@rocicorp/zero 1.12.0-canary.1 → 1.12.0-canary.10

package/out/zero-cache/src/services/profz.js.map

@@ -1 +1 @@
-{"version":3,"file":"profz.js","names":[],"sources":["../../../../../zero-cache/src/services/profz.ts"],"sourcesContent":["import {randomUUID} from 'node:crypto';\nimport type {Profiler} from 'node:inspector';\nimport type {LogContext} from '@rocicorp/logger';\nimport auth from 'basic-auth';\nimport type {FastifyReply, FastifyRequest} from 'fastify';\nimport {sleep} from '../../../shared/src/sleep.ts';\nimport type {NormalizedZeroConfig} from '../config/normalize.ts';\nimport {getOperatorAccess} from '../config/zero-config.ts';\nimport {\n  singleProcessMode,\n  subscribeToMessageType,\n  type ProfileResponse,\n  type ProfileResponseMessage,\n  type Worker,\n} from '../types/processes.ts';\nimport {CpuProfiler} from '../types/profiler.ts';\nimport {URLParams} from '../types/url-params.ts';\n\n/**\n * Serves CPU profiles. This is available to the operator password as well as\n * the admin password (see `--operator-password`), so it must never serve\n * application data to `operator` access.\n *\n * A V8 CPU profile describes code, not data: function names, script URLs and\n * positions, and sample timings. The exception is a regular expression, which\n * V8 names after its source (`RegExp: <source>`). zero-cache compiles `LIKE`\n * and `ILIKE` patterns from client queries into regular expressions, so their\n * sources are redacted for `operator` access. See {@link redactProfile}.\n */\nexport async function handleProfzRequest(\n  lc: LogContext,\n  config: Pick<NormalizedZeroConfig, 'adminPassword' | 'operatorPassword'>,\n  req: FastifyRequest,\n  res: FastifyReply,\n  getWorker?: (() => Promise<Worker>) | undefined,\n  forcedWorker?: string | undefined,\n  localProcessName: string = 'dispatcher',\n): Promise<void> {\n  const credentials = auth(req);\n  const access = getOperatorAccess(lc, config, credentials?.pass);\n  if (access === undefined) {\n    void res\n      .code(401)\n      .header('WWW-Authenticate', 'Basic realm=\"Profz Protected Area\"')\n      .send('Unauthorized');\n    return;\n  }\n\n  const params = new URLParams(new URL(req.url, 'http://localhost'));\n  const rawDuration =\n    params.getInteger('duration', false) ??\n    params.getInteger('seconds', false) ??\n    5;\n  const durationSec = Math.max(1, Math.min(60, rawDuration));\n  const durationMs = durationSec * 1000;\n  const targetWorker = forcedWorker ?? params.get('worker', false) ?? undefined;\n  const targetWorkerIndex = params.getInteger('index', false) ?? undefined;\n  const id = randomUUID();\n\n  const responses = new Map<string, unknown>();\n\n  // Profile dispatcher / local process if requested, when profiling all processes,\n  // or when no worker dispatcher is available (single process / standalone mode)\n  const shouldProfileLocal =\n    singleProcessMode() ||\n    getWorker === undefined ||\n    targetWorker === undefined ||\n    targetWorker === localProcessName;\n\n  const localProfilePromise = shouldProfileLocal\n    ? CpuProfiler.profile(durationMs).catch(err => {\n        lc.warn?.('Failed to capture local CPU profile:', err);\n        return null;\n      })\n    : Promise.resolve(null);\n\n  if (!singleProcessMode() && getWorker !== undefined) {\n    try {\n      const worker = await getWorker();\n      const onMessage = (msg: ProfileResponse) => {\n        if (msg.id === id && msg.profile) {\n          responses.set(msg.name, msg.profile);\n        } else if (msg.id === id && msg.error) {\n          lc.warn?.(`Worker ${msg.name} profile error: ${msg.error}`);\n        }\n      };\n\n      // The worker is long-lived (and shared across requests), so the\n      // per-request handler must be removed once this request is done.\n      const unsubscribe = subscribeToMessageType<ProfileResponseMessage>(\n        worker,\n        'profileResponse',\n        onMessage,\n      );\n      try {\n        worker.send([\n          'profile',\n          {\n            id,\n            durationMs,\n            worker:\n              targetWorker === localProcessName ? '__none__' : targetWorker,\n            workerIndex: targetWorkerIndex,\n          },\n        ]);\n\n        // Wait for profile duration, then wait for child workers to transfer\n        // profiles over IPC. Under heavy production load, serializing and sending\n        // large CPU profiles can take several seconds.\n        const graceMs =\n          params.getInteger('graceMs', false) ??\n          params.getInteger('timeout', false) ??\n          5000;\n        await sleep(durationMs);\n\n        const pollMs = 50;\n        let waited = 0;\n        let lastCount = responses.size;\n        let quietMs = 0;\n        while (waited < graceMs) {\n          await sleep(pollMs);\n          waited += pollMs;\n\n          if (targetWorker && targetWorker !== 'all') {\n            const hasTarget = [...responses.keys()].some(\n              name =>\n                name === targetWorker || name.startsWith(`${targetWorker}-`),\n            );\n            if (hasTarget) {\n              break;\n            }\n          } else if (responses.size !== lastCount) {\n            lastCount = responses.size;\n            quietMs = 0;\n          } else if (responses.size > 0) {\n            quietMs += pollMs;\n            if (quietMs >= 400) {\n              break;\n            }\n          }\n        }\n      } finally {\n        unsubscribe();\n      }\n    } catch (err) {\n      lc.warn?.('Failed to dispatch profile request to child workers:', err);\n    }\n  }\n\n  const localProfile = await localProfilePromise;\n  if (localProfile) {\n    const localName =\n      targetWorker ?? (singleProcessMode() ? 'zero-cache' : localProcessName);\n    responses.set(localName, localProfile);\n  }\n\n  if (access === 'operator') {\n    for (const [name, prof] of responses) {\n      responses.set(name, redactProfile(prof));\n    }\n  }\n\n  // If a single specific worker was requested, return that profile directly\n  if (targetWorker !== undefined && targetWorker !== 'all') {\n    let matchedProfile = responses.get(targetWorker);\n    if (!matchedProfile) {\n      // Try matching by prefix or substring (e.g. 'syncer' matches 'syncer-0')\n      for (const [name, prof] of responses.entries()) {\n        if (name === targetWorker || name.startsWith(`${targetWorker}-`)) {\n          matchedProfile = prof;\n          break;\n        }\n      }\n    }\n\n    if (matchedProfile) {\n      void res\n        .header('Content-Type', 'application/json')\n        .header(\n          'Content-Disposition',\n          `attachment; filename=\"${targetWorker}.cpuprofile\"`,\n        )\n        .send(matchedProfile);\n      return;\n    }\n\n    void res.code(404).send({\n      error: `No profile captured for worker \"${targetWorker}\". Available: ${[...responses.keys()].join(', ')}`,\n    });\n    return;\n  }\n\n  // Default (Option A): Return multi-process profile bundle as a JSON map\n  const bundle: Record<string, unknown> = {};\n  for (const [name, prof] of responses.entries()) {\n    bundle[name] = prof;\n  }\n\n  void res\n    .header('Content-Type', 'application/json')\n    .header(\n      'Content-Disposition',\n      `attachment; filename=\"zero-profile-bundle-${Date.now()}.json\"`,\n    )\n    .send(bundle);\n}\n\nexport async function handleProfrmzRequest(\n  lc: LogContext,\n  config: NormalizedZeroConfig,\n  req: FastifyRequest,\n  res: FastifyReply,\n  getWorker?: (() => Promise<Worker>) | undefined,\n): Promise<void> {\n  const credentials = auth(req);\n  if (getOperatorAccess(lc, config, credentials?.pass) === undefined) {\n    void res\n      .code(401)\n      .header('WWW-Authenticate', 'Basic realm=\"Profrmz Protected Area\"')\n      .send('Unauthorized');\n    return;\n  }\n\n  // In distributed mode, proxy to the upstream Replication Manager. The\n  // credentials are forwarded, and the Replication Manager's /profz decides\n  // for itself what access they grant (and so what to redact).\n  if (config.changeStreamer.uri) {\n    const upstreamURL = new URL('/profz', config.changeStreamer.uri);\n    if (upstreamURL.protocol === 'ws:') {\n      upstreamURL.protocol = 'http:';\n    } else if (upstreamURL.protocol === 'wss:') {\n      upstreamURL.protocol = 'https:';\n    }\n    const incomingURL = new URL(req.url, 'http://localhost');\n    for (const [key, value] of incomingURL.searchParams.entries()) {\n      upstreamURL.searchParams.set(key, value);\n    }\n\n    try {\n      const headers: Record<string, string> = {};\n      if (req.headers.authorization) {\n        headers.authorization = req.headers.authorization;\n      }\n      const response = await fetch(upstreamURL.toString(), {\n        method: 'GET',\n        headers,\n      });\n\n      res.code(response.status);\n      const contentType = response.headers.get('content-type');\n      if (contentType) {\n        res.header('content-type', contentType);\n      }\n      const contentDisposition = response.headers.get('content-disposition');\n      if (contentDisposition) {\n        res.header('content-disposition', contentDisposition);\n      }\n\n      const body = await response.text();\n      return res.send(body);\n    } catch (err) {\n      lc.error?.(`Failed to proxy /profrmz to RM at ${upstreamURL}:`, err);\n      return res.code(502).send({\n        error: `Failed to proxy profiling request to RM at ${upstreamURL}: ${String(err)}`,\n      });\n    }\n  }\n\n  // In single-node mode, profile local change-streamer / RM process\n  return handleProfzRequest(lc, config, req, res, getWorker, 'change-streamer');\n}\n\n// V8 names the code for a regular expression `RegExp: <source>`.\nconst REGEXP_NAME_PREFIX = 'RegExp:';\nconst REDACTED_REGEXP_NAME = 'RegExp: <redacted>';\n\n/**\n * Returns a copy of the V8 CPU `profile` with the source of every regular\n * expression replaced, since a pattern built at runtime can contain\n * application data (e.g. a `LIKE` pattern from a client query). The time spent\n * in regular expressions is still attributed to them.\n *\n * A `profile` that is not in the expected format is withheld rather than\n * served unredacted.\n *\n * @visibleForTesting\n */\nexport function redactProfile(profile: unknown): unknown {\n  const {nodes} = (profile ?? {}) as Partial<Profiler.Profile>;\n  if (!Array.isArray(nodes)) {\n    return {error: 'Profile withheld: unrecognized format'};\n  }\n  return {\n    ...(profile as Profiler.Profile),\n    nodes: nodes.map(node =>\n      node.callFrame?.functionName?.startsWith(REGEXP_NAME_PREFIX)\n        ? {\n            ...node,\n            callFrame: {...node.callFrame, functionName: REDACTED_REGEXP_NAME},\n          }\n        : node,\n    ),\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AA6BA,eAAsB,mBACpB,IACA,QACA,KACA,KACA,WACA,cACA,mBAA2B,cACZ;CAEf,MAAM,SAAS,kBAAkB,IAAI,QADjB,KAAK,GACoB,GAAa,IAAI;CAC9D,IAAI,WAAW,KAAA,GAAW;EACxB,IACG,KAAK,GAAG,EACR,OAAO,oBAAoB,sCAAoC,EAC/D,KAAK,cAAc;EACtB;CACF;CAEA,MAAM,SAAS,IAAI,UAAU,IAAI,IAAI,IAAI,KAAK,kBAAkB,CAAC;CACjE,MAAM,cACJ,OAAO,WAAW,YAAY,KAAK,KACnC,OAAO,WAAW,WAAW,KAAK,KAClC;CAEF,MAAM,aADc,KAAK,IAAI,GAAG,KAAK,IAAI,IAAI,WAAW,CACrC,IAAc;CACjC,MAAM,eAAe,gBAAgB,OAAO,IAAI,UAAU,KAAK,KAAK,KAAA;CACpE,MAAM,oBAAoB,OAAO,WAAW,SAAS,KAAK,KAAK,KAAA;CAC/D,MAAM,KAAK,WAAW;CAEtB,MAAM,4BAAY,IAAI,IAAqB;CAU3C,MAAM,sBALJ,kBAAkB,KAClB,cAAc,KAAA,KACd,iBAAiB,KAAA,KACjB,iBAAiB,mBAGf,YAAY,QAAQ,UAAU,EAAE,OAAM,QAAO;EAC3C,GAAG,OAAO,wCAAwC,GAAG;EACrD,OAAO;CACT,CAAC,IACD,QAAQ,QAAQ,IAAI;CAExB,IAAI,CAAC,kBAAkB,KAAK,cAAc,KAAA,GACxC,IAAI;EACF,MAAM,SAAS,MAAM,UAAU;EAC/B,MAAM,aAAa,QAAyB;GAC1C,IAAI,IAAI,OAAO,MAAM,IAAI,SACvB,UAAU,IAAI,IAAI,MAAM,IAAI,OAAO;QAC9B,IAAI,IAAI,OAAO,MAAM,IAAI,OAC9B,GAAG,OAAO,UAAU,IAAI,KAAK,kBAAkB,IAAI,OAAO;EAE9D;EAIA,MAAM,cAAc,uBAClB,QACA,mBACA,SACF;EACA,IAAI;GACF,OAAO,KAAK,CACV,WACA;IACE;IACA;IACA,QACE,iBAAiB,mBAAmB,aAAa;IACnD,aAAa;GACf,CACF,CAAC;GAKD,MAAM,UACJ,OAAO,WAAW,WAAW,KAAK,KAClC,OAAO,WAAW,WAAW,KAAK,KAClC;GACF,MAAM,MAAM,UAAU;GAEtB,MAAM,SAAS;GACf,IAAI,SAAS;GACb,IAAI,YAAY,UAAU;GAC1B,IAAI,UAAU;GACd,OAAO,SAAS,SAAS;IACvB,MAAM,MAAM,MAAM;IAClB,UAAU;IAEV,IAAI,gBAAgB,iBAAiB;SACjB,CAAC,GAAG,UAAU,KAAK,CAAC,EAAE,MACtC,SACE,SAAS,gBAAgB,KAAK,WAAW,GAAG,aAAa,EAAE,CAE3D,GACF;IAAA,OAEG,IAAI,UAAU,SAAS,WAAW;KACvC,YAAY,UAAU;KACtB,UAAU;IACZ,OAAO,IAAI,UAAU,OAAO,GAAG;KAC7B,WAAW;KACX,IAAI,WAAW,KACb;IAEJ;GACF;EACF,UAAU;GACR,YAAY;EACd;CACF,SAAS,KAAK;EACZ,GAAG,OAAO,wDAAwD,GAAG;CACvE;CAGF,MAAM,eAAe,MAAM;CAC3B,IAAI,cAAc;EAChB,MAAM,YACJ,iBAAiB,kBAAkB,IAAI,eAAe;EACxD,UAAU,IAAI,WAAW,YAAY;CACvC;CAEA,IAAI,WAAW,YACb,KAAK,MAAM,CAAC,MAAM,SAAS,WACzB,UAAU,IAAI,MAAM,cAAc,IAAI,CAAC;CAK3C,IAAI,iBAAiB,KAAA,KAAa,iBAAiB,OAAO;EACxD,IAAI,iBAAiB,UAAU,IAAI,YAAY;EAC/C,IAAI,CAAC;QAEE,MAAM,CAAC,MAAM,SAAS,UAAU,QAAQ,GAC3C,IAAI,SAAS,gBAAgB,KAAK,WAAW,GAAG,aAAa,EAAE,GAAG;IAChE,iBAAiB;IACjB;GACF;;EAIJ,IAAI,gBAAgB;GAClB,IACG,OAAO,gBAAgB,kBAAkB,EACzC,OACC,uBACA,yBAAyB,aAAa,aACxC,EACC,KAAK,cAAc;GACtB;EACF;EAEA,IAAS,KAAK,GAAG,EAAE,KAAK,EACtB,OAAO,mCAAmC,aAAa,gBAAgB,CAAC,GAAG,UAAU,KAAK,CAAC,EAAE,KAAK,IAAI,IACxG,CAAC;EACD;CACF;CAGA,MAAM,SAAkC,CAAC;CACzC,KAAK,MAAM,CAAC,MAAM,SAAS,UAAU,QAAQ,GAC3C,OAAO,QAAQ;CAGjB,IACG,OAAO,gBAAgB,kBAAkB,EACzC,OACC,uBACA,6CAA6C,KAAK,IAAI,EAAE,OAC1D,EACC,KAAK,MAAM;AAChB;AAEA,eAAsB,qBACpB,IACA,QACA,KACA,KACA,WACe;CAEf,IAAI,kBAAkB,IAAI,QADN,KAAK,GACS,GAAa,IAAI,MAAM,KAAA,GAAW;EAClE,IACG,KAAK,GAAG,EACR,OAAO,oBAAoB,wCAAsC,EACjE,KAAK,cAAc;EACtB;CACF;CAKA,IAAI,OAAO,eAAe,KAAK;EAC7B,MAAM,cAAc,IAAI,IAAI,UAAU,OAAO,eAAe,GAAG;EAC/D,IAAI,YAAY,aAAa,OAC3B,YAAY,WAAW;OAClB,IAAI,YAAY,aAAa,QAClC,YAAY,WAAW;EAEzB,MAAM,cAAc,IAAI,IAAI,IAAI,KAAK,kBAAkB;EACvD,KAAK,MAAM,CAAC,KAAK,UAAU,YAAY,aAAa,QAAQ,GAC1D,YAAY,aAAa,IAAI,KAAK,KAAK;EAGzC,IAAI;GACF,MAAM,UAAkC,CAAC;GACzC,IAAI,IAAI,QAAQ,eACd,QAAQ,gBAAgB,IAAI,QAAQ;GAEtC,MAAM,WAAW,MAAM,MAAM,YAAY,SAAS,GAAG;IACnD,QAAQ;IACR;GACF,CAAC;GAED,IAAI,KAAK,SAAS,MAAM;GACxB,MAAM,cAAc,SAAS,QAAQ,IAAI,cAAc;GACvD,IAAI,aACF,IAAI,OAAO,gBAAgB,WAAW;GAExC,MAAM,qBAAqB,SAAS,QAAQ,IAAI,qBAAqB;GACrE,IAAI,oBACF,IAAI,OAAO,uBAAuB,kBAAkB;GAGtD,MAAM,OAAO,MAAM,SAAS,KAAK;GACjC,OAAO,IAAI,KAAK,IAAI;EACtB,SAAS,KAAK;GACZ,GAAG,QAAQ,qCAAqC,YAAY,IAAI,GAAG;GACnE,OAAO,IAAI,KAAK,GAAG,EAAE,KAAK,EACxB,OAAO,8CAA8C,YAAY,IAAI,OAAO,GAAG,IACjF,CAAC;EACH;CACF;CAGA,OAAO,mBAAmB,IAAI,QAAQ,KAAK,KAAK,WAAW,iBAAiB;AAC9E;AAGA,IAAM,qBAAqB;AAC3B,IAAM,uBAAuB;;;;;;;;;;;;AAa7B,SAAgB,cAAc,SAA2B;CACvD,MAAM,EAAC,UAAU,WAAW,CAAC;CAC7B,IAAI,CAAC,MAAM,QAAQ,KAAK,GACtB,OAAO,EAAC,OAAO,wCAAuC;CAExD,OAAO;EACL,GAAI;EACJ,OAAO,MAAM,KAAI,SACf,KAAK,WAAW,cAAc,WAAW,kBAAkB,IACvD;GACE,GAAG;GACH,WAAW;IAAC,GAAG,KAAK;IAAW,cAAc;GAAoB;EACnE,IACA,IACN;CACF;AACF"}
+{"version":3,"file":"profz.js","names":[],"sources":["../../../../../zero-cache/src/services/profz.ts"],"sourcesContent":["import {randomUUID} from 'node:crypto';\nimport type {Profiler} from 'node:inspector';\nimport type {LogContext} from '@rocicorp/logger';\nimport auth from 'basic-auth';\nimport type {FastifyReply, FastifyRequest} from 'fastify';\nimport {sleep} from '../../../shared/src/sleep.ts';\nimport type {NormalizedZeroConfig} from '../config/normalize.ts';\nimport {getOperatorAccess} from '../config/zero-config.ts';\nimport {\n  singleProcessMode,\n  subscribeToMessageType,\n  type ProfileResponse,\n  type ProfileResponseMessage,\n  type Worker,\n} from '../types/processes.ts';\nimport {CpuProfiler} from '../types/profiler.ts';\nimport {URLParams} from '../types/url-params.ts';\n\n/**\n * Serves CPU profiles. This is available to the operator password as well as\n * the admin password (see `--operator-password`), so it must never serve\n * application data to `operator` access.\n *\n * A V8 CPU profile describes code, not data: function names, script URLs and\n * positions, and sample timings. The exception is a regular expression, which\n * V8 names after its source (`RegExp: <source>`). zero-cache compiles `LIKE`\n * and `ILIKE` patterns from client queries into regular expressions, so their\n * sources are redacted for `operator` access. See {@link redactProfile}.\n */\nexport async function handleProfzRequest(\n  lc: LogContext,\n  config: Pick<NormalizedZeroConfig, 'adminPassword' | 'operatorPassword'>,\n  req: FastifyRequest,\n  res: FastifyReply,\n  getWorker?: (() => Promise<Worker>) | undefined,\n  forcedWorker?: string | undefined,\n  localProcessName: string = 'dispatcher',\n): Promise<void> {\n  const credentials = auth(req);\n  const access = getOperatorAccess(lc, config, credentials?.pass);\n  if (access === undefined) {\n    void res\n      .code(401)\n      .header('WWW-Authenticate', 'Basic realm=\"Profz Protected Area\"')\n      .send('Unauthorized');\n    return;\n  }\n\n  const params = new URLParams(new URL(req.url, 'http://localhost'));\n  const rawDuration =\n    params.getInteger('duration', false) ??\n    params.getInteger('seconds', false) ??\n    5;\n  const durationSec = Math.max(1, Math.min(60, rawDuration));\n  const durationMs = durationSec * 1000;\n  const targetWorker = forcedWorker ?? params.get('worker', false) ?? undefined;\n  const targetWorkerIndex = params.getInteger('index', false) ?? undefined;\n  const id = randomUUID();\n\n  const responses = new Map<string, unknown>();\n\n  // Profile dispatcher / local process if requested, when profiling all processes,\n  // or when no worker dispatcher is available (single process / standalone mode)\n  const shouldProfileLocal =\n    singleProcessMode() ||\n    getWorker === undefined ||\n    targetWorker === undefined ||\n    targetWorker === localProcessName;\n\n  const localProfilePromise = shouldProfileLocal\n    ? CpuProfiler.profile(durationMs).catch(err => {\n        lc.warn?.('Failed to capture local CPU profile:', err);\n        return null;\n      })\n    : Promise.resolve(null);\n\n  if (!singleProcessMode() && getWorker !== undefined) {\n    try {\n      const worker = await getWorker();\n      const onMessage = (msg: ProfileResponse) => {\n        if (msg.id === id && msg.profile) {\n          responses.set(msg.name, msg.profile);\n        } else if (msg.id === id && msg.error) {\n          lc.warn?.(`Worker ${msg.name} profile error: ${msg.error}`);\n        }\n      };\n\n      // The worker is long-lived (and shared across requests), so the\n      // per-request handler must be removed once this request is done.\n      const unsubscribe = subscribeToMessageType<ProfileResponseMessage>(\n        worker,\n        'profileResponse',\n        onMessage,\n      );\n      try {\n        worker.send([\n          'profile',\n          {\n            id,\n            durationMs,\n            worker:\n              targetWorker === localProcessName ? '__none__' : targetWorker,\n            workerIndex: targetWorkerIndex,\n          },\n        ]);\n\n        // Wait for profile duration, then wait for child workers to transfer\n        // profiles over IPC. Under heavy production load, serializing and sending\n        // large CPU profiles can take several seconds.\n        const graceMs =\n          params.getInteger('graceMs', false) ??\n          params.getInteger('timeout', false) ??\n          5000;\n        await sleep(durationMs);\n\n        const pollMs = 50;\n        let waited = 0;\n        let lastCount = responses.size;\n        let quietMs = 0;\n        while (waited < graceMs) {\n          await sleep(pollMs);\n          waited += pollMs;\n\n          if (targetWorker && targetWorker !== 'all') {\n            const hasTarget = [...responses.keys()].some(\n              name =>\n                name === targetWorker || name.startsWith(`${targetWorker}-`),\n            );\n            if (hasTarget) {\n              break;\n            }\n          } else if (responses.size !== lastCount) {\n            lastCount = responses.size;\n            quietMs = 0;\n          } else if (responses.size > 0) {\n            quietMs += pollMs;\n            if (quietMs >= 400) {\n              break;\n            }\n          }\n        }\n      } finally {\n        unsubscribe();\n      }\n    } catch (err) {\n      lc.warn?.('Failed to dispatch profile request to child workers:', err);\n    }\n  }\n\n  const localProfile = await localProfilePromise;\n  if (localProfile) {\n    const localName =\n      targetWorker ?? (singleProcessMode() ? 'zero-cache' : localProcessName);\n    responses.set(localName, localProfile);\n  }\n\n  if (access === 'operator') {\n    for (const [name, prof] of responses) {\n      responses.set(name, redactProfile(prof));\n    }\n  }\n\n  // If a single specific worker was requested, return that profile directly\n  if (targetWorker !== undefined && targetWorker !== 'all') {\n    let matchedProfile = responses.get(targetWorker);\n    if (!matchedProfile) {\n      // Try matching by prefix or substring (e.g. 'syncer' matches 'syncer-0')\n      for (const [name, prof] of responses.entries()) {\n        if (name === targetWorker || name.startsWith(`${targetWorker}-`)) {\n          matchedProfile = prof;\n          break;\n        }\n      }\n    }\n\n    if (matchedProfile) {\n      void res\n        .header('Content-Type', 'application/json')\n        .header(\n          'Content-Disposition',\n          `attachment; filename=\"${targetWorker}.cpuprofile\"`,\n        )\n        .send(matchedProfile);\n      return;\n    }\n\n    void res.code(404).send({\n      error: `No profile captured for worker \"${targetWorker}\". Available: ${[...responses.keys()].join(', ')}`,\n    });\n    return;\n  }\n\n  // Default (Option A): Return multi-process profile bundle as a JSON map\n  const bundle: Record<string, unknown> = {};\n  for (const [name, prof] of responses.entries()) {\n    bundle[name] = prof;\n  }\n\n  void res\n    .header('Content-Type', 'application/json')\n    .header(\n      'Content-Disposition',\n      `attachment; filename=\"zero-profile-bundle-${Date.now()}.json\"`,\n    )\n    .send(bundle);\n}\n\nexport async function handleProfrmzRequest(\n  lc: LogContext,\n  config: NormalizedZeroConfig,\n  req: FastifyRequest,\n  res: FastifyReply,\n  getWorker?: (() => Promise<Worker>) | undefined,\n): Promise<void> {\n  const credentials = auth(req);\n  if (getOperatorAccess(lc, config, credentials?.pass) === undefined) {\n    void res\n      .code(401)\n      .header('WWW-Authenticate', 'Basic realm=\"Profrmz Protected Area\"')\n      .send('Unauthorized');\n    return;\n  }\n\n  // In distributed mode, proxy to the upstream Replication Manager. The\n  // credentials are forwarded, and the Replication Manager's /profz decides\n  // for itself what access they grant (and so what to redact).\n  if (config.changeStreamer.uri) {\n    const upstreamURL = new URL('/profz', config.changeStreamer.uri);\n    if (upstreamURL.protocol === 'ws:') {\n      upstreamURL.protocol = 'http:';\n    } else if (upstreamURL.protocol === 'wss:') {\n      upstreamURL.protocol = 'https:';\n    }\n    const incomingURL = new URL(req.url, 'http://localhost');\n    for (const [key, value] of incomingURL.searchParams.entries()) {\n      upstreamURL.searchParams.set(key, value);\n    }\n\n    try {\n      const headers: Record<string, string> = {};\n      if (req.headers.authorization) {\n        headers.authorization = req.headers.authorization;\n      }\n      const response = await fetch(upstreamURL.toString(), {\n        method: 'GET',\n        headers,\n      });\n\n      res.code(response.status);\n      const contentType = response.headers.get('content-type');\n      if (contentType) {\n        res.header('content-type', contentType);\n      }\n      const contentDisposition = response.headers.get('content-disposition');\n      if (contentDisposition) {\n        res.header('content-disposition', contentDisposition);\n      }\n\n      const body = await response.text();\n      return res.send(body);\n    } catch (err) {\n      lc.error?.(`Failed to proxy /profrmz to RM at ${upstreamURL}:`, err);\n      return res.code(502).send({\n        error: `Failed to proxy profiling request to RM at ${upstreamURL}: ${String(err)}`,\n      });\n    }\n  }\n\n  // In single-node mode, profile local change-streamer / RM process\n  return handleProfzRequest(lc, config, req, res, getWorker, 'change-streamer');\n}\n\n// V8 names the code for a regular expression `RegExp: <source>`.\nconst REGEXP_NAME_PREFIX = 'RegExp:';\nconst REDACTED_REGEXP_NAME = 'RegExp: <redacted>';\n\n/**\n * Returns a copy of the V8 CPU `profile` with the source of every regular\n * expression replaced, since a pattern built at runtime can contain\n * application data (e.g. a `LIKE` pattern from a client query). The time spent\n * in regular expressions is still attributed to them.\n *\n * A `profile` that is not in the expected format is withheld rather than\n * served unredacted.\n *\n * @visibleForTesting\n */\nexport function redactProfile(profile: unknown): unknown {\n  const {nodes} = (profile ?? {}) as Partial<Profiler.Profile>;\n  if (!Array.isArray(nodes)) {\n    return {error: 'Profile withheld: unrecognized format'};\n  }\n  return {\n    ...(profile as Profiler.Profile),\n    nodes: nodes.map(node =>\n      node.callFrame?.functionName?.startsWith(REGEXP_NAME_PREFIX)\n        ? {\n            ...node,\n            callFrame: {...node.callFrame, functionName: REDACTED_REGEXP_NAME},\n          }\n        : node,\n    ),\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AA6BA,eAAsB,mBACpB,IACA,QACA,KACA,KACA,WACA,cACA,mBAA2B,cACZ;CACf,MAAM,cAAc,KAAK,GAAG;CAC5B,MAAM,SAAS,kBAAkB,IAAI,QAAQ,aAAa,IAAI;CAC9D,IAAI,WAAW,KAAA,GAAW;EACxB,IACG,KAAK,GAAG,CAAC,CACT,OAAO,oBAAoB,sCAAoC,CAAC,CAChE,KAAK,cAAc;EACtB;CACF;CAEA,MAAM,SAAS,IAAI,UAAU,IAAI,IAAI,IAAI,KAAK,kBAAkB,CAAC;CACjE,MAAM,cACJ,OAAO,WAAW,YAAY,KAAK,KACnC,OAAO,WAAW,WAAW,KAAK,KAClC;CAEF,MAAM,aADc,KAAK,IAAI,GAAG,KAAK,IAAI,IAAI,WAAW,CACrC,IAAc;CACjC,MAAM,eAAe,gBAAgB,OAAO,IAAI,UAAU,KAAK,KAAK,KAAA;CACpE,MAAM,oBAAoB,OAAO,WAAW,SAAS,KAAK,KAAK,KAAA;CAC/D,MAAM,KAAK,WAAW;CAEtB,MAAM,4BAAY,IAAI,IAAqB;CAU3C,MAAM,sBALJ,kBAAkB,KAClB,cAAc,KAAA,KACd,iBAAiB,KAAA,KACjB,iBAAiB,mBAGf,YAAY,QAAQ,UAAU,CAAC,CAAC,OAAM,QAAO;EAC3C,GAAG,OAAO,wCAAwC,GAAG;EACrD,OAAO;CACT,CAAC,IACD,QAAQ,QAAQ,IAAI;CAExB,IAAI,CAAC,kBAAkB,KAAK,cAAc,KAAA,GACxC,IAAI;EACF,MAAM,SAAS,MAAM,UAAU;EAC/B,MAAM,aAAa,QAAyB;GAC1C,IAAI,IAAI,OAAO,MAAM,IAAI,SACvB,UAAU,IAAI,IAAI,MAAM,IAAI,OAAO;QAC9B,IAAI,IAAI,OAAO,MAAM,IAAI,OAC9B,GAAG,OAAO,UAAU,IAAI,KAAK,kBAAkB,IAAI,OAAO;EAE9D;EAIA,MAAM,cAAc,uBAClB,QACA,mBACA,SACF;EACA,IAAI;GACF,OAAO,KAAK,CACV,WACA;IACE;IACA;IACA,QACE,iBAAiB,mBAAmB,aAAa;IACnD,aAAa;GACf,CACF,CAAC;GAKD,MAAM,UACJ,OAAO,WAAW,WAAW,KAAK,KAClC,OAAO,WAAW,WAAW,KAAK,KAClC;GACF,MAAM,MAAM,UAAU;GAEtB,MAAM,SAAS;GACf,IAAI,SAAS;GACb,IAAI,YAAY,UAAU;GAC1B,IAAI,UAAU;GACd,OAAO,SAAS,SAAS;IACvB,MAAM,MAAM,MAAM;IAClB,UAAU;IAEV,IAAI,gBAAgB,iBAAiB,OACjB;SAAA,CAAC,GAAG,UAAU,KAAK,CAAC,CAAC,CAAC,MACtC,SACE,SAAS,gBAAgB,KAAK,WAAW,GAAG,aAAa,EAAE,CAE3D,GACF;IAAA,OAEG,IAAI,UAAU,SAAS,WAAW;KACvC,YAAY,UAAU;KACtB,UAAU;IACZ,OAAO,IAAI,UAAU,OAAO,GAAG;KAC7B,WAAW;KACX,IAAI,WAAW,KACb;IAEJ;GACF;EACF,UAAU;GACR,YAAY;EACd;CACF,SAAS,KAAK;EACZ,GAAG,OAAO,wDAAwD,GAAG;CACvE;CAGF,MAAM,eAAe,MAAM;CAC3B,IAAI,cAAc;EAChB,MAAM,YACJ,iBAAiB,kBAAkB,IAAI,eAAe;EACxD,UAAU,IAAI,WAAW,YAAY;CACvC;CAEA,IAAI,WAAW,YACb,KAAK,MAAM,CAAC,MAAM,SAAS,WACzB,UAAU,IAAI,MAAM,cAAc,IAAI,CAAC;CAK3C,IAAI,iBAAiB,KAAA,KAAa,iBAAiB,OAAO;EACxD,IAAI,iBAAiB,UAAU,IAAI,YAAY;EAC/C,IAAI,CAAC,gBAEE;QAAA,MAAM,CAAC,MAAM,SAAS,UAAU,QAAQ,GAC3C,IAAI,SAAS,gBAAgB,KAAK,WAAW,GAAG,aAAa,EAAE,GAAG;IAChE,iBAAiB;IACjB;GACF;;EAIJ,IAAI,gBAAgB;GAClB,IACG,OAAO,gBAAgB,kBAAkB,CAAC,CAC1C,OACC,uBACA,yBAAyB,aAAa,aACxC,CAAC,CACA,KAAK,cAAc;GACtB;EACF;EAEA,IAAS,KAAK,GAAG,CAAC,CAAC,KAAK,EACtB,OAAO,mCAAmC,aAAa,gBAAgB,CAAC,GAAG,UAAU,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IACxG,CAAC;EACD;CACF;CAGA,MAAM,SAAkC,CAAC;CACzC,KAAK,MAAM,CAAC,MAAM,SAAS,UAAU,QAAQ,GAC3C,OAAO,QAAQ;CAGjB,IACG,OAAO,gBAAgB,kBAAkB,CAAC,CAC1C,OACC,uBACA,6CAA6C,KAAK,IAAI,EAAE,OAC1D,CAAC,CACA,KAAK,MAAM;AAChB;AAEA,eAAsB,qBACpB,IACA,QACA,KACA,KACA,WACe;CACf,MAAM,cAAc,KAAK,GAAG;CAC5B,IAAI,kBAAkB,IAAI,QAAQ,aAAa,IAAI,MAAM,KAAA,GAAW;EAClE,IACG,KAAK,GAAG,CAAC,CACT,OAAO,oBAAoB,wCAAsC,CAAC,CAClE,KAAK,cAAc;EACtB;CACF;CAKA,IAAI,OAAO,eAAe,KAAK;EAC7B,MAAM,cAAc,IAAI,IAAI,UAAU,OAAO,eAAe,GAAG;EAC/D,IAAI,YAAY,aAAa,OAC3B,YAAY,WAAW;OAClB,IAAI,YAAY,aAAa,QAClC,YAAY,WAAW;EAEzB,MAAM,cAAc,IAAI,IAAI,IAAI,KAAK,kBAAkB;EACvD,KAAK,MAAM,CAAC,KAAK,UAAU,YAAY,aAAa,QAAQ,GAC1D,YAAY,aAAa,IAAI,KAAK,KAAK;EAGzC,IAAI;GACF,MAAM,UAAkC,CAAC;GACzC,IAAI,IAAI,QAAQ,eACd,QAAQ,gBAAgB,IAAI,QAAQ;GAEtC,MAAM,WAAW,MAAM,MAAM,YAAY,SAAS,GAAG;IACnD,QAAQ;IACR;GACF,CAAC;GAED,IAAI,KAAK,SAAS,MAAM;GACxB,MAAM,cAAc,SAAS,QAAQ,IAAI,cAAc;GACvD,IAAI,aACF,IAAI,OAAO,gBAAgB,WAAW;GAExC,MAAM,qBAAqB,SAAS,QAAQ,IAAI,qBAAqB;GACrE,IAAI,oBACF,IAAI,OAAO,uBAAuB,kBAAkB;GAGtD,MAAM,OAAO,MAAM,SAAS,KAAK;GACjC,OAAO,IAAI,KAAK,IAAI;EACtB,SAAS,KAAK;GACZ,GAAG,QAAQ,qCAAqC,YAAY,IAAI,GAAG;GACnE,OAAO,IAAI,KAAK,GAAG,CAAC,CAAC,KAAK,EACxB,OAAO,8CAA8C,YAAY,IAAI,OAAO,GAAG,IACjF,CAAC;EACH;CACF;CAGA,OAAO,mBAAmB,IAAI,QAAQ,KAAK,KAAK,WAAW,iBAAiB;AAC9E;AAGA,IAAM,qBAAqB;AAC3B,IAAM,uBAAuB;;;;;;;;;;;;AAa7B,SAAgB,cAAc,SAA2B;CACvD,MAAM,EAAC,UAAU,WAAW,CAAC;CAC7B,IAAI,CAAC,MAAM,QAAQ,KAAK,GACtB,OAAO,EAAC,OAAO,wCAAuC;CAExD,OAAO;EACL,GAAI;EACJ,OAAO,MAAM,KAAI,SACf,KAAK,WAAW,cAAc,WAAW,kBAAkB,IACvD;GACE,GAAG;GACH,WAAW;IAAC,GAAG,KAAK;IAAW,cAAc;GAAoB;EACnE,IACA,IACN;CACF;AACF"}

package/out/zero-cache/src/services/replicator/change-log-cookies.js.map

@@ -1 +1 @@
-{"version":3,"file":"change-log-cookies.js","names":["#upsertMetadata","#upsertBackfill","#renameMetadataTable","#renameBackfillTable","#deleteMetadataTable","#deleteBackfillTable","#renameBackfillColumn","#deleteBackfillColumn","#run"],"sources":["../../../../../../zero-cache/src/services/replicator/change-log-cookies.ts"],"sourcesContent":["/**\n * The change log's *second* job.\n *\n * A change log is a buffer **and** a cookie jar. The buffer catches a\n * reconnecting subscriber up to the head; the cookie jar holds the backfill\n * progress state that the change-streamer hands the change-source on every\n * `startStream`, so that the change source never has to persist backfill state\n * upstream. See `change-log-db.ts` for the buffer.\n *\n * There are two cookies, mirroring the two `cdc` tables the Postgres change log\n * has always carried (`change-streamer/schema/tables.ts`):\n *\n * - **table metadata**, the most current {@link TableMetadata} of a table, which\n *   a {@link BackfillRequest} has to carry; and\n * - **backfilling columns**, the opaque {@link BackfillID} of every column whose\n *   backfill has not completed.\n *\n * Both are a *fold over the change stream*: the cookie set is only meaningful\n * paired with the watermark it was folded up to. {@link cookieOps} is that fold,\n * expressed transport-free so that the Postgres change log and the SQLite change\n * log cannot drift from each other — they must agree on all eight transitions\n * forever, and the failure mode if they disagree is a backfill that is silently\n * never re-requested. The two interpreters are {@link ChangeLogCookieWriter}\n * here and `Storer.#trackBackfillMetadata()` in\n * `change-streamer/storer.ts`.\n *\n * The tables live in the change-log database rather than in the replica: the\n * replicator is a subscriber *downstream* of the change-streamer's write loop,\n * so its state version trails the log's head, and pairing its cookies with the\n * log's resume watermark would lose every backfill that completed in between.\n * The replica's own copies (`_zero.tableMetadata`, `_zero.column_metadata`) are\n * the *seed* source; these are the *working* set.\n */\n\nimport {unreachable} from '../../../../shared/src/asserts.ts';\nimport {BigIntJSON} from '../../../../shared/src/bigint-json.ts';\nimport * as v from '../../../../shared/src/valita.ts';\nimport type {Database, Statement} from '../../../../zqlite/src/db.ts';\nimport type {\n  BackfillID,\n  Identifier,\n  SchemaChange,\n  TableMetadata,\n} from '../change-source/protocol/current/data.ts';\nimport {\n  backfillRequestSchema,\n  type BackfillRequest,\n} from '../change-source/protocol/current/upstream.ts';\n\nexport const CHANGE_LOG_TABLE_METADATA_TABLE = '_zero.changeLogTableMetadata';\nexport const CHANGE_LOG_BACKFILLING_TABLE = '_zero.changeLogBackfilling';\n\n// The names follow the file's existing convention, beside\n// \"_zero.changeLogStream\" and \"_zero.changeLogMeta\".\n//\n// `metadata` and `backfill` hold the JSON that the `cdc` tables hold as JSONB.\n// SQLite has no JSONB, and nothing here queries into the documents: they are\n// stored to be handed back to the change source verbatim.\nexport const CREATE_CHANGE_LOG_COOKIE_SCHEMA = /*sql*/ `\n  CREATE TABLE \"${CHANGE_LOG_TABLE_METADATA_TABLE}\" (\n    \"schema\"   TEXT NOT NULL,\n    \"table\"    TEXT NOT NULL,\n    \"metadata\" TEXT NOT NULL,\n    PRIMARY KEY (\"schema\", \"table\")\n  );\n\n  CREATE TABLE \"${CHANGE_LOG_BACKFILLING_TABLE}\" (\n    \"schema\"   TEXT NOT NULL,\n    \"table\"    TEXT NOT NULL,\n    \"column\"   TEXT NOT NULL,\n    \"backfill\" TEXT NOT NULL,\n    PRIMARY KEY (\"schema\", \"table\", \"column\")\n  );\n`;\n\nexport const DROP_CHANGE_LOG_COOKIE_TABLES = /*sql*/ `\n  DROP TABLE IF EXISTS \"${CHANGE_LOG_TABLE_METADATA_TABLE}\";\n  DROP TABLE IF EXISTS \"${CHANGE_LOG_BACKFILLING_TABLE}\";\n`;\n\nexport type TableMetadataCookie = {\n  readonly schema: string;\n  readonly table: string;\n  readonly metadata: TableMetadata;\n};\n\nexport type BackfillCookie = {\n  readonly schema: string;\n  readonly table: string;\n  readonly column: string;\n  readonly backfill: BackfillID;\n};\n\n/**\n * The whole cookie set, as of the log's head. Both lists are ordered by their\n * primary key so that two stores' sets can be compared directly.\n */\nexport type CookieSet = {\n  readonly tableMetadata: readonly TableMetadataCookie[];\n  readonly backfilling: readonly BackfillCookie[];\n};\n\nexport const EMPTY_COOKIE_SET: CookieSet = {\n  tableMetadata: [],\n  backfilling: [],\n};\n\n/**\n * A transport-free description of a cookie mutation. This is the whole of what\n * a {@link SchemaChange} means to the cookie jar; everything else about the\n * change belongs to the buffer.\n */\nexport type CookieOp =\n  | {op: 'upsert-metadata'; table: Identifier; metadata: TableMetadata}\n  | {\n      op: 'upsert-backfill';\n      table: Identifier;\n      column: string;\n      backfill: BackfillID;\n    }\n  | {op: 'rename-table'; old: Identifier; new: Identifier}\n  | {op: 'drop-table'; table: Identifier}\n  | {op: 'rename-column'; table: Identifier; old: string; new: string}\n  | {op: 'drop-column'; table: Identifier; column: string}\n  | {op: 'complete-backfill'; table: Identifier; columns: readonly string[]};\n\nexport type CookieOpTag = CookieOp['op'];\n\n/**\n * The fold, and the only place either store decides what a schema change means\n * for the cookie set. Both interpreters are mechanical translations of what this\n * returns, in the order it returns them.\n *\n * Changes that carry no cookie state — index changes, and the `create-table` /\n * `add-column` variants whose optional `metadata` and `backfill` fields are\n * absent — produce no ops.\n */\nexport function cookieOps(change: SchemaChange): CookieOp[] {\n  switch (change.tag) {\n    case 'update-table-metadata':\n      return [\n        {op: 'upsert-metadata', table: change.table, metadata: change.new},\n      ];\n\n    case 'create-table': {\n      const {spec, metadata, backfill} = change;\n      const table = {schema: spec.schema, name: spec.name};\n      const ops: CookieOp[] = [];\n      if (metadata) {\n        ops.push({op: 'upsert-metadata', table, metadata});\n      }\n      if (backfill) {\n        for (const [column, id] of Object.entries(backfill)) {\n          ops.push({op: 'upsert-backfill', table, column, backfill: id});\n        }\n      }\n      return ops;\n    }\n\n    case 'rename-table':\n      return [{op: 'rename-table', old: change.old, new: change.new}];\n\n    case 'drop-table':\n      return [{op: 'drop-table', table: change.id}];\n\n    case 'add-column': {\n      const {table, tableMetadata, column, backfill} = change;\n      const ops: CookieOp[] = [];\n      if (tableMetadata) {\n        ops.push({op: 'upsert-metadata', table, metadata: tableMetadata});\n      }\n      if (backfill) {\n        ops.push({\n          op: 'upsert-backfill',\n          table,\n          column: column.name,\n          backfill,\n        });\n      }\n      return ops;\n    }\n\n    case 'update-column': {\n      // Only a rename moves the cookie; the rest of a column update does not\n      // affect whether or how it is being backfilled.\n      const {table, old, new: updated} = change;\n      return old.name === updated.name\n        ? []\n        : [{op: 'rename-column', table, old: old.name, new: updated.name}];\n    }\n\n    case 'drop-column':\n      return [{op: 'drop-column', table: change.table, column: change.column}];\n\n    case 'backfill-completed': {\n      const {relation, columns} = change;\n      // The rowKey columns are excluded from `columns` but are backfilled with\n      // them, so both are cleared.\n      const cleared = [...relation.rowKey.columns, ...columns];\n      return cleared.length === 0\n        ? []\n        : [\n            {\n              op: 'complete-backfill',\n              table: {schema: relation.schema, name: relation.name},\n              columns: cleared,\n            },\n          ];\n    }\n\n    case 'create-index':\n    case 'drop-index':\n      return [];\n\n    default:\n      // Unreachable: `isSchemaChange()` gates on the same tag set this switch\n      // covers. It is exhaustive so that a new schema-change tag is a compile\n      // error here rather than a silently dropped backfill.\n      unreachable(change);\n  }\n}\n\n/**\n * The SQLite interpreter of {@link cookieOps}, over prepared statements on the\n * change-log database.\n *\n * The statements run inside the log's transaction, in stream order, at the point\n * the schema change is appended (see `ChangeLogStreamWriter`). That is what\n * makes the cookie set atomic with the head — a crash cannot leave cookies ahead\n * of or behind the rows they were folded from — and what makes an aborted\n * transaction discard its cookies with its rows, for free.\n *\n * Statements are prepared against the tables as they exist now, so an instance\n * does not survive a reconcile that drops and recreates them.\n */\nexport class ChangeLogCookieWriter {\n  readonly #upsertMetadata: Statement;\n  readonly #upsertBackfill: Statement;\n  readonly #renameMetadataTable: Statement;\n  readonly #renameBackfillTable: Statement;\n  readonly #deleteMetadataTable: Statement;\n  readonly #deleteBackfillTable: Statement;\n  readonly #renameBackfillColumn: Statement;\n  readonly #deleteBackfillColumn: Statement;\n\n  constructor(db: Database) {\n    this.#upsertMetadata = db.prepare(/*sql*/ `\n      INSERT INTO \"${CHANGE_LOG_TABLE_METADATA_TABLE}\"\n        (\"schema\", \"table\", \"metadata\") VALUES (?, ?, ?)\n        ON CONFLICT (\"schema\", \"table\")\n        DO UPDATE SET \"metadata\" = excluded.\"metadata\"\n    `);\n    this.#upsertBackfill = db.prepare(/*sql*/ `\n      INSERT INTO \"${CHANGE_LOG_BACKFILLING_TABLE}\"\n        (\"schema\", \"table\", \"column\", \"backfill\") VALUES (?, ?, ?, ?)\n        ON CONFLICT (\"schema\", \"table\", \"column\")\n        DO UPDATE SET \"backfill\" = excluded.\"backfill\"\n    `);\n    this.#renameMetadataTable = db.prepare(/*sql*/ `\n      UPDATE \"${CHANGE_LOG_TABLE_METADATA_TABLE}\"\n        SET \"schema\" = ?, \"table\" = ? WHERE \"schema\" = ? AND \"table\" = ?\n    `);\n    this.#renameBackfillTable = db.prepare(/*sql*/ `\n      UPDATE \"${CHANGE_LOG_BACKFILLING_TABLE}\"\n        SET \"schema\" = ?, \"table\" = ? WHERE \"schema\" = ? AND \"table\" = ?\n    `);\n    this.#deleteMetadataTable = db.prepare(/*sql*/ `\n      DELETE FROM \"${CHANGE_LOG_TABLE_METADATA_TABLE}\"\n        WHERE \"schema\" = ? AND \"table\" = ?\n    `);\n    this.#deleteBackfillTable = db.prepare(/*sql*/ `\n      DELETE FROM \"${CHANGE_LOG_BACKFILLING_TABLE}\"\n        WHERE \"schema\" = ? AND \"table\" = ?\n    `);\n    this.#renameBackfillColumn = db.prepare(/*sql*/ `\n      UPDATE \"${CHANGE_LOG_BACKFILLING_TABLE}\" SET \"column\" = ?\n        WHERE \"schema\" = ? AND \"table\" = ? AND \"column\" = ?\n    `);\n    this.#deleteBackfillColumn = db.prepare(/*sql*/ `\n      DELETE FROM \"${CHANGE_LOG_BACKFILLING_TABLE}\"\n        WHERE \"schema\" = ? AND \"table\" = ? AND \"column\" = ?\n    `);\n  }\n\n  /** Applies the change's cookie ops, returning the ops that were applied. */\n  apply(change: SchemaChange): CookieOp[] {\n    const ops = cookieOps(change);\n    for (const op of ops) {\n      this.#run(op);\n    }\n    return ops;\n  }\n\n  #run(op: CookieOp): void {\n    switch (op.op) {\n      case 'upsert-metadata':\n        this.#upsertMetadata.run(\n          op.table.schema,\n          op.table.name,\n          BigIntJSON.stringify(op.metadata),\n        );\n        break;\n\n      case 'upsert-backfill':\n        this.#upsertBackfill.run(\n          op.table.schema,\n          op.table.name,\n          op.column,\n          BigIntJSON.stringify(op.backfill),\n        );\n        break;\n\n      case 'rename-table':\n        this.#renameMetadataTable.run(\n          op.new.schema,\n          op.new.name,\n          op.old.schema,\n          op.old.name,\n        );\n        this.#renameBackfillTable.run(\n          op.new.schema,\n          op.new.name,\n          op.old.schema,\n          op.old.name,\n        );\n        break;\n\n      case 'drop-table':\n        this.#deleteMetadataTable.run(op.table.schema, op.table.name);\n        this.#deleteBackfillTable.run(op.table.schema, op.table.name);\n        break;\n\n      case 'rename-column':\n        this.#renameBackfillColumn.run(\n          op.new,\n          op.table.schema,\n          op.table.name,\n          op.old,\n        );\n        break;\n\n      case 'drop-column':\n        this.#deleteBackfillColumn.run(\n          op.table.schema,\n          op.table.name,\n          op.column,\n        );\n        break;\n\n      case 'complete-backfill':\n        // A per-column delete rather than an `IN` list, which cannot be a\n        // single prepared statement across arities. The columns of one\n        // completed backfill are few, and this runs only on schema changes.\n        for (const column of op.columns) {\n          this.#deleteBackfillColumn.run(\n            op.table.schema,\n            op.table.name,\n            column,\n          );\n        }\n        break;\n\n      default:\n        unreachable(op);\n    }\n  }\n}\n\nconst tableKey = (schema: string, table: string) =>\n  JSON.stringify([schema, table]);\n\nconst columnKey = (schema: string, table: string, column: string) =>\n  JSON.stringify([schema, table, column]);\n\nconst cmp = (a: string, b: string) => (a < b ? -1 : a > b ? 1 : 0);\n\n/**\n * The in-memory interpreter of {@link cookieOps}: the third one, and the only\n * one that is not a store.\n *\n * A replica-derived cookie set is a snapshot at the replica's state version,\n * which trails the change log's head, so it cannot be compared with a\n * Postgres-derived set directly. This carries it forward over the schema changes\n * the log holds in between, which turns \"the two stores disagree, but they are\n * also at different positions\" into an exact equality — and makes a\n * disagreement between any two of the three interpreters visible as an\n * inequality that neither store would have noticed on its own.\n *\n * `changes` must be the log's schema changes over `(from, to]` in stream order.\n * Anything else produces a set that belongs to no watermark.\n */\nexport function foldCookies(\n  cookies: CookieSet,\n  changes: Iterable<SchemaChange>,\n): CookieSet {\n  const metadata = new Map<string, TableMetadataCookie>(\n    cookies.tableMetadata.map(c => [tableKey(c.schema, c.table), c]),\n  );\n  const backfilling = new Map<string, BackfillCookie>(\n    cookies.backfilling.map(c => [columnKey(c.schema, c.table, c.column), c]),\n  );\n  const dropColumn = ({schema, name}: Identifier, column: string) =>\n    backfilling.delete(columnKey(schema, name, column));\n\n  for (const change of changes) {\n    for (const op of cookieOps(change)) {\n      switch (op.op) {\n        case 'upsert-metadata':\n          metadata.set(tableKey(op.table.schema, op.table.name), {\n            schema: op.table.schema,\n            table: op.table.name,\n            metadata: op.metadata,\n          });\n          break;\n\n        case 'upsert-backfill':\n          backfilling.set(\n            columnKey(op.table.schema, op.table.name, op.column),\n            {\n              schema: op.table.schema,\n              table: op.table.name,\n              column: op.column,\n              backfill: op.backfill,\n            },\n          );\n          break;\n\n        case 'rename-table': {\n          const {old, new: renamed} = op;\n          const moved = metadata.get(tableKey(old.schema, old.name));\n          if (moved) {\n            metadata.delete(tableKey(old.schema, old.name));\n            metadata.set(tableKey(renamed.schema, renamed.name), {\n              ...moved,\n              schema: renamed.schema,\n              table: renamed.name,\n            });\n          }\n          // Snapshotted before mutating, since the rename both deletes and\n          // inserts into the map being scanned.\n          for (const [key, cookie] of [...backfilling]) {\n            if (cookie.schema === old.schema && cookie.table === old.name) {\n              backfilling.delete(key);\n              backfilling.set(\n                columnKey(renamed.schema, renamed.name, cookie.column),\n                {...cookie, schema: renamed.schema, table: renamed.name},\n              );\n            }\n          }\n          break;\n        }\n\n        case 'drop-table': {\n          const {schema, name} = op.table;\n          metadata.delete(tableKey(schema, name));\n          for (const [key, cookie] of [...backfilling]) {\n            if (cookie.schema === schema && cookie.table === name) {\n              backfilling.delete(key);\n            }\n          }\n          break;\n        }\n\n        case 'rename-column': {\n          const {schema, name} = op.table;\n          const moved = backfilling.get(columnKey(schema, name, op.old));\n          if (moved) {\n            backfilling.delete(columnKey(schema, name, op.old));\n            backfilling.set(columnKey(schema, name, op.new), {\n              ...moved,\n              column: op.new,\n            });\n          }\n          break;\n        }\n\n        case 'drop-column':\n          dropColumn(op.table, op.column);\n          break;\n\n        case 'complete-backfill':\n          for (const column of op.columns) {\n            dropColumn(op.table, column);\n          }\n          break;\n\n        default:\n          unreachable(op);\n      }\n    }\n  }\n\n  return {\n    tableMetadata: [...metadata.values()].toSorted(\n      (a, b) => cmp(a.schema, b.schema) || cmp(a.table, b.table),\n    ),\n    backfilling: [...backfilling.values()].toSorted(\n      (a, b) =>\n        cmp(a.schema, b.schema) ||\n        cmp(a.table, b.table) ||\n        cmp(a.column, b.column),\n    ),\n  };\n}\n\nconst backfillRequestsSchema = v.array(backfillRequestSchema);\n\n/**\n * Returns one {@link BackfillRequest} for each table with an active backfill.\n * Each request contains the stored table metadata, if available.\n */\nexport function backfillRequestsFrom(cookies: CookieSet): BackfillRequest[] {\n  const metadata = new Map(\n    cookies.tableMetadata.map(c => [tableKey(c.schema, c.table), c.metadata]),\n  );\n  const requests: BackfillRequest[] = [];\n  let curr: BackfillRequest | undefined;\n  for (const {schema, table, column, backfill} of cookies.backfilling) {\n    if (curr?.table.schema !== schema || curr.table.name !== table) {\n      curr = {\n        table: {\n          schema,\n          name: table,\n          // Use `null` when a backfilling table has no metadata. This matches\n          // the result of the Postgres left join.\n          metadata: metadata.get(tableKey(schema, table)) ?? null,\n        },\n        columns: {},\n      };\n      requests.push(curr);\n    }\n    curr.columns[column] = {id: backfill};\n  }\n  return v.parse(requests, backfillRequestsSchema);\n}\n\n/**\n * Reads the whole cookie set, ordered by primary key. This is what a\n * change-streamer would hand `startStream`, and what the Postgres-derived and\n * replica-derived sets are compared against.\n */\nexport function readCookies(db: Database): CookieSet {\n  const tableMetadata = db\n    .prepare(/*sql*/ `\n      SELECT \"schema\", \"table\", \"metadata\"\n        FROM \"${CHANGE_LOG_TABLE_METADATA_TABLE}\"\n        ORDER BY \"schema\", \"table\"\n    `)\n    .all<{schema: string; table: string; metadata: string}>()\n    .map(({schema, table, metadata}) => ({\n      schema,\n      table,\n      metadata: BigIntJSON.parse(metadata) as TableMetadata,\n    }));\n\n  const backfilling = db\n    .prepare(/*sql*/ `\n      SELECT \"schema\", \"table\", \"column\", \"backfill\"\n        FROM \"${CHANGE_LOG_BACKFILLING_TABLE}\"\n        ORDER BY \"schema\", \"table\", \"column\"\n    `)\n    .all<{schema: string; table: string; column: string; backfill: string}>()\n    .map(({schema, table, column, backfill}) => ({\n      schema,\n      table,\n      column,\n      backfill: BigIntJSON.parse(backfill) as BackfillID,\n    }));\n\n  return {tableMetadata, backfilling};\n}\n\n/**\n * Replaces the cookie set wholesale.\n *\n * The cookies are unversioned point-in-time state, so a reconciliation that\n * moves the head invalidates them: truncating the stream above `W` does not roll\n * the cookie set back to `W`, and the truncated transactions can contain\n * `create-table`, `add-column`, and `backfill-completed`. The caller must run\n * this in the same transaction as the reconciliation that invalidated them.\n */\nexport function replaceCookies(db: Database, cookies: CookieSet): void {\n  db.prepare(/*sql*/ `DELETE FROM \"${CHANGE_LOG_TABLE_METADATA_TABLE}\"`).run();\n  db.prepare(/*sql*/ `DELETE FROM \"${CHANGE_LOG_BACKFILLING_TABLE}\"`).run();\n\n  if (cookies.tableMetadata.length > 0) {\n    const insert = db.prepare(/*sql*/ `\n      INSERT INTO \"${CHANGE_LOG_TABLE_METADATA_TABLE}\"\n        (\"schema\", \"table\", \"metadata\") VALUES (?, ?, ?)\n    `);\n    for (const {schema, table, metadata} of cookies.tableMetadata) {\n      insert.run(schema, table, BigIntJSON.stringify(metadata));\n    }\n  }\n  if (cookies.backfilling.length > 0) {\n    const insert = db.prepare(/*sql*/ `\n      INSERT INTO \"${CHANGE_LOG_BACKFILLING_TABLE}\"\n        (\"schema\", \"table\", \"column\", \"backfill\") VALUES (?, ?, ?, ?)\n    `);\n    for (const {schema, table, column, backfill} of cookies.backfilling) {\n      insert.run(schema, table, column, BigIntJSON.stringify(backfill));\n    }\n  }\n}\n\n/** Retained cookie rows, by table. Both are normally zero. */\nexport type CookieRowCounts = {\n  readonly tableMetadata: number;\n  readonly backfilling: number;\n};\n\nexport function readCookieRowCounts(db: Database): CookieRowCounts {\n  return db\n    .prepare(/*sql*/ `\n      SELECT\n        (SELECT count(*) FROM \"${CHANGE_LOG_TABLE_METADATA_TABLE}\")\n          AS \"tableMetadata\",\n        (SELECT count(*) FROM \"${CHANGE_LOG_BACKFILLING_TABLE}\")\n          AS \"backfilling\"\n    `)\n    .get<CookieRowCounts>();\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiDA,IAAa,kCAAkC;AAC/C,IAAa,+BAA+B;AAQ5C,IAAa,kCAA0C;kBACrC,gCAAgC;;;;;;;kBAOhC,6BAA6B;;;;;;;;AAS/C,IAAa,gCAAwC;0BAC3B,gCAAgC;0BAChC,6BAA6B;;;;;;;;;;;AA4DvD,SAAgB,UAAU,QAAkC;CAC1D,QAAQ,OAAO,KAAf;EACE,KAAK,yBACH,OAAO,CACL;GAAC,IAAI;GAAmB,OAAO,OAAO;GAAO,UAAU,OAAO;EAAG,CACnE;EAEF,KAAK,gBAAgB;GACnB,MAAM,EAAC,MAAM,UAAU,aAAY;GACnC,MAAM,QAAQ;IAAC,QAAQ,KAAK;IAAQ,MAAM,KAAK;GAAI;GACnD,MAAM,MAAkB,CAAC;GACzB,IAAI,UACF,IAAI,KAAK;IAAC,IAAI;IAAmB;IAAO;GAAQ,CAAC;GAEnD,IAAI,UACF,KAAK,MAAM,CAAC,QAAQ,OAAO,OAAO,QAAQ,QAAQ,GAChD,IAAI,KAAK;IAAC,IAAI;IAAmB;IAAO;IAAQ,UAAU;GAAE,CAAC;GAGjE,OAAO;EACT;EAEA,KAAK,gBACH,OAAO,CAAC;GAAC,IAAI;GAAgB,KAAK,OAAO;GAAK,KAAK,OAAO;EAAG,CAAC;EAEhE,KAAK,cACH,OAAO,CAAC;GAAC,IAAI;GAAc,OAAO,OAAO;EAAE,CAAC;EAE9C,KAAK,cAAc;GACjB,MAAM,EAAC,OAAO,eAAe,QAAQ,aAAY;GACjD,MAAM,MAAkB,CAAC;GACzB,IAAI,eACF,IAAI,KAAK;IAAC,IAAI;IAAmB;IAAO,UAAU;GAAa,CAAC;GAElE,IAAI,UACF,IAAI,KAAK;IACP,IAAI;IACJ;IACA,QAAQ,OAAO;IACf;GACF,CAAC;GAEH,OAAO;EACT;EAEA,KAAK,iBAAiB;GAGpB,MAAM,EAAC,OAAO,KAAK,KAAK,YAAW;GACnC,OAAO,IAAI,SAAS,QAAQ,OACxB,CAAC,IACD,CAAC;IAAC,IAAI;IAAiB;IAAO,KAAK,IAAI;IAAM,KAAK,QAAQ;GAAI,CAAC;EACrE;EAEA,KAAK,eACH,OAAO,CAAC;GAAC,IAAI;GAAe,OAAO,OAAO;GAAO,QAAQ,OAAO;EAAM,CAAC;EAEzE,KAAK,sBAAsB;GACzB,MAAM,EAAC,UAAU,YAAW;GAG5B,MAAM,UAAU,CAAC,GAAG,SAAS,OAAO,SAAS,GAAG,OAAO;GACvD,OAAO,QAAQ,WAAW,IACtB,CAAC,IACD,CACE;IACE,IAAI;IACJ,OAAO;KAAC,QAAQ,SAAS;KAAQ,MAAM,SAAS;IAAI;IACpD,SAAS;GACX,CACF;EACN;EAEA,KAAK;EACL,KAAK,cACH,OAAO,CAAC;EAEV,SAIE,YAAY,MAAM;CACtB;AACF;;;;;;;;;;;;;;AAeA,IAAa,wBAAb,MAAmC;CACjC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAEA,YAAY,IAAc;EACxB,KAAKA,kBAAkB,GAAG,QAAgB;qBACzB,gCAAgC;;;;KAIhD;EACD,KAAKC,kBAAkB,GAAG,QAAgB;qBACzB,6BAA6B;;;;KAI7C;EACD,KAAKC,uBAAuB,GAAG,QAAgB;gBACnC,gCAAgC;;KAE3C;EACD,KAAKC,uBAAuB,GAAG,QAAgB;gBACnC,6BAA6B;;KAExC;EACD,KAAKC,uBAAuB,GAAG,QAAgB;qBAC9B,gCAAgC;;KAEhD;EACD,KAAKC,uBAAuB,GAAG,QAAgB;qBAC9B,6BAA6B;;KAE7C;EACD,KAAKC,wBAAwB,GAAG,QAAgB;gBACpC,6BAA6B;;KAExC;EACD,KAAKC,wBAAwB,GAAG,QAAgB;qBAC/B,6BAA6B;;KAE7C;CACH;;CAGA,MAAM,QAAkC;EACtC,MAAM,MAAM,UAAU,MAAM;EAC5B,KAAK,MAAM,MAAM,KACf,KAAKC,KAAK,EAAE;EAEd,OAAO;CACT;CAEA,KAAK,IAAoB;EACvB,QAAQ,GAAG,IAAX;GACE,KAAK;IACH,KAAKR,gBAAgB,IACnB,GAAG,MAAM,QACT,GAAG,MAAM,MACT,WAAW,UAAU,GAAG,QAAQ,CAClC;IACA;GAEF,KAAK;IACH,KAAKC,gBAAgB,IACnB,GAAG,MAAM,QACT,GAAG,MAAM,MACT,GAAG,QACH,WAAW,UAAU,GAAG,QAAQ,CAClC;IACA;GAEF,KAAK;IACH,KAAKC,qBAAqB,IACxB,GAAG,IAAI,QACP,GAAG,IAAI,MACP,GAAG,IAAI,QACP,GAAG,IAAI,IACT;IACA,KAAKC,qBAAqB,IACxB,GAAG,IAAI,QACP,GAAG,IAAI,MACP,GAAG,IAAI,QACP,GAAG,IAAI,IACT;IACA;GAEF,KAAK;IACH,KAAKC,qBAAqB,IAAI,GAAG,MAAM,QAAQ,GAAG,MAAM,IAAI;IAC5D,KAAKC,qBAAqB,IAAI,GAAG,MAAM,QAAQ,GAAG,MAAM,IAAI;IAC5D;GAEF,KAAK;IACH,KAAKC,sBAAsB,IACzB,GAAG,KACH,GAAG,MAAM,QACT,GAAG,MAAM,MACT,GAAG,GACL;IACA;GAEF,KAAK;IACH,KAAKC,sBAAsB,IACzB,GAAG,MAAM,QACT,GAAG,MAAM,MACT,GAAG,MACL;IACA;GAEF,KAAK;IAIH,KAAK,MAAM,UAAU,GAAG,SACtB,KAAKA,sBAAsB,IACzB,GAAG,MAAM,QACT,GAAG,MAAM,MACT,MACF;IAEF;GAEF,SACE,YAAY,EAAE;EAClB;CACF;AACF;AAEA,IAAM,YAAY,QAAgB,UAChC,KAAK,UAAU,CAAC,QAAQ,KAAK,CAAC;AAEhC,IAAM,aAAa,QAAgB,OAAe,WAChD,KAAK,UAAU;CAAC;CAAQ;CAAO;AAAM,CAAC;AAExC,IAAM,OAAO,GAAW,MAAe,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI;;;;;;;;;;;;;;;;AAiBhE,SAAgB,YACd,SACA,SACW;CACX,MAAM,WAAW,IAAI,IACnB,QAAQ,cAAc,KAAI,MAAK,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CACjE;CACA,MAAM,cAAc,IAAI,IACtB,QAAQ,YAAY,KAAI,MAAK,CAAC,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAAC,CAC1E;CACA,MAAM,cAAc,EAAC,QAAQ,QAAmB,WAC9C,YAAY,OAAO,UAAU,QAAQ,MAAM,MAAM,CAAC;CAEpD,KAAK,MAAM,UAAU,SACnB,KAAK,MAAM,MAAM,UAAU,MAAM,GAC/B,QAAQ,GAAG,IAAX;EACE,KAAK;GACH,SAAS,IAAI,SAAS,GAAG,MAAM,QAAQ,GAAG,MAAM,IAAI,GAAG;IACrD,QAAQ,GAAG,MAAM;IACjB,OAAO,GAAG,MAAM;IAChB,UAAU,GAAG;GACf,CAAC;GACD;EAEF,KAAK;GACH,YAAY,IACV,UAAU,GAAG,MAAM,QAAQ,GAAG,MAAM,MAAM,GAAG,MAAM,GACnD;IACE,QAAQ,GAAG,MAAM;IACjB,OAAO,GAAG,MAAM;IAChB,QAAQ,GAAG;IACX,UAAU,GAAG;GACf,CACF;GACA;EAEF,KAAK,gBAAgB;GACnB,MAAM,EAAC,KAAK,KAAK,YAAW;GAC5B,MAAM,QAAQ,SAAS,IAAI,SAAS,IAAI,QAAQ,IAAI,IAAI,CAAC;GACzD,IAAI,OAAO;IACT,SAAS,OAAO,SAAS,IAAI,QAAQ,IAAI,IAAI,CAAC;IAC9C,SAAS,IAAI,SAAS,QAAQ,QAAQ,QAAQ,IAAI,GAAG;KACnD,GAAG;KACH,QAAQ,QAAQ;KAChB,OAAO,QAAQ;IACjB,CAAC;GACH;GAGA,KAAK,MAAM,CAAC,KAAK,WAAW,CAAC,GAAG,WAAW,GACzC,IAAI,OAAO,WAAW,IAAI,UAAU,OAAO,UAAU,IAAI,MAAM;IAC7D,YAAY,OAAO,GAAG;IACtB,YAAY,IACV,UAAU,QAAQ,QAAQ,QAAQ,MAAM,OAAO,MAAM,GACrD;KAAC,GAAG;KAAQ,QAAQ,QAAQ;KAAQ,OAAO,QAAQ;IAAI,CACzD;GACF;GAEF;EACF;EAEA,KAAK,cAAc;GACjB,MAAM,EAAC,QAAQ,SAAQ,GAAG;GAC1B,SAAS,OAAO,SAAS,QAAQ,IAAI,CAAC;GACtC,KAAK,MAAM,CAAC,KAAK,WAAW,CAAC,GAAG,WAAW,GACzC,IAAI,OAAO,WAAW,UAAU,OAAO,UAAU,MAC/C,YAAY,OAAO,GAAG;GAG1B;EACF;EAEA,KAAK,iBAAiB;GACpB,MAAM,EAAC,QAAQ,SAAQ,GAAG;GAC1B,MAAM,QAAQ,YAAY,IAAI,UAAU,QAAQ,MAAM,GAAG,GAAG,CAAC;GAC7D,IAAI,OAAO;IACT,YAAY,OAAO,UAAU,QAAQ,MAAM,GAAG,GAAG,CAAC;IAClD,YAAY,IAAI,UAAU,QAAQ,MAAM,GAAG,GAAG,GAAG;KAC/C,GAAG;KACH,QAAQ,GAAG;IACb,CAAC;GACH;GACA;EACF;EAEA,KAAK;GACH,WAAW,GAAG,OAAO,GAAG,MAAM;GAC9B;EAEF,KAAK;GACH,KAAK,MAAM,UAAU,GAAG,SACtB,WAAW,GAAG,OAAO,MAAM;GAE7B;EAEF,SACE,YAAY,EAAE;CAClB;CAIJ,OAAO;EACL,eAAe,CAAC,GAAG,SAAS,OAAO,CAAC,EAAE,UACnC,GAAG,MAAM,IAAI,EAAE,QAAQ,EAAE,MAAM,KAAK,IAAI,EAAE,OAAO,EAAE,KAAK,CAC3D;EACA,aAAa,CAAC,GAAG,YAAY,OAAO,CAAC,EAAE,UACpC,GAAG,MACF,IAAI,EAAE,QAAQ,EAAE,MAAM,KACtB,IAAI,EAAE,OAAO,EAAE,KAAK,KACpB,IAAI,EAAE,QAAQ,EAAE,MAAM,CAC1B;CACF;AACF;AAEA,IAAM,yBAAyB,eAAE,MAAM,qBAAqB;;;;;AAM5D,SAAgB,qBAAqB,SAAuC;CAC1E,MAAM,WAAW,IAAI,IACnB,QAAQ,cAAc,KAAI,MAAK,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,GAAG,EAAE,QAAQ,CAAC,CAC1E;CACA,MAAM,WAA8B,CAAC;CACrC,IAAI;CACJ,KAAK,MAAM,EAAC,QAAQ,OAAO,QAAQ,cAAa,QAAQ,aAAa;EACnE,IAAI,MAAM,MAAM,WAAW,UAAU,KAAK,MAAM,SAAS,OAAO;GAC9D,OAAO;IACL,OAAO;KACL;KACA,MAAM;KAGN,UAAU,SAAS,IAAI,SAAS,QAAQ,KAAK,CAAC,KAAK;IACrD;IACA,SAAS,CAAC;GACZ;GACA,SAAS,KAAK,IAAI;EACpB;EACA,KAAK,QAAQ,UAAU,EAAC,IAAI,SAAQ;CACtC;CACA,OAAO,MAAQ,UAAU,sBAAsB;AACjD;;;;;;AAOA,SAAgB,YAAY,IAAyB;CA4BnD,OAAO;EAAC,eA3Bc,GACnB,QAAgB;;gBAEL,gCAAgC;;KAE3C,EACA,IAAuD,EACvD,KAAK,EAAC,QAAQ,OAAO,gBAAe;GACnC;GACA;GACA,UAAU,WAAW,MAAM,QAAQ;EACrC,EAgBM;EAAe,aAdH,GACjB,QAAgB;;gBAEL,6BAA6B;;KAExC,EACA,IAAuE,EACvE,KAAK,EAAC,QAAQ,OAAO,QAAQ,gBAAe;GAC3C;GACA;GACA;GACA,UAAU,WAAW,MAAM,QAAQ;EACrC,EAEqB;CAAW;AACpC;;;;;;;;;;AAWA,SAAgB,eAAe,IAAc,SAA0B;CACrE,GAAG,QAAgB,gBAAgB,gCAAgC,EAAE,EAAE,IAAI;CAC3E,GAAG,QAAgB,gBAAgB,6BAA6B,EAAE,EAAE,IAAI;CAExE,IAAI,QAAQ,cAAc,SAAS,GAAG;EACpC,MAAM,SAAS,GAAG,QAAgB;qBACjB,gCAAgC;;KAEhD;EACD,KAAK,MAAM,EAAC,QAAQ,OAAO,cAAa,QAAQ,eAC9C,OAAO,IAAI,QAAQ,OAAO,WAAW,UAAU,QAAQ,CAAC;CAE5D;CACA,IAAI,QAAQ,YAAY,SAAS,GAAG;EAClC,MAAM,SAAS,GAAG,QAAgB;qBACjB,6BAA6B;;KAE7C;EACD,KAAK,MAAM,EAAC,QAAQ,OAAO,QAAQ,cAAa,QAAQ,aACtD,OAAO,IAAI,QAAQ,OAAO,QAAQ,WAAW,UAAU,QAAQ,CAAC;CAEpE;AACF;AAQA,SAAgB,oBAAoB,IAA+B;CACjE,OAAO,GACJ,QAAgB;;iCAEY,gCAAgC;;iCAEhC,6BAA6B;;KAEzD,EACA,IAAqB;AAC1B"}
+{"version":3,"file":"change-log-cookies.js","names":["v","v.parse"],"sources":["../../../../../../zero-cache/src/services/replicator/change-log-cookies.ts"],"sourcesContent":["/**\n * The change log's *second* job.\n *\n * A change log is a buffer **and** a cookie jar. The buffer catches a\n * reconnecting subscriber up to the head; the cookie jar holds the backfill\n * progress state that the change-streamer hands the change-source on every\n * `startStream`, so that the change source never has to persist backfill state\n * upstream. See `change-log-db.ts` for the buffer.\n *\n * There are two cookies, mirroring the two `cdc` tables the Postgres change log\n * has always carried (`change-streamer/schema/tables.ts`):\n *\n * - **table metadata**, the most current {@link TableMetadata} of a table, which\n *   a {@link BackfillRequest} has to carry; and\n * - **backfilling columns**, the opaque {@link BackfillID} of every column whose\n *   backfill has not completed.\n *\n * Both are a *fold over the change stream*: the cookie set is only meaningful\n * paired with the watermark it was folded up to. {@link cookieOps} is that fold,\n * expressed transport-free so that the Postgres change log and the SQLite change\n * log cannot drift from each other — they must agree on all eight transitions\n * forever, and the failure mode if they disagree is a backfill that is silently\n * never re-requested. The two interpreters are {@link ChangeLogCookieWriter}\n * here and `Storer.#trackBackfillMetadata()` in\n * `change-streamer/storer.ts`.\n *\n * The tables live in the change-log database rather than in the replica: the\n * replicator is a subscriber *downstream* of the change-streamer's write loop,\n * so its state version trails the log's head, and pairing its cookies with the\n * log's resume watermark would lose every backfill that completed in between.\n * The replica's own copies (`_zero.tableMetadata`, `_zero.column_metadata`) are\n * the *seed* source; these are the *working* set.\n */\n\nimport {unreachable} from '../../../../shared/src/asserts.ts';\nimport {BigIntJSON} from '../../../../shared/src/bigint-json.ts';\nimport * as v from '../../../../shared/src/valita.ts';\nimport type {Database, Statement} from '../../../../zqlite/src/db.ts';\nimport type {\n  BackfillID,\n  Identifier,\n  SchemaChange,\n  TableMetadata,\n} from '../change-source/protocol/current/data.ts';\nimport {\n  backfillRequestSchema,\n  type BackfillRequest,\n} from '../change-source/protocol/current/upstream.ts';\n\nexport const CHANGE_LOG_TABLE_METADATA_TABLE = '_zero.changeLogTableMetadata';\nexport const CHANGE_LOG_BACKFILLING_TABLE = '_zero.changeLogBackfilling';\n\n// The names follow the file's existing convention, beside\n// \"_zero.changeLogStream\" and \"_zero.changeLogMeta\".\n//\n// `metadata` and `backfill` hold the JSON that the `cdc` tables hold as JSONB.\n// SQLite has no JSONB, and nothing here queries into the documents: they are\n// stored to be handed back to the change source verbatim.\nexport const CREATE_CHANGE_LOG_COOKIE_SCHEMA = /*sql*/ `\n  CREATE TABLE \"${CHANGE_LOG_TABLE_METADATA_TABLE}\" (\n    \"schema\"   TEXT NOT NULL,\n    \"table\"    TEXT NOT NULL,\n    \"metadata\" TEXT NOT NULL,\n    PRIMARY KEY (\"schema\", \"table\")\n  );\n\n  CREATE TABLE \"${CHANGE_LOG_BACKFILLING_TABLE}\" (\n    \"schema\"   TEXT NOT NULL,\n    \"table\"    TEXT NOT NULL,\n    \"column\"   TEXT NOT NULL,\n    \"backfill\" TEXT NOT NULL,\n    PRIMARY KEY (\"schema\", \"table\", \"column\")\n  );\n`;\n\nexport const DROP_CHANGE_LOG_COOKIE_TABLES = /*sql*/ `\n  DROP TABLE IF EXISTS \"${CHANGE_LOG_TABLE_METADATA_TABLE}\";\n  DROP TABLE IF EXISTS \"${CHANGE_LOG_BACKFILLING_TABLE}\";\n`;\n\nexport type TableMetadataCookie = {\n  readonly schema: string;\n  readonly table: string;\n  readonly metadata: TableMetadata;\n};\n\nexport type BackfillCookie = {\n  readonly schema: string;\n  readonly table: string;\n  readonly column: string;\n  readonly backfill: BackfillID;\n};\n\n/**\n * The whole cookie set, as of the log's head. Both lists are ordered by their\n * primary key so that two stores' sets can be compared directly.\n */\nexport type CookieSet = {\n  readonly tableMetadata: readonly TableMetadataCookie[];\n  readonly backfilling: readonly BackfillCookie[];\n};\n\nexport const EMPTY_COOKIE_SET: CookieSet = {\n  tableMetadata: [],\n  backfilling: [],\n};\n\n/**\n * A transport-free description of a cookie mutation. This is the whole of what\n * a {@link SchemaChange} means to the cookie jar; everything else about the\n * change belongs to the buffer.\n */\nexport type CookieOp =\n  | {op: 'upsert-metadata'; table: Identifier; metadata: TableMetadata}\n  | {\n      op: 'upsert-backfill';\n      table: Identifier;\n      column: string;\n      backfill: BackfillID;\n    }\n  | {op: 'rename-table'; old: Identifier; new: Identifier}\n  | {op: 'drop-table'; table: Identifier}\n  | {op: 'rename-column'; table: Identifier; old: string; new: string}\n  | {op: 'drop-column'; table: Identifier; column: string}\n  | {op: 'complete-backfill'; table: Identifier; columns: readonly string[]};\n\nexport type CookieOpTag = CookieOp['op'];\n\n/**\n * The fold, and the only place either store decides what a schema change means\n * for the cookie set. Both interpreters are mechanical translations of what this\n * returns, in the order it returns them.\n *\n * Changes that carry no cookie state — index changes, and the `create-table` /\n * `add-column` variants whose optional `metadata` and `backfill` fields are\n * absent — produce no ops.\n */\nexport function cookieOps(change: SchemaChange): CookieOp[] {\n  switch (change.tag) {\n    case 'update-table-metadata':\n      return [\n        {op: 'upsert-metadata', table: change.table, metadata: change.new},\n      ];\n\n    case 'create-table': {\n      const {spec, metadata, backfill} = change;\n      const table = {schema: spec.schema, name: spec.name};\n      const ops: CookieOp[] = [];\n      if (metadata) {\n        ops.push({op: 'upsert-metadata', table, metadata});\n      }\n      if (backfill) {\n        for (const [column, id] of Object.entries(backfill)) {\n          ops.push({op: 'upsert-backfill', table, column, backfill: id});\n        }\n      }\n      return ops;\n    }\n\n    case 'rename-table':\n      return [{op: 'rename-table', old: change.old, new: change.new}];\n\n    case 'drop-table':\n      return [{op: 'drop-table', table: change.id}];\n\n    case 'add-column': {\n      const {table, tableMetadata, column, backfill} = change;\n      const ops: CookieOp[] = [];\n      if (tableMetadata) {\n        ops.push({op: 'upsert-metadata', table, metadata: tableMetadata});\n      }\n      if (backfill) {\n        ops.push({\n          op: 'upsert-backfill',\n          table,\n          column: column.name,\n          backfill,\n        });\n      }\n      return ops;\n    }\n\n    case 'update-column': {\n      // Only a rename moves the cookie; the rest of a column update does not\n      // affect whether or how it is being backfilled.\n      const {table, old, new: updated} = change;\n      return old.name === updated.name\n        ? []\n        : [{op: 'rename-column', table, old: old.name, new: updated.name}];\n    }\n\n    case 'drop-column':\n      return [{op: 'drop-column', table: change.table, column: change.column}];\n\n    case 'backfill-completed': {\n      const {relation, columns} = change;\n      // The rowKey columns are excluded from `columns` but are backfilled with\n      // them, so both are cleared.\n      const cleared = [...relation.rowKey.columns, ...columns];\n      return cleared.length === 0\n        ? []\n        : [\n            {\n              op: 'complete-backfill',\n              table: {schema: relation.schema, name: relation.name},\n              columns: cleared,\n            },\n          ];\n    }\n\n    case 'create-index':\n    case 'drop-index':\n      return [];\n\n    default:\n      // Unreachable: `isSchemaChange()` gates on the same tag set this switch\n      // covers. It is exhaustive so that a new schema-change tag is a compile\n      // error here rather than a silently dropped backfill.\n      unreachable(change);\n  }\n}\n\n/**\n * The SQLite interpreter of {@link cookieOps}, over prepared statements on the\n * change-log database.\n *\n * The statements run inside the log's transaction, in stream order, at the point\n * the schema change is appended (see `ChangeLogStreamWriter`). That is what\n * makes the cookie set atomic with the head — a crash cannot leave cookies ahead\n * of or behind the rows they were folded from — and what makes an aborted\n * transaction discard its cookies with its rows, for free.\n *\n * Statements are prepared against the tables as they exist now, so an instance\n * does not survive a reconcile that drops and recreates them.\n */\nexport class ChangeLogCookieWriter {\n  readonly #upsertMetadata: Statement;\n  readonly #upsertBackfill: Statement;\n  readonly #renameMetadataTable: Statement;\n  readonly #renameBackfillTable: Statement;\n  readonly #deleteMetadataTable: Statement;\n  readonly #deleteBackfillTable: Statement;\n  readonly #renameBackfillColumn: Statement;\n  readonly #deleteBackfillColumn: Statement;\n\n  constructor(db: Database) {\n    this.#upsertMetadata = db.prepare(/*sql*/ `\n      INSERT INTO \"${CHANGE_LOG_TABLE_METADATA_TABLE}\"\n        (\"schema\", \"table\", \"metadata\") VALUES (?, ?, ?)\n        ON CONFLICT (\"schema\", \"table\")\n        DO UPDATE SET \"metadata\" = excluded.\"metadata\"\n    `);\n    this.#upsertBackfill = db.prepare(/*sql*/ `\n      INSERT INTO \"${CHANGE_LOG_BACKFILLING_TABLE}\"\n        (\"schema\", \"table\", \"column\", \"backfill\") VALUES (?, ?, ?, ?)\n        ON CONFLICT (\"schema\", \"table\", \"column\")\n        DO UPDATE SET \"backfill\" = excluded.\"backfill\"\n    `);\n    this.#renameMetadataTable = db.prepare(/*sql*/ `\n      UPDATE \"${CHANGE_LOG_TABLE_METADATA_TABLE}\"\n        SET \"schema\" = ?, \"table\" = ? WHERE \"schema\" = ? AND \"table\" = ?\n    `);\n    this.#renameBackfillTable = db.prepare(/*sql*/ `\n      UPDATE \"${CHANGE_LOG_BACKFILLING_TABLE}\"\n        SET \"schema\" = ?, \"table\" = ? WHERE \"schema\" = ? AND \"table\" = ?\n    `);\n    this.#deleteMetadataTable = db.prepare(/*sql*/ `\n      DELETE FROM \"${CHANGE_LOG_TABLE_METADATA_TABLE}\"\n        WHERE \"schema\" = ? AND \"table\" = ?\n    `);\n    this.#deleteBackfillTable = db.prepare(/*sql*/ `\n      DELETE FROM \"${CHANGE_LOG_BACKFILLING_TABLE}\"\n        WHERE \"schema\" = ? AND \"table\" = ?\n    `);\n    this.#renameBackfillColumn = db.prepare(/*sql*/ `\n      UPDATE \"${CHANGE_LOG_BACKFILLING_TABLE}\" SET \"column\" = ?\n        WHERE \"schema\" = ? AND \"table\" = ? AND \"column\" = ?\n    `);\n    this.#deleteBackfillColumn = db.prepare(/*sql*/ `\n      DELETE FROM \"${CHANGE_LOG_BACKFILLING_TABLE}\"\n        WHERE \"schema\" = ? AND \"table\" = ? AND \"column\" = ?\n    `);\n  }\n\n  /** Applies the change's cookie ops, returning the ops that were applied. */\n  apply(change: SchemaChange): CookieOp[] {\n    const ops = cookieOps(change);\n    for (const op of ops) {\n      this.#run(op);\n    }\n    return ops;\n  }\n\n  #run(op: CookieOp): void {\n    switch (op.op) {\n      case 'upsert-metadata':\n        this.#upsertMetadata.run(\n          op.table.schema,\n          op.table.name,\n          BigIntJSON.stringify(op.metadata),\n        );\n        break;\n\n      case 'upsert-backfill':\n        this.#upsertBackfill.run(\n          op.table.schema,\n          op.table.name,\n          op.column,\n          BigIntJSON.stringify(op.backfill),\n        );\n        break;\n\n      case 'rename-table':\n        this.#renameMetadataTable.run(\n          op.new.schema,\n          op.new.name,\n          op.old.schema,\n          op.old.name,\n        );\n        this.#renameBackfillTable.run(\n          op.new.schema,\n          op.new.name,\n          op.old.schema,\n          op.old.name,\n        );\n        break;\n\n      case 'drop-table':\n        this.#deleteMetadataTable.run(op.table.schema, op.table.name);\n        this.#deleteBackfillTable.run(op.table.schema, op.table.name);\n        break;\n\n      case 'rename-column':\n        this.#renameBackfillColumn.run(\n          op.new,\n          op.table.schema,\n          op.table.name,\n          op.old,\n        );\n        break;\n\n      case 'drop-column':\n        this.#deleteBackfillColumn.run(\n          op.table.schema,\n          op.table.name,\n          op.column,\n        );\n        break;\n\n      case 'complete-backfill':\n        // A per-column delete rather than an `IN` list, which cannot be a\n        // single prepared statement across arities. The columns of one\n        // completed backfill are few, and this runs only on schema changes.\n        for (const column of op.columns) {\n          this.#deleteBackfillColumn.run(\n            op.table.schema,\n            op.table.name,\n            column,\n          );\n        }\n        break;\n\n      default:\n        unreachable(op);\n    }\n  }\n}\n\nconst tableKey = (schema: string, table: string) =>\n  JSON.stringify([schema, table]);\n\nconst columnKey = (schema: string, table: string, column: string) =>\n  JSON.stringify([schema, table, column]);\n\nconst cmp = (a: string, b: string) => (a < b ? -1 : a > b ? 1 : 0);\n\n/**\n * The in-memory interpreter of {@link cookieOps}: the third one, and the only\n * one that is not a store.\n *\n * A replica-derived cookie set is a snapshot at the replica's state version,\n * which trails the change log's head, so it cannot be compared with a\n * Postgres-derived set directly. This carries it forward over the schema changes\n * the log holds in between, which turns \"the two stores disagree, but they are\n * also at different positions\" into an exact equality — and makes a\n * disagreement between any two of the three interpreters visible as an\n * inequality that neither store would have noticed on its own.\n *\n * `changes` must be the log's schema changes over `(from, to]` in stream order.\n * Anything else produces a set that belongs to no watermark.\n */\nexport function foldCookies(\n  cookies: CookieSet,\n  changes: Iterable<SchemaChange>,\n): CookieSet {\n  const metadata = new Map<string, TableMetadataCookie>(\n    cookies.tableMetadata.map(c => [tableKey(c.schema, c.table), c]),\n  );\n  const backfilling = new Map<string, BackfillCookie>(\n    cookies.backfilling.map(c => [columnKey(c.schema, c.table, c.column), c]),\n  );\n  const dropColumn = ({schema, name}: Identifier, column: string) =>\n    backfilling.delete(columnKey(schema, name, column));\n\n  for (const change of changes) {\n    for (const op of cookieOps(change)) {\n      switch (op.op) {\n        case 'upsert-metadata':\n          metadata.set(tableKey(op.table.schema, op.table.name), {\n            schema: op.table.schema,\n            table: op.table.name,\n            metadata: op.metadata,\n          });\n          break;\n\n        case 'upsert-backfill':\n          backfilling.set(\n            columnKey(op.table.schema, op.table.name, op.column),\n            {\n              schema: op.table.schema,\n              table: op.table.name,\n              column: op.column,\n              backfill: op.backfill,\n            },\n          );\n          break;\n\n        case 'rename-table': {\n          const {old, new: renamed} = op;\n          const moved = metadata.get(tableKey(old.schema, old.name));\n          if (moved) {\n            metadata.delete(tableKey(old.schema, old.name));\n            metadata.set(tableKey(renamed.schema, renamed.name), {\n              ...moved,\n              schema: renamed.schema,\n              table: renamed.name,\n            });\n          }\n          // Snapshotted before mutating, since the rename both deletes and\n          // inserts into the map being scanned.\n          for (const [key, cookie] of [...backfilling]) {\n            if (cookie.schema === old.schema && cookie.table === old.name) {\n              backfilling.delete(key);\n              backfilling.set(\n                columnKey(renamed.schema, renamed.name, cookie.column),\n                {...cookie, schema: renamed.schema, table: renamed.name},\n              );\n            }\n          }\n          break;\n        }\n\n        case 'drop-table': {\n          const {schema, name} = op.table;\n          metadata.delete(tableKey(schema, name));\n          for (const [key, cookie] of [...backfilling]) {\n            if (cookie.schema === schema && cookie.table === name) {\n              backfilling.delete(key);\n            }\n          }\n          break;\n        }\n\n        case 'rename-column': {\n          const {schema, name} = op.table;\n          const moved = backfilling.get(columnKey(schema, name, op.old));\n          if (moved) {\n            backfilling.delete(columnKey(schema, name, op.old));\n            backfilling.set(columnKey(schema, name, op.new), {\n              ...moved,\n              column: op.new,\n            });\n          }\n          break;\n        }\n\n        case 'drop-column':\n          dropColumn(op.table, op.column);\n          break;\n\n        case 'complete-backfill':\n          for (const column of op.columns) {\n            dropColumn(op.table, column);\n          }\n          break;\n\n        default:\n          unreachable(op);\n      }\n    }\n  }\n\n  return {\n    tableMetadata: [...metadata.values()].toSorted(\n      (a, b) => cmp(a.schema, b.schema) || cmp(a.table, b.table),\n    ),\n    backfilling: [...backfilling.values()].toSorted(\n      (a, b) =>\n        cmp(a.schema, b.schema) ||\n        cmp(a.table, b.table) ||\n        cmp(a.column, b.column),\n    ),\n  };\n}\n\nconst backfillRequestsSchema = v.array(backfillRequestSchema);\n\n/**\n * Returns one {@link BackfillRequest} for each table with an active backfill.\n * Each request contains the stored table metadata, if available.\n */\nexport function backfillRequestsFrom(cookies: CookieSet): BackfillRequest[] {\n  const metadata = new Map(\n    cookies.tableMetadata.map(c => [tableKey(c.schema, c.table), c.metadata]),\n  );\n  const requests: BackfillRequest[] = [];\n  let curr: BackfillRequest | undefined;\n  for (const {schema, table, column, backfill} of cookies.backfilling) {\n    if (curr?.table.schema !== schema || curr.table.name !== table) {\n      curr = {\n        table: {\n          schema,\n          name: table,\n          // Use `null` when a backfilling table has no metadata. This matches\n          // the result of the Postgres left join.\n          metadata: metadata.get(tableKey(schema, table)) ?? null,\n        },\n        columns: {},\n      };\n      requests.push(curr);\n    }\n    curr.columns[column] = {id: backfill};\n  }\n  return v.parse(requests, backfillRequestsSchema);\n}\n\n/**\n * Reads the whole cookie set, ordered by primary key. This is what a\n * change-streamer would hand `startStream`, and what the Postgres-derived and\n * replica-derived sets are compared against.\n */\nexport function readCookies(db: Database): CookieSet {\n  const tableMetadata = db\n    .prepare(/*sql*/ `\n      SELECT \"schema\", \"table\", \"metadata\"\n        FROM \"${CHANGE_LOG_TABLE_METADATA_TABLE}\"\n        ORDER BY \"schema\", \"table\"\n    `)\n    .all<{schema: string; table: string; metadata: string}>()\n    .map(({schema, table, metadata}) => ({\n      schema,\n      table,\n      metadata: BigIntJSON.parse(metadata) as TableMetadata,\n    }));\n\n  const backfilling = db\n    .prepare(/*sql*/ `\n      SELECT \"schema\", \"table\", \"column\", \"backfill\"\n        FROM \"${CHANGE_LOG_BACKFILLING_TABLE}\"\n        ORDER BY \"schema\", \"table\", \"column\"\n    `)\n    .all<{schema: string; table: string; column: string; backfill: string}>()\n    .map(({schema, table, column, backfill}) => ({\n      schema,\n      table,\n      column,\n      backfill: BigIntJSON.parse(backfill) as BackfillID,\n    }));\n\n  return {tableMetadata, backfilling};\n}\n\n/**\n * Replaces the cookie set wholesale.\n *\n * The cookies are unversioned point-in-time state, so a reconciliation that\n * moves the head invalidates them: truncating the stream above `W` does not roll\n * the cookie set back to `W`, and the truncated transactions can contain\n * `create-table`, `add-column`, and `backfill-completed`. The caller must run\n * this in the same transaction as the reconciliation that invalidated them.\n */\nexport function replaceCookies(db: Database, cookies: CookieSet): void {\n  db.prepare(/*sql*/ `DELETE FROM \"${CHANGE_LOG_TABLE_METADATA_TABLE}\"`).run();\n  db.prepare(/*sql*/ `DELETE FROM \"${CHANGE_LOG_BACKFILLING_TABLE}\"`).run();\n\n  if (cookies.tableMetadata.length > 0) {\n    const insert = db.prepare(/*sql*/ `\n      INSERT INTO \"${CHANGE_LOG_TABLE_METADATA_TABLE}\"\n        (\"schema\", \"table\", \"metadata\") VALUES (?, ?, ?)\n    `);\n    for (const {schema, table, metadata} of cookies.tableMetadata) {\n      insert.run(schema, table, BigIntJSON.stringify(metadata));\n    }\n  }\n  if (cookies.backfilling.length > 0) {\n    const insert = db.prepare(/*sql*/ `\n      INSERT INTO \"${CHANGE_LOG_BACKFILLING_TABLE}\"\n        (\"schema\", \"table\", \"column\", \"backfill\") VALUES (?, ?, ?, ?)\n    `);\n    for (const {schema, table, column, backfill} of cookies.backfilling) {\n      insert.run(schema, table, column, BigIntJSON.stringify(backfill));\n    }\n  }\n}\n\n/** Retained cookie rows, by table. Both are normally zero. */\nexport type CookieRowCounts = {\n  readonly tableMetadata: number;\n  readonly backfilling: number;\n};\n\nexport function readCookieRowCounts(db: Database): CookieRowCounts {\n  return db\n    .prepare(/*sql*/ `\n      SELECT\n        (SELECT count(*) FROM \"${CHANGE_LOG_TABLE_METADATA_TABLE}\")\n          AS \"tableMetadata\",\n        (SELECT count(*) FROM \"${CHANGE_LOG_BACKFILLING_TABLE}\")\n          AS \"backfilling\"\n    `)\n    .get<CookieRowCounts>();\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiDA,IAAa,kCAAkC;AAC/C,IAAa,+BAA+B;AAQ5C,IAAa,kCAA0C;kBACrC,gCAAgC;;;;;;;kBAOhC,6BAA6B;;;;;;;;AAS/C,IAAa,gCAAwC;0BAC3B,gCAAgC;0BAChC,6BAA6B;;;;;;;;;;;AA4DvD,SAAgB,UAAU,QAAkC;CAC1D,QAAQ,OAAO,KAAf;EACE,KAAK,yBACH,OAAO,CACL;GAAC,IAAI;GAAmB,OAAO,OAAO;GAAO,UAAU,OAAO;EAAG,CACnE;EAEF,KAAK,gBAAgB;GACnB,MAAM,EAAC,MAAM,UAAU,aAAY;GACnC,MAAM,QAAQ;IAAC,QAAQ,KAAK;IAAQ,MAAM,KAAK;GAAI;GACnD,MAAM,MAAkB,CAAC;GACzB,IAAI,UACF,IAAI,KAAK;IAAC,IAAI;IAAmB;IAAO;GAAQ,CAAC;GAEnD,IAAI,UACF,KAAK,MAAM,CAAC,QAAQ,OAAO,OAAO,QAAQ,QAAQ,GAChD,IAAI,KAAK;IAAC,IAAI;IAAmB;IAAO;IAAQ,UAAU;GAAE,CAAC;GAGjE,OAAO;EACT;EAEA,KAAK,gBACH,OAAO,CAAC;GAAC,IAAI;GAAgB,KAAK,OAAO;GAAK,KAAK,OAAO;EAAG,CAAC;EAEhE,KAAK,cACH,OAAO,CAAC;GAAC,IAAI;GAAc,OAAO,OAAO;EAAE,CAAC;EAE9C,KAAK,cAAc;GACjB,MAAM,EAAC,OAAO,eAAe,QAAQ,aAAY;GACjD,MAAM,MAAkB,CAAC;GACzB,IAAI,eACF,IAAI,KAAK;IAAC,IAAI;IAAmB;IAAO,UAAU;GAAa,CAAC;GAElE,IAAI,UACF,IAAI,KAAK;IACP,IAAI;IACJ;IACA,QAAQ,OAAO;IACf;GACF,CAAC;GAEH,OAAO;EACT;EAEA,KAAK,iBAAiB;GAGpB,MAAM,EAAC,OAAO,KAAK,KAAK,YAAW;GACnC,OAAO,IAAI,SAAS,QAAQ,OACxB,CAAC,IACD,CAAC;IAAC,IAAI;IAAiB;IAAO,KAAK,IAAI;IAAM,KAAK,QAAQ;GAAI,CAAC;EACrE;EAEA,KAAK,eACH,OAAO,CAAC;GAAC,IAAI;GAAe,OAAO,OAAO;GAAO,QAAQ,OAAO;EAAM,CAAC;EAEzE,KAAK,sBAAsB;GACzB,MAAM,EAAC,UAAU,YAAW;GAG5B,MAAM,UAAU,CAAC,GAAG,SAAS,OAAO,SAAS,GAAG,OAAO;GACvD,OAAO,QAAQ,WAAW,IACtB,CAAC,IACD,CACE;IACE,IAAI;IACJ,OAAO;KAAC,QAAQ,SAAS;KAAQ,MAAM,SAAS;IAAI;IACpD,SAAS;GACX,CACF;EACN;EAEA,KAAK;EACL,KAAK,cACH,OAAO,CAAC;EAEV,SAIE,YAAY,MAAM;CACtB;AACF;;;;;;;;;;;;;;AAeA,IAAa,wBAAb,MAAmC;CACjC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAEA,YAAY,IAAc;EACxB,KAAK,kBAAkB,GAAG,QAAgB;qBACzB,gCAAgC;;;;KAIhD;EACD,KAAK,kBAAkB,GAAG,QAAgB;qBACzB,6BAA6B;;;;KAI7C;EACD,KAAK,uBAAuB,GAAG,QAAgB;gBACnC,gCAAgC;;KAE3C;EACD,KAAK,uBAAuB,GAAG,QAAgB;gBACnC,6BAA6B;;KAExC;EACD,KAAK,uBAAuB,GAAG,QAAgB;qBAC9B,gCAAgC;;KAEhD;EACD,KAAK,uBAAuB,GAAG,QAAgB;qBAC9B,6BAA6B;;KAE7C;EACD,KAAK,wBAAwB,GAAG,QAAgB;gBACpC,6BAA6B;;KAExC;EACD,KAAK,wBAAwB,GAAG,QAAgB;qBAC/B,6BAA6B;;KAE7C;CACH;;CAGA,MAAM,QAAkC;EACtC,MAAM,MAAM,UAAU,MAAM;EAC5B,KAAK,MAAM,MAAM,KACf,KAAK,KAAK,EAAE;EAEd,OAAO;CACT;CAEA,KAAK,IAAoB;EACvB,QAAQ,GAAG,IAAX;GACE,KAAK;IACH,KAAK,gBAAgB,IACnB,GAAG,MAAM,QACT,GAAG,MAAM,MACT,WAAW,UAAU,GAAG,QAAQ,CAClC;IACA;GAEF,KAAK;IACH,KAAK,gBAAgB,IACnB,GAAG,MAAM,QACT,GAAG,MAAM,MACT,GAAG,QACH,WAAW,UAAU,GAAG,QAAQ,CAClC;IACA;GAEF,KAAK;IACH,KAAK,qBAAqB,IACxB,GAAG,IAAI,QACP,GAAG,IAAI,MACP,GAAG,IAAI,QACP,GAAG,IAAI,IACT;IACA,KAAK,qBAAqB,IACxB,GAAG,IAAI,QACP,GAAG,IAAI,MACP,GAAG,IAAI,QACP,GAAG,IAAI,IACT;IACA;GAEF,KAAK;IACH,KAAK,qBAAqB,IAAI,GAAG,MAAM,QAAQ,GAAG,MAAM,IAAI;IAC5D,KAAK,qBAAqB,IAAI,GAAG,MAAM,QAAQ,GAAG,MAAM,IAAI;IAC5D;GAEF,KAAK;IACH,KAAK,sBAAsB,IACzB,GAAG,KACH,GAAG,MAAM,QACT,GAAG,MAAM,MACT,GAAG,GACL;IACA;GAEF,KAAK;IACH,KAAK,sBAAsB,IACzB,GAAG,MAAM,QACT,GAAG,MAAM,MACT,GAAG,MACL;IACA;GAEF,KAAK;IAIH,KAAK,MAAM,UAAU,GAAG,SACtB,KAAK,sBAAsB,IACzB,GAAG,MAAM,QACT,GAAG,MAAM,MACT,MACF;IAEF;GAEF,SACE,YAAY,EAAE;EAClB;CACF;AACF;AAEA,IAAM,YAAY,QAAgB,UAChC,KAAK,UAAU,CAAC,QAAQ,KAAK,CAAC;AAEhC,IAAM,aAAa,QAAgB,OAAe,WAChD,KAAK,UAAU;CAAC;CAAQ;CAAO;AAAM,CAAC;AAExC,IAAM,OAAO,GAAW,MAAe,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI;;;;;;;;;;;;;;;;AAiBhE,SAAgB,YACd,SACA,SACW;CACX,MAAM,WAAW,IAAI,IACnB,QAAQ,cAAc,KAAI,MAAK,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CACjE;CACA,MAAM,cAAc,IAAI,IACtB,QAAQ,YAAY,KAAI,MAAK,CAAC,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAAC,CAC1E;CACA,MAAM,cAAc,EAAC,QAAQ,QAAmB,WAC9C,YAAY,OAAO,UAAU,QAAQ,MAAM,MAAM,CAAC;CAEpD,KAAK,MAAM,UAAU,SACnB,KAAK,MAAM,MAAM,UAAU,MAAM,GAC/B,QAAQ,GAAG,IAAX;EACE,KAAK;GACH,SAAS,IAAI,SAAS,GAAG,MAAM,QAAQ,GAAG,MAAM,IAAI,GAAG;IACrD,QAAQ,GAAG,MAAM;IACjB,OAAO,GAAG,MAAM;IAChB,UAAU,GAAG;GACf,CAAC;GACD;EAEF,KAAK;GACH,YAAY,IACV,UAAU,GAAG,MAAM,QAAQ,GAAG,MAAM,MAAM,GAAG,MAAM,GACnD;IACE,QAAQ,GAAG,MAAM;IACjB,OAAO,GAAG,MAAM;IAChB,QAAQ,GAAG;IACX,UAAU,GAAG;GACf,CACF;GACA;EAEF,KAAK,gBAAgB;GACnB,MAAM,EAAC,KAAK,KAAK,YAAW;GAC5B,MAAM,QAAQ,SAAS,IAAI,SAAS,IAAI,QAAQ,IAAI,IAAI,CAAC;GACzD,IAAI,OAAO;IACT,SAAS,OAAO,SAAS,IAAI,QAAQ,IAAI,IAAI,CAAC;IAC9C,SAAS,IAAI,SAAS,QAAQ,QAAQ,QAAQ,IAAI,GAAG;KACnD,GAAG;KACH,QAAQ,QAAQ;KAChB,OAAO,QAAQ;IACjB,CAAC;GACH;GAGA,KAAK,MAAM,CAAC,KAAK,WAAW,CAAC,GAAG,WAAW,GACzC,IAAI,OAAO,WAAW,IAAI,UAAU,OAAO,UAAU,IAAI,MAAM;IAC7D,YAAY,OAAO,GAAG;IACtB,YAAY,IACV,UAAU,QAAQ,QAAQ,QAAQ,MAAM,OAAO,MAAM,GACrD;KAAC,GAAG;KAAQ,QAAQ,QAAQ;KAAQ,OAAO,QAAQ;IAAI,CACzD;GACF;GAEF;EACF;EAEA,KAAK,cAAc;GACjB,MAAM,EAAC,QAAQ,SAAQ,GAAG;GAC1B,SAAS,OAAO,SAAS,QAAQ,IAAI,CAAC;GACtC,KAAK,MAAM,CAAC,KAAK,WAAW,CAAC,GAAG,WAAW,GACzC,IAAI,OAAO,WAAW,UAAU,OAAO,UAAU,MAC/C,YAAY,OAAO,GAAG;GAG1B;EACF;EAEA,KAAK,iBAAiB;GACpB,MAAM,EAAC,QAAQ,SAAQ,GAAG;GAC1B,MAAM,QAAQ,YAAY,IAAI,UAAU,QAAQ,MAAM,GAAG,GAAG,CAAC;GAC7D,IAAI,OAAO;IACT,YAAY,OAAO,UAAU,QAAQ,MAAM,GAAG,GAAG,CAAC;IAClD,YAAY,IAAI,UAAU,QAAQ,MAAM,GAAG,GAAG,GAAG;KAC/C,GAAG;KACH,QAAQ,GAAG;IACb,CAAC;GACH;GACA;EACF;EAEA,KAAK;GACH,WAAW,GAAG,OAAO,GAAG,MAAM;GAC9B;EAEF,KAAK;GACH,KAAK,MAAM,UAAU,GAAG,SACtB,WAAW,GAAG,OAAO,MAAM;GAE7B;EAEF,SACE,YAAY,EAAE;CAClB;CAIJ,OAAO;EACL,eAAe,CAAC,GAAG,SAAS,OAAO,CAAC,CAAC,CAAC,UACnC,GAAG,MAAM,IAAI,EAAE,QAAQ,EAAE,MAAM,KAAK,IAAI,EAAE,OAAO,EAAE,KAAK,CAC3D;EACA,aAAa,CAAC,GAAG,YAAY,OAAO,CAAC,CAAC,CAAC,UACpC,GAAG,MACF,IAAI,EAAE,QAAQ,EAAE,MAAM,KACtB,IAAI,EAAE,OAAO,EAAE,KAAK,KACpB,IAAI,EAAE,QAAQ,EAAE,MAAM,CAC1B;CACF;AACF;AAEA,IAAM,yBAAyBA,eAAE,MAAM,qBAAqB;;;;;AAM5D,SAAgB,qBAAqB,SAAuC;CAC1E,MAAM,WAAW,IAAI,IACnB,QAAQ,cAAc,KAAI,MAAK,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,GAAG,EAAE,QAAQ,CAAC,CAC1E;CACA,MAAM,WAA8B,CAAC;CACrC,IAAI;CACJ,KAAK,MAAM,EAAC,QAAQ,OAAO,QAAQ,cAAa,QAAQ,aAAa;EACnE,IAAI,MAAM,MAAM,WAAW,UAAU,KAAK,MAAM,SAAS,OAAO;GAC9D,OAAO;IACL,OAAO;KACL;KACA,MAAM;KAGN,UAAU,SAAS,IAAI,SAAS,QAAQ,KAAK,CAAC,KAAK;IACrD;IACA,SAAS,CAAC;GACZ;GACA,SAAS,KAAK,IAAI;EACpB;EACA,KAAK,QAAQ,UAAU,EAAC,IAAI,SAAQ;CACtC;CACA,OAAOC,MAAQ,UAAU,sBAAsB;AACjD;;;;;;AAOA,SAAgB,YAAY,IAAyB;CA4BnD,OAAO;EAAC,eA3Bc,GACnB,QAAgB;;gBAEL,gCAAgC;;KAE3C,CAAC,CACD,IAAuD,CAAC,CACxD,KAAK,EAAC,QAAQ,OAAO,gBAAe;GACnC;GACA;GACA,UAAU,WAAW,MAAM,QAAQ;EACrC,EAgBM;EAAe,aAdH,GACjB,QAAgB;;gBAEL,6BAA6B;;KAExC,CAAC,CACD,IAAuE,CAAC,CACxE,KAAK,EAAC,QAAQ,OAAO,QAAQ,gBAAe;GAC3C;GACA;GACA;GACA,UAAU,WAAW,MAAM,QAAQ;EACrC,EAEqB;CAAW;AACpC;;;;;;;;;;AAWA,SAAgB,eAAe,IAAc,SAA0B;CACrE,GAAG,QAAgB,gBAAgB,gCAAgC,EAAE,CAAC,CAAC,IAAI;CAC3E,GAAG,QAAgB,gBAAgB,6BAA6B,EAAE,CAAC,CAAC,IAAI;CAExE,IAAI,QAAQ,cAAc,SAAS,GAAG;EACpC,MAAM,SAAS,GAAG,QAAgB;qBACjB,gCAAgC;;KAEhD;EACD,KAAK,MAAM,EAAC,QAAQ,OAAO,cAAa,QAAQ,eAC9C,OAAO,IAAI,QAAQ,OAAO,WAAW,UAAU,QAAQ,CAAC;CAE5D;CACA,IAAI,QAAQ,YAAY,SAAS,GAAG;EAClC,MAAM,SAAS,GAAG,QAAgB;qBACjB,6BAA6B;;KAE7C;EACD,KAAK,MAAM,EAAC,QAAQ,OAAO,QAAQ,cAAa,QAAQ,aACtD,OAAO,IAAI,QAAQ,OAAO,QAAQ,WAAW,UAAU,QAAQ,CAAC;CAEpE;AACF;AAQA,SAAgB,oBAAoB,IAA+B;CACjE,OAAO,GACJ,QAAgB;;iCAEY,gCAAgC;;iCAEhC,6BAA6B;;KAEzD,CAAC,CACD,IAAqB;AAC1B"}

package/out/zero-cache/src/services/replicator/change-log-db.js

@@ -1,6 +1,6 @@
 import { Database } from "../../../../zqlite/src/db.js";
-import { CREATE_CHANGE_LOG_COOKIE_SCHEMA, DROP_CHANGE_LOG_COOKIE_TABLES, replaceCookies } from "./change-log-cookies.js";
 import { isSQLiteCorruption, logSQLiteCorruptionDiagnostics } from "../../db/sqlite-corruption.js";
+import { CREATE_CHANGE_LOG_COOKIE_SCHEMA, DROP_CHANGE_LOG_COOKIE_TABLES, replaceCookies } from "./change-log-cookies.js";
 import { deleteLiteDB } from "../../db/delete-lite-db.js";
 import { existsSync } from "node:fs";
 /** https://www.sqlite.org/pragma.html#pragma_auto_vacuum */
@@ -238,6 +238,7 @@ function openAndReconcile(lc, replicaFile, anchor, boundReconciliation, reseedRe
 * arbitrarily large suffix in place.
 */
 var MAX_RECONCILE_TRUNCATE_ROWS = 1e4;
+var MAX_RECONCILE_TRUNCATE_BYTES = 16777216;
 var ChangeLogRebuildRequired = class extends Error {
 	name = "ChangeLogRebuildRequired";
 	reason;
@@ -321,7 +322,7 @@ function rebuildRequired(db, anchor) {
         FROM (
           SELECT "estimatedBytes" FROM "${CHANGE_LOG_STREAM_TABLE}"
             WHERE "watermark" > ?
-            LIMIT ${MAX_RECONCILE_TRUNCATE_ROWS + 1}
+            LIMIT 10001
         )
     `).get(resumeWatermark);
 	return rows > 1e4 || estimatedBytes > 16777216 ? new ChangeLogRebuildRequired("oversized-truncate", rows, estimatedBytes) : void 0;
@@ -486,6 +487,6 @@ function tableExists(db, table) {
       `).get(table) !== void 0;
 }
 //#endregion
-export { CHANGE_LOG_STREAM_TABLE, ChangeLogRebuildRequired, changeLogFileName, changeLogWipeReason, deleteChangeLogDB, estimateChangeLogStreamRowBytes, openChangeLogDBForWriting, readChangeLogBounds, readChangeLogHead, readChangeLogMeta, rebuildChangeLogDBForWriting, reconcileChangeLog };
+export { CHANGE_LOG_META_TABLE, CHANGE_LOG_STREAM_TABLE, CHANGE_LOG_STREAM_WRITE_TIME_INDEX, CREATE_CHANGE_LOG_STREAM_SCHEMA, ChangeLogRebuildRequired, MAX_RECONCILE_TRUNCATE_BYTES, MAX_RECONCILE_TRUNCATE_ROWS, applyChangeLogPragmas, changeLogFileName, changeLogWipeReason, deleteChangeLogDB, estimateChangeLogStreamRowBytes, openChangeLogDB, openChangeLogDBForWriting, readChangeLogBounds, readChangeLogHead, readChangeLogMeta, rebuildChangeLogDBForWriting, reconcileChangeLog };
 
 //# sourceMappingURL=change-log-db.js.map

package/out/zero-cache/src/services/replicator/change-log-db.js.map

@@ -1 +1 @@
-{"version":3,"file":"change-log-db.js","names":[],"sources":["../../../../../../zero-cache/src/services/replicator/change-log-db.ts"],"sourcesContent":["/**\n * The change log lives in its own SQLite database, `${replicaFile}-change-log`,\n * rather than in the replica file. It is a catchup cache: everything it holds is\n * either already durable in the replica's litestream backup or re-derivable from\n * the upstream replication slot, so it is deliberately excluded from the backup\n * and is never a source of truth.\n *\n * The change-streamer writes it, from the stream loop that fans changes out to\n * subscribers, and commits it before forwarding each transaction's `commit`\n * message. Its head is therefore always at or above the watermark the stream\n * would resume from, which is what {@link reconcileChangeLog} anchors on.\n *\n * Beside the buffer it holds the log's *cookie jar* — the backfill progress\n * state folded up to the same head. That is `change-log-cookies.ts`; this file\n * owns its tables' lifecycle, because a cookie set is only meaningful paired\n * with the watermark it was folded to, and so must be created, dropped, and —\n * whenever reconciliation moves the head — replaced with the anchor's, all with\n * the buffer rather than beside it.\n *\n * Because it is disposable, it has no migration framework. Any inconsistency —\n * a schema change, a leftover file from a different replica, a gap left by a\n * crash or by running with the writer disabled, a corrupt file — is resolved by\n * {@link reconcileChangeLog} and {@link openChangeLogDBForWriting}, which\n * truncate a bounded suffix or replace and reseed the log at the resume\n * watermark. The worst outcome is a `too-old` for a lagging subscriber; a\n * silently delivered gap is not reachable.\n *\n * Disk sizing: a task that writes the log needs room for the replica *plus* the\n * retained change stream — the log's main file, its wal2 sidecars, and pages a\n * purge has freed but not yet returned to the OS. The change-streamer schedules\n * purges against the same floor as the PG change log, so retention is bounded\n * by the confirmed backup watermark ANDed with the minimum retention window —\n * a function of the backup interval, not a constant: 15–30+ minutes behind an\n * RMv1 sync interval, ~60 seconds once litestream v5 backs up every 15–30 s.\n * A held snapshot reservation pins retention unboundedly for its duration, so\n * peak retained bytes is set by the slowest concurrent restore rather than by\n * the retention setting — size disk and alerts on that. The log is excluded\n * from the litestream backup, so this is local disk only and never S3.\n */\n\nimport {existsSync} from 'node:fs';\nimport type {LogContext} from '@rocicorp/logger';\nimport {Database} from '../../../../zqlite/src/db.ts';\nimport {deleteLiteDB} from '../../db/delete-lite-db.ts';\nimport {\n  isSQLiteCorruption,\n  logSQLiteCorruptionDiagnostics,\n} from '../../db/sqlite-corruption.ts';\nimport {\n  CHANGE_LOG_BACKFILLING_TABLE,\n  CHANGE_LOG_TABLE_METADATA_TABLE,\n  CREATE_CHANGE_LOG_COOKIE_SCHEMA,\n  DROP_CHANGE_LOG_COOKIE_TABLES,\n  replaceCookies,\n  type CookieSet,\n} from './change-log-cookies.ts';\n\n/**\n * Bumped whenever the change-log database's schema changes. Since the file is a\n * cache, a mismatch costs one reseed rather than a migration.\n *\n * v2 re-homed the writer to the change-streamer: the log anchors on the\n * watermark its stream connection resumes from rather than on the replica's\n * state version, and its meta row carries the replica's identity triple plus\n * the seed point.\n *\n * v3 added the cookie tables (see `change-log-cookies.ts`), i.e. the log's\n * second job. The reseed it costs on upgrade buys one retention window of\n * catchup reach on a log nothing reads yet.\n *\n * v4 stores each row's tag and estimated retained bytes alongside its JSON.\n * Readers can now filter without parsing arbitrary row payloads, and\n * reconciliation can bound truncation by bytes as well as rows.\n *\n * `auto_vacuum = INCREMENTAL` arrived within v2, deliberately without a bump:\n * it is a file-header property rather than a schema change, and the reseed a\n * version mismatch triggers cannot enable it (see\n * {@link applyChangeLogPragmas}), so {@link openChangeLogDBForWriting} guards\n * on the pragma itself instead of on this number.\n */\nexport const CHANGE_LOG_DB_SCHEMA_VERSION = 4;\n\n/** https://www.sqlite.org/pragma.html#pragma_auto_vacuum */\nconst AUTO_VACUUM_INCREMENTAL = 2;\n\nexport const CHANGE_LOG_STREAM_TABLE = '_zero.changeLogStream';\nexport const CHANGE_LOG_STREAM_WRITE_TIME_INDEX =\n  '_zero.changeLogStream_writeTimeMs';\n\nconst INTEGER_BYTES = 8;\n\n/**\n * Estimates the retained payload size of a stream row. This deliberately does\n * not claim to measure SQLite b-tree/page overhead; it is stable across the\n * write path, reconciliation, and the startup scan used by observability.\n */\nexport function estimateChangeLogStreamRowBytes(\n  watermark: string,\n  tag: string,\n  change: string,\n  precommit?: string,\n  hasWriteTime = false,\n): number {\n  return (\n    Buffer.byteLength(watermark) +\n    INTEGER_BYTES +\n    Buffer.byteLength(tag) +\n    Buffer.byteLength(change) +\n    (precommit === undefined ? 0 : Buffer.byteLength(precommit)) +\n    (hasWriteTime ? INTEGER_BYTES : 0)\n  );\n}\n\n// The index is partial because only commit rows carry a \"writeTimeMs\", so it\n// holds one entry per transaction rather than one per change. It is what the\n// purger scans to find transactions older than the retention window.\n//\n// Pre-release builds briefly carried this table in the replica; see the test\n// fixture `CREATE_V14_CHANGE_LOG_STREAM` in\n// `change-source/common/replica-schema.ts`. Its old shape must not be kept in\n// sync with this one.\nexport const CREATE_CHANGE_LOG_STREAM_SCHEMA = /*sql*/ `\n  CREATE TABLE \"${CHANGE_LOG_STREAM_TABLE}\" (\n    \"watermark\"      TEXT NOT NULL,\n    \"pos\"            INTEGER NOT NULL,\n    \"tag\"            TEXT NOT NULL,\n    \"estimatedBytes\"  INTEGER NOT NULL,\n    \"change\"          TEXT NOT NULL,\n    \"precommit\"       TEXT,\n    \"writeTimeMs\"     INTEGER,\n    PRIMARY KEY (\"watermark\", \"pos\")\n  );\n\n  CREATE INDEX \"${CHANGE_LOG_STREAM_WRITE_TIME_INDEX}\"\n    ON \"${CHANGE_LOG_STREAM_TABLE}\" (\"writeTimeMs\", \"watermark\")\n    WHERE \"writeTimeMs\" IS NOT NULL;\n`;\n\n/**\n * Inserts the synthetic begin/commit pair for the seed watermark.\n *\n * Both rows are inserted by one statement so a caller outside a larger\n * transaction cannot leave a partial seed.\n */\nconst SEED_CHANGE_LOG_STREAM_SQL = /*sql*/ `\n  INSERT INTO \"${CHANGE_LOG_STREAM_TABLE}\"\n    (\"watermark\", \"pos\", \"tag\", \"estimatedBytes\", \"change\", \"precommit\",\n     \"writeTimeMs\")\n  VALUES\n    (@watermark, 0, 'begin', @beginBytes, @beginChange, NULL, NULL),\n    (@watermark, 1, 'commit', @commitBytes, @commitChange, @watermark,\n     @writeTimeMs)\n  ON CONFLICT (\"watermark\", \"pos\") DO NOTHING\n`;\n\nexport const CHANGE_LOG_META_TABLE = '_zero.changeLogMeta';\n\n// The identity triple (see ChangeLogIdentity) detects a file left behind by a\n// different replica -- most concretely, a leftover log on a reused volume.\n//\n// \"seededAtMs\"    : when the log was seeded, i.e. how far its retention window\n//                   can possibly reach back. Slice 11 uses it as the warm-up\n//                   signal for canary reads.\n// \"seedWatermark\" : where the log was seeded. `min(\"watermark\")` cannot answer\n//                   this once purge has advanced the minimum, and the\n//                   difference is what distinguishes a log that purged past the\n//                   retention floor (an invariant violation) from one that\n//                   never held that history at all (routine at every fork).\n// \"lock\"          : enforces single-row semantics, as in\n//                   \"_zero.replicationConfig\".\nconst CREATE_CHANGE_LOG_META_SCHEMA = /*sql*/ `\n  CREATE TABLE \"${CHANGE_LOG_META_TABLE}\" (\n    \"epoch\"         TEXT,\n    \"generation\"    TEXT NOT NULL,\n    \"replicaID\"     TEXT,\n    \"schemaVersion\" INTEGER NOT NULL,\n    \"seededAtMs\"    INTEGER NOT NULL,\n    \"seedWatermark\" TEXT NOT NULL,\n    \"lock\"          INTEGER PRIMARY KEY DEFAULT 1 CHECK (\"lock\" = 1)\n  );\n`;\n\n/**\n * `${replicaFile}-change-log`, matching the `-serving-copy` convention.\n *\n * The name outlives the writer's move into the change-streamer: the\n * change-streamer derives the path from the replica file it owns, so renaming\n * would save no plumbing and would orphan the old file on every existing\n * volume, where nothing would delete it.\n *\n * Its `-wal` / `-wal2` / `-shm` sidecars are suffixes of *this* name, so they\n * never collide with the replica's own sidecars.\n */\nexport function changeLogFileName(replicaFile: string): string {\n  return `${replicaFile}-change-log`;\n}\n\n/**\n * Removes the change-log database and its `-wal` / `-wal2` / `-shm` sidecars.\n * Safe to call when the file does not exist.\n */\nexport function deleteChangeLogDB(replicaFile: string): void {\n  deleteLiteDB(changeLogFileName(replicaFile));\n}\n\n/**\n * Which replica the log's contents belong to.\n *\n * `generation` is RMv1's `replicaVersion`: the version at which initial sync\n * copied every row. It is shared by every sibling of a forked replica, which is\n * why it cannot be the whole of the identity under RMv2 — `epoch` and\n * `replicaID` are what distinguish two siblings' logs. Both are `null` until\n * RMv2 supplies them, and a `null` matches only another `null`, so a log\n * written before they exist is still recognized as this replica's.\n */\nexport type ChangeLogIdentity = {\n  readonly epoch: string | null;\n  readonly generation: string;\n  readonly replicaID: string | null;\n};\n\n/**\n * Where the stream connection resumes, and everything the log's state at that\n * position consists of.\n *\n * The two fields travel together because a cookie set is only meaningful paired\n * with the watermark it was folded up to (invariant 15). They are read from one\n * store, in one snapshot: `Storer.getStartStreamInitializationParameters()`\n * reads both from Postgres in a single REPEATABLE READ transaction. Pairing one\n * store's cookies with another's watermark would silently drop every backfill\n * that completed in the interval, and those rows are unrecoverable — backfill\n * transactions are synthesized by the change source rather than replayed from\n * the slot.\n */\nexport type ChangeLogResumePoint = {\n  /**\n   * The watermark this stream connection resumes from. The log's own head is\n   * measured against it, and a reseed seeds a synthetic transaction at it.\n   *\n   * Deliberately *not* \"the replica's state version\": after the writer moved to\n   * the change-streamer, the canonical replicator is a subscriber downstream of\n   * the write loop, so its state version is a consequence of this log rather\n   * than a constraint on it.\n   */\n  readonly resumeWatermark: string;\n  /**\n   * The cookie set that belongs to {@link resumeWatermark}. Any reconciliation\n   * that moves the head invalidates the set the log was holding — the cookies\n   * are unversioned point-in-time state, and truncating the stream above `W`\n   * does not roll them back to `W` — so the same transaction installs this one\n   * in its place (invariant 17).\n   *\n   * Postgres supplies it while it remains the store the stream resumes from. At\n   * the C5 flip the log's own head *is* the resume point, phantoms cannot\n   * exist, and both this field and the truncate-above path become dead code.\n   */\n  readonly cookies: CookieSet;\n};\n\n/**\n * What the log is reconciled against. Reconciliation runs once per stream\n * connection, since every reconnect can re-read a different resume point.\n */\nexport type ChangeLogAnchor = ChangeLogResumePoint & {\n  readonly identity: ChangeLogIdentity;\n  /**\n   * The change-streamer's clock, at reconciliation time. Supplied rather than\n   * read inline so that tests control it. Used for `seededAtMs` and for the\n   * seed transaction's `writeTimeMs`, which is what the purger's time floor\n   * measures.\n   */\n  readonly nowMs: number;\n};\n\n/** The meta row, i.e. everything the log records about itself. */\nexport type ChangeLogMeta = ChangeLogIdentity & {\n  readonly schemaVersion: number;\n  readonly seededAtMs: number;\n  readonly seedWatermark: string;\n};\n\n/**\n * Opens the change-log database beside `replicaFile`.\n *\n * A writable handle creates the file if it is absent; a `readonly` handle\n * throws, which is the normal state for a change-streamer whose writer is\n * disabled. Pragmas are the caller's responsibility, since only the writer sets\n * the persistent ones.\n */\nexport function openChangeLogDB(\n  lc: LogContext,\n  replicaFile: string,\n  opts: {readonly: boolean},\n): Database {\n  return new Database(\n    lc.withContext('component', 'change-log-db'),\n    changeLogFileName(replicaFile),\n    {readonly: opts.readonly},\n  );\n}\n\n/**\n * Configures the change-log database, which the change-streamer's writer owns\n * exclusively. These are the settings the `separate-files` mode of\n * `sqlite-change-log-ceiling.bench.ts` measured.\n *\n * `wal2` because the log is a continuous append that catchup reads\n * continuously, which is the case wal2 exists for: it avoids checkpoint\n * starvation without needing an autocheckpoint. `wal_autocheckpoint` therefore\n * keeps its default, unlike the backup replica's 0, which hands checkpointing\n * to litestream — nothing else owns this file.\n *\n * `synchronous = NORMAL` because the commit sits on the forward path, once per\n * upstream transaction, and NORMAL keeps that from costing an fsync. It is not\n * a durability compromise here: in WAL mode NORMAL still writes every commit\n * through to the OS, so it survives a process crash, an OOM kill, or a SIGKILL.\n * It is lost only to kernel panic or power loss, and those destroy the node —\n * the task restarts elsewhere, restores the replica from S3, and has no\n * change-log file at all. Whatever a power loss does take is detected by\n * {@link reconcileChangeLog} and reseeded.\n *\n * `auto_vacuum = INCREMENTAL` so that purge can return freed pages to the OS\n * rather than leaving the file at its high-water mark. **It must be the first\n * statement here.** SQLite honours a `none` -> `incremental` transition only\n * while the file is still empty, and `journal_mode = wal2` materializes page 1;\n * appending the pragma instead of prepending it silently leaves the file at\n * mode 0 forever, since neither `DROP TABLE` nor a reseed makes a file empty\n * again. {@link openChangeLogDBForWriting} verifies the result.\n */\nexport function applyChangeLogPragmas(db: Database): void {\n  db.pragma('auto_vacuum = INCREMENTAL');\n  db.pragma('busy_timeout = 30000');\n  db.pragma('analysis_limit = 1000');\n  db.pragma('journal_mode = wal2');\n  db.pragma('synchronous = NORMAL');\n}\n\nfunction readAutoVacuum(db: Database): number {\n  const [{auto_vacuum: mode}] = db.pragma<{auto_vacuum: number}>('auto_vacuum');\n  return mode;\n}\n\n/**\n * Opens the change-log database for the writer, applies its pragmas, and\n * reconciles it against `anchor`, returning the handle and what reconciliation\n * had to do.\n *\n * Corruption is answered with a rebuild rather than an escalation, which is a\n * deliberate divergence from how the replica's own corruption is handled. A\n * corrupt replica is a lost source of truth, so it ends in a restore or an\n * auto-reset; the change log holds nothing that is not either already in the\n * replica's litestream backup or re-derivable from the upstream slot, so the\n * entire response is to delete the file and seed a new one at the resume\n * watermark. The cost is one retention window of catchup — reconnecting\n * subscribers below the head get `too-old` — which is what every other\n * {@link ReseedReason} costs.\n *\n * Only corruption is rebuilt through. Anything else (a bad path, a permissions\n * error, a full disk) is a problem with the environment rather than with the\n * file's contents, and deleting a database in response would destroy state\n * without fixing it. Those propagate to the caller, which disables the writer\n * and keeps replicating.\n *\n * A file that predates `auto_vacuum = INCREMENTAL` takes the same rebuild, for\n * the same reason and at the same cost: the pragma only takes on an empty file,\n * so a reseed cannot enable it. Unlike corruption, a *second* failure there is\n * tolerated rather than thrown — see {@link ensureIncrementalAutoVacuum}.\n */\n/**\n * Returns an anchor after the database opens.\n *\n * The resolver can inspect the existing file before it selects the anchor. A\n * valid log can use its own head. A new or invalid log uses the replica seed.\n * The rebuild path calls the resolver again for the new file.\n */\nexport type AnchorResolver = (db: Database) => ChangeLogAnchor;\n\nexport function openChangeLogDBForWriting(\n  lc: LogContext,\n  replicaFile: string,\n  anchor: AnchorResolver,\n): {db: Database; result: ReconcileResult; replacedFile: boolean} {\n  const existed = existsSync(changeLogFileName(replicaFile));\n  const opened = openOrRebuildCorrupt(lc, replicaFile, anchor, existed);\n  const {db, result, replacedFile} = ensureIncrementalAutoVacuum(\n    lc,\n    replicaFile,\n    anchor,\n    opened,\n  );\n  return {db, result, replacedFile};\n}\n\nfunction openOrRebuildCorrupt(\n  lc: LogContext,\n  replicaFile: string,\n  anchor: AnchorResolver,\n  boundReconciliation: boolean,\n): OpenedChangeLog {\n  try {\n    return openAndReconcile(lc, replicaFile, anchor, boundReconciliation);\n  } catch (e) {\n    if (e instanceof ChangeLogRebuildRequired) {\n      return rebuildChangeLog(lc, replicaFile, anchor, e);\n    }\n    if (!isSQLiteCorruption(e)) {\n      throw e;\n    }\n    const file = changeLogFileName(replicaFile);\n    logSQLiteCorruptionDiagnostics(lc, 'change-log', file, e);\n    lc.error?.('rebuilding the corrupt SQLite change log', {\n      sqliteChangeLog: {file},\n    });\n    return rebuildChangeLog(lc, replicaFile, anchor);\n  }\n}\n\n/**\n * Rebuilds a log whose `auto_vacuum` mode is not `INCREMENTAL`, which is every\n * log created before the pragma shipped — including every v2 file the writer\n * wrote in the meantime, which is why the guard is on the pragma rather than\n * on the schema version. Deleting the file is the only way to enable it:\n * `DROP TABLE` leaves the header's mode intact, and the in-place alternative —\n * a full `VACUUM` — is an unbounded blocking statement on a file the writer\n * needs.\n *\n * A mode that is still wrong after the rebuild is logged and tolerated, which\n * is the one place this diverges from the corruption path. The two failures are\n * not alike: a file that stays corrupt after a rebuild is an environment\n * problem, but a pragma that stays wrong on a brand-new file can only mean\n * {@link applyChangeLogPragmas}' statement order is wrong — a code bug, present\n * on every task, on every start. Throwing there turns a lost optimization into\n * a crash loop, and rebuilding again turns it into a reseed per start, which is\n * worse than the freelist growth it was trying to avoid. `Database.compact()`\n * already warns and no-ops when the mode is not `INCREMENTAL`, so degrading is\n * the accepted fallback.\n */\nfunction ensureIncrementalAutoVacuum(\n  lc: LogContext,\n  replicaFile: string,\n  anchor: AnchorResolver,\n  opened: OpenedChangeLog,\n): OpenedChangeLog {\n  if (opened.autoVacuum === AUTO_VACUUM_INCREMENTAL) {\n    return opened;\n  }\n  const file = changeLogFileName(replicaFile);\n  lc.info?.('rebuilding the SQLite change log to enable incremental vacuum', {\n    sqliteChangeLog: {file, autoVacuum: opened.autoVacuum},\n  });\n  opened.db.close();\n  const rebuilt = rebuildChangeLog(lc, replicaFile, anchor);\n  if (rebuilt.autoVacuum !== AUTO_VACUUM_INCREMENTAL) {\n    lc.error?.(\n      'SQLite change log does not support incremental vacuum; ' +\n        'it will plateau at its high-water mark',\n      {sqliteChangeLog: {file, autoVacuum: rebuilt.autoVacuum}},\n    );\n  }\n  return rebuilt;\n}\n\n/** The shared \"delete the file and open a new one\" body. */\nfunction rebuildChangeLog(\n  lc: LogContext,\n  replicaFile: string,\n  anchor: AnchorResolver,\n  required?: ChangeLogRebuildRequired | undefined,\n): OpenedChangeLog {\n  if (required) {\n    lc.warn?.(\n      'rebuilding the SQLite change log instead of running an unbounded reconciliation',\n      {\n        sqliteChangeLogRebuild: {\n          reason: required.reason,\n          rows: required.rows,\n          estimatedBytes: required.estimatedBytes,\n        },\n      },\n    );\n  }\n  deleteChangeLogDB(replicaFile);\n  // The file is absent, so the reseed only drops empty/nonexistent tables. A\n  // second failure is the environment's, not the old file's.\n  const opened = openAndReconcile(\n    lc,\n    replicaFile,\n    anchor,\n    false,\n    required?.reason,\n  );\n  return {...opened, replacedFile: true};\n}\n\n/**\n * Replaces an already-closed change-log file after bounded reconciliation\n * declined its work. The caller closes cached readers before calling this so\n * none can continue serving the unlinked inode.\n */\nexport function rebuildChangeLogDBForWriting(\n  lc: LogContext,\n  replicaFile: string,\n  anchor: ChangeLogAnchor,\n  required: ChangeLogRebuildRequired,\n): {db: Database; result: ReconcileResult; replacedFile: true} {\n  const {db, result} = rebuildChangeLog(\n    lc,\n    replicaFile,\n    () => anchor,\n    required,\n  );\n  return {db, result, replacedFile: true};\n}\n\ntype OpenedChangeLog = {\n  db: Database;\n  result: ReconcileResult;\n  replacedFile: boolean;\n  /** The file's persistent `auto_vacuum` mode, read back after the pragmas. */\n  autoVacuum: number;\n};\n\nfunction openAndReconcile(\n  lc: LogContext,\n  replicaFile: string,\n  anchor: AnchorResolver,\n  boundReconciliation: boolean,\n  reseedReason?: ReseedReason | undefined,\n): OpenedChangeLog {\n  const db = openChangeLogDB(lc, replicaFile, {readonly: false});\n  try {\n    applyChangeLogPragmas(db);\n    const autoVacuum = readAutoVacuum(db);\n    return {\n      db,\n      result: reconcileChangeLog(lc, db, anchor(db), {\n        rebuildInsteadOfUnboundedWork: boundReconciliation,\n        reseedReason,\n      }),\n      replacedFile: false,\n      autoVacuum,\n    };\n  } catch (e) {\n    // The caller never sees this handle, so it closes here or leaks — and it\n    // must be closed before the corruption path deletes the file.\n    db.close();\n    throw e;\n  }\n}\n\nexport type ReseedReason =\n  | 'created' // file or table absent\n  | 'schema-mismatch'\n  | 'identity-mismatch'\n  | 'gap' // head does not land on the resume watermark after truncation\n  | 'oversized-truncate'; // preserving the prefix would require too much work\n\n/**\n * Reconciliation runs synchronously on the change-streamer's event loop. A\n * normal phantom is one transaction, so work above either limit is answered by\n * unlinking and reseeding this disposable cache rather than deleting an\n * arbitrarily large suffix in place.\n */\nexport const MAX_RECONCILE_TRUNCATE_ROWS = 10_000;\nexport const MAX_RECONCILE_TRUNCATE_BYTES = 16 * 1024 * 1024;\n\nexport class ChangeLogRebuildRequired extends Error {\n  override readonly name = 'ChangeLogRebuildRequired';\n  readonly reason: ReseedReason;\n  readonly rows?: number | undefined;\n  readonly estimatedBytes?: number | undefined;\n\n  constructor(\n    reason: ReseedReason,\n    rows?: number | undefined,\n    estimatedBytes?: number | undefined,\n  ) {\n    super(`SQLite change log requires a ${reason} rebuild`);\n    this.reason = reason;\n    this.rows = rows;\n    this.estimatedBytes = estimatedBytes;\n  }\n}\n\ntype ReconcileOptions = {\n  /** Throw before an unbounded delete/drop so the file owner can unlink it. */\n  readonly rebuildInsteadOfUnboundedWork?: boolean | undefined;\n  /** Preserve the reason that caused an old file to be unlinked. */\n  readonly reseedReason?: ReseedReason | undefined;\n};\n\n/**\n * `cookiesStale` records that the cookie set the log held did not survive\n * reconciliation. The cookies are unversioned point-in-time state, so any\n * reconciliation that moves the head invalidates them, and the same transaction\n * replaces them with the anchor's — the set that belongs to the resume\n * watermark (see `change-log-cookies.ts`). It is `action !== 'none'` today; it\n * is a field rather than a derivation because the replacement reads as intent\n * at the call site, and because it is what the `cookie_reseed` counter is keyed\n * on.\n */\nexport type ReconcileResult =\n  | {action: 'none'; head: string; cookiesStale: false}\n  | {action: 'truncated'; head: string; rows: number; cookiesStale: true}\n  | {\n      action: 'reseeded';\n      head: string;\n      reason: ReseedReason;\n      cookiesStale: true;\n    };\n\n/**\n * Brings the change log into agreement with the watermark its stream connection\n * resumes from, in one transaction on the change-log database:\n *\n * ```\n * head === resumeWatermark  → keep appending\n * head  >  resumeWatermark  → truncate above resumeWatermark\n * otherwise                 → wipe, seed at resumeWatermark, record the reason\n * ```\n *\n * The log commits before anything that can advance the resume watermark, so a\n * *phantom* — a transaction the log holds whose watermark the resumed stream\n * re-delivers — is the normal state, and truncate-above is the whole of\n * reconciliation rather than a special case. A phantom's rows all carry the\n * transaction's commit watermark, which is strictly greater than the resume\n * watermark, so deleting on that predicate removes phantoms whole and retains\n * every transaction at or below the resume point.\n *\n * It must run per stream connection, not once per process: the stream loop\n * re-reads its resume watermark on every reconnect, and the writer inserts with\n * a plain `INSERT` against `PRIMARY KEY (\"watermark\",\"pos\")`, so an\n * un-truncated overlap is a constraint violation on the first re-delivered\n * transaction.\n *\n * Anything truncation cannot resolve — the file was deleted, the writer was\n * disabled for a while, the replica was restored, power was lost with\n * `synchronous=NORMAL` — surfaces as a head that does not land on the resume\n * watermark, and is resolved by wiping and reseeding there.\n *\n * Whichever of the two moves the head also replaces the cookie set with the one\n * the anchor carries, in the same transaction: the head and the cookies are one\n * position, and nothing may observe them at two.\n */\nexport function reconcileChangeLog(\n  lc: LogContext,\n  db: Database,\n  anchor: ChangeLogAnchor,\n  opts: ReconcileOptions = {},\n): ReconcileResult {\n  db.exec('BEGIN IMMEDIATE');\n  try {\n    if (opts.rebuildInsteadOfUnboundedWork) {\n      const required = rebuildRequired(db, anchor);\n      if (required) {\n        throw required;\n      }\n    }\n    const result = opts.reseedReason\n      ? reseed(lc, db, anchor, opts.reseedReason)\n      : reconcile(lc, db, anchor);\n    db.exec('COMMIT');\n    return result;\n  } catch (e) {\n    if (db.inTransaction) {\n      db.exec('ROLLBACK');\n    }\n    throw e;\n  }\n}\n\n/**\n * Decides whether reconciliation can be performed within its synchronous work\n * budget. Every query is either an index seek or a scan capped at one row past\n * the delete limit. No state changes before the decision is complete.\n */\nfunction rebuildRequired(\n  db: Database,\n  anchor: ChangeLogAnchor,\n): ChangeLogRebuildRequired | undefined {\n  const wipe = changeLogWipeReason(db, anchor.identity);\n  if (wipe !== undefined) {\n    return new ChangeLogRebuildRequired(wipe);\n  }\n\n  const head = readChangeLogHead(db);\n  const {resumeWatermark} = anchor;\n  if (head === null || head < resumeWatermark) {\n    return new ChangeLogRebuildRequired('gap');\n  }\n  if (head === resumeWatermark) {\n    return undefined;\n  }\n\n  const boundary = db\n    .prepare(/*sql*/ `\n      SELECT 1 FROM \"${CHANGE_LOG_STREAM_TABLE}\"\n        WHERE \"watermark\" = ?\n        LIMIT 1\n    `)\n    .get<{1: number} | undefined>(resumeWatermark);\n  if (boundary === undefined) {\n    return new ChangeLogRebuildRequired('gap');\n  }\n\n  const {rows, estimatedBytes} = db\n    .prepare(/*sql*/ `\n      SELECT count(*) AS \"rows\",\n             coalesce(sum(\"estimatedBytes\"), 0) AS \"estimatedBytes\"\n        FROM (\n          SELECT \"estimatedBytes\" FROM \"${CHANGE_LOG_STREAM_TABLE}\"\n            WHERE \"watermark\" > ?\n            LIMIT ${MAX_RECONCILE_TRUNCATE_ROWS + 1}\n        )\n    `)\n    .get<{rows: number; estimatedBytes: number}>(resumeWatermark);\n  return rows > MAX_RECONCILE_TRUNCATE_ROWS ||\n    estimatedBytes > MAX_RECONCILE_TRUNCATE_BYTES\n    ? new ChangeLogRebuildRequired('oversized-truncate', rows, estimatedBytes)\n    : undefined;\n}\n\nfunction reconcile(\n  lc: LogContext,\n  db: Database,\n  anchor: ChangeLogAnchor,\n): ReconcileResult {\n  const wipe = changeLogWipeReason(db, anchor.identity);\n  if (wipe !== undefined) {\n    return reseed(lc, db, anchor, wipe);\n  }\n\n  const {resumeWatermark} = anchor;\n  let head = readChangeLogHead(db);\n  let rows = 0;\n  if (head !== null && head > resumeWatermark) {\n    rows = db\n      .prepare(/*sql*/ `\n        DELETE FROM \"${CHANGE_LOG_STREAM_TABLE}\" WHERE \"watermark\" > ?\n      `)\n      .run(resumeWatermark).changes;\n    head = readChangeLogHead(db);\n  }\n\n  if (head !== resumeWatermark) {\n    return reseed(lc, db, anchor, 'gap');\n  }\n  if (rows > 0) {\n    // The truncated transactions can have carried `create-table`,\n    // `add-column`, and `backfill-completed`, none of which the truncate rolls\n    // back, so the cookie set no longer belongs to the head. The anchor's set\n    // does, and it lands in this same transaction: invariant 17 holds at every\n    // point another connection could observe the log.\n    replaceCookies(db, anchor.cookies);\n    lc.info?.('truncated phantom transactions from the SQLite change log', {\n      sqliteChangeLogReconcile: {head, rows, cookies: cookieCounts(anchor)},\n    });\n    return {action: 'truncated', head, rows, cookiesStale: true};\n  }\n  lc.debug?.('SQLite change log is at the resume watermark', {\n    sqliteChangeLogReconcile: {head},\n  });\n  return {action: 'none', head, cookiesStale: false};\n}\n\n/**\n * Returns the reason that the log must be recreated. Returns `undefined` when\n * the writer can continue to use the log.\n *\n * This function takes only the expected identity because callers use the result\n * to select the anchor.\n */\nexport function changeLogWipeReason(\n  db: Database,\n  identity: ChangeLogIdentity,\n): ReseedReason | undefined {\n  if (\n    !tableExists(db, CHANGE_LOG_STREAM_TABLE) ||\n    !tableExists(db, CHANGE_LOG_META_TABLE)\n  ) {\n    return 'created';\n  }\n  // The schema version is read on its own because it is the one column every\n  // version of this table has had. Reading the rest of a v1 row would fail on\n  // its missing columns instead of reporting the mismatch that explains it.\n  const version = db\n    .prepare(/*sql*/ `\n      SELECT \"schemaVersion\" FROM \"${CHANGE_LOG_META_TABLE}\"\n    `)\n    .get<{schemaVersion: number} | undefined>();\n  if (version === undefined) {\n    return 'created';\n  }\n  if (version.schemaVersion !== CHANGE_LOG_DB_SCHEMA_VERSION) {\n    return 'schema-mismatch';\n  }\n  // Checked *after* the version, so that every pre-v4 file — which is every\n  // file in the fleet at the upgrade — reports the `schema-mismatch` that\n  // explains it rather than the `created` its absent cookie tables would\n  // otherwise look like.\n  if (\n    !tableExists(db, CHANGE_LOG_TABLE_METADATA_TABLE) ||\n    !tableExists(db, CHANGE_LOG_BACKFILLING_TABLE)\n  ) {\n    return 'created';\n  }\n  const {epoch, generation, replicaID} = readChangeLogMeta(db);\n  if (\n    epoch !== identity.epoch ||\n    generation !== identity.generation ||\n    replicaID !== identity.replicaID\n  ) {\n    return 'identity-mismatch';\n  }\n  return undefined;\n}\n\nfunction reseed(\n  lc: LogContext,\n  db: Database,\n  anchor: ChangeLogAnchor,\n  reason: ReseedReason,\n): ReconcileResult {\n  const {identity, resumeWatermark, nowMs} = anchor;\n  // Dropping the table drops its partial index with it. The cookie tables go\n  // with the buffer: a cookie set without the transactions it was folded from\n  // is not a smaller cookie set, it is a wrong one.\n  db.exec(/*sql*/ `\n    DROP TABLE IF EXISTS \"${CHANGE_LOG_STREAM_TABLE}\";\n    DROP TABLE IF EXISTS \"${CHANGE_LOG_META_TABLE}\";\n    ${DROP_CHANGE_LOG_COOKIE_TABLES}\n    ${CREATE_CHANGE_LOG_STREAM_SCHEMA}\n    ${CREATE_CHANGE_LOG_META_SCHEMA}\n    ${CREATE_CHANGE_LOG_COOKIE_SCHEMA}\n  `);\n  db.prepare(/*sql*/ `\n    INSERT INTO \"${CHANGE_LOG_META_TABLE}\"\n      (\"epoch\", \"generation\", \"replicaID\", \"schemaVersion\", \"seededAtMs\",\n       \"seedWatermark\")\n      VALUES (@epoch, @generation, @replicaID, @schemaVersion, @seededAtMs,\n              @seedWatermark)\n  `).run({\n    epoch: identity.epoch,\n    generation: identity.generation,\n    replicaID: identity.replicaID,\n    schemaVersion: CHANGE_LOG_DB_SCHEMA_VERSION,\n    seededAtMs: nowMs,\n    seedWatermark: resumeWatermark,\n  });\n  seedChangeLogStream(db, anchor);\n  // Into tables this statement just created, so the wholesale replacement is\n  // all insert. It is still the same call the truncate path makes: a reseed is\n  // the case where the log's cookie set was not merely moved but discarded, and\n  // the anchor's is equally what belongs at the head either way.\n  replaceCookies(db, anchor.cookies);\n\n  lc.info?.('reseeded the SQLite change log', {\n    sqliteChangeLogReconcile: {\n      reason,\n      head: resumeWatermark,\n      ...identity,\n      schemaVersion: CHANGE_LOG_DB_SCHEMA_VERSION,\n      seededAtMs: nowMs,\n      cookies: cookieCounts(anchor),\n    },\n  });\n  return {\n    action: 'reseeded',\n    head: resumeWatermark,\n    reason,\n    cookiesStale: true,\n  };\n}\n\n/**\n * Seeds a valid synthetic transaction at the anchor's resume watermark, making\n * an otherwise empty log serviceable as a catchup boundary for a subscriber\n * that is exactly at that watermark.\n */\nexport function seedChangeLogStream(\n  db: Database,\n  anchor: ChangeLogAnchor,\n): void {\n  const beginChange = '{\"tag\":\"begin\"}';\n  const commitChange = '{\"tag\":\"commit\"}';\n  db.prepare(SEED_CHANGE_LOG_STREAM_SQL).run({\n    watermark: anchor.resumeWatermark,\n    beginBytes: estimateChangeLogStreamRowBytes(\n      anchor.resumeWatermark,\n      'begin',\n      beginChange,\n    ),\n    beginChange,\n    commitBytes: estimateChangeLogStreamRowBytes(\n      anchor.resumeWatermark,\n      'commit',\n      commitChange,\n      anchor.resumeWatermark,\n      true,\n    ),\n    commitChange,\n    writeTimeMs: anchor.nowMs,\n  });\n}\n\n/** Reads the whole meta row. Throws if the log has not been reconciled. */\nexport function readChangeLogMeta(db: Database): ChangeLogMeta {\n  const meta = db\n    .prepare(/*sql*/ `\n      SELECT \"epoch\", \"generation\", \"replicaID\", \"schemaVersion\",\n             \"seededAtMs\", \"seedWatermark\"\n        FROM \"${CHANGE_LOG_META_TABLE}\"\n    `)\n    .get<ChangeLogMeta | undefined>();\n  if (meta === undefined) {\n    throw new Error('the SQLite change log has no meta row');\n  }\n  return meta;\n}\n\n/**\n * `max()` on the primary key's leading column, i.e. an index seek. Null when\n * the log is empty.\n */\nexport function readChangeLogHead(db: Database): string | null {\n  const {head} = db\n    .prepare(/*sql*/ `\n      SELECT max(\"watermark\") AS \"head\" FROM \"${CHANGE_LOG_STREAM_TABLE}\"\n    `)\n    .get<{head: string | null}>();\n  return head;\n}\n\n/**\n * The covered watermark range. Both scalar subqueries seek the watermark\n * index, so unlike a `count()` this does not scan the log. Both bounds are\n * null when it is empty.\n */\nexport function readChangeLogBounds(db: Database): ChangeLogBounds {\n  return db\n    .prepare(/*sql*/ `\n      SELECT\n        (SELECT min(\"watermark\") FROM \"${CHANGE_LOG_STREAM_TABLE}\")\n          AS \"minWatermark\",\n        (SELECT max(\"watermark\") FROM \"${CHANGE_LOG_STREAM_TABLE}\")\n          AS \"headWatermark\"\n    `)\n    .get<ChangeLogBounds>();\n}\n\nexport type ChangeLogBounds = {\n  readonly minWatermark: string | null;\n  readonly headWatermark: string | null;\n};\n\n/**\n * What was installed, for the reconcile log line. Normally `{0, 0}`: a nonzero\n * `backfilling` means the resumed stream is being handed backfills to re-request.\n */\nfunction cookieCounts({cookies}: ChangeLogAnchor) {\n  return {\n    tableMetadata: cookies.tableMetadata.length,\n    backfilling: cookies.backfilling.length,\n  };\n}\n\nfunction tableExists(db: Database, table: string): boolean {\n  return (\n    db\n      .prepare(/*sql*/ `\n        SELECT 1 FROM \"sqlite_master\" WHERE \"type\" = 'table' AND \"name\" = ?\n      `)\n      .get<{1: number} | undefined>(table) !== undefined\n  );\n}\n"],"mappings":";;;;;;AAmFA,IAAM,0BAA0B;AAEhC,IAAa,0BAA0B;AACvC,IAAa,qCACX;AAEF,IAAM,gBAAgB;;;;;;AAOtB,SAAgB,gCACd,WACA,KACA,QACA,WACA,eAAe,OACP;CACR,OACE,OAAO,WAAW,SAAS,IAC3B,gBACA,OAAO,WAAW,GAAG,IACrB,OAAO,WAAW,MAAM,KACvB,cAAc,KAAA,IAAY,IAAI,OAAO,WAAW,SAAS,MACzD,eAAe,gBAAgB;AAEpC;AAUA,IAAa,kCAA0C;kBACrC,wBAAwB;;;;;;;;;;;kBAWxB,mCAAmC;UAC3C,wBAAwB;;;;;;;;;AAUlC,IAAM,6BAAqC;iBAC1B,wBAAwB;;;;;;;;;AAUzC,IAAa,wBAAwB;AAerC,IAAM,gCAAwC;kBAC5B,sBAAsB;;;;;;;;;;;;;;;;;;;;;AAsBxC,SAAgB,kBAAkB,aAA6B;CAC7D,OAAO,GAAG,YAAY;AACxB;;;;;AAMA,SAAgB,kBAAkB,aAA2B;CAC3D,aAAa,kBAAkB,WAAW,CAAC;AAC7C;;;;;;;;;AAsFA,SAAgB,gBACd,IACA,aACA,MACU;CACV,OAAO,IAAI,SACT,GAAG,YAAY,aAAa,eAAe,GAC3C,kBAAkB,WAAW,GAC7B,EAAC,UAAU,KAAK,SAAQ,CAC1B;AACF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8BA,SAAgB,sBAAsB,IAAoB;CACxD,GAAG,OAAO,2BAA2B;CACrC,GAAG,OAAO,sBAAsB;CAChC,GAAG,OAAO,uBAAuB;CACjC,GAAG,OAAO,qBAAqB;CAC/B,GAAG,OAAO,sBAAsB;AAClC;AAEA,SAAS,eAAe,IAAsB;CAC5C,MAAM,CAAC,EAAC,aAAa,UAAS,GAAG,OAA8B,aAAa;CAC5E,OAAO;AACT;AAqCA,SAAgB,0BACd,IACA,aACA,QACgE;CAGhE,MAAM,EAAC,IAAI,QAAQ,iBAAgB,4BACjC,IACA,aACA,QAJa,qBAAqB,IAAI,aAAa,QADrC,WAAW,kBAAkB,WAAW,CACK,CAK3D,CACF;CACA,OAAO;EAAC;EAAI;EAAQ;CAAY;AAClC;AAEA,SAAS,qBACP,IACA,aACA,QACA,qBACiB;CACjB,IAAI;EACF,OAAO,iBAAiB,IAAI,aAAa,QAAQ,mBAAmB;CACtE,SAAS,GAAG;EACV,IAAI,aAAa,0BACf,OAAO,iBAAiB,IAAI,aAAa,QAAQ,CAAC;EAEpD,IAAI,CAAC,mBAAmB,CAAC,GACvB,MAAM;EAER,MAAM,OAAO,kBAAkB,WAAW;EAC1C,+BAA+B,IAAI,cAAc,MAAM,CAAC;EACxD,GAAG,QAAQ,4CAA4C,EACrD,iBAAiB,EAAC,KAAI,EACxB,CAAC;EACD,OAAO,iBAAiB,IAAI,aAAa,MAAM;CACjD;AACF;;;;;;;;;;;;;;;;;;;;;AAsBA,SAAS,4BACP,IACA,aACA,QACA,QACiB;CACjB,IAAI,OAAO,eAAe,yBACxB,OAAO;CAET,MAAM,OAAO,kBAAkB,WAAW;CAC1C,GAAG,OAAO,iEAAiE,EACzE,iBAAiB;EAAC;EAAM,YAAY,OAAO;CAAU,EACvD,CAAC;CACD,OAAO,GAAG,MAAM;CAChB,MAAM,UAAU,iBAAiB,IAAI,aAAa,MAAM;CACxD,IAAI,QAAQ,eAAe,yBACzB,GAAG,QACD,iGAEA,EAAC,iBAAiB;EAAC;EAAM,YAAY,QAAQ;CAAU,EAAC,CAC1D;CAEF,OAAO;AACT;;AAGA,SAAS,iBACP,IACA,aACA,QACA,UACiB;CACjB,IAAI,UACF,GAAG,OACD,mFACA,EACE,wBAAwB;EACtB,QAAQ,SAAS;EACjB,MAAM,SAAS;EACf,gBAAgB,SAAS;CAC3B,EACF,CACF;CAEF,kBAAkB,WAAW;CAU7B,OAAO;EAAC,GAPO,iBACb,IACA,aACA,QACA,OACA,UAAU,MAED;EAAQ,cAAc;CAAI;AACvC;;;;;;AAOA,SAAgB,6BACd,IACA,aACA,QACA,UAC6D;CAC7D,MAAM,EAAC,IAAI,WAAU,iBACnB,IACA,mBACM,QACN,QACF;CACA,OAAO;EAAC;EAAI;EAAQ,cAAc;CAAI;AACxC;AAUA,SAAS,iBACP,IACA,aACA,QACA,qBACA,cACiB;CACjB,MAAM,KAAK,gBAAgB,IAAI,aAAa,EAAC,UAAU,MAAK,CAAC;CAC7D,IAAI;EACF,sBAAsB,EAAE;EACxB,MAAM,aAAa,eAAe,EAAE;EACpC,OAAO;GACL;GACA,QAAQ,mBAAmB,IAAI,IAAI,OAAO,EAAE,GAAG;IAC7C,+BAA+B;IAC/B;GACF,CAAC;GACD,cAAc;GACd;EACF;CACF,SAAS,GAAG;EAGV,GAAG,MAAM;EACT,MAAM;CACR;AACF;;;;;;;AAeA,IAAa,8BAA8B;AAG3C,IAAa,2BAAb,cAA8C,MAAM;CAClD,OAAyB;CACzB;CACA;CACA;CAEA,YACE,QACA,MACA,gBACA;EACA,MAAM,gCAAgC,OAAO,SAAS;EACtD,KAAK,SAAS;EACd,KAAK,OAAO;EACZ,KAAK,iBAAiB;CACxB;AACF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8DA,SAAgB,mBACd,IACA,IACA,QACA,OAAyB,CAAC,GACT;CACjB,GAAG,KAAK,iBAAiB;CACzB,IAAI;EACF,IAAI,KAAK,+BAA+B;GACtC,MAAM,WAAW,gBAAgB,IAAI,MAAM;GAC3C,IAAI,UACF,MAAM;EAEV;EACA,MAAM,SAAS,KAAK,eAChB,OAAO,IAAI,IAAI,QAAQ,KAAK,YAAY,IACxC,UAAU,IAAI,IAAI,MAAM;EAC5B,GAAG,KAAK,QAAQ;EAChB,OAAO;CACT,SAAS,GAAG;EACV,IAAI,GAAG,eACL,GAAG,KAAK,UAAU;EAEpB,MAAM;CACR;AACF;;;;;;AAOA,SAAS,gBACP,IACA,QACsC;CACtC,MAAM,OAAO,oBAAoB,IAAI,OAAO,QAAQ;CACpD,IAAI,SAAS,KAAA,GACX,OAAO,IAAI,yBAAyB,IAAI;CAG1C,MAAM,OAAO,kBAAkB,EAAE;CACjC,MAAM,EAAC,oBAAmB;CAC1B,IAAI,SAAS,QAAQ,OAAO,iBAC1B,OAAO,IAAI,yBAAyB,KAAK;CAE3C,IAAI,SAAS,iBACX;CAUF,IAPiB,GACd,QAAgB;;;;KAIhB,EACA,IAA6B,eAC5B,MAAa,KAAA,GACf,OAAO,IAAI,yBAAyB,KAAK;CAG3C,MAAM,EAAC,MAAM,mBAAkB,GAC5B,QAAgB;;;;0CAIqB,wBAAwB;;oBAE9C,8BAA8B,EAAE;;KAE/C,EACA,IAA4C,eAAe;CAC9D,OAAO,OAAA,OACL,iBAAA,WACE,IAAI,yBAAyB,sBAAsB,MAAM,cAAc,IACvE,KAAA;AACN;AAEA,SAAS,UACP,IACA,IACA,QACiB;CACjB,MAAM,OAAO,oBAAoB,IAAI,OAAO,QAAQ;CACpD,IAAI,SAAS,KAAA,GACX,OAAO,OAAO,IAAI,IAAI,QAAQ,IAAI;CAGpC,MAAM,EAAC,oBAAmB;CAC1B,IAAI,OAAO,kBAAkB,EAAE;CAC/B,IAAI,OAAO;CACX,IAAI,SAAS,QAAQ,OAAO,iBAAiB;EAC3C,OAAO,GACJ,QAAgB;uBACA,wBAAwB;OACxC,EACA,IAAI,eAAe,EAAE;EACxB,OAAO,kBAAkB,EAAE;CAC7B;CAEA,IAAI,SAAS,iBACX,OAAO,OAAO,IAAI,IAAI,QAAQ,KAAK;CAErC,IAAI,OAAO,GAAG;EAMZ,eAAe,IAAI,OAAO,OAAO;EACjC,GAAG,OAAO,6DAA6D,EACrE,0BAA0B;GAAC;GAAM;GAAM,SAAS,aAAa,MAAM;EAAC,EACtE,CAAC;EACD,OAAO;GAAC,QAAQ;GAAa;GAAM;GAAM,cAAc;EAAI;CAC7D;CACA,GAAG,QAAQ,gDAAgD,EACzD,0BAA0B,EAAC,KAAI,EACjC,CAAC;CACD,OAAO;EAAC,QAAQ;EAAQ;EAAM,cAAc;CAAK;AACnD;;;;;;;;AASA,SAAgB,oBACd,IACA,UAC0B;CAC1B,IACE,CAAC,YAAY,IAAA,uBAA2B,KACxC,CAAC,YAAY,IAAA,qBAAyB,GAEtC,OAAO;CAKT,MAAM,UAAU,GACb,QAAgB;qCACgB,sBAAsB;KACtD,EACA,IAAyC;CAC5C,IAAI,YAAY,KAAA,GACd,OAAO;CAET,IAAI,QAAQ,kBAAA,GACV,OAAO;CAMT,IACE,CAAC,YAAY,IAAA,8BAAmC,KAChD,CAAC,YAAY,IAAA,4BAAgC,GAE7C,OAAO;CAET,MAAM,EAAC,OAAO,YAAY,cAAa,kBAAkB,EAAE;CAC3D,IACE,UAAU,SAAS,SACnB,eAAe,SAAS,cACxB,cAAc,SAAS,WAEvB,OAAO;AAGX;AAEA,SAAS,OACP,IACA,IACA,QACA,QACiB;CACjB,MAAM,EAAC,UAAU,iBAAiB,UAAS;CAI3C,GAAG,KAAa;4BACU,wBAAwB;4BACxB,sBAAsB;MAC5C,8BAA8B;MAC9B,gCAAgC;MAChC,8BAA8B;MAC9B,gCAAgC;GACnC;CACD,GAAG,QAAgB;mBACF,sBAAsB;;;;;GAKtC,EAAE,IAAI;EACL,OAAO,SAAS;EAChB,YAAY,SAAS;EACrB,WAAW,SAAS;EACpB,eAAA;EACA,YAAY;EACZ,eAAe;CACjB,CAAC;CACD,oBAAoB,IAAI,MAAM;CAK9B,eAAe,IAAI,OAAO,OAAO;CAEjC,GAAG,OAAO,kCAAkC,EAC1C,0BAA0B;EACxB;EACA,MAAM;EACN,GAAG;EACH,eAAA;EACA,YAAY;EACZ,SAAS,aAAa,MAAM;CAC9B,EACF,CAAC;CACD,OAAO;EACL,QAAQ;EACR,MAAM;EACN;EACA,cAAc;CAChB;AACF;;;;;;AAOA,SAAgB,oBACd,IACA,QACM;CACN,MAAM,cAAc;CACpB,MAAM,eAAe;CACrB,GAAG,QAAQ,0BAA0B,EAAE,IAAI;EACzC,WAAW,OAAO;EAClB,YAAY,gCACV,OAAO,iBACP,SACA,WACF;EACA;EACA,aAAa,gCACX,OAAO,iBACP,UACA,cACA,OAAO,iBACP,IACF;EACA;EACA,aAAa,OAAO;CACtB,CAAC;AACH;;AAGA,SAAgB,kBAAkB,IAA6B;CAC7D,MAAM,OAAO,GACV,QAAgB;;;gBAGL,sBAAsB;KACjC,EACA,IAA+B;CAClC,IAAI,SAAS,KAAA,GACX,MAAM,IAAI,MAAM,uCAAuC;CAEzD,OAAO;AACT;;;;;AAMA,SAAgB,kBAAkB,IAA6B;CAC7D,MAAM,EAAC,SAAQ,GACZ,QAAgB;gDAC2B,wBAAwB;KACnE,EACA,IAA2B;CAC9B,OAAO;AACT;;;;;;AAOA,SAAgB,oBAAoB,IAA+B;CACjE,OAAO,GACJ,QAAgB;;yCAEoB,wBAAwB;;yCAExB,wBAAwB;;KAE5D,EACA,IAAqB;AAC1B;;;;;AAWA,SAAS,aAAa,EAAC,WAA2B;CAChD,OAAO;EACL,eAAe,QAAQ,cAAc;EACrC,aAAa,QAAQ,YAAY;CACnC;AACF;AAEA,SAAS,YAAY,IAAc,OAAwB;CACzD,OACE,GACG,QAAgB;;OAEhB,EACA,IAA6B,KAAK,MAAM,KAAA;AAE/C"}
+{"version":3,"file":"change-log-db.js","names":[],"sources":["../../../../../../zero-cache/src/services/replicator/change-log-db.ts"],"sourcesContent":["/**\n * The change log lives in its own SQLite database, `${replicaFile}-change-log`,\n * rather than in the replica file. It is a catchup cache: everything it holds is\n * either already durable in the replica's litestream backup or re-derivable from\n * the upstream replication slot, so it is deliberately excluded from the backup\n * and is never a source of truth.\n *\n * The change-streamer writes it, from the stream loop that fans changes out to\n * subscribers, and commits it before forwarding each transaction's `commit`\n * message. Its head is therefore always at or above the watermark the stream\n * would resume from, which is what {@link reconcileChangeLog} anchors on.\n *\n * Beside the buffer it holds the log's *cookie jar* — the backfill progress\n * state folded up to the same head. That is `change-log-cookies.ts`; this file\n * owns its tables' lifecycle, because a cookie set is only meaningful paired\n * with the watermark it was folded to, and so must be created, dropped, and —\n * whenever reconciliation moves the head — replaced with the anchor's, all with\n * the buffer rather than beside it.\n *\n * Because it is disposable, it has no migration framework. Any inconsistency —\n * a schema change, a leftover file from a different replica, a gap left by a\n * crash or by running with the writer disabled, a corrupt file — is resolved by\n * {@link reconcileChangeLog} and {@link openChangeLogDBForWriting}, which\n * truncate a bounded suffix or replace and reseed the log at the resume\n * watermark. The worst outcome is a `too-old` for a lagging subscriber; a\n * silently delivered gap is not reachable.\n *\n * Disk sizing: a task that writes the log needs room for the replica *plus* the\n * retained change stream — the log's main file, its wal2 sidecars, and pages a\n * purge has freed but not yet returned to the OS. The change-streamer schedules\n * purges against the same floor as the PG change log, so retention is bounded\n * by the confirmed backup watermark ANDed with the minimum retention window —\n * a function of the backup interval, not a constant: 15–30+ minutes behind an\n * RMv1 sync interval, ~60 seconds once litestream v5 backs up every 15–30 s.\n * A held snapshot reservation pins retention unboundedly for its duration, so\n * peak retained bytes is set by the slowest concurrent restore rather than by\n * the retention setting — size disk and alerts on that. The log is excluded\n * from the litestream backup, so this is local disk only and never S3.\n */\n\nimport {existsSync} from 'node:fs';\nimport type {LogContext} from '@rocicorp/logger';\nimport {Database} from '../../../../zqlite/src/db.ts';\nimport {deleteLiteDB} from '../../db/delete-lite-db.ts';\nimport {\n  isSQLiteCorruption,\n  logSQLiteCorruptionDiagnostics,\n} from '../../db/sqlite-corruption.ts';\nimport {\n  CHANGE_LOG_BACKFILLING_TABLE,\n  CHANGE_LOG_TABLE_METADATA_TABLE,\n  CREATE_CHANGE_LOG_COOKIE_SCHEMA,\n  DROP_CHANGE_LOG_COOKIE_TABLES,\n  replaceCookies,\n  type CookieSet,\n} from './change-log-cookies.ts';\n\n/**\n * Bumped whenever the change-log database's schema changes. Since the file is a\n * cache, a mismatch costs one reseed rather than a migration.\n *\n * v2 re-homed the writer to the change-streamer: the log anchors on the\n * watermark its stream connection resumes from rather than on the replica's\n * state version, and its meta row carries the replica's identity triple plus\n * the seed point.\n *\n * v3 added the cookie tables (see `change-log-cookies.ts`), i.e. the log's\n * second job. The reseed it costs on upgrade buys one retention window of\n * catchup reach on a log nothing reads yet.\n *\n * v4 stores each row's tag and estimated retained bytes alongside its JSON.\n * Readers can now filter without parsing arbitrary row payloads, and\n * reconciliation can bound truncation by bytes as well as rows.\n *\n * `auto_vacuum = INCREMENTAL` arrived within v2, deliberately without a bump:\n * it is a file-header property rather than a schema change, and the reseed a\n * version mismatch triggers cannot enable it (see\n * {@link applyChangeLogPragmas}), so {@link openChangeLogDBForWriting} guards\n * on the pragma itself instead of on this number.\n */\nexport const CHANGE_LOG_DB_SCHEMA_VERSION = 4;\n\n/** https://www.sqlite.org/pragma.html#pragma_auto_vacuum */\nconst AUTO_VACUUM_INCREMENTAL = 2;\n\nexport const CHANGE_LOG_STREAM_TABLE = '_zero.changeLogStream';\nexport const CHANGE_LOG_STREAM_WRITE_TIME_INDEX =\n  '_zero.changeLogStream_writeTimeMs';\n\nconst INTEGER_BYTES = 8;\n\n/**\n * Estimates the retained payload size of a stream row. This deliberately does\n * not claim to measure SQLite b-tree/page overhead; it is stable across the\n * write path, reconciliation, and the startup scan used by observability.\n */\nexport function estimateChangeLogStreamRowBytes(\n  watermark: string,\n  tag: string,\n  change: string,\n  precommit?: string,\n  hasWriteTime = false,\n): number {\n  return (\n    Buffer.byteLength(watermark) +\n    INTEGER_BYTES +\n    Buffer.byteLength(tag) +\n    Buffer.byteLength(change) +\n    (precommit === undefined ? 0 : Buffer.byteLength(precommit)) +\n    (hasWriteTime ? INTEGER_BYTES : 0)\n  );\n}\n\n// The index is partial because only commit rows carry a \"writeTimeMs\", so it\n// holds one entry per transaction rather than one per change. It is what the\n// purger scans to find transactions older than the retention window.\n//\n// Pre-release builds briefly carried this table in the replica; see the test\n// fixture `CREATE_V14_CHANGE_LOG_STREAM` in\n// `change-source/common/replica-schema.ts`. Its old shape must not be kept in\n// sync with this one.\nexport const CREATE_CHANGE_LOG_STREAM_SCHEMA = /*sql*/ `\n  CREATE TABLE \"${CHANGE_LOG_STREAM_TABLE}\" (\n    \"watermark\"      TEXT NOT NULL,\n    \"pos\"            INTEGER NOT NULL,\n    \"tag\"            TEXT NOT NULL,\n    \"estimatedBytes\"  INTEGER NOT NULL,\n    \"change\"          TEXT NOT NULL,\n    \"precommit\"       TEXT,\n    \"writeTimeMs\"     INTEGER,\n    PRIMARY KEY (\"watermark\", \"pos\")\n  );\n\n  CREATE INDEX \"${CHANGE_LOG_STREAM_WRITE_TIME_INDEX}\"\n    ON \"${CHANGE_LOG_STREAM_TABLE}\" (\"writeTimeMs\", \"watermark\")\n    WHERE \"writeTimeMs\" IS NOT NULL;\n`;\n\n/**\n * Inserts the synthetic begin/commit pair for the seed watermark.\n *\n * Both rows are inserted by one statement so a caller outside a larger\n * transaction cannot leave a partial seed.\n */\nconst SEED_CHANGE_LOG_STREAM_SQL = /*sql*/ `\n  INSERT INTO \"${CHANGE_LOG_STREAM_TABLE}\"\n    (\"watermark\", \"pos\", \"tag\", \"estimatedBytes\", \"change\", \"precommit\",\n     \"writeTimeMs\")\n  VALUES\n    (@watermark, 0, 'begin', @beginBytes, @beginChange, NULL, NULL),\n    (@watermark, 1, 'commit', @commitBytes, @commitChange, @watermark,\n     @writeTimeMs)\n  ON CONFLICT (\"watermark\", \"pos\") DO NOTHING\n`;\n\nexport const CHANGE_LOG_META_TABLE = '_zero.changeLogMeta';\n\n// The identity triple (see ChangeLogIdentity) detects a file left behind by a\n// different replica -- most concretely, a leftover log on a reused volume.\n//\n// \"seededAtMs\"    : when the log was seeded, i.e. how far its retention window\n//                   can possibly reach back. Slice 11 uses it as the warm-up\n//                   signal for canary reads.\n// \"seedWatermark\" : where the log was seeded. `min(\"watermark\")` cannot answer\n//                   this once purge has advanced the minimum, and the\n//                   difference is what distinguishes a log that purged past the\n//                   retention floor (an invariant violation) from one that\n//                   never held that history at all (routine at every fork).\n// \"lock\"          : enforces single-row semantics, as in\n//                   \"_zero.replicationConfig\".\nconst CREATE_CHANGE_LOG_META_SCHEMA = /*sql*/ `\n  CREATE TABLE \"${CHANGE_LOG_META_TABLE}\" (\n    \"epoch\"         TEXT,\n    \"generation\"    TEXT NOT NULL,\n    \"replicaID\"     TEXT,\n    \"schemaVersion\" INTEGER NOT NULL,\n    \"seededAtMs\"    INTEGER NOT NULL,\n    \"seedWatermark\" TEXT NOT NULL,\n    \"lock\"          INTEGER PRIMARY KEY DEFAULT 1 CHECK (\"lock\" = 1)\n  );\n`;\n\n/**\n * `${replicaFile}-change-log`, matching the `-serving-copy` convention.\n *\n * The name outlives the writer's move into the change-streamer: the\n * change-streamer derives the path from the replica file it owns, so renaming\n * would save no plumbing and would orphan the old file on every existing\n * volume, where nothing would delete it.\n *\n * Its `-wal` / `-wal2` / `-shm` sidecars are suffixes of *this* name, so they\n * never collide with the replica's own sidecars.\n */\nexport function changeLogFileName(replicaFile: string): string {\n  return `${replicaFile}-change-log`;\n}\n\n/**\n * Removes the change-log database and its `-wal` / `-wal2` / `-shm` sidecars.\n * Safe to call when the file does not exist.\n */\nexport function deleteChangeLogDB(replicaFile: string): void {\n  deleteLiteDB(changeLogFileName(replicaFile));\n}\n\n/**\n * Which replica the log's contents belong to.\n *\n * `generation` is RMv1's `replicaVersion`: the version at which initial sync\n * copied every row. It is shared by every sibling of a forked replica, which is\n * why it cannot be the whole of the identity under RMv2 — `epoch` and\n * `replicaID` are what distinguish two siblings' logs. Both are `null` until\n * RMv2 supplies them, and a `null` matches only another `null`, so a log\n * written before they exist is still recognized as this replica's.\n */\nexport type ChangeLogIdentity = {\n  readonly epoch: string | null;\n  readonly generation: string;\n  readonly replicaID: string | null;\n};\n\n/**\n * Where the stream connection resumes, and everything the log's state at that\n * position consists of.\n *\n * The two fields travel together because a cookie set is only meaningful paired\n * with the watermark it was folded up to (invariant 15). They are read from one\n * store, in one snapshot: `Storer.getStartStreamInitializationParameters()`\n * reads both from Postgres in a single REPEATABLE READ transaction. Pairing one\n * store's cookies with another's watermark would silently drop every backfill\n * that completed in the interval, and those rows are unrecoverable — backfill\n * transactions are synthesized by the change source rather than replayed from\n * the slot.\n */\nexport type ChangeLogResumePoint = {\n  /**\n   * The watermark this stream connection resumes from. The log's own head is\n   * measured against it, and a reseed seeds a synthetic transaction at it.\n   *\n   * Deliberately *not* \"the replica's state version\": after the writer moved to\n   * the change-streamer, the canonical replicator is a subscriber downstream of\n   * the write loop, so its state version is a consequence of this log rather\n   * than a constraint on it.\n   */\n  readonly resumeWatermark: string;\n  /**\n   * The cookie set that belongs to {@link resumeWatermark}. Any reconciliation\n   * that moves the head invalidates the set the log was holding — the cookies\n   * are unversioned point-in-time state, and truncating the stream above `W`\n   * does not roll them back to `W` — so the same transaction installs this one\n   * in its place (invariant 17).\n   *\n   * Postgres supplies it while it remains the store the stream resumes from. At\n   * the C5 flip the log's own head *is* the resume point, phantoms cannot\n   * exist, and both this field and the truncate-above path become dead code.\n   */\n  readonly cookies: CookieSet;\n};\n\n/**\n * What the log is reconciled against. Reconciliation runs once per stream\n * connection, since every reconnect can re-read a different resume point.\n */\nexport type ChangeLogAnchor = ChangeLogResumePoint & {\n  readonly identity: ChangeLogIdentity;\n  /**\n   * The change-streamer's clock, at reconciliation time. Supplied rather than\n   * read inline so that tests control it. Used for `seededAtMs` and for the\n   * seed transaction's `writeTimeMs`, which is what the purger's time floor\n   * measures.\n   */\n  readonly nowMs: number;\n};\n\n/** The meta row, i.e. everything the log records about itself. */\nexport type ChangeLogMeta = ChangeLogIdentity & {\n  readonly schemaVersion: number;\n  readonly seededAtMs: number;\n  readonly seedWatermark: string;\n};\n\n/**\n * Opens the change-log database beside `replicaFile`.\n *\n * A writable handle creates the file if it is absent; a `readonly` handle\n * throws, which is the normal state for a change-streamer whose writer is\n * disabled. Pragmas are the caller's responsibility, since only the writer sets\n * the persistent ones.\n */\nexport function openChangeLogDB(\n  lc: LogContext,\n  replicaFile: string,\n  opts: {readonly: boolean},\n): Database {\n  return new Database(\n    lc.withContext('component', 'change-log-db'),\n    changeLogFileName(replicaFile),\n    {readonly: opts.readonly},\n  );\n}\n\n/**\n * Configures the change-log database, which the change-streamer's writer owns\n * exclusively. These are the settings the `separate-files` mode of\n * `sqlite-change-log-ceiling.bench.ts` measured.\n *\n * `wal2` because the log is a continuous append that catchup reads\n * continuously, which is the case wal2 exists for: it avoids checkpoint\n * starvation without needing an autocheckpoint. `wal_autocheckpoint` therefore\n * keeps its default, unlike the backup replica's 0, which hands checkpointing\n * to litestream — nothing else owns this file.\n *\n * `synchronous = NORMAL` because the commit sits on the forward path, once per\n * upstream transaction, and NORMAL keeps that from costing an fsync. It is not\n * a durability compromise here: in WAL mode NORMAL still writes every commit\n * through to the OS, so it survives a process crash, an OOM kill, or a SIGKILL.\n * It is lost only to kernel panic or power loss, and those destroy the node —\n * the task restarts elsewhere, restores the replica from S3, and has no\n * change-log file at all. Whatever a power loss does take is detected by\n * {@link reconcileChangeLog} and reseeded.\n *\n * `auto_vacuum = INCREMENTAL` so that purge can return freed pages to the OS\n * rather than leaving the file at its high-water mark. **It must be the first\n * statement here.** SQLite honours a `none` -> `incremental` transition only\n * while the file is still empty, and `journal_mode = wal2` materializes page 1;\n * appending the pragma instead of prepending it silently leaves the file at\n * mode 0 forever, since neither `DROP TABLE` nor a reseed makes a file empty\n * again. {@link openChangeLogDBForWriting} verifies the result.\n */\nexport function applyChangeLogPragmas(db: Database): void {\n  db.pragma('auto_vacuum = INCREMENTAL');\n  db.pragma('busy_timeout = 30000');\n  db.pragma('analysis_limit = 1000');\n  db.pragma('journal_mode = wal2');\n  db.pragma('synchronous = NORMAL');\n}\n\nfunction readAutoVacuum(db: Database): number {\n  const [{auto_vacuum: mode}] = db.pragma<{auto_vacuum: number}>('auto_vacuum');\n  return mode;\n}\n\n/**\n * Opens the change-log database for the writer, applies its pragmas, and\n * reconciles it against `anchor`, returning the handle and what reconciliation\n * had to do.\n *\n * Corruption is answered with a rebuild rather than an escalation, which is a\n * deliberate divergence from how the replica's own corruption is handled. A\n * corrupt replica is a lost source of truth, so it ends in a restore or an\n * auto-reset; the change log holds nothing that is not either already in the\n * replica's litestream backup or re-derivable from the upstream slot, so the\n * entire response is to delete the file and seed a new one at the resume\n * watermark. The cost is one retention window of catchup — reconnecting\n * subscribers below the head get `too-old` — which is what every other\n * {@link ReseedReason} costs.\n *\n * Only corruption is rebuilt through. Anything else (a bad path, a permissions\n * error, a full disk) is a problem with the environment rather than with the\n * file's contents, and deleting a database in response would destroy state\n * without fixing it. Those propagate to the caller, which disables the writer\n * and keeps replicating.\n *\n * A file that predates `auto_vacuum = INCREMENTAL` takes the same rebuild, for\n * the same reason and at the same cost: the pragma only takes on an empty file,\n * so a reseed cannot enable it. Unlike corruption, a *second* failure there is\n * tolerated rather than thrown — see {@link ensureIncrementalAutoVacuum}.\n */\n/**\n * Returns an anchor after the database opens.\n *\n * The resolver can inspect the existing file before it selects the anchor. A\n * valid log can use its own head. A new or invalid log uses the replica seed.\n * The rebuild path calls the resolver again for the new file.\n */\nexport type AnchorResolver = (db: Database) => ChangeLogAnchor;\n\nexport function openChangeLogDBForWriting(\n  lc: LogContext,\n  replicaFile: string,\n  anchor: AnchorResolver,\n): {db: Database; result: ReconcileResult; replacedFile: boolean} {\n  const existed = existsSync(changeLogFileName(replicaFile));\n  const opened = openOrRebuildCorrupt(lc, replicaFile, anchor, existed);\n  const {db, result, replacedFile} = ensureIncrementalAutoVacuum(\n    lc,\n    replicaFile,\n    anchor,\n    opened,\n  );\n  return {db, result, replacedFile};\n}\n\nfunction openOrRebuildCorrupt(\n  lc: LogContext,\n  replicaFile: string,\n  anchor: AnchorResolver,\n  boundReconciliation: boolean,\n): OpenedChangeLog {\n  try {\n    return openAndReconcile(lc, replicaFile, anchor, boundReconciliation);\n  } catch (e) {\n    if (e instanceof ChangeLogRebuildRequired) {\n      return rebuildChangeLog(lc, replicaFile, anchor, e);\n    }\n    if (!isSQLiteCorruption(e)) {\n      throw e;\n    }\n    const file = changeLogFileName(replicaFile);\n    logSQLiteCorruptionDiagnostics(lc, 'change-log', file, e);\n    lc.error?.('rebuilding the corrupt SQLite change log', {\n      sqliteChangeLog: {file},\n    });\n    return rebuildChangeLog(lc, replicaFile, anchor);\n  }\n}\n\n/**\n * Rebuilds a log whose `auto_vacuum` mode is not `INCREMENTAL`, which is every\n * log created before the pragma shipped — including every v2 file the writer\n * wrote in the meantime, which is why the guard is on the pragma rather than\n * on the schema version. Deleting the file is the only way to enable it:\n * `DROP TABLE` leaves the header's mode intact, and the in-place alternative —\n * a full `VACUUM` — is an unbounded blocking statement on a file the writer\n * needs.\n *\n * A mode that is still wrong after the rebuild is logged and tolerated, which\n * is the one place this diverges from the corruption path. The two failures are\n * not alike: a file that stays corrupt after a rebuild is an environment\n * problem, but a pragma that stays wrong on a brand-new file can only mean\n * {@link applyChangeLogPragmas}' statement order is wrong — a code bug, present\n * on every task, on every start. Throwing there turns a lost optimization into\n * a crash loop, and rebuilding again turns it into a reseed per start, which is\n * worse than the freelist growth it was trying to avoid. `Database.compact()`\n * already warns and no-ops when the mode is not `INCREMENTAL`, so degrading is\n * the accepted fallback.\n */\nfunction ensureIncrementalAutoVacuum(\n  lc: LogContext,\n  replicaFile: string,\n  anchor: AnchorResolver,\n  opened: OpenedChangeLog,\n): OpenedChangeLog {\n  if (opened.autoVacuum === AUTO_VACUUM_INCREMENTAL) {\n    return opened;\n  }\n  const file = changeLogFileName(replicaFile);\n  lc.info?.('rebuilding the SQLite change log to enable incremental vacuum', {\n    sqliteChangeLog: {file, autoVacuum: opened.autoVacuum},\n  });\n  opened.db.close();\n  const rebuilt = rebuildChangeLog(lc, replicaFile, anchor);\n  if (rebuilt.autoVacuum !== AUTO_VACUUM_INCREMENTAL) {\n    lc.error?.(\n      'SQLite change log does not support incremental vacuum; ' +\n        'it will plateau at its high-water mark',\n      {sqliteChangeLog: {file, autoVacuum: rebuilt.autoVacuum}},\n    );\n  }\n  return rebuilt;\n}\n\n/** The shared \"delete the file and open a new one\" body. */\nfunction rebuildChangeLog(\n  lc: LogContext,\n  replicaFile: string,\n  anchor: AnchorResolver,\n  required?: ChangeLogRebuildRequired | undefined,\n): OpenedChangeLog {\n  if (required) {\n    lc.warn?.(\n      'rebuilding the SQLite change log instead of running an unbounded reconciliation',\n      {\n        sqliteChangeLogRebuild: {\n          reason: required.reason,\n          rows: required.rows,\n          estimatedBytes: required.estimatedBytes,\n        },\n      },\n    );\n  }\n  deleteChangeLogDB(replicaFile);\n  // The file is absent, so the reseed only drops empty/nonexistent tables. A\n  // second failure is the environment's, not the old file's.\n  const opened = openAndReconcile(\n    lc,\n    replicaFile,\n    anchor,\n    false,\n    required?.reason,\n  );\n  return {...opened, replacedFile: true};\n}\n\n/**\n * Replaces an already-closed change-log file after bounded reconciliation\n * declined its work. The caller closes cached readers before calling this so\n * none can continue serving the unlinked inode.\n */\nexport function rebuildChangeLogDBForWriting(\n  lc: LogContext,\n  replicaFile: string,\n  anchor: ChangeLogAnchor,\n  required: ChangeLogRebuildRequired,\n): {db: Database; result: ReconcileResult; replacedFile: true} {\n  const {db, result} = rebuildChangeLog(\n    lc,\n    replicaFile,\n    () => anchor,\n    required,\n  );\n  return {db, result, replacedFile: true};\n}\n\ntype OpenedChangeLog = {\n  db: Database;\n  result: ReconcileResult;\n  replacedFile: boolean;\n  /** The file's persistent `auto_vacuum` mode, read back after the pragmas. */\n  autoVacuum: number;\n};\n\nfunction openAndReconcile(\n  lc: LogContext,\n  replicaFile: string,\n  anchor: AnchorResolver,\n  boundReconciliation: boolean,\n  reseedReason?: ReseedReason | undefined,\n): OpenedChangeLog {\n  const db = openChangeLogDB(lc, replicaFile, {readonly: false});\n  try {\n    applyChangeLogPragmas(db);\n    const autoVacuum = readAutoVacuum(db);\n    return {\n      db,\n      result: reconcileChangeLog(lc, db, anchor(db), {\n        rebuildInsteadOfUnboundedWork: boundReconciliation,\n        reseedReason,\n      }),\n      replacedFile: false,\n      autoVacuum,\n    };\n  } catch (e) {\n    // The caller never sees this handle, so it closes here or leaks — and it\n    // must be closed before the corruption path deletes the file.\n    db.close();\n    throw e;\n  }\n}\n\nexport type ReseedReason =\n  | 'created' // file or table absent\n  | 'schema-mismatch'\n  | 'identity-mismatch'\n  | 'gap' // head does not land on the resume watermark after truncation\n  | 'oversized-truncate'; // preserving the prefix would require too much work\n\n/**\n * Reconciliation runs synchronously on the change-streamer's event loop. A\n * normal phantom is one transaction, so work above either limit is answered by\n * unlinking and reseeding this disposable cache rather than deleting an\n * arbitrarily large suffix in place.\n */\nexport const MAX_RECONCILE_TRUNCATE_ROWS = 10_000;\nexport const MAX_RECONCILE_TRUNCATE_BYTES = 16 * 1024 * 1024;\n\nexport class ChangeLogRebuildRequired extends Error {\n  override readonly name = 'ChangeLogRebuildRequired';\n  readonly reason: ReseedReason;\n  readonly rows?: number | undefined;\n  readonly estimatedBytes?: number | undefined;\n\n  constructor(\n    reason: ReseedReason,\n    rows?: number | undefined,\n    estimatedBytes?: number | undefined,\n  ) {\n    super(`SQLite change log requires a ${reason} rebuild`);\n    this.reason = reason;\n    this.rows = rows;\n    this.estimatedBytes = estimatedBytes;\n  }\n}\n\ntype ReconcileOptions = {\n  /** Throw before an unbounded delete/drop so the file owner can unlink it. */\n  readonly rebuildInsteadOfUnboundedWork?: boolean | undefined;\n  /** Preserve the reason that caused an old file to be unlinked. */\n  readonly reseedReason?: ReseedReason | undefined;\n};\n\n/**\n * `cookiesStale` records that the cookie set the log held did not survive\n * reconciliation. The cookies are unversioned point-in-time state, so any\n * reconciliation that moves the head invalidates them, and the same transaction\n * replaces them with the anchor's — the set that belongs to the resume\n * watermark (see `change-log-cookies.ts`). It is `action !== 'none'` today; it\n * is a field rather than a derivation because the replacement reads as intent\n * at the call site, and because it is what the `cookie_reseed` counter is keyed\n * on.\n */\nexport type ReconcileResult =\n  | {action: 'none'; head: string; cookiesStale: false}\n  | {action: 'truncated'; head: string; rows: number; cookiesStale: true}\n  | {\n      action: 'reseeded';\n      head: string;\n      reason: ReseedReason;\n      cookiesStale: true;\n    };\n\n/**\n * Brings the change log into agreement with the watermark its stream connection\n * resumes from, in one transaction on the change-log database:\n *\n * ```\n * head === resumeWatermark  → keep appending\n * head  >  resumeWatermark  → truncate above resumeWatermark\n * otherwise                 → wipe, seed at resumeWatermark, record the reason\n * ```\n *\n * The log commits before anything that can advance the resume watermark, so a\n * *phantom* — a transaction the log holds whose watermark the resumed stream\n * re-delivers — is the normal state, and truncate-above is the whole of\n * reconciliation rather than a special case. A phantom's rows all carry the\n * transaction's commit watermark, which is strictly greater than the resume\n * watermark, so deleting on that predicate removes phantoms whole and retains\n * every transaction at or below the resume point.\n *\n * It must run per stream connection, not once per process: the stream loop\n * re-reads its resume watermark on every reconnect, and the writer inserts with\n * a plain `INSERT` against `PRIMARY KEY (\"watermark\",\"pos\")`, so an\n * un-truncated overlap is a constraint violation on the first re-delivered\n * transaction.\n *\n * Anything truncation cannot resolve — the file was deleted, the writer was\n * disabled for a while, the replica was restored, power was lost with\n * `synchronous=NORMAL` — surfaces as a head that does not land on the resume\n * watermark, and is resolved by wiping and reseeding there.\n *\n * Whichever of the two moves the head also replaces the cookie set with the one\n * the anchor carries, in the same transaction: the head and the cookies are one\n * position, and nothing may observe them at two.\n */\nexport function reconcileChangeLog(\n  lc: LogContext,\n  db: Database,\n  anchor: ChangeLogAnchor,\n  opts: ReconcileOptions = {},\n): ReconcileResult {\n  db.exec('BEGIN IMMEDIATE');\n  try {\n    if (opts.rebuildInsteadOfUnboundedWork) {\n      const required = rebuildRequired(db, anchor);\n      if (required) {\n        throw required;\n      }\n    }\n    const result = opts.reseedReason\n      ? reseed(lc, db, anchor, opts.reseedReason)\n      : reconcile(lc, db, anchor);\n    db.exec('COMMIT');\n    return result;\n  } catch (e) {\n    if (db.inTransaction) {\n      db.exec('ROLLBACK');\n    }\n    throw e;\n  }\n}\n\n/**\n * Decides whether reconciliation can be performed within its synchronous work\n * budget. Every query is either an index seek or a scan capped at one row past\n * the delete limit. No state changes before the decision is complete.\n */\nfunction rebuildRequired(\n  db: Database,\n  anchor: ChangeLogAnchor,\n): ChangeLogRebuildRequired | undefined {\n  const wipe = changeLogWipeReason(db, anchor.identity);\n  if (wipe !== undefined) {\n    return new ChangeLogRebuildRequired(wipe);\n  }\n\n  const head = readChangeLogHead(db);\n  const {resumeWatermark} = anchor;\n  if (head === null || head < resumeWatermark) {\n    return new ChangeLogRebuildRequired('gap');\n  }\n  if (head === resumeWatermark) {\n    return undefined;\n  }\n\n  const boundary = db\n    .prepare(/*sql*/ `\n      SELECT 1 FROM \"${CHANGE_LOG_STREAM_TABLE}\"\n        WHERE \"watermark\" = ?\n        LIMIT 1\n    `)\n    .get<{1: number} | undefined>(resumeWatermark);\n  if (boundary === undefined) {\n    return new ChangeLogRebuildRequired('gap');\n  }\n\n  const {rows, estimatedBytes} = db\n    .prepare(/*sql*/ `\n      SELECT count(*) AS \"rows\",\n             coalesce(sum(\"estimatedBytes\"), 0) AS \"estimatedBytes\"\n        FROM (\n          SELECT \"estimatedBytes\" FROM \"${CHANGE_LOG_STREAM_TABLE}\"\n            WHERE \"watermark\" > ?\n            LIMIT ${MAX_RECONCILE_TRUNCATE_ROWS + 1}\n        )\n    `)\n    .get<{rows: number; estimatedBytes: number}>(resumeWatermark);\n  return rows > MAX_RECONCILE_TRUNCATE_ROWS ||\n    estimatedBytes > MAX_RECONCILE_TRUNCATE_BYTES\n    ? new ChangeLogRebuildRequired('oversized-truncate', rows, estimatedBytes)\n    : undefined;\n}\n\nfunction reconcile(\n  lc: LogContext,\n  db: Database,\n  anchor: ChangeLogAnchor,\n): ReconcileResult {\n  const wipe = changeLogWipeReason(db, anchor.identity);\n  if (wipe !== undefined) {\n    return reseed(lc, db, anchor, wipe);\n  }\n\n  const {resumeWatermark} = anchor;\n  let head = readChangeLogHead(db);\n  let rows = 0;\n  if (head !== null && head > resumeWatermark) {\n    rows = db\n      .prepare(/*sql*/ `\n        DELETE FROM \"${CHANGE_LOG_STREAM_TABLE}\" WHERE \"watermark\" > ?\n      `)\n      .run(resumeWatermark).changes;\n    head = readChangeLogHead(db);\n  }\n\n  if (head !== resumeWatermark) {\n    return reseed(lc, db, anchor, 'gap');\n  }\n  if (rows > 0) {\n    // The truncated transactions can have carried `create-table`,\n    // `add-column`, and `backfill-completed`, none of which the truncate rolls\n    // back, so the cookie set no longer belongs to the head. The anchor's set\n    // does, and it lands in this same transaction: invariant 17 holds at every\n    // point another connection could observe the log.\n    replaceCookies(db, anchor.cookies);\n    lc.info?.('truncated phantom transactions from the SQLite change log', {\n      sqliteChangeLogReconcile: {head, rows, cookies: cookieCounts(anchor)},\n    });\n    return {action: 'truncated', head, rows, cookiesStale: true};\n  }\n  lc.debug?.('SQLite change log is at the resume watermark', {\n    sqliteChangeLogReconcile: {head},\n  });\n  return {action: 'none', head, cookiesStale: false};\n}\n\n/**\n * Returns the reason that the log must be recreated. Returns `undefined` when\n * the writer can continue to use the log.\n *\n * This function takes only the expected identity because callers use the result\n * to select the anchor.\n */\nexport function changeLogWipeReason(\n  db: Database,\n  identity: ChangeLogIdentity,\n): ReseedReason | undefined {\n  if (\n    !tableExists(db, CHANGE_LOG_STREAM_TABLE) ||\n    !tableExists(db, CHANGE_LOG_META_TABLE)\n  ) {\n    return 'created';\n  }\n  // The schema version is read on its own because it is the one column every\n  // version of this table has had. Reading the rest of a v1 row would fail on\n  // its missing columns instead of reporting the mismatch that explains it.\n  const version = db\n    .prepare(/*sql*/ `\n      SELECT \"schemaVersion\" FROM \"${CHANGE_LOG_META_TABLE}\"\n    `)\n    .get<{schemaVersion: number} | undefined>();\n  if (version === undefined) {\n    return 'created';\n  }\n  if (version.schemaVersion !== CHANGE_LOG_DB_SCHEMA_VERSION) {\n    return 'schema-mismatch';\n  }\n  // Checked *after* the version, so that every pre-v4 file — which is every\n  // file in the fleet at the upgrade — reports the `schema-mismatch` that\n  // explains it rather than the `created` its absent cookie tables would\n  // otherwise look like.\n  if (\n    !tableExists(db, CHANGE_LOG_TABLE_METADATA_TABLE) ||\n    !tableExists(db, CHANGE_LOG_BACKFILLING_TABLE)\n  ) {\n    return 'created';\n  }\n  const {epoch, generation, replicaID} = readChangeLogMeta(db);\n  if (\n    epoch !== identity.epoch ||\n    generation !== identity.generation ||\n    replicaID !== identity.replicaID\n  ) {\n    return 'identity-mismatch';\n  }\n  return undefined;\n}\n\nfunction reseed(\n  lc: LogContext,\n  db: Database,\n  anchor: ChangeLogAnchor,\n  reason: ReseedReason,\n): ReconcileResult {\n  const {identity, resumeWatermark, nowMs} = anchor;\n  // Dropping the table drops its partial index with it. The cookie tables go\n  // with the buffer: a cookie set without the transactions it was folded from\n  // is not a smaller cookie set, it is a wrong one.\n  db.exec(/*sql*/ `\n    DROP TABLE IF EXISTS \"${CHANGE_LOG_STREAM_TABLE}\";\n    DROP TABLE IF EXISTS \"${CHANGE_LOG_META_TABLE}\";\n    ${DROP_CHANGE_LOG_COOKIE_TABLES}\n    ${CREATE_CHANGE_LOG_STREAM_SCHEMA}\n    ${CREATE_CHANGE_LOG_META_SCHEMA}\n    ${CREATE_CHANGE_LOG_COOKIE_SCHEMA}\n  `);\n  db.prepare(/*sql*/ `\n    INSERT INTO \"${CHANGE_LOG_META_TABLE}\"\n      (\"epoch\", \"generation\", \"replicaID\", \"schemaVersion\", \"seededAtMs\",\n       \"seedWatermark\")\n      VALUES (@epoch, @generation, @replicaID, @schemaVersion, @seededAtMs,\n              @seedWatermark)\n  `).run({\n    epoch: identity.epoch,\n    generation: identity.generation,\n    replicaID: identity.replicaID,\n    schemaVersion: CHANGE_LOG_DB_SCHEMA_VERSION,\n    seededAtMs: nowMs,\n    seedWatermark: resumeWatermark,\n  });\n  seedChangeLogStream(db, anchor);\n  // Into tables this statement just created, so the wholesale replacement is\n  // all insert. It is still the same call the truncate path makes: a reseed is\n  // the case where the log's cookie set was not merely moved but discarded, and\n  // the anchor's is equally what belongs at the head either way.\n  replaceCookies(db, anchor.cookies);\n\n  lc.info?.('reseeded the SQLite change log', {\n    sqliteChangeLogReconcile: {\n      reason,\n      head: resumeWatermark,\n      ...identity,\n      schemaVersion: CHANGE_LOG_DB_SCHEMA_VERSION,\n      seededAtMs: nowMs,\n      cookies: cookieCounts(anchor),\n    },\n  });\n  return {\n    action: 'reseeded',\n    head: resumeWatermark,\n    reason,\n    cookiesStale: true,\n  };\n}\n\n/**\n * Seeds a valid synthetic transaction at the anchor's resume watermark, making\n * an otherwise empty log serviceable as a catchup boundary for a subscriber\n * that is exactly at that watermark.\n */\nfunction seedChangeLogStream(db: Database, anchor: ChangeLogAnchor): void {\n  const beginChange = '{\"tag\":\"begin\"}';\n  const commitChange = '{\"tag\":\"commit\"}';\n  db.prepare(SEED_CHANGE_LOG_STREAM_SQL).run({\n    watermark: anchor.resumeWatermark,\n    beginBytes: estimateChangeLogStreamRowBytes(\n      anchor.resumeWatermark,\n      'begin',\n      beginChange,\n    ),\n    beginChange,\n    commitBytes: estimateChangeLogStreamRowBytes(\n      anchor.resumeWatermark,\n      'commit',\n      commitChange,\n      anchor.resumeWatermark,\n      true,\n    ),\n    commitChange,\n    writeTimeMs: anchor.nowMs,\n  });\n}\n\n/** Reads the whole meta row. Throws if the log has not been reconciled. */\nexport function readChangeLogMeta(db: Database): ChangeLogMeta {\n  const meta = db\n    .prepare(/*sql*/ `\n      SELECT \"epoch\", \"generation\", \"replicaID\", \"schemaVersion\",\n             \"seededAtMs\", \"seedWatermark\"\n        FROM \"${CHANGE_LOG_META_TABLE}\"\n    `)\n    .get<ChangeLogMeta | undefined>();\n  if (meta === undefined) {\n    throw new Error('the SQLite change log has no meta row');\n  }\n  return meta;\n}\n\n/**\n * `max()` on the primary key's leading column, i.e. an index seek. Null when\n * the log is empty.\n */\nexport function readChangeLogHead(db: Database): string | null {\n  const {head} = db\n    .prepare(/*sql*/ `\n      SELECT max(\"watermark\") AS \"head\" FROM \"${CHANGE_LOG_STREAM_TABLE}\"\n    `)\n    .get<{head: string | null}>();\n  return head;\n}\n\n/**\n * The covered watermark range. Both scalar subqueries seek the watermark\n * index, so unlike a `count()` this does not scan the log. Both bounds are\n * null when it is empty.\n */\nexport function readChangeLogBounds(db: Database): ChangeLogBounds {\n  return db\n    .prepare(/*sql*/ `\n      SELECT\n        (SELECT min(\"watermark\") FROM \"${CHANGE_LOG_STREAM_TABLE}\")\n          AS \"minWatermark\",\n        (SELECT max(\"watermark\") FROM \"${CHANGE_LOG_STREAM_TABLE}\")\n          AS \"headWatermark\"\n    `)\n    .get<ChangeLogBounds>();\n}\n\nexport type ChangeLogBounds = {\n  readonly minWatermark: string | null;\n  readonly headWatermark: string | null;\n};\n\n/**\n * What was installed, for the reconcile log line. Normally `{0, 0}`: a nonzero\n * `backfilling` means the resumed stream is being handed backfills to re-request.\n */\nfunction cookieCounts({cookies}: ChangeLogAnchor) {\n  return {\n    tableMetadata: cookies.tableMetadata.length,\n    backfilling: cookies.backfilling.length,\n  };\n}\n\nfunction tableExists(db: Database, table: string): boolean {\n  return (\n    db\n      .prepare(/*sql*/ `\n        SELECT 1 FROM \"sqlite_master\" WHERE \"type\" = 'table' AND \"name\" = ?\n      `)\n      .get<{1: number} | undefined>(table) !== undefined\n  );\n}\n"],"mappings":";;;;;;AAmFA,IAAM,0BAA0B;AAEhC,IAAa,0BAA0B;AACvC,IAAa,qCACX;AAEF,IAAM,gBAAgB;;;;;;AAOtB,SAAgB,gCACd,WACA,KACA,QACA,WACA,eAAe,OACP;CACR,OACE,OAAO,WAAW,SAAS,IAC3B,gBACA,OAAO,WAAW,GAAG,IACrB,OAAO,WAAW,MAAM,KACvB,cAAc,KAAA,IAAY,IAAI,OAAO,WAAW,SAAS,MACzD,eAAe,gBAAgB;AAEpC;AAUA,IAAa,kCAA0C;kBACrC,wBAAwB;;;;;;;;;;;kBAWxB,mCAAmC;UAC3C,wBAAwB;;;;;;;;;AAUlC,IAAM,6BAAqC;iBAC1B,wBAAwB;;;;;;;;;AAUzC,IAAa,wBAAwB;AAerC,IAAM,gCAAwC;kBAC5B,sBAAsB;;;;;;;;;;;;;;;;;;;;;AAsBxC,SAAgB,kBAAkB,aAA6B;CAC7D,OAAO,GAAG,YAAY;AACxB;;;;;AAMA,SAAgB,kBAAkB,aAA2B;CAC3D,aAAa,kBAAkB,WAAW,CAAC;AAC7C;;;;;;;;;AAsFA,SAAgB,gBACd,IACA,aACA,MACU;CACV,OAAO,IAAI,SACT,GAAG,YAAY,aAAa,eAAe,GAC3C,kBAAkB,WAAW,GAC7B,EAAC,UAAU,KAAK,SAAQ,CAC1B;AACF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8BA,SAAgB,sBAAsB,IAAoB;CACxD,GAAG,OAAO,2BAA2B;CACrC,GAAG,OAAO,sBAAsB;CAChC,GAAG,OAAO,uBAAuB;CACjC,GAAG,OAAO,qBAAqB;CAC/B,GAAG,OAAO,sBAAsB;AAClC;AAEA,SAAS,eAAe,IAAsB;CAC5C,MAAM,CAAC,EAAC,aAAa,UAAS,GAAG,OAA8B,aAAa;CAC5E,OAAO;AACT;AAqCA,SAAgB,0BACd,IACA,aACA,QACgE;CAGhE,MAAM,EAAC,IAAI,QAAQ,iBAAgB,4BACjC,IACA,aACA,QAJa,qBAAqB,IAAI,aAAa,QADrC,WAAW,kBAAkB,WAAW,CACK,CAK3D,CACF;CACA,OAAO;EAAC;EAAI;EAAQ;CAAY;AAClC;AAEA,SAAS,qBACP,IACA,aACA,QACA,qBACiB;CACjB,IAAI;EACF,OAAO,iBAAiB,IAAI,aAAa,QAAQ,mBAAmB;CACtE,SAAS,GAAG;EACV,IAAI,aAAa,0BACf,OAAO,iBAAiB,IAAI,aAAa,QAAQ,CAAC;EAEpD,IAAI,CAAC,mBAAmB,CAAC,GACvB,MAAM;EAER,MAAM,OAAO,kBAAkB,WAAW;EAC1C,+BAA+B,IAAI,cAAc,MAAM,CAAC;EACxD,GAAG,QAAQ,4CAA4C,EACrD,iBAAiB,EAAC,KAAI,EACxB,CAAC;EACD,OAAO,iBAAiB,IAAI,aAAa,MAAM;CACjD;AACF;;;;;;;;;;;;;;;;;;;;;AAsBA,SAAS,4BACP,IACA,aACA,QACA,QACiB;CACjB,IAAI,OAAO,eAAe,yBACxB,OAAO;CAET,MAAM,OAAO,kBAAkB,WAAW;CAC1C,GAAG,OAAO,iEAAiE,EACzE,iBAAiB;EAAC;EAAM,YAAY,OAAO;CAAU,EACvD,CAAC;CACD,OAAO,GAAG,MAAM;CAChB,MAAM,UAAU,iBAAiB,IAAI,aAAa,MAAM;CACxD,IAAI,QAAQ,eAAe,yBACzB,GAAG,QACD,iGAEA,EAAC,iBAAiB;EAAC;EAAM,YAAY,QAAQ;CAAU,EAAC,CAC1D;CAEF,OAAO;AACT;;AAGA,SAAS,iBACP,IACA,aACA,QACA,UACiB;CACjB,IAAI,UACF,GAAG,OACD,mFACA,EACE,wBAAwB;EACtB,QAAQ,SAAS;EACjB,MAAM,SAAS;EACf,gBAAgB,SAAS;CAC3B,EACF,CACF;CAEF,kBAAkB,WAAW;CAU7B,OAAO;EAAC,GAPO,iBACb,IACA,aACA,QACA,OACA,UAAU,MAED;EAAQ,cAAc;CAAI;AACvC;;;;;;AAOA,SAAgB,6BACd,IACA,aACA,QACA,UAC6D;CAC7D,MAAM,EAAC,IAAI,WAAU,iBACnB,IACA,mBACM,QACN,QACF;CACA,OAAO;EAAC;EAAI;EAAQ,cAAc;CAAI;AACxC;AAUA,SAAS,iBACP,IACA,aACA,QACA,qBACA,cACiB;CACjB,MAAM,KAAK,gBAAgB,IAAI,aAAa,EAAC,UAAU,MAAK,CAAC;CAC7D,IAAI;EACF,sBAAsB,EAAE;EACxB,MAAM,aAAa,eAAe,EAAE;EACpC,OAAO;GACL;GACA,QAAQ,mBAAmB,IAAI,IAAI,OAAO,EAAE,GAAG;IAC7C,+BAA+B;IAC/B;GACF,CAAC;GACD,cAAc;GACd;EACF;CACF,SAAS,GAAG;EAGV,GAAG,MAAM;EACT,MAAM;CACR;AACF;;;;;;;AAeA,IAAa,8BAA8B;AAC3C,IAAa,+BAA+B;AAE5C,IAAa,2BAAb,cAA8C,MAAM;CAClD,OAAyB;CACzB;CACA;CACA;CAEA,YACE,QACA,MACA,gBACA;EACA,MAAM,gCAAgC,OAAO,SAAS;EACtD,KAAK,SAAS;EACd,KAAK,OAAO;EACZ,KAAK,iBAAiB;CACxB;AACF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8DA,SAAgB,mBACd,IACA,IACA,QACA,OAAyB,CAAC,GACT;CACjB,GAAG,KAAK,iBAAiB;CACzB,IAAI;EACF,IAAI,KAAK,+BAA+B;GACtC,MAAM,WAAW,gBAAgB,IAAI,MAAM;GAC3C,IAAI,UACF,MAAM;EAEV;EACA,MAAM,SAAS,KAAK,eAChB,OAAO,IAAI,IAAI,QAAQ,KAAK,YAAY,IACxC,UAAU,IAAI,IAAI,MAAM;EAC5B,GAAG,KAAK,QAAQ;EAChB,OAAO;CACT,SAAS,GAAG;EACV,IAAI,GAAG,eACL,GAAG,KAAK,UAAU;EAEpB,MAAM;CACR;AACF;;;;;;AAOA,SAAS,gBACP,IACA,QACsC;CACtC,MAAM,OAAO,oBAAoB,IAAI,OAAO,QAAQ;CACpD,IAAI,SAAS,KAAA,GACX,OAAO,IAAI,yBAAyB,IAAI;CAG1C,MAAM,OAAO,kBAAkB,EAAE;CACjC,MAAM,EAAC,oBAAmB;CAC1B,IAAI,SAAS,QAAQ,OAAO,iBAC1B,OAAO,IAAI,yBAAyB,KAAK;CAE3C,IAAI,SAAS,iBACX;CAUF,IAPiB,GACd,QAAgB;;;;KAIhB,CAAC,CACD,IAA6B,eAC5B,MAAa,KAAA,GACf,OAAO,IAAI,yBAAyB,KAAK;CAG3C,MAAM,EAAC,MAAM,mBAAkB,GAC5B,QAAgB;;;;0CAIqB,wBAAwB;;;;KAI7D,CAAC,CACD,IAA4C,eAAe;CAC9D,OAAO,OAAA,OACL,iBAAA,WACE,IAAI,yBAAyB,sBAAsB,MAAM,cAAc,IACvE,KAAA;AACN;AAEA,SAAS,UACP,IACA,IACA,QACiB;CACjB,MAAM,OAAO,oBAAoB,IAAI,OAAO,QAAQ;CACpD,IAAI,SAAS,KAAA,GACX,OAAO,OAAO,IAAI,IAAI,QAAQ,IAAI;CAGpC,MAAM,EAAC,oBAAmB;CAC1B,IAAI,OAAO,kBAAkB,EAAE;CAC/B,IAAI,OAAO;CACX,IAAI,SAAS,QAAQ,OAAO,iBAAiB;EAC3C,OAAO,GACJ,QAAgB;uBACA,wBAAwB;OACxC,CAAC,CACD,IAAI,eAAe,CAAC,CAAC;EACxB,OAAO,kBAAkB,EAAE;CAC7B;CAEA,IAAI,SAAS,iBACX,OAAO,OAAO,IAAI,IAAI,QAAQ,KAAK;CAErC,IAAI,OAAO,GAAG;EAMZ,eAAe,IAAI,OAAO,OAAO;EACjC,GAAG,OAAO,6DAA6D,EACrE,0BAA0B;GAAC;GAAM;GAAM,SAAS,aAAa,MAAM;EAAC,EACtE,CAAC;EACD,OAAO;GAAC,QAAQ;GAAa;GAAM;GAAM,cAAc;EAAI;CAC7D;CACA,GAAG,QAAQ,gDAAgD,EACzD,0BAA0B,EAAC,KAAI,EACjC,CAAC;CACD,OAAO;EAAC,QAAQ;EAAQ;EAAM,cAAc;CAAK;AACnD;;;;;;;;AASA,SAAgB,oBACd,IACA,UAC0B;CAC1B,IACE,CAAC,YAAY,IAAA,uBAA2B,KACxC,CAAC,YAAY,IAAA,qBAAyB,GAEtC,OAAO;CAKT,MAAM,UAAU,GACb,QAAgB;qCACgB,sBAAsB;KACtD,CAAC,CACD,IAAyC;CAC5C,IAAI,YAAY,KAAA,GACd,OAAO;CAET,IAAI,QAAQ,kBAAA,GACV,OAAO;CAMT,IACE,CAAC,YAAY,IAAA,8BAAmC,KAChD,CAAC,YAAY,IAAA,4BAAgC,GAE7C,OAAO;CAET,MAAM,EAAC,OAAO,YAAY,cAAa,kBAAkB,EAAE;CAC3D,IACE,UAAU,SAAS,SACnB,eAAe,SAAS,cACxB,cAAc,SAAS,WAEvB,OAAO;AAGX;AAEA,SAAS,OACP,IACA,IACA,QACA,QACiB;CACjB,MAAM,EAAC,UAAU,iBAAiB,UAAS;CAI3C,GAAG,KAAa;4BACU,wBAAwB;4BACxB,sBAAsB;MAC5C,8BAA8B;MAC9B,gCAAgC;MAChC,8BAA8B;MAC9B,gCAAgC;GACnC;CACD,GAAG,QAAgB;mBACF,sBAAsB;;;;;GAKtC,CAAC,CAAC,IAAI;EACL,OAAO,SAAS;EAChB,YAAY,SAAS;EACrB,WAAW,SAAS;EACpB,eAAA;EACA,YAAY;EACZ,eAAe;CACjB,CAAC;CACD,oBAAoB,IAAI,MAAM;CAK9B,eAAe,IAAI,OAAO,OAAO;CAEjC,GAAG,OAAO,kCAAkC,EAC1C,0BAA0B;EACxB;EACA,MAAM;EACN,GAAG;EACH,eAAA;EACA,YAAY;EACZ,SAAS,aAAa,MAAM;CAC9B,EACF,CAAC;CACD,OAAO;EACL,QAAQ;EACR,MAAM;EACN;EACA,cAAc;CAChB;AACF;;;;;;AAOA,SAAS,oBAAoB,IAAc,QAA+B;CACxE,MAAM,cAAc;CACpB,MAAM,eAAe;CACrB,GAAG,QAAQ,0BAA0B,CAAC,CAAC,IAAI;EACzC,WAAW,OAAO;EAClB,YAAY,gCACV,OAAO,iBACP,SACA,WACF;EACA;EACA,aAAa,gCACX,OAAO,iBACP,UACA,cACA,OAAO,iBACP,IACF;EACA;EACA,aAAa,OAAO;CACtB,CAAC;AACH;;AAGA,SAAgB,kBAAkB,IAA6B;CAC7D,MAAM,OAAO,GACV,QAAgB;;;gBAGL,sBAAsB;KACjC,CAAC,CACD,IAA+B;CAClC,IAAI,SAAS,KAAA,GACX,MAAM,IAAI,MAAM,uCAAuC;CAEzD,OAAO;AACT;;;;;AAMA,SAAgB,kBAAkB,IAA6B;CAC7D,MAAM,EAAC,SAAQ,GACZ,QAAgB;gDAC2B,wBAAwB;KACnE,CAAC,CACD,IAA2B;CAC9B,OAAO;AACT;;;;;;AAOA,SAAgB,oBAAoB,IAA+B;CACjE,OAAO,GACJ,QAAgB;;yCAEoB,wBAAwB;;yCAExB,wBAAwB;;KAE5D,CAAC,CACD,IAAqB;AAC1B;;;;;AAWA,SAAS,aAAa,EAAC,WAA2B;CAChD,OAAO;EACL,eAAe,QAAQ,cAAc;EACrC,aAAa,QAAQ,YAAY;CACnC;AACF;AAEA,SAAS,YAAY,IAAc,OAAwB;CACzD,OACE,GACG,QAAgB;;OAEhB,CAAC,CACD,IAA6B,KAAK,MAAM,KAAA;AAE/C"}

package/out/zero-cache/src/services/replicator/change-log-stream-writer.js.map

@@ -1 +1 @@
-{"version":3,"file":"change-log-stream-writer.js","names":["#db","#insertChange","#insertCommit","#cookies","#watermark","#pos","#hasher","#estimatedBytes","#requireWatermark","#cookieMutations","#reset"],"sources":["../../../../../../zero-cache/src/services/replicator/change-log-stream-writer.ts"],"sourcesContent":["import type {Statement} from '../../../../zqlite/src/db.ts';\nimport type {StatementRunner} from '../../db/statements.ts';\nimport {\n  isSchemaChange,\n  type DataOrSchemaChange,\n} from '../change-source/protocol/current/data.ts';\nimport {extractChangeSubstring} from '../change-streamer/change-log-codec.ts';\nimport {ChangeLogTransactionHasher} from '../change-streamer/change-log-transaction-hash.ts';\nimport {ChangeLogCookieWriter, type CookieOpTag} from './change-log-cookies.ts';\nimport {\n  CHANGE_LOG_STREAM_TABLE,\n  estimateChangeLogStreamRowBytes,\n} from './change-log-db.ts';\n\nexport type ChangeLogStreamTransactionStats = {\n  readonly rows: number;\n  readonly estimatedBytes: number;\n  /** Present only for transactions selected for shadow-write validation. */\n  readonly hash?: string | undefined;\n  /**\n   * The cookie mutations this transaction's schema changes folded in, in stream\n   * order. Empty for the overwhelming majority of transactions.\n   */\n  readonly cookieMutations: readonly CookieOpTag[];\n};\n\nexport class ChangeLogStreamInvariantError extends Error {\n  override readonly name = 'ChangeLogStreamInvariantError';\n}\n\nfunction assertInvariant(\n  condition: unknown,\n  message: string,\n): asserts condition {\n  if (!condition) {\n    throw new ChangeLogStreamInvariantError(message);\n  }\n}\n\n/**\n * Appends the canonical downstream stream to the change-log database, which is\n * a separate file from the replica, and folds its schema changes into the log's\n * cookie jar (`change-log-cookies.ts`) as it goes.\n *\n * This class owns the change log's transaction, and its transaction alone. It is\n * driven from the change-streamer's stream loop, which commits it before\n * forwarding a transaction's `commit` message; see `SQLiteChangeLogWriter` in\n * `change-streamer/sqlite-change-log-writer.ts` for the ordering that makes a\n * hole unreachable, and for the fail-soft policy that wraps every call here.\n *\n * Because the cookies are written in that same transaction, they are atomic with\n * the head and {@link rollback} discards them with the rows they were folded\n * from. Neither needs any handling of its own.\n */\nexport class ChangeLogStreamWriter {\n  readonly #db: StatementRunner;\n  readonly #insertChange: Statement;\n  readonly #insertCommit: Statement;\n  readonly #cookies: ChangeLogCookieWriter;\n\n  #watermark: string | undefined;\n  #pos = 0;\n  #estimatedBytes = 0;\n  #hasher: ChangeLogTransactionHasher | undefined;\n  #cookieMutations: CookieOpTag[] = [];\n\n  constructor(db: StatementRunner) {\n    this.#db = db;\n    this.#insertChange = db.db.prepare(/*sql*/ `\n      INSERT INTO \"${CHANGE_LOG_STREAM_TABLE}\"\n        (\"watermark\", \"pos\", \"tag\", \"estimatedBytes\", \"change\")\n        VALUES (?, ?, ?, ?, ?)\n    `);\n    this.#insertCommit = db.db.prepare(/*sql*/ `\n      INSERT INTO \"${CHANGE_LOG_STREAM_TABLE}\"\n        (\"watermark\", \"pos\", \"tag\", \"estimatedBytes\", \"change\", \"precommit\",\n         \"writeTimeMs\")\n        VALUES (?, ?, 'commit', ?, ?, ?, ?)\n    `);\n    this.#cookies = new ChangeLogCookieWriter(db.db);\n  }\n\n  begin(\n    watermark: string,\n    json: string,\n    storedChange = extractChangeSubstring(json, 'begin'),\n    hash = true,\n  ): void {\n    assertInvariant(\n      this.#watermark === undefined,\n      `change-log stream transaction already open at ${this.#watermark}`,\n    );\n    // This process is the sole writer of the change-log database, so the write\n    // lock is taken up front rather than risking a failed upgrade from a\n    // deferred transaction partway through the append.\n    this.#db.beginImmediate();\n    this.#watermark = watermark;\n    this.#pos = 0;\n    const change = storedChange;\n    const estimatedBytes = estimateChangeLogStreamRowBytes(\n      watermark,\n      'begin',\n      change,\n    );\n    this.#insertChange.run(\n      watermark,\n      this.#pos,\n      'begin',\n      estimatedBytes,\n      change,\n    );\n    if (hash) {\n      this.#hasher = new ChangeLogTransactionHasher();\n      this.#hasher.add({\n        watermark,\n        pos: this.#pos,\n        tag: 'begin',\n        change,\n        precommit: null,\n      });\n    }\n    this.#estimatedBytes = estimatedBytes;\n  }\n\n  /**\n   * Appends one data or schema change. The parsed message is taken rather than\n   * just its tag because a schema change also mutates the cookie jar, and the\n   * caller already holds it — so the fold costs no re-parse.\n   *\n   * The cookie statements run here, i.e. inside this transaction and in stream\n   * order relative to the rows they were folded from. The Postgres change log\n   * has to flush its buffered batch to get the same ordering\n   * (`Storer.#processQueue()`); SQLite gets it from statement order.\n   */\n  append(\n    json: string,\n    change: DataOrSchemaChange,\n    storedChange = extractChangeSubstring(json, change.tag),\n  ): void {\n    const watermark = this.#requireWatermark();\n    const {tag} = change;\n    const stored = storedChange;\n    const estimatedBytes = estimateChangeLogStreamRowBytes(\n      watermark,\n      tag,\n      stored,\n    );\n    this.#insertChange.run(watermark, ++this.#pos, tag, estimatedBytes, stored);\n    this.#hasher?.add({\n      watermark,\n      pos: this.#pos,\n      tag,\n      change: stored,\n      precommit: null,\n    });\n    this.#estimatedBytes += estimatedBytes;\n\n    if (isSchemaChange(change)) {\n      for (const op of this.#cookies.apply(change)) {\n        this.#cookieMutations.push(op.op);\n      }\n    }\n  }\n\n  commit(\n    watermark: string,\n    json: string,\n    writeTimeMs: number,\n    storedChange = extractChangeSubstring(json, 'commit'),\n  ): ChangeLogStreamTransactionStats {\n    const precommit = this.#requireWatermark();\n    assertInvariant(\n      watermark === precommit,\n      `change-log stream commit ${watermark} does not match begin ${precommit}`,\n    );\n    const change = storedChange;\n    const estimatedBytes = estimateChangeLogStreamRowBytes(\n      watermark,\n      'commit',\n      change,\n      precommit,\n      true,\n    );\n    this.#insertCommit.run(\n      watermark,\n      ++this.#pos,\n      estimatedBytes,\n      change,\n      precommit,\n      writeTimeMs,\n    );\n    const hasher = this.#hasher;\n    hasher?.add({\n      watermark,\n      pos: this.#pos,\n      tag: 'commit',\n      change,\n      precommit,\n    });\n    const stats = {\n      rows: this.#pos + 1,\n      estimatedBytes: this.#estimatedBytes + estimatedBytes,\n      hash: hasher?.digest(),\n      cookieMutations: this.#cookieMutations,\n    };\n    // The log is durable at `watermark` from here on, and nothing that can\n    // advance the watermark the stream would resume from has run yet. A crash in\n    // that window leaves a transaction the resumed stream re-delivers, which\n    // reconciliation truncates.\n    this.#db.commit();\n    this.#reset();\n    return stats;\n  }\n\n  /**\n   * Discards the open transaction, if any. Safe to call when none is open — the\n   * caller rolls back on an interrupted change stream, which can arrive between\n   * transactions as well as inside one.\n   */\n  rollback(): void {\n    const {inTransaction} = this.#db.db;\n    this.#reset();\n    if (inTransaction) {\n      this.#db.rollback();\n    }\n  }\n\n  #reset(): void {\n    this.#watermark = undefined;\n    this.#pos = 0;\n    this.#estimatedBytes = 0;\n    this.#hasher = undefined;\n    // A fresh array rather than a truncation: the committed stats hold a\n    // reference to the previous one.\n    this.#cookieMutations = [];\n  }\n\n  #requireWatermark(): string {\n    assertInvariant(\n      this.#watermark !== undefined,\n      'change-log stream message received outside of a transaction',\n    );\n    return this.#watermark;\n  }\n}\n"],"mappings":";;;;;;AA0BA,IAAa,gCAAb,cAAmD,MAAM;CACvD,OAAyB;AAC3B;AAEA,SAAS,gBACP,WACA,SACmB;CACnB,IAAI,CAAC,WACH,MAAM,IAAI,8BAA8B,OAAO;AAEnD;;;;;;;;;;;;;;;;AAiBA,IAAa,wBAAb,MAAmC;CACjC;CACA;CACA;CACA;CAEA;CACA,OAAO;CACP,kBAAkB;CAClB;CACA,mBAAkC,CAAC;CAEnC,YAAY,IAAqB;EAC/B,KAAKA,MAAM;EACX,KAAKC,gBAAgB,GAAG,GAAG,QAAgB;qBAC1B,wBAAwB;;;KAGxC;EACD,KAAKC,gBAAgB,GAAG,GAAG,QAAgB;qBAC1B,wBAAwB;;;;KAIxC;EACD,KAAKC,WAAW,IAAI,sBAAsB,GAAG,EAAE;CACjD;CAEA,MACE,WACA,MACA,eAAe,uBAAuB,MAAM,OAAO,GACnD,OAAO,MACD;EACN,gBACE,KAAKC,eAAe,KAAA,GACpB,iDAAiD,KAAKA,YACxD;EAIA,KAAKJ,IAAI,eAAe;EACxB,KAAKI,aAAa;EAClB,KAAKC,OAAO;EACZ,MAAM,SAAS;EACf,MAAM,iBAAiB,gCACrB,WACA,SACA,MACF;EACA,KAAKJ,cAAc,IACjB,WACA,KAAKI,MACL,SACA,gBACA,MACF;EACA,IAAI,MAAM;GACR,KAAKC,UAAU,IAAI,2BAA2B;GAC9C,KAAKA,QAAQ,IAAI;IACf;IACA,KAAK,KAAKD;IACV,KAAK;IACL;IACA,WAAW;GACb,CAAC;EACH;EACA,KAAKE,kBAAkB;CACzB;;;;;;;;;;;CAYA,OACE,MACA,QACA,eAAe,uBAAuB,MAAM,OAAO,GAAG,GAChD;EACN,MAAM,YAAY,KAAKC,kBAAkB;EACzC,MAAM,EAAC,QAAO;EACd,MAAM,SAAS;EACf,MAAM,iBAAiB,gCACrB,WACA,KACA,MACF;EACA,KAAKP,cAAc,IAAI,WAAW,EAAE,KAAKI,MAAM,KAAK,gBAAgB,MAAM;EAC1E,KAAKC,SAAS,IAAI;GAChB;GACA,KAAK,KAAKD;GACV;GACA,QAAQ;GACR,WAAW;EACb,CAAC;EACD,KAAKE,mBAAmB;EAExB,IAAI,eAAe,MAAM,GACvB,KAAK,MAAM,MAAM,KAAKJ,SAAS,MAAM,MAAM,GACzC,KAAKM,iBAAiB,KAAK,GAAG,EAAE;CAGtC;CAEA,OACE,WACA,MACA,aACA,eAAe,uBAAuB,MAAM,QAAQ,GACnB;EACjC,MAAM,YAAY,KAAKD,kBAAkB;EACzC,gBACE,cAAc,WACd,4BAA4B,UAAU,wBAAwB,WAChE;EACA,MAAM,SAAS;EACf,MAAM,iBAAiB,gCACrB,WACA,UACA,QACA,WACA,IACF;EACA,KAAKN,cAAc,IACjB,WACA,EAAE,KAAKG,MACP,gBACA,QACA,WACA,WACF;EACA,MAAM,SAAS,KAAKC;EACpB,QAAQ,IAAI;GACV;GACA,KAAK,KAAKD;GACV,KAAK;GACL;GACA;EACF,CAAC;EACD,MAAM,QAAQ;GACZ,MAAM,KAAKA,OAAO;GAClB,gBAAgB,KAAKE,kBAAkB;GACvC,MAAM,QAAQ,OAAO;GACrB,iBAAiB,KAAKE;EACxB;EAKA,KAAKT,IAAI,OAAO;EAChB,KAAKU,OAAO;EACZ,OAAO;CACT;;;;;;CAOA,WAAiB;EACf,MAAM,EAAC,kBAAiB,KAAKV,IAAI;EACjC,KAAKU,OAAO;EACZ,IAAI,eACF,KAAKV,IAAI,SAAS;CAEtB;CAEA,SAAe;EACb,KAAKI,aAAa,KAAA;EAClB,KAAKC,OAAO;EACZ,KAAKE,kBAAkB;EACvB,KAAKD,UAAU,KAAA;EAGf,KAAKG,mBAAmB,CAAC;CAC3B;CAEA,oBAA4B;EAC1B,gBACE,KAAKL,eAAe,KAAA,GACpB,6DACF;EACA,OAAO,KAAKA;CACd;AACF"}
+{"version":3,"file":"change-log-stream-writer.js","names":[],"sources":["../../../../../../zero-cache/src/services/replicator/change-log-stream-writer.ts"],"sourcesContent":["import type {Statement} from '../../../../zqlite/src/db.ts';\nimport type {StatementRunner} from '../../db/statements.ts';\nimport {\n  isSchemaChange,\n  type DataOrSchemaChange,\n} from '../change-source/protocol/current/data.ts';\nimport {extractChangeSubstring} from '../change-streamer/change-log-codec.ts';\nimport {ChangeLogTransactionHasher} from '../change-streamer/change-log-transaction-hash.ts';\nimport {ChangeLogCookieWriter, type CookieOpTag} from './change-log-cookies.ts';\nimport {\n  CHANGE_LOG_STREAM_TABLE,\n  estimateChangeLogStreamRowBytes,\n} from './change-log-db.ts';\n\nexport type ChangeLogStreamTransactionStats = {\n  readonly rows: number;\n  readonly estimatedBytes: number;\n  /** Present only for transactions selected for shadow-write validation. */\n  readonly hash?: string | undefined;\n  /**\n   * The cookie mutations this transaction's schema changes folded in, in stream\n   * order. Empty for the overwhelming majority of transactions.\n   */\n  readonly cookieMutations: readonly CookieOpTag[];\n};\n\nclass ChangeLogStreamInvariantError extends Error {\n  override readonly name = 'ChangeLogStreamInvariantError';\n}\n\nfunction assertInvariant(\n  condition: unknown,\n  message: string,\n): asserts condition {\n  if (!condition) {\n    throw new ChangeLogStreamInvariantError(message);\n  }\n}\n\n/**\n * Appends the canonical downstream stream to the change-log database, which is\n * a separate file from the replica, and folds its schema changes into the log's\n * cookie jar (`change-log-cookies.ts`) as it goes.\n *\n * This class owns the change log's transaction, and its transaction alone. It is\n * driven from the change-streamer's stream loop, which commits it before\n * forwarding a transaction's `commit` message; see `SQLiteChangeLogWriter` in\n * `change-streamer/sqlite-change-log-writer.ts` for the ordering that makes a\n * hole unreachable, and for the fail-soft policy that wraps every call here.\n *\n * Because the cookies are written in that same transaction, they are atomic with\n * the head and {@link rollback} discards them with the rows they were folded\n * from. Neither needs any handling of its own.\n */\nexport class ChangeLogStreamWriter {\n  readonly #db: StatementRunner;\n  readonly #insertChange: Statement;\n  readonly #insertCommit: Statement;\n  readonly #cookies: ChangeLogCookieWriter;\n\n  #watermark: string | undefined;\n  #pos = 0;\n  #estimatedBytes = 0;\n  #hasher: ChangeLogTransactionHasher | undefined;\n  #cookieMutations: CookieOpTag[] = [];\n\n  constructor(db: StatementRunner) {\n    this.#db = db;\n    this.#insertChange = db.db.prepare(/*sql*/ `\n      INSERT INTO \"${CHANGE_LOG_STREAM_TABLE}\"\n        (\"watermark\", \"pos\", \"tag\", \"estimatedBytes\", \"change\")\n        VALUES (?, ?, ?, ?, ?)\n    `);\n    this.#insertCommit = db.db.prepare(/*sql*/ `\n      INSERT INTO \"${CHANGE_LOG_STREAM_TABLE}\"\n        (\"watermark\", \"pos\", \"tag\", \"estimatedBytes\", \"change\", \"precommit\",\n         \"writeTimeMs\")\n        VALUES (?, ?, 'commit', ?, ?, ?, ?)\n    `);\n    this.#cookies = new ChangeLogCookieWriter(db.db);\n  }\n\n  begin(\n    watermark: string,\n    json: string,\n    storedChange = extractChangeSubstring(json, 'begin'),\n    hash = true,\n  ): void {\n    assertInvariant(\n      this.#watermark === undefined,\n      `change-log stream transaction already open at ${this.#watermark}`,\n    );\n    // This process is the sole writer of the change-log database, so the write\n    // lock is taken up front rather than risking a failed upgrade from a\n    // deferred transaction partway through the append.\n    this.#db.beginImmediate();\n    this.#watermark = watermark;\n    this.#pos = 0;\n    const change = storedChange;\n    const estimatedBytes = estimateChangeLogStreamRowBytes(\n      watermark,\n      'begin',\n      change,\n    );\n    this.#insertChange.run(\n      watermark,\n      this.#pos,\n      'begin',\n      estimatedBytes,\n      change,\n    );\n    if (hash) {\n      this.#hasher = new ChangeLogTransactionHasher();\n      this.#hasher.add({\n        watermark,\n        pos: this.#pos,\n        tag: 'begin',\n        change,\n        precommit: null,\n      });\n    }\n    this.#estimatedBytes = estimatedBytes;\n  }\n\n  /**\n   * Appends one data or schema change. The parsed message is taken rather than\n   * just its tag because a schema change also mutates the cookie jar, and the\n   * caller already holds it — so the fold costs no re-parse.\n   *\n   * The cookie statements run here, i.e. inside this transaction and in stream\n   * order relative to the rows they were folded from. The Postgres change log\n   * has to flush its buffered batch to get the same ordering\n   * (`Storer.#processQueue()`); SQLite gets it from statement order.\n   */\n  append(\n    json: string,\n    change: DataOrSchemaChange,\n    storedChange = extractChangeSubstring(json, change.tag),\n  ): void {\n    const watermark = this.#requireWatermark();\n    const {tag} = change;\n    const stored = storedChange;\n    const estimatedBytes = estimateChangeLogStreamRowBytes(\n      watermark,\n      tag,\n      stored,\n    );\n    this.#insertChange.run(watermark, ++this.#pos, tag, estimatedBytes, stored);\n    this.#hasher?.add({\n      watermark,\n      pos: this.#pos,\n      tag,\n      change: stored,\n      precommit: null,\n    });\n    this.#estimatedBytes += estimatedBytes;\n\n    if (isSchemaChange(change)) {\n      for (const op of this.#cookies.apply(change)) {\n        this.#cookieMutations.push(op.op);\n      }\n    }\n  }\n\n  commit(\n    watermark: string,\n    json: string,\n    writeTimeMs: number,\n    storedChange = extractChangeSubstring(json, 'commit'),\n  ): ChangeLogStreamTransactionStats {\n    const precommit = this.#requireWatermark();\n    assertInvariant(\n      watermark === precommit,\n      `change-log stream commit ${watermark} does not match begin ${precommit}`,\n    );\n    const change = storedChange;\n    const estimatedBytes = estimateChangeLogStreamRowBytes(\n      watermark,\n      'commit',\n      change,\n      precommit,\n      true,\n    );\n    this.#insertCommit.run(\n      watermark,\n      ++this.#pos,\n      estimatedBytes,\n      change,\n      precommit,\n      writeTimeMs,\n    );\n    const hasher = this.#hasher;\n    hasher?.add({\n      watermark,\n      pos: this.#pos,\n      tag: 'commit',\n      change,\n      precommit,\n    });\n    const stats = {\n      rows: this.#pos + 1,\n      estimatedBytes: this.#estimatedBytes + estimatedBytes,\n      hash: hasher?.digest(),\n      cookieMutations: this.#cookieMutations,\n    };\n    // The log is durable at `watermark` from here on, and nothing that can\n    // advance the watermark the stream would resume from has run yet. A crash in\n    // that window leaves a transaction the resumed stream re-delivers, which\n    // reconciliation truncates.\n    this.#db.commit();\n    this.#reset();\n    return stats;\n  }\n\n  /**\n   * Discards the open transaction, if any. Safe to call when none is open — the\n   * caller rolls back on an interrupted change stream, which can arrive between\n   * transactions as well as inside one.\n   */\n  rollback(): void {\n    const {inTransaction} = this.#db.db;\n    this.#reset();\n    if (inTransaction) {\n      this.#db.rollback();\n    }\n  }\n\n  #reset(): void {\n    this.#watermark = undefined;\n    this.#pos = 0;\n    this.#estimatedBytes = 0;\n    this.#hasher = undefined;\n    // A fresh array rather than a truncation: the committed stats hold a\n    // reference to the previous one.\n    this.#cookieMutations = [];\n  }\n\n  #requireWatermark(): string {\n    assertInvariant(\n      this.#watermark !== undefined,\n      'change-log stream message received outside of a transaction',\n    );\n    return this.#watermark;\n  }\n}\n"],"mappings":";;;;;;AA0BA,IAAM,gCAAN,cAA4C,MAAM;CAChD,OAAyB;AAC3B;AAEA,SAAS,gBACP,WACA,SACmB;CACnB,IAAI,CAAC,WACH,MAAM,IAAI,8BAA8B,OAAO;AAEnD;;;;;;;;;;;;;;;;AAiBA,IAAa,wBAAb,MAAmC;CACjC;CACA;CACA;CACA;CAEA;CACA,OAAO;CACP,kBAAkB;CAClB;CACA,mBAAkC,CAAC;CAEnC,YAAY,IAAqB;EAC/B,KAAK,MAAM;EACX,KAAK,gBAAgB,GAAG,GAAG,QAAgB;qBAC1B,wBAAwB;;;KAGxC;EACD,KAAK,gBAAgB,GAAG,GAAG,QAAgB;qBAC1B,wBAAwB;;;;KAIxC;EACD,KAAK,WAAW,IAAI,sBAAsB,GAAG,EAAE;CACjD;CAEA,MACE,WACA,MACA,eAAe,uBAAuB,MAAM,OAAO,GACnD,OAAO,MACD;EACN,gBACE,KAAK,eAAe,KAAA,GACpB,iDAAiD,KAAK,YACxD;EAIA,KAAK,IAAI,eAAe;EACxB,KAAK,aAAa;EAClB,KAAK,OAAO;EACZ,MAAM,SAAS;EACf,MAAM,iBAAiB,gCACrB,WACA,SACA,MACF;EACA,KAAK,cAAc,IACjB,WACA,KAAK,MACL,SACA,gBACA,MACF;EACA,IAAI,MAAM;GACR,KAAK,UAAU,IAAI,2BAA2B;GAC9C,KAAK,QAAQ,IAAI;IACf;IACA,KAAK,KAAK;IACV,KAAK;IACL;IACA,WAAW;GACb,CAAC;EACH;EACA,KAAK,kBAAkB;CACzB;;;;;;;;;;;CAYA,OACE,MACA,QACA,eAAe,uBAAuB,MAAM,OAAO,GAAG,GAChD;EACN,MAAM,YAAY,KAAK,kBAAkB;EACzC,MAAM,EAAC,QAAO;EACd,MAAM,SAAS;EACf,MAAM,iBAAiB,gCACrB,WACA,KACA,MACF;EACA,KAAK,cAAc,IAAI,WAAW,EAAE,KAAK,MAAM,KAAK,gBAAgB,MAAM;EAC1E,KAAK,SAAS,IAAI;GAChB;GACA,KAAK,KAAK;GACV;GACA,QAAQ;GACR,WAAW;EACb,CAAC;EACD,KAAK,mBAAmB;EAExB,IAAI,eAAe,MAAM,GACvB,KAAK,MAAM,MAAM,KAAK,SAAS,MAAM,MAAM,GACzC,KAAK,iBAAiB,KAAK,GAAG,EAAE;CAGtC;CAEA,OACE,WACA,MACA,aACA,eAAe,uBAAuB,MAAM,QAAQ,GACnB;EACjC,MAAM,YAAY,KAAK,kBAAkB;EACzC,gBACE,cAAc,WACd,4BAA4B,UAAU,wBAAwB,WAChE;EACA,MAAM,SAAS;EACf,MAAM,iBAAiB,gCACrB,WACA,UACA,QACA,WACA,IACF;EACA,KAAK,cAAc,IACjB,WACA,EAAE,KAAK,MACP,gBACA,QACA,WACA,WACF;EACA,MAAM,SAAS,KAAK;EACpB,QAAQ,IAAI;GACV;GACA,KAAK,KAAK;GACV,KAAK;GACL;GACA;EACF,CAAC;EACD,MAAM,QAAQ;GACZ,MAAM,KAAK,OAAO;GAClB,gBAAgB,KAAK,kBAAkB;GACvC,MAAM,QAAQ,OAAO;GACrB,iBAAiB,KAAK;EACxB;EAKA,KAAK,IAAI,OAAO;EAChB,KAAK,OAAO;EACZ,OAAO;CACT;;;;;;CAOA,WAAiB;EACf,MAAM,EAAC,kBAAiB,KAAK,IAAI;EACjC,KAAK,OAAO;EACZ,IAAI,eACF,KAAK,IAAI,SAAS;CAEtB;CAEA,SAAe;EACb,KAAK,aAAa,KAAA;EAClB,KAAK,OAAO;EACZ,KAAK,kBAAkB;EACvB,KAAK,UAAU,KAAA;EAGf,KAAK,mBAAmB,CAAC;CAC3B;CAEA,oBAA4B;EAC1B,gBACE,KAAK,eAAe,KAAA,GACpB,6DACF;EACA,OAAO,KAAK;CACd;AACF"}