@rocicorp/zero 1.10.0-canary.24 → 1.10.0-canary.26

package/out/zero-cache/src/services/litestream/litestream-checkpointer.js

@@ -1,131 +0,0 @@
-import { AbortError } from "../../../../shared/src/abort-error.js";
-import { RunningState } from "../running-state.js";
-//#region ../zero-cache/src/services/litestream/litestream-checkpointer.ts
-var SOFT_CHECKPOINT_WAIT_MS = 1e4;
-var LITESTREAM_SYNC_TIMEOUT_MS = 5 * 6e4;
-var PAUSE_POLL_INTERVAL_MS = 1e3;
-var PAUSE_LOG_INTERVAL_POLLS = 30;
-/**
-* Forces litestream to checkpoint the WAL from the write path, so a sustained
-* high write rate can't grow the WAL until litestream's own blocking TRUNCATE
-* checkpoint locks the db (see ReplicationPauseCheckpointConfig).
-*
-* Two tiers:
-*  - Soft (`checkpointThresholdPages`): after each committed transaction,
-*    once the un-checkpointed WAL backlog reaches the threshold, force an
-*    immediate litestream sync (which seals the WAL to LTX and attempts
-*    litestream's own PASSIVE checkpoint) and block the write path until it
-*    completes, but only up to {@link SOFT_CHECKPOINT_WAIT_MS}. Waiting is the
-*    backpressure: it throttles upstream reads to litestream's WAL-seal rate
-*    and, in the common case, gives litestream a window to checkpoint without
-*    writer interference. A single sync is kept in flight at a time
-*    (`#pendingSync`): if one is still running when the budget elapses, the
-*    writer proceeds and the next commit waits for that sync rather than
-*    issuing (and orphaning) another. Backs off by a full threshold's worth of
-*    WAL growth whenever an attempt fails to drain the WAL (e.g. litestream
-*    is mid-snapshot and its checkpoints are being skipped), so repeated
-*    failures don't reattempt on every commit.
-*  - Hard (`walMaxPages`, optional): if the WAL still exceeds this cap after
-*    a soft attempt, pause (block the caller) polling litestream until the
-*    WAL drains below it. This is the fail-safe against unbounded WAL growth
-*    when litestream structurally cannot checkpoint — e.g. an in-progress
-*    snapshot holds litestream's checkpoint lock for its full duration, so
-*    neither PASSIVE nor TRUNCATE checkpoints can run until it completes.
-*/
-var LitestreamCheckpointer = class {
-	#lc;
-	#db;
-	#litestream;
-	#attemptChunk;
-	#maxWalPages;
-	#state = new RunningState("litestream-checkpointer");
-	#nextWalThreshold;
-	#pendingSync;
-	constructor(lc, db, litestream, config) {
-		this.#lc = lc.withContext("component", "litestream-checkpointer");
-		this.#db = db;
-		this.#litestream = litestream;
-		this.#attemptChunk = config.checkpointThresholdPages;
-		this.#nextWalThreshold = config.checkpointThresholdPages;
-		this.#maxWalPages = config.maxWalPages;
-	}
-	#getNumWalPages() {
-		const [{ log, checkpointed }] = this.#db.pragma("wal_checkpoint(NOOP)");
-		return log - checkpointed;
-	}
-	/**
-	* Call after a committed transaction. No-ops unless the WAL has grown to
-	* at least the current threshold, in which case it triggers a litestream
-	* sync to perform a checkpoint. Assuming that snapshots are disabled, the
-	* checkpoint always succeeds. In the case where the server is configured to
-	* perform snapshots and checkpoints fail, the "emergency break"
-	* {@link #pauseUntilWalDrained()} option provides the disk use protection
-	* that litestream's (disabled) truncate-page-n would have served.
-	*/
-	async maybeCheckpoint() {
-		let walPages = this.#getNumWalPages();
-		if (walPages < this.#nextWalThreshold) return;
-		this.#pendingSync ??= this.#sync(walPages);
-		await this.#waitFor(this.#pendingSync, SOFT_CHECKPOINT_WAIT_MS);
-		walPages = this.#getNumWalPages();
-		if (this.#maxWalPages !== void 0 && walPages > this.#maxWalPages) walPages = await this.#pauseUntilWalDrained(this.#maxWalPages);
-		this.#nextWalThreshold = walPages + this.#attemptChunk;
-	}
-	async #waitFor(p, timeoutMs) {
-		if (await Promise.race([p, this.#state.sleep(timeoutMs).then(() => "timed-out")]) === "timed-out") this.#lc.warn?.(`timed out waiting for /sync result (${timeoutMs}ms)`);
-	}
-	/**
-	* Runs a single litestream sync, logs its outcome, and clears
-	* {@link #pendingSync} when it settles. Never rejects: sync failures and
-	* post-sync bookkeeping errors (e.g. the db being closed during shutdown)
-	* are caught and logged, so the shared promise can be awaited from multiple
-	* places without risking an unhandled rejection.
-	*/
-	async #sync(walPagesBefore) {
-		const start = performance.now();
-		let result;
-		let err;
-		try {
-			try {
-				result = await this.#litestream.sync({
-					wait: false,
-					timeoutMs: LITESTREAM_SYNC_TIMEOUT_MS
-				}, this.#state.signal);
-			} catch (e) {
-				err = e;
-			}
-			const elapsed = performance.now() - start;
-			const newWalPages = this.#getNumWalPages();
-			if (newWalPages < this.#nextWalThreshold) this.#lc.info?.(`checkpointed ${walPagesBefore} -> ${newWalPages} wal pages (${elapsed.toFixed(2)} ms)`, result);
-			else if (result) this.#lc.warn?.(`checkpoint skipped ${walPagesBefore} -> ${newWalPages}. a snapshot may be in progress (${elapsed.toFixed(2)} ms)`, result);
-			else this.#lc.warn?.(`checkpoint failed ${walPagesBefore} -> ${newWalPages} (${elapsed.toFixed(2)} ms)`, err);
-		} catch (e) {
-			this.#lc.warn?.("litestream-checkpointer sync post-processing failed", e);
-		} finally {
-			this.#pendingSync = void 0;
-		}
-	}
-	async #pauseUntilWalDrained(maxWalPages) {
-		for (let i = 0; this.#state.shouldRun(); i++) {
-			const walPages = this.#getNumWalPages();
-			if (walPages < maxWalPages) {
-				this.#lc.info?.(`wal size (${walPages} pages) is under the max limit of ${maxWalPages}`);
-				return walPages;
-			}
-			if (i % PAUSE_LOG_INTERVAL_POLLS === 0) this.#lc.warn?.(`waiting for litestream to successfully checkpoint ${walPages} wal pages`);
-			await this.#state.sleep(PAUSE_POLL_INTERVAL_MS);
-			this.#pendingSync ??= this.#sync(this.#getNumWalPages());
-			await this.#pendingSync;
-		}
-		throw new AbortError("litestream-controller stopped");
-	}
-	/** Releases the underlying litestream controller's connection. */
-	close() {
-		this.#litestream.close();
-		this.#state.stop(this.#lc);
-	}
-};
-//#endregion
-export { LitestreamCheckpointer };
-
-//# sourceMappingURL=litestream-checkpointer.js.map

package/out/zero-cache/src/services/litestream/litestream-checkpointer.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"litestream-checkpointer.js","names":["#lc","#db","#litestream","#attemptChunk","#maxWalPages","#state","#nextWalThreshold","#getNumWalPages","#pendingSync","#sync","#waitFor","#pauseUntilWalDrained"],"sources":["../../../../../../zero-cache/src/services/litestream/litestream-checkpointer.ts"],"sourcesContent":["import type {LogContext} from '@rocicorp/logger';\nimport {AbortError} from '../../../../shared/src/abort-error.ts';\nimport type {Database} from '../../../../zqlite/src/db.ts';\nimport type {ForceCheckpointConfig} from '../replicator/write-worker-client.ts';\nimport {RunningState} from '../running-state.ts';\nimport type {\n  LitestreamController,\n  SyncResponse,\n} from './litestream-controller.ts';\n\n// How long the soft path blocks the write path waiting for an in-flight sync\n// before letting the writer proceed. This is a backpressure knob, *not* a\n// request timeout: letting it elapse leaves the sync running (see #pendingSync)\n// rather than abandoning it. In normal operation litestream seals + runs its\n// PASSIVE checkpoint well within this budget; a sync that regularly exceeds it\n// indicates a litestream-side problem to fix (e.g. unintended snapshot), not a\n// value to raise.\nexport const SOFT_CHECKPOINT_WAIT_MS = 10_000;\n// Liveness bound on the /sync request itself, well above the soft wait budget.\n// It exists only to recover from a genuinely wedged litestream (so #pendingSync\n// can't hang forever).\nconst LITESTREAM_SYNC_TIMEOUT_MS = 5 * 60_000;\nconst PAUSE_POLL_INTERVAL_MS = 1_000;\nconst PAUSE_LOG_INTERVAL_POLLS = 30;\n\n/**\n * Forces litestream to checkpoint the WAL from the write path, so a sustained\n * high write rate can't grow the WAL until litestream's own blocking TRUNCATE\n * checkpoint locks the db (see ReplicationPauseCheckpointConfig).\n *\n * Two tiers:\n *  - Soft (`checkpointThresholdPages`): after each committed transaction,\n *    once the un-checkpointed WAL backlog reaches the threshold, force an\n *    immediate litestream sync (which seals the WAL to LTX and attempts\n *    litestream's own PASSIVE checkpoint) and block the write path until it\n *    completes, but only up to {@link SOFT_CHECKPOINT_WAIT_MS}. Waiting is the\n *    backpressure: it throttles upstream reads to litestream's WAL-seal rate\n *    and, in the common case, gives litestream a window to checkpoint without\n *    writer interference. A single sync is kept in flight at a time\n *    (`#pendingSync`): if one is still running when the budget elapses, the\n *    writer proceeds and the next commit waits for that sync rather than\n *    issuing (and orphaning) another. Backs off by a full threshold's worth of\n *    WAL growth whenever an attempt fails to drain the WAL (e.g. litestream\n *    is mid-snapshot and its checkpoints are being skipped), so repeated\n *    failures don't reattempt on every commit.\n *  - Hard (`walMaxPages`, optional): if the WAL still exceeds this cap after\n *    a soft attempt, pause (block the caller) polling litestream until the\n *    WAL drains below it. This is the fail-safe against unbounded WAL growth\n *    when litestream structurally cannot checkpoint — e.g. an in-progress\n *    snapshot holds litestream's checkpoint lock for its full duration, so\n *    neither PASSIVE nor TRUNCATE checkpoints can run until it completes.\n */\nexport class LitestreamCheckpointer {\n  readonly #lc: LogContext;\n  readonly #db: Database;\n  readonly #litestream: LitestreamController;\n  readonly #attemptChunk: number;\n  readonly #maxWalPages: number | undefined;\n  readonly #state = new RunningState('litestream-checkpointer');\n  #nextWalThreshold: number;\n  #pendingSync: Promise<void> | undefined;\n\n  constructor(\n    lc: LogContext,\n    db: Database,\n    litestream: LitestreamController,\n    config: ForceCheckpointConfig,\n  ) {\n    this.#lc = lc.withContext('component', 'litestream-checkpointer');\n    this.#db = db;\n    this.#litestream = litestream;\n    this.#attemptChunk = config.checkpointThresholdPages;\n    this.#nextWalThreshold = config.checkpointThresholdPages;\n    this.#maxWalPages = config.maxWalPages;\n  }\n\n  #getNumWalPages(): number {\n    // wal_checkpoint(NOOP) reads WAL status without doing any work: `log` is\n    // the current WAL frame count and `checkpointed` is how many of those\n    // frames are already applied to the main db, so `log - checkpointed` is\n    // the un-checkpointed backlog that a forced sync would actually drain.\n    // (Both reset once litestream restarts the WAL.)\n    const [{log, checkpointed}] = this.#db.pragma<{\n      log: number;\n      checkpointed: number;\n    }>('wal_checkpoint(NOOP)');\n    return log - checkpointed;\n  }\n\n  /**\n   * Call after a committed transaction. No-ops unless the WAL has grown to\n   * at least the current threshold, in which case it triggers a litestream\n   * sync to perform a checkpoint. Assuming that snapshots are disabled, the\n   * checkpoint always succeeds. In the case where the server is configured to\n   * perform snapshots and checkpoints fail, the \"emergency break\"\n   * {@link #pauseUntilWalDrained()} option provides the disk use protection\n   * that litestream's (disabled) truncate-page-n would have served.\n   */\n  async maybeCheckpoint(): Promise<void> {\n    let walPages = this.#getNumWalPages();\n    if (walPages < this.#nextWalThreshold) {\n      return;\n    }\n\n    // Single-flight: reuse the outstanding sync if one is already running.\n    this.#pendingSync ??= this.#sync(walPages);\n\n    // Soft backpressure: block the write path until the sync completes, but no\n    // longer than the wait budget. Letting the budget elapse lets the writer\n    // proceed *without* cancelling the sync (it keeps running, tracked by\n    // #pendingSync); unbounded WAL growth is caught by the hard cap below.\n    await this.#waitFor(this.#pendingSync, SOFT_CHECKPOINT_WAIT_MS);\n\n    walPages = this.#getNumWalPages();\n    if (this.#maxWalPages !== undefined && walPages > this.#maxWalPages) {\n      // Emergency brake when best-effort checkpoints are being skipped\n      // (i.e. during a snapshot) and the WAL is approaching disk capacity.\n      // Pausing replication is favorable to litestream's truncate-page-n\n      // because the latter involves re-encoding the database under the lock\n      // (https://github.com/benbjohnson/litestream/issues/1332), which would\n      // incur the full latency of an additional snapshot.\n      walPages = await this.#pauseUntilWalDrained(this.#maxWalPages);\n    }\n\n    // In the common case where checkpoints are successful, this is always\n    // just `attemptChunk`. When a checkpoint doesn't drain the WAL (e.g.\n    // litestream is performing a snapshot), wait for another chunk of growth\n    // before the next attempt.\n    this.#nextWalThreshold = walPages + this.#attemptChunk;\n  }\n\n  async #waitFor(p: Promise<void>, timeoutMs: number): Promise<void> {\n    const result = await Promise.race([\n      p,\n      this.#state.sleep(timeoutMs).then(() => 'timed-out' as const),\n    ]);\n    if (result === 'timed-out') {\n      this.#lc.warn?.(`timed out waiting for /sync result (${timeoutMs}ms)`);\n    }\n  }\n\n  /**\n   * Runs a single litestream sync, logs its outcome, and clears\n   * {@link #pendingSync} when it settles. Never rejects: sync failures and\n   * post-sync bookkeeping errors (e.g. the db being closed during shutdown)\n   * are caught and logged, so the shared promise can be awaited from multiple\n   * places without risking an unhandled rejection.\n   */\n  async #sync(walPagesBefore: number): Promise<void> {\n    const start = performance.now();\n    let result: SyncResponse | undefined;\n    let err: unknown;\n    try {\n      try {\n        result = await this.#litestream.sync(\n          {wait: false, timeoutMs: LITESTREAM_SYNC_TIMEOUT_MS},\n          this.#state.signal,\n        );\n      } catch (e) {\n        err = e;\n      }\n\n      const elapsed = performance.now() - start;\n      const newWalPages = this.#getNumWalPages();\n      if (newWalPages < this.#nextWalThreshold) {\n        this.#lc.info?.(\n          `checkpointed ${walPagesBefore} -> ${newWalPages} wal pages (${elapsed.toFixed(2)} ms)`,\n          result,\n        );\n      } else if (result) {\n        this.#lc.warn?.(\n          `checkpoint skipped ${walPagesBefore} -> ${newWalPages}. a snapshot may be in progress (${elapsed.toFixed(2)} ms)`,\n          result,\n        );\n      } else {\n        this.#lc.warn?.(\n          `checkpoint failed ${walPagesBefore} -> ${newWalPages} (${elapsed.toFixed(2)} ms)`,\n          err,\n        );\n      }\n    } catch (e) {\n      this.#lc.warn?.('litestream-checkpointer sync post-processing failed', e);\n    } finally {\n      this.#pendingSync = undefined;\n    }\n  }\n\n  async #pauseUntilWalDrained(maxWalPages: number): Promise<number> {\n    for (let i = 0; this.#state.shouldRun(); i++) {\n      const walPages = this.#getNumWalPages();\n      if (walPages < maxWalPages) {\n        this.#lc.info?.(\n          `wal size (${walPages} pages) is under the max limit of ${maxWalPages}`,\n        );\n        return walPages;\n      }\n\n      // Log every 30 seconds.\n      if (i % PAUSE_LOG_INTERVAL_POLLS === 0) {\n        this.#lc.warn?.(\n          `waiting for litestream to successfully checkpoint ${walPages} wal pages`,\n        );\n      }\n      await this.#state.sleep(PAUSE_POLL_INTERVAL_MS);\n      // Single-flight: reuse the outstanding sync if one is already running.\n      this.#pendingSync ??= this.#sync(this.#getNumWalPages());\n      // await the full liveness timeout configured in #sync()\n      await this.#pendingSync;\n    }\n    throw new AbortError('litestream-controller stopped');\n  }\n\n  /** Releases the underlying litestream controller's connection. */\n  close(): void {\n    this.#litestream.close();\n    this.#state.stop(this.#lc);\n  }\n}\n"],"mappings":";;;AAiBA,IAAa,0BAA0B;AAIvC,IAAM,6BAA6B,IAAI;AACvC,IAAM,yBAAyB;AAC/B,IAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6BjC,IAAa,yBAAb,MAAoC;CAClC;CACA;CACA;CACA;CACA;CACA,SAAkB,IAAI,aAAa,yBAAyB;CAC5D;CACA;CAEA,YACE,IACA,IACA,YACA,QACA;EACA,KAAKA,MAAM,GAAG,YAAY,aAAa,yBAAyB;EAChE,KAAKC,MAAM;EACX,KAAKC,cAAc;EACnB,KAAKC,gBAAgB,OAAO;EAC5B,KAAKG,oBAAoB,OAAO;EAChC,KAAKF,eAAe,OAAO;CAC7B;CAEA,kBAA0B;EAMxB,MAAM,CAAC,EAAC,KAAK,kBAAiB,KAAKH,IAAI,OAGpC,sBAAsB;EACzB,OAAO,MAAM;CACf;;;;;;;;;;CAWA,MAAM,kBAAiC;EACrC,IAAI,WAAW,KAAKM,gBAAgB;EACpC,IAAI,WAAW,KAAKD,mBAClB;EAIF,KAAKE,iBAAiB,KAAKC,MAAM,QAAQ;EAMzC,MAAM,KAAKC,SAAS,KAAKF,cAAc,uBAAuB;EAE9D,WAAW,KAAKD,gBAAgB;EAChC,IAAI,KAAKH,iBAAiB,KAAA,KAAa,WAAW,KAAKA,cAOrD,WAAW,MAAM,KAAKO,sBAAsB,KAAKP,YAAY;EAO/D,KAAKE,oBAAoB,WAAW,KAAKH;CAC3C;CAEA,MAAMO,SAAS,GAAkB,WAAkC;EAKjE,IAAI,MAJiB,QAAQ,KAAK,CAChC,GACA,KAAKL,OAAO,MAAM,SAAS,EAAE,WAAW,WAAoB,CAC9D,CAAC,MACc,aACb,KAAKL,IAAI,OAAO,uCAAuC,UAAU,IAAI;CAEzE;;;;;;;;CASA,MAAMS,MAAM,gBAAuC;EACjD,MAAM,QAAQ,YAAY,IAAI;EAC9B,IAAI;EACJ,IAAI;EACJ,IAAI;GACF,IAAI;IACF,SAAS,MAAM,KAAKP,YAAY,KAC9B;KAAC,MAAM;KAAO,WAAW;IAA0B,GACnD,KAAKG,OAAO,MACd;GACF,SAAS,GAAG;IACV,MAAM;GACR;GAEA,MAAM,UAAU,YAAY,IAAI,IAAI;GACpC,MAAM,cAAc,KAAKE,gBAAgB;GACzC,IAAI,cAAc,KAAKD,mBACrB,KAAKN,IAAI,OACP,gBAAgB,eAAe,MAAM,YAAY,cAAc,QAAQ,QAAQ,CAAC,EAAE,OAClF,MACF;QACK,IAAI,QACT,KAAKA,IAAI,OACP,sBAAsB,eAAe,MAAM,YAAY,mCAAmC,QAAQ,QAAQ,CAAC,EAAE,OAC7G,MACF;QAEA,KAAKA,IAAI,OACP,qBAAqB,eAAe,MAAM,YAAY,IAAI,QAAQ,QAAQ,CAAC,EAAE,OAC7E,GACF;EAEJ,SAAS,GAAG;GACV,KAAKA,IAAI,OAAO,uDAAuD,CAAC;EAC1E,UAAU;GACR,KAAKQ,eAAe,KAAA;EACtB;CACF;CAEA,MAAMG,sBAAsB,aAAsC;EAChE,KAAK,IAAI,IAAI,GAAG,KAAKN,OAAO,UAAU,GAAG,KAAK;GAC5C,MAAM,WAAW,KAAKE,gBAAgB;GACtC,IAAI,WAAW,aAAa;IAC1B,KAAKP,IAAI,OACP,aAAa,SAAS,oCAAoC,aAC5D;IACA,OAAO;GACT;GAGA,IAAI,IAAI,6BAA6B,GACnC,KAAKA,IAAI,OACP,qDAAqD,SAAS,WAChE;GAEF,MAAM,KAAKK,OAAO,MAAM,sBAAsB;GAE9C,KAAKG,iBAAiB,KAAKC,MAAM,KAAKF,gBAAgB,CAAC;GAEvD,MAAM,KAAKC;EACb;EACA,MAAM,IAAI,WAAW,+BAA+B;CACtD;;CAGA,QAAc;EACZ,KAAKN,YAAY,MAAM;EACvB,KAAKG,OAAO,KAAK,KAAKL,GAAG;CAC3B;AACF"}

package/out/zero-cache/src/services/litestream/litestream-controller.d.ts

@@ -1,70 +0,0 @@
-import type { LogContext } from '@rocicorp/logger';
-/**
- * Path of the litestream control socket, derived from the replica file's
- * directory. The socket must live on a filesystem the (non-root) runtime user
- * can write — the replica directory is guaranteed writable since litestream
- * writes the replica there — so it must NOT default to a root-owned location
- * like /var/run. Kept in sync with config-v5.yml's `socket.path`, which is set
- * from `ZERO_LITESTREAM_SOCKET_PATH` (see getLitestream() in commands.ts).
- */
-export declare function litestreamSocketPath(replicaFile: string): string;
-/** Response body from litestream's `POST /sync` control endpoint. */
-export type SyncResponse = {
-    /**
-     * `synced` when `wait` was true and the upload completed, `synced_local`
-     * when the WAL was sealed locally without waiting on the remote replica, or
-     * `no_change` when there was nothing to sync.
-     */
-    status: 'synced' | 'synced_local' | 'no_change';
-    path: string;
-    txid: number;
-    replicated_txid: number;
-};
-export type SyncOptions = {
-    /**
-     * When true, block until the sealed WAL has been uploaded to the remote
-     * replica (litestream's SyncAndWait). When false (the default), litestream
-     * only seals the WAL into local LTX files and runs its checkpoint thresholds,
-     * returning without waiting on the backup store. Use false on the write path
-     * where the goal is to keep the WAL small, not to durably back it up.
-     */
-    wait?: boolean;
-    /** Overall request timeout in milliseconds. Defaults to 30s. */
-    timeoutMs?: number;
-};
-/**
- * IPC client for the litestream control server. litestream serves an HTTP API
- * over a Unix domain socket (enabled via the `socket:` block in config-v5.yml);
- * because zero-cache runs litestream as a subprocess in the same container, the
- * socket is reachable directly on the local filesystem.
- *
- * A single keep-alive connection is held open and reused across calls, so a
- * high-frequency caller (e.g. write-path backpressure) does not pay a
- * connect/handshake per request.
- */
-export declare class LitestreamController {
-    #private;
-    /**
-     * @param replicaFile Path of the replica database litestream is managing —
-     *   the same value passed to litestream as `ZERO_REPLICA_FILE`. This is the
-     *   `path` litestream matches control requests against.
-     * @param socketPath Path of the control socket; defaults to the path derived
-     *   from `replicaFile`, matching config-v5.yml's `socket.path`.
-     */
-    constructor(lc: LogContext, replicaFile: string, socketPath?: string);
-    /**
-     * Forces litestream to sync the WAL into LTX files immediately and run its
-     * checkpoint thresholds, instead of waiting for the next monitor-interval
-     * tick. The checkpoint itself is still litestream's usual (non-blocking)
-     * PASSIVE attempt, so it is skipped if the database is busy — call this once
-     * writes are quiesced.
-     *
-     * Best-effort: callers should tolerate rejection (e.g. ECONNREFUSED/ENOENT
-     * while litestream is restarting or before it has created the socket) rather
-     * than blocking application progress on it.
-     */
-    sync(opts?: SyncOptions, signal?: AbortSignal): Promise<SyncResponse>;
-    /** Releases the pooled keep-alive connection. */
-    close(): void;
-}
-//# sourceMappingURL=litestream-controller.d.ts.map

package/out/zero-cache/src/services/litestream/litestream-controller.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"litestream-controller.d.ts","sourceRoot":"","sources":["../../../../../../zero-cache/src/services/litestream/litestream-controller.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AAEjD;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAEhE;AAID,qEAAqE;AACrE,MAAM,MAAM,YAAY,GAAG;IACzB;;;;OAIG;IACH,MAAM,EAAE,QAAQ,GAAG,cAAc,GAAG,WAAW,CAAC;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IAEf,gEAAgE;IAChE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;;;;;;GASG;AACH,qBAAa,oBAAoB;;IAM/B;;;;;;OAMG;gBAED,EAAE,EAAE,UAAU,EACd,WAAW,EAAE,MAAM,EACnB,UAAU,SAAoC;IAUhD;;;;;;;;;;OAUG;IACG,IAAI,CACR,IAAI,GAAE,WAAgB,EACtB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,YAAY,CAAC;IAYxB,iDAAiD;IACjD,KAAK,IAAI,IAAI;CA8Dd"}

package/out/zero-cache/src/services/litestream/litestream-controller.js

@@ -1,101 +0,0 @@
-import { Agent, request } from "node:http";
-import { json } from "node:stream/consumers";
-//#region ../zero-cache/src/services/litestream/litestream-controller.ts
-/**
-* Path of the litestream control socket, derived from the replica file's
-* directory. The socket must live on a filesystem the (non-root) runtime user
-* can write — the replica directory is guaranteed writable since litestream
-* writes the replica there — so it must NOT default to a root-owned location
-* like /var/run. Kept in sync with config-v5.yml's `socket.path`, which is set
-* from `ZERO_LITESTREAM_SOCKET_PATH` (see getLitestream() in commands.ts).
-*/
-function litestreamSocketPath(replicaFile) {
-	return `${replicaFile}.sock`;
-}
-var DEFAULT_REQUEST_TIMEOUT_MS = 3e4;
-/**
-* IPC client for the litestream control server. litestream serves an HTTP API
-* over a Unix domain socket (enabled via the `socket:` block in config-v5.yml);
-* because zero-cache runs litestream as a subprocess in the same container, the
-* socket is reachable directly on the local filesystem.
-*
-* A single keep-alive connection is held open and reused across calls, so a
-* high-frequency caller (e.g. write-path backpressure) does not pay a
-* connect/handshake per request.
-*/
-var LitestreamController = class {
-	#lc;
-	#replicaFile;
-	#socketPath;
-	#agent;
-	/**
-	* @param replicaFile Path of the replica database litestream is managing —
-	*   the same value passed to litestream as `ZERO_REPLICA_FILE`. This is the
-	*   `path` litestream matches control requests against.
-	* @param socketPath Path of the control socket; defaults to the path derived
-	*   from `replicaFile`, matching config-v5.yml's `socket.path`.
-	*/
-	constructor(lc, replicaFile, socketPath = litestreamSocketPath(replicaFile)) {
-		this.#lc = lc.withContext("component", "litestream-controller");
-		this.#replicaFile = replicaFile;
-		this.#socketPath = socketPath;
-		this.#agent = new Agent({
-			keepAlive: true,
-			maxSockets: 1
-		});
-	}
-	/**
-	* Forces litestream to sync the WAL into LTX files immediately and run its
-	* checkpoint thresholds, instead of waiting for the next monitor-interval
-	* tick. The checkpoint itself is still litestream's usual (non-blocking)
-	* PASSIVE attempt, so it is skipped if the database is busy — call this once
-	* writes are quiesced.
-	*
-	* Best-effort: callers should tolerate rejection (e.g. ECONNREFUSED/ENOENT
-	* while litestream is restarting or before it has created the socket) rather
-	* than blocking application progress on it.
-	*/
-	async sync(opts = {}, signal) {
-		const { wait = false, timeoutMs = DEFAULT_REQUEST_TIMEOUT_MS } = opts;
-		const result = await this.#post("/sync", {
-			path: this.#replicaFile,
-			wait
-		}, timeoutMs, signal);
-		this.#lc.debug?.("litestream sync", result);
-		return result;
-	}
-	/** Releases the pooled keep-alive connection. */
-	close() {
-		this.#agent.destroy();
-	}
-	#post(path, body, timeoutMs, signal) {
-		const payload = JSON.stringify(body);
-		return new Promise((resolve, reject) => {
-			const req = request({
-				socketPath: this.#socketPath,
-				method: "POST",
-				path,
-				agent: this.#agent,
-				timeout: timeoutMs,
-				headers: {
-					"content-type": "application/json",
-					"content-length": Buffer.byteLength(payload)
-				},
-				signal
-			}, (res) => {
-				const status = res.statusCode ?? 0;
-				json(res).then((body) => {
-					if (status < 200 || status >= 300) reject(/* @__PURE__ */ new Error(`litestream ${path} failed: ${status} ${JSON.stringify(body)}`));
-					else resolve(body);
-				}, (e) => reject(new Error(`litestream ${path} returned invalid JSON`, { cause: e })));
-			});
-			req.on("timeout", () => req.destroy(/* @__PURE__ */ new Error(`litestream ${path} timed out after ${timeoutMs}ms`)));
-			req.on("error", reject);
-			req.end(payload);
-		});
-	}
-};
-//#endregion
-export { LitestreamController, litestreamSocketPath };
-
-//# sourceMappingURL=litestream-controller.js.map

package/out/zero-cache/src/services/litestream/litestream-controller.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"litestream-controller.js","names":["#lc","#replicaFile","#socketPath","#agent","#post"],"sources":["../../../../../../zero-cache/src/services/litestream/litestream-controller.ts"],"sourcesContent":["import type {IncomingMessage} from 'node:http';\nimport {Agent, request} from 'node:http';\nimport {json as readJSON} from 'node:stream/consumers';\nimport type {LogContext} from '@rocicorp/logger';\n\n/**\n * Path of the litestream control socket, derived from the replica file's\n * directory. The socket must live on a filesystem the (non-root) runtime user\n * can write — the replica directory is guaranteed writable since litestream\n * writes the replica there — so it must NOT default to a root-owned location\n * like /var/run. Kept in sync with config-v5.yml's `socket.path`, which is set\n * from `ZERO_LITESTREAM_SOCKET_PATH` (see getLitestream() in commands.ts).\n */\nexport function litestreamSocketPath(replicaFile: string): string {\n  return `${replicaFile}.sock`;\n}\n\nconst DEFAULT_REQUEST_TIMEOUT_MS = 30_000;\n\n/** Response body from litestream's `POST /sync` control endpoint. */\nexport type SyncResponse = {\n  /**\n   * `synced` when `wait` was true and the upload completed, `synced_local`\n   * when the WAL was sealed locally without waiting on the remote replica, or\n   * `no_change` when there was nothing to sync.\n   */\n  status: 'synced' | 'synced_local' | 'no_change';\n  path: string;\n  txid: number;\n  replicated_txid: number;\n};\n\nexport type SyncOptions = {\n  /**\n   * When true, block until the sealed WAL has been uploaded to the remote\n   * replica (litestream's SyncAndWait). When false (the default), litestream\n   * only seals the WAL into local LTX files and runs its checkpoint thresholds,\n   * returning without waiting on the backup store. Use false on the write path\n   * where the goal is to keep the WAL small, not to durably back it up.\n   */\n  wait?: boolean;\n\n  /** Overall request timeout in milliseconds. Defaults to 30s. */\n  timeoutMs?: number;\n};\n\n/**\n * IPC client for the litestream control server. litestream serves an HTTP API\n * over a Unix domain socket (enabled via the `socket:` block in config-v5.yml);\n * because zero-cache runs litestream as a subprocess in the same container, the\n * socket is reachable directly on the local filesystem.\n *\n * A single keep-alive connection is held open and reused across calls, so a\n * high-frequency caller (e.g. write-path backpressure) does not pay a\n * connect/handshake per request.\n */\nexport class LitestreamController {\n  readonly #lc: LogContext;\n  readonly #replicaFile: string;\n  readonly #socketPath: string;\n  readonly #agent: Agent;\n\n  /**\n   * @param replicaFile Path of the replica database litestream is managing —\n   *   the same value passed to litestream as `ZERO_REPLICA_FILE`. This is the\n   *   `path` litestream matches control requests against.\n   * @param socketPath Path of the control socket; defaults to the path derived\n   *   from `replicaFile`, matching config-v5.yml's `socket.path`.\n   */\n  constructor(\n    lc: LogContext,\n    replicaFile: string,\n    socketPath = litestreamSocketPath(replicaFile),\n  ) {\n    this.#lc = lc.withContext('component', 'litestream-controller');\n    this.#replicaFile = replicaFile;\n    this.#socketPath = socketPath;\n    // keepAlive with a single socket keeps one warm connection to the control\n    // socket that is reused across calls.\n    this.#agent = new Agent({keepAlive: true, maxSockets: 1});\n  }\n\n  /**\n   * Forces litestream to sync the WAL into LTX files immediately and run its\n   * checkpoint thresholds, instead of waiting for the next monitor-interval\n   * tick. The checkpoint itself is still litestream's usual (non-blocking)\n   * PASSIVE attempt, so it is skipped if the database is busy — call this once\n   * writes are quiesced.\n   *\n   * Best-effort: callers should tolerate rejection (e.g. ECONNREFUSED/ENOENT\n   * while litestream is restarting or before it has created the socket) rather\n   * than blocking application progress on it.\n   */\n  async sync(\n    opts: SyncOptions = {},\n    signal?: AbortSignal,\n  ): Promise<SyncResponse> {\n    const {wait = false, timeoutMs = DEFAULT_REQUEST_TIMEOUT_MS} = opts;\n    const result = await this.#post<SyncResponse>(\n      '/sync',\n      {path: this.#replicaFile, wait},\n      timeoutMs,\n      signal,\n    );\n    this.#lc.debug?.('litestream sync', result);\n    return result;\n  }\n\n  /** Releases the pooled keep-alive connection. */\n  close(): void {\n    this.#agent.destroy();\n  }\n\n  // Note: Uses ye'old node:http for its unix socketPath support.\n  //   fetch() would have less boiler-plate, but it would require importing\n  //   the `unidici` package to provide a fetch Agent that supports sockets.\n  #post<T>(\n    path: string,\n    body: unknown,\n    timeoutMs: number,\n    signal?: AbortSignal,\n  ): Promise<T> {\n    const payload = JSON.stringify(body);\n    return new Promise<T>((resolve, reject) => {\n      const req = request(\n        {\n          socketPath: this.#socketPath,\n          method: 'POST',\n          path,\n          agent: this.#agent,\n          timeout: timeoutMs,\n          headers: {\n            'content-type': 'application/json',\n            'content-length': Buffer.byteLength(payload),\n          },\n          signal,\n        },\n        (res: IncomingMessage) => {\n          const status = res.statusCode ?? 0;\n          // litestream's success and error responses are both always JSON\n          // (writeJSON / writeJSONError in server.go).\n          readJSON(res).then(\n            body => {\n              if (status < 200 || status >= 300) {\n                reject(\n                  new Error(\n                    `litestream ${path} failed: ${status} ${JSON.stringify(body)}`,\n                  ),\n                );\n              } else {\n                resolve(body as T);\n              }\n            },\n            (e: unknown) =>\n              reject(\n                new Error(`litestream ${path} returned invalid JSON`, {\n                  cause: e,\n                }),\n              ),\n          );\n        },\n      );\n      req.on('timeout', () =>\n        req.destroy(\n          new Error(`litestream ${path} timed out after ${timeoutMs}ms`),\n        ),\n      );\n      req.on('error', reject);\n      req.end(payload);\n    });\n  }\n}\n"],"mappings":";;;;;;;;;;;AAaA,SAAgB,qBAAqB,aAA6B;CAChE,OAAO,GAAG,YAAY;AACxB;AAEA,IAAM,6BAA6B;;;;;;;;;;;AAuCnC,IAAa,uBAAb,MAAkC;CAChC;CACA;CACA;CACA;;;;;;;;CASA,YACE,IACA,aACA,aAAa,qBAAqB,WAAW,GAC7C;EACA,KAAKA,MAAM,GAAG,YAAY,aAAa,uBAAuB;EAC9D,KAAKC,eAAe;EACpB,KAAKC,cAAc;EAGnB,KAAKC,SAAS,IAAI,MAAM;GAAC,WAAW;GAAM,YAAY;EAAC,CAAC;CAC1D;;;;;;;;;;;;CAaA,MAAM,KACJ,OAAoB,CAAC,GACrB,QACuB;EACvB,MAAM,EAAC,OAAO,OAAO,YAAY,+BAA8B;EAC/D,MAAM,SAAS,MAAM,KAAKC,MACxB,SACA;GAAC,MAAM,KAAKH;GAAc;EAAI,GAC9B,WACA,MACF;EACA,KAAKD,IAAI,QAAQ,mBAAmB,MAAM;EAC1C,OAAO;CACT;;CAGA,QAAc;EACZ,KAAKG,OAAO,QAAQ;CACtB;CAKA,MACE,MACA,MACA,WACA,QACY;EACZ,MAAM,UAAU,KAAK,UAAU,IAAI;EACnC,OAAO,IAAI,SAAY,SAAS,WAAW;GACzC,MAAM,MAAM,QACV;IACE,YAAY,KAAKD;IACjB,QAAQ;IACR;IACA,OAAO,KAAKC;IACZ,SAAS;IACT,SAAS;KACP,gBAAgB;KAChB,kBAAkB,OAAO,WAAW,OAAO;IAC7C;IACA;GACF,IACC,QAAyB;IACxB,MAAM,SAAS,IAAI,cAAc;IAGjC,KAAS,GAAG,EAAE,MACZ,SAAQ;KACN,IAAI,SAAS,OAAO,UAAU,KAC5B,uBACE,IAAI,MACF,cAAc,KAAK,WAAW,OAAO,GAAG,KAAK,UAAU,IAAI,GAC7D,CACF;UAEA,QAAQ,IAAS;IAErB,IACC,MACC,OACE,IAAI,MAAM,cAAc,KAAK,yBAAyB,EACpD,OAAO,EACT,CAAC,CACH,CACJ;GACF,CACF;GACA,IAAI,GAAG,iBACL,IAAI,wBACF,IAAI,MAAM,cAAc,KAAK,mBAAmB,UAAU,GAAG,CAC/D,CACF;GACA,IAAI,GAAG,SAAS,MAAM;GACtB,IAAI,IAAI,OAAO;EACjB,CAAC;CACH;AACF"}

package/out/zero-cache/src/services/profz.d.ts

@@ -1,7 +0,0 @@
-import type { LogContext } from '@rocicorp/logger';
-import type { FastifyReply, FastifyRequest } from 'fastify';
-import type { NormalizedZeroConfig } from '../config/normalize.ts';
-import { type Worker } from '../types/processes.ts';
-export declare function handleProfzRequest(lc: LogContext, config: Pick<NormalizedZeroConfig, 'adminPassword'>, req: FastifyRequest, res: FastifyReply, getWorker?: (() => Promise<Worker>) | undefined, forcedWorker?: string | undefined, localProcessName?: string): Promise<void>;
-export declare function handleProfrmzRequest(lc: LogContext, config: NormalizedZeroConfig, req: FastifyRequest, res: FastifyReply, getWorker?: (() => Promise<Worker>) | undefined): Promise<void>;
-//# sourceMappingURL=profz.d.ts.map

package/out/zero-cache/src/services/profz.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"profz.d.ts","sourceRoot":"","sources":["../../../../../zero-cache/src/services/profz.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AAEjD,OAAO,KAAK,EAAC,YAAY,EAAE,cAAc,EAAC,MAAM,SAAS,CAAC;AAE1D,OAAO,KAAK,EAAC,oBAAoB,EAAC,MAAM,wBAAwB,CAAC;AAEjE,OAAO,EAKL,KAAK,MAAM,EACZ,MAAM,uBAAuB,CAAC;AAI/B,wBAAsB,kBAAkB,CACtC,EAAE,EAAE,UAAU,EACd,MAAM,EAAE,IAAI,CAAC,oBAAoB,EAAE,eAAe,CAAC,EACnD,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,YAAY,EACjB,SAAS,CAAC,EAAE,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,SAAS,EAC/C,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,EACjC,gBAAgB,GAAE,MAAqB,GACtC,OAAO,CAAC,IAAI,CAAC,CAgIf;AAED,wBAAsB,oBAAoB,CACxC,EAAE,EAAE,UAAU,EACd,MAAM,EAAE,oBAAoB,EAC5B,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,YAAY,EACjB,SAAS,CAAC,EAAE,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,SAAS,GAC9C,OAAO,CAAC,IAAI,CAAC,CAkDf"}

package/out/zero-cache/src/services/profz.js

@@ -1,103 +0,0 @@
-import { sleep } from "../../../shared/src/sleep.js";
-import { singleProcessMode, subscribeToMessageType } from "../types/processes.js";
-import { isAdminPasswordValid } from "../config/zero-config.js";
-import { CpuProfiler } from "../types/profiler.js";
-import { URLParams } from "../types/url-params.js";
-import { randomUUID } from "node:crypto";
-import auth from "basic-auth";
-//#region ../zero-cache/src/services/profz.ts
-async function handleProfzRequest(lc, config, req, res, getWorker, forcedWorker, localProcessName = "dispatcher") {
-	if (!isAdminPasswordValid(lc, config, auth(req)?.pass)) {
-		res.code(401).header("WWW-Authenticate", "Basic realm=\"Profz Protected Area\"").send("Unauthorized");
-		return;
-	}
-	const params = new URLParams(new URL(req.url, "http://localhost"));
-	const rawDuration = params.getInteger("duration", false) ?? params.getInteger("seconds", false) ?? 5;
-	const durationMs = Math.max(1, Math.min(60, rawDuration)) * 1e3;
-	const targetWorker = forcedWorker ?? params.get("worker", false) ?? void 0;
-	const targetWorkerIndex = params.getInteger("index", false) ?? void 0;
-	const id = randomUUID();
-	const responses = /* @__PURE__ */ new Map();
-	const localProfilePromise = singleProcessMode() || getWorker === void 0 || targetWorker === void 0 || targetWorker === localProcessName ? CpuProfiler.profile(durationMs).catch((err) => {
-		lc.warn?.("Failed to capture local CPU profile:", err);
-		return null;
-	}) : Promise.resolve(null);
-	if (!singleProcessMode() && getWorker !== void 0) try {
-		const worker = await getWorker();
-		const onMessage = (msg) => {
-			if (msg.id === id && msg.profile) responses.set(msg.name, msg.profile);
-			else if (msg.id === id && msg.error) lc.warn?.(`Worker ${msg.name} profile error: ${msg.error}`);
-		};
-		const unsubscribe = subscribeToMessageType(worker, "profileResponse", onMessage);
-		try {
-			worker.send(["profile", {
-				id,
-				durationMs,
-				worker: targetWorker === localProcessName ? "__none__" : targetWorker,
-				workerIndex: targetWorkerIndex
-			}]);
-			await sleep(durationMs + 500);
-		} finally {
-			unsubscribe();
-		}
-	} catch (err) {
-		lc.warn?.("Failed to dispatch profile request to child workers:", err);
-	}
-	const localProfile = await localProfilePromise;
-	if (localProfile) {
-		const localName = targetWorker ?? (singleProcessMode() ? "zero-cache" : localProcessName);
-		responses.set(localName, localProfile);
-	}
-	if (targetWorker !== void 0 && targetWorker !== "all") {
-		let matchedProfile = responses.get(targetWorker);
-		if (!matchedProfile) {
-			for (const [name, prof] of responses.entries()) if (name === targetWorker || name.startsWith(`${targetWorker}-`)) {
-				matchedProfile = prof;
-				break;
-			}
-		}
-		if (matchedProfile) {
-			res.header("Content-Type", "application/json").header("Content-Disposition", `attachment; filename="${targetWorker}.cpuprofile"`).send(matchedProfile);
-			return;
-		}
-		res.code(404).send({ error: `No profile captured for worker "${targetWorker}". Available: ${[...responses.keys()].join(", ")}` });
-		return;
-	}
-	const bundle = {};
-	for (const [name, prof] of responses.entries()) bundle[name] = prof;
-	res.header("Content-Type", "application/json").header("Content-Disposition", `attachment; filename="zero-profile-bundle-${Date.now()}.json"`).send(bundle);
-}
-async function handleProfrmzRequest(lc, config, req, res, getWorker) {
-	if (!isAdminPasswordValid(lc, config, auth(req)?.pass)) {
-		res.code(401).header("WWW-Authenticate", "Basic realm=\"Profrmz Protected Area\"").send("Unauthorized");
-		return;
-	}
-	if (config.changeStreamer.uri) {
-		const upstreamURL = new URL("/profz", config.changeStreamer.uri);
-		const incomingURL = new URL(req.url, "http://localhost");
-		for (const [key, value] of incomingURL.searchParams.entries()) upstreamURL.searchParams.set(key, value);
-		try {
-			const headers = {};
-			if (req.headers.authorization) headers.authorization = req.headers.authorization;
-			const response = await fetch(upstreamURL.toString(), {
-				method: "GET",
-				headers
-			});
-			res.code(response.status);
-			const contentType = response.headers.get("content-type");
-			if (contentType) res.header("content-type", contentType);
-			const contentDisposition = response.headers.get("content-disposition");
-			if (contentDisposition) res.header("content-disposition", contentDisposition);
-			const body = await response.text();
-			return res.send(body);
-		} catch (err) {
-			lc.error?.(`Failed to proxy /profrmz to RM at ${upstreamURL}:`, err);
-			return res.code(502).send({ error: `Failed to proxy profiling request to RM at ${upstreamURL}: ${String(err)}` });
-		}
-	}
-	return handleProfzRequest(lc, config, req, res, getWorker, "change-streamer");
-}
-//#endregion
-export { handleProfrmzRequest, handleProfzRequest };
-
-//# sourceMappingURL=profz.js.map

package/out/zero-cache/src/services/profz.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"profz.js","names":[],"sources":["../../../../../zero-cache/src/services/profz.ts"],"sourcesContent":["import {randomUUID} from 'node:crypto';\nimport type {LogContext} from '@rocicorp/logger';\nimport auth from 'basic-auth';\nimport type {FastifyReply, FastifyRequest} from 'fastify';\nimport {sleep} from '../../../shared/src/sleep.ts';\nimport type {NormalizedZeroConfig} from '../config/normalize.ts';\nimport {isAdminPasswordValid} from '../config/zero-config.ts';\nimport {\n  singleProcessMode,\n  subscribeToMessageType,\n  type ProfileResponse,\n  type ProfileResponseMessage,\n  type Worker,\n} from '../types/processes.ts';\nimport {CpuProfiler} from '../types/profiler.ts';\nimport {URLParams} from '../types/url-params.ts';\n\nexport async function handleProfzRequest(\n  lc: LogContext,\n  config: Pick<NormalizedZeroConfig, 'adminPassword'>,\n  req: FastifyRequest,\n  res: FastifyReply,\n  getWorker?: (() => Promise<Worker>) | undefined,\n  forcedWorker?: string | undefined,\n  localProcessName: string = 'dispatcher',\n): Promise<void> {\n  const credentials = auth(req);\n  if (!isAdminPasswordValid(lc, config, credentials?.pass)) {\n    void res\n      .code(401)\n      .header('WWW-Authenticate', 'Basic realm=\"Profz Protected Area\"')\n      .send('Unauthorized');\n    return;\n  }\n\n  const params = new URLParams(new URL(req.url, 'http://localhost'));\n  const rawDuration =\n    params.getInteger('duration', false) ??\n    params.getInteger('seconds', false) ??\n    5;\n  const durationSec = Math.max(1, Math.min(60, rawDuration));\n  const durationMs = durationSec * 1000;\n  const targetWorker = forcedWorker ?? params.get('worker', false) ?? undefined;\n  const targetWorkerIndex = params.getInteger('index', false) ?? undefined;\n  const id = randomUUID();\n\n  const responses = new Map<string, unknown>();\n\n  // Profile dispatcher / local process if requested, when profiling all processes,\n  // or when no worker dispatcher is available (single process / standalone mode)\n  const shouldProfileLocal =\n    singleProcessMode() ||\n    getWorker === undefined ||\n    targetWorker === undefined ||\n    targetWorker === localProcessName;\n\n  const localProfilePromise = shouldProfileLocal\n    ? CpuProfiler.profile(durationMs).catch(err => {\n        lc.warn?.('Failed to capture local CPU profile:', err);\n        return null;\n      })\n    : Promise.resolve(null);\n\n  if (!singleProcessMode() && getWorker !== undefined) {\n    try {\n      const worker = await getWorker();\n      const onMessage = (msg: ProfileResponse) => {\n        if (msg.id === id && msg.profile) {\n          responses.set(msg.name, msg.profile);\n        } else if (msg.id === id && msg.error) {\n          lc.warn?.(`Worker ${msg.name} profile error: ${msg.error}`);\n        }\n      };\n\n      // The worker is long-lived (and shared across requests), so the\n      // per-request handler must be removed once this request is done.\n      const unsubscribe = subscribeToMessageType<ProfileResponseMessage>(\n        worker,\n        'profileResponse',\n        onMessage,\n      );\n      try {\n        worker.send([\n          'profile',\n          {\n            id,\n            durationMs,\n            worker:\n              targetWorker === localProcessName ? '__none__' : targetWorker,\n            workerIndex: targetWorkerIndex,\n          },\n        ]);\n\n        // Wait for duration plus grace period for IPC transfer\n        await sleep(durationMs + 500);\n      } finally {\n        unsubscribe();\n      }\n    } catch (err) {\n      lc.warn?.('Failed to dispatch profile request to child workers:', err);\n    }\n  }\n\n  const localProfile = await localProfilePromise;\n  if (localProfile) {\n    const localName =\n      targetWorker ?? (singleProcessMode() ? 'zero-cache' : localProcessName);\n    responses.set(localName, localProfile);\n  }\n\n  // If a single specific worker was requested, return that profile directly\n  if (targetWorker !== undefined && targetWorker !== 'all') {\n    let matchedProfile = responses.get(targetWorker);\n    if (!matchedProfile) {\n      // Try matching by prefix or substring (e.g. 'syncer' matches 'syncer-0')\n      for (const [name, prof] of responses.entries()) {\n        if (name === targetWorker || name.startsWith(`${targetWorker}-`)) {\n          matchedProfile = prof;\n          break;\n        }\n      }\n    }\n\n    if (matchedProfile) {\n      void res\n        .header('Content-Type', 'application/json')\n        .header(\n          'Content-Disposition',\n          `attachment; filename=\"${targetWorker}.cpuprofile\"`,\n        )\n        .send(matchedProfile);\n      return;\n    }\n\n    void res.code(404).send({\n      error: `No profile captured for worker \"${targetWorker}\". Available: ${[...responses.keys()].join(', ')}`,\n    });\n    return;\n  }\n\n  // Default (Option A): Return multi-process profile bundle as a JSON map\n  const bundle: Record<string, unknown> = {};\n  for (const [name, prof] of responses.entries()) {\n    bundle[name] = prof;\n  }\n\n  void res\n    .header('Content-Type', 'application/json')\n    .header(\n      'Content-Disposition',\n      `attachment; filename=\"zero-profile-bundle-${Date.now()}.json\"`,\n    )\n    .send(bundle);\n}\n\nexport async function handleProfrmzRequest(\n  lc: LogContext,\n  config: NormalizedZeroConfig,\n  req: FastifyRequest,\n  res: FastifyReply,\n  getWorker?: (() => Promise<Worker>) | undefined,\n): Promise<void> {\n  const credentials = auth(req);\n  if (!isAdminPasswordValid(lc, config, credentials?.pass)) {\n    void res\n      .code(401)\n      .header('WWW-Authenticate', 'Basic realm=\"Profrmz Protected Area\"')\n      .send('Unauthorized');\n    return;\n  }\n\n  // In distributed mode, proxy to the upstream Replication Manager\n  if (config.changeStreamer.uri) {\n    const upstreamURL = new URL('/profz', config.changeStreamer.uri);\n    const incomingURL = new URL(req.url, 'http://localhost');\n    for (const [key, value] of incomingURL.searchParams.entries()) {\n      upstreamURL.searchParams.set(key, value);\n    }\n\n    try {\n      const headers: Record<string, string> = {};\n      if (req.headers.authorization) {\n        headers.authorization = req.headers.authorization;\n      }\n      const response = await fetch(upstreamURL.toString(), {\n        method: 'GET',\n        headers,\n      });\n\n      res.code(response.status);\n      const contentType = response.headers.get('content-type');\n      if (contentType) {\n        res.header('content-type', contentType);\n      }\n      const contentDisposition = response.headers.get('content-disposition');\n      if (contentDisposition) {\n        res.header('content-disposition', contentDisposition);\n      }\n\n      const body = await response.text();\n      return res.send(body);\n    } catch (err) {\n      lc.error?.(`Failed to proxy /profrmz to RM at ${upstreamURL}:`, err);\n      return res.code(502).send({\n        error: `Failed to proxy profiling request to RM at ${upstreamURL}: ${String(err)}`,\n      });\n    }\n  }\n\n  // In single-node mode, profile local change-streamer / RM process\n  return handleProfzRequest(lc, config, req, res, getWorker, 'change-streamer');\n}\n"],"mappings":";;;;;;;;AAiBA,eAAsB,mBACpB,IACA,QACA,KACA,KACA,WACA,cACA,mBAA2B,cACZ;CAEf,IAAI,CAAC,qBAAqB,IAAI,QADV,KAAK,GACa,GAAa,IAAI,GAAG;EACxD,IACG,KAAK,GAAG,EACR,OAAO,oBAAoB,sCAAoC,EAC/D,KAAK,cAAc;EACtB;CACF;CAEA,MAAM,SAAS,IAAI,UAAU,IAAI,IAAI,IAAI,KAAK,kBAAkB,CAAC;CACjE,MAAM,cACJ,OAAO,WAAW,YAAY,KAAK,KACnC,OAAO,WAAW,WAAW,KAAK,KAClC;CAEF,MAAM,aADc,KAAK,IAAI,GAAG,KAAK,IAAI,IAAI,WAAW,CACrC,IAAc;CACjC,MAAM,eAAe,gBAAgB,OAAO,IAAI,UAAU,KAAK,KAAK,KAAA;CACpE,MAAM,oBAAoB,OAAO,WAAW,SAAS,KAAK,KAAK,KAAA;CAC/D,MAAM,KAAK,WAAW;CAEtB,MAAM,4BAAY,IAAI,IAAqB;CAU3C,MAAM,sBALJ,kBAAkB,KAClB,cAAc,KAAA,KACd,iBAAiB,KAAA,KACjB,iBAAiB,mBAGf,YAAY,QAAQ,UAAU,EAAE,OAAM,QAAO;EAC3C,GAAG,OAAO,wCAAwC,GAAG;EACrD,OAAO;CACT,CAAC,IACD,QAAQ,QAAQ,IAAI;CAExB,IAAI,CAAC,kBAAkB,KAAK,cAAc,KAAA,GACxC,IAAI;EACF,MAAM,SAAS,MAAM,UAAU;EAC/B,MAAM,aAAa,QAAyB;GAC1C,IAAI,IAAI,OAAO,MAAM,IAAI,SACvB,UAAU,IAAI,IAAI,MAAM,IAAI,OAAO;QAC9B,IAAI,IAAI,OAAO,MAAM,IAAI,OAC9B,GAAG,OAAO,UAAU,IAAI,KAAK,kBAAkB,IAAI,OAAO;EAE9D;EAIA,MAAM,cAAc,uBAClB,QACA,mBACA,SACF;EACA,IAAI;GACF,OAAO,KAAK,CACV,WACA;IACE;IACA;IACA,QACE,iBAAiB,mBAAmB,aAAa;IACnD,aAAa;GACf,CACF,CAAC;GAGD,MAAM,MAAM,aAAa,GAAG;EAC9B,UAAU;GACR,YAAY;EACd;CACF,SAAS,KAAK;EACZ,GAAG,OAAO,wDAAwD,GAAG;CACvE;CAGF,MAAM,eAAe,MAAM;CAC3B,IAAI,cAAc;EAChB,MAAM,YACJ,iBAAiB,kBAAkB,IAAI,eAAe;EACxD,UAAU,IAAI,WAAW,YAAY;CACvC;CAGA,IAAI,iBAAiB,KAAA,KAAa,iBAAiB,OAAO;EACxD,IAAI,iBAAiB,UAAU,IAAI,YAAY;EAC/C,IAAI,CAAC;QAEE,MAAM,CAAC,MAAM,SAAS,UAAU,QAAQ,GAC3C,IAAI,SAAS,gBAAgB,KAAK,WAAW,GAAG,aAAa,EAAE,GAAG;IAChE,iBAAiB;IACjB;GACF;;EAIJ,IAAI,gBAAgB;GAClB,IACG,OAAO,gBAAgB,kBAAkB,EACzC,OACC,uBACA,yBAAyB,aAAa,aACxC,EACC,KAAK,cAAc;GACtB;EACF;EAEA,IAAS,KAAK,GAAG,EAAE,KAAK,EACtB,OAAO,mCAAmC,aAAa,gBAAgB,CAAC,GAAG,UAAU,KAAK,CAAC,EAAE,KAAK,IAAI,IACxG,CAAC;EACD;CACF;CAGA,MAAM,SAAkC,CAAC;CACzC,KAAK,MAAM,CAAC,MAAM,SAAS,UAAU,QAAQ,GAC3C,OAAO,QAAQ;CAGjB,IACG,OAAO,gBAAgB,kBAAkB,EACzC,OACC,uBACA,6CAA6C,KAAK,IAAI,EAAE,OAC1D,EACC,KAAK,MAAM;AAChB;AAEA,eAAsB,qBACpB,IACA,QACA,KACA,KACA,WACe;CAEf,IAAI,CAAC,qBAAqB,IAAI,QADV,KAAK,GACa,GAAa,IAAI,GAAG;EACxD,IACG,KAAK,GAAG,EACR,OAAO,oBAAoB,wCAAsC,EACjE,KAAK,cAAc;EACtB;CACF;CAGA,IAAI,OAAO,eAAe,KAAK;EAC7B,MAAM,cAAc,IAAI,IAAI,UAAU,OAAO,eAAe,GAAG;EAC/D,MAAM,cAAc,IAAI,IAAI,IAAI,KAAK,kBAAkB;EACvD,KAAK,MAAM,CAAC,KAAK,UAAU,YAAY,aAAa,QAAQ,GAC1D,YAAY,aAAa,IAAI,KAAK,KAAK;EAGzC,IAAI;GACF,MAAM,UAAkC,CAAC;GACzC,IAAI,IAAI,QAAQ,eACd,QAAQ,gBAAgB,IAAI,QAAQ;GAEtC,MAAM,WAAW,MAAM,MAAM,YAAY,SAAS,GAAG;IACnD,QAAQ;IACR;GACF,CAAC;GAED,IAAI,KAAK,SAAS,MAAM;GACxB,MAAM,cAAc,SAAS,QAAQ,IAAI,cAAc;GACvD,IAAI,aACF,IAAI,OAAO,gBAAgB,WAAW;GAExC,MAAM,qBAAqB,SAAS,QAAQ,IAAI,qBAAqB;GACrE,IAAI,oBACF,IAAI,OAAO,uBAAuB,kBAAkB;GAGtD,MAAM,OAAO,MAAM,SAAS,KAAK;GACjC,OAAO,IAAI,KAAK,IAAI;EACtB,SAAS,KAAK;GACZ,GAAG,QAAQ,qCAAqC,YAAY,IAAI,GAAG;GACnE,OAAO,IAAI,KAAK,GAAG,EAAE,KAAK,EACxB,OAAO,8CAA8C,YAAY,IAAI,OAAO,GAAG,IACjF,CAAC;EACH;CACF;CAGA,OAAO,mBAAmB,IAAI,QAAQ,KAAK,KAAK,WAAW,iBAAiB;AAC9E"}

package/out/zero-cache/src/services/view-syncer/hydration-budget.d.ts

@@ -1,33 +0,0 @@
-export type MonotonicClock = () => number;
-/**
- * A soft wall-clock budget for one view-syncer hydration pass.
- *
- * Callers check the budget only at query boundaries. Consequently, a query
- * that starts before the limit is reached is always allowed to finish.
- *
- * The budget measures hydration work. Intervals that are not hydration --
- * notably the remote custom-query transform round trips -- are discounted via
- * {@link excluding}, so that endpoint latency cannot spend a budget that only
- * evicting queries could recover.
- */
-export declare class HydrationBudget {
-    #private;
-    readonly limitMs: number;
-    constructor(limitMs: number, now?: MonotonicClock);
-    /**
-     * Runs `fn`, discounting the time it takes as non-hydration work. The
-     * interval is measured with this budget's own clock, so an injected clock
-     * governs both the elapsed time and what is excluded from it.
-     */
-    excluding<T>(fn: () => Promise<T>): Promise<T>;
-    elapsedMs(): number;
-    /**
-     * Whether the budget is spent. A disabled budget (`limitMs === 0`) is never
-     * exhausted. The elapsed time at the first exhausted check is retained in
-     * {@link exhaustedAtMs} so that reporting does not re-read the clock.
-     */
-    exhausted(): boolean;
-    /** The elapsed time at which {@link exhausted} first returned true. */
-    get exhaustedAtMs(): number | undefined;
-}
-//# sourceMappingURL=hydration-budget.d.ts.map

package/out/zero-cache/src/services/view-syncer/hydration-budget.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"hydration-budget.d.ts","sourceRoot":"","sources":["../../../../../../zero-cache/src/services/view-syncer/hydration-budget.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC;AAE1C;;;;;;;;;;GAUG;AACH,qBAAa,eAAe;;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBAOvB,OAAO,EAAE,MAAM,EACf,GAAG,GAAE,cAAkD;IAWzD;;;;OAIG;IACG,SAAS,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IASpD,SAAS,IAAI,MAAM;IAInB;;;;OAIG;IACH,SAAS,IAAI,OAAO;IAYpB,uEAAuE;IACvE,IAAI,aAAa,IAAI,MAAM,GAAG,SAAS,CAEtC;CACF"}

package/out/zero-cache/src/services/view-syncer/hydration-budget.js

@@ -1,62 +0,0 @@
-import { assert } from "../../../../shared/src/asserts.js";
-//#region ../zero-cache/src/services/view-syncer/hydration-budget.ts
-/**
-* A soft wall-clock budget for one view-syncer hydration pass.
-*
-* Callers check the budget only at query boundaries. Consequently, a query
-* that starts before the limit is reached is always allowed to finish.
-*
-* The budget measures hydration work. Intervals that are not hydration --
-* notably the remote custom-query transform round trips -- are discounted via
-* {@link excluding}, so that endpoint latency cannot spend a budget that only
-* evicting queries could recover.
-*/
-var HydrationBudget = class {
-	limitMs;
-	#now;
-	#startedAt;
-	#excludedMs = 0;
-	#exhaustedAtMs;
-	constructor(limitMs, now = performance.now.bind(performance)) {
-		assert(Number.isSafeInteger(limitMs) && limitMs >= 0, "Hydration budget must be a nonnegative integer");
-		this.limitMs = limitMs;
-		this.#now = now;
-		this.#startedAt = now();
-	}
-	/**
-	* Runs `fn`, discounting the time it takes as non-hydration work. The
-	* interval is measured with this budget's own clock, so an injected clock
-	* governs both the elapsed time and what is excluded from it.
-	*/
-	async excluding(fn) {
-		const start = this.#now();
-		try {
-			return await fn();
-		} finally {
-			this.#excludedMs += this.#now() - start;
-		}
-	}
-	elapsedMs() {
-		return this.#now() - this.#startedAt - this.#excludedMs;
-	}
-	/**
-	* Whether the budget is spent. A disabled budget (`limitMs === 0`) is never
-	* exhausted. The elapsed time at the first exhausted check is retained in
-	* {@link exhaustedAtMs} so that reporting does not re-read the clock.
-	*/
-	exhausted() {
-		if (this.limitMs === 0) return false;
-		const elapsed = this.elapsedMs();
-		if (elapsed < this.limitMs) return false;
-		this.#exhaustedAtMs ??= elapsed;
-		return true;
-	}
-	/** The elapsed time at which {@link exhausted} first returned true. */
-	get exhaustedAtMs() {
-		return this.#exhaustedAtMs;
-	}
-};
-//#endregion
-export { HydrationBudget };
-
-//# sourceMappingURL=hydration-budget.js.map

package/out/zero-cache/src/services/view-syncer/hydration-budget.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"hydration-budget.js","names":["#now","#startedAt","#excludedMs","#exhaustedAtMs"],"sources":["../../../../../../zero-cache/src/services/view-syncer/hydration-budget.ts"],"sourcesContent":["import {assert} from '../../../../shared/src/asserts.ts';\n\nexport type MonotonicClock = () => number;\n\n/**\n * A soft wall-clock budget for one view-syncer hydration pass.\n *\n * Callers check the budget only at query boundaries. Consequently, a query\n * that starts before the limit is reached is always allowed to finish.\n *\n * The budget measures hydration work. Intervals that are not hydration --\n * notably the remote custom-query transform round trips -- are discounted via\n * {@link excluding}, so that endpoint latency cannot spend a budget that only\n * evicting queries could recover.\n */\nexport class HydrationBudget {\n  readonly limitMs: number;\n  readonly #now: MonotonicClock;\n  readonly #startedAt: number;\n  #excludedMs = 0;\n  #exhaustedAtMs: number | undefined;\n\n  constructor(\n    limitMs: number,\n    now: MonotonicClock = performance.now.bind(performance),\n  ) {\n    assert(\n      Number.isSafeInteger(limitMs) && limitMs >= 0,\n      'Hydration budget must be a nonnegative integer',\n    );\n    this.limitMs = limitMs;\n    this.#now = now;\n    this.#startedAt = now();\n  }\n\n  /**\n   * Runs `fn`, discounting the time it takes as non-hydration work. The\n   * interval is measured with this budget's own clock, so an injected clock\n   * governs both the elapsed time and what is excluded from it.\n   */\n  async excluding<T>(fn: () => Promise<T>): Promise<T> {\n    const start = this.#now();\n    try {\n      return await fn();\n    } finally {\n      this.#excludedMs += this.#now() - start;\n    }\n  }\n\n  elapsedMs(): number {\n    return this.#now() - this.#startedAt - this.#excludedMs;\n  }\n\n  /**\n   * Whether the budget is spent. A disabled budget (`limitMs === 0`) is never\n   * exhausted. The elapsed time at the first exhausted check is retained in\n   * {@link exhaustedAtMs} so that reporting does not re-read the clock.\n   */\n  exhausted(): boolean {\n    if (this.limitMs === 0) {\n      return false;\n    }\n    const elapsed = this.elapsedMs();\n    if (elapsed < this.limitMs) {\n      return false;\n    }\n    this.#exhaustedAtMs ??= elapsed;\n    return true;\n  }\n\n  /** The elapsed time at which {@link exhausted} first returned true. */\n  get exhaustedAtMs(): number | undefined {\n    return this.#exhaustedAtMs;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;AAeA,IAAa,kBAAb,MAA6B;CAC3B;CACA;CACA;CACA,cAAc;CACd;CAEA,YACE,SACA,MAAsB,YAAY,IAAI,KAAK,WAAW,GACtD;EACA,OACE,OAAO,cAAc,OAAO,KAAK,WAAW,GAC5C,gDACF;EACA,KAAK,UAAU;EACf,KAAKA,OAAO;EACZ,KAAKC,aAAa,IAAI;CACxB;;;;;;CAOA,MAAM,UAAa,IAAkC;EACnD,MAAM,QAAQ,KAAKD,KAAK;EACxB,IAAI;GACF,OAAO,MAAM,GAAG;EAClB,UAAU;GACR,KAAKE,eAAe,KAAKF,KAAK,IAAI;EACpC;CACF;CAEA,YAAoB;EAClB,OAAO,KAAKA,KAAK,IAAI,KAAKC,aAAa,KAAKC;CAC9C;;;;;;CAOA,YAAqB;EACnB,IAAI,KAAK,YAAY,GACnB,OAAO;EAET,MAAM,UAAU,KAAK,UAAU;EAC/B,IAAI,UAAU,KAAK,SACjB,OAAO;EAET,KAAKC,mBAAmB;EACxB,OAAO;CACT;;CAGA,IAAI,gBAAoC;EACtC,OAAO,KAAKA;CACd;AACF"}