@jarenjs/db 0.66.1 → 0.67.0

package/ARCHITECTURE.md

@@ -1095,3 +1095,22 @@ processes creating one fresh file never meet the deferred-upgrade
 `SQLITE_BUSY` the busy handler cannot retry. The job queue's
 administration (`page`, `cancel`, `requeue`, `sweep`) lives in
 `src/jobs.js` beside the fence it authorises through (JOBS-FORMAT §10).
+
+
+## Replication and bounded dependency maintenance
+
+`replication-format.js` owns JSON normalization; `replication.js` persists replica
+identity, frontiers, canonical receipts, before-images, outbox and conflict
+evidence through the capture transaction's `beforeCommit` seam. `logical-rows.js`
+shares mapped, validated row access between replication and live dependencies.
+Remote application suppresses only local envelope allocation: its data still
+invalidates capture subscribers after commit. Snapshot reset carries complete
+receipt evidence and refuses histories beyond its explicit credits.
+
+`live-join.js` compiles indexed dependency descriptors from the entity planner
+and mapping. The same cache strategy maintains inner/left joins and eligible
+nested graph projections. `live-nested.js` maintains explicit two-level groups
+by refreshing affected parents from bounded leaves. Source and result payloads
+consume row and byte credits; unsupported shapes keep named reruns. See
+[the replication contract](docs/REPLICATION-FORMAT.md) and
+[the strategy matrix](docs/LIVE-FORMAT.md).

package/README.md

@@ -990,11 +990,17 @@ shutdown limits, the browser persistence matrix and measured latency/memory loss
   `sessionReason`. One diff
   format runs store → patch → live query → O(k) render. Capture is
   opt-in; the overhead is published, not waved away.
+- **Portable replication** ([REPLICATION-FORMAT](docs/REPLICATION-FORMAT.md)):
+  opt-in replica identities, causal frontiers, bounded logical envelopes,
+  durable replay receipts, explicit conflict evidence and snapshot resets.
+  Data and acknowledgements commit together. Hosts supply transport and any
+  conflict resolver; the default preserves both contenders and rejects the write.
 - **Live queries** (LIVE-FORMAT §§7–13): `collection.live(document)`
   maintains a result as writes arrive and emits patches — incremental
   for `where`/`select`/`orderBy`+`limit`/aggregates/single-level
   `groupBy` and a spatial `where` over a derived index (the geofence;
-  the normative maintenance table), re-run for everything else,
+  the normative maintenance table), indexed inner/left entity joins, bounded
+  graph projections and explicit two-level groups; re-run for other shapes,
   **declared, never silent** (`live.mode` names the reason).
   Unaffected rows stay reference-identical; a seeded oracle holds the
   maintained result equal to a fresh re-query after every mutation.
@@ -1276,7 +1282,8 @@ its side-effect-free status read are in
   there. Same-host processes over WAL are the supported topology. No
   priority classes, no cron, no workflow compensation.
 - **Live-query maintenance is limited to the declared table** (§7);
-  joins, entity queries and non-canonical shapes re-run, reported.
+  indexed joins and graph projections require bounded dependencies. Offset
+  windows, unindexed joins, load-spec graphs and non-canonical shapes re-run, reported.
 - **`eventTime.retention` bounds repair work, not memory.** It is the
   horizon a view claims and is checked against the window it maintains;
   the maintained state is still bounded by `live.maxMaintained`, and no
@@ -1287,8 +1294,8 @@ its side-effect-free status read are in
   durability differences; see [execution hosts](docs/HOSTS.md).
 - **Named future work, not silent gaps**: `$groupby` pushdown beyond
   the `$time-bucket` ladder, a many-to-many hop on the chain, membership
-  on an auto-keyed pending insert, incremental joins, other SQL dialects,
-  replication, database introspection (MODEL-FORMAT §10.6, the roadmap).
+  on an auto-keyed pending insert, additional join/group shapes, other SQL dialects,
+  transport policy, database introspection (MODEL-FORMAT §10.6, the roadmap).
 
 The normative formats are
 [docs/MODEL-FORMAT.md](docs/MODEL-FORMAT.md) (storage §§1–7, safe
@@ -1320,6 +1327,10 @@ Every subpath a consumer can import, derived from the manifest by
 | `@jarenjs/db/schemas/jaren-migration.schema.json` | schema | — |
 | `@jarenjs/db/schemas/jaren-model.draft-07.schema.json` | schema | — |
 | `@jarenjs/db/schemas/jaren-model.schema.json` | schema | — |
+| `@jarenjs/db/schemas/jaren-replication-snapshot.draft-07.schema.json` | schema | — |
+| `@jarenjs/db/schemas/jaren-replication-snapshot.schema.json` | schema | — |
+| `@jarenjs/db/schemas/jaren-replication.draft-07.schema.json` | schema | — |
+| `@jarenjs/db/schemas/jaren-replication.schema.json` | schema | — |
 | `@jarenjs/db/package.json` | metadata | — |
 | `@jarenjs/db/node-worker` | JavaScript | declared |
 | `@jarenjs/db/node-pool` | JavaScript | declared |

package/docs/LIVE-FORMAT.md

@@ -273,7 +273,10 @@ what the pushdown planner already means by it.
 | a spatial predicate the planner **refused** (no `derive` index on the member, an untyped member, an unbounded probe) | **re-run on invalidation**, the refusal named — it never translated, so nothing narrows the fetch | the previous result, for diffing |
 | a `$resample` or `$rolling` document over the collection, with an explicit `eventTime` and a fixed width (§13) | **event-time bucket / rolling state**: rows kept by bucket, or in instant order; only what a write can reach is folded again, through `@jarenjs/core/series` itself | the contributing rows, plus one fold per bucket |
 | the same document with no `eventTime`, a calendar width, a named zone, a `locf`/`linear` fill, a `first`/`last` aggregate, or a retention that does not cover the window | **re-run on invalidation**, the member that stopped it named (§13.2) | the previous result, for diffing |
-| joins, multi-entity roots, graph loads, every entity query | **re-run on invalidation — declared, not attempted** in this version | the previous result, for diffing |
+| indexed inner equi-joins and canonical allowing-empty left joins over mapped entity roots | **join dependency maintenance**; point-read changed keys and reevaluate their bounded outer owners | source rows, key indexes and projected tuples, bounded by `maxMaintained` and `maxBytes` |
+| nested entity graph projections with indexed equality edges and unique binding names | **graph dependency maintenance**; a child change refreshes its bounded owners | source rows, reverse key indexes and graph outputs |
+| explicit two-level collection groups with a singular parent key and bounded nested input | **nested-group maintenance**; recompute affected parents through the query engine | source leaves and parent outputs |
+| unindexed/non-equi joins, self joins, explicit entity ordering/windows, object-root documents and load-spec graphs | **re-run on invalidation**, with the dependency or planner reason | previous result for diffing |
 | anything else: non-translatable predicates, `limit` without `orderBy`, `offset` > 0, windowed aggregates, `@jarenjs/linq`'s nested two-level `groupBy` emission, non-canonical group returns | **re-run on invalidation**, the reason named | the previous result, for diffing |
 
 The **physical mapping** of a `derive: 'bbox'` index (MODEL-FORMAT §2.1,
@@ -310,8 +313,8 @@ refuses at registration (`JD0051`), the same shape as capture's
 demanded session — an application that needs the property can refuse
 to start.
 
-The **canonical group form** the classifier recognises (and the only
-one — the linq chain's nested emission re-runs, stated plainly):
+The **canonical group form** the classifier recognises (the linq chain's group-of-groups emission still re-runs; explicit
+nested groups have a separate bounded strategy below):
 
 ```json
 { "$for": { "it": "$[*]" },
@@ -502,13 +505,14 @@ ERRORING rather than degrading (the D14 rule — the bound is printed):
   delete-correctness, and a count over a table larger than the bound
   is a conscious `maxMaintained` raise, not a silent one.
 
-Non-claims, in one place: no incremental joins (re-run is the declared
-strategy), no cross-connection invalidation (§6's `data_version` is
+Non-claims, in one place: no maintenance of unindexed or non-equality joins,
+no cross-connection invalidation (§6's `data_version` is
 the signal), no maintenance over asynchronous connections —
 `capabilities.live` is `false` there and a registration is `JD0051`
 naming the reason, because maintenance point-reads rows synchronously
 inside delivery (the wasm driver's oo1 API is synchronous, which is
-why the browser has live queries at all) — no replication, and no ordering guarantee for
+why the browser has live queries at all). Replication is specified separately in
+[REPLICATION-FORMAT](REPLICATION-FORMAT.md). There is no ordering guarantee for
 unordered queries beyond §9's determinism.
 
 ## 13. Event time
@@ -616,3 +620,40 @@ holds a shuffled stream of inserts, in-place updates, instant moves and
 deletes against `resampleSeries` / `rollingSeries` over the whole
 collection after each one, which is the only oracle that cannot drift
 with the implementation.
+
+
+## Bounded joins, graph projections and nested groups
+
+`join`, `graph` and `nested-group` strategies charge their source rows and
+result entries to `live.maxMaintained`, and serialized input/output payloads to
+`live.maxBytes` (default 4 MiB). These credits bound cached payloads rather than
+claiming to measure JavaScript heap overhead. Initialization uses a limited
+source read; updates read changed keys, then visit cached indexed dependencies.
+Bounds are checked while caches grow. Overflow is `JD2060`, emits one error,
+closes the subscription and releases dependency caches. It never relabels an
+unbounded query as incremental.
+
+Entity equality columns need a primary-key prefix, declared index or mapped
+foreign-key index. Every binding needs a key and a distinct root. The projected
+identity is the tuple of source identities, so duplicate projected values remain
+distinct. Default entity result order follows physical row insertion order;
+point reads preserve that order even when a key is deleted and reinserted. A
+left join uses a canonical `$allowing-empty` binding over an equality-filtered
+inner subquery. Its absent child can be defaulted to null. Graph projections
+embed equality-filtered child queries in a single outer row's return object.
+Global-root reads outside those bindings re-run because changing one row can
+change every projected graph.
+
+`dependencyReads`, `refreshedRoots` and `refreshedGroups` expose the work done.
+`dependencyReads` counts logical changed-row reads; a row-position lookup is an
+additional statement. No full query reruns occur under these strategy labels.
+Materializing and diffing the final bounded output still costs work proportional
+to its size. See the equal-correctness [measurements](REPLICATION-FORMAT.md#measurements)
+for startup and high-fan-out losses beside selective wins.
+
+Two-level grouping currently accepts an explicit parent `$groupby` over a
+singular member, with one nested group over that parent's bound row sequence.
+Count, sum, average, minimum and maximum recompute from only the affected
+parent's bounded leaves. An offset, an unsupported operator, a global input to
+the nested group, or a group-of-groups LINQ emission remains a named rerun.
+Replicated writes enter the same committed capture stream as local writes.

package/docs/MODEL-FORMAT.md

@@ -1078,6 +1078,14 @@ error.
 | `JD2092` | a worker row, compatibility result or remote identity count exceeds its declared bound |
 | `JD2093` | malformed worker protocol request |
 | `JD2094` | invalid or uncommitted durable snapshot; reopen the last committed version |
+| `JD0060` | a replication envelope or snapshot is invalid |
+| `JD2100` | a replica sequence or causal dependency has a gap |
+| `JD2101` | an envelope identity names different content or an unknown local origin |
+| `JD2102` | the replica identity or model revision disagrees |
+| `JD2103` | a resolver fails its synchronous decision contract |
+| `JD2104` | a logical row or snapshot disagrees with its causal history |
+| `JD2105` | an explicit snapshot reset is required, or reset would discard acknowledged history |
+| `JD2106` | a replication operation or snapshot exceeds its configured bound |
 
 The table above is proven in sync with the runtime `DB_CODES` table by
 a test.

package/docs/REPLICATION-FORMAT.md

@@ -0,0 +1,208 @@
+# Replication format and runtime
+
+`jaren-replication` 0.1 is a transport-neutral logical transaction. Open an empty
+store with `replication: { replica: 'host-issued-id' }`; capture is enabled when
+omitted. Existing replication stores must reopen with the same identity and
+model. Every writer of that file must enable replication. External SQL writes
+and opening a replicated file without replication are outside the history
+contract; a detected before-image disagreement refuses with `JD2104`.
+
+The host owns network transport, authentication, replica identity allocation and
+resolver policy. A replica id must remain unique to its writer lineage. The
+runtime works on SQLite Node, worker and wasm hosts through session or journal
+capture. Drivers without `changeCapture` refuse at open; PostgreSQL capture is
+not implemented. Journal replication refuses models with cascading or set-null
+child foreign keys (`JD0051`), because the journal cannot observe those effects.
+Session capture includes them. Both modes support membership cascades and
+roll back an envelope whose side effects are absent from its logical operations.
+
+## Envelope
+
+```json
+{
+  "$replication": "0.1",
+  "replica": "site-a",
+  "seq": 1,
+  "frontier": {},
+  "model": "application-model-revision",
+  "operations": [
+    { "table": "notes", "key": "note/one", "before": null,
+      "after": { "id": "note/one", "body": "hello" } }
+  ]
+}
+```
+
+`model` is the store's `shapeHash(model)` revision. `seq` is a positive safe
+integer, allocated from the replica's durable frontier in the data transaction.
+The identity is `replicationIdentity(replica, seq)`, the JSON encoding of their
+pair, so separators inside host ids cannot collide. A frontier maps host ids to
+non-negative safe sequences. The sender's frontier entry must equal `seq - 1`,
+with an absent entry meaning zero. Property names such as `__proto__` and
+`constructor` remain ordinary replica ids.
+
+Each operation is one net row transition. `before: null` inserts, `after: null`
+deletes, and two objects replace the complete logical row. A table/key occurs
+once per envelope. Composite keys use the capture format's JSON-array token;
+single keys use their scalar text. Entity documents include mapped scalar and
+foreign-key fields, omit relation projections and retain authored version and
+timestamp values. Membership tables carry their two keys. Application performs
+schema validation through the store's configured validator and reuses physical
+column plans; it does not generate fresh defaults or version stamps.
+
+`normalizeReplication` validates and detaches the document. `encodeReplication`
+produces deterministic JSON. Object members are canonically ordered; operation
+array order remains part of identity. Capture sorts net rows by table/key, making
+physical session and journal output equal. Envelope order preserves transaction
+order. Physical insertion order inside a netted transaction or snapshot is not a
+portable query ordering: use an explicit query order when comparing replicas.
+Receipts retain the entire canonical payload, avoiding hash-collision ambiguity.
+
+Unknown members and versions, empty ids, unsafe sequences, non-JSON values,
+cycles, duplicate net rows and unchanged operations are `JD0060`. Nesting is
+limited to 128 object/array ancestors. JSON Schema artifacts describe structural
+validation; cross-field sequence, uniqueness and causal checks are runtime
+constraints. Current and draft-07 artifacts ship for envelopes and snapshots:
+
+- `@jarenjs/db/schemas/jaren-replication.schema.json`
+- `@jarenjs/db/schemas/jaren-replication.draft-07.schema.json`
+- `@jarenjs/db/schemas/jaren-replication-snapshot.schema.json`
+- `@jarenjs/db/schemas/jaren-replication-snapshot.draft-07.schema.json`
+
+## Applying and exporting
+
+```js
+const source = await openStore(model, {
+  driver, replication: { replica: 'site-a', retention: 1000 }
+});
+const page = await source.replication.page({ after: 0, limit: 100, maxBytes: 1048576 });
+for (const envelope of page.items) {
+  const result = await target.replication.apply(envelope);
+  if (result.status === 'conflict') hostReport(result.conflicts);
+}
+```
+
+`apply` returns `applied`, `duplicate` or `conflict`, together with the committed
+frontier and conflict records. Successful duplicate delivery performs no row
+write or live emission. An acknowledged identity with different bytes is
+`JD2101`. A sequence or causal gap is `JD2100`: no suffix is applied. Deliver
+missing envelopes first, then retry, or perform an explicit reset. Model mismatch
+is `JD2102`. Imported envelopes keep their original identity and produce no local
+outbox entry, preventing echoes. A host forwarding between peers must preserve
+the original envelopes; `page()` exports this replica's own commits only.
+
+Data, receipt, per-row causal metadata, capture record and frontier settle in
+the same transaction. Replication is available only on the root Store; transaction
+views expose no replication API. Failed validation, cancellation, constraint checks or
+commit roll everything back. Subscribers run through the existing committed
+capture delivery path. Tests kill a process immediately before and after commit
+and verify both data and frontier after reopening.
+
+Pages use the shared cursor and byte-credit drain. `limit` counts whole envelopes;
+`maxBytes` counts complete canonical envelope bytes. An indivisible oversize
+envelope is `JD2074`. Retention loss returns `resetRequired: true`, no items and
+no continuation. `earliestAvailable`, `highWatermark`, `next` and `hasMore` describe
+the local outbox. Pages and snapshots take a consistent store transaction.
+`signal` and `deadline` are honored through existing cancellation contracts:
+queue cancellation is `JD2064`, operation-boundary cancellation `JD2072`, and an
+expired deadline `JD2075`.
+
+Defaults are `retention: 1000`, `maxOperations: 10000`, `maxBytes: 4194304`.
+Operation overflow is `JD2106`; all credits are positive safe integers. Retention
+prunes only outgoing envelope history. Replay receipts, row tombstones and
+conflict evidence remain durable. They are deliberately not claimed to be a
+bounded total database size. Internal tables use the reserved `_jaren_replica`
+prefix. No schema migration or revision rewrite of this protocol is implicit.
+
+## Conflicts
+
+Concurrent incompatible whole-row writes reject by default. A `conflict` result
+does not acknowledge the remote envelope and leaves the local row intact.
+`replication.conflicts({ limit, maxBytes, signal, deadline })` reads persisted evidence: the common base,
+local value and frontier, remote value and envelope position, resolver identity
+and decision. A rejected envelope reserves its canonical identity too, so retries
+cannot replace its contender with different content.
+
+An optional `replication.resolver` has `{ id, resolve }`. Its synchronous pure
+function receives frozen evidence and returns `{ action: 'local' }`,
+`{ action: 'remote' }`, or `{ action: 'merged', value }`; a merged value may be
+null for deletion. Invalid decisions refuse with `JD2103`. Both contenders and
+the resolver id are retained for every resolution. No resolver is bundled.
+Determinism and convergence of a custom policy are the host's responsibility:
+choosing the receiver's local value on each replica is deterministic but does
+not make replicas agree. Independent non-conflicting deliveries converge without
+resolver policy. Concurrent changes to different fields of the same row are
+conservatively whole-row conflicts in this version.
+
+## Reset handshake
+
+`source.replication.snapshot()` returns a `jaren-replication-snapshot` 0.1
+document containing `model`, `frontier`, logical `rows` with their causal
+frontiers, and complete acknowledged `receipts`.
+`target.replication.reset(snapshot)` validates and atomically installs it while
+emitting ordinary live invalidations. The snapshot must dominate all target
+acknowledgements and preserve every known receipt's bytes. It cannot discard
+unsynchronized local history (`JD2105`) or rewrite identities (`JD2101`).
+Snapshot receipt sequences must completely cover their frontier, and row
+frontiers cannot be ahead of it. Subsequent duplicate deliveries remain
+verifiable because the receipts travel with the snapshot.
+
+Resets are intentionally bounded single documents: rows plus receipts must fit
+`maxOperations`, and the complete encoding must fit `maxBytes`. Snapshot and
+conflict readers pull through the shared cursor and stop before accumulating
+beyond the configured credits. Resolver outputs and conflict evidence also
+obey `maxBytes`. Very large
+histories require a separately designed paged snapshot/receipt compaction
+protocol; this implementation refuses them rather than splicing partial state.
+A reset preserves the receiver's own replica identity and clears its outgoing
+history. Future writes continue its sequence from the imported frontier.
+
+## Authoring
+
+`@jarenjs/linq/db` exports a deterministic pen using the same validator:
+
+```js
+const envelope = defineReplication({ replica: 'site-a', seq: 1,
+  frontier: {}, model: revision })
+  .change('notes', 'one', null, { id: 'one', body: 'hello' })
+  .toDocument();
+```
+
+The pen snapshots its input and emits the same canonical bytes as hand-authored
+JSON. Normal applications export committed Store envelopes; constructing an
+envelope does not allocate or acknowledge a Store sequence.
+
+## Measurements
+
+Run `npm run benchmark:changeflow`. Every timed mutation is followed by a fresh
+query and a patch-only consumer comparison; every measured mutation changes its
+visible result. Graph measurements mutate a child of one owner. Replication deliveries compare
+complete database state, including relations. Conflict timings retry one
+rejected contender and assert unchanged data/frontier plus durable evidence. Timing includes capture and live
+delivery; oracle time is reported separately. Heap deltas are uncollected
+allocations observed after initialization, not precise retained-heap sizes.
+
+<!--fact:db.changeflow-->
+
+Measured 2026-09-08, v24.19.0, AMD Ryzen 9 5900HX with Radeon Graphics; 15 mutations per case.
+
+| Shape | Strategy | Initialize ms | Mutation p50 ms | Mutation p95 ms | Initialization heap bytes |
+|---|---|---:|---:|---:|---:|
+| selective join | join | 16.663 | 0.323 | 2.119 | 4878848 |
+| selective join | rerun | 0.899 | 0.746 | 1.622 | 347160 |
+| high fan-out join | join | 7.314 | 1.901 | 3.179 | 4851232 |
+| high fan-out join | rerun | 0.860 | 0.850 | 1.188 | 340328 |
+| graph | graph | 7.462 | 0.459 | 0.750 | 4811712 |
+| graph | rerun | 4.539 | 4.042 | 4.979 | 1417928 |
+| nested groups | nested-group | 6.775 | 0.252 | 0.795 | 2057832 |
+| nested groups | rerun | 0.897 | 0.472 | 0.685 | 295808 |
+| offset groups | rerun | 1.519 | 0.459 | 0.547 | 383648 |
+| offset groups | rerun | 0.884 | 0.426 | 0.585 | 282280 |
+
+| Capture | Envelopes | Operations | Bytes | Apply p50 ms | Replay p50 ms | Conflict p50 ms |
+|---|---:|---:|---:|---:|---:|---:|---:|
+| session | 15 | 15 | 3169 | 0.458 | 0.118 | 0.204 |
+| journal | 15 | 15 | 3169 | 0.294 | 0.092 | 0.161 |
+
+Selective maintenance avoids repeated full SQL evaluation. Initialization and high-fan-out maintenance can cost more than rerunning; the table includes both. Offset groups remain rerun in both requested modes.
+
+<!--/fact-->

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@jarenjs/db",
   "private": false,
-  "version": "0.66.1",
+  "version": "0.67.0",
   "type": "module",
   "main": "./src/index.js",
   "types": "./types/index.d.ts",
@@ -84,9 +84,9 @@
     "prepack": "npm run build:types"
   },
   "dependencies": {
-    "@jarenjs/core": "^0.66.1",
-    "@jarenjs/json": "^0.66.1",
-    "@jarenjs/validate": "^0.66.1"
+    "@jarenjs/core": "^0.67.0",
+    "@jarenjs/json": "^0.67.0",
+    "@jarenjs/validate": "^0.67.0"
   },
   "bin": {
     "jaren-db": "./src/cli.js"

package/schemas/jaren-replication-snapshot.draft-07.schema.json

@@ -0,0 +1,83 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://jarenjs.dev/schemas/jaren-replication-snapshot/draft-07",
+  "title": "Bounded replication snapshot and frontier handshake",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "$replicationSnapshot",
+    "model",
+    "frontier",
+    "rows",
+    "receipts"
+  ],
+  "properties": {
+    "$replicationSnapshot": {
+      "const": "0.1"
+    },
+    "model": {
+      "type": "string",
+      "minLength": 1
+    },
+    "frontier": {
+      "type": "object",
+      "propertyNames": {
+        "type": "string",
+        "minLength": 1,
+        "maxLength": 128
+      },
+      "additionalProperties": {
+        "type": "integer",
+        "minimum": 0,
+        "maximum": 9007199254740991
+      }
+    },
+    "rows": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": [
+          "table",
+          "key",
+          "value",
+          "frontier"
+        ],
+        "properties": {
+          "table": {
+            "type": "string",
+            "pattern": "^[A-Za-z_][A-Za-z0-9_]*$"
+          },
+          "key": {
+            "type": "string"
+          },
+          "value": {
+            "type": [
+              "object",
+              "null"
+            ]
+          },
+          "frontier": {
+            "type": "object",
+            "propertyNames": {
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 128
+            },
+            "additionalProperties": {
+              "type": "integer",
+              "minimum": 0,
+              "maximum": 9007199254740991
+            }
+          }
+        }
+      }
+    },
+    "receipts": {
+      "type": "array",
+      "items": {
+        "$ref": "https://jarenjs.dev/schemas/jaren-replication/draft-07"
+      }
+    }
+  }
+}

package/schemas/jaren-replication-snapshot.schema.json

@@ -0,0 +1,83 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://jarenjs.dev/schemas/jaren-replication-snapshot",
+  "title": "Bounded replication snapshot and frontier handshake",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "$replicationSnapshot",
+    "model",
+    "frontier",
+    "rows",
+    "receipts"
+  ],
+  "properties": {
+    "$replicationSnapshot": {
+      "const": "0.1"
+    },
+    "model": {
+      "type": "string",
+      "minLength": 1
+    },
+    "frontier": {
+      "type": "object",
+      "propertyNames": {
+        "type": "string",
+        "minLength": 1,
+        "maxLength": 128
+      },
+      "additionalProperties": {
+        "type": "integer",
+        "minimum": 0,
+        "maximum": 9007199254740991
+      }
+    },
+    "rows": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": [
+          "table",
+          "key",
+          "value",
+          "frontier"
+        ],
+        "properties": {
+          "table": {
+            "type": "string",
+            "pattern": "^[A-Za-z_][A-Za-z0-9_]*$"
+          },
+          "key": {
+            "type": "string"
+          },
+          "value": {
+            "type": [
+              "object",
+              "null"
+            ]
+          },
+          "frontier": {
+            "type": "object",
+            "propertyNames": {
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 128
+            },
+            "additionalProperties": {
+              "type": "integer",
+              "minimum": 0,
+              "maximum": 9007199254740991
+            }
+          }
+        }
+      }
+    },
+    "receipts": {
+      "type": "array",
+      "items": {
+        "$ref": "https://jarenjs.dev/schemas/jaren-replication"
+      }
+    }
+  }
+}

package/schemas/jaren-replication.draft-07.schema.json

@@ -0,0 +1,82 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://jarenjs.dev/schemas/jaren-replication/draft-07",
+  "title": "Portable logical replication transaction",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "$replication",
+    "replica",
+    "seq",
+    "frontier",
+    "model",
+    "operations"
+  ],
+  "properties": {
+    "$replication": {
+      "const": "0.1"
+    },
+    "replica": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 128
+    },
+    "seq": {
+      "type": "integer",
+      "minimum": 1,
+      "maximum": 9007199254740991
+    },
+    "frontier": {
+      "type": "object",
+      "propertyNames": {
+        "type": "string",
+        "minLength": 1,
+        "maxLength": 128
+      },
+      "additionalProperties": {
+        "type": "integer",
+        "minimum": 0,
+        "maximum": 9007199254740991
+      }
+    },
+    "model": {
+      "type": "string",
+      "minLength": 1
+    },
+    "operations": {
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": [
+          "table",
+          "key",
+          "before",
+          "after"
+        ],
+        "properties": {
+          "table": {
+            "type": "string",
+            "pattern": "^[A-Za-z_][A-Za-z0-9_]*$"
+          },
+          "key": {
+            "type": "string"
+          },
+          "before": {
+            "type": [
+              "object",
+              "null"
+            ]
+          },
+          "after": {
+            "type": [
+              "object",
+              "null"
+            ]
+          }
+        }
+      }
+    }
+  }
+}