@murumets-ee/imports 0.37.0 → 0.38.0

package/dist/{cleanup-DY_bZ5LK.mjs → cleanup-CUfYcxFc.mjs}

@@ -1,2 +1,2 @@
-import{t as e}from"./rolldown-runtime-DK3Fl9T5.mjs";import{getImportsStorage as t}from"./storage.mjs";var n=e({cleanupOrphanedImports:()=>a,cleanupProcessedImports:()=>s});const r=1e3;function i(e){let{ttlOrRetention:t,ttlLabel:n,limit:i=100}=e;if(!Number.isFinite(t)||t<0)throw Error(`imports cleanup: ${n} must be a finite, non-negative number (got ${t})`);if(!Number.isFinite(i)||!Number.isInteger(i)||i<1||i>r)throw Error(`imports cleanup: limit must be an integer in [1, ${r}] (got ${i})`);return{ttlOrRetention:t,limit:i}}async function a(e){let{app:n,bucket:r,logger:a}=e,o=n.db.readWrite,{ttlOrRetention:s,limit:c}=i({ttlOrRetention:e.ttlHours,ttlLabel:`ttlHours`,...e.limit!==void 0&&{limit:e.limit}}),{and:l,asc:u,eq:d,isNull:f,lt:p,getTableColumns:m}=await import(`drizzle-orm`),{toolkitFiles:h}=await import(`@murumets-ee/storage`),{createAdminClient:g}=await import(`@murumets-ee/core/clients`),{ImportRun:_}=await import(`./transform-BCMEEIMe.mjs`).then(e=>e.o),v=g(_).getTable(),y=m(h),b=y.key,x=y.bucket,S=y.createdAt;if(!b||!x||!S)throw Error(`cleanupOrphanedImports: toolkit_files schema missing expected columns (key/bucket/createdAt)`);let C=m(v),w=C.filePath,T=C.id;if(!w||!T)throw Error(`cleanupOrphanedImports: import_run schema missing expected columns (filePath/id)`);let E=new Date(Date.now()-s*60*60*1e3),D=await o.select({key:b}).from(h).leftJoin(v,d(w,b)).where(l(d(x,r),p(S,E),f(T))).orderBy(u(S)).limit(c);if(D.length===0)return a.debug({bucket:r,ttlHours:s},`No orphaned imports uploads found`),0;let O=await t(),k=0;for(let e of D){let t=e.key;try{await O.delete(t),k++}catch(e){a.warn({key:t,err:e},`Failed to delete orphaned imports upload`)}}return a.info({cleaned:k,total:D.length,bucket:r,ttlHours:s},`Cleaned up orphaned imports uploads`),k}const o=[`succeeded`,`failed`,`cancelled`];async function s(e){let{app:n,bucket:r,logger:a}=e,s=n.db.readWrite,{ttlOrRetention:c,limit:l}=i({ttlOrRetention:e.retentionDays,ttlLabel:`retentionDays`,...e.limit!==void 0&&{limit:e.limit}}),{and:u,asc:d,eq:f,getTableColumns:p,inArray:m,lt:h}=await import(`drizzle-orm`),{toolkitFiles:g}=await import(`@murumets-ee/storage`),{createAdminClient:_}=await import(`@murumets-ee/core/clients`),{ImportRun:v}=await import(`./transform-BCMEEIMe.mjs`).then(e=>e.o),y=_(v).getTable(),b=p(g),x=b.key,S=b.bucket;if(!x||!S)throw Error(`cleanupProcessedImports: toolkit_files schema missing expected columns (key/bucket)`);let C=p(y),w=C.filePath,T=C.status,E=C.finishedAt;if(!w||!T||!E)throw Error(`cleanupProcessedImports: import_run schema missing expected columns (filePath/status/finishedAt)`);let D=new Date(Date.now()-c*24*60*60*1e3),O=await s.selectDistinctOn([x],{key:x}).from(g).innerJoin(y,f(w,x)).where(u(f(S,r),m(T,[...o]),h(E,D))).orderBy(d(x),d(E)).limit(l);if(O.length===0)return a.debug({bucket:r,retentionDays:c},`No processed-imports uploads ready for cleanup`),0;let k=await t(),A=0;for(let e of O){let t=e.key;try{await k.delete(t),A++}catch(e){a.warn({key:t,err:e},`Failed to delete processed-imports upload`)}}return a.info({cleaned:A,total:O.length,bucket:r,retentionDays:c},`Cleaned up processed imports uploads`),A}export{s as n,n as r,a as t};
-//# sourceMappingURL=cleanup-DY_bZ5LK.mjs.map
+import{t as e}from"./rolldown-runtime-DK3Fl9T5.mjs";import{getImportsStorage as t}from"./storage.mjs";var n=e({cleanupOrphanedImports:()=>a,cleanupProcessedImports:()=>s});const r=1e3;function i(e){let{ttlOrRetention:t,ttlLabel:n,limit:i=100}=e;if(!Number.isFinite(t)||t<0)throw Error(`imports cleanup: ${n} must be a finite, non-negative number (got ${t})`);if(!Number.isFinite(i)||!Number.isInteger(i)||i<1||i>r)throw Error(`imports cleanup: limit must be an integer in [1, ${r}] (got ${i})`);return{ttlOrRetention:t,limit:i}}async function a(e){let{app:n,bucket:r,logger:a}=e,o=n.db.readWrite,{ttlOrRetention:s,limit:c}=i({ttlOrRetention:e.ttlHours,ttlLabel:`ttlHours`,...e.limit!==void 0&&{limit:e.limit}}),{and:l,asc:u,eq:d,isNull:f,lt:p,getTableColumns:m}=await import(`drizzle-orm`),{toolkitFiles:h}=await import(`@murumets-ee/storage`),{createAdminClient:g}=await import(`@murumets-ee/core/clients`),{ImportRun:_}=await import(`./transform-D7uHod4E.mjs`).then(e=>e.d),v=g(_).getTable(),y=m(h),b=y.key,x=y.bucket,S=y.createdAt;if(!b||!x||!S)throw Error(`cleanupOrphanedImports: toolkit_files schema missing expected columns (key/bucket/createdAt)`);let C=m(v),w=C.filePath,T=C.id;if(!w||!T)throw Error(`cleanupOrphanedImports: import_run schema missing expected columns (filePath/id)`);let E=new Date(Date.now()-s*60*60*1e3),D=await o.select({key:b}).from(h).leftJoin(v,d(w,b)).where(l(d(x,r),p(S,E),f(T))).orderBy(u(S)).limit(c);if(D.length===0)return a.debug({bucket:r,ttlHours:s},`No orphaned imports uploads found`),0;let O=await t(),k=0;for(let e of D){let t=e.key;try{await O.delete(t),k++}catch(e){a.warn({key:t,err:e},`Failed to delete orphaned imports upload`)}}return a.info({cleaned:k,total:D.length,bucket:r,ttlHours:s},`Cleaned up orphaned imports uploads`),k}const o=[`succeeded`,`failed`,`cancelled`];async function s(e){let{app:n,bucket:r,logger:a}=e,s=n.db.readWrite,{ttlOrRetention:c,limit:l}=i({ttlOrRetention:e.retentionDays,ttlLabel:`retentionDays`,...e.limit!==void 0&&{limit:e.limit}}),{and:u,asc:d,eq:f,getTableColumns:p,inArray:m,lt:h}=await import(`drizzle-orm`),{toolkitFiles:g}=await import(`@murumets-ee/storage`),{createAdminClient:_}=await import(`@murumets-ee/core/clients`),{ImportRun:v}=await import(`./transform-D7uHod4E.mjs`).then(e=>e.d),y=_(v).getTable(),b=p(g),x=b.key,S=b.bucket;if(!x||!S)throw Error(`cleanupProcessedImports: toolkit_files schema missing expected columns (key/bucket)`);let C=p(y),w=C.filePath,T=C.status,E=C.finishedAt;if(!w||!T||!E)throw Error(`cleanupProcessedImports: import_run schema missing expected columns (filePath/status/finishedAt)`);let D=new Date(Date.now()-c*24*60*60*1e3),O=await s.selectDistinctOn([x],{key:x}).from(g).innerJoin(y,f(w,x)).where(u(f(S,r),m(T,[...o]),h(E,D))).orderBy(d(x),d(E)).limit(l);if(O.length===0)return a.debug({bucket:r,retentionDays:c},`No processed-imports uploads ready for cleanup`),0;let k=await t(),A=0;for(let e of O){let t=e.key;try{await k.delete(t),A++}catch(e){a.warn({key:t,err:e},`Failed to delete processed-imports upload`)}}return a.info({cleaned:A,total:O.length,bucket:r,retentionDays:c},`Cleaned up processed imports uploads`),A}export{s as n,n as r,a as t};
+//# sourceMappingURL=cleanup-CUfYcxFc.mjs.map

package/dist/{cleanup-DY_bZ5LK.mjs.map → cleanup-CUfYcxFc.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"cleanup-DY_bZ5LK.mjs","names":[],"sources":["../src/admin/cleanup.ts"],"sourcesContent":["/**\n * Cleanup orphaned imports uploads.\n *\n * Finds rows in `toolkit_files` within the configured imports bucket\n * that:\n *  - were created more than `ttlHours` ago, AND\n *  - have no matching `import_run.filePath` reference\n *\n * For each match, calls `StorageClient.delete(key)` — which removes\n * BOTH the adapter bytes (local file / R2 object) AND the\n * `toolkit_files` metadata row in one transactional unit (see\n * `@murumets-ee/storage` `StorageClient.delete`).\n *\n * Why this exists: the Tus upload flow stores bytes + metadata BEFORE\n * the client's downstream `register` step inserts an `import_run` row.\n * If the register call fails (validation, MIME mismatch, network\n * blip, agent abandons the workflow), the storage row is left\n * dangling. The commerce-side register handler does opportunistic\n * cleanup on its OWN failure paths, but rejections from the Zod\n * schema (before the handler runs), rejections where the agent\n * never calls register at all, AND the handler's operator-fixable\n * mapping rejections (mapping not-found / no-mapping 422 / structure\n * drift 409 — which deliberately KEEP the valid upload for a re-run)\n * all rely on this sweep.\n *\n * Scheduling: driven by the `defineJob({ schedule: '@every 1h' })`\n * declaration in `plugin.ts`. The queue worker bootstraps a\n * `toolkit_scheduled_jobs` row for this job at startup and its cron\n * loop (`processDueSchedules`) fires the registered handler on each\n * tick. The handler does NOT re-enqueue itself — the schedule is\n * driven by the worker, not the handler.\n */\n\nimport type { ToolkitApp } from '@murumets-ee/core'\nimport type { Logger } from '@murumets-ee/logging'\nimport { getImportsStorage } from '../storage.js'\n\nexport interface CleanupOrphanedImportsArgs {\n  /** Toolkit app (provides db). */\n  app: ToolkitApp\n  /**\n   * Bucket name the imports flow uses. Rows in `toolkit_files` are\n   * filtered to this bucket so the cleanup doesn't touch media,\n   * ticketing attachments, or any other consumer's uploads even if\n   * they share the same Postgres instance.\n   */\n  bucket: string\n  /**\n   * Hours after which an unreferenced upload is considered orphaned.\n   * Operator-grace window: should be long enough that a normal\n   * upload-then-register round-trip never wipes a fresh upload, but\n   * short enough that storage waste from failed uploads doesn't\n   * accumulate. 2 hours is the default in the imports plugin\n   * config — calibrated against the typical \"operator clicks\n   * upload, walks away, comes back to check\" workflow.\n   */\n  ttlHours: number\n  /**\n   * Maximum rows to process per run. Bounded so a sudden flood of\n   * orphans (e.g. after a brand-new supplier with unrecognised\n   * filenames floods the queue with rejected uploads) doesn't\n   * block the queue worker on a single multi-hour cleanup.\n   */\n  limit?: number\n  /** Logger for diagnostics. */\n  logger: Pick<Logger, 'debug' | 'info' | 'warn'>\n}\n\n/** Default per-run cap. Tuned against ticketing's `cleanupOrphanedUploads` (also 100). */\nconst DEFAULT_LIMIT = 100\n\n/** Hard cap on per-run limit. Protects against pathological caller input. */\nconst MAX_LIMIT = 1000\n\n/**\n * Validate the numeric inputs every cleanup helper accepts. Returns\n * the sanitised values OR throws — the queue worker logs thrown\n * errors against the scheduled-job row so a misconfigured TTL\n * doesn't silently delete every bucket file (which would happen if\n * a negative `ttlHours` reached the date arithmetic and pushed the\n * cutoff into the future).\n */\nfunction validateCleanupArgs(\n  raw: { ttlOrRetention: number; ttlLabel: string; limit?: number },\n): { ttlOrRetention: number; limit: number } {\n  const { ttlOrRetention, ttlLabel, limit = DEFAULT_LIMIT } = raw\n  if (!Number.isFinite(ttlOrRetention) || ttlOrRetention < 0) {\n    throw new Error(\n      `imports cleanup: ${ttlLabel} must be a finite, non-negative number (got ${ttlOrRetention})`,\n    )\n  }\n  if (!Number.isFinite(limit) || !Number.isInteger(limit) || limit < 1 || limit > MAX_LIMIT) {\n    throw new Error(\n      `imports cleanup: limit must be an integer in [1, ${MAX_LIMIT}] (got ${limit})`,\n    )\n  }\n  return { ttlOrRetention, limit }\n}\n\n/**\n * Run one cleanup pass. Returns the count of rows actually deleted\n * (which may be less than the count of orphans found if some\n * `storage.delete` calls failed — see the `warn` log inside the loop).\n */\nexport async function cleanupOrphanedImports(args: CleanupOrphanedImportsArgs): Promise<number> {\n  const { app, bucket, logger } = args\n  const db = app.db.readWrite\n  const { ttlOrRetention: ttlHours, limit } = validateCleanupArgs({\n    ttlOrRetention: args.ttlHours,\n    ttlLabel: 'ttlHours',\n    // `exactOptionalPropertyTypes` rejects an explicit `undefined`\n    // for the optional `limit?: number` slot. Spread the field only\n    // when defined so the validator's default-via-destructure kicks in.\n    ...(args.limit !== undefined && { limit: args.limit }),\n  })\n\n  // Cross-table query: `toolkit_files` LEFT JOIN `import_run` — same\n  // documented exception for cross-entity JOINs that ticketing's\n  // cleanup uses. Two-table joins can't go through a single-entity\n  // AdminClient (per CLAUDE.md \"Database Queries\").\n  const { and, asc, eq, isNull, lt, getTableColumns } = await import('drizzle-orm')\n  const { toolkitFiles } = await import('@murumets-ee/storage')\n  const { createAdminClient } = await import('@murumets-ee/core/clients')\n  const { ImportRun } = await import('../entities/import-run.js')\n  type AnyPgColumn = import('drizzle-orm/pg-core').AnyPgColumn\n\n  const importRunsTable = createAdminClient(ImportRun).getTable()\n\n  // Both `toolkitFiles` and the `importRunsTable` are exported as\n  // generic PgTables so direct dot-access widens to `T | undefined`.\n  // Pull the column refs through `getTableColumns` (same shape as\n  // ticketing's cleanup + the entity-version helper).\n  const fileCols = getTableColumns(toolkitFiles) as Record<string, AnyPgColumn>\n  const fileKey = fileCols.key\n  const fileBucket = fileCols.bucket\n  const fileCreatedAt = fileCols.createdAt\n  if (!fileKey || !fileBucket || !fileCreatedAt) {\n    throw new Error(\n      'cleanupOrphanedImports: toolkit_files schema missing expected columns (key/bucket/createdAt)',\n    )\n  }\n  const importRunCols = getTableColumns(importRunsTable) as Record<string, AnyPgColumn>\n  const irFilePath = importRunCols.filePath\n  const irId = importRunCols.id\n  if (!irFilePath || !irId) {\n    throw new Error(\n      'cleanupOrphanedImports: import_run schema missing expected columns (filePath/id)',\n    )\n  }\n\n  const cutoff = new Date(Date.now() - ttlHours * 60 * 60 * 1000)\n\n  // Find toolkit_files rows in the imports bucket, older than cutoff,\n  // where the storage key is NOT referenced by any import_run row.\n  // ORDER BY createdAt ASC delivers strict FIFO so a sustained\n  // orphan stream makes deterministic progress on the oldest rows\n  // first — without the orderBy, Postgres returns rows in heap\n  // order and a LIMIT 100 sweep could keep recycling the same\n  // young rows while ancient orphans never get touched.\n  const orphans = await db\n    .select({ key: fileKey })\n    .from(toolkitFiles)\n    .leftJoin(importRunsTable, eq(irFilePath, fileKey))\n    .where(and(eq(fileBucket, bucket), lt(fileCreatedAt, cutoff), isNull(irId)))\n    .orderBy(asc(fileCreatedAt))\n    .limit(limit)\n\n  if (orphans.length === 0) {\n    logger.debug({ bucket, ttlHours }, 'No orphaned imports uploads found')\n    return 0\n  }\n\n  const storage = await getImportsStorage()\n  let cleaned = 0\n  for (const row of orphans) {\n    const key = row.key as unknown as string\n    try {\n      await storage.delete(key)\n      cleaned++\n    } catch (err) {\n      logger.warn({ key, err }, 'Failed to delete orphaned imports upload')\n    }\n  }\n\n  logger.info(\n    { cleaned, total: orphans.length, bucket, ttlHours },\n    'Cleaned up orphaned imports uploads',\n  )\n  return cleaned\n}\n\n/** Statuses considered \"done\" for the post-success/failure cleanup. */\nconst TERMINAL_IMPORT_RUN_STATUSES = ['succeeded', 'failed', 'cancelled'] as const\n\nexport interface CleanupProcessedImportsArgs {\n  /** Toolkit app (provides db). */\n  app: ToolkitApp\n  /** Bucket name to scope the cleanup. Same semantics as `cleanupOrphanedImports`. */\n  bucket: string\n  /**\n   * Days after which a terminal-status `import_run`'s source file is\n   * deleted. Operator-grace window: long enough that an operator can\n   * inspect the source file if a transform bug surfaces shortly after\n   * a successful import; short enough that storage doesn't accumulate\n   * months of supplier feeds.\n   *\n   * The plugin default is 7. Set to 0 to delete the source file\n   * immediately at the next cleanup tick after the import row\n   * reaches terminal status — useful when storage cost matters more\n   * than forensic reprocess capability.\n   */\n  retentionDays: number\n  /** Max rows per run. Defaults to 100 (same cap as the orphan sweep). */\n  limit?: number\n  logger: Pick<Logger, 'debug' | 'info' | 'warn'>\n}\n\n/**\n * Cleanup source files for `import_run`s that finished (succeeded /\n * failed / cancelled) more than `retentionDays` days ago.\n *\n * Counterpart to `cleanupOrphanedImports`: that one targets uploads\n * with NO matching `import_run` (handshake never completed); this one\n * targets uploads whose `import_run` row IS present and terminal.\n * Together they cover every \"useless storage row\" case the imports\n * flow can produce.\n *\n * Deletes ONLY the storage row (via `StorageClient.delete`); the\n * `import_run` row is kept so the History panel + audit trail still\n * surface the past run. The `import_run.filePath` value points at a\n * now-deleted key after this runs — consumers that try to re-download\n * the source file (e.g. a future \"reprocess\" button) will get a\n * `getMetadata` → null and should show \"source file unavailable\" in\n * the UI rather than crashing.\n */\nexport async function cleanupProcessedImports(args: CleanupProcessedImportsArgs): Promise<number> {\n  const { app, bucket, logger } = args\n  const db = app.db.readWrite\n  const { ttlOrRetention: retentionDays, limit } = validateCleanupArgs({\n    ttlOrRetention: args.retentionDays,\n    ttlLabel: 'retentionDays',\n    // `exactOptionalPropertyTypes` rejects an explicit `undefined`\n    // for the optional `limit?: number` slot. Spread the field only\n    // when defined so the validator's default-via-destructure kicks in.\n    ...(args.limit !== undefined && { limit: args.limit }),\n  })\n\n  const { and, asc, eq, getTableColumns, inArray, lt } = await import('drizzle-orm')\n  const { toolkitFiles } = await import('@murumets-ee/storage')\n  const { createAdminClient } = await import('@murumets-ee/core/clients')\n  const { ImportRun } = await import('../entities/import-run.js')\n  type AnyPgColumn = import('drizzle-orm/pg-core').AnyPgColumn\n\n  const importRunsTable = createAdminClient(ImportRun).getTable()\n\n  const fileCols = getTableColumns(toolkitFiles) as Record<string, AnyPgColumn>\n  const fileKey = fileCols.key\n  const fileBucket = fileCols.bucket\n  if (!fileKey || !fileBucket) {\n    throw new Error(\n      'cleanupProcessedImports: toolkit_files schema missing expected columns (key/bucket)',\n    )\n  }\n  const importRunCols = getTableColumns(importRunsTable) as Record<string, AnyPgColumn>\n  const irFilePath = importRunCols.filePath\n  const irStatus = importRunCols.status\n  const irFinishedAt = importRunCols.finishedAt\n  if (!irFilePath || !irStatus || !irFinishedAt) {\n    throw new Error(\n      'cleanupProcessedImports: import_run schema missing expected columns (filePath/status/finishedAt)',\n    )\n  }\n\n  const cutoff = new Date(Date.now() - retentionDays * 24 * 60 * 60 * 1000)\n\n  // INNER JOIN so we only consider keys that DO have a matching\n  // import_run row — the inverse of the orphan-cleanup query. Filter\n  // on terminal status + finishedAt cutoff so a long-running batch\n  // doesn't get its still-being-processed file ripped out from under\n  // the worker.\n  //\n  // `selectDistinctOn([fileKey])` is the right primitive here:\n  //\n  //   (a) **Dedupe before LIMIT.** `toolkit_files.key` is UNIQUE\n  //       within its own table, but `import_run.filePath` has no\n  //       unique constraint — a future re-run / retry flow that\n  //       creates two terminal `import_run` rows pointing at the\n  //       same `storageKey` would make the INNER JOIN project the\n  //       key twice. Without dedupe in SQL, a pathological cluster\n  //       of 100 duplicates sharing 1 storageKey would burn the\n  //       LIMIT cap to clean 1 file.\n  //\n  //   (b) **Deterministic ordering** (NOT strict global FIFO).\n  //       `DISTINCT ON` requires the ORDER BY to start with the\n  //       distinct columns (Postgres rule). So we sort by `fileKey`\n  //       first, then `irFinishedAt` within each key group. The\n  //       LIMIT then picks the first N keys in `fileKey` order —\n  //       i.e. alphabetical by storage path, not globally oldest by\n  //       finishedAt. In practice this is roughly chronological\n  //       anyway: storage keys are `uploads/YYYY/MM/<uuid>/...` so\n  //       earlier months sort first. Within a month, ordering is\n  //       UUID-random — but every key eventually gets cleaned\n  //       (no starvation), so over ~10 ticks the entire backlog\n  //       drains either way. A subquery-wrapped \"true global FIFO\"\n  //       (DISTINCT ON inner, ORDER BY finishedAt outer) is\n  //       possible but adds complexity for marginal benefit; the\n  //       practical-FIFO-via-key-prefix property is acceptable.\n  const candidates = await db\n    .selectDistinctOn([fileKey], { key: fileKey })\n    .from(toolkitFiles)\n    .innerJoin(importRunsTable, eq(irFilePath, fileKey))\n    .where(\n      and(\n        eq(fileBucket, bucket),\n        inArray(irStatus, [...TERMINAL_IMPORT_RUN_STATUSES]),\n        lt(irFinishedAt, cutoff),\n      ),\n    )\n    .orderBy(asc(fileKey), asc(irFinishedAt))\n    .limit(limit)\n\n  if (candidates.length === 0) {\n    logger.debug({ bucket, retentionDays }, 'No processed-imports uploads ready for cleanup')\n    return 0\n  }\n\n  const storage = await getImportsStorage()\n  let cleaned = 0\n  for (const row of candidates) {\n    const key = row.key as unknown as string\n    try {\n      await storage.delete(key)\n      cleaned++\n    } catch (err) {\n      logger.warn({ key, err }, 'Failed to delete processed-imports upload')\n    }\n  }\n\n  logger.info(\n    { cleaned, total: candidates.length, bucket, retentionDays },\n    'Cleaned up processed imports uploads',\n  )\n  return cleaned\n}\n"],"mappings":"4KAqEA,MAGM,EAAY,IAUlB,SAAS,EACP,EAC2C,CAC3C,GAAM,CAAE,iBAAgB,WAAU,QAAQ,KAAkB,EAC5D,GAAI,CAAC,OAAO,SAAS,CAAc,GAAK,EAAiB,EACvD,MAAU,MACR,oBAAoB,EAAS,8CAA8C,EAAe,EAC5F,EAEF,GAAI,CAAC,OAAO,SAAS,CAAK,GAAK,CAAC,OAAO,UAAU,CAAK,GAAK,EAAQ,GAAK,EAAQ,EAC9E,MAAU,MACR,oDAAoD,EAAU,SAAS,EAAM,EAC/E,EAEF,MAAO,CAAE,iBAAgB,OAAM,CACjC,CAOA,eAAsB,EAAuB,EAAmD,CAC9F,GAAM,CAAE,MAAK,SAAQ,UAAW,EAC1B,EAAK,EAAI,GAAG,UACZ,CAAE,eAAgB,EAAU,SAAU,EAAoB,CAC9D,eAAgB,EAAK,SACrB,SAAU,WAIV,GAAI,EAAK,QAAU,IAAA,IAAa,CAAE,MAAO,EAAK,KAAM,CACtD,CAAC,EAMK,CAAE,MAAK,MAAK,KAAI,SAAQ,KAAI,mBAAoB,MAAM,OAAO,eAC7D,CAAE,gBAAiB,MAAM,OAAO,wBAChC,CAAE,qBAAsB,MAAM,OAAO,6BACrC,CAAE,aAAc,MAAM,OAAO,2BAA4B,CAAA,KAAA,GAAA,EAAA,CAAA,EAGzD,EAAkB,EAAkB,CAAS,CAAC,CAAC,SAAS,EAMxD,EAAW,EAAgB,CAAY,EACvC,EAAU,EAAS,IACnB,EAAa,EAAS,OACtB,EAAgB,EAAS,UAC/B,GAAI,CAAC,GAAW,CAAC,GAAc,CAAC,EAC9B,MAAU,MACR,8FACF,EAEF,IAAM,EAAgB,EAAgB,CAAe,EAC/C,EAAa,EAAc,SAC3B,EAAO,EAAc,GAC3B,GAAI,CAAC,GAAc,CAAC,EAClB,MAAU,MACR,kFACF,EAGF,IAAM,EAAS,IAAI,KAAK,KAAK,IAAI,EAAI,EAAW,GAAK,GAAK,GAAI,EASxD,EAAU,MAAM,EACnB,OAAO,CAAE,IAAK,CAAQ,CAAC,CAAC,CACxB,KAAK,CAAY,CAAC,CAClB,SAAS,EAAiB,EAAG,EAAY,CAAO,CAAC,CAAC,CAClD,MAAM,EAAI,EAAG,EAAY,CAAM,EAAG,EAAG,EAAe,CAAM,EAAG,EAAO,CAAI,CAAC,CAAC,CAAC,CAC3E,QAAQ,EAAI,CAAa,CAAC,CAAC,CAC3B,MAAM,CAAK,EAEd,GAAI,EAAQ,SAAW,EAErB,OADA,EAAO,MAAM,CAAE,SAAQ,UAAS,EAAG,mCAAmC,EAC/D,EAGT,IAAM,EAAU,MAAM,EAAkB,EACpC,EAAU,EACd,IAAK,IAAM,KAAO,EAAS,CACzB,IAAM,EAAM,EAAI,IAChB,GAAI,CACF,MAAM,EAAQ,OAAO,CAAG,EACxB,GACF,OAAS,EAAK,CACZ,EAAO,KAAK,CAAE,MAAK,KAAI,EAAG,0CAA0C,CACtE,CACF,CAMA,OAJA,EAAO,KACL,CAAE,UAAS,MAAO,EAAQ,OAAQ,SAAQ,UAAS,EACnD,qCACF,EACO,CACT,CAGA,MAAM,EAA+B,CAAC,YAAa,SAAU,WAAW,EA2CxE,eAAsB,EAAwB,EAAoD,CAChG,GAAM,CAAE,MAAK,SAAQ,UAAW,EAC1B,EAAK,EAAI,GAAG,UACZ,CAAE,eAAgB,EAAe,SAAU,EAAoB,CACnE,eAAgB,EAAK,cACrB,SAAU,gBAIV,GAAI,EAAK,QAAU,IAAA,IAAa,CAAE,MAAO,EAAK,KAAM,CACtD,CAAC,EAEK,CAAE,MAAK,MAAK,KAAI,kBAAiB,UAAS,MAAO,MAAM,OAAO,eAC9D,CAAE,gBAAiB,MAAM,OAAO,wBAChC,CAAE,qBAAsB,MAAM,OAAO,6BACrC,CAAE,aAAc,MAAM,OAAO,2BAA4B,CAAA,KAAA,GAAA,EAAA,CAAA,EAGzD,EAAkB,EAAkB,CAAS,CAAC,CAAC,SAAS,EAExD,EAAW,EAAgB,CAAY,EACvC,EAAU,EAAS,IACnB,EAAa,EAAS,OAC5B,GAAI,CAAC,GAAW,CAAC,EACf,MAAU,MACR,qFACF,EAEF,IAAM,EAAgB,EAAgB,CAAe,EAC/C,EAAa,EAAc,SAC3B,EAAW,EAAc,OACzB,EAAe,EAAc,WACnC,GAAI,CAAC,GAAc,CAAC,GAAY,CAAC,EAC/B,MAAU,MACR,kGACF,EAGF,IAAM,EAAS,IAAI,KAAK,KAAK,IAAI,EAAI,EAAgB,GAAK,GAAK,GAAK,GAAI,EAkClE,EAAa,MAAM,EACtB,iBAAiB,CAAC,CAAO,EAAG,CAAE,IAAK,CAAQ,CAAC,CAAC,CAC7C,KAAK,CAAY,CAAC,CAClB,UAAU,EAAiB,EAAG,EAAY,CAAO,CAAC,CAAC,CACnD,MACC,EACE,EAAG,EAAY,CAAM,EACrB,EAAQ,EAAU,CAAC,GAAG,CAA4B,CAAC,EACnD,EAAG,EAAc,CAAM,CACzB,CACF,CAAC,CACA,QAAQ,EAAI,CAAO,EAAG,EAAI,CAAY,CAAC,CAAC,CACxC,MAAM,CAAK,EAEd,GAAI,EAAW,SAAW,EAExB,OADA,EAAO,MAAM,CAAE,SAAQ,eAAc,EAAG,gDAAgD,EACjF,EAGT,IAAM,EAAU,MAAM,EAAkB,EACpC,EAAU,EACd,IAAK,IAAM,KAAO,EAAY,CAC5B,IAAM,EAAM,EAAI,IAChB,GAAI,CACF,MAAM,EAAQ,OAAO,CAAG,EACxB,GACF,OAAS,EAAK,CACZ,EAAO,KAAK,CAAE,MAAK,KAAI,EAAG,2CAA2C,CACvE,CACF,CAMA,OAJA,EAAO,KACL,CAAE,UAAS,MAAO,EAAW,OAAQ,SAAQ,eAAc,EAC3D,sCACF,EACO,CACT"}
+{"version":3,"file":"cleanup-CUfYcxFc.mjs","names":[],"sources":["../src/admin/cleanup.ts"],"sourcesContent":["/**\n * Cleanup orphaned imports uploads.\n *\n * Finds rows in `toolkit_files` within the configured imports bucket\n * that:\n *  - were created more than `ttlHours` ago, AND\n *  - have no matching `import_run.filePath` reference\n *\n * For each match, calls `StorageClient.delete(key)` — which removes\n * BOTH the adapter bytes (local file / R2 object) AND the\n * `toolkit_files` metadata row in one transactional unit (see\n * `@murumets-ee/storage` `StorageClient.delete`).\n *\n * Why this exists: the Tus upload flow stores bytes + metadata BEFORE\n * the client's downstream `register` step inserts an `import_run` row.\n * If the register call fails (validation, MIME mismatch, network\n * blip, agent abandons the workflow), the storage row is left\n * dangling. The commerce-side register handler does opportunistic\n * cleanup on its OWN failure paths, but rejections from the Zod\n * schema (before the handler runs), rejections where the agent\n * never calls register at all, AND the handler's operator-fixable\n * mapping rejections (mapping not-found / no-mapping 422 / structure\n * drift 409 — which deliberately KEEP the valid upload for a re-run)\n * all rely on this sweep.\n *\n * Scheduling: driven by the `defineJob({ schedule: '@every 1h' })`\n * declaration in `plugin.ts`. The queue worker bootstraps a\n * `toolkit_scheduled_jobs` row for this job at startup and its cron\n * loop (`processDueSchedules`) fires the registered handler on each\n * tick. The handler does NOT re-enqueue itself — the schedule is\n * driven by the worker, not the handler.\n */\n\nimport type { ToolkitApp } from '@murumets-ee/core'\nimport type { Logger } from '@murumets-ee/logging'\nimport { getImportsStorage } from '../storage.js'\n\nexport interface CleanupOrphanedImportsArgs {\n  /** Toolkit app (provides db). */\n  app: ToolkitApp\n  /**\n   * Bucket name the imports flow uses. Rows in `toolkit_files` are\n   * filtered to this bucket so the cleanup doesn't touch media,\n   * ticketing attachments, or any other consumer's uploads even if\n   * they share the same Postgres instance.\n   */\n  bucket: string\n  /**\n   * Hours after which an unreferenced upload is considered orphaned.\n   * Operator-grace window: should be long enough that a normal\n   * upload-then-register round-trip never wipes a fresh upload, but\n   * short enough that storage waste from failed uploads doesn't\n   * accumulate. 2 hours is the default in the imports plugin\n   * config — calibrated against the typical \"operator clicks\n   * upload, walks away, comes back to check\" workflow.\n   */\n  ttlHours: number\n  /**\n   * Maximum rows to process per run. Bounded so a sudden flood of\n   * orphans (e.g. after a brand-new supplier with unrecognised\n   * filenames floods the queue with rejected uploads) doesn't\n   * block the queue worker on a single multi-hour cleanup.\n   */\n  limit?: number\n  /** Logger for diagnostics. */\n  logger: Pick<Logger, 'debug' | 'info' | 'warn'>\n}\n\n/** Default per-run cap. Tuned against ticketing's `cleanupOrphanedUploads` (also 100). */\nconst DEFAULT_LIMIT = 100\n\n/** Hard cap on per-run limit. Protects against pathological caller input. */\nconst MAX_LIMIT = 1000\n\n/**\n * Validate the numeric inputs every cleanup helper accepts. Returns\n * the sanitised values OR throws — the queue worker logs thrown\n * errors against the scheduled-job row so a misconfigured TTL\n * doesn't silently delete every bucket file (which would happen if\n * a negative `ttlHours` reached the date arithmetic and pushed the\n * cutoff into the future).\n */\nfunction validateCleanupArgs(\n  raw: { ttlOrRetention: number; ttlLabel: string; limit?: number },\n): { ttlOrRetention: number; limit: number } {\n  const { ttlOrRetention, ttlLabel, limit = DEFAULT_LIMIT } = raw\n  if (!Number.isFinite(ttlOrRetention) || ttlOrRetention < 0) {\n    throw new Error(\n      `imports cleanup: ${ttlLabel} must be a finite, non-negative number (got ${ttlOrRetention})`,\n    )\n  }\n  if (!Number.isFinite(limit) || !Number.isInteger(limit) || limit < 1 || limit > MAX_LIMIT) {\n    throw new Error(\n      `imports cleanup: limit must be an integer in [1, ${MAX_LIMIT}] (got ${limit})`,\n    )\n  }\n  return { ttlOrRetention, limit }\n}\n\n/**\n * Run one cleanup pass. Returns the count of rows actually deleted\n * (which may be less than the count of orphans found if some\n * `storage.delete` calls failed — see the `warn` log inside the loop).\n */\nexport async function cleanupOrphanedImports(args: CleanupOrphanedImportsArgs): Promise<number> {\n  const { app, bucket, logger } = args\n  const db = app.db.readWrite\n  const { ttlOrRetention: ttlHours, limit } = validateCleanupArgs({\n    ttlOrRetention: args.ttlHours,\n    ttlLabel: 'ttlHours',\n    // `exactOptionalPropertyTypes` rejects an explicit `undefined`\n    // for the optional `limit?: number` slot. Spread the field only\n    // when defined so the validator's default-via-destructure kicks in.\n    ...(args.limit !== undefined && { limit: args.limit }),\n  })\n\n  // Cross-table query: `toolkit_files` LEFT JOIN `import_run` — same\n  // documented exception for cross-entity JOINs that ticketing's\n  // cleanup uses. Two-table joins can't go through a single-entity\n  // AdminClient (per CLAUDE.md \"Database Queries\").\n  const { and, asc, eq, isNull, lt, getTableColumns } = await import('drizzle-orm')\n  const { toolkitFiles } = await import('@murumets-ee/storage')\n  const { createAdminClient } = await import('@murumets-ee/core/clients')\n  const { ImportRun } = await import('../entities/import-run.js')\n  type AnyPgColumn = import('drizzle-orm/pg-core').AnyPgColumn\n\n  const importRunsTable = createAdminClient(ImportRun).getTable()\n\n  // Both `toolkitFiles` and the `importRunsTable` are exported as\n  // generic PgTables so direct dot-access widens to `T | undefined`.\n  // Pull the column refs through `getTableColumns` (same shape as\n  // ticketing's cleanup + the entity-version helper).\n  const fileCols = getTableColumns(toolkitFiles) as Record<string, AnyPgColumn>\n  const fileKey = fileCols.key\n  const fileBucket = fileCols.bucket\n  const fileCreatedAt = fileCols.createdAt\n  if (!fileKey || !fileBucket || !fileCreatedAt) {\n    throw new Error(\n      'cleanupOrphanedImports: toolkit_files schema missing expected columns (key/bucket/createdAt)',\n    )\n  }\n  const importRunCols = getTableColumns(importRunsTable) as Record<string, AnyPgColumn>\n  const irFilePath = importRunCols.filePath\n  const irId = importRunCols.id\n  if (!irFilePath || !irId) {\n    throw new Error(\n      'cleanupOrphanedImports: import_run schema missing expected columns (filePath/id)',\n    )\n  }\n\n  const cutoff = new Date(Date.now() - ttlHours * 60 * 60 * 1000)\n\n  // Find toolkit_files rows in the imports bucket, older than cutoff,\n  // where the storage key is NOT referenced by any import_run row.\n  // ORDER BY createdAt ASC delivers strict FIFO so a sustained\n  // orphan stream makes deterministic progress on the oldest rows\n  // first — without the orderBy, Postgres returns rows in heap\n  // order and a LIMIT 100 sweep could keep recycling the same\n  // young rows while ancient orphans never get touched.\n  const orphans = await db\n    .select({ key: fileKey })\n    .from(toolkitFiles)\n    .leftJoin(importRunsTable, eq(irFilePath, fileKey))\n    .where(and(eq(fileBucket, bucket), lt(fileCreatedAt, cutoff), isNull(irId)))\n    .orderBy(asc(fileCreatedAt))\n    .limit(limit)\n\n  if (orphans.length === 0) {\n    logger.debug({ bucket, ttlHours }, 'No orphaned imports uploads found')\n    return 0\n  }\n\n  const storage = await getImportsStorage()\n  let cleaned = 0\n  for (const row of orphans) {\n    const key = row.key as unknown as string\n    try {\n      await storage.delete(key)\n      cleaned++\n    } catch (err) {\n      logger.warn({ key, err }, 'Failed to delete orphaned imports upload')\n    }\n  }\n\n  logger.info(\n    { cleaned, total: orphans.length, bucket, ttlHours },\n    'Cleaned up orphaned imports uploads',\n  )\n  return cleaned\n}\n\n/** Statuses considered \"done\" for the post-success/failure cleanup. */\nconst TERMINAL_IMPORT_RUN_STATUSES = ['succeeded', 'failed', 'cancelled'] as const\n\nexport interface CleanupProcessedImportsArgs {\n  /** Toolkit app (provides db). */\n  app: ToolkitApp\n  /** Bucket name to scope the cleanup. Same semantics as `cleanupOrphanedImports`. */\n  bucket: string\n  /**\n   * Days after which a terminal-status `import_run`'s source file is\n   * deleted. Operator-grace window: long enough that an operator can\n   * inspect the source file if a transform bug surfaces shortly after\n   * a successful import; short enough that storage doesn't accumulate\n   * months of supplier feeds.\n   *\n   * The plugin default is 7. Set to 0 to delete the source file\n   * immediately at the next cleanup tick after the import row\n   * reaches terminal status — useful when storage cost matters more\n   * than forensic reprocess capability.\n   */\n  retentionDays: number\n  /** Max rows per run. Defaults to 100 (same cap as the orphan sweep). */\n  limit?: number\n  logger: Pick<Logger, 'debug' | 'info' | 'warn'>\n}\n\n/**\n * Cleanup source files for `import_run`s that finished (succeeded /\n * failed / cancelled) more than `retentionDays` days ago.\n *\n * Counterpart to `cleanupOrphanedImports`: that one targets uploads\n * with NO matching `import_run` (handshake never completed); this one\n * targets uploads whose `import_run` row IS present and terminal.\n * Together they cover every \"useless storage row\" case the imports\n * flow can produce.\n *\n * Deletes ONLY the storage row (via `StorageClient.delete`); the\n * `import_run` row is kept so the History panel + audit trail still\n * surface the past run. The `import_run.filePath` value points at a\n * now-deleted key after this runs — consumers that try to re-download\n * the source file (e.g. a future \"reprocess\" button) will get a\n * `getMetadata` → null and should show \"source file unavailable\" in\n * the UI rather than crashing.\n */\nexport async function cleanupProcessedImports(args: CleanupProcessedImportsArgs): Promise<number> {\n  const { app, bucket, logger } = args\n  const db = app.db.readWrite\n  const { ttlOrRetention: retentionDays, limit } = validateCleanupArgs({\n    ttlOrRetention: args.retentionDays,\n    ttlLabel: 'retentionDays',\n    // `exactOptionalPropertyTypes` rejects an explicit `undefined`\n    // for the optional `limit?: number` slot. Spread the field only\n    // when defined so the validator's default-via-destructure kicks in.\n    ...(args.limit !== undefined && { limit: args.limit }),\n  })\n\n  const { and, asc, eq, getTableColumns, inArray, lt } = await import('drizzle-orm')\n  const { toolkitFiles } = await import('@murumets-ee/storage')\n  const { createAdminClient } = await import('@murumets-ee/core/clients')\n  const { ImportRun } = await import('../entities/import-run.js')\n  type AnyPgColumn = import('drizzle-orm/pg-core').AnyPgColumn\n\n  const importRunsTable = createAdminClient(ImportRun).getTable()\n\n  const fileCols = getTableColumns(toolkitFiles) as Record<string, AnyPgColumn>\n  const fileKey = fileCols.key\n  const fileBucket = fileCols.bucket\n  if (!fileKey || !fileBucket) {\n    throw new Error(\n      'cleanupProcessedImports: toolkit_files schema missing expected columns (key/bucket)',\n    )\n  }\n  const importRunCols = getTableColumns(importRunsTable) as Record<string, AnyPgColumn>\n  const irFilePath = importRunCols.filePath\n  const irStatus = importRunCols.status\n  const irFinishedAt = importRunCols.finishedAt\n  if (!irFilePath || !irStatus || !irFinishedAt) {\n    throw new Error(\n      'cleanupProcessedImports: import_run schema missing expected columns (filePath/status/finishedAt)',\n    )\n  }\n\n  const cutoff = new Date(Date.now() - retentionDays * 24 * 60 * 60 * 1000)\n\n  // INNER JOIN so we only consider keys that DO have a matching\n  // import_run row — the inverse of the orphan-cleanup query. Filter\n  // on terminal status + finishedAt cutoff so a long-running batch\n  // doesn't get its still-being-processed file ripped out from under\n  // the worker.\n  //\n  // `selectDistinctOn([fileKey])` is the right primitive here:\n  //\n  //   (a) **Dedupe before LIMIT.** `toolkit_files.key` is UNIQUE\n  //       within its own table, but `import_run.filePath` has no\n  //       unique constraint — a future re-run / retry flow that\n  //       creates two terminal `import_run` rows pointing at the\n  //       same `storageKey` would make the INNER JOIN project the\n  //       key twice. Without dedupe in SQL, a pathological cluster\n  //       of 100 duplicates sharing 1 storageKey would burn the\n  //       LIMIT cap to clean 1 file.\n  //\n  //   (b) **Deterministic ordering** (NOT strict global FIFO).\n  //       `DISTINCT ON` requires the ORDER BY to start with the\n  //       distinct columns (Postgres rule). So we sort by `fileKey`\n  //       first, then `irFinishedAt` within each key group. The\n  //       LIMIT then picks the first N keys in `fileKey` order —\n  //       i.e. alphabetical by storage path, not globally oldest by\n  //       finishedAt. In practice this is roughly chronological\n  //       anyway: storage keys are `uploads/YYYY/MM/<uuid>/...` so\n  //       earlier months sort first. Within a month, ordering is\n  //       UUID-random — but every key eventually gets cleaned\n  //       (no starvation), so over ~10 ticks the entire backlog\n  //       drains either way. A subquery-wrapped \"true global FIFO\"\n  //       (DISTINCT ON inner, ORDER BY finishedAt outer) is\n  //       possible but adds complexity for marginal benefit; the\n  //       practical-FIFO-via-key-prefix property is acceptable.\n  const candidates = await db\n    .selectDistinctOn([fileKey], { key: fileKey })\n    .from(toolkitFiles)\n    .innerJoin(importRunsTable, eq(irFilePath, fileKey))\n    .where(\n      and(\n        eq(fileBucket, bucket),\n        inArray(irStatus, [...TERMINAL_IMPORT_RUN_STATUSES]),\n        lt(irFinishedAt, cutoff),\n      ),\n    )\n    .orderBy(asc(fileKey), asc(irFinishedAt))\n    .limit(limit)\n\n  if (candidates.length === 0) {\n    logger.debug({ bucket, retentionDays }, 'No processed-imports uploads ready for cleanup')\n    return 0\n  }\n\n  const storage = await getImportsStorage()\n  let cleaned = 0\n  for (const row of candidates) {\n    const key = row.key as unknown as string\n    try {\n      await storage.delete(key)\n      cleaned++\n    } catch (err) {\n      logger.warn({ key, err }, 'Failed to delete processed-imports upload')\n    }\n  }\n\n  logger.info(\n    { cleaned, total: candidates.length, bucket, retentionDays },\n    'Cleaned up processed imports uploads',\n  )\n  return cleaned\n}\n"],"mappings":"4KAqEA,MAGM,EAAY,IAUlB,SAAS,EACP,EAC2C,CAC3C,GAAM,CAAE,iBAAgB,WAAU,QAAQ,KAAkB,EAC5D,GAAI,CAAC,OAAO,SAAS,CAAc,GAAK,EAAiB,EACvD,MAAU,MACR,oBAAoB,EAAS,8CAA8C,EAAe,EAC5F,EAEF,GAAI,CAAC,OAAO,SAAS,CAAK,GAAK,CAAC,OAAO,UAAU,CAAK,GAAK,EAAQ,GAAK,EAAQ,EAC9E,MAAU,MACR,oDAAoD,EAAU,SAAS,EAAM,EAC/E,EAEF,MAAO,CAAE,iBAAgB,OAAM,CACjC,CAOA,eAAsB,EAAuB,EAAmD,CAC9F,GAAM,CAAE,MAAK,SAAQ,UAAW,EAC1B,EAAK,EAAI,GAAG,UACZ,CAAE,eAAgB,EAAU,SAAU,EAAoB,CAC9D,eAAgB,EAAK,SACrB,SAAU,WAIV,GAAI,EAAK,QAAU,IAAA,IAAa,CAAE,MAAO,EAAK,KAAM,CACtD,CAAC,EAMK,CAAE,MAAK,MAAK,KAAI,SAAQ,KAAI,mBAAoB,MAAM,OAAO,eAC7D,CAAE,gBAAiB,MAAM,OAAO,wBAChC,CAAE,qBAAsB,MAAM,OAAO,6BACrC,CAAE,aAAc,MAAM,OAAO,2BAA4B,CAAA,KAAA,GAAA,EAAA,CAAA,EAGzD,EAAkB,EAAkB,CAAS,CAAC,CAAC,SAAS,EAMxD,EAAW,EAAgB,CAAY,EACvC,EAAU,EAAS,IACnB,EAAa,EAAS,OACtB,EAAgB,EAAS,UAC/B,GAAI,CAAC,GAAW,CAAC,GAAc,CAAC,EAC9B,MAAU,MACR,8FACF,EAEF,IAAM,EAAgB,EAAgB,CAAe,EAC/C,EAAa,EAAc,SAC3B,EAAO,EAAc,GAC3B,GAAI,CAAC,GAAc,CAAC,EAClB,MAAU,MACR,kFACF,EAGF,IAAM,EAAS,IAAI,KAAK,KAAK,IAAI,EAAI,EAAW,GAAK,GAAK,GAAI,EASxD,EAAU,MAAM,EACnB,OAAO,CAAE,IAAK,CAAQ,CAAC,CAAC,CACxB,KAAK,CAAY,CAAC,CAClB,SAAS,EAAiB,EAAG,EAAY,CAAO,CAAC,CAAC,CAClD,MAAM,EAAI,EAAG,EAAY,CAAM,EAAG,EAAG,EAAe,CAAM,EAAG,EAAO,CAAI,CAAC,CAAC,CAAC,CAC3E,QAAQ,EAAI,CAAa,CAAC,CAAC,CAC3B,MAAM,CAAK,EAEd,GAAI,EAAQ,SAAW,EAErB,OADA,EAAO,MAAM,CAAE,SAAQ,UAAS,EAAG,mCAAmC,EAC/D,EAGT,IAAM,EAAU,MAAM,EAAkB,EACpC,EAAU,EACd,IAAK,IAAM,KAAO,EAAS,CACzB,IAAM,EAAM,EAAI,IAChB,GAAI,CACF,MAAM,EAAQ,OAAO,CAAG,EACxB,GACF,OAAS,EAAK,CACZ,EAAO,KAAK,CAAE,MAAK,KAAI,EAAG,0CAA0C,CACtE,CACF,CAMA,OAJA,EAAO,KACL,CAAE,UAAS,MAAO,EAAQ,OAAQ,SAAQ,UAAS,EACnD,qCACF,EACO,CACT,CAGA,MAAM,EAA+B,CAAC,YAAa,SAAU,WAAW,EA2CxE,eAAsB,EAAwB,EAAoD,CAChG,GAAM,CAAE,MAAK,SAAQ,UAAW,EAC1B,EAAK,EAAI,GAAG,UACZ,CAAE,eAAgB,EAAe,SAAU,EAAoB,CACnE,eAAgB,EAAK,cACrB,SAAU,gBAIV,GAAI,EAAK,QAAU,IAAA,IAAa,CAAE,MAAO,EAAK,KAAM,CACtD,CAAC,EAEK,CAAE,MAAK,MAAK,KAAI,kBAAiB,UAAS,MAAO,MAAM,OAAO,eAC9D,CAAE,gBAAiB,MAAM,OAAO,wBAChC,CAAE,qBAAsB,MAAM,OAAO,6BACrC,CAAE,aAAc,MAAM,OAAO,2BAA4B,CAAA,KAAA,GAAA,EAAA,CAAA,EAGzD,EAAkB,EAAkB,CAAS,CAAC,CAAC,SAAS,EAExD,EAAW,EAAgB,CAAY,EACvC,EAAU,EAAS,IACnB,EAAa,EAAS,OAC5B,GAAI,CAAC,GAAW,CAAC,EACf,MAAU,MACR,qFACF,EAEF,IAAM,EAAgB,EAAgB,CAAe,EAC/C,EAAa,EAAc,SAC3B,EAAW,EAAc,OACzB,EAAe,EAAc,WACnC,GAAI,CAAC,GAAc,CAAC,GAAY,CAAC,EAC/B,MAAU,MACR,kGACF,EAGF,IAAM,EAAS,IAAI,KAAK,KAAK,IAAI,EAAI,EAAgB,GAAK,GAAK,GAAK,GAAI,EAkClE,EAAa,MAAM,EACtB,iBAAiB,CAAC,CAAO,EAAG,CAAE,IAAK,CAAQ,CAAC,CAAC,CAC7C,KAAK,CAAY,CAAC,CAClB,UAAU,EAAiB,EAAG,EAAY,CAAO,CAAC,CAAC,CACnD,MACC,EACE,EAAG,EAAY,CAAM,EACrB,EAAQ,EAAU,CAAC,GAAG,CAA4B,CAAC,EACnD,EAAG,EAAc,CAAM,CACzB,CACF,CAAC,CACA,QAAQ,EAAI,CAAO,EAAG,EAAI,CAAY,CAAC,CAAC,CACxC,MAAM,CAAK,EAEd,GAAI,EAAW,SAAW,EAExB,OADA,EAAO,MAAM,CAAE,SAAQ,eAAc,EAAG,gDAAgD,EACjF,EAGT,IAAM,EAAU,MAAM,EAAkB,EACpC,EAAU,EACd,IAAK,IAAM,KAAO,EAAY,CAC5B,IAAM,EAAM,EAAI,IAChB,GAAI,CACF,MAAM,EAAQ,OAAO,CAAG,EACxB,GACF,OAAS,EAAK,CACZ,EAAO,KAAK,CAAE,MAAK,KAAI,EAAG,2CAA2C,CACvE,CACF,CAMA,OAJA,EAAO,KACL,CAAE,UAAS,MAAO,EAAW,OAAQ,SAAQ,eAAc,EAC3D,sCACF,EACO,CACT"}

package/dist/index.d.mts

@@ -1,10 +1,139 @@
-import { A as ErrorSample, C as StreamFeedOptions, D as DEFAULT_MAX_PATTERNS, E as streamFeed, F as ImportRunClient, I as ImportRunStatus, M as ErrorTrackerConfig, N as IMPORT_RUN_STATUSES, O as DEFAULT_MAX_SAMPLES_PER_PATTERN, P as ImportRun, S as readFeed, T as countDataRows, _ as RunImportResult, b as ReadFeedOptions, c as PairSinkContext, g as RunImportOptions, h as ImportRunProgress, j as ErrorTracker, k as ErrorPattern, m as DEFAULT_BATCH_SIZE, n as EsClientResolver, r as FilePathResolver, s as PairSink, t as EnsureIndexResolver, v as runImport, w as StreamFeedRow, x as feedReaderConfigSchema, y as FeedReaderConfig } from "./worker-CA4jf4BA.mjs";
+import { A as StreamFeedOptions, C as ErrorTracker, D as feedReaderConfigSchema, E as ReadFeedOptions, F as ImportRun, I as ImportRunClient, L as ImportRunStatus, M as countDataRows, N as streamFeed, O as readFeed, P as IMPORT_RUN_STATUSES, S as ErrorSample, T as FeedReaderConfig, _ as RunImportResult, b as DEFAULT_MAX_SAMPLES_PER_PATTERN, c as PairSinkContext, g as RunImportOptions, h as ImportRunProgress, j as StreamFeedRow, k as readPersistedFeedConfig, m as DEFAULT_BATCH_SIZE, n as EsClientResolver, r as FilePathResolver, s as PairSink, t as EnsureIndexResolver, v as runImport, w as ErrorTrackerConfig, x as ErrorPattern, y as DEFAULT_MAX_PATTERNS } from "./worker-ZWkDs7gz.mjs";
 import { a as RowWarning, c as TransformRegistry, i as RowTransform, l as getTransformRegistry, n as RowError, o as TransformContext, r as RowResult, s as TransformName, t as DirectionalPair, u as registerImportTransform } from "./transform-CulePAbJ.mjs";
-import { Behavior } from "@murumets-ee/entity";
 import { ToolkitApp } from "@murumets-ee/core";
+import { Behavior } from "@murumets-ee/entity";
 import { Logger as Logger$1 } from "@murumets-ee/logging";
 import { AdminClient } from "@murumets-ee/entity/admin";
 
+//#region src/admin/audit-empty-header.d.ts
+/**
+ * Per-run outcome of the file re-read.
+ *
+ * - `corrupt` — the patched reader refuses this file's header. The run imported
+ *   empty rows and reported success.
+ * - `clean` — the header re-reads with at least one column today. See the
+ *   false-negative caveat in the module docblock.
+ * - `source_unavailable` — the source file could not be read at all (reaped by
+ *   the retention sweep, deleted, or storage refused). Undecidable from the
+ *   file; `zeroRowsIndexed` is the only signal left.
+ * - `undetectable` — the run is outside what this detector can decide: a
+ *   `hasHeader: false` run has no header for the guard to test, a non-xlsx run
+ *   cannot have the defect, and a file that yields no data rows never reached
+ *   the guard at all.
+ * - `error` — reading failed for some other reason; `detail` carries it.
+ */
+declare const EMPTY_HEADER_VERDICTS: readonly ["corrupt", "clean", "source_unavailable", "undetectable", "error"];
+type EmptyHeaderVerdict = (typeof EMPTY_HEADER_VERDICTS)[number];
+interface InspectImportRunSourceArgs {
+  /** Local path OR storage key, verbatim from `import_run.filePath`. */
+  filePath: string;
+  /** The run's persisted reader config (`import_run.params.feed`). */
+  feed: FeedReaderConfig;
+  /**
+   * Resolves `filePath` to a readable local path, exactly as the worker does.
+   * Omit when `filePath` is already a local FS path (the on-disk deployments
+   * the worker's no-resolver fallback covers).
+   */
+  resolveFilePath?: FilePathResolver | undefined;
+}
+interface InspectImportRunSourceResult {
+  verdict: EmptyHeaderVerdict;
+  /** Human-readable reason. Always set for everything except `clean`. */
+  detail?: string;
+}
+/**
+ * Re-read ONE run's source file with the patched reader and classify it.
+ *
+ * Stops pulling rows once the header has been decided — the guard fires while
+ * the header is captured, before any data row is yielded, so the first row
+ * settles it.
+ *
+ * That bounds the rows parsed OF THE TARGET SHEET, and nothing else. The
+ * resolver has already downloaded the whole object, and `streamXlsx` parses the
+ * worksheets after the target on its way out — it has to, or exceljs strands a
+ * temp file and an fd per deferred worksheet. So the per-run cost is one file,
+ * plus its trailing sheets; what bounds the SWEEP is the item cap and the
+ * concurrency cap in `auditEmptyHeaderRuns`.
+ */
+declare function inspectImportRunSource(args: InspectImportRunSourceArgs): Promise<InspectImportRunSourceResult>;
+/**
+ * The counters this audit reads out of `import_run.totals`.
+ *
+ * A LOSSY view, deliberately: `rowsWarned` / `batchesCompleted` /
+ * `patchesApplied` / `patchesOrphaned` are dropped rather than passed through,
+ * because a report is easier to read for what it needs than for everything the
+ * run recorded. Read the `import_run` row itself if you want the rest.
+ */
+interface RecordedTotals {
+  rowsRead?: number | undefined;
+  rowsSucceeded?: number | undefined;
+  rowsFailed?: number | undefined;
+  rowsSkipped?: number | undefined;
+}
+/** Narrow the opaque `totals` JSONB to the counters this audit reports. */
+declare function readRecordedTotals(raw: unknown): RecordedTotals;
+interface AuditedImportRun {
+  id: string;
+  label: string;
+  /** Verbatim `import_run.filePath` — the storage key, so an operator can go look. */
+  filePath: string;
+  transformName: string;
+  createdAt: Date | null;
+  finishedAt: Date | null;
+  /** Row counters the run recorded. A corrupted run that recorded a plausible count is the most misleading artefact of all. */
+  totals: RecordedTotals;
+  verdict: EmptyHeaderVerdict;
+  detail?: string;
+  /**
+   * The run finished having read rows but indexed none. Corroborating evidence
+   * that survives the source file being reaped, and the ONLY signal available
+   * for the transient variant of the defect — but it is also what a wrong
+   * column mapping looks like, so it is never folded into the verdict.
+   *
+   * THREE-VALUED on purpose. `'unknown'` means the run recorded no usable
+   * counters (older rows; any run audited with a non-`succeeded` status, since
+   * `markFailed` never writes `totals`). Collapsing that to `false` would render
+   * absence of evidence as evidence of absence — in the one signal that is
+   * supposed to outlive the file.
+   */
+  zeroRowsIndexed: boolean | 'unknown';
+}
+interface EmptyHeaderAuditReport {
+  /** Total xlsx runs matching the audited statuses. */
+  candidates: number;
+  /** How many of them this invocation actually read. */
+  examined: number;
+  /** `candidates - examined` — dropped by the cap, newest kept. Never silent: also logged. */
+  notExamined: number;
+  counts: Record<EmptyHeaderVerdict, number>;
+  /** Every examined run, verdict-annotated, newest first. */
+  runs: AuditedImportRun[];
+}
+interface AuditEmptyHeaderRunsArgs {
+  /** Toolkit app — provides the app-bound `AdminClient` for `import_run`. */
+  app: ToolkitApp;
+  /**
+   * Same resolver the imports plugin hands the worker (typically
+   * `storageResolveFilePath`). Omit only when `filePath` is a local FS path.
+   */
+  resolveFilePath?: FilePathResolver | undefined;
+  /** Statuses to audit. Default `['succeeded']` — a failed run announced itself. */
+  statuses?: readonly ImportRunStatus[] | undefined;
+  /** Max runs examined, newest first. Default 200, hard ceiling 5000. */
+  limit?: number | undefined;
+  /** Peak concurrent storage reads. Default 4, hard ceiling 16. */
+  concurrency?: number | undefined;
+  logger: Pick<Logger$1, 'info' | 'warn'>;
+}
+/**
+ * Audit past import runs for the silent empty-header corruption.
+ *
+ * Newest-first, because the answerable window is the recent one — the retention
+ * sweep reaps source files ~7 days after a run reaches terminal status by
+ * default, so the oldest runs are the ones whose evidence is already gone.
+ */
+declare function auditEmptyHeaderRuns(args: AuditEmptyHeaderRunsArgs): Promise<EmptyHeaderAuditReport>;
+//#endregion
 //#region src/admin/cleanup.d.ts
 interface CleanupOrphanedImportsArgs {
   /** Toolkit app (provides db). */
@@ -233,5 +362,5 @@ interface FeedPreview {
  */
 declare function previewFeed(options: PreviewFeedOptions): Promise<FeedPreview>;
 //#endregion
-export { type CleanupOrphanedImportsArgs, type CleanupProcessedImportsArgs, DEFAULT_BATCH_SIZE, DEFAULT_MAX_PATTERNS, DEFAULT_MAX_SAMPLES_PER_PATTERN, DEFAULT_PREVIEW_ROWS, type DirectionalPair, type EnsureIndexResolver, type ErrorPattern, type ErrorSample, ErrorTracker, type ErrorTrackerConfig, type EsClientResolver, type FeedPreview, type FeedReaderConfig, type FilePathResolver, IMPORT_MAPPING_FORMATS, IMPORT_MAPPING_TARGET_SCHEMAS, IMPORT_RUN_STATUSES, ImportMapping, type ImportMappingClient, type ImportMappingFormat, type ImportMappingTargetSchema, ImportRun, type ImportRunClient, type ImportRunProgress, type ImportRunStatus, MAX_PREVIEW_ROWS, type PairSink, type PairSinkContext, type PreviewFeedOptions, type ReadFeedOptions, type RowError, type RowResult, type RowTransform, type RowWarning, type RunImportOptions, type RunImportResult, type StreamFeedOptions, type StreamFeedRow, type TransformContext, type TransformName, TransformRegistry, assertValidMapping, cleanupOrphanedImports, cleanupProcessedImports, countDataRows, feedReaderConfigSchema, getTransformRegistry, importMappingValidation, previewFeed, readFeed, registerImportTransform, runImport, streamFeed };
+export { type AuditEmptyHeaderRunsArgs, type AuditedImportRun, type CleanupOrphanedImportsArgs, type CleanupProcessedImportsArgs, DEFAULT_BATCH_SIZE, DEFAULT_MAX_PATTERNS, DEFAULT_MAX_SAMPLES_PER_PATTERN, DEFAULT_PREVIEW_ROWS, type DirectionalPair, EMPTY_HEADER_VERDICTS, type EmptyHeaderAuditReport, type EmptyHeaderVerdict, type EnsureIndexResolver, type ErrorPattern, type ErrorSample, ErrorTracker, type ErrorTrackerConfig, type EsClientResolver, type FeedPreview, type FeedReaderConfig, type FilePathResolver, IMPORT_MAPPING_FORMATS, IMPORT_MAPPING_TARGET_SCHEMAS, IMPORT_RUN_STATUSES, ImportMapping, type ImportMappingClient, type ImportMappingFormat, type ImportMappingTargetSchema, ImportRun, type ImportRunClient, type ImportRunProgress, type ImportRunStatus, type InspectImportRunSourceArgs, type InspectImportRunSourceResult, MAX_PREVIEW_ROWS, type PairSink, type PairSinkContext, type PreviewFeedOptions, type ReadFeedOptions, type RecordedTotals, type RowError, type RowResult, type RowTransform, type RowWarning, type RunImportOptions, type RunImportResult, type StreamFeedOptions, type StreamFeedRow, type TransformContext, type TransformName, TransformRegistry, assertValidMapping, auditEmptyHeaderRuns, cleanupOrphanedImports, cleanupProcessedImports, countDataRows, feedReaderConfigSchema, getTransformRegistry, importMappingValidation, inspectImportRunSource, previewFeed, readFeed, readPersistedFeedConfig, readRecordedTotals, registerImportTransform, runImport, streamFeed };
 //# sourceMappingURL=index.d.mts.map

package/dist/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../src/admin/cleanup.ts","../src/entities/import-mapping.ts","../src/entities/import-mapping-validation.ts","../src/preview-feed.ts"],"mappings":";;;;;;;;UAqCiB,0BAAA;EA6JA;EA3Jf,GAAA,EAAK,UAAA;;;;;;;EAOL,MAAA;EAsJK;;;;;;;;AAkBc;EA9JnB,QAAA;EAmL2C;;;;;;EA5K3C,KAAA;EA4KuF;EA1KvF,MAAA,EAAQ,IAAA,CAAK,QAAA;AAAA;;AC1Bf;;;;iBDiEsB,sBAAA,CAAuB,IAAA,EAAM,0BAAA,GAA6B,OAAO;AAAA,UA0FtE,2BAAA;EC1JoB;ED4JnC,GAAA,EAAK,UAAA;EC5JsE;ED8J3E,MAAA;EC3JW;;;;AAAwD;AACrE;;;;AAAgE;AAgDhE;;EDuHE,aAAA;;EAEA,KAAA;EACA,MAAA,EAAQ,IAAA,CAAK,QAAA;AAAA;;;;;;;;;;;;;;;;;;;iBAqBO,uBAAA,CAAwB,IAAA,EAAM,2BAAA,GAA8B,OAAO;;;;;;;;cCpM5E,6BAAA;AAAA,KACD,yBAAA,WAAoC,6BAA6B;AD0J7E;AAAA,cCvJa,sBAAA;AAAA,KACD,mBAAA,WAA8B,sBAAsB;AAAA,cAgDnD,aAAA,gCAAa,MAAA;;;ED0HZ;;;;;;KAAJ;;;;;;KAqB+E;;;;;;;;;;;KCpMR;;;;;;;EAIZ;;;AAAA;;;KACL;;;;;;;;;;;;EAgDtC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAqFd,mBAAA,GAAsB,WAAW,QAAQ,aAAA,CAAc,SAAA;;;;;;;;iBCtGnD,kBAAA,CAAmB,KAAA;EACjC,YAAA;EACA,YAAA;EACA,SAAA;EACA,cAAA;AAAA;;;;;;AFuImB;cEnDR,uBAAA,EAAyB,QAAQ,CAC5C,MAAA;;;;cClJW,gBAAA;;cAEA,oBAAA;AAAA,UAEI,kBAAA,SAA2B,eAAe;EHyCzD;EGvCA,OAAO;AAAA;AAAA,UAGQ,WAAA;EHsCI;AAAA;AAuCrB;;;EGvEE,OAAA;EHuEiD;EGrEjD,IAAA,EAAM,KAAK,CAAC,MAAA;AAAA;;AHqEyE;AA0FvF;;;iBGvJsB,WAAA,CAAY,OAAA,EAAS,kBAAA,GAAqB,OAAA,CAAQ,WAAA"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../src/admin/audit-empty-header.ts","../src/admin/cleanup.ts","../src/entities/import-mapping.ts","../src/entities/import-mapping-validation.ts","../src/preview-feed.ts"],"mappings":";;;;;;;;;AAwQa;AASb;;;;AAAgE;AAWhE;;;;;;;;;cA9Ma,qBAAA;AAAA,KAOD,kBAAA,WAA6B,qBAAqB;AAAA,UAc7C,0BAAA;EA8Lf;EA5LA,QAAA;EA6LW;EA3LX,IAAA,EAAM,gBAAA;EA4LM;;;;;EAtLZ,eAAA,GAAkB,gBAAgB;AAAA;AAAA,UAGnB,4BAAA;EACf,OAAA,EAAS,kBAAkB;EAsMZ;EApMf,MAAA;AAAA;;;;;;;;;;;;;;;iBAyDoB,sBAAA,CACpB,IAAA,EAAM,0BAAA,GACL,OAAA,CAAQ,4BAAA;AAqJX;;;;;;;;AAAA,UA/DiB,cAAA;EACf,QAAA;EACA,aAAA;EACA,UAAA;EACA,WAAA;AAAA;;iBASc,kBAAA,CAAmB,GAAA,YAAe,cAAc;AAAA,UAW/C,gBAAA;EACf,EAAA;EACA,KAAA;EAmDQ;EAjDR,QAAA;EACA,aAAA;EACA,SAAA,EAAW,IAAA;EACX,UAAA,EAAY,IAAA;EAkF4B;EAhFxC,MAAA,EAAQ,cAAA;EACR,OAAA,EAAS,kBAAA;EACT,MAAA;EAgFC;;;;;;;;AAA8B;;;;EAnE/B,eAAA;AAAA;AAAA,UAGe,sBAAA;EChRV;EDkRL,UAAA;ECxPQ;ED0PR,QAAA;EC1PY;ED4PZ,WAAA;EACA,MAAA,EAAQ,MAAA,CAAO,kBAAA;EChRf;EDkRA,IAAA,EAAM,gBAAA;AAAA;AAAA,UAGS,wBAAA;EClQP;EDoQR,GAAA,EAAK,UAAA;ECpQc;AAAA;AAuCrB;;EDkOE,eAAA,GAAkB,gBAAA;EClOmE;EDoOrF,QAAA,YAAoB,eAAA;ECpOuB;EDsO3C,KAAA;ECtOqF;EDwOrF,WAAA;EACA,MAAA,EAAQ,IAAA,CAAK,QAAA;AAAA;;;;;;;;iBAoCO,oBAAA,CACpB,IAAA,EAAM,wBAAA,GACL,OAAA,CAAQ,sBAAA;;;UClVM,0BAAA;ED8Ef;EC5EA,GAAA,EAAK,UAAA;ED4EC;AAyDR;;;;;EC9HE,MAAA;EDgIQ;;;;;;;AAA6B;AAsFvC;EC5ME,QAAA;;;;;;;EAOA,KAAA;EDyMW;ECvMX,MAAA,EAAQ,IAAA,CAAK,QAAA;AAAA;;;ADgNiD;AAWhE;;iBCpLsB,sBAAA,CAAuB,IAAA,EAAM,0BAAA,GAA6B,OAAO;AAAA,UA0FtE,2BAAA;EDiGH;EC/FZ,GAAA,EAAK,UAAA;EDkGI;EChGT,MAAA;EDgG2B;;;;;;;;;;;;ECnF3B,aAAA;EDoFA;EClFA,KAAA;EACA,MAAA,EAAQ,IAAA,CAAK,QAAA;AAAA;ADiGf;;;;;;;;;;;;;;;;;AASwB;AATxB,iBC5EsB,uBAAA,CAAwB,IAAA,EAAM,2BAAA,GAA8B,OAAO;;;AD9HrD;AAGpC;;;;AAHoC,cEtEvB,6BAAA;AAAA,KACD,yBAAA,WAAoC,6BAA6B;;cAGhE,sBAAA;AAAA,KACD,mBAAA,WAA8B,sBAAsB;AAAA,cAgDnD,aAAA,gCAAa,MAAA;;;EFiFlB;;;;;;KACG;;;;;;KAuFT;;;;;;;;;;;;;;;;;;EAwBA;;;;;;KAMY;;;KAGH;;;;;KAiB4B;;;;EAS/B;;;;;;;;;;;EAAgB;AAAA;AAGxB;;;;;;;;EAcc;;;;;;;;;;;;8GAAO;;;;;;KEhKT,mBAAA,GAAsB,WAAW,QAAQ,aAAA,CAAc,SAAA;;;;AF9D3D;AAyDR;;;iBGjGgB,kBAAA,CAAmB,KAAA;EACjC,YAAA;EACA,YAAA;EACA,SAAA;EACA,cAAA;AAAA;;;;;AH+FqC;AAsFvC;cGjGa,uBAAA,EAAyB,QAAQ,CAC5C,MAAA;;;;cClJW,gBAAA;AJmEiD;AAAA,cIjEjD,oBAAA;AAAA,UAEI,kBAAA,SAA2B,eAAe;;EAEzD,OAAO;AAAA;AAAA,UAGQ,WAAA;EJ4ET;;;;AAM4B;EI5ElC,OAAA;EJ+E2C;EI7E3C,IAAA,EAAM,KAAK,CAAC,MAAA;AAAA;;;;;AJgFN;iBIxEc,WAAA,CAAY,OAAA,EAAS,kBAAA,GAAqB,OAAA,CAAQ,WAAA"}

package/dist/index.mjs

@@ -1,2 +1,2 @@
-import{n as e,t}from"./cleanup-DY_bZ5LK.mjs";import{a as n,c as r,d as i,i as a,l as o,n as s,r as c,s as l,t as u,u as d}from"./transform-BCMEEIMe.mjs";import{c as f,i as p,l as m,n as h,o as g,r as _,s as v,t as y,u as b}from"./runner-BOwPUm7W.mjs";const x=100,S=20;async function C(e){let{maxRows:t,...n}=e,r=t??20,i=Math.min(100,Math.max(1,Number.isFinite(r)?Math.floor(r):20)),a=[],o=new Map;for await(let{row:e}of p({...n,relaxColumnCount:!0})){for(let t of Object.keys(e))o.set(t,!0);if(a.push(e),a.length>=i)break}return{columns:[...o.keys()],rows:a}}export{y as DEFAULT_BATCH_SIZE,f as DEFAULT_MAX_PATTERNS,m as DEFAULT_MAX_SAMPLES_PER_PATTERN,S as DEFAULT_PREVIEW_ROWS,b as ErrorTracker,l as IMPORT_MAPPING_FORMATS,r as IMPORT_MAPPING_TARGET_SCHEMAS,a as IMPORT_RUN_STATUSES,o as ImportMapping,n as ImportRun,x as MAX_PREVIEW_ROWS,u as TransformRegistry,d as assertValidMapping,t as cleanupOrphanedImports,e as cleanupProcessedImports,g as countDataRows,_ as feedReaderConfigSchema,s as getTransformRegistry,i as importMappingValidation,C as previewFeed,p as readFeed,c as registerImportTransform,h as runImport,v as streamFeed};
+import{a as e,c as t,i as n,l as r,n as i,o as a,r as o,s,t as c,u as l}from"./transform-D7uHod4E.mjs";import{a as u,c as d,d as f,i as p,n as m,o as h,r as g,s as _,t as v,u as y}from"./runner-C-s6SD7t.mjs";import{n as b,t as x}from"./cleanup-CUfYcxFc.mjs";import{DEFAULT_BOUNDED_CONCURRENCY as S,runBounded as C}from"@murumets-ee/core";const w=[`corrupt`,`clean`,`source_unavailable`,`undetectable`,`error`],T=[`succeeded`],E=5e3;function D(e){return e instanceof Error?e.message:String(e)}const O=new Set([`ENOENT`,`EACCES`,`EPERM`,`EISDIR`,`ENOTDIR`]),k=/FILE_ENDED/;function A(e,t){if(typeof e!=`object`||!e)return!1;if(e instanceof t)return!0;if(`code`in e){let{code:t}=e;if(typeof t==`string`&&O.has(t))return!0}return e instanceof Error&&k.test(e.message)}async function j(e){let{filePath:t,feed:n,resolveFilePath:r}=e;if(n.format!==`xlsx`)return{verdict:`undetectable`,detail:`not an xlsx run (format: ${n.format??`tsv (default)`}) — the defect is exceljs-specific`};if(n.hasHeader===!1)return{verdict:`undetectable`,detail:`run used hasHeader:false — no header row for the guard to test`};let{streamXlsx:i,XlsxEmptyHeaderError:a,XlsxNotAFileError:o}=await import(`./xlsx-reader-Ccesszbc.mjs`),s;try{s=r?await r(t):{localPath:t}}catch(e){return{verdict:`source_unavailable`,detail:D(e)}}try{let e=!1;for await(let t of i({filePath:s.localPath,...n.headerRowIndex!==void 0&&{headerRowIndex:n.headerRowIndex},...n.sheet!==void 0&&{sheet:n.sheet}})){e=!0;break}return e?{verdict:`clean`}:{verdict:`undetectable`,detail:`file yielded no data rows — the header guard never ran`}}catch(e){return e instanceof a?{verdict:`corrupt`,detail:e.message}:A(e,o)?{verdict:`source_unavailable`,detail:D(e)}:{verdict:`error`,detail:D(e)}}finally{await s.cleanup?.().catch(()=>{})}}function M(e,t){let n=e[t];return typeof n==`number`&&Number.isFinite(n)?n:void 0}function N(e){if(typeof e!=`object`||!e||Array.isArray(e))return{};let t=e;return{rowsRead:M(t,`rowsRead`),rowsSucceeded:M(t,`rowsSucceeded`),rowsFailed:M(t,`rowsFailed`),rowsSkipped:M(t,`rowsSkipped`)}}function P(){return{corrupt:0,clean:0,source_unavailable:0,undetectable:0,error:0}}function F(e){return e.rowsRead===void 0||e.rowsSucceeded===void 0?`unknown`:e.rowsRead>0&&e.rowsSucceeded===0}function I(e){if(e instanceof Date)return e;if(typeof e==`string`){let t=new Date(e);return Number.isNaN(t.getTime())?null:t}return null}async function L(e){let{app:t,resolveFilePath:n,logger:r}=e,i=e.statuses??T;if(i.length===0)throw Error(`auditEmptyHeaderRuns: statuses must name at least one import_run status`);let a=e.limit??200;if(!Number.isInteger(a)||a<1||a>E)throw Error(`auditEmptyHeaderRuns: limit must be an integer in [1, ${E}] (got ${a})`);let o=e.concurrency??S;if(!Number.isInteger(o)||o<1||o>16)throw Error(`auditEmptyHeaderRuns: concurrency must be an integer in [1, 16] (got ${o})`);let s=t.getClient(l),{and:c,desc:u,getTableColumns:f,inArray:p,sql:m}=await import(`drizzle-orm`),h=f(s.getTable()),g=h.status,_=h.params,v=h.createdAt;if(!g||!_||!v)throw Error(`auditEmptyHeaderRuns: import_run schema missing expected columns (status/params/createdAt)`);let y=c(p(g,[...i]),m`${_}->'feed'->>'format' = ${`xlsx`}`),b=await s.count({where:y}),x=await s.findMany({where:y,orderBy:u(v),limit:a}),w=Math.max(0,b-x.length);if(w>0&&r.warn({candidates:b,examined:x.length,notExamined:w,limit:a},`imports audit: capped at the most recent runs — re-run with a higher limit to cover the rest`),x.length===0)return r.info({statuses:i},`imports audit: no xlsx runs to audit`),{candidates:b,examined:0,notExamined:w,counts:P(),runs:[]};r.info({candidates:b,examining:x.length,concurrency:o},`imports audit: re-reading source files for the empty-header defect`);let O=await C(x,async e=>{let t=e.filePath,r=N(e.totals),i={id:e.id,label:e.label,filePath:t,transformName:e.transformName,createdAt:I(e.createdAt),finishedAt:I(e.finishedAt),totals:r,zeroRowsIndexed:F(r)};try{let r=d(e.params);if(!r.success){let e=r.error.issues[0]?.message??`invalid feed reader config`;return{...i,verdict:`error`,detail:`invalid params.feed: ${e}`}}let a=await j({filePath:t,feed:r.data,...n!==void 0&&{resolveFilePath:n}});return{...i,verdict:a.verdict,...a.detail!==void 0&&{detail:a.detail}}}catch(e){return{...i,verdict:`error`,detail:D(e)}}},o),k=P();for(let e of O)k[e.verdict]+=1,e.verdict===`corrupt`&&r.warn({importRunId:e.id,label:e.label,filePath:e.filePath,transformName:e.transformName,createdAt:e.createdAt,totals:e.totals},`imports audit: SILENTLY CORRUPTED run — its source file has no readable header`);let A=O.filter(e=>e.zeroRowsIndexed===!0).length,M=O.filter(e=>e.zeroRowsIndexed===`unknown`).length;return n===void 0&&k.source_unavailable===O.length&&r.warn({examined:O.length},`imports audit: every source was unreadable and no resolveFilePath was given — if filePath holds storage keys rather than local paths, pass storageResolveFilePath`),r.info({candidates:b,examined:O.length,notExamined:w,...k,zeroRowsIndexed:A,totalsUnknown:M},`imports audit: complete`),{candidates:b,examined:O.length,notExamined:w,counts:k,runs:O}}const R=100,z=20;async function B(e){let{maxRows:t,...n}=e,r=t??20,i=Math.min(100,Math.max(1,Number.isFinite(r)?Math.floor(r):20)),a=[],o=new Map;for await(let{row:e}of _({...n,relaxColumnCount:!0})){for(let t of Object.keys(e))o.set(t,!0);if(a.push(e),a.length>=i)break}return{columns:[...o.keys()],rows:a}}export{v as DEFAULT_BATCH_SIZE,g as DEFAULT_MAX_PATTERNS,p as DEFAULT_MAX_SAMPLES_PER_PATTERN,z as DEFAULT_PREVIEW_ROWS,w as EMPTY_HEADER_VERDICTS,u as ErrorTracker,n as IMPORT_MAPPING_FORMATS,e as IMPORT_MAPPING_TARGET_SCHEMAS,r as IMPORT_RUN_STATUSES,a as ImportMapping,l as ImportRun,R as MAX_PREVIEW_ROWS,c as TransformRegistry,s as assertValidMapping,L as auditEmptyHeaderRuns,x as cleanupOrphanedImports,b as cleanupProcessedImports,y as countDataRows,h as feedReaderConfigSchema,i as getTransformRegistry,t as importMappingValidation,j as inspectImportRunSource,B as previewFeed,_ as readFeed,d as readPersistedFeedConfig,N as readRecordedTotals,o as registerImportTransform,m as runImport,f as streamFeed};
 //# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../src/preview-feed.ts"],"sourcesContent":["/**\n * `previewFeed` — read the first N data rows of a feed for the PR3 import wizard\n * (commerce-demo phase 02 §4). Reuses {@link readFeed} so the preview is parsed by\n * the EXACT same reader (csv-parse / exceljs), with the same delimiter / header /\n * sheet config, that the run will use — the operator maps against what they'll get,\n * not a re-implemented best-guess parser (R02: drift between preview + run is a\n * mapping foot-gun).\n *\n * Bounded: it consumes only `maxRows` rows then stops iterating, so on a delimited\n * feed it streams a tiny prefix rather than the whole file. (The caller materialises\n * the storage object to a local path first — see the commerce preview route — so for\n * a very large upload the materialise cost dominates; that's a demo-depth trade-off,\n * noted on the route.)\n */\n\nimport { type ReadFeedOptions, readFeed } from './read-feed.js'\n\n/** Hard ceiling on preview rows regardless of caller request — bounds work + payload. */\nexport const MAX_PREVIEW_ROWS = 100\n/** Default sample size when the caller doesn't specify. */\nexport const DEFAULT_PREVIEW_ROWS = 20\n\nexport interface PreviewFeedOptions extends ReadFeedOptions {\n  /** Rows to sample. Defaults to {@link DEFAULT_PREVIEW_ROWS}; clamped to [1, {@link MAX_PREVIEW_ROWS}]. */\n  maxRows?: number\n}\n\nexport interface FeedPreview {\n  /**\n   * Source column names in first-seen order. With a header these are the (trimmed)\n   * header names; headerless feeds yield positional `\"0\"`, `\"1\"`, … keys. The union\n   * across sampled rows covers feeds whose first row omits trailing empty cells.\n   */\n  columns: string[]\n  /** Up to `maxRows` sampled data rows, each a `{ column → cell }` map (cells are strings). */\n  rows: Array<Record<string, string>>\n}\n\n/**\n * Read up to `maxRows` data rows from a feed file and return the detected columns +\n * sample rows. Throws whatever the underlying reader throws (bad sheet index,\n * duplicate header, unreadable file) — the caller maps that to a 4xx.\n */\nexport async function previewFeed(options: PreviewFeedOptions): Promise<FeedPreview> {\n  const { maxRows, ...feedOptions } = options\n  // Coerce to a finite integer BEFORE clamping: `previewFeed` is public API, so a\n  // caller passing `NaN`/`Infinity`/fractional must not slip through. `NaN` in\n  // particular would make `rows.length >= limit` always false → read the whole file.\n  const requested = maxRows ?? DEFAULT_PREVIEW_ROWS\n  const safeRows = Number.isFinite(requested) ? Math.floor(requested) : DEFAULT_PREVIEW_ROWS\n  const limit = Math.min(MAX_PREVIEW_ROWS, Math.max(1, safeRows))\n\n  const rows: Array<Record<string, string>> = []\n  // First-seen-order column set: a Map preserves insertion order and dedupes.\n  const columns = new Map<string, true>()\n\n  // Preview is EXPLORATORY — force lenient column counts (csv/tsv). With the wrong\n  // delimiter a feed parses as a single odd column, OR a row's field count differs\n  // from the header; strict parsing would abort the whole preview with a cryptic\n  // \"Invalid Record Length\" instead of letting the operator SEE the bad parse and\n  // fix the delimiter/format, then re-preview. The actual run keeps its own\n  // (stricter) settings.\n  for await (const { row } of readFeed({ ...feedOptions, relaxColumnCount: true })) {\n    for (const key of Object.keys(row)) columns.set(key, true)\n    rows.push(row)\n    if (rows.length >= limit) break\n  }\n\n  return { columns: [...columns.keys()], rows }\n}\n"],"mappings":"2PAkBA,MAAa,EAAmB,IAEnB,EAAuB,GAuBpC,eAAsB,EAAY,EAAmD,CACnF,GAAM,CAAE,UAAS,GAAG,GAAgB,EAI9B,EAAY,GAAA,GAEZ,EAAQ,KAAK,IAAA,IAAsB,KAAK,IAAI,EADjC,OAAO,SAAS,CAAS,EAAI,KAAK,MAAM,CAAS,EAAA,EACL,CAAC,EAExD,EAAsC,CAAC,EAEvC,EAAU,IAAI,IAQpB,UAAW,GAAM,CAAE,SAAS,EAAS,CAAE,GAAG,EAAa,iBAAkB,EAAK,CAAC,EAAG,CAChF,IAAK,IAAM,KAAO,OAAO,KAAK,CAAG,EAAG,EAAQ,IAAI,EAAK,EAAI,EAEzD,GADA,EAAK,KAAK,CAAG,EACT,EAAK,QAAU,EAAO,KAC5B,CAEA,MAAO,CAAE,QAAS,CAAC,GAAG,EAAQ,KAAK,CAAC,EAAG,MAAK,CAC9C"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../src/admin/audit-empty-header.ts","../src/preview-feed.ts"],"sourcesContent":["/**\n * Retroactive audit for the silent empty-header corruption fixed in #839\n * (issue #842).\n *\n * **What went wrong.** exceljs assigns `this.sharedStrings = []` at the top of\n * `_parseSharedStrings`, before parsing a single entry — and an empty array is\n * truthy, which is what its inline-worksheet guard tests. A shared-strings\n * entry that yields nothing therefore leaves every string cell resolving to\n * `undefined`: the header parses to zero columns, every data row maps to `{}`,\n * and the import reports SUCCESS with every value dropped. #839 made\n * `streamXlsx` refuse that file. It cannot see backwards, and a past occurrence\n * is indistinguishable from success in the `import_run` row alone — both\n * `status: 'succeeded'`, both no fatal error.\n *\n * **What this does.** Re-reads the retained source file of every past xlsx run\n * with the PATCHED reader and classifies each one. `import_run.filePath` is\n * `required: true`, so every run has a source to point at.\n *\n * **What a verdict is worth — read this before acting on a report.**\n *\n * - `corrupt` has no false positives worth worrying about: the guard fires on\n *   precisely the condition that produced the empty parse, so a file that\n *   throws today would have thrown then. There is no threshold to tune, unlike\n *   inferring corruption from suspiciously-low row counts.\n * - `clean` is NOT proof the run was fine. The upstream defect has two causes:\n *   a file that genuinely carries an empty/unparseable shared-strings part\n *   (deterministic — caught here), and a truncated or starved read at import\n *   time (transient — the same file re-reads perfectly today). The file re-read\n *   is blind to the second. That is why every audited run also carries\n *   {@link AuditedImportRun.zeroRowsIndexed}, which is derived from the\n *   recorded totals and needs no file at all: a run that finished `succeeded`\n *   having indexed zero rows is the observable signature of the corruption\n *   whichever cause produced it. It is corroborating, not conclusive — an\n *   operator who uploaded a feed with the wrong column mapping gets the same\n *   shape — so it is reported as a separate flag and never folded into the\n *   verdict.\n * - `source_unavailable` is the honest answer for a run whose evidence is gone,\n *   and there will be some: `cleanupProcessedImports` deletes the source file\n *   of any terminal run older than `processedRetentionDays` (plugin default 7),\n *   on an hourly schedule. The retained-file window is therefore about a week\n *   on a deployment running the queue worker with the default config — run this\n *   audit sooner rather than later, and read `zeroRowsIndexed` for the runs\n *   whose files have already been reaped.\n *\n * Read-only by construction: it reports, it never re-imports. Deciding what to\n * do about a corrupted run needs the operator.\n *\n * Bounded per CLAUDE.md's fan-out rule — it is `O(runs)` reads against storage,\n * so it caps both the item count AND the peak concurrency, and logs whatever it\n * drops rather than silently truncating. The per-run cost is one file: the\n * resolver downloads the object, and the reader parses to the header of the\n * target sheet plus whatever follows it. Neither cap substitutes for the other,\n * and neither substitutes for running the audit while the answer is still\n * there.\n */\n\nimport { DEFAULT_BOUNDED_CONCURRENCY, runBounded, type ToolkitApp } from '@murumets-ee/core'\nimport type { Logger } from '@murumets-ee/logging'\nimport { ImportRun, type ImportRunStatus } from '../entities/import-run.js'\nimport { type FeedReaderConfig, readPersistedFeedConfig } from '../read-feed.js'\nimport type { FilePathResolver } from '../worker.js'\n\n/**\n * Per-run outcome of the file re-read.\n *\n * - `corrupt` — the patched reader refuses this file's header. The run imported\n *   empty rows and reported success.\n * - `clean` — the header re-reads with at least one column today. See the\n *   false-negative caveat in the module docblock.\n * - `source_unavailable` — the source file could not be read at all (reaped by\n *   the retention sweep, deleted, or storage refused). Undecidable from the\n *   file; `zeroRowsIndexed` is the only signal left.\n * - `undetectable` — the run is outside what this detector can decide: a\n *   `hasHeader: false` run has no header for the guard to test, a non-xlsx run\n *   cannot have the defect, and a file that yields no data rows never reached\n *   the guard at all.\n * - `error` — reading failed for some other reason; `detail` carries it.\n */\nexport const EMPTY_HEADER_VERDICTS = [\n  'corrupt',\n  'clean',\n  'source_unavailable',\n  'undetectable',\n  'error',\n] as const\nexport type EmptyHeaderVerdict = (typeof EMPTY_HEADER_VERDICTS)[number]\n\n/** Statuses audited when the caller doesn't name any. */\nconst DEFAULT_STATUSES: readonly ImportRunStatus[] = ['succeeded']\n\n/** Default cap on runs examined per invocation. */\nconst DEFAULT_LIMIT = 200\n\n/** Hard ceiling on the per-invocation cap. Protects storage from a fat-fingered `--limit`. */\nconst MAX_LIMIT = 5000\n\n/** Hard ceiling on peak concurrent reads. Bounds the burst the item cap alone does not. */\nconst MAX_CONCURRENCY = 16\n\nexport interface InspectImportRunSourceArgs {\n  /** Local path OR storage key, verbatim from `import_run.filePath`. */\n  filePath: string\n  /** The run's persisted reader config (`import_run.params.feed`). */\n  feed: FeedReaderConfig\n  /**\n   * Resolves `filePath` to a readable local path, exactly as the worker does.\n   * Omit when `filePath` is already a local FS path (the on-disk deployments\n   * the worker's no-resolver fallback covers).\n   */\n  resolveFilePath?: FilePathResolver | undefined\n}\n\nexport interface InspectImportRunSourceResult {\n  verdict: EmptyHeaderVerdict\n  /** Human-readable reason. Always set for everything except `clean`. */\n  detail?: string\n}\n\n/** Best-effort message for an unknown thrown value. */\nfunction describeError(err: unknown): string {\n  if (err instanceof Error) return err.message\n  return String(err)\n}\n\n/**\n * Filesystem / object-store errors that mean \"the evidence is not readable\",\n * as distinct from \"the file is readable and its header is bad\".\n *\n * ENOENT is the retention sweep having got there first — the expected outcome\n * for anything older than `processedRetentionDays`. The rest are real\n * deployment conditions rather than theory: the imports directory has had uid\n * drift before (#661's `imports-init` chown), and this audit is run from an\n * operator shell, not under the worker's uid — so EACCES against a file the\n * worker wrote is exactly the shape to expect. All of them are \"cannot decide\",\n * never \"corrupt\".\n */\nconst UNREADABLE_SOURCE_CODES = new Set(['ENOENT', 'EACCES', 'EPERM', 'EISDIR', 'ENOTDIR'])\n\n/**\n * unzipper's error for a zip that ends mid-entry. A half-written retained\n * upload is evidence we cannot read, not a verdict about the run — checked:\n * truncating a workbook at 95% / 60% / 20% all reject cleanly with this rather\n * than crashing or hanging.\n */\nconst TRUNCATED_ARCHIVE_MESSAGE = /FILE_ENDED/\n\nfunction isUnreadableSource(err: unknown, notAFile: new (...args: never[]) => Error): boolean {\n  if (typeof err !== 'object' || err === null) return false\n  // A directory (or socket, or fifo) where a workbook should be. Matched by\n  // TYPE — the reader exports the class precisely so this is not a regex.\n  if (err instanceof notAFile) return true\n  if ('code' in err) {\n    const { code } = err as { code?: unknown }\n    if (typeof code === 'string' && UNREADABLE_SOURCE_CODES.has(code)) return true\n  }\n  return err instanceof Error && TRUNCATED_ARCHIVE_MESSAGE.test(err.message)\n}\n\n/**\n * Re-read ONE run's source file with the patched reader and classify it.\n *\n * Stops pulling rows once the header has been decided — the guard fires while\n * the header is captured, before any data row is yielded, so the first row\n * settles it.\n *\n * That bounds the rows parsed OF THE TARGET SHEET, and nothing else. The\n * resolver has already downloaded the whole object, and `streamXlsx` parses the\n * worksheets after the target on its way out — it has to, or exceljs strands a\n * temp file and an fd per deferred worksheet. So the per-run cost is one file,\n * plus its trailing sheets; what bounds the SWEEP is the item cap and the\n * concurrency cap in `auditEmptyHeaderRuns`.\n */\nexport async function inspectImportRunSource(\n  args: InspectImportRunSourceArgs,\n): Promise<InspectImportRunSourceResult> {\n  const { filePath, feed, resolveFilePath } = args\n\n  // The defect is exceljs-specific: csv/tsv go through csv-parse, which has no\n  // shared-strings table to lose. A run with no persisted `format` defaulted to\n  // tab-delimited in the worker, so absence is a real answer, not a gap.\n  if (feed.format !== 'xlsx') {\n    return {\n      verdict: 'undetectable',\n      detail: `not an xlsx run (format: ${feed.format ?? 'tsv (default)'}) — the defect is exceljs-specific`,\n    }\n  }\n  // With `hasHeader: false` the reader keys rows positionally and never captures\n  // a header, so the guard has nothing to fire on. Say so rather than returning\n  // a `clean` that means \"not checked\".\n  if (feed.hasHeader === false) {\n    return {\n      verdict: 'undetectable',\n      detail: 'run used hasHeader:false — no header row for the guard to test',\n    }\n  }\n\n  // Dynamic import, matching `read-feed.ts`: exceljs is heavy and Node-only,\n  // and this module is reachable from the package's main entry. Bound BEFORE\n  // the resolver runs, so a module-resolution failure cannot strand a tmpfile\n  // the resolver just downloaded — and outside the try below, because `catch`\n  // cannot see a `const` block-scoped to the `try`.\n  const { streamXlsx, XlsxEmptyHeaderError, XlsxNotAFileError } = await import('../xlsx-reader.js')\n\n  let resolved: { localPath: string; cleanup?: (() => Promise<void>) | undefined }\n  try {\n    resolved = resolveFilePath ? await resolveFilePath(filePath) : { localPath: filePath }\n  } catch (err) {\n    // A resolver throw is a storage miss (reaped / deleted / permissions) or a\n    // transport failure. `detail` carries which — a 404 and a connection reset\n    // read very differently to an operator.\n    return { verdict: 'source_unavailable', detail: describeError(err) }\n  }\n\n  try {\n    let sawRow = false\n    for await (const _first of streamXlsx({\n      filePath: resolved.localPath,\n      ...(feed.headerRowIndex !== undefined && { headerRowIndex: feed.headerRowIndex }),\n      ...(feed.sheet !== undefined && { sheet: feed.sheet }),\n    })) {\n      void _first\n      sawRow = true\n      break\n    }\n    if (!sawRow) {\n      // The reader completed without yielding, which means the guard never ran:\n      // an empty worksheet, or a `headerRowIndex` past the last row. Reporting\n      // `clean` here would be the comforting-but-false signal this whole audit\n      // exists to avoid — nothing was verified.\n      return {\n        verdict: 'undetectable',\n        detail: 'file yielded no data rows — the header guard never ran',\n      }\n    }\n    return { verdict: 'clean' }\n  } catch (err) {\n    if (err instanceof XlsxEmptyHeaderError) {\n      return { verdict: 'corrupt', detail: err.message }\n    }\n    if (isUnreadableSource(err, XlsxNotAFileError)) {\n      return { verdict: 'source_unavailable', detail: describeError(err) }\n    }\n    return { verdict: 'error', detail: describeError(err) }\n  } finally {\n    await resolved.cleanup?.().catch(() => {\n      // Best-effort tmpfile removal, same posture as the worker: a failed\n      // cleanup must not turn a read-only audit into a failure. The path is a\n      // /tmp copy the OS reclaims anyway.\n    })\n  }\n}\n\n/**\n * The counters this audit reads out of `import_run.totals`.\n *\n * A LOSSY view, deliberately: `rowsWarned` / `batchesCompleted` /\n * `patchesApplied` / `patchesOrphaned` are dropped rather than passed through,\n * because a report is easier to read for what it needs than for everything the\n * run recorded. Read the `import_run` row itself if you want the rest.\n */\nexport interface RecordedTotals {\n  rowsRead?: number | undefined\n  rowsSucceeded?: number | undefined\n  rowsFailed?: number | undefined\n  rowsSkipped?: number | undefined\n}\n\nfunction readCount(source: Record<string, unknown>, key: string): number | undefined {\n  const value = source[key]\n  return typeof value === 'number' && Number.isFinite(value) ? value : undefined\n}\n\n/** Narrow the opaque `totals` JSONB to the counters this audit reports. */\nexport function readRecordedTotals(raw: unknown): RecordedTotals {\n  if (typeof raw !== 'object' || raw === null || Array.isArray(raw)) return {}\n  const source = raw as Record<string, unknown>\n  return {\n    rowsRead: readCount(source, 'rowsRead'),\n    rowsSucceeded: readCount(source, 'rowsSucceeded'),\n    rowsFailed: readCount(source, 'rowsFailed'),\n    rowsSkipped: readCount(source, 'rowsSkipped'),\n  }\n}\n\nexport interface AuditedImportRun {\n  id: string\n  label: string\n  /** Verbatim `import_run.filePath` — the storage key, so an operator can go look. */\n  filePath: string\n  transformName: string\n  createdAt: Date | null\n  finishedAt: Date | null\n  /** Row counters the run recorded. A corrupted run that recorded a plausible count is the most misleading artefact of all. */\n  totals: RecordedTotals\n  verdict: EmptyHeaderVerdict\n  detail?: string\n  /**\n   * The run finished having read rows but indexed none. Corroborating evidence\n   * that survives the source file being reaped, and the ONLY signal available\n   * for the transient variant of the defect — but it is also what a wrong\n   * column mapping looks like, so it is never folded into the verdict.\n   *\n   * THREE-VALUED on purpose. `'unknown'` means the run recorded no usable\n   * counters (older rows; any run audited with a non-`succeeded` status, since\n   * `markFailed` never writes `totals`). Collapsing that to `false` would render\n   * absence of evidence as evidence of absence — in the one signal that is\n   * supposed to outlive the file.\n   */\n  zeroRowsIndexed: boolean | 'unknown'\n}\n\nexport interface EmptyHeaderAuditReport {\n  /** Total xlsx runs matching the audited statuses. */\n  candidates: number\n  /** How many of them this invocation actually read. */\n  examined: number\n  /** `candidates - examined` — dropped by the cap, newest kept. Never silent: also logged. */\n  notExamined: number\n  counts: Record<EmptyHeaderVerdict, number>\n  /** Every examined run, verdict-annotated, newest first. */\n  runs: AuditedImportRun[]\n}\n\nexport interface AuditEmptyHeaderRunsArgs {\n  /** Toolkit app — provides the app-bound `AdminClient` for `import_run`. */\n  app: ToolkitApp\n  /**\n   * Same resolver the imports plugin hands the worker (typically\n   * `storageResolveFilePath`). Omit only when `filePath` is a local FS path.\n   */\n  resolveFilePath?: FilePathResolver | undefined\n  /** Statuses to audit. Default `['succeeded']` — a failed run announced itself. */\n  statuses?: readonly ImportRunStatus[] | undefined\n  /** Max runs examined, newest first. Default 200, hard ceiling 5000. */\n  limit?: number | undefined\n  /** Peak concurrent storage reads. Default 4, hard ceiling 16. */\n  concurrency?: number | undefined\n  logger: Pick<Logger, 'info' | 'warn'>\n}\n\nfunction emptyCounts(): Record<EmptyHeaderVerdict, number> {\n  return { corrupt: 0, clean: 0, source_unavailable: 0, undetectable: 0, error: 0 }\n}\n\n/**\n * Derive the corroborating flag from whatever counters the run recorded.\n * `rowsRead` is what the reader yielded; `rowsSucceeded` is what the cluster\n * acknowledged. Read-but-none-indexed is the shape a `{}`-row stream leaves\n * behind however the transform rejected it (error OR skip), which is why the\n * test is on succeeded rather than failed.\n */\nfunction deriveZeroRowsIndexed(totals: RecordedTotals): boolean | 'unknown' {\n  if (totals.rowsRead === undefined || totals.rowsSucceeded === undefined) return 'unknown'\n  return totals.rowsRead > 0 && totals.rowsSucceeded === 0\n}\n\n/** Coerce a DTO date field (Date | string | null | undefined) to `Date | null`. */\nfunction toDate(value: unknown): Date | null {\n  if (value instanceof Date) return value\n  if (typeof value === 'string') {\n    const parsed = new Date(value)\n    return Number.isNaN(parsed.getTime()) ? null : parsed\n  }\n  return null\n}\n\n/**\n * Audit past import runs for the silent empty-header corruption.\n *\n * Newest-first, because the answerable window is the recent one — the retention\n * sweep reaps source files ~7 days after a run reaches terminal status by\n * default, so the oldest runs are the ones whose evidence is already gone.\n */\nexport async function auditEmptyHeaderRuns(\n  args: AuditEmptyHeaderRunsArgs,\n): Promise<EmptyHeaderAuditReport> {\n  const { app, resolveFilePath, logger } = args\n  const statuses = args.statuses ?? DEFAULT_STATUSES\n  if (statuses.length === 0) {\n    throw new Error('auditEmptyHeaderRuns: statuses must name at least one import_run status')\n  }\n  const limit = args.limit ?? DEFAULT_LIMIT\n  if (!Number.isInteger(limit) || limit < 1 || limit > MAX_LIMIT) {\n    throw new Error(\n      `auditEmptyHeaderRuns: limit must be an integer in [1, ${MAX_LIMIT}] (got ${limit})`,\n    )\n  }\n  // Concurrency needs its own ceiling, not just `runBounded`'s\n  // positive-integer check: `{ limit: 5000, concurrency: 5000 }` type-checks and\n  // is a 5000-wide burst at object storage, which is the amplification the item\n  // cap alone does not prevent.\n  const concurrency = args.concurrency ?? DEFAULT_BOUNDED_CONCURRENCY\n  if (!Number.isInteger(concurrency) || concurrency < 1 || concurrency > MAX_CONCURRENCY) {\n    throw new Error(\n      `auditEmptyHeaderRuns: concurrency must be an integer in [1, ${MAX_CONCURRENCY}] (got ${concurrency})`,\n    )\n  }\n\n  const client = app.getClient(ImportRun)\n\n  const { and, desc, getTableColumns, inArray, sql } = await import('drizzle-orm')\n  type AnyPgColumn = import('drizzle-orm/pg-core').AnyPgColumn\n\n  // `getTableColumns` rather than dot-access: the entity table is a generic\n  // PgTable, so direct access widens every column to `T | undefined` (same\n  // shape the cleanup helpers use).\n  const cols = getTableColumns(client.getTable()) as Record<string, AnyPgColumn>\n  const statusCol = cols.status\n  const paramsCol = cols.params\n  const createdAtCol = cols.createdAt\n  if (!statusCol || !paramsCol || !createdAtCol) {\n    throw new Error(\n      'auditEmptyHeaderRuns: import_run schema missing expected columns (status/params/createdAt)',\n    )\n  }\n\n  // Narrow to xlsx runs IN SQL rather than paging every run and filtering in\n  // JS — otherwise the `limit` cap would be spent on tsv rows and a deployment\n  // with a long carmaker history would examine nothing. `params` is jsonb, and\n  // a JSONB operator inside Drizzle's typed builder is the sanctioned use of\n  // the `sql` template (CLAUDE.md \"Database Queries\" rule 5): the column ref is\n  // a typed Drizzle object and the compared value is bound as a parameter. The\n  // key path mirrors the worker's `params.feed` rehydration exactly.\n  const where = and(\n    inArray(statusCol, [...statuses]),\n    sql`${paramsCol}->'feed'->>'format' = ${'xlsx'}`,\n  )\n\n  const candidates = await client.count({ where })\n  const rows = await client.findMany({ where, orderBy: desc(createdAtCol), limit })\n\n  const notExamined = Math.max(0, candidates - rows.length)\n  if (notExamined > 0) {\n    logger.warn(\n      { candidates, examined: rows.length, notExamined, limit },\n      'imports audit: capped at the most recent runs — re-run with a higher limit to cover the rest',\n    )\n  }\n  if (rows.length === 0) {\n    logger.info({ statuses }, 'imports audit: no xlsx runs to audit')\n    return { candidates, examined: 0, notExamined, counts: emptyCounts(), runs: [] }\n  }\n\n  logger.info(\n    { candidates, examining: rows.length, concurrency },\n    'imports audit: re-reading source files for the empty-header defect',\n  )\n\n  const audited = await runBounded(\n    rows,\n    async (row): Promise<AuditedImportRun> => {\n      // `filePath` / `label` / `transformName` are `required: true`, so the\n      // inferred DTO already types them as `string`. `totals` is `field.json()`.\n      const filePath = row.filePath\n      const totals = readRecordedTotals(row.totals)\n      const base = {\n        id: row.id,\n        label: row.label,\n        filePath,\n        transformName: row.transformName,\n        createdAt: toDate(row.createdAt),\n        finishedAt: toDate(row.finishedAt),\n        totals,\n        zeroRowsIndexed: deriveZeroRowsIndexed(totals),\n      }\n\n      // EVERY per-item failure degrades THIS run to `error` and no further.\n      // `runBounded` rejects on the first worker rejection, so an unhandled\n      // throw here would discard all N results — and the report is the entire\n      // product of this function.\n      try {\n        // Rehydrated through the SAME helper the worker uses, so the audit\n        // cannot re-read a run with options that run never used.\n        const feedParsed = readPersistedFeedConfig(row.params)\n        if (!feedParsed.success) {\n          const reason = feedParsed.error.issues[0]?.message ?? 'invalid feed reader config'\n          return { ...base, verdict: 'error', detail: `invalid params.feed: ${reason}` }\n        }\n\n        const result = await inspectImportRunSource({\n          filePath,\n          feed: feedParsed.data,\n          ...(resolveFilePath !== undefined && { resolveFilePath }),\n        })\n        return {\n          ...base,\n          verdict: result.verdict,\n          ...(result.detail !== undefined && { detail: result.detail }),\n        }\n      } catch (err) {\n        return { ...base, verdict: 'error', detail: describeError(err) }\n      }\n    },\n    concurrency,\n  )\n\n  const counts = emptyCounts()\n  for (const run of audited) {\n    counts[run.verdict] += 1\n    if (run.verdict === 'corrupt') {\n      logger.warn(\n        {\n          importRunId: run.id,\n          label: run.label,\n          filePath: run.filePath,\n          transformName: run.transformName,\n          createdAt: run.createdAt,\n          totals: run.totals,\n        },\n        'imports audit: SILENTLY CORRUPTED run — its source file has no readable header',\n      )\n    }\n  }\n\n  const zeroRowsIndexed = audited.filter((run) => run.zeroRowsIndexed === true).length\n  const totalsUnknown = audited.filter((run) => run.zeroRowsIndexed === 'unknown').length\n\n  // A run of nothing but `source_unavailable` usually means the audit was\n  // pointed at storage keys with no resolver, not that a week of evidence\n  // evaporated. Those read identically in the report, so say which is likelier.\n  if (resolveFilePath === undefined && counts.source_unavailable === audited.length) {\n    logger.warn(\n      { examined: audited.length },\n      'imports audit: every source was unreadable and no resolveFilePath was given — ' +\n        'if filePath holds storage keys rather than local paths, pass storageResolveFilePath',\n    )\n  }\n\n  logger.info(\n    {\n      candidates,\n      examined: audited.length,\n      notExamined,\n      ...counts,\n      zeroRowsIndexed,\n      totalsUnknown,\n    },\n    'imports audit: complete',\n  )\n\n  return { candidates, examined: audited.length, notExamined, counts, runs: audited }\n}\n","/**\n * `previewFeed` — read the first N data rows of a feed for the PR3 import wizard\n * (commerce-demo phase 02 §4). Reuses {@link readFeed} so the preview is parsed by\n * the EXACT same reader (csv-parse / exceljs), with the same delimiter / header /\n * sheet config, that the run will use — the operator maps against what they'll get,\n * not a re-implemented best-guess parser (R02: drift between preview + run is a\n * mapping foot-gun).\n *\n * Bounded: it consumes only `maxRows` rows then stops iterating, so on a delimited\n * feed it streams a tiny prefix rather than the whole file. (The caller materialises\n * the storage object to a local path first — see the commerce preview route — so for\n * a very large upload the materialise cost dominates; that's a demo-depth trade-off,\n * noted on the route.)\n */\n\nimport { type ReadFeedOptions, readFeed } from './read-feed.js'\n\n/** Hard ceiling on preview rows regardless of caller request — bounds work + payload. */\nexport const MAX_PREVIEW_ROWS = 100\n/** Default sample size when the caller doesn't specify. */\nexport const DEFAULT_PREVIEW_ROWS = 20\n\nexport interface PreviewFeedOptions extends ReadFeedOptions {\n  /** Rows to sample. Defaults to {@link DEFAULT_PREVIEW_ROWS}; clamped to [1, {@link MAX_PREVIEW_ROWS}]. */\n  maxRows?: number\n}\n\nexport interface FeedPreview {\n  /**\n   * Source column names in first-seen order. With a header these are the (trimmed)\n   * header names; headerless feeds yield positional `\"0\"`, `\"1\"`, … keys. The union\n   * across sampled rows covers feeds whose first row omits trailing empty cells.\n   */\n  columns: string[]\n  /** Up to `maxRows` sampled data rows, each a `{ column → cell }` map (cells are strings). */\n  rows: Array<Record<string, string>>\n}\n\n/**\n * Read up to `maxRows` data rows from a feed file and return the detected columns +\n * sample rows. Throws whatever the underlying reader throws (bad sheet index,\n * duplicate header, unreadable file) — the caller maps that to a 4xx.\n */\nexport async function previewFeed(options: PreviewFeedOptions): Promise<FeedPreview> {\n  const { maxRows, ...feedOptions } = options\n  // Coerce to a finite integer BEFORE clamping: `previewFeed` is public API, so a\n  // caller passing `NaN`/`Infinity`/fractional must not slip through. `NaN` in\n  // particular would make `rows.length >= limit` always false → read the whole file.\n  const requested = maxRows ?? DEFAULT_PREVIEW_ROWS\n  const safeRows = Number.isFinite(requested) ? Math.floor(requested) : DEFAULT_PREVIEW_ROWS\n  const limit = Math.min(MAX_PREVIEW_ROWS, Math.max(1, safeRows))\n\n  const rows: Array<Record<string, string>> = []\n  // First-seen-order column set: a Map preserves insertion order and dedupes.\n  const columns = new Map<string, true>()\n\n  // Preview is EXPLORATORY — force lenient column counts (csv/tsv). With the wrong\n  // delimiter a feed parses as a single odd column, OR a row's field count differs\n  // from the header; strict parsing would abort the whole preview with a cryptic\n  // \"Invalid Record Length\" instead of letting the operator SEE the bad parse and\n  // fix the delimiter/format, then re-preview. The actual run keeps its own\n  // (stricter) settings.\n  for await (const { row } of readFeed({ ...feedOptions, relaxColumnCount: true })) {\n    for (const key of Object.keys(row)) columns.set(key, true)\n    rows.push(row)\n    if (rows.length >= limit) break\n  }\n\n  return { columns: [...columns.keys()], rows }\n}\n"],"mappings":"kVA8EA,MAAa,EAAwB,CACnC,UACA,QACA,qBACA,eACA,OACF,EAIM,EAA+C,CAAC,WAAW,EAM3D,EAAY,IAyBlB,SAAS,EAAc,EAAsB,CAE3C,OADI,aAAe,MAAc,EAAI,QAC9B,OAAO,CAAG,CACnB,CAcA,MAAM,EAA0B,IAAI,IAAI,CAAC,SAAU,SAAU,QAAS,SAAU,SAAS,CAAC,EAQpF,EAA4B,aAElC,SAAS,EAAmB,EAAc,EAAoD,CAC5F,GAAI,OAAO,GAAQ,WAAY,EAAc,MAAO,GAGpD,GAAI,aAAe,EAAU,MAAO,GACpC,GAAI,SAAU,EAAK,CACjB,GAAM,CAAE,QAAS,EACjB,GAAI,OAAO,GAAS,UAAY,EAAwB,IAAI,CAAI,EAAG,MAAO,EAC5E,CACA,OAAO,aAAe,OAAS,EAA0B,KAAK,EAAI,OAAO,CAC3E,CAgBA,eAAsB,EACpB,EACuC,CACvC,GAAM,CAAE,WAAU,OAAM,mBAAoB,EAK5C,GAAI,EAAK,SAAW,OAClB,MAAO,CACL,QAAS,eACT,OAAQ,4BAA4B,EAAK,QAAU,gBAAgB,mCACrE,EAKF,GAAI,EAAK,YAAc,GACrB,MAAO,CACL,QAAS,eACT,OAAQ,gEACV,EAQF,GAAM,CAAE,aAAY,uBAAsB,qBAAsB,MAAM,OAAO,8BAEzE,EACJ,GAAI,CACF,EAAW,EAAkB,MAAM,EAAgB,CAAQ,EAAI,CAAE,UAAW,CAAS,CACvF,OAAS,EAAK,CAIZ,MAAO,CAAE,QAAS,qBAAsB,OAAQ,EAAc,CAAG,CAAE,CACrE,CAEA,GAAI,CACF,IAAI,EAAS,GACb,UAAW,IAAM,KAAU,EAAW,CACpC,SAAU,EAAS,UACnB,GAAI,EAAK,iBAAmB,IAAA,IAAa,CAAE,eAAgB,EAAK,cAAe,EAC/E,GAAI,EAAK,QAAU,IAAA,IAAa,CAAE,MAAO,EAAK,KAAM,CACtD,CAAC,EAAG,CAEF,EAAS,GACT,KACF,CAWA,OAVK,EAUE,CAAE,QAAS,OAAQ,EALjB,CACL,QAAS,eACT,OAAQ,wDACV,CAGJ,OAAS,EAAK,CAOZ,OANI,aAAe,EACV,CAAE,QAAS,UAAW,OAAQ,EAAI,OAAQ,EAE/C,EAAmB,EAAK,CAAiB,EACpC,CAAE,QAAS,qBAAsB,OAAQ,EAAc,CAAG,CAAE,EAE9D,CAAE,QAAS,QAAS,OAAQ,EAAc,CAAG,CAAE,CACxD,QAAU,CACR,MAAM,EAAS,UAAU,CAAC,CAAC,UAAY,CAIvC,CAAC,CACH,CACF,CAiBA,SAAS,EAAU,EAAiC,EAAiC,CACnF,IAAM,EAAQ,EAAO,GACrB,OAAO,OAAO,GAAU,UAAY,OAAO,SAAS,CAAK,EAAI,EAAQ,IAAA,EACvE,CAGA,SAAgB,EAAmB,EAA8B,CAC/D,GAAI,OAAO,GAAQ,WAAY,GAAgB,MAAM,QAAQ,CAAG,EAAG,MAAO,CAAC,EAC3E,IAAM,EAAS,EACf,MAAO,CACL,SAAU,EAAU,EAAQ,UAAU,EACtC,cAAe,EAAU,EAAQ,eAAe,EAChD,WAAY,EAAU,EAAQ,YAAY,EAC1C,YAAa,EAAU,EAAQ,aAAa,CAC9C,CACF,CA0DA,SAAS,GAAkD,CACzD,MAAO,CAAE,QAAS,EAAG,MAAO,EAAG,mBAAoB,EAAG,aAAc,EAAG,MAAO,CAAE,CAClF,CASA,SAAS,EAAsB,EAA6C,CAE1E,OADI,EAAO,WAAa,IAAA,IAAa,EAAO,gBAAkB,IAAA,GAAkB,UACzE,EAAO,SAAW,GAAK,EAAO,gBAAkB,CACzD,CAGA,SAAS,EAAO,EAA6B,CAC3C,GAAI,aAAiB,KAAM,OAAO,EAClC,GAAI,OAAO,GAAU,SAAU,CAC7B,IAAM,EAAS,IAAI,KAAK,CAAK,EAC7B,OAAO,OAAO,MAAM,EAAO,QAAQ,CAAC,EAAI,KAAO,CACjD,CACA,OAAO,IACT,CASA,eAAsB,EACpB,EACiC,CACjC,GAAM,CAAE,MAAK,kBAAiB,UAAW,EACnC,EAAW,EAAK,UAAY,EAClC,GAAI,EAAS,SAAW,EACtB,MAAU,MAAM,yEAAyE,EAE3F,IAAM,EAAQ,EAAK,OAAS,IAC5B,GAAI,CAAC,OAAO,UAAU,CAAK,GAAK,EAAQ,GAAK,EAAQ,EACnD,MAAU,MACR,yDAAyD,EAAU,SAAS,EAAM,EACpF,EAMF,IAAM,EAAc,EAAK,aAAe,EACxC,GAAI,CAAC,OAAO,UAAU,CAAW,GAAK,EAAc,GAAK,EAAc,GACrE,MAAU,MACR,wEAAwF,EAAY,EACtG,EAGF,IAAM,EAAS,EAAI,UAAU,CAAS,EAEhC,CAAE,MAAK,OAAM,kBAAiB,UAAS,OAAQ,MAAM,OAAO,eAM5D,EAAO,EAAgB,EAAO,SAAS,CAAC,EACxC,EAAY,EAAK,OACjB,EAAY,EAAK,OACjB,EAAe,EAAK,UAC1B,GAAI,CAAC,GAAa,CAAC,GAAa,CAAC,EAC/B,MAAU,MACR,4FACF,EAUF,IAAM,EAAQ,EACZ,EAAQ,EAAW,CAAC,GAAG,CAAQ,CAAC,EAChC,CAAG,GAAG,EAAU,wBAAwB,QAC1C,EAEM,EAAa,MAAM,EAAO,MAAM,CAAE,OAAM,CAAC,EACzC,EAAO,MAAM,EAAO,SAAS,CAAE,QAAO,QAAS,EAAK,CAAY,EAAG,OAAM,CAAC,EAE1E,EAAc,KAAK,IAAI,EAAG,EAAa,EAAK,MAAM,EAOxD,GANI,EAAc,GAChB,EAAO,KACL,CAAE,aAAY,SAAU,EAAK,OAAQ,cAAa,OAAM,EACxD,8FACF,EAEE,EAAK,SAAW,EAElB,OADA,EAAO,KAAK,CAAE,UAAS,EAAG,sCAAsC,EACzD,CAAE,aAAY,SAAU,EAAG,cAAa,OAAQ,EAAY,EAAG,KAAM,CAAC,CAAE,EAGjF,EAAO,KACL,CAAE,aAAY,UAAW,EAAK,OAAQ,aAAY,EAClD,oEACF,EAEA,IAAM,EAAU,MAAM,EACpB,EACA,KAAO,IAAmC,CAGxC,IAAM,EAAW,EAAI,SACf,EAAS,EAAmB,EAAI,MAAM,EACtC,EAAO,CACX,GAAI,EAAI,GACR,MAAO,EAAI,MACX,WACA,cAAe,EAAI,cACnB,UAAW,EAAO,EAAI,SAAS,EAC/B,WAAY,EAAO,EAAI,UAAU,EACjC,SACA,gBAAiB,EAAsB,CAAM,CAC/C,EAMA,GAAI,CAGF,IAAM,EAAa,EAAwB,EAAI,MAAM,EACrD,GAAI,CAAC,EAAW,QAAS,CACvB,IAAM,EAAS,EAAW,MAAM,OAAO,EAAE,EAAE,SAAW,6BACtD,MAAO,CAAE,GAAG,EAAM,QAAS,QAAS,OAAQ,wBAAwB,GAAS,CAC/E,CAEA,IAAM,EAAS,MAAM,EAAuB,CAC1C,WACA,KAAM,EAAW,KACjB,GAAI,IAAoB,IAAA,IAAa,CAAE,iBAAgB,CACzD,CAAC,EACD,MAAO,CACL,GAAG,EACH,QAAS,EAAO,QAChB,GAAI,EAAO,SAAW,IAAA,IAAa,CAAE,OAAQ,EAAO,MAAO,CAC7D,CACF,OAAS,EAAK,CACZ,MAAO,CAAE,GAAG,EAAM,QAAS,QAAS,OAAQ,EAAc,CAAG,CAAE,CACjE,CACF,EACA,CACF,EAEM,EAAS,EAAY,EAC3B,IAAK,IAAM,KAAO,EAChB,EAAO,EAAI,UAAY,EACnB,EAAI,UAAY,WAClB,EAAO,KACL,CACE,YAAa,EAAI,GACjB,MAAO,EAAI,MACX,SAAU,EAAI,SACd,cAAe,EAAI,cACnB,UAAW,EAAI,UACf,OAAQ,EAAI,MACd,EACA,gFACF,EAIJ,IAAM,EAAkB,EAAQ,OAAQ,GAAQ,EAAI,kBAAoB,EAAI,CAAC,CAAC,OACxE,EAAgB,EAAQ,OAAQ,GAAQ,EAAI,kBAAoB,SAAS,CAAC,CAAC,OAyBjF,OApBI,IAAoB,IAAA,IAAa,EAAO,qBAAuB,EAAQ,QACzE,EAAO,KACL,CAAE,SAAU,EAAQ,MAAO,EAC3B,mKAEF,EAGF,EAAO,KACL,CACE,aACA,SAAU,EAAQ,OAClB,cACA,GAAG,EACH,kBACA,eACF,EACA,yBACF,EAEO,CAAE,aAAY,SAAU,EAAQ,OAAQ,cAAa,SAAQ,KAAM,CAAQ,CACpF,CC3gBA,MAAa,EAAmB,IAEnB,EAAuB,GAuBpC,eAAsB,EAAY,EAAmD,CACnF,GAAM,CAAE,UAAS,GAAG,GAAgB,EAI9B,EAAY,GAAA,GAEZ,EAAQ,KAAK,IAAA,IAAsB,KAAK,IAAI,EADjC,OAAO,SAAS,CAAS,EAAI,KAAK,MAAM,CAAS,EAAA,EACL,CAAC,EAExD,EAAsC,CAAC,EAEvC,EAAU,IAAI,IAQpB,UAAW,GAAM,CAAE,SAAS,EAAS,CAAE,GAAG,EAAa,iBAAkB,EAAK,CAAC,EAAG,CAChF,IAAK,IAAM,KAAO,OAAO,KAAK,CAAG,EAAG,EAAQ,IAAI,EAAK,EAAI,EAEzD,GADA,EAAK,KAAK,CAAG,EACT,EAAK,QAAU,EAAO,KAC5B,CAEA,MAAO,CAAE,QAAS,CAAC,GAAG,EAAQ,KAAK,CAAC,EAAG,MAAK,CAC9C"}

package/dist/plugin.d.mts

@@ -1,4 +1,4 @@
-import { n as EsClientResolver, r as FilePathResolver, s as PairSink, t as EnsureIndexResolver } from "./worker-CA4jf4BA.mjs";
+import { n as EsClientResolver, r as FilePathResolver, s as PairSink, t as EnsureIndexResolver } from "./worker-ZWkDs7gz.mjs";
 import { ImportsStorageFactory } from "./storage.mjs";
 
 //#region src/plugin.d.ts
@@ -73,7 +73,7 @@ interface ImportsPluginOptions {
    * `toolkit_files` with this bucket value AND no matching
    * `import_run.filePath` AND `createdAt < cutoff` get garbage-
    * collected on each cleanup tick. Defaults to `'lumi-imports'` —
-   * the convention `apps/admin-playground/lib/imports-storage.ts`
+   * the convention `apps/admin/lib/imports-storage.ts`
    * uses by default. Override if your deployment pins a different
    * bucket name via `IMPORTS_STORAGE_BUCKET` or equivalent.
    *

package/dist/plugin.mjs

@@ -1,2 +1,2 @@
-import{registerImportsStorageFactory as e}from"./storage.mjs";import{a as t,l as n,n as r}from"./transform-BCMEEIMe.mjs";import{n as i,t as a}from"./mapping-transform-D9n8D-Fo.mjs";import{r as o,t as s}from"./carmaker-feed-DtfAYS1P.mjs";import{createImportsRunDeadListener as c,createRunImportHandler as l,importsRunJob as u}from"./worker.mjs";import{definePlugin as d}from"@murumets-ee/core";const f=Symbol.for(`@murumets-ee/imports:dead-listener-unsubscribe`);function p(p){let m=p.esIndex??`parts`,h=p.storageBucket===null?null:{bucket:p.storageBucket??`lumi-imports`,orphanTtlHours:p.orphanUploadTtlHours??2,processedRetentionDays:p.processedRetentionDays??7};return p.storage&&e(p.storage),d({name:`@murumets-ee/imports`,server:{entities:[t,n],init:async e=>{let n=r();if(n.has(`commerce:mapping`)||n.register(a,i),n.has(`commerce:carmaker-feed`)||n.register(s,o),!e.plugins.all().some(e=>e.name===`@murumets-ee/queue`)){e.logger.warn(`imports: queue() plugin not in plugins array — imports:run jobs will not be processed`);return}let d=await import(`@murumets-ee/queue/client`),g=e.getClient(t);d.registerJob(u,l({importRuns:g,transforms:n,esClient:p.esClient,esIndex:m,...p.ensureIndex!==void 0&&{ensureIndex:p.ensureIndex},...p.resolveFilePath!==void 0&&{resolveFilePath:p.resolveFilePath},...p.pairSink!==void 0&&{pairSink:p.pairSink},logger:e.logger.child({pkg:`imports`})}));let _=globalThis[f];_&&_();let v=d.addQueueTerminalListener(c({importRuns:g,logger:e.logger.child({pkg:`imports`})}));if(globalThis[f]=v,h!==null){let{cleanupOrphanedImports:t,cleanupProcessedImports:n}=await import(`./cleanup-DY_bZ5LK.mjs`).then(e=>e.r),{runAsCli:r}=await import(`@murumets-ee/core`),i=e.logger.child({pkg:`imports`,job:`cleanup`});d.registerJob(d.defineJob({name:`imports:cleanup-orphaned-uploads`,description:`Delete toolkit_files rows in the imports bucket with no matching import_run reference and createdAt older than the configured TTL.`,schedule:`@every 1h`}),async()=>{await r(()=>t({app:e,bucket:h.bucket,ttlHours:h.orphanTtlHours,logger:i}))}),d.registerJob(d.defineJob({name:`imports:cleanup-processed-uploads`,description:`Delete toolkit_files rows for import_runs in terminal status (succeeded/failed/cancelled) whose finishedAt is older than the configured retention window. The import_run row itself is preserved.`,schedule:`@every 1h`}),async()=>{await r(()=>n({app:e,bucket:h.bucket,retentionDays:h.processedRetentionDays,logger:i}))})}e.logger.info({esIndex:m,cleanup:h===null?{enabled:!1}:{enabled:!0,...h}},`Imports plugin initialized`)}}})}export{p as imports};
+import{n as e,o as t,u as n}from"./transform-D7uHod4E.mjs";import{registerImportsStorageFactory as r}from"./storage.mjs";import{n as i,t as a}from"./mapping-transform-D9n8D-Fo.mjs";import{r as o,t as s}from"./carmaker-feed-DtfAYS1P.mjs";import{createImportsRunDeadListener as c,createRunImportHandler as l,importsRunJob as u}from"./worker.mjs";import{definePlugin as d}from"@murumets-ee/core";const f=Symbol.for(`@murumets-ee/imports:dead-listener-unsubscribe`);function p(p){let m=p.esIndex??`parts`,h=p.storageBucket===null?null:{bucket:p.storageBucket??`lumi-imports`,orphanTtlHours:p.orphanUploadTtlHours??2,processedRetentionDays:p.processedRetentionDays??7};return p.storage&&r(p.storage),d({name:`@murumets-ee/imports`,server:{entities:[n,t],init:async t=>{let r=e();if(r.has(`commerce:mapping`)||r.register(a,i),r.has(`commerce:carmaker-feed`)||r.register(s,o),!t.plugins.all().some(e=>e.name===`@murumets-ee/queue`)){t.logger.warn(`imports: queue() plugin not in plugins array — imports:run jobs will not be processed`);return}let d=await import(`@murumets-ee/queue/client`),g=t.getClient(n);d.registerJob(u,l({importRuns:g,transforms:r,esClient:p.esClient,esIndex:m,...p.ensureIndex!==void 0&&{ensureIndex:p.ensureIndex},...p.resolveFilePath!==void 0&&{resolveFilePath:p.resolveFilePath},...p.pairSink!==void 0&&{pairSink:p.pairSink},logger:t.logger.child({pkg:`imports`})}));let _=globalThis[f];_&&_();let v=d.addQueueTerminalListener(c({importRuns:g,logger:t.logger.child({pkg:`imports`})}));if(globalThis[f]=v,h!==null){let{cleanupOrphanedImports:e,cleanupProcessedImports:n}=await import(`./cleanup-CUfYcxFc.mjs`).then(e=>e.r),{runAsCli:r}=await import(`@murumets-ee/core`),i=t.logger.child({pkg:`imports`,job:`cleanup`});d.registerJob(d.defineJob({name:`imports:cleanup-orphaned-uploads`,description:`Delete toolkit_files rows in the imports bucket with no matching import_run reference and createdAt older than the configured TTL.`,schedule:`@every 1h`}),async()=>{await r(()=>e({app:t,bucket:h.bucket,ttlHours:h.orphanTtlHours,logger:i}))}),d.registerJob(d.defineJob({name:`imports:cleanup-processed-uploads`,description:`Delete toolkit_files rows for import_runs in terminal status (succeeded/failed/cancelled) whose finishedAt is older than the configured retention window. The import_run row itself is preserved.`,schedule:`@every 1h`}),async()=>{await r(()=>n({app:t,bucket:h.bucket,retentionDays:h.processedRetentionDays,logger:i}))})}t.logger.info({esIndex:m,cleanup:h===null?{enabled:!1}:{enabled:!0,...h}},`Imports plugin initialized`)}}})}export{p as imports};
 //# sourceMappingURL=plugin.mjs.map

package/dist/plugin.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.mjs","names":[],"sources":["../src/plugin.ts"],"sourcesContent":["/**\n * Imports plugin — registers the `import_run` entity and (when ES + queue\n * are wired) registers the `imports:run` job handler.\n *\n * Per PLAN-ECOMMERCE.md PR 7 (PoC scope): plumbing only. The bespoke\n * admin pages (upload form, parts search) live in PR 8a.\n *\n * **Built-in transforms register HERE, at plugin init.** Both transforms\n * this package ships (`commerce:mapping`, `commerce:carmaker-feed`) go\n * into the process-global registry inside `init`, so every process that\n * boots the plugin — Next.js web server, standalone queue worker — can\n * dispatch them with zero app-side wiring. Registration used to be the\n * app's job (`lib/app.ts` calling `registry.register(...)`), which is\n * exactly the drift foot-gun CLAUDE.md's \"no forgotten registrations\"\n * rule warns about: an app scaffolded before the mapping transform\n * existed keeps its old `lib/app.ts` through `pnpm up` toolkit upgrades,\n * and every mapping-driven run then dies in the worker with\n * `No transform registered for name \"commerce:mapping\"`. App-side\n * registration remains harmless even when unguarded —\n * `registerImportTransform` overwrites last-wins instead of throwing —\n * it is just no longer required.\n *\n * @example\n * ```ts\n * import { defineLumiConfig } from '@murumets-ee/core'\n * import { imports } from '@murumets-ee/imports/plugin'\n * import { Client } from '@elastic/elasticsearch'\n *\n * const es = new Client({ node: process.env.ES_URL })\n *\n * export default defineLumiConfig({\n *   plugins: [\n *     // queue() must be present too — it runs the imports:run jobs.\n *     queue(),\n *     imports({ esClient: () => es, esIndex: 'parts' }),\n *   ],\n * })\n * ```\n */\n\nimport { definePlugin } from '@murumets-ee/core'\n// **Why no static `@murumets-ee/core/clients` import in this file.**\n//\n// `@murumets-ee/core/clients` begins with `import 'server-only'`, which\n// throws when this plugin module is loaded at `lumi.config.ts`\n// evaluation time by the CLI (`lumi migrate`/`seed`/`doctor` use jiti,\n// which doesn't apply the `react-server` export condition).\n// Static-importing would propagate that throw all the way through\n// `lumi.config.ts` → CLI startup, blocking every CLI invocation.\n//\n// **Today (after PLAN-DECLARATIVE-PLUGINS PR 2):** plugin `init`\n// reaches `AdminClient` via the framework-provided `app.getClient(\n// entity)` accessor — no `createAdminClient` call, no dynamic import\n// either. The remaining `@murumets-ee/core/clients` dependency lives\n// in `./admin/cleanup.js`, which IS still dynamic-imported inside\n// `init` and which still benefits from this rationale. The pattern\n// matches `getDb()` in `@murumets-ee/queue/admin.ts`.\nimport { ImportMapping } from './entities/import-mapping.js'\nimport { ImportRun } from './entities/import-run.js'\nimport { MAPPING_TRANSFORM_NAME, mappingTransform } from './mapping/mapping-transform.js'\nimport { type ImportsStorageFactory, registerImportsStorageFactory } from './storage.js'\nimport { getTransformRegistry } from './transform.js'\nimport { CARMAKER_FEED_TRANSFORM_NAME, carmakerFeedTransform } from './transforms/carmaker-feed.js'\nimport {\n  createImportsRunDeadListener,\n  createRunImportHandler,\n  type EnsureIndexResolver,\n  type EsClientResolver,\n  type FilePathResolver,\n  importsRunJob,\n  type PairSink,\n} from './worker.js'\n\n/**\n * `Symbol.for`-keyed slot for the active dead-listener unsubscribe\n * handle. Symbol.for so an HMR-replaced module instance still finds\n * the previous unsubscribe (`Symbol`-by-reference would skip the\n * lookup across module-evaluation boundaries). Same pattern as\n * `transform.ts`'s registry slot and `storage.ts`'s factory slot.\n */\nconst IMPORTS_DEAD_LISTENER_KEY = Symbol.for('@murumets-ee/imports:dead-listener-unsubscribe')\n\ninterface GlobalThisWithUnsubscribe {\n  [IMPORTS_DEAD_LISTENER_KEY]?: () => void\n}\n\nexport interface ImportsPluginOptions {\n  /**\n   * Elasticsearch client resolver. Lazy so consumers can construct\n   * the client inside a route initialiser instead of at plugin-init\n   * time. Required — without it, the worker can't bulk-write.\n   */\n  esClient: EsClientResolver\n  /**\n   * ES index alias to write to. Defaults to `'parts'` (the\n   * `PARTS_INDEX_ALIAS` re-exported from `@murumets-ee/search-elasticsearch`,\n   * inlined here to avoid a runtime import for a one-line constant).\n   * Per D6 always pass an alias, never a physical index.\n   */\n  esIndex?: string\n  /**\n   * Optional bootstrap for the destination index/alias, run once per import\n   * job before any bulk-write (see {@link EnsureIndexResolver}). Wire your\n   * app's `ensureAliasedIndex`-backed helper here so the worker can never\n   * auto-create a mis-mapped physical index — WITHOUT gating app boot on ES.\n   *\n   * Omit only when the index is bootstrapped out-of-band; without it a\n   * first-ever import against an unbootstrapped alias lets ES auto-create a\n   * `text`-mapped physical index, breaking aggregations (issue #610).\n   */\n  ensureIndex?: EnsureIndexResolver\n  /**\n   * Resolve `import_run.filePath` to a local FS path before streaming.\n   * **Required when uploads land in remote storage** (R2/S3/etc.) —\n   * without it, the worker hands the storage key to `createReadStream`\n   * and crashes with `ENOENT`.\n   *\n   * Typical wiring downloads the storage object to a tmpfile and\n   * returns its path; the optional `cleanup` callback runs after the\n   * run finishes (success or failure).\n   *\n   * Omit this option for the original on-disk PoC setup where the\n   * upload route writes directly to a local directory and persists\n   * the absolute path on `import_run.filePath`.\n   */\n  resolveFilePath?: FilePathResolver\n  /**\n   * Optional consumer for the directional supersession pairs the runner harvests as\n   * a side-output (commerce-demo PR6, SD007). The app composes it — commerce exports\n   * the replacement-merge sink and passes it here, same injection shape as\n   * {@link esClient} / {@link resolveFilePath}. Omit when not ingesting replacement\n   * codes; the pairs are then discarded after the run.\n   */\n  pairSink?: PairSink\n  /**\n   * Optional dedicated `StorageClient` factory for imports. When\n   * provided, the upload route (in `@murumets-ee/commerce`) and the\n   * worker resolver consult this client instead of the global\n   * `getStorageConfig()` default — so a deployment can pin imports\n   * to a local-disk adapter (single-VPS / dev) while media,\n   * ticketing attachments, and the rest of the app keep using the\n   * default R2 (or S3) adapter.\n   *\n   * Lazy / async so consumers can defer adapter construction until\n   * the first import — useful when the local-disk root is\n   * environment-dependent or when the factory needs `getApp()` to\n   * have resolved.\n   *\n   * Omit to keep the legacy single-storage behaviour (everything on\n   * the global default).\n   */\n  storage?: ImportsStorageFactory\n  /**\n   * Bucket name to scope the orphan-cleanup queue job. Rows in\n   * `toolkit_files` with this bucket value AND no matching\n   * `import_run.filePath` AND `createdAt < cutoff` get garbage-\n   * collected on each cleanup tick. Defaults to `'lumi-imports'` —\n   * the convention `apps/admin-playground/lib/imports-storage.ts`\n   * uses by default. Override if your deployment pins a different\n   * bucket name via `IMPORTS_STORAGE_BUCKET` or equivalent.\n   *\n   * Set to `null` to DISABLE the cleanup job entirely (e.g. for\n   * deployments that handle their own retention via S3 lifecycle\n   * rules). Disabling without an alternative will leak storage\n   * over time as failed uploads accumulate.\n   */\n  storageBucket?: string | null\n  /**\n   * Hours after which an unreferenced `toolkit_files` row in the\n   * imports bucket is considered orphaned and deleted by the\n   * cleanup job. Default 2h — long enough that a normal\n   * upload-then-register round-trip never wipes a fresh upload,\n   * short enough that storage waste from failed uploads doesn't\n   * accumulate.\n   *\n   * The upload→register flow happens client-side automatically (no\n   * \"operator clicks register\" step in the current UI), so the TTL\n   * just needs to cover network blips + retries. Bumping the TTL\n   * is safe if your operators commonly upload then wait before\n   * processing.\n   */\n  orphanUploadTtlHours?: number\n  /**\n   * Days after which a terminal-status `import_run`'s source file is\n   * deleted from `toolkit_files`. Default 7 days — gives operators a\n   * reprocess window if a transform bug surfaces post-success, while\n   * keeping storage costs bounded. Set to 0 for instant cleanup at\n   * the next cleanup tick after `import_run.status` becomes terminal\n   * (`succeeded` / `failed` / `cancelled`).\n   *\n   * The `import_run` row itself is preserved — the audit trail and\n   * History panel still show the past run; only the source feed\n   * file is removed.\n   */\n  processedRetentionDays?: number\n}\n\nexport function imports(options: ImportsPluginOptions) {\n  const esIndex = options.esIndex ?? 'parts'\n  // Resolve the cleanup config eagerly. `storageBucket === null` is the\n  // explicit opt-out path; `undefined` falls back to the convention.\n  // Two cleanup jobs share the same bucket but have independent TTLs:\n  // orphans (no import_run ref) churn fast (2h); processed runs\n  // (terminal status) get a longer reprocess window (7d).\n  const cleanupConfig =\n    options.storageBucket === null\n      ? null\n      : {\n          bucket: options.storageBucket ?? 'lumi-imports',\n          orphanTtlHours: options.orphanUploadTtlHours ?? 2,\n          processedRetentionDays: options.processedRetentionDays ?? 7,\n        }\n\n  // Register the storage factory eagerly — runs at `imports()` factory\n  // call time during `lumi.config.ts` evaluation, NOT inside the\n  // `init` hook. The hook only fires at `createApp()` time (Next.js\n  // request boot / worker boot), but the factory needs to be visible\n  // to consumers that read it at module-load (e.g. the commerce\n  // route's lazy `getStorageClient` thunk closes over a value that\n  // resolves the moment a request comes in). Late registration in\n  // `init` would race the first request.\n  if (options.storage) {\n    registerImportsStorageFactory(options.storage)\n  }\n\n  return definePlugin({\n    name: '@murumets-ee/imports',\n    server: {\n      entities: [ImportRun, ImportMapping],\n      init: async (app) => {\n        // Built-in transforms — registered FIRST, before the queue-plugin\n        // probe below, so the registry reflects this package's dispatch\n        // capability even in queue-less processes (the admin Catalog tab\n        // lists registry names). The `has()` guards make this idempotent\n        // under dev HMR re-init AND let older scaffolds that still\n        // self-register from `lib/app.ts` coexist (their registration is\n        // also `has()`-guarded; whichever runs first wins — it's the same\n        // function either way). See the module JSDoc for why app-side-only\n        // registration was a drift foot-gun.\n        //\n        // Why imperative-in-init rather than a declarative `contributes`\n        // slot (CLAUDE.md's default for contributions): these are this\n        // package's OWN built-ins landing in this package's OWN\n        // process-global registry — nothing crosses a plugin boundary, and\n        // the registry is consumed at job-dispatch time, not at the\n        // framework's merge step. A contributes slot buys cross-plugin\n        // introspection we don't need at the cost of a core-visible slot\n        // type for an imports-internal concern.\n        const transformRegistry = getTransformRegistry()\n        if (!transformRegistry.has(MAPPING_TRANSFORM_NAME)) {\n          transformRegistry.register(MAPPING_TRANSFORM_NAME, mappingTransform)\n        }\n        if (!transformRegistry.has(CARMAKER_FEED_TRANSFORM_NAME)) {\n          transformRegistry.register(CARMAKER_FEED_TRANSFORM_NAME, carmakerFeedTransform)\n        }\n\n        // Queue PACKAGE being importable doesn't mean the queue() PLUGIN\n        // is in the consumer's plugins array. Without it, registerJob()\n        // succeeds but no worker ever picks up the job. Probe and warn.\n        const queuePluginPresent = app.plugins.all().some((p) => p.name === '@murumets-ee/queue')\n        if (!queuePluginPresent) {\n          app.logger.warn(\n            'imports: queue() plugin not in plugins array — imports:run jobs will not be processed',\n          )\n          return\n        }\n\n        // Queue client stays dynamic-imported: we already early-returned\n        // above when the queue() plugin isn't in the consumer's plugins\n        // array, so static-importing here would force-load the queue\n        // client module in deployments that don't enable the worker.\n        // `@murumets-ee/core/clients` is NO LONGER imported here —\n        // `app.getClient(entity)` gives us a typed, app-bound\n        // AdminClient without the F1+F2 foot-guns from\n        // PLAN-DECLARATIVE-PLUGINS.md.\n        const queueClientModule = await import('@murumets-ee/queue/client')\n\n        const importRuns = app.getClient(ImportRun)\n\n        queueClientModule.registerJob(\n          importsRunJob,\n          createRunImportHandler({\n            importRuns,\n            transforms: transformRegistry,\n            esClient: options.esClient,\n            esIndex,\n            ...(options.ensureIndex !== undefined && { ensureIndex: options.ensureIndex }),\n            ...(options.resolveFilePath !== undefined && {\n              resolveFilePath: options.resolveFilePath,\n            }),\n            ...(options.pairSink !== undefined && { pairSink: options.pairSink }),\n            logger: app.logger.child({ pkg: 'imports' }),\n          }),\n        )\n\n        // Subscribe to the queue's terminal-state event stream so a\n        // worker that crashes mid-import — and whose `imports:run` job\n        // ultimately reaches `dead` without the handler reaching its\n        // own `markFailed` path — flips the mirror `import_run` row to\n        // `failed`. This replaces what would otherwise be a per-domain\n        // periodic sweep; the queue's terminal notifier is the generic\n        // primitive (graphile-worker's `job:failed` event, BullMQ's\n        // `failed` listener — same shape).\n        //\n        // The listener is multi-subscriber, so we coexist with the\n        // notifications plugin's admin-email handler without either of\n        // us clobbering the other. Filtering on `event.jobType` keeps\n        // this listener cheap on jobs we don't own.\n        //\n        // **HMR**: each re-init of this `init` hook constructs a new\n        // listener instance. The notifier registry stores listeners\n        // by reference, so without explicit cleanup an HMR cycle would\n        // STACK duplicate listeners — `findMany`+`update` per dead\n        // event growing linearly with the number of HMR rounds. Stash\n        // the unsubscribe on a globalThis Symbol-keyed slot (same\n        // pattern as `transform.ts` / `storage.ts`) and call it before\n        // re-subscribing so HMR is idempotent.\n        const previousUnsubscribe = (globalThis as GlobalThisWithUnsubscribe)[\n          IMPORTS_DEAD_LISTENER_KEY\n        ]\n        if (previousUnsubscribe) previousUnsubscribe()\n        const unsubscribe = queueClientModule.addQueueTerminalListener(\n          createImportsRunDeadListener({\n            importRuns,\n            logger: app.logger.child({ pkg: 'imports' }),\n          }),\n        )\n        ;(globalThis as GlobalThisWithUnsubscribe)[IMPORTS_DEAD_LISTENER_KEY] = unsubscribe\n\n        // Storage-cleanup jobs. Two passes, same bucket:\n        //   1. Orphan sweep — uploads whose register handshake never\n        //      completed (no `import_run` reference). 2h TTL.\n        //   2. Processed sweep — uploads whose `import_run` is terminal\n        //      (succeeded / failed / cancelled). 7-day reprocess\n        //      window then drop.\n        // `defineJob({ schedule })` declares the cadence; the queue\n        // worker reads the metadata at startup, materialises a\n        // `toolkit_scheduled_jobs` row, and its cron loop fires the\n        // registered handler each tick. No explicit\n        // `client.schedule()` call needed — the worker owns the\n        // schedule, not the handler. Same helper-signature shape as\n        // ticketing's cleanup.\n        if (cleanupConfig !== null) {\n          const { cleanupOrphanedImports, cleanupProcessedImports } = await import(\n            './admin/cleanup.js'\n          )\n          const { runAsCli } = await import('@murumets-ee/core')\n          const cleanupLogger = app.logger.child({ pkg: 'imports', job: 'cleanup' })\n\n          queueClientModule.registerJob(\n            queueClientModule.defineJob({\n              name: 'imports:cleanup-orphaned-uploads',\n              description:\n                'Delete toolkit_files rows in the imports bucket with no matching import_run reference and createdAt older than the configured TTL.',\n              schedule: '@every 1h',\n            }),\n            async () => {\n              // `runAsCli` is load-bearing today: the queue worker's\n              // handler context (see `packages/queue/src/handler-context.ts`)\n              // tracks the job type but NOT a user / RequestContext.\n              // Any AdminClient call reachable from the cleanup\n              // helpers — currently `createAdminClient(ImportRun).getTable()`\n              // for column-metadata resolution — runs without a user\n              // unless we enter a CLI scope. The synthetic CLI user\n              // is the right attribution for scheduled-job work\n              // (matches ticketing's `cleanupOrphanedUploads` shape).\n              await runAsCli(() =>\n                cleanupOrphanedImports({\n                  app,\n                  bucket: cleanupConfig.bucket,\n                  ttlHours: cleanupConfig.orphanTtlHours,\n                  logger: cleanupLogger,\n                }),\n              )\n            },\n          )\n\n          queueClientModule.registerJob(\n            queueClientModule.defineJob({\n              name: 'imports:cleanup-processed-uploads',\n              description:\n                'Delete toolkit_files rows for import_runs in terminal status (succeeded/failed/cancelled) whose finishedAt is older than the configured retention window. The import_run row itself is preserved.',\n              schedule: '@every 1h',\n            }),\n            async () => {\n              await runAsCli(() =>\n                cleanupProcessedImports({\n                  app,\n                  bucket: cleanupConfig.bucket,\n                  retentionDays: cleanupConfig.processedRetentionDays,\n                  logger: cleanupLogger,\n                }),\n              )\n            },\n          )\n        }\n\n        app.logger.info(\n          {\n            esIndex,\n            // Stable shape regardless of enabled/disabled so structured-\n            // log queries (`cleanup.enabled = false`) don't have to\n            // handle a string fallback.\n            cleanup:\n              cleanupConfig === null ? { enabled: false } : { enabled: true, ...cleanupConfig },\n          },\n          'Imports plugin initialized',\n        )\n      },\n    },\n  })\n}\n"],"mappings":"yYAgFA,MAAM,EAA4B,OAAO,IAAI,gDAAgD,EAqH7F,SAAgB,EAAQ,EAA+B,CACrD,IAAM,EAAU,EAAQ,SAAW,QAM7B,EACJ,EAAQ,gBAAkB,KACtB,KACA,CACE,OAAQ,EAAQ,eAAiB,eACjC,eAAgB,EAAQ,sBAAwB,EAChD,uBAAwB,EAAQ,wBAA0B,CAC5D,EAcN,OAJI,EAAQ,SACV,EAA8B,EAAQ,OAAO,EAGxC,EAAa,CAClB,KAAM,uBACN,OAAQ,CACN,SAAU,CAAC,EAAW,CAAa,EACnC,KAAM,KAAO,IAAQ,CAmBnB,IAAM,EAAoB,EAAqB,EAY/C,GAXK,EAAkB,IAAA,kBAA0B,GAC/C,EAAkB,SAAS,EAAwB,CAAgB,EAEhE,EAAkB,IAAA,wBAAgC,GACrD,EAAkB,SAAS,EAA8B,CAAqB,EAO5E,CADuB,EAAI,QAAQ,IAAI,CAAC,CAAC,KAAM,GAAM,EAAE,OAAS,oBAC9C,EAAG,CACvB,EAAI,OAAO,KACT,uFACF,EACA,MACF,CAUA,IAAM,EAAoB,MAAM,OAAO,6BAEjC,EAAa,EAAI,UAAU,CAAS,EAE1C,EAAkB,YAChB,EACA,EAAuB,CACrB,aACA,WAAY,EACZ,SAAU,EAAQ,SAClB,UACA,GAAI,EAAQ,cAAgB,IAAA,IAAa,CAAE,YAAa,EAAQ,WAAY,EAC5E,GAAI,EAAQ,kBAAoB,IAAA,IAAa,CAC3C,gBAAiB,EAAQ,eAC3B,EACA,GAAI,EAAQ,WAAa,IAAA,IAAa,CAAE,SAAU,EAAQ,QAAS,EACnE,OAAQ,EAAI,OAAO,MAAM,CAAE,IAAK,SAAU,CAAC,CAC7C,CAAC,CACH,EAwBA,IAAM,EAAuB,WAC3B,GAEE,GAAqB,EAAoB,EAC7C,IAAM,EAAc,EAAkB,yBACpC,EAA6B,CAC3B,aACA,OAAQ,EAAI,OAAO,MAAM,CAAE,IAAK,SAAU,CAAC,CAC7C,CAAC,CACH,EAgBA,GAfC,WAA0C,GAA6B,EAepE,IAAkB,KAAM,CAC1B,GAAM,CAAE,yBAAwB,2BAA4B,MAAM,OAChE,yBACD,CAAA,KAAA,GAAA,EAAA,CAAA,EACK,CAAE,YAAa,MAAM,OAAO,qBAC5B,EAAgB,EAAI,OAAO,MAAM,CAAE,IAAK,UAAW,IAAK,SAAU,CAAC,EAEzE,EAAkB,YAChB,EAAkB,UAAU,CAC1B,KAAM,mCACN,YACE,qIACF,SAAU,WACZ,CAAC,EACD,SAAY,CAUV,MAAM,MACJ,EAAuB,CACrB,MACA,OAAQ,EAAc,OACtB,SAAU,EAAc,eACxB,OAAQ,CACV,CAAC,CACH,CACF,CACF,EAEA,EAAkB,YAChB,EAAkB,UAAU,CAC1B,KAAM,oCACN,YACE,oMACF,SAAU,WACZ,CAAC,EACD,SAAY,CACV,MAAM,MACJ,EAAwB,CACtB,MACA,OAAQ,EAAc,OACtB,cAAe,EAAc,uBAC7B,OAAQ,CACV,CAAC,CACH,CACF,CACF,CACF,CAEA,EAAI,OAAO,KACT,CACE,UAIA,QACE,IAAkB,KAAO,CAAE,QAAS,EAAM,EAAI,CAAE,QAAS,GAAM,GAAG,CAAc,CACpF,EACA,4BACF,CACF,CACF,CACF,CAAC,CACH"}
+{"version":3,"file":"plugin.mjs","names":[],"sources":["../src/plugin.ts"],"sourcesContent":["/**\n * Imports plugin — registers the `import_run` entity and (when ES + queue\n * are wired) registers the `imports:run` job handler.\n *\n * Per PLAN-ECOMMERCE.md PR 7 (PoC scope): plumbing only. The bespoke\n * admin pages (upload form, parts search) live in PR 8a.\n *\n * **Built-in transforms register HERE, at plugin init.** Both transforms\n * this package ships (`commerce:mapping`, `commerce:carmaker-feed`) go\n * into the process-global registry inside `init`, so every process that\n * boots the plugin — Next.js web server, standalone queue worker — can\n * dispatch them with zero app-side wiring. Registration used to be the\n * app's job (`lib/app.ts` calling `registry.register(...)`), which is\n * exactly the drift foot-gun CLAUDE.md's \"no forgotten registrations\"\n * rule warns about: an app scaffolded before the mapping transform\n * existed keeps its old `lib/app.ts` through `pnpm up` toolkit upgrades,\n * and every mapping-driven run then dies in the worker with\n * `No transform registered for name \"commerce:mapping\"`. App-side\n * registration remains harmless even when unguarded —\n * `registerImportTransform` overwrites last-wins instead of throwing —\n * it is just no longer required.\n *\n * @example\n * ```ts\n * import { defineLumiConfig } from '@murumets-ee/core'\n * import { imports } from '@murumets-ee/imports/plugin'\n * import { Client } from '@elastic/elasticsearch'\n *\n * const es = new Client({ node: process.env.ES_URL })\n *\n * export default defineLumiConfig({\n *   plugins: [\n *     // queue() must be present too — it runs the imports:run jobs.\n *     queue(),\n *     imports({ esClient: () => es, esIndex: 'parts' }),\n *   ],\n * })\n * ```\n */\n\nimport { definePlugin } from '@murumets-ee/core'\n// **Why no static `@murumets-ee/core/clients` import in this file.**\n//\n// `@murumets-ee/core/clients` begins with `import 'server-only'`, which\n// throws when this plugin module is loaded at `lumi.config.ts`\n// evaluation time by the CLI (`lumi migrate`/`seed`/`doctor` use jiti,\n// which doesn't apply the `react-server` export condition).\n// Static-importing would propagate that throw all the way through\n// `lumi.config.ts` → CLI startup, blocking every CLI invocation.\n//\n// **Today (after PLAN-DECLARATIVE-PLUGINS PR 2):** plugin `init`\n// reaches `AdminClient` via the framework-provided `app.getClient(\n// entity)` accessor — no `createAdminClient` call, no dynamic import\n// either. The remaining `@murumets-ee/core/clients` dependency lives\n// in `./admin/cleanup.js`, which IS still dynamic-imported inside\n// `init` and which still benefits from this rationale. The pattern\n// matches `getDb()` in `@murumets-ee/queue/admin.ts`.\nimport { ImportMapping } from './entities/import-mapping.js'\nimport { ImportRun } from './entities/import-run.js'\nimport { MAPPING_TRANSFORM_NAME, mappingTransform } from './mapping/mapping-transform.js'\nimport { type ImportsStorageFactory, registerImportsStorageFactory } from './storage.js'\nimport { getTransformRegistry } from './transform.js'\nimport { CARMAKER_FEED_TRANSFORM_NAME, carmakerFeedTransform } from './transforms/carmaker-feed.js'\nimport {\n  createImportsRunDeadListener,\n  createRunImportHandler,\n  type EnsureIndexResolver,\n  type EsClientResolver,\n  type FilePathResolver,\n  importsRunJob,\n  type PairSink,\n} from './worker.js'\n\n/**\n * `Symbol.for`-keyed slot for the active dead-listener unsubscribe\n * handle. Symbol.for so an HMR-replaced module instance still finds\n * the previous unsubscribe (`Symbol`-by-reference would skip the\n * lookup across module-evaluation boundaries). Same pattern as\n * `transform.ts`'s registry slot and `storage.ts`'s factory slot.\n */\nconst IMPORTS_DEAD_LISTENER_KEY = Symbol.for('@murumets-ee/imports:dead-listener-unsubscribe')\n\ninterface GlobalThisWithUnsubscribe {\n  [IMPORTS_DEAD_LISTENER_KEY]?: () => void\n}\n\nexport interface ImportsPluginOptions {\n  /**\n   * Elasticsearch client resolver. Lazy so consumers can construct\n   * the client inside a route initialiser instead of at plugin-init\n   * time. Required — without it, the worker can't bulk-write.\n   */\n  esClient: EsClientResolver\n  /**\n   * ES index alias to write to. Defaults to `'parts'` (the\n   * `PARTS_INDEX_ALIAS` re-exported from `@murumets-ee/search-elasticsearch`,\n   * inlined here to avoid a runtime import for a one-line constant).\n   * Per D6 always pass an alias, never a physical index.\n   */\n  esIndex?: string\n  /**\n   * Optional bootstrap for the destination index/alias, run once per import\n   * job before any bulk-write (see {@link EnsureIndexResolver}). Wire your\n   * app's `ensureAliasedIndex`-backed helper here so the worker can never\n   * auto-create a mis-mapped physical index — WITHOUT gating app boot on ES.\n   *\n   * Omit only when the index is bootstrapped out-of-band; without it a\n   * first-ever import against an unbootstrapped alias lets ES auto-create a\n   * `text`-mapped physical index, breaking aggregations (issue #610).\n   */\n  ensureIndex?: EnsureIndexResolver\n  /**\n   * Resolve `import_run.filePath` to a local FS path before streaming.\n   * **Required when uploads land in remote storage** (R2/S3/etc.) —\n   * without it, the worker hands the storage key to `createReadStream`\n   * and crashes with `ENOENT`.\n   *\n   * Typical wiring downloads the storage object to a tmpfile and\n   * returns its path; the optional `cleanup` callback runs after the\n   * run finishes (success or failure).\n   *\n   * Omit this option for the original on-disk PoC setup where the\n   * upload route writes directly to a local directory and persists\n   * the absolute path on `import_run.filePath`.\n   */\n  resolveFilePath?: FilePathResolver\n  /**\n   * Optional consumer for the directional supersession pairs the runner harvests as\n   * a side-output (commerce-demo PR6, SD007). The app composes it — commerce exports\n   * the replacement-merge sink and passes it here, same injection shape as\n   * {@link esClient} / {@link resolveFilePath}. Omit when not ingesting replacement\n   * codes; the pairs are then discarded after the run.\n   */\n  pairSink?: PairSink\n  /**\n   * Optional dedicated `StorageClient` factory for imports. When\n   * provided, the upload route (in `@murumets-ee/commerce`) and the\n   * worker resolver consult this client instead of the global\n   * `getStorageConfig()` default — so a deployment can pin imports\n   * to a local-disk adapter (single-VPS / dev) while media,\n   * ticketing attachments, and the rest of the app keep using the\n   * default R2 (or S3) adapter.\n   *\n   * Lazy / async so consumers can defer adapter construction until\n   * the first import — useful when the local-disk root is\n   * environment-dependent or when the factory needs `getApp()` to\n   * have resolved.\n   *\n   * Omit to keep the legacy single-storage behaviour (everything on\n   * the global default).\n   */\n  storage?: ImportsStorageFactory\n  /**\n   * Bucket name to scope the orphan-cleanup queue job. Rows in\n   * `toolkit_files` with this bucket value AND no matching\n   * `import_run.filePath` AND `createdAt < cutoff` get garbage-\n   * collected on each cleanup tick. Defaults to `'lumi-imports'` —\n   * the convention `apps/admin/lib/imports-storage.ts`\n   * uses by default. Override if your deployment pins a different\n   * bucket name via `IMPORTS_STORAGE_BUCKET` or equivalent.\n   *\n   * Set to `null` to DISABLE the cleanup job entirely (e.g. for\n   * deployments that handle their own retention via S3 lifecycle\n   * rules). Disabling without an alternative will leak storage\n   * over time as failed uploads accumulate.\n   */\n  storageBucket?: string | null\n  /**\n   * Hours after which an unreferenced `toolkit_files` row in the\n   * imports bucket is considered orphaned and deleted by the\n   * cleanup job. Default 2h — long enough that a normal\n   * upload-then-register round-trip never wipes a fresh upload,\n   * short enough that storage waste from failed uploads doesn't\n   * accumulate.\n   *\n   * The upload→register flow happens client-side automatically (no\n   * \"operator clicks register\" step in the current UI), so the TTL\n   * just needs to cover network blips + retries. Bumping the TTL\n   * is safe if your operators commonly upload then wait before\n   * processing.\n   */\n  orphanUploadTtlHours?: number\n  /**\n   * Days after which a terminal-status `import_run`'s source file is\n   * deleted from `toolkit_files`. Default 7 days — gives operators a\n   * reprocess window if a transform bug surfaces post-success, while\n   * keeping storage costs bounded. Set to 0 for instant cleanup at\n   * the next cleanup tick after `import_run.status` becomes terminal\n   * (`succeeded` / `failed` / `cancelled`).\n   *\n   * The `import_run` row itself is preserved — the audit trail and\n   * History panel still show the past run; only the source feed\n   * file is removed.\n   */\n  processedRetentionDays?: number\n}\n\nexport function imports(options: ImportsPluginOptions) {\n  const esIndex = options.esIndex ?? 'parts'\n  // Resolve the cleanup config eagerly. `storageBucket === null` is the\n  // explicit opt-out path; `undefined` falls back to the convention.\n  // Two cleanup jobs share the same bucket but have independent TTLs:\n  // orphans (no import_run ref) churn fast (2h); processed runs\n  // (terminal status) get a longer reprocess window (7d).\n  const cleanupConfig =\n    options.storageBucket === null\n      ? null\n      : {\n          bucket: options.storageBucket ?? 'lumi-imports',\n          orphanTtlHours: options.orphanUploadTtlHours ?? 2,\n          processedRetentionDays: options.processedRetentionDays ?? 7,\n        }\n\n  // Register the storage factory eagerly — runs at `imports()` factory\n  // call time during `lumi.config.ts` evaluation, NOT inside the\n  // `init` hook. The hook only fires at `createApp()` time (Next.js\n  // request boot / worker boot), but the factory needs to be visible\n  // to consumers that read it at module-load (e.g. the commerce\n  // route's lazy `getStorageClient` thunk closes over a value that\n  // resolves the moment a request comes in). Late registration in\n  // `init` would race the first request.\n  if (options.storage) {\n    registerImportsStorageFactory(options.storage)\n  }\n\n  return definePlugin({\n    name: '@murumets-ee/imports',\n    server: {\n      entities: [ImportRun, ImportMapping],\n      init: async (app) => {\n        // Built-in transforms — registered FIRST, before the queue-plugin\n        // probe below, so the registry reflects this package's dispatch\n        // capability even in queue-less processes (the admin Catalog tab\n        // lists registry names). The `has()` guards make this idempotent\n        // under dev HMR re-init AND let older scaffolds that still\n        // self-register from `lib/app.ts` coexist (their registration is\n        // also `has()`-guarded; whichever runs first wins — it's the same\n        // function either way). See the module JSDoc for why app-side-only\n        // registration was a drift foot-gun.\n        //\n        // Why imperative-in-init rather than a declarative `contributes`\n        // slot (CLAUDE.md's default for contributions): these are this\n        // package's OWN built-ins landing in this package's OWN\n        // process-global registry — nothing crosses a plugin boundary, and\n        // the registry is consumed at job-dispatch time, not at the\n        // framework's merge step. A contributes slot buys cross-plugin\n        // introspection we don't need at the cost of a core-visible slot\n        // type for an imports-internal concern.\n        const transformRegistry = getTransformRegistry()\n        if (!transformRegistry.has(MAPPING_TRANSFORM_NAME)) {\n          transformRegistry.register(MAPPING_TRANSFORM_NAME, mappingTransform)\n        }\n        if (!transformRegistry.has(CARMAKER_FEED_TRANSFORM_NAME)) {\n          transformRegistry.register(CARMAKER_FEED_TRANSFORM_NAME, carmakerFeedTransform)\n        }\n\n        // Queue PACKAGE being importable doesn't mean the queue() PLUGIN\n        // is in the consumer's plugins array. Without it, registerJob()\n        // succeeds but no worker ever picks up the job. Probe and warn.\n        const queuePluginPresent = app.plugins.all().some((p) => p.name === '@murumets-ee/queue')\n        if (!queuePluginPresent) {\n          app.logger.warn(\n            'imports: queue() plugin not in plugins array — imports:run jobs will not be processed',\n          )\n          return\n        }\n\n        // Queue client stays dynamic-imported: we already early-returned\n        // above when the queue() plugin isn't in the consumer's plugins\n        // array, so static-importing here would force-load the queue\n        // client module in deployments that don't enable the worker.\n        // `@murumets-ee/core/clients` is NO LONGER imported here —\n        // `app.getClient(entity)` gives us a typed, app-bound\n        // AdminClient without the F1+F2 foot-guns from\n        // PLAN-DECLARATIVE-PLUGINS.md.\n        const queueClientModule = await import('@murumets-ee/queue/client')\n\n        const importRuns = app.getClient(ImportRun)\n\n        queueClientModule.registerJob(\n          importsRunJob,\n          createRunImportHandler({\n            importRuns,\n            transforms: transformRegistry,\n            esClient: options.esClient,\n            esIndex,\n            ...(options.ensureIndex !== undefined && { ensureIndex: options.ensureIndex }),\n            ...(options.resolveFilePath !== undefined && {\n              resolveFilePath: options.resolveFilePath,\n            }),\n            ...(options.pairSink !== undefined && { pairSink: options.pairSink }),\n            logger: app.logger.child({ pkg: 'imports' }),\n          }),\n        )\n\n        // Subscribe to the queue's terminal-state event stream so a\n        // worker that crashes mid-import — and whose `imports:run` job\n        // ultimately reaches `dead` without the handler reaching its\n        // own `markFailed` path — flips the mirror `import_run` row to\n        // `failed`. This replaces what would otherwise be a per-domain\n        // periodic sweep; the queue's terminal notifier is the generic\n        // primitive (graphile-worker's `job:failed` event, BullMQ's\n        // `failed` listener — same shape).\n        //\n        // The listener is multi-subscriber, so we coexist with the\n        // notifications plugin's admin-email handler without either of\n        // us clobbering the other. Filtering on `event.jobType` keeps\n        // this listener cheap on jobs we don't own.\n        //\n        // **HMR**: each re-init of this `init` hook constructs a new\n        // listener instance. The notifier registry stores listeners\n        // by reference, so without explicit cleanup an HMR cycle would\n        // STACK duplicate listeners — `findMany`+`update` per dead\n        // event growing linearly with the number of HMR rounds. Stash\n        // the unsubscribe on a globalThis Symbol-keyed slot (same\n        // pattern as `transform.ts` / `storage.ts`) and call it before\n        // re-subscribing so HMR is idempotent.\n        const previousUnsubscribe = (globalThis as GlobalThisWithUnsubscribe)[\n          IMPORTS_DEAD_LISTENER_KEY\n        ]\n        if (previousUnsubscribe) previousUnsubscribe()\n        const unsubscribe = queueClientModule.addQueueTerminalListener(\n          createImportsRunDeadListener({\n            importRuns,\n            logger: app.logger.child({ pkg: 'imports' }),\n          }),\n        )\n        ;(globalThis as GlobalThisWithUnsubscribe)[IMPORTS_DEAD_LISTENER_KEY] = unsubscribe\n\n        // Storage-cleanup jobs. Two passes, same bucket:\n        //   1. Orphan sweep — uploads whose register handshake never\n        //      completed (no `import_run` reference). 2h TTL.\n        //   2. Processed sweep — uploads whose `import_run` is terminal\n        //      (succeeded / failed / cancelled). 7-day reprocess\n        //      window then drop.\n        // `defineJob({ schedule })` declares the cadence; the queue\n        // worker reads the metadata at startup, materialises a\n        // `toolkit_scheduled_jobs` row, and its cron loop fires the\n        // registered handler each tick. No explicit\n        // `client.schedule()` call needed — the worker owns the\n        // schedule, not the handler. Same helper-signature shape as\n        // ticketing's cleanup.\n        if (cleanupConfig !== null) {\n          const { cleanupOrphanedImports, cleanupProcessedImports } = await import(\n            './admin/cleanup.js'\n          )\n          const { runAsCli } = await import('@murumets-ee/core')\n          const cleanupLogger = app.logger.child({ pkg: 'imports', job: 'cleanup' })\n\n          queueClientModule.registerJob(\n            queueClientModule.defineJob({\n              name: 'imports:cleanup-orphaned-uploads',\n              description:\n                'Delete toolkit_files rows in the imports bucket with no matching import_run reference and createdAt older than the configured TTL.',\n              schedule: '@every 1h',\n            }),\n            async () => {\n              // `runAsCli` is load-bearing today: the queue worker's\n              // handler context (see `packages/queue/src/handler-context.ts`)\n              // tracks the job type but NOT a user / RequestContext.\n              // Any AdminClient call reachable from the cleanup\n              // helpers — currently `createAdminClient(ImportRun).getTable()`\n              // for column-metadata resolution — runs without a user\n              // unless we enter a CLI scope. The synthetic CLI user\n              // is the right attribution for scheduled-job work\n              // (matches ticketing's `cleanupOrphanedUploads` shape).\n              await runAsCli(() =>\n                cleanupOrphanedImports({\n                  app,\n                  bucket: cleanupConfig.bucket,\n                  ttlHours: cleanupConfig.orphanTtlHours,\n                  logger: cleanupLogger,\n                }),\n              )\n            },\n          )\n\n          queueClientModule.registerJob(\n            queueClientModule.defineJob({\n              name: 'imports:cleanup-processed-uploads',\n              description:\n                'Delete toolkit_files rows for import_runs in terminal status (succeeded/failed/cancelled) whose finishedAt is older than the configured retention window. The import_run row itself is preserved.',\n              schedule: '@every 1h',\n            }),\n            async () => {\n              await runAsCli(() =>\n                cleanupProcessedImports({\n                  app,\n                  bucket: cleanupConfig.bucket,\n                  retentionDays: cleanupConfig.processedRetentionDays,\n                  logger: cleanupLogger,\n                }),\n              )\n            },\n          )\n        }\n\n        app.logger.info(\n          {\n            esIndex,\n            // Stable shape regardless of enabled/disabled so structured-\n            // log queries (`cleanup.enabled = false`) don't have to\n            // handle a string fallback.\n            cleanup:\n              cleanupConfig === null ? { enabled: false } : { enabled: true, ...cleanupConfig },\n          },\n          'Imports plugin initialized',\n        )\n      },\n    },\n  })\n}\n"],"mappings":"yYAgFA,MAAM,EAA4B,OAAO,IAAI,gDAAgD,EAqH7F,SAAgB,EAAQ,EAA+B,CACrD,IAAM,EAAU,EAAQ,SAAW,QAM7B,EACJ,EAAQ,gBAAkB,KACtB,KACA,CACE,OAAQ,EAAQ,eAAiB,eACjC,eAAgB,EAAQ,sBAAwB,EAChD,uBAAwB,EAAQ,wBAA0B,CAC5D,EAcN,OAJI,EAAQ,SACV,EAA8B,EAAQ,OAAO,EAGxC,EAAa,CAClB,KAAM,uBACN,OAAQ,CACN,SAAU,CAAC,EAAW,CAAa,EACnC,KAAM,KAAO,IAAQ,CAmBnB,IAAM,EAAoB,EAAqB,EAY/C,GAXK,EAAkB,IAAA,kBAA0B,GAC/C,EAAkB,SAAS,EAAwB,CAAgB,EAEhE,EAAkB,IAAA,wBAAgC,GACrD,EAAkB,SAAS,EAA8B,CAAqB,EAO5E,CADuB,EAAI,QAAQ,IAAI,CAAC,CAAC,KAAM,GAAM,EAAE,OAAS,oBAC9C,EAAG,CACvB,EAAI,OAAO,KACT,uFACF,EACA,MACF,CAUA,IAAM,EAAoB,MAAM,OAAO,6BAEjC,EAAa,EAAI,UAAU,CAAS,EAE1C,EAAkB,YAChB,EACA,EAAuB,CACrB,aACA,WAAY,EACZ,SAAU,EAAQ,SAClB,UACA,GAAI,EAAQ,cAAgB,IAAA,IAAa,CAAE,YAAa,EAAQ,WAAY,EAC5E,GAAI,EAAQ,kBAAoB,IAAA,IAAa,CAC3C,gBAAiB,EAAQ,eAC3B,EACA,GAAI,EAAQ,WAAa,IAAA,IAAa,CAAE,SAAU,EAAQ,QAAS,EACnE,OAAQ,EAAI,OAAO,MAAM,CAAE,IAAK,SAAU,CAAC,CAC7C,CAAC,CACH,EAwBA,IAAM,EAAuB,WAC3B,GAEE,GAAqB,EAAoB,EAC7C,IAAM,EAAc,EAAkB,yBACpC,EAA6B,CAC3B,aACA,OAAQ,EAAI,OAAO,MAAM,CAAE,IAAK,SAAU,CAAC,CAC7C,CAAC,CACH,EAgBA,GAfC,WAA0C,GAA6B,EAepE,IAAkB,KAAM,CAC1B,GAAM,CAAE,yBAAwB,2BAA4B,MAAM,OAChE,yBACD,CAAA,KAAA,GAAA,EAAA,CAAA,EACK,CAAE,YAAa,MAAM,OAAO,qBAC5B,EAAgB,EAAI,OAAO,MAAM,CAAE,IAAK,UAAW,IAAK,SAAU,CAAC,EAEzE,EAAkB,YAChB,EAAkB,UAAU,CAC1B,KAAM,mCACN,YACE,qIACF,SAAU,WACZ,CAAC,EACD,SAAY,CAUV,MAAM,MACJ,EAAuB,CACrB,MACA,OAAQ,EAAc,OACtB,SAAU,EAAc,eACxB,OAAQ,CACV,CAAC,CACH,CACF,CACF,EAEA,EAAkB,YAChB,EAAkB,UAAU,CAC1B,KAAM,oCACN,YACE,oMACF,SAAU,WACZ,CAAC,EACD,SAAY,CACV,MAAM,MACJ,EAAwB,CACtB,MACA,OAAQ,EAAc,OACtB,cAAe,EAAc,uBAC7B,OAAQ,CACV,CAAC,CACH,CACF,CACF,CACF,CAEA,EAAI,OAAO,KACT,CACE,UAIA,QACE,IAAkB,KAAO,CAAE,QAAS,EAAM,EAAI,CAAE,QAAS,GAAM,GAAG,CAAc,CACpF,EACA,4BACF,CACF,CACF,CACF,CAAC,CACH"}

package/dist/runner-C-s6SD7t.mjs

@@ -0,0 +1,2 @@
+import{z as e}from"zod";import{createReadStream as t}from"node:fs";import{parse as n}from"csv-parse";import{bulkPartialUpdate as r,bulkUpsert as i}from"@murumets-ee/search-elasticsearch";function a(e){let t=new Set;for(let n of e)if(n!==``){if(t.has(n))throw Error(`Duplicate header "${n}" after trimming — column names must be unique`);t.add(n)}}async function o(e,n={}){let{hasHeader:r=!0}=n,i=t(e),a=0,o=0;for await(let e of i){for(let t=0;t<e.length;t+=1)e[t]===10&&(a+=1);e.length>0&&(o=e[e.length-1]??0)}return o!==0&&o!==10&&(a+=1),r?Math.max(0,a-1):a}async function*s(e){let{filePath:r,delimiter:i=`	`,hasHeader:o=!0,columns:s,relaxColumnCount:c=!1,quote:l=!1}=e,u=s?Array.from(s):o?e=>{let t=e.map(e=>e.trim());return a(t),t}:!1,d=t(r),f=d.pipe(n({delimiter:i,columns:u,bom:!0,skip_empty_lines:!0,relax_column_count:c,quote:l})),p=0;try{for await(let e of f){p+=1;let t={};if(Array.isArray(e)){let n=e;for(let e=0;e<n.length;e+=1)t[String(e)]=n[e]??``}else for(let[n,r]of Object.entries(e))t[n]=r??``;yield{rowNumber:p,row:t}}}finally{d.destroy()}}const c=e.object({format:e.enum([`csv`,`tsv`,`xlsx`]).optional(),delimiter:e.string().min(1).max(4).optional(),hasHeader:e.boolean().optional(),headerRowIndex:e.number().int().min(0).optional(),sheet:e.string().min(1).max(128).optional()}).strict();function l(e){let t=e&&typeof e==`object`&&!Array.isArray(e)?e:{},n=t.feed===void 0||t.feed===null?{}:t.feed;return c.safeParse(n)}function u(e){let t=e.delimiter??(e.format===`csv`?`,`:`	`);return{filePath:e.filePath,delimiter:t,...e.hasHeader!==void 0&&{hasHeader:e.hasHeader},...e.columns!==void 0&&{columns:e.columns},...e.relaxColumnCount!==void 0&&{relaxColumnCount:e.relaxColumnCount},...e.quote!==void 0&&{quote:e.quote}}}async function*d(e){if(e.format===`xlsx`){let{streamXlsx:t}=await import(`./xlsx-reader-Ccesszbc.mjs`);yield*t({filePath:e.filePath,...e.hasHeader!==void 0&&{hasHeader:e.hasHeader},...e.headerRowIndex!==void 0&&{headerRowIndex:e.headerRowIndex},...e.sheet!==void 0&&{sheet:e.sheet}});return}yield*s(u(e))}const f=50,p=5;var m=class{patterns=new Map;maxPatterns;maxSamplesPerPattern;droppedSignatures=0;constructor(e={}){this.maxPatterns=e.maxPatterns??50,this.maxSamplesPerPattern=e.maxSamplesPerPattern??5}addError(e,t,n,r,i){let a=`${t}:${r??`GENERAL`}:${n}`,o=this.patterns.get(a);if(!o){if(this.patterns.size>=this.maxPatterns){this.droppedSignatures+=1;return}o={errorType:t,field:r??null,message:n,count:0,firstOccurrence:e,lastOccurrence:e,samples:[]},this.patterns.set(a,o)}o.count+=1,o.lastOccurrence=e,o.samples.length<this.maxSamplesPerPattern&&o.samples.push({rowNumber:e,rowData:i})}getTotalErrorCount(){let e=0;for(let t of this.patterns.values())e+=t.count;return e}getDistinctPatternCount(){return this.patterns.size}getDroppedSignatureCount(){return this.droppedSignatures}getTopPatterns(){let e=Array.from(this.patterns.values()).sort((e,t)=>t.count-e.count),t=e.reduce((e,t)=>e+t.count,0);return e.map(e=>({errorType:e.errorType,field:e.field,message:e.message,count:e.count,firstOccurrence:e.firstOccurrence,lastOccurrence:e.lastOccurrence,samples:e.samples.slice(),percentage:t>0?e.count/t*100:0}))}snapshot(){return{totalErrors:this.getTotalErrorCount(),distinctPatterns:this.getDistinctPatternCount(),droppedSignatures:this.droppedSignatures,patterns:this.getTopPatterns()}}};const h=1e3;async function g(e){let{importRunId:t,runLabel:n,params:a,transform:o,feed:s,esClient:c,esIndex:l,batchSize:u=h,onProgress:f,rowLimit:p,signal:g,errorTracker:_=new m,warningTracker:v=new m,logger:y}=e;if(u<1)throw Error(`batchSize must be >= 1 (got ${u})`);let b=Date.now();y?.info({importRunId:t,runLabel:n,batchSize:u,esIndex:l},`imports.runner: started`);let x=0,S=0,C=0,w=0,T=0,E=0,D=[],O=[],k=[],A=async()=>{if(k.length===0)return;let e=k;k=[];let n=Date.now(),r;try{r=await i(c,{index:l,docs:e.map(({id:e,doc:t})=>({id:e,doc:t})),...g!==void 0&&{signal:g}})}catch(t){let n=g?.aborted??(t instanceof Error&&(t.name===`AbortError`||/abort/i.test(t.message)))?`aborted`:`bulk_request_failed`,r=t instanceof Error?t.message:String(t);for(let{rowNumber:t}of e)_.addError(t,n,r,void 0,null);throw C+=e.length,t}S+=r.succeeded,C+=r.failures.length,E+=1;let a=Date.now()-n,o=(Date.now()-b)/1e3;if(y?.info({importRunId:t,batch:E,flushMs:a,submitted:e.length,succeeded:r.succeeded,failed:r.failures.length,rowsRead:x,rowsPerSecond:o>0?Math.round(x/o):0},`imports.runner: batch flushed`),r.failures.length>0){let t=new Map(e.map(e=>[e.id,e.rowNumber]));for(let e of r.failures){let n=t.get(e.id)??-1;_.addError(n,e.type,e.reason,void 0,{id:e.id})}}let s=new Set(r.failures.map(e=>e.id));for(let t of e)if(!(!t.warnings||t.warnings.length===0)&&!s.has(t.id)){T+=1;for(let e of t.warnings)v.addError(t.rowNumber,e.warningType,e.message,e.field,t.rowData)}for(let t of e)!t.pairs||t.pairs.length===0||s.has(t.id)||D.push(...t.pairs);if(f){let e=(Date.now()-b)/1e3;f({rowsRead:x,rowsSucceeded:S,rowsFailed:C,rowsSkipped:w,rowsWarned:T,batchesCompleted:E,elapsedSeconds:e,rowsPerSecond:e>0?x/e:0,distinctErrorPatterns:_.getDistinctPatternCount()})}},j=u,M=new Map;for await(let{rowNumber:e,row:r}of d(s)){if(g?.aborted||p!==void 0&&x>=p)break;if(x+=1,x===1&&y?.info({importRunId:t,rowNumber:e,sampleKeys:Object.keys(r)},`imports.runner: STREAM_FIRST_ROW`),x%j===0){let e=(Date.now()-b)/1e3;y?.info({importRunId:t,rowsRead:x,rowsSucceeded:S,rowsFailed:C,rowsSkipped:w,pending:k.length,elapsedSec:Math.round(e*10)/10,rowsPerSecond:e>0?Math.round(x/e):0,distinctFirstErrorTypes:M.size},`imports.runner: STREAM_TICK`)}let i={importRunId:t,params:a,runLabel:n,rowNumber:e},s;try{s=await o(r,i)}catch(n){let i=n instanceof Error?n.message:String(n);_.addError(e,`transform_threw`,i,void 0,r),M.has(`transform_threw`)||(M.set(`transform_threw`,{rowNumber:e,message:i}),y?.warn({importRunId:t,rowNumber:e,errorType:`transform_threw`,message:i},`imports.runner: FIRST_ERROR transform_threw`)),C+=1;continue}if(s.kind===`skip`){w+=1,s.patches&&s.patches.length>0&&O.push(...s.patches);continue}if(s.kind===`error`){_.addError(e,s.error.errorType,s.error.message,s.error.field,r),M.has(s.error.errorType)||(M.set(s.error.errorType,{rowNumber:e,message:s.error.message}),y?.warn({importRunId:t,rowNumber:e,errorType:s.error.errorType,field:s.error.field,message:s.error.message},`imports.runner: FIRST_ERROR ${s.error.errorType}`)),C+=1;continue}k.push({id:s.id,doc:s.doc,rowNumber:e,rowData:r,...s.warnings&&s.warnings.length>0&&{warnings:s.warnings},...s.pairs&&s.pairs.length>0&&{pairs:s.pairs}}),k.length>=u&&await A()}await A();let N=0,P=0;for(let e=0;e<O.length;e+=u){if(g?.aborted)throw Error(`imports: run aborted during core-charge attach (phase 2)`);let t=O.slice(e,e+u),n;try{n=await r(c,{index:l,updates:t.map(({id:e,doc:t})=>({id:e,doc:t})),...g!==void 0&&{signal:g}})}catch(e){if(g?.aborted??(e instanceof Error&&(e.name===`AbortError`||/abort/i.test(e.message))))throw e;let n=e instanceof Error?e.message:String(e);for(let e of t)v.addError(-1,`patch_attach_failed`,n,e.orphanWarning?.field,{target:e.id});continue}if(N+=n.succeeded,n.failures.length>0){let e=new Map(t.map(e=>[e.id,e]));for(let t of n.failures){let n=e.get(t.id)?.orphanWarning;t.status===404||t.type===`document_missing_exception`?(P+=1,v.addError(-1,n?.warningType??`orphan_patch`,n?.message??t.reason,n?.field,{target:t.id})):v.addError(-1,`patch_attach_failed`,t.reason,n?.field,{target:t.id})}}}let F=(Date.now()-b)/1e3;return y?.info({importRunId:t,rowsRead:x,rowsSucceeded:S,rowsFailed:C,rowsSkipped:w,batchesCompleted:E,patchesApplied:N,patchesOrphaned:P,totalSec:Math.round(F*10)/10,rowsPerSecond:F>0?Math.round(x/F):0},`imports.runner: finished`),{rowsRead:x,rowsSucceeded:S,rowsFailed:C,rowsSkipped:w,rowsWarned:T,batchesCompleted:E,errors:_.snapshot(),warnings:v.snapshot(),pairs:D,patchesApplied:N,patchesOrphaned:P}}export{m as a,l as c,s as d,p as i,a as l,g as n,c as o,f as r,d as s,h as t,o as u};
+//# sourceMappingURL=runner-C-s6SD7t.mjs.map