@sixb/pg 0.1.13 → 0.1.15

package/dist/index.js

@@ -32,20 +32,34 @@ import {
 } from "@sixb/core/storage";
 
 // src/storage-errors.ts
+import { createSixbError } from "@sixb/core/internal/errors";
 var UNIQUE_VIOLATION = "23505";
 var FOREIGN_KEY_VIOLATION = "23503";
 var RETRYABLE_TRANSACTION_CONFLICT_CODES = new Set(["40001", "40P01"]);
-var CONNECTION_ERROR_CODES = new Set([
-  "CONNECT_TIMEOUT",
+var CONNECTION_LOST_CODES = new Set([
   "CONNECTION_CLOSED",
   "CONNECTION_DESTROYED",
-  "CONNECTION_ENDED",
-  "ECONNREFUSED",
   "ECONNRESET",
-  "ETIMEDOUT",
+  "EPIPE",
+  "ETIMEDOUT"
+]);
+var CONNECT_FAILED_CODES = new Set([
+  "CONNECT_TIMEOUT",
+  "ECONNREFUSED",
   "ENOTFOUND",
-  "EAI_AGAIN"
+  "EAI_AGAIN",
+  "EHOSTUNREACH",
+  "ENETUNREACH"
 ]);
+var LOCK_TABLES = [
+  {
+    setting: "max_pred_locks_per_transaction",
+    table: "predicate lock table",
+    note: " A long serializable transaction also keeps the predicate locks of every serializable" + " transaction that commits while it is open."
+  },
+  { setting: "max_locks_per_transaction", table: "lock table", note: "" }
+];
+var OUT_OF_MEMORY = "53200";
 function pgErrorCode(error) {
   if (error instanceof Error) {
     const code = error.code;
@@ -65,30 +79,101 @@ function isRetryableTransactionConflict(error) {
   const code = pgErrorCode(error);
   return code !== undefined && RETRYABLE_TRANSACTION_CONFLICT_CODES.has(code);
 }
+function isConnectionLost(error) {
+  const code = pgErrorCode(error);
+  if (code !== undefined && CONNECTION_LOST_CODES.has(code)) {
+    return true;
+  }
+  const severity = error instanceof Error ? error.severity : null;
+  return severity === "FATAL" || severity === "PANIC";
+}
+function explainPgError(error) {
+  if (isStorageUnavailable(error)) {
+    return storageUnavailable(error);
+  }
+  if (!(error instanceof Error) || pgErrorCode(error) !== OUT_OF_MEMORY) {
+    return error;
+  }
+  const hint = error.hint;
+  const lockTable = typeof hint === "string" ? LOCK_TABLES.find(({ setting }) => hint.includes(setting)) : undefined;
+  if (!lockTable) {
+    return error;
+  }
+  const { setting, table, note } = lockTable;
+  return new Error(`[SixbPg] PostgreSQL aborted the transaction because its shared ${table} is full ` + `(SQLSTATE 53200 "${error.message}"). The table holds ${setting} \xD7 (max_connections + ` + `max_prepared_transactions) entries shared by all sessions.${note} Raise ${setting} ` + "(applied at server restart) or shorten the transactions that overlap.", { cause: error });
+}
+function isStorageUnavailable(error) {
+  const code = pgErrorCode(error);
+  return isConnectionLost(error) || code !== undefined && CONNECT_FAILED_CODES.has(code);
+}
+function storageUnavailable(error) {
+  const code = pgErrorCode(error);
+  const reason = error instanceof Error ? error.message : String(error);
+  return createSixbError("storage.unavailable", `[SixbPg] PostgreSQL is unavailable: the connection was lost or could not be opened (${code ?? "no code"}: ${reason}).`, { cause: error, ...code === undefined ? {} : { details: { code } } });
+}
 
 // src/transactions.ts
 import { createHash } from "crypto";
+var BEGIN_STATEMENTS = {
+  unverifiedDefault: "BEGIN",
+  repeatableRead: "BEGIN ISOLATION LEVEL REPEATABLE READ",
+  serializable: "BEGIN ISOLATION LEVEL SERIALIZABLE"
+};
+var pgTransactionClients = new WeakSet;
 var activePgTransactions = new WeakMap;
 async function runPgTransaction(sql, run, options = {}) {
   if (!canStartPgTransaction(sql)) {
     return run(sql);
   }
   const isolation = options.isolation ?? "unverifiedDefault";
-  const trackedRun = async (tx) => {
-    activePgTransactions.set(tx, isolation);
-    try {
-      return await run(tx);
-    } finally {
-      activePgTransactions.delete(tx);
+  try {
+    return await withReservedPgConnection(sql, (tx) => {
+      pgTransactionClients.add(tx);
+      return runPgTransactionOn(tx, async () => {
+        activePgTransactions.set(tx, isolation);
+        try {
+          return await run(tx);
+        } finally {
+          activePgTransactions.delete(tx);
+        }
+      }, isolation);
+    });
+  } catch (error) {
+    throw explainPgError(error);
+  }
+}
+async function withReservedPgConnection(sql, run) {
+  const connection = await sql.reserve();
+  let usable = true;
+  try {
+    return await run(connection);
+  } catch (error) {
+    usable = !isConnectionLost(error);
+    throw error;
+  } finally {
+    if (usable) {
+      connection.release();
     }
-  };
-  if (isolation === "serializable") {
-    return sql.begin("isolation level serializable", trackedRun);
   }
-  if (isolation === "repeatableRead") {
-    return sql.begin("isolation level repeatable read", trackedRun);
+}
+async function runPgTransactionOn(connection, run, isolation = "unverifiedDefault") {
+  await connection.unsafe(BEGIN_STATEMENTS[isolation]);
+  const result = await undoOnFailure(run, () => connection.unsafe("ROLLBACK"));
+  const commit = await connection.unsafe("COMMIT");
+  if (commit.command !== "COMMIT") {
+    throw new Error("[SixbPg] PostgreSQL rolled the transaction back instead of committing it: a statement in it" + " failed and its error was caught without being rethrown. A failed statement aborts the" + " whole transaction, so let its error propagate out of the transaction callback.");
+  }
+  return result;
+}
+async function undoOnFailure(run, undo) {
+  try {
+    return await run();
+  } catch (error) {
+    if (!isConnectionLost(error)) {
+      await undo();
+    }
+    throw error;
   }
-  return sql.begin(trackedRun);
 }
 async function runPgRepeatableReadTransaction(sql, run) {
   if (canStartPgTransaction(sql)) {
@@ -121,7 +206,7 @@ function advisoryLockParts(key) {
   return [hash.readInt32BE(0), hash.readInt32BE(4)];
 }
 function canStartPgTransaction(sql) {
-  return typeof sql.begin === "function";
+  return !pgTransactionClients.has(sql) && typeof sql.reserve === "function";
 }
 
 // src/agents/rows.ts
@@ -3055,17 +3140,6 @@ class PgAuthStorage {
           error: new AuthStorageError11("user_creation_not_allowed", `[Sixb] Magic link '${input.magicLinkId}' cannot create a user for project '${projectId}'.`)
         };
       }
-      if (shouldCreateUser && !activeInvitation && input.allowUserCreationWithoutInvitation && input.requireNoActiveUsersForUserCreation && await hasActiveUsers(tx, projectId)) {
-        await consumeMagicLink(tx, {
-          projectId,
-          id: input.magicLinkId,
-          tokenHash: input.tokenHash,
-          consumedAt: completedAt
-        });
-        return {
-          error: new AuthStorageError11("user_creation_not_allowed", `[Sixb] Magic link '${input.magicLinkId}' cannot create a user for project '${projectId}'.`)
-        };
-      }
       await validateCompleteSessionInput(tx, projectId, input.session);
       assertSignInSessionAudience(projectId, input.session.audience, magicLink.audience);
       let newUserId;
@@ -3097,8 +3171,9 @@ class PgAuthStorage {
         projectId,
         user
       });
-      const groupMemberships = await this.applyManualGroups(tx, {
+      const groupMemberships = await this.applyGroups(tx, {
         completedAt,
+        source: "manual",
         existing: invitation.groupMemberships,
         groupIds: manualGroupIds,
         projectId,
@@ -3158,36 +3233,18 @@ class PgAuthStorage {
           error: new AuthStorageError11("missing_user", `[Sixb] User '${identity.user_id}' not found for linked OIDC identity.`)
         };
       }
-      if (!identity && userRow && (!input.autoLinkByVerifiedEmail || !input.emailVerified)) {
-        await this.consumeOidcAttempt(input, completedAt, projectId, tx);
-        return {
-          error: new AuthStorageError11("email_link_not_allowed", `[Sixb] OIDC identity cannot auto-link to user '${userRow.id}' for project '${projectId}'.`)
-        };
-      }
       if (userRow?.status === "suspended") {
         await this.consumeOidcAttempt(input, completedAt, projectId, tx);
         return {
           error: new AuthStorageError11("suspended_user", `[Sixb] User '${userRow.id}' is suspended for project '${projectId}'.`)
         };
       }
-      if (shouldCreateUser && !input.emailVerified) {
-        await this.consumeOidcAttempt(input, completedAt, projectId, tx);
-        return {
-          error: new AuthStorageError11("user_creation_not_allowed", `[Sixb] OIDC authorization attempt '${input.oidcAuthorizationAttemptId}' cannot create a user for project '${projectId}'.`)
-        };
-      }
       if (shouldCreateUser && !activeInvitation && !input.allowUserCreationWithoutInvitation) {
         await this.consumeOidcAttempt(input, completedAt, projectId, tx);
         return {
           error: new AuthStorageError11("user_creation_not_allowed", `[Sixb] OIDC authorization attempt '${input.oidcAuthorizationAttemptId}' cannot create a user for project '${projectId}'.`)
         };
       }
-      if (shouldCreateUser && !activeInvitation && input.allowUserCreationWithoutInvitation && input.requireNoActiveUsersForUserCreation && await hasActiveUsers(tx, projectId)) {
-        await this.consumeOidcAttempt(input, completedAt, projectId, tx);
-        return {
-          error: new AuthStorageError11("user_creation_not_allowed", `[Sixb] OIDC authorization attempt '${input.oidcAuthorizationAttemptId}' cannot create a user for project '${projectId}'.`)
-        };
-      }
       await validateCompleteSessionInput(tx, projectId, input.session);
       assertSignInSessionAudience(projectId, input.session.audience, attempt.audience);
       let newUserId;
@@ -3230,10 +3287,17 @@ class PgAuthStorage {
         projectId,
         user
       });
-      const groupMemberships = await this.applyManualGroups(tx, {
+      const groupMemberships = await this.syncDirectoryGroups(tx, {
         completedAt,
-        existing: invitation.groupMemberships,
-        groupIds: manualGroupIds,
+        existing: await this.applyGroups(tx, {
+          completedAt,
+          source: "manual",
+          existing: invitation.groupMemberships,
+          groupIds: manualGroupIds,
+          projectId,
+          userId: user.id
+        }),
+        groupIds: input.directoryGroupIds,
         projectId,
         userId: user.id
       });
@@ -3362,19 +3426,33 @@ class PgAuthStorage {
     }
     return { invitation, groupMemberships };
   }
-  async applyManualGroups(sql, input) {
+  async applyGroups(sql, input) {
     const groupMemberships = [...input.existing];
     for (const groupId of input.groupIds) {
       groupMemberships.push(await upsertGroupMembership(sql, {
         projectId: input.projectId,
         userId: input.userId,
         groupId,
-        source: "manual",
+        source: input.source,
         createdAt: input.completedAt
       }));
     }
     return groupMemberships;
   }
+  async syncDirectoryGroups(sql, input) {
+    if (!input.groupIds) {
+      return input.existing;
+    }
+    const groupIds = normalizeGroupIds(input.groupIds);
+    await sql`
+      DELETE FROM auth_group_memberships
+      WHERE project_id = ${input.projectId}
+        AND user_id = ${input.userId}
+        AND source = 'directory'
+        ${groupIds.length > 0 ? sql`AND group_id NOT IN ${sql(groupIds)}` : sql``}
+    `;
+    return this.applyGroups(sql, { ...input, groupIds, source: "directory" });
+  }
   async createSignInSession(sql, input) {
     await lockAdvisoryKeys(sql, [
       authLockKey("sessions", input.projectId, input.userId),
@@ -3431,16 +3509,6 @@ class PgAuthStorage {
     return rowToIdentityRecord(row);
   }
 }
-async function hasActiveUsers(sql, projectId) {
-  const rows = await sql`
-    SELECT 1 AS active
-    FROM auth_users
-    WHERE project_id = ${projectId}
-      AND status = 'active'
-    LIMIT 1
-  `;
-  return rows.length > 0;
-}
 function assertSignInSessionAudience(projectId, sessionAudience, storedAudience) {
   if (sessionAudience === storedAudience) {
     return;
@@ -7388,6 +7456,181 @@ ALTER TABLE auth_device_authorizations
   DROP COLUMN token_expires_at;
 `;
 
+// src/migrations/050-directory-group-memberships.sql
+var _050_directory_group_memberships_default = `-- A membership the identity provider owns is recorded with source 'directory' and synced to the
+-- provider's groups on every sign-in. Service accounts never sign in, so their table is unchanged.
+ALTER TABLE auth_group_memberships DROP CONSTRAINT auth_group_memberships_source_check;
+ALTER TABLE auth_group_memberships ADD CONSTRAINT auth_group_memberships_source_check
+  CHECK (source IN ('invitation', 'manual', 'agent', 'directory'));
+`;
+
+// src/migrations/051-projection-run-supersession.sql
+var _051_projection_run_supersession_default = `-- Projection runs gain the terminal status \`superseded\`, and a running run may carry the failure
+-- of its last attempt in \`error\` while the queue retries it.
+
+-- The status checks were unnamed. Drop exactly the two that enumerate the terminal statuses, then
+-- replace them with named ones that admit \`superseded\`.
+DO $$
+DECLARE status_constraint RECORD;
+BEGIN
+  FOR status_constraint IN
+    SELECT conname
+    FROM pg_constraint
+    WHERE conrelid = 'projection_runs'::regclass
+      AND contype = 'c'
+      AND pg_get_constraintdef(oid) LIKE '%''cancelled''%'
+  LOOP
+    EXECUTE format('ALTER TABLE projection_runs DROP CONSTRAINT %I', status_constraint.conname);
+  END LOOP;
+END $$;
+
+ALTER TABLE projection_runs
+  ADD CONSTRAINT projection_runs_status_check CHECK (
+    status IN ('queued', 'running', 'succeeded', 'failed', 'cancelled', 'superseded')
+  ),
+  ADD CONSTRAINT projection_runs_lifecycle_check CHECK (
+    (status = 'queued' AND attempt = 0 AND started_at IS NULL AND finished_at IS NULL
+      AND error IS NULL)
+    OR (status = 'running' AND attempt >= 1 AND started_at IS NOT NULL AND finished_at IS NULL)
+    OR (
+      status IN ('succeeded', 'failed', 'cancelled', 'superseded')
+      AND finished_at IS NOT NULL
+      AND (
+        (error->>'code' = 'queue.enqueue_failed'
+          AND status = 'failed' AND attempt = 0 AND started_at IS NULL)
+        OR (COALESCE(error->>'code', '') != 'queue.enqueue_failed'
+          AND attempt >= 1 AND started_at IS NOT NULL)
+      )
+    )
+  ),
+  -- A run is superseded instead of materialized, so it carries no failure, and only replacement
+  -- runs can be: telemetry appends readings rather than replace a source.
+  ADD CONSTRAINT projection_runs_superseded_check CHECK (
+    status != 'superseded' OR (error IS NULL AND materialization_protocol = 'replacement')
+  );
+`;
+
+// src/migrations/052-compact-source-storage.sql
+var _052_compact_source_storage_default = `-- Source versions get a compact surrogate key; roots and rows stop repeating the text triple.
+ALTER TABLE ontology_sources ADD COLUMN version_id BIGINT GENERATED ALWAYS AS IDENTITY;
+ALTER TABLE ontology_sources ADD CONSTRAINT ontology_sources_version_id_key UNIQUE (version_id);
+
+ALTER TABLE ontology_source_rows RENAME TO legacy_ontology_source_rows;
+ALTER TABLE ontology_source_roots RENAME TO legacy_ontology_source_roots;
+-- Index names are schema-wide: free them for the new tables.
+DO $$
+DECLARE
+  legacy record;
+BEGIN
+  FOR legacy IN
+    SELECT index_class.relname AS name
+    FROM pg_index
+    JOIN pg_class AS index_class ON index_class.oid = pg_index.indexrelid
+    JOIN pg_class AS table_class ON table_class.oid = pg_index.indrelid
+    WHERE table_class.relnamespace = current_schema()::regnamespace
+      AND table_class.relname IN ('legacy_ontology_source_rows', 'legacy_ontology_source_roots')
+  LOOP
+    EXECUTE format('ALTER INDEX %I RENAME TO %I', legacy.name, left('legacy_' || legacy.name, 63));
+  END LOOP;
+END $$;
+
+-- A root is live while its version is published (active or superseded), it is not retired and
+-- it is not a deletion. Activation therefore writes only the roots it replaces, never its own.
+-- \`root_key\` is the canonical key; "C" orders it by its UTF-8 bytes.
+CREATE TABLE ontology_source_roots (
+  id BIGINT GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
+  version_id BIGINT NOT NULL REFERENCES ontology_sources (version_id) ON DELETE RESTRICT,
+  project_id TEXT NOT NULL,
+  root_key TEXT COLLATE "C" NOT NULL,
+  staging_ordinal BIGINT NOT NULL CHECK (staging_ordinal >= 0),
+  deleted BOOLEAN NOT NULL DEFAULT FALSE,
+  retired_at TIMESTAMPTZ,
+  CONSTRAINT ontology_source_roots_key UNIQUE (version_id, root_key),
+  CONSTRAINT ontology_source_roots_ordinal UNIQUE (version_id, staging_ordinal)
+);
+CREATE INDEX idx_ontology_source_roots_live
+  ON ontology_source_roots (project_id, root_key) WHERE retired_at IS NULL AND NOT deleted;
+CREATE INDEX idx_ontology_source_roots_retired
+  ON ontology_source_roots (project_id, retired_at) WHERE retired_at IS NOT NULL;
+
+-- A row's identity lives in its typed columns; \`payload\` is the assertion without kind and ref.
+CREATE TABLE ontology_source_rows (
+  root_id BIGINT NOT NULL REFERENCES ontology_source_roots (id) ON DELETE RESTRICT,
+  entity_kind TEXT NOT NULL CHECK (entity_kind IN ('object', 'link')),
+  object_type_id TEXT,
+  primary_id TEXT,
+  source_type_id TEXT,
+  source_primary_id TEXT,
+  link_id TEXT,
+  target_type_id TEXT,
+  target_primary_id TEXT,
+  payload JSONB,
+  CHECK (
+    (
+      entity_kind = 'object'
+      AND object_type_id IS NOT NULL AND primary_id IS NOT NULL
+      AND source_type_id IS NULL AND source_primary_id IS NULL AND link_id IS NULL
+      AND target_type_id IS NULL AND target_primary_id IS NULL
+    )
+    OR
+    (
+      entity_kind = 'link'
+      AND object_type_id IS NULL AND primary_id IS NULL
+      AND source_type_id IS NOT NULL AND source_primary_id IS NOT NULL AND link_id IS NOT NULL
+      AND target_type_id IS NOT NULL AND target_primary_id IS NOT NULL
+    )
+  )
+);
+CREATE INDEX idx_ontology_source_rows_root ON ontology_source_rows (root_id);
+CREATE INDEX idx_ontology_source_rows_link_source
+  ON ontology_source_rows (source_type_id, source_primary_id, link_id)
+  WHERE entity_kind = 'link';
+CREATE INDEX idx_ontology_source_rows_link_target
+  ON ontology_source_rows (target_type_id, target_primary_id)
+  WHERE entity_kind = 'link';
+
+-- A published root that was not active is retired, so liveness stays exactly what it was.
+INSERT INTO ontology_source_roots (
+  version_id, project_id, root_key, staging_ordinal, deleted, retired_at
+)
+SELECT versions.version_id, roots.project_id,
+  convert_from(decode(roots.root_sort_key, 'hex'), 'UTF8'), roots.staging_ordinal, roots.deleted,
+  CASE
+    WHEN roots.active THEN NULL
+    WHEN roots.retired_at IS NOT NULL THEN roots.retired_at
+    WHEN versions.status IN ('active', 'superseded') THEN versions.updated_at
+  END
+FROM legacy_ontology_source_roots AS roots
+JOIN ontology_sources AS versions USING (project_id, source_id, materialization_id);
+
+INSERT INTO ontology_source_rows (
+  root_id, entity_kind, object_type_id, primary_id,
+  source_type_id, source_primary_id, link_id, target_type_id, target_primary_id, payload
+)
+SELECT roots.id, rows.entity_kind, rows.object_type_id, rows.primary_id,
+  rows.source_type_id, rows.source_primary_id, rows.link_id, rows.target_type_id,
+  rows.target_primary_id, NULLIF(rows.assertion - 'kind' - 'ref', '{}'::jsonb)
+FROM legacy_ontology_source_rows AS rows
+JOIN ontology_sources AS versions USING (project_id, source_id, materialization_id)
+JOIN ontology_source_roots AS roots
+  ON roots.version_id = versions.version_id
+  AND roots.root_key = convert_from(decode(rows.root_sort_key, 'hex'), 'UTF8');
+
+DO $$
+BEGIN
+  IF (SELECT count(*) FROM legacy_ontology_source_roots)
+      <> (SELECT count(*) FROM ontology_source_roots)
+    OR (SELECT count(*) FROM legacy_ontology_source_rows)
+      <> (SELECT count(*) FROM ontology_source_rows) THEN
+    RAISE EXCEPTION 'Source roots or rows were lost while compacting source storage.';
+  END IF;
+END $$;
+
+DROP TABLE legacy_ontology_source_rows;
+DROP TABLE legacy_ontology_source_roots;
+ANALYZE ontology_sources, ontology_source_roots, ontology_source_rows;
+`;
+
 // src/migrations/037-execution-requester-groups.sql
 var _037_execution_requester_groups_default = `ALTER TABLE executions ADD COLUMN requester_group_ids JSONB NOT NULL DEFAULT '[]'::jsonb;
 
@@ -7573,15 +7816,11 @@ function postgresMigrationSession(sql, schemaName) {
       async transaction(run) {
         const previous = active;
         active = sql;
-        await sql.unsafe("BEGIN");
         try {
-          await sql.unsafe(`SET LOCAL search_path TO ${schema}`);
-          const result = await run();
-          await sql.unsafe("COMMIT");
-          return result;
-        } catch (error) {
-          await sql.unsafe("ROLLBACK");
-          throw error;
+          return await runPgTransactionOn(sql, async () => {
+            await sql.unsafe(`SET LOCAL search_path TO ${schema}`);
+            return run();
+          });
         } finally {
           active = previous;
         }
@@ -7601,18 +7840,14 @@ async function readPostgresHistory(sql, schemaName, adapterId) {
   return rows.map(rowToMigrationRecord);
 }
 async function withPostgresMigrationLock(params, run) {
-  const sql = await params.sql.reserve();
   const [first, second] = advisoryLockParts2(`storage:migration:${params.schemaName}:${params.migrations.adapterId}`);
-  try {
+  return withReservedPgConnection(params.sql, async (sql) => {
+    const unlock = () => sql`SELECT pg_advisory_unlock(${first}, ${second})`;
     await sql`SELECT pg_advisory_lock(${first}, ${second})`;
-    try {
-      return await run(sql);
-    } finally {
-      await sql`SELECT pg_advisory_unlock(${first}, ${second})`;
-    }
-  } finally {
-    sql.release();
-  }
+    const result = await undoOnFailure(() => run(sql), unlock);
+    await unlock();
+    return result;
+  });
 }
 function advisoryLockParts2(key) {
   const hash = createHash2("sha256").update(key).digest();
@@ -7686,7 +7921,10 @@ var postgresStorageMigrations = defineMigrations({
     pgSql("046-workflow-intervention-principals", _046_workflow_intervention_principals_default),
     pgSql("047-ontology-commit-attribution", _047_ontology_commit_attribution_default),
     pgSql("048-file-upload-sessions", _048_file_upload_sessions_default),
-    pgSql("049-native-sessions", _049_native_sessions_default)
+    pgSql("049-native-sessions", _049_native_sessions_default),
+    pgSql("050-directory-group-memberships", _050_directory_group_memberships_default),
+    pgSql("051-projection-run-supersession", _051_projection_run_supersession_default),
+    pgSql("052-compact-source-storage", _052_compact_source_storage_default)
   ]
 });
 
@@ -9936,6 +10174,10 @@ function assertReconciliationPageLimit(limit) {
 // src/ontology-storage/shared.ts
 import { parseSixbFailure as parseSixbFailure2 } from "@sixb/core/internal/errors";
 import { MaterializationConflictError } from "@sixb/core/internal/materialization";
+import {
+  sourceAssertionFromColumns,
+  sourceEntityFromKey
+} from "@sixb/core/internal/ontology-storage-provider";
 import { ONTOLOGY_OUTBOX_FAILURE_CODES } from "@sixb/core/storage";
 import {
   assertNonblank,
@@ -10001,8 +10243,8 @@ function sourceRecord(row) {
 }
 function sourceAssertion(row) {
   return {
-    root: structuredClone(row.root),
-    assertion: structuredClone(row.assertion),
+    root: sourceEntityFromKey(row.root_key),
+    assertion: sourceAssertionFromColumns(row, row.payload),
     stagingOrdinal: databaseSafeInteger(row.staging_ordinal, "Source staging ordinal")
   };
 }
@@ -10214,27 +10456,80 @@ import {
   MaterializationValidationError,
   projectionEntityKey
 } from "@sixb/core/internal/materialization";
-import { sourceStageRoots, utf8SortKey } from "@sixb/core/internal/ontology-storage-provider";
+import {
+  sourceEntityColumns,
+  sourceStageRoots
+} from "@sixb/core/internal/ontology-storage-provider";
+var PUBLISHED = "('active', 'superseded')";
+function sourceAssertionColumns(sql) {
+  return sql.unsafe(`versions.source_id, versions.materialization_id, roots.root_key,
+    roots.staging_ordinal, rows.entity_kind, rows.object_type_id, rows.primary_id,
+    rows.source_type_id, rows.source_primary_id, rows.link_id, rows.target_type_id,
+    rows.target_primary_id, rows.payload`);
+}
+function liveSourceRowsJoin(sql, projectId) {
+  return sql`
+    JOIN ontology_source_roots AS roots ON roots.id = rows.root_id
+      AND roots.project_id = ${projectId} AND roots.retired_at IS NULL AND NOT roots.deleted
+    JOIN ontology_sources AS versions ON versions.version_id = roots.version_id
+      AND versions.status IN ${sql.unsafe(PUBLISHED)}
+  `;
+}
+function candidateVersion(sql, input) {
+  return sql`(SELECT version_id FROM ontology_sources WHERE project_id = ${input.projectId}
+    AND source_id = ${input.sourceId} AND materialization_id = ${input.materializationId})`;
+}
+var ENTITY_MATCH = `rows.entity_kind = requested.entity_kind
+  AND rows.object_type_id IS NOT DISTINCT FROM requested.object_type_id
+  AND rows.primary_id IS NOT DISTINCT FROM requested.primary_id
+  AND rows.source_type_id IS NOT DISTINCT FROM requested.source_type_id
+  AND rows.source_primary_id IS NOT DISTINCT FROM requested.source_primary_id
+  AND rows.link_id IS NOT DISTINCT FROM requested.link_id
+  AND rows.target_type_id IS NOT DISTINCT FROM requested.target_type_id
+  AND rows.target_primary_id IS NOT DISTINCT FROM requested.target_primary_id`;
+var REQUESTED_ENTITY = `entity_kind TEXT, object_type_id TEXT, primary_id TEXT,
+  source_type_id TEXT, source_primary_id TEXT, link_id TEXT, target_type_id TEXT,
+  target_primary_id TEXT`;
+function requestedEntity(ref) {
+  const columns = sourceEntityColumns(ref);
+  const key = projectionEntityKey(ref);
+  return {
+    entity_kind: ref.kind,
+    object_type_id: columns.objectTypeId,
+    primary_id: columns.primaryId,
+    source_type_id: columns.sourceTypeId,
+    source_primary_id: columns.sourcePrimaryId,
+    link_id: columns.linkId,
+    target_type_id: columns.targetTypeId,
+    target_primary_id: columns.targetPrimaryId,
+    root_keys: ref.kind === "object" ? [key] : [key, projectionEntityKey({ kind: "object", ref: ref.ref.source })]
+  };
+}
 function replacementSourceRows(sql, input) {
+  const live = sql`roots.retired_at IS NULL AND NOT roots.deleted
+    AND versions.source_id = ${input.sourceId} AND versions.status IN ${sql.unsafe(PUBLISHED)}`;
   const roots = input.incremental ? sql`
-    SELECT roots.* FROM ontology_source_roots AS changed
+    SELECT live.id FROM ontology_source_roots AS changed
     CROSS JOIN LATERAL (
-      SELECT roots.* FROM ontology_source_roots AS roots
-      WHERE roots.project_id = changed.project_id AND roots.source_id = changed.source_id
-        AND roots.root_sort_key = changed.root_sort_key AND roots.active OFFSET 0
-    ) AS roots
-    WHERE changed.project_id = ${input.projectId} AND changed.source_id = ${input.sourceId}
-      AND changed.materialization_id = ${input.materializationId}
-  ` : sql`SELECT * FROM ontology_source_roots WHERE project_id = ${input.projectId} AND source_id = ${input.sourceId} AND active`;
+      SELECT roots.id FROM ontology_source_roots AS roots
+      JOIN ontology_sources AS versions ON versions.version_id = roots.version_id
+      WHERE roots.project_id = ${input.projectId} AND roots.root_key = changed.root_key AND ${live}
+      OFFSET 0
+    ) AS live
+    WHERE changed.version_id = ${candidateVersion(sql, input)}
+  ` : sql`
+    SELECT roots.id FROM ontology_sources AS versions
+    JOIN ontology_source_roots AS roots ON roots.version_id = versions.version_id
+    WHERE versions.project_id = ${input.projectId} AND ${live}
+  `;
   return sql`
-    SELECT * FROM ontology_source_rows WHERE project_id = ${input.projectId}
-      AND source_id = ${input.sourceId} AND materialization_id = ${input.materializationId}
+    SELECT rows.* FROM ontology_source_roots AS roots
+    JOIN ontology_source_rows AS rows ON rows.root_id = roots.id
+    WHERE roots.version_id = ${candidateVersion(sql, input)}
     UNION ALL
     SELECT rows.* FROM (${roots}) AS roots
     CROSS JOIN LATERAL (
-      SELECT rows.* FROM ontology_source_rows AS rows WHERE rows.project_id = roots.project_id
-        AND rows.source_id = roots.source_id AND rows.materialization_id = roots.materialization_id
-        AND rows.root_sort_key = roots.root_sort_key OFFSET 0
+      SELECT rows.* FROM ontology_source_rows AS rows WHERE rows.root_id = roots.id OFFSET 0
     ) AS rows
   `;
 }
@@ -10246,35 +10541,28 @@ async function stageSourceRoots(sql, manifest, input) {
     throw new MaterializationValidationError("Root deletions require a source delta base.");
   }
   const values = jsonParameter2(sql, roots.map((root) => ({
-    root_sort_key: root.sortKey,
-    root_kind: root.root.kind,
-    root_key: JSON.parse(root.rootKey),
-    root: root.root,
+    root_key: root.rootKey,
     staging_ordinal: root.stagingOrdinal,
     deleted: root.deleted
   })));
   const inserted = await sql`
-    INSERT INTO ontology_source_roots (
-      project_id, source_id, materialization_id, root_sort_key, root_kind, root_key, root, staging_ordinal, deleted
-    ) SELECT ${input.projectId}, ${input.source.projectionId}, ${input.materializationId},
-      root_sort_key, root_kind, root_key, root, staging_ordinal, deleted
-    FROM jsonb_to_recordset(${values}) AS input(
-      root_sort_key TEXT, root_kind TEXT, root_key JSONB, root JSONB, staging_ordinal BIGINT, deleted BOOLEAN)
-    ON CONFLICT DO NOTHING RETURNING root_sort_key
+    INSERT INTO ontology_source_roots (version_id, project_id, root_key, staging_ordinal, deleted)
+    SELECT ${manifest.version_id}, ${input.projectId}, root_key, staging_ordinal, deleted
+    FROM jsonb_to_recordset(${values}) AS input(root_key TEXT, staging_ordinal BIGINT, deleted BOOLEAN)
+    ON CONFLICT DO NOTHING RETURNING root_key
   `;
   if (inserted.length === roots.length)
     return;
-  const insertedKeys = new Set(inserted.map((row) => row.root_sort_key));
-  const skipped = roots.filter((root) => !insertedKeys.has(root.sortKey));
+  const insertedKeys = new Set(inserted.map((row) => row.root_key));
+  const skipped = roots.filter((root) => !insertedKeys.has(root.rootKey));
   const stored = await sql`
-    SELECT root_sort_key, staging_ordinal, deleted FROM ontology_source_roots
-    WHERE project_id = ${input.projectId} AND source_id = ${input.source.projectionId}
-      AND materialization_id = ${input.materializationId}
-      AND root_sort_key = ANY(${sql.array(skipped.map((root) => root.sortKey))}::text[])
+    SELECT root_key, staging_ordinal, deleted FROM ontology_source_roots
+    WHERE version_id = ${manifest.version_id}
+      AND root_key = ANY(${sql.array(skipped.map((root) => root.rootKey))}::text[])
   `;
-  const existing = new Map(stored.map((root) => [root.root_sort_key, root]));
+  const existing = new Map(stored.map((root) => [root.root_key, root]));
   if (skipped.some((root) => {
-    const previous = existing.get(root.sortKey);
+    const previous = existing.get(root.rootKey);
     return !previous || Number(previous.staging_ordinal) !== root.stagingOrdinal || previous.deleted !== root.deleted;
   }))
     throw new MaterializationValidationError("Source materialization repeats root or stream ordinal with different content.");
@@ -10284,94 +10572,84 @@ async function activateSourceRoots(sql, projectId, candidate, activation) {
     throw new MaterializationConflictError2("projection-fence", "Source delta base changed before activation.");
   if (candidate.base_materialization_id !== null && Number(candidate.root_count) === 0)
     return;
-  const affected = candidate.base_materialization_id === null ? sql`` : sql`AND root_sort_key IN (
-    SELECT root_sort_key FROM ontology_source_roots
-    WHERE project_id = ${projectId} AND source_id = ${activation.source.projectionId}
-      AND materialization_id = ${activation.materializationId}
-  )`;
-  await sql`
-    UPDATE ontology_source_roots AS roots SET active = FALSE, retired_at = ${activation.updatedAt}
-    WHERE project_id = ${projectId} AND source_id = ${activation.source.projectionId} AND active
-    ${affected}
-  `;
+  const live = sql`roots.retired_at IS NULL AND NOT roots.deleted
+    AND versions.version_id = roots.version_id AND versions.project_id = ${projectId}
+    AND versions.source_id = ${activation.source.projectionId}
+    AND versions.status IN ${sql.unsafe(PUBLISHED)}`;
+  if (candidate.base_materialization_id === null) {
+    await sql`
+      UPDATE ontology_source_roots AS roots SET retired_at = ${activation.updatedAt}
+      FROM ontology_sources AS versions WHERE ${live}
+    `;
+  } else {
+    await sql`
+      UPDATE ontology_source_roots AS roots SET retired_at = ${activation.updatedAt}
+      FROM ontology_source_roots AS changed, ontology_sources AS versions
+      WHERE changed.version_id = ${candidate.version_id} AND roots.project_id = ${projectId}
+        AND roots.root_key = changed.root_key AND ${live}
+    `;
+  }
   await sql`
-    UPDATE ontology_source_roots SET active = NOT deleted,
-      retired_at = CASE WHEN deleted THEN ${activation.updatedAt}::timestamptz ELSE NULL END
-    WHERE project_id = ${projectId} AND source_id = ${activation.source.projectionId}
-      AND materialization_id = ${activation.materializationId}
+    UPDATE ontology_source_roots SET retired_at = ${activation.updatedAt}
+    WHERE version_id = ${candidate.version_id} AND deleted
   `;
 }
 async function assertSourceRootCoverage(sql, manifest) {
   const [invalid] = await sql`
     SELECT 1 FROM ontology_source_roots AS roots
-    WHERE project_id = ${manifest.project_id} AND source_id = ${manifest.source_id}
-      AND materialization_id = ${manifest.materialization_id}
+    WHERE roots.version_id = ${manifest.version_id}
       AND roots.deleted = EXISTS (
-        SELECT 1 FROM ontology_source_rows AS rows
-        WHERE rows.project_id = roots.project_id AND rows.source_id = roots.source_id
-          AND rows.materialization_id = roots.materialization_id AND rows.root_sort_key = roots.root_sort_key
-      ) LIMIT 1
+        SELECT 1 FROM ontology_source_rows AS rows WHERE rows.root_id = roots.id
+      )
+    LIMIT 1
   `;
   if (invalid)
     throw new MaterializationValidationError("Source roots must have complete assertions or an explicit deletion, never both.");
 }
 function activeSourceRows(sql, projectId, refs) {
-  const keys = refs.flatMap((entity) => {
-    const entitySortKey = utf8SortKey(projectionEntityKey(entity));
-    const roots = entity.kind === "object" ? [entitySortKey] : [
-      entitySortKey,
-      utf8SortKey(projectionEntityKey({ kind: "object", ref: entity.ref.source }))
-    ];
-    return roots.map((rootSortKey) => ({
-      root_sort_key: rootSortKey,
-      entity_sort_key: entitySortKey
-    }));
+  const requested = refs.flatMap((ref) => {
+    const { root_keys, ...entity } = requestedEntity(ref);
+    return root_keys.map((root_key) => ({ ...entity, root_key }));
   });
   return sql`
-    SELECT rows.* FROM jsonb_to_recordset(${jsonParameter2(sql, keys)}) AS requested(root_sort_key TEXT, entity_sort_key TEXT)
+    SELECT ${sourceAssertionColumns(sql)}
+    FROM jsonb_to_recordset(${jsonParameter2(sql, requested)})
+      AS requested(root_key TEXT, ${sql.unsafe(REQUESTED_ENTITY)})
     JOIN ontology_source_roots AS roots ON roots.project_id = ${projectId}
-      AND roots.active AND roots.root_sort_key = requested.root_sort_key
-    JOIN ontology_source_rows AS rows ON rows.project_id = roots.project_id AND rows.source_id = roots.source_id
-      AND rows.materialization_id = roots.materialization_id AND rows.entity_sort_key = requested.entity_sort_key
-      AND rows.root_sort_key = roots.root_sort_key
+      AND roots.root_key = requested.root_key AND roots.retired_at IS NULL AND NOT roots.deleted
+    JOIN ontology_sources AS versions ON versions.version_id = roots.version_id
+      AND versions.status IN ${sql.unsafe(PUBLISHED)}
+    JOIN ontology_source_rows AS rows ON rows.root_id = roots.id AND ${sql.unsafe(ENTITY_MATCH)}
   `;
 }
 function replacementAssertionRows(sql, input) {
-  const keys = input.refs.map((ref) => ({
-    entity_kind: ref.kind,
-    entity_key: JSON.parse(projectionEntityKey(ref)),
-    root_keys: ref.kind === "object" ? [utf8SortKey(projectionEntityKey(ref))] : [
-      utf8SortKey(projectionEntityKey(ref)),
-      utf8SortKey(projectionEntityKey({ kind: "object", ref: ref.ref.source }))
-    ]
-  }));
+  const version = candidateVersion(sql, input);
   const previous = !input.includePrevious ? sql`` : sql`UNION ALL
-    SELECT rows.* FROM (
+    SELECT ${sourceAssertionColumns(sql)} FROM (
       SELECT roots.* FROM ontology_source_roots AS roots
-    WHERE roots.project_id = ${input.projectId} AND roots.source_id = ${input.sourceId}
-      AND roots.active AND roots.root_sort_key = ANY(requested.root_keys)
+      JOIN ontology_sources AS versions ON versions.version_id = roots.version_id
+      WHERE roots.project_id = ${input.projectId} AND roots.root_key = ANY(requested.root_keys)
+        AND roots.retired_at IS NULL AND NOT roots.deleted
+        AND versions.source_id = ${input.sourceId} AND versions.status IN ${sql.unsafe(PUBLISHED)}
       ${!input.incremental ? sql`` : sql`AND EXISTS (SELECT 1 FROM ontology_source_roots AS changed
-        WHERE changed.project_id = roots.project_id AND changed.source_id = roots.source_id
-          AND changed.materialization_id = ${input.materializationId} AND changed.root_sort_key = roots.root_sort_key)`}
-
+        WHERE changed.version_id = ${version} AND changed.root_key = roots.root_key)`}
       OFFSET 0
     ) AS roots
+    JOIN ontology_sources AS versions ON versions.version_id = roots.version_id
     CROSS JOIN LATERAL (
       SELECT rows.* FROM ontology_source_rows AS rows
-      WHERE rows.project_id = roots.project_id AND rows.source_id = roots.source_id
-        AND rows.materialization_id = roots.materialization_id AND rows.root_sort_key = roots.root_sort_key
-        AND rows.entity_kind = requested.entity_kind AND rows.entity_key = requested.entity_key
+      WHERE rows.root_id = roots.id AND ${sql.unsafe(ENTITY_MATCH)}
       OFFSET 0
     ) AS rows
   `;
   return sql`
-    SELECT selected.* FROM jsonb_to_recordset(${jsonParameter2(sql, keys)})
-      AS requested(entity_kind TEXT, entity_key JSONB, root_keys TEXT[])
+    SELECT selected.* FROM jsonb_to_recordset(${jsonParameter2(sql, input.refs.map(requestedEntity))})
+      AS requested(${sql.unsafe(REQUESTED_ENTITY)}, root_keys TEXT[])
     CROSS JOIN LATERAL (
-      SELECT rows.* FROM ontology_source_rows AS rows
-      WHERE rows.project_id = ${input.projectId} AND rows.source_id = ${input.sourceId}
-        AND rows.materialization_id = ${input.materializationId}
-        AND rows.entity_kind = requested.entity_kind AND rows.entity_key = requested.entity_key
+      SELECT ${sourceAssertionColumns(sql)} FROM ontology_source_roots AS roots
+      JOIN ontology_sources AS versions ON versions.version_id = roots.version_id
+      JOIN ontology_source_rows AS rows ON rows.root_id = roots.id AND ${sql.unsafe(ENTITY_MATCH)}
+      WHERE roots.version_id = ${version} AND roots.root_key = ANY(requested.root_keys)
       ${previous}
       OFFSET 0
     ) AS selected
@@ -10590,20 +10868,14 @@ class PgMaterializationStateReader {
               scope_sort_key TEXT, source_type_id TEXT, source_id TEXT, link_id TEXT
             )
         )
-        SELECT rows.*
+        SELECT ${sourceAssertionColumns(this.sql)}
         FROM ontology_source_rows AS rows
         JOIN requested
           ON requested.source_type_id = rows.source_type_id
          AND requested.source_id = rows.source_primary_id
          AND requested.link_id = rows.link_id
-        JOIN ontology_source_roots AS sources
-          ON sources.project_id = rows.project_id
-         AND sources.source_id = rows.source_id
-         AND sources.materialization_id = rows.materialization_id
-         AND sources.root_sort_key = rows.root_sort_key
-        WHERE rows.project_id = ${this.projectId}
-          AND rows.entity_kind = 'link'
-          AND sources.active
+        ${liveSourceRowsJoin(this.sql, this.projectId)}
+        WHERE rows.entity_kind = 'link'
       `,
       this.sql`
         WITH requested AS (
@@ -10745,32 +11017,20 @@ class PgMaterializationStateReader {
           SELECT rows.source_type_id, rows.source_primary_id AS source_id,
             rows.link_id, rows.target_type_id, rows.target_primary_id AS target_id
           FROM ontology_source_rows AS rows
-          JOIN ontology_source_roots AS sources
-            ON sources.project_id = rows.project_id
-           AND sources.source_id = rows.source_id
-           AND sources.materialization_id = rows.materialization_id
-         AND sources.root_sort_key = rows.root_sort_key
+          ${liveSourceRowsJoin(this.sql, this.projectId)}
           JOIN requested
             ON requested.object_type_id = rows.source_type_id
            AND requested.primary_id = rows.source_primary_id
-          WHERE rows.project_id = ${this.projectId}
-            AND rows.entity_kind = 'link'
-            AND sources.active
+          WHERE rows.entity_kind = 'link'
           UNION
           SELECT rows.source_type_id, rows.source_primary_id AS source_id,
             rows.link_id, rows.target_type_id, rows.target_primary_id AS target_id
           FROM ontology_source_rows AS rows
-          JOIN ontology_source_roots AS sources
-            ON sources.project_id = rows.project_id
-           AND sources.source_id = rows.source_id
-           AND sources.materialization_id = rows.materialization_id
-         AND sources.root_sort_key = rows.root_sort_key
+          ${liveSourceRowsJoin(this.sql, this.projectId)}
           JOIN requested
             ON requested.object_type_id = rows.target_type_id
            AND requested.primary_id = rows.target_primary_id
-          WHERE rows.project_id = ${this.projectId}
-            AND rows.entity_kind = 'link'
-            AND sources.active
+          WHERE rows.entity_kind = 'link'
         ), selected AS (
           SELECT DISTINCT links.*,
             ${this.sql.unsafe(linkSortExpression("links"))} AS sort_key
@@ -11004,32 +11264,20 @@ class PgMaterializationStateReader {
         SELECT rows.source_type_id, rows.source_primary_id AS source_id,
           rows.link_id, rows.target_type_id, rows.target_primary_id AS target_id
         FROM ontology_source_rows AS rows
-        JOIN ontology_source_roots AS sources
-          ON sources.project_id = rows.project_id
-         AND sources.source_id = rows.source_id
-         AND sources.materialization_id = rows.materialization_id
-         AND sources.root_sort_key = rows.root_sort_key
+        ${liveSourceRowsJoin(this.sql, this.projectId)}
         JOIN incident_objects
           ON incident_objects.object_type_id = rows.source_type_id
          AND incident_objects.primary_id = rows.source_primary_id
-        WHERE rows.project_id = ${this.projectId}
-          AND rows.entity_kind = 'link'
-          AND sources.active
+        WHERE rows.entity_kind = 'link'
         UNION
         SELECT rows.source_type_id, rows.source_primary_id AS source_id,
           rows.link_id, rows.target_type_id, rows.target_primary_id AS target_id
         FROM ontology_source_rows AS rows
-        JOIN ontology_source_roots AS sources
-          ON sources.project_id = rows.project_id
-         AND sources.source_id = rows.source_id
-         AND sources.materialization_id = rows.materialization_id
-         AND sources.root_sort_key = rows.root_sort_key
+        ${liveSourceRowsJoin(this.sql, this.projectId)}
         JOIN incident_objects
           ON incident_objects.object_type_id = rows.target_type_id
          AND incident_objects.primary_id = rows.target_primary_id
-        WHERE rows.project_id = ${this.projectId}
-          AND rows.entity_kind = 'link'
-          AND sources.active
+        WHERE rows.entity_kind = 'link'
       ), diff_links AS (
         SELECT * FROM replacement_links
         UNION SELECT * FROM incident_links
@@ -11171,9 +11419,7 @@ function storedSource(row) {
   return {
     source: { projectionId: row.source_id },
     materializationId: row.materialization_id,
-    root: structuredClone(row.root),
-    assertion: structuredClone(row.assertion),
-    stagingOrdinal: databaseSafeInteger(row.staging_ordinal, "Source staging ordinal")
+    ...sourceAssertion(row)
   };
 }
 function effectiveObjectSnapshot(row) {
@@ -12871,26 +13117,70 @@ import {
   sourceEntityColumns as entityColumns,
   isExactStagingManifest,
   reconcileSourceStageRows,
+  sourceAssertionPayload,
   sourceConflict,
   sourceMaterializationIdentity,
   sourceStageRow,
-  sourceStageRows,
-  utf8SortKey as utf8SortKey2
+  sourceStageRows
 } from "@sixb/core/internal/ontology-storage-provider";
 
 // src/ontology-storage/source-cleanup.ts
+async function purgeAbandonedSourceVersions(sql, input) {
+  let remaining = input.limit;
+  let rowsDeleted = 0;
+  let materializationsDeleted = 0;
+  while (remaining > 0) {
+    const [candidate] = await sql`
+      SELECT version_id FROM ontology_sources
+      WHERE project_id = ${input.projectId} AND status = 'abandoned'
+      ORDER BY terminal_at, source_id, materialization_id
+      LIMIT 1 FOR UPDATE SKIP LOCKED
+    `;
+    if (!candidate)
+      break;
+    const rows = await sql`
+      DELETE FROM ontology_source_rows WHERE ctid IN (
+        SELECT rows.ctid FROM ontology_source_roots AS roots
+        JOIN ontology_source_rows AS rows ON rows.root_id = roots.id
+        WHERE roots.version_id = ${candidate.version_id} LIMIT ${remaining}
+      )
+    `;
+    rowsDeleted += rows.count;
+    remaining -= rows.count;
+    if (remaining === 0)
+      break;
+    const roots = await sql`
+      DELETE FROM ontology_source_roots WHERE ctid IN (
+        SELECT ctid FROM ontology_source_roots
+        WHERE version_id = ${candidate.version_id} LIMIT ${remaining}
+      )
+    `;
+    rowsDeleted += roots.count;
+    remaining -= roots.count;
+    if (remaining === 0)
+      break;
+    const manifest = await sql`
+      DELETE FROM ontology_sources
+      WHERE version_id = ${candidate.version_id} AND status = 'abandoned'
+    `;
+    if (manifest.count === 0)
+      break;
+    materializationsDeleted += manifest.count;
+    remaining -= manifest.count;
+  }
+  return { rowsDeleted, materializationsDeleted };
+}
 async function cleanupSourceVersions(sql, input) {
   let remaining = input.limit;
+  const retired = sql`roots.project_id = ${input.projectId}
+    AND roots.retired_at < ${input.terminalBefore} AND versions.status = 'superseded'`;
   const removedRows = await sql`
     WITH selected AS (
       SELECT rows.ctid FROM ontology_source_roots AS roots
-      JOIN ontology_sources AS sources USING (project_id, source_id, materialization_id)
-      JOIN ontology_source_rows AS rows
-        ON rows.project_id = roots.project_id AND rows.source_id = roots.source_id
-        AND rows.materialization_id = roots.materialization_id AND rows.root_sort_key = roots.root_sort_key
-      WHERE roots.project_id = ${input.projectId} AND NOT roots.active AND roots.retired_at < ${input.terminalBefore}
-        AND sources.status IN ('superseded', 'abandoned')
-      ORDER BY roots.retired_at, roots.source_id, roots.materialization_id, roots.root_sort_key, rows.entity_sort_key
+      JOIN ontology_sources AS versions ON versions.version_id = roots.version_id
+      JOIN ontology_source_rows AS rows ON rows.root_id = roots.id
+      WHERE ${retired}
+      ORDER BY roots.retired_at, roots.id
       LIMIT ${remaining} FOR UPDATE OF rows SKIP LOCKED
     ) DELETE FROM ontology_source_rows AS rows USING selected WHERE rows.ctid = selected.ctid RETURNING 1
   `;
@@ -12900,13 +13190,10 @@ async function cleanupSourceVersions(sql, input) {
     const removed = await sql`
       WITH selected AS (
         SELECT roots.ctid FROM ontology_source_roots AS roots
-        JOIN ontology_sources AS sources USING (project_id, source_id, materialization_id)
-        WHERE roots.project_id = ${input.projectId} AND NOT roots.active AND roots.retired_at < ${input.terminalBefore}
-          AND sources.status IN ('superseded', 'abandoned')
-          AND NOT EXISTS (SELECT 1 FROM ontology_source_rows AS rows
-            WHERE rows.project_id = roots.project_id AND rows.source_id = roots.source_id
-              AND rows.materialization_id = roots.materialization_id AND rows.root_sort_key = roots.root_sort_key)
-        ORDER BY roots.retired_at, roots.source_id, roots.materialization_id, roots.root_sort_key
+        JOIN ontology_sources AS versions ON versions.version_id = roots.version_id
+        WHERE ${retired}
+          AND NOT EXISTS (SELECT 1 FROM ontology_source_rows AS rows WHERE rows.root_id = roots.id)
+        ORDER BY roots.retired_at, roots.id
         LIMIT ${remaining} FOR UPDATE OF roots SKIP LOCKED
       ) DELETE FROM ontology_source_roots AS roots USING selected WHERE roots.ctid = selected.ctid RETURNING 1
     `;
@@ -12915,16 +13202,13 @@ async function cleanupSourceVersions(sql, input) {
   }
   const removedManifests = remaining === 0 ? [] : await sql`
     WITH selected AS (
-      SELECT sources.ctid FROM ontology_sources AS sources
-      WHERE project_id = ${input.projectId} AND status IN ('superseded', 'abandoned') AND terminal_at < ${input.terminalBefore}
+      SELECT versions.ctid FROM ontology_sources AS versions
+      WHERE project_id = ${input.projectId} AND status = 'superseded'
+        AND terminal_at < ${input.terminalBefore}
         AND NOT EXISTS (SELECT 1 FROM ontology_source_roots AS roots
-          WHERE roots.project_id = sources.project_id AND roots.source_id = sources.source_id
-            AND roots.materialization_id = sources.materialization_id)
-        AND NOT EXISTS (SELECT 1 FROM ontology_source_rows AS rows
-          WHERE rows.project_id = sources.project_id AND rows.source_id = sources.source_id
-            AND rows.materialization_id = sources.materialization_id)
+          WHERE roots.version_id = versions.version_id)
       ORDER BY terminal_at, source_id, materialization_id LIMIT ${remaining} FOR UPDATE SKIP LOCKED
-    ) DELETE FROM ontology_sources AS sources USING selected WHERE sources.ctid = selected.ctid RETURNING 1
+    ) DELETE FROM ontology_sources AS versions USING selected WHERE versions.ctid = selected.ctid RETURNING 1
   `;
   return { rowsDeleted, materializationsDeleted: removedManifests.length };
 }
@@ -12951,7 +13235,7 @@ class PgOntologySourceStorage {
       }
       const candidate = await this.getRunCandidate(sql, input);
       if (candidate) {
-        throw sourceConflict(`Projection run '${input.execution.projectionRunId}' already has a nonterminal source materialization; reclaim it before beginning another.`);
+        throw sourceConflict(`Projection run '${input.execution.projectionRunId}' already has a nonterminal source materialization; adopt it before beginning another.`);
       }
       const rows = await sql`
         INSERT INTO ontology_sources (
@@ -12980,7 +13264,7 @@ class PgOntologySourceStorage {
         return sourceRecord(racedManifest);
       }
       if (await this.getRunCandidate(sql, input)) {
-        throw sourceConflict(`Projection run '${input.execution.projectionRunId}' already has a nonterminal source materialization; reclaim it before beginning another.`);
+        throw sourceConflict(`Projection run '${input.execution.projectionRunId}' already has a nonterminal source materialization; adopt it before beginning another.`);
       }
       throw sourceConflict(`Source materialization '${input.materializationId}' already exists with different identity or state.`);
     });
@@ -12995,10 +13279,10 @@ class PgOntologySourceStorage {
         throw sourceConflict(`Source materialization '${input.materializationId}' is '${manifest.status}' and cannot accept rows.`);
       }
       const rows = sourceStageRows(manifest.projection_kind, input.rows);
-      const existing = await this.findStageRows(sql, input, rows);
+      const existing = await this.findStageRows(sql, manifest, rows);
       const { pending, unchanged } = reconcileSourceStageRows(rows, existing);
       await stageSourceRoots(sql, manifest, input);
-      await this.insertStageRows(sql, input, pending);
+      await this.insertStageRows(sql, manifest, pending);
       return { inserted: pending.length, unchanged };
     });
   }
@@ -13057,13 +13341,43 @@ class PgOntologySourceStorage {
       return row ? sourceRecord(row) : null;
     });
   }
+  async adopt(input) {
+    return this.runRootOperation(async (sql) => {
+      assertProjectAndSource(input);
+      assertExecutionIdentity(input.execution.projectionRunId, input.execution.executionToken);
+      assertTimestamp(input.adoptedAt, "Source adoptedAt", true);
+      await this.assertExecution(sql, input);
+      const candidate = await this.lockRunCandidate(sql, input);
+      if (!candidate)
+        return null;
+      const [adopted] = await sql`
+        UPDATE ontology_sources
+        SET execution_token = ${input.execution.executionToken},
+          updated_at = GREATEST(updated_at, ${input.adoptedAt}::timestamptz)
+        WHERE project_id = ${candidate.project_id} AND source_id = ${candidate.source_id}
+          AND materialization_id = ${candidate.materialization_id}
+          AND status IN ('staging', 'ready')
+        RETURNING *
+      `;
+      if (!adopted) {
+        throw sourceConflict(`Source materialization '${candidate.materialization_id}' changed.`);
+      }
+      return {
+        record: sourceRecord(adopted),
+        resumeStagingOrdinal: adopted.status === "ready" ? Number(adopted.root_count) : await this.lastStagedOrdinal(sql, adopted)
+      };
+    });
+  }
   async abandon(input) {
     return this.runRootOperation(async (sql) => {
       assertProjectAndSource(input);
       assertExecutionIdentity(input.execution.projectionRunId, input.execution.executionToken);
       assertTimestamp(input.abandonedAt, "Source abandonedAt", true);
       await this.assertExecution(sql, input);
-      return input.kind === "candidate" ? this.abandonCandidate(sql, input) : this.abandonForReclaim(sql, input);
+      if (input.kind === "candidate")
+        return this.abandonCandidate(sql, input);
+      const candidate = await this.lockRunCandidate(sql, input);
+      return candidate ? this.transitionToAbandoned(sql, candidate, input.abandonedAt) : null;
     });
   }
   async cleanupTerminal(input) {
@@ -13074,6 +13388,13 @@ class PgOntologySourceStorage {
       return cleanupSourceVersions(sql, input);
     });
   }
+  async purgeAbandoned(input) {
+    return this.runRootOperation(async (sql) => {
+      assertNonblank(input.projectId, "Abandoned source purge project id");
+      assertPositiveInteger(input.limit, "Abandoned source purge limit");
+      return purgeAbandonedSourceVersions(sql, input);
+    });
+  }
   async summarizeTerminal(input) {
     return this.runRootOperation(async (sql) => {
       assertNonblank(input.projectId, "Terminal source summary project id");
@@ -13100,7 +13421,7 @@ class PgOntologySourceStorage {
     assertSourceCandidateOwner(sourceRecord(manifest), input.execution);
     return this.transitionToAbandoned(sql, manifest, input.abandonedAt);
   }
-  async abandonForReclaim(sql, input) {
+  async lockRunCandidate(sql, input) {
     const candidates = await sql`
       SELECT * FROM ontology_sources
       WHERE project_id = ${input.projectId}
@@ -13109,13 +13430,17 @@ class PgOntologySourceStorage {
         AND status IN ('staging', 'ready')
       FOR UPDATE
     `;
-    if (candidates.some((candidate) => candidate.execution_token === input.execution.executionToken)) {
-      throw sourceConflict(`Projection run '${input.execution.projectionRunId}' already has a source materialization owned by the current execution.`);
-    }
     if (candidates.length > 1) {
       throw sourceConflict(`Projection run '${input.execution.projectionRunId}' has multiple nonterminal source materializations.`);
     }
-    return candidates[0] ? this.transitionToAbandoned(sql, candidates[0], input.abandonedAt) : null;
+    return candidates[0] ?? null;
+  }
+  async lastStagedOrdinal(sql, manifest) {
+    const [last] = await sql`
+      SELECT MAX(staging_ordinal) AS ordinal FROM ontology_source_roots
+      WHERE version_id = ${manifest.version_id}
+    `;
+    return last?.ordinal == null ? 0 : Number(last.ordinal);
   }
   async transitionToAbandoned(sql, manifest, abandonedAt) {
     if (abandonedAt < toIsoString2(manifest.created_at) || manifest.ready_at !== null && abandonedAt < toIsoString2(manifest.ready_at)) {
@@ -13134,22 +13459,18 @@ class PgOntologySourceStorage {
     if (!rows[0]) {
       throw sourceConflict(`Source materialization '${manifest.materialization_id}' cannot transition to 'abandoned'.`);
     }
-    await sql`UPDATE ontology_source_roots SET retired_at = ${abandonedAt}
-      WHERE project_id = ${manifest.project_id} AND source_id = ${manifest.source_id}
-        AND materialization_id = ${manifest.materialization_id} AND NOT active`;
     return sourceRecord(rows[0]);
   }
   async assertReadyState(sql, manifest, rootCount, assertionCount) {
+    const version = manifest.version_id;
     const [counts] = await sql`
-      SELECT (SELECT COUNT(*) FROM ontology_source_rows
-        WHERE project_id = ${manifest.project_id} AND source_id = ${manifest.source_id}
-          AND materialization_id = ${manifest.materialization_id}) AS assertions, COUNT(*) AS roots,
-        COUNT(DISTINCT staging_ordinal) AS ordinals,
+      SELECT (SELECT COUNT(*) FROM ontology_source_roots AS roots
+          JOIN ontology_source_rows AS rows ON rows.root_id = roots.id
+          WHERE roots.version_id = ${version}) AS assertions,
+        COUNT(*) AS roots, COUNT(DISTINCT staging_ordinal) AS ordinals,
         MIN(staging_ordinal) AS min_ordinal, MAX(staging_ordinal) AS max_ordinal
       FROM ontology_source_roots
-      WHERE project_id = ${manifest.project_id}
-        AND source_id = ${manifest.source_id}
-        AND materialization_id = ${manifest.materialization_id}
+      WHERE version_id = ${version}
     `;
     const assertions = Number(counts?.assertions ?? 0);
     const roots = Number(counts?.roots ?? 0);
@@ -13161,122 +13482,101 @@ class PgOntologySourceStorage {
     }
     await assertSourceRootCoverage(sql, manifest);
     const [invalid] = manifest.projection_kind === "link" ? await sql`
-            SELECT root_key
-            FROM ontology_source_rows
-            WHERE project_id = ${manifest.project_id}
-              AND source_id = ${manifest.source_id}
-              AND materialization_id = ${manifest.materialization_id}
-            GROUP BY root_key
+            SELECT roots.root_key
+            FROM ontology_source_roots AS roots
+            CROSS JOIN LATERAL (SELECT roots.root_key::jsonb AS parts) AS root
+            JOIN ontology_source_rows AS rows ON rows.root_id = roots.id
+            WHERE roots.version_id = ${version}
+            GROUP BY roots.id, roots.root_key
             HAVING COUNT(*) <> 1
-              OR BOOL_OR(root_kind <> 'link')
-              OR BOOL_OR(entity_kind <> 'link')
-              OR BOOL_OR(root_key <> entity_key)
+              OR BOOL_OR(root.parts->>0 <> 'link')
+              OR BOOL_OR(rows.entity_kind <> 'link')
+              OR BOOL_OR(rows.source_type_id <> root.parts->>1
+                OR rows.source_primary_id <> root.parts->>2 OR rows.link_id <> root.parts->>3
+                OR rows.target_type_id <> root.parts->>4 OR rows.target_primary_id <> root.parts->>5)
             LIMIT 1
           ` : await sql`
-            SELECT root_key
-            FROM ontology_source_rows
-            WHERE project_id = ${manifest.project_id}
-              AND source_id = ${manifest.source_id}
-              AND materialization_id = ${manifest.materialization_id}
-            GROUP BY root_key
-            HAVING BOOL_OR(root_kind <> 'object')
+            SELECT roots.root_key
+            FROM ontology_source_roots AS roots
+            CROSS JOIN LATERAL (SELECT roots.root_key::jsonb AS parts) AS root
+            JOIN ontology_source_rows AS rows ON rows.root_id = roots.id
+            WHERE roots.version_id = ${version}
+            GROUP BY roots.id, roots.root_key
+            HAVING BOOL_OR(root.parts->>0 <> 'object')
               OR COUNT(*) FILTER (
-                WHERE entity_kind = 'object' AND entity_key = root_key
+                WHERE rows.entity_kind = 'object' AND rows.object_type_id = root.parts->>1
+                  AND rows.primary_id = root.parts->>2
               ) <> 1
               OR COUNT(*) FILTER (
-                WHERE (entity_kind = 'object' AND entity_key <> root_key)
-                   OR (entity_kind = 'link' AND (
-                     source_type_id <> root_object_type_id
-                     OR source_primary_id <> root_primary_id
-                   ))
+                WHERE (rows.entity_kind = 'object' AND (rows.object_type_id <> root.parts->>1
+                    OR rows.primary_id <> root.parts->>2))
+                  OR (rows.entity_kind = 'link' AND (rows.source_type_id <> root.parts->>1
+                    OR rows.source_primary_id <> root.parts->>2))
               ) <> 0
+              OR COUNT(*) FILTER (WHERE rows.entity_kind = 'link') <> COUNT(DISTINCT (
+                rows.link_id, rows.target_type_id, rows.target_primary_id
+              )) FILTER (WHERE rows.entity_kind = 'link')
             LIMIT 1
           `;
     if (invalid) {
       throw new MaterializationValidationError4(manifest.projection_kind === "link" ? "Link projection roots must contain exactly their matching link assertion." : "Object projection roots must contain exactly their matching object assertion plus links sourced from that root.");
     }
   }
-  async findStageRows(sql, input, rows) {
+  async findStageRows(sql, manifest, rows) {
     if (rows.length === 0)
       return [];
-    const rootSortKeys = [...new Set(rows.map((row) => utf8SortKey2(row.rootKey)))];
+    const rootKeys = [...new Set(rows.map((row) => row.rootKey))];
     const ordinals = [...new Set(rows.map((row) => row.row.stagingOrdinal))];
-    const entitySortKeys = [...new Set(rows.map((row) => utf8SortKey2(row.entityKey)))];
     const existing = await sql`
-      SELECT * FROM ontology_source_rows
-      WHERE project_id = ${input.projectId}
-        AND source_id = ${input.source.projectionId}
-        AND materialization_id = ${input.materializationId}
+      SELECT ${sourceAssertionColumns(sql)}
+      FROM ontology_source_roots AS roots
+      JOIN ontology_sources AS versions ON versions.version_id = roots.version_id
+      JOIN ontology_source_rows AS rows ON rows.root_id = roots.id
+      WHERE roots.version_id = ${manifest.version_id}
         AND (
-          root_sort_key = ANY(${sql.array(rootSortKeys)}::text[])
-          OR staging_ordinal = ANY(${sql.array(ordinals)}::bigint[])
-          OR entity_sort_key = ANY(${sql.array(entitySortKeys)}::text[])
+          roots.root_key = ANY(${sql.array(rootKeys)}::text[])
+          OR roots.staging_ordinal = ANY(${sql.array(ordinals)}::bigint[])
         )
     `;
     return existing.map((row) => sourceStageRow(sourceAssertion(row)));
   }
-  async insertStageRows(sql, input, rows) {
+  async insertStageRows(sql, manifest, rows) {
     if (rows.length === 0)
       return;
-    const payload = rows.map(({ entityKey, rootKey, row }) => {
+    const payload = rows.map(({ rootKey, row }) => {
       const entity = entityColumns(row.assertion);
-      const root = entityColumns(row.root);
       return {
-        entityKind: row.assertion.kind,
-        entityKey: JSON.parse(entityKey),
-        entitySortKey: utf8SortKey2(entityKey),
-        rootKind: row.root.kind,
-        rootKey: JSON.parse(rootKey),
-        rootSortKey: utf8SortKey2(rootKey),
-        stagingOrdinal: row.stagingOrdinal,
-        root: row.root,
-        assertion: row.assertion,
-        objectTypeId: entity.objectTypeId,
-        primaryId: entity.primaryId,
-        sourceTypeId: entity.sourceTypeId,
-        sourcePrimaryId: entity.sourcePrimaryId,
-        linkId: entity.linkId,
-        targetTypeId: entity.targetTypeId,
-        targetPrimaryId: entity.targetPrimaryId,
-        rootObjectTypeId: root.objectTypeId,
-        rootPrimaryId: root.primaryId,
-        rootSourceTypeId: root.sourceTypeId,
-        rootSourcePrimaryId: root.sourcePrimaryId,
-        rootLinkId: root.linkId,
-        rootTargetTypeId: root.targetTypeId,
-        rootTargetPrimaryId: root.targetPrimaryId
+        root_key: rootKey,
+        entity_kind: row.assertion.kind,
+        object_type_id: entity.objectTypeId,
+        primary_id: entity.primaryId,
+        source_type_id: entity.sourceTypeId,
+        source_primary_id: entity.sourcePrimaryId,
+        link_id: entity.linkId,
+        target_type_id: entity.targetTypeId,
+        target_primary_id: entity.targetPrimaryId,
+        payload: sourceAssertionPayload(row.assertion)
       };
     });
-    await sql`
-      WITH staged AS (
-        SELECT value
-        FROM jsonb_array_elements(${jsonParameter2(sql, payload)}::jsonb)
-      )
+    const inserted = await sql`
       INSERT INTO ontology_source_rows (
-        project_id, source_id, materialization_id,
-        entity_kind, entity_key, entity_sort_key,
-        root_kind, root_key, root_sort_key, staging_ordinal,
-        root, assertion,
-        object_type_id, primary_id,
-        source_type_id, source_primary_id, link_id, target_type_id, target_primary_id,
-        root_object_type_id, root_primary_id,
-        root_source_type_id, root_source_primary_id, root_link_id,
-        root_target_type_id, root_target_primary_id
+        root_id, entity_kind, object_type_id, primary_id,
+        source_type_id, source_primary_id, link_id, target_type_id, target_primary_id, payload
       )
-      SELECT
-        ${input.projectId}, ${input.source.projectionId}, ${input.materializationId},
-        value->>'entityKind', value->'entityKey', value->>'entitySortKey',
-        value->>'rootKind', value->'rootKey', value->>'rootSortKey',
-        (value->>'stagingOrdinal')::bigint,
-        value->'root', value->'assertion',
-        value->>'objectTypeId', value->>'primaryId',
-        value->>'sourceTypeId', value->>'sourcePrimaryId', value->>'linkId',
-        value->>'targetTypeId', value->>'targetPrimaryId',
-        value->>'rootObjectTypeId', value->>'rootPrimaryId',
-        value->>'rootSourceTypeId', value->>'rootSourcePrimaryId', value->>'rootLinkId',
-        value->>'rootTargetTypeId', value->>'rootTargetPrimaryId'
-      FROM staged
+      SELECT roots.id, staged.entity_kind, staged.object_type_id, staged.primary_id,
+        staged.source_type_id, staged.source_primary_id, staged.link_id,
+        staged.target_type_id, staged.target_primary_id, staged.payload
+      FROM jsonb_to_recordset(${jsonParameter2(sql, payload)}) AS staged(
+        root_key TEXT, entity_kind TEXT, object_type_id TEXT, primary_id TEXT,
+        source_type_id TEXT, source_primary_id TEXT, link_id TEXT,
+        target_type_id TEXT, target_primary_id TEXT, payload JSONB
+      )
+      JOIN ontology_source_roots AS roots
+        ON roots.version_id = ${manifest.version_id} AND roots.root_key = staged.root_key
     `;
+    if (inserted.count !== rows.length) {
+      throw sourceConflict("Staged source rows do not all belong to a staged root.");
+    }
   }
   assertExecution(sql, input, identity) {
     return assertProjectionExecution(sql, {
@@ -15553,6 +15853,8 @@ function invalidState(reservation, operation) {
 }
 
 // src/pg-client.ts
+import { isIP } from "net";
+import { connect as connectTls } from "tls";
 import postgres from "postgres";
 var DEFAULT_IDLE_TIMEOUT_SECONDS = 30;
 var DEFAULT_CONNECT_TIMEOUT_SECONDS = 10;
@@ -15575,10 +15877,10 @@ function createPgClient(options) {
     connection,
     onnotice: () => {},
     ...options.prepare !== undefined ? { prepare: options.prepare } : {},
-    ...options.ssl ? { ssl: options.ssl } : {}
+    ...tlsOptions(options)
   };
   if (options.connectionString) {
-    return postgres(options.connectionString, base);
+    return assertDirectTlsTarget(postgres(options.connectionString, base), base);
   }
   return postgres({
     ...base,
@@ -15589,6 +15891,78 @@ function createPgClient(options) {
     ...options.password !== undefined ? { password: options.password } : {}
   });
 }
+function tlsOptions(options) {
+  const verification = directTlsVerification(options);
+  if (verification === null) {
+    return options.ssl ? { ssl: options.ssl } : {};
+  }
+  return { ssl: false, sslnegotiation: null, socket: directTlsSocket(verification) };
+}
+function directTlsVerification(options) {
+  const params = connectionStringParams(options.connectionString);
+  if (params.get("sslnegotiation") !== "direct") {
+    return null;
+  }
+  const sslmode = options.ssl === true ? "verify-full" : options.ssl || (params.get("sslrootcert") === "system" ? "verify-full" : params.get("sslmode") ?? params.get("ssl"));
+  switch (sslmode) {
+    case "require":
+      return "none";
+    case "verify-ca":
+      return "ca";
+    case "verify-full":
+    case "true":
+      return "full";
+    default:
+      throw new Error(`[SixbPg] sslnegotiation=direct requires sslmode=require, verify-ca or verify-full, got ${sslmode ? `"${sslmode}"` : "no sslmode"}: a direct TLS connection has no plaintext fallback.`);
+  }
+}
+function connectionStringParams(connectionString) {
+  return new URLSearchParams(connectionString?.split("?")[1] ?? "");
+}
+function directTlsSocket(verification) {
+  let reportedRefusal = false;
+  return ({ host: [host = "localhost"], port: [port = 5432] }) => {
+    const socket = connectTls({
+      host,
+      port,
+      servername: isIP(host) ? undefined : host,
+      ALPNProtocols: ["postgresql"],
+      rejectUnauthorized: verification !== "none",
+      ...verification === "ca" ? { checkServerIdentity: () => {
+        return;
+      } } : {}
+    });
+    let reachedServer = false;
+    let secured = false;
+    socket.once("connect", () => {
+      reachedServer = true;
+    });
+    socket.once("secureConnect", () => {
+      secured = true;
+      if (socket.alpnProtocol !== "postgresql") {
+        socket.destroy(new Error(`[SixbPg] ${host}:${port} accepted TLS without selecting the "postgresql" protocol` + " (ALPN), so it is not a PostgreSQL server accepting sslnegotiation=direct."));
+      }
+    });
+    socket.once("error", (error) => {
+      if (reportedRefusal || !reachedServer || secured)
+        return;
+      if (!["ECONNRESET", "EPIPE", "ERR_SOCKET_CLOSED"].includes(pgErrorCode(error) ?? ""))
+        return;
+      reportedRefusal = true;
+      console.error(`[SixbPg] ${host}:${port} closed the connection during a direct TLS handshake` + " (sslnegotiation=direct). Direct TLS needs PostgreSQL 17 or later, reached without a" + " proxy or pooler that expects an SSLRequest; remove sslnegotiation=direct otherwise.");
+    });
+    return socket;
+  };
+}
+function assertDirectTlsTarget(sql, options) {
+  if (!("socket" in options)) {
+    return sql;
+  }
+  if (sql.options.host.length !== 1 || sql.options.path) {
+    throw new Error("[SixbPg] sslnegotiation=direct supports one TCP host:port in the connection string, not" + " several hosts or a Unix socket path.");
+  }
+  return sql;
+}
 
 // src/pg-execution-storage.ts
 import {
@@ -15853,13 +16227,19 @@ async function queryLatestRunsByOwnerId(input) {
     return [];
   }
   const placeholders = ownerIds.map((_, index) => `$${index + 2}`).join(", ");
+  const parameters = [input.projectId, ...ownerIds];
+  let statusFilter = "";
+  if (input.excludedStatus !== undefined) {
+    parameters.push(input.excludedStatus);
+    statusFilter = ` AND status <> $${parameters.length}`;
+  }
   const orderColumn = input.tableName === "sync_runs" || input.tableName === "pipeline_runs" || input.tableName === "projection_runs" ? "COALESCE(started_at, queued_at)" : "started_at";
   const rows = await input.sql.unsafe(`
       SELECT DISTINCT ON (${input.ownerColumn}) ${input.selectList ?? "*"}
       FROM ${input.tableName}
-      WHERE project_id = $1 AND ${input.ownerColumn} IN (${placeholders})
+      WHERE project_id = $1 AND ${input.ownerColumn} IN (${placeholders})${statusFilter}
       ORDER BY ${input.ownerColumn}, ${orderColumn} DESC, id DESC
-    `, [input.projectId, ...ownerIds]);
+    `, parameters);
   const latestByOwnerId = new Map(rows.map((row) => [input.ownerIdFor(row), row]));
   return ownerIds.flatMap((ownerId) => {
     const row = latestByOwnerId.get(ownerId);
@@ -16248,12 +16628,14 @@ import {
   failProjectionRunEnqueue,
   immutableDatasetVersionConflict,
   mergeProjectionRunProgress,
+  parseProjectionAttemptFailure,
   planProjectionRunFinish,
   planProjectionRunReclaim,
   projectionRunNotFound,
   publicProjectionRunRecord,
   requireTelemetryProjectionRun,
   restoreProjectionRun,
+  SUPERSEDING_PROJECTION_RUN_STATUSES,
   staleProjectionRunExecution
 } from "@sixb/core/internal/projection-run-storage-provider";
 import { PROJECTION_RUN_FAILURE_CODES, ProjectionRunError } from "@sixb/core/storage";
@@ -16355,8 +16737,7 @@ class PgProjectionRunStorage {
       const [updated] = await tx`
         UPDATE projection_runs
         SET status = ${"running"}, started_at = COALESCE(started_at, ${input.startedAt ?? new Date}),
-          finished_at = ${null}, attempt = ${attempt}, execution_token = ${executionToken},
-          error = ${null}
+          finished_at = ${null}, attempt = ${attempt}, execution_token = ${executionToken}
         WHERE project_id = ${input.projectId} AND id = ${input.id}
           AND (
             (status = ${"queued"} AND execution_token IS NULL)
@@ -16423,6 +16804,24 @@ class PgProjectionRunStorage {
       return rowToProjectionRunRecord(updated);
     });
   }
+  async recordAttemptFailure(input) {
+    return runPgTransaction(this.sql, async (tx) => {
+      const existingRow = await requireMaterializationExecution(tx, input);
+      const error = parseProjectionAttemptFailure(restoreProjectionRunRow(existingRow), input.error);
+      const [updated] = await tx`
+        UPDATE projection_runs
+        SET error = ${serializeSixbFailure4(error, PROJECTION_RUN_FAILURE_CODES)}::text::jsonb
+        WHERE project_id = ${input.projectId}
+          AND id = ${input.id}
+          AND status = ${"running"}
+          AND execution_token = ${input.executionToken}
+        RETURNING *
+      `;
+      if (!updated)
+        throw staleProjectionRunExecution(input.id);
+      return rowToProjectionRunRecord(updated);
+    });
+  }
   async finish(input) {
     return runPgTransaction(this.sql, async (tx) => {
       const existingRow = await requireMaterializationExecution(tx, input);
@@ -16582,6 +16981,28 @@ class PgProjectionRunStorage {
     const runs = rows.map(rowToProjectionRunRecord);
     return { runs, hasMore: offset + runs.length < total, total };
   }
+  async findSupersedingRun(input) {
+    const [run] = await this.sql`
+      SELECT projection_id, materialization_protocol, dataset_version_created_at
+      FROM projection_runs
+      WHERE project_id = ${input.projectId} AND id = ${input.id}
+    `;
+    if (!run)
+      throw projectionRunNotFound(input.projectId, input.id);
+    if (run.materialization_protocol !== "replacement")
+      return null;
+    const [newer] = await this.sql`
+      SELECT * FROM projection_runs
+      WHERE project_id = ${input.projectId}
+        AND projection_id = ${run.projection_id}
+        AND materialization_protocol = ${"replacement"}
+        AND status = ANY(${this.sql.array([...SUPERSEDING_PROJECTION_RUN_STATUSES])}::text[])
+        AND dataset_version_created_at COLLATE "C" > ${run.dataset_version_created_at} COLLATE "C"
+      ORDER BY dataset_version_created_at COLLATE "C" DESC, id DESC
+      LIMIT 1
+    `;
+    return newer ? rowToProjectionRunRecord(newer) : null;
+  }
   async listLatestByProjectionIds(input) {
     const rows = await queryLatestRunsByOwnerId({
       sql: this.sql,
@@ -16589,7 +17010,8 @@ class PgProjectionRunStorage {
       ownerColumn: "projection_id",
       ownerIds: input.projectionIds,
       projectId: input.projectId,
-      ownerIdFor: (row) => row.projection_id
+      ownerIdFor: (row) => row.projection_id,
+      excludedStatus: "superseded"
     });
     return { runs: rows.map(rowToProjectionRunRecord) };
   }
@@ -18915,4 +19337,4 @@ export {
   migratePostgresStorage
 };
 
-//# debugId=F4D8409142F8F3AF64756E2164756E21
+//# debugId=4748AE3972DA287E64756E2164756E21