@raybase/core 0.3.6 → 0.3.7

package/dist/worker.js

@@ -45,7 +45,7 @@ import { appNowIso, appNowMs, devTimeTravelStateKey, hydrateAppClock, installDev
 import { createRaybaseRuntimeEnv, raybaseAgentConversationName, raybaseCoreRuntimeProfile, RaybaseRuntimeProfileConfigurationError, raybaseRuntimeProfile, raybaseRuntimeSettingsAppId, raybaseRuntimeScopeClaims, raybaseRuntimeScope, runtimePolicySubjectId, withRaybaseRuntimeClaims } from "./platform.js";
 import { appUrlForEmail, cloudflareEmailNotificationAdapter, hasRaybaseAuthEmailConfig, isRaybaseAuthEmailFeatureEnabled, raybaseAuthEmailProvider, redactedEmailError, resolveRaybaseAuthEmailConfig, sendRaybaseAuthEmail } from "./email.js";
 import { accessDeniedPage, forgotPasswordPage, loginPage, page, resetPasswordPage, setupPage, signupPage, verifyEmailPage } from "./html.js";
-import { authorizationServerMetadata, authorizeMcpOAuthRequest, mcpMetadataSurface, mcpOAuthConsentContext, beginMcpHostAuthorization, checkMcpRateLimit, completeMcpHostApproval, createMcpHandler, exchangeMcpOAuthToken, handleMcpHostConnect, listMcpGrants, listMcpOAuthClientsForUser, operatorMcpEnabled, operatorMcpEndpoint, protectedResourceMetadata, raybaseMcpSystemTables, registerMcpOAuthClient, revokeMcpGrant, revokeMcpOAuthClient, revokeMcpOAuthToken } from "./mcp.js";
+import { authorizationServerMetadata, authorizeMcpOAuthRequest, mcpAppConnectorScopes, mcpMetadataSurface, mcpOAuthConsentContext, beginMcpHostAuthorization, checkMcpRateLimit, completeMcpHostApproval, createMcpHandler, exchangeMcpOAuthToken, handleMcpHostConnect, listMcpGrants, listMcpOAuthClientsForUser, operatorMcpEnabled, operatorMcpEndpoint, protectedResourceMetadata, raybaseMcpSystemTables, registerMcpOAuthClient, revokeMcpGrant, revokeMcpOAuthClient, revokeMcpOAuthToken } from "./mcp.js";
 import { createCoreOperatorMcpResources, createCoreOperatorMcpTools } from "./operator-mcp.js";
 import { mergeRaybaseRecords, mergeRaybaseRetrieval, mergeRaybaseSearch, resolveRaybaseModules } from "./modules.js";
 import { claimAndRunNotificationDeliveries, compactNotificationThrottleWindows, createNotificationsOperatorEvidenceProvider, createNotificationsRuntime, handleInboundNotification, mergeRaybaseNotifications, notificationAdminSummary, notificationDeliveriesQuery, notificationDeliveryDetail, notificationInboundEventDetail, notificationInboundEventsQuery, notificationThrottleWindowsQuery, notificationJobPrincipal, raybaseNotificationDeliveryJobName, raybaseNotificationRecipientsTableName, raybaseNotificationsTableName, raybaseNotificationServicePrincipal, raybaseNotificationSystemTables, resetNotificationThrottleWindow, retryNotificationDelivery, resolveNotificationConfig, validateNotifications } from "./notifications.js";
@@ -72,6 +72,7 @@ import { raybaseFilesTableName, validateStorageConfig } from "./storage.js";
 import { supportModule } from "./support.js";
 import { adminBrowsableSystemTables, ensureManifestTables, validateSystemTables } from "./system-tables.js";
 import { raybaseLocalDevChromePersonas } from "./local-dev-chrome.js";
+import { sameOriginPath } from "./same-origin-path.js";
 import { RAYBASE_CORE_VERSION, RAYBASE_DATASHEET_GRID_VERSION } from "./version.js";
 export { maxOutstandingComposeRequests } from "./agent-ai-chat.js";
 export { raybaseLocalDevChromePayload, raybaseLocalDevChromePersonas, withRaybaseLocalDevChrome } from "./local-dev-chrome.js";
@@ -701,12 +702,6 @@ function searchNumber(url, key) {
     const numeric = Number(value);
     return Number.isFinite(numeric) ? numeric : undefined;
 }
-function safeRelativePath(value, fallback) {
-    const path = asString(value).trim();
-    if (path.startsWith("/") && !path.startsWith("//"))
-        return path;
-    return fallback;
-}
 function providerMetadataById(config, externalAuth, providerId) {
     return raybaseExternalProviderMetadata(config, externalAuth).find((provider) => provider.id === providerId) ?? null;
 }
@@ -1148,7 +1143,7 @@ async function localSeedContext(env, request, user, options, localDevPersonas) {
     })).for({
         user,
         adminOverride: true,
-        audit: (entry) => audit(control, actorId(user), entry.action, entry.target.type, entry.target.id ?? undefined, entry.metadata),
+        audit: (entry, auditDb) => audit(auditDb, actorId(user), entry.action, entry.target.type, entry.target.id ?? undefined, entry.metadata),
         notify: realtimeEnabled
             ? async (change) => {
                 if (!("seq" in change))
@@ -2349,7 +2344,22 @@ function createRaybaseRuntimeHandlers(options, runtimeProfile, resolvedModules =
     const runtimeJobs = runtimeJobsFor(options, resolvedModules);
     const runtimeNotifications = runtimeNotificationsFor(options, resolvedModules);
     const inferenceProviderFactory = selectedInferenceProviderFactory(options.config, resolvedModules);
-    const moduleMcpScopes = { operatorPermissions: resolvedModules.operatorPermissions };
+    const appMcpTools = [...resolvedModules.mcpTools, ...(options.mcp?.tools ?? [])];
+    const appMcpResources = [...resolvedModules.mcpResources, ...(options.mcp?.resources ?? [])];
+    const moduleMcpScopes = {
+        operatorPermissions: resolvedModules.operatorPermissions,
+        // What a machine credential for the app connector may hold.
+        appScopes: mcpEnabled
+            ? mcpAppConnectorScopes({
+                schema: options.schema,
+                appMigrations: options.appMigrations,
+                search: runtimeSearch,
+                tools: appMcpTools,
+                resources: appMcpResources,
+                generatedTools: options.mcp?.generatedTools
+            })
+            : []
+    };
     const runtimeOptions = { ...options, settings: runtimeSettings, actions: runtimeActions, agents: runtimeAgents, jobs: runtimeJobs, retrieval: runtimeRetrieval, search: runtimeSearch, notifications: runtimeNotifications };
     const resetLocalAppWorld = async (env, request, user, localDevPersonas) => {
         const control = raybaseAuthExecutor(env);
@@ -2368,6 +2378,9 @@ function createRaybaseRuntimeHandlers(options, runtimeProfile, resolvedModules =
     };
     const passwordSecretLifecycle = passwordSecretLifecycleFor(options.backups);
     const settingsDefinitions = settingsDefinitionsFor(runtimeOptions, aiEnabled, runtimeProfile);
+    // The local seed runs once per database: concurrent first requests share
+    // one run, keyed like the default model seed below.
+    const localSeedsInFlight = new Map();
     const defaultAiModelSeeded = new Set();
     const defaultAiModelSeedPromises = new Map();
     const ensureDefaultAiModelSeeded = async (env, control) => {
@@ -4050,7 +4063,7 @@ function createRaybaseRuntimeHandlers(options, runtimeProfile, resolvedModules =
         const agentDb = createRaybaseDb(input.env, options.schema, options.appMigrations, runtimeDbOptions(input.env));
         const clientFor = (source) => agentDb.for({
             user: executionUser,
-            audit: (entry) => auditTagged(input.control, input.actor, runAs, entry.action, entry.target.type, entry.target.id ?? undefined, {
+            audit: (entry, auditDb) => auditTagged(auditDb, input.actor, runAs, entry.action, entry.target.type, entry.target.id ?? undefined, {
                 ...metadataObject(entry.metadata),
                 ...auditMetadata
             }),
@@ -4676,8 +4689,8 @@ function createRaybaseRuntimeHandlers(options, runtimeProfile, resolvedModules =
             schema: options.schema,
             appMigrations: options.appMigrations,
             search: runtimeSearch,
-            tools: [...resolvedModules.mcpTools, ...(options.mcp?.tools ?? [])],
-            resources: [...resolvedModules.mcpResources, ...(options.mcp?.resources ?? [])],
+            tools: appMcpTools,
+            resources: appMcpResources,
             generatedTools: options.mcp?.generatedTools,
             resolveContext: options.mcp?.resolveContext,
             scopeOptions: mcpHostGrantScopes,
@@ -4994,7 +5007,7 @@ function createRaybaseRuntimeHandlers(options, runtimeProfile, resolvedModules =
             const provider = providerMetadataById(options.config, externalAuth, providerId);
             if (!provider || !externalAuth?.providerIds.includes(provider.id))
                 throw new Error("External auth provider is not configured");
-            const callbackURL = safeRelativePath(body.callbackURL, "/");
+            const callbackURL = sameOriginPath(asString(body.callbackURL).trim(), "/");
             // Better Auth keeps `disableImplicitSignUp` on every Raybase provider, so
             // a first-time visitor only gets an account when the redirect explicitly
             // asks for one. In public signup mode that ask is the whole point of the
@@ -5049,7 +5062,7 @@ function createRaybaseRuntimeHandlers(options, runtimeProfile, resolvedModules =
                 request: requestWithPendingCookie,
                 passwordSecretLifecycle
             });
-            const callbackURL = safeRelativePath(body.callbackURL, "/api/auth/raybase/provider/complete");
+            const callbackURL = sameOriginPath(asString(body.callbackURL).trim(), "/api/auth/raybase/provider/complete");
             const { url, headers } = await startProviderRedirect({ auth, request: requestWithPendingCookie, provider, callbackURL, requestSignUp: true });
             await audit(control, null, "auth.provider.pending.create", "_auth_pending", pending.pending.id, { providerId: provider.id, purpose });
             const response = jsonWithSetCookie({ url, redirect: true }, pending.cookie);
@@ -5220,7 +5233,7 @@ function createRaybaseRuntimeHandlers(options, runtimeProfile, resolvedModules =
                 throw new Error("Dev sessions are local-only");
             const auth = createRaybaseAuth(c.env, options.config, { passwordSecretLifecycle });
             const session = await createDevSession(auth, c.req.raw, c.env, options.config);
-            await seedLocalIfNeeded(c.env, c.req.raw, session.user, runtimeOptions);
+            await seedLocalIfNeeded(c.env, c.req.raw, session.user, runtimeOptions, localSeedsInFlight);
             return responseWithAuthHeaders({ ok: true, user: session.user }, session.headers);
         }
         catch (error) {
@@ -5439,7 +5452,7 @@ function createRaybaseRuntimeHandlers(options, runtimeProfile, resolvedModules =
         const session = await getRuntimeSession(c.req.raw, c.env, options.config).catch(() => null)
             ?? await hostAgentSession(c.req.raw, c.env);
         if (session && isLocal(c.env)) {
-            await seedLocalIfNeeded(c.env, c.req.raw, session.user, runtimeOptions);
+            await seedLocalIfNeeded(c.env, c.req.raw, session.user, runtimeOptions, localSeedsInFlight);
         }
         return session;
     };
@@ -6543,7 +6556,7 @@ function createRaybaseRuntimeHandlers(options, runtimeProfile, resolvedModules =
             throw new Error("Authentication required");
         }
         if (session && isLocal(c.env)) {
-            await seedLocalIfNeeded(c.env, c.req.raw, session.user, runtimeOptions);
+            await seedLocalIfNeeded(c.env, c.req.raw, session.user, runtimeOptions, localSeedsInFlight);
         }
         if (route.auth === "admin" && session && !isAdmin(session.user, options.config)) {
             throw new Error("Admin role required");
@@ -6572,7 +6585,7 @@ function createRaybaseRuntimeHandlers(options, runtimeProfile, resolvedModules =
         const data = db.for({
             user: actor,
             adminOverride: route.auth === "admin",
-            audit: user ? (entry) => audit(control, actorId(user), entry.action, entry.target.type, entry.target.id ?? undefined, entry.metadata) : undefined,
+            audit: user ? (entry, auditDb) => audit(auditDb, actorId(user), entry.action, entry.target.type, entry.target.id ?? undefined, entry.metadata) : undefined,
             notify: notifyRealtime(c.env),
             realtime: realtimeEnabled ? realtimeConfig : undefined
         });
@@ -6711,7 +6724,7 @@ function createRaybaseRuntimeHandlers(options, runtimeProfile, resolvedModules =
                 return c.html(accessDeniedPage(options.config), 403);
             }
             if (isLocal(c.env)) {
-                await seedLocalIfNeeded(c.env, c.req.raw, session.user, runtimeOptions);
+                await seedLocalIfNeeded(c.env, c.req.raw, session.user, runtimeOptions, localSeedsInFlight);
             }
             return next();
         }
@@ -6851,7 +6864,7 @@ function createRaybaseRuntimeHandlers(options, runtimeProfile, resolvedModules =
         const client = db.for({
             user,
             adminOverride: true,
-            audit: (entry) => audit(raybaseAuthExecutor(c.env), actorId(user), entry.action, entry.target.type, entry.target.id ?? undefined, entry.metadata)
+            audit: (entry, auditDb) => audit(auditDb, actorId(user), entry.action, entry.target.type, entry.target.id ?? undefined, entry.metadata)
         });
         const ai = createRaybaseAI({
             env: c.env,
@@ -6912,7 +6925,7 @@ function createRaybaseRuntimeHandlers(options, runtimeProfile, resolvedModules =
         const client = db.for({
             user,
             adminOverride: true,
-            audit: (entry) => audit(raybaseAuthExecutor(c.env), actorId(user), entry.action, entry.target.type, entry.target.id ?? undefined, entry.metadata)
+            audit: (entry, auditDb) => audit(auditDb, actorId(user), entry.action, entry.target.type, entry.target.id ?? undefined, entry.metadata)
         });
         const result = await reindexSearchIndex({
             schema: options.schema,
@@ -6961,7 +6974,7 @@ function createRaybaseRuntimeHandlers(options, runtimeProfile, resolvedModules =
                     user,
                     adminOverride,
                     adminOrgId: adminOverride ? c.req.query("adminOrgId") : undefined,
-                    audit: (entry) => audit(control, actorId(user), entry.action, entry.target.type, entry.target.id ?? undefined, entry.metadata)
+                    audit: (entry, auditDb) => audit(auditDb, actorId(user), entry.action, entry.target.type, entry.target.id ?? undefined, entry.metadata)
                 });
                 return c.json(await client.list(c.req.param("bucket"), storageListOptionsFromRequest(c.req.raw, adminOverride)));
             }
@@ -6983,7 +6996,7 @@ function createRaybaseRuntimeHandlers(options, runtimeProfile, resolvedModules =
                     user,
                     adminOverride,
                     adminOrgId: adminOverride ? c.req.query("adminOrgId") : undefined,
-                    audit: (entry) => audit(control, actorId(user), entry.action, entry.target.type, entry.target.id ?? undefined, entry.metadata)
+                    audit: (entry, auditDb) => audit(auditDb, actorId(user), entry.action, entry.target.type, entry.target.id ?? undefined, entry.metadata)
                 });
                 return c.json(await client.create(c.req.param("bucket"), c.req.raw), 201);
             }
@@ -7005,7 +7018,7 @@ function createRaybaseRuntimeHandlers(options, runtimeProfile, resolvedModules =
                     user,
                     adminOverride,
                     adminOrgId: adminOverride ? c.req.query("adminOrgId") : undefined,
-                    audit: (entry) => audit(control, actorId(user), entry.action, entry.target.type, entry.target.id ?? undefined, entry.metadata)
+                    audit: (entry, auditDb) => audit(auditDb, actorId(user), entry.action, entry.target.type, entry.target.id ?? undefined, entry.metadata)
                 });
                 return await client.download(c.req.param("bucket"), c.req.param("id"));
             }
@@ -7027,7 +7040,7 @@ function createRaybaseRuntimeHandlers(options, runtimeProfile, resolvedModules =
                     user,
                     adminOverride,
                     adminOrgId: adminOverride ? c.req.query("adminOrgId") : undefined,
-                    audit: (entry) => audit(control, actorId(user), entry.action, entry.target.type, entry.target.id ?? undefined, entry.metadata)
+                    audit: (entry, auditDb) => audit(auditDb, actorId(user), entry.action, entry.target.type, entry.target.id ?? undefined, entry.metadata)
                 });
                 const file = await client.get(c.req.param("bucket"), c.req.param("id"), { includeHidden: adminOverride });
                 return file ? c.json(file) : jsonError(new Error("Not found"), 404);
@@ -7050,7 +7063,7 @@ function createRaybaseRuntimeHandlers(options, runtimeProfile, resolvedModules =
                     user,
                     adminOverride,
                     adminOrgId: adminOverride ? c.req.query("adminOrgId") : undefined,
-                    audit: (entry) => audit(control, actorId(user), entry.action, entry.target.type, entry.target.id ?? undefined, entry.metadata)
+                    audit: (entry, auditDb) => audit(auditDb, actorId(user), entry.action, entry.target.type, entry.target.id ?? undefined, entry.metadata)
                 });
                 return c.json(await client.update(c.req.param("bucket"), c.req.param("id"), await jsonBody(c)));
             }
@@ -7072,7 +7085,7 @@ function createRaybaseRuntimeHandlers(options, runtimeProfile, resolvedModules =
                     user,
                     adminOverride,
                     adminOrgId: adminOverride ? c.req.query("adminOrgId") : undefined,
-                    audit: (entry) => audit(control, actorId(user), entry.action, entry.target.type, entry.target.id ?? undefined, entry.metadata)
+                    audit: (entry, auditDb) => audit(auditDb, actorId(user), entry.action, entry.target.type, entry.target.id ?? undefined, entry.metadata)
                 });
                 return c.json(await client.delete(c.req.param("bucket"), c.req.param("id")));
             }
@@ -7140,7 +7153,7 @@ function createRaybaseRuntimeHandlers(options, runtimeProfile, resolvedModules =
                 const client = db.for({
                     user: executionUser,
                     source: { surface: "http", route: route.path, requestId: c.req.header("cf-ray") ?? undefined, actionName: route.action.name },
-                    audit: (entry) => recordAudit(control, { actor: principal, action: entry.action, target: entry.target, metadata: entry.metadata, source: entry.source }),
+                    audit: (entry, auditDb) => recordAudit(auditDb, { actor: principal, action: entry.action, target: entry.target, metadata: entry.metadata, source: entry.source }),
                     notify: notifyRealtime(c.env),
                     realtime: realtimeConfig
                 });
@@ -7249,7 +7262,7 @@ function createRaybaseRuntimeHandlers(options, runtimeProfile, resolvedModules =
             const client = db.for({
                 user,
                 adminOverride,
-                audit: (entry) => audit(control, actorId(user), entry.action, entry.target.type, entry.target.id ?? undefined, entry.metadata)
+                audit: (entry, auditDb) => audit(auditDb, actorId(user), entry.action, entry.target.type, entry.target.id ?? undefined, entry.metadata)
             });
             const listOptions = listOptionsFromRequest(c.req.raw, dataSchema, c.req.param("table"));
             const tableSearchIndexes = adminOverride && listOptions.search ? searchIndexesForTable(runtimeSearch, c.req.param("table")) : [];
@@ -7300,7 +7313,7 @@ function createRaybaseRuntimeHandlers(options, runtimeProfile, resolvedModules =
             const client = createRaybaseDb(c.env, adminOverride ? adminDataSchema(options.schema, manifestTables) : options.schema, options.appMigrations, runtimeDbOptions(c.env)).for({
                 user,
                 adminOverride,
-                audit: (entry) => audit(control, actorId(user), entry.action, entry.target.type, entry.target.id ?? undefined, entry.metadata),
+                audit: (entry, auditDb) => audit(auditDb, actorId(user), entry.action, entry.target.type, entry.target.id ?? undefined, entry.metadata),
                 notify: notifyRealtime(c.env),
                 realtime: realtimeConfig
             });
@@ -7318,7 +7331,7 @@ function createRaybaseRuntimeHandlers(options, runtimeProfile, resolvedModules =
             const client = createRaybaseDb(c.env, adminOverride ? adminDataSchema(options.schema, manifestTables) : options.schema, options.appMigrations, runtimeDbOptions(c.env)).for({
                 user,
                 adminOverride,
-                audit: (entry) => audit(control, actorId(user), entry.action, entry.target.type, entry.target.id ?? undefined, entry.metadata),
+                audit: (entry, auditDb) => audit(auditDb, actorId(user), entry.action, entry.target.type, entry.target.id ?? undefined, entry.metadata),
                 notify: notifyRealtime(c.env),
                 realtime: realtimeConfig
             });
@@ -7336,7 +7349,7 @@ function createRaybaseRuntimeHandlers(options, runtimeProfile, resolvedModules =
             const client = createRaybaseDb(c.env, adminOverride ? adminDataSchema(options.schema, manifestTables) : options.schema, options.appMigrations, runtimeDbOptions(c.env)).for({
                 user,
                 adminOverride,
-                audit: (entry) => audit(control, actorId(user), entry.action, entry.target.type, entry.target.id ?? undefined, entry.metadata),
+                audit: (entry, auditDb) => audit(auditDb, actorId(user), entry.action, entry.target.type, entry.target.id ?? undefined, entry.metadata),
                 notify: notifyRealtime(c.env),
                 realtime: realtimeConfig
             });
@@ -10996,7 +11009,7 @@ function createRaybaseRuntimeHandlers(options, runtimeProfile, resolvedModules =
         const control = raybaseAuthExecutor(c.env);
         const client = createRaybaseDb(c.env, options.schema, options.appMigrations, runtimeDbOptions(c.env)).for({
             user,
-            audit: (entry) => audit(control, actorId(user), entry.action, entry.target.type, entry.target.id ?? undefined, entry.metadata),
+            audit: (entry, auditDb) => audit(auditDb, actorId(user), entry.action, entry.target.type, entry.target.id ?? undefined, entry.metadata),
             notify: notifyRealtime(c.env),
             realtime: realtimeConfig
         });
@@ -11238,7 +11251,7 @@ function createRaybaseRuntimeHandlers(options, runtimeProfile, resolvedModules =
         const request = new Request(`https://raybase.local/api/raybase/agents/${encodeURIComponent(agent.name)}/follow-ups/${encodeURIComponent(row.id)}/lapse`);
         const client = createRaybaseDb(env, options.schema, options.appMigrations, runtimeDbOptions(env)).for({
             user: serviceUser,
-            audit: (entry) => auditTagged(control, actor, actor, entry.action, entry.target.type, entry.target.id ?? undefined, entry.metadata)
+            audit: (entry, auditDb) => auditTagged(auditDb, actor, actor, entry.action, entry.target.type, entry.target.id ?? undefined, entry.metadata)
         });
         const agents = createAgentInvocationRuntime({
             env,
@@ -11517,7 +11530,7 @@ function createRaybaseRuntimeHandlers(options, runtimeProfile, resolvedModules =
             user: executionUser,
             // A service job acts as that service, so fromService(name) policies match it.
             ...(runAs.kind === "service" ? { principal: runAs } : {}),
-            audit: (entry) => auditTagged(control, actor, runAs, entry.action, entry.target.type, entry.target.id ?? undefined, {
+            audit: (entry, auditDb) => auditTagged(auditDb, actor, runAs, entry.action, entry.target.type, entry.target.id ?? undefined, {
                 ...(entry.metadata && typeof entry.metadata === "object" ? entry.metadata : { value: entry.metadata }),
                 jobRunId: run.id,
                 jobName: job.name
@@ -13012,13 +13025,30 @@ function createRaybaseAgentStaticRuntime(options, resolvedModules, runtimeProfil
         })
     };
 }
-async function seedLocalIfNeeded(env, request, user, options) {
+/**
+ * Runs the app's local seed the first time a signed-in request reaches a local
+ * database. Simultaneous first requests (a page that opens a widget lists and
+ * starts conversations at once) share one run: the first starts it, the rest
+ * wait for it, rather than each seeding and colliding on the seed's users. A
+ * failed run is not remembered, so the next request tries again.
+ */
+async function seedLocalIfNeeded(env, request, user, options, inFlight) {
     if (!options.seed)
         return;
-    const control = raybaseAuthExecutor(env);
-    const existing = await control.first(`SELECT "key" FROM "_state" WHERE "key" = ?`, [localSeedStateKey]);
-    if (existing)
-        return;
-    await runLocalSeed(env, request, user, options);
+    const key = `${raybaseRuntimeSettingsAppId(env)}\0${raybaseRuntimeScope(env)?.scopeId ?? "default"}`;
+    const running = inFlight.get(key);
+    if (running)
+        return running;
+    const run = (async () => {
+        const control = raybaseAuthExecutor(env);
+        const existing = await control.first(`SELECT "key" FROM "_state" WHERE "key" = ?`, [localSeedStateKey]);
+        if (existing)
+            return;
+        await runLocalSeed(env, request, user, options);
+    })().finally(() => {
+        inFlight.delete(key);
+    });
+    inFlight.set(key, run);
+    return run;
 }
 //# sourceMappingURL=worker.js.map