@rebasepro/server 0.14.1-canary.g7e666eb → 0.14.1

package/dist/jobs-DR4SjGrD.js

@@ -0,0 +1,326 @@
+import { createRequire as __createRequire } from "module";
+import process from "process";
+__createRequire(import.meta.url);
+import { n as __exportAll } from "./rolldown-runtime-DSJWtz9O.js";
+import "./src-8XDWyDfR.js";
+import "./src-Cz9nMgUR.js";
+import { n as createDdlBootstrapper, o as revokeInternalTableSql, r as hasInCauseChain, s as isSQLAdmin } from "./ddl-bootstrap-Cywoj8Ta.js";
+import { t as logger } from "./logger-DfvF_8r-.js";
+import { randomUUID } from "crypto";
+//#region src/jobs/job-store.ts
+/**
+* The queue's storage, as SQL against `rebase.jobs`.
+*
+* Split from the worker for the same reason `cron-store` is split from
+* `cron-scheduler`: the interesting parts here are three statements that have
+* to be exactly right under concurrency, and they are much easier to reason
+* about — and to test — away from a polling loop.
+*/
+var TABLE = "rebase.jobs";
+/** How long finished jobs are kept before the boot sweep removes them. */
+var SUCCEEDED_RETENTION_DAYS = 3;
+/**
+* Failures outlive successes by a lot. A dead-lettered job is evidence, and the
+* person who needs it is usually looking on Monday for something that happened
+* on Friday night.
+*/
+var FAILED_RETENTION_DAYS = 30;
+function toRecord(row) {
+	return {
+		id: row.id,
+		task: row.task,
+		payload: row.payload,
+		status: row.status,
+		runAt: new Date(row.run_at).toISOString(),
+		attempts: Number(row.attempts),
+		maxAttempts: Number(row.max_attempts),
+		lastError: row.last_error,
+		createdAt: new Date(row.created_at).toISOString(),
+		updatedAt: new Date(row.updated_at).toISOString()
+	};
+}
+/** Same rule as `cron-store`: match the SQLSTATE, never the message. */
+function isUniqueViolation(err) {
+	return hasInCauseChain(err, (e) => e.code === "23505");
+}
+function createJobStore(driver) {
+	const admin = driver.admin;
+	if (!isSQLAdmin(admin)) {
+		logger.warn("⚠️ [jobs] DataDriver does not support SQL admin — the durable job queue is unavailable. Work that would have been queued runs inline instead.");
+		return;
+	}
+	const execRaw = (sqlText, options) => admin.executeSql(sqlText, options?.params ? { params: options.params } : void 0);
+	const exec = (sqlText, params) => execRaw(sqlText, params ? { params } : void 0);
+	const ddl = createDdlBootstrapper(execRaw, "jobs");
+	return {
+		async ensureTable() {
+			await ddl.ensureObject("Creating schema rebase", "CREATE SCHEMA IF NOT EXISTS rebase");
+			await ddl.ensureObject(`Creating ${TABLE}`, `
+                CREATE TABLE IF NOT EXISTS ${TABLE} (
+                    id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
+                    task TEXT NOT NULL,
+                    payload JSONB,
+                    status TEXT NOT NULL DEFAULT 'pending',
+                    run_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+                    attempts INTEGER NOT NULL DEFAULT 0,
+                    max_attempts INTEGER NOT NULL DEFAULT 3,
+                    locked_at TIMESTAMPTZ,
+                    locked_by TEXT,
+                    idempotency_key TEXT,
+                    last_error TEXT,
+                    created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+                    updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+                )
+            `);
+			await ddl.ensureObject("Creating idx_jobs_runnable", `
+                CREATE INDEX IF NOT EXISTS idx_jobs_runnable
+                ON ${TABLE}(run_at, created_at)
+                WHERE status = 'pending'
+            `);
+			await ddl.ensureObject("Creating idx_jobs_running", `
+                CREATE INDEX IF NOT EXISTS idx_jobs_running
+                ON ${TABLE}(locked_at)
+                WHERE status = 'running'
+            `);
+			await ddl.ensureObject("Creating idx_jobs_idempotency", `
+                CREATE UNIQUE INDEX IF NOT EXISTS idx_jobs_idempotency
+                ON ${TABLE}(idempotency_key)
+                WHERE idempotency_key IS NOT NULL AND status IN ('pending', 'running')
+            `);
+			if (await ddl.isReadable(TABLE)) {
+				await ddl.step("Job retention sweep", async () => {
+					await exec(`DELETE FROM ${TABLE}
+                         WHERE (status = 'succeeded' AND updated_at < now() - make_interval(days => $1))
+                            OR (status = 'failed'    AND updated_at < now() - make_interval(days => $2))`, [SUCCEEDED_RETENTION_DAYS, FAILED_RETENTION_DAYS]);
+				});
+				await ddl.step("Revoking end-user access to jobs", () => exec(revokeInternalTableSql("rebase", "jobs")));
+				logger.info("✅ Job queue table ready");
+			} else logger.error(`❌ [jobs] ${TABLE} is unavailable — nothing can be queued and nothing queued earlier will run. Callers fall back to running the work inline.`);
+		},
+		async insert(job) {
+			try {
+				return (await exec(`INSERT INTO ${TABLE} (task, payload, run_at, max_attempts, idempotency_key)
+                     VALUES ($1, $2::jsonb, $3, $4, $5)
+                     RETURNING id`, [
+					job.task,
+					JSON.stringify(job.payload ?? null),
+					job.runAt.toISOString(),
+					job.maxAttempts,
+					job.idempotencyKey ?? null
+				]))?.[0]?.id ?? null;
+			} catch (error) {
+				if (isUniqueViolation(error)) return null;
+				throw error;
+			}
+		},
+		async claim(limit, workerId) {
+			return (await exec(`UPDATE ${TABLE} SET
+                    status = 'running',
+                    attempts = attempts + 1,
+                    locked_at = now(),
+                    locked_by = $2,
+                    updated_at = now()
+                 WHERE id IN (
+                     SELECT id FROM ${TABLE}
+                     WHERE status = 'pending' AND run_at <= now()
+                     ORDER BY run_at, created_at
+                     LIMIT $1
+                     FOR UPDATE SKIP LOCKED
+                 )
+                 RETURNING *`, [limit, workerId])).map(toRecord);
+		},
+		async complete(id) {
+			await exec(`UPDATE ${TABLE} SET status = 'succeeded', locked_at = NULL, locked_by = NULL,
+                        last_error = NULL, updated_at = now()
+                 WHERE id = $1`, [id]);
+		},
+		async fail(id, error, retryAt) {
+			if (retryAt) {
+				await exec(`UPDATE ${TABLE} SET status = 'pending', run_at = $2, locked_at = NULL,
+                            locked_by = NULL, last_error = $3, updated_at = now()
+                     WHERE id = $1`, [
+					id,
+					retryAt.toISOString(),
+					error
+				]);
+				return;
+			}
+			await exec(`UPDATE ${TABLE} SET status = 'failed', locked_at = NULL, locked_by = NULL,
+                        last_error = $2, updated_at = now()
+                 WHERE id = $1`, [id, error]);
+		},
+		async reapExpired(visibilityTimeoutMs) {
+			const seconds = Math.max(1, Math.round(visibilityTimeoutMs / 1e3));
+			const revived = await exec(`UPDATE ${TABLE} SET status = 'pending', locked_at = NULL, locked_by = NULL,
+                        last_error = 'Worker stopped responding; the job was reclaimed', updated_at = now()
+                 WHERE status = 'running'
+                   AND locked_at < now() - make_interval(secs => $1)
+                   AND attempts < max_attempts
+                 RETURNING id`, [seconds]);
+			const buried = await exec(`UPDATE ${TABLE} SET status = 'failed', locked_at = NULL, locked_by = NULL,
+                        last_error = 'Worker stopped responding on the final attempt', updated_at = now()
+                 WHERE status = 'running'
+                   AND locked_at < now() - make_interval(secs => $1)
+                   AND attempts >= max_attempts
+                 RETURNING id`, [seconds]);
+			const count = (revived?.length ?? 0) + (buried?.length ?? 0);
+			if (count > 0) logger.warn(`[jobs] Reclaimed ${count} job(s) from a worker that stopped responding (${revived?.length ?? 0} retryable, ${buried?.length ?? 0} dead-lettered)`);
+			return count;
+		},
+		async fetch(id) {
+			const row = (await exec(`SELECT * FROM ${TABLE} WHERE id = $1`, [id]))[0];
+			return row ? toRecord(row) : null;
+		}
+	};
+}
+//#endregion
+//#region src/jobs/job-queue.ts
+/**
+* The worker: claim, run, record, repeat.
+*
+* Everything difficult about running jobs concurrently is in `job-store.ts`,
+* where one `UPDATE … FOR UPDATE SKIP LOCKED` does the arbitration. What is
+* left here is a loop and the decisions around a handler that throws.
+*/
+var DEFAULT_CONCURRENCY = 5;
+var DEFAULT_POLL_INTERVAL_MS = 2e3;
+var DEFAULT_VISIBILITY_TIMEOUT_MS = 5 * 6e4;
+var DEFAULT_MAX_ATTEMPTS = 3;
+/** 1s, 5s, 25s, 125s … capped at an hour. */
+function defaultBackoff(attempt) {
+	return Math.min(1e3 * Math.pow(5, Math.max(0, attempt - 1)), 60 * 6e4);
+}
+/**
+* How often the reaper runs, relative to the visibility timeout.
+*
+* A quarter of it, so a stranded job waits at most 1.25× the timeout rather
+* than 2× — and so the sweep is not itself a per-poll query against a table
+* whose interesting rows are, almost always, none.
+*/
+var REAP_INTERVAL_FACTOR = .25;
+function createJobQueue(store, options = {}) {
+	const concurrency = options.concurrency ?? DEFAULT_CONCURRENCY;
+	const pollIntervalMs = options.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
+	const visibilityTimeoutMs = options.visibilityTimeoutMs ?? DEFAULT_VISIBILITY_TIMEOUT_MS;
+	const defaultMaxAttempts = options.maxAttempts ?? DEFAULT_MAX_ATTEMPTS;
+	const backoff = options.backoff ?? defaultBackoff;
+	const handlers = /* @__PURE__ */ new Map();
+	for (const [task, handler] of Object.entries(options.tasks ?? {})) handlers.set(task, handler);
+	const workerId = `${process.pid}-${randomUUID().slice(0, 8)}`;
+	let timer = null;
+	let running = false;
+	let draining = false;
+	/** Resolves when the in-flight poll finishes, so `stop()` can wait for it. */
+	let inFlight = Promise.resolve();
+	let lastReapAt = 0;
+	async function runJob(job) {
+		const handler = handlers.get(job.task);
+		if (!handler) {
+			logger.warn(`[jobs] No handler registered for task "${job.task}" — returning the job to the queue`);
+			await store.fail(job.id, `No handler registered for task "${job.task}"`, job.attempts < job.maxAttempts ? new Date(Date.now() + backoff(job.attempts)) : null);
+			return;
+		}
+		try {
+			await handler({
+				id: job.id,
+				task: job.task,
+				payload: job.payload,
+				attempt: job.attempts,
+				maxAttempts: job.maxAttempts
+			});
+			await store.complete(job.id);
+		} catch (error) {
+			const message = error instanceof Error ? error.stack ?? error.message : String(error);
+			const willRetry = job.attempts < job.maxAttempts;
+			await store.fail(job.id, message.slice(0, 4e3), willRetry ? new Date(Date.now() + backoff(job.attempts)) : null);
+			if (willRetry) logger.warn(`[jobs] "${job.task}" failed on attempt ${job.attempts}/${job.maxAttempts}; retrying`, { jobId: job.id });
+			else logger.error(`[jobs] "${job.task}" failed permanently after ${job.attempts} attempts`, {
+				jobId: job.id,
+				error: message
+			});
+		}
+	}
+	async function poll() {
+		const now = Date.now();
+		if (now - lastReapAt > visibilityTimeoutMs * REAP_INTERVAL_FACTOR) {
+			lastReapAt = now;
+			try {
+				await store.reapExpired(visibilityTimeoutMs);
+			} catch (error) {
+				logger.error("[jobs] Failed to reclaim expired jobs", { error });
+			}
+		}
+		const jobs = await store.claim(concurrency, workerId);
+		if (jobs.length === 0) return 0;
+		await Promise.allSettled(jobs.map(runJob));
+		return jobs.length;
+	}
+	function schedule(delayMs) {
+		if (!running) return;
+		timer = setTimeout(() => {
+			tick();
+		}, delayMs);
+		timer.unref?.();
+	}
+	async function tick() {
+		if (!running) return;
+		const work = (async () => {
+			try {
+				return await poll();
+			} catch (error) {
+				logger.error("[jobs] Poll failed", { error });
+				return 0;
+			}
+		})();
+		inFlight = work;
+		schedule(await work >= concurrency ? 0 : pollIntervalMs);
+	}
+	return {
+		start() {
+			if (running) return;
+			running = true;
+			logger.info(`[jobs] Worker started (concurrency ${concurrency}, poll ${pollIntervalMs}ms)`);
+			schedule(0);
+		},
+		async stop() {
+			running = false;
+			if (timer) {
+				clearTimeout(timer);
+				timer = null;
+			}
+			if (draining) return;
+			draining = true;
+			await inFlight.catch(() => void 0);
+			draining = false;
+		},
+		runOnce() {
+			return poll();
+		},
+		register(task, handler) {
+			if (handlers.has(task)) logger.warn(`[jobs] Task "${task}" was already registered; the later handler wins`);
+			handlers.set(task, handler);
+		},
+		isRunning() {
+			return running;
+		},
+		async enqueue(task, payload, enqueueOptions = {}) {
+			return store.insert({
+				task,
+				payload: payload ?? null,
+				runAt: new Date(Date.now() + (enqueueOptions.delayMs ?? 0)),
+				maxAttempts: enqueueOptions.maxAttempts ?? defaultMaxAttempts,
+				idempotencyKey: enqueueOptions.idempotencyKey
+			});
+		}
+	};
+}
+//#endregion
+//#region src/jobs/index.ts
+var jobs_exports = /* @__PURE__ */ __exportAll({
+	createJobQueue: () => createJobQueue,
+	createJobStore: () => createJobStore
+});
+//#endregion
+export { createJobStore as i, createJobQueue as n, defaultBackoff as r, jobs_exports as t };
+
+//# sourceMappingURL=jobs-DR4SjGrD.js.map

package/dist/jobs-DR4SjGrD.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jobs-DR4SjGrD.js","names":[],"sources":["../src/jobs/job-store.ts","../src/jobs/job-queue.ts","../src/jobs/index.ts"],"sourcesContent":["import type { DataDriver } from \"@rebasepro/types\";\nimport { isSQLAdmin } from \"@rebasepro/types\";\nimport { revokeInternalTableSql } from \"@rebasepro/common\";\nimport { logger } from \"../utils/logger.js\";\nimport { createDdlBootstrapper, hasInCauseChain, type SqlExec } from \"../boot/ddl-bootstrap.js\";\nimport type { JobRecord } from \"./types.js\";\n\n/**\n * The queue's storage, as SQL against `rebase.jobs`.\n *\n * Split from the worker for the same reason `cron-store` is split from\n * `cron-scheduler`: the interesting parts here are three statements that have\n * to be exactly right under concurrency, and they are much easier to reason\n * about — and to test — away from a polling loop.\n */\n\nconst TABLE = \"rebase.jobs\";\n\n/** How long finished jobs are kept before the boot sweep removes them. */\nconst SUCCEEDED_RETENTION_DAYS = 3;\n/**\n * Failures outlive successes by a lot. A dead-lettered job is evidence, and the\n * person who needs it is usually looking on Monday for something that happened\n * on Friday night.\n */\nconst FAILED_RETENTION_DAYS = 30;\n\n/** A row as Postgres returns it. */\ninterface JobRow {\n    id: string;\n    task: string;\n    payload: unknown;\n    status: string;\n    run_at: string;\n    attempts: number;\n    max_attempts: number;\n    last_error: string | null;\n    created_at: string;\n    updated_at: string;\n}\n\nfunction toRecord(row: JobRow): JobRecord {\n    return {\n        id: row.id,\n        task: row.task,\n        payload: row.payload,\n        status: row.status as JobRecord[\"status\"],\n        runAt: new Date(row.run_at).toISOString(),\n        attempts: Number(row.attempts),\n        maxAttempts: Number(row.max_attempts),\n        lastError: row.last_error,\n        createdAt: new Date(row.created_at).toISOString(),\n        updatedAt: new Date(row.updated_at).toISOString()\n    };\n}\n\n/** Same rule as `cron-store`: match the SQLSTATE, never the message. */\nfunction isUniqueViolation(err: unknown): boolean {\n    return hasInCauseChain(err, (e) => e.code === \"23505\");\n}\n\nexport interface JobStore {\n    ensureTable(): Promise<void>;\n    /** Returns the new job's id, or `null` if an idempotency key matched unfinished work. */\n    insert(job: {\n        task: string;\n        payload: unknown;\n        runAt: Date;\n        maxAttempts: number;\n        idempotencyKey?: string;\n    }): Promise<string | null>;\n    /** Atomically take up to `limit` runnable jobs for this worker. */\n    claim(limit: number, workerId: string): Promise<JobRecord[]>;\n    complete(id: string): Promise<void>;\n    /** Back to `pending` with a later `runAt`, or `failed` when out of attempts. */\n    fail(id: string, error: string, retryAt: Date | null): Promise<void>;\n    /** Return jobs stranded by a worker that died holding them. Resolves with how many. */\n    reapExpired(visibilityTimeoutMs: number): Promise<number>;\n    fetch(id: string): Promise<JobRecord | null>;\n}\n\nexport function createJobStore(driver: DataDriver): JobStore | undefined {\n    const admin = driver.admin;\n    if (!isSQLAdmin(admin)) {\n        logger.warn(\n            \"⚠️ [jobs] DataDriver does not support SQL admin — the durable job queue is unavailable. \" +\n            \"Work that would have been queued runs inline instead.\"\n        );\n        return undefined;\n    }\n\n    // Two shapes of the same call: the bootstrapper's `SqlExec` takes an\n    // options object, while everything below reads better with a positional\n    // parameter array.\n    const execRaw: SqlExec = (sqlText, options) =>\n        admin.executeSql(sqlText, options?.params ? { params: options.params } : undefined);\n    const exec = (sqlText: string, params?: unknown[]) =>\n        execRaw(sqlText, params ? { params } : undefined);\n\n    const ddl = createDdlBootstrapper(execRaw, \"jobs\");\n\n    return {\n        async ensureTable(): Promise<void> {\n            await ddl.ensureObject(\"Creating schema rebase\", \"CREATE SCHEMA IF NOT EXISTS rebase\");\n\n            await ddl.ensureObject(`Creating ${TABLE}`, `\n                CREATE TABLE IF NOT EXISTS ${TABLE} (\n                    id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,\n                    task TEXT NOT NULL,\n                    payload JSONB,\n                    status TEXT NOT NULL DEFAULT 'pending',\n                    run_at TIMESTAMPTZ NOT NULL DEFAULT now(),\n                    attempts INTEGER NOT NULL DEFAULT 0,\n                    max_attempts INTEGER NOT NULL DEFAULT 3,\n                    locked_at TIMESTAMPTZ,\n                    locked_by TEXT,\n                    idempotency_key TEXT,\n                    last_error TEXT,\n                    created_at TIMESTAMPTZ NOT NULL DEFAULT now(),\n                    updated_at TIMESTAMPTZ NOT NULL DEFAULT now()\n                )\n            `);\n\n            // The claim query's index. Partial, because the rows it has to find\n            // fast are a shrinking minority of a table that also holds every\n            // success and every dead letter.\n            await ddl.ensureObject(\"Creating idx_jobs_runnable\", `\n                CREATE INDEX IF NOT EXISTS idx_jobs_runnable\n                ON ${TABLE}(run_at, created_at)\n                WHERE status = 'pending'\n            `);\n\n            // Finds jobs stranded by a dead worker.\n            await ddl.ensureObject(\"Creating idx_jobs_running\", `\n                CREATE INDEX IF NOT EXISTS idx_jobs_running\n                ON ${TABLE}(locked_at)\n                WHERE status = 'running'\n            `);\n\n            // What makes `idempotencyKey` a guarantee rather than a\n            // check-then-act race: two instances reacting to one event both\n            // reach the INSERT, and the index decides. Partial on unfinished\n            // work — see `EnqueueOptions.idempotencyKey` for why a key must be\n            // reusable once its job is done.\n            await ddl.ensureObject(\"Creating idx_jobs_idempotency\", `\n                CREATE UNIQUE INDEX IF NOT EXISTS idx_jobs_idempotency\n                ON ${TABLE}(idempotency_key)\n                WHERE idempotency_key IS NOT NULL AND status IN ('pending', 'running')\n            `);\n\n            const ready = await ddl.isReadable(TABLE);\n\n            if (ready) {\n                await ddl.step(\"Job retention sweep\", async () => {\n                    await exec(\n                        `DELETE FROM ${TABLE}\n                         WHERE (status = 'succeeded' AND updated_at < now() - make_interval(days => $1))\n                            OR (status = 'failed'    AND updated_at < now() - make_interval(days => $2))`,\n                        [SUCCEEDED_RETENTION_DAYS, FAILED_RETENTION_DAYS]\n                    );\n                });\n\n                // Payloads are arbitrary application data — a webhook body, a\n                // user id, whatever was passed — and a writable queue lets any\n                // signed-in user schedule work of their choosing under the\n                // server's own authority. Same reasoning, and the same\n                // unconditional re-application, as `cron_claims`.\n                await ddl.step(\"Revoking end-user access to jobs\", () =>\n                    exec(revokeInternalTableSql(\"rebase\", \"jobs\")));\n\n                logger.info(\"✅ Job queue table ready\");\n            } else {\n                logger.error(\n                    `❌ [jobs] ${TABLE} is unavailable — nothing can be queued and nothing queued earlier ` +\n                    \"will run. Callers fall back to running the work inline.\"\n                );\n            }\n        },\n\n        async insert(job): Promise<string | null> {\n            try {\n                const rows = await exec(\n                    `INSERT INTO ${TABLE} (task, payload, run_at, max_attempts, idempotency_key)\n                     VALUES ($1, $2::jsonb, $3, $4, $5)\n                     RETURNING id`,\n                    [\n                        job.task,\n                        JSON.stringify(job.payload ?? null),\n                        job.runAt.toISOString(),\n                        job.maxAttempts,\n                        job.idempotencyKey ?? null\n                    ]\n                );\n                return (rows?.[0]?.id as string) ?? null;\n            } catch (error) {\n                // The losing side of an idempotency race. Not an error: the\n                // work the caller wanted is already queued, which is the\n                // outcome they asked for.\n                if (isUniqueViolation(error)) return null;\n                throw error;\n            }\n        },\n\n        async claim(limit: number, workerId: string): Promise<JobRecord[]> {\n            // `FOR UPDATE SKIP LOCKED` is the whole design. The inner select\n            // takes row locks on the jobs it picks and *skips* any a concurrent\n            // worker already holds, so N workers polling the same table divide\n            // the work instead of contending for the head of it — and no job is\n            // ever handed to two of them.\n            //\n            // `attempts` is incremented here, on claim, rather than on failure.\n            // A worker that is killed mid-job never reports anything, so\n            // counting on failure would let a job that crashes the process be\n            // retried forever, once per restart, taking the process down each\n            // time.\n            const rows = await exec(\n                `UPDATE ${TABLE} SET\n                    status = 'running',\n                    attempts = attempts + 1,\n                    locked_at = now(),\n                    locked_by = $2,\n                    updated_at = now()\n                 WHERE id IN (\n                     SELECT id FROM ${TABLE}\n                     WHERE status = 'pending' AND run_at <= now()\n                     ORDER BY run_at, created_at\n                     LIMIT $1\n                     FOR UPDATE SKIP LOCKED\n                 )\n                 RETURNING *`,\n                [limit, workerId]\n            );\n            return (rows as unknown as JobRow[]).map(toRecord);\n        },\n\n        async complete(id: string): Promise<void> {\n            await exec(\n                `UPDATE ${TABLE} SET status = 'succeeded', locked_at = NULL, locked_by = NULL,\n                        last_error = NULL, updated_at = now()\n                 WHERE id = $1`,\n                [id]\n            );\n        },\n\n        async fail(id: string, error: string, retryAt: Date | null): Promise<void> {\n            if (retryAt) {\n                await exec(\n                    `UPDATE ${TABLE} SET status = 'pending', run_at = $2, locked_at = NULL,\n                            locked_by = NULL, last_error = $3, updated_at = now()\n                     WHERE id = $1`,\n                    [id, retryAt.toISOString(), error]\n                );\n                return;\n            }\n            await exec(\n                `UPDATE ${TABLE} SET status = 'failed', locked_at = NULL, locked_by = NULL,\n                        last_error = $2, updated_at = now()\n                 WHERE id = $1`,\n                [id, error]\n            );\n        },\n\n        async reapExpired(visibilityTimeoutMs: number): Promise<number> {\n            // A worker killed while holding a job cannot release it, so nothing\n            // but a timeout will ever free the row. Jobs that still have\n            // attempts left go back to `pending`; the rest are dead-lettered\n            // with an error that says what happened, because \"attempts: 3,\n            // lastError: null\" is otherwise a genuinely baffling row to find.\n            const seconds = Math.max(1, Math.round(visibilityTimeoutMs / 1000));\n\n            const revived = await exec(\n                `UPDATE ${TABLE} SET status = 'pending', locked_at = NULL, locked_by = NULL,\n                        last_error = 'Worker stopped responding; the job was reclaimed', updated_at = now()\n                 WHERE status = 'running'\n                   AND locked_at < now() - make_interval(secs => $1)\n                   AND attempts < max_attempts\n                 RETURNING id`,\n                [seconds]\n            );\n\n            const buried = await exec(\n                `UPDATE ${TABLE} SET status = 'failed', locked_at = NULL, locked_by = NULL,\n                        last_error = 'Worker stopped responding on the final attempt', updated_at = now()\n                 WHERE status = 'running'\n                   AND locked_at < now() - make_interval(secs => $1)\n                   AND attempts >= max_attempts\n                 RETURNING id`,\n                [seconds]\n            );\n\n            const count = (revived?.length ?? 0) + (buried?.length ?? 0);\n            if (count > 0) {\n                logger.warn(\n                    `[jobs] Reclaimed ${count} job(s) from a worker that stopped responding ` +\n                    `(${revived?.length ?? 0} retryable, ${buried?.length ?? 0} dead-lettered)`\n                );\n            }\n            return count;\n        },\n\n        async fetch(id: string): Promise<JobRecord | null> {\n            const rows = await exec(`SELECT * FROM ${TABLE} WHERE id = $1`, [id]);\n            const row = (rows as unknown as JobRow[])[0];\n            return row ? toRecord(row) : null;\n        }\n    };\n}\n","import { randomUUID } from \"crypto\";\nimport { logger } from \"../utils/logger.js\";\nimport type { JobStore } from \"./job-store.js\";\nimport type { EnqueueOptions, JobHandler, JobQueueClient, JobQueueOptions, JobRecord } from \"./types.js\";\n\n/**\n * The worker: claim, run, record, repeat.\n *\n * Everything difficult about running jobs concurrently is in `job-store.ts`,\n * where one `UPDATE … FOR UPDATE SKIP LOCKED` does the arbitration. What is\n * left here is a loop and the decisions around a handler that throws.\n */\n\nconst DEFAULT_CONCURRENCY = 5;\nconst DEFAULT_POLL_INTERVAL_MS = 2_000;\nconst DEFAULT_VISIBILITY_TIMEOUT_MS = 5 * 60_000;\nconst DEFAULT_MAX_ATTEMPTS = 3;\n\n/** 1s, 5s, 25s, 125s … capped at an hour. */\nexport function defaultBackoff(attempt: number): number {\n    return Math.min(1_000 * Math.pow(5, Math.max(0, attempt - 1)), 60 * 60_000);\n}\n\n/**\n * How often the reaper runs, relative to the visibility timeout.\n *\n * A quarter of it, so a stranded job waits at most 1.25× the timeout rather\n * than 2× — and so the sweep is not itself a per-poll query against a table\n * whose interesting rows are, almost always, none.\n */\nconst REAP_INTERVAL_FACTOR = 0.25;\n\nexport interface JobQueue extends JobQueueClient {\n    start(): void;\n    stop(): Promise<void>;\n    /** Run one poll's worth of work and return how many jobs ran. For tests and for `/jobs/drain`. */\n    runOnce(): Promise<number>;\n    /** Registered after construction — how `tasks` from config and internal producers meet. */\n    register<P = unknown>(task: string, handler: JobHandler<P>): void;\n    isRunning(): boolean;\n}\n\nexport function createJobQueue(store: JobStore, options: JobQueueOptions = {}): JobQueue {\n    const concurrency = options.concurrency ?? DEFAULT_CONCURRENCY;\n    const pollIntervalMs = options.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;\n    const visibilityTimeoutMs = options.visibilityTimeoutMs ?? DEFAULT_VISIBILITY_TIMEOUT_MS;\n    const defaultMaxAttempts = options.maxAttempts ?? DEFAULT_MAX_ATTEMPTS;\n    const backoff = options.backoff ?? defaultBackoff;\n\n    const handlers = new Map<string, JobHandler<never>>();\n    for (const [task, handler] of Object.entries(options.tasks ?? {})) {\n        handlers.set(task, handler);\n    }\n\n    // Identifies this process in `locked_by`. Purely diagnostic — the claim is\n    // enforced by the row lock, not by this — but \"which pod had it when it\n    // stopped\" is the first question anyone asks of a stuck job.\n    const workerId = `${process.pid}-${randomUUID().slice(0, 8)}`;\n\n    let timer: NodeJS.Timeout | null = null;\n    let running = false;\n    let draining = false;\n    /** Resolves when the in-flight poll finishes, so `stop()` can wait for it. */\n    let inFlight: Promise<unknown> = Promise.resolve();\n    let lastReapAt = 0;\n\n    async function runJob(job: JobRecord): Promise<void> {\n        const handler = handlers.get(job.task);\n\n        if (!handler) {\n            // Not a failure. A rolling deploy runs old and new code at once, and\n            // an instance that has not been updated yet must not burn the\n            // attempts of a job belonging to one that has. Give the row back\n            // and let a peer — or this process after its next deploy — take it.\n            //\n            // The attempt increment from the claim is deliberately not undone:\n            // a task nobody in the fleet implements would otherwise cycle\n            // forever, and this way it dead-letters after `maxAttempts` with an\n            // error naming the task.\n            logger.warn(`[jobs] No handler registered for task \"${job.task}\" — returning the job to the queue`);\n            await store.fail(\n                job.id,\n                `No handler registered for task \"${job.task}\"`,\n                job.attempts < job.maxAttempts ? new Date(Date.now() + backoff(job.attempts)) : null\n            );\n            return;\n        }\n\n        try {\n            await handler({\n                id: job.id,\n                task: job.task,\n                payload: job.payload as never,\n                attempt: job.attempts,\n                maxAttempts: job.maxAttempts\n            } as never);\n            await store.complete(job.id);\n        } catch (error) {\n            const message = error instanceof Error ? (error.stack ?? error.message) : String(error);\n            const willRetry = job.attempts < job.maxAttempts;\n\n            // Truncated, because `last_error` holds a stack and a queue that\n            // accumulates megabytes of them is its own outage.\n            await store.fail(job.id, message.slice(0, 4_000), willRetry ? new Date(Date.now() + backoff(job.attempts)) : null);\n\n            if (willRetry) {\n                logger.warn(`[jobs] \"${job.task}\" failed on attempt ${job.attempts}/${job.maxAttempts}; retrying`, { jobId: job.id });\n            } else {\n                // The last attempt is an error, not a warning: nothing else will\n                // touch this job, and if nobody looks at the table it is simply\n                // lost work.\n                logger.error(`[jobs] \"${job.task}\" failed permanently after ${job.attempts} attempts`, { jobId: job.id, error: message });\n            }\n        }\n    }\n\n    async function poll(): Promise<number> {\n        // The reaper, on its own cadence.\n        const now = Date.now();\n        if (now - lastReapAt > visibilityTimeoutMs * REAP_INTERVAL_FACTOR) {\n            lastReapAt = now;\n            try {\n                await store.reapExpired(visibilityTimeoutMs);\n            } catch (error) {\n                logger.error(\"[jobs] Failed to reclaim expired jobs\", { error });\n            }\n        }\n\n        const jobs = await store.claim(concurrency, workerId);\n        if (jobs.length === 0) return 0;\n\n        // Settled, not `all`: `runJob` handles its own errors, but a store\n        // write failing inside it must not abandon this batch's siblings.\n        await Promise.allSettled(jobs.map(runJob));\n        return jobs.length;\n    }\n\n    function schedule(delayMs: number): void {\n        if (!running) return;\n        timer = setTimeout(() => {\n            void tick();\n        }, delayMs);\n        // Never hold the process open. A queue with nothing to do should not be\n        // the reason `rebase dev` will not exit.\n        timer.unref?.();\n    }\n\n    async function tick(): Promise<void> {\n        if (!running) return;\n        const work = (async () => {\n            try {\n                return await poll();\n            } catch (error) {\n                logger.error(\"[jobs] Poll failed\", { error });\n                return 0;\n            }\n        })();\n        inFlight = work;\n        const count = await work;\n\n        // A full batch means there is probably more waiting, so go straight\n        // back rather than sleeping through a backlog.\n        schedule(count >= concurrency ? 0 : pollIntervalMs);\n    }\n\n    return {\n        start(): void {\n            if (running) return;\n            running = true;\n            logger.info(`[jobs] Worker started (concurrency ${concurrency}, poll ${pollIntervalMs}ms)`);\n            schedule(0);\n        },\n\n        async stop(): Promise<void> {\n            running = false;\n            if (timer) {\n                clearTimeout(timer);\n                timer = null;\n            }\n            if (draining) return;\n            draining = true;\n            // Jobs in flight keep their claim until they finish or the\n            // visibility timeout expires, so waiting here is what turns a\n            // graceful shutdown into \"no job runs twice\".\n            await inFlight.catch(() => undefined);\n            draining = false;\n        },\n\n        runOnce(): Promise<number> {\n            return poll();\n        },\n\n        register<P = unknown>(task: string, handler: JobHandler<P>): void {\n            if (handlers.has(task)) {\n                logger.warn(`[jobs] Task \"${task}\" was already registered; the later handler wins`);\n            }\n            handlers.set(task, handler as JobHandler<never>);\n        },\n\n        isRunning(): boolean {\n            return running;\n        },\n\n        async enqueue<P = unknown>(task: string, payload?: P, enqueueOptions: EnqueueOptions = {}): Promise<string | null> {\n            return store.insert({\n                task,\n                payload: payload ?? null,\n                runAt: new Date(Date.now() + (enqueueOptions.delayMs ?? 0)),\n                maxAttempts: enqueueOptions.maxAttempts ?? defaultMaxAttempts,\n                idempotencyKey: enqueueOptions.idempotencyKey\n            });\n        }\n    };\n}\n","export { createJobStore } from \"./job-store\";\nexport type { JobStore } from \"./job-store\";\nexport { createJobQueue, defaultBackoff } from \"./job-queue\";\nexport type { JobQueue } from \"./job-queue\";\nexport type {\n    EnqueueOptions,\n    JobContext,\n    JobHandler,\n    JobQueueClient,\n    JobQueueOptions,\n    JobRecord,\n    JobStatus\n} from \"./types\";\n"],"mappings":";;;;;;;;;;;;;;;;;;AAgBA,IAAM,QAAQ;;AAGd,IAAM,2BAA2B;;;;;;AAMjC,IAAM,wBAAwB;AAgB9B,SAAS,SAAS,KAAwB;CACtC,OAAO;EACH,IAAI,IAAI;EACR,MAAM,IAAI;EACV,SAAS,IAAI;EACb,QAAQ,IAAI;EACZ,OAAO,IAAI,KAAK,IAAI,MAAM,CAAC,CAAC,YAAY;EACxC,UAAU,OAAO,IAAI,QAAQ;EAC7B,aAAa,OAAO,IAAI,YAAY;EACpC,WAAW,IAAI;EACf,WAAW,IAAI,KAAK,IAAI,UAAU,CAAC,CAAC,YAAY;EAChD,WAAW,IAAI,KAAK,IAAI,UAAU,CAAC,CAAC,YAAY;CACpD;AACJ;;AAGA,SAAS,kBAAkB,KAAuB;CAC9C,OAAO,gBAAgB,MAAM,MAAM,EAAE,SAAS,OAAO;AACzD;AAsBA,SAAgB,eAAe,QAA0C;CACrE,MAAM,QAAQ,OAAO;CACrB,IAAI,CAAC,WAAW,KAAK,GAAG;EACpB,OAAO,KACH,+IAEJ;EACA;CACJ;CAKA,MAAM,WAAoB,SAAS,YAC/B,MAAM,WAAW,SAAS,SAAS,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,KAAA,CAAS;CACtF,MAAM,QAAQ,SAAiB,WAC3B,QAAQ,SAAS,SAAS,EAAE,OAAO,IAAI,KAAA,CAAS;CAEpD,MAAM,MAAM,sBAAsB,SAAS,MAAM;CAEjD,OAAO;EACH,MAAM,cAA6B;GAC/B,MAAM,IAAI,aAAa,0BAA0B,oCAAoC;GAErF,MAAM,IAAI,aAAa,YAAY,SAAS;6CACX,MAAM;;;;;;;;;;;;;;;aAetC;GAKD,MAAM,IAAI,aAAa,8BAA8B;;qBAE5C,MAAM;;aAEd;GAGD,MAAM,IAAI,aAAa,6BAA6B;;qBAE3C,MAAM;;aAEd;GAOD,MAAM,IAAI,aAAa,iCAAiC;;qBAE/C,MAAM;;aAEd;GAID,IAAI,MAFgB,IAAI,WAAW,KAAK,GAE7B;IACP,MAAM,IAAI,KAAK,uBAAuB,YAAY;KAC9C,MAAM,KACF,eAAe,MAAM;;2GAGrB,CAAC,0BAA0B,qBAAqB,CACpD;IACJ,CAAC;IAOD,MAAM,IAAI,KAAK,0CACX,KAAK,uBAAuB,UAAU,MAAM,CAAC,CAAC;IAElD,OAAO,KAAK,yBAAyB;GACzC,OACI,OAAO,MACH,YAAY,MAAM,2HAEtB;EAER;EAEA,MAAM,OAAO,KAA6B;GACtC,IAAI;IAaA,QAAQ,MAZW,KACf,eAAe,MAAM;;oCAGrB;KACI,IAAI;KACJ,KAAK,UAAU,IAAI,WAAW,IAAI;KAClC,IAAI,MAAM,YAAY;KACtB,IAAI;KACJ,IAAI,kBAAkB;IAC1B,CACJ,EAAA,GACe,EAAE,EAAE,MAAiB;GACxC,SAAS,OAAO;IAIZ,IAAI,kBAAkB,KAAK,GAAG,OAAO;IACrC,MAAM;GACV;EACJ;EAEA,MAAM,MAAM,OAAe,UAAwC;GA6B/D,QAAQ,MAjBW,KACf,UAAU,MAAM;;;;;;;sCAOM,MAAM;;;;;;+BAO5B,CAAC,OAAO,QAAQ,CACpB,EAAA,CACqC,IAAI,QAAQ;EACrD;EAEA,MAAM,SAAS,IAA2B;GACtC,MAAM,KACF,UAAU,MAAM;;iCAGhB,CAAC,EAAE,CACP;EACJ;EAEA,MAAM,KAAK,IAAY,OAAe,SAAqC;GACvE,IAAI,SAAS;IACT,MAAM,KACF,UAAU,MAAM;;qCAGhB;KAAC;KAAI,QAAQ,YAAY;KAAG;IAAK,CACrC;IACA;GACJ;GACA,MAAM,KACF,UAAU,MAAM;;iCAGhB,CAAC,IAAI,KAAK,CACd;EACJ;EAEA,MAAM,YAAY,qBAA8C;GAM5D,MAAM,UAAU,KAAK,IAAI,GAAG,KAAK,MAAM,sBAAsB,GAAI,CAAC;GAElE,MAAM,UAAU,MAAM,KAClB,UAAU,MAAM;;;;;gCAMhB,CAAC,OAAO,CACZ;GAEA,MAAM,SAAS,MAAM,KACjB,UAAU,MAAM;;;;;gCAMhB,CAAC,OAAO,CACZ;GAEA,MAAM,SAAS,SAAS,UAAU,MAAM,QAAQ,UAAU;GAC1D,IAAI,QAAQ,GACR,OAAO,KACH,oBAAoB,MAAM,iDACtB,SAAS,UAAU,EAAE,cAAc,QAAQ,UAAU,EAAE,gBAC/D;GAEJ,OAAO;EACX;EAEA,MAAM,MAAM,IAAuC;GAE/C,MAAM,OAAO,MADM,KAAK,iBAAiB,MAAM,iBAAiB,CAAC,EAAE,CAAC,EAAA,CAC1B;GAC1C,OAAO,MAAM,SAAS,GAAG,IAAI;EACjC;CACJ;AACJ;;;;;;;;;;ACrSA,IAAM,sBAAsB;AAC5B,IAAM,2BAA2B;AACjC,IAAM,gCAAgC,IAAI;AAC1C,IAAM,uBAAuB;;AAG7B,SAAgB,eAAe,SAAyB;CACpD,OAAO,KAAK,IAAI,MAAQ,KAAK,IAAI,GAAG,KAAK,IAAI,GAAG,UAAU,CAAC,CAAC,GAAG,KAAK,GAAM;AAC9E;;;;;;;;AASA,IAAM,uBAAuB;AAY7B,SAAgB,eAAe,OAAiB,UAA2B,CAAC,GAAa;CACrF,MAAM,cAAc,QAAQ,eAAe;CAC3C,MAAM,iBAAiB,QAAQ,kBAAkB;CACjD,MAAM,sBAAsB,QAAQ,uBAAuB;CAC3D,MAAM,qBAAqB,QAAQ,eAAe;CAClD,MAAM,UAAU,QAAQ,WAAW;CAEnC,MAAM,2BAAW,IAAI,IAA+B;CACpD,KAAK,MAAM,CAAC,MAAM,YAAY,OAAO,QAAQ,QAAQ,SAAS,CAAC,CAAC,GAC5D,SAAS,IAAI,MAAM,OAAO;CAM9B,MAAM,WAAW,GAAG,QAAQ,IAAI,GAAG,WAAW,CAAC,CAAC,MAAM,GAAG,CAAC;CAE1D,IAAI,QAA+B;CACnC,IAAI,UAAU;CACd,IAAI,WAAW;;CAEf,IAAI,WAA6B,QAAQ,QAAQ;CACjD,IAAI,aAAa;CAEjB,eAAe,OAAO,KAA+B;EACjD,MAAM,UAAU,SAAS,IAAI,IAAI,IAAI;EAErC,IAAI,CAAC,SAAS;GAUV,OAAO,KAAK,0CAA0C,IAAI,KAAK,mCAAmC;GAClG,MAAM,MAAM,KACR,IAAI,IACJ,mCAAmC,IAAI,KAAK,IAC5C,IAAI,WAAW,IAAI,cAAc,IAAI,KAAK,KAAK,IAAI,IAAI,QAAQ,IAAI,QAAQ,CAAC,IAAI,IACpF;GACA;EACJ;EAEA,IAAI;GACA,MAAM,QAAQ;IACV,IAAI,IAAI;IACR,MAAM,IAAI;IACV,SAAS,IAAI;IACb,SAAS,IAAI;IACb,aAAa,IAAI;GACrB,CAAU;GACV,MAAM,MAAM,SAAS,IAAI,EAAE;EAC/B,SAAS,OAAO;GACZ,MAAM,UAAU,iBAAiB,QAAS,MAAM,SAAS,MAAM,UAAW,OAAO,KAAK;GACtF,MAAM,YAAY,IAAI,WAAW,IAAI;GAIrC,MAAM,MAAM,KAAK,IAAI,IAAI,QAAQ,MAAM,GAAG,GAAK,GAAG,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,QAAQ,IAAI,QAAQ,CAAC,IAAI,IAAI;GAEjH,IAAI,WACA,OAAO,KAAK,WAAW,IAAI,KAAK,sBAAsB,IAAI,SAAS,GAAG,IAAI,YAAY,aAAa,EAAE,OAAO,IAAI,GAAG,CAAC;QAKpH,OAAO,MAAM,WAAW,IAAI,KAAK,6BAA6B,IAAI,SAAS,YAAY;IAAE,OAAO,IAAI;IAAI,OAAO;GAAQ,CAAC;EAEhI;CACJ;CAEA,eAAe,OAAwB;EAEnC,MAAM,MAAM,KAAK,IAAI;EACrB,IAAI,MAAM,aAAa,sBAAsB,sBAAsB;GAC/D,aAAa;GACb,IAAI;IACA,MAAM,MAAM,YAAY,mBAAmB;GAC/C,SAAS,OAAO;IACZ,OAAO,MAAM,yCAAyC,EAAE,MAAM,CAAC;GACnE;EACJ;EAEA,MAAM,OAAO,MAAM,MAAM,MAAM,aAAa,QAAQ;EACpD,IAAI,KAAK,WAAW,GAAG,OAAO;EAI9B,MAAM,QAAQ,WAAW,KAAK,IAAI,MAAM,CAAC;EACzC,OAAO,KAAK;CAChB;CAEA,SAAS,SAAS,SAAuB;EACrC,IAAI,CAAC,SAAS;EACd,QAAQ,iBAAiB;GACrB,KAAU;EACd,GAAG,OAAO;EAGV,MAAM,QAAQ;CAClB;CAEA,eAAe,OAAsB;EACjC,IAAI,CAAC,SAAS;EACd,MAAM,QAAQ,YAAY;GACtB,IAAI;IACA,OAAO,MAAM,KAAK;GACtB,SAAS,OAAO;IACZ,OAAO,MAAM,sBAAsB,EAAE,MAAM,CAAC;IAC5C,OAAO;GACX;EACJ,EAAA,CAAG;EACH,WAAW;EAKX,SAAS,MAJW,QAIF,cAAc,IAAI,cAAc;CACtD;CAEA,OAAO;EACH,QAAc;GACV,IAAI,SAAS;GACb,UAAU;GACV,OAAO,KAAK,sCAAsC,YAAY,SAAS,eAAe,IAAI;GAC1F,SAAS,CAAC;EACd;EAEA,MAAM,OAAsB;GACxB,UAAU;GACV,IAAI,OAAO;IACP,aAAa,KAAK;IAClB,QAAQ;GACZ;GACA,IAAI,UAAU;GACd,WAAW;GAIX,MAAM,SAAS,YAAY,KAAA,CAAS;GACpC,WAAW;EACf;EAEA,UAA2B;GACvB,OAAO,KAAK;EAChB;EAEA,SAAsB,MAAc,SAA8B;GAC9D,IAAI,SAAS,IAAI,IAAI,GACjB,OAAO,KAAK,gBAAgB,KAAK,iDAAiD;GAEtF,SAAS,IAAI,MAAM,OAA4B;EACnD;EAEA,YAAqB;GACjB,OAAO;EACX;EAEA,MAAM,QAAqB,MAAc,SAAa,iBAAiC,CAAC,GAA2B;GAC/G,OAAO,MAAM,OAAO;IAChB;IACA,SAAS,WAAW;IACpB,OAAO,IAAI,KAAK,KAAK,IAAI,KAAK,eAAe,WAAW,EAAE;IAC1D,aAAa,eAAe,eAAe;IAC3C,gBAAgB,eAAe;GACnC,CAAC;EACL;CACJ;AACJ"}

package/dist/{jwt-CYGFT0ih.js → jwt-VJyXTdQQ.js}

@@ -4,7 +4,7 @@ __createRequire(import.meta.url);
 import { i as __toESM, n as __exportAll, r as __require, t as __commonJSMin } from "./rolldown-runtime-DSJWtz9O.js";
 import "./src-Cz9nMgUR.js";
 import { t as logger } from "./logger-DfvF_8r-.js";
-import { createHash, randomBytes } from "crypto";
+import { createHash, createPrivateKey, createPublicKey, randomBytes } from "crypto";
 import path from "node:path";
 //#region ../types/src/types/storage_source.ts
 /**
@@ -4019,7 +4019,7 @@ var require_sign = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	var isPlainObject = require_lodash_isplainobject();
 	var isString = require_lodash_isstring();
 	var once = require_lodash_once();
-	var { KeyObject, createSecretKey, createPrivateKey } = __require("crypto");
+	var { KeyObject, createSecretKey, createPrivateKey: createPrivateKey$1 } = __require("crypto");
 	var SUPPORTED_ALGS = [
 		"RS256",
 		"RS384",
@@ -4160,7 +4160,7 @@ var require_sign = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		}
 		if (!secretOrPrivateKey && options.algorithm !== "none") return failure(/* @__PURE__ */ new Error("secretOrPrivateKey must have a value"));
 		if (secretOrPrivateKey != null && !(secretOrPrivateKey instanceof KeyObject)) try {
-			secretOrPrivateKey = createPrivateKey(secretOrPrivateKey);
+			secretOrPrivateKey = createPrivateKey$1(secretOrPrivateKey);
 		} catch (_) {
 			try {
 				secretOrPrivateKey = createSecretKey(typeof secretOrPrivateKey === "string" ? Buffer.from(secretOrPrivateKey) : secretOrPrivateKey);
@@ -4415,6 +4415,111 @@ function canonicalStorageBucket(rawBucket) {
 	return rawBucket;
 }
 //#endregion
+//#region src/auth/jwt-keys.ts
+/**
+* The algorithm a key type implies.
+*
+* Rejecting anything else here rather than defaulting is deliberate: an Ed25519
+* key configured by someone expecting it to work would otherwise be signed with
+* `RS256` in the header and fail verification everywhere, at runtime, on tokens
+* already handed to users.
+*/
+function algorithmForKey(key, kid) {
+	switch (key.asymmetricKeyType) {
+		case "rsa":
+		case "rsa-pss": return "RS256";
+		case "ec": return "ES256";
+		default: throw new Error(`JWT signing key "${kid}" is a ${key.asymmetricKeyType ?? "non-asymmetric"} key. Supported: RSA (RS256) and EC P-256 (ES256). Generate one with: openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 -out jwt-key.pem`);
+	}
+}
+/**
+* An EC key of the wrong curve is the other way a key parses cleanly and then
+* fails to verify: `ES256` means P-256 specifically, and a P-384 key signs a
+* token whose header says P-256's algorithm.
+*/
+function assertCurveMatches(publicKey, kid) {
+	const jwk = publicKey.export({ format: "jwk" });
+	if (jwk.crv && jwk.crv !== "P-256") throw new Error(`JWT signing key "${kid}" uses curve ${jwk.crv}, but ES256 requires P-256. Generate one with: openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 -out jwt-key.pem`);
+}
+/**
+* Parse the configured keys, deriving each public half from its private key.
+*
+* Throws on anything malformed. This runs at boot, from `configureJwt`, so a
+* key that cannot sign takes the process down at start rather than at the first
+* login — the same bargain every other credential in this file makes.
+*/
+function resolveSigningKeys(configs) {
+	const seen = /* @__PURE__ */ new Set();
+	return configs.map((config) => {
+		if (!config.kid) throw new Error("Every JWT signing key needs a `kid`; it is what the JWKS and the token header agree on.");
+		if (seen.has(config.kid)) throw new Error(`Duplicate JWT signing key id "${config.kid}". A \`kid\` selects exactly one key at verification time, so two keys sharing one is a token that verifies or does not depending on order.`);
+		seen.add(config.kid);
+		let privateKey;
+		try {
+			privateKey = createPrivateKey(config.privateKey);
+		} catch (error) {
+			throw new Error(`JWT signing key "${config.kid}" is not a readable PEM private key: ${error instanceof Error ? error.message : String(error)}`);
+		}
+		const publicKey = createPublicKey(privateKey);
+		const derived = algorithmForKey(privateKey, config.kid);
+		const algorithm = config.algorithm ?? derived;
+		if (algorithm !== derived) throw new Error(`JWT signing key "${config.kid}" is declared as ${algorithm} but is a ${privateKey.asymmetricKeyType} key, which signs ${derived}.`);
+		if (algorithm === "ES256") assertCurveMatches(publicKey, config.kid);
+		return {
+			kid: config.kid,
+			algorithm,
+			privateKey,
+			publicKey
+		};
+	});
+}
+/**
+* The key a token names, or `null` if it names none we hold.
+*
+* The returned algorithm is the *key's*, and the caller must verify with that
+* one alone. See the module docblock for what happens otherwise.
+*/
+function resolveVerificationKey(keys, kid) {
+	if (!kid) return null;
+	return keys.find((key) => key.kid === kid) ?? null;
+}
+/**
+* A PEM as an environment variable can actually carry it.
+*
+* A PEM is multi-line and environment variables are not, so every deployment
+* tool solves it differently: `.env` files and most secret managers escape the
+* newlines to `\n`, Kubernetes and Docker secrets pass the bytes through
+* intact, and CI systems that mangle both are usually fed base64. All three
+* arrive here, and guessing wrong produces "not a readable PEM private key" at
+* boot with a key the operator can see is perfectly valid.
+*
+* Detection is on content, not on a flag: a PEM says so on its first line, and
+* anything that does not is tried as base64.
+*/
+function normalizePemFromEnv(value) {
+	const trimmed = value.trim();
+	if (trimmed.includes("-----BEGIN")) return trimmed.replace(/\\n/g, "\n");
+	return Buffer.from(trimmed, "base64").toString("utf8");
+}
+/**
+* The public halves, in JWKS form.
+*
+* Node exports a JWK containing only public parameters for a public
+* `KeyObject` — no `d`, no primes — so the private material cannot leak
+* through this path even if a private key were passed by mistake. The keys are
+* derived from `publicKey` regardless, and this is asserted in the tests,
+* because "cannot" is worth checking on the one endpoint whose entire job is to
+* be world-readable.
+*/
+function toJwks(keys) {
+	return { keys: keys.map((key) => ({
+		...key.publicKey.export({ format: "jwk" }),
+		kid: key.kid,
+		alg: key.algorithm,
+		use: "sig"
+	})) };
+}
+//#endregion
 //#region src/auth/jwt.ts
 var jwt_exports = /* @__PURE__ */ __exportAll({
 	MAX_COOKIE_AGE_MS: () => MAX_COOKIE_AGE_MS,
@@ -4426,8 +4531,10 @@ var jwt_exports = /* @__PURE__ */ __exportAll({
 	generateRefreshToken: () => generateRefreshToken,
 	getAccessTokenExpiry: () => getAccessTokenExpiry,
 	getAccessTokenExpiryMs: () => getAccessTokenExpiryMs,
+	getJwks: () => getJwks,
 	getRefreshTokenExpiry: () => getRefreshTokenExpiry,
 	getRefreshTokenTtlMs: () => getRefreshTokenTtlMs,
+	hasAsymmetricSigningKey: () => hasAsymmetricSigningKey,
 	hashRefreshToken: () => hashRefreshToken,
 	isJwtConfigured: () => isJwtConfigured,
 	verifyAccessToken: () => verifyAccessToken,
@@ -4440,6 +4547,15 @@ var jwtConfig = {
 	refreshExpiresIn: "400d"
 };
 /**
+* The parsed signing keys, and which one mints new access tokens.
+*
+* Both are module state beside `jwtConfig` for the same reason it is: every
+* signing and verifying path in the server reads them through this file, and
+* there is exactly one JWT configuration per process.
+*/
+var signingKeys = [];
+var activeSigningKey = null;
+/**
 * Configure JWT settings - call this during initialization.
 * Validates the secret strength to prevent deployment with default/weak secrets.
 */
@@ -4467,10 +4583,33 @@ function configureJwt(config) {
 	]);
 	if (!config.secret || config.secret.length < 32) throw new Error("JWT secret is too short. Must be at least 32 characters. Generate one with: node -e \"logger.info(require('crypto').randomBytes(48).toString('base64'))\"");
 	if (weakSecrets.has(config.secret.toLowerCase())) throw new Error("JWT secret is a known default/weak value. Please use a strong, randomly generated secret. Generate one with: node -e \"logger.info(require('crypto').randomBytes(48).toString('base64'))\"");
+	const resolved = config.signingKeys ? resolveSigningKeys(config.signingKeys) : [];
+	let active = null;
+	if (resolved.length > 0) if (config.activeKid) {
+		active = resolved.find((key) => key.kid === config.activeKid) ?? null;
+		if (!active) throw new Error(`auth.activeKid is "${config.activeKid}", which is not among the configured signing keys (${resolved.map((k) => `"${k.kid}"`).join(", ")}). Signing with a key nobody published produces tokens no verifier can check.`);
+	} else active = resolved[0];
 	jwtConfig = {
 		...jwtConfig,
 		...config
 	};
+	signingKeys = resolved;
+	activeSigningKey = active;
+}
+/**
+* The public keys, in JWKS form, for `/.well-known/jwks.json`.
+*
+* An empty `keys` array on a backend with no asymmetric keys configured is the
+* correct answer rather than a 404: it says "this issuer publishes none",
+* which a verifier can act on, where a 404 is indistinguishable from a
+* misconfigured URL.
+*/
+function getJwks() {
+	return toJwks(signingKeys);
+}
+/** Is this backend signing access tokens asymmetrically? */
+function hasAsymmetricSigningKey() {
+	return activeSigningKey !== null;
 }
 /**
 * Has this server been given a JWT secret?
@@ -4497,6 +4636,11 @@ function generateAccessToken(uid, roles, aal = "aal1", customClaims) {
 		...customClaims,
 		aal
 	};
+	if (activeSigningKey) return import_jsonwebtoken.default.sign(payload, activeSigningKey.privateKey, {
+		expiresIn: jwtConfig.accessExpiresIn,
+		algorithm: activeSigningKey.algorithm,
+		keyid: activeSigningKey.kid
+	});
 	return import_jsonwebtoken.default.sign(payload, jwtConfig.secret, {
 		expiresIn: jwtConfig.accessExpiresIn,
 		algorithm: "HS256"
@@ -4540,7 +4684,9 @@ function getAccessTokenExpiry() {
 function verifyAccessToken(token) {
 	if (!jwtConfig.secret) throw new Error("JWT secret not configured. Call configureJwt() first.");
 	try {
-		const decoded = import_jsonwebtoken.default.verify(token, jwtConfig.secret, { algorithms: ["HS256"] });
+		const header = import_jsonwebtoken.default.decode(token, { complete: true })?.header;
+		const namedKey = resolveVerificationKey(signingKeys, header?.kid);
+		const decoded = namedKey ? import_jsonwebtoken.default.verify(token, namedKey.publicKey, { algorithms: [namedKey.algorithm] }) : import_jsonwebtoken.default.verify(token, jwtConfig.secret, { algorithms: ["HS256"] });
 		if (decoded.purpose) {
 			logger.error("[JWT] Verification failed: a purpose-scoped token is not an access token", { purpose: decoded.purpose });
 			return null;
@@ -4712,6 +4858,6 @@ function verifyDownloadToken(token) {
 	}
 }
 //#endregion
-export { DEFAULT_STORAGE_SOURCE_KEY as C, storageEnvSuffix as E, require_jsonwebtoken as S, normalizeStorageSources as T, InvalidStorageKeyError as _, generateMfaPendingToken as a, canonicalStorageKey as b, getRefreshTokenExpiry as c, isJwtConfigured as d, jwt_exports as f, InvalidStorageBucketError as g, verifyMfaPendingToken as h, generateDownloadToken as i, getRefreshTokenTtlMs as l, verifyDownloadToken as m, configureJwt as n, generateRefreshToken as o, verifyAccessToken as p, generateAccessToken as r, getAccessTokenExpiry as s, MAX_COOKIE_AGE_MS as t, hashRefreshToken as u, canonicalStorageBucket as v, findStorageSuffixCollision as w, tryCanonicalStorageKey as x, canonicalStorageId as y };
+export { canonicalStorageKey as C, findStorageSuffixCollision as D, DEFAULT_STORAGE_SOURCE_KEY as E, normalizeStorageSources as O, canonicalStorageId as S, require_jsonwebtoken as T, verifyMfaPendingToken as _, generateMfaPendingToken as a, InvalidStorageKeyError as b, getJwks as c, hasAsymmetricSigningKey as d, hashRefreshToken as f, verifyDownloadToken as g, verifyAccessToken as h, generateDownloadToken as i, storageEnvSuffix as k, getRefreshTokenExpiry as l, jwt_exports as m, configureJwt as n, generateRefreshToken as o, isJwtConfigured as p, generateAccessToken as r, getAccessTokenExpiry as s, MAX_COOKIE_AGE_MS as t, getRefreshTokenTtlMs as u, normalizePemFromEnv as v, tryCanonicalStorageKey as w, canonicalStorageBucket as x, InvalidStorageBucketError as y };
 
-//# sourceMappingURL=jwt-CYGFT0ih.js.map
+//# sourceMappingURL=jwt-VJyXTdQQ.js.map