@ultimat3/realtime 21.0.0 → 22.1.0

package/src/pg-entity-row.ts

@@ -1,198 +1,51 @@
-// Physical Postgres row -> entity-row shaping: snake_case columns become camelCase properties,
-// and the `<p>_minor` / `<p>_currency` / `<p>_scale` columns fold into one `<p>: Money`-shaped
-// property. The inverse of the camelCasing here is `@ultimat3/entity`'s `column.ts#snake`, and
-// the fold is its `pg-row.ts#moneyOf` — neither is imported (this package declares no dependency
-// on tier 2), so both are pinned by a test instead: `pg-entity-row-parity.test.ts` reads one
-// physical row through both surfaces and asserts one object.
-
-import { describeValue } from '@ultimat3/core';
+// Physical Postgres row -> the entity row the app declared, by `@ultimat3/entity`'s own decoder.
+// The relation names the table, `entityForTable` names the entity, and `decodeRow` shapes the row
+// by each column's declared KIND — money included — exactly as a repository read does.
+//
+// It GUESSED, until 22.0.0: snake_case camelCased by string rules and any `<p>_minor`/`<p>_currency`
+// pair folded into money by name. So a nullable money column diverged from the repository shape,
+// two plain columns that happened to be called `x_minor`/`x_currency` were folded into a `Money`,
+// and a `.column()` rename arrived under its physical name. One decoder, the entity's, now.
+
+import { decodeRow, entityForTable } from '@ultimat3/entity';
 import { ReplicationProtocolError } from './errors';
-import type { PhysicalRow, PhysicalValue } from './pg-values';
-
-/** `org_id` -> `orgId`, `published_at` -> `publishedAt`. The inverse of `@ultimat3/entity`'s `snake()`. */
-export function camel(column: string): string {
-  const [head = '', ...tail] = column.split('_');
-  return head + tail.map(capitalize).join('');
-}
-
-/** A leading, trailing, or doubled underscore produces an empty part; it contributes nothing. */
-function capitalize(part: string): string {
-  return part.charAt(0).toUpperCase() + part.slice(1);
-}
-
-interface FoldedMoney {
-  readonly property: string;
-  /** The physical columns the fold consumed, in declaration order — named together on a collision. */
-  readonly columns: readonly string[];
-  readonly value: PhysicalRow;
-}
-
-/**
- * `price_minor` / `price_currency` / `price_scale` -> `price`; any other column name has no money
- * prefix. The scale column is matched here for the same reason the other two are: unmatched, it
- * survived the fold as a physical `priceScale` property beside `price`, so one row read live and
- * the same row read through a repository reported two different shapes — and the sub-cent amount
- * the scale names was delivered to every subscriber unscaled.
- */
-function moneyPrefix(column: string): string | null {
-  if (column.endsWith('_minor')) return column.slice(0, -'_minor'.length);
-  if (column.endsWith('_currency')) return column.slice(0, -'_currency'.length);
-  if (column.endsWith('_scale')) return column.slice(0, -'_scale'.length);
-  return null;
-}
-
-/**
- * `Money` is `{ minor: number; currency: string }` everywhere in the framework, so `minor` is
- * normalised here rather than passed through: `pgoutput` decodes an int8 as text once it leaves
- * `Number.isSafeInteger` range and a numeric as text always, which would otherwise make one column
- * a number on one row and a string on the next. A value no JS number holds exactly is not money
- * this pipeline can carry, and saying so is better than shipping a `minor` the contract forbids.
- */
-function moneyMinor(column: string, value: number | string): number {
-  const minor =
-    typeof value === 'number' ? value : /^-?\d+$/.test(value) ? Number(value) : Number.NaN;
-  if (Number.isSafeInteger(minor)) return minor;
-  throw new ReplicationProtocolError({
-    stage: 'value',
-    detail: `column "${column}" carries ${shownNumber(value)}, which is not a whole number of minor units`,
-    fix: `store ${column} as a bigint inside ±2^53 — Money.minor is a number, never a float or a bigint`,
-  });
-}
-
-/**
- * `MoneyValue.scale` is a whole, non-negative count of decimal places, so that — and only that —
- * is what this decoder refuses: a fractional or negative scale is not a value the shape can carry
- * at all, exactly as an out-of-range `minor` is not.
- *
- * The `0…MAX_MONEY_SCALE` CEILING is `@ultimat3/schema`'s and is deliberately not restated here:
- * it is enforced at both ends of this column already — the CHECK `@ultimat3/entity`'s
- * `describeColumn` emits on `<p>_scale`, and `parseScale` on the repository read — and this
- * package declares no `@ultimat3/schema` dependency, so a copy of the bound here would be a
- * second declaration that can drift from the one that decides.
- *
- * `/^\d+$/` and not `Number(value)`: `Number('')` is 0, and 0 means whole units — the one value
- * an empty column must never decode to. The same guard `parseScale` uses.
- */
-function moneyScale(column: string, value: PhysicalValue): number {
-  const digits = typeof value === 'string' && /^\d+$/.test(value);
-  const scale = typeof value === 'number' ? value : digits ? Number(value) : Number.NaN;
-  if (Number.isSafeInteger(scale) && scale >= 0) return scale;
-  throw new ReplicationProtocolError({
-    stage: 'value',
-    detail: `column "${column}" carries ${shownNumber(value)}, which is not a whole number of decimal places`,
-    fix: `store ${column} as a non-negative integer, or null for the currency's own minor unit`,
-  });
-}
+import type { PhysicalRow } from './pg-values';
+import type { PgRelation } from './pgoutput';
 
 /**
- * **Paired with `parseMinor` in `@ultimat3/entity`'s `columns.ts`, and the pairing is the rule
- * rather than the spelling: an amount may be echoed when it is *provably numeric*, and this file
- * has to prove it at run time because entity proves it from the branch.**
- *
- * Entity reaches its echo only on a value already narrowed to a finite non-integer `number`, a
- * `bigint`, or a `/^-?\d+$/` string. Here the value came off the WAL, and a `<p>_minor` pair is
- * matched by column *name*: any `text` column called `note_minor` beside `note_currency` routes
- * arbitrary user content through this throw. `"${value}"` on that path is the leak
- * `describeValue` exists for — the message is built before any field-level redaction can see it,
- * and it reaches the log store and the operator alike.
- *
- * So the amount survives when its content is a number (a float, an out-of-range integer, or a
- * string that *is* one), and everything else is reported as shape. The scale column is matched by
- * name the same way and carries the same risk, so it renders through here too.
+ * A key-only `before` image — any replica identity but FULL — carries NULL for every column that is
+ * not part of the key. Those NULLs are not the row's values, and handed to the decoder a not-null
+ * column would read as a table that no longer matches its entity. They are dropped, so the image
+ * decodes as what it is: the key, and nothing claimed about the rest.
  */
-function shownNumber(value: PhysicalValue): string {
-  if (typeof value === 'number') return `"${value}"`;
-  if (typeof value !== 'string') return describeValue(value);
-  const numeric = value.trim() !== '' && Number.isFinite(Number(value));
-  return numeric ? `"${value}"` : describeValue(value);
-}
-
-/**
- * `name` is part of a `<p>_minor` / `<p>_currency` (/ `<p>_scale`) group, or null if it is not.
- * The first two must be present *and* typed like money — a null currency (an unset money value) is
- * not "half a pair", it simply is not a pair, so every column falls through as an ordinary value.
- *
- * The scale column is the one member that may be absent or NULL, and both mean the same thing:
- * "the currency's own minor unit". Neither produces a `scale` key, because `undefined` and `0` are
- * different values — `0` claims whole units, a 100x reinterpretation of an ordinary price — which
- * is exactly the rule `moneyOf` follows on the repository side. What it may NOT do is survive as a
- * column of its own: the fold consumes it whenever the group folds.
- */
-function foldMoney(
-  physical: Readonly<Record<string, PhysicalValue>>,
-  name: string,
-): FoldedMoney | null {
-  const prefix = moneyPrefix(name);
-  if (prefix === null) return null;
-
-  const minorKey = `${prefix}_minor`;
-  const currencyKey = `${prefix}_currency`;
-  if (!Object.hasOwn(physical, minorKey) || !Object.hasOwn(physical, currencyKey)) return null;
-
-  const minor = physical[minorKey];
-  const currency = physical[currencyKey];
-  if (!(typeof minor === 'number' || typeof minor === 'string') || typeof currency !== 'string') {
-    return null;
+function replicatedOnly(relation: PgRelation, physical: PhysicalRow): PhysicalRow {
+  if (relation.replicaIdentity === 'f') return physical;
+  const keys = new Set(relation.columns.filter((column) => column.key).map((c) => c.name));
+  const kept: PhysicalRow = {};
+  for (const [name, value] of Object.entries(physical)) {
+    if (value !== null || keys.has(name)) kept[name] = value;
   }
-
-  const scaleKey = `${prefix}_scale`;
-  const scale = Object.hasOwn(physical, scaleKey) ? physical[scaleKey] : undefined;
-  return {
-    property: camel(prefix),
-    columns: scale === undefined ? [minorKey, currencyKey] : [minorKey, currencyKey, scaleKey],
-    value: {
-      minor: moneyMinor(minorKey, minor),
-      currency,
-      ...(scale === undefined || scale === null ? {} : { scale: moneyScale(scaleKey, scale) }),
-    },
-  };
+  return kept;
 }
 
 /**
- * `camel()` is not injective — `a_b` and `a__b` both give `aB`, `x` and `x_` both give `x` — and
- * `entityRow` writes by assignment, so without this the second column would silently overwrite the
- * first and the row would be short one value with nothing to read about it.
+ * The entity row for one replicated tuple. A relation with no registered entity is refused: the
+ * stream only selects tables `replicatedRelations()` named from the entity registry, so one that
+ * arrives unregistered is a process that never loaded the app's entities.
  */
-function claim(taken: Map<string, string>, property: string, column: string): void {
-  const first = taken.get(property);
-  if (first !== undefined) {
+export function entityRow(
+  relation: PgRelation,
+  physical: PhysicalRow,
+  image: 'before' | 'after',
+): PhysicalRow {
+  const entity = entityForTable(relation.name);
+  if (entity === undefined) {
     throw new ReplicationProtocolError({
       stage: 'value',
-      detail: `columns "${first}" and "${column}" both map to the entity property "${property}"`,
-      fix: `rename one of them — two columns cannot share one property once camelCased`,
+      detail: `table "${relation.name}" has no registered entity, so its rows cannot be decoded`,
+      fix: 'load the app before starting the replicator — runRole({ root, env }) does — or drop the table from the entity list',
     });
   }
-  taken.set(property, column);
-}
-
-/**
- * A physical postgres row -> the row shape the rest of the pipeline is written against.
- * Two things are not one-to-one and both live here: the column is snake_case while the entity
- * property is camelCase, and money is one property over the columns `<p>_minor`/`<p>_currency`
- * and the nullable `<p>_scale`.
- */
-export function entityRow(physical: Readonly<Record<string, PhysicalValue>>): PhysicalRow {
-  const row: PhysicalRow = {};
-  // Column order in is key order out; a folded money property lands wherever its earliest member
-  // (whichever of the three the source happened to emit first) would otherwise have sat.
-  const consumed = new Set<string>();
-  // Which column produced each property, so a collision names both sides rather than losing one.
-  const taken = new Map<string, string>();
-
-  for (const name of Object.keys(physical)) {
-    if (consumed.has(name)) continue;
-
-    const money = foldMoney(physical, name);
-    if (money !== null) {
-      claim(taken, money.property, money.columns.join('/'));
-      row[money.property] = money.value;
-      for (const column of money.columns) consumed.add(column);
-      continue;
-    }
-
-    const property = camel(name);
-    claim(taken, property, name);
-    row[property] = physical[name] ?? null;
-  }
-  return row;
+  const source = image === 'before' ? replicatedOnly(relation, physical) : physical;
+  return decodeRow(entity, source) as PhysicalRow;
 }

package/src/pg-identifier.ts

@@ -0,0 +1,23 @@
+// Single responsibility: the identifier charset every replication statement interpolates through.
+// Its own module because the preflight and the publication both assert through it, and either
+// importing the other for it would close a cycle.
+
+import { ReplicationFailedError } from './errors';
+
+/** Identifiers reach a simple query unparameterised, so the charset is the injection boundary. */
+const IDENTIFIER = /^[a-z_][a-z0-9_]*$/;
+
+/**
+ * The one gate between a caller-supplied name and a simple query. `PgReplicationStream` checks its
+ * slot, publication and entity names in its CONSTRUCTOR — a mistyped `REPLICATION_SLOT` is a
+ * boot-time fact, and finding it at the first WAL read means a replicator that reported itself
+ * started and then never delivered a change.
+ */
+export const assertIdentifier = (kind: string, value: string): string => {
+  if (IDENTIFIER.test(value)) return value;
+  throw new ReplicationFailedError({
+    stage: 'preflight',
+    detail: `${kind} "${value}" is not a lower-case postgres identifier`,
+    fix: `rename the ${kind} to match [a-z_][a-z0-9_]* — it is interpolated into a replication command`,
+  });
+};

package/src/pg-preflight.ts

@@ -1,35 +1,20 @@
-// Single responsibility: the four questions asked of a database BEFORE `START_REPLICATION`, and
-// the identifier charset every one of them interpolates through. Three refuse the boot with the
-// exact statement that fixes them; the fourth warns, because refusing it would stop every app on
-// the default replica identity from starting.
+// Single responsibility: the four questions asked of a database BEFORE `START_REPLICATION`. Two
+// refuse the boot with the exact statement that fixes them, one — the publication — is answered by
+// ensuring it (`pg-publication.ts`), and the fourth warns, because refusing it would stop every app
+// on the default replica identity from starting.
 
 import { logger } from '@ultimat3/core';
 import { ReplicaIdentityError, ReplicationFailedError } from './errors';
 import type { PgConnection } from './pg-connection';
-
-/** Identifiers reach a simple query unparameterised, so the charset is the injection boundary. */
-const IDENTIFIER = /^[a-z_][a-z0-9_]*$/;
+import { assertIdentifier } from './pg-identifier';
+import { ensurePublication } from './pg-publication';
 
 /**
- * The one gate between a caller-supplied name and a simple query. Exported because
- * `PgReplicationStream` checks its slot, publication and entity names in its CONSTRUCTOR — a
- * mistyped `REPLICATION_SLOT` is a boot-time fact, and finding it at the first WAL read means a
- * replicator that reported itself started and then never delivered a change.
- */
-export const assertIdentifier = (kind: string, value: string): string => {
-  if (IDENTIFIER.test(value)) return value;
-  throw new ReplicationFailedError({
-    stage: 'preflight',
-    detail: `${kind} "${value}" is not a lower-case postgres identifier`,
-    fix: `rename the ${kind} to match [a-z_][a-z0-9_]* — it is interpolated into a replication command`,
-  });
-};
-
-/**
- * The four things that are always misconfigured. Three produce an unreadable server message if
- * left to the server, so each gets its own `fix:` line; the fourth is `warnPartialIdentity` and
- * only warns. `slot` and `publication` are interpolated into simple queries, so the `IDENTIFIER`
- * charset is the injection boundary; re-asserted here rather than trusted, so the guarantee
+ * The four things that are always misconfigured. `wal_level` and the slot produce an unreadable
+ * server message if left to the server, so each gets its own `fix:` line; the publication is
+ * created or extended here, and refused with its statement only when this role may not; the
+ * fourth is `warnPartialIdentity` and only warns. `slot` and `publication` are interpolated into
+ * simple queries, so the identifier charset is the injection boundary; re-asserted here rather than trusted, so the guarantee
  * travels with the function instead of living only in `start()`.
  */
 export async function preflight(
@@ -45,19 +30,12 @@ export async function preflight(
     throw new ReplicationFailedError({
       stage: 'preflight',
       detail: `wal_level is "${walLevel?.[0] ?? 'unknown'}", so the server writes no logical WAL`,
-      fix: "ALTER SYSTEM SET wal_level = 'logical'; -- then restart postgres",
-    });
-  }
-  const publications = await connection.query(
-    `SELECT 1 FROM pg_publication WHERE pubname = '${publication}'`,
-  );
-  if (publications.length === 0) {
-    throw new ReplicationFailedError({
-      stage: 'preflight',
-      detail: `no publication named "${publication}" exists`,
-      fix: `CREATE PUBLICATION ${publication} FOR ALL TABLES;`,
+      // Not `ALTER SYSTEM`: managed and operator-run Postgres refuse it, and the setting lives in
+      // the provider's configuration. The setting, where it goes, and that it needs a restart.
+      fix: "set wal_level=logical in the server configuration — postgresql.conf, your managed provider's database flags, or `postgres -c wal_level=logical` on a container — then restart postgres",
     });
   }
+  await ensurePublication(connection, publication, entities);
   await warnPartialIdentity(connection, entities);
   const [existing] = await connection.query(
     `SELECT plugin FROM pg_replication_slots WHERE slot_name = '${slot}'`,
@@ -78,15 +56,16 @@ export async function preflight(
 }
 
 /**
- * The fourth preflight question, and the one that does NOT refuse. A live query decides whether a
- * row left its result set from `change.before`, and under any replica identity but FULL that tuple
- * is the key columns alone — which `toRow` accepts, since it only requires a text `id`.
+ * The fourth preflight question, and the one that does NOT refuse: which entity tables have NO
+ * replica identity. Once such a table is in the publication, Postgres refuses its UPDATE and
+ * DELETE outright, and a change could not be keyed if it did not. A table with a primary key is
+ * not named: under DEFAULT a delete carries its key, and a live query decides against the whole
+ * row its shared window holds, never against `change.before` alone.
  *
  * It runs BEFORE `pg_create_logical_replication_slot`: a slot decodes with the identity the
  * catalog held when the rows were written, so asking after the slot exists answers about a stream
- * nobody is reading yet. It WARNS rather than throws because every app on the default identity
- * would otherwise stop booting, and a replicator that will not start is worse than the partial
- * rows it is complaining about — `ReplicationStreamStats.partialBefore` is the running half.
+ * nobody is reading yet. It WARNS rather than throws, as it always has — a replicator that will
+ * not start is worse than the tables it is naming.
  *
  * Entity names are the ones the constructor already put through `assertIdentifier`, which is what
  * makes both the interpolation and the `fix:` safe; a name postgres answers with that is not in
@@ -98,9 +77,17 @@ async function warnPartialIdentity(
 ): Promise<void> {
   if (entities.size === 0) return;
   const names = [...entities].map((name) => `'${name}'`).join(', ');
+  // NO identity, not "not FULL": `n` (NOTHING), `d` (DEFAULT) with no primary key, or `i` whose
+  // index is gone.
+  // A keyed table replicates correctly under DEFAULT — a delete names its key, and the shared
+  // window holds the whole row a live query decides on — so naming it was noise on every boot.
   const rows = await connection.query(
-    `SELECT relname FROM pg_class WHERE relkind = 'r' AND relreplident <> 'f' ` +
-      `AND relname IN (${names})`,
+    `SELECT c.relname FROM pg_class c WHERE c.relkind = 'r' AND c.relname IN (${names}) ` +
+      `AND (c.relreplident = 'n' OR (c.relreplident = 'd' AND NOT EXISTS ` +
+      `(SELECT 1 FROM pg_index i WHERE i.indrelid = c.oid AND i.indisprimary)) ` +
+      // USING INDEX whose index was dropped: `relreplident` stays 'i' and it behaves as NOTHING.
+      `OR (c.relreplident = 'i' AND NOT EXISTS ` +
+      `(SELECT 1 FROM pg_index i WHERE i.indrelid = c.oid AND i.indisreplident)))`,
   );
   const tables = [
     ...new Set(

package/src/pg-publication.ts

@@ -0,0 +1,95 @@
+// Single responsibility: the replicator's publication, ensured at boot — created FOR every entity
+// table when missing, extended by the entity tables it lacks when present, never shrunk. The one
+// way an app gets it: a migration is `x db gen`'s, and `FOR ALL TABLES` needs a superuser.
+
+import { logger, stringField } from '@ultimat3/core';
+import { ReplicationFailedError } from './errors';
+import type { PgConnection } from './pg-connection';
+import { assertIdentifier } from './pg-identifier';
+import { REPLICATION_GRANT_WARNING } from './pg-wire';
+
+/** What `ensurePublication` did — `added` is sorted, and empty when the publication was complete. */
+export interface PublicationOutcome {
+  readonly created: boolean;
+  readonly added: readonly string[];
+}
+
+/**
+ * Ensures `publication` carries every table in `entities`.
+ *
+ * `FOR TABLE`, because a table's OWNER may publish it without a superuser — and the app role that
+ * ran the migrations owns every entity table. Membership is read through `pg_publication_tables`,
+ * which also expands `FOR ALL TABLES` and `FOR TABLES IN SCHEMA`, so an operator's broader
+ * publication is recognised as complete rather than ALTERed into an error. Cast through `regclass`
+ * so a table on the search path compares by the bare name the entity list uses.
+ *
+ * Never `DROP TABLE` from it: a table the operator added is theirs. A statement the role may not
+ * run is refused with the exact statement to run as a role that may — the refusal preflight always
+ * raised, now reached only when the boot could not fix it itself.
+ */
+export async function ensurePublication(
+  connection: Pick<PgConnection, 'query'>,
+  publication: string,
+  entities: ReadonlySet<string>,
+): Promise<PublicationOutcome> {
+  assertIdentifier('publication', publication);
+  const tables = [...entities].map((name) => assertIdentifier('entity', name)).sort();
+  const exists = await connection.query(
+    `SELECT 1 FROM pg_publication WHERE pubname = '${publication}'`,
+  );
+  if (exists.length === 0) {
+    const create = `CREATE PUBLICATION ${publication} FOR TABLE ${tables.join(', ')}`;
+    await attempt(connection, create, `no publication named "${publication}" exists`);
+    logger.info('realtime.publication.created', { publication, tables });
+    return { created: true, added: tables };
+  }
+  const members = await connection.query(
+    `SELECT (quote_ident(schemaname) || '.' || quote_ident(tablename))::regclass::text ` +
+      `FROM pg_publication_tables WHERE pubname = '${publication}'`,
+  );
+  const present = new Set(members.map((row) => row[0]));
+  const missing = tables.filter((name) => !present.has(name));
+  if (missing.length === 0) return { created: false, added: [] };
+  const alter = `ALTER PUBLICATION ${publication} ADD TABLE ${missing.join(', ')}`;
+  await attempt(connection, alter, `publication "${publication}" lacks ${missing.join(', ')}`);
+  logger.info('realtime.publication.extended', { publication, tables: missing });
+  return { created: false, added: missing };
+}
+
+/**
+ * Runs `statement`, or refuses with it. Only a server's ErrorResponse is this function's to
+ * explain — a dead socket is not a privilege question, so anything else propagates unchanged.
+ */
+async function attempt(
+  connection: Pick<PgConnection, 'query'>,
+  statement: string,
+  why: string,
+): Promise<void> {
+  try {
+    await connection.query(statement);
+  } catch (error) {
+    if (!(error instanceof ReplicationFailedError)) throw error;
+    const server = stringField(error, 'cause') ?? 'the server refused it';
+    const [role] = await connection.query('SELECT current_user');
+    throw new ReplicationFailedError({
+      stage: 'preflight',
+      detail: `${why}, and this role could not ${statement.split(' ')[0]?.toLowerCase()} it: ${server}`,
+      fix: statementFix(statement, role?.[0]),
+    });
+  }
+}
+
+/**
+ * The statement to run as a role that owns the tables, plus the `REPLICATION` role attribute
+ * streaming needs — which no fix line named until one did. Every name in `statement` already
+ * passed `assertIdentifier`; the role is quoted, because a role name is whatever the operator chose.
+ */
+function statementFix(statement: string, role: string | null | undefined): string {
+  const who =
+    typeof role === 'string' && role !== '' ? `"${role.replaceAll('"', '""')}"` : 'CURRENT_USER';
+  return (
+    `${statement}; -- as a role that owns those tables and holds CREATE on the database, then restart the replicator. ` +
+    `And, if the role cannot stream yet: ALTER ROLE ${who} WITH REPLICATION; -- ` +
+    REPLICATION_GRANT_WARNING
+  );
+}

package/src/pg-replication.ts

@@ -10,7 +10,8 @@ import { isRow, type Row } from './json';
 import { ByteReader, ByteWriter, epochMsToPgTimestamp, printLsn } from './pg-bytes';
 import { PgConnection } from './pg-connection';
 import { entityRow } from './pg-entity-row';
-import { assertIdentifier, preflight } from './pg-preflight';
+import { assertIdentifier } from './pg-identifier';
+import { preflight } from './pg-preflight';
 import { bunPgStream, parsePgUrl } from './pg-socket';
 import type { PhysicalRow } from './pg-values';
 import { keyedWrite, PgOutputDecoder, type PgOutputMessage, type PgRelation } from './pgoutput';
@@ -337,8 +338,15 @@ export class PgReplicationStream {
       case 'delete':
         await this.#deliver('delete', message.relation, message.before, null, handlers);
         return;
+      case 'truncate':
+        // One change per truncated relation, rowless. It was decoded and DROPPED here, and with the
+        // recommended `FOR ALL TABLES` publication every window and every client kept the rows.
+        for (const relation of message.relations) {
+          await this.#deliver('truncate', relation, null, null, handlers);
+        }
+        return;
       default:
-        // Relation, truncate, origin, type, logical message: nothing the matcher can act on.
+        // Relation, origin, type, logical message: nothing the matcher can act on.
         return;
     }
   }
@@ -375,9 +383,11 @@ export class PgReplicationStream {
     // Read off the Relation message rather than off the tuple: a DEFAULT-identity table whose
     // non-key columns happen to be NULL sends the same bytes a FULL one does, so counting missing
     // keys would undercount exactly the rows a policy is most likely to misjudge.
-    if (op !== 'insert' && relation.replicaIdentity !== 'f') this.#partialBefore += 1;
-    const before = toRow(relation, oldTuple);
-    const after = toRow(relation, newTuple);
+    if ((op === 'update' || op === 'delete') && relation.replicaIdentity !== 'f') {
+      this.#partialBefore += 1;
+    }
+    const before = toRow(relation, oldTuple, 'before');
+    const after = toRow(relation, newTuple, 'after');
     const event: ChangeEvent = {
       entity: relation.name,
       op,
@@ -462,9 +472,13 @@ export class PgReplicationStream {
 }
 
 /** A physical tuple becomes the row the matcher's predicates are written against, or nothing. */
-function toRow(relation: PgRelation, physical: PhysicalRow | null): Row | null {
+function toRow(
+  relation: PgRelation,
+  physical: PhysicalRow | null,
+  image: 'before' | 'after',
+): Row | null {
   if (physical === null) return null;
-  const row = entityRow(physical);
+  const row = entityRow(relation, physical, image);
   // A bigserial id decodes as a number inside `Number.isSafeInteger` range and as text outside it,
   // so the same table would otherwise identify small rows by number and large ones by string.
   // `Row.id`, `RowPatch.id` and every cursor are text: the identity is normalised once, here.