cursedbelt-server 2.0.0 → 3.0.0

package/src/server/bench/recorder.ts

@@ -0,0 +1,163 @@
+/**
+ * Per-route CPU samples, and the percentiles read off them.
+ *
+ * 🔴 **p99, not a mean.** A mean over a route that is fast 99 times and 400 ms once
+ * reports ~4 ms and looks healthy. The number that decides whether a route is safe to
+ * make common is its tail, so the mean is reported beside p99 and never instead of it.
+ */
+
+import {
+  type CpuBudgetConfig,
+  type ResolvedBudget,
+  resolveBudget,
+  validateCpuBudgetConfig,
+} from './budget';
+import type { CpuClock } from './cpuClock';
+
+/**
+ * Nearest-rank percentile over an ASCENDING-sorted array: the smallest value at or below
+ * which at least `p`% of samples fall. No interpolation — an interpolated p99 reports a
+ * CPU cost no request ever actually paid, which is the wrong direction to be wrong in
+ * when the number is a ceiling.
+ */
+export function percentile(sortedAsc: readonly number[], p: number): number {
+  if (sortedAsc.length === 0) return Number.NaN;
+  if (p <= 0) return sortedAsc[0];
+  if (p >= 100) return sortedAsc[sortedAsc.length - 1];
+  const rank = Math.ceil((p / 100) * sortedAsc.length);
+  return sortedAsc[Math.min(sortedAsc.length, Math.max(1, rank)) - 1];
+}
+
+export interface RouteCpuStats {
+  method: string;
+  route: string;
+  /** `'GET /api/notes/:id'` — how the route is named in a violation message. */
+  key: string;
+  samples: number;
+  /** Samples actually retained (≤ `samples` once the reservoir is full). */
+  retained: number;
+  mean: number;
+  p50: number;
+  p95: number;
+  p99: number;
+  max: number;
+  /** Total CPU-ms observed across every sample — what the route costs in aggregate. */
+  totalCpuMs: number;
+  /** The ceiling in CPU-ms, or `null` when exempt. */
+  budgetMs: number | null;
+  exemptReason?: string;
+  noticeAboveMs?: number;
+  /** False when no explicit entry matched and the default was applied. */
+  declared: boolean;
+}
+
+export interface CpuBudgetReport {
+  /** Provenance of every number below — e.g. `'process.cpuUsage'`. */
+  source: string;
+  /** 🔴 True ⇒ these are a PROXY for Worker CPU-ms, not a reading of them. */
+  proxy: boolean;
+  /** False ⇒ nothing could be measured; every stat is NaN and nothing may be concluded. */
+  available: boolean;
+  routes: RouteCpuStats[];
+}
+
+export interface CpuRecorderOpts {
+  clock: CpuClock;
+  config?: CpuBudgetConfig;
+  /**
+   * Samples retained per route. Beyond this, reservoir sampling keeps the retained set
+   * representative of the WHOLE run rather than of its first N requests — truncating
+   * would quietly turn a long-lived mount into a measurement of its own warm-up.
+   */
+  maxSamplesPerRoute?: number;
+  /**
+   * Deterministic source of randomness for the reservoir, for tests. Defaults to
+   * `Math.random`.
+   */
+  random?: () => number;
+}
+
+export interface CpuRecorder {
+  readonly clock: CpuClock;
+  readonly config: CpuBudgetConfig;
+  record(method: string, route: string, cpuMs: number): void;
+  report(): CpuBudgetReport;
+  reset(): void;
+}
+
+interface Bucket {
+  method: string;
+  route: string;
+  seen: number;
+  samples: number[];
+  total: number;
+}
+
+export function createCpuRecorder(opts: CpuRecorderOpts): CpuRecorder {
+  const config = opts.config ?? {};
+  validateCpuBudgetConfig(config);
+  const cap = opts.maxSamplesPerRoute ?? 10_000;
+  if (!(cap > 0)) throw new Error('createCpuRecorder: maxSamplesPerRoute must be > 0');
+  const random = opts.random ?? Math.random;
+  let buckets = new Map<string, Bucket>();
+
+  return {
+    clock: opts.clock,
+    config,
+    record(method, route, cpuMs) {
+      // A NaN reading means the clock could not measure. Recording it would poison every
+      // percentile on the route, so an unmeasurable request is not a sample.
+      if (!Number.isFinite(cpuMs)) return;
+      const key = `${method} ${route}`;
+      let b = buckets.get(key);
+      if (!b) {
+        b = { method, route, seen: 0, samples: [], total: 0 };
+        buckets.set(key, b);
+      }
+      b.seen += 1;
+      b.total += cpuMs;
+      if (b.samples.length < cap) {
+        b.samples.push(cpuMs);
+      } else {
+        // Algorithm R: keep each observed sample with equal probability.
+        const j = Math.floor(random() * b.seen);
+        if (j < cap) b.samples[j] = cpuMs;
+      }
+    },
+    report(): CpuBudgetReport {
+      const routes: RouteCpuStats[] = [];
+      for (const [key, b] of buckets) {
+        const sorted = [...b.samples].sort((x, y) => x - y);
+        const resolved: ResolvedBudget = resolveBudget(config, b.method, b.route);
+        routes.push({
+          method: b.method,
+          route: b.route,
+          key,
+          samples: b.seen,
+          retained: sorted.length,
+          mean: b.seen > 0 ? b.total / b.seen : Number.NaN,
+          p50: percentile(sorted, 50),
+          p95: percentile(sorted, 95),
+          p99: percentile(sorted, 99),
+          max: percentile(sorted, 100),
+          totalCpuMs: b.total,
+          budgetMs: resolved.cpuMs,
+          exemptReason: resolved.exemptReason,
+          noticeAboveMs: resolved.noticeAboveMs,
+          declared: resolved.declared,
+        });
+      }
+      // Worst offender first — a report is read from the top.
+      routes.sort((a, z) => (z.p99 || 0) - (a.p99 || 0));
+      return {
+        source: opts.clock.source,
+        proxy: opts.clock.proxy,
+        available: opts.clock.available,
+        routes,
+      };
+    },
+    reset() {
+      buckets = new Map();
+    },
+  };
+}

package/src/server/bench/runBench.ts

@@ -0,0 +1,110 @@
+import type { CpuRecorder } from './recorder';
+import type { CpuBudgetReport } from './recorder';
+
+/**
+ * Drive a Hono app's routes and measure what each costs in CPU.
+ *
+ * 🔴 **Serial on purpose, and this is the load-bearing decision.** `process.cpuUsage()`
+ * deltas are PROCESS-wide (see `cpuClock.ts`), so two requests in flight each absorb the
+ * other's CPU and every number is inflated by an amount nobody can subtract afterwards.
+ * Running one request at a time is what makes the local proxy sound enough to gate on.
+ * There is deliberately no `concurrency` option — it would produce numbers that look
+ * finer-grained and are strictly less true.
+ *
+ * Wall-clock cost of the bench itself is irrelevant; it is a gate, not a load test.
+ */
+
+/** RFC 2606 reserved TLD — a bench request must never be able to leave the process. */
+export const BENCH_ORIGIN = 'http://cpu-bench.invalid';
+
+export interface BenchCase {
+  /** Default `'GET'`. */
+  method?: string;
+  /** Path with a leading slash, e.g. `'/api/notes/abc'`. */
+  path: string;
+  /** Extra request init — headers, body. `method` above wins over `init.method`. */
+  init?: RequestInit;
+  /** Overrides the run-wide `iterations` for this case. */
+  iterations?: number;
+  /**
+   * Statuses this case is expected to return. Default: anything `< 400`.
+   *
+   * 🔴 This guard is the point. A route that 404s or 500s costs almost no CPU, so a
+   * bench that does not check the response reports a beautiful number for a handler
+   * that never ran — a green budget over a broken route.
+   */
+  expectStatus?: number | number[] | ((status: number) => boolean);
+}
+
+export interface RunCpuBenchOpts {
+  /** Anything with Hono's `fetch` shape. */
+  app: { fetch: (req: Request, env?: unknown, ctx?: unknown) => Response | Promise<Response> };
+  /** The recorder the app's `cpuBudget()` middleware writes through. */
+  recorder: CpuRecorder;
+  cases: BenchCase[];
+  /** Measured iterations per case. Default 30 — above `assertCpuBudgets`' 20-sample floor. */
+  iterations?: number;
+  /**
+   * Unmeasured iterations per case, run first and then DISCARDED.
+   *
+   * 🔴 Without this the bench measures JIT warm-up. A first call through a cold handler
+   * can cost an order of magnitude more than its steady state, and with 30 samples one
+   * cold call lands squarely in the p99 — so the route that fails is whichever one the
+   * bench happened to touch first. Default 5.
+   */
+  warmup?: number;
+  /** Origin for the synthesized requests. Default {@link BENCH_ORIGIN}. */
+  origin?: string;
+  /** Passed through to `app.fetch` as the Worker `env`. */
+  env?: unknown;
+  /** Passed through to `app.fetch` as the Worker execution context. */
+  ctx?: unknown;
+}
+
+function statusAllowed(c: BenchCase, status: number): boolean {
+  const expect = c.expectStatus;
+  if (expect === undefined) return status < 400;
+  if (typeof expect === 'function') return expect(status);
+  if (Array.isArray(expect)) return expect.includes(status);
+  return expect === status;
+}
+
+function describe(c: BenchCase): string {
+  return `${(c.method ?? 'GET').toUpperCase()} ${c.path}`;
+}
+
+async function fire(opts: RunCpuBenchOpts, c: BenchCase): Promise<void> {
+  const method = (c.method ?? c.init?.method ?? 'GET').toUpperCase();
+  const req = new Request(`${opts.origin ?? BENCH_ORIGIN}${c.path}`, { ...c.init, method });
+  const res = await opts.app.fetch(req, opts.env, opts.ctx);
+  if (!statusAllowed(c, res.status)) {
+    const body = await res.text().catch(() => '');
+    throw new Error(
+      `cpu-bench: ${describe(c)} returned ${res.status}, which this case does not expect. ` +
+        'A route that errors costs no CPU, so measuring it would report a budget it never ' +
+        `met. Fix the case or set expectStatus.${body ? ` Body: ${body.slice(0, 200)}` : ''}`,
+    );
+  }
+  // Drain the body so a streamed response's work is actually done before the span ends.
+  if (res.body && !res.bodyUsed) await res.arrayBuffer().catch(() => undefined);
+}
+
+export async function runCpuBench(opts: RunCpuBenchOpts): Promise<CpuBudgetReport> {
+  if (opts.cases.length === 0) throw new Error('runCpuBench: no cases given');
+  const iterations = opts.iterations ?? 30;
+  const warmup = opts.warmup ?? 5;
+  if (!(iterations > 0)) throw new Error('runCpuBench: iterations must be > 0');
+
+  for (const c of opts.cases) {
+    for (let i = 0; i < warmup; i += 1) await fire(opts, c);
+  }
+  // 🔴 Everything above was warm-up. Discard it — measuring it is the bug this guards.
+  opts.recorder.reset();
+
+  for (const c of opts.cases) {
+    const n = c.iterations ?? iterations;
+    for (let i = 0; i < n; i += 1) await fire(opts, c);
+  }
+
+  return opts.recorder.report();
+}

package/src/server/d1/backup.spec.ts

@@ -0,0 +1,121 @@
+import { Database } from 'bun:sqlite';
+import { afterEach, describe, expect, test } from 'bun:test';
+import { existsSync, mkdtempSync, rmSync, statSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { backupFor, checkpointWal, createLocalBackup, createTimeTravelBackup } from './backup';
+
+const dirs: string[] = [];
+const scratch = (): string => {
+	const d = mkdtempSync(join(tmpdir(), 'd1-backup-'));
+	dirs.push(d);
+	return d;
+};
+afterEach(() => {
+	for (const d of dirs.splice(0)) rmSync(d, { recursive: true, force: true });
+});
+
+/** A WAL-mode database on disk with enough rows to produce a real WAL file. */
+function seeded(dir: string): { path: string; db: Database } {
+	const path = join(dir, 'app.sqlite');
+	const db = new Database(path, { create: true });
+	db.exec('PRAGMA journal_mode = WAL');
+	db.run('CREATE TABLE t (id INTEGER PRIMARY KEY, v TEXT)');
+	const insert = db.prepare('INSERT INTO t (v) VALUES (?)');
+	for (let i = 0; i < 2_000; i++) insert.run(`row-${i}`);
+	return { path, db };
+}
+
+describe('the local half keeps checkpointing the WAL', () => {
+	test('🔴 wal_checkpoint(TRUNCATE) actually drains the WAL file', () => {
+		// The measurement this exists for: `family.sqlite` was once 2.2 MB of principal
+		// against a 2.1 MB WAL. An un-checkpointed copy is half a database.
+		const dir = scratch();
+		const { path, db } = seeded(dir);
+		const walPath = `${path}-wal`;
+
+		expect(existsSync(walPath)).toBe(true);
+		expect(statSync(walPath).size).toBeGreaterThan(0);
+
+		const result = checkpointWal(db);
+		expect(result.busy).toBe(false);
+		// 🔴 The post-condition is the FILE SIZE, not the pragma's counters. Measured
+		// 2026-09-16: under TRUNCATE, SQLite reports the counters from after the
+		// truncation, so a fully successful checkpoint returns `checkpointed: 0`. A test
+		// asserting `checkpointed > 0` would be asserting a structurally impossible value
+		// — it fails on a working checkpoint, which is how a real check gets deleted.
+		expect(result.checkpointed).toBe(0);
+		// TRUNCATE, not PASSIVE: the file is emptied, not merely merged.
+		expect(statSync(walPath).size).toBe(0);
+		db.close();
+	});
+
+	test('capture() checkpoints and writes a readable snapshot containing every row', async () => {
+		const dir = scratch();
+		const { path, db } = seeded(dir);
+		const destDir = join(dir, 'backups');
+
+		const point = await createLocalBackup({ db, sourcePath: path, destDir }).capture();
+
+		expect(point.kind).toBe('file');
+		expect(existsSync(point.ref)).toBe(true);
+		expect(point.bytes).toBeGreaterThan(0);
+		expect(point.exportCommand).toBeNull();
+
+		// The snapshot is a real database with the full row count — which is what would
+		// have failed had the WAL not been merged in.
+		const restored = new Database(point.ref, { readonly: true });
+		const count = restored.query('SELECT COUNT(*) AS n FROM t').get() as { n: number };
+		expect(count.n).toBe(2_000);
+		restored.close();
+		db.close();
+	});
+
+	test('the local half reports that it DOES need a periodic capture', () => {
+		const dir = scratch();
+		const { path, db } = seeded(dir);
+		expect(createLocalBackup({ db, sourcePath: path, destDir: dir }).needsPeriodicCapture).toBe(true);
+		db.close();
+	});
+});
+
+describe('the D1 half records a coordinate instead of copying bytes', () => {
+	const at = new Date('2026-09-16T04:30:00.000Z');
+
+	test('capture() returns a restorable timestamp and the two real commands', async () => {
+		const point = await createTimeTravelBackup({ databaseName: 'patterns', now: () => at }).capture();
+
+		expect(point.kind).toBe('time-travel');
+		expect(point.ref).toBe('2026-09-16T04:30:00.000Z');
+		expect(point.restoreCommand).toBe(
+			'wrangler d1 time-travel restore patterns --timestamp=2026-09-16T04:30:00.000Z',
+		);
+		expect(point.exportCommand).toContain('wrangler d1 export patterns --remote');
+	});
+
+	test('🔴 it reports needsPeriodicCapture: false — Time Travel is automatic', () => {
+		// A nightly no-op job logging "backup complete" is worse than no job, because it
+		// reads as evidence. A scheduler must honour this flag.
+		expect(createTimeTravelBackup({ databaseName: 'patterns' }).needsPeriodicCapture).toBe(false);
+	});
+
+	test('bytes is null rather than a fabricated zero', () => {
+		// Cloudflare reports no size for a restore point; a 0 would read as a measurement.
+		return createTimeTravelBackup({ databaseName: 'x', now: () => at })
+			.capture()
+			.then((p) => expect(p.bytes).toBeNull());
+	});
+});
+
+describe('backupFor picks the implementation from the driver flavor', () => {
+	test('local flavor checkpoints; d1 flavor does not need to', async () => {
+		const dir = scratch();
+		const { path, db } = seeded(dir);
+		const local = () => ({ db, sourcePath: path, destDir: join(dir, 'b') });
+		const remote = () => ({ databaseName: 'patterns' });
+
+		expect(backupFor('local', local, remote).needsPeriodicCapture).toBe(true);
+		expect(backupFor('d1', local, remote).needsPeriodicCapture).toBe(false);
+		db.close();
+	});
+});

package/src/server/d1/backup.ts

@@ -0,0 +1,186 @@
+/**
+ * The backup seam — `PRAGMA wal_checkpoint(TRUNCATE)` locally, Time Travel remotely.
+ *
+ * ## 🔴 BOTH, not one
+ *
+ * D1 has no WAL a caller can checkpoint, and 30 days of free point-in-time restore is
+ * strictly better than the file copy it replaces. It is tempting to read that as "the
+ * checkpoint goes away". It does not: `PRAGMA wal_checkpoint(TRUNCATE)` is in the backup
+ * path of every app in this fleet and it is load-bearing while any of them is still
+ * Mac-hosted. Measured previously, `family.sqlite` was **2.2 MB of principal against a
+ * 2.1 MB WAL** — an un-checkpointed copy is half a database, and `VACUUM INTO` merging
+ * the WAL is the only reason the existing `../sqlite/backup.ts` is safe.
+ *
+ * So the local implementation keeps checkpointing, the remote one records a restore
+ * coordinate, and both answer the same interface. An app's backup job stops caring which
+ * side it is on — which is the property that lets the job move before the database does.
+ *
+ * ## The remote side does not "take" a backup, and that is not a gap
+ *
+ * Time Travel is automatic and continuous: D1 retains 30 days and restores to any
+ * timestamp or bookmark within it. There is nothing to trigger, so
+ * {@link createTimeTravelBackup} records the coordinate rather than inventing an API call
+ * that does not exist. The coordinate IS the backup — `wrangler d1 time-travel restore`
+ * takes a timestamp.
+ *
+ * 🔴 **`wrangler d1 export` is the off-Cloudflare leg, and a Worker cannot run it.** A
+ * Worker has no shell. That leg belongs to a Cron Trigger on this Mac or in CI, which is
+ * why {@link BackupPoint.exportCommand} hands back the command rather than running it —
+ * the same split as the binary server, where the bytes and the thing that copies them are
+ * deliberately not the same process.
+ */
+
+import type { Database } from 'bun:sqlite';
+import { existsSync, mkdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { snapshotSqlite } from '../sqlite/backup';
+
+/** A restore coordinate — a file on this Mac, or a point in D1's retention window. */
+export interface BackupPoint {
+	kind: 'file' | 'time-travel';
+	/** A filesystem path for `file`; an ISO-8601 timestamp for `time-travel`. */
+	ref: string;
+	createdAt: string;
+	/** Bytes on disk, or `null` where the platform does not tell us. */
+	bytes: number | null;
+	/** The exact command that restores this point. Printed in the job log, not executed. */
+	restoreCommand: string;
+	/** For `time-travel`, the command that pulls a copy OFF Cloudflare. `null` locally. */
+	exportCommand: string | null;
+}
+
+export interface DatabaseBackup {
+	/** Capture a restore point now, and describe it. */
+	capture(): Promise<BackupPoint>;
+	/** Whether this side needs a periodic capture at all. Time Travel does not. */
+	readonly needsPeriodicCapture: boolean;
+}
+
+export interface LocalBackupOpts {
+	/** The live handle — checkpointed before the snapshot is taken. */
+	db: Database;
+	/** Path of the database file being backed up. */
+	sourcePath: string;
+	/** Directory the snapshot is written into. Created if missing. */
+	destDir: string;
+	/** Override the snapshot's file name. Defaults to `<name>-<ISO>.sqlite`. */
+	nameFor?: (now: Date) => string;
+}
+
+/**
+ * Force the WAL back into the principal database and truncate the log file.
+ *
+ * `TRUNCATE` — not `PASSIVE` — because `PASSIVE` gives up silently when a reader holds the
+ * WAL, leaving a WAL that never drains while every log line says the backup succeeded.
+ *
+ * 🔴 **`busy` is the only field worth reading, and that is a measured correction.** Under
+ * `TRUNCATE` SQLite reports the counters from AFTER the truncation, so a completely
+ * successful checkpoint returns `(busy 0, log 0, checkpointed 0)` — measured 2026-09-16,
+ * draining a 70,072-byte WAL to zero reported `checkpointed: 0`. Anything asserting
+ * `checkpointed > 0` as proof of work is asserting a value that is structurally always
+ * zero here. The honest post-condition is the WAL file's SIZE, which is what
+ * `backup.spec.ts` checks; the honest error signal is `busy`.
+ */
+export function checkpointWal(db: Database): { busy: boolean; logPages: number; checkpointed: number } {
+	// One row: (busy, log, checkpointed). See the note above on what they mean here.
+	const row = db.query('PRAGMA wal_checkpoint(TRUNCATE)').get() as
+		| { busy?: number; log?: number; checkpointed?: number }
+		| null;
+	return {
+		busy: (row?.busy ?? 0) === 1,
+		logPages: row?.log ?? 0,
+		checkpointed: row?.checkpointed ?? 0,
+	};
+}
+
+/**
+ * The Mac-hosted implementation: checkpoint, then `VACUUM INTO` a fresh file.
+ *
+ * `VACUUM INTO` is already transactionally consistent under WAL, so the checkpoint is not
+ * what makes the copy correct — it is what keeps the WAL from growing without bound on a
+ * database that is written far more often than it is read, which is how a 2.2 MB database
+ * came to carry a 2.1 MB WAL.
+ */
+export function createLocalBackup(opts: LocalBackupOpts): DatabaseBackup {
+	return {
+		needsPeriodicCapture: true,
+
+		async capture(): Promise<BackupPoint> {
+			const checkpoint = checkpointWal(opts.db);
+			if (checkpoint.busy) {
+				// Not fatal — `VACUUM INTO` still produces a consistent copy — but it is the
+				// signal that the WAL is not draining, and silence here is how it grows.
+				console.warn(
+					`[d1/backup] wal_checkpoint(TRUNCATE) reported BUSY for ${opts.sourcePath} — ` +
+						`${checkpoint.logPages} page(s) still in the WAL. A reader is holding it open.`,
+				);
+			}
+			if (!existsSync(opts.destDir)) mkdirSync(opts.destDir, { recursive: true });
+
+			const now = new Date();
+			const stamp = now.toISOString().replace(/[:.]/g, '-');
+			const name = opts.nameFor?.(now) ?? `backup-${stamp}.sqlite`;
+			const dest = join(opts.destDir, name);
+
+			const bytes = snapshotSqlite(opts.sourcePath, dest);
+			return {
+				kind: 'file',
+				ref: dest,
+				createdAt: now.toISOString(),
+				bytes,
+				restoreCommand: `cp '${dest}' '${opts.sourcePath}'   # with the app stopped`,
+				exportCommand: null,
+			};
+		},
+	};
+}
+
+export interface TimeTravelOpts {
+	/** The database name as `wrangler` knows it — what the restore command needs. */
+	databaseName: string;
+	/** Where an export should be written, for the off-Cloudflare leg. */
+	exportPath?: string;
+	/** Injected for the test; defaults to the real clock. */
+	now?: () => Date;
+}
+
+/**
+ * The D1 implementation: record the coordinate, because retention is automatic.
+ *
+ * 🔴 It reports `needsPeriodicCapture: false`, and a scheduler must honour that rather
+ * than calling `capture()` on a timer — a nightly no-op job that logs "backup complete"
+ * is worse than no job, because it reads as evidence.
+ */
+export function createTimeTravelBackup(opts: TimeTravelOpts): DatabaseBackup {
+	const clock = opts.now ?? (() => new Date());
+	const exportPath = opts.exportPath ?? `./${opts.databaseName}-export.sql`;
+	return {
+		needsPeriodicCapture: false,
+
+		async capture(): Promise<BackupPoint> {
+			const at = clock().toISOString();
+			return {
+				kind: 'time-travel',
+				ref: at,
+				createdAt: at,
+				// Cloudflare does not report a size for a restore point, and a fabricated
+				// number would read as a measurement.
+				bytes: null,
+				restoreCommand: `wrangler d1 time-travel restore ${opts.databaseName} --timestamp=${at}`,
+				exportCommand: `wrangler d1 export ${opts.databaseName} --remote --output=${exportPath}`,
+			};
+		},
+	};
+}
+
+/**
+ * Pick the backup implementation from the driver flavor, so an app's job definition reads
+ * the same on both sides.
+ */
+export function backupFor(
+	flavor: 'local' | 'd1',
+	local: () => LocalBackupOpts,
+	remote: () => TimeTravelOpts,
+): DatabaseBackup {
+	return flavor === 'local' ? createLocalBackup(local()) : createTimeTravelBackup(remote());
+}