@north-light/crouter 0.3.318 → 0.3.319

package/dist/core/canvas/crons.js

@@ -1,303 +1,8 @@
-// crons.ts — the CRONS + CRON_RUNS data-access layer (canvas.db, migration
-// v21). One-module-per-table: ALL SQL touching
-// `crons`/`cron_runs` lives HERE and nowhere else.
-//
-// A CRON is the one scheduling primitive of the cron spec: run this bash,
-// then. The row decides WHEN (fire_at, advanced by the daemon for a
-// recurrence) and snapshots the execution context (cwd/env/profile) at arm
-// time so a job never changes behavior because its creator went away.
-// `created_by` is provenance only — no FK, never cascades. `anchor_node` is
-// the opt-in node coupling carrying the sole FK (ON DELETE CASCADE).
-//
-// Each function is a single-statement query mirroring the canvas.ts atomic-
-// setter pattern — no read-modify-write, serialized by WAL — except the two
-// deliberate multi-statement boundaries under withCanvasWrite (cancelCron's
-// kill-then-delete, recordCronRun's insert-then-prune ring).
-//
-// `cron_id` is CALLER-SUPPLIED (the daemon API handler mints it): the canvas
-// layer never mints ids.
-//
-// Lease primitives (acquireCronRunLease/releaseCronRunLease/runningCrons)
-// serve the daemon-owned run executor in src/daemon/cron-run.ts.
-import { openDb, withCanvasWrite } from './db.js';
-import { capturePidIdentities, identitiesMatch, killProcessGroup } from './pid.js';
-import { isProfilePaused } from '../profiles/manifest.js';
-/** Ring bound for `cron_runs`: recordCronRun prunes each cron's history to
- *  its most recent this-many rows. */
-export const CRON_RUN_RING = 20;
-function cronFrom(r) {
-    return {
-        cron_id: r['cron_id'],
-        name: r['name'],
-        created_by: r['created_by'] ?? null,
-        command: r['command'],
-        fire_at: r['fire_at'],
-        recur: r['recur'] ?? null,
-        tz: r['tz'] ?? null,
-        expires_at: r['expires_at'] ?? null,
-        anchor_node: r['anchor_node'] ?? null,
-        cancel_on_wake: Number(r['cancel_on_wake']) !== 0,
-        cwd: r['cwd'],
-        env_json: r['env_json'] ?? null,
-        profile: r['profile'] ?? null,
-        scope: r['scope'],
-        run_timeout_s: Number(r['run_timeout_s']),
-        overlap: r['overlap'],
-        on_output: r['on_output'],
-        sink: r['sink'],
-        tier: r['tier'],
-        last_output_hash: r['last_output_hash'] ?? null,
-        held: Number(r['held']) !== 0,
-        last_poke_at: r['last_poke_at'] ?? null,
-        state: r['state'],
-        run_state: r['run_state'],
-        run_pid: r['run_pid'] ?? null,
-        run_pid_identity: r['run_pid_identity'] ?? null,
-        run_started_at: r['run_started_at'] ?? null,
-        run_lease_owner: r['run_lease_owner'] ?? null,
-        run_out_of_band: Number(r['run_out_of_band']) !== 0,
-        created: r['created'],
-        updated: r['updated'],
-    };
-}
-/** Decode the stored cron sink JSON. A malformed or unrecognised value has no sink. */
-export function parseCronSink(sinkJson) {
-    try {
-        const sink = JSON.parse(sinkJson);
-        if (typeof sink['node'] === 'string')
-            return { kind: 'node', node: sink['node'] };
-        if (typeof sink['spawn'] === 'string')
-            return { kind: 'spawn', spawn: sink['spawn'] };
-        if (sink['human'] === true)
-            return { kind: 'human' };
-    }
-    catch {
-        // A malformed stored value cannot deliver but remains listable and runnable.
-    }
-    return null;
-}
-/** Render a stored cron sink as the arm-time CLI spec, or null when it has no destination. */
-export function cronSinkDisplay(sinkJson) {
-    const sink = parseCronSink(sinkJson);
-    if (sink === null)
-        return null;
-    switch (sink.kind) {
-        case 'node':
-            return `node:${sink.node}`;
-        case 'spawn':
-            return `spawn:${sink.spawn}`;
-        case 'human':
-            return 'human';
-    }
-}
-// Signal safety
-/** The ONLY sanctioned way to signal a cron run's process group from a stored
- *  row. Re-captures the CURRENT identity of `run_pid` and signals only when it
- *  MATCHES the fingerprint recorded at lease acquisition. Returns whether the
- *  signal was sent.
- *
- *  FAIL-CLOSED, unlike the rest of this repo's pid handling. Elsewhere the
- *  baseline was captured by the same daemon life that is now signaling, so an
- *  absent baseline or a failed `ps` probe means "no evidence of reuse" and
- *  failing open to the signal is right. A cron lease outlives its daemon: after
- *  a SIGKILL or a host reboot, `run_pid` is a number from a dead kernel's pid
- *  space that the OS has very likely handed to an unrelated process, and
- *  `isPidAlive` cheerfully confirms that stranger. So here the ONLY thing that
- *  authorizes a kill is positive proof of sameness — no identity (pre-v23 row,
- *  capture failed), no `ps` table (probe failed), no row for the pid (process
- *  gone), or a mismatch (reused) all mean: do not signal. The caller settles the
- *  lease instead; the worst case is a leaked runaway process, versus SIGTERMing
- *  a stranger's process group. */
-export function killLeasedCronRun(c, signal = 'SIGTERM') {
-    if (!verifyLeasedCronRun(c))
-        return false;
-    killProcessGroup(c.run_pid, signal);
-    return true;
-}
-/** Positive proof that `run_pid` is STILL the process this lease launched:
- *  a stored identity exists, the `ps` probe succeeded, the pid has a row, and
- *  its current identity matches. Anything else — including "we could not tell"
- *  — is `false`, which is what makes `killLeasedCronRun` fail closed. */
-export function verifyLeasedCronRun(c) {
-    const pid = c.run_pid;
-    if (pid == null || c.run_pid_identity == null)
-        return false;
-    const table = capturePidIdentities([pid]);
-    if (table === null)
-        return false; // probe itself failed — no information
-    const current = table.get(pid);
-    if (current === undefined)
-        return false; // pid genuinely gone
-    return identitiesMatch(current, c.run_pid_identity);
-}
-// Writes
-/** INSERT one cron row from the pinned arm spec, returning its (caller-
- *  supplied) `cron_id` plus the ids of any deadline it displaced. Stamps
- *  `created`/`updated`; lease fields start idle.
- *
- *  ONE DEADLINE PER ANCHOR: a `cancel_on_wake` arm REPLACES the anchor's
- *  pending cancel-on-wake cron rather than stacking a second one — re-arming a
- *  bounded wait moves the deadline. This is the invariant the dropped
- *  `triggers` partial unique index carried, and `idx_crons_deadline`
- *  (`crons(anchor_node) WHERE cancel_on_wake = 1`) is still its structural
- *  backstop; the displace-then-insert runs inside ONE canvas write boundary so
- *  two concurrent arms cannot both pass. Only the anchor's own cancel-on-wake
- *  rows are displaced — a standing declarative cron on the same anchor is
- *  untouched. Any displaced in-flight run's process group is killed first (the
- *  cancelCron discipline). */
-export function armCron(spec) {
-    return withCanvasWrite((db) => {
-        const replaced = [];
-        if (spec.cancel_on_wake && spec.anchor_node !== null) {
-            const rows = db
-                .prepare('SELECT * FROM crons WHERE anchor_node = ? AND cancel_on_wake = 1')
-                .all(spec.anchor_node).map(cronFrom);
-            for (const c of rows) {
-                if (c.run_state === 'running')
-                    killLeasedCronRun(c);
-                db.prepare('DELETE FROM crons WHERE cron_id = ?').run(c.cron_id);
-                replaced.push(c.cron_id);
-            }
-        }
-        insertCron(db, spec);
-        return { cron_id: spec.cron_id, replaced };
-    });
-}
-function insertCron(db, spec) {
-    const now = new Date().toISOString();
-    db
-        .prepare(`INSERT INTO crons (
+var f=Object.defineProperty;var t=(e,n)=>f(e,"name",{value:n,configurable:!0});import{openDb as a,withCanvasWrite as s}from"./db.js";import{capturePidIdentities as d,identitiesMatch as R,killProcessGroup as m}from"./pid.js";import{isProfilePaused as D}from"../profiles/manifest.js";const S=20;function u(e){return{cron_id:e.cron_id,name:e.name,created_by:e.created_by??null,command:e.command,fire_at:e.fire_at,recur:e.recur??null,tz:e.tz??null,expires_at:e.expires_at??null,anchor_node:e.anchor_node??null,cancel_on_wake:Number(e.cancel_on_wake)!==0,cwd:e.cwd,env_json:e.env_json??null,profile:e.profile??null,scope:e.scope,run_timeout_s:Number(e.run_timeout_s),overlap:e.overlap,on_output:e.on_output,sink:e.sink,tier:e.tier,last_output_hash:e.last_output_hash??null,held:Number(e.held)!==0,last_poke_at:e.last_poke_at??null,state:e.state,run_state:e.run_state,run_pid:e.run_pid??null,run_pid_identity:e.run_pid_identity??null,run_started_at:e.run_started_at??null,run_lease_owner:e.run_lease_owner??null,run_out_of_band:Number(e.run_out_of_band)!==0,created:e.created,updated:e.updated}}t(u,"cronFrom");function l(e){try{const n=JSON.parse(e);if(typeof n.node=="string")return{kind:"node",node:n.node};if(typeof n.spawn=="string")return{kind:"spawn",spawn:n.spawn};if(n.human===!0)return{kind:"human"}}catch{}return null}t(l,"parseCronSink");function x(e){const n=l(e);if(n===null)return null;switch(n.kind){case"node":return`node:${n.node}`;case"spawn":return`spawn:${n.spawn}`;case"human":return"human"}}t(x,"cronSinkDisplay");function c(e,n="SIGTERM"){return h(e)?(m(e.run_pid,n),!0):!1}t(c,"killLeasedCronRun");function h(e){const n=e.run_pid;if(n==null||e.run_pid_identity==null)return!1;const r=d([n]);if(r===null)return!1;const o=r.get(n);return o===void 0?!1:R(o,e.run_pid_identity)}t(h,"verifyLeasedCronRun");function k(e){return s(n=>{const r=[];if(e.cancel_on_wake&&e.anchor_node!==null){const o=n.prepare("SELECT * FROM crons WHERE anchor_node = ? AND cancel_on_wake = 1").all(e.anchor_node).map(u);for(const i of o)i.run_state==="running"&&c(i),n.prepare("DELETE FROM crons WHERE cron_id = ?").run(i.cron_id),r.push(i.cron_id)}return O(n,e),{cron_id:e.cron_id,replaced:r}})}t(k,"armCron");function O(e,n){const r=new Date().toISOString();e.prepare(`INSERT INTO crons (
          cron_id, name, created_by, command, fire_at, recur, tz, expires_at,
          anchor_node, cancel_on_wake, cwd, env_json, profile, scope,
          run_timeout_s, overlap, on_output, sink, tier, created, updated
-       ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
-        .run(spec.cron_id, spec.name, spec.created_by, spec.command, spec.fire_at, spec.recur, spec.tz, spec.expires_at, spec.anchor_node, spec.cancel_on_wake ? 1 : 0, spec.cwd, spec.env_json, spec.profile, spec.scope, spec.run_timeout_s, spec.overlap, spec.on_output, spec.sink, spec.tier, now, now);
-}
-/** SELECT one cron by id. */
-export function getCron(cron_id) {
-    const row = openDb().prepare('SELECT * FROM crons WHERE cron_id = ?').get(cron_id);
-    return row === undefined ? null : cronFrom(row);
-}
-/** List crons for a scope, next-fire order. `{profile}` = that profile's
- *  profile-scoped rows; `{global:true}` = global-scoped rows only;
- *  `{all:true}` = every cron on the canvas. */
-export function listCrons(scope) {
-    const db = openDb();
-    let rows;
-    if ('profile' in scope) {
-        rows = db
-            .prepare("SELECT * FROM crons WHERE scope = 'profile' AND profile = ? ORDER BY fire_at")
-            .all(scope.profile);
-    }
-    else if ('global' in scope) {
-        rows = db
-            .prepare("SELECT * FROM crons WHERE scope = 'global' ORDER BY fire_at")
-            .all();
-    }
-    else {
-        rows = db.prepare('SELECT * FROM crons ORDER BY fire_at').all();
-    }
-    return rows.map(cronFrom);
-}
-/** DELETE one cron — the explicit user/surface cancel. Idempotent: an absent
- *  row is a no-op `false`. Kills any in-flight run process group before
- *  deleting unless the daemon has proved the caller is that exact run; then
- *  the process must finish and deliver its already-produced output. The lease
- *  acquisition still linearizes before this selection (the run is observed
- *  and killed) or after the delete (and loses the lease). The FK cascade reaps
- *  the cron's run history with it. */
-export function cancelCron(cron_id, options) {
-    return withCanvasWrite((db) => {
-        const row = db.prepare('SELECT * FROM crons WHERE cron_id = ?').get(cron_id);
-        if (row === undefined)
-            return false;
-        const cron = cronFrom(row);
-        if (cron.run_state === 'running' && options?.preserveRunningProcess !== true)
-            killLeasedCronRun(cron);
-        db.prepare('DELETE FROM crons WHERE cron_id = ?').run(cron_id);
-        return true;
-    });
-}
-function profileCronWhere(profileId, anchorNodeIds) {
-    const anchors = [...new Set(anchorNodeIds)];
-    if (anchors.length === 0)
-        return { sql: 'profile = ?', params: [profileId] };
-    return {
-        sql: `profile = ? OR anchor_node IN (${anchors.map(() => '?').join(',')})`,
-        params: [profileId, ...anchors],
-    };
-}
-/** Cron ids a hard profile deletion will remove: matching execution profile,
- *  plus every row anchored to a node being deleted. */
-export function cronIdsForProfileDeletion(profileId, anchorNodeIds) {
-    const where = profileCronWhere(profileId, anchorNodeIds);
-    return openDb()
-        .prepare(`SELECT cron_id FROM crons WHERE ${where.sql} ORDER BY created, cron_id`)
-        .all(...where.params).map(({ cron_id }) => cron_id);
-}
-/** Kill any leased matching/anchored runs, then delete their rows together. */
-export function deleteCronsForProfile(profileId, anchorNodeIds) {
-    return withCanvasWrite((db) => {
-        const where = profileCronWhere(profileId, anchorNodeIds);
-        const rows = db
-            .prepare(`SELECT * FROM crons WHERE ${where.sql} ORDER BY created, cron_id`)
-            .all(...where.params).map(cronFrom);
-        for (const cron of rows) {
-            if (cron.run_state === 'running')
-                killLeasedCronRun(cron);
-        }
-        db.prepare(`DELETE FROM crons WHERE ${where.sql}`).run(...where.params);
-        return rows.map(({ cron_id }) => cron_id);
-    });
-}
-/** Cron ids whose snapshotted profile will be detached. */
-export function cronIdsForProfileDetach(profileId) {
-    return openDb()
-        .prepare('SELECT cron_id FROM crons WHERE profile = ? ORDER BY created, cron_id')
-        .all(profileId).map(({ cron_id }) => cron_id);
-}
-/** Preserve matching crons while removing their deleted profile dependency. */
-export function globalizeCronsForProfile(profileId) {
-    return withCanvasWrite((db) => {
-        const ids = db
-            .prepare('SELECT cron_id FROM crons WHERE profile = ? ORDER BY created, cron_id')
-            .all(profileId).map(({ cron_id }) => cron_id);
-        if (ids.length > 0) {
-            db.prepare("UPDATE crons SET profile = NULL, scope = 'global', updated = ? WHERE profile = ?")
-                .run(new Date().toISOString(), profileId);
-        }
-        return ids;
-    });
-}
-/** DELETE one cron by id — one-shot consumption after its run settles.
- *  Returns whether a live row was removed, so a consumer racing an explicit
- *  cancel can no-op instead of double-settling. */
-export function consumeCron(cron_id) {
-    return openDb().prepare('DELETE FROM crons WHERE cron_id = ?').run(cron_id).changes > 0;
-}
-/** UPDATE `state` (active|paused). Returns whether a row changed — pausing an
- *  already-paused cron (or a gone one) reports `false`. Pausing does NOT kill
- *  an in-flight run: the run settles normally, the row just stops being due. */
-export function setCronState(cron_id, state) {
-    return (openDb()
-        .prepare('UPDATE crons SET state = ?, updated = ? WHERE cron_id = ?')
-        .run(state, new Date().toISOString(), cron_id).changes > 0);
-}
-/** UPDATE `last_output_hash` — the on-change disposition's memory of the
- *  previous run's stdout. Written after EVERY settled run of an on-change
- *  cron, delivered or not. */
-export function setCronLastOutputHash(cron_id, hash) {
-    openDb()
-        .prepare('UPDATE crons SET last_output_hash = ?, updated = ? WHERE cron_id = ?')
-        .run(hash, new Date().toISOString(), cron_id);
-}
-/** True when a cron can still wake this node. An active deadline is a wake
- * source by its anchor; output delivery is a wake source by its decoded node
- * sink. Scheduled rows must remain active and unexpired, while a leased run
- * remains eligible through settlement even if it has since been paused or
- * expired. */
-export function hasPendingCronWake(nodeId) {
-    const rows = openDb().prepare(`SELECT anchor_node, cancel_on_wake, sink
+       ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(n.cron_id,n.name,n.created_by,n.command,n.fire_at,n.recur,n.tz,n.expires_at,n.anchor_node,n.cancel_on_wake?1:0,n.cwd,n.env_json,n.profile,n.scope,n.run_timeout_s,n.overlap,n.on_output,n.sink,n.tier,r,r)}t(O,"insertCron");function g(e){const n=a().prepare("SELECT * FROM crons WHERE cron_id = ?").get(e);return n===void 0?null:u(n)}t(g,"getCron");function W(e){const n=a();let r;return"profile"in e?r=n.prepare("SELECT * FROM crons WHERE scope = 'profile' AND profile = ? ORDER BY fire_at").all(e.profile):"global"in e?r=n.prepare("SELECT * FROM crons WHERE scope = 'global' ORDER BY fire_at").all():r=n.prepare("SELECT * FROM crons ORDER BY fire_at").all(),r.map(u)}t(W,"listCrons");function A(e,n){return s(r=>{const o=r.prepare("SELECT * FROM crons WHERE cron_id = ?").get(e);if(o===void 0)return!1;const i=u(o);return i.run_state==="running"&&n?.preserveRunningProcess!==!0&&c(i),r.prepare("DELETE FROM crons WHERE cron_id = ?").run(e),!0})}t(A,"cancelCron");function p(e,n){const r=[...new Set(n)];return r.length===0?{sql:"profile = ?",params:[e]}:{sql:`profile = ? OR anchor_node IN (${r.map(()=>"?").join(",")})`,params:[e,...r]}}t(p,"profileCronWhere");function H(e,n){const r=p(e,n);return a().prepare(`SELECT cron_id FROM crons WHERE ${r.sql} ORDER BY created, cron_id`).all(...r.params).map(({cron_id:o})=>o)}t(H,"cronIdsForProfileDeletion");function F(e,n){return s(r=>{const o=p(e,n),i=r.prepare(`SELECT * FROM crons WHERE ${o.sql} ORDER BY created, cron_id`).all(...o.params).map(u);for(const _ of i)_.run_state==="running"&&c(_);return r.prepare(`DELETE FROM crons WHERE ${o.sql}`).run(...o.params),i.map(({cron_id:_})=>_)})}t(F,"deleteCronsForProfile");function M(e){return a().prepare("SELECT cron_id FROM crons WHERE profile = ? ORDER BY created, cron_id").all(e).map(({cron_id:n})=>n)}t(M,"cronIdsForProfileDetach");function v(e){return s(n=>{const r=n.prepare("SELECT cron_id FROM crons WHERE profile = ? ORDER BY created, cron_id").all(e).map(({cron_id:o})=>o);return r.length>0&&n.prepare("UPDATE crons SET profile = NULL, scope = 'global', updated = ? WHERE profile = ?").run(new Date().toISOString(),e),r})}t(v,"globalizeCronsForProfile");function I(e){return a().prepare("DELETE FROM crons WHERE cron_id = ?").run(e).changes>0}t(I,"consumeCron");function P(e,n){return a().prepare("UPDATE crons SET state = ?, updated = ? WHERE cron_id = ?").run(n,new Date().toISOString(),e).changes>0}t(P,"setCronState");function U(e,n){a().prepare("UPDATE crons SET last_output_hash = ?, updated = ? WHERE cron_id = ?").run(n,new Date().toISOString(),e)}t(U,"setCronLastOutputHash");function y(e){const n=a().prepare(`SELECT anchor_node, cancel_on_wake, sink
      FROM crons
      WHERE (anchor_node = ? AND cancel_on_wake = 1 AND state = 'active')
         OR (
@@ -306,199 +11,24 @@ export function hasPendingCronWake(nodeId) {
             run_state = 'running'
             OR (run_state = 'idle' AND state = 'active' AND (expires_at IS NULL OR expires_at > ?))
           )
-        )`).all(nodeId, new Date().toISOString());
-    for (const row of rows) {
-        if (row['anchor_node'] === nodeId && Number(row['cancel_on_wake']) !== 0)
-            return true;
-        const sink = parseCronSink(row['sink']);
-        if (sink?.kind === 'node' && sink.node === nodeId)
-            return true;
-    }
-    return false;
-}
-/** DELETE every cancel-on-wake cron anchored to this node — the deadline rule.
- *  A real wake consumes the wait at its delivery boundary or, as a dormant
- *  fallback, in reviveNode; recovery replacement is not a wake. Terminal
- *  lifecycle transitions also clear the wait. Standing declarative crons are
- *  untouched. Kills an in-flight run process group first (the cancelCron
- *  discipline), under one canvas write boundary. Returns removed cron ids. */
-export function cancelCronsOnWake(anchor_node) {
-    return withCanvasWrite((db) => {
-        const rows = db
-            .prepare('SELECT * FROM crons WHERE anchor_node = ? AND cancel_on_wake = 1')
-            .all(anchor_node).map(cronFrom);
-        for (const c of rows) {
-            if (c.run_state === 'running')
-                killLeasedCronRun(c);
-            db.prepare('DELETE FROM crons WHERE cron_id = ?').run(c.cron_id);
-        }
-        return rows.map((c) => c.cron_id);
-    });
-}
-/** UPDATE the next fire time — recurrence advancement. The daemon settles a
- *  recurring row to its next slot BEFORE enacting the run (crash-safe). */
-export function advanceCron(cron_id, nextFireIso) {
-    openDb()
-        .prepare('UPDATE crons SET fire_at = ?, updated = ? WHERE cron_id = ?')
-        .run(nextFireIso, new Date().toISOString(), cron_id);
-}
-// Daemon run-executor primitives (src/daemon/cron-run.ts)
-/** The daemon's per-tick due query: active, idle, fire_at arrived, in
- *  deterministic order. The idle-only filter IS the default `overlap='skip'`
- *  behavior — a row whose previous run is still leased is simply not due.
- *  Returns exactly ONE row per cron regardless of missed slots — coalescing
- *  is structural (fire_at holds a single next occurrence). */
-export function dueClockCrons(nowIso) {
-    return openDb()
-        .prepare(`SELECT * FROM crons
+        )`).all(e,new Date().toISOString());for(const r of n){if(r.anchor_node===e&&Number(r.cancel_on_wake)!==0)return!0;const o=l(r.sink);if(o?.kind==="node"&&o.node===e)return!0}return!1}t(y,"hasPendingCronWake");function b(e){return s(n=>{const r=n.prepare("SELECT * FROM crons WHERE anchor_node = ? AND cancel_on_wake = 1").all(e).map(u);for(const o of r)o.run_state==="running"&&c(o),n.prepare("DELETE FROM crons WHERE cron_id = ?").run(o.cron_id);return r.map(o=>o.cron_id)})}t(b,"cancelCronsOnWake");function B(e,n){a().prepare("UPDATE crons SET fire_at = ?, updated = ? WHERE cron_id = ?").run(n,new Date().toISOString(),e)}t(B,"advanceCron");function Y(e){return a().prepare(`SELECT * FROM crons
          WHERE state = 'active' AND run_state = 'idle' AND fire_at <= ?
-         ORDER BY fire_at, created, cron_id`)
-        .all(nowIso).map(cronFrom).filter((cron) => !isProfilePaused(cron.profile));
-}
-/** Atomically acquire the idle run lease: flips `run_state` to 'running' and
- *  records lease/pid metadata, but ONLY if the row is still idle (the
- *  `WHERE run_state = 'idle'` guard is the atomicity). Returns whether THIS
- *  call acquired it.
- *
- *  The pid is recorded WITH its launch-time identity fingerprint, captured here
- *  from the just-spawned child: that fingerprint is what later authorizes any
- *  signal against this pid (`killLeasedCronRun`). A failed capture stores NULL,
- *  which costs the row its kill rights rather than licensing a blind kill.
- *
- *  `outOfBand` stamps the lease as a `cron run` (manual verification) so the
- *  overlap pass leaves it alone — see `dueOverlapCrons`. */
-export function acquireCronRunLease(cron_id, leaseOwner, pid, startedAtIso, outOfBand) {
-    const identity = capturePidIdentities([pid])?.get(pid) ?? null;
-    const res = openDb()
-        .prepare(`UPDATE crons
+         ORDER BY fire_at, created, cron_id`).all(e).map(u).filter(n=>!D(n.profile))}t(Y,"dueClockCrons");function q(e,n,r,o,i){const _=d([r])?.get(r)??null,E=a().prepare(`UPDATE crons
        SET run_state = 'running', run_started_at = ?, run_pid = ?, run_pid_identity = ?,
            run_lease_owner = ?, run_out_of_band = ?, updated = ?
-       WHERE cron_id = ? AND run_state = 'idle'`)
-        .run(startedAtIso, pid, identity, leaseOwner, outOfBand ? 1 : 0, new Date().toISOString(), cron_id);
-    return Number(res.changes) > 0;
-}
-/** Release the run lease back to idle (run settled, or stale-lease recovery
- *  for a dead pid), applying the settlement's `held` disposition in the same
- *  statement. */
-export function releaseCronRunLease(cron_id, held) {
-    let heldSql = '';
-    const heldParams = [];
-    if (held !== undefined) {
-        if (held.kind === 'clear') {
-            heldSql = ', held = 0';
-        }
-        else if (held.kind === 'park') {
-            heldSql = held.fireAt !== undefined ? ', held = 1, fire_at = ?' : ', held = 1';
-            if (held.fireAt !== undefined)
-                heldParams.push(held.fireAt);
-        }
-        else {
-            heldSql = ', held = 0, fire_at = ?';
-            heldParams.push(held.nowIso);
-        }
-    }
-    openDb()
-        .prepare(`UPDATE crons
+       WHERE cron_id = ? AND run_state = 'idle'`).run(o,r,_,n,i?1:0,new Date().toISOString(),e);return Number(E.changes)>0}t(q,"acquireCronRunLease");function $(e,n){let r="";const o=[];n!==void 0&&(n.kind==="clear"?r=", held = 0":n.kind==="park"?(r=n.fireAt!==void 0?", held = 1, fire_at = ?":", held = 1",n.fireAt!==void 0&&o.push(n.fireAt)):(r=", held = 0, fire_at = ?",o.push(n.nowIso))),a().prepare(`UPDATE crons
        SET run_state = 'idle', run_started_at = NULL, run_pid = NULL, run_pid_identity = NULL,
-           run_lease_owner = NULL, run_out_of_band = 0, updated = ?${heldSql}
-       WHERE cron_id = ?`)
-        .run(new Date().toISOString(), ...heldParams, cron_id);
-}
-/** The daemon-level eligibility poke (`POST /v1/crons/poke`): "something
- *  changed; re-check now". One write boundary, two statements:
- *    1. stamp `last_poke_at` on EVERY row — this is what reaches a gate check
- *       in flight right now, which statement 2 deliberately skips: its exit-75
- *       settlement sees the stamp and re-dues itself (the F2 branch in
- *       cron-run.ts);
- *    2. re-due every held active IDLE row now (fire_at=now, held=0). A leased
- *       row is excluded: its running gate check settles against the stamp —
- *       75 re-dues, and success means the gate resolved and the occurrence
- *       fired, poke satisfied. Unparking mid-run would overwrite the row's
- *       pre-advanced backstop slot with `now`, so a PASSING gate would fire a
- *       second time on the next tick.
- *  Paused rows are not unparked — pause is user-owned and freezes everything;
- *  a paused held row keeps its state and unparks via a later poke/backstop
- *  after resume (it still receives the stamp, harmlessly). Returns the
- *  unparked count. Idempotent and free when nothing is held. */
-export function pokeHeldCrons(nowIso) {
-    return withCanvasWrite((db) => {
-        db.prepare('UPDATE crons SET last_poke_at = ?').run(nowIso);
-        const res = db
-            .prepare("UPDATE crons SET fire_at = ?, held = 0, updated = ? WHERE held = 1 AND state = 'active' AND run_state = 'idle'")
-            .run(nowIso, nowIso);
-        return Number(res.changes);
-    });
-}
-/** Recurring crons whose NEXT fire has arrived while their previous run is
- *  still leased — the overlap-policy pass. One-shots never appear here (a
- *  one-shot has exactly one fire, already consumed by its running lease).
- *
- *  An OUT-OF-BAND lease (`cron run`) is excluded: overlap policy arbitrates
- *  between a SCHEDULED fire and the scheduled run already in flight. A manual
- *  verification is neither, so letting it participate would either advance
- *  `fire_at` past a genuine occurrence (`skip`) or SIGTERM the invoker's own
- *  run (`replace`). Such a row simply is not due for overlap; the real
- *  occurrence stays past-due and fires the moment the manual lease releases. */
-export function dueOverlapCrons(nowIso) {
-    return openDb()
-        .prepare(`SELECT * FROM crons
+           run_lease_owner = NULL, run_out_of_band = 0, updated = ?${r}
+       WHERE cron_id = ?`).run(new Date().toISOString(),...o,e)}t($,"releaseCronRunLease");function j(e){return s(n=>{n.prepare("UPDATE crons SET last_poke_at = ?").run(e);const r=n.prepare("UPDATE crons SET fire_at = ?, held = 0, updated = ? WHERE held = 1 AND state = 'active' AND run_state = 'idle'").run(e,e);return Number(r.changes)})}t(j,"pokeHeldCrons");function z(e){return a().prepare(`SELECT * FROM crons
          WHERE state = 'active' AND run_state = 'running' AND run_out_of_band = 0
            AND recur IS NOT NULL AND fire_at <= ?
-         ORDER BY fire_at, created, cron_id`)
-        .all(nowIso).map(cronFrom);
-}
-/** Crons whose clock bound (`expires_at`) has passed — the daemon deletes
- *  these each tick. Idle rows only: an expired row whose run is still in
- *  flight is picked up on a later tick, after the run settles. */
-export function expiredIdleCrons(nowIso) {
-    return openDb()
-        .prepare(`SELECT * FROM crons
+         ORDER BY fire_at, created, cron_id`).all(e).map(u)}t(z,"dueOverlapCrons");function G(e){return a().prepare(`SELECT * FROM crons
          WHERE expires_at IS NOT NULL AND expires_at <= ? AND run_state = 'idle'
-         ORDER BY expires_at`)
-        .all(nowIso).map(cronFrom);
-}
-/** The run-log ring for one cron, most recent first. */
-export function listCronRuns(cron_id) {
-    return openDb()
-        .prepare('SELECT * FROM cron_runs WHERE cron_id = ? ORDER BY started DESC, run_id DESC')
-        .all(cron_id).map((r) => ({
-        run_id: r['run_id'],
-        cron_id: r['cron_id'],
-        started: r['started'],
-        finished: r['finished'],
-        duration_ms: Number(r['duration_ms']),
-        exit_code: r['exit_code'] ?? null,
-        stdout_head: r['stdout_head'] ?? null,
-        stderr_head: r['stderr_head'] ?? null,
-        delivered: r['delivered'] ?? null,
-    }));
-}
-/** Every cron currently marked 'running' — the daemon's stale-lease recovery
- *  scan checks each recorded `run_pid` for liveness. */
-export function runningCrons() {
-    return openDb().prepare("SELECT * FROM crons WHERE run_state = 'running'").all().map(cronFrom);
-}
-/** INSERT one settled run record, then prune that cron's history down to the
- *  most recent CRON_RUN_RING rows — one canvas write boundary, so the ring
- *  bound holds atomically with the insert. Returns whether the record was
- *  written: a cron canceled while its run was in flight is already gone (and
- *  its history cascaded), so a settling run no-ops with `false` instead of
- *  violating the FK. */
-export function recordCronRunLocked(db, run) {
-    if (db.prepare('SELECT 1 FROM crons WHERE cron_id = ?').get(run.cron_id) === undefined) {
-        return false;
-    }
-    db.prepare(`INSERT INTO cron_runs (
+         ORDER BY expires_at`).all(e).map(u)}t(G,"expiredIdleCrons");function V(e){return a().prepare("SELECT * FROM cron_runs WHERE cron_id = ? ORDER BY started DESC, run_id DESC").all(e).map(n=>({run_id:n.run_id,cron_id:n.cron_id,started:n.started,finished:n.finished,duration_ms:Number(n.duration_ms),exit_code:n.exit_code??null,stdout_head:n.stdout_head??null,stderr_head:n.stderr_head??null,delivered:n.delivered??null}))}t(V,"listCronRuns");function J(){return a().prepare("SELECT * FROM crons WHERE run_state = 'running'").all().map(u)}t(J,"runningCrons");function C(e,n){return e.prepare("SELECT 1 FROM crons WHERE cron_id = ?").get(n.cron_id)===void 0?!1:(e.prepare(`INSERT INTO cron_runs (
        run_id, cron_id, started, finished, duration_ms, exit_code,
        stdout_head, stderr_head, delivered
-     ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(run.run_id, run.cron_id, run.started, run.finished, run.duration_ms, run.exit_code, run.stdout_head, run.stderr_head, run.delivered);
-    db.prepare(`DELETE FROM cron_runs
+     ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(n.run_id,n.cron_id,n.started,n.finished,n.duration_ms,n.exit_code,n.stdout_head,n.stderr_head,n.delivered),e.prepare(`DELETE FROM cron_runs
      WHERE cron_id = ? AND run_id NOT IN (
        SELECT run_id FROM cron_runs WHERE cron_id = ?
        ORDER BY started DESC, run_id DESC LIMIT ?
-     )`).run(run.cron_id, run.cron_id, CRON_RUN_RING);
-    return true;
-}
-export function recordCronRun(run) {
-    return withCanvasWrite((db) => recordCronRunLocked(db, run));
-}
+     )`).run(n.cron_id,n.cron_id,S),!0)}t(C,"recordCronRunLocked");function K(e){return s(n=>C(n,e))}t(K,"recordCronRun");export{S as CRON_RUN_RING,q as acquireCronRunLease,B as advanceCron,k as armCron,A as cancelCron,b as cancelCronsOnWake,I as consumeCron,H as cronIdsForProfileDeletion,M as cronIdsForProfileDetach,x as cronSinkDisplay,F as deleteCronsForProfile,Y as dueClockCrons,z as dueOverlapCrons,G as expiredIdleCrons,g as getCron,v as globalizeCronsForProfile,y as hasPendingCronWake,c as killLeasedCronRun,V as listCronRuns,W as listCrons,l as parseCronSink,j as pokeHeldCrons,K as recordCronRun,C as recordCronRunLocked,$ as releaseCronRunLease,J as runningCrons,U as setCronLastOutputHash,P as setCronState,h as verifyLeasedCronRun};