layercache 1.2.7 → 1.2.9

package/dist/index.js

@@ -440,7 +440,7 @@ function normalizeForSerialization(value) {
 }
 function serializeKeyPart(value) {
   if (typeof value === "string") {
-    return `s:${value}`;
+    return `s:${value.replace(/%/g, "%25").replace(/:/g, "%3A")}`;
   }
   if (typeof value === "number") {
     return `n:${value}`;
@@ -468,102 +468,6 @@ function createInstanceId() {
   return `layercache-${Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("")}`;
 }
 
-// src/internal/CacheSnapshotFile.ts
-function isWithinSnapshotBase(realBaseDir, candidatePath, pathSeparator, path) {
-  const relative = path.relative(realBaseDir, candidatePath);
-  return !(relative === ".." || relative.startsWith(`..${pathSeparator}`) || path.isAbsolute(relative));
-}
-async function findExistingAncestor(directory, fs2, path) {
-  let current = directory;
-  while (true) {
-    try {
-      await fs2.lstat(current);
-      return current;
-    } catch (error) {
-      if (error.code !== "ENOENT") {
-        throw error;
-      }
-    }
-    const parent = path.dirname(current);
-    if (parent === current) {
-      return current;
-    }
-    current = parent;
-  }
-}
-async function validateSnapshotFilePath(filePath, mode, snapshotBaseDir, cwd = process.cwd()) {
-  if (filePath.length === 0) {
-    throw new Error("filePath must not be empty.");
-  }
-  if (filePath.includes("\0")) {
-    throw new Error("filePath must not contain null bytes.");
-  }
-  const { promises: fs2 } = await import("fs");
-  const path = await import("path");
-  const resolved = path.resolve(filePath);
-  const baseDir = snapshotBaseDir === false ? false : path.resolve(snapshotBaseDir ?? cwd);
-  if (baseDir === false) {
-    return resolved;
-  }
-  await fs2.mkdir(baseDir, { recursive: true });
-  const realBaseDir = await fs2.realpath(baseDir);
-  if (!isWithinSnapshotBase(realBaseDir, resolved, path.sep, path)) {
-    throw new Error(`filePath is outside the allowed snapshot directory: ${realBaseDir}`);
-  }
-  if (mode === "read") {
-    const realTarget = await fs2.realpath(resolved);
-    if (!isWithinSnapshotBase(realBaseDir, realTarget, path.sep, path)) {
-      throw new Error(`filePath is outside the allowed snapshot directory: ${realBaseDir}`);
-    }
-    return realTarget;
-  }
-  const parentDir = path.dirname(resolved);
-  const existingAncestor = await findExistingAncestor(parentDir, fs2, path);
-  const realExistingAncestor = await fs2.realpath(existingAncestor);
-  if (!isWithinSnapshotBase(realBaseDir, realExistingAncestor, path.sep, path)) {
-    throw new Error(`filePath is outside the allowed snapshot directory: ${realBaseDir}`);
-  }
-  await fs2.mkdir(parentDir, { recursive: true });
-  const realParentDir = await fs2.realpath(parentDir);
-  if (!isWithinSnapshotBase(realBaseDir, realParentDir, path.sep, path)) {
-    throw new Error(`filePath is outside the allowed snapshot directory: ${realBaseDir}`);
-  }
-  const targetPath = path.join(realParentDir, path.basename(resolved));
-  try {
-    const existing = await fs2.lstat(targetPath);
-    if (existing.isSymbolicLink()) {
-      throw new Error("filePath must not point to a symbolic link.");
-    }
-  } catch (error) {
-    if (error.code !== "ENOENT") {
-      throw error;
-    }
-  }
-  return targetPath;
-}
-async function readUtf8HandleWithLimit(handle, byteLimit) {
-  if (byteLimit === false) {
-    return handle.readFile({ encoding: "utf8" });
-  }
-  const chunks = [];
-  let totalBytes = 0;
-  let position = 0;
-  while (true) {
-    const buffer = Buffer.allocUnsafe(Math.min(64 * 1024, byteLimit - totalBytes + 1));
-    const { bytesRead } = await handle.read(buffer, 0, buffer.byteLength, position);
-    if (bytesRead === 0) {
-      break;
-    }
-    totalBytes += bytesRead;
-    if (totalBytes > byteLimit) {
-      throw new Error(`Snapshot file exceeds snapshotMaxBytes limit (${totalBytes} bytes > ${byteLimit} bytes).`);
-    }
-    chunks.push(buffer.subarray(0, bytesRead));
-    position += bytesRead;
-  }
-  return Buffer.concat(chunks).toString("utf8");
-}
-
 // src/internal/CacheStackGeneration.ts
 var DEFAULT_GENERATION_CLEANUP_BATCH_SIZE = 500;
 function generationPrefix(generation) {
@@ -611,6 +515,206 @@ function planGenerationCleanupBatches(keys, generationCleanup) {
   return batches;
 }
 
+// src/internal/CacheStackInvalidationSupport.ts
+var CacheStackInvalidationSupport = class {
+  constructor(options) {
+    this.options = options;
+  }
+  options;
+  async collectKeysForTag(tag, maxKeys) {
+    const keys = /* @__PURE__ */ new Set();
+    if (this.options.tagIndex.forEachKeyForTag) {
+      await this.options.tagIndex.forEachKeyForTag(tag, async (key) => {
+        keys.add(key);
+        this.assertWithinInvalidationKeyLimit(keys.size, maxKeys);
+      });
+      return [...keys];
+    }
+    for (const key of await this.options.tagIndex.keysForTag(tag)) {
+      keys.add(key);
+      this.assertWithinInvalidationKeyLimit(keys.size, maxKeys);
+    }
+    return [...keys];
+  }
+  intersectKeys(groups) {
+    if (groups.length === 0) {
+      return [];
+    }
+    const [firstGroup, ...rest] = groups;
+    const restSets = rest.map((group) => new Set(group));
+    return [...new Set(firstGroup)].filter((key) => restSets.every((group) => group.has(key)));
+  }
+  async deleteKeysFromLayers(layers, keys) {
+    await Promise.all(
+      layers.map(async (layer) => {
+        if (this.options.shouldSkipLayer(layer)) {
+          return;
+        }
+        if (layer.deleteMany) {
+          try {
+            await layer.deleteMany(keys);
+          } catch (error) {
+            await this.options.handleLayerFailure(layer, "delete", error);
+          }
+          return;
+        }
+        await Promise.all(
+          keys.map(async (key) => {
+            try {
+              await layer.delete(key);
+            } catch (error) {
+              await this.options.handleLayerFailure(layer, "delete", error);
+            }
+          })
+        );
+      })
+    );
+  }
+  assertWithinInvalidationKeyLimit(size, maxKeys) {
+    if (maxKeys !== false && size > maxKeys) {
+      throw new Error(`Invalidation matched too many keys (${size} > ${maxKeys}).`);
+    }
+  }
+};
+
+// src/internal/CacheStackLayerWriter.ts
+var CacheStackLayerWriter = class {
+  constructor(options) {
+    this.options = options;
+  }
+  options;
+  async writeAcrossLayers(key, kind, value, writeOptions) {
+    const now = Date.now();
+    const clearEpoch = this.options.maintenance.currentClearEpoch();
+    const keyEpoch = this.options.maintenance.currentKeyEpoch(key);
+    const immediateOperations = [];
+    const deferredOperations = [];
+    for (const layer of this.options.layers) {
+      const operation = async () => {
+        if (this.options.maintenance.isWriteOutdated(key, clearEpoch, keyEpoch)) {
+          return;
+        }
+        if (this.options.shouldSkipLayer(layer)) {
+          return;
+        }
+        const entry = this.buildLayerSetEntry(layer, key, kind, value, writeOptions, now);
+        try {
+          await layer.set(entry.key, entry.value, entry.ttl);
+        } catch (error) {
+          await this.options.handleLayerFailure(layer, "write", error);
+        }
+      };
+      if (this.options.shouldWriteBehind(layer)) {
+        deferredOperations.push(operation);
+      } else {
+        immediateOperations.push(operation);
+      }
+    }
+    await this.executeLayerOperations(immediateOperations, { key, action: kind === "empty" ? "negative-set" : "set" });
+    await Promise.all(deferredOperations.map((operation) => this.options.enqueueWriteBehind(operation)));
+  }
+  async writeBatch(entries) {
+    const now = Date.now();
+    const clearEpoch = this.options.maintenance.currentClearEpoch();
+    const entryEpochs = new Map(
+      entries.map((entry) => [entry.key, this.options.maintenance.currentKeyEpoch(entry.key)])
+    );
+    const entriesByLayer = /* @__PURE__ */ new Map();
+    const immediateOperations = [];
+    const deferredOperations = [];
+    for (const entry of entries) {
+      for (const layer of this.options.layers) {
+        if (this.options.shouldSkipLayer(layer)) {
+          continue;
+        }
+        const layerEntry = this.buildLayerSetEntry(layer, entry.key, "value", entry.value, entry.options, now);
+        const bucket = entriesByLayer.get(layer) ?? [];
+        bucket.push(layerEntry);
+        entriesByLayer.set(layer, bucket);
+      }
+    }
+    for (const [layer, layerEntries] of entriesByLayer.entries()) {
+      const operation = async () => {
+        if (clearEpoch !== this.options.maintenance.currentClearEpoch()) {
+          return;
+        }
+        const activeEntries = layerEntries.filter(
+          (entry) => (entryEpochs.get(entry.key) ?? 0) === this.options.maintenance.currentKeyEpoch(entry.key)
+        );
+        if (activeEntries.length === 0) {
+          return;
+        }
+        try {
+          if (layer.setMany) {
+            await layer.setMany(activeEntries);
+            return;
+          }
+          await Promise.all(activeEntries.map((entry) => layer.set(entry.key, entry.value, entry.ttl)));
+        } catch (error) {
+          await this.options.handleLayerFailure(layer, "write", error);
+        }
+      };
+      if (this.options.shouldWriteBehind(layer)) {
+        deferredOperations.push(operation);
+      } else {
+        immediateOperations.push(operation);
+      }
+    }
+    await this.executeLayerOperations(immediateOperations, { key: "batch", action: "mset" });
+    await Promise.all(deferredOperations.map((operation) => this.options.enqueueWriteBehind(operation)));
+    return { clearEpoch, entryEpochs };
+  }
+  async executeLayerOperations(operations, context) {
+    if (this.options.writePolicy !== "best-effort") {
+      await Promise.all(operations.map((operation) => operation()));
+      return;
+    }
+    const results = await Promise.allSettled(operations.map((operation) => operation()));
+    const failures = results.filter((result) => result.status === "rejected");
+    const degraded = results.filter((result) => result.status === "fulfilled");
+    if (failures.length === 0) {
+      return;
+    }
+    this.options.onWriteFailures(
+      context,
+      failures.map((failure) => failure.reason)
+    );
+    if (failures.length === operations.length) {
+      throw new AggregateError(
+        failures.map((failure) => failure.reason),
+        `${context.action} failed for every cache layer`
+      );
+    }
+  }
+  buildLayerSetEntry(layer, key, kind, value, writeOptions, now) {
+    const freshTtl = this.options.resolveFreshTtl(key, layer.name, kind, writeOptions, layer.defaultTtl, value);
+    const staleWhileRevalidate = this.options.resolveLayerSeconds(
+      layer.name,
+      writeOptions?.staleWhileRevalidate,
+      this.options.globalStaleWhileRevalidate
+    );
+    const staleIfError = this.options.resolveLayerSeconds(
+      layer.name,
+      writeOptions?.staleIfError,
+      this.options.globalStaleIfError
+    );
+    const payload = createStoredValueEnvelope({
+      kind,
+      value,
+      freshTtlSeconds: freshTtl,
+      staleWhileRevalidateSeconds: staleWhileRevalidate,
+      staleIfErrorSeconds: staleIfError,
+      now
+    });
+    const ttl = remainingStoredTtlSeconds(payload, now) ?? freshTtl;
+    return {
+      key,
+      value: payload,
+      ttl
+    };
+  }
+};
+
 // src/internal/CacheStackMaintenance.ts
 var CacheStackMaintenance = class {
   keyEpochs = /* @__PURE__ */ new Map();
@@ -694,57 +798,347 @@ var CacheStackMaintenance = class {
       await this.flushWriteBehindQueue(options, flushBatch);
     }
   }
-  scheduleGenerationCleanup(generation, task, onError) {
-    const scheduledTask = (this.generationCleanupPromise ?? Promise.resolve()).then(() => task(generation)).catch((error) => {
-      onError(generation, error);
-    });
-    this.generationCleanupPromise = scheduledTask.finally(() => {
-      if (this.generationCleanupPromise === scheduledTask) {
-        this.generationCleanupPromise = void 0;
+  scheduleGenerationCleanup(generation, task, onError) {
+    const scheduledTask = (this.generationCleanupPromise ?? Promise.resolve()).then(() => task(generation)).catch((error) => {
+      onError(generation, error);
+    });
+    this.generationCleanupPromise = scheduledTask.finally(() => {
+      if (this.generationCleanupPromise === scheduledTask) {
+        this.generationCleanupPromise = void 0;
+      }
+    });
+  }
+  async waitForGenerationCleanup() {
+    await this.generationCleanupPromise;
+  }
+};
+
+// src/internal/CacheStackRuntimePolicy.ts
+function shouldSkipLayer(degradedUntil, now = Date.now()) {
+  return degradedUntil !== void 0 && degradedUntil > now;
+}
+function shouldStartBackgroundRefresh({
+  isDisconnecting,
+  hasRefreshInFlight
+}) {
+  return !isDisconnecting && !hasRefreshInFlight;
+}
+function resolveRecoverableLayerFailure(gracefulDegradation, now = Date.now()) {
+  if (!gracefulDegradation) {
+    return { degrade: false };
+  }
+  const retryAfterMs = typeof gracefulDegradation === "object" ? gracefulDegradation.retryAfterMs ?? 1e4 : 1e4;
+  return {
+    degrade: true,
+    degradedUntil: now + retryAfterMs
+  };
+}
+function planFreshReadPolicies({
+  stored,
+  hasFetcher,
+  slidingTtl,
+  refreshAheadSeconds
+}) {
+  const refreshedStored = slidingTtl && isStoredValueEnvelope(stored) ? refreshStoredEnvelope(stored) : void 0;
+  const refreshedStoredTtl = refreshedStored ? remainingStoredTtlSeconds(refreshedStored) ?? void 0 : void 0;
+  const remainingFreshTtl = remainingFreshTtlSeconds(stored) ?? 0;
+  return {
+    refreshedStored,
+    refreshedStoredTtl,
+    shouldScheduleBackgroundRefresh: hasFetcher && refreshAheadSeconds > 0 && remainingFreshTtl > 0 && remainingFreshTtl <= refreshAheadSeconds
+  };
+}
+
+// src/internal/CacheStackSnapshotManager.ts
+import { randomBytes } from "crypto";
+import { constants, promises as fs } from "fs";
+import path from "path";
+
+// src/internal/CacheSnapshotFile.ts
+function isWithinSnapshotBase(realBaseDir, candidatePath, pathSeparator, path2) {
+  const relative = path2.relative(realBaseDir, candidatePath);
+  return !(relative === ".." || relative.startsWith(`..${pathSeparator}`) || path2.isAbsolute(relative));
+}
+async function findExistingAncestor(directory, fs3, path2) {
+  let current = directory;
+  while (true) {
+    try {
+      await fs3.lstat(current);
+      return current;
+    } catch (error) {
+      if (error.code !== "ENOENT") {
+        throw error;
+      }
+    }
+    const parent = path2.dirname(current);
+    if (parent === current) {
+      return current;
+    }
+    current = parent;
+  }
+}
+async function validateSnapshotFilePath(filePath, mode, snapshotBaseDir, cwd = process.cwd()) {
+  if (filePath.length === 0) {
+    throw new Error("filePath must not be empty.");
+  }
+  if (filePath.includes("\0")) {
+    throw new Error("filePath must not contain null bytes.");
+  }
+  const { promises: fs3 } = await import("fs");
+  const path2 = await import("path");
+  const resolved = path2.resolve(filePath);
+  const baseDir = snapshotBaseDir === false ? false : path2.resolve(snapshotBaseDir ?? cwd);
+  if (baseDir === false) {
+    return resolved;
+  }
+  await fs3.mkdir(baseDir, { recursive: true });
+  const realBaseDir = await fs3.realpath(baseDir);
+  if (!isWithinSnapshotBase(realBaseDir, resolved, path2.sep, path2)) {
+    throw new Error(`filePath is outside the allowed snapshot directory: ${realBaseDir}`);
+  }
+  if (mode === "read") {
+    const realTarget = await fs3.realpath(resolved);
+    if (!isWithinSnapshotBase(realBaseDir, realTarget, path2.sep, path2)) {
+      throw new Error(`filePath is outside the allowed snapshot directory: ${realBaseDir}`);
+    }
+    return realTarget;
+  }
+  const parentDir = path2.dirname(resolved);
+  const existingAncestor = await findExistingAncestor(parentDir, fs3, path2);
+  const realExistingAncestor = await fs3.realpath(existingAncestor);
+  if (!isWithinSnapshotBase(realBaseDir, realExistingAncestor, path2.sep, path2)) {
+    throw new Error(`filePath is outside the allowed snapshot directory: ${realBaseDir}`);
+  }
+  await fs3.mkdir(parentDir, { recursive: true });
+  const realParentDir = await fs3.realpath(parentDir);
+  if (!isWithinSnapshotBase(realBaseDir, realParentDir, path2.sep, path2)) {
+    throw new Error(`filePath is outside the allowed snapshot directory: ${realBaseDir}`);
+  }
+  const targetPath = path2.join(realParentDir, path2.basename(resolved));
+  try {
+    const existing = await fs3.lstat(targetPath);
+    if (existing.isSymbolicLink()) {
+      throw new Error("filePath must not point to a symbolic link.");
+    }
+  } catch (error) {
+    if (error.code !== "ENOENT") {
+      throw error;
+    }
+  }
+  return targetPath;
+}
+async function readUtf8HandleWithLimit(handle, byteLimit) {
+  if (byteLimit === false) {
+    return handle.readFile({ encoding: "utf8" });
+  }
+  const chunks = [];
+  let totalBytes = 0;
+  let position = 0;
+  while (true) {
+    const buffer = Buffer.allocUnsafe(Math.min(64 * 1024, byteLimit - totalBytes + 1));
+    const { bytesRead } = await handle.read(buffer, 0, buffer.byteLength, position);
+    if (bytesRead === 0) {
+      break;
+    }
+    totalBytes += bytesRead;
+    if (totalBytes > byteLimit) {
+      throw new Error(`Snapshot file exceeds snapshotMaxBytes limit (${totalBytes} bytes > ${byteLimit} bytes).`);
+    }
+    chunks.push(buffer.subarray(0, bytesRead));
+    position += bytesRead;
+  }
+  return Buffer.concat(chunks).toString("utf8");
+}
+
+// src/internal/StructuredDataSanitizer.ts
+var DANGEROUS_KEYS = /* @__PURE__ */ new Set(["__proto__", "prototype", "constructor"]);
+function sanitizeStructuredData(value, options) {
+  return sanitizeValue(value, 0, { count: 0 }, options);
+}
+function sanitizeValue(value, depth, state, options) {
+  state.count += 1;
+  if (state.count > options.maxNodes) {
+    throw new Error(`${options.label} exceeds max node count of ${options.maxNodes}.`);
+  }
+  if (depth > options.maxDepth) {
+    throw new Error(`${options.label} exceeds max depth of ${options.maxDepth}.`);
+  }
+  if (Array.isArray(value)) {
+    const sanitized2 = [];
+    for (const entry of value) {
+      sanitized2.push(sanitizeValue(entry, depth + 1, state, options));
+    }
+    return sanitized2;
+  }
+  if (!isPlainObject(value)) {
+    return value;
+  }
+  const sanitized = options.createObject?.() ?? {};
+  for (const [key, entry] of Object.entries(value)) {
+    if (DANGEROUS_KEYS.has(key)) {
+      continue;
+    }
+    sanitized[key] = sanitizeValue(entry, depth + 1, state, options);
+  }
+  return sanitized;
+}
+function isPlainObject(value) {
+  return Object.prototype.toString.call(value) === "[object Object]";
+}
+
+// src/internal/CacheStackSnapshotManager.ts
+var DEFAULT_SNAPSHOT_IMPORT_BATCH_SIZE = 50;
+var CacheStackSnapshotManager = class {
+  constructor(options) {
+    this.options = options;
+  }
+  options;
+  async exportState(maxEntries) {
+    const entries = [];
+    await this.visitExportEntries(maxEntries, async (entry) => {
+      entries.push(entry);
+    });
+    return entries;
+  }
+  async importState(entries) {
+    const normalizedEntries = entries.map((entry) => ({
+      key: this.options.qualifyKey(this.options.validateCacheKey(entry.key)),
+      value: entry.value,
+      ttl: entry.ttl
+    }));
+    for (let index = 0; index < normalizedEntries.length; index += DEFAULT_SNAPSHOT_IMPORT_BATCH_SIZE) {
+      const batch = normalizedEntries.slice(index, index + DEFAULT_SNAPSHOT_IMPORT_BATCH_SIZE);
+      await Promise.all(
+        batch.map(async (entry) => {
+          await Promise.all(
+            this.options.layers.map(async (layer) => {
+              if (this.options.shouldSkipLayer(layer)) return;
+              try {
+                await layer.set(entry.key, entry.value, entry.ttl);
+              } catch (error) {
+                await this.options.handleLayerFailure(layer, "write", error);
+              }
+            })
+          );
+          await this.options.tagIndex.touch(entry.key);
+        })
+      );
+    }
+  }
+  async persistToFile(filePath, snapshotBaseDir, maxEntries) {
+    const targetPath = await validateSnapshotFilePath(filePath, "write", snapshotBaseDir);
+    const tempPath = path.join(
+      path.dirname(targetPath),
+      `.layercache-${process.pid}-${Date.now()}-${randomBytes(8).toString("hex")}.tmp`
+    );
+    let handle;
+    try {
+      handle = await fs.open(tempPath, "wx");
+      const openedHandle = handle;
+      await openedHandle.writeFile("[", "utf8");
+      let wroteAny = false;
+      await this.visitExportEntries(maxEntries, async (entry) => {
+        await openedHandle.writeFile(wroteAny ? ",\n" : "\n", "utf8");
+        await openedHandle.writeFile(JSON.stringify(entry, null, 2), "utf8");
+        wroteAny = true;
+      });
+      await openedHandle.writeFile(wroteAny ? "\n]" : "]", "utf8");
+      await openedHandle.close();
+      handle = void 0;
+      await fs.rename(tempPath, targetPath);
+    } catch (error) {
+      await handle?.close().catch(() => void 0);
+      await fs.unlink(tempPath).catch(() => void 0);
+      throw error;
+    }
+  }
+  async restoreFromFile(filePath, snapshotBaseDir, maxBytes) {
+    const validatedPath = await validateSnapshotFilePath(filePath, "read", snapshotBaseDir);
+    const handle = await fs.open(validatedPath, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+    let raw;
+    try {
+      if (maxBytes !== false) {
+        const stat = await handle.stat();
+        if (stat.size > maxBytes) {
+          throw new Error(`Snapshot file exceeds snapshotMaxBytes limit (${stat.size} bytes > ${maxBytes} bytes).`);
+        }
+      }
+      raw = await readUtf8HandleWithLimit(handle, maxBytes);
+    } finally {
+      await handle.close();
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch (cause) {
+      throw new Error(`Invalid snapshot file: could not parse JSON (${this.options.formatError(cause)})`);
+    }
+    if (!this.isCacheSnapshotEntries(parsed)) {
+      throw new Error("Invalid snapshot file: expected an array of { key: string, value, ttl? } entries");
+    }
+    await this.importState(
+      parsed.map((entry) => ({
+        key: entry.key,
+        value: this.sanitizeSnapshotValue(entry.value),
+        ttl: entry.ttl
+      }))
+    );
+  }
+  async visitExportEntries(maxEntries, visitor) {
+    const exported = /* @__PURE__ */ new Set();
+    for (const layer of this.options.layers) {
+      if (!layer.keys && !layer.forEachKey) {
+        continue;
+      }
+      const visitKey = async (key) => {
+        const exportedKey = this.options.stripQualifiedKey(key);
+        if (exported.has(exportedKey)) {
+          return;
+        }
+        const stored = await this.options.readLayerEntry(layer, key);
+        if (stored === null) {
+          return;
+        }
+        exported.add(exportedKey);
+        if (maxEntries !== false && exported.size > maxEntries) {
+          throw new Error(`Snapshot export exceeds snapshotMaxEntries limit (${exported.size} > ${maxEntries}).`);
+        }
+        await visitor({
+          key: exportedKey,
+          value: stored,
+          ttl: remainingStoredTtlSeconds(stored)
+        });
+      };
+      if (layer.forEachKey) {
+        await layer.forEachKey(visitKey);
+        continue;
+      }
+      const keys = await layer.keys?.();
+      for (const key of keys ?? []) {
+        await visitKey(key);
+      }
+    }
+  }
+  isCacheSnapshotEntries(value) {
+    return Array.isArray(value) && value.every((entry) => {
+      if (!entry || typeof entry !== "object") {
+        return false;
       }
+      const candidate = entry;
+      return typeof candidate.key === "string" && (candidate.ttl === void 0 || typeof candidate.ttl === "number" && Number.isFinite(candidate.ttl) && candidate.ttl >= 0);
     });
   }
-  async waitForGenerationCleanup() {
-    await this.generationCleanupPromise;
+  sanitizeSnapshotValue(value) {
+    const roundTripped = this.options.snapshotSerializer.deserialize(this.options.snapshotSerializer.serialize(value));
+    return sanitizeStructuredData(roundTripped, {
+      label: "Snapshot value",
+      maxDepth: 64,
+      maxNodes: 1e4,
+      createObject: () => /* @__PURE__ */ Object.create(null)
+    });
   }
 };
 
-// src/internal/CacheStackRuntimePolicy.ts
-function shouldSkipLayer(degradedUntil, now = Date.now()) {
-  return degradedUntil !== void 0 && degradedUntil > now;
-}
-function shouldStartBackgroundRefresh({
-  isDisconnecting,
-  hasRefreshInFlight
-}) {
-  return !isDisconnecting && !hasRefreshInFlight;
-}
-function resolveRecoverableLayerFailure(gracefulDegradation, now = Date.now()) {
-  if (!gracefulDegradation) {
-    return { degrade: false };
-  }
-  const retryAfterMs = typeof gracefulDegradation === "object" ? gracefulDegradation.retryAfterMs ?? 1e4 : 1e4;
-  return {
-    degrade: true,
-    degradedUntil: now + retryAfterMs
-  };
-}
-function planFreshReadPolicies({
-  stored,
-  hasFetcher,
-  slidingTtl,
-  refreshAheadSeconds
-}) {
-  const refreshedStored = slidingTtl && isStoredValueEnvelope(stored) ? refreshStoredEnvelope(stored) : void 0;
-  const refreshedStoredTtl = refreshedStored ? remainingStoredTtlSeconds(refreshedStored) ?? void 0 : void 0;
-  const remainingFreshTtl = remainingFreshTtlSeconds(stored) ?? 0;
-  return {
-    refreshedStored,
-    refreshedStoredTtl,
-    shouldScheduleBackgroundRefresh: hasFetcher && refreshAheadSeconds > 0 && remainingFreshTtl > 0 && remainingFreshTtl <= refreshAheadSeconds
-  };
-}
-
 // src/internal/CacheStackValidation.ts
 var MAX_CACHE_KEY_LENGTH = 1024;
 var MAX_PATTERN_LENGTH = 1024;
@@ -972,7 +1366,11 @@ var FetchRateLimiter = class {
   fetcherBuckets = /* @__PURE__ */ new WeakMap();
   nextFetcherBucketId = 0;
   drainTimer;
+  isDisposed = false;
   async schedule(options, context, task) {
+    if (this.isDisposed) {
+      throw new Error("FetchRateLimiter has been disposed.");
+    }
     if (!options) {
       return task();
     }
@@ -995,6 +1393,27 @@ var FetchRateLimiter = class {
       this.drain();
     });
   }
+  dispose() {
+    this.isDisposed = true;
+    if (this.drainTimer) {
+      clearTimeout(this.drainTimer);
+      this.drainTimer = void 0;
+    }
+    for (const bucket of this.buckets.values()) {
+      if (bucket.cleanupTimer) {
+        clearTimeout(bucket.cleanupTimer);
+        bucket.cleanupTimer = void 0;
+      }
+    }
+    for (const queue of this.queuesByBucket.values()) {
+      for (const item of queue) {
+        item.reject(new Error("FetchRateLimiter has been disposed."));
+      }
+    }
+    this.queuesByBucket.clear();
+    this.pendingBuckets.clear();
+    this.buckets.clear();
+  }
   normalize(options) {
     const maxConcurrent = options.maxConcurrent;
     const intervalMs = options.intervalMs;
@@ -1030,6 +1449,9 @@ var FetchRateLimiter = class {
     return "global";
   }
   drain() {
+    if (this.isDisposed) {
+      return;
+    }
     if (this.drainTimer) {
       clearTimeout(this.drainTimer);
       this.drainTimer = void 0;
@@ -1093,7 +1515,13 @@ var FetchRateLimiter = class {
           this.pendingBuckets.add(next.bucketKey);
         }
         this.cleanupBucket(next.bucketKey, bucket, next.options.intervalMs);
-        this.drain();
+        if (!this.drainTimer) {
+          this.drainTimer = setTimeout(() => {
+            this.drainTimer = void 0;
+            this.drain();
+          }, 0);
+          this.drainTimer.unref?.();
+        }
       });
     }
   }
@@ -1126,12 +1554,18 @@ var FetchRateLimiter = class {
     }
   }
   bucketState(bucketKey) {
+    if (this.isDisposed) {
+      throw new Error("FetchRateLimiter has been disposed.");
+    }
     const existing = this.buckets.get(bucketKey);
     if (existing) {
       return existing;
     }
     if (this.buckets.size >= MAX_BUCKETS) {
       this.evictIdleBuckets();
+      if (this.buckets.size >= MAX_BUCKETS) {
+        throw new Error(`FetchRateLimiter bucket limit (${MAX_BUCKETS}) exceeded.`);
+      }
     }
     const bucket = { active: 0, startedAt: [] };
     this.buckets.set(bucketKey, bucket);
@@ -1362,44 +1796,19 @@ var TtlResolver = class {
 };
 
 // src/serialization/JsonSerializer.ts
-var DANGEROUS_JSON_KEYS = /* @__PURE__ */ new Set(["__proto__", "prototype", "constructor"]);
-var MAX_SANITIZE_NODES = 1e4;
 var JsonSerializer = class {
   serialize(value) {
     return JSON.stringify(value);
   }
   deserialize(payload) {
     const normalized = Buffer.isBuffer(payload) ? payload.toString("utf8") : payload;
-    return sanitizeJsonValue(JSON.parse(normalized), 0, { count: 0 });
+    return sanitizeStructuredData(JSON.parse(normalized), {
+      label: "JSON payload",
+      maxDepth: 200,
+      maxNodes: 1e4
+    });
   }
 };
-var MAX_SANITIZE_DEPTH = 200;
-function sanitizeJsonValue(value, depth, state) {
-  state.count += 1;
-  if (state.count > MAX_SANITIZE_NODES) {
-    throw new Error(`JSON payload exceeds max node count of ${MAX_SANITIZE_NODES}.`);
-  }
-  if (depth > MAX_SANITIZE_DEPTH) {
-    throw new Error(`JSON payload exceeds max depth of ${MAX_SANITIZE_DEPTH}.`);
-  }
-  if (Array.isArray(value)) {
-    return value.map((entry) => sanitizeJsonValue(entry, depth + 1, state));
-  }
-  if (!isPlainObject(value)) {
-    return value;
-  }
-  const sanitized = {};
-  for (const [key, entry] of Object.entries(value)) {
-    if (DANGEROUS_JSON_KEYS.has(key)) {
-      continue;
-    }
-    sanitized[key] = sanitizeJsonValue(entry, depth + 1, state);
-  }
-  return sanitized;
-}
-function isPlainObject(value) {
-  return Object.prototype.toString.call(value) === "[object Object]";
-}
 
 // src/stampede/StampedeGuard.ts
 import { Mutex as Mutex2 } from "async-mutex";
@@ -1445,7 +1854,6 @@ var DEFAULT_SINGLE_FLIGHT_POLL_MS = 50;
 var DEFAULT_BACKGROUND_REFRESH_TIMEOUT_MS = 3e4;
 var DEFAULT_SNAPSHOT_MAX_BYTES = 16 * 1024 * 1024;
 var DEFAULT_SNAPSHOT_MAX_ENTRIES = 1e4;
-var DEFAULT_SNAPSHOT_IMPORT_BATCH_SIZE = 50;
 var DEFAULT_INVALIDATION_MAX_KEYS = 1e4;
 var DEFAULT_MAX_PROFILE_ENTRIES = 1e5;
 var DebugLogger = class {
@@ -1502,6 +1910,35 @@ var CacheStack = class extends EventEmitter {
         await this.handleLayerFailure(layer, operation, error);
       }
     });
+    this.invalidation = new CacheStackInvalidationSupport({
+      tagIndex: this.tagIndex,
+      shouldSkipLayer: (layer) => this.shouldSkipLayer(layer),
+      handleLayerFailure: async (layer, operation, error) => {
+        await this.handleLayerFailure(layer, operation, error);
+      }
+    });
+    this.layerWriter = new CacheStackLayerWriter({
+      layers: this.layers,
+      maintenance: this.maintenance,
+      shouldSkipLayer: (layer) => this.shouldSkipLayer(layer),
+      shouldWriteBehind: (layer) => this.shouldWriteBehind(layer),
+      handleLayerFailure: async (layer, operation, error) => {
+        await this.handleLayerFailure(layer, operation, error);
+      },
+      enqueueWriteBehind: this.enqueueWriteBehind.bind(this),
+      resolveFreshTtl: this.resolveFreshTtl.bind(this),
+      resolveLayerSeconds: this.resolveLayerSeconds.bind(this),
+      globalStaleWhileRevalidate: this.options.staleWhileRevalidate,
+      globalStaleIfError: this.options.staleIfError,
+      writePolicy: this.options.writePolicy,
+      onWriteFailures: (context, failures) => {
+        this.metricsCollector.increment("writeFailures", failures.length);
+        this.logger.debug?.("write-failure", {
+          ...context,
+          failures: failures.map((failure) => this.formatError(failure))
+        });
+      }
+    });
     if (!options.tagIndex && layers.some((layer) => layer.isLocal === false)) {
       this.logger.warn?.(
         "Using the default in-memory TagIndex with a shared cache layer only tracks keys seen by this process. Use RedisTagIndex for cross-instance tag invalidation."
@@ -1517,6 +1954,18 @@ var CacheStack = class extends EventEmitter {
         "broadcastL1Invalidation defaults to false when an invalidation bus is configured; opt in explicitly if write-triggered L1 invalidation is desired."
       );
     }
+    this.snapshots = new CacheStackSnapshotManager({
+      layers: this.layers,
+      tagIndex: this.tagIndex,
+      snapshotSerializer: this.snapshotSerializer,
+      readLayerEntry: this.readLayerEntry.bind(this),
+      shouldSkipLayer: (layer) => this.shouldSkipLayer(layer),
+      handleLayerFailure: async (layer, operation, error) => this.handleLayerFailure(layer, operation, error),
+      qualifyKey: this.qualifyKey.bind(this),
+      stripQualifiedKey: this.stripQualifiedKey.bind(this),
+      validateCacheKey,
+      formatError: this.formatError.bind(this)
+    });
     this.initializeWriteBehind(options.writeBehind);
     this.startup = this.initialize();
   }
@@ -1532,11 +1981,16 @@ var CacheStack = class extends EventEmitter {
   keyDiscovery;
   fetchRateLimiter = new FetchRateLimiter();
   snapshotSerializer = new JsonSerializer();
+  invalidation;
+  layerWriter;
+  snapshots;
   backgroundRefreshes = /* @__PURE__ */ new Map();
+  backgroundRefreshAbort = /* @__PURE__ */ new Map();
   layerDegradedUntil = /* @__PURE__ */ new Map();
   maintenance = new CacheStackMaintenance();
   ttlResolver;
   circuitBreakerManager;
+  nextOperationId = 0;
   currentGeneration;
   isDisconnecting = false;
   disconnectPromise;
@@ -1547,10 +2001,12 @@ var CacheStack = class extends EventEmitter {
    * and no `fetcher` is provided.
    */
   async get(key, fetcher, options) {
-    const normalizedKey = this.qualifyKey(validateCacheKey(key));
-    this.validateWriteOptions(options);
-    await this.awaitStartup("get");
-    return this.getPrepared(normalizedKey, fetcher, options);
+    return this.observeOperation("layercache.get", { "layercache.key": String(key ?? "") }, async () => {
+      const normalizedKey = this.qualifyKey(validateCacheKey(key));
+      this.validateWriteOptions(options);
+      await this.awaitStartup("get");
+      return this.getPrepared(normalizedKey, fetcher, options);
+    });
   }
   async getPrepared(normalizedKey, fetcher, options) {
     const hit = await this.readFromLayers(normalizedKey, options, "allow-stale");
@@ -1672,23 +2128,27 @@ var CacheStack = class extends EventEmitter {
    * Stores a value in all cache layers. Overwrites any existing value.
    */
   async set(key, value, options) {
-    const normalizedKey = this.qualifyKey(validateCacheKey(key));
-    this.validateWriteOptions(options);
-    await this.awaitStartup("set");
-    await this.storeEntry(normalizedKey, "value", value, options);
+    await this.observeOperation("layercache.set", { "layercache.key": String(key ?? "") }, async () => {
+      const normalizedKey = this.qualifyKey(validateCacheKey(key));
+      this.validateWriteOptions(options);
+      await this.awaitStartup("set");
+      await this.storeEntry(normalizedKey, "value", value, options);
+    });
   }
   /**
    * Deletes the key from all layers and publishes an invalidation message.
    */
   async delete(key) {
-    const normalizedKey = this.qualifyKey(validateCacheKey(key));
-    await this.awaitStartup("delete");
-    await this.deleteKeys([normalizedKey]);
-    await this.publishInvalidation({
-      scope: "key",
-      keys: [normalizedKey],
-      sourceId: this.instanceId,
-      operation: "delete"
+    await this.observeOperation("layercache.delete", { "layercache.key": String(key ?? "") }, async () => {
+      const normalizedKey = this.qualifyKey(validateCacheKey(key));
+      await this.awaitStartup("delete");
+      await this.deleteKeys([normalizedKey]);
+      await this.publishInvalidation({
+        scope: "key",
+        keys: [normalizedKey],
+        sourceId: this.instanceId,
+        operation: "delete"
+      });
     });
   }
   async clear() {
@@ -1721,95 +2181,102 @@ var CacheStack = class extends EventEmitter {
     });
   }
   async mget(entries) {
-    this.assertActive("mget");
-    if (entries.length === 0) {
-      return [];
-    }
-    const normalizedEntries = entries.map((entry) => ({
-      ...entry,
-      key: this.qualifyKey(validateCacheKey(entry.key))
-    }));
-    normalizedEntries.forEach((entry) => this.validateWriteOptions(entry.options));
-    const canFastPath = normalizedEntries.every((entry) => entry.fetch === void 0 && entry.options === void 0);
-    if (!canFastPath) {
+    return this.observeOperation("layercache.mget", void 0, async () => {
+      this.assertActive("mget");
+      if (entries.length === 0) {
+        return [];
+      }
+      const normalizedEntries = entries.map((entry) => ({
+        ...entry,
+        key: this.qualifyKey(validateCacheKey(entry.key))
+      }));
+      normalizedEntries.forEach((entry) => this.validateWriteOptions(entry.options));
+      const canFastPath = normalizedEntries.every((entry) => entry.fetch === void 0 && entry.options === void 0);
+      if (!canFastPath) {
+        await this.awaitStartup("mget");
+        const pendingReads = /* @__PURE__ */ new Map();
+        return Promise.all(
+          normalizedEntries.map((entry) => {
+            const optionsSignature = serializeOptions(entry.options);
+            const existing = pendingReads.get(entry.key);
+            if (!existing) {
+              const promise = this.getPrepared(entry.key, entry.fetch, entry.options);
+              pendingReads.set(entry.key, {
+                promise,
+                fetch: entry.fetch,
+                optionsSignature
+              });
+              return promise;
+            }
+            if (existing.fetch !== entry.fetch || existing.optionsSignature !== optionsSignature) {
+              throw new Error(`mget received conflicting entries for key "${entry.key}".`);
+            }
+            return existing.promise;
+          })
+        );
+      }
       await this.awaitStartup("mget");
-      const pendingReads = /* @__PURE__ */ new Map();
-      return Promise.all(
-        normalizedEntries.map((entry) => {
-          const optionsSignature = serializeOptions(entry.options);
-          const existing = pendingReads.get(entry.key);
-          if (!existing) {
-            const promise = this.getPrepared(entry.key, entry.fetch, entry.options);
-            pendingReads.set(entry.key, {
-              promise,
-              fetch: entry.fetch,
-              optionsSignature
-            });
-            return promise;
-          }
-          if (existing.fetch !== entry.fetch || existing.optionsSignature !== optionsSignature) {
-            throw new Error(`mget received conflicting entries for key "${entry.key}".`);
-          }
-          return existing.promise;
-        })
-      );
-    }
-    await this.awaitStartup("mget");
-    const pending = /* @__PURE__ */ new Set();
-    const indexesByKey = /* @__PURE__ */ new Map();
-    const resultsByKey = /* @__PURE__ */ new Map();
-    for (let index = 0; index < normalizedEntries.length; index += 1) {
-      const entry = normalizedEntries[index];
-      if (!entry) continue;
-      const key = entry.key;
-      const indexes = indexesByKey.get(key) ?? [];
-      indexes.push(index);
-      indexesByKey.set(key, indexes);
-      pending.add(key);
-    }
-    for (let layerIndex = 0; layerIndex < this.layers.length; layerIndex += 1) {
-      const layer = this.layers[layerIndex];
-      if (!layer) continue;
-      const keys = [...pending];
-      if (keys.length === 0) {
-        break;
+      const pending = /* @__PURE__ */ new Set();
+      const indexesByKey = /* @__PURE__ */ new Map();
+      const resultsByKey = /* @__PURE__ */ new Map();
+      for (let index = 0; index < normalizedEntries.length; index += 1) {
+        const entry = normalizedEntries[index];
+        if (!entry) continue;
+        const key = entry.key;
+        const indexes = indexesByKey.get(key) ?? [];
+        indexes.push(index);
+        indexesByKey.set(key, indexes);
+        pending.add(key);
       }
-      const values = layer.getMany ? await layer.getMany(keys) : await Promise.all(keys.map((key) => this.readLayerEntry(layer, key)));
-      for (let offset = 0; offset < values.length; offset += 1) {
-        const key = keys[offset];
-        const stored = values[offset];
-        if (!key || stored === null) {
-          continue;
+      for (let layerIndex = 0; layerIndex < this.layers.length; layerIndex += 1) {
+        const layer = this.layers[layerIndex];
+        if (!layer || this.shouldSkipLayer(layer)) continue;
+        const keys = [...pending];
+        if (keys.length === 0) {
+          break;
         }
-        const resolved = resolveStoredValue(stored);
-        if (resolved.state === "expired") {
-          await layer.delete(key);
-          continue;
+        const values = layer.getMany ? await layer.getMany(keys) : await Promise.all(keys.map((key) => this.readLayerEntry(layer, key)));
+        for (let offset = 0; offset < values.length; offset += 1) {
+          const key = keys[offset];
+          const stored = values[offset];
+          if (!key || stored === null) {
+            continue;
+          }
+          const resolved = resolveStoredValue(stored);
+          if (resolved.state === "expired") {
+            await layer.delete(key);
+            continue;
+          }
+          if (resolved.state === "stale-while-revalidate" || resolved.state === "stale-if-error") {
+            this.metricsCollector.increment("staleHits", indexesByKey.get(key)?.length ?? 1);
+          }
+          await this.tagIndex.touch(key);
+          await this.backfill(key, stored, layerIndex - 1);
+          resultsByKey.set(key, resolved.value);
+          pending.delete(key);
+          this.metricsCollector.increment("hits", indexesByKey.get(key)?.length ?? 1);
         }
-        await this.tagIndex.touch(key);
-        await this.backfill(key, stored, layerIndex - 1);
-        resultsByKey.set(key, resolved.value);
-        pending.delete(key);
-        this.metricsCollector.increment("hits", indexesByKey.get(key)?.length ?? 1);
       }
-    }
-    if (pending.size > 0) {
-      for (const key of pending) {
-        await this.tagIndex.remove(key);
-        this.metricsCollector.increment("misses", indexesByKey.get(key)?.length ?? 1);
+      if (pending.size > 0) {
+        for (const key of pending) {
+          await this.tagIndex.remove(key);
+          this.metricsCollector.increment("misses", indexesByKey.get(key)?.length ?? 1);
+        }
       }
-    }
-    return normalizedEntries.map((entry) => resultsByKey.get(entry.key) ?? null);
+      return normalizedEntries.map((entry) => resultsByKey.get(entry.key) ?? null);
+    });
   }
   async mset(entries) {
-    this.assertActive("mset");
-    const normalizedEntries = entries.map((entry) => ({
-      ...entry,
-      key: this.qualifyKey(validateCacheKey(entry.key))
-    }));
-    normalizedEntries.forEach((entry) => this.validateWriteOptions(entry.options));
-    await this.awaitStartup("mset");
-    await this.writeBatch(normalizedEntries);
+    await this.observeOperation("layercache.mset", void 0, async () => {
+      this.assertActive("mset");
+      const normalizedEntries = entries.map((entry) => ({
+        ...entry,
+        key: this.qualifyKey(validateCacheKey(entry.key))
+      }));
+      normalizedEntries.forEach((entry) => this.validateWriteOptions(entry.options));
+      await this.awaitStartup("mset");
+      await this.writeBatch(normalizedEntries);
+    });
   }
   async warm(entries, options = {}) {
     this.assertActive("warm");
@@ -1862,40 +2329,50 @@ var CacheStack = class extends EventEmitter {
     return new CacheNamespace(this, prefix);
   }
   async invalidateByTag(tag) {
-    validateTag(tag);
-    await this.awaitStartup("invalidateByTag");
-    const keys = await this.collectKeysForTag(tag);
-    await this.deleteKeys(keys);
-    await this.publishInvalidation({ scope: "keys", keys, sourceId: this.instanceId, operation: "invalidate" });
+    await this.observeOperation("layercache.invalidate_by_tag", void 0, async () => {
+      validateTag(tag);
+      await this.awaitStartup("invalidateByTag");
+      const keys = await this.invalidation.collectKeysForTag(tag, this.invalidationMaxKeys());
+      await this.deleteKeys(keys);
+      await this.publishInvalidation({ scope: "keys", keys, sourceId: this.instanceId, operation: "invalidate" });
+    });
   }
   async invalidateByTags(tags, mode = "any") {
-    if (tags.length === 0) {
-      return;
-    }
-    validateTags(tags);
-    await this.awaitStartup("invalidateByTags");
-    const keysByTag = await Promise.all(tags.map((tag) => this.collectKeysForTag(tag)));
-    const keys = mode === "all" ? this.intersectKeys(keysByTag) : [...new Set(keysByTag.flat())];
-    this.assertWithinInvalidationKeyLimit(keys.length);
-    await this.deleteKeys(keys);
-    await this.publishInvalidation({ scope: "keys", keys, sourceId: this.instanceId, operation: "invalidate" });
+    await this.observeOperation("layercache.invalidate_by_tags", void 0, async () => {
+      if (tags.length === 0) {
+        return;
+      }
+      validateTags(tags);
+      await this.awaitStartup("invalidateByTags");
+      const keysByTag = await Promise.all(
+        tags.map((tag) => this.invalidation.collectKeysForTag(tag, this.invalidationMaxKeys()))
+      );
+      const keys = mode === "all" ? this.invalidation.intersectKeys(keysByTag) : [...new Set(keysByTag.flat())];
+      this.invalidation.assertWithinInvalidationKeyLimit(keys.length, this.invalidationMaxKeys());
+      await this.deleteKeys(keys);
+      await this.publishInvalidation({ scope: "keys", keys, sourceId: this.instanceId, operation: "invalidate" });
+    });
   }
   async invalidateByPattern(pattern) {
-    validatePattern(pattern);
-    await this.awaitStartup("invalidateByPattern");
-    const keys = await this.keyDiscovery.collectKeysMatchingPattern(
-      this.qualifyPattern(pattern),
-      this.invalidationMaxKeys()
-    );
-    await this.deleteKeys(keys);
-    await this.publishInvalidation({ scope: "keys", keys, sourceId: this.instanceId, operation: "invalidate" });
+    await this.observeOperation("layercache.invalidate_by_pattern", void 0, async () => {
+      validatePattern(pattern);
+      await this.awaitStartup("invalidateByPattern");
+      const keys = await this.keyDiscovery.collectKeysMatchingPattern(
+        this.qualifyPattern(pattern),
+        this.invalidationMaxKeys()
+      );
+      await this.deleteKeys(keys);
+      await this.publishInvalidation({ scope: "keys", keys, sourceId: this.instanceId, operation: "invalidate" });
+    });
   }
   async invalidateByPrefix(prefix) {
-    await this.awaitStartup("invalidateByPrefix");
-    const qualifiedPrefix = this.qualifyKey(validateCacheKey(prefix));
-    const keys = await this.keyDiscovery.collectKeysWithPrefix(qualifiedPrefix, this.invalidationMaxKeys());
-    await this.deleteKeys(keys);
-    await this.publishInvalidation({ scope: "keys", keys, sourceId: this.instanceId, operation: "invalidate" });
+    await this.observeOperation("layercache.invalidate_by_prefix", void 0, async () => {
+      await this.awaitStartup("invalidateByPrefix");
+      const qualifiedPrefix = this.qualifyKey(validateCacheKey(prefix));
+      const keys = await this.keyDiscovery.collectKeysWithPrefix(qualifiedPrefix, this.invalidationMaxKeys());
+      await this.deleteKeys(keys);
+      await this.publishInvalidation({ scope: "keys", keys, sourceId: this.instanceId, operation: "invalidate" });
+    });
   }
   getMetrics() {
     return this.metricsCollector.snapshot;
@@ -2006,95 +2483,19 @@ var CacheStack = class extends EventEmitter {
   }
   async exportState() {
     await this.awaitStartup("exportState");
-    const entries = [];
-    await this.visitExportEntries(this.snapshotMaxEntries(), async (entry) => {
-      entries.push(entry);
-    });
-    return entries;
+    return this.snapshots.exportState(this.snapshotMaxEntries());
   }
   async importState(entries) {
     await this.awaitStartup("importState");
-    const normalizedEntries = entries.map((entry) => ({
-      key: this.qualifyKey(validateCacheKey(entry.key)),
-      value: entry.value,
-      ttl: entry.ttl
-    }));
-    for (let index = 0; index < normalizedEntries.length; index += DEFAULT_SNAPSHOT_IMPORT_BATCH_SIZE) {
-      const batch = normalizedEntries.slice(index, index + DEFAULT_SNAPSHOT_IMPORT_BATCH_SIZE);
-      await Promise.all(
-        batch.map(async (entry) => {
-          await Promise.all(this.layers.map((layer) => layer.set(entry.key, entry.value, entry.ttl)));
-          await this.tagIndex.touch(entry.key);
-        })
-      );
-    }
+    await this.snapshots.importState(entries);
   }
   async persistToFile(filePath) {
     this.assertActive("persistToFile");
-    const { promises: fs2 } = await import("fs");
-    const path = await import("path");
-    const targetPath = await validateSnapshotFilePath(filePath, "write", this.options.snapshotBaseDir);
-    const tempPath = path.join(
-      path.dirname(targetPath),
-      `.layercache-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}.tmp`
-    );
-    let handle;
-    try {
-      handle = await fs2.open(tempPath, "wx");
-      const openedHandle = handle;
-      await openedHandle.writeFile("[", "utf8");
-      let wroteAny = false;
-      await this.visitExportEntries(this.snapshotMaxEntries(), async (entry) => {
-        await openedHandle.writeFile(wroteAny ? ",\n" : "\n", "utf8");
-        await openedHandle.writeFile(JSON.stringify(entry, null, 2), "utf8");
-        wroteAny = true;
-      });
-      await openedHandle.writeFile(wroteAny ? "\n]" : "]", "utf8");
-      await openedHandle.close();
-      handle = void 0;
-      await fs2.rename(tempPath, targetPath);
-    } catch (error) {
-      await handle?.close().catch(() => void 0);
-      await fs2.unlink(tempPath).catch(() => void 0);
-      throw error;
-    }
+    await this.snapshots.persistToFile(filePath, this.options.snapshotBaseDir, this.snapshotMaxEntries());
   }
   async restoreFromFile(filePath) {
     this.assertActive("restoreFromFile");
-    const { promises: fs2, constants } = await import("fs");
-    const validatedPath = await validateSnapshotFilePath(filePath, "read", this.options.snapshotBaseDir);
-    const handle = await fs2.open(validatedPath, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
-    const snapshotMaxBytes = this.snapshotMaxBytes();
-    let raw;
-    try {
-      if (snapshotMaxBytes !== false) {
-        const stat = await handle.stat();
-        if (stat.size > snapshotMaxBytes) {
-          throw new Error(
-            `Snapshot file exceeds snapshotMaxBytes limit (${stat.size} bytes > ${snapshotMaxBytes} bytes).`
-          );
-        }
-      }
-      raw = await readUtf8HandleWithLimit(handle, snapshotMaxBytes);
-    } finally {
-      await handle.close();
-    }
-    let parsed;
-    try {
-      parsed = JSON.parse(raw);
-    } catch (cause) {
-      throw new Error(`Invalid snapshot file: could not parse JSON (${this.formatError(cause)})`);
-    }
-    if (!this.isCacheSnapshotEntries(parsed)) {
-      throw new Error("Invalid snapshot file: expected an array of { key: string, value, ttl? } entries");
-    }
-    await this.importState(
-      parsed.map((entry) => ({
-        key: entry.key,
-        value: this.sanitizeSnapshotValue(entry.value),
-        ttl: entry.ttl
-      }))
-    );
+    await this.snapshots.restoreFromFile(filePath, this.options.snapshotBaseDir, this.snapshotMaxBytes());
   }
   async disconnect() {
     if (!this.disconnectPromise) {
@@ -2104,8 +2505,27 @@ var CacheStack = class extends EventEmitter {
         await this.unsubscribeInvalidation?.();
         await this.flushWriteBehindQueue();
         await this.maintenance.waitForGenerationCleanup();
-        await Promise.allSettled([...this.backgroundRefreshes.values()]);
+        for (const key of this.backgroundRefreshAbort.keys()) {
+          this.backgroundRefreshAbort.set(key, true);
+        }
+        await Promise.allSettled(
+          [...this.backgroundRefreshes.values()].map((promise) => {
+            let timer;
+            return Promise.race([
+              promise,
+              new Promise((resolve2) => {
+                timer = setTimeout(resolve2, 5e3);
+                timer.unref?.();
+              })
+            ]).finally(() => {
+              if (timer) clearTimeout(timer);
+            });
+          })
+        );
+        this.backgroundRefreshes.clear();
+        this.backgroundRefreshAbort.clear();
         this.maintenance.disposeWriteBehindTimer();
+        this.fetchRateLimiter.dispose();
         await Promise.allSettled(this.layers.map((layer) => layer.dispose?.() ?? Promise.resolve()));
       })();
     }
@@ -2219,7 +2639,7 @@ var CacheStack = class extends EventEmitter {
   async storeEntry(key, kind, value, options) {
     const clearEpoch = this.maintenance.currentClearEpoch();
     const keyEpoch = this.maintenance.currentKeyEpoch(key);
-    await this.writeAcrossLayers(key, kind, value, options);
+    await this.layerWriter.writeAcrossLayers(key, kind, value, options);
     if (this.maintenance.isWriteOutdated(key, clearEpoch, keyEpoch)) {
       return;
     }
@@ -2236,52 +2656,7 @@ var CacheStack = class extends EventEmitter {
     }
   }
   async writeBatch(entries) {
-    const now = Date.now();
-    const clearEpoch = this.maintenance.currentClearEpoch();
-    const entryEpochs = new Map(entries.map((entry) => [entry.key, this.maintenance.currentKeyEpoch(entry.key)]));
-    const entriesByLayer = /* @__PURE__ */ new Map();
-    const immediateOperations = [];
-    const deferredOperations = [];
-    for (const entry of entries) {
-      for (const layer of this.layers) {
-        if (this.shouldSkipLayer(layer)) {
-          continue;
-        }
-        const layerEntry = this.buildLayerSetEntry(layer, entry.key, "value", entry.value, entry.options, now);
-        const bucket = entriesByLayer.get(layer) ?? [];
-        bucket.push(layerEntry);
-        entriesByLayer.set(layer, bucket);
-      }
-    }
-    for (const [layer, layerEntries] of entriesByLayer.entries()) {
-      const operation = async () => {
-        if (clearEpoch !== this.maintenance.currentClearEpoch()) {
-          return;
-        }
-        const activeEntries = layerEntries.filter(
-          (entry) => (entryEpochs.get(entry.key) ?? 0) === this.maintenance.currentKeyEpoch(entry.key)
-        );
-        if (activeEntries.length === 0) {
-          return;
-        }
-        try {
-          if (layer.setMany) {
-            await layer.setMany(activeEntries);
-            return;
-          }
-          await Promise.all(activeEntries.map((entry) => layer.set(entry.key, entry.value, entry.ttl)));
-        } catch (error) {
-          await this.handleLayerFailure(layer, "write", error);
-        }
-      };
-      if (this.shouldWriteBehind(layer)) {
-        deferredOperations.push(operation);
-      } else {
-        immediateOperations.push(operation);
-      }
-    }
-    await this.executeLayerOperations(immediateOperations, { key: "batch", action: "mset" });
-    await Promise.all(deferredOperations.map((operation) => this.enqueueWriteBehind(operation)));
+    const { clearEpoch, entryEpochs } = await this.layerWriter.writeBatch(entries);
     if (clearEpoch !== this.maintenance.currentClearEpoch()) {
       return;
     }
@@ -2388,58 +2763,6 @@ var CacheStack = class extends EventEmitter {
       this.emit("backfill", { key, layer: layer.name });
     }
   }
-  async writeAcrossLayers(key, kind, value, options) {
-    const now = Date.now();
-    const clearEpoch = this.maintenance.currentClearEpoch();
-    const keyEpoch = this.maintenance.currentKeyEpoch(key);
-    const immediateOperations = [];
-    const deferredOperations = [];
-    for (const layer of this.layers) {
-      const operation = async () => {
-        if (this.maintenance.isWriteOutdated(key, clearEpoch, keyEpoch)) {
-          return;
-        }
-        if (this.shouldSkipLayer(layer)) {
-          return;
-        }
-        const entry = this.buildLayerSetEntry(layer, key, kind, value, options, now);
-        try {
-          await layer.set(entry.key, entry.value, entry.ttl);
-        } catch (error) {
-          await this.handleLayerFailure(layer, "write", error);
-        }
-      };
-      if (this.shouldWriteBehind(layer)) {
-        deferredOperations.push(operation);
-      } else {
-        immediateOperations.push(operation);
-      }
-    }
-    await this.executeLayerOperations(immediateOperations, { key, action: kind === "empty" ? "negative-set" : "set" });
-    await Promise.all(deferredOperations.map((operation) => this.enqueueWriteBehind(operation)));
-  }
-  async executeLayerOperations(operations, context) {
-    if (this.options.writePolicy !== "best-effort") {
-      await Promise.all(operations.map((operation) => operation()));
-      return;
-    }
-    const results = await Promise.allSettled(operations.map((operation) => operation()));
-    const failures = results.filter((result) => result.status === "rejected");
-    if (failures.length === 0) {
-      return;
-    }
-    this.metricsCollector.increment("writeFailures", failures.length);
-    this.logger.debug?.("write-failure", {
-      ...context,
-      failures: failures.map((failure) => this.formatError(failure.reason))
-    });
-    if (failures.length === operations.length) {
-      throw new AggregateError(
-        failures.map((failure) => failure.reason),
-        `${context.action} failed for every cache layer`
-      );
-    }
-  }
   resolveFreshTtl(key, layerName, kind, options, fallbackTtl, value) {
     return this.ttlResolver.resolveFreshTtl(
       key,
@@ -2467,15 +2790,19 @@ var CacheStack = class extends EventEmitter {
     }
     const clearEpoch = this.maintenance.currentClearEpoch();
     const keyEpoch = this.maintenance.currentKeyEpoch(key);
+    this.backgroundRefreshAbort.set(key, false);
     const refresh = (async () => {
       this.metricsCollector.increment("refreshes");
       try {
+        if (this.backgroundRefreshAbort.get(key)) return;
         await this.runBackgroundRefresh(key, fetcher, options, clearEpoch, keyEpoch);
       } catch (error) {
+        if (this.backgroundRefreshAbort.get(key)) return;
         this.metricsCollector.increment("refreshErrors");
         this.logger.debug?.("refresh-error", { key, error: this.formatError(error) });
       } finally {
         this.backgroundRefreshes.delete(key);
+        this.backgroundRefreshAbort.delete(key);
       }
     })();
     this.backgroundRefreshes.set(key, refresh);
@@ -2505,7 +2832,7 @@ var CacheStack = class extends EventEmitter {
       return;
     }
     this.maintenance.bumpKeyEpochs(keys);
-    await this.deleteKeysFromLayers(this.layers, keys);
+    await this.invalidation.deleteKeysFromLayers(this.layers, keys);
     for (const key of keys) {
       await this.tagIndex.remove(key);
       this.ttlResolver.deleteProfile(key);
@@ -2537,7 +2864,7 @@ var CacheStack = class extends EventEmitter {
     }
     const keys = message.keys ?? [];
     this.maintenance.bumpKeyEpochs(keys);
-    await this.deleteKeysFromLayers(localLayers, keys);
+    await this.invalidation.deleteKeysFromLayers(localLayers, keys);
     if (message.operation !== "write") {
       for (const key of keys) {
         await this.tagIndex.remove(key);
@@ -2578,7 +2905,7 @@ var CacheStack = class extends EventEmitter {
           timer.unref?.();
         })
       ]);
-      if (result && typeof result === "object" && "kind" in result) {
+      if (result !== null && result !== void 0 && typeof result === "object" && "kind" in result) {
         if (result.kind === "error") {
           throw result.error;
         }
@@ -2594,6 +2921,31 @@ var CacheStack = class extends EventEmitter {
   shouldBroadcastL1Invalidation() {
     return this.options.broadcastL1Invalidation ?? this.options.publishSetInvalidation ?? false;
   }
+  async observeOperation(name, attributes, execute) {
+    const id = this.nextOperationId;
+    this.nextOperationId = (this.nextOperationId + 1) % Number.MAX_SAFE_INTEGER;
+    this.emit("operation-start", { id, name, attributes });
+    try {
+      const result = await execute();
+      this.emit("operation-end", {
+        id,
+        name,
+        attributes,
+        success: true,
+        result: result === null ? "null" : void 0
+      });
+      return result;
+    } catch (error) {
+      this.emit("operation-end", {
+        id,
+        name,
+        attributes,
+        success: false,
+        error
+      });
+      throw error;
+    }
+  }
   scheduleGenerationCleanup(generation) {
     this.maintenance.scheduleGenerationCleanup(
       generation,
@@ -2649,37 +3001,6 @@ var CacheStack = class extends EventEmitter {
     });
     this.emitError("write-behind", { failed: failures.length, total: batch.length });
   }
-  buildLayerSetEntry(layer, key, kind, value, options, now) {
-    const freshTtl = this.resolveFreshTtl(key, layer.name, kind, options, layer.defaultTtl, value);
-    const staleWhileRevalidate = this.resolveLayerSeconds(
-      layer.name,
-      options?.staleWhileRevalidate,
-      this.options.staleWhileRevalidate
-    );
-    const staleIfError = this.resolveLayerSeconds(layer.name, options?.staleIfError, this.options.staleIfError);
-    const payload = createStoredValueEnvelope({
-      kind,
-      value,
-      freshTtlSeconds: freshTtl,
-      staleWhileRevalidateSeconds: staleWhileRevalidate,
-      staleIfErrorSeconds: staleIfError,
-      now
-    });
-    const ttl = remainingStoredTtlSeconds(payload, now) ?? freshTtl;
-    return {
-      key,
-      value: payload,
-      ttl
-    };
-  }
-  intersectKeys(groups) {
-    if (groups.length === 0) {
-      return [];
-    }
-    const [firstGroup, ...rest] = groups;
-    const restSets = rest.map((group) => new Set(group));
-    return [...new Set(firstGroup)].filter((key) => restSets.every((group) => group.has(key)));
-  }
   qualifyKey(key) {
     return qualifyGenerationKey(key, this.currentGeneration);
   }
@@ -2689,32 +3010,6 @@ var CacheStack = class extends EventEmitter {
   stripQualifiedKey(key) {
     return stripGenerationPrefix(key, this.currentGeneration);
   }
-  async deleteKeysFromLayers(layers, keys) {
-    await Promise.all(
-      layers.map(async (layer) => {
-        if (this.shouldSkipLayer(layer)) {
-          return;
-        }
-        if (layer.deleteMany) {
-          try {
-            await layer.deleteMany(keys);
-          } catch (error) {
-            await this.handleLayerFailure(layer, "delete", error);
-          }
-          return;
-        }
-        await Promise.all(
-          keys.map(async (key) => {
-            try {
-              await layer.delete(key);
-            } catch (error) {
-              await this.handleLayerFailure(layer, "delete", error);
-            }
-          })
-        );
-      })
-    );
-  }
   validateConfiguration() {
     if (this.options.broadcastL1Invalidation !== void 0 && this.options.publishSetInvalidation !== void 0 && this.options.broadcastL1Invalidation !== this.options.publishSetInvalidation) {
       throw new Error("broadcastL1Invalidation and publishSetInvalidation cannot conflict.");
@@ -2845,18 +3140,6 @@ var CacheStack = class extends EventEmitter {
       this.emit("error", { operation, ...context });
     }
   }
-  isCacheSnapshotEntries(value) {
-    return Array.isArray(value) && value.every((entry) => {
-      if (!entry || typeof entry !== "object") {
-        return false;
-      }
-      const candidate = entry;
-      return typeof candidate.key === "string" && (candidate.ttl === void 0 || typeof candidate.ttl === "number" && Number.isFinite(candidate.ttl) && candidate.ttl >= 0);
-    });
-  }
-  sanitizeSnapshotValue(value) {
-    return this.snapshotSerializer.deserialize(this.snapshotSerializer.serialize(value));
-  }
   snapshotMaxBytes() {
     return this.options.snapshotMaxBytes === false ? false : this.options.snapshotMaxBytes ?? DEFAULT_SNAPSHOT_MAX_BYTES;
   }
@@ -2866,62 +3149,6 @@ var CacheStack = class extends EventEmitter {
   invalidationMaxKeys() {
     return this.options.invalidationMaxKeys === false ? false : this.options.invalidationMaxKeys ?? DEFAULT_INVALIDATION_MAX_KEYS;
   }
-  async collectKeysForTag(tag) {
-    const keys = /* @__PURE__ */ new Set();
-    if (this.tagIndex.forEachKeyForTag) {
-      await this.tagIndex.forEachKeyForTag(tag, async (key) => {
-        keys.add(key);
-        this.assertWithinInvalidationKeyLimit(keys.size);
-      });
-      return [...keys];
-    }
-    for (const key of await this.tagIndex.keysForTag(tag)) {
-      keys.add(key);
-      this.assertWithinInvalidationKeyLimit(keys.size);
-    }
-    return [...keys];
-  }
-  assertWithinInvalidationKeyLimit(size) {
-    const maxKeys = this.invalidationMaxKeys();
-    if (maxKeys !== false && size > maxKeys) {
-      throw new Error(`Invalidation matched too many keys (${size} > ${maxKeys}).`);
-    }
-  }
-  async visitExportEntries(maxEntries, visitor) {
-    const exported = /* @__PURE__ */ new Set();
-    for (const layer of this.layers) {
-      if (!layer.keys && !layer.forEachKey) {
-        continue;
-      }
-      const visitKey = async (key) => {
-        const exportedKey = this.stripQualifiedKey(key);
-        if (exported.has(exportedKey)) {
-          return;
-        }
-        const stored = await this.readLayerEntry(layer, key);
-        if (stored === null) {
-          return;
-        }
-        exported.add(exportedKey);
-        if (maxEntries !== false && exported.size > maxEntries) {
-          throw new Error(`Snapshot export exceeds snapshotMaxEntries limit (${exported.size} > ${maxEntries}).`);
-        }
-        await visitor({
-          key: exportedKey,
-          value: stored,
-          ttl: remainingStoredTtlSeconds(stored)
-        });
-      };
-      if (layer.forEachKey) {
-        await layer.forEachKey(visitKey);
-        continue;
-      }
-      const keys = await layer.keys?.();
-      for (const key of keys ?? []) {
-        await visitKey(key);
-      }
-    }
-  }
 };
 
 // src/invalidation/RedisInvalidationBus.ts
@@ -2932,6 +3159,7 @@ var RedisInvalidationBus = class {
   logger;
   handlers = /* @__PURE__ */ new Set();
   sharedListener;
+  subscribePromise;
   constructor(options) {
     this.publisher = options.publisher;
     this.subscriber = options.subscriber ?? options.publisher.duplicate();
@@ -2939,15 +3167,27 @@ var RedisInvalidationBus = class {
     this.logger = options.logger;
   }
   async subscribe(handler) {
-    if (this.handlers.size === 0) {
-      const listener = (_channel, payload) => {
-        void this.dispatchToHandlers(payload);
-      };
-      this.sharedListener = listener;
-      this.subscriber.on("message", listener);
-      await this.subscriber.subscribe(this.channel);
+    const previousPromise = this.subscribePromise;
+    let resolveThis;
+    this.subscribePromise = new Promise((resolve2) => {
+      resolveThis = resolve2;
+    });
+    if (previousPromise) {
+      await previousPromise;
+    }
+    try {
+      if (this.handlers.size === 0) {
+        const listener = (_channel, payload) => {
+          void this.dispatchToHandlers(payload);
+        };
+        this.sharedListener = listener;
+        this.subscriber.on("message", listener);
+        await this.subscriber.subscribe(this.channel);
+      }
+      this.handlers.add(handler);
+    } finally {
+      resolveThis();
     }
-    this.handlers.add(handler);
     return async () => {
       this.handlers.delete(handler);
       if (this.handlers.size === 0 && this.sharedListener) {
@@ -2963,7 +3203,12 @@ var RedisInvalidationBus = class {
   async dispatchToHandlers(payload) {
     let message;
     try {
-      const parsed = sanitizeJsonValue2(JSON.parse(payload));
+      const parsed = sanitizeStructuredData(JSON.parse(payload), {
+        label: "Invalidation payload",
+        maxDepth: 64,
+        maxNodes: 1e4,
+        createObject: () => /* @__PURE__ */ Object.create(null)
+      });
       if (!this.isInvalidationMessage(parsed)) {
         throw new Error("Invalid invalidation payload shape.");
       }
@@ -3000,31 +3245,6 @@ var RedisInvalidationBus = class {
     console.error(`[layercache] ${message}`, error);
   }
 };
-var DANGEROUS_KEYS = /* @__PURE__ */ new Set(["__proto__", "prototype", "constructor"]);
-var MAX_SANITIZE_DEPTH2 = 64;
-var MAX_SANITIZE_NODES2 = 1e4;
-function sanitizeJsonValue2(value, depth = 0, state = { count: 0 }) {
-  state.count += 1;
-  if (state.count > MAX_SANITIZE_NODES2) {
-    throw new Error(`Invalidation payload exceeds max node count of ${MAX_SANITIZE_NODES2}.`);
-  }
-  if (depth > MAX_SANITIZE_DEPTH2) {
-    throw new Error(`Invalidation payload exceeds max depth of ${MAX_SANITIZE_DEPTH2}.`);
-  }
-  if (Array.isArray(value)) {
-    return value.map((entry) => sanitizeJsonValue2(entry, depth + 1, state));
-  }
-  if (value && typeof value === "object") {
-    const result = /* @__PURE__ */ Object.create(null);
-    for (const key of Object.keys(value)) {
-      if (!DANGEROUS_KEYS.has(key)) {
-        result[key] = sanitizeJsonValue2(value[key], depth + 1, state);
-      }
-    }
-    return result;
-  }
-  return value;
-}
 
 // src/http/createCacheStatsHandler.ts
 function createCacheStatsHandler(cache, options = {}) {
@@ -3168,65 +3388,52 @@ function cacheGraphqlResolver(cache, prefix, resolver, options = {}) {
 }
 
 // src/integrations/opentelemetry.ts
+var MAX_SPANS = 1e4;
 function createOpenTelemetryPlugin(cache, tracer) {
-  const originals = {
-    get: cache.get.bind(cache),
-    set: cache.set.bind(cache),
-    delete: cache.delete.bind(cache),
-    mget: cache.mget.bind(cache),
-    mset: cache.mset.bind(cache),
-    invalidateByTag: cache.invalidateByTag.bind(cache),
-    invalidateByTags: cache.invalidateByTags.bind(cache),
-    invalidateByPattern: cache.invalidateByPattern.bind(cache),
-    invalidateByPrefix: cache.invalidateByPrefix.bind(cache)
-  };
-  cache.get = instrument("layercache.get", tracer, originals.get, (args) => ({
-    "layercache.key": String(args[0] ?? "")
-  }));
-  cache.set = instrument("layercache.set", tracer, originals.set, (args) => ({
-    "layercache.key": String(args[0] ?? "")
-  }));
-  cache.delete = instrument("layercache.delete", tracer, originals.delete, (args) => ({
-    "layercache.key": String(args[0] ?? "")
-  }));
-  cache.mget = instrument("layercache.mget", tracer, originals.mget);
-  cache.mset = instrument("layercache.mset", tracer, originals.mset);
-  cache.invalidateByTag = instrument("layercache.invalidate_by_tag", tracer, originals.invalidateByTag);
-  cache.invalidateByTags = instrument("layercache.invalidate_by_tags", tracer, originals.invalidateByTags);
-  cache.invalidateByPattern = instrument("layercache.invalidate_by_pattern", tracer, originals.invalidateByPattern);
-  cache.invalidateByPrefix = instrument("layercache.invalidate_by_prefix", tracer, originals.invalidateByPrefix);
-  return {
-    uninstall() {
-      cache.get = originals.get;
-      cache.set = originals.set;
-      cache.delete = originals.delete;
-      cache.mget = originals.mget;
-      cache.mset = originals.mset;
-      cache.invalidateByTag = originals.invalidateByTag;
-      cache.invalidateByTags = originals.invalidateByTags;
-      cache.invalidateByPattern = originals.invalidateByPattern;
-      cache.invalidateByPrefix = originals.invalidateByPrefix;
+  const spans = /* @__PURE__ */ new Map();
+  const onStart = (event) => {
+    try {
+      if (spans.size >= MAX_SPANS) {
+        const oldest = spans.keys().next().value;
+        if (oldest !== void 0) {
+          spans.get(oldest)?.end();
+          spans.delete(oldest);
+        }
+      }
+      spans.set(event.id, tracer.startSpan(event.name, { attributes: event.attributes }));
+    } catch {
     }
   };
-}
-function instrument(name, tracer, method, attributes) {
-  return (async (...args) => {
-    const span = tracer.startSpan(name, { attributes: attributes?.(args) });
+  const onEnd = (event) => {
+    const span = spans.get(event.id);
+    if (!span) {
+      return;
+    }
+    spans.delete(event.id);
     try {
-      const result = await method(...args);
-      span.setAttribute?.("layercache.success", true);
-      if (result === null) {
-        span.setAttribute?.("layercache.result", "null");
+      span.setAttribute?.("layercache.success", event.success);
+      if (event.result) {
+        span.setAttribute?.("layercache.result", event.result);
       }
-      return result;
-    } catch (error) {
-      span.setAttribute?.("layercache.success", false);
-      span.recordException?.(error);
-      throw error;
-    } finally {
-      span.end();
+      if (event.error !== void 0) {
+        span.recordException?.(event.error);
+      }
+    } catch {
     }
-  });
+    span.end();
+  };
+  cache.on("operation-start", onStart);
+  cache.on("operation-end", onEnd);
+  return {
+    uninstall() {
+      cache.off("operation-start", onStart);
+      cache.off("operation-end", onEnd);
+      for (const span of spans.values()) {
+        span.end();
+      }
+      spans.clear();
+    }
+  };
 }
 
 // src/integrations/trpc.ts
@@ -3589,8 +3796,8 @@ var RedisLayer = class {
 };
 
 // src/layers/DiskLayer.ts
-import { createHash } from "crypto";
-import { promises as fs } from "fs";
+import { createHash, randomBytes as randomBytes2 } from "crypto";
+import { promises as fs2 } from "fs";
 import { join, resolve } from "path";
 var FILE_SCAN_CONCURRENCY = 32;
 var DiskLayer = class {
@@ -3634,7 +3841,7 @@ var DiskLayer = class {
   }
   async set(key, value, ttl = this.defaultTtl) {
     await this.enqueueWrite(async () => {
-      await fs.mkdir(this.directory, { recursive: true });
+      await fs2.mkdir(this.directory, { recursive: true });
       const entry = {
         key,
         value,
@@ -3642,10 +3849,10 @@ var DiskLayer = class {
       };
       const payload = this.serializer.serialize(entry);
       const targetPath = this.keyToPath(key);
-      const tempPath = `${targetPath}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2)}.tmp`;
+      const tempPath = `${targetPath}.${process.pid}.${Date.now()}.${randomBytes2(8).toString("hex")}.tmp`;
       try {
-        await fs.writeFile(tempPath, payload);
-        await fs.rename(tempPath, targetPath);
+        await fs2.writeFile(tempPath, payload);
+        await fs2.rename(tempPath, targetPath);
       } catch (error) {
         await this.safeDelete(tempPath);
         throw error;
@@ -3699,7 +3906,7 @@ var DiskLayer = class {
     await this.enqueueWrite(async () => {
       let entries;
       try {
-        entries = await fs.readdir(this.directory);
+        entries = await fs2.readdir(this.directory);
       } catch {
         return;
       }
@@ -3733,7 +3940,7 @@ var DiskLayer = class {
   }
   async ping() {
     try {
-      await fs.mkdir(this.directory, { recursive: true });
+      await fs2.mkdir(this.directory, { recursive: true });
       return true;
     } catch {
       return false;
@@ -3776,7 +3983,7 @@ var DiskLayer = class {
   async readEntryFile(filePath) {
     let handle;
     try {
-      handle = await fs.open(filePath, "r");
+      handle = await fs2.open(filePath, "r");
       return await this.readHandleWithLimit(handle);
     } catch {
       await this.safeDelete(filePath);
@@ -3816,7 +4023,7 @@ var DiskLayer = class {
   async scanEntries(visitor) {
     let entries;
     try {
-      entries = await fs.readdir(this.directory);
+      entries = await fs2.readdir(this.directory);
     } catch {
       return;
     }
@@ -3879,7 +4086,7 @@ var DiskLayer = class {
   }
   async safeDelete(filePath) {
     try {
-      await fs.unlink(filePath);
+      await fs2.unlink(filePath);
     } catch {
     }
   }
@@ -3897,7 +4104,7 @@ var DiskLayer = class {
     }
     let entries;
     try {
-      entries = await fs.readdir(this.directory);
+      entries = await fs2.readdir(this.directory);
     } catch {
       return;
     }
@@ -3909,7 +4116,7 @@ var DiskLayer = class {
       lcFiles.map(async (name) => {
         const filePath = join(this.directory, name);
         try {
-          const stat = await fs.stat(filePath);
+          const stat = await fs2.stat(filePath);
           return { filePath, mtimeMs: stat.mtimeMs };
         } catch {
           return { filePath, mtimeMs: 0 };
@@ -4005,44 +4212,19 @@ var MemcachedLayer = class {
 
 // src/serialization/MsgpackSerializer.ts
 import { decode, encode } from "@msgpack/msgpack";
-var DANGEROUS_KEYS2 = /* @__PURE__ */ new Set(["__proto__", "prototype", "constructor"]);
-var MAX_SANITIZE_DEPTH3 = 64;
-var MAX_SANITIZE_NODES3 = 1e4;
 var MsgpackSerializer = class {
   serialize(value) {
     return Buffer.from(encode(value));
   }
   deserialize(payload) {
     const normalized = Buffer.isBuffer(payload) ? payload : Buffer.from(payload, "latin1");
-    return sanitizeMsgpackValue(decode(normalized), 0, { count: 0 });
+    return sanitizeStructuredData(decode(normalized), {
+      label: "MessagePack payload",
+      maxDepth: 64,
+      maxNodes: 1e4
+    });
   }
 };
-function sanitizeMsgpackValue(value, depth, state) {
-  state.count += 1;
-  if (state.count > MAX_SANITIZE_NODES3) {
-    throw new Error(`MessagePack payload exceeds max node count of ${MAX_SANITIZE_NODES3}.`);
-  }
-  if (depth > MAX_SANITIZE_DEPTH3) {
-    throw new Error(`MessagePack payload exceeds max depth of ${MAX_SANITIZE_DEPTH3}.`);
-  }
-  if (Array.isArray(value)) {
-    return value.map((entry) => sanitizeMsgpackValue(entry, depth + 1, state));
-  }
-  if (!isPlainObject2(value)) {
-    return value;
-  }
-  const sanitized = {};
-  for (const [key, entry] of Object.entries(value)) {
-    if (DANGEROUS_KEYS2.has(key)) {
-      continue;
-    }
-    sanitized[key] = sanitizeMsgpackValue(entry, depth + 1, state);
-  }
-  return sanitized;
-}
-function isPlainObject2(value) {
-  return Object.prototype.toString.call(value) === "[object Object]";
-}
 
 // src/singleflight/RedisSingleFlightCoordinator.ts
 import { randomUUID } from "crypto";