@rebasepro/server 0.14.0 → 0.14.1

package/dist/boot/boot.d.ts

@@ -1,6 +1,5 @@
 import { type Server } from "http";
 import { Hono } from "hono";
-import { type CollectionConfig } from "@rebasepro/types";
 import { type RebaseBackendInstance } from "../init";
 import type { HonoEnv } from "../api/types";
 import { type RebaseBootEnv } from "./env";
@@ -18,6 +17,18 @@ export interface BootedRuntime {
     dataSources: InitializedDataSource[];
     shutdown: () => Promise<void>;
 }
+/**
+ * Whether this process is the one that provisions the database schema.
+ *
+ * Separate from `REBASE_MIGRATE_ON_BOOT` on purpose. That variable answers
+ * "does this deployment create its own schema at boot"; this answers "is this
+ * *process* the one that does it", which only becomes a question once a
+ * deployment boots the same bundle more than once.
+ */
+export interface SchemaProvisioningOptions {
+    /** Default `true`. `false` leaves every DDL statement to another process. */
+    provision?: boolean;
+}
 export interface BootOptions {
     /** Bundle directory. Defaults to `REBASE_BUNDLE` or `./dist-bundle`. */
     bundleDir?: string;
@@ -33,6 +44,20 @@ export interface BootOptions {
     listen?: boolean;
     /** Install SIGTERM/SIGINT handlers. Off for tests. */
     handleSignals?: boolean;
+    /**
+     * Whether this process provisions the collection schema and its RLS
+     * policies at boot. Default `true` — the behaviour every deployment has.
+     *
+     * Set `false` on a process that is one of several booting the same bundle
+     * against the same database. `CREATE … IF NOT EXISTS` reads the catalog and
+     * then writes to it non-atomically, so peers starting together do collide;
+     * exactly one owner is cheaper and more legible than N racing and retrying.
+     *
+     * Independent of `REBASE_MIGRATE_ON_BOOT`, which answers a different
+     * question — whether *this deployment* provisions its schema at boot at all,
+     * rather than which of its processes does.
+     */
+    provisionSchema?: boolean;
 }
 /**
  * Boot a Rebase runtime from a built bundle.
@@ -77,55 +102,16 @@ export declare function runFromBundle(options?: BootOptions): Promise<BootedRunt
  */
 export declare function warnOnDriverSkew(dataSources: InitializedDataSource[], runtimeVersion: string | undefined): void;
 /**
- * The collections a data source's engine is the store for.
+ * Warn about a bundle whose shape makes provisioning impossible.
  *
- * A bundle's collections directory holds *every* collection the project
- * declares, whatever engine serves it — that is the point of `dataSource`
- * routing. What it is not is a list of tables to create: handing the whole
- * directory to the primary source's bootstrapper made a Firestore collection
- * declared alongside the Postgres ones arrive as an empty Postgres table, with
- * RLS policies, while the app went on reading its documents from Firestore.
- *
- * Excluding is deliberately conservative. A collection that names neither an
- * `engine` nor a `dataSource` belongs to whichever source is primary — the
- * "postgres" that `resolveDataSource` falls back to there is a default, not a
- * declaration, and must not exclude anything on its own. Only a collection that
- * explicitly routes to a *different* engine is dropped, so a project running two
- * sources on the same engine is unaffected.
- */
-export declare function collectionsStoredBy(collections: CollectionConfig[], primary: InitializedDataSource, dataSources: InitializedDataSource[]): CollectionConfig[];
-/**
- * Bring the database's collection tables up to date before serving.
- *
- * Delegates to whichever driver bootstrapped the default data source; a driver
- * without `ensureCollectionSchema` (a schemaless one, or an older build) skips
- * rather than failing, which is why this cannot break an existing deployment.
- *
- * Every path out of here says why, at info or louder. Guaranteeing the tables
- * exist is this function's entire job, so "it declined, and said nothing" is the
- * one outcome it must never produce: a deployment that skips comes up answering
- * sign-in and 500ing every `/api/data/*` route, and the operator's only evidence
- * is what these lines print. Silence here has already sent one investigation
- * chasing a stale runtime image that was not stale.
- *
- * Failure is fatal on purpose. Booting anyway would produce exactly the state
- * this exists to prevent — an app that answers sign-in and 500s every data
- * request — and a crash-looping pod with the DDL error in its logs is a far
- * better signal than a running one that silently cannot serve.
- */
-export declare function ensureCollectionSchema(bundle: LoadedBundle, dataSources: InitializedDataSource[], env: RebaseBootEnv): Promise<void>;
-/**
- * Apply the project's RLS policies before serving — the companion to
- * {@link ensureCollectionSchema}, which creates the tables this makes servable.
+ * `initializeRebaseBackend` provisions the collection schema for every boot
+ * path, and it decides from what actually resolved: a project with no
+ * collections reads them from the database and creates nothing. That rule is
+ * right, but from inside the runtime it cannot tell "this project declares no
+ * collections" from "this build lost them" — and the second is a broken build
+ * that silently serves an empty API.
  *
- * Runs after `initializeRebaseBackend`, not alongside table creation: the
- * generated policies call the `auth.*` helper functions, and `CREATE POLICY`
- * validates those exist, so this cannot run before auth is initialized. The
- * gate conditions mirror `ensureCollectionSchema` (mode, bundle shape, driver
- * support) — and because that function already ran and explained any skip on
- * this same boot, the benign gates here return quietly rather than logging the
- * same reason twice. The one thing it does say out loud is a driver that
- * created tables but cannot apply policies: that is the difference between a
- * served collection and a 401, and it must not pass in silence.
+ * Only the bundle knows the difference, so this is the one piece of the old
+ * bundle-side provisioning worth keeping here. It warns; it never provisions.
  */
-export declare function ensureCollectionPolicies(bundle: LoadedBundle, dataSources: InitializedDataSource[], env: RebaseBootEnv): Promise<void>;
+export declare function warnOnUnusableBundleShape(bundle: LoadedBundle): void;

package/dist/boot/ddl-bootstrap.d.ts

@@ -46,6 +46,21 @@ export declare function hasInCauseChain(err: unknown, visit: (e: Record<string,
  * times and then reported as a race that never was.
  */
 export declare function isConcurrentDdlRace(err: unknown): boolean;
+/**
+ * Did this statement fail *because a peer already created the same object*?
+ *
+ * The narrow companion to {@link isConcurrentDdlRace}, for the one caller that
+ * needs to tell "someone beat me to it" from "this genuinely failed": a loop
+ * applying a schema plan, where treating every `23505` as a harmless race would
+ * silently swallow the one that matters — a unique constraint that cannot be
+ * added because the customer's existing rows violate it.
+ *
+ * `23505` is therefore only accepted when it names a `pg_catalog` index. That is
+ * what a lost `CREATE TYPE`/`CREATE TABLE` race raises (`pg_type_typname_nsp_index`
+ * is the one seen in practice); a unique violation on user data names the user's
+ * own constraint and is left to the caller.
+ */
+export declare function isDuplicateObjectRace(err: unknown): boolean;
 export interface DdlBootstrapper {
     /**
      * Run one idempotent statement — `CREATE … IF NOT EXISTS`, `ALTER TABLE …

package/dist/boot/env.d.ts

@@ -95,6 +95,26 @@ declare const bootEnvExtension: z.ZodObject<{
         false: "false";
     }>>, z.ZodTransform<boolean, "" | "true" | "false">>;
     CORS_ORIGINS: z.ZodOptional<z.ZodString>;
+    REBASE_ROLE: z.ZodPipe<z.ZodDefault<z.ZodEnum<{
+        "": "";
+        functions: "functions";
+        all: "all";
+        api: "api";
+        worker: "worker";
+    }>>, z.ZodTransform<"functions" | "all" | "api" | "worker", "" | "functions" | "all" | "api" | "worker">>;
+    REBASE_CRON_SCHEDULER: z.ZodPipe<z.ZodOptional<z.ZodEnum<{
+        "": "";
+        true: "true";
+        false: "false";
+    }>>, z.ZodTransform<boolean | undefined, "" | "true" | "false" | undefined>>;
+    REBASE_JOB_WORKERS: z.ZodPipe<z.ZodOptional<z.ZodEnum<{
+        "": "";
+        true: "true";
+        false: "false";
+    }>>, z.ZodTransform<boolean | undefined, "" | "true" | "false" | undefined>>;
+    REBASE_FUNCTIONS_ONLY: z.ZodOptional<z.ZodString>;
+    REBASE_FUNCTIONS_EXCLUDE: z.ZodOptional<z.ZodString>;
+    REBASE_FUNCTIONS_UPSTREAM: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export type RebaseBootEnv = RebaseEnv & z.infer<typeof bootEnvExtension>;
 /**

package/dist/boot/provision.d.ts

@@ -0,0 +1,182 @@
+import type { BackendBootstrapper, CollectionConfig, InitializedDriver } from "@rebasepro/types";
+/**
+ * Boot-time provisioning of collection tables and their RLS policies.
+ *
+ * This lives outside both boot paths on purpose. It used to live inside
+ * `bootFromBundle`, which meant it ran for managed tenants and for nobody else:
+ * an app that ships its own image (`runtimeMode: custom`) boots by calling
+ * `initializeRebaseBackend` directly and never passes through the bundle path,
+ * so its collection tables were never created. That app came up serving sign-in
+ * — auth bootstraps its own tables — and 500ing every `/api/data/*` route, with
+ * a green deploy and no failing check anywhere. It stayed that way for weeks.
+ *
+ * The fix is structural rather than a second copy of the logic in the other
+ * path: `initializeRebaseBackend` is the one function BOTH paths go through, so
+ * provisioning belongs there, and this module is what it calls.
+ */
+/** How the process-wide provisioning attempt turned out. */
+export type ProvisionOutcome = 
+/** The hook ran. `applied` counts the statements it executed. */
+{
+    status: "applied";
+    applied: number;
+}
+/** A gate declined, with the reason already logged. */
+ | {
+    status: "skipped";
+    reason: string;
+};
+/**
+ * What ran, in this process, before the driver looked at the database.
+ *
+ * Handed to `initializeDriver` so a driver's drift check can say something true
+ * about why tables are missing. Without it the Postgres driver could only guess,
+ * and it guessed wrong in the one case that mattered: its warning told operators
+ * to "redeploy with REBASE_MIGRATE_ON_BOOT unset" and to suspect a stale driver,
+ * when the real answer was that no provisioning step existed in that boot path
+ * at all. Both suggestions were unactionable, and the second sent an
+ * investigation after a driver that was current.
+ */
+export interface SchemaProvisioningReport {
+    /** Whether the table-creation hook was invoked at all this boot. */
+    attempted: boolean;
+    /** Why it was not, when it was not — phrased to be printed verbatim. */
+    reason?: string;
+}
+/** The subset of a bootstrapper this module needs, from either boot path. */
+export interface ProvisionTarget {
+    /**
+     * The driver's package name, when the caller resolved one.
+     *
+     * Undefined for an adapter an application constructed itself: there is no
+     * package to name, and inventing one misdirects — the reader would go
+     * looking for a dependency to bump when the object in question was built in
+     * their own source file.
+     */
+    driverPackage?: string;
+    engine: string;
+    driverVersion?: string;
+    runtimeVersion?: string;
+    bootstrapper: Pick<BackendBootstrapper, "ensureCollectionSchema" | "ensureCollectionPolicies">;
+    /**
+     * The handle the hooks read (`internals.db`), or `undefined` to let the
+     * adapter fall back to the connection it was constructed with.
+     *
+     * The bundle path has one because the coordinator opened the connection
+     * itself; an app calling `initializeRebaseBackend` directly passed its
+     * connection into the adapter and the framework never sees it.
+     */
+    driverResult?: InitializedDriver;
+}
+/** `REBASE_MIGRATE_ON_BOOT=none` opts a deployment out of both phases. */
+/**
+ * How one call to a provisioning function is run.
+ *
+ * `provision` is a different question from `REBASE_MIGRATE_ON_BOOT`, and both
+ * are checked. That variable says whether this *deployment* provisions its own
+ * schema at boot; `provision` says whether this *process* is the one that does
+ * it — which only becomes a question once a deployment boots the same bundle
+ * more than once (see `REBASE_ROLE`).
+ */
+export interface ProvisionRunOptions {
+    introspecting?: boolean;
+    env?: {
+        REBASE_MIGRATE_ON_BOOT?: string;
+    };
+    /** Default `true`. `false` leaves every DDL statement to another process. */
+    provision?: boolean;
+}
+export declare function provisioningDisabled(env?: {
+    REBASE_MIGRATE_ON_BOOT?: string;
+}): boolean;
+/**
+ * Create any collection tables the database is missing, before serving.
+ *
+ * Additive only: the driver may create missing tables, columns and enum types,
+ * and may never drop or rewrite. Destructive changes stay a deliberate
+ * migration, because this runs unattended with nobody reading a diff.
+ *
+ * Every path out of here says why, at info or louder. Guaranteeing the tables
+ * exist is this function's entire job, so "it declined, and said nothing" is the
+ * one outcome it must never produce: a deployment that skips comes up answering
+ * sign-in and 500ing every `/api/data/*` route, and the operator's only evidence
+ * is what these lines print.
+ *
+ * Note that silence is still possible one level up — if nothing CALLS this, no
+ * line is printed and the absence is the only signal. That is precisely the bug
+ * this module was extracted to make structurally impossible, and it is why the
+ * outcome is reported back to the driver rather than only logged.
+ *
+ * Failure is fatal on purpose. Booting anyway would produce exactly the state
+ * this exists to prevent, and a crash-looping pod with the DDL error in its logs
+ * is a far better signal than a running one that silently cannot serve.
+ */
+export declare function provisionCollectionTables(collections: CollectionConfig[], target: ProvisionTarget, options?: ProvisionRunOptions): Promise<ProvisionOutcome>;
+/**
+ * Apply the collections' RLS policies — the companion to
+ * {@link provisionCollectionTables}, which creates the tables this makes
+ * servable.
+ *
+ * Runs after auth is initialized, not alongside table creation: the generated
+ * policies call the `auth.*` helper functions and `CREATE POLICY` validates
+ * those exist. Tables without policies are not servable either — authenticated
+ * requests run as a restricted role, so a read with no policy returns nothing.
+ *
+ * The benign gates return quietly here rather than logging the same reason
+ * twice: table provisioning already ran on this same boot and explained itself.
+ * The one thing this does say out loud is a driver that created tables but
+ * cannot apply policies — that is the difference between a served collection and
+ * a 401, and it must not pass in silence.
+ */
+export declare function provisionCollectionPolicies(collections: CollectionConfig[], target: ProvisionTarget, options?: ProvisionRunOptions): Promise<ProvisionOutcome>;
+/**
+ * The collections a data source's engine is the store for.
+ *
+ * A project's collections directory holds *every* collection it declares,
+ * whatever engine serves it — that is the point of `dataSource` routing. What it
+ * is not is a list of tables to create: handing the whole directory to the
+ * primary source's bootstrapper made a Firestore collection declared alongside
+ * the Postgres ones arrive as an empty Postgres table, with RLS policies, while
+ * the app went on reading its documents from Firestore.
+ *
+ * Excluding is deliberately conservative. A collection that names neither an
+ * `engine` nor a `dataSource` belongs to whichever source is primary — the
+ * "postgres" that `resolveDataSource` falls back to there is a default, not a
+ * declaration, and must not exclude anything on its own. Only a collection that
+ * explicitly routes to a *different* engine is dropped, so a project running two
+ * sources on the same engine is unaffected.
+ *
+ * Takes the shapes it actually reads rather than an `InitializedDataSource`, so
+ * the path that has data sources and the path that has only an adapter can share
+ * one implementation instead of growing a second one that drifts.
+ */
+export declare function collectionsStoredBy(collections: CollectionConfig[], primary: {
+    engine: string;
+}, dataSources: Array<{
+    key: string;
+    engine: string;
+}>): CollectionConfig[];
+/** Say what was routed elsewhere, so a missing table is never a silent one. */
+export declare function logForeignCollections(all: CollectionConfig[], stored: CollectionConfig[], primary: {
+    engine: string;
+}): void;
+/**
+ * Which bootstrapper provisions, and what to call it in a message.
+ *
+ * The default source is the one that stores this project's collections, so it
+ * is the one asked to create them; `dataSources[0]` is the bundle path's
+ * equivalent of the same choice.
+ *
+ * `driverResult` is deliberately left undefined here. The hooks run BEFORE
+ * `initializeDriver`, so there is no driver result to pass, and unlike the
+ * bundle path — where the coordinator opens the connection itself — an app that
+ * built its own adapter never handed the framework a connection handle. The
+ * adapter has one: it was constructed with it. So the contract is that an
+ * adapter falls back to its own connection when no result is supplied, which is
+ * the only shape that works for both paths.
+ */
+export declare function provisionTargetFor(bootstrappers: BackendBootstrapper[], adapter?: {
+    type: string;
+}, driverResult?: InitializedDriver): ProvisionTarget;
+/** Load collections for provisioning when only a directory is known. */
+export declare function collectionsForProvisioning(declared: CollectionConfig[], collectionsDir: string | undefined): Promise<CollectionConfig[]>;

package/dist/boot/role.d.ts

@@ -0,0 +1,88 @@
+/**
+ * Turning `REBASE_ROLE` into a process shape.
+ *
+ * A deployment that boots one process is the default and stays the default.
+ * A deployment that boots the same image and the same bundle several times over
+ * says so here, once, per process — and everything downstream (which routes
+ * mount, which timers fire, who provisions the schema) is derived rather than
+ * configured separately. Four named shapes rather than a free-form list of
+ * surfaces, because the set of processes anyone actually runs is small and
+ * sixteen combinations is a space nobody tests.
+ *
+ * Every function in this module is pure. The decisions are the whole risk here:
+ * a role that quietly runs no scheduler, or two roles that both provision the
+ * schema, are failures nothing in a boot log makes obvious.
+ */
+import type { RuntimeOwnershipOptions, RuntimeSurfaceOptions } from "../init/surfaces";
+import type { FunctionSelection } from "../functions/selection";
+/** The four shapes a runtime process can boot in. */
+export type RebaseRuntimeRole = "all" | "api" | "functions" | "worker";
+/** Everything a role decides, resolved. */
+export interface ResolvedRole {
+    role: RebaseRuntimeRole;
+    surfaces: RuntimeSurfaceOptions;
+    ownership: RuntimeOwnershipOptions;
+    /** Whether this process runs the boot-time schema DDL. */
+    provisionSchema: boolean;
+    /** Which functions this process serves. Empty lists mean "all of them". */
+    functionsSelection: FunctionSelection;
+    /** Where `/api/functions/*` is forwarded, when this process forwards it. */
+    functionsUpstream?: string;
+}
+/** The environment this module reads. Narrowed so it can be called with a literal. */
+export interface RoleEnv {
+    REBASE_ROLE?: RebaseRuntimeRole;
+    REBASE_CRON_SCHEDULER?: boolean;
+    REBASE_JOB_WORKERS?: boolean;
+    REBASE_MIGRATE_ON_BOOT?: "none" | "ensure" | "push" | "";
+    REBASE_FUNCTIONS_ONLY?: string;
+    REBASE_FUNCTIONS_EXCLUDE?: string;
+    REBASE_FUNCTIONS_UPSTREAM?: string;
+}
+/**
+ * A refusal to boot, phrased as the variable to change.
+ *
+ * Its own class so `bootFromBundle` can present it as a configuration problem
+ * rather than a crash. Every message names the variable and the fix, because the
+ * reader is looking at a container that will not start and has one line of log
+ * to work from.
+ */
+export declare class RoleConfigurationError extends Error {
+    readonly hint?: string | undefined;
+    constructor(message: string, hint?: string | undefined);
+}
+/** Split a comma-separated list, dropping blanks. */
+export declare function parseNameList(raw: string | undefined): string[];
+/**
+ * Resolve the process shape, or refuse.
+ *
+ * @throws RoleConfigurationError for a combination that would boot into a state
+ *   nobody meant — see the refusals inline. Each one is a refusal rather than a
+ *   warning because its failure mode is silent: a second process racing schema
+ *   DDL, or presence quietly not crossing instances, is not something an
+ *   operator finds by reading logs.
+ */
+export declare function resolveRole(env: RoleEnv): ResolvedRole;
+/**
+ * ## Why there is no channel-bus refusal here
+ *
+ * Splitting `api` from `functions` was expected to need one: the in-memory
+ * channel bus is the default, and broadcast and presence do not cross processes
+ * on it. It turns out to be the wrong place to check, for two reasons.
+ *
+ * The first is that a role split does not create the problem. Only the roles
+ * that mount the API serve websockets at all — a `functions` process has no
+ * realtime clients to keep in sync, and a `worker` has no HTTP surface. What
+ * makes the bus matter is the *replica count* of the websocket-serving process,
+ * which is exactly as true for a single `all` deployment scaled to three as it
+ * is for a split one, and which no process can read from its own environment.
+ *
+ * The second is that the runtime already answers it better than a guess from
+ * configuration could: `RealtimeService.warnIfMemoryBusOnMultiplePods` fires on
+ * *evidence* — the first notification seen from another instance while the bus
+ * is still in-memory. That is a fact rather than an inference, and it catches
+ * the scaled-`all` case this would have missed.
+ *
+ * So: no refusal, and the operator guidance belongs in the deployment docs
+ * beside the replica count, not here.
+ */

package/dist/{cron-store-Dvr4Y1sZ.js → cron-store-CB1x-Ken.js}

@@ -2,9 +2,9 @@ import { createRequire as __createRequire } from "module";
 import "process";
 __createRequire(import.meta.url);
 import { n as __exportAll } from "./rolldown-runtime-DSJWtz9O.js";
-import "./src-C7rkDGxA.js";
+import "./src-8XDWyDfR.js";
 import "./src-Cz9nMgUR.js";
-import { i as isSQLAdmin, n as hasInCauseChain, r as revokeInternalTableSql, t as createDdlBootstrapper } from "./ddl-bootstrap-BhXbTnBl.js";
+import { n as createDdlBootstrapper, o as revokeInternalTableSql, r as hasInCauseChain, s as isSQLAdmin } from "./ddl-bootstrap-Cywoj8Ta.js";
 import { t as logger } from "./logger-DfvF_8r-.js";
 //#region src/cron/cron-store.ts
 var cron_store_exports = /* @__PURE__ */ __exportAll({ createCronStore: () => createCronStore });
@@ -180,4 +180,4 @@ function rowToLogEntry(row) {
 //#endregion
 export { cron_store_exports as n, createCronStore as t };
 
-//# sourceMappingURL=cron-store-Dvr4Y1sZ.js.map
+//# sourceMappingURL=cron-store-CB1x-Ken.js.map

package/dist/{cron-store-Dvr4Y1sZ.js.map → cron-store-CB1x-Ken.js.map}

@@ -1 +1 @@
-{"version":3,"file":"cron-store-Dvr4Y1sZ.js","names":[],"sources":["../src/cron/cron-store.ts"],"sourcesContent":["import type { CronJobLogEntry } from \"@rebasepro/types\";\nimport type { DataDriver } from \"@rebasepro/types\";\nimport { isSQLAdmin } from \"@rebasepro/types\";\nimport { revokeInternalTableSql } from \"@rebasepro/common\";\nimport { logger } from \"../utils/logger.js\";\nimport { createDdlBootstrapper, hasInCauseChain } from \"../boot/ddl-bootstrap.js\";\n\n/**\n * Persistence layer for cron job execution logs.\n *\n * Uses the DataDriver's `admin.executeSql` capability to store logs in a\n * `rebase.cron_logs` table. Falls back gracefully if the driver doesn't\n * support SQL (e.g. MongoDB) — in that case, no persistence occurs.\n */\nexport interface CronStore {\n    /** Ensure the backing table exists. Called once on startup. */\n    ensureTable(): Promise<void>;\n\n    /** Persist a single log entry after execution. */\n    insertLog(entry: CronJobLogEntry): Promise<void>;\n\n    /**\n     * Fetch the most recent logs for a job.\n     * @param jobId  The job identifier\n     * @param limit  Max entries to return (default 50)\n     * @returns Logs sorted newest-first\n     */\n    fetchLogs(jobId: string, limit?: number): Promise<CronJobLogEntry[]>;\n\n    /**\n     * Fetch aggregate stats for all jobs (totalRuns, totalFailures, lastRunAt).\n     * Used to seed in-memory counters on startup.\n     */\n    fetchJobStats(): Promise<Map<string, { totalRuns: number; totalFailures: number; lastRunAt?: string }>>;\n\n    /**\n     * Atomically claim a scheduled run slot for a job.\n     *\n     * `slot` is the *scheduled* fire time (ISO string) derived from the cron\n     * expression — deterministic across instances regardless of timer drift,\n     * so all instances contend on the same (jobId, slot) key. Exactly one\n     * caller wins the insert against the unique constraint and executes;\n     * the rest skip.\n     *\n     * Fails open (returns true) on unexpected store errors, so a broken\n     * claims table degrades to uncoordinated execution rather than silently\n     * never running jobs.\n     *\n     * Optional so custom stores written against the pre-claims interface\n     * keep working — the scheduler treats a missing implementation as\n     * uncoordinated (always run).\n     */\n    tryClaimRun?(jobId: string, slot: string): Promise<boolean>;\n}\n\n// ─── SQL-based implementation ────────────────────────────────────────\n\nconst TABLE = \"rebase.cron_logs\";\nconst CLAIMS_TABLE = \"rebase.cron_claims\";\n\n/** Claims older than this are garbage-collected on startup. */\nconst CLAIM_RETENTION_DAYS = 7;\n\n/**\n * How far ahead a claim may legitimately sit. Slots are claimed as they fire,\n * so anything beyond this is a clock-skewed peer at best and a stranded claim\n * at worst; see the sweep in `ensureTable`.\n */\nconst FUTURE_CLAIM_SKEW_MINUTES = 2;\n\n/**\n * Detect a unique-constraint violation anywhere in an error's cause chain.\n * Match the SQLSTATE code, never message text. Also covers SQLite\n * (\"UNIQUE constraint failed\") and MySQL (ER_DUP_ENTRY 1062) for future SQL\n * drivers.\n *\n * Distinct from `isConcurrentDdlRace` in `boot/ddl-bootstrap.ts`, which shares\n * the 23505 code but asks a different question — that one is about a losing\n * `CREATE`, this one is about a losing claim, and only the latter means\n * \"another instance already has this slot\".\n */\nfunction isUniqueViolation(err: unknown): boolean {\n    return hasInCauseChain(err, (e) =>\n        e.code === \"23505\" ||\n        e.errno === 1062 ||\n        (typeof e.message === \"string\" && e.message.includes(\"UNIQUE constraint failed\"))\n    );\n}\n\nexport function createCronStore(driver: DataDriver): CronStore | undefined {\n    const admin = driver.admin;\n    if (!isSQLAdmin(admin)) {\n        logger.warn(\"⚠️ [cron-store] DataDriver does not support SQL admin — cron logs will not be persisted.\");\n        return undefined;\n    }\n\n    const exec = (sqlText: string, options?: { params?: unknown[] }) =>\n        admin.executeSql(sqlText, options?.params ? { params: options.params } : undefined);\n\n    const ddl = createDdlBootstrapper(exec, \"cron-store\");\n\n    return {\n        async ensureTable(): Promise<void> {\n            // Creation. Every statement here is idempotent, so losing the race\n            // to a peer that booted at the same moment is survivable — but only\n            // if the loser retries rather than abandoning everything below it.\n            // One step each, so a hard failure on any one of them does not take\n            // the others with it. The claims table in particular must not be\n            // lost because an index on the *logs* table could not be built.\n            await ddl.ensureObject(\"Creating schema rebase\", \"CREATE SCHEMA IF NOT EXISTS rebase\");\n\n            await ddl.ensureObject(`Creating ${TABLE}`, `\n                CREATE TABLE IF NOT EXISTS ${TABLE} (\n                    id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,\n                    job_id TEXT NOT NULL,\n                    started_at TIMESTAMPTZ NOT NULL,\n                    finished_at TIMESTAMPTZ NOT NULL,\n                    duration_ms INTEGER NOT NULL,\n                    success BOOLEAN NOT NULL DEFAULT true,\n                    error TEXT,\n                    result JSONB,\n                    logs JSONB,\n                    manual BOOLEAN NOT NULL DEFAULT false\n                )\n            `);\n\n            await ddl.ensureObject(\"Creating idx_cron_logs_job\", `\n                CREATE INDEX IF NOT EXISTS idx_cron_logs_job\n                ON ${TABLE}(job_id, started_at DESC)\n            `);\n\n            await ddl.ensureObject(`Creating ${CLAIMS_TABLE}`, `\n                CREATE TABLE IF NOT EXISTS ${CLAIMS_TABLE} (\n                    job_id TEXT NOT NULL,\n                    slot TIMESTAMPTZ NOT NULL,\n                    claimed_at TIMESTAMPTZ NOT NULL DEFAULT now(),\n                    PRIMARY KEY (job_id, slot)\n                )\n            `);\n\n            // Everything from here is keyed on what actually exists, not on\n            // whether *this* instance is the one that created it. A single\n            // failure above used to abandon the rest of this method, which meant\n            // the loser of a boot race skipped the sweeps and — far worse — the\n            // privilege revocation, leaving the claims table writable by end\n            // users on an instance that reported nothing but a warning about\n            // log persistence.\n            const [logsReady, claimsReady] = await Promise.all([\n                ddl.isReadable(TABLE),\n                ddl.isReadable(CLAIMS_TABLE)\n            ]);\n\n            if (claimsReady) {\n                // Garbage-collect old claims — they are only needed while\n                // instances could still contend on the same slot.\n                await ddl.step(\"Claim retention sweep\", async () => {\n                    await exec(\n                        `DELETE FROM ${CLAIMS_TABLE} WHERE claimed_at < now() - make_interval(days => $1)`,\n                        { params: [CLAIM_RETENTION_DAYS] }\n                    );\n                });\n\n                // Drop claims for slots that have not happened yet. A slot is\n                // claimed at the moment it fires, so a future one can only come\n                // from a timer that woke early — and because claims are\n                // permanent, that claim would silently skip the real run when it\n                // finally came due. The margin keeps a legitimate claim made\n                // moments early by a clock-skewed peer.\n                await ddl.step(\"Future-slot claim sweep\", async () => {\n                    const stranded = await exec(\n                        `DELETE FROM ${CLAIMS_TABLE}\n                         WHERE slot > now() + make_interval(mins => $1)\n                         RETURNING job_id, slot`,\n                        { params: [FUTURE_CLAIM_SKEW_MINUTES] }\n                    );\n                    // A driver that does not honour RETURNING gives back\n                    // nothing; the rows are only used to report, so treat that\n                    // as \"none\".\n                    for (const row of (stranded ?? []) as { job_id: string; slot: string }[]) {\n                        logger.warn(\n                            `[cron-store] Released a claim on the future slot ${new Date(row.slot).toISOString()} ` +\n                            `for \"${row.job_id}\" — it was claimed by a timer that fired early, and would ` +\n                            \"otherwise have skipped that run\"\n                        );\n                    }\n                });\n            }\n\n            // Neither table is a collection, so neither carries RLS, while the\n            // Postgres driver's schema-wide grant reaches both. Cron logs hold\n            // job output — arbitrary application data — and a writable\n            // `cron_claims` lets any signed-in user suppress a scheduled run by\n            // claiming its slot. This is a security control, so it is re-applied\n            // by every instance on every boot, whatever else went wrong.\n            if (logsReady) {\n                await ddl.step(\"Revoking end-user access to cron_logs\", () =>\n                    exec(revokeInternalTableSql(\"rebase\", \"cron_logs\")));\n            }\n            if (claimsReady) {\n                await ddl.step(\"Revoking end-user access to cron_claims\", () =>\n                    exec(revokeInternalTableSql(\"rebase\", \"cron_claims\")));\n            }\n\n            if (logsReady && claimsReady) {\n                logger.info(\"✅ Cron logs table ready\");\n                return;\n            }\n            // Say which capability is gone, and what it costs. \"Continuing\n            // without cron log persistence\" undersold this: the claims table is\n            // the only thing stopping every instance from running every job.\n            if (!claimsReady) {\n                logger.error(\n                    `❌ [cron-store] ${CLAIMS_TABLE} is unavailable — scheduled runs cannot be coordinated. ` +\n                    \"With more than one app instance, every instance will now run every job on every tick.\"\n                );\n            }\n            if (!logsReady) {\n                logger.warn(`⚠️ [cron-store] ${TABLE} is unavailable — cron run history will not be persisted.`);\n            }\n        },\n\n        async insertLog(entry: CronJobLogEntry): Promise<void> {\n            try {\n                const resultJson = entry.result !== undefined ? JSON.stringify(entry.result) : null;\n                const logsJson = entry.logs.length > 0 ? JSON.stringify(entry.logs) : null;\n\n                await exec(\n                    `INSERT INTO ${TABLE} (job_id, started_at, finished_at, duration_ms, success, error, result, logs, manual)\n                     VALUES ($1, $2, $3, $4, $5, $6, $7::jsonb, $8::jsonb, $9)`,\n                    { params: [\n                        entry.jobId,\n                        entry.startedAt,\n                        entry.finishedAt,\n                        entry.durationMs,\n                        entry.success,\n                        entry.error || null,\n                        resultJson,\n                        logsJson,\n                        entry.manual\n                    ]}\n                );\n            } catch (err) {\n                // Non-blocking — log persistence should never crash the scheduler\n                logger.error(`[cron-store] Failed to persist log for \"${entry.jobId}\"`, { error: err });\n            }\n        },\n\n        async fetchLogs(jobId: string, limit = 50): Promise<CronJobLogEntry[]> {\n            try {\n                const rows = await exec(\n                    `SELECT job_id, started_at, finished_at, duration_ms, success, error, result, logs, manual\n                     FROM ${TABLE}\n                     WHERE job_id = $1\n                     ORDER BY started_at DESC\n                     LIMIT $2`,\n                    { params: [jobId, limit] }\n                );\n\n                return rows.map(rowToLogEntry);\n            } catch (err) {\n                logger.error(`[cron-store] Failed to fetch logs for \"${jobId}\"`, { error: err });\n                return [];\n            }\n        },\n\n        async fetchJobStats(): Promise<Map<string, { totalRuns: number; totalFailures: number; lastRunAt?: string }>> {\n            const stats = new Map<string, { totalRuns: number; totalFailures: number; lastRunAt?: string }>();\n            try {\n                const rows = await exec(`\n                    SELECT\n                        job_id,\n                        COUNT(*)::int AS total_runs,\n                        COUNT(*) FILTER (WHERE NOT success)::int AS total_failures,\n                        MAX(started_at) AS last_run_at\n                    FROM ${TABLE}\n                    GROUP BY job_id\n                `);\n\n                for (const row of rows) {\n                    stats.set(row.job_id as string, {\n                        totalRuns: row.total_runs as number,\n                        totalFailures: row.total_failures as number,\n                        lastRunAt: row.last_run_at ? new Date(row.last_run_at as string).toISOString() : undefined\n                    });\n                }\n            } catch (err) {\n                logger.error(\"[cron-store] Failed to fetch job stats\", { error: err });\n            }\n            return stats;\n        },\n\n        async tryClaimRun(jobId: string, slot: string): Promise<boolean> {\n            try {\n                const rows = await exec(\n                    `INSERT INTO ${CLAIMS_TABLE} (job_id, slot)\n                     VALUES ($1, $2)\n                     ON CONFLICT (job_id, slot) DO NOTHING\n                     RETURNING job_id`,\n                    { params: [jobId, slot] }\n                );\n                return rows.length > 0;\n            } catch (err) {\n                if (isUniqueViolation(err)) {\n                    // Another instance won the race for this slot\n                    return false;\n                }\n                // Fail open: better to risk a duplicate run than to have a\n                // broken claims table silently stop all cron execution.\n                logger.warn(`[cron-store] Claim check failed for \"${jobId}\" — running uncoordinated`, { error: err });\n                return true;\n            }\n        }\n    };\n}\n\n// ─── Helpers ─────────────────────────────────────────────────────────\n\nfunction rowToLogEntry(row: Record<string, unknown>): CronJobLogEntry {\n    return {\n        jobId: row.job_id as string,\n        startedAt: new Date(row.started_at as string).toISOString(),\n        finishedAt: new Date(row.finished_at as string).toISOString(),\n        durationMs: row.duration_ms as number,\n        success: row.success as boolean,\n        error: (row.error as string) ?? undefined,\n        result: row.result ?? undefined,\n        logs: Array.isArray(row.logs) ? row.logs : (row.logs ? (() => { try { return JSON.parse(row.logs as string); } catch { return []; } })() : []),\n        manual: row.manual as boolean\n    };\n}\n"],"mappings":";;;;;;;;;;AAyDA,IAAM,QAAQ;AACd,IAAM,eAAe;;AAGrB,IAAM,uBAAuB;;;;;;AAO7B,IAAM,4BAA4B;;;;;;;;;;;;AAalC,SAAS,kBAAkB,KAAuB;CAC9C,OAAO,gBAAgB,MAAM,MACzB,EAAE,SAAS,WACX,EAAE,UAAU,QACX,OAAO,EAAE,YAAY,YAAY,EAAE,QAAQ,SAAS,0BAA0B,CACnF;AACJ;AAEA,SAAgB,gBAAgB,QAA2C;CACvE,MAAM,QAAQ,OAAO;CACrB,IAAI,CAAC,WAAW,KAAK,GAAG;EACpB,OAAO,KAAK,0FAA0F;EACtG;CACJ;CAEA,MAAM,QAAQ,SAAiB,YAC3B,MAAM,WAAW,SAAS,SAAS,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,KAAA,CAAS;CAEtF,MAAM,MAAM,sBAAsB,MAAM,YAAY;CAEpD,OAAO;EACH,MAAM,cAA6B;GAO/B,MAAM,IAAI,aAAa,0BAA0B,oCAAoC;GAErF,MAAM,IAAI,aAAa,YAAY,SAAS;6CACX,MAAM;;;;;;;;;;;;aAYtC;GAED,MAAM,IAAI,aAAa,8BAA8B;;qBAE5C,MAAM;aACd;GAED,MAAM,IAAI,aAAa,YAAY,gBAAgB;6CAClB,aAAa;;;;;;aAM7C;GASD,MAAM,CAAC,WAAW,eAAe,MAAM,QAAQ,IAAI,CAC/C,IAAI,WAAW,KAAK,GACpB,IAAI,WAAW,YAAY,CAC/B,CAAC;GAED,IAAI,aAAa;IAGb,MAAM,IAAI,KAAK,yBAAyB,YAAY;KAChD,MAAM,KACF,eAAe,aAAa,wDAC5B,EAAE,QAAQ,CAAC,oBAAoB,EAAE,CACrC;IACJ,CAAC;IAQD,MAAM,IAAI,KAAK,2BAA2B,YAAY;KAClD,MAAM,WAAW,MAAM,KACnB,eAAe,aAAa;;kDAG5B,EAAE,QAAQ,CAAC,yBAAyB,EAAE,CAC1C;KAIA,KAAK,MAAM,OAAQ,YAAY,CAAC,GAC5B,OAAO,KACH,oDAAoD,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,YAAY,EAAE,QAC7E,IAAI,OAAO,0FAEvB;IAER,CAAC;GACL;GAQA,IAAI,WACA,MAAM,IAAI,KAAK,+CACX,KAAK,uBAAuB,UAAU,WAAW,CAAC,CAAC;GAE3D,IAAI,aACA,MAAM,IAAI,KAAK,iDACX,KAAK,uBAAuB,UAAU,aAAa,CAAC,CAAC;GAG7D,IAAI,aAAa,aAAa;IAC1B,OAAO,KAAK,yBAAyB;IACrC;GACJ;GAIA,IAAI,CAAC,aACD,OAAO,MACH,kBAAkB,aAAa,8IAEnC;GAEJ,IAAI,CAAC,WACD,OAAO,KAAK,mBAAmB,MAAM,0DAA0D;EAEvG;EAEA,MAAM,UAAU,OAAuC;GACnD,IAAI;IACA,MAAM,aAAa,MAAM,WAAW,KAAA,IAAY,KAAK,UAAU,MAAM,MAAM,IAAI;IAC/E,MAAM,WAAW,MAAM,KAAK,SAAS,IAAI,KAAK,UAAU,MAAM,IAAI,IAAI;IAEtE,MAAM,KACF,eAAe,MAAM;iFAErB,EAAE,QAAQ;KACN,MAAM;KACN,MAAM;KACN,MAAM;KACN,MAAM;KACN,MAAM;KACN,MAAM,SAAS;KACf;KACA;KACA,MAAM;IACV,EAAC,CACL;GACJ,SAAS,KAAK;IAEV,OAAO,MAAM,2CAA2C,MAAM,MAAM,IAAI,EAAE,OAAO,IAAI,CAAC;GAC1F;EACJ;EAEA,MAAM,UAAU,OAAe,QAAQ,IAAgC;GACnE,IAAI;IAUA,QAAO,MATY,KACf;4BACQ,MAAM;;;gCAId,EAAE,QAAQ,CAAC,OAAO,KAAK,EAAE,CAC7B,EAAA,CAEY,IAAI,aAAa;GACjC,SAAS,KAAK;IACV,OAAO,MAAM,0CAA0C,MAAM,IAAI,EAAE,OAAO,IAAI,CAAC;IAC/E,OAAO,CAAC;GACZ;EACJ;EAEA,MAAM,gBAAwG;GAC1G,MAAM,wBAAQ,IAAI,IAA8E;GAChG,IAAI;IACA,MAAM,OAAO,MAAM,KAAK;;;;;;2BAMb,MAAM;;iBAEhB;IAED,KAAK,MAAM,OAAO,MACd,MAAM,IAAI,IAAI,QAAkB;KAC5B,WAAW,IAAI;KACf,eAAe,IAAI;KACnB,WAAW,IAAI,cAAc,IAAI,KAAK,IAAI,WAAqB,CAAC,CAAC,YAAY,IAAI,KAAA;IACrF,CAAC;GAET,SAAS,KAAK;IACV,OAAO,MAAM,0CAA0C,EAAE,OAAO,IAAI,CAAC;GACzE;GACA,OAAO;EACX;EAEA,MAAM,YAAY,OAAe,MAAgC;GAC7D,IAAI;IAQA,QAAO,MAPY,KACf,eAAe,aAAa;;;wCAI5B,EAAE,QAAQ,CAAC,OAAO,IAAI,EAAE,CAC5B,EAAA,CACY,SAAS;GACzB,SAAS,KAAK;IACV,IAAI,kBAAkB,GAAG,GAErB,OAAO;IAIX,OAAO,KAAK,wCAAwC,MAAM,4BAA4B,EAAE,OAAO,IAAI,CAAC;IACpG,OAAO;GACX;EACJ;CACJ;AACJ;AAIA,SAAS,cAAc,KAA+C;CAClE,OAAO;EACH,OAAO,IAAI;EACX,WAAW,IAAI,KAAK,IAAI,UAAoB,CAAC,CAAC,YAAY;EAC1D,YAAY,IAAI,KAAK,IAAI,WAAqB,CAAC,CAAC,YAAY;EAC5D,YAAY,IAAI;EAChB,SAAS,IAAI;EACb,OAAQ,IAAI,SAAoB,KAAA;EAChC,QAAQ,IAAI,UAAU,KAAA;EACtB,MAAM,MAAM,QAAQ,IAAI,IAAI,IAAI,IAAI,OAAQ,IAAI,cAAc;GAAE,IAAI;IAAE,OAAO,KAAK,MAAM,IAAI,IAAc;GAAG,QAAQ;IAAE,OAAO,CAAC;GAAG;EAAE,EAAA,CAAG,IAAI,CAAC;EAC5I,QAAQ,IAAI;CAChB;AACJ"}
+{"version":3,"file":"cron-store-CB1x-Ken.js","names":[],"sources":["../src/cron/cron-store.ts"],"sourcesContent":["import type { CronJobLogEntry } from \"@rebasepro/types\";\nimport type { DataDriver } from \"@rebasepro/types\";\nimport { isSQLAdmin } from \"@rebasepro/types\";\nimport { revokeInternalTableSql } from \"@rebasepro/common\";\nimport { logger } from \"../utils/logger.js\";\nimport { createDdlBootstrapper, hasInCauseChain } from \"../boot/ddl-bootstrap.js\";\n\n/**\n * Persistence layer for cron job execution logs.\n *\n * Uses the DataDriver's `admin.executeSql` capability to store logs in a\n * `rebase.cron_logs` table. Falls back gracefully if the driver doesn't\n * support SQL (e.g. MongoDB) — in that case, no persistence occurs.\n */\nexport interface CronStore {\n    /** Ensure the backing table exists. Called once on startup. */\n    ensureTable(): Promise<void>;\n\n    /** Persist a single log entry after execution. */\n    insertLog(entry: CronJobLogEntry): Promise<void>;\n\n    /**\n     * Fetch the most recent logs for a job.\n     * @param jobId  The job identifier\n     * @param limit  Max entries to return (default 50)\n     * @returns Logs sorted newest-first\n     */\n    fetchLogs(jobId: string, limit?: number): Promise<CronJobLogEntry[]>;\n\n    /**\n     * Fetch aggregate stats for all jobs (totalRuns, totalFailures, lastRunAt).\n     * Used to seed in-memory counters on startup.\n     */\n    fetchJobStats(): Promise<Map<string, { totalRuns: number; totalFailures: number; lastRunAt?: string }>>;\n\n    /**\n     * Atomically claim a scheduled run slot for a job.\n     *\n     * `slot` is the *scheduled* fire time (ISO string) derived from the cron\n     * expression — deterministic across instances regardless of timer drift,\n     * so all instances contend on the same (jobId, slot) key. Exactly one\n     * caller wins the insert against the unique constraint and executes;\n     * the rest skip.\n     *\n     * Fails open (returns true) on unexpected store errors, so a broken\n     * claims table degrades to uncoordinated execution rather than silently\n     * never running jobs.\n     *\n     * Optional so custom stores written against the pre-claims interface\n     * keep working — the scheduler treats a missing implementation as\n     * uncoordinated (always run).\n     */\n    tryClaimRun?(jobId: string, slot: string): Promise<boolean>;\n}\n\n// ─── SQL-based implementation ────────────────────────────────────────\n\nconst TABLE = \"rebase.cron_logs\";\nconst CLAIMS_TABLE = \"rebase.cron_claims\";\n\n/** Claims older than this are garbage-collected on startup. */\nconst CLAIM_RETENTION_DAYS = 7;\n\n/**\n * How far ahead a claim may legitimately sit. Slots are claimed as they fire,\n * so anything beyond this is a clock-skewed peer at best and a stranded claim\n * at worst; see the sweep in `ensureTable`.\n */\nconst FUTURE_CLAIM_SKEW_MINUTES = 2;\n\n/**\n * Detect a unique-constraint violation anywhere in an error's cause chain.\n * Match the SQLSTATE code, never message text. Also covers SQLite\n * (\"UNIQUE constraint failed\") and MySQL (ER_DUP_ENTRY 1062) for future SQL\n * drivers.\n *\n * Distinct from `isConcurrentDdlRace` in `boot/ddl-bootstrap.ts`, which shares\n * the 23505 code but asks a different question — that one is about a losing\n * `CREATE`, this one is about a losing claim, and only the latter means\n * \"another instance already has this slot\".\n */\nfunction isUniqueViolation(err: unknown): boolean {\n    return hasInCauseChain(err, (e) =>\n        e.code === \"23505\" ||\n        e.errno === 1062 ||\n        (typeof e.message === \"string\" && e.message.includes(\"UNIQUE constraint failed\"))\n    );\n}\n\nexport function createCronStore(driver: DataDriver): CronStore | undefined {\n    const admin = driver.admin;\n    if (!isSQLAdmin(admin)) {\n        logger.warn(\"⚠️ [cron-store] DataDriver does not support SQL admin — cron logs will not be persisted.\");\n        return undefined;\n    }\n\n    const exec = (sqlText: string, options?: { params?: unknown[] }) =>\n        admin.executeSql(sqlText, options?.params ? { params: options.params } : undefined);\n\n    const ddl = createDdlBootstrapper(exec, \"cron-store\");\n\n    return {\n        async ensureTable(): Promise<void> {\n            // Creation. Every statement here is idempotent, so losing the race\n            // to a peer that booted at the same moment is survivable — but only\n            // if the loser retries rather than abandoning everything below it.\n            // One step each, so a hard failure on any one of them does not take\n            // the others with it. The claims table in particular must not be\n            // lost because an index on the *logs* table could not be built.\n            await ddl.ensureObject(\"Creating schema rebase\", \"CREATE SCHEMA IF NOT EXISTS rebase\");\n\n            await ddl.ensureObject(`Creating ${TABLE}`, `\n                CREATE TABLE IF NOT EXISTS ${TABLE} (\n                    id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,\n                    job_id TEXT NOT NULL,\n                    started_at TIMESTAMPTZ NOT NULL,\n                    finished_at TIMESTAMPTZ NOT NULL,\n                    duration_ms INTEGER NOT NULL,\n                    success BOOLEAN NOT NULL DEFAULT true,\n                    error TEXT,\n                    result JSONB,\n                    logs JSONB,\n                    manual BOOLEAN NOT NULL DEFAULT false\n                )\n            `);\n\n            await ddl.ensureObject(\"Creating idx_cron_logs_job\", `\n                CREATE INDEX IF NOT EXISTS idx_cron_logs_job\n                ON ${TABLE}(job_id, started_at DESC)\n            `);\n\n            await ddl.ensureObject(`Creating ${CLAIMS_TABLE}`, `\n                CREATE TABLE IF NOT EXISTS ${CLAIMS_TABLE} (\n                    job_id TEXT NOT NULL,\n                    slot TIMESTAMPTZ NOT NULL,\n                    claimed_at TIMESTAMPTZ NOT NULL DEFAULT now(),\n                    PRIMARY KEY (job_id, slot)\n                )\n            `);\n\n            // Everything from here is keyed on what actually exists, not on\n            // whether *this* instance is the one that created it. A single\n            // failure above used to abandon the rest of this method, which meant\n            // the loser of a boot race skipped the sweeps and — far worse — the\n            // privilege revocation, leaving the claims table writable by end\n            // users on an instance that reported nothing but a warning about\n            // log persistence.\n            const [logsReady, claimsReady] = await Promise.all([\n                ddl.isReadable(TABLE),\n                ddl.isReadable(CLAIMS_TABLE)\n            ]);\n\n            if (claimsReady) {\n                // Garbage-collect old claims — they are only needed while\n                // instances could still contend on the same slot.\n                await ddl.step(\"Claim retention sweep\", async () => {\n                    await exec(\n                        `DELETE FROM ${CLAIMS_TABLE} WHERE claimed_at < now() - make_interval(days => $1)`,\n                        { params: [CLAIM_RETENTION_DAYS] }\n                    );\n                });\n\n                // Drop claims for slots that have not happened yet. A slot is\n                // claimed at the moment it fires, so a future one can only come\n                // from a timer that woke early — and because claims are\n                // permanent, that claim would silently skip the real run when it\n                // finally came due. The margin keeps a legitimate claim made\n                // moments early by a clock-skewed peer.\n                await ddl.step(\"Future-slot claim sweep\", async () => {\n                    const stranded = await exec(\n                        `DELETE FROM ${CLAIMS_TABLE}\n                         WHERE slot > now() + make_interval(mins => $1)\n                         RETURNING job_id, slot`,\n                        { params: [FUTURE_CLAIM_SKEW_MINUTES] }\n                    );\n                    // A driver that does not honour RETURNING gives back\n                    // nothing; the rows are only used to report, so treat that\n                    // as \"none\".\n                    for (const row of (stranded ?? []) as { job_id: string; slot: string }[]) {\n                        logger.warn(\n                            `[cron-store] Released a claim on the future slot ${new Date(row.slot).toISOString()} ` +\n                            `for \"${row.job_id}\" — it was claimed by a timer that fired early, and would ` +\n                            \"otherwise have skipped that run\"\n                        );\n                    }\n                });\n            }\n\n            // Neither table is a collection, so neither carries RLS, while the\n            // Postgres driver's schema-wide grant reaches both. Cron logs hold\n            // job output — arbitrary application data — and a writable\n            // `cron_claims` lets any signed-in user suppress a scheduled run by\n            // claiming its slot. This is a security control, so it is re-applied\n            // by every instance on every boot, whatever else went wrong.\n            if (logsReady) {\n                await ddl.step(\"Revoking end-user access to cron_logs\", () =>\n                    exec(revokeInternalTableSql(\"rebase\", \"cron_logs\")));\n            }\n            if (claimsReady) {\n                await ddl.step(\"Revoking end-user access to cron_claims\", () =>\n                    exec(revokeInternalTableSql(\"rebase\", \"cron_claims\")));\n            }\n\n            if (logsReady && claimsReady) {\n                logger.info(\"✅ Cron logs table ready\");\n                return;\n            }\n            // Say which capability is gone, and what it costs. \"Continuing\n            // without cron log persistence\" undersold this: the claims table is\n            // the only thing stopping every instance from running every job.\n            if (!claimsReady) {\n                logger.error(\n                    `❌ [cron-store] ${CLAIMS_TABLE} is unavailable — scheduled runs cannot be coordinated. ` +\n                    \"With more than one app instance, every instance will now run every job on every tick.\"\n                );\n            }\n            if (!logsReady) {\n                logger.warn(`⚠️ [cron-store] ${TABLE} is unavailable — cron run history will not be persisted.`);\n            }\n        },\n\n        async insertLog(entry: CronJobLogEntry): Promise<void> {\n            try {\n                const resultJson = entry.result !== undefined ? JSON.stringify(entry.result) : null;\n                const logsJson = entry.logs.length > 0 ? JSON.stringify(entry.logs) : null;\n\n                await exec(\n                    `INSERT INTO ${TABLE} (job_id, started_at, finished_at, duration_ms, success, error, result, logs, manual)\n                     VALUES ($1, $2, $3, $4, $5, $6, $7::jsonb, $8::jsonb, $9)`,\n                    { params: [\n                        entry.jobId,\n                        entry.startedAt,\n                        entry.finishedAt,\n                        entry.durationMs,\n                        entry.success,\n                        entry.error || null,\n                        resultJson,\n                        logsJson,\n                        entry.manual\n                    ]}\n                );\n            } catch (err) {\n                // Non-blocking — log persistence should never crash the scheduler\n                logger.error(`[cron-store] Failed to persist log for \"${entry.jobId}\"`, { error: err });\n            }\n        },\n\n        async fetchLogs(jobId: string, limit = 50): Promise<CronJobLogEntry[]> {\n            try {\n                const rows = await exec(\n                    `SELECT job_id, started_at, finished_at, duration_ms, success, error, result, logs, manual\n                     FROM ${TABLE}\n                     WHERE job_id = $1\n                     ORDER BY started_at DESC\n                     LIMIT $2`,\n                    { params: [jobId, limit] }\n                );\n\n                return rows.map(rowToLogEntry);\n            } catch (err) {\n                logger.error(`[cron-store] Failed to fetch logs for \"${jobId}\"`, { error: err });\n                return [];\n            }\n        },\n\n        async fetchJobStats(): Promise<Map<string, { totalRuns: number; totalFailures: number; lastRunAt?: string }>> {\n            const stats = new Map<string, { totalRuns: number; totalFailures: number; lastRunAt?: string }>();\n            try {\n                const rows = await exec(`\n                    SELECT\n                        job_id,\n                        COUNT(*)::int AS total_runs,\n                        COUNT(*) FILTER (WHERE NOT success)::int AS total_failures,\n                        MAX(started_at) AS last_run_at\n                    FROM ${TABLE}\n                    GROUP BY job_id\n                `);\n\n                for (const row of rows) {\n                    stats.set(row.job_id as string, {\n                        totalRuns: row.total_runs as number,\n                        totalFailures: row.total_failures as number,\n                        lastRunAt: row.last_run_at ? new Date(row.last_run_at as string).toISOString() : undefined\n                    });\n                }\n            } catch (err) {\n                logger.error(\"[cron-store] Failed to fetch job stats\", { error: err });\n            }\n            return stats;\n        },\n\n        async tryClaimRun(jobId: string, slot: string): Promise<boolean> {\n            try {\n                const rows = await exec(\n                    `INSERT INTO ${CLAIMS_TABLE} (job_id, slot)\n                     VALUES ($1, $2)\n                     ON CONFLICT (job_id, slot) DO NOTHING\n                     RETURNING job_id`,\n                    { params: [jobId, slot] }\n                );\n                return rows.length > 0;\n            } catch (err) {\n                if (isUniqueViolation(err)) {\n                    // Another instance won the race for this slot\n                    return false;\n                }\n                // Fail open: better to risk a duplicate run than to have a\n                // broken claims table silently stop all cron execution.\n                logger.warn(`[cron-store] Claim check failed for \"${jobId}\" — running uncoordinated`, { error: err });\n                return true;\n            }\n        }\n    };\n}\n\n// ─── Helpers ─────────────────────────────────────────────────────────\n\nfunction rowToLogEntry(row: Record<string, unknown>): CronJobLogEntry {\n    return {\n        jobId: row.job_id as string,\n        startedAt: new Date(row.started_at as string).toISOString(),\n        finishedAt: new Date(row.finished_at as string).toISOString(),\n        durationMs: row.duration_ms as number,\n        success: row.success as boolean,\n        error: (row.error as string) ?? undefined,\n        result: row.result ?? undefined,\n        logs: Array.isArray(row.logs) ? row.logs : (row.logs ? (() => { try { return JSON.parse(row.logs as string); } catch { return []; } })() : []),\n        manual: row.manual as boolean\n    };\n}\n"],"mappings":";;;;;;;;;;AAyDA,IAAM,QAAQ;AACd,IAAM,eAAe;;AAGrB,IAAM,uBAAuB;;;;;;AAO7B,IAAM,4BAA4B;;;;;;;;;;;;AAalC,SAAS,kBAAkB,KAAuB;CAC9C,OAAO,gBAAgB,MAAM,MACzB,EAAE,SAAS,WACX,EAAE,UAAU,QACX,OAAO,EAAE,YAAY,YAAY,EAAE,QAAQ,SAAS,0BAA0B,CACnF;AACJ;AAEA,SAAgB,gBAAgB,QAA2C;CACvE,MAAM,QAAQ,OAAO;CACrB,IAAI,CAAC,WAAW,KAAK,GAAG;EACpB,OAAO,KAAK,0FAA0F;EACtG;CACJ;CAEA,MAAM,QAAQ,SAAiB,YAC3B,MAAM,WAAW,SAAS,SAAS,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,KAAA,CAAS;CAEtF,MAAM,MAAM,sBAAsB,MAAM,YAAY;CAEpD,OAAO;EACH,MAAM,cAA6B;GAO/B,MAAM,IAAI,aAAa,0BAA0B,oCAAoC;GAErF,MAAM,IAAI,aAAa,YAAY,SAAS;6CACX,MAAM;;;;;;;;;;;;aAYtC;GAED,MAAM,IAAI,aAAa,8BAA8B;;qBAE5C,MAAM;aACd;GAED,MAAM,IAAI,aAAa,YAAY,gBAAgB;6CAClB,aAAa;;;;;;aAM7C;GASD,MAAM,CAAC,WAAW,eAAe,MAAM,QAAQ,IAAI,CAC/C,IAAI,WAAW,KAAK,GACpB,IAAI,WAAW,YAAY,CAC/B,CAAC;GAED,IAAI,aAAa;IAGb,MAAM,IAAI,KAAK,yBAAyB,YAAY;KAChD,MAAM,KACF,eAAe,aAAa,wDAC5B,EAAE,QAAQ,CAAC,oBAAoB,EAAE,CACrC;IACJ,CAAC;IAQD,MAAM,IAAI,KAAK,2BAA2B,YAAY;KAClD,MAAM,WAAW,MAAM,KACnB,eAAe,aAAa;;kDAG5B,EAAE,QAAQ,CAAC,yBAAyB,EAAE,CAC1C;KAIA,KAAK,MAAM,OAAQ,YAAY,CAAC,GAC5B,OAAO,KACH,oDAAoD,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,YAAY,EAAE,QAC7E,IAAI,OAAO,0FAEvB;IAER,CAAC;GACL;GAQA,IAAI,WACA,MAAM,IAAI,KAAK,+CACX,KAAK,uBAAuB,UAAU,WAAW,CAAC,CAAC;GAE3D,IAAI,aACA,MAAM,IAAI,KAAK,iDACX,KAAK,uBAAuB,UAAU,aAAa,CAAC,CAAC;GAG7D,IAAI,aAAa,aAAa;IAC1B,OAAO,KAAK,yBAAyB;IACrC;GACJ;GAIA,IAAI,CAAC,aACD,OAAO,MACH,kBAAkB,aAAa,8IAEnC;GAEJ,IAAI,CAAC,WACD,OAAO,KAAK,mBAAmB,MAAM,0DAA0D;EAEvG;EAEA,MAAM,UAAU,OAAuC;GACnD,IAAI;IACA,MAAM,aAAa,MAAM,WAAW,KAAA,IAAY,KAAK,UAAU,MAAM,MAAM,IAAI;IAC/E,MAAM,WAAW,MAAM,KAAK,SAAS,IAAI,KAAK,UAAU,MAAM,IAAI,IAAI;IAEtE,MAAM,KACF,eAAe,MAAM;iFAErB,EAAE,QAAQ;KACN,MAAM;KACN,MAAM;KACN,MAAM;KACN,MAAM;KACN,MAAM;KACN,MAAM,SAAS;KACf;KACA;KACA,MAAM;IACV,EAAC,CACL;GACJ,SAAS,KAAK;IAEV,OAAO,MAAM,2CAA2C,MAAM,MAAM,IAAI,EAAE,OAAO,IAAI,CAAC;GAC1F;EACJ;EAEA,MAAM,UAAU,OAAe,QAAQ,IAAgC;GACnE,IAAI;IAUA,QAAO,MATY,KACf;4BACQ,MAAM;;;gCAId,EAAE,QAAQ,CAAC,OAAO,KAAK,EAAE,CAC7B,EAAA,CAEY,IAAI,aAAa;GACjC,SAAS,KAAK;IACV,OAAO,MAAM,0CAA0C,MAAM,IAAI,EAAE,OAAO,IAAI,CAAC;IAC/E,OAAO,CAAC;GACZ;EACJ;EAEA,MAAM,gBAAwG;GAC1G,MAAM,wBAAQ,IAAI,IAA8E;GAChG,IAAI;IACA,MAAM,OAAO,MAAM,KAAK;;;;;;2BAMb,MAAM;;iBAEhB;IAED,KAAK,MAAM,OAAO,MACd,MAAM,IAAI,IAAI,QAAkB;KAC5B,WAAW,IAAI;KACf,eAAe,IAAI;KACnB,WAAW,IAAI,cAAc,IAAI,KAAK,IAAI,WAAqB,CAAC,CAAC,YAAY,IAAI,KAAA;IACrF,CAAC;GAET,SAAS,KAAK;IACV,OAAO,MAAM,0CAA0C,EAAE,OAAO,IAAI,CAAC;GACzE;GACA,OAAO;EACX;EAEA,MAAM,YAAY,OAAe,MAAgC;GAC7D,IAAI;IAQA,QAAO,MAPY,KACf,eAAe,aAAa;;;wCAI5B,EAAE,QAAQ,CAAC,OAAO,IAAI,EAAE,CAC5B,EAAA,CACY,SAAS;GACzB,SAAS,KAAK;IACV,IAAI,kBAAkB,GAAG,GAErB,OAAO;IAIX,OAAO,KAAK,wCAAwC,MAAM,4BAA4B,EAAE,OAAO,IAAI,CAAC;IACpG,OAAO;GACX;EACJ;CACJ;AACJ;AAIA,SAAS,cAAc,KAA+C;CAClE,OAAO;EACH,OAAO,IAAI;EACX,WAAW,IAAI,KAAK,IAAI,UAAoB,CAAC,CAAC,YAAY;EAC1D,YAAY,IAAI,KAAK,IAAI,WAAqB,CAAC,CAAC,YAAY;EAC5D,YAAY,IAAI;EAChB,SAAS,IAAI;EACb,OAAQ,IAAI,SAAoB,KAAA;EAChC,QAAQ,IAAI,UAAU,KAAA;EACtB,MAAM,MAAM,QAAQ,IAAI,IAAI,IAAI,IAAI,OAAQ,IAAI,cAAc;GAAE,IAAI;IAAE,OAAO,KAAK,MAAM,IAAI,IAAc;GAAG,QAAQ;IAAE,OAAO,CAAC;GAAG;EAAE,EAAA,CAAG,IAAI,CAAC;EAC5I,QAAQ,IAAI;CAChB;AACJ"}

package/dist/{ddl-bootstrap-BhXbTnBl.js → ddl-bootstrap-Cywoj8Ta.js}

@@ -140,6 +140,44 @@ function isConcurrentDdlRace(err) {
 	return hasInCauseChain(err, (e) => typeof e.code === "string" && CONCURRENT_DDL_SQLSTATES.has(e.code) || typeof e.message === "string" && /already exists/i.test(e.message));
 }
 /**
+* SQLSTATEs that mean, unambiguously, *the object is already there*.
+*
+* A subset of {@link CONCURRENT_DDL_SQLSTATES} and a stricter question. The
+* broad set answers "should this be retried"; this one answers "is it safe to
+* carry on as though the statement had succeeded", which is a claim about the
+* end state rather than about the attempt. Deadlock is not in it — a deadlocked
+* statement did nothing and must be retried, not skipped.
+*/
+var DUPLICATE_OBJECT_SQLSTATES = /* @__PURE__ */ new Set([
+	"42P06",
+	"42P07",
+	"42710"
+]);
+/**
+* Did this statement fail *because a peer already created the same object*?
+*
+* The narrow companion to {@link isConcurrentDdlRace}, for the one caller that
+* needs to tell "someone beat me to it" from "this genuinely failed": a loop
+* applying a schema plan, where treating every `23505` as a harmless race would
+* silently swallow the one that matters — a unique constraint that cannot be
+* added because the customer's existing rows violate it.
+*
+* `23505` is therefore only accepted when it names a `pg_catalog` index. That is
+* what a lost `CREATE TYPE`/`CREATE TABLE` race raises (`pg_type_typname_nsp_index`
+* is the one seen in practice); a unique violation on user data names the user's
+* own constraint and is left to the caller.
+*/
+function isDuplicateObjectRace(err) {
+	return hasInCauseChain(err, (e) => {
+		if (typeof e.code !== "string") return false;
+		if (DUPLICATE_OBJECT_SQLSTATES.has(e.code)) return true;
+		if (e.code !== "23505") return false;
+		const constraint = typeof e.constraint === "string" ? e.constraint : "";
+		const detail = typeof e.detail === "string" ? e.detail : "";
+		return constraint.startsWith("pg_") || /\bpg_[a-z_]+_index\b/.test(detail);
+	});
+}
+/**
 * @param exec   the driver's SQL escape hatch
 * @param scope  log prefix identifying the caller, e.g. `"cron-store"`
 */
@@ -178,6 +216,6 @@ function createDdlBootstrapper(exec, scope) {
 	};
 }
 //#endregion
-export { isSQLAdmin as i, hasInCauseChain as n, revokeInternalTableSql as r, createDdlBootstrapper as t };
+export { isDuplicateObjectRace as a, isConcurrentDdlRace as i, createDdlBootstrapper as n, revokeInternalTableSql as o, hasInCauseChain as r, isSQLAdmin as s, CONCURRENT_DDL_SQLSTATES as t };
 
-//# sourceMappingURL=ddl-bootstrap-BhXbTnBl.js.map
+//# sourceMappingURL=ddl-bootstrap-Cywoj8Ta.js.map