@nodii/telemetry 0.13.0 → 0.14.1

package/dist/worker/checkpoint-store.d.ts

@@ -0,0 +1,66 @@
+import type { SqlExecutor } from "./tx.js";
+/** Default table name for the generalized checkpoint cursor. */
+export declare const DEFAULT_CHECKPOINT_TABLE = "worker_checkpoint";
+/** The durable checkpoint a worker resumes from. */
+export interface Checkpoint {
+    subscription: string;
+    /** Redis-Streams id of the last event committed, or null if none yet. */
+    lastStreamId: string | null;
+    /** Optional LWW entity_version HWM (per D402 "+ optional"); null when unused. */
+    highWaterEntityVersion: bigint | null;
+    /** Count of events committed against this subscription. */
+    consumedCount: bigint;
+}
+/** The cursor position to advance to inside the apply tx. */
+export interface CheckpointAdvance {
+    subscription: string;
+    /** The Redis-Streams id of the event being committed in this apply tx. */
+    lastStreamId: string;
+    /**
+     * Optional LWW entity_version high-water-mark. When provided the cursor only
+     * advances `high_water_entity_version` MONOTONICALLY (GREATEST of old/new) so
+     * an out-of-order replay cannot regress it. Omit when the subscription
+     * doesn't track an entity-version HWM.
+     */
+    highWaterEntityVersion?: bigint | null;
+    /** How much to bump `consumed_count` by (default 1). */
+    incrementBy?: number;
+}
+/** Idempotent DDL to create the generalized checkpoint table. */
+export declare function checkpointTableDDL(table?: string): string;
+/**
+ * Durable HWM cursor store. ONE instance per subscription family (or share one
+ * across subscriptions — the `subscription` key disambiguates). The
+ * `advance(...)` write joins the caller's apply transaction via the injected
+ * `tx`; the store has NO pool of its own and cannot commit independently.
+ */
+export declare class CheckpointStore {
+    readonly table: string;
+    private readonly upsertSql;
+    private readonly selectSql;
+    constructor(opts?: {
+        table?: string;
+    });
+    /**
+     * Read the durable checkpoint for a subscription, or `null` if none exists
+     * yet (cold start → the worker bootstraps from the snapshot per
+     * 09-replication § 7, then stitches to live from `lastStreamId`).
+     *
+     * `tx` may be a transaction handle OR a pooled connection — a read does not
+     * need to join the apply tx, but accepting the same seam keeps the API
+     * uniform and lets the caller read its OWN uncommitted advance inside a tx if
+     * it wants to.
+     */
+    get(subscription: string, tx: SqlExecutor): Promise<Checkpoint | null>;
+    /**
+     * Advance the durable cursor INSIDE the caller's apply transaction. MUST be
+     * called on the SAME `tx` the caller runs its projection upsert + dedupe
+     * record on, so cursor + projection + dedupe commit together-or-none. This is
+     * the atomic-in-apply-tx guarantee D402 pins.
+     *
+     * @param adv      the new cursor position (the event id being committed).
+     * @param tx       the caller's transaction handle (NOT a fresh pool conn).
+     */
+    advance(adv: CheckpointAdvance, tx: SqlExecutor): Promise<void>;
+}
+//# sourceMappingURL=checkpoint-store.d.ts.map

package/dist/worker/checkpoint-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkpoint-store.d.ts","sourceRoot":"","sources":["../../src/worker/checkpoint-store.ts"],"names":[],"mappings":"AA6BA,OAAO,KAAK,EAAE,WAAW,EAAU,MAAM,SAAS,CAAC;AAYnD,gEAAgE;AAChE,eAAO,MAAM,wBAAwB,sBAAsB,CAAC;AAE5D,oDAAoD;AACpD,MAAM,WAAW,UAAU;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,yEAAyE;IACzE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,iFAAiF;IACjF,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,2DAA2D;IAC3D,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,6DAA6D;AAC7D,MAAM,WAAW,iBAAiB;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,0EAA0E;IAC1E,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,sBAAsB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,wDAAwD;IACxD,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,iEAAiE;AACjE,wBAAgB,kBAAkB,CAAC,KAAK,SAA2B,GAAG,MAAM,CAS3E;AAcD;;;;;GAKG;AACH,qBAAa,eAAe;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;gBAEvB,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO;IAsBzC;;;;;;;;;OASG;IACG,GAAG,CAAC,YAAY,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAY5E;;;;;;;;OAQG;IACG,OAAO,CAAC,GAAG,EAAE,iBAAiB,EAAE,EAAE,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;CActE"}

package/dist/worker/checkpoint-store.js

@@ -0,0 +1,131 @@
+// D402 — CheckpointStore: the durable high-water-mark (HWM) cursor primitive.
+//
+// D402 (LOCKED):
+//   "CheckpointStore (HWM cursor) — durable `last_stream_id` per subscription;
+//    advanced ATOMICALLY inside the apply transaction (cursor + projection
+//    upsert + dedupe commit together or none); snapshot→live 'stitch' per
+//    09-replication-doctrine § 7."
+//
+// This GENERALIZES the two hand-rolled cursors that exist today (the task's
+// instruction — "generalize, don't duplicate the table"):
+//   - replica-consumer's `replication_cursor` keyed by `source_stream`
+//     (ts/replica-consumer/src/sql-builders.ts CURSOR_UPSERT_SQL).
+//   - outbox-dispatcher's in-memory `HwmTracker` (ts/outbox-dispatcher/src/hwm.ts).
+//
+// THE LOAD-BEARING CORRECTNESS PROPERTY — atomic-in-apply-tx:
+//   `advance(...)` runs on a `tx` handle the CALLER owns. The store NEVER opens
+//   its own connection for the cursor write, so it physically cannot commit the
+//   cursor independently of the projection. The caller wraps projection upsert +
+//   `dedupe.record(...)` + `checkpoint.advance(...)` in ONE transaction; a
+//   failure anywhere rolls back ALL THREE (cursor does NOT advance past an
+//   un-applied event → no silent gap, no double-apply on retry).
+//
+// Table shape (generalized `replication_cursor`, keyed by `subscription`):
+//   subscription            TEXT PRIMARY KEY   -- the per-subscription key
+//   last_stream_id          TEXT NOT NULL      -- Redis-Streams id of last applied
+//   high_water_entity_version BIGINT           -- optional LWW pointer (nullable)
+//   consumed_count          BIGINT NOT NULL DEFAULT 0
+//   updated_at              TIMESTAMPTZ NOT NULL DEFAULT now()
+/** Strict SQL identifier whitelist (mirrors replica-consumer's quoteIdent). */
+const IDENT_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
+function quoteIdent(name) {
+    if (!IDENT_PATTERN.test(name)) {
+        throw new Error(`invalid SQL identifier: ${name}`);
+    }
+    return `"${name}"`;
+}
+/** Default table name for the generalized checkpoint cursor. */
+export const DEFAULT_CHECKPOINT_TABLE = "worker_checkpoint";
+/** Idempotent DDL to create the generalized checkpoint table. */
+export function checkpointTableDDL(table = DEFAULT_CHECKPOINT_TABLE) {
+    const t = quoteIdent(table);
+    return `CREATE TABLE IF NOT EXISTS ${t} (
+  subscription TEXT PRIMARY KEY,
+  last_stream_id TEXT,
+  high_water_entity_version BIGINT,
+  consumed_count BIGINT NOT NULL DEFAULT 0,
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+)`;
+}
+function toBigintOrNull(v) {
+    if (v === null || v === undefined)
+        return null;
+    return BigInt(v);
+}
+/**
+ * Durable HWM cursor store. ONE instance per subscription family (or share one
+ * across subscriptions — the `subscription` key disambiguates). The
+ * `advance(...)` write joins the caller's apply transaction via the injected
+ * `tx`; the store has NO pool of its own and cannot commit independently.
+ */
+export class CheckpointStore {
+    table;
+    upsertSql;
+    selectSql;
+    constructor(opts = {}) {
+        this.table = opts.table ?? DEFAULT_CHECKPOINT_TABLE;
+        const t = quoteIdent(this.table);
+        // ON CONFLICT upsert: advance the cursor + bump consumed_count.
+        // `high_water_entity_version` advances MONOTONICALLY (GREATEST) so an
+        // out-of-order apply can't regress the LWW HWM; a NULL incoming value keeps
+        // the existing one (COALESCE on EXCLUDED).
+        this.upsertSql = `INSERT INTO ${t}
+  (subscription, last_stream_id, high_water_entity_version, consumed_count, updated_at)
+VALUES ($1, $2, $3, $4, now())
+ON CONFLICT (subscription) DO UPDATE SET
+  last_stream_id = EXCLUDED.last_stream_id,
+  high_water_entity_version = GREATEST(
+    COALESCE(${t}.high_water_entity_version, EXCLUDED.high_water_entity_version, 0),
+    COALESCE(EXCLUDED.high_water_entity_version, ${t}.high_water_entity_version, 0)
+  ),
+  consumed_count = ${t}.consumed_count + EXCLUDED.consumed_count,
+  updated_at = now()`;
+        this.selectSql = `SELECT subscription, last_stream_id, high_water_entity_version, consumed_count
+FROM ${t} WHERE subscription = $1`;
+    }
+    /**
+     * Read the durable checkpoint for a subscription, or `null` if none exists
+     * yet (cold start → the worker bootstraps from the snapshot per
+     * 09-replication § 7, then stitches to live from `lastStreamId`).
+     *
+     * `tx` may be a transaction handle OR a pooled connection — a read does not
+     * need to join the apply tx, but accepting the same seam keeps the API
+     * uniform and lets the caller read its OWN uncommitted advance inside a tx if
+     * it wants to.
+     */
+    async get(subscription, tx) {
+        const res = await tx.query(this.selectSql, [subscription]);
+        const row = res.rows[0];
+        if (!row)
+            return null;
+        return {
+            subscription: row.subscription,
+            lastStreamId: row.last_stream_id,
+            highWaterEntityVersion: toBigintOrNull(row.high_water_entity_version),
+            consumedCount: BigInt(row.consumed_count),
+        };
+    }
+    /**
+     * Advance the durable cursor INSIDE the caller's apply transaction. MUST be
+     * called on the SAME `tx` the caller runs its projection upsert + dedupe
+     * record on, so cursor + projection + dedupe commit together-or-none. This is
+     * the atomic-in-apply-tx guarantee D402 pins.
+     *
+     * @param adv      the new cursor position (the event id being committed).
+     * @param tx       the caller's transaction handle (NOT a fresh pool conn).
+     */
+    async advance(adv, tx) {
+        const inc = adv.incrementBy ?? 1;
+        const hwev = adv.highWaterEntityVersion === undefined ||
+            adv.highWaterEntityVersion === null
+            ? null
+            : adv.highWaterEntityVersion.toString();
+        await tx.query(this.upsertSql, [
+            adv.subscription,
+            adv.lastStreamId,
+            hwev,
+            inc,
+        ]);
+    }
+}
+//# sourceMappingURL=checkpoint-store.js.map

package/dist/worker/checkpoint-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkpoint-store.js","sourceRoot":"","sources":["../../src/worker/checkpoint-store.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,EAAE;AACF,iBAAiB;AACjB,+EAA+E;AAC/E,2EAA2E;AAC3E,0EAA0E;AAC1E,mCAAmC;AACnC,EAAE;AACF,4EAA4E;AAC5E,0DAA0D;AAC1D,uEAAuE;AACvE,mEAAmE;AACnE,oFAAoF;AACpF,EAAE;AACF,8DAA8D;AAC9D,gFAAgF;AAChF,gFAAgF;AAChF,iFAAiF;AACjF,2EAA2E;AAC3E,2EAA2E;AAC3E,iEAAiE;AACjE,EAAE;AACF,2EAA2E;AAC3E,2EAA2E;AAC3E,mFAAmF;AACnF,kFAAkF;AAClF,sDAAsD;AACtD,+DAA+D;AAI/D,+EAA+E;AAC/E,MAAM,aAAa,GAAG,0BAA0B,CAAC;AAEjD,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,EAAE,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,IAAI,IAAI,GAAG,CAAC;AACrB,CAAC;AAED,gEAAgE;AAChE,MAAM,CAAC,MAAM,wBAAwB,GAAG,mBAAmB,CAAC;AA6B5D,iEAAiE;AACjE,MAAM,UAAU,kBAAkB,CAAC,KAAK,GAAG,wBAAwB;IACjE,MAAM,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAC5B,OAAO,8BAA8B,CAAC;;;;;;EAMtC,CAAC;AACH,CAAC;AASD,SAAS,cAAc,CAAC,CAAyB;IAC/C,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC/C,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,eAAe;IACjB,KAAK,CAAS;IACN,SAAS,CAAS;IAClB,SAAS,CAAS;IAEnC,YAAY,OAA2B,EAAE;QACvC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,wBAAwB,CAAC;QACpD,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjC,gEAAgE;QAChE,sEAAsE;QACtE,4EAA4E;QAC5E,2CAA2C;QAC3C,IAAI,CAAC,SAAS,GAAG,eAAe,CAAC;;;;;;eAMtB,CAAC;mDACmC,CAAC;;qBAE/B,CAAC;qBACD,CAAC;QAClB,IAAI,CAAC,SAAS,GAAG;OACd,CAAC,0BAA0B,CAAC;IACjC,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,GAAG,CAAC,YAAoB,EAAE,EAAe;QAC7C,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,KAAK,CAAgB,IAAI,CAAC,SAAS,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;QAC1E,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxB,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,OAAO;YACL,YAAY,EAAE,GAAG,CAAC,YAAY;YAC9B,YAAY,EAAE,GAAG,CAAC,cAAc;YAChC,sBAAsB,EAAE,cAAc,CAAC,GAAG,CAAC,yBAAyB,CAAC;YACrE,aAAa,EAAE,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC;SAC1C,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,OAAO,CAAC,GAAsB,EAAE,EAAe;QACnD,MAAM,GAAG,GAAG,GAAG,CAAC,WAAW,IAAI,CAAC,CAAC;QACjC,MAAM,IAAI,GACR,GAAG,CAAC,sBAAsB,KAAK,SAAS;YACxC,GAAG,CAAC,sBAAsB,KAAK,IAAI;YACjC,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC,QAAQ,EAAE,CAAC;QAC5C,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE;YAC7B,GAAG,CAAC,YAAY;YAChB,GAAG,CAAC,YAAY;YAChB,IAAI;YACJ,GAAG;SACJ,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/worker/dead-letter.d.ts

@@ -0,0 +1,81 @@
+import type { SqlExecutor } from "./tx.js";
+/**
+ * A poison event handed to a dead-letter sink after exhausting in-line retries.
+ * Carries enough to make it REPLAYABLE (mirrors replica-consumer's DLQ envelope
+ * columns) plus the failure cause.
+ */
+export interface DeadLetterItem {
+    /** Source stream the event came off (the subscription / topic stream). */
+    sourceStream: string;
+    /** The outbox topic. */
+    topic: string;
+    /** The event's dedupe id (event_id). */
+    eventId: string;
+    /**
+     * The event payload — possibly containing PII. The redaction hook scrubs this
+     * BEFORE it reaches the sink (fail-closed). The sink NEVER sees raw PII.
+     */
+    payload: Record<string, unknown>;
+    /** Why it was dead-lettered (the terminal error message). */
+    errorMessage: string;
+    /** How many in-line retries were attempted before giving up. */
+    retryCount: number;
+}
+/**
+ * The injected dead-letter sink. The caller provides the impl; there is NO
+ * default. `deadLetter(item)` MUST be durable / loud — a dead item must never
+ * vanish silently.
+ */
+export interface DeadLetterSink {
+    deadLetter(item: DeadLetterItem): Promise<void>;
+}
+/**
+ * A minimal logger seam for the loud sink (structurally satisfied by the
+ * telemetry `logger` or `console`). Only `error` is required.
+ */
+export interface DeadLetterLogger {
+    error(msg: string, fields?: Record<string, unknown>): void;
+}
+export declare function withPiiRedaction(sink: DeadLetterSink, opts?: {
+    extraPaths?: readonly string[];
+}): DeadLetterSink;
+/**
+ * The FAIL-CLOSED-BY-DEFAULT wrapper every worker applies to its injected
+ * DeadLetterSink: redaction runs on every dead item WITHOUT the consumer having
+ * to remember to wrap (D15: the SAFE state must be the default). An
+ * already-wrapped sink is returned as-is (no double-wrap). Used internally by the
+ * worker constructors.
+ */
+export declare function ensurePiiRedaction(sink: DeadLetterSink): DeadLetterSink;
+/**
+ * Reference sink #1: accepts the dead item but logs it LOUDLY (error-level,
+ * with the failure cause + identity, never the raw payload — that's already
+ * redacted by `withPiiRedaction`). It does NOT persist. Useful as an explicit
+ * "I have NO durable DLQ yet but I refuse to silently drop" choice. NEVER
+ * auto-wired — the caller must construct + inject it.
+ */
+export declare class LoudNoopDeadLetterSink implements DeadLetterSink {
+    private readonly logger;
+    constructor(logger: DeadLetterLogger);
+    deadLetter(item: DeadLetterItem): Promise<void>;
+}
+/**
+ * Reference sink #2: persists the dead item into a CONSUMER-OWNED quarantine
+ * table the caller opts into (passing its OWN transaction/pool executor + table
+ * name). This is the SUBSCRIBER's own DLQ — NOT a source-side `outbox_dlq`
+ * (which D401 forbids). The caller controls the executor, so the write joins
+ * whatever transaction the caller chooses (or runs standalone on a pool conn).
+ */
+export declare class TableDeadLetterSink implements DeadLetterSink {
+    readonly table: string;
+    private readonly insertSql;
+    private readonly exec;
+    constructor(opts: {
+        executor: SqlExecutor;
+        table?: string;
+    });
+    /** Idempotent DDL for the consumer-owned quarantine table. */
+    static tableDDL(table?: string): string;
+    deadLetter(item: DeadLetterItem): Promise<void>;
+}
+//# sourceMappingURL=dead-letter.d.ts.map

package/dist/worker/dead-letter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dead-letter.d.ts","sourceRoot":"","sources":["../../src/worker/dead-letter.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAY3C;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,0EAA0E;IAC1E,YAAY,EAAE,MAAM,CAAC;IACrB,wBAAwB;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,wCAAwC;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,6DAA6D;IAC7D,YAAY,EAAE,MAAM,CAAC;IACrB,gEAAgE;IAChE,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,UAAU,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjD;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC5D;AAqBD,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,cAAc,EACpB,IAAI,GAAE;IAAE,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAO,GAC5C,cAAc,CA6BhB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,cAAc,GAAG,cAAc,CAGvE;AAED;;;;;;GAMG;AACH,qBAAa,sBAAuB,YAAW,cAAc;IAC/C,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,gBAAgB;IAE/C,UAAU,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;CAWtD;AAED;;;;;;GAMG;AACH,qBAAa,mBAAoB,YAAW,cAAc;IACxD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAc;gBAEvB,IAAI,EAAE;QAAE,QAAQ,EAAE,WAAW,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;IAS3D,8DAA8D;IAC9D,MAAM,CAAC,QAAQ,CAAC,KAAK,SAAuB,GAAG,MAAM;IAc/C,UAAU,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;CAUtD"}

package/dist/worker/dead-letter.js

@@ -0,0 +1,165 @@
+// D402 — DeadLetter: an INJECTED dead-letter sink with a fail-closed PII
+// redaction hook.
+//
+// D402 (LOCKED):
+//   "DeadLetter — an injected sink (NEVER a default-on source-side `outbox_dlq`
+//    — see D-NEW / D401)."
+//
+// D401 forbids a default-on source-side DLQ table. So this primitive ships:
+//   1. The `DeadLetterSink` INTERFACE — the caller injects the impl.
+//   2. A fail-closed PII redaction wrapper AUTOMATICALLY applied by every worker
+//      constructor (via `ensurePiiRedaction`) to every dead item BEFORE it
+//      reaches the sink — fail-closed BY DEFAULT (D15: the SAFE state is the
+//      default; a consumer cannot leak raw PII by forgetting to wrap). If
+//      redaction throws, the payload is dropped to `[REDACTED]`, never raw. A
+//      consumer who wraps manually with `withPiiRedaction` is not double-wrapped.
+//   3. A couple of REFERENCE impls the caller OPTS INTO:
+//        - `LoudNoopDeadLetterSink` — accepts the item but logs LOUDLY (never a
+//          silent drop). Only constructed when EXPLICITLY injected; never
+//          auto-wired anywhere.
+//        - `TableDeadLetterSink` — persists into a CONSUMER-OWNED table the
+//          caller opts into by passing its own `SqlExecutor` + table name. NOT a
+//          source-side `outbox_dlq`; it is the subscriber's own quarantine.
+//
+// There is NO default sink. A worker constructed without a DeadLetter has no
+// dead-letter behavior; the caller must inject one to enable it. This is the
+// D401/D402 "never a default-on" rule expressed in the type system.
+import { attemptRedactString, redactFields } from "../redaction.js";
+/** Strict SQL identifier whitelist (mirrors replica-consumer's quoteIdent). */
+const IDENT_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
+function quoteIdent(name) {
+    if (!IDENT_PATTERN.test(name)) {
+        throw new Error(`invalid SQL identifier: ${name}`);
+    }
+    return `"${name}"`;
+}
+/**
+ * Wrap a sink with the FAIL-CLOSED PII redaction hook. Both the item's
+ * `payload` AND its `errorMessage` are scrubbed before they reach the wrapped
+ * sink:
+ *   - `payload` runs through the canonical D15 `redactFields` redactor; if it
+ *     THROWS (e.g. a circular/non-serializable value) the whole payload is
+ *     collapsed to `{ redaction: "[REDACTED]" }` rather than passed through raw.
+ *   - `errorMessage` runs through the canonical D15 string redactor
+ *     (`attemptRedactString`) — real apply errors embed PII routinely (a
+ *     postgres `Key (email)=(user@example.com) already exists`, an HTTP error
+ *     carrying a URL+querystring); if the scrub fails it collapses to
+ *     `[REDACTED]`. Fail-closed, never fail-open, on BOTH fields.
+ *
+ * Every worker that injects a DeadLetterSink gets this wrapper applied so a
+ * dead item can never carry plaintext PII into a quarantine table or a log.
+ */
+/** Brand marking a sink as already PII-redacting (so it is not double-wrapped). */
+const PII_REDACTING = Symbol.for("nodii.worker.piiRedactingSink");
+export function withPiiRedaction(sink, opts = {}) {
+    const wrapped = {
+        async deadLetter(item) {
+            let safePayload;
+            try {
+                safePayload = redactFields(item.payload ?? {}, {
+                    extraPaths: opts.extraPaths,
+                });
+            }
+            catch {
+                // Fail CLOSED: redaction failed → drop the payload entirely rather than
+                // risk leaking raw PII into the sink.
+                safePayload = { redaction: "[REDACTED]" };
+            }
+            // Scrub the error string too — a raw apply error routinely quotes PII.
+            // attemptRedactString is itself fail-closed (returns ok:false on throw);
+            // on a non-ok result we drop the whole string to [REDACTED].
+            const scrubbed = attemptRedactString(item.errorMessage ?? "", {
+                extraPaths: opts.extraPaths,
+            });
+            const safeErrorMessage = scrubbed.ok ? scrubbed.redacted : "[REDACTED]";
+            await sink.deadLetter({
+                ...item,
+                payload: safePayload,
+                errorMessage: safeErrorMessage,
+            });
+        },
+    };
+    wrapped[PII_REDACTING] = true;
+    return wrapped;
+}
+/**
+ * The FAIL-CLOSED-BY-DEFAULT wrapper every worker applies to its injected
+ * DeadLetterSink: redaction runs on every dead item WITHOUT the consumer having
+ * to remember to wrap (D15: the SAFE state must be the default). An
+ * already-wrapped sink is returned as-is (no double-wrap). Used internally by the
+ * worker constructors.
+ */
+export function ensurePiiRedaction(sink) {
+    if (sink[PII_REDACTING])
+        return sink;
+    return withPiiRedaction(sink);
+}
+/**
+ * Reference sink #1: accepts the dead item but logs it LOUDLY (error-level,
+ * with the failure cause + identity, never the raw payload — that's already
+ * redacted by `withPiiRedaction`). It does NOT persist. Useful as an explicit
+ * "I have NO durable DLQ yet but I refuse to silently drop" choice. NEVER
+ * auto-wired — the caller must construct + inject it.
+ */
+export class LoudNoopDeadLetterSink {
+    logger;
+    constructor(logger) {
+        this.logger = logger;
+    }
+    async deadLetter(item) {
+        this.logger.error("worker.dead_letter (no durable sink wired)", {
+            source_stream: item.sourceStream,
+            topic: item.topic,
+            event_id: item.eventId,
+            error_message: item.errorMessage,
+            retry_count: item.retryCount,
+            // payload is redacted by withPiiRedaction before reaching here.
+            payload: item.payload,
+        });
+    }
+}
+/**
+ * Reference sink #2: persists the dead item into a CONSUMER-OWNED quarantine
+ * table the caller opts into (passing its OWN transaction/pool executor + table
+ * name). This is the SUBSCRIBER's own DLQ — NOT a source-side `outbox_dlq`
+ * (which D401 forbids). The caller controls the executor, so the write joins
+ * whatever transaction the caller chooses (or runs standalone on a pool conn).
+ */
+export class TableDeadLetterSink {
+    table;
+    insertSql;
+    exec;
+    constructor(opts) {
+        this.exec = opts.executor;
+        this.table = opts.table ?? "worker_dead_letter";
+        const t = quoteIdent(this.table);
+        this.insertSql = `INSERT INTO ${t}
+  (source_stream, topic, event_id, payload, error_message, retry_count, dead_lettered_at)
+VALUES ($1, $2, $3, $4::jsonb, $5, $6, now())`;
+    }
+    /** Idempotent DDL for the consumer-owned quarantine table. */
+    static tableDDL(table = "worker_dead_letter") {
+        const t = quoteIdent(table);
+        return `CREATE TABLE IF NOT EXISTS ${t} (
+  id BIGINT GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
+  source_stream TEXT NOT NULL,
+  topic TEXT NOT NULL,
+  event_id TEXT NOT NULL,
+  payload JSONB NOT NULL,
+  error_message TEXT NOT NULL,
+  retry_count INTEGER NOT NULL DEFAULT 0,
+  dead_lettered_at TIMESTAMPTZ NOT NULL DEFAULT now()
+)`;
+    }
+    async deadLetter(item) {
+        await this.exec.query(this.insertSql, [
+            item.sourceStream,
+            item.topic,
+            item.eventId,
+            JSON.stringify(item.payload ?? {}),
+            item.errorMessage,
+            item.retryCount,
+        ]);
+    }
+}
+//# sourceMappingURL=dead-letter.js.map

package/dist/worker/dead-letter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dead-letter.js","sourceRoot":"","sources":["../../src/worker/dead-letter.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,kBAAkB;AAClB,EAAE;AACF,iBAAiB;AACjB,gFAAgF;AAChF,2BAA2B;AAC3B,EAAE;AACF,4EAA4E;AAC5E,qEAAqE;AACrE,iFAAiF;AACjF,2EAA2E;AAC3E,6EAA6E;AAC7E,0EAA0E;AAC1E,8EAA8E;AAC9E,kFAAkF;AAClF,yDAAyD;AACzD,gFAAgF;AAChF,0EAA0E;AAC1E,gCAAgC;AAChC,4EAA4E;AAC5E,iFAAiF;AACjF,4EAA4E;AAC5E,EAAE;AACF,6EAA6E;AAC7E,6EAA6E;AAC7E,oEAAoE;AAEpE,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAGpE,+EAA+E;AAC/E,MAAM,aAAa,GAAG,0BAA0B,CAAC;AAEjD,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,EAAE,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,IAAI,IAAI,GAAG,CAAC;AACrB,CAAC;AA0CD;;;;;;;;;;;;;;;GAeG;AACH,mFAAmF;AACnF,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;AAElE,MAAM,UAAU,gBAAgB,CAC9B,IAAoB,EACpB,OAA2C,EAAE;IAE7C,MAAM,OAAO,GAAgD;QAC3D,KAAK,CAAC,UAAU,CAAC,IAAoB;YACnC,IAAI,WAAoC,CAAC;YACzC,IAAI,CAAC;gBACH,WAAW,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,EAAE;oBAC7C,UAAU,EAAE,IAAI,CAAC,UAAU;iBAC5B,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,wEAAwE;gBACxE,sCAAsC;gBACtC,WAAW,GAAG,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC;YAC5C,CAAC;YACD,uEAAuE;YACvE,yEAAyE;YACzE,6DAA6D;YAC7D,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,EAAE;gBAC5D,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B,CAAC,CAAC;YACH,MAAM,gBAAgB,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC;YACxE,MAAM,IAAI,CAAC,UAAU,CAAC;gBACpB,GAAG,IAAI;gBACP,OAAO,EAAE,WAAW;gBACpB,YAAY,EAAE,gBAAgB;aAC/B,CAAC,CAAC;QACL,CAAC;KACF,CAAC;IACF,OAAO,CAAC,aAAa,CAAC,GAAG,IAAI,CAAC;IAC9B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAoB;IACrD,IAAK,IAAmC,CAAC,aAAa,CAAC;QAAE,OAAO,IAAI,CAAC;IACrE,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC;AAChC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,sBAAsB;IACJ;IAA7B,YAA6B,MAAwB;QAAxB,WAAM,GAAN,MAAM,CAAkB;IAAG,CAAC;IAEzD,KAAK,CAAC,UAAU,CAAC,IAAoB;QACnC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,4CAA4C,EAAE;YAC9D,aAAa,EAAE,IAAI,CAAC,YAAY;YAChC,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ,EAAE,IAAI,CAAC,OAAO;YACtB,aAAa,EAAE,IAAI,CAAC,YAAY;YAChC,WAAW,EAAE,IAAI,CAAC,UAAU;YAC5B,gEAAgE;YAChE,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC,CAAC;IACL,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,mBAAmB;IACrB,KAAK,CAAS;IACN,SAAS,CAAS;IAClB,IAAI,CAAc;IAEnC,YAAY,IAA+C;QACzD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC1B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,oBAAoB,CAAC;QAChD,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,CAAC,SAAS,GAAG,eAAe,CAAC;;8CAES,CAAC;IAC7C,CAAC;IAED,8DAA8D;IAC9D,MAAM,CAAC,QAAQ,CAAC,KAAK,GAAG,oBAAoB;QAC1C,MAAM,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;QAC5B,OAAO,8BAA8B,CAAC;;;;;;;;;EASxC,CAAC;IACD,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,IAAoB;QACnC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE;YACpC,IAAI,CAAC,YAAY;YACjB,IAAI,CAAC,KAAK;YACV,IAAI,CAAC,OAAO;YACZ,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;YAClC,IAAI,CAAC,YAAY;YACjB,IAAI,CAAC,UAAU;SAChB,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/worker/dedupe-store.d.ts

@@ -0,0 +1,46 @@
+import type { SqlExecutor } from "./tx.js";
+/** The canonical un-prefixed dedupe table (per-service DB). */
+export declare const DEFAULT_CONSUMED_EVENTS_TABLE = "consumed_events";
+/** Default retention horizon for the sweep — 30d per 09-replication § 6. */
+export declare const DEFAULT_RETENTION_DAYS = 30;
+/** Idempotent DDL for the composite-PK dedupe table (D198). */
+export declare function consumedEventsTableDDL(table?: string): string;
+/**
+ * Dedupe over `consumed_events (event_id, topic)` (D198 composite PK). One
+ * instance serves a whole service DB (the table is per-service). All writes
+ * join the caller's apply transaction via the injected `tx`.
+ */
+export declare class DedupeStore {
+    readonly table: string;
+    private readonly selectSql;
+    private readonly insertSql;
+    private readonly sweepSql;
+    constructor(opts?: {
+        table?: string;
+    });
+    /**
+     * Has `(event_id, topic)` already been consumed? Call at step [1] of consume
+     * to skip an already-applied event before any work. Pass the apply `tx` (so
+     * the probe sees the tx's own uncommitted inserts) or a pooled connection for
+     * a cheap pre-tx probe.
+     */
+    seen(eventId: string, topic: string, tx: SqlExecutor): Promise<boolean>;
+    /**
+     * Record `(event_id, topic)` as consumed INSIDE the caller's apply tx — the
+     * SAME `tx` the projection upsert + `checkpoint.advance(...)` run on, so the
+     * dedupe row commits together-or-none with them.
+     *
+     * @returns `true` if this call inserted the row (first time consumed), `false`
+     *          if it was already present (ON CONFLICT DO NOTHING) — lets the
+     *          caller detect a concurrent double-consume.
+     */
+    record(eventId: string, topic: string, tx: SqlExecutor): Promise<boolean>;
+    /**
+     * Retention sweep — DELETE dedupe rows older than `retentionDays` (default
+     * 30d per 09-replication § 6). Run on a SweeperWorker tick. Returns the number
+     * of rows removed (surface as `nodii.worker.swept_total`). `tx` may be a
+     * pooled connection — the sweep is independent of any apply transaction.
+     */
+    sweep(tx: SqlExecutor, retentionDays?: number): Promise<number>;
+}
+//# sourceMappingURL=dedupe-store.d.ts.map

package/dist/worker/dedupe-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dedupe-store.d.ts","sourceRoot":"","sources":["../../src/worker/dedupe-store.ts"],"names":[],"mappings":"AA+BA,OAAO,KAAK,EAAE,WAAW,EAAU,MAAM,SAAS,CAAC;AAYnD,+DAA+D;AAC/D,eAAO,MAAM,6BAA6B,oBAAoB,CAAC;AAE/D,4EAA4E;AAC5E,eAAO,MAAM,sBAAsB,KAAK,CAAC;AAEzC,+DAA+D;AAC/D,wBAAgB,sBAAsB,CACpC,KAAK,SAAgC,GACpC,MAAM,CAQR;AAMD;;;;GAIG;AACH,qBAAa,WAAW;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;gBAEtB,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO;IAczC;;;;;OAKG;IACG,IAAI,CACR,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,WAAW,GACd,OAAO,CAAC,OAAO,CAAC;IAKnB;;;;;;;;OAQG;IACG,MAAM,CACV,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,WAAW,GACd,OAAO,CAAC,OAAO,CAAC;IAKnB;;;;;OAKG;IACG,KAAK,CACT,EAAE,EAAE,WAAW,EACf,aAAa,GAAE,MAA+B,GAC7C,OAAO,CAAC,MAAM,CAAC;CASnB"}

package/dist/worker/dedupe-store.js

@@ -0,0 +1,113 @@
+// D402 — DedupeStore: the at-most-once dedupe primitive over the
+// `consumed_events (event_id, topic)` composite-PK table.
+//
+// D402 (LOCKED):
+//   "DedupeStore — `consumed_events (event_id, topic)` composite-PK dedupe +
+//    retention sweep (default 30d per 09-replication-doctrine § 6)."
+//
+// D198 (LOCKED 2026-06-03) pins the COMPOSITE pk: the same event_id can
+// legitimately recur across topics, so an event_id-only dedupe would wrongly
+// short-circuit the second topic. Keying on `(event_id, topic)` is the
+// cross-topic-correctness fix (see ts/replica-consumer/src/sql-builders.ts
+// DEDUPE_SELECT_SQL / CONSUMED_EVENTS_INSERT_SQL — generalized here, NOT
+// duplicated; same table, same column shape).
+//
+// The `consumed_events` table is intentionally UN-prefixed: each adopting
+// service owns its own database, so the table is already per-service (operator-
+// confirmed; see memory feedback_consumed_events_table).
+//
+// ── Atomic-in-apply-tx (the load-bearing property) ───────────────────────────
+//   `record(...)` runs on the CALLER's `tx` handle, the SAME one the projection
+//   upsert + `checkpoint.advance(...)` run on. The dedupe row is therefore
+//   committed together-or-none with the projection + the cursor: if apply fails
+//   after `record(...)`, the rollback removes the dedupe row too, so the event
+//   is NOT falsely marked consumed (a retry re-processes it). And because the
+//   cursor advance is in the same tx, a committed dedupe row always has a
+//   committed cursor that covers it.
+//
+//   `seen(...)` is the read-side probe at step [1] of the consume sequence:
+//   call it (on the tx, or a pooled conn pre-tx) to skip an already-applied
+//   (event_id, topic) before doing any work.
+/** Strict SQL identifier whitelist (mirrors replica-consumer's quoteIdent). */
+const IDENT_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
+function quoteIdent(name) {
+    if (!IDENT_PATTERN.test(name)) {
+        throw new Error(`invalid SQL identifier: ${name}`);
+    }
+    return `"${name}"`;
+}
+/** The canonical un-prefixed dedupe table (per-service DB). */
+export const DEFAULT_CONSUMED_EVENTS_TABLE = "consumed_events";
+/** Default retention horizon for the sweep — 30d per 09-replication § 6. */
+export const DEFAULT_RETENTION_DAYS = 30;
+/** Idempotent DDL for the composite-PK dedupe table (D198). */
+export function consumedEventsTableDDL(table = DEFAULT_CONSUMED_EVENTS_TABLE) {
+    const t = quoteIdent(table);
+    return `CREATE TABLE IF NOT EXISTS ${t} (
+  event_id TEXT NOT NULL,
+  topic TEXT NOT NULL,
+  consumed_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  PRIMARY KEY (event_id, topic)
+)`;
+}
+/**
+ * Dedupe over `consumed_events (event_id, topic)` (D198 composite PK). One
+ * instance serves a whole service DB (the table is per-service). All writes
+ * join the caller's apply transaction via the injected `tx`.
+ */
+export class DedupeStore {
+    table;
+    selectSql;
+    insertSql;
+    sweepSql;
+    constructor(opts = {}) {
+        this.table = opts.table ?? DEFAULT_CONSUMED_EVENTS_TABLE;
+        const t = quoteIdent(this.table);
+        this.selectSql = `SELECT 1 AS one FROM ${t} WHERE event_id = $1 AND topic = $2 LIMIT 1`;
+        // ON CONFLICT DO NOTHING: a concurrent / replayed insert is a benign no-op
+        // (the row already proves consumption); rowCount distinguishes first-insert
+        // (1) from already-seen (0).
+        this.insertSql = `INSERT INTO ${t} (event_id, topic, consumed_at) VALUES ($1, $2, now())
+ON CONFLICT (event_id, topic) DO NOTHING`;
+        // Retention sweep — parameterized day horizon, cast to an interval. Mirrors
+        // replica-consumer's SWEEP_CONSUMED_EVENTS_SQL.
+        this.sweepSql = `DELETE FROM ${t} WHERE consumed_at < now() - ($1::int || ' days')::interval`;
+    }
+    /**
+     * Has `(event_id, topic)` already been consumed? Call at step [1] of consume
+     * to skip an already-applied event before any work. Pass the apply `tx` (so
+     * the probe sees the tx's own uncommitted inserts) or a pooled connection for
+     * a cheap pre-tx probe.
+     */
+    async seen(eventId, topic, tx) {
+        const res = await tx.query(this.selectSql, [eventId, topic]);
+        return res.rows.length > 0;
+    }
+    /**
+     * Record `(event_id, topic)` as consumed INSIDE the caller's apply tx — the
+     * SAME `tx` the projection upsert + `checkpoint.advance(...)` run on, so the
+     * dedupe row commits together-or-none with them.
+     *
+     * @returns `true` if this call inserted the row (first time consumed), `false`
+     *          if it was already present (ON CONFLICT DO NOTHING) — lets the
+     *          caller detect a concurrent double-consume.
+     */
+    async record(eventId, topic, tx) {
+        const res = await tx.query(this.insertSql, [eventId, topic]);
+        return res.rowCount > 0;
+    }
+    /**
+     * Retention sweep — DELETE dedupe rows older than `retentionDays` (default
+     * 30d per 09-replication § 6). Run on a SweeperWorker tick. Returns the number
+     * of rows removed (surface as `nodii.worker.swept_total`). `tx` may be a
+     * pooled connection — the sweep is independent of any apply transaction.
+     */
+    async sweep(tx, retentionDays = DEFAULT_RETENTION_DAYS) {
+        if (!Number.isInteger(retentionDays) || retentionDays < 0) {
+            throw new Error(`retentionDays must be a non-negative integer, got ${retentionDays}`);
+        }
+        const res = await tx.query(this.sweepSql, [retentionDays]);
+        return res.rowCount;
+    }
+}
+//# sourceMappingURL=dedupe-store.js.map

package/dist/worker/dedupe-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dedupe-store.js","sourceRoot":"","sources":["../../src/worker/dedupe-store.ts"],"names":[],"mappings":"AAAA,iEAAiE;AACjE,0DAA0D;AAC1D,EAAE;AACF,iBAAiB;AACjB,6EAA6E;AAC7E,qEAAqE;AACrE,EAAE;AACF,wEAAwE;AACxE,6EAA6E;AAC7E,uEAAuE;AACvE,2EAA2E;AAC3E,yEAAyE;AACzE,8CAA8C;AAC9C,EAAE;AACF,0EAA0E;AAC1E,gFAAgF;AAChF,yDAAyD;AACzD,EAAE;AACF,gFAAgF;AAChF,gFAAgF;AAChF,2EAA2E;AAC3E,gFAAgF;AAChF,+EAA+E;AAC/E,8EAA8E;AAC9E,0EAA0E;AAC1E,qCAAqC;AACrC,EAAE;AACF,4EAA4E;AAC5E,4EAA4E;AAC5E,6CAA6C;AAI7C,+EAA+E;AAC/E,MAAM,aAAa,GAAG,0BAA0B,CAAC;AAEjD,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,EAAE,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,IAAI,IAAI,GAAG,CAAC;AACrB,CAAC;AAED,+DAA+D;AAC/D,MAAM,CAAC,MAAM,6BAA6B,GAAG,iBAAiB,CAAC;AAE/D,4EAA4E;AAC5E,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAEzC,+DAA+D;AAC/D,MAAM,UAAU,sBAAsB,CACpC,KAAK,GAAG,6BAA6B;IAErC,MAAM,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAC5B,OAAO,8BAA8B,CAAC;;;;;EAKtC,CAAC;AACH,CAAC;AAMD;;;;GAIG;AACH,MAAM,OAAO,WAAW;IACb,KAAK,CAAS;IACN,SAAS,CAAS;IAClB,SAAS,CAAS;IAClB,QAAQ,CAAS;IAElC,YAAY,OAA2B,EAAE;QACvC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,6BAA6B,CAAC;QACzD,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,CAAC,SAAS,GAAG,wBAAwB,CAAC,6CAA6C,CAAC;QACxF,2EAA2E;QAC3E,4EAA4E;QAC5E,6BAA6B;QAC7B,IAAI,CAAC,SAAS,GAAG,eAAe,CAAC;yCACI,CAAC;QACtC,4EAA4E;QAC5E,gDAAgD;QAChD,IAAI,CAAC,QAAQ,GAAG,eAAe,CAAC,6DAA6D,CAAC;IAChG,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,IAAI,CACR,OAAe,EACf,KAAa,EACb,EAAe;QAEf,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,KAAK,CAAU,IAAI,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;QACtE,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7B,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,MAAM,CACV,OAAe,EACf,KAAa,EACb,EAAe;QAEf,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;QAC7D,OAAO,GAAG,CAAC,QAAQ,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,KAAK,CACT,EAAe,EACf,gBAAwB,sBAAsB;QAE9C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CACb,qDAAqD,aAAa,EAAE,CACrE,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC;QAC3D,OAAO,GAAG,CAAC,QAAQ,CAAC;IACtB,CAAC;CACF"}