@voltro/plugin-cdc-out 0.32.0 → 0.34.0

package/dist/index.js

@@ -1,6 +1,7 @@
 import { Duration as e, Effect as t, Fiber as n, Schedule as r, Schema as i } from "effect";
-import { definePlugin as a } from "@voltro/protocol";
-import { and as o, count as s, eq as c, generateId as l, id as u, inSet as d, integer as f, json as p, lt as m, registerRetention as h, retentionTtlMsFromEnv as g, table as _, text as v, timestamp as y } from "@voltro/database";
+import { definePlugin as a, pluginInstanceName as o } from "@voltro/protocol";
+import { and as s, count as c, eq as l, generateId as u, id as d, inSet as f, integer as p, json as m, lt as h, registerRetention as ee, retentionTtlMsFromEnv as te, table as g, text as _, timestamp as v } from "@voltro/database";
+import { createHash as y } from "node:crypto";
 //#region src/errors.ts
 var b = class extends i.TaggedError()("CdcConfigError", { message: i.String }) {}, x = class extends i.TaggedError()("CdcDeliveryError", {
 	sink: i.String,
@@ -9,31 +10,40 @@ var b = class extends i.TaggedError()("CdcConfigError", { message: i.String }) {
 	get message() {
 		return `cdc-out delivery to '${this.sink}' failed: ${this.reason}`;
 	}
-}, S = "_voltro_cdcout_outbox", C = "_voltro_cdcout_leases", w = {
+}, S = "_voltro_cdcout_outbox", C = "_voltro_cdcout_leases", w = "_voltro_cdcout_claims", T = {
 	kind: "typeid",
 	prefix: "cdcout"
-}, T = () => l(w, S), E = _(S, {
-	id: u({ prefix: "cdcout" }),
-	pipe: v(),
-	sourceTable: v(),
-	op: v(),
-	key: v(),
-	payload: p().nullable(),
-	status: v(),
-	attempts: f().default(0),
-	nextAttemptAt: y(),
-	claimedBy: v().nullable(),
-	claimedAt: y().nullable(),
-	createdAt: y(),
-	deliveredAt: y().nullable(),
-	lastError: v().nullable()
-}).index(["pipe", "status"]), D = _(C, {
-	id: u({ scheme: "numeric" }),
-	key: v(),
-	holder: v(),
-	expiresAt: y(),
-	renewedAt: y()
-}).unique("cdcoutLeaseKey", ["key"]), O = (e) => e instanceof Date ? e.getTime() : new Date(String(e)).getTime(), k = class {
+}, E = {
+	kind: "typeid",
+	prefix: "cdcoutclaim"
+}, D = () => u(T, S), ne = () => u(E, w), O = g(S, {
+	id: d({ prefix: "cdcout" }),
+	pipe: _(),
+	sourceTable: _(),
+	op: _(),
+	key: _(),
+	payload: m().nullable(),
+	status: _(),
+	attempts: p().default(0),
+	nextAttemptAt: v(),
+	claimedBy: _().nullable(),
+	claimedAt: v().nullable(),
+	createdAt: v(),
+	deliveredAt: v().nullable(),
+	lastError: _().nullable()
+}).index(["pipe", "status"]), k = g(w, {
+	id: d({ prefix: "cdcoutclaim" }),
+	pipe: _(),
+	changeKey: _(),
+	claimedBy: _(),
+	seenAt: v()
+}).unique("cdcoutClaimKey", ["pipe", "changeKey"]).index(["seenAt"]), re = g(C, {
+	id: d({ scheme: "numeric" }),
+	key: _(),
+	holder: _(),
+	expiresAt: v(),
+	renewedAt: v()
+}).unique("cdcoutLeaseKey", ["key"]), A = (e) => e instanceof Date ? e.getTime() : new Date(String(e)).getTime(), j = class {
 	opts;
 	held = !1;
 	constructor(e) {
@@ -49,13 +59,13 @@ var b = class extends i.TaggedError()("CdcConfigError", { message: i.String }) {
 			renewedAt: new Date(t)
 		};
 		try {
-			if (await e.updateMany("_voltro_cdcout_leases", n, { where: o(c("key", this.opts.key), c("holder", this.opts.holder)) }) === 1) return this.held = !0, !0;
+			if (await e.updateMany("_voltro_cdcout_leases", n, { where: s(l("key", this.opts.key), l("holder", this.opts.holder)) }) === 1) return this.held = !0, !0;
 			let r = await e.insertIgnore(C, {
 				key: this.opts.key,
 				...n
 			}, { conflictColumns: ["key"] });
 			if (r.holder === this.opts.holder) return this.held = !0, !0;
-			let i = await e.updateMany(C, n, { where: o(c("key", this.opts.key), c("holder", String(r.holder)), m("expiresAt", new Date(t))) });
+			let i = await e.updateMany(C, n, { where: s(l("key", this.opts.key), l("holder", String(r.holder)), h("expiresAt", new Date(t))) });
 			return this.held = i === 1, this.held;
 		} catch {
 			return this.held = !1, !1;
@@ -64,10 +74,100 @@ var b = class extends i.TaggedError()("CdcConfigError", { message: i.String }) {
 	async release(e) {
 		this.held = !1;
 		try {
-			await e.updateMany(C, { expiresAt: /* @__PURE__ */ new Date(0) }, { where: o(c("key", this.opts.key), c("holder", this.opts.holder)) });
+			await e.updateMany(C, { expiresAt: /* @__PURE__ */ new Date(0) }, { where: s(l("key", this.opts.key), l("holder", this.opts.holder)) });
 		} catch {}
 	}
-}, A = (n, r, i) => t.suspend(() => {
+}, M = (e) => e == null ? "null" : e instanceof Date ? JSON.stringify(e.toISOString()) : typeof e == "bigint" ? JSON.stringify(e.toString()) : Array.isArray(e) ? `[${e.map(M).join(",")}]` : typeof e == "object" ? `{${Object.entries(e).filter(([, e]) => e !== void 0).sort(([e], [t]) => e < t ? -1 : +(e > t)).map(([e, t]) => `${JSON.stringify(e)}:${M(t)}`).join(",")}}` : JSON.stringify(e) ?? "null", N = (e) => y("sha256").update([
+	e.pipe,
+	e.op,
+	e.key,
+	M(e.next),
+	M(e.prev)
+].join("\0")).digest("hex").slice(0, 32), P = (e, t) => `${e}:${t}`, F = (e) => {
+	let t = e.lastIndexOf(":");
+	if (t <= 0) return null;
+	let n = Number(e.slice(t + 1));
+	return !Number.isInteger(n) || n < 0 ? null : {
+		digest: e.slice(0, t),
+		occurrence: n
+	};
+}, ie = class {
+	#e = /* @__PURE__ */ new Map();
+	#t;
+	#n;
+	constructor(e) {
+		this.#t = e.windowMs, this.#n = Math.max(1, e.maxEntries);
+	}
+	get size() {
+		return this.#e.size;
+	}
+	next(e, t) {
+		let n = this.#e.get(e);
+		if (n === void 0) return this.#e.set(e, {
+			count: 1,
+			lastMs: t
+		}), this.#r(), 0;
+		n.lastMs = t;
+		let r = n.count;
+		return n.count += 1, this.#e.delete(e), this.#e.set(e, n), r;
+	}
+	seedFromChangeKeys(e, t) {
+		for (let n of e) {
+			let e = F(n);
+			if (e === null) continue;
+			let r = this.#e.get(e.digest), i = Math.max(r?.count ?? 0, e.occurrence + 1);
+			this.#e.set(e.digest, {
+				count: i,
+				lastMs: r?.lastMs ?? t
+			});
+		}
+		this.#r();
+	}
+	prune(e) {
+		let t = e - this.#t;
+		for (let [e, n] of this.#e) n.lastMs < t && this.#e.delete(e);
+	}
+	#r() {
+		for (; this.#e.size > this.#n;) {
+			let e = this.#e.keys().next();
+			if (e.done === !0) return;
+			this.#e.delete(e.value);
+		}
+	}
+}, ae = class {
+	#e = [];
+	#t = 0;
+	#n;
+	#r;
+	#i = 0;
+	constructor(e) {
+		this.#n = e.windowMs, this.#r = Math.max(1, e.maxEntries);
+	}
+	get size() {
+		return this.#e.length;
+	}
+	get droppedPending() {
+		return this.#i;
+	}
+	append(e) {
+		for (this.#e.push(e); this.#e.length > this.#r;) {
+			let e = this.#e.shift();
+			e !== void 0 && !e.enqueued && (this.#i += 1), this.#t > 0 && --this.#t;
+		}
+	}
+	nextPending() {
+		for (; this.#t < this.#e.length && this.#e[this.#t].enqueued;) this.#t += 1;
+		return this.#e[this.#t];
+	}
+	pendingCount() {
+		return this.#e.reduce((e, t) => t.enqueued ? e : e + 1, 0);
+	}
+	prune(e) {
+		let t = e - this.#n, n = [], r = 0;
+		for (let [e, i] of this.#e.entries()) i.observedAtMs >= t ? (e < this.#t && (r += 1), n.push(i)) : i.enqueued || (this.#i += 1);
+		this.#e = n, this.#t = r;
+	}
+}, I = (n, r, i) => t.suspend(() => {
 	let a = new AbortController();
 	return t.try(() => n.deliver(r, { signal: a.signal })).pipe(t.flatMap((e) => t.isEffect(e) ? e : t.tryPromise(() => e))).pipe(t.timeoutFail({
 		duration: e.millis(i.timeoutMs),
@@ -75,21 +175,21 @@ var b = class extends i.TaggedError()("CdcConfigError", { message: i.String }) {
 			sink: n.name,
 			reason: `delivery timed out after ${i.timeoutMs}ms`
 		})
-	}), t.onError(() => t.sync(() => a.abort())), t.mapError((e) => e instanceof x ? e : j(n.name, e)), t.withSpan("cdcOut.deliver", { attributes: {
+	}), t.onError(() => t.sync(() => a.abort())), t.mapError((e) => e instanceof x ? e : L(n.name, e)), t.withSpan("cdcOut.deliver", { attributes: {
 		pipe: i.pipe,
 		sink: n.name,
 		records: r.length
 	} }));
-}), j = (e, t) => {
+}), L = (e, t) => {
 	let n = typeof t == "object" && t && "error" in t ? t.error : t;
 	return new x({
 		sink: e,
 		reason: n instanceof Error ? n.message : String(n)
 	});
-}, M = (e, t) => {
+}, R = (e, t) => {
 	let n = Math.min(t.baseMs * 2 ** Math.max(0, e - 1), t.maxMs);
 	return Math.round(n * (.5 + .5 * (t.random ?? Math.random)()));
-}, N = class {
+}, oe = class {
 	opts;
 	now;
 	stuckClaimMs;
@@ -114,9 +214,9 @@ var b = class extends i.TaggedError()("CdcConfigError", { message: i.String }) {
 			status: "pending",
 			claimedBy: null,
 			claimedAt: null
-		}, { where: o(c("pipe", n.key), c("status", "delivering"), m("claimedAt", new Date(r - this.stuckClaimMs))) }), (await e.query({
+		}, { where: s(l("pipe", n.key), l("status", "delivering"), h("claimedAt", new Date(r - this.stuckClaimMs))) }), (await e.query({
 			table: "_voltro_cdcout_outbox",
-			predicate: o(c("pipe", n.key), c("status", "delivering")),
+			predicate: s(l("pipe", n.key), l("status", "delivering")),
 			order: [],
 			take: 1,
 			skip: void 0,
@@ -124,7 +224,7 @@ var b = class extends i.TaggedError()("CdcConfigError", { message: i.String }) {
 		})).length > 0) return;
 		let i = await e.query({
 			table: S,
-			predicate: o(c("pipe", n.key), c("status", "pending")),
+			predicate: s(l("pipe", n.key), l("status", "pending")),
 			order: [{
 				column: "id",
 				direction: "asc"
@@ -136,19 +236,19 @@ var b = class extends i.TaggedError()("CdcConfigError", { message: i.String }) {
 		if (i.length === 0) return;
 		let a = [];
 		for (let e of i) {
-			if (O(e.nextAttemptAt) > r) break;
+			if (A(e.nextAttemptAt) > r) break;
 			a.push(e);
 		}
 		if (a.length === 0) return;
-		let s = a.map((e) => e.id);
+		let o = a.map((e) => e.id);
 		if (await e.updateMany("_voltro_cdcout_outbox", {
 			status: "delivering",
 			claimedBy: this.opts.replicaId,
 			claimedAt: new Date(r)
-		}, { where: o(c("pipe", n.key), d("id", s), c("status", "pending")) }) === 0) return;
-		let l = await e.query({
+		}, { where: s(l("pipe", n.key), f("id", o), l("status", "pending")) }) === 0) return;
+		let c = await e.query({
 			table: S,
-			predicate: o(c("pipe", n.key), d("id", s), c("status", "delivering"), c("claimedBy", this.opts.replicaId)),
+			predicate: s(l("pipe", n.key), f("id", o), l("status", "delivering"), l("claimedBy", this.opts.replicaId)),
 			order: [{
 				column: "id",
 				direction: "asc"
@@ -157,39 +257,39 @@ var b = class extends i.TaggedError()("CdcConfigError", { message: i.String }) {
 			skip: void 0,
 			projection: void 0
 		});
-		if (l.length === 0) return;
-		let u = l.map((e) => ({
+		if (c.length === 0) return;
+		let u = c.map((e) => ({
 			table: e.sourceTable,
 			op: e.op,
 			key: e.key,
 			data: e.payload,
 			deliveryKey: e.id
-		})), f = await t.runPromise(t.either(A(n.sink, u, {
+		})), d = await t.runPromise(t.either(I(n.sink, u, {
 			timeoutMs: this.opts.deliveryTimeoutMs,
 			pipe: n.key
 		}))), p = this.now();
-		if (f._tag === "Right") {
+		if (d._tag === "Right") {
 			await e.updateMany(S, {
 				status: "delivered",
 				deliveredAt: new Date(p),
 				claimedBy: null,
 				claimedAt: null,
 				lastError: null
-			}, { where: o(c("pipe", n.key), d("id", l.map((e) => e.id)), c("status", "delivering"), c("claimedBy", this.opts.replicaId)) }), n.stats.delivered += l.length, n.stats.lastDeliveryAtMs = p;
+			}, { where: s(l("pipe", n.key), f("id", c.map((e) => e.id)), l("status", "delivering"), l("claimedBy", this.opts.replicaId)) }), n.stats.delivered += c.length, n.stats.lastDeliveryAtMs = p;
 			return;
 		}
-		let h = f.left.message;
-		for (let t of l) {
+		let m = d.left.message;
+		for (let t of c) {
 			let r = t.attempts + 1;
 			if (r >= this.opts.maxAttempts) await e.update(S, t.id, {
 				status: "dead",
 				attempts: r,
 				claimedBy: null,
 				claimedAt: null,
-				lastError: h
+				lastError: m
 			}), n.stats.dead += 1;
 			else {
-				let n = M(r, {
+				let n = R(r, {
 					baseMs: this.opts.backoffBaseMs,
 					maxMs: this.opts.backoffMaxMs,
 					...this.opts.random === void 0 ? {} : { random: this.opts.random }
@@ -200,7 +300,7 @@ var b = class extends i.TaggedError()("CdcConfigError", { message: i.String }) {
 					nextAttemptAt: new Date(p + n),
 					claimedBy: null,
 					claimedAt: null,
-					lastError: h
+					lastError: m
 				});
 			}
 			n.stats.failed += 1;
@@ -208,13 +308,13 @@ var b = class extends i.TaggedError()("CdcConfigError", { message: i.String }) {
 		this.opts.warn?.("cdc-out delivery failed (durable retry scheduled)", {
 			pipe: n.key,
 			sink: n.sink.name,
-			records: l.length,
-			attempts: l[0] === void 0 ? 1 : l[0].attempts + 1,
+			records: c.length,
+			attempts: c[0] === void 0 ? 1 : c[0].attempts + 1,
 			maxAttempts: this.opts.maxAttempts,
-			reason: h
+			reason: m
 		});
 	}
-}, P = (e = "memory") => {
+}, z = (e = "memory") => {
 	let t = [];
 	return {
 		name: e,
@@ -228,7 +328,7 @@ var b = class extends i.TaggedError()("CdcConfigError", { message: i.String }) {
 			return t.flat();
 		}
 	};
-}, F = (e, t) => {
+}, B = (e, t) => {
 	let n;
 	try {
 		n = new URL(e).host;
@@ -255,14 +355,14 @@ var b = class extends i.TaggedError()("CdcConfigError", { message: i.String }) {
 			});
 		}
 	};
-}, I = 100, L = 5, R = 200, z = 3e4, B = 250, V = 1e4, H = 15e3, U = 72, W = (e) => {
+}, se = 100, ce = 5, le = 200, ue = 3e4, de = 250, fe = 1e4, V = 15e3, pe = 72, me = 6e4, he = 1e4, ge = 1e3, H = (e) => {
 	throw new b({ message: e });
-}, G = (e) => {
-	(e.sinks === void 0 || e.sinks.length === 0) && W("cdcOutPlugin: at least one sink config is required");
+}, U = (e) => {
+	(e.sinks === void 0 || e.sinks.length === 0) && H("cdcOutPlugin: at least one sink config is required");
 	let t = /* @__PURE__ */ new Set();
 	e.sinks.forEach((e, n) => {
-		(typeof e.table != "string" || e.table.length === 0) && W(`cdcOutPlugin: sinks[${n}].table is required`), e.table.startsWith("_voltro_cdcout") && W(`cdcOutPlugin: sinks[${n}].table '${e.table}' is the plugin's own delivery state — it cannot be mirrored`), t.has(e.table) && W(`cdcOutPlugin: duplicate sink config for table '${e.table}' — one sink config per table per instance; for multiple sinks on one table wire a second cdcOutPlugin({ name: '…' }) instance`), t.add(e.table), (e.sink === void 0 || typeof e.sink.deliver != "function") && W(`cdcOutPlugin: sinks[${n}] (table '${e.table}') needs a sink with a deliver(batch) function`), e.batchSize !== void 0 && e.batchSize <= 0 && W(`cdcOutPlugin: sinks[${n}] (table '${e.table}') batchSize must be > 0`);
-	}), e.name !== void 0 && !/^[a-zA-Z0-9-]+$/.test(e.name) && W(`cdcOutPlugin: name '${e.name}' must match [a-zA-Z0-9-]+ (it lands in the inspect URL)`);
+		(typeof e.table != "string" || e.table.length === 0) && H(`cdcOutPlugin: sinks[${n}].table is required`), e.table.startsWith("_voltro_cdcout") && H(`cdcOutPlugin: sinks[${n}].table '${e.table}' is the plugin's own delivery state — it cannot be mirrored`), t.has(e.table) && H(`cdcOutPlugin: duplicate sink config for table '${e.table}' — one sink config per table per instance; for multiple sinks on one table wire a second cdcOutPlugin({ name: '…' }) instance`), t.add(e.table), (e.sink === void 0 || typeof e.sink.deliver != "function") && H(`cdcOutPlugin: sinks[${n}] (table '${e.table}') needs a sink with a deliver(batch) function`), e.batchSize !== void 0 && e.batchSize <= 0 && H(`cdcOutPlugin: sinks[${n}] (table '${e.table}') batchSize must be > 0`);
+	}), e.name !== void 0 && !/^[a-zA-Z0-9-]+$/.test(e.name) && H(`cdcOutPlugin: name '${e.name}' must match [a-zA-Z0-9-]+ (it lands in the inspect URL)`);
 	let n = [
 		["maxAttempts", e.maxAttempts],
 		["backoffBaseMs", e.backoffBaseMs],
@@ -270,10 +370,15 @@ var b = class extends i.TaggedError()("CdcConfigError", { message: i.String }) {
 		["sweepIntervalMs", e.sweepIntervalMs],
 		["deliveryTimeoutMs", e.deliveryTimeoutMs],
 		["leaseTtlMs", e.leaseTtlMs],
-		["retentionHours", e.retentionHours]
+		["retentionHours", e.retentionHours],
+		["dedupWindowMs", e.dedupWindowMs],
+		["handoffBufferMs", e.handoffBufferMs],
+		["handoffBufferSize", e.handoffBufferSize]
 	];
-	for (let [e, t] of n) t !== void 0 && t < 1 && W(`cdcOutPlugin: ${e} must be >= 1`);
-}, K = (e, t) => {
+	for (let [e, t] of n) t !== void 0 && t < 1 && H(`cdcOutPlugin: ${e} must be >= 1`);
+	let r = e.leaseTtlMs ?? V;
+	e.dedupWindowMs !== void 0 && e.dedupWindowMs <= r && H(`cdcOutPlugin: dedupWindowMs (${e.dedupWindowMs}) must exceed leaseTtlMs (${r}) — a claim that expires inside a leadership handoff lets two replicas enqueue the same change`);
+}, W = (e, t) => {
 	if (t.filter !== void 0 && !t.filter(e)) return null;
 	if (e.op === "delete") {
 		let t = String(e.old?.id ?? "");
@@ -293,8 +398,8 @@ var b = class extends i.TaggedError()("CdcConfigError", { message: i.String }) {
 		key: r,
 		data: t.map ? t.map(n) : n
 	};
-}, q = (e, t) => `${e}:${t.table}:${t.sink.name}`, J = (e, t, n) => ({
-	id: T(),
+}, G = (e, t) => `${e}:${t.table}:${t.sink.name}`, K = (e, t, n) => ({
+	id: D(),
 	pipe: t,
 	sourceTable: e.table,
 	op: e.op,
@@ -308,10 +413,10 @@ var b = class extends i.TaggedError()("CdcConfigError", { message: i.String }) {
 	createdAt: new Date(n),
 	deliveredAt: null,
 	lastError: null
-}), Y = async (e, t, n, r) => {
-	let i = q(r?.instanceName ?? "default", t), a = (r?.now ?? Date.now)(), o = n.flatMap((e) => {
+}), q = async (e, t, n, r) => {
+	let i = G(r?.instanceName ?? "default", t), a = (r?.now ?? Date.now)(), o = n.flatMap((e) => {
 		let n = String(e.id ?? "");
-		return n === "" ? [] : [J({
+		return n === "" ? [] : [K({
 			table: t.table,
 			op: "insert",
 			key: n,
@@ -319,15 +424,19 @@ var b = class extends i.TaggedError()("CdcConfigError", { message: i.String }) {
 		}, i, a)];
 	});
 	return o.length > 0 && await e.insertMany(S, o), o.length;
-}, X = (i) => {
-	G(i);
-	let l = i.name ?? "default", u = i.name ? `@voltro/plugin-cdc-out#${i.name}` : "@voltro/plugin-cdc-out", f = `cdcout-${Math.random().toString(36).slice(2, 10)}`, p = i.maxAttempts ?? L, m = i.sweepIntervalMs ?? B, _ = i.leaseTtlMs ?? H, v = /* @__PURE__ */ new Map();
-	for (let e of i.sinks) v.set(e.table, {
+}, J = "@voltro/plugin-cdc-out", Y = (i) => {
+	U(i);
+	let u = i.name ?? "default", d = o({
+		base: J,
+		alias: i.alias,
+		instance: i.name
+	}), p = `cdcout-${Math.random().toString(36).slice(2, 10)}`, m = i.maxAttempts ?? ce, g = i.sweepIntervalMs ?? de, _ = i.leaseTtlMs ?? V, v = i.dedupWindowMs ?? Math.max(me, 4 * _), y = i.handoffBufferMs ?? v, b = i.handoffBufferSize ?? he, x = /* @__PURE__ */ new Map();
+	for (let e of i.sinks) x.set(e.table, {
 		config: e,
 		enginePipe: {
-			key: q(l, e),
+			key: G(u, e),
 			sink: e.sink,
-			batchSize: e.batchSize ?? I,
+			batchSize: e.batchSize ?? se,
 			busy: !1,
 			stats: {
 				delivered: 0,
@@ -337,63 +446,149 @@ var b = class extends i.TaggedError()("CdcConfigError", { message: i.String }) {
 			}
 		}
 	});
-	let y = new k({
-		key: l,
-		holder: f,
+	let C = new j({
+		key: u,
+		holder: p,
 		ttlMs: _
-	}), b = new N({
-		pipes: [...v.values()].map((e) => e.enginePipe),
-		replicaId: f,
-		maxAttempts: p,
-		backoffBaseMs: i.backoffBaseMs ?? R,
-		backoffMaxMs: i.backoffMaxMs ?? z,
-		deliveryTimeoutMs: i.deliveryTimeoutMs ?? V,
-		isLeader: () => y.isLeader,
-		warn: (e, t) => C(e, t)
-	}), x = { current: null }, C = () => void 0, w = 0, T, O;
-	h({
+	}), T = new oe({
+		pipes: [...x.values()].map((e) => e.enginePipe),
+		replicaId: p,
+		maxAttempts: m,
+		backoffBaseMs: i.backoffBaseMs ?? le,
+		backoffMaxMs: i.backoffMaxMs ?? ue,
+		deliveryTimeoutMs: i.deliveryTimeoutMs ?? fe,
+		isLeader: () => C.isLeader,
+		warn: (e, t) => D(e, t)
+	}), E = { current: null }, D = () => void 0, A = 0, M, F, I = new ie({
+		windowMs: 2 * v,
+		maxEntries: Math.max(b, 1e3) * 4
+	}), L = new ae({
+		windowMs: y,
+		maxEntries: b
+	}), R = !1, z = 0, B = !1, H = null, q = 0, Y = !1, _e = !1, X = [], Z = 0;
+	ee({
+		source: "plugin",
 		table: S,
 		timeColumn: "createdAt",
-		ttlMs: i.retentionHours === void 0 ? g(process.env.CDCOUT_RETENTION_HOURS, U) : i.retentionHours * 36e5,
-		where: d("status", ["delivered", "dead"]),
+		ttlMs: i.retentionHours === void 0 ? te(process.env.CDCOUT_RETENTION_HOURS, pe) : i.retentionHours * 36e5,
+		where: f("status", ["delivered", "dead"]),
 		label: "cdc-out outbox (delivered/dead)"
+	}), ee({
+		source: "plugin",
+		table: w,
+		timeColumn: "seenAt",
+		ttlMs: v,
+		label: "cdc-out enqueue claims (dedup window)"
 	});
-	let A = /* @__PURE__ */ new Set();
-	for (let e of i.sinks) e.sink.outboundHost && A.add(e.sink.outboundHost);
-	let j = [
+	let ve = /* @__PURE__ */ new Set();
+	for (let e of i.sinks) e.sink.outboundHost && ve.add(e.sink.outboundHost);
+	let ye = [
 		"store:changes:read",
 		"store:write",
 		"inspect:read",
-		...[...A].map((e) => `network:outbound:${e}`)
-	], M = [
+		...[...ve].map((e) => `network:outbound:${e}`)
+	], be = [
 		"pending",
 		"delivering",
 		"delivered",
 		"dead"
-	], P = async (e, t) => {
+	], xe = async (e, t) => {
 		let n = {
 			pending: 0,
 			delivering: 0,
 			delivered: 0,
 			dead: 0
 		};
-		return await Promise.all(M.map(async (r) => {
+		return await Promise.all(be.map(async (r) => {
 			let i = await e.query({
 				table: S,
-				predicate: o(c("pipe", t), c("status", r)),
+				predicate: s(l("pipe", t), l("status", r)),
 				order: [],
 				take: void 0,
 				skip: void 0,
 				projection: void 0,
-				aggregations: [s("n")]
+				aggregations: [c("n")]
 			});
 			n[r] = Number(i[0]?.n ?? 0);
 		})), n;
+	}, Se = (e) => {
+		let t = Date.now();
+		t - A > 6e4 && (A = t, D("cdc-out: no DataStore bound — change events are NOT being mirrored", { table: e }));
+	}, Ce = async (e, t, n) => (await e.insertIgnore(w, {
+		id: ne(),
+		pipe: t,
+		changeKey: n,
+		claimedBy: p,
+		seenAt: /* @__PURE__ */ new Date()
+	}, { conflictColumns: ["pipe", "changeKey"] })).claimedBy === p, Q = async () => {
+		if (R) return;
+		let e = E.current;
+		if (e !== null) {
+			R = !0;
+			try {
+				for (;;) {
+					let t = L.nextPending();
+					if (t === void 0 || !C.isLeader) return;
+					await Ce(e, t.pipe, t.changeKey) && await e.insert(S, K(t.change, t.pipe, Date.now())), t.enqueued = !0;
+				}
+			} finally {
+				R = !1;
+			}
+		}
+	}, we = (e) => {
+		if (Y = !0, !B) {
+			for (X.push(e); X.length > b;) X.shift(), Z += 1;
+			return;
+		}
+		L.append({
+			pipe: e.pipe,
+			changeKey: P(e.digest, I.next(e.digest, e.observedAtMs)),
+			change: e.change,
+			observedAtMs: e.observedAtMs,
+			enqueued: !1
+		});
+	}, Te = (e, t) => {
+		I.seedFromChangeKeys(e, t), B = !0;
+		for (let e of X.splice(0, X.length)) we(e);
+	}, $ = async () => {
+		if (B) return;
+		let e = E.current;
+		if (e !== null) {
+			if (H === null) {
+				if (q !== 0 && Date.now() - q < ge) return;
+				let t = !Y;
+				H = (async () => {
+					let n = await e.query({
+						table: w,
+						predicate: void 0,
+						order: [{
+							column: "seenAt",
+							direction: "desc"
+						}],
+						take: Math.max(b, 1e3),
+						skip: void 0,
+						projection: ["changeKey"]
+					});
+					!t && !_e && (_e = !0, D("cdc-out: occurrence counters start from this replica's own stream — the claims snapshot was only reachable after it began observing, and counting it could duplicate a change", { replicaId: p })), Te(t ? n.flatMap((e) => typeof e.changeKey == "string" ? [e.changeKey] : []) : [], Date.now());
+				})().catch((e) => {
+					q = Date.now(), D("cdc-out: could not seed change-occurrence counters — enqueue is held until it lands", { reason: String(e) });
+				}).finally(() => {
+					H = null;
+				});
+			}
+			await H;
+		}
+	}, Ee = (e) => {
+		let t = e - y;
+		for (; X.length > 0 && X[0].observedAtMs < t;) X.shift(), Z += 1;
+	}, De = async (e, t) => {
+		t - z < Math.max(1e3, Math.floor(v / 4)) || (z = t, await e.deleteMany(w, { where: h("seenAt", new Date(t - v)) }));
 	};
 	return a({
-		name: u,
+		name: d,
+		baseName: J,
 		description: "Declarative reverse-ETL: mirror table changes outward to external sinks (webhook/Kafka/Snowflake/BigQuery) through a durable outbox — ordered per pipe, at-least-once from enqueue, retried with backoff, dead-lettered.",
-		permissions: j,
+		permissions: ye,
 		declaredEnv: [{
 			name: "CDCOUT_RETENTION_HOURS",
 			required: !1,
@@ -401,34 +596,50 @@ var b = class extends i.TaggedError()("CdcConfigError", { message: i.String }) {
 			description: "Hours delivered/dead outbox rows are kept before the retention sweep purges them (default 72).",
 			example: "72"
 		}],
-		extendSchema: { tables: [E, D] },
+		extendSchema: { tables: [
+			O,
+			re,
+			k
+		] },
 		bindDataStore: (e) => {
-			x.current = e;
+			E.current = e, $();
 		},
 		inspectEndpoints: [{
 			method: "GET",
 			path: "/sinks",
 			description: "Configured sinks + per-pipe outbox counts and delivery stats.",
 			handler: () => t.tryPromise(async () => {
-				let e = x.current;
+				let e = E.current;
 				return {
 					kind: "json",
-					data: { sinks: await Promise.all([...v.values()].map(async ({ config: t, enginePipe: n }) => {
-						let r = e === null ? {
-							pending: 0,
-							delivering: 0,
-							delivered: 0,
-							dead: 0
-						} : await P(e, n.key);
-						return {
-							table: t.table,
-							sink: t.sink.name,
-							pipe: n.key,
-							...r,
-							failed: r.dead,
-							lastDeliveryAtMs: n.stats.lastDeliveryAtMs
-						};
-					})) }
+					data: {
+						sinks: await Promise.all([...x.values()].map(async ({ config: t, enginePipe: n }) => {
+							let r = e === null ? {
+								pending: 0,
+								delivering: 0,
+								delivered: 0,
+								dead: 0
+							} : await xe(e, n.key);
+							return {
+								table: t.table,
+								sink: t.sink.name,
+								pipe: n.key,
+								...r,
+								failed: r.dead,
+								lastDeliveryAtMs: n.stats.lastDeliveryAtMs
+							};
+						})),
+						handoff: {
+							leader: C.isLeader,
+							seeded: B,
+							awaitingSeed: X.length,
+							buffered: L.size,
+							pending: L.pendingCount(),
+							dropped: L.droppedPending + Z,
+							windowMs: y,
+							dedupWindowMs: v
+						}
+					}
 				};
 			})
 		}, {
@@ -436,7 +647,7 @@ var b = class extends i.TaggedError()("CdcConfigError", { message: i.String }) {
 			path: "/dead-letter",
 			description: "Outbox rows that exhausted maxAttempts (newest first, capped at 100).",
 			handler: () => t.tryPromise(async () => {
-				let e = x.current;
+				let e = E.current;
 				return e === null ? {
 					kind: "json",
 					data: { rows: [] }
@@ -444,7 +655,7 @@ var b = class extends i.TaggedError()("CdcConfigError", { message: i.String }) {
 					kind: "json",
 					data: { rows: (await e.query({
 						table: S,
-						predicate: c("status", "dead"),
+						predicate: l("status", "dead"),
 						order: [{
 							column: "id",
 							direction: "desc"
@@ -466,42 +677,61 @@ var b = class extends i.TaggedError()("CdcConfigError", { message: i.String }) {
 			})
 		}],
 		onChangeEvent: (e) => {
-			let n = v.get(e.table);
+			let n = x.get(e.table);
 			if (n === void 0) return t.void;
-			if (e.changeScope === "fleet") {
-				if (!y.isLeader) return t.void;
-			} else if (e.origin === "injected") return t.void;
-			let r = K(e, n.config);
+			let r = W(e, n.config);
 			if (r === null) return t.void;
-			let i = x.current;
-			if (i === null) {
-				let n = Date.now();
-				return n - w > 6e4 && (w = n, C("cdc-out: no DataStore bound — change events are NOT being mirrored", { table: e.table })), t.void;
+			if (e.changeScope === "fleet") {
+				let i = Date.now(), a = N({
+					pipe: n.enginePipe.key,
+					op: r.op,
+					key: r.key,
+					next: e.new,
+					prev: e.old
+				});
+				return we({
+					pipe: n.enginePipe.key,
+					digest: a,
+					change: r,
+					observedAtMs: i
+				}), E.current === null ? (Se(e.table), t.void) : t.promise(() => $()).pipe(t.flatMap(() => C.isLeader ? t.tryPromise(() => Q()) : t.void));
 			}
-			let a = J(r, n.enginePipe.key, Date.now());
+			if (e.origin === "injected") return t.void;
+			let i = E.current;
+			if (i === null) return Se(e.table), t.void;
+			let a = K(r, n.enginePipe.key, Date.now());
 			return t.tryPromise(() => i.insert(S, a).then(() => void 0));
 		},
 		onActivate: (n) => t.sync(() => {
-			C = (e, t) => n.logger.warn(e, t);
+			D = (e, t) => n.logger.warn(e, t);
 			let i = t.suspend(() => {
-				let e = x.current;
-				return e === null ? t.void : t.promise(() => y.heartbeat(e).then(() => void 0));
+				let e = E.current;
+				return e === null ? t.void : t.promise(async () => {
+					await $();
+					let t = C.isLeader;
+					await C.heartbeat(e) && !t && await Q().catch((e) => {
+						D("cdc-out: handoff drain failed (retried on the next sweep)", { reason: String(e) });
+					});
+				});
 			}).pipe(t.repeat(r.spaced(e.millis(Math.max(1, Math.floor(_ / 3)))))), a = t.suspend(() => {
-				let e = x.current;
-				return e === null ? t.void : t.tryPromise(() => b.tick(e)).pipe(t.catchAll((e) => t.sync(() => C("cdc-out worker sweep failed", { reason: String(e) }))));
-			}).pipe(t.repeat(r.spaced(e.millis(m))));
-			O = t.runFork(i), T = t.runFork(a), n.logger.info("cdc-out active", {
-				tables: [...v.keys()],
-				replicaId: f,
+				let e = E.current;
+				return e === null ? t.void : t.tryPromise(async () => {
+					let t = Date.now();
+					await $(), Ee(t), L.prune(t), I.prune(t), await De(e, t), C.isLeader && await Q(), await T.tick(e);
+				}).pipe(t.catchAll((e) => t.sync(() => D("cdc-out worker sweep failed", { reason: String(e) }))));
+			}).pipe(t.repeat(r.spaced(e.millis(g))));
+			F = t.runFork(i), M = t.runFork(a), n.logger.info("cdc-out active", {
+				tables: [...x.keys()],
+				replicaId: p,
 				outbox: S
 			});
 		}),
 		onDeactivate: () => t.gen(function* () {
-			T !== void 0 && (yield* n.interrupt(T)), O !== void 0 && (yield* n.interrupt(O)), T = void 0, O = void 0;
-			let e = x.current;
-			e !== null && (yield* t.promise(() => y.release(e)));
+			M !== void 0 && (yield* n.interrupt(M)), F !== void 0 && (yield* n.interrupt(F)), M = void 0, F = void 0;
+			let e = E.current;
+			e !== null && (yield* t.promise(() => C.release(e)));
 		})
 	});
 };
 //#endregion
-export { C as CDCOUT_LEASES_TABLE, S as CDCOUT_OUTBOX_TABLE, b as CdcConfigError, x as CdcDeliveryError, k as CdcLeaseManager, N as CdcOutEngine, D as cdcOutLeasesTable, E as cdcOutOutboxTable, X as cdcOutPlugin, A as deliverOnce, Y as enqueueBackfill, K as mapChange, P as memorySink, T as nextOutboxId, J as outboxRowFor, q as pipeKey, M as retryDelayMs, G as validateCdcOutConfig, F as webhookSink };
+export { w as CDCOUT_CLAIMS_TABLE, C as CDCOUT_LEASES_TABLE, S as CDCOUT_OUTBOX_TABLE, b as CdcConfigError, x as CdcDeliveryError, j as CdcLeaseManager, oe as CdcOutEngine, ae as HandoffBuffer, ie as OccurrenceCounter, M as canonicalJson, k as cdcOutClaimsTable, re as cdcOutLeasesTable, O as cdcOutOutboxTable, Y as cdcOutPlugin, N as changeDigest, P as composeChangeKey, I as deliverOnce, q as enqueueBackfill, W as mapChange, z as memorySink, ne as nextClaimId, D as nextOutboxId, K as outboxRowFor, F as parseChangeKey, G as pipeKey, R as retryDelayMs, U as validateCdcOutConfig, B as webhookSink };