@rocicorp/zero 1.12.0-canary.0 → 1.12.0-canary.10

package/out/zero-cache/src/services/change-streamer/forwarder.d.ts

@@ -1,49 +0,0 @@
-import type { LogContext } from '@rocicorp/logger';
-import type { Status, WatermarkedChange } from './change-streamer.ts';
-import type { Subscriber } from './subscriber.ts';
-export type ProgressMonitorOptions = {
-    flowControlConsensusTimeoutProportion: number;
-    flowControlSlowSubscriberGracePeriodMs?: number | undefined;
-    setTimeoutFn?: typeof setTimeout | undefined;
-    clearTimeoutFn?: typeof clearTimeout | undefined;
-};
-export declare class Forwarder {
-    #private;
-    constructor(lc: LogContext, opts?: ProgressMonitorOptions);
-    startProgressMonitor(): void;
-    /**
-     * Runs one progress-monitor tick: samples each active subscriber's change
-     * rate, logs slow broadcasts, and disconnects subscribers that have been
-     * continuously lagging for longer than the configured grace period.
-     *
-     * Invoked on an interval by {@link startProgressMonitor()}; exposed (rather
-     * than private) so tests can drive a single tick with an explicit `now`.
-     */
-    checkSubscriberProgress(now: number): void;
-    stopProgressMonitor(): void;
-    /**
-     * `add()` is called in lock step with `Storer.catchup()` so that the
-     * two components have an equivalent interpretation of whether a Transaction is
-     * currently being streamed.
-     */
-    add(sub: Subscriber): void;
-    remove(sub: Subscriber): void;
-    /**
-     * `forward()` is called in lockstep with `Storer.store()` so that the
-     * two components have an equivalent interpretation of whether a Transaction is
-     * currently being streamed.
-     *
-     * This version of forward buffers changes across the current event loop turn
-     * and dispatches them in batches. The change-streamer should call and await
-     * {@link forwardWithFlowControl()} occasionally to avoid memory blowup.
-     */
-    forward(entry: WatermarkedChange): void;
-    sendStatus(status: Status): void;
-    /**
-     * The flow-control-aware equivalent of {@link forward()}, returning a
-     * Promise that resolves when replication should continue.
-     */
-    forwardWithFlowControl(entry: WatermarkedChange): Promise<void>;
-    getAcks(): Set<string>;
-}
-//# sourceMappingURL=forwarder.d.ts.map

package/out/zero-cache/src/services/change-streamer/forwarder.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"forwarder.d.ts","sourceRoot":"","sources":["../../../../../../zero-cache/src/services/change-streamer/forwarder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AAQjD,OAAO,KAAK,EAAY,MAAM,EAAE,iBAAiB,EAAC,MAAM,sBAAsB,CAAC;AAE/E,OAAO,KAAK,EAAC,UAAU,EAAkB,MAAM,iBAAiB,CAAC;AAEjE,MAAM,MAAM,sBAAsB,GAAG;IACnC,qCAAqC,EAAE,MAAM,CAAC;IAC9C,sCAAsC,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAE5D,YAAY,CAAC,EAAE,OAAO,UAAU,GAAG,SAAS,CAAC;IAC7C,cAAc,CAAC,EAAE,OAAO,YAAY,GAAG,SAAS,CAAC;CAClD,CAAC;AAIF,qBAAa,SAAS;;IAmCpB,YACE,EAAE,EAAE,UAAU,EACd,IAAI,GAAE,sBAEL,EA6DF;IAED,oBAAoB,SAMnB;IAED;;;;;;;OAOG;IACH,uBAAuB,CAAC,GAAG,EAAE,MAAM,QA6DlC;IAED,mBAAmB,SAGlB;IAED;;;;OAIG;IACH,GAAG,CAAC,GAAG,EAAE,UAAU,QAOlB;IAED,MAAM,CAAC,GAAG,EAAE,UAAU,QAKrB;IAED;;;;;;;;OAQG;IACH,OAAO,CAAC,KAAK,EAAE,iBAAiB,QAmB/B;IAED,UAAU,CAAC,MAAM,EAAE,MAAM,QAKxB;IAED;;;OAGG;IACG,sBAAsB,CAAC,KAAK,EAAE,iBAAiB,iBA4BpD;IAkED,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAOrB;CACF"}

package/out/zero-cache/src/services/change-streamer/litestream-sync-requester.d.ts

@@ -1,53 +0,0 @@
-import type { LogContext } from '@rocicorp/logger';
-import type { Source } from '../../types/streams.ts';
-import { LitestreamController } from '../litestream/litestream-controller.ts';
-import type { BackedUpWatermark } from './backup-monitor.ts';
-/** The subset of {@link LitestreamController} used by the requester. */
-export type SyncController = Pick<LitestreamController, 'sync' | 'close'>;
-export type SyncRequesterConfig = {
-    /**
-     * Interval between sync requests. This paces how often litestream seals
-     * (and uploads) a new LTX file.
-     */
-    intervalMs: number;
-};
-/**
- * The LitestreamSyncRequester drives litestream v5 backups and tracks which
- * replica watermark is durably backed up, emitting it as a stream of
- * {@link BackedUpWatermark}s.
- *
- * It periodically reads the replica's current watermark `W` and then asks
- * litestream to sync and wait for the upload (`POST /sync {wait: true}`).
- * litestream satisfies the request with a sync pass that *starts after* the
- * request, and a pass syncs up to the end of the WAL, so a successful response
- * means that every transaction committed before the request, including the
- * one that wrote `W`, has been uploaded to the backup. No part of the backup
- * needs to be read to determine this.
- *
- * Requests continue even when `W` is already backed up, so that changes that
- * don't advance the watermark (e.g. change-log cleanup or `PRAGMA optimize`)
- * are also backed up at this cadence rather than only at litestream's slower
- * backstop interval. A request on an idle replica is a local no-op for
- * litestream: there is nothing to seal or upload, and no backup reads.
- *
- * At most one request is outstanding at a time. Failed or timed-out requests
- * are retried with a backoff that starts short and, once it grows to the
- * interval, defers to the regular ticks. Nothing is published until a request
- * succeeds.
- */
-export declare class LitestreamSyncRequester {
-    #private;
-    constructor(lc: LogContext, replicaFile: string, config: SyncRequesterConfig, litestream?: SyncController);
-    /**
-     * Starts requesting syncs and pushes backed-up watermarks to the returned
-     * stream. Must only be called once.
-     */
-    start(): Source<BackedUpWatermark>;
-    /**
-     * Requests a sync unless a request is already outstanding. Resolves when
-     * this tick's request (or the outstanding one) completes.
-     * Exported for testing.
-     */
-    readonly tick: () => Promise<void>;
-}
-//# sourceMappingURL=litestream-sync-requester.d.ts.map

package/out/zero-cache/src/services/change-streamer/litestream-sync-requester.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"litestream-sync-requester.d.ts","sourceRoot":"","sources":["../../../../../../zero-cache/src/services/change-streamer/litestream-sync-requester.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AAIjD,OAAO,KAAK,EAAC,MAAM,EAAC,MAAM,wBAAwB,CAAC;AAEnD,OAAO,EAAC,oBAAoB,EAAC,MAAM,wCAAwC,CAAC;AAE5E,OAAO,KAAK,EAAC,iBAAiB,EAAC,MAAM,qBAAqB,CAAC;AAoC3D,wEAAwE;AACxE,MAAM,MAAM,cAAc,GAAG,IAAI,CAAC,oBAAoB,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC;AAE1E,MAAM,MAAM,mBAAmB,GAAG;IAChC;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,qBAAa,uBAAuB;;IAelC,YACE,EAAE,EAAE,UAAU,EACd,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,mBAAmB,EAC3B,UAAU,GAAE,cAA0D,EAmBvE;IAED;;;OAGG;IACH,KAAK,IAAI,MAAM,CAAC,iBAAiB,CAAC,CAQjC;IAED;;;;OAIG;IACH,QAAQ,CAAC,IAAI,QAAO,OAAO,CAAC,IAAI,CAAC,CAe/B;CAqDH"}

package/out/zero-cache/src/services/change-streamer/litestream3-prometheus-poller.d.ts

@@ -1,88 +0,0 @@
-import type { LogContext } from '@rocicorp/logger';
-import type { Source } from '../../types/streams.ts';
-import type { BackedUpWatermark } from './backup-monitor.ts';
-export declare const CHECK_INTERVAL_MS = 10000;
-/**
- * Allowance for clock skew between the machine reporting litestream metrics
- * and the timestamps reported by the backup destination (e.g. S3).
- */
-export declare const BACKUP_VERIFICATION_SLACK_MS = 60000;
-/**
- * How long the actual backup state may remain *continuously* behind the
- * backup progress claimed by litestream metrics before the backup is
- * considered genuinely wedged and the process is shut down.
- *
- * A wedged backup is dangerous: litestream believes it is making durable
- * progress when it is not, which can silently corrupt the backup (the WAL
- * format only makes *some* such gaps detectable). Once that is confirmed to
- * be the persistent state, continuing to run is worse than crashing, so the
- * process exits loudly (non-zero, with a logged error) and the wedged backup
- * destination becomes the priority to investigate.
- *
- * The change-log is conservatively *not* purged for the entire time the
- * backup is stale, so the only cost of a generous grace period is unbounded
- * change-log growth. We therefore err well on the side of slack: the backup
- * must stay stuck across many {@link CHECK_INTERVAL_MS} checks before we tear
- * the server down, so that a transient hiccup (a slow or briefly unreachable
- * destination, or litestream restarting) does not trigger a shutdown. The
- * staleness clock is reset the moment a purge is confirmed against a real
- * upload.
- */
-export declare const WEDGED_SHUTDOWN_GRACE_MS: number;
-/**
- * How long the BackupMonitor waits for the *first* restorable backup to appear
- * before concluding that the backup pipeline is broken and shutting the process
- * down (see {@link BackupMonitor.#shutDownOnMissingInitialBackup}).
- *
- * On a fresh stack the first backup is not restorable until the initial
- * Postgres->replica sync completes and litestream finishes uploading the
- * initial snapshot — a multipart upload that is not listable in the destination
- * until it is committed. The producer cannot observe that sub-snapshot progress,
- * so this is necessarily a generous timeout. It is scaled by replica size to
- * mirror the platform's storage-scaled startup-probe allowance (~1 hour per
- * 50GB) so that it never fires before the platform would restart a view-syncer
- * that is waiting on the backup.
- */
-export declare const INITIAL_BACKUP_GRACE_MS_PER_UNIT: number;
-/**
- * How often the BackupMonitor re-checks whether the first restorable backup has
- * appeared while a view-syncer holds a snapshot reservation open during a cold
- * start.
- */
-export declare const RESTORABLE_BACKUP_POLL_INTERVAL_MS = 10000;
-/**
- * Returns the time of the most recent object actually uploaded to the
- * backup replica destination (e.g. as determined by listing the snapshots
- * and WAL segments in S3). Rejects if the backup state cannot be determined.
- *
- * See `getLastBackupTime()` in `../litestream/commands.ts` for the
- * production implementation.
- */
-export type BackupStateVerifier = () => Promise<Date>;
-/**
- * The Litestream3PrometheusPoller polls the litestream "/metrics" endpoint to
- * track the watermark (label) value of the `litestream_replica_progress` gauge
- * and emits verified watermarks to a stream of {@link BackedUpWatermark}s.
- *
- * See: https://github.com/rocicorp/litestream/pull/3
- *
- * Because the watermarks reported by litestream metrics reflect what
- * litestream *believes* has been backed up (which has been observed to
- * diverge from reality when uploads silently fail), the cleanup watermark is
- * only published after verifying it against the actual backup state in the
- * replica destination via a {@link BackupStateVerifier}. If the
- * actual backup state stays behind the claimed progress for longer than
- * {@link WEDGED_SHUTDOWN_GRACE_MS}, the backup is treated as wedged and the
- * process is shut down rather than risk corrupting the backup.
- */
-export declare class Litestream3PrometheusPoller {
-    #private;
-    constructor(lc: LogContext, replicaFile: string, backupURL: string, metricsEndpoint: string, verifyBackupState: BackupStateVerifier);
-    /**
-     * Starts polling for watermarks and pushes new ones to returned stream.
-     * Must only be called once.
-     */
-    start(): Source<BackedUpWatermark>;
-    readonly checkVerifyAndPublishWatermarks: () => Promise<void>;
-}
-//# sourceMappingURL=litestream3-prometheus-poller.d.ts.map

package/out/zero-cache/src/services/change-streamer/litestream3-prometheus-poller.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"litestream3-prometheus-poller.d.ts","sourceRoot":"","sources":["../../../../../../zero-cache/src/services/change-streamer/litestream3-prometheus-poller.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AAMjD,OAAO,KAAK,EAAC,MAAM,EAAC,MAAM,wBAAwB,CAAC;AAOnD,OAAO,KAAK,EAAC,iBAAiB,EAAC,MAAM,qBAAqB,CAAC;AAE3D,eAAO,MAAM,iBAAiB,QAAS,CAAC;AAExC;;;GAGG;AACH,eAAO,MAAM,4BAA4B,QAAS,CAAC;AAEnD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,wBAAwB,QAAc,CAAC;AAIpD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,gCAAgC,QAAc,CAAC;AAG5D;;;;GAIG;AACH,eAAO,MAAM,kCAAkC,QAAS,CAAC;AAEzD;;;;;;;GAOG;AACH,MAAM,MAAM,mBAAmB,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;AAEtD;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,2BAA2B;;IAuCtC,YACE,EAAE,EAAE,UAAU,EACd,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,eAAe,EAAE,MAAM,EACvB,iBAAiB,EAAE,mBAAmB,EAavC;IAED;;;OAGG;IACH,KAAK,IAAI,MAAM,CAAC,iBAAiB,CAAC,CASjC;IAqBD,QAAQ,CAAC,+BAA+B,sBAgBtC;CAmSH"}

package/out/zero-cache/src/services/change-streamer/replica-poller.d.ts

@@ -1,15 +0,0 @@
-import type { LogContext } from '@rocicorp/logger';
-import type { Source } from '../../types/streams.ts';
-import type { BackedUpWatermark } from './backup-monitor.ts';
-/**
- * The single-node equivalent of a backup monitor polls the replica file every
- * 30 seconds and schedules cleanup when the watermark
- * (i.e. stateVersion) moves forward.
- */
-export declare class ReplicaPoller {
-    #private;
-    readonly id = "replica-poller";
-    constructor(lc: LogContext, replicaFile: string);
-    start(): Source<BackedUpWatermark>;
-}
-//# sourceMappingURL=replica-poller.d.ts.map

package/out/zero-cache/src/services/change-streamer/replica-poller.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"replica-poller.d.ts","sourceRoot":"","sources":["../../../../../../zero-cache/src/services/change-streamer/replica-poller.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AAGjD,OAAO,KAAK,EAAC,MAAM,EAAC,MAAM,wBAAwB,CAAC;AAGnD,OAAO,KAAK,EAAC,iBAAiB,EAAC,MAAM,qBAAqB,CAAC;AAI3D;;;;GAIG;AACH,qBAAa,aAAa;;IACxB,QAAQ,CAAC,EAAE,oBAAoB;IAQ/B,YAAY,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAM9C;IAED,KAAK,IAAI,MAAM,CAAC,iBAAiB,CAAC,CAQjC;CAiBF"}

package/out/zero-cache/src/services/change-streamer/restore-admission.d.ts

@@ -1,243 +0,0 @@
-import type { LogContext } from '@rocicorp/logger';
-import type { LocalReplica } from './subscribe.ts';
-/**
- * The default time to wait for a subscriber that was granted permission to
- * restore to reconnect (i.e. to open a replacement reservation) after its
- * held connection closes, or after its replacement reservation closes
- * without subscribing (e.g. to retry a failed restore). This covers the
- * subscriber's process exit and restart (e.g. a container restart, the
- * backoff of which starts at 10 seconds in Kubernetes), but not the restore
- * itself, which is tracked by the liveness of its snapshot reservation.
- */
-export declare const DEFAULT_PENDING_GRANT_TTL_MS = 90000;
-/**
- * The default time for which a replacement continues to be counted after its
- * subscriber has caught up, which covers the time for the subscriber to start
- * serving (i.e. become ready) after catching up. See
- * {@link RestoreAdmissionOptions.readinessGracePeriodMs}.
- */
-export declare const DEFAULT_READINESS_GRACE_PERIOD_MS = 5000;
-export type RestoreAdmissionOptions = {
-    /** The replica version of the replication-manager. */
-    replicaVersion: string;
-    /**
-     * The maximum number of subscribers that may be restoring (or granted
-     * permission to restore) at the same time.
-     */
-    maxConcurrentRestores: number;
-    pendingGrantTTLMs?: number | undefined;
-    /**
-     * The time for which a replacement continues to be counted after its
-     * subscriber has caught up, so that the next subscriber is not granted
-     * permission to restore (and stop serving) before the restored one has
-     * started serving. Catching up is followed by the subscriber's readiness
-     * checks (e.g. waiting for the next replication lag report), and by the
-     * container runner's detection of its readiness.
-     */
-    readinessGracePeriodMs?: number | undefined;
-    setTimeoutFn?: typeof setTimeout | undefined;
-    clearTimeoutFn?: typeof clearTimeout | undefined;
-};
-export type AdmissionRequest = {
-    /**
-     * Called when the request is queued, and again whenever its (1-based)
-     * position in the queue changes.
-     */
-    onQueued: (position: number) => void;
-    /** Called (once) when the request is granted. */
-    onGranted: () => void;
-};
-/** A subscribed replacement, returned by {@link RestoreAdmission.reservationSubscribed}. */
-export type Replacement = {
-    /**
-     * Called when the subscriber has caught up. The replacement is released
-     * after the readiness grace period.
-     */
-    caughtUp: () => void;
-    /** Called when the subscription closes. The replacement is released. */
-    closed: () => void;
-};
-export type AdmissionTicket = {
-    /**
-     * Must be called when the requesting connection closes. A queued request
-     * is removed from the queue. For a granted request, this starts the
-     * timer within which the subscriber is expected to reconnect and open a
-     * replacement reservation.
-     */
-    release(): void;
-};
-/**
- * Limits the number of view-syncers that replace their replica at the same
- * time, so that view-syncers switching over from an incompatible
- * replication-manager (e.g. after a resync) do not all stop serving at once.
- *
- * Capacity is consumed by:
- * * Replacement restores: snapshot reservations of subscribers that are
- *   replacing an (incompatible or outdated) local replica, i.e. subscribers
- *   that were serving. Restores onto an empty disk (e.g. a new pod) do not
- *   take a serving subscriber out of service, and are not counted. The
- *   reservation's connection is held open for the duration of the restore,
- *   and the subscription that follows it is held open until the restored
- *   subscriber has caught up, so their liveness tracks that of the
- *   replacement without a timeout.
- * * Outstanding grants: permission to restore that has not yet been
- *   followed by a replacement reservation (e.g. while the subscriber drains
- *   and restarts). Grants are not matched to reservations by identity:
- *   any replacement reservation consumes an outstanding grant, and a grant
- *   that is not consumed expires a short time after the granted connection
- *   closes (e.g. if the subscriber reconnected to a different
- *   replication-manager or was deleted).
- *
- * ## Life cycle of a switchover restore
- *
- * The following traces a view-syncer (VS) with a replica at version `R1`,
- * served by an old replication-manager (RM) at `R1`, while a new RM (e.g.
- * after a resync) is at `R2 > R1`. The RestoreAdmission is that of the new
- * RM. Terms in `code` are those used in the code.
- *
- * 1. **Drain.** The old RM receives a SIGTERM, and its `DrainTracker` sends
- *    `status {draining: true}` to its `drainable` (i.e. serving) subscribers.
- *    It continues to stream changes to them, and exits once they have all
- *    disconnected.
- *
- * 2. **Switchover.** The VS's `DrainHandler` opens a second `/subscribe`
- *    with `switchover: true` at the watermark of its last committed
- *    transaction, which is routed to some RM. The VS continues to consume
- *    the old RM's stream. If the RM is compatible (i.e. another old RM),
- *    the subscription is accepted and the VS simply moves to it. If the RM
- *    is the new one, the subscriber's replica version is older, and the
- *    subscription proceeds to step 3.
- *
- * 3. **Queued.** `ChangeStreamerImpl.subscribe()` holds the subscription
- *    (it is not added to the forwarder) and calls {@link request}. The
- *    request is `queued` and `onQueued(position)` sends
- *    `status {restore: {state: 'queued', position}}`, again whenever the
- *    position changes. If the held connection closes while queued (e.g.
- *    the VS's old stream ended and it gave up on the switchover), the
- *    ticket is `release()`d and the request leaves the queue.
- *
- * 4. **Granted.** When the number in flight (`replacing` + `granted`) is
- *    below `maxConcurrentRestores`, the head of the queue is `granted`: a
- *    {@link Grant} is added (counting toward capacity), and `onGranted()`
- *    sends `status {restore: {state: 'granted'}}`. The VS keeps the granted
- *    connection open, and initiates a self-drain (`drainRequested`): it
- *    fails its health checks, drains its clients, and keeps replicating
- *    from the old RM in the meantime.
- *
- * 5. **Restart.** The VS process exits, closing the granted connection.
- *    The ticket is `release()`d, marking the grant as `released` and
- *    starting the pending grant TTL ({@link DEFAULT_PENDING_GRANT_TTL_MS}),
- *    within which a replacement reservation is expected. The drain itself
- *    does not count against the TTL.
- *
- * 6. **Reservation opened.** The restarted VS sends
- *    `reserve-snapshot {taskID, localReplica}`, and
- *    `ChangeStreamerImpl.startSnapshotReservation()` calls
- *    {@link reservationOpened}:
- *    * A `localReplica` of a different replica version (e.g. `R1`) is
- *      `replacing`: the reservation is counted, and consumes an outstanding
- *      grant (preferring a `released` one), so the number in flight is
- *      unchanged.
- *    * A `localReplica` of the same replica version is `unclassified` until
- *      the reservation is confirmed ({@link reservationConfirmed}) with the
- *      backup's minimum watermark. It is `replacing` if its watermark is
- *      older (i.e. it cannot catch up from the change log).
- *    * No `localReplica` (an empty disk) is not counted.
- *
- *    If the VS reached a different RM instead, the grant here expires after
- *    the TTL and frees its capacity, while the replacement is counted (as
- *    an ungranted one) by the RM that it reached.
- *
- * 7. **Restoring.** The VS restores the backup while holding the
- *    reservation's connection open. A retried reservation from the same
- *    task that arrives while the previous one is still open replaces it
- *    (`SnapshotReservations` `onClose`) but does not end it (`onEnd`), so it
- *    remains `replacing`. If the reservation instead closes without
- *    subscribing (e.g. a failed or disconnected restore, after which the VS
- *    retries), {@link reservationClosed} converts its capacity into a
- *    `released` grant, which the retry's replacement reservation consumes
- *    (step 6), or which expires after the pending grant TTL (e.g. if the VS
- *    was deleted).
- *
- * 8. **Subscribed.** Once restored, the VS subscribes on the same
- *    connection at `R2`, which is accepted. `ChangeStreamerImpl.subscribe()`
- *    calls {@link reservationSubscribed}, which moves the replacement from
- *    its reservation (the key leaves `replacing`) to the subscription
- *    (`catchingUp`), and then closes the task's reservation. Its `onEnd`
- *    calls {@link reservationClosed}, which is a no-op for the moved key.
- *
- * 9. **Caught up.** The VS catches up on the change stream from the
- *    backup's watermark. Once it has acked all changes up to the head of
- *    the stream (`Subscriber.caughtUp`), the replacement is released after
- *    the readiness grace period, which covers the time for the VS to start
- *    serving, and the next queued request is granted. If the VS disconnects
- *    first, the replacement is released immediately.
- *
- * A VS that restarts outside of a switchover with an incompatible replica
- * (e.g. after a crash) enters at step 6 without a grant, and its restore
- * consumes capacity all the same, delaying queued requests.
- *
- * ## States
- *
- * | Term          | Where                    | Meaning                          |
- * | ------------- | ------------------------ | -------------------------------- |
- * | queued        | `Entry.state`            | Held, waiting for capacity       |
- * | granted       | `Entry.state`, `#grants` | Permitted to restore, pending a  |
- * |               |                          | replacement reservation          |
- * | released      | `Entry.state`            | The held connection closed       |
- * | released      | `Grant.released`         | The granted connection, or an    |
- * |               |                          | unsubscribed replacement         |
- * |               |                          | reservation, closed; the TTL is  |
- * |               |                          | running                          |
- * | unclassified  | `#unclassified`          | Same-version reservation, not    |
- * |               |                          | yet confirmed                    |
- * | replacing     | `#replacing`             | Open replacement reservation     |
- * | catching up   | `#catchingUp`            | Subscribed replacement, not yet  |
- * |               |                          | caught up (or within the         |
- * |               |                          | readiness grace period)          |
- * | in flight     | `#inFlight`              | `replacing` + `catchingUp` +     |
- * |               |                          | `granted`, bounded by            |
- * |               |                          | `maxConcurrentRestores`          |
- */
-export declare class RestoreAdmission {
-    #private;
-    constructor(lc: LogContext, opts: RestoreAdmissionOptions);
-    /** For testing and logging. */
-    get stats(): {
-        replacing: number;
-        granted: number;
-        queued: number;
-    };
-    /**
-     * Called when a snapshot reservation is opened by a subscriber with the
-     * given `localReplica` (if any). A subscriber with a local replica of a
-     * different replica version is replacing it. One with the same replica
-     * version is replacing it if it is outdated, which is determined by
-     * {@link reservationConfirmed}. Idempotent for the same `key` (e.g. a
-     * retried reservation).
-     */
-    reservationOpened(key: string, localReplica: LocalReplica | undefined): void;
-    /**
-     * Called when a reservation is confirmed with the minimum watermark of the
-     * replica to restore.
-     */
-    reservationConfirmed(key: string, minWatermark: string): void;
-    /**
-     * Called when a reservation ends. A replacement reservation normally ends
-     * after its task subscribes ({@link reservationSubscribed}), in which case
-     * this is a no-op. A replacement reservation that ends without subscribing
-     * (e.g. a failed or disconnected restore) is most likely followed by a
-     * retry, so its capacity is retained as a released grant (which the retry
-     * consumes) rather than released immediately.
-     */
-    reservationClosed(key: string): void;
-    /**
-     * Called when the task of a reservation subscribes (before the reservation
-     * is closed). If the reservation is a replacement, it continues to be
-     * counted until the readiness grace period after the subscriber has caught
-     * up, or until the subscription closes.
-     */
-    reservationSubscribed(key: string): Replacement | undefined;
-    request(request: AdmissionRequest): AdmissionTicket;
-}
-//# sourceMappingURL=restore-admission.d.ts.map

package/out/zero-cache/src/services/change-streamer/restore-admission.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"restore-admission.d.ts","sourceRoot":"","sources":["../../../../../../zero-cache/src/services/change-streamer/restore-admission.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AAEjD,OAAO,KAAK,EAAC,YAAY,EAAC,MAAM,gBAAgB,CAAC;AAEjD;;;;;;;;GAQG;AACH,eAAO,MAAM,4BAA4B,QAAS,CAAC;AAEnD;;;;;GAKG;AACH,eAAO,MAAM,iCAAiC,OAAQ,CAAC;AAEvD,MAAM,MAAM,uBAAuB,GAAG;IACpC,sDAAsD;IACtD,cAAc,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,qBAAqB,EAAE,MAAM,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC;;;;;;;OAOG;IACH,sBAAsB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAE5C,YAAY,CAAC,EAAE,OAAO,UAAU,GAAG,SAAS,CAAC;IAC7C,cAAc,CAAC,EAAE,OAAO,YAAY,GAAG,SAAS,CAAC;CAClD,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B;;;OAGG;IACH,QAAQ,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC;IAErC,iDAAiD;IACjD,SAAS,EAAE,MAAM,IAAI,CAAC;CACvB,CAAC;AAEF,4FAA4F;AAC5F,MAAM,MAAM,WAAW,GAAG;IACxB;;;OAGG;IACH,QAAQ,EAAE,MAAM,IAAI,CAAC;IAErB,wEAAwE;IACxE,MAAM,EAAE,MAAM,IAAI,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B;;;;;OAKG;IACH,OAAO,IAAI,IAAI,CAAC;CACjB,CAAC;AAeF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoIG;AACH,qBAAa,gBAAgB;;IAwB3B,YAAY,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,uBAAuB,EAqBxD;IAMD,+BAA+B;IAC/B,IAAI,KAAK;QAEL,SAAS;QACT,OAAO;QACP,MAAM;MAET;IAED;;;;;;;OAOG;IACH,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,GAAG,SAAS,QAUpE;IAED;;;OAGG;IACH,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,QAMrD;IAED;;;;;;;OAOG;IACH,iBAAiB,CAAC,GAAG,EAAE,MAAM,QAO5B;IAED;;;;;OAKG;IACH,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAwB1D;IAiBD,OAAO,CAAC,OAAO,EAAE,gBAAgB,GAAG,eAAe,CAKlD;CAoDF"}

package/out/zero-cache/src/services/change-streamer/schema/init.d.ts

@@ -1,6 +0,0 @@
-import type { LogContext } from '@rocicorp/logger';
-import type { PostgresDB } from '../../../types/pg.ts';
-import { type ShardID } from '../../../types/shards.ts';
-export declare function initChangeStreamerSchema(log: LogContext, db: PostgresDB, shard: ShardID): Promise<void>;
-export declare function getLastWatermarkV2(db: PostgresDB, shard: ShardID): Promise<string>;
-//# sourceMappingURL=init.d.ts.map

package/out/zero-cache/src/services/change-streamer/schema/init.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../../../../../../zero-cache/src/services/change-streamer/schema/init.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AAMjD,OAAO,KAAK,EAAC,UAAU,EAAsB,MAAM,sBAAsB,CAAC;AAC1E,OAAO,EAAY,KAAK,OAAO,EAAC,MAAM,0BAA0B,CAAC;AA+BjE,wBAAsB,wBAAwB,CAC5C,GAAG,EAAE,UAAU,EACf,EAAE,EAAE,UAAU,EACd,KAAK,EAAE,OAAO,GACb,OAAO,CAAC,IAAI,CAAC,CA0Ef;AAED,wBAAsB,kBAAkB,CACtC,EAAE,EAAE,UAAU,EACd,KAAK,EAAE,OAAO,GACb,OAAO,CAAC,MAAM,CAAC,CAajB"}

package/out/zero-cache/src/services/change-streamer/schema/tables.d.ts

@@ -1,152 +0,0 @@
-import type { LogContext } from '@rocicorp/logger';
-import type postgres from 'postgres';
-import { AbortError } from '../../../../../shared/src/abort-error.ts';
-import { type PostgresDB } from '../../../types/pg.ts';
-import { type ShardID } from '../../../types/shards.ts';
-import type { BackfillID, Change, TableMetadata } from '../../change-source/protocol/current/data.ts';
-import type { SubscriptionState } from '../../replicator/schema/replication-state.ts';
-export declare const PG_SCHEMA = "cdc";
-export type ChangeLogEntry = {
-    watermark: string;
-    change: Change;
-};
-/**
- * Tracks the watermark from which to resume the change stream and the
- * current owner (task ID) acting as the single writer to the changeLog.
- */
-export type ReplicationState = {
-    lastWatermark: string;
-    owner: string | null;
-    ownerAddress: string | null;
-};
-export declare function createReplicationStateTable(shard: ShardID): string;
-export declare function discoverChangeStreamerAddress(shard: ShardID, sql: PostgresDB): Promise<string | null>;
-/**
- * This mirrors the analogously named table in the SQLite replica
- * (`services/replicator/schema/replication-state.ts`), and is used
- * to detect when the replica has been reset and is no longer compatible
- * with the current ChangeLog.
- */
-export type ReplicationConfig = {
-    replicaVersion: string;
-    publications: readonly string[];
-};
-export declare function createBackfillTables(shard: ShardID): string;
-export type TableMetadataRow = {
-    schema: string;
-    table: string;
-    metadata: TableMetadata;
-};
-export type BackfillingColumn = {
-    schema: string;
-    table: string;
-    column: string;
-    backfill: BackfillID;
-};
-interface PurgeLock {
-    release(): Promise<void>;
-}
-export declare function setupCDCTables(lc: LogContext, db: postgres.TransactionSql, shard: ShardID): Promise<void>;
-export declare function markResetRequired(sql: PostgresDB, shard: ShardID): Promise<void>;
-export type ReplicaSubscriptionState = Pick<SubscriptionState, 'publications' | 'replicaVersion' | 'watermark'>;
-/**
- * Checks, without modifying the change db, that the replica can be served
- * by the change log once {@link ensureReplicationConfig} is called upon
- * taking over the change log. Throws an {@link AutoResetSignal} otherwise.
- *
- * This allows a replication-manager to detect an incompatible replica at
- * startup while leaving the change log to its current owner until then.
- */
-export declare function checkReplicationConfig(lc: LogContext, db: PostgresDB, subscriptionState: ReplicaSubscriptionState, shard: ShardID, autoReset: boolean, behindSlot?: boolean): Promise<void>;
-/**
- * Initializes the cdc tables for the replica, resetting them if they were
- * written for a different replica (version or publications). This disrupts
- * a replication-manager that is serving the change log, and is thus only
- * done when taking over the change log (see `Storer.assumeOwnershipAtHead`).
- *
- * @param purgeLock A purge lock held by the caller, if any, which is released
- *     before the tables are reset.
- * @param behindSlot See {@link checkReplicationConfig}.
- */
-export declare function ensureReplicationConfig(lc: LogContext, db: PostgresDB, subscriptionState: ReplicaSubscriptionState, shard: ShardID, autoReset: boolean, purgeLock?: PurgeLock, setTimeoutFn?: typeof setTimeout, behindSlot?: boolean): Promise<void>;
-export type ChangeLogReinitialization = {
-    /**
-     * The watermark of the replica from which the change log is re-initialized,
-     * i.e. the watermark from which the change stream will resume.
-     */
-    watermark: string;
-    cookies: {
-        tableMetadata: readonly {
-            schema: string;
-            table: string;
-            metadata: TableMetadata;
-        }[];
-        backfilling: readonly {
-            schema: string;
-            table: string;
-            column: string;
-            backfill: BackfillID;
-        }[];
-    };
-    owner: string;
-    ownerAddress: string;
-};
-/**
- * Re-initializes the change log from the state of the replica if it does not
- * contain all of the replica's changes, i.e. if its `lastWatermark` is before
- * the replica's watermark. This is the case if the change log is no longer
- * maintained (e.g. after running in high-availability mode), or if its last
- * owner stopped before persisting changes that it had already forwarded
- * (and backed up). Ownership of the change log is taken in the same
- * transaction, in which:
- *
- * * The `replicationState`, `changeLog`, `tableMetadata`, and `backfilling`
- *   tables are truncated. (The `replicationConfig` is kept;
- *   {@link ensureReplicationConfig} handles changes of the replica version
- *   or publications.)
- * * The change log is seeded with an empty transaction at the replica's
- *   watermark, so that subscribers at that watermark can be caught up, while
- *   subscribers at earlier watermarks are rejected as being too old.
- * * The `tableMetadata` and `backfilling` cookies are set from the replica.
- *
- * Returns `'maintained'` without modifying anything if the change log's
- * `lastWatermark` is at or past the replica's watermark, i.e. the change log
- * contains all of the replica's changes. Because a replication slot is only
- * acked past a transaction once it has been backed up, this means that the
- * change log contains every transaction up to the position of the replica's
- * replication slot, and it can be taken over (and resumed from its head).
- *
- * This is called when the change log's head is behind the position of the
- * replication slot (see `PgChangeLogPurgeLocker`). That position cannot be
- * compared with the watermarks of transactions to determine whether the
- * change log is maintained, as it is also advanced past positions of changes
- * outside of the publication.
- *
- * @param purgeLock A purge lock held by the caller, if any, which is released
- *     before the tables are truncated.
- */
-export declare function reinitializeChangeLog(lc: LogContext, db: PostgresDB, shard: ShardID, { watermark, cookies, owner, ownerAddress }: ChangeLogReinitialization, purgeLock?: PurgeLock, setTimeoutFn?: typeof setTimeout): Promise<'reinitialized' | 'maintained'>;
-export declare const CHANGE_STREAMER_APP_NAME = "zero-change-streamer";
-export declare class AutoResetSignal extends AbortError {
-    readonly name = "AutoResetSignal";
-}
-/**
- * Terminates zero-cache backends that are blocking the current backend
- * from acquiring locks on CDC tables (e.g., during TRUNCATE).
- *
- * This is used during change-DB takeover when the new replication-manager's
- * `ensureReplicationConfig` needs to TRUNCATE tables, but the old
- * replication-manager's storer is still reading from them (e.g., large
- * catchup cursors).
- *
- * The function:
- * 1. Finds backends waiting for a lock on a TRUNCATE in {schema}
- * 2. Uses `pg_blocking_pids()` to identify which backends are blocking them
- * 3. Terminates blocking backends that have `application_name = 'zero-change-streamer'`
- *
- * Must be called on a **separate connection** from the one that is blocked,
- * since the blocked connection is inside a pending transaction.
- */
-export declare function terminateChangeDBLockHolders(lc: LogContext, db: PostgresDB, shard: ShardID): Promise<void>;
-export {};
-//# sourceMappingURL=tables.d.ts.map

package/out/zero-cache/src/services/change-streamer/schema/tables.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"tables.d.ts","sourceRoot":"","sources":["../../../../../../../zero-cache/src/services/change-streamer/schema/tables.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AAEjD,OAAO,KAAK,QAAQ,MAAM,UAAU,CAAC;AAErC,OAAO,EAAC,UAAU,EAAC,MAAM,0CAA0C,CAAC;AAGpE,OAAO,EAAC,KAAK,UAAU,EAA2B,MAAM,sBAAsB,CAAC;AAC/E,OAAO,EAAY,KAAK,OAAO,EAAC,MAAM,0BAA0B,CAAC;AACjE,OAAO,KAAK,EACV,UAAU,EACV,MAAM,EACN,aAAa,EACd,MAAM,8CAA8C,CAAC;AACtD,OAAO,KAAK,EAAC,iBAAiB,EAAC,MAAM,8CAA8C,CAAC;AAOpF,eAAO,MAAM,SAAS,QAAQ,CAAC;AAM/B,MAAM,MAAM,cAAc,GAAG;IAG3B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAmBF;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B,CAAC;AAEF,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,OAAO,UASzD;AAED,wBAAsB,6BAA6B,CACjD,KAAK,EAAE,OAAO,EACd,GAAG,EAAE,UAAU,GACd,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAIxB;AAED;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CACjC,CAAC;AAaF,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,UAiBlD;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,aAAa,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,UAAU,CAAC;CACtB,CAAC;AAYF,UAAU,SAAS;IACjB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED,wBAAsB,cAAc,CAClC,EAAE,EAAE,UAAU,EACd,EAAE,EAAE,QAAQ,CAAC,cAAc,EAC3B,KAAK,EAAE,OAAO,iBAIf;AAED,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,iBAKtE;AAMD,MAAM,MAAM,wBAAwB,GAAG,IAAI,CACzC,iBAAiB,EACjB,cAAc,GAAG,gBAAgB,GAAG,WAAW,CAChD,CAAC;AAwDF;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAC1C,EAAE,EAAE,UAAU,EACd,EAAE,EAAE,UAAU,EACd,iBAAiB,EAAE,wBAAwB,EAC3C,KAAK,EAAE,OAAO,EACd,SAAS,EAAE,OAAO,EAClB,UAAU,UAAQ,GACjB,OAAO,CAAC,IAAI,CAAC,CAgBf;AAED;;;;;;;;;GASG;AACH,wBAAsB,uBAAuB,CAC3C,EAAE,EAAE,UAAU,EACd,EAAE,EAAE,UAAU,EACd,iBAAiB,EAAE,wBAAwB,EAC3C,KAAK,EAAE,OAAO,EACd,SAAS,EAAE,OAAO,EAClB,SAAS,CAAC,EAAE,SAAS,EACrB,YAAY,GAAE,OAAO,UAAuB,EAC5C,UAAU,UAAQ,iBAoFnB;AA6CD,MAAM,MAAM,yBAAyB,GAAG;IACtC;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE;QACP,aAAa,EAAE,SAAS;YACtB,MAAM,EAAE,MAAM,CAAC;YACf,KAAK,EAAE,MAAM,CAAC;YACd,QAAQ,EAAE,aAAa,CAAC;SACzB,EAAE,CAAC;QACJ,WAAW,EAAE,SAAS;YACpB,MAAM,EAAE,MAAM,CAAC;YACf,KAAK,EAAE,MAAM,CAAC;YACd,MAAM,EAAE,MAAM,CAAC;YACf,QAAQ,EAAE,UAAU,CAAC;SACtB,EAAE,CAAC;KACL,CAAC;IACF,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,qBAAqB,CACnC,EAAE,EAAE,UAAU,EACd,EAAE,EAAE,UAAU,EACd,KAAK,EAAE,OAAO,EACd,EAAC,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAC,EAAE,yBAAyB,EACpE,SAAS,CAAC,EAAE,SAAS,EACrB,YAAY,GAAE,OAAO,UAAuB,GAC3C,OAAO,CAAC,eAAe,GAAG,YAAY,CAAC,CAuDzC;AAED,eAAO,MAAM,wBAAwB,yBAAyB,CAAC;AAE/D,qBAAa,eAAgB,SAAQ,UAAU;IAC7C,QAAQ,CAAC,IAAI,qBAAqB;CACnC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,4BAA4B,CAChD,EAAE,EAAE,UAAU,EACd,EAAE,EAAE,UAAU,EACd,KAAK,EAAE,OAAO,iBA4Cf"}