orez-lite 0.13.0 → 0.13.1

package/dist/cf-do/worker.js

@@ -18,6 +18,7 @@ const SCHEMA_PROVISIONING_WAIT_MS = 20_000;
 const SCHEMA_PROVISIONING_MAX_DELAY_MS = 500;
 const APPLICATION_SQL_TURN_WAIT_MS = 30_000;
 const WRITE_GRANT_WAIT_SAMPLE_CAPACITY = 4_096;
+const DEFAULT_SQL_TELEMETRY_SAMPLE_RATE = 0.01;
 const DEFAULT_SNAPSHOT_PAGE_ROWS = 2_000;
 const MAX_SNAPSHOT_PAGE_ROWS = 10_000;
 const TRANSACTION_CONTROL_SQL = /^\s*(?:BEGIN|COMMIT|ROLLBACK|SAVEPOINT|RELEASE)(?=\s|;|$)/i;
@@ -61,6 +62,12 @@ function positiveEnvInteger(value, fallback) {
     const parsed = Number(value);
     return Number.isSafeInteger(parsed) && parsed > 0 ? parsed : fallback;
 }
+function probabilityEnv(value, fallback) {
+    if (value === undefined)
+        return fallback;
+    const parsed = Number(value);
+    return Number.isFinite(parsed) && parsed >= 0 && parsed <= 1 ? parsed : fallback;
+}
 function quoteIdent(name) {
     return `"${name.replace(/"/g, '""')}"`;
 }
@@ -137,14 +144,17 @@ class ApplicationSqlSessionTarget extends RpcTarget {
     sessionID;
     readOnly;
     priority;
+    telemetry;
     state = 'created';
     mutated = false;
-    constructor(owner, sessionID, readOnly, priority) {
+    telemetryFinished = false;
+    constructor(owner, sessionID, readOnly, priority, telemetry) {
         super();
         this.owner = owner;
         this.sessionID = sessionID;
         this.readOnly = readOnly;
         this.priority = priority;
+        this.telemetry = telemetry;
     }
     begin() {
         return this.owner[APPLICATION_SQL_ACQUIRE](this);
@@ -182,6 +192,7 @@ export class ZeroDO extends DurableObject {
         sqlStatements: 0,
     };
     sqlBillingSinceBoot = { rowsRead: 0, rowsWritten: 0 };
+    sqlTelemetrySampleRate;
     writeGrantWaitMs = new RecentLatencySamples(WRITE_GRANT_WAIT_SAMPLE_CAPACITY);
     sql;
     watermarks;
@@ -205,6 +216,56 @@ export class ZeroDO extends DurableObject {
             objectName: typeof this.ctx.id.name === 'string' ? this.ctx.id.name : null,
         };
     }
+    startSqlTelemetrySample() {
+        if (this.sqlTelemetrySampleRate <= 0 ||
+            (this.sqlTelemetrySampleRate < 1 && Math.random() >= this.sqlTelemetrySampleRate)) {
+            return null;
+        }
+        return {
+            startedAt: performance.now(),
+            admittedAt: null,
+            rowsReturned: 0,
+            rowsChanged: 0,
+            statements: 0,
+        };
+    }
+    recordSqlTelemetry(sample, result) {
+        sample.rowsReturned += result.rows.length;
+        sample.rowsChanged += result.changes;
+    }
+    emitSqlTelemetry(event, name, outcome, sample, error) {
+        if (!sample)
+            return;
+        try {
+            console.log(JSON.stringify({
+                event,
+                name: name.slice(0, 200),
+                outcome,
+                durationMs: Math.round((performance.now() - sample.startedAt) * 1_000) / 1_000,
+                ...(sample.admittedAt === null
+                    ? null
+                    : {
+                        queueMs: Math.round((sample.admittedAt - sample.startedAt) * 1_000) / 1_000,
+                    }),
+                rowsReturned: sample.rowsReturned,
+                rowsChanged: sample.rowsChanged,
+                statements: sample.statements,
+                sampleRate: this.sqlTelemetrySampleRate,
+                ...(error
+                    ? {
+                        errorName: (error instanceof Error ? error.name : typeof error).slice(0, 100),
+                    }
+                    : null),
+            }));
+        }
+        catch { }
+    }
+    finishApplicationSqlTelemetry(session, outcome, error) {
+        if (session.telemetryFinished)
+            return;
+        session.telemetryFinished = true;
+        this.emitSqlTelemetry('orez_sql_transaction_sample', session.readOnly ? 'application_sql_read' : 'application_sql_write', outcome, session.telemetry, error);
+    }
     recordWriteBudgetRows(rows, statement) {
         const wasTripped = this.writeBudget.status().tripped;
         try {
@@ -291,6 +352,7 @@ export class ZeroDO extends DurableObject {
         this.sql = ctx.storage.sql;
         this.writeBudgetDisabled = /^(?:1|true)$/i.test(env.OREZ_DO_WRITE_BUDGET_DISABLED ?? '');
         this.writeBudgetAdminToken = env.OREZ_DO_WRITE_BUDGET_ADMIN_TOKEN;
+        this.sqlTelemetrySampleRate = probabilityEnv(env.OREZ_SQL_TELEMETRY_SAMPLE_RATE, DEFAULT_SQL_TELEMETRY_SAMPLE_RATE);
         this.writeBudget = new RollingRowWriteBudget({
             budgetRows: positiveEnvInteger(env.OREZ_DO_WRITE_BUDGET_ROWS, DEFAULT_WRITE_BUDGET_ROWS),
             windowMs: positiveEnvInteger(env.OREZ_DO_WRITE_BUDGET_WINDOW_MS, DEFAULT_WRITE_BUDGET_WINDOW_MS),
@@ -339,6 +401,10 @@ export class ZeroDO extends DurableObject {
             });
             if (recovered.length)
                 this.invalidateSchemaCaches();
+            // after recovery, which may still restore journal rows or re-create the
+            // residual triggers from a pre-cleanup schema snapshot, and before the
+            // trip restore, so the one-time drops run against a fresh write budget.
+            this.dropZeroHttpJournalResidue();
             if (!this.writeBudgetDisabled) {
                 const persisted = await ctx.storage.get(WRITE_BUDGET_TRIPPED_KEY);
                 if (persisted) {
@@ -349,6 +415,66 @@ export class ZeroDO extends DurableObject {
             }
         });
     }
+    /**
+     * Drop what the retired zero-http full-projection engine left in this
+     * database. That engine's mount installed `_zsync_tr_<table>_{i,u,d}` AFTER
+     * triggers on every synced table, appending a change envelope to
+     * `_zsync_changes` per write plus a `_zsync_meta` marker row per UPDATE. The
+     * engine was deleted on 2026-07-29, its drop logic with it, and nothing has
+     * read either table since the packed ledger replaced that pull path. The
+     * triggers stayed installed, though, so every synced write on a namespace
+     * mounted before the deletion still paid one or two billable journal rows
+     * forever (86,082 rows and ~2,600/day measured on the largest production
+     * namespace).
+     *
+     * Order matters for crash safety, and every step is idempotent:
+     *
+     * 1. preserve the journal's high watermark in `_zsync_watermark`, which
+     *    `initializePackedLedger` already consults, so a namespace whose packed
+     *    ledger has not initialized yet still seeds above every cookie it ever
+     *    issued after the journal is gone;
+     * 2. drop every trigger whose body references `_zsync_changes`; `_zsync_*`
+     *    is orez's reserved namespace, so no application trigger can
+     *    legitimately write it;
+     * 3. drop both tables and the journal's rollback-capture registration.
+     *
+     * Steady state costs one sqlite_master read per boot.
+     */
+    dropZeroHttpJournalResidue() {
+        const residue = this.sql
+            .exec('SELECT name, type FROM sqlite_master ' +
+            "WHERE (type = 'trigger' AND sql LIKE '%\\_zsync\\_changes%' ESCAPE '\\') " +
+            `OR (type = 'table' AND name IN ('${ZSYNC_CHANGES_TABLE}', '_zsync_meta'))`)
+            .toArray()
+            .map((row) => ({ name: String(row.name), type: String(row.type) }));
+        if (residue.length === 0)
+            return;
+        if (residue.some((row) => row.type === 'table' && row.name === ZSYNC_CHANGES_TABLE)) {
+            const high = Number(this.sql
+                .exec(`SELECT COALESCE(MAX(watermark), 0) AS high FROM ${quoteIdent(ZSYNC_CHANGES_TABLE)}`)
+                .toArray()[0]?.high ?? 0);
+            if (high > 0) {
+                this.sql.exec('CREATE TABLE IF NOT EXISTS _zsync_watermark (' +
+                    'lock INTEGER PRIMARY KEY CHECK (lock = 1), high INTEGER NOT NULL)');
+                this.sql.exec('INSERT INTO _zsync_watermark (lock, high) VALUES (1, ?) ' +
+                    'ON CONFLICT (lock) DO UPDATE SET high = MAX(high, excluded.high)', high);
+            }
+        }
+        for (const row of residue) {
+            if (row.type === 'trigger') {
+                this.sql.exec(`DROP TRIGGER IF EXISTS ${quoteIdent(row.name)}`);
+            }
+        }
+        this.sql.exec(`DROP TABLE IF EXISTS ${quoteIdent(ZSYNC_CHANGES_TABLE)}`);
+        this.sql.exec('DROP TABLE IF EXISTS _zsync_meta');
+        const cdcRegistry = this.sql
+            .exec("SELECT 1 AS ok FROM sqlite_master WHERE type = 'table' AND name = '_orez_cdc_tables' LIMIT 1")
+            .toArray();
+        if (cdcRegistry.length > 0) {
+            this.sql.exec('DELETE FROM _orez_cdc_tables WHERE physical_table = ?', ZSYNC_CHANGES_TABLE);
+            this.cdc.reload();
+        }
+    }
     async fetch(request) {
         this.requestsSinceBoot.fetch++;
         const url = new URL(request.url);
@@ -1138,6 +1264,9 @@ export class ZeroDO extends DurableObject {
             this.applicationSqlQueue.shift();
             clearTimeout(waiter.timer);
             waiter.session.state = 'active';
+            if (waiter.session.telemetry) {
+                waiter.session.telemetry.admittedAt = performance.now();
+            }
             if (waiter.session.readOnly)
                 this.applicationSqlReaders.add(waiter.session);
             else {
@@ -1326,7 +1455,7 @@ export class ZeroDO extends DurableObject {
             this.requestsSinceBoot.applicationSqlReadSessions++;
         else
             this.requestsSinceBoot.applicationSqlWriteSessions++;
-        return new ApplicationSqlSessionTarget(this, sessionID, options.readOnly === true, priority);
+        return new ApplicationSqlSessionTarget(this, sessionID, options.readOnly === true, priority, this.startSqlTelemetrySample());
     }
     /**
      * Run one read statement end to end in a single round trip.
@@ -1385,7 +1514,7 @@ export class ZeroDO extends DurableObject {
             if (this.prepareApplicationSqlMutation(session.sessionID, sql)) {
                 session.mutated = true;
             }
-            return this.executeSQL(sql, [...params], undefined, session.sessionID).rows;
+            return this.executeSQL(sql, [...params], undefined, session.sessionID, session.telemetry).rows;
         });
     }
     async [APPLICATION_SQL_EXEC](session, sql, params = [], metadata) {
@@ -1394,16 +1523,26 @@ export class ZeroDO extends DurableObject {
             if (this.prepareApplicationSqlMutation(session.sessionID, sql)) {
                 session.mutated = true;
             }
-            const result = this.executeSQL(sql, [...params], applicationSqlTrack(metadata), session.sessionID);
+            const result = this.executeSQL(sql, [...params], applicationSqlTrack(metadata), session.sessionID, session.telemetry);
             return { changes: result.changes };
         });
     }
     async [APPLICATION_SQL_QUERY_PLAN](session, plan, queryName, queryBudget) {
         this.assertApplicationSqlSession(session);
-        return this.atomically(() => executeTransactionQueryPlan(plan, (sql, params) => {
-            this.assertApplicationSqlStatement(session, sql);
-            return this.executeSQL(sql, params, undefined, session.sessionID).rows;
-        }, { queryName, budget: queryBudget }));
+        const sample = this.startSqlTelemetrySample();
+        const name = queryName?.trim() || `${plan.rootTable}:${plan.planHash}`;
+        try {
+            const result = await this.atomically(() => executeTransactionQueryPlan(plan, (sql, params) => {
+                this.assertApplicationSqlStatement(session, sql);
+                return this.executeSQL(sql, params, undefined, session.sessionID, session.telemetry, sample).rows;
+            }, { queryName, budget: queryBudget }));
+            this.emitSqlTelemetry('orez_sql_query_sample', name, 'success', sample);
+            return result;
+        }
+        catch (error) {
+            this.emitSqlTelemetry('orez_sql_query_sample', name, 'error', sample, error);
+            throw error;
+        }
     }
     async [APPLICATION_SQL_REGISTER_TABLES](session, tables) {
         this.assertApplicationSqlSession(session);
@@ -1424,10 +1563,21 @@ export class ZeroDO extends DurableObject {
                 });
             }
         }
+        catch (error) {
+            this.finishApplicationSqlTelemetry(session, 'error', error);
+            throw error;
+        }
         finally {
             this.releaseApplicationSqlTurn(session);
         }
-        this.applicationSqlDidCommit(published, session.mutated);
+        try {
+            this.applicationSqlDidCommit(published, session.mutated);
+            this.finishApplicationSqlTelemetry(session, 'committed');
+        }
+        catch (error) {
+            this.finishApplicationSqlTelemetry(session, 'error', error);
+            throw error;
+        }
     }
     /**
      * Undo whatever this session wrote and hand its turn on.
@@ -1454,10 +1604,24 @@ export class ZeroDO extends DurableObject {
         this.releaseApplicationSqlTurn(session);
     }
     async [APPLICATION_SQL_ROLLBACK](session) {
-        this.closeApplicationSqlSession(session);
+        try {
+            this.closeApplicationSqlSession(session);
+            this.finishApplicationSqlTelemetry(session, 'rolled_back');
+        }
+        catch (error) {
+            this.finishApplicationSqlTelemetry(session, 'error', error);
+            throw error;
+        }
     }
     [APPLICATION_SQL_DISPOSE](session) {
-        this.closeApplicationSqlSession(session);
+        try {
+            this.closeApplicationSqlSession(session);
+            this.finishApplicationSqlTelemetry(session, 'rolled_back');
+        }
+        catch (error) {
+            this.finishApplicationSqlTelemetry(session, 'error', error);
+            throw error;
+        }
     }
     atomicallySync(work) {
         try {
@@ -1541,7 +1705,12 @@ export class ZeroDO extends DurableObject {
             return false;
         }
     }
-    executeSQL(sql, params = [], track, transactionID) {
+    executeSQL(sql, params = [], track, transactionID, transactionTelemetry = null, queryTelemetry = null) {
+        if (transactionTelemetry)
+            transactionTelemetry.statements++;
+        if (queryTelemetry && queryTelemetry !== transactionTelemetry) {
+            queryTelemetry.statements++;
+        }
         let capturesTrackedTable = false;
         if (track?.physicalTableName) {
             capturesTrackedTable = this.cdc.ensureTable({
@@ -1579,16 +1748,6 @@ export class ZeroDO extends DurableObject {
         }
         if (track && trackedTransactionID) {
             const physicalTableName = track.physicalTableName || stripPublicPrefix(track.tableName);
-            // the `_zsync_changes` journal is the one side-effect target orez owns,
-            // so this path may register it directly: its identity is fixed and it
-            // never publishes. registering it before the DML that fires the trigger,
-            // in the same storage transaction, keeps the ordering safe. otherwise
-            // `coversRowUndo` says no and the journal is snapshotted as before.
-            this.cdc.ensureTable({
-                physicalTableName: ZSYNC_CHANGES_TABLE,
-                tableName: ZSYNC_CHANGES_TABLE,
-                publish: false,
-            });
             for (const table of snapshotSideEffectWriteTables(this.sql, trackedTransactionID, physicalTableName, track.operation, (table) => this.cdc.coversRowUndo(table))) {
                 snapshotted.add(table);
             }
@@ -1657,16 +1816,22 @@ export class ZeroDO extends DurableObject {
                 this.appendDerivedTrackedChanges(track, rows);
         }
         const publishedCaptured = captured.filter((change) => change.publish !== false).length;
-        if (!track)
-            return { rows, columns, changes, capturedChanges: publishedCaptured };
-        return {
-            rows: track.returnRows ? rows : [],
-            columns: track.returnRows ? columns : [],
-            changes,
-            affectedRows: rows.length,
-            capturedChanges: publishedCaptured ||
-                (capturesTrackedTable || track.publish === false ? 0 : rows.length),
-        };
+        const result = !track
+            ? { rows, columns, changes, capturedChanges: publishedCaptured }
+            : {
+                rows: track.returnRows ? rows : [],
+                columns: track.returnRows ? columns : [],
+                changes,
+                affectedRows: rows.length,
+                capturedChanges: publishedCaptured ||
+                    (capturesTrackedTable || track.publish === false ? 0 : rows.length),
+            };
+        if (transactionTelemetry)
+            this.recordSqlTelemetry(transactionTelemetry, result);
+        if (queryTelemetry && queryTelemetry !== transactionTelemetry) {
+            this.recordSqlTelemetry(queryTelemetry, result);
+        }
+        return result;
     }
     cursorRows(cursor, columns) {
         const cols = Array.isArray(columns) && columns.length > 0 ? columns : null;