@cronwatch/sdk 0.10.0 → 0.11.1

package/dist/discord.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/alerts/shared.ts","../src/alerts/discord.ts"],"names":[],"mappings":";AAiCO,SAAS,SAAS,GAAA,EAAqB;AAC5C,EAAA,IAAI,QAAA;AACJ,EAAA,IAAI;AACF,IAAA,QAAA,GAAW,IAAI,GAAA,CAAI,GAAG,CAAA,CAAE,QAAA;AAAA,EAC1B,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,MAAM,yDAAyD,CAAA;AAAA,EAC3E;AACA,EAAA,IAAI,QAAA,KAAa,WAAW,QAAA,KAAa,QAAA,QAAgB,IAAI,KAAA,CAAM,CAAA,+CAAA,EAAkD,QAAQ,CAAA,CAAE,CAAA;AAC/H,EAAA,OAAO,GAAA;AACT;AA4EO,SAAS,GAAA,CAAI,MAAc,GAAA,EAAqB;AACrD,EAAA,IAAI,IAAA,CAAK,MAAA,IAAU,GAAA,EAAK,OAAO,IAAA;AAC/B,EAAA,IAAI,GAAA,GAAM,GAAA;AACV,EAAA,MAAM,IAAA,GAAO,IAAA,CAAK,UAAA,CAAW,GAAA,GAAM,CAAC,CAAA;AACpC,EAAA,IAAI,IAAA,IAAQ,KAAA,IAAU,IAAA,IAAQ,KAAA,EAAQ,GAAA,IAAO,CAAA;AAC7C,EAAA,OAAO,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,GAAG,CAAA;AAC1B;;;ACnHA,IAAM,KAAA,GAAuC;AAAA,EAC3C,MAAA,EAAQ,QAAA;AAAA,EACR,MAAA,EAAQ,QAAA;AAAA,EACR,KAAA,EAAO,QAAA;AAAA,EACP,IAAA,EAAM,QAAA;AAAA,EACN,WAAA,EAAa,QAAA;AAAA,EACb,SAAA,EAAW;AACb,CAAA;AAEA,IAAM,UAAA,GAAa,GAAA;AAGZ,IAAM,eAAA,GAAkB;AAGxB,SAAS,QAAQ,OAAA,EAAuC;AAC7D,EAAA,IAAI,CAAC,OAAA,CAAQ,UAAA,EAAY,MAAM,IAAI,MAAM,8BAA8B,CAAA;AACvE,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,SAAA;AAAA,IACN,MAAM,KAAK,KAAA,EAAO;AAChB,MAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,IAAA,GAAO,KAAK,CAAA;AAChC,MAAA,MAAM,WAAW,MAAM,KAAA,CAAM,QAAA,CAAS,OAAA,CAAQ,UAAU,CAAA,EAAG;AAAA,QACzD,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAmB;AAAA;AAAA,QAE9C,QAAA,EAAU,OAAA;AAAA,QACV,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,UAAU,CAAA;AAAA,QACtC,IAAA,EAAM,KAAK,SAAA,CAAU;AAAA,UACnB,SAAS,KAAA,CAAM,KAAA;AAAA;AAAA,UAEf,gBAAA,EAAkB,EAAE,KAAA,EAAO,EAAC,EAAE;AAAA,UAC9B,MAAA,EAAQ;AAAA,YACN;AAAA,cACE,OAAO,KAAA,CAAM,KAAA;AAAA,cACb,GAAI,GAAA,GAAM,EAAE,GAAA,KAAQ,EAAC;AAAA,cACrB,WAAA,EAAa,iBAAiB,KAAK,CAAA;AAAA,cACnC,KAAA,EAAO,KAAA,CAAM,KAAA,CAAM,IAAI,CAAA;AAAA,cACvB,WAAW,IAAI,IAAA,CAAK,KAAA,CAAM,EAAE,EAAE,WAAA;AAAY;AAC5C;AACF,SACD;AAAA,OACF,CAAA;AACD,MAAA,IAAI,CAAC,QAAA,CAAS,EAAA,QAAU,IAAI,KAAA,CAAM,4BAA4B,QAAA,CAAS,MAAM,CAAA,EAAA,EAAA,CAAM,MAAM,SAAS,IAAA,EAAK,EAAG,MAAM,CAAA,EAAG,GAAG,CAAC,CAAA,CAAE,CAAA;AAAA,IAC3H;AAAA,GACF;AACF;AAQO,SAAS,iBAAiB,KAAA,EAAsB;AACrD,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,GAAS;AAAA,YAAA,EAAiB,cAAA,CAAe,MAAM,MAAA,CAAO,KAAA,CAAM,GAAG,GAAI,CAAC,CAAC,CAAA,CAAA,GAAK,EAAA;AAC/F,EAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,MAAA,GAAS,OAAA,CAAQ,MAAA;AACxC,EAAA,OAAO,OAAA,GAAU,GAAA,CAAI,aAAA,CAAc,KAAA,CAAM,QAAQ,KAAA,CAAM,CAAA,EAAG,IAAI,CAAC,GAAG,eAAA,GAAkB,MAAA,GAAS,MAAA,CAAO,MAAM,IAAI,OAAA,GAAU,MAAA;AAC1H;AAGO,SAAS,cAAc,IAAA,EAAsB;AAClD,EAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,MAAA,EAAQ,iBAAO,CAAA;AACrC;AAGO,SAAS,eAAe,IAAA,EAAsB;AACnD,EAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,mBAAA,EAAqB,MAAM,CAAA;AACjD","file":"discord.js","sourcesContent":["/**\n * Helpers shared by the provider channels. Only fetch and Web Crypto, so the\n * channels run on Node, Cloudflare Workers, Deno and Bun alike. Not an entry\n * point: each channel bundles its own copy.\n */\nimport { isoTime } from \"../duration.js\";\nimport type { Alert } from \"../types.js\";\n\nexport const TIMEOUT_MS = 10_000;\n\n/** Severity for trackers that have levels. Recovered is informational. */\nexport type Severity = \"error\" | \"warning\" | \"info\";\n\nexport function severity(type: Alert[\"type\"]): Severity {\n  if (type === \"recovered\") return \"info\";\n  if (type === \"slow\" || type === \"over_budget\") return \"warning\";\n  return \"error\";\n}\n\n/** The scheme, host and port only. A URL's path or query can hold a credential. */\nexport function origin(url: string): string {\n  try {\n    return new URL(url).origin;\n  } catch {\n    return \"(invalid URL)\";\n  }\n}\n\n/**\n * The URL, once it is one fetch can post to. Refused without quoting it:\n * fetch's own error for a URL it cannot parse (\"Failed to parse URL from ...\")\n * quotes the whole URL, and a webhook URL's path is its credential.\n */\nexport function postable(url: string): string {\n  let protocol: string;\n  try {\n    protocol = new URL(url).protocol;\n  } catch {\n    throw new Error(\"only http and https URLs can be posted to, not this URL\");\n  }\n  if (protocol !== \"http:\" && protocol !== \"https:\") throw new Error(`only http and https URLs can be posted to, not ${protocol}`);\n  return url;\n}\n\n/** How much of a provider's error body goes into the error message. */\nexport const ERROR_BODY_MAX = 200;\n\n/**\n * POSTs and throws on a non-2xx answer. The error names the provider and the\n * URL's origin, plus the start of the response body with every secret the\n * channel holds cut out, in case a provider echoes one back. Secrets are cut\n * from a prefix long enough to hold one that starts inside the first\n * ERROR_BODY_MAX characters, and only then is it cut to that length, so no\n * part of a secret survives at the edge. A redirect is refused rather than\n * followed: the credential headers would go with it to wherever it points.\n */\nexport async function post(provider: string, url: string, init: { headers: Record<string, string>; body: string }, secrets: (string | undefined)[] = []): Promise<Response> {\n  const response = await fetch(postable(url), { method: \"POST\", headers: init.headers, body: init.body, redirect: \"error\", signal: AbortSignal.timeout(TIMEOUT_MS) });\n  if (!response.ok) {\n    let text = \"\";\n    try {\n      text = await response.text();\n    } catch {\n      // The status is enough.\n    }\n    throw new Error(`${provider} ${origin(url)} answered ${response.status}${text ? `: ${errorBody(text, secrets)}` : \"\"}`);\n  }\n  return response;\n}\n\n/** The start of an error body, secrets cut out first, then cut to ERROR_BODY_MAX on a code point. */\nexport function errorBody(text: string, secrets: (string | undefined)[] = []): string {\n  const kept = secrets.filter((s): s is string => typeof s === \"string\" && s.length >= 4);\n  const longest = kept.reduce((n, s) => Math.max(n, s.length), 0);\n  let head = cut(text, ERROR_BODY_MAX + longest);\n  for (const secret of kept) head = head.split(secret).join(\"[redacted]\");\n  return cut(head, ERROR_BODY_MAX);\n}\n\n/** A credential with the spaces and newlines a paste leaves around it taken off. Anything not a string is empty. */\nexport function trimmed(value: unknown): string {\n  return typeof value === \"string\" ? value.trim() : \"\";\n}\n\n/** Base64 of UTF-8, without Buffer. */\nexport function base64(text: string): string {\n  let binary = \"\";\n  for (const byte of new TextEncoder().encode(text)) binary += String.fromCharCode(byte);\n  return btoa(binary);\n}\n\nexport function basicAuth(user: string, password: string): string {\n  return `Basic ${base64(`${user}:${password}`)}`;\n}\n\nexport function hex(bytes: ArrayBuffer | Uint8Array): string {\n  return Array.from(bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes), (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nexport async function sha256Hex(text: string): Promise<string> {\n  return hex(await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(text)));\n}\n\n/**\n * A stable 32 hex character id for one alert: the same job, type and time\n * always give the same id, so a provider that deduplicates on it drops a\n * resend of an alert it already took.\n */\nexport async function alertId(alert: Alert): Promise<string> {\n  return (await sha256Hex(`${alert.job}\\n${alert.type}\\n${alert.at}`)).slice(0, 32);\n}\n\n/** The same id laid out as a UUID, for APIs that ask for one. */\nexport function asUuid(id: string): string {\n  return `${id.slice(0, 8)}-${id.slice(8, 12)}-${id.slice(12, 16)}-${id.slice(16, 20)}-${id.slice(20, 32)}`;\n}\n\n/** Cuts to at most `max` UTF-16 units without splitting a surrogate pair. */\nexport function cut(text: string, max: number): string {\n  if (text.length <= max) return text;\n  let end = max;\n  const code = text.charCodeAt(end - 1);\n  if (code >= 0xd800 && code <= 0xdbff) end -= 1;\n  return text.slice(0, end);\n}\n\n/** The run fields worth attaching to a tracker event. A start before the year 1 or after 9999 is null. */\nexport function runSummary(alert: Alert): Record<string, unknown> | null {\n  const run = alert.run;\n  if (!run) return null;\n  return { id: run.id, status: run.status, startedAt: isoTime(run.startedAt), durationMs: run.durationMs, trigger: run.trigger };\n}\n\n/** Title, message, triage and link as one plain text block, the way every channel reads. */\nexport function plainText(alert: Alert, link: string | undefined): string {\n  return [alert.title, \"\", alert.message, ...(alert.triage ? [\"\", `Triage: ${alert.triage}`] : []), ...(link ? [\"\", `Open: ${link}`] : [])].join(\"\\n\");\n}\n","import type { Alert, AlertChannel } from \"../types.js\";\nimport { cut, postable } from \"./shared.js\";\n\nexport interface DiscordOptions {\n  /** A channel webhook URL from Server Settings, Integrations, Webhooks. */\n  webhookUrl: string;\n  link?: (alert: Alert) => string;\n}\n\nconst COLOR: Record<Alert[\"type\"], number> = {\n  missed: 0xb7791f,\n  failed: 0xc62828,\n  stuck: 0xc62828,\n  slow: 0xb7791f,\n  over_budget: 0xb7791f,\n  recovered: 0x1f8a4c,\n};\n\nconst TIMEOUT_MS = 10_000;\n\n/** The longest embed description Discord takes. The title (under 256) and it stay well inside the embed's 6000. */\nexport const DESCRIPTION_MAX = 4096;\n\n/** Sends alerts to a Discord channel through a webhook. */\nexport function discord(options: DiscordOptions): AlertChannel {\n  if (!options.webhookUrl) throw new Error(\"discord() needs a webhookUrl\");\n  return {\n    name: \"discord\",\n    async send(alert) {\n      const url = options.link?.(alert);\n      const response = await fetch(postable(options.webhookUrl), {\n        method: \"POST\",\n        headers: { \"content-type\": \"application/json\" },\n        // Refused, not followed: a webhook URL is its own credential.\n        redirect: \"error\",\n        signal: AbortSignal.timeout(TIMEOUT_MS),\n        body: JSON.stringify({\n          content: alert.title,\n          // Job output can hold anything, \"@everyone\" included; ping no one.\n          allowed_mentions: { parse: [] },\n          embeds: [\n            {\n              title: alert.title,\n              ...(url ? { url } : {}),\n              description: embedDescription(alert),\n              color: COLOR[alert.type],\n              timestamp: new Date(alert.at).toISOString(),\n            },\n          ],\n        }),\n      });\n      if (!response.ok) throw new Error(`Discord webhook answered ${response.status}: ${(await response.text()).slice(0, 200)}`);\n    },\n  };\n}\n\n/**\n * The message in a code block, then the triage. Each part has its own cap,\n * and escaping can grow both, so the whole is held to DESCRIPTION_MAX (in\n * UTF-16 units) by cutting the message's block, never the triage: Discord\n * refuses a longer one on every retry.\n */\nexport function embedDescription(alert: Alert): string {\n  const triage = alert.triage ? `\\n**Triage:** ${escapeMarkdown(alert.triage.slice(0, 1000))}` : \"\";\n  const fences = \"```\\n\".length + \"\\n```\".length;\n  return \"```\\n\" + cut(codeBlockSafe(alert.message.slice(0, 3800)), DESCRIPTION_MAX - fences - triage.length) + \"\\n```\" + triage;\n}\n\n/** Breaks up ``` so text inside a code block cannot close it. */\nexport function codeBlockSafe(text: string): string {\n  return text.replace(/```/g, \"`​`​`\");\n}\n\n/** Escapes the characters Discord reads as markdown, links included. */\nexport function escapeMarkdown(text: string): string {\n  return text.replace(/[\\\\`*_~|[\\]()<>]/g, \"\\\\$&\");\n}\n"]}
+{"version":3,"sources":["../src/alerts/shared.ts","../src/alerts/discord.ts","../src/entries/discord.ts"],"names":["DESCRIPTION_MAX","embedDescription","codeBlockSafe","escapeMarkdown"],"mappings":";AAiCO,SAAS,SAAS,GAAA,EAAqB;AAC5C,EAAA,IAAI,QAAA;AACJ,EAAA,IAAI;AACF,IAAA,QAAA,GAAW,IAAI,GAAA,CAAI,GAAG,CAAA,CAAE,QAAA;AAAA,EAC1B,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,MAAM,yDAAyD,CAAA;AAAA,EAC3E;AACA,EAAA,IAAI,QAAA,KAAa,WAAW,QAAA,KAAa,QAAA,QAAgB,IAAI,KAAA,CAAM,CAAA,+CAAA,EAAkD,QAAQ,CAAA,CAAE,CAAA;AAC/H,EAAA,OAAO,GAAA;AACT;AA4EO,SAAS,GAAA,CAAI,MAAc,GAAA,EAAqB;AACrD,EAAA,IAAI,IAAA,CAAK,MAAA,IAAU,GAAA,EAAK,OAAO,IAAA;AAC/B,EAAA,IAAI,GAAA,GAAM,GAAA;AACV,EAAA,MAAM,IAAA,GAAO,IAAA,CAAK,UAAA,CAAW,GAAA,GAAM,CAAC,CAAA;AACpC,EAAA,IAAI,IAAA,IAAQ,KAAA,IAAU,IAAA,IAAQ,KAAA,EAAQ,GAAA,IAAO,CAAA;AAC7C,EAAA,OAAO,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,GAAG,CAAA;AAC1B;;;ACnHA,IAAM,KAAA,GAAuC;AAAA,EAC3C,MAAA,EAAQ,QAAA;AAAA,EACR,MAAA,EAAQ,QAAA;AAAA,EACR,KAAA,EAAO,QAAA;AAAA,EACP,IAAA,EAAM,QAAA;AAAA,EACN,WAAA,EAAa,QAAA;AAAA,EACb,SAAA,EAAW;AACb,CAAA;AAEA,IAAM,UAAA,GAAa,GAAA;AAGZ,IAAM,eAAA,GAAkB,IAAA;AAGxB,SAAS,QAAQ,OAAA,EAAuC;AAC7D,EAAA,IAAI,CAAC,OAAA,CAAQ,UAAA,EAAY,MAAM,IAAI,MAAM,8BAA8B,CAAA;AACvE,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,SAAA;AAAA,IACN,MAAM,KAAK,KAAA,EAAO;AAChB,MAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,IAAA,GAAO,KAAK,CAAA;AAChC,MAAA,MAAM,WAAW,MAAM,KAAA,CAAM,QAAA,CAAS,OAAA,CAAQ,UAAU,CAAA,EAAG;AAAA,QACzD,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAmB;AAAA;AAAA,QAE9C,QAAA,EAAU,OAAA;AAAA,QACV,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,UAAU,CAAA;AAAA,QACtC,IAAA,EAAM,KAAK,SAAA,CAAU;AAAA,UACnB,SAAS,KAAA,CAAM,KAAA;AAAA;AAAA,UAEf,gBAAA,EAAkB,EAAE,KAAA,EAAO,EAAC,EAAE;AAAA,UAC9B,MAAA,EAAQ;AAAA,YACN;AAAA,cACE,OAAO,KAAA,CAAM,KAAA;AAAA,cACb,GAAI,GAAA,GAAM,EAAE,GAAA,KAAQ,EAAC;AAAA,cACrB,WAAA,EAAa,iBAAiB,KAAK,CAAA;AAAA,cACnC,KAAA,EAAO,KAAA,CAAM,KAAA,CAAM,IAAI,CAAA;AAAA,cACvB,WAAW,IAAI,IAAA,CAAK,KAAA,CAAM,EAAE,EAAE,WAAA;AAAY;AAC5C;AACF,SACD;AAAA,OACF,CAAA;AACD,MAAA,IAAI,CAAC,QAAA,CAAS,EAAA,QAAU,IAAI,KAAA,CAAM,4BAA4B,QAAA,CAAS,MAAM,CAAA,EAAA,EAAA,CAAM,MAAM,SAAS,IAAA,EAAK,EAAG,MAAM,CAAA,EAAG,GAAG,CAAC,CAAA,CAAE,CAAA;AAAA,IAC3H;AAAA,GACF;AACF;AAQO,SAAS,iBAAiB,KAAA,EAAsB;AACrD,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,GAAS;AAAA,YAAA,EAAiB,cAAA,CAAe,MAAM,MAAA,CAAO,KAAA,CAAM,GAAG,GAAI,CAAC,CAAC,CAAA,CAAA,GAAK,EAAA;AAC/F,EAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,MAAA,GAAS,OAAA,CAAQ,MAAA;AACxC,EAAA,OAAO,OAAA,GAAU,GAAA,CAAI,aAAA,CAAc,KAAA,CAAM,QAAQ,KAAA,CAAM,CAAA,EAAG,IAAI,CAAC,GAAG,eAAA,GAAkB,MAAA,GAAS,MAAA,CAAO,MAAM,IAAI,OAAA,GAAU,MAAA;AAC1H;AAGO,SAAS,cAAc,IAAA,EAAsB;AAClD,EAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,MAAA,EAAQ,iBAAO,CAAA;AACrC;AAGO,SAAS,eAAe,IAAA,EAAsB;AACnD,EAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,mBAAA,EAAqB,MAAM,CAAA;AACjD;;;ACnEO,IAAMA,gBAAAA,GAA2B;AAEjC,IAAMC,iBAAAA,GAA4B;AAElC,IAAMC,cAAAA,GAAyB;AAE/B,IAAMC,eAAAA,GAA0B","file":"discord.js","sourcesContent":["/**\n * Helpers shared by the provider channels. Only fetch and Web Crypto, so the\n * channels run on Node, Cloudflare Workers, Deno and Bun alike. Not an entry\n * point: each channel bundles its own copy.\n */\nimport { isoTime } from \"../duration.js\";\nimport type { Alert } from \"../types.js\";\n\nexport const TIMEOUT_MS = 10_000;\n\n/** Severity for trackers that have levels. Recovered is informational. */\nexport type Severity = \"error\" | \"warning\" | \"info\";\n\nexport function severity(type: Alert[\"type\"]): Severity {\n  if (type === \"recovered\") return \"info\";\n  if (type === \"slow\" || type === \"over_budget\") return \"warning\";\n  return \"error\";\n}\n\n/** The scheme, host and port only. A URL's path or query can hold a credential. */\nexport function origin(url: string): string {\n  try {\n    return new URL(url).origin;\n  } catch {\n    return \"(invalid URL)\";\n  }\n}\n\n/**\n * The URL, once it is one fetch can post to. Refused without quoting it:\n * fetch's own error for a URL it cannot parse (\"Failed to parse URL from ...\")\n * quotes the whole URL, and a webhook URL's path is its credential.\n */\nexport function postable(url: string): string {\n  let protocol: string;\n  try {\n    protocol = new URL(url).protocol;\n  } catch {\n    throw new Error(\"only http and https URLs can be posted to, not this URL\");\n  }\n  if (protocol !== \"http:\" && protocol !== \"https:\") throw new Error(`only http and https URLs can be posted to, not ${protocol}`);\n  return url;\n}\n\n/** How much of a provider's error body goes into the error message. */\nexport const ERROR_BODY_MAX = 200;\n\n/**\n * POSTs and throws on a non-2xx answer. The error names the provider and the\n * URL's origin, plus the start of the response body with every secret the\n * channel holds cut out, in case a provider echoes one back. Secrets are cut\n * from a prefix long enough to hold one that starts inside the first\n * ERROR_BODY_MAX characters, and only then is it cut to that length, so no\n * part of a secret survives at the edge. A redirect is refused rather than\n * followed: the credential headers would go with it to wherever it points.\n */\nexport async function post(provider: string, url: string, init: { headers: Record<string, string>; body: string }, secrets: (string | undefined)[] = []): Promise<Response> {\n  const response = await fetch(postable(url), { method: \"POST\", headers: init.headers, body: init.body, redirect: \"error\", signal: AbortSignal.timeout(TIMEOUT_MS) });\n  if (!response.ok) {\n    let text = \"\";\n    try {\n      text = await response.text();\n    } catch {\n      // The status is enough.\n    }\n    throw new Error(`${provider} ${origin(url)} answered ${response.status}${text ? `: ${errorBody(text, secrets)}` : \"\"}`);\n  }\n  return response;\n}\n\n/** The start of an error body, secrets cut out first, then cut to ERROR_BODY_MAX on a code point. */\nexport function errorBody(text: string, secrets: (string | undefined)[] = []): string {\n  const kept = secrets.filter((s): s is string => typeof s === \"string\" && s.length >= 4);\n  const longest = kept.reduce((n, s) => Math.max(n, s.length), 0);\n  let head = cut(text, ERROR_BODY_MAX + longest);\n  for (const secret of kept) head = head.split(secret).join(\"[redacted]\");\n  return cut(head, ERROR_BODY_MAX);\n}\n\n/** A credential with the spaces and newlines a paste leaves around it taken off. Anything not a string is empty. */\nexport function trimmed(value: unknown): string {\n  return typeof value === \"string\" ? value.trim() : \"\";\n}\n\n/** Base64 of UTF-8, without Buffer. */\nexport function base64(text: string): string {\n  let binary = \"\";\n  for (const byte of new TextEncoder().encode(text)) binary += String.fromCharCode(byte);\n  return btoa(binary);\n}\n\nexport function basicAuth(user: string, password: string): string {\n  return `Basic ${base64(`${user}:${password}`)}`;\n}\n\nexport function hex(bytes: ArrayBuffer | Uint8Array): string {\n  return Array.from(bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes), (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nexport async function sha256Hex(text: string): Promise<string> {\n  return hex(await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(text)));\n}\n\n/**\n * A stable 32 hex character id for one alert: the same job, type and time\n * always give the same id, so a provider that deduplicates on it drops a\n * resend of an alert it already took.\n */\nexport async function alertId(alert: Alert): Promise<string> {\n  return (await sha256Hex(`${alert.job}\\n${alert.type}\\n${alert.at}`)).slice(0, 32);\n}\n\n/** The same id laid out as a UUID, for APIs that ask for one. */\nexport function asUuid(id: string): string {\n  return `${id.slice(0, 8)}-${id.slice(8, 12)}-${id.slice(12, 16)}-${id.slice(16, 20)}-${id.slice(20, 32)}`;\n}\n\n/** Cuts to at most `max` UTF-16 units without splitting a surrogate pair. */\nexport function cut(text: string, max: number): string {\n  if (text.length <= max) return text;\n  let end = max;\n  const code = text.charCodeAt(end - 1);\n  if (code >= 0xd800 && code <= 0xdbff) end -= 1;\n  return text.slice(0, end);\n}\n\n/** The run fields worth attaching to a tracker event. A start before the year 1 or after 9999 is null. */\nexport function runSummary(alert: Alert): Record<string, unknown> | null {\n  const run = alert.run;\n  if (!run) return null;\n  return { id: run.id, status: run.status, startedAt: isoTime(run.startedAt), durationMs: run.durationMs, trigger: run.trigger };\n}\n\n/** Title, message, triage and link as one plain text block, the way every channel reads. */\nexport function plainText(alert: Alert, link: string | undefined): string {\n  return [alert.title, \"\", alert.message, ...(alert.triage ? [\"\", `Triage: ${alert.triage}`] : []), ...(link ? [\"\", `Open: ${link}`] : [])].join(\"\\n\");\n}\n","import type { Alert, AlertChannel } from \"../types.js\";\nimport { cut, postable } from \"./shared.js\";\n\nexport interface DiscordOptions {\n  /** A channel webhook URL from Server Settings, Integrations, Webhooks. */\n  webhookUrl: string;\n  link?: (alert: Alert) => string;\n}\n\nconst COLOR: Record<Alert[\"type\"], number> = {\n  missed: 0xb7791f,\n  failed: 0xc62828,\n  stuck: 0xc62828,\n  slow: 0xb7791f,\n  over_budget: 0xb7791f,\n  recovered: 0x1f8a4c,\n};\n\nconst TIMEOUT_MS = 10_000;\n\n/** The longest embed description Discord takes. The title (under 256) and it stay well inside the embed's 6000. */\nexport const DESCRIPTION_MAX = 4096;\n\n/** Sends alerts to a Discord channel through a webhook. */\nexport function discord(options: DiscordOptions): AlertChannel {\n  if (!options.webhookUrl) throw new Error(\"discord() needs a webhookUrl\");\n  return {\n    name: \"discord\",\n    async send(alert) {\n      const url = options.link?.(alert);\n      const response = await fetch(postable(options.webhookUrl), {\n        method: \"POST\",\n        headers: { \"content-type\": \"application/json\" },\n        // Refused, not followed: a webhook URL is its own credential.\n        redirect: \"error\",\n        signal: AbortSignal.timeout(TIMEOUT_MS),\n        body: JSON.stringify({\n          content: alert.title,\n          // Job output can hold anything, \"@everyone\" included; ping no one.\n          allowed_mentions: { parse: [] },\n          embeds: [\n            {\n              title: alert.title,\n              ...(url ? { url } : {}),\n              description: embedDescription(alert),\n              color: COLOR[alert.type],\n              timestamp: new Date(alert.at).toISOString(),\n            },\n          ],\n        }),\n      });\n      if (!response.ok) throw new Error(`Discord webhook answered ${response.status}: ${(await response.text()).slice(0, 200)}`);\n    },\n  };\n}\n\n/**\n * The message in a code block, then the triage. Each part has its own cap,\n * and escaping can grow both, so the whole is held to DESCRIPTION_MAX (in\n * UTF-16 units) by cutting the message's block, never the triage: Discord\n * refuses a longer one on every retry.\n */\nexport function embedDescription(alert: Alert): string {\n  const triage = alert.triage ? `\\n**Triage:** ${escapeMarkdown(alert.triage.slice(0, 1000))}` : \"\";\n  const fences = \"```\\n\".length + \"\\n```\".length;\n  return \"```\\n\" + cut(codeBlockSafe(alert.message.slice(0, 3800)), DESCRIPTION_MAX - fences - triage.length) + \"\\n```\" + triage;\n}\n\n/** Breaks up ``` so text inside a code block cannot close it. */\nexport function codeBlockSafe(text: string): string {\n  return text.replace(/```/g, \"`​`​`\");\n}\n\n/** Escapes the characters Discord reads as markdown, links included. */\nexport function escapeMarkdown(text: string): string {\n  return text.replace(/[\\\\`*_~|[\\]()<>]/g, \"\\\\$&\");\n}\n","// @cronwatch/sdk/discord: what the entry point exports. The helpers the\n// channel is built from are internal; the names below are kept, deprecated,\n// for anyone who imported them, and are no longer exported from 1.0.\nimport * as internal from \"../alerts/discord.js\";\n\nexport { discord } from \"../alerts/discord.js\";\nexport type { DiscordOptions } from \"../alerts/discord.js\";\n\n/** @deprecated Internal to the Discord channel; no longer exported from 1.0. */\nexport const DESCRIPTION_MAX = internal.DESCRIPTION_MAX;\n/** @deprecated Internal to the Discord channel; no longer exported from 1.0. */\nexport const embedDescription = internal.embedDescription;\n/** @deprecated Internal to the Discord channel; no longer exported from 1.0. */\nexport const codeBlockSafe = internal.codeBlockSafe;\n/** @deprecated Internal to the Discord channel; no longer exported from 1.0. */\nexport const escapeMarkdown = internal.escapeMarkdown;\n"]}

package/dist/{email-VrGsVz43.d.ts → email-BWuUiCkw.d.ts}

@@ -1,4 +1,4 @@
-import { A as Alert } from './types-DyWCxlSi.js';
+import { A as Alert } from './types-DLnlUie8.js';
 
 /**
  * What every email channel sends: one subject, a plain text body and a small

package/dist/{email-JZs3vxwq.d.cts → email-Dcqe3k8n.d.cts}

@@ -1,4 +1,4 @@
-import { A as Alert } from './types-DyWCxlSi.cjs';
+import { A as Alert } from './types-DLnlUie8.cjs';
 
 /**
  * What every email channel sends: one subject, a plain text body and a small

package/dist/honeybadger.d.cts

@@ -1,4 +1,4 @@
-import { A as Alert, a as AlertChannel } from './types-DyWCxlSi.cjs';
+import { A as Alert, a as AlertChannel } from './types-DLnlUie8.cjs';
 
 /**
  * Honeybadger, as error notices (not Check-ins, a separate product).

package/dist/honeybadger.d.ts

@@ -1,4 +1,4 @@
-import { A as Alert, a as AlertChannel } from './types-DyWCxlSi.js';
+import { A as Alert, a as AlertChannel } from './types-DLnlUie8.js';
 
 /**
  * Honeybadger, as error notices (not Check-ins, a separate product).

package/dist/index.cjs

@@ -80,13 +80,46 @@ function beyondDates(at) {
 function readEnv(name) {
   return typeof process === "undefined" || !process.env ? void 0 : process.env[name];
 }
+function readSecretEnv(name) {
+  const value = readEnv(name);
+  return value === void 0 || value.trim() === "" ? void 0 : value;
+}
+function secretOption(value, what) {
+  if (value === void 0 || value === null) return value;
+  if (typeof value !== "string") {
+    throw new TypeError(`${what} must be a string, or null to opt out, not ${Array.isArray(value) ? "an array" : typeof value}`);
+  }
+  return value.trim() === "" ? void 0 : value;
+}
+function environment() {
+  if (typeof process === "undefined" || !process.env) return "";
+  for (const value of [process.env.CRONWATCH_ENV, process.env.APP_ENV, process.env.NODE_ENV]) {
+    const name = typeof value === "string" ? value.trim().toLowerCase() : "";
+    if (name === "") continue;
+    if (name === "prod") return "production";
+    if (name === "dev" || name === "local" || name === "test" || name === "testing") return "development";
+    return name;
+  }
+  return "";
+}
 function isDevelopment() {
-  if (typeof process === "undefined" || !process.env) return false;
-  const mode = process.env.NODE_ENV;
-  return mode === "development" || mode === "test";
+  return environment() === "development";
+}
+function isProduction() {
+  return environment() === "production";
 }
 var cache = /* @__PURE__ */ new Map();
 var crons = /* @__PURE__ */ new WeakMap();
+var never = /* @__PURE__ */ new WeakSet();
+var PROBE_FROM_MS = Date.UTC(2e3, 0, 1);
+function neverFires(cron) {
+  try {
+    return cron.nextRuns(1, new Date(PROBE_FROM_MS)).length === 0;
+  } catch (error) {
+    return error instanceof RangeError && /call stack/i.test(error.message);
+  }
+}
+var ONE_TIME_DATE = /^\d{4}-\d{2}-\d{2}[T ]\d{2}:\d{2}/;
 var EARLY_SLACK_MS = 6e4;
 function parseSchedule(schedule, timezone) {
   const key = `${timezone ?? ""}|${schedule}`;
@@ -100,6 +133,10 @@ function parseSchedule(schedule, timezone) {
     if (everyMs < 1e3) throw new Error(`schedule "${schedule}" is shorter than one second`);
     parsed = { kind: "interval", source: text, everyMs };
   } else {
+    if (text.slice(1).includes(":")) {
+      const reason = ONE_TIME_DATE.test(text) ? "CronPattern: a one-time date is not supported" : "Invalid ISO8601 passed to timezone parser.";
+      throw new Error(`schedule "${schedule}" is not a cron expression or "every <duration>": ${reason}`);
+    }
     let cron;
     try {
       cron = new croner.Cron(text, timezone ? { timezone } : {});
@@ -108,6 +145,7 @@ function parseSchedule(schedule, timezone) {
     }
     parsed = { kind: "cron", source: text, ...timezone ? { timezone } : {} };
     crons.set(parsed, cron);
+    if (neverFires(cron)) never.add(parsed);
   }
   cache.set(key, parsed);
   return parsed;
@@ -134,6 +172,7 @@ function countFrom(from) {
 function fireAfter(parsed, from) {
   const cron = crons.get(parsed);
   if (!cron) throw new Error(`schedule "${parsed.source}" was not made by parseSchedule`);
+  if (never.has(parsed)) return null;
   const start = countFrom(from);
   if (start === null) return null;
   let probe = start;
@@ -149,6 +188,7 @@ function fireAfter(parsed, from) {
 function firesBetween(parsed, from, to, limit) {
   const cron = crons.get(parsed);
   if (!cron) throw new Error(`schedule "${parsed.source}" was not made by parseSchedule`);
+  if (never.has(parsed)) return [];
   const out = [];
   const start = countFrom(from);
   if (start === null) return out;
@@ -283,16 +323,24 @@ function failureCount(state) {
 function emptyState(job) {
   return { job, open: {}, consecutiveFailures: 0, silencedUntil: null, lastAlertAt: null, pendingRecovery: [], undelivered: [] };
 }
+function isObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
 function normalizeState(state, job) {
-  if (!state) return emptyState(job);
+  if (!isObject(state)) return emptyState(job);
   const { sending, ...rest } = state;
+  const open = isObject(state.open) ? Object.fromEntries(Object.entries(state.open).filter(([, at]) => typeof at === "number")) : {};
+  const number = (value) => typeof value === "number" ? value : null;
+  const list = (value) => Array.isArray(value) ? value : [];
   return {
     ...emptyState(job),
     ...rest,
-    open: { ...state.open },
+    open,
     consecutiveFailures: failureCount(state),
-    pendingRecovery: [...state.pendingRecovery ?? []],
-    undelivered: [...state.undelivered ?? []],
+    silencedUntil: number(state.silencedUntil),
+    lastAlertAt: number(state.lastAlertAt),
+    pendingRecovery: list(state.pendingRecovery).filter((c) => typeof c === "string"),
+    undelivered: list(state.undelivered).filter((alert) => isObject(alert)),
     ...Array.isArray(sending) && sending.length > 0 ? { sending: [...sending] } : {}
   };
 }
@@ -496,8 +544,12 @@ function applySilence(previous, evaluation, now) {
   return { state: muteOpens(previous, evaluation.state), alerts: [] };
 }
 function staleAlert(alert, state) {
-  if (alert.type === "recovered") return alert.details.after.some((condition) => state.open[condition] !== void 0);
-  return state.open[alert.type] !== alert.at;
+  if (alert.type === "recovered") {
+    const after2 = isObject(alert.details) ? alert.details.after : void 0;
+    if (!Array.isArray(after2)) return true;
+    return after2.some((condition) => typeof condition !== "string" || state.open[condition] !== void 0);
+  }
+  return typeof alert.at !== "number" || state.open[alert.type] !== alert.at;
 }
 function jobHealth(def, lastRun, state, now) {
   const open = openConditions(state);
@@ -810,6 +862,15 @@ function checkExpectation(expect, output) {
   }
   return ok ? null : "Output did not pass the expect() check";
 }
+function readStoredJob(stored) {
+  const definition = stored.definition;
+  if (typeof definition !== "object" || definition === null || Array.isArray(definition)) {
+    return { job: { ...stored, definition: { name: stored.name } }, readable: false };
+  }
+  const read = { ...definition };
+  if ("tags" in read && !(Array.isArray(read.tags) && read.tags.every((tag) => typeof tag === "string"))) delete read.tags;
+  return { job: { ...stored, definition: read }, readable: true };
+}
 
 // src/routes/escape.ts
 function escapeHtml(value) {
@@ -853,6 +914,21 @@ function manifest(base) {
   });
 }
 var APP_JS = `"use strict";
+(function () {
+  var root = document.documentElement;
+  try {
+    var stored = localStorage.getItem("cronwatch-theme");
+    if (stored === "light" || stored === "dark") root.setAttribute("data-theme", stored);
+  } catch (e) {}
+  document.addEventListener("keydown", function (event) {
+    if (!(event.metaKey || event.ctrlKey) || !event.shiftKey || event.altKey || event.code !== "KeyD") return;
+    event.preventDefault();
+    var shown = root.getAttribute("data-theme") || (matchMedia("(prefers-color-scheme: dark)").matches ? "dark" : "light");
+    var next = shown === "dark" ? "light" : "dark";
+    root.setAttribute("data-theme", next);
+    try { localStorage.setItem("cronwatch-theme", next); } catch (e) {}
+  });
+})();
 (function () {
   var script = document.currentScript;
   if (!script || !("serviceWorker" in navigator)) return;
@@ -1229,7 +1305,8 @@ function weekRunsLimit(job, now) {
 var h = escapeHtml;
 var CSS = `
 :root{color-scheme:light dark;--paper:#f4f4f5;--sheet:#fff;--sunk:#fafafa;--rule:#e4e4e7;--rule-2:#d4d4d8;--tick:#909098;--ink:#000;--body:#18181b;--muted:#71717a;--ok:#15803d;--warn:#a16207;--bad:#b91c1c;--serif:"Newsreader",ui-serif,Georgia,Cambria,"Times New Roman",serif;--mono:"IBM Plex Mono",ui-monospace,SFMono-Regular,Menlo,Consolas,monospace;--who:200px}
-@media(prefers-color-scheme:dark){:root{--paper:#09090b;--sheet:#111113;--sunk:#18181b;--rule:#27272a;--rule-2:#3f3f46;--tick:#66666f;--ink:#fff;--body:#e4e4e7;--muted:#a1a1aa;--ok:#4ade80;--warn:#fbbf24;--bad:#f87171}}
+@media(prefers-color-scheme:dark){:root:not([data-theme=light]){--paper:#09090b;--sheet:#111113;--sunk:#18181b;--rule:#27272a;--rule-2:#3f3f46;--tick:#66666f;--ink:#fff;--body:#e4e4e7;--muted:#a1a1aa;--ok:#4ade80;--warn:#fbbf24;--bad:#f87171}}
+:root[data-theme=light]{color-scheme:light}:root[data-theme=dark]{color-scheme:dark;--paper:#09090b;--sheet:#111113;--sunk:#18181b;--rule:#27272a;--rule-2:#3f3f46;--tick:#66666f;--ink:#fff;--body:#e4e4e7;--muted:#a1a1aa;--ok:#4ade80;--warn:#fbbf24;--bad:#f87171}
 *{box-sizing:border-box}html{-webkit-text-size-adjust:100%}
 body{margin:0;background:var(--paper);color:var(--ink);font:400 16px/1.55 var(--serif);-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale}
 a{color:inherit;text-decoration:underline;text-decoration-thickness:1px;text-underline-offset:.16em;text-decoration-color:var(--rule-2)}a:hover{text-decoration-color:currentColor}
@@ -1581,12 +1658,18 @@ function jobPage(job, runs, now, base, complete = true) {
   return layout(`${job.name}: CronWatch`, body, base, { refresh: 60 });
 }
 function messagePage(title, message, base, signIn = false) {
-  const form = signIn ? `<form class="signin" method="get" action="${h(base)}/"><label for="token">Token</label><input id="token" name="token" type="password" autocomplete="current-password" autocapitalize="off" spellcheck="false" required><button class="primary" type="submit">Sign in</button></form>` : "";
+  const form = signIn ? `<form class="signin" method="post" action="${h(base)}/signin"><label for="token">Token</label><input id="token" name="token" type="password" autocomplete="current-password" autocapitalize="off" spellcheck="false" required><button class="primary" type="submit">Sign in</button></form>` : "";
   return layout(title, `<header class="top">${brand(base)}</header><main class="message"><h1>${h(title)}</h1><p>${h(message)}</p>${form}</main>`, base);
 }
 
+// src/version.ts
+var VERSION = "0.11.1";
+var API_VERSION = 1;
+
 // src/routes/index.ts
 var COOKIE = "cronwatch_token";
+var LIBRARY = "@cronwatch/sdk";
+var LANGUAGE = "typescript";
 async function cookieValue(token) {
   const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(`cronwatch-cookie:${token}`));
   return Array.from(new Uint8Array(digest), (b) => b.toString(16).padStart(2, "0")).join("");
@@ -1670,6 +1753,20 @@ function forwardedOrigin(request, url) {
     return url.origin;
   }
 }
+function bearerToken(header) {
+  const match = header === null ? null : /^Bearer\s+([\s\S]*)$/i.exec(header);
+  return match ? match[1] : null;
+}
+function signInReturn(referer, publicOrigin, base) {
+  if (referer === null || !referer.startsWith(publicOrigin + "/")) return `${base}/`;
+  let url;
+  try {
+    url = new URL(referer);
+  } catch {
+    return `${base}/`;
+  }
+  return url.searchParams.has("token") ? `${base}/` : referer;
+}
 function stripBase(pathname, base) {
   let path = pathname.startsWith(base) ? pathname.slice(base.length) : pathname;
   if (path === "") path = "/";
@@ -1712,8 +1809,12 @@ function runsLimit(value) {
   return Number.isFinite(n) ? Math.min(MAX_RUNS, Math.max(1, n)) : DEFAULT_RUNS;
 }
 function createRoutes(cw, options = {}) {
+  return cw.routes(options);
+}
+function buildRoutes(cw, options = {}) {
   const optedOut = options.token === null;
-  const configured = optedOut ? null : options.token || readEnv("CRONWATCH_TOKEN") || null;
+  const given = secretOption(options.token, "routes: token");
+  const configured = optedOut ? null : given || readSecretEnv("CRONWATCH_TOKEN") || null;
   const base = (options.basePath ?? "/cronwatch").replace(/\/+$/, "");
   const developing = isDevelopment();
   const fixedOrigin = configuredOrigin(options.origin);
@@ -1745,7 +1846,17 @@ function createRoutes(cw, options = {}) {
     if (method !== "GET" && method !== "HEAD" && crossSite(request, publicOrigin)) {
       return wantsHtml ? html(messagePage("Cross-site request refused", "Changes can only be made from the dashboard itself.", base), 403) : api({ ok: false, error: "Cross-site request refused" }, 403);
     }
-    const bearer = request.headers.get("authorization")?.replace(/^Bearer\s+/i, "") ?? null;
+    const bearer = bearerToken(request.headers.get("authorization"));
+    const signInCookie = async () => {
+      const secure = publicOrigin.startsWith("https:") ? "; Secure" : "";
+      return `${COOKIE}=${await expectedCookie(token)}; Path=${base || "/"}; HttpOnly; SameSite=Lax; Max-Age=${60 * 60 * 24 * 30}${secure}`;
+    };
+    const signInPage = () => generated ? html(messagePage("Sign in", "CRONWATCH_TOKEN is not set, so this development server made a token. The sign-in link is in the server log: open it once, or enter the token from it below, and this browser stays signed in.", base, true), 401) : html(messagePage("Sign in", "Enter your CRONWATCH_TOKEN and this browser stays signed in.", base, true), 401);
+    if (token && method === "POST" && path === "/signin") {
+      const sent = (await readBody(request)).token;
+      if (sent === void 0 || !constantTimeEqual(sent, token)) return signInPage();
+      return redirect(signInReturn(request.headers.get("referer"), publicOrigin, base), { "set-cookie": await signInCookie() });
+    }
     if (token) {
       const query = wantsHtml && method === "GET" ? url.searchParams.get("token") : null;
       const sent = readCookie(request, COOKIE);
@@ -1753,17 +1864,12 @@ function createRoutes(cw, options = {}) {
       const cronSecretOk = isCheck && bearer !== null && cw.cronSecret !== null && constantTimeEqual(bearer, cw.cronSecret);
       const tokenOk = bearer !== null ? constantTimeEqual(bearer, token) : query !== null ? constantTimeEqual(query, token) : sent !== null && constantTimeEqual(sent, await expectedCookie(token));
       if (!cronSecretOk && !tokenOk) {
-        if (generated) {
-          return wantsHtml ? html(messagePage("Sign in", "CRONWATCH_TOKEN is not set, so this development server made a token. The sign-in link is in the server log: open it once and this browser stays signed in.", base, true), 401) : api({ ok: false, error: "Unauthorized: CRONWATCH_TOKEN is not set, so this development server made a token; it is in the server log" }, 401);
-        }
-        return wantsHtml ? html(messagePage("Sign in", `Open this page with ?token=<your CRONWATCH_TOKEN> once and it will stay signed in.`, base, true), 401) : api({ ok: false, error: "Unauthorized" }, 401);
+        if (wantsHtml) return signInPage();
+        return generated ? api({ ok: false, error: "Unauthorized: CRONWATCH_TOKEN is not set, so this development server made a token; it is in the server log" }, 401) : api({ ok: false, error: "Unauthorized" }, 401);
       }
       if (query !== null) {
         url.searchParams.delete("token");
-        const secure = publicOrigin.startsWith("https:") ? "; Secure" : "";
-        return redirect(url.pathname + (url.search || ""), {
-          "set-cookie": `${COOKIE}=${await expectedCookie(token)}; Path=${base || "/"}; HttpOnly; SameSite=Lax; Max-Age=${60 * 60 * 24 * 30}${secure}`
-        });
+        return redirect(url.pathname + (url.search || ""), { "set-cookie": await signInCookie() });
       }
     }
     const redirectBack = () => {
@@ -1814,6 +1920,9 @@ function createRoutes(cw, options = {}) {
     }
     if (parts[0] === "api") {
       const rest = parts.slice(1);
+      if (method === "GET" && rest.length === 0) {
+        return api({ ok: true, library: LIBRARY, language: LANGUAGE, version: VERSION, api: API_VERSION });
+      }
       if (method === "GET" && rest[0] === "jobs" && rest.length === 1) {
         return api({ ok: true, jobs: await cw.jobs() });
       }
@@ -1841,9 +1950,13 @@ function createRoutes(cw, options = {}) {
           } catch (e) {
             return api({ ok: false, error: e.message }, 400);
           }
-          return api({ ok: true, state: await cw.silence(name, duration) });
+          await cw.silence(name, duration);
+          return api({ ok: true, job: await cw.jobSummary(name) });
+        }
+        if (rest[2] === "unsilence") {
+          await cw.unsilence(name);
+          return api({ ok: true, job: await cw.jobSummary(name) });
         }
-        if (rest[2] === "unsilence") return api({ ok: true, state: await cw.unsilence(name) });
       }
       if (rest[0] === "check" && rest.length === 1) {
         if (method === "GET" && bearer === null) {
@@ -2051,7 +2164,7 @@ function validateDefinition(def) {
 function sameState(a, b) {
   return JSON.stringify(a) === JSON.stringify(b);
 }
-var CronWatch = class {
+var Cronwatch = class {
   store;
   alerts;
   triage;
@@ -2064,7 +2177,7 @@ var CronWatch = class {
   /** cronSecret was passed as null: handlers may run without a secret. */
   secretOptOut;
   redact;
-  /** "check": queue alerts for another process's check instead of sending them. See CronWatchOptions.deliver. */
+  /** "check": queue alerts for another process's check instead of sending them. See CronwatchOptions.deliver. */
   deferDelivery;
   defaults;
   definitions = /* @__PURE__ */ new Map();
@@ -2083,12 +2196,15 @@ var CronWatch = class {
   usingDefaultStore = false;
   warnedNoSecret = false;
   warnedDeferredStart = false;
+  /** Stored jobs read with a definition that was not a JSON object (see readJob). */
+  unreadable = /* @__PURE__ */ new WeakSet();
   constructor(options = {}) {
     this.store = options.store ?? (this.usingDefaultStore = true, memory());
     this.alerts = options.alerts ?? [consoleChannel()];
     this.triage = options.triage;
     this.sources = options.sources ?? [];
-    const secret = options.cronSecret === void 0 ? readEnv("CRON_SECRET") : options.cronSecret;
+    const given = secretOption(options.cronSecret, "cronSecret");
+    const secret = options.cronSecret === void 0 ? readSecretEnv("CRON_SECRET") : given;
     this.cronSecret = secret ? secret : null;
     this.secretOptOut = options.cronSecret === null;
     this.retentionMs = parseDuration(options.retention ?? "30d", "retention");
@@ -2149,7 +2265,7 @@ var CronWatch = class {
         return outcome.result;
       },
       handler(fn, options) {
-        const own = options?.secret;
+        const own = secretOption(options?.secret, "handler: secret");
         const secret = own === null ? null : own ? own : self.cronSecret;
         const optedOut = own === null || !own && self.secretOptOut;
         return async (request) => {
@@ -2201,7 +2317,7 @@ var CronWatch = class {
     if (!this.ready) {
       this.ready = (async () => {
         if (this.store.init) await this.store.init();
-        if (this.usingDefaultStore && readEnv("NODE_ENV") === "production") {
+        if (this.usingDefaultStore && isProduction()) {
           console.warn("[cronwatch] using the in-memory store: runs and state are lost on restart. Pass a store from @cronwatch/sdk/sqlite or @cronwatch/sdk/postgres.");
         }
       })().catch((error) => {
@@ -2251,13 +2367,23 @@ var CronWatch = class {
     const jobs = await this.store.listJobs();
     const listed = new Set(jobs.map((job) => job.name));
     const missing = [...this.definitions.values()].filter((definition) => !listed.has(definition.name));
-    if (missing.length === 0) return jobs;
+    if (missing.length === 0) return jobs.map((job) => this.readJob(job));
     for (const definition of missing) {
       if (this.definitions.get(definition.name) !== definition) continue;
       this.synced.delete(definition.name);
       await this.sync(definition);
     }
-    return this.store.listJobs();
+    return (await this.store.listJobs()).map((job) => this.readJob(job));
+  }
+  /** A stored job read leniently (readStoredJob); one whose definition is unreadable is remembered, so that evaluating it throws. */
+  readJob(stored) {
+    const { job, readable } = readStoredJob(stored);
+    if (!readable) this.unreadable.add(job);
+    return job;
+  }
+  /** Throws for a job whose stored definition was not a JSON object: reported, and shown as failing, while the others carry on. */
+  evaluable(stored) {
+    if (this.unreadable.has(stored)) throw new Error(`job "${stored.name}": its stored definition is not a JSON object`);
   }
   /**
    * Runs `fn` after every earlier state update for the same job has settled,
@@ -2676,6 +2802,10 @@ ${id}`;
   async recordRun(input, options = {}) {
     const declared = this.definitions.get(input.job);
     if (!declared) throw new Error(`recordRun: job "${input.job}" is not declared; call job() first`);
+    if (typeof input.id !== "string" || input.id.length === 0 || input.id.length > MAX_RUN_ID) {
+      const got = typeof input.id === "string" ? `${input.id.length} characters` : typeof input.id;
+      throw new Error(`recordRun: run ids must be 1 to ${MAX_RUN_ID} characters (got ${got}; job "${input.job}")`);
+    }
     if (input.id.includes("\0")) throw new Error(`recordRun: run ids cannot contain a NUL character (job "${input.job}")`);
     for (const [metric, value] of Object.entries(input.metrics ?? {})) {
       if (typeof value !== "number" || !Number.isFinite(value)) {
@@ -2804,7 +2934,10 @@ ${id}`;
     for (const listed of await this.store.runningRuns()) {
       try {
         const declared = this.definitions.get(listed.job);
-        const definition = declared ? toStored(declared) : (await this.store.getJob(listed.job))?.definition;
+        const found = declared ? null : await this.store.getJob(listed.job);
+        const stored = found ? this.readJob(found) : null;
+        if (stored) this.evaluable(stored);
+        const definition = declared ? toStored(declared) : stored?.definition;
         if (!definition || !isStuck(definition, listed, now)) continue;
         const run = await this.store.getRun(listed.id);
         if (!run || run.status !== "running" || run.job !== listed.job) continue;
@@ -2823,6 +2956,7 @@ ${id}`;
     const retries = { spentMs: 0 };
     for (const stored of await this.storedJobs()) {
       try {
+        this.evaluable(stored);
         const recent = await this.store.listRuns(stored.name, BASELINE_WINDOW);
         let nextExpectedAt = null;
         const { state, result: held } = await this.updateState(stored.name, (previous) => {
@@ -2858,6 +2992,7 @@ ${id}`;
     let recent = [];
     try {
       recent = await this.store.listRuns(stored.name, Math.max(runs, BASELINE_WINDOW));
+      this.evaluable(stored);
       const state = await this.readState(stored.name);
       const { nextExpectedAt } = onCheck(stored.definition, stored, recent[0] ?? null, state, now);
       return { job: summarize(stored, recent, state, nextExpectedAt, now), runs: recent.slice(0, runs) };
@@ -2892,7 +3027,7 @@ ${id}`;
     if (definition) await this.sync(definition, true);
     const stored = await this.store.getJob(name);
     if (!stored) return null;
-    return (await this.snapshot(stored, this.now(), 0)).job;
+    return (await this.snapshot(this.readJob(stored), this.now(), 0)).job;
   }
   /** A job's runs, newest first. `limit` is a whole number from 1 to 500. */
   async runs(name, limit = 50) {
@@ -2939,21 +3074,27 @@ ${id}`;
     this.synced.delete(name);
     await this.store.deleteJob(name);
   }
-  /** The dashboard and JSON API as fetch-style handlers. See createRoutes(). */
+  /**
+   * The dashboard and JSON API as fetch-style handlers: the one way to mount
+   * them. A Next.js app exports them from app/cronwatch/[[...path]]/route.ts:
+   *
+   *   export const { GET, POST, DELETE } = cw.routes();
+   */
   routes(options) {
-    return createRoutes(this, options);
+    return buildRoutes(this, options);
   }
   /**
    * Check on an interval, for long-running servers. Default every minute.
    * Not for serverless functions or Cloudflare Workers, where nothing runs
-   * between requests: call check() from a cron there instead.
+   * between requests: call check() from a cron there instead. (A job's
+   * start() opens a run; this starts the checks.)
    */
-  start(every = "1m") {
+  startChecking(every = "1m") {
     if (this.timer) return;
     const ms = Math.min(TIMER_MAX_MS, Math.max(5e3, parseDuration(every, "check interval")));
     if (this.deferDelivery && !this.warnedDeferredStart) {
       this.warnedDeferredStart = true;
-      console.warn('[cronwatch] start() was called with deliver: "check", so these checks send no alerts. Another process must run checks with deliver: "now" (the default) to send them.');
+      console.warn('[cronwatch] startChecking() was called with deliver: "check", so these checks send no alerts. Another process must run checks with deliver: "now" (the default) to send them.');
     }
     const tick = () => this.check().catch((e) => this.onError(e, "check"));
     this.timer = setInterval(tick, ms);
@@ -2964,6 +3105,15 @@ ${id}`;
     }, 1e3);
     if (typeof this.firstTick === "object" && "unref" in this.firstTick) this.firstTick.unref();
   }
+  /**
+   * startChecking(), under its former name.
+   * @deprecated Renamed `startChecking`, since a job's `start()` opens a run.
+   * This name still works through 1.x and goes in 2.0.
+   */
+  start(every = "1m") {
+    this.startChecking(every);
+  }
+  /** Stop the checks startChecking() began. */
   stop() {
     if (this.timer) clearInterval(this.timer);
     if (this.firstTick) clearTimeout(this.firstTick);
@@ -3076,9 +3226,10 @@ ${id}`;
   }
 };
 var RESERVED_RUN_ID_PREFIX = "pgcron:";
+var MAX_RUN_ID = 200;
 function checkRunId(job, id, method) {
-  if (typeof id !== "string" || id.length === 0 || id.length > 200) {
-    throw new Error(`job "${job}": ${method}() needs a run id of 1 to 200 characters (got ${typeof id === "string" ? `${id.length} characters` : typeof id})`);
+  if (typeof id !== "string" || id.length === 0 || id.length > MAX_RUN_ID) {
+    throw new Error(`job "${job}": ${method}() needs a run id of 1 to ${MAX_RUN_ID} characters (got ${typeof id === "string" ? `${id.length} characters` : typeof id})`);
   }
   if (id.includes("\0")) throw new Error(`job "${job}": ${method}() cannot take a run id containing a NUL character`);
   if (id.startsWith(RESERVED_RUN_ID_PREFIX)) {
@@ -3139,13 +3290,16 @@ function custom(name, send) {
     await send(alert);
   } };
 }
+var CronWatch = Cronwatch;
 
 // src/index.ts
 function cronwatch(options = {}) {
-  return new CronWatch(options);
+  return new Cronwatch(options);
 }
 
 exports.CronWatch = CronWatch;
+exports.Cronwatch = Cronwatch;
+exports.VERSION = VERSION;
 exports.composeAlert = composeAlert;
 exports.consoleChannel = consoleChannel;
 exports.createRoutes = createRoutes;