orez-lite 0.9.7

package/dist/cf-do/worker.js

@@ -0,0 +1,1999 @@
+// @ts-nocheck — cloudflare:workers types not available in orez
+import { DurableObject, RpcTarget } from 'cloudflare:workers';
+import { executeTransactionQueryPlan, } from 'orez-sync-cf-host/transaction-query';
+import { classifySql, isSqlMutation, isSqlRowMutation, RollingRowWriteBudget, stripPublicPrefix, trackSqlCursorRowsWritten, trackedChangeRow, WriteBudgetExceededError, } from '../do-sql-tracking.js';
+import { TransactionalCdc, schemaChangeTargets, } from './cdc.js';
+import { appendPendingChange, deletePendingChanges, ensurePendingChangesTable, rollbackPendingChanges, } from './row-undo.js';
+import { beginTxJournal, commitTxJournal, recoverTxJournal, rollbackTxJournal, snapshotSideEffectWriteTables, snapshotTxSchema, upgradeToTableSnapshot, } from './tx-journal.js';
+import { DurableWatermarkState } from './watermark.js';
+export { createApplicationSqlClient } from './application-sql.js';
+const SCHEMA_VERSION = 1;
+const SQL_ERROR_SNIPPET_RADIUS = 1600;
+const SQL_ERROR_FALLBACK_LIMIT = 4000;
+const DEFAULT_WRITE_BUDGET_ROWS = 150_000;
+const DEFAULT_WRITE_BUDGET_WINDOW_MS = 5 * 60 * 1000;
+const WRITE_BUDGET_TRIPPED_KEY = '_orez_write_budget_tripped_at';
+const SCHEMA_PROVISIONING_WAIT_MS = 20_000;
+const SCHEMA_PROVISIONING_MAX_DELAY_MS = 500;
+const APPLICATION_SQL_TURN_WAIT_MS = 30_000;
+const DEFAULT_SNAPSHOT_PAGE_ROWS = 2_000;
+const MAX_SNAPSHOT_PAGE_ROWS = 10_000;
+const TRANSACTION_CONTROL_SQL = /^\s*(?:BEGIN|COMMIT|ROLLBACK|SAVEPOINT|RELEASE)(?=\s|;|$)/i;
+function positiveEnvInteger(value, fallback) {
+    const parsed = Number(value);
+    return Number.isSafeInteger(parsed) && parsed > 0 ? parsed : fallback;
+}
+function quoteIdent(name) {
+    return `"${name.replace(/"/g, '""')}"`;
+}
+function sqliteTypeForSchemaColumn(type) {
+    const types = {
+        string: 'TEXT',
+        number: 'REAL',
+        boolean: 'INTEGER',
+        json: 'TEXT',
+        bigint: 'TEXT',
+    };
+    return types[type] || 'TEXT';
+}
+function sqliteErrorOffset(message) {
+    const marker = 'offset ';
+    const start = message.indexOf(marker);
+    if (start < 0)
+        return null;
+    let index = start + marker.length;
+    let digits = '';
+    while (index < message.length) {
+        const code = message.charCodeAt(index);
+        if (code < 48 || code > 57)
+            break;
+        digits += message[index];
+        index++;
+    }
+    if (!digits)
+        return null;
+    const offset = Number(digits);
+    return Number.isFinite(offset) ? offset : null;
+}
+function sqlErrorSnippet(sql, message) {
+    const offset = sqliteErrorOffset(message);
+    if (offset !== null) {
+        const start = Math.max(0, offset - SQL_ERROR_SNIPPET_RADIUS);
+        const end = Math.min(sql.length, offset + SQL_ERROR_SNIPPET_RADIUS);
+        return `${start > 0 ? '...' : ''}${sql.slice(start, end)}${end < sql.length ? '...' : ''}`;
+    }
+    if (sql.length <= SQL_ERROR_FALLBACK_LIMIT)
+        return sql;
+    return `${sql.slice(0, SQL_ERROR_FALLBACK_LIMIT)}...`;
+}
+function assertApplicationTransactionSQL(sql) {
+    if (TRANSACTION_CONTROL_SQL.test(sql)) {
+        throw new TypeError('transaction SQL is owned by ZeroDO');
+    }
+}
+function applicationSqlTrack(metadata) {
+    if (!metadata)
+        return undefined;
+    const operations = {
+        insert: 'INSERT',
+        update: 'UPDATE',
+        delete: 'DELETE',
+        upsert: 'UPSERT',
+    };
+    return {
+        tableName: metadata.publicTable,
+        physicalTableName: metadata.table,
+        operation: operations[metadata.kind],
+    };
+}
+const APPLICATION_SQL_ACQUIRE = Symbol('applicationSqlAcquire');
+const APPLICATION_SQL_QUERY = Symbol('applicationSqlQuery');
+const APPLICATION_SQL_EXEC = Symbol('applicationSqlExec');
+const APPLICATION_SQL_QUERY_PLAN = Symbol('applicationSqlQueryPlan');
+const APPLICATION_SQL_REGISTER_TABLES = Symbol('applicationSqlRegisterTables');
+const APPLICATION_SQL_COMMIT = Symbol('applicationSqlCommit');
+const APPLICATION_SQL_ROLLBACK = Symbol('applicationSqlRollback');
+const APPLICATION_SQL_DISPOSE = Symbol('applicationSqlDispose');
+class ApplicationSqlSessionTarget extends RpcTarget {
+    owner;
+    sessionID;
+    state = 'created';
+    changed = false;
+    mutated = false;
+    constructor(owner, sessionID) {
+        super();
+        this.owner = owner;
+        this.sessionID = sessionID;
+    }
+    async begin() {
+        return this.owner[APPLICATION_SQL_ACQUIRE](this);
+    }
+    query(sql, params = []) {
+        return this.owner[APPLICATION_SQL_QUERY](this, sql, params);
+    }
+    exec(sql, params = [], metadata) {
+        return this.owner[APPLICATION_SQL_EXEC](this, sql, params, metadata);
+    }
+    queryPlan(plan, queryName, queryBudget) {
+        return this.owner[APPLICATION_SQL_QUERY_PLAN](this, plan, queryName, queryBudget);
+    }
+    registerTables(tables) {
+        return this.owner[APPLICATION_SQL_REGISTER_TABLES](this, tables);
+    }
+    commit() {
+        return this.owner[APPLICATION_SQL_COMMIT](this);
+    }
+    rollback() {
+        return this.owner[APPLICATION_SQL_ROLLBACK](this);
+    }
+    [Symbol.dispose]() {
+        this.owner[APPLICATION_SQL_DISPOSE](this);
+    }
+}
+export class ZeroDO extends DurableObject {
+    sql;
+    watermarks;
+    cdc;
+    schemaTables = new Set();
+    tableSchemas = new Map();
+    writeBudget;
+    writeBudgetDisabled;
+    writeBudgetAdminToken;
+    activeWriteMeasurements = null;
+    writeBudgetTripStatement;
+    pendingChangesSchemaReady = false;
+    activeApplicationSqlSession = null;
+    applicationSqlDidCommit(_changed, _mutated) { }
+    recordWriteBudgetRows(rows, statement) {
+        const wasTripped = this.writeBudget.status().tripped;
+        try {
+            this.writeBudget.recordBillable(rows);
+        }
+        catch (error) {
+            if (error instanceof WriteBudgetExceededError && !wasTripped) {
+                this.writeBudgetTripStatement = statement
+                    ? {
+                        sql: statement.sql
+                            .replace(/'(?:''|[^'])*'/g, '?')
+                            .replace(/\b\d+(?:\.\d+)?\b/g, '?')
+                            .replace(/\s+/g, ' ')
+                            .trim()
+                            .slice(0, 1_000),
+                        rowsWritten: statement.rowsWritten,
+                    }
+                    : undefined;
+                const status = this.writeBudget.status();
+                console.error(JSON.stringify({
+                    event: 'orez_do_write_budget_tripped',
+                    windowRows: status.windowRows,
+                    billableRows: status.billableRows,
+                    logicalRows: status.logicalRows,
+                    budget: status.budget,
+                    windowMs: status.windowMs,
+                    trippedAt: status.trippedAt,
+                    statement: this.writeBudgetTripStatement,
+                }));
+                this.persistWriteBudgetTrip();
+            }
+            throw error;
+        }
+    }
+    /**
+     * Make the trip sticky, from outside the transaction that is aborting.
+     *
+     * The trip fires during cursor consumption, which is almost always inside
+     * ctx.storage.transaction(). A put in that scope is rolled back with the
+     * write (prod booted un-tripped this way on 2026-07-11), and code after the
+     * transaction does not reliably get to run either: measured under workerd,
+     * a write budget tripped on the application SQL path resolved neither the
+     * transaction's success nor its failure path, so a namespace tripped by
+     * soot's real write path persisted nothing and came back OPEN on the next
+     * eviction. blockConcurrencyWhile is the seam that survives both: the
+     * runtime defers this until the in-flight storage work is done, so it lands
+     * after the rollback rather than inside it.
+     *
+     * The count rides along with the timestamp. The rolling window keeps decaying
+     * while the circuit stays sticky and a restored object starts with none of
+     * it, so a status read that consults the live meter reports 0/budget and
+     * erases how far over the namespace actually went.
+     */
+    persistWriteBudgetTrip() {
+        const trip = this.writeBudget.trip();
+        if (!trip)
+            return;
+        void this.ctx
+            .blockConcurrencyWhile(async () => {
+            await this.ctx.storage.put(WRITE_BUDGET_TRIPPED_KEY, {
+                ...trip,
+                statement: this.writeBudgetTripStatement,
+            });
+        })
+            .catch((error) => {
+            console.error(JSON.stringify({
+                event: 'orez_do_write_budget_persist_failed',
+                message: error instanceof Error ? error.message : String(error),
+            }));
+        });
+    }
+    // The trip itself is persisted by persistWriteBudgetTrip at the moment it
+    // fires, which is the one place every path passes through, so this only has
+    // to shape the response.
+    writeBudgetErrorResponse(error) {
+        if (!(error instanceof WriteBudgetExceededError))
+            return null;
+        return Response.json(error.toJSON(), { status: 429 });
+    }
+    constructor(ctx, env) {
+        super(ctx, env);
+        this.sql = ctx.storage.sql;
+        this.writeBudgetDisabled = /^(?:1|true)$/i.test(env.OREZ_DO_WRITE_BUDGET_DISABLED ?? '');
+        this.writeBudgetAdminToken = env.OREZ_DO_WRITE_BUDGET_ADMIN_TOKEN;
+        this.writeBudget = new RollingRowWriteBudget({
+            budgetRows: positiveEnvInteger(env.OREZ_DO_WRITE_BUDGET_ROWS, DEFAULT_WRITE_BUDGET_ROWS),
+            windowMs: positiveEnvInteger(env.OREZ_DO_WRITE_BUDGET_WINDOW_MS, DEFAULT_WRITE_BUDGET_WINDOW_MS),
+            now: () => Date.now(),
+        });
+        if (this.writeBudgetDisabled) {
+            console.error(JSON.stringify({
+                event: 'orez_do_write_budget_disabled',
+                warning: 'row write circuit breaker explicitly disabled',
+            }));
+        }
+        const rawExec = this.sql.exec.bind(this.sql);
+        this.sql.exec = (statement, ...params) => {
+            const mutation = isSqlMutation(statement);
+            if (mutation && !this.writeBudgetDisabled)
+                this.writeBudget.assertOpen();
+            const cursor = rawExec(statement, ...params);
+            if (!mutation)
+                return cursor;
+            const measurement = {
+                sql: statement,
+                rowsWritten: 0,
+            };
+            if (this.activeWriteMeasurements)
+                this.activeWriteMeasurements.push(measurement);
+            return trackSqlCursorRowsWritten(cursor, (rows) => {
+                measurement.rowsWritten += rows;
+                if (!this.writeBudgetDisabled)
+                    this.recordWriteBudgetRows(rows, measurement);
+            });
+        };
+        this.cdc = new TransactionalCdc(this.sql);
+        this.watermarks = new DurableWatermarkState(this.sql);
+        ctx.blockConcurrencyWhile(async () => {
+            const recovered = this.rollbackAtomicallyWithoutForeignKeys(() => {
+                const transactionIDs = recoverTxJournal(this.sql, 'application', (transactionID) => {
+                    this.rollbackPendingTrackedChanges(transactionID);
+                });
+                for (const transactionID of transactionIDs)
+                    this.deletePendingTrackedChanges(transactionID);
+                return transactionIDs;
+            });
+            if (recovered.length)
+                this.invalidateSchemaCaches();
+            if (!this.writeBudgetDisabled) {
+                const persisted = await ctx.storage.get(WRITE_BUDGET_TRIPPED_KEY);
+                if (persisted) {
+                    this.writeBudget.restoreTrip(persisted);
+                    if (typeof persisted !== 'number')
+                        this.writeBudgetTripStatement = persisted.statement;
+                }
+            }
+        });
+    }
+    async fetch(request) {
+        const url = new URL(request.url);
+        if (request.method === 'OPTIONS') {
+            return new Response(null, {
+                headers: {
+                    'Access-Control-Allow-Origin': '*',
+                    'Access-Control-Allow-Methods': 'GET, POST, OPTIONS',
+                    'Access-Control-Allow-Headers': '*',
+                },
+            });
+        }
+        if (url.pathname.startsWith('/sync/v') && url.pathname.endsWith('/connect'))
+            return this.handleSyncConnect(request, url);
+        if (url.pathname === '/_orez/write-budget' && request.method === 'GET')
+            return Response.json({
+                enabled: !this.writeBudgetDisabled,
+                ...this.writeBudget.status(),
+                trippedStatement: this.writeBudgetTripStatement,
+            });
+        if (url.pathname === '/_orez/write-budget/trip' && request.method === 'POST')
+            return this.handleWriteBudgetTrip(request);
+        if (url.pathname === '/_orez/write-budget/reopen' && request.method === 'POST')
+            return this.handleWriteBudgetReopen(request);
+        if ((url.pathname === '/zero/push' || url.pathname === '/api/zero/push') &&
+            request.method === 'POST')
+            return this.handleHttpPush(request);
+        if (url.pathname === '/exec' && request.method === 'POST')
+            return this.handleExec(request);
+        if (url.pathname === '/batch' && request.method === 'POST')
+            return this.handleBatch(request);
+        if (url.pathname === '/snapshot-tx-schema' && request.method === 'POST')
+            return this.handleSnapshotTransactionSchema(request);
+        if (url.pathname === '/commit-tx' && request.method === 'POST')
+            return this.handleCommitTransaction(request);
+        if (url.pathname === '/rollback-tx' && request.method === 'POST')
+            return this.handleRollbackTransaction(request);
+        if (url.pathname === '/recover-txs' && request.method === 'POST')
+            return this.handleRecoverTransactions(request);
+        if (url.pathname === '/changes' &&
+            (request.method === 'GET' || request.method === 'POST'))
+            return this.handleChanges(request, url);
+        if (url.pathname === '/snapshot' && request.method === 'GET')
+            return this.withApplicationSqlTurn(() => this.handleSnapshot(url), request.signal);
+        if (url.pathname === '/notify' && request.method === 'POST')
+            return Response.json({ ok: true, cookie: this.cookie() });
+        return new Response('not found', { status: 404 });
+    }
+    async handleWriteBudgetReopen(request) {
+        if (!this.hasWriteBudgetAdminToken(request))
+            return Response.json({ error: 'forbidden' }, { status: 403 });
+        await this.ctx.storage.delete(WRITE_BUDGET_TRIPPED_KEY);
+        this.writeBudgetTripStatement = undefined;
+        const status = this.writeBudget.reopen();
+        console.log(JSON.stringify({ event: 'orez_do_write_budget_reopened', reopenedAt: Date.now() }));
+        return Response.json({ ok: true, enabled: !this.writeBudgetDisabled, ...status });
+    }
+    async handleWriteBudgetTrip(request) {
+        if (!this.hasWriteBudgetAdminToken(request))
+            return Response.json({ error: 'forbidden' }, { status: 403 });
+        const status = this.writeBudget.forceTrip();
+        this.writeBudgetTripStatement = {
+            sql: 'operator force-trip',
+            rowsWritten: 0,
+        };
+        await this.ctx.storage.put(WRITE_BUDGET_TRIPPED_KEY, {
+            ...this.writeBudget.trip(),
+            statement: this.writeBudgetTripStatement,
+        });
+        console.error(JSON.stringify({
+            event: 'orez_do_write_budget_force_tripped',
+            trippedAt: Date.now(),
+        }));
+        return Response.json({
+            ok: true,
+            enabled: !this.writeBudgetDisabled,
+            ...status,
+            trippedStatement: this.writeBudgetTripStatement,
+        });
+    }
+    hasWriteBudgetAdminToken(request) {
+        const supplied = request.headers.get('x-orez-admin-token') ??
+            request.headers.get('authorization')?.replace(/^Bearer\s+/i, '');
+        return Boolean(this.writeBudgetAdminToken && supplied === this.writeBudgetAdminToken);
+    }
+    // ── Zero sync protocol ──────────────────────────────────────────────────
+    handleSyncConnect(request, url) {
+        if (request.headers.get('upgrade')?.toLowerCase() !== 'websocket') {
+            return new Response('expected websocket upgrade', { status: 426 });
+        }
+        const pair = new WebSocketPair();
+        const client = pair[0];
+        const server = pair[1];
+        const clientID = url.searchParams.get('clientID') || 'anon';
+        const clientGroupID = url.searchParams.get('clientGroupID') || 'default';
+        const userID = url.searchParams.get('userID') || 'anon';
+        const wsid = url.searchParams.get('wsid') || crypto.randomUUID();
+        const baseCookie = url.searchParams.get('baseCookie');
+        this.ctx.acceptWebSocket(server);
+        server.serializeAttachment({
+            clientID,
+            clientGroupID,
+            userID,
+            cookie: baseCookie ? baseCookie : null,
+            initialized: false,
+            desiredTableNames: [],
+            desiredQueries: [],
+        });
+        this.sendJSON(server, ['connected', { wsid, timestamp: Date.now() }]);
+        const secProtocol = request.headers.get('sec-websocket-protocol');
+        if (secProtocol) {
+            const initData = decodeInitConnection(secProtocol);
+            if (initData) {
+                const clientSchema = initData[1]?.clientSchema;
+                const patch = (initData[1]?.desiredQueriesPatch || []);
+                this.applyDesiredQueries(server, patch, clientSchema);
+            }
+        }
+        return new Response(null, {
+            status: 101,
+            headers: secProtocol ? { 'Sec-WebSocket-Protocol': secProtocol } : undefined,
+            webSocket: client,
+        });
+    }
+    async webSocketMessage(socket, messageData) {
+        this.watermarks.ensureTables();
+        const ws = socket;
+        const attachment = this.readSocketAttachment(ws);
+        if (!attachment)
+            return;
+        const message = this.parseMessage(messageData);
+        if (!message)
+            return;
+        const body = message[1] || {};
+        switch (message[0]) {
+            case 'initConnection':
+            case 'changeDesiredQueries':
+                this.applyDesiredQueries(ws, (body.desiredQueriesPatch || []), body.clientSchema);
+                break;
+            case 'push':
+                this.handlePush(ws, attachment, message[1]);
+                break;
+            case 'pull':
+                this.handlePull(ws, message[1]);
+                break;
+            case 'ping':
+                this.sendJSON(ws, ['pong', {}]);
+                break;
+        }
+    }
+    webSocketClose(_socket, _code, _reason, _wasClean) { }
+    applyDesiredQueries(socket, patch, clientSchema) {
+        const attachment = this.readSocketAttachment(socket);
+        if (!attachment)
+            return;
+        if (clientSchema)
+            this.ensureSchemaTables(clientSchema);
+        let nextAttachment = this.applyDesiredQueryPatch(attachment, patch);
+        socket.serializeAttachment(nextAttachment);
+        if (!nextAttachment.initialized) {
+            nextAttachment = this.sendSyncPoke(socket, { ...nextAttachment, initialized: true }, { lastMutationIDChanges: {}, rowsPatch: [] });
+        }
+        if (patch.length === 0)
+            return;
+        const rowsPatch = [
+            { op: 'clear' },
+            ...this.rowsPatchForTables(nextAttachment.desiredTableNames),
+        ];
+        this.sendSyncPoke(socket, nextAttachment, {
+            gotQueriesPatch: this.gotQueriesPatch(patch),
+            rowsPatch,
+        });
+    }
+    applyDesiredQueryPatch(attachment, patch) {
+        const desiredQueries = new Map();
+        for (const query of attachment.desiredQueries || [])
+            desiredQueries.set(query.hash, query.tableNames);
+        for (const op of patch) {
+            if (op.op === 'clear') {
+                desiredQueries.clear();
+            }
+            else if (op.op === 'put' && op.hash) {
+                desiredQueries.set(op.hash, this.resolveTablesFromPatch([op]));
+            }
+            else if (op.op === 'del' && op.hash) {
+                desiredQueries.delete(op.hash);
+            }
+        }
+        const queries = [...desiredQueries.entries()].map(([hash, tableNames]) => ({
+            hash,
+            tableNames,
+        }));
+        return {
+            ...attachment,
+            desiredQueries: queries,
+            desiredTableNames: [...new Set(queries.flatMap((query) => query.tableNames))],
+        };
+    }
+    gotQueriesPatch(patch) {
+        const got = [];
+        for (const op of patch) {
+            if (op.op === 'clear')
+                got.push({ op: 'clear' });
+            else if (op.hash)
+                got.push({ op: op.op, hash: op.hash });
+        }
+        return got;
+    }
+    rowsPatchForTables(tableNames) {
+        const rowsPatch = [];
+        for (const tn of tableNames) {
+            if (!this.tableExists(tn))
+                continue;
+            for (const row of this.readAllRows(tn))
+                rowsPatch.push({ op: 'put', tableName: tn, value: row });
+        }
+        return rowsPatch;
+    }
+    resolveTablesFromPatch(patch) {
+        const tables = [];
+        for (const op of patch) {
+            const tableFromName = this.tableNameFromOperationName(op.name);
+            if (tableFromName)
+                tables.push(tableFromName);
+            if (op.ast)
+                this.extractTableFromAST(op.ast, tables);
+        }
+        return tables;
+    }
+    extractTableFromAST(ast, tables) {
+        if (ast?.table)
+            tables.push(ast.table);
+        if (ast?.related)
+            for (const rel of ast.related) {
+                if (rel?.subquery?.table)
+                    tables.push(rel.subquery.table);
+                if (rel?.subquery?.related)
+                    this.extractTableFromAST(rel.subquery, tables);
+            }
+    }
+    handlePush(socket, attachment, body) {
+        const mutations = Array.isArray(body?.mutations) ? body.mutations : [];
+        const before = this.watermark();
+        const mutationResults = [];
+        const lastMutationIDChanges = {};
+        for (const m of mutations) {
+            const result = this.applyMutation(m);
+            mutationResults.push({ id: { clientID: m.clientID, id: m.id }, result });
+            lastMutationIDChanges[m.clientID] = m.id;
+        }
+        this.sendJSON(socket, ['pushResponse', { mutations: mutationResults }]);
+        const after = this.watermark();
+        const changes = after > before ? this.readChangesSince(before) : [];
+        const rowsPatch = changes.map((c) => this.syncRowPatchFromChange(c));
+        if (Object.keys(lastMutationIDChanges).length > 0 || rowsPatch.length > 0)
+            this.broadcastMutationPoke(attachment, {
+                lastMutationIDChanges,
+                rowsPatch,
+            });
+    }
+    async handleHttpPush(request) {
+        try {
+            const body = (await request.json());
+            const before = this.watermark();
+            const mutations = Array.isArray(body?.mutations) ? body.mutations : [];
+            const mutationResults = [];
+            const lastMutationIDChanges = {};
+            for (const m of mutations) {
+                const result = this.applyMutation(m);
+                mutationResults.push({ id: { clientID: m.clientID, id: m.id }, result });
+                lastMutationIDChanges[m.clientID] = m.id;
+            }
+            const after = this.watermark();
+            const changes = after > before ? this.readChangesSince(before) : [];
+            const rowsPatch = changes.map((c) => this.syncRowPatchFromChange(c));
+            if (Object.keys(lastMutationIDChanges).length > 0 || rowsPatch.length > 0)
+                this.broadcastPoke(body?.clientGroupID || 'default', {
+                    lastMutationIDChanges,
+                    rowsPatch,
+                });
+            return Response.json({ mutations: mutationResults });
+        }
+        catch (err) {
+            const budgetResponse = this.writeBudgetErrorResponse(err);
+            if (budgetResponse)
+                return budgetResponse;
+            return Response.json({ error: err.message }, { status: 500 });
+        }
+    }
+    handlePull(socket, body) {
+        this.sendJSON(socket, [
+            'pull',
+            {
+                requestID: body?.requestID || crypto.randomUUID(),
+                cookie: this.cookie(),
+                lastMutationIDChanges: {},
+                patch: [],
+            },
+        ]);
+    }
+    // ── SQL execution endpoints ─────────────────────────────────────────────
+    async handleExec(request) {
+        let sql = '';
+        const measurements = this.startWriteMeasurement(request);
+        try {
+            const body = (await request.json());
+            sql = body.sql;
+            const params = Array.isArray(body.params) ? body.params : [];
+            const transactionID = String(body.transactionID || body.track?.transactionID || '');
+            // CDC rows are drained into the durable change log before the storage
+            // transaction returns. Keep unrelated DDL/read calls on the fast path:
+            // wrapping every /exec adds ~2-5ms and materially slows large schemas.
+            const needsAtomicCapture = !!body.track ||
+                (this.cdc.active && (isSqlRowMutation(sql) || this.cdc.capturesSchemaChange(sql)));
+            const result = await this.withSchemaProvisioningWait(() => needsAtomicCapture
+                ? this.atomically(() => this.executeSQL(sql, params, body.track, transactionID || undefined))
+                : this.executeSQL(sql, params, undefined, transactionID || undefined));
+            return Response.json(measurements ? { ...result, writeMeasurements: measurements } : result);
+        }
+        catch (err) {
+            const budgetResponse = this.writeBudgetErrorResponse(err);
+            if (budgetResponse)
+                return budgetResponse;
+            const suffix = sql ? ` while executing: ${sqlErrorSnippet(sql, err.message)}` : '';
+            console.error(`[exec-500] ${err.message} :: SQL=${sql.slice(0, 800)}`);
+            return Response.json({ error: `${err.message}${suffix}` }, { status: 500 });
+        }
+        finally {
+            if (measurements)
+                this.activeWriteMeasurements = null;
+        }
+    }
+    /** Execute multiple statements atomically via ctx.storage.transaction() */
+    async handleBatch(request) {
+        const measurements = this.startWriteMeasurement(request);
+        try {
+            const { statements, cdcTables } = (await request.json());
+            const allRows = await this.withSchemaProvisioningWait(() => this.atomically(() => {
+                const results = [];
+                if (Array.isArray(cdcTables))
+                    this.cdc.syncTables(cdcTables);
+                for (const statement of statements) {
+                    const item = typeof statement === 'string' ? { sql: statement } : statement;
+                    if (!item?.sql?.trim())
+                        continue;
+                    if (item.skipIfColumnExists &&
+                        this.tableHasColumn(item.skipIfColumnExists.table, item.skipIfColumnExists.column)) {
+                        continue;
+                    }
+                    if (item.skipIfColumnMissing &&
+                        !this.tableHasColumn(item.skipIfColumnMissing.table, item.skipIfColumnMissing.column)) {
+                        continue;
+                    }
+                    try {
+                        results.push(this.executeSQL(item.sql, Array.isArray(item.params) ? item.params : [], item.track, item.transactionID || item.track?.transactionID));
+                    }
+                    catch (err) {
+                        if (err instanceof WriteBudgetExceededError)
+                            throw err;
+                        throw new Error(`${err.message} while executing: ${sqlErrorSnippet(item.sql, err.message)}`);
+                    }
+                }
+                return results;
+            }));
+            return Response.json({
+                results: allRows,
+                capturedChanges: allRows.reduce((total, result) => total + Number(result.capturedChanges ?? 0), 0),
+                ...(measurements ? { writeMeasurements: measurements } : null),
+            });
+        }
+        catch (err) {
+            const budgetResponse = this.writeBudgetErrorResponse(err);
+            if (budgetResponse)
+                return budgetResponse;
+            return Response.json({ error: err.message }, { status: 500 });
+        }
+        finally {
+            if (measurements)
+                this.activeWriteMeasurements = null;
+        }
+    }
+    // Fresh project traffic can arrive while the deploy shim is still applying
+    // its schema through a separate request to this same DO. Yield on SQLite's
+    // undefined-table error so that migration request can commit, then retry the
+    // read/batch. The operation that failed did not execute, and a failed batch
+    // transaction has rolled back, so replay is safe.
+    async withSchemaProvisioningWait(operation) {
+        const deadline = Date.now() + SCHEMA_PROVISIONING_WAIT_MS;
+        let delayMs = 25;
+        for (;;) {
+            try {
+                return await operation();
+            }
+            catch (error) {
+                if (!/no such table:/i.test(String(error?.message ?? error)))
+                    throw error;
+                if (Date.now() >= deadline)
+                    throw error;
+                await scheduler.wait(delayMs);
+                delayMs = Math.min(SCHEMA_PROVISIONING_MAX_DELAY_MS, delayMs * 2);
+            }
+        }
+    }
+    startWriteMeasurement(request) {
+        if (request.headers.get('x-orez-measure-writes') !== '1')
+            return null;
+        const measurements = [];
+        this.activeWriteMeasurements = measurements;
+        return measurements;
+    }
+    /**
+     * Atomic commit point for an application-SQL transaction. Promotes the
+     * tx's pending tracked changes into _zero_changes (allocating watermarks)
+     * and clears its journal (drops snapshots + manifest rows) in ONE storage
+     * transaction, so a DO kill can never leave a tx half-committed: either the
+     * manifest rows are gone (committed) or recovery rolls the tx back.
+     */
+    async handleCommitTransaction(request) {
+        const measurements = this.startWriteMeasurement(request);
+        try {
+            const body = (await request.json());
+            const transactionID = String(body.transactionID || '');
+            if (!transactionID)
+                throw new Error('missing transactionID');
+            const count = await this.atomically(() => {
+                const committed = this.commitPendingTrackedChanges(transactionID);
+                commitTxJournal(this.sql, transactionID);
+                return committed;
+            });
+            return Response.json({
+                ok: true,
+                count,
+                ...(measurements ? { writeMeasurements: measurements } : null),
+            });
+        }
+        catch (err) {
+            const budgetResponse = this.writeBudgetErrorResponse(err);
+            if (budgetResponse)
+                return budgetResponse;
+            return Response.json({ error: err.message }, { status: 500 });
+        }
+        finally {
+            if (measurements)
+                this.activeWriteMeasurements = null;
+        }
+    }
+    async handleSnapshotTransactionSchema(request) {
+        try {
+            const body = (await request.json());
+            const transactionID = String(body.transactionID || '');
+            if (!transactionID)
+                throw new Error('missing transactionID');
+            const owner = body.owner === undefined ? 'default' : String(body.owner);
+            const affectedTables = Array.isArray(body.affectedTables)
+                ? body.affectedTables.map(String)
+                : [];
+            await this.atomically(() => snapshotTxSchema(this.sql, transactionID, owner, affectedTables));
+            return Response.json({ ok: true });
+        }
+        catch (err) {
+            const budgetResponse = this.writeBudgetErrorResponse(err);
+            if (budgetResponse)
+                return budgetResponse;
+            return Response.json({ error: err.message }, { status: 500 });
+        }
+    }
+    async handleRollbackTransaction(request) {
+        const measurements = this.startWriteMeasurement(request);
+        try {
+            const body = (await request.json());
+            const transactionID = String(body.transactionID || '');
+            if (!transactionID)
+                throw new Error('missing transactionID');
+            const count = this.rollbackAtomicallyWithoutForeignKeys(() => {
+                this.rollbackPendingTrackedChanges(transactionID);
+                rollbackTxJournal(this.sql, transactionID);
+                return this.deletePendingTrackedChanges(transactionID);
+            });
+            this.invalidateSchemaCaches();
+            return Response.json({
+                ok: true,
+                count,
+                ...(measurements ? { writeMeasurements: measurements } : null),
+            });
+        }
+        catch (err) {
+            const budgetResponse = this.writeBudgetErrorResponse(err);
+            if (budgetResponse)
+                return budgetResponse;
+            return Response.json({ error: err.message }, { status: 500 });
+        }
+        finally {
+            if (measurements)
+                this.activeWriteMeasurements = null;
+        }
+    }
+    /**
+     * roll back orphaned transactions for a dead process generation. callers
+     * (e.g. the zero-cache embed at boot, before opening pg sessions) own the
+     * liveness guarantee: every journaled tx for `owner` is dead.
+     */
+    async handleRecoverTransactions(request) {
+        try {
+            const body = (await request.json().catch(() => ({})));
+            const owner = body.owner === undefined ? undefined : String(body.owner);
+            const transactionIDs = this.rollbackAtomicallyWithoutForeignKeys(() => {
+                const recovered = recoverTxJournal(this.sql, owner, (txID) => {
+                    this.rollbackPendingTrackedChanges(txID);
+                });
+                for (const txID of recovered)
+                    this.deletePendingTrackedChanges(txID);
+                return recovered;
+            });
+            this.invalidateSchemaCaches();
+            return Response.json({ ok: true, transactionIDs });
+        }
+        catch (err) {
+            const budgetResponse = this.writeBudgetErrorResponse(err);
+            if (budgetResponse)
+                return budgetResponse;
+            return Response.json({ error: err.message }, { status: 500 });
+        }
+    }
+    async handleChanges(request, url) {
+        try {
+            let watermark = Number(url.searchParams.get('watermark') ?? url.searchParams.get('since') ?? 0);
+            let limit = Number(url.searchParams.get('limit') ?? 1000);
+            if (request.method === 'POST') {
+                const body = (await request.json().catch(() => ({})));
+                watermark = Number(body.watermark ?? body.since ?? watermark);
+                limit = Number(body.limit ?? limit);
+            }
+            if (!Number.isFinite(watermark) || watermark < 0)
+                watermark = 0;
+            if (!Number.isFinite(limit) || limit <= 0)
+                limit = 1000;
+            const changeLimit = Math.trunc(Math.min(limit, 10_000));
+            const head = this.watermark();
+            const first = this.sql
+                .exec('SELECT MIN(watermark) AS watermark FROM _zero_changes')
+                .one();
+            const oldest = first?.watermark == null ? null : Number(first.watermark);
+            if (watermark < head && (oldest === null || oldest > watermark + 1)) {
+                return Response.json({ error: 'watermarkTooOld', watermark: head, oldestWatermark: oldest }, { status: 410 });
+            }
+            return Response.json({
+                watermark: head,
+                changes: this.readChangesSince(watermark, changeLimit),
+            });
+        }
+        catch (err) {
+            const budgetResponse = this.writeBudgetErrorResponse(err);
+            if (budgetResponse)
+                return budgetResponse;
+            return Response.json({ error: err.message }, { status: 500 });
+        }
+    }
+    async handleSnapshot(url) {
+        try {
+            const paged = url &&
+                ['table', 'cursor', 'limit'].some((parameter) => url.searchParams.has(parameter));
+            if (paged) {
+                const table = url.searchParams.get('table');
+                if (!table)
+                    return Response.json({ error: 'paged snapshot requires a table parameter' }, { status: 400 });
+                const limitValue = url.searchParams.get('limit');
+                const limit = limitValue === null ? DEFAULT_SNAPSHOT_PAGE_ROWS : Number(limitValue);
+                if (!Number.isSafeInteger(limit) ||
+                    limit <= 0 ||
+                    limit > MAX_SNAPSHOT_PAGE_ROWS) {
+                    return Response.json({
+                        error: `snapshot limit must be an integer from 1 to ${MAX_SNAPSHOT_PAGE_ROWS}`,
+                    }, { status: 400 });
+                }
+                return this.atomicallySync(() => {
+                    this.ensureSchemaMetadataTable();
+                    const schemaRow = this.sql
+                        .exec('SELECT schema_json FROM _zero_schema_tables WHERE name = ?', table)
+                        .one();
+                    if (!schemaRow?.schema_json)
+                        return Response.json({ error: `snapshot table ${JSON.stringify(table)} is not modeled` }, { status: 400 });
+                    const schema = JSON.parse(String(schemaRow.schema_json));
+                    if (!Array.isArray(schema.primaryKey) ||
+                        !schema.primaryKey.length ||
+                        schema.primaryKey.some((column) => typeof column !== 'string' || !column)) {
+                        throw new Error(`snapshot table ${JSON.stringify(table)} has no valid primary key`);
+                    }
+                    this.tableSchemas.set(table, schema);
+                    const physicalTable = schema.physicalName || table;
+                    const physicalPrimaryKey = schema.primaryKey.map((column) => schema.columns[column]?.serverName || column);
+                    const cursor = url.searchParams.get('cursor');
+                    let cursorValues = null;
+                    if (cursor !== null) {
+                        try {
+                            const decoded = JSON.parse(cursor);
+                            if (!Array.isArray(decoded) ||
+                                decoded.length !== schema.primaryKey.length ||
+                                decoded.some((value) => !['string', 'number', 'boolean'].includes(typeof value) ||
+                                    (typeof value === 'number' && !Number.isFinite(value)))) {
+                                return Response.json({ error: 'snapshot cursor does not match the table primary key' }, { status: 400 });
+                            }
+                            cursorValues = decoded;
+                        }
+                        catch {
+                            return Response.json({ error: 'snapshot cursor is invalid' }, { status: 400 });
+                        }
+                    }
+                    const primaryKey = physicalPrimaryKey.map(quoteIdent);
+                    const keyColumns = primaryKey.length === 1 ? primaryKey[0] : `(${primaryKey.join(', ')})`;
+                    const keyParams = primaryKey.length === 1 ? '?' : `(${primaryKey.map(() => '?').join(', ')})`;
+                    const where = cursorValues ? ` WHERE ${keyColumns} > ${keyParams}` : '';
+                    // one look-ahead row distinguishes an exact final page from a page
+                    // with more data without issuing an unbounded count or second read.
+                    const page = this.sql
+                        .exec(`SELECT * FROM ${quoteIdent(physicalTable)}${where} ORDER BY ${primaryKey.join(', ')} LIMIT ?`, ...(cursorValues ?? []), limit + 1)
+                        .toArray();
+                    const hasMore = page.length > limit;
+                    const rawRows = hasMore ? page.slice(0, limit) : page;
+                    let nextCursor = null;
+                    if (hasMore) {
+                        const last = rawRows[rawRows.length - 1];
+                        const values = physicalPrimaryKey.map((column) => last[column]);
+                        if (values.some((value) => !['string', 'number', 'boolean'].includes(typeof value) ||
+                            (typeof value === 'number' && !Number.isFinite(value)))) {
+                            throw new Error(`snapshot table ${JSON.stringify(table)} returned an invalid primary key`);
+                        }
+                        nextCursor = JSON.stringify(values);
+                    }
+                    return Response.json({
+                        watermark: this.watermark(),
+                        rows: rawRows.map((row) => this.normalizeRow(table, row)),
+                        nextCursor,
+                    });
+                });
+            }
+            return this.atomicallySync(() => {
+                this.ensureSchemaMetadataTable();
+                const names = this.sql
+                    .exec('SELECT name FROM _zero_schema_tables ORDER BY name')
+                    .toArray()
+                    .map((row) => String(row.name));
+                const tables = {};
+                for (const name of names) {
+                    const schema = this.schemaForTable(name);
+                    const physicalName = schema?.physicalName || name;
+                    tables[name] = this.sql
+                        .exec(`SELECT * FROM ${quoteIdent(physicalName)}`)
+                        .toArray()
+                        .map((row) => this.normalizeRow(name, row));
+                }
+                return Response.json({ watermark: this.watermark(), tables });
+            });
+        }
+        catch (err) {
+            const budgetResponse = this.writeBudgetErrorResponse(err);
+            if (budgetResponse)
+                return budgetResponse;
+            return Response.json({ error: err.message }, { status: 500 });
+        }
+    }
+    /**
+     * Run work in a storage transaction, re-deriving every in-memory schema cache
+     * from SQLite if it aborts.
+     *
+     * ctx.storage.transaction() rolls the SQLite side back on throw, but the
+     * caches are plain fields that keep asserting state SQLite no longer has: a
+     * CDC table stays "registered and verified" with no trigger left on disk, so
+     * ensureTable short-circuits and every later write to it goes silently
+     * uncaptured. The readiness flags are the same class: their CREATE TABLE is
+     * rolled back while the flag still says the table exists.
+     */
+    async atomically(work) {
+        try {
+            return await this.ctx.storage.transaction(work);
+        }
+        catch (error) {
+            this.invalidateSchemaCaches();
+            throw error;
+        }
+    }
+    /**
+     * execute trusted subclass work in this object's SQLite transaction.
+     *
+     * the method is protected so the base public fetch surface cannot invoke it.
+     * every SQL cursor is consumed before an executor promise is returned.
+     */
+    async runApplicationTransaction(compileQuery, work, queryBudget) {
+        const execute = (sql, params = [], metadata) => {
+            assertApplicationTransactionSQL(sql);
+            return this.executeSQL(sql, [...params], applicationSqlTrack(metadata));
+        };
+        const tx = {
+            async exec(sql, params = [], metadata) {
+                const result = execute(sql, params, metadata);
+                return { changes: result.changes };
+            },
+            async query(sql, params = []) {
+                return execute(sql, params).rows;
+            },
+            async queryAst(ast, format, queryName) {
+                const compiled = await compileQuery(ast, format);
+                return executeTransactionQueryPlan(compiled, (sql, params) => execute(sql, params).rows, { queryName, budget: queryBudget });
+            },
+        };
+        return this.withSchemaProvisioningWait(() => this.atomically(async () => {
+            return work(tx);
+        }));
+    }
+    assertApplicationSqlSession(session) {
+        if (session.state !== 'active' || this.activeApplicationSqlSession !== session) {
+            throw new Error('application SQLite session is not active');
+        }
+    }
+    [APPLICATION_SQL_ACQUIRE](session) {
+        if (session.state === 'active' && this.activeApplicationSqlSession === session) {
+            return true;
+        }
+        if (session.state !== 'created') {
+            throw new Error('application SQLite session cannot begin again');
+        }
+        if (this.activeApplicationSqlSession)
+            return false;
+        session.state = 'active';
+        this.activeApplicationSqlSession = session;
+        return true;
+    }
+    releaseApplicationSqlTurn(session) {
+        this.assertApplicationSqlSession(session);
+        session.state = 'closed';
+        this.activeApplicationSqlSession = null;
+    }
+    async withApplicationSqlTurn(work, signal) {
+        const session = await this.applicationSqlSession(crypto.randomUUID());
+        const dispose = () => session[Symbol.dispose]();
+        signal?.addEventListener('abort', dispose, { once: true });
+        try {
+            while (!(await session.begin())) {
+                if (signal?.aborted)
+                    throw new Error('application SQLite request was canceled');
+                await new Promise((resolve) => setTimeout(resolve, 25));
+            }
+            return await work();
+        }
+        finally {
+            signal?.removeEventListener('abort', dispose);
+            if (session.state === 'active')
+                this.releaseApplicationSqlTurn(session);
+            else if (session.state !== 'closed')
+                dispose();
+        }
+    }
+    /**
+     * drive one application SQLite session from INSIDE this durable object.
+     *
+     * identical to the client-side session helper in application-sql.ts — same
+     * ownership acquisition, same per-statement journal, same commit/rollback —
+     * except the begin poll and every statement are local calls instead of RPCs.
+     * the caller must already be running in this object.
+     */
+    async withLocalApplicationSqlSession(work) {
+        const session = await this.applicationSqlSession(crypto.randomUUID());
+        try {
+            // bounded, unlike the client-side poll. a remote caller that goes away
+            // stops polling and frees the turn; a local caller has no signal to
+            // observe, so an unbounded loop would spin for the life of the object
+            // every time somebody abandoned a request mid-reconcile.
+            const deadline = Date.now() + APPLICATION_SQL_TURN_WAIT_MS;
+            while (!(await session.begin())) {
+                if (Date.now() >= deadline) {
+                    throw new Error('timed out acquiring the application SQLite session');
+                }
+                await scheduler.wait(25);
+            }
+            const value = await work(session);
+            await session.commit();
+            return value;
+        }
+        catch (error) {
+            await session.rollback().catch(() => { });
+            throw error;
+        }
+        finally {
+            if (session.state !== 'closed')
+                session[Symbol.dispose]();
+        }
+    }
+    /**
+     * an ApplicationSqlClient bound to THIS object, for subclass work that would
+     * otherwise call back into itself over RPC.
+     *
+     * a schema migration is the motivating case: driven from a worker it costs one
+     * round trip per statement, so replaying a full migration history into a fresh
+     * namespace ran ~1000 sequential round trips and measured 35.9s wall against
+     * 2.8s of durable-object cpu — 92% of it spent idle between statements. the
+     * statements, their order and their transaction semantics are unchanged; only
+     * the transport is.
+     */
+    applicationSqlLocalClient(namespace) {
+        const run = (work) => this.withLocalApplicationSqlSession(work);
+        return {
+            namespace,
+            query: (sql, params = []) => run((session) => session.query(sql, params)),
+            exec: (sql, params = [], metadata) => run((session) => session.exec(sql, params, metadata)),
+            registerTables: (tables) => run((session) => session.registerTables(tables)),
+            transaction: (compileQuery, work, queryBudget) => run(async (session) => work({
+                exec: (sql, params = [], metadata) => session.exec(sql, params, metadata),
+                query: (sql, params = []) => session.query(sql, params),
+                registerTables: (tables) => session.registerTables(tables),
+                async queryAst(ast, format, queryName) {
+                    return session.queryPlan(await compileQuery(ast, format), queryName, queryBudget);
+                },
+            })),
+        };
+    }
+    registerApplicationSqlTables(tables) {
+        for (const table of tables) {
+            this.cdc.ensureTable({
+                physicalTableName: table.table,
+                tableName: table.publicTable,
+                ...(table.publish === false ? { publish: false } : null),
+            });
+        }
+    }
+    /**
+     * private durable object RPC surface for the application SQLite client. the
+     * disposable target exists before ownership acquisition, so waiting callers
+     * hold no server state and active cancellation rolls back the transaction.
+     * this method is intentionally absent from fetch().
+     */
+    async applicationSqlSession(sessionID) {
+        if (!sessionID)
+            throw new TypeError('application SQLite session id is required');
+        return new ApplicationSqlSessionTarget(this, sessionID);
+    }
+    prepareApplicationSqlMutation(sessionID, sql) {
+        if (!isSqlMutation(sql))
+            return false;
+        if (!isSqlRowMutation(sql)) {
+            const targets = schemaChangeTargets(sql);
+            if (/^\s*CREATE\s+TABLE\s+IF\s+NOT\s+EXISTS\b/i.test(sql) &&
+                targets.length > 0 &&
+                targets.every((table) => this.tableExists(table))) {
+                return false;
+            }
+            beginTxJournal(this.sql, sessionID, 'application');
+            snapshotTxSchema(this.sql, sessionID, 'application', targets);
+            return true;
+        }
+        beginTxJournal(this.sql, sessionID, 'application');
+        return true;
+    }
+    async [APPLICATION_SQL_QUERY](session, sql, params = []) {
+        this.assertApplicationSqlSession(session);
+        return this.atomically(() => {
+            if (this.prepareApplicationSqlMutation(session.sessionID, sql)) {
+                session.mutated = true;
+            }
+            return this.executeSQL(sql, [...params], undefined, session.sessionID).rows;
+        });
+    }
+    async [APPLICATION_SQL_EXEC](session, sql, params = [], metadata) {
+        this.assertApplicationSqlSession(session);
+        return this.atomically(() => {
+            if (this.prepareApplicationSqlMutation(session.sessionID, sql)) {
+                session.mutated = true;
+            }
+            const result = this.executeSQL(sql, [...params], applicationSqlTrack(metadata), session.sessionID);
+            if (result.changes > 0)
+                session.changed = true;
+            return { changes: result.changes };
+        });
+    }
+    async [APPLICATION_SQL_QUERY_PLAN](session, plan, queryName, queryBudget) {
+        this.assertApplicationSqlSession(session);
+        return this.atomically(() => executeTransactionQueryPlan(plan, (sql, params) => this.executeSQL(sql, params, undefined, session.sessionID).rows, { queryName, budget: queryBudget }));
+    }
+    async [APPLICATION_SQL_REGISTER_TABLES](session, tables) {
+        this.assertApplicationSqlSession(session);
+        await this.atomically(() => this.registerApplicationSqlTables(tables));
+    }
+    async [APPLICATION_SQL_COMMIT](session) {
+        this.assertApplicationSqlSession(session);
+        try {
+            if (session.mutated) {
+                await this.atomically(() => {
+                    this.commitPendingTrackedChanges(session.sessionID);
+                    commitTxJournal(this.sql, session.sessionID);
+                });
+            }
+        }
+        finally {
+            this.releaseApplicationSqlTurn(session);
+        }
+        this.applicationSqlDidCommit(session.changed, session.mutated);
+    }
+    async [APPLICATION_SQL_ROLLBACK](session) {
+        if (session.state === 'created') {
+            session.state = 'closed';
+            return;
+        }
+        this.assertApplicationSqlSession(session);
+        try {
+            if (session.mutated) {
+                this.rollbackAtomicallyWithoutForeignKeys(() => {
+                    this.rollbackPendingTrackedChanges(session.sessionID);
+                    rollbackTxJournal(this.sql, session.sessionID);
+                    this.deletePendingTrackedChanges(session.sessionID);
+                });
+                this.invalidateSchemaCaches();
+            }
+        }
+        finally {
+            this.releaseApplicationSqlTurn(session);
+        }
+    }
+    [APPLICATION_SQL_DISPOSE](session) {
+        if (session.state === 'closed')
+            return;
+        if (session.state === 'created') {
+            session.state = 'closed';
+            return;
+        }
+        this.assertApplicationSqlSession(session);
+        try {
+            if (session.mutated) {
+                this.rollbackAtomicallyWithoutForeignKeys(() => {
+                    this.rollbackPendingTrackedChanges(session.sessionID);
+                    rollbackTxJournal(this.sql, session.sessionID);
+                    this.deletePendingTrackedChanges(session.sessionID);
+                });
+                this.invalidateSchemaCaches();
+            }
+        }
+        finally {
+            this.releaseApplicationSqlTurn(session);
+        }
+    }
+    atomicallySync(work) {
+        try {
+            return this.ctx.storage.transactionSync(work);
+        }
+        catch (error) {
+            this.invalidateSchemaCaches();
+            throw error;
+        }
+    }
+    /**
+     * Run journal rollback/recovery with foreign-key enforcement off.
+     *
+     * Rollback restores pre-transaction images verbatim, so the target state is
+     * the pre-tx reality whatever its referential health. Enforcement is also
+     * fatal here: workerd always runs with foreign_keys on, and in a namespace
+     * whose parent table is missing (an interrupted table rebuild) EVERY
+     * statement on a referencing table fails at compile with "no such table:
+     * main.<parent>". That made recovery unable to ever finish, and because the
+     * storage transaction rolled the cleanup back while Cloudflare still billed
+     * the rows written, every wake re-ran the same doomed replay forever (the
+     * 2026-07-25 rows-written runaway). The pragma cannot change inside a
+     * transaction, so it brackets one synchronous transaction; the whole helper
+     * is synchronous, so no other event can execute while enforcement is off.
+     * The cursors must be consumed: workerd executes a statement only as its
+     * cursor is read, so a discarded PRAGMA cursor silently never runs.
+     */
+    rollbackAtomicallyWithoutForeignKeys(work) {
+        this.sql.exec('PRAGMA foreign_keys = OFF').toArray();
+        try {
+            return this.atomicallySync(work);
+        }
+        finally {
+            this.restoreForeignKeyEnforcement();
+        }
+    }
+    /**
+     * Measured under workerd: only the first foreign_keys change in an event
+     * applies, so the OFF above latches and an inline reset here is silently
+     * ignored — the object would then serve every later write unenforced.
+     * Verify, and when the inline reset did not stick, re-run it from
+     * blockConcurrencyWhile: the runtime defers that until the in-flight
+     * storage work is done, the same seam persistWriteBudgetTrip relies on.
+     */
+    restoreForeignKeyEnforcement() {
+        this.sql.exec('PRAGMA foreign_keys = ON').toArray();
+        const state = this.sql.exec('PRAGMA foreign_keys').one();
+        if (Number(state?.foreign_keys ?? 0) === 1)
+            return;
+        void this.ctx
+            .blockConcurrencyWhile(async () => {
+            this.sql.exec('PRAGMA foreign_keys = ON').toArray();
+        })
+            .catch((error) => {
+            console.error(JSON.stringify({
+                event: 'orez_do_foreign_keys_restore_failed',
+                message: error instanceof Error ? error.message : String(error),
+            }));
+        });
+    }
+    invalidateSchemaCaches() {
+        this.watermarks.invalidateCache();
+        this.pendingChangesSchemaReady = false;
+        // Reload is intentionally last because corrupt persisted CDC metadata must
+        // throw (fail closed), without preventing the other caches from invalidating.
+        this.cdc.reload();
+    }
+    // sync (storage.transaction-safe) column presence check for the /batch
+    // skipIfColumnExists/skipIfColumnMissing conditions. a missing table reads
+    // as "no columns", which makes ADD COLUMN skips behave like pg's
+    // IF NOT EXISTS on a table the same batch is about to create.
+    tableHasColumn(table, column) {
+        try {
+            const cursor = this.sql.exec('SELECT 1 FROM pragma_table_info(?) WHERE name = ? LIMIT 1', table, column);
+            return this.cursorRows(cursor).length > 0;
+        }
+        catch {
+            return false;
+        }
+    }
+    executeSQL(sql, params = [], track, transactionID) {
+        let capturesTrackedTable = false;
+        if (track?.physicalTableName) {
+            capturesTrackedTable = this.cdc.ensureTable({
+                physicalTableName: track.physicalTableName,
+                tableName: track.tableName,
+                ...(track.publish === false ? { publish: false } : null),
+                ...(track.rowColumns?.length ? { columns: track.rowColumns } : null),
+            });
+        }
+        else if (track) {
+            capturesTrackedTable = this.cdc.capturesTable(track.tableName);
+        }
+        // SQLite decides whether an INSERT ... ON CONFLICT write inserted or
+        // updated. Only the installed trigger sees that result. Falling back to a
+        // caller-declared operation would publish a false change shape.
+        if (track?.operation === 'UPSERT' && !capturesTrackedTable) {
+            throw new Error(`upsert requires CDC registration for ${track.tableName}`);
+        }
+        // The transaction owner marked this table row-journaled, expecting the DO to
+        // capture before/after images for it. When it cannot, that marker promises
+        // a rollback nothing can perform, so take the table snapshot the journal
+        // would otherwise have taken. It has to happen before the DML, while the
+        // table still holds its pre-transaction contents.
+        const trackedTransactionID = track ? transactionID || track.transactionID : undefined;
+        let snapshotsOwnStatement = false;
+        if (track && !capturesTrackedTable && trackedTransactionID) {
+            const physicalTableName = track.physicalTableName || stripPublicPrefix(track.tableName);
+            if (this.tableExists(physicalTableName)) {
+                upgradeToTableSnapshot(this.sql, trackedTransactionID, physicalTableName);
+            }
+        }
+        if (track && trackedTransactionID) {
+            const physicalTableName = track.physicalTableName || stripPublicPrefix(track.tableName);
+            snapshotsOwnStatement = snapshotSideEffectWriteTables(this.sql, trackedTransactionID, physicalTableName, track.operation);
+        }
+        const suspendedCdc = this.cdc.beginSchemaChange(sql);
+        let cursor;
+        try {
+            cursor = this.sql.exec(sql, ...params);
+        }
+        catch (error) {
+            // Restore capture against the unchanged schema before propagating a DDL
+            // failure. In normal /exec and /batch paths this is also protected by the
+            // surrounding storage transaction.
+            this.cdc.finishSchemaChange(suspendedCdc);
+            throw error;
+        }
+        this.cdc.finishSchemaChange(suspendedCdc);
+        const columns = Array.isArray(cursor.columnNames) ? cursor.columnNames : [];
+        const rows = this.cursorRows(cursor, columns);
+        const { mutation, rowMutation } = classifySql(sql);
+        const changes = rowMutation
+            ? Number(this.sql.exec('SELECT changes() AS changes').one()?.changes ?? 0)
+            : 0;
+        if (mutation)
+            this.writeBudget.recordLogical(rows.length);
+        if (mutation && !rowMutation)
+            this.cdc.invalidateSchema();
+        const captured = track || (this.cdc.active && rowMutation) ? this.cdc.drain() : [];
+        for (const change of captured) {
+            this.appendCapturedChange(change, transactionID || track?.transactionID, !snapshotsOwnStatement);
+        }
+        // Backward compatibility for callers that have not yet supplied the
+        // physical SQLite table identity needed to install a trigger. Once a
+        // table is registered, trigger capture is the sole source of truth and
+        // includes arbitrary business-trigger side effects.
+        //
+        // These rows carry no before-image, so they only feed the changefeed. Their
+        // rollback is owned by the table snapshot taken above, and `undoable: false`
+        // keeps the row-undo pass from trying to restore them from a wire image that
+        // cannot round-trip a blob or an int64.
+        if (track && !capturesTrackedTable) {
+            const physicalTableName = track.physicalTableName || stripPublicPrefix(track.tableName);
+            for (const row of rows) {
+                const trackedRow = trackedChangeRow(row, track);
+                const isDelete = track.operation === 'DELETE';
+                this.appendTrackedChange({
+                    tableName: track.tableName,
+                    op: isDelete ? 'DELETE' : track.operation,
+                    rowData: isDelete ? null : trackedRow,
+                    oldData: isDelete ? trackedRow : null,
+                    transactionID: transactionID || track.transactionID,
+                    physicalTableName,
+                    publish: track.publish !== false,
+                    undoable: false,
+                });
+            }
+            if (track.publish !== false)
+                this.appendDerivedTrackedChanges(track, rows);
+        }
+        const publishedCaptured = captured.filter((change) => change.publish !== false).length;
+        if (!track)
+            return { rows, columns, changes, capturedChanges: publishedCaptured };
+        return {
+            rows: track.returnRows ? rows : [],
+            columns: track.returnRows ? columns : [],
+            changes,
+            affectedRows: rows.length,
+            capturedChanges: publishedCaptured ||
+                (capturesTrackedTable || track.publish === false ? 0 : rows.length),
+        };
+    }
+    cursorRows(cursor, columns) {
+        const cols = Array.isArray(columns) && columns.length > 0 ? columns : null;
+        return cursor.toArray().map((row) => {
+            const obj = {};
+            if (cols) {
+                // include EVERY selected column, even SQL NULLs the DO cursor omits from
+                // the row object — pg/drizzle consumers index results positionally, so a
+                // dropped null column shifts every later value (e.g. trailing nullable
+                // timestamps read back undefined and crash the type decoder).
+                for (const k of cols)
+                    obj[k] = k in row ? row[k] : null;
+            }
+            else {
+                for (const k of Object.keys(row))
+                    obj[k] = row[k];
+            }
+            return obj;
+        });
+    }
+    appendDerivedTrackedChanges(track, rows) {
+        if (!rows.length)
+            return;
+        const table = stripPublicPrefix(track.tableName);
+        if (table !== 'message')
+            return;
+        const channelIds = new Set();
+        const threadIds = new Set();
+        for (const row of rows) {
+            const channelId = String(row.channelId || '');
+            const threadId = String(row.threadId || '');
+            if (this.messageRowUpdatesChannelLatestOrder(row) && channelId) {
+                channelIds.add(channelId);
+            }
+            if (this.messageRowUpdatesThreadReplyCount(row) && threadId) {
+                threadIds.add(threadId);
+            }
+        }
+        this.appendRowsAsUpdates('public.channel', 'channel', 'id', channelIds, track.transactionID);
+        this.appendRowsAsUpdates('public.thread', 'thread', 'id', threadIds, track.transactionID);
+    }
+    appendRowsAsUpdates(publicTableName, sqliteTableName, keyColumn, keys, transactionID) {
+        if (keys.size === 0)
+            return;
+        const values = [...keys];
+        const placeholders = values.map(() => '?').join(', ');
+        const rows = this.sql
+            .exec(`SELECT * FROM ${quoteIdent(sqliteTableName)} WHERE ${quoteIdent(keyColumn)} IN (${placeholders})`, ...values)
+            .toArray();
+        // Derived notifications: the rows were written by business triggers and are
+        // captured for the changefeed only. They carry no physical table name, so
+        // the row-undo pass never sees them, and their real writes are rolled back
+        // by whichever journal entry owns the table.
+        for (const row of rows) {
+            this.appendTrackedChange({
+                tableName: publicTableName,
+                op: 'UPDATE',
+                rowData: row,
+                oldData: null,
+                transactionID,
+                undoable: false,
+            });
+        }
+    }
+    messageRowUpdatesChannelLatestOrder(row) {
+        return (row.type !== 'draft' &&
+            row.type !== 'hidden' &&
+            !row.deleted &&
+            !row.isThreadReply &&
+            row.order !== null &&
+            row.order !== undefined);
+    }
+    messageRowUpdatesThreadReplyCount(row) {
+        return !!row.threadId && row.type !== 'draft' && !row.deleted && row.isThreadReply;
+    }
+    // ── CRUD operations ──────────────────────────────────────────────────────
+    applyMutation(mutation) {
+        if (mutation.type === 'crud' && mutation.name === '_zero_crud') {
+            return this.applyCrudMutation(mutation);
+        }
+        if (mutation.name === '_zero_cleanupResults')
+            return {};
+        if (mutation.type === 'custom')
+            return this.applyTableMutation(mutation);
+        return {
+            error: 'app',
+            message: `unsupported mutation ${mutation.type}:${mutation.name}`,
+        };
+    }
+    applyTableMutation(mutation) {
+        const [tableName, action] = this.tableActionFromMutationName(mutation.name);
+        if (!tableName || !action)
+            return { error: 'app', message: `invalid mutation name ${mutation.name}` };
+        if (!this.tableExists(tableName))
+            return { error: 'app', message: `unknown table ${tableName}` };
+        const value = (mutation.args[0] || {});
+        const primaryKey = this.primaryKeyForTable(tableName, []);
+        if (action === 'insert')
+            this.insertRow(tableName, value, primaryKey);
+        else if (action === 'upsert')
+            this.upsertRow(tableName, value, primaryKey);
+        else if (action === 'delete')
+            this.deleteRow(tableName, value, primaryKey);
+        else
+            this.updateRow(tableName, value, primaryKey);
+        return {};
+    }
+    tableActionFromMutationName(name) {
+        if (name.includes('|'))
+            return name.split('|', 2);
+        return name.split('.', 2);
+    }
+    tableNameFromOperationName(name) {
+        if (!name)
+            return null;
+        return name.split(/[.|]/, 1)[0] || null;
+    }
+    applyCrudMutation(mutation) {
+        const arg = mutation.args[0];
+        const ops = Array.isArray(arg?.ops) ? arg.ops : [];
+        for (const crud of ops) {
+            if (!crud?.tableName)
+                return { error: 'app', message: 'invalid crud mutation' };
+            if (!this.tableExists(crud.tableName))
+                return { error: 'app', message: `unknown table ${crud.tableName}` };
+            const value = crud.value || {};
+            const primaryKey = this.primaryKeyForTable(crud.tableName, crud.primaryKey || []);
+            if (crud.op === 'insert')
+                this.insertRow(crud.tableName, value, primaryKey);
+            else if (crud.op === 'upsert')
+                this.upsertRow(crud.tableName, value, primaryKey);
+            else if (crud.op === 'update')
+                this.updateRow(crud.tableName, value, primaryKey);
+            else if (crud.op === 'delete')
+                this.deleteRow(crud.tableName, value, primaryKey);
+        }
+        return {};
+    }
+    insertRow(tn, value, pk) {
+        if (this.readRowByPrimaryKey(tn, value, pk))
+            return;
+        const row = this.storageRow(tn, value, true);
+        const cols = Object.keys(row);
+        if (!cols.length)
+            return;
+        const qc = cols.map((c) => quoteIdent(c)).join(', ');
+        const ph = cols.map(() => '?').join(', ');
+        this.sql.exec(`INSERT INTO ${quoteIdent(tn)} (${qc}) VALUES (${ph})`, ...cols.map((c) => row[c]));
+        this.writeBudget.recordLogical(1);
+        const next = this.readRowByPrimaryKey(tn, value, pk) || this.normalizeRow(tn, row);
+        this.appendChange(tn, 'INSERT', next, null);
+    }
+    upsertRow(tn, value, pk) {
+        const existing = this.readRowByPrimaryKey(tn, value, pk);
+        if (existing) {
+            this.updateRow(tn, value, pk);
+            return;
+        }
+        this.insertRow(tn, value, pk);
+    }
+    updateRow(tn, value, pk) {
+        if (!pk.length)
+            return;
+        const existing = this.readRowByPrimaryKey(tn, value, pk);
+        if (!existing)
+            return;
+        const nk = Object.keys(value).filter((c) => !pk.includes(c));
+        if (!nk.length)
+            return;
+        const storage = this.storageRow(tn, value, false);
+        this.sql.exec(`UPDATE ${quoteIdent(tn)} SET ${nk.map((c) => `${quoteIdent(c)} = ?`).join(', ')} WHERE ${this.primaryKeyWhere(pk)}`, ...nk.map((c) => storage[c]), ...pk.map((c) => this.storageColumnValue(tn, c, value[c])));
+        this.writeBudget.recordLogical(1);
+        const next = this.readRowByPrimaryKey(tn, value, pk);
+        if (next)
+            this.appendChange(tn, 'UPDATE', next, existing);
+    }
+    deleteRow(tn, value, pk) {
+        if (!pk.length)
+            return;
+        const existing = this.readRowByPrimaryKey(tn, value, pk);
+        if (!existing)
+            return;
+        this.sql.exec(`DELETE FROM ${quoteIdent(tn)} WHERE ${this.primaryKeyWhere(pk)}`, ...pk.map((c) => this.storageColumnValue(tn, c, value[c])));
+        this.writeBudget.recordLogical(1);
+        this.appendChange(tn, 'DELETE', null, existing);
+    }
+    appendChange(tn, op, rowData, oldData) {
+        this.appendTrackedChange({ tableName: tn, op, rowData, oldData });
+    }
+    /** Record a trigger-captured change, before-images and row identity included. */
+    appendCapturedChange(change, transactionID, undoable = true) {
+        this.appendTrackedChange({
+            tableName: change.tableName,
+            op: change.op,
+            rowData: change.rowData,
+            oldData: change.oldData,
+            transactionID,
+            physicalTableName: change.physicalTableName,
+            publish: change.publish !== false,
+            rowJournal: change.rowJournal,
+            oldJournal: change.oldJournal,
+            newRowid: change.newRowid,
+            oldRowid: change.oldRowid,
+            undoable,
+        });
+    }
+    appendTrackedChange(change) {
+        const publish = change.publish !== false;
+        if (!publish && !change.transactionID)
+            return;
+        if (change.transactionID) {
+            this.ensurePendingTrackedChangesTable();
+            appendPendingChange(this.sql, {
+                transactionID: change.transactionID,
+                physicalTableName: change.physicalTableName,
+                tableName: change.tableName,
+                publish,
+                op: change.op,
+                rowData: change.rowData,
+                oldData: change.oldData,
+                rowJournal: change.rowJournal ?? null,
+                oldJournal: change.oldJournal ?? null,
+                newRowid: change.newRowid ?? null,
+                oldRowid: change.oldRowid ?? null,
+                undoable: change.undoable === true,
+            });
+            return;
+        }
+        this.appendCommittedTrackedChange(change.tableName, change.op, change.rowData, change.oldData);
+    }
+    appendCommittedTrackedChange(tableName, op, rowData, oldData) {
+        this.watermarks.ensureTables();
+        const watermark = this.watermarks.next();
+        this.sql.exec('INSERT INTO _zero_changes (watermark, table_name, op, row_data, old_data) VALUES (?, ?, ?, ?, ?)', watermark, tableName, op, rowData ? JSON.stringify(rowData) : null, oldData ? JSON.stringify(oldData) : null);
+        this.watermarks.mark(watermark);
+    }
+    ensurePendingTrackedChangesTable() {
+        if (this.pendingChangesSchemaReady)
+            return;
+        ensurePendingChangesTable(this.sql);
+        this.pendingChangesSchemaReady = true;
+    }
+    rollbackPendingTrackedChanges(transactionID) {
+        this.ensurePendingTrackedChangesTable();
+        return rollbackPendingChanges(this.sql, transactionID);
+    }
+    commitPendingTrackedChanges(transactionID) {
+        this.ensurePendingTrackedChangesTable();
+        this.watermarks.ensureTables();
+        const rows = this.sql
+            .exec(`INSERT INTO _zero_changes (table_name, op, row_data, old_data)
+         SELECT table_name, op, row_data, old_data
+         FROM _zero_pending_changes
+         WHERE transaction_id = ? AND publish != 0
+         ORDER BY id
+         RETURNING watermark`, transactionID)
+            .toArray();
+        let watermark = 0;
+        for (const row of rows)
+            watermark = Math.max(watermark, Number(row.watermark ?? 0));
+        if (watermark > 0) {
+            this.watermarks.mark(watermark);
+        }
+        this.deletePendingTrackedChanges(transactionID);
+        return rows.length;
+    }
+    deletePendingTrackedChanges(transactionID) {
+        this.ensurePendingTrackedChangesTable();
+        return deletePendingChanges(this.sql, transactionID);
+    }
+    readChangesSince(watermark, limit) {
+        this.watermarks.ensureTables();
+        const statement = 'SELECT watermark, table_name, op, row_data, old_data FROM _zero_changes WHERE watermark > ? ORDER BY watermark' +
+            (limit === undefined ? '' : ' LIMIT ?');
+        const params = limit === undefined ? [watermark] : [watermark, limit];
+        return this.sql
+            .exec(statement, ...params)
+            .toArray()
+            .map((row) => {
+            const tableName = String(row.table_name);
+            const rowData = row.row_data ? JSON.parse(String(row.row_data)) : null;
+            const oldData = row.old_data ? JSON.parse(String(row.old_data)) : null;
+            return {
+                watermark: Number(row.watermark),
+                tableName,
+                op: String(row.op),
+                rowData: rowData ? this.normalizeRow(tableName, rowData) : null,
+                oldData: oldData ? this.normalizeRow(tableName, oldData) : null,
+            };
+        });
+    }
+    watermark() {
+        return this.watermarks.current();
+    }
+    ensureSchemaTables(clientSchema) {
+        this.ensureSchemaMetadataTable();
+        for (const [name, def] of Object.entries(clientSchema.tables)) {
+            this.tableSchemas.set(name, def);
+            this.createSchemaTable(name, def);
+            this.ensureSchemaColumns(name, def);
+            this.sql.exec('INSERT OR REPLACE INTO _zero_schema_tables (name, schema_json) VALUES (?, ?)', name, JSON.stringify(def));
+            this.schemaTables.add(name);
+        }
+    }
+    createSchemaTable(name, def) {
+        const pk = def.primaryKey.map((c) => quoteIdent(c));
+        const pkClause = pk.length ? `, PRIMARY KEY (${pk.join(', ')})` : '';
+        const colDefs = Object.entries(def.columns).map(([cn, cd]) => `${quoteIdent(cn)} ${sqliteTypeForSchemaColumn(cd.type)}`);
+        this.sql.exec(`CREATE TABLE IF NOT EXISTS ${quoteIdent(name)} (${colDefs.join(', ')}${pkClause})`);
+    }
+    ensureSchemaColumns(name, def) {
+        const existing = this.columnNamesForTable(name);
+        for (const [columnName, column] of Object.entries(def.columns)) {
+            if (existing.has(columnName))
+                continue;
+            this.sql.exec(`ALTER TABLE ${quoteIdent(name)} ADD COLUMN ${quoteIdent(columnName)} ${sqliteTypeForSchemaColumn(column.type)}`);
+        }
+    }
+    columnNamesForTable(name) {
+        try {
+            return new Set(this.sql
+                .exec(`PRAGMA table_info(${quoteIdent(name)})`)
+                .toArray()
+                .map((row) => String(row.name)));
+        }
+        catch {
+            return new Set();
+        }
+    }
+    ensureSchemaMetadataTable() {
+        this.sql.exec('CREATE TABLE IF NOT EXISTS _zero_schema_tables (name TEXT PRIMARY KEY, schema_json TEXT NOT NULL)');
+    }
+    schemaForTable(tableName) {
+        const schemaTableName = stripPublicPrefix(tableName);
+        const tableSchemas = (this.tableSchemas ??= new Map());
+        const cached = tableSchemas.get(schemaTableName);
+        if (cached)
+            return cached;
+        try {
+            this.ensureSchemaMetadataTable();
+            const row = this.sql
+                .exec('SELECT schema_json FROM _zero_schema_tables WHERE name = ?', schemaTableName)
+                .one();
+            if (!row?.schema_json)
+                return undefined;
+            const schema = JSON.parse(String(row.schema_json));
+            tableSchemas.set(schemaTableName, schema);
+            return schema;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    tableExists(n) {
+        try {
+            return !!this.sql
+                .exec("SELECT name FROM sqlite_master WHERE type='table' AND name=?", n)
+                .one();
+        }
+        catch {
+            return false;
+        }
+    }
+    readAllRows(tn) {
+        return this.sql
+            .exec(`SELECT * FROM ${quoteIdent(tn)}`)
+            .toArray()
+            .map((row) => this.normalizeRow(tn, row));
+    }
+    readRowByPrimaryKey(tn, value, pk) {
+        if (!pk.length)
+            return null;
+        try {
+            const row = this.sql
+                .exec(`SELECT * FROM ${quoteIdent(tn)} WHERE ${this.primaryKeyWhere(pk)}`, ...pk.map((c) => this.storageColumnValue(tn, c, value[c])))
+                .one();
+            return row ? this.normalizeRow(tn, row) : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    primaryKeyWhere(pk) {
+        return pk.map((c) => `${quoteIdent(c)} = ?`).join(' AND ');
+    }
+    primaryKeyForTable(tn, fallback) {
+        const schema = this.schemaForTable(tn);
+        if (schema?.primaryKey?.length)
+            return schema.primaryKey;
+        return fallback;
+    }
+    storageRow(tn, value, includeMissingSchemaColumns) {
+        const schema = this.schemaForTable(tn);
+        const row = {};
+        if (schema && includeMissingSchemaColumns) {
+            for (const column of Object.keys(schema.columns))
+                row[column] = this.storageColumnValue(tn, column, value[column] ?? null);
+        }
+        for (const column of Object.keys(value)) {
+            if (value[column] !== undefined)
+                row[column] = this.storageColumnValue(tn, column, value[column]);
+        }
+        return row;
+    }
+    storageColumnValue(tn, column, value) {
+        if (value === undefined || value === null)
+            return null;
+        const schema = this.schemaForTable(tn);
+        const type = schema?.columns?.[column]?.type ??
+            Object.values(schema?.columns ?? {}).find((candidate) => candidate.serverName === column)?.type;
+        if (type === 'boolean')
+            return value ? 1 : 0;
+        if (type === 'json')
+            return typeof value === 'string' ? value : JSON.stringify(value);
+        if (type === 'number')
+            return Number(value);
+        if (type === 'bigint')
+            return String(value);
+        return value;
+    }
+    normalizeRow(tn, row) {
+        const schema = this.schemaForTable(tn);
+        const normalized = {};
+        for (const key of Object.keys(row)) {
+            const type = schema?.columns?.[key]?.type ??
+                Object.values(schema?.columns ?? {}).find((candidate) => candidate.serverName === key)?.type;
+            const value = row[key];
+            if (value === null || value === undefined) {
+                normalized[key] = null;
+            }
+            else if (type === 'boolean') {
+                normalized[key] =
+                    value === true || value === 1 || value === '1' || value === 'true';
+            }
+            else if (type === 'number') {
+                // timestamp/timestamptz columns are declared `number` in the zero
+                // schema but may be stored as timestamp text (for example
+                // "2026-07-11 13:34:46.000+00"). Coercing
+                // that text with Number() yields NaN, which JSON serializes as null and
+                // silently wipes every timestamp reaching the sync-cf-host snapshot
+                // feed. Forward a non-numeric value untouched so the engine's
+                // timestamp_text_to_epoch_ms decodes it, matching the /changes feed
+                // which forwards the raw text.
+                const numeric = Number(value);
+                normalized[key] = Number.isFinite(numeric) ? numeric : value;
+            }
+            else if (type === 'json' && typeof value === 'string') {
+                try {
+                    normalized[key] = JSON.parse(value);
+                }
+                catch {
+                    normalized[key] = value;
+                }
+            }
+            else {
+                normalized[key] = value;
+            }
+        }
+        return normalized;
+    }
+    sendSyncPoke(socket, attachment, part) {
+        const cookie = this.nextCookie();
+        const pokeID = crypto.randomUUID();
+        this.sendJSON(socket, [
+            'pokeStart',
+            {
+                pokeID,
+                baseCookie: attachment.cookie,
+                schemaVersions: {
+                    minSupportedVersion: SCHEMA_VERSION,
+                    maxSupportedVersion: SCHEMA_VERSION,
+                },
+                timestamp: Date.now(),
+            },
+        ]);
+        this.sendJSON(socket, ['pokePart', { pokeID, ...part }]);
+        this.sendJSON(socket, ['pokeEnd', { pokeID, cookie }]);
+        const nextAttachment = { ...attachment, cookie };
+        socket.serializeAttachment(nextAttachment);
+        return nextAttachment;
+    }
+    broadcastPoke(clientGroupID, part) {
+        for (const socket of this.ctx.getWebSockets()) {
+            const ws = socket;
+            const attachment = this.readSocketAttachment(ws);
+            if (!attachment)
+                continue;
+            if (attachment.clientGroupID !== clientGroupID)
+                continue;
+            this.sendSyncPoke(ws, attachment, part);
+        }
+    }
+    broadcastMutationPoke(sourceAttachment, part) {
+        const rowsPatch = part.rowsPatch || [];
+        const changedTables = new Set(rowsPatch
+            .map((op) => op?.tableName)
+            .filter((tableName) => !!tableName));
+        const hasLastMutationIDChanges = Object.keys(part.lastMutationIDChanges || {}).length > 0;
+        for (const socket of this.ctx.getWebSockets()) {
+            const ws = socket;
+            const attachment = this.readSocketAttachment(ws);
+            if (!attachment)
+                continue;
+            if (attachment.userID !== sourceAttachment.userID)
+                continue;
+            const isSourceClientGroup = attachment.clientGroupID === sourceAttachment.clientGroupID;
+            const wantsChangedRows = changedTables.size > 0 &&
+                attachment.desiredTableNames.some((tableName) => changedTables.has(tableName));
+            const nextPart = {};
+            if (wantsChangedRows)
+                nextPart.rowsPatch = rowsPatch;
+            if (isSourceClientGroup && hasLastMutationIDChanges)
+                nextPart.lastMutationIDChanges = part.lastMutationIDChanges;
+            if (!nextPart.rowsPatch && !nextPart.lastMutationIDChanges)
+                continue;
+            this.sendSyncPoke(ws, attachment, nextPart);
+        }
+    }
+    syncRowPatchFromChange(change) {
+        if (change.op === 'DELETE')
+            return {
+                op: 'del',
+                tableName: change.tableName,
+                id: this.primaryKeyValue(change.tableName, change.oldData || {}),
+            };
+        return {
+            op: 'put',
+            tableName: change.tableName,
+            value: this.normalizeRow(change.tableName, change.rowData || {}),
+        };
+    }
+    primaryKeyValue(tableName, row) {
+        const pk = this.primaryKeyForTable(tableName, []);
+        if (pk.length)
+            return Object.fromEntries(pk.map((column) => [column, row[column]]));
+        if ('id' in row)
+            return { id: row.id };
+        return row;
+    }
+    cookie() {
+        return String(this.watermark()).padStart(20, '0');
+    }
+    nextCookie() {
+        const watermark = this.watermarks.next();
+        this.watermarks.mark(watermark);
+        return String(watermark).padStart(20, '0');
+    }
+    readSocketAttachment(socket) {
+        const attachment = socket.deserializeAttachment();
+        if (!attachment)
+            return null;
+        return {
+            ...attachment,
+            initialized: attachment.initialized === true,
+            desiredTableNames: attachment.desiredTableNames || [],
+            desiredQueries: attachment.desiredQueries || [],
+        };
+    }
+    sendJSON(socket, msg) {
+        try {
+            socket.send(JSON.stringify(msg));
+        }
+        catch { }
+    }
+    parseMessage(data) {
+        try {
+            return JSON.parse(typeof data === 'string' ? data : new TextDecoder().decode(data));
+        }
+        catch {
+            return null;
+        }
+    }
+}
+export default {
+    async fetch(request, env) {
+        // every endpoint is served by the one singleton ZeroDO (its fetch() does the
+        // routing, CORS preflight, and 404s). forward unconditionally rather than
+        // re-listing each path here — a second route table only drifts from the DO's.
+        const id = env.ZERO_DO.idFromName('singleton');
+        return env.ZERO_DO.get(id).fetch(request);
+    },
+};
+function decodeInitConnection(secProtocol) {
+    try {
+        const decoded = decodeURIComponent(secProtocol);
+        const bytes = Uint8Array.from(atob(decoded), (char) => char.charCodeAt(0));
+        const protocols = JSON.parse(new TextDecoder().decode(bytes));
+        const message = protocols.initConnectionMessage;
+        if (Array.isArray(message) && message[0] === 'initConnection') {
+            return message;
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=worker.js.map