@cat-factory/worker 0.176.0 → 0.178.0

package/dist/infrastructure/containers/stopCause.d.ts

@@ -12,9 +12,30 @@
 export type ContainerStopCause = 'rollout' | 'idle';
 /** DO-storage key holding the {@link StopCauseRecord} of the most recent self-observed stop. */
 export declare const STOP_CAUSE_KEY = "containerStopCause";
-/** What the container persists when it observes its own reclaim. */
+/**
+ * What the runtime reported when the workload stopped, mirroring the container base class's
+ * `StopParams`. Recorded for EVERY stop, including the ones no {@link ContainerStopCause}
+ * explains, because it answers a different question: the cause decides the recovery BUDGET, the
+ * exit state is the only account of the death anyone gets afterwards.
+ *
+ * A Cloudflare Container's stdout is delivered to the deployment's Workers logs and is not
+ * readable back from inside the Durable Object, so this is the whole of the post-mortem this
+ * runtime can mint. It is still the difference between "container evicted or crashed" and "exit
+ * code 137", i.e. between a run nobody can diagnose and an out-of-memory kill.
+ */
+export interface ContainerExitState {
+    code: number;
+    reason: 'exit' | 'runtime_signal';
+}
+/** What the container persists when it observes its own stop. */
 export interface StopCauseRecord {
-    cause: ContainerStopCause;
+    /**
+     * The infrastructure-churn cause, when the container recognised one. Absent for a stop it
+     * cannot explain (a crash, an OOM kill), which is exactly the case {@link exit} exists for.
+     */
+    cause?: ContainerStopCause;
+    /** What the runtime reported about the stop, when a hook that carries it fired. */
+    exit?: ContainerExitState;
     /** Epoch ms the stop was observed. */
     at: number;
     /**
@@ -49,6 +70,42 @@ export declare const ATTRIBUTION_WINDOW_MS: {
     rollout: number;
     idle: number;
 };
+/**
+ * How long a stop this container could NOT attribute (a crash, an OOM kill) may still explain a
+ * 404 poll, i.e. the window governing a record that carries only an {@link ContainerExitState}.
+ *
+ * The same reasoning as the `idle` window, and deliberately the same number: what separates the
+ * death from the poll that discovers it is the POLL GAP, and a crash is discovered by the same
+ * ~15s tick an idle reclaim is, stretched by whatever delayed the driver. Sizing this to the
+ * rollout case instead would read every crash discovered after a re-drive as unexplained, which
+ * is the class this record exists to explain.
+ *
+ * Wide is affordable here for a reason the cause windows do not share: an exit state changes no
+ * verdict. It is attached to the failure `detail`, so the cost of over-attributing is a
+ * misleading sentence, never a wrongly-extended recovery budget.
+ */
+export declare const EXIT_ATTRIBUTION_WINDOW_MS: number;
+/**
+ * How far apart two hook calls may be and still be treated as observations of ONE stop, i.e. the
+ * bound on {@link recordStopCause}'s merge.
+ *
+ * The merge exists for a single reason: `onError` and `onStop` are two views of the same death,
+ * fired by the runtime within moments of each other. Anything older is a DIFFERENT, earlier
+ * stop, and merging onto it is not conservative, it is destructive twice over: the new
+ * observation inherits the old record's `at`, so it is born already aged, and both halves then
+ * fall out of their own attribution windows and explain nothing. A record that is 40 minutes old
+ * would silently swallow the crash that just happened.
+ *
+ * Sized generously against what it models (two hooks, milliseconds apart) and far below the
+ * narrowest attribution window, so it cannot be the thing that decides an attribution: what a
+ * merge may do is complete an account of one stop, never date it.
+ */
+export declare const STOP_MERGE_WINDOW_MS = 60000;
+/** What a container observed about its own stop, once attributed to the job that reads it. */
+export interface StopObservation {
+    cause?: ContainerStopCause;
+    exit?: ContainerExitState;
+}
 /**
  * The message the base container class surfaces when the RUNTIME (not the workload) stopped a
  * container: a deploy draining the old version. Its own exit-code parser is keyed on the plain
@@ -57,18 +114,43 @@ export declare const ATTRIBUTION_WINDOW_MS: {
  */
 export declare function isRolloutSignal(error: unknown): boolean;
 /**
- * The cause a stored record still justifies at `now`, or `undefined` when there is nothing to
- * attribute.
+ * What a container should record about a stop the runtime just reported, or undefined when it
+ * should record nothing.
+ *
+ * Two rules, both about what the stop MEANS rather than what it says:
+ *
+ * - A `runtime_signal` 143 is the rollout drain surfacing through this hook instead of (or as
+ *   well as) `onError`, depending on the runtime version, so it names the same cause.
+ * - A stop the container ASKED for records nothing at all. Its idle reclaim and its shutdown RPC
+ *   both work by signalling the container, so the exit that comes back is this container's own
+ *   request echoed at it (escalating to a SIGKILL 137 when the workload does not exit inside the
+ *   grace period), not an observation of how anything died. Recorded anyway, it is read back as
+ *   the container's cause of death and reported to the operator as "most often an out-of-memory
+ *   kill" underneath a verdict that says the platform reclaimed an idle container. The cause the
+ *   caller recorded when it decided to stop is the whole account, and it is already stored.
+ */
+export declare function observationForStop(params: {
+    exitCode: number;
+    reason: 'exit' | 'runtime_signal';
+}, selfInitiated: boolean): StopObservation | undefined;
+/**
+ * What a stored record still explains at `now`, or an EMPTY observation when it explains
+ * nothing.
  *
- * `undefined` covers three things that all mean the same to the caller: nothing was recorded,
- * the record outlived its cause's window (the container recovered and ran on, so a later death
+ * An empty observation covers three things that all mean the same to the caller: nothing was
+ * recorded, the record outlived its window (the container recovered and ran on, so a later death
  * is its own), or the record names a cause this build no longer has. The last is possible
  * because the record is PERSISTED and the vocabulary is closed: a deploy that retires a member
  * leaves rows behind. All three land on the caller's existing default, reporting the eviction
  * as a `crash`, which is the honest reading of "no attribution" and the conservative one:
  * it costs a run one restart of its recovery budget, never a wrongly-extended one.
+ *
+ * The two halves are attributed INDEPENDENTLY, on their own windows: a record can be too old to
+ * excuse the eviction as churn while still being the only account of how the container died, and
+ * dropping the exit state with the cause would throw away the diagnostic to protect a budget the
+ * diagnostic never touches.
  */
-export declare function attributeStopCause(record: unknown, now: number, claimant: string): ContainerStopCause | undefined;
+export declare function attributeStopCause(record: unknown, now: number, claimant: string): StopObservation;
 /**
  * The slice of DO storage the bookkeeping below needs. Narrowed to three methods so the rules
  * can be exercised against a plain fake. The alternative is asserting them through a real
@@ -79,8 +161,57 @@ export interface StopCauseStorage {
     put: (key: string, value: StopCauseRecord) => Promise<void>;
     delete: (key: string) => Promise<unknown>;
 }
-/** Persist what this container just observed about its own reclaim. */
-export declare function recordStopCause(storage: StopCauseStorage, cause: ContainerStopCause, now: number): Promise<void>;
+/**
+ * Persist what this container just observed about its own stop, MERGING onto an unclaimed record
+ * of the SAME stop rather than replacing it.
+ *
+ * Merging is the point. One stop reaches this container through up to two hooks carrying
+ * different halves of the answer: `onError` recognises a rollout drain and knows no exit state,
+ * `onStop` carries `{ exitCode, reason }` and cannot name the churn. They fire in either order
+ * (and, on some runtime versions, both), so a plain overwrite means whichever landed second
+ * silently discarded the other's half: either the recovery budget or the only account of the
+ * death, depending on the ordering that day.
+ *
+ * Two records are never merged:
+ *
+ * - a CLAIMED one, which has already explained somebody's eviction, so anything observed after
+ *   it belongs to the next one;
+ * - one older than {@link STOP_MERGE_WINDOW_MS}, which is a different stop entirely. This
+ *   container's records are not reliably cleared between stops (`takeStopCause` deliberately
+ *   leaves an expired record in place, and only an accepted dispatch deletes one), so a stale
+ *   record is the ORDINARY state of a container that idled out and was re-driven, not an edge
+ *   case. Merging onto it would back-date the new observation to the old stop's `at` and age it
+ *   out of its own attribution window on arrival: the crash that just happened would be
+ *   recorded, read back, and dropped as too old to explain the eviction it caused.
+ *
+ * The kept `at` is the EARLIEST of the two observations, which within the merge window is a
+ * choice between timestamps moments apart: both describe one stop, and the window measures how
+ * long ago that stop happened.
+ */
+export declare function recordStopCause(storage: StopCauseStorage, observed: StopObservation, now: number): Promise<void>;
+/**
+ * The one-line account of a container's stop for the eviction `detail`, or undefined when
+ * nothing was recorded.
+ *
+ * `cause` is the account the run has ALREADY been given, and passing it is what keeps the detail
+ * from arguing with the verdict beside it. The two halves are recorded independently and the
+ * exit state is attached whether or not a cause was recognised, so they routinely describe one
+ * event twice: an idle reclaim is performed BY the platform with a SIGKILL, so a run correctly
+ * reported as "idle container reclaimed between polls" carries exit 137, and read as an
+ * unexplained death that code says "most often an out-of-memory kill". The operator is then
+ * holding a verdict and a detail that cannot both be true, which is worse than either alone,
+ * because there is no way to tell which one to act on.
+ *
+ * So the interpretation is offered only where it is the only account there is. Where a cause was
+ * named, the exit code is reported as the MECHANICS of that stop: still the difference between
+ * "reclaimed" and "reclaimed with a SIGKILL", and never a second, competing cause of death.
+ *
+ * Either way it states the platform's own limit rather than leaving it to be inferred: a
+ * Cloudflare Container writes its stdout to the deployment's Workers logs, and nothing inside
+ * the Durable Object can read it back, so an operator who reads this and goes looking for a log
+ * tail here should be told where the tail actually is.
+ */
+export declare function describeContainerExit(exit: ContainerExitState | undefined, cause?: ContainerStopCause): string | undefined;
 /**
  * Forget whatever this container observed before now.
  *
@@ -93,13 +224,17 @@ export declare function recordStopCause(storage: StopCauseStorage, cause: Contai
  */
 export declare function clearStopCause(storage: StopCauseStorage): Promise<void>;
 /**
- * Read the cause explaining `claimant`'s 404 poll, CLAIMING it for that job.
+ * Read what explains `claimant`'s 404 poll, CLAIMING it for that job.
  *
- * One reclaim explains exactly one job's eviction: the engine answers one by re-dispatching onto
+ * One stop explains exactly one job's eviction: the engine answers one by re-dispatching onto
  * a fresh container under the same DO id, so an unclaimed record would still be sitting there to
  * excuse the next death, whenever and for whatever reason it came. The claim is written rather
  * than the record deleted so a REPLAYED poll for the same job reads back the same answer (see
  * {@link StopCauseRecord.claimedBy}).
+ *
+ * The claim covers the record, not one half of it: an exit state read here is spent as surely as
+ * a cause is, because attaching one container's death to two runs' failures is the same lie
+ * either way.
  */
-export declare function takeStopCause(storage: StopCauseStorage, now: number, claimant: string): Promise<ContainerStopCause | undefined>;
+export declare function takeStopCause(storage: StopCauseStorage, now: number, claimant: string): Promise<StopObservation>;
 //# sourceMappingURL=stopCause.d.ts.map

package/dist/infrastructure/containers/stopCause.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stopCause.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/containers/stopCause.ts"],"names":[],"mappings":"AAOA;;;;;;;;;;GAUG;AACH,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,MAAM,CAAA;AAEnD,gGAAgG;AAChG,eAAO,MAAM,cAAc,uBAAuB,CAAA;AAElD,oEAAoE;AACpE,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,kBAAkB,CAAA;IACzB,sCAAsC;IACtC,EAAE,EAAE,MAAM,CAAA;IACV;;;;;;;;;OASG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,qBAAqB;;;CAGY,CAAA;AAE9C;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAIvD;AAWD;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,OAAO,EACf,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,GACf,kBAAkB,GAAG,SAAS,CAQhC;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IACtC,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAC3D,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;CAC1C;AAED,uEAAuE;AACvE,wBAAsB,eAAe,CACnC,OAAO,EAAE,gBAAgB,EACzB,KAAK,EAAE,kBAAkB,EACzB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,IAAI,CAAC,CAEf;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAE7E;AAED;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,gBAAgB,EACzB,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CASzC"}
+{"version":3,"file":"stopCause.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/containers/stopCause.ts"],"names":[],"mappings":"AAOA;;;;;;;;;;GAUG;AACH,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,MAAM,CAAA;AAEnD,gGAAgG;AAChG,eAAO,MAAM,cAAc,uBAAuB,CAAA;AAElD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,GAAG,gBAAgB,CAAA;CAClC;AAED,iEAAiE;AACjE,MAAM,WAAW,eAAe;IAC9B;;;OAGG;IACH,KAAK,CAAC,EAAE,kBAAkB,CAAA;IAC1B,mFAAmF;IACnF,IAAI,CAAC,EAAE,kBAAkB,CAAA;IACzB,sCAAsC;IACtC,EAAE,EAAE,MAAM,CAAA;IACV;;;;;;;;;OASG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,qBAAqB;;;CAGY,CAAA;AAE9C;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,0BAA0B,QAAc,CAAA;AAErD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,oBAAoB,QAAS,CAAA;AAE1C,8FAA8F;AAC9F,MAAM,WAAW,eAAe;IAC9B,KAAK,CAAC,EAAE,kBAAkB,CAAA;IAC1B,IAAI,CAAC,EAAE,kBAAkB,CAAA;CAC1B;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAIvD;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,CAAA;CAAE,EAC/D,aAAa,EAAE,OAAO,GACrB,eAAe,GAAG,SAAS,CAO7B;AAwBD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,OAAO,EACf,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,GACf,eAAe,CAYjB;AAOD;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IACtC,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAC3D,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;CAC1C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,gBAAgB,EACzB,QAAQ,EAAE,eAAe,EACzB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,IAAI,CAAC,CAUf;AAmDD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,kBAAkB,GAAG,SAAS,EACpC,KAAK,CAAC,EAAE,kBAAkB,GACzB,MAAM,GAAG,SAAS,CAgBpB;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAE7E;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,gBAAgB,EACzB,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,eAAe,CAAC,CAS1B"}

package/dist/infrastructure/containers/stopCause.js

@@ -26,6 +26,37 @@ export const ATTRIBUTION_WINDOW_MS = {
     rollout: 120_000,
     idle: 30 * 60_000,
 };
+/**
+ * How long a stop this container could NOT attribute (a crash, an OOM kill) may still explain a
+ * 404 poll, i.e. the window governing a record that carries only an {@link ContainerExitState}.
+ *
+ * The same reasoning as the `idle` window, and deliberately the same number: what separates the
+ * death from the poll that discovers it is the POLL GAP, and a crash is discovered by the same
+ * ~15s tick an idle reclaim is, stretched by whatever delayed the driver. Sizing this to the
+ * rollout case instead would read every crash discovered after a re-drive as unexplained, which
+ * is the class this record exists to explain.
+ *
+ * Wide is affordable here for a reason the cause windows do not share: an exit state changes no
+ * verdict. It is attached to the failure `detail`, so the cost of over-attributing is a
+ * misleading sentence, never a wrongly-extended recovery budget.
+ */
+export const EXIT_ATTRIBUTION_WINDOW_MS = 30 * 60_000;
+/**
+ * How far apart two hook calls may be and still be treated as observations of ONE stop, i.e. the
+ * bound on {@link recordStopCause}'s merge.
+ *
+ * The merge exists for a single reason: `onError` and `onStop` are two views of the same death,
+ * fired by the runtime within moments of each other. Anything older is a DIFFERENT, earlier
+ * stop, and merging onto it is not conservative, it is destructive twice over: the new
+ * observation inherits the old record's `at`, so it is born already aged, and both halves then
+ * fall out of their own attribution windows and explain nothing. A record that is 40 minutes old
+ * would silently swallow the crash that just happened.
+ *
+ * Sized generously against what it models (two hooks, milliseconds apart) and far below the
+ * narrowest attribution window, so it cannot be the thing that decides an attribution: what a
+ * merge may do is complete an account of one stop, never date it.
+ */
+export const STOP_MERGE_WINDOW_MS = 60_000;
 /**
  * The message the base container class surfaces when the RUNTIME (not the workload) stopped a
  * container: a deploy draining the old version. Its own exit-code parser is keyed on the plain
@@ -36,6 +67,31 @@ export function isRolloutSignal(error) {
     const message = error instanceof Error ? error.message : typeof error === 'string' ? error : String(error);
     return /new version rollout|runtime signalled the container to exit/i.test(message);
 }
+/**
+ * What a container should record about a stop the runtime just reported, or undefined when it
+ * should record nothing.
+ *
+ * Two rules, both about what the stop MEANS rather than what it says:
+ *
+ * - A `runtime_signal` 143 is the rollout drain surfacing through this hook instead of (or as
+ *   well as) `onError`, depending on the runtime version, so it names the same cause.
+ * - A stop the container ASKED for records nothing at all. Its idle reclaim and its shutdown RPC
+ *   both work by signalling the container, so the exit that comes back is this container's own
+ *   request echoed at it (escalating to a SIGKILL 137 when the workload does not exit inside the
+ *   grace period), not an observation of how anything died. Recorded anyway, it is read back as
+ *   the container's cause of death and reported to the operator as "most often an out-of-memory
+ *   kill" underneath a verdict that says the platform reclaimed an idle container. The cause the
+ *   caller recorded when it decided to stop is the whole account, and it is already stored.
+ */
+export function observationForStop(params, selfInitiated) {
+    if (selfInitiated)
+        return undefined;
+    const rollout = params.reason === 'runtime_signal' && params.exitCode === 143;
+    return {
+        ...(rollout ? { cause: 'rollout' } : {}),
+        exit: { code: params.exitCode, reason: params.reason },
+    };
+}
 /**
  * Whether a value read back out of DO storage is still a cause this build knows. Derived from
  * the window table's own keys rather than restated, so retiring a cause fails the build here
@@ -45,32 +101,177 @@ function isContainerStopCause(value) {
     return typeof value === 'string' && Object.hasOwn(ATTRIBUTION_WINDOW_MS, value);
 }
 /**
- * The cause a stored record still justifies at `now`, or `undefined` when there is nothing to
- * attribute.
+ * Whether a value read back out of DO storage is an exit state this build can render.
  *
- * `undefined` covers three things that all mean the same to the caller: nothing was recorded,
- * the record outlived its cause's window (the container recovered and ran on, so a later death
+ * The `reason` union is closed and PERSISTED, so an unknown member is possible after a runtime
+ * bump; it degrades to "no exit state recorded" rather than being rendered as a bare string,
+ * because a reason nobody has worded says less than the exit code alone already does.
+ */
+function isContainerExitState(value) {
+    if (!value || typeof value !== 'object')
+        return false;
+    const { code, reason } = value;
+    return typeof code === 'number' && (reason === 'exit' || reason === 'runtime_signal');
+}
+/**
+ * What a stored record still explains at `now`, or an EMPTY observation when it explains
+ * nothing.
+ *
+ * An empty observation covers three things that all mean the same to the caller: nothing was
+ * recorded, the record outlived its window (the container recovered and ran on, so a later death
  * is its own), or the record names a cause this build no longer has. The last is possible
  * because the record is PERSISTED and the vocabulary is closed: a deploy that retires a member
  * leaves rows behind. All three land on the caller's existing default, reporting the eviction
  * as a `crash`, which is the honest reading of "no attribution" and the conservative one:
  * it costs a run one restart of its recovery budget, never a wrongly-extended one.
+ *
+ * The two halves are attributed INDEPENDENTLY, on their own windows: a record can be too old to
+ * excuse the eviction as churn while still being the only account of how the container died, and
+ * dropping the exit state with the cause would throw away the diagnostic to protect a budget the
+ * diagnostic never touches.
  */
 export function attributeStopCause(record, now, claimant) {
     if (!record || typeof record !== 'object')
-        return undefined;
-    const { cause, at, claimedBy } = record;
-    if (!isContainerStopCause(cause) || typeof at !== 'number')
-        return undefined;
+        return {};
+    const { cause, exit, at, claimedBy } = record;
+    if (typeof at !== 'number')
+        return {};
     // Spent on somebody else's eviction. Only the job that claimed it may read it back, which is
     // what lets a replay be idempotent without letting one reclaim excuse two deaths.
     if (claimedBy !== undefined && claimedBy !== claimant)
+        return {};
+    const age = now - at;
+    return {
+        ...(isContainerStopCause(cause) && age <= ATTRIBUTION_WINDOW_MS[cause] ? { cause } : {}),
+        ...(isContainerExitState(exit) && age <= EXIT_ATTRIBUTION_WINDOW_MS ? { exit } : {}),
+    };
+}
+/** Whether an observation carries anything at all (i.e. whether claiming it is worth a write). */
+function isEmptyObservation(observation) {
+    return !observation.cause && !observation.exit;
+}
+/**
+ * Persist what this container just observed about its own stop, MERGING onto an unclaimed record
+ * of the SAME stop rather than replacing it.
+ *
+ * Merging is the point. One stop reaches this container through up to two hooks carrying
+ * different halves of the answer: `onError` recognises a rollout drain and knows no exit state,
+ * `onStop` carries `{ exitCode, reason }` and cannot name the churn. They fire in either order
+ * (and, on some runtime versions, both), so a plain overwrite means whichever landed second
+ * silently discarded the other's half: either the recovery budget or the only account of the
+ * death, depending on the ordering that day.
+ *
+ * Two records are never merged:
+ *
+ * - a CLAIMED one, which has already explained somebody's eviction, so anything observed after
+ *   it belongs to the next one;
+ * - one older than {@link STOP_MERGE_WINDOW_MS}, which is a different stop entirely. This
+ *   container's records are not reliably cleared between stops (`takeStopCause` deliberately
+ *   leaves an expired record in place, and only an accepted dispatch deletes one), so a stale
+ *   record is the ORDINARY state of a container that idled out and was re-driven, not an edge
+ *   case. Merging onto it would back-date the new observation to the old stop's `at` and age it
+ *   out of its own attribution window on arrival: the crash that just happened would be
+ *   recorded, read back, and dropped as too old to explain the eviction it caused.
+ *
+ * The kept `at` is the EARLIEST of the two observations, which within the merge window is a
+ * choice between timestamps moments apart: both describe one stop, and the window measures how
+ * long ago that stop happened.
+ */
+export async function recordStopCause(storage, observed, now) {
+    const mergeable = mergeableRecord(await storage.get(STOP_CAUSE_KEY), now);
+    const at = mergeable ? Math.min(mergeable.at, now) : now;
+    const cause = observed.cause ?? mergeable?.cause;
+    const exit = observed.exit ?? mergeable?.exit;
+    await storage.put(STOP_CAUSE_KEY, {
+        ...(cause ? { cause } : {}),
+        ...(exit ? { exit } : {}),
+        at,
+    });
+}
+/**
+ * The stored record a new observation may complete, i.e. an unclaimed one describing the same
+ * stop. Anything else (absent, malformed, claimed, or from an earlier stop) is undefined, and
+ * the new observation stands alone.
+ */
+function mergeableRecord(stored, now) {
+    if (!stored || typeof stored !== 'object')
+        return undefined;
+    const record = stored;
+    if (record.claimedBy !== undefined)
         return undefined;
-    return now - at <= ATTRIBUTION_WINDOW_MS[cause] ? cause : undefined;
+    if (typeof record.at !== 'number')
+        return undefined;
+    // `now - at` rather than an absolute difference: a record stamped in the FUTURE (a clock
+    // adjustment between two hook calls) is one of ours moments ago, not a stale one.
+    if (now - record.at > STOP_MERGE_WINDOW_MS)
+        return undefined;
+    return record;
 }
-/** Persist what this container just observed about its own reclaim. */
-export async function recordStopCause(storage, cause, now) {
-    await storage.put(STOP_CAUSE_KEY, { cause, at: now });
+/**
+ * What an exit code IS, independent of why the container stopped.
+ *
+ * A bounded map rather than a `128 + n` derivation on purpose: the platform reports one number
+ * and only a couple of them are worth translating, while decoding an arbitrary code into a
+ * signal name would confidently mislabel an application exit code that merely happens to exceed
+ * 128. An unmapped code is reported as itself.
+ */
+const EXIT_SIGNAL_NAMES = {
+    137: 'SIGKILL',
+    143: 'SIGTERM',
+};
+/**
+ * What an exit code SUGGESTS about a death nothing else explains. Read only when no
+ * {@link ContainerStopCause} was recognised, which is what makes the guess worth offering: the
+ * alternative there is silence.
+ *
+ * Kept apart from {@link EXIT_SIGNAL_NAMES} because the two are different kinds of claim. The
+ * signal name is a fact about the number; this is an inference from the absence of any other
+ * account, and it is false exactly when that absence is false.
+ */
+const UNEXPLAINED_EXIT_NOTES = {
+    // Killed outright rather than exiting. With nothing else to explain it, on this runtime that
+    // is overwhelmingly the instance running out of memory, which is why it is worth saying.
+    137: 'most often an out-of-memory kill or a forced stop',
+    // Something asked it to stop, and whatever it was left no cause behind for us to name.
+    143: 'something asked the container to stop',
+};
+/**
+ * The one-line account of a container's stop for the eviction `detail`, or undefined when
+ * nothing was recorded.
+ *
+ * `cause` is the account the run has ALREADY been given, and passing it is what keeps the detail
+ * from arguing with the verdict beside it. The two halves are recorded independently and the
+ * exit state is attached whether or not a cause was recognised, so they routinely describe one
+ * event twice: an idle reclaim is performed BY the platform with a SIGKILL, so a run correctly
+ * reported as "idle container reclaimed between polls" carries exit 137, and read as an
+ * unexplained death that code says "most often an out-of-memory kill". The operator is then
+ * holding a verdict and a detail that cannot both be true, which is worse than either alone,
+ * because there is no way to tell which one to act on.
+ *
+ * So the interpretation is offered only where it is the only account there is. Where a cause was
+ * named, the exit code is reported as the MECHANICS of that stop: still the difference between
+ * "reclaimed" and "reclaimed with a SIGKILL", and never a second, competing cause of death.
+ *
+ * Either way it states the platform's own limit rather than leaving it to be inferred: a
+ * Cloudflare Container writes its stdout to the deployment's Workers logs, and nothing inside
+ * the Durable Object can read it back, so an operator who reads this and goes looking for a log
+ * tail here should be told where the tail actually is.
+ */
+export function describeContainerExit(exit, cause) {
+    if (!exit)
+        return undefined;
+    const signal = EXIT_SIGNAL_NAMES[exit.code];
+    const note = cause
+        ? signal
+        : [signal, UNEXPLAINED_EXIT_NOTES[exit.code]].filter(Boolean).join(', ');
+    const how = cause
+        ? 'the runtime reported it as'
+        : exit.reason === 'runtime_signal'
+            ? 'the runtime signalled it to exit, with'
+            : 'the workload inside it exited, with';
+    return (`The run's container stopped while the job was running: ${how} exit code ${exit.code}` +
+        `${note ? ` (${note})` : ''}. The container's own output is not readable from the Worker; ` +
+        `it is in this deployment's Workers logs.`);
 }
 /**
  * Forget whatever this container observed before now.
@@ -86,23 +287,27 @@ export async function clearStopCause(storage) {
     await storage.delete(STOP_CAUSE_KEY);
 }
 /**
- * Read the cause explaining `claimant`'s 404 poll, CLAIMING it for that job.
+ * Read what explains `claimant`'s 404 poll, CLAIMING it for that job.
  *
- * One reclaim explains exactly one job's eviction: the engine answers one by re-dispatching onto
+ * One stop explains exactly one job's eviction: the engine answers one by re-dispatching onto
  * a fresh container under the same DO id, so an unclaimed record would still be sitting there to
  * excuse the next death, whenever and for whatever reason it came. The claim is written rather
  * than the record deleted so a REPLAYED poll for the same job reads back the same answer (see
  * {@link StopCauseRecord.claimedBy}).
+ *
+ * The claim covers the record, not one half of it: an exit state read here is spent as surely as
+ * a cause is, because attaching one container's death to two runs' failures is the same lie
+ * either way.
  */
 export async function takeStopCause(storage, now, claimant) {
     const record = await storage.get(STOP_CAUSE_KEY);
-    const cause = attributeStopCause(record, now, claimant);
+    const observation = attributeStopCause(record, now, claimant);
     // Nothing to claim: either there was no record, it was spent, or it is too old to explain
     // anything. Leaving an expired record in place costs one key until the next reclaim
     // overwrites it, and rewriting it here would only re-date somebody else's observation.
-    if (!cause)
-        return undefined;
+    if (isEmptyObservation(observation))
+        return observation;
     await storage.put(STOP_CAUSE_KEY, { ...record, claimedBy: claimant });
-    return cause;
+    return observation;
 }
 //# sourceMappingURL=stopCause.js.map

package/dist/infrastructure/containers/stopCause.js.map

@@ -1 +1 @@
-{"version":3,"file":"stopCause.js","sourceRoot":"","sources":["../../../src/infrastructure/containers/stopCause.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAC3F,yFAAyF;AACzF,uFAAuF;AACvF,yFAAyF;AACzF,4FAA4F;AAC5F,8CAA8C;AAe9C,gGAAgG;AAChG,MAAM,CAAC,MAAM,cAAc,GAAG,oBAAoB,CAAA;AAoBlD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,OAAO,EAAE,OAAO;IAChB,IAAI,EAAE,EAAE,GAAG,MAAM;CAC2B,CAAA;AAE9C;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,MAAM,OAAO,GACX,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC5F,OAAO,8DAA8D,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;AACrF,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,KAAc;IAC1C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAA;AACjF,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAe,EACf,GAAW,EACX,QAAgB;IAEhB,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAA;IAC3D,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,MAAkC,CAAA;IACnE,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,IAAI,OAAO,EAAE,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAA;IAC5E,6FAA6F;IAC7F,kFAAkF;IAClF,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAA;IACvE,OAAO,GAAG,GAAG,EAAE,IAAI,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;AACrE,CAAC;AAaD,uEAAuE;AACvE,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAyB,EACzB,KAAyB,EACzB,GAAW;IAEX,MAAM,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAA;AACvD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAyB;IAC5D,MAAM,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAA;AACtC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAyB,EACzB,GAAW,EACX,QAAgB;IAEhB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;IAChD,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAA;IACvD,0FAA0F;IAC1F,oFAAoF;IACpF,uFAAuF;IACvF,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAA;IAC5B,MAAM,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,GAAI,MAA0B,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC1F,OAAO,KAAK,CAAA;AACd,CAAC"}
+{"version":3,"file":"stopCause.js","sourceRoot":"","sources":["../../../src/infrastructure/containers/stopCause.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAC3F,yFAAyF;AACzF,uFAAuF;AACvF,yFAAyF;AACzF,4FAA4F;AAC5F,8CAA8C;AAe9C,gGAAgG;AAChG,MAAM,CAAC,MAAM,cAAc,GAAG,oBAAoB,CAAA;AA0ClD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,OAAO,EAAE,OAAO;IAChB,IAAI,EAAE,EAAE,GAAG,MAAM;CAC2B,CAAA;AAE9C;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,GAAG,MAAM,CAAA;AAErD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAA;AAQ1C;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,MAAM,OAAO,GACX,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC5F,OAAO,8DAA8D,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;AACrF,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAA+D,EAC/D,aAAsB;IAEtB,IAAI,aAAa;QAAE,OAAO,SAAS,CAAA;IACnC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,KAAK,gBAAgB,IAAI,MAAM,CAAC,QAAQ,KAAK,GAAG,CAAA;IAC7E,OAAO;QACL,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;KACvD,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,KAAc;IAC1C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAA;AACjF,CAAC;AAED;;;;;;GAMG;AACH,SAAS,oBAAoB,CAAC,KAAc;IAC1C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IACrD,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,KAAoC,CAAA;IAC7D,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,gBAAgB,CAAC,CAAA;AACvF,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAe,EACf,GAAW,EACX,QAAgB;IAEhB,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAA;IACpD,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,MAAkC,CAAA;IACzE,IAAI,OAAO,EAAE,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAA;IACrC,6FAA6F;IAC7F,kFAAkF;IAClF,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAA;IAChE,MAAM,GAAG,GAAG,GAAG,GAAG,EAAE,CAAA;IACpB,OAAO;QACL,GAAG,CAAC,oBAAoB,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxF,GAAG,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,0BAA0B,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrF,CAAA;AACH,CAAC;AAED,kGAAkG;AAClG,SAAS,kBAAkB,CAAC,WAA4B;IACtD,OAAO,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC,WAAW,CAAC,IAAI,CAAA;AAChD,CAAC;AAaD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAyB,EACzB,QAAyB,EACzB,GAAW;IAEX,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,GAAG,CAAC,CAAA;IACzE,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;IACxD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,IAAI,SAAS,EAAE,KAAK,CAAA;IAChD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,IAAI,SAAS,EAAE,IAAI,CAAA;IAC7C,MAAM,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE;QAChC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3B,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzB,EAAE;KACH,CAAC,CAAA;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CACtB,MAAe,EACf,GAAW;IAEX,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAA;IAC3D,MAAM,MAAM,GAAG,MAAkC,CAAA;IACjD,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACpD,IAAI,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAA;IACnD,yFAAyF;IACzF,kFAAkF;IAClF,IAAI,GAAG,GAAG,MAAM,CAAC,EAAE,GAAG,oBAAoB;QAAE,OAAO,SAAS,CAAA;IAC5D,OAAO,MAAmD,CAAA;AAC5D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,iBAAiB,GAA2B;IAChD,GAAG,EAAE,SAAS;IACd,GAAG,EAAE,SAAS;CACf,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,sBAAsB,GAA2B;IACrD,6FAA6F;IAC7F,yFAAyF;IACzF,GAAG,EAAE,mDAAmD;IACxD,uFAAuF;IACvF,GAAG,EAAE,uCAAuC;CAC7C,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAAoC,EACpC,KAA0B;IAE1B,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAA;IAC3B,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC3C,MAAM,IAAI,GAAG,KAAK;QAChB,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,CAAC,MAAM,EAAE,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC1E,MAAM,GAAG,GAAG,KAAK;QACf,CAAC,CAAC,4BAA4B;QAC9B,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,gBAAgB;YAChC,CAAC,CAAC,wCAAwC;YAC1C,CAAC,CAAC,qCAAqC,CAAA;IAC3C,OAAO,CACL,0DAA0D,GAAG,cAAc,IAAI,CAAC,IAAI,EAAE;QACtF,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,gEAAgE;QAC3F,0CAA0C,CAC3C,CAAA;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAyB;IAC5D,MAAM,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAA;AACtC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAyB,EACzB,GAAW,EACX,QAAgB;IAEhB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;IAChD,MAAM,WAAW,GAAG,kBAAkB,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAA;IAC7D,0FAA0F;IAC1F,oFAAoF;IACpF,uFAAuF;IACvF,IAAI,kBAAkB,CAAC,WAAW,CAAC;QAAE,OAAO,WAAW,CAAA;IACvD,MAAM,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,GAAI,MAA0B,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC1F,OAAO,WAAW,CAAA;AACpB,CAAC"}

package/dist/infrastructure/github-deps.js

@@ -1,4 +1,4 @@
-import { makeResolveRepoFilesForCoords, makeResolveRunRepoContext, ProviderRoutingGitHubClient, logger, } from '@cat-factory/server';
+import { makeResolveRepoFilesForCoords, makeResolveRunRepoContext, providerRoutingGitHubClient, logger, } from '@cat-factory/server';
 import { buildGitLabEngineClient } from '@cat-factory/gitlab';
 import { selectWorkerVcsConnectDeps } from './vcsConnect';
 import { buildAppRegistry, buildResolveRepoTarget } from './container';
@@ -96,7 +96,7 @@ export function selectGitHubDeps(env, config, db, clock, idGenerator, repoFilesC
     // the GitHub-issue/docs consumers keep the raw App `githubClient` (they must not gain the
     // GitLab fallback, per CLAUDE.md's VCS rule).
     const moduleClient = gitlabConnectClient
-        ? new ProviderRoutingGitHubClient({
+        ? providerRoutingGitHubClient({
             installations: githubInstallationRepository,
             github: githubClient,
             gitlab: gitlabConnectClient,

package/dist/infrastructure/github-deps.js.map

@@ -1 +1 @@
-{"version":3,"file":"github-deps.js","sourceRoot":"","sources":["../../src/infrastructure/github-deps.ts"],"names":[],"mappings":"AAQA,OAAO,EACL,6BAA6B,EAC7B,yBAAyB,EACzB,2BAA2B,EAC3B,MAAM,GACP,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAA;AAG7D,OAAO,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAA;AACzD,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AACtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAA;AAC9D,OAAO,EAAE,6BAA6B,EAAE,MAAM,wCAAwC,CAAA;AACtF,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAA;AAC5E,OAAO,EAAE,8BAA8B,EAAE,MAAM,+CAA+C,CAAA;AAC9F,OAAO,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAA;AACtF,OAAO,EAAE,4BAA4B,EAAE,MAAM,6CAA6C,CAAA;AAC1F,OAAO,EAAE,iCAAiC,EAAE,MAAM,kDAAkD,CAAA;AACpG,OAAO,EAAE,2BAA2B,EAAE,MAAM,4CAA4C,CAAA;AACxF,OAAO,EAAE,4BAA4B,EAAE,MAAM,6CAA6C,CAAA;AAC1F,OAAO,EAAE,8BAA8B,EAAE,MAAM,+CAA+C,CAAA;AAC9F,OAAO,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAA;AACtF,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAA;AAE5E,8EAA8E;AAC9E,mFAAmF;AACnF,qFAAqF;AACrF,sFAAsF;AACtF,0FAA0F;AAC1F,sFAAsF;AACtF,yEAAyE;AACzE,8EAA8E;AAE9E,yFAAyF;AACzF,SAAS,2BAA2B,CAAC,EAAc;IACjD,OAAO;QACL,wBAAwB,EAAE,IAAI,0BAA0B,CAAC,EAAE,EAAE,EAAE,CAAC;QAChE,0BAA0B,EAAE,IAAI,4BAA4B,CAAC,EAAE,EAAE,EAAE,CAAC;QACpE,+BAA+B,EAAE,IAAI,iCAAiC,CAAC,EAAE,EAAE,EAAE,CAAC;QAC9E,yBAAyB,EAAE,IAAI,2BAA2B,CAAC,EAAE,EAAE,EAAE,CAAC;QAClE,0BAA0B,EAAE,IAAI,4BAA4B,CAAC,EAAE,EAAE,EAAE,CAAC;QACpE,4BAA4B,EAAE,IAAI,8BAA8B,CAAC,EAAE,EAAE,EAAE,CAAC;QACxE,wBAAwB,EAAE,IAAI,0BAA0B,CAAC,EAAE,EAAE,EAAE,CAAC;KACjE,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,GAAQ,EACR,MAAiB,EACjB,EAAc,EACd,KAAY,EACZ,WAAwB,EACxB,cAAgD;IAEhD,MAAM,4BAA4B,GAAG,IAAI,8BAA8B,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;IAC/E,gGAAgG;IAChG,6FAA6F;IAC7F,wFAAwF;IACxF,MAAM,aAAa,GAAG,0BAA0B,CAAC,MAAM,EAAE,4BAA4B,EAAE,EAAE,EAAE,KAAK,CAAC,CAAA;IACjG,MAAM,mBAAmB,GAAG,aAAa,EAAE,MAAM,CAAA;IAEjD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAC3B,+FAA+F;QAC/F,iGAAiG;QACjG,+FAA+F;QAC/F,kGAAkG;QAClG,8FAA8F;QAC9F,4FAA4F;QAC5F,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,IAAI,GAAG,CAAC,YAAY,EAAE,CAAC;YAC9C,MAAM,YAAY,GAAG,uBAAuB,CAAC;gBAC3C,KAAK,EAAE,GAAG,CAAC,YAAY;gBACvB,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO;gBAC9B,KAAK;gBACL,MAAM;aACP,CAAC,CAAA;YACF,OAAO;gBACL,qBAAqB,EAAE,yBAAyB,CAC9C,YAAY,EACZ,sBAAsB,CAAC,EAAE,CAAC,EAC1B,cAAc,CACf;gBACD,yBAAyB,EAAE,6BAA6B,CACtD,YAAY,EACZ,4BAA4B,EAC5B,IAAI,0BAA0B,CAAC,EAAE,EAAE,EAAE,CAAC,CACvC;gBACD,GAAG,CAAC,mBAAmB;oBACrB,CAAC,CAAC;wBACE,YAAY,EAAE,mBAAmB;wBACjC,4BAA4B;wBAC5B,GAAG,2BAA2B,CAAC,EAAE,CAAC;wBAClC,uBAAuB,EAAE,MAAM,CAAC,SAAS,CAAC,QAAQ,IAAI,SAAS;qBAChE;oBACH,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,aAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1E,CAAA;QACH,CAAC;QACD,OAAO,EAAE,CAAA;IACX,CAAC;IAED,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,CAAC,CAAA;IACzD,MAAM,YAAY,GAAG,IAAI,iBAAiB,CAAC;QACzC,QAAQ;QACR,mBAAmB,EAAE,IAAI,qBAAqB,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC;QACnE,WAAW;QACX,KAAK;QACL,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO;KAC/B,CAAC,CAAA;IACF,wEAAwE;IACxE,+EAA+E;IAC/E,gFAAgF;IAChF,MAAM,sBAAsB,GAAG,MAAM,CAAC,MAAM,CAAC,aAAa;QACxD,CAAC,CAAC,IAAI,6BAA6B,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACjF,CAAC,CAAC,SAAS,CAAA;IACb,0FAA0F;IAC1F,8FAA8F;IAC9F,8FAA8F;IAC9F,0FAA0F;IAC1F,8CAA8C;IAC9C,MAAM,YAAY,GAAiB,mBAAmB;QACpD,CAAC,CAAC,IAAI,2BAA2B,CAAC;YAC9B,aAAa,EAAE,4BAA4B;YAC3C,MAAM,EAAE,YAAY;YACpB,MAAM,EAAE,mBAAmB;SAC5B,CAAC;QACJ,CAAC,CAAC,YAAY,CAAA;IAChB,OAAO;QACL,YAAY,EAAE,YAAY;QAC1B,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,aAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,oFAAoF;QACpF,gFAAgF;QAChF,oFAAoF;QACpF,yFAAyF;QACzF,qBAAqB,EAAE,yBAAyB,CAC9C,YAAY,EACZ,sBAAsB,CAAC,EAAE,CAAC,EAC1B,cAAc,CACf;QACD,qFAAqF;QACrF,gDAAgD;QAChD,yBAAyB,EAAE,6BAA6B,CACtD,YAAY,EACZ,4BAA4B,EAC5B,IAAI,0BAA0B,CAAC,EAAE,EAAE,EAAE,CAAC,CACvC;QACD,4BAA4B;QAC5B,GAAG,2BAA2B,CAAC,EAAE,CAAC;QAClC,eAAe,EAAE,IAAI,wBAAwB,CAAC,GAAG,CAAC,qBAAsB,CAAC;QACzE,yEAAyE;QACzE,uBAAuB,EAAE,MAAM,CAAC,SAAS,CAAC,QAAQ,IAAI,SAAS;QAC/D,sBAAsB;QACtB,cAAc,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,YAAY,CAAC;QACvE,8EAA8E;QAC9E,8EAA8E;QAC9E,sEAAsE;QACtE,gBAAgB,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE;YACvC,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,uBAAuB,CAAC,YAAY,CAAC,cAAc,CAAC,CAAA;YACjF,OAAO,KAAK,CAAC,SAAS,KAAK,OAAO,CAAA;QACpC,CAAC;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"github-deps.js","sourceRoot":"","sources":["../../src/infrastructure/github-deps.ts"],"names":[],"mappings":"AAQA,OAAO,EACL,6BAA6B,EAC7B,yBAAyB,EACzB,2BAA2B,EAC3B,MAAM,GACP,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAA;AAG7D,OAAO,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAA;AACzD,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AACtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAA;AAC9D,OAAO,EAAE,6BAA6B,EAAE,MAAM,wCAAwC,CAAA;AACtF,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAA;AAC5E,OAAO,EAAE,8BAA8B,EAAE,MAAM,+CAA+C,CAAA;AAC9F,OAAO,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAA;AACtF,OAAO,EAAE,4BAA4B,EAAE,MAAM,6CAA6C,CAAA;AAC1F,OAAO,EAAE,iCAAiC,EAAE,MAAM,kDAAkD,CAAA;AACpG,OAAO,EAAE,2BAA2B,EAAE,MAAM,4CAA4C,CAAA;AACxF,OAAO,EAAE,4BAA4B,EAAE,MAAM,6CAA6C,CAAA;AAC1F,OAAO,EAAE,8BAA8B,EAAE,MAAM,+CAA+C,CAAA;AAC9F,OAAO,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAA;AACtF,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAA;AAE5E,8EAA8E;AAC9E,mFAAmF;AACnF,qFAAqF;AACrF,sFAAsF;AACtF,0FAA0F;AAC1F,sFAAsF;AACtF,yEAAyE;AACzE,8EAA8E;AAE9E,yFAAyF;AACzF,SAAS,2BAA2B,CAAC,EAAc;IACjD,OAAO;QACL,wBAAwB,EAAE,IAAI,0BAA0B,CAAC,EAAE,EAAE,EAAE,CAAC;QAChE,0BAA0B,EAAE,IAAI,4BAA4B,CAAC,EAAE,EAAE,EAAE,CAAC;QACpE,+BAA+B,EAAE,IAAI,iCAAiC,CAAC,EAAE,EAAE,EAAE,CAAC;QAC9E,yBAAyB,EAAE,IAAI,2BAA2B,CAAC,EAAE,EAAE,EAAE,CAAC;QAClE,0BAA0B,EAAE,IAAI,4BAA4B,CAAC,EAAE,EAAE,EAAE,CAAC;QACpE,4BAA4B,EAAE,IAAI,8BAA8B,CAAC,EAAE,EAAE,EAAE,CAAC;QACxE,wBAAwB,EAAE,IAAI,0BAA0B,CAAC,EAAE,EAAE,EAAE,CAAC;KACjE,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,GAAQ,EACR,MAAiB,EACjB,EAAc,EACd,KAAY,EACZ,WAAwB,EACxB,cAAgD;IAEhD,MAAM,4BAA4B,GAAG,IAAI,8BAA8B,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;IAC/E,gGAAgG;IAChG,6FAA6F;IAC7F,wFAAwF;IACxF,MAAM,aAAa,GAAG,0BAA0B,CAAC,MAAM,EAAE,4BAA4B,EAAE,EAAE,EAAE,KAAK,CAAC,CAAA;IACjG,MAAM,mBAAmB,GAAG,aAAa,EAAE,MAAM,CAAA;IAEjD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAC3B,+FAA+F;QAC/F,iGAAiG;QACjG,+FAA+F;QAC/F,kGAAkG;QAClG,8FAA8F;QAC9F,4FAA4F;QAC5F,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,IAAI,GAAG,CAAC,YAAY,EAAE,CAAC;YAC9C,MAAM,YAAY,GAAG,uBAAuB,CAAC;gBAC3C,KAAK,EAAE,GAAG,CAAC,YAAY;gBACvB,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO;gBAC9B,KAAK;gBACL,MAAM;aACP,CAAC,CAAA;YACF,OAAO;gBACL,qBAAqB,EAAE,yBAAyB,CAC9C,YAAY,EACZ,sBAAsB,CAAC,EAAE,CAAC,EAC1B,cAAc,CACf;gBACD,yBAAyB,EAAE,6BAA6B,CACtD,YAAY,EACZ,4BAA4B,EAC5B,IAAI,0BAA0B,CAAC,EAAE,EAAE,EAAE,CAAC,CACvC;gBACD,GAAG,CAAC,mBAAmB;oBACrB,CAAC,CAAC;wBACE,YAAY,EAAE,mBAAmB;wBACjC,4BAA4B;wBAC5B,GAAG,2BAA2B,CAAC,EAAE,CAAC;wBAClC,uBAAuB,EAAE,MAAM,CAAC,SAAS,CAAC,QAAQ,IAAI,SAAS;qBAChE;oBACH,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,aAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1E,CAAA;QACH,CAAC;QACD,OAAO,EAAE,CAAA;IACX,CAAC;IAED,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,CAAC,CAAA;IACzD,MAAM,YAAY,GAAG,IAAI,iBAAiB,CAAC;QACzC,QAAQ;QACR,mBAAmB,EAAE,IAAI,qBAAqB,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC;QACnE,WAAW;QACX,KAAK;QACL,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO;KAC/B,CAAC,CAAA;IACF,wEAAwE;IACxE,+EAA+E;IAC/E,gFAAgF;IAChF,MAAM,sBAAsB,GAAG,MAAM,CAAC,MAAM,CAAC,aAAa;QACxD,CAAC,CAAC,IAAI,6BAA6B,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACjF,CAAC,CAAC,SAAS,CAAA;IACb,0FAA0F;IAC1F,8FAA8F;IAC9F,8FAA8F;IAC9F,0FAA0F;IAC1F,8CAA8C;IAC9C,MAAM,YAAY,GAAiB,mBAAmB;QACpD,CAAC,CAAC,2BAA2B,CAAC;YAC1B,aAAa,EAAE,4BAA4B;YAC3C,MAAM,EAAE,YAAY;YACpB,MAAM,EAAE,mBAAmB;SAC5B,CAAC;QACJ,CAAC,CAAC,YAAY,CAAA;IAChB,OAAO;QACL,YAAY,EAAE,YAAY;QAC1B,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,aAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,oFAAoF;QACpF,gFAAgF;QAChF,oFAAoF;QACpF,yFAAyF;QACzF,qBAAqB,EAAE,yBAAyB,CAC9C,YAAY,EACZ,sBAAsB,CAAC,EAAE,CAAC,EAC1B,cAAc,CACf;QACD,qFAAqF;QACrF,gDAAgD;QAChD,yBAAyB,EAAE,6BAA6B,CACtD,YAAY,EACZ,4BAA4B,EAC5B,IAAI,0BAA0B,CAAC,EAAE,EAAE,EAAE,CAAC,CACvC;QACD,4BAA4B;QAC5B,GAAG,2BAA2B,CAAC,EAAE,CAAC;QAClC,eAAe,EAAE,IAAI,wBAAwB,CAAC,GAAG,CAAC,qBAAsB,CAAC;QACzE,yEAAyE;QACzE,uBAAuB,EAAE,MAAM,CAAC,SAAS,CAAC,QAAQ,IAAI,SAAS;QAC/D,sBAAsB;QACtB,cAAc,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,YAAY,CAAC;QACvE,8EAA8E;QAC9E,8EAA8E;QAC9E,sEAAsE;QACtE,gBAAgB,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE;YACvC,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,uBAAuB,CAAC,YAAY,CAAC,cAAc,CAAC,CAAA;YACjF,OAAO,KAAK,CAAC,SAAS,KAAK,OAAO,CAAA;QACpC,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/infrastructure/repositories/D1BinaryArtifactMetadataStore.d.ts

@@ -12,6 +12,7 @@ export declare class D1BinaryArtifactMetadataStore implements BinaryArtifactMeta
     countByExecution(workspaceId: string, executionId: string): Promise<number>;
     listByBlock(workspaceId: string, blockId: string): Promise<BinaryArtifactRecord[]>;
     listByDocument(workspaceId: string, document: DocumentArtifactRef): Promise<BinaryArtifactRecord[]>;
+    listByDocuments(workspaceId: string, documents: readonly DocumentArtifactRef[]): Promise<BinaryArtifactRecord[]>;
     deleteByIds(workspaceId: string, ids: readonly string[]): Promise<number>;
     delete(workspaceId: string, id: string): Promise<void>;
     listOlderThan(workspaceId: string, olderThan: number): Promise<BinaryArtifactRecord[]>;

package/dist/infrastructure/repositories/D1BinaryArtifactMetadataStore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"D1BinaryArtifactMetadataStore.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/repositories/D1BinaryArtifactMetadataStore.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,2BAA2B,EAC3B,oBAAoB,EACpB,mBAAmB,EAEpB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAA;AA2C3D,+FAA+F;AAC/F,qBAAa,6BAA8B,YAAW,2BAA2B;IAC/E,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAY;IAE/B,YAAY,EAAE,EAAE,EAAE,EAAE;QAAE,EAAE,EAAE,UAAU,CAAA;KAAE,EAErC;IAEK,MAAM,CAAC,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CA0BxD;IAEK,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAM/E;IAEK,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAU/F;IAEK,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAQhF;IAEK,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAUvF;IAEK,cAAc,CAClB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,mBAAmB,GAC5B,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAUjC;IAEK,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAc9E;IAEK,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAK3D;IAIK,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAS3F;IAEK,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAS7E;IAEK,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAM1E;IAEK,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAM5D;CACF"}
+{"version":3,"file":"D1BinaryArtifactMetadataStore.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/repositories/D1BinaryArtifactMetadataStore.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,2BAA2B,EAC3B,oBAAoB,EACpB,mBAAmB,EAEpB,MAAM,qBAAqB,CAAA;AAE5B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAA;AAqD3D,+FAA+F;AAC/F,qBAAa,6BAA8B,YAAW,2BAA2B;IAC/E,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAY;IAE/B,YAAY,EAAE,EAAE,EAAE,EAAE;QAAE,EAAE,EAAE,UAAU,CAAA;KAAE,EAErC;IAEK,MAAM,CAAC,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CA0BxD;IAEK,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAM/E;IAEK,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAU/F;IAEK,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAQhF;IAEK,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAUvF;IAEK,cAAc,CAClB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,mBAAmB,GAC5B,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAUjC;IAEK,eAAe,CACnB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,SAAS,mBAAmB,EAAE,GACxC,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAoBjC;IAEK,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAc9E;IAEK,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAK3D;IAIK,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAS3F;IAEK,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAS7E;IAEK,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAM1E;IAEK,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAM5D;CACF"}

package/dist/infrastructure/repositories/D1BinaryArtifactMetadataStore.js

@@ -1,3 +1,4 @@
+import { dedupeDocumentRefs } from '@cat-factory/kernel';
 import { chunkForIn } from './chunk';
 function rowToRecord(row) {
     return {
@@ -20,6 +21,13 @@ function rowToRecord(row) {
         createdAt: row.created_at,
     };
 }
+/**
+ * Order rows the way every list read on this table returns them (`created_at`, then `id`), for a
+ * batch read whose result is the concatenation of several statements.
+ */
+function sortArtifactRows(rows) {
+    return rows.sort((a, b) => a.created_at - b.created_at || (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
+}
 /** D1-backed metadata store for binary artifacts (see migration 0017). Bytes live in R2/S3. */
 export class D1BinaryArtifactMetadataStore {
     db;
@@ -77,6 +85,28 @@ export class D1BinaryArtifactMetadataStore {
             .all();
         return (results ?? []).map(rowToRecord);
     }
+    async listByDocuments(workspaceId, documents) {
+        const refs = dedupeDocumentRefs(documents);
+        if (!refs.length)
+            return [];
+        const rows = [];
+        // Two bound params per ref (source + external id), so the chunk size is derived from that
+        // rather than from the scalar-`IN` default.
+        for (const chunk of chunkForIn(refs, 2)) {
+            const clauses = chunk
+                .map(() => '(document_source = ? AND document_external_id = ?)')
+                .join(' OR ');
+            const { results } = await this.db
+                .prepare(`SELECT * FROM binary_artifacts WHERE workspace_id = ? AND (${clauses})`)
+                .bind(workspaceId, ...chunk.flatMap((ref) => [ref.source, ref.externalId]))
+                .all();
+            rows.push(...(results ?? []));
+        }
+        // Sorted here rather than per statement: with more than one chunk the concatenation is
+        // ordered by chunk, and the caller's "newest render for a view wins" rule reads the WHOLE
+        // list in order.
+        return sortArtifactRows(rows).map(rowToRecord);
+    }
     async deleteByIds(workspaceId, ids) {
         let removed = 0;
         for (const chunk of chunkForIn(ids)) {