@harperfast/rocksdb-js 2.3.0 → 2.5.0

package/dist/index.mjs

@@ -1,15 +1,15 @@
 import { createRequire } from "node:module";
 import { execSync } from "node:child_process";
 import { closeSync, existsSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, statSync } from "node:fs";
-import { dirname, join, resolve } from "node:path";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
-import { mkdir } from "node:fs/promises";
+import { access, cp, mkdir, readdir, rm } from "node:fs/promises";
 import * as orderedBinary from "ordered-binary";
 import { ExtendedIterable } from "@harperfast/extended-iterable";
 import { Encoder } from "msgpackr";
 
 //#region \0rolldown/runtime.js
-var __require = /* @__PURE__ */ createRequire(import.meta.url);
+var __require = /* #__PURE__ */ (() => createRequire(import.meta.url))();
 
 //#endregion
 //#region src/load-binding.ts
@@ -89,16 +89,248 @@ const coolTransactionLogs = binding.coolTransactionLogs;
 * the underlying mapping rather than leaving it retained.
 */
 const transactionLogMapCount = binding.transactionLogMapCount;
+/**
+* Test-only: force the next `count` transaction commits to fail with TryAgain (rolled back, so
+* no data is committed), reproducing a stranded-snapshot conflict deterministically. Pass 0 to
+* disarm. Used by the ERR_TRY_AGAIN retry regression test.
+*/
+const forceTryAgainForTesting = binding.forceTryAgainForTesting;
+/**
+* Creates a native file lock using the specified file path (`flock` on POSIX,
+* `LockFileEx` on Windows), creating the file and any missing parent
+* directories. Exclusive by default; pass `shared` for a shared (reader) lock
+* that coexists with other shared holders but conflicts with an exclusive
+* holder in either direction. Returns an opaque non-zero token to pass to
+* `fileLockRelease`, or `0` if a conflicting holder — in any process,
+* container, or worker thread — currently has it. Throws on a hard error. The
+* OS handle is owned entirely in native code (no fd crosses into JS), and the
+* kernel releases the lock when the handle closes, including on process death.
+*/
+const tryFileLock = binding.tryFileLock;
+/**
+* Releases a file lock acquired via `tryFileLock`. A no-op for
+* token `0` or an unknown token.
+*/
+const fileLockRelease = binding.fileLockRelease;
 const nativeBackupRestore = binding.backupRestore;
 const nativeBackupList = binding.backupList;
 const nativeBackupDelete = binding.backupDelete;
 const nativeBackupPurge = binding.backupPurge;
 const nativeBackupVerify = binding.backupVerify;
+const nativeValidateTransactionLog = binding.validateTransactionLog;
 const stats = binding.stats;
 const version = binding.version;
 
+//#endregion
+//#region src/validate-transaction-log.ts
+/**
+* Validates a transaction log store directory: every `<sequence>.txnlog` file
+* is checked for a valid header (token, version) and intact v1 entry framing
+* (using the same scan as open-time crash recovery), file-name and sequence
+* continuity are checked, and the `txn.state` side file (when present) is
+* checked for shape and a plausible flushed position. The result reports
+* per-file entry counts, errors, and warnings; it does not throw when the
+* store is invalid — check `result.valid`.
+*
+* Runs entirely in native code on a worker thread and does not require (or
+* open) a database, so it works on the store of a closed database and on the
+* per-backup snapshots under `<backupDir>/transaction_logs/<backupId>/` alike.
+*
+* Validating a store that is being actively appended to can spuriously report
+* a torn tail for the current log file — the tail of an in-flight append is
+* indistinguishable from a crash artifact.
+*
+* Rejects if `path` does not exist or is not a directory (a bad argument, as
+* opposed to an invalid store).
+*
+* @param path The store directory, e.g. `<dbDir>/transaction_logs/<name>`.
+* @param options Validation options.
+*
+* @example
+* ```typescript
+* import { validateTransactionLogStore } from '@harperfast/rocksdb-js';
+*
+* const result = await validateTransactionLogStore('/path/to/db/transaction_logs/mylog');
+* if (!result.valid) {
+*   for (const file of result.files) {
+*     console.error(file.file, file.errors);
+*   }
+* }
+* ```
+*/
+function validateTransactionLogStore(path, options) {
+	return new Promise((resolve, reject) => nativeValidateTransactionLog(resolve, reject, path, options?.strict ?? false));
+}
+
 //#endregion
 //#region src/backup.ts
+/** Subdirectory (under a backup directory) holding per-backup transaction log snapshots. */
+const TRANSACTION_LOGS_DIRNAME = "transaction_logs";
+/** Non-blocking existence check (`fs.existsSync` would block the event loop). */
+async function exists(path) {
+	try {
+		await access(path);
+		return true;
+	} catch {
+		return false;
+	}
+}
+/**
+* Runs `fn` while holding a native file lock for `backupDir`, releasing it when
+* `fn` settles. The lock is exclusive by default — used by the writable-engine
+* operations `backups.delete` and `backups.purge`; backup creation
+* (`Store.backup`) takes the same exclusive lock on the same file natively
+* inside `Database::Backup` (see `runCreateBackup` in
+* `src/binding/database/backup.cpp`), where the backup directory is also
+* created. Throws immediately (without running `fn`) if the backup directory
+* is missing — `tryFileLock` creates missing parents, but `delete`/`purge`/
+* `restore` on a nonexistent directory is a caller error and must not conjure
+* an empty one — or if a conflicting holder has the directory lock.
+*
+* `backups.restore` holds the lock in `shared` mode for its source read:
+* shared holders coexist (concurrent restores are safe), but a writer's
+* exclusive acquisition rejects while a restore is in flight — and vice versa.
+* Without this, a `purge`/`delete` racing a restore can delete the very files
+* the restore is copying, after the restore's default `purgeAllFiles` mode has
+* already wiped the destination — failing the restore with no fallback. A
+* rejected writer, by contrast, just retries later.
+*
+* The remaining read-only operations (`list`, `verify`) use
+* `BackupEngineReadOnly` and are not locked: concurrent readers are safe, and
+* locking them would make cheap listings reject during a long backup. Running
+* them concurrently with a `delete`/`purge` on the same directory is a
+* caller-managed hazard, matching RocksDB's one-writable-engine-per-dir model.
+*
+* RocksDB only serializes work within a single `BackupEngine` instance and has
+* no lock on the backup directory itself. Two writable engines — in any
+* processes — creating/deleting/purging backups in the same directory
+* concurrently race on the per-backup staging directory and both fail,
+* potentially leaving the directory with no usable backup. An in-memory lock
+* cannot prevent this across processes, so the lock lives on disk: a kernel
+* advisory lock (`flock` on POSIX, `LockFileEx` on Windows) held on a
+* `.backup.lock` file at the directory root.
+*
+* The lock is taken entirely in native code (`tryFileLock`), which opens,
+* locks, and later closes the file's OS handle without ever exposing a
+* descriptor to JS — the addon statically links its own C runtime, so a
+* Node/libuv fd is not usable across that boundary. The kernel owning the lock
+* buys two properties a pidfile cannot:
+*
+* - No staleness heuristic. The lock is released when the holder's handle closes
+*   — normal release, crash, `kill -9`, container exit — so there is nothing to
+*   reclaim and no liveness check.
+* - True cross-context exclusion. The lock conflicts across processes, containers
+*   sharing a volume (same kernel), and `worker_threads`.
+*
+* The lock file is never deleted, only locked and unlocked; an unlocked, empty
+* `.backup.lock` at the directory root is the steady state.
+*/
+async function withBackupDirLock(backupDir, fn, options) {
+	if (!await exists(backupDir)) throw new Error(`Backup directory does not exist: ${backupDir}`);
+	const token = tryFileLock(join(backupDir, ".backup.lock"), options?.shared === true);
+	if (token === 0) throw new Error(`Backup directory is locked: ${backupDir}`);
+	try {
+		return await fn();
+	} finally {
+		fileLockRelease(token);
+	}
+}
+/**
+* Throws if `backupDir` resolves to the database directory itself or any path
+* beneath it. Backing up into the live database directory would write backup
+* files (the `.backup.lock`, `meta/`, `shared/`, `private/` subtrees) on top of
+* RocksDB's own files, and every subsequent backup would recursively capture
+* the prior ones. Both paths are resolved first so trailing slashes and
+* relative/absolute variants of the same location cannot slip past the check.
+*
+* Only the "backup dir at or under the database dir" direction is rejected —
+* the case the user hits by pointing a backup at `<db>` or `<db>/backups`. The
+* reverse (a database nested under the backup dir) is left to the caller: a
+* backup engine writes into named subtrees, not on top of arbitrary sibling
+* files, so it does not clobber the database in place.
+*
+* On case-insensitive filesystems `<db>` and `<db>/../DB/backup` are the same
+* directory on disk, but `relative()` compares case-sensitively and would call
+* the second one "outside". We case-fold both paths on the platforms whose
+* default filesystem is case-insensitive (macOS, Windows) so a casing
+* difference cannot slip a backup into the database directory. This is a
+* platform heuristic, not a per-volume probe (a case-sensitive macOS/Windows
+* volume exists), so it can over-reject a legitimately differently-cased
+* sibling there — the safe direction for a guard against clobbering the live
+* database.
+*/
+function assertBackupDirOutsideDatabase(dbPath, backupDir) {
+	let resolvedDb = resolve(dbPath);
+	let resolvedBackup = resolve(backupDir);
+	if (process.platform === "win32" || process.platform === "darwin") {
+		resolvedDb = resolvedDb.toLowerCase();
+		resolvedBackup = resolvedBackup.toLowerCase();
+	}
+	const rel = relative(resolvedDb, resolvedBackup);
+	if (!(rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel))) throw new Error(`Backup directory must not be inside the database directory: ${backupDir} is at or within ${dbPath}`);
+}
+/**
+* Removes `<backupDir>/transaction_logs/<id>` subtrees whose backup id no longer
+* corresponds to a surviving backup. Called after a `purge` (which holds the
+* backup-dir lock); a no-op when no transaction logs were backed up. Self-healing:
+* it drops every log subtree without a live backup. Note the surviving set comes
+* from `nativeBackupList`, which omits corrupt backups — a still-present but
+* corrupt backup's logs may be pruned (acceptable: it cannot be restored anyway).
+* This also sweeps `.staging-*` leftovers from a crashed backup process (a
+* staging name never matches a live backup id); backup creation sweeps them
+* natively as well, under the backup-dir lock.
+*/
+async function pruneOrphanedTransactionLogs(backupDir) {
+	const logsRoot = join(backupDir, TRANSACTION_LOGS_DIRNAME);
+	let ids;
+	try {
+		ids = await readdir(logsRoot);
+	} catch (err) {
+		if (err.code === "ENOENT") return;
+		throw err;
+	}
+	const list = await new Promise((resolve, reject) => nativeBackupList(resolve, reject, backupDir));
+	const surviving = new Set(list.map((info) => String(info.backupId)));
+	await Promise.all(ids.filter((id) => !surviving.has(id)).map((id) => rm(join(logsRoot, id), {
+		recursive: true,
+		force: true
+	})));
+}
+/**
+* Restores the transaction log snapshot for the restored backup into
+* `<dbDir>/transaction_logs/`, wiping the destination first so that restoring an
+* older backup over a newer one cannot leave stale (newer) log files behind.
+*
+* Only acts when THIS backup actually captured logs: if the restored id has no
+* snapshot, the destination is left untouched. Wiping unconditionally would
+* destroy on-disk logs that a mixed-mode (`transactionLogs:false`) backup never
+* managed.
+*
+* Offline only: the files are picked up when the database is next opened. mtimes
+* are preserved because the store derives file age (rotation/retention) from
+* mtime — a fresh mtime would break retention.
+*/
+async function restoreTransactionLogs(backupDir, dbDir, backupId) {
+	const logsRoot = join(backupDir, TRANSACTION_LOGS_DIRNAME);
+	if (!await exists(logsRoot)) return;
+	let id = backupId;
+	if (id === void 0) {
+		const list = await new Promise((resolve, reject) => nativeBackupList(resolve, reject, backupDir));
+		if (list.length === 0) return;
+		id = Math.max(...list.map((info) => info.backupId));
+	}
+	const logsSrc = join(logsRoot, String(id));
+	if (!await exists(logsSrc)) return;
+	const logsDest = join(dbDir, TRANSACTION_LOGS_DIRNAME);
+	await rm(logsDest, {
+		recursive: true,
+		force: true
+	});
+	await cp(logsSrc, logsDest, {
+		recursive: true,
+		preserveTimestamps: true
+	});
+}
 /**
 * Backup management operations that act on a backup directory and do not
 * require an open database. To create a backup, use the `db.backup()` instance
@@ -118,17 +350,32 @@ const backups = {
 	* Restores a database from a backup directory into a (closed) database
 	* directory. The default mode purges the destination directory, so it must
 	* not point at a live database.
+	*
+	* Holds the backup directory lock in shared mode for the duration: multiple
+	* restores can read concurrently, but a writer (`db.backup()`, `delete`,
+	* `purge`) rejects while a restore is in flight rather than deleting files
+	* out from under it — and a restore rejects while a writer holds the lock.
+	*
+	* The shared lock needs no write access to `backupDir`, so restoring from a
+	* read-only backup directory (immutable/WORM store, read-only-mounted volume)
+	* works: the lock is taken on an existing `.backup.lock` read-only, degrading
+	* to a no-op only when the media is read-only for every process (`EROFS`). A
+	* mere permission denial hard-fails instead — it doesn't prove a privileged
+	* writer isn't running.
 	*/
 	async restore(backupDir, dbDir, options) {
 		if (resolve(backupDir) === resolve(dbDir)) throw new Error("Backup directory and database directory must be different");
-		const walDir = options?.walDir ?? dbDir;
-		await mkdir(dbDir, { recursive: true });
-		if (walDir !== dbDir) await mkdir(walDir, { recursive: true });
-		return new Promise((resolve, reject) => nativeBackupRestore(resolve, reject, backupDir, dbDir, walDir, {
-			backupId: options?.backupId,
-			keepLogFiles: options?.keepLogFiles,
-			mode: options?.mode
-		}));
+		return withBackupDirLock(backupDir, async () => {
+			const walDir = options?.walDir ?? dbDir;
+			await mkdir(dbDir, { recursive: true });
+			if (walDir !== dbDir) await mkdir(walDir, { recursive: true });
+			await new Promise((resolve, reject) => nativeBackupRestore(resolve, reject, backupDir, dbDir, walDir, {
+				backupId: options?.backupId,
+				keepLogFiles: options?.keepLogFiles,
+				mode: options?.mode
+			}));
+			await restoreTransactionLogs(backupDir, dbDir, options?.backupId);
+		}, { shared: true });
 	},
 	/**
 	* Lists the non-corrupt backups in a backup directory, ordered by id.
@@ -140,21 +387,53 @@ const backups = {
 	* Deletes a specific backup. Shared files are reference-counted and only
 	* removed once no remaining backup references them.
 	*/
-	delete(backupDir, backupId) {
-		return new Promise((resolve, reject) => nativeBackupDelete(resolve, reject, backupDir, backupId));
+	async delete(backupDir, backupId) {
+		return withBackupDirLock(backupDir, async () => {
+			await new Promise((resolve, reject) => nativeBackupDelete(resolve, reject, backupDir, backupId));
+			try {
+				await rm(join(backupDir, TRANSACTION_LOGS_DIRNAME, String(backupId)), {
+					recursive: true,
+					force: true
+				});
+			} catch {}
+		});
 	},
 	/**
 	* Deletes all but the newest `keepCount` backups.
 	*/
-	purge(backupDir, keepCount) {
-		return new Promise((resolve, reject) => nativeBackupPurge(resolve, reject, backupDir, keepCount));
+	async purge(backupDir, keepCount) {
+		return withBackupDirLock(backupDir, async () => {
+			await new Promise((resolve, reject) => nativeBackupPurge(resolve, reject, backupDir, keepCount));
+			try {
+				await pruneOrphanedTransactionLogs(backupDir);
+			} catch {}
+		});
 	},
 	/**
 	* Verifies a backup's file sizes, and optionally their checksums (which
 	* requires reading all backed-up data).
-	*/
-	verify(backupDir, backupId, options) {
-		return new Promise((resolve, reject) => nativeBackupVerify(resolve, reject, backupDir, backupId, options?.verifyWithChecksum ?? false));
+	*
+	* When the backup was created with `transactionLogs: true`, the backup's
+	* transaction log snapshot (`<backupDir>/transaction_logs/<backupId>/`) is
+	* also validated — every log file's header and entry framing must be intact
+	* (snapshots are copied on committed entry boundaries, so even a torn tail
+	* is a verification failure). Set `verifyTransactionLogs: false` to skip.
+	*/
+	async verify(backupDir, backupId, options) {
+		await new Promise((resolve, reject) => nativeBackupVerify(resolve, reject, backupDir, backupId, options?.verifyWithChecksum ?? false));
+		if (options?.verifyTransactionLogs === false) return;
+		const logsDir = join(backupDir, TRANSACTION_LOGS_DIRNAME, String(backupId));
+		if (!await exists(logsDir)) return;
+		const failures = [];
+		for (const entry of await readdir(logsDir, { withFileTypes: true })) {
+			if (!entry.isDirectory()) continue;
+			const result = await validateTransactionLogStore(join(logsDir, entry.name), { strict: true });
+			if (!result.valid) {
+				const details = [...result.errors, ...result.files.flatMap((file) => file.errors.map((error) => `${file.file}: ${error}`))];
+				failures.push(`${entry.name}: ${details.join("; ")}`);
+			}
+		}
+		if (failures.length > 0) throw new Error(`Backup ${backupId} transaction log verification failed: ${failures.join("\n")}`);
 	}
 };
 
@@ -518,6 +797,258 @@ var DBI = class DBI {
 	}
 };
 
+//#endregion
+//#region src/tar.ts
+/**
+* A minimal, dependency-free streaming USTAR (POSIX tar) encoder.
+*
+* Built for streaming whole-database backups: the set of live RocksDB files
+* (SSTs, blobs, MANIFEST, CURRENT, OPTIONS, WAL) is serialized into a single
+* tar byte stream that can be piped to any destination and unpacked with
+* standard tools (`tar -xf`). The encoder never buffers a whole file — each
+* entry's payload is streamed through in chunks — so peak memory stays flat
+* regardless of database size.
+*
+* Backpressure is the caller's lever: every method `await`s the {@link TarSink},
+* so wiring the sink to a stream writer's `write()` naturally paces production
+* to the consumer.
+*
+* Only what a RocksDB backup needs is implemented: regular files. Paths longer
+* than USTAR's 100-byte `name` field are split across the `name` and `prefix`
+* fields (~255 bytes total), which covers `transaction_logs/<store>/<file>`
+* entries; GNU/pax long-name extensions are not implemented, so a path that
+* still doesn't fit throws rather than being silently truncated. File sizes
+* larger than the octal `size` field can hold (~8 GiB) fall back to the GNU
+* base-256 encoding.
+*/
+/** Size of a tar block. Every header and the archive length are multiples of this. */
+const BLOCK_SIZE = 512;
+/** Maximum bytes for the USTAR `name` field. */
+const MAX_NAME_LENGTH = 100;
+/** Maximum bytes for the USTAR `prefix` field (holds the leading directories). */
+const MAX_PREFIX_LENGTH = 155;
+const textEncoder = new TextEncoder();
+const textDecoder = new TextDecoder();
+/**
+* Writes a UTF-8 string into a fixed-width header field, left-justified and
+* NUL-padded (the block is already zero-filled, so nothing else is needed).
+* Throws if the encoded value does not fit — tar fields are silently lossy
+* otherwise, which corrupts the archive.
+*/
+function writeField(block, value, offset, length) {
+	const bytes = textEncoder.encode(value);
+	if (bytes.length > length) throw new RangeError(`tar field value ${JSON.stringify(value)} exceeds ${length} bytes`);
+	block.set(bytes, offset);
+}
+/**
+* Writes a non-negative integer as a NUL-terminated, zero-padded octal string
+* into a `length`-byte field (so `length - 1` octal digits). Values too large
+* for octal fall back to the GNU base-256 extension, where the high bit of the
+* first byte is set and the magnitude is stored big-endian in the remainder.
+*/
+function writeOctal(block, value, offset, length) {
+	const digits = length - 1;
+	if (value > 8 ** digits - 1) {
+		let v = value;
+		for (let i = offset + length - 1; i > offset; i--) {
+			block[i] = v & 255;
+			v = Math.floor(v / 256);
+		}
+		block[offset] = 128;
+		return;
+	}
+	const str = value.toString(8).padStart(digits, "0");
+	for (let i = 0; i < digits; i++) block[offset + i] = str.charCodeAt(i);
+}
+/**
+* Computes and writes the USTAR header checksum: the unsigned sum of all 512
+* header bytes with the checksum field itself taken as ASCII spaces. Stored as
+* six octal digits, a NUL, then a space (the conventional encoding).
+*/
+function writeChecksum(block) {
+	for (let i = 148; i < 156; i++) block[i] = 32;
+	let sum = 0;
+	for (let i = 0; i < BLOCK_SIZE; i++) sum += block[i];
+	const str = sum.toString(8).padStart(6, "0");
+	for (let i = 0; i < 6; i++) block[148 + i] = str.charCodeAt(i);
+	block[154] = 0;
+	block[155] = 32;
+}
+/**
+* Splits a path into USTAR `name` (<=100 bytes) and `prefix` (<=155 bytes)
+* fields at a `/` boundary; a reader rejoins them as `prefix + "/" + name`.
+* Returns an empty prefix when the whole path fits in `name`. Throws when the
+* path cannot be represented — a trailing component over 100 bytes, or leading
+* directories that don't fit in 155. RocksDB and transaction-log filenames never
+* hit this; only a pathological log-store name would.
+*/
+function splitTarName(path) {
+	const encoded = textEncoder.encode(path);
+	if (encoded.length <= MAX_NAME_LENGTH) return {
+		name: path,
+		prefix: ""
+	};
+	let best = -1;
+	for (let i = 0; i < encoded.length; i++) {
+		if (encoded[i] !== 47) continue;
+		const prefixLength = i;
+		const nameLength = encoded.length - i - 1;
+		if (nameLength > 0 && nameLength <= MAX_NAME_LENGTH && prefixLength <= MAX_PREFIX_LENGTH) best = i;
+	}
+	if (best === -1) throw new RangeError(`tar entry name ${JSON.stringify(path)} does not fit the USTAR name (<=${MAX_NAME_LENGTH}) + prefix (<=${MAX_PREFIX_LENGTH}) fields`);
+	return {
+		name: textDecoder.decode(encoded.subarray(best + 1)),
+		prefix: textDecoder.decode(encoded.subarray(0, best))
+	};
+}
+/**
+* Builds a single 512-byte USTAR header block for a regular file. Long paths are
+* split across the `name` and `prefix` fields (see {@link splitTarName}).
+*/
+function buildHeader(name, size, mode, mtime) {
+	const block = new Uint8Array(BLOCK_SIZE);
+	const split = splitTarName(name);
+	writeField(block, split.name, 0, MAX_NAME_LENGTH);
+	writeOctal(block, mode & 4095, 100, 8);
+	writeOctal(block, 0, 108, 8);
+	writeOctal(block, 0, 116, 8);
+	writeOctal(block, size, 124, 12);
+	writeOctal(block, Math.floor(mtime), 136, 12);
+	block[156] = 48;
+	writeField(block, "ustar", 257, 6);
+	block[263] = 48;
+	block[264] = 48;
+	if (split.prefix.length > 0) writeField(block, split.prefix, 345, MAX_PREFIX_LENGTH);
+	writeChecksum(block);
+	return block;
+}
+/**
+* Streaming USTAR encoder. Usage is a strict sequence per file —
+* {@link TarEncoder.addFile} once, then {@link TarEncoder.writeData} until the
+* declared size is reached — followed by a single {@link TarEncoder.finalize}:
+*
+* ```ts
+* const tar = new TarEncoder((chunk) => writer.write(chunk));
+* await tar.addFile('CURRENT', current.length);
+* await tar.writeData(current);
+* await tar.addFile('000123.sst', sstSize);
+* for await (const chunk of sstChunks) await tar.writeData(chunk);
+* await tar.finalize();
+* ```
+*
+* The size passed to `addFile` is authoritative: tar records it in the header
+* before any payload, so it must be known up front (it is — RocksDB's
+* `GetLiveFilesStorageInfo` returns each file's exact size). Writing more or
+* fewer bytes than declared throws.
+*/
+var TarEncoder = class {
+	#sink;
+	/** Payload bytes still expected for the current entry. */
+	#remaining = 0;
+	/** Zero-padding bytes owed after the current entry's payload reaches a block boundary. */
+	#pad = 0;
+	#finalized = false;
+	constructor(sink) {
+		this.#sink = sink;
+	}
+	/**
+	* Emits the header for a new file entry. Must be preceded by completing any
+	* prior entry's payload. After this, exactly `size` bytes must be supplied
+	* via {@link TarEncoder.writeData} before the next `addFile` or `finalize`.
+	*/
+	async addFile(name, size, options) {
+		if (this.#finalized) throw new Error("TarEncoder already finalized");
+		if (this.#remaining !== 0) throw new Error(`previous tar entry incomplete: ${this.#remaining} byte(s) unwritten`);
+		if (!Number.isInteger(size) || size < 0) throw new RangeError("tar entry size must be a non-negative integer");
+		const header = buildHeader(name, size, options?.mode ?? 420, options?.mtime ?? 0);
+		this.#remaining = size;
+		this.#pad = (BLOCK_SIZE - size % BLOCK_SIZE) % BLOCK_SIZE;
+		await this.#sink(header);
+	}
+	/**
+	* Streams a chunk of the current entry's payload. Chunks may be any size; the
+	* total across all `writeData` calls for an entry must equal the size passed
+	* to {@link TarEncoder.addFile}. Block padding is emitted automatically once
+	* the final byte of an entry is written.
+	*/
+	async writeData(chunk) {
+		if (this.#finalized) throw new Error("TarEncoder already finalized");
+		if (chunk.length === 0) return;
+		if (chunk.length > this.#remaining) throw new RangeError(`tar data overruns entry size by ${chunk.length - this.#remaining} byte(s)`);
+		this.#remaining -= chunk.length;
+		await this.#sink(chunk);
+		if (this.#remaining === 0 && this.#pad > 0) {
+			const pad = this.#pad;
+			this.#pad = 0;
+			await this.#sink(new Uint8Array(pad));
+		}
+	}
+	/**
+	* Convenience for an entry whose contents are already fully in memory (e.g.
+	* the small `CURRENT`/`OPTIONS` files RocksDB returns inline).
+	*/
+	async addFileData(name, data, options) {
+		await this.addFile(name, data.length, options);
+		await this.writeData(data);
+	}
+	/**
+	* Writes the two zero-filled blocks that mark end-of-archive. The encoder is
+	* unusable afterward. Throws if the current entry is not fully written, so a
+	* truncated stream cannot be silently finalized into a valid-looking archive.
+	*/
+	async finalize() {
+		if (this.#finalized) throw new Error("TarEncoder already finalized");
+		if (this.#remaining !== 0) throw new Error(`cannot finalize: current tar entry has ${this.#remaining} byte(s) unwritten`);
+		this.#finalized = true;
+		await this.#sink(new Uint8Array(BLOCK_SIZE * 2));
+	}
+};
+
+//#endregion
+//#region src/backup-stream.ts
+/** Native event discriminator: a new file header (vs. a payload chunk). */
+const EVENT_FILE = 0;
+/**
+* Streams a consistent snapshot of the database to a `WritableStream` as a tar
+* archive, with no intermediate copy on disk. The set of live RocksDB files is
+* enumerated and read natively; each file header and payload chunk is framed
+* into the {@link TarEncoder} here in JS and written to `stream`.
+*
+* Backpressure flows end to end: the encoder awaits each `writer.write()`, and
+* the native producer awaits each `emit()` before reading the next chunk, so a
+* slow consumer paces the entire pipeline rather than buffering in memory.
+*
+* The resulting archive can be unpacked with any tar tool (`tar -xf`) into a
+* directory that opens directly as a RocksDB database.
+*/
+async function backupToStream(db, stream, options) {
+	let tarDestination;
+	let piped;
+	if (options?.gzip) {
+		const gzip = new CompressionStream("gzip");
+		piped = gzip.readable.pipeTo(stream);
+		tarDestination = gzip.writable;
+	} else tarDestination = stream;
+	const writer = tarDestination.getWriter();
+	const tar = new TarEncoder((chunk) => writer.write(chunk));
+	const emit = async (kind, data, size, mtime) => {
+		if (kind === EVENT_FILE) await tar.addFile(data, size, { mtime });
+		else await tar.writeData(data);
+	};
+	try {
+		await new Promise((resolve, reject) => {
+			db.backupStream(resolve, reject, emit, options);
+		});
+		await tar.finalize();
+		await writer.close();
+		if (piped) await piped;
+	} catch (err) {
+		await writer.abort(err).catch(() => {});
+		if (piped) await piped.catch(() => {});
+		throw err;
+	}
+}
+
 //#endregion
 //#region src/dbi-iterator.ts
 const { ITERATOR_RESULT_DONE, ITERATOR_RESULT_FAST } = constants;
@@ -731,6 +1262,16 @@ var Store = class {
 	*/
 	maxKeySize;
 	/**
+	* The maximum number of table files RocksDB keeps open. `0` (the default)
+	* derives a budget from the effective per-process open-file limit (an
+	* eighth of the limit — several databases can share one process — clamped
+	* to `[1024, 262144]`); `-1` holds every table file open (the RocksDB
+	* default, which can exhaust the process file-descriptor limit when
+	* compaction falls behind under sustained ingest); a positive `int32` is
+	* an explicit cap.
+	*/
+	maxOpenFiles;
+	/**
 	* The maximum number of memtables that can be queued per column family
 	* before writes stall. Higher values absorb write bursts while flushes catch
 	* up, at the cost of memory.
@@ -851,6 +1392,7 @@ var Store = class {
 		this.keyBuffer = KEY_BUFFER;
 		this.keyEncoding = keyEncoding;
 		this.maxKeySize = options?.maxKeySize ?? MAX_KEY_SIZE;
+		this.maxOpenFiles = options?.maxOpenFiles;
 		this.maxWriteBufferNumber = options?.maxWriteBufferNumber;
 		this.maxWriteBufferSizeToMaintain = options?.maxWriteBufferSizeToMaintain;
 		this.name = options?.name ?? "default";
@@ -900,19 +1442,10 @@ var Store = class {
 		}
 		return new Promise((resolve, reject) => this.db.compact(resolve, reject, startBuffer, endBuffer));
 	}
-	/**
-	* Creates a backup of the entire database (all column families) into the
-	* given directory and resolves with the new backup id. Parent directories
-	* are created as needed. See `backups` for restore and management.
-	*
-	* @example
-	* ```typescript
-	* const id = await db.backup('/path/to/backups');
-	* ```
-	*/
-	async backup(backupDir, options) {
-		await mkdir(backupDir, { recursive: true });
-		return new Promise((resolve, reject) => this.db.backup(resolve, reject, backupDir, options));
+	async backup(target, options) {
+		if (typeof target !== "string" && typeof target?.getWriter === "function") return backupToStream(this.db, target, options);
+		assertBackupDirOutsideDatabase(this.path, target);
+		return new Promise((resolve, reject) => this.db.backup(resolve, reject, target, options));
 	}
 	/**
 	* Compacts the entire key range of the database synchronously.
@@ -1152,6 +1685,7 @@ var Store = class {
 			dbWriteBufferSize: this.dbWriteBufferSize,
 			disableWAL: this.disableWAL,
 			enableStats: this.enableStats,
+			maxOpenFiles: this.maxOpenFiles,
 			maxWriteBufferNumber: this.maxWriteBufferNumber,
 			maxWriteBufferSizeToMaintain: this.maxWriteBufferSizeToMaintain,
 			mode: this.pessimistic ? "pessimistic" : "optimistic",
@@ -1270,8 +1804,18 @@ const RETRY_NOW = constants.RETRY_NOW_VALUE;
 var TransactionAlreadyAbortedError = class extends Error {
 	code = "ERR_ALREADY_ABORTED";
 };
-var TransactionIsBusyError = class extends Error {
-	code = "ERR_BUSY";
+/**
+* Base for commit conflicts the native layer has already recovered from by resetting the
+* transaction in place (fresh RocksDB snapshot; `committedPosition` preserved, so a staged
+* transaction-log batch stays write-once): the caller should re-run the transaction body
+* and retry the commit — the handling is identical for every subclass. `hasLog` reports
+* whether the transaction wrote to a transaction log (drives the default retry decision).
+*
+* {@link TransactionAbandonedError} shares this field shape but deliberately does NOT
+* extend this class — an abandoned transaction is not retryable, and retryability is the
+* boundary this hierarchy expresses.
+*/
+var TransactionRetryableError = class extends Error {
 	hasLog;
 	txn;
 	constructor(error, txn) {
@@ -1280,6 +1824,21 @@ var TransactionIsBusyError = class extends Error {
 		this.txn = txn;
 	}
 };
+/**
+* An optimistic commit detected a write conflict with a concurrently committed
+* transaction (RocksDB `Busy`).
+*/
+var TransactionIsBusyError = class extends TransactionRetryableError {
+	code = "ERR_BUSY";
+};
+/**
+* An optimistic commit could not be validated: the transaction's snapshot was stranded
+* outside the memtable window (its sequence history was flushed away — RocksDB
+* `TryAgain`), so the conflict check had nothing to validate against.
+*/
+var TransactionTryAgainError = class extends TransactionRetryableError {
+	code = "ERR_TRY_AGAIN";
+};
 var TransactionAbandonedError = class extends Error {
 	code = "ERR_TRANSACTION_ABANDONED";
 	hasLog;
@@ -1374,6 +1933,7 @@ var Transaction = class extends DBI {
 		if (err instanceof Error && "code" in err) {
 			if (err.code === "ERR_ALREADY_ABORTED") return new TransactionAlreadyAbortedError(err.message);
 			if (err.code === "ERR_BUSY") return new TransactionIsBusyError(err, this);
+			if (err.code === "ERR_TRY_AGAIN") return new TransactionTryAgainError(err, this);
 		}
 		return err;
 	}
@@ -1481,25 +2041,9 @@ var RocksDatabase = class RocksDatabase extends DBI {
 	compact(options) {
 		return this.store.compact(options);
 	}
-	/**
-	* Creates a backup of the entire database (all column families) into the
-	* given directory, creating parent directories as needed, and resolves with
-	* the new backup id. Use the `backups` namespace to restore, list, delete,
-	* purge, or verify backups.
-	*
-	* When the database was opened with `disableWAL`, the memtable is flushed
-	* before the backup by default so unflushed data is not lost.
-	*
-	* @example
-	* ```typescript
-	* import { backups } from '@harperfast/rocksdb-js';
-	*
-	* const db = RocksDatabase.open('/path/to/database');
-	* const id = await db.backup('/path/to/backups');
-	* ```
-	*/
-	backup(backupDir, options) {
-		return this.store.backup(backupDir, options);
+	backup(target, options) {
+		if (typeof target === "string") return this.store.backup(target, options);
+		return this.store.backup(target, options);
 	}
 	/**
 	* Creates a hardlinked, point-in-time, fully independent copy of the entire
@@ -1970,7 +2514,7 @@ var RocksDatabase = class RocksDatabase extends DBI {
 				commitResult = await txn.commit();
 			} catch (commitErr) {
 				if (commitErr instanceof TransactionAlreadyAbortedError) return;
-				if (commitErr instanceof TransactionIsBusyError && (options?.retryOnBusy ?? commitErr.hasLog) && attempt < maxRetries) continue;
+				if (commitErr instanceof TransactionRetryableError && (options?.retryOnBusy ?? commitErr.hasLog) && attempt < maxRetries) continue;
 				this.#abandonTransaction(txn, commitErr);
 				return;
 			}
@@ -2002,7 +2546,7 @@ var RocksDatabase = class RocksDatabase extends DBI {
 		if (typeof callback !== "function") throw new TypeError("Callback must be a function");
 		const maxRetries = options?.maxRetries ?? 3;
 		const isRetryable = (err, attempt) => {
-			return err instanceof TransactionIsBusyError && (options?.retryOnBusy ?? err.hasLog) && attempt <= maxRetries;
+			return err instanceof TransactionRetryableError && (options?.retryOnBusy ?? err.hasLog) && attempt <= maxRetries;
 		};
 		const runAttempt = (attempt) => {
 			const txn = new Transaction(this.store, options);
@@ -2198,7 +2742,7 @@ function parseTransactionLog(path, options = {}) {
 
 //#endregion
 //#region src/transaction-log-reader.ts
-const FLOAT_TO_UINT32 = new Float64Array(1);
+const FLOAT_TO_UINT32 = /* @__PURE__ */ new Float64Array(1);
 const UINT32_FROM_FLOAT = new Uint32Array(FLOAT_TO_UINT32.buffer);
 const { TRANSACTION_LOG_FILE_HEADER_SIZE, TRANSACTION_LOG_ENTRY_HEADER_SIZE } = constants;
 /**
@@ -2384,9 +2928,9 @@ function loadLastPosition(transactionLog, readUncommitted) {
 //#region src/index.ts
 const versions = {
 	rocksdb: version,
-	"rocksdb-js": "2.3.0"
+	"rocksdb-js": "2.5.0"
 };
 
 //#endregion
-export { DBI, DBIterator, RocksDatabase, Store, Transaction, TransactionLog, backups, constants, coolTransactionLogs, currentThreadId, parseTransactionLog, registryStatus, shutdown, stats, versions };
+export { DBI, DBIterator, RocksDatabase, Store, Transaction, TransactionLog, backups, constants, coolTransactionLogs, currentThreadId, fileLockRelease, parseTransactionLog, registryStatus, shutdown, stats, tryFileLock, validateTransactionLogStore, versions };
 //# sourceMappingURL=index.mjs.map