@rocicorp/zero 1.12.0-canary.0 → 1.12.0-canary.10

package/out/zero-cache/src/services/change-streamer/sqlite-change-log-reader.js.map

@@ -1 +1 @@
-{"version":3,"file":"sqlite-change-log-reader.js","names":["#db","#assertOpen","#prepare","#throwIfAborted","#closed","#statements","#streamTableExists"],"sources":["../../../../../../zero-cache/src/services/change-streamer/sqlite-change-log-reader.ts"],"sourcesContent":["import type {LogContext} from '@rocicorp/logger';\nimport {AbortError} from '../../../../shared/src/abort-error.ts';\nimport {assert} from '../../../../shared/src/asserts.ts';\nimport {Database, type Statement} from '../../../../zqlite/src/db.ts';\nimport {CHANGE_LOG_STREAM_TABLE} from '../replicator/change-log-db.ts';\nimport {\n  reconstructWatermarkedChange,\n  type ChangeLogEntry,\n} from './change-log-codec.ts';\nimport type {WatermarkedChange} from './change-streamer.ts';\n\nexport type CatchupPlan =\n  | {\n      readonly kind: 'range';\n      readonly minWatermark: string;\n      readonly headWatermark: string;\n    }\n  | {readonly kind: 'ahead'; readonly headWatermark: string}\n  | {\n      readonly kind: 'too-old';\n      readonly minWatermark: string;\n      readonly headWatermark: string;\n    }\n  // The log exists as a file but has no content to serve: the replicator has\n  // not created or reconciled it yet. Subscriber selection treats this as\n  // \"decline and fall back to PG catchup\", which is why it is a plan rather\n  // than an error.\n  | {readonly kind: 'not-ready'};\n\ntype PlanRow = {\n  readonly headWatermark: string | null;\n  readonly minWatermark: string | null;\n  readonly boundaryExists: number;\n};\n\ntype ChangeLogRow = ChangeLogEntry & {\n  readonly pos: number;\n};\n\ntype PreparedStatements = {\n  readonly plan: Statement;\n  readonly readBatch: Statement;\n};\n\n/**\n * Seeks to the final position so validating a boundary does not scan every row\n * of a large transaction. Exported so the focused query-plan test covers the\n * production subquery.\n */\nexport const SQLITE_CHANGE_LOG_BOUNDARY_SQL = /*sql*/ `\n  SELECT\n    \"precommit\" = @fromWatermark AND\n      \"tag\" = 'commit' AS \"boundaryExists\"\n  FROM \"${CHANGE_LOG_STREAM_TABLE}\"\n  WHERE \"watermark\" = @fromWatermark\n  ORDER BY \"pos\" DESC\n  LIMIT 1\n`;\n\n/**\n * The log describes its own bounds; nothing here reads the replica.\n * `max(\"watermark\")` is the head because a transaction's rows commit atomically,\n * so the log never ends mid-transaction.\n *\n * `min` and `max` are deliberately kept as *separate* scalar subqueries: SQLite\n * applies its single-aggregate index optimization only when the aggregate is\n * alone in its query, so `SELECT min(x), max(x) FROM t` degrades to a full scan\n * while two scalar subqueries are two index seeks. The query-plan test pins\n * this.\n *\n * Exported so that test can cover the production query.\n */\nexport const SQLITE_CHANGE_LOG_PLAN_SQL = /*sql*/ `\n  SELECT\n    (SELECT max(\"watermark\") FROM \"${CHANGE_LOG_STREAM_TABLE}\")\n      AS \"headWatermark\",\n    (SELECT min(\"watermark\") FROM \"${CHANGE_LOG_STREAM_TABLE}\")\n      AS \"minWatermark\",\n    coalesce((${SQLITE_CHANGE_LOG_BOUNDARY_SQL}), 0) AS \"boundaryExists\"\n`;\n\n/** Exported so the focused query-plan test covers the production query. */\nexport const SQLITE_CHANGE_LOG_READ_BATCH_SQL = /*sql*/ `\n  SELECT\n    \"watermark\",\n    \"pos\",\n    \"tag\",\n    \"change\"\n  FROM \"${CHANGE_LOG_STREAM_TABLE}\"\n  WHERE (\"watermark\", \"pos\") > (?, ?)\n    AND \"watermark\" <= ?\n  ORDER BY \"watermark\", \"pos\"\n  LIMIT ?\n`;\n\nconst TABLE_EXISTS_SQL = /*sql*/ `\n  SELECT 1 FROM \"sqlite_master\" WHERE \"type\" = 'table' AND \"name\" = ?\n`;\n\n/**\n * Reads the change log without retaining a SQLite snapshot while a consumer\n * processes a batch.\n *\n * The log lives in its own database beside the replica\n * (`changeLogFileName(replicaFile)`), which this reader opens read-only; it\n * never opens the replica. The connection therefore keeps the journal mode\n * configured by the change-log writer. Callers pin a head with {@link plan}\n * before passing it to {@link read}.\n *\n * A change-streamer can start before the replicator has created the log, so the\n * stream table may not exist yet. Statements are prepared on first use rather\n * than in the constructor, and {@link plan} reports `not-ready` until they can\n * be; a reader constructed too early becomes usable once the writer catches up.\n */\nexport class SQLiteChangeLogReader implements Disposable {\n  readonly #db: Database;\n  #statements: PreparedStatements | undefined;\n  #closed = false;\n\n  constructor(lc: LogContext, changeLogFile: string) {\n    this.#db = new Database(\n      lc.withContext('component', 'sqlite-change-log-reader'),\n      changeLogFile,\n      {readonly: true},\n    );\n  }\n\n  plan(fromWatermark: string): CatchupPlan {\n    this.#assertOpen();\n    const statements = this.#prepare();\n    if (statements === undefined) {\n      return {kind: 'not-ready'};\n    }\n    const row = statements.plan.get<PlanRow>({fromWatermark});\n    if (row.headWatermark === null || row.minWatermark === null) {\n      return {kind: 'not-ready'};\n    }\n    const {headWatermark, minWatermark} = row;\n\n    if (fromWatermark > headWatermark) {\n      return {kind: 'ahead', headWatermark};\n    }\n    if (fromWatermark < minWatermark || row.boundaryExists === 0) {\n      return {kind: 'too-old', minWatermark, headWatermark};\n    }\n    return {kind: 'range', minWatermark, headWatermark};\n  }\n\n  async *read(\n    fromWatermark: string,\n    throughWatermark: string,\n    batchSize: number,\n    signal?: AbortSignal | undefined,\n    maxRows?: number | undefined,\n  ): AsyncIterable<readonly WatermarkedChange[]> {\n    assert(\n      Number.isSafeInteger(batchSize) && batchSize > 0,\n      'SQLite change log batch size must be a positive safe integer',\n    );\n    assert(\n      maxRows === undefined || (Number.isSafeInteger(maxRows) && maxRows > 0),\n      'SQLite change log row limit must be a positive safe integer',\n    );\n    this.#assertOpen();\n    const statements = this.#prepare();\n    assert(\n      statements !== undefined,\n      'SQLite change log must be ready before it is read',\n    );\n\n    let lastWatermark = fromWatermark;\n    // The first query must be strictly after the requested transaction. Every\n    // real stream position is far below this sentinel.\n    let lastPos = Number.MAX_SAFE_INTEGER;\n    let lastTag: string | undefined;\n    let rowsRead = 0;\n\n    while (true) {\n      this.#throwIfAborted(signal);\n      const remainingRows =\n        maxRows === undefined ? batchSize : maxRows - rowsRead;\n      if (remainingRows === 0) {\n        break;\n      }\n      const rows = statements.readBatch.all<ChangeLogRow>(\n        lastWatermark,\n        lastPos,\n        throughWatermark,\n        Math.min(batchSize, remainingRows),\n      );\n      this.#throwIfAborted(signal);\n\n      if (rows.length === 0) {\n        break;\n      }\n\n      const changes = rows.map(reconstructWatermarkedChange);\n      const last = rows.at(-1);\n      assert(last !== undefined, 'non-empty batch must have a final row');\n      lastWatermark = last.watermark;\n      lastPos = last.pos;\n      lastTag = last.tag;\n      rowsRead += rows.length;\n\n      // all() has exhausted the SELECT and closed its implicit read\n      // transaction. This yield therefore cannot pin the WAL while subscriber\n      // flow control is pending.\n      yield changes;\n    }\n\n    // `throughWatermark` was pinned from `max(\"watermark\")` of this same table,\n    // so reaching it no longer depends on the log agreeing with the replica's\n    // `_zero.replicationState`, which is what this assertion used to guard.\n    // What remains is a concurrent purge of the head transaction, which the\n    // purge policy (never past the latest durable transaction) does not do.\n    // A read that stopped at `maxRows` cannot know whether more rows follow,\n    // so completeness is only asserted for a read that ran out on its own.\n    // Detecting a short bounded read is left to the caller, which set the\n    // limit and is the only side that knows what a full range should hold.\n    if (\n      fromWatermark !== throughWatermark &&\n      (maxRows === undefined || rowsRead < maxRows)\n    ) {\n      assert(\n        lastWatermark === throughWatermark && lastTag === 'commit',\n        () =>\n          `SQLite change log did not end at pinned head ${throughWatermark}`,\n      );\n    }\n  }\n\n  close(): void {\n    if (this.#closed) {\n      return;\n    }\n    this.#closed = true;\n    this.#db.close();\n  }\n\n  [Symbol.dispose](): void {\n    this.close();\n  }\n\n  /**\n   * Prepares the statements once the stream table exists, memoizing them.\n   * Returns `undefined` while the log has not been created, which is a normal\n   * startup state rather than an error.\n   */\n  #prepare(): PreparedStatements | undefined {\n    if (this.#statements === undefined && this.#streamTableExists()) {\n      this.#statements = {\n        plan: this.#db.prepare(SQLITE_CHANGE_LOG_PLAN_SQL),\n        readBatch: this.#db.prepare(SQLITE_CHANGE_LOG_READ_BATCH_SQL),\n      };\n    }\n    return this.#statements;\n  }\n\n  #streamTableExists(): boolean {\n    return (\n      this.#db\n        .prepare(TABLE_EXISTS_SQL)\n        .get<{1: number} | undefined>(CHANGE_LOG_STREAM_TABLE) !== undefined\n    );\n  }\n\n  #assertOpen(): void {\n    if (this.#closed) {\n      throw new AbortError('SQLite change log reader is closed');\n    }\n  }\n\n  #throwIfAborted(signal: AbortSignal | undefined): void {\n    this.#assertOpen();\n    if (signal?.aborted) {\n      throw new AbortError('SQLite change log read aborted');\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;AAiDA,IAAa,iCAAyC;;;;UAI5C,wBAAwB;;;;;;;;;;;;;;;;;;AAmBlC,IAAa,6BAAqC;;qCAEb,wBAAwB;;qCAExB,wBAAwB;;gBAE7C,+BAA+B;;;AAI/C,IAAa,mCAA2C;;;;;;UAM9C,wBAAwB;;;;;;AAOlC,IAAM,mBAA2B;;;;;;;;;;;;;;;;;;AAmBjC,IAAa,wBAAb,MAAyD;CACvD;CACA;CACA,UAAU;CAEV,YAAY,IAAgB,eAAuB;EACjD,KAAKA,MAAM,IAAI,SACb,GAAG,YAAY,aAAa,0BAA0B,GACtD,eACA,EAAC,UAAU,KAAI,CACjB;CACF;CAEA,KAAK,eAAoC;EACvC,KAAKC,YAAY;EACjB,MAAM,aAAa,KAAKC,SAAS;EACjC,IAAI,eAAe,KAAA,GACjB,OAAO,EAAC,MAAM,YAAW;EAE3B,MAAM,MAAM,WAAW,KAAK,IAAa,EAAC,cAAa,CAAC;EACxD,IAAI,IAAI,kBAAkB,QAAQ,IAAI,iBAAiB,MACrD,OAAO,EAAC,MAAM,YAAW;EAE3B,MAAM,EAAC,eAAe,iBAAgB;EAEtC,IAAI,gBAAgB,eAClB,OAAO;GAAC,MAAM;GAAS;EAAa;EAEtC,IAAI,gBAAgB,gBAAgB,IAAI,mBAAmB,GACzD,OAAO;GAAC,MAAM;GAAW;GAAc;EAAa;EAEtD,OAAO;GAAC,MAAM;GAAS;GAAc;EAAa;CACpD;CAEA,OAAO,KACL,eACA,kBACA,WACA,QACA,SAC6C;EAC7C,OACE,OAAO,cAAc,SAAS,KAAK,YAAY,GAC/C,8DACF;EACA,OACE,YAAY,KAAA,KAAc,OAAO,cAAc,OAAO,KAAK,UAAU,GACrE,6DACF;EACA,KAAKD,YAAY;EACjB,MAAM,aAAa,KAAKC,SAAS;EACjC,OACE,eAAe,KAAA,GACf,mDACF;EAEA,IAAI,gBAAgB;EAGpB,IAAI,UAAU,OAAO;EACrB,IAAI;EACJ,IAAI,WAAW;EAEf,OAAO,MAAM;GACX,KAAKC,gBAAgB,MAAM;GAC3B,MAAM,gBACJ,YAAY,KAAA,IAAY,YAAY,UAAU;GAChD,IAAI,kBAAkB,GACpB;GAEF,MAAM,OAAO,WAAW,UAAU,IAChC,eACA,SACA,kBACA,KAAK,IAAI,WAAW,aAAa,CACnC;GACA,KAAKA,gBAAgB,MAAM;GAE3B,IAAI,KAAK,WAAW,GAClB;GAGF,MAAM,UAAU,KAAK,IAAI,4BAA4B;GACrD,MAAM,OAAO,KAAK,GAAG,EAAE;GACvB,OAAO,SAAS,KAAA,GAAW,uCAAuC;GAClE,gBAAgB,KAAK;GACrB,UAAU,KAAK;GACf,UAAU,KAAK;GACf,YAAY,KAAK;GAKjB,MAAM;EACR;EAWA,IACE,kBAAkB,qBACjB,YAAY,KAAA,KAAa,WAAW,UAErC,OACE,kBAAkB,oBAAoB,YAAY,gBAEhD,gDAAgD,kBACpD;CAEJ;CAEA,QAAc;EACZ,IAAI,KAAKC,SACP;EAEF,KAAKA,UAAU;EACf,KAAKJ,IAAI,MAAM;CACjB;CAEA,CAAC,OAAO,WAAiB;EACvB,KAAK,MAAM;CACb;;;;;;CAOA,WAA2C;EACzC,IAAI,KAAKK,gBAAgB,KAAA,KAAa,KAAKC,mBAAmB,GAC5D,KAAKD,cAAc;GACjB,MAAM,KAAKL,IAAI,QAAQ,0BAA0B;GACjD,WAAW,KAAKA,IAAI,QAAQ,gCAAgC;EAC9D;EAEF,OAAO,KAAKK;CACd;CAEA,qBAA8B;EAC5B,OACE,KAAKL,IACF,QAAQ,gBAAgB,EACxB,IAA6B,uBAAuB,MAAM,KAAA;CAEjE;CAEA,cAAoB;EAClB,IAAI,KAAKI,SACP,MAAM,IAAI,WAAW,oCAAoC;CAE7D;CAEA,gBAAgB,QAAuC;EACrD,KAAKH,YAAY;EACjB,IAAI,QAAQ,SACV,MAAM,IAAI,WAAW,gCAAgC;CAEzD;AACF"}
+{"version":3,"file":"sqlite-change-log-reader.js","names":[],"sources":["../../../../../../zero-cache/src/services/change-streamer/sqlite-change-log-reader.ts"],"sourcesContent":["import type {LogContext} from '@rocicorp/logger';\nimport {AbortError} from '../../../../shared/src/abort-error.ts';\nimport {assert} from '../../../../shared/src/asserts.ts';\nimport {Database, type Statement} from '../../../../zqlite/src/db.ts';\nimport {CHANGE_LOG_STREAM_TABLE} from '../replicator/change-log-db.ts';\nimport {reconstructWatermarkedChange} from './change-log-codec.ts';\nimport type {WatermarkedChange} from './change-streamer.ts';\n\nexport type CatchupPlan =\n  | {\n      readonly kind: 'range';\n      readonly minWatermark: string;\n      readonly headWatermark: string;\n    }\n  | {readonly kind: 'ahead'; readonly headWatermark: string}\n  | {\n      readonly kind: 'too-old';\n      readonly minWatermark: string;\n      readonly headWatermark: string;\n    }\n  // The log exists as a file but has no content to serve: the replicator has\n  // not created or reconciled it yet. Subscriber selection treats this as\n  // \"decline and fall back to PG catchup\", which is why it is a plan rather\n  // than an error.\n  | {readonly kind: 'not-ready'};\n\ntype PlanRow = {\n  readonly headWatermark: string | null;\n  readonly minWatermark: string | null;\n  readonly boundaryExists: number;\n};\n\n/** A row of {@link SQLITE_CHANGE_LOG_READ_BATCH_SQL}, read with `raw(true)`. */\ntype RawChangeLogRow = readonly [\n  watermark: string,\n  pos: number,\n  tag: string,\n  change: string,\n];\n\ntype PreparedStatements = {\n  readonly plan: Statement;\n  readonly readBatch: Statement;\n};\n\n/**\n * Seeks to the final position so validating a boundary does not scan every row\n * of a large transaction. Exported so the focused query-plan test covers the\n * production subquery.\n */\nexport const SQLITE_CHANGE_LOG_BOUNDARY_SQL = /*sql*/ `\n  SELECT\n    \"precommit\" = @fromWatermark AND\n      \"tag\" = 'commit' AS \"boundaryExists\"\n  FROM \"${CHANGE_LOG_STREAM_TABLE}\"\n  WHERE \"watermark\" = @fromWatermark\n  ORDER BY \"pos\" DESC\n  LIMIT 1\n`;\n\n/**\n * The log describes its own bounds; nothing here reads the replica.\n * `max(\"watermark\")` is the head because a transaction's rows commit atomically,\n * so the log never ends mid-transaction.\n *\n * `min` and `max` are deliberately kept as *separate* scalar subqueries: SQLite\n * applies its single-aggregate index optimization only when the aggregate is\n * alone in its query, so `SELECT min(x), max(x) FROM t` degrades to a full scan\n * while two scalar subqueries are two index seeks. The query-plan test pins\n * this.\n *\n * Exported so that test can cover the production query.\n */\nexport const SQLITE_CHANGE_LOG_PLAN_SQL = /*sql*/ `\n  SELECT\n    (SELECT max(\"watermark\") FROM \"${CHANGE_LOG_STREAM_TABLE}\")\n      AS \"headWatermark\",\n    (SELECT min(\"watermark\") FROM \"${CHANGE_LOG_STREAM_TABLE}\")\n      AS \"minWatermark\",\n    coalesce((${SQLITE_CHANGE_LOG_BOUNDARY_SQL}), 0) AS \"boundaryExists\"\n`;\n\n/** Exported so the focused query-plan test covers the production query. */\nexport const SQLITE_CHANGE_LOG_READ_BATCH_SQL = /*sql*/ `\n  SELECT\n    \"watermark\",\n    \"pos\",\n    \"tag\",\n    \"change\"\n  FROM \"${CHANGE_LOG_STREAM_TABLE}\"\n  WHERE (\"watermark\", \"pos\") > (?, ?)\n    AND \"watermark\" <= ?\n  ORDER BY \"watermark\", \"pos\"\n  LIMIT ?\n`;\n\nconst TABLE_EXISTS_SQL = /*sql*/ `\n  SELECT 1 FROM \"sqlite_master\" WHERE \"type\" = 'table' AND \"name\" = ?\n`;\n\n/**\n * Reads the change log without retaining a SQLite snapshot while a consumer\n * processes a batch.\n *\n * The log lives in its own database beside the replica\n * (`changeLogFileName(replicaFile)`), which this reader opens read-only; it\n * never opens the replica. The connection therefore keeps the journal mode\n * configured by the change-log writer. Callers pin a head with {@link plan}\n * before passing it to {@link read}.\n *\n * A change-streamer can start before the replicator has created the log, so the\n * stream table may not exist yet. Statements are prepared on first use rather\n * than in the constructor, and {@link plan} reports `not-ready` until they can\n * be; a reader constructed too early becomes usable once the writer catches up.\n */\nexport class SQLiteChangeLogReader implements Disposable {\n  readonly #db: Database;\n  #statements: PreparedStatements | undefined;\n  #closed = false;\n\n  constructor(lc: LogContext, changeLogFile: string) {\n    this.#db = new Database(\n      lc.withContext('component', 'sqlite-change-log-reader'),\n      changeLogFile,\n      {readonly: true},\n    );\n  }\n\n  plan(fromWatermark: string): CatchupPlan {\n    this.#assertOpen();\n    const statements = this.#prepare();\n    if (statements === undefined) {\n      return {kind: 'not-ready'};\n    }\n    const row = statements.plan.get<PlanRow>({fromWatermark});\n    if (row.headWatermark === null || row.minWatermark === null) {\n      return {kind: 'not-ready'};\n    }\n    const {headWatermark, minWatermark} = row;\n\n    if (fromWatermark > headWatermark) {\n      return {kind: 'ahead', headWatermark};\n    }\n    if (fromWatermark < minWatermark || row.boundaryExists === 0) {\n      return {kind: 'too-old', minWatermark, headWatermark};\n    }\n    return {kind: 'range', minWatermark, headWatermark};\n  }\n\n  async *read(\n    fromWatermark: string,\n    throughWatermark: string,\n    batchSize: number,\n    signal?: AbortSignal | undefined,\n    maxRows?: number | undefined,\n  ): AsyncIterable<readonly WatermarkedChange[]> {\n    assert(\n      Number.isSafeInteger(batchSize) && batchSize > 0,\n      'SQLite change log batch size must be a positive safe integer',\n    );\n    assert(\n      maxRows === undefined || (Number.isSafeInteger(maxRows) && maxRows > 0),\n      'SQLite change log row limit must be a positive safe integer',\n    );\n    this.#assertOpen();\n    const statements = this.#prepare();\n    assert(\n      statements !== undefined,\n      'SQLite change log must be ready before it is read',\n    );\n\n    let lastWatermark = fromWatermark;\n    // The first query must be strictly after the requested transaction. Every\n    // real stream position is far below this sentinel.\n    let lastPos = Number.MAX_SAFE_INTEGER;\n    let lastTag: string | undefined;\n    let rowsRead = 0;\n\n    while (true) {\n      this.#throwIfAborted(signal);\n      const remainingRows =\n        maxRows === undefined ? batchSize : maxRows - rowsRead;\n      if (remainingRows === 0) {\n        break;\n      }\n      const rows = statements.readBatch.all<RawChangeLogRow>(\n        lastWatermark,\n        lastPos,\n        throughWatermark,\n        Math.min(batchSize, remainingRows),\n      );\n      this.#throwIfAborted(signal);\n\n      if (rows.length === 0) {\n        break;\n      }\n\n      const changes = rows.map(([watermark, , tag, change]) =>\n        reconstructWatermarkedChange(watermark, tag, change),\n      );\n      const last = rows.at(-1);\n      assert(last !== undefined, 'non-empty batch must have a final row');\n      [lastWatermark, lastPos, lastTag] = last;\n      rowsRead += rows.length;\n\n      // all() has exhausted the SELECT and closed its implicit read\n      // transaction. This yield therefore cannot pin the WAL while subscriber\n      // flow control is pending.\n      yield changes;\n    }\n\n    // `throughWatermark` was pinned from `max(\"watermark\")` of this same table,\n    // so reaching it no longer depends on the log agreeing with the replica's\n    // `_zero.replicationState`, which is what this assertion used to guard.\n    // What remains is a concurrent purge of the head transaction, which the\n    // purge policy (never past the latest durable transaction) does not do.\n    // A read that stopped at `maxRows` cannot know whether more rows follow,\n    // so completeness is only asserted for a read that ran out on its own.\n    // Detecting a short bounded read is left to the caller, which set the\n    // limit and is the only side that knows what a full range should hold.\n    if (\n      fromWatermark !== throughWatermark &&\n      (maxRows === undefined || rowsRead < maxRows)\n    ) {\n      assert(\n        lastWatermark === throughWatermark && lastTag === 'commit',\n        () =>\n          `SQLite change log did not end at pinned head ${throughWatermark}`,\n      );\n    }\n  }\n\n  close(): void {\n    if (this.#closed) {\n      return;\n    }\n    this.#closed = true;\n    this.#db.close();\n  }\n\n  [Symbol.dispose](): void {\n    this.close();\n  }\n\n  /**\n   * Prepares the statements once the stream table exists, memoizing them.\n   * Returns `undefined` while the log has not been created, which is a normal\n   * startup state rather than an error.\n   */\n  #prepare(): PreparedStatements | undefined {\n    if (this.#statements === undefined && this.#streamTableExists()) {\n      this.#statements = {\n        plan: this.#db.prepare(SQLITE_CHANGE_LOG_PLAN_SQL),\n        readBatch: this.#db.prepare(SQLITE_CHANGE_LOG_READ_BATCH_SQL).raw(true),\n      };\n    }\n    return this.#statements;\n  }\n\n  #streamTableExists(): boolean {\n    return (\n      this.#db\n        .prepare(TABLE_EXISTS_SQL)\n        .get<{1: number} | undefined>(CHANGE_LOG_STREAM_TABLE) !== undefined\n    );\n  }\n\n  #assertOpen(): void {\n    if (this.#closed) {\n      throw new AbortError('SQLite change log reader is closed');\n    }\n  }\n\n  #throwIfAborted(signal: AbortSignal | undefined): void {\n    this.#assertOpen();\n    if (signal?.aborted) {\n      throw new AbortError('SQLite change log read aborted');\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;AAkDA,IAAa,iCAAyC;;;;UAI5C,wBAAwB;;;;;;;;;;;;;;;;;;AAmBlC,IAAa,6BAAqC;;qCAEb,wBAAwB;;qCAExB,wBAAwB;;gBAE7C,+BAA+B;;;AAI/C,IAAa,mCAA2C;;;;;;UAM9C,wBAAwB;;;;;;AAOlC,IAAM,mBAA2B;;;;;;;;;;;;;;;;;;AAmBjC,IAAa,wBAAb,MAAyD;CACvD;CACA;CACA,UAAU;CAEV,YAAY,IAAgB,eAAuB;EACjD,KAAK,MAAM,IAAI,SACb,GAAG,YAAY,aAAa,0BAA0B,GACtD,eACA,EAAC,UAAU,KAAI,CACjB;CACF;CAEA,KAAK,eAAoC;EACvC,KAAK,YAAY;EACjB,MAAM,aAAa,KAAK,SAAS;EACjC,IAAI,eAAe,KAAA,GACjB,OAAO,EAAC,MAAM,YAAW;EAE3B,MAAM,MAAM,WAAW,KAAK,IAAa,EAAC,cAAa,CAAC;EACxD,IAAI,IAAI,kBAAkB,QAAQ,IAAI,iBAAiB,MACrD,OAAO,EAAC,MAAM,YAAW;EAE3B,MAAM,EAAC,eAAe,iBAAgB;EAEtC,IAAI,gBAAgB,eAClB,OAAO;GAAC,MAAM;GAAS;EAAa;EAEtC,IAAI,gBAAgB,gBAAgB,IAAI,mBAAmB,GACzD,OAAO;GAAC,MAAM;GAAW;GAAc;EAAa;EAEtD,OAAO;GAAC,MAAM;GAAS;GAAc;EAAa;CACpD;CAEA,OAAO,KACL,eACA,kBACA,WACA,QACA,SAC6C;EAC7C,OACE,OAAO,cAAc,SAAS,KAAK,YAAY,GAC/C,8DACF;EACA,OACE,YAAY,KAAA,KAAc,OAAO,cAAc,OAAO,KAAK,UAAU,GACrE,6DACF;EACA,KAAK,YAAY;EACjB,MAAM,aAAa,KAAK,SAAS;EACjC,OACE,eAAe,KAAA,GACf,mDACF;EAEA,IAAI,gBAAgB;EAGpB,IAAI,UAAU,OAAO;EACrB,IAAI;EACJ,IAAI,WAAW;EAEf,OAAO,MAAM;GACX,KAAK,gBAAgB,MAAM;GAC3B,MAAM,gBACJ,YAAY,KAAA,IAAY,YAAY,UAAU;GAChD,IAAI,kBAAkB,GACpB;GAEF,MAAM,OAAO,WAAW,UAAU,IAChC,eACA,SACA,kBACA,KAAK,IAAI,WAAW,aAAa,CACnC;GACA,KAAK,gBAAgB,MAAM;GAE3B,IAAI,KAAK,WAAW,GAClB;GAGF,MAAM,UAAU,KAAK,KAAK,CAAC,aAAa,KAAK,YAC3C,6BAA6B,WAAW,KAAK,MAAM,CACrD;GACA,MAAM,OAAO,KAAK,GAAG,EAAE;GACvB,OAAO,SAAS,KAAA,GAAW,uCAAuC;GAClE,CAAC,eAAe,SAAS,WAAW;GACpC,YAAY,KAAK;GAKjB,MAAM;EACR;EAWA,IACE,kBAAkB,qBACjB,YAAY,KAAA,KAAa,WAAW,UAErC,OACE,kBAAkB,oBAAoB,YAAY,gBAEhD,gDAAgD,kBACpD;CAEJ;CAEA,QAAc;EACZ,IAAI,KAAK,SACP;EAEF,KAAK,UAAU;EACf,KAAK,IAAI,MAAM;CACjB;CAEA,CAAC,OAAO,WAAiB;EACvB,KAAK,MAAM;CACb;;;;;;CAOA,WAA2C;EACzC,IAAI,KAAK,gBAAgB,KAAA,KAAa,KAAK,mBAAmB,GAC5D,KAAK,cAAc;GACjB,MAAM,KAAK,IAAI,QAAQ,0BAA0B;GACjD,WAAW,KAAK,IAAI,QAAQ,gCAAgC,CAAC,CAAC,IAAI,IAAI;EACxE;EAEF,OAAO,KAAK;CACd;CAEA,qBAA8B;EAC5B,OACE,KAAK,IACF,QAAQ,gBAAgB,CAAC,CACzB,IAA6B,uBAAuB,MAAM,KAAA;CAEjE;CAEA,cAAoB;EAClB,IAAI,KAAK,SACP,MAAM,IAAI,WAAW,oCAAoC;CAE7D;CAEA,gBAAgB,QAAuC;EACrD,KAAK,YAAY;EACjB,IAAI,QAAQ,SACV,MAAM,IAAI,WAAW,gCAAgC;CAEzD;AACF"}

package/out/zero-cache/src/services/change-streamer/sqlite-change-log-writer.js

@@ -1,9 +1,9 @@
 import { assert } from "../../../../shared/src/asserts.js";
 import { must } from "../../../../shared/src/must.js";
 import { h32 } from "../../../../shared/src/hash.js";
-import { readCookieRowCounts, readCookies } from "../replicator/change-log-cookies.js";
-import { StatementRunner } from "../../db/statements.js";
 import { isSQLiteCorruption, logSQLiteCorruptionDiagnostics } from "../../db/sqlite-corruption.js";
+import { StatementRunner } from "../../db/statements.js";
+import { readCookieRowCounts, readCookies } from "../replicator/change-log-cookies.js";
 import { ChangeLogRebuildRequired, changeLogFileName, changeLogWipeReason, deleteChangeLogDB, openChangeLogDBForWriting, readChangeLogHead, rebuildChangeLogDBForWriting, reconcileChangeLog } from "../replicator/change-log-db.js";
 import { extractChangeSubstring } from "./change-log-codec.js";
 import { ChangeLogStreamWriter } from "../replicator/change-log-stream-writer.js";
@@ -198,9 +198,7 @@ var SQLiteChangeLogWriter = class {
 				case "rollback":
 					writer.rollback();
 					break;
-				default:
-					writer.append(json, msg, storedChange);
-					break;
+				default: writer.append(json, msg, storedChange);
 			}
 			observer?.messageProcessed(change, commit, startedAt === void 0 ? void 0 : performance.now() - startedAt);
 			if (commit !== null && commit.stats.cookieMutations.length > 0) observer?.cookiesMutated(commit.stats.cookieMutations, readCookieRowCounts(db));

package/out/zero-cache/src/services/change-streamer/sqlite-change-log-writer.js.map

@@ -1 +1 @@
-{"version":3,"file":"sqlite-change-log-writer.js","names":["#lc","#opts","#now","#shadowValidationPercent","#disabled","#db","#observer","#reconcile","#resumeFromLog","#writer","#failSoft","#validateTransaction","#isSelectedForShadowValidation"],"sources":["../../../../../../zero-cache/src/services/change-streamer/sqlite-change-log-writer.ts"],"sourcesContent":["import type {LogContext} from '@rocicorp/logger';\nimport {SqliteError} from '@rocicorp/zero-sqlite3';\nimport {assert} from '../../../../shared/src/asserts.ts';\nimport {h32} from '../../../../shared/src/hash.ts';\nimport {must} from '../../../../shared/src/must.ts';\nimport type {Database} from '../../../../zqlite/src/db.ts';\nimport {\n  isSQLiteCorruption,\n  logSQLiteCorruptionDiagnostics,\n} from '../../db/sqlite-corruption.ts';\nimport {StatementRunner} from '../../db/statements.ts';\nimport type {ChangeStreamData} from '../change-source/protocol/current/downstream.ts';\nimport {\n  readCookieRowCounts,\n  readCookies,\n} from '../replicator/change-log-cookies.ts';\nimport {\n  ChangeLogRebuildRequired,\n  changeLogFileName,\n  changeLogWipeReason,\n  deleteChangeLogDB,\n  openChangeLogDBForWriting,\n  readChangeLogHead,\n  rebuildChangeLogDBForWriting,\n  reconcileChangeLog,\n  type ChangeLogAnchor,\n  type ChangeLogIdentity,\n  type ChangeLogResumePoint,\n  type ReconcileResult,\n} from '../replicator/change-log-db.ts';\nimport {ChangeLogStreamWriter} from '../replicator/change-log-stream-writer.ts';\nimport {\n  getSQLiteChangeLogInfo,\n  logSQLiteChangeLogStartup,\n  recordSQLiteChangeLogReconcile,\n  SQLiteChangeLogObserver,\n  type ChangeLogCommit,\n  type SQLiteChangeLogObservabilityState,\n} from '../replicator/sqlite-change-log-observability.ts';\nimport {extractChangeSubstring} from './change-log-codec.ts';\n\nexport type SQLiteChangeLogWriterOptions = {\n  /** The replica file the log is named after, i.e. `${replicaFile}-change-log`. */\n  replicaFile: string;\n  /** The replica whose contents this log belongs to. */\n  identity: ChangeLogIdentity;\n  /**\n   * Called after each transaction's log commit, with the log's new head. This\n   * is what releases the catchup barrier: after the writer moved in-process,\n   * the head advances here rather than at a subscriber's ACK.\n   */\n  onCommit?: ((watermark: string) => void) | undefined;\n  /**\n   * Called when the writer disables itself and deletes the file. The reader is\n   * cached on the service, so a delete that leaves it open would leave an\n   * in-process reader serving an unlinked inode while every new open sees\n   * nothing.\n   */\n  onDisabled?: (() => void) | undefined;\n  /** Called when reconciliation replaces the file, to close cached readers. */\n  onRebuilt?: (() => void) | undefined;\n  /** Overridable for tests. */\n  now?: (() => number) | undefined;\n  /**\n   * Percentage of transactions that retain the rollout-only per-message\n   * timing and source-vs-stored hash validation. Defaults to 1.\n   */\n  shadowValidationPercent?: number | undefined;\n};\n\nconst DEFAULT_SHADOW_VALIDATION_PERCENT = 1;\n\n/**\n * Appends the canonical change stream to the SQLite change log, from the\n * change-streamer's own stream loop.\n *\n * ### Ordering\n *\n * The log's commit for a transaction precedes the forward of that transaction's\n * `commit` message, and nothing `await`s in between. Everything that can\n * advance the watermark the stream would resume from — the storer's Postgres\n * commit, `lastWatermark`, the upstream ACK — runs strictly after it, so the\n * log's head is always at or above the resume point. A *hole* is therefore\n * unreachable at any crash timing, and a *phantom* is the normal state, which is\n * what makes truncate-above the whole of reconciliation.\n *\n * ### Fail-soft\n *\n * The log is a catchup cache: nothing in it is not either already durable in the\n * replica's litestream backup or re-derivable from the replication slot. A write\n * failure must therefore not stop replication for the shard. Corruption is\n * rebuilt once at open; any other write error — a full disk, an I/O error, a\n * permissions problem — logs, disables the writer, deletes the file, closes the\n * reader, and lets the stream continue. The cost is catchup reach, and reach is\n * recoverable: `too-old` sends a subscriber to a restore.\n *\n * One carve-out keeps that from hiding the bug class this topology introduces. A\n * missed truncate-above surfaces as `SQLITE_CONSTRAINT` on the writer's plain\n * `INSERT`, which is \"any write error other than corruption\" and would be\n * absorbed quietly. It is counted as an invariant failure and alerted on before\n * failing soft.\n */\nexport class SQLiteChangeLogWriter {\n  readonly #lc: LogContext;\n  readonly #opts: SQLiteChangeLogWriterOptions;\n  readonly #now: () => number;\n  readonly #shadowValidationPercent: number;\n\n  #db: Database | undefined;\n  #writer: ChangeLogStreamWriter | undefined;\n  #observer: SQLiteChangeLogObserver | undefined;\n  #disabled = false;\n  #validateTransaction = false;\n\n  constructor(lc: LogContext, opts: SQLiteChangeLogWriterOptions) {\n    this.#lc = lc.withContext('component', 'sqlite-change-log-writer');\n    this.#opts = opts;\n    this.#now = opts.now ?? Date.now;\n    this.#shadowValidationPercent =\n      opts.shadowValidationPercent ?? DEFAULT_SHADOW_VALIDATION_PERCENT;\n    assert(\n      Number.isInteger(this.#shadowValidationPercent) &&\n        this.#shadowValidationPercent >= 0 &&\n        this.#shadowValidationPercent <= 100,\n      'SQLite change-log shadow validation percentage must be an integer between 0 and 100',\n    );\n  }\n\n  /** False once the writer has failed soft, or after {@link close}. */\n  get enabled(): boolean {\n    return !this.#disabled;\n  }\n\n  /**\n   * The writer's own connection, which is the one purge runs on (§3.3): one\n   * process appends *and* deletes, on one handle, with no second writable\n   * connection and no cross-process barrier. `undefined` until the stream\n   * loop's first reconcile creates the log, and again once the writer has\n   * failed soft and deleted the file — both of which a purge cycle treats as\n   * \"skip\", not as an error.\n   */\n  get connection(): Database | undefined {\n    return this.#db;\n  }\n\n  /** Exposed for tests and for the integration assertions on the metrics. */\n  state(): SQLiteChangeLogObservabilityState | undefined {\n    return this.#observer?.state();\n  }\n\n  /**\n   * Opens the log if necessary and reconciles it with the Postgres resume\n   * point. Returns the resume point stored in the log.\n   *\n   * Returns `undefined` when the writer is disabled. The caller must then use\n   * another source.\n   *\n   * This runs for every connection because Postgres supplies a new resume point\n   * after each reconnect. The log can contain transactions above that point.\n   * Reconciliation removes them before Postgres sends them again.\n   *\n   * `resumeFrom` includes cookies because the cookies must match the resume\n   * watermark.\n   */\n  reconcile(\n    resumeFrom: ChangeLogResumePoint,\n  ): ChangeLogResumePoint | undefined {\n    return this.#reconcile(() => resumeFrom);\n  }\n\n  /**\n   * Reconciles the log without a Postgres resume point.\n   *\n   * A valid log uses its own head and cookies. A new or invalid log uses the\n   * replica values returned by `seed`.\n   */\n  reconcileFromLog(\n    seed: () => ChangeLogResumePoint,\n  ): ChangeLogResumePoint | undefined {\n    return this.#reconcile(db => this.#resumeFromLog(db, seed));\n  }\n\n  #reconcile(\n    resolve: (db: Database) => ChangeLogResumePoint,\n  ): ChangeLogResumePoint | undefined {\n    if (this.#disabled) {\n      return undefined;\n    }\n    const {replicaFile, identity} = this.#opts;\n    const nowMs = this.#now();\n    const anchor = (db: Database): ChangeLogAnchor => ({\n      ...resolve(db),\n      identity,\n      nowMs,\n    });\n    try {\n      const db = this.#db;\n      if (db === undefined) {\n        const opened = openChangeLogDBForWriting(this.#lc, replicaFile, anchor);\n        this.#db = opened.db;\n        if (opened.replacedFile) {\n          this.#opts.onRebuilt?.();\n        }\n        recordSQLiteChangeLogReconcile(this.#lc, opened.result);\n        const info = getSQLiteChangeLogInfo(opened.db);\n        logSQLiteChangeLogStartup(\n          this.#lc,\n          changeLogFileName(replicaFile),\n          info,\n        );\n        this.#observer = new SQLiteChangeLogObserver(this.#lc, info);\n      } else {\n        const resolved = anchor(db);\n        let result: ReconcileResult;\n        try {\n          result = reconcileChangeLog(this.#lc, db, resolved, {\n            rebuildInsteadOfUnboundedWork: true,\n          });\n        } catch (e) {\n          if (!(e instanceof ChangeLogRebuildRequired)) {\n            throw e;\n          }\n          // Close every handle to the old inode before unlinking it. The writer\n          // is reconstructed below against the replacement connection.\n          this.#writer = undefined;\n          this.#db = undefined;\n          db.close();\n          this.#opts.onRebuilt?.();\n          const rebuilt = rebuildChangeLogDBForWriting(\n            this.#lc,\n            replicaFile,\n            resolved,\n            e,\n          );\n          this.#db = rebuilt.db;\n          result = rebuilt.result;\n        }\n        recordSQLiteChangeLogReconcile(this.#lc, result);\n        if (result.action !== 'none') {\n          this.#observer?.reconciled(\n            getSQLiteChangeLogInfo(\n              must(this.#db, 'the SQLite change log is not open'),\n            ),\n          );\n        }\n      }\n      // A reseed drops and recreates the stream table, so the append statements\n      // are prepared fresh against whatever the reconciliation left behind.\n      const reconciledDB = must(this.#db, 'the SQLite change log is not open');\n      this.#writer = new ChangeLogStreamWriter(\n        new StatementRunner(reconciledDB),\n      );\n      // Read both values after reconciliation. A truncate or reseed updates the\n      // head and cookies in the same transaction.\n      return {\n        resumeWatermark: must(\n          readChangeLogHead(reconciledDB),\n          'the SQLite change log has no head after reconciliation',\n        ),\n        cookies: readCookies(reconciledDB),\n      };\n    } catch (e) {\n      this.#failSoft('reconciling the SQLite change log', e);\n      return undefined;\n    }\n  }\n\n  /**\n   * Returns the resume point supplied by the log.\n   *\n   * A valid log uses its own head and cookies. A log that must be recreated uses\n   * the replica values returned by `seed`.\n   */\n  #resumeFromLog(\n    db: Database,\n    seed: () => ChangeLogResumePoint,\n  ): ChangeLogResumePoint {\n    if (changeLogWipeReason(db, this.#opts.identity) !== undefined) {\n      return seed();\n    }\n    const head = readChangeLogHead(db);\n    // An empty log has no resume point, so use the replica seed.\n    return head === null\n      ? seed()\n      : {resumeWatermark: head, cookies: readCookies(db)};\n  }\n\n  /**\n   * Writes one stream message, committing at transaction boundaries. Never\n   * throws: a write failure disables the writer instead of failing the stream.\n   */\n  write(\n    change: ChangeStreamData,\n    json: string,\n    storedChange = extractChangeSubstring(json, change[1].tag),\n  ): void {\n    const writer = this.#writer;\n    const db = this.#db;\n    if (this.#disabled || writer === undefined || db === undefined) {\n      return;\n    }\n    const [type, msg] = change;\n    if (type === 'begin') {\n      this.#validateTransaction = this.#isSelectedForShadowValidation(\n        change[2].commitWatermark,\n      );\n    }\n    const validateTransaction = this.#validateTransaction;\n    const observer = this.#observer;\n    observer?.messageReceived(change, json, validateTransaction, storedChange);\n    const startedAt = validateTransaction ? performance.now() : undefined;\n    try {\n      let commit: ChangeLogCommit | null = null;\n      switch (type) {\n        case 'begin':\n          writer.begin(\n            change[2].commitWatermark,\n            json,\n            storedChange,\n            validateTransaction,\n          );\n          break;\n        case 'commit': {\n          const {watermark} = change[2];\n          const commitStart = performance.now();\n          const stats = writer.commit(\n            watermark,\n            json,\n            this.#now(),\n            storedChange,\n          );\n          commit = {\n            watermark,\n            stats,\n            logCommitMs: performance.now() - commitStart,\n          };\n          break;\n        }\n        case 'rollback':\n          writer.rollback();\n          break;\n        default:\n          writer.append(json, msg, storedChange);\n          break;\n      }\n      observer?.messageProcessed(\n        change,\n        commit,\n        startedAt === undefined ? undefined : performance.now() - startedAt,\n      );\n      if (commit !== null && commit.stats.cookieMutations.length > 0) {\n        // Only re-counted when a schema change actually moved the cookie jar,\n        // which keeps the count off the forward path of every other\n        // transaction. The counts are read after the commit, so they are what\n        // a reader of the file would see.\n        observer?.cookiesMutated(\n          commit.stats.cookieMutations,\n          readCookieRowCounts(db),\n        );\n      }\n      if (commit !== null) {\n        // The head advanced, and it is durable. Releasing the barrier here is\n        // what makes its poll interval a backstop rather than the mechanism.\n        this.#opts.onCommit?.(commit.watermark);\n      }\n      if (type === 'commit' || type === 'rollback') {\n        this.#validateTransaction = false;\n      }\n    } catch (e) {\n      observer?.messageFailed(\n        change,\n        e,\n        startedAt === undefined ? undefined : performance.now() - startedAt,\n      );\n      this.#validateTransaction = false;\n      if (isConstraintViolation(e)) {\n        // Reconciliation should have truncated whatever this collided with.\n        // Report it as an invariant failure before failing soft, so that a\n        // truncate-above bug cannot look like a lost cache.\n        observer?.invariantFailure(\n          'SQLite change-log insert violated a constraint, which means a ' +\n            'transaction above the resume watermark was not truncated',\n          {tag: msg.tag, error: String(e)},\n        );\n      }\n      this.#failSoft('writing to the SQLite change log', e);\n    }\n  }\n\n  #isSelectedForShadowValidation(watermark: string): boolean {\n    const percent = this.#shadowValidationPercent;\n    return (\n      percent >= 100 ||\n      (percent > 0 &&\n        h32(\n          `${this.#opts.identity.generation}/${this.#opts.identity.replicaID ?? ''}:${watermark}`,\n        ) %\n          100 <\n          percent)\n    );\n  }\n\n  /**\n   * Discards the open transaction, if any. Called when the change stream is\n   * interrupted mid-transaction.\n   */\n  abort(): void {\n    const writer = this.#writer;\n    this.#validateTransaction = false;\n    if (this.#disabled || writer === undefined) {\n      return;\n    }\n    this.#observer?.abort();\n    try {\n      writer.rollback();\n    } catch (e) {\n      this.#failSoft('rolling back the SQLite change log', e);\n    }\n  }\n\n  close(): void {\n    this.#disabled = true;\n    this.#validateTransaction = false;\n    this.#writer = undefined;\n    this.#observer = undefined;\n    const db = this.#db;\n    this.#db = undefined;\n    try {\n      db?.close();\n    } catch (e) {\n      this.#lc.warn?.('error closing the SQLite change log', e);\n    }\n  }\n\n  /**\n   * Logs, disables the writer, deletes the file, and closes the reader, leaving\n   * replication running. Disabling is for the life of the process: a log that\n   * failed a write is not re-opened until the task restarts, so the behavior a\n   * subscriber sees is the same as `sqliteChangeLogMode=off`.\n   */\n  #failSoft(what: string, e: unknown): void {\n    const file = changeLogFileName(this.#opts.replicaFile);\n    if (isSQLiteCorruption(e)) {\n      // Open-time corruption is rebuilt by openChangeLogDBForWriting. Reaching\n      // here means the file went bad under an open handle, which the same\n      // delete-and-reseed answers -- on the next process start rather than now.\n      logSQLiteCorruptionDiagnostics(this.#lc, 'change-log', file, e);\n    }\n    this.#lc.error?.(\n      `error ${what}: disabling the writer and deleting ${file}. ` +\n        `Replication continues; catchup reach is lost until this task restarts.`,\n      e,\n    );\n    this.close();\n    try {\n      deleteChangeLogDB(this.#opts.replicaFile);\n    } catch (deleteError) {\n      this.#lc.error?.(`unable to delete ${file}`, deleteError);\n    }\n    this.#opts.onDisabled?.();\n  }\n}\n\nfunction isConstraintViolation(e: unknown): boolean {\n  return e instanceof SqliteError && e.code.startsWith('SQLITE_CONSTRAINT');\n}\n"],"mappings":";;;;;;;;;;;;AAsEA,IAAM,oCAAoC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgC1C,IAAa,wBAAb,MAAmC;CACjC;CACA;CACA;CACA;CAEA;CACA;CACA;CACA,YAAY;CACZ,uBAAuB;CAEvB,YAAY,IAAgB,MAAoC;EAC9D,KAAKA,MAAM,GAAG,YAAY,aAAa,0BAA0B;EACjE,KAAKC,QAAQ;EACb,KAAKC,OAAO,KAAK,OAAO,KAAK;EAC7B,KAAKC,2BACH,KAAK,2BAA2B;EAClC,OACE,OAAO,UAAU,KAAKA,wBAAwB,KAC5C,KAAKA,4BAA4B,KACjC,KAAKA,4BAA4B,KACnC,qFACF;CACF;;CAGA,IAAI,UAAmB;EACrB,OAAO,CAAC,KAAKC;CACf;;;;;;;;;CAUA,IAAI,aAAmC;EACrC,OAAO,KAAKC;CACd;;CAGA,QAAuD;EACrD,OAAO,KAAKC,WAAW,MAAM;CAC/B;;;;;;;;;;;;;;;CAgBA,UACE,YACkC;EAClC,OAAO,KAAKC,iBAAiB,UAAU;CACzC;;;;;;;CAQA,iBACE,MACkC;EAClC,OAAO,KAAKA,YAAW,OAAM,KAAKC,eAAe,IAAI,IAAI,CAAC;CAC5D;CAEA,WACE,SACkC;EAClC,IAAI,KAAKJ,WACP;EAEF,MAAM,EAAC,aAAa,aAAY,KAAKH;EACrC,MAAM,QAAQ,KAAKC,KAAK;EACxB,MAAM,UAAU,QAAmC;GACjD,GAAG,QAAQ,EAAE;GACb;GACA;EACF;EACA,IAAI;GACF,MAAM,KAAK,KAAKG;GAChB,IAAI,OAAO,KAAA,GAAW;IACpB,MAAM,SAAS,0BAA0B,KAAKL,KAAK,aAAa,MAAM;IACtE,KAAKK,MAAM,OAAO;IAClB,IAAI,OAAO,cACT,KAAKJ,MAAM,YAAY;IAEzB,+BAA+B,KAAKD,KAAK,OAAO,MAAM;IACtD,MAAM,OAAO,uBAAuB,OAAO,EAAE;IAC7C,0BACE,KAAKA,KACL,kBAAkB,WAAW,GAC7B,IACF;IACA,KAAKM,YAAY,IAAI,wBAAwB,KAAKN,KAAK,IAAI;GAC7D,OAAO;IACL,MAAM,WAAW,OAAO,EAAE;IAC1B,IAAI;IACJ,IAAI;KACF,SAAS,mBAAmB,KAAKA,KAAK,IAAI,UAAU,EAClD,+BAA+B,KACjC,CAAC;IACH,SAAS,GAAG;KACV,IAAI,EAAE,aAAa,2BACjB,MAAM;KAIR,KAAKS,UAAU,KAAA;KACf,KAAKJ,MAAM,KAAA;KACX,GAAG,MAAM;KACT,KAAKJ,MAAM,YAAY;KACvB,MAAM,UAAU,6BACd,KAAKD,KACL,aACA,UACA,CACF;KACA,KAAKK,MAAM,QAAQ;KACnB,SAAS,QAAQ;IACnB;IACA,+BAA+B,KAAKL,KAAK,MAAM;IAC/C,IAAI,OAAO,WAAW,QACpB,KAAKM,WAAW,WACd,uBACE,KAAK,KAAKD,KAAK,mCAAmC,CACpD,CACF;GAEJ;GAGA,MAAM,eAAe,KAAK,KAAKA,KAAK,mCAAmC;GACvE,KAAKI,UAAU,IAAI,sBACjB,IAAI,gBAAgB,YAAY,CAClC;GAGA,OAAO;IACL,iBAAiB,KACf,kBAAkB,YAAY,GAC9B,wDACF;IACA,SAAS,YAAY,YAAY;GACnC;EACF,SAAS,GAAG;GACV,KAAKC,UAAU,qCAAqC,CAAC;GACrD;EACF;CACF;;;;;;;CAQA,eACE,IACA,MACsB;EACtB,IAAI,oBAAoB,IAAI,KAAKT,MAAM,QAAQ,MAAM,KAAA,GACnD,OAAO,KAAK;EAEd,MAAM,OAAO,kBAAkB,EAAE;EAEjC,OAAO,SAAS,OACZ,KAAK,IACL;GAAC,iBAAiB;GAAM,SAAS,YAAY,EAAE;EAAC;CACtD;;;;;CAMA,MACE,QACA,MACA,eAAe,uBAAuB,MAAM,OAAO,GAAG,GAAG,GACnD;EACN,MAAM,SAAS,KAAKQ;EACpB,MAAM,KAAK,KAAKJ;EAChB,IAAI,KAAKD,aAAa,WAAW,KAAA,KAAa,OAAO,KAAA,GACnD;EAEF,MAAM,CAAC,MAAM,OAAO;EACpB,IAAI,SAAS,SACX,KAAKO,uBAAuB,KAAKC,+BAC/B,OAAO,GAAG,eACZ;EAEF,MAAM,sBAAsB,KAAKD;EACjC,MAAM,WAAW,KAAKL;EACtB,UAAU,gBAAgB,QAAQ,MAAM,qBAAqB,YAAY;EACzE,MAAM,YAAY,sBAAsB,YAAY,IAAI,IAAI,KAAA;EAC5D,IAAI;GACF,IAAI,SAAiC;GACrC,QAAQ,MAAR;IACE,KAAK;KACH,OAAO,MACL,OAAO,GAAG,iBACV,MACA,cACA,mBACF;KACA;IACF,KAAK,UAAU;KACb,MAAM,EAAC,cAAa,OAAO;KAC3B,MAAM,cAAc,YAAY,IAAI;KAOpC,SAAS;MACP;MACA,OARY,OAAO,OACnB,WACA,MACA,KAAKJ,KAAK,GACV,YAIA;MACA,aAAa,YAAY,IAAI,IAAI;KACnC;KACA;IACF;IACA,KAAK;KACH,OAAO,SAAS;KAChB;IACF;KACE,OAAO,OAAO,MAAM,KAAK,YAAY;KACrC;GACJ;GACA,UAAU,iBACR,QACA,QACA,cAAc,KAAA,IAAY,KAAA,IAAY,YAAY,IAAI,IAAI,SAC5D;GACA,IAAI,WAAW,QAAQ,OAAO,MAAM,gBAAgB,SAAS,GAK3D,UAAU,eACR,OAAO,MAAM,iBACb,oBAAoB,EAAE,CACxB;GAEF,IAAI,WAAW,MAGb,KAAKD,MAAM,WAAW,OAAO,SAAS;GAExC,IAAI,SAAS,YAAY,SAAS,YAChC,KAAKU,uBAAuB;EAEhC,SAAS,GAAG;GACV,UAAU,cACR,QACA,GACA,cAAc,KAAA,IAAY,KAAA,IAAY,YAAY,IAAI,IAAI,SAC5D;GACA,KAAKA,uBAAuB;GAC5B,IAAI,sBAAsB,CAAC,GAIzB,UAAU,iBACR,0HAEA;IAAC,KAAK,IAAI;IAAK,OAAO,OAAO,CAAC;GAAC,CACjC;GAEF,KAAKD,UAAU,oCAAoC,CAAC;EACtD;CACF;CAEA,+BAA+B,WAA4B;EACzD,MAAM,UAAU,KAAKP;EACrB,OACE,WAAW,OACV,UAAU,KACT,IACE,GAAG,KAAKF,MAAM,SAAS,WAAW,GAAG,KAAKA,MAAM,SAAS,aAAa,GAAG,GAAG,WAC9E,IACE,MACA;CAER;;;;;CAMA,QAAc;EACZ,MAAM,SAAS,KAAKQ;EACpB,KAAKE,uBAAuB;EAC5B,IAAI,KAAKP,aAAa,WAAW,KAAA,GAC/B;EAEF,KAAKE,WAAW,MAAM;EACtB,IAAI;GACF,OAAO,SAAS;EAClB,SAAS,GAAG;GACV,KAAKI,UAAU,sCAAsC,CAAC;EACxD;CACF;CAEA,QAAc;EACZ,KAAKN,YAAY;EACjB,KAAKO,uBAAuB;EAC5B,KAAKF,UAAU,KAAA;EACf,KAAKH,YAAY,KAAA;EACjB,MAAM,KAAK,KAAKD;EAChB,KAAKA,MAAM,KAAA;EACX,IAAI;GACF,IAAI,MAAM;EACZ,SAAS,GAAG;GACV,KAAKL,IAAI,OAAO,uCAAuC,CAAC;EAC1D;CACF;;;;;;;CAQA,UAAU,MAAc,GAAkB;EACxC,MAAM,OAAO,kBAAkB,KAAKC,MAAM,WAAW;EACrD,IAAI,mBAAmB,CAAC,GAItB,+BAA+B,KAAKD,KAAK,cAAc,MAAM,CAAC;EAEhE,KAAKA,IAAI,QACP,SAAS,KAAK,sCAAsC,KAAK,2EAEzD,CACF;EACA,KAAK,MAAM;EACX,IAAI;GACF,kBAAkB,KAAKC,MAAM,WAAW;EAC1C,SAAS,aAAa;GACpB,KAAKD,IAAI,QAAQ,oBAAoB,QAAQ,WAAW;EAC1D;EACA,KAAKC,MAAM,aAAa;CAC1B;AACF;AAEA,SAAS,sBAAsB,GAAqB;CAClD,OAAO,aAAa,eAAe,EAAE,KAAK,WAAW,mBAAmB;AAC1E"}
+{"version":3,"file":"sqlite-change-log-writer.js","names":[],"sources":["../../../../../../zero-cache/src/services/change-streamer/sqlite-change-log-writer.ts"],"sourcesContent":["import type {LogContext} from '@rocicorp/logger';\nimport {SqliteError} from '@rocicorp/zero-sqlite3';\nimport {assert} from '../../../../shared/src/asserts.ts';\nimport {h32} from '../../../../shared/src/hash.ts';\nimport {must} from '../../../../shared/src/must.ts';\nimport type {Database} from '../../../../zqlite/src/db.ts';\nimport {\n  isSQLiteCorruption,\n  logSQLiteCorruptionDiagnostics,\n} from '../../db/sqlite-corruption.ts';\nimport {StatementRunner} from '../../db/statements.ts';\nimport type {ChangeStreamData} from '../change-source/protocol/current/downstream.ts';\nimport {\n  readCookieRowCounts,\n  readCookies,\n} from '../replicator/change-log-cookies.ts';\nimport {\n  ChangeLogRebuildRequired,\n  changeLogFileName,\n  changeLogWipeReason,\n  deleteChangeLogDB,\n  openChangeLogDBForWriting,\n  readChangeLogHead,\n  rebuildChangeLogDBForWriting,\n  reconcileChangeLog,\n  type ChangeLogAnchor,\n  type ChangeLogIdentity,\n  type ChangeLogResumePoint,\n  type ReconcileResult,\n} from '../replicator/change-log-db.ts';\nimport {ChangeLogStreamWriter} from '../replicator/change-log-stream-writer.ts';\nimport {\n  getSQLiteChangeLogInfo,\n  logSQLiteChangeLogStartup,\n  recordSQLiteChangeLogReconcile,\n  SQLiteChangeLogObserver,\n  type ChangeLogCommit,\n  type SQLiteChangeLogObservabilityState,\n} from '../replicator/sqlite-change-log-observability.ts';\nimport {extractChangeSubstring} from './change-log-codec.ts';\n\nexport type SQLiteChangeLogWriterOptions = {\n  /** The replica file the log is named after, i.e. `${replicaFile}-change-log`. */\n  replicaFile: string;\n  /** The replica whose contents this log belongs to. */\n  identity: ChangeLogIdentity;\n  /**\n   * Called after each transaction's log commit, with the log's new head. This\n   * is what releases the catchup barrier: after the writer moved in-process,\n   * the head advances here rather than at a subscriber's ACK.\n   */\n  onCommit?: ((watermark: string) => void) | undefined;\n  /**\n   * Called when the writer disables itself and deletes the file. The reader is\n   * cached on the service, so a delete that leaves it open would leave an\n   * in-process reader serving an unlinked inode while every new open sees\n   * nothing.\n   */\n  onDisabled?: (() => void) | undefined;\n  /** Called when reconciliation replaces the file, to close cached readers. */\n  onRebuilt?: (() => void) | undefined;\n  /** Overridable for tests. */\n  now?: (() => number) | undefined;\n  /**\n   * Percentage of transactions that retain the rollout-only per-message\n   * timing and source-vs-stored hash validation. Defaults to 1.\n   */\n  shadowValidationPercent?: number | undefined;\n};\n\nconst DEFAULT_SHADOW_VALIDATION_PERCENT = 1;\n\n/**\n * Appends the canonical change stream to the SQLite change log, from the\n * change-streamer's own stream loop.\n *\n * ### Ordering\n *\n * The log's commit for a transaction precedes the forward of that transaction's\n * `commit` message, and nothing `await`s in between. Everything that can\n * advance the watermark the stream would resume from — the storer's Postgres\n * commit, `lastWatermark`, the upstream ACK — runs strictly after it, so the\n * log's head is always at or above the resume point. A *hole* is therefore\n * unreachable at any crash timing, and a *phantom* is the normal state, which is\n * what makes truncate-above the whole of reconciliation.\n *\n * ### Fail-soft\n *\n * The log is a catchup cache: nothing in it is not either already durable in the\n * replica's litestream backup or re-derivable from the replication slot. A write\n * failure must therefore not stop replication for the shard. Corruption is\n * rebuilt once at open; any other write error — a full disk, an I/O error, a\n * permissions problem — logs, disables the writer, deletes the file, closes the\n * reader, and lets the stream continue. The cost is catchup reach, and reach is\n * recoverable: `too-old` sends a subscriber to a restore.\n *\n * One carve-out keeps that from hiding the bug class this topology introduces. A\n * missed truncate-above surfaces as `SQLITE_CONSTRAINT` on the writer's plain\n * `INSERT`, which is \"any write error other than corruption\" and would be\n * absorbed quietly. It is counted as an invariant failure and alerted on before\n * failing soft.\n */\nexport class SQLiteChangeLogWriter {\n  readonly #lc: LogContext;\n  readonly #opts: SQLiteChangeLogWriterOptions;\n  readonly #now: () => number;\n  readonly #shadowValidationPercent: number;\n\n  #db: Database | undefined;\n  #writer: ChangeLogStreamWriter | undefined;\n  #observer: SQLiteChangeLogObserver | undefined;\n  #disabled = false;\n  #validateTransaction = false;\n\n  constructor(lc: LogContext, opts: SQLiteChangeLogWriterOptions) {\n    this.#lc = lc.withContext('component', 'sqlite-change-log-writer');\n    this.#opts = opts;\n    this.#now = opts.now ?? Date.now;\n    this.#shadowValidationPercent =\n      opts.shadowValidationPercent ?? DEFAULT_SHADOW_VALIDATION_PERCENT;\n    assert(\n      Number.isInteger(this.#shadowValidationPercent) &&\n        this.#shadowValidationPercent >= 0 &&\n        this.#shadowValidationPercent <= 100,\n      'SQLite change-log shadow validation percentage must be an integer between 0 and 100',\n    );\n  }\n\n  /** False once the writer has failed soft, or after {@link close}. */\n  get enabled(): boolean {\n    return !this.#disabled;\n  }\n\n  /**\n   * The writer's own connection, which is the one purge runs on (§3.3): one\n   * process appends *and* deletes, on one handle, with no second writable\n   * connection and no cross-process barrier. `undefined` until the stream\n   * loop's first reconcile creates the log, and again once the writer has\n   * failed soft and deleted the file — both of which a purge cycle treats as\n   * \"skip\", not as an error.\n   */\n  get connection(): Database | undefined {\n    return this.#db;\n  }\n\n  /** Exposed for tests and for the integration assertions on the metrics. */\n  state(): SQLiteChangeLogObservabilityState | undefined {\n    return this.#observer?.state();\n  }\n\n  /**\n   * Opens the log if necessary and reconciles it with the Postgres resume\n   * point. Returns the resume point stored in the log.\n   *\n   * Returns `undefined` when the writer is disabled. The caller must then use\n   * another source.\n   *\n   * This runs for every connection because Postgres supplies a new resume point\n   * after each reconnect. The log can contain transactions above that point.\n   * Reconciliation removes them before Postgres sends them again.\n   *\n   * `resumeFrom` includes cookies because the cookies must match the resume\n   * watermark.\n   */\n  reconcile(\n    resumeFrom: ChangeLogResumePoint,\n  ): ChangeLogResumePoint | undefined {\n    return this.#reconcile(() => resumeFrom);\n  }\n\n  /**\n   * Reconciles the log without a Postgres resume point.\n   *\n   * A valid log uses its own head and cookies. A new or invalid log uses the\n   * replica values returned by `seed`.\n   */\n  reconcileFromLog(\n    seed: () => ChangeLogResumePoint,\n  ): ChangeLogResumePoint | undefined {\n    return this.#reconcile(db => this.#resumeFromLog(db, seed));\n  }\n\n  #reconcile(\n    resolve: (db: Database) => ChangeLogResumePoint,\n  ): ChangeLogResumePoint | undefined {\n    if (this.#disabled) {\n      return undefined;\n    }\n    const {replicaFile, identity} = this.#opts;\n    const nowMs = this.#now();\n    const anchor = (db: Database): ChangeLogAnchor => ({\n      ...resolve(db),\n      identity,\n      nowMs,\n    });\n    try {\n      const db = this.#db;\n      if (db === undefined) {\n        const opened = openChangeLogDBForWriting(this.#lc, replicaFile, anchor);\n        this.#db = opened.db;\n        if (opened.replacedFile) {\n          this.#opts.onRebuilt?.();\n        }\n        recordSQLiteChangeLogReconcile(this.#lc, opened.result);\n        const info = getSQLiteChangeLogInfo(opened.db);\n        logSQLiteChangeLogStartup(\n          this.#lc,\n          changeLogFileName(replicaFile),\n          info,\n        );\n        this.#observer = new SQLiteChangeLogObserver(this.#lc, info);\n      } else {\n        const resolved = anchor(db);\n        let result: ReconcileResult;\n        try {\n          result = reconcileChangeLog(this.#lc, db, resolved, {\n            rebuildInsteadOfUnboundedWork: true,\n          });\n        } catch (e) {\n          if (!(e instanceof ChangeLogRebuildRequired)) {\n            throw e;\n          }\n          // Close every handle to the old inode before unlinking it. The writer\n          // is reconstructed below against the replacement connection.\n          this.#writer = undefined;\n          this.#db = undefined;\n          db.close();\n          this.#opts.onRebuilt?.();\n          const rebuilt = rebuildChangeLogDBForWriting(\n            this.#lc,\n            replicaFile,\n            resolved,\n            e,\n          );\n          this.#db = rebuilt.db;\n          result = rebuilt.result;\n        }\n        recordSQLiteChangeLogReconcile(this.#lc, result);\n        if (result.action !== 'none') {\n          this.#observer?.reconciled(\n            getSQLiteChangeLogInfo(\n              must(this.#db, 'the SQLite change log is not open'),\n            ),\n          );\n        }\n      }\n      // A reseed drops and recreates the stream table, so the append statements\n      // are prepared fresh against whatever the reconciliation left behind.\n      const reconciledDB = must(this.#db, 'the SQLite change log is not open');\n      this.#writer = new ChangeLogStreamWriter(\n        new StatementRunner(reconciledDB),\n      );\n      // Read both values after reconciliation. A truncate or reseed updates the\n      // head and cookies in the same transaction.\n      return {\n        resumeWatermark: must(\n          readChangeLogHead(reconciledDB),\n          'the SQLite change log has no head after reconciliation',\n        ),\n        cookies: readCookies(reconciledDB),\n      };\n    } catch (e) {\n      this.#failSoft('reconciling the SQLite change log', e);\n      return undefined;\n    }\n  }\n\n  /**\n   * Returns the resume point supplied by the log.\n   *\n   * A valid log uses its own head and cookies. A log that must be recreated uses\n   * the replica values returned by `seed`.\n   */\n  #resumeFromLog(\n    db: Database,\n    seed: () => ChangeLogResumePoint,\n  ): ChangeLogResumePoint {\n    if (changeLogWipeReason(db, this.#opts.identity) !== undefined) {\n      return seed();\n    }\n    const head = readChangeLogHead(db);\n    // An empty log has no resume point, so use the replica seed.\n    return head === null\n      ? seed()\n      : {resumeWatermark: head, cookies: readCookies(db)};\n  }\n\n  /**\n   * Writes one stream message, committing at transaction boundaries. Never\n   * throws: a write failure disables the writer instead of failing the stream.\n   */\n  write(\n    change: ChangeStreamData,\n    json: string,\n    storedChange = extractChangeSubstring(json, change[1].tag),\n  ): void {\n    const writer = this.#writer;\n    const db = this.#db;\n    if (this.#disabled || writer === undefined || db === undefined) {\n      return;\n    }\n    const [type, msg] = change;\n    if (type === 'begin') {\n      this.#validateTransaction = this.#isSelectedForShadowValidation(\n        change[2].commitWatermark,\n      );\n    }\n    const validateTransaction = this.#validateTransaction;\n    const observer = this.#observer;\n    observer?.messageReceived(change, json, validateTransaction, storedChange);\n    const startedAt = validateTransaction ? performance.now() : undefined;\n    try {\n      let commit: ChangeLogCommit | null = null;\n      switch (type) {\n        case 'begin':\n          writer.begin(\n            change[2].commitWatermark,\n            json,\n            storedChange,\n            validateTransaction,\n          );\n          break;\n        case 'commit': {\n          const {watermark} = change[2];\n          const commitStart = performance.now();\n          const stats = writer.commit(\n            watermark,\n            json,\n            this.#now(),\n            storedChange,\n          );\n          commit = {\n            watermark,\n            stats,\n            logCommitMs: performance.now() - commitStart,\n          };\n          break;\n        }\n        case 'rollback':\n          writer.rollback();\n          break;\n        default:\n          writer.append(json, msg, storedChange);\n          break;\n      }\n      observer?.messageProcessed(\n        change,\n        commit,\n        startedAt === undefined ? undefined : performance.now() - startedAt,\n      );\n      if (commit !== null && commit.stats.cookieMutations.length > 0) {\n        // Only re-counted when a schema change actually moved the cookie jar,\n        // which keeps the count off the forward path of every other\n        // transaction. The counts are read after the commit, so they are what\n        // a reader of the file would see.\n        observer?.cookiesMutated(\n          commit.stats.cookieMutations,\n          readCookieRowCounts(db),\n        );\n      }\n      if (commit !== null) {\n        // The head advanced, and it is durable. Releasing the barrier here is\n        // what makes its poll interval a backstop rather than the mechanism.\n        this.#opts.onCommit?.(commit.watermark);\n      }\n      if (type === 'commit' || type === 'rollback') {\n        this.#validateTransaction = false;\n      }\n    } catch (e) {\n      observer?.messageFailed(\n        change,\n        e,\n        startedAt === undefined ? undefined : performance.now() - startedAt,\n      );\n      this.#validateTransaction = false;\n      if (isConstraintViolation(e)) {\n        // Reconciliation should have truncated whatever this collided with.\n        // Report it as an invariant failure before failing soft, so that a\n        // truncate-above bug cannot look like a lost cache.\n        observer?.invariantFailure(\n          'SQLite change-log insert violated a constraint, which means a ' +\n            'transaction above the resume watermark was not truncated',\n          {tag: msg.tag, error: String(e)},\n        );\n      }\n      this.#failSoft('writing to the SQLite change log', e);\n    }\n  }\n\n  #isSelectedForShadowValidation(watermark: string): boolean {\n    const percent = this.#shadowValidationPercent;\n    return (\n      percent >= 100 ||\n      (percent > 0 &&\n        h32(\n          `${this.#opts.identity.generation}/${this.#opts.identity.replicaID ?? ''}:${watermark}`,\n        ) %\n          100 <\n          percent)\n    );\n  }\n\n  /**\n   * Discards the open transaction, if any. Called when the change stream is\n   * interrupted mid-transaction.\n   */\n  abort(): void {\n    const writer = this.#writer;\n    this.#validateTransaction = false;\n    if (this.#disabled || writer === undefined) {\n      return;\n    }\n    this.#observer?.abort();\n    try {\n      writer.rollback();\n    } catch (e) {\n      this.#failSoft('rolling back the SQLite change log', e);\n    }\n  }\n\n  close(): void {\n    this.#disabled = true;\n    this.#validateTransaction = false;\n    this.#writer = undefined;\n    this.#observer = undefined;\n    const db = this.#db;\n    this.#db = undefined;\n    try {\n      db?.close();\n    } catch (e) {\n      this.#lc.warn?.('error closing the SQLite change log', e);\n    }\n  }\n\n  /**\n   * Logs, disables the writer, deletes the file, and closes the reader, leaving\n   * replication running. Disabling is for the life of the process: a log that\n   * failed a write is not re-opened until the task restarts, so the behavior a\n   * subscriber sees is the same as `sqliteChangeLogMode=off`.\n   */\n  #failSoft(what: string, e: unknown): void {\n    const file = changeLogFileName(this.#opts.replicaFile);\n    if (isSQLiteCorruption(e)) {\n      // Open-time corruption is rebuilt by openChangeLogDBForWriting. Reaching\n      // here means the file went bad under an open handle, which the same\n      // delete-and-reseed answers -- on the next process start rather than now.\n      logSQLiteCorruptionDiagnostics(this.#lc, 'change-log', file, e);\n    }\n    this.#lc.error?.(\n      `error ${what}: disabling the writer and deleting ${file}. ` +\n        `Replication continues; catchup reach is lost until this task restarts.`,\n      e,\n    );\n    this.close();\n    try {\n      deleteChangeLogDB(this.#opts.replicaFile);\n    } catch (deleteError) {\n      this.#lc.error?.(`unable to delete ${file}`, deleteError);\n    }\n    this.#opts.onDisabled?.();\n  }\n}\n\nfunction isConstraintViolation(e: unknown): boolean {\n  return e instanceof SqliteError && e.code.startsWith('SQLITE_CONSTRAINT');\n}\n"],"mappings":";;;;;;;;;;;;AAsEA,IAAM,oCAAoC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgC1C,IAAa,wBAAb,MAAmC;CACjC;CACA;CACA;CACA;CAEA;CACA;CACA;CACA,YAAY;CACZ,uBAAuB;CAEvB,YAAY,IAAgB,MAAoC;EAC9D,KAAK,MAAM,GAAG,YAAY,aAAa,0BAA0B;EACjE,KAAK,QAAQ;EACb,KAAK,OAAO,KAAK,OAAO,KAAK;EAC7B,KAAK,2BACH,KAAK,2BAA2B;EAClC,OACE,OAAO,UAAU,KAAK,wBAAwB,KAC5C,KAAK,4BAA4B,KACjC,KAAK,4BAA4B,KACnC,qFACF;CACF;;CAGA,IAAI,UAAmB;EACrB,OAAO,CAAC,KAAK;CACf;;;;;;;;;CAUA,IAAI,aAAmC;EACrC,OAAO,KAAK;CACd;;CAGA,QAAuD;EACrD,OAAO,KAAK,WAAW,MAAM;CAC/B;;;;;;;;;;;;;;;CAgBA,UACE,YACkC;EAClC,OAAO,KAAK,iBAAiB,UAAU;CACzC;;;;;;;CAQA,iBACE,MACkC;EAClC,OAAO,KAAK,YAAW,OAAM,KAAK,eAAe,IAAI,IAAI,CAAC;CAC5D;CAEA,WACE,SACkC;EAClC,IAAI,KAAK,WACP;EAEF,MAAM,EAAC,aAAa,aAAY,KAAK;EACrC,MAAM,QAAQ,KAAK,KAAK;EACxB,MAAM,UAAU,QAAmC;GACjD,GAAG,QAAQ,EAAE;GACb;GACA;EACF;EACA,IAAI;GACF,MAAM,KAAK,KAAK;GAChB,IAAI,OAAO,KAAA,GAAW;IACpB,MAAM,SAAS,0BAA0B,KAAK,KAAK,aAAa,MAAM;IACtE,KAAK,MAAM,OAAO;IAClB,IAAI,OAAO,cACT,KAAK,MAAM,YAAY;IAEzB,+BAA+B,KAAK,KAAK,OAAO,MAAM;IACtD,MAAM,OAAO,uBAAuB,OAAO,EAAE;IAC7C,0BACE,KAAK,KACL,kBAAkB,WAAW,GAC7B,IACF;IACA,KAAK,YAAY,IAAI,wBAAwB,KAAK,KAAK,IAAI;GAC7D,OAAO;IACL,MAAM,WAAW,OAAO,EAAE;IAC1B,IAAI;IACJ,IAAI;KACF,SAAS,mBAAmB,KAAK,KAAK,IAAI,UAAU,EAClD,+BAA+B,KACjC,CAAC;IACH,SAAS,GAAG;KACV,IAAI,EAAE,aAAa,2BACjB,MAAM;KAIR,KAAK,UAAU,KAAA;KACf,KAAK,MAAM,KAAA;KACX,GAAG,MAAM;KACT,KAAK,MAAM,YAAY;KACvB,MAAM,UAAU,6BACd,KAAK,KACL,aACA,UACA,CACF;KACA,KAAK,MAAM,QAAQ;KACnB,SAAS,QAAQ;IACnB;IACA,+BAA+B,KAAK,KAAK,MAAM;IAC/C,IAAI,OAAO,WAAW,QACpB,KAAK,WAAW,WACd,uBACE,KAAK,KAAK,KAAK,mCAAmC,CACpD,CACF;GAEJ;GAGA,MAAM,eAAe,KAAK,KAAK,KAAK,mCAAmC;GACvE,KAAK,UAAU,IAAI,sBACjB,IAAI,gBAAgB,YAAY,CAClC;GAGA,OAAO;IACL,iBAAiB,KACf,kBAAkB,YAAY,GAC9B,wDACF;IACA,SAAS,YAAY,YAAY;GACnC;EACF,SAAS,GAAG;GACV,KAAK,UAAU,qCAAqC,CAAC;GACrD;EACF;CACF;;;;;;;CAQA,eACE,IACA,MACsB;EACtB,IAAI,oBAAoB,IAAI,KAAK,MAAM,QAAQ,MAAM,KAAA,GACnD,OAAO,KAAK;EAEd,MAAM,OAAO,kBAAkB,EAAE;EAEjC,OAAO,SAAS,OACZ,KAAK,IACL;GAAC,iBAAiB;GAAM,SAAS,YAAY,EAAE;EAAC;CACtD;;;;;CAMA,MACE,QACA,MACA,eAAe,uBAAuB,MAAM,OAAO,EAAE,CAAC,GAAG,GACnD;EACN,MAAM,SAAS,KAAK;EACpB,MAAM,KAAK,KAAK;EAChB,IAAI,KAAK,aAAa,WAAW,KAAA,KAAa,OAAO,KAAA,GACnD;EAEF,MAAM,CAAC,MAAM,OAAO;EACpB,IAAI,SAAS,SACX,KAAK,uBAAuB,KAAK,+BAC/B,OAAO,EAAE,CAAC,eACZ;EAEF,MAAM,sBAAsB,KAAK;EACjC,MAAM,WAAW,KAAK;EACtB,UAAU,gBAAgB,QAAQ,MAAM,qBAAqB,YAAY;EACzE,MAAM,YAAY,sBAAsB,YAAY,IAAI,IAAI,KAAA;EAC5D,IAAI;GACF,IAAI,SAAiC;GACrC,QAAQ,MAAR;IACE,KAAK;KACH,OAAO,MACL,OAAO,EAAE,CAAC,iBACV,MACA,cACA,mBACF;KACA;IACF,KAAK,UAAU;KACb,MAAM,EAAC,cAAa,OAAO;KAC3B,MAAM,cAAc,YAAY,IAAI;KAOpC,SAAS;MACP;MACA,OARY,OAAO,OACnB,WACA,MACA,KAAK,KAAK,GACV,YAIA;MACA,aAAa,YAAY,IAAI,IAAI;KACnC;KACA;IACF;IACA,KAAK;KACH,OAAO,SAAS;KAChB;IACF,SACE,OAAO,OAAO,MAAM,KAAK,YAAY;GAEzC;GACA,UAAU,iBACR,QACA,QACA,cAAc,KAAA,IAAY,KAAA,IAAY,YAAY,IAAI,IAAI,SAC5D;GACA,IAAI,WAAW,QAAQ,OAAO,MAAM,gBAAgB,SAAS,GAK3D,UAAU,eACR,OAAO,MAAM,iBACb,oBAAoB,EAAE,CACxB;GAEF,IAAI,WAAW,MAGb,KAAK,MAAM,WAAW,OAAO,SAAS;GAExC,IAAI,SAAS,YAAY,SAAS,YAChC,KAAK,uBAAuB;EAEhC,SAAS,GAAG;GACV,UAAU,cACR,QACA,GACA,cAAc,KAAA,IAAY,KAAA,IAAY,YAAY,IAAI,IAAI,SAC5D;GACA,KAAK,uBAAuB;GAC5B,IAAI,sBAAsB,CAAC,GAIzB,UAAU,iBACR,0HAEA;IAAC,KAAK,IAAI;IAAK,OAAO,OAAO,CAAC;GAAC,CACjC;GAEF,KAAK,UAAU,oCAAoC,CAAC;EACtD;CACF;CAEA,+BAA+B,WAA4B;EACzD,MAAM,UAAU,KAAK;EACrB,OACE,WAAW,OACV,UAAU,KACT,IACE,GAAG,KAAK,MAAM,SAAS,WAAW,GAAG,KAAK,MAAM,SAAS,aAAa,GAAG,GAAG,WAC9E,IACE,MACA;CAER;;;;;CAMA,QAAc;EACZ,MAAM,SAAS,KAAK;EACpB,KAAK,uBAAuB;EAC5B,IAAI,KAAK,aAAa,WAAW,KAAA,GAC/B;EAEF,KAAK,WAAW,MAAM;EACtB,IAAI;GACF,OAAO,SAAS;EAClB,SAAS,GAAG;GACV,KAAK,UAAU,sCAAsC,CAAC;EACxD;CACF;CAEA,QAAc;EACZ,KAAK,YAAY;EACjB,KAAK,uBAAuB;EAC5B,KAAK,UAAU,KAAA;EACf,KAAK,YAAY,KAAA;EACjB,MAAM,KAAK,KAAK;EAChB,KAAK,MAAM,KAAA;EACX,IAAI;GACF,IAAI,MAAM;EACZ,SAAS,GAAG;GACV,KAAK,IAAI,OAAO,uCAAuC,CAAC;EAC1D;CACF;;;;;;;CAQA,UAAU,MAAc,GAAkB;EACxC,MAAM,OAAO,kBAAkB,KAAK,MAAM,WAAW;EACrD,IAAI,mBAAmB,CAAC,GAItB,+BAA+B,KAAK,KAAK,cAAc,MAAM,CAAC;EAEhE,KAAK,IAAI,QACP,SAAS,KAAK,sCAAsC,KAAK,2EAEzD,CACF;EACA,KAAK,MAAM;EACX,IAAI;GACF,kBAAkB,KAAK,MAAM,WAAW;EAC1C,SAAS,aAAa;GACpB,KAAK,IAAI,QAAQ,oBAAoB,QAAQ,WAAW;EAC1D;EACA,KAAK,MAAM,aAAa;CAC1B;AACF;AAEA,SAAS,sBAAsB,GAAqB;CAClD,OAAO,aAAa,eAAe,EAAE,KAAK,WAAW,mBAAmB;AAC1E"}

package/out/zero-cache/src/services/change-streamer/storer.js

@@ -1,5 +1,6 @@
 import { assert, unreachable } from "../../../../shared/src/asserts.js";
 import { promiseVoid } from "../../../../shared/src/resolved-promises.js";
+import { resolver } from "../../../../shared/src/resolver.js";
 import { AbortError } from "../../../../shared/src/abort-error.js";
 import { parse, valita_exports } from "../../../../shared/src/valita.js";
 import { must } from "../../../../shared/src/must.js";
@@ -9,16 +10,15 @@ import { isDataChange, isSchemaChange } from "../change-source/protocol/current/
 import "../change-source/protocol/current/downstream.js";
 import { backfillRequestSchema } from "../change-source/protocol/current/upstream.js";
 import "../change-source/protocol/current.js";
-import { cookieOps } from "../replicator/change-log-cookies.js";
 import "../../types/pg.js";
 import { orTimeout } from "../../types/timeout.js";
+import { cookieOps } from "../replicator/change-log-cookies.js";
 import { READONLY, READ_COMMITTED } from "../../db/mode-enum.js";
 import { runTx } from "../../db/run-transaction.js";
 import { Queue } from "../../../../shared/src/queue.js";
 import { AutoResetSignal, ensureReplicationConfig, markResetRequired, reinitializeChangeLog } from "./schema/tables.js";
 import { TransactionPool, sharedSnapshot } from "../../db/transaction-pool.js";
 import { reconstructWatermarkedChange, serializeChangeStreamDataWithChange } from "./change-log-codec.js";
-import { resolver } from "@rocicorp/resolver";
 import "postgres";
 import { getHeapStatistics } from "node:v8";
 //#region ../zero-cache/src/services/change-streamer/storer.ts
@@ -739,7 +739,7 @@ var Storer = class {
 						if (lastBatchConsumed) lc[elapsed > 100 ? "info" : "debug"]?.(`waited ${elapsed.toFixed(3)} ms for ${sub.id} to consume last batch of catchup entries`);
 						for (const entry of entries) if (entry.watermark === sub.watermark) watermarkFound = true;
 						else if (watermarkFound) {
-							lastBatchConsumed = sub.catchup(reconstructWatermarkedChange(entry));
+							lastBatchConsumed = sub.catchup(reconstructWatermarkedChange(entry.watermark, entry.tag, entry.change));
 							count++;
 						} else if (mode === "backup") throw new AutoResetSignal(`backup replica at watermark ${sub.watermark} is behind change db: ${entry.watermark})`);
 						else {
@@ -1011,6 +1011,6 @@ var ProgressMonitor = class {
 	}
 };
 //#endregion
-export { PurgeLocker, Storer };
+export { ProgressMonitor, PurgeLock, PurgeLocker, Storer };
 
 //# sourceMappingURL=storer.js.map