@minnowdb/core 0.9.1 → 0.10.1

package/dist/storage/toolkit/record-core.js

@@ -1,4 +1,4 @@
-import { CompactionBacklogError, CompactionJobConflictError, assertCompactionOutputProvenance, compactionOutputSegmentIds, createManifest, createGarbageCollectionJobRecord, advanceGarbageCollectionJobRecord, collectFtsCandidates, collectFtsPostingsBounded, validateFtsCandidateLimit, validateFtsReadVersion, activePostingStorageColumnIds, invalidateUncoveredFtsColumns, invalidateUncoveredSecondaryIndexes, GarbageCollectionJobConflictError, LeaseConflictError, LeaseExpiredError, LeaseOwnerConflictError, MAX_LEASE_TTL_MS, MAX_ACTIVE_LEASES, MAX_ACTIVE_TEMP_OWNERS, MAX_ACTIVE_COMPACTION_JOBS, MAX_ACTIVE_UNIQUE_KEY_BUILDS, MAX_ACTIVE_TRANSACTIONS, MAX_TERMINAL_TRANSACTION_RECORDS, MAX_TERMINAL_COMPACTION_JOB_RECORDS, MAX_COMPLETED_GARBAGE_COLLECTION_JOB_RECORDS, MAX_PINNED_MANIFEST_VERSION_LAG, MAX_PINNED_RETIRED_BLOCKS, MAX_PINNED_RETIRED_BYTES, MAX_RETIRED_HISTORY_BYTES, MAX_GLOBAL_STAGED_ARTIFACT_BYTES, MAX_GLOBAL_STAGED_BLOCKS, MAX_GLOBAL_STAGED_SEGMENTS, MAX_TEMP_OWNER_TTL_MS, MAX_ROW_ID, MAX_ROW_ID_EXCLUSIVE_END, MAX_AUTO_INCREMENT_EXCLUSIVE_END, MAX_LEVEL_ZERO_SEGMENTS, MAX_MANIFEST_BLOCK_PRESENCE_IDS, MAX_STORAGE_ID_CHARACTERS, MAX_CATALOG_RECORDS, MAX_CATALOG_RETAINED_BYTES, MAX_MANIFEST_RECORDS, MAX_MANIFEST_RETAINED_BYTES, MAX_SEGMENT_RECORDS, MAX_SEGMENT_RETAINED_BYTES, MAX_FTS_CANDIDATE_ROW_IDS, MAX_FTS_POSTINGS_PER_CHUNK, MAX_FTS_POSTING_ROW_IDS_PER_CHUNK, MAX_FTS_POSTING_TERM_CHARACTERS, MAX_FTS_TOKENS_PER_DOCUMENT, MAX_FTS_BASE_CHUNKS, MAX_FTS_DELTA_CHUNKS, SnapshotManifestMissingError, StorageResourceLimitError, TableInUseError, TableRecordConflictError, TempOwnerConflictError, TransactionRecordConflictError, UniqueKeyConflictError, UniqueKeyBuildConflictError, UniqueIndexCoverageError, assertTransactionArtifactBatchLimits, assertTransactionArtifactJournalLimits, assertTempRunPageBatchLimits, assertStorageBulkReadItems, boundedMaintenanceBatchItems, normalizeCompactionJobRecord, normalizeGarbageCollectionJobRecord, normalizeSegmentRecord, updateCompactionJobRecord, updateTransactionRecord, updateGarbageCollectionPlanningRecord, validateTableColumns, validateTableForeignKey, validateSecondaryIndexes, secondaryIndexColumnIds, secondaryIndexWriteContractChanged, secondaryUniqueKeyNamespace, transactionCommitDeltaRetainedBytes, uniqueKeyBuildChunkRetainedBytes, MAX_UNIQUE_KEY_BUILD_TTL_MS, MAX_UNIQUE_KEY_BUILD_STAGED_BYTES, MAX_UNIQUE_KEY_BUILD_STAGED_BYTES_TOTAL, MAX_UNIQUE_KEY_BUILD_TOKENS_PER_CHUNK, validateFtsPostingQueries, validateCanonicalManifestChangedTableIds, catalogRecordRetainedBytes, manifestRecordRetainedReservationBytes, segmentRecordRetainedBytes, snapshotAcceleratorItemRetainedUsage, assertSnapshotImportAcceleratorUsage, SchemaConflictError, WriteConflictError } from "../types.js";
+import { CompactionBacklogError, CompactionJobConflictError, assertCompactionOutputProvenance, compactionOutputSegmentIds, createManifest, createGarbageCollectionJobRecord, advanceGarbageCollectionJobRecord, collectFtsCandidates, collectFtsPostingsBounded, validateFtsCandidateLimit, validateFtsReadVersion, activePostingStorageColumnIds, invalidateUncoveredFtsColumns, invalidateUncoveredSecondaryIndexes, GarbageCollectionJobConflictError, LeaseConflictError, LeaseExpiredError, LeaseOwnerConflictError, MAX_LEASE_TTL_MS, MAX_ACTIVE_LEASES, MAX_ACTIVE_TEMP_OWNERS, MAX_ACTIVE_COMPACTION_JOBS, MAX_ACTIVE_UNIQUE_KEY_BUILDS, MAX_ACTIVE_TRANSACTIONS, MAX_TERMINAL_TRANSACTION_RECORDS, MAX_TERMINAL_COMPACTION_JOB_RECORDS, MAX_COMPLETED_GARBAGE_COLLECTION_JOB_RECORDS, MAX_PINNED_MANIFEST_VERSION_LAG, MAX_PINNED_RETIRED_BLOCKS, MAX_PINNED_RETIRED_BYTES, MAX_RETIRED_HISTORY_BYTES, MAX_GLOBAL_STAGED_ARTIFACT_BYTES, MAX_GLOBAL_STAGED_BLOCKS, MAX_GLOBAL_STAGED_SEGMENTS, MAX_TEMP_OWNER_TTL_MS, MAX_ROW_ID, MAX_ROW_ID_EXCLUSIVE_END, MAX_AUTO_INCREMENT_EXCLUSIVE_END, MAX_LEVEL_ZERO_SEGMENTS, MAX_MANIFEST_BLOCK_PRESENCE_IDS, MAX_STORAGE_ID_CHARACTERS, MAX_CATALOG_RECORDS, MAX_CATALOG_RETAINED_BYTES, MAX_MANIFEST_RECORDS, MAX_MANIFEST_RETAINED_BYTES, MAX_SEGMENT_RECORDS, MAX_SEGMENT_RETAINED_BYTES, MAX_FTS_CANDIDATE_ROW_IDS, MAX_FTS_POSTINGS_PER_CHUNK, MAX_FTS_POSTING_ROW_IDS_PER_CHUNK, MAX_FTS_POSTING_TERM_CHARACTERS, MAX_FTS_TOKENS_PER_DOCUMENT, MAX_FTS_BASE_CHUNKS, MAX_FTS_DELTA_CHUNKS, SnapshotManifestMissingError, StorageResourceLimitError, TableInUseError, TableRecordConflictError, TempOwnerConflictError, TransactionRecordConflictError, UniqueKeyConflictError, UniqueKeyBuildConflictError, UniqueIndexCoverageError, assertTransactionArtifactBatchLimits, assertTempRunPageBatchLimits, assertStorageBulkReadItems, boundedMaintenanceBatchItems, normalizeCompactionJobRecord, normalizeGarbageCollectionJobRecord, normalizeSegmentRecord, updateCompactionJobRecord, appendTransactionJournal, updateTransactionRecord, updateGarbageCollectionPlanningRecord, validateTableColumns, validateTableForeignKey, validateSecondaryIndexes, secondaryIndexColumnIds, secondaryIndexWriteContractChanged, secondaryUniqueKeyNamespace, transactionCommitDeltaRetainedBytes, uniqueKeyBuildChunkRetainedBytes, MAX_UNIQUE_KEY_BUILD_TTL_MS, MAX_UNIQUE_KEY_BUILD_STAGED_BYTES, MAX_UNIQUE_KEY_BUILD_STAGED_BYTES_TOTAL, MAX_UNIQUE_KEY_BUILD_TOKENS_PER_CHUNK, validateFtsPostingQueries, validateCanonicalManifestChangedTableIds, catalogRecordRetainedBytes, manifestRecordRetainedReservationBytes, segmentRecordRetainedBytes, snapshotAcceleratorItemRetainedUsage, assertSnapshotImportAcceleratorUsage, SchemaConflictError, WriteConflictError } from "../types.js";
 import { dateIsoString } from "../../date-value.js";
 import { assertWellFormedString, crc32, MAX_STORED_BLOCK_BYTE_LENGTH } from "../../block-format/index.js";
 function cloneRecord(value) {
@@ -418,6 +418,14 @@ class RecordRootIndex {
     else
       index.delete(record.version);
   }
+  appendTransactionArtifacts(record, appended) {
+    this.#change(this.#transactionBlocks, appended.blockIds, 1);
+    this.#change(this.#transactionSegments, appended.segmentIds, 1);
+    if (record.status !== "active")
+      return;
+    this.#change(this.#activeTransactionBlocks, appended.blockIds, 1);
+    this.#change(this.#activeTransactionSegments, appended.segmentIds, 1);
+  }
   changeTransaction(record, delta) {
     this.#change(this.#transactionBlocks, record.pendingBlockIds, delta);
     this.#change(this.#transactionSegments, record.pendingSegmentIds, delta);
@@ -616,6 +624,9 @@ class RecordCore {
   #activeStagedArtifactBytes = 0;
   #terminalTransactionCount = 0;
   #transactionBlockLengthOverrides;
+  #journalBlockSets = /* @__PURE__ */ new WeakMap();
+  #journalBytes = /* @__PURE__ */ new WeakMap();
+  #transactionAppendHint;
   #activeTransactionExpiries = new OrderedKeyIndex(compareExpiryKeys);
   #activeTransactionExpiryKeys = /* @__PURE__ */ new Map();
   #transactions = new OrderedRecordMap((previous, next) => {
@@ -691,6 +702,11 @@ class RecordCore {
     this.#activeStagedBlockCount += after.blocks - before.blocks;
     this.#activeStagedSegmentCount += after.segments - before.segments;
     this.#activeStagedArtifactBytes += after.bytes - before.bytes;
+    const hint = this.#transactionAppendHint;
+    if (hint !== void 0 && previous !== void 0 && next !== void 0 && hint.previous === previous && previous.status === "active" && next.status === "active" && next.snapshotVersion === previous.snapshotVersion && next.pendingBlockIds.length === previous.pendingBlockIds.length + hint.blockIds.length && next.pendingSegmentIds.length === previous.pendingSegmentIds.length + hint.segmentIds.length) {
+      this.#roots.appendTransactionArtifacts(next, hint);
+      return;
+    }
     if (previous !== void 0) {
       const linkedJobs = this.#roots.liveJobTransactionCount(previous.id);
       if (previous.status === "committed") {
@@ -829,15 +845,19 @@ class RecordCore {
   #transactionResources(record, overrides) {
     if (record?.status !== "active")
       return { transactions: 0, blocks: 0, segments: 0, bytes: 0 };
-    let bytes = 0;
-    for (const id of record.pendingBlockIds) {
-      const length = overrides?.get(id) ?? this.#physical.blockByteLength(id);
-      if (length === void 0)
-        throw new Error(`Active transaction references missing block: ${id}`);
-      bytes += length;
-      if (!Number.isSafeInteger(bytes)) {
-        throw new RangeError("Active transaction staged bytes exceed the safe integer range");
+    let bytes = this.#journalBytes.get(record.pendingBlockIds);
+    if (bytes === void 0) {
+      bytes = 0;
+      for (const id of record.pendingBlockIds) {
+        const length = overrides?.get(id) ?? this.#physical.blockByteLength(id);
+        if (length === void 0)
+          throw new Error(`Active transaction references missing block: ${id}`);
+        bytes += length;
+        if (!Number.isSafeInteger(bytes)) {
+          throw new RangeError("Active transaction staged bytes exceed the safe integer range");
+        }
       }
+      this.#journalBytes.set(record.pendingBlockIds, bytes);
     }
     return {
       transactions: 1,
@@ -1943,10 +1963,6 @@ class RecordCore {
     if (replacement.pendingSegmentIds.includes(desired.id)) {
       throw new Error(`Replacement transaction already journals segment: ${desired.id}`);
     }
-    assertTransactionArtifactJournalLimits(replacement.pendingBlockIds, [
-      ...replacement.pendingSegmentIds,
-      desired.id
-    ]);
     for (const id of segmentBlockIds(stored)) {
       const provenance = this.#manifestBlocks.get(id);
       if (provenance !== void 0 && this.#manifestBlockHasReadableVersion(provenance)) {
@@ -2612,9 +2628,29 @@ class RecordCore {
     ]));
     this.#assertTransactionResourceTransition(plan.updated, blockByteLengths);
     this.#replaceSegments(plan.segments);
-    this.#setTransaction(plan.updated, blockByteLengths);
+    this.#transactionAppendHint = {
+      previous: plan.current,
+      blockIds: [...blockByteLengths.keys()],
+      segmentIds: plan.segments.map((segment) => segment.id)
+    };
+    try {
+      this.#setTransaction(plan.updated, blockByteLengths);
+    } finally {
+      this.#transactionAppendHint = void 0;
+    }
+    for (const id of blockByteLengths.keys())
+      plan.journalBlocks.add(id);
+    this.#journalBlockSets.set(plan.updated.pendingBlockIds, plan.journalBlocks);
     return cloneRecord(plan.updated);
   }
+  #journalBlockSet(record) {
+    let set = this.#journalBlockSets.get(record.pendingBlockIds);
+    if (set === void 0) {
+      set = new Set(record.pendingBlockIds);
+      this.#journalBlockSets.set(record.pendingBlockIds, set);
+    }
+    return set;
+  }
   preflightTransactionArtifactStage(input) {
     const plan = this.#planTransactionArtifactStage(input, {});
     this.#assertTransactionResourceTransition(plan.updated, new Map(input.blocks.map((block) => [block.id, block.bytes.byteLength])));
@@ -2627,25 +2663,18 @@ class RecordCore {
     assertGenericTransactionUpdateAllowed(current, { updatedAt: input.updatedAt });
     validateTimestampRuntime(input.updatedAt, "Transaction staging timestamp");
     assertTransactionArtifactBatchLimits(input.blocks, input.segments);
-    const pendingBlockIds = [...current.pendingBlockIds, ...input.blocks.map((block) => block.id)];
-    const pendingSegmentIds = [
-      ...current.pendingSegmentIds,
-      ...input.segments.map((segment) => segment.id)
-    ];
-    assertTransactionArtifactJournalLimits(pendingBlockIds, pendingSegmentIds);
+    const journalBlocks = this.#journalBlockSet(current);
     const inputBlockIds = /* @__PURE__ */ new Set();
+    let addedBytes = 0;
     for (const block of input.blocks) {
       validateId(block.id);
       validateBlockWriteBytes(block.bytes);
-      if (inputBlockIds.has(block.id) || options.blocksPrevalidated !== true && this.#physical.hasBlock(block.id)) {
+      if (inputBlockIds.has(block.id) || journalBlocks.has(block.id) || options.blocksPrevalidated !== true && this.#physical.hasBlock(block.id)) {
         throw new Error(`Block already exists: ${block.id}`);
       }
       inputBlockIds.add(block.id);
+      addedBytes += options.blockByteLengths?.get(block.id) ?? block.bytes.byteLength;
     }
-    const stagedBlockIds = /* @__PURE__ */ new Set([
-      ...current.pendingBlockIds,
-      ...input.blocks.map((block) => block.id)
-    ]);
     const segmentIds = /* @__PURE__ */ new Set();
     const normalizedSegments = [];
     for (const segment of input.segments) {
@@ -2661,19 +2690,16 @@ class RecordCore {
       if (normalized.commitOrdinal !== expectedCommitOrdinal) {
         throw new TypeError(`Segment ${segment.id} commit ordinal must be ${String(expectedCommitOrdinal)}`);
       }
-      const availableBlockIds = new Set(stagedBlockIds);
+      const availableBlockIds = /* @__PURE__ */ new Set();
       for (const id of segmentBlockIds(normalized)) {
-        if (this.#isManifestBlockVisible(current.snapshotVersion, id))
+        if (inputBlockIds.has(id) || journalBlocks.has(id) || this.#isManifestBlockVisible(current.snapshotVersion, id)) {
           availableBlockIds.add(id);
+        }
       }
       this.#validateStagedSegment(normalized, input.transactionId, availableBlockIds);
       normalizedSegments.push(normalized);
     }
-    const update = {
-      pendingBlockIds,
-      pendingSegmentIds,
-      updatedAt: input.updatedAt
-    };
+    let pendingTableNextRowId;
     if (current.pendingTable !== void 0) {
       let nextRowId = current.pendingTableNextRowId;
       if (nextRowId === void 0)
@@ -2687,13 +2713,17 @@ class RecordCore {
         }
         nextRowId = segment.rowIdEndExclusive;
       }
-      update.pendingTableNextRowId = nextRowId;
+      pendingTableNextRowId = nextRowId;
     }
-    assertGenericTransactionUpdateAllowed(current, update);
-    const updated = updateTransactionRecord(current, update);
-    this.#assertPendingArtifactsAvailable(current, true, true);
+    const updated = appendTransactionJournal(current, {
+      blockIds: input.blocks.map((block) => block.id),
+      segmentIds: normalizedSegments.map((segment) => segment.id),
+      updatedAt: input.updatedAt,
+      ...pendingTableNextRowId === void 0 ? {} : { pendingTableNextRowId }
+    });
+    this.#journalBytes.set(updated.pendingBlockIds, this.#transactionResources(current, options.blockByteLengths).bytes + addedBytes);
     this.#segmentUsageAfter(normalizedSegments);
-    return { updated, segments: normalizedSegments };
+    return { updated, segments: normalizedSegments, journalBlocks, current };
   }
   rollbackTransactionArtifacts(input) {
     const current = this.#transactions.get(input.transactionId);
@@ -2878,7 +2908,6 @@ class RecordCore {
     }
     const pendingBlockIds = [...base.pendingBlockIds, ...blockIds];
     const pendingSegmentIds = [...base.pendingSegmentIds, ...segments.keys()];
-    assertTransactionArtifactJournalLimits(pendingBlockIds, pendingSegmentIds);
     let segmentIndex = 0;
     for (const segment of segments.values()) {
       const expectedCommitOrdinal = base.pendingSegmentIds.length + segmentIndex;

package/dist/storage/toolkit/wal.js

@@ -79,6 +79,8 @@ function* iterateWalFrames(handle) {
   while (offset + FRAME_HEADER_BYTES <= size) {
     readFully(handle, header, offset, "reading a WAL frame header for recovery");
     if (headerView.getUint32(0, true) !== FRAME_MAGIC) {
+      if (isZeroFilled(handle, offset, size))
+        break;
       throw new Error(`WAL frame marker mismatch at offset ${String(offset)}`);
     }
     const length = headerView.getUint32(4, true);
@@ -92,12 +94,26 @@ function* iterateWalFrames(handle) {
     const payloadBytes = new Uint8Array(length);
     readFully(handle, payloadBytes, offset + FRAME_HEADER_BYTES, "reading a WAL frame payload for recovery");
     if (crc32(payloadBytes) !== checksum) {
+      if (payloadBytes.every((byte) => byte === 0) && isZeroFilled(handle, end, size))
+        break;
       throw new Error(`WAL frame checksum mismatch at offset ${String(offset)}`);
     }
     yield { payload: decodeRecordJson(payloadBytes), frameEnd: end };
     offset = end;
   }
 }
+function isZeroFilled(handle, offset, size) {
+  const chunk = new Uint8Array(Math.min(64 * 1024, Math.max(0, size - offset)));
+  for (let at = offset; at < size; at += chunk.byteLength) {
+    const length = Math.min(chunk.byteLength, size - at);
+    const window = length === chunk.byteLength ? chunk : chunk.subarray(0, length);
+    readFully(handle, window, at, "reading a WAL tail for recovery");
+    for (let index = 0; index < length; index += 1)
+      if (window[index] !== 0)
+        return false;
+  }
+  return true;
+}
 export {
   MAX_WAL_FRAME_BYTES,
   WalWriter,

package/dist/storage/toolkit/wire.d.ts

@@ -9,7 +9,7 @@
  * can produce that object naturally — keys are ids and column names, values are JSON scalars —
  * and the reviver only converts an object whose sole key is `$n`.
  */
-export declare const LOG_FORMAT_VERSION = 5;
+export declare const LOG_FORMAT_VERSION = 6;
 export declare function encodeRecordJson(value: unknown): Uint8Array;
 export declare function decodeRecordJson(bytes: Uint8Array): unknown;
 /** Immutable artifact payloads (full-text base chunks) inside extents. */

package/dist/storage/toolkit/wire.js

@@ -1,6 +1,6 @@
 import { crc32 } from "../../block-format/index.js";
 import { MAX_ROW_ID_EXCLUSIVE_END, StorageFormatVersionError } from "../types.js";
-const LOG_FORMAT_VERSION = 5;
+const LOG_FORMAT_VERSION = 6;
 const textEncoder = new TextEncoder();
 const textDecoder = new TextDecoder("utf-8", { fatal: true });
 function encodeRecordJson(value) {
@@ -58,15 +58,15 @@ function decodeEnvelope(magic, bytes) {
   }
   const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
   const version = view.getUint32(8, true);
-  if (version !== LOG_FORMAT_VERSION) {
-    throw new StorageFormatVersionError("opfs", `envelope/${magic}`, version, LOG_FORMAT_VERSION, version < LOG_FORMAT_VERSION ? "older" : "newer");
-  }
   const payloadLength = view.getUint32(12, true);
   if (bytes.byteLength !== ENVELOPE_HEADER_BYTES + payloadLength)
     return void 0;
   const payload = bytes.subarray(ENVELOPE_HEADER_BYTES, ENVELOPE_HEADER_BYTES + payloadLength);
   if (crc32(payload) !== view.getUint32(16, true))
     return void 0;
+  if (version !== LOG_FORMAT_VERSION) {
+    throw new StorageFormatVersionError("opfs", `envelope/${magic}`, version, LOG_FORMAT_VERSION, version < LOG_FORMAT_VERSION ? "older" : "newer");
+  }
   return payload;
 }
 const CHUNK_MAGIC = "MNWCHNK1";

package/dist/storage/types.d.ts

@@ -480,8 +480,8 @@ export declare const MAX_ACCELERATOR_BUILD_STAGED_BYTES_TOTAL: number;
 export declare const MAX_ACCELERATOR_BUILD_STAGED_ENTRIES_TOTAL = 16777216;
 export declare const MAX_ACTIVE_TRANSACTIONS = 4096;
 export declare const MAX_GLOBAL_STAGED_ARTIFACT_BYTES: number;
-export declare const MAX_GLOBAL_STAGED_BLOCKS = 65536;
-export declare const MAX_GLOBAL_STAGED_SEGMENTS = 65536;
+export declare const MAX_GLOBAL_STAGED_BLOCKS = 1048576;
+export declare const MAX_GLOBAL_STAGED_SEGMENTS = 1048576;
 /** Catalog enumeration remains bounded even for cold public inspection APIs. */
 export declare const MAX_CATALOG_RECORDS = 4096;
 /** Total canonical UTF-8 record-wire bytes retained by the durable catalog. */
@@ -502,11 +502,11 @@ export declare const MAX_PINNED_RETIRED_BYTES: number;
 export declare const MAX_RETIRED_HISTORY_BYTES: number;
 /** A durable resource family reached its fixed corruption/growth safety ceiling. */
 export declare class StorageResourceLimitError extends Error {
-    readonly resource: "lease" | "temp owner" | "temp run" | "temp page" | "temporary run total" | "temporary page total" | "temp owner byte" | "temporary byte" | "compaction job" | "garbage collection job" | "unique-key build" | "full-text build" | "secondary-index build" | "accelerator build byte" | "accelerator build entry" | "transaction" | "staged artifact byte" | "staged block" | "staged segment" | "catalog record" | "catalog byte" | "manifest record" | "manifest byte" | "segment record" | "segment byte" | "terminal transaction" | "terminal compaction job" | "completed garbage collection job" | "pinned manifest version lag" | "pinned retired block" | "pinned retired byte" | "snapshot accelerator byte" | "snapshot accelerator entry" | "retired history byte";
+    readonly resource: "lease" | "temp owner" | "temp run" | "temp page" | "temporary run total" | "temporary page total" | "temp owner byte" | "temporary byte" | "compaction job" | "garbage collection job" | "unique-key build" | "full-text build" | "secondary-index build" | "accelerator build byte" | "accelerator build entry" | "transaction" | "staged artifact byte" | "staged block" | "staged segment" | "catalog record" | "catalog byte" | "manifest record" | "manifest byte" | "segment record" | "segment byte" | "terminal transaction" | "terminal compaction job" | "completed garbage collection job" | "pinned manifest version lag" | "pinned retired block" | "pinned retired byte" | "snapshot accelerator byte" | "snapshot accelerator entry" | "retired history byte" | "checkpoint byte";
     readonly count: number;
     readonly limit: number;
     readonly name = "StorageResourceLimitError";
-    constructor(resource: "lease" | "temp owner" | "temp run" | "temp page" | "temporary run total" | "temporary page total" | "temp owner byte" | "temporary byte" | "compaction job" | "garbage collection job" | "unique-key build" | "full-text build" | "secondary-index build" | "accelerator build byte" | "accelerator build entry" | "transaction" | "staged artifact byte" | "staged block" | "staged segment" | "catalog record" | "catalog byte" | "manifest record" | "manifest byte" | "segment record" | "segment byte" | "terminal transaction" | "terminal compaction job" | "completed garbage collection job" | "pinned manifest version lag" | "pinned retired block" | "pinned retired byte" | "snapshot accelerator byte" | "snapshot accelerator entry" | "retired history byte", count: number, limit: number);
+    constructor(resource: "lease" | "temp owner" | "temp run" | "temp page" | "temporary run total" | "temporary page total" | "temp owner byte" | "temporary byte" | "compaction job" | "garbage collection job" | "unique-key build" | "full-text build" | "secondary-index build" | "accelerator build byte" | "accelerator build entry" | "transaction" | "staged artifact byte" | "staged block" | "staged segment" | "catalog record" | "catalog byte" | "manifest record" | "manifest byte" | "segment record" | "segment byte" | "terminal transaction" | "terminal compaction job" | "completed garbage collection job" | "pinned manifest version lag" | "pinned retired block" | "pinned retired byte" | "snapshot accelerator byte" | "snapshot accelerator entry" | "retired history byte" | "checkpoint byte", count: number, limit: number);
 }
 export interface LeaseRecord {
     id: string;
@@ -1043,13 +1043,8 @@ export declare const MAX_TRANSACTION_STAGE_SEGMENTS = 64;
  * maximum-size physical block; callers split collections of smaller blocks into bounded calls.
  */
 export declare const MAX_TRANSACTION_STAGE_BYTES: number;
-/** Durable journal ceilings prevent a forgotten or hostile transaction growing without bound. */
-export declare const MAX_TRANSACTION_PENDING_BLOCKS = 4096;
-export declare const MAX_TRANSACTION_PENDING_SEGMENTS = 4096;
 /** Storage-boundary preflight shared by staging and single-shot write implementations. */
 export declare function assertTransactionArtifactBatchLimits(blocks: readonly BlockWrite[], segments: readonly SegmentRecord[]): void;
-/** Preflight for the complete persisted journal after a bounded staging operation. */
-export declare function assertTransactionArtifactJournalLimits(pendingBlockIds: readonly string[], pendingSegmentIds: readonly string[]): void;
 /**
  * Atomically rewinds one active transaction's artifact journal to an earlier set and removes
  * exactly the artifacts that are no longer reachable. Journals are canonically sorted, so an
@@ -1351,11 +1346,26 @@ export declare class StorageCorruptionError extends Error {
     readonly name = "StorageCorruptionError";
     constructor(backend: string, location: string, message: string);
 }
+/**
+ * The base of every error that means "the operation may have happened": the reply was lost,
+ * not the request. Nothing that extends it may be retried blindly — reconcile a stable id or
+ * revision first. `instanceof` survives the worker and follower hops.
+ */
+export declare class UnknownOutcomeError extends Error {
+    readonly name: string;
+}
+/**
+ * The base of every error that means "this connection is finished": every later call on it
+ * fails the same way, and the remedy is a new connection (`client.reopen()`), not a retry.
+ */
+export declare class ConnectionLostError extends Error {
+    readonly name: string;
+}
 /**
  * A remote OPFS leader may have committed a mutation whose acknowledgement was lost.
  * Reconcile stable identities or revisions before retrying the named operation.
  */
-export declare class OpfsUncertainOutcomeError extends Error {
+export declare class OpfsUncertainOutcomeError extends UnknownOutcomeError {
     readonly method: string;
     readonly name = "OpfsUncertainOutcomeError";
     constructor(method: string);
@@ -2448,6 +2458,17 @@ export declare function createManifest(input: CreateManifestInput): Manifest;
 /** Strictly clones the one canonical v1 segment shape. */
 export declare function normalizeSegmentRecord(record: SegmentRecord): SegmentRecord;
 export declare function updateTransactionRecord(record: TransactionRecord, update: TransactionRecordUpdate): TransactionRecord;
+/**
+ * Appends artifacts to a transaction's journal without re-validating the journal it already
+ * holds. The caller proves the additions are new; this checks only that they are well-formed and
+ * distinct among themselves, so one staging call costs what it stages, not what came before.
+ */
+export declare function appendTransactionJournal(record: TransactionRecord, additions: {
+    blockIds: readonly string[];
+    segmentIds: readonly string[];
+    updatedAt: string;
+    pendingTableNextRowId?: bigint;
+}): TransactionRecord;
 export declare function createGarbageCollectionJobRecord(input: CreateGarbageCollectionJobInput): GarbageCollectionJobRecord;
 export declare function updateGarbageCollectionPlanningRecord(record: GarbageCollectionJobRecord, input: UpdateGarbageCollectionPlanningInput): GarbageCollectionJobRecord;
 export declare function normalizeGarbageCollectionJobRecord(record: GarbageCollectionJobRecord): GarbageCollectionJobRecord;

package/dist/storage/types.js

@@ -553,8 +553,8 @@ const MAX_ACCELERATOR_BUILD_STAGED_BYTES_TOTAL = 1024 * 1024 * 1024;
 const MAX_ACCELERATOR_BUILD_STAGED_ENTRIES_TOTAL = 16777216;
 const MAX_ACTIVE_TRANSACTIONS = 4096;
 const MAX_GLOBAL_STAGED_ARTIFACT_BYTES = 512 * 1024 * 1024;
-const MAX_GLOBAL_STAGED_BLOCKS = 65536;
-const MAX_GLOBAL_STAGED_SEGMENTS = 65536;
+const MAX_GLOBAL_STAGED_BLOCKS = 1048576;
+const MAX_GLOBAL_STAGED_SEGMENTS = 1048576;
 const MAX_CATALOG_RECORDS = 4096;
 const MAX_CATALOG_RETAINED_BYTES = 64 * 1024 * 1024;
 const MAX_MANIFEST_RECORDS = 65536;
@@ -874,8 +874,6 @@ class LeaseOwnerConflictError extends Error {
 const MAX_TRANSACTION_STAGE_BLOCKS = 64;
 const MAX_TRANSACTION_STAGE_SEGMENTS = 64;
 const MAX_TRANSACTION_STAGE_BYTES = MAX_STORED_BLOCK_BYTE_LENGTH;
-const MAX_TRANSACTION_PENDING_BLOCKS = 4096;
-const MAX_TRANSACTION_PENDING_SEGMENTS = 4096;
 function assertTransactionArtifactBatchLimits(blocks, segments) {
   if (blocks.length > MAX_TRANSACTION_STAGE_BLOCKS) {
     throw new RangeError(`Transaction artifact batch exceeds ${String(MAX_TRANSACTION_STAGE_BLOCKS)} blocks`);
@@ -894,14 +892,6 @@ function assertTransactionArtifactBatchLimits(blocks, segments) {
     }
   }
 }
-function assertTransactionArtifactJournalLimits(pendingBlockIds, pendingSegmentIds) {
-  if (pendingBlockIds.length > MAX_TRANSACTION_PENDING_BLOCKS) {
-    throw new RangeError(`Transaction journal exceeds ${String(MAX_TRANSACTION_PENDING_BLOCKS)} pending blocks`);
-  }
-  if (pendingSegmentIds.length > MAX_TRANSACTION_PENDING_SEGMENTS) {
-    throw new RangeError(`Transaction journal exceeds ${String(MAX_TRANSACTION_PENDING_SEGMENTS)} pending segments`);
-  }
-}
 const MAX_SNAPSHOT_SESSION_TTL_MS = 60 * 60 * 1e3;
 const SNAPSHOT_FRAME_KINDS = [
   "catalog-page",
@@ -997,7 +987,13 @@ class StorageCorruptionError extends Error {
     this.location = location;
   }
 }
-class OpfsUncertainOutcomeError extends Error {
+class UnknownOutcomeError extends Error {
+  name = "UnknownOutcomeError";
+}
+class ConnectionLostError extends Error {
+  name = "ConnectionLostError";
+}
+class OpfsUncertainOutcomeError extends UnknownOutcomeError {
   method;
   name = "OpfsUncertainOutcomeError";
   constructor(method) {
@@ -1641,6 +1637,21 @@ function updateTransactionRecord(record, update) {
   }
   return updated;
 }
+function appendTransactionJournal(record, additions) {
+  if (record.status !== "active") {
+    throw new TypeError(`Only active transactions can be updated; found ${record.status}`);
+  }
+  const blockIds = orderedUniqueIds(additions.blockIds, "Transaction pending block ID");
+  const segmentIds = orderedUniqueIds(additions.segmentIds, "Transaction pending segment ID");
+  return {
+    ...record,
+    pendingBlockIds: blockIds.length === 0 ? record.pendingBlockIds : [...record.pendingBlockIds, ...blockIds],
+    pendingSegmentIds: segmentIds.length === 0 ? record.pendingSegmentIds : [...record.pendingSegmentIds, ...segmentIds],
+    ...additions.pendingTableNextRowId === void 0 ? {} : { pendingTableNextRowId: additions.pendingTableNextRowId },
+    updatedAt: additions.updatedAt,
+    revision: safeSum([record.revision, 1], "Transaction revision")
+  };
+}
 function createGarbageCollectionJobRecord(input) {
   const candidateManifestVersions = uniqueWholeNumbers(input.candidateManifestVersions, "Garbage collection candidate manifest version");
   const candidateSegmentIds = uniqueIds(input.candidateSegmentIds, "Garbage collection candidate segment ID", true);
@@ -2950,6 +2961,7 @@ export {
   BlockReadBatchTooLargeError,
   CompactionBacklogError,
   CompactionJobConflictError,
+  ConnectionLostError,
   GarbageCollectionJobConflictError,
   IndexedDbSchemaUpgradeBlockedError,
   LeaseConflictError,
@@ -3033,8 +3045,6 @@ export {
   MAX_TERMINAL_TRANSACTION_RECORDS,
   MAX_TRANSACTION_COMMIT_DELTA_BYTES,
   MAX_TRANSACTION_COMMIT_DELTA_ENTRIES,
-  MAX_TRANSACTION_PENDING_BLOCKS,
-  MAX_TRANSACTION_PENDING_SEGMENTS,
   MAX_TRANSACTION_STAGE_BLOCKS,
   MAX_TRANSACTION_STAGE_BYTES,
   MAX_TRANSACTION_STAGE_SEGMENTS,
@@ -3062,15 +3072,16 @@ export {
   UniqueIndexCoverageError,
   UniqueKeyBuildConflictError,
   UniqueKeyConflictError,
+  UnknownOutcomeError,
   WriteConflictError,
   activePostingStorageColumnIds,
   advanceGarbageCollectionJobRecord,
+  appendTransactionJournal,
   assertCompactionOutputProvenance,
   assertSnapshotImportAcceleratorUsage,
   assertStorageBulkReadItems,
   assertTempRunPageBatchLimits,
   assertTransactionArtifactBatchLimits,
-  assertTransactionArtifactJournalLimits,
   boundedMaintenanceBatchItems,
   canonicalManifestChangedTableIds,
   catalogRecordRetainedBytes,

package/dist/testing/opfs-shim.js

@@ -181,6 +181,18 @@ class ShimDirectoryHandle {
     return this.entries();
   }
 }
+function grownFileBytes(bytes, length) {
+  const owned = bytes.byteOffset === 0 && bytes.buffer instanceof ArrayBuffer;
+  const capacity = owned ? bytes.buffer.byteLength : bytes.byteLength;
+  if (owned && length <= capacity) {
+    const grown = new Uint8Array(bytes.buffer, 0, length);
+    grown.fill(0, bytes.byteLength);
+    return grown;
+  }
+  const backing = new Uint8Array(Math.max(length, capacity * 2, 4096));
+  backing.set(bytes);
+  return new Uint8Array(backing.buffer, 0, length);
+}
 function assertSubtreeUnlocked(node, name) {
   for (const child of node.children.values()) {
     if (child.kind === "file") {
@@ -262,9 +274,7 @@ class ShimSyncAccessHandle {
     const source = requested.subarray(0, limit);
     const end = at + source.byteLength;
     if (source.byteLength > 0 && end > this.#node.bytes.byteLength) {
-      const grown = new Uint8Array(end);
-      grown.set(this.#node.bytes);
-      this.#node.bytes = grown;
+      this.#node.bytes = grownFileBytes(this.#node.bytes, end);
     }
     this.#node.bytes.set(source, at);
     return source.byteLength;
@@ -276,9 +286,7 @@ class ShimSyncAccessHandle {
       this.#node.bytes = this.#node.bytes.slice(0, size);
       return;
     }
-    const grown = new Uint8Array(size);
-    grown.set(this.#node.bytes);
-    this.#node.bytes = grown;
+    this.#node.bytes = grownFileBytes(this.#node.bytes, size);
   }
   flush() {
     this.#assertOpen();

package/dist/transactions/index.d.ts

@@ -112,6 +112,18 @@ export declare class DatabaseTransaction {
     get snapshotVersion(): number | null;
     get pendingBlockIds(): string[];
     get pendingSegmentIds(): string[];
+    /** Whether the journal, persisted or process-local, holds the block. */
+    hasPendingBlock(id: string): boolean;
+    /**
+     * Every segment this transaction has staged, persisted or process-local, as the records it
+     * staged them with. One shared array, rebuilt only when the set changes: a scope reads it on
+     * every statement, and copying a long journal's records each time would cost more than the
+     * read. Callers must not mutate it.
+     */
+    get stagedSegments(): readonly SegmentRecord[];
+    /** Journal sizes without materializing the id lists. */
+    get pendingBlockCount(): number;
+    get pendingSegmentCount(): number;
     /** Process-local segments retained for a bounded single-shot commit. */
     get deferredSegments(): SegmentRecord[];
     get pendingTableNextRowId(): bigint | undefined;
@@ -133,6 +145,13 @@ export declare class DatabaseTransaction {
     get compactionSourceBlockIds(): string[];
     /** Extends durable ownership; scope owners call this while user code is legitimately waiting. */
     renew(): Promise<void>;
+    /**
+     * Renews the lease and record only when a third of their lifetime has gone: an O(1) deadline
+     * check otherwise. A scope that buffers statement after statement stages nothing, so nothing
+     * renews inline, and a loop that never yields to the event loop never lets the heartbeat
+     * timer fire either — the buffered path calls this per statement instead.
+     */
+    renewIfDue(): Promise<void>;
     /**
      * Counts every registration this transaction carries: staged blocks and segments, unique-key
      * entries, full-text entries, and supersessions. A caller that fails part-way through a