * signal.\n   */\n  resyncRequired?: boolean;\n  /**\n   * Current committed horizon to use after handling a resync. Present with\n   * {@link resyncRequired}; separated from `cursor` so old callers that rely\n   * on `cursor` echoing the rejected value keep their monotonic-cursor\n   * invariant.\n   */\n  resyncCursor?: number;\n}\n\n/** Input for {@link appendChange} / {@link bumpChangeFeed}. */\nexport interface AppendChangeInput {\n  /** Physical table name the change refers to. */\n  table: string;\n  /** Changed row's primary key; `null`/omitted records a table-level change. */\n  rowId?: string | null;\n  /** Operation to record (default `'update'`). */\n  operation?: ChangeOperation;\n  /** Tenant the change belongs to (default `null` = global). */\n  tenantId?: string | null;\n}\n\n/** Retention bounds for {@link pruneChangeFeed}. At least one is required. */\nexport interface ChangeFeedRetention {\n  /** Prune entries older than this many milliseconds. */\n  maxAgeMs?: number;\n  /** Keep at most this many newest entries (by sequence). */\n  maxRows?: number;\n}\n\n/** Default page size for {@link getChangesSince}. */\nexport const DEFAULT_CHANGES_LIMIT = 500;\n\n/** Hard cap on the page size for {@link getChangesSince}. */\nexport const MAX_CHANGES_LIMIT = 5_000;\n\n/**\n * Maximum append attempts under sequence contention. Conflicts only occur\n * with concurrent writers on MVCC engines and resolve as soon as the\n * blocking transaction commits, so a small bound is ample.\n */\nconst MAX_APPEND_ATTEMPTS = 20;\n\nconst VALID_OPERATIONS: ReadonlySet<string> = new Set([\n  'create',\n  'update',\n  'delete',\n]);\n\n// ============================================================================\n// Engine / SQL helpers (mirrors system/compatibility.ts conventions)\n// ============================================================================\n\ntype DatabaseWithConfig = DatabaseInterface & {\n  config?: { type?: string; url?: string };\n  type?: string;\n};\n\nfunction getEngine(\n  db: DatabaseInterface,\n  typeHint?: string,\n): ReturnType<typeof detectEngine> {\n  const withConfig = db as DatabaseWithConfig;\n  return detectEngine(\n    db.url || withConfig.config?.url || '',\n    typeHint || withConfig.type || withConfig.config?.type,\n  );\n}\n\n/**\n * Positional placeholder factory: Postgres uses `$n`, SQLite/DuckDB use `?`.\n */\nfunction placeholders(db: DatabaseInterface): (index: number) => string {\n  const engine = getEngine(db);\n  return engine === 'postgres' ? (index) => `$${index}` : () => '?';\n}\n\nfunction getQueryRows(result: unknown): Record<string, unknown>[] {\n  if (Array.isArray(result)) {\n    return result as Record<string, unknown>[];\n  }\n  if (result && typeof result === 'object' && 'rows' in result) {\n    const rows = (result as { rows?: unknown }).rows;\n    if (Array.isArray(rows)) {\n      return rows as Record<string, unknown>[];\n    }\n  }\n  return [];\n}\n\nfunction isUniqueViolation(error: unknown): boolean {\n  const signals: string[] = [];\n  const pending: unknown[] = [error];\n  const seen = new Set<object>();\n\n  while (pending.length > 0 && seen.size < 5) {\n    const candidate = pending.shift();\n    if (typeof candidate === 'string') {\n      signals.push(candidate);\n      continue;\n    }\n    if (!candidate || typeof candidate !== 'object' || seen.has(candidate)) {\n      continue;\n    }\n    seen.add(candidate);\n\n    const shaped = candidate as {\n      cause?: unknown;\n      code?: unknown;\n      context?: unknown;\n      message?: unknown;\n    };\n    if (typeof shaped.message === 'string') signals.push(shaped.message);\n    if (typeof shaped.code === 'string') signals.push(shaped.code);\n    if (shaped.cause !== undefined) pending.push(shaped.cause);\n\n    if (shaped.context && typeof shaped.context === 'object') {\n      const originalError = (shaped.context as { originalError?: unknown })\n        .originalError;\n      if (originalError !== undefined) pending.push(originalError);\n    }\n  }\n\n  const message = signals.join(', ');\n  return (\n    /\\b23505\\b/.test(message) ||\n    /unique constraint/i.test(message) ||\n    /duplicate key/i.test(message) ||\n    /primary key constraint/i.test(message) ||\n    /constraint error/i.test(message)\n  );\n}\n\n/**\n * Ensure the `_smrt_changes` system table exists on a database handle that\n * may not have passed through framework initialization (e.g. a raw handle\n * given to the REST generator). Idempotent (`CREATE ... IF NOT EXISTS`) and\n * guarded to run once per handle. Databases initialized through the\n * framework already have the table via the system-table bootstrap.\n */\nconst ensuredHandles = new WeakSet<object>();\n\nasync function postgresChangeFeedAppendFunctionExists(\n  db: DatabaseInterface,\n): Promise<boolean> {\n  const rows = getQueryRows(\n    await db.query(\n      `SELECT to_regprocedure('${POSTGRES_CHANGE_FEED_APPEND_FUNCTION_IDENTITY}') AS function_name`,\n    ),\n  );\n  return Boolean(rows[0]?.function_name);\n}\n\nasync function getPostgresChangeFeedSchemaState(\n  db: DatabaseInterface,\n): Promise<{\n  tableExists: boolean;\n  functionExists: boolean;\n  createdAtType: string | null;\n}> {\n  const rows = getQueryRows(\n    await db.query(\n      `SELECT\n         to_regclass('${CHANGE_FEED_TABLE}') AS table_name,\n         to_regprocedure('${POSTGRES_CHANGE_FEED_APPEND_FUNCTION_IDENTITY}') AS function_name,\n         (\n           SELECT data_type\n           FROM information_schema.columns\n           WHERE table_schema = current_schema()\n             AND table_name = '${CHANGE_FEED_TABLE}'\n             AND column_name = 'created_at'\n         ) AS created_at_type`,\n    ),\n  );\n  return {\n    tableExists: Boolean(rows[0]?.table_name),\n    functionExists: Boolean(rows[0]?.function_name),\n    createdAtType: rows[0]?.created_at_type\n      ? String(rows[0].created_at_type)\n      : null,\n  };\n}\n\nfunction assertPostgresChangeFeedTimestampCurrent(\n  state: Awaited<ReturnType<typeof getPostgresChangeFeedSchemaState>>,\n): void {\n  if (state.createdAtType === 'timestamp without time zone') {\n    throw new Error(\n      'Legacy _smrt_changes.created_at requires an explicit audited migratePostgresSystemTimestamps() call before change-feed initialization',\n    );\n  }\n}\n\n/**\n * Install/refresh the PostgreSQL exception-subtransaction append boundary.\n *\n * Framework bootstrap calls this while applying the system-schema version that\n * introduced the helper, so upgraded databases acquire it before the migration\n * is recorded. Raw-handle initialization passes `replaceExisting: false` so a\n * read route does not require function ownership when the installed helper is\n * already current. A missing helper is installed by one server-side statement\n * that locks and rechecks before DDL. Non-PostgreSQL adapters are a no-op.\n *\n * @internal\n */\nexport async function ensurePostgresChangeFeedAppendFunction(\n  db: DatabaseInterface,\n  options: {\n    replaceExisting?: boolean;\n    typeHint?: string;\n  } = {},\n): Promise<void> {\n  if (getEngine(db, options.typeHint) !== 'postgres') return;\n\n  assertPostgresChangeFeedTimestampCurrent(\n    await getPostgresChangeFeedSchemaState(db),\n  );\n\n  if (options.replaceExisting === false) {\n    if (await postgresChangeFeedAppendFunctionExists(db)) return;\n    await db.query(ENSURE_POSTGRES_CHANGE_FEED_APPEND_FUNCTION);\n    return;\n  }\n\n  await db.query(REPLACE_POSTGRES_CHANGE_FEED_APPEND_FUNCTION);\n}\n\nexport async function ensureChangeFeedTable(\n  db: DatabaseInterface,\n): Promise<void> {\n  if (ensuredHandles.has(db)) return;\n  if (getEngine(db) === 'postgres') {\n    const state = await getPostgresChangeFeedSchemaState(db);\n    assertPostgresChangeFeedTimestampCurrent(state);\n    if (\n      state.tableExists &&\n      state.functionExists &&\n      state.createdAtType === 'timestamp with time zone'\n    ) {\n      ensuredHandles.add(db);\n      return;\n    }\n    await db.query(ENSURE_POSTGRES_CHANGE_FEED_SCHEMA);\n  } else {\n    const statements = CREATE_SMRT_CHANGES_TABLE.split(';')\n      .map((statement) => statement.trim())\n      .filter((statement) => statement.length > 0);\n    for (const statement of statements) {\n      await db.query(statement);\n    }\n  }\n  ensuredHandles.add(db);\n}\n\n// ============================================================================\n// Append (writer primitive + manual bump escape hatch)\n// ============================================================================\n\n/**\n * Append one change entry with a database-allocated, strictly monotonic\n * sequence.\n *\n * The sequence is allocated inside the INSERT itself\n * (`COALESCE(MAX(seq), 0) + 1`) and retried on primary-key conflict, which\n * keeps committed sequences contiguous and makes commit order equal\n * sequence order — the property the cursor guarantee rests on (see the\n * module docs). Throws after {@link MAX_APPEND_ATTEMPTS} consecutive\n * conflicts or on any non-conflict database error; the framework's\n * interceptor catches and logs instead of failing the user's write.\n *\n * **PostgreSQL transaction safety (#2026).** The INSERT runs inside the\n * framework-owned `_smrt_append_change` PL/pgSQL function. Its exception\n * handler is a PostgreSQL subtransaction: a failed attempt is rolled back\n * before the function returns `{ error_code, error_message }`. This method\n * then throws in JavaScript, where the existing retry/swallow policy applies\n * without aborting a caller-managed transaction. Keeping isolation inside one\n * database statement also prevents concurrent work on the same transaction\n * handle from interleaving inside a manual SAVEPOINT scope.\n */\nexport async function appendChange(\n  db: DatabaseInterface,\n  input: AppendChangeInput,\n): Promise<number> {\n  const table = input.table?.trim();\n  if (!table) {\n    throw new Error('appendChange requires a non-empty table name');\n  }\n  const operation = input.operation ?? 'update';\n  if (!VALID_OPERATIONS.has(operation)) {\n    throw new Error(\n      `appendChange operation must be one of create/update/delete, got '${String(\n        input.operation,\n      )}'`,\n    );\n  }\n\n  const engine = getEngine(db);\n  const p = placeholders(db);\n  // The INSERT yields the ACTUAL sequence it allocated in the SAME statement\n  // (directly via RETURNING on portable engines, through the function on\n  // PostgreSQL). A separate follow-up `SELECT MAX(seq)` is racy under concurrent\n  // appends (a peer can commit a higher seq in between), which would hand two\n  // distinct changes the same SSE `id` and let a client's `Last-Event-ID`\n  // overshoot a change it never received. The allocator stays `MAX+1` under the\n  // unique-PK retry, so committed sequences remain contiguous (the cursor\n  // guarantee — see module docs).\n  const sql =\n    engine === 'postgres'\n      ? `SELECT allocated_seq, error_code, error_message FROM ` +\n        `${POSTGRES_CHANGE_FEED_APPEND_FUNCTION_NAME}(` +\n        `${p(1)}, ${p(2)}, ${p(3)}, ${p(4)}, ${p(5)})`\n      : `INSERT INTO ${CHANGE_FEED_TABLE} ` +\n        '(seq, table_name, row_id, operation, tenant_id, created_at) ' +\n        `SELECT COALESCE(MAX(seq), 0) + 1, ${p(1)}, ${p(2)}, ${p(3)}, ${p(4)}, ${p(5)} ` +\n        `FROM ${CHANGE_FEED_TABLE} RETURNING seq`;\n  const params = [\n    table,\n    input.rowId ?? null,\n    operation,\n    input.tenantId ?? null,\n    new Date().toISOString(),\n  ];\n\n  for (let attempt = 1; attempt <= MAX_APPEND_ATTEMPTS; attempt++) {\n    try {\n      const rows = getQueryRows(await db.query(sql, ...params));\n      const row = rows[0];\n      if (!row) {\n        throw new Error('Change feed append returned no result row');\n      }\n      if (engine === 'postgres' && row.error_code != null) {\n        const error = new Error(\n          String(row.error_message || 'PostgreSQL change-feed append failed'),\n        ) as Error & { code: string };\n        error.code = String(row.error_code);\n        throw error;\n      }\n      return toSeqNumber(engine === 'postgres' ? row.allocated_seq : row.seq);\n    } catch (error) {\n      if (!isUniqueViolation(error) || attempt === MAX_APPEND_ATTEMPTS) {\n        throw error;\n      }\n      // Sequence head contention: another append won the value. Re-running\n      // recomputes MAX(seq) against the now-committed head.\n    }\n  }\n\n  // Unreachable: the loop returns a seq or throws on the final attempt. Present\n  // so the function satisfies its `Promise<number>` contract structurally.\n  throw new Error('appendChange exhausted retries without allocating a seq');\n}\n\n/**\n * Manual bump escape hatch for out-of-band writers.\n *\n * Framework mutation paths feed the log automatically, but raw SQL issued\n * outside `save()`/`delete()` is invisible to it (documented gap, shared\n * with the #1499 collection cache). Call this after such a write so feed\n * consumers observe the change. Omitting `rowId` records a table-level\n * change (`rowId: null`), which consumers should treat as \"anything in this\n * table may have changed\".\n *\n * @example\n * ```typescript\n * await db.query(`UPDATE products SET price = price * 1.1`);\n * await bumpChangeFeed(db, { table: 'products' });\n * ```\n */\nexport async function bumpChangeFeed(\n  db: DatabaseInterface,\n  input: AppendChangeInput,\n): Promise<void> {\n  await ensureChangeFeedTable(db);\n  await appendChange(db, input);\n}\n\n// ============================================================================\n// Read interface\n// ============================================================================\n\n/**\n * Read committed changes after a cursor.\n *\n * Returns every committed change with `since < seq <= cursor` that matches\n * the filters, ordered by ascending `seq`. The returned cursor is safe to\n * persist and poll with: committed sequences are contiguous (see module\n * docs), so nothing can commit at or below the observed horizon afterwards —\n * reads miss no committed change under concurrent writers and never return\n * the same change twice. When `since` is already at the horizon, returns an\n * empty page with `cursor: since`.\n *\n * ## Resync detection (pruned / foreign cursors)\n *\n * A cursor that cannot be served incrementally is flagged with\n * `resyncRequired: true` (empty `changes`, `cursor` echoed unchanged,\n * `resyncCursor` set to the current horizon) so pollers never go silently,\n * permanently stale:\n *\n * - **Pruned gap**: retained sequences always form a contiguous run\n *   `[floor..horizon]` and {@link pruneChangeFeed} deletes oldest-first\n *   while always retaining the newest entry, so `since < floor - 1` proves\n *   changes between the cursor and the retained window were pruned away.\n * - **Foreign/reset cursor**: `since > horizon` (ahead of anything this\n *   database ever allocated), including any `since > 0` against a feed\n *   with no entries.\n *\n * Detection runs on the **unfiltered** log — `tables`/`tenantId` filters\n * legitimately hide rows and never trigger (or mask) the signal. A caught-up\n * consumer (`since === horizon`) is never asked to resync, even when\n * retention has pruned everything older.\n *\n * Filters (`tables`, `tenantId`) affect which rows are *returned*, never how\n * the cursor advances — an exhausted filtered page still advances to the\n * horizon so pollers do not rescan filtered-out rows.\n */\nexport async function getChangesSince(\n  db: DatabaseInterface,\n  options: GetChangesOptions,\n): Promise<ChangeFeedPage> {\n  const { since } = options;\n  if (!Number.isFinite(since) || since < 0) {\n    throw new Error(\n      `getChangesSince requires a non-negative numeric cursor, got '${String(since)}'`,\n    );\n  }\n  const limit = Math.min(\n    Math.max(Math.floor(options.limit ?? DEFAULT_CHANGES_LIMIT), 1),\n    MAX_CHANGES_LIMIT,\n  );\n\n  const p = placeholders(db);\n\n  // The committed horizon: every seq <= horizon is committed and immutable\n  // (append-only + contiguous allocation), so the page below is stable even\n  // though it runs as a separate statement. The floor bounds the retained\n  // window for pruned-cursor detection; both are computed UNFILTERED so\n  // table/tenant filters can neither trigger nor mask a resync signal.\n  const boundsRows = getQueryRows(\n    await db.query(\n      `SELECT MIN(seq) AS floor, MAX(seq) AS horizon FROM ${CHANGE_FEED_TABLE}`,\n    ),\n  );\n  const floor = toSeqNumber(boundsRows[0]?.floor);\n  const horizon = toSeqNumber(boundsRows[0]?.horizon);\n\n  if (horizon === 0) {\n    // No entries at all. A zero cursor is simply \"no changes ever\"; any\n    // other cursor came from a different database (or a reset feed) and\n    // cannot be served incrementally.\n    return since === 0\n      ? { changes: [], cursor: 0 }\n      : { changes: [], cursor: since, resyncRequired: true, resyncCursor: 0 };\n  }\n\n  if (since > horizon) {\n    // Foreign or reset cursor — ahead of anything this database allocated.\n    return {\n      changes: [],\n      cursor: since,\n      resyncRequired: true,\n      resyncCursor: horizon,\n    };\n  }\n\n  if (since < floor - 1) {\n    // Pruned gap — the changes with seq in (since, floor) are gone for good.\n    return {\n      changes: [],\n      cursor: since,\n      resyncRequired: true,\n      resyncCursor: horizon,\n    };\n  }\n\n  if (horizon === since) {\n    return { changes: [], cursor: since };\n  }\n\n  const conditions: string[] = [];\n  const params: unknown[] = [];\n  let index = 0;\n  const next = () => p(++index);\n\n  conditions.push(`seq > ${next()}`);\n  params.push(since);\n  conditions.push(`seq <= ${next()}`);\n  params.push(horizon);\n\n  const tables = options.tables?.filter((table) => table.trim().length > 0);\n  if (tables && tables.length > 0) {\n    conditions.push(`table_name IN (${tables.map(() => next()).join(', ')})`);\n    params.push(...tables);\n  }\n\n  if (options.tenantId === null) {\n    conditions.push('tenant_id IS NULL');\n  } else if (typeof options.tenantId === 'string') {\n    conditions.push(`(tenant_id = ${next()} OR tenant_id IS NULL)`);\n    params.push(options.tenantId);\n  }\n\n  const sql =\n    'SELECT seq, table_name, row_id, operation, tenant_id, created_at ' +\n    `FROM ${CHANGE_FEED_TABLE} WHERE ${conditions.join(' AND ')} ` +\n    `ORDER BY seq ASC LIMIT ${next()}`;\n  params.push(limit);\n\n  const rows = getQueryRows(await db.query(sql, ...params));\n  const changes = rows.map(rowToEntry);\n\n  // Page limited → resume after the last returned row. Page exhaustive →\n  // everything up to the horizon (matching or filtered out) has been\n  // observed, so advance all the way.\n  const cursor =\n    changes.length === limit ? changes[changes.length - 1].seq : horizon;\n\n  return { changes, cursor };\n}\n\n/**\n * {@link getChangesSince} scoped by the active tenant context.\n *\n * Resolves the tenant through the same dependency-inversion hook the\n * DispatchBus uses ({@link resolveDispatchTenantScope}), so it works without\n * core depending on `@happyvertical/smrt-tenancy`:\n *\n * - Tenancy disabled (no resolver registered) → no tenant filter.\n * - Tenancy enabled with an active tenant `T` → `T`'s rows plus global rows.\n * - Tenancy enabled with **no** active tenant → global rows only\n *   (**fail-closed**: a missing context never widens visibility to all\n *   tenants).\n *\n * This is the read the generated `_changes` routes call after establishing\n * tenant context from the authenticated principal.\n */\nexport async function getTenantScopedChangesSince(\n  db: DatabaseInterface,\n  options: Omit<GetChangesOptions, 'tenantId'>,\n): Promise<ChangeFeedPage> {\n  const scope = resolveDispatchTenantScope();\n  if (!scope.enforced) {\n    return getChangesSince(db, options);\n  }\n  return getChangesSince(db, { ...options, tenantId: scope.tenantId });\n}\n\n/**\n * The per-table change version — the ETag source for zero-query conditional\n * GETs (#1765).\n *\n * Returns `MAX(seq)` over the feed rows for `table`: a monotonic number that\n * advances on every framework write to that table (create/update/delete, and\n * writes through the sync-apply endpoint, which all `save()`/`delete()`).\n * Because sequences are the change feed's globally-monotonic cursor dimension\n * (allocated `MAX+1` at commit time, never a native identity — see the module\n * docs), the value is **replica-stable**: two processes reading the same\n * committed database compute the same version, with no per-process divergence.\n * That is what lets a generated read route derive an ETag that short-circuits a\n * matching `If-None-Match` into a `304` before the collection query runs — an\n * unchanged table costs one indexed `MAX(seq)` lookup (backed by\n * `idx_smrt_changes_table_seq`) to revalidate, not a table scan.\n *\n * ## Why the fallback to the global horizon (and not 0)\n *\n * A table with no *retained* feed entry falls back to the global horizon\n * (`MAX(seq)` across all tables), returning 0 only when the whole feed is\n * empty. Retention prunes oldest-first and always keeps the newest entry, so a\n * quiet table can lose all of its own entries while busier tables advance. If\n * such a table reported 0, a client that cached it while it was empty (version\n * 0) could, after a change→prune→change→prune cycle returned the lookup to 0,\n * be wrongly answered `304` against data that has since changed — a false-304.\n *\n * The horizon fallback closes that hole: any write to the table appends a new\n * sequence strictly greater than every previously-observed value (its own or\n * the horizon), so the version — and therefore the ETag — strictly exceeds any\n * value a client already holds, forcing a fresh `200`. The only cost is that a\n * table with no retained entries of its own revalidates whenever the global\n * horizon moves; a table with a retained entry uses its own stable `MAX(seq)`\n * and is unaffected by writes to sibling tables. A persistent per-table\n * high-water mark that survives pruning would remove even that cost; it is a\n * deliberate follow-up, out of scope for this slice.\n *\n * Idempotently ensures the feed table exists first, so it is safe to call from\n * a read route on a raw handle that has never been written to.\n */\nexport async function getTableVersion(\n  db: DatabaseInterface,\n  table: string,\n): Promise<number> {\n  const name = table?.trim();\n  if (!name) {\n    throw new Error('getTableVersion requires a non-empty table name');\n  }\n  await ensureChangeFeedTable(db);\n\n  const p = placeholders(db);\n  const tableRows = getQueryRows(\n    await db.query(\n      `SELECT MAX(seq) AS version FROM ${CHANGE_FEED_TABLE} WHERE table_name = ${p(1)}`,\n      name,\n    ),\n  );\n  const tableVersion = tableRows[0]?.version;\n  if (tableVersion != null) {\n    return toSeqNumber(tableVersion);\n  }\n\n  // No retained entry for this table — fall back to the global horizon so an\n  // all-pruned (or never-written) table never reports a resettable low value\n  // that could false-304 a stale client. 0 only when the feed is empty.\n  const horizonRows = getQueryRows(\n    await db.query(`SELECT MAX(seq) AS horizon FROM ${CHANGE_FEED_TABLE}`),\n  );\n  return toSeqNumber(horizonRows[0]?.horizon);\n}\n\nfunction toSeqNumber(value: unknown): number {\n  // Postgres adapters may surface BIGINT aggregates as strings.\n  const parsed = typeof value === 'number' ? value : Number(value ?? 0);\n  return Number.isFinite(parsed) ? parsed : 0;\n}\n\nfunction rowToEntry(row: Record<string, unknown>): ChangeFeedEntry {\n  return {\n    seq: toSeqNumber(row.seq),\n    table: String(row.table_name ?? ''),\n    rowId: row.row_id == null ? null : String(row.row_id),\n    operation: String(row.operation ?? 'update') as ChangeOperation,\n    tenantId: row.tenant_id == null ? null : String(row.tenant_id),\n    timestamp: normalizeTimestamp(row.created_at),\n  };\n}\n\nfunction normalizeTimestamp(value: unknown): string {\n  if (value instanceof Date) return value.toISOString();\n  return String(value ?? '');\n}\n\n// ============================================================================\n// Retention / compaction\n// ============================================================================\n\n/**\n * Prune the change feed to bound its growth.\n *\n * Applies whichever bounds are provided (at least one is required):\n * - `maxRows`: keep only the newest N entries by sequence.\n * - `maxAgeMs`: drop entries older than the cutoff.\n *\n * Pruning deletes oldest-first, never renumbers surviving entries, and\n * **always retains the newest entry** (a non-empty feed is never emptied,\n * whatever the bounds say). That invariant anchors pruned-cursor detection:\n * retained sequences stay a contiguous run `[floor..horizon]`, so\n * {@link getChangesSince} can prove a cursor predates the retained window\n * (`resyncRequired`) — and a fully caught-up consumer keeps polling\n * normally even after everything older was pruned.\n *\n * Cursors within the retained window keep working. Schedule pruning (e.g.\n * via `@happyvertical/smrt-jobs`) with a retention window comfortably\n * larger than the slowest consumer's polling interval; consumers whose\n * cursor falls out of it are told to full-resync via `resyncRequired`.\n *\n * @returns The number of entries pruned (approximate under concurrent prunes).\n */\nexport async function pruneChangeFeed(\n  db: DatabaseInterface,\n  retention: ChangeFeedRetention,\n): Promise<{ pruned: number }> {\n  const { maxAgeMs, maxRows } = retention;\n  if (maxAgeMs == null && maxRows == null) {\n    throw new Error('pruneChangeFeed requires maxAgeMs and/or maxRows');\n  }\n  if (maxAgeMs != null && (!Number.isFinite(maxAgeMs) || maxAgeMs < 0)) {\n    throw new Error(`pruneChangeFeed maxAgeMs must be >= 0, got ${maxAgeMs}`);\n  }\n  if (maxRows != null && (!Number.isFinite(maxRows) || maxRows < 0)) {\n    throw new Error(`pruneChangeFeed maxRows must be >= 0, got ${maxRows}`);\n  }\n\n  const p = placeholders(db);\n\n  // Snapshot the horizon once: both bounds prune strictly below it so the\n  // newest entry always survives (see resync-detection contract above).\n  const horizonRows = getQueryRows(\n    await db.query(`SELECT MAX(seq) AS horizon FROM ${CHANGE_FEED_TABLE}`),\n  );\n  const horizon = toSeqNumber(horizonRows[0]?.horizon);\n  if (horizon === 0) {\n    return { pruned: 0 };\n  }\n\n  let pruned = 0;\n\n  if (maxRows != null) {\n    const pruneThrough = Math.min(horizon - Math.floor(maxRows), horizon - 1);\n    if (pruneThrough > 0) {\n      pruned += await deleteCounted(db, `seq <= ${p(1)}`, [pruneThrough]);\n    }\n  }\n\n  if (maxAgeMs != null) {\n    const cutoff = new Date(Date.now() - maxAgeMs).toISOString();\n    pruned += await deleteCounted(\n      db,\n      `created_at < ${p(1)} AND seq < ${p(2)}`,\n      [cutoff, horizon],\n    );\n  }\n\n  return { pruned };\n}\n\nasync function deleteCounted(\n  db: DatabaseInterface,\n  condition: string,\n  params: unknown[],\n): Promise<number> {\n  const countRows = getQueryRows(\n    await db.query(\n      `SELECT COUNT(*) AS total FROM ${CHANGE_FEED_TABLE} WHERE ${condition}`,\n      ...params,\n    ),\n  );\n  const total = toSeqNumber(countRows[0]?.total);\n  if (total > 0) {\n    await db.query(\n      `DELETE FROM ${CHANGE_FEED_TABLE} WHERE ${condition}`,\n      ...params,\n    );\n  }\n  return total;\n}\n\n// ============================================================================\n// Framework writer (GlobalInterceptors registration)\n// ============================================================================\n\nconst WAS_PERSISTED_KEY = '_smrtChangeFeedWasPersisted';\n\n/** Databases we already warned about after a failed feed append. */\nconst warnedAppendFailures = new Set<string>();\n\n/** Databases we already warned about after a failed signal publish (#1763). */\nconst warnedSignalPublishFailures = new Set<string>();\n\n/**\n * Register the change-feed writer with {@link GlobalInterceptors}.\n *\n * Called automatically during framework initialization (every\n * `SmrtClass.initialize()` passes through it), so applications never need\n * to call it directly; it is exported for tests and for re-registering\n * after `GlobalInterceptors.clear()`. Idempotent — a second call while the\n * writer is registered is a no-op.\n *\n * The writer observes the same hooks the reports scheduler and tenancy\n * interceptors use:\n * - `beforeSave` stashes whether the instance was already persisted (this\n *   is what distinguishes `create` from `update` in the feed).\n * - `afterSave`/`afterDelete` append exactly one change entry per framework\n *   save/delete. `_smrt_*` system tables are skipped — the feed observes\n *   application data, not framework bookkeeping (and never itself).\n *\n * Failure policy: appends run after the user's write succeeded and must not\n * un-succeed it — failures are logged (deduped per database) and swallowed.\n */\nexport function registerChangeFeedWriter(): void {\n  if (\n    GlobalInterceptors.getAll().some(\n      (interceptor) => interceptor.name === CHANGE_FEED_INTERCEPTOR_NAME,\n    )\n  ) {\n    return;\n  }\n\n  GlobalInterceptors.register({\n    name: CHANGE_FEED_INTERCEPTOR_NAME,\n    // Below tenancy (100) so tenantId auto-population precedes the stash;\n    // above the reports refresh interceptor (-10) so a triggered refresh\n    // can already observe the appended change entry.\n    priority: 0,\n\n    beforeSave(instance: SmrtObject, context: InterceptorContext): void {\n      try {\n        context.metadata = {\n          ...context.metadata,\n          [WAS_PERSISTED_KEY]: instance.isPersisted === true,\n        };\n      } catch {\n        // Never let feed bookkeeping block a save.\n      }\n    },\n\n    async afterSave(\n      instance: SmrtObject,\n      context: InterceptorContext,\n    ): Promise<void> {\n      const wasPersisted = context.metadata?.[WAS_PERSISTED_KEY] === true;\n      await appendForInstance(instance, wasPersisted ? 'update' : 'create');\n    },\n\n    async afterDelete(instance: SmrtObject): Promise<void> {\n      await appendForInstance(instance, 'delete');\n    },\n  });\n}\n\n/** Unregister the change-feed writer (test helper). */\nexport function unregisterChangeFeedWriter(): boolean {\n  return GlobalInterceptors.unregister(CHANGE_FEED_INTERCEPTOR_NAME);\n}\n\nasync function appendForInstance(\n  instance: SmrtObject,\n  operation: ChangeOperation,\n): Promise<void> {\n  let db: DatabaseInterface;\n  let table: string;\n  try {\n    table = instance.tableName;\n    // System tables are framework bookkeeping, not client-syncable data —\n    // recording them would let the feed observe (and re-observe) itself.\n    if (!table || table.startsWith('_smrt_')) return;\n    db = instance.db;\n  } catch {\n    // Not a fully initialized SmrtObject (e.g. plain-object doubles in\n    // tests) — nothing to record.\n    return;\n  }\n\n  try {\n    const id = (instance as { id?: unknown }).id;\n    const tenantId = (instance as unknown as Record<string, unknown>).tenantId;\n    const rowId = typeof id === 'string' && id ? id : null;\n    const rowTenantId =\n      typeof tenantId === 'string' && tenantId ? tenantId : null;\n    const seq = await appendChange(db, {\n      table,\n      rowId,\n      operation,\n      tenantId: rowTenantId,\n    });\n\n    // Publish a coarse live signal for the SSE `_events` route (#1763). This\n    // runs only after the durable feed append SUCCEEDED (same try block, so a\n    // failed append never emits a signal — \"no signal without a durable feed\n    // row\"). Its own try/catch (distinct dedup key) keeps a signal-publish\n    // problem from failing the user's write or masking the append's own\n    // failure semantics above.\n    try {\n      publishChangeSignal(db, {\n        table,\n        operation,\n        rowId,\n        tenantId: rowTenantId,\n        seq,\n      });\n    } catch (error) {\n      warnSignalPublishFailureOnce(db, table, error);\n    }\n  } catch (error) {\n    warnAppendFailureOnce(db, table, error);\n  }\n}\n\nfunction warnAppendFailureOnce(\n  db: DatabaseInterface,\n  table: string,\n  error: unknown,\n): void {\n  try {\n    const dbKey = resolveDbCacheKey(db);\n    if (warnedAppendFailures.has(dbKey)) return;\n    warnedAppendFailures.add(dbKey);\n    logger.warn(\n      `Change feed: failed to append a change entry for '${table}'. The ` +\n        'write itself succeeded; the feed is missing this change (further ' +\n        'failures for this database are suppressed). Consumers recover on ' +\n        'full resync.',\n      { error: error instanceof Error ? error.message : String(error) },\n    );\n  } catch {\n    // Logging must never propagate into the write path.\n  }\n}\n\nfunction warnSignalPublishFailureOnce(\n  db: DatabaseInterface,\n  table: string,\n  error: unknown,\n): void {\n  try {\n    const dbKey = resolveDbCacheKey(db);\n    if (warnedSignalPublishFailures.has(dbKey)) return;\n    warnedSignalPublishFailures.add(dbKey);\n    logger.warn(\n      `Change feed: failed to publish a live change signal for '${table}'. ` +\n        'The write and its durable feed row are unaffected; live SSE ' +\n        'subscribers miss this signal but recover via cursor catch-up ' +\n        '(further failures for this database are suppressed).',\n      { error: error instanceof Error ? error.message : String(error) },\n    );\n  } catch {\n    // Logging must never propagate into the write path.\n  }\n}\n\n/**\n * Reset the append-failure and signal-publish warning dedups (test helper).\n */\nexport function resetChangeFeedWarnings(): void {\n  warnedAppendFailures.clear();\n  warnedSignalPublishFailures.clear();\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6GA,IAAM,SAAS,aAAa,EAAE,OAAO,OAAO,CAAC;;AAG7C,IAAa,oBAAoB;;AAGjC,IAAa,+BAA+B;;AAyH5C,IAAa,wBAAwB;;AAGrC,IAAa,oBAAoB;;;;;;AAOjC,IAAM,sBAAsB;AAE5B,IAAM,mCAAwC,IAAI,IAAI;CACpD;CACA;CACA;AACF,CAAC;AAWD,SAAS,UACP,IACA,UACiC;CACjC,MAAM,aAAa;CACnB,OAAO,aACL,GAAG,OAAO,WAAW,QAAQ,OAAO,IACpC,YAAY,WAAW,QAAQ,WAAW,QAAQ,IACpD;AACF;;;;AAKA,SAAS,aAAa,IAAkD;CAEtE,OADe,UAAU,EAClB,MAAW,cAAc,UAAU,IAAI,gBAAgB;AAChE;AAEA,SAAS,aAAa,QAA4C;CAChE,IAAI,MAAM,QAAQ,MAAM,GACtB,OAAO;CAET,IAAI,UAAU,OAAO,WAAW,YAAY,UAAU,QAAQ;EAC5D,MAAM,OAAQ,OAA8B;EAC5C,IAAI,MAAM,QAAQ,IAAI,GACpB,OAAO;CAEX;CACA,OAAO,CAAC;AACV;AAEA,SAAS,kBAAkB,OAAyB;CAClD,MAAM,UAAoB,CAAC;CAC3B,MAAM,UAAqB,CAAC,KAAK;CACjC,MAAM,uBAAO,IAAI,IAAY;CAE7B,OAAO,QAAQ,SAAS,KAAK,KAAK,OAAO,GAAG;EAC1C,MAAM,YAAY,QAAQ,MAAM;EAChC,IAAI,OAAO,cAAc,UAAU;GACjC,QAAQ,KAAK,SAAS;GACtB;EACF;EACA,IAAI,CAAC,aAAa,OAAO,cAAc,YAAY,KAAK,IAAI,SAAS,GACnE;EAEF,KAAK,IAAI,SAAS;EAElB,MAAM,SAAS;EAMf,IAAI,OAAO,OAAO,YAAY,UAAU,QAAQ,KAAK,OAAO,OAAO;EACnE,IAAI,OAAO,OAAO,SAAS,UAAU,QAAQ,KAAK,OAAO,IAAI;EAC7D,IAAI,OAAO,UAAU,KAAA,GAAW,QAAQ,KAAK,OAAO,KAAK;EAEzD,IAAI,OAAO,WAAW,OAAO,OAAO,YAAY,UAAU;GACxD,MAAM,gBAAiB,OAAO,QAC3B;GACH,IAAI,kBAAkB,KAAA,GAAW,QAAQ,KAAK,aAAa;EAC7D;CACF;CAEA,MAAM,UAAU,QAAQ,KAAK,IAAI;CACjC,OACE,YAAY,KAAK,OAAO,KACxB,qBAAqB,KAAK,OAAO,KACjC,iBAAiB,KAAK,OAAO,KAC7B,0BAA0B,KAAK,OAAO,KACtC,oBAAoB,KAAK,OAAO;AAEpC;;;;;;;;AASA,IAAM,iCAAiB,IAAI,QAAgB;AAE3C,eAAe,uCACb,IACkB;CAClB,MAAM,OAAO,aACX,MAAM,GAAG,MACP,2BAA2B,8CAA8C,oBAC3E,CACF;CACA,OAAO,QAAQ,KAAK,EAAE,EAAE,aAAa;AACvC;AAEA,eAAe,iCACb,IAKC;CACD,MAAM,OAAO,aACX,MAAM,GAAG,MACP;wBACkB,kBAAkB;4BACd,8CAA8C;;;;;iCAKzC,kBAAkB;;8BAG/C,CACF;CACA,OAAO;EACL,aAAa,QAAQ,KAAK,EAAE,EAAE,UAAU;EACxC,gBAAgB,QAAQ,KAAK,EAAE,EAAE,aAAa;EAC9C,eAAe,KAAK,EAAE,EAAE,kBACpB,OAAO,KAAK,EAAE,CAAC,eAAe,IAC9B;CACN;AACF;AAEA,SAAS,yCACP,OACM;CACN,IAAI,MAAM,kBAAkB,+BAC1B,MAAM,IAAI,MACR,uIACF;AAEJ;;;;;;;;;;;;;AAcA,eAAsB,uCACpB,IACA,UAGI,CAAC,GACU;CACf,IAAI,UAAU,IAAI,QAAQ,QAAQ,MAAM,YAAY;CAEpD,yCACE,MAAM,iCAAiC,EAAE,CAC3C;CAEA,IAAI,QAAQ,oBAAoB,OAAO;EACrC,IAAI,MAAM,uCAAuC,EAAE,GAAG;EACtD,MAAM,GAAG,MAAM,2CAA2C;EAC1D;CACF;CAEA,MAAM,GAAG,MAAM,4CAA4C;AAC7D;AAEA,eAAsB,sBACpB,IACe;CACf,IAAI,eAAe,IAAI,EAAE,GAAG;CAC5B,IAAI,UAAU,EAAE,MAAM,YAAY;EAChC,MAAM,QAAQ,MAAM,iCAAiC,EAAE;EACvD,yCAAyC,KAAK;EAC9C,IACE,MAAM,eACN,MAAM,kBACN,MAAM,kBAAkB,4BACxB;GACA,eAAe,IAAI,EAAE;GACrB;EACF;EACA,MAAM,GAAG,MAAM,kCAAkC;CACnD,OAAO;EACL,MAAM,aAAa,0BAA0B,MAAM,GAAG,CAAC,CACpD,KAAK,cAAc,UAAU,KAAK,CAAC,CAAC,CACpC,QAAQ,cAAc,UAAU,SAAS,CAAC;EAC7C,KAAK,MAAM,aAAa,YACtB,MAAM,GAAG,MAAM,SAAS;CAE5B;CACA,eAAe,IAAI,EAAE;AACvB;;;;;;;;;;;;;;;;;;;;;;AA2BA,eAAsB,aACpB,IACA,OACiB;CACjB,MAAM,QAAQ,MAAM,OAAO,KAAK;CAChC,IAAI,CAAC,OACH,MAAM,IAAI,MAAM,8CAA8C;CAEhE,MAAM,YAAY,MAAM,aAAa;CACrC,IAAI,CAAC,iBAAiB,IAAI,SAAS,GACjC,MAAM,IAAI,MACR,oEAAoE,OAClE,MAAM,SACR,EAAE,EACJ;CAGF,MAAM,SAAS,UAAU,EAAE;CAC3B,MAAM,IAAI,aAAa,EAAE;CASzB,MAAM,MACJ,WAAW,aACP,wDACG,0CAA0C,GAC1C,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAC5C,eAAe,kBAAkB,iGAEI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,QACtE,kBAAkB;CAChC,MAAM,SAAS;EACb;EACA,MAAM,SAAS;EACf;EACA,MAAM,YAAY;mBAClB,IAAI,KAAK,EAAA,CAAE,YAAY;CACzB;CAEA,KAAK,IAAI,UAAU,GAAG,WAAW,qBAAqB,WACpD,IAAI;EAEF,MAAM,MADO,aAAa,MAAM,GAAG,MAAM,KAAK,GAAG,MAAM,CAC3C,CAAA,CAAK;EACjB,IAAI,CAAC,KACH,MAAM,IAAI,MAAM,2CAA2C;EAE7D,IAAI,WAAW,cAAc,IAAI,cAAc,MAAM;GACnD,MAAM,QAAQ,IAAI,MAChB,OAAO,IAAI,iBAAiB,sCAAsC,CACpE;GACA,MAAM,OAAO,OAAO,IAAI,UAAU;GAClC,MAAM;EACR;EACA,OAAO,YAAY,WAAW,aAAa,IAAI,gBAAgB,IAAI,GAAG;CACxE,SAAS,OAAO;EACd,IAAI,CAAC,kBAAkB,KAAK,KAAK,YAAY,qBAC3C,MAAM;CAIV;CAKF,MAAM,IAAI,MAAM,yDAAyD;AAC3E;;;;;;;;;;;;;;;;;AAkBA,eAAsB,eACpB,IACA,OACe;CACf,MAAM,sBAAsB,EAAE;CAC9B,MAAM,aAAa,IAAI,KAAK;AAC9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyCA,eAAsB,gBACpB,IACA,SACyB;CACzB,MAAM,EAAE,UAAU;CAClB,IAAI,CAAC,OAAO,SAAS,KAAK,KAAK,QAAQ,GACrC,MAAM,IAAI,MACR,gEAAgE,OAAO,KAAK,EAAE,EAChF;CAEF,MAAM,QAAQ,KAAK,IACjB,KAAK,IAAI,KAAK,MAAM,QAAQ,SAAA,GAA8B,GAAG,CAAC,GAC9D,iBACF;CAEA,MAAM,IAAI,aAAa,EAAE;CAOzB,MAAM,aAAa,aACjB,MAAM,GAAG,MACP,sDAAsD,mBACxD,CACF;CACA,MAAM,QAAQ,YAAY,WAAW,EAAE,EAAE,KAAK;CAC9C,MAAM,UAAU,YAAY,WAAW,EAAE,EAAE,OAAO;CAElD,IAAI,YAAY,GAId,OAAO,UAAU,IACb;EAAE,SAAS,CAAC;EAAG,QAAQ;CAAE,IACzB;EAAE,SAAS,CAAC;EAAG,QAAQ;EAAO,gBAAgB;EAAM,cAAc;CAAE;CAG1E,IAAI,QAAQ,SAEV,OAAO;EACL,SAAS,CAAC;EACV,QAAQ;EACR,gBAAgB;EAChB,cAAc;CAChB;CAGF,IAAI,QAAQ,QAAQ,GAElB,OAAO;EACL,SAAS,CAAC;EACV,QAAQ;EACR,gBAAgB;EAChB,cAAc;CAChB;CAGF,IAAI,YAAY,OACd,OAAO;EAAE,SAAS,CAAC;EAAG,QAAQ;CAAM;CAGtC,MAAM,aAAuB,CAAC;CAC9B,MAAM,SAAoB,CAAC;CAC3B,IAAI,QAAQ;CACZ,MAAM,aAAa,EAAE,EAAE,KAAK;CAE5B,WAAW,KAAK,SAAS,KAAK,GAAG;CACjC,OAAO,KAAK,KAAK;CACjB,WAAW,KAAK,UAAU,KAAK,GAAG;CAClC,OAAO,KAAK,OAAO;CAEnB,MAAM,SAAS,QAAQ,QAAQ,QAAQ,UAAU,MAAM,KAAK,CAAC,CAAC,SAAS,CAAC;CACxE,IAAI,UAAU,OAAO,SAAS,GAAG;EAC/B,WAAW,KAAK,kBAAkB,OAAO,UAAU,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE;EACxE,OAAO,KAAK,GAAG,MAAM;CACvB;CAEA,IAAI,QAAQ,aAAa,MACvB,WAAW,KAAK,mBAAmB;MAC9B,IAAI,OAAO,QAAQ,aAAa,UAAU;EAC/C,WAAW,KAAK,gBAAgB,KAAK,EAAE,uBAAuB;EAC9D,OAAO,KAAK,QAAQ,QAAQ;CAC9B;CAEA,MAAM,MACJ,yEACQ,kBAAkB,SAAS,WAAW,KAAK,OAAO,EAAE,0BAClC,KAAK;CACjC,OAAO,KAAK,KAAK;CAGjB,MAAM,UADO,aAAa,MAAM,GAAG,MAAM,KAAK,GAAG,MAAM,CACvC,CAAA,CAAK,IAAI,UAAU;CAQnC,OAAO;EAAE;EAAS,QAFhB,QAAQ,WAAW,QAAQ,QAAQ,QAAQ,SAAS,EAAE,CAAC,MAAM;CAEtC;AAC3B;;;;;;;;;;;;;;;;;AAkBA,eAAsB,4BACpB,IACA,SACyB;CACzB,MAAM,QAAQ,2BAA2B;CACzC,IAAI,CAAC,MAAM,UACT,OAAO,gBAAgB,IAAI,OAAO;CAEpC,OAAO,gBAAgB,IAAI;EAAE,GAAG;EAAS,UAAU,MAAM;CAAS,CAAC;AACrE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyCA,eAAsB,gBACpB,IACA,OACiB;CACjB,MAAM,OAAO,OAAO,KAAK;CACzB,IAAI,CAAC,MACH,MAAM,IAAI,MAAM,iDAAiD;CAEnE,MAAM,sBAAsB,EAAE;CAE9B,MAAM,IAAI,aAAa,EAAE;CAOzB,MAAM,eANY,aAChB,MAAM,GAAG,MACP,mCAAmC,kBAAkB,sBAAsB,EAAE,CAAC,KAC9E,IACF,CAEmB,CAAA,CAAU,EAAE,EAAE;CACnC,IAAI,gBAAgB,MAClB,OAAO,YAAY,YAAY;CASjC,OAAO,YAHa,aAClB,MAAM,GAAG,MAAM,mCAAmC,mBAAmB,CAEpD,CAAA,CAAY,EAAE,EAAE,OAAO;AAC5C;AAEA,SAAS,YAAY,OAAwB;CAE3C,MAAM,SAAS,OAAO,UAAU,WAAW,QAAQ,OAAO,SAAS,CAAC;CACpE,OAAO,OAAO,SAAS,MAAM,IAAI,SAAS;AAC5C;AAEA,SAAS,WAAW,KAA+C;CACjE,OAAO;EACL,KAAK,YAAY,IAAI,GAAG;EACxB,OAAO,OAAO,IAAI,cAAc,EAAE;EAClC,OAAO,IAAI,UAAU,OAAO,OAAO,OAAO,IAAI,MAAM;EACpD,WAAW,OAAO,IAAI,aAAa,QAAQ;EAC3C,UAAU,IAAI,aAAa,OAAO,OAAO,OAAO,IAAI,SAAS;EAC7D,WAAW,mBAAmB,IAAI,UAAU;CAC9C;AACF;AAEA,SAAS,mBAAmB,OAAwB;CAClD,IAAI,iBAAiB,MAAM,OAAO,MAAM,YAAY;CACpD,OAAO,OAAO,SAAS,EAAE;AAC3B;;;;;;;;;;;;;;;;;;;;;;;AA4BA,eAAsB,gBACpB,IACA,WAC6B;CAC7B,MAAM,EAAE,UAAU,YAAY;CAC9B,IAAI,YAAY,QAAQ,WAAW,MACjC,MAAM,IAAI,MAAM,kDAAkD;CAEpE,IAAI,YAAY,SAAS,CAAC,OAAO,SAAS,QAAQ,KAAK,WAAW,IAChE,MAAM,IAAI,MAAM,8CAA8C,UAAU;CAE1E,IAAI,WAAW,SAAS,CAAC,OAAO,SAAS,OAAO,KAAK,UAAU,IAC7D,MAAM,IAAI,MAAM,6CAA6C,SAAS;CAGxE,MAAM,IAAI,aAAa,EAAE;CAOzB,MAAM,UAAU,YAHI,aAClB,MAAM,GAAG,MAAM,mCAAmC,mBAAmB,CAE3C,CAAA,CAAY,EAAE,EAAE,OAAO;CACnD,IAAI,YAAY,GACd,OAAO,EAAE,QAAQ,EAAE;CAGrB,IAAI,SAAS;CAEb,IAAI,WAAW,MAAM;EACnB,MAAM,eAAe,KAAK,IAAI,UAAU,KAAK,MAAM,OAAO,GAAG,UAAU,CAAC;EACxE,IAAI,eAAe,GACjB,UAAU,MAAM,cAAc,IAAI,UAAU,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC;CAEtE;CAEA,IAAI,YAAY,MAAM;EACpB,MAAM,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,QAAQ,CAAC,CAAC,YAAY;EAC3D,UAAU,MAAM,cACd,IACA,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,KACrC,CAAC,QAAQ,OAAO,CAClB;CACF;CAEA,OAAO,EAAE,OAAO;AAClB;AAEA,eAAe,cACb,IACA,WACA,QACiB;CAOjB,MAAM,QAAQ,YANI,aAChB,MAAM,GAAG,MACP,iCAAiC,kBAAkB,SAAS,aAC5D,GAAG,MACL,CAEwB,CAAA,CAAU,EAAE,EAAE,KAAK;CAC7C,IAAI,QAAQ,GACV,MAAM,GAAG,MACP,eAAe,kBAAkB,SAAS,aAC1C,GAAG,MACL;CAEF,OAAO;AACT;AAMA,IAAM,oBAAoB;;AAG1B,IAAM,uCAAuB,IAAI,IAAY;;AAG7C,IAAM,8CAA8B,IAAI,IAAY;;;;;;;;;;;;;;;;;;;;;AAsBpD,SAAgB,2BAAiC;CAC/C,IACE,mBAAmB,OAAO,CAAC,CAAC,MACzB,gBAAgB,YAAY,SAAA,kBAC/B,GAEA;CAGF,mBAAmB,SAAS;EAC1B,MAAM;EAIN,UAAU;EAEV,WAAW,UAAsB,SAAmC;GAClE,IAAI;IACF,QAAQ,WAAW;KACjB,GAAG,QAAQ;MACV,oBAAoB,SAAS,gBAAgB;IAChD;GACF,QAAQ,CAER;EACF;EAEA,MAAM,UACJ,UACA,SACe;GAEf,MAAM,kBAAkB,UADH,QAAQ,WAAW,uBAAuB,OACd,WAAW,QAAQ;EACtE;EAEA,MAAM,YAAY,UAAqC;GACrD,MAAM,kBAAkB,UAAU,QAAQ;EAC5C;CACF,CAAC;AACH;;AAGA,SAAgB,6BAAsC;CACpD,OAAO,mBAAmB,WAAW,4BAA4B;AACnE;AAEA,eAAe,kBACb,UACA,WACe;CACf,IAAI;CACJ,IAAI;CACJ,IAAI;EACF,QAAQ,SAAS;EAGjB,IAAI,CAAC,SAAS,MAAM,WAAW,QAAQ,GAAG;EAC1C,KAAK,SAAS;CAChB,QAAQ;EAGN;CACF;CAEA,IAAI;EACF,MAAM,KAAM,SAA8B;EAC1C,MAAM,WAAY,SAAgD;EAClE,MAAM,QAAQ,OAAO,OAAO,YAAY,KAAK,KAAK;EAClD,MAAM,cACJ,OAAO,aAAa,YAAY,WAAW,WAAW;EACxD,MAAM,MAAM,MAAM,aAAa,IAAI;GACjC;GACA;GACA;GACA,UAAU;EACZ,CAAC;EAQD,IAAI;GACF,oBAAoB,IAAI;IACtB;IACA;IACA;IACA,UAAU;IACV;GACF,CAAC;EACH,SAAS,OAAO;GACd,6BAA6B,IAAI,OAAO,KAAK;EAC/C;CACF,SAAS,OAAO;EACd,sBAAsB,IAAI,OAAO,KAAK;CACxC;AACF;AAEA,SAAS,sBACP,IACA,OACA,OACM;CACN,IAAI;EACF,MAAM,QAAQ,kBAAkB,EAAE;EAClC,IAAI,qBAAqB,IAAI,KAAK,GAAG;EACrC,qBAAqB,IAAI,KAAK;EAC9B,OAAO,KACL,qDAAqD,MAAM,wJAI3D,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,CAClE;CACF,QAAQ,CAER;AACF;AAEA,SAAS,6BACP,IACA,OACA,OACM;CACN,IAAI;EACF,MAAM,QAAQ,kBAAkB,EAAE;EAClC,IAAI,4BAA4B,IAAI,KAAK,GAAG;EAC5C,4BAA4B,IAAI,KAAK;EACrC,OAAO,KACL,4DAA4D,MAAM,mLAIlE,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,CAClE;CACF,QAAQ,CAER;AACF;;;;AAKA,SAAgB,0BAAgC;CAC9C,qBAAqB,MAAM;CAC3B,4BAA4B,MAAM;AACpC"}
+{"version":3,"file":"change-feed.js","names":[],"sources":["../src/change-feed.ts"],"sourcesContent":["/**\n * Adapter-agnostic change feed — the framework's change-observation spine\n * (issue #1758, parent PRD #1755).\n *\n * Every framework `save()`/`delete()` appends exactly one row to the\n * `_smrt_changes` system table (monotonic per-database sequence, table name,\n * row id, operation, tenant id, timestamp). Deletes are recorded as\n * tombstones (`operation: 'delete'`), distinguishable from updates. One read\n * interface — {@link getChangesSince} — returns changes after a cursor,\n * filterable by table and tenant, and serves three eventual consumers:\n * client delta pull, the SSE push channel, and the per-table version source\n * backing ETags.\n *\n * ## Cursor semantics (the precise guarantee)\n *\n * Sequences are allocated *inside* the append statement as\n * `COALESCE(MAX(seq), 0) + 1` over the feed table itself, with a retry on\n * primary-key conflict. `MAX(seq)` only observes committed rows, so a row\n * with sequence `N` can only be inserted while every row with sequence\n * `< N` is already committed (a conflicting in-flight allocation of the same\n * value blocks, then retries). Committed rows therefore always form a\n * contiguous run ending at `MAX(seq)` — the **committed horizon**. Sequence\n * order equals commit order; out-of-order commit visibility (the classic\n * MVCC race that makes native identity/serial columns unsafe as cursors\n * under concurrent writers) cannot occur.\n *\n * {@link getChangesSince} reads the committed horizon `H = MAX(seq)`, then\n * returns matching rows with `since < seq <= H` (bounded by `limit`), and a\n * `cursor` that is either `H` (page exhaustive) or the last returned `seq`\n * (page limited). Because no change can ever commit at or below an observed\n * horizon after it was observed, polling with returned cursors misses no\n * committed change and never returns the same change twice — under any\n * number of concurrent writers, identically on SQLite, Postgres and DuckDB.\n * This is the design reason the allocator is `MAX+1` rather than a native\n * AUTOINCREMENT/identity column: identity values are allocated before\n * commit, so a reader on Postgres could observe seq 101 while seq 100 is\n * still uncommitted and advance its cursor past it. (No shared\n * auto-increment mechanism exists in the system-table schema path either;\n * see `system/schema.ts`.)\n *\n * Contention note: appends serialize on the head of the log. Each append is\n * one small INSERT (issued from the write path *after* the user's row was\n * written), so the serialization window is one statement; conflicts resolve\n * with a bounded retry loop and are impossible on single-writer engines\n * (SQLite). PostgreSQL invokes that INSERT through the framework-owned\n * `_smrt_append_change` function so failure isolation remains one statement.\n *\n * ## Failure semantics\n *\n * A feed-write failure must never fail the user's write. The interceptor\n * wraps the append in a try/catch: on failure it logs a warning (deduped per\n * database) and continues. The trade-off is availability of the user's\n * write over completeness of the feed — consumers already need a\n * full-resync path for cursors older than the retention window, and the\n * same path covers a (rare) dropped feed row. PostgreSQL runs the INSERT in a\n * PL/pgSQL exception subtransaction and returns a caught SQLSTATE as data;\n * JavaScript only throws/logs after PostgreSQL has restored the caller's\n * transaction, so a swallowed append failure cannot surface later as 25P02.\n * The append still joins a caller-managed transaction on the same handle and\n * shares its fate (a rollback removes the change row with the data row).\n *\n * ## Known gaps (documented in the PRD)\n *\n * - Writes that bypass framework mutation paths (raw SQL) are invisible to\n *   the feed — the same accepted gap as the #1499 collection cache.\n *   {@link bumpChangeFeed} is the manual escape hatch: out-of-band writers\n *   append a synthetic change row for the affected table.\n * - **Spurious `update` entries**: `SmrtObject.save()` has no dirty-check,\n *   so a field-unchanged `.save()` still appends an `update` row. This is\n *   by design — the writer observes writes, not diffs (it has no old-row\n *   access), so the feed faithfully mirrors the write path. Diff-aware\n *   paths (`getOrUpsert()`'s diff guard, the sync-apply endpoint's no-op\n *   detection) short-circuit before `save()` and append nothing.\n *   Subscribers must tolerate spurious entries; they are convergent — a\n *   re-fetch returns identical data.\n *\n * ## Retention\n *\n * The log is append-only and grows with write volume. {@link pruneChangeFeed}\n * bounds it by age (`maxAgeMs`) and/or row count (`maxRows`); call it from a\n * scheduled job sized so the retention window comfortably exceeds the\n * slowest consumer's polling interval. Pruning deletes oldest-first and\n * always retains the newest entry, so retained sequences stay a contiguous\n * `[floor..horizon]` run — which is how {@link getChangesSince} *detects* a\n * consumer whose cursor predates the retained window and answers it with\n * `resyncRequired: true` plus a fresh resume cursor instead of silently\n * skipping the pruned changes.\n *\n * @see https://github.com/happyvertical/smrt/issues/1758\n * @packageDocumentation\n */\n\nimport { createLogger } from '@happyvertical/logger';\nimport type { DatabaseInterface } from '@happyvertical/sql';\nimport { publishChangeSignal } from './change-signals.js';\nimport { resolveDbCacheKey } from './collection-cache.js';\nimport { resolveDispatchTenantScope } from './dispatch/tenant-resolver.js';\nimport {\n  isEmbeddedDatabase,\n  withEmbeddedWriteQueue,\n} from './embedded-write-queue.js';\nimport { GlobalInterceptors, type InterceptorContext } from './interceptors.js';\nimport type { SmrtObject } from './object.js';\nimport { detectEngine } from './schema/ddl/index.js';\nimport { SYSTEM_TABLE_NAMES } from './schema/system-table-shapes.js';\nimport {\n  CREATE_SMRT_CHANGES_TABLE,\n  ENSURE_POSTGRES_CHANGE_FEED_APPEND_FUNCTION,\n  ENSURE_POSTGRES_CHANGE_FEED_SCHEMA,\n  FRAMEWORK_OPERATIONAL_TABLES,\n  POSTGRES_CHANGE_FEED_APPEND_FUNCTION_IDENTITY,\n  POSTGRES_CHANGE_FEED_APPEND_FUNCTION_NAME,\n  REPLACE_POSTGRES_CHANGE_FEED_APPEND_FUNCTION,\n  RETIRED_SYSTEM_TABLES,\n} from './system/schema.js';\nimport { toSafeInteger } from './utils/safe-integer.js';\n\nconst logger = createLogger({ level: 'info' });\n\n/** Name of the append-only change-feed system table. */\nexport const CHANGE_FEED_TABLE = '_smrt_changes';\n\n/**\n * Tables the change-feed writer never records (issue #2376).\n *\n * The writer used to skip every table whose name started with `_smrt_`. That\n * prefix stopped meaning \"framework bookkeeping\" once packages began naming\n * their *domain* tables `_smrt_feature_overrides`, `_smrt_prompt_overrides`,\n * `_smrt_subscription_plans`, `_smrt_report_schedules`, `_smrt_field_policies`\n * and ~20 more: clients syncing those through `_changes` never saw an update.\n *\n * The exclusion is now an allowlist of tables the framework actually owns —\n * the hand-written bookkeeping DDL ({@link SYSTEM_TABLE_NAMES}, which includes\n * the feed's own table so it can never observe itself), the model-backed\n * operational plumbing ({@link FRAMEWORK_OPERATIONAL_TABLES}), and the retired\n * system tables that may still exist on older databases.\n */\nexport const CHANGE_FEED_EXCLUDED_TABLES: ReadonlySet<string> = new Set([\n  ...SYSTEM_TABLE_NAMES,\n  ...FRAMEWORK_OPERATIONAL_TABLES,\n  ...RETIRED_SYSTEM_TABLES,\n]);\n\n/**\n * Whether framework writes to `tableName` are recorded in the change feed.\n *\n * Exported so tooling and tests can reason about feed coverage without\n * re-deriving the rule. See {@link CHANGE_FEED_EXCLUDED_TABLES}.\n */\nexport function isChangeFeedObservableTable(tableName: string): boolean {\n  return Boolean(tableName) && !CHANGE_FEED_EXCLUDED_TABLES.has(tableName);\n}\n\n/** Interceptor name of the framework's change-feed writer. */\nexport const CHANGE_FEED_INTERCEPTOR_NAME = 'smrt-change-feed';\n\n/**\n * Change operations recorded in the feed. Deletes are tombstones —\n * consumers can distinguish \"row changed\" from \"row is gone\" without\n * consulting the source table.\n */\nexport type ChangeOperation = 'create' | 'update' | 'delete';\n\n/** One entry of the change feed. */\nexport interface ChangeFeedEntry {\n  /** Strictly monotonic per-database sequence (the cursor dimension). */\n  seq: number;\n  /** Physical table the change happened in (STI children report the shared base table). */\n  table: string;\n  /**\n   * Primary key of the changed row, or `null` for table-level synthetic\n   * bumps recorded via {@link bumpChangeFeed} without a row id.\n   */\n  rowId: string | null;\n  /** What happened. `'delete'` entries double as tombstones. */\n  operation: ChangeOperation;\n  /** Tenant the changed row belongs to, or `null` for global/non-tenant rows. */\n  tenantId: string | null;\n  /** ISO-8601 timestamp recorded when the change was appended. */\n  timestamp: string;\n}\n\n/** Options for {@link getChangesSince}. */\nexport interface GetChangesOptions {\n  /**\n   * Cursor to read after. Only rows with `seq` strictly greater than `since`\n   * are returned; pass a previously returned {@link ChangeFeedPage.cursor} to\n   * poll.\n   *\n   * `0` reads from the start of the log only while it has not been pruned past\n   * the beginning. Once retention has raised the retained floor above the\n   * start, `since: 0` (like any cursor older than the retained window) can no\n   * longer be served incrementally — the read returns\n   * {@link ChangeFeedPage.resyncRequired} and the caller must do a full\n   * resync before resuming from {@link ChangeFeedPage.resyncCursor}.\n   */\n  since: number;\n  /** Restrict to these physical table names. Empty/omitted → all tables. */\n  tables?: string[];\n  /**\n   * Tenant visibility filter:\n   * - omitted/`undefined` → no tenant filter (all rows).\n   * - `null` → only global rows (`tenant_id IS NULL`).\n   * - `'<tenantId>'` → that tenant's rows **plus** global rows, matching the\n   *   DispatchBus read rule (`tenant_id = T OR tenant_id IS NULL`). A tenant\n   *   never sees another tenant's changes.\n   */\n  tenantId?: string | null;\n  /**\n   * Page size (default {@link DEFAULT_CHANGES_LIMIT}, capped at\n   * {@link MAX_CHANGES_LIMIT}). When a page fills up, the returned cursor\n   * stops at the last returned row so the next poll continues seamlessly.\n   */\n  limit?: number;\n}\n\n/** Result page of {@link getChangesSince}. */\nexport interface ChangeFeedPage {\n  /** Matching changes ordered by ascending `seq`. */\n  changes: ChangeFeedEntry[];\n  /**\n   * The next cursor. Monotonic: never lower than the `since` it was derived\n   * from. Equal to the committed horizon when the page was exhaustive, or to\n   * the last returned `seq` when the page hit `limit`. Feed the value back\n   * as `since` to observe every later change exactly once.\n   */\n  cursor: number;\n  /**\n   * Present (and `true`) when the supplied cursor cannot be served\n   * incrementally and the consumer must fall back to a full resync:\n   *\n   * - the cursor predates the retained window (entries at or below it were\n   *   pruned away — the changes between it and the retained floor are gone\n   *   for good), or\n   * - the cursor is ahead of the committed horizon / unknown to this\n   *   database (a foreign or reset cursor).\n   *\n   * When set, `changes` is empty and `cursor` echoes `since` unchanged.\n   * After its full data refetch, the consumer should resume polling from\n   * {@link resyncCursor}, the committed horizon observed by this read.\n   * Detection is computed on the **unfiltered** log: `tables`/`tenantId`\n   * filters legitimately hide rows and never trigger (or mask) a resync\n   * signal.\n   */\n  resyncRequired?: boolean;\n  /**\n   * Current committed horizon to use after handling a resync. Present with\n   * {@link resyncRequired}; separated from `cursor` so old callers that rely\n   * on `cursor` echoing the rejected value keep their monotonic-cursor\n   * invariant.\n   */\n  resyncCursor?: number;\n}\n\n/** Input for {@link appendChange} / {@link bumpChangeFeed}. */\nexport interface AppendChangeInput {\n  /** Physical table name the change refers to. */\n  table: string;\n  /** Changed row's primary key; `null`/omitted records a table-level change. */\n  rowId?: string | null;\n  /** Operation to record (default `'update'`). */\n  operation?: ChangeOperation;\n  /** Tenant the change belongs to (default `null` = global). */\n  tenantId?: string | null;\n}\n\n/** Retention bounds for {@link pruneChangeFeed}. At least one is required. */\nexport interface ChangeFeedRetention {\n  /** Prune entries older than this many milliseconds. */\n  maxAgeMs?: number;\n  /** Keep at most this many newest entries (by sequence). */\n  maxRows?: number;\n  /**\n   * Count the entries the bounds select without deleting them (#2375).\n   *\n   * Lets the retention sweep and `smrt db:prune --dry-run` preview the exact\n   * same predicate the real prune would execute.\n   */\n  dryRun?: boolean;\n}\n\n/** Default page size for {@link getChangesSince}. */\nexport const DEFAULT_CHANGES_LIMIT = 500;\n\n/** Hard cap on the page size for {@link getChangesSince}. */\nexport const MAX_CHANGES_LIMIT = 5_000;\n\n/**\n * Maximum append attempts under sequence contention. Conflicts only occur\n * with concurrent writers on MVCC engines and resolve as soon as the\n * blocking transaction commits, so a small bound is ample.\n */\nconst MAX_APPEND_ATTEMPTS = 20;\n\nconst VALID_OPERATIONS: ReadonlySet<string> = new Set([\n  'create',\n  'update',\n  'delete',\n]);\n\n// ============================================================================\n// Engine / SQL helpers (mirrors system/compatibility.ts conventions)\n// ============================================================================\n\ntype DatabaseWithConfig = DatabaseInterface & {\n  config?: { type?: string; url?: string };\n  type?: string;\n};\n\nfunction getEngine(\n  db: DatabaseInterface,\n  typeHint?: string,\n): ReturnType<typeof detectEngine> {\n  const withConfig = db as DatabaseWithConfig;\n  return detectEngine(\n    db.url || withConfig.config?.url || '',\n    typeHint || withConfig.type || withConfig.config?.type,\n  );\n}\n\n/**\n * Positional placeholder factory: Postgres uses `$n`, SQLite/DuckDB use `?`.\n */\nfunction placeholders(db: DatabaseInterface): (index: number) => string {\n  const engine = getEngine(db);\n  return engine === 'postgres' ? (index) => `$${index}` : () => '?';\n}\n\nfunction getQueryRows(result: unknown): Record<string, unknown>[] {\n  if (Array.isArray(result)) {\n    return result as Record<string, unknown>[];\n  }\n  if (result && typeof result === 'object' && 'rows' in result) {\n    const rows = (result as { rows?: unknown }).rows;\n    if (Array.isArray(rows)) {\n      return rows as Record<string, unknown>[];\n    }\n  }\n  return [];\n}\n\nfunction isUniqueViolation(error: unknown): boolean {\n  const signals: string[] = [];\n  const pending: unknown[] = [error];\n  const seen = new Set<object>();\n\n  while (pending.length > 0 && seen.size < 5) {\n    const candidate = pending.shift();\n    if (typeof candidate === 'string') {\n      signals.push(candidate);\n      continue;\n    }\n    if (!candidate || typeof candidate !== 'object' || seen.has(candidate)) {\n      continue;\n    }\n    seen.add(candidate);\n\n    const shaped = candidate as {\n      cause?: unknown;\n      code?: unknown;\n      context?: unknown;\n      message?: unknown;\n    };\n    if (typeof shaped.message === 'string') signals.push(shaped.message);\n    if (typeof shaped.code === 'string') signals.push(shaped.code);\n    if (shaped.cause !== undefined) pending.push(shaped.cause);\n\n    if (shaped.context && typeof shaped.context === 'object') {\n      const originalError = (shaped.context as { originalError?: unknown })\n        .originalError;\n      if (originalError !== undefined) pending.push(originalError);\n    }\n  }\n\n  const message = signals.join(', ');\n  return (\n    /\\b23505\\b/.test(message) ||\n    /unique constraint/i.test(message) ||\n    /duplicate key/i.test(message) ||\n    /primary key constraint/i.test(message) ||\n    /constraint error/i.test(message)\n  );\n}\n\n/**\n * Ensure the `_smrt_changes` system table exists on a database handle that\n * may not have passed through framework initialization (e.g. a raw handle\n * given to the REST generator). Idempotent (`CREATE ... IF NOT EXISTS`) and\n * guarded to run once per handle. Databases initialized through the\n * framework already have the table via the system-table bootstrap.\n */\nconst ensuredHandles = new WeakSet<object>();\n\nasync function postgresChangeFeedAppendFunctionExists(\n  db: DatabaseInterface,\n): Promise<boolean> {\n  const rows = getQueryRows(\n    await db.query(\n      `SELECT to_regprocedure('${POSTGRES_CHANGE_FEED_APPEND_FUNCTION_IDENTITY}') AS function_name`,\n    ),\n  );\n  return Boolean(rows[0]?.function_name);\n}\n\nasync function getPostgresChangeFeedSchemaState(\n  db: DatabaseInterface,\n): Promise<{\n  tableExists: boolean;\n  functionExists: boolean;\n  createdAtType: string | null;\n}> {\n  const rows = getQueryRows(\n    await db.query(\n      `SELECT\n         to_regclass('${CHANGE_FEED_TABLE}') AS table_name,\n         to_regprocedure('${POSTGRES_CHANGE_FEED_APPEND_FUNCTION_IDENTITY}') AS function_name,\n         (\n           SELECT data_type\n           FROM information_schema.columns\n           WHERE table_schema = current_schema()\n             AND table_name = '${CHANGE_FEED_TABLE}'\n             AND column_name = 'created_at'\n         ) AS created_at_type`,\n    ),\n  );\n  return {\n    tableExists: Boolean(rows[0]?.table_name),\n    functionExists: Boolean(rows[0]?.function_name),\n    createdAtType: rows[0]?.created_at_type\n      ? String(rows[0].created_at_type)\n      : null,\n  };\n}\n\nfunction assertPostgresChangeFeedTimestampCurrent(\n  state: Awaited<ReturnType<typeof getPostgresChangeFeedSchemaState>>,\n): void {\n  if (state.createdAtType === 'timestamp without time zone') {\n    throw new Error(\n      'Legacy _smrt_changes.created_at requires an explicit audited migratePostgresSystemTimestamps() call before change-feed initialization',\n    );\n  }\n}\n\n/**\n * Install/refresh the PostgreSQL exception-subtransaction append boundary.\n *\n * Framework bootstrap calls this while applying the system-schema version that\n * introduced the helper, so upgraded databases acquire it before the migration\n * is recorded. Raw-handle initialization passes `replaceExisting: false` so a\n * read route does not require function ownership when the installed helper is\n * already current. A missing helper is installed by one server-side statement\n * that locks and rechecks before DDL. Non-PostgreSQL adapters are a no-op.\n *\n * @internal\n */\nexport async function ensurePostgresChangeFeedAppendFunction(\n  db: DatabaseInterface,\n  options: {\n    replaceExisting?: boolean;\n    typeHint?: string;\n  } = {},\n): Promise<void> {\n  if (getEngine(db, options.typeHint) !== 'postgres') return;\n\n  assertPostgresChangeFeedTimestampCurrent(\n    await getPostgresChangeFeedSchemaState(db),\n  );\n\n  if (options.replaceExisting === false) {\n    if (await postgresChangeFeedAppendFunctionExists(db)) return;\n    await db.query(ENSURE_POSTGRES_CHANGE_FEED_APPEND_FUNCTION);\n    return;\n  }\n\n  await db.query(REPLACE_POSTGRES_CHANGE_FEED_APPEND_FUNCTION);\n}\n\nexport async function ensureChangeFeedTable(\n  db: DatabaseInterface,\n): Promise<void> {\n  if (ensuredHandles.has(db)) return;\n  if (getEngine(db) === 'postgres') {\n    const state = await getPostgresChangeFeedSchemaState(db);\n    assertPostgresChangeFeedTimestampCurrent(state);\n    if (\n      state.tableExists &&\n      state.functionExists &&\n      state.createdAtType === 'timestamp with time zone'\n    ) {\n      ensuredHandles.add(db);\n      return;\n    }\n    await db.query(ENSURE_POSTGRES_CHANGE_FEED_SCHEMA);\n  } else {\n    const statements = CREATE_SMRT_CHANGES_TABLE.split(';')\n      .map((statement) => statement.trim())\n      .filter((statement) => statement.length > 0);\n    for (const statement of statements) {\n      await db.query(statement);\n    }\n  }\n  ensuredHandles.add(db);\n}\n\n// ============================================================================\n// Append (writer primitive + manual bump escape hatch)\n// ============================================================================\n\n/**\n * Append one change entry with a database-allocated, strictly monotonic\n * sequence.\n *\n * The sequence is allocated inside the INSERT itself\n * (`COALESCE(MAX(seq), 0) + 1`) and retried on primary-key conflict, which\n * keeps committed sequences contiguous and makes commit order equal\n * sequence order — the property the cursor guarantee rests on (see the\n * module docs). Throws after {@link MAX_APPEND_ATTEMPTS} consecutive\n * conflicts or on any non-conflict database error; the framework's\n * interceptor catches and logs instead of failing the user's write.\n *\n * **PostgreSQL transaction safety (#2026).** The INSERT runs inside the\n * framework-owned `_smrt_append_change` PL/pgSQL function. Its exception\n * handler is a PostgreSQL subtransaction: a failed attempt is rolled back\n * before the function returns `{ error_code, error_message }`. This method\n * then throws in JavaScript, where the existing retry/swallow policy applies\n * without aborting a caller-managed transaction. Keeping isolation inside one\n * database statement also prevents concurrent work on the same transaction\n * handle from interleaving inside a manual SAVEPOINT scope.\n */\nexport async function appendChange(\n  db: DatabaseInterface,\n  input: AppendChangeInput,\n): Promise<number> {\n  const table = input.table?.trim();\n  if (!table) {\n    throw new Error('appendChange requires a non-empty table name');\n  }\n  const operation = input.operation ?? 'update';\n  if (!VALID_OPERATIONS.has(operation)) {\n    throw new Error(\n      `appendChange operation must be one of create/update/delete, got '${String(\n        input.operation,\n      )}'`,\n    );\n  }\n\n  const engine = getEngine(db);\n  const p = placeholders(db);\n  // The INSERT yields the ACTUAL sequence it allocated in the SAME statement\n  // (directly via RETURNING on portable engines, through the function on\n  // PostgreSQL). A separate follow-up `SELECT MAX(seq)` is racy under concurrent\n  // appends (a peer can commit a higher seq in between), which would hand two\n  // distinct changes the same SSE `id` and let a client's `Last-Event-ID`\n  // overshoot a change it never received. The allocator stays `MAX+1` under the\n  // unique-PK retry, so committed sequences remain contiguous (the cursor\n  // guarantee — see module docs).\n  const sql =\n    engine === 'postgres'\n      ? `SELECT allocated_seq, error_code, error_message FROM ` +\n        `${POSTGRES_CHANGE_FEED_APPEND_FUNCTION_NAME}(` +\n        `${p(1)}, ${p(2)}, ${p(3)}, ${p(4)}, ${p(5)})`\n      : `INSERT INTO ${CHANGE_FEED_TABLE} ` +\n        '(seq, table_name, row_id, operation, tenant_id, created_at) ' +\n        `SELECT COALESCE(MAX(seq), 0) + 1, ${p(1)}, ${p(2)}, ${p(3)}, ${p(4)}, ${p(5)} ` +\n        `FROM ${CHANGE_FEED_TABLE} RETURNING seq`;\n  const params = [\n    table,\n    input.rowId ?? null,\n    operation,\n    input.tenantId ?? null,\n    new Date().toISOString(),\n  ];\n\n  for (let attempt = 1; attempt <= MAX_APPEND_ATTEMPTS; attempt++) {\n    try {\n      // The append is a root-connection write; on embedded engines it goes\n      // through the per-database write queue so it can never overlap a\n      // null-aware upsert's second-connection transaction (#2360 — the pair\n      // livelocked into SQLITE_BUSY under concurrent NULL-tenant creates).\n      const rows = getQueryRows(\n        await withEmbeddedWriteQueue(db, isEmbeddedDatabase(db), () =>\n          db.query(sql, ...params),\n        ),\n      );\n      const row = rows[0];\n      if (!row) {\n        throw new Error('Change feed append returned no result row');\n      }\n      if (engine === 'postgres' && row.error_code != null) {\n        const error = new Error(\n          String(row.error_message || 'PostgreSQL change-feed append failed'),\n        ) as Error & { code: string };\n        error.code = String(row.error_code);\n        throw error;\n      }\n      return toSeqNumber(engine === 'postgres' ? row.allocated_seq : row.seq);\n    } catch (error) {\n      if (!isUniqueViolation(error) || attempt === MAX_APPEND_ATTEMPTS) {\n        throw error;\n      }\n      // Sequence head contention: another append won the value. Re-running\n      // recomputes MAX(seq) against the now-committed head.\n    }\n  }\n\n  // Unreachable: the loop returns a seq or throws on the final attempt. Present\n  // so the function satisfies its `Promise<number>` contract structurally.\n  throw new Error('appendChange exhausted retries without allocating a seq');\n}\n\n/**\n * Manual bump escape hatch for out-of-band writers.\n *\n * Framework mutation paths feed the log automatically, but raw SQL issued\n * outside `save()`/`delete()` is invisible to it (documented gap, shared\n * with the #1499 collection cache). Call this after such a write so feed\n * consumers observe the change. Omitting `rowId` records a table-level\n * change (`rowId: null`), which consumers should treat as \"anything in this\n * table may have changed\".\n *\n * @example\n * ```typescript\n * await db.query(`UPDATE products SET price = price * 1.1`);\n * await bumpChangeFeed(db, { table: 'products' });\n * ```\n */\nexport async function bumpChangeFeed(\n  db: DatabaseInterface,\n  input: AppendChangeInput,\n): Promise<void> {\n  await ensureChangeFeedTable(db);\n  await appendChange(db, input);\n}\n\n// ============================================================================\n// Read interface\n// ============================================================================\n\n/**\n * Read committed changes after a cursor.\n *\n * Returns every committed change with `since < seq <= cursor` that matches\n * the filters, ordered by ascending `seq`. The returned cursor is safe to\n * persist and poll with: committed sequences are contiguous (see module\n * docs), so nothing can commit at or below the observed horizon afterwards —\n * reads miss no committed change under concurrent writers and never return\n * the same change twice. When `since` is already at the horizon, returns an\n * empty page with `cursor: since`.\n *\n * ## Resync detection (pruned / foreign cursors)\n *\n * A cursor that cannot be served incrementally is flagged with\n * `resyncRequired: true` (empty `changes`, `cursor` echoed unchanged,\n * `resyncCursor` set to the current horizon) so pollers never go silently,\n * permanently stale:\n *\n * - **Pruned gap**: retained sequences always form a contiguous run\n *   `[floor..horizon]` and {@link pruneChangeFeed} deletes oldest-first\n *   while always retaining the newest entry, so `since < floor - 1` proves\n *   changes between the cursor and the retained window were pruned away.\n * - **Foreign/reset cursor**: `since > horizon` (ahead of anything this\n *   database ever allocated), including any `since > 0` against a feed\n *   with no entries.\n *\n * Detection runs on the **unfiltered** log — `tables`/`tenantId` filters\n * legitimately hide rows and never trigger (or mask) the signal. A caught-up\n * consumer (`since === horizon`) is never asked to resync, even when\n * retention has pruned everything older.\n *\n * Filters (`tables`, `tenantId`) affect which rows are *returned*, never how\n * the cursor advances — an exhausted filtered page still advances to the\n * horizon so pollers do not rescan filtered-out rows.\n */\nexport async function getChangesSince(\n  db: DatabaseInterface,\n  options: GetChangesOptions,\n): Promise<ChangeFeedPage> {\n  const { since } = options;\n  if (!Number.isFinite(since) || since < 0) {\n    throw new Error(\n      `getChangesSince requires a non-negative numeric cursor, got '${String(since)}'`,\n    );\n  }\n  const limit = Math.min(\n    Math.max(Math.floor(options.limit ?? DEFAULT_CHANGES_LIMIT), 1),\n    MAX_CHANGES_LIMIT,\n  );\n\n  const p = placeholders(db);\n\n  // The committed horizon: every seq <= horizon is committed and immutable\n  // (append-only + contiguous allocation), so the page below is stable even\n  // though it runs as a separate statement. The floor bounds the retained\n  // window for pruned-cursor detection; both are computed UNFILTERED so\n  // table/tenant filters can neither trigger nor mask a resync signal.\n  const boundsRows = getQueryRows(\n    await db.query(\n      `SELECT MIN(seq) AS floor, MAX(seq) AS horizon FROM ${CHANGE_FEED_TABLE}`,\n    ),\n  );\n  const floor = toSeqNumber(boundsRows[0]?.floor);\n  const horizon = toSeqNumber(boundsRows[0]?.horizon);\n\n  if (horizon === 0) {\n    // No entries at all. A zero cursor is simply \"no changes ever\"; any\n    // other cursor came from a different database (or a reset feed) and\n    // cannot be served incrementally.\n    return since === 0\n      ? { changes: [], cursor: 0 }\n      : { changes: [], cursor: since, resyncRequired: true, resyncCursor: 0 };\n  }\n\n  if (since > horizon) {\n    // Foreign or reset cursor — ahead of anything this database allocated.\n    return {\n      changes: [],\n      cursor: since,\n      resyncRequired: true,\n      resyncCursor: horizon,\n    };\n  }\n\n  if (since < floor - 1) {\n    // Pruned gap — the changes with seq in (since, floor) are gone for good.\n    return {\n      changes: [],\n      cursor: since,\n      resyncRequired: true,\n      resyncCursor: horizon,\n    };\n  }\n\n  if (horizon === since) {\n    return { changes: [], cursor: since };\n  }\n\n  const conditions: string[] = [];\n  const params: unknown[] = [];\n  let index = 0;\n  const next = () => p(++index);\n\n  conditions.push(`seq > ${next()}`);\n  params.push(since);\n  conditions.push(`seq <= ${next()}`);\n  params.push(horizon);\n\n  const tables = options.tables?.filter((table) => table.trim().length > 0);\n  if (tables && tables.length > 0) {\n    conditions.push(`table_name IN (${tables.map(() => next()).join(', ')})`);\n    params.push(...tables);\n  }\n\n  if (options.tenantId === null) {\n    conditions.push('tenant_id IS NULL');\n  } else if (typeof options.tenantId === 'string') {\n    conditions.push(`(tenant_id = ${next()} OR tenant_id IS NULL)`);\n    params.push(options.tenantId);\n  }\n\n  const sql =\n    'SELECT seq, table_name, row_id, operation, tenant_id, created_at ' +\n    `FROM ${CHANGE_FEED_TABLE} WHERE ${conditions.join(' AND ')} ` +\n    `ORDER BY seq ASC LIMIT ${next()}`;\n  params.push(limit);\n\n  const rows = getQueryRows(await db.query(sql, ...params));\n  const changes = rows.map(rowToEntry);\n\n  // Page limited → resume after the last returned row. Page exhaustive →\n  // everything up to the horizon (matching or filtered out) has been\n  // observed, so advance all the way.\n  const cursor =\n    changes.length === limit ? changes[changes.length - 1].seq : horizon;\n\n  return { changes, cursor };\n}\n\n/**\n * {@link getChangesSince} scoped by the active tenant context.\n *\n * Resolves the tenant through the same dependency-inversion hook the\n * DispatchBus uses ({@link resolveDispatchTenantScope}), so it works without\n * core depending on `@happyvertical/smrt-tenancy`:\n *\n * - Tenancy disabled (no resolver registered) → no tenant filter.\n * - Tenancy enabled with an active tenant `T` → `T`'s rows plus global rows.\n * - Tenancy enabled with **no** active tenant → global rows only\n *   (**fail-closed**: a missing context never widens visibility to all\n *   tenants).\n *\n * This is the read the generated `_changes` routes call after establishing\n * tenant context from the authenticated principal.\n */\nexport async function getTenantScopedChangesSince(\n  db: DatabaseInterface,\n  options: Omit<GetChangesOptions, 'tenantId'>,\n): Promise<ChangeFeedPage> {\n  const scope = resolveDispatchTenantScope();\n  if (!scope.enforced) {\n    return getChangesSince(db, options);\n  }\n  return getChangesSince(db, { ...options, tenantId: scope.tenantId });\n}\n\n/**\n * The per-table change version — the ETag source for zero-query conditional\n * GETs (#1765).\n *\n * Returns `MAX(seq)` over the feed rows for `table`: a monotonic number that\n * advances on every framework write to that table (create/update/delete, and\n * writes through the sync-apply endpoint, which all `save()`/`delete()`).\n * Because sequences are the change feed's globally-monotonic cursor dimension\n * (allocated `MAX+1` at commit time, never a native identity — see the module\n * docs), the value is **replica-stable**: two processes reading the same\n * committed database compute the same version, with no per-process divergence.\n * That is what lets a generated read route derive an ETag that short-circuits a\n * matching `If-None-Match` into a `304` before the collection query runs — an\n * unchanged table costs one indexed `MAX(seq)` lookup (backed by\n * `idx_smrt_changes_table_seq`) to revalidate, not a table scan.\n *\n * ## Why the fallback to the global horizon (and not 0)\n *\n * A table with no *retained* feed entry falls back to the global horizon\n * (`MAX(seq)` across all tables), returning 0 only when the whole feed is\n * empty. Retention prunes oldest-first and always keeps the newest entry, so a\n * quiet table can lose all of its own entries while busier tables advance. If\n * such a table reported 0, a client that cached it while it was empty (version\n * 0) could, after a change→prune→change→prune cycle returned the lookup to 0,\n * be wrongly answered `304` against data that has since changed — a false-304.\n *\n * The horizon fallback closes that hole: any write to the table appends a new\n * sequence strictly greater than every previously-observed value (its own or\n * the horizon), so the version — and therefore the ETag — strictly exceeds any\n * value a client already holds, forcing a fresh `200`. The only cost is that a\n * table with no retained entries of its own revalidates whenever the global\n * horizon moves; a table with a retained entry uses its own stable `MAX(seq)`\n * and is unaffected by writes to sibling tables. A persistent per-table\n * high-water mark that survives pruning would remove even that cost; it is a\n * deliberate follow-up, out of scope for this slice.\n *\n * Idempotently ensures the feed table exists first, so it is safe to call from\n * a read route on a raw handle that has never been written to.\n */\nexport async function getTableVersion(\n  db: DatabaseInterface,\n  table: string,\n): Promise<number> {\n  const name = table?.trim();\n  if (!name) {\n    throw new Error('getTableVersion requires a non-empty table name');\n  }\n  await ensureChangeFeedTable(db);\n\n  const p = placeholders(db);\n  const tableRows = getQueryRows(\n    await db.query(\n      `SELECT MAX(seq) AS version FROM ${CHANGE_FEED_TABLE} WHERE table_name = ${p(1)}`,\n      name,\n    ),\n  );\n  const tableVersion = tableRows[0]?.version;\n  if (tableVersion != null) {\n    return toSeqNumber(tableVersion);\n  }\n\n  // No retained entry for this table — fall back to the global horizon so an\n  // all-pruned (or never-written) table never reports a resettable low value\n  // that could false-304 a stale client. 0 only when the feed is empty.\n  const horizonRows = getQueryRows(\n    await db.query(`SELECT MAX(seq) AS horizon FROM ${CHANGE_FEED_TABLE}`),\n  );\n  return toSeqNumber(horizonRows[0]?.horizon);\n}\n\nfunction toSeqNumber(value: unknown): number {\n  // PostgreSQL surfaces BIGINT aggregates as strings and DuckDB can return\n  // BigInt. Change-feed cursors must never advance on a rounded value.\n  return toSafeInteger(value ?? 0, 'Change-feed sequence');\n}\n\nfunction rowToEntry(row: Record<string, unknown>): ChangeFeedEntry {\n  return {\n    seq: toSeqNumber(row.seq),\n    table: String(row.table_name ?? ''),\n    rowId: row.row_id == null ? null : String(row.row_id),\n    operation: String(row.operation ?? 'update') as ChangeOperation,\n    tenantId: row.tenant_id == null ? null : String(row.tenant_id),\n    timestamp: normalizeTimestamp(row.created_at),\n  };\n}\n\nfunction normalizeTimestamp(value: unknown): string {\n  if (value instanceof Date) return value.toISOString();\n  return String(value ?? '');\n}\n\n// ============================================================================\n// Retention / compaction\n// ============================================================================\n\n/**\n * Prune the change feed to bound its growth.\n *\n * Applies whichever bounds are provided (at least one is required):\n * - `maxRows`: keep only the newest N entries by sequence.\n * - `maxAgeMs`: drop entries older than the cutoff.\n *\n * Pruning deletes oldest-first, never renumbers surviving entries, and\n * **always retains the newest entry** (a non-empty feed is never emptied,\n * whatever the bounds say). That invariant anchors pruned-cursor detection:\n * retained sequences stay a contiguous run `[floor..horizon]`, so\n * {@link getChangesSince} can prove a cursor predates the retained window\n * (`resyncRequired`) — and a fully caught-up consumer keeps polling\n * normally even after everything older was pruned.\n *\n * Cursors within the retained window keep working. Schedule pruning (e.g.\n * via `@happyvertical/smrt-jobs`) with a retention window comfortably\n * larger than the slowest consumer's polling interval; consumers whose\n * cursor falls out of it are told to full-resync via `resyncRequired`.\n *\n * @returns The number of entries pruned — or, with `dryRun`, the number the\n *   same bounds would prune (approximate under concurrent prunes).\n */\nexport async function pruneChangeFeed(\n  db: DatabaseInterface,\n  retention: ChangeFeedRetention,\n): Promise<{ pruned: number }> {\n  const { maxAgeMs, maxRows, dryRun = false } = retention;\n  if (maxAgeMs == null && maxRows == null) {\n    throw new Error('pruneChangeFeed requires maxAgeMs and/or maxRows');\n  }\n  if (maxAgeMs != null && (!Number.isFinite(maxAgeMs) || maxAgeMs < 0)) {\n    throw new Error(`pruneChangeFeed maxAgeMs must be >= 0, got ${maxAgeMs}`);\n  }\n  if (maxRows != null && (!Number.isFinite(maxRows) || maxRows < 0)) {\n    throw new Error(`pruneChangeFeed maxRows must be >= 0, got ${maxRows}`);\n  }\n\n  const p = placeholders(db);\n\n  // Snapshot the horizon once: both bounds prune strictly below it so the\n  // newest entry always survives (see resync-detection contract above).\n  const horizonRows = getQueryRows(\n    await db.query(`SELECT MAX(seq) AS horizon FROM ${CHANGE_FEED_TABLE}`),\n  );\n  const horizon = toSeqNumber(horizonRows[0]?.horizon);\n  if (horizon === 0) {\n    return { pruned: 0 };\n  }\n\n  let pruned = 0;\n  let prunedThrough = 0;\n\n  if (maxRows != null) {\n    const pruneThrough = Math.min(horizon - Math.floor(maxRows), horizon - 1);\n    if (pruneThrough > 0) {\n      prunedThrough = pruneThrough;\n      pruned += await deleteCounted(\n        db,\n        `seq <= ${p(1)}`,\n        [pruneThrough],\n        dryRun,\n      );\n    }\n  }\n\n  if (maxAgeMs != null) {\n    const cutoff = new Date(Date.now() - maxAgeMs).toISOString();\n    // `seq > prunedThrough` excludes what the row bound already accounted for.\n    // Redundant when the rows were really deleted, load-bearing under\n    // `dryRun`, where nothing was — without it overlapping entries would be\n    // counted by both bounds.\n    pruned += await deleteCounted(\n      db,\n      `created_at < ${p(1)} AND seq < ${p(2)} AND seq > ${p(3)}`,\n      [cutoff, horizon, prunedThrough],\n      dryRun,\n    );\n  }\n\n  return { pruned };\n}\n\nasync function deleteCounted(\n  db: DatabaseInterface,\n  condition: string,\n  params: unknown[],\n  dryRun = false,\n): Promise<number> {\n  const countRows = getQueryRows(\n    await db.query(\n      `SELECT COUNT(*) AS total FROM ${CHANGE_FEED_TABLE} WHERE ${condition}`,\n      ...params,\n    ),\n  );\n  const total = toSeqNumber(countRows[0]?.total);\n  if (total > 0 && !dryRun) {\n    await db.query(\n      `DELETE FROM ${CHANGE_FEED_TABLE} WHERE ${condition}`,\n      ...params,\n    );\n  }\n  return total;\n}\n\n// ============================================================================\n// Framework writer (GlobalInterceptors registration)\n// ============================================================================\n\nconst WAS_PERSISTED_KEY = '_smrtChangeFeedWasPersisted';\n\n/** Databases we already warned about after a failed feed append. */\nconst warnedAppendFailures = new Set<string>();\n\n/** Databases we already warned about after a failed signal publish (#1763). */\nconst warnedSignalPublishFailures = new Set<string>();\n\n/**\n * Register the change-feed writer with {@link GlobalInterceptors}.\n *\n * Called automatically during framework initialization (every\n * `SmrtClass.initialize()` passes through it), so applications never need\n * to call it directly; it is exported for tests and for re-registering\n * after `GlobalInterceptors.clear()`. Idempotent — a second call while the\n * writer is registered is a no-op.\n *\n * The writer observes the same hooks the reports scheduler and tenancy\n * interceptors use:\n * - `beforeSave` stashes whether the instance was already persisted (this\n *   is what distinguishes `create` from `update` in the feed).\n * - `afterSave`/`afterDelete` append exactly one change entry per framework\n *   save/delete. Framework-owned tables listed in\n *   {@link CHANGE_FEED_EXCLUDED_TABLES} are skipped — the feed observes\n *   application data, not framework bookkeeping (and never itself).\n *\n * Failure policy: appends run after the user's write succeeded and must not\n * un-succeed it — failures are logged (deduped per database) and swallowed.\n */\nexport function registerChangeFeedWriter(): void {\n  if (\n    GlobalInterceptors.getAll().some(\n      (interceptor) => interceptor.name === CHANGE_FEED_INTERCEPTOR_NAME,\n    )\n  ) {\n    return;\n  }\n\n  GlobalInterceptors.register({\n    name: CHANGE_FEED_INTERCEPTOR_NAME,\n    // Below tenancy (100) so tenantId auto-population precedes the stash;\n    // above the reports refresh interceptor (-10) so a triggered refresh\n    // can already observe the appended change entry.\n    priority: 0,\n\n    beforeSave(instance: SmrtObject, context: InterceptorContext): void {\n      try {\n        context.metadata = {\n          ...context.metadata,\n          [WAS_PERSISTED_KEY]: instance.isPersisted === true,\n        };\n      } catch {\n        // Never let feed bookkeeping block a save.\n      }\n    },\n\n    async afterSave(\n      instance: SmrtObject,\n      context: InterceptorContext,\n    ): Promise<void> {\n      const wasPersisted = context.metadata?.[WAS_PERSISTED_KEY] === true;\n      await appendForInstance(instance, wasPersisted ? 'update' : 'create');\n    },\n\n    async afterDelete(instance: SmrtObject): Promise<void> {\n      await appendForInstance(instance, 'delete');\n    },\n  });\n}\n\n/** Unregister the change-feed writer (test helper). */\nexport function unregisterChangeFeedWriter(): boolean {\n  return GlobalInterceptors.unregister(CHANGE_FEED_INTERCEPTOR_NAME);\n}\n\nasync function appendForInstance(\n  instance: SmrtObject,\n  operation: ChangeOperation,\n): Promise<void> {\n  let db: DatabaseInterface;\n  let table: string;\n  try {\n    table = instance.tableName;\n    // Framework-owned tables are bookkeeping, not client-syncable data —\n    // recording them would let the feed observe (and re-observe) itself. The\n    // test is an allowlist, not the `_smrt_` prefix: ~25 domain tables carry\n    // that prefix and must be observed (issue #2376).\n    if (!isChangeFeedObservableTable(table)) return;\n    db = instance.db;\n  } catch {\n    // Not a fully initialized SmrtObject (e.g. plain-object doubles in\n    // tests) — nothing to record.\n    return;\n  }\n\n  try {\n    const id = (instance as { id?: unknown }).id;\n    const tenantId = (instance as unknown as Record<string, unknown>).tenantId;\n    const rowId = typeof id === 'string' && id ? id : null;\n    const rowTenantId =\n      typeof tenantId === 'string' && tenantId ? tenantId : null;\n    const seq = await appendChange(db, {\n      table,\n      rowId,\n      operation,\n      tenantId: rowTenantId,\n    });\n\n    // Publish a coarse live signal for the SSE `_events` route (#1763). This\n    // runs only after the durable feed append SUCCEEDED (same try block, so a\n    // failed append never emits a signal — \"no signal without a durable feed\n    // row\"). Its own try/catch (distinct dedup key) keeps a signal-publish\n    // problem from failing the user's write or masking the append's own\n    // failure semantics above.\n    try {\n      publishChangeSignal(db, {\n        table,\n        operation,\n        rowId,\n        tenantId: rowTenantId,\n        seq,\n      });\n    } catch (error) {\n      warnSignalPublishFailureOnce(db, table, error);\n    }\n  } catch (error) {\n    warnAppendFailureOnce(db, table, error);\n  }\n}\n\nfunction warnAppendFailureOnce(\n  db: DatabaseInterface,\n  table: string,\n  error: unknown,\n): void {\n  try {\n    const dbKey = resolveDbCacheKey(db);\n    if (warnedAppendFailures.has(dbKey)) return;\n    warnedAppendFailures.add(dbKey);\n    logger.warn(\n      `Change feed: failed to append a change entry for '${table}'. The ` +\n        'write itself succeeded; the feed is missing this change (further ' +\n        'failures for this database are suppressed). Consumers recover on ' +\n        'full resync.',\n      { error: error instanceof Error ? error.message : String(error) },\n    );\n  } catch {\n    // Logging must never propagate into the write path.\n  }\n}\n\nfunction warnSignalPublishFailureOnce(\n  db: DatabaseInterface,\n  table: string,\n  error: unknown,\n): void {\n  try {\n    const dbKey = resolveDbCacheKey(db);\n    if (warnedSignalPublishFailures.has(dbKey)) return;\n    warnedSignalPublishFailures.add(dbKey);\n    logger.warn(\n      `Change feed: failed to publish a live change signal for '${table}'. ` +\n        'The write and its durable feed row are unaffected; live SSE ' +\n        'subscribers miss this signal but recover via cursor catch-up ' +\n        '(further failures for this database are suppressed).',\n      { error: error instanceof Error ? error.message : String(error) },\n    );\n  } catch {\n    // Logging must never propagate into the write path.\n  }\n}\n\n/**\n * Reset the append-failure and signal-publish warning dedups (test helper).\n */\nexport function resetChangeFeedWarnings(): void {\n  warnedAppendFailures.clear();\n  warnedSignalPublishFailures.clear();\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqHA,IAAM,SAAS,aAAa,EAAE,OAAO,OAAO,CAAC;;AAG7C,IAAa,oBAAoB;;;;;;;;;;;;;;;;AAiBjC,IAAa,8CAAmD,IAAI,IAAI;CACtE,GAAG;CACH,GAAG;CACH,GAAG;AACL,CAAC;;;;;;;AAQD,SAAgB,4BAA4B,WAA4B;CACtE,OAAO,QAAQ,SAAS,KAAK,CAAC,4BAA4B,IAAI,SAAS;AACzE;;AAGA,IAAa,+BAA+B;;AAgI5C,IAAa,wBAAwB;;AAGrC,IAAa,oBAAoB;;;;;;AAOjC,IAAM,sBAAsB;AAE5B,IAAM,mCAAwC,IAAI,IAAI;CACpD;CACA;CACA;AACF,CAAC;AAWD,SAAS,UACP,IACA,UACiC;CACjC,MAAM,aAAa;CACnB,OAAO,aACL,GAAG,OAAO,WAAW,QAAQ,OAAO,IACpC,YAAY,WAAW,QAAQ,WAAW,QAAQ,IACpD;AACF;;;;AAKA,SAAS,aAAa,IAAkD;CAEtE,OADe,UAAU,EAClB,MAAW,cAAc,UAAU,IAAI,gBAAgB;AAChE;AAEA,SAAS,aAAa,QAA4C;CAChE,IAAI,MAAM,QAAQ,MAAM,GACtB,OAAO;CAET,IAAI,UAAU,OAAO,WAAW,YAAY,UAAU,QAAQ;EAC5D,MAAM,OAAQ,OAA8B;EAC5C,IAAI,MAAM,QAAQ,IAAI,GACpB,OAAO;CAEX;CACA,OAAO,CAAC;AACV;AAEA,SAAS,kBAAkB,OAAyB;CAClD,MAAM,UAAoB,CAAC;CAC3B,MAAM,UAAqB,CAAC,KAAK;CACjC,MAAM,uBAAO,IAAI,IAAY;CAE7B,OAAO,QAAQ,SAAS,KAAK,KAAK,OAAO,GAAG;EAC1C,MAAM,YAAY,QAAQ,MAAM;EAChC,IAAI,OAAO,cAAc,UAAU;GACjC,QAAQ,KAAK,SAAS;GACtB;EACF;EACA,IAAI,CAAC,aAAa,OAAO,cAAc,YAAY,KAAK,IAAI,SAAS,GACnE;EAEF,KAAK,IAAI,SAAS;EAElB,MAAM,SAAS;EAMf,IAAI,OAAO,OAAO,YAAY,UAAU,QAAQ,KAAK,OAAO,OAAO;EACnE,IAAI,OAAO,OAAO,SAAS,UAAU,QAAQ,KAAK,OAAO,IAAI;EAC7D,IAAI,OAAO,UAAU,KAAA,GAAW,QAAQ,KAAK,OAAO,KAAK;EAEzD,IAAI,OAAO,WAAW,OAAO,OAAO,YAAY,UAAU;GACxD,MAAM,gBAAiB,OAAO,QAC3B;GACH,IAAI,kBAAkB,KAAA,GAAW,QAAQ,KAAK,aAAa;EAC7D;CACF;CAEA,MAAM,UAAU,QAAQ,KAAK,IAAI;CACjC,OACE,YAAY,KAAK,OAAO,KACxB,qBAAqB,KAAK,OAAO,KACjC,iBAAiB,KAAK,OAAO,KAC7B,0BAA0B,KAAK,OAAO,KACtC,oBAAoB,KAAK,OAAO;AAEpC;;;;;;;;AASA,IAAM,iCAAiB,IAAI,QAAgB;AAE3C,eAAe,uCACb,IACkB;CAClB,MAAM,OAAO,aACX,MAAM,GAAG,MACP,2BAA2B,8CAA8C,oBAC3E,CACF;CACA,OAAO,QAAQ,KAAK,EAAE,EAAE,aAAa;AACvC;AAEA,eAAe,iCACb,IAKC;CACD,MAAM,OAAO,aACX,MAAM,GAAG,MACP;wBACkB,kBAAkB;4BACd,8CAA8C;;;;;iCAKzC,kBAAkB;;8BAG/C,CACF;CACA,OAAO;EACL,aAAa,QAAQ,KAAK,EAAE,EAAE,UAAU;EACxC,gBAAgB,QAAQ,KAAK,EAAE,EAAE,aAAa;EAC9C,eAAe,KAAK,EAAE,EAAE,kBACpB,OAAO,KAAK,EAAE,CAAC,eAAe,IAC9B;CACN;AACF;AAEA,SAAS,yCACP,OACM;CACN,IAAI,MAAM,kBAAkB,+BAC1B,MAAM,IAAI,MACR,uIACF;AAEJ;;;;;;;;;;;;;AAcA,eAAsB,uCACpB,IACA,UAGI,CAAC,GACU;CACf,IAAI,UAAU,IAAI,QAAQ,QAAQ,MAAM,YAAY;CAEpD,yCACE,MAAM,iCAAiC,EAAE,CAC3C;CAEA,IAAI,QAAQ,oBAAoB,OAAO;EACrC,IAAI,MAAM,uCAAuC,EAAE,GAAG;EACtD,MAAM,GAAG,MAAM,2CAA2C;EAC1D;CACF;CAEA,MAAM,GAAG,MAAM,4CAA4C;AAC7D;AAEA,eAAsB,sBACpB,IACe;CACf,IAAI,eAAe,IAAI,EAAE,GAAG;CAC5B,IAAI,UAAU,EAAE,MAAM,YAAY;EAChC,MAAM,QAAQ,MAAM,iCAAiC,EAAE;EACvD,yCAAyC,KAAK;EAC9C,IACE,MAAM,eACN,MAAM,kBACN,MAAM,kBAAkB,4BACxB;GACA,eAAe,IAAI,EAAE;GACrB;EACF;EACA,MAAM,GAAG,MAAM,kCAAkC;CACnD,OAAO;EACL,MAAM,aAAa,0BAA0B,MAAM,GAAG,CAAC,CACpD,KAAK,cAAc,UAAU,KAAK,CAAC,CAAC,CACpC,QAAQ,cAAc,UAAU,SAAS,CAAC;EAC7C,KAAK,MAAM,aAAa,YACtB,MAAM,GAAG,MAAM,SAAS;CAE5B;CACA,eAAe,IAAI,EAAE;AACvB;;;;;;;;;;;;;;;;;;;;;;AA2BA,eAAsB,aACpB,IACA,OACiB;CACjB,MAAM,QAAQ,MAAM,OAAO,KAAK;CAChC,IAAI,CAAC,OACH,MAAM,IAAI,MAAM,8CAA8C;CAEhE,MAAM,YAAY,MAAM,aAAa;CACrC,IAAI,CAAC,iBAAiB,IAAI,SAAS,GACjC,MAAM,IAAI,MACR,oEAAoE,OAClE,MAAM,SACR,EAAE,EACJ;CAGF,MAAM,SAAS,UAAU,EAAE;CAC3B,MAAM,IAAI,aAAa,EAAE;CASzB,MAAM,MACJ,WAAW,aACP,wDACG,0CAA0C,GAC1C,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAC5C,eAAe,kBAAkB,iGAEI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,QACtE,kBAAkB;CAChC,MAAM,SAAS;EACb;EACA,MAAM,SAAS;EACf;EACA,MAAM,YAAY;mBAClB,IAAI,KAAK,EAAA,CAAE,YAAY;CACzB;CAEA,KAAK,IAAI,UAAU,GAAG,WAAW,qBAAqB,WACpD,IAAI;EAUF,MAAM,MALO,aACX,MAAM,uBAAuB,IAAI,mBAAmB,EAAE,SACpD,GAAG,MAAM,KAAK,GAAG,MAAM,CACzB,CAEU,CAAA,CAAK;EACjB,IAAI,CAAC,KACH,MAAM,IAAI,MAAM,2CAA2C;EAE7D,IAAI,WAAW,cAAc,IAAI,cAAc,MAAM;GACnD,MAAM,QAAQ,IAAI,MAChB,OAAO,IAAI,iBAAiB,sCAAsC,CACpE;GACA,MAAM,OAAO,OAAO,IAAI,UAAU;GAClC,MAAM;EACR;EACA,OAAO,YAAY,WAAW,aAAa,IAAI,gBAAgB,IAAI,GAAG;CACxE,SAAS,OAAO;EACd,IAAI,CAAC,kBAAkB,KAAK,KAAK,YAAY,qBAC3C,MAAM;CAIV;CAKF,MAAM,IAAI,MAAM,yDAAyD;AAC3E;;;;;;;;;;;;;;;;;AAkBA,eAAsB,eACpB,IACA,OACe;CACf,MAAM,sBAAsB,EAAE;CAC9B,MAAM,aAAa,IAAI,KAAK;AAC9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyCA,eAAsB,gBACpB,IACA,SACyB;CACzB,MAAM,EAAE,UAAU;CAClB,IAAI,CAAC,OAAO,SAAS,KAAK,KAAK,QAAQ,GACrC,MAAM,IAAI,MACR,gEAAgE,OAAO,KAAK,EAAE,EAChF;CAEF,MAAM,QAAQ,KAAK,IACjB,KAAK,IAAI,KAAK,MAAM,QAAQ,SAAA,GAA8B,GAAG,CAAC,GAC9D,iBACF;CAEA,MAAM,IAAI,aAAa,EAAE;CAOzB,MAAM,aAAa,aACjB,MAAM,GAAG,MACP,sDAAsD,mBACxD,CACF;CACA,MAAM,QAAQ,YAAY,WAAW,EAAE,EAAE,KAAK;CAC9C,MAAM,UAAU,YAAY,WAAW,EAAE,EAAE,OAAO;CAElD,IAAI,YAAY,GAId,OAAO,UAAU,IACb;EAAE,SAAS,CAAC;EAAG,QAAQ;CAAE,IACzB;EAAE,SAAS,CAAC;EAAG,QAAQ;EAAO,gBAAgB;EAAM,cAAc;CAAE;CAG1E,IAAI,QAAQ,SAEV,OAAO;EACL,SAAS,CAAC;EACV,QAAQ;EACR,gBAAgB;EAChB,cAAc;CAChB;CAGF,IAAI,QAAQ,QAAQ,GAElB,OAAO;EACL,SAAS,CAAC;EACV,QAAQ;EACR,gBAAgB;EAChB,cAAc;CAChB;CAGF,IAAI,YAAY,OACd,OAAO;EAAE,SAAS,CAAC;EAAG,QAAQ;CAAM;CAGtC,MAAM,aAAuB,CAAC;CAC9B,MAAM,SAAoB,CAAC;CAC3B,IAAI,QAAQ;CACZ,MAAM,aAAa,EAAE,EAAE,KAAK;CAE5B,WAAW,KAAK,SAAS,KAAK,GAAG;CACjC,OAAO,KAAK,KAAK;CACjB,WAAW,KAAK,UAAU,KAAK,GAAG;CAClC,OAAO,KAAK,OAAO;CAEnB,MAAM,SAAS,QAAQ,QAAQ,QAAQ,UAAU,MAAM,KAAK,CAAC,CAAC,SAAS,CAAC;CACxE,IAAI,UAAU,OAAO,SAAS,GAAG;EAC/B,WAAW,KAAK,kBAAkB,OAAO,UAAU,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE;EACxE,OAAO,KAAK,GAAG,MAAM;CACvB;CAEA,IAAI,QAAQ,aAAa,MACvB,WAAW,KAAK,mBAAmB;MAC9B,IAAI,OAAO,QAAQ,aAAa,UAAU;EAC/C,WAAW,KAAK,gBAAgB,KAAK,EAAE,uBAAuB;EAC9D,OAAO,KAAK,QAAQ,QAAQ;CAC9B;CAEA,MAAM,MACJ,yEACQ,kBAAkB,SAAS,WAAW,KAAK,OAAO,EAAE,0BAClC,KAAK;CACjC,OAAO,KAAK,KAAK;CAGjB,MAAM,UADO,aAAa,MAAM,GAAG,MAAM,KAAK,GAAG,MAAM,CACvC,CAAA,CAAK,IAAI,UAAU;CAQnC,OAAO;EAAE;EAAS,QAFhB,QAAQ,WAAW,QAAQ,QAAQ,QAAQ,SAAS,EAAE,CAAC,MAAM;CAEtC;AAC3B;;;;;;;;;;;;;;;;;AAkBA,eAAsB,4BACpB,IACA,SACyB;CACzB,MAAM,QAAQ,2BAA2B;CACzC,IAAI,CAAC,MAAM,UACT,OAAO,gBAAgB,IAAI,OAAO;CAEpC,OAAO,gBAAgB,IAAI;EAAE,GAAG;EAAS,UAAU,MAAM;CAAS,CAAC;AACrE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyCA,eAAsB,gBACpB,IACA,OACiB;CACjB,MAAM,OAAO,OAAO,KAAK;CACzB,IAAI,CAAC,MACH,MAAM,IAAI,MAAM,iDAAiD;CAEnE,MAAM,sBAAsB,EAAE;CAE9B,MAAM,IAAI,aAAa,EAAE;CAOzB,MAAM,eANY,aAChB,MAAM,GAAG,MACP,mCAAmC,kBAAkB,sBAAsB,EAAE,CAAC,KAC9E,IACF,CAEmB,CAAA,CAAU,EAAE,EAAE;CACnC,IAAI,gBAAgB,MAClB,OAAO,YAAY,YAAY;CASjC,OAAO,YAHa,aAClB,MAAM,GAAG,MAAM,mCAAmC,mBAAmB,CAEpD,CAAA,CAAY,EAAE,EAAE,OAAO;AAC5C;AAEA,SAAS,YAAY,OAAwB;CAG3C,OAAO,cAAc,SAAS,GAAG,sBAAsB;AACzD;AAEA,SAAS,WAAW,KAA+C;CACjE,OAAO;EACL,KAAK,YAAY,IAAI,GAAG;EACxB,OAAO,OAAO,IAAI,cAAc,EAAE;EAClC,OAAO,IAAI,UAAU,OAAO,OAAO,OAAO,IAAI,MAAM;EACpD,WAAW,OAAO,IAAI,aAAa,QAAQ;EAC3C,UAAU,IAAI,aAAa,OAAO,OAAO,OAAO,IAAI,SAAS;EAC7D,WAAW,mBAAmB,IAAI,UAAU;CAC9C;AACF;AAEA,SAAS,mBAAmB,OAAwB;CAClD,IAAI,iBAAiB,MAAM,OAAO,MAAM,YAAY;CACpD,OAAO,OAAO,SAAS,EAAE;AAC3B;;;;;;;;;;;;;;;;;;;;;;;;AA6BA,eAAsB,gBACpB,IACA,WAC6B;CAC7B,MAAM,EAAE,UAAU,SAAS,SAAS,UAAU;CAC9C,IAAI,YAAY,QAAQ,WAAW,MACjC,MAAM,IAAI,MAAM,kDAAkD;CAEpE,IAAI,YAAY,SAAS,CAAC,OAAO,SAAS,QAAQ,KAAK,WAAW,IAChE,MAAM,IAAI,MAAM,8CAA8C,UAAU;CAE1E,IAAI,WAAW,SAAS,CAAC,OAAO,SAAS,OAAO,KAAK,UAAU,IAC7D,MAAM,IAAI,MAAM,6CAA6C,SAAS;CAGxE,MAAM,IAAI,aAAa,EAAE;CAOzB,MAAM,UAAU,YAHI,aAClB,MAAM,GAAG,MAAM,mCAAmC,mBAAmB,CAE3C,CAAA,CAAY,EAAE,EAAE,OAAO;CACnD,IAAI,YAAY,GACd,OAAO,EAAE,QAAQ,EAAE;CAGrB,IAAI,SAAS;CACb,IAAI,gBAAgB;CAEpB,IAAI,WAAW,MAAM;EACnB,MAAM,eAAe,KAAK,IAAI,UAAU,KAAK,MAAM,OAAO,GAAG,UAAU,CAAC;EACxE,IAAI,eAAe,GAAG;GACpB,gBAAgB;GAChB,UAAU,MAAM,cACd,IACA,UAAU,EAAE,CAAC,KACb,CAAC,YAAY,GACb,MACF;EACF;CACF;CAEA,IAAI,YAAY,MAAM;EACpB,MAAM,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,QAAQ,CAAC,CAAC,YAAY;EAK3D,UAAU,MAAM,cACd,IACA,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,KACvD;GAAC;GAAQ;GAAS;EAAa,GAC/B,MACF;CACF;CAEA,OAAO,EAAE,OAAO;AAClB;AAEA,eAAe,cACb,IACA,WACA,QACA,SAAS,OACQ;CAOjB,MAAM,QAAQ,YANI,aAChB,MAAM,GAAG,MACP,iCAAiC,kBAAkB,SAAS,aAC5D,GAAG,MACL,CAEwB,CAAA,CAAU,EAAE,EAAE,KAAK;CAC7C,IAAI,QAAQ,KAAK,CAAC,QAChB,MAAM,GAAG,MACP,eAAe,kBAAkB,SAAS,aAC1C,GAAG,MACL;CAEF,OAAO;AACT;AAMA,IAAM,oBAAoB;;AAG1B,IAAM,uCAAuB,IAAI,IAAY;;AAG7C,IAAM,8CAA8B,IAAI,IAAY;;;;;;;;;;;;;;;;;;;;;;AAuBpD,SAAgB,2BAAiC;CAC/C,IACE,mBAAmB,OAAO,CAAC,CAAC,MACzB,gBAAgB,YAAY,SAAA,kBAC/B,GAEA;CAGF,mBAAmB,SAAS;EAC1B,MAAM;EAIN,UAAU;EAEV,WAAW,UAAsB,SAAmC;GAClE,IAAI;IACF,QAAQ,WAAW;KACjB,GAAG,QAAQ;MACV,oBAAoB,SAAS,gBAAgB;IAChD;GACF,QAAQ,CAER;EACF;EAEA,MAAM,UACJ,UACA,SACe;GAEf,MAAM,kBAAkB,UADH,QAAQ,WAAW,uBAAuB,OACd,WAAW,QAAQ;EACtE;EAEA,MAAM,YAAY,UAAqC;GACrD,MAAM,kBAAkB,UAAU,QAAQ;EAC5C;CACF,CAAC;AACH;;AAGA,SAAgB,6BAAsC;CACpD,OAAO,mBAAmB,WAAW,4BAA4B;AACnE;AAEA,eAAe,kBACb,UACA,WACe;CACf,IAAI;CACJ,IAAI;CACJ,IAAI;EACF,QAAQ,SAAS;EAKjB,IAAI,CAAC,4BAA4B,KAAK,GAAG;EACzC,KAAK,SAAS;CAChB,QAAQ;EAGN;CACF;CAEA,IAAI;EACF,MAAM,KAAM,SAA8B;EAC1C,MAAM,WAAY,SAAgD;EAClE,MAAM,QAAQ,OAAO,OAAO,YAAY,KAAK,KAAK;EAClD,MAAM,cACJ,OAAO,aAAa,YAAY,WAAW,WAAW;EACxD,MAAM,MAAM,MAAM,aAAa,IAAI;GACjC;GACA;GACA;GACA,UAAU;EACZ,CAAC;EAQD,IAAI;GACF,oBAAoB,IAAI;IACtB;IACA;IACA;IACA,UAAU;IACV;GACF,CAAC;EACH,SAAS,OAAO;GACd,6BAA6B,IAAI,OAAO,KAAK;EAC/C;CACF,SAAS,OAAO;EACd,sBAAsB,IAAI,OAAO,KAAK;CACxC;AACF;AAEA,SAAS,sBACP,IACA,OACA,OACM;CACN,IAAI;EACF,MAAM,QAAQ,kBAAkB,EAAE;EAClC,IAAI,qBAAqB,IAAI,KAAK,GAAG;EACrC,qBAAqB,IAAI,KAAK;EAC9B,OAAO,KACL,qDAAqD,MAAM,wJAI3D,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,CAClE;CACF,QAAQ,CAER;AACF;AAEA,SAAS,6BACP,IACA,OACA,OACM;CACN,IAAI;EACF,MAAM,QAAQ,kBAAkB,EAAE;EAClC,IAAI,4BAA4B,IAAI,KAAK,GAAG;EAC5C,4BAA4B,IAAI,KAAK;EACrC,OAAO,KACL,4DAA4D,MAAM,mLAIlE,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,CAClE;CACF,QAAQ,CAER;AACF;;;;AAKA,SAAgB,0BAAgC;CAC9C,qBAAqB,MAAM;CAC3B,4BAA4B,MAAM;AACpC"}

package/dist/change-signals.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"change-signals.d.ts","sourceRoot":"","sources":["../src/change-signals.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;AAGH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAS5D;;;;;GAKG;AACH,MAAM,MAAM,qBAAqB,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEnE;;GAEG;AACH,MAAM,WAAW,YAAY;IAE3B,6CAA6C;IAC7C,KAAK,EAAE,MAAM,CAAC;IACd,gEAAgE;IAChE,SAAS,EAAE,qBAAqB,CAAC;IACjC,yEAAyE;IACzE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,oEAAoE;IACpE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB;;;OAGG;IACH,GAAG,EAAE,MAAM,CAAC;CACb;AAED,2EAA2E;AAC3E,MAAM,MAAM,oBAAoB,GAAG,CAAC,MAAM,EAAE,YAAY,KAAK,IAAI,CAAC;AAElE;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,wBAAwB,CAAC;AA4B3D;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wBAAwB,CACtC,EAAE,EAAE,iBAAiB,EACrB,QAAQ,EAAE,oBAAoB,GAC7B,MAAM,IAAI,CA2BZ;AAED;;;;;;;;;GASG;AACH,wBAAgB,oCAAoC,CAClD,EAAE,EAAE,iBAAiB,EACrB,cAAc,EAAE,MAAM,GAAG,IAAI,GAC5B,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,CAuBrB;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,EAAE,EAAE,iBAAiB,EACrB,MAAM,EAAE,YAAY,GACnB,IAAI,CAKN;AAwBD;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CACzC,EAAE,EAAE,iBAAiB,EACrB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,IAAI,CAAC,CAkBf;AA4ED;;;GAGG;AACH,wBAAgB,yBAAyB,IAAI,IAAI,CAOhD;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,IAAI,IAAI,CAIzC;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CAAC,EAAE,EAAE,iBAAiB,GAAG,MAAM,CAEzE"}
+{"version":3,"file":"change-signals.d.ts","sourceRoot":"","sources":["../src/change-signals.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;AAGH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAU5D;;;;;GAKG;AACH,MAAM,MAAM,qBAAqB,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEnE;;GAEG;AACH,MAAM,WAAW,YAAY;IAE3B,6CAA6C;IAC7C,KAAK,EAAE,MAAM,CAAC;IACd,gEAAgE;IAChE,SAAS,EAAE,qBAAqB,CAAC;IACjC,yEAAyE;IACzE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,oEAAoE;IACpE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB;;;OAGG;IACH,GAAG,EAAE,MAAM,CAAC;CACb;AAED,2EAA2E;AAC3E,MAAM,MAAM,oBAAoB,GAAG,CAAC,MAAM,EAAE,YAAY,KAAK,IAAI,CAAC;AAElE;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,wBAAwB,CAAC;AA4B3D;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wBAAwB,CACtC,EAAE,EAAE,iBAAiB,EACrB,QAAQ,EAAE,oBAAoB,GAC7B,MAAM,IAAI,CA2BZ;AAED;;;;;;;;;GASG;AACH,wBAAgB,oCAAoC,CAClD,EAAE,EAAE,iBAAiB,EACrB,cAAc,EAAE,MAAM,GAAG,IAAI,GAC5B,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,CAuBrB;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,EAAE,EAAE,iBAAiB,EACrB,MAAM,EAAE,YAAY,GACnB,IAAI,CAKN;AAwBD;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CACzC,EAAE,EAAE,iBAAiB,EACrB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,IAAI,CAAC,CAkBf;AA4ED;;;GAGG;AACH,wBAAgB,yBAAyB,IAAI,IAAI,CAOhD;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,IAAI,IAAI,CAIzC;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CAAC,EAAE,EAAE,iBAAiB,GAAG,MAAM,CAEzE"}