Optional_the pack replay driver, created on first use
Optionalactivitytoday's renders, alarm firings and drained fetches since the last meter flush
OptionalalarmWhen the alarm this object last set is due, in memory only.
armFillAlarm() compares against it so a burst costs one charged row; a hibernation costs
one extra arm.
Optionalalarmalarm firings this incarnation
Optionalalarmalarm re-arms this incarnation
Optionalarrivalsthe arrivals the thermal predictor reads; a ring, so it costs no rows
OptionalauthToday's authenticated spend, or undefined when nothing has been charged in this lifetime.
Re-read from ctx.storage on each charge; an eviction must not reset the day's budget.
Optionalbootthe last boot that started while another interpreter was still resident in this isolate
timestamped boot notes from the loader
Optionalbootwhat the last boot decided about the published boot image, and what the restore did
Optionalbootthe heap at the restore point, kept only by a bake rig so a capture can take the delta
linear memory when the current interpreter finished booting; a reused memory starts large
Optionalboothow long the last boot took
Optionalbumpwhether this invocation already bumped the generation
Optionalbumpsgeneration bumps this incarnation
OptionalcarriedcarriedServeTotal()'s memo; the lifetime serve total moves only through flushMeters()
Optionalcoldscold boots not yet folded into the persisted window
Optionalconsecutiveconsecutive failing batches, for the capped backoff; reset by any batch that progressed
Optionalcrossingcapability names actually present to wrap, so a 0 is not read as "never called"
OptionalcrossingsPHP-to-host crossings, per capability; see src/ops/crossings.ts
Optionaldeferredoutbound calls the render in flight has deferred; see the re-drive in fillOne
the highest linear-memory reading each path has caused
the last requests' effect on linear memory
whether this incarnation has already made sure the deployment document lists it
OptionaldoDurable Object invocations since the last flush; in memory, since a row each would inflate the rows meter.
trend ring for Durable Object requests
OptionalelidedWrites skipped because the row already held the value; in memory (a row to count rows saved defeats it).
How often a request met an evicted interpreter; in memory, folded into a per-day total on the alarm.
the worker's own vars (narrows the base class's env; emits nothing)
firings whose background PHP waited for a young interpreter
Optionalforwardwrites this lane executed speculatively and owes the primary; see collectForward()
Optionalforwardthe generation this lane read at, pinned on the first collected write
Optionalheapwhat the heap image integrity check has seen; shown by /__serve-stats
Optionalheapwhat the last heap restore attempt did, or undefined when it was never attempted
OptionalheapWhere a chunked restore has got to, or undefined when none is in flight.
In memory only: the cursor indexes a live heap, and a persisted one could resume at chunk 7 of a heap an eviction already zeroed. Repeating one object's memcpy after an eviction is idempotent.
Optionalheapshow many boots instantiated into a dropped interpreter's memory
Optionalhttpwhether ensureHttpTables() has run
Optionalinflightrequests in flight right now
Optionalinflightthe peak of inflight since the alarm last read it
Optionalinstalledfiles written from cfw_module_file at boot; 0 on a site that has installed nothing
every cache tag invalidated this invocation (the bump is coalesced; the tag set is not)
OptionalkvPAGE_KV page writes granted since the last meter flush
Optionalkvlever names adoptSettings() took from KV, so cfwSettings can report a source
Optionallaneset when one more lane would project the day's rows past the reduce fraction
Optionallanesthe last CONFIG_KV write of the pool, awaited only by tests
Optionallanethe gated lane's queue/service split; a ring, read by /serve-stats
Optionallastwhat the last asset aggregation removed from a stored page, so 5,400 bytes/row has an n
Optionallastwhen the alarm last fired
Optionallastthe class of the last alarm outcome
Optionallasthow the last alarm ended
OptionallastWhen an authenticated request last reached this object; in memory, since a row spends the meter it protects.
Optionallastwhat the last autoscale evaluation decided; null when it did nothing
Optionallastwall time of the last fill that also booted; diagnostics only, never an estimate
Optionallastthe last catch-up round, reported at /serve-stats so a stuck lane is visible
Optionallastthe last cron firing, with when it ran
Optionallastthe hook list the last firing scheduled from; discovered, or the shipped fallback
Optionallastwhat the last eager derivative run did; see deriveStep()
Optionallastthe last firing whose background PHP waited for a young interpreter
Optionallastwhat the last supervised alarm found, for /__health
Optionallastthe last fleet reporting failure
Optionallastthe last forward outcome, reported at /serve-stats so a refused write is visible
Optionallastthe last garbage-collection pass; lastGcAt is apart because it paces the next
Optionallastwhen the last collection pass succeeded; an error leaves it so a failing pass retries
Optionallastthe last git poll, with when it ran
Optionallastwhat the last heap-image attempt did; see SitePhpDurableObject.snapshotStep
Optionallastthe last deferred-HTTP drain, with when it ran
Optionallastthe last invocation's complete tag set, reported at /serve-stats
OptionallastOptionallastthe last mail drain, with when it ran
Optionallastwhen the daily meters last paid for a write; see shouldFlushMeters()
Optionallastthe last file-mirror drain, with when it ran
Optionallastthe last stepped-operation outcome
Optionallastthe last outbound URL the SSRF guard refused; see src/ops/outbound-guard.ts
Optionallastthe last page-mirror drain, with when it ran
Optionallasthow the last parked render went, so a park that stopped answering is readable
Optionallastwhat that settlement did, so a crash-then-recover is observable rather than assumed
Optionallastthe last scoped plan purge, so an invalidation that removed nothing is still visible
Optionallastthe idle re-arm last chosen, with why and the idle time behind it; in memory
Optionallastthe last reconciliation outcome, including a step that is waiting and owns no firing
Optionallastthe last interpreter drop and why
OptionallastThe last request-level re-drive; at and seq tell a repeat from the first one still
sitting here.
Optionallastwhen a render last began in this incarnation; the exact half of the idle clock
the size of the last rendered page, for the demand record
Optionallastthe tally at the start of the last render, so /serve-stats reports a per-render figure
Optionallastwall ms of the last warm render (the inline budget guard's estimate)
Optionallastwhen that window last paid for a write
Optionallastthe last adoption attempt, for /serve-stats
Optionallastthe last such reuse
Optionallastwhat the last tag-scoped purge did, reported at /serve-stats so the 11x is observable
Optionallastwhen this lane last chased a session it did not hold; the cookie is attacker-supplied
Optionallastwhat the last addressable-sweep step did, so coverage has a number rather than a guess
Optionallastwhen a sweep last queued something; separate from the report, which every step replaces
Optionallastthe last VM trap
Optionallastthe last database-update beat, with when it ran
Optionallastwhat the predictor last decided, reported at /serve-stats so a policy is legible
Optionallastwhy this lane last left the pool; survives the readmission that clears lastCatchUp
Which platform limits this incarnation's failed requests hit; per incarnation, since a reset object has already answered.
Optionallogsrecent PHP log payloads, bounded
Optionalmailsrecent mail attempts, bounded
Optionalrefusal?: stringwhy it was refused; absent on a message that reached the queue
the transport the message was committed to, or null when it was refused
OptionalmailWhether an SMTP send holds an outbound socket; the only thing that makes this object non-hibernateable.
Trend ring for memory; held here because the supervisor owns no state (a poisoned observation must not outlive a recycle).
whether the pack database has been replayed into this object
Optionalmigrateconsecutive pack replay failures
Optionalmodulewhat the installed-file integrity check has seen; shown by /serve-stats
Optionalmountwhat the lazy mount reported for this site
the shared output buffer of the interpreter
settles once a legacy plaintext owner token has been moved into sealed storage
Optionalpackedthe pack's container row, loaded once an instance has reconciliation to do
per-path render sizes, previous renders only (the renderSizeAnomaly baseline)
per-path serve counts, in memory only; the R2 page mirror publishes the busiest first
Optionalpagespages the alarm chain filled this incarnation
OptionalparkWhat a parked HTTP yield is performed with; global fetch unless a test stubs it (keeps the
real classifier and guard).
Optionalparkwhether this interpreter can park a Zend continuation, probed once per interpreter
Optionalparkthe sockets a parked chain holds; per interpreter, because its PHP tokens are
OptionalparkEvery park this interpreter has driven, and every trip inside them.
Cumulative: one park is below the 1 ms meter, so a cost needs two reads either side of a window.
Optionalpendingthe attempt the next render belongs to; see src/ops/attempt.ts
commit advances not yet persisted; see flushCommitSeq()
Optionalpendingwhether this incarnation has settled a purge a previous one recorded
OptionalpendingAuthoritative statements collected during this invocation, awaiting a fingerprint.
Per invocation: one that dies before sealing must leave no record (a replica restores instead; a partial record would leave it silently wrong).
OptionalphpnowMs() when the resident interpreter booted; what fillSettleMs is measured from.
Optionalphprequests served through the PHP lane this incarnation
Optionalphpwhat every host closure of the current interpreter resolves this through
OptionalpinnedStrong references to every vrzno handle value this interpreter has handed PHP.
In memory only; stops the handle table's WeakRefs dying under a heap that still holds their integers.
Optionalplanswhether this invocation has already flagged the plans; cleared by settlePlans()
the last RangeErrors a handler saw, with what the interpreter was doing when they landed
Set when this interpreter's first kernel boot has no container row and so rebuilds it.
The rebuild's garbage is invisible to the memory estimate, so the next invocation can be reset; the interpreter is dropped at the end of that invocation regardless of thresholds.
the last faults a catch absorbed while keeping its fallback, oldest first
Optionalrecyclesinterpreter drops taken to stay under the isolate limit; /serve-stats reports both
Optionalrenderset when the frozen clock made the last render time unusable
renders in flight, so N concurrent identical requests cost one; see herdKeyFor()
Optionalrendersrenders not yet folded into the persisted window; see flushRenderWindow()
OptionalreplicaThe read-only guard when REPLICA_READ_ONLY is set, undefined on a primary; see
src/ops/replica.ts.
The most recent refusals (failovers are counted from it); bounded, since each holds a stack and the JS heap shares the 128 MiB isolate.
the total, kept apart so bounding the array above does not deflate the reported count
interpreters adopted from an evicted instance
Optionalretiredset by retire(); this incarnation then answers 410 and arms nothing
Optionalrowstrend ring for rows written
Optionalrowswrites accumulated since the last alarm folded them into the daily total
Optionalrowsaccumulated across the object's life; undefined until the first statement
Optionalserveserved requests not yet folded into their durable total; see flushServeRequests()
Optionalservewhether ensureServeTables() has run
Optionalsessionhow many times chasing a session found it
Paths a shell seed already failed on, so each is attempted once (in memory; a hibernation costs one more attempt).
Optionalsleepthe waiting allowance of the invocation in progress; see sleepBudgetMs()
Optionalspeculatinginside an execTxn pass that will be rolled back; see the guard in execSql()
Optionalspooltag to the cursor of its last change, for spool's sync; memory only
Optionalsqlstatement counter for PW_SQL_TRACE, so the tail can be read as a sequence
the counted handle; storage-metered.spec.ts fails on a direct ctx.storage write
Optionalstoragerequests served from storage this incarnation
Optionalsuppressset while a write must not bump the generation
Optionaltrappeddrops taken because the VM trapped, which is a fault rather than a size; see run
OptionaltxnOptionaltxnreplays not skippable because a read overlaps the buffer's tables
Optionaltxnspeculative replays whose read touches no table the buffer writes; see execTxn()
Optionaltxnstatements those replays ran, which is the size of the lever rather than its value
Optionaltxnreplays not skippable because a statement's table could not be attributed
Optionaltxnwhy a replay was NOT skippable, so no opportunity reads differently from a blind parser
OptionaltxnOptionaltxnspeculative replays with no read
Optionaltxnthe split a read filter lives or dies on: a replay with no read has nothing to filter
Optionaltxnset by a request carrying a file, cleared when the interpreter drops after it
Optionalwidehow many result sets this lifetime needed a wide-integer re-read; 0 on an ordinary site
Optionalwindowfills served by the open fill window, sent back on its socket
Optionalwriteper-table rows-written tally; only allocated when /__writes turns it on
Static ReadonlyFILL_The bins a fill empties on itself.
dynamic_page_cache stays warm: 1.4x on a site whose page table fills (5 charged rows
against 7), and tag invalidation still reaches it through its checksum. A non-tag bump
purges it and gcDynamicPageCache() bounds it.
Static ReadonlySESSION_Minimum ms between session chases on a lane; a forged cookie must not buy a primary hop per request.
The interpreter. Clearing it also drops the isolate's retained copy, or a recycle or a drop would leave the memory it exists to free held in module scope.
today's activity counters, stored plus pending, so a read between flushes is current
Moves every credential that sits in cfw_meta (a site from before sealed storage, or an
import that carried them) into sealed storage. Runs on wake and at the head of each alarm,
which is where an import is applied, so a credential is in SQL for one firing at most.
Overlays every KV lever override onto this object's env.
withSettings() only covers the front worker's env; the object gets its own bindings.
Awaited here and never in fetch() (the fast lane stays await-free and reads no lever), and
called from alarm() too, which never passes through handle().
Advances the monotonic count of authoritative invalidations that a replica fences on.
Separate from generation, a coalesced page-purge counter that stops moving once
cfw_page is empty (a permission grant invalidated two tags and left it still).
What the last advisory sweep found: one indexed row read, no kernel boot (the module's cron hook fills it).
The aggregate manifest from the ASSETS binding, or undefined; memoised per incarnation,
absence included.
Fill one page, then re-arm at +1 ms (each link is a fresh invocation with a fresh budget).
The fill runs inside the gate. The return is any because the platform discards it and this
one feeds /__serve-stats.
Optionalinfo: AlarmInvocationInfoAppends the disposable rows a forwarded batch carried, outside its transaction; a failure drops only that row, and nothing is buffered for replication.
Arms the fill alarm without disturbing one that is already sooner.
Synchronous callers cannot await getAlarm(), so the guard is an in-memory note; an
unconditional setAlarm() costs a row per hit on hot paths. Fire-and-forget: a memo lost to
hibernation costs one extra arm and never skips one.
Whether this lane is empty and waiting for the primary's copy (CREATED with a readmission
ask outstanding).
the end of the young-interpreter hold on background PHP, or undefined when there is none
the settings override's inputs other than the origin, which the boot image keys on
Optionalparams: SqlBindingsOptionalreason: stringOptionaloptions: { arm?: boolean; invalidatedTags?: string[]; scopedTo?: string[] }The scheme://host[:port] this site renders absolute URLs against; pinned on first use (one
cfw_meta row), and a local origin is never pinned.
Optionalobserved: string
url.origin of the request being served (the visitor's scheme and host in
production); harness origins like do.local are refused by pinnable
The lifetime serve total from whichever day last recorded one; memoised, since it only moves
through flushMeters().
Optionallimit: numberThe Cloudflare API credentials, from the durable grant or from the deployed pair.
Every consumer goes through here: the env overlay dies with the incarnation (about ten seconds idle), so the persisted grant is the source. A refreshed set is persisted so the next incarnation starts from it; a refresh failure is not an error (the access token may still be valid).
The same credentials without the refresh, for a caller that cannot await.
One rule for which credential a site uses (durable grant first), shared with mailEnv(); the
drain refreshes before it resolves. An expired token answers 401, which is the better signal.
adds ops to this month's R2 write tally (deletes count too, so it reads high)
forgets the recorded set, once the purge it describes has happened
Abandons a restore in progress.
Without it restore_generation survives and every chunk of a fresh attempt is refused as
torn. The in-flight marker stays: landed rows remain and the replica is untrusted until a
copy completes.
The share of requests that met an evicted interpreter, today and in this incarnation (score a boot proposal against it).
the stored commit sequence plus advances not yet persisted
whether the next kernel boot has to rebuild the container; unreadable reads as no
The generation a copy may hand a replica: the last sealed record, not commitSeq().
The sequence can sit ahead of the last record (a lane copied at 86 meets a record from 85 and is withdrawn). The gap holds no statements, so resuming at the last record skips no change.
How long a lane waiting on a copy sleeps before asking again: doubling from the catch-up interval to 60 s.
adds n to today's pending counter for kind
Row count for a table that may not exist yet. null rather than 0: several Drupal tables are created lazily on first write, and 0 for a missing one reads as a verified invariant.
Optionalwhere: stringtoday's DO invocations, without flushing
today's granted PAGE_KV page writes, without flushing
today's rows written, without flushing (for a read that must not write)
Where this site sits on the quota ladder; both daily meters reset at midnight UTC, so nothing is persisted (two warm reads, no await).
removes a lane from the repair queue and returns what remains
Optionaltransport: DeriveTransportOptionallimit: numberpurges the recorded pending tags and clears the record; undefined when none are owed
Drops the compiled container and plugin discovery so the next boot rebuilds both.
Called when a delivery changes an extension's wiring; a container cached before a module's code arrives resolves routes to classes that cannot load.
Drops the interpreter, but only one with a binary (a stubRender() stub holds no heap and
would be lost).
records a lane as needing a fresh copy; idempotent, since a lane re-asks every firing
Queues a refill for one path and wakes the chain; await-free (the storage lane runs outside
the gate) and bounded by FILL_QUEUE_MAX.
Builds the interpreter, installs the bridge, mounts the tree. Once.
Lazy rather than in the constructor so boot cost is attributable to a route. A static build instantiates inside a request handler because it needs no runtime codegen.
creates the replication log table if absent
What the next render on this instance is expected to cost, in ms.
A prediction, because php._run() is one synchronous wasm call that no timer or
AbortSignal can preempt. The last render is the best predictor; pessimistic with no
evidence (a cold instance is the common case and must not gamble on a multi-second boot).
Every Drupal statement, plus the automatic invalidation trigger.
Suppressed during /__migrate (packed cachetags rows are setup). Coalesced: one save writes
many tags, and once bumped further writes are ignored until fillOne() clears the flag.
Optionalparams: SqlBindingsCounts speculative replays whose read could not have seen the buffer anyway.
An instrument, not a lever (skipping a replay also skips rememberResults()); measured zero,
since replays on a content write carry no read.
Whether this object may answer a request that requires generation g.
A primary is never fenced. A replica checks the caller's header: absent means any view will do, an unparseable one refuses (unreadable is not absent), a number goes to fenceAllows.
serves one request: routes it, hands refusals to the primary, classifies platform limits
OptionaltargetPath: stringOptionalbins: string[]Optionaldestruct: string | booleanOptionalrequest: RenderRequestThis site's own verdict on itself for the fleet inventory (findings stay on /health).
Quarantine outranks degradation: a quarantined site refuses requests, a degraded one serves them cheaper.
Persists the invocation's commit advances as one row (a write per statement was 15% of a node save's row cost). An invocation's writes commit together, so the counter cannot fall behind the data it fences; the seal flushes unconditionally, since under-advancing serves stale authorization.
Folds this firing's Durable Object invocations into a per-UTC-day total.
Counts only what reached this object (an edge-cache hit never enters the isolate), so it is the DO meter and not the Worker-request meter.
Folds the writes since the last flush into a per-UTC-day total; flushed on the alarm, never per write (that would double the count; the flush row is itself counted).
the running total for today
Folds this incarnation's cold-encounter counts into a per-UTC-day total; called from the alarm, where a row is already written.
OptionalnowMs: numberFolds pending renders into the persisted window, at most once per 15-minute window (96 rows/day against 1,440 at the 60 s meter interval; the rate only separates ~505 renders/day from ~8,640).
The roll is also where the warm interval is solved: lastRenderWindowFlushMs is in memory,
so it is set only if this incarnation did the previous roll.
Folds served requests into their durable total, on the meters' own interval.
A row per view would cost ~15,000 of free's 100,000 rows/day. A serve arms the fill alarm at +1 ms and that firing flushes, so an eviction loses about a millisecond of counting.
Runs the tag-scoped purge once the invocation's invalidated tags are complete.
Runs at the end, so a death before it leaves a plan alive. The wholesale purge in
bumpGeneration() runs at the write and has no such window.
The site generation: one integer every edge cache key carries, so one write unreaches every cached URL (tag purge is Enterprise-only).
the stored token, email and username for a remote (empty strings when unset)
who owns each installed path, which is what turns an overwrite into a refusal
Optionallimit: numberevery open request, from the provider API where there is one, else from the refs
the ref advertisement, which is the poll and works against any remote that speaks git
every configured remote; the list is one meta row so an add is one write
the git transport's view of a remote, which authenticates as Basic, unlike the API
every file this remote has installed, so a plan can tell a change from an addition
Writes one commit status, never a check run (a pasted token is refused by the check-run endpoints on all three providers).
adopts KV levers, learns the site name, then dispatches to the route table
OptionaldeliverBase: stringThe vrzno handle table (Module.targets), shape-checked; undefined when absent, which a
restore refuses on.
Whether this deployment ships migration chunks; a quiet false, since an alarm that throws stops re-arming.
whether this object holds a table at all; the restore's own precondition
What the host knows about itself, in the shape BootSelfTest reads.
Every key is a host fact (bridge, absent capabilities, migration progress, update run, pack
identity), so the PHP health unit needs no kernel. missing_capabilities comes from the
installed list, not a hand-kept name list.
The emscripten heap as bytes (HEAPU8, else wasmMemory; php-wasm types neither);
undefined if neither exists.
The identity a heap image is valid for: the pack plus the site's module set.
An install changes the container and class loader without touching the pack, so a pack-only
key restores a stale kernel (access() on null). Undefined when there is no pack
generation.
Linear memory right now, or 0 where there is nothing to read (this.php can be a
stubRender() stub with no binary).
The key N concurrent identical requests share, or undefined when they may not be coalesced.
The cookie is in the key, so one visitor's page is never handed to another. Serving GETs only.
reads a cached outbound response, optionally stale; undefined on a miss
Optionalmethod: stringOptionalbody: stringOptionalheaders: Record<string, string>Optionalopts: { allowStale?: boolean }Which slice of the rowid space this object's driver mints from.
The count is ID_PARTITION_LANES, not the pool size (a lane cannot learn it). The
primary takes slice 0, or unpartitioned ids collide with forwarded rows on UNIQUE. Gated
on the site having a pool, since ids advance by the stride.
how many times this object has tried to image generation; a new one starts at zero
Sets a stored page's tag list out of band, for a caller that did not write the row.
Tags come from the render's cacheability metadata, never parsed HTML. Replaces rather than merges, so a re-render with fewer dependencies is not purged by a dropped tag.
Wall-clock budget a miss may spend rendering before the path goes to the alarm chain.
2 s covers the measured first-render range (195 to 1,636 ms) and excludes the 3,754 ms cold
boot; it bounds the visitor's patience, not a billed resource. budget on the query string
overrides (0 disables inline rendering). A cold object refuses on !this.php before this is
consulted.
Optionalconstraint: stringOptionalstability: stringInstalls the synchronous SQL entry point on the PHP Module so vrzno can reach it, wrapped in the codec.
The codec matters here specifically: node IDs, file sizes and timestamps all cross this boundary, PHP is 32-bit, and a SQLite INTEGER can exceed 2^31. Handing back a raw JS number silently wraps it -- that is the bug class the codec closes, and a database driver is where it would bite hardest.
Both entry points run inside withMask(): they are JS frames under the PHP
stack, and a slice interrupt that fires there cannot suspend (see src/mask.js).
The decode/encode codec calls sit inside the same window, so the codec needs no
mask of its own.
Optionalconstraint: stringOptionalbudget: { left: number }Optionalstability: stringDrops the caches that embed the Drupal core version, once per lifetime, when that version has moved.
The whole isolate's demand: wasm linear memory plus the JS-side bytes the mount holds (the pack blob and in-memory fs arrays share the 128 MiB budget).
Whether this object is a pool lane, narrower than a replica.
A lane has a lifecycle (restore, then SERVING) and hands traffic back until then; a
var-configured replica sits at CREATED forever, so the readiness check would refuse
everything.
Whether this object is a replica, a property of its name (example.com#r1).
REPLICA_READ_ONLY is deployment-wide and would make a pool's primary read-only, so the
role is per-object; no client request can change which id the router used. Either source
suffices (OR, so a misconfiguration lands on read-only).
whether the fill chain has already proven it cannot satisfy this path
the pool advertisement every primary response carries, or nothing without a pool
Whether this is a pool lane nothing has routed to lately; a primary is never idle (it takes every write and miss).
lane numbers waiting to be copied again, lowest first; read on the primary
loads the pack's container row from ASSETS once
The replication log's view of this object.
Uses cfw_meta, not ctx.storage.kv (a record applies inside synchronous
transactionSync).
metaSet('') clears the in-flight marker: v is NOT NULL, so empty means absent.
Which values this object cannot mint for itself and does not hold.
Asked of a replica (did the copy finish) and of a primary (may it be copied from): a
provisioned site holds no system.private_key yet, and each replica would then mint a key
the others reject.
records that an attempt's PHP is about to run, dropping markers past their ttl
Records the rowids this lane minted for a batch the primary committed (else a second insert
between catch-ups mints the id again). Uses MAX so the mark never falls.
The rolling median body size for one path, over previous renders only.
Reading cfw_page would compare a render against the row it just wrote (ratio 1.00, so
renderSizeAnomaly could never fire). In memory and capped, like pageHits.
Reads a cfw_meta value, or fallback when the key is absent.
A key in SEALED_META_KEYS is read from sealed storage; a row left from before the move is adopted on the first read that misses it.
Writes a cfw_meta value, skipping one that is already there. A key in
SEALED_META_KEYS goes to sealed storage and leaves no row.
the migration cursor for diagnostics, or null on a site that never started one
The cursor when a migration is started but unfinished, else undefined (never started must keep serving; deploys predate the chunked engine).
The JS-side migrator, built lazily (the manifest is an asset fetch) and cached (re-reading per chunk costs 15 subrequests of the 50 cap).
The R2 bucket to offload files to, or undefined when there is none.
An absent bucket is supported (the free-tier default): files live durably in DO SQL and R2 only buys serving headroom. Typed structurally so the drain runs over a stand-in.
the 400 for a modify action called without a JSON POST
Whether this site was never provisioned (no cursor at all, unlike a half-finished one);
migrateStepIfPending() needs a cursor, so this starts the chain.
Advances the commit sequence when a statement writes authoritative state.
Keyed on the target table, not cache tags (a user create and a system.private_key rotation
write no tag). Every key_value write counts, which over-advances safely: too often costs a
refresh, too rarely serves stale authorization.
Optionalparams: SqlBindingsRecords that a lane finished copying; the key puts x-cfw-lanes on responses, so every
provisioning path must call this (one writer).
Persists the tags this invocation invalidated, at the write, so a crash before
flushTagPurge() leaves a durable record of what is owed. drainPendingTags settles
it at the end of the invocation and again at boot.
records one render's size after its median was taken, so a render never sets its baseline
Records whether a path can be stored at all; only an anonymous render Drupal itself refused counts (a cookie, redirect or 500 is transient).
Date.now() is not available at DO global scope in some contexts and the value must also survive the 32-bit PHP boundary, so it is read here and encoded by the codec on the way out rather than passed raw.
The OIDC provider an operator configured, or why it is not usable.
The secret is an env binding; neither it nor the issuer may join KV_OVERRIDABLE (a KV
writer could point every login at a provider they control).
the discovery document, fetched per callback, not cached; a login is not a hot path
whether a stepped operation is in flight
advances the stepped operation one step; a throw drops the job (a throwing alarm stops)
Runs one step of a stepped operation, keeping the job only while it reports more to do.
A failed step also ends it (a retry from the top would replay what already landed). The first
cim step carries the payload; the run holds its own state after that.
Whether this object should drop its interpreter at the next safe point; either threshold fires.
Only once the heap has grown since the boot (a reused memory starts large and a drop cannot shrink it, else it would drop every invocation). The batch guard reads this too.
The pack generation this object migrated from, or undefined; a heap restored across packs holds paths into moved files.
Optionalextra: Record<string, string>When this page became superseded, derived from tag state rather than written per save.
A marked row answers at once; an unmarked one is checked against its tags' invalidation sum
and marked if it moved (2 rows instead of 34 per save). Undefined with no usable checksum,
which bumpGeneration() marks eagerly.
the socket table this interpreter's parked chains use, created on first park
the stored paths that depend on any of tags
the durably recorded tag set, empty when there is nothing owed
Optionalasked: stringOptionalbudget: numberWhether a page request asked this site to provision itself; durable (one cfw_meta row),
since an eviction sits between ask and alarm.
the origin public bytes are served from, or '' when everything goes through the Worker
Drops the derived caches a lane holds once the primary's log has moved it past a generation.
Only the primary runs bumpGeneration(); replayed SQL leaves a lane's path-keyed cfw_page
stale. Wholesale, since the log carries statements, not tags.
what each store gave up, for the pull loop to report
Empties Drupal's dynamic page cache, tolerating a site that has never created the table.
rows removed, or -1 when the bin does not exist yet.
Optionalreason: stringOptionaloptions: { bump?: boolean }Deletes the plans that depend on any of tags, or every plan when none are known.
LIKE rather than a join table: a page bubbles 10-40 tags and a row each would spend the
meter that binds regeneration, so the tags live in one JSON column on the plan row.
Optionaltags: string[]rows waiting in the fill queue
Queues a public image for its styles to be rendered ahead of the first view (derivatives and Drupal's styles directory are not sources).
this month's R2 writes against r2WriteBudget; the key carries the month
a body that is not JSON is a caller error, and a throw here would read as a server fault
reads a credential from sealed storage, moving a legacy cfw_meta row over on first read
what a reconciliation step may ask this object beyond plain SQL
Why reconcileStepOnce() answered undefined, so a POST that did nothing is not mistaken for
a silent failure.
the stored reconciliation state
the reconciliation report for this site
drops the interpreter after a request that carried a file; see carriesUpload()
Drops the interpreter when linear memory has climbed too close to the isolate limit.
PHP returns nothing under USE_ZEND_ALLOC=0, so demand is cumulative; past 128 MiB the edge
resets the isolate and every in-flight request. Called between invocations only (a
mid-request drop holds both heaps until collection). A ceiling check; a trend misses a
workload arriving high.
the SSRF guard, or undefined when it is off or the URL is allowed
stores the autoload map a build-delivered vendor package asks composer to register
the 421 sending the caller to the primary; neverRan marks an uncommitted forward
OptionalneverRan: booleanthe stored replica stage (CREATED when none)
statements sealed for replication since sinceMs, each at least one row on every lane
sealed log records after generation since
Optionallimit: numberrecords that a visitor wants this site, and wakes the alarm chain to build it
a comma-joined restore bookkeeping list, empty when unset
keeps this object's interpreter in module scope, stamped with the commit it has seen
Wipes this object: its alarm, its storage, its interpreter and any retained one. The flag goes first so nothing in flight can arm an alarm between the two deletes.
Runs a PHP fragment and returns everything it wrote.
A wasm trap (RuntimeError out of _run()) leaves a half-finished Zend state, so the
interpreter is dropped. The error still propagates; a 503 would read as warming and hide a
fault.
runs a fragment and parses the JSON object it printed
Keeps the interpreter warm.
Boot is per-DO-lifetime, not per-request: 3,754 ms of CPU on the edge, of which roughly 1 s of the residual has no identified lever. So the strategy cannot be "make boot fast", it has to be "boot rarely". An alarm is the only way a DO wakes itself, so it is the cold-start strategy rather than an optimisation.
The interval is a floor, not a guarantee: Cloudflare may still evict, and alarms are best-effort. It reduces cold starts, it does not remove them.
The meta table as a SecretStore, so the mint needs no Durable Object to test, with
sealed on key-value storage: the SQL bridge cannot read or write it.
the durable total plus what has not been paid for yet; for a read that must not write
Sets an alarm and remembers when it is due, so armFillAlarm() never believes a +1 ms alarm
survived a 240 s re-arm.
Moves this object's replica stage through canTransition, or refuses the move.
the stage now in force; unchanged when the transition was refused
Settles a purge a previous invocation recorded and did not finish; runs at boot too, so a dead invocation purges on the next.
Deletes the plans this invocation's tags invalidate and un-flags the rest; runs at the end, when the tag set is complete.
always false; see the summary
how many shells are stored for a path; 0 makes a seed the right move, not a retry
Whether this firing should pay for a daily-meter flush.
Two triggers: pending volume flushes at once, an idle warming tick waits for the interval.
Both come from meterFlushBudget() (the remaining budget), reaching 25 rows and 60 s at the
ceiling. The accumulator is in memory, so an eviction loses at most one interval of counting.
Whether this alarm firing should spend rows on garbage collection.
Fills and GC share the rows-written meter, so a waiting page outranks reclaiming disk; the interval gate exists because the measured steady state is 0 rows written.
Which site this object is, pinned like the origin (a shared bucket needs per-site mirror
keys, not the literal 'site').
Optionalobserved: stringOptionalopts: { chunkBytes?: number }One page of one table, as columns plus flat rows.
Uses OFFSET (a WITHOUT ROWID table has no rowid); unstable under a concurrent write,
which the receiving generation check refuses.
ponytail: O(n^2) over a whole table; a keyset cursor if a restore ever spans a large one
the version vector spool syncs from, created on first use at this generation; memory only
Flags every plan the moment content changes, before the tag set is known.
One wholesale UPDATE at the write, so an invocation that dies before
settlePlans leaves everything flagged. Not coalesced on bumpCoalesced, which only
fillOne() clears (a node save left plans in place on a site serving plans).
What the packed day row holds, else the four legacy keys (read-only, so an upgrade mid-day keeps the row budget the degrade guard reads).
the render window as it survived the last hibernation, or undefined if none is stored
Optionaloptions: { force?: boolean }The DDL that recreates one table, its own statement first and its indexes after.
sql IS NOT NULL drops sqlite's auto-indexes, which have no statement and are recreated with
the table anyway.
every table this object holds, in sqlite_master order
The idle re-arm this site's own traffic justifies.
Falls back to the configured interval when the predictor has nothing to say. The warm branch
is solved (climbing toward the ceiling on windows the object survived); an explicit
WARM_INTERVAL_MS wins.
One log line of memory readings when MEMORY_TRACE=1 (the platform only reports that the
isolate was reset).
Optionalopts: { maxChunks?: number }the paths a render has proven cannot be stored
One beat, acquiring the gate only when the caller does not already hold it.
The gate is a non-reentrant FIFO chain and fetch() already holds it; a second acquire
inside the router hangs forever. alarm() is its own event and needs the explicit acquire.
the one dependency bag every updb entry point takes; nothing here holds state
Advances a database-update run by one beat; updbStep() owns no transport, alarm or env, so
the dependency bag is built here.
the ceiling the warm solver may climb to; 9,500 unless WARM_CEILING_MS raises it
Which uploaded Worker version is answering; null under wrangler dev --local and in the
test lanes (not deployed, not unknown).
stores a credential in sealed storage, where the SQL bridge cannot read or write it
One site: the interpreter and the database in the same isolate.
ctx.storage.sqlis synchronous only inside the Durable Object and PHP's PDO blocks, so PHP must run here.