@10x-media/jobs 0.1.0-beta.0

package/dist/index.js

@@ -0,0 +1,1622 @@
+import { t as keys } from "./keys-BYs8GTJy.js";
+import { n as labelForKey } from "./server-JsvYf5vy.js";
+import { t as translations } from "./translations-KyQ3962W.js";
+import { t as deriveJobStatus } from "./deriveJobStatus-CM_sCsgm.js";
+import { ValidationError, definePlugin, getCurrentDate } from "payload";
+import { deepMergeSimple } from "payload/shared";
+import { hostname } from "node:os";
+//#region src/plugin/resolve.ts
+/** Apply an `Override`, falling back to `defaults` when none was provided. */
+const resolve = (override, defaults) => {
+	if (override === void 0) return defaults;
+	return typeof override === "function" ? override(defaults) : override;
+};
+//#endregion
+//#region src/plugin/registerJobsEnhancements.ts
+const STATUS_CELL = "@10x-media/jobs/client#JobStatusCell";
+const STATUS_HEADER = "@10x-media/jobs/client#JobStatusHeader";
+const RELATIVE_CELL = "@10x-media/jobs/client#RelativeTimeCell";
+const ERROR_PANEL = "@10x-media/jobs/client#JobErrorPanel";
+const LOG_TIMELINE = "@10x-media/jobs/client#JobLogTimeline";
+const DOC_DESCRIPTION = "@10x-media/jobs/client#JobDocDescription";
+const HEALTH_BAR = "@10x-media/jobs/rsc#JobsHealthBar";
+/** Stored field that titles the document: the workflow or task the job runs. */
+const TITLE_FIELD = {
+	name: "jobTitle",
+	type: "text",
+	admin: {
+		disableListColumn: true,
+		hidden: true
+	}
+};
+/**
+* Keep `jobTitle` in sync with the job's workflow or task on every write, falling
+* back to the existing doc so partial state updates never clobber it.
+*/
+const setJobTitle = ({ data, originalDoc }) => {
+	const source = {
+		...originalDoc ?? {},
+		...data
+	};
+	const workflow = typeof source.workflowSlug === "string" ? source.workflowSlug : void 0;
+	const task = typeof source.taskSlug === "string" ? source.taskSlug : void 0;
+	const title = workflow || task;
+	return title ? {
+		...data,
+		jobTitle: title
+	} : data;
+};
+/** Our default document Field component for specific job fields. */
+const FIELD_COMPONENTS = {
+	error: ERROR_PANEL,
+	log: LOG_TIMELINE
+};
+const DEFAULT_JOBS_COLUMNS = [
+	"workflowSlug",
+	"status",
+	"queue",
+	"totalTried",
+	"updatedAt"
+];
+/** Friendlier labels for a few of Payload's default job fields. */
+const FIELD_LABELS = {
+	totalTried: labelForKey(keys.fieldAttempts),
+	workflowSlug: labelForKey(keys.fieldWorkflow)
+};
+/**
+* Payload appends `createdAt`/`updatedAt` after overrides run, but only when they
+* are absent, so we inject our own to attach the relative-time cell to them.
+*/
+const TIMESTAMP_FIELDS = [{
+	name: "createdAt",
+	type: "date",
+	label: labelForKey(keys.fieldCreated),
+	index: true,
+	admin: {
+		disableBulkEdit: true,
+		hidden: true
+	}
+}, {
+	name: "updatedAt",
+	type: "date",
+	label: labelForKey(keys.fieldUpdated),
+	index: true,
+	admin: {
+		disableBulkEdit: true,
+		hidden: true
+	}
+}];
+const fieldName = (field) => "name" in field && typeof field.name === "string" ? field.name : void 0;
+const setCell = (field, cell) => ({
+	...field,
+	admin: {
+		...field.admin,
+		components: {
+			...field.admin?.components,
+			Cell: cell
+		}
+	}
+});
+/**
+* Resolve a field's list cell: an explicit `cells` override wins (`false` keeps
+* Payload's default), otherwise date fields get the relative-time cell.
+*/
+const resolveCell = (field, cells) => {
+	const name = fieldName(field);
+	const override = name ? cells?.[name] : void 0;
+	if (override === false) return field;
+	if (override) return setCell(field, override);
+	if (field.type === "date") return setCell(field, RELATIVE_CELL);
+	return field;
+};
+/** Execution-state fields surfaced in the header; hidden from the form, kept as data/columns. */
+const HIDE_ALWAYS = new Set([
+	"completedAt",
+	"totalTried",
+	"hasError",
+	"processing",
+	"taskStatus"
+]);
+/** Inputs shown only when creating a job; hidden once it exists. */
+const HIDE_ON_EDIT = new Set(["waitUntil"]);
+/** Execution output: read-only in the admin (admin-only, so the runner can still write it). */
+const READONLY_OUTPUTS = new Set(["error", "log"]);
+/** Config inputs: editable on Create, read-only on edit; kept in the sidebar. */
+const READONLY_INPUTS = new Set([
+	"input",
+	"workflowSlug",
+	"taskSlug",
+	"queue"
+]);
+/**
+* Lock a field for the read-only-record model. Runner-written fields use
+* admin-only props (`hidden`/`readOnly`) so the jobs runner is never blocked;
+* inputs use field `access.update` so they stay editable on Create but lock once
+* the job exists.
+*/
+const lockField = (field, name) => {
+	if (HIDE_ALWAYS.has(name)) return {
+		...field,
+		admin: {
+			...field.admin,
+			hidden: true
+		}
+	};
+	if (HIDE_ON_EDIT.has(name)) return {
+		...field,
+		admin: {
+			...field.admin,
+			condition: (_data, _siblingData, { operation }) => operation === "create"
+		}
+	};
+	if (READONLY_OUTPUTS.has(name)) return {
+		...field,
+		admin: {
+			...field.admin,
+			readOnly: true
+		}
+	};
+	if (READONLY_INPUTS.has(name)) {
+		const access = "access" in field && field.access ? field.access : {};
+		return {
+			...field,
+			access: {
+				...access,
+				update: () => false
+			}
+		};
+	}
+	return field;
+};
+/** Recursively relabel fields, apply cell overrides, and lock the record, descending into tabs. */
+const enhanceFields = (fields, cells, lockRecord) => fields.map((field) => {
+	let next = field;
+	const name = fieldName(field);
+	if (name && FIELD_LABELS[name]) next = {
+		...field,
+		label: FIELD_LABELS[name]
+	};
+	next = resolveCell(next, cells);
+	if (lockRecord && name) next = lockField(next, name);
+	if (name && FIELD_COMPONENTS[name]) next = {
+		...next,
+		admin: {
+			...next.admin,
+			components: {
+				...next.admin?.components,
+				Field: FIELD_COMPONENTS[name]
+			}
+		}
+	};
+	if ("tabs" in next) next = {
+		...next,
+		tabs: next.tabs.map((tab) => ({
+			...tab,
+			fields: enhanceFields(tab.fields, cells, lockRecord)
+		}))
+	};
+	else if ("fields" in next) next = {
+		...next,
+		fields: enhanceFields(next.fields, cells, lockRecord)
+	};
+	return next;
+});
+/** Build the derived Status column, honoring the `status` override (`false` removes it). */
+const buildStatusField = (status) => {
+	if (status === false) return null;
+	return {
+		name: "status",
+		type: "ui",
+		label: labelForKey(keys.fieldStatus),
+		admin: { components: {
+			Cell: status ?? STATUS_CELL,
+			Field: STATUS_HEADER
+		} }
+	};
+};
+/**
+* Enhance Payload's built-in `payload-jobs` collection through its sanctioned
+* `jobs.jobsCollectionOverrides` seam. Composes with a host-provided override
+* (ours layer on top of theirs) so neither clobbers the other, and every piece
+* is replaceable through `options` (`status`, `cells`, `beforeListTable`).
+*/
+const registerJobsEnhancements = (config, options) => {
+	const existing = config.jobs?.jobsCollectionOverrides;
+	const enhance = ({ defaultJobsCollection }) => {
+		const base = existing ? existing({ defaultJobsCollection }) : defaultJobsCollection;
+		const existingNames = new Set(base.fields.flatMap((field) => {
+			const name = fieldName(field);
+			return name ? [name] : [];
+		}));
+		const timestamps = TIMESTAMP_FIELDS.filter((field) => {
+			const name = fieldName(field);
+			return name ? !existingNames.has(name) : false;
+		}).map((field) => resolveCell(field, options.cells));
+		const statusField = buildStatusField(options.status);
+		const lockRecord = options.readOnlyRecord !== false;
+		const hostBeforeTable = base.admin?.components?.beforeListTable ?? [];
+		const ourBeforeTable = options.beforeListTable === false ? [] : options.beforeListTable ?? [{
+			path: HEALTH_BAR,
+			serverProps: { cap: options.healthBarCap }
+		}];
+		return {
+			...base,
+			admin: {
+				...base.admin,
+				hidden: options.hidden ?? false,
+				useAsTitle: "jobTitle",
+				defaultColumns: resolve(options.defaultColumns, DEFAULT_JOBS_COLUMNS),
+				components: {
+					...base.admin?.components,
+					Description: DOC_DESCRIPTION,
+					beforeListTable: [...hostBeforeTable, ...ourBeforeTable]
+				}
+			},
+			hooks: {
+				...base.hooks,
+				beforeChange: [...base.hooks?.beforeChange ?? [], setJobTitle]
+			},
+			fields: [
+				...statusField ? [statusField] : [],
+				TITLE_FIELD,
+				...enhanceFields(base.fields, options.cells, lockRecord),
+				...timestamps
+			]
+		};
+	};
+	config.jobs = {
+		...config.jobs,
+		jobsCollectionOverrides: enhance
+	};
+};
+//#endregion
+//#region src/plugin/registerTranslations.ts
+/**
+* Merge this plugin's translations into the host config. A host value wins on
+* conflict (`deepMergeSimple` lets the second argument override), so projects can
+* override any string.
+*/
+const registerTranslations = (config) => {
+	config.i18n ??= {};
+	config.i18n.translations = deepMergeSimple(translations, config.i18n.translations ?? {});
+};
+//#endregion
+//#region src/queueControl/access.ts
+/** The default endpoint guard: logged-in users only (safer than Payload's open default). */
+const loggedInAccess = ({ req }) => Boolean(req.user);
+/**
+* An access checker for serverless cron triggers: a logged-in user passes, otherwise
+* the request must carry `Authorization: Bearer ${process.env[envVar]}`. Payload ships
+* no built-in secret check, so this implements the canonical Vercel-cron pattern.
+*/
+const cronSecretAccess = (options = {}) => {
+	const envVar = options.envVar ?? "CRON_SECRET";
+	return ({ req }) => {
+		if (req.user) return true;
+		const secret = process.env[envVar];
+		if (!secret) return false;
+		return req.headers.get("authorization") === `Bearer ${secret}`;
+	};
+};
+//#endregion
+//#region src/queueControl/options.ts
+/** Resolve queue-control options to a fully-defaulted object, or `null` when disabled. */
+const resolveQueueControlOptions = (options) => {
+	if (options === void 0 || options === false) return null;
+	return {
+		access: options.access ?? loggedInAccess,
+		queues: options.queues ?? ["default"]
+	};
+};
+//#endregion
+//#region src/reliability/leaseLogic.ts
+/** The expiry instant for a lease acquired/renewed at `now` for `ttlMs`. */
+const leaseExpiry = (now, ttlMs) => new Date(now.getTime() + ttlMs);
+//#endregion
+//#region src/reliability/jobLeaseStore.mongo.ts
+const JOBS_SLUG$4 = "payload-jobs";
+/** Reach the raw Mongoose model the adapter exposes on `db.collections[slug]`. */
+const model$1 = (payload) => {
+	const found = payload.db.collections[JOBS_SLUG$4];
+	if (!found) throw new Error(`@10x-media/jobs: missing Mongoose model for "${JOBS_SLUG$4}"`);
+	return found;
+};
+/** The stale-orphan predicate shared by requeue and dead-letter. */
+const stale = (now, fallbackMs) => ({
+	hasError: { $ne: true },
+	processing: true,
+	$or: [{ leaseExpiresAt: { $lt: now } }, {
+		leaseExpiresAt: null,
+		updatedAt: { $lt: new Date(now.getTime() - fallbackMs) }
+	}]
+});
+/** Single-document `findOneAndUpdate` is an atomic compare-and-set on MongoDB. */
+const createMongoJobLeaseStore = (payload) => {
+	const m = model$1(payload);
+	return {
+		deadLetter: async ({ error, fallbackMs, jobId, now }) => {
+			return { ok: await m.findOneAndUpdate({
+				_id: jobId,
+				...stale(now, fallbackMs)
+			}, {
+				$inc: { fenceToken: 1 },
+				$set: {
+					claimedBy: null,
+					error,
+					hasError: true,
+					leaseExpiresAt: null,
+					processing: false
+				}
+			}, { new: true }) !== null };
+		},
+		read: async (jobId) => {
+			const doc = await m.findOne({ _id: jobId }).lean();
+			if (doc === null) return null;
+			return {
+				claimedBy: doc.claimedBy ?? null,
+				fenceToken: doc.fenceToken ?? 0,
+				leaseExpiresAt: doc.leaseExpiresAt ? new Date(doc.leaseExpiresAt) : null,
+				processing: doc.processing === true,
+				recoveryAttempts: doc.recoveryAttempts ?? 0,
+				updatedAt: doc.updatedAt ? new Date(doc.updatedAt) : /* @__PURE__ */ new Date(0)
+			};
+		},
+		renew: async (jobId, fenceToken, ttlMs, now) => {
+			return { ok: await m.findOneAndUpdate({
+				_id: jobId,
+				fenceToken
+			}, { $set: { leaseExpiresAt: leaseExpiry(now, ttlMs) } }, { new: true }) !== null };
+		},
+		releaseAllClaims: async (owner) => {
+			return { released: (await m.updateMany({
+				claimedBy: owner,
+				processing: true
+			}, {
+				$inc: {
+					fenceToken: 1,
+					recoveryAttempts: 1
+				},
+				$set: {
+					claimedBy: null,
+					leaseExpiresAt: null,
+					processing: false,
+					waitUntil: null
+				}
+			})).modifiedCount ?? 0 };
+		},
+		requeue: async (jobId, now, fallbackMs) => {
+			return { ok: await m.findOneAndUpdate({
+				_id: jobId,
+				...stale(now, fallbackMs)
+			}, {
+				$inc: {
+					fenceToken: 1,
+					recoveryAttempts: 1
+				},
+				$set: {
+					claimedBy: null,
+					leaseExpiresAt: null,
+					processing: false,
+					waitUntil: null
+				}
+			}, { new: true }) !== null };
+		},
+		stampClaim: async (jobId, owner, ttlMs, now) => {
+			const doc = await m.findOneAndUpdate({
+				_id: jobId,
+				processing: true
+			}, {
+				$inc: { fenceToken: 1 },
+				$set: {
+					claimedBy: owner,
+					leaseExpiresAt: leaseExpiry(now, ttlMs),
+					startedAt: now
+				}
+			}, { new: true });
+			return {
+				fenceToken: doc?.fenceToken ?? 0,
+				ok: doc !== null
+			};
+		}
+	};
+};
+//#endregion
+//#region src/reliability/jobLeaseStore.postgres.ts
+const JOBS_SLUG$3 = "payload-jobs";
+/** Payload tables for kebab slugs are the slug with hyphens replaced by underscores. */
+const tableName$1 = (payload) => {
+	const defaultTable = JOBS_SLUG$3.replace(/-/g, "_");
+	const map = payload.db.tableNameMap;
+	return (map && typeof map.get === "function" ? map.get(defaultTable) : void 0) ?? defaultTable;
+};
+const pool$1 = (payload) => {
+	const found = payload.db.pool;
+	if (!found) throw new Error(`@10x-media/jobs: missing pg pool on the "${payload.db.name}" adapter`);
+	return found;
+};
+/** Single-statement `UPDATE ... WHERE <guard> RETURNING` is atomic under READ COMMITTED. */
+const createPostgresJobLeaseStore = (payload) => {
+	const table = tableName$1(payload);
+	const db = pool$1(payload);
+	const staleGuard = "processing = true AND has_error IS NOT TRUE AND (lease_expires_at < $2 OR (lease_expires_at IS NULL AND updated_at < $3))";
+	return {
+		deadLetter: async ({ error, fallbackMs, jobId, now }) => {
+			return { ok: (await db.query(`UPDATE ${table}
+				 SET processing = false, has_error = true, error = $4::jsonb,
+				     lease_expires_at = NULL, claimed_by = NULL, fence_token = COALESCE(fence_token, 0) + 1
+				 WHERE id = $1 AND ${staleGuard}
+				 RETURNING id`, [
+				jobId,
+				now,
+				new Date(now.getTime() - fallbackMs),
+				JSON.stringify(error)
+			])).rowCount === 1 };
+		},
+		read: async (jobId) => {
+			const row = (await db.query(`SELECT processing, lease_expires_at, claimed_by, fence_token, recovery_attempts, updated_at
+				 FROM ${table} WHERE id = $1`, [jobId])).rows[0];
+			if (row === void 0) return null;
+			return {
+				claimedBy: row.claimed_by ?? null,
+				fenceToken: Number(row.fence_token ?? 0),
+				leaseExpiresAt: row.lease_expires_at ? new Date(row.lease_expires_at) : null,
+				processing: row.processing === true,
+				recoveryAttempts: Number(row.recovery_attempts ?? 0),
+				updatedAt: row.updated_at ? new Date(row.updated_at) : /* @__PURE__ */ new Date(0)
+			};
+		},
+		renew: async (jobId, fenceToken, ttlMs, now) => {
+			return { ok: (await db.query(`UPDATE ${table} SET lease_expires_at = $1
+				 WHERE id = $2 AND fence_token = $3
+				 RETURNING id`, [
+				leaseExpiry(now, ttlMs),
+				jobId,
+				fenceToken
+			])).rowCount === 1 };
+		},
+		releaseAllClaims: async (owner) => {
+			return { released: (await db.query(`UPDATE ${table}
+				 SET processing = false, claimed_by = NULL, lease_expires_at = NULL, wait_until = NULL,
+				     recovery_attempts = COALESCE(recovery_attempts, 0) + 1,
+				     fence_token = COALESCE(fence_token, 0) + 1
+				 WHERE claimed_by = $1 AND processing = true
+				 RETURNING id`, [owner])).rowCount ?? 0 };
+		},
+		requeue: async (jobId, now, fallbackMs) => {
+			return { ok: (await db.query(`UPDATE ${table}
+				 SET processing = false, lease_expires_at = NULL, claimed_by = NULL, wait_until = NULL,
+				     recovery_attempts = COALESCE(recovery_attempts, 0) + 1,
+				     fence_token = COALESCE(fence_token, 0) + 1
+				 WHERE id = $1 AND ${staleGuard}
+				 RETURNING id`, [
+				jobId,
+				now,
+				new Date(now.getTime() - fallbackMs)
+			])).rowCount === 1 };
+		},
+		stampClaim: async (jobId, owner, ttlMs, now) => {
+			const res = await db.query(`UPDATE ${table}
+				 SET started_at = $1, claimed_by = $2, lease_expires_at = $3,
+				     fence_token = COALESCE(fence_token, 0) + 1
+				 WHERE id = $4 AND processing = true
+				 RETURNING fence_token`, [
+				now,
+				owner,
+				leaseExpiry(now, ttlMs),
+				jobId
+			]);
+			const ok = res.rowCount === 1;
+			return {
+				fenceToken: ok ? Number(res.rows[0]?.fence_token) : 0,
+				ok
+			};
+		}
+	};
+};
+//#endregion
+//#region src/reliability/jobLeaseStore.ts
+/** Build the job-lease store for the running adapter. Throws for an unsupported adapter. */
+const createJobLeaseStore = (payload) => {
+	if (payload.db.name === "mongoose") return createMongoJobLeaseStore(payload);
+	if (payload.db.name === "postgres") return createPostgresJobLeaseStore(payload);
+	throw new Error(`@10x-media/jobs reliability does not support db adapter "${payload.db.name}"`);
+};
+//#endregion
+//#region src/reliability/leaseMode.ts
+/**
+* Heartbeat mode renews a running job's lease from a side timer. Serverless mode
+* never renews (the function is hard-killed at maxDuration with no SIGTERM), so the
+* stamp encodes the platform limit and the sweeper recovers from it.
+*/
+const isHeartbeatMode = (options) => options.serverlessMaxDurationMs === null;
+/**
+* The lease TTL stamped when a worker claims a job, and the grace used to age out a
+* claimed-but-never-stamped (null lease) job by its updatedAt. In serverless mode
+* this is the platform hard-kill duration; otherwise the configured job lease TTL.
+*/
+const initialLeaseTtlMs = (options) => options.serverlessMaxDurationMs ?? options.jobLeaseTtlMs;
+//#endregion
+//#region src/reliability/recoveryDecision.ts
+/**
+* Requeue an orphaned job while it is below the recovery cap; dead-letter once it
+* reaches the cap, to stop a poison job from thrashing the queue. `recoveryAttempts`
+* is the count before this pass (a requeue increments it). `maxRecoveries` of 0
+* dead-letters on the first orphan.
+*/
+const decideRecovery = (recoveryAttempts, maxRecoveries) => recoveryAttempts < maxRecoveries ? "requeue" : "deadLetter";
+//#endregion
+//#region src/reliability/sweeper.ts
+const JOBS_SLUG$2 = "payload-jobs";
+/** The dead-letter error payload written when a job reaches the recovery cap. */
+const deadLetterError = (attempts) => ({
+	cancelled: false,
+	message: `@10x-media/jobs sweeper: dead-lettered after reaching the recovery cap (${attempts} attempts)`,
+	recovered: false
+});
+/**
+* One sweep pass: find stale `processing: true` orphans and either requeue them
+* (below the recovery cap) or dead-letter them (at the cap), each through a fenced
+* conditional write that re-checks staleness, so a job that renewed between the find
+* and the write is skipped and two overlapping sweepers never both reclaim the same
+* orphan. Gated by leadership: callers pass `isLeader` from the Plan 1 sweeper lease.
+*/
+const runSweep = async (args) => {
+	const { isLeader = true, limit = 100, options, payload } = args;
+	const result = {
+		deadLettered: 0,
+		requeued: 0,
+		scanned: 0
+	};
+	if (!isLeader) return result;
+	const now = args.now ?? getCurrentDate();
+	const store = args.store ?? createJobLeaseStore(payload);
+	const fallbackMs = initialLeaseTtlMs(options);
+	const cutoff = new Date(now.getTime() - fallbackMs).toISOString();
+	const where = { and: [
+		{ processing: { equals: true } },
+		{ completedAt: { exists: false } },
+		{ hasError: { not_equals: true } },
+		{ or: [{ leaseExpiresAt: { less_than: now.toISOString() } }, { and: [{ leaseExpiresAt: { exists: false } }, { updatedAt: { less_than: cutoff } }] }] }
+	] };
+	const find = payload.find;
+	const { docs } = await find({
+		collection: JOBS_SLUG$2,
+		depth: 0,
+		limit,
+		where
+	});
+	result.scanned = docs.length;
+	for (const doc of docs) {
+		const attempts = typeof doc.recoveryAttempts === "number" ? doc.recoveryAttempts : 0;
+		if (decideRecovery(attempts, options.maxRecoveries) === "requeue") {
+			if ((await store.requeue(doc.id, now, fallbackMs)).ok) result.requeued += 1;
+		} else if ((await store.deadLetter({
+			error: deadLetterError(attempts),
+			fallbackMs,
+			jobId: doc.id,
+			now
+		})).ok) result.deadLettered += 1;
+	}
+	return result;
+};
+//#endregion
+//#region src/queueControl/pauseState.ts
+/** The default (nothing paused) state. */
+const emptyPauseState = () => ({
+	global: false,
+	queues: []
+});
+/** Pause everything (no queue) or a single queue (idempotent). */
+const applyPause = (state, queue) => {
+	if (queue === void 0) return {
+		...state,
+		global: true
+	};
+	return state.queues.includes(queue) ? state : {
+		...state,
+		queues: [...state.queues, queue]
+	};
+};
+/** Resume everything (no queue, clears the global flag) or a single queue. */
+const applyResume = (state, queue) => {
+	if (queue === void 0) return {
+		...state,
+		global: false
+	};
+	return {
+		...state,
+		queues: state.queues.filter((q) => q !== queue)
+	};
+};
+/** Whether `queue` is currently paused (a global pause covers every queue). */
+const isPaused = (state, queue) => state.global || state.queues.includes(queue);
+//#endregion
+//#region src/queueControl/pauseStore.ts
+const PAUSE_KEY = "@10x-media/jobs:pause-state";
+/**
+* Build the pause store over `payload.kv` (always available, durable, cluster-wide).
+* Pause and resume read-modify-write the single state value; this is last-writer-wins
+* (kv has no atomic compare-and-set), which is acceptable for rare admin actions.
+*/
+const createPauseStore = (payload) => {
+	const getState = async () => await payload.kv.get(PAUSE_KEY) ?? emptyPauseState();
+	return {
+		getState,
+		isPaused: async (queue) => isPaused(await getState(), queue),
+		pause: async (queue) => {
+			await payload.kv.set(PAUSE_KEY, applyPause(await getState(), queue));
+		},
+		resume: async (queue) => {
+			await payload.kv.set(PAUSE_KEY, applyResume(await getState(), queue));
+		}
+	};
+};
+//#endregion
+//#region src/queueControl/queueHealth.ts
+const JOBS_SLUG$1 = "payload-jobs";
+const STATS_SLUG = "payload-jobs-stats";
+const queueClause = (queue) => queue ? [{ queue: { equals: queue } }] : [];
+const pendingWhere = (queue) => ({ and: [
+	{ completedAt: { exists: false } },
+	{ hasError: { not_equals: true } },
+	{ processing: { equals: false } },
+	...queueClause(queue)
+] });
+const processingWhere = (queue) => ({ and: [{ processing: { equals: true } }, ...queueClause(queue)] });
+const failedWhere = (queue) => ({ and: [{ hasError: { equals: true } }, ...queueClause(queue)] });
+const recoveredWhere = (queue) => ({ and: [{ recoveryAttempts: { greater_than: 0 } }, ...queueClause(queue)] });
+const readStats = async (payload) => {
+	const db = payload.db;
+	try {
+		return await db.findGlobal({ slug: STATS_SLUG });
+	} catch {
+		return null;
+	}
+};
+const lastScheduledRunFor = (stats, queue) => {
+	const entry = stats?.stats?.scheduledRuns?.queues?.[queue];
+	if (!entry) return null;
+	const runs = [...Object.values(entry.tasks ?? {}), ...Object.values(entry.workflows ?? {})].map((r) => r.lastScheduledRun).filter((r) => typeof r === "string");
+	return runs.length > 0 ? runs.sort().at(-1) ?? null : null;
+};
+/**
+* Aggregate queue health via `payload.count` per state (pending, processing, failed,
+* and, when reliability is on, recovered), plus the oldest-pending age and the last
+* scheduled run per queue. Reuses Payload's own run-selector predicates. The stats
+* global is read through `payload.db.findGlobal` inside a try/catch because that call
+* throws when the global does not exist (no schedule has run).
+*/
+const getQueueHealth = async (payload, options = {}) => {
+	const queues = options.queues ?? ["default"];
+	const includeRecovered = options.includeRecovered ?? false;
+	const count = payload.count;
+	const find = payload.find;
+	const countWhere = async (where) => (await count({
+		collection: JOBS_SLUG$1,
+		where
+	})).totalDocs;
+	const totals = {
+		failed: await countWhere(failedWhere()),
+		pending: await countWhere(pendingWhere()),
+		processing: await countWhere(processingWhere()),
+		recovered: includeRecovered ? await countWhere(recoveredWhere()) : 0
+	};
+	const oldestCreated = (await find({
+		collection: JOBS_SLUG$1,
+		depth: 0,
+		limit: 1,
+		sort: "createdAt",
+		where: pendingWhere()
+	})).docs[0]?.createdAt;
+	const nowMs = (options.now ?? /* @__PURE__ */ new Date()).getTime();
+	const oldestPendingAgeMs = oldestCreated ? nowMs - new Date(oldestCreated).getTime() : null;
+	const stats = await readStats(payload);
+	const perQueue = [];
+	for (const queue of queues) perQueue.push({
+		failed: await countWhere(failedWhere(queue)),
+		lastScheduledRun: lastScheduledRunFor(stats, queue),
+		pending: await countWhere(pendingWhere(queue)),
+		processing: await countWhere(processingWhere(queue)),
+		queue,
+		recovered: includeRecovered ? await countWhere(recoveredWhere(queue)) : 0
+	});
+	return {
+		oldestPendingAgeMs,
+		queues: perQueue,
+		totals
+	};
+};
+//#endregion
+//#region src/queueControl/runTargets.ts
+/**
+* Compute the run targets for one cycle, given the worker's configured queues (or
+* undefined for all queues) and the current pause state. A global pause yields no
+* targets. A specific queue list drops the paused queues. All-queues running excludes
+* paused queues via `not_in` paired with `allQueues: true` (the exclusion requires
+* allQueues, because Payload's built-in single-queue filter only applies otherwise).
+*/
+const runTargetsForPause = (queues, state) => {
+	if (state.global) return [];
+	if (queues && queues.length > 0) return queues.filter((queue) => !state.queues.includes(queue)).map((queue) => ({ queue }));
+	if (state.queues.length > 0) return [{
+		allQueues: true,
+		where: { queue: { not_in: state.queues } }
+	}];
+	return [{ allQueues: true }];
+};
+//#endregion
+//#region src/queueControl/endpoints.ts
+const unauthorized = () => Response.json({ message: "Unauthorized" }, { status: 401 });
+/** GET queue health, grouped by queue. */
+const statusEndpoint = (deps) => ({
+	handler: async (req) => {
+		if (!await deps.access({ req })) return unauthorized();
+		const report = await getQueueHealth(req.payload, {
+			includeRecovered: deps.reliability !== null,
+			queues: deps.queues
+		});
+		return Response.json(report, { status: 200 });
+	},
+	method: "get",
+	path: "/queue-status"
+});
+/** GET a hardened, pause-aware run. Mirrors the native run params. */
+const runControlEndpoint = (deps) => ({
+	handler: async (req) => {
+		if (!await deps.access({ req })) return unauthorized();
+		const query = req.query;
+		const limit = query.limit ? Number(query.limit) : void 0;
+		const silent = query.silent === "true";
+		const state = await createPauseStore(req.payload).getState();
+		const targets = runTargetsForPause(query.allQueues === "true" ? void 0 : [query.queue ?? "default"], state);
+		if (query.disableScheduling !== "true") await req.payload.jobs.handleSchedules({ allQueues: true });
+		const results = [];
+		for (const target of targets) results.push(await req.payload.jobs.run({
+			...target,
+			...limit !== void 0 ? { limit } : {},
+			silent
+		}));
+		return Response.json({
+			paused: state,
+			ran: targets.length,
+			results
+		}, { status: 200 });
+	},
+	method: "get",
+	path: "/queue-run"
+});
+/** GET a one-shot sweep for serverless (one cron invocation, so no leader election). */
+const sweepEndpoint = (deps) => ({
+	handler: async (req) => {
+		if (!await deps.access({ req })) return unauthorized();
+		if (!deps.reliability) return Response.json({ message: "reliability is not enabled; the sweeper is unavailable" }, { status: 400 });
+		const result = await runSweep({
+			isLeader: true,
+			options: deps.reliability,
+			payload: req.payload,
+			store: createJobLeaseStore(req.payload)
+		});
+		return Response.json(result, { status: 200 });
+	},
+	method: "get",
+	path: "/queue-sweep"
+});
+//#endregion
+//#region src/queueControl/registerQueueControl.ts
+/**
+* Register the queue-control layer: harden the native run endpoint by setting
+* `jobs.access.run` to the configured checker, and add the status, hardened-run, and
+* sweep endpoints to `payload-jobs` through the same `jobsCollectionOverrides` seam the
+* reliability and observability layers use (composing, never clobbering).
+*/
+const registerQueueControl = (config, options, reliability) => {
+	const deps = {
+		access: options.access,
+		queues: options.queues,
+		reliability
+	};
+	const controlEndpoints = [
+		statusEndpoint(deps),
+		runControlEndpoint(deps),
+		sweepEndpoint(deps)
+	];
+	const existingOverride = config.jobs?.jobsCollectionOverrides;
+	config.jobs = {
+		...config.jobs,
+		access: {
+			...config.jobs?.access,
+			run: options.access
+		},
+		jobsCollectionOverrides: ({ defaultJobsCollection }) => {
+			const base = existingOverride ? existingOverride({ defaultJobsCollection }) : defaultJobsCollection;
+			const baseEndpoints = Array.isArray(base.endpoints) ? base.endpoints : [];
+			return {
+				...base,
+				endpoints: [...baseEndpoints, ...controlEndpoints]
+			};
+		}
+	};
+};
+//#endregion
+//#region src/reliability/options.ts
+/** Resolve user reliability options to a fully-defaulted object, or `null` when disabled. */
+const resolveReliabilityOptions = (options) => {
+	if (options === void 0 || options === false) return null;
+	const jobLeaseTtlMs = options.jobLeaseTtlMs ?? 3e5;
+	return {
+		heartbeatIntervalMs: options.heartbeatIntervalMs ?? Math.floor(jobLeaseTtlMs / 3),
+		jobLeaseTtlMs,
+		leaderId: options.leaderId ?? null,
+		leaderLeaseTtlMs: options.leaderLeaseTtlMs ?? 3e4,
+		maxRecoveries: options.maxRecoveries ?? 3,
+		requireConcurrencyControl: options.requireConcurrencyControl ?? false,
+		serverlessMaxDurationMs: options.serverless?.maxDurationMs ?? null,
+		sweepIntervalMs: options.sweepIntervalMs ?? 6e4
+	};
+};
+//#endregion
+//#region src/reliability/concurrencyContract.ts
+/**
+* When `reliability.requireConcurrencyControl` is set, refuse to start unless
+* Payload's own `jobs.enableConcurrencyControl` is on. The at-least-once contract
+* relies on it for app-level mutual exclusion under multi-node, and enabling it
+* changes the jobs schema (adds a `concurrencyKey` field), so we fail loudly rather
+* than silently mutate the adopter's schema. The config parameter is a structural
+* subset (Payload's `Config` satisfies it), which keeps the function trivial to unit
+* test with a plain object literal.
+*/
+const enforceConcurrencyControl = (config, options) => {
+	if (!options.requireConcurrencyControl) return;
+	if (config.jobs?.enableConcurrencyControl === true) return;
+	throw new Error("@10x-media/jobs: reliability.requireConcurrencyControl is set but jobs.enableConcurrencyControl is not true. Enable it in your Payload config (it adds a concurrencyKey field, so run a migration) or unset requireConcurrencyControl.");
+};
+/**
+* Wrap a job handler so its side effect runs at most once per idempotency key, even
+* when at-least-once delivery re-runs the job. The race this guards is not only
+* redelivery: when the sweeper requeues a job whose lease expired while it was still
+* running, the original execution cannot be aborted (Payload exposes no AbortSignal),
+* so a second worker can run the handler concurrently with the first. Key on the
+* stable unit of work, never the job id, so both executions resolve to the same key.
+* The check and the mark are the caller's to make transactional (Payload's queue and
+* the app data share one database, which makes that natural); this helper only
+* sequences them around the handler. A skipped run returns `{ output: {} }`.
+*/
+const withIdempotencyKey = (handler, idem) => {
+	return async (args) => {
+		const key = idem.keyFor(args);
+		if (await idem.store.has(key)) return { output: {} };
+		const out = await handler(args);
+		await idem.store.mark(key);
+		return out;
+	};
+};
+//#endregion
+//#region src/reliability/fields.ts
+/**
+* Fields added to the built-in `payload-jobs` collection (via jobsCollectionOverrides)
+* when reliability is enabled. `leaseExpiresAt` is the liveness signal renewed by the
+* worker heartbeat; the sweeper reclaims a job when `leaseExpiresAt < now`. All are
+* sidebar, read-only-in-admin diagnostics (the runtime, not a human, writes them).
+*/
+const reliabilityJobFields = () => [
+	{
+		name: "startedAt",
+		type: "date",
+		admin: {
+			position: "sidebar",
+			readOnly: true
+		},
+		index: true
+	},
+	{
+		name: "leaseExpiresAt",
+		type: "date",
+		admin: {
+			position: "sidebar",
+			readOnly: true
+		},
+		index: true
+	},
+	{
+		name: "claimedBy",
+		type: "text",
+		admin: {
+			position: "sidebar",
+			readOnly: true
+		},
+		index: true
+	},
+	{
+		name: "fenceToken",
+		type: "number",
+		admin: {
+			position: "sidebar",
+			readOnly: true
+		}
+	},
+	{
+		name: "recoveryAttempts",
+		type: "number",
+		admin: {
+			position: "sidebar",
+			readOnly: true
+		},
+		defaultValue: 0
+	}
+];
+//#endregion
+//#region src/reliability/heartbeat.ts
+/**
+* Wrap one job handler so the job keeps its lease fresh while it runs. On entry the
+* wrapper stamps the just-claimed row (fenced on `processing = true`) and, in
+* heartbeat mode, renews the lease on a self-scheduling timer at
+* `heartbeatIntervalMs`. A renew that matches nothing means the sweeper reclaimed the
+* job (its fence token moved): the wrapper records the loss, warns, and stops
+* renewing, but cannot abort an opaque handler (Payload exposes no AbortSignal), so
+* correctness under that race is the idempotency contract's job. The timer is always
+* cleared in `finally`. If the initial stamp fails (already completed, cancelled, or
+* reclaimed) the handler still runs, just without a heartbeat.
+*/
+const withHeartbeat = (args) => {
+	const { getStore, handler, onLeaseLost, options, ownerId } = args;
+	const ttlMs = initialLeaseTtlMs(options);
+	const beats = isHeartbeatMode(options);
+	const intervalMs = options.heartbeatIntervalMs;
+	return async (handlerArgs) => {
+		const payload = handlerArgs.req.payload;
+		const jobId = handlerArgs.job.id;
+		const store = getStore(payload);
+		const stamp = await store.stampClaim(jobId, ownerId, ttlMs, getCurrentDate());
+		if (!stamp.ok) return handler(handlerArgs);
+		const fence = stamp.fenceToken;
+		let done = false;
+		let timer;
+		const tick = async () => {
+			if (done) return;
+			let ok = true;
+			try {
+				ok = (await store.renew(jobId, fence, ttlMs, getCurrentDate())).ok;
+			} catch (err) {
+				payload.logger?.warn(`@10x-media/jobs: heartbeat renew error for job ${jobId}: ${String(err)}`);
+				schedule();
+				return;
+			}
+			if (!ok) {
+				payload.logger?.warn(`@10x-media/jobs: lost lease for job ${jobId} (reclaimed)`);
+				onLeaseLost?.(jobId);
+				return;
+			}
+			schedule();
+		};
+		function schedule() {
+			if (done) return;
+			timer = setTimeout(() => {
+				tick();
+			}, intervalMs);
+		}
+		if (beats) schedule();
+		try {
+			return await handler(handlerArgs);
+		} finally {
+			done = true;
+			if (timer) clearTimeout(timer);
+		}
+	};
+};
+/**
+* Wrap every task and workflow handler on the config with the heartbeat. Only
+* function handlers are wrapped (Payload also allows a string path for controlled
+* handlers, which we leave alone). One job-lease store is reused per Payload instance
+* via a WeakMap. All other task and workflow properties are preserved.
+*/
+const registerHeartbeat = (config, options, ownerId) => {
+	const jobs = config.jobs;
+	if (!jobs) return;
+	const storeCache = /* @__PURE__ */ new WeakMap();
+	const getStore = (payload) => {
+		const hit = storeCache.get(payload);
+		if (hit) return hit;
+		const store = createJobLeaseStore(payload);
+		storeCache.set(payload, store);
+		return store;
+	};
+	const wrapEntry = (entry) => {
+		if (typeof entry.handler !== "function") return entry;
+		const wrapped = withHeartbeat({
+			getStore,
+			handler: entry.handler,
+			options,
+			ownerId
+		});
+		return {
+			...entry,
+			handler: wrapped
+		};
+	};
+	if (Array.isArray(jobs.tasks)) jobs.tasks = jobs.tasks.map(wrapEntry);
+	if (Array.isArray(jobs.workflows)) jobs.workflows = jobs.workflows.map(wrapEntry);
+};
+//#endregion
+//#region src/reliability/locksCollection.ts
+/** Slug of the plugin-owned leases collection. Table name: payload_jobs_locks. */
+const JOBS_LOCKS_SLUG = "payload-jobs-locks";
+/** The two singleton leadership roles. */
+const LEADER_ROLES = ["scheduler", "sweeper"];
+/**
+* A hidden collection holding one row per leadership role. Acquire/renew/steal are
+* conditional updates against these rows (see the lease store). Not edit-locked,
+* not shown in admin, and access is closed by default (the plugin mutates it
+* directly through the db adapter, never the REST/GraphQL API).
+*/
+const buildJobsLocksCollection = () => ({
+	slug: JOBS_LOCKS_SLUG,
+	access: {
+		create: () => false,
+		delete: () => false,
+		read: () => false,
+		update: () => false
+	},
+	admin: { hidden: true },
+	fields: [
+		{
+			name: "role",
+			type: "text",
+			index: true,
+			required: true,
+			unique: true
+		},
+		{
+			name: "owner",
+			type: "text"
+		},
+		{
+			name: "leaseExpiresAt",
+			type: "date"
+		},
+		{
+			name: "fenceToken",
+			type: "number",
+			defaultValue: 0,
+			required: true
+		}
+	],
+	lockDocuments: false
+});
+//#endregion
+//#region src/reliability/nodeId.ts
+/**
+* A stable-per-process identity for job claims and leadership. An explicit
+* `leaderId` wins; otherwise derive `hostname:pid`, which is stable within a process
+* and distinguishes nodes in a cluster.
+*/
+const resolveNodeId = (leaderId) => leaderId ?? `${hostname()}:${process.pid}`;
+//#endregion
+//#region src/reliability/registerReliability.ts
+/** Idempotently ensure one lock row per leadership role. Race-safe via the unique `role`. */
+const ensureLockRows = async (payload) => {
+	const create = payload.create;
+	for (const role of LEADER_ROLES) try {
+		await create({
+			collection: JOBS_LOCKS_SLUG,
+			data: {
+				fenceToken: 0,
+				leaseExpiresAt: null,
+				owner: null,
+				role
+			},
+			overrideAccess: true
+		});
+	} catch (err) {
+		if (!(err instanceof ValidationError)) throw err;
+	}
+};
+/**
+* Register the reliability layer on the incoming config: add diagnostic fields to
+* `payload-jobs` through the same `jobsCollectionOverrides` seam the observability
+* layer uses (composing, never clobbering), add the locks collection, and ensure the
+* lock rows at init (preserving any host onInit).
+*/
+const registerReliability = (config, options) => {
+	enforceConcurrencyControl(config, options);
+	const existingOverride = config.jobs?.jobsCollectionOverrides;
+	config.jobs = {
+		...config.jobs,
+		jobsCollectionOverrides: ({ defaultJobsCollection }) => {
+			const base = existingOverride ? existingOverride({ defaultJobsCollection }) : defaultJobsCollection;
+			return {
+				...base,
+				fields: [...base.fields, ...reliabilityJobFields()]
+			};
+		}
+	};
+	config.collections = [...config.collections ?? [], buildJobsLocksCollection()];
+	const previousOnInit = config.onInit;
+	config.onInit = async (payload) => {
+		await previousOnInit?.(payload);
+		await ensureLockRows(payload);
+	};
+	registerHeartbeat(config, options, resolveNodeId(options.leaderId));
+};
+//#endregion
+//#region src/execution/autoRunConfig.ts
+const DEFAULT_CRON = "* * * * *";
+const DEFAULT_LIMIT = 10;
+/**
+* Build a production `jobs.autoRun` array: one Croner config per queue, silent by
+* default, with Payload's own `protect: true` preventing overlap. This is the simple
+* single-node and serverless-adjacent path where native autoRun safely handles both
+* scheduling and running in one process. Multi-node deployments use `createWorker`
+* instead, because native autoRun cannot gate scheduling to one elected leader (its
+* only dynamic lever, `shouldAutoRun`, permanently stops the cron rather than pausing).
+*/
+const autoRunConfig = (options = {}) => {
+	const { disableScheduling = false, queues = [{ queue: "default" }], silent = true } = options;
+	return queues.map((q) => ({
+		cron: q.cron ?? DEFAULT_CRON,
+		disableScheduling,
+		limit: q.limit ?? DEFAULT_LIMIT,
+		queue: q.queue,
+		silent
+	}));
+};
+//#endregion
+//#region src/execution/drain.ts
+/**
+* Run the graceful-drain sequence: stop claiming, await this node's in-flight jobs up
+* to a wall-clock budget, requeue any stragglers, release leadership, and destroy. The
+* clock (`now`/`sleep`) is injected so tests drive it deterministically without real
+* waiting. Always releases leadership and destroys, even when nothing was in flight.
+*/
+const drainWorker = async (deps, options) => {
+	deps.stopLoops();
+	const start = deps.now();
+	const inFlightAtStart = await deps.countInFlight();
+	let remaining = inFlightAtStart;
+	while (remaining > 0 && deps.now() - start < options.drainTimeoutMs) {
+		await deps.sleep(options.pollIntervalMs);
+		remaining = await deps.countInFlight();
+	}
+	const timedOut = remaining > 0;
+	const requeued = timedOut ? await deps.requeueStragglers() : 0;
+	await deps.releaseLeadership();
+	await deps.destroy();
+	deps.logger?.info?.(`@10x-media/jobs: drain complete (started ${inFlightAtStart}, requeued ${requeued}, timedOut ${timedOut})`);
+	return {
+		inFlightAtStart,
+		remaining,
+		requeued,
+		timedOut
+	};
+};
+//#endregion
+//#region src/reliability/leaderController.ts
+/**
+* Turns a lease into leadership. On each `tick`: if not leading, try to acquire/steal;
+* if leading, renew. A failed renew (the lease was stolen while this node was paused
+* past expiry) drops leadership immediately, so a zombie never keeps acting. No timer
+* lives here; a caller schedules `tick` at `ttlMs / 3`.
+*/
+const createLeaderController = (args) => {
+	const { ownerId, role, store, ttlMs } = args;
+	let leading = false;
+	let token = 0;
+	return {
+		fenceToken: () => leading ? token : 0,
+		isLeader: () => leading,
+		release: async () => {
+			await store.release(role, ownerId);
+			leading = false;
+			token = 0;
+		},
+		tick: async (now) => {
+			if (leading) {
+				if (!(await store.renew(role, ownerId, ttlMs, now)).ok) {
+					leading = false;
+					token = 0;
+				}
+				return;
+			}
+			const acquired = await store.acquireOrSteal(role, ownerId, ttlMs, now);
+			if (acquired.ok) {
+				leading = true;
+				token = acquired.fenceToken;
+			}
+		}
+	};
+};
+//#endregion
+//#region src/reliability/leaseStore.mongo.ts
+/** Reach the raw Mongoose model the adapter exposes on `db.collections[slug]`. */
+const model = (payload) => {
+	const found = payload.db.collections[JOBS_LOCKS_SLUG];
+	if (!found) throw new Error(`@10x-media/jobs: missing Mongoose model for "${JOBS_LOCKS_SLUG}"`);
+	return found;
+};
+/** Single-document `findOneAndUpdate` is an atomic compare-and-set on MongoDB. */
+const createMongoLeaseStore = (payload) => {
+	const m = model(payload);
+	const toRecord = (doc) => doc === null ? null : {
+		fenceToken: doc.fenceToken,
+		leaseExpiresAt: doc.leaseExpiresAt ? new Date(doc.leaseExpiresAt) : null,
+		owner: doc.owner ?? null,
+		role: doc.role
+	};
+	return {
+		acquireOrSteal: async (role, owner, ttlMs, now) => {
+			const doc = await m.findOneAndUpdate({
+				$or: [{ owner: null }, { leaseExpiresAt: { $lt: now } }],
+				role
+			}, {
+				$inc: { fenceToken: 1 },
+				$set: {
+					leaseExpiresAt: leaseExpiry(now, ttlMs),
+					owner
+				}
+			}, { new: true });
+			return {
+				fenceToken: doc?.fenceToken ?? 0,
+				ok: doc !== null
+			};
+		},
+		read: async (role) => toRecord(await m.findOne({ role }).lean()),
+		release: async (role, owner) => {
+			await m.findOneAndUpdate({
+				owner,
+				role
+			}, { $set: {
+				leaseExpiresAt: null,
+				owner: null
+			} });
+		},
+		renew: async (role, owner, ttlMs, now) => {
+			const doc = await m.findOneAndUpdate({
+				owner,
+				role
+			}, { $set: { leaseExpiresAt: leaseExpiry(now, ttlMs) } }, { new: true });
+			return {
+				fenceToken: doc?.fenceToken ?? 0,
+				ok: doc !== null
+			};
+		}
+	};
+};
+//#endregion
+//#region src/reliability/leaseStore.postgres.ts
+/** Payload tables for kebab slugs are the slug with hyphens replaced by underscores. */
+const tableName = (payload) => {
+	const defaultTable = JOBS_LOCKS_SLUG.replace(/-/g, "_");
+	const map = payload.db.tableNameMap;
+	return (map && typeof map.get === "function" ? map.get(defaultTable) : void 0) ?? defaultTable;
+};
+const pool = (payload) => {
+	const found = payload.db.pool;
+	if (!found) throw new Error(`@10x-media/jobs: missing pg pool on the "${payload.db.name}" adapter`);
+	return found;
+};
+/** Single-statement `UPDATE ... WHERE <guard> RETURNING` is atomic under READ COMMITTED. */
+const createPostgresLeaseStore = (payload) => {
+	const table = tableName(payload);
+	const db = pool(payload);
+	const toRecord = (row) => row === void 0 ? null : {
+		fenceToken: Number(row.fence_token),
+		leaseExpiresAt: row.lease_expires_at ? new Date(row.lease_expires_at) : null,
+		owner: row.owner ?? null,
+		role: row.role
+	};
+	return {
+		acquireOrSteal: async (role, owner, ttlMs, now) => {
+			const res = await db.query(`UPDATE ${table}
+				 SET owner = $1, lease_expires_at = $2, fence_token = fence_token + 1
+				 WHERE role = $3 AND (owner IS NULL OR lease_expires_at < $4)
+				 RETURNING fence_token`, [
+				owner,
+				leaseExpiry(now, ttlMs),
+				role,
+				now
+			]);
+			return {
+				fenceToken: res.rowCount === 1 ? Number(res.rows[0]?.fence_token) : 0,
+				ok: res.rowCount === 1
+			};
+		},
+		read: async (role) => {
+			return toRecord((await db.query(`SELECT role, owner, lease_expires_at, fence_token FROM ${table} WHERE role = $1`, [role])).rows[0]);
+		},
+		release: async (role, owner) => {
+			await db.query(`UPDATE ${table} SET owner = NULL, lease_expires_at = NULL WHERE role = $1 AND owner = $2`, [role, owner]);
+		},
+		renew: async (role, owner, ttlMs, now) => {
+			const res = await db.query(`UPDATE ${table}
+				 SET lease_expires_at = $1
+				 WHERE role = $2 AND owner = $3
+				 RETURNING fence_token`, [
+				leaseExpiry(now, ttlMs),
+				role,
+				owner
+			]);
+			return {
+				fenceToken: res.rowCount === 1 ? Number(res.rows[0]?.fence_token) : 0,
+				ok: res.rowCount === 1
+			};
+		}
+	};
+};
+//#endregion
+//#region src/reliability/leaseStore.ts
+/** Build the lease store for the running adapter. Throws for an unsupported adapter. */
+const createLeaseStore = (payload) => {
+	if (payload.db.name === "mongoose") return createMongoLeaseStore(payload);
+	if (payload.db.name === "postgres") return createPostgresLeaseStore(payload);
+	throw new Error(`@10x-media/jobs reliability does not support db adapter "${payload.db.name}"`);
+};
+//#endregion
+//#region src/execution/inFlight.ts
+const JOBS_SLUG = "payload-jobs";
+/** Count this node's in-flight jobs: `processing: true` AND claimed by `claimedBy`. */
+const countInFlight = async (payload, claimedBy) => {
+	const count = payload.count;
+	return (await count({
+		collection: JOBS_SLUG,
+		where: { and: [{ processing: { equals: true } }, { claimedBy: { equals: claimedBy } }] }
+	})).totalDocs;
+};
+//#endregion
+//#region src/execution/signals.ts
+/**
+* Register `handler` for each signal and return a cleanup that removes them. The
+* handler fires at most once across all signals (a second signal during drain is
+* ignored). Payload installs no signal handlers of its own, so these never conflict.
+* `target` defaults to `process`; tests pass an EventEmitter.
+*/
+const installSignalHandlers = (signals, handler, target = process) => {
+	let fired = false;
+	const registered = signals.map((signal) => {
+		const listener = () => {
+			if (fired) return;
+			fired = true;
+			handler(signal);
+		};
+		target.on(signal, listener);
+		return [signal, listener];
+	});
+	return () => {
+		for (const [signal, listener] of registered) target.removeListener(signal, listener);
+	};
+};
+//#endregion
+//#region src/execution/workerCycles.ts
+const guard = async (logger, label, fn) => {
+	try {
+		await fn();
+	} catch (err) {
+		logger?.error?.(`@10x-media/jobs: worker ${label} cycle error: ${String(err)}`);
+	}
+};
+/** One run cycle: claim and execute jobs on this node. Errors are logged, not thrown. */
+const runCycle = async (deps) => {
+	await guard(deps.logger, "run", deps.runJobs);
+};
+/** One maintenance cycle: advance leadership, then schedule only if scheduler-leader. */
+const maintenanceCycle = async (deps) => {
+	await guard(deps.logger, "leadership", () => deps.tickLeaders(deps.now()));
+	if (deps.isSchedulerLeader()) await guard(deps.logger, "schedule", deps.handleSchedules);
+};
+/** One sweep cycle: reclaim stuck jobs only if sweeper-leader. */
+const sweepCycle = async (deps) => {
+	if (deps.isSweeperLeader()) await guard(deps.logger, "sweep", deps.sweep);
+};
+//#endregion
+//#region src/execution/worker.ts
+const realSleep = (ms) => new Promise((resolve) => {
+	setTimeout(resolve, ms);
+});
+/** A self-skipping interval: a slow tick never overlaps the next (like Croner's `protect`). */
+const guardedInterval = (fn, ms) => {
+	let busy = false;
+	return setInterval(() => {
+		if (busy) return;
+		busy = true;
+		fn().finally(() => {
+			busy = false;
+		});
+	}, ms);
+};
+/**
+* A plugin-driven worker: runs jobs on every node, schedules and sweeps only while
+* holding the corresponding leadership lease, and drains gracefully on SIGTERM/SIGINT.
+* It owns its own timers (never Payload's autoRun cron), because Payload's
+* `shouldAutoRun` gate permanently stops a cron and cannot follow dynamic leadership.
+* Leadership timestamps use Payload's swappable `getCurrentDate()`; the drain budget
+* uses the injected wall clock.
+*/
+const createWorker = (args) => {
+	const { payload, reliability } = args;
+	if (!payload.collections["payload-jobs"]) throw new Error("@10x-media/jobs: createWorker requires at least one configured job task. Payload only registers the payload-jobs collection when jobs.tasks or jobs.workflows is non-empty.");
+	const nodeId = resolveNodeId(reliability.leaderId);
+	const leaseStore = createLeaseStore(payload);
+	const jobLeaseStore = createJobLeaseStore(payload);
+	const scheduler = createLeaderController({
+		ownerId: nodeId,
+		role: "scheduler",
+		store: leaseStore,
+		ttlMs: reliability.leaderLeaseTtlMs
+	});
+	const sweeper = createLeaderController({
+		ownerId: nodeId,
+		role: "sweeper",
+		store: leaseStore,
+		ttlMs: reliability.leaderLeaseTtlMs
+	});
+	const runIntervalMs = args.runIntervalMs ?? 2e3;
+	const maintenanceIntervalMs = args.maintenanceIntervalMs ?? Math.max(1e3, Math.floor(reliability.leaderLeaseTtlMs / 3));
+	const sweepIntervalMs = reliability.sweepIntervalMs;
+	const runLimit = args.runLimit ?? 10;
+	const drainTimeoutMs = args.drainTimeoutMs ?? 3e4;
+	const pollIntervalMs = args.pollIntervalMs ?? 500;
+	const destroy = args.destroy ?? (() => payload.destroy());
+	const now = args.now ?? (() => Date.now());
+	const sleep = args.sleep ?? realSleep;
+	const logger = payload.logger;
+	let timers = [];
+	let signalCleanup;
+	let draining;
+	const runJobs = async () => {
+		const state = args.pauseStore ? await args.pauseStore.getState() : emptyPauseState();
+		for (const target of runTargetsForPause(args.queues, state)) await payload.jobs.run({
+			...target,
+			limit: runLimit,
+			silent: true
+		});
+	};
+	const handleSchedules = async () => {
+		await payload.jobs.handleSchedules({ allQueues: true });
+	};
+	const sweep = async () => {
+		await runSweep({
+			isLeader: sweeper.isLeader(),
+			now: getCurrentDate(),
+			options: reliability,
+			payload,
+			store: jobLeaseStore
+		});
+	};
+	const tickLeaders = async (at) => {
+		await scheduler.tick(at);
+		await sweeper.tick(at);
+	};
+	const stopLoops = () => {
+		for (const timer of timers) clearInterval(timer);
+		timers = [];
+	};
+	const removeSignals = () => {
+		signalCleanup?.();
+		signalCleanup = void 0;
+	};
+	const drain = () => {
+		if (draining) return draining;
+		removeSignals();
+		draining = drainWorker({
+			countInFlight: () => countInFlight(payload, nodeId),
+			destroy,
+			logger,
+			now,
+			releaseLeadership: async () => {
+				await scheduler.release();
+				await sweeper.release();
+			},
+			requeueStragglers: async () => (await jobLeaseStore.releaseAllClaims(nodeId)).released,
+			sleep,
+			stopLoops
+		}, {
+			drainTimeoutMs,
+			pollIntervalMs
+		});
+		return draining;
+	};
+	const worker = {
+		drain,
+		isLeader: (role) => role === "scheduler" ? scheduler.isLeader() : sweeper.isLeader(),
+		start: () => {
+			stopLoops();
+			timers = [
+				guardedInterval(() => runCycle({
+					logger,
+					runJobs
+				}), runIntervalMs),
+				guardedInterval(() => maintenanceCycle({
+					handleSchedules,
+					isSchedulerLeader: scheduler.isLeader,
+					logger,
+					now: getCurrentDate,
+					tickLeaders
+				}), maintenanceIntervalMs),
+				guardedInterval(() => sweepCycle({
+					isSweeperLeader: sweeper.isLeader,
+					logger,
+					sweep
+				}), sweepIntervalMs)
+			];
+		},
+		stop: () => {
+			stopLoops();
+			removeSignals();
+		}
+	};
+	if (args.installSignals !== false) {
+		const exit = args.exit ?? ((code) => process.exit(code));
+		signalCleanup = installSignalHandlers(args.signals ?? ["SIGTERM", "SIGINT"], () => {
+			drain().then(() => exit(0)).catch(() => exit(1));
+		});
+	}
+	return worker;
+};
+//#endregion
+//#region src/presets/presets.ts
+/**
+* Single-node Docker: one serial claimer, so claim races are moot. Reliability and
+* queue control on with defaults; the sweeper runs from the in-process worker.
+*/
+const singleNodePreset = () => ({
+	queueControl: {},
+	reliability: {}
+});
+/**
+* Multi-node Docker: leader-elected scheduling and sweeping (the default). Pass a
+* stable `leaderId` per node if you do not want the generated hostname:pid identity.
+*/
+const multiNodePreset = (options = {}) => ({
+	queueControl: {},
+	reliability: options.leaderId === void 0 ? {} : { leaderId: options.leaderId }
+});
+/**
+* Serverless (Vercel): no long-running worker, so staleness derives from the platform
+* hard-kill duration (the function maxDuration) rather than a heartbeat, and the run
+* and sweep endpoints are guarded by the cron secret. Drive them with Vercel Cron
+* (see `vercelCrons`).
+*/
+const serverlessPreset = (options) => ({
+	queueControl: { access: cronSecretAccess({ envVar: options.cronSecretEnvVar }) },
+	reliability: {
+		jobLeaseTtlMs: options.maxDurationMs,
+		serverless: { maxDurationMs: options.maxDurationMs }
+	}
+});
+/**
+* Build the `vercel.json` `crons` array: one entry hitting the hardened run endpoint
+* (all queues) and one hitting the sweep endpoint. Defaults to every minute (Vercel
+* Pro). Vercel sends the `CRON_SECRET` as a Bearer token, which `cronSecretAccess`
+* checks.
+*/
+const vercelCrons = (options = {}) => [{
+	path: options.runPath ?? "/api/payload-jobs/queue-run?allQueues=true",
+	schedule: options.runSchedule ?? "* * * * *"
+}, {
+	path: options.sweepPath ?? "/api/payload-jobs/queue-sweep",
+	schedule: options.sweepSchedule ?? "* * * * *"
+}];
+//#endregion
+//#region src/index.ts
+/**
+* Jobs plugin for Payload v3. Enhances the built-in `payload-jobs` collection
+* with an ops dashboard (status, queue health, error and log panels) and the
+* supporting i18n. Authored with `definePlugin` so the automations and webhooks
+* plugins can detect it by slug. Runs first (`order: 0`).
+*/
+const jobs = definePlugin({
+	slug: "@10x-media/jobs",
+	order: 0,
+	plugin: ({ config, plugins: _plugins, ...options }) => {
+		if (options.disabled === true) return config;
+		registerTranslations(config);
+		registerJobsEnhancements(config, options);
+		const reliability = resolveReliabilityOptions(options.reliability);
+		if (reliability) registerReliability(config, reliability);
+		const queueControl = resolveQueueControlOptions(options.queueControl);
+		if (queueControl) registerQueueControl(config, queueControl, reliability);
+		return config;
+	}
+});
+//#endregion
+export { JOBS_LOCKS_SLUG, LEADER_ROLES, autoRunConfig, createJobLeaseStore, createLeaderController, createLeaseStore, createPauseStore, createWorker, cronSecretAccess, decideRecovery, deriveJobStatus, drainWorker, getQueueHealth, jobs, loggedInAccess, multiNodePreset, resolveReliabilityOptions, runSweep, serverlessPreset, singleNodePreset, vercelCrons, withIdempotencyKey };
+
+//# sourceMappingURL=index.js.map