@kne/fastify-app-manager 0.1.8 → 0.1.10

package/libs/services/app.js

@@ -3,10 +3,12 @@ const path = require('node:path');
 const crypto = require('node:crypto');
 const fs = require('fs-extra');
 const portPool = require('../utils/portPool');
-const { mergeEnv, maskEnvForResponse, applyEnvPatch, mergePm2Config, normalizeSecretKeys, collectSecretKeys } = require('../utils/env');
+const { mergeEnv, maskEnvForResponse, applyEnvPatch, mergePm2Config, normalizeSecretKeys, collectSecretKeys, isSystemEnvKey, omitSystemEnv } = require('../utils/env');
 const { prepareVersionArtifact } = require('../utils/version');
 const { injectEntryHtml } = require('../utils/entryInject');
-const { ensureLogFiles, readLogTail, readLastLines, appendLog } = require('../utils/logFiles');
+const { ensureLogFiles, readLogTail, readLastLines, appendLog, countLines } = require('../utils/logFiles');
+const { currentFileName, isCurrentFileName, resolveLogFile, listLogFiles } = require('../utils/logRotate');
+const { toIsoInTz, convertLogText } = require('../utils/logTime');
 const { runSqlMigrations, MIGRATION_ACTIONS } = require('../utils/migrate');
 const { listSqlFiles } = require('../utils/validatePackage');
 const pm2Util = require('../utils/pm2');
@@ -43,6 +45,27 @@ module.exports = fp(async (fastify, options) => {
     }
     return category.code ? { code: category.code, name: category.name || category.code } : null;
   };
+  // 应用入口：label + 相对应用根的 path；去空、补前导 /、按 path 去重
+  const normalizeEntries = entries => {
+    const seen = new Set();
+    return (Array.isArray(entries) ? entries : []).reduce((result, item) => {
+      const label = String(item?.label || '').trim();
+      const rawPath = String(item?.path || '').trim();
+      if (!label || !rawPath) {
+        return result;
+      }
+      const entryPath = rawPath.startsWith('/') ? rawPath : `/${rawPath}`;
+      if (!seen.has(entryPath)) {
+        seen.add(entryPath);
+        result.push({ label, path: entryPath });
+      }
+      return result;
+    }, []);
+  };
+  const resolveEntries = appLike => {
+    const base = mountPrefix(appLike.name);
+    return normalizeEntries(appLike.options?.entries).map(entry => Object.assign({}, entry, { url: `${base}${entry.path}` }));
+  };
 
   const toPublicApp = app => {
     if (!app) {
@@ -57,6 +80,7 @@ module.exports = fp(async (fastify, options) => {
     json.pathUrl = `${mountPrefix(json.name)}/`;
     json.category = json.options?.category || null;
     json.isPublic = isAppPublic(json);
+    json.entries = resolveEntries(json);
     return json;
   };
 
@@ -69,7 +93,7 @@ module.exports = fp(async (fastify, options) => {
   };
 
   const create = async data => {
-    const { name, label, domain, icon, description, category, isPublic, env, pm2Config, options: appOptions } = data;
+    const { name, label, domain, icon, description, category, isPublic, entries, env, pm2Config, options: appOptions } = data;
     if (!name || !NAME_RE.test(name)) {
       httpError(400, 'invalid name: use lowercase slug [a-z0-9-]');
     }
@@ -109,6 +133,9 @@ module.exports = fp(async (fastify, options) => {
     if (isPublic !== undefined) {
       normalizedOptions.isPublic = !!isPublic;
     }
+    if (entries !== undefined) {
+      normalizedOptions.entries = normalizeEntries(entries);
+    }
 
     const app = await models.app.create({
       name,
@@ -116,7 +143,7 @@ module.exports = fp(async (fastify, options) => {
       domain: domain || null,
       icon: icon || null,
       description: description || null,
-      env: env || {},
+      env: omitSystemEnv(env, options.systemEnvKeys),
       pm2Config: pm2Config || {},
       options: normalizedOptions,
       port,
@@ -128,7 +155,7 @@ module.exports = fp(async (fastify, options) => {
     return toPublicApp(app);
   };
 
-  const save = async ({ name, category, isPublic, ...data }) => {
+  const save = async ({ name, category, isPublic, entries, ...data }) => {
     const app = await getByName(name);
     const omit = ['name', 'port', 'rootPath', 'pm2Name', 'status', 'currentVersionId'];
     const patch = {};
@@ -150,7 +177,7 @@ module.exports = fp(async (fastify, options) => {
     }
     if (patch.options && patch.options.secretEnvKeys !== undefined) {
       patch.options = Object.assign({}, patch.options, {
-        secretEnvKeys: normalizeSecretKeys(patch.options.secretEnvKeys)
+        secretEnvKeys: normalizeSecretKeys([...resolveSecretEnvKeys(app), ...patch.options.secretEnvKeys])
       });
     }
     if (category !== undefined) {
@@ -159,16 +186,19 @@ module.exports = fp(async (fastify, options) => {
     if (isPublic !== undefined) {
       patch.options = Object.assign({}, patch.options || app.options || {}, { isPublic: !!isPublic });
     }
+    if (entries !== undefined) {
+      patch.options = Object.assign({}, patch.options || app.options || {}, { entries: normalizeEntries(entries) });
+    }
     await app.update(patch);
     return toPublicApp(app);
   };
 
   const saveEnv = async ({ name, env, secretEnvKeys: nextSecretKeys } = {}) => {
     const app = await getByName(name);
-    const currentSecrets = resolveSecretEnvKeys(app);
-    const secretEnvKeys = nextSecretKeys !== undefined ? normalizeSecretKeys(nextSecretKeys) : currentSecrets;
+    // 密钥类型不可撤销，只随变量删除而移除
+    const secretEnvKeys = normalizeSecretKeys([...resolveSecretEnvKeys(app), ...(nextSecretKeys || [])]);
     const nextEnv = applyEnvPatch(app.env || {}, env || {}, Object.assign({}, options, { secretEnvKeys }));
-    const cleanedSecrets = secretEnvKeys.filter(key => Object.prototype.hasOwnProperty.call(nextEnv, key));
+    const cleanedSecrets = secretEnvKeys.filter(key => !isSystemEnvKey(key, options.systemEnvKeys) && Object.prototype.hasOwnProperty.call(nextEnv, key));
     await app.update({
       env: nextEnv,
       options: Object.assign({}, app.options || {}, { secretEnvKeys: cleanedSecrets })
@@ -209,7 +239,8 @@ module.exports = fp(async (fastify, options) => {
         description: app.description,
         category: app.options?.category || null,
         isPublic: isAppPublic(app),
-        pathUrl: `${mountPrefix(app.name)}/`
+        pathUrl: `${mountPrefix(app.name)}/`,
+        entries: resolveEntries(app)
       }));
     return { pageData, totalCount: pageData.length };
   };
@@ -478,6 +509,26 @@ module.exports = fp(async (fastify, options) => {
       await app.reload();
     }
 
+    if (typeof options.resolveSystemEnv === 'function') {
+      const systemEnv = await options.resolveSystemEnv({ app, version, serverDir });
+      if (systemEnv && typeof systemEnv === 'object') {
+        const persisted = {};
+        for (const [key, value] of Object.entries(systemEnv)) {
+          if (value == null) {
+            continue;
+          }
+          env[key] = String(value);
+          if ((options.systemEnvKeys || []).includes(key) && app.env?.[key] !== env[key]) {
+            persisted[key] = env[key];
+          }
+        }
+        if (Object.keys(persisted).length) {
+          await app.update({ env: Object.assign({}, app.env || {}, persisted) });
+          await app.reload();
+        }
+      }
+    }
+
     const pathBase = mountPrefix(app.name);
     // Domain-first: inject `/` so custom Host SPA works; path mode then relies on gateway rewrite fallback.
     // Path-only: inject `/app/{name}` so runtime* matches strip-prefix gateway.
@@ -661,9 +712,17 @@ module.exports = fp(async (fastify, options) => {
       }
     }
 
+    const snapshot = app.toJSON();
     await models.appVersion.destroy({ where: { appName: name } });
     await fs.remove(app.rootPath).catch(() => {});
     await app.destroy();
+    if (typeof options.onAppRemoved === 'function') {
+      try {
+        await options.onAppRemoved({ app: snapshot });
+      } catch (e) {
+        fastify.log.warn({ err: e, appName: name }, 'onAppRemoved hook failed');
+      }
+    }
     return {
       removed: true,
       export: exportResult,
@@ -671,10 +730,103 @@ module.exports = fp(async (fastify, options) => {
     };
   };
 
-  const logs = async ({ name, stream = 'out', perPage = 100, currentPage = 1, beforeLine } = {}) => {
+  const logsDirOf = app => path.join(app.rootPath, 'logs');
+  const currentLogFile = (app, stream) => path.join(logsDirOf(app), currentFileName(stream));
+
+  const resolveExistingLogFile = async (app, fileName) => {
+    let filePath;
+    try {
+      filePath = resolveLogFile(logsDirOf(app), fileName);
+    } catch (e) {
+      httpError(400, e.message);
+    }
+    if (!(await fs.pathExists(filePath))) {
+      httpError(404, `log file ${fileName} not found`);
+    }
+    return filePath;
+  };
+
+  const logs = async ({ name, stream = 'out', file, perPage = 100, currentPage = 1, beforeLine } = {}) => {
+    const app = await getByName(name);
+    const filePath = file ? await resolveExistingLogFile(app, file) : currentLogFile(app, stream);
+    return readLogTail(filePath, { perPage, currentPage, beforeLine, timezone: options.logTimezone });
+  };
+
+  const logFiles = async ({ name }) => {
     const app = await getByName(name);
-    const file = path.join(app.rootPath, 'logs', stream === 'err' ? 'err.log' : 'out.log');
-    return readLogTail(file, { perPage, currentPage, beforeLine });
+    const pageData = (await listLogFiles(logsDirOf(app))).map(item => Object.assign({}, item, { mtime: toIsoInTz(item.mtime, options.logTimezone) }));
+    return { pageData, totalCount: pageData.length };
+  };
+
+  const resolveAppLogFile = async ({ name, file }) => {
+    const app = await getByName(name);
+    const filePath = await resolveExistingLogFile(app, file);
+    const { size } = await fs.stat(filePath);
+    return { path: filePath, fileName: file, size, compressed: file.endsWith('.gz') };
+  };
+
+  const resolveAppLogFiles = async ({ name, files = [] }) => {
+    const app = await getByName(name);
+    const items = [];
+    for (const fileName of Array.from(new Set(files))) {
+      const filePath = await resolveExistingLogFile(app, fileName);
+      const { size, mtime } = await fs.stat(filePath);
+      items.push({ path: filePath, fileName, size, mtime, compressed: fileName.endsWith('.gz') });
+    }
+    return { name: app.name, files: items };
+  };
+
+  const removeLogFiles = async ({ name, files = [] }) => {
+    const app = await getByName(name);
+    const targets = [];
+    for (const fileName of files) {
+      if (isCurrentFileName(fileName)) {
+        httpError(400, `cannot remove current log file ${fileName}`);
+      }
+      try {
+        targets.push({ fileName, filePath: resolveLogFile(logsDirOf(app), fileName) });
+      } catch (e) {
+        httpError(400, e.message);
+      }
+    }
+    const removed = [];
+    for (const { fileName, filePath } of targets) {
+      if (await fs.pathExists(filePath)) {
+        await fs.remove(filePath);
+        removed.push(fileName);
+      }
+    }
+    return { removed };
+  };
+
+  const getLoadStore = () => fastify[options.name].loadStore;
+
+  const load = async ({ name }) => {
+    const app = await getByName(name);
+    const store = getLoadStore();
+    return {
+      intervalMs: options.loadSampleIntervalMs > 0 ? options.loadSampleIntervalMs : 0,
+      current: store ? store.latest(app.name) : null,
+      pageData: store ? store.history(app.name) : []
+    };
+  };
+
+  const emitAppLog = async (appName, stream, content) => {
+    const hub = getLogHub();
+    if (!hub) {
+      return;
+    }
+    const app = await models.app.findOne({ where: { name: appName } });
+    if (!app) {
+      return;
+    }
+    hub.emit(`log:${appName}`, {
+      appName,
+      stream,
+      content: convertLogText(content, options.logTimezone),
+      line: await countLines(currentLogFile(app, stream)),
+      loggedAt: toIsoInTz(new Date(), options.logTimezone)
+    });
   };
 
   const findByHost = async (host, { running = true } = {}) => {
@@ -707,34 +859,29 @@ module.exports = fp(async (fastify, options) => {
       syncAllStatuses,
       remove,
       logs,
+      logFiles,
+      resolveAppLogFile,
+      resolveAppLogFiles,
+      removeLogFiles,
+      load,
+      getLoadStore,
       toPublicApp,
       mountPrefix,
       findByHost,
       findByPathName,
       readLastLines: async (name, stream, n) => {
         const app = await getByName(name);
-        const file = path.join(app.rootPath, 'logs', stream === 'err' ? 'err.log' : 'out.log');
-        return readLastLines(file, n);
+        return readLastLines(currentLogFile(app, stream), n, { timezone: options.logTimezone });
       },
       getLogHub,
+      emitAppLog,
       appendAppLog: async (appName, stream, content) => {
         const app = await models.app.findOne({ where: { name: appName } });
         if (!app) {
           return;
         }
-        const file = path.join(app.rootPath, 'logs', stream === 'err' ? 'err.log' : 'out.log');
-        await appendLog(file, content);
-        const hub = getLogHub();
-        if (hub) {
-          const { totalCount } = await readLogTail(file, { perPage: 1, currentPage: 1 });
-          hub.emit(`log:${appName}`, {
-            appName,
-            stream,
-            content,
-            line: totalCount,
-            loggedAt: new Date().toISOString()
-          });
-        }
+        await appendLog(currentLogFile(app, stream), content);
+        await emitAppLog(appName, stream, content);
       }
     }
   });

package/libs/services/bootstrap.js

@@ -1,14 +1,34 @@
 const fp = require('fastify-plugin');
+const path = require('node:path');
+const fs = require('fs-extra');
 const { EventEmitter } = require('node:events');
 const pm2Util = require('../utils/pm2');
+const { LOG_STREAMS, rotateIfNeeded, compressArchive, applyRetention } = require('../utils/logRotate');
+const { summarizeProcesses, createLoadStore } = require('../utils/loadMonitor');
+const { createRequestMetrics } = require('../utils/requestMetrics');
+const { toIsoInTz } = require('../utils/logTime');
+
+const OFFLINE_LOAD = { status: 'offline', cpu: 0, memory: 0, instances: 0, pids: [], uptime: 0, restarts: 0 };
 
 module.exports = fp(async (fastify, options) => {
   const logHub = new EventEmitter();
   logHub.setMaxListeners(0);
   fastify[options.name].logHub = logHub;
 
+  const loadStore = createLoadStore({
+    size: options.loadSampleIntervalMs > 0 ? Math.ceil((options.loadHistoryMinutes * 60 * 1000) / options.loadSampleIntervalMs) : 1
+  });
+  fastify[options.name].loadStore = loadStore;
+
+  const requestMetrics = createRequestMetrics({ intervalMs: options.loadSampleIntervalMs });
+  fastify[options.name].requestMetrics = requestMetrics;
+
   let bus = null;
   let connected = false;
+  let rotateTimer = null;
+  let rotating = null;
+  let loadTimer = null;
+  let sampling = null;
 
   const mapPm2NameToApp = async pm2Name => {
     const { models } = fastify[options.name];
@@ -41,7 +61,8 @@ module.exports = fp(async (fastify, options) => {
           if (!content) {
             return;
           }
-          await fastify[options.name].services.app.appendAppLog(app.name, stream, content);
+          // PM2 already writes out_file/error_file; the bus only feeds SSE subscribers.
+          await fastify[options.name].services.app.emitAppLog(app.name, stream, content);
         } catch (e) {
           fastify.log.debug({ err: e }, 'log bus handler error');
         }
@@ -52,16 +73,33 @@ module.exports = fp(async (fastify, options) => {
       fastify.log.warn({ err: e }, 'pm2 launchBus failed');
     }
 
+    if (options.logRotateIntervalMs > 0) {
+      rotateTimer = setInterval(() => {
+        rotateLogs().catch(err => fastify.log.warn({ err }, 'log rotation failed'));
+      }, options.logRotateIntervalMs);
+      rotateTimer.unref?.();
+    }
+
+    if (options.loadSampleIntervalMs > 0) {
+      loadTimer = setInterval(() => {
+        sampleLoad().catch(err => fastify.log.debug({ err }, 'load sampling failed'));
+      }, options.loadSampleIntervalMs);
+      loadTimer.unref?.();
+    }
+
     // 父应用重启后不阻塞 ready：后台按 PM2 真实状态异步对齐 DB
     setImmediate(() => {
       reconcile().catch(err => {
         fastify.log.warn({ err }, 'async reconcile/sync statuses failed');
       });
+      rotateLogs().catch(err => fastify.log.warn({ err }, 'log rotation failed'));
+      if (options.loadSampleIntervalMs > 0) {
+        sampleLoad().catch(err => fastify.log.debug({ err }, 'load sampling failed'));
+      }
     });
   };
 
   const fsEnsureAppsRoot = async () => {
-    const fs = require('fs-extra');
     await fs.ensureDir(options.appsRoot);
   };
 
@@ -73,7 +111,126 @@ module.exports = fp(async (fastify, options) => {
     return [];
   };
 
+  const runRotation = async ({ now = new Date() } = {}) => {
+    const { models } = fastify[options.name];
+    const apps = await models.app.findAll({ attributes: ['name', 'rootPath'] });
+    const targets = [];
+    for (const app of apps) {
+      const logsDir = path.join(app.rootPath, 'logs');
+      if (await fs.pathExists(logsDir)) {
+        targets.push({ name: app.name, logsDir });
+      }
+    }
+
+    const rotated = [];
+    for (const { name, logsDir } of targets) {
+      for (const stream of LOG_STREAMS) {
+        try {
+          const result = await rotateIfNeeded({
+            logsDir,
+            stream,
+            maxSize: options.logMaxSize,
+            daily: options.logRotateDaily,
+            timezone: options.logTimezone,
+            now
+          });
+          if (result) {
+            rotated.push(Object.assign({ name, stream }, result));
+          }
+        } catch (e) {
+          fastify.log.warn({ err: e, app: name, stream }, 'rotate log file failed');
+        }
+      }
+    }
+
+    // Until PM2 reopens its handles it keeps writing into the renamed file, so compress only afterwards.
+    if (rotated.length && connected) {
+      try {
+        await pm2Util.reloadLogs();
+      } catch (e) {
+        fastify.log.warn({ err: e }, 'pm2 reloadLogs failed');
+      }
+    }
+
+    if (options.logCompress) {
+      for (const item of rotated) {
+        try {
+          item.archive = await compressArchive(item.archive);
+        } catch (e) {
+          fastify.log.warn({ err: e, app: item.name, archive: item.archive }, 'compress log archive failed');
+        }
+      }
+    }
+
+    for (const { name, logsDir } of targets) {
+      for (const stream of LOG_STREAMS) {
+        try {
+          await applyRetention({ logsDir, stream, maxFiles: options.logRetentionMaxFiles, maxDays: options.logRetentionDays, now });
+        } catch (e) {
+          fastify.log.warn({ err: e, app: name, stream }, 'log retention failed');
+        }
+      }
+    }
+
+    return rotated.map(({ name, stream, archive, reason }) => ({ name, stream, fileName: path.basename(archive), reason }));
+  };
+
+  const rotateLogs = async opts => {
+    if (rotating) {
+      return rotating;
+    }
+    rotating = runRotation(opts).finally(() => {
+      rotating = null;
+    });
+    return rotating;
+  };
+
+  const runSampling = async ({ now = new Date() } = {}) => {
+    if (!connected) {
+      return [];
+    }
+    const { models } = fastify[options.name];
+    const summary = summarizeProcesses(await pm2Util.list(), { now: now.getTime() });
+    const apps = await models.app.findAll({ attributes: ['name', 'pm2Name'] });
+    const base = { ts: now.getTime(), sampledAt: toIsoInTz(now, options.logTimezone) };
+    const samples = apps.map(app => {
+      const sample = Object.assign({ name: app.name }, base, summary.get(app.pm2Name) || OFFLINE_LOAD, {
+        requests: requestMetrics.snapshot(app.name, { now: base.ts })
+      });
+      loadStore.push(app.name, sample);
+      return sample;
+    });
+    const names = apps.map(app => app.name);
+    loadStore.retain(names);
+    requestMetrics.retain(names);
+    return samples;
+  };
+
+  const sampleLoad = async opts => {
+    if (sampling) {
+      return sampling;
+    }
+    sampling = runSampling(opts).finally(() => {
+      sampling = null;
+    });
+    return sampling;
+  };
+
   const onClose = async () => {
+    if (rotateTimer) {
+      clearInterval(rotateTimer);
+      rotateTimer = null;
+    }
+    if (loadTimer) {
+      clearInterval(loadTimer);
+      loadTimer = null;
+    }
+    if (rotating) {
+      await rotating.catch(() => {});
+    }
+    if (sampling) {
+      await sampling.catch(() => {});
+    }
     if (bus) {
       try {
         bus.close?.();
@@ -87,6 +244,6 @@ module.exports = fp(async (fastify, options) => {
   };
 
   Object.assign(fastify[options.name].services, {
-    bootstrap: { onReady, onClose, reconcile }
+    bootstrap: { onReady, onClose, reconcile, rotateLogs, sampleLoad }
   });
 });

package/libs/services/dbops.js

@@ -4,7 +4,7 @@ const fs = require('fs-extra');
 const AdmZip = require('adm-zip');
 const { createSequelizeFromEnv, SQL_MIGRATIONS_TABLE } = require('../utils/migrate');
 const { resolveAppDbEnv, hasAppDbConfig } = require('../utils/env');
-const { resolveDbScope, normalizeOwnedTables, isSystemTable, resolveTablePrefix } = require('../utils/dbIdentity');
+const { resolveDbScope, normalizeOwnedTables, isSystemTable, resolveTablePrefix, filterOwnedTables } = require('../utils/dbIdentity');
 const { assertReadOnlyQuerySql } = require('../utils/sqlQueryGuard');
 
 module.exports = fp(async (fastify, options) => {
@@ -83,15 +83,7 @@ module.exports = fp(async (fastify, options) => {
     return { table, columns, primaryKey };
   };
 
-  const getOwnedTables = (app, allTables) => {
-    const scope = resolveDbScope(app.env || {}, app.options || {});
-    const existing = new Set(allTables);
-    if (scope === 'dedicated') {
-      return allTables.filter(t => !isSystemTable(t));
-    }
-    const owned = normalizeOwnedTables(app.options?.ownedTables);
-    return owned.filter(t => existing.has(t));
-  };
+  const getOwnedTables = (app, allTables) => filterOwnedTables({ appEnv: app.env || {}, ownedTables: app.options?.ownedTables, allTables });
 
   const assertTableOwned = (app, allTables, table) => {
     const owned = getOwnedTables(app, allTables);

package/libs/utils/dbIdentity.js

@@ -1,5 +1,5 @@
 const path = require('node:path');
-const { hasAppDbConfig } = require('./env');
+const { isAppDbEnabled } = require('./env');
 
 const SYSTEM_TABLES = new Set(['_fs_sql_migrations']);
 
@@ -69,12 +69,8 @@ const assertDefaultAppDbSeparated = (defaultAppDb, hostSequelize) => {
   }
 };
 
-const resolveDbScope = (appEnv = {}, options = {}) => {
-  if (options.dbScope === 'dedicated' || options.dbScope === 'shared') {
-    return options.dbScope;
-  }
-  return hasAppDbConfig(appEnv) ? 'dedicated' : 'shared';
-};
+// 与 startProcess 注入的连接一致：只看 env（独立库配置 + DB_DEDICATED 开关）。options.dbScope 只是认领表时写入的缓存，env 变化后会过期
+const resolveDbScope = (appEnv = {}) => (isAppDbEnabled(appEnv) ? 'dedicated' : 'shared');
 
 const normalizeOwnedTables = tables => [...new Set((Array.isArray(tables) ? tables : []).map(t => String(t || '').trim()).filter(Boolean))];
 
@@ -104,8 +100,21 @@ const resolveTablePrefix = (appName, appEnv = {}) => {
   return buildTablePrefix(appName);
 };
 
+/**
+ * 共享库：只认登记过的表；独立库：库内业务表全归本应用，但显式配了 DB_TABLE_PREFIX 说明该库与其它系统共用，只认本前缀的表
+ */
+const filterOwnedTables = ({ appEnv = {}, ownedTables, allTables = [] }) => {
+  if (resolveDbScope(appEnv) === 'dedicated') {
+    const prefix = String(appEnv.DB_TABLE_PREFIX || '').trim();
+    return allTables.filter(t => !isSystemTable(t) && (!prefix || String(t).startsWith(prefix)));
+  }
+  const existing = new Set(allTables);
+  return normalizeOwnedTables(ownedTables).filter(t => existing.has(t));
+};
+
 module.exports = {
   SYSTEM_TABLES,
+  filterOwnedTables,
   fingerprintDbConfig,
   fingerprintFromEnv,
   assertDefaultAppDbSeparated,