turso_backup/lib.rs
1//! turso-backup — back up a local Turso (rewrite) database to S3-compatible
2//! object storage and restore it, with the at-rest artifact readable by
3//! vanilla SQLite.
4//!
5//! Plan + findings: `.yah/docs/working/turso-s3-backup.md`
6//!
7//! Three tiers (see modules), all three implemented:
8//! - [`snapshot`] — Tier 1a: full `VACUUM INTO` snapshot → object store, behind
9//! a two-gate skip. [`snapshot::upload_base_snapshot`] publishes an image the
10//! caller already holds, for a caller that may not open the file itself.
11//! - [`dedup`] — Tier 1b: incremental page-dedup snapshot.
12//! - [`stream`] — Tier 2: WAL-frame streaming anchored to a 1a base, with
13//! restore by frame replay, an RPO watermark, two-level fencing, bounded
14//! spill backpressure ([`backpressure`]), one-puller-per-box fan-out
15//! ([`puller`]), and a [`stream::probe_conditional_puts`] preflight.
16//!
17//! Both streaming tiers accumulate garbage a writer deliberately does not
18//! delete, and each has an explicitly-invoked sweep that does:
19//! [`dedup::gc_dedup`] for 1b's `pages/`, [`stream::gc_stream`] for 2's
20//! superseded base snapshots and orphaned frame prefixes.
21//!
22//! This header called tier 2 "deferred, engine-coupled" until 2026-08-28. It
23//! was neither by then: `stream.rs` had shipped in R005-F2/F3 and grown fencing
24//! (R732-F2), the RPO watermark (R574-T4) and frame batching (R761-F2). The
25//! claim was disproved by R760-F6 while wiring roadcase onto it, and corrected
26//! here rather than filed — a stale doc comment costs every reader after it the
27//! same wrong first impression.
28//!
29//! @yah:relay(Q002, "Turso → S3 backup crate")
30//! @yah:at(2026-05-26T22:28:29Z)
31//! @yah:kind(quest)
32//! @arch:see(.yah/docs/working/turso-s3-backup.md)
33//!
34//! @yah:ticket(R003-T1, "Spike: decide crate shape (sibling vs wrapper) + name; pin deps (turso/object_store/anyhow/tokio); flesh skeleton")
35//! @yah:assignee(agent:claude)
36//! @yah:at(2026-05-26T22:30:03Z)
37//! @yah:status(review)
38//! @yah:phase(P1)
39//! @yah:parent(R003)
40//! @arch:see(.yah/docs/working/turso-s3-backup.md)
41//! @yah:handoff("Spike complete. Sibling crate (standalone, depends on turso via crates.io, no re-exports) >> wrapper — less coupling, simpler maintenance, matches how writer/ already depends on turso. Name confirmed: turso-backup.")
42//! @yah:handoff("Prior-art eval: tier 1a (VACUUM INTO + object_store) is greenfield-worthy — no crate wraps turso-rewrite snapshot to S3. smugglr/verneuil (page-dedup, tier 1b) and walrust/wal-backup (WAL streaming, tier 2) remain candidates per working doc for their respective phases; license-check deferrable to those spikes.")
43//! @yah:handoff("Deps pinned in Cargo.toml: turso 0.6.1, object_store 0.13, anyhow 1, tokio 1 (rt+macros). Skeleton modules fleshed: snapshot.rs has real BackupTarget struct + async signatures; dedup.rs/stream.rs use anyhow::Result. Crate compiles cleanly.")
44//! @yah:next("R003-F2: implement snapshot_and_upload (VACUUM INTO temp + object_store put + change_counter skip)")
45//! @yah:next("R003-F3: implement restore_latest (object_store get + write file)")
46//! @yah:next("R003-T4: green e2e in harness (writer -> snapshot sink -> MinIO -> restore -> verifier)")
47
48pub mod snapshot;
49pub mod dedup;
50pub mod stream;
51pub mod backpressure;
52pub mod puller;
53/// R850-F1: mints the fencing epoch `stream::StreamConfig::epoch` enforces, for
54/// callers with no raft state machine to ask.
55pub mod claim;
56/// R850-F1: hydrate-on-place — fill an empty volume's declared databases from
57/// the store before the workload starts, under a [`claim`].
58pub mod hydrate;
59/// R850-F1: the other half of [`hydrate`] — keep a *running* appliance's
60/// declared databases shipped to the store, beside an application that holds
61/// them open, under the same [`claim`].
62pub mod tail;