@c9up/ream 0.2.8 → 0.2.10

package/src/http/Request.ts

@@ -383,7 +383,14 @@ export class Request extends Macroable {
   cookie(name: string, defaultValue?: string): string | null
   cookie(name: string, defaultValue?: string): string | null {
     const raw = this.plainCookie<string>(name, undefined, { encoded: false })
-    const value = raw === null ? null : this.#cookieSigner ? this.#cookieSigner.unsign(raw) : raw
+    // No signer means nothing here was ever signed. Handing the raw value back
+    // would present whatever the client wrote as a verified one — the reader
+    // cannot tell the difference, which is exactly the confusion signing
+    // exists to remove. `plainCookie()` is the way to read an unsigned value.
+    if (!this.#cookieSigner) return defaultValue ?? null
+    // The name is part of the signature, so a value moved to another cookie
+    // fails here rather than being honoured under its new name.
+    const value = raw === null ? null : this.#cookieSigner.unsign<string>(raw, name)
     return value ?? defaultValue ?? null
   }
 
@@ -675,20 +682,29 @@ export class Request extends Macroable {
   }
 
   /**
-   * A JSON-safe view of the request (AdonisJS `serialize`), for logs and error
-   * reports. Carries no body: it may hold credentials, and a log line is the
-   * last place they should land.
+   * A JSON view of the request (AdonisJS `serialize`).
+   *
+   * The whole request, as upstream reports it: body, cookies and every header
+   * verbatim. It is a debugging dump, and it carries credentials — an
+   * `authorization` header, a session cookie, a password field in the body.
+   *
+   * Do not put it in a log line. {@link serializeSafe} is the one built for
+   * that.
    */
   serialize(): Record<string, unknown> {
     return {
       id: this.id(),
       url: this.url(true),
+      query: this.parsedUrl().search?.slice(1) ?? '',
+      body: this.body(),
+      params: this.params(),
+      headers: this.headers(),
       method: this.method(),
       protocol: this.protocol(),
-      host: this.host(),
-      headers: this.headers(),
-      qs: this.qs(),
-      params: this.params(),
+      cookies: this.cookies(),
+      hostname: this.hostname(),
+      ip: this.ip(),
+      subdomains: this.subdomains(),
     }
   }
 
@@ -697,6 +713,28 @@ export class Request extends Macroable {
     return this.serialize()
   }
 
+  /**
+   * A view fit for a log line or an error report.
+   *
+   * Not upstream's — it has no such method, and its `serialize()` is a full
+   * dump. This one carries no body and no cookies, and the headers that hold a
+   * credential come back as `[redacted]` rather than as their value: the header
+   * is still LISTED, because knowing a request arrived with an `authorization`
+   * header is most of what a reader wants, and its contents are none of it.
+   */
+  serializeSafe(): Record<string, unknown> {
+    return {
+      id: this.id(),
+      url: this.url(true),
+      method: this.method(),
+      protocol: this.protocol(),
+      host: this.host(),
+      headers: redactSensitiveHeaders(this.headers()),
+      qs: this.qs(),
+      params: this.params(),
+    }
+  }
+
   // ─── Query string ─────────────────────────────────────────
 
   /** Get parsed query string as an object. */
@@ -999,6 +1037,33 @@ function isPlainObject(value: unknown): value is Dict<unknown> {
 }
 
 /** True for an IPv4 dotted-quad or a (bracketed) IPv6 literal — hosts with no subdomains. */
+/**
+ * Headers whose VALUE is a credential. Listing them is useful; printing them
+ * hands whoever reads the log a working key.
+ */
+const SENSITIVE_HEADERS = new Set([
+  'authorization',
+  'proxy-authorization',
+  'cookie',
+  'set-cookie',
+  'x-api-key',
+  'x-auth-token',
+  'x-access-token',
+  'x-csrf-token',
+  'x-xsrf-token',
+  'x-session-token',
+  'x-amz-security-token',
+])
+
+/** Replace each credential-bearing header's value with a marker, keeping the name. */
+function redactSensitiveHeaders(headers: Dict): Dict {
+  const out: Dict = {}
+  for (const [name, value] of Object.entries(headers)) {
+    out[name] = SENSITIVE_HEADERS.has(name.toLowerCase()) ? '[redacted]' : value
+  }
+  return out
+}
+
 function isIpLiteral(host: string): boolean {
   if (host.startsWith('[') || host.includes('::')) return true
   return /^(\d{1,3}\.){3}\d{1,3}$/.test(host)

package/src/http/Response.ts

@@ -13,6 +13,7 @@ import { readFile, stat } from 'node:fs/promises'
 import { basename } from 'node:path'
 import etag from 'etag'
 import { contentType } from 'mime-types'
+import { ReamError } from '../errors/ReamError.js'
 import { durationToSeconds } from '../helpers/duration.js'
 
 /**
@@ -60,8 +61,6 @@ function assertNoCRLF(name: string, value: string): void {
  */
 function contentDisposition(disposition: string, filename: string): string {
   const quoted = filename.replace(/\\/g, '\\\\').replace(/"/g, '\\"')
-  // biome-ignore lint/suspicious/noControlCharactersInRegex: matching control
-  // characters is the point — they cannot travel in a header field.
   const ascii = quoted.replace(/[^\x20-\x7e]/g, '_')
   const base = `${disposition}; filename="${ascii}"`
   if (ascii === quoted) return base
@@ -285,7 +284,7 @@ export class Response extends Macroable {
   /** Send a JSON response. Sets content-type and stringifies. */
   json(data: unknown): void {
     this.#headers['content-type'] = 'application/json'
-    this.#body = safeStringify(data)
+    this.#setBody(safeStringify(data))
     this.#finished = true
   }
 
@@ -315,7 +314,7 @@ export class Response extends Macroable {
       c === '\u2028' ? '\\u2028' : '\\u2029',
     )
     this.#headers['content-type'] = 'text/javascript; charset=utf-8'
-    this.#body = `/**/ typeof ${safeCallback} === 'function' && ${safeCallback}(${json});`
+    this.#setBody(`/**/ typeof ${safeCallback} === 'function' && ${safeCallback}(${json});`)
     this.#finished = true
   }
 
@@ -330,7 +329,7 @@ export class Response extends Macroable {
           ? 'text/html; charset=utf-8'
           : 'text/plain; charset=utf-8'
       }
-      this.#body = data
+      this.#setBody(data)
     } else if (Buffer.isBuffer(data)) {
       // Without this branch a Buffer would hit the `typeof === 'object'`
       // path and be JSON-stringified into `{"type":"Buffer","data":[...]}`
@@ -339,12 +338,12 @@ export class Response extends Macroable {
       return
     } else if (typeof data === 'object' && data !== null) {
       this.#headers['content-type'] = 'application/json'
-      this.#body = safeStringify(data)
+      this.#setBody(safeStringify(data))
     } else if (data !== undefined && data !== null) {
       if (!this.#headers['content-type']) {
         this.#headers['content-type'] = 'text/plain'
       }
-      this.#body = String(data)
+      this.#setBody(String(data))
     }
     this.#finished = true
   }
@@ -383,12 +382,37 @@ export class Response extends Macroable {
    * `@c9up/archive` instead and let the client fetch it from storage — the
    * bytes then never pass through the server at all.
    */
+  /**
+   * Assign the body, refusing one too large to hold.
+   *
+   * Every textual path goes through here — `json()`, `send()`, `jsonp()`, a
+   * middleware rewriting the body. The ceiling used to live only in
+   * `sendBuffer()`, so `json(hugeObject)` and `send(hugeString)` walked past
+   * it and the process grew until it died, which is the failure the ceiling
+   * exists to name.
+   *
+   * Measured in UTF-8 BYTES, not characters: a string of accented or CJK text
+   * is one and a half to three times its length on the wire.
+   */
+  #setBody(body: string): void {
+    this.#assertBodyFits(Buffer.byteLength(body, 'utf8'))
+    this.#body = body
+  }
+
   #assertBodyFits(bytes: number): void {
     if (bytes <= this.#maxBodyBytes) return
-    throw new Error(
-      `[E_RESPONSE_TOO_LARGE] Response body is ${Math.round(bytes / 1_048_576)}MB, over the ${Math.round(this.#maxBodyBytes / 1_048_576)}MB ceiling. ` +
-        'The body is held whole in memory (and base64-encoded, ~2.3x) because responses are not streamed yet. ' +
-        'Raise `maxResponseBytes` in the kernel config, or serve large files with a signed URL from @c9up/archive.',
+    throw new ReamError(
+      'E_RESPONSE_TOO_LARGE',
+      `Response body is ${Math.round(bytes / 1_048_576)}MB, over the ${Math.round(this.#maxBodyBytes / 1_048_576)}MB ceiling.`,
+      {
+        context: {
+          bytes: String(bytes),
+          ceiling: String(this.#maxBodyBytes),
+        },
+        hint:
+          'The body is held whole in memory (and base64-encoded, ~2.3x) because responses are not streamed yet. ' +
+          'Raise `maxResponseBytes` in the kernel config, or serve large files with a signed URL from @c9up/archive.',
+      },
     )
   }
 
@@ -665,7 +689,11 @@ export class Response extends Macroable {
    */
   redirect(): RedirectBuilder
   redirect(path: string, forwardQueryString?: boolean, statusCode?: number): void
-  redirect(path?: string, forwardQueryString = false, statusCode = 302): RedirectBuilder | void {
+  redirect(
+    path?: string,
+    forwardQueryString = false,
+    statusCode = 302,
+  ): RedirectBuilder | undefined {
     if (!this.#redirectBuilderFactory) {
       throw new Error(
         'redirect() requires an HttpContext. Response was created outside a request handler.',
@@ -1063,14 +1091,25 @@ export class Response extends Macroable {
   // ─── Cookies ──────────────────────────────────────────────
 
   /**
-   * Set a SIGNED response cookie (AdonisJS default). The value is HMAC-signed
-   * with the app's `APP_KEY` (via the injected signer) so tampering is detected
-   * on read; `request.cookie()` verifies + unwraps it. Falls back to a plain
-   * cookie when no APP_KEY / encryption service is configured.
+   * Set a SIGNED response cookie (the default). The value is HMAC-signed with
+   * the app's `APP_KEY`, so tampering is detected on read; `request.cookie()`
+   * verifies and unwraps it.
+   *
+   * Requires APP_KEY, and REFUSES rather than falling back to a plain cookie.
+   * A silent fallback is the worst of both: the caller asked for integrity,
+   * the value ships without it, and `request.cookie()` on the far side hands
+   * back whatever the client wrote as though it had been verified.
+   *
+   * The cookie's NAME is signed along with its value, so a signed cookie
+   * cannot be lifted onto another name and still verify.
    */
   cookie(name: string, value: string, options?: CookieOptions): this {
-    const signed = this.#cookieSigner ? this.#cookieSigner.sign(value) : value
-    return this.#writeCookie(name, signed, options)
+    if (!this.#cookieSigner) {
+      throw new Error(
+        'cookie() signs the value and needs APP_KEY — set it so the encryption service is registered, or use plainCookie() when the value does not need signing.',
+      )
+    }
+    return this.#writeCookie(name, this.#cookieSigner.sign(value, undefined, name), options)
   }
 
   /**
@@ -1262,7 +1301,7 @@ export class Response extends Macroable {
 
   /** @internal Set body directly (used by redirect, exception handler). */
   setBody(body: string): void {
-    this.#body = body
+    this.#setBody(body)
     this.#finished = true
   }
 

package/src/index.ts

@@ -347,12 +347,16 @@ export {
 export type {
   ErrorReporter,
   LockBackend,
+  LockBackendFactory,
+  LockRedisClient,
+  LockRedisResolver,
   RunTaskOutcome,
   ScheduleEvent,
   ScheduleEventSink,
   ScheduleInvocation,
   ScheduleMetadata,
   ScheduleProviderOptions,
+  SchedulerConfig,
   SchedulerOptions,
   ScheduleTaskCompletedEvent,
   ScheduleTaskFailedEvent,
@@ -362,8 +366,11 @@ export type {
   TaskStats,
 } from './scheduler/index.js'
 export {
+  defineSchedulerConfig,
   getScheduleMetadata,
+  locks,
   MemoryLockBackend,
+  RedisLockBackend,
   SCHEDULE_METADATA_KEY,
   Schedule,
   ScheduleProvider,
@@ -371,4 +378,4 @@ export {
   StatsTracker,
 } from './scheduler/index.js'
 
-export const VERSION = '0.2.8'
+export const VERSION = '0.2.10'

package/src/router/Router.ts

@@ -1602,12 +1602,21 @@ function matchPath(pattern: string, actual: string): MatchedParams | null {
   return params
 }
 
-/** Match domain pattern against actual host. Supports wildcards like *.example.com */
+/**
+ * Match a domain pattern against the request's host. Supports wildcards like
+ * `*.example.com`.
+ *
+ * Both sides are lowercased: a hostname is case-insensitive (RFC 4343), so a
+ * client that sends `API.Example.COM` — which is legal, and what some proxies
+ * and older clients do — must reach the same route as `api.example.com`.
+ * Comparing them verbatim sends that request to a fallback, or to a 404.
+ */
 function matchDomain(pattern: string, host: string): boolean {
-  const actualHost = host.split(':')[0] // strip port
-  if (pattern === actualHost) return true
-  if (pattern.startsWith('*.')) {
-    const suffix = pattern.slice(1) // ".example.com"
+  const actualHost = host.split(':')[0].toLowerCase() // strip port
+  const wanted = pattern.toLowerCase()
+  if (wanted === actualHost) return true
+  if (wanted.startsWith('*.')) {
+    const suffix = wanted.slice(1) // ".example.com"
     return actualHost.endsWith(suffix) && actualHost.length > suffix.length
   }
   return false

package/src/rpc/RpcRouter.ts

@@ -18,6 +18,7 @@ import {
   parseRequest as parseRpcRequest,
   buildError as rpcError,
 } from '@c9up/comet'
+import { currentNodeEnv } from '../env/nodeEnv.js'
 import type { HttpContext } from '../http/HttpContext.js'
 import type { MiddlewareRegistry, RuntimeValidator } from '../middleware/Pipeline.js'
 import { composeMiddleware, runValidator } from '../middleware/Pipeline.js'
@@ -316,7 +317,7 @@ export class RpcRouter {
         return rpcError(err.code, message, id, err.data)
       }
       // Otherwise don't leak internal error details to the caller.
-      const isDev = process.env.NODE_ENV !== 'production'
+      const isDev = currentNodeEnv() !== 'production'
       const message = isDev && err instanceof Error ? err.message : 'Internal error'
       return rpcError(-32603, message, id)
     }

package/src/scheduler/ScheduleProvider.ts

@@ -24,8 +24,9 @@ import { getServiceRegistry } from '../decorators/Service.js'
 import { ReamError } from '../errors/ReamError.js'
 import type { AppContext } from '../Provider.js'
 import { Provider } from '../Provider.js'
+import type { SchedulerConfig } from './config.js'
 import { getScheduleMetadata } from './Schedule.js'
-import { Scheduler } from './Scheduler.js'
+import { Scheduler, type SchedulerOptions } from './Scheduler.js'
 
 export interface ScheduleProviderOptions {
   /**
@@ -40,12 +41,14 @@ let activeProvider: ScheduleProvider | undefined
 
 export class ScheduleProvider extends Provider {
   readonly scheduler: Scheduler
-  #booted = false
+  /** Task names already registered, so a second pass adds only what is new. */
+  readonly #known = new Set<string>()
   #registered = false
 
   constructor(app: AppContext, options: ScheduleProviderOptions = {}) {
     super(app)
-    this.scheduler = options.scheduler ?? new Scheduler()
+    this.scheduler =
+      options.scheduler ?? new Scheduler(schedulerOptionsFrom(app.config.get('scheduler')))
   }
 
   /**
@@ -82,8 +85,44 @@ export class ScheduleProvider extends Provider {
     this.#registered = true
   }
 
+  /**
+   * Discovery runs at START, not at boot, and that is the whole point.
+   *
+   * `app/modules/**` is auto-loaded during the start phase — after every
+   * provider has booted. A `@Service()` carrying `@Schedule` there, which is
+   * where one naturally lives, was therefore registered into the service
+   * registry AFTER this had already read it. The task was never registered,
+   * and nothing said so: no error, no warning, the application started
+   * normally and the task simply never fired.
+   *
+   * Reading the registry once the modules are in place is what fixes it. A
+   * service declared anywhere earlier — a provider, a preload — is in the
+   * registry by then too, so nothing is lost by waiting.
+   */
   override async boot(): Promise<void> {
-    if (this.#booted) return
+    // Anything already in the registry — declared by a provider, or imported
+    // by one. The rest is caught at start().
+    this.#discover()
+  }
+
+  override async start(): Promise<void> {
+    this.#discover()
+    if (activeProvider !== undefined && activeProvider !== this) {
+      // A previous app's scheduler is still running — stop it before this one
+      // starts, otherwise every @Schedule task fires twice per tick.
+      activeProvider.scheduler.stop()
+    }
+    activeProvider = this
+    this.scheduler.start()
+  }
+
+  /**
+   * Walk the service registry and register every `@Schedule` it declares.
+   *
+   * Idempotent: a second call registers nothing twice, so an application that
+   * restarts its Ignitor does not end up firing everything in duplicate.
+   */
+  #discover(): void {
     const registry = getServiceRegistry()
     const registered: string[] = []
 
@@ -118,6 +157,8 @@ export class ScheduleProvider extends Provider {
           }
 
           const taskName = `${target.name}.${methodName}`
+          // Registered on an earlier pass: skip rather than fire it twice.
+          if (this.#known.has(taskName)) continue
           try {
             this.scheduler.register(taskName, cronExpr, async () => {
               // Resolve from the container on every fire so transient
@@ -133,6 +174,7 @@ export class ScheduleProvider extends Provider {
               await (method as (...args: unknown[]) => unknown).call(instance)
             })
             registered.push(taskName)
+            this.#known.add(taskName)
           } catch (cause) {
             const inner = cause as ReamError & { message?: string; hint?: string }
             throw new ReamError(
@@ -146,7 +188,6 @@ export class ScheduleProvider extends Provider {
           }
         }
       }
-      this.#booted = true
     } catch (err) {
       // Roll back any partial registrations so a retry does not hit
       // DUPLICATE_TASK and the scheduler is never half-initialized.
@@ -162,16 +203,6 @@ export class ScheduleProvider extends Provider {
     }
   }
 
-  override async start(): Promise<void> {
-    if (activeProvider !== undefined && activeProvider !== this) {
-      // A previous app's scheduler is still running — stop it before this one starts,
-      // otherwise every @Schedule task fires twice per tick.
-      activeProvider.scheduler.stop()
-    }
-    activeProvider = this
-    this.scheduler.start()
-  }
-
   override async shutdown(): Promise<void> {
     if (activeProvider === this) activeProvider = undefined
     this.scheduler.stop()
@@ -180,3 +211,22 @@ export class ScheduleProvider extends Provider {
 
 // Default export so reamrc's provider loader can `() => import('@c9up/ream/<feature>/provider')` (resolves to { default }), matching events/rpc. Named export above stays.
 export default ScheduleProvider
+
+/**
+ * Turn `config/scheduler.ts` into the options the `Scheduler` takes.
+ *
+ * The lock is built here rather than in the config file because that file is
+ * read before the application boots — a Redis connection named in it does not
+ * exist yet, so the helpers hand back a factory and this calls it.
+ */
+function schedulerOptionsFrom(config: SchedulerConfig | undefined): SchedulerOptions {
+  if (config === undefined) return {}
+  const options: SchedulerOptions = {}
+  if (config.lock !== undefined) {
+    options.lockBackend = typeof config.lock === 'function' ? config.lock() : config.lock
+  }
+  if (config.defaultLockTtlMs !== undefined) {
+    options.defaultLockTtlMs = config.defaultLockTtlMs
+  }
+  return options
+}

package/src/scheduler/config.ts

@@ -0,0 +1,34 @@
+/**
+ * Author-time config for `config/scheduler.ts`.
+ *
+ *   import { defineConfig, locks } from '@c9up/ream/scheduler/config'
+ *
+ *   export default defineConfig({
+ *     lock: locks.redis({ connection: 'main' }),
+ *   })
+ */
+
+import type { LockBackend } from './locks/LockBackend.js'
+import type { LockBackendFactory } from './locks/locks.js'
+
+export interface SchedulerConfig {
+  /**
+   * The lock consulted before a task fires, so that only one instance runs
+   * it. Takes a backend, or a factory answering one — which is what the
+   * `locks.*` helpers return, so a config file can name a Redis lock before
+   * the connection exists.
+   *
+   * Left out, the scheduler locks nothing: every instance runs every task.
+   * Correct on one instance, and a duplicate run per replica past that.
+   */
+  lock?: LockBackend | LockBackendFactory
+  /** How long a lease is held before it expires on its own. Default 60 000. */
+  defaultLockTtlMs?: number
+}
+
+export function defineConfig(config: SchedulerConfig): SchedulerConfig {
+  return config
+}
+
+export type { LockBackend } from './locks/LockBackend.js'
+export { type LockBackendFactory, locks } from './locks/locks.js'

package/src/scheduler/index.ts

@@ -1,5 +1,13 @@
+export type { SchedulerConfig } from './config.js'
+export { defineConfig as defineSchedulerConfig } from './config.js'
 export type { LockBackend } from './locks/LockBackend.js'
+export { type LockBackendFactory, locks } from './locks/locks.js'
 export { MemoryLockBackend } from './locks/MemoryLockBackend.js'
+export {
+  type LockRedisClient,
+  type LockRedisResolver,
+  RedisLockBackend,
+} from './locks/RedisLockBackend.js'
 export type { ErrorReporter } from './observability/ErrorReporter.js'
 export type {
   ScheduleEvent,

package/src/scheduler/locks/LockBackend.ts

@@ -3,13 +3,18 @@
  *
  * The scheduler consults a `LockBackend` immediately before firing a
  * registered task so that in multi-instance deployments only one
- * instance runs a given task on each tick. Redis, database
- * advisory-lock, and other backends live in user-land — this module
- * ships only the interface and a single-process `MemoryLockBackend`.
+ * instance runs a given task on each tick.
+ *
+ * Two backends ship with it: `MemoryLockBackend`, correct while the
+ * application runs in one process, and `RedisLockBackend`, which is
+ * what a second replica needs — see `locks` for the factories a
+ * config file names.
  *
  * @implements Story 28.3
  */
 
+import { ReamError } from '../../errors/ReamError.js'
+
 export interface LockBackend {
   /**
    * Attempt to acquire an exclusive lock on `name` for up to `ttlMs`
@@ -36,3 +41,21 @@ export interface LockBackend {
    */
   release(name: string): Promise<void>
 }
+
+/**
+ * Reject a TTL that cannot bound anything. A zero or negative lease
+ * expires the instant it is taken, so every instance would acquire the
+ * same lock and run the same task — the exact outcome locking exists to
+ * prevent, arriving silently.
+ */
+export function assertValidTtl(ttlMs: number): void {
+  if (!Number.isFinite(ttlMs) || ttlMs <= 0) {
+    throw new ReamError(
+      'SCHEDULE_INVALID_LOCK_TTL',
+      `Lock TTL must be a finite positive number, got ${ttlMs}`,
+      {
+        hint: 'Use a millisecond value greater than zero (typical range 1_000 - 600_000).',
+      },
+    )
+  }
+}

package/src/scheduler/locks/MemoryLockBackend.ts

@@ -1,11 +1,10 @@
 /**
  * Default single-process lock backend backed by a `Map`.
  *
- * Correct for apps that run in a single Node.js process. For
- * horizontally-scaled deployments, implement `LockBackend` against a
- * shared store (Redis `SET NX PX`, Postgres advisory locks, etc.) —
- * those drivers live in user-land per the project's "agnostic per
- * package" rule.
+ * Correct for apps that run in a single Node.js process, and only
+ * those: two processes each keep their own map, so both acquire the
+ * same name and both run the task. Reach for `RedisLockBackend` the
+ * moment a second replica exists.
  *
  * Expiry is evaluated **lazily** at `acquire` time — no background
  * timer, no `setInterval`. This preserves Story 28.1's
@@ -20,23 +19,10 @@
  * @implements Story 28.3
  */
 
-import { ReamError } from '../../errors/ReamError.js'
-import type { LockBackend } from './LockBackend.js'
+import { assertValidTtl, type LockBackend } from './LockBackend.js'
 
 const SWEEP_THRESHOLD = 256
 
-function assertValidTtl(ttlMs: number): void {
-  if (!Number.isFinite(ttlMs) || ttlMs <= 0) {
-    throw new ReamError(
-      'SCHEDULE_INVALID_LOCK_TTL',
-      `Lock TTL must be a finite positive number, got ${ttlMs}`,
-      {
-        hint: 'Use a millisecond value greater than zero (typical range 1_000 – 600_000).',
-      },
-    )
-  }
-}
-
 export class MemoryLockBackend implements LockBackend {
   #locks = new Map<string, number>()