@rocicorp/zero 1.10.0-canary.16 → 1.10.0-canary.17

package/out/zero/package.js

@@ -1,6 +1,6 @@
 var package_default = {
 	name: "@rocicorp/zero",
-	version: "1.10.0-canary.16",
+	version: "1.10.0-canary.17",
 	description: "Zero is a web framework for serverless web development.",
 	homepage: "https://zero.rocicorp.dev",
 	bugs: { "url": "https://bugs.rocicorp.dev" },

package/out/zero/package.js.map

@@ -1 +1 @@
-{"version":3,"file":"package.js","names":[],"sources":["../../package.json"],"sourcesContent":["{\n  \"name\": \"@rocicorp/zero\",\n  \"version\": \"1.10.0-canary.16\",\n  \"description\": \"Zero is a web framework for serverless web development.\",\n  \"homepage\": \"https://zero.rocicorp.dev\",\n  \"bugs\": {\n    \"url\": \"https://bugs.rocicorp.dev\"\n  },\n  \"license\": \"Apache-2.0\",\n  \"author\": \"Rocicorp, Inc.\",\n  \"repository\": {\n    \"type\": \"git\",\n    \"url\": \"git+https://github.com/rocicorp/mono.git\",\n    \"directory\": \"packages/zero\"\n  },\n  \"bin\": {\n    \"analyze-query\": \"./out/zero/src/analyze-query.js\",\n    \"ast-to-zql\": \"./out/zero/src/ast-to-zql.js\",\n    \"transform-query\": \"./out/zero/src/transform-query.js\",\n    \"zero-build-schema\": \"./out/zero/src/build-schema.js\",\n    \"zero-cache\": \"./out/zero/src/cli.js\",\n    \"zero-cache-dev\": \"./out/zero/src/zero-cache-dev.js\",\n    \"zero-deploy-permissions\": \"./out/zero/src/deploy-permissions.js\",\n    \"zero-out\": \"./out/zero/src/zero-out.js\"\n  },\n  \"files\": [\n    \"out\",\n    \"!*.tsbuildinfo\"\n  ],\n  \"type\": \"module\",\n  \"main\": \"out/zero/src/zero.js\",\n  \"module\": \"out/zero/src/zero.js\",\n  \"types\": \"out/zero/src/zero.d.ts\",\n  \"exports\": {\n    \".\": {\n      \"types\": \"./out/zero/src/zero.d.ts\",\n      \"default\": \"./out/zero/src/zero.js\"\n    },\n    \"./analyze\": {\n      \"types\": \"./out/zero/src/analyze.d.ts\",\n      \"default\": \"./out/zero/src/analyze.js\"\n    },\n    \"./bindings\": {\n      \"types\": \"./out/zero/src/bindings.d.ts\",\n      \"default\": \"./out/zero/src/bindings.js\"\n    },\n    \"./change-protocol/v0\": {\n      \"types\": \"./out/zero/src/change-protocol/v0.d.ts\",\n      \"default\": \"./out/zero/src/change-protocol/v0.js\"\n    },\n    \"./expo-sqlite\": {\n      \"types\": \"./out/zero/src/expo-sqlite.d.ts\",\n      \"default\": \"./out/zero/src/expo-sqlite.js\"\n    },\n    \"./op-sqlite\": {\n      \"types\": \"./out/zero/src/op-sqlite.d.ts\",\n      \"default\": \"./out/zero/src/op-sqlite.js\"\n    },\n    \"./pg\": {\n      \"types\": \"./out/zero/src/pg.d.ts\",\n      \"default\": \"./out/zero/src/pg.js\"\n    },\n    \"./react\": {\n      \"types\": \"./out/zero/src/react.d.ts\",\n      \"default\": \"./out/zero/src/react.js\"\n    },\n    \"./react-native\": {\n      \"types\": \"./out/zero/src/react-native.d.ts\",\n      \"default\": \"./out/zero/src/react-native.js\"\n    },\n    \"./server\": {\n      \"types\": \"./out/zero/src/server.d.ts\",\n      \"default\": \"./out/zero/src/server.js\"\n    },\n    \"./server/adapters/drizzle\": {\n      \"types\": \"./out/zero/src/adapters/drizzle.d.ts\",\n      \"default\": \"./out/zero/src/adapters/drizzle.js\"\n    },\n    \"./server/adapters/kysely\": {\n      \"types\": \"./out/zero/src/adapters/kysely.d.ts\",\n      \"default\": \"./out/zero/src/adapters/kysely.js\"\n    },\n    \"./server/adapters/prisma\": {\n      \"types\": \"./out/zero/src/adapters/prisma.d.ts\",\n      \"default\": \"./out/zero/src/adapters/prisma.js\"\n    },\n    \"./server/adapters/pg\": {\n      \"types\": \"./out/zero/src/adapters/pg.d.ts\",\n      \"default\": \"./out/zero/src/adapters/pg.js\"\n    },\n    \"./server/adapters/postgresjs\": {\n      \"types\": \"./out/zero/src/adapters/postgresjs.d.ts\",\n      \"default\": \"./out/zero/src/adapters/postgresjs.js\"\n    },\n    \"./solid\": {\n      \"types\": \"./out/zero/src/solid.d.ts\",\n      \"default\": \"./out/zero/src/solid.js\"\n    },\n    \"./sqlite\": {\n      \"types\": \"./out/zero/src/sqlite.d.ts\",\n      \"default\": \"./out/zero/src/sqlite.js\"\n    },\n    \"./zqlite\": {\n      \"types\": \"./out/zero/src/zqlite.d.ts\",\n      \"default\": \"./out/zero/src/zqlite.js\"\n    }\n  },\n  \"scripts\": {\n    \"build\": \"node --experimental-strip-types --no-warnings tool/build.ts\",\n    \"build:watch\": \"node --experimental-strip-types --no-warnings tool/build.ts --watch\",\n    \"check-types\": \"tsc -p tsconfig.client.json && tsc -p tsconfig.server.json\",\n    \"check-types:client:watch\": \"tsc -p tsconfig.client.json --watch\",\n    \"check-types:server:watch\": \"tsc -p tsconfig.server.json --watch\",\n    \"format\": \"oxfmt .\",\n    \"check-format\": \"oxfmt --check .\",\n    \"lint\": \"oxlint --quiet --config ../../oxlint.config.ts src/\",\n    \"docs\": \"node --experimental-strip-types --no-warnings tool/generate-docs.ts\",\n    \"docs:server\": \"node --watch --experimental-strip-types --no-warnings tool/generate-docs.ts --server\",\n    \"fmt\": \"oxfmt .\",\n    \"check-fmt\": \"oxfmt --check .\"\n  },\n  \"dependencies\": {\n    \"@badrap/valita\": \"0.3.11\",\n    \"@databases/escape-identifier\": \"^1.0.3\",\n    \"@databases/sql\": \"^3.3.0\",\n    \"@dotenvx/dotenvx\": \"^1.39.0\",\n    \"@drdgvhbh/postgres-error-codes\": \"^0.0.6\",\n    \"@fastify/cors\": \"^10.0.0\",\n    \"@fastify/websocket\": \"^11.0.0\",\n    \"@google-cloud/precise-date\": \"^4.0.0\",\n    \"@opentelemetry/api\": \"^1.9.0\",\n    \"@opentelemetry/api-logs\": \"^0.218.0\",\n    \"@opentelemetry/auto-instrumentations-node\": \"^0.76.0\",\n    \"@opentelemetry/exporter-metrics-otlp-http\": \"^0.218.0\",\n    \"@opentelemetry/resources\": \"^2.7.1\",\n    \"@opentelemetry/sdk-metrics\": \"^2.7.1\",\n    \"@opentelemetry/sdk-node\": \"^0.218.0\",\n    \"@opentelemetry/sdk-trace-node\": \"^2.7.1\",\n    \"@opentelemetry/semantic-conventions\": \"^1.41.1\",\n    \"@postgresql-typed/oids\": \"^0.2.0\",\n    \"@rocicorp/lock\": \"^1.0.4\",\n    \"@rocicorp/logger\": \"^6.1.0\",\n    \"@rocicorp/resolver\": \"^1.0.2\",\n    \"@rocicorp/zero-sqlite3\": \"^1.1.4\",\n    \"@standard-schema/spec\": \"^1.0.0\",\n    \"@types/basic-auth\": \"^1.1.8\",\n    \"@types/ws\": \"^8.5.12\",\n    \"basic-auth\": \"^2.0.1\",\n    \"chalk-template\": \"^1.1.0\",\n    \"chokidar\": \"^4.0.1\",\n    \"cloudevents\": \"^10.0.0\",\n    \"command-line-args\": \"^6.0.1\",\n    \"command-line-usage\": \"^7.0.3\",\n    \"compare-utf8\": \"^0.2.0\",\n    \"defu\": \"^6.1.4\",\n    \"eventemitter3\": \"^5.0.1\",\n    \"fastify\": \"^5.0.0\",\n    \"is-in-subnet\": \"^4.0.1\",\n    \"jose\": \"^5.9.3\",\n    \"js-xxhash\": \"^4.0.0\",\n    \"json-custom-numbers\": \"^3.1.1\",\n    \"kasi\": \"^1.1.0\",\n    \"nanoid\": \"^5.1.2\",\n    \"oxfmt\": \"^0.45.0\",\n    \"parse-prometheus-text-format\": \"^1.1.1\",\n    \"pg-format\": \"npm:pg-format-fix@^1.0.5\",\n    \"postgres\": \"3.4.7\",\n    \"semver\": \"^7.5.4\",\n    \"url-pattern\": \"^1.0.3\",\n    \"urlpattern-polyfill\": \"^10.1.0\",\n    \"ws\": \"^8.18.1\"\n  },\n  \"devDependencies\": {\n    \"@op-engineering/op-sqlite\": \">=15\",\n    \"@vitest/runner\": \"^4.1.6\",\n    \"analyze-query\": \"workspace:*\",\n    \"ast-to-zql\": \"workspace:*\",\n    \"expo-sqlite\": \">=15\",\n    \"oxc-parser\": \"^0.129.0\",\n    \"replicache\": \"workspace:*\",\n    \"shared\": \"workspace:*\",\n    \"syncpack\": \"^14.3.0\",\n    \"typedoc\": \"^0.28.17\",\n    \"typedoc-plugin-markdown\": \"^4.10.0\",\n    \"typescript\": \"~6.0.2\",\n    \"vite\": \"^8.0.13\",\n    \"vitest\": \"^4.1.6\",\n    \"zero-cache\": \"workspace:*\",\n    \"zero-client\": \"workspace:*\",\n    \"zero-pg\": \"workspace:*\",\n    \"zero-react\": \"workspace:*\",\n    \"zero-server\": \"workspace:*\",\n    \"zero-solid\": \"workspace:*\",\n    \"zqlite\": \"workspace:*\"\n  },\n  \"engines\": {\n    \"node\": \">=22\"\n  },\n  \"packageManager\": \"pnpm@11.11.0\"\n}\n"],"mappings":""}
+{"version":3,"file":"package.js","names":[],"sources":["../../package.json"],"sourcesContent":["{\n  \"name\": \"@rocicorp/zero\",\n  \"version\": \"1.10.0-canary.17\",\n  \"description\": \"Zero is a web framework for serverless web development.\",\n  \"homepage\": \"https://zero.rocicorp.dev\",\n  \"bugs\": {\n    \"url\": \"https://bugs.rocicorp.dev\"\n  },\n  \"license\": \"Apache-2.0\",\n  \"author\": \"Rocicorp, Inc.\",\n  \"repository\": {\n    \"type\": \"git\",\n    \"url\": \"git+https://github.com/rocicorp/mono.git\",\n    \"directory\": \"packages/zero\"\n  },\n  \"bin\": {\n    \"analyze-query\": \"./out/zero/src/analyze-query.js\",\n    \"ast-to-zql\": \"./out/zero/src/ast-to-zql.js\",\n    \"transform-query\": \"./out/zero/src/transform-query.js\",\n    \"zero-build-schema\": \"./out/zero/src/build-schema.js\",\n    \"zero-cache\": \"./out/zero/src/cli.js\",\n    \"zero-cache-dev\": \"./out/zero/src/zero-cache-dev.js\",\n    \"zero-deploy-permissions\": \"./out/zero/src/deploy-permissions.js\",\n    \"zero-out\": \"./out/zero/src/zero-out.js\"\n  },\n  \"files\": [\n    \"out\",\n    \"!*.tsbuildinfo\"\n  ],\n  \"type\": \"module\",\n  \"main\": \"out/zero/src/zero.js\",\n  \"module\": \"out/zero/src/zero.js\",\n  \"types\": \"out/zero/src/zero.d.ts\",\n  \"exports\": {\n    \".\": {\n      \"types\": \"./out/zero/src/zero.d.ts\",\n      \"default\": \"./out/zero/src/zero.js\"\n    },\n    \"./analyze\": {\n      \"types\": \"./out/zero/src/analyze.d.ts\",\n      \"default\": \"./out/zero/src/analyze.js\"\n    },\n    \"./bindings\": {\n      \"types\": \"./out/zero/src/bindings.d.ts\",\n      \"default\": \"./out/zero/src/bindings.js\"\n    },\n    \"./change-protocol/v0\": {\n      \"types\": \"./out/zero/src/change-protocol/v0.d.ts\",\n      \"default\": \"./out/zero/src/change-protocol/v0.js\"\n    },\n    \"./expo-sqlite\": {\n      \"types\": \"./out/zero/src/expo-sqlite.d.ts\",\n      \"default\": \"./out/zero/src/expo-sqlite.js\"\n    },\n    \"./op-sqlite\": {\n      \"types\": \"./out/zero/src/op-sqlite.d.ts\",\n      \"default\": \"./out/zero/src/op-sqlite.js\"\n    },\n    \"./pg\": {\n      \"types\": \"./out/zero/src/pg.d.ts\",\n      \"default\": \"./out/zero/src/pg.js\"\n    },\n    \"./react\": {\n      \"types\": \"./out/zero/src/react.d.ts\",\n      \"default\": \"./out/zero/src/react.js\"\n    },\n    \"./react-native\": {\n      \"types\": \"./out/zero/src/react-native.d.ts\",\n      \"default\": \"./out/zero/src/react-native.js\"\n    },\n    \"./server\": {\n      \"types\": \"./out/zero/src/server.d.ts\",\n      \"default\": \"./out/zero/src/server.js\"\n    },\n    \"./server/adapters/drizzle\": {\n      \"types\": \"./out/zero/src/adapters/drizzle.d.ts\",\n      \"default\": \"./out/zero/src/adapters/drizzle.js\"\n    },\n    \"./server/adapters/kysely\": {\n      \"types\": \"./out/zero/src/adapters/kysely.d.ts\",\n      \"default\": \"./out/zero/src/adapters/kysely.js\"\n    },\n    \"./server/adapters/prisma\": {\n      \"types\": \"./out/zero/src/adapters/prisma.d.ts\",\n      \"default\": \"./out/zero/src/adapters/prisma.js\"\n    },\n    \"./server/adapters/pg\": {\n      \"types\": \"./out/zero/src/adapters/pg.d.ts\",\n      \"default\": \"./out/zero/src/adapters/pg.js\"\n    },\n    \"./server/adapters/postgresjs\": {\n      \"types\": \"./out/zero/src/adapters/postgresjs.d.ts\",\n      \"default\": \"./out/zero/src/adapters/postgresjs.js\"\n    },\n    \"./solid\": {\n      \"types\": \"./out/zero/src/solid.d.ts\",\n      \"default\": \"./out/zero/src/solid.js\"\n    },\n    \"./sqlite\": {\n      \"types\": \"./out/zero/src/sqlite.d.ts\",\n      \"default\": \"./out/zero/src/sqlite.js\"\n    },\n    \"./zqlite\": {\n      \"types\": \"./out/zero/src/zqlite.d.ts\",\n      \"default\": \"./out/zero/src/zqlite.js\"\n    }\n  },\n  \"scripts\": {\n    \"build\": \"node --experimental-strip-types --no-warnings tool/build.ts\",\n    \"build:watch\": \"node --experimental-strip-types --no-warnings tool/build.ts --watch\",\n    \"check-types\": \"tsc -p tsconfig.client.json && tsc -p tsconfig.server.json\",\n    \"check-types:client:watch\": \"tsc -p tsconfig.client.json --watch\",\n    \"check-types:server:watch\": \"tsc -p tsconfig.server.json --watch\",\n    \"format\": \"oxfmt .\",\n    \"check-format\": \"oxfmt --check .\",\n    \"lint\": \"oxlint --quiet --config ../../oxlint.config.ts src/\",\n    \"docs\": \"node --experimental-strip-types --no-warnings tool/generate-docs.ts\",\n    \"docs:server\": \"node --watch --experimental-strip-types --no-warnings tool/generate-docs.ts --server\",\n    \"fmt\": \"oxfmt .\",\n    \"check-fmt\": \"oxfmt --check .\"\n  },\n  \"dependencies\": {\n    \"@badrap/valita\": \"0.3.11\",\n    \"@databases/escape-identifier\": \"^1.0.3\",\n    \"@databases/sql\": \"^3.3.0\",\n    \"@dotenvx/dotenvx\": \"^1.39.0\",\n    \"@drdgvhbh/postgres-error-codes\": \"^0.0.6\",\n    \"@fastify/cors\": \"^10.0.0\",\n    \"@fastify/websocket\": \"^11.0.0\",\n    \"@google-cloud/precise-date\": \"^4.0.0\",\n    \"@opentelemetry/api\": \"^1.9.0\",\n    \"@opentelemetry/api-logs\": \"^0.218.0\",\n    \"@opentelemetry/auto-instrumentations-node\": \"^0.76.0\",\n    \"@opentelemetry/exporter-metrics-otlp-http\": \"^0.218.0\",\n    \"@opentelemetry/resources\": \"^2.7.1\",\n    \"@opentelemetry/sdk-metrics\": \"^2.7.1\",\n    \"@opentelemetry/sdk-node\": \"^0.218.0\",\n    \"@opentelemetry/sdk-trace-node\": \"^2.7.1\",\n    \"@opentelemetry/semantic-conventions\": \"^1.41.1\",\n    \"@postgresql-typed/oids\": \"^0.2.0\",\n    \"@rocicorp/lock\": \"^1.0.4\",\n    \"@rocicorp/logger\": \"^6.1.0\",\n    \"@rocicorp/resolver\": \"^1.0.2\",\n    \"@rocicorp/zero-sqlite3\": \"^1.1.4\",\n    \"@standard-schema/spec\": \"^1.0.0\",\n    \"@types/basic-auth\": \"^1.1.8\",\n    \"@types/ws\": \"^8.5.12\",\n    \"basic-auth\": \"^2.0.1\",\n    \"chalk-template\": \"^1.1.0\",\n    \"chokidar\": \"^4.0.1\",\n    \"cloudevents\": \"^10.0.0\",\n    \"command-line-args\": \"^6.0.1\",\n    \"command-line-usage\": \"^7.0.3\",\n    \"compare-utf8\": \"^0.2.0\",\n    \"defu\": \"^6.1.4\",\n    \"eventemitter3\": \"^5.0.1\",\n    \"fastify\": \"^5.0.0\",\n    \"is-in-subnet\": \"^4.0.1\",\n    \"jose\": \"^5.9.3\",\n    \"js-xxhash\": \"^4.0.0\",\n    \"json-custom-numbers\": \"^3.1.1\",\n    \"kasi\": \"^1.1.0\",\n    \"nanoid\": \"^5.1.2\",\n    \"oxfmt\": \"^0.45.0\",\n    \"parse-prometheus-text-format\": \"^1.1.1\",\n    \"pg-format\": \"npm:pg-format-fix@^1.0.5\",\n    \"postgres\": \"3.4.7\",\n    \"semver\": \"^7.5.4\",\n    \"url-pattern\": \"^1.0.3\",\n    \"urlpattern-polyfill\": \"^10.1.0\",\n    \"ws\": \"^8.18.1\"\n  },\n  \"devDependencies\": {\n    \"@op-engineering/op-sqlite\": \">=15\",\n    \"@vitest/runner\": \"^4.1.6\",\n    \"analyze-query\": \"workspace:*\",\n    \"ast-to-zql\": \"workspace:*\",\n    \"expo-sqlite\": \">=15\",\n    \"oxc-parser\": \"^0.129.0\",\n    \"replicache\": \"workspace:*\",\n    \"shared\": \"workspace:*\",\n    \"syncpack\": \"^14.3.0\",\n    \"typedoc\": \"^0.28.17\",\n    \"typedoc-plugin-markdown\": \"^4.10.0\",\n    \"typescript\": \"~6.0.2\",\n    \"vite\": \"^8.0.13\",\n    \"vitest\": \"^4.1.6\",\n    \"zero-cache\": \"workspace:*\",\n    \"zero-client\": \"workspace:*\",\n    \"zero-pg\": \"workspace:*\",\n    \"zero-react\": \"workspace:*\",\n    \"zero-server\": \"workspace:*\",\n    \"zero-solid\": \"workspace:*\",\n    \"zqlite\": \"workspace:*\"\n  },\n  \"engines\": {\n    \"node\": \">=22\"\n  },\n  \"packageManager\": \"pnpm@11.11.0\"\n}\n"],"mappings":""}

package/out/zero-cache/src/services/change-source/common/replica-schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"replica-schema.d.ts","sourceRoot":"","sources":["../../../../../../../zero-cache/src/services/change-source/common/replica-schema.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AAEjD,OAAO,KAAK,EAAC,QAAQ,EAAC,MAAM,iCAAiC,CAAC;AAG9D,OAAO,EAEL,KAAK,uBAAuB,EAE7B,MAAM,+BAA+B,CAAC;AAgBvC,wBAAsB,WAAW,CAC/B,GAAG,EAAE,UAAU,EACf,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,CAAC,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,KAAK,OAAO,CAAC,IAAI,CAAC,GAC3D,OAAO,CAAC,IAAI,CAAC,CA0Bf;AAED,wBAAsB,cAAc,CAClC,GAAG,EAAE,UAAU,EACf,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,iBAoBf;AAkBD,eAAO,MAAM,+BAA+B,0UAW3C,CAAC;AAEF,eAAO,MAAM,oBAAoB,8XAUhC,CAAC;AAEF,eAAO,MAAM,8BAA8B,sMAO1C,CAAC;AAKF,eAAO,MAAM,2BAA2B,0BAA0B,CAAC;AAQnE,eAAO,MAAM,4BAA4B,8aAaxC,CAAC;AA4BF,eAAO,MAAM,yBAAyB,EAAE,uBA+MvC,CAAC;AAGF,eAAO,MAAM,sBAAsB,QAEwB,CAAC"}
+{"version":3,"file":"replica-schema.d.ts","sourceRoot":"","sources":["../../../../../../../zero-cache/src/services/change-source/common/replica-schema.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AACjD,OAAO,KAAK,EAAC,QAAQ,EAAC,MAAM,iCAAiC,CAAC;AAG9D,OAAO,EAEL,KAAK,uBAAuB,EAE7B,MAAM,+BAA+B,CAAC;AAgBvC,wBAAsB,WAAW,CAC/B,GAAG,EAAE,UAAU,EACf,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,CAAC,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,KAAK,OAAO,CAAC,IAAI,CAAC,GAC3D,OAAO,CAAC,IAAI,CAAC,CA0Bf;AAED,wBAAsB,cAAc,CAClC,GAAG,EAAE,UAAU,EACf,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,iBAoBf;AAkBD,eAAO,MAAM,+BAA+B,0UAW3C,CAAC;AAEF,eAAO,MAAM,oBAAoB,8XAUhC,CAAC;AAEF,eAAO,MAAM,8BAA8B,sMAO1C,CAAC;AAKF,eAAO,MAAM,2BAA2B,0BAA0B,CAAC;AAMnE,eAAO,MAAM,4BAA4B,8aAaxC,CAAC;AAEF,eAAO,MAAM,yBAAyB,EAAE,uBAmMvC,CAAC;AAGF,eAAO,MAAM,sBAAsB,QAEwB,CAAC"}

package/out/zero-cache/src/services/change-source/common/replica-schema.js

@@ -1,4 +1,3 @@
-import { assert } from "../../../../../shared/src/asserts.js";
 import { populateFromExistingTables } from "../../replicator/schema/column-metadata.js";
 import { listTables } from "../../../db/lite-tables.js";
 import { CREATE_BACKFILLING_TABLE, populateBackfillingFromColumnMetadata } from "../../replicator/schema/backfilling.js";
@@ -73,36 +72,7 @@ var CREATE_V9_TABLE_METADATA_TABLE = `
 `;
 var V14_CHANGE_LOG_STREAM_TABLE = "_zero.changeLogStream";
 var V14_CHANGE_LOG_STREAM_WRITE_TIME_INDEX = "_zero.changeLogStream_writeTimeMs";
-var CREATE_V14_CHANGE_LOG_STREAM = `
-  CREATE TABLE "${V14_CHANGE_LOG_STREAM_TABLE}" (
-    "watermark"   TEXT NOT NULL,
-    "pos"         INTEGER NOT NULL,
-    "change"      TEXT NOT NULL,
-    "precommit"   TEXT,
-    "writeTimeMs" INTEGER,
-    PRIMARY KEY ("watermark", "pos")
-  );
-
-  CREATE INDEX "${V14_CHANGE_LOG_STREAM_WRITE_TIME_INDEX}"
-    ON "${V14_CHANGE_LOG_STREAM_TABLE}" ("writeTimeMs", "watermark")
-    WHERE "writeTimeMs" IS NOT NULL;
-`;
-var SEED_V14_CHANGE_LOG_STREAM = `
-  INSERT INTO "${V14_CHANGE_LOG_STREAM_TABLE}"
-    ("watermark", "pos", "change", "precommit", "writeTimeMs")
-  VALUES
-    (@stateVersion, 0, '{"tag":"begin"}', NULL, NULL),
-    (@stateVersion, 1, '{"tag":"commit"}', @stateVersion, @writeTimeMs)
-  ON CONFLICT ("watermark", "pos") DO NOTHING
-`;
-function seedV14ChangeLogStream(db) {
-	const state = db.prepare(`
-      SELECT "stateVersion", "writeTimeMs" FROM "_zero.replicationState"
-    `).get();
-	assert(state !== void 0, "replication state must be initialized");
-	assert(state.writeTimeMs !== null, "replication state writeTimeMs must be initialized");
-	db.prepare(SEED_V14_CHANGE_LOG_STREAM).run(state);
-}
+`${V14_CHANGE_LOG_STREAM_TABLE}${V14_CHANGE_LOG_STREAM_WRITE_TIME_INDEX}${V14_CHANGE_LOG_STREAM_TABLE}`;
 var schemaVersionMigrationMap = {
 	4: {
 		migrateSchema: () => {
@@ -186,14 +156,7 @@ var schemaVersionMigrationMap = {
           SET writeTimeMs = COALESCE(writeTimeMs, unixepoch('subsec') * 1000)`);
 		}
 	},
-	14: {
-		migrateSchema: (_, db) => {
-			db.exec(CREATE_V14_CHANGE_LOG_STREAM);
-		},
-		migrateData: (_, db) => {
-			seedV14ChangeLogStream(db);
-		}
-	},
+	14: {},
 	15: { migrateSchema: (_, db) => {
 		db.exec(`
         CREATE TABLE "_zero.replicationState2" (

package/out/zero-cache/src/services/change-source/common/replica-schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"replica-schema.js","names":[],"sources":["../../../../../../../zero-cache/src/services/change-source/common/replica-schema.ts"],"sourcesContent":["import {existsSync, renameSync} from 'node:fs';\nimport type {LogContext} from '@rocicorp/logger';\nimport {assert} from '../../../../../shared/src/asserts.ts';\nimport type {Database} from '../../../../../zqlite/src/db.ts';\nimport {deleteLiteDB} from '../../../db/delete-lite-db.ts';\nimport {listTables} from '../../../db/lite-tables.ts';\nimport {\n  runSchemaMigrations,\n  type IncrementalMigrationMap,\n  type Migration,\n} from '../../../db/migration-lite.ts';\nimport {\n  isSQLiteCorruption,\n  logSQLiteCorruptionDiagnostics,\n} from '../../../db/sqlite-corruption.ts';\nimport {AutoResetSignal} from '../../change-streamer/schema/tables.ts';\nimport {\n  CREATE_BACKFILLING_TABLE,\n  populateBackfillingFromColumnMetadata,\n} from '../../replicator/schema/backfilling.ts';\nimport {populateFromExistingTables} from '../../replicator/schema/column-metadata.ts';\nimport {\n  CREATE_RUNTIME_EVENTS_TABLE,\n  recordEvent,\n} from '../../replicator/schema/replication-state.ts';\n\nexport async function initReplica(\n  log: LogContext,\n  debugName: string,\n  dbPath: string,\n  initialSync: (lc: LogContext, tx: Database) => Promise<void>,\n): Promise<void> {\n  const isInitialSync = !existsSync(dbPath);\n  const migrationPath = isInitialSync ? `${dbPath}.tmp` : dbPath;\n  if (isInitialSync) {\n    deleteLiteDB(migrationPath);\n  }\n\n  const setupMigration: Migration = {\n    migrateSchema: (log, tx) => initialSync(log, tx),\n    minSafeVersion: 1,\n  };\n\n  try {\n    await runSchemaMigrations(\n      log,\n      debugName,\n      migrationPath,\n      setupMigration,\n      schemaVersionMigrationMap,\n    );\n    if (isInitialSync) {\n      renameSync(migrationPath, dbPath);\n    }\n  } catch (e) {\n    throwAutoResetForCorruption(log, debugName, migrationPath, e);\n  }\n}\n\nexport async function upgradeReplica(\n  log: LogContext,\n  debugName: string,\n  dbPath: string,\n) {\n  try {\n    await runSchemaMigrations(\n      log,\n      debugName,\n      dbPath,\n      // setupMigration should never be invoked\n      {\n        migrateSchema: () => {\n          throw new Error(\n            'This should only be called for already synced replicas',\n          );\n        },\n      },\n      schemaVersionMigrationMap,\n    );\n  } catch (e) {\n    throwAutoResetForCorruption(log, debugName, dbPath, e);\n  }\n}\n\nfunction throwAutoResetForCorruption(\n  log: LogContext,\n  debugName: string,\n  dbPath: string,\n  e: unknown,\n): never {\n  if (isSQLiteCorruption(e)) {\n    logSQLiteCorruptionDiagnostics(log, debugName, dbPath, e);\n    throw new AutoResetSignal(\n      `replica database appears corrupt: ${String(e)}`,\n      {cause: e},\n    );\n  }\n  throw e;\n}\n\nexport const CREATE_V6_COLUMN_METADATA_TABLE = /*sql*/ `\n  CREATE TABLE \"_zero.column_metadata\" (\n    table_name TEXT NOT NULL,\n    column_name TEXT NOT NULL,\n    upstream_type TEXT NOT NULL,\n    is_not_null INTEGER NOT NULL,\n    is_enum INTEGER NOT NULL,\n    is_array INTEGER NOT NULL,\n    character_max_length INTEGER,\n    PRIMARY KEY (table_name, column_name)\n  );\n`;\n\nexport const CREATE_V7_CHANGE_LOG = /*sql*/ `\n  CREATE TABLE \"_zero.changeLog2\" (\n    \"stateVersion\"              TEXT NOT NULL,\n    \"pos\"                       INT  NOT NULL,\n    \"table\"                     TEXT NOT NULL,\n    \"rowKey\"                    TEXT NOT NULL,\n    \"op\"                        TEXT NOT NULL,\n    PRIMARY KEY(\"stateVersion\", \"pos\"),\n    UNIQUE(\"table\", \"rowKey\")\n  );\n`;\n\nexport const CREATE_V9_TABLE_METADATA_TABLE = /*sql*/ `\n  CREATE TABLE \"_zero.tableMetadata\" (\n    \"schema\"    TEXT NOT NULL,\n    \"table\"     TEXT NOT NULL,\n    \"metadata\"  TEXT NOT NULL,\n    PRIMARY KEY (\"schema\", \"table\")\n  );\n`;\n\n// Deliberately shadows the same names in `replicator/change-log-db.ts`: these\n// are the v14 replica's, that module's are the change-log database's, and the\n// two are frozen apart.\nexport const V14_CHANGE_LOG_STREAM_TABLE = '_zero.changeLogStream';\nconst V14_CHANGE_LOG_STREAM_WRITE_TIME_INDEX =\n  '_zero.changeLogStream_writeTimeMs';\n\n// The change-log stream table, as migration 14 created it and migration 16\n// drops it. Frozen at its v14 shape: a migration is history, so this must not\n// be kept in sync with the live definition in `replicator/change-log-db.ts`,\n// which now describes a table in a different database.\nexport const CREATE_V14_CHANGE_LOG_STREAM = /*sql*/ `\n  CREATE TABLE \"${V14_CHANGE_LOG_STREAM_TABLE}\" (\n    \"watermark\"   TEXT NOT NULL,\n    \"pos\"         INTEGER NOT NULL,\n    \"change\"      TEXT NOT NULL,\n    \"precommit\"   TEXT,\n    \"writeTimeMs\" INTEGER,\n    PRIMARY KEY (\"watermark\", \"pos\")\n  );\n\n  CREATE INDEX \"${V14_CHANGE_LOG_STREAM_WRITE_TIME_INDEX}\"\n    ON \"${V14_CHANGE_LOG_STREAM_TABLE}\" (\"writeTimeMs\", \"watermark\")\n    WHERE \"writeTimeMs\" IS NOT NULL;\n`;\n\n// Idempotent because migrateData may run again after a rollback followed by a\n// roll-forward, and both rows go in with one statement so a partial seed is\n// not reachable.\nconst SEED_V14_CHANGE_LOG_STREAM = /*sql*/ `\n  INSERT INTO \"${V14_CHANGE_LOG_STREAM_TABLE}\"\n    (\"watermark\", \"pos\", \"change\", \"precommit\", \"writeTimeMs\")\n  VALUES\n    (@stateVersion, 0, '{\"tag\":\"begin\"}', NULL, NULL),\n    (@stateVersion, 1, '{\"tag\":\"commit\"}', @stateVersion, @writeTimeMs)\n  ON CONFLICT (\"watermark\", \"pos\") DO NOTHING\n`;\n\nfunction seedV14ChangeLogStream(db: Database): void {\n  const state = db\n    .prepare(/*sql*/ `\n      SELECT \"stateVersion\", \"writeTimeMs\" FROM \"_zero.replicationState\"\n    `)\n    .get<{stateVersion: string; writeTimeMs: number | null} | undefined>();\n  assert(state !== undefined, 'replication state must be initialized');\n  assert(\n    state.writeTimeMs !== null,\n    'replication state writeTimeMs must be initialized',\n  );\n  db.prepare(SEED_V14_CHANGE_LOG_STREAM).run(state);\n}\n\nexport const schemaVersionMigrationMap: IncrementalMigrationMap = {\n  // There's no incremental migration from v1. Just reset the replica.\n  4: {\n    migrateSchema: () => {\n      throw new AutoResetSignal('upgrading replica to new schema');\n    },\n    minSafeVersion: 3,\n  },\n\n  5: {\n    migrateSchema: (_, db) => {\n      db.exec(CREATE_RUNTIME_EVENTS_TABLE);\n    },\n    migrateData: (_, db) => {\n      recordEvent(db, 'upgrade');\n    },\n  },\n\n  // Revised in the migration to v8 because the v6 code was incomplete.\n  6: {},\n\n  7: {\n    migrateSchema: (_, db) => {\n      // Note: The original \"changeLog\" table is kept so that the replica file\n      // is compatible with older zero-caches. However, it is truncated for\n      // space savings (since historic changes were never read).\n      db.exec(`DELETE FROM \"_zero.changeLog\"`);\n      // First version of changeLog2\n      db.exec(CREATE_V7_CHANGE_LOG);\n    },\n  },\n\n  8: {\n    migrateSchema: (_, db) => {\n      const tableExists = db\n        .prepare(\n          `SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = '_zero.column_metadata'`,\n        )\n        .get();\n\n      if (!tableExists) {\n        db.exec(CREATE_V6_COLUMN_METADATA_TABLE);\n      }\n    },\n    migrateData: (_, db) => {\n      // Re-populate the ColumnMetadataStore; the original migration\n      // at v6 was incomplete, as covered replicas migrated from earlier\n      // versions but did not initialize the table for new replicas.\n      db.exec(/*sql*/ `DELETE FROM \"_zero.column_metadata\"`);\n\n      const tables = listTables(db, false, false);\n      populateFromExistingTables(db, tables);\n    },\n  },\n\n  9: {\n    migrateSchema: (_, db) => {\n      db.exec(\n        /*sql*/ `\n        ALTER TABLE \"_zero.changeLog2\" \n          ADD COLUMN \"backfillingColumnVersions\" TEXT DEFAULT '{}';\n        ALTER TABLE \"_zero.column_metadata\"\n          ADD COLUMN backfill TEXT;\n      ` + CREATE_V9_TABLE_METADATA_TABLE,\n      );\n    },\n  },\n\n  10: {\n    migrateSchema: (_, db) => {\n      db.exec(/*sql*/ `\n        ALTER TABLE \"_zero.replicationConfig\" \n          ADD COLUMN \"initialSyncContext\" TEXT DEFAULT '{}';\n      `);\n    },\n  },\n\n  11: {\n    migrateSchema: (_, db) => {\n      db.exec(/*sql*/ `\n        ALTER TABLE \"_zero.tableMetadata\"\n          ADD COLUMN \"minRowVersion\" TEXT NOT NULL DEFAULT '00';\n\n        -- Removing the NOT NULL constraint from \"metadata\" requires copying\n        -- the column. We piggyback the rename to \"upstreamMetadata\" here.\n        ALTER TABLE \"_zero.tableMetadata\"\n          ADD COLUMN \"upstreamMetadata\" TEXT;\n        UPDATE \"_zero.tableMetadata\" SET \"upstreamMetadata\" = \"metadata\";\n        ALTER TABLE \"_zero.tableMetadata\" DROP \"metadata\";\n      `);\n    },\n  },\n\n  12: {\n    migrateSchema: (_, db) => {\n      // Bring back the \"metadata\" column removed in v11, but as a NULL-able column.\n      // It is needed for backwards compatibility.\n      db.exec(/*sql*/ `\n        ALTER TABLE \"_zero.tableMetadata\"\n          ADD COLUMN \"metadata\" TEXT;\n      `);\n    },\n\n    migrateData: (_, db) => {\n      // For rollback then roll forward, re-copy anything written to metadata.\n      db.exec(/*sql*/ `\n        UPDATE \"_zero.tableMetadata\" \n          SET \"upstreamMetadata\" = COALESCE(\"metadata\", \"upstreamMetadata\"),\n              \"metadata\" = NULL;\n      `);\n    },\n  },\n\n  13: {\n    migrateSchema: (_, db) => {\n      db.exec(/*sql*/ `\n        ALTER TABLE \"_zero.replicationState\" ADD COLUMN writeTimeMs INTEGER;\n      `);\n    },\n\n    migrateData: (_, db) => {\n      db.exec(/*sql*/ `\n        UPDATE \"_zero.replicationState\" \n          SET writeTimeMs = COALESCE(writeTimeMs, unixepoch('subsec') * 1000)`);\n    },\n  },\n\n  // Deliberately left as it shipped, even though v16 immediately undoes it.\n  // Rewriting it to a no-op would strand replicas already at v14: they roll\n  // back to v14 code, which expects the table this created.\n  14: {\n    migrateSchema: (_, db) => {\n      db.exec(CREATE_V14_CHANGE_LOG_STREAM);\n    },\n\n    migrateData: (_, db) => {\n      seedV14ChangeLogStream(db);\n    },\n  },\n\n  15: {\n    migrateSchema: (_, db) => {\n      // Make writeTimeMs NOT NULL. In SQLite the only way to do this is to\n      // create a new table, copy the data over, delete the old table, and\n      // rename. This is cheap because it's a single row table.\n      db.exec(/*sql*/ `\n        CREATE TABLE \"_zero.replicationState2\" (\n          stateVersion TEXT NOT NULL,\n          writeTimeMs INTEGER NOT NULL,\n          lock INTEGER PRIMARY KEY DEFAULT 1 CHECK (lock=1)\n        );\n\n        INSERT INTO \"_zero.replicationState2\" (stateVersion, writeTimeMs, lock)\n          SELECT stateVersion, writeTimeMs, lock FROM \"_zero.replicationState\";\n\n        DROP TABLE \"_zero.replicationState\";\n\n        ALTER TABLE \"_zero.replicationState2\" RENAME TO \"_zero.replicationState\";\n      `);\n    },\n  },\n\n  // The change log moved out of the replica and into its own database\n  // (`${replicaFile}-change-log`), so the replica's copy is dead weight in\n  // every file the backup ships and every follower downloads. Nothing reads it\n  // as of this version.\n  //\n  // `IF EXISTS` because a fresh replica never runs the incremental migrations\n  // at all — its setup migration creates the current schema directly, which no\n  // longer includes this table — and because a rollback to v14 followed by a\n  // roll-forward re-runs `migrateData` while skipping `migrateSchema`.\n  //\n  // The freed pages are reclaimed by the existing `vacuumIntervalHours`\n  // trigger in `workers/replicator.ts`; no special handling here.\n  //\n  // No `minSafeVersion`: an older zero-cache still runs against a v16 replica,\n  // and with `sqliteChangeLogMode=off` (the default) it never looks for this\n  // table. Bumping the rollback limit would turn every rollback into a hard\n  // startup failure to protect a configuration that is not enabled anywhere.\n  16: {\n    migrateSchema: (_, db) => {\n      db.exec(/*sql*/ `\n        DROP INDEX IF EXISTS \"${V14_CHANGE_LOG_STREAM_WRITE_TIME_INDEX}\";\n        DROP TABLE IF EXISTS \"${V14_CHANGE_LOG_STREAM_TABLE}\";\n      `);\n    },\n  },\n\n  // `_zero.column_metadata.backfill` records which columns are backfilling but\n  // is keyed by lite table name, which has no inverse: it cannot be turned back\n  // into the `BackfillRequest`s that a change log initialized from this replica\n  // would have to send. This table carries the upstream identity alongside the\n  // same state. See `replicator/schema/backfilling.ts`.\n  //\n  // No `minSafeVersion`: an older zero-cache runs fine against a v17 replica,\n  // since nothing at v16 reads the new table. Its writes to\n  // `column_metadata.backfill` are what `migrateData` rebuilds from when rolling\n  // forward again, so a rollback costs nothing but the re-seed.\n  17: {\n    migrateSchema: (_, db) => {\n      db.exec(CREATE_BACKFILLING_TABLE);\n    },\n\n    migrateData: (lc, db) => {\n      populateBackfillingFromColumnMetadata(lc, db);\n    },\n  },\n};\n\n// Referenced in tests.\nexport const CURRENT_SCHEMA_VERSION = Object.keys(\n  schemaVersionMigrationMap,\n).reduce((prev, curr) => Math.max(prev, parseInt(curr)), 0);\n"],"mappings":";;;;;;;;;;;AA0BA,eAAsB,YACpB,KACA,WACA,QACA,aACe;CACf,MAAM,gBAAgB,CAAC,WAAW,MAAM;CACxC,MAAM,gBAAgB,gBAAgB,GAAG,OAAO,QAAQ;CACxD,IAAI,eACF,aAAa,aAAa;CAG5B,MAAM,iBAA4B;EAChC,gBAAgB,KAAK,OAAO,YAAY,KAAK,EAAE;EAC/C,gBAAgB;CAClB;CAEA,IAAI;EACF,MAAM,oBACJ,KACA,WACA,eACA,gBACA,yBACF;EACA,IAAI,eACF,WAAW,eAAe,MAAM;CAEpC,SAAS,GAAG;EACV,4BAA4B,KAAK,WAAW,eAAe,CAAC;CAC9D;AACF;AAEA,eAAsB,eACpB,KACA,WACA,QACA;CACA,IAAI;EACF,MAAM,oBACJ,KACA,WACA,QAEA,EACE,qBAAqB;GACnB,MAAM,IAAI,MACR,wDACF;EACF,EACF,GACA,yBACF;CACF,SAAS,GAAG;EACV,4BAA4B,KAAK,WAAW,QAAQ,CAAC;CACvD;AACF;AAEA,SAAS,4BACP,KACA,WACA,QACA,GACO;CACP,IAAI,mBAAmB,CAAC,GAAG;EACzB,+BAA+B,KAAK,WAAW,QAAQ,CAAC;EACxD,MAAM,IAAI,gBACR,qCAAqC,OAAO,CAAC,KAC7C,EAAC,OAAO,EAAC,CACX;CACF;CACA,MAAM;AACR;AAEA,IAAa,kCAA0C;;;;;;;;;;;;AAavD,IAAa,uBAA+B;;;;;;;;;;;AAY5C,IAAa,iCAAyC;;;;;;;;AAYtD,IAAa,8BAA8B;AAC3C,IAAM,yCACJ;AAMF,IAAa,+BAAuC;kBAClC,4BAA4B;;;;;;;;;kBAS5B,uCAAuC;UAC/C,4BAA4B;;;AAOtC,IAAM,6BAAqC;iBAC1B,4BAA4B;;;;;;;AAQ7C,SAAS,uBAAuB,IAAoB;CAClD,MAAM,QAAQ,GACX,QAAgB;;KAEhB,EACA,IAAoE;CACvE,OAAO,UAAU,KAAA,GAAW,uCAAuC;CACnE,OACE,MAAM,gBAAgB,MACtB,mDACF;CACA,GAAG,QAAQ,0BAA0B,EAAE,IAAI,KAAK;AAClD;AAEA,IAAa,4BAAqD;CAEhE,GAAG;EACD,qBAAqB;GACnB,MAAM,IAAI,gBAAgB,iCAAiC;EAC7D;EACA,gBAAgB;CAClB;CAEA,GAAG;EACD,gBAAgB,GAAG,OAAO;GACxB,GAAG,KAAK,2BAA2B;EACrC;EACA,cAAc,GAAG,OAAO;GACtB,YAAY,IAAI,SAAS;EAC3B;CACF;CAGA,GAAG,CAAC;CAEJ,GAAG,EACD,gBAAgB,GAAG,OAAO;EAIxB,GAAG,KAAK,+BAA+B;EAEvC,GAAG,KAAK,oBAAoB;CAC9B,EACF;CAEA,GAAG;EACD,gBAAgB,GAAG,OAAO;GAOxB,IAAI,CANgB,GACjB,QACC,qFACF,EACC,IAEE,GACH,GAAG,KAAK,+BAA+B;EAE3C;EACA,cAAc,GAAG,OAAO;GAItB,GAAG,KAAa,qCAAqC;GAGrD,2BAA2B,IADZ,WAAW,IAAI,OAAO,KACN,CAAM;EACvC;CACF;CAEA,GAAG,EACD,gBAAgB,GAAG,OAAO;EACxB,GAAG,KACO;;;;;UAKN,8BACJ;CACF,EACF;CAEA,IAAI,EACF,gBAAgB,GAAG,OAAO;EACxB,GAAG,KAAa;;;OAGf;CACH,EACF;CAEA,IAAI,EACF,gBAAgB,GAAG,OAAO;EACxB,GAAG,KAAa;;;;;;;;;;OAUf;CACH,EACF;CAEA,IAAI;EACF,gBAAgB,GAAG,OAAO;GAGxB,GAAG,KAAa;;;OAGf;EACH;EAEA,cAAc,GAAG,OAAO;GAEtB,GAAG,KAAa;;;;OAIf;EACH;CACF;CAEA,IAAI;EACF,gBAAgB,GAAG,OAAO;GACxB,GAAG,KAAa;;OAEf;EACH;EAEA,cAAc,GAAG,OAAO;GACtB,GAAG,KAAa;;8EAEwD;EAC1E;CACF;CAKA,IAAI;EACF,gBAAgB,GAAG,OAAO;GACxB,GAAG,KAAK,4BAA4B;EACtC;EAEA,cAAc,GAAG,OAAO;GACtB,uBAAuB,EAAE;EAC3B;CACF;CAEA,IAAI,EACF,gBAAgB,GAAG,OAAO;EAIxB,GAAG,KAAa;;;;;;;;;;;;;OAaf;CACH,EACF;CAmBA,IAAI,EACF,gBAAgB,GAAG,OAAO;EACxB,GAAG,KAAa;gCACU,uCAAuC;gCACvC,4BAA4B;OACrD;CACH,EACF;CAYA,IAAI;EACF,gBAAgB,GAAG,OAAO;GACxB,GAAG,KAAK,wBAAwB;EAClC;EAEA,cAAc,IAAI,OAAO;GACvB,sCAAsC,IAAI,EAAE;EAC9C;CACF;AACF;AAGsC,OAAO,KAC3C,yBACF,EAAE,QAAQ,MAAM,SAAS,KAAK,IAAI,MAAM,SAAS,IAAI,CAAC,GAAG,CAAC"}
+{"version":3,"file":"replica-schema.js","names":[],"sources":["../../../../../../../zero-cache/src/services/change-source/common/replica-schema.ts"],"sourcesContent":["import {existsSync, renameSync} from 'node:fs';\nimport type {LogContext} from '@rocicorp/logger';\nimport type {Database} from '../../../../../zqlite/src/db.ts';\nimport {deleteLiteDB} from '../../../db/delete-lite-db.ts';\nimport {listTables} from '../../../db/lite-tables.ts';\nimport {\n  runSchemaMigrations,\n  type IncrementalMigrationMap,\n  type Migration,\n} from '../../../db/migration-lite.ts';\nimport {\n  isSQLiteCorruption,\n  logSQLiteCorruptionDiagnostics,\n} from '../../../db/sqlite-corruption.ts';\nimport {AutoResetSignal} from '../../change-streamer/schema/tables.ts';\nimport {\n  CREATE_BACKFILLING_TABLE,\n  populateBackfillingFromColumnMetadata,\n} from '../../replicator/schema/backfilling.ts';\nimport {populateFromExistingTables} from '../../replicator/schema/column-metadata.ts';\nimport {\n  CREATE_RUNTIME_EVENTS_TABLE,\n  recordEvent,\n} from '../../replicator/schema/replication-state.ts';\n\nexport async function initReplica(\n  log: LogContext,\n  debugName: string,\n  dbPath: string,\n  initialSync: (lc: LogContext, tx: Database) => Promise<void>,\n): Promise<void> {\n  const isInitialSync = !existsSync(dbPath);\n  const migrationPath = isInitialSync ? `${dbPath}.tmp` : dbPath;\n  if (isInitialSync) {\n    deleteLiteDB(migrationPath);\n  }\n\n  const setupMigration: Migration = {\n    migrateSchema: (log, tx) => initialSync(log, tx),\n    minSafeVersion: 1,\n  };\n\n  try {\n    await runSchemaMigrations(\n      log,\n      debugName,\n      migrationPath,\n      setupMigration,\n      schemaVersionMigrationMap,\n    );\n    if (isInitialSync) {\n      renameSync(migrationPath, dbPath);\n    }\n  } catch (e) {\n    throwAutoResetForCorruption(log, debugName, migrationPath, e);\n  }\n}\n\nexport async function upgradeReplica(\n  log: LogContext,\n  debugName: string,\n  dbPath: string,\n) {\n  try {\n    await runSchemaMigrations(\n      log,\n      debugName,\n      dbPath,\n      // setupMigration should never be invoked\n      {\n        migrateSchema: () => {\n          throw new Error(\n            'This should only be called for already synced replicas',\n          );\n        },\n      },\n      schemaVersionMigrationMap,\n    );\n  } catch (e) {\n    throwAutoResetForCorruption(log, debugName, dbPath, e);\n  }\n}\n\nfunction throwAutoResetForCorruption(\n  log: LogContext,\n  debugName: string,\n  dbPath: string,\n  e: unknown,\n): never {\n  if (isSQLiteCorruption(e)) {\n    logSQLiteCorruptionDiagnostics(log, debugName, dbPath, e);\n    throw new AutoResetSignal(\n      `replica database appears corrupt: ${String(e)}`,\n      {cause: e},\n    );\n  }\n  throw e;\n}\n\nexport const CREATE_V6_COLUMN_METADATA_TABLE = /*sql*/ `\n  CREATE TABLE \"_zero.column_metadata\" (\n    table_name TEXT NOT NULL,\n    column_name TEXT NOT NULL,\n    upstream_type TEXT NOT NULL,\n    is_not_null INTEGER NOT NULL,\n    is_enum INTEGER NOT NULL,\n    is_array INTEGER NOT NULL,\n    character_max_length INTEGER,\n    PRIMARY KEY (table_name, column_name)\n  );\n`;\n\nexport const CREATE_V7_CHANGE_LOG = /*sql*/ `\n  CREATE TABLE \"_zero.changeLog2\" (\n    \"stateVersion\"              TEXT NOT NULL,\n    \"pos\"                       INT  NOT NULL,\n    \"table\"                     TEXT NOT NULL,\n    \"rowKey\"                    TEXT NOT NULL,\n    \"op\"                        TEXT NOT NULL,\n    PRIMARY KEY(\"stateVersion\", \"pos\"),\n    UNIQUE(\"table\", \"rowKey\")\n  );\n`;\n\nexport const CREATE_V9_TABLE_METADATA_TABLE = /*sql*/ `\n  CREATE TABLE \"_zero.tableMetadata\" (\n    \"schema\"    TEXT NOT NULL,\n    \"table\"     TEXT NOT NULL,\n    \"metadata\"  TEXT NOT NULL,\n    PRIMARY KEY (\"schema\", \"table\")\n  );\n`;\n\n// Deliberately shadows the same names in `replicator/change-log-db.ts`: these\n// describe replica files created by pre-release v14 builds, while that module\n// describes the separate change-log database. The two are frozen apart.\nexport const V14_CHANGE_LOG_STREAM_TABLE = '_zero.changeLogStream';\nconst V14_CHANGE_LOG_STREAM_WRITE_TIME_INDEX =\n  '_zero.changeLogStream_writeTimeMs';\n\n// The change-log stream table created by pre-release v14 builds and dropped by\n// migration 16. Retained at its old shape for migration tests only.\nexport const CREATE_V14_CHANGE_LOG_STREAM = /*sql*/ `\n  CREATE TABLE \"${V14_CHANGE_LOG_STREAM_TABLE}\" (\n    \"watermark\"   TEXT NOT NULL,\n    \"pos\"         INTEGER NOT NULL,\n    \"change\"      TEXT NOT NULL,\n    \"precommit\"   TEXT,\n    \"writeTimeMs\" INTEGER,\n    PRIMARY KEY (\"watermark\", \"pos\")\n  );\n\n  CREATE INDEX \"${V14_CHANGE_LOG_STREAM_WRITE_TIME_INDEX}\"\n    ON \"${V14_CHANGE_LOG_STREAM_TABLE}\" (\"writeTimeMs\", \"watermark\")\n    WHERE \"writeTimeMs\" IS NOT NULL;\n`;\n\nexport const schemaVersionMigrationMap: IncrementalMigrationMap = {\n  // There's no incremental migration from v1. Just reset the replica.\n  4: {\n    migrateSchema: () => {\n      throw new AutoResetSignal('upgrading replica to new schema');\n    },\n    minSafeVersion: 3,\n  },\n\n  5: {\n    migrateSchema: (_, db) => {\n      db.exec(CREATE_RUNTIME_EVENTS_TABLE);\n    },\n    migrateData: (_, db) => {\n      recordEvent(db, 'upgrade');\n    },\n  },\n\n  // Revised in the migration to v8 because the v6 code was incomplete.\n  6: {},\n\n  7: {\n    migrateSchema: (_, db) => {\n      // Note: The original \"changeLog\" table is kept so that the replica file\n      // is compatible with older zero-caches. However, it is truncated for\n      // space savings (since historic changes were never read).\n      db.exec(`DELETE FROM \"_zero.changeLog\"`);\n      // First version of changeLog2\n      db.exec(CREATE_V7_CHANGE_LOG);\n    },\n  },\n\n  8: {\n    migrateSchema: (_, db) => {\n      const tableExists = db\n        .prepare(\n          `SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = '_zero.column_metadata'`,\n        )\n        .get();\n\n      if (!tableExists) {\n        db.exec(CREATE_V6_COLUMN_METADATA_TABLE);\n      }\n    },\n    migrateData: (_, db) => {\n      // Re-populate the ColumnMetadataStore; the original migration\n      // at v6 was incomplete, as covered replicas migrated from earlier\n      // versions but did not initialize the table for new replicas.\n      db.exec(/*sql*/ `DELETE FROM \"_zero.column_metadata\"`);\n\n      const tables = listTables(db, false, false);\n      populateFromExistingTables(db, tables);\n    },\n  },\n\n  9: {\n    migrateSchema: (_, db) => {\n      db.exec(\n        /*sql*/ `\n        ALTER TABLE \"_zero.changeLog2\" \n          ADD COLUMN \"backfillingColumnVersions\" TEXT DEFAULT '{}';\n        ALTER TABLE \"_zero.column_metadata\"\n          ADD COLUMN backfill TEXT;\n      ` + CREATE_V9_TABLE_METADATA_TABLE,\n      );\n    },\n  },\n\n  10: {\n    migrateSchema: (_, db) => {\n      db.exec(/*sql*/ `\n        ALTER TABLE \"_zero.replicationConfig\" \n          ADD COLUMN \"initialSyncContext\" TEXT DEFAULT '{}';\n      `);\n    },\n  },\n\n  11: {\n    migrateSchema: (_, db) => {\n      db.exec(/*sql*/ `\n        ALTER TABLE \"_zero.tableMetadata\"\n          ADD COLUMN \"minRowVersion\" TEXT NOT NULL DEFAULT '00';\n\n        -- Removing the NOT NULL constraint from \"metadata\" requires copying\n        -- the column. We piggyback the rename to \"upstreamMetadata\" here.\n        ALTER TABLE \"_zero.tableMetadata\"\n          ADD COLUMN \"upstreamMetadata\" TEXT;\n        UPDATE \"_zero.tableMetadata\" SET \"upstreamMetadata\" = \"metadata\";\n        ALTER TABLE \"_zero.tableMetadata\" DROP \"metadata\";\n      `);\n    },\n  },\n\n  12: {\n    migrateSchema: (_, db) => {\n      // Bring back the \"metadata\" column removed in v11, but as a NULL-able column.\n      // It is needed for backwards compatibility.\n      db.exec(/*sql*/ `\n        ALTER TABLE \"_zero.tableMetadata\"\n          ADD COLUMN \"metadata\" TEXT;\n      `);\n    },\n\n    migrateData: (_, db) => {\n      // For rollback then roll forward, re-copy anything written to metadata.\n      db.exec(/*sql*/ `\n        UPDATE \"_zero.tableMetadata\" \n          SET \"upstreamMetadata\" = COALESCE(\"metadata\", \"upstreamMetadata\"),\n              \"metadata\" = NULL;\n      `);\n    },\n  },\n\n  13: {\n    migrateSchema: (_, db) => {\n      db.exec(/*sql*/ `\n        ALTER TABLE \"_zero.replicationState\" ADD COLUMN writeTimeMs INTEGER;\n      `);\n    },\n\n    migrateData: (_, db) => {\n      db.exec(/*sql*/ `\n        UPDATE \"_zero.replicationState\" \n          SET writeTimeMs = COALESCE(writeTimeMs, unixepoch('subsec') * 1000)`);\n    },\n  },\n\n  // The replica-local change log moved to its own database before v14 shipped.\n  14: {},\n\n  15: {\n    migrateSchema: (_, db) => {\n      // Make writeTimeMs NOT NULL. In SQLite the only way to do this is to\n      // create a new table, copy the data over, delete the old table, and\n      // rename. This is cheap because it's a single row table.\n      db.exec(/*sql*/ `\n        CREATE TABLE \"_zero.replicationState2\" (\n          stateVersion TEXT NOT NULL,\n          writeTimeMs INTEGER NOT NULL,\n          lock INTEGER PRIMARY KEY DEFAULT 1 CHECK (lock=1)\n        );\n\n        INSERT INTO \"_zero.replicationState2\" (stateVersion, writeTimeMs, lock)\n          SELECT stateVersion, writeTimeMs, lock FROM \"_zero.replicationState\";\n\n        DROP TABLE \"_zero.replicationState\";\n\n        ALTER TABLE \"_zero.replicationState2\" RENAME TO \"_zero.replicationState\";\n      `);\n    },\n  },\n\n  // The change log moved out of the replica and into its own database\n  // (`${replicaFile}-change-log`), so the replica's copy is dead weight in\n  // every file the backup ships and every follower downloads. Nothing reads it\n  // as of this version.\n  //\n  // `IF EXISTS` because fresh and post-v13 replicas never create this table.\n  // Pre-release v14 builds did, so keep their cleanup idempotent.\n  //\n  // The freed pages are reclaimed by the existing `vacuumIntervalHours`\n  // trigger in `workers/replicator.ts`; no special handling here.\n  //\n  // No `minSafeVersion`: an older zero-cache still runs against a v16 replica,\n  // and with `sqliteChangeLogMode=off` (the default) it never looks for this\n  // table. Bumping the rollback limit would turn every rollback into a hard\n  // startup failure to protect a configuration that is not enabled anywhere.\n  16: {\n    migrateSchema: (_, db) => {\n      db.exec(/*sql*/ `\n        DROP INDEX IF EXISTS \"${V14_CHANGE_LOG_STREAM_WRITE_TIME_INDEX}\";\n        DROP TABLE IF EXISTS \"${V14_CHANGE_LOG_STREAM_TABLE}\";\n      `);\n    },\n  },\n\n  // `_zero.column_metadata.backfill` records which columns are backfilling but\n  // is keyed by lite table name, which has no inverse: it cannot be turned back\n  // into the `BackfillRequest`s that a change log initialized from this replica\n  // would have to send. This table carries the upstream identity alongside the\n  // same state. See `replicator/schema/backfilling.ts`.\n  //\n  // No `minSafeVersion`: an older zero-cache runs fine against a v17 replica,\n  // since nothing at v16 reads the new table. Its writes to\n  // `column_metadata.backfill` are what `migrateData` rebuilds from when rolling\n  // forward again, so a rollback costs nothing but the re-seed.\n  17: {\n    migrateSchema: (_, db) => {\n      db.exec(CREATE_BACKFILLING_TABLE);\n    },\n\n    migrateData: (lc, db) => {\n      populateBackfillingFromColumnMetadata(lc, db);\n    },\n  },\n};\n\n// Referenced in tests.\nexport const CURRENT_SCHEMA_VERSION = Object.keys(\n  schemaVersionMigrationMap,\n).reduce((prev, curr) => Math.max(prev, parseInt(curr)), 0);\n"],"mappings":";;;;;;;;;;AAyBA,eAAsB,YACpB,KACA,WACA,QACA,aACe;CACf,MAAM,gBAAgB,CAAC,WAAW,MAAM;CACxC,MAAM,gBAAgB,gBAAgB,GAAG,OAAO,QAAQ;CACxD,IAAI,eACF,aAAa,aAAa;CAG5B,MAAM,iBAA4B;EAChC,gBAAgB,KAAK,OAAO,YAAY,KAAK,EAAE;EAC/C,gBAAgB;CAClB;CAEA,IAAI;EACF,MAAM,oBACJ,KACA,WACA,eACA,gBACA,yBACF;EACA,IAAI,eACF,WAAW,eAAe,MAAM;CAEpC,SAAS,GAAG;EACV,4BAA4B,KAAK,WAAW,eAAe,CAAC;CAC9D;AACF;AAEA,eAAsB,eACpB,KACA,WACA,QACA;CACA,IAAI;EACF,MAAM,oBACJ,KACA,WACA,QAEA,EACE,qBAAqB;GACnB,MAAM,IAAI,MACR,wDACF;EACF,EACF,GACA,yBACF;CACF,SAAS,GAAG;EACV,4BAA4B,KAAK,WAAW,QAAQ,CAAC;CACvD;AACF;AAEA,SAAS,4BACP,KACA,WACA,QACA,GACO;CACP,IAAI,mBAAmB,CAAC,GAAG;EACzB,+BAA+B,KAAK,WAAW,QAAQ,CAAC;EACxD,MAAM,IAAI,gBACR,qCAAqC,OAAO,CAAC,KAC7C,EAAC,OAAO,EAAC,CACX;CACF;CACA,MAAM;AACR;AAEA,IAAa,kCAA0C;;;;;;;;;;;;AAavD,IAAa,uBAA+B;;;;;;;;;;;AAY5C,IAAa,iCAAyC;;;;;;;;AAYtD,IAAa,8BAA8B;AAC3C,IAAM,yCACJ;AAIkD,GAClC,4BADkC,EAUlC,uCAVkC,EAW1C,4BAX0C;AAepD,IAAa,4BAAqD;CAEhE,GAAG;EACD,qBAAqB;GACnB,MAAM,IAAI,gBAAgB,iCAAiC;EAC7D;EACA,gBAAgB;CAClB;CAEA,GAAG;EACD,gBAAgB,GAAG,OAAO;GACxB,GAAG,KAAK,2BAA2B;EACrC;EACA,cAAc,GAAG,OAAO;GACtB,YAAY,IAAI,SAAS;EAC3B;CACF;CAGA,GAAG,CAAC;CAEJ,GAAG,EACD,gBAAgB,GAAG,OAAO;EAIxB,GAAG,KAAK,+BAA+B;EAEvC,GAAG,KAAK,oBAAoB;CAC9B,EACF;CAEA,GAAG;EACD,gBAAgB,GAAG,OAAO;GAOxB,IAAI,CANgB,GACjB,QACC,qFACF,EACC,IAEE,GACH,GAAG,KAAK,+BAA+B;EAE3C;EACA,cAAc,GAAG,OAAO;GAItB,GAAG,KAAa,qCAAqC;GAGrD,2BAA2B,IADZ,WAAW,IAAI,OAAO,KACN,CAAM;EACvC;CACF;CAEA,GAAG,EACD,gBAAgB,GAAG,OAAO;EACxB,GAAG,KACO;;;;;UAKN,8BACJ;CACF,EACF;CAEA,IAAI,EACF,gBAAgB,GAAG,OAAO;EACxB,GAAG,KAAa;;;OAGf;CACH,EACF;CAEA,IAAI,EACF,gBAAgB,GAAG,OAAO;EACxB,GAAG,KAAa;;;;;;;;;;OAUf;CACH,EACF;CAEA,IAAI;EACF,gBAAgB,GAAG,OAAO;GAGxB,GAAG,KAAa;;;OAGf;EACH;EAEA,cAAc,GAAG,OAAO;GAEtB,GAAG,KAAa;;;;OAIf;EACH;CACF;CAEA,IAAI;EACF,gBAAgB,GAAG,OAAO;GACxB,GAAG,KAAa;;OAEf;EACH;EAEA,cAAc,GAAG,OAAO;GACtB,GAAG,KAAa;;8EAEwD;EAC1E;CACF;CAGA,IAAI,CAAC;CAEL,IAAI,EACF,gBAAgB,GAAG,OAAO;EAIxB,GAAG,KAAa;;;;;;;;;;;;;OAaf;CACH,EACF;CAiBA,IAAI,EACF,gBAAgB,GAAG,OAAO;EACxB,GAAG,KAAa;gCACU,uCAAuC;gCACvC,4BAA4B;OACrD;CACH,EACF;CAYA,IAAI;EACF,gBAAgB,GAAG,OAAO;GACxB,GAAG,KAAK,wBAAwB;EAClC;EAEA,cAAc,IAAI,OAAO;GACvB,sCAAsC,IAAI,EAAE;EAC9C;CACF;AACF;AAGsC,OAAO,KAC3C,yBACF,EAAE,QAAQ,MAAM,SAAS,KAAK,IAAI,MAAM,SAAS,IAAI,CAAC,GAAG,CAAC"}

package/out/zero-cache/src/services/replicator/change-log-db.js.map

@@ -1 +1 @@
-{"version":3,"file":"change-log-db.js","names":[],"sources":["../../../../../../zero-cache/src/services/replicator/change-log-db.ts"],"sourcesContent":["/**\n * The change log lives in its own SQLite database, `${replicaFile}-change-log`,\n * rather than in the replica file. It is a catchup cache: everything it holds is\n * either already durable in the replica's litestream backup or re-derivable from\n * the upstream replication slot, so it is deliberately excluded from the backup\n * and is never a source of truth.\n *\n * The change-streamer writes it, from the stream loop that fans changes out to\n * subscribers, and commits it before forwarding each transaction's `commit`\n * message. Its head is therefore always at or above the watermark the stream\n * would resume from, which is what {@link reconcileChangeLog} anchors on.\n *\n * Beside the buffer it holds the log's *cookie jar* — the backfill progress\n * state folded up to the same head. That is `change-log-cookies.ts`; this file\n * owns its tables' lifecycle, because a cookie set is only meaningful paired\n * with the watermark it was folded to, and so must be created, dropped, and —\n * whenever reconciliation moves the head — replaced with the anchor's, all with\n * the buffer rather than beside it.\n *\n * Because it is disposable, it has no migration framework. Any inconsistency —\n * a schema change, a leftover file from a different replica, a gap left by a\n * crash or by running with the writer disabled, a corrupt file — is resolved by\n * {@link reconcileChangeLog} and {@link openChangeLogDBForWriting}, which\n * truncate a bounded suffix or replace and reseed the log at the resume\n * watermark. The worst outcome is a `too-old` for a lagging subscriber; a\n * silently delivered gap is not reachable.\n *\n * Disk sizing: a task that writes the log needs room for the replica *plus* the\n * retained change stream — the log's main file, its wal2 sidecars, and pages a\n * purge has freed but not yet returned to the OS. The change-streamer schedules\n * purges against the same floor as the PG change log, so retention is bounded\n * by the confirmed backup watermark ANDed with the minimum retention window —\n * a function of the backup interval, not a constant: 15–30+ minutes behind an\n * RMv1 sync interval, ~60 seconds once litestream v5 backs up every 15–30 s.\n * A held snapshot reservation pins retention unboundedly for its duration, so\n * peak retained bytes is set by the slowest concurrent restore rather than by\n * the retention setting — size disk and alerts on that. The log is excluded\n * from the litestream backup, so this is local disk only and never S3.\n */\n\nimport {existsSync} from 'node:fs';\nimport type {LogContext} from '@rocicorp/logger';\nimport {Database} from '../../../../zqlite/src/db.ts';\nimport {deleteLiteDB} from '../../db/delete-lite-db.ts';\nimport {\n  isSQLiteCorruption,\n  logSQLiteCorruptionDiagnostics,\n} from '../../db/sqlite-corruption.ts';\nimport {\n  CHANGE_LOG_BACKFILLING_TABLE,\n  CHANGE_LOG_TABLE_METADATA_TABLE,\n  CREATE_CHANGE_LOG_COOKIE_SCHEMA,\n  DROP_CHANGE_LOG_COOKIE_TABLES,\n  replaceCookies,\n  type CookieSet,\n} from './change-log-cookies.ts';\n\n/**\n * Bumped whenever the change-log database's schema changes. Since the file is a\n * cache, a mismatch costs one reseed rather than a migration.\n *\n * v2 re-homed the writer to the change-streamer: the log anchors on the\n * watermark its stream connection resumes from rather than on the replica's\n * state version, and its meta row carries the replica's identity triple plus\n * the seed point.\n *\n * v3 added the cookie tables (see `change-log-cookies.ts`), i.e. the log's\n * second job. The reseed it costs on upgrade buys one retention window of\n * catchup reach on a log nothing reads yet.\n *\n * v4 stores each row's tag and estimated retained bytes alongside its JSON.\n * Readers can now filter without parsing arbitrary row payloads, and\n * reconciliation can bound truncation by bytes as well as rows.\n *\n * `auto_vacuum = INCREMENTAL` arrived within v2, deliberately without a bump:\n * it is a file-header property rather than a schema change, and the reseed a\n * version mismatch triggers cannot enable it (see\n * {@link applyChangeLogPragmas}), so {@link openChangeLogDBForWriting} guards\n * on the pragma itself instead of on this number.\n */\nexport const CHANGE_LOG_DB_SCHEMA_VERSION = 4;\n\n/** https://www.sqlite.org/pragma.html#pragma_auto_vacuum */\nconst AUTO_VACUUM_INCREMENTAL = 2;\n\nexport const CHANGE_LOG_STREAM_TABLE = '_zero.changeLogStream';\nexport const CHANGE_LOG_STREAM_WRITE_TIME_INDEX =\n  '_zero.changeLogStream_writeTimeMs';\n\nconst INTEGER_BYTES = 8;\n\n/**\n * Estimates the retained payload size of a stream row. This deliberately does\n * not claim to measure SQLite b-tree/page overhead; it is stable across the\n * write path, reconciliation, and the startup scan used by observability.\n */\nexport function estimateChangeLogStreamRowBytes(\n  watermark: string,\n  tag: string,\n  change: string,\n  precommit?: string,\n  hasWriteTime = false,\n): number {\n  return (\n    Buffer.byteLength(watermark) +\n    INTEGER_BYTES +\n    Buffer.byteLength(tag) +\n    Buffer.byteLength(change) +\n    (precommit === undefined ? 0 : Buffer.byteLength(precommit)) +\n    (hasWriteTime ? INTEGER_BYTES : 0)\n  );\n}\n\n// The index is partial because only commit rows carry a \"writeTimeMs\", so it\n// holds one entry per transaction rather than one per change. It is what the\n// purger scans to find transactions older than the retention window.\n//\n// The replica carried this table's original shape through versions 14 and 15;\n// see `CREATE_V14_CHANGE_LOG_STREAM` in\n// `change-source/common/replica-schema.ts`, which is frozen at the v14 shape\n// and must not be kept in sync with this one.\nexport const CREATE_CHANGE_LOG_STREAM_SCHEMA = /*sql*/ `\n  CREATE TABLE \"${CHANGE_LOG_STREAM_TABLE}\" (\n    \"watermark\"      TEXT NOT NULL,\n    \"pos\"            INTEGER NOT NULL,\n    \"tag\"            TEXT NOT NULL,\n    \"estimatedBytes\"  INTEGER NOT NULL,\n    \"change\"          TEXT NOT NULL,\n    \"precommit\"       TEXT,\n    \"writeTimeMs\"     INTEGER,\n    PRIMARY KEY (\"watermark\", \"pos\")\n  );\n\n  CREATE INDEX \"${CHANGE_LOG_STREAM_WRITE_TIME_INDEX}\"\n    ON \"${CHANGE_LOG_STREAM_TABLE}\" (\"writeTimeMs\", \"watermark\")\n    WHERE \"writeTimeMs\" IS NOT NULL;\n`;\n\n/**\n * Inserts the synthetic begin/commit pair for the seed watermark.\n *\n * Both rows are inserted by one statement so a caller outside a larger\n * transaction cannot leave a partial seed.\n */\nconst SEED_CHANGE_LOG_STREAM_SQL = /*sql*/ `\n  INSERT INTO \"${CHANGE_LOG_STREAM_TABLE}\"\n    (\"watermark\", \"pos\", \"tag\", \"estimatedBytes\", \"change\", \"precommit\",\n     \"writeTimeMs\")\n  VALUES\n    (@watermark, 0, 'begin', @beginBytes, @beginChange, NULL, NULL),\n    (@watermark, 1, 'commit', @commitBytes, @commitChange, @watermark,\n     @writeTimeMs)\n  ON CONFLICT (\"watermark\", \"pos\") DO NOTHING\n`;\n\nexport const CHANGE_LOG_META_TABLE = '_zero.changeLogMeta';\n\n// The identity triple (see ChangeLogIdentity) detects a file left behind by a\n// different replica -- most concretely, a leftover log on a reused volume.\n//\n// \"seededAtMs\"    : when the log was seeded, i.e. how far its retention window\n//                   can possibly reach back. Slice 11 uses it as the warm-up\n//                   signal for canary reads.\n// \"seedWatermark\" : where the log was seeded. `min(\"watermark\")` cannot answer\n//                   this once purge has advanced the minimum, and the\n//                   difference is what distinguishes a log that purged past the\n//                   retention floor (an invariant violation) from one that\n//                   never held that history at all (routine at every fork).\n// \"lock\"          : enforces single-row semantics, as in\n//                   \"_zero.replicationConfig\".\nconst CREATE_CHANGE_LOG_META_SCHEMA = /*sql*/ `\n  CREATE TABLE \"${CHANGE_LOG_META_TABLE}\" (\n    \"epoch\"         TEXT,\n    \"generation\"    TEXT NOT NULL,\n    \"replicaID\"     TEXT,\n    \"schemaVersion\" INTEGER NOT NULL,\n    \"seededAtMs\"    INTEGER NOT NULL,\n    \"seedWatermark\" TEXT NOT NULL,\n    \"lock\"          INTEGER PRIMARY KEY DEFAULT 1 CHECK (\"lock\" = 1)\n  );\n`;\n\n/**\n * `${replicaFile}-change-log`, matching the `-serving-copy` convention.\n *\n * The name outlives the writer's move into the change-streamer: the\n * change-streamer derives the path from the replica file it owns, so renaming\n * would save no plumbing and would orphan the old file on every existing\n * volume, where nothing would delete it.\n *\n * Its `-wal` / `-wal2` / `-shm` sidecars are suffixes of *this* name, so they\n * never collide with the replica's own sidecars.\n */\nexport function changeLogFileName(replicaFile: string): string {\n  return `${replicaFile}-change-log`;\n}\n\n/**\n * Removes the change-log database and its `-wal` / `-wal2` / `-shm` sidecars.\n * Safe to call when the file does not exist.\n */\nexport function deleteChangeLogDB(replicaFile: string): void {\n  deleteLiteDB(changeLogFileName(replicaFile));\n}\n\n/**\n * Which replica the log's contents belong to.\n *\n * `generation` is RMv1's `replicaVersion`: the version at which initial sync\n * copied every row. It is shared by every sibling of a forked replica, which is\n * why it cannot be the whole of the identity under RMv2 — `epoch` and\n * `replicaID` are what distinguish two siblings' logs. Both are `null` until\n * RMv2 supplies them, and a `null` matches only another `null`, so a log\n * written before they exist is still recognized as this replica's.\n */\nexport type ChangeLogIdentity = {\n  readonly epoch: string | null;\n  readonly generation: string;\n  readonly replicaID: string | null;\n};\n\n/**\n * Where the stream connection resumes, and everything the log's state at that\n * position consists of.\n *\n * The two fields travel together because a cookie set is only meaningful paired\n * with the watermark it was folded up to (invariant 15). They are read from one\n * store, in one snapshot: `Storer.getStartStreamInitializationParameters()`\n * reads both from Postgres in a single REPEATABLE READ transaction. Pairing one\n * store's cookies with another's watermark would silently drop every backfill\n * that completed in the interval, and those rows are unrecoverable — backfill\n * transactions are synthesized by the change source rather than replayed from\n * the slot.\n */\nexport type ChangeLogResumePoint = {\n  /**\n   * The watermark this stream connection resumes from. The log's own head is\n   * measured against it, and a reseed seeds a synthetic transaction at it.\n   *\n   * Deliberately *not* \"the replica's state version\": after the writer moved to\n   * the change-streamer, the canonical replicator is a subscriber downstream of\n   * the write loop, so its state version is a consequence of this log rather\n   * than a constraint on it.\n   */\n  readonly resumeWatermark: string;\n  /**\n   * The cookie set that belongs to {@link resumeWatermark}. Any reconciliation\n   * that moves the head invalidates the set the log was holding — the cookies\n   * are unversioned point-in-time state, and truncating the stream above `W`\n   * does not roll them back to `W` — so the same transaction installs this one\n   * in its place (invariant 17).\n   *\n   * Postgres supplies it while it remains the store the stream resumes from. At\n   * the C5 flip the log's own head *is* the resume point, phantoms cannot\n   * exist, and both this field and the truncate-above path become dead code.\n   */\n  readonly cookies: CookieSet;\n};\n\n/**\n * What the log is reconciled against. Reconciliation runs once per stream\n * connection, since every reconnect can re-read a different resume point.\n */\nexport type ChangeLogAnchor = ChangeLogResumePoint & {\n  readonly identity: ChangeLogIdentity;\n  /**\n   * The change-streamer's clock, at reconciliation time. Supplied rather than\n   * read inline so that tests control it. Used for `seededAtMs` and for the\n   * seed transaction's `writeTimeMs`, which is what the purger's time floor\n   * measures.\n   */\n  readonly nowMs: number;\n};\n\n/** The meta row, i.e. everything the log records about itself. */\nexport type ChangeLogMeta = ChangeLogIdentity & {\n  readonly schemaVersion: number;\n  readonly seededAtMs: number;\n  readonly seedWatermark: string;\n};\n\n/**\n * Opens the change-log database beside `replicaFile`.\n *\n * A writable handle creates the file if it is absent; a `readonly` handle\n * throws, which is the normal state for a change-streamer whose writer is\n * disabled. Pragmas are the caller's responsibility, since only the writer sets\n * the persistent ones.\n */\nexport function openChangeLogDB(\n  lc: LogContext,\n  replicaFile: string,\n  opts: {readonly: boolean},\n): Database {\n  return new Database(\n    lc.withContext('component', 'change-log-db'),\n    changeLogFileName(replicaFile),\n    {readonly: opts.readonly},\n  );\n}\n\n/**\n * Configures the change-log database, which the change-streamer's writer owns\n * exclusively. These are the settings the `separate-files` mode of\n * `sqlite-change-log-ceiling.bench.ts` measured.\n *\n * `wal2` because the log is a continuous append that catchup reads\n * continuously, which is the case wal2 exists for: it avoids checkpoint\n * starvation without needing an autocheckpoint. `wal_autocheckpoint` therefore\n * keeps its default, unlike the backup replica's 0, which hands checkpointing\n * to litestream — nothing else owns this file.\n *\n * `synchronous = NORMAL` because the commit sits on the forward path, once per\n * upstream transaction, and NORMAL keeps that from costing an fsync. It is not\n * a durability compromise here: in WAL mode NORMAL still writes every commit\n * through to the OS, so it survives a process crash, an OOM kill, or a SIGKILL.\n * It is lost only to kernel panic or power loss, and those destroy the node —\n * the task restarts elsewhere, restores the replica from S3, and has no\n * change-log file at all. Whatever a power loss does take is detected by\n * {@link reconcileChangeLog} and reseeded.\n *\n * `auto_vacuum = INCREMENTAL` so that purge can return freed pages to the OS\n * rather than leaving the file at its high-water mark. **It must be the first\n * statement here.** SQLite honours a `none` -> `incremental` transition only\n * while the file is still empty, and `journal_mode = wal2` materializes page 1;\n * appending the pragma instead of prepending it silently leaves the file at\n * mode 0 forever, since neither `DROP TABLE` nor a reseed makes a file empty\n * again. {@link openChangeLogDBForWriting} verifies the result.\n */\nexport function applyChangeLogPragmas(db: Database): void {\n  db.pragma('auto_vacuum = INCREMENTAL');\n  db.pragma('busy_timeout = 30000');\n  db.pragma('analysis_limit = 1000');\n  db.pragma('journal_mode = wal2');\n  db.pragma('synchronous = NORMAL');\n}\n\nfunction readAutoVacuum(db: Database): number {\n  const [{auto_vacuum: mode}] = db.pragma<{auto_vacuum: number}>('auto_vacuum');\n  return mode;\n}\n\n/**\n * Opens the change-log database for the writer, applies its pragmas, and\n * reconciles it against `anchor`, returning the handle and what reconciliation\n * had to do.\n *\n * Corruption is answered with a rebuild rather than an escalation, which is a\n * deliberate divergence from how the replica's own corruption is handled. A\n * corrupt replica is a lost source of truth, so it ends in a restore or an\n * auto-reset; the change log holds nothing that is not either already in the\n * replica's litestream backup or re-derivable from the upstream slot, so the\n * entire response is to delete the file and seed a new one at the resume\n * watermark. The cost is one retention window of catchup — reconnecting\n * subscribers below the head get `too-old` — which is what every other\n * {@link ReseedReason} costs.\n *\n * Only corruption is rebuilt through. Anything else (a bad path, a permissions\n * error, a full disk) is a problem with the environment rather than with the\n * file's contents, and deleting a database in response would destroy state\n * without fixing it. Those propagate to the caller, which disables the writer\n * and keeps replicating.\n *\n * A file that predates `auto_vacuum = INCREMENTAL` takes the same rebuild, for\n * the same reason and at the same cost: the pragma only takes on an empty file,\n * so a reseed cannot enable it. Unlike corruption, a *second* failure there is\n * tolerated rather than thrown — see {@link ensureIncrementalAutoVacuum}.\n */\n/**\n * Returns an anchor after the database opens.\n *\n * The resolver can inspect the existing file before it selects the anchor. A\n * valid log can use its own head. A new or invalid log uses the replica seed.\n * The rebuild path calls the resolver again for the new file.\n */\nexport type AnchorResolver = (db: Database) => ChangeLogAnchor;\n\nexport function openChangeLogDBForWriting(\n  lc: LogContext,\n  replicaFile: string,\n  anchor: AnchorResolver,\n): {db: Database; result: ReconcileResult; replacedFile: boolean} {\n  const existed = existsSync(changeLogFileName(replicaFile));\n  const opened = openOrRebuildCorrupt(lc, replicaFile, anchor, existed);\n  const {db, result, replacedFile} = ensureIncrementalAutoVacuum(\n    lc,\n    replicaFile,\n    anchor,\n    opened,\n  );\n  return {db, result, replacedFile};\n}\n\nfunction openOrRebuildCorrupt(\n  lc: LogContext,\n  replicaFile: string,\n  anchor: AnchorResolver,\n  boundReconciliation: boolean,\n): OpenedChangeLog {\n  try {\n    return openAndReconcile(lc, replicaFile, anchor, boundReconciliation);\n  } catch (e) {\n    if (e instanceof ChangeLogRebuildRequired) {\n      return rebuildChangeLog(lc, replicaFile, anchor, e);\n    }\n    if (!isSQLiteCorruption(e)) {\n      throw e;\n    }\n    const file = changeLogFileName(replicaFile);\n    logSQLiteCorruptionDiagnostics(lc, 'change-log', file, e);\n    lc.error?.('rebuilding the corrupt SQLite change log', {\n      sqliteChangeLog: {file},\n    });\n    return rebuildChangeLog(lc, replicaFile, anchor);\n  }\n}\n\n/**\n * Rebuilds a log whose `auto_vacuum` mode is not `INCREMENTAL`, which is every\n * log created before the pragma shipped — including every v2 file the writer\n * wrote in the meantime, which is why the guard is on the pragma rather than\n * on the schema version. Deleting the file is the only way to enable it:\n * `DROP TABLE` leaves the header's mode intact, and the in-place alternative —\n * a full `VACUUM` — is an unbounded blocking statement on a file the writer\n * needs.\n *\n * A mode that is still wrong after the rebuild is logged and tolerated, which\n * is the one place this diverges from the corruption path. The two failures are\n * not alike: a file that stays corrupt after a rebuild is an environment\n * problem, but a pragma that stays wrong on a brand-new file can only mean\n * {@link applyChangeLogPragmas}' statement order is wrong — a code bug, present\n * on every task, on every start. Throwing there turns a lost optimization into\n * a crash loop, and rebuilding again turns it into a reseed per start, which is\n * worse than the freelist growth it was trying to avoid. `Database.compact()`\n * already warns and no-ops when the mode is not `INCREMENTAL`, so degrading is\n * the accepted fallback.\n */\nfunction ensureIncrementalAutoVacuum(\n  lc: LogContext,\n  replicaFile: string,\n  anchor: AnchorResolver,\n  opened: OpenedChangeLog,\n): OpenedChangeLog {\n  if (opened.autoVacuum === AUTO_VACUUM_INCREMENTAL) {\n    return opened;\n  }\n  const file = changeLogFileName(replicaFile);\n  lc.info?.('rebuilding the SQLite change log to enable incremental vacuum', {\n    sqliteChangeLog: {file, autoVacuum: opened.autoVacuum},\n  });\n  opened.db.close();\n  const rebuilt = rebuildChangeLog(lc, replicaFile, anchor);\n  if (rebuilt.autoVacuum !== AUTO_VACUUM_INCREMENTAL) {\n    lc.error?.(\n      'SQLite change log does not support incremental vacuum; ' +\n        'it will plateau at its high-water mark',\n      {sqliteChangeLog: {file, autoVacuum: rebuilt.autoVacuum}},\n    );\n  }\n  return rebuilt;\n}\n\n/** The shared \"delete the file and open a new one\" body. */\nfunction rebuildChangeLog(\n  lc: LogContext,\n  replicaFile: string,\n  anchor: AnchorResolver,\n  required?: ChangeLogRebuildRequired | undefined,\n): OpenedChangeLog {\n  if (required) {\n    lc.warn?.(\n      'rebuilding the SQLite change log instead of running an unbounded reconciliation',\n      {\n        sqliteChangeLogRebuild: {\n          reason: required.reason,\n          rows: required.rows,\n          estimatedBytes: required.estimatedBytes,\n        },\n      },\n    );\n  }\n  deleteChangeLogDB(replicaFile);\n  // The file is absent, so the reseed only drops empty/nonexistent tables. A\n  // second failure is the environment's, not the old file's.\n  const opened = openAndReconcile(\n    lc,\n    replicaFile,\n    anchor,\n    false,\n    required?.reason,\n  );\n  return {...opened, replacedFile: true};\n}\n\n/**\n * Replaces an already-closed change-log file after bounded reconciliation\n * declined its work. The caller closes cached readers before calling this so\n * none can continue serving the unlinked inode.\n */\nexport function rebuildChangeLogDBForWriting(\n  lc: LogContext,\n  replicaFile: string,\n  anchor: ChangeLogAnchor,\n  required: ChangeLogRebuildRequired,\n): {db: Database; result: ReconcileResult; replacedFile: true} {\n  const {db, result} = rebuildChangeLog(\n    lc,\n    replicaFile,\n    () => anchor,\n    required,\n  );\n  return {db, result, replacedFile: true};\n}\n\ntype OpenedChangeLog = {\n  db: Database;\n  result: ReconcileResult;\n  replacedFile: boolean;\n  /** The file's persistent `auto_vacuum` mode, read back after the pragmas. */\n  autoVacuum: number;\n};\n\nfunction openAndReconcile(\n  lc: LogContext,\n  replicaFile: string,\n  anchor: AnchorResolver,\n  boundReconciliation: boolean,\n  reseedReason?: ReseedReason | undefined,\n): OpenedChangeLog {\n  const db = openChangeLogDB(lc, replicaFile, {readonly: false});\n  try {\n    applyChangeLogPragmas(db);\n    const autoVacuum = readAutoVacuum(db);\n    return {\n      db,\n      result: reconcileChangeLog(lc, db, anchor(db), {\n        rebuildInsteadOfUnboundedWork: boundReconciliation,\n        reseedReason,\n      }),\n      replacedFile: false,\n      autoVacuum,\n    };\n  } catch (e) {\n    // The caller never sees this handle, so it closes here or leaks — and it\n    // must be closed before the corruption path deletes the file.\n    db.close();\n    throw e;\n  }\n}\n\nexport type ReseedReason =\n  | 'created' // file or table absent\n  | 'schema-mismatch'\n  | 'identity-mismatch'\n  | 'gap' // head does not land on the resume watermark after truncation\n  | 'oversized-truncate'; // preserving the prefix would require too much work\n\n/**\n * Reconciliation runs synchronously on the change-streamer's event loop. A\n * normal phantom is one transaction, so work above either limit is answered by\n * unlinking and reseeding this disposable cache rather than deleting an\n * arbitrarily large suffix in place.\n */\nexport const MAX_RECONCILE_TRUNCATE_ROWS = 10_000;\nexport const MAX_RECONCILE_TRUNCATE_BYTES = 16 * 1024 * 1024;\n\nexport class ChangeLogRebuildRequired extends Error {\n  override readonly name = 'ChangeLogRebuildRequired';\n  readonly reason: ReseedReason;\n  readonly rows?: number | undefined;\n  readonly estimatedBytes?: number | undefined;\n\n  constructor(\n    reason: ReseedReason,\n    rows?: number | undefined,\n    estimatedBytes?: number | undefined,\n  ) {\n    super(`SQLite change log requires a ${reason} rebuild`);\n    this.reason = reason;\n    this.rows = rows;\n    this.estimatedBytes = estimatedBytes;\n  }\n}\n\ntype ReconcileOptions = {\n  /** Throw before an unbounded delete/drop so the file owner can unlink it. */\n  readonly rebuildInsteadOfUnboundedWork?: boolean | undefined;\n  /** Preserve the reason that caused an old file to be unlinked. */\n  readonly reseedReason?: ReseedReason | undefined;\n};\n\n/**\n * `cookiesStale` records that the cookie set the log held did not survive\n * reconciliation. The cookies are unversioned point-in-time state, so any\n * reconciliation that moves the head invalidates them, and the same transaction\n * replaces them with the anchor's — the set that belongs to the resume\n * watermark (see `change-log-cookies.ts`). It is `action !== 'none'` today; it\n * is a field rather than a derivation because the replacement reads as intent\n * at the call site, and because it is what the `cookie_reseed` counter is keyed\n * on.\n */\nexport type ReconcileResult =\n  | {action: 'none'; head: string; cookiesStale: false}\n  | {action: 'truncated'; head: string; rows: number; cookiesStale: true}\n  | {\n      action: 'reseeded';\n      head: string;\n      reason: ReseedReason;\n      cookiesStale: true;\n    };\n\n/**\n * Brings the change log into agreement with the watermark its stream connection\n * resumes from, in one transaction on the change-log database:\n *\n * ```\n * head === resumeWatermark  → keep appending\n * head  >  resumeWatermark  → truncate above resumeWatermark\n * otherwise                 → wipe, seed at resumeWatermark, record the reason\n * ```\n *\n * The log commits before anything that can advance the resume watermark, so a\n * *phantom* — a transaction the log holds whose watermark the resumed stream\n * re-delivers — is the normal state, and truncate-above is the whole of\n * reconciliation rather than a special case. A phantom's rows all carry the\n * transaction's commit watermark, which is strictly greater than the resume\n * watermark, so deleting on that predicate removes phantoms whole and retains\n * every transaction at or below the resume point.\n *\n * It must run per stream connection, not once per process: the stream loop\n * re-reads its resume watermark on every reconnect, and the writer inserts with\n * a plain `INSERT` against `PRIMARY KEY (\"watermark\",\"pos\")`, so an\n * un-truncated overlap is a constraint violation on the first re-delivered\n * transaction.\n *\n * Anything truncation cannot resolve — the file was deleted, the writer was\n * disabled for a while, the replica was restored, power was lost with\n * `synchronous=NORMAL` — surfaces as a head that does not land on the resume\n * watermark, and is resolved by wiping and reseeding there.\n *\n * Whichever of the two moves the head also replaces the cookie set with the one\n * the anchor carries, in the same transaction: the head and the cookies are one\n * position, and nothing may observe them at two.\n */\nexport function reconcileChangeLog(\n  lc: LogContext,\n  db: Database,\n  anchor: ChangeLogAnchor,\n  opts: ReconcileOptions = {},\n): ReconcileResult {\n  db.exec('BEGIN IMMEDIATE');\n  try {\n    if (opts.rebuildInsteadOfUnboundedWork) {\n      const required = rebuildRequired(db, anchor);\n      if (required) {\n        throw required;\n      }\n    }\n    const result = opts.reseedReason\n      ? reseed(lc, db, anchor, opts.reseedReason)\n      : reconcile(lc, db, anchor);\n    db.exec('COMMIT');\n    return result;\n  } catch (e) {\n    if (db.inTransaction) {\n      db.exec('ROLLBACK');\n    }\n    throw e;\n  }\n}\n\n/**\n * Decides whether reconciliation can be performed within its synchronous work\n * budget. Every query is either an index seek or a scan capped at one row past\n * the delete limit. No state changes before the decision is complete.\n */\nfunction rebuildRequired(\n  db: Database,\n  anchor: ChangeLogAnchor,\n): ChangeLogRebuildRequired | undefined {\n  const wipe = changeLogWipeReason(db, anchor.identity);\n  if (wipe !== undefined) {\n    return new ChangeLogRebuildRequired(wipe);\n  }\n\n  const head = readChangeLogHead(db);\n  const {resumeWatermark} = anchor;\n  if (head === null || head < resumeWatermark) {\n    return new ChangeLogRebuildRequired('gap');\n  }\n  if (head === resumeWatermark) {\n    return undefined;\n  }\n\n  const boundary = db\n    .prepare(/*sql*/ `\n      SELECT 1 FROM \"${CHANGE_LOG_STREAM_TABLE}\"\n        WHERE \"watermark\" = ?\n        LIMIT 1\n    `)\n    .get<{1: number} | undefined>(resumeWatermark);\n  if (boundary === undefined) {\n    return new ChangeLogRebuildRequired('gap');\n  }\n\n  const {rows, estimatedBytes} = db\n    .prepare(/*sql*/ `\n      SELECT count(*) AS \"rows\",\n             coalesce(sum(\"estimatedBytes\"), 0) AS \"estimatedBytes\"\n        FROM (\n          SELECT \"estimatedBytes\" FROM \"${CHANGE_LOG_STREAM_TABLE}\"\n            WHERE \"watermark\" > ?\n            LIMIT ${MAX_RECONCILE_TRUNCATE_ROWS + 1}\n        )\n    `)\n    .get<{rows: number; estimatedBytes: number}>(resumeWatermark);\n  return rows > MAX_RECONCILE_TRUNCATE_ROWS ||\n    estimatedBytes > MAX_RECONCILE_TRUNCATE_BYTES\n    ? new ChangeLogRebuildRequired('oversized-truncate', rows, estimatedBytes)\n    : undefined;\n}\n\nfunction reconcile(\n  lc: LogContext,\n  db: Database,\n  anchor: ChangeLogAnchor,\n): ReconcileResult {\n  const wipe = changeLogWipeReason(db, anchor.identity);\n  if (wipe !== undefined) {\n    return reseed(lc, db, anchor, wipe);\n  }\n\n  const {resumeWatermark} = anchor;\n  let head = readChangeLogHead(db);\n  let rows = 0;\n  if (head !== null && head > resumeWatermark) {\n    rows = db\n      .prepare(/*sql*/ `\n        DELETE FROM \"${CHANGE_LOG_STREAM_TABLE}\" WHERE \"watermark\" > ?\n      `)\n      .run(resumeWatermark).changes;\n    head = readChangeLogHead(db);\n  }\n\n  if (head !== resumeWatermark) {\n    return reseed(lc, db, anchor, 'gap');\n  }\n  if (rows > 0) {\n    // The truncated transactions can have carried `create-table`,\n    // `add-column`, and `backfill-completed`, none of which the truncate rolls\n    // back, so the cookie set no longer belongs to the head. The anchor's set\n    // does, and it lands in this same transaction: invariant 17 holds at every\n    // point another connection could observe the log.\n    replaceCookies(db, anchor.cookies);\n    lc.info?.('truncated phantom transactions from the SQLite change log', {\n      sqliteChangeLogReconcile: {head, rows, cookies: cookieCounts(anchor)},\n    });\n    return {action: 'truncated', head, rows, cookiesStale: true};\n  }\n  lc.debug?.('SQLite change log is at the resume watermark', {\n    sqliteChangeLogReconcile: {head},\n  });\n  return {action: 'none', head, cookiesStale: false};\n}\n\n/**\n * Returns the reason that the log must be recreated. Returns `undefined` when\n * the writer can continue to use the log.\n *\n * This function takes only the expected identity because callers use the result\n * to select the anchor.\n */\nexport function changeLogWipeReason(\n  db: Database,\n  identity: ChangeLogIdentity,\n): ReseedReason | undefined {\n  if (\n    !tableExists(db, CHANGE_LOG_STREAM_TABLE) ||\n    !tableExists(db, CHANGE_LOG_META_TABLE)\n  ) {\n    return 'created';\n  }\n  // The schema version is read on its own because it is the one column every\n  // version of this table has had. Reading the rest of a v1 row would fail on\n  // its missing columns instead of reporting the mismatch that explains it.\n  const version = db\n    .prepare(/*sql*/ `\n      SELECT \"schemaVersion\" FROM \"${CHANGE_LOG_META_TABLE}\"\n    `)\n    .get<{schemaVersion: number} | undefined>();\n  if (version === undefined) {\n    return 'created';\n  }\n  if (version.schemaVersion !== CHANGE_LOG_DB_SCHEMA_VERSION) {\n    return 'schema-mismatch';\n  }\n  // Checked *after* the version, so that every pre-v4 file — which is every\n  // file in the fleet at the upgrade — reports the `schema-mismatch` that\n  // explains it rather than the `created` its absent cookie tables would\n  // otherwise look like.\n  if (\n    !tableExists(db, CHANGE_LOG_TABLE_METADATA_TABLE) ||\n    !tableExists(db, CHANGE_LOG_BACKFILLING_TABLE)\n  ) {\n    return 'created';\n  }\n  const {epoch, generation, replicaID} = readChangeLogMeta(db);\n  if (\n    epoch !== identity.epoch ||\n    generation !== identity.generation ||\n    replicaID !== identity.replicaID\n  ) {\n    return 'identity-mismatch';\n  }\n  return undefined;\n}\n\nfunction reseed(\n  lc: LogContext,\n  db: Database,\n  anchor: ChangeLogAnchor,\n  reason: ReseedReason,\n): ReconcileResult {\n  const {identity, resumeWatermark, nowMs} = anchor;\n  // Dropping the table drops its partial index with it. The cookie tables go\n  // with the buffer: a cookie set without the transactions it was folded from\n  // is not a smaller cookie set, it is a wrong one.\n  db.exec(/*sql*/ `\n    DROP TABLE IF EXISTS \"${CHANGE_LOG_STREAM_TABLE}\";\n    DROP TABLE IF EXISTS \"${CHANGE_LOG_META_TABLE}\";\n    ${DROP_CHANGE_LOG_COOKIE_TABLES}\n    ${CREATE_CHANGE_LOG_STREAM_SCHEMA}\n    ${CREATE_CHANGE_LOG_META_SCHEMA}\n    ${CREATE_CHANGE_LOG_COOKIE_SCHEMA}\n  `);\n  db.prepare(/*sql*/ `\n    INSERT INTO \"${CHANGE_LOG_META_TABLE}\"\n      (\"epoch\", \"generation\", \"replicaID\", \"schemaVersion\", \"seededAtMs\",\n       \"seedWatermark\")\n      VALUES (@epoch, @generation, @replicaID, @schemaVersion, @seededAtMs,\n              @seedWatermark)\n  `).run({\n    epoch: identity.epoch,\n    generation: identity.generation,\n    replicaID: identity.replicaID,\n    schemaVersion: CHANGE_LOG_DB_SCHEMA_VERSION,\n    seededAtMs: nowMs,\n    seedWatermark: resumeWatermark,\n  });\n  seedChangeLogStream(db, anchor);\n  // Into tables this statement just created, so the wholesale replacement is\n  // all insert. It is still the same call the truncate path makes: a reseed is\n  // the case where the log's cookie set was not merely moved but discarded, and\n  // the anchor's is equally what belongs at the head either way.\n  replaceCookies(db, anchor.cookies);\n\n  lc.info?.('reseeded the SQLite change log', {\n    sqliteChangeLogReconcile: {\n      reason,\n      head: resumeWatermark,\n      ...identity,\n      schemaVersion: CHANGE_LOG_DB_SCHEMA_VERSION,\n      seededAtMs: nowMs,\n      cookies: cookieCounts(anchor),\n    },\n  });\n  return {\n    action: 'reseeded',\n    head: resumeWatermark,\n    reason,\n    cookiesStale: true,\n  };\n}\n\n/**\n * Seeds a valid synthetic transaction at the anchor's resume watermark, making\n * an otherwise empty log serviceable as a catchup boundary for a subscriber\n * that is exactly at that watermark.\n */\nexport function seedChangeLogStream(\n  db: Database,\n  anchor: ChangeLogAnchor,\n): void {\n  const beginChange = '{\"tag\":\"begin\"}';\n  const commitChange = '{\"tag\":\"commit\"}';\n  db.prepare(SEED_CHANGE_LOG_STREAM_SQL).run({\n    watermark: anchor.resumeWatermark,\n    beginBytes: estimateChangeLogStreamRowBytes(\n      anchor.resumeWatermark,\n      'begin',\n      beginChange,\n    ),\n    beginChange,\n    commitBytes: estimateChangeLogStreamRowBytes(\n      anchor.resumeWatermark,\n      'commit',\n      commitChange,\n      anchor.resumeWatermark,\n      true,\n    ),\n    commitChange,\n    writeTimeMs: anchor.nowMs,\n  });\n}\n\n/** Reads the whole meta row. Throws if the log has not been reconciled. */\nexport function readChangeLogMeta(db: Database): ChangeLogMeta {\n  const meta = db\n    .prepare(/*sql*/ `\n      SELECT \"epoch\", \"generation\", \"replicaID\", \"schemaVersion\",\n             \"seededAtMs\", \"seedWatermark\"\n        FROM \"${CHANGE_LOG_META_TABLE}\"\n    `)\n    .get<ChangeLogMeta | undefined>();\n  if (meta === undefined) {\n    throw new Error('the SQLite change log has no meta row');\n  }\n  return meta;\n}\n\n/**\n * `max()` on the primary key's leading column, i.e. an index seek. Null when\n * the log is empty.\n */\nexport function readChangeLogHead(db: Database): string | null {\n  const {head} = db\n    .prepare(/*sql*/ `\n      SELECT max(\"watermark\") AS \"head\" FROM \"${CHANGE_LOG_STREAM_TABLE}\"\n    `)\n    .get<{head: string | null}>();\n  return head;\n}\n\n/**\n * The covered watermark range. Both scalar subqueries seek the watermark\n * index, so unlike a `count()` this does not scan the log. Both bounds are\n * null when it is empty.\n */\nexport function readChangeLogBounds(db: Database): ChangeLogBounds {\n  return db\n    .prepare(/*sql*/ `\n      SELECT\n        (SELECT min(\"watermark\") FROM \"${CHANGE_LOG_STREAM_TABLE}\")\n          AS \"minWatermark\",\n        (SELECT max(\"watermark\") FROM \"${CHANGE_LOG_STREAM_TABLE}\")\n          AS \"headWatermark\"\n    `)\n    .get<ChangeLogBounds>();\n}\n\nexport type ChangeLogBounds = {\n  readonly minWatermark: string | null;\n  readonly headWatermark: string | null;\n};\n\n/**\n * What was installed, for the reconcile log line. Normally `{0, 0}`: a nonzero\n * `backfilling` means the resumed stream is being handed backfills to re-request.\n */\nfunction cookieCounts({cookies}: ChangeLogAnchor) {\n  return {\n    tableMetadata: cookies.tableMetadata.length,\n    backfilling: cookies.backfilling.length,\n  };\n}\n\nfunction tableExists(db: Database, table: string): boolean {\n  return (\n    db\n      .prepare(/*sql*/ `\n        SELECT 1 FROM \"sqlite_master\" WHERE \"type\" = 'table' AND \"name\" = ?\n      `)\n      .get<{1: number} | undefined>(table) !== undefined\n  );\n}\n"],"mappings":";;;;;;AAmFA,IAAM,0BAA0B;AAEhC,IAAa,0BAA0B;AACvC,IAAa,qCACX;AAEF,IAAM,gBAAgB;;;;;;AAOtB,SAAgB,gCACd,WACA,KACA,QACA,WACA,eAAe,OACP;CACR,OACE,OAAO,WAAW,SAAS,IAC3B,gBACA,OAAO,WAAW,GAAG,IACrB,OAAO,WAAW,MAAM,KACvB,cAAc,KAAA,IAAY,IAAI,OAAO,WAAW,SAAS,MACzD,eAAe,gBAAgB;AAEpC;AAUA,IAAa,kCAA0C;kBACrC,wBAAwB;;;;;;;;;;;kBAWxB,mCAAmC;UAC3C,wBAAwB;;;;;;;;;AAUlC,IAAM,6BAAqC;iBAC1B,wBAAwB;;;;;;;;;AAUzC,IAAa,wBAAwB;AAerC,IAAM,gCAAwC;kBAC5B,sBAAsB;;;;;;;;;;;;;;;;;;;;;AAsBxC,SAAgB,kBAAkB,aAA6B;CAC7D,OAAO,GAAG,YAAY;AACxB;;;;;AAMA,SAAgB,kBAAkB,aAA2B;CAC3D,aAAa,kBAAkB,WAAW,CAAC;AAC7C;;;;;;;;;AAsFA,SAAgB,gBACd,IACA,aACA,MACU;CACV,OAAO,IAAI,SACT,GAAG,YAAY,aAAa,eAAe,GAC3C,kBAAkB,WAAW,GAC7B,EAAC,UAAU,KAAK,SAAQ,CAC1B;AACF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8BA,SAAgB,sBAAsB,IAAoB;CACxD,GAAG,OAAO,2BAA2B;CACrC,GAAG,OAAO,sBAAsB;CAChC,GAAG,OAAO,uBAAuB;CACjC,GAAG,OAAO,qBAAqB;CAC/B,GAAG,OAAO,sBAAsB;AAClC;AAEA,SAAS,eAAe,IAAsB;CAC5C,MAAM,CAAC,EAAC,aAAa,UAAS,GAAG,OAA8B,aAAa;CAC5E,OAAO;AACT;AAqCA,SAAgB,0BACd,IACA,aACA,QACgE;CAGhE,MAAM,EAAC,IAAI,QAAQ,iBAAgB,4BACjC,IACA,aACA,QAJa,qBAAqB,IAAI,aAAa,QADrC,WAAW,kBAAkB,WAAW,CACK,CAK3D,CACF;CACA,OAAO;EAAC;EAAI;EAAQ;CAAY;AAClC;AAEA,SAAS,qBACP,IACA,aACA,QACA,qBACiB;CACjB,IAAI;EACF,OAAO,iBAAiB,IAAI,aAAa,QAAQ,mBAAmB;CACtE,SAAS,GAAG;EACV,IAAI,aAAa,0BACf,OAAO,iBAAiB,IAAI,aAAa,QAAQ,CAAC;EAEpD,IAAI,CAAC,mBAAmB,CAAC,GACvB,MAAM;EAER,MAAM,OAAO,kBAAkB,WAAW;EAC1C,+BAA+B,IAAI,cAAc,MAAM,CAAC;EACxD,GAAG,QAAQ,4CAA4C,EACrD,iBAAiB,EAAC,KAAI,EACxB,CAAC;EACD,OAAO,iBAAiB,IAAI,aAAa,MAAM;CACjD;AACF;;;;;;;;;;;;;;;;;;;;;AAsBA,SAAS,4BACP,IACA,aACA,QACA,QACiB;CACjB,IAAI,OAAO,eAAe,yBACxB,OAAO;CAET,MAAM,OAAO,kBAAkB,WAAW;CAC1C,GAAG,OAAO,iEAAiE,EACzE,iBAAiB;EAAC;EAAM,YAAY,OAAO;CAAU,EACvD,CAAC;CACD,OAAO,GAAG,MAAM;CAChB,MAAM,UAAU,iBAAiB,IAAI,aAAa,MAAM;CACxD,IAAI,QAAQ,eAAe,yBACzB,GAAG,QACD,iGAEA,EAAC,iBAAiB;EAAC;EAAM,YAAY,QAAQ;CAAU,EAAC,CAC1D;CAEF,OAAO;AACT;;AAGA,SAAS,iBACP,IACA,aACA,QACA,UACiB;CACjB,IAAI,UACF,GAAG,OACD,mFACA,EACE,wBAAwB;EACtB,QAAQ,SAAS;EACjB,MAAM,SAAS;EACf,gBAAgB,SAAS;CAC3B,EACF,CACF;CAEF,kBAAkB,WAAW;CAU7B,OAAO;EAAC,GAPO,iBACb,IACA,aACA,QACA,OACA,UAAU,MAED;EAAQ,cAAc;CAAI;AACvC;;;;;;AAOA,SAAgB,6BACd,IACA,aACA,QACA,UAC6D;CAC7D,MAAM,EAAC,IAAI,WAAU,iBACnB,IACA,mBACM,QACN,QACF;CACA,OAAO;EAAC;EAAI;EAAQ,cAAc;CAAI;AACxC;AAUA,SAAS,iBACP,IACA,aACA,QACA,qBACA,cACiB;CACjB,MAAM,KAAK,gBAAgB,IAAI,aAAa,EAAC,UAAU,MAAK,CAAC;CAC7D,IAAI;EACF,sBAAsB,EAAE;EACxB,MAAM,aAAa,eAAe,EAAE;EACpC,OAAO;GACL;GACA,QAAQ,mBAAmB,IAAI,IAAI,OAAO,EAAE,GAAG;IAC7C,+BAA+B;IAC/B;GACF,CAAC;GACD,cAAc;GACd;EACF;CACF,SAAS,GAAG;EAGV,GAAG,MAAM;EACT,MAAM;CACR;AACF;;;;;;;AAeA,IAAa,8BAA8B;AAG3C,IAAa,2BAAb,cAA8C,MAAM;CAClD,OAAyB;CACzB;CACA;CACA;CAEA,YACE,QACA,MACA,gBACA;EACA,MAAM,gCAAgC,OAAO,SAAS;EACtD,KAAK,SAAS;EACd,KAAK,OAAO;EACZ,KAAK,iBAAiB;CACxB;AACF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8DA,SAAgB,mBACd,IACA,IACA,QACA,OAAyB,CAAC,GACT;CACjB,GAAG,KAAK,iBAAiB;CACzB,IAAI;EACF,IAAI,KAAK,+BAA+B;GACtC,MAAM,WAAW,gBAAgB,IAAI,MAAM;GAC3C,IAAI,UACF,MAAM;EAEV;EACA,MAAM,SAAS,KAAK,eAChB,OAAO,IAAI,IAAI,QAAQ,KAAK,YAAY,IACxC,UAAU,IAAI,IAAI,MAAM;EAC5B,GAAG,KAAK,QAAQ;EAChB,OAAO;CACT,SAAS,GAAG;EACV,IAAI,GAAG,eACL,GAAG,KAAK,UAAU;EAEpB,MAAM;CACR;AACF;;;;;;AAOA,SAAS,gBACP,IACA,QACsC;CACtC,MAAM,OAAO,oBAAoB,IAAI,OAAO,QAAQ;CACpD,IAAI,SAAS,KAAA,GACX,OAAO,IAAI,yBAAyB,IAAI;CAG1C,MAAM,OAAO,kBAAkB,EAAE;CACjC,MAAM,EAAC,oBAAmB;CAC1B,IAAI,SAAS,QAAQ,OAAO,iBAC1B,OAAO,IAAI,yBAAyB,KAAK;CAE3C,IAAI,SAAS,iBACX;CAUF,IAPiB,GACd,QAAgB;;;;KAIhB,EACA,IAA6B,eAC5B,MAAa,KAAA,GACf,OAAO,IAAI,yBAAyB,KAAK;CAG3C,MAAM,EAAC,MAAM,mBAAkB,GAC5B,QAAgB;;;;0CAIqB,wBAAwB;;oBAE9C,8BAA8B,EAAE;;KAE/C,EACA,IAA4C,eAAe;CAC9D,OAAO,OAAA,OACL,iBAAA,WACE,IAAI,yBAAyB,sBAAsB,MAAM,cAAc,IACvE,KAAA;AACN;AAEA,SAAS,UACP,IACA,IACA,QACiB;CACjB,MAAM,OAAO,oBAAoB,IAAI,OAAO,QAAQ;CACpD,IAAI,SAAS,KAAA,GACX,OAAO,OAAO,IAAI,IAAI,QAAQ,IAAI;CAGpC,MAAM,EAAC,oBAAmB;CAC1B,IAAI,OAAO,kBAAkB,EAAE;CAC/B,IAAI,OAAO;CACX,IAAI,SAAS,QAAQ,OAAO,iBAAiB;EAC3C,OAAO,GACJ,QAAgB;uBACA,wBAAwB;OACxC,EACA,IAAI,eAAe,EAAE;EACxB,OAAO,kBAAkB,EAAE;CAC7B;CAEA,IAAI,SAAS,iBACX,OAAO,OAAO,IAAI,IAAI,QAAQ,KAAK;CAErC,IAAI,OAAO,GAAG;EAMZ,eAAe,IAAI,OAAO,OAAO;EACjC,GAAG,OAAO,6DAA6D,EACrE,0BAA0B;GAAC;GAAM;GAAM,SAAS,aAAa,MAAM;EAAC,EACtE,CAAC;EACD,OAAO;GAAC,QAAQ;GAAa;GAAM;GAAM,cAAc;EAAI;CAC7D;CACA,GAAG,QAAQ,gDAAgD,EACzD,0BAA0B,EAAC,KAAI,EACjC,CAAC;CACD,OAAO;EAAC,QAAQ;EAAQ;EAAM,cAAc;CAAK;AACnD;;;;;;;;AASA,SAAgB,oBACd,IACA,UAC0B;CAC1B,IACE,CAAC,YAAY,IAAA,uBAA2B,KACxC,CAAC,YAAY,IAAA,qBAAyB,GAEtC,OAAO;CAKT,MAAM,UAAU,GACb,QAAgB;qCACgB,sBAAsB;KACtD,EACA,IAAyC;CAC5C,IAAI,YAAY,KAAA,GACd,OAAO;CAET,IAAI,QAAQ,kBAAA,GACV,OAAO;CAMT,IACE,CAAC,YAAY,IAAA,8BAAmC,KAChD,CAAC,YAAY,IAAA,4BAAgC,GAE7C,OAAO;CAET,MAAM,EAAC,OAAO,YAAY,cAAa,kBAAkB,EAAE;CAC3D,IACE,UAAU,SAAS,SACnB,eAAe,SAAS,cACxB,cAAc,SAAS,WAEvB,OAAO;AAGX;AAEA,SAAS,OACP,IACA,IACA,QACA,QACiB;CACjB,MAAM,EAAC,UAAU,iBAAiB,UAAS;CAI3C,GAAG,KAAa;4BACU,wBAAwB;4BACxB,sBAAsB;MAC5C,8BAA8B;MAC9B,gCAAgC;MAChC,8BAA8B;MAC9B,gCAAgC;GACnC;CACD,GAAG,QAAgB;mBACF,sBAAsB;;;;;GAKtC,EAAE,IAAI;EACL,OAAO,SAAS;EAChB,YAAY,SAAS;EACrB,WAAW,SAAS;EACpB,eAAA;EACA,YAAY;EACZ,eAAe;CACjB,CAAC;CACD,oBAAoB,IAAI,MAAM;CAK9B,eAAe,IAAI,OAAO,OAAO;CAEjC,GAAG,OAAO,kCAAkC,EAC1C,0BAA0B;EACxB;EACA,MAAM;EACN,GAAG;EACH,eAAA;EACA,YAAY;EACZ,SAAS,aAAa,MAAM;CAC9B,EACF,CAAC;CACD,OAAO;EACL,QAAQ;EACR,MAAM;EACN;EACA,cAAc;CAChB;AACF;;;;;;AAOA,SAAgB,oBACd,IACA,QACM;CACN,MAAM,cAAc;CACpB,MAAM,eAAe;CACrB,GAAG,QAAQ,0BAA0B,EAAE,IAAI;EACzC,WAAW,OAAO;EAClB,YAAY,gCACV,OAAO,iBACP,SACA,WACF;EACA;EACA,aAAa,gCACX,OAAO,iBACP,UACA,cACA,OAAO,iBACP,IACF;EACA;EACA,aAAa,OAAO;CACtB,CAAC;AACH;;AAGA,SAAgB,kBAAkB,IAA6B;CAC7D,MAAM,OAAO,GACV,QAAgB;;;gBAGL,sBAAsB;KACjC,EACA,IAA+B;CAClC,IAAI,SAAS,KAAA,GACX,MAAM,IAAI,MAAM,uCAAuC;CAEzD,OAAO;AACT;;;;;AAMA,SAAgB,kBAAkB,IAA6B;CAC7D,MAAM,EAAC,SAAQ,GACZ,QAAgB;gDAC2B,wBAAwB;KACnE,EACA,IAA2B;CAC9B,OAAO;AACT;;;;;;AAOA,SAAgB,oBAAoB,IAA+B;CACjE,OAAO,GACJ,QAAgB;;yCAEoB,wBAAwB;;yCAExB,wBAAwB;;KAE5D,EACA,IAAqB;AAC1B;;;;;AAWA,SAAS,aAAa,EAAC,WAA2B;CAChD,OAAO;EACL,eAAe,QAAQ,cAAc;EACrC,aAAa,QAAQ,YAAY;CACnC;AACF;AAEA,SAAS,YAAY,IAAc,OAAwB;CACzD,OACE,GACG,QAAgB;;OAEhB,EACA,IAA6B,KAAK,MAAM,KAAA;AAE/C"}
+{"version":3,"file":"change-log-db.js","names":[],"sources":["../../../../../../zero-cache/src/services/replicator/change-log-db.ts"],"sourcesContent":["/**\n * The change log lives in its own SQLite database, `${replicaFile}-change-log`,\n * rather than in the replica file. It is a catchup cache: everything it holds is\n * either already durable in the replica's litestream backup or re-derivable from\n * the upstream replication slot, so it is deliberately excluded from the backup\n * and is never a source of truth.\n *\n * The change-streamer writes it, from the stream loop that fans changes out to\n * subscribers, and commits it before forwarding each transaction's `commit`\n * message. Its head is therefore always at or above the watermark the stream\n * would resume from, which is what {@link reconcileChangeLog} anchors on.\n *\n * Beside the buffer it holds the log's *cookie jar* — the backfill progress\n * state folded up to the same head. That is `change-log-cookies.ts`; this file\n * owns its tables' lifecycle, because a cookie set is only meaningful paired\n * with the watermark it was folded to, and so must be created, dropped, and —\n * whenever reconciliation moves the head — replaced with the anchor's, all with\n * the buffer rather than beside it.\n *\n * Because it is disposable, it has no migration framework. Any inconsistency —\n * a schema change, a leftover file from a different replica, a gap left by a\n * crash or by running with the writer disabled, a corrupt file — is resolved by\n * {@link reconcileChangeLog} and {@link openChangeLogDBForWriting}, which\n * truncate a bounded suffix or replace and reseed the log at the resume\n * watermark. The worst outcome is a `too-old` for a lagging subscriber; a\n * silently delivered gap is not reachable.\n *\n * Disk sizing: a task that writes the log needs room for the replica *plus* the\n * retained change stream — the log's main file, its wal2 sidecars, and pages a\n * purge has freed but not yet returned to the OS. The change-streamer schedules\n * purges against the same floor as the PG change log, so retention is bounded\n * by the confirmed backup watermark ANDed with the minimum retention window —\n * a function of the backup interval, not a constant: 15–30+ minutes behind an\n * RMv1 sync interval, ~60 seconds once litestream v5 backs up every 15–30 s.\n * A held snapshot reservation pins retention unboundedly for its duration, so\n * peak retained bytes is set by the slowest concurrent restore rather than by\n * the retention setting — size disk and alerts on that. The log is excluded\n * from the litestream backup, so this is local disk only and never S3.\n */\n\nimport {existsSync} from 'node:fs';\nimport type {LogContext} from '@rocicorp/logger';\nimport {Database} from '../../../../zqlite/src/db.ts';\nimport {deleteLiteDB} from '../../db/delete-lite-db.ts';\nimport {\n  isSQLiteCorruption,\n  logSQLiteCorruptionDiagnostics,\n} from '../../db/sqlite-corruption.ts';\nimport {\n  CHANGE_LOG_BACKFILLING_TABLE,\n  CHANGE_LOG_TABLE_METADATA_TABLE,\n  CREATE_CHANGE_LOG_COOKIE_SCHEMA,\n  DROP_CHANGE_LOG_COOKIE_TABLES,\n  replaceCookies,\n  type CookieSet,\n} from './change-log-cookies.ts';\n\n/**\n * Bumped whenever the change-log database's schema changes. Since the file is a\n * cache, a mismatch costs one reseed rather than a migration.\n *\n * v2 re-homed the writer to the change-streamer: the log anchors on the\n * watermark its stream connection resumes from rather than on the replica's\n * state version, and its meta row carries the replica's identity triple plus\n * the seed point.\n *\n * v3 added the cookie tables (see `change-log-cookies.ts`), i.e. the log's\n * second job. The reseed it costs on upgrade buys one retention window of\n * catchup reach on a log nothing reads yet.\n *\n * v4 stores each row's tag and estimated retained bytes alongside its JSON.\n * Readers can now filter without parsing arbitrary row payloads, and\n * reconciliation can bound truncation by bytes as well as rows.\n *\n * `auto_vacuum = INCREMENTAL` arrived within v2, deliberately without a bump:\n * it is a file-header property rather than a schema change, and the reseed a\n * version mismatch triggers cannot enable it (see\n * {@link applyChangeLogPragmas}), so {@link openChangeLogDBForWriting} guards\n * on the pragma itself instead of on this number.\n */\nexport const CHANGE_LOG_DB_SCHEMA_VERSION = 4;\n\n/** https://www.sqlite.org/pragma.html#pragma_auto_vacuum */\nconst AUTO_VACUUM_INCREMENTAL = 2;\n\nexport const CHANGE_LOG_STREAM_TABLE = '_zero.changeLogStream';\nexport const CHANGE_LOG_STREAM_WRITE_TIME_INDEX =\n  '_zero.changeLogStream_writeTimeMs';\n\nconst INTEGER_BYTES = 8;\n\n/**\n * Estimates the retained payload size of a stream row. This deliberately does\n * not claim to measure SQLite b-tree/page overhead; it is stable across the\n * write path, reconciliation, and the startup scan used by observability.\n */\nexport function estimateChangeLogStreamRowBytes(\n  watermark: string,\n  tag: string,\n  change: string,\n  precommit?: string,\n  hasWriteTime = false,\n): number {\n  return (\n    Buffer.byteLength(watermark) +\n    INTEGER_BYTES +\n    Buffer.byteLength(tag) +\n    Buffer.byteLength(change) +\n    (precommit === undefined ? 0 : Buffer.byteLength(precommit)) +\n    (hasWriteTime ? INTEGER_BYTES : 0)\n  );\n}\n\n// The index is partial because only commit rows carry a \"writeTimeMs\", so it\n// holds one entry per transaction rather than one per change. It is what the\n// purger scans to find transactions older than the retention window.\n//\n// Pre-release builds briefly carried this table in the replica; see the test\n// fixture `CREATE_V14_CHANGE_LOG_STREAM` in\n// `change-source/common/replica-schema.ts`. Its old shape must not be kept in\n// sync with this one.\nexport const CREATE_CHANGE_LOG_STREAM_SCHEMA = /*sql*/ `\n  CREATE TABLE \"${CHANGE_LOG_STREAM_TABLE}\" (\n    \"watermark\"      TEXT NOT NULL,\n    \"pos\"            INTEGER NOT NULL,\n    \"tag\"            TEXT NOT NULL,\n    \"estimatedBytes\"  INTEGER NOT NULL,\n    \"change\"          TEXT NOT NULL,\n    \"precommit\"       TEXT,\n    \"writeTimeMs\"     INTEGER,\n    PRIMARY KEY (\"watermark\", \"pos\")\n  );\n\n  CREATE INDEX \"${CHANGE_LOG_STREAM_WRITE_TIME_INDEX}\"\n    ON \"${CHANGE_LOG_STREAM_TABLE}\" (\"writeTimeMs\", \"watermark\")\n    WHERE \"writeTimeMs\" IS NOT NULL;\n`;\n\n/**\n * Inserts the synthetic begin/commit pair for the seed watermark.\n *\n * Both rows are inserted by one statement so a caller outside a larger\n * transaction cannot leave a partial seed.\n */\nconst SEED_CHANGE_LOG_STREAM_SQL = /*sql*/ `\n  INSERT INTO \"${CHANGE_LOG_STREAM_TABLE}\"\n    (\"watermark\", \"pos\", \"tag\", \"estimatedBytes\", \"change\", \"precommit\",\n     \"writeTimeMs\")\n  VALUES\n    (@watermark, 0, 'begin', @beginBytes, @beginChange, NULL, NULL),\n    (@watermark, 1, 'commit', @commitBytes, @commitChange, @watermark,\n     @writeTimeMs)\n  ON CONFLICT (\"watermark\", \"pos\") DO NOTHING\n`;\n\nexport const CHANGE_LOG_META_TABLE = '_zero.changeLogMeta';\n\n// The identity triple (see ChangeLogIdentity) detects a file left behind by a\n// different replica -- most concretely, a leftover log on a reused volume.\n//\n// \"seededAtMs\"    : when the log was seeded, i.e. how far its retention window\n//                   can possibly reach back. Slice 11 uses it as the warm-up\n//                   signal for canary reads.\n// \"seedWatermark\" : where the log was seeded. `min(\"watermark\")` cannot answer\n//                   this once purge has advanced the minimum, and the\n//                   difference is what distinguishes a log that purged past the\n//                   retention floor (an invariant violation) from one that\n//                   never held that history at all (routine at every fork).\n// \"lock\"          : enforces single-row semantics, as in\n//                   \"_zero.replicationConfig\".\nconst CREATE_CHANGE_LOG_META_SCHEMA = /*sql*/ `\n  CREATE TABLE \"${CHANGE_LOG_META_TABLE}\" (\n    \"epoch\"         TEXT,\n    \"generation\"    TEXT NOT NULL,\n    \"replicaID\"     TEXT,\n    \"schemaVersion\" INTEGER NOT NULL,\n    \"seededAtMs\"    INTEGER NOT NULL,\n    \"seedWatermark\" TEXT NOT NULL,\n    \"lock\"          INTEGER PRIMARY KEY DEFAULT 1 CHECK (\"lock\" = 1)\n  );\n`;\n\n/**\n * `${replicaFile}-change-log`, matching the `-serving-copy` convention.\n *\n * The name outlives the writer's move into the change-streamer: the\n * change-streamer derives the path from the replica file it owns, so renaming\n * would save no plumbing and would orphan the old file on every existing\n * volume, where nothing would delete it.\n *\n * Its `-wal` / `-wal2` / `-shm` sidecars are suffixes of *this* name, so they\n * never collide with the replica's own sidecars.\n */\nexport function changeLogFileName(replicaFile: string): string {\n  return `${replicaFile}-change-log`;\n}\n\n/**\n * Removes the change-log database and its `-wal` / `-wal2` / `-shm` sidecars.\n * Safe to call when the file does not exist.\n */\nexport function deleteChangeLogDB(replicaFile: string): void {\n  deleteLiteDB(changeLogFileName(replicaFile));\n}\n\n/**\n * Which replica the log's contents belong to.\n *\n * `generation` is RMv1's `replicaVersion`: the version at which initial sync\n * copied every row. It is shared by every sibling of a forked replica, which is\n * why it cannot be the whole of the identity under RMv2 — `epoch` and\n * `replicaID` are what distinguish two siblings' logs. Both are `null` until\n * RMv2 supplies them, and a `null` matches only another `null`, so a log\n * written before they exist is still recognized as this replica's.\n */\nexport type ChangeLogIdentity = {\n  readonly epoch: string | null;\n  readonly generation: string;\n  readonly replicaID: string | null;\n};\n\n/**\n * Where the stream connection resumes, and everything the log's state at that\n * position consists of.\n *\n * The two fields travel together because a cookie set is only meaningful paired\n * with the watermark it was folded up to (invariant 15). They are read from one\n * store, in one snapshot: `Storer.getStartStreamInitializationParameters()`\n * reads both from Postgres in a single REPEATABLE READ transaction. Pairing one\n * store's cookies with another's watermark would silently drop every backfill\n * that completed in the interval, and those rows are unrecoverable — backfill\n * transactions are synthesized by the change source rather than replayed from\n * the slot.\n */\nexport type ChangeLogResumePoint = {\n  /**\n   * The watermark this stream connection resumes from. The log's own head is\n   * measured against it, and a reseed seeds a synthetic transaction at it.\n   *\n   * Deliberately *not* \"the replica's state version\": after the writer moved to\n   * the change-streamer, the canonical replicator is a subscriber downstream of\n   * the write loop, so its state version is a consequence of this log rather\n   * than a constraint on it.\n   */\n  readonly resumeWatermark: string;\n  /**\n   * The cookie set that belongs to {@link resumeWatermark}. Any reconciliation\n   * that moves the head invalidates the set the log was holding — the cookies\n   * are unversioned point-in-time state, and truncating the stream above `W`\n   * does not roll them back to `W` — so the same transaction installs this one\n   * in its place (invariant 17).\n   *\n   * Postgres supplies it while it remains the store the stream resumes from. At\n   * the C5 flip the log's own head *is* the resume point, phantoms cannot\n   * exist, and both this field and the truncate-above path become dead code.\n   */\n  readonly cookies: CookieSet;\n};\n\n/**\n * What the log is reconciled against. Reconciliation runs once per stream\n * connection, since every reconnect can re-read a different resume point.\n */\nexport type ChangeLogAnchor = ChangeLogResumePoint & {\n  readonly identity: ChangeLogIdentity;\n  /**\n   * The change-streamer's clock, at reconciliation time. Supplied rather than\n   * read inline so that tests control it. Used for `seededAtMs` and for the\n   * seed transaction's `writeTimeMs`, which is what the purger's time floor\n   * measures.\n   */\n  readonly nowMs: number;\n};\n\n/** The meta row, i.e. everything the log records about itself. */\nexport type ChangeLogMeta = ChangeLogIdentity & {\n  readonly schemaVersion: number;\n  readonly seededAtMs: number;\n  readonly seedWatermark: string;\n};\n\n/**\n * Opens the change-log database beside `replicaFile`.\n *\n * A writable handle creates the file if it is absent; a `readonly` handle\n * throws, which is the normal state for a change-streamer whose writer is\n * disabled. Pragmas are the caller's responsibility, since only the writer sets\n * the persistent ones.\n */\nexport function openChangeLogDB(\n  lc: LogContext,\n  replicaFile: string,\n  opts: {readonly: boolean},\n): Database {\n  return new Database(\n    lc.withContext('component', 'change-log-db'),\n    changeLogFileName(replicaFile),\n    {readonly: opts.readonly},\n  );\n}\n\n/**\n * Configures the change-log database, which the change-streamer's writer owns\n * exclusively. These are the settings the `separate-files` mode of\n * `sqlite-change-log-ceiling.bench.ts` measured.\n *\n * `wal2` because the log is a continuous append that catchup reads\n * continuously, which is the case wal2 exists for: it avoids checkpoint\n * starvation without needing an autocheckpoint. `wal_autocheckpoint` therefore\n * keeps its default, unlike the backup replica's 0, which hands checkpointing\n * to litestream — nothing else owns this file.\n *\n * `synchronous = NORMAL` because the commit sits on the forward path, once per\n * upstream transaction, and NORMAL keeps that from costing an fsync. It is not\n * a durability compromise here: in WAL mode NORMAL still writes every commit\n * through to the OS, so it survives a process crash, an OOM kill, or a SIGKILL.\n * It is lost only to kernel panic or power loss, and those destroy the node —\n * the task restarts elsewhere, restores the replica from S3, and has no\n * change-log file at all. Whatever a power loss does take is detected by\n * {@link reconcileChangeLog} and reseeded.\n *\n * `auto_vacuum = INCREMENTAL` so that purge can return freed pages to the OS\n * rather than leaving the file at its high-water mark. **It must be the first\n * statement here.** SQLite honours a `none` -> `incremental` transition only\n * while the file is still empty, and `journal_mode = wal2` materializes page 1;\n * appending the pragma instead of prepending it silently leaves the file at\n * mode 0 forever, since neither `DROP TABLE` nor a reseed makes a file empty\n * again. {@link openChangeLogDBForWriting} verifies the result.\n */\nexport function applyChangeLogPragmas(db: Database): void {\n  db.pragma('auto_vacuum = INCREMENTAL');\n  db.pragma('busy_timeout = 30000');\n  db.pragma('analysis_limit = 1000');\n  db.pragma('journal_mode = wal2');\n  db.pragma('synchronous = NORMAL');\n}\n\nfunction readAutoVacuum(db: Database): number {\n  const [{auto_vacuum: mode}] = db.pragma<{auto_vacuum: number}>('auto_vacuum');\n  return mode;\n}\n\n/**\n * Opens the change-log database for the writer, applies its pragmas, and\n * reconciles it against `anchor`, returning the handle and what reconciliation\n * had to do.\n *\n * Corruption is answered with a rebuild rather than an escalation, which is a\n * deliberate divergence from how the replica's own corruption is handled. A\n * corrupt replica is a lost source of truth, so it ends in a restore or an\n * auto-reset; the change log holds nothing that is not either already in the\n * replica's litestream backup or re-derivable from the upstream slot, so the\n * entire response is to delete the file and seed a new one at the resume\n * watermark. The cost is one retention window of catchup — reconnecting\n * subscribers below the head get `too-old` — which is what every other\n * {@link ReseedReason} costs.\n *\n * Only corruption is rebuilt through. Anything else (a bad path, a permissions\n * error, a full disk) is a problem with the environment rather than with the\n * file's contents, and deleting a database in response would destroy state\n * without fixing it. Those propagate to the caller, which disables the writer\n * and keeps replicating.\n *\n * A file that predates `auto_vacuum = INCREMENTAL` takes the same rebuild, for\n * the same reason and at the same cost: the pragma only takes on an empty file,\n * so a reseed cannot enable it. Unlike corruption, a *second* failure there is\n * tolerated rather than thrown — see {@link ensureIncrementalAutoVacuum}.\n */\n/**\n * Returns an anchor after the database opens.\n *\n * The resolver can inspect the existing file before it selects the anchor. A\n * valid log can use its own head. A new or invalid log uses the replica seed.\n * The rebuild path calls the resolver again for the new file.\n */\nexport type AnchorResolver = (db: Database) => ChangeLogAnchor;\n\nexport function openChangeLogDBForWriting(\n  lc: LogContext,\n  replicaFile: string,\n  anchor: AnchorResolver,\n): {db: Database; result: ReconcileResult; replacedFile: boolean} {\n  const existed = existsSync(changeLogFileName(replicaFile));\n  const opened = openOrRebuildCorrupt(lc, replicaFile, anchor, existed);\n  const {db, result, replacedFile} = ensureIncrementalAutoVacuum(\n    lc,\n    replicaFile,\n    anchor,\n    opened,\n  );\n  return {db, result, replacedFile};\n}\n\nfunction openOrRebuildCorrupt(\n  lc: LogContext,\n  replicaFile: string,\n  anchor: AnchorResolver,\n  boundReconciliation: boolean,\n): OpenedChangeLog {\n  try {\n    return openAndReconcile(lc, replicaFile, anchor, boundReconciliation);\n  } catch (e) {\n    if (e instanceof ChangeLogRebuildRequired) {\n      return rebuildChangeLog(lc, replicaFile, anchor, e);\n    }\n    if (!isSQLiteCorruption(e)) {\n      throw e;\n    }\n    const file = changeLogFileName(replicaFile);\n    logSQLiteCorruptionDiagnostics(lc, 'change-log', file, e);\n    lc.error?.('rebuilding the corrupt SQLite change log', {\n      sqliteChangeLog: {file},\n    });\n    return rebuildChangeLog(lc, replicaFile, anchor);\n  }\n}\n\n/**\n * Rebuilds a log whose `auto_vacuum` mode is not `INCREMENTAL`, which is every\n * log created before the pragma shipped — including every v2 file the writer\n * wrote in the meantime, which is why the guard is on the pragma rather than\n * on the schema version. Deleting the file is the only way to enable it:\n * `DROP TABLE` leaves the header's mode intact, and the in-place alternative —\n * a full `VACUUM` — is an unbounded blocking statement on a file the writer\n * needs.\n *\n * A mode that is still wrong after the rebuild is logged and tolerated, which\n * is the one place this diverges from the corruption path. The two failures are\n * not alike: a file that stays corrupt after a rebuild is an environment\n * problem, but a pragma that stays wrong on a brand-new file can only mean\n * {@link applyChangeLogPragmas}' statement order is wrong — a code bug, present\n * on every task, on every start. Throwing there turns a lost optimization into\n * a crash loop, and rebuilding again turns it into a reseed per start, which is\n * worse than the freelist growth it was trying to avoid. `Database.compact()`\n * already warns and no-ops when the mode is not `INCREMENTAL`, so degrading is\n * the accepted fallback.\n */\nfunction ensureIncrementalAutoVacuum(\n  lc: LogContext,\n  replicaFile: string,\n  anchor: AnchorResolver,\n  opened: OpenedChangeLog,\n): OpenedChangeLog {\n  if (opened.autoVacuum === AUTO_VACUUM_INCREMENTAL) {\n    return opened;\n  }\n  const file = changeLogFileName(replicaFile);\n  lc.info?.('rebuilding the SQLite change log to enable incremental vacuum', {\n    sqliteChangeLog: {file, autoVacuum: opened.autoVacuum},\n  });\n  opened.db.close();\n  const rebuilt = rebuildChangeLog(lc, replicaFile, anchor);\n  if (rebuilt.autoVacuum !== AUTO_VACUUM_INCREMENTAL) {\n    lc.error?.(\n      'SQLite change log does not support incremental vacuum; ' +\n        'it will plateau at its high-water mark',\n      {sqliteChangeLog: {file, autoVacuum: rebuilt.autoVacuum}},\n    );\n  }\n  return rebuilt;\n}\n\n/** The shared \"delete the file and open a new one\" body. */\nfunction rebuildChangeLog(\n  lc: LogContext,\n  replicaFile: string,\n  anchor: AnchorResolver,\n  required?: ChangeLogRebuildRequired | undefined,\n): OpenedChangeLog {\n  if (required) {\n    lc.warn?.(\n      'rebuilding the SQLite change log instead of running an unbounded reconciliation',\n      {\n        sqliteChangeLogRebuild: {\n          reason: required.reason,\n          rows: required.rows,\n          estimatedBytes: required.estimatedBytes,\n        },\n      },\n    );\n  }\n  deleteChangeLogDB(replicaFile);\n  // The file is absent, so the reseed only drops empty/nonexistent tables. A\n  // second failure is the environment's, not the old file's.\n  const opened = openAndReconcile(\n    lc,\n    replicaFile,\n    anchor,\n    false,\n    required?.reason,\n  );\n  return {...opened, replacedFile: true};\n}\n\n/**\n * Replaces an already-closed change-log file after bounded reconciliation\n * declined its work. The caller closes cached readers before calling this so\n * none can continue serving the unlinked inode.\n */\nexport function rebuildChangeLogDBForWriting(\n  lc: LogContext,\n  replicaFile: string,\n  anchor: ChangeLogAnchor,\n  required: ChangeLogRebuildRequired,\n): {db: Database; result: ReconcileResult; replacedFile: true} {\n  const {db, result} = rebuildChangeLog(\n    lc,\n    replicaFile,\n    () => anchor,\n    required,\n  );\n  return {db, result, replacedFile: true};\n}\n\ntype OpenedChangeLog = {\n  db: Database;\n  result: ReconcileResult;\n  replacedFile: boolean;\n  /** The file's persistent `auto_vacuum` mode, read back after the pragmas. */\n  autoVacuum: number;\n};\n\nfunction openAndReconcile(\n  lc: LogContext,\n  replicaFile: string,\n  anchor: AnchorResolver,\n  boundReconciliation: boolean,\n  reseedReason?: ReseedReason | undefined,\n): OpenedChangeLog {\n  const db = openChangeLogDB(lc, replicaFile, {readonly: false});\n  try {\n    applyChangeLogPragmas(db);\n    const autoVacuum = readAutoVacuum(db);\n    return {\n      db,\n      result: reconcileChangeLog(lc, db, anchor(db), {\n        rebuildInsteadOfUnboundedWork: boundReconciliation,\n        reseedReason,\n      }),\n      replacedFile: false,\n      autoVacuum,\n    };\n  } catch (e) {\n    // The caller never sees this handle, so it closes here or leaks — and it\n    // must be closed before the corruption path deletes the file.\n    db.close();\n    throw e;\n  }\n}\n\nexport type ReseedReason =\n  | 'created' // file or table absent\n  | 'schema-mismatch'\n  | 'identity-mismatch'\n  | 'gap' // head does not land on the resume watermark after truncation\n  | 'oversized-truncate'; // preserving the prefix would require too much work\n\n/**\n * Reconciliation runs synchronously on the change-streamer's event loop. A\n * normal phantom is one transaction, so work above either limit is answered by\n * unlinking and reseeding this disposable cache rather than deleting an\n * arbitrarily large suffix in place.\n */\nexport const MAX_RECONCILE_TRUNCATE_ROWS = 10_000;\nexport const MAX_RECONCILE_TRUNCATE_BYTES = 16 * 1024 * 1024;\n\nexport class ChangeLogRebuildRequired extends Error {\n  override readonly name = 'ChangeLogRebuildRequired';\n  readonly reason: ReseedReason;\n  readonly rows?: number | undefined;\n  readonly estimatedBytes?: number | undefined;\n\n  constructor(\n    reason: ReseedReason,\n    rows?: number | undefined,\n    estimatedBytes?: number | undefined,\n  ) {\n    super(`SQLite change log requires a ${reason} rebuild`);\n    this.reason = reason;\n    this.rows = rows;\n    this.estimatedBytes = estimatedBytes;\n  }\n}\n\ntype ReconcileOptions = {\n  /** Throw before an unbounded delete/drop so the file owner can unlink it. */\n  readonly rebuildInsteadOfUnboundedWork?: boolean | undefined;\n  /** Preserve the reason that caused an old file to be unlinked. */\n  readonly reseedReason?: ReseedReason | undefined;\n};\n\n/**\n * `cookiesStale` records that the cookie set the log held did not survive\n * reconciliation. The cookies are unversioned point-in-time state, so any\n * reconciliation that moves the head invalidates them, and the same transaction\n * replaces them with the anchor's — the set that belongs to the resume\n * watermark (see `change-log-cookies.ts`). It is `action !== 'none'` today; it\n * is a field rather than a derivation because the replacement reads as intent\n * at the call site, and because it is what the `cookie_reseed` counter is keyed\n * on.\n */\nexport type ReconcileResult =\n  | {action: 'none'; head: string; cookiesStale: false}\n  | {action: 'truncated'; head: string; rows: number; cookiesStale: true}\n  | {\n      action: 'reseeded';\n      head: string;\n      reason: ReseedReason;\n      cookiesStale: true;\n    };\n\n/**\n * Brings the change log into agreement with the watermark its stream connection\n * resumes from, in one transaction on the change-log database:\n *\n * ```\n * head === resumeWatermark  → keep appending\n * head  >  resumeWatermark  → truncate above resumeWatermark\n * otherwise                 → wipe, seed at resumeWatermark, record the reason\n * ```\n *\n * The log commits before anything that can advance the resume watermark, so a\n * *phantom* — a transaction the log holds whose watermark the resumed stream\n * re-delivers — is the normal state, and truncate-above is the whole of\n * reconciliation rather than a special case. A phantom's rows all carry the\n * transaction's commit watermark, which is strictly greater than the resume\n * watermark, so deleting on that predicate removes phantoms whole and retains\n * every transaction at or below the resume point.\n *\n * It must run per stream connection, not once per process: the stream loop\n * re-reads its resume watermark on every reconnect, and the writer inserts with\n * a plain `INSERT` against `PRIMARY KEY (\"watermark\",\"pos\")`, so an\n * un-truncated overlap is a constraint violation on the first re-delivered\n * transaction.\n *\n * Anything truncation cannot resolve — the file was deleted, the writer was\n * disabled for a while, the replica was restored, power was lost with\n * `synchronous=NORMAL` — surfaces as a head that does not land on the resume\n * watermark, and is resolved by wiping and reseeding there.\n *\n * Whichever of the two moves the head also replaces the cookie set with the one\n * the anchor carries, in the same transaction: the head and the cookies are one\n * position, and nothing may observe them at two.\n */\nexport function reconcileChangeLog(\n  lc: LogContext,\n  db: Database,\n  anchor: ChangeLogAnchor,\n  opts: ReconcileOptions = {},\n): ReconcileResult {\n  db.exec('BEGIN IMMEDIATE');\n  try {\n    if (opts.rebuildInsteadOfUnboundedWork) {\n      const required = rebuildRequired(db, anchor);\n      if (required) {\n        throw required;\n      }\n    }\n    const result = opts.reseedReason\n      ? reseed(lc, db, anchor, opts.reseedReason)\n      : reconcile(lc, db, anchor);\n    db.exec('COMMIT');\n    return result;\n  } catch (e) {\n    if (db.inTransaction) {\n      db.exec('ROLLBACK');\n    }\n    throw e;\n  }\n}\n\n/**\n * Decides whether reconciliation can be performed within its synchronous work\n * budget. Every query is either an index seek or a scan capped at one row past\n * the delete limit. No state changes before the decision is complete.\n */\nfunction rebuildRequired(\n  db: Database,\n  anchor: ChangeLogAnchor,\n): ChangeLogRebuildRequired | undefined {\n  const wipe = changeLogWipeReason(db, anchor.identity);\n  if (wipe !== undefined) {\n    return new ChangeLogRebuildRequired(wipe);\n  }\n\n  const head = readChangeLogHead(db);\n  const {resumeWatermark} = anchor;\n  if (head === null || head < resumeWatermark) {\n    return new ChangeLogRebuildRequired('gap');\n  }\n  if (head === resumeWatermark) {\n    return undefined;\n  }\n\n  const boundary = db\n    .prepare(/*sql*/ `\n      SELECT 1 FROM \"${CHANGE_LOG_STREAM_TABLE}\"\n        WHERE \"watermark\" = ?\n        LIMIT 1\n    `)\n    .get<{1: number} | undefined>(resumeWatermark);\n  if (boundary === undefined) {\n    return new ChangeLogRebuildRequired('gap');\n  }\n\n  const {rows, estimatedBytes} = db\n    .prepare(/*sql*/ `\n      SELECT count(*) AS \"rows\",\n             coalesce(sum(\"estimatedBytes\"), 0) AS \"estimatedBytes\"\n        FROM (\n          SELECT \"estimatedBytes\" FROM \"${CHANGE_LOG_STREAM_TABLE}\"\n            WHERE \"watermark\" > ?\n            LIMIT ${MAX_RECONCILE_TRUNCATE_ROWS + 1}\n        )\n    `)\n    .get<{rows: number; estimatedBytes: number}>(resumeWatermark);\n  return rows > MAX_RECONCILE_TRUNCATE_ROWS ||\n    estimatedBytes > MAX_RECONCILE_TRUNCATE_BYTES\n    ? new ChangeLogRebuildRequired('oversized-truncate', rows, estimatedBytes)\n    : undefined;\n}\n\nfunction reconcile(\n  lc: LogContext,\n  db: Database,\n  anchor: ChangeLogAnchor,\n): ReconcileResult {\n  const wipe = changeLogWipeReason(db, anchor.identity);\n  if (wipe !== undefined) {\n    return reseed(lc, db, anchor, wipe);\n  }\n\n  const {resumeWatermark} = anchor;\n  let head = readChangeLogHead(db);\n  let rows = 0;\n  if (head !== null && head > resumeWatermark) {\n    rows = db\n      .prepare(/*sql*/ `\n        DELETE FROM \"${CHANGE_LOG_STREAM_TABLE}\" WHERE \"watermark\" > ?\n      `)\n      .run(resumeWatermark).changes;\n    head = readChangeLogHead(db);\n  }\n\n  if (head !== resumeWatermark) {\n    return reseed(lc, db, anchor, 'gap');\n  }\n  if (rows > 0) {\n    // The truncated transactions can have carried `create-table`,\n    // `add-column`, and `backfill-completed`, none of which the truncate rolls\n    // back, so the cookie set no longer belongs to the head. The anchor's set\n    // does, and it lands in this same transaction: invariant 17 holds at every\n    // point another connection could observe the log.\n    replaceCookies(db, anchor.cookies);\n    lc.info?.('truncated phantom transactions from the SQLite change log', {\n      sqliteChangeLogReconcile: {head, rows, cookies: cookieCounts(anchor)},\n    });\n    return {action: 'truncated', head, rows, cookiesStale: true};\n  }\n  lc.debug?.('SQLite change log is at the resume watermark', {\n    sqliteChangeLogReconcile: {head},\n  });\n  return {action: 'none', head, cookiesStale: false};\n}\n\n/**\n * Returns the reason that the log must be recreated. Returns `undefined` when\n * the writer can continue to use the log.\n *\n * This function takes only the expected identity because callers use the result\n * to select the anchor.\n */\nexport function changeLogWipeReason(\n  db: Database,\n  identity: ChangeLogIdentity,\n): ReseedReason | undefined {\n  if (\n    !tableExists(db, CHANGE_LOG_STREAM_TABLE) ||\n    !tableExists(db, CHANGE_LOG_META_TABLE)\n  ) {\n    return 'created';\n  }\n  // The schema version is read on its own because it is the one column every\n  // version of this table has had. Reading the rest of a v1 row would fail on\n  // its missing columns instead of reporting the mismatch that explains it.\n  const version = db\n    .prepare(/*sql*/ `\n      SELECT \"schemaVersion\" FROM \"${CHANGE_LOG_META_TABLE}\"\n    `)\n    .get<{schemaVersion: number} | undefined>();\n  if (version === undefined) {\n    return 'created';\n  }\n  if (version.schemaVersion !== CHANGE_LOG_DB_SCHEMA_VERSION) {\n    return 'schema-mismatch';\n  }\n  // Checked *after* the version, so that every pre-v4 file — which is every\n  // file in the fleet at the upgrade — reports the `schema-mismatch` that\n  // explains it rather than the `created` its absent cookie tables would\n  // otherwise look like.\n  if (\n    !tableExists(db, CHANGE_LOG_TABLE_METADATA_TABLE) ||\n    !tableExists(db, CHANGE_LOG_BACKFILLING_TABLE)\n  ) {\n    return 'created';\n  }\n  const {epoch, generation, replicaID} = readChangeLogMeta(db);\n  if (\n    epoch !== identity.epoch ||\n    generation !== identity.generation ||\n    replicaID !== identity.replicaID\n  ) {\n    return 'identity-mismatch';\n  }\n  return undefined;\n}\n\nfunction reseed(\n  lc: LogContext,\n  db: Database,\n  anchor: ChangeLogAnchor,\n  reason: ReseedReason,\n): ReconcileResult {\n  const {identity, resumeWatermark, nowMs} = anchor;\n  // Dropping the table drops its partial index with it. The cookie tables go\n  // with the buffer: a cookie set without the transactions it was folded from\n  // is not a smaller cookie set, it is a wrong one.\n  db.exec(/*sql*/ `\n    DROP TABLE IF EXISTS \"${CHANGE_LOG_STREAM_TABLE}\";\n    DROP TABLE IF EXISTS \"${CHANGE_LOG_META_TABLE}\";\n    ${DROP_CHANGE_LOG_COOKIE_TABLES}\n    ${CREATE_CHANGE_LOG_STREAM_SCHEMA}\n    ${CREATE_CHANGE_LOG_META_SCHEMA}\n    ${CREATE_CHANGE_LOG_COOKIE_SCHEMA}\n  `);\n  db.prepare(/*sql*/ `\n    INSERT INTO \"${CHANGE_LOG_META_TABLE}\"\n      (\"epoch\", \"generation\", \"replicaID\", \"schemaVersion\", \"seededAtMs\",\n       \"seedWatermark\")\n      VALUES (@epoch, @generation, @replicaID, @schemaVersion, @seededAtMs,\n              @seedWatermark)\n  `).run({\n    epoch: identity.epoch,\n    generation: identity.generation,\n    replicaID: identity.replicaID,\n    schemaVersion: CHANGE_LOG_DB_SCHEMA_VERSION,\n    seededAtMs: nowMs,\n    seedWatermark: resumeWatermark,\n  });\n  seedChangeLogStream(db, anchor);\n  // Into tables this statement just created, so the wholesale replacement is\n  // all insert. It is still the same call the truncate path makes: a reseed is\n  // the case where the log's cookie set was not merely moved but discarded, and\n  // the anchor's is equally what belongs at the head either way.\n  replaceCookies(db, anchor.cookies);\n\n  lc.info?.('reseeded the SQLite change log', {\n    sqliteChangeLogReconcile: {\n      reason,\n      head: resumeWatermark,\n      ...identity,\n      schemaVersion: CHANGE_LOG_DB_SCHEMA_VERSION,\n      seededAtMs: nowMs,\n      cookies: cookieCounts(anchor),\n    },\n  });\n  return {\n    action: 'reseeded',\n    head: resumeWatermark,\n    reason,\n    cookiesStale: true,\n  };\n}\n\n/**\n * Seeds a valid synthetic transaction at the anchor's resume watermark, making\n * an otherwise empty log serviceable as a catchup boundary for a subscriber\n * that is exactly at that watermark.\n */\nexport function seedChangeLogStream(\n  db: Database,\n  anchor: ChangeLogAnchor,\n): void {\n  const beginChange = '{\"tag\":\"begin\"}';\n  const commitChange = '{\"tag\":\"commit\"}';\n  db.prepare(SEED_CHANGE_LOG_STREAM_SQL).run({\n    watermark: anchor.resumeWatermark,\n    beginBytes: estimateChangeLogStreamRowBytes(\n      anchor.resumeWatermark,\n      'begin',\n      beginChange,\n    ),\n    beginChange,\n    commitBytes: estimateChangeLogStreamRowBytes(\n      anchor.resumeWatermark,\n      'commit',\n      commitChange,\n      anchor.resumeWatermark,\n      true,\n    ),\n    commitChange,\n    writeTimeMs: anchor.nowMs,\n  });\n}\n\n/** Reads the whole meta row. Throws if the log has not been reconciled. */\nexport function readChangeLogMeta(db: Database): ChangeLogMeta {\n  const meta = db\n    .prepare(/*sql*/ `\n      SELECT \"epoch\", \"generation\", \"replicaID\", \"schemaVersion\",\n             \"seededAtMs\", \"seedWatermark\"\n        FROM \"${CHANGE_LOG_META_TABLE}\"\n    `)\n    .get<ChangeLogMeta | undefined>();\n  if (meta === undefined) {\n    throw new Error('the SQLite change log has no meta row');\n  }\n  return meta;\n}\n\n/**\n * `max()` on the primary key's leading column, i.e. an index seek. Null when\n * the log is empty.\n */\nexport function readChangeLogHead(db: Database): string | null {\n  const {head} = db\n    .prepare(/*sql*/ `\n      SELECT max(\"watermark\") AS \"head\" FROM \"${CHANGE_LOG_STREAM_TABLE}\"\n    `)\n    .get<{head: string | null}>();\n  return head;\n}\n\n/**\n * The covered watermark range. Both scalar subqueries seek the watermark\n * index, so unlike a `count()` this does not scan the log. Both bounds are\n * null when it is empty.\n */\nexport function readChangeLogBounds(db: Database): ChangeLogBounds {\n  return db\n    .prepare(/*sql*/ `\n      SELECT\n        (SELECT min(\"watermark\") FROM \"${CHANGE_LOG_STREAM_TABLE}\")\n          AS \"minWatermark\",\n        (SELECT max(\"watermark\") FROM \"${CHANGE_LOG_STREAM_TABLE}\")\n          AS \"headWatermark\"\n    `)\n    .get<ChangeLogBounds>();\n}\n\nexport type ChangeLogBounds = {\n  readonly minWatermark: string | null;\n  readonly headWatermark: string | null;\n};\n\n/**\n * What was installed, for the reconcile log line. Normally `{0, 0}`: a nonzero\n * `backfilling` means the resumed stream is being handed backfills to re-request.\n */\nfunction cookieCounts({cookies}: ChangeLogAnchor) {\n  return {\n    tableMetadata: cookies.tableMetadata.length,\n    backfilling: cookies.backfilling.length,\n  };\n}\n\nfunction tableExists(db: Database, table: string): boolean {\n  return (\n    db\n      .prepare(/*sql*/ `\n        SELECT 1 FROM \"sqlite_master\" WHERE \"type\" = 'table' AND \"name\" = ?\n      `)\n      .get<{1: number} | undefined>(table) !== undefined\n  );\n}\n"],"mappings":";;;;;;AAmFA,IAAM,0BAA0B;AAEhC,IAAa,0BAA0B;AACvC,IAAa,qCACX;AAEF,IAAM,gBAAgB;;;;;;AAOtB,SAAgB,gCACd,WACA,KACA,QACA,WACA,eAAe,OACP;CACR,OACE,OAAO,WAAW,SAAS,IAC3B,gBACA,OAAO,WAAW,GAAG,IACrB,OAAO,WAAW,MAAM,KACvB,cAAc,KAAA,IAAY,IAAI,OAAO,WAAW,SAAS,MACzD,eAAe,gBAAgB;AAEpC;AAUA,IAAa,kCAA0C;kBACrC,wBAAwB;;;;;;;;;;;kBAWxB,mCAAmC;UAC3C,wBAAwB;;;;;;;;;AAUlC,IAAM,6BAAqC;iBAC1B,wBAAwB;;;;;;;;;AAUzC,IAAa,wBAAwB;AAerC,IAAM,gCAAwC;kBAC5B,sBAAsB;;;;;;;;;;;;;;;;;;;;;AAsBxC,SAAgB,kBAAkB,aAA6B;CAC7D,OAAO,GAAG,YAAY;AACxB;;;;;AAMA,SAAgB,kBAAkB,aAA2B;CAC3D,aAAa,kBAAkB,WAAW,CAAC;AAC7C;;;;;;;;;AAsFA,SAAgB,gBACd,IACA,aACA,MACU;CACV,OAAO,IAAI,SACT,GAAG,YAAY,aAAa,eAAe,GAC3C,kBAAkB,WAAW,GAC7B,EAAC,UAAU,KAAK,SAAQ,CAC1B;AACF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8BA,SAAgB,sBAAsB,IAAoB;CACxD,GAAG,OAAO,2BAA2B;CACrC,GAAG,OAAO,sBAAsB;CAChC,GAAG,OAAO,uBAAuB;CACjC,GAAG,OAAO,qBAAqB;CAC/B,GAAG,OAAO,sBAAsB;AAClC;AAEA,SAAS,eAAe,IAAsB;CAC5C,MAAM,CAAC,EAAC,aAAa,UAAS,GAAG,OAA8B,aAAa;CAC5E,OAAO;AACT;AAqCA,SAAgB,0BACd,IACA,aACA,QACgE;CAGhE,MAAM,EAAC,IAAI,QAAQ,iBAAgB,4BACjC,IACA,aACA,QAJa,qBAAqB,IAAI,aAAa,QADrC,WAAW,kBAAkB,WAAW,CACK,CAK3D,CACF;CACA,OAAO;EAAC;EAAI;EAAQ;CAAY;AAClC;AAEA,SAAS,qBACP,IACA,aACA,QACA,qBACiB;CACjB,IAAI;EACF,OAAO,iBAAiB,IAAI,aAAa,QAAQ,mBAAmB;CACtE,SAAS,GAAG;EACV,IAAI,aAAa,0BACf,OAAO,iBAAiB,IAAI,aAAa,QAAQ,CAAC;EAEpD,IAAI,CAAC,mBAAmB,CAAC,GACvB,MAAM;EAER,MAAM,OAAO,kBAAkB,WAAW;EAC1C,+BAA+B,IAAI,cAAc,MAAM,CAAC;EACxD,GAAG,QAAQ,4CAA4C,EACrD,iBAAiB,EAAC,KAAI,EACxB,CAAC;EACD,OAAO,iBAAiB,IAAI,aAAa,MAAM;CACjD;AACF;;;;;;;;;;;;;;;;;;;;;AAsBA,SAAS,4BACP,IACA,aACA,QACA,QACiB;CACjB,IAAI,OAAO,eAAe,yBACxB,OAAO;CAET,MAAM,OAAO,kBAAkB,WAAW;CAC1C,GAAG,OAAO,iEAAiE,EACzE,iBAAiB;EAAC;EAAM,YAAY,OAAO;CAAU,EACvD,CAAC;CACD,OAAO,GAAG,MAAM;CAChB,MAAM,UAAU,iBAAiB,IAAI,aAAa,MAAM;CACxD,IAAI,QAAQ,eAAe,yBACzB,GAAG,QACD,iGAEA,EAAC,iBAAiB;EAAC;EAAM,YAAY,QAAQ;CAAU,EAAC,CAC1D;CAEF,OAAO;AACT;;AAGA,SAAS,iBACP,IACA,aACA,QACA,UACiB;CACjB,IAAI,UACF,GAAG,OACD,mFACA,EACE,wBAAwB;EACtB,QAAQ,SAAS;EACjB,MAAM,SAAS;EACf,gBAAgB,SAAS;CAC3B,EACF,CACF;CAEF,kBAAkB,WAAW;CAU7B,OAAO;EAAC,GAPO,iBACb,IACA,aACA,QACA,OACA,UAAU,MAED;EAAQ,cAAc;CAAI;AACvC;;;;;;AAOA,SAAgB,6BACd,IACA,aACA,QACA,UAC6D;CAC7D,MAAM,EAAC,IAAI,WAAU,iBACnB,IACA,mBACM,QACN,QACF;CACA,OAAO;EAAC;EAAI;EAAQ,cAAc;CAAI;AACxC;AAUA,SAAS,iBACP,IACA,aACA,QACA,qBACA,cACiB;CACjB,MAAM,KAAK,gBAAgB,IAAI,aAAa,EAAC,UAAU,MAAK,CAAC;CAC7D,IAAI;EACF,sBAAsB,EAAE;EACxB,MAAM,aAAa,eAAe,EAAE;EACpC,OAAO;GACL;GACA,QAAQ,mBAAmB,IAAI,IAAI,OAAO,EAAE,GAAG;IAC7C,+BAA+B;IAC/B;GACF,CAAC;GACD,cAAc;GACd;EACF;CACF,SAAS,GAAG;EAGV,GAAG,MAAM;EACT,MAAM;CACR;AACF;;;;;;;AAeA,IAAa,8BAA8B;AAG3C,IAAa,2BAAb,cAA8C,MAAM;CAClD,OAAyB;CACzB;CACA;CACA;CAEA,YACE,QACA,MACA,gBACA;EACA,MAAM,gCAAgC,OAAO,SAAS;EACtD,KAAK,SAAS;EACd,KAAK,OAAO;EACZ,KAAK,iBAAiB;CACxB;AACF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8DA,SAAgB,mBACd,IACA,IACA,QACA,OAAyB,CAAC,GACT;CACjB,GAAG,KAAK,iBAAiB;CACzB,IAAI;EACF,IAAI,KAAK,+BAA+B;GACtC,MAAM,WAAW,gBAAgB,IAAI,MAAM;GAC3C,IAAI,UACF,MAAM;EAEV;EACA,MAAM,SAAS,KAAK,eAChB,OAAO,IAAI,IAAI,QAAQ,KAAK,YAAY,IACxC,UAAU,IAAI,IAAI,MAAM;EAC5B,GAAG,KAAK,QAAQ;EAChB,OAAO;CACT,SAAS,GAAG;EACV,IAAI,GAAG,eACL,GAAG,KAAK,UAAU;EAEpB,MAAM;CACR;AACF;;;;;;AAOA,SAAS,gBACP,IACA,QACsC;CACtC,MAAM,OAAO,oBAAoB,IAAI,OAAO,QAAQ;CACpD,IAAI,SAAS,KAAA,GACX,OAAO,IAAI,yBAAyB,IAAI;CAG1C,MAAM,OAAO,kBAAkB,EAAE;CACjC,MAAM,EAAC,oBAAmB;CAC1B,IAAI,SAAS,QAAQ,OAAO,iBAC1B,OAAO,IAAI,yBAAyB,KAAK;CAE3C,IAAI,SAAS,iBACX;CAUF,IAPiB,GACd,QAAgB;;;;KAIhB,EACA,IAA6B,eAC5B,MAAa,KAAA,GACf,OAAO,IAAI,yBAAyB,KAAK;CAG3C,MAAM,EAAC,MAAM,mBAAkB,GAC5B,QAAgB;;;;0CAIqB,wBAAwB;;oBAE9C,8BAA8B,EAAE;;KAE/C,EACA,IAA4C,eAAe;CAC9D,OAAO,OAAA,OACL,iBAAA,WACE,IAAI,yBAAyB,sBAAsB,MAAM,cAAc,IACvE,KAAA;AACN;AAEA,SAAS,UACP,IACA,IACA,QACiB;CACjB,MAAM,OAAO,oBAAoB,IAAI,OAAO,QAAQ;CACpD,IAAI,SAAS,KAAA,GACX,OAAO,OAAO,IAAI,IAAI,QAAQ,IAAI;CAGpC,MAAM,EAAC,oBAAmB;CAC1B,IAAI,OAAO,kBAAkB,EAAE;CAC/B,IAAI,OAAO;CACX,IAAI,SAAS,QAAQ,OAAO,iBAAiB;EAC3C,OAAO,GACJ,QAAgB;uBACA,wBAAwB;OACxC,EACA,IAAI,eAAe,EAAE;EACxB,OAAO,kBAAkB,EAAE;CAC7B;CAEA,IAAI,SAAS,iBACX,OAAO,OAAO,IAAI,IAAI,QAAQ,KAAK;CAErC,IAAI,OAAO,GAAG;EAMZ,eAAe,IAAI,OAAO,OAAO;EACjC,GAAG,OAAO,6DAA6D,EACrE,0BAA0B;GAAC;GAAM;GAAM,SAAS,aAAa,MAAM;EAAC,EACtE,CAAC;EACD,OAAO;GAAC,QAAQ;GAAa;GAAM;GAAM,cAAc;EAAI;CAC7D;CACA,GAAG,QAAQ,gDAAgD,EACzD,0BAA0B,EAAC,KAAI,EACjC,CAAC;CACD,OAAO;EAAC,QAAQ;EAAQ;EAAM,cAAc;CAAK;AACnD;;;;;;;;AASA,SAAgB,oBACd,IACA,UAC0B;CAC1B,IACE,CAAC,YAAY,IAAA,uBAA2B,KACxC,CAAC,YAAY,IAAA,qBAAyB,GAEtC,OAAO;CAKT,MAAM,UAAU,GACb,QAAgB;qCACgB,sBAAsB;KACtD,EACA,IAAyC;CAC5C,IAAI,YAAY,KAAA,GACd,OAAO;CAET,IAAI,QAAQ,kBAAA,GACV,OAAO;CAMT,IACE,CAAC,YAAY,IAAA,8BAAmC,KAChD,CAAC,YAAY,IAAA,4BAAgC,GAE7C,OAAO;CAET,MAAM,EAAC,OAAO,YAAY,cAAa,kBAAkB,EAAE;CAC3D,IACE,UAAU,SAAS,SACnB,eAAe,SAAS,cACxB,cAAc,SAAS,WAEvB,OAAO;AAGX;AAEA,SAAS,OACP,IACA,IACA,QACA,QACiB;CACjB,MAAM,EAAC,UAAU,iBAAiB,UAAS;CAI3C,GAAG,KAAa;4BACU,wBAAwB;4BACxB,sBAAsB;MAC5C,8BAA8B;MAC9B,gCAAgC;MAChC,8BAA8B;MAC9B,gCAAgC;GACnC;CACD,GAAG,QAAgB;mBACF,sBAAsB;;;;;GAKtC,EAAE,IAAI;EACL,OAAO,SAAS;EAChB,YAAY,SAAS;EACrB,WAAW,SAAS;EACpB,eAAA;EACA,YAAY;EACZ,eAAe;CACjB,CAAC;CACD,oBAAoB,IAAI,MAAM;CAK9B,eAAe,IAAI,OAAO,OAAO;CAEjC,GAAG,OAAO,kCAAkC,EAC1C,0BAA0B;EACxB;EACA,MAAM;EACN,GAAG;EACH,eAAA;EACA,YAAY;EACZ,SAAS,aAAa,MAAM;CAC9B,EACF,CAAC;CACD,OAAO;EACL,QAAQ;EACR,MAAM;EACN;EACA,cAAc;CAChB;AACF;;;;;;AAOA,SAAgB,oBACd,IACA,QACM;CACN,MAAM,cAAc;CACpB,MAAM,eAAe;CACrB,GAAG,QAAQ,0BAA0B,EAAE,IAAI;EACzC,WAAW,OAAO;EAClB,YAAY,gCACV,OAAO,iBACP,SACA,WACF;EACA;EACA,aAAa,gCACX,OAAO,iBACP,UACA,cACA,OAAO,iBACP,IACF;EACA;EACA,aAAa,OAAO;CACtB,CAAC;AACH;;AAGA,SAAgB,kBAAkB,IAA6B;CAC7D,MAAM,OAAO,GACV,QAAgB;;;gBAGL,sBAAsB;KACjC,EACA,IAA+B;CAClC,IAAI,SAAS,KAAA,GACX,MAAM,IAAI,MAAM,uCAAuC;CAEzD,OAAO;AACT;;;;;AAMA,SAAgB,kBAAkB,IAA6B;CAC7D,MAAM,EAAC,SAAQ,GACZ,QAAgB;gDAC2B,wBAAwB;KACnE,EACA,IAA2B;CAC9B,OAAO;AACT;;;;;;AAOA,SAAgB,oBAAoB,IAA+B;CACjE,OAAO,GACJ,QAAgB;;yCAEoB,wBAAwB;;yCAExB,wBAAwB;;KAE5D,EACA,IAAqB;AAC1B;;;;;AAWA,SAAS,aAAa,EAAC,WAA2B;CAChD,OAAO;EACL,eAAe,QAAQ,cAAc;EACrC,aAAa,QAAQ,YAAY;CACnC;AACF;AAEA,SAAS,YAAY,IAAc,OAAwB;CACzD,OACE,GACG,QAAgB;;OAEhB,EACA,IAA6B,KAAK,MAAM,KAAA;AAE/C"}

package/out/zero-client/src/client/version.js

@@ -2,7 +2,7 @@
 /**
 * The current version of Zero.
 */
-var version = "1.10.0-canary.16";
+var version = "1.10.0-canary.17";
 //#endregion
 export { version };
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rocicorp/zero",
-  "version": "1.10.0-canary.16",
+  "version": "1.10.0-canary.17",
   "description": "Zero is a web framework for serverless web development.",
   "homepage": "https://zero.rocicorp.dev",
   "bugs": {