@docstack/client 0.1.6 → 0.1.8

package/lib/index.umd.js

@@ -3540,7 +3540,69 @@ async function execute(_stack, params) {
             }
         ]
     };
-    syspatches.push(sys_011, sys_012, sys_013, sys_014, sys_015);
+    /**
+     * Tenancy declared at the datamodel.
+     *
+     * `tenants` on a class model names the tenant spaces the class belongs to. A tenant is a
+     * stack (ADR-0030): the declaration is what a sync channel's entitlement is compiled
+     * against - which stacks the channel is served at all, and which classes travel over a
+     * stack that holds a mix of declarations. A class with no declaration is tenant-neutral
+     * and follows its stack, so a datamodel that never declares one keeps today's behavior
+     * exactly.
+     */
+    const sys_016 = {
+        "_id": "~sys-0.0.16",
+        "~class": "patch",
+        "version": "0.0.16",
+        "target": "system",
+        "changelog": "### Schema Patch: v0.0.16\\n#### New attribute: class.tenants",
+        "docs": [
+            {
+                "_id": "class",
+                "_rev": "auto",
+                "active": true,
+                "name": "class",
+                "description": "A class document representing a data model class",
+                "~class": "~self",
+                // Patch hydration is a shallow merge: this `schema` REPLACES the stored one,
+                // it does not add to it. So a patch to the `class` document must carry the
+                // full attribute set - dropping `ephemeral`/`simple` here silently strips
+                // those flags from every class model on the next validated write.
+                "schema": {
+                    "ephemeral": {
+                        "name": "ephemeral",
+                        "type": "boolean",
+                        "description": "Contents are local to one run: emptied when the stack next opens, and never replicated.",
+                        "config": {
+                            "mandatory": false,
+                            "isArray": false,
+                            "defaultValue": false
+                        }
+                    },
+                    "simple": {
+                        "name": "simple",
+                        "type": "boolean",
+                        "description": "Documents are stored as given: no schema, no validation, no triggers, no relations.",
+                        "config": {
+                            "mandatory": false,
+                            "isArray": false,
+                            "defaultValue": false
+                        }
+                    },
+                    "tenants": {
+                        "name": "tenants",
+                        "type": "string",
+                        "description": "Tenant spaces this class belongs to; a tenant is a stack. Absent means tenant-neutral.",
+                        "config": {
+                            "mandatory": false,
+                            "isArray": true
+                        }
+                    }
+                }
+            }
+        ]
+    };
+    syspatches.push(sys_011, sys_012, sys_013, sys_014, sys_015, sys_016);
     /**
      * Every document id the system patches seed.
      *
@@ -3637,7 +3699,7 @@ async function execute(_stack, params) {
         return updatedDoc;
     };
 
-    const logger$2 = createLogger().child({ module: "pouchdb" });
+    const logger$3 = createLogger().child({ module: "pouchdb" });
     /**
      * Raised when a locked stack is asked to write a class carrying encrypted attributes.
      *
@@ -3696,12 +3758,17 @@ async function execute(_stack, params) {
     const StackPlugin = (pouch, stack, pristine) => {
         const pouchBulkDocs = pristine.bulkDocs;
         const pouchBulkGet = pristine.bulkGet;
+        // Captured from the pristine instance like the two above, and for the same
+        // ADR-0019 reason - `pouch.prototype.get` is not a reliable source under the
+        // plugin-loading shim (it resolves undefined in the UMD build), which is exactly
+        // what got the decrypting `get` override commented out instead of recaptured.
+        const pouchGet = pristine.get;
         return {
             ping: () => {
                 return Promise.resolve("pong");
             },
             bulkDocs: async function (docs, options, callback) {
-                const fnLogger = logger$2.child({ method: "bulkDocs" });
+                const fnLogger = logger$3.child({ method: "bulkDocs" });
                 if (typeof options == 'function') {
                     callback = options;
                     options = {};
@@ -4121,32 +4188,57 @@ async function execute(_stack, params) {
                 }
                 return exec();
             },
-            /*
-            get: async function (docId, options?: PouchDB.Core.GetOptions | null, callback?) {
+            // Single-document reads decrypt, symmetrically with `bulkGet`, `find` and the
+            // query engine: ADR-0020 keeps ciphertext on the *changes feed*, never on
+            // reads. This override spent a while commented out - disabled by a comment
+            // that rode an unrelated refactor commit, with no decision recorded - which
+            // left `stack.getDocument` returning ciphertext while every other read path
+            // decrypted. Re-enabled with a cheaper precheck: the cached class model
+            // answers "does this class encrypt anything?" first, so a class with nothing
+            // encrypted pays a cache lookup here rather than a class snapshot per get.
+            // See ADR-0032.
+            get: async function (docId, options, callback) {
                 if (typeof options === "function") {
                     callback = options;
                     options = undefined;
                 }
-
                 const exec = async () => {
-                    const result = await pouchGet.call(this, docId, options ?? {});
-                    if (result && isDocument(result) && stack.cryptoEngine.isEnabled()
+                    var _a, _b;
+                    const result = await pouchGet.call(this, docId, options !== null && options !== void 0 ? options : {});
+                    // Optional-chained on purpose: this override serves `initialize` itself
+                    // (`checkSystem` reads `~system` through it), which runs before the
+                    // crypto engine is constructed. And gated on the *key*, not just the
+                    // engine: without a document key `decryptDocument` can do nothing, so a
+                    // keyless stack - initialization, a locked stack, every stack that never
+                    // encrypts - skips the branch and pays nothing per get. Only a keyed
+                    // stack reading an encrypted class pays the class lookup and decrypt.
+                    if (result && isDocument(result) && ((_a = stack.cryptoEngine) === null || _a === void 0 ? void 0 : _a.isEnabled())
+                        && stack.cryptoEngine.getDocumentKey()
                         && !stack.isSimpleClass(result["~class"])) {
-                        const classObj = await stack.getClassSnapshot(result["~class"]).catch(() => null);
-                        if (classObj && classObj.getEncryptedAttributes().length) {
-                            await stack.cryptoEngine.decryptDocument(result as Document, classObj);
+                        const model = await stack.getClassModel(result["~class"]).catch(() => null);
+                        const encrypts = model && Object.values((_b = model.schema) !== null && _b !== void 0 ? _b : {})
+                            .some((attribute) => { var _a; return ((_a = attribute === null || attribute === void 0 ? void 0 : attribute.config) === null || _a === void 0 ? void 0 : _a.encrypted) === true; });
+                        if (encrypts) {
+                            const classObj = await stack.getClassSnapshot(result["~class"]).catch(() => null);
+                            if (classObj && classObj.getEncryptedAttributes().length) {
+                                await stack.cryptoEngine.decryptDocument(result, classObj);
+                            }
                         }
                     }
                     return result;
                 };
-
                 if (callback) {
                     exec().then((res) => callback(null, res)).catch((err) => callback(err, undefined));
                     return;
                 }
                 return exec();
             },
-            
+            /*
+            Deliberately retired, not lost: pouchdb-core routes `put` through `bulkDocs`,
+            and the active `bulkDocs` above already owns encryption - a put override that
+            encrypted too would encrypt twice. Kept for the record beside the `get`
+            override's history. See ADR-0032.
+
             put: async function (doc, options?: PouchDB.Core.PutOptions | null, callback?) {
                 if (typeof options === "function") {
                     callback = options;
@@ -4327,12 +4419,18 @@ async function execute(_stack, params) {
     const createReplicationDb = (db, pristine) => {
         const bulkDocs = pristine.bulkDocs.bind(db);
         const bulkGet = pristine.bulkGet.bind(db);
+        // `get` restored for the same reason as `bulkGet`: since ADR-0032 the plugin
+        // decrypts single-document reads too, and this handle's whole contract is reading
+        // documents exactly as they are stored.
+        const get = pristine.get.bind(db);
         return new Proxy(db, {
             get(target, property) {
                 if (property === "bulkDocs")
                     return bulkDocs;
                 if (property === "bulkGet")
                     return bulkGet;
+                if (property === "get")
+                    return get;
                 return forward(target, property);
             },
         });
@@ -4765,7 +4863,76 @@ async function execute(_stack, params) {
         }));
     };
 
-    const logger$1 = createLogger().child({ module: "sync" });
+    /**
+     * Normalizes a class model's tenant declaration.
+     *
+     * @param model - Any object carrying (or omitting) a `tenants` declaration.
+     * @returns The declared tenant names; empty for a tenant-neutral class.
+     */
+    const classTenants = (model) => {
+        const declared = model === null || model === void 0 ? void 0 : model.tenants;
+        if (!Array.isArray(declared))
+            return [];
+        return declared.filter((t) => typeof t === "string" && t.length > 0);
+    };
+    /**
+     * Compiles an entitlement into the stacks it reaches and the class rules it needs.
+     *
+     * A stack is served when its name is an entitled tenant - a tenant *is* a stack - or
+     * when it holds at least one class declared for an entitled tenant. Within a served
+     * stack:
+     *
+     * - classes declared for an entitled tenant travel;
+     * - tenant-neutral classes follow their stack: they travel when the stack itself is the
+     *   entitled tenant, which is what keeps a datamodel with no declarations at today's
+     *   behavior exactly;
+     * - classes declared only for other tenants are excluded.
+     *
+     * Resolved once per call, the way the sync layer resolves ephemeral classes when a
+     * replication starts (ADR-0028): a declaration that changes later takes effect on the
+     * next `sync()`, never silently mid-stream.
+     *
+     * @param stacks - The candidate stacks, typically every open stack.
+     * @param entitlement - The tenant names this channel may see.
+     * @returns Which stacks to serve, and per-stack class rules where needed.
+     */
+    const deriveTenantScope = async (stacks, entitlement) => {
+        const entitled = new Set(entitlement.filter(t => typeof t === "string" && t.length > 0));
+        const scope = { stacks: [], classes: {} };
+        for (const stack of stacks) {
+            const { list } = await stack.getClassModels();
+            const admitted = [];
+            const foreign = [];
+            for (const model of list) {
+                const declared = classTenants(model);
+                if (!declared.length)
+                    continue;
+                if (declared.some(t => entitled.has(t)))
+                    admitted.push(model.name);
+                else
+                    foreign.push(model.name);
+            }
+            const stackIsTenant = entitled.has(stack.name);
+            if (!stackIsTenant && !admitted.length)
+                continue;
+            scope.stacks.push(stack.name);
+            if (stackIsTenant) {
+                // The stack is itself an entitled tenant: everything follows it except
+                // classes spoken for by tenants outside the entitlement.
+                if (foreign.length)
+                    scope.classes[stack.name] = { exclude: foreign.sort() };
+            }
+            else {
+                // Served only because entitled classes live here: nothing else travels.
+                // `include` keeps the data-model classes automatically (class-filter.ts),
+                // so the receiving end stays a readable replica.
+                scope.classes[stack.name] = { include: admitted.sort() };
+            }
+        }
+        return scope;
+    };
+
+    const logger$2 = createLogger().child({ module: "sync" });
     /**
      * Raised when a remote is ahead of this device's data model.
      *
@@ -4930,7 +5097,7 @@ async function execute(_stack, params) {
          * @throws {SyncSchemaMismatchError} When the remote is ahead of this device.
          */
         async start() {
-            const fnLogger = logger$1.child({ method: "start", stack: this.stack.name });
+            const fnLogger = logger$2.child({ method: "start", stack: this.stack.name });
             this.cancelled = false;
             this.setState("starting");
             try {
@@ -4969,7 +5136,7 @@ async function execute(_stack, params) {
                     this.replication.cancel();
                 }
                 catch (error) {
-                    logger$1.warn("Error while cancelling replication", { error, stack: this.stack.name });
+                    logger$2.warn("Error while cancelling replication", { error, stack: this.stack.name });
                 }
                 if (typeof this.replication.removeAllListeners === "function") {
                     this.replication.removeAllListeners();
@@ -5242,6 +5409,22 @@ async function execute(_stack, params) {
                 this.dispatchEvent(new CustomEvent("status", { detail: this.getStatus() }));
             });
         }
+        /** The stacks this handle covers. What is missing from this list is not
+         *  replicating - compare against `DocStack.getStacks()`, or use
+         *  `DocStack.getSyncCoverage()` which does exactly that. */
+        get names() {
+            return [...this.handles.keys()];
+        }
+        /** @internal - use {@link DocStack.removeStack}. Cancels and drops one stack's
+         *  replication; the rest are untouched. */
+        remove(name) {
+            const handle = this.handles.get(name);
+            if (!handle)
+                return false;
+            handle.cancel();
+            this.handles.delete(name);
+            return true;
+        }
         /** Every stack's status, keyed by stack name. */
         getStatus() {
             const status = {};
@@ -7781,6 +7964,549 @@ async function execute(_stack, params) {
         }
     }
 
+    /**
+     * The schedule grammar a client can actually honour.
+     *
+     * `JobModel.schedule` is a string, and the obvious thing to put in it is cron. Cron is
+     * not offered here, and the reason is not implementation cost: cron's entire vocabulary
+     * is about *naming occurrences* — "02:15 on the 3rd of every month" — and a client
+     * cannot promise to be running at an occurrence. It is a closed tab, a suspended app, a
+     * sleeping laptop. Accepting the syntax would promise a precision the runtime has no way
+     * to keep, and the failure would be silent: the job simply never runs on the 3rd.
+     *
+     * So the grammar says only what a client can honour, which is a floor rather than a
+     * moment: *not more often than this*.
+     *
+     * | Form | Meaning |
+     * | --- | --- |
+     * | `@every 30m`, `@every 6h`, `@every 7d` | Fixed interval since the last run. |
+     * | `@hourly` | Top of each local hour. |
+     * | `@daily` | Local midnight. |
+     * | `@daily@09:00` | A local wall-clock time. |
+     * | `@weekly` | Monday, local midnight. |
+     * | `@weekly@09:00` | Monday, at a local wall-clock time. |
+     *
+     * Anchored forms are computed against *local* time through `Date`, so they follow the
+     * device across daylight-saving changes: `@daily@09:00` stays 09:00 to the person
+     * reading the screen, which is the only definition of "nine" that a campaign cares
+     * about.
+     *
+     * @module
+     */
+    /** Milliseconds per unit accepted by `@every`. */
+    const UNIT_MS = {
+        s: 1000,
+        m: 60000,
+        h: 3600000,
+        d: 86400000,
+        w: 604800000,
+    };
+    /** Shortest interval `@every` will accept. Below this a client is polling, not scheduling. */
+    const MIN_PERIOD_MS = 30000;
+    /** `HH:MM`, 24-hour, as minutes past local midnight. `null` when the text is not a time. */
+    const parseTimeOfDay = (text) => {
+        const match = /^([01]?\d|2[0-3]):([0-5]\d)$/.exec(text);
+        if (!match)
+            return null;
+        return Number(match[1]) * 60 + Number(match[2]);
+    };
+    /**
+     * Reads a schedule string, or returns `null` when it is not one.
+     *
+     * `null` is a value the scheduler acts on rather than an error to throw: a job document
+     * carrying a schedule nobody can parse should be skipped and reported, not allowed to
+     * take down the tick that would have run the other jobs.
+     *
+     * @example
+     * ```typescript
+     * parseSchedule("@every 6h");     // { kind: "interval", periodMs: 21600000, ... }
+     * parseSchedule("@daily@09:00");  // { kind: "daily", minutes: 540, ... }
+     * parseSchedule("0 9 * * *");     // null — cron is not accepted, see the module docblock
+     * ```
+     */
+    const parseSchedule = (schedule) => {
+        if (typeof schedule !== "string")
+            return null;
+        const source = schedule.trim();
+        const text = source.toLowerCase();
+        if (!text.startsWith("@"))
+            return null;
+        const every = /^@every\s+(\d+)\s*([smhdw])$/.exec(text);
+        if (every) {
+            const periodMs = Number(every[1]) * UNIT_MS[every[2]];
+            if (!Number.isFinite(periodMs) || periodMs < MIN_PERIOD_MS)
+                return null;
+            return { kind: "interval", source, periodMs };
+        }
+        if (text === "@hourly")
+            return { kind: "hourly", source };
+        const parts = text.split("@").filter(Boolean);
+        const [keyword, at] = parts;
+        if (keyword === "daily") {
+            if (at === undefined)
+                return { kind: "daily", source, minutes: 0 };
+            const minutes = parseTimeOfDay(at);
+            return minutes === null ? null : { kind: "daily", source, minutes };
+        }
+        if (keyword === "weekly") {
+            // Monday, because a week that starts on Sunday surprises most of the people who
+            // write "@weekly" and none of the ones who wanted Monday.
+            if (at === undefined)
+                return { kind: "weekly", source, weekday: 1, minutes: 0 };
+            const minutes = parseTimeOfDay(at);
+            return minutes === null ? null : { kind: "weekly", source, weekday: 1, minutes };
+        }
+        return null;
+    };
+    /** Local midnight of the day containing `at`. */
+    const startOfLocalDay = (at) => {
+        const date = new Date(at);
+        date.setHours(0, 0, 0, 0);
+        return date;
+    };
+    /** `n` days later in *local* time — `setDate` rather than arithmetic, so DST is handled. */
+    const addDays = (date, n) => {
+        const next = new Date(date.getTime());
+        next.setDate(next.getDate() + n);
+        return next;
+    };
+    /**
+     * The first moment this schedule comes due strictly after `from`.
+     *
+     * **The occurrences between the last run and `from` are not returned, and there is no
+     * way to ask for them.** That absence is the design: a device that was closed for a
+     * fortnight has missed fourteen occurrences of a daily job, and replaying them would run
+     * the campaign fourteen times over data that only justifies running it once. A sweep
+     * that reads current state does the right thing in a single pass; fourteen sweeps do the
+     * same thing plus a stampede.
+     *
+     * @param schedule - A parsed schedule.
+     * @param from - The instant to measure from, normally "now".
+     * @returns The next due timestamp, strictly greater than `from`.
+     */
+    const nextOccurrence = (schedule, from) => {
+        switch (schedule.kind) {
+            case "interval":
+                return from + schedule.periodMs;
+            case "hourly": {
+                const hour = new Date(from);
+                hour.setMinutes(0, 0, 0);
+                return hour.getTime() + UNIT_MS.h;
+            }
+            case "daily": {
+                const candidate = startOfLocalDay(from).getTime() + schedule.minutes * UNIT_MS.m;
+                if (candidate > from)
+                    return candidate;
+                return addDays(startOfLocalDay(from), 1).getTime() + schedule.minutes * UNIT_MS.m;
+            }
+            case "weekly": {
+                const today = startOfLocalDay(from);
+                const shift = (schedule.weekday - today.getDay() + 7) % 7;
+                const candidate = addDays(today, shift).getTime() + schedule.minutes * UNIT_MS.m;
+                if (candidate > from)
+                    return candidate;
+                return addDays(today, shift + 7).getTime() + schedule.minutes * UNIT_MS.m;
+            }
+        }
+    };
+    /** The longest a schedule may legitimately wait — the ceiling used to detect a bad clock. */
+    const periodCeilingMs = (schedule) => {
+        switch (schedule.kind) {
+            case "interval":
+                return schedule.periodMs;
+            case "hourly":
+                return UNIT_MS.h;
+            case "daily":
+                return UNIT_MS.d;
+            case "weekly":
+                return UNIT_MS.w;
+        }
+    };
+    /**
+     * Whether a stored `nextRunAt` is too far in the future to have been computed honestly.
+     *
+     * The device clock belongs to the user: it can be wrong, and it can be set back. A run
+     * recorded while the clock read 2031 leaves a `nextRunAt` that would suppress the job for
+     * years once the clock is corrected. Anything further out than two periods did not come
+     * from this schedule, so the scheduler recomputes it from now rather than honouring it.
+     */
+    const isImplausible = (nextRunAt, schedule, now) => nextRunAt - now > periodCeilingMs(schedule) * 2;
+
+    /**
+     * Running jobs unattended, on a client.
+     *
+     * {@link JobEngine} executes a job when something asks it to. This decides *when* to
+     * ask, on a device that a server-side scheduler's assumptions do not describe:
+     *
+     * 1. **The app is closed most of the time.** "Daily at 09:00" is missed on most days.
+     * 2. **Timers are throttled or frozen.** A background tab gets about one tick a minute;
+     *    a suspended app gets none, and `setInterval` does not catch up on wake.
+     * 3. **There are several instances.** Two devices, or two tabs, run this against
+     *    replicas of the same `~Job` documents.
+     * 4. **A run can vanish mid-flight.** A closed tab kills a `RUNNING` job with no
+     *    `catch`, no `finally`, and no process left to notice.
+     * 5. **The clock is the user's.** It can be wrong, and it can move backwards.
+     *
+     * Four rules answer those, and each is load-bearing:
+     *
+     * - **Missed occurrences collapse into one run** ({@link nextOccurrence}). Never a
+     *   backlog.
+     * - **Schedule state is device-local**, in a `_local/` document. `JobModel.nextRunTimestamp`
+     *   looks like the place for it and is not: an application's `~Job` documents replicate —
+     *   `DATA_MODEL_CLASSES` keeps them even under an `include` allow-list — so every device
+     *   would write that field on every run and collide on a document whose `content` field is
+     *   executable code. A losing revision there does not lose a timestamp, it forks what the
+     *   job does.
+     * - **Duplicate work is answered by the jobs, not by a lock.** Leader election needs a
+     *   consensus point that two offline replicas do not have. Jobs that run here must write
+     *   documents whose `_id` is derived from what they are about (`ReviewRequest-<orderId>`),
+     *   so a second device's sweep collides into one document instead of sending a second
+     *   email. The scheduler cannot enforce that; it is the price of running campaign logic
+     *   on clients.
+     * - **Only named jobs run unattended** ({@link SchedulerOptions.jobs}). `~Job.content` is
+     *   JavaScript, it replicates, and {@link Job} hydrates it with `new Function` — which
+     *   runs with full ambient authority, whatever the docs call it. Until now a human was
+     *   always behind an execution. An allow-list keeps that true: a job document arriving
+     *   over sync cannot become code that runs itself.
+     *
+     * @module
+     */
+    const logger$1 = createLogger().child({ module: "job-scheduler" });
+    /** The `_local/` document holding this device's schedule state. Never replicates. */
+    const JOB_SCHEDULE_DOC_ID = "_local/docstack-job-schedule";
+    const DEFAULTS = {
+        intervalMs: 60000,
+        minIntervalMs: 5000,
+        staleRunMs: 15 * 60000,
+        backoffBaseMs: 5 * 60000,
+        maxBackoffMs: 6 * 60 * 60000,
+        /** Most abandoned runs reaped per tick — a sweep is not a migration. */
+        staleRunBatch: 50,
+    };
+    /**
+     * Decides when the jobs an application has approved should run, and dispatches them.
+     *
+     * Mounted at `stack.jobScheduler`, but never started by the stack: what may run
+     * unattended is the application's decision.
+     *
+     * @example
+     * ```typescript
+     * stack.jobScheduler.start({
+     *     jobs: ["Job-review-campaign", "Job-cross-sell"],
+     *     pinnedHashes: { "Job-review-campaign": "9f2c…" },
+     * });
+     *
+     * // Wake sources are the application's, because `core/` imports no DOM:
+     * document.addEventListener("visibilitychange", () => {
+     *     if (document.visibilityState === "visible") void stack.jobScheduler.tick();
+     * });
+     * ```
+     */
+    class JobScheduler {
+        constructor(host) {
+            this.options = null;
+            this.timer = null;
+            /** Jobs this device has dispatched and not yet seen finish. */
+            this.inFlight = new Set();
+            /** Dispatches still running, so {@link drain} can wait for them. */
+            this.pending = new Set();
+            /** Deduplicates concurrent ticks — a wake signal and the interval can land together. */
+            this.ticking = null;
+            /** Serialises read-modify-write of the `_local/` document. */
+            this.stateWrites = Promise.resolve();
+            /** Last state read, for {@link status} — reporting must not require a database round-trip. */
+            this.snapshot = {};
+            this.host = host;
+        }
+        /**
+         * Begins scheduling, and evaluates once immediately.
+         *
+         * The immediate evaluation is the point: a client's most reliable clock signal is
+         * "the app just opened", not a timer that was frozen while it was closed.
+         */
+        start(options) {
+            var _a, _b, _c, _d, _e, _f, _g, _h;
+            if (this.timer)
+                this.stop();
+            this.options = {
+                jobs: [...options.jobs],
+                pinnedHashes: (_a = options.pinnedHashes) !== null && _a !== void 0 ? _a : {},
+                intervalMs: Math.max(DEFAULTS.minIntervalMs, (_b = options.intervalMs) !== null && _b !== void 0 ? _b : DEFAULTS.intervalMs),
+                staleRunMs: (_c = options.staleRunMs) !== null && _c !== void 0 ? _c : DEFAULTS.staleRunMs,
+                backoffBaseMs: (_d = options.backoffBaseMs) !== null && _d !== void 0 ? _d : DEFAULTS.backoffBaseMs,
+                maxBackoffMs: (_e = options.maxBackoffMs) !== null && _e !== void 0 ? _e : DEFAULTS.maxBackoffMs,
+                now: (_f = options.now) !== null && _f !== void 0 ? _f : (() => Date.now()),
+                onRun: options.onRun,
+            };
+            this.timer = setInterval(() => void this.tick(), this.options.intervalMs);
+            // Node keeps the process alive for a pending interval; a scheduler should not be
+            // the reason a CLI or a test runner refuses to exit.
+            (_h = (_g = this.timer) === null || _g === void 0 ? void 0 : _g.unref) === null || _h === void 0 ? void 0 : _h.call(_g);
+            void this.tick();
+        }
+        /**
+         * Stops scheduling. Jobs already dispatched keep running — a hydrated `new Function`
+         * has no cancellation, and pretending otherwise would leave a `RUNNING` run behind.
+         */
+        stop() {
+            if (this.timer)
+                clearInterval(this.timer);
+            this.timer = null;
+            // Dropping the options, not just the timer: an application's wake handlers
+            // outlive teardown more often than not, and `tick()` from one of them after
+            // `stop()` has to be nothing rather than one last dispatch.
+            this.options = null;
+        }
+        /** Whether {@link start} is in effect. */
+        get isRunning() {
+            return this.timer !== null;
+        }
+        /**
+         * Evaluates every allowed job and dispatches those that are due.
+         *
+         * Idempotent and safe to call from any wake signal. Concurrent calls share one
+         * evaluation. It returns once dispatch has *started*: a long job does not hold the
+         * tick open, because a tick that waits is a tick that stops the others.
+         */
+        tick() {
+            if (this.ticking)
+                return this.ticking;
+            const run = this.runTick().finally(() => {
+                this.ticking = null;
+            });
+            this.ticking = run;
+            return run;
+        }
+        /** Resolves when every job this scheduler started has finished. For teardown and tests. */
+        async drain() {
+            while (this.pending.size) {
+                await Promise.all([...this.pending]);
+            }
+        }
+        /** What the scheduler believes, without touching the database. */
+        status() {
+            return {
+                running: this.isRunning,
+                inFlight: [...this.inFlight],
+                jobs: Object.assign({}, this.snapshot),
+            };
+        }
+        // ---------------------------------------------------------------- evaluation
+        async runTick() {
+            const options = this.options;
+            const at = options ? options.now() : Date.now();
+            const report = { at, dispatched: [], skipped: [], sweptRuns: 0 };
+            // A wake signal can arrive after stop(); that is not an error, it is nothing.
+            if (!options)
+                return report;
+            report.sweptRuns = await this.sweepAbandonedRuns(at, options.staleRunMs);
+            const due = [];
+            // The whole read-evaluate-write shares {@link recordOutcome}'s serialisation. A
+            // job finishing mid-evaluation would otherwise bump the `_local` rev between
+            // this read and this write; the write would 409 and be dropped - and with it
+            // the claims it carried, so a job this very tick dispatched would still look
+            // due on the next one and run twice inside its own period.
+            await this.withState(async (doc) => {
+                for (const jobId of options.jobs) {
+                    const job = await this.host.db.get(jobId).catch(() => null);
+                    if (!job) {
+                        report.skipped.push({ jobId, reason: "missing" });
+                        continue;
+                    }
+                    if (!job.isEnabled) {
+                        report.skipped.push({ jobId, reason: "disabled" });
+                        continue;
+                    }
+                    const pinned = options.pinnedHashes[jobId];
+                    if (pinned && pinned !== job.hash) {
+                        // Fail closed. The content behind an unexpected hash is exactly the case
+                        // the allow-list exists for.
+                        logger$1.warn("tick - job hash does not match the pinned value; not running", { jobId });
+                        report.skipped.push({ jobId, reason: "hash-mismatch" });
+                        continue;
+                    }
+                    if (!job.schedule) {
+                        report.skipped.push({ jobId, reason: "no-schedule" });
+                        continue;
+                    }
+                    const schedule = parseSchedule(job.schedule);
+                    if (!schedule) {
+                        logger$1.warn("tick - job carries a schedule this client cannot read", {
+                            jobId,
+                            schedule: job.schedule,
+                        });
+                        report.skipped.push({ jobId, reason: "unparseable-schedule" });
+                        continue;
+                    }
+                    const state = doc.jobs[jobId];
+                    const changedSchedule = state && state.schedule !== schedule.source;
+                    // First sight of a job, or a schedule that has been rewritten: give it a
+                    // starting point rather than running it on the spot. A newly installed daily
+                    // job that fires the instant it is saved would fire again on every device
+                    // that receives it, which is a stampede dressed as a first run.
+                    if (!state || changedSchedule) {
+                        doc.jobs[jobId] = {
+                            nextRunAt: nextOccurrence(schedule, at),
+                            consecutiveFailures: 0,
+                            schedule: schedule.source,
+                        };
+                        report.skipped.push({ jobId, reason: "not-due" });
+                        continue;
+                    }
+                    if (isImplausible(state.nextRunAt, schedule, at)) {
+                        logger$1.warn("tick - stored nextRunAt is further out than the schedule allows; recomputing", {
+                            jobId,
+                            nextRunAt: state.nextRunAt,
+                        });
+                        state.nextRunAt = nextOccurrence(schedule, at);
+                        report.skipped.push({ jobId, reason: "not-due" });
+                        continue;
+                    }
+                    if (state.nextRunAt > at) {
+                        report.skipped.push({ jobId, reason: "not-due" });
+                        continue;
+                    }
+                    // Due, but the previous dispatch has not come back. Leaving `nextRunAt`
+                    // where it is means the job runs as soon as it is free, rather than losing
+                    // the slot to a run that is still doing it.
+                    if (this.inFlight.has(jobId)) {
+                        report.skipped.push({ jobId, reason: "in-flight" });
+                        continue;
+                    }
+                    // Claim before dispatching, not after. A tab closed mid-run then costs the
+                    // job one period, rather than re-running it on every boot from then on —
+                    // and jobs here are required to be idempotent anyway, so a lost run is the
+                    // cheaper of the two failures.
+                    state.nextRunAt = nextOccurrence(schedule, at);
+                    state.lastRunAt = at;
+                    due.push({ jobId, job, nextRunAt: state.nextRunAt });
+                }
+            });
+            for (const entry of due) {
+                this.inFlight.add(entry.jobId);
+                report.dispatched.push(entry.jobId);
+                this.track(this.dispatch(entry.jobId, options));
+            }
+            return report;
+        }
+        /** Runs one job and records what happened. Never throws: a tick outlives its jobs. */
+        async dispatch(jobId, options) {
+            var _a;
+            try {
+                const run = await this.host.jobEngine.executeJob(jobId, undefined, "scheduled");
+                await this.recordOutcome(jobId, run.status, options);
+                (_a = options.onRun) === null || _a === void 0 ? void 0 : _a.call(options, run);
+            }
+            catch (error) {
+                // `executeJob` throws for a disabled job and for a blocked singleton, and
+                // rejects if the content hash no longer matches. All three are outcomes, not
+                // crashes; the backoff is what keeps a permanently broken job from becoming
+                // a write per minute.
+                logger$1.warn("dispatch - scheduled job did not run", { jobId, error: (error === null || error === void 0 ? void 0 : error.message) || String(error) });
+                await this.recordOutcome(jobId, "FAILURE", options);
+            }
+            finally {
+                this.inFlight.delete(jobId);
+            }
+        }
+        async recordOutcome(jobId, status, options) {
+            await this.withState(doc => {
+                const state = doc.jobs[jobId];
+                if (!state)
+                    return;
+                state.lastStatus = status;
+                if (status === "SUCCESS") {
+                    state.consecutiveFailures = 0;
+                    return;
+                }
+                state.consecutiveFailures += 1;
+                const backoff = Math.min(options.backoffBaseMs * 2 ** (state.consecutiveFailures - 1), options.maxBackoffMs);
+                // Backoff replaces the claimed slot only when it pushes the job further out;
+                // a daily job that fails should not come back in five minutes *sooner* than
+                // its own schedule would have.
+                state.nextRunAt = Math.max(state.nextRunAt, options.now() + backoff);
+            });
+        }
+        // ------------------------------------------------------------------- sweeping
+        /**
+         * Moves this device's abandoned runs to `CANCELED`.
+         *
+         * A `~JobRun` only changes status inside `Job.execute`'s `try`/`catch`, so a tab
+         * closed mid-run leaves one `RUNNING` for ever — and `hasRunningInstance` then skips
+         * that singleton job on this device permanently. Unattended execution turns that from
+         * a latent oddity into a job that silently stops working, so the sweep runs before
+         * every dispatch. `~JobRun` never replicates, so these are unambiguously *this*
+         * device's abandoned runs.
+         */
+        async sweepAbandonedRuns(at, staleRunMs) {
+            var _a;
+            try {
+                const found = await this.host.db.find({
+                    selector: { "~class": "~JobRun", status: "RUNNING" },
+                    limit: DEFAULTS.staleRunBatch,
+                });
+                const stale = ((_a = found === null || found === void 0 ? void 0 : found.docs) !== null && _a !== void 0 ? _a : []).filter((run) => typeof run.startTime === "number" && at - run.startTime > staleRunMs);
+                if (!stale.length)
+                    return 0;
+                await this.host.db.bulkDocs(stale.map((run) => (Object.assign(Object.assign({}, run), { status: "CANCELED", endTime: at, durationMs: at - run.startTime, errorMessage: "Run abandoned — the client stopped before it finished." }))));
+                logger$1.info("sweepAbandonedRuns - reaped abandoned runs", { count: stale.length });
+                return stale.length;
+            }
+            catch (error) {
+                logger$1.warn("sweepAbandonedRuns - could not sweep", { error: (error === null || error === void 0 ? void 0 : error.message) || String(error) });
+                return 0;
+            }
+        }
+        // ---------------------------------------------------------------------- state
+        async readState() {
+            var _a;
+            try {
+                const doc = await this.host.db.get(JOB_SCHEDULE_DOC_ID);
+                const jobs = ((_a = doc === null || doc === void 0 ? void 0 : doc.jobs) !== null && _a !== void 0 ? _a : {});
+                this.snapshot = jobs;
+                return { _id: JOB_SCHEDULE_DOC_ID, _rev: doc === null || doc === void 0 ? void 0 : doc._rev, jobs };
+            }
+            catch (_b) {
+                return { _id: JOB_SCHEDULE_DOC_ID, jobs: {} };
+            }
+        }
+        async writeState(doc) {
+            this.snapshot = doc.jobs;
+            try {
+                await this.host.db.put(doc);
+            }
+            catch (error) {
+                // A 409 means another tick wrote first; its state is as good as this one's,
+                // and the next tick reads the winner.
+                logger$1.warn("writeState - could not persist schedule state", {
+                    error: (error === null || error === void 0 ? void 0 : error.message) || String(error),
+                });
+            }
+        }
+        /**
+         * Read-modify-write against the `_local/` document, serialised.
+         *
+         * Everything that touches the state document goes through here - tick evaluation
+         * and outcome recording alike - so within this instance no write can land between
+         * another's read and write. Two *instances* (two tabs) still contend; there the 409
+         * in {@link writeState} stands, logged, and the jobs' own idempotency is the answer,
+         * as the module docblock requires of them.
+         */
+        withState(change) {
+            const next = this.stateWrites.then(async () => {
+                const doc = await this.readState();
+                await change(doc);
+                await this.writeState(doc);
+            });
+            this.stateWrites = next.catch(() => undefined);
+            return next;
+        }
+        track(work) {
+            this.pending.add(work);
+            void work.finally(() => this.pending.delete(work));
+        }
+    }
+
     /**
      * Set of system classes that bypass policy evaluation.
      * These classes are internal to DocStack and always accessible.
@@ -7877,9 +8603,12 @@ async function execute(_stack, params) {
                 // Read raw rather than through `findDocuments`: policies are a system class
                 // that bypasses policy evaluation anyway, and going through the read path
                 // here recursed into a policy check per policy document. The selector is the
-                // same one `findDocuments` produced (it injects `active: true`); the explicit
-                // limit is because pouchdb-find otherwise silently caps results at 25, which
-                // for policies means silently not enforcing the 26th.
+                // same one `findDocuments` produced (it injects `active: true`), and that is
+                // the contract, not an accident: a policy enforces only while `active: true`,
+                // exactly as a document is visible only while active - an unflagged or
+                // explicitly inactive policy does not apply (ADR-0032). The explicit limit is
+                // because pouchdb-find otherwise silently caps results at 25, which for
+                // policies means silently not enforcing the 26th.
                 const result = await this.stack.db.find({
                     selector: { "~class": "~Policy", active: true },
                     limit: 2 ** 31 - 1,
@@ -9740,7 +10469,11 @@ async function execute(_stack, params) {
              * Removes event listeners and terminates background workers.
              */
             this.close = () => {
+                var _a;
                 this.cancelSync();
+                // Before the listeners go: a surviving interval would tick against a database
+                // this stack no longer serves.
+                (_a = this.jobScheduler) === null || _a === void 0 ? void 0 : _a.stop();
                 this.removeAllListeners();
                 if (this.modelWorker)
                     this.modelWorker.terminate();
@@ -10044,9 +10777,10 @@ async function execute(_stack, params) {
                         { description: { $regex: RegExp(search, "i") } }
                     ];
                 }
-                // `ephemeral` is projected too: without it the models come back with the flag
-                // stripped, and every class looks durable. See ADR-0028.
-                const fields = ['_id', 'name', 'description', 'schema', '~class', '_rev', 'ephemeral', 'simple'];
+                // `ephemeral`, `simple` and `tenants` are projected too: a fixed field list
+                // silently strips any model flag it does not name, so every class would read
+                // as durable, schema-full and tenant-neutral. See ADR-0028, ADR-0030.
+                const fields = ['_id', 'name', 'description', 'schema', '~class', '_rev', 'ephemeral', 'simple', 'tenants'];
                 const response = await this.findDocuments(selector, fields);
                 const result = response.docs;
                 if (!conf.listen) {
@@ -10132,9 +10866,10 @@ async function execute(_stack, params) {
                         { description: { $regex: RegExp(search, "i") } }
                     ];
                 }
-                // `ephemeral` is projected too: without it the models come back with the flag
-                // stripped, and every class looks durable. See ADR-0028.
-                const fields = ['_id', 'name', 'description', 'schema', '~class', '_rev', 'ephemeral', 'simple'];
+                // `ephemeral`, `simple` and `tenants` are projected too: a fixed field list
+                // silently strips any model flag it does not name, so every class would read
+                // as durable, schema-full and tenant-neutral. See ADR-0028, ADR-0030.
+                const fields = ['_id', 'name', 'description', 'schema', '~class', '_rev', 'ephemeral', 'simple', 'tenants'];
                 const response = await this.findDocuments(selector, fields);
                 const result = response.docs;
                 if (!conf.listen) {
@@ -10843,7 +11578,7 @@ async function execute(_stack, params) {
             // `undefined` and capturing from there silently yields nothing. Replication needs
             // them too - it writes documents verbatim and reads them exactly as stored.
             // Unbound on purpose: StackPlugin forwards with `.call(this, ...)`.
-            this.pristineDbMethods = { bulkDocs: rawDb.bulkDocs, bulkGet: rawDb.bulkGet };
+            this.pristineDbMethods = { bulkDocs: rawDb.bulkDocs, bulkGet: rawDb.bulkGet, get: rawDb.get };
             // Built from the pristine methods rather than looking them up: the plugin can no
             // longer be constructed at a moment when its capture would be wrong, because the
             // capture is an argument. See ADR-0019.
@@ -10851,6 +11586,7 @@ async function execute(_stack, params) {
             rawDb.ping = stackPlugin.ping;
             rawDb.bulkDocs = stackPlugin.bulkDocs;
             rawDb.bulkGet = stackPlugin.bulkGet;
+            rawDb.get = stackPlugin.get;
             this.rawDb = rawDb;
             this.replicationDb = undefined;
             // What consumers get is guarded: the two ways around the authoring path -
@@ -10866,6 +11602,7 @@ async function execute(_stack, params) {
             // empty at init
             };
             this.jobEngine = new JobEngine(this);
+            this.jobScheduler = new JobScheduler(this);
             this.policyEngine = new PolicyEngine(this);
             this.cryptoEngine = new CryptoEngine(this);
             if (options === null || options === void 0 ? void 0 : options.documentKey) {
@@ -12208,6 +12945,13 @@ async function execute(_stack, params) {
              * on the same database. See ADR-0022.
              */
             this.pendingStacks = new Map();
+            /**
+             * What the last un-scoped {@link sync} call asked for, kept so a stack added
+             * later can be bound to the same replication. `null` when sync was never
+             * called, was called with an explicit `stacks` list (a caller who named three
+             * databases asked for three), or was cancelled. See ADR-0033.
+             */
+            this.syncOptions = null;
             this.logger = createLogger().child({ module: "client" });
             /**
              * Opens a stack and adds it to this instance.
@@ -12251,10 +12995,19 @@ async function execute(_stack, params) {
                 }
                 // Registered before the first `await`, which is what makes the guard atomic:
                 // nothing else runs between the miss above and this line.
-                const creation = ClientStack.create(connection, options).then(stack => {
+                const creation = ClientStack.create(connection, options).then(async (stack) => {
                     this.stacks.push(stack);
                     if (!this.store)
                         this.store = stack;
+                    // Bound to any live un-scoped sync BEFORE the stack is announced, so that
+                    // when addStack resolves - or a 'stack-added' listener runs - the stack is
+                    // already replicating. Without this, a database mounted after sync() sat
+                    // outside replication for the lifetime of the handle, with every status
+                    // surface reporting healthy: the handle simply had no entry for it, and a
+                    // missing key reads as "nothing to say" rather than "not covered". A
+                    // workspace registry that lives in one database and names the others makes
+                    // that ordering a boot-time coin toss, not an exotic case. See ADR-0033.
+                    await this.bindStackToSync(stack);
                     this.dispatchEvent(new CustomEvent("stack-added", { detail: { stack } }));
                     return stack;
                 });
@@ -12281,6 +13034,7 @@ async function execute(_stack, params) {
              * @returns `true` if a stack was removed, `false` if there was none by that name.
              */
             this.removeStack = async (name, options) => {
+                var _a;
                 const stack = this.getStack(name);
                 if (!stack)
                     return false;
@@ -12288,6 +13042,9 @@ async function execute(_stack, params) {
                 this.stacks = this.stacks.filter(s => s !== stack);
                 if (this.store === stack)
                     this.store = this.stacks[0];
+                // A removed stack must also leave the sync handle, or getStatus() keeps
+                // reporting a database this instance no longer holds.
+                (_a = this.syncHandle) === null || _a === void 0 ? void 0 : _a.remove(stack.name);
                 if (options === null || options === void 0 ? void 0 : options.destroy) {
                     await stack.destroyDb();
                 }
@@ -12313,8 +13070,8 @@ async function execute(_stack, params) {
              * ```
              */
             this.sync = async (options) => {
-                const { stacks: names } = options, stackOptions = __rest(options, ["stacks"]);
-                const targets = names
+                const { stacks: names, tenants } = options, stackOptions = __rest(options, ["stacks", "tenants"]);
+                let targets = names
                     ? names.map(name => {
                         const stack = this.getStack(name);
                         if (!stack)
@@ -12322,13 +13079,85 @@ async function execute(_stack, params) {
                         return stack;
                     })
                     : this.stacks;
+                // A tenant entitlement compiles into per-stack configuration: stacks outside
+                // the scope are not synced at all - withheld structurally, which is a stronger
+                // grant than any filter - and stacks holding a mix of declarations get class
+                // rules. See ADR-0030 and sync/tenants.ts.
+                let scopedClasses = {};
+                if (tenants) {
+                    if (stackOptions.classes) {
+                        throw new Error("`tenants` and `classes` cannot be combined: the tenant scope compiles its own " +
+                            "class rules per stack. Narrow further with `filter`, or scope by hand without `tenants`.");
+                    }
+                    const scope = await deriveTenantScope(targets, tenants);
+                    const served = new Set(scope.stacks);
+                    targets = targets.filter(stack => served.has(stack.name));
+                    scopedClasses = scope.classes;
+                }
                 const handle = new DocStackSyncHandle();
+                // Registered before the loop, and the options with it: a stack added while
+                // this loop awaits is bound by addStack through bindStackToSync, and the
+                // has() guards on both paths keep the two from double-binding it.
+                this.syncHandle = handle;
+                this.syncOptions = names ? null : options;
                 for (const stack of targets) {
-                    handle.add(stack.name, await stack.sync(stackOptions));
+                    if (handle.handles.has(stack.name))
+                        continue;
+                    const classes = scopedClasses[stack.name];
+                    handle.add(stack.name, await stack.sync(classes ? Object.assign(Object.assign({}, stackOptions), { classes }) : stackOptions));
                 }
-                this.syncHandle = handle;
                 return handle;
             };
+            /**
+             * Binds one stack to the live sync, if there is one and it was un-scoped.
+             *
+             * Failure here must not fail {@link addStack} - the stack itself opened fine -
+             * but it must not be silent either, silence being this defect's whole shape:
+             * it is logged and dispatched as an `error` event on the sync handle.
+             */
+            this.bindStackToSync = async (stack) => {
+                const handle = this.syncHandle;
+                const options = this.syncOptions;
+                if (!handle || !options)
+                    return;
+                if (handle.handles.has(stack.name))
+                    return;
+                const { stacks: _names, tenants } = options, stackOptions = __rest(options, ["stacks", "tenants"]);
+                try {
+                    let classes;
+                    if (tenants) {
+                        // The same entitlement the original call compiled, derived for this
+                        // stack alone: outside the scope means not synced at all - withheld
+                        // structurally, exactly as it would have been at sync() time.
+                        const scope = await deriveTenantScope([stack], tenants);
+                        if (!scope.stacks.includes(stack.name))
+                            return;
+                        classes = scope.classes[stack.name];
+                    }
+                    if (handle.handles.has(stack.name))
+                        return; // bound while deriving
+                    handle.add(stack.name, await stack.sync(classes ? Object.assign(Object.assign({}, stackOptions), { classes }) : stackOptions));
+                }
+                catch (error) {
+                    this.logger.child({ method: "bindStackToSync" }).error("Stack opened but could not join replication", { stack: stack.name, error });
+                    handle.dispatchEvent(new CustomEvent("error", { detail: { stack: stack.name, error } }));
+                }
+            };
+            /**
+             * Which open stacks the current sync covers, and which it does not.
+             *
+             * An idle stack and an unbound one are opposite problems, and `getStatus()`
+             * cannot tell them apart - the unbound one has no key at all. With no sync
+             * running, every open stack is unbound.
+             */
+            this.getSyncCoverage = () => {
+                const bound = this.syncHandle ? [...this.syncHandle.handles.keys()] : [];
+                const boundSet = new Set(bound);
+                return {
+                    bound,
+                    unbound: this.stacks.map(s => s.name).filter(name => !boundSet.has(name)),
+                };
+            };
             /**
              * Returns the handle from the last {@link sync} call, or `null`.
              */
@@ -12341,6 +13170,9 @@ async function execute(_stack, params) {
             this.cancelSync = () => {
                 if (this.syncHandle)
                     this.syncHandle.cancel();
+                // A stack added after this point must not start replicating into a handle
+                // whose other members were just stopped.
+                this.syncOptions = null;
             };
             this.initStacks = async (configs) => {
                 // TODO: Consider changing to Promise.all for concurrency
@@ -12694,6 +13526,9 @@ async function execute(_stack, params) {
     exports.INTERNAL_DOC_CLASSES = INTERNAL_DOC_CLASSES;
     exports.INTERNAL_DOC_IDS = INTERNAL_DOC_IDS;
     exports.INTERNAL_DOC_ID_PREFIXES = INTERNAL_DOC_ID_PREFIXES;
+    exports.JOB_SCHEDULE_DOC_ID = JOB_SCHEDULE_DOC_ID;
+    exports.JobEngine = JobEngine;
+    exports.JobScheduler = JobScheduler;
     exports.META_CLASSES = META_CLASSES;
     exports.OPTIONAL_INTERNAL_DOC_CLASSES = OPTIONAL_INTERNAL_DOC_CLASSES;
     exports.SYNC_META_DOC_ID = SYNC_META_DOC_ID;
@@ -12703,11 +13538,13 @@ async function execute(_stack, params) {
     exports.StackWriteGuardError = StackWriteGuardError;
     exports.SyncSchemaMismatchError = SyncSchemaMismatchError;
     exports.Trigger = Trigger;
+    exports.classTenants = classTenants;
     exports.collectQueryClasses = collectQueryClasses;
     exports.createClassFilter = createClassFilter;
     exports.createReplicationFilter = createReplicationFilter;
     exports.default = DocStack;
     exports.deriveKeyId = deriveKeyId;
+    exports.deriveTenantScope = deriveTenantScope;
     exports.describeFilter = describeFilter;
     exports.hasClassRules = hasClassRules;
     exports.isContentClassName = isContentClassName;
@@ -12715,6 +13552,8 @@ async function execute(_stack, params) {
     exports.isContentRelation = isContentRelation;
     exports.isEncryptedPayload = isEncryptedPayload;
     exports.isInternalDoc = isInternalDoc;
+    exports.nextOccurrence = nextOccurrence;
+    exports.parseSchedule = parseSchedule;
     exports.publishSchemaVersion = publishSchemaVersion;
     exports.readRemoteSchemaVersion = readRemoteSchemaVersion;
     exports.resolveInternalClasses = resolveInternalClasses;