watch-tail 0.4.0 → 0.6.0

package/build/server/chunks/chunks/archive.js-C2D-5edp.js

@@ -0,0 +1,823 @@
+import { d as detectRequestId, a as detectLevelWithSource, i as isLogLevel, L as LEVEL_RANK } from './log-buffer.js-BI_gQOls.js';
+import { mkdirSync, statSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join, dirname } from 'node:path';
+import { setTimeout } from 'node:timers/promises';
+import { createHash } from 'node:crypto';
+
+//#region src/lib/server/archive-sql.ts
+/**
+* SQL and row mapping for the local DuckDB archive.
+*
+* DuckDB is a native dependency and is loaded lazily by `archive.ts`; everything
+* in this file is plain text and pure functions so the archive can be unit
+* tested without the driver. Column order matters: {@link ARCHIVE_INSERT_COLUMNS}
+* is the contract with {@link toArchiveParams}, and the `SELECT` in
+* {@link buildPageQuery} uses the same names as {@link rowsToPage}.
+*
+* `level` and `request_id` are both derived from the message on the way in, and
+* both may be NULL in an archive written by an older build. NULL does not mean
+* the same thing for the two columns: for `level` it is a verdict ("this line
+* carries no level"), while for `request_id` it means "not looked at yet", since
+* the client can still detect an id in the message it renders. {@link rowsToPage}
+* and the request-id backfill below are written from that difference.
+*/
+/**
+* Statements that bring a database file up to the current schema.
+*
+* Every statement is idempotent so an existing archive can be opened by a newer
+* build without a migration step. `seq` orders events by arrival, which keeps
+* paging stable when many events share a millisecond timestamp.
+*/
+var ARCHIVE_SCHEMA = [
+	`CREATE SEQUENCE IF NOT EXISTS log_events_seq`,
+	`CREATE TABLE IF NOT EXISTS log_events (
+		region VARCHAR NOT NULL,
+		log_group VARCHAR NOT NULL,
+		log_stream VARCHAR,
+		event_key VARCHAR NOT NULL,
+		event_id VARCHAR,
+		timestamp_ms BIGINT NOT NULL,
+		ingestion_time_ms BIGINT,
+		message VARCHAR NOT NULL,
+		level VARCHAR,
+		level_source VARCHAR,
+		request_id VARCHAR,
+		seq BIGINT NOT NULL DEFAULT nextval('log_events_seq'),
+		archived_at TIMESTAMP NOT NULL DEFAULT now()
+	)`,
+	`ALTER TABLE log_events ADD COLUMN IF NOT EXISTS level VARCHAR`,
+	`ALTER TABLE log_events ADD COLUMN IF NOT EXISTS level_source VARCHAR`,
+	`ALTER TABLE log_events ADD COLUMN IF NOT EXISTS request_id VARCHAR`,
+	`CREATE TABLE IF NOT EXISTS archive_meta (key VARCHAR PRIMARY KEY, value VARCHAR)`,
+	`CREATE UNIQUE INDEX IF NOT EXISTS log_events_unique ON log_events (region, log_group, event_key)`,
+	`CREATE INDEX IF NOT EXISTS log_events_time ON log_events (region, log_group, timestamp_ms)`
+];
+/** Columns written by {@link buildInsertSql}, in binding order. */
+var ARCHIVE_INSERT_COLUMNS = [
+	"region",
+	"log_group",
+	"log_stream",
+	"event_key",
+	"event_id",
+	"timestamp_ms",
+	"ingestion_time_ms",
+	"message",
+	"level",
+	"level_source",
+	"request_id"
+];
+/** Escape character used with `LIKE`/`ILIKE` so user input cannot inject wildcards. */
+var LIKE_ESCAPE = "\\";
+/**
+* Stable identity of an event inside one log group.
+*
+* CloudWatch event ids are unique per log group and are reused as the key;
+* events without an id (floci and LocalStack omit them) get a deterministic
+* hash of timestamp, stream and message, so re-scanning the same window is
+* idempotent instead of duplicating rows.
+*/
+function archiveEventKey(event) {
+	if (event.id !== null && event.id.length > 0) return event.id;
+	return `h:${createHash("sha256").update(`${event.timestamp}\u0000${event.streamName ?? ""}\u0000${event.message}`).digest("hex").slice(0, 32)}`;
+}
+/** Renders `count` placeholder rows, one group of columns per row. */
+function placeholderRows(count) {
+	const row = `(${ARCHIVE_INSERT_COLUMNS.map(() => "?").join(", ")})`;
+	return Array.from({ length: count }, () => row).join(", ");
+}
+/**
+* Builds a multi-row `INSERT OR IGNORE`, so events already archived are skipped
+* by the unique index instead of raising.
+*/
+function buildInsertSql(rowCount) {
+	if (!Number.isInteger(rowCount) || rowCount < 1) throw new RangeError(`rowCount must be a positive integer, received ${String(rowCount)}`);
+	return `INSERT OR IGNORE INTO log_events (${ARCHIVE_INSERT_COLUMNS.join(", ")}) VALUES ${placeholderRows(rowCount)}`;
+}
+/**
+* Flattens events into the parameter list {@link buildInsertSql} expects.
+*
+* The request id is detected here, exactly like the level, so the archive holds
+* what a reader of the line would see rather than whatever a writer claimed.
+*/
+function toArchiveParams(region, logGroup, events) {
+	const params = [];
+	for (const event of events) {
+		const detected = detectLevelWithSource(event.message);
+		params.push(region, logGroup, event.streamName ?? null, archiveEventKey(event), event.id ?? null, BigInt(Math.round(event.timestamp)), event.ingestionTime === void 0 ? null : BigInt(Math.round(event.ingestionTime)), event.message, detected.level, detected.source, detectRequestId(event.message));
+	}
+	return params;
+}
+/** Column list shared by {@link buildPageQuery} and {@link rowsToPage}. */
+var PAGE_COLUMNS = `region, log_group, log_stream, event_key, event_id, timestamp_ms, ingestion_time_ms, message, level, level_source, request_id, seq`;
+/** Escapes `LIKE` metacharacters so a search term is matched literally. */
+function escapeLike(value) {
+	return value.replace(/[\\%_]/g, (match) => `${LIKE_ESCAPE}${match}`);
+}
+/**
+* Builds one keyset page of archived events.
+*
+* Ordering is `(timestamp_ms, seq)`, and the cursor compares the same tuple, so
+* pages never repeat or skip a row even when thousands of events share a
+* timestamp.
+*/
+function buildPageQuery(request) {
+	const limit = Math.max(1, Math.round(request.limit));
+	const groups = request.logGroups.length > 0 ? request.logGroups : [""];
+	const where = [
+		"region = ?",
+		`log_group IN (${groups.map(() => "?").join(", ")})`,
+		"timestamp_ms >= ?",
+		"timestamp_ms <= ?"
+	];
+	const params = [
+		request.region,
+		...groups,
+		BigInt(Math.round(request.startTime)),
+		BigInt(Math.round(request.endTime))
+	];
+	const search = request.search?.trim() ?? "";
+	if (search.length > 0) {
+		where.push(`message ILIKE ? ESCAPE '${LIKE_ESCAPE}'`);
+		params.push(`%${escapeLike(search)}%`);
+	}
+	const prefix = request.streamPrefix?.trim() ?? "";
+	if (prefix.length > 0) {
+		where.push(`log_stream LIKE ? ESCAPE '${LIKE_ESCAPE}'`);
+		params.push(`${escapeLike(prefix)}%`);
+	}
+	const levels = request.levels ?? [];
+	if (levels.length > 0) {
+		where.push(`level IN (${levels.map(() => "?").join(", ")})`);
+		params.push(...levels);
+	}
+	const after = request.after ?? null;
+	if (after !== null) {
+		where.push("(timestamp_ms > ? OR (timestamp_ms = ? AND seq > ?))");
+		params.push(BigInt(Math.round(after.timestamp)), BigInt(Math.round(after.timestamp)), BigInt(Math.round(after.seq)));
+	}
+	params.push(BigInt(limit));
+	return {
+		sql: `SELECT ${PAGE_COLUMNS} FROM log_events WHERE ${where.join(" AND ")} ORDER BY timestamp_ms, seq LIMIT ?`,
+		params
+	};
+}
+/** Converts a DuckDB value (which may be a bigint) into a JS number. */
+function toNumber(value) {
+	if (typeof value === "number") return Number.isFinite(value) ? value : null;
+	if (typeof value === "bigint") return Number(value);
+	if (typeof value === "string" && value.trim().length > 0) {
+		const parsed = Number(value);
+		return Number.isFinite(parsed) ? parsed : null;
+	}
+	return null;
+}
+/** Converts a nullable DuckDB string column into `string` or `null`. */
+function toNullableString(value) {
+	if (typeof value === "string") return value.length > 0 ? value : null;
+	return null;
+}
+/** Reads one column from a row object, tolerating case differences. */
+function pick(row, column) {
+	if (column in row) return row[column];
+	const upper = column.toUpperCase();
+	if (upper in row) return row[upper];
+}
+/**
+* Maps query rows onto wire events plus the cursor of the last row.
+*
+* Rows without a usable timestamp are dropped rather than rendered as 1970.
+*/
+function rowsToPage(rows) {
+	const events = [];
+	let last = null;
+	for (const row of rows) {
+		const timestamp = toNumber(pick(row, "timestamp_ms"));
+		const seq = toNumber(pick(row, "seq"));
+		if (timestamp === null || seq === null) continue;
+		const rawLevel = pick(row, "level");
+		const group = toNullableString(pick(row, "log_group"));
+		const event = {
+			id: toNullableString(pick(row, "event_key")),
+			timestamp,
+			message: typeof pick(row, "message") === "string" ? pick(row, "message") : "",
+			level: isLogLevel(rawLevel) ? rawLevel : null
+		};
+		if (group !== null) event.group = group;
+		const requestId = toNullableString(pick(row, "request_id"));
+		if (requestId !== null) event.requestId = requestId;
+		const streamName = toNullableString(pick(row, "log_stream"));
+		if (streamName !== null) event.streamName = streamName;
+		const ingestionTime = toNumber(pick(row, "ingestion_time_ms"));
+		if (ingestionTime !== null) event.ingestionTime = ingestionTime;
+		events.push(event);
+		last = {
+			timestamp,
+			seq
+		};
+	}
+	return {
+		events,
+		last
+	};
+}
+/** Aggregate query behind {@link ArchiveTotals}. */
+var ARCHIVE_TOTALS_SQL = `SELECT count(*) AS rows, count(DISTINCT log_group) AS groups, count(DISTINCT region) AS regions, min(timestamp_ms) AS oldest, max(timestamp_ms) AS newest FROM log_events`;
+/** Log groups held by the archive, optionally limited to one region. */
+function buildGroupsQuery(region) {
+	const where = region === null || region.length === 0 ? "" : "WHERE region = ?";
+	return {
+		sql: `SELECT region, log_group, count(*) AS events, min(timestamp_ms) AS oldest, max(timestamp_ms) AS newest FROM log_events ${where} GROUP BY region, log_group ORDER BY region, log_group`,
+		params: where === "" ? [] : [region]
+	};
+}
+/** Maps the single row of {@link ARCHIVE_TOTALS_SQL}. */
+function rowToTotals(row) {
+	if (row === void 0) return {
+		rows: 0,
+		groups: 0,
+		regions: 0,
+		oldest: null,
+		newest: null
+	};
+	return {
+		rows: toNumber(pick(row, "rows")) ?? 0,
+		groups: toNumber(pick(row, "groups")) ?? 0,
+		regions: toNumber(pick(row, "regions")) ?? 0,
+		oldest: toNumber(pick(row, "oldest")),
+		newest: toNumber(pick(row, "newest"))
+	};
+}
+/** Maps the rows of {@link buildGroupsQuery}. */
+function rowsToGroups(rows) {
+	const groups = [];
+	for (const row of rows) {
+		const region = pick(row, "region");
+		const logGroup = pick(row, "log_group");
+		if (typeof region !== "string" || typeof logGroup !== "string") continue;
+		groups.push({
+			region,
+			logGroup,
+			events: toNumber(pick(row, "events")) ?? 0,
+			oldest: toNumber(pick(row, "oldest")),
+			newest: toNumber(pick(row, "newest"))
+		});
+	}
+	return groups;
+}
+/**
+* Row budget of one request-id backfill pass.
+*
+* The pass runs on every open, so it has to stay cheap. 20000 messages is a
+* fraction of a second of regex work, and an archive with more than that scans
+* the rest on the next open, because the watermark moves.
+*/
+var REQUEST_ID_BACKFILL_LIMIT = 2e4;
+/** `archive_meta` key holding the request-id backfill watermark. */
+var REQUEST_ID_BACKFILL_KEY = "request_id_backfill";
+/** Highest `seq` in the archive: the ceiling of a backfill pass. */
+var ARCHIVE_MAX_SEQ_SQL = `SELECT max(seq) AS maxSeq FROM log_events`;
+/** Reads the single row of {@link ARCHIVE_MAX_SEQ_SQL}; `null` for an empty archive. */
+function rowToMaxSeq(row) {
+	return row === void 0 ? null : toNumber(pick(row, "maxSeq"));
+}
+/** Statement that reads the backfill watermark; no row means it never ran. */
+function buildRequestIdBackfillStateQuery() {
+	return `SELECT value FROM archive_meta WHERE key = '${REQUEST_ID_BACKFILL_KEY}'`;
+}
+/** Statement that stores the backfill watermark, which is the highest scanned `seq`. */
+function buildRequestIdBackfillStateWrite() {
+	return `INSERT OR REPLACE INTO archive_meta (key, value) VALUES ('${REQUEST_ID_BACKFILL_KEY}', ?)`;
+}
+/** Reads the watermark row; an absent row or junk means "scan from the start". */
+function rowToBackfillWatermark(row) {
+	const value = row === void 0 ? null : toNumber(pick(row, "value"));
+	return value === null || value < 0 ? null : value;
+}
+/**
+* Builds the scan that finds rows archived before `request_id` existed.
+*
+* `seq` is selected although the update does not need it: the caller stores
+* where the pass stopped. `afterSeq` skips the range a previous pass already
+* looked at, which is what lets a capped pass resume - a message with no request
+* id stays NULL for ever, so without the lower bound every pass would start on
+* the same id-less rows and never reach the rows above them.
+*/
+function buildRequestIdBackfillQuery(request) {
+	const limit = Math.max(1, Math.round(request.limit));
+	const scanned = request.afterSeq ?? 0;
+	const after = scanned > 0 ? " AND seq > ?" : "";
+	const params = [BigInt(Math.round(request.maxSeq))];
+	if (scanned > 0) params.push(BigInt(Math.round(scanned)));
+	params.push(BigInt(limit));
+	return {
+		sql: `SELECT event_key, log_group, region, message, seq FROM log_events WHERE seq <= ?${after} AND request_id IS NULL ORDER BY seq LIMIT ?`,
+		params
+	};
+}
+/** Maps the rows of {@link buildRequestIdBackfillQuery}, dropping unusable ones. */
+function rowsToBackfillCandidates(rows) {
+	const candidates = [];
+	for (const row of rows) {
+		const seq = toNumber(pick(row, "seq"));
+		const region = pick(row, "region");
+		const logGroup = pick(row, "log_group");
+		const eventKey = pick(row, "event_key");
+		const message = pick(row, "message");
+		if (seq === null || typeof region !== "string" || typeof logGroup !== "string" || typeof eventKey !== "string" || typeof message !== "string") continue;
+		candidates.push({
+			seq,
+			region,
+			logGroup,
+			eventKey,
+			message
+		});
+	}
+	return candidates;
+}
+/** Highest `seq` of a scanned set, or `null` when nothing was scanned. */
+function maxSeqOf(candidates) {
+	let highest = null;
+	for (const candidate of candidates) if (highest === null || candidate.seq > highest) highest = candidate.seq;
+	return highest;
+}
+/**
+* Detects the request id of every candidate.
+*
+* A message that yields no id is dropped rather than written as an empty string:
+* it is a finished row, not a failure, and the watermark moves past it so it is
+* never looked at again.
+*/
+function planRequestIdBackfill(candidates) {
+	const updates = [];
+	for (const candidate of candidates) {
+		const requestId = detectRequestId(candidate.message);
+		if (requestId === null) continue;
+		updates.push({
+			region: candidate.region,
+			logGroup: candidate.logGroup,
+			eventKey: candidate.eventKey,
+			requestId
+		});
+	}
+	return updates;
+}
+/**
+* Builds one `UPDATE ... FROM (VALUES ...)` that writes many ids at once.
+*
+* One statement per chunk instead of one per row keeps a 20000-row pass down to
+* a handful of statements, and the predicate is an exact row match on the unique
+* index (`region`, `log_group`, `event_key`).
+*/
+function buildRequestIdBackfillUpdate(rowCount) {
+	if (!Number.isInteger(rowCount) || rowCount < 1) throw new RangeError(`rowCount must be a positive integer, received ${String(rowCount)}`);
+	return `UPDATE log_events SET request_id = v.request_id FROM (VALUES ${Array.from({ length: rowCount }, () => "(?, ?, ?, ?)").join(", ")}) AS v(region, log_group, event_key, request_id) WHERE log_events.region = v.region AND log_events.log_group = v.log_group AND log_events.event_key = v.event_key`;
+}
+/** Flattens updates into the parameter list {@link buildRequestIdBackfillUpdate} expects. */
+function toRequestIdBackfillParams(updates) {
+	const params = [];
+	for (const update of updates) params.push(update.region, update.logGroup, update.eventKey, update.requestId);
+	return params;
+}
+/** Levels and their rank, highest first; `unknown` is left to the `ELSE` branch. */
+function rankArms() {
+	return Object.entries(LEVEL_RANK).filter(([level]) => level !== "unknown");
+}
+/**
+* SQL `CASE` that turns a level into its severity rank.
+*
+* Generated from {@link LEVEL_RANK} so the ranks have one source of truth: the
+* statement and the UI cannot disagree about which level is worse.
+*/
+function levelRankCase(expression) {
+	return `CASE ${expression} ${rankArms().map(([level, rank]) => `WHEN '${level}' THEN ${rank}`).join(" ")} ELSE ${LEVEL_RANK.unknown} END`;
+}
+/** SQL `CASE` that turns a severity rank back into a level name. */
+function levelNameCase(expression) {
+	return `CASE ${expression} ${rankArms().map(([level, rank]) => `WHEN ${rank} THEN '${level}'`).join(" ")} ELSE 'unknown' END`;
+}
+/** The `WHERE` clause both series forms share: one region, one window, one or more groups. */
+function seriesScope(request, groups) {
+	return {
+		where: [
+			"region = ?",
+			`log_group IN (${groups.map(() => "?").join(", ")})`,
+			"timestamp_ms >= ?",
+			"timestamp_ms <= ?"
+		],
+		params: [
+			request.region,
+			...groups,
+			BigInt(Math.round(request.startTime)),
+			BigInt(Math.round(request.endTime))
+		]
+	};
+}
+/**
+* Builds the bucketed counts behind the chart.
+*
+* One statement returns every series. The bucket is plain integer arithmetic on
+* `timestamp_ms`, so it cannot drift with a time zone; NULL levels are reported
+* as `unknown` rather than dropped; and a level filter matches only rows that
+* carry one of the requested levels.
+*
+* `by: 'request'` selects the request form below; `by: 'event'` (the default)
+* keeps the event form unchanged.
+*/
+function buildSeriesQuery(request) {
+	const bucketMs = Math.max(1, Math.round(request.bucketMs));
+	const scope = seriesScope(request, request.logGroups.length > 0 ? request.logGroups : [""]);
+	if (request.by === "request") return buildRequestSeriesQuery(request, bucketMs, scope.where, scope.params);
+	const params = [
+		BigInt(bucketMs),
+		BigInt(bucketMs),
+		...scope.params
+	];
+	const where = scope.where.slice();
+	const levels = request.levels ?? [];
+	if (levels.length > 0) {
+		where.push(`level IN (${levels.map(() => "?").join(", ")})`);
+		params.push(...levels);
+	}
+	return {
+		sql: `SELECT CAST(floor(timestamp_ms / ?) * ? AS BIGINT) AS bucket, log_group, coalesce(level, 'unknown') AS level, count(*) AS events FROM log_events WHERE ${where.join(" AND ")} GROUP BY bucket, log_group, level ORDER BY bucket, log_group, level`,
+		params
+	};
+}
+/**
+* Builds the request form: one mark per request instead of one per line.
+*
+* `coalesce(request_id, event_key)` makes a line with no request id a request of
+* its own, so no line is dropped. A request is placed at its FIRST line
+* (`min(timestamp_ms)`) and counted once, and it takes the WORST level of its
+* lines (`max` of the ranks). A level filter selects on that same worst level in
+* the `HAVING`: asking for errors keeps every request that logged one, whatever
+* else it logged, and drops the requests that stayed below it.
+*
+* BIND ORDER: DuckDB binds `?` positionally in statement text order, and the CTE
+* comes first, so the parameters are the scope ones, then one rank per requested
+* level (the RANKS, not the level names), and the bucket width LAST - the
+* opposite of the event form above.
+*/
+function buildRequestSeriesQuery(request, bucketMs, where, scopeParams) {
+	const levels = request.levels ?? [];
+	const having = levels.length > 0 ? ` HAVING level_rank IN (${levels.map(() => "?").join(", ")})` : "";
+	const params = [
+		...scopeParams,
+		...levels.map((level) => LEVEL_RANK[level]),
+		BigInt(bucketMs),
+		BigInt(bucketMs)
+	];
+	return {
+		sql: [
+			"WITH requests AS (",
+			`SELECT coalesce(request_id, event_key) AS request_key, log_group, min(timestamp_ms) AS start_ms, max(${levelRankCase(`coalesce(level, 'unknown')`)}) AS level_rank`,
+			`FROM log_events WHERE ${where.join(" AND ")}`,
+			`GROUP BY request_key, log_group${having})`,
+			`SELECT CAST(floor(start_ms / ?) * ? AS BIGINT) AS bucket, log_group, ${levelNameCase("level_rank")} AS level, count(*) AS events`,
+			"FROM requests GROUP BY bucket, log_group, level ORDER BY bucket, log_group, level"
+		].join(" "),
+		params
+	};
+}
+/** Maps the rows of {@link buildSeriesQuery} onto chart points. */
+function rowsToSeries(rows) {
+	const points = [];
+	for (const row of rows) {
+		const t = toNumber(pick(row, "bucket"));
+		const group = pick(row, "log_group");
+		const level = pick(row, "level");
+		if (t === null || typeof group !== "string") continue;
+		points.push({
+			t,
+			group,
+			level: typeof level === "string" && level.length > 0 ? level : "unknown",
+			events: toNumber(pick(row, "events")) ?? 0
+		});
+	}
+	return points;
+}
+//#endregion
+//#region src/lib/server/archive.ts
+/**
+* Local DuckDB archive of the events the app has streamed.
+*
+* The driver (`@duckdb/node-api` plus its per-platform native binding) is an
+* optional dependency: it is imported lazily, on the first request that needs
+* it, and every failure is turned into an unavailable archive instead of an
+* error. The rest of the app therefore works unchanged on platforms where the
+* binding is missing.
+*
+* One process owns the file: DuckDB allows a single writer, and the SvelteKit
+* server is that writer. Statements are serialised through an internal queue so
+* a stream writing while another request reads cannot interleave on the
+* connection.
+*/
+/** Package name of the optional DuckDB driver. */
+var DUCKDB_MODULE = "@duckdb/node-api";
+/** Directory name used under the platform data directory. */
+var ARCHIVE_DIR_NAME = "watch-tail";
+/** File name of the archive inside {@link ARCHIVE_DIR_NAME}. */
+var ARCHIVE_FILE_NAME = "archive.duckdb";
+/**
+* Imports the optional DuckDB driver.
+*
+* The specifier is held in a variable on purpose: bundlers must leave the
+* import alone so Node resolves it at run time, where a missing binding can be
+* reported as an unavailable archive rather than a build error.
+*/
+async function loadDuckDbDriver() {
+	const loaded = await import(DUCKDB_MODULE);
+	if (typeof loaded.DuckDBInstance?.create !== "function") throw new Error(`${DUCKDB_MODULE} did not expose DuckDBInstance.create`);
+	return loaded;
+}
+var DISABLED_VALUES = /* @__PURE__ */ new Set([
+	"0",
+	"false",
+	"no",
+	"off"
+]);
+/** True when an environment value means "off". */
+function isDisabled(value) {
+	return value !== void 0 && DISABLED_VALUES.has(value.trim().toLowerCase());
+}
+/**
+* True when this process is a test runner.
+*
+* Vitest sets `VITEST`, and `NODE_ENV=test` covers other harnesses. Tests must
+* not append to the archive of the machine they run on, so the archive is off
+* unless a test asks for it through `WATCH_STREAM_ARCHIVE_DB` or
+* `WATCH_STREAM_ARCHIVE=on`.
+*/
+function isTestProcess(env) {
+	return env.VITEST !== void 0 || env.NODE_ENV === "test";
+}
+/**
+* Resolves the archive file path.
+*
+* `WATCH_STREAM_ARCHIVE_DB` wins; otherwise the file lives in the platform's
+* data directory (`XDG_DATA_HOME`, `%LOCALAPPDATA%` or
+* `~/Library/Application Support`), never in the current directory, so history
+* survives running the CLI from a different folder.
+*/
+function resolveArchiveConfig(env, platform = process.platform, home = homedir()) {
+	const path = env.WATCH_STREAM_ARCHIVE_DB?.trim() ?? "";
+	const dataDir = env.XDG_DATA_HOME?.trim() ?? (platform === "darwin" ? join(home, "Library", "Application Support") : platform === "win32" ? env.LOCALAPPDATA?.trim() ?? join(home, "AppData", "Local") : join(home, ".local", "share"));
+	const requested = env.WATCH_STREAM_ARCHIVE?.trim() ?? "";
+	return {
+		enabled: isDisabled(requested) ? false : path.length > 0 || requested.length > 0 ? true : !isTestProcess(env),
+		path: path.length > 0 ? path : join(dataDir, ARCHIVE_DIR_NAME, ARCHIVE_FILE_NAME)
+	};
+}
+/**
+* A short, non-throwing description of an unknown failure.
+*
+* A conflicting lock is the one failure a user can act on, and DuckDB's own
+* message buries the reason in a pid and a documentation link, so it is
+* reported as what it means for this app.
+*/
+function describeOpenError(error, path) {
+	const message = error instanceof Error ? error.message : String(error);
+	if (/Could not set lock|Conflicting lock/i.test(message)) return `the archive file ${path} is locked by another process (another watch-tail is using it); use --db to keep a separate file`;
+	return message;
+}
+/** True when the failure is the exclusive file lock. */
+function isLockError(error) {
+	const message = error instanceof Error ? error.message : String(error);
+	return /Could not set lock|Conflicting lock/i.test(message);
+}
+/**
+* One DuckDB file holding every event the app has streamed.
+*
+* `open` never throws: a missing driver, a locked file or a corrupt database all
+* produce an instance with `available === false` and the reason on `error`. The
+* read and write methods then behave as no-ops, so callers never have to guard
+* their happy path.
+*/
+var LogArchive = class LogArchive {
+	/** Database file this archive uses. */
+	path;
+	#connection = null;
+	#available = false;
+	#error = null;
+	#queue = Promise.resolve();
+	constructor(path) {
+		this.path = path;
+	}
+	/**
+	* Opens (and creates) the archive.
+	*
+	* Statements are executed in order: the sequence first, then the table, then
+	* the indexes, so an existing file from an older build is upgraded in place.
+	* The request-id backfill runs last, inside the same serialised path, and
+	* cannot fail the open.
+	*/
+	static async open(options) {
+		const archive = new LogArchive(options.path);
+		const load = options.load ?? loadDuckDbDriver;
+		const ensureDir = options.ensureDir ?? ((dir) => mkdirSync(dir, { recursive: true }));
+		try {
+			ensureDir(dirname(options.path));
+			const driver = await load();
+			for (let attempt = 1;; attempt += 1) try {
+				const connection = await (await driver.DuckDBInstance.create(options.path)).connect();
+				for (const statement of ARCHIVE_SCHEMA) await connection.run(statement);
+				archive.#connection = connection;
+				archive.#available = true;
+				await archive.#backfillRequestIds();
+				break;
+			} catch (error) {
+				if (attempt >= 3 || !isLockError(error)) throw error;
+				await setTimeout(150);
+			}
+		} catch (error) {
+			archive.#available = false;
+			archive.#error = describeOpenError(error, options.path);
+		}
+		return archive;
+	}
+	/**
+	* An archive that is off by configuration or could not be opened.
+	*
+	* Every method degrades to a no-op, so callers can use one code path for
+	* "no DuckDB on this machine" and "the user asked for no archive".
+	*/
+	static unavailable(path, error = null) {
+		const archive = new LogArchive(path);
+		archive.#available = false;
+		archive.#error = error;
+		return archive;
+	}
+	/** True when the archive can be read and written. */
+	get available() {
+		return this.#available;
+	}
+	/** Why the archive is unavailable, or the last failure, or `null`. */
+	get error() {
+		return this.#error;
+	}
+	/** Runs one task after every task queued before it. */
+	#enqueue(task) {
+		const next = this.#queue.then(task, task);
+		this.#queue = next.then(() => void 0, () => void 0);
+		return next;
+	}
+	/** Runs a statement, returning the failure instead of throwing. */
+	async #guard(fallback, task) {
+		if (this.#connection === null) return fallback;
+		return this.#enqueue(async () => {
+			try {
+				return await task();
+			} catch (error) {
+				this.#error = error instanceof Error ? error.message : String(error);
+				return fallback;
+			}
+		});
+	}
+	/**
+	* Migrates the request id of rows written before the column existed.
+	*
+	* It runs inside {@link LogArchive.#guard}, so it shares the serialised
+	* statement queue with every other write and reports a failure on `error`
+	* instead of letting it escape `open`. The watermark is the highest `seq` the
+	* migration has looked at, so a capped or interrupted pass carries on from
+	* there on the next open and no row is scanned twice; a row whose message
+	* holds no id stays NULL, which is the archive's answer for that row.
+	*/
+	async #backfillRequestIds() {
+		await this.#guard(void 0, async () => {
+			const connection = this.#connection;
+			if (connection === null) return;
+			const ceiling = rowToMaxSeq((await connection.runAndReadAll(ARCHIVE_MAX_SEQ_SQL)).getRowObjects()[0]);
+			if (ceiling === null) return;
+			const watermark = rowToBackfillWatermark((await connection.runAndReadAll(buildRequestIdBackfillStateQuery())).getRowObjects()[0]);
+			if (watermark !== null && watermark >= ceiling) return;
+			const { sql, params } = buildRequestIdBackfillQuery({
+				maxSeq: ceiling,
+				afterSeq: watermark,
+				limit: REQUEST_ID_BACKFILL_LIMIT
+			});
+			const candidates = rowsToBackfillCandidates((await connection.runAndReadAll(sql, params)).getRowObjects());
+			const updates = planRequestIdBackfill(candidates);
+			for (let start = 0; start < updates.length; start += 500) {
+				const chunk = updates.slice(start, start + 500);
+				await connection.run(buildRequestIdBackfillUpdate(chunk.length), toRequestIdBackfillParams(chunk));
+			}
+			const scanned = candidates.length < 2e4 ? ceiling : maxSeqOf(candidates);
+			await connection.run(buildRequestIdBackfillStateWrite(), [String(scanned ?? ceiling)]);
+		});
+	}
+	/**
+	* Writes one batch of streamed events.
+	*
+	* Batches are split into chunks of {@link ARCHIVE_INSERT_CHUNK} rows, and
+	* `INSERT OR IGNORE` plus the unique index make a repeated scan idempotent.
+	* Failures never propagate: a full disk must not interrupt a log stream.
+	*/
+	async record(region, logGroup, events) {
+		if (events.length === 0) return 0;
+		return this.#guard(0, async () => {
+			const connection = this.#connection;
+			if (connection === null) return 0;
+			let written = 0;
+			for (let start = 0; start < events.length; start += 500) {
+				const chunk = events.slice(start, start + 500);
+				await connection.run(buildInsertSql(chunk.length), toArchiveParams(region, logGroup, chunk));
+				written += chunk.length;
+			}
+			return written;
+		});
+	}
+	/** Reads one page of archived events. */
+	async page(request) {
+		const empty = {
+			events: [],
+			last: null
+		};
+		return this.#guard(empty, async () => {
+			const connection = this.#connection;
+			if (connection === null) return empty;
+			const { sql, params } = buildPageQuery(request);
+			return rowsToPage((await connection.runAndReadAll(sql, params)).getRowObjects());
+		});
+	}
+	/**
+	* Bucketed counts for the chart, per group and level.
+	*
+	* The request is forwarded as it arrives: it carries the grouping that says
+	* whether a mark counts an event or a request.
+	*/
+	async seriesQuery(request) {
+		return this.#guard([], async () => {
+			const connection = this.#connection;
+			if (connection === null) return [];
+			const { sql, params } = buildSeriesQuery(request);
+			return rowsToSeries((await connection.runAndReadAll(sql, params)).getRowObjects());
+		});
+	}
+	/** Aggregate row count and time bounds. */
+	async totals() {
+		return this.#guard(rowToTotals(void 0), async () => {
+			const connection = this.#connection;
+			if (connection === null) return rowToTotals(void 0);
+			return rowToTotals((await connection.runAndReadAll(ARCHIVE_TOTALS_SQL)).getRowObjects()[0]);
+		});
+	}
+	/** Log groups held by the archive, optionally limited to one region. */
+	async groups(region = null) {
+		return this.#guard([], async () => {
+			const connection = this.#connection;
+			if (connection === null) return [];
+			const { sql, params } = buildGroupsQuery(region);
+			return rowsToGroups((await connection.runAndReadAll(sql, params)).getRowObjects());
+		});
+	}
+	/** Status for `GET /api/archive`, including the file size on disk. */
+	async status() {
+		const totals = await this.totals();
+		let bytes = null;
+		if (this.#available) try {
+			bytes = statSync(this.path).size;
+		} catch {
+			bytes = null;
+		}
+		return {
+			path: this.path,
+			available: this.#available,
+			error: this.#error,
+			bytes,
+			totals
+		};
+	}
+	/** Closes the connection. Safe to call twice. */
+	async close() {
+		const connection = this.#connection;
+		this.#connection = null;
+		this.#available = false;
+		if (connection?.closeSync === void 0) return;
+		await this.#enqueue(async () => {
+			connection.closeSync?.();
+		});
+	}
+};
+/** The archive for the running server, opened once per process. */
+var sharedArchive = null;
+/**
+* Returns the process-wide archive for `env`, opening it on first use.
+*
+* The same file is never opened twice per process; a disabled archive
+* (`WATCH_STREAM_ARCHIVE=off`) is remembered so no driver import is attempted.
+*/
+function getArchive(env, load) {
+	if (sharedArchive === null) {
+		const config = resolveArchiveConfig(env);
+		sharedArchive = config.enabled ? LogArchive.open({
+			path: config.path,
+			...{} 
+		}) : Promise.resolve(LogArchive.unavailable(config.path));
+	}
+	return sharedArchive;
+}
+
+export { getArchive as g };
+//# sourceMappingURL=archive.js-C2D-5edp.js.map