@plitzi/sdk-server 0.37.1 → 0.37.3

package/dist/index.d.ts

@@ -1,6 +1,8 @@
 export { createServer, resolveServices } from './core/createServer';
+export { closeOnSignals } from './core/server/closeOnSignals';
+export { loadFunctions, readFunctionsDir } from './modules/functions/load';
 export { registerHealthCheck, buildHealthPayload } from './core/health';
-export { consoleLogger, renderLogEvent } from './helpers/serverLog';
+export { consoleLogger, isLogged, logLevelOf, renderLogEvent, serverLog } from './helpers/serverLog';
 export type { HealthCheckApp, HealthIdentity } from './core/health';
 export { createCloudAdapters } from './adapters/cloudAdapters';
 export { createJsonAdapters } from './adapters/jsonAdapters';
@@ -8,6 +10,8 @@ export { createAuthAdapters } from './adapters/authAdapters';
 export { authoringPreview, createMemoryCache, createSpaceAdapters, fixedSpace, presentsCredential, refuse, verifiedDomain, wildcardSubdomain } from './adapters/space';
 export { createLocalFontStore, hostedPathsOf } from './core/fontStore';
 export { createMemoryDraftStore, takeDraftOverride } from './modules/ssr/preview';
+export { createMemoryPubSub } from './modules/realtime/memoryPubSub';
+export { createRedisPubSub } from './modules/realtime/redisPubSub';
 export { PREVIEW_TOKEN_PARAM } from './core/previewToken';
 export { resolveRscData } from './modules/rsc/resolveRscData';
 export { fetchConnectorRecords, rebaseMedia, writeConnectorRecord, createConnectorResolver } from './modules/connectors';
@@ -18,5 +22,8 @@ export type { AuthoringPreviewOptions, DeploymentRow, FrameAncestorsConfig, Spac
 export type { RscElementResolver, RscResolveContext, ResolveRscDataOptions } from './modules/rsc/resolveRscData';
 export type { ConnectorAuth, ConnectorCredential, ConnectorEndpoints, ConnectorFilter, ConnectorLookups, ConnectorManifest, ConnectorManifestDraft, ConnectorPageInfo, ConnectorPagination, ConnectorQuery, ConnectorReadEndpoint, ConnectorRecord, ConnectorResponseMapping, ConnectorResult, ProviderPagination } from './modules/connectors';
 export type { FontStore, StoredFont } from './core/fontStore';
+export type { PubSubAdapter, SSRRealtimeConfig } from '@plitzi/sdk-shared';
+export type { RedisPubSubClients } from './modules/realtime/redisPubSub';
 export type { ResolvedServices } from './core/createServer';
+export type { Closable, CloseOnSignalsOptions } from './core/server/closeOnSignals';
 export type { BaseContext, PipelineExtensions, SSRContext, Stage } from './core/http/types';

package/dist/index.js

@@ -1,4 +1,6 @@
+import { consoleLogger, isLogged, logLevelOf, renderLogEvent, serverLog } from "./helpers/serverLog.js";
 import { fetchConnectorRecords, rebaseMedia, writeConnectorRecord } from "./modules/connectors/engine.js";
+import { createMemoryPubSub } from "./modules/realtime/memoryPubSub.js";
 import { createConnectorResolver } from "./modules/connectors/resolver.js";
 import { resolveRscData } from "./modules/rsc/resolveRscData.js";
 import { PREVIEW_TOKEN_PARAM } from "./core/previewToken.js";
@@ -6,7 +8,8 @@ import { createMemoryDraftStore, takeDraftOverride } from "./modules/ssr/preview
 import { resolveServices } from "./core/services/resolve.js";
 import { buildHealthPayload, registerHealthCheck } from "./core/health.js";
 import { createServer } from "./core/createServer.js";
-import { consoleLogger, renderLogEvent } from "./helpers/serverLog.js";
+import { closeOnSignals } from "./core/server/closeOnSignals.js";
+import { loadFunctions, readFunctionsDir } from "./modules/functions/load.js";
 import { createCloudAdapters } from "./adapters/cloudAdapters.js";
 import { createJsonAdapters } from "./adapters/jsonAdapters.js";
 import { createAuthAdapters } from "./adapters/authAdapters.js";
@@ -14,4 +17,5 @@ import { createMemoryCache, refuse } from "./adapters/space/types.js";
 import { authoringPreview, fixedSpace, presentsCredential, verifiedDomain, wildcardSubdomain } from "./adapters/space/resolvers.js";
 import { createSpaceAdapters } from "./adapters/space/index.js";
 import { createLocalFontStore, hostedPathsOf } from "./core/fontStore.js";
-export { PREVIEW_TOKEN_PARAM, authoringPreview, buildHealthPayload, consoleLogger, createAuthAdapters, createCloudAdapters, createConnectorResolver, createJsonAdapters, createLocalFontStore, createMemoryCache, createMemoryDraftStore, createServer, createSpaceAdapters, fetchConnectorRecords, fixedSpace, hostedPathsOf, presentsCredential, rebaseMedia, refuse, registerHealthCheck, renderLogEvent, resolveRscData, resolveServices, takeDraftOverride, verifiedDomain, wildcardSubdomain, writeConnectorRecord };
+import { createRedisPubSub } from "./modules/realtime/redisPubSub.js";
+export { PREVIEW_TOKEN_PARAM, authoringPreview, buildHealthPayload, closeOnSignals, consoleLogger, createAuthAdapters, createCloudAdapters, createConnectorResolver, createJsonAdapters, createLocalFontStore, createMemoryCache, createMemoryDraftStore, createMemoryPubSub, createRedisPubSub, createServer, createSpaceAdapters, fetchConnectorRecords, fixedSpace, hostedPathsOf, isLogged, loadFunctions, logLevelOf, presentsCredential, readFunctionsDir, rebaseMedia, refuse, registerHealthCheck, renderLogEvent, resolveRscData, resolveServices, serverLog, takeDraftOverride, verifiedDomain, wildcardSubdomain, writeConnectorRecord };

package/dist/kernel.d.ts

@@ -16,8 +16,9 @@ export { healthStage } from './core/http/stages/health';
 export { configStaticStage, publicDirStage, wellKnownStage } from './core/http/stages/static';
 export { buildHealthPayload, registerHealthCheck } from './core/health';
 export { clientIp, parseRequest, readRawBody, requestOrigin } from './core/requestParser';
-export { consoleLogger, renderLogEvent } from './helpers/serverLog';
+export { consoleLogger, isLogged, logLevelOf, renderLogEvent, serverLog } from './helpers/serverLog';
 export { PREVIEW_TOKEN_PARAM } from './core/previewToken';
+export { assertOutboundAllowed, isBlockedHost } from './helpers/outboundGuard';
 export type { HttpServerParts } from './core/server/baseServer';
 export type { BuildContext } from './core/http/dispatcher';
 export type { HealthCheckApp, HealthIdentity } from './core/health';

package/dist/kernel.js

@@ -1,3 +1,5 @@
+import { consoleLogger, isLogged, logLevelOf, renderLogEvent, serverLog } from "./helpers/serverLog.js";
+import { assertOutboundAllowed, isBlockedHost } from "./helpers/outboundGuard.js";
 import { clientIp, parseRequest, readRawBody, requestOrigin } from "./core/requestParser.js";
 import { createHttpServer } from "./core/server/baseServer.js";
 import { PREVIEW_TOKEN_PARAM } from "./core/previewToken.js";
@@ -5,5 +7,4 @@ import { makeHandler } from "./core/http/dispatcher.js";
 import { buildHealthPayload, registerHealthCheck } from "./core/health.js";
 import { healthStage } from "./core/http/stages/health.js";
 import { configStaticStage, publicDirStage, wellKnownStage } from "./core/http/stages/static.js";
-import { consoleLogger, renderLogEvent } from "./helpers/serverLog.js";
-export { PREVIEW_TOKEN_PARAM, buildHealthPayload, clientIp, configStaticStage, consoleLogger, createHttpServer, healthStage, makeHandler, parseRequest, publicDirStage, readRawBody, registerHealthCheck, renderLogEvent, requestOrigin, wellKnownStage };
+export { PREVIEW_TOKEN_PARAM, assertOutboundAllowed, buildHealthPayload, clientIp, configStaticStage, consoleLogger, createHttpServer, healthStage, isBlockedHost, isLogged, logLevelOf, makeHandler, parseRequest, publicDirStage, readRawBody, registerHealthCheck, renderLogEvent, requestOrigin, serverLog, wellKnownStage };

package/dist/modules/actions/connectorWrite.js

@@ -1,3 +1,4 @@
+import { serverLog } from "../../helpers/serverLog.js";
 import { writeConnectorRecord } from "../connectors/engine.js";
 //#region src/modules/actions/connectorWrite.ts
 var parseBody = (body) => {
@@ -72,7 +73,7 @@ var handleAction = async (req, res, config, lookups) => {
 		res.setHeader("Cache-Control", "no-store");
 		res.send(JSON.stringify({ record: record ?? null }));
 	} catch (err) {
-		console.error("[Action] connector write failed:", err);
+		serverLog.error("Action", "connector write failed", err);
 		fail(res, 502, "Connector write failed");
 	}
 };

package/dist/modules/actions/index.d.ts

@@ -1,30 +1,58 @@
+import { ActionJobs } from './jobs';
 import { RunGuards } from './runtime/guards';
 import { ActionRunner } from './runtime/runAction';
-import { ActionKvStore, ActionsConfig, ActionTaskRegistry, ResolvedActionLimits } from './types';
+import { ActionKvStore, ActionsConfig, ActionTaskRegistry, ResolvedActionLimits, SpaceRevision } from './types';
+import { FunctionsSource } from '../functions/build';
+import { ManifestReading } from '../functions/manifest';
+import { RouteHandler, RouteVisit } from '../functions/routes';
+import { PreparedFunctions } from '../functions/space';
 import { ActionDocument } from '@plitzi/sdk-shared';
 export type ActionsModule = ActionRunner & {
+    /** The deployment's own tasks: shipped, and its native functions. */
     registry: ActionTaskRegistry;
+    /**
+     * What a space's actions can use as of that revision: the deployment's tasks and the space's own functions — what
+     * its catalog offers, what a check checks against and what its runs run.
+     */
+    registryFor: (spaceId: number, at?: SpaceRevision) => Promise<ActionTaskRegistry>;
+    /**
+     * A space's functions source, built, read and checked — ready to store, or the problems to show where they are. The
+     * one way a space's functions become storable; refused when this server has no runner.
+     */
+    prepareFunctions: (source: FunctionsSource) => Promise<PreparedFunctions>;
+    /**
+     * What a space's code declares, read by every rule a saved space's functions meet — for code that is not built here:
+     * a space runtime's, described by the runtime itself when it starts. The manifest, and the problems that refuse it.
+     */
+    readManifest: (declared: unknown) => ManifestReading;
+    /**
+     * The function that answers `method path` under `/api/` for this visit — the deployment's own routes, then the space's
+     * — or none, and the page server answers as it would have.
+     */
+    routeFor: (visit: RouteVisit, method: string, path: string) => Promise<RouteHandler | undefined>;
     guards: RunGuards;
     /** The key/value store, namespaced to one space — the same one the `kv` tasks write through, so a rate limit the
      *  transport keeps and a counter a flow keeps cannot end up in different places. */
     kv: (spaceId: number) => ActionKvStore;
     /** What this server will allow one run of that document to spend — the deployment's ceilings, tightened by it. */
     limitsFor: (document: ActionDocument) => ResolvedActionLimits;
+    /**
+     * Scheduled runs: the queue, the sweep that fills it and the workers that drain it.
+     *
+     * Built but NOT started — whoever owns the process decides when background work begins, and a server nobody
+     * listened on must not be quietly claiming jobs. Absent when the deployment cannot list a space's actions, since
+     * there is then no way to know what is scheduled.
+     */
+    jobs?: ActionJobs;
 };
-/**
- * The module's whole public surface: build it once from the deployment's config, then run actions through it.
- *
- * Constructed rather than imported piecemeal so the task registry is validated ONCE, at boot, and so the guards
- * are a single set for the process — two instances would each think they were the only run in flight, which is
- * the same as having no single-flight at all. Nothing outside this folder needs to know how a run is assembled.
- */
-export declare const createActionsModule: (config: ActionsConfig) => ActionsModule;
-export { ActionRunError } from './runtime/errors';
+export declare const createActionsModule: (given: ActionsConfig) => ActionsModule;
+export { ActionRefusal, ActionRunError } from './runtime/errors';
 export { precheckRun } from './runtime/precheck';
+export { spaceKvPatterns } from './runtime/namespaceKv';
 export { checkAction } from './runtime/check';
 export { DEFAULT_LIMITS, resolveLimits } from './runtime/limits';
 export { createRunGuards, deriveRunKey } from './runtime/guards';
-export { createScheduleRunner } from './runtime/schedule';
+export { createActionJobs, createJobWorker, createMemoryJobQueue, createScheduler } from './jobs';
 export { createMemoryKv } from './runtime/memoryKv';
 export { createRunLogger, createRejectLogger } from './runtime/runLogger';
 export { createTaskRegistry, taskName } from './tasks/registry';
@@ -34,8 +62,8 @@ export { handleActionCatalog } from './transport/catalogHandler';
 export { handleActionWebhook } from './transport/webhookHandler';
 export { verifySignature } from './transport/verifySignature';
 export { handleActionCancel } from './transport/cancelHandler';
+export type { ActionJobs, JobWorker, JobWorkerOptions, Scheduler, SchedulerOptions, SweepResult } from './jobs';
 export type { ActiveRun, RunGuards } from './runtime/guards';
-export type { ScheduleResult, ScheduleRunner, ScheduleTick } from './runtime/schedule';
 export type { ActionTaskDescriptor } from './taskCatalog';
 export type { TaskRegistryOptions } from './tasks/registry';
-export type { ActionCredential, ActionDbDriver, ActionEmailConfig, ActionEmailDelivery, ActionEmailMessage, ActionEmailTransport, ActionKvStore, ActionLookups, ActionRejectRecord, ActionRunRecord, ActionRunRequest, ActionRunResult, ActionsConfig, ActionTask, ActionTaskContext, ActionTaskRegistry, RegisteredTask, ResolvedConnector } from './types';
+export type { ActionCredential, ActionDbDriver, ActionEmailConfig, ActionEmailDelivery, ActionEmailMessage, ActionEmailTransport, ActionJobsConfig, ActionKvStore, ActionLookups, ActionRejectRecord, ActionRunRecord, ActionRunRequest, ActionRunResult, ActionsConfig, ActionTask, ActionTaskContext, ActionTaskRegistry, RegisteredTask, ResolvedConnector } from './types';

package/dist/modules/actions/index.js

@@ -1,14 +1,21 @@
+import "./jobs/memoryQueue.js";
+import "./jobs/scheduler.js";
 import "./runtime/errors.js";
+import "./jobs/worker.js";
+import { fleetStore } from "../../core/server/fleet/link.js";
+import { createActionJobs } from "./jobs/index.js";
 import { createRunGuards } from "./runtime/guards.js";
 import { createKvStore } from "./runtime/kvStore.js";
 import { resolveLimits } from "./runtime/limits.js";
-import { createMemoryKv } from "./runtime/memoryKv.js";
-import { namespaceKv } from "./runtime/namespaceKv.js";
+import { KV_METHODS, createMemoryKv } from "./runtime/memoryKv.js";
+import { namespaceKv, spaceKvPatterns } from "./runtime/namespaceKv.js";
 import "./runtime/precheck.js";
 import { createActionRunner } from "./runtime/runAction.js";
 import { createTaskRegistry } from "./tasks/registry.js";
+import { readManifest } from "../functions/manifest.js";
+import { createRoutes } from "../functions/routes.js";
+import { createSpaceRegistries, prepareFunctions } from "../functions/space.js";
 import "./runtime/check.js";
-import "./runtime/schedule.js";
 import "./runtime/runLogger.js";
 import "./taskCatalog.js";
 import { handleActionCall } from "./transport/callHandler.js";
@@ -24,9 +31,32 @@ import { handleActionCancel } from "./transport/cancelHandler.js";
 * are a single set for the process — two instances would each think they were the only run in flight, which is
 * the same as having no single-flight at all. Nothing outside this folder needs to know how a run is assembled.
 */
-var createActionsModule = (config) => {
-	const registry = createTaskRegistry(config.tasks, { db: (config.dbDrivers?.length ?? 0) > 0 });
-	const { runAction } = createActionRunner(config, registry, config.fetchImpl);
+/**
+* The workers of one server are one replica, so with no `kv` configured they share the primary's: a flow's counter,
+* a webhook's rate limit, a run's single-flight key, a cancel and a replayed answer then mean the same whichever
+* worker the request lands on — the path a deployment with its own shared store already takes. One process keeps
+* its own map.
+*/
+var withFleetKv = (config) => {
+	if (config.kv) return config;
+	return {
+		...config,
+		kv: fleetStore("actions.kv", KV_METHODS) ?? createMemoryKv()
+	};
+};
+var createActionsModule = (given) => {
+	const config = withFleetKv(given);
+	const registry = createTaskRegistry(config.functions?.native, { db: (config.dbDrivers?.length ?? 0) > 0 });
+	const spaceRegistries = createSpaceRegistries(registry, config.functions);
+	const reserved = new Set(registry.list().map((task) => task.namespace));
+	const registryFor = async (spaceId, at) => spaceRegistries.registryFor(await config.lookups.getFunctions?.(spaceId, at));
+	const registryForRun = (request) => Object.values(request.entry.document.nodes).every((node) => node.type !== "task" || !node.action || registry.get(node.action)) ? registry : registryFor(request.spaceId, request.at);
+	const { runAction, taskContext } = createActionRunner(config, registryForRun, config.fetchImpl);
+	const routes = createRoutes({
+		config: config.functions ?? {},
+		...config.lookups.getFunctions ? { getFunctions: config.lookups.getFunctions } : {},
+		taskContext
+	});
 	/**
 	* Single-flight over the store the deployment already gave the `kv` tasks — its own Redis, table or whatever it
 	* runs — because per process it is not a guarantee: the same double-click behind a load balancer lands on two
@@ -34,13 +64,26 @@ var createActionsModule = (config) => {
 	*/
 	const guards = createRunGuards(config.concurrency, config.kv, config.idempotency);
 	const kv = createKvStore(config.kv ?? createMemoryKv());
-	return {
+	const limitsFor = (document) => resolveLimits(config.limits, document.limits);
+	const module = {
 		runAction,
 		registry,
+		registryFor,
+		routeFor: routes.routeFor,
+		prepareFunctions: (source) => {
+			const runner = config.functions?.runner;
+			return runner ? prepareFunctions(source, runner, reserved) : Promise.resolve({
+				ok: false,
+				problems: [{ message: "This server runs no space functions" }]
+			});
+		},
+		readManifest: (declared) => readManifest(declared, reserved),
 		guards,
 		kv: (spaceId) => namespaceKv(kv, spaceId),
-		limitsFor: (document) => resolveLimits(config.limits, document.limits)
+		limitsFor
 	};
+	if (config.jobs !== false && config.lookups.listActions) module.jobs = createActionJobs(config.jobs ?? {}, module, config.lookups);
+	return module;
 };
 //#endregion
-export { createActionsModule, handleActionCall, handleActionCancel, handleActionCatalog, handleActionWebhook };
+export { createActionsModule, handleActionCall, handleActionCancel, handleActionCatalog, handleActionWebhook, spaceKvPatterns };

package/dist/modules/actions/jobs/failureStreak.d.ts

@@ -0,0 +1,17 @@
+/** How long a pass may keep failing before it is reported as the error it has become. */
+export declare const FAILURE_STREAK_ESCALATION_MS = 60000;
+export type FailureStreak = {
+    failed: (error: unknown) => void;
+    succeeded: () => void;
+};
+/**
+ * How a pass that runs again by itself reports failing: a schedule sweep, a claim, a heartbeat.
+ *
+ * A store that drops its connections for a moment — a failover, a driver resetting its pool because the host stalled
+ * — fails one pass, and the next, seconds later, works. Nothing is lost: every pass is safe to repeat. Reported as an
+ * error with a stack, each of those read as an incident, and the ones that are an incident read the same.
+ *
+ * So the first failure of a streak is a warning with its reason; a streak still going after `escalateAfterMs` is the
+ * error, with the whole cause, once; and the pass that ends a streak that got that far says so.
+ */
+export declare const createFailureStreak: (scope: string, what: string, escalateAfterMs?: number, now?: () => number) => FailureStreak;

package/dist/modules/actions/jobs/failureStreak.js

@@ -0,0 +1,47 @@
+import { serverLog } from "../../../helpers/serverLog.js";
+//#region src/modules/actions/jobs/failureStreak.ts
+/** How long a pass may keep failing before it is reported as the error it has become. */
+var FAILURE_STREAK_ESCALATION_MS = 6e4;
+var reasonOf = (error) => error instanceof Error ? error.message : String(error);
+/**
+* How a pass that runs again by itself reports failing: a schedule sweep, a claim, a heartbeat.
+*
+* A store that drops its connections for a moment — a failover, a driver resetting its pool because the host stalled
+* — fails one pass, and the next, seconds later, works. Nothing is lost: every pass is safe to repeat. Reported as an
+* error with a stack, each of those read as an incident, and the ones that are an incident read the same.
+*
+* So the first failure of a streak is a warning with its reason; a streak still going after `escalateAfterMs` is the
+* error, with the whole cause, once; and the pass that ends a streak that got that far says so.
+*/
+var createFailureStreak = (scope, what, escalateAfterMs = FAILURE_STREAK_ESCALATION_MS, now = Date.now) => {
+	let since;
+	let failures = 0;
+	let escalated = false;
+	return {
+		failed: (error) => {
+			failures += 1;
+			if (since === void 0) {
+				since = now();
+				serverLog.warn(scope, `${what} failed, trying again`, reasonOf(error));
+				return;
+			}
+			const elapsed = now() - since;
+			if (!escalated && elapsed >= escalateAfterMs) {
+				escalated = true;
+				serverLog.error(scope, `${what} has been failing for ${String(Math.round(elapsed / 1e3))}s`, error);
+			}
+		},
+		succeeded: () => {
+			if (since === void 0) return;
+			if (escalated) {
+				const seconds = Math.round((now() - since) / 1e3);
+				serverLog.info(scope, `${what} is working again, after ${String(failures)} failures over ${String(seconds)}s`);
+			}
+			since = void 0;
+			failures = 0;
+			escalated = false;
+		}
+	};
+};
+//#endregion
+export { FAILURE_STREAK_ESCALATION_MS, createFailureStreak };

package/dist/modules/actions/jobs/failureStreak.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/modules/actions/jobs/index.d.ts

@@ -0,0 +1,33 @@
+import { Scheduler } from './scheduler';
+import { JobWorker } from './worker';
+import { ActionsModule } from '../index';
+import { ActionJobsConfig, ActionLookups } from '../types';
+import { ActionJobQueue } from '@plitzi/sdk-shared';
+export type ActionJobs = {
+    queue: ActionJobQueue;
+    scheduler: Scheduler;
+    worker: JobWorker;
+    start: () => void;
+    stop: () => Promise<void>;
+};
+/**
+ * The scheduling half of actions: a producer, a consumer and the store they meet in.
+ *
+ * Both halves run in EVERY replica by default, and neither needs to know about the others. The producer is safe to
+ * duplicate because a fire's job id is the fire's own instant; the consumer is safe to duplicate because a claim is
+ * atomic. What a deployment tunes is how many jobs each replica carries (`workers`) and whether it produces at all
+ * — a pod dedicated to running jobs sets `produce: false`, a pod serving pages sets `workers: 0`.
+ *
+ * With no `queue` supplied this is one process's memory, which is right for a single replica and wrong the moment
+ * there are two. That is a sentence rather than a silent behaviour because the failure is invisible: everything
+ * works, and the nightly email goes out once per replica. The workers of one server are one replica: they share
+ * the primary's queue, and only one of them runs the scheduler and the jobs (`runsFleetJobs`).
+ */
+export declare const createActionJobs: (config: ActionJobsConfig, module: ActionsModule, lookups: ActionLookups) => ActionJobs;
+export { createMemoryJobQueue } from './memoryQueue';
+export { createScheduler } from './scheduler';
+export { createJobWorker } from './worker';
+export { DEFAULT_MAX_ATTEMPTS, scheduleFor, scheduleJobId, schedulesFor } from './schedules';
+export type { MemoryJobQueueOptions } from './memoryQueue';
+export type { Scheduler, SchedulerOptions, SweepResult } from './scheduler';
+export type { JobWorker, JobWorkerOptions } from './worker';

package/dist/modules/actions/jobs/index.js

@@ -0,0 +1,59 @@
+import { JOB_QUEUE_METHODS, createMemoryJobQueue } from "./memoryQueue.js";
+import { DEFAULT_MAX_ATTEMPTS, scheduleFor, scheduleJobId, schedulesFor } from "./schedules.js";
+import { createScheduler } from "./scheduler.js";
+import { createJobWorker } from "./worker.js";
+import { fleetStore } from "../../../core/server/fleet/link.js";
+//#region src/modules/actions/jobs/index.ts
+/**
+* The scheduling half of actions: a producer, a consumer and the store they meet in.
+*
+* Both halves run in EVERY replica by default, and neither needs to know about the others. The producer is safe to
+* duplicate because a fire's job id is the fire's own instant; the consumer is safe to duplicate because a claim is
+* atomic. What a deployment tunes is how many jobs each replica carries (`workers`) and whether it produces at all
+* — a pod dedicated to running jobs sets `produce: false`, a pod serving pages sets `workers: 0`.
+*
+* With no `queue` supplied this is one process's memory, which is right for a single replica and wrong the moment
+* there are two. That is a sentence rather than a silent behaviour because the failure is invisible: everything
+* works, and the nightly email goes out once per replica. The workers of one server are one replica: they share
+* the primary's queue, and only one of them runs the scheduler and the jobs (`runsFleetJobs`).
+*/
+var createActionJobs = (config, module, lookups) => {
+	const queue = config.queue ?? fleetStore("actions.jobs", JOB_QUEUE_METHODS) ?? createMemoryJobQueue();
+	const { produce = true, workers = 4 } = config;
+	const scheduler = createScheduler({
+		queue,
+		lookups,
+		...config.environment ? { environment: config.environment } : {},
+		...config.schedulePollMs ? { pollMs: config.schedulePollMs } : {},
+		...config.maxAttempts ? { maxAttempts: config.maxAttempts } : {},
+		...config.reconcileMs ? { reconcileMs: config.reconcileMs } : {},
+		...config.spaces ? { spaces: config.spaces } : {},
+		...config.onError ? { onError: config.onError } : {}
+	});
+	const worker = createJobWorker({
+		queue,
+		lookups,
+		module,
+		workers,
+		...config.pollMs ? { pollMs: config.pollMs } : {},
+		...config.leaseMs ? { leaseMs: config.leaseMs } : {},
+		...config.backoff ? { backoff: config.backoff } : {},
+		...config.workerId ? { workerId: config.workerId } : {},
+		...config.onError ? { onError: config.onError } : {}
+	});
+	return {
+		queue,
+		scheduler,
+		worker,
+		start: () => {
+			if (produce) scheduler.start();
+			worker.start();
+		},
+		stop: async () => {
+			scheduler.stop();
+			await worker.stop();
+		}
+	};
+};
+//#endregion
+export { DEFAULT_MAX_ATTEMPTS, createActionJobs, createJobWorker, createMemoryJobQueue, createScheduler, scheduleFor, scheduleJobId, schedulesFor };

package/dist/modules/actions/jobs/memoryQueue.d.ts

@@ -0,0 +1,33 @@
+import { StoreMethods } from '../../../core/server/fleet/channel';
+import { ActionJobQueue } from '@plitzi/sdk-shared';
+export type MemoryJobQueueOptions = {
+    /**
+     * How many finished jobs to keep before the oldest are dropped.
+     *
+     * A bound rather than a retention period, because this store has no eviction of its own and an unbounded history
+     * in a long-lived process is a leak with a nice name. A deployment that wants jobs it can still read next week
+     * supplies a queue backed by something that survives a restart.
+     */
+    retainFinished?: number;
+    /**
+     * What this queue calls now, in epoch ms.
+     *
+     * The seam that makes a lease, a backoff and an overdue schedule testable without waiting for one — and the
+     * shape of the rule a shared store keeps too: everything here reads ONE clock, and it is the store's.
+     */
+    clock?: () => number;
+};
+/** Every method of the queue, for the copy a server's workers share (see `fleet/stores.ts`). */
+export declare const JOB_QUEUE_METHODS: StoreMethods<ActionJobQueue>;
+/**
+ * The default queue: one process's Maps.
+ *
+ * Correct for a deployment that runs ONE replica, which is most self-hosted ones, and honest about the rest — a
+ * second replica running on this gets its own schedules and its own jobs, so a nightly digest goes out twice. The
+ * cure is any store the replicas share, behind the same {@link ActionJobQueue} seam.
+ *
+ * It keeps the contract exactly, rather than approximately: enqueue is idempotent by id, a claim reaps lapsed
+ * leases, and every instant is read here rather than accepted from a caller. A test that passes against this one
+ * is testing the rules a shared store has to keep too.
+ */
+export declare const createMemoryJobQueue: ({ retainFinished, clock }?: MemoryJobQueueOptions) => ActionJobQueue;