@rocicorp/zero 1.12.0-canary.6 → 1.12.0-canary.7

package/out/zero-cache/src/services/change-streamer/forwarder.d.ts

@@ -1,49 +0,0 @@
-import type { LogContext } from '@rocicorp/logger';
-import type { Status, WatermarkedChange } from './change-streamer.ts';
-import type { Subscriber } from './subscriber.ts';
-export type ProgressMonitorOptions = {
-    flowControlConsensusTimeoutProportion: number;
-    flowControlSlowSubscriberGracePeriodMs?: number | undefined;
-    setTimeoutFn?: typeof setTimeout | undefined;
-    clearTimeoutFn?: typeof clearTimeout | undefined;
-};
-export declare class Forwarder {
-    #private;
-    constructor(lc: LogContext, opts?: ProgressMonitorOptions);
-    startProgressMonitor(): void;
-    /**
-     * Runs one progress-monitor tick: samples each active subscriber's change
-     * rate, logs slow broadcasts, and disconnects subscribers that have been
-     * continuously lagging for longer than the configured grace period.
-     *
-     * Invoked on an interval by {@link startProgressMonitor()}; exposed (rather
-     * than private) so tests can drive a single tick with an explicit `now`.
-     */
-    checkSubscriberProgress(now: number): void;
-    stopProgressMonitor(): void;
-    /**
-     * `add()` is called in lock step with `Storer.catchup()` so that the
-     * two components have an equivalent interpretation of whether a Transaction is
-     * currently being streamed.
-     */
-    add(sub: Subscriber): void;
-    remove(sub: Subscriber): void;
-    /**
-     * `forward()` is called in lockstep with `Storer.store()` so that the
-     * two components have an equivalent interpretation of whether a Transaction is
-     * currently being streamed.
-     *
-     * This version of forward buffers changes across the current event loop turn
-     * and dispatches them in batches. The change-streamer should call and await
-     * {@link forwardWithFlowControl()} occasionally to avoid memory blowup.
-     */
-    forward(entry: WatermarkedChange): void;
-    sendStatus(status: Status): void;
-    /**
-     * The flow-control-aware equivalent of {@link forward()}, returning a
-     * Promise that resolves when replication should continue.
-     */
-    forwardWithFlowControl(entry: WatermarkedChange): Promise<void>;
-    getAcks(): Set<string>;
-}
-//# sourceMappingURL=forwarder.d.ts.map

package/out/zero-cache/src/services/change-streamer/forwarder.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"forwarder.d.ts","sourceRoot":"","sources":["../../../../../../zero-cache/src/services/change-streamer/forwarder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AAQjD,OAAO,KAAK,EAAY,MAAM,EAAE,iBAAiB,EAAC,MAAM,sBAAsB,CAAC;AAE/E,OAAO,KAAK,EAAC,UAAU,EAAkB,MAAM,iBAAiB,CAAC;AAEjE,MAAM,MAAM,sBAAsB,GAAG;IACnC,qCAAqC,EAAE,MAAM,CAAC;IAC9C,sCAAsC,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAE5D,YAAY,CAAC,EAAE,OAAO,UAAU,GAAG,SAAS,CAAC;IAC7C,cAAc,CAAC,EAAE,OAAO,YAAY,GAAG,SAAS,CAAC;CAClD,CAAC;AAIF,qBAAa,SAAS;;IAmCpB,YACE,EAAE,EAAE,UAAU,EACd,IAAI,GAAE,sBAEL,EA6DF;IAED,oBAAoB,SAMnB;IAED;;;;;;;OAOG;IACH,uBAAuB,CAAC,GAAG,EAAE,MAAM,QA6DlC;IAED,mBAAmB,SAGlB;IAED;;;;OAIG;IACH,GAAG,CAAC,GAAG,EAAE,UAAU,QAOlB;IAED,MAAM,CAAC,GAAG,EAAE,UAAU,QAKrB;IAED;;;;;;;;OAQG;IACH,OAAO,CAAC,KAAK,EAAE,iBAAiB,QAmB/B;IAED,UAAU,CAAC,MAAM,EAAE,MAAM,QAKxB;IAED;;;OAGG;IACG,sBAAsB,CAAC,KAAK,EAAE,iBAAiB,iBA4BpD;IAkED,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAOrB;CACF"}

package/out/zero-cache/src/services/change-streamer/litestream-sync-requester.d.ts

@@ -1,80 +0,0 @@
-import type { LogContext } from '@rocicorp/logger';
-import type { Source } from '../../types/streams.ts';
-import { LitestreamController } from '../litestream/litestream-controller.ts';
-import type { BackedUpWatermark, BackupPoller } from './backup-monitor.ts';
-/**
- * How often the local replica is polled while a requested sync (see
- * {@link LitestreamSyncRequester.requestSync}) waits for the replica to reach
- * the requested watermark. Each poll is a single read of the replica's
- * watermark, which the replica typically reaches within a poll or two.
- */
-export declare const EXPEDITED_POLL_INTERVAL_MS = 50;
-/** The subset of {@link LitestreamController} used by the requester. */
-export type SyncController = Pick<LitestreamController, 'sync' | 'close'>;
-export type SyncRequesterConfig = {
-    /**
-     * Interval between sync requests. This paces how often litestream seals
-     * (and uploads) a new LTX file.
-     */
-    intervalMs: number;
-};
-/**
- * The LitestreamSyncRequester drives litestream v5 backups and tracks which
- * replica watermark is durably backed up, emitting it as a stream of
- * {@link BackedUpWatermark}s.
- *
- * It periodically reads the replica's current watermark `W` and then asks
- * litestream to sync and wait for the upload (`POST /sync {wait: true}`).
- * litestream satisfies the request with a sync pass that *starts after* the
- * request, and a pass syncs up to the end of the WAL, so a successful response
- * means that every transaction committed before the request, including the
- * one that wrote `W`, has been uploaded to the backup. No part of the backup
- * needs to be read to determine this.
- *
- * Requests continue even when `W` is already backed up, so that changes that
- * don't advance the watermark (e.g. change-log cleanup or `PRAGMA optimize`)
- * are also backed up at this cadence rather than only at litestream's slower
- * backstop interval. A request on an idle replica is a local no-op for
- * litestream: there is nothing to seal or upload, and no backup reads.
- *
- * At most one request is outstanding at a time. Failed or timed-out requests
- * are retried with a backoff that starts short and, once it grows to the
- * interval, defers to the regular ticks. Nothing is published until a request
- * succeeds.
- *
- * A sync through a specific watermark can also be requested out of band (see
- * {@link requestSync}), e.g. when a replica fork waits on its backup.
- */
-export declare class LitestreamSyncRequester implements BackupPoller {
-    #private;
-    constructor(lc: LogContext, replicaFile: string, config: SyncRequesterConfig, litestream?: SyncController);
-    /**
-     * Starts requesting syncs and pushes backed-up watermarks to the returned
-     * stream. Must only be called once.
-     *
-     * The replica is only opened here, so that a requester that is never
-     * started holds no resources.
-     */
-    start(): Source<BackedUpWatermark>;
-    /**
-     * Requests a sync unless a request is already outstanding. Resolves when
-     * this tick's request (or the outstanding one) completes.
-     * Exported for testing.
-     */
-    readonly tick: () => Promise<void>;
-    /**
-     * Requests a sync through `watermark` as soon as the local replica has
-     * reached it, rather than at the next regular tick.
-     *
-     * The replica is polled every {@link EXPEDITED_POLL_INTERVAL_MS} until its
-     * watermark reaches the target, after which a sync is requested
-     * immediately (or once the outstanding request, which may predate the
-     * target, completes). A failed request is retried with the usual backoff.
-     * Concurrent requests are coalesced into one, for the latest target.
-     *
-     * If the replica does not reach the target within the configured interval,
-     * the request is dropped, as the regular ticks then cover it anyway.
-     */
-    requestSync(watermark: string): void;
-}
-//# sourceMappingURL=litestream-sync-requester.d.ts.map

package/out/zero-cache/src/services/change-streamer/litestream-sync-requester.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"litestream-sync-requester.d.ts","sourceRoot":"","sources":["../../../../../../zero-cache/src/services/change-streamer/litestream-sync-requester.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AAKjD,OAAO,KAAK,EAAC,MAAM,EAAC,MAAM,wBAAwB,CAAC;AAEnD,OAAO,EAAC,oBAAoB,EAAC,MAAM,wCAAwC,CAAC;AAE5E,OAAO,KAAK,EAAC,iBAAiB,EAAE,YAAY,EAAC,MAAM,qBAAqB,CAAC;AA6BzE;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,KAAK,CAAC;AAS7C,wEAAwE;AACxE,MAAM,MAAM,cAAc,GAAG,IAAI,CAAC,oBAAoB,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC;AAE1E,MAAM,MAAM,mBAAmB,GAAG;IAChC;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,qBAAa,uBAAwB,YAAW,YAAY;;IAoB1D,YACE,EAAE,EAAE,UAAU,EACd,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,mBAAmB,EAC3B,UAAU,GAAE,cAA0D,EAgBvE;IAED;;;;;;OAMG;IACH,KAAK,IAAI,MAAM,CAAC,iBAAiB,CAAC,CAYjC;IAED;;;;OAIG;IACH,QAAQ,CAAC,IAAI,QAAO,OAAO,CAAC,IAAI,CAAC,CAY/B;IAcF;;;;;;;;;;;;OAYG;IACH,WAAW,CAAC,SAAS,EAAE,MAAM,QAa5B;CA+FF"}

package/out/zero-cache/src/services/change-streamer/litestream3-prometheus-poller.d.ts

@@ -1,88 +0,0 @@
-import type { LogContext } from '@rocicorp/logger';
-import type { Source } from '../../types/streams.ts';
-import type { BackedUpWatermark, BackupPoller } from './backup-monitor.ts';
-export declare const CHECK_INTERVAL_MS = 10000;
-/**
- * Allowance for clock skew between the machine reporting litestream metrics
- * and the timestamps reported by the backup destination (e.g. S3).
- */
-export declare const BACKUP_VERIFICATION_SLACK_MS = 60000;
-/**
- * How long the actual backup state may remain *continuously* behind the
- * backup progress claimed by litestream metrics before the backup is
- * considered genuinely wedged and the process is shut down.
- *
- * A wedged backup is dangerous: litestream believes it is making durable
- * progress when it is not, which can silently corrupt the backup (the WAL
- * format only makes *some* such gaps detectable). Once that is confirmed to
- * be the persistent state, continuing to run is worse than crashing, so the
- * process exits loudly (non-zero, with a logged error) and the wedged backup
- * destination becomes the priority to investigate.
- *
- * The change-log is conservatively *not* purged for the entire time the
- * backup is stale, so the only cost of a generous grace period is unbounded
- * change-log growth. We therefore err well on the side of slack: the backup
- * must stay stuck across many {@link CHECK_INTERVAL_MS} checks before we tear
- * the server down, so that a transient hiccup (a slow or briefly unreachable
- * destination, or litestream restarting) does not trigger a shutdown. The
- * staleness clock is reset the moment a purge is confirmed against a real
- * upload.
- */
-export declare const WEDGED_SHUTDOWN_GRACE_MS: number;
-/**
- * How long the BackupMonitor waits for the *first* restorable backup to appear
- * before concluding that the backup pipeline is broken and shutting the process
- * down (see {@link BackupMonitor.#shutDownOnMissingInitialBackup}).
- *
- * On a fresh stack the first backup is not restorable until the initial
- * Postgres->replica sync completes and litestream finishes uploading the
- * initial snapshot — a multipart upload that is not listable in the destination
- * until it is committed. The producer cannot observe that sub-snapshot progress,
- * so this is necessarily a generous timeout. It is scaled by replica size to
- * mirror the platform's storage-scaled startup-probe allowance (~1 hour per
- * 50GB) so that it never fires before the platform would restart a view-syncer
- * that is waiting on the backup.
- */
-export declare const INITIAL_BACKUP_GRACE_MS_PER_UNIT: number;
-/**
- * How often the BackupMonitor re-checks whether the first restorable backup has
- * appeared while a view-syncer holds a snapshot reservation open during a cold
- * start.
- */
-export declare const RESTORABLE_BACKUP_POLL_INTERVAL_MS = 10000;
-/**
- * Returns the time of the most recent object actually uploaded to the
- * backup replica destination (e.g. as determined by listing the snapshots
- * and WAL segments in S3). Rejects if the backup state cannot be determined.
- *
- * See `getLastBackupTime()` in `../litestream/commands.ts` for the
- * production implementation.
- */
-export type BackupStateVerifier = () => Promise<Date>;
-/**
- * The Litestream3PrometheusPoller polls the litestream "/metrics" endpoint to
- * track the watermark (label) value of the `litestream_replica_progress` gauge
- * and emits verified watermarks to a stream of {@link BackedUpWatermark}s.
- *
- * See: https://github.com/rocicorp/litestream/pull/3
- *
- * Because the watermarks reported by litestream metrics reflect what
- * litestream *believes* has been backed up (which has been observed to
- * diverge from reality when uploads silently fail), the cleanup watermark is
- * only published after verifying it against the actual backup state in the
- * replica destination via a {@link BackupStateVerifier}. If the
- * actual backup state stays behind the claimed progress for longer than
- * {@link WEDGED_SHUTDOWN_GRACE_MS}, the backup is treated as wedged and the
- * process is shut down rather than risk corrupting the backup.
- */
-export declare class Litestream3PrometheusPoller implements BackupPoller {
-    #private;
-    constructor(lc: LogContext, replicaFile: string, backupURL: string, metricsEndpoint: string, verifyBackupState: BackupStateVerifier);
-    /**
-     * Starts polling for watermarks and pushes new ones to returned stream.
-     * Must only be called once.
-     */
-    start(): Source<BackedUpWatermark>;
-    readonly checkVerifyAndPublishWatermarks: () => Promise<void>;
-}
-//# sourceMappingURL=litestream3-prometheus-poller.d.ts.map

package/out/zero-cache/src/services/change-streamer/litestream3-prometheus-poller.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"litestream3-prometheus-poller.d.ts","sourceRoot":"","sources":["../../../../../../zero-cache/src/services/change-streamer/litestream3-prometheus-poller.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AAMjD,OAAO,KAAK,EAAC,MAAM,EAAC,MAAM,wBAAwB,CAAC;AAOnD,OAAO,KAAK,EAAC,iBAAiB,EAAE,YAAY,EAAC,MAAM,qBAAqB,CAAC;AAEzE,eAAO,MAAM,iBAAiB,QAAS,CAAC;AAExC;;;GAGG;AACH,eAAO,MAAM,4BAA4B,QAAS,CAAC;AAEnD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,wBAAwB,QAAc,CAAC;AAIpD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,gCAAgC,QAAc,CAAC;AAG5D;;;;GAIG;AACH,eAAO,MAAM,kCAAkC,QAAS,CAAC;AAEzD;;;;;;;GAOG;AACH,MAAM,MAAM,mBAAmB,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;AAEtD;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,2BAA4B,YAAW,YAAY;;IAuC9D,YACE,EAAE,EAAE,UAAU,EACd,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,eAAe,EAAE,MAAM,EACvB,iBAAiB,EAAE,mBAAmB,EAavC;IAED;;;OAGG;IACH,KAAK,IAAI,MAAM,CAAC,iBAAiB,CAAC,CASjC;IAqBD,QAAQ,CAAC,+BAA+B,sBAgBtC;CAmSH"}

package/out/zero-cache/src/services/change-streamer/replica-poller.d.ts

@@ -1,15 +0,0 @@
-import type { LogContext } from '@rocicorp/logger';
-import type { Source } from '../../types/streams.ts';
-import type { BackedUpWatermark, BackupPoller } from './backup-monitor.ts';
-/**
- * The single-node equivalent of a backup monitor polls the replica file every
- * 30 seconds and schedules cleanup when the watermark
- * (i.e. stateVersion) moves forward.
- */
-export declare class ReplicaPoller implements BackupPoller {
-    #private;
-    readonly id = "replica-poller";
-    constructor(lc: LogContext, replicaFile: string);
-    start(): Source<BackedUpWatermark>;
-}
-//# sourceMappingURL=replica-poller.d.ts.map

package/out/zero-cache/src/services/change-streamer/replica-poller.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"replica-poller.d.ts","sourceRoot":"","sources":["../../../../../../zero-cache/src/services/change-streamer/replica-poller.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AAGjD,OAAO,KAAK,EAAC,MAAM,EAAC,MAAM,wBAAwB,CAAC;AAGnD,OAAO,KAAK,EAAC,iBAAiB,EAAE,YAAY,EAAC,MAAM,qBAAqB,CAAC;AAIzE;;;;GAIG;AACH,qBAAa,aAAc,YAAW,YAAY;;IAChD,QAAQ,CAAC,EAAE,oBAAoB;IAQ/B,YAAY,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAM9C;IAED,KAAK,IAAI,MAAM,CAAC,iBAAiB,CAAC,CAQjC;CAiBF"}

package/out/zero-cache/src/services/change-streamer/restore-admission.d.ts

@@ -1,243 +0,0 @@
-import type { LogContext } from '@rocicorp/logger';
-import type { LocalReplica } from './subscribe.ts';
-/**
- * The default time to wait for a subscriber that was granted permission to
- * restore to reconnect (i.e. to open a replacement reservation) after its
- * held connection closes, or after its replacement reservation closes
- * without subscribing (e.g. to retry a failed restore). This covers the
- * subscriber's process exit and restart (e.g. a container restart, the
- * backoff of which starts at 10 seconds in Kubernetes), but not the restore
- * itself, which is tracked by the liveness of its snapshot reservation.
- */
-export declare const DEFAULT_PENDING_GRANT_TTL_MS = 90000;
-/**
- * The default time for which a replacement continues to be counted after its
- * subscriber has caught up, which covers the time for the subscriber to start
- * serving (i.e. become ready) after catching up. See
- * {@link RestoreAdmissionOptions.readinessGracePeriodMs}.
- */
-export declare const DEFAULT_READINESS_GRACE_PERIOD_MS = 5000;
-export type RestoreAdmissionOptions = {
-    /** The replica version of the replication-manager. */
-    replicaVersion: string;
-    /**
-     * The maximum number of subscribers that may be restoring (or granted
-     * permission to restore) at the same time.
-     */
-    maxConcurrentRestores: number;
-    pendingGrantTTLMs?: number | undefined;
-    /**
-     * The time for which a replacement continues to be counted after its
-     * subscriber has caught up, so that the next subscriber is not granted
-     * permission to restore (and stop serving) before the restored one has
-     * started serving. Catching up is followed by the subscriber's readiness
-     * checks (e.g. waiting for the next replication lag report), and by the
-     * container runner's detection of its readiness.
-     */
-    readinessGracePeriodMs?: number | undefined;
-    setTimeoutFn?: typeof setTimeout | undefined;
-    clearTimeoutFn?: typeof clearTimeout | undefined;
-};
-export type AdmissionRequest = {
-    /**
-     * Called when the request is queued, and again whenever its (1-based)
-     * position in the queue changes.
-     */
-    onQueued: (position: number) => void;
-    /** Called (once) when the request is granted. */
-    onGranted: () => void;
-};
-/** A subscribed replacement, returned by {@link RestoreAdmission.reservationSubscribed}. */
-export type Replacement = {
-    /**
-     * Called when the subscriber has caught up. The replacement is released
-     * after the readiness grace period.
-     */
-    caughtUp: () => void;
-    /** Called when the subscription closes. The replacement is released. */
-    closed: () => void;
-};
-export type AdmissionTicket = {
-    /**
-     * Must be called when the requesting connection closes. A queued request
-     * is removed from the queue. For a granted request, this starts the
-     * timer within which the subscriber is expected to reconnect and open a
-     * replacement reservation.
-     */
-    release(): void;
-};
-/**
- * Limits the number of view-syncers that replace their replica at the same
- * time, so that view-syncers switching over from an incompatible
- * replication-manager (e.g. after a resync) do not all stop serving at once.
- *
- * Capacity is consumed by:
- * * Replacement restores: snapshot reservations of subscribers that are
- *   replacing an (incompatible or outdated) local replica, i.e. subscribers
- *   that were serving. Restores onto an empty disk (e.g. a new pod) do not
- *   take a serving subscriber out of service, and are not counted. The
- *   reservation's connection is held open for the duration of the restore,
- *   and the subscription that follows it is held open until the restored
- *   subscriber has caught up, so their liveness tracks that of the
- *   replacement without a timeout.
- * * Outstanding grants: permission to restore that has not yet been
- *   followed by a replacement reservation (e.g. while the subscriber drains
- *   and restarts). Grants are not matched to reservations by identity:
- *   any replacement reservation consumes an outstanding grant, and a grant
- *   that is not consumed expires a short time after the granted connection
- *   closes (e.g. if the subscriber reconnected to a different
- *   replication-manager or was deleted).
- *
- * ## Life cycle of a switchover restore
- *
- * The following traces a view-syncer (VS) with a replica at version `R1`,
- * served by an old replication-manager (RM) at `R1`, while a new RM (e.g.
- * after a resync) is at `R2 > R1`. The RestoreAdmission is that of the new
- * RM. Terms in `code` are those used in the code.
- *
- * 1. **Drain.** The old RM receives a SIGTERM, and its `DrainTracker` sends
- *    `status {draining: true}` to its `drainable` (i.e. serving) subscribers.
- *    It continues to stream changes to them, and exits once they have all
- *    disconnected.
- *
- * 2. **Switchover.** The VS's `DrainHandler` opens a second `/subscribe`
- *    with `switchover: true` at the watermark of its last committed
- *    transaction, which is routed to some RM. The VS continues to consume
- *    the old RM's stream. If the RM is compatible (i.e. another old RM),
- *    the subscription is accepted and the VS simply moves to it. If the RM
- *    is the new one, the subscriber's replica version is older, and the
- *    subscription proceeds to step 3.
- *
- * 3. **Queued.** `ChangeStreamerImpl.subscribe()` holds the subscription
- *    (it is not added to the forwarder) and calls {@link request}. The
- *    request is `queued` and `onQueued(position)` sends
- *    `status {restore: {state: 'queued', position}}`, again whenever the
- *    position changes. If the held connection closes while queued (e.g.
- *    the VS's old stream ended and it gave up on the switchover), the
- *    ticket is `release()`d and the request leaves the queue.
- *
- * 4. **Granted.** When the number in flight (`replacing` + `granted`) is
- *    below `maxConcurrentRestores`, the head of the queue is `granted`: a
- *    {@link Grant} is added (counting toward capacity), and `onGranted()`
- *    sends `status {restore: {state: 'granted'}}`. The VS keeps the granted
- *    connection open, and initiates a self-drain (`drainRequested`): it
- *    fails its health checks, drains its clients, and keeps replicating
- *    from the old RM in the meantime.
- *
- * 5. **Restart.** The VS process exits, closing the granted connection.
- *    The ticket is `release()`d, marking the grant as `released` and
- *    starting the pending grant TTL ({@link DEFAULT_PENDING_GRANT_TTL_MS}),
- *    within which a replacement reservation is expected. The drain itself
- *    does not count against the TTL.
- *
- * 6. **Reservation opened.** The restarted VS sends
- *    `reserve-snapshot {taskID, localReplica}`, and
- *    `ChangeStreamerImpl.startSnapshotReservation()` calls
- *    {@link reservationOpened}:
- *    * A `localReplica` of a different replica version (e.g. `R1`) is
- *      `replacing`: the reservation is counted, and consumes an outstanding
- *      grant (preferring a `released` one), so the number in flight is
- *      unchanged.
- *    * A `localReplica` of the same replica version is `unclassified` until
- *      the reservation is confirmed ({@link reservationConfirmed}) with the
- *      backup's minimum watermark. It is `replacing` if its watermark is
- *      older (i.e. it cannot catch up from the change log).
- *    * No `localReplica` (an empty disk) is not counted.
- *
- *    If the VS reached a different RM instead, the grant here expires after
- *    the TTL and frees its capacity, while the replacement is counted (as
- *    an ungranted one) by the RM that it reached.
- *
- * 7. **Restoring.** The VS restores the backup while holding the
- *    reservation's connection open. A retried reservation from the same
- *    task that arrives while the previous one is still open replaces it
- *    (`SnapshotReservations` `onClose`) but does not end it (`onEnd`), so it
- *    remains `replacing`. If the reservation instead closes without
- *    subscribing (e.g. a failed or disconnected restore, after which the VS
- *    retries), {@link reservationClosed} converts its capacity into a
- *    `released` grant, which the retry's replacement reservation consumes
- *    (step 6), or which expires after the pending grant TTL (e.g. if the VS
- *    was deleted).
- *
- * 8. **Subscribed.** Once restored, the VS subscribes on the same
- *    connection at `R2`, which is accepted. `ChangeStreamerImpl.subscribe()`
- *    calls {@link reservationSubscribed}, which moves the replacement from
- *    its reservation (the key leaves `replacing`) to the subscription
- *    (`catchingUp`), and then closes the task's reservation. Its `onEnd`
- *    calls {@link reservationClosed}, which is a no-op for the moved key.
- *
- * 9. **Caught up.** The VS catches up on the change stream from the
- *    backup's watermark. Once it has acked all changes up to the head of
- *    the stream (`Subscriber.caughtUp`), the replacement is released after
- *    the readiness grace period, which covers the time for the VS to start
- *    serving, and the next queued request is granted. If the VS disconnects
- *    first, the replacement is released immediately.
- *
- * A VS that restarts outside of a switchover with an incompatible replica
- * (e.g. after a crash) enters at step 6 without a grant, and its restore
- * consumes capacity all the same, delaying queued requests.
- *
- * ## States
- *
- * | Term          | Where                    | Meaning                          |
- * | ------------- | ------------------------ | -------------------------------- |
- * | queued        | `Entry.state`            | Held, waiting for capacity       |
- * | granted       | `Entry.state`, `#grants` | Permitted to restore, pending a  |
- * |               |                          | replacement reservation          |
- * | released      | `Entry.state`            | The held connection closed       |
- * | released      | `Grant.released`         | The granted connection, or an    |
- * |               |                          | unsubscribed replacement         |
- * |               |                          | reservation, closed; the TTL is  |
- * |               |                          | running                          |
- * | unclassified  | `#unclassified`          | Same-version reservation, not    |
- * |               |                          | yet confirmed                    |
- * | replacing     | `#replacing`             | Open replacement reservation     |
- * | catching up   | `#catchingUp`            | Subscribed replacement, not yet  |
- * |               |                          | caught up (or within the         |
- * |               |                          | readiness grace period)          |
- * | in flight     | `#inFlight`              | `replacing` + `catchingUp` +     |
- * |               |                          | `granted`, bounded by            |
- * |               |                          | `maxConcurrentRestores`          |
- */
-export declare class RestoreAdmission {
-    #private;
-    constructor(lc: LogContext, opts: RestoreAdmissionOptions);
-    /** For testing and logging. */
-    get stats(): {
-        replacing: number;
-        granted: number;
-        queued: number;
-    };
-    /**
-     * Called when a snapshot reservation is opened by a subscriber with the
-     * given `localReplica` (if any). A subscriber with a local replica of a
-     * different replica version is replacing it. One with the same replica
-     * version is replacing it if it is outdated, which is determined by
-     * {@link reservationConfirmed}. Idempotent for the same `key` (e.g. a
-     * retried reservation).
-     */
-    reservationOpened(key: string, localReplica: LocalReplica | undefined): void;
-    /**
-     * Called when a reservation is confirmed with the minimum watermark of the
-     * replica to restore.
-     */
-    reservationConfirmed(key: string, minWatermark: string): void;
-    /**
-     * Called when a reservation ends. A replacement reservation normally ends
-     * after its task subscribes ({@link reservationSubscribed}), in which case
-     * this is a no-op. A replacement reservation that ends without subscribing
-     * (e.g. a failed or disconnected restore) is most likely followed by a
-     * retry, so its capacity is retained as a released grant (which the retry
-     * consumes) rather than released immediately.
-     */
-    reservationClosed(key: string): void;
-    /**
-     * Called when the task of a reservation subscribes (before the reservation
-     * is closed). If the reservation is a replacement, it continues to be
-     * counted until the readiness grace period after the subscriber has caught
-     * up, or until the subscription closes.
-     */
-    reservationSubscribed(key: string): Replacement | undefined;
-    request(request: AdmissionRequest): AdmissionTicket;
-}
-//# sourceMappingURL=restore-admission.d.ts.map

package/out/zero-cache/src/services/change-streamer/restore-admission.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"restore-admission.d.ts","sourceRoot":"","sources":["../../../../../../zero-cache/src/services/change-streamer/restore-admission.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AAEjD,OAAO,KAAK,EAAC,YAAY,EAAC,MAAM,gBAAgB,CAAC;AAEjD;;;;;;;;GAQG;AACH,eAAO,MAAM,4BAA4B,QAAS,CAAC;AAEnD;;;;;GAKG;AACH,eAAO,MAAM,iCAAiC,OAAQ,CAAC;AAEvD,MAAM,MAAM,uBAAuB,GAAG;IACpC,sDAAsD;IACtD,cAAc,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,qBAAqB,EAAE,MAAM,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC;;;;;;;OAOG;IACH,sBAAsB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAE5C,YAAY,CAAC,EAAE,OAAO,UAAU,GAAG,SAAS,CAAC;IAC7C,cAAc,CAAC,EAAE,OAAO,YAAY,GAAG,SAAS,CAAC;CAClD,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B;;;OAGG;IACH,QAAQ,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC;IAErC,iDAAiD;IACjD,SAAS,EAAE,MAAM,IAAI,CAAC;CACvB,CAAC;AAEF,4FAA4F;AAC5F,MAAM,MAAM,WAAW,GAAG;IACxB;;;OAGG;IACH,QAAQ,EAAE,MAAM,IAAI,CAAC;IAErB,wEAAwE;IACxE,MAAM,EAAE,MAAM,IAAI,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B;;;;;OAKG;IACH,OAAO,IAAI,IAAI,CAAC;CACjB,CAAC;AAeF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoIG;AACH,qBAAa,gBAAgB;;IAwB3B,YAAY,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,uBAAuB,EAqBxD;IAMD,+BAA+B;IAC/B,IAAI,KAAK;QAEL,SAAS;QACT,OAAO;QACP,MAAM;MAET;IAED;;;;;;;OAOG;IACH,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,GAAG,SAAS,QAUpE;IAED;;;OAGG;IACH,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,QAMrD;IAED;;;;;;;OAOG;IACH,iBAAiB,CAAC,GAAG,EAAE,MAAM,QAO5B;IAED;;;;;OAKG;IACH,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAwB1D;IAiBD,OAAO,CAAC,OAAO,EAAE,gBAAgB,GAAG,eAAe,CAKlD;CAoDF"}

package/out/zero-cache/src/services/change-streamer/schema/init.d.ts

@@ -1,6 +0,0 @@
-import type { LogContext } from '@rocicorp/logger';
-import type { PostgresDB } from '../../../types/pg.ts';
-import { type ShardID } from '../../../types/shards.ts';
-export declare function initChangeStreamerSchema(log: LogContext, db: PostgresDB, shard: ShardID): Promise<void>;
-export declare function getLastWatermarkV2(db: PostgresDB, shard: ShardID): Promise<string>;
-//# sourceMappingURL=init.d.ts.map

package/out/zero-cache/src/services/change-streamer/schema/init.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../../../../../../zero-cache/src/services/change-streamer/schema/init.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AAMjD,OAAO,KAAK,EAAC,UAAU,EAAsB,MAAM,sBAAsB,CAAC;AAC1E,OAAO,EAAY,KAAK,OAAO,EAAC,MAAM,0BAA0B,CAAC;AA+BjE,wBAAsB,wBAAwB,CAC5C,GAAG,EAAE,UAAU,EACf,EAAE,EAAE,UAAU,EACd,KAAK,EAAE,OAAO,GACb,OAAO,CAAC,IAAI,CAAC,CA0Ef;AAED,wBAAsB,kBAAkB,CACtC,EAAE,EAAE,UAAU,EACd,KAAK,EAAE,OAAO,GACb,OAAO,CAAC,MAAM,CAAC,CAajB"}