@rocicorp/zero 1.11.0-canary.2 → 1.11.0-canary.20

package/out/zero-cache/src/services/view-syncer/deferred-writes-budget.js

@@ -0,0 +1,128 @@
+import { assert } from "../../../../shared/src/asserts.js";
+import { getHeapStatistics } from "node:v8";
+//#region ../zero-cache/src/services/view-syncer/deferred-writes-budget.ts
+/**
+* The bytes assumed for each row held in memory, which converts the memory
+* given to deferred writes into rows. The width of the rows an advancement
+* will hold is not known before it starts.
+*/
+var BYTES_PER_ROW = 1024;
+/**
+* Bounds the memory that deferred IVM writes (see `deferIvmWrites`) use
+* across the client groups of one syncer process.
+*
+* Each client group holds its own in-memory copy of the changes of the
+* advancement it is processing, so the copies add up across the groups that
+* advance at the same time. Before an advancement starts, its pipeline driver
+* reserves the number of change log entries it advances through (of every
+* table, since counting only the tables it reads would take a scan of the
+* entries). That number bounds the rows its sources can hold: the change log
+* has one entry per row key (a truncation, which does not, resets the
+* pipelines instead), and a row displaced through a unique key must itself
+* have changed in the same interval, so it has its own entry. (An entry that
+* sets a row of a table whose primary key in the client schema is not the key
+* the change log uses can change the row's primary key, which is two rows, so
+* the driver reserves a second row for it as it gets to it.) An advancement that does
+* not fit is written through to the replica snapshot instead, which SQLite
+* bounds with its page cache and spills to disk.
+*
+* The rows are reserved at an assumed {@link BYTES_PER_ROW}, but their width
+* is not known until they are held. So the advancements also add up the
+* bytes they are estimated to hold as they go, and the one that takes the
+* total past the budget writes what it holds through to the replica snapshot,
+* and the rest of its changes after them.
+*
+* The budget is a share of the heap, so it does not depend on how many
+* client groups are connected: when advancements do not overlap, each one
+* can use all of it, and when many do, each gets less and the rest write
+* through.
+*/
+var DeferredWritesBudget = class DeferredWritesBudget {
+	#maxRows;
+	#maxBytes;
+	#reservedRows = 0;
+	#heldBytes = 0;
+	#rowOverruns = 0;
+	/**
+	* A budget of `proportion` of the heap limit, and the rows that fit in it
+	* at {@link BYTES_PER_ROW}.
+	*/
+	static forHeapProportion(proportion) {
+		return DeferredWritesBudget.forBytes(Math.floor(getHeapStatistics().heap_size_limit * proportion));
+	}
+	/** A budget of `bytes`, and the rows that fit in it at {@link BYTES_PER_ROW}. */
+	static forBytes(bytes) {
+		return new DeferredWritesBudget(Math.floor(bytes / BYTES_PER_ROW), bytes);
+	}
+	constructor(maxRows, maxBytes) {
+		this.#maxRows = maxRows;
+		this.#maxBytes = maxBytes;
+	}
+	get maxRows() {
+		return this.#maxRows;
+	}
+	get maxBytes() {
+		return this.#maxBytes;
+	}
+	get reservedRows() {
+		return this.#reservedRows;
+	}
+	/** The estimated bytes held by the advancements that hold rows. */
+	get heldBytes() {
+		return this.#heldBytes;
+	}
+	/**
+	* Reserves `rows` if they fit in what is left of the budget, and returns
+	* whether they did. A successful reservation must be {@link release}d.
+	*/
+	tryReserve(rows) {
+		return this.#tryReserve(rows);
+	}
+	/**
+	* Reserves `rows` more for an advancement that is already holding rows, if
+	* they fit. An advancement reserves a row this way for each change log entry
+	* that can change the primary key of the row it sets, as it gets to it, and
+	* writes through if it does not fit. The rows are {@link release}d with the rest.
+	*/
+	tryReserveMore(rows) {
+		return this.#tryReserve(rows);
+	}
+	#tryReserve(rows) {
+		if (this.#reservedRows + rows > this.#maxRows) return false;
+		this.#reservedRows += rows;
+		return true;
+	}
+	/**
+	* Adds `bytes` (fewer if negative) to the estimated bytes held by an
+	* advancement that has reserved rows, and returns whether the total is
+	* still within the budget. If it is not, the advancement is expected to
+	* stop holding rows and {@link release} them.
+	*/
+	holdBytes(bytes) {
+		this.#heldBytes += bytes;
+		assert(this.#heldBytes >= 0, () => `Holding ${this.#heldBytes} bytes`);
+		return this.#heldBytes <= this.#maxBytes;
+	}
+	/**
+	* The advancements that have held more rows than they reserved, which the
+	* reservation is supposed to rule out. Each writes through the rest of its
+	* changes instead.
+	*/
+	get rowOverruns() {
+		return this.#rowOverruns;
+	}
+	recordRowOverrun() {
+		this.#rowOverruns++;
+	}
+	/** Returns an advancement's reserved `rows` and the `bytes` it held. */
+	release(rows, bytes) {
+		assert(rows <= this.#reservedRows, () => `Releasing ${rows} rows but only ${this.#reservedRows} are reserved`);
+		assert(bytes <= this.#heldBytes, () => `Releasing ${bytes} bytes but only ${this.#heldBytes} are held`);
+		this.#reservedRows -= rows;
+		this.#heldBytes -= bytes;
+	}
+};
+//#endregion
+export { DeferredWritesBudget };
+
+//# sourceMappingURL=deferred-writes-budget.js.map

package/out/zero-cache/src/services/view-syncer/deferred-writes-budget.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deferred-writes-budget.js","names":["#maxRows","#maxBytes","#reservedRows","#heldBytes","#tryReserve","#rowOverruns"],"sources":["../../../../../../zero-cache/src/services/view-syncer/deferred-writes-budget.ts"],"sourcesContent":["import {getHeapStatistics} from 'node:v8';\nimport {assert} from '../../../../shared/src/asserts.ts';\n\n/**\n * The bytes assumed for each row held in memory, which converts the memory\n * given to deferred writes into rows. The width of the rows an advancement\n * will hold is not known before it starts.\n */\nexport const BYTES_PER_ROW = 1024;\n\n/**\n * Bounds the memory that deferred IVM writes (see `deferIvmWrites`) use\n * across the client groups of one syncer process.\n *\n * Each client group holds its own in-memory copy of the changes of the\n * advancement it is processing, so the copies add up across the groups that\n * advance at the same time. Before an advancement starts, its pipeline driver\n * reserves the number of change log entries it advances through (of every\n * table, since counting only the tables it reads would take a scan of the\n * entries). That number bounds the rows its sources can hold: the change log\n * has one entry per row key (a truncation, which does not, resets the\n * pipelines instead), and a row displaced through a unique key must itself\n * have changed in the same interval, so it has its own entry. (An entry that\n * sets a row of a table whose primary key in the client schema is not the key\n * the change log uses can change the row's primary key, which is two rows, so\n * the driver reserves a second row for it as it gets to it.) An advancement that does\n * not fit is written through to the replica snapshot instead, which SQLite\n * bounds with its page cache and spills to disk.\n *\n * The rows are reserved at an assumed {@link BYTES_PER_ROW}, but their width\n * is not known until they are held. So the advancements also add up the\n * bytes they are estimated to hold as they go, and the one that takes the\n * total past the budget writes what it holds through to the replica snapshot,\n * and the rest of its changes after them.\n *\n * The budget is a share of the heap, so it does not depend on how many\n * client groups are connected: when advancements do not overlap, each one\n * can use all of it, and when many do, each gets less and the rest write\n * through.\n */\nexport class DeferredWritesBudget {\n  readonly #maxRows: number;\n  readonly #maxBytes: number;\n  #reservedRows = 0;\n  #heldBytes = 0;\n  #rowOverruns = 0;\n\n  /**\n   * A budget of `proportion` of the heap limit, and the rows that fit in it\n   * at {@link BYTES_PER_ROW}.\n   */\n  static forHeapProportion(proportion: number): DeferredWritesBudget {\n    return DeferredWritesBudget.forBytes(\n      Math.floor(getHeapStatistics().heap_size_limit * proportion),\n    );\n  }\n\n  /** A budget of `bytes`, and the rows that fit in it at {@link BYTES_PER_ROW}. */\n  static forBytes(bytes: number): DeferredWritesBudget {\n    return new DeferredWritesBudget(Math.floor(bytes / BYTES_PER_ROW), bytes);\n  }\n\n  constructor(maxRows: number, maxBytes: number) {\n    this.#maxRows = maxRows;\n    this.#maxBytes = maxBytes;\n  }\n\n  get maxRows(): number {\n    return this.#maxRows;\n  }\n\n  get maxBytes(): number {\n    return this.#maxBytes;\n  }\n\n  get reservedRows(): number {\n    return this.#reservedRows;\n  }\n\n  /** The estimated bytes held by the advancements that hold rows. */\n  get heldBytes(): number {\n    return this.#heldBytes;\n  }\n\n  /**\n   * Reserves `rows` if they fit in what is left of the budget, and returns\n   * whether they did. A successful reservation must be {@link release}d.\n   */\n  tryReserve(rows: number): boolean {\n    return this.#tryReserve(rows);\n  }\n\n  /**\n   * Reserves `rows` more for an advancement that is already holding rows, if\n   * they fit. An advancement reserves a row this way for each change log entry\n   * that can change the primary key of the row it sets, as it gets to it, and\n   * writes through if it does not fit. The rows are {@link release}d with the rest.\n   */\n  tryReserveMore(rows: number): boolean {\n    return this.#tryReserve(rows);\n  }\n\n  #tryReserve(rows: number): boolean {\n    if (this.#reservedRows + rows > this.#maxRows) {\n      return false;\n    }\n    this.#reservedRows += rows;\n    return true;\n  }\n\n  /**\n   * Adds `bytes` (fewer if negative) to the estimated bytes held by an\n   * advancement that has reserved rows, and returns whether the total is\n   * still within the budget. If it is not, the advancement is expected to\n   * stop holding rows and {@link release} them.\n   */\n  holdBytes(bytes: number): boolean {\n    this.#heldBytes += bytes;\n    assert(this.#heldBytes >= 0, () => `Holding ${this.#heldBytes} bytes`);\n    return this.#heldBytes <= this.#maxBytes;\n  }\n\n  /**\n   * The advancements that have held more rows than they reserved, which the\n   * reservation is supposed to rule out. Each writes through the rest of its\n   * changes instead.\n   */\n  get rowOverruns(): number {\n    return this.#rowOverruns;\n  }\n\n  recordRowOverrun(): void {\n    this.#rowOverruns++;\n  }\n\n  /** Returns an advancement's reserved `rows` and the `bytes` it held. */\n  release(rows: number, bytes: number): void {\n    assert(\n      rows <= this.#reservedRows,\n      () =>\n        `Releasing ${rows} rows but only ${this.#reservedRows} are reserved`,\n    );\n    assert(\n      bytes <= this.#heldBytes,\n      () => `Releasing ${bytes} bytes but only ${this.#heldBytes} are held`,\n    );\n    this.#reservedRows -= rows;\n    this.#heldBytes -= bytes;\n  }\n}\n"],"mappings":";;;;;;;;AAQA,IAAa,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgC7B,IAAa,uBAAb,MAAa,qBAAqB;CAChC;CACA;CACA,gBAAgB;CAChB,aAAa;CACb,eAAe;;;;;CAMf,OAAO,kBAAkB,YAA0C;EACjE,OAAO,qBAAqB,SAC1B,KAAK,MAAM,kBAAkB,EAAE,kBAAkB,UAAU,CAC7D;CACF;;CAGA,OAAO,SAAS,OAAqC;EACnD,OAAO,IAAI,qBAAqB,KAAK,MAAM,QAAQ,aAAa,GAAG,KAAK;CAC1E;CAEA,YAAY,SAAiB,UAAkB;EAC7C,KAAKA,WAAW;EAChB,KAAKC,YAAY;CACnB;CAEA,IAAI,UAAkB;EACpB,OAAO,KAAKD;CACd;CAEA,IAAI,WAAmB;EACrB,OAAO,KAAKC;CACd;CAEA,IAAI,eAAuB;EACzB,OAAO,KAAKC;CACd;;CAGA,IAAI,YAAoB;EACtB,OAAO,KAAKC;CACd;;;;;CAMA,WAAW,MAAuB;EAChC,OAAO,KAAKC,YAAY,IAAI;CAC9B;;;;;;;CAQA,eAAe,MAAuB;EACpC,OAAO,KAAKA,YAAY,IAAI;CAC9B;CAEA,YAAY,MAAuB;EACjC,IAAI,KAAKF,gBAAgB,OAAO,KAAKF,UACnC,OAAO;EAET,KAAKE,iBAAiB;EACtB,OAAO;CACT;;;;;;;CAQA,UAAU,OAAwB;EAChC,KAAKC,cAAc;EACnB,OAAO,KAAKA,cAAc,SAAS,WAAW,KAAKA,WAAW,OAAO;EACrE,OAAO,KAAKA,cAAc,KAAKF;CACjC;;;;;;CAOA,IAAI,cAAsB;EACxB,OAAO,KAAKI;CACd;CAEA,mBAAyB;EACvB,KAAKA;CACP;;CAGA,QAAQ,MAAc,OAAqB;EACzC,OACE,QAAQ,KAAKH,qBAEX,aAAa,KAAK,iBAAiB,KAAKA,cAAc,cAC1D;EACA,OACE,SAAS,KAAKC,kBACR,aAAa,MAAM,kBAAkB,KAAKA,WAAW,UAC7D;EACA,KAAKD,iBAAiB;EACtB,KAAKC,cAAc;CACrB;AACF"}

package/out/zero-cache/src/services/view-syncer/drain-coordinator.d.ts

@@ -1,3 +1,4 @@
+type DrainListener = () => void;
 /**
  * There are two types of drains:
  * 1. Elective drains happen when a view-syncer is about to process
@@ -23,10 +24,22 @@
  */
 export declare class DrainCoordinator {
     #private;
-    get draining(): Promise<'draining'>;
+    /**
+     * Calls `listener` once draining has started (immediately if it already
+     * has) and returns a function that unsubscribes it.
+     *
+     * This is a subscription rather than a Promise so that a caller that stops
+     * caring (e.g. a view-syncer that finished initializing) can let go of it.
+     * A reaction attached to a Promise that may never settle would otherwise
+     * be retained by the coordinator for the lifetime of the server, once per
+     * view-syncer ever created.
+     */
+    onDraining(listener: DrainListener): () => void;
+    get drainListenerCount(): number;
     shouldDrain(): 0 | boolean;
     drainNextIn(interval: number): void;
     get forceDrainTimeout(): Promise<void>;
     get nextDrainTime(): number;
 }
+export {};
 //# sourceMappingURL=drain-coordinator.d.ts.map

package/out/zero-cache/src/services/view-syncer/drain-coordinator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"drain-coordinator.d.ts","sourceRoot":"","sources":["../../../../../../zero-cache/src/services/view-syncer/drain-coordinator.ts"],"names":[],"mappings":"AAOA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBAAa,gBAAgB;;IAM3B,IAAI,QAAQ,IAAI,OAAO,CAAC,UAAU,CAAC,CAElC;IAED,WAAW,gBAEV;IAED,WAAW,CAAC,QAAQ,EAAE,MAAM,QAmB3B;IAED,IAAI,iBAAiB,kBAEpB;IAGD,IAAI,aAAa,WAEhB;CACF"}
+{"version":3,"file":"drain-coordinator.d.ts","sourceRoot":"","sources":["../../../../../../zero-cache/src/services/view-syncer/drain-coordinator.ts"],"names":[],"mappings":"AAGA,KAAK,aAAa,GAAG,MAAM,IAAI,CAAC;AAMhC;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBAAa,gBAAgB;;IAO3B;;;;;;;;;OASG;IACH,UAAU,CAAC,QAAQ,EAAE,aAAa,GAAG,MAAM,IAAI,CAS9C;IAGD,IAAI,kBAAkB,WAErB;IAED,WAAW,gBAEV;IAED,WAAW,CAAC,QAAQ,EAAE,MAAM,QA0B3B;IAED,IAAI,iBAAiB,kBAEpB;IAGD,IAAI,aAAa,WAEhB;CACF"}

package/out/zero-cache/src/services/view-syncer/drain-coordinator.js

@@ -26,18 +26,44 @@ var TARGET_UTILIZATION = .6;
 * for the next elective or forced drain.
 */
 var DrainCoordinator = class {
-	#draining = resolver();
+	#draining = false;
+	#drainListeners = /* @__PURE__ */ new Set();
 	#nextDrainTime = 0;
 	#timeout = resolver();
 	#timeoutID;
-	get draining() {
-		return this.#draining.promise;
+	/**
+	* Calls `listener` once draining has started (immediately if it already
+	* has) and returns a function that unsubscribes it.
+	*
+	* This is a subscription rather than a Promise so that a caller that stops
+	* caring (e.g. a view-syncer that finished initializing) can let go of it.
+	* A reaction attached to a Promise that may never settle would otherwise
+	* be retained by the coordinator for the lifetime of the server, once per
+	* view-syncer ever created.
+	*/
+	onDraining(listener) {
+		if (this.#draining) {
+			listener();
+			return () => {};
+		}
+		this.#drainListeners.add(listener);
+		return () => {
+			this.#drainListeners.delete(listener);
+		};
+	}
+	get drainListenerCount() {
+		return this.#drainListeners.size;
 	}
 	shouldDrain() {
 		return this.#nextDrainTime && this.#nextDrainTime <= Date.now();
 	}
 	drainNextIn(interval) {
-		this.#draining.resolve("draining");
+		if (!this.#draining) {
+			this.#draining = true;
+			const listeners = [...this.#drainListeners];
+			this.#drainListeners.clear();
+			for (const listener of listeners) listener();
+		}
 		interval /= TARGET_UTILIZATION;
 		const now = Date.now();
 		assert(this.#nextDrainTime <= now, `drainNextIn() should only be called if shouldDrain()`);

package/out/zero-cache/src/services/view-syncer/drain-coordinator.js.map

@@ -1 +1 @@
-{"version":3,"file":"drain-coordinator.js","names":["#draining","#nextDrainTime","#timeoutID","#timeout"],"sources":["../../../../../../zero-cache/src/services/view-syncer/drain-coordinator.ts"],"sourcesContent":["import {resolver} from '@rocicorp/resolver';\nimport {assert} from '../../../../shared/src/asserts.ts';\n\n// The target (additional) utilization to impose on the server\n// that receives the drained connections.\nconst TARGET_UTILIZATION = 0.6;\n\n/**\n * There are two types of drains:\n * 1. Elective drains happen when a view-syncer is about to process\n *    a replication event and drains instead because {@link shouldDrain()}\n *    returned true. In this case, it exits its processing loop and\n *    calls {@link drainNextIn()} immediately.\n * 2. Force drains are performed by the Syncer, which picks a random\n *    view-syncer and calls {@link stop()}.\n *\n * In the case of a forced drain, the view-syncer may be queued up\n * behind a large amount of CPU-consuming events, and thus it may take\n * a long time before it actually stops. Elective drains are preferred because\n * they are less subject to that variance. However, elective drains only happen\n * if there is a task to be processed, so forced drains are still necessary\n * for draining servers with no work / tasks.\n *\n * The Syncer kicks off the drain process by calling {@link drainNextIn drainNextIn(0)},\n * which sets off a short {@link forceDrainTimeout} but starts returning `true` for\n * {@link shouldDrain()} for elective drains. In the latter case, the drained\n * view-syncer immediately exiting its processing loop and calls\n * {@link drainNextIn drainNextIn(myHydrationTime)} to reset the timeout\n * for the next elective or forced drain.\n */\nexport class DrainCoordinator {\n  readonly #draining = resolver<'draining'>();\n  #nextDrainTime = 0;\n  #timeout = resolver();\n  #timeoutID: NodeJS.Timeout | undefined;\n\n  get draining(): Promise<'draining'> {\n    return this.#draining.promise;\n  }\n\n  shouldDrain() {\n    return this.#nextDrainTime && this.#nextDrainTime <= Date.now();\n  }\n\n  drainNextIn(interval: number) {\n    this.#draining.resolve('draining');\n    // Increase the timeout between drains to give the receiving\n    // server space to perform normal processing.\n    interval /= TARGET_UTILIZATION;\n\n    const now = Date.now();\n    assert(\n      this.#nextDrainTime <= now,\n      `drainNextIn() should only be called if shouldDrain()`,\n    );\n    this.#nextDrainTime = now + interval;\n\n    // Push the forceDrainTimeout forward.\n    clearTimeout(this.#timeoutID);\n    this.#timeoutID = setTimeout(() => {\n      this.#timeout.resolve();\n      this.#timeout = resolver();\n    }, interval + FORCE_DRAIN_PADDING);\n  }\n\n  get forceDrainTimeout() {\n    return this.#timeout.promise;\n  }\n\n  // Exposed for testing.\n  get nextDrainTime() {\n    return this.#nextDrainTime;\n  }\n}\n\nconst FORCE_DRAIN_PADDING = 2;\n"],"mappings":";;;AAKA,IAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;AAyB3B,IAAa,mBAAb,MAA8B;CAC5B,YAAqB,SAAqB;CAC1C,iBAAiB;CACjB,WAAW,SAAS;CACpB;CAEA,IAAI,WAAgC;EAClC,OAAO,KAAKA,UAAU;CACxB;CAEA,cAAc;EACZ,OAAO,KAAKC,kBAAkB,KAAKA,kBAAkB,KAAK,IAAI;CAChE;CAEA,YAAY,UAAkB;EAC5B,KAAKD,UAAU,QAAQ,UAAU;EAGjC,YAAY;EAEZ,MAAM,MAAM,KAAK,IAAI;EACrB,OACE,KAAKC,kBAAkB,KACvB,sDACF;EACA,KAAKA,iBAAiB,MAAM;EAG5B,aAAa,KAAKC,UAAU;EAC5B,KAAKA,aAAa,iBAAiB;GACjC,KAAKC,SAAS,QAAQ;GACtB,KAAKA,WAAW,SAAS;EAC3B,GAAG,WAAW,mBAAmB;CACnC;CAEA,IAAI,oBAAoB;EACtB,OAAO,KAAKA,SAAS;CACvB;CAGA,IAAI,gBAAgB;EAClB,OAAO,KAAKF;CACd;AACF;AAEA,IAAM,sBAAsB"}
+{"version":3,"file":"drain-coordinator.js","names":["#drainListeners","#draining","#nextDrainTime","#timeoutID","#timeout"],"sources":["../../../../../../zero-cache/src/services/view-syncer/drain-coordinator.ts"],"sourcesContent":["import {resolver} from '@rocicorp/resolver';\nimport {assert} from '../../../../shared/src/asserts.ts';\n\ntype DrainListener = () => void;\n\n// The target (additional) utilization to impose on the server\n// that receives the drained connections.\nconst TARGET_UTILIZATION = 0.6;\n\n/**\n * There are two types of drains:\n * 1. Elective drains happen when a view-syncer is about to process\n *    a replication event and drains instead because {@link shouldDrain()}\n *    returned true. In this case, it exits its processing loop and\n *    calls {@link drainNextIn()} immediately.\n * 2. Force drains are performed by the Syncer, which picks a random\n *    view-syncer and calls {@link stop()}.\n *\n * In the case of a forced drain, the view-syncer may be queued up\n * behind a large amount of CPU-consuming events, and thus it may take\n * a long time before it actually stops. Elective drains are preferred because\n * they are less subject to that variance. However, elective drains only happen\n * if there is a task to be processed, so forced drains are still necessary\n * for draining servers with no work / tasks.\n *\n * The Syncer kicks off the drain process by calling {@link drainNextIn drainNextIn(0)},\n * which sets off a short {@link forceDrainTimeout} but starts returning `true` for\n * {@link shouldDrain()} for elective drains. In the latter case, the drained\n * view-syncer immediately exiting its processing loop and calls\n * {@link drainNextIn drainNextIn(myHydrationTime)} to reset the timeout\n * for the next elective or forced drain.\n */\nexport class DrainCoordinator {\n  #draining = false;\n  readonly #drainListeners = new Set<DrainListener>();\n  #nextDrainTime = 0;\n  #timeout = resolver();\n  #timeoutID: NodeJS.Timeout | undefined;\n\n  /**\n   * Calls `listener` once draining has started (immediately if it already\n   * has) and returns a function that unsubscribes it.\n   *\n   * This is a subscription rather than a Promise so that a caller that stops\n   * caring (e.g. a view-syncer that finished initializing) can let go of it.\n   * A reaction attached to a Promise that may never settle would otherwise\n   * be retained by the coordinator for the lifetime of the server, once per\n   * view-syncer ever created.\n   */\n  onDraining(listener: DrainListener): () => void {\n    if (this.#draining) {\n      listener();\n      return () => {};\n    }\n    this.#drainListeners.add(listener);\n    return () => {\n      this.#drainListeners.delete(listener);\n    };\n  }\n\n  // Exposed for testing.\n  get drainListenerCount() {\n    return this.#drainListeners.size;\n  }\n\n  shouldDrain() {\n    return this.#nextDrainTime && this.#nextDrainTime <= Date.now();\n  }\n\n  drainNextIn(interval: number) {\n    if (!this.#draining) {\n      this.#draining = true;\n      const listeners = [...this.#drainListeners];\n      this.#drainListeners.clear();\n      for (const listener of listeners) {\n        listener();\n      }\n    }\n    // Increase the timeout between drains to give the receiving\n    // server space to perform normal processing.\n    interval /= TARGET_UTILIZATION;\n\n    const now = Date.now();\n    assert(\n      this.#nextDrainTime <= now,\n      `drainNextIn() should only be called if shouldDrain()`,\n    );\n    this.#nextDrainTime = now + interval;\n\n    // Push the forceDrainTimeout forward.\n    clearTimeout(this.#timeoutID);\n    this.#timeoutID = setTimeout(() => {\n      this.#timeout.resolve();\n      this.#timeout = resolver();\n    }, interval + FORCE_DRAIN_PADDING);\n  }\n\n  get forceDrainTimeout() {\n    return this.#timeout.promise;\n  }\n\n  // Exposed for testing.\n  get nextDrainTime() {\n    return this.#nextDrainTime;\n  }\n}\n\nconst FORCE_DRAIN_PADDING = 2;\n"],"mappings":";;;AAOA,IAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;AAyB3B,IAAa,mBAAb,MAA8B;CAC5B,YAAY;CACZ,kCAA2B,IAAI,IAAmB;CAClD,iBAAiB;CACjB,WAAW,SAAS;CACpB;;;;;;;;;;;CAYA,WAAW,UAAqC;EAC9C,IAAI,KAAKC,WAAW;GAClB,SAAS;GACT,aAAa,CAAC;EAChB;EACA,KAAKD,gBAAgB,IAAI,QAAQ;EACjC,aAAa;GACX,KAAKA,gBAAgB,OAAO,QAAQ;EACtC;CACF;CAGA,IAAI,qBAAqB;EACvB,OAAO,KAAKA,gBAAgB;CAC9B;CAEA,cAAc;EACZ,OAAO,KAAKE,kBAAkB,KAAKA,kBAAkB,KAAK,IAAI;CAChE;CAEA,YAAY,UAAkB;EAC5B,IAAI,CAAC,KAAKD,WAAW;GACnB,KAAKA,YAAY;GACjB,MAAM,YAAY,CAAC,GAAG,KAAKD,eAAe;GAC1C,KAAKA,gBAAgB,MAAM;GAC3B,KAAK,MAAM,YAAY,WACrB,SAAS;EAEb;EAGA,YAAY;EAEZ,MAAM,MAAM,KAAK,IAAI;EACrB,OACE,KAAKE,kBAAkB,KACvB,sDACF;EACA,KAAKA,iBAAiB,MAAM;EAG5B,aAAa,KAAKC,UAAU;EAC5B,KAAKA,aAAa,iBAAiB;GACjC,KAAKC,SAAS,QAAQ;GACtB,KAAKA,WAAW,SAAS;EAC3B,GAAG,WAAW,mBAAmB;CACnC;CAEA,IAAI,oBAAoB;EACtB,OAAO,KAAKA,SAAS;CACvB;CAGA,IAAI,gBAAgB;EAClB,OAAO,KAAKF;CACd;AACF;AAEA,IAAM,sBAAsB"}

package/out/zero-cache/src/services/view-syncer/hydration-budget.d.ts

@@ -0,0 +1,33 @@
+export type MonotonicClock = () => number;
+/**
+ * A soft wall-clock budget for one view-syncer hydration pass.
+ *
+ * Callers check the budget only at query boundaries. Consequently, a query
+ * that starts before the limit is reached is always allowed to finish.
+ *
+ * The budget measures hydration work. Intervals that are not hydration --
+ * notably the remote custom-query transform round trips -- are discounted via
+ * {@link excluding}, so that endpoint latency cannot spend a budget that only
+ * evicting queries could recover.
+ */
+export declare class HydrationBudget {
+    #private;
+    readonly limitMs: number;
+    constructor(limitMs: number, now?: MonotonicClock);
+    /**
+     * Runs `fn`, discounting the time it takes as non-hydration work. The
+     * interval is measured with this budget's own clock, so an injected clock
+     * governs both the elapsed time and what is excluded from it.
+     */
+    excluding<T>(fn: () => Promise<T>): Promise<T>;
+    elapsedMs(): number;
+    /**
+     * Whether the budget is spent. A disabled budget (`limitMs === 0`) is never
+     * exhausted. The elapsed time at the first exhausted check is retained in
+     * {@link exhaustedAtMs} so that reporting does not re-read the clock.
+     */
+    exhausted(): boolean;
+    /** The elapsed time at which {@link exhausted} first returned true. */
+    get exhaustedAtMs(): number | undefined;
+}
+//# sourceMappingURL=hydration-budget.d.ts.map

package/out/zero-cache/src/services/view-syncer/hydration-budget.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hydration-budget.d.ts","sourceRoot":"","sources":["../../../../../../zero-cache/src/services/view-syncer/hydration-budget.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC;AAE1C;;;;;;;;;;GAUG;AACH,qBAAa,eAAe;;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAMzB,YACE,OAAO,EAAE,MAAM,EACf,GAAG,GAAE,cAAkD,EASxD;IAED;;;;OAIG;IACG,SAAS,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAOnD;IAED,SAAS,IAAI,MAAM,CAElB;IAED;;;;OAIG;IACH,SAAS,IAAI,OAAO,CAUnB;IAED,uEAAuE;IACvE,IAAI,aAAa,IAAI,MAAM,GAAG,SAAS,CAEtC;CACF"}

package/out/zero-cache/src/services/view-syncer/hydration-budget.js

@@ -0,0 +1,62 @@
+import { assert } from "../../../../shared/src/asserts.js";
+//#region ../zero-cache/src/services/view-syncer/hydration-budget.ts
+/**
+* A soft wall-clock budget for one view-syncer hydration pass.
+*
+* Callers check the budget only at query boundaries. Consequently, a query
+* that starts before the limit is reached is always allowed to finish.
+*
+* The budget measures hydration work. Intervals that are not hydration --
+* notably the remote custom-query transform round trips -- are discounted via
+* {@link excluding}, so that endpoint latency cannot spend a budget that only
+* evicting queries could recover.
+*/
+var HydrationBudget = class {
+	limitMs;
+	#now;
+	#startedAt;
+	#excludedMs = 0;
+	#exhaustedAtMs;
+	constructor(limitMs, now = performance.now.bind(performance)) {
+		assert(Number.isSafeInteger(limitMs) && limitMs >= 0, "Hydration budget must be a nonnegative integer");
+		this.limitMs = limitMs;
+		this.#now = now;
+		this.#startedAt = now();
+	}
+	/**
+	* Runs `fn`, discounting the time it takes as non-hydration work. The
+	* interval is measured with this budget's own clock, so an injected clock
+	* governs both the elapsed time and what is excluded from it.
+	*/
+	async excluding(fn) {
+		const start = this.#now();
+		try {
+			return await fn();
+		} finally {
+			this.#excludedMs += this.#now() - start;
+		}
+	}
+	elapsedMs() {
+		return this.#now() - this.#startedAt - this.#excludedMs;
+	}
+	/**
+	* Whether the budget is spent. A disabled budget (`limitMs === 0`) is never
+	* exhausted. The elapsed time at the first exhausted check is retained in
+	* {@link exhaustedAtMs} so that reporting does not re-read the clock.
+	*/
+	exhausted() {
+		if (this.limitMs === 0) return false;
+		const elapsed = this.elapsedMs();
+		if (elapsed < this.limitMs) return false;
+		this.#exhaustedAtMs ??= elapsed;
+		return true;
+	}
+	/** The elapsed time at which {@link exhausted} first returned true. */
+	get exhaustedAtMs() {
+		return this.#exhaustedAtMs;
+	}
+};
+//#endregion
+export { HydrationBudget };
+
+//# sourceMappingURL=hydration-budget.js.map

package/out/zero-cache/src/services/view-syncer/hydration-budget.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hydration-budget.js","names":["#now","#startedAt","#excludedMs","#exhaustedAtMs"],"sources":["../../../../../../zero-cache/src/services/view-syncer/hydration-budget.ts"],"sourcesContent":["import {assert} from '../../../../shared/src/asserts.ts';\n\nexport type MonotonicClock = () => number;\n\n/**\n * A soft wall-clock budget for one view-syncer hydration pass.\n *\n * Callers check the budget only at query boundaries. Consequently, a query\n * that starts before the limit is reached is always allowed to finish.\n *\n * The budget measures hydration work. Intervals that are not hydration --\n * notably the remote custom-query transform round trips -- are discounted via\n * {@link excluding}, so that endpoint latency cannot spend a budget that only\n * evicting queries could recover.\n */\nexport class HydrationBudget {\n  readonly limitMs: number;\n  readonly #now: MonotonicClock;\n  readonly #startedAt: number;\n  #excludedMs = 0;\n  #exhaustedAtMs: number | undefined;\n\n  constructor(\n    limitMs: number,\n    now: MonotonicClock = performance.now.bind(performance),\n  ) {\n    assert(\n      Number.isSafeInteger(limitMs) && limitMs >= 0,\n      'Hydration budget must be a nonnegative integer',\n    );\n    this.limitMs = limitMs;\n    this.#now = now;\n    this.#startedAt = now();\n  }\n\n  /**\n   * Runs `fn`, discounting the time it takes as non-hydration work. The\n   * interval is measured with this budget's own clock, so an injected clock\n   * governs both the elapsed time and what is excluded from it.\n   */\n  async excluding<T>(fn: () => Promise<T>): Promise<T> {\n    const start = this.#now();\n    try {\n      return await fn();\n    } finally {\n      this.#excludedMs += this.#now() - start;\n    }\n  }\n\n  elapsedMs(): number {\n    return this.#now() - this.#startedAt - this.#excludedMs;\n  }\n\n  /**\n   * Whether the budget is spent. A disabled budget (`limitMs === 0`) is never\n   * exhausted. The elapsed time at the first exhausted check is retained in\n   * {@link exhaustedAtMs} so that reporting does not re-read the clock.\n   */\n  exhausted(): boolean {\n    if (this.limitMs === 0) {\n      return false;\n    }\n    const elapsed = this.elapsedMs();\n    if (elapsed < this.limitMs) {\n      return false;\n    }\n    this.#exhaustedAtMs ??= elapsed;\n    return true;\n  }\n\n  /** The elapsed time at which {@link exhausted} first returned true. */\n  get exhaustedAtMs(): number | undefined {\n    return this.#exhaustedAtMs;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;AAeA,IAAa,kBAAb,MAA6B;CAC3B;CACA;CACA;CACA,cAAc;CACd;CAEA,YACE,SACA,MAAsB,YAAY,IAAI,KAAK,WAAW,GACtD;EACA,OACE,OAAO,cAAc,OAAO,KAAK,WAAW,GAC5C,gDACF;EACA,KAAK,UAAU;EACf,KAAKA,OAAO;EACZ,KAAKC,aAAa,IAAI;CACxB;;;;;;CAOA,MAAM,UAAa,IAAkC;EACnD,MAAM,QAAQ,KAAKD,KAAK;EACxB,IAAI;GACF,OAAO,MAAM,GAAG;EAClB,UAAU;GACR,KAAKE,eAAe,KAAKF,KAAK,IAAI;EACpC;CACF;CAEA,YAAoB;EAClB,OAAO,KAAKA,KAAK,IAAI,KAAKC,aAAa,KAAKC;CAC9C;;;;;;CAOA,YAAqB;EACnB,IAAI,KAAK,YAAY,GACnB,OAAO;EAET,MAAM,UAAU,KAAK,UAAU;EAC/B,IAAI,UAAU,KAAK,SACjB,OAAO;EAET,KAAKC,mBAAmB;EACxB,OAAO;CACT;;CAGA,IAAI,gBAAoC;EACtC,OAAO,KAAKA;CACd;AACF"}

package/out/zero-cache/src/services/view-syncer/hydration-circuit-breaker.d.ts

@@ -0,0 +1,51 @@
+import type { MonotonicClock } from './hydration-budget.ts';
+/**
+ * How long a tripped query stays rejected before a retry is allowed.
+ *
+ * A query that blows the timeout is almost always slow because of the shape
+ * of its data rather than because of transient load, so retrying it on every
+ * reconnect would burn a full timeout each time. The cooldown keeps that cost
+ * to at most one timeout per cooldown period per query.
+ */
+export declare const DEFAULT_CIRCUIT_BREAKER_OPEN_MS: number;
+/**
+ * A per-query circuit breaker for view-syncer hydration.
+ *
+ * Hydration of a single query is aborted once its processing time exceeds
+ * {@link timeoutMs}. Callers check {@link exceeded} at the yield points of a
+ * hydration, so a query is only ever aborted between time slices.
+ *
+ * Once a query has been aborted the breaker is "open" for its transformation
+ * hash: {@link isOpen} reports true for {@link openMs}, and callers reject the
+ * query up front instead of hydrating it again. After that the breaker is
+ * implicitly half-open: the next hydration attempt runs, and either succeeds
+ * or trips the breaker again.
+ *
+ * The breaker is keyed by transformation hash rather than query hash because
+ * the transformation (permissions, auth context) determines the pipeline that
+ * runs, and a different transformation of the same query may well be fast.
+ */
+export declare class HydrationCircuitBreaker {
+    #private;
+    readonly timeoutMs: number;
+    readonly openMs: number;
+    constructor(timeoutMs: number, openMs?: number, now?: MonotonicClock);
+    /** Whether the breaker does anything at all. */
+    get enabled(): boolean;
+    /**
+     * Whether a hydration that has consumed `elapsedMs` of processing time must
+     * be aborted. Always false when the breaker is disabled.
+     */
+    exceeded(elapsedMs: number): boolean;
+    /**
+     * Records that hydrating `transformationHash` was aborted.
+     *
+     * Trips are rare, so this is also when expired entries are swept, which
+     * keeps the map bounded by the number of hashes tripped within one cooldown
+     * rather than by every hash ever tripped.
+     */
+    trip(transformationHash: string): void;
+    /** Whether `transformationHash` is currently rejected. */
+    isOpen(transformationHash: string): boolean;
+}
+//# sourceMappingURL=hydration-circuit-breaker.d.ts.map

package/out/zero-cache/src/services/view-syncer/hydration-circuit-breaker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hydration-circuit-breaker.d.ts","sourceRoot":"","sources":["../../../../../../zero-cache/src/services/view-syncer/hydration-circuit-breaker.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,uBAAuB,CAAC;AAE1D;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,QAAa,CAAC;AAE1D;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,uBAAuB;;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAIxB,YACE,SAAS,EAAE,MAAM,EACjB,MAAM,GAAE,MAAwC,EAChD,GAAG,GAAE,cAAkD,EAUxD;IAED,gDAAgD;IAChD,IAAI,OAAO,IAAI,OAAO,CAErB;IAED;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAEnC;IAED;;;;;;OAMG;IACH,IAAI,CAAC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAQrC;IAED,0DAA0D;IAC1D,MAAM,CAAC,kBAAkB,EAAE,MAAM,GAAG,OAAO,CAU1C;CACF"}

package/out/zero-cache/src/services/view-syncer/hydration-circuit-breaker.js

@@ -0,0 +1,78 @@
+import { assert } from "../../../../shared/src/asserts.js";
+//#region ../zero-cache/src/services/view-syncer/hydration-circuit-breaker.ts
+/**
+* How long a tripped query stays rejected before a retry is allowed.
+*
+* A query that blows the timeout is almost always slow because of the shape
+* of its data rather than because of transient load, so retrying it on every
+* reconnect would burn a full timeout each time. The cooldown keeps that cost
+* to at most one timeout per cooldown period per query.
+*/
+var DEFAULT_CIRCUIT_BREAKER_OPEN_MS = 5 * 6e4;
+/**
+* A per-query circuit breaker for view-syncer hydration.
+*
+* Hydration of a single query is aborted once its processing time exceeds
+* {@link timeoutMs}. Callers check {@link exceeded} at the yield points of a
+* hydration, so a query is only ever aborted between time slices.
+*
+* Once a query has been aborted the breaker is "open" for its transformation
+* hash: {@link isOpen} reports true for {@link openMs}, and callers reject the
+* query up front instead of hydrating it again. After that the breaker is
+* implicitly half-open: the next hydration attempt runs, and either succeeds
+* or trips the breaker again.
+*
+* The breaker is keyed by transformation hash rather than query hash because
+* the transformation (permissions, auth context) determines the pipeline that
+* runs, and a different transformation of the same query may well be fast.
+*/
+var HydrationCircuitBreaker = class {
+	timeoutMs;
+	openMs;
+	#now;
+	#openedAt = /* @__PURE__ */ new Map();
+	constructor(timeoutMs, openMs = DEFAULT_CIRCUIT_BREAKER_OPEN_MS, now = performance.now.bind(performance)) {
+		assert(Number.isSafeInteger(timeoutMs) && timeoutMs >= 0, "Hydration timeout must be a nonnegative integer");
+		assert(openMs >= 0, "Circuit breaker open duration must be nonnegative");
+		this.timeoutMs = timeoutMs;
+		this.openMs = openMs;
+		this.#now = now;
+	}
+	/** Whether the breaker does anything at all. */
+	get enabled() {
+		return this.timeoutMs > 0;
+	}
+	/**
+	* Whether a hydration that has consumed `elapsedMs` of processing time must
+	* be aborted. Always false when the breaker is disabled.
+	*/
+	exceeded(elapsedMs) {
+		return this.enabled && elapsedMs >= this.timeoutMs;
+	}
+	/**
+	* Records that hydrating `transformationHash` was aborted.
+	*
+	* Trips are rare, so this is also when expired entries are swept, which
+	* keeps the map bounded by the number of hashes tripped within one cooldown
+	* rather than by every hash ever tripped.
+	*/
+	trip(transformationHash) {
+		const now = this.#now();
+		for (const [hash, openedAt] of this.#openedAt) if (now - openedAt >= this.openMs) this.#openedAt.delete(hash);
+		this.#openedAt.set(transformationHash, now);
+	}
+	/** Whether `transformationHash` is currently rejected. */
+	isOpen(transformationHash) {
+		const openedAt = this.#openedAt.get(transformationHash);
+		if (openedAt === void 0) return false;
+		if (this.#now() - openedAt >= this.openMs) {
+			this.#openedAt.delete(transformationHash);
+			return false;
+		}
+		return true;
+	}
+};
+//#endregion
+export { HydrationCircuitBreaker };
+
+//# sourceMappingURL=hydration-circuit-breaker.js.map

package/out/zero-cache/src/services/view-syncer/hydration-circuit-breaker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hydration-circuit-breaker.js","names":["#now","#openedAt"],"sources":["../../../../../../zero-cache/src/services/view-syncer/hydration-circuit-breaker.ts"],"sourcesContent":["import {assert} from '../../../../shared/src/asserts.ts';\nimport type {MonotonicClock} from './hydration-budget.ts';\n\n/**\n * How long a tripped query stays rejected before a retry is allowed.\n *\n * A query that blows the timeout is almost always slow because of the shape\n * of its data rather than because of transient load, so retrying it on every\n * reconnect would burn a full timeout each time. The cooldown keeps that cost\n * to at most one timeout per cooldown period per query.\n */\nexport const DEFAULT_CIRCUIT_BREAKER_OPEN_MS = 5 * 60_000;\n\n/**\n * A per-query circuit breaker for view-syncer hydration.\n *\n * Hydration of a single query is aborted once its processing time exceeds\n * {@link timeoutMs}. Callers check {@link exceeded} at the yield points of a\n * hydration, so a query is only ever aborted between time slices.\n *\n * Once a query has been aborted the breaker is \"open\" for its transformation\n * hash: {@link isOpen} reports true for {@link openMs}, and callers reject the\n * query up front instead of hydrating it again. After that the breaker is\n * implicitly half-open: the next hydration attempt runs, and either succeeds\n * or trips the breaker again.\n *\n * The breaker is keyed by transformation hash rather than query hash because\n * the transformation (permissions, auth context) determines the pipeline that\n * runs, and a different transformation of the same query may well be fast.\n */\nexport class HydrationCircuitBreaker {\n  readonly timeoutMs: number;\n  readonly openMs: number;\n  readonly #now: MonotonicClock;\n  readonly #openedAt = new Map<string, number>();\n\n  constructor(\n    timeoutMs: number,\n    openMs: number = DEFAULT_CIRCUIT_BREAKER_OPEN_MS,\n    now: MonotonicClock = performance.now.bind(performance),\n  ) {\n    assert(\n      Number.isSafeInteger(timeoutMs) && timeoutMs >= 0,\n      'Hydration timeout must be a nonnegative integer',\n    );\n    assert(openMs >= 0, 'Circuit breaker open duration must be nonnegative');\n    this.timeoutMs = timeoutMs;\n    this.openMs = openMs;\n    this.#now = now;\n  }\n\n  /** Whether the breaker does anything at all. */\n  get enabled(): boolean {\n    return this.timeoutMs > 0;\n  }\n\n  /**\n   * Whether a hydration that has consumed `elapsedMs` of processing time must\n   * be aborted. Always false when the breaker is disabled.\n   */\n  exceeded(elapsedMs: number): boolean {\n    return this.enabled && elapsedMs >= this.timeoutMs;\n  }\n\n  /**\n   * Records that hydrating `transformationHash` was aborted.\n   *\n   * Trips are rare, so this is also when expired entries are swept, which\n   * keeps the map bounded by the number of hashes tripped within one cooldown\n   * rather than by every hash ever tripped.\n   */\n  trip(transformationHash: string): void {\n    const now = this.#now();\n    for (const [hash, openedAt] of this.#openedAt) {\n      if (now - openedAt >= this.openMs) {\n        this.#openedAt.delete(hash);\n      }\n    }\n    this.#openedAt.set(transformationHash, now);\n  }\n\n  /** Whether `transformationHash` is currently rejected. */\n  isOpen(transformationHash: string): boolean {\n    const openedAt = this.#openedAt.get(transformationHash);\n    if (openedAt === undefined) {\n      return false;\n    }\n    if (this.#now() - openedAt >= this.openMs) {\n      this.#openedAt.delete(transformationHash);\n      return false;\n    }\n    return true;\n  }\n}\n"],"mappings":";;;;;;;;;;AAWA,IAAa,kCAAkC,IAAI;;;;;;;;;;;;;;;;;;AAmBnD,IAAa,0BAAb,MAAqC;CACnC;CACA;CACA;CACA,4BAAqB,IAAI,IAAoB;CAE7C,YACE,WACA,SAAiB,iCACjB,MAAsB,YAAY,IAAI,KAAK,WAAW,GACtD;EACA,OACE,OAAO,cAAc,SAAS,KAAK,aAAa,GAChD,iDACF;EACA,OAAO,UAAU,GAAG,mDAAmD;EACvE,KAAK,YAAY;EACjB,KAAK,SAAS;EACd,KAAKA,OAAO;CACd;;CAGA,IAAI,UAAmB;EACrB,OAAO,KAAK,YAAY;CAC1B;;;;;CAMA,SAAS,WAA4B;EACnC,OAAO,KAAK,WAAW,aAAa,KAAK;CAC3C;;;;;;;;CASA,KAAK,oBAAkC;EACrC,MAAM,MAAM,KAAKA,KAAK;EACtB,KAAK,MAAM,CAAC,MAAM,aAAa,KAAKC,WAClC,IAAI,MAAM,YAAY,KAAK,QACzB,KAAKA,UAAU,OAAO,IAAI;EAG9B,KAAKA,UAAU,IAAI,oBAAoB,GAAG;CAC5C;;CAGA,OAAO,oBAAqC;EAC1C,MAAM,WAAW,KAAKA,UAAU,IAAI,kBAAkB;EACtD,IAAI,aAAa,KAAA,GACf,OAAO;EAET,IAAI,KAAKD,KAAK,IAAI,YAAY,KAAK,QAAQ;GACzC,KAAKC,UAAU,OAAO,kBAAkB;GACxC,OAAO;EACT;EACA,OAAO;CACT;AACF"}

package/out/zero-cache/src/services/view-syncer/inspect-handler.d.ts

@@ -7,7 +7,7 @@ import type { ClientHandler } from './client-handler.ts';
 import type { ConnectionContext } from './connection-context-manager.ts';
 import type { CVRStore } from './cvr-store.ts';
 import type { CVRSnapshot } from './cvr.ts';
-export declare function handleInspect(lc: LogContext, body: UnparsedInspectUpBody, cvr: CVRSnapshot, client: ClientHandler, inspectorDelegate: InspectorDelegate, clientGroupID: string, cvrStore: CVRStore, config: NormalizedZeroConfig, ctx: ConnectionContext): Promise<void>;
+export declare function handleInspect(lc: LogContext, body: UnparsedInspectUpBody, cvr: CVRSnapshot, client: ClientHandler, inspectorDelegate: InspectorDelegate, clientGroupID: string, authOwner: object, cvrStore: CVRStore, config: NormalizedZeroConfig, ctx: ConnectionContext): Promise<void>;
 /**
  * Converts per-query server metrics to the appropriate wire format based on the
  * client's protocol version.

package/out/zero-cache/src/services/view-syncer/inspect-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"inspect-handler.d.ts","sourceRoot":"","sources":["../../../../../../zero-cache/src/services/view-syncer/inspect-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AAKjD,OAAO,KAAK,EACV,kBAAkB,EAEnB,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,6CAA6C,CAAC;AAGrD,OAAO,KAAK,EAAC,oBAAoB,EAAC,MAAM,2BAA2B,CAAC;AAMpE,OAAO,KAAK,EAAC,iBAAiB,EAAC,MAAM,oCAAoC,CAAC;AAE1E,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAC,iBAAiB,EAAC,MAAM,iCAAiC,CAAC;AACvE,OAAO,KAAK,EAAC,QAAQ,EAAC,MAAM,gBAAgB,CAAC;AAC7C,OAAO,KAAK,EAAC,WAAW,EAAC,MAAM,UAAU,CAAC;AAE1C,wBAAsB,aAAa,CACjC,EAAE,EAAE,UAAU,EACd,IAAI,EAAE,qBAAqB,EAC3B,GAAG,EAAE,WAAW,EAChB,MAAM,EAAE,aAAa,EACrB,iBAAiB,EAAE,iBAAiB,EACpC,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,oBAAoB,EAC5B,GAAG,EAAE,iBAAiB,GACrB,OAAO,CAAC,IAAI,CAAC,CAiJf;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,kBAAkB,GAAG,IAAI,EAClC,eAAe,EAAE,MAAM,GACtB,kBAAkB,GAAG,IAAI,CAmB3B"}
+{"version":3,"file":"inspect-handler.d.ts","sourceRoot":"","sources":["../../../../../../zero-cache/src/services/view-syncer/inspect-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AAKjD,OAAO,KAAK,EACV,kBAAkB,EAEnB,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,6CAA6C,CAAC;AAGrD,OAAO,KAAK,EAAC,oBAAoB,EAAC,MAAM,2BAA2B,CAAC;AAMpE,OAAO,KAAK,EAAC,iBAAiB,EAAC,MAAM,oCAAoC,CAAC;AAE1E,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAC,iBAAiB,EAAC,MAAM,iCAAiC,CAAC;AACvE,OAAO,KAAK,EAAC,QAAQ,EAAC,MAAM,gBAAgB,CAAC;AAC7C,OAAO,KAAK,EAAC,WAAW,EAAC,MAAM,UAAU,CAAC;AAE1C,wBAAsB,aAAa,CACjC,EAAE,EAAE,UAAU,EACd,IAAI,EAAE,qBAAqB,EAC3B,GAAG,EAAE,WAAW,EAChB,MAAM,EAAE,aAAa,EACrB,iBAAiB,EAAE,iBAAiB,EACpC,aAAa,EAAE,MAAM,EAGrB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,oBAAoB,EAC5B,GAAG,EAAE,iBAAiB,GACrB,OAAO,CAAC,IAAI,CAAC,CAiJf;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,kBAAkB,GAAG,IAAI,EAClC,eAAe,EAAE,MAAM,GACtB,kBAAkB,GAAG,IAAI,CAmB3B"}

package/out/zero-cache/src/services/view-syncer/inspect-handler.js

@@ -6,11 +6,11 @@ import { getServerVersion, isAdminPasswordValid } from "../../config/zero-config
 import { Database } from "../../../../zqlite/src/db.js";
 import { loadPermissions } from "../../auth/load-permissions.js";
 import { StatementRunner } from "../../db/statements.js";
-import { inspectAnalyzeQueryUpSchema } from "../../../../zero-protocol/src/inspect-up.js";
 import { _usingCtx } from "../../../../_virtual/_@oxc-project_runtime@0.130.0/helpers/usingCtx.js";
+import { inspectAnalyzeQueryUpSchema } from "../../../../zero-protocol/src/inspect-up.js";
 import { analyzeQuery } from "../analyze.js";
 //#region ../zero-cache/src/services/view-syncer/inspect-handler.ts
-async function handleInspect(lc, body, cvr, client, inspectorDelegate, clientGroupID, cvrStore, config, ctx) {
+async function handleInspect(lc, body, cvr, client, inspectorDelegate, clientGroupID, authOwner, cvrStore, config, ctx) {
 	if (body.op !== "authenticate" && !inspectorDelegate.isAuthenticated(clientGroupID)) {
 		lc.info?.("Client not authenticated to access the inspector protocol. Sending authentication challenge");
 		client.sendInspectResponse(lc, {
@@ -52,7 +52,7 @@ async function handleInspect(lc, body, cvr, client, inspectorDelegate, clientGro
 			case "authenticate": {
 				const password = body.value;
 				const ok = isAdminPasswordValid(lc, config, password);
-				if (ok) inspectorDelegate.setAuthenticated(clientGroupID);
+				if (ok) inspectorDelegate.setAuthenticated(clientGroupID, authOwner);
 				else inspectorDelegate.clearAuthenticated(clientGroupID);
 				client.sendInspectResponse(lc, {
 					op: "authenticated",

package/out/zero-cache/src/services/view-syncer/inspect-handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"inspect-handler.js","names":[],"sources":["../../../../../../zero-cache/src/services/view-syncer/inspect-handler.ts"],"sourcesContent":["import type {LogContext} from '@rocicorp/logger';\nimport {unreachable} from '../../../../shared/src/asserts.ts';\nimport {must} from '../../../../shared/src/must.ts';\nimport {TDigest} from '../../../../shared/src/tdigest.ts';\nimport * as v from '../../../../shared/src/valita.ts';\nimport type {\n  QueryServerMetrics,\n  ServerMetrics,\n} from '../../../../zero-protocol/src/inspect-down.ts';\nimport {\n  inspectAnalyzeQueryUpSchema,\n  type UnparsedInspectUpBody,\n} from '../../../../zero-protocol/src/inspect-up.ts';\nimport {Database} from '../../../../zqlite/src/db.ts';\nimport {loadPermissions} from '../../auth/load-permissions.ts';\nimport type {NormalizedZeroConfig} from '../../config/normalize.ts';\nimport {\n  getServerVersion,\n  isAdminPasswordValid,\n} from '../../config/zero-config.ts';\nimport {StatementRunner} from '../../db/statements.ts';\nimport type {InspectorDelegate} from '../../server/inspector-delegate.ts';\nimport {analyzeQuery} from '../analyze.ts';\nimport type {ClientHandler} from './client-handler.ts';\nimport type {ConnectionContext} from './connection-context-manager.ts';\nimport type {CVRStore} from './cvr-store.ts';\nimport type {CVRSnapshot} from './cvr.ts';\n\nexport async function handleInspect(\n  lc: LogContext,\n  body: UnparsedInspectUpBody,\n  cvr: CVRSnapshot,\n  client: ClientHandler,\n  inspectorDelegate: InspectorDelegate,\n  clientGroupID: string,\n  cvrStore: CVRStore,\n  config: NormalizedZeroConfig,\n  ctx: ConnectionContext,\n): Promise<void> {\n  // Check if the client is already authenticated. We only authenticate the clientGroup\n  // once per \"worker\".\n  if (\n    body.op !== 'authenticate' &&\n    !inspectorDelegate.isAuthenticated(clientGroupID)\n  ) {\n    lc.info?.(\n      'Client not authenticated to access the inspector protocol. Sending authentication challenge',\n    );\n    client.sendInspectResponse(lc, {\n      op: 'authenticated',\n      id: body.id,\n      value: false,\n    });\n    return;\n  }\n\n  try {\n    switch (body.op) {\n      case 'queries': {\n        const queryRows = await cvrStore.inspectQueries(\n          lc,\n          cvr.ttlClock,\n          body.clientID,\n        );\n\n        // Enhance query rows with server-side materialization metrics\n        const enhancedRows = queryRows.map(row => ({\n          ...row,\n          ast: row.ast ?? inspectorDelegate.getASTForQuery(row.queryID) ?? null,\n          metrics: metricsForProtocol(\n            inspectorDelegate.getMetricsJSONForQuery(row.queryID),\n            ctx.protocolVersion,\n          ),\n        }));\n\n        client.sendInspectResponse(lc, {\n          op: 'queries',\n          id: body.id,\n          value: enhancedRows,\n        });\n        break;\n      }\n\n      case 'metrics': {\n        client.sendInspectResponse(lc, {\n          op: 'metrics',\n          id: body.id,\n          value: inspectorDelegate.getMetricsJSON(),\n        });\n        break;\n      }\n\n      case 'version':\n        client.sendInspectResponse(lc, {\n          op: 'version',\n          id: body.id,\n          value: getServerVersion(config),\n        });\n        break;\n\n      case 'authenticate': {\n        const password = body.value;\n        const ok = isAdminPasswordValid(lc, config, password);\n        if (ok) {\n          inspectorDelegate.setAuthenticated(clientGroupID);\n        } else {\n          inspectorDelegate.clearAuthenticated(clientGroupID);\n        }\n\n        client.sendInspectResponse(lc, {\n          op: 'authenticated',\n          id: body.id,\n          value: ok,\n        });\n\n        break;\n      }\n\n      case 'analyze-query': {\n        const parsedBody = v.parse(body, inspectAnalyzeQueryUpSchema);\n        let ast = parsedBody.ast ?? parsedBody.value;\n        let legacyQuery = true;\n\n        if (parsedBody.name && parsedBody.args) {\n          // Get the AST from the API server by transforming the named query\n          ast = await inspectorDelegate.transformCustomQuery(\n            parsedBody.name,\n            parsedBody.args,\n            ctx,\n          );\n          legacyQuery = false;\n        }\n\n        if (ast === undefined) {\n          throw new Error(\n            'AST is required for analyze-query operation. Either provide an AST directly or ensure custom query transformation is configured.',\n          );\n        }\n\n        let permissions;\n        if (legacyQuery) {\n          using db = new Database(lc, config.replica.file);\n          const dbRunner = new StatementRunner(db);\n          const loaded = loadPermissions(lc, dbRunner, config.app.id, config);\n          if (loaded.permissions) {\n            permissions = loaded.permissions;\n          } else {\n            lc.info?.(\n              'No permissions loaded; analyze-query will run without applying permissions.',\n            );\n          }\n        }\n\n        const result = await analyzeQuery(\n          lc,\n          config,\n          must(cvr.clientSchema),\n          ast,\n          parsedBody.options?.syncedRows,\n          parsedBody.options?.vendedRows,\n          permissions,\n          ctx.auth?.type === 'jwt' ? ctx.auth : undefined,\n          parsedBody.options?.joinPlans,\n        );\n        client.sendInspectResponse(lc, {\n          op: 'analyze-query',\n          id: body.id,\n          value: result,\n        });\n        break;\n      }\n\n      default:\n        unreachable(body);\n    }\n  } catch (e) {\n    lc.warn?.('Error handling inspect message', e);\n    client.sendInspectResponse(lc, {\n      op: 'error',\n      id: body.id,\n      value: (e as Error).message,\n    });\n  }\n}\n\n/**\n * Converts per-query server metrics to the appropriate wire format based on the\n * client's protocol version.\n *\n * Protocol >= 51: new format — `query-hydration-server-ms` (plain number) +\n *   `query-update-server` (TDigest).\n * Protocol < 51: old format — `query-materialization-server` (TDigest) +\n *   `query-update-server` (TDigest). The scalar hydration time is wrapped into a\n *   one-point TDigest for backward compatibility.\n *\n * @visibleForTesting\n */\nexport function metricsForProtocol(\n  metrics: QueryServerMetrics | null,\n  protocolVersion: number,\n): QueryServerMetrics | null {\n  if (protocolVersion >= 51 || metrics === null) {\n    return metrics;\n  }\n  // Backward compat: wrap the scalar hydration ms into a one-point TDigest\n  // under the old field name so that 1.5 clients can parse the response.\n  const hydrateDigest = new TDigest();\n  const hydrateMs = metrics['query-hydration-server-ms'];\n  if (hydrateMs !== undefined) {\n    hydrateDigest.add(hydrateMs);\n  }\n  const legacyMetrics: ServerMetrics = {\n    'query-materialization-server': hydrateDigest.toJSON(),\n    'query-update-server': metrics['query-update-server'],\n  };\n  // Cast to QueryServerMetrics: this is intentional — for old-protocol clients\n  // we send the legacy ServerMetrics wire shape under the QueryServerMetrics type\n  // to satisfy TypeScript while preserving backward compatibility.\n  return legacyMetrics as unknown as QueryServerMetrics;\n}\n"],"mappings":";;;;;;;;;;;;AA4BA,eAAsB,cACpB,IACA,MACA,KACA,QACA,mBACA,eACA,UACA,QACA,KACe;CAGf,IACE,KAAK,OAAO,kBACZ,CAAC,kBAAkB,gBAAgB,aAAa,GAChD;EACA,GAAG,OACD,6FACF;EACA,OAAO,oBAAoB,IAAI;GAC7B,IAAI;GACJ,IAAI,KAAK;GACT,OAAO;EACT,CAAC;EACD;CACF;CAEA,IAAI;EACF,QAAQ,KAAK,IAAb;GACE,KAAK,WAAW;IAQd,MAAM,gBAAe,MAPG,SAAS,eAC/B,IACA,IAAI,UACJ,KAAK,QACP,GAG+B,KAAI,SAAQ;KACzC,GAAG;KACH,KAAK,IAAI,OAAO,kBAAkB,eAAe,IAAI,OAAO,KAAK;KACjE,SAAS,mBACP,kBAAkB,uBAAuB,IAAI,OAAO,GACpD,IAAI,eACN;IACF,EAAE;IAEF,OAAO,oBAAoB,IAAI;KAC7B,IAAI;KACJ,IAAI,KAAK;KACT,OAAO;IACT,CAAC;IACD;GACF;GAEA,KAAK;IACH,OAAO,oBAAoB,IAAI;KAC7B,IAAI;KACJ,IAAI,KAAK;KACT,OAAO,kBAAkB,eAAe;IAC1C,CAAC;IACD;GAGF,KAAK;IACH,OAAO,oBAAoB,IAAI;KAC7B,IAAI;KACJ,IAAI,KAAK;KACT,OAAO,iBAAiB,MAAM;IAChC,CAAC;IACD;GAEF,KAAK,gBAAgB;IACnB,MAAM,WAAW,KAAK;IACtB,MAAM,KAAK,qBAAqB,IAAI,QAAQ,QAAQ;IACpD,IAAI,IACF,kBAAkB,iBAAiB,aAAa;SAEhD,kBAAkB,mBAAmB,aAAa;IAGpD,OAAO,oBAAoB,IAAI;KAC7B,IAAI;KACJ,IAAI,KAAK;KACT,OAAO;IACT,CAAC;IAED;GACF;GAEA,KAAK,iBAAiB;IACpB,MAAM,aAAa,MAAQ,MAAM,2BAA2B;IAC5D,IAAI,MAAM,WAAW,OAAO,WAAW;IACvC,IAAI,cAAc;IAElB,IAAI,WAAW,QAAQ,WAAW,MAAM;KAEtC,MAAM,MAAM,kBAAkB,qBAC5B,WAAW,MACX,WAAW,MACX,GACF;KACA,cAAc;IAChB;IAEA,IAAI,QAAQ,KAAA,GACV,MAAM,IAAI,MACR,kIACF;IAGF,IAAI;IACJ,IAAI,aAAa,IAAA;;KAGf,MAAM,SAAS,gBAAgB,IAAI,IADd,gBAAA,YAAA,EADV,IAAI,SAAS,IAAI,OAAO,QAAQ,IAAI,CACV,CACF,GAAU,OAAO,IAAI,IAAI,MAAM;KAClE,IAAI,OAAO,aACT,cAAc,OAAO;UAErB,GAAG,OACD,6EACF;;;;;;IAIJ,MAAM,SAAS,MAAM,aACnB,IACA,QACA,KAAK,IAAI,YAAY,GACrB,KACA,WAAW,SAAS,YACpB,WAAW,SAAS,YACpB,aACA,IAAI,MAAM,SAAS,QAAQ,IAAI,OAAO,KAAA,GACtC,WAAW,SAAS,SACtB;IACA,OAAO,oBAAoB,IAAI;KAC7B,IAAI;KACJ,IAAI,KAAK;KACT,OAAO;IACT,CAAC;IACD;GACF;GAEA,SACE,YAAY,IAAI;EACpB;CACF,SAAS,GAAG;EACV,GAAG,OAAO,kCAAkC,CAAC;EAC7C,OAAO,oBAAoB,IAAI;GAC7B,IAAI;GACJ,IAAI,KAAK;GACT,OAAQ,EAAY;EACtB,CAAC;CACH;AACF;;;;;;;;;;;;;AAcA,SAAgB,mBACd,SACA,iBAC2B;CAC3B,IAAI,mBAAmB,MAAM,YAAY,MACvC,OAAO;CAIT,MAAM,gBAAgB,IAAI,QAAQ;CAClC,MAAM,YAAY,QAAQ;CAC1B,IAAI,cAAc,KAAA,GAChB,cAAc,IAAI,SAAS;CAS7B,OAAO;EANL,gCAAgC,cAAc,OAAO;EACrD,uBAAuB,QAAQ;CAK1B;AACT"}
+{"version":3,"file":"inspect-handler.js","names":[],"sources":["../../../../../../zero-cache/src/services/view-syncer/inspect-handler.ts"],"sourcesContent":["import type {LogContext} from '@rocicorp/logger';\nimport {unreachable} from '../../../../shared/src/asserts.ts';\nimport {must} from '../../../../shared/src/must.ts';\nimport {TDigest} from '../../../../shared/src/tdigest.ts';\nimport * as v from '../../../../shared/src/valita.ts';\nimport type {\n  QueryServerMetrics,\n  ServerMetrics,\n} from '../../../../zero-protocol/src/inspect-down.ts';\nimport {\n  inspectAnalyzeQueryUpSchema,\n  type UnparsedInspectUpBody,\n} from '../../../../zero-protocol/src/inspect-up.ts';\nimport {Database} from '../../../../zqlite/src/db.ts';\nimport {loadPermissions} from '../../auth/load-permissions.ts';\nimport type {NormalizedZeroConfig} from '../../config/normalize.ts';\nimport {\n  getServerVersion,\n  isAdminPasswordValid,\n} from '../../config/zero-config.ts';\nimport {StatementRunner} from '../../db/statements.ts';\nimport type {InspectorDelegate} from '../../server/inspector-delegate.ts';\nimport {analyzeQuery} from '../analyze.ts';\nimport type {ClientHandler} from './client-handler.ts';\nimport type {ConnectionContext} from './connection-context-manager.ts';\nimport type {CVRStore} from './cvr-store.ts';\nimport type {CVRSnapshot} from './cvr.ts';\n\nexport async function handleInspect(\n  lc: LogContext,\n  body: UnparsedInspectUpBody,\n  cvr: CVRSnapshot,\n  client: ClientHandler,\n  inspectorDelegate: InspectorDelegate,\n  clientGroupID: string,\n  // The service handling the request, on whose behalf authentication is\n  // recorded (see InspectorDelegate.clearAuthenticated).\n  authOwner: object,\n  cvrStore: CVRStore,\n  config: NormalizedZeroConfig,\n  ctx: ConnectionContext,\n): Promise<void> {\n  // Check if the client is already authenticated. We only authenticate the clientGroup\n  // once per \"worker\".\n  if (\n    body.op !== 'authenticate' &&\n    !inspectorDelegate.isAuthenticated(clientGroupID)\n  ) {\n    lc.info?.(\n      'Client not authenticated to access the inspector protocol. Sending authentication challenge',\n    );\n    client.sendInspectResponse(lc, {\n      op: 'authenticated',\n      id: body.id,\n      value: false,\n    });\n    return;\n  }\n\n  try {\n    switch (body.op) {\n      case 'queries': {\n        const queryRows = await cvrStore.inspectQueries(\n          lc,\n          cvr.ttlClock,\n          body.clientID,\n        );\n\n        // Enhance query rows with server-side materialization metrics\n        const enhancedRows = queryRows.map(row => ({\n          ...row,\n          ast: row.ast ?? inspectorDelegate.getASTForQuery(row.queryID) ?? null,\n          metrics: metricsForProtocol(\n            inspectorDelegate.getMetricsJSONForQuery(row.queryID),\n            ctx.protocolVersion,\n          ),\n        }));\n\n        client.sendInspectResponse(lc, {\n          op: 'queries',\n          id: body.id,\n          value: enhancedRows,\n        });\n        break;\n      }\n\n      case 'metrics': {\n        client.sendInspectResponse(lc, {\n          op: 'metrics',\n          id: body.id,\n          value: inspectorDelegate.getMetricsJSON(),\n        });\n        break;\n      }\n\n      case 'version':\n        client.sendInspectResponse(lc, {\n          op: 'version',\n          id: body.id,\n          value: getServerVersion(config),\n        });\n        break;\n\n      case 'authenticate': {\n        const password = body.value;\n        const ok = isAdminPasswordValid(lc, config, password);\n        if (ok) {\n          inspectorDelegate.setAuthenticated(clientGroupID, authOwner);\n        } else {\n          inspectorDelegate.clearAuthenticated(clientGroupID);\n        }\n\n        client.sendInspectResponse(lc, {\n          op: 'authenticated',\n          id: body.id,\n          value: ok,\n        });\n\n        break;\n      }\n\n      case 'analyze-query': {\n        const parsedBody = v.parse(body, inspectAnalyzeQueryUpSchema);\n        let ast = parsedBody.ast ?? parsedBody.value;\n        let legacyQuery = true;\n\n        if (parsedBody.name && parsedBody.args) {\n          // Get the AST from the API server by transforming the named query\n          ast = await inspectorDelegate.transformCustomQuery(\n            parsedBody.name,\n            parsedBody.args,\n            ctx,\n          );\n          legacyQuery = false;\n        }\n\n        if (ast === undefined) {\n          throw new Error(\n            'AST is required for analyze-query operation. Either provide an AST directly or ensure custom query transformation is configured.',\n          );\n        }\n\n        let permissions;\n        if (legacyQuery) {\n          using db = new Database(lc, config.replica.file);\n          const dbRunner = new StatementRunner(db);\n          const loaded = loadPermissions(lc, dbRunner, config.app.id, config);\n          if (loaded.permissions) {\n            permissions = loaded.permissions;\n          } else {\n            lc.info?.(\n              'No permissions loaded; analyze-query will run without applying permissions.',\n            );\n          }\n        }\n\n        const result = await analyzeQuery(\n          lc,\n          config,\n          must(cvr.clientSchema),\n          ast,\n          parsedBody.options?.syncedRows,\n          parsedBody.options?.vendedRows,\n          permissions,\n          ctx.auth?.type === 'jwt' ? ctx.auth : undefined,\n          parsedBody.options?.joinPlans,\n        );\n        client.sendInspectResponse(lc, {\n          op: 'analyze-query',\n          id: body.id,\n          value: result,\n        });\n        break;\n      }\n\n      default:\n        unreachable(body);\n    }\n  } catch (e) {\n    lc.warn?.('Error handling inspect message', e);\n    client.sendInspectResponse(lc, {\n      op: 'error',\n      id: body.id,\n      value: (e as Error).message,\n    });\n  }\n}\n\n/**\n * Converts per-query server metrics to the appropriate wire format based on the\n * client's protocol version.\n *\n * Protocol >= 51: new format — `query-hydration-server-ms` (plain number) +\n *   `query-update-server` (TDigest).\n * Protocol < 51: old format — `query-materialization-server` (TDigest) +\n *   `query-update-server` (TDigest). The scalar hydration time is wrapped into a\n *   one-point TDigest for backward compatibility.\n *\n * @visibleForTesting\n */\nexport function metricsForProtocol(\n  metrics: QueryServerMetrics | null,\n  protocolVersion: number,\n): QueryServerMetrics | null {\n  if (protocolVersion >= 51 || metrics === null) {\n    return metrics;\n  }\n  // Backward compat: wrap the scalar hydration ms into a one-point TDigest\n  // under the old field name so that 1.5 clients can parse the response.\n  const hydrateDigest = new TDigest();\n  const hydrateMs = metrics['query-hydration-server-ms'];\n  if (hydrateMs !== undefined) {\n    hydrateDigest.add(hydrateMs);\n  }\n  const legacyMetrics: ServerMetrics = {\n    'query-materialization-server': hydrateDigest.toJSON(),\n    'query-update-server': metrics['query-update-server'],\n  };\n  // Cast to QueryServerMetrics: this is intentional — for old-protocol clients\n  // we send the legacy ServerMetrics wire shape under the QueryServerMetrics type\n  // to satisfy TypeScript while preserving backward compatibility.\n  return legacyMetrics as unknown as QueryServerMetrics;\n}\n"],"mappings":";;;;;;;;;;;;AA4BA,eAAsB,cACpB,IACA,MACA,KACA,QACA,mBACA,eAGA,WACA,UACA,QACA,KACe;CAGf,IACE,KAAK,OAAO,kBACZ,CAAC,kBAAkB,gBAAgB,aAAa,GAChD;EACA,GAAG,OACD,6FACF;EACA,OAAO,oBAAoB,IAAI;GAC7B,IAAI;GACJ,IAAI,KAAK;GACT,OAAO;EACT,CAAC;EACD;CACF;CAEA,IAAI;EACF,QAAQ,KAAK,IAAb;GACE,KAAK,WAAW;IAQd,MAAM,gBAAe,MAPG,SAAS,eAC/B,IACA,IAAI,UACJ,KAAK,QACP,GAG+B,KAAI,SAAQ;KACzC,GAAG;KACH,KAAK,IAAI,OAAO,kBAAkB,eAAe,IAAI,OAAO,KAAK;KACjE,SAAS,mBACP,kBAAkB,uBAAuB,IAAI,OAAO,GACpD,IAAI,eACN;IACF,EAAE;IAEF,OAAO,oBAAoB,IAAI;KAC7B,IAAI;KACJ,IAAI,KAAK;KACT,OAAO;IACT,CAAC;IACD;GACF;GAEA,KAAK;IACH,OAAO,oBAAoB,IAAI;KAC7B,IAAI;KACJ,IAAI,KAAK;KACT,OAAO,kBAAkB,eAAe;IAC1C,CAAC;IACD;GAGF,KAAK;IACH,OAAO,oBAAoB,IAAI;KAC7B,IAAI;KACJ,IAAI,KAAK;KACT,OAAO,iBAAiB,MAAM;IAChC,CAAC;IACD;GAEF,KAAK,gBAAgB;IACnB,MAAM,WAAW,KAAK;IACtB,MAAM,KAAK,qBAAqB,IAAI,QAAQ,QAAQ;IACpD,IAAI,IACF,kBAAkB,iBAAiB,eAAe,SAAS;SAE3D,kBAAkB,mBAAmB,aAAa;IAGpD,OAAO,oBAAoB,IAAI;KAC7B,IAAI;KACJ,IAAI,KAAK;KACT,OAAO;IACT,CAAC;IAED;GACF;GAEA,KAAK,iBAAiB;IACpB,MAAM,aAAa,MAAQ,MAAM,2BAA2B;IAC5D,IAAI,MAAM,WAAW,OAAO,WAAW;IACvC,IAAI,cAAc;IAElB,IAAI,WAAW,QAAQ,WAAW,MAAM;KAEtC,MAAM,MAAM,kBAAkB,qBAC5B,WAAW,MACX,WAAW,MACX,GACF;KACA,cAAc;IAChB;IAEA,IAAI,QAAQ,KAAA,GACV,MAAM,IAAI,MACR,kIACF;IAGF,IAAI;IACJ,IAAI,aAAa,IAAA;;KAGf,MAAM,SAAS,gBAAgB,IAAI,IADd,gBAAA,YAAA,EADV,IAAI,SAAS,IAAI,OAAO,QAAQ,IAAI,CACV,CACF,GAAU,OAAO,IAAI,IAAI,MAAM;KAClE,IAAI,OAAO,aACT,cAAc,OAAO;UAErB,GAAG,OACD,6EACF;;;;;;IAIJ,MAAM,SAAS,MAAM,aACnB,IACA,QACA,KAAK,IAAI,YAAY,GACrB,KACA,WAAW,SAAS,YACpB,WAAW,SAAS,YACpB,aACA,IAAI,MAAM,SAAS,QAAQ,IAAI,OAAO,KAAA,GACtC,WAAW,SAAS,SACtB;IACA,OAAO,oBAAoB,IAAI;KAC7B,IAAI;KACJ,IAAI,KAAK;KACT,OAAO;IACT,CAAC;IACD;GACF;GAEA,SACE,YAAY,IAAI;EACpB;CACF,SAAS,GAAG;EACV,GAAG,OAAO,kCAAkC,CAAC;EAC7C,OAAO,oBAAoB,IAAI;GAC7B,IAAI;GACJ,IAAI,KAAK;GACT,OAAQ,EAAY;EACtB,CAAC;CACH;AACF;;;;;;;;;;;;;AAcA,SAAgB,mBACd,SACA,iBAC2B;CAC3B,IAAI,mBAAmB,MAAM,YAAY,MACvC,OAAO;CAIT,MAAM,gBAAgB,IAAI,QAAQ;CAClC,MAAM,YAAY,QAAQ;CAC1B,IAAI,cAAc,KAAA,GAChB,cAAc,IAAI,SAAS;CAS7B,OAAO;EANL,gCAAgC,cAAc,OAAO;EACrD,uBAAuB,QAAQ;CAK1B;AACT"}