@tearleads/client-sdk 0.1.42 → 0.1.44

package/data/sqlite/documentHistoryPersistence.js

@@ -1,6 +1,6 @@
 import { base64ToBytes } from "../../internal/encoding/index.js";
 import { createDocument, exportFullHistoryIdentity, importSnapshot, satisfiesVersionVector, } from "../../internal/loro/index.js";
-import { and, eq, inArray, sql } from "drizzle-orm";
+import { and, eq, inArray, isNull, ne, sql } from "drizzle-orm";
 import { documentHistoryCheckpoints, documentHistoryUpdates, documentTables, } from "./schema.js";
 import { getClientSQLitePersistenceRuntime } from "./sqlitePersistenceRuntime.js";
 import { ensureSqlTables } from "./sqlSchema.js";
@@ -13,6 +13,21 @@ import { ensureSqlTables } from "./sqlSchema.js";
  */
 export const DOCUMENT_HISTORY_COMPACTION_MAX_ROWS = 200;
 export const DOCUMENT_HISTORY_COMPACTION_MAX_BYTES = 512 * 1024;
+/**
+ * Rows of the update log that are history tail: every row except an "outbox"
+ * row, which only waits to be sent (see `documentHistoryUpdates`).
+ */
+function tailInScope(scope) {
+    return and(eq(documentHistoryUpdates.appKind, scope.appKind), eq(documentHistoryUpdates.localId, scope.localId), ne(documentHistoryUpdates.origin, "outbox"));
+}
+/**
+ * Tail rows compaction may fold into a checkpoint and delete: a queued row is
+ * the only durable copy of an unsent update, so it waits for settlement even
+ * when a checkpoint already covers its operations.
+ */
+function compactableTailInScope(scope) {
+    return and(tailInScope(scope), isNull(documentHistoryUpdates.updateId));
+}
 export async function appendDocumentHistoryUpdates(execSql, scope, updates, origin) {
     if (updates.length === 0) {
         return;
@@ -59,7 +74,7 @@ export async function loadDocumentHistoryRestoreState(execSql, scope) {
         updateData: documentHistoryUpdates.updateData,
     })
         .from(documentHistoryUpdates)
-        .where(and(eq(documentHistoryUpdates.appKind, scope.appKind), eq(documentHistoryUpdates.localId, scope.localId)))
+        .where(tailInScope(scope))
         // Insertion order: same-millisecond appends make createdAt tie and a
         // random-uuid tiebreak would replay out of order. importUpdates tolerates
         // out-of-order batches, but replay should still be deterministic.
@@ -83,6 +98,11 @@ export async function loadDocumentHistoryRestoreState(execSql, scope) {
         })),
     };
 }
+/**
+ * Size of the tail compaction can shrink. Queued rows are excluded: they stay
+ * until settlement, so counting them would re-export full history on every
+ * persist while offline edits wait to sync.
+ */
 export async function readDocumentHistoryTailSize(execSql, scope) {
     await ensureSqlTables(execSql, documentTables);
     const { db } = getClientSQLitePersistenceRuntime(execSql);
@@ -92,7 +112,7 @@ export async function readDocumentHistoryTailSize(execSql, scope) {
         rowCount: sql `count(*)`,
     })
         .from(documentHistoryUpdates)
-        .where(and(eq(documentHistoryUpdates.appKind, scope.appKind), eq(documentHistoryUpdates.localId, scope.localId)));
+        .where(compactableTailInScope(scope));
     const [checkpoint] = await db
         .select({ localId: documentHistoryCheckpoints.localId })
         .from(documentHistoryCheckpoints)
@@ -105,9 +125,10 @@ export async function readDocumentHistoryTailSize(execSql, scope) {
     };
 }
 /**
- * The current tail rows WITH their payloads, so a compactor can prove each
- * row's ops are covered by the snapshot it is about to install (another
- * pane's append may carry ops this pane's document has not merged yet).
+ * The current compactable tail rows WITH their payloads, so a compactor can
+ * prove each row's ops are covered by the snapshot it is about to install
+ * (another pane's append may carry ops this pane's document has not merged
+ * yet). Queued rows are never candidates.
  */
 export async function listDocumentHistoryTailEntries(execSql, scope) {
     await ensureSqlTables(execSql, documentTables);
@@ -118,7 +139,7 @@ export async function listDocumentHistoryTailEntries(execSql, scope) {
         updateData: documentHistoryUpdates.updateData,
     })
         .from(documentHistoryUpdates)
-        .where(and(eq(documentHistoryUpdates.appKind, scope.appKind), eq(documentHistoryUpdates.localId, scope.localId)));
+        .where(compactableTailInScope(scope));
     return rows.flatMap((row) => row.id === null ? [] : [{ id: row.id, updateData: row.updateData }]);
 }
 const HISTORY_ROW_CHUNK = 400;
@@ -162,9 +183,11 @@ export async function replaceDocumentHistoryCheckpoint(execSql, scope, input) {
                 continue;
             }
             for (let index = 0; index < input.coveredTailIds.length; index += HISTORY_ROW_CHUNK) {
+                // Never a queued row, even if a caller names one: its operations may
+                // be in the checkpoint, but it is still the unsent update itself.
                 await tx
                     .delete(documentHistoryUpdates)
-                    .where(and(eq(documentHistoryUpdates.appKind, scope.appKind), eq(documentHistoryUpdates.localId, scope.localId), inArray(documentHistoryUpdates.id, input.coveredTailIds.slice(index, index + HISTORY_ROW_CHUNK))));
+                    .where(and(compactableTailInScope(scope), inArray(documentHistoryUpdates.id, input.coveredTailIds.slice(index, index + HISTORY_ROW_CHUNK))));
             }
             return true;
         }

package/data/sqlite/documentHistoryPersistence.js.map

@@ -1 +1 @@
-{"version":3,"file":"documentHistoryPersistence.js","sourceRoot":"","sources":["documentHistoryPersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EACL,cAAc,EACd,yBAAyB,EACzB,cAAc,EACd,sBAAsB,GACvB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAEpD,OAAO,EACL,0BAA0B,EAC1B,sBAAsB,EACtB,cAAc,GACf,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,iCAAiC,EAAE,MAAM,4BAA4B,CAAC;AAC/E,OAAO,EAAgB,eAAe,EAAE,MAAM,aAAa,CAAC;AAE5D;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,GAAG,CAAC;AACxD,MAAM,CAAC,MAAM,qCAAqC,GAAG,GAAG,GAAG,IAAI,CAAC;AAmBhE,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,OAAgB,EAChB,KAAoB,EACpB,OAA0B,EAC1B,MAAmC;IAEnC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;IACT,CAAC;IACD,MAAM,eAAe,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IAC/C,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,MAAM,iCAAiC,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QACxE,wEAAwE;QACxE,+DAA+D;QAC/D,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,IAAI,iBAAiB,EAAE,CAAC;YACvE,MAAM,EAAE,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,MAAM,CAC5C,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;gBACnE,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE;gBACvB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,UAAU;gBACV,MAAM;gBACN,SAAS;aACV,CAAC,CAAC,CACJ,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,OAAgB,EAChB,KAAoB;IAEpB,MAAM,eAAe,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IAC/C,MAAM,EAAE,EAAE,EAAE,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC1D,uEAAuE;IACvE,yEAAyE;IACzE,yEAAyE;IACzE,2EAA2E;IAC3E,wEAAwE;IACxE,6BAA6B;IAC7B,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,CAAC;QACN,EAAE,EAAE,sBAAsB,CAAC,EAAE;QAC7B,MAAM,EAAE,sBAAsB,CAAC,MAAM;QACrC,UAAU,EAAE,sBAAsB,CAAC,UAAU;KAC9C,CAAC;SACD,IAAI,CAAC,sBAAsB,CAAC;SAC5B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,sBAAsB,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,EACjD,EAAE,CAAC,sBAAsB,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAClD,CACF;QACD,qEAAqE;QACrE,0EAA0E;QAC1E,kEAAkE;SACjE,OAAO,CAAC,GAAG,CAAA,OAAO,CAAC,CAAC;IAEvB,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,EAAE;SAC1B,MAAM,CAAC,EAAE,QAAQ,EAAE,0BAA0B,CAAC,QAAQ,EAAE,CAAC;SACzD,IAAI,CAAC,0BAA0B,CAAC;SAChC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,0BAA0B,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,EACrD,EAAE,CAAC,0BAA0B,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CACtD,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,UAAU,EAAE,QAAQ,IAAI,EAAE;QACpC,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAC9B,oEAAoE;YACpE,oEAAoE;YACpE,kEAAkE;YAClE,MAAM,EACJ,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAE,QAAkB,CAAC,CAAC,CAAE,OAAiB;YACpE,UAAU,EAAE,GAAG,CAAC,UAAU;SAC3B,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,OAAgB,EAChB,KAAoB;IAEpB,MAAM,eAAe,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IAC/C,MAAM,EAAE,EAAE,EAAE,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,CAAC;QACN,UAAU,EAAE,GAAG,CAAQ,uBAAuB,sBAAsB,CAAC,UAAU,QAAQ;QACvF,QAAQ,EAAE,GAAG,CAAQ,UAAU;KAChC,CAAC;SACD,IAAI,CAAC,sBAAsB,CAAC;SAC5B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,sBAAsB,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,EACjD,EAAE,CAAC,sBAAsB,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAClD,CACF,CAAC;IACJ,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,EAAE;SAC1B,MAAM,CAAC,EAAE,OAAO,EAAE,0BAA0B,CAAC,OAAO,EAAE,CAAC;SACvD,IAAI,CAAC,0BAA0B,CAAC;SAChC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,0BAA0B,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,EACrD,EAAE,CAAC,0BAA0B,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CACtD,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO;QACL,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,IAAI,CAAC,CAAC;QAC3C,aAAa,EAAE,UAAU,KAAK,SAAS;QACvC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,IAAI,CAAC,CAAC;KACxC,CAAC;AACJ,CAAC;AAOD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,OAAgB,EAChB,KAAoB;IAEpB,MAAM,eAAe,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IAC/C,MAAM,EAAE,EAAE,EAAE,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,CAAC;QACN,EAAE,EAAE,sBAAsB,CAAC,EAAE;QAC7B,UAAU,EAAE,sBAAsB,CAAC,UAAU;KAC9C,CAAC;SACD,IAAI,CAAC,sBAAsB,CAAC;SAC5B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,sBAAsB,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,EACjD,EAAE,CAAC,sBAAsB,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAClD,CACF,CAAC;IACJ,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAC1B,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,CACpE,CAAC;AACJ,CAAC;AAED,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAE9B;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,OAAgB,EAChB,KAAoB,EACpB,KAkBC;IAED,MAAM,eAAe,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IAC/C,yEAAyE;IACzE,wEAAwE;IACxE,iEAAiE;IACjE,0EAA0E;IAC1E,sEAAsE;IACtE,yEAAyE;IACzE,0EAA0E;IAC1E,OAAO,iCAAiC,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QACzE,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,EAAE,CAAC;YACrC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,uBAAuB,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;YACtE,IAAI,QAAiB,CAAC;YACtB,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,wBAAwB,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;YAC9D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,sBAAsB,EAAE,CAAC;oBAC5C,+DAA+D;oBAC/D,6DAA6D;oBAC7D,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;YACD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,gEAAgE;gBAChE,wCAAwC;gBACxC,SAAS;YACX,CAAC;YACD,KACE,IAAI,KAAK,GAAG,CAAC,EACb,KAAK,GAAG,KAAK,CAAC,cAAc,CAAC,MAAM,EACnC,KAAK,IAAI,iBAAiB,EAC1B,CAAC;gBACD,MAAM,EAAE;qBACL,MAAM,CAAC,sBAAsB,CAAC;qBAC9B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,sBAAsB,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,EACjD,EAAE,CAAC,sBAAsB,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,EACjD,OAAO,CACL,sBAAsB,CAAC,EAAE,EACzB,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,iBAAiB,CAAC,CAC7D,CACF,CACF,CAAC;YACN,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,oEAAoE;QACpE,8DAA8D;QAC9D,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAQnC;;;;;GAKG;AACH,KAAK,UAAU,wBAAwB,CACrC,EAAc,EACd,KAAoB,EACpB,KAIC;IAED,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IACrC,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,CAAC;QACN,gBAAgB,EAAE,0BAA0B,CAAC,gBAAgB;QAC7D,QAAQ,EAAE,0BAA0B,CAAC,QAAQ;QAC7C,QAAQ,EAAE,0BAA0B,CAAC,QAAQ;KAC9C,CAAC;SACD,IAAI,CAAC,0BAA0B,CAAC;SAChC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,0BAA0B,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,EACrD,EAAE,CAAC,0BAA0B,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CACtD,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,QAAQ,GAAG,MAAM,EAAE;aACtB,MAAM,CAAC,0BAA0B,CAAC;aAClC,MAAM,CAAC;YACN,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,QAAQ;YACR,SAAS;SACV,CAAC;aACD,mBAAmB,CAAC;YACnB,MAAM,EAAE;gBACN,0BAA0B,CAAC,OAAO;gBAClC,0BAA0B,CAAC,OAAO;aACnC;SACF,CAAC;aACD,SAAS,CAAC,EAAE,OAAO,EAAE,0BAA0B,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9D,sEAAsE;QACtE,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7B,CAAC;IAED,yEAAyE;IACzE,sEAAsE;IACtE,iEAAiE;IACjE,uEAAuE;IACvE,uEAAuE;IACvE,oEAAoE;IACpE,6CAA6C;IAC7C,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QACzB,IACE,CAAC,sBAAsB,CAAC,KAAK,CAAC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,CAAC,EACxE,CAAC;YACD,MAAM,IAAI,sBAAsB,EAAE,CAAC;QACrC,CAAC;QACD,IACE,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ;YAClC,CAAC,CAAC,MAAM,wCAAwC,CAAC;gBAC/C,iBAAiB,EAAE,KAAK,CAAC,QAAQ;gBACjC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;gBACzC,cAAc,EAAE,MAAM,CAAC,QAAQ;aAChC,CAAC,CAAC,EACH,CAAC;YACD,MAAM,IAAI,sBAAsB,EAAE,CAAC;QACrC,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,EAAE;SACtB,MAAM,CAAC,0BAA0B,CAAC;SAClC,GAAG,CAAC;QACH,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,QAAQ;QACR,SAAS;KACV,CAAC;SACD,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,0BAA0B,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,EACrD,EAAE,CAAC,0BAA0B,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,EACrD,EAAE,CAAC,0BAA0B,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CACzD,CACF;SACA,SAAS,CAAC,EAAE,OAAO,EAAE,0BAA0B,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9D,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED,KAAK,UAAU,wCAAwC,CAAC,KAIvD;IACC,MAAM,CAAC,iBAAiB,EAAE,cAAc,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC5D,cAAc,CAAC,mCAAmC,CAAC;QACnD,cAAc,CAAC,gCAAgC,CAAC;KACjD,CAAC,CAAC;IACH,IAAI,CAAC;QACH,cAAc,CAAC,iBAAiB,EAAE,aAAa,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC;QAC1E,cAAc,CAAC,cAAc,EAAE,aAAa,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC;QACpE,OAAO,CACL,yBAAyB,CAAC,iBAAiB,EAAE,KAAK,CAAC,gBAAgB,CAAC;YACpE,yBAAyB,CAAC,cAAc,CAAC,CAC1C,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,iBAAiB,CAAC,IAAI,EAAE,CAAC;QACzB,cAAc,CAAC,IAAI,EAAE,CAAC;IACxB,CAAC;AACH,CAAC;AAED,MAAM,sBAAuB,SAAQ,KAAK;IACxC;QACE,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAgB,EAChB,KAAoB;IAEpB,MAAM,eAAe,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IAC/C,MAAM,iCAAiC,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QACxE,MAAM,EAAE;aACL,MAAM,CAAC,0BAA0B,CAAC;aAClC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,0BAA0B,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,EACrD,EAAE,CAAC,0BAA0B,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CACtD,CACF,CAAC;QACJ,MAAM,EAAE;aACL,MAAM,CAAC,sBAAsB,CAAC;aAC9B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,sBAAsB,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,EACjD,EAAE,CAAC,sBAAsB,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAClD,CACF,CAAC;IACN,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { base64ToBytes } from \"@tearleads/encoding\";\nimport {\n  createDocument,\n  exportFullHistoryIdentity,\n  importSnapshot,\n  satisfiesVersionVector,\n} from \"@tearleads/loro\";\nimport { and, eq, inArray, sql } from \"drizzle-orm\";\nimport type { DocumentScope } from \"./documentPersistenceTypes\";\nimport {\n  documentHistoryCheckpoints,\n  documentHistoryUpdates,\n  documentTables,\n} from \"./schema\";\nimport { getClientSQLitePersistenceRuntime } from \"./sqlitePersistenceRuntime\";\nimport { type ExecSql, ensureSqlTables } from \"./sqlSchema\";\n\n/**\n * Compaction thresholds: once the tail carries this many rows or bytes, the\n * next persist of a full-history-capable document exports a fresh checkpoint\n * and clears the tail. Small enough to keep restore replay short, large\n * enough that a full-history export (O(history)) happens once per burst of\n * edits instead of per keystroke.\n */\nexport const DOCUMENT_HISTORY_COMPACTION_MAX_ROWS = 200;\nexport const DOCUMENT_HISTORY_COMPACTION_MAX_BYTES = 512 * 1024;\n\n/**\n * Row provenance: \"local\" for updates authored on this device, \"remote\" for\n * decrypted pulled updates. Restores advance the outgoing-delta marker across\n * remote rows (already server-side); local rows never advance it.\n */\ntype DocumentHistoryUpdateOrigin = \"local\" | \"remote\";\n\ninterface DocumentHistoryTailUpdate {\n  readonly origin: DocumentHistoryUpdateOrigin;\n  readonly updateData: string;\n}\n\ninterface DocumentHistoryRestoreState {\n  readonly snapshot: string;\n  readonly tailUpdates: readonly DocumentHistoryTailUpdate[];\n}\n\nexport async function appendDocumentHistoryUpdates(\n  execSql: ExecSql,\n  scope: DocumentScope,\n  updates: readonly string[],\n  origin: DocumentHistoryUpdateOrigin,\n): Promise<void> {\n  if (updates.length === 0) {\n    return;\n  }\n  await ensureSqlTables(execSql, documentTables);\n  const createdAt = new Date().toISOString();\n  await getClientSQLitePersistenceRuntime(execSql).runMutation(async (db) => {\n    // Chunked: a catch-up pull can carry thousands of updates, and a single\n    // multi-row insert would exceed SQLite's bound-variable limit.\n    for (let index = 0; index < updates.length; index += HISTORY_ROW_CHUNK) {\n      await db.insert(documentHistoryUpdates).values(\n        updates.slice(index, index + HISTORY_ROW_CHUNK).map((updateData) => ({\n          id: crypto.randomUUID(),\n          appKind: scope.appKind,\n          localId: scope.localId,\n          updateData,\n          origin,\n          createdAt,\n        })),\n      );\n    }\n  });\n}\n\n/**\n * The checkpoint + ordered tail for a scope, or null when NEITHER exists (a\n * discovered shell that has not hydrated content yet; the caller starts the\n * document empty and the remote pull supplies the content). A tail WITHOUT a\n * checkpoint — a crash between the first enqueued edit's tail append and the\n * birth-checkpoint seed — restores as tail-only (`snapshot: \"\"`): those tail\n * rows can be the only durable copy of a local edit, so they must never be\n * silently ignored.\n */\nexport async function loadDocumentHistoryRestoreState(\n  execSql: ExecSql,\n  scope: DocumentScope,\n): Promise<DocumentHistoryRestoreState | null> {\n  await ensureSqlTables(execSql, documentTables);\n  const { db } = getClientSQLitePersistenceRuntime(execSql);\n  // Read the TAIL before the (full) checkpoint: if another pane compacts\n  // between the two reads, this order yields old-tail + new-checkpoint — a\n  // safe superset (the new checkpoint subsumes the old tail, and replay is\n  // idempotent by op identity). The reverse order could yield old-checkpoint\n  // + already-emptied tail, a torn read that silently drops the compacted\n  // ops for the whole session.\n  const tail = await db\n    .select({\n      id: documentHistoryUpdates.id,\n      origin: documentHistoryUpdates.origin,\n      updateData: documentHistoryUpdates.updateData,\n    })\n    .from(documentHistoryUpdates)\n    .where(\n      and(\n        eq(documentHistoryUpdates.appKind, scope.appKind),\n        eq(documentHistoryUpdates.localId, scope.localId),\n      ),\n    )\n    // Insertion order: same-millisecond appends make createdAt tie and a\n    // random-uuid tiebreak would replay out of order. importUpdates tolerates\n    // out-of-order batches, but replay should still be deterministic.\n    .orderBy(sql`rowid`);\n\n  const [checkpoint] = await db\n    .select({ snapshot: documentHistoryCheckpoints.snapshot })\n    .from(documentHistoryCheckpoints)\n    .where(\n      and(\n        eq(documentHistoryCheckpoints.appKind, scope.appKind),\n        eq(documentHistoryCheckpoints.localId, scope.localId),\n      ),\n    )\n    .limit(1);\n  if (!checkpoint && tail.length === 0) {\n    return null;\n  }\n\n  return {\n    snapshot: checkpoint?.snapshot ?? \"\",\n    tailUpdates: tail.map((row) => ({\n      // Fail toward re-sending: an unrecognized origin never advances the\n      // marker, which is the recoverable direction (a redundant re-submit\n      // is idempotent; a skipped local op would be orphaned from sync).\n      origin:\n        row.origin === \"remote\" ? (\"remote\" as const) : (\"local\" as const),\n      updateData: row.updateData,\n    })),\n  };\n}\n\nexport async function readDocumentHistoryTailSize(\n  execSql: ExecSql,\n  scope: DocumentScope,\n): Promise<{ byteLength: number; hasCheckpoint: boolean; rowCount: number }> {\n  await ensureSqlTables(execSql, documentTables);\n  const { db } = getClientSQLitePersistenceRuntime(execSql);\n  const [totals] = await db\n    .select({\n      byteLength: sql<number>`coalesce(sum(length(${documentHistoryUpdates.updateData})), 0)`,\n      rowCount: sql<number>`count(*)`,\n    })\n    .from(documentHistoryUpdates)\n    .where(\n      and(\n        eq(documentHistoryUpdates.appKind, scope.appKind),\n        eq(documentHistoryUpdates.localId, scope.localId),\n      ),\n    );\n  const [checkpoint] = await db\n    .select({ localId: documentHistoryCheckpoints.localId })\n    .from(documentHistoryCheckpoints)\n    .where(\n      and(\n        eq(documentHistoryCheckpoints.appKind, scope.appKind),\n        eq(documentHistoryCheckpoints.localId, scope.localId),\n      ),\n    )\n    .limit(1);\n  return {\n    byteLength: Number(totals?.byteLength ?? 0),\n    hasCheckpoint: checkpoint !== undefined,\n    rowCount: Number(totals?.rowCount ?? 0),\n  };\n}\n\ninterface DocumentHistoryTailEntry {\n  readonly id: string;\n  readonly updateData: string;\n}\n\n/**\n * The current tail rows WITH their payloads, so a compactor can prove each\n * row's ops are covered by the snapshot it is about to install (another\n * pane's append may carry ops this pane's document has not merged yet).\n */\nexport async function listDocumentHistoryTailEntries(\n  execSql: ExecSql,\n  scope: DocumentScope,\n): Promise<DocumentHistoryTailEntry[]> {\n  await ensureSqlTables(execSql, documentTables);\n  const { db } = getClientSQLitePersistenceRuntime(execSql);\n  const rows = await db\n    .select({\n      id: documentHistoryUpdates.id,\n      updateData: documentHistoryUpdates.updateData,\n    })\n    .from(documentHistoryUpdates)\n    .where(\n      and(\n        eq(documentHistoryUpdates.appKind, scope.appKind),\n        eq(documentHistoryUpdates.localId, scope.localId),\n      ),\n    );\n  return rows.flatMap((row) =>\n    row.id === null ? [] : [{ id: row.id, updateData: row.updateData }],\n  );\n}\n\nconst HISTORY_ROW_CHUNK = 400;\n\n/**\n * Replace the scope's checkpoint with a fresh full-history snapshot and\n * delete ONLY the tail rows the caller captured before exporting it. Every\n * append path writes its tail row after the ops are already in the live\n * document, so any row captured before the export is provably covered by\n * the snapshot — while a row appended concurrently (between export and this\n * delete) survives for the next compaction instead of being lost.\n */\nexport async function replaceDocumentHistoryCheckpoint(\n  execSql: ExecSql,\n  scope: DocumentScope,\n  input: {\n    coveredTailIds: readonly string[];\n    endVersionVector: string;\n    /**\n     * Skip the monotonic version gate. Only for document CREATION, where any\n     * existing checkpoint under this localId is the orphan of a failed prior\n     * attempt (checkpoint written, record row never committed) — a retry's\n     * fresh document need not dominate that orphan to replace it.\n     */\n    force?: boolean;\n    snapshot: string;\n    /**\n     * Re-checked after acquiring the serialized mutation slot (like the\n     * record-save path): a store reset/recreation that happened while this\n     * call waited in the queue must abort the write, or a stale compactor\n     * could install the OLD document's checkpoint over the new identity's.\n     */\n    stillCurrent?: () => boolean;\n  },\n): Promise<boolean> {\n  await ensureSqlTables(execSql, documentTables);\n  // Sequential (non-transactional) so callers already inside a transaction\n  // can nest this. Crash between the statements leaves the new checkpoint\n  // plus covered tail rows — a safe superset, since tail replay is\n  // idempotent by op identity. The replacement itself is a compare-and-swap\n  // on the stored revision, so the version gate cannot be bypassed by a\n  // concurrent compactor between the read and the write: whoever loses the\n  // CAS re-reads and re-evaluates the gate against the winner's checkpoint.\n  return getClientSQLitePersistenceRuntime(execSql).runMutation(async (tx) => {\n    if (input.stillCurrent?.() === false) {\n      return false;\n    }\n    for (let attempt = 0; attempt < CHECKPOINT_CAS_ATTEMPTS; attempt += 1) {\n      let replaced: boolean;\n      try {\n        replaced = await tryReplaceCheckpointOnce(tx, scope, input);\n      } catch (error) {\n        if (error instanceof CheckpointGateRejected) {\n          // A fresher checkpoint dominates this candidate: no write, and\n          // the caller's covered rows must stay for the covering pane.\n          return false;\n        }\n        throw error;\n      }\n      if (!replaced) {\n        // CAS lost to a concurrent writer — re-read and re-evaluate the\n        // gate against the winner's checkpoint.\n        continue;\n      }\n      for (\n        let index = 0;\n        index < input.coveredTailIds.length;\n        index += HISTORY_ROW_CHUNK\n      ) {\n        await tx\n          .delete(documentHistoryUpdates)\n          .where(\n            and(\n              eq(documentHistoryUpdates.appKind, scope.appKind),\n              eq(documentHistoryUpdates.localId, scope.localId),\n              inArray(\n                documentHistoryUpdates.id,\n                input.coveredTailIds.slice(index, index + HISTORY_ROW_CHUNK),\n              ),\n            ),\n          );\n      }\n      return true;\n    }\n    // Exhaustion must not read as durable success: creation and rebuild\n    // callers persist record rows assuming the checkpoint landed.\n    throw new Error(\n      \"Document history checkpoint replacement lost every CAS attempt\",\n    );\n  });\n}\n\nconst CHECKPOINT_CAS_ATTEMPTS = 16;\n\ntype MutationDb = Parameters<\n  Parameters<\n    ReturnType<typeof getClientSQLitePersistenceRuntime>[\"runMutation\"]\n  >[0]\n>[0];\n\n/**\n * One compare-and-swap attempt. Returns true when this caller's checkpoint\n * became the stored one, false when a concurrent writer won the CAS (the\n * caller re-reads and retries), and throws CheckpointGateRejected when a\n * fresher stored checkpoint dominates the candidate.\n */\nasync function tryReplaceCheckpointOnce(\n  tx: MutationDb,\n  scope: DocumentScope,\n  input: {\n    endVersionVector: string;\n    force?: boolean;\n    snapshot: string;\n  },\n): Promise<boolean> {\n  const updatedAt = new Date().toISOString();\n  const revision = crypto.randomUUID();\n  const [stored] = await tx\n    .select({\n      endVersionVector: documentHistoryCheckpoints.endVersionVector,\n      revision: documentHistoryCheckpoints.revision,\n      snapshot: documentHistoryCheckpoints.snapshot,\n    })\n    .from(documentHistoryCheckpoints)\n    .where(\n      and(\n        eq(documentHistoryCheckpoints.appKind, scope.appKind),\n        eq(documentHistoryCheckpoints.localId, scope.localId),\n      ),\n    )\n    .limit(1);\n\n  if (!stored) {\n    const inserted = await tx\n      .insert(documentHistoryCheckpoints)\n      .values({\n        appKind: scope.appKind,\n        localId: scope.localId,\n        snapshot: input.snapshot,\n        endVersionVector: input.endVersionVector,\n        revision,\n        updatedAt,\n      })\n      .onConflictDoNothing({\n        target: [\n          documentHistoryCheckpoints.appKind,\n          documentHistoryCheckpoints.localId,\n        ],\n      })\n      .returning({ localId: documentHistoryCheckpoints.localId });\n    // Conflict means a concurrent writer inserted first — retry the gate.\n    return inserted.length > 0;\n  }\n\n  // A stale compactor (a pane whose document has not merged another pane's\n  // ops) must never replace a checkpoint it does not cover: the covered\n  // pane may already have deleted its tail rows, so regressing the\n  // checkpoint would leave those ops with no durable copy at all. Vector\n  // dominance proves counter coverage; the retained-prefix identity also\n  // proves the candidate carries the exact stored operations at those\n  // counters rather than a same-frontier fork.\n  if (input.force !== true) {\n    if (\n      !satisfiesVersionVector(input.endVersionVector, stored.endVersionVector)\n    ) {\n      throw new CheckpointGateRejected();\n    }\n    if (\n      input.snapshot !== stored.snapshot &&\n      !(await candidateContainsStoredCheckpointHistory({\n        candidateSnapshot: input.snapshot,\n        storedEndVersion: stored.endVersionVector,\n        storedSnapshot: stored.snapshot,\n      }))\n    ) {\n      throw new CheckpointGateRejected();\n    }\n  }\n\n  const replaced = await tx\n    .update(documentHistoryCheckpoints)\n    .set({\n      snapshot: input.snapshot,\n      endVersionVector: input.endVersionVector,\n      revision,\n      updatedAt,\n    })\n    .where(\n      and(\n        eq(documentHistoryCheckpoints.appKind, scope.appKind),\n        eq(documentHistoryCheckpoints.localId, scope.localId),\n        eq(documentHistoryCheckpoints.revision, stored.revision),\n      ),\n    )\n    .returning({ localId: documentHistoryCheckpoints.localId });\n  return replaced.length > 0;\n}\n\nasync function candidateContainsStoredCheckpointHistory(input: {\n  candidateSnapshot: string;\n  storedEndVersion: string;\n  storedSnapshot: string;\n}): Promise<boolean> {\n  const [candidateDocument, storedDocument] = await Promise.all([\n    createDocument(\"checkpoint-candidate-history-gate\"),\n    createDocument(\"checkpoint-stored-history-gate\"),\n  ]);\n  try {\n    importSnapshot(candidateDocument, base64ToBytes(input.candidateSnapshot));\n    importSnapshot(storedDocument, base64ToBytes(input.storedSnapshot));\n    return (\n      exportFullHistoryIdentity(candidateDocument, input.storedEndVersion) ===\n      exportFullHistoryIdentity(storedDocument)\n    );\n  } finally {\n    candidateDocument.free();\n    storedDocument.free();\n  }\n}\n\nclass CheckpointGateRejected extends Error {\n  constructor() {\n    super(\"checkpoint gate rejected\");\n    this.name = \"CheckpointGateRejected\";\n  }\n}\n\nexport async function deleteDocumentHistory(\n  execSql: ExecSql,\n  scope: DocumentScope,\n): Promise<void> {\n  await ensureSqlTables(execSql, documentTables);\n  await getClientSQLitePersistenceRuntime(execSql).runMutation(async (tx) => {\n    await tx\n      .delete(documentHistoryCheckpoints)\n      .where(\n        and(\n          eq(documentHistoryCheckpoints.appKind, scope.appKind),\n          eq(documentHistoryCheckpoints.localId, scope.localId),\n        ),\n      );\n    await tx\n      .delete(documentHistoryUpdates)\n      .where(\n        and(\n          eq(documentHistoryUpdates.appKind, scope.appKind),\n          eq(documentHistoryUpdates.localId, scope.localId),\n        ),\n      );\n  });\n}\n"]}
+{"version":3,"file":"documentHistoryPersistence.js","sourceRoot":"","sources":["documentHistoryPersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EACL,cAAc,EACd,yBAAyB,EACzB,cAAc,EACd,sBAAsB,GACvB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAEhE,OAAO,EACL,0BAA0B,EAC1B,sBAAsB,EACtB,cAAc,GACf,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,iCAAiC,EAAE,MAAM,4BAA4B,CAAC;AAC/E,OAAO,EAAgB,eAAe,EAAE,MAAM,aAAa,CAAC;AAE5D;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,GAAG,CAAC;AACxD,MAAM,CAAC,MAAM,qCAAqC,GAAG,GAAG,GAAG,IAAI,CAAC;AAShE;;;GAGG;AACH,SAAS,WAAW,CAAC,KAAoB;IACvC,OAAO,GAAG,CACR,EAAE,CAAC,sBAAsB,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,EACjD,EAAE,CAAC,sBAAsB,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,EACjD,EAAE,CAAC,sBAAsB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAC5C,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,sBAAsB,CAAC,KAAoB;IAClD,OAAO,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC1E,CAAC;AAYD,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,OAAgB,EAChB,KAAoB,EACpB,OAA0B,EAC1B,MAAmC;IAEnC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;IACT,CAAC;IACD,MAAM,eAAe,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IAC/C,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,MAAM,iCAAiC,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QACxE,wEAAwE;QACxE,+DAA+D;QAC/D,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,IAAI,iBAAiB,EAAE,CAAC;YACvE,MAAM,EAAE,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,MAAM,CAC5C,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;gBACnE,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE;gBACvB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,UAAU;gBACV,MAAM;gBACN,SAAS;aACV,CAAC,CAAC,CACJ,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,OAAgB,EAChB,KAAoB;IAEpB,MAAM,eAAe,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IAC/C,MAAM,EAAE,EAAE,EAAE,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC1D,uEAAuE;IACvE,yEAAyE;IACzE,yEAAyE;IACzE,2EAA2E;IAC3E,wEAAwE;IACxE,6BAA6B;IAC7B,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,CAAC;QACN,EAAE,EAAE,sBAAsB,CAAC,EAAE;QAC7B,MAAM,EAAE,sBAAsB,CAAC,MAAM;QACrC,UAAU,EAAE,sBAAsB,CAAC,UAAU;KAC9C,CAAC;SACD,IAAI,CAAC,sBAAsB,CAAC;SAC5B,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAC1B,qEAAqE;QACrE,0EAA0E;QAC1E,kEAAkE;SACjE,OAAO,CAAC,GAAG,CAAA,OAAO,CAAC,CAAC;IAEvB,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,EAAE;SAC1B,MAAM,CAAC,EAAE,QAAQ,EAAE,0BAA0B,CAAC,QAAQ,EAAE,CAAC;SACzD,IAAI,CAAC,0BAA0B,CAAC;SAChC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,0BAA0B,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,EACrD,EAAE,CAAC,0BAA0B,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CACtD,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,UAAU,EAAE,QAAQ,IAAI,EAAE;QACpC,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAC9B,oEAAoE;YACpE,oEAAoE;YACpE,kEAAkE;YAClE,MAAM,EACJ,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAE,QAAkB,CAAC,CAAC,CAAE,OAAiB;YACpE,UAAU,EAAE,GAAG,CAAC,UAAU;SAC3B,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,OAAgB,EAChB,KAAoB;IAEpB,MAAM,eAAe,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IAC/C,MAAM,EAAE,EAAE,EAAE,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,CAAC;QACN,UAAU,EAAE,GAAG,CAAQ,uBAAuB,sBAAsB,CAAC,UAAU,QAAQ;QACvF,QAAQ,EAAE,GAAG,CAAQ,UAAU;KAChC,CAAC;SACD,IAAI,CAAC,sBAAsB,CAAC;SAC5B,KAAK,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAC;IACxC,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,EAAE;SAC1B,MAAM,CAAC,EAAE,OAAO,EAAE,0BAA0B,CAAC,OAAO,EAAE,CAAC;SACvD,IAAI,CAAC,0BAA0B,CAAC;SAChC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,0BAA0B,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,EACrD,EAAE,CAAC,0BAA0B,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CACtD,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO;QACL,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,IAAI,CAAC,CAAC;QAC3C,aAAa,EAAE,UAAU,KAAK,SAAS;QACvC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,IAAI,CAAC,CAAC;KACxC,CAAC;AACJ,CAAC;AAOD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,OAAgB,EAChB,KAAoB;IAEpB,MAAM,eAAe,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IAC/C,MAAM,EAAE,EAAE,EAAE,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,CAAC;QACN,EAAE,EAAE,sBAAsB,CAAC,EAAE;QAC7B,UAAU,EAAE,sBAAsB,CAAC,UAAU;KAC9C,CAAC;SACD,IAAI,CAAC,sBAAsB,CAAC;SAC5B,KAAK,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAC;IACxC,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAC1B,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,CACpE,CAAC;AACJ,CAAC;AAED,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAE9B;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,OAAgB,EAChB,KAAoB,EACpB,KAkBC;IAED,MAAM,eAAe,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IAC/C,yEAAyE;IACzE,wEAAwE;IACxE,iEAAiE;IACjE,0EAA0E;IAC1E,sEAAsE;IACtE,yEAAyE;IACzE,0EAA0E;IAC1E,OAAO,iCAAiC,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QACzE,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,EAAE,CAAC;YACrC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,uBAAuB,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;YACtE,IAAI,QAAiB,CAAC;YACtB,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,wBAAwB,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;YAC9D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,sBAAsB,EAAE,CAAC;oBAC5C,+DAA+D;oBAC/D,6DAA6D;oBAC7D,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;YACD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,gEAAgE;gBAChE,wCAAwC;gBACxC,SAAS;YACX,CAAC;YACD,KACE,IAAI,KAAK,GAAG,CAAC,EACb,KAAK,GAAG,KAAK,CAAC,cAAc,CAAC,MAAM,EACnC,KAAK,IAAI,iBAAiB,EAC1B,CAAC;gBACD,qEAAqE;gBACrE,kEAAkE;gBAClE,MAAM,EAAE;qBACL,MAAM,CAAC,sBAAsB,CAAC;qBAC9B,KAAK,CACJ,GAAG,CACD,sBAAsB,CAAC,KAAK,CAAC,EAC7B,OAAO,CACL,sBAAsB,CAAC,EAAE,EACzB,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,iBAAiB,CAAC,CAC7D,CACF,CACF,CAAC;YACN,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,oEAAoE;QACpE,8DAA8D;QAC9D,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAQnC;;;;;GAKG;AACH,KAAK,UAAU,wBAAwB,CACrC,EAAc,EACd,KAAoB,EACpB,KAIC;IAED,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IACrC,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,CAAC;QACN,gBAAgB,EAAE,0BAA0B,CAAC,gBAAgB;QAC7D,QAAQ,EAAE,0BAA0B,CAAC,QAAQ;QAC7C,QAAQ,EAAE,0BAA0B,CAAC,QAAQ;KAC9C,CAAC;SACD,IAAI,CAAC,0BAA0B,CAAC;SAChC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,0BAA0B,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,EACrD,EAAE,CAAC,0BAA0B,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CACtD,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,QAAQ,GAAG,MAAM,EAAE;aACtB,MAAM,CAAC,0BAA0B,CAAC;aAClC,MAAM,CAAC;YACN,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,QAAQ;YACR,SAAS;SACV,CAAC;aACD,mBAAmB,CAAC;YACnB,MAAM,EAAE;gBACN,0BAA0B,CAAC,OAAO;gBAClC,0BAA0B,CAAC,OAAO;aACnC;SACF,CAAC;aACD,SAAS,CAAC,EAAE,OAAO,EAAE,0BAA0B,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9D,sEAAsE;QACtE,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7B,CAAC;IAED,yEAAyE;IACzE,sEAAsE;IACtE,iEAAiE;IACjE,uEAAuE;IACvE,uEAAuE;IACvE,oEAAoE;IACpE,6CAA6C;IAC7C,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QACzB,IACE,CAAC,sBAAsB,CAAC,KAAK,CAAC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,CAAC,EACxE,CAAC;YACD,MAAM,IAAI,sBAAsB,EAAE,CAAC;QACrC,CAAC;QACD,IACE,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ;YAClC,CAAC,CAAC,MAAM,wCAAwC,CAAC;gBAC/C,iBAAiB,EAAE,KAAK,CAAC,QAAQ;gBACjC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;gBACzC,cAAc,EAAE,MAAM,CAAC,QAAQ;aAChC,CAAC,CAAC,EACH,CAAC;YACD,MAAM,IAAI,sBAAsB,EAAE,CAAC;QACrC,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,EAAE;SACtB,MAAM,CAAC,0BAA0B,CAAC;SAClC,GAAG,CAAC;QACH,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,QAAQ;QACR,SAAS;KACV,CAAC;SACD,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,0BAA0B,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,EACrD,EAAE,CAAC,0BAA0B,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,EACrD,EAAE,CAAC,0BAA0B,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CACzD,CACF;SACA,SAAS,CAAC,EAAE,OAAO,EAAE,0BAA0B,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9D,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED,KAAK,UAAU,wCAAwC,CAAC,KAIvD;IACC,MAAM,CAAC,iBAAiB,EAAE,cAAc,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC5D,cAAc,CAAC,mCAAmC,CAAC;QACnD,cAAc,CAAC,gCAAgC,CAAC;KACjD,CAAC,CAAC;IACH,IAAI,CAAC;QACH,cAAc,CAAC,iBAAiB,EAAE,aAAa,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC;QAC1E,cAAc,CAAC,cAAc,EAAE,aAAa,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC;QACpE,OAAO,CACL,yBAAyB,CAAC,iBAAiB,EAAE,KAAK,CAAC,gBAAgB,CAAC;YACpE,yBAAyB,CAAC,cAAc,CAAC,CAC1C,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,iBAAiB,CAAC,IAAI,EAAE,CAAC;QACzB,cAAc,CAAC,IAAI,EAAE,CAAC;IACxB,CAAC;AACH,CAAC;AAED,MAAM,sBAAuB,SAAQ,KAAK;IACxC;QACE,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAgB,EAChB,KAAoB;IAEpB,MAAM,eAAe,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IAC/C,MAAM,iCAAiC,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QACxE,MAAM,EAAE;aACL,MAAM,CAAC,0BAA0B,CAAC;aAClC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,0BAA0B,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,EACrD,EAAE,CAAC,0BAA0B,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CACtD,CACF,CAAC;QACJ,MAAM,EAAE;aACL,MAAM,CAAC,sBAAsB,CAAC;aAC9B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,sBAAsB,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,EACjD,EAAE,CAAC,sBAAsB,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAClD,CACF,CAAC;IACN,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { base64ToBytes } from \"@tearleads/encoding\";\nimport {\n  createDocument,\n  exportFullHistoryIdentity,\n  importSnapshot,\n  satisfiesVersionVector,\n} from \"@tearleads/loro\";\nimport { and, eq, inArray, isNull, ne, sql } from \"drizzle-orm\";\nimport type { DocumentScope } from \"./documentPersistenceTypes\";\nimport {\n  documentHistoryCheckpoints,\n  documentHistoryUpdates,\n  documentTables,\n} from \"./schema\";\nimport { getClientSQLitePersistenceRuntime } from \"./sqlitePersistenceRuntime\";\nimport { type ExecSql, ensureSqlTables } from \"./sqlSchema\";\n\n/**\n * Compaction thresholds: once the tail carries this many rows or bytes, the\n * next persist of a full-history-capable document exports a fresh checkpoint\n * and clears the tail. Small enough to keep restore replay short, large\n * enough that a full-history export (O(history)) happens once per burst of\n * edits instead of per keystroke.\n */\nexport const DOCUMENT_HISTORY_COMPACTION_MAX_ROWS = 200;\nexport const DOCUMENT_HISTORY_COMPACTION_MAX_BYTES = 512 * 1024;\n\n/**\n * Row provenance: \"local\" for updates authored on this device, \"remote\" for\n * decrypted pulled updates. Restores advance the outgoing-delta marker across\n * remote rows (already server-side); local rows never advance it.\n */\ntype DocumentHistoryUpdateOrigin = \"local\" | \"remote\";\n\n/**\n * Rows of the update log that are history tail: every row except an \"outbox\"\n * row, which only waits to be sent (see `documentHistoryUpdates`).\n */\nfunction tailInScope(scope: DocumentScope) {\n  return and(\n    eq(documentHistoryUpdates.appKind, scope.appKind),\n    eq(documentHistoryUpdates.localId, scope.localId),\n    ne(documentHistoryUpdates.origin, \"outbox\"),\n  );\n}\n\n/**\n * Tail rows compaction may fold into a checkpoint and delete: a queued row is\n * the only durable copy of an unsent update, so it waits for settlement even\n * when a checkpoint already covers its operations.\n */\nfunction compactableTailInScope(scope: DocumentScope) {\n  return and(tailInScope(scope), isNull(documentHistoryUpdates.updateId));\n}\n\ninterface DocumentHistoryTailUpdate {\n  readonly origin: DocumentHistoryUpdateOrigin;\n  readonly updateData: string;\n}\n\ninterface DocumentHistoryRestoreState {\n  readonly snapshot: string;\n  readonly tailUpdates: readonly DocumentHistoryTailUpdate[];\n}\n\nexport async function appendDocumentHistoryUpdates(\n  execSql: ExecSql,\n  scope: DocumentScope,\n  updates: readonly string[],\n  origin: DocumentHistoryUpdateOrigin,\n): Promise<void> {\n  if (updates.length === 0) {\n    return;\n  }\n  await ensureSqlTables(execSql, documentTables);\n  const createdAt = new Date().toISOString();\n  await getClientSQLitePersistenceRuntime(execSql).runMutation(async (db) => {\n    // Chunked: a catch-up pull can carry thousands of updates, and a single\n    // multi-row insert would exceed SQLite's bound-variable limit.\n    for (let index = 0; index < updates.length; index += HISTORY_ROW_CHUNK) {\n      await db.insert(documentHistoryUpdates).values(\n        updates.slice(index, index + HISTORY_ROW_CHUNK).map((updateData) => ({\n          id: crypto.randomUUID(),\n          appKind: scope.appKind,\n          localId: scope.localId,\n          updateData,\n          origin,\n          createdAt,\n        })),\n      );\n    }\n  });\n}\n\n/**\n * The checkpoint + ordered tail for a scope, or null when NEITHER exists (a\n * discovered shell that has not hydrated content yet; the caller starts the\n * document empty and the remote pull supplies the content). A tail WITHOUT a\n * checkpoint — a crash between the first enqueued edit's tail append and the\n * birth-checkpoint seed — restores as tail-only (`snapshot: \"\"`): those tail\n * rows can be the only durable copy of a local edit, so they must never be\n * silently ignored.\n */\nexport async function loadDocumentHistoryRestoreState(\n  execSql: ExecSql,\n  scope: DocumentScope,\n): Promise<DocumentHistoryRestoreState | null> {\n  await ensureSqlTables(execSql, documentTables);\n  const { db } = getClientSQLitePersistenceRuntime(execSql);\n  // Read the TAIL before the (full) checkpoint: if another pane compacts\n  // between the two reads, this order yields old-tail + new-checkpoint — a\n  // safe superset (the new checkpoint subsumes the old tail, and replay is\n  // idempotent by op identity). The reverse order could yield old-checkpoint\n  // + already-emptied tail, a torn read that silently drops the compacted\n  // ops for the whole session.\n  const tail = await db\n    .select({\n      id: documentHistoryUpdates.id,\n      origin: documentHistoryUpdates.origin,\n      updateData: documentHistoryUpdates.updateData,\n    })\n    .from(documentHistoryUpdates)\n    .where(tailInScope(scope))\n    // Insertion order: same-millisecond appends make createdAt tie and a\n    // random-uuid tiebreak would replay out of order. importUpdates tolerates\n    // out-of-order batches, but replay should still be deterministic.\n    .orderBy(sql`rowid`);\n\n  const [checkpoint] = await db\n    .select({ snapshot: documentHistoryCheckpoints.snapshot })\n    .from(documentHistoryCheckpoints)\n    .where(\n      and(\n        eq(documentHistoryCheckpoints.appKind, scope.appKind),\n        eq(documentHistoryCheckpoints.localId, scope.localId),\n      ),\n    )\n    .limit(1);\n  if (!checkpoint && tail.length === 0) {\n    return null;\n  }\n\n  return {\n    snapshot: checkpoint?.snapshot ?? \"\",\n    tailUpdates: tail.map((row) => ({\n      // Fail toward re-sending: an unrecognized origin never advances the\n      // marker, which is the recoverable direction (a redundant re-submit\n      // is idempotent; a skipped local op would be orphaned from sync).\n      origin:\n        row.origin === \"remote\" ? (\"remote\" as const) : (\"local\" as const),\n      updateData: row.updateData,\n    })),\n  };\n}\n\n/**\n * Size of the tail compaction can shrink. Queued rows are excluded: they stay\n * until settlement, so counting them would re-export full history on every\n * persist while offline edits wait to sync.\n */\nexport async function readDocumentHistoryTailSize(\n  execSql: ExecSql,\n  scope: DocumentScope,\n): Promise<{ byteLength: number; hasCheckpoint: boolean; rowCount: number }> {\n  await ensureSqlTables(execSql, documentTables);\n  const { db } = getClientSQLitePersistenceRuntime(execSql);\n  const [totals] = await db\n    .select({\n      byteLength: sql<number>`coalesce(sum(length(${documentHistoryUpdates.updateData})), 0)`,\n      rowCount: sql<number>`count(*)`,\n    })\n    .from(documentHistoryUpdates)\n    .where(compactableTailInScope(scope));\n  const [checkpoint] = await db\n    .select({ localId: documentHistoryCheckpoints.localId })\n    .from(documentHistoryCheckpoints)\n    .where(\n      and(\n        eq(documentHistoryCheckpoints.appKind, scope.appKind),\n        eq(documentHistoryCheckpoints.localId, scope.localId),\n      ),\n    )\n    .limit(1);\n  return {\n    byteLength: Number(totals?.byteLength ?? 0),\n    hasCheckpoint: checkpoint !== undefined,\n    rowCount: Number(totals?.rowCount ?? 0),\n  };\n}\n\ninterface DocumentHistoryTailEntry {\n  readonly id: string;\n  readonly updateData: string;\n}\n\n/**\n * The current compactable tail rows WITH their payloads, so a compactor can\n * prove each row's ops are covered by the snapshot it is about to install\n * (another pane's append may carry ops this pane's document has not merged\n * yet). Queued rows are never candidates.\n */\nexport async function listDocumentHistoryTailEntries(\n  execSql: ExecSql,\n  scope: DocumentScope,\n): Promise<DocumentHistoryTailEntry[]> {\n  await ensureSqlTables(execSql, documentTables);\n  const { db } = getClientSQLitePersistenceRuntime(execSql);\n  const rows = await db\n    .select({\n      id: documentHistoryUpdates.id,\n      updateData: documentHistoryUpdates.updateData,\n    })\n    .from(documentHistoryUpdates)\n    .where(compactableTailInScope(scope));\n  return rows.flatMap((row) =>\n    row.id === null ? [] : [{ id: row.id, updateData: row.updateData }],\n  );\n}\n\nconst HISTORY_ROW_CHUNK = 400;\n\n/**\n * Replace the scope's checkpoint with a fresh full-history snapshot and\n * delete ONLY the tail rows the caller captured before exporting it. Every\n * append path writes its tail row after the ops are already in the live\n * document, so any row captured before the export is provably covered by\n * the snapshot — while a row appended concurrently (between export and this\n * delete) survives for the next compaction instead of being lost.\n */\nexport async function replaceDocumentHistoryCheckpoint(\n  execSql: ExecSql,\n  scope: DocumentScope,\n  input: {\n    coveredTailIds: readonly string[];\n    endVersionVector: string;\n    /**\n     * Skip the monotonic version gate. Only for document CREATION, where any\n     * existing checkpoint under this localId is the orphan of a failed prior\n     * attempt (checkpoint written, record row never committed) — a retry's\n     * fresh document need not dominate that orphan to replace it.\n     */\n    force?: boolean;\n    snapshot: string;\n    /**\n     * Re-checked after acquiring the serialized mutation slot (like the\n     * record-save path): a store reset/recreation that happened while this\n     * call waited in the queue must abort the write, or a stale compactor\n     * could install the OLD document's checkpoint over the new identity's.\n     */\n    stillCurrent?: () => boolean;\n  },\n): Promise<boolean> {\n  await ensureSqlTables(execSql, documentTables);\n  // Sequential (non-transactional) so callers already inside a transaction\n  // can nest this. Crash between the statements leaves the new checkpoint\n  // plus covered tail rows — a safe superset, since tail replay is\n  // idempotent by op identity. The replacement itself is a compare-and-swap\n  // on the stored revision, so the version gate cannot be bypassed by a\n  // concurrent compactor between the read and the write: whoever loses the\n  // CAS re-reads and re-evaluates the gate against the winner's checkpoint.\n  return getClientSQLitePersistenceRuntime(execSql).runMutation(async (tx) => {\n    if (input.stillCurrent?.() === false) {\n      return false;\n    }\n    for (let attempt = 0; attempt < CHECKPOINT_CAS_ATTEMPTS; attempt += 1) {\n      let replaced: boolean;\n      try {\n        replaced = await tryReplaceCheckpointOnce(tx, scope, input);\n      } catch (error) {\n        if (error instanceof CheckpointGateRejected) {\n          // A fresher checkpoint dominates this candidate: no write, and\n          // the caller's covered rows must stay for the covering pane.\n          return false;\n        }\n        throw error;\n      }\n      if (!replaced) {\n        // CAS lost to a concurrent writer — re-read and re-evaluate the\n        // gate against the winner's checkpoint.\n        continue;\n      }\n      for (\n        let index = 0;\n        index < input.coveredTailIds.length;\n        index += HISTORY_ROW_CHUNK\n      ) {\n        // Never a queued row, even if a caller names one: its operations may\n        // be in the checkpoint, but it is still the unsent update itself.\n        await tx\n          .delete(documentHistoryUpdates)\n          .where(\n            and(\n              compactableTailInScope(scope),\n              inArray(\n                documentHistoryUpdates.id,\n                input.coveredTailIds.slice(index, index + HISTORY_ROW_CHUNK),\n              ),\n            ),\n          );\n      }\n      return true;\n    }\n    // Exhaustion must not read as durable success: creation and rebuild\n    // callers persist record rows assuming the checkpoint landed.\n    throw new Error(\n      \"Document history checkpoint replacement lost every CAS attempt\",\n    );\n  });\n}\n\nconst CHECKPOINT_CAS_ATTEMPTS = 16;\n\ntype MutationDb = Parameters<\n  Parameters<\n    ReturnType<typeof getClientSQLitePersistenceRuntime>[\"runMutation\"]\n  >[0]\n>[0];\n\n/**\n * One compare-and-swap attempt. Returns true when this caller's checkpoint\n * became the stored one, false when a concurrent writer won the CAS (the\n * caller re-reads and retries), and throws CheckpointGateRejected when a\n * fresher stored checkpoint dominates the candidate.\n */\nasync function tryReplaceCheckpointOnce(\n  tx: MutationDb,\n  scope: DocumentScope,\n  input: {\n    endVersionVector: string;\n    force?: boolean;\n    snapshot: string;\n  },\n): Promise<boolean> {\n  const updatedAt = new Date().toISOString();\n  const revision = crypto.randomUUID();\n  const [stored] = await tx\n    .select({\n      endVersionVector: documentHistoryCheckpoints.endVersionVector,\n      revision: documentHistoryCheckpoints.revision,\n      snapshot: documentHistoryCheckpoints.snapshot,\n    })\n    .from(documentHistoryCheckpoints)\n    .where(\n      and(\n        eq(documentHistoryCheckpoints.appKind, scope.appKind),\n        eq(documentHistoryCheckpoints.localId, scope.localId),\n      ),\n    )\n    .limit(1);\n\n  if (!stored) {\n    const inserted = await tx\n      .insert(documentHistoryCheckpoints)\n      .values({\n        appKind: scope.appKind,\n        localId: scope.localId,\n        snapshot: input.snapshot,\n        endVersionVector: input.endVersionVector,\n        revision,\n        updatedAt,\n      })\n      .onConflictDoNothing({\n        target: [\n          documentHistoryCheckpoints.appKind,\n          documentHistoryCheckpoints.localId,\n        ],\n      })\n      .returning({ localId: documentHistoryCheckpoints.localId });\n    // Conflict means a concurrent writer inserted first — retry the gate.\n    return inserted.length > 0;\n  }\n\n  // A stale compactor (a pane whose document has not merged another pane's\n  // ops) must never replace a checkpoint it does not cover: the covered\n  // pane may already have deleted its tail rows, so regressing the\n  // checkpoint would leave those ops with no durable copy at all. Vector\n  // dominance proves counter coverage; the retained-prefix identity also\n  // proves the candidate carries the exact stored operations at those\n  // counters rather than a same-frontier fork.\n  if (input.force !== true) {\n    if (\n      !satisfiesVersionVector(input.endVersionVector, stored.endVersionVector)\n    ) {\n      throw new CheckpointGateRejected();\n    }\n    if (\n      input.snapshot !== stored.snapshot &&\n      !(await candidateContainsStoredCheckpointHistory({\n        candidateSnapshot: input.snapshot,\n        storedEndVersion: stored.endVersionVector,\n        storedSnapshot: stored.snapshot,\n      }))\n    ) {\n      throw new CheckpointGateRejected();\n    }\n  }\n\n  const replaced = await tx\n    .update(documentHistoryCheckpoints)\n    .set({\n      snapshot: input.snapshot,\n      endVersionVector: input.endVersionVector,\n      revision,\n      updatedAt,\n    })\n    .where(\n      and(\n        eq(documentHistoryCheckpoints.appKind, scope.appKind),\n        eq(documentHistoryCheckpoints.localId, scope.localId),\n        eq(documentHistoryCheckpoints.revision, stored.revision),\n      ),\n    )\n    .returning({ localId: documentHistoryCheckpoints.localId });\n  return replaced.length > 0;\n}\n\nasync function candidateContainsStoredCheckpointHistory(input: {\n  candidateSnapshot: string;\n  storedEndVersion: string;\n  storedSnapshot: string;\n}): Promise<boolean> {\n  const [candidateDocument, storedDocument] = await Promise.all([\n    createDocument(\"checkpoint-candidate-history-gate\"),\n    createDocument(\"checkpoint-stored-history-gate\"),\n  ]);\n  try {\n    importSnapshot(candidateDocument, base64ToBytes(input.candidateSnapshot));\n    importSnapshot(storedDocument, base64ToBytes(input.storedSnapshot));\n    return (\n      exportFullHistoryIdentity(candidateDocument, input.storedEndVersion) ===\n      exportFullHistoryIdentity(storedDocument)\n    );\n  } finally {\n    candidateDocument.free();\n    storedDocument.free();\n  }\n}\n\nclass CheckpointGateRejected extends Error {\n  constructor() {\n    super(\"checkpoint gate rejected\");\n    this.name = \"CheckpointGateRejected\";\n  }\n}\n\nexport async function deleteDocumentHistory(\n  execSql: ExecSql,\n  scope: DocumentScope,\n): Promise<void> {\n  await ensureSqlTables(execSql, documentTables);\n  await getClientSQLitePersistenceRuntime(execSql).runMutation(async (tx) => {\n    await tx\n      .delete(documentHistoryCheckpoints)\n      .where(\n        and(\n          eq(documentHistoryCheckpoints.appKind, scope.appKind),\n          eq(documentHistoryCheckpoints.localId, scope.localId),\n        ),\n      );\n    await tx\n      .delete(documentHistoryUpdates)\n      .where(\n        and(\n          eq(documentHistoryUpdates.appKind, scope.appKind),\n          eq(documentHistoryUpdates.localId, scope.localId),\n        ),\n      );\n  });\n}\n"]}

package/data/sqlite/documentPendingUpdatePersistence.d.ts

@@ -1,14 +1,48 @@
 import type { DocumentScope, PendingUpdateFields, PendingUpdateRecord } from "./documentPersistenceTypes.js";
 import type { ClientSQLiteTransactionScope } from "./sqlitePersistenceRuntime.js";
 import type { ExecSql } from "./sqlSchema.js";
+/**
+ * Queued updates are the rows of the local update log that carry an
+ * `updateId`. A tail row (origin "local") stays in the log after settlement as
+ * history until compaction; an "outbox" row has no tail role and settlement
+ * deletes it.
+ */
+declare const OUTBOX_ORIGIN = "outbox";
+type QueueStatement = Pick<ClientSQLiteTransactionScope, "delete" | "update">;
+type QueueRead = Pick<ClientSQLiteTransactionScope, "selectDistinct">;
+/** The ids among `localIds` (one app kind) with at least one queued update. */
+export declare function listLocalIdsWithQueuedUpdates(db: QueueRead, appKind: string, localIds: readonly string[]): Promise<string[]>;
+export declare function hasQueuedDocumentUpdates(db: QueueRead, scope: DocumentScope): Promise<boolean>;
 export declare function listDocumentPendingUpdates(execSql: ExecSql, scope: DocumentScope): Promise<PendingUpdateRecord[]>;
+/** One log row for a queued update; `origin` decides its tail role. */
+export declare function queuedUpdateRow(input: {
+    createdAt: string;
+    origin: "local" | typeof OUTBOX_ORIGIN;
+    pendingUpdate: PendingUpdateFields;
+    scope: DocumentScope;
+    updateId: string;
+}): {
+    id: `${string}-${string}-${string}-${string}-${string}`;
+    appKind: string;
+    localId: string;
+    updateData: string;
+    origin: "local" | "outbox";
+    createdAt: string;
+    updateId: string;
+    partialStartVersionVector: string;
+    partialEndVersionVector: string;
+    sourceVersionVector: string | null;
+};
+/**
+ * Queue an update that has no history-tail role: container metadata (its
+ * content is its checkpoint) and full-state re-uploads after a remote reset.
+ */
 export declare function enqueueDocumentPendingUpdate(execSql: ExecSql, scope: DocumentScope, pendingUpdate: PendingUpdateFields): Promise<string>;
 /**
- * Enqueue an outgoing update AND append it to the durable-history tail in a
- * single transaction. Serialization alone is not enough: a crash between
- * separate inserts could leave the op restorable from history while missing
- * from the outgoing queue, and a null-marker restore would then classify it
- * as covered and never send it.
+ * Append a locally authored update to the history tail AND queue it, as one
+ * row in one transaction. A crash can therefore never leave the op restorable
+ * from history while missing from the outgoing queue, where a null-marker
+ * restore would classify it as covered and never send it.
  */
 export declare function enqueueDocumentPendingUpdateWithHistory(execSql: ExecSql, scope: DocumentScope, pendingUpdate: PendingUpdateFields, options?: {
     expectedDocumentId: string | null;
@@ -21,7 +55,7 @@ export declare function insertDocumentPendingUpdateWithHistoryInTransaction(inpu
     tx: ClientSQLiteTransactionScope;
 }): Promise<string>;
 /**
- * Assign a fresh id to a pending update, keeping every other column. A lost
+ * Assign a fresh id to a queued update, keeping every other column. A lost
  * sync ack leaves the server holding the update under the original id with
  * ciphertext a rebuilt submission can never reproduce (each rebuild encrypts
  * with a fresh IV), so the id is permanently poisoned: every resubmission
@@ -32,8 +66,8 @@ export declare function insertDocumentPendingUpdateWithHistoryInTransaction(inpu
  * Returns null when no row carries the id, so callers never report progress
  * for a row that lives in some other queue (or nowhere). The UPDATE's own
  * RETURNING row is the progress signal — a pre-flight SELECT would race a
- * second tab sharing the SQLite file, which can settle-delete the row between
- * the read and the write and turn "rekeyed" into a spurious re-arm.
+ * second tab sharing the SQLite file, which can settle the row between the
+ * read and the write and turn "rekeyed" into a spurious re-arm.
  *
  * The persisted per-row bound is enforced here as well: a row already at
  * MAX_PENDING_UPDATE_REKEYS is left untouched and reported as no progress.
@@ -43,7 +77,7 @@ export declare function insertDocumentPendingUpdateWithHistoryInTransaction(inpu
  */
 export declare const MAX_PENDING_UPDATE_REKEYS = 5;
 /**
- * Reset the durable re-key budget for every pending update in a scope. The
+ * Reset the durable re-key budget for every queued update in a scope. The
  * cap exists to stop a server that keeps conflicting fresh ids from driving
  * a network-speed loop — but a budget burned during an unrelated outage
  * (e.g. yesterday's stale-bundle deadlock 409ing every submit) should not be
@@ -52,5 +86,18 @@ export declare const MAX_PENDING_UPDATE_REKEYS = 5;
  */
 export declare function resetDocumentPendingUpdateRekeyBudget(execSql: ExecSql, scope: DocumentScope): Promise<void>;
 export declare function rekeyDocumentPendingUpdate(execSql: ExecSql, id: string): Promise<string | null>;
-export declare function deleteDocumentPendingUpdate(execSql: ExecSql, id: string): Promise<void>;
-export declare function deleteDocumentPendingUpdates(execSql: ExecSql, scope: DocumentScope): Promise<void>;
+/**
+ * Settle queued updates: an outbox row is deleted, and a tail row stops being
+ * queued but stays as history until compaction folds it into a checkpoint.
+ */
+export declare function settleQueuedDocumentUpdatesInTransaction(tx: QueueStatement, scope: DocumentScope, updateIds: readonly string[]): Promise<void>;
+/** Settle one queued update by id, whatever its scope. */
+export declare function settleDocumentPendingUpdate(execSql: ExecSql, id: string): Promise<void>;
+/**
+ * Stop queueing every update in the given scopes: outbox rows are dropped,
+ * and local tail rows keep their content as history (it is already in the
+ * document).
+ */
+export declare function unqueueDocumentScopesInTransaction(tx: QueueStatement, scopes: readonly DocumentScope[]): Promise<void>;
+export declare function unqueueDocumentPendingUpdates(execSql: ExecSql, scope: DocumentScope): Promise<void>;
+export {};

package/data/sqlite/documentPendingUpdatePersistence.js

@@ -1,7 +1,23 @@
-import { and, asc, eq, lt, sql } from "drizzle-orm";
-import { documentHistoryUpdates, documentPendingUpdates, documents, } from "./schema.js";
+import { and, asc, eq, inArray, isNotNull, lt, or, sql, } from "drizzle-orm";
+import { documentHistoryUpdates, documents } from "./schema.js";
 import { getClientSQLitePersistenceRuntime } from "./sqlitePersistenceRuntime.js";
+/**
+ * Queued updates are the rows of the local update log that carry an
+ * `updateId`. A tail row (origin "local") stays in the log after settlement as
+ * history until compaction; an "outbox" row has no tail role and settlement
+ * deletes it.
+ */
+const OUTBOX_ORIGIN = "outbox";
+function queuedInScope(scope) {
+    return and(eq(documentHistoryUpdates.appKind, scope.appKind), eq(documentHistoryUpdates.localId, scope.localId), isNotNull(documentHistoryUpdates.updateId));
+}
 function mapSelectedPendingUpdate(row) {
+    // A queued row always carries its submission vectors; a row without them
+    // cannot be submitted and must fail closed rather than send empty ranges.
+    if (row.partialStartVersionVector === null ||
+        row.partialEndVersionVector === null) {
+        throw new Error("Queued document update is missing its version vectors");
+    }
     return {
         id: String(row.id ?? ""),
         updateData: row.updateData,
@@ -11,50 +27,80 @@ function mapSelectedPendingUpdate(row) {
         rekeyCount: row.rekeyCount,
     };
 }
+/** The ids among `localIds` (one app kind) with at least one queued update. */
+export async function listLocalIdsWithQueuedUpdates(db, appKind, localIds) {
+    const uniqueIds = [...new Set(localIds)];
+    if (uniqueIds.length === 0)
+        return [];
+    const rows = await db
+        .selectDistinct({ localId: documentHistoryUpdates.localId })
+        .from(documentHistoryUpdates)
+        .where(and(eq(documentHistoryUpdates.appKind, appKind), inArray(documentHistoryUpdates.localId, uniqueIds), isNotNull(documentHistoryUpdates.updateId)))
+        .orderBy(asc(documentHistoryUpdates.localId));
+    return rows.map((row) => row.localId);
+}
+export async function hasQueuedDocumentUpdates(db, scope) {
+    const ids = await listLocalIdsWithQueuedUpdates(db, scope.appKind, [
+        scope.localId,
+    ]);
+    return ids.length > 0;
+}
 export async function listDocumentPendingUpdates(execSql, scope) {
     const { db } = getClientSQLitePersistenceRuntime(execSql);
     const rows = await db
         .select({
-        id: documentPendingUpdates.id,
-        updateData: documentPendingUpdates.updateData,
-        partialStartVersionVector: documentPendingUpdates.partialStartVersionVector,
-        partialEndVersionVector: documentPendingUpdates.partialEndVersionVector,
-        sourceVersionVector: documentPendingUpdates.sourceVersionVector,
-        rekeyCount: documentPendingUpdates.rekeyCount,
+        id: documentHistoryUpdates.updateId,
+        updateData: documentHistoryUpdates.updateData,
+        partialStartVersionVector: documentHistoryUpdates.partialStartVersionVector,
+        partialEndVersionVector: documentHistoryUpdates.partialEndVersionVector,
+        sourceVersionVector: documentHistoryUpdates.sourceVersionVector,
+        rekeyCount: documentHistoryUpdates.rekeyCount,
     })
-        .from(documentPendingUpdates)
-        .where(and(eq(documentPendingUpdates.appKind, scope.appKind), eq(documentPendingUpdates.localId, scope.localId)))
-        .orderBy(asc(documentPendingUpdates.createdAt), asc(sql `rowid`));
+        .from(documentHistoryUpdates)
+        .where(queuedInScope(scope))
+        .orderBy(asc(documentHistoryUpdates.createdAt), asc(sql `rowid`));
     return rows.map(mapSelectedPendingUpdate);
 }
-function pendingUpdateRow(scope, pendingUpdate, createdAt, id = crypto.randomUUID()) {
+/** One log row for a queued update; `origin` decides its tail role. */
+export function queuedUpdateRow(input) {
     return {
-        id,
-        appKind: scope.appKind,
-        localId: scope.localId,
-        updateData: pendingUpdate.updateData,
-        partialStartVersionVector: pendingUpdate.partialStartVersionVector,
-        partialEndVersionVector: pendingUpdate.partialEndVersionVector,
-        sourceVersionVector: pendingUpdate.sourceVersionVector ?? null,
-        createdAt,
+        id: crypto.randomUUID(),
+        appKind: input.scope.appKind,
+        localId: input.scope.localId,
+        updateData: input.pendingUpdate.updateData,
+        origin: input.origin,
+        createdAt: input.createdAt,
+        updateId: input.updateId,
+        partialStartVersionVector: input.pendingUpdate.partialStartVersionVector,
+        partialEndVersionVector: input.pendingUpdate.partialEndVersionVector,
+        sourceVersionVector: input.pendingUpdate.sourceVersionVector ?? null,
     };
 }
+/**
+ * Queue an update that has no history-tail role: container metadata (its
+ * content is its checkpoint) and full-state re-uploads after a remote reset.
+ */
 export async function enqueueDocumentPendingUpdate(execSql, scope, pendingUpdate) {
-    const id = crypto.randomUUID();
+    const updateId = crypto.randomUUID();
     await getClientSQLitePersistenceRuntime(execSql).runMutation(async (db) => {
         await db
-            .insert(documentPendingUpdates)
-            .values(pendingUpdateRow(scope, pendingUpdate, new Date().toISOString(), id))
+            .insert(documentHistoryUpdates)
+            .values(queuedUpdateRow({
+            createdAt: new Date().toISOString(),
+            origin: OUTBOX_ORIGIN,
+            pendingUpdate,
+            scope,
+            updateId,
+        }))
             .run();
     });
-    return id;
+    return updateId;
 }
 /**
- * Enqueue an outgoing update AND append it to the durable-history tail in a
- * single transaction. Serialization alone is not enough: a crash between
- * separate inserts could leave the op restorable from history while missing
- * from the outgoing queue, and a null-marker restore would then classify it
- * as covered and never send it.
+ * Append a locally authored update to the history tail AND queue it, as one
+ * row in one transaction. A crash can therefore never leave the op restorable
+ * from history while missing from the outgoing queue, where a null-marker
+ * restore would classify it as covered and never send it.
  */
 export async function enqueueDocumentPendingUpdateWithHistory(execSql, scope, pendingUpdate, options) {
     const createdAt = new Date().toISOString();
@@ -78,26 +124,21 @@ export async function enqueueDocumentPendingUpdateWithHistory(execSql, scope, pe
     }, { behavior: "immediate" });
 }
 export async function insertDocumentPendingUpdateWithHistoryInTransaction(input) {
-    const id = crypto.randomUUID();
+    const updateId = crypto.randomUUID();
     await input.tx
         .insert(documentHistoryUpdates)
-        .values({
-        id: crypto.randomUUID(),
-        appKind: input.scope.appKind,
-        localId: input.scope.localId,
-        updateData: input.pendingUpdate.updateData,
-        origin: "local",
+        .values(queuedUpdateRow({
         createdAt: input.createdAt,
-    })
-        .run();
-    await input.tx
-        .insert(documentPendingUpdates)
-        .values(pendingUpdateRow(input.scope, input.pendingUpdate, input.createdAt, id))
+        origin: "local",
+        pendingUpdate: input.pendingUpdate,
+        scope: input.scope,
+        updateId,
+    }))
         .run();
-    return id;
+    return updateId;
 }
 /**
- * Assign a fresh id to a pending update, keeping every other column. A lost
+ * Assign a fresh id to a queued update, keeping every other column. A lost
  * sync ack leaves the server holding the update under the original id with
  * ciphertext a rebuilt submission can never reproduce (each rebuild encrypts
  * with a fresh IV), so the id is permanently poisoned: every resubmission
@@ -108,8 +149,8 @@ export async function insertDocumentPendingUpdateWithHistoryInTransaction(input)
  * Returns null when no row carries the id, so callers never report progress
  * for a row that lives in some other queue (or nowhere). The UPDATE's own
  * RETURNING row is the progress signal — a pre-flight SELECT would race a
- * second tab sharing the SQLite file, which can settle-delete the row between
- * the read and the write and turn "rekeyed" into a spurious re-arm.
+ * second tab sharing the SQLite file, which can settle the row between the
+ * read and the write and turn "rekeyed" into a spurious re-arm.
  *
  * The persisted per-row bound is enforced here as well: a row already at
  * MAX_PENDING_UPDATE_REKEYS is left untouched and reported as no progress.
@@ -119,7 +160,7 @@ export async function insertDocumentPendingUpdateWithHistoryInTransaction(input)
  */
 export const MAX_PENDING_UPDATE_REKEYS = 5;
 /**
- * Reset the durable re-key budget for every pending update in a scope. The
+ * Reset the durable re-key budget for every queued update in a scope. The
  * cap exists to stop a server that keeps conflicting fresh ids from driving
  * a network-speed loop — but a budget burned during an unrelated outage
  * (e.g. yesterday's stale-bundle deadlock 409ing every submit) should not be
@@ -129,9 +170,9 @@ export const MAX_PENDING_UPDATE_REKEYS = 5;
 export async function resetDocumentPendingUpdateRekeyBudget(execSql, scope) {
     await getClientSQLitePersistenceRuntime(execSql).runMutation(async (db) => {
         await db
-            .update(documentPendingUpdates)
+            .update(documentHistoryUpdates)
             .set({ rekeyCount: 0 })
-            .where(and(eq(documentPendingUpdates.appKind, scope.appKind), eq(documentPendingUpdates.localId, scope.localId)));
+            .where(queuedInScope(scope));
     });
 }
 export async function rekeyDocumentPendingUpdate(execSql, id) {
@@ -139,31 +180,64 @@ export async function rekeyDocumentPendingUpdate(execSql, id) {
     let rekeyed = false;
     await getClientSQLitePersistenceRuntime(execSql).runMutation(async (db) => {
         const updated = await db
-            .update(documentPendingUpdates)
+            .update(documentHistoryUpdates)
             .set({
-            id: nextId,
-            rekeyCount: sql `${documentPendingUpdates.rekeyCount} + 1`,
+            updateId: nextId,
+            rekeyCount: sql `${documentHistoryUpdates.rekeyCount} + 1`,
         })
-            .where(and(eq(documentPendingUpdates.id, id), lt(documentPendingUpdates.rekeyCount, MAX_PENDING_UPDATE_REKEYS)))
-            .returning({ id: documentPendingUpdates.id });
+            .where(and(eq(documentHistoryUpdates.updateId, id), lt(documentHistoryUpdates.rekeyCount, MAX_PENDING_UPDATE_REKEYS)))
+            .returning({ id: documentHistoryUpdates.updateId });
         rekeyed = updated.length > 0;
     });
     return rekeyed ? nextId : null;
 }
-export async function deleteDocumentPendingUpdate(execSql, id) {
+/**
+ * Settle queued updates: an outbox row is deleted, and a tail row stops being
+ * queued but stays as history until compaction folds it into a checkpoint.
+ */
+export async function settleQueuedDocumentUpdatesInTransaction(tx, scope, updateIds) {
+    const uniqueIds = [...new Set(updateIds)];
+    if (uniqueIds.length === 0)
+        return;
+    const selected = and(eq(documentHistoryUpdates.appKind, scope.appKind), eq(documentHistoryUpdates.localId, scope.localId), inArray(documentHistoryUpdates.updateId, uniqueIds));
+    await unqueueSelectedUpdates(tx, selected);
+}
+async function unqueueSelectedUpdates(tx, selected) {
+    await tx
+        .delete(documentHistoryUpdates)
+        .where(and(selected, eq(documentHistoryUpdates.origin, OUTBOX_ORIGIN)))
+        .run();
+    await tx
+        .update(documentHistoryUpdates)
+        .set({
+        updateId: null,
+        partialStartVersionVector: null,
+        partialEndVersionVector: null,
+        sourceVersionVector: null,
+        rekeyCount: 0,
+    })
+        .where(selected)
+        .run();
+}
+/** Settle one queued update by id, whatever its scope. */
+export async function settleDocumentPendingUpdate(execSql, id) {
     await getClientSQLitePersistenceRuntime(execSql).runMutation(async (db) => {
-        await db
-            .delete(documentPendingUpdates)
-            .where(eq(documentPendingUpdates.id, id))
-            .run();
+        await unqueueSelectedUpdates(db, eq(documentHistoryUpdates.updateId, id));
     });
 }
-export async function deleteDocumentPendingUpdates(execSql, scope) {
+/**
+ * Stop queueing every update in the given scopes: outbox rows are dropped,
+ * and local tail rows keep their content as history (it is already in the
+ * document).
+ */
+export async function unqueueDocumentScopesInTransaction(tx, scopes) {
+    if (scopes.length === 0)
+        return;
+    await unqueueSelectedUpdates(tx, or(...scopes.map(queuedInScope)));
+}
+export async function unqueueDocumentPendingUpdates(execSql, scope) {
     await getClientSQLitePersistenceRuntime(execSql).runMutation(async (db) => {
-        await db
-            .delete(documentPendingUpdates)
-            .where(and(eq(documentPendingUpdates.appKind, scope.appKind), eq(documentPendingUpdates.localId, scope.localId)))
-            .run();
+        await unqueueDocumentScopesInTransaction(db, [scope]);
     });
 }
 //# sourceMappingURL=documentPendingUpdatePersistence.js.map