@rocicorp/zero 1.12.0-canary.1 → 1.12.0-canary.11

package/out/zero-cache/src/services/plannerz.js

@@ -1,10 +1,10 @@
 import { getOperatorAccess, getServerVersion } from "../config/zero-config.js";
 import { Database } from "../../../zqlite/src/db.js";
-import { computeZqlSpecsFromLiteSpecs, listIndexes, listTables } from "../db/lite-tables.js";
 import { decodeSampleKinds } from "../../../zqlite/src/sqlite-stat4-sample.js";
-import { getReplicationState } from "./replicator/schema/replication-state.js";
+import { computeZqlSpecsFromLiteSpecs, listIndexes, listTables } from "../db/lite-tables.js";
 import { StatementRunner } from "../db/statements.js";
-import { _usingCtx } from "../../../_virtual/_@oxc-project_runtime@0.130.0/helpers/usingCtx.js";
+import { getReplicationState } from "./replicator/schema/replication-state.js";
+import _usingCtx from "../../../_virtual/_@oxc-project_runtime@0.154.0/helpers/esm/usingCtx.js";
 import auth from "basic-auth";
 //#region ../zero-cache/src/services/plannerz.ts
 /**
@@ -73,8 +73,6 @@ function parseCounts(raw) {
 * Builds the `/plannerz` bundle from the replica's catalog, `sqlite_stat*`
 * tables and the server config. No user table is read, so the cost does not
 * depend on how much data the replica holds.
-*
-* @visibleForTesting
 */
 function buildPlannerzBundle(lc, config, opts = {}) {
 	try {
@@ -245,7 +243,8 @@ function replicaWatermark(lc, db) {
 * * `stat4=full`: includes the full sqlite_stat4 histogram, which is large
 */
 async function handlePlannerzRequest(lc, config, req, res) {
-	if (getOperatorAccess(lc, config, auth(req)?.pass) === void 0) {
+	const credentials = auth(req);
+	if (getOperatorAccess(lc, config, credentials?.pass) === void 0) {
 		res.code(401).header("WWW-Authenticate", "Basic realm=\"Plannerz Protected Area\"").send("Unauthorized");
 		return;
 	}
@@ -262,6 +261,6 @@ async function handlePlannerzRequest(lc, config, req, res) {
 	await res.header("Content-Type", "application/json").send(JSON.stringify(bundle, null, indent));
 }
 //#endregion
-export { handlePlannerzRequest };
+export { buildPlannerzBundleFromDB, handlePlannerzRequest, parseStat1, summarizeStat4 };
 
 //# sourceMappingURL=plannerz.js.map

package/out/zero-cache/src/services/plannerz.js.map

@@ -1 +1 @@
-{"version":3,"file":"plannerz.js","names":[],"sources":["../../../../../zero-cache/src/services/plannerz.ts"],"sourcesContent":["import type {LogContext} from '@rocicorp/logger';\nimport auth from 'basic-auth';\nimport type {FastifyReply, FastifyRequest} from 'fastify';\nimport {Database} from '../../../zqlite/src/db.ts';\nimport {\n  decodeSampleKinds,\n  type SampleValueKind,\n} from '../../../zqlite/src/sqlite-stat4-sample.ts';\nimport type {NormalizedZeroConfig as ZeroConfig} from '../config/normalize.ts';\nimport {getOperatorAccess, getServerVersion} from '../config/zero-config.ts';\nimport {\n  computeZqlSpecsFromLiteSpecs,\n  listIndexes,\n  listTables,\n} from '../db/lite-tables.ts';\nimport {StatementRunner} from '../db/statements.ts';\nimport {getReplicationState} from './replicator/schema/replication-state.ts';\n\n/**\n * How the statistics in the replica were gathered. zero-cache only ever runs\n * `PRAGMA optimize`, and always under an `analysis_limit`, which samples rather\n * than scanning. A replica that someone ran `ANALYZE` on by hand has better\n * statistics, which is visible in `sqlite_stat4` having rows at all.\n */\nconst APPROXIMATE_METHOD =\n  'PRAGMA optimize under an analysis_limit. Row counts and per-key averages ' +\n  'are sampled estimates, and sqlite_stat4 is not collected.';\nconst FULL_METHOD =\n  'ANALYZE, with no analysis limit. sqlite_stat4 has rows, so a full ANALYZE ' +\n  'ran against this replica at some point.';\n\n/**\n * A fixed glossary, sent with every bundle. The audience is a language model\n * that has the user's codebase but has never seen these statistics, and would\n * otherwise read a sampled estimate as an exact count.\n */\nconst ABOUT = {\n  whatThisIs:\n    'Schema, indexes and SQLite statistics for the SQLite replica that ' +\n    'zero-cache queries. Use it to decide how to rewrite ZQL queries and ' +\n    'which indexes to add. It contains no row data.',\n  stat1Format:\n    'sqlite_stat1.stat is \"<rows> <avg rows per distinct 1-column prefix> ' +\n    '<... per 2-column prefix> ...\", parsed here into `rows` and ' +\n    '`avgRowsPerPrefix`. NULLs count as ordinary values, so a sparse column ' +\n    'looks less selective than it is. Trailing flags such as \"unordered\", ' +\n    '\"noskipscan\" and \"sz=N\" are kept in `flags`.',\n  stat4Format:\n    'sqlite_stat4 is a per-index histogram. For each sample, `nEq` is the ' +\n    'rows equal to it, `nLt` the rows less than it, and `nDLt` the distinct ' +\n    'values less than it, one entry per key column. A large `nEq` next to a ' +\n    'small `nDLt` means a skewed column, where the average in stat1 hides ' +\n    'the common values. Sample values are never returned: `sample` reports ' +\n    'only each key column’s type.',\n  howThePlannerUsesThis: [\n    'Cost comes from SQLite scanstatus estimates for the SQL each source ' +\n      'connection would run, so the statistics here are what the planner sees.',\n    'Join fanout comes from sqlite_stat4, else sqlite_stat1, else a default ' +\n      'of 3. With no stat4 (the usual case) fanout on a nullable foreign key ' +\n      'is overestimated, because stat1 counts NULLs.',\n    'The planner chooses per join whether to run it as a semi-join or to flip ' +\n      'it so the child drives. An index that matches the child’s ' +\n      'constraint plus ordering is what makes a flip cheap.',\n  ],\n  whatYouCanChange: [\n    'The ZQL query: `whereExists` vs `related`, the order of conditions, and ' +\n      'ordering that matches an existing index.',\n    'A `limit`, which lets the planner stop early.',\n    'Indexes: add them in Postgres, not on the replica. The replica copies ' +\n      'upstream indexes, so a new index reaches it through replication.',\n    'The planner flags in `server.planner`.',\n  ],\n  caveats: [\n    'Row counts are estimates from the statistics, not COUNT(*). This ' +\n      'endpoint never scans a table.',\n    'Statistics are as of the last time they were gathered, which SQLite does ' +\n      'not record. A table whose size changed a lot since then can be far off.',\n    'Tables in `tables` with `syncable: false` cannot be queried by clients: ' +\n      'they lack a primary key or unique index, or every column has a type ' +\n      'ZQL does not support.',\n  ],\n} as const;\n\nexport type Stat1 = {\n  /** The raw `sqlite_stat1.stat` text, in case a flag is not parsed here. */\n  raw: string;\n  /** Estimated rows in the table. */\n  rows: number;\n  /**\n   * Average rows per distinct key prefix: the first entry is for a 1-column\n   * prefix, the second for 2 columns, and so on.\n   */\n  avgRowsPerPrefix: number[];\n  /** Non-numeric tokens, e.g. `unordered`, `noskipscan`, `sz=N`. */\n  flags: string[];\n};\n\n/** A `sqlite_stat4` sample with its values replaced by their types. */\nexport type Stat4Sample = {\n  nEq: number[];\n  nLt: number[];\n  nDLt: number[];\n  /** One entry per key column, plus the trailing rowid. */\n  sample: SampleValueKind[];\n};\n\n/**\n * A digest of an index's `sqlite_stat4` histogram, one entry per key prefix\n * depth. This is what the default response carries: a full histogram runs to\n * hundreds of samples per index, which is a lot of context to spend on data an\n * LLM would only summarize anyway.\n */\nexport type Stat4PrefixSummary = {\n  /** Rows equal to the most common sampled key at this depth. */\n  maxRowsPerKey: number;\n  /** Median rows per sampled key at this depth. */\n  medianRowsPerKey: number;\n  /**\n   * Lower bound on distinct keys at this depth, from the last sample's count of\n   * distinct values less than it.\n   */\n  estimatedDistinctKeys: number;\n};\n\nexport type Stat4Summary = {\n  samples: number;\n  /** The type of each key column, and of the trailing rowid. */\n  sampleKinds: SampleValueKind[];\n  /** One entry per key prefix depth: 1 column, then 2, and so on. */\n  perPrefix: Stat4PrefixSummary[];\n};\n\nexport type IndexStats = {\n  name: string;\n  columns: {name: string; dir: 'ASC' | 'DESC'}[];\n  unique: boolean;\n  partial: boolean;\n  stat1?: Stat1 | undefined;\n  stat4?: Stat4Summary | undefined;\n  /** The full histogram, only with `?stat4=full`. */\n  stat4Samples?: Stat4Sample[] | undefined;\n};\n\nexport type ColumnStats = {\n  name: string;\n  dataType: string;\n  nullable: boolean;\n  /** The ZQL type, or `null` for a column clients cannot see. */\n  zqlType: string | null;\n  backfilling?: true | undefined;\n};\n\nexport type TableStats = {\n  name: string;\n  columns: ColumnStats[];\n  primaryKey: string[] | undefined;\n  estimatedRows: number | undefined;\n  syncable: boolean;\n  indexes: IndexStats[];\n};\n\nexport type PlannerzBundle = {\n  about: typeof ABOUT;\n  server: {\n    zeroVersion: string;\n    sqliteVersion: string;\n    replicaWatermark: string | undefined;\n    generatedAt: string;\n    planner: {\n      enableQueryPlanner: boolean;\n      enableCorrelatedPredicatePushdown: boolean;\n      enablePlannerAwarePushdown: boolean;\n    };\n  };\n  statsQuality: {\n    stat1Present: boolean;\n    stat4Rows: number;\n    method: string;\n    tablesWithoutStats: string[];\n  };\n  tables: TableStats[];\n};\n\n/**\n * Parses a `sqlite_stat1.stat` value.\n *\n * @visibleForTesting\n */\nexport function parseStat1(raw: string): Stat1 {\n  const tokens = raw.trim().split(SEPARATOR).filter(Boolean);\n  const numbers: number[] = [];\n  const flags: string[] = [];\n  for (const token of tokens) {\n    // Only leading tokens are counts; anything else is a flag, even if it\n    // parses as a number (e.g. a future \"sz=N\" spelled differently).\n    if (flags.length === 0 && COUNT.test(token)) {\n      numbers.push(parseInt(token, 10));\n    } else {\n      flags.push(token);\n    }\n  }\n  return {\n    raw,\n    rows: numbers[0] ?? 0,\n    avgRowsPerPrefix: numbers.slice(1),\n    flags,\n  };\n}\n\n/** Whitespace between the counts in a `sqlite_stat1` or `sqlite_stat4` value. */\nconst SEPARATOR = /\\s+/;\n/** A count, as opposed to a trailing flag such as `unordered` or `sz=N`. */\nconst COUNT = /^\\d+$/;\n\ntype Stat1Row = {tbl: string; idx: string | null; stat: string};\ntype Stat4Row = {\n  tbl: string;\n  idx: string;\n  neq: string;\n  nlt: string;\n  ndlt: string;\n  sample: Buffer;\n};\n\nfunction tableExists(db: Database, name: string): boolean {\n  return (\n    db\n      .prepare(\n        `SELECT name FROM sqlite_master WHERE type = 'table' AND name = ?`,\n      )\n      .all(name).length > 0\n  );\n}\n\nfunction parseCounts(raw: string): number[] {\n  return raw\n    .trim()\n    .split(SEPARATOR)\n    .filter(Boolean)\n    .map(n => parseInt(n, 10));\n}\n\n/**\n * Builds the `/plannerz` bundle from the replica's catalog, `sqlite_stat*`\n * tables and the server config. No user table is read, so the cost does not\n * depend on how much data the replica holds.\n *\n * @visibleForTesting\n */\nexport function buildPlannerzBundle(\n  lc: LogContext,\n  config: ZeroConfig,\n  opts: BundleOptions = {},\n): PlannerzBundle {\n  using db = new Database(lc, config.replica.file, {readonly: true});\n  return buildPlannerzBundleFromDB(lc, db, config, opts);\n}\n\nexport type BundleOptions = {\n  /** Include the full `sqlite_stat4` histogram, not just the digest. */\n  fullStat4?: boolean | undefined;\n};\n\n/** @visibleForTesting */\nexport function buildPlannerzBundleFromDB(\n  lc: LogContext,\n  db: Database,\n  config: ZeroConfig,\n  opts: BundleOptions = {},\n): PlannerzBundle {\n  const tables = listReplicaTables(lc, db);\n  const indexes = listIndexes(db);\n  const zqlSpecs = computeZqlSpecsFromLiteSpecs(\n    tables,\n    indexes,\n    {includeBackfillingColumns: false},\n    undefined,\n    undefined,\n    lc,\n  );\n\n  const stat1Present = tableExists(db, 'sqlite_stat1');\n  const stat1ByTableAndIndex = new Map<string, Stat1>();\n  const statsByTable = new Map<string, Stat1>();\n  if (stat1Present) {\n    for (const {tbl, idx, stat} of db\n      .prepare(`SELECT tbl, idx, stat FROM sqlite_stat1`)\n      .all() as Stat1Row[]) {\n      const parsed = parseStat1(stat);\n      if (idx !== null) {\n        stat1ByTableAndIndex.set(`${tbl}.${idx}`, parsed);\n      }\n      // Every row for a table starts with the table's row count. A row with a\n      // null `idx` is written for a table with no indexes, and is preferred\n      // because it is about the table itself.\n      if (idx === null || !statsByTable.has(tbl)) {\n        statsByTable.set(tbl, parsed);\n      }\n    }\n  }\n\n  const stat4Present = tableExists(db, 'sqlite_stat4');\n  const stat4ByTableAndIndex = new Map<string, Stat4Sample[]>();\n  let stat4Rows = 0;\n  if (stat4Present) {\n    for (const {tbl, idx, neq, nlt, ndlt, sample} of db\n      .prepare(`SELECT tbl, idx, neq, nlt, ndlt, sample FROM sqlite_stat4`)\n      .all() as Stat4Row[]) {\n      stat4Rows++;\n      const samples = stat4ByTableAndIndex.get(`${tbl}.${idx}`) ?? [];\n      samples.push({\n        nEq: parseCounts(neq),\n        nLt: parseCounts(nlt),\n        nDLt: parseCounts(ndlt),\n        // Values are deliberately dropped here: only the types are reported.\n        sample: decodeSampleKinds(sample),\n      });\n      stat4ByTableAndIndex.set(`${tbl}.${idx}`, samples);\n    }\n  }\n\n  const indexesByTable = new Map<string, IndexStats[]>();\n  for (const index of indexes) {\n    const key = `${index.tableName}.${index.name}`;\n    const stat4 = stat4ByTableAndIndex.get(key);\n    const forTable = indexesByTable.get(index.tableName) ?? [];\n    forTable.push({\n      name: index.name,\n      columns: Object.entries(index.columns).map(([name, dir]) => ({\n        name,\n        dir,\n      })),\n      unique: index.unique,\n      partial: index.partial === true,\n      stat1: stat1ByTableAndIndex.get(key),\n      stat4: stat4?.length ? summarizeStat4(stat4) : undefined,\n      stat4Samples: opts.fullStat4 && stat4?.length ? stat4 : undefined,\n    });\n    indexesByTable.set(index.tableName, forTable);\n  }\n\n  const tablesWithoutStats: string[] = [];\n  const tableStats = tables.map(table => {\n    const zqlSpec = zqlSpecs.get(table.name)?.zqlSpec;\n    if (!statsByTable.has(table.name)) {\n      tablesWithoutStats.push(table.name);\n    }\n    const backfilling = new Set(table.backfilling ?? []);\n    return {\n      name: table.name,\n      columns: Object.entries(table.columns).map(([name, spec]) => ({\n        name,\n        dataType: spec.dataType,\n        nullable: !spec.notNull,\n        zqlType: zqlSpec?.[name]?.type ?? null,\n        ...(backfilling.has(name) ? {backfilling: true as const} : {}),\n      })),\n      primaryKey: table.primaryKey ? [...table.primaryKey] : undefined,\n      estimatedRows: statsByTable.get(table.name)?.rows,\n      syncable: zqlSpec !== undefined,\n      indexes: indexesByTable.get(table.name) ?? [],\n    };\n  });\n\n  return {\n    about: ABOUT,\n    server: {\n      zeroVersion: getServerVersion(config),\n      sqliteVersion: sqliteVersion(db),\n      replicaWatermark: replicaWatermark(lc, db),\n      generatedAt: new Date().toISOString(),\n      planner: {\n        enableQueryPlanner: config.enableQueryPlanner,\n        // Both default to on, matching services/analyze.ts.\n        enableCorrelatedPredicatePushdown:\n          config.enableCorrelatedPredicatePushdown !== false,\n        enablePlannerAwarePushdown: config.enablePlannerAwarePushdown !== false,\n      },\n    },\n    statsQuality: {\n      stat1Present,\n      stat4Rows,\n      method: stat4Rows > 0 ? FULL_METHOD : APPROXIMATE_METHOD,\n      tablesWithoutStats,\n    },\n    tables: tableStats,\n  };\n}\n\n/**\n * Lists the replica's tables, tolerating a replica that has no metadata tables\n * yet. `listTables` reads `_zero.tableMetadata` for backfill status, which does\n * not exist until initial sync has created it. Reporting the schema without\n * backfill status beats failing the whole request.\n */\nfunction listReplicaTables(lc: LogContext, db: Database) {\n  try {\n    return listTables(db);\n  } catch (e) {\n    lc.debug?.('reading table metadata failed; listing tables without it', e);\n    return listTables(db, true, false);\n  }\n}\n\n/**\n * Digests an index's stat4 samples.\n *\n * Note that `nLt` and `nDLt` are stored as text, so SQL cannot order the\n * samples by them numerically. This works off the whole set rather than\n * relying on the samples' order: the highest `nDLt` is a lower bound on the\n * distinct keys, since the sample holding it has that many distinct keys below\n * it plus itself.\n *\n * @visibleForTesting\n */\nexport function summarizeStat4(samples: Stat4Sample[]): Stat4Summary {\n  const depth = Math.max(...samples.map(s => s.nEq.length));\n  const perPrefix: Stat4PrefixSummary[] = [];\n  for (let d = 0; d < depth; d++) {\n    const counts = samples\n      .map(s => s.nEq[d])\n      .filter(n => n !== undefined)\n      .sort((a, b) => a - b);\n    const maxDistinctBelow = Math.max(\n      ...samples.map(s => s.nDLt[d]).filter(n => n !== undefined),\n    );\n    perPrefix.push({\n      maxRowsPerKey: counts.at(-1)!,\n      medianRowsPerKey: counts[Math.floor((counts.length - 1) / 2)],\n      estimatedDistinctKeys: maxDistinctBelow + 1,\n    });\n  }\n  return {\n    samples: samples.length,\n    // Every sample of an index describes the same columns.\n    sampleKinds: samples[0].sample,\n    perPrefix,\n  };\n}\n\nfunction sqliteVersion(db: Database): string {\n  const [{version}] = db\n    .prepare(`SELECT sqlite_version() AS version`)\n    .all() as {version: string}[];\n  return version;\n}\n\nfunction replicaWatermark(lc: LogContext, db: Database): string | undefined {\n  try {\n    return getReplicationState(new StatementRunner(db)).stateVersion;\n  } catch (e) {\n    // A replica that has not finished initial sync has no replication state.\n    lc.debug?.('could not read replication state', e);\n    return undefined;\n  }\n}\n\n/**\n * Serves the replica's schema, indexes and SQLite statistics for consumption by\n * a language model, so that it can advise on query rewrites and indexes.\n *\n * Row data is never returned. See `designs/003_replica_stats_endpoint.md`.\n *\n * This is available to the operator password as well as the admin password\n * (see `--operator-password`). That does not extend to `/plannerz/analyze`,\n * which runs caller-supplied queries against the replica and so must require\n * the admin password (`isAdminPasswordValid`).\n *\n * HTTP query parameters:\n * * `pretty`: indents the JSON\n * * `stat4=full`: includes the full sqlite_stat4 histogram, which is large\n */\nexport async function handlePlannerzRequest(\n  lc: LogContext,\n  config: ZeroConfig,\n  req: FastifyRequest,\n  res: FastifyReply,\n) {\n  const credentials = auth(req);\n  if (getOperatorAccess(lc, config, credentials?.pass) === undefined) {\n    void res\n      .code(401)\n      .header('WWW-Authenticate', 'Basic realm=\"Plannerz Protected Area\"')\n      .send('Unauthorized');\n    return;\n  }\n\n  const query = req.query as Record<string, unknown>;\n  const indent = query.pretty !== undefined ? 2 : undefined;\n  let bundle: PlannerzBundle;\n  try {\n    bundle = buildPlannerzBundle(lc, config, {\n      fullStat4: query.stat4 === 'full',\n    });\n  } catch (e) {\n    lc.error?.('error building plannerz bundle', e);\n    await res.code(500).send({error: String(e)});\n    return;\n  }\n  await res\n    .header('Content-Type', 'application/json')\n    .send(JSON.stringify(bundle, null, indent));\n}\n"],"mappings":";;;;;;;;;;;;;;;AAwBA,IAAM,qBACJ;AAEF,IAAM,cACJ;;;;;;AAQF,IAAM,QAAQ;CACZ,YACE;CAGF,aACE;CAKF,aACE;CAMF,uBAAuB;EACrB;EAEA;EAGA;CAGF;CACA,kBAAkB;EAChB;EAEA;EACA;EAEA;CACF;CACA,SAAS;EACP;EAEA;EAEA;CAGF;AACF;;;;;;AA2GA,SAAgB,WAAW,KAAoB;CAC7C,MAAM,SAAS,IAAI,KAAK,EAAE,MAAM,SAAS,EAAE,OAAO,OAAO;CACzD,MAAM,UAAoB,CAAC;CAC3B,MAAM,QAAkB,CAAC;CACzB,KAAK,MAAM,SAAS,QAGlB,IAAI,MAAM,WAAW,KAAK,MAAM,KAAK,KAAK,GACxC,QAAQ,KAAK,SAAS,OAAO,EAAE,CAAC;MAEhC,MAAM,KAAK,KAAK;CAGpB,OAAO;EACL;EACA,MAAM,QAAQ,MAAM;EACpB,kBAAkB,QAAQ,MAAM,CAAC;EACjC;CACF;AACF;;AAGA,IAAM,YAAY;;AAElB,IAAM,QAAQ;AAYd,SAAS,YAAY,IAAc,MAAuB;CACxD,OACE,GACG,QACC,kEACF,EACC,IAAI,IAAI,EAAE,SAAS;AAE1B;AAEA,SAAS,YAAY,KAAuB;CAC1C,OAAO,IACJ,KAAK,EACL,MAAM,SAAS,EACf,OAAO,OAAO,EACd,KAAI,MAAK,SAAS,GAAG,EAAE,CAAC;AAC7B;;;;;;;;AASA,SAAgB,oBACd,IACA,QACA,OAAsB,CAAC,GACP;;;EAEhB,OAAO,0BAA0B,IAAA,YAAA,EADtB,IAAI,SAAS,IAAI,OAAO,QAAQ,MAAM,EAAC,UAAU,KAAI,CAAC,CAC5B,GAAI,QAAQ,IAAI;;;;;;AACvD;;AAQA,SAAgB,0BACd,IACA,IACA,QACA,OAAsB,CAAC,GACP;CAChB,MAAM,SAAS,kBAAkB,IAAI,EAAE;CACvC,MAAM,UAAU,YAAY,EAAE;CAC9B,MAAM,WAAW,6BACf,QACA,SACA,EAAC,2BAA2B,MAAK,GACjC,KAAA,GACA,KAAA,GACA,EACF;CAEA,MAAM,eAAe,YAAY,IAAI,cAAc;CACnD,MAAM,uCAAuB,IAAI,IAAmB;CACpD,MAAM,+BAAe,IAAI,IAAmB;CAC5C,IAAI,cACF,KAAK,MAAM,EAAC,KAAK,KAAK,UAAS,GAC5B,QAAQ,yCAAyC,EACjD,IAAI,GAAiB;EACtB,MAAM,SAAS,WAAW,IAAI;EAC9B,IAAI,QAAQ,MACV,qBAAqB,IAAI,GAAG,IAAI,GAAG,OAAO,MAAM;EAKlD,IAAI,QAAQ,QAAQ,CAAC,aAAa,IAAI,GAAG,GACvC,aAAa,IAAI,KAAK,MAAM;CAEhC;CAGF,MAAM,eAAe,YAAY,IAAI,cAAc;CACnD,MAAM,uCAAuB,IAAI,IAA2B;CAC5D,IAAI,YAAY;CAChB,IAAI,cACF,KAAK,MAAM,EAAC,KAAK,KAAK,KAAK,KAAK,MAAM,YAAW,GAC9C,QAAQ,2DAA2D,EACnE,IAAI,GAAiB;EACtB;EACA,MAAM,UAAU,qBAAqB,IAAI,GAAG,IAAI,GAAG,KAAK,KAAK,CAAC;EAC9D,QAAQ,KAAK;GACX,KAAK,YAAY,GAAG;GACpB,KAAK,YAAY,GAAG;GACpB,MAAM,YAAY,IAAI;GAEtB,QAAQ,kBAAkB,MAAM;EAClC,CAAC;EACD,qBAAqB,IAAI,GAAG,IAAI,GAAG,OAAO,OAAO;CACnD;CAGF,MAAM,iCAAiB,IAAI,IAA0B;CACrD,KAAK,MAAM,SAAS,SAAS;EAC3B,MAAM,MAAM,GAAG,MAAM,UAAU,GAAG,MAAM;EACxC,MAAM,QAAQ,qBAAqB,IAAI,GAAG;EAC1C,MAAM,WAAW,eAAe,IAAI,MAAM,SAAS,KAAK,CAAC;EACzD,SAAS,KAAK;GACZ,MAAM,MAAM;GACZ,SAAS,OAAO,QAAQ,MAAM,OAAO,EAAE,KAAK,CAAC,MAAM,UAAU;IAC3D;IACA;GACF,EAAE;GACF,QAAQ,MAAM;GACd,SAAS,MAAM,YAAY;GAC3B,OAAO,qBAAqB,IAAI,GAAG;GACnC,OAAO,OAAO,SAAS,eAAe,KAAK,IAAI,KAAA;GAC/C,cAAc,KAAK,aAAa,OAAO,SAAS,QAAQ,KAAA;EAC1D,CAAC;EACD,eAAe,IAAI,MAAM,WAAW,QAAQ;CAC9C;CAEA,MAAM,qBAA+B,CAAC;CACtC,MAAM,aAAa,OAAO,KAAI,UAAS;EACrC,MAAM,UAAU,SAAS,IAAI,MAAM,IAAI,GAAG;EAC1C,IAAI,CAAC,aAAa,IAAI,MAAM,IAAI,GAC9B,mBAAmB,KAAK,MAAM,IAAI;EAEpC,MAAM,cAAc,IAAI,IAAI,MAAM,eAAe,CAAC,CAAC;EACnD,OAAO;GACL,MAAM,MAAM;GACZ,SAAS,OAAO,QAAQ,MAAM,OAAO,EAAE,KAAK,CAAC,MAAM,WAAW;IAC5D;IACA,UAAU,KAAK;IACf,UAAU,CAAC,KAAK;IAChB,SAAS,UAAU,OAAO,QAAQ;IAClC,GAAI,YAAY,IAAI,IAAI,IAAI,EAAC,aAAa,KAAa,IAAI,CAAC;GAC9D,EAAE;GACF,YAAY,MAAM,aAAa,CAAC,GAAG,MAAM,UAAU,IAAI,KAAA;GACvD,eAAe,aAAa,IAAI,MAAM,IAAI,GAAG;GAC7C,UAAU,YAAY,KAAA;GACtB,SAAS,eAAe,IAAI,MAAM,IAAI,KAAK,CAAC;EAC9C;CACF,CAAC;CAED,OAAO;EACL,OAAO;EACP,QAAQ;GACN,aAAa,iBAAiB,MAAM;GACpC,eAAe,cAAc,EAAE;GAC/B,kBAAkB,iBAAiB,IAAI,EAAE;GACzC,8BAAa,IAAI,KAAK,GAAE,YAAY;GACpC,SAAS;IACP,oBAAoB,OAAO;IAE3B,mCACE,OAAO,sCAAsC;IAC/C,4BAA4B,OAAO,+BAA+B;GACpE;EACF;EACA,cAAc;GACZ;GACA;GACA,QAAQ,YAAY,IAAI,cAAc;GACtC;EACF;EACA,QAAQ;CACV;AACF;;;;;;;AAQA,SAAS,kBAAkB,IAAgB,IAAc;CACvD,IAAI;EACF,OAAO,WAAW,EAAE;CACtB,SAAS,GAAG;EACV,GAAG,QAAQ,4DAA4D,CAAC;EACxE,OAAO,WAAW,IAAI,MAAM,KAAK;CACnC;AACF;;;;;;;;;;;;AAaA,SAAgB,eAAe,SAAsC;CACnE,MAAM,QAAQ,KAAK,IAAI,GAAG,QAAQ,KAAI,MAAK,EAAE,IAAI,MAAM,CAAC;CACxD,MAAM,YAAkC,CAAC;CACzC,KAAK,IAAI,IAAI,GAAG,IAAI,OAAO,KAAK;EAC9B,MAAM,SAAS,QACZ,KAAI,MAAK,EAAE,IAAI,EAAE,EACjB,QAAO,MAAK,MAAM,KAAA,CAAS,EAC3B,MAAM,GAAG,MAAM,IAAI,CAAC;EACvB,MAAM,mBAAmB,KAAK,IAC5B,GAAG,QAAQ,KAAI,MAAK,EAAE,KAAK,EAAE,EAAE,QAAO,MAAK,MAAM,KAAA,CAAS,CAC5D;EACA,UAAU,KAAK;GACb,eAAe,OAAO,GAAG,EAAE;GAC3B,kBAAkB,OAAO,KAAK,OAAO,OAAO,SAAS,KAAK,CAAC;GAC3D,uBAAuB,mBAAmB;EAC5C,CAAC;CACH;CACA,OAAO;EACL,SAAS,QAAQ;EAEjB,aAAa,QAAQ,GAAG;EACxB;CACF;AACF;AAEA,SAAS,cAAc,IAAsB;CAC3C,MAAM,CAAC,EAAC,aAAY,GACjB,QAAQ,oCAAoC,EAC5C,IAAI;CACP,OAAO;AACT;AAEA,SAAS,iBAAiB,IAAgB,IAAkC;CAC1E,IAAI;EACF,OAAO,oBAAoB,IAAI,gBAAgB,EAAE,CAAC,EAAE;CACtD,SAAS,GAAG;EAEV,GAAG,QAAQ,oCAAoC,CAAC;EAChD;CACF;AACF;;;;;;;;;;;;;;;;AAiBA,eAAsB,sBACpB,IACA,QACA,KACA,KACA;CAEA,IAAI,kBAAkB,IAAI,QADN,KAAK,GACS,GAAa,IAAI,MAAM,KAAA,GAAW;EAClE,IACG,KAAK,GAAG,EACR,OAAO,oBAAoB,yCAAuC,EAClE,KAAK,cAAc;EACtB;CACF;CAEA,MAAM,QAAQ,IAAI;CAClB,MAAM,SAAS,MAAM,WAAW,KAAA,IAAY,IAAI,KAAA;CAChD,IAAI;CACJ,IAAI;EACF,SAAS,oBAAoB,IAAI,QAAQ,EACvC,WAAW,MAAM,UAAU,OAC7B,CAAC;CACH,SAAS,GAAG;EACV,GAAG,QAAQ,kCAAkC,CAAC;EAC9C,MAAM,IAAI,KAAK,GAAG,EAAE,KAAK,EAAC,OAAO,OAAO,CAAC,EAAC,CAAC;EAC3C;CACF;CACA,MAAM,IACH,OAAO,gBAAgB,kBAAkB,EACzC,KAAK,KAAK,UAAU,QAAQ,MAAM,MAAM,CAAC;AAC9C"}
+{"version":3,"file":"plannerz.js","names":[],"sources":["../../../../../zero-cache/src/services/plannerz.ts"],"sourcesContent":["import type {LogContext} from '@rocicorp/logger';\nimport auth from 'basic-auth';\nimport type {FastifyReply, FastifyRequest} from 'fastify';\nimport {Database} from '../../../zqlite/src/db.ts';\nimport {\n  decodeSampleKinds,\n  type SampleValueKind,\n} from '../../../zqlite/src/sqlite-stat4-sample.ts';\nimport type {NormalizedZeroConfig as ZeroConfig} from '../config/normalize.ts';\nimport {getOperatorAccess, getServerVersion} from '../config/zero-config.ts';\nimport {\n  computeZqlSpecsFromLiteSpecs,\n  listIndexes,\n  listTables,\n} from '../db/lite-tables.ts';\nimport {StatementRunner} from '../db/statements.ts';\nimport {getReplicationState} from './replicator/schema/replication-state.ts';\n\n/**\n * How the statistics in the replica were gathered. zero-cache only ever runs\n * `PRAGMA optimize`, and always under an `analysis_limit`, which samples rather\n * than scanning. A replica that someone ran `ANALYZE` on by hand has better\n * statistics, which is visible in `sqlite_stat4` having rows at all.\n */\nconst APPROXIMATE_METHOD =\n  'PRAGMA optimize under an analysis_limit. Row counts and per-key averages ' +\n  'are sampled estimates, and sqlite_stat4 is not collected.';\nconst FULL_METHOD =\n  'ANALYZE, with no analysis limit. sqlite_stat4 has rows, so a full ANALYZE ' +\n  'ran against this replica at some point.';\n\n/**\n * A fixed glossary, sent with every bundle. The audience is a language model\n * that has the user's codebase but has never seen these statistics, and would\n * otherwise read a sampled estimate as an exact count.\n */\nconst ABOUT = {\n  whatThisIs:\n    'Schema, indexes and SQLite statistics for the SQLite replica that ' +\n    'zero-cache queries. Use it to decide how to rewrite ZQL queries and ' +\n    'which indexes to add. It contains no row data.',\n  stat1Format:\n    'sqlite_stat1.stat is \"<rows> <avg rows per distinct 1-column prefix> ' +\n    '<... per 2-column prefix> ...\", parsed here into `rows` and ' +\n    '`avgRowsPerPrefix`. NULLs count as ordinary values, so a sparse column ' +\n    'looks less selective than it is. Trailing flags such as \"unordered\", ' +\n    '\"noskipscan\" and \"sz=N\" are kept in `flags`.',\n  stat4Format:\n    'sqlite_stat4 is a per-index histogram. For each sample, `nEq` is the ' +\n    'rows equal to it, `nLt` the rows less than it, and `nDLt` the distinct ' +\n    'values less than it, one entry per key column. A large `nEq` next to a ' +\n    'small `nDLt` means a skewed column, where the average in stat1 hides ' +\n    'the common values. Sample values are never returned: `sample` reports ' +\n    'only each key column’s type.',\n  howThePlannerUsesThis: [\n    'Cost comes from SQLite scanstatus estimates for the SQL each source ' +\n      'connection would run, so the statistics here are what the planner sees.',\n    'Join fanout comes from sqlite_stat4, else sqlite_stat1, else a default ' +\n      'of 3. With no stat4 (the usual case) fanout on a nullable foreign key ' +\n      'is overestimated, because stat1 counts NULLs.',\n    'The planner chooses per join whether to run it as a semi-join or to flip ' +\n      'it so the child drives. An index that matches the child’s ' +\n      'constraint plus ordering is what makes a flip cheap.',\n  ],\n  whatYouCanChange: [\n    'The ZQL query: `whereExists` vs `related`, the order of conditions, and ' +\n      'ordering that matches an existing index.',\n    'A `limit`, which lets the planner stop early.',\n    'Indexes: add them in Postgres, not on the replica. The replica copies ' +\n      'upstream indexes, so a new index reaches it through replication.',\n    'The planner flags in `server.planner`.',\n  ],\n  caveats: [\n    'Row counts are estimates from the statistics, not COUNT(*). This ' +\n      'endpoint never scans a table.',\n    'Statistics are as of the last time they were gathered, which SQLite does ' +\n      'not record. A table whose size changed a lot since then can be far off.',\n    'Tables in `tables` with `syncable: false` cannot be queried by clients: ' +\n      'they lack a primary key or unique index, or every column has a type ' +\n      'ZQL does not support.',\n  ],\n} as const;\n\nexport type Stat1 = {\n  /** The raw `sqlite_stat1.stat` text, in case a flag is not parsed here. */\n  raw: string;\n  /** Estimated rows in the table. */\n  rows: number;\n  /**\n   * Average rows per distinct key prefix: the first entry is for a 1-column\n   * prefix, the second for 2 columns, and so on.\n   */\n  avgRowsPerPrefix: number[];\n  /** Non-numeric tokens, e.g. `unordered`, `noskipscan`, `sz=N`. */\n  flags: string[];\n};\n\n/** A `sqlite_stat4` sample with its values replaced by their types. */\nexport type Stat4Sample = {\n  nEq: number[];\n  nLt: number[];\n  nDLt: number[];\n  /** One entry per key column, plus the trailing rowid. */\n  sample: SampleValueKind[];\n};\n\n/**\n * A digest of an index's `sqlite_stat4` histogram, one entry per key prefix\n * depth. This is what the default response carries: a full histogram runs to\n * hundreds of samples per index, which is a lot of context to spend on data an\n * LLM would only summarize anyway.\n */\ntype Stat4PrefixSummary = {\n  /** Rows equal to the most common sampled key at this depth. */\n  maxRowsPerKey: number;\n  /** Median rows per sampled key at this depth. */\n  medianRowsPerKey: number;\n  /**\n   * Lower bound on distinct keys at this depth, from the last sample's count of\n   * distinct values less than it.\n   */\n  estimatedDistinctKeys: number;\n};\n\nexport type Stat4Summary = {\n  samples: number;\n  /** The type of each key column, and of the trailing rowid. */\n  sampleKinds: SampleValueKind[];\n  /** One entry per key prefix depth: 1 column, then 2, and so on. */\n  perPrefix: Stat4PrefixSummary[];\n};\n\ntype IndexStats = {\n  name: string;\n  columns: {name: string; dir: 'ASC' | 'DESC'}[];\n  unique: boolean;\n  partial: boolean;\n  stat1?: Stat1 | undefined;\n  stat4?: Stat4Summary | undefined;\n  /** The full histogram, only with `?stat4=full`. */\n  stat4Samples?: Stat4Sample[] | undefined;\n};\n\ntype ColumnStats = {\n  name: string;\n  dataType: string;\n  nullable: boolean;\n  /** The ZQL type, or `null` for a column clients cannot see. */\n  zqlType: string | null;\n  backfilling?: true | undefined;\n};\n\ntype TableStats = {\n  name: string;\n  columns: ColumnStats[];\n  primaryKey: string[] | undefined;\n  estimatedRows: number | undefined;\n  syncable: boolean;\n  indexes: IndexStats[];\n};\n\nexport type PlannerzBundle = {\n  about: typeof ABOUT;\n  server: {\n    zeroVersion: string;\n    sqliteVersion: string;\n    replicaWatermark: string | undefined;\n    generatedAt: string;\n    planner: {\n      enableQueryPlanner: boolean;\n      enableCorrelatedPredicatePushdown: boolean;\n      enablePlannerAwarePushdown: boolean;\n    };\n  };\n  statsQuality: {\n    stat1Present: boolean;\n    stat4Rows: number;\n    method: string;\n    tablesWithoutStats: string[];\n  };\n  tables: TableStats[];\n};\n\n/**\n * Parses a `sqlite_stat1.stat` value.\n *\n * @visibleForTesting\n */\nexport function parseStat1(raw: string): Stat1 {\n  const tokens = raw.trim().split(SEPARATOR).filter(Boolean);\n  const numbers: number[] = [];\n  const flags: string[] = [];\n  for (const token of tokens) {\n    // Only leading tokens are counts; anything else is a flag, even if it\n    // parses as a number (e.g. a future \"sz=N\" spelled differently).\n    if (flags.length === 0 && COUNT.test(token)) {\n      numbers.push(parseInt(token, 10));\n    } else {\n      flags.push(token);\n    }\n  }\n  return {\n    raw,\n    rows: numbers[0] ?? 0,\n    avgRowsPerPrefix: numbers.slice(1),\n    flags,\n  };\n}\n\n/** Whitespace between the counts in a `sqlite_stat1` or `sqlite_stat4` value. */\nconst SEPARATOR = /\\s+/;\n/** A count, as opposed to a trailing flag such as `unordered` or `sz=N`. */\nconst COUNT = /^\\d+$/;\n\ntype Stat1Row = {tbl: string; idx: string | null; stat: string};\ntype Stat4Row = {\n  tbl: string;\n  idx: string;\n  neq: string;\n  nlt: string;\n  ndlt: string;\n  sample: Buffer;\n};\n\nfunction tableExists(db: Database, name: string): boolean {\n  return (\n    db\n      .prepare(\n        `SELECT name FROM sqlite_master WHERE type = 'table' AND name = ?`,\n      )\n      .all(name).length > 0\n  );\n}\n\nfunction parseCounts(raw: string): number[] {\n  return raw\n    .trim()\n    .split(SEPARATOR)\n    .filter(Boolean)\n    .map(n => parseInt(n, 10));\n}\n\n/**\n * Builds the `/plannerz` bundle from the replica's catalog, `sqlite_stat*`\n * tables and the server config. No user table is read, so the cost does not\n * depend on how much data the replica holds.\n */\nfunction buildPlannerzBundle(\n  lc: LogContext,\n  config: ZeroConfig,\n  opts: BundleOptions = {},\n): PlannerzBundle {\n  using db = new Database(lc, config.replica.file, {readonly: true});\n  return buildPlannerzBundleFromDB(lc, db, config, opts);\n}\n\nexport type BundleOptions = {\n  /** Include the full `sqlite_stat4` histogram, not just the digest. */\n  fullStat4?: boolean | undefined;\n};\n\n/** @visibleForTesting */\nexport function buildPlannerzBundleFromDB(\n  lc: LogContext,\n  db: Database,\n  config: ZeroConfig,\n  opts: BundleOptions = {},\n): PlannerzBundle {\n  const tables = listReplicaTables(lc, db);\n  const indexes = listIndexes(db);\n  const zqlSpecs = computeZqlSpecsFromLiteSpecs(\n    tables,\n    indexes,\n    {includeBackfillingColumns: false},\n    undefined,\n    undefined,\n    lc,\n  );\n\n  const stat1Present = tableExists(db, 'sqlite_stat1');\n  const stat1ByTableAndIndex = new Map<string, Stat1>();\n  const statsByTable = new Map<string, Stat1>();\n  if (stat1Present) {\n    for (const {tbl, idx, stat} of db\n      .prepare(`SELECT tbl, idx, stat FROM sqlite_stat1`)\n      .all() as Stat1Row[]) {\n      const parsed = parseStat1(stat);\n      if (idx !== null) {\n        stat1ByTableAndIndex.set(`${tbl}.${idx}`, parsed);\n      }\n      // Every row for a table starts with the table's row count. A row with a\n      // null `idx` is written for a table with no indexes, and is preferred\n      // because it is about the table itself.\n      if (idx === null || !statsByTable.has(tbl)) {\n        statsByTable.set(tbl, parsed);\n      }\n    }\n  }\n\n  const stat4Present = tableExists(db, 'sqlite_stat4');\n  const stat4ByTableAndIndex = new Map<string, Stat4Sample[]>();\n  let stat4Rows = 0;\n  if (stat4Present) {\n    for (const {tbl, idx, neq, nlt, ndlt, sample} of db\n      .prepare(`SELECT tbl, idx, neq, nlt, ndlt, sample FROM sqlite_stat4`)\n      .all() as Stat4Row[]) {\n      stat4Rows++;\n      const samples = stat4ByTableAndIndex.get(`${tbl}.${idx}`) ?? [];\n      samples.push({\n        nEq: parseCounts(neq),\n        nLt: parseCounts(nlt),\n        nDLt: parseCounts(ndlt),\n        // Values are deliberately dropped here: only the types are reported.\n        sample: decodeSampleKinds(sample),\n      });\n      stat4ByTableAndIndex.set(`${tbl}.${idx}`, samples);\n    }\n  }\n\n  const indexesByTable = new Map<string, IndexStats[]>();\n  for (const index of indexes) {\n    const key = `${index.tableName}.${index.name}`;\n    const stat4 = stat4ByTableAndIndex.get(key);\n    const forTable = indexesByTable.get(index.tableName) ?? [];\n    forTable.push({\n      name: index.name,\n      columns: Object.entries(index.columns).map(([name, dir]) => ({\n        name,\n        dir,\n      })),\n      unique: index.unique,\n      partial: index.partial === true,\n      stat1: stat1ByTableAndIndex.get(key),\n      stat4: stat4?.length ? summarizeStat4(stat4) : undefined,\n      stat4Samples: opts.fullStat4 && stat4?.length ? stat4 : undefined,\n    });\n    indexesByTable.set(index.tableName, forTable);\n  }\n\n  const tablesWithoutStats: string[] = [];\n  const tableStats = tables.map(table => {\n    const zqlSpec = zqlSpecs.get(table.name)?.zqlSpec;\n    if (!statsByTable.has(table.name)) {\n      tablesWithoutStats.push(table.name);\n    }\n    const backfilling = new Set(table.backfilling ?? []);\n    return {\n      name: table.name,\n      columns: Object.entries(table.columns).map(([name, spec]) => ({\n        name,\n        dataType: spec.dataType,\n        nullable: !spec.notNull,\n        zqlType: zqlSpec?.[name]?.type ?? null,\n        ...(backfilling.has(name) ? {backfilling: true as const} : {}),\n      })),\n      primaryKey: table.primaryKey ? [...table.primaryKey] : undefined,\n      estimatedRows: statsByTable.get(table.name)?.rows,\n      syncable: zqlSpec !== undefined,\n      indexes: indexesByTable.get(table.name) ?? [],\n    };\n  });\n\n  return {\n    about: ABOUT,\n    server: {\n      zeroVersion: getServerVersion(config),\n      sqliteVersion: sqliteVersion(db),\n      replicaWatermark: replicaWatermark(lc, db),\n      generatedAt: new Date().toISOString(),\n      planner: {\n        enableQueryPlanner: config.enableQueryPlanner,\n        // Both default to on, matching services/analyze.ts.\n        enableCorrelatedPredicatePushdown:\n          config.enableCorrelatedPredicatePushdown !== false,\n        enablePlannerAwarePushdown: config.enablePlannerAwarePushdown !== false,\n      },\n    },\n    statsQuality: {\n      stat1Present,\n      stat4Rows,\n      method: stat4Rows > 0 ? FULL_METHOD : APPROXIMATE_METHOD,\n      tablesWithoutStats,\n    },\n    tables: tableStats,\n  };\n}\n\n/**\n * Lists the replica's tables, tolerating a replica that has no metadata tables\n * yet. `listTables` reads `_zero.tableMetadata` for backfill status, which does\n * not exist until initial sync has created it. Reporting the schema without\n * backfill status beats failing the whole request.\n */\nfunction listReplicaTables(lc: LogContext, db: Database) {\n  try {\n    return listTables(db);\n  } catch (e) {\n    lc.debug?.('reading table metadata failed; listing tables without it', e);\n    return listTables(db, true, false);\n  }\n}\n\n/**\n * Digests an index's stat4 samples.\n *\n * Note that `nLt` and `nDLt` are stored as text, so SQL cannot order the\n * samples by them numerically. This works off the whole set rather than\n * relying on the samples' order: the highest `nDLt` is a lower bound on the\n * distinct keys, since the sample holding it has that many distinct keys below\n * it plus itself.\n *\n * @visibleForTesting\n */\nexport function summarizeStat4(samples: Stat4Sample[]): Stat4Summary {\n  const depth = Math.max(...samples.map(s => s.nEq.length));\n  const perPrefix: Stat4PrefixSummary[] = [];\n  for (let d = 0; d < depth; d++) {\n    const counts = samples\n      .map(s => s.nEq[d])\n      .filter(n => n !== undefined)\n      .sort((a, b) => a - b);\n    const maxDistinctBelow = Math.max(\n      ...samples.map(s => s.nDLt[d]).filter(n => n !== undefined),\n    );\n    perPrefix.push({\n      maxRowsPerKey: counts.at(-1)!,\n      medianRowsPerKey: counts[Math.floor((counts.length - 1) / 2)],\n      estimatedDistinctKeys: maxDistinctBelow + 1,\n    });\n  }\n  return {\n    samples: samples.length,\n    // Every sample of an index describes the same columns.\n    sampleKinds: samples[0].sample,\n    perPrefix,\n  };\n}\n\nfunction sqliteVersion(db: Database): string {\n  const [{version}] = db\n    .prepare(`SELECT sqlite_version() AS version`)\n    .all() as {version: string}[];\n  return version;\n}\n\nfunction replicaWatermark(lc: LogContext, db: Database): string | undefined {\n  try {\n    return getReplicationState(new StatementRunner(db)).stateVersion;\n  } catch (e) {\n    // A replica that has not finished initial sync has no replication state.\n    lc.debug?.('could not read replication state', e);\n    return undefined;\n  }\n}\n\n/**\n * Serves the replica's schema, indexes and SQLite statistics for consumption by\n * a language model, so that it can advise on query rewrites and indexes.\n *\n * Row data is never returned. See `designs/003_replica_stats_endpoint.md`.\n *\n * This is available to the operator password as well as the admin password\n * (see `--operator-password`). That does not extend to `/plannerz/analyze`,\n * which runs caller-supplied queries against the replica and so must require\n * the admin password (`isAdminPasswordValid`).\n *\n * HTTP query parameters:\n * * `pretty`: indents the JSON\n * * `stat4=full`: includes the full sqlite_stat4 histogram, which is large\n */\nexport async function handlePlannerzRequest(\n  lc: LogContext,\n  config: ZeroConfig,\n  req: FastifyRequest,\n  res: FastifyReply,\n) {\n  const credentials = auth(req);\n  if (getOperatorAccess(lc, config, credentials?.pass) === undefined) {\n    void res\n      .code(401)\n      .header('WWW-Authenticate', 'Basic realm=\"Plannerz Protected Area\"')\n      .send('Unauthorized');\n    return;\n  }\n\n  const query = req.query as Record<string, unknown>;\n  const indent = query.pretty !== undefined ? 2 : undefined;\n  let bundle: PlannerzBundle;\n  try {\n    bundle = buildPlannerzBundle(lc, config, {\n      fullStat4: query.stat4 === 'full',\n    });\n  } catch (e) {\n    lc.error?.('error building plannerz bundle', e);\n    await res.code(500).send({error: String(e)});\n    return;\n  }\n  await res\n    .header('Content-Type', 'application/json')\n    .send(JSON.stringify(bundle, null, indent));\n}\n"],"mappings":";;;;;;;;;;;;;;;AAwBA,IAAM,qBACJ;AAEF,IAAM,cACJ;;;;;;AAQF,IAAM,QAAQ;CACZ,YACE;CAGF,aACE;CAKF,aACE;CAMF,uBAAuB;EACrB;EAEA;EAGA;CAGF;CACA,kBAAkB;EAChB;EAEA;EACA;EAEA;CACF;CACA,SAAS;EACP;EAEA;EAEA;CAGF;AACF;;;;;;AA2GA,SAAgB,WAAW,KAAoB;CAC7C,MAAM,SAAS,IAAI,KAAK,CAAC,CAAC,MAAM,SAAS,CAAC,CAAC,OAAO,OAAO;CACzD,MAAM,UAAoB,CAAC;CAC3B,MAAM,QAAkB,CAAC;CACzB,KAAK,MAAM,SAAS,QAGlB,IAAI,MAAM,WAAW,KAAK,MAAM,KAAK,KAAK,GACxC,QAAQ,KAAK,SAAS,OAAO,EAAE,CAAC;MAEhC,MAAM,KAAK,KAAK;CAGpB,OAAO;EACL;EACA,MAAM,QAAQ,MAAM;EACpB,kBAAkB,QAAQ,MAAM,CAAC;EACjC;CACF;AACF;;AAGA,IAAM,YAAY;;AAElB,IAAM,QAAQ;AAYd,SAAS,YAAY,IAAc,MAAuB;CACxD,OACE,GACG,QACC,kEACF,CAAC,CACA,IAAI,IAAI,CAAC,CAAC,SAAS;AAE1B;AAEA,SAAS,YAAY,KAAuB;CAC1C,OAAO,IACJ,KAAK,CAAC,CACN,MAAM,SAAS,CAAC,CAChB,OAAO,OAAO,CAAC,CACf,KAAI,MAAK,SAAS,GAAG,EAAE,CAAC;AAC7B;;;;;;AAOA,SAAS,oBACP,IACA,QACA,OAAsB,CAAC,GACP;;;EAEhB,OAAO,0BAA0B,IAAA,YAAA,EADtB,IAAI,SAAS,IAAI,OAAO,QAAQ,MAAM,EAAC,UAAU,KAAI,CAAC,CAC5B,GAAI,QAAQ,IAAI;;;;;;AACvD;;AAQA,SAAgB,0BACd,IACA,IACA,QACA,OAAsB,CAAC,GACP;CAChB,MAAM,SAAS,kBAAkB,IAAI,EAAE;CACvC,MAAM,UAAU,YAAY,EAAE;CAC9B,MAAM,WAAW,6BACf,QACA,SACA,EAAC,2BAA2B,MAAK,GACjC,KAAA,GACA,KAAA,GACA,EACF;CAEA,MAAM,eAAe,YAAY,IAAI,cAAc;CACnD,MAAM,uCAAuB,IAAI,IAAmB;CACpD,MAAM,+BAAe,IAAI,IAAmB;CAC5C,IAAI,cACF,KAAK,MAAM,EAAC,KAAK,KAAK,UAAS,GAC5B,QAAQ,yCAAyC,CAAC,CAClD,IAAI,GAAiB;EACtB,MAAM,SAAS,WAAW,IAAI;EAC9B,IAAI,QAAQ,MACV,qBAAqB,IAAI,GAAG,IAAI,GAAG,OAAO,MAAM;EAKlD,IAAI,QAAQ,QAAQ,CAAC,aAAa,IAAI,GAAG,GACvC,aAAa,IAAI,KAAK,MAAM;CAEhC;CAGF,MAAM,eAAe,YAAY,IAAI,cAAc;CACnD,MAAM,uCAAuB,IAAI,IAA2B;CAC5D,IAAI,YAAY;CAChB,IAAI,cACF,KAAK,MAAM,EAAC,KAAK,KAAK,KAAK,KAAK,MAAM,YAAW,GAC9C,QAAQ,2DAA2D,CAAC,CACpE,IAAI,GAAiB;EACtB;EACA,MAAM,UAAU,qBAAqB,IAAI,GAAG,IAAI,GAAG,KAAK,KAAK,CAAC;EAC9D,QAAQ,KAAK;GACX,KAAK,YAAY,GAAG;GACpB,KAAK,YAAY,GAAG;GACpB,MAAM,YAAY,IAAI;GAEtB,QAAQ,kBAAkB,MAAM;EAClC,CAAC;EACD,qBAAqB,IAAI,GAAG,IAAI,GAAG,OAAO,OAAO;CACnD;CAGF,MAAM,iCAAiB,IAAI,IAA0B;CACrD,KAAK,MAAM,SAAS,SAAS;EAC3B,MAAM,MAAM,GAAG,MAAM,UAAU,GAAG,MAAM;EACxC,MAAM,QAAQ,qBAAqB,IAAI,GAAG;EAC1C,MAAM,WAAW,eAAe,IAAI,MAAM,SAAS,KAAK,CAAC;EACzD,SAAS,KAAK;GACZ,MAAM,MAAM;GACZ,SAAS,OAAO,QAAQ,MAAM,OAAO,CAAC,CAAC,KAAK,CAAC,MAAM,UAAU;IAC3D;IACA;GACF,EAAE;GACF,QAAQ,MAAM;GACd,SAAS,MAAM,YAAY;GAC3B,OAAO,qBAAqB,IAAI,GAAG;GACnC,OAAO,OAAO,SAAS,eAAe,KAAK,IAAI,KAAA;GAC/C,cAAc,KAAK,aAAa,OAAO,SAAS,QAAQ,KAAA;EAC1D,CAAC;EACD,eAAe,IAAI,MAAM,WAAW,QAAQ;CAC9C;CAEA,MAAM,qBAA+B,CAAC;CACtC,MAAM,aAAa,OAAO,KAAI,UAAS;EACrC,MAAM,UAAU,SAAS,IAAI,MAAM,IAAI,CAAC,EAAE;EAC1C,IAAI,CAAC,aAAa,IAAI,MAAM,IAAI,GAC9B,mBAAmB,KAAK,MAAM,IAAI;EAEpC,MAAM,cAAc,IAAI,IAAI,MAAM,eAAe,CAAC,CAAC;EACnD,OAAO;GACL,MAAM,MAAM;GACZ,SAAS,OAAO,QAAQ,MAAM,OAAO,CAAC,CAAC,KAAK,CAAC,MAAM,WAAW;IAC5D;IACA,UAAU,KAAK;IACf,UAAU,CAAC,KAAK;IAChB,SAAS,UAAU,KAAK,EAAE,QAAQ;IAClC,GAAI,YAAY,IAAI,IAAI,IAAI,EAAC,aAAa,KAAa,IAAI,CAAC;GAC9D,EAAE;GACF,YAAY,MAAM,aAAa,CAAC,GAAG,MAAM,UAAU,IAAI,KAAA;GACvD,eAAe,aAAa,IAAI,MAAM,IAAI,CAAC,EAAE;GAC7C,UAAU,YAAY,KAAA;GACtB,SAAS,eAAe,IAAI,MAAM,IAAI,KAAK,CAAC;EAC9C;CACF,CAAC;CAED,OAAO;EACL,OAAO;EACP,QAAQ;GACN,aAAa,iBAAiB,MAAM;GACpC,eAAe,cAAc,EAAE;GAC/B,kBAAkB,iBAAiB,IAAI,EAAE;GACzC,8BAAa,IAAI,KAAK,EAAA,CAAE,YAAY;GACpC,SAAS;IACP,oBAAoB,OAAO;IAE3B,mCACE,OAAO,sCAAsC;IAC/C,4BAA4B,OAAO,+BAA+B;GACpE;EACF;EACA,cAAc;GACZ;GACA;GACA,QAAQ,YAAY,IAAI,cAAc;GACtC;EACF;EACA,QAAQ;CACV;AACF;;;;;;;AAQA,SAAS,kBAAkB,IAAgB,IAAc;CACvD,IAAI;EACF,OAAO,WAAW,EAAE;CACtB,SAAS,GAAG;EACV,GAAG,QAAQ,4DAA4D,CAAC;EACxE,OAAO,WAAW,IAAI,MAAM,KAAK;CACnC;AACF;;;;;;;;;;;;AAaA,SAAgB,eAAe,SAAsC;CACnE,MAAM,QAAQ,KAAK,IAAI,GAAG,QAAQ,KAAI,MAAK,EAAE,IAAI,MAAM,CAAC;CACxD,MAAM,YAAkC,CAAC;CACzC,KAAK,IAAI,IAAI,GAAG,IAAI,OAAO,KAAK;EAC9B,MAAM,SAAS,QACZ,KAAI,MAAK,EAAE,IAAI,EAAE,CAAC,CAClB,QAAO,MAAK,MAAM,KAAA,CAAS,CAAC,CAC5B,MAAM,GAAG,MAAM,IAAI,CAAC;EACvB,MAAM,mBAAmB,KAAK,IAC5B,GAAG,QAAQ,KAAI,MAAK,EAAE,KAAK,EAAE,CAAC,CAAC,QAAO,MAAK,MAAM,KAAA,CAAS,CAC5D;EACA,UAAU,KAAK;GACb,eAAe,OAAO,GAAG,EAAE;GAC3B,kBAAkB,OAAO,KAAK,OAAO,OAAO,SAAS,KAAK,CAAC;GAC3D,uBAAuB,mBAAmB;EAC5C,CAAC;CACH;CACA,OAAO;EACL,SAAS,QAAQ;EAEjB,aAAa,QAAQ,EAAE,CAAC;EACxB;CACF;AACF;AAEA,SAAS,cAAc,IAAsB;CAC3C,MAAM,CAAC,EAAC,aAAY,GACjB,QAAQ,oCAAoC,CAAC,CAC7C,IAAI;CACP,OAAO;AACT;AAEA,SAAS,iBAAiB,IAAgB,IAAkC;CAC1E,IAAI;EACF,OAAO,oBAAoB,IAAI,gBAAgB,EAAE,CAAC,CAAC,CAAC;CACtD,SAAS,GAAG;EAEV,GAAG,QAAQ,oCAAoC,CAAC;EAChD;CACF;AACF;;;;;;;;;;;;;;;;AAiBA,eAAsB,sBACpB,IACA,QACA,KACA,KACA;CACA,MAAM,cAAc,KAAK,GAAG;CAC5B,IAAI,kBAAkB,IAAI,QAAQ,aAAa,IAAI,MAAM,KAAA,GAAW;EAClE,IACG,KAAK,GAAG,CAAC,CACT,OAAO,oBAAoB,yCAAuC,CAAC,CACnE,KAAK,cAAc;EACtB;CACF;CAEA,MAAM,QAAQ,IAAI;CAClB,MAAM,SAAS,MAAM,WAAW,KAAA,IAAY,IAAI,KAAA;CAChD,IAAI;CACJ,IAAI;EACF,SAAS,oBAAoB,IAAI,QAAQ,EACvC,WAAW,MAAM,UAAU,OAC7B,CAAC;CACH,SAAS,GAAG;EACV,GAAG,QAAQ,kCAAkC,CAAC;EAC9C,MAAM,IAAI,KAAK,GAAG,CAAC,CAAC,KAAK,EAAC,OAAO,OAAO,CAAC,EAAC,CAAC;EAC3C;CACF;CACA,MAAM,IACH,OAAO,gBAAgB,kBAAkB,CAAC,CAC1C,KAAK,KAAK,UAAU,QAAQ,MAAM,MAAM,CAAC;AAC9C"}

package/out/zero-cache/src/services/profz.js

@@ -18,7 +18,8 @@ import auth from "basic-auth";
 * sources are redacted for `operator` access. See {@link redactProfile}.
 */
 async function handleProfzRequest(lc, config, req, res, getWorker, forcedWorker, localProcessName = "dispatcher") {
-	const access = getOperatorAccess(lc, config, auth(req)?.pass);
+	const credentials = auth(req);
+	const access = getOperatorAccess(lc, config, credentials?.pass);
 	if (access === void 0) {
 		res.code(401).header("WWW-Authenticate", "Basic realm=\"Profz Protected Area\"").send("Unauthorized");
 		return;
@@ -99,7 +100,8 @@ async function handleProfzRequest(lc, config, req, res, getWorker, forcedWorker,
 	res.header("Content-Type", "application/json").header("Content-Disposition", `attachment; filename="zero-profile-bundle-${Date.now()}.json"`).send(bundle);
 }
 async function handleProfrmzRequest(lc, config, req, res, getWorker) {
-	if (getOperatorAccess(lc, config, auth(req)?.pass) === void 0) {
+	const credentials = auth(req);
+	if (getOperatorAccess(lc, config, credentials?.pass) === void 0) {
 		res.code(401).header("WWW-Authenticate", "Basic realm=\"Profrmz Protected Area\"").send("Unauthorized");
 		return;
 	}
@@ -158,6 +160,6 @@ function redactProfile(profile) {
 	};
 }
 //#endregion
-export { handleProfrmzRequest, handleProfzRequest };
+export { handleProfrmzRequest, handleProfzRequest, redactProfile };
 
 //# sourceMappingURL=profz.js.map

package/out/zero-cache/src/services/profz.js.map

@@ -1 +1 @@
-{"version":3,"file":"profz.js","names":[],"sources":["../../../../../zero-cache/src/services/profz.ts"],"sourcesContent":["import {randomUUID} from 'node:crypto';\nimport type {Profiler} from 'node:inspector';\nimport type {LogContext} from '@rocicorp/logger';\nimport auth from 'basic-auth';\nimport type {FastifyReply, FastifyRequest} from 'fastify';\nimport {sleep} from '../../../shared/src/sleep.ts';\nimport type {NormalizedZeroConfig} from '../config/normalize.ts';\nimport {getOperatorAccess} from '../config/zero-config.ts';\nimport {\n  singleProcessMode,\n  subscribeToMessageType,\n  type ProfileResponse,\n  type ProfileResponseMessage,\n  type Worker,\n} from '../types/processes.ts';\nimport {CpuProfiler} from '../types/profiler.ts';\nimport {URLParams} from '../types/url-params.ts';\n\n/**\n * Serves CPU profiles. This is available to the operator password as well as\n * the admin password (see `--operator-password`), so it must never serve\n * application data to `operator` access.\n *\n * A V8 CPU profile describes code, not data: function names, script URLs and\n * positions, and sample timings. The exception is a regular expression, which\n * V8 names after its source (`RegExp: <source>`). zero-cache compiles `LIKE`\n * and `ILIKE` patterns from client queries into regular expressions, so their\n * sources are redacted for `operator` access. See {@link redactProfile}.\n */\nexport async function handleProfzRequest(\n  lc: LogContext,\n  config: Pick<NormalizedZeroConfig, 'adminPassword' | 'operatorPassword'>,\n  req: FastifyRequest,\n  res: FastifyReply,\n  getWorker?: (() => Promise<Worker>) | undefined,\n  forcedWorker?: string | undefined,\n  localProcessName: string = 'dispatcher',\n): Promise<void> {\n  const credentials = auth(req);\n  const access = getOperatorAccess(lc, config, credentials?.pass);\n  if (access === undefined) {\n    void res\n      .code(401)\n      .header('WWW-Authenticate', 'Basic realm=\"Profz Protected Area\"')\n      .send('Unauthorized');\n    return;\n  }\n\n  const params = new URLParams(new URL(req.url, 'http://localhost'));\n  const rawDuration =\n    params.getInteger('duration', false) ??\n    params.getInteger('seconds', false) ??\n    5;\n  const durationSec = Math.max(1, Math.min(60, rawDuration));\n  const durationMs = durationSec * 1000;\n  const targetWorker = forcedWorker ?? params.get('worker', false) ?? undefined;\n  const targetWorkerIndex = params.getInteger('index', false) ?? undefined;\n  const id = randomUUID();\n\n  const responses = new Map<string, unknown>();\n\n  // Profile dispatcher / local process if requested, when profiling all processes,\n  // or when no worker dispatcher is available (single process / standalone mode)\n  const shouldProfileLocal =\n    singleProcessMode() ||\n    getWorker === undefined ||\n    targetWorker === undefined ||\n    targetWorker === localProcessName;\n\n  const localProfilePromise = shouldProfileLocal\n    ? CpuProfiler.profile(durationMs).catch(err => {\n        lc.warn?.('Failed to capture local CPU profile:', err);\n        return null;\n      })\n    : Promise.resolve(null);\n\n  if (!singleProcessMode() && getWorker !== undefined) {\n    try {\n      const worker = await getWorker();\n      const onMessage = (msg: ProfileResponse) => {\n        if (msg.id === id && msg.profile) {\n          responses.set(msg.name, msg.profile);\n        } else if (msg.id === id && msg.error) {\n          lc.warn?.(`Worker ${msg.name} profile error: ${msg.error}`);\n        }\n      };\n\n      // The worker is long-lived (and shared across requests), so the\n      // per-request handler must be removed once this request is done.\n      const unsubscribe = subscribeToMessageType<ProfileResponseMessage>(\n        worker,\n        'profileResponse',\n        onMessage,\n      );\n      try {\n        worker.send([\n          'profile',\n          {\n            id,\n            durationMs,\n            worker:\n              targetWorker === localProcessName ? '__none__' : targetWorker,\n            workerIndex: targetWorkerIndex,\n          },\n        ]);\n\n        // Wait for profile duration, then wait for child workers to transfer\n        // profiles over IPC. Under heavy production load, serializing and sending\n        // large CPU profiles can take several seconds.\n        const graceMs =\n          params.getInteger('graceMs', false) ??\n          params.getInteger('timeout', false) ??\n          5000;\n        await sleep(durationMs);\n\n        const pollMs = 50;\n        let waited = 0;\n        let lastCount = responses.size;\n        let quietMs = 0;\n        while (waited < graceMs) {\n          await sleep(pollMs);\n          waited += pollMs;\n\n          if (targetWorker && targetWorker !== 'all') {\n            const hasTarget = [...responses.keys()].some(\n              name =>\n                name === targetWorker || name.startsWith(`${targetWorker}-`),\n            );\n            if (hasTarget) {\n              break;\n            }\n          } else if (responses.size !== lastCount) {\n            lastCount = responses.size;\n            quietMs = 0;\n          } else if (responses.size > 0) {\n            quietMs += pollMs;\n            if (quietMs >= 400) {\n              break;\n            }\n          }\n        }\n      } finally {\n        unsubscribe();\n      }\n    } catch (err) {\n      lc.warn?.('Failed to dispatch profile request to child workers:', err);\n    }\n  }\n\n  const localProfile = await localProfilePromise;\n  if (localProfile) {\n    const localName =\n      targetWorker ?? (singleProcessMode() ? 'zero-cache' : localProcessName);\n    responses.set(localName, localProfile);\n  }\n\n  if (access === 'operator') {\n    for (const [name, prof] of responses) {\n      responses.set(name, redactProfile(prof));\n    }\n  }\n\n  // If a single specific worker was requested, return that profile directly\n  if (targetWorker !== undefined && targetWorker !== 'all') {\n    let matchedProfile = responses.get(targetWorker);\n    if (!matchedProfile) {\n      // Try matching by prefix or substring (e.g. 'syncer' matches 'syncer-0')\n      for (const [name, prof] of responses.entries()) {\n        if (name === targetWorker || name.startsWith(`${targetWorker}-`)) {\n          matchedProfile = prof;\n          break;\n        }\n      }\n    }\n\n    if (matchedProfile) {\n      void res\n        .header('Content-Type', 'application/json')\n        .header(\n          'Content-Disposition',\n          `attachment; filename=\"${targetWorker}.cpuprofile\"`,\n        )\n        .send(matchedProfile);\n      return;\n    }\n\n    void res.code(404).send({\n      error: `No profile captured for worker \"${targetWorker}\". Available: ${[...responses.keys()].join(', ')}`,\n    });\n    return;\n  }\n\n  // Default (Option A): Return multi-process profile bundle as a JSON map\n  const bundle: Record<string, unknown> = {};\n  for (const [name, prof] of responses.entries()) {\n    bundle[name] = prof;\n  }\n\n  void res\n    .header('Content-Type', 'application/json')\n    .header(\n      'Content-Disposition',\n      `attachment; filename=\"zero-profile-bundle-${Date.now()}.json\"`,\n    )\n    .send(bundle);\n}\n\nexport async function handleProfrmzRequest(\n  lc: LogContext,\n  config: NormalizedZeroConfig,\n  req: FastifyRequest,\n  res: FastifyReply,\n  getWorker?: (() => Promise<Worker>) | undefined,\n): Promise<void> {\n  const credentials = auth(req);\n  if (getOperatorAccess(lc, config, credentials?.pass) === undefined) {\n    void res\n      .code(401)\n      .header('WWW-Authenticate', 'Basic realm=\"Profrmz Protected Area\"')\n      .send('Unauthorized');\n    return;\n  }\n\n  // In distributed mode, proxy to the upstream Replication Manager. The\n  // credentials are forwarded, and the Replication Manager's /profz decides\n  // for itself what access they grant (and so what to redact).\n  if (config.changeStreamer.uri) {\n    const upstreamURL = new URL('/profz', config.changeStreamer.uri);\n    if (upstreamURL.protocol === 'ws:') {\n      upstreamURL.protocol = 'http:';\n    } else if (upstreamURL.protocol === 'wss:') {\n      upstreamURL.protocol = 'https:';\n    }\n    const incomingURL = new URL(req.url, 'http://localhost');\n    for (const [key, value] of incomingURL.searchParams.entries()) {\n      upstreamURL.searchParams.set(key, value);\n    }\n\n    try {\n      const headers: Record<string, string> = {};\n      if (req.headers.authorization) {\n        headers.authorization = req.headers.authorization;\n      }\n      const response = await fetch(upstreamURL.toString(), {\n        method: 'GET',\n        headers,\n      });\n\n      res.code(response.status);\n      const contentType = response.headers.get('content-type');\n      if (contentType) {\n        res.header('content-type', contentType);\n      }\n      const contentDisposition = response.headers.get('content-disposition');\n      if (contentDisposition) {\n        res.header('content-disposition', contentDisposition);\n      }\n\n      const body = await response.text();\n      return res.send(body);\n    } catch (err) {\n      lc.error?.(`Failed to proxy /profrmz to RM at ${upstreamURL}:`, err);\n      return res.code(502).send({\n        error: `Failed to proxy profiling request to RM at ${upstreamURL}: ${String(err)}`,\n      });\n    }\n  }\n\n  // In single-node mode, profile local change-streamer / RM process\n  return handleProfzRequest(lc, config, req, res, getWorker, 'change-streamer');\n}\n\n// V8 names the code for a regular expression `RegExp: <source>`.\nconst REGEXP_NAME_PREFIX = 'RegExp:';\nconst REDACTED_REGEXP_NAME = 'RegExp: <redacted>';\n\n/**\n * Returns a copy of the V8 CPU `profile` with the source of every regular\n * expression replaced, since a pattern built at runtime can contain\n * application data (e.g. a `LIKE` pattern from a client query). The time spent\n * in regular expressions is still attributed to them.\n *\n * A `profile` that is not in the expected format is withheld rather than\n * served unredacted.\n *\n * @visibleForTesting\n */\nexport function redactProfile(profile: unknown): unknown {\n  const {nodes} = (profile ?? {}) as Partial<Profiler.Profile>;\n  if (!Array.isArray(nodes)) {\n    return {error: 'Profile withheld: unrecognized format'};\n  }\n  return {\n    ...(profile as Profiler.Profile),\n    nodes: nodes.map(node =>\n      node.callFrame?.functionName?.startsWith(REGEXP_NAME_PREFIX)\n        ? {\n            ...node,\n            callFrame: {...node.callFrame, functionName: REDACTED_REGEXP_NAME},\n          }\n        : node,\n    ),\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AA6BA,eAAsB,mBACpB,IACA,QACA,KACA,KACA,WACA,cACA,mBAA2B,cACZ;CAEf,MAAM,SAAS,kBAAkB,IAAI,QADjB,KAAK,GACoB,GAAa,IAAI;CAC9D,IAAI,WAAW,KAAA,GAAW;EACxB,IACG,KAAK,GAAG,EACR,OAAO,oBAAoB,sCAAoC,EAC/D,KAAK,cAAc;EACtB;CACF;CAEA,MAAM,SAAS,IAAI,UAAU,IAAI,IAAI,IAAI,KAAK,kBAAkB,CAAC;CACjE,MAAM,cACJ,OAAO,WAAW,YAAY,KAAK,KACnC,OAAO,WAAW,WAAW,KAAK,KAClC;CAEF,MAAM,aADc,KAAK,IAAI,GAAG,KAAK,IAAI,IAAI,WAAW,CACrC,IAAc;CACjC,MAAM,eAAe,gBAAgB,OAAO,IAAI,UAAU,KAAK,KAAK,KAAA;CACpE,MAAM,oBAAoB,OAAO,WAAW,SAAS,KAAK,KAAK,KAAA;CAC/D,MAAM,KAAK,WAAW;CAEtB,MAAM,4BAAY,IAAI,IAAqB;CAU3C,MAAM,sBALJ,kBAAkB,KAClB,cAAc,KAAA,KACd,iBAAiB,KAAA,KACjB,iBAAiB,mBAGf,YAAY,QAAQ,UAAU,EAAE,OAAM,QAAO;EAC3C,GAAG,OAAO,wCAAwC,GAAG;EACrD,OAAO;CACT,CAAC,IACD,QAAQ,QAAQ,IAAI;CAExB,IAAI,CAAC,kBAAkB,KAAK,cAAc,KAAA,GACxC,IAAI;EACF,MAAM,SAAS,MAAM,UAAU;EAC/B,MAAM,aAAa,QAAyB;GAC1C,IAAI,IAAI,OAAO,MAAM,IAAI,SACvB,UAAU,IAAI,IAAI,MAAM,IAAI,OAAO;QAC9B,IAAI,IAAI,OAAO,MAAM,IAAI,OAC9B,GAAG,OAAO,UAAU,IAAI,KAAK,kBAAkB,IAAI,OAAO;EAE9D;EAIA,MAAM,cAAc,uBAClB,QACA,mBACA,SACF;EACA,IAAI;GACF,OAAO,KAAK,CACV,WACA;IACE;IACA;IACA,QACE,iBAAiB,mBAAmB,aAAa;IACnD,aAAa;GACf,CACF,CAAC;GAKD,MAAM,UACJ,OAAO,WAAW,WAAW,KAAK,KAClC,OAAO,WAAW,WAAW,KAAK,KAClC;GACF,MAAM,MAAM,UAAU;GAEtB,MAAM,SAAS;GACf,IAAI,SAAS;GACb,IAAI,YAAY,UAAU;GAC1B,IAAI,UAAU;GACd,OAAO,SAAS,SAAS;IACvB,MAAM,MAAM,MAAM;IAClB,UAAU;IAEV,IAAI,gBAAgB,iBAAiB;SACjB,CAAC,GAAG,UAAU,KAAK,CAAC,EAAE,MACtC,SACE,SAAS,gBAAgB,KAAK,WAAW,GAAG,aAAa,EAAE,CAE3D,GACF;IAAA,OAEG,IAAI,UAAU,SAAS,WAAW;KACvC,YAAY,UAAU;KACtB,UAAU;IACZ,OAAO,IAAI,UAAU,OAAO,GAAG;KAC7B,WAAW;KACX,IAAI,WAAW,KACb;IAEJ;GACF;EACF,UAAU;GACR,YAAY;EACd;CACF,SAAS,KAAK;EACZ,GAAG,OAAO,wDAAwD,GAAG;CACvE;CAGF,MAAM,eAAe,MAAM;CAC3B,IAAI,cAAc;EAChB,MAAM,YACJ,iBAAiB,kBAAkB,IAAI,eAAe;EACxD,UAAU,IAAI,WAAW,YAAY;CACvC;CAEA,IAAI,WAAW,YACb,KAAK,MAAM,CAAC,MAAM,SAAS,WACzB,UAAU,IAAI,MAAM,cAAc,IAAI,CAAC;CAK3C,IAAI,iBAAiB,KAAA,KAAa,iBAAiB,OAAO;EACxD,IAAI,iBAAiB,UAAU,IAAI,YAAY;EAC/C,IAAI,CAAC;QAEE,MAAM,CAAC,MAAM,SAAS,UAAU,QAAQ,GAC3C,IAAI,SAAS,gBAAgB,KAAK,WAAW,GAAG,aAAa,EAAE,GAAG;IAChE,iBAAiB;IACjB;GACF;;EAIJ,IAAI,gBAAgB;GAClB,IACG,OAAO,gBAAgB,kBAAkB,EACzC,OACC,uBACA,yBAAyB,aAAa,aACxC,EACC,KAAK,cAAc;GACtB;EACF;EAEA,IAAS,KAAK,GAAG,EAAE,KAAK,EACtB,OAAO,mCAAmC,aAAa,gBAAgB,CAAC,GAAG,UAAU,KAAK,CAAC,EAAE,KAAK,IAAI,IACxG,CAAC;EACD;CACF;CAGA,MAAM,SAAkC,CAAC;CACzC,KAAK,MAAM,CAAC,MAAM,SAAS,UAAU,QAAQ,GAC3C,OAAO,QAAQ;CAGjB,IACG,OAAO,gBAAgB,kBAAkB,EACzC,OACC,uBACA,6CAA6C,KAAK,IAAI,EAAE,OAC1D,EACC,KAAK,MAAM;AAChB;AAEA,eAAsB,qBACpB,IACA,QACA,KACA,KACA,WACe;CAEf,IAAI,kBAAkB,IAAI,QADN,KAAK,GACS,GAAa,IAAI,MAAM,KAAA,GAAW;EAClE,IACG,KAAK,GAAG,EACR,OAAO,oBAAoB,wCAAsC,EACjE,KAAK,cAAc;EACtB;CACF;CAKA,IAAI,OAAO,eAAe,KAAK;EAC7B,MAAM,cAAc,IAAI,IAAI,UAAU,OAAO,eAAe,GAAG;EAC/D,IAAI,YAAY,aAAa,OAC3B,YAAY,WAAW;OAClB,IAAI,YAAY,aAAa,QAClC,YAAY,WAAW;EAEzB,MAAM,cAAc,IAAI,IAAI,IAAI,KAAK,kBAAkB;EACvD,KAAK,MAAM,CAAC,KAAK,UAAU,YAAY,aAAa,QAAQ,GAC1D,YAAY,aAAa,IAAI,KAAK,KAAK;EAGzC,IAAI;GACF,MAAM,UAAkC,CAAC;GACzC,IAAI,IAAI,QAAQ,eACd,QAAQ,gBAAgB,IAAI,QAAQ;GAEtC,MAAM,WAAW,MAAM,MAAM,YAAY,SAAS,GAAG;IACnD,QAAQ;IACR;GACF,CAAC;GAED,IAAI,KAAK,SAAS,MAAM;GACxB,MAAM,cAAc,SAAS,QAAQ,IAAI,cAAc;GACvD,IAAI,aACF,IAAI,OAAO,gBAAgB,WAAW;GAExC,MAAM,qBAAqB,SAAS,QAAQ,IAAI,qBAAqB;GACrE,IAAI,oBACF,IAAI,OAAO,uBAAuB,kBAAkB;GAGtD,MAAM,OAAO,MAAM,SAAS,KAAK;GACjC,OAAO,IAAI,KAAK,IAAI;EACtB,SAAS,KAAK;GACZ,GAAG,QAAQ,qCAAqC,YAAY,IAAI,GAAG;GACnE,OAAO,IAAI,KAAK,GAAG,EAAE,KAAK,EACxB,OAAO,8CAA8C,YAAY,IAAI,OAAO,GAAG,IACjF,CAAC;EACH;CACF;CAGA,OAAO,mBAAmB,IAAI,QAAQ,KAAK,KAAK,WAAW,iBAAiB;AAC9E;AAGA,IAAM,qBAAqB;AAC3B,IAAM,uBAAuB;;;;;;;;;;;;AAa7B,SAAgB,cAAc,SAA2B;CACvD,MAAM,EAAC,UAAU,WAAW,CAAC;CAC7B,IAAI,CAAC,MAAM,QAAQ,KAAK,GACtB,OAAO,EAAC,OAAO,wCAAuC;CAExD,OAAO;EACL,GAAI;EACJ,OAAO,MAAM,KAAI,SACf,KAAK,WAAW,cAAc,WAAW,kBAAkB,IACvD;GACE,GAAG;GACH,WAAW;IAAC,GAAG,KAAK;IAAW,cAAc;GAAoB;EACnE,IACA,IACN;CACF;AACF"}
+{"version":3,"file":"profz.js","names":[],"sources":["../../../../../zero-cache/src/services/profz.ts"],"sourcesContent":["import {randomUUID} from 'node:crypto';\nimport type {Profiler} from 'node:inspector';\nimport type {LogContext} from '@rocicorp/logger';\nimport auth from 'basic-auth';\nimport type {FastifyReply, FastifyRequest} from 'fastify';\nimport {sleep} from '../../../shared/src/sleep.ts';\nimport type {NormalizedZeroConfig} from '../config/normalize.ts';\nimport {getOperatorAccess} from '../config/zero-config.ts';\nimport {\n  singleProcessMode,\n  subscribeToMessageType,\n  type ProfileResponse,\n  type ProfileResponseMessage,\n  type Worker,\n} from '../types/processes.ts';\nimport {CpuProfiler} from '../types/profiler.ts';\nimport {URLParams} from '../types/url-params.ts';\n\n/**\n * Serves CPU profiles. This is available to the operator password as well as\n * the admin password (see `--operator-password`), so it must never serve\n * application data to `operator` access.\n *\n * A V8 CPU profile describes code, not data: function names, script URLs and\n * positions, and sample timings. The exception is a regular expression, which\n * V8 names after its source (`RegExp: <source>`). zero-cache compiles `LIKE`\n * and `ILIKE` patterns from client queries into regular expressions, so their\n * sources are redacted for `operator` access. See {@link redactProfile}.\n */\nexport async function handleProfzRequest(\n  lc: LogContext,\n  config: Pick<NormalizedZeroConfig, 'adminPassword' | 'operatorPassword'>,\n  req: FastifyRequest,\n  res: FastifyReply,\n  getWorker?: (() => Promise<Worker>) | undefined,\n  forcedWorker?: string | undefined,\n  localProcessName: string = 'dispatcher',\n): Promise<void> {\n  const credentials = auth(req);\n  const access = getOperatorAccess(lc, config, credentials?.pass);\n  if (access === undefined) {\n    void res\n      .code(401)\n      .header('WWW-Authenticate', 'Basic realm=\"Profz Protected Area\"')\n      .send('Unauthorized');\n    return;\n  }\n\n  const params = new URLParams(new URL(req.url, 'http://localhost'));\n  const rawDuration =\n    params.getInteger('duration', false) ??\n    params.getInteger('seconds', false) ??\n    5;\n  const durationSec = Math.max(1, Math.min(60, rawDuration));\n  const durationMs = durationSec * 1000;\n  const targetWorker = forcedWorker ?? params.get('worker', false) ?? undefined;\n  const targetWorkerIndex = params.getInteger('index', false) ?? undefined;\n  const id = randomUUID();\n\n  const responses = new Map<string, unknown>();\n\n  // Profile dispatcher / local process if requested, when profiling all processes,\n  // or when no worker dispatcher is available (single process / standalone mode)\n  const shouldProfileLocal =\n    singleProcessMode() ||\n    getWorker === undefined ||\n    targetWorker === undefined ||\n    targetWorker === localProcessName;\n\n  const localProfilePromise = shouldProfileLocal\n    ? CpuProfiler.profile(durationMs).catch(err => {\n        lc.warn?.('Failed to capture local CPU profile:', err);\n        return null;\n      })\n    : Promise.resolve(null);\n\n  if (!singleProcessMode() && getWorker !== undefined) {\n    try {\n      const worker = await getWorker();\n      const onMessage = (msg: ProfileResponse) => {\n        if (msg.id === id && msg.profile) {\n          responses.set(msg.name, msg.profile);\n        } else if (msg.id === id && msg.error) {\n          lc.warn?.(`Worker ${msg.name} profile error: ${msg.error}`);\n        }\n      };\n\n      // The worker is long-lived (and shared across requests), so the\n      // per-request handler must be removed once this request is done.\n      const unsubscribe = subscribeToMessageType<ProfileResponseMessage>(\n        worker,\n        'profileResponse',\n        onMessage,\n      );\n      try {\n        worker.send([\n          'profile',\n          {\n            id,\n            durationMs,\n            worker:\n              targetWorker === localProcessName ? '__none__' : targetWorker,\n            workerIndex: targetWorkerIndex,\n          },\n        ]);\n\n        // Wait for profile duration, then wait for child workers to transfer\n        // profiles over IPC. Under heavy production load, serializing and sending\n        // large CPU profiles can take several seconds.\n        const graceMs =\n          params.getInteger('graceMs', false) ??\n          params.getInteger('timeout', false) ??\n          5000;\n        await sleep(durationMs);\n\n        const pollMs = 50;\n        let waited = 0;\n        let lastCount = responses.size;\n        let quietMs = 0;\n        while (waited < graceMs) {\n          await sleep(pollMs);\n          waited += pollMs;\n\n          if (targetWorker && targetWorker !== 'all') {\n            const hasTarget = [...responses.keys()].some(\n              name =>\n                name === targetWorker || name.startsWith(`${targetWorker}-`),\n            );\n            if (hasTarget) {\n              break;\n            }\n          } else if (responses.size !== lastCount) {\n            lastCount = responses.size;\n            quietMs = 0;\n          } else if (responses.size > 0) {\n            quietMs += pollMs;\n            if (quietMs >= 400) {\n              break;\n            }\n          }\n        }\n      } finally {\n        unsubscribe();\n      }\n    } catch (err) {\n      lc.warn?.('Failed to dispatch profile request to child workers:', err);\n    }\n  }\n\n  const localProfile = await localProfilePromise;\n  if (localProfile) {\n    const localName =\n      targetWorker ?? (singleProcessMode() ? 'zero-cache' : localProcessName);\n    responses.set(localName, localProfile);\n  }\n\n  if (access === 'operator') {\n    for (const [name, prof] of responses) {\n      responses.set(name, redactProfile(prof));\n    }\n  }\n\n  // If a single specific worker was requested, return that profile directly\n  if (targetWorker !== undefined && targetWorker !== 'all') {\n    let matchedProfile = responses.get(targetWorker);\n    if (!matchedProfile) {\n      // Try matching by prefix or substring (e.g. 'syncer' matches 'syncer-0')\n      for (const [name, prof] of responses.entries()) {\n        if (name === targetWorker || name.startsWith(`${targetWorker}-`)) {\n          matchedProfile = prof;\n          break;\n        }\n      }\n    }\n\n    if (matchedProfile) {\n      void res\n        .header('Content-Type', 'application/json')\n        .header(\n          'Content-Disposition',\n          `attachment; filename=\"${targetWorker}.cpuprofile\"`,\n        )\n        .send(matchedProfile);\n      return;\n    }\n\n    void res.code(404).send({\n      error: `No profile captured for worker \"${targetWorker}\". Available: ${[...responses.keys()].join(', ')}`,\n    });\n    return;\n  }\n\n  // Default (Option A): Return multi-process profile bundle as a JSON map\n  const bundle: Record<string, unknown> = {};\n  for (const [name, prof] of responses.entries()) {\n    bundle[name] = prof;\n  }\n\n  void res\n    .header('Content-Type', 'application/json')\n    .header(\n      'Content-Disposition',\n      `attachment; filename=\"zero-profile-bundle-${Date.now()}.json\"`,\n    )\n    .send(bundle);\n}\n\nexport async function handleProfrmzRequest(\n  lc: LogContext,\n  config: NormalizedZeroConfig,\n  req: FastifyRequest,\n  res: FastifyReply,\n  getWorker?: (() => Promise<Worker>) | undefined,\n): Promise<void> {\n  const credentials = auth(req);\n  if (getOperatorAccess(lc, config, credentials?.pass) === undefined) {\n    void res\n      .code(401)\n      .header('WWW-Authenticate', 'Basic realm=\"Profrmz Protected Area\"')\n      .send('Unauthorized');\n    return;\n  }\n\n  // In distributed mode, proxy to the upstream Replication Manager. The\n  // credentials are forwarded, and the Replication Manager's /profz decides\n  // for itself what access they grant (and so what to redact).\n  if (config.changeStreamer.uri) {\n    const upstreamURL = new URL('/profz', config.changeStreamer.uri);\n    if (upstreamURL.protocol === 'ws:') {\n      upstreamURL.protocol = 'http:';\n    } else if (upstreamURL.protocol === 'wss:') {\n      upstreamURL.protocol = 'https:';\n    }\n    const incomingURL = new URL(req.url, 'http://localhost');\n    for (const [key, value] of incomingURL.searchParams.entries()) {\n      upstreamURL.searchParams.set(key, value);\n    }\n\n    try {\n      const headers: Record<string, string> = {};\n      if (req.headers.authorization) {\n        headers.authorization = req.headers.authorization;\n      }\n      const response = await fetch(upstreamURL.toString(), {\n        method: 'GET',\n        headers,\n      });\n\n      res.code(response.status);\n      const contentType = response.headers.get('content-type');\n      if (contentType) {\n        res.header('content-type', contentType);\n      }\n      const contentDisposition = response.headers.get('content-disposition');\n      if (contentDisposition) {\n        res.header('content-disposition', contentDisposition);\n      }\n\n      const body = await response.text();\n      return res.send(body);\n    } catch (err) {\n      lc.error?.(`Failed to proxy /profrmz to RM at ${upstreamURL}:`, err);\n      return res.code(502).send({\n        error: `Failed to proxy profiling request to RM at ${upstreamURL}: ${String(err)}`,\n      });\n    }\n  }\n\n  // In single-node mode, profile local change-streamer / RM process\n  return handleProfzRequest(lc, config, req, res, getWorker, 'change-streamer');\n}\n\n// V8 names the code for a regular expression `RegExp: <source>`.\nconst REGEXP_NAME_PREFIX = 'RegExp:';\nconst REDACTED_REGEXP_NAME = 'RegExp: <redacted>';\n\n/**\n * Returns a copy of the V8 CPU `profile` with the source of every regular\n * expression replaced, since a pattern built at runtime can contain\n * application data (e.g. a `LIKE` pattern from a client query). The time spent\n * in regular expressions is still attributed to them.\n *\n * A `profile` that is not in the expected format is withheld rather than\n * served unredacted.\n *\n * @visibleForTesting\n */\nexport function redactProfile(profile: unknown): unknown {\n  const {nodes} = (profile ?? {}) as Partial<Profiler.Profile>;\n  if (!Array.isArray(nodes)) {\n    return {error: 'Profile withheld: unrecognized format'};\n  }\n  return {\n    ...(profile as Profiler.Profile),\n    nodes: nodes.map(node =>\n      node.callFrame?.functionName?.startsWith(REGEXP_NAME_PREFIX)\n        ? {\n            ...node,\n            callFrame: {...node.callFrame, functionName: REDACTED_REGEXP_NAME},\n          }\n        : node,\n    ),\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AA6BA,eAAsB,mBACpB,IACA,QACA,KACA,KACA,WACA,cACA,mBAA2B,cACZ;CACf,MAAM,cAAc,KAAK,GAAG;CAC5B,MAAM,SAAS,kBAAkB,IAAI,QAAQ,aAAa,IAAI;CAC9D,IAAI,WAAW,KAAA,GAAW;EACxB,IACG,KAAK,GAAG,CAAC,CACT,OAAO,oBAAoB,sCAAoC,CAAC,CAChE,KAAK,cAAc;EACtB;CACF;CAEA,MAAM,SAAS,IAAI,UAAU,IAAI,IAAI,IAAI,KAAK,kBAAkB,CAAC;CACjE,MAAM,cACJ,OAAO,WAAW,YAAY,KAAK,KACnC,OAAO,WAAW,WAAW,KAAK,KAClC;CAEF,MAAM,aADc,KAAK,IAAI,GAAG,KAAK,IAAI,IAAI,WAAW,CACrC,IAAc;CACjC,MAAM,eAAe,gBAAgB,OAAO,IAAI,UAAU,KAAK,KAAK,KAAA;CACpE,MAAM,oBAAoB,OAAO,WAAW,SAAS,KAAK,KAAK,KAAA;CAC/D,MAAM,KAAK,WAAW;CAEtB,MAAM,4BAAY,IAAI,IAAqB;CAU3C,MAAM,sBALJ,kBAAkB,KAClB,cAAc,KAAA,KACd,iBAAiB,KAAA,KACjB,iBAAiB,mBAGf,YAAY,QAAQ,UAAU,CAAC,CAAC,OAAM,QAAO;EAC3C,GAAG,OAAO,wCAAwC,GAAG;EACrD,OAAO;CACT,CAAC,IACD,QAAQ,QAAQ,IAAI;CAExB,IAAI,CAAC,kBAAkB,KAAK,cAAc,KAAA,GACxC,IAAI;EACF,MAAM,SAAS,MAAM,UAAU;EAC/B,MAAM,aAAa,QAAyB;GAC1C,IAAI,IAAI,OAAO,MAAM,IAAI,SACvB,UAAU,IAAI,IAAI,MAAM,IAAI,OAAO;QAC9B,IAAI,IAAI,OAAO,MAAM,IAAI,OAC9B,GAAG,OAAO,UAAU,IAAI,KAAK,kBAAkB,IAAI,OAAO;EAE9D;EAIA,MAAM,cAAc,uBAClB,QACA,mBACA,SACF;EACA,IAAI;GACF,OAAO,KAAK,CACV,WACA;IACE;IACA;IACA,QACE,iBAAiB,mBAAmB,aAAa;IACnD,aAAa;GACf,CACF,CAAC;GAKD,MAAM,UACJ,OAAO,WAAW,WAAW,KAAK,KAClC,OAAO,WAAW,WAAW,KAAK,KAClC;GACF,MAAM,MAAM,UAAU;GAEtB,MAAM,SAAS;GACf,IAAI,SAAS;GACb,IAAI,YAAY,UAAU;GAC1B,IAAI,UAAU;GACd,OAAO,SAAS,SAAS;IACvB,MAAM,MAAM,MAAM;IAClB,UAAU;IAEV,IAAI,gBAAgB,iBAAiB,OACjB;SAAA,CAAC,GAAG,UAAU,KAAK,CAAC,CAAC,CAAC,MACtC,SACE,SAAS,gBAAgB,KAAK,WAAW,GAAG,aAAa,EAAE,CAE3D,GACF;IAAA,OAEG,IAAI,UAAU,SAAS,WAAW;KACvC,YAAY,UAAU;KACtB,UAAU;IACZ,OAAO,IAAI,UAAU,OAAO,GAAG;KAC7B,WAAW;KACX,IAAI,WAAW,KACb;IAEJ;GACF;EACF,UAAU;GACR,YAAY;EACd;CACF,SAAS,KAAK;EACZ,GAAG,OAAO,wDAAwD,GAAG;CACvE;CAGF,MAAM,eAAe,MAAM;CAC3B,IAAI,cAAc;EAChB,MAAM,YACJ,iBAAiB,kBAAkB,IAAI,eAAe;EACxD,UAAU,IAAI,WAAW,YAAY;CACvC;CAEA,IAAI,WAAW,YACb,KAAK,MAAM,CAAC,MAAM,SAAS,WACzB,UAAU,IAAI,MAAM,cAAc,IAAI,CAAC;CAK3C,IAAI,iBAAiB,KAAA,KAAa,iBAAiB,OAAO;EACxD,IAAI,iBAAiB,UAAU,IAAI,YAAY;EAC/C,IAAI,CAAC,gBAEE;QAAA,MAAM,CAAC,MAAM,SAAS,UAAU,QAAQ,GAC3C,IAAI,SAAS,gBAAgB,KAAK,WAAW,GAAG,aAAa,EAAE,GAAG;IAChE,iBAAiB;IACjB;GACF;;EAIJ,IAAI,gBAAgB;GAClB,IACG,OAAO,gBAAgB,kBAAkB,CAAC,CAC1C,OACC,uBACA,yBAAyB,aAAa,aACxC,CAAC,CACA,KAAK,cAAc;GACtB;EACF;EAEA,IAAS,KAAK,GAAG,CAAC,CAAC,KAAK,EACtB,OAAO,mCAAmC,aAAa,gBAAgB,CAAC,GAAG,UAAU,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IACxG,CAAC;EACD;CACF;CAGA,MAAM,SAAkC,CAAC;CACzC,KAAK,MAAM,CAAC,MAAM,SAAS,UAAU,QAAQ,GAC3C,OAAO,QAAQ;CAGjB,IACG,OAAO,gBAAgB,kBAAkB,CAAC,CAC1C,OACC,uBACA,6CAA6C,KAAK,IAAI,EAAE,OAC1D,CAAC,CACA,KAAK,MAAM;AAChB;AAEA,eAAsB,qBACpB,IACA,QACA,KACA,KACA,WACe;CACf,MAAM,cAAc,KAAK,GAAG;CAC5B,IAAI,kBAAkB,IAAI,QAAQ,aAAa,IAAI,MAAM,KAAA,GAAW;EAClE,IACG,KAAK,GAAG,CAAC,CACT,OAAO,oBAAoB,wCAAsC,CAAC,CAClE,KAAK,cAAc;EACtB;CACF;CAKA,IAAI,OAAO,eAAe,KAAK;EAC7B,MAAM,cAAc,IAAI,IAAI,UAAU,OAAO,eAAe,GAAG;EAC/D,IAAI,YAAY,aAAa,OAC3B,YAAY,WAAW;OAClB,IAAI,YAAY,aAAa,QAClC,YAAY,WAAW;EAEzB,MAAM,cAAc,IAAI,IAAI,IAAI,KAAK,kBAAkB;EACvD,KAAK,MAAM,CAAC,KAAK,UAAU,YAAY,aAAa,QAAQ,GAC1D,YAAY,aAAa,IAAI,KAAK,KAAK;EAGzC,IAAI;GACF,MAAM,UAAkC,CAAC;GACzC,IAAI,IAAI,QAAQ,eACd,QAAQ,gBAAgB,IAAI,QAAQ;GAEtC,MAAM,WAAW,MAAM,MAAM,YAAY,SAAS,GAAG;IACnD,QAAQ;IACR;GACF,CAAC;GAED,IAAI,KAAK,SAAS,MAAM;GACxB,MAAM,cAAc,SAAS,QAAQ,IAAI,cAAc;GACvD,IAAI,aACF,IAAI,OAAO,gBAAgB,WAAW;GAExC,MAAM,qBAAqB,SAAS,QAAQ,IAAI,qBAAqB;GACrE,IAAI,oBACF,IAAI,OAAO,uBAAuB,kBAAkB;GAGtD,MAAM,OAAO,MAAM,SAAS,KAAK;GACjC,OAAO,IAAI,KAAK,IAAI;EACtB,SAAS,KAAK;GACZ,GAAG,QAAQ,qCAAqC,YAAY,IAAI,GAAG;GACnE,OAAO,IAAI,KAAK,GAAG,CAAC,CAAC,KAAK,EACxB,OAAO,8CAA8C,YAAY,IAAI,OAAO,GAAG,IACjF,CAAC;EACH;CACF;CAGA,OAAO,mBAAmB,IAAI,QAAQ,KAAK,KAAK,WAAW,iBAAiB;AAC9E;AAGA,IAAM,qBAAqB;AAC3B,IAAM,uBAAuB;;;;;;;;;;;;AAa7B,SAAgB,cAAc,SAA2B;CACvD,MAAM,EAAC,UAAU,WAAW,CAAC;CAC7B,IAAI,CAAC,MAAM,QAAQ,KAAK,GACtB,OAAO,EAAC,OAAO,wCAAuC;CAExD,OAAO;EACL,GAAI;EACJ,OAAO,MAAM,KAAI,SACf,KAAK,WAAW,cAAc,WAAW,kBAAkB,IACvD;GACE,GAAG;GACH,WAAW;IAAC,GAAG,KAAK;IAAW,cAAc;GAAoB;EACnE,IACA,IACN;CACF;AACF"}

package/out/zero-cache/src/services/replicator/change-log-cookies.js.map

@@ -1 +1 @@
-{"version":3,"file":"change-log-cookies.js","names":["#upsertMetadata","#upsertBackfill","#renameMetadataTable","#renameBackfillTable","#deleteMetadataTable","#deleteBackfillTable","#renameBackfillColumn","#deleteBackfillColumn","#run"],"sources":["../../../../../../zero-cache/src/services/replicator/change-log-cookies.ts"],"sourcesContent":["/**\n * The change log's *second* job.\n *\n * A change log is a buffer **and** a cookie jar. The buffer catches a\n * reconnecting subscriber up to the head; the cookie jar holds the backfill\n * progress state that the change-streamer hands the change-source on every\n * `startStream`, so that the change source never has to persist backfill state\n * upstream. See `change-log-db.ts` for the buffer.\n *\n * There are two cookies, mirroring the two `cdc` tables the Postgres change log\n * has always carried (`change-streamer/schema/tables.ts`):\n *\n * - **table metadata**, the most current {@link TableMetadata} of a table, which\n *   a {@link BackfillRequest} has to carry; and\n * - **backfilling columns**, the opaque {@link BackfillID} of every column whose\n *   backfill has not completed.\n *\n * Both are a *fold over the change stream*: the cookie set is only meaningful\n * paired with the watermark it was folded up to. {@link cookieOps} is that fold,\n * expressed transport-free so that the Postgres change log and the SQLite change\n * log cannot drift from each other — they must agree on all eight transitions\n * forever, and the failure mode if they disagree is a backfill that is silently\n * never re-requested. The two interpreters are {@link ChangeLogCookieWriter}\n * here and `Storer.#trackBackfillMetadata()` in\n * `change-streamer/storer.ts`.\n *\n * The tables live in the change-log database rather than in the replica: the\n * replicator is a subscriber *downstream* of the change-streamer's write loop,\n * so its state version trails the log's head, and pairing its cookies with the\n * log's resume watermark would lose every backfill that completed in between.\n * The replica's own copies (`_zero.tableMetadata`, `_zero.column_metadata`) are\n * the *seed* source; these are the *working* set.\n */\n\nimport {unreachable} from '../../../../shared/src/asserts.ts';\nimport {BigIntJSON} from '../../../../shared/src/bigint-json.ts';\nimport * as v from '../../../../shared/src/valita.ts';\nimport type {Database, Statement} from '../../../../zqlite/src/db.ts';\nimport type {\n  BackfillID,\n  Identifier,\n  SchemaChange,\n  TableMetadata,\n} from '../change-source/protocol/current/data.ts';\nimport {\n  backfillRequestSchema,\n  type BackfillRequest,\n} from '../change-source/protocol/current/upstream.ts';\n\nexport const CHANGE_LOG_TABLE_METADATA_TABLE = '_zero.changeLogTableMetadata';\nexport const CHANGE_LOG_BACKFILLING_TABLE = '_zero.changeLogBackfilling';\n\n// The names follow the file's existing convention, beside\n// \"_zero.changeLogStream\" and \"_zero.changeLogMeta\".\n//\n// `metadata` and `backfill` hold the JSON that the `cdc` tables hold as JSONB.\n// SQLite has no JSONB, and nothing here queries into the documents: they are\n// stored to be handed back to the change source verbatim.\nexport const CREATE_CHANGE_LOG_COOKIE_SCHEMA = /*sql*/ `\n  CREATE TABLE \"${CHANGE_LOG_TABLE_METADATA_TABLE}\" (\n    \"schema\"   TEXT NOT NULL,\n    \"table\"    TEXT NOT NULL,\n    \"metadata\" TEXT NOT NULL,\n    PRIMARY KEY (\"schema\", \"table\")\n  );\n\n  CREATE TABLE \"${CHANGE_LOG_BACKFILLING_TABLE}\" (\n    \"schema\"   TEXT NOT NULL,\n    \"table\"    TEXT NOT NULL,\n    \"column\"   TEXT NOT NULL,\n    \"backfill\" TEXT NOT NULL,\n    PRIMARY KEY (\"schema\", \"table\", \"column\")\n  );\n`;\n\nexport const DROP_CHANGE_LOG_COOKIE_TABLES = /*sql*/ `\n  DROP TABLE IF EXISTS \"${CHANGE_LOG_TABLE_METADATA_TABLE}\";\n  DROP TABLE IF EXISTS \"${CHANGE_LOG_BACKFILLING_TABLE}\";\n`;\n\nexport type TableMetadataCookie = {\n  readonly schema: string;\n  readonly table: string;\n  readonly metadata: TableMetadata;\n};\n\nexport type BackfillCookie = {\n  readonly schema: string;\n  readonly table: string;\n  readonly column: string;\n  readonly backfill: BackfillID;\n};\n\n/**\n * The whole cookie set, as of the log's head. Both lists are ordered by their\n * primary key so that two stores' sets can be compared directly.\n */\nexport type CookieSet = {\n  readonly tableMetadata: readonly TableMetadataCookie[];\n  readonly backfilling: readonly BackfillCookie[];\n};\n\nexport const EMPTY_COOKIE_SET: CookieSet = {\n  tableMetadata: [],\n  backfilling: [],\n};\n\n/**\n * A transport-free description of a cookie mutation. This is the whole of what\n * a {@link SchemaChange} means to the cookie jar; everything else about the\n * change belongs to the buffer.\n */\nexport type CookieOp =\n  | {op: 'upsert-metadata'; table: Identifier; metadata: TableMetadata}\n  | {\n      op: 'upsert-backfill';\n      table: Identifier;\n      column: string;\n      backfill: BackfillID;\n    }\n  | {op: 'rename-table'; old: Identifier; new: Identifier}\n  | {op: 'drop-table'; table: Identifier}\n  | {op: 'rename-column'; table: Identifier; old: string; new: string}\n  | {op: 'drop-column'; table: Identifier; column: string}\n  | {op: 'complete-backfill'; table: Identifier; columns: readonly string[]};\n\nexport type CookieOpTag = CookieOp['op'];\n\n/**\n * The fold, and the only place either store decides what a schema change means\n * for the cookie set. Both interpreters are mechanical translations of what this\n * returns, in the order it returns them.\n *\n * Changes that carry no cookie state — index changes, and the `create-table` /\n * `add-column` variants whose optional `metadata` and `backfill` fields are\n * absent — produce no ops.\n */\nexport function cookieOps(change: SchemaChange): CookieOp[] {\n  switch (change.tag) {\n    case 'update-table-metadata':\n      return [\n        {op: 'upsert-metadata', table: change.table, metadata: change.new},\n      ];\n\n    case 'create-table': {\n      const {spec, metadata, backfill} = change;\n      const table = {schema: spec.schema, name: spec.name};\n      const ops: CookieOp[] = [];\n      if (metadata) {\n        ops.push({op: 'upsert-metadata', table, metadata});\n      }\n      if (backfill) {\n        for (const [column, id] of Object.entries(backfill)) {\n          ops.push({op: 'upsert-backfill', table, column, backfill: id});\n        }\n      }\n      return ops;\n    }\n\n    case 'rename-table':\n      return [{op: 'rename-table', old: change.old, new: change.new}];\n\n    case 'drop-table':\n      return [{op: 'drop-table', table: change.id}];\n\n    case 'add-column': {\n      const {table, tableMetadata, column, backfill} = change;\n      const ops: CookieOp[] = [];\n      if (tableMetadata) {\n        ops.push({op: 'upsert-metadata', table, metadata: tableMetadata});\n      }\n      if (backfill) {\n        ops.push({\n          op: 'upsert-backfill',\n          table,\n          column: column.name,\n          backfill,\n        });\n      }\n      return ops;\n    }\n\n    case 'update-column': {\n      // Only a rename moves the cookie; the rest of a column update does not\n      // affect whether or how it is being backfilled.\n      const {table, old, new: updated} = change;\n      return old.name === updated.name\n        ? []\n        : [{op: 'rename-column', table, old: old.name, new: updated.name}];\n    }\n\n    case 'drop-column':\n      return [{op: 'drop-column', table: change.table, column: change.column}];\n\n    case 'backfill-completed': {\n      const {relation, columns} = change;\n      // The rowKey columns are excluded from `columns` but are backfilled with\n      // them, so both are cleared.\n      const cleared = [...relation.rowKey.columns, ...columns];\n      return cleared.length === 0\n        ? []\n        : [\n            {\n              op: 'complete-backfill',\n              table: {schema: relation.schema, name: relation.name},\n              columns: cleared,\n            },\n          ];\n    }\n\n    case 'create-index':\n    case 'drop-index':\n      return [];\n\n    default:\n      // Unreachable: `isSchemaChange()` gates on the same tag set this switch\n      // covers. It is exhaustive so that a new schema-change tag is a compile\n      // error here rather than a silently dropped backfill.\n      unreachable(change);\n  }\n}\n\n/**\n * The SQLite interpreter of {@link cookieOps}, over prepared statements on the\n * change-log database.\n *\n * The statements run inside the log's transaction, in stream order, at the point\n * the schema change is appended (see `ChangeLogStreamWriter`). That is what\n * makes the cookie set atomic with the head — a crash cannot leave cookies ahead\n * of or behind the rows they were folded from — and what makes an aborted\n * transaction discard its cookies with its rows, for free.\n *\n * Statements are prepared against the tables as they exist now, so an instance\n * does not survive a reconcile that drops and recreates them.\n */\nexport class ChangeLogCookieWriter {\n  readonly #upsertMetadata: Statement;\n  readonly #upsertBackfill: Statement;\n  readonly #renameMetadataTable: Statement;\n  readonly #renameBackfillTable: Statement;\n  readonly #deleteMetadataTable: Statement;\n  readonly #deleteBackfillTable: Statement;\n  readonly #renameBackfillColumn: Statement;\n  readonly #deleteBackfillColumn: Statement;\n\n  constructor(db: Database) {\n    this.#upsertMetadata = db.prepare(/*sql*/ `\n      INSERT INTO \"${CHANGE_LOG_TABLE_METADATA_TABLE}\"\n        (\"schema\", \"table\", \"metadata\") VALUES (?, ?, ?)\n        ON CONFLICT (\"schema\", \"table\")\n        DO UPDATE SET \"metadata\" = excluded.\"metadata\"\n    `);\n    this.#upsertBackfill = db.prepare(/*sql*/ `\n      INSERT INTO \"${CHANGE_LOG_BACKFILLING_TABLE}\"\n        (\"schema\", \"table\", \"column\", \"backfill\") VALUES (?, ?, ?, ?)\n        ON CONFLICT (\"schema\", \"table\", \"column\")\n        DO UPDATE SET \"backfill\" = excluded.\"backfill\"\n    `);\n    this.#renameMetadataTable = db.prepare(/*sql*/ `\n      UPDATE \"${CHANGE_LOG_TABLE_METADATA_TABLE}\"\n        SET \"schema\" = ?, \"table\" = ? WHERE \"schema\" = ? AND \"table\" = ?\n    `);\n    this.#renameBackfillTable = db.prepare(/*sql*/ `\n      UPDATE \"${CHANGE_LOG_BACKFILLING_TABLE}\"\n        SET \"schema\" = ?, \"table\" = ? WHERE \"schema\" = ? AND \"table\" = ?\n    `);\n    this.#deleteMetadataTable = db.prepare(/*sql*/ `\n      DELETE FROM \"${CHANGE_LOG_TABLE_METADATA_TABLE}\"\n        WHERE \"schema\" = ? AND \"table\" = ?\n    `);\n    this.#deleteBackfillTable = db.prepare(/*sql*/ `\n      DELETE FROM \"${CHANGE_LOG_BACKFILLING_TABLE}\"\n        WHERE \"schema\" = ? AND \"table\" = ?\n    `);\n    this.#renameBackfillColumn = db.prepare(/*sql*/ `\n      UPDATE \"${CHANGE_LOG_BACKFILLING_TABLE}\" SET \"column\" = ?\n        WHERE \"schema\" = ? AND \"table\" = ? AND \"column\" = ?\n    `);\n    this.#deleteBackfillColumn = db.prepare(/*sql*/ `\n      DELETE FROM \"${CHANGE_LOG_BACKFILLING_TABLE}\"\n        WHERE \"schema\" = ? AND \"table\" = ? AND \"column\" = ?\n    `);\n  }\n\n  /** Applies the change's cookie ops, returning the ops that were applied. */\n  apply(change: SchemaChange): CookieOp[] {\n    const ops = cookieOps(change);\n    for (const op of ops) {\n      this.#run(op);\n    }\n    return ops;\n  }\n\n  #run(op: CookieOp): void {\n    switch (op.op) {\n      case 'upsert-metadata':\n        this.#upsertMetadata.run(\n          op.table.schema,\n          op.table.name,\n          BigIntJSON.stringify(op.metadata),\n        );\n        break;\n\n      case 'upsert-backfill':\n        this.#upsertBackfill.run(\n          op.table.schema,\n          op.table.name,\n          op.column,\n          BigIntJSON.stringify(op.backfill),\n        );\n        break;\n\n      case 'rename-table':\n        this.#renameMetadataTable.run(\n          op.new.schema,\n          op.new.name,\n          op.old.schema,\n          op.old.name,\n        );\n        this.#renameBackfillTable.run(\n          op.new.schema,\n          op.new.name,\n          op.old.schema,\n          op.old.name,\n        );\n        break;\n\n      case 'drop-table':\n        this.#deleteMetadataTable.run(op.table.schema, op.table.name);\n        this.#deleteBackfillTable.run(op.table.schema, op.table.name);\n        break;\n\n      case 'rename-column':\n        this.#renameBackfillColumn.run(\n          op.new,\n          op.table.schema,\n          op.table.name,\n          op.old,\n        );\n        break;\n\n      case 'drop-column':\n        this.#deleteBackfillColumn.run(\n          op.table.schema,\n          op.table.name,\n          op.column,\n        );\n        break;\n\n      case 'complete-backfill':\n        // A per-column delete rather than an `IN` list, which cannot be a\n        // single prepared statement across arities. The columns of one\n        // completed backfill are few, and this runs only on schema changes.\n        for (const column of op.columns) {\n          this.#deleteBackfillColumn.run(\n            op.table.schema,\n            op.table.name,\n            column,\n          );\n        }\n        break;\n\n      default:\n        unreachable(op);\n    }\n  }\n}\n\nconst tableKey = (schema: string, table: string) =>\n  JSON.stringify([schema, table]);\n\nconst columnKey = (schema: string, table: string, column: string) =>\n  JSON.stringify([schema, table, column]);\n\nconst cmp = (a: string, b: string) => (a < b ? -1 : a > b ? 1 : 0);\n\n/**\n * The in-memory interpreter of {@link cookieOps}: the third one, and the only\n * one that is not a store.\n *\n * A replica-derived cookie set is a snapshot at the replica's state version,\n * which trails the change log's head, so it cannot be compared with a\n * Postgres-derived set directly. This carries it forward over the schema changes\n * the log holds in between, which turns \"the two stores disagree, but they are\n * also at different positions\" into an exact equality — and makes a\n * disagreement between any two of the three interpreters visible as an\n * inequality that neither store would have noticed on its own.\n *\n * `changes` must be the log's schema changes over `(from, to]` in stream order.\n * Anything else produces a set that belongs to no watermark.\n */\nexport function foldCookies(\n  cookies: CookieSet,\n  changes: Iterable<SchemaChange>,\n): CookieSet {\n  const metadata = new Map<string, TableMetadataCookie>(\n    cookies.tableMetadata.map(c => [tableKey(c.schema, c.table), c]),\n  );\n  const backfilling = new Map<string, BackfillCookie>(\n    cookies.backfilling.map(c => [columnKey(c.schema, c.table, c.column), c]),\n  );\n  const dropColumn = ({schema, name}: Identifier, column: string) =>\n    backfilling.delete(columnKey(schema, name, column));\n\n  for (const change of changes) {\n    for (const op of cookieOps(change)) {\n      switch (op.op) {\n        case 'upsert-metadata':\n          metadata.set(tableKey(op.table.schema, op.table.name), {\n            schema: op.table.schema,\n            table: op.table.name,\n            metadata: op.metadata,\n          });\n          break;\n\n        case 'upsert-backfill':\n          backfilling.set(\n            columnKey(op.table.schema, op.table.name, op.column),\n            {\n              schema: op.table.schema,\n              table: op.table.name,\n              column: op.column,\n              backfill: op.backfill,\n            },\n          );\n          break;\n\n        case 'rename-table': {\n          const {old, new: renamed} = op;\n          const moved = metadata.get(tableKey(old.schema, old.name));\n          if (moved) {\n            metadata.delete(tableKey(old.schema, old.name));\n            metadata.set(tableKey(renamed.schema, renamed.name), {\n              ...moved,\n              schema: renamed.schema,\n              table: renamed.name,\n            });\n          }\n          // Snapshotted before mutating, since the rename both deletes and\n          // inserts into the map being scanned.\n          for (const [key, cookie] of [...backfilling]) {\n            if (cookie.schema === old.schema && cookie.table === old.name) {\n              backfilling.delete(key);\n              backfilling.set(\n                columnKey(renamed.schema, renamed.name, cookie.column),\n                {...cookie, schema: renamed.schema, table: renamed.name},\n              );\n            }\n          }\n          break;\n        }\n\n        case 'drop-table': {\n          const {schema, name} = op.table;\n          metadata.delete(tableKey(schema, name));\n          for (const [key, cookie] of [...backfilling]) {\n            if (cookie.schema === schema && cookie.table === name) {\n              backfilling.delete(key);\n            }\n          }\n          break;\n        }\n\n        case 'rename-column': {\n          const {schema, name} = op.table;\n          const moved = backfilling.get(columnKey(schema, name, op.old));\n          if (moved) {\n            backfilling.delete(columnKey(schema, name, op.old));\n            backfilling.set(columnKey(schema, name, op.new), {\n              ...moved,\n              column: op.new,\n            });\n          }\n          break;\n        }\n\n        case 'drop-column':\n          dropColumn(op.table, op.column);\n          break;\n\n        case 'complete-backfill':\n          for (const column of op.columns) {\n            dropColumn(op.table, column);\n          }\n          break;\n\n        default:\n          unreachable(op);\n      }\n    }\n  }\n\n  return {\n    tableMetadata: [...metadata.values()].toSorted(\n      (a, b) => cmp(a.schema, b.schema) || cmp(a.table, b.table),\n    ),\n    backfilling: [...backfilling.values()].toSorted(\n      (a, b) =>\n        cmp(a.schema, b.schema) ||\n        cmp(a.table, b.table) ||\n        cmp(a.column, b.column),\n    ),\n  };\n}\n\nconst backfillRequestsSchema = v.array(backfillRequestSchema);\n\n/**\n * Returns one {@link BackfillRequest} for each table with an active backfill.\n * Each request contains the stored table metadata, if available.\n */\nexport function backfillRequestsFrom(cookies: CookieSet): BackfillRequest[] {\n  const metadata = new Map(\n    cookies.tableMetadata.map(c => [tableKey(c.schema, c.table), c.metadata]),\n  );\n  const requests: BackfillRequest[] = [];\n  let curr: BackfillRequest | undefined;\n  for (const {schema, table, column, backfill} of cookies.backfilling) {\n    if (curr?.table.schema !== schema || curr.table.name !== table) {\n      curr = {\n        table: {\n          schema,\n          name: table,\n          // Use `null` when a backfilling table has no metadata. This matches\n          // the result of the Postgres left join.\n          metadata: metadata.get(tableKey(schema, table)) ?? null,\n        },\n        columns: {},\n      };\n      requests.push(curr);\n    }\n    curr.columns[column] = {id: backfill};\n  }\n  return v.parse(requests, backfillRequestsSchema);\n}\n\n/**\n * Reads the whole cookie set, ordered by primary key. This is what a\n * change-streamer would hand `startStream`, and what the Postgres-derived and\n * replica-derived sets are compared against.\n */\nexport function readCookies(db: Database): CookieSet {\n  const tableMetadata = db\n    .prepare(/*sql*/ `\n      SELECT \"schema\", \"table\", \"metadata\"\n        FROM \"${CHANGE_LOG_TABLE_METADATA_TABLE}\"\n        ORDER BY \"schema\", \"table\"\n    `)\n    .all<{schema: string; table: string; metadata: string}>()\n    .map(({schema, table, metadata}) => ({\n      schema,\n      table,\n      metadata: BigIntJSON.parse(metadata) as TableMetadata,\n    }));\n\n  const backfilling = db\n    .prepare(/*sql*/ `\n      SELECT \"schema\", \"table\", \"column\", \"backfill\"\n        FROM \"${CHANGE_LOG_BACKFILLING_TABLE}\"\n        ORDER BY \"schema\", \"table\", \"column\"\n    `)\n    .all<{schema: string; table: string; column: string; backfill: string}>()\n    .map(({schema, table, column, backfill}) => ({\n      schema,\n      table,\n      column,\n      backfill: BigIntJSON.parse(backfill) as BackfillID,\n    }));\n\n  return {tableMetadata, backfilling};\n}\n\n/**\n * Replaces the cookie set wholesale.\n *\n * The cookies are unversioned point-in-time state, so a reconciliation that\n * moves the head invalidates them: truncating the stream above `W` does not roll\n * the cookie set back to `W`, and the truncated transactions can contain\n * `create-table`, `add-column`, and `backfill-completed`. The caller must run\n * this in the same transaction as the reconciliation that invalidated them.\n */\nexport function replaceCookies(db: Database, cookies: CookieSet): void {\n  db.prepare(/*sql*/ `DELETE FROM \"${CHANGE_LOG_TABLE_METADATA_TABLE}\"`).run();\n  db.prepare(/*sql*/ `DELETE FROM \"${CHANGE_LOG_BACKFILLING_TABLE}\"`).run();\n\n  if (cookies.tableMetadata.length > 0) {\n    const insert = db.prepare(/*sql*/ `\n      INSERT INTO \"${CHANGE_LOG_TABLE_METADATA_TABLE}\"\n        (\"schema\", \"table\", \"metadata\") VALUES (?, ?, ?)\n    `);\n    for (const {schema, table, metadata} of cookies.tableMetadata) {\n      insert.run(schema, table, BigIntJSON.stringify(metadata));\n    }\n  }\n  if (cookies.backfilling.length > 0) {\n    const insert = db.prepare(/*sql*/ `\n      INSERT INTO \"${CHANGE_LOG_BACKFILLING_TABLE}\"\n        (\"schema\", \"table\", \"column\", \"backfill\") VALUES (?, ?, ?, ?)\n    `);\n    for (const {schema, table, column, backfill} of cookies.backfilling) {\n      insert.run(schema, table, column, BigIntJSON.stringify(backfill));\n    }\n  }\n}\n\n/** Retained cookie rows, by table. Both are normally zero. */\nexport type CookieRowCounts = {\n  readonly tableMetadata: number;\n  readonly backfilling: number;\n};\n\nexport function readCookieRowCounts(db: Database): CookieRowCounts {\n  return db\n    .prepare(/*sql*/ `\n      SELECT\n        (SELECT count(*) FROM \"${CHANGE_LOG_TABLE_METADATA_TABLE}\")\n          AS \"tableMetadata\",\n        (SELECT count(*) FROM \"${CHANGE_LOG_BACKFILLING_TABLE}\")\n          AS \"backfilling\"\n    `)\n    .get<CookieRowCounts>();\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiDA,IAAa,kCAAkC;AAC/C,IAAa,+BAA+B;AAQ5C,IAAa,kCAA0C;kBACrC,gCAAgC;;;;;;;kBAOhC,6BAA6B;;;;;;;;AAS/C,IAAa,gCAAwC;0BAC3B,gCAAgC;0BAChC,6BAA6B;;;;;;;;;;;AA4DvD,SAAgB,UAAU,QAAkC;CAC1D,QAAQ,OAAO,KAAf;EACE,KAAK,yBACH,OAAO,CACL;GAAC,IAAI;GAAmB,OAAO,OAAO;GAAO,UAAU,OAAO;EAAG,CACnE;EAEF,KAAK,gBAAgB;GACnB,MAAM,EAAC,MAAM,UAAU,aAAY;GACnC,MAAM,QAAQ;IAAC,QAAQ,KAAK;IAAQ,MAAM,KAAK;GAAI;GACnD,MAAM,MAAkB,CAAC;GACzB,IAAI,UACF,IAAI,KAAK;IAAC,IAAI;IAAmB;IAAO;GAAQ,CAAC;GAEnD,IAAI,UACF,KAAK,MAAM,CAAC,QAAQ,OAAO,OAAO,QAAQ,QAAQ,GAChD,IAAI,KAAK;IAAC,IAAI;IAAmB;IAAO;IAAQ,UAAU;GAAE,CAAC;GAGjE,OAAO;EACT;EAEA,KAAK,gBACH,OAAO,CAAC;GAAC,IAAI;GAAgB,KAAK,OAAO;GAAK,KAAK,OAAO;EAAG,CAAC;EAEhE,KAAK,cACH,OAAO,CAAC;GAAC,IAAI;GAAc,OAAO,OAAO;EAAE,CAAC;EAE9C,KAAK,cAAc;GACjB,MAAM,EAAC,OAAO,eAAe,QAAQ,aAAY;GACjD,MAAM,MAAkB,CAAC;GACzB,IAAI,eACF,IAAI,KAAK;IAAC,IAAI;IAAmB;IAAO,UAAU;GAAa,CAAC;GAElE,IAAI,UACF,IAAI,KAAK;IACP,IAAI;IACJ;IACA,QAAQ,OAAO;IACf;GACF,CAAC;GAEH,OAAO;EACT;EAEA,KAAK,iBAAiB;GAGpB,MAAM,EAAC,OAAO,KAAK,KAAK,YAAW;GACnC,OAAO,IAAI,SAAS,QAAQ,OACxB,CAAC,IACD,CAAC;IAAC,IAAI;IAAiB;IAAO,KAAK,IAAI;IAAM,KAAK,QAAQ;GAAI,CAAC;EACrE;EAEA,KAAK,eACH,OAAO,CAAC;GAAC,IAAI;GAAe,OAAO,OAAO;GAAO,QAAQ,OAAO;EAAM,CAAC;EAEzE,KAAK,sBAAsB;GACzB,MAAM,EAAC,UAAU,YAAW;GAG5B,MAAM,UAAU,CAAC,GAAG,SAAS,OAAO,SAAS,GAAG,OAAO;GACvD,OAAO,QAAQ,WAAW,IACtB,CAAC,IACD,CACE;IACE,IAAI;IACJ,OAAO;KAAC,QAAQ,SAAS;KAAQ,MAAM,SAAS;IAAI;IACpD,SAAS;GACX,CACF;EACN;EAEA,KAAK;EACL,KAAK,cACH,OAAO,CAAC;EAEV,SAIE,YAAY,MAAM;CACtB;AACF;;;;;;;;;;;;;;AAeA,IAAa,wBAAb,MAAmC;CACjC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAEA,YAAY,IAAc;EACxB,KAAKA,kBAAkB,GAAG,QAAgB;qBACzB,gCAAgC;;;;KAIhD;EACD,KAAKC,kBAAkB,GAAG,QAAgB;qBACzB,6BAA6B;;;;KAI7C;EACD,KAAKC,uBAAuB,GAAG,QAAgB;gBACnC,gCAAgC;;KAE3C;EACD,KAAKC,uBAAuB,GAAG,QAAgB;gBACnC,6BAA6B;;KAExC;EACD,KAAKC,uBAAuB,GAAG,QAAgB;qBAC9B,gCAAgC;;KAEhD;EACD,KAAKC,uBAAuB,GAAG,QAAgB;qBAC9B,6BAA6B;;KAE7C;EACD,KAAKC,wBAAwB,GAAG,QAAgB;gBACpC,6BAA6B;;KAExC;EACD,KAAKC,wBAAwB,GAAG,QAAgB;qBAC/B,6BAA6B;;KAE7C;CACH;;CAGA,MAAM,QAAkC;EACtC,MAAM,MAAM,UAAU,MAAM;EAC5B,KAAK,MAAM,MAAM,KACf,KAAKC,KAAK,EAAE;EAEd,OAAO;CACT;CAEA,KAAK,IAAoB;EACvB,QAAQ,GAAG,IAAX;GACE,KAAK;IACH,KAAKR,gBAAgB,IACnB,GAAG,MAAM,QACT,GAAG,MAAM,MACT,WAAW,UAAU,GAAG,QAAQ,CAClC;IACA;GAEF,KAAK;IACH,KAAKC,gBAAgB,IACnB,GAAG,MAAM,QACT,GAAG,MAAM,MACT,GAAG,QACH,WAAW,UAAU,GAAG,QAAQ,CAClC;IACA;GAEF,KAAK;IACH,KAAKC,qBAAqB,IACxB,GAAG,IAAI,QACP,GAAG,IAAI,MACP,GAAG,IAAI,QACP,GAAG,IAAI,IACT;IACA,KAAKC,qBAAqB,IACxB,GAAG,IAAI,QACP,GAAG,IAAI,MACP,GAAG,IAAI,QACP,GAAG,IAAI,IACT;IACA;GAEF,KAAK;IACH,KAAKC,qBAAqB,IAAI,GAAG,MAAM,QAAQ,GAAG,MAAM,IAAI;IAC5D,KAAKC,qBAAqB,IAAI,GAAG,MAAM,QAAQ,GAAG,MAAM,IAAI;IAC5D;GAEF,KAAK;IACH,KAAKC,sBAAsB,IACzB,GAAG,KACH,GAAG,MAAM,QACT,GAAG,MAAM,MACT,GAAG,GACL;IACA;GAEF,KAAK;IACH,KAAKC,sBAAsB,IACzB,GAAG,MAAM,QACT,GAAG,MAAM,MACT,GAAG,MACL;IACA;GAEF,KAAK;IAIH,KAAK,MAAM,UAAU,GAAG,SACtB,KAAKA,sBAAsB,IACzB,GAAG,MAAM,QACT,GAAG,MAAM,MACT,MACF;IAEF;GAEF,SACE,YAAY,EAAE;EAClB;CACF;AACF;AAEA,IAAM,YAAY,QAAgB,UAChC,KAAK,UAAU,CAAC,QAAQ,KAAK,CAAC;AAEhC,IAAM,aAAa,QAAgB,OAAe,WAChD,KAAK,UAAU;CAAC;CAAQ;CAAO;AAAM,CAAC;AAExC,IAAM,OAAO,GAAW,MAAe,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI;;;;;;;;;;;;;;;;AAiBhE,SAAgB,YACd,SACA,SACW;CACX,MAAM,WAAW,IAAI,IACnB,QAAQ,cAAc,KAAI,MAAK,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CACjE;CACA,MAAM,cAAc,IAAI,IACtB,QAAQ,YAAY,KAAI,MAAK,CAAC,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAAC,CAC1E;CACA,MAAM,cAAc,EAAC,QAAQ,QAAmB,WAC9C,YAAY,OAAO,UAAU,QAAQ,MAAM,MAAM,CAAC;CAEpD,KAAK,MAAM,UAAU,SACnB,KAAK,MAAM,MAAM,UAAU,MAAM,GAC/B,QAAQ,GAAG,IAAX;EACE,KAAK;GACH,SAAS,IAAI,SAAS,GAAG,MAAM,QAAQ,GAAG,MAAM,IAAI,GAAG;IACrD,QAAQ,GAAG,MAAM;IACjB,OAAO,GAAG,MAAM;IAChB,UAAU,GAAG;GACf,CAAC;GACD;EAEF,KAAK;GACH,YAAY,IACV,UAAU,GAAG,MAAM,QAAQ,GAAG,MAAM,MAAM,GAAG,MAAM,GACnD;IACE,QAAQ,GAAG,MAAM;IACjB,OAAO,GAAG,MAAM;IAChB,QAAQ,GAAG;IACX,UAAU,GAAG;GACf,CACF;GACA;EAEF,KAAK,gBAAgB;GACnB,MAAM,EAAC,KAAK,KAAK,YAAW;GAC5B,MAAM,QAAQ,SAAS,IAAI,SAAS,IAAI,QAAQ,IAAI,IAAI,CAAC;GACzD,IAAI,OAAO;IACT,SAAS,OAAO,SAAS,IAAI,QAAQ,IAAI,IAAI,CAAC;IAC9C,SAAS,IAAI,SAAS,QAAQ,QAAQ,QAAQ,IAAI,GAAG;KACnD,GAAG;KACH,QAAQ,QAAQ;KAChB,OAAO,QAAQ;IACjB,CAAC;GACH;GAGA,KAAK,MAAM,CAAC,KAAK,WAAW,CAAC,GAAG,WAAW,GACzC,IAAI,OAAO,WAAW,IAAI,UAAU,OAAO,UAAU,IAAI,MAAM;IAC7D,YAAY,OAAO,GAAG;IACtB,YAAY,IACV,UAAU,QAAQ,QAAQ,QAAQ,MAAM,OAAO,MAAM,GACrD;KAAC,GAAG;KAAQ,QAAQ,QAAQ;KAAQ,OAAO,QAAQ;IAAI,CACzD;GACF;GAEF;EACF;EAEA,KAAK,cAAc;GACjB,MAAM,EAAC,QAAQ,SAAQ,GAAG;GAC1B,SAAS,OAAO,SAAS,QAAQ,IAAI,CAAC;GACtC,KAAK,MAAM,CAAC,KAAK,WAAW,CAAC,GAAG,WAAW,GACzC,IAAI,OAAO,WAAW,UAAU,OAAO,UAAU,MAC/C,YAAY,OAAO,GAAG;GAG1B;EACF;EAEA,KAAK,iBAAiB;GACpB,MAAM,EAAC,QAAQ,SAAQ,GAAG;GAC1B,MAAM,QAAQ,YAAY,IAAI,UAAU,QAAQ,MAAM,GAAG,GAAG,CAAC;GAC7D,IAAI,OAAO;IACT,YAAY,OAAO,UAAU,QAAQ,MAAM,GAAG,GAAG,CAAC;IAClD,YAAY,IAAI,UAAU,QAAQ,MAAM,GAAG,GAAG,GAAG;KAC/C,GAAG;KACH,QAAQ,GAAG;IACb,CAAC;GACH;GACA;EACF;EAEA,KAAK;GACH,WAAW,GAAG,OAAO,GAAG,MAAM;GAC9B;EAEF,KAAK;GACH,KAAK,MAAM,UAAU,GAAG,SACtB,WAAW,GAAG,OAAO,MAAM;GAE7B;EAEF,SACE,YAAY,EAAE;CAClB;CAIJ,OAAO;EACL,eAAe,CAAC,GAAG,SAAS,OAAO,CAAC,EAAE,UACnC,GAAG,MAAM,IAAI,EAAE,QAAQ,EAAE,MAAM,KAAK,IAAI,EAAE,OAAO,EAAE,KAAK,CAC3D;EACA,aAAa,CAAC,GAAG,YAAY,OAAO,CAAC,EAAE,UACpC,GAAG,MACF,IAAI,EAAE,QAAQ,EAAE,MAAM,KACtB,IAAI,EAAE,OAAO,EAAE,KAAK,KACpB,IAAI,EAAE,QAAQ,EAAE,MAAM,CAC1B;CACF;AACF;AAEA,IAAM,yBAAyB,eAAE,MAAM,qBAAqB;;;;;AAM5D,SAAgB,qBAAqB,SAAuC;CAC1E,MAAM,WAAW,IAAI,IACnB,QAAQ,cAAc,KAAI,MAAK,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,GAAG,EAAE,QAAQ,CAAC,CAC1E;CACA,MAAM,WAA8B,CAAC;CACrC,IAAI;CACJ,KAAK,MAAM,EAAC,QAAQ,OAAO,QAAQ,cAAa,QAAQ,aAAa;EACnE,IAAI,MAAM,MAAM,WAAW,UAAU,KAAK,MAAM,SAAS,OAAO;GAC9D,OAAO;IACL,OAAO;KACL;KACA,MAAM;KAGN,UAAU,SAAS,IAAI,SAAS,QAAQ,KAAK,CAAC,KAAK;IACrD;IACA,SAAS,CAAC;GACZ;GACA,SAAS,KAAK,IAAI;EACpB;EACA,KAAK,QAAQ,UAAU,EAAC,IAAI,SAAQ;CACtC;CACA,OAAO,MAAQ,UAAU,sBAAsB;AACjD;;;;;;AAOA,SAAgB,YAAY,IAAyB;CA4BnD,OAAO;EAAC,eA3Bc,GACnB,QAAgB;;gBAEL,gCAAgC;;KAE3C,EACA,IAAuD,EACvD,KAAK,EAAC,QAAQ,OAAO,gBAAe;GACnC;GACA;GACA,UAAU,WAAW,MAAM,QAAQ;EACrC,EAgBM;EAAe,aAdH,GACjB,QAAgB;;gBAEL,6BAA6B;;KAExC,EACA,IAAuE,EACvE,KAAK,EAAC,QAAQ,OAAO,QAAQ,gBAAe;GAC3C;GACA;GACA;GACA,UAAU,WAAW,MAAM,QAAQ;EACrC,EAEqB;CAAW;AACpC;;;;;;;;;;AAWA,SAAgB,eAAe,IAAc,SAA0B;CACrE,GAAG,QAAgB,gBAAgB,gCAAgC,EAAE,EAAE,IAAI;CAC3E,GAAG,QAAgB,gBAAgB,6BAA6B,EAAE,EAAE,IAAI;CAExE,IAAI,QAAQ,cAAc,SAAS,GAAG;EACpC,MAAM,SAAS,GAAG,QAAgB;qBACjB,gCAAgC;;KAEhD;EACD,KAAK,MAAM,EAAC,QAAQ,OAAO,cAAa,QAAQ,eAC9C,OAAO,IAAI,QAAQ,OAAO,WAAW,UAAU,QAAQ,CAAC;CAE5D;CACA,IAAI,QAAQ,YAAY,SAAS,GAAG;EAClC,MAAM,SAAS,GAAG,QAAgB;qBACjB,6BAA6B;;KAE7C;EACD,KAAK,MAAM,EAAC,QAAQ,OAAO,QAAQ,cAAa,QAAQ,aACtD,OAAO,IAAI,QAAQ,OAAO,QAAQ,WAAW,UAAU,QAAQ,CAAC;CAEpE;AACF;AAQA,SAAgB,oBAAoB,IAA+B;CACjE,OAAO,GACJ,QAAgB;;iCAEY,gCAAgC;;iCAEhC,6BAA6B;;KAEzD,EACA,IAAqB;AAC1B"}
+{"version":3,"file":"change-log-cookies.js","names":["v","v.parse"],"sources":["../../../../../../zero-cache/src/services/replicator/change-log-cookies.ts"],"sourcesContent":["/**\n * The change log's *second* job.\n *\n * A change log is a buffer **and** a cookie jar. The buffer catches a\n * reconnecting subscriber up to the head; the cookie jar holds the backfill\n * progress state that the change-streamer hands the change-source on every\n * `startStream`, so that the change source never has to persist backfill state\n * upstream. See `change-log-db.ts` for the buffer.\n *\n * There are two cookies, mirroring the two `cdc` tables the Postgres change log\n * has always carried (`change-streamer/schema/tables.ts`):\n *\n * - **table metadata**, the most current {@link TableMetadata} of a table, which\n *   a {@link BackfillRequest} has to carry; and\n * - **backfilling columns**, the opaque {@link BackfillID} of every column whose\n *   backfill has not completed.\n *\n * Both are a *fold over the change stream*: the cookie set is only meaningful\n * paired with the watermark it was folded up to. {@link cookieOps} is that fold,\n * expressed transport-free so that the Postgres change log and the SQLite change\n * log cannot drift from each other — they must agree on all eight transitions\n * forever, and the failure mode if they disagree is a backfill that is silently\n * never re-requested. The two interpreters are {@link ChangeLogCookieWriter}\n * here and `Storer.#trackBackfillMetadata()` in\n * `change-streamer/storer.ts`.\n *\n * The tables live in the change-log database rather than in the replica: the\n * replicator is a subscriber *downstream* of the change-streamer's write loop,\n * so its state version trails the log's head, and pairing its cookies with the\n * log's resume watermark would lose every backfill that completed in between.\n * The replica's own copies (`_zero.tableMetadata`, `_zero.column_metadata`) are\n * the *seed* source; these are the *working* set.\n */\n\nimport {unreachable} from '../../../../shared/src/asserts.ts';\nimport {BigIntJSON} from '../../../../shared/src/bigint-json.ts';\nimport * as v from '../../../../shared/src/valita.ts';\nimport type {Database, Statement} from '../../../../zqlite/src/db.ts';\nimport type {\n  BackfillID,\n  Identifier,\n  SchemaChange,\n  TableMetadata,\n} from '../change-source/protocol/current/data.ts';\nimport {\n  backfillRequestSchema,\n  type BackfillRequest,\n} from '../change-source/protocol/current/upstream.ts';\n\nexport const CHANGE_LOG_TABLE_METADATA_TABLE = '_zero.changeLogTableMetadata';\nexport const CHANGE_LOG_BACKFILLING_TABLE = '_zero.changeLogBackfilling';\n\n// The names follow the file's existing convention, beside\n// \"_zero.changeLogStream\" and \"_zero.changeLogMeta\".\n//\n// `metadata` and `backfill` hold the JSON that the `cdc` tables hold as JSONB.\n// SQLite has no JSONB, and nothing here queries into the documents: they are\n// stored to be handed back to the change source verbatim.\nexport const CREATE_CHANGE_LOG_COOKIE_SCHEMA = /*sql*/ `\n  CREATE TABLE \"${CHANGE_LOG_TABLE_METADATA_TABLE}\" (\n    \"schema\"   TEXT NOT NULL,\n    \"table\"    TEXT NOT NULL,\n    \"metadata\" TEXT NOT NULL,\n    PRIMARY KEY (\"schema\", \"table\")\n  );\n\n  CREATE TABLE \"${CHANGE_LOG_BACKFILLING_TABLE}\" (\n    \"schema\"   TEXT NOT NULL,\n    \"table\"    TEXT NOT NULL,\n    \"column\"   TEXT NOT NULL,\n    \"backfill\" TEXT NOT NULL,\n    PRIMARY KEY (\"schema\", \"table\", \"column\")\n  );\n`;\n\nexport const DROP_CHANGE_LOG_COOKIE_TABLES = /*sql*/ `\n  DROP TABLE IF EXISTS \"${CHANGE_LOG_TABLE_METADATA_TABLE}\";\n  DROP TABLE IF EXISTS \"${CHANGE_LOG_BACKFILLING_TABLE}\";\n`;\n\nexport type TableMetadataCookie = {\n  readonly schema: string;\n  readonly table: string;\n  readonly metadata: TableMetadata;\n};\n\nexport type BackfillCookie = {\n  readonly schema: string;\n  readonly table: string;\n  readonly column: string;\n  readonly backfill: BackfillID;\n};\n\n/**\n * The whole cookie set, as of the log's head. Both lists are ordered by their\n * primary key so that two stores' sets can be compared directly.\n */\nexport type CookieSet = {\n  readonly tableMetadata: readonly TableMetadataCookie[];\n  readonly backfilling: readonly BackfillCookie[];\n};\n\nexport const EMPTY_COOKIE_SET: CookieSet = {\n  tableMetadata: [],\n  backfilling: [],\n};\n\n/**\n * A transport-free description of a cookie mutation. This is the whole of what\n * a {@link SchemaChange} means to the cookie jar; everything else about the\n * change belongs to the buffer.\n */\nexport type CookieOp =\n  | {op: 'upsert-metadata'; table: Identifier; metadata: TableMetadata}\n  | {\n      op: 'upsert-backfill';\n      table: Identifier;\n      column: string;\n      backfill: BackfillID;\n    }\n  | {op: 'rename-table'; old: Identifier; new: Identifier}\n  | {op: 'drop-table'; table: Identifier}\n  | {op: 'rename-column'; table: Identifier; old: string; new: string}\n  | {op: 'drop-column'; table: Identifier; column: string}\n  | {op: 'complete-backfill'; table: Identifier; columns: readonly string[]};\n\nexport type CookieOpTag = CookieOp['op'];\n\n/**\n * The fold, and the only place either store decides what a schema change means\n * for the cookie set. Both interpreters are mechanical translations of what this\n * returns, in the order it returns them.\n *\n * Changes that carry no cookie state — index changes, and the `create-table` /\n * `add-column` variants whose optional `metadata` and `backfill` fields are\n * absent — produce no ops.\n */\nexport function cookieOps(change: SchemaChange): CookieOp[] {\n  switch (change.tag) {\n    case 'update-table-metadata':\n      return [\n        {op: 'upsert-metadata', table: change.table, metadata: change.new},\n      ];\n\n    case 'create-table': {\n      const {spec, metadata, backfill} = change;\n      const table = {schema: spec.schema, name: spec.name};\n      const ops: CookieOp[] = [];\n      if (metadata) {\n        ops.push({op: 'upsert-metadata', table, metadata});\n      }\n      if (backfill) {\n        for (const [column, id] of Object.entries(backfill)) {\n          ops.push({op: 'upsert-backfill', table, column, backfill: id});\n        }\n      }\n      return ops;\n    }\n\n    case 'rename-table':\n      return [{op: 'rename-table', old: change.old, new: change.new}];\n\n    case 'drop-table':\n      return [{op: 'drop-table', table: change.id}];\n\n    case 'add-column': {\n      const {table, tableMetadata, column, backfill} = change;\n      const ops: CookieOp[] = [];\n      if (tableMetadata) {\n        ops.push({op: 'upsert-metadata', table, metadata: tableMetadata});\n      }\n      if (backfill) {\n        ops.push({\n          op: 'upsert-backfill',\n          table,\n          column: column.name,\n          backfill,\n        });\n      }\n      return ops;\n    }\n\n    case 'update-column': {\n      // Only a rename moves the cookie; the rest of a column update does not\n      // affect whether or how it is being backfilled.\n      const {table, old, new: updated} = change;\n      return old.name === updated.name\n        ? []\n        : [{op: 'rename-column', table, old: old.name, new: updated.name}];\n    }\n\n    case 'drop-column':\n      return [{op: 'drop-column', table: change.table, column: change.column}];\n\n    case 'backfill-completed': {\n      const {relation, columns} = change;\n      // The rowKey columns are excluded from `columns` but are backfilled with\n      // them, so both are cleared.\n      const cleared = [...relation.rowKey.columns, ...columns];\n      return cleared.length === 0\n        ? []\n        : [\n            {\n              op: 'complete-backfill',\n              table: {schema: relation.schema, name: relation.name},\n              columns: cleared,\n            },\n          ];\n    }\n\n    case 'create-index':\n    case 'drop-index':\n      return [];\n\n    default:\n      // Unreachable: `isSchemaChange()` gates on the same tag set this switch\n      // covers. It is exhaustive so that a new schema-change tag is a compile\n      // error here rather than a silently dropped backfill.\n      unreachable(change);\n  }\n}\n\n/**\n * The SQLite interpreter of {@link cookieOps}, over prepared statements on the\n * change-log database.\n *\n * The statements run inside the log's transaction, in stream order, at the point\n * the schema change is appended (see `ChangeLogStreamWriter`). That is what\n * makes the cookie set atomic with the head — a crash cannot leave cookies ahead\n * of or behind the rows they were folded from — and what makes an aborted\n * transaction discard its cookies with its rows, for free.\n *\n * Statements are prepared against the tables as they exist now, so an instance\n * does not survive a reconcile that drops and recreates them.\n */\nexport class ChangeLogCookieWriter {\n  readonly #upsertMetadata: Statement;\n  readonly #upsertBackfill: Statement;\n  readonly #renameMetadataTable: Statement;\n  readonly #renameBackfillTable: Statement;\n  readonly #deleteMetadataTable: Statement;\n  readonly #deleteBackfillTable: Statement;\n  readonly #renameBackfillColumn: Statement;\n  readonly #deleteBackfillColumn: Statement;\n\n  constructor(db: Database) {\n    this.#upsertMetadata = db.prepare(/*sql*/ `\n      INSERT INTO \"${CHANGE_LOG_TABLE_METADATA_TABLE}\"\n        (\"schema\", \"table\", \"metadata\") VALUES (?, ?, ?)\n        ON CONFLICT (\"schema\", \"table\")\n        DO UPDATE SET \"metadata\" = excluded.\"metadata\"\n    `);\n    this.#upsertBackfill = db.prepare(/*sql*/ `\n      INSERT INTO \"${CHANGE_LOG_BACKFILLING_TABLE}\"\n        (\"schema\", \"table\", \"column\", \"backfill\") VALUES (?, ?, ?, ?)\n        ON CONFLICT (\"schema\", \"table\", \"column\")\n        DO UPDATE SET \"backfill\" = excluded.\"backfill\"\n    `);\n    this.#renameMetadataTable = db.prepare(/*sql*/ `\n      UPDATE \"${CHANGE_LOG_TABLE_METADATA_TABLE}\"\n        SET \"schema\" = ?, \"table\" = ? WHERE \"schema\" = ? AND \"table\" = ?\n    `);\n    this.#renameBackfillTable = db.prepare(/*sql*/ `\n      UPDATE \"${CHANGE_LOG_BACKFILLING_TABLE}\"\n        SET \"schema\" = ?, \"table\" = ? WHERE \"schema\" = ? AND \"table\" = ?\n    `);\n    this.#deleteMetadataTable = db.prepare(/*sql*/ `\n      DELETE FROM \"${CHANGE_LOG_TABLE_METADATA_TABLE}\"\n        WHERE \"schema\" = ? AND \"table\" = ?\n    `);\n    this.#deleteBackfillTable = db.prepare(/*sql*/ `\n      DELETE FROM \"${CHANGE_LOG_BACKFILLING_TABLE}\"\n        WHERE \"schema\" = ? AND \"table\" = ?\n    `);\n    this.#renameBackfillColumn = db.prepare(/*sql*/ `\n      UPDATE \"${CHANGE_LOG_BACKFILLING_TABLE}\" SET \"column\" = ?\n        WHERE \"schema\" = ? AND \"table\" = ? AND \"column\" = ?\n    `);\n    this.#deleteBackfillColumn = db.prepare(/*sql*/ `\n      DELETE FROM \"${CHANGE_LOG_BACKFILLING_TABLE}\"\n        WHERE \"schema\" = ? AND \"table\" = ? AND \"column\" = ?\n    `);\n  }\n\n  /** Applies the change's cookie ops, returning the ops that were applied. */\n  apply(change: SchemaChange): CookieOp[] {\n    const ops = cookieOps(change);\n    for (const op of ops) {\n      this.#run(op);\n    }\n    return ops;\n  }\n\n  #run(op: CookieOp): void {\n    switch (op.op) {\n      case 'upsert-metadata':\n        this.#upsertMetadata.run(\n          op.table.schema,\n          op.table.name,\n          BigIntJSON.stringify(op.metadata),\n        );\n        break;\n\n      case 'upsert-backfill':\n        this.#upsertBackfill.run(\n          op.table.schema,\n          op.table.name,\n          op.column,\n          BigIntJSON.stringify(op.backfill),\n        );\n        break;\n\n      case 'rename-table':\n        this.#renameMetadataTable.run(\n          op.new.schema,\n          op.new.name,\n          op.old.schema,\n          op.old.name,\n        );\n        this.#renameBackfillTable.run(\n          op.new.schema,\n          op.new.name,\n          op.old.schema,\n          op.old.name,\n        );\n        break;\n\n      case 'drop-table':\n        this.#deleteMetadataTable.run(op.table.schema, op.table.name);\n        this.#deleteBackfillTable.run(op.table.schema, op.table.name);\n        break;\n\n      case 'rename-column':\n        this.#renameBackfillColumn.run(\n          op.new,\n          op.table.schema,\n          op.table.name,\n          op.old,\n        );\n        break;\n\n      case 'drop-column':\n        this.#deleteBackfillColumn.run(\n          op.table.schema,\n          op.table.name,\n          op.column,\n        );\n        break;\n\n      case 'complete-backfill':\n        // A per-column delete rather than an `IN` list, which cannot be a\n        // single prepared statement across arities. The columns of one\n        // completed backfill are few, and this runs only on schema changes.\n        for (const column of op.columns) {\n          this.#deleteBackfillColumn.run(\n            op.table.schema,\n            op.table.name,\n            column,\n          );\n        }\n        break;\n\n      default:\n        unreachable(op);\n    }\n  }\n}\n\nconst tableKey = (schema: string, table: string) =>\n  JSON.stringify([schema, table]);\n\nconst columnKey = (schema: string, table: string, column: string) =>\n  JSON.stringify([schema, table, column]);\n\nconst cmp = (a: string, b: string) => (a < b ? -1 : a > b ? 1 : 0);\n\n/**\n * The in-memory interpreter of {@link cookieOps}: the third one, and the only\n * one that is not a store.\n *\n * A replica-derived cookie set is a snapshot at the replica's state version,\n * which trails the change log's head, so it cannot be compared with a\n * Postgres-derived set directly. This carries it forward over the schema changes\n * the log holds in between, which turns \"the two stores disagree, but they are\n * also at different positions\" into an exact equality — and makes a\n * disagreement between any two of the three interpreters visible as an\n * inequality that neither store would have noticed on its own.\n *\n * `changes` must be the log's schema changes over `(from, to]` in stream order.\n * Anything else produces a set that belongs to no watermark.\n */\nexport function foldCookies(\n  cookies: CookieSet,\n  changes: Iterable<SchemaChange>,\n): CookieSet {\n  const metadata = new Map<string, TableMetadataCookie>(\n    cookies.tableMetadata.map(c => [tableKey(c.schema, c.table), c]),\n  );\n  const backfilling = new Map<string, BackfillCookie>(\n    cookies.backfilling.map(c => [columnKey(c.schema, c.table, c.column), c]),\n  );\n  const dropColumn = ({schema, name}: Identifier, column: string) =>\n    backfilling.delete(columnKey(schema, name, column));\n\n  for (const change of changes) {\n    for (const op of cookieOps(change)) {\n      switch (op.op) {\n        case 'upsert-metadata':\n          metadata.set(tableKey(op.table.schema, op.table.name), {\n            schema: op.table.schema,\n            table: op.table.name,\n            metadata: op.metadata,\n          });\n          break;\n\n        case 'upsert-backfill':\n          backfilling.set(\n            columnKey(op.table.schema, op.table.name, op.column),\n            {\n              schema: op.table.schema,\n              table: op.table.name,\n              column: op.column,\n              backfill: op.backfill,\n            },\n          );\n          break;\n\n        case 'rename-table': {\n          const {old, new: renamed} = op;\n          const moved = metadata.get(tableKey(old.schema, old.name));\n          if (moved) {\n            metadata.delete(tableKey(old.schema, old.name));\n            metadata.set(tableKey(renamed.schema, renamed.name), {\n              ...moved,\n              schema: renamed.schema,\n              table: renamed.name,\n            });\n          }\n          // Snapshotted before mutating, since the rename both deletes and\n          // inserts into the map being scanned.\n          for (const [key, cookie] of [...backfilling]) {\n            if (cookie.schema === old.schema && cookie.table === old.name) {\n              backfilling.delete(key);\n              backfilling.set(\n                columnKey(renamed.schema, renamed.name, cookie.column),\n                {...cookie, schema: renamed.schema, table: renamed.name},\n              );\n            }\n          }\n          break;\n        }\n\n        case 'drop-table': {\n          const {schema, name} = op.table;\n          metadata.delete(tableKey(schema, name));\n          for (const [key, cookie] of [...backfilling]) {\n            if (cookie.schema === schema && cookie.table === name) {\n              backfilling.delete(key);\n            }\n          }\n          break;\n        }\n\n        case 'rename-column': {\n          const {schema, name} = op.table;\n          const moved = backfilling.get(columnKey(schema, name, op.old));\n          if (moved) {\n            backfilling.delete(columnKey(schema, name, op.old));\n            backfilling.set(columnKey(schema, name, op.new), {\n              ...moved,\n              column: op.new,\n            });\n          }\n          break;\n        }\n\n        case 'drop-column':\n          dropColumn(op.table, op.column);\n          break;\n\n        case 'complete-backfill':\n          for (const column of op.columns) {\n            dropColumn(op.table, column);\n          }\n          break;\n\n        default:\n          unreachable(op);\n      }\n    }\n  }\n\n  return {\n    tableMetadata: [...metadata.values()].toSorted(\n      (a, b) => cmp(a.schema, b.schema) || cmp(a.table, b.table),\n    ),\n    backfilling: [...backfilling.values()].toSorted(\n      (a, b) =>\n        cmp(a.schema, b.schema) ||\n        cmp(a.table, b.table) ||\n        cmp(a.column, b.column),\n    ),\n  };\n}\n\nconst backfillRequestsSchema = v.array(backfillRequestSchema);\n\n/**\n * Returns one {@link BackfillRequest} for each table with an active backfill.\n * Each request contains the stored table metadata, if available.\n */\nexport function backfillRequestsFrom(cookies: CookieSet): BackfillRequest[] {\n  const metadata = new Map(\n    cookies.tableMetadata.map(c => [tableKey(c.schema, c.table), c.metadata]),\n  );\n  const requests: BackfillRequest[] = [];\n  let curr: BackfillRequest | undefined;\n  for (const {schema, table, column, backfill} of cookies.backfilling) {\n    if (curr?.table.schema !== schema || curr.table.name !== table) {\n      curr = {\n        table: {\n          schema,\n          name: table,\n          // Use `null` when a backfilling table has no metadata. This matches\n          // the result of the Postgres left join.\n          metadata: metadata.get(tableKey(schema, table)) ?? null,\n        },\n        columns: {},\n      };\n      requests.push(curr);\n    }\n    curr.columns[column] = {id: backfill};\n  }\n  return v.parse(requests, backfillRequestsSchema);\n}\n\n/**\n * Reads the whole cookie set, ordered by primary key. This is what a\n * change-streamer would hand `startStream`, and what the Postgres-derived and\n * replica-derived sets are compared against.\n */\nexport function readCookies(db: Database): CookieSet {\n  const tableMetadata = db\n    .prepare(/*sql*/ `\n      SELECT \"schema\", \"table\", \"metadata\"\n        FROM \"${CHANGE_LOG_TABLE_METADATA_TABLE}\"\n        ORDER BY \"schema\", \"table\"\n    `)\n    .all<{schema: string; table: string; metadata: string}>()\n    .map(({schema, table, metadata}) => ({\n      schema,\n      table,\n      metadata: BigIntJSON.parse(metadata) as TableMetadata,\n    }));\n\n  const backfilling = db\n    .prepare(/*sql*/ `\n      SELECT \"schema\", \"table\", \"column\", \"backfill\"\n        FROM \"${CHANGE_LOG_BACKFILLING_TABLE}\"\n        ORDER BY \"schema\", \"table\", \"column\"\n    `)\n    .all<{schema: string; table: string; column: string; backfill: string}>()\n    .map(({schema, table, column, backfill}) => ({\n      schema,\n      table,\n      column,\n      backfill: BigIntJSON.parse(backfill) as BackfillID,\n    }));\n\n  return {tableMetadata, backfilling};\n}\n\n/**\n * Replaces the cookie set wholesale.\n *\n * The cookies are unversioned point-in-time state, so a reconciliation that\n * moves the head invalidates them: truncating the stream above `W` does not roll\n * the cookie set back to `W`, and the truncated transactions can contain\n * `create-table`, `add-column`, and `backfill-completed`. The caller must run\n * this in the same transaction as the reconciliation that invalidated them.\n */\nexport function replaceCookies(db: Database, cookies: CookieSet): void {\n  db.prepare(/*sql*/ `DELETE FROM \"${CHANGE_LOG_TABLE_METADATA_TABLE}\"`).run();\n  db.prepare(/*sql*/ `DELETE FROM \"${CHANGE_LOG_BACKFILLING_TABLE}\"`).run();\n\n  if (cookies.tableMetadata.length > 0) {\n    const insert = db.prepare(/*sql*/ `\n      INSERT INTO \"${CHANGE_LOG_TABLE_METADATA_TABLE}\"\n        (\"schema\", \"table\", \"metadata\") VALUES (?, ?, ?)\n    `);\n    for (const {schema, table, metadata} of cookies.tableMetadata) {\n      insert.run(schema, table, BigIntJSON.stringify(metadata));\n    }\n  }\n  if (cookies.backfilling.length > 0) {\n    const insert = db.prepare(/*sql*/ `\n      INSERT INTO \"${CHANGE_LOG_BACKFILLING_TABLE}\"\n        (\"schema\", \"table\", \"column\", \"backfill\") VALUES (?, ?, ?, ?)\n    `);\n    for (const {schema, table, column, backfill} of cookies.backfilling) {\n      insert.run(schema, table, column, BigIntJSON.stringify(backfill));\n    }\n  }\n}\n\n/** Retained cookie rows, by table. Both are normally zero. */\nexport type CookieRowCounts = {\n  readonly tableMetadata: number;\n  readonly backfilling: number;\n};\n\nexport function readCookieRowCounts(db: Database): CookieRowCounts {\n  return db\n    .prepare(/*sql*/ `\n      SELECT\n        (SELECT count(*) FROM \"${CHANGE_LOG_TABLE_METADATA_TABLE}\")\n          AS \"tableMetadata\",\n        (SELECT count(*) FROM \"${CHANGE_LOG_BACKFILLING_TABLE}\")\n          AS \"backfilling\"\n    `)\n    .get<CookieRowCounts>();\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiDA,IAAa,kCAAkC;AAC/C,IAAa,+BAA+B;AAQ5C,IAAa,kCAA0C;kBACrC,gCAAgC;;;;;;;kBAOhC,6BAA6B;;;;;;;;AAS/C,IAAa,gCAAwC;0BAC3B,gCAAgC;0BAChC,6BAA6B;;;;;;;;;;;AA4DvD,SAAgB,UAAU,QAAkC;CAC1D,QAAQ,OAAO,KAAf;EACE,KAAK,yBACH,OAAO,CACL;GAAC,IAAI;GAAmB,OAAO,OAAO;GAAO,UAAU,OAAO;EAAG,CACnE;EAEF,KAAK,gBAAgB;GACnB,MAAM,EAAC,MAAM,UAAU,aAAY;GACnC,MAAM,QAAQ;IAAC,QAAQ,KAAK;IAAQ,MAAM,KAAK;GAAI;GACnD,MAAM,MAAkB,CAAC;GACzB,IAAI,UACF,IAAI,KAAK;IAAC,IAAI;IAAmB;IAAO;GAAQ,CAAC;GAEnD,IAAI,UACF,KAAK,MAAM,CAAC,QAAQ,OAAO,OAAO,QAAQ,QAAQ,GAChD,IAAI,KAAK;IAAC,IAAI;IAAmB;IAAO;IAAQ,UAAU;GAAE,CAAC;GAGjE,OAAO;EACT;EAEA,KAAK,gBACH,OAAO,CAAC;GAAC,IAAI;GAAgB,KAAK,OAAO;GAAK,KAAK,OAAO;EAAG,CAAC;EAEhE,KAAK,cACH,OAAO,CAAC;GAAC,IAAI;GAAc,OAAO,OAAO;EAAE,CAAC;EAE9C,KAAK,cAAc;GACjB,MAAM,EAAC,OAAO,eAAe,QAAQ,aAAY;GACjD,MAAM,MAAkB,CAAC;GACzB,IAAI,eACF,IAAI,KAAK;IAAC,IAAI;IAAmB;IAAO,UAAU;GAAa,CAAC;GAElE,IAAI,UACF,IAAI,KAAK;IACP,IAAI;IACJ;IACA,QAAQ,OAAO;IACf;GACF,CAAC;GAEH,OAAO;EACT;EAEA,KAAK,iBAAiB;GAGpB,MAAM,EAAC,OAAO,KAAK,KAAK,YAAW;GACnC,OAAO,IAAI,SAAS,QAAQ,OACxB,CAAC,IACD,CAAC;IAAC,IAAI;IAAiB;IAAO,KAAK,IAAI;IAAM,KAAK,QAAQ;GAAI,CAAC;EACrE;EAEA,KAAK,eACH,OAAO,CAAC;GAAC,IAAI;GAAe,OAAO,OAAO;GAAO,QAAQ,OAAO;EAAM,CAAC;EAEzE,KAAK,sBAAsB;GACzB,MAAM,EAAC,UAAU,YAAW;GAG5B,MAAM,UAAU,CAAC,GAAG,SAAS,OAAO,SAAS,GAAG,OAAO;GACvD,OAAO,QAAQ,WAAW,IACtB,CAAC,IACD,CACE;IACE,IAAI;IACJ,OAAO;KAAC,QAAQ,SAAS;KAAQ,MAAM,SAAS;IAAI;IACpD,SAAS;GACX,CACF;EACN;EAEA,KAAK;EACL,KAAK,cACH,OAAO,CAAC;EAEV,SAIE,YAAY,MAAM;CACtB;AACF;;;;;;;;;;;;;;AAeA,IAAa,wBAAb,MAAmC;CACjC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAEA,YAAY,IAAc;EACxB,KAAK,kBAAkB,GAAG,QAAgB;qBACzB,gCAAgC;;;;KAIhD;EACD,KAAK,kBAAkB,GAAG,QAAgB;qBACzB,6BAA6B;;;;KAI7C;EACD,KAAK,uBAAuB,GAAG,QAAgB;gBACnC,gCAAgC;;KAE3C;EACD,KAAK,uBAAuB,GAAG,QAAgB;gBACnC,6BAA6B;;KAExC;EACD,KAAK,uBAAuB,GAAG,QAAgB;qBAC9B,gCAAgC;;KAEhD;EACD,KAAK,uBAAuB,GAAG,QAAgB;qBAC9B,6BAA6B;;KAE7C;EACD,KAAK,wBAAwB,GAAG,QAAgB;gBACpC,6BAA6B;;KAExC;EACD,KAAK,wBAAwB,GAAG,QAAgB;qBAC/B,6BAA6B;;KAE7C;CACH;;CAGA,MAAM,QAAkC;EACtC,MAAM,MAAM,UAAU,MAAM;EAC5B,KAAK,MAAM,MAAM,KACf,KAAK,KAAK,EAAE;EAEd,OAAO;CACT;CAEA,KAAK,IAAoB;EACvB,QAAQ,GAAG,IAAX;GACE,KAAK;IACH,KAAK,gBAAgB,IACnB,GAAG,MAAM,QACT,GAAG,MAAM,MACT,WAAW,UAAU,GAAG,QAAQ,CAClC;IACA;GAEF,KAAK;IACH,KAAK,gBAAgB,IACnB,GAAG,MAAM,QACT,GAAG,MAAM,MACT,GAAG,QACH,WAAW,UAAU,GAAG,QAAQ,CAClC;IACA;GAEF,KAAK;IACH,KAAK,qBAAqB,IACxB,GAAG,IAAI,QACP,GAAG,IAAI,MACP,GAAG,IAAI,QACP,GAAG,IAAI,IACT;IACA,KAAK,qBAAqB,IACxB,GAAG,IAAI,QACP,GAAG,IAAI,MACP,GAAG,IAAI,QACP,GAAG,IAAI,IACT;IACA;GAEF,KAAK;IACH,KAAK,qBAAqB,IAAI,GAAG,MAAM,QAAQ,GAAG,MAAM,IAAI;IAC5D,KAAK,qBAAqB,IAAI,GAAG,MAAM,QAAQ,GAAG,MAAM,IAAI;IAC5D;GAEF,KAAK;IACH,KAAK,sBAAsB,IACzB,GAAG,KACH,GAAG,MAAM,QACT,GAAG,MAAM,MACT,GAAG,GACL;IACA;GAEF,KAAK;IACH,KAAK,sBAAsB,IACzB,GAAG,MAAM,QACT,GAAG,MAAM,MACT,GAAG,MACL;IACA;GAEF,KAAK;IAIH,KAAK,MAAM,UAAU,GAAG,SACtB,KAAK,sBAAsB,IACzB,GAAG,MAAM,QACT,GAAG,MAAM,MACT,MACF;IAEF;GAEF,SACE,YAAY,EAAE;EAClB;CACF;AACF;AAEA,IAAM,YAAY,QAAgB,UAChC,KAAK,UAAU,CAAC,QAAQ,KAAK,CAAC;AAEhC,IAAM,aAAa,QAAgB,OAAe,WAChD,KAAK,UAAU;CAAC;CAAQ;CAAO;AAAM,CAAC;AAExC,IAAM,OAAO,GAAW,MAAe,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI;;;;;;;;;;;;;;;;AAiBhE,SAAgB,YACd,SACA,SACW;CACX,MAAM,WAAW,IAAI,IACnB,QAAQ,cAAc,KAAI,MAAK,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CACjE;CACA,MAAM,cAAc,IAAI,IACtB,QAAQ,YAAY,KAAI,MAAK,CAAC,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAAC,CAC1E;CACA,MAAM,cAAc,EAAC,QAAQ,QAAmB,WAC9C,YAAY,OAAO,UAAU,QAAQ,MAAM,MAAM,CAAC;CAEpD,KAAK,MAAM,UAAU,SACnB,KAAK,MAAM,MAAM,UAAU,MAAM,GAC/B,QAAQ,GAAG,IAAX;EACE,KAAK;GACH,SAAS,IAAI,SAAS,GAAG,MAAM,QAAQ,GAAG,MAAM,IAAI,GAAG;IACrD,QAAQ,GAAG,MAAM;IACjB,OAAO,GAAG,MAAM;IAChB,UAAU,GAAG;GACf,CAAC;GACD;EAEF,KAAK;GACH,YAAY,IACV,UAAU,GAAG,MAAM,QAAQ,GAAG,MAAM,MAAM,GAAG,MAAM,GACnD;IACE,QAAQ,GAAG,MAAM;IACjB,OAAO,GAAG,MAAM;IAChB,QAAQ,GAAG;IACX,UAAU,GAAG;GACf,CACF;GACA;EAEF,KAAK,gBAAgB;GACnB,MAAM,EAAC,KAAK,KAAK,YAAW;GAC5B,MAAM,QAAQ,SAAS,IAAI,SAAS,IAAI,QAAQ,IAAI,IAAI,CAAC;GACzD,IAAI,OAAO;IACT,SAAS,OAAO,SAAS,IAAI,QAAQ,IAAI,IAAI,CAAC;IAC9C,SAAS,IAAI,SAAS,QAAQ,QAAQ,QAAQ,IAAI,GAAG;KACnD,GAAG;KACH,QAAQ,QAAQ;KAChB,OAAO,QAAQ;IACjB,CAAC;GACH;GAGA,KAAK,MAAM,CAAC,KAAK,WAAW,CAAC,GAAG,WAAW,GACzC,IAAI,OAAO,WAAW,IAAI,UAAU,OAAO,UAAU,IAAI,MAAM;IAC7D,YAAY,OAAO,GAAG;IACtB,YAAY,IACV,UAAU,QAAQ,QAAQ,QAAQ,MAAM,OAAO,MAAM,GACrD;KAAC,GAAG;KAAQ,QAAQ,QAAQ;KAAQ,OAAO,QAAQ;IAAI,CACzD;GACF;GAEF;EACF;EAEA,KAAK,cAAc;GACjB,MAAM,EAAC,QAAQ,SAAQ,GAAG;GAC1B,SAAS,OAAO,SAAS,QAAQ,IAAI,CAAC;GACtC,KAAK,MAAM,CAAC,KAAK,WAAW,CAAC,GAAG,WAAW,GACzC,IAAI,OAAO,WAAW,UAAU,OAAO,UAAU,MAC/C,YAAY,OAAO,GAAG;GAG1B;EACF;EAEA,KAAK,iBAAiB;GACpB,MAAM,EAAC,QAAQ,SAAQ,GAAG;GAC1B,MAAM,QAAQ,YAAY,IAAI,UAAU,QAAQ,MAAM,GAAG,GAAG,CAAC;GAC7D,IAAI,OAAO;IACT,YAAY,OAAO,UAAU,QAAQ,MAAM,GAAG,GAAG,CAAC;IAClD,YAAY,IAAI,UAAU,QAAQ,MAAM,GAAG,GAAG,GAAG;KAC/C,GAAG;KACH,QAAQ,GAAG;IACb,CAAC;GACH;GACA;EACF;EAEA,KAAK;GACH,WAAW,GAAG,OAAO,GAAG,MAAM;GAC9B;EAEF,KAAK;GACH,KAAK,MAAM,UAAU,GAAG,SACtB,WAAW,GAAG,OAAO,MAAM;GAE7B;EAEF,SACE,YAAY,EAAE;CAClB;CAIJ,OAAO;EACL,eAAe,CAAC,GAAG,SAAS,OAAO,CAAC,CAAC,CAAC,UACnC,GAAG,MAAM,IAAI,EAAE,QAAQ,EAAE,MAAM,KAAK,IAAI,EAAE,OAAO,EAAE,KAAK,CAC3D;EACA,aAAa,CAAC,GAAG,YAAY,OAAO,CAAC,CAAC,CAAC,UACpC,GAAG,MACF,IAAI,EAAE,QAAQ,EAAE,MAAM,KACtB,IAAI,EAAE,OAAO,EAAE,KAAK,KACpB,IAAI,EAAE,QAAQ,EAAE,MAAM,CAC1B;CACF;AACF;AAEA,IAAM,yBAAyBA,eAAE,MAAM,qBAAqB;;;;;AAM5D,SAAgB,qBAAqB,SAAuC;CAC1E,MAAM,WAAW,IAAI,IACnB,QAAQ,cAAc,KAAI,MAAK,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,GAAG,EAAE,QAAQ,CAAC,CAC1E;CACA,MAAM,WAA8B,CAAC;CACrC,IAAI;CACJ,KAAK,MAAM,EAAC,QAAQ,OAAO,QAAQ,cAAa,QAAQ,aAAa;EACnE,IAAI,MAAM,MAAM,WAAW,UAAU,KAAK,MAAM,SAAS,OAAO;GAC9D,OAAO;IACL,OAAO;KACL;KACA,MAAM;KAGN,UAAU,SAAS,IAAI,SAAS,QAAQ,KAAK,CAAC,KAAK;IACrD;IACA,SAAS,CAAC;GACZ;GACA,SAAS,KAAK,IAAI;EACpB;EACA,KAAK,QAAQ,UAAU,EAAC,IAAI,SAAQ;CACtC;CACA,OAAOC,MAAQ,UAAU,sBAAsB;AACjD;;;;;;AAOA,SAAgB,YAAY,IAAyB;CA4BnD,OAAO;EAAC,eA3Bc,GACnB,QAAgB;;gBAEL,gCAAgC;;KAE3C,CAAC,CACD,IAAuD,CAAC,CACxD,KAAK,EAAC,QAAQ,OAAO,gBAAe;GACnC;GACA;GACA,UAAU,WAAW,MAAM,QAAQ;EACrC,EAgBM;EAAe,aAdH,GACjB,QAAgB;;gBAEL,6BAA6B;;KAExC,CAAC,CACD,IAAuE,CAAC,CACxE,KAAK,EAAC,QAAQ,OAAO,QAAQ,gBAAe;GAC3C;GACA;GACA;GACA,UAAU,WAAW,MAAM,QAAQ;EACrC,EAEqB;CAAW;AACpC;;;;;;;;;;AAWA,SAAgB,eAAe,IAAc,SAA0B;CACrE,GAAG,QAAgB,gBAAgB,gCAAgC,EAAE,CAAC,CAAC,IAAI;CAC3E,GAAG,QAAgB,gBAAgB,6BAA6B,EAAE,CAAC,CAAC,IAAI;CAExE,IAAI,QAAQ,cAAc,SAAS,GAAG;EACpC,MAAM,SAAS,GAAG,QAAgB;qBACjB,gCAAgC;;KAEhD;EACD,KAAK,MAAM,EAAC,QAAQ,OAAO,cAAa,QAAQ,eAC9C,OAAO,IAAI,QAAQ,OAAO,WAAW,UAAU,QAAQ,CAAC;CAE5D;CACA,IAAI,QAAQ,YAAY,SAAS,GAAG;EAClC,MAAM,SAAS,GAAG,QAAgB;qBACjB,6BAA6B;;KAE7C;EACD,KAAK,MAAM,EAAC,QAAQ,OAAO,QAAQ,cAAa,QAAQ,aACtD,OAAO,IAAI,QAAQ,OAAO,QAAQ,WAAW,UAAU,QAAQ,CAAC;CAEpE;AACF;AAQA,SAAgB,oBAAoB,IAA+B;CACjE,OAAO,GACJ,QAAgB;;iCAEY,gCAAgC;;iCAEhC,6BAA6B;;KAEzD,CAAC,CACD,IAAqB;AAC1B"}

package/out/zero-cache/src/services/replicator/change-log-db.js

@@ -1,6 +1,6 @@
 import { Database } from "../../../../zqlite/src/db.js";
-import { CREATE_CHANGE_LOG_COOKIE_SCHEMA, DROP_CHANGE_LOG_COOKIE_TABLES, replaceCookies } from "./change-log-cookies.js";
 import { isSQLiteCorruption, logSQLiteCorruptionDiagnostics } from "../../db/sqlite-corruption.js";
+import { CREATE_CHANGE_LOG_COOKIE_SCHEMA, DROP_CHANGE_LOG_COOKIE_TABLES, replaceCookies } from "./change-log-cookies.js";
 import { deleteLiteDB } from "../../db/delete-lite-db.js";
 import { existsSync } from "node:fs";
 /** https://www.sqlite.org/pragma.html#pragma_auto_vacuum */
@@ -238,6 +238,7 @@ function openAndReconcile(lc, replicaFile, anchor, boundReconciliation, reseedRe
 * arbitrarily large suffix in place.
 */
 var MAX_RECONCILE_TRUNCATE_ROWS = 1e4;
+var MAX_RECONCILE_TRUNCATE_BYTES = 16777216;
 var ChangeLogRebuildRequired = class extends Error {
 	name = "ChangeLogRebuildRequired";
 	reason;
@@ -321,7 +322,7 @@ function rebuildRequired(db, anchor) {
         FROM (
           SELECT "estimatedBytes" FROM "${CHANGE_LOG_STREAM_TABLE}"
             WHERE "watermark" > ?
-            LIMIT ${MAX_RECONCILE_TRUNCATE_ROWS + 1}
+            LIMIT 10001
         )
     `).get(resumeWatermark);
 	return rows > 1e4 || estimatedBytes > 16777216 ? new ChangeLogRebuildRequired("oversized-truncate", rows, estimatedBytes) : void 0;
@@ -486,6 +487,6 @@ function tableExists(db, table) {
       `).get(table) !== void 0;
 }
 //#endregion
-export { CHANGE_LOG_STREAM_TABLE, ChangeLogRebuildRequired, changeLogFileName, changeLogWipeReason, deleteChangeLogDB, estimateChangeLogStreamRowBytes, openChangeLogDBForWriting, readChangeLogBounds, readChangeLogHead, readChangeLogMeta, rebuildChangeLogDBForWriting, reconcileChangeLog };
+export { CHANGE_LOG_META_TABLE, CHANGE_LOG_STREAM_TABLE, CHANGE_LOG_STREAM_WRITE_TIME_INDEX, CREATE_CHANGE_LOG_STREAM_SCHEMA, ChangeLogRebuildRequired, MAX_RECONCILE_TRUNCATE_BYTES, MAX_RECONCILE_TRUNCATE_ROWS, applyChangeLogPragmas, changeLogFileName, changeLogWipeReason, deleteChangeLogDB, estimateChangeLogStreamRowBytes, openChangeLogDB, openChangeLogDBForWriting, readChangeLogBounds, readChangeLogHead, readChangeLogMeta, rebuildChangeLogDBForWriting, reconcileChangeLog };
 
 //# sourceMappingURL=change-log-db.js.map