orez 0.4.40 → 0.4.41

package/dist/zero-litestream-patch.d.ts

@@ -1,29 +1,39 @@
 /**
  * neutralize zero-cache's litestream replica restore for orez.
  *
- * zero 1.5's dedicated change-streamer worker unconditionally calls
- * `restoreReplica()` on startup whenever the change-log already has rows
- * (i.e. on every restart after the first replication). it assumes a litestream
- * backup exists to restore the SQLite replica from. orez has no litestream
- * backup — it owns the replica on disk directly — so the restore throws
- * "Missing --litestream-executable" (or "Missing required value" for the backup
- * URL), which zero logs as an error and "recovers" from by wastefully
- * re-syncing the entire replica from scratch.
+ * zero's dedicated change-streamer worker unconditionally calls
+ * `restoreReplica()` on startup whenever the change-log already has rows.
+ * it assumes a litestream backup exists to restore the SQLite replica from.
+ * orez has no litestream backup — it owns the replica on disk directly — so
+ * without a guard the restore throws "Missing --litestream-executable" (or
+ * "Missing required value" for the backup URL) after a retry, which zero
+ * logs at error level on every warm restart.
  *
  * the correct config gate doesn't exist for the dedicated change-streamer:
- *   - leaving litestream unconfigured -> the error above + resync.
+ *   - leaving litestream unconfigured -> the noisy double-attempt error above.
  *   - setting ZERO_LITESTREAM_BACKUP_URL to satisfy the restore -> switches the
  *     replicator into "serving-copy" mode (VACUUM INTO a copy on every start)
  *     and spawns a backup worker + litestream `replicate` subprocess. wrong for
  *     an ephemeral dev backend.
  *
- * so we patch the compiled `restoreReplica` to be a no-op when no litestream
- * backup URL is configured. zero's own dispatcher (`main.js`) already gates all
- * backup/restore work behind `litestream.backupURL`; this brings the dedicated
- * change-streamer in line. a no-op restore leaves orez's existing local replica
- * in place with the purge-lock held — identical to the path where a real
- * restore found a backup matching the current replica — so the change-streamer
- * resumes from the local replica and releases the lock on ownership assumption.
+ * so we patch the compiled `restoreReplica` for the no-backup case. the guard
+ * must preserve upstream's LOCK-RELEASE semantics, not just silence the error:
+ * the change-streamer acquires a changeLog purge lock before restoring — an
+ * open `SELECT ... FOR SHARE` transaction, which holds a real xid — and its
+ * caller only releases that lock when restoreReplica THROWS. a plain
+ * `return` here (the original v1 guard) kept the lock held into
+ * `initializePostgresChangeSource`; whenever the local replica was missing
+ * (unclean shutdown, cache-only reset), initial sync then ran with the lock
+ * still open and `CREATE_REPLICATION_SLOT` waited on our own transaction's
+ * xid — a deterministic self-deadlock, crash-looping the change-streamer on
+ * `ensureSchemaMigrated`/55P03 lock timeouts until the change db was dropped.
+ *
+ * throwing `BackupNotFoundException` mirrors what unpatched zero does when
+ * litestream config is absent (its `must(backupURL)` throws and the caller
+ * releases the lock, logs at warn, and proceeds): a valid local replica is
+ * resumed exactly as before, an invalid/missing one initial-syncs lock-free.
+ * the purge lock only exists to fence multi-node purge races during a real
+ * backup restore; single-node orez has neither.
  *
  * this mirrors orez's existing in-place patching of @rocicorp/zero-sqlite3
  * (see sqlite-mode/apply-mode.ts). it is idempotent and only touches orez's
@@ -33,7 +43,7 @@
 /**
  * apply the restore-guard to a specific compiled litestream commands.js —
  * shared by the in-place node path and the CF overlay (cf-patches.ts).
- * idempotent.
+ * idempotent; upgrades a v1 guard in place.
  */
 export declare function applyLitestreamRestoreGuard(commandsPath: string): void;
 /**

package/dist/zero-litestream-patch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"zero-litestream-patch.d.ts","sourceRoot":"","sources":["../src/zero-litestream-patch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAwCH;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAgBtE;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,IAAI,IAAI,CAInD"}
+{"version":3,"file":"zero-litestream-patch.d.ts","sourceRoot":"","sources":["../src/zero-litestream-patch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAmDH;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CA8BtE;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,IAAI,IAAI,CAInD"}

package/dist/zero-litestream-patch.js

@@ -1,29 +1,39 @@
 /**
  * neutralize zero-cache's litestream replica restore for orez.
  *
- * zero 1.5's dedicated change-streamer worker unconditionally calls
- * `restoreReplica()` on startup whenever the change-log already has rows
- * (i.e. on every restart after the first replication). it assumes a litestream
- * backup exists to restore the SQLite replica from. orez has no litestream
- * backup — it owns the replica on disk directly — so the restore throws
- * "Missing --litestream-executable" (or "Missing required value" for the backup
- * URL), which zero logs as an error and "recovers" from by wastefully
- * re-syncing the entire replica from scratch.
+ * zero's dedicated change-streamer worker unconditionally calls
+ * `restoreReplica()` on startup whenever the change-log already has rows.
+ * it assumes a litestream backup exists to restore the SQLite replica from.
+ * orez has no litestream backup — it owns the replica on disk directly — so
+ * without a guard the restore throws "Missing --litestream-executable" (or
+ * "Missing required value" for the backup URL) after a retry, which zero
+ * logs at error level on every warm restart.
  *
  * the correct config gate doesn't exist for the dedicated change-streamer:
- *   - leaving litestream unconfigured -> the error above + resync.
+ *   - leaving litestream unconfigured -> the noisy double-attempt error above.
  *   - setting ZERO_LITESTREAM_BACKUP_URL to satisfy the restore -> switches the
  *     replicator into "serving-copy" mode (VACUUM INTO a copy on every start)
  *     and spawns a backup worker + litestream `replicate` subprocess. wrong for
  *     an ephemeral dev backend.
  *
- * so we patch the compiled `restoreReplica` to be a no-op when no litestream
- * backup URL is configured. zero's own dispatcher (`main.js`) already gates all
- * backup/restore work behind `litestream.backupURL`; this brings the dedicated
- * change-streamer in line. a no-op restore leaves orez's existing local replica
- * in place with the purge-lock held — identical to the path where a real
- * restore found a backup matching the current replica — so the change-streamer
- * resumes from the local replica and releases the lock on ownership assumption.
+ * so we patch the compiled `restoreReplica` for the no-backup case. the guard
+ * must preserve upstream's LOCK-RELEASE semantics, not just silence the error:
+ * the change-streamer acquires a changeLog purge lock before restoring — an
+ * open `SELECT ... FOR SHARE` transaction, which holds a real xid — and its
+ * caller only releases that lock when restoreReplica THROWS. a plain
+ * `return` here (the original v1 guard) kept the lock held into
+ * `initializePostgresChangeSource`; whenever the local replica was missing
+ * (unclean shutdown, cache-only reset), initial sync then ran with the lock
+ * still open and `CREATE_REPLICATION_SLOT` waited on our own transaction's
+ * xid — a deterministic self-deadlock, crash-looping the change-streamer on
+ * `ensureSchemaMigrated`/55P03 lock timeouts until the change db was dropped.
+ *
+ * throwing `BackupNotFoundException` mirrors what unpatched zero does when
+ * litestream config is absent (its `must(backupURL)` throws and the caller
+ * releases the lock, logs at warn, and proceeds): a valid local replica is
+ * resumed exactly as before, an invalid/missing one initial-syncs lock-free.
+ * the purge lock only exists to fence multi-node purge races during a real
+ * backup restore; single-node orez has neither.
  *
  * this mirrors orez's existing in-place patching of @rocicorp/zero-sqlite3
  * (see sqlite-mode/apply-mode.ts). it is idempotent and only touches orez's
@@ -33,11 +43,21 @@
 import { existsSync, readFileSync, writeFileSync } from 'node:fs';
 import { dirname, resolve } from 'node:path';
 import { resolvePackage } from './sqlite-mode/package-resolve.js';
-const OREZ_MARKER = '/* orez: litestream restore disabled (no backup configured) */';
-// the early-return guard injected at the top of restoreReplica's body. when
-// no backup URL is configured there is nothing to restore, so the local
-// replica is used as-is and the change-streamer resumes from it.
-const GUARD = `${OREZ_MARKER}\n\tif (!config.litestream?.backupURL) return;`;
+const OREZ_MARKER = '/* orez: litestream restore disabled (no backup configured) — v2 */';
+// the previous guard generation: silenced the error but swallowed the throw
+// the caller relies on to release the changeLog purge lock (see header).
+// stripped on sight so upgrades replace it instead of stacking guards.
+const OREZ_MARKER_V1 = '/* orez: litestream restore disabled (no backup configured) */';
+const GUARD_V1 = `${OREZ_MARKER_V1}\n\tif (!config.litestream?.backupURL) return;`;
+// the guard injected at the top of restoreReplica's body. when no backup URL
+// is configured there is nothing to restore; surfacing not-found makes the
+// caller release the purge lock before any initial sync (the deadlock fix),
+// while callers without a lock (replicaConstraints == null) just proceed.
+const GUARD = `${OREZ_MARKER}
+	if (!config.litestream?.backupURL) {
+		if (replicaConstraints) throw new BackupNotFoundException("(litestream disabled)");
+		return;
+	}`;
 /** locate the compiled litestream commands.js inside the resolved @rocicorp/zero */
 function findLitestreamCommands() {
     const zeroEntry = resolvePackage('@rocicorp/zero');
@@ -58,12 +78,24 @@ function findLitestreamCommands() {
 /**
  * apply the restore-guard to a specific compiled litestream commands.js —
  * shared by the in-place node path and the CF overlay (cf-patches.ts).
- * idempotent.
+ * idempotent; upgrades a v1 guard in place.
  */
 export function applyLitestreamRestoreGuard(commandsPath) {
-    const content = readFileSync(commandsPath, 'utf-8');
-    if (content.includes(OREZ_MARKER))
+    let content = readFileSync(commandsPath, 'utf-8');
+    // strip the v1 guard BEFORE the already-patched check: a v1-era orez run
+    // against an already-v2-patched file re-injects v1 above the v2 guard
+    // (its marker check doesn't recognize v2), and v1's early `return` then
+    // shadows the fix. checking the v2 marker first would return early here
+    // and leave that stacked v1 in place. observed live on 2026-07-07.
+    const hadV1 = content.includes(GUARD_V1);
+    if (hadV1) {
+        content = content.replace(`\n\t${GUARD_V1}`, '');
+    }
+    if (content.includes(OREZ_MARKER)) {
+        if (hadV1)
+            writeFileSync(commandsPath, content);
         return; // already patched
+    }
     const anchor = 'async function restoreReplica(lc, config, replicaConstraints) {';
     if (!content.includes(anchor)) {
         // upstream shape changed — fail loudly rather than silently leaving the

package/dist/zero-litestream-patch.js.map

@@ -1 +1 @@
-{"version":3,"file":"zero-litestream-patch.js","sourceRoot":"","sources":["../src/zero-litestream-patch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AACjE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAE5C,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAA;AAEjE,MAAM,WAAW,GAAG,gEAAgE,CAAA;AAEpF,4EAA4E;AAC5E,wEAAwE;AACxE,iEAAiE;AACjE,MAAM,KAAK,GAAG,GAAG,WAAW,gDAAgD,CAAA;AAE5E,oFAAoF;AACpF,SAAS,sBAAsB;IAC7B,MAAM,SAAS,GAAG,cAAc,CAAC,gBAAgB,CAAC,CAAA;IAClD,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAA;IAE3B,8EAA8E;IAC9E,sEAAsE;IACtE,IAAI,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC,CAAA;IAC5B,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC;QACxD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QACjC,IAAI,MAAM,KAAK,GAAG;YAAE,MAAK;QACzB,GAAG,GAAG,MAAM,CAAA;IACd,CAAC;IAED,MAAM,YAAY,GAAG,OAAO,CAC1B,GAAG,EACH,KAAK,EACL,YAAY,EACZ,KAAK,EACL,UAAU,EACV,YAAY,EACZ,aAAa,CACd,CAAA;IACD,OAAO,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAA;AACvD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CAAC,YAAoB;IAC9D,MAAM,OAAO,GAAG,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAA;IACnD,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAM,CAAC,kBAAkB;IAE5D,MAAM,MAAM,GAAG,iEAAiE,CAAA;IAChF,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,wEAAwE;QACxE,yDAAyD;QACzD,MAAM,IAAI,KAAK,CACb,+FAA+F,YAAY,IAAI;YAC7G,mEAAmE,CACtE,CAAA;IACH,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,MAAM,OAAO,KAAK,EAAE,CAAC,CAAA;IAChE,aAAa,CAAC,YAAY,EAAE,OAAO,CAAC,CAAA;AACtC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,4BAA4B;IAC1C,MAAM,YAAY,GAAG,sBAAsB,EAAE,CAAA;IAC7C,IAAI,CAAC,YAAY;QAAE,OAAM;IACzB,2BAA2B,CAAC,YAAY,CAAC,CAAA;AAC3C,CAAC"}
+{"version":3,"file":"zero-litestream-patch.js","sourceRoot":"","sources":["../src/zero-litestream-patch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AACjE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAE5C,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAA;AAEjE,MAAM,WAAW,GAAG,qEAAqE,CAAA;AAEzF,4EAA4E;AAC5E,yEAAyE;AACzE,uEAAuE;AACvE,MAAM,cAAc,GAAG,gEAAgE,CAAA;AACvF,MAAM,QAAQ,GAAG,GAAG,cAAc,gDAAgD,CAAA;AAElF,6EAA6E;AAC7E,2EAA2E;AAC3E,4EAA4E;AAC5E,0EAA0E;AAC1E,MAAM,KAAK,GAAG,GAAG,WAAW;;;;GAIzB,CAAA;AAEH,oFAAoF;AACpF,SAAS,sBAAsB;IAC7B,MAAM,SAAS,GAAG,cAAc,CAAC,gBAAgB,CAAC,CAAA;IAClD,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAA;IAE3B,8EAA8E;IAC9E,sEAAsE;IACtE,IAAI,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC,CAAA;IAC5B,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC;QACxD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QACjC,IAAI,MAAM,KAAK,GAAG;YAAE,MAAK;QACzB,GAAG,GAAG,MAAM,CAAA;IACd,CAAC;IAED,MAAM,YAAY,GAAG,OAAO,CAC1B,GAAG,EACH,KAAK,EACL,YAAY,EACZ,KAAK,EACL,UAAU,EACV,YAAY,EACZ,aAAa,CACd,CAAA;IACD,OAAO,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAA;AACvD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CAAC,YAAoB;IAC9D,IAAI,OAAO,GAAG,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAA;IAEjD,yEAAyE;IACzE,sEAAsE;IACtE,wEAAwE;IACxE,wEAAwE;IACxE,mEAAmE;IACnE,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;IACxC,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAA;IAClD,CAAC;IAED,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAClC,IAAI,KAAK;YAAE,aAAa,CAAC,YAAY,EAAE,OAAO,CAAC,CAAA;QAC/C,OAAM,CAAC,kBAAkB;IAC3B,CAAC;IAED,MAAM,MAAM,GAAG,iEAAiE,CAAA;IAChF,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,wEAAwE;QACxE,yDAAyD;QACzD,MAAM,IAAI,KAAK,CACb,+FAA+F,YAAY,IAAI;YAC7G,mEAAmE,CACtE,CAAA;IACH,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,MAAM,OAAO,KAAK,EAAE,CAAC,CAAA;IAChE,aAAa,CAAC,YAAY,EAAE,OAAO,CAAC,CAAA;AACtC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,4BAA4B;IAC1C,MAAM,YAAY,GAAG,sBAAsB,EAAE,CAAA;IAC7C,IAAI,CAAC,YAAY;QAAE,OAAM;IACzB,2BAA2B,CAAC,YAAY,CAAC,CAAA;AAC3C,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "orez",
-  "version": "0.4.40",
+  "version": "0.4.41",
   "description": "PGlite-powered zero-sync development backend. No Docker required.",
   "type": "module",
   "license": "MIT",
@@ -87,7 +87,7 @@
     "@electric-sql/pglite": "0.4.1",
     "@electric-sql/pglite-tools": "^0.3.1",
     "@pgsql/traverse": "17.2.6",
-    "bedrock-sqlite": "0.4.40",
+    "bedrock-sqlite": "0.4.41",
     "citty": "^0.2.0",
     "pg-gateway": "0.3.0-beta.4",
     "pgsql-parser": "^17.9.11",