@quereus/isolation 4.4.1 → 4.6.0

package/README.md

@@ -84,6 +84,30 @@ The isolation layer operates at the **row level**, merging query results from tw
 └─────────────────────────────────────────────────────────┘
 ```
 
+### Reading a pushed index window
+
+When the underlying serves a read through an index seek, the overlay must be narrowed to
+the same window — otherwise a staged row outside it would leak into the answer. The
+overlay is full-scanned (it cannot resolve an index name the underlying minted for its own
+plan), and `IsolatedTable`'s constraint matcher re-applies the pushed window itself. Several
+equality constraints on the *same* column are read as an **IN set**, not as an AND: that is
+how an `IN`-list seek is encoded — one equality per seek value — so an AND reading would
+match nothing and silently drop every staged row.
+
+This holds for a set of values that only exists at run time (`where v in (select …)`,
+which the engine may materialize and push down as a seek) exactly as it does for a literal
+`in (1, 2, 3)`: the pushed window has the same shape either way, and this layer cannot —
+and need not — tell them apart.
+
+One ordering caveat. The **primary-key** merge walks both streams in the primary key's own
+declared order — ascending, or descending for a `primary key (… desc)`. The engine sorts a
+run-time key set into that same order before pushing it, so that path arrives in order. A
+**literal** list does not: `where pk in (3, 1, 2)` is visited in list order, and with rows
+staged in the transaction the merge mis-pairs them — a staged update can surface alongside
+the stale stored row, and a staged delete can reappear. That is tracked as
+`backlog/bug-isolation-multiseek-merge-order`; the secondary-index merge is unaffected
+(it sorts the overlay itself and excludes shadowed rows by primary key).
+
 ## Isolation Level
 
 The guarantee this layer actually provides is closer to **read-committed with
@@ -110,12 +134,15 @@ read-your-own-writes** than to snapshot isolation:
 
 **Lazy overlay creation** — No memory overhead until the first write in a transaction.
 
-**Transparent hook forwarding** — `IsolationModule` is a wrapper, so the engine/planner/lens machinery reaches *it* (the registered module) rather than the underlying. Optional `VirtualTableModule` hooks whose behavior is isolation-transparent are forwarded straight through to the underlying: `getMappingAdvertisements` (decomposition shape), `getBestAccessPlan` (index awareness), the `beginSchemaBatch` / `endSchemaBatch` APPLY SCHEMA batch hooks (single-substrate-commit batching of migration DDL), `assertCatalogObjectPersistable` (the pre-flight veto that lets a persisting module refuse a view / materialized view whose catalog entry it could not durably write — whether a definition is encodable is a property of the definition text, not of the overlay, and without the forward a wrapped store would silently keep dropping such views on reopen), and `getBackingHost` (the materialized-view backing-host capability — assigned in the constructor only when the underlying implements it, so method *presence* mirrors the underlying; backing writes are privileged and bypass the per-connection overlay entirely, making the underlying host's pending state the right surface). Hooks whose underlying value would *misdescribe* the wrapped behavior are intentionally **not** forwarded: `getCapabilities` is augmented with `isolation`/`savepoints` rather than passed through verbatim; `supports` (full-query push-down) is suppressed so the overlay always sees every row to merge; and `concurrencyMode` / `expectedLatencyMs` are derived rather than passed through verbatim: `concurrencyMode` is the weaker of the underlying and overlay modes, capped at `reentrant-reads` (the wrapper's own write path mutates shared overlay-merge state non-atomically, so it is never `fully-reentrant`), while `expectedLatencyMs` forwards the underlying's hint (defaulting to `0` when the underlying declares none).
+**Transparent hook forwarding** — `IsolationModule` is a wrapper, so the engine/planner/lens machinery reaches *it* (the registered module) rather than the underlying. Optional `VirtualTableModule` hooks whose behavior is isolation-transparent are forwarded straight through to the underlying: `getMappingAdvertisements` (decomposition shape), `getBestAccessPlan` (index awareness), the `beginSchemaBatch` / `endSchemaBatch` APPLY SCHEMA batch hooks (single-substrate-commit batching of migration DDL), `onRegister` (the registration-time handoff of the `Database`, which a persisting underlying uses to subscribe to the schema-change notifier before any statement runs — which `Database` a module serves is isolation-transparent, and without the forward a wrapped store would fall back to subscribing at its first table hook and silently drop a view created ahead of that), `assertCatalogObjectPersistable` (the pre-flight veto that lets a persisting module refuse a view / materialized view — or a table a RENAME would rewrite — whose catalog entry it could not durably write; whether a definition is encodable is a property of the definition text, not of the overlay, and without the forward a wrapped store would silently keep dropping such views on reopen. The table arm also needs the underlying module to recognise its OWN tables through this wrapper, since a wrapped table's `vtabModule` is the `IsolationModule`: it does so by matching `underlying`), and `getBackingHost` (the materialized-view backing-host capability — assigned in the constructor only when the underlying implements it, so method *presence* mirrors the underlying; backing writes are privileged and bypass the per-connection overlay entirely, making the underlying host's pending state the right surface). Hooks whose underlying value would *misdescribe* the wrapped behavior are intentionally **not** forwarded: `getCapabilities` is augmented with `isolation`/`savepoints` rather than passed through verbatim; `supports` (full-query push-down) is suppressed so the overlay always sees every row to merge; and `concurrencyMode` / `expectedLatencyMs` are derived rather than passed through verbatim: `concurrencyMode` is the weaker of the underlying and overlay modes, capped at `reentrant-reads` (the wrapper's own write path mutates shared overlay-merge state non-atomically, so it is never `fully-reentrant`), while `expectedLatencyMs` forwards the underlying's hint (defaulting to `0` when the underlying declares none).
 
 **Atomic ALTER (issuer-faithful) + cross-connection poison** — DDL through Quereus is not transaction-scoped and the shared underlying base auto-commits its mutation immediately, so a half-applied ALTER cannot be rolled back. The blast radius is isolation-faithful — an ALTER never depends on another connection's uncommitted data:
 
 - **Issuer's own overlay** — `IsolationModule.alterTable` dry-run **validates the issuing connection's own affected overlay's backfill** (per-row `NOT NULL` checks — for a new `ADD COLUMN ... NOT NULL` and for tightening an existing column with `ALTER COLUMN ... SET NOT NULL` — and the tombstone-present guard) *before* mutating the underlying. A rejection fires while the underlying, the schema catalog, and every overlay are still untouched, so for the issuer the ALTER either fails clean or fully applies — base and catalog never diverge. (The issuer staged both the data and the DDL, so rejecting up front is the least-surprising behavior.)
+- **`ALTER TABLE ... ALTER COLUMN ... SET COLLATE` on a primary-key column** — the change re-keys the table, so two staged rows can land on one new key. A deletion marker sharing its new key with a staged live row is that row's before-image (delete `'A'`, insert `'a'`, then switch to `NOCASE`), so the marker is discarded and the ALTER succeeds; two staged **live** rows on one key are a real duplicate and are refused. A shape the re-keyed overlay cannot physically hold — a savepoint that could restore both a marker and its replacement at one key — is refused as retryable (`BUSY`), the same answer a plain non-isolated table gives. Every refusal is surfaced *before* the shared underlying is touched, so the transaction survives intact.
+- **`ALTER TABLE ... ALTER PRIMARY KEY`** — the one change no overlay can follow: an overlay's staged rows (and its deletion markers) are keyed by the *old* primary key. A connection that has uncommitted changes staged for the table is therefore rejected with `BUSY` (retryable — not `UNSUPPORTED`, which the engine would treat as "fall back to a shadow-table rebuild" and silently lose the staged writes) *before* the underlying is touched — commit or roll back first, then retry. Another connection's overlay holding staged rows is poisoned; one holding nothing is swapped for an empty overlay under the new key. (Both bundled underlyings — `MemoryTableModule` and the store — re-key in place, so these paths arise under either. The refusal above is about the *overlay's* representation, not the underlying's capability.)
 - **Another connection's overlay** — the shared underlying and the catalog change regardless of any *other* connection's uncommitted state. A foreign overlay that *can* migrate is carried forward as usual (a staged `NULL` is backfilled when a usable literal `DEFAULT` exists); one that *cannot* (its staged row can't satisfy the new or newly-`NOT NULL` column) is left in place and marked **poisoned**. Its owning connection then raises a `CONSTRAINT` error the next time it reads (merged), writes, or commits that table, and recovers by rolling back (which discards the overlay and its poison). A committed-snapshot (`committed.<table>`) read bypasses the overlay and keeps working. A layer-invariant violation (e.g. a missing tombstone column, `INTERNAL`) still rethrows loud for everyone rather than poisoning.
+- **`ALTER TABLE ... ADD COLUMN` position** — `SchemaChangeInfo`'s optional `insertAtIndex` names a slot instead of the end (there is no SQL syntax for it; only an in-process module wrapper can set one). A caller-named position is honored in the overlay too, for both the issuer's own overlay and every migrated foreign one; with none supplied, the new column lands ahead of the overlay's own deletion-marker column so that column stays last.
 
 **Configurable overlay module** — Use memory for fast transactions, or persistent storage for large transactions:
 

package/dist/src/alter-migration.d.ts

@@ -0,0 +1,261 @@
+import type { Database, TableSchema, SchemaChangeInfo, Row, SqlValue } from '@quereus/quereus';
+import type { ConnectionOverlayState, Predicate } from './isolation-types.js';
+/**
+ * Carrying a connection's open staging area (its "overlay") forward across an ALTER TABLE.
+ *
+ * When one connection runs ALTER TABLE, the shared underlying table mutates immediately and
+ * irreversibly. Every open overlay therefore has to be judged BEFORE that mutation and then
+ * reshaped to match it, or else marked unusable ("poisoned") for its owning connection. This
+ * module owns that whole subject; `IsolationModule.alterTable` is its only caller and stays
+ * responsible for the surrounding lifecycle — which overlays are in scope, how a failure is
+ * routed (issuer vs foreign), and the ALTER PRIMARY KEY overlay swap.
+ *
+ * The flow, in the order `alterTable` runs it:
+ *
+ * 1. {@link assertColumnNameNotTombstone} — reject a column name that would collide with the
+ *    overlay's private deletion-marker flag, before anything mutates.
+ * 2. {@link deriveAlterMigrationPlan} — precompute every per-change-type constant the later
+ *    passes need, from the PRE-alter schema (so it is valid before the underlying mutates).
+ * 3. {@link validateOverlayMigration} — dry-run one overlay's fallible work without mutating
+ *    it. Runs for the issuer before `underlying.alterTable` (atomic abort) and per foreign
+ *    overlay after it (a data rejection becomes poison, via {@link buildAlterPoisonMessage}).
+ * 4. {@link planPkRekeyMarkerDrops} / {@link applyPkRekeyMarkerDrops} /
+ *    {@link reinsertPkRekeyMarkers} — the primary-key re-key marker handling, which the issuer
+ *    path also needs BEFORE the underlying mutates so the overlay's own `alterSchema` can be
+ *    pre-flighted against the exact state the migrate step will see.
+ * 5. {@link migrateOverlayForward} — reshape one overlay to the post-alter schema, in place.
+ */
+/**
+ * What the ALTER-migration helpers need back from the module that owns the overlays.
+ * `IsolationModule` satisfies it structurally; nothing here reaches for more of the class
+ * than these three members.
+ */
+export interface AlterMigrationHost {
+    /** Name of the extra column every overlay carries as its deletion-marker flag. */
+    readonly tombstoneColumn: string;
+    /** `<base predicate, rescoped to the overlay> AND <tombstone> = 0`. */
+    overlayPredicate(base: Predicate | undefined, baseName: string, overlayName: string): Predicate;
+    /** Case-insensitive "does `schema` declare an index named `indexName`". */
+    schemaHasIndex(schema: TableSchema, indexName: string): boolean;
+}
+/**
+ * Per-ALTER constants for backfilling a freshly added column into staged overlay
+ * rows. Precomputed once per `addColumn` (see `deriveAddColumnBackfill`) so the
+ * per-row loop only branches on tombstone / evaluator / literal.
+ */
+export interface AddColumnBackfillContext {
+    /** The folded literal DEFAULT, or `null` when there is no usable literal default. */
+    foldedDefault: SqlValue;
+    /** Per-row evaluator for a non-foldable `new.<col>` default; absent for a literal default. */
+    evaluator?: (row: Row) => SqlValue | Promise<SqlValue>;
+    /** Whether the new column is NOT NULL (enforced on both the evaluator and folded-default paths). */
+    newColNotNull: boolean;
+    /** New column name, for the NOT NULL error message. */
+    newColName: string;
+    /** Owning table name, for the NOT NULL error message. */
+    tableName: string;
+}
+/**
+ * Per-ALTER constants for an `alter column … set not null` overlay backfill (see
+ * `deriveSetNotNullBackfill`). Precomputed once so the per-row validate/backfill loops only
+ * branch on tombstone / has-default. Present only for a NOT NULL *tightening* (`setNotNull: true`)
+ * with staged overlays to carry forward.
+ *
+ * `alter column … set data type` rides the same derive → validate seam via
+ * {@link SetDataTypeConvertContext}. The two are mutually exclusive: the runtime rejects a
+ * multi-attribute `alter column` before it reaches this module.
+ */
+export interface SetNotNullBackfillContext {
+    /** Zero-based index of the now-NOT-NULL column in the overlay's data columns. */
+    colIndex: number;
+    /** The folded literal DEFAULT used to backfill staged NULLs; meaningful only when `hasDefault`. */
+    foldedDefault: SqlValue;
+    /** Whether a usable literal DEFAULT exists — backfill when true, reject the staged NULL when false. */
+    hasDefault: boolean;
+    /** Column name, for the CONSTRAINT message. */
+    colName: string;
+}
+/**
+ * Per-ALTER constants for an `alter column … set data type` overlay pre-validation (see
+ * {@link deriveSetDataTypeConvert}). Present only when the retype actually rewrites values (the
+ * new physical type differs from the old) and there are staged overlays to judge — a
+ * metadata-only retype leaves every staged value as it stands.
+ *
+ * The conversion itself is done by the overlay module when the retype is forwarded through its
+ * `alterSchema` ({@link forwardAlterColumnToOverlay}); this context exists so
+ * {@link validateOverlayMigration} can prove every staged value convertible FIRST — atomically
+ * for the issuer, and as the poison-vs-forward gate for a foreign overlay.
+ */
+export interface SetDataTypeConvertContext {
+    /** Zero-based index of the retyped column in the overlay's data columns. */
+    colIndex: number;
+    /** Per-value conversion; throws MISMATCH exactly as the underlying's does. */
+    convert: (v: SqlValue) => SqlValue;
+}
+/**
+ * Per-ALTER constants for an `alter column … set collate` that re-keys the PRIMARY KEY (see
+ * {@link derivePkRekey}). Present only when the normalized collation actually changes on a PK
+ * member column and there are staged overlays to carry — a non-PK collate change, or a re-declare
+ * of the column's current collation, re-keys nothing. A retype of a PK column is rejected
+ * upstream, so `setCollation` is the only ALTER COLUMN attribute that re-keys.
+ *
+ * Under the re-keyed primary key, a staged deletion marker and a staged live row that land on
+ * one key are the same logical row's before and after — not two rows — so
+ * {@link validateOverlayMigration} accepts the pair and {@link dropCollapsedPkRekeyMarkers}
+ * discards the marker before the re-key is forwarded to the overlay. Two live rows on one key
+ * stay a real duplicate and are refused. This is the isolation-layer lift of the rule
+ * `TransactionLayer.rekeyPrimaryKey` applies to its own write log one level down: a deletion
+ * whose key an upsert now occupies is dropped.
+ */
+export interface PkRekeyContext {
+    /** Overlay positions of the PRIMARY KEY columns (identical to the base's — the tombstone flag sits after them). */
+    pkIndices: readonly number[];
+    /** Serializes a PK tuple under the POST-change collation — two old keys that serialize alike collapse. */
+    keyOf: (pk: readonly SqlValue[]) => string;
+    /** User-facing table name, for the CONSTRAINT message. */
+    tableName: string;
+}
+/**
+ * Every per-change-type constant one ALTER's overlay migration needs, derived once from the
+ * PRE-alter schema and shared by the validate and migrate passes so the two cannot drift.
+ *
+ * At most one field is ever populated — each is gated on a different change type (or, for the
+ * three `alterColumn` arms, a different attribute, and the runtime admits exactly one attribute
+ * per ALTER COLUMN). Bundled into one object rather than threaded as one parameter per
+ * attribute, which is what the cluster did while it lived on `IsolationModule`.
+ */
+export interface AlterMigrationPlan {
+    addColumn?: AddColumnBackfillContext;
+    setNotNull?: SetNotNullBackfillContext;
+    setDataType?: SetDataTypeConvertContext;
+    pkRekey?: PkRekeyContext;
+}
+/**
+ * Rejects an ADD / RENAME COLUMN that would give a base column the same name as the
+ * overlay's private tombstone flag, BEFORE `underlying.alterTable` runs.
+ *
+ * Every overlay carries one extra column named `AlterMigrationHost.tombstoneColumn`, so a base
+ * column of that name collides with it. Forwarding the change to an open overlay makes the
+ * overlay module raise a duplicate-name `ERROR`, which is not a data condition and so
+ * rethrows out of `IsolationModule.applyInPlaceOverlayChange` — after the underlying has already
+ * (irreversibly) applied. The catalog then keeps the pre-alter column set while the base
+ * holds the new one, and the next write to the table lands values against the wrong
+ * columns. Rejecting up front keeps the atomic-abort guarantee `IsolationModule.alterTable`
+ * documents.
+ *
+ * NOTE: the check is unconditional — not gated on an overlay existing — so the answer
+ * does not depend on whether some connection happens to have a transaction open. That
+ * also stops a table from acquiring the colliding name while idle and hitting
+ * `IsolationModule.createOverlaySchema`'s (silent) duplicate at the next BEGIN. A CREATE TABLE
+ * declaring the name still gets that duplicate — tracked separately.
+ */
+export declare function assertColumnNameNotTombstone(host: AlterMigrationHost, schemaName: string, tableName: string, change: SchemaChangeInfo): void;
+/**
+ * Builds the poison message stamped onto a foreign overlay whose backfill could not
+ * satisfy a cross-connection ALTER (see `IsolationModule.alterTable` tier 3). Names the
+ * schema.table and the offending column so the owning connection's eventual
+ * read/write/commit error is self-explanatory. Poison arises on the addColumn NOT NULL
+ * path (a new NOT-NULL column with no usable default), the `set not null` tightening
+ * path (a staged NULL with no usable default), the `set data type` path (a staged value
+ * that cannot be converted to the new type), and the primary-key `set collate` path (two
+ * staged live rows colliding under the new collation); other change types never reach
+ * here but are handled defensively.
+ */
+export declare function buildAlterPoisonMessage(schemaName: string, tableName: string, change: SchemaChangeInfo): string;
+/**
+ * Precomputes every per-change-type constant this ALTER's overlay migration needs, from the
+ * PRE-alter schema — so the whole plan is valid BEFORE the irreversible `underlying.alterTable`
+ * and the same plan drives the migration after it.
+ *
+ * `toMigrate` is the overlays that will actually be carried forward (issuer-own first). The
+ * attribute contexts are probed from `toMigrate[0]`'s schema, never from a skipped poisoned
+ * overlay whose schema may be a stale pre-alter layout; with no overlays to migrate there is
+ * nothing to backfill, convert or re-key, so those arms stay undefined.
+ */
+export declare function deriveAlterMigrationPlan(change: SchemaChangeInfo, db: Database, tableName: string, toMigrate: readonly [string, ConnectionOverlayState][]): AlterMigrationPlan;
+/**
+ * Dry-runs an overlay's ALTER migration-fallible work without mutating anything,
+ * so the caller can run it for every affected overlay BEFORE the irreversible
+ * `underlying.alterTable` (see `IsolationModule.alterTable`). It exercises the EXACT code
+ * paths the real migration uses — the tombstone-present guard and, for addColumn,
+ * `computeAddColumnValue` per staged row — so a dry-run pass and the subsequent
+ * migrate pass cannot diverge:
+ *
+ * - A clean overlay (`!hasChanges`) stages no rows, so there is nothing to validate.
+ * - A missing tombstone column throws INTERNAL here, before the underlying is touched.
+ * - For addColumn, each staged row runs through {@link computeAddColumnValue}, which owns
+ *   both NOT NULL reject sources and short-circuits tombstone rows; a violation throws
+ *   CONSTRAINT here, atomically. Computed values are discarded.
+ *
+ * For `set not null` with NO usable DEFAULT (`plan.setNotNull.hasDefault === false`), a staged
+ * non-tombstone NULL at the now-NOT-NULL column throws CONSTRAINT here — for the issuer this
+ * aborts atomically before the underlying mutates; for a foreign overlay the caller maps it to
+ * poison. With a usable DEFAULT the staged NULLs are backfilled by
+ * {@link backfillStagedNotNull}, so nothing is rejected here.
+ *
+ * For `set data type` (`plan.setDataType`), every staged non-NULL value is run through the
+ * conversion and the result discarded, so an unconvertible one throws MISMATCH here. For the
+ * ISSUER this is belt-and-braces — the underlying's own pre-mutation pass walks the same rows
+ * via `IsolationModule.issuerEffectiveRows` — EXCEPT when an outer wrapper supplied `rows`, in
+ * which case this is the only check. For a FOREIGN overlay it is the only pass that ever sees
+ * those rows, and it must run before the migration so a failure becomes poison rather than a
+ * half-migrated overlay.
+ *
+ * For a primary-key re-keying `set collate` (`plan.pkRekey`), the staged rows are grouped by
+ * their POST-change key: a deletion marker sharing a key with one live row is that row's
+ * before-image (the migrate step discards it — {@link dropCollapsedPkRekeyMarkers}), and
+ * markers alone on one key are one deletion — neither is a duplicate. Two LIVE rows on one
+ * key ARE, so that throws CONSTRAINT here, mirroring the underlying's own collision message.
+ * For the ISSUER this is belt-and-braces (the underlying's pre-mutation pass judges the same
+ * staged rows via `IsolationModule.issuerEffectiveRows`, though this check fires first); for a
+ * FOREIGN overlay it is the only pass that sees those rows, and its throw becomes poison.
+ *
+ * Non-addColumn / non-tightening / non-retype / non-re-key changes (an empty `plan`) only run
+ * the tombstone guard; their row translation appends/removes nothing fallible on data grounds.
+ */
+export declare function validateOverlayMigration(host: AlterMigrationHost, oldState: ConnectionOverlayState, plan: AlterMigrationPlan): Promise<void>;
+/**
+ * Carries ONE already-open overlay to the post-alter schema, IN PLACE — through the overlay's
+ * own `alterSchema` / `createIndex` / ordinary writes — so the overlay's layer chain and
+ * savepoint snapshots survive the ALTER and `rollback to savepoint` keeps distinguishing rows
+ * staged before the savepoint from rows staged after it (see
+ * `IsolationModule.applyIndexChangeToOverlays` for why the old rebuild — copying staged rows
+ * into a fresh staging table — destroyed that distinction). Per change type:
+ *
+ * - ADD / DROP / RENAME COLUMN: {@link forwardColumnShapeToOverlay}.
+ * - ALTER COLUMN: {@link forwardAlterColumnToOverlay}.
+ * - ADD CONSTRAINT: {@link forwardAddConstraintToOverlay}.
+ * - DROP / RENAME CONSTRAINT: {@link forwardConstraintNameChangeToOverlay}.
+ *
+ * ALTER PRIMARY KEY is excluded from the parameter type: no overlay can follow it in place, so
+ * `IsolationModule.replaceOverlayForPrimaryKeyChange` handles that arm instead.
+ *
+ * The caller wraps this in `IsolationModule.applyInPlaceOverlayChange`, which routes a
+ * CONSTRAINT/BUSY failure by who owns the overlay (issuer → INTERNAL drift error; foreign →
+ * poison) and rethrows everything else.
+ */
+export declare function migrateOverlayForward(host: AlterMigrationHost, overlayState: ConnectionOverlayState, change: Exclude<SchemaChangeInfo, {
+    type: 'alterPrimaryKey';
+}>, plan: AlterMigrationPlan, updatedSchema: TableSchema): Promise<void>;
+/**
+ * The whole overlay rows of every deletion marker {@link dropCollapsedPkRekeyMarkers} will
+ * discard, computed without mutating anything. Re-planning after the drops finds nothing
+ * (each group then holds at most one marker and no marker beside a live row), so the
+ * issuer path — which drops in tier 2 for the pre-flight — can safely run the shared
+ * migrate-step drop again as a no-op.
+ */
+export declare function planPkRekeyMarkerDrops(host: AlterMigrationHost, overlayState: ConnectionOverlayState, ctx: PkRekeyContext): Promise<Row[]>;
+/** Deletes each planned marker by its OLD primary key through the overlay's ordinary write path. */
+export declare function applyPkRekeyMarkerDrops(overlayState: ConnectionOverlayState, ctx: PkRekeyContext, toDrop: readonly Row[]): Promise<void>;
+/**
+ * Undoes {@link applyPkRekeyMarkerDrops} after a refusal that aborts the whole ALTER —
+ * the overlay pre-flight's or the underlying's (see the tier-2 re-key block in
+ * `IsolationModule.alterTable`). Reinserts each marker row verbatim: a marker minted for a
+ * committed row carries NULL at every non-key data column, but one made by deleting a row this
+ * transaction had already staged keeps that row's values (the convert-to-tombstone branch
+ * of `IsolatedTable.update`), so a reconstructed-from-PK row would not restore what was
+ * dropped. The reinserts land in the same savepoint frame the drops did, so the pair nets
+ * to nothing.
+ */
+export declare function reinsertPkRekeyMarkers(overlayState: ConnectionOverlayState, droppedRows: readonly Row[]): Promise<void>;
+//# sourceMappingURL=alter-migration.d.ts.map

package/dist/src/alter-migration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"alter-migration.d.ts","sourceRoot":"","sources":["../../src/alter-migration.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,gBAAgB,EAAE,GAAG,EAAE,QAAQ,EAA8B,MAAM,kBAAkB,CAAC;AAE3H,OAAO,KAAK,EAAE,sBAAsB,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAI9E;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IAClC,kFAAkF;IAClF,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,uEAAuE;IACvE,gBAAgB,CAAC,IAAI,EAAE,SAAS,GAAG,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChG,2EAA2E;IAC3E,cAAc,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;CAChE;AAED;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACxC,qFAAqF;IACrF,aAAa,EAAE,QAAQ,CAAC;IACxB,8FAA8F;IAC9F,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvD,oGAAoG;IACpG,aAAa,EAAE,OAAO,CAAC;IACvB,uDAAuD;IACvD,UAAU,EAAE,MAAM,CAAC;IACnB,yDAAyD;IACzD,SAAS,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,yBAAyB;IACzC,iFAAiF;IACjF,QAAQ,EAAE,MAAM,CAAC;IACjB,mGAAmG;IACnG,aAAa,EAAE,QAAQ,CAAC;IACxB,uGAAuG;IACvG,UAAU,EAAE,OAAO,CAAC;IACpB,+CAA+C;IAC/C,OAAO,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,yBAAyB;IACzC,4EAA4E;IAC5E,QAAQ,EAAE,MAAM,CAAC;IACjB,8EAA8E;IAC9E,OAAO,EAAE,CAAC,CAAC,EAAE,QAAQ,KAAK,QAAQ,CAAC;CACnC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,cAAc;IAC9B,mHAAmH;IACnH,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B,0GAA0G;IAC1G,KAAK,EAAE,CAAC,EAAE,EAAE,SAAS,QAAQ,EAAE,KAAK,MAAM,CAAC;IAC3C,0DAA0D;IAC1D,SAAS,EAAE,MAAM,CAAC;CAClB;AAcD;;;;;;;;GAQG;AACH,MAAM,WAAW,kBAAkB;IAClC,SAAS,CAAC,EAAE,wBAAwB,CAAC;IACrC,UAAU,CAAC,EAAE,yBAAyB,CAAC;IACvC,WAAW,CAAC,EAAE,yBAAyB,CAAC;IACxC,OAAO,CAAC,EAAE,cAAc,CAAC;CACzB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,4BAA4B,CAC3C,IAAI,EAAE,kBAAkB,EACxB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,gBAAgB,GACtB,IAAI,CASN;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,GAAG,MAAM,CAiB/G;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CACvC,MAAM,EAAE,gBAAgB,EACxB,EAAE,EAAE,QAAQ,EACZ,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,SAAS,CAAC,MAAM,EAAE,sBAAsB,CAAC,EAAE,GACpD,kBAAkB,CAOpB;AAwMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,wBAAsB,wBAAwB,CAC7C,IAAI,EAAE,kBAAkB,EACxB,QAAQ,EAAE,sBAAsB,EAChC,IAAI,EAAE,kBAAkB,GACtB,OAAO,CAAC,IAAI,CAAC,CA8Df;AAsDD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,qBAAqB,CAC1C,IAAI,EAAE,kBAAkB,EACxB,YAAY,EAAE,sBAAsB,EACpC,MAAM,EAAE,OAAO,CAAC,gBAAgB,EAAE;IAAE,IAAI,EAAE,iBAAiB,CAAA;CAAE,CAAC,EAC9D,IAAI,EAAE,kBAAkB,EACxB,aAAa,EAAE,WAAW,GACxB,OAAO,CAAC,IAAI,CAAC,CAsBf;AA8JD;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC3C,IAAI,EAAE,kBAAkB,EACxB,YAAY,EAAE,sBAAsB,EACpC,GAAG,EAAE,cAAc,GACjB,OAAO,CAAC,GAAG,EAAE,CAAC,CAehB;AAED,oGAAoG;AACpG,wBAAsB,uBAAuB,CAC5C,YAAY,EAAE,sBAAsB,EACpC,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,SAAS,GAAG,EAAE,GACpB,OAAO,CAAC,IAAI,CAAC,CAqBf;AAED;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAC3C,YAAY,EAAE,sBAAsB,EACpC,WAAW,EAAE,SAAS,GAAG,EAAE,GACzB,OAAO,CAAC,IAAI,CAAC,CAcf"}