@cat-factory/worker 0.171.2 → 0.173.0

package/dist/infrastructure/repositories/D1NotificationWebhookRepository.js

@@ -1,38 +1,55 @@
 import { parseNotificationWebhookTypes, parsePlatformAlertEvents, parseRunLifecycleEvents, } from '@cat-factory/server';
 /**
- * A workspace's outbound webhook, one row per workspace (migration 0061; `run_events` added in
- * 0072, `alert_events` in 0080). All three JSON filter columns are decoded through the SHARED
- * parsers the Drizzle repo uses, so the columns can't drift between runtimes.
+ * A workspace's outbound webhooks, keyed by (workspace, endpoint id) (migration 0061; `run_events`
+ * added in 0072, `alert_events` in 0080, the named-collection key in 0085). All three JSON filter
+ * columns are decoded through the SHARED parsers the Drizzle repo uses, so the columns can't drift
+ * between runtimes.
  */
 export class D1NotificationWebhookRepository {
     db;
     constructor({ db }) {
         this.db = db;
     }
-    async get(workspaceId) {
+    async get(workspaceId, id) {
         const row = await this.db
-            .prepare(`SELECT * FROM notification_webhooks WHERE workspace_id = ?`)
-            .bind(workspaceId)
+            .prepare(`SELECT * FROM notification_webhooks WHERE workspace_id = ? AND id = ?`)
+            .bind(workspaceId, id)
             .first();
-        if (!row)
-            return null;
-        return {
-            workspaceId: row.workspace_id,
-            url: row.url,
-            types: parseNotificationWebhookTypes(row.types),
-            runEvents: parseRunLifecycleEvents(row.run_events),
-            alertEvents: parsePlatformAlertEvents(row.alert_events),
-            enabled: row.enabled === 1,
-            secretSealed: row.secret_sealed,
-            updatedAt: row.updated_at,
-        };
+        return row ? toRecord(row) : null;
     }
-    async put(record) {
-        await this.db
+    async list(workspaceId) {
+        // `COLLATE BINARY` is SQLite's default for a text column and is spelled out only to name the
+        // order this port promises: the Drizzle mirror has to ask Postgres for `COLLATE "C"` to match,
+        // because its database-locale default would sort `web-hook` after `webhook` by ignoring the
+        // punctuation. Byte order on both, so the two runtimes return one sequence.
+        const { results } = await this.db
+            .prepare(`SELECT * FROM notification_webhooks WHERE workspace_id = ? ORDER BY id COLLATE BINARY`)
+            .bind(workspaceId)
+            .all();
+        return (results ?? []).map(toRecord);
+    }
+    async put(record, limit) {
+        // ONE statement, so the cap and the write cannot be separated by another writer. The row
+        // source is a `SELECT ... WHERE` rather than `VALUES` precisely so the admission test rides
+        // inside the insert: SQLite serializes statements, so a concurrent enrolment either sees this
+        // row or is seen by it, and can never read the same free slot twice.
+        //
+        // The predicate admits an existing endpoint unconditionally (`EXISTS`) before it consults the
+        // count, because the count includes that row: without the first half, a workspace sitting
+        // exactly at the limit could no longer edit, disable or re-point what it had already
+        // registered, which are the only ways back under it.
+        //
+        // The `WHERE` also disambiguates the parse. SQLite cannot otherwise tell an upsert's `ON
+        // CONFLICT` from a join's `ON` in an `INSERT ... SELECT`, and its documented fix is exactly a
+        // `WHERE` clause on the SELECT, which this needs anyway.
+        const result = await this.db
             .prepare(`INSERT INTO notification_webhooks
-           (workspace_id, url, types, run_events, alert_events, enabled, secret_sealed, updated_at)
-         VALUES (?, ?, ?, ?, ?, ?, ?, ?)
-         ON CONFLICT (workspace_id) DO UPDATE SET
+           (workspace_id, id, name, url, types, run_events, alert_events, enabled, secret_sealed, updated_at)
+         SELECT ?, ?, ?, ?, ?, ?, ?, ?, ?, ?
+         WHERE EXISTS (SELECT 1 FROM notification_webhooks WHERE workspace_id = ? AND id = ?)
+            OR (SELECT COUNT(*) FROM notification_webhooks WHERE workspace_id = ?) < ?
+         ON CONFLICT (workspace_id, id) DO UPDATE SET
+           name = excluded.name,
            url = excluded.url,
            types = excluded.types,
            run_events = excluded.run_events,
@@ -40,14 +57,31 @@ export class D1NotificationWebhookRepository {
            enabled = excluded.enabled,
            secret_sealed = excluded.secret_sealed,
            updated_at = excluded.updated_at`)
-            .bind(record.workspaceId, record.url, JSON.stringify(record.types), JSON.stringify(record.runEvents), JSON.stringify(record.alertEvents), record.enabled ? 1 : 0, record.secretSealed, record.updatedAt)
+            .bind(record.workspaceId, record.id, record.name, record.url, JSON.stringify(record.types), JSON.stringify(record.runEvents), JSON.stringify(record.alertEvents), record.enabled ? 1 : 0, record.secretSealed, record.updatedAt, record.workspaceId, record.id, record.workspaceId, limit)
             .run();
+        // A filtered-out row writes nothing, which is the refusal. An admitted one always reports a
+        // change, whether it inserted or took the conflict branch.
+        return (result.meta?.changes ?? 0) > 0 ? 'stored' : 'limit_reached';
     }
-    async delete(workspaceId) {
+    async delete(workspaceId, id) {
         await this.db
-            .prepare(`DELETE FROM notification_webhooks WHERE workspace_id = ?`)
-            .bind(workspaceId)
+            .prepare(`DELETE FROM notification_webhooks WHERE workspace_id = ? AND id = ?`)
+            .bind(workspaceId, id)
             .run();
     }
 }
+function toRecord(row) {
+    return {
+        workspaceId: row.workspace_id,
+        id: row.id,
+        name: row.name,
+        url: row.url,
+        types: parseNotificationWebhookTypes(row.types),
+        runEvents: parseRunLifecycleEvents(row.run_events),
+        alertEvents: parsePlatformAlertEvents(row.alert_events),
+        enabled: row.enabled === 1,
+        secretSealed: row.secret_sealed,
+        updatedAt: row.updated_at,
+    };
+}
 //# sourceMappingURL=D1NotificationWebhookRepository.js.map

package/dist/infrastructure/repositories/D1NotificationWebhookRepository.js.map

@@ -1 +1 @@
-{"version":3,"file":"D1NotificationWebhookRepository.js","sourceRoot":"","sources":["../../../src/infrastructure/repositories/D1NotificationWebhookRepository.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,6BAA6B,EAC7B,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,qBAAqB,CAAA;AAa5B;;;;GAIG;AACH,MAAM,OAAO,+BAA+B;IACzB,EAAE,CAAY;IAE/B,YAAY,EAAE,EAAE,EAAsB;QACpC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAA;IACd,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,WAAmB;QAC3B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE;aACtB,OAAO,CAAC,4DAA4D,CAAC;aACrE,IAAI,CAAC,WAAW,CAAC;aACjB,KAAK,EAA0B,CAAA;QAClC,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAA;QACrB,OAAO;YACL,WAAW,EAAE,GAAG,CAAC,YAAY;YAC7B,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,KAAK,EAAE,6BAA6B,CAAC,GAAG,CAAC,KAAK,CAAC;YAC/C,SAAS,EAAE,uBAAuB,CAAC,GAAG,CAAC,UAAU,CAAC;YAClD,WAAW,EAAE,wBAAwB,CAAC,GAAG,CAAC,YAAY,CAAC;YACvD,OAAO,EAAE,GAAG,CAAC,OAAO,KAAK,CAAC;YAC1B,YAAY,EAAE,GAAG,CAAC,aAAa;YAC/B,SAAS,EAAE,GAAG,CAAC,UAAU;SAC1B,CAAA;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,MAAiC;QACzC,MAAM,IAAI,CAAC,EAAE;aACV,OAAO,CACN;;;;;;;;;;4CAUoC,CACrC;aACA,IAAI,CACH,MAAM,CAAC,WAAW,EAClB,MAAM,CAAC,GAAG,EACV,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,EAC5B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,EAChC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,EAClC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EACtB,MAAM,CAAC,YAAY,EACnB,MAAM,CAAC,SAAS,CACjB;aACA,GAAG,EAAE,CAAA;IACV,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,WAAmB;QAC9B,MAAM,IAAI,CAAC,EAAE;aACV,OAAO,CAAC,0DAA0D,CAAC;aACnE,IAAI,CAAC,WAAW,CAAC;aACjB,GAAG,EAAE,CAAA;IACV,CAAC;CACF"}
+{"version":3,"file":"D1NotificationWebhookRepository.js","sourceRoot":"","sources":["../../../src/infrastructure/repositories/D1NotificationWebhookRepository.ts"],"names":[],"mappings":"AAMA,OAAO,EACL,6BAA6B,EAC7B,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,qBAAqB,CAAA;AAe5B;;;;;GAKG;AACH,MAAM,OAAO,+BAA+B;IACzB,EAAE,CAAY;IAE/B,YAAY,EAAE,EAAE,EAAsB;QACpC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAA;IACd,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,WAAmB,EAAE,EAAU;QACvC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE;aACtB,OAAO,CAAC,uEAAuE,CAAC;aAChF,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;aACrB,KAAK,EAA0B,CAAA;QAClC,OAAO,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACnC,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,WAAmB;QAC5B,6FAA6F;QAC7F,+FAA+F;QAC/F,4FAA4F;QAC5F,4EAA4E;QAC5E,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE;aAC9B,OAAO,CACN,uFAAuF,CACxF;aACA,IAAI,CAAC,WAAW,CAAC;aACjB,GAAG,EAA0B,CAAA;QAChC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IACtC,CAAC;IAED,KAAK,CAAC,GAAG,CACP,MAAiC,EACjC,KAAa;QAEb,yFAAyF;QACzF,4FAA4F;QAC5F,8FAA8F;QAC9F,qEAAqE;QACrE,EAAE;QACF,8FAA8F;QAC9F,0FAA0F;QAC1F,qFAAqF;QACrF,qDAAqD;QACrD,EAAE;QACF,yFAAyF;QACzF,8FAA8F;QAC9F,yDAAyD;QACzD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE;aACzB,OAAO,CACN;;;;;;;;;;;;;4CAaoC,CACrC;aACA,IAAI,CACH,MAAM,CAAC,WAAW,EAClB,MAAM,CAAC,EAAE,EACT,MAAM,CAAC,IAAI,EACX,MAAM,CAAC,GAAG,EACV,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,EAC5B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,EAChC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,EAClC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EACtB,MAAM,CAAC,YAAY,EACnB,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,WAAW,EAClB,MAAM,CAAC,EAAE,EACT,MAAM,CAAC,WAAW,EAClB,KAAK,CACN;aACA,GAAG,EAAE,CAAA;QACR,4FAA4F;QAC5F,2DAA2D;QAC3D,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAA;IACrE,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,WAAmB,EAAE,EAAU;QAC1C,MAAM,IAAI,CAAC,EAAE;aACV,OAAO,CAAC,qEAAqE,CAAC;aAC9E,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;aACrB,GAAG,EAAE,CAAA;IACV,CAAC;CACF;AAED,SAAS,QAAQ,CAAC,GAA2B;IAC3C,OAAO;QACL,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,KAAK,EAAE,6BAA6B,CAAC,GAAG,CAAC,KAAK,CAAC;QAC/C,SAAS,EAAE,uBAAuB,CAAC,GAAG,CAAC,UAAU,CAAC;QAClD,WAAW,EAAE,wBAAwB,CAAC,GAAG,CAAC,YAAY,CAAC;QACvD,OAAO,EAAE,GAAG,CAAC,OAAO,KAAK,CAAC;QAC1B,YAAY,EAAE,GAAG,CAAC,aAAa;QAC/B,SAAS,EAAE,GAAG,CAAC,UAAU;KAC1B,CAAA;AACH,CAAC"}

package/dist/infrastructure/workflows/sweeper.d.ts

@@ -2,35 +2,66 @@ import type { AgentRunRef, AgentRunRepository, Clock, EnvironmentTestRunRecord,
 import type { Workflow } from '@cloudflare/workers-types';
 /**
  * A run's durable instance, as the sweeper needs to classify it:
- *   - `alive`    — running/queued/waiting/paused; leave it.
- *   - `terminal` — the instance exists but completed/errored/terminated. It can NOT
+ *   - `alive`    : running/queued/waiting/paused/waitingForPause; leave it.
+ *   - `terminal` : the instance exists but completed/errored/terminated. It can NOT
  *                  be recreated (instance ids are unique), so a re-drive via
- *                  `create` is a silent no-op — the run must be FINALIZED instead.
- *   - `missing`  — no instance for this id; safe to (re-)create via `redrive`.
+ *                  `create` is a silent no-op and the run must be FINALIZED instead.
+ *   - `missing`  : no instance for this id; safe to (re-)create via `redrive`.
+ *   - `unknown`  : the probe could not classify the instance. The Workflows API refused the
+ *                  lookup, the binding for this run's kind is unconfigured, or Workflows
+ *                  itself answered `unknown`. Every disposition the sweeper has is DESTRUCTIVE
+ *                  against a live run (a re-drive of a run that is fine is at best wasted, a
+ *                  finalize kills it outright), so this state buys the run one more tick
+ *                  instead of guessing. It exists because the two swallows this replaced both
+ *                  answered `missing`, which made a Workflows outage read as every stale run
+ *                  having lost its instance at once, and re-drove the whole fleet with no log
+ *                  line to say why.
  */
-export type InstanceState = 'alive' | 'terminal' | 'missing';
+export type InstanceState = 'alive' | 'terminal' | 'missing' | 'unknown';
+/** What the probe learned about a run's durable instance. */
+export interface InstanceProbe {
+    state: InstanceState;
+    /**
+     * What the probe learned beyond the state, already scrubbed and capped for a surface a
+     * person reads:
+     *   - on `terminal`, the instance's OWN error (`InstanceStatus.error`) when Workflows
+     *     reported one. It is the only account of why the driver died that survives the
+     *     instance, and the run is about to be stopped with a fixed sentence that says nothing.
+     *   - on `unknown`, why the lookup could not classify.
+     *
+     * Absent when there is nothing to say, which is not the same as an empty string: a terminal
+     * instance that Workflows reports no error for ended on purpose.
+     */
+    detail?: string;
+}
 /** Tells the sweeper the state of a run's durable instance. */
 interface WorkflowLookup {
-    instanceState(runId: string): Promise<InstanceState>;
+    instanceState(runId: string): Promise<InstanceProbe>;
 }
 /** WorkflowLookup over a Cloudflare Workflows binding. */
 export declare class WorkflowsLookup implements WorkflowLookup {
     private readonly workflow;
-    constructor(workflow: Workflow);
-    instanceState(runId: string): Promise<InstanceState>;
+    private readonly log;
+    constructor(workflow: Workflow, log?: Logger);
+    instanceState(runId: string): Promise<InstanceProbe>;
 }
 export interface SweepDeps {
     agentRunRepository: AgentRunRepository;
     /** State of the durable instance backing this run (by kind). */
-    instanceState(ref: AgentRunRef): Promise<InstanceState>;
+    instanceState(ref: AgentRunRef): Promise<InstanceProbe>;
     /** (Re-)create the durable driver for a run whose instance is `missing`. */
     redrive(ref: AgentRunRef): Promise<void>;
     /**
      * Finalize a run whose instance is `terminal` (so it can't be re-created): mark it
      * stopped/failed and reclaim any leftover container, routed by kind. Without this,
      * such a run would show as `running` forever (the re-drive is a silent no-op).
+     *
+     * `cause` is the dead instance's own account of itself ({@link InstanceProbe.detail}), when
+     * Workflows kept one. It is the only thing that distinguishes the runs this branch settles,
+     * all of which otherwise carry the same fixed sentence, so it belongs in the stop reason
+     * rather than only in a log line the operator has to go and find.
      */
-    finalizeOrphan(ref: AgentRunRef): Promise<void>;
+    finalizeOrphan(ref: AgentRunRef, cause?: string): Promise<void>;
     /**
      * Fail an execution run whose instance stayed `missing` past the hard-stall deadline —
      * re-driving isn't resurrecting it, so flag it `stalled` (loud banner + retry) instead of
@@ -72,6 +103,12 @@ export interface SweepResult {
     finalized: number;
     /** Runs failed `stalled` (instance missing past the hard-stall deadline). */
     stalled: number;
+    /**
+     * Runs the probe could not classify, so the sweep left them alone. Reported apart from the
+     * three dispositions because it is not one: a rising number here means the sweeper is
+     * BLIND, which reads in every other number as a fleet that suddenly went quiet.
+     */
+    unknown: number;
 }
 /**
  * Backstop for runs that are still `running` in storage but whose Workflows
@@ -82,6 +119,10 @@ export interface SweepResult {
  *                  recreated under the same id, so re-driving is a no-op — without
  *                  this the run would be stuck `running` forever).
  *   - `alive`    → leave it.
+ *   - `unknown`  → leave it, count it, and forget its orphan clock. The sweep acts on what it
+ *                  KNOWS; an unclassifiable instance costs the run one tick of recovery
+ *                  latency, where guessing costs a live run its container or an orphan its
+ *                  place in the queue for as long as the outage lasts.
  * Pure orchestration over its ports so it is unit-testable with fakes.
  */
 export declare function sweepStuckRuns({ agentRunRepository, instanceState, redrive, finalizeOrphan, failStalled, clock, leaseMs, hardStallMs, orphanedSince, metrics, logger, }: SweepDeps): Promise<SweepResult>;
@@ -90,14 +131,15 @@ export interface EnvTestSweepDeps {
         listStale(cutoffMs: number): Promise<EnvironmentTestRunRecord[]>;
     };
     /** State of the run's EnvironmentTestWorkflow instance. */
-    instanceState(runId: string): Promise<InstanceState>;
+    instanceState(runId: string): Promise<InstanceProbe>;
     /** (Re-)create the durable driver for a run whose instance is `missing`. */
     redrive(workspaceId: string, runId: string): Promise<void>;
     /**
      * Finalize a run whose instance is `terminal` (it can't be re-created under the same
      * id): best-effort cleanup + mark it failed, via `EnvironmentTestService.expire`.
+     * `cause` is the dead instance's own error when Workflows kept one (see {@link SweepDeps}).
      */
-    finalizeOrphan(workspaceId: string, runId: string): Promise<void>;
+    finalizeOrphan(workspaceId: string, runId: string, cause?: string): Promise<void>;
     clock: Clock;
     /** A run is considered stuck if its record hasn't been touched in this many ms. */
     leaseMs: number;
@@ -115,6 +157,7 @@ export interface EnvTestSweepDeps {
 export declare function sweepStuckEnvTests({ repository, instanceState, redrive, finalizeOrphan, clock, leaseMs, }: EnvTestSweepDeps): Promise<{
     redriven: number;
     finalized: number;
+    unknown: number;
 }>;
 export {};
 //# sourceMappingURL=sweeper.d.ts.map

package/dist/infrastructure/workflows/sweeper.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sweeper.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/workflows/sweeper.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,WAAW,EACX,kBAAkB,EAClB,KAAK,EACL,wBAAwB,EACxB,MAAM,EACN,kBAAkB,EACnB,MAAM,qBAAqB,CAAA;AAE5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAA;AAEzD;;;;;;;GAOG;AACH,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,UAAU,GAAG,SAAS,CAAA;AAE5D,+DAA+D;AAC/D,UAAU,cAAc;IACtB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAAA;CACrD;AAED,0DAA0D;AAC1D,qBAAa,eAAgB,YAAW,cAAc;IACxC,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAArC,YAA6B,QAAQ,EAAE,QAAQ,EAAI;IAE7C,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAqBzD;CACF;AAED,MAAM,WAAW,SAAS;IACxB,kBAAkB,EAAE,kBAAkB,CAAA;IACtC,gEAAgE;IAChE,aAAa,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,aAAa,CAAC,CAAA;IACvD,4EAA4E;IAC5E,OAAO,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACxC;;;;OAIG;IACH,cAAc,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC/C;;;;OAIG;IACH,WAAW,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC5C,KAAK,EAAE,KAAK,CAAA;IACZ,yEAAyE;IACzE,OAAO,EAAE,MAAM,CAAA;IACf,6FAA6F;IAC7F,WAAW,EAAE,MAAM,CAAA;IACnB;;;;;;;;;;OAUG;IACH,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACnC;;;;;OAKG;IACH,OAAO,CAAC,EAAE,kBAAkB,CAAA;IAC5B,yFAAyF;IACzF,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,qCAAqC;AACrC,MAAM,WAAW,WAAW;IAC1B,+CAA+C;IAC/C,QAAQ,EAAE,MAAM,CAAA;IAChB,sEAAsE;IACtE,SAAS,EAAE,MAAM,CAAA;IACjB,6EAA6E;IAC7E,OAAO,EAAE,MAAM,CAAA;CAChB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,cAAc,CAAC,EACnC,kBAAkB,EAClB,aAAa,EACb,OAAO,EACP,cAAc,EACd,WAAW,EACX,KAAK,EACL,OAAO,EACP,WAAW,EACX,aAAyC,EACzC,OAAgC,EAChC,MAAmB,GACpB,EAAE,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,CA4DlC;AAED,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE;QAAE,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,EAAE,CAAC,CAAA;KAAE,CAAA;IAChF,2DAA2D;IAC3D,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAAA;IACpD,4EAA4E;IAC5E,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1D;;;OAGG;IACH,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACjE,KAAK,EAAE,KAAK,CAAA;IACZ,mFAAmF;IACnF,OAAO,EAAE,MAAM,CAAA;CAChB;AAED;;;;;;;;;GASG;AACH,wBAAsB,kBAAkB,CAAC,EACvC,UAAU,EACV,aAAa,EACb,OAAO,EACP,cAAc,EACd,KAAK,EACL,OAAO,GACR,EAAE,gBAAgB,GAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAgBrE"}
+{"version":3,"file":"sweeper.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/workflows/sweeper.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,WAAW,EACX,kBAAkB,EAClB,KAAK,EACL,wBAAwB,EACxB,MAAM,EACN,kBAAkB,EACnB,MAAM,qBAAqB,CAAA;AAQ5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAA;AAEzD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,CAAA;AAExE,6DAA6D;AAC7D,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,aAAa,CAAA;IACpB;;;;;;;;;;OAUG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,+DAA+D;AAC/D,UAAU,cAAc;IACtB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAAA;CACrD;AAwGD,0DAA0D;AAC1D,qBAAa,eAAgB,YAAW,cAAc;IAElD,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,GAAG;IAFtB,YACmB,QAAQ,EAAE,QAAQ,EAClB,GAAG,GAAE,MAAmB,EACvC;IAEE,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CA2CzD;CACF;AAED,MAAM,WAAW,SAAS;IACxB,kBAAkB,EAAE,kBAAkB,CAAA;IACtC,gEAAgE;IAChE,aAAa,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,aAAa,CAAC,CAAA;IACvD,4EAA4E;IAC5E,OAAO,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACxC;;;;;;;;;OASG;IACH,cAAc,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC/D;;;;OAIG;IACH,WAAW,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC5C,KAAK,EAAE,KAAK,CAAA;IACZ,yEAAyE;IACzE,OAAO,EAAE,MAAM,CAAA;IACf,6FAA6F;IAC7F,WAAW,EAAE,MAAM,CAAA;IACnB;;;;;;;;;;OAUG;IACH,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACnC;;;;;OAKG;IACH,OAAO,CAAC,EAAE,kBAAkB,CAAA;IAC5B,yFAAyF;IACzF,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,qCAAqC;AACrC,MAAM,WAAW,WAAW;IAC1B,+CAA+C;IAC/C,QAAQ,EAAE,MAAM,CAAA;IAChB,sEAAsE;IACtE,SAAS,EAAE,MAAM,CAAA;IACjB,6EAA6E;IAC7E,OAAO,EAAE,MAAM,CAAA;IACf;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAA;CAChB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,cAAc,CAAC,EACnC,kBAAkB,EAClB,aAAa,EACb,OAAO,EACP,cAAc,EACd,WAAW,EACX,KAAK,EACL,OAAO,EACP,WAAW,EACX,aAAyC,EACzC,OAAgC,EAChC,MAAmB,GACpB,EAAE,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,CAwElC;AAED,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE;QAAE,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,EAAE,CAAC,CAAA;KAAE,CAAA;IAChF,2DAA2D;IAC3D,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAAA;IACpD,4EAA4E;IAC5E,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1D;;;;OAIG;IACH,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACjF,KAAK,EAAE,KAAK,CAAA;IACZ,mFAAmF;IACnF,OAAO,EAAE,MAAM,CAAA;CAChB;AAED;;;;;;;;;GASG;AACH,wBAAsB,kBAAkB,CAAC,EACvC,UAAU,EACV,aAAa,EACb,OAAO,EACP,cAAc,EACd,KAAK,EACL,OAAO,GACR,EAAE,gBAAgB,GAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAwBtF"}

package/dist/infrastructure/workflows/sweeper.js

@@ -1,32 +1,156 @@
-import { noopLogger, noopOperationalMetrics, runBestEffort } from '@cat-factory/kernel';
+import { describeError, noopLogger, noopOperationalMetrics, redactSecrets, runBestEffort, } from '@cat-factory/kernel';
+/**
+ * How much of an instance's own error text is carried onto the run's stop reason. It is
+ * rendered in the run's details, so it is a sentence or two of context, not a transcript.
+ */
+const INSTANCE_DETAIL_CAP = 400;
+/**
+ * Workflows' code for "no instance with this id". It rides the error MESSAGE
+ * (`(instance.not_found) Instance does not exist` from the API, a bare `instance.not_found`
+ * from the local binding); the binding's own `WorkflowError.code` is a NUMBER, so this string
+ * is the only spelling stable across both.
+ */
+const INSTANCE_NOT_FOUND_CODE = 'instance.not_found';
+/** How far down a `cause` chain the classification below looks before giving up. */
+const CAUSE_DEPTH = 4;
+/**
+ * The message a thrown value carries, whatever shape it arrived in.
+ *
+ * Reading `.message` only off an `Error` is the trap: `Workflow.get` is declared to reject with
+ * a plain `WorkflowError` (`{ code?: number; message: string }`), which is not an `Error`, so an
+ * `instanceof` test falls through to `String(error)` and renders it `[object Object]`. That
+ * silently makes `missing` unreachable, and with it the ENTIRE stale-run backstop: every probe
+ * answers `unknown`, which by design takes no action at all. Empty when the value carries no
+ * message, so a caller can tell "nothing said" from "said nothing useful".
+ */
+function messageOf(error) {
+    if (typeof error === 'string')
+        return error;
+    if (error instanceof Error)
+        return error.message;
+    if (typeof error === 'object' && error !== null) {
+        const { message } = error;
+        if (typeof message === 'string')
+            return message;
+    }
+    return '';
+}
+/**
+ * Whether a lookup throw means "no instance with this id" (the state the sweeper acts on)
+ * rather than "the lookup failed" (which says nothing about the run).
+ *
+ * Matching the CODE rather than the prose keeps it stable across Workflows' two spellings, and
+ * walking the `cause` chain keeps it stable across a binding shim that re-throws wrapping the
+ * original. Anything else (a quota rejection, an unbound namespace, an API outage) is a lookup
+ * failure and must NOT be reported as a lost instance.
+ *
+ * A misclassification here is invisible in the sweep's dispositions, which is what
+ * `sweep.run_state_unknown` is counted for: a sweeper that can no longer recognise the code
+ * reports every stale run as unclassifiable rather than re-driving none of them quietly.
+ */
+function isInstanceNotFound(error) {
+    let current = error;
+    for (let depth = 0; depth < CAUSE_DEPTH && current != null; depth++) {
+        if (messageOf(current).includes(INSTANCE_NOT_FOUND_CODE))
+            return true;
+        current = current.cause;
+    }
+    return false;
+}
+/**
+ * Prepare free text for {@link InstanceProbe.detail}: scrub, trim, cap. Workflows echoes the
+ * step's own throw, which routinely carries a URL or a provider response, and this lands on a
+ * run surface a person reads. Empty in ⇒ empty out, so the caller can tell "nothing to say"
+ * from "said nothing useful".
+ */
+function probeDetail(text) {
+    const scrubbed = (redactSecrets(text.trim()) ?? '').trim();
+    return scrubbed.length > INSTANCE_DETAIL_CAP
+        ? `${scrubbed.slice(0, INSTANCE_DETAIL_CAP)}…`
+        : scrubbed;
+}
+/** The instance's own error, scrubbed and capped; empty when Workflows reported none. */
+function describeInstanceError(error) {
+    if (!error)
+        return '';
+    return probeDetail([error.name, error.message].filter(Boolean).join(': '));
+}
+/**
+ * Why a lookup could not answer, scrubbed and capped. Reads the message off whatever shape the
+ * throw arrived in (see {@link messageOf}) rather than stringifying it, since the plain
+ * `WorkflowError` the binding is declared to reject with renders as `[object Object]` and would
+ * put a run's only account of an outage as literally nothing.
+ */
+function describeLookupFailure(error) {
+    const message = messageOf(error);
+    if (!message)
+        return probeDetail(safeStringify(error));
+    const name = error instanceof Error ? error.name : '';
+    return probeDetail(name ? `${name}: ${message}` : message);
+}
+/** A last-resort rendering of a throw that carries no message. Never throws itself. */
+function safeStringify(error) {
+    try {
+        return typeof error === 'object' && error !== null ? JSON.stringify(error) : String(error);
+    }
+    catch {
+        // silent-catch-ok: the value is unserialisable (a cycle, a throwing getter); its type is
+        // the only honest thing left to say about it, and this is already the fallback path.
+        return Object.prototype.toString.call(error);
+    }
+}
 /** WorkflowLookup over a Cloudflare Workflows binding. */
 export class WorkflowsLookup {
     workflow;
-    constructor(workflow) {
+    log;
+    constructor(workflow, log = noopLogger) {
         this.workflow = workflow;
+        this.log = log;
     }
     async instanceState(runId) {
         let instance;
         try {
             instance = await this.workflow.get(runId);
         }
-        catch {
-            // No instance with this id was ever created → safe to create one.
-            return 'missing';
+        catch (error) {
+            if (isInstanceNotFound(error))
+                return { state: 'missing' };
+            // The lookup itself failed. Reporting `missing` here is how one Workflows outage became
+            // a fleet-wide re-drive; report that we do not know instead, and name the cause.
+            this.log.warn('workflow instance lookup failed', { runId, ...describeError(error) });
+            return { state: 'unknown', detail: describeLookupFailure(error) };
         }
         try {
-            const { status } = await instance.status();
-            return status === 'running' ||
+            const { status, error } = await instance.status();
+            if (status === 'running' ||
                 status === 'queued' ||
                 status === 'waiting' ||
-                status === 'paused'
-                ? 'alive'
-                : 'terminal';
+                status === 'paused' ||
+                // Finishing the current work before parking: still driving the run, so leaving it
+                // alone is right. Absent from the alive set it fell through to `terminal`, and the
+                // sweeper force-stopped a run that was pausing exactly as it was asked to.
+                status === 'waitingForPause') {
+                return { state: 'alive' };
+            }
+            // Workflows' OWN "I cannot tell you" answer. It shares the fall-through with the genuine
+            // terminal states, so it used to finalize the run, the most destructive disposition
+            // available, taken on the one answer that carries no information.
+            if (status === 'unknown') {
+                this.log.warn('workflow instance status is unknown', { runId });
+                return { state: 'unknown', detail: 'Workflows reported the instance status as unknown.' };
+            }
+            const detail = describeInstanceError(error);
+            return { state: 'terminal', ...(detail ? { detail } : {}) };
         }
-        catch {
-            // The instance handle resolved but status is unreadable — treat as missing so
-            // the sweeper tries to (re-)create rather than wrongly finalizing a live run.
-            return 'missing';
+        catch (error) {
+            // The handle `get` hands back is LAZY: it resolves nothing, so "no instance with this id"
+            // routinely surfaces here rather than from `get`. It is the same fact and takes the same
+            // classification, or a genuinely lost instance reads as an unreadable one and is never
+            // re-created.
+            if (isInstanceNotFound(error))
+                return { state: 'missing' };
+            this.log.warn('workflow instance status unreadable', { runId, ...describeError(error) });
+            return { state: 'unknown', detail: describeLookupFailure(error) };
         }
     }
 }
@@ -39,6 +163,10 @@ export class WorkflowsLookup {
  *                  recreated under the same id, so re-driving is a no-op — without
  *                  this the run would be stuck `running` forever).
  *   - `alive`    → leave it.
+ *   - `unknown`  → leave it, count it, and forget its orphan clock. The sweep acts on what it
+ *                  KNOWS; an unclassifiable instance costs the run one tick of recovery
+ *                  latency, where guessing costs a live run its container or an orphan its
+ *                  place in the queue for as long as the outage lasts.
  * Pure orchestration over its ports so it is unit-testable with fakes.
  */
 export async function sweepStuckRuns({ agentRunRepository, instanceState, redrive, finalizeOrphan, failStalled, clock, leaseMs, hardStallMs, orphanedSince = new Map(), metrics = noopOperationalMetrics, logger = noopLogger, }) {
@@ -47,19 +175,31 @@ export async function sweepStuckRuns({ agentRunRepository, instanceState, redriv
     let redriven = 0;
     let finalized = 0;
     let stalled = 0;
+    let unknown = 0;
     // Which runs were observed still-orphaned (`missing`) THIS tick — used to prune the
     // per-process clock of any run that recovered or went terminal so its deadline restarts
     // if it ever stalls again.
     const stillOrphaned = new Set();
     for (const ref of stale) {
-        const state = await instanceState(ref);
+        const { state, detail } = await instanceState(ref);
         if (state === 'alive') {
             orphanedSince.delete(ref.id);
             continue;
         }
+        if (state === 'unknown') {
+            // Forget the orphan clock rather than carrying it: the run was NOT observed orphaned
+            // this tick, and letting an outage age a deadline nobody could measure is how a
+            // Workflows incident would come out the far side as a batch of `stalled` runs. The
+            // deadline restarts from the next observation that actually saw something, which also
+            // guarantees the run is re-driven at least once before it can be given up on.
+            orphanedSince.delete(ref.id);
+            unknown++;
+            metrics.increment('sweep.run_state_unknown', { kind: ref.kind });
+            continue;
+        }
         if (state === 'terminal') {
             orphanedSince.delete(ref.id);
-            await finalizeOrphan(ref);
+            await finalizeOrphan(ref, detail);
             finalized++;
             // The run KIND is a bounded enum and the split that matters: bootstrap runs and
             // execution runs are lost for different reasons and fixed in different places.
@@ -99,7 +239,7 @@ export async function sweepStuckRuns({ agentRunRepository, instanceState, redriv
         if (!stillOrphaned.has(id))
             orphanedSince.delete(id);
     }
-    return { redriven, finalized, stalled };
+    return { redriven, finalized, stalled, unknown };
 }
 /**
  * The env-test sibling of {@link sweepStuckRuns}: self-test runs live in their own
@@ -115,18 +255,26 @@ export async function sweepStuckEnvTests({ repository, instanceState, redrive, f
     const stale = await repository.listStale(clock.now() - leaseMs);
     let redriven = 0;
     let finalized = 0;
+    let unknown = 0;
     for (const run of stale) {
-        const state = await instanceState(run.id);
+        const { state, detail } = await instanceState(run.id);
         if (state === 'alive')
             continue;
+        // Unclassifiable: leave it for the next tick, exactly like the run sweep. Re-driving a
+        // test whose instance is alive would be harmless, but expiring one that is provisioning
+        // real infrastructure is not, and neither disposition is safe to take blind.
+        if (state === 'unknown') {
+            unknown++;
+            continue;
+        }
         if (state === 'terminal') {
-            await finalizeOrphan(run.workspaceId, run.id);
+            await finalizeOrphan(run.workspaceId, run.id, detail);
             finalized++;
             continue;
         }
         await redrive(run.workspaceId, run.id);
         redriven++;
     }
-    return { redriven, finalized };
+    return { redriven, finalized, unknown };
 }
 //# sourceMappingURL=sweeper.js.map

package/dist/infrastructure/workflows/sweeper.js.map

@@ -1 +1 @@
-{"version":3,"file":"sweeper.js","sourceRoot":"","sources":["../../../src/infrastructure/workflows/sweeper.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,UAAU,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAkBvF,0DAA0D;AAC1D,MAAM,OAAO,eAAe;IACG,QAAQ;IAArC,YAA6B,QAAkB;wBAAlB,QAAQ;IAAa,CAAC;IAEnD,KAAK,CAAC,aAAa,CAAC,KAAa;QAC/B,IAAI,QAAQ,CAAA;QACZ,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;YAClE,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAA;YAC1C,OAAO,MAAM,KAAK,SAAS;gBACzB,MAAM,KAAK,QAAQ;gBACnB,MAAM,KAAK,SAAS;gBACpB,MAAM,KAAK,QAAQ;gBACnB,CAAC,CAAC,OAAO;gBACT,CAAC,CAAC,UAAU,CAAA;QAChB,CAAC;QAAC,MAAM,CAAC;YACP,8EAA8E;YAC9E,8EAA8E;YAC9E,OAAO,SAAS,CAAA;QAClB,CAAC;IACH,CAAC;CACF;AA0DD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EACnC,kBAAkB,EAClB,aAAa,EACb,OAAO,EACP,cAAc,EACd,WAAW,EACX,KAAK,EACL,OAAO,EACP,WAAW,EACX,aAAa,GAAG,IAAI,GAAG,EAAkB,EACzC,OAAO,GAAG,sBAAsB,EAChC,MAAM,GAAG,UAAU,GACT;IACV,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,CAAA;IACvB,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,SAAS,CAAC,GAAG,GAAG,OAAO,CAAC,CAAA;IAC/D,IAAI,QAAQ,GAAG,CAAC,CAAA;IAChB,IAAI,SAAS,GAAG,CAAC,CAAA;IACjB,IAAI,OAAO,GAAG,CAAC,CAAA;IACf,oFAAoF;IACpF,wFAAwF;IACxF,2BAA2B;IAC3B,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAA;IACvC,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAA;QACtC,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;YACtB,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YAC5B,SAAQ;QACV,CAAC;QACD,IAAI,KAAK,KAAK,UAAU,EAAE,CAAC;YACzB,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YAC5B,MAAM,cAAc,CAAC,GAAG,CAAC,CAAA;YACzB,SAAS,EAAE,CAAA;YACX,gFAAgF;YAChF,+EAA+E;YAC/E,OAAO,CAAC,SAAS,CAAC,qBAAqB,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAA;YAC5D,SAAQ;QACV,CAAC;QACD,qFAAqF;QACrF,mFAAmF;QACnF,uFAAuF;QACvF,wFAAwF;QACxF,0CAA0C;QAC1C,MAAM,iBAAiB,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,GAAG,CAAA;QAC1D,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,iBAAiB,CAAC,CAAA;QAC5C,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACzB,yFAAyF;QACzF,qFAAqF;QACrF,kBAAkB;QAClB,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW,IAAI,GAAG,GAAG,iBAAiB,GAAG,WAAW,EAAE,CAAC;YACtE,MAAM,WAAW,CAAC,GAAG,CAAC,CAAA;YACtB,OAAO,EAAE,CAAA;YACT,OAAO,CAAC,SAAS,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAA;YAC1D,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YAC5B,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YAC5B,SAAQ;QACV,CAAC;QACD,MAAM,OAAO,CAAC,GAAG,CAAC,CAAA;QAClB,QAAQ,EAAE,CAAA;QACV,OAAO,CAAC,SAAS,CAAC,oBAAoB,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAA;QAC3D,0FAA0F;QAC1F,0FAA0F;QAC1F,wFAAwF;QACxF,MAAM,aAAa,CAAC,MAAM,EAAE,qBAAqB,EAAE,GAAG,EAAE,CACtD,kBAAkB,CAAC,aAAa,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,CAAC,CAC1D,CAAA;IACH,CAAC;IACD,4FAA4F;IAC5F,sEAAsE;IACtE,KAAK,MAAM,EAAE,IAAI,aAAa,CAAC,IAAI,EAAE,EAAE,CAAC;QACtC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IACtD,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,CAAA;AACzC,CAAC;AAkBD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EACvC,UAAU,EACV,aAAa,EACb,OAAO,EACP,cAAc,EACd,KAAK,EACL,OAAO,GACU;IACjB,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,CAAA;IAC/D,IAAI,QAAQ,GAAG,CAAC,CAAA;IAChB,IAAI,SAAS,GAAG,CAAC,CAAA;IACjB,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACzC,IAAI,KAAK,KAAK,OAAO;YAAE,SAAQ;QAC/B,IAAI,KAAK,KAAK,UAAU,EAAE,CAAC;YACzB,MAAM,cAAc,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,CAAC,CAAA;YAC7C,SAAS,EAAE,CAAA;YACX,SAAQ;QACV,CAAC;QACD,MAAM,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,CAAC,CAAA;QACtC,QAAQ,EAAE,CAAA;IACZ,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAA;AAChC,CAAC"}
+{"version":3,"file":"sweeper.js","sourceRoot":"","sources":["../../../src/infrastructure/workflows/sweeper.ts"],"names":[],"mappings":"AAQA,OAAO,EACL,aAAa,EACb,UAAU,EACV,sBAAsB,EACtB,aAAa,EACb,aAAa,GACd,MAAM,qBAAqB,CAAA;AA4C5B;;;GAGG;AACH,MAAM,mBAAmB,GAAG,GAAG,CAAA;AAE/B;;;;;GAKG;AACH,MAAM,uBAAuB,GAAG,oBAAoB,CAAA;AAEpD,oFAAoF;AACpF,MAAM,WAAW,GAAG,CAAC,CAAA;AAErB;;;;;;;;;GASG;AACH,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IAC3C,IAAI,KAAK,YAAY,KAAK;QAAE,OAAO,KAAK,CAAC,OAAO,CAAA;IAChD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,MAAM,EAAE,OAAO,EAAE,GAAG,KAA8B,CAAA;QAClD,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,OAAO,CAAA;IACjD,CAAC;IACD,OAAO,EAAE,CAAA;AACX,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,OAAO,GAAY,KAAK,CAAA;IAC5B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,WAAW,IAAI,OAAO,IAAI,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACpE,IAAI,SAAS,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,uBAAuB,CAAC;YAAE,OAAO,IAAI,CAAA;QACrE,OAAO,GAAI,OAA+B,CAAC,KAAK,CAAA;IAClD,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,QAAQ,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IAC1D,OAAO,QAAQ,CAAC,MAAM,GAAG,mBAAmB;QAC1C,CAAC,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,mBAAmB,CAAC,GAAG;QAC9C,CAAC,CAAC,QAAQ,CAAA;AACd,CAAC;AAED,yFAAyF;AACzF,SAAS,qBAAqB,CAAC,KAAsD;IACnF,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAA;IACrB,OAAO,WAAW,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;AAC5E,CAAC;AAED;;;;;GAKG;AACH,SAAS,qBAAqB,CAAC,KAAc;IAC3C,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,CAAA;IAChC,IAAI,CAAC,OAAO;QAAE,OAAO,WAAW,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAA;IACtD,MAAM,IAAI,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;IACrD,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;AAC5D,CAAC;AAED,uFAAuF;AACvF,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,CAAC;QACH,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC5F,CAAC;IAAC,MAAM,CAAC;QACP,yFAAyF;QACzF,qFAAqF;QACrF,OAAO,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC9C,CAAC;AACH,CAAC;AAED,0DAA0D;AAC1D,MAAM,OAAO,eAAe;IAEP,QAAQ;IACR,GAAG;IAFtB,YACmB,QAAkB,EAClB,GAAG,GAAW,UAAU;wBADxB,QAAQ;mBACR,GAAG;IACnB,CAAC;IAEJ,KAAK,CAAC,aAAa,CAAC,KAAa;QAC/B,IAAI,QAAQ,CAAA;QACZ,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,kBAAkB,CAAC,KAAK,CAAC;gBAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;YAC1D,wFAAwF;YACxF,iFAAiF;YACjF,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,iCAAiC,EAAE,EAAE,KAAK,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;YACpF,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAA;QACnE,CAAC;QACD,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAA;YACjD,IACE,MAAM,KAAK,SAAS;gBACpB,MAAM,KAAK,QAAQ;gBACnB,MAAM,KAAK,SAAS;gBACpB,MAAM,KAAK,QAAQ;gBACnB,kFAAkF;gBAClF,mFAAmF;gBACnF,2EAA2E;gBAC3E,MAAM,KAAK,iBAAiB,EAC5B,CAAC;gBACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAA;YAC3B,CAAC;YACD,yFAAyF;YACzF,oFAAoF;YACpF,kEAAkE;YAClE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,qCAAqC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;gBAC/D,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,oDAAoD,EAAE,CAAA;YAC3F,CAAC;YACD,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAA;YAC3C,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAA;QAC7D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,0FAA0F;YAC1F,yFAAyF;YACzF,uFAAuF;YACvF,cAAc;YACd,IAAI,kBAAkB,CAAC,KAAK,CAAC;gBAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;YAC1D,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,qCAAqC,EAAE,EAAE,KAAK,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;YACxF,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAA;QACnE,CAAC;IACH,CAAC;CACF;AAqED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EACnC,kBAAkB,EAClB,aAAa,EACb,OAAO,EACP,cAAc,EACd,WAAW,EACX,KAAK,EACL,OAAO,EACP,WAAW,EACX,aAAa,GAAG,IAAI,GAAG,EAAkB,EACzC,OAAO,GAAG,sBAAsB,EAChC,MAAM,GAAG,UAAU,GACT;IACV,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,CAAA;IACvB,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,SAAS,CAAC,GAAG,GAAG,OAAO,CAAC,CAAA;IAC/D,IAAI,QAAQ,GAAG,CAAC,CAAA;IAChB,IAAI,SAAS,GAAG,CAAC,CAAA;IACjB,IAAI,OAAO,GAAG,CAAC,CAAA;IACf,IAAI,OAAO,GAAG,CAAC,CAAA;IACf,oFAAoF;IACpF,wFAAwF;IACxF,2BAA2B;IAC3B,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAA;IACvC,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAA;QAClD,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;YACtB,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YAC5B,SAAQ;QACV,CAAC;QACD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,qFAAqF;YACrF,gFAAgF;YAChF,mFAAmF;YACnF,sFAAsF;YACtF,8EAA8E;YAC9E,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YAC5B,OAAO,EAAE,CAAA;YACT,OAAO,CAAC,SAAS,CAAC,yBAAyB,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAA;YAChE,SAAQ;QACV,CAAC;QACD,IAAI,KAAK,KAAK,UAAU,EAAE,CAAC;YACzB,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YAC5B,MAAM,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;YACjC,SAAS,EAAE,CAAA;YACX,gFAAgF;YAChF,+EAA+E;YAC/E,OAAO,CAAC,SAAS,CAAC,qBAAqB,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAA;YAC5D,SAAQ;QACV,CAAC;QACD,qFAAqF;QACrF,mFAAmF;QACnF,uFAAuF;QACvF,wFAAwF;QACxF,0CAA0C;QAC1C,MAAM,iBAAiB,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,GAAG,CAAA;QAC1D,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,iBAAiB,CAAC,CAAA;QAC5C,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACzB,yFAAyF;QACzF,qFAAqF;QACrF,kBAAkB;QAClB,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW,IAAI,GAAG,GAAG,iBAAiB,GAAG,WAAW,EAAE,CAAC;YACtE,MAAM,WAAW,CAAC,GAAG,CAAC,CAAA;YACtB,OAAO,EAAE,CAAA;YACT,OAAO,CAAC,SAAS,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAA;YAC1D,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YAC5B,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YAC5B,SAAQ;QACV,CAAC;QACD,MAAM,OAAO,CAAC,GAAG,CAAC,CAAA;QAClB,QAAQ,EAAE,CAAA;QACV,OAAO,CAAC,SAAS,CAAC,oBAAoB,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAA;QAC3D,0FAA0F;QAC1F,0FAA0F;QAC1F,wFAAwF;QACxF,MAAM,aAAa,CAAC,MAAM,EAAE,qBAAqB,EAAE,GAAG,EAAE,CACtD,kBAAkB,CAAC,aAAa,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,CAAC,CAC1D,CAAA;IACH,CAAC;IACD,4FAA4F;IAC5F,sEAAsE;IACtE,KAAK,MAAM,EAAE,IAAI,aAAa,CAAC,IAAI,EAAE,EAAE,CAAC;QACtC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IACtD,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,CAAA;AAClD,CAAC;AAmBD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EACvC,UAAU,EACV,aAAa,EACb,OAAO,EACP,cAAc,EACd,KAAK,EACL,OAAO,GACU;IACjB,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,CAAA;IAC/D,IAAI,QAAQ,GAAG,CAAC,CAAA;IAChB,IAAI,SAAS,GAAG,CAAC,CAAA;IACjB,IAAI,OAAO,GAAG,CAAC,CAAA;IACf,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACrD,IAAI,KAAK,KAAK,OAAO;YAAE,SAAQ;QAC/B,uFAAuF;QACvF,wFAAwF;QACxF,6EAA6E;QAC7E,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,EAAE,CAAA;YACT,SAAQ;QACV,CAAC;QACD,IAAI,KAAK,KAAK,UAAU,EAAE,CAAC;YACzB,MAAM,cAAc,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;YACrD,SAAS,EAAE,CAAA;YACX,SAAQ;QACV,CAAC;QACD,MAAM,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,CAAC,CAAA;QACtC,QAAQ,EAAE,CAAA;IACZ,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,CAAA;AACzC,CAAC"}

package/migrations/0085_notification_webhook_collection.sql

@@ -0,0 +1,37 @@
+-- Several NAMED outbound webhooks per workspace, replacing the one-row-per-workspace shape from
+-- migration 0061. One endpoint per workspace made a second integration's enrolment a hostile act:
+-- registering it overwrote whatever was already there, and the only symptom was that the previous
+-- receiver went quiet. Each row now carries a caller-chosen `id` (the key, alongside the workspace)
+-- and an operator-facing `name`.
+--
+-- SQLite cannot re-key a table in place, so this is the standard rebuild. Existing rows migrate to
+-- the id `default`, which is exactly what the singular `/api/v1/notification-webhook` routes now
+-- address: an already-registered endpoint keeps delivering, and the caller that registered it keeps
+-- addressing it through the same route.
+
+CREATE TABLE notification_webhooks_new (
+  workspace_id TEXT NOT NULL,
+  id TEXT NOT NULL,
+  name TEXT NOT NULL,
+  url TEXT NOT NULL,
+  types TEXT NOT NULL DEFAULT '[]',
+  run_events TEXT NOT NULL DEFAULT '[]',
+  alert_events TEXT NOT NULL DEFAULT '[]',
+  enabled INTEGER NOT NULL DEFAULT 1,
+  secret_sealed TEXT,
+  updated_at INTEGER NOT NULL,
+  PRIMARY KEY (workspace_id, id)
+);
+
+INSERT INTO notification_webhooks_new
+  (workspace_id, id, name, url, types, run_events, alert_events, enabled, secret_sealed, updated_at)
+SELECT
+  workspace_id, 'default', 'Default', url, types, run_events, alert_events, enabled, secret_sealed, updated_at
+FROM notification_webhooks;
+
+DROP TABLE notification_webhooks;
+
+ALTER TABLE notification_webhooks_new RENAME TO notification_webhooks;
+
+-- No extra index on `workspace_id`: it is the leading column of the composite primary key, so the
+-- per-workspace list every delivery reads is already served by that index.