@rebasepro/server 0.21.2-canary.g1ea48be → 0.22.0

package/dist/init/global-callbacks.d.ts

@@ -0,0 +1,21 @@
+import type { CollectionCallbacks, InitializedDriver } from "@rebasepro/types";
+/**
+ * Hand the backend's global callbacks to one driver.
+ *
+ * `initializeRebaseBackend({ callbacks })` is declared once, on the backend,
+ * but no driver resolves callbacks from the backend's `collectionRegistry`:
+ * each builds a registry of its own in `initializeDriver` and reads global
+ * callbacks from that. So they are given to each driver here, by the
+ * coordinator, rather than left for every driver to remember to ask for.
+ *
+ * Refuses rather than skipping, in two cases.
+ *
+ * - **A registry that cannot take them.** Every collection that driver serves
+ *   would run with the global hooks off, an `afterRead` that masks PII among
+ *   them, and nothing would say so.
+ * - **A global `beforeQuery` on a driver that does not compile one.** Only
+ *   `@rebasepro/server-postgres` narrows a read before running it. Anywhere
+ *   else the hook is a row filter that filters nothing, which is the refusal
+ *   `assertBeforeQueryIsPostgresOnly` makes for a collection's own hook.
+ */
+export declare function handGlobalCallbacksTo(driverId: string, engine: string, driverResult: InitializedDriver, callbacks: CollectionCallbacks): void;

package/dist/{jobs-2fO2BI8P.js → jobs-Bjr8DZAi.js}

@@ -3,7 +3,7 @@ import __rebaseProcess from "process";
 globalThis.process ??= __rebaseProcess;
 __rebaseCreateRequire(import.meta.url);
 import { n as __exportAll } from "./rolldown-runtime-dW7B1o5h.js";
-import { N as REBASE_USER_ROLE, P as revokeInternalTableSql } from "./src-BYax9_rm.js";
+import { F as revokeInternalTableSql, P as REBASE_USER_ROLE } from "./src-1vL-I1Po.js";
 import "./src-Br6ARbs6.js";
 import { n as createDdlBootstrapper, o as isSQLAdmin, r as hasInCauseChain } from "./ddl-bootstrap-CfNvxMuK.js";
 import { n as sqlRows, t as firstSqlRow } from "./sql-rows-C6GEc2oE.js";
@@ -394,4 +394,4 @@ var jobs_exports = /* @__PURE__ */ __exportAll({
 //#endregion
 export { currentAmbientTransaction as a, createJobStore as i, createJobQueue as n, defaultBackoff as r, jobs_exports as t };
 
-//# sourceMappingURL=jobs-2fO2BI8P.js.map
+//# sourceMappingURL=jobs-Bjr8DZAi.js.map

package/dist/{jobs-2fO2BI8P.js.map → jobs-Bjr8DZAi.js.map}

@@ -1 +1 @@
-{"version":3,"file":"jobs-2fO2BI8P.js","names":[],"sources":["../src/db/ambient-transaction.ts","../src/jobs/job-store.ts","../src/jobs/job-queue.ts","../src/jobs/index.ts"],"sourcesContent":["/**\n * The write transaction the current code is running inside, when there is one.\n *\n * A collection callback runs inside the transaction that carries its write.\n * Work it hands off — a job, a queue message, a topic event, a webhook\n * delivery — has to share that write's fate: queued when it commits, never\n * queued when it rolls back, and invisible to a worker until the commit. The\n * code that queues it lives in this package and knows no driver; the\n * transaction belongs to the driver. So the driver publishes the transaction it\n * opened for a write, and the queueing code asks for it here.\n *\n * Until this existed the job store wrote through the default driver's own\n * connection, in autocommit, whatever called it. A job enqueued from an\n * `afterSave` that then threw stayed queued for a row that was never written,\n * and a worker could claim it before the row it was about committed.\n *\n * The resolver lives on `globalThis` under a registered symbol, like the\n * `rebase` singleton: a managed runtime can load two copies of this package,\n * and the copy a driver registers with must be the one the job store reads.\n * No Node imports — the store is reachable from code that has to stay portable.\n *\n * **The symbol's key is a contract between packages, and frozen.** The\n * Postgres driver writes the slot itself rather than importing a setter from\n * here: the managed runtime supplies this package from the image while a\n * bundle brings its own driver, and a driver importing a function an older\n * image does not export would fail to link and take the boot down. Written\n * through the slot, any pairing of versions degrades to the old behaviour —\n * jobs committing on their own — instead.\n */\nexport interface AmbientTransaction {\n    /**\n     * Run one statement on the transaction, `$1…` placeholders as\n     * `executeSql` takes them. It runs as the transaction's current role — on\n     * Postgres the request's restricted one — so a statement that needs more\n     * goes through a function granted to that role.\n     */\n    exec(sqlText: string, params?: unknown[]): Promise<Record<string, unknown>[]>;\n    /** Run `fn` after the transaction commits. Never runs if it rolls back. */\n    afterCommit(fn: () => void): void;\n}\n\n/** Frozen — see above. `server-postgres/src/services/write-transaction-scope.ts` writes it. */\nconst RESOLVER_SLOT = Symbol.for(\"rebase.server.ambientTransactionResolver\");\n\ntype ResolverSlot = { [RESOLVER_SLOT]?: () => AmbientTransaction | undefined };\n\n/**\n * Register how to find the write transaction the caller is inside; pass\n * `undefined` to unregister. For tests and for drivers in this repository's\n * lockstep — a driver shipped separately writes the slot, as above.\n */\nexport function setAmbientTransactionResolver(resolve: (() => AmbientTransaction | undefined) | undefined): void {\n    (globalThis as ResolverSlot)[RESOLVER_SLOT] = resolve;\n}\n\n/** The write transaction the caller is inside, or `undefined` outside one. */\nexport function currentAmbientTransaction(): AmbientTransaction | undefined {\n    return (globalThis as ResolverSlot)[RESOLVER_SLOT]?.();\n}\n","import type { DataDriver } from \"@rebasepro/types\";\nimport { isSQLAdmin } from \"@rebasepro/types\";\nimport { REBASE_USER_ROLE, revokeInternalTableSql, sqlRows, firstSqlRow } from \"@rebasepro/common\";\nimport { logger } from \"../utils/logger.js\";\nimport { createDdlBootstrapper, hasInCauseChain, type SqlExec } from \"../boot/ddl-bootstrap.js\";\nimport { currentAmbientTransaction } from \"../db/ambient-transaction.js\";\nimport type { JobRecord } from \"./types.js\";\n\n/**\n * The queue's storage, as SQL against `rebase.jobs`.\n *\n * Split from the worker for the same reason `cron-store` is split from\n * `cron-scheduler`: the interesting parts here are three statements that have\n * to be exactly right under concurrency, and they are much easier to reason\n * about — and to test — away from a polling loop.\n */\n\nconst TABLE = \"rebase.jobs\";\n\n/** How long finished jobs are kept before the boot sweep removes them. */\nconst SUCCEEDED_RETENTION_DAYS = 3;\n/**\n * Failures outlive successes by a lot. A dead-lettered job is evidence, and the\n * person who needs it is usually looking on Monday for something that happened\n * on Friday night.\n */\nconst FAILED_RETENTION_DAYS = 30;\n\n/** A row as Postgres returns it. */\ninterface JobRow {\n    id: string;\n    task: string;\n    payload: unknown;\n    status: string;\n    run_at: string;\n    attempts: number;\n    max_attempts: number;\n    last_error: string | null;\n    created_at: string;\n    updated_at: string;\n}\n\nfunction toRecord(row: JobRow): JobRecord {\n    return {\n        id: row.id,\n        task: row.task,\n        payload: row.payload,\n        status: row.status as JobRecord[\"status\"],\n        runAt: new Date(row.run_at).toISOString(),\n        attempts: Number(row.attempts),\n        maxAttempts: Number(row.max_attempts),\n        lastError: row.last_error,\n        createdAt: new Date(row.created_at).toISOString(),\n        updatedAt: new Date(row.updated_at).toISOString()\n    };\n}\n\n/** Same rule as `cron-store`: match the SQLSTATE, never the message. */\nfunction isUniqueViolation(err: unknown): boolean {\n    return hasInCauseChain(err, (e) => e.code === \"23505\");\n}\n\n/**\n * How a job gets into `rebase.jobs` from inside somebody else's transaction.\n *\n * An enqueue from a collection callback has to ride the write's transaction —\n * committed with it, discarded with it, invisible to workers until then — and\n * that transaction runs as the request's restricted role, which has no access\n * to `rebase.jobs` at all (see the revoke in `ensureTable`). This function is\n * the one door: `SECURITY DEFINER`, so the insert runs with the owner's rights\n * for that one statement and the transaction's role never changes. Switching\n * the role for the insert instead would elevate the whole connection for as\n * long as the insert took, and a callback's un-awaited statement would run\n * in that window as the owner.\n *\n * The door is narrow on purpose. It takes the five columns an enqueue sets and\n * nothing else, so it cannot claim, complete or rewrite a job — and only the\n * request role is granted it, not PUBLIC. That role runs statements the server\n * writes; nobody outside gets SQL as it.\n *\n * `ON CONFLICT DO NOTHING` rather than a caught unique violation: an error\n * inside a transaction aborts the whole transaction, so an idempotency clash\n * would have failed the customer's write. A clash returns no row, hence NULL.\n */\nconst ENQUEUE_FUNCTION = \"rebase.enqueue_job\";\nconst ENQUEUE_SIGNATURE = `${ENQUEUE_FUNCTION}(text, jsonb, timestamptz, integer, text)`;\n\nexport interface JobStore {\n    ensureTable(): Promise<void>;\n    /** Returns the new job's id, or `null` if an idempotency key matched unfinished work. */\n    insert(job: {\n        task: string;\n        payload: unknown;\n        runAt: Date;\n        maxAttempts: number;\n        idempotencyKey?: string;\n    }): Promise<string | null>;\n    /** Atomically take up to `limit` runnable jobs for this worker. */\n    claim(limit: number, workerId: string): Promise<JobRecord[]>;\n    complete(id: string): Promise<void>;\n    /** Back to `pending` with a later `runAt`, or `failed` when out of attempts. */\n    fail(id: string, error: string, retryAt: Date | null): Promise<void>;\n    /** Return jobs stranded by a worker that died holding them. Resolves with how many. */\n    reapExpired(visibilityTimeoutMs: number): Promise<number>;\n    fetch(id: string): Promise<JobRecord | null>;\n}\n\nexport function createJobStore(driver: DataDriver): JobStore | undefined {\n    const admin = driver.admin;\n    if (!isSQLAdmin(admin)) {\n        logger.warn(\n            \"⚠️ [jobs] DataDriver does not support SQL admin — the durable job queue is unavailable. \" +\n            \"Work that would have been queued runs inline instead.\"\n        );\n        return undefined;\n    }\n\n    // Two shapes of the same call: the bootstrapper's `SqlExec` takes an\n    // options object, while everything below reads better with a positional\n    // parameter array.\n    const execRaw: SqlExec = (sqlText, options) =>\n        admin.executeSql(sqlText, options?.params ? { params: options.params } : undefined);\n    const exec = (sqlText: string, params?: unknown[]) =>\n        execRaw(sqlText, params ? { params } : undefined);\n\n    const ddl = createDdlBootstrapper(execRaw, \"jobs\");\n\n    /**\n     * Whether {@link ENQUEUE_FUNCTION} exists, so an enqueue inside a write can\n     * ride its transaction. Decided at boot rather than assumed: a database\n     * that refused the function would otherwise fail every write whose callback\n     * enqueues, where falling back to the old behaviour only loses atomicity.\n     */\n    let enqueueInTransaction = false;\n\n    return {\n        async ensureTable(): Promise<void> {\n            await ddl.ensureObject(\"Creating schema rebase\", \"CREATE SCHEMA IF NOT EXISTS rebase\");\n\n            await ddl.ensureObject(`Creating ${TABLE}`, `\n                CREATE TABLE IF NOT EXISTS ${TABLE} (\n                    id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,\n                    task TEXT NOT NULL,\n                    payload JSONB,\n                    status TEXT NOT NULL DEFAULT 'pending',\n                    run_at TIMESTAMPTZ NOT NULL DEFAULT now(),\n                    attempts INTEGER NOT NULL DEFAULT 0,\n                    max_attempts INTEGER NOT NULL DEFAULT 3,\n                    locked_at TIMESTAMPTZ,\n                    locked_by TEXT,\n                    idempotency_key TEXT,\n                    last_error TEXT,\n                    created_at TIMESTAMPTZ NOT NULL DEFAULT now(),\n                    updated_at TIMESTAMPTZ NOT NULL DEFAULT now()\n                )\n            `);\n\n            // The claim query's index. Partial, because the rows it has to find\n            // fast are a shrinking minority of a table that also holds every\n            // success and every dead letter.\n            await ddl.ensureObject(\"Creating idx_jobs_runnable\", `\n                CREATE INDEX IF NOT EXISTS idx_jobs_runnable\n                ON ${TABLE}(run_at, created_at)\n                WHERE status = 'pending'\n            `);\n\n            // Finds jobs stranded by a dead worker.\n            await ddl.ensureObject(\"Creating idx_jobs_running\", `\n                CREATE INDEX IF NOT EXISTS idx_jobs_running\n                ON ${TABLE}(locked_at)\n                WHERE status = 'running'\n            `);\n\n            // What makes `idempotencyKey` a guarantee rather than a\n            // check-then-act race: two instances reacting to one event both\n            // reach the INSERT, and the index decides. Partial on unfinished\n            // work — see `EnqueueOptions.idempotencyKey` for why a key must be\n            // reusable once its job is done.\n            await ddl.ensureObject(\"Creating idx_jobs_idempotency\", `\n                CREATE UNIQUE INDEX IF NOT EXISTS idx_jobs_idempotency\n                ON ${TABLE}(idempotency_key)\n                WHERE idempotency_key IS NOT NULL AND status IN ('pending', 'running')\n            `);\n\n            const ready = await ddl.isReadable(TABLE);\n\n            if (ready) {\n                await ddl.step(\"Job retention sweep\", async () => {\n                    await exec(\n                        `DELETE FROM ${TABLE}\n                         WHERE (status = 'succeeded' AND updated_at < now() - make_interval(days => $1))\n                            OR (status = 'failed'    AND updated_at < now() - make_interval(days => $2))`,\n                        [SUCCEEDED_RETENTION_DAYS, FAILED_RETENTION_DAYS]\n                    );\n                });\n\n                // Payloads are arbitrary application data — a webhook body, a\n                // user id, whatever was passed — and a writable queue lets any\n                // signed-in user schedule work of their choosing under the\n                // server's own authority. Same reasoning, and the same\n                // unconditional re-application, as `cron_claims`.\n                await ddl.step(\"Revoking end-user access to jobs\", () =>\n                    exec(revokeInternalTableSql(\"rebase\", \"jobs\")));\n\n                await ddl.ensureObject(`Creating ${ENQUEUE_FUNCTION}`, `\n                    CREATE OR REPLACE FUNCTION ${ENQUEUE_FUNCTION}(\n                        p_task text, p_payload jsonb, p_run_at timestamptz,\n                        p_max_attempts integer, p_idempotency_key text\n                    ) RETURNS text\n                    LANGUAGE sql\n                    SECURITY DEFINER\n                    SET search_path = pg_catalog, pg_temp\n                    AS $fn$\n                        INSERT INTO ${TABLE} (task, payload, run_at, max_attempts, idempotency_key)\n                        VALUES (p_task, p_payload, p_run_at, p_max_attempts, p_idempotency_key)\n                        ON CONFLICT DO NOTHING\n                        RETURNING id\n                    $fn$\n                `);\n                // Re-applied every boot: a new function is executable by PUBLIC\n                // until told otherwise, and the request role may be provisioned\n                // after the function was first made.\n                await ddl.step(`Granting ${ENQUEUE_FUNCTION} to the request role`, async () => {\n                    await exec(`REVOKE ALL ON FUNCTION ${ENQUEUE_SIGNATURE} FROM PUBLIC`);\n                    await exec(`\n                        DO $grant$ BEGIN\n                            IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = '${REBASE_USER_ROLE}') THEN\n                                GRANT EXECUTE ON FUNCTION ${ENQUEUE_SIGNATURE} TO ${REBASE_USER_ROLE};\n                            END IF;\n                        END $grant$\n                    `);\n                });\n                enqueueInTransaction = firstSqlRow<{ present: boolean }>(await exec(\n                    `SELECT to_regprocedure('${ENQUEUE_SIGNATURE}') IS NOT NULL AS present`\n                ))?.present === true;\n                if (!enqueueInTransaction) {\n                    logger.warn(\n                        `⚠️ [jobs] ${ENQUEUE_FUNCTION} could not be created, so a job enqueued inside a write ` +\n                        \"commits on its own: it stays queued if the write rolls back.\"\n                    );\n                }\n\n                logger.info(\"✅ Job queue table ready\");\n            } else {\n                logger.error(\n                    `❌ [jobs] ${TABLE} is unavailable — nothing can be queued and nothing queued earlier ` +\n                    \"will run. Callers fall back to running the work inline.\"\n                );\n            }\n        },\n\n        async insert(job): Promise<string | null> {\n            const params = [\n                job.task,\n                JSON.stringify(job.payload ?? null),\n                job.runAt.toISOString(),\n                job.maxAttempts,\n                job.idempotencyKey ?? null\n            ];\n            // Inside a write: on its transaction, through the definer function\n            // — see `ENQUEUE_FUNCTION`. Checked and used with no `await`\n            // between, so the transaction cannot close in the gap.\n            const ambient = enqueueInTransaction ? currentAmbientTransaction() : undefined;\n            if (ambient) {\n                const rows = await ambient.exec(\n                    `SELECT ${ENQUEUE_FUNCTION}($1::text, $2::jsonb, $3::timestamptz, $4::integer, $5::text) AS id`,\n                    params\n                );\n                return (rows?.[0]?.id as string | null | undefined) ?? null;\n            }\n            try {\n                const rows = await exec(\n                    `INSERT INTO ${TABLE} (task, payload, run_at, max_attempts, idempotency_key)\n                     VALUES ($1, $2::jsonb, $3, $4, $5)\n                     RETURNING id`,\n                    params\n                );\n                return (rows?.[0]?.id as string) ?? null;\n            } catch (error) {\n                // The losing side of an idempotency race. Not an error: the\n                // work the caller wanted is already queued, which is the\n                // outcome they asked for.\n                if (isUniqueViolation(error)) return null;\n                throw error;\n            }\n        },\n\n        async claim(limit: number, workerId: string): Promise<JobRecord[]> {\n            // `FOR UPDATE SKIP LOCKED` is the whole design. The inner select\n            // takes row locks on the jobs it picks and *skips* any a concurrent\n            // worker already holds, so N workers polling the same table divide\n            // the work instead of contending for the head of it — and no job is\n            // ever handed to two of them.\n            //\n            // `attempts` is incremented here, on claim, rather than on failure.\n            // A worker that is killed mid-job never reports anything, so\n            // counting on failure would let a job that crashes the process be\n            // retried forever, once per restart, taking the process down each\n            // time.\n            const rows = await exec(\n                `UPDATE ${TABLE} SET\n                    status = 'running',\n                    attempts = attempts + 1,\n                    locked_at = now(),\n                    locked_by = $2,\n                    updated_at = now()\n                 WHERE id IN (\n                     SELECT id FROM ${TABLE}\n                     WHERE status = 'pending' AND run_at <= now()\n                     ORDER BY run_at, created_at\n                     LIMIT $1\n                     FOR UPDATE SKIP LOCKED\n                 )\n                 RETURNING *`,\n                [limit, workerId]\n            );\n            return sqlRows<JobRow>(rows).map(toRecord);\n        },\n\n        async complete(id: string): Promise<void> {\n            await exec(\n                `UPDATE ${TABLE} SET status = 'succeeded', locked_at = NULL, locked_by = NULL,\n                        last_error = NULL, updated_at = now()\n                 WHERE id = $1`,\n                [id]\n            );\n        },\n\n        async fail(id: string, error: string, retryAt: Date | null): Promise<void> {\n            if (retryAt) {\n                await exec(\n                    `UPDATE ${TABLE} SET status = 'pending', run_at = $2, locked_at = NULL,\n                            locked_by = NULL, last_error = $3, updated_at = now()\n                     WHERE id = $1`,\n                    [id, retryAt.toISOString(), error]\n                );\n                return;\n            }\n            await exec(\n                `UPDATE ${TABLE} SET status = 'failed', locked_at = NULL, locked_by = NULL,\n                        last_error = $2, updated_at = now()\n                 WHERE id = $1`,\n                [id, error]\n            );\n        },\n\n        async reapExpired(visibilityTimeoutMs: number): Promise<number> {\n            // A worker killed while holding a job cannot release it, so nothing\n            // but a timeout will ever free the row. Jobs that still have\n            // attempts left go back to `pending`; the rest are dead-lettered\n            // with an error that says what happened, because \"attempts: 3,\n            // lastError: null\" is otherwise a genuinely baffling row to find.\n            const seconds = Math.max(1, Math.round(visibilityTimeoutMs / 1000));\n\n            const revived = await exec(\n                `UPDATE ${TABLE} SET status = 'pending', locked_at = NULL, locked_by = NULL,\n                        last_error = 'Worker stopped responding; the job was reclaimed', updated_at = now()\n                 WHERE status = 'running'\n                   AND locked_at < now() - make_interval(secs => $1)\n                   AND attempts < max_attempts\n                 RETURNING id`,\n                [seconds]\n            );\n\n            const buried = await exec(\n                `UPDATE ${TABLE} SET status = 'failed', locked_at = NULL, locked_by = NULL,\n                        last_error = 'Worker stopped responding on the final attempt', updated_at = now()\n                 WHERE status = 'running'\n                   AND locked_at < now() - make_interval(secs => $1)\n                   AND attempts >= max_attempts\n                 RETURNING id`,\n                [seconds]\n            );\n\n            const count = (revived?.length ?? 0) + (buried?.length ?? 0);\n            if (count > 0) {\n                logger.warn(\n                    `[jobs] Reclaimed ${count} job(s) from a worker that stopped responding ` +\n                    `(${revived?.length ?? 0} retryable, ${buried?.length ?? 0} dead-lettered)`\n                );\n            }\n            return count;\n        },\n\n        async fetch(id: string): Promise<JobRecord | null> {\n            const rows = await exec(`SELECT * FROM ${TABLE} WHERE id = $1`, [id]);\n            const row = firstSqlRow<JobRow>(rows);\n            return row ? toRecord(row) : null;\n        }\n    };\n}\n","import { randomUUID } from \"crypto\";\nimport { logger } from \"../utils/logger.js\";\nimport type { JobStore } from \"./job-store.js\";\nimport type { EnqueueOptions, JobHandler, JobQueueClient, JobQueueOptions, JobRecord } from \"./types.js\";\n\n/**\n * The worker: claim, run, record, repeat.\n *\n * Everything difficult about running jobs concurrently is in `job-store.ts`,\n * where one `UPDATE … FOR UPDATE SKIP LOCKED` does the arbitration. What is\n * left here is a loop and the decisions around a handler that throws.\n */\n\nconst DEFAULT_CONCURRENCY = 5;\nconst DEFAULT_POLL_INTERVAL_MS = 2_000;\nconst DEFAULT_VISIBILITY_TIMEOUT_MS = 5 * 60_000;\nconst DEFAULT_MAX_ATTEMPTS = 3;\n\n/** 1s, 5s, 25s, 125s … capped at an hour. */\nexport function defaultBackoff(attempt: number): number {\n    return Math.min(1_000 * Math.pow(5, Math.max(0, attempt - 1)), 60 * 60_000);\n}\n\n/**\n * How often the reaper runs, relative to the visibility timeout.\n *\n * A quarter of it, so a stranded job waits at most 1.25× the timeout rather\n * than 2× — and so the sweep is not itself a per-poll query against a table\n * whose interesting rows are, almost always, none.\n */\nconst REAP_INTERVAL_FACTOR = 0.25;\n\nexport interface JobQueue extends JobQueueClient {\n    start(): void;\n    stop(): Promise<void>;\n    /** Run one poll's worth of work and return how many jobs ran. For tests and for `/jobs/drain`. */\n    runOnce(): Promise<number>;\n    /** Registered after construction — how `tasks` from config and internal producers meet. */\n    register<P = unknown>(task: string, handler: JobHandler<P>): void;\n    isRunning(): boolean;\n}\n\nexport function createJobQueue(store: JobStore, options: JobQueueOptions = {}): JobQueue {\n    const concurrency = options.concurrency ?? DEFAULT_CONCURRENCY;\n    const pollIntervalMs = options.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;\n    const visibilityTimeoutMs = options.visibilityTimeoutMs ?? DEFAULT_VISIBILITY_TIMEOUT_MS;\n    const defaultMaxAttempts = options.maxAttempts ?? DEFAULT_MAX_ATTEMPTS;\n    const backoff = options.backoff ?? defaultBackoff;\n\n    const handlers = new Map<string, JobHandler<never>>();\n    for (const [task, handler] of Object.entries(options.tasks ?? {})) {\n        handlers.set(task, handler);\n    }\n\n    // Identifies this process in `locked_by`. Purely diagnostic — the claim is\n    // enforced by the row lock, not by this — but \"which pod had it when it\n    // stopped\" is the first question anyone asks of a stuck job.\n    const workerId = `${process.pid}-${randomUUID().slice(0, 8)}`;\n\n    let timer: NodeJS.Timeout | null = null;\n    let running = false;\n    let draining = false;\n    /** Resolves when the in-flight poll finishes, so `stop()` can wait for it. */\n    let inFlight: Promise<unknown> = Promise.resolve();\n    let lastReapAt = 0;\n\n    async function runJob(job: JobRecord): Promise<void> {\n        const handler = handlers.get(job.task);\n\n        if (!handler) {\n            // Not a failure. A rolling deploy runs old and new code at once, and\n            // an instance that has not been updated yet must not burn the\n            // attempts of a job belonging to one that has. Give the row back\n            // and let a peer — or this process after its next deploy — take it.\n            //\n            // The attempt increment from the claim is deliberately not undone:\n            // a task nobody in the fleet implements would otherwise cycle\n            // forever, and this way it dead-letters after `maxAttempts` with an\n            // error naming the task.\n            logger.warn(`[jobs] No handler registered for task \"${job.task}\" — returning the job to the queue`);\n            await store.fail(\n                job.id,\n                `No handler registered for task \"${job.task}\"`,\n                job.attempts < job.maxAttempts ? new Date(Date.now() + backoff(job.attempts)) : null\n            );\n            return;\n        }\n\n        try {\n            await handler({\n                id: job.id,\n                task: job.task,\n                payload: job.payload as never,\n                attempt: job.attempts,\n                maxAttempts: job.maxAttempts\n            } as never);\n            await store.complete(job.id);\n        } catch (error) {\n            const message = error instanceof Error ? (error.stack ?? error.message) : String(error);\n            const willRetry = job.attempts < job.maxAttempts;\n\n            // Truncated, because `last_error` holds a stack and a queue that\n            // accumulates megabytes of them is its own outage.\n            await store.fail(job.id, message.slice(0, 4_000), willRetry ? new Date(Date.now() + backoff(job.attempts)) : null);\n\n            if (willRetry) {\n                logger.warn(`[jobs] \"${job.task}\" failed on attempt ${job.attempts}/${job.maxAttempts}; retrying`, { jobId: job.id });\n            } else {\n                // The last attempt is an error, not a warning: nothing else will\n                // touch this job, and if nobody looks at the table it is simply\n                // lost work.\n                logger.error(`[jobs] \"${job.task}\" failed permanently after ${job.attempts} attempts`, { jobId: job.id, error: message });\n            }\n        }\n    }\n\n    async function poll(): Promise<number> {\n        // The reaper, on its own cadence.\n        const now = Date.now();\n        if (now - lastReapAt > visibilityTimeoutMs * REAP_INTERVAL_FACTOR) {\n            lastReapAt = now;\n            try {\n                await store.reapExpired(visibilityTimeoutMs);\n            } catch (error) {\n                logger.error(\"[jobs] Failed to reclaim expired jobs\", { error });\n            }\n        }\n\n        const jobs = await store.claim(concurrency, workerId);\n        if (jobs.length === 0) return 0;\n\n        // Settled, not `all`: `runJob` handles its own errors, but a store\n        // write failing inside it must not abandon this batch's siblings.\n        await Promise.allSettled(jobs.map(runJob));\n        return jobs.length;\n    }\n\n    function schedule(delayMs: number): void {\n        if (!running) return;\n        timer = setTimeout(() => {\n            void tick();\n        }, delayMs);\n        // Never hold the process open. A queue with nothing to do should not be\n        // the reason `rebase dev` will not exit.\n        timer.unref?.();\n    }\n\n    async function tick(): Promise<void> {\n        if (!running) return;\n        const work = (async () => {\n            try {\n                return await poll();\n            } catch (error) {\n                logger.error(\"[jobs] Poll failed\", { error });\n                return 0;\n            }\n        })();\n        inFlight = work;\n        const count = await work;\n\n        // A full batch means there is probably more waiting, so go straight\n        // back rather than sleeping through a backlog.\n        schedule(count >= concurrency ? 0 : pollIntervalMs);\n    }\n\n    return {\n        start(): void {\n            if (running) return;\n            running = true;\n            logger.info(`[jobs] Worker started (concurrency ${concurrency}, poll ${pollIntervalMs}ms)`);\n            schedule(0);\n        },\n\n        async stop(): Promise<void> {\n            running = false;\n            if (timer) {\n                clearTimeout(timer);\n                timer = null;\n            }\n            if (draining) return;\n            draining = true;\n            // Jobs in flight keep their claim until they finish or the\n            // visibility timeout expires, so waiting here is what turns a\n            // graceful shutdown into \"no job runs twice\".\n            await inFlight.catch(() => undefined);\n            draining = false;\n        },\n\n        runOnce(): Promise<number> {\n            return poll();\n        },\n\n        register<P = unknown>(task: string, handler: JobHandler<P>): void {\n            if (handlers.has(task)) {\n                logger.warn(`[jobs] Task \"${task}\" was already registered; the later handler wins`);\n            }\n            handlers.set(task, handler as JobHandler<never>);\n        },\n\n        isRunning(): boolean {\n            return running;\n        },\n\n        async enqueue<P = unknown>(task: string, payload?: P, enqueueOptions: EnqueueOptions = {}): Promise<string | null> {\n            return store.insert({\n                task,\n                payload: payload ?? null,\n                runAt: new Date(Date.now() + (enqueueOptions.delayMs ?? 0)),\n                maxAttempts: enqueueOptions.maxAttempts ?? defaultMaxAttempts,\n                idempotencyKey: enqueueOptions.idempotencyKey\n            });\n        }\n    };\n}\n","export { createJobStore } from \"./job-store\";\nexport type { JobStore } from \"./job-store\";\nexport { createJobQueue, defaultBackoff } from \"./job-queue\";\nexport type { JobQueue } from \"./job-queue\";\nexport type {\n    EnqueueOptions,\n    JobContext,\n    JobHandler,\n    JobQueueClient,\n    JobQueueOptions,\n    JobRecord,\n    JobStatus\n} from \"./types\";\n"],"mappings":";;;;;;;;;;;;;AA0CA,IAAM,gBAAgB,OAAO,IAAI,0CAA0C;;AAc3E,SAAgB,4BAA4D;CACxE,OAAQ,WAA4B,cAAc,GAAG;AACzD;;;;;;;;;;;ACzCA,IAAM,QAAQ;;AAGd,IAAM,2BAA2B;;;;;;AAMjC,IAAM,wBAAwB;AAgB9B,SAAS,SAAS,KAAwB;CACtC,OAAO;EACH,IAAI,IAAI;EACR,MAAM,IAAI;EACV,SAAS,IAAI;EACb,QAAQ,IAAI;EACZ,OAAO,IAAI,KAAK,IAAI,MAAM,CAAC,CAAC,YAAY;EACxC,UAAU,OAAO,IAAI,QAAQ;EAC7B,aAAa,OAAO,IAAI,YAAY;EACpC,WAAW,IAAI;EACf,WAAW,IAAI,KAAK,IAAI,UAAU,CAAC,CAAC,YAAY;EAChD,WAAW,IAAI,KAAK,IAAI,UAAU,CAAC,CAAC,YAAY;CACpD;AACJ;;AAGA,SAAS,kBAAkB,KAAuB;CAC9C,OAAO,gBAAgB,MAAM,MAAM,EAAE,SAAS,OAAO;AACzD;;;;;;;;;;;;;;;;;;;;;;;AAwBA,IAAM,mBAAmB;AACzB,IAAM,oBAAoB,GAAG,iBAAiB;AAsB9C,SAAgB,eAAe,QAA0C;CACrE,MAAM,QAAQ,OAAO;CACrB,IAAI,CAAC,WAAW,KAAK,GAAG;EACpB,OAAO,KACH,+IAEJ;EACA;CACJ;CAKA,MAAM,WAAoB,SAAS,YAC/B,MAAM,WAAW,SAAS,SAAS,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,KAAA,CAAS;CACtF,MAAM,QAAQ,SAAiB,WAC3B,QAAQ,SAAS,SAAS,EAAE,OAAO,IAAI,KAAA,CAAS;CAEpD,MAAM,MAAM,sBAAsB,SAAS,MAAM;;;;;;;CAQjD,IAAI,uBAAuB;CAE3B,OAAO;EACH,MAAM,cAA6B;GAC/B,MAAM,IAAI,aAAa,0BAA0B,oCAAoC;GAErF,MAAM,IAAI,aAAa,YAAY,SAAS;6CACX,MAAM;;;;;;;;;;;;;;;aAetC;GAKD,MAAM,IAAI,aAAa,8BAA8B;;qBAE5C,MAAM;;aAEd;GAGD,MAAM,IAAI,aAAa,6BAA6B;;qBAE3C,MAAM;;aAEd;GAOD,MAAM,IAAI,aAAa,iCAAiC;;qBAE/C,MAAM;;aAEd;GAID,IAAI,MAFgB,IAAI,WAAW,KAAK,GAE7B;IACP,MAAM,IAAI,KAAK,uBAAuB,YAAY;KAC9C,MAAM,KACF,eAAe,MAAM;;2GAGrB,CAAC,0BAA0B,qBAAqB,CACpD;IACJ,CAAC;IAOD,MAAM,IAAI,KAAK,0CACX,KAAK,uBAAuB,UAAU,MAAM,CAAC,CAAC;IAElD,MAAM,IAAI,aAAa,YAAY,oBAAoB;iDACtB,iBAAiB;;;;;;;;sCAQ5B,MAAM;;;;;iBAK3B;IAID,MAAM,IAAI,KAAK,YAAY,iBAAiB,uBAAuB,YAAY;KAC3E,MAAM,KAAK,0BAA0B,kBAAkB,aAAa;KACpE,MAAM,KAAK;;iFAEkD,iBAAiB;4DACtC,kBAAkB,MAAM,iBAAiB;;;qBAGhF;IACL,CAAC;IACD,uBAAuB,YAAkC,MAAM,KAC3D,2BAA2B,kBAAkB,0BACjD,CAAC,CAAC,EAAE,YAAY;IAChB,IAAI,CAAC,sBACD,OAAO,KACH,aAAa,iBAAiB,qHAElC;IAGJ,OAAO,KAAK,yBAAyB;GACzC,OACI,OAAO,MACH,YAAY,MAAM,2HAEtB;EAER;EAEA,MAAM,OAAO,KAA6B;GACtC,MAAM,SAAS;IACX,IAAI;IACJ,KAAK,UAAU,IAAI,WAAW,IAAI;IAClC,IAAI,MAAM,YAAY;IACtB,IAAI;IACJ,IAAI,kBAAkB;GAC1B;GAIA,MAAM,UAAU,uBAAuB,0BAA0B,IAAI,KAAA;GACrE,IAAI,SAKA,QAAQ,MAJW,QAAQ,KACvB,UAAU,iBAAiB,sEAC3B,MACJ,EAAA,GACe,EAAE,EAAE,MAAoC;GAE3D,IAAI;IAOA,QAAQ,MANW,KACf,eAAe,MAAM;;oCAGrB,MACJ,EAAA,GACe,EAAE,EAAE,MAAiB;GACxC,SAAS,OAAO;IAIZ,IAAI,kBAAkB,KAAK,GAAG,OAAO;IACrC,MAAM;GACV;EACJ;EAEA,MAAM,MAAM,OAAe,UAAwC;GA6B/D,OAAO,QAAgB,MAjBJ,KACf,UAAU,MAAM;;;;;;;sCAOM,MAAM;;;;;;+BAO5B,CAAC,OAAO,QAAQ,CACpB,CAC2B,CAAC,CAAC,IAAI,QAAQ;EAC7C;EAEA,MAAM,SAAS,IAA2B;GACtC,MAAM,KACF,UAAU,MAAM;;iCAGhB,CAAC,EAAE,CACP;EACJ;EAEA,MAAM,KAAK,IAAY,OAAe,SAAqC;GACvE,IAAI,SAAS;IACT,MAAM,KACF,UAAU,MAAM;;qCAGhB;KAAC;KAAI,QAAQ,YAAY;KAAG;IAAK,CACrC;IACA;GACJ;GACA,MAAM,KACF,UAAU,MAAM;;iCAGhB,CAAC,IAAI,KAAK,CACd;EACJ;EAEA,MAAM,YAAY,qBAA8C;GAM5D,MAAM,UAAU,KAAK,IAAI,GAAG,KAAK,MAAM,sBAAsB,GAAI,CAAC;GAElE,MAAM,UAAU,MAAM,KAClB,UAAU,MAAM;;;;;gCAMhB,CAAC,OAAO,CACZ;GAEA,MAAM,SAAS,MAAM,KACjB,UAAU,MAAM;;;;;gCAMhB,CAAC,OAAO,CACZ;GAEA,MAAM,SAAS,SAAS,UAAU,MAAM,QAAQ,UAAU;GAC1D,IAAI,QAAQ,GACR,OAAO,KACH,oBAAoB,MAAM,iDACtB,SAAS,UAAU,EAAE,cAAc,QAAQ,UAAU,EAAE,gBAC/D;GAEJ,OAAO;EACX;EAEA,MAAM,MAAM,IAAuC;GAE/C,MAAM,MAAM,YAAoB,MADb,KAAK,iBAAiB,MAAM,iBAAiB,CAAC,EAAE,CAAC,CAChC;GACpC,OAAO,MAAM,SAAS,GAAG,IAAI;EACjC;CACJ;AACJ;;;;;;;;;;ACzXA,IAAM,sBAAsB;AAC5B,IAAM,2BAA2B;AACjC,IAAM,gCAAgC,IAAI;AAC1C,IAAM,uBAAuB;;AAG7B,SAAgB,eAAe,SAAyB;CACpD,OAAO,KAAK,IAAI,MAAQ,KAAK,IAAI,GAAG,KAAK,IAAI,GAAG,UAAU,CAAC,CAAC,GAAG,KAAK,GAAM;AAC9E;;;;;;;;AASA,IAAM,uBAAuB;AAY7B,SAAgB,eAAe,OAAiB,UAA2B,CAAC,GAAa;CACrF,MAAM,cAAc,QAAQ,eAAe;CAC3C,MAAM,iBAAiB,QAAQ,kBAAkB;CACjD,MAAM,sBAAsB,QAAQ,uBAAuB;CAC3D,MAAM,qBAAqB,QAAQ,eAAe;CAClD,MAAM,UAAU,QAAQ,WAAW;CAEnC,MAAM,2BAAW,IAAI,IAA+B;CACpD,KAAK,MAAM,CAAC,MAAM,YAAY,OAAO,QAAQ,QAAQ,SAAS,CAAC,CAAC,GAC5D,SAAS,IAAI,MAAM,OAAO;CAM9B,MAAM,WAAW,GAAG,QAAQ,IAAI,GAAG,WAAW,CAAC,CAAC,MAAM,GAAG,CAAC;CAE1D,IAAI,QAA+B;CACnC,IAAI,UAAU;CACd,IAAI,WAAW;;CAEf,IAAI,WAA6B,QAAQ,QAAQ;CACjD,IAAI,aAAa;CAEjB,eAAe,OAAO,KAA+B;EACjD,MAAM,UAAU,SAAS,IAAI,IAAI,IAAI;EAErC,IAAI,CAAC,SAAS;GAUV,OAAO,KAAK,0CAA0C,IAAI,KAAK,mCAAmC;GAClG,MAAM,MAAM,KACR,IAAI,IACJ,mCAAmC,IAAI,KAAK,IAC5C,IAAI,WAAW,IAAI,cAAc,IAAI,KAAK,KAAK,IAAI,IAAI,QAAQ,IAAI,QAAQ,CAAC,IAAI,IACpF;GACA;EACJ;EAEA,IAAI;GACA,MAAM,QAAQ;IACV,IAAI,IAAI;IACR,MAAM,IAAI;IACV,SAAS,IAAI;IACb,SAAS,IAAI;IACb,aAAa,IAAI;GACrB,CAAU;GACV,MAAM,MAAM,SAAS,IAAI,EAAE;EAC/B,SAAS,OAAO;GACZ,MAAM,UAAU,iBAAiB,QAAS,MAAM,SAAS,MAAM,UAAW,OAAO,KAAK;GACtF,MAAM,YAAY,IAAI,WAAW,IAAI;GAIrC,MAAM,MAAM,KAAK,IAAI,IAAI,QAAQ,MAAM,GAAG,GAAK,GAAG,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,QAAQ,IAAI,QAAQ,CAAC,IAAI,IAAI;GAEjH,IAAI,WACA,OAAO,KAAK,WAAW,IAAI,KAAK,sBAAsB,IAAI,SAAS,GAAG,IAAI,YAAY,aAAa,EAAE,OAAO,IAAI,GAAG,CAAC;QAKpH,OAAO,MAAM,WAAW,IAAI,KAAK,6BAA6B,IAAI,SAAS,YAAY;IAAE,OAAO,IAAI;IAAI,OAAO;GAAQ,CAAC;EAEhI;CACJ;CAEA,eAAe,OAAwB;EAEnC,MAAM,MAAM,KAAK,IAAI;EACrB,IAAI,MAAM,aAAa,sBAAsB,sBAAsB;GAC/D,aAAa;GACb,IAAI;IACA,MAAM,MAAM,YAAY,mBAAmB;GAC/C,SAAS,OAAO;IACZ,OAAO,MAAM,yCAAyC,EAAE,MAAM,CAAC;GACnE;EACJ;EAEA,MAAM,OAAO,MAAM,MAAM,MAAM,aAAa,QAAQ;EACpD,IAAI,KAAK,WAAW,GAAG,OAAO;EAI9B,MAAM,QAAQ,WAAW,KAAK,IAAI,MAAM,CAAC;EACzC,OAAO,KAAK;CAChB;CAEA,SAAS,SAAS,SAAuB;EACrC,IAAI,CAAC,SAAS;EACd,QAAQ,iBAAiB;GACrB,KAAU;EACd,GAAG,OAAO;EAGV,MAAM,QAAQ;CAClB;CAEA,eAAe,OAAsB;EACjC,IAAI,CAAC,SAAS;EACd,MAAM,QAAQ,YAAY;GACtB,IAAI;IACA,OAAO,MAAM,KAAK;GACtB,SAAS,OAAO;IACZ,OAAO,MAAM,sBAAsB,EAAE,MAAM,CAAC;IAC5C,OAAO;GACX;EACJ,EAAA,CAAG;EACH,WAAW;EAKX,SAAS,MAJW,QAIF,cAAc,IAAI,cAAc;CACtD;CAEA,OAAO;EACH,QAAc;GACV,IAAI,SAAS;GACb,UAAU;GACV,OAAO,KAAK,sCAAsC,YAAY,SAAS,eAAe,IAAI;GAC1F,SAAS,CAAC;EACd;EAEA,MAAM,OAAsB;GACxB,UAAU;GACV,IAAI,OAAO;IACP,aAAa,KAAK;IAClB,QAAQ;GACZ;GACA,IAAI,UAAU;GACd,WAAW;GAIX,MAAM,SAAS,YAAY,KAAA,CAAS;GACpC,WAAW;EACf;EAEA,UAA2B;GACvB,OAAO,KAAK;EAChB;EAEA,SAAsB,MAAc,SAA8B;GAC9D,IAAI,SAAS,IAAI,IAAI,GACjB,OAAO,KAAK,gBAAgB,KAAK,iDAAiD;GAEtF,SAAS,IAAI,MAAM,OAA4B;EACnD;EAEA,YAAqB;GACjB,OAAO;EACX;EAEA,MAAM,QAAqB,MAAc,SAAa,iBAAiC,CAAC,GAA2B;GAC/G,OAAO,MAAM,OAAO;IAChB;IACA,SAAS,WAAW;IACpB,OAAO,IAAI,KAAK,KAAK,IAAI,KAAK,eAAe,WAAW,EAAE;IAC1D,aAAa,eAAe,eAAe;IAC3C,gBAAgB,eAAe;GACnC,CAAC;EACL;CACJ;AACJ"}
+{"version":3,"file":"jobs-Bjr8DZAi.js","names":[],"sources":["../src/db/ambient-transaction.ts","../src/jobs/job-store.ts","../src/jobs/job-queue.ts","../src/jobs/index.ts"],"sourcesContent":["/**\n * The write transaction the current code is running inside, when there is one.\n *\n * A collection callback runs inside the transaction that carries its write.\n * Work it hands off — a job, a queue message, a topic event, a webhook\n * delivery — has to share that write's fate: queued when it commits, never\n * queued when it rolls back, and invisible to a worker until the commit. The\n * code that queues it lives in this package and knows no driver; the\n * transaction belongs to the driver. So the driver publishes the transaction it\n * opened for a write, and the queueing code asks for it here.\n *\n * Until this existed the job store wrote through the default driver's own\n * connection, in autocommit, whatever called it. A job enqueued from an\n * `afterSave` that then threw stayed queued for a row that was never written,\n * and a worker could claim it before the row it was about committed.\n *\n * The resolver lives on `globalThis` under a registered symbol, like the\n * `rebase` singleton: a managed runtime can load two copies of this package,\n * and the copy a driver registers with must be the one the job store reads.\n * No Node imports — the store is reachable from code that has to stay portable.\n *\n * **The symbol's key is a contract between packages, and frozen.** The\n * Postgres driver writes the slot itself rather than importing a setter from\n * here: the managed runtime supplies this package from the image while a\n * bundle brings its own driver, and a driver importing a function an older\n * image does not export would fail to link and take the boot down. Written\n * through the slot, any pairing of versions degrades to the old behaviour —\n * jobs committing on their own — instead.\n */\nexport interface AmbientTransaction {\n    /**\n     * Run one statement on the transaction, `$1…` placeholders as\n     * `executeSql` takes them. It runs as the transaction's current role — on\n     * Postgres the request's restricted one — so a statement that needs more\n     * goes through a function granted to that role.\n     */\n    exec(sqlText: string, params?: unknown[]): Promise<Record<string, unknown>[]>;\n    /** Run `fn` after the transaction commits. Never runs if it rolls back. */\n    afterCommit(fn: () => void): void;\n}\n\n/** Frozen — see above. `server-postgres/src/services/write-transaction-scope.ts` writes it. */\nconst RESOLVER_SLOT = Symbol.for(\"rebase.server.ambientTransactionResolver\");\n\ntype ResolverSlot = { [RESOLVER_SLOT]?: () => AmbientTransaction | undefined };\n\n/**\n * Register how to find the write transaction the caller is inside; pass\n * `undefined` to unregister. For tests and for drivers in this repository's\n * lockstep — a driver shipped separately writes the slot, as above.\n */\nexport function setAmbientTransactionResolver(resolve: (() => AmbientTransaction | undefined) | undefined): void {\n    (globalThis as ResolverSlot)[RESOLVER_SLOT] = resolve;\n}\n\n/** The write transaction the caller is inside, or `undefined` outside one. */\nexport function currentAmbientTransaction(): AmbientTransaction | undefined {\n    return (globalThis as ResolverSlot)[RESOLVER_SLOT]?.();\n}\n","import type { DataDriver } from \"@rebasepro/types\";\nimport { isSQLAdmin } from \"@rebasepro/types\";\nimport { REBASE_USER_ROLE, revokeInternalTableSql, sqlRows, firstSqlRow } from \"@rebasepro/common\";\nimport { logger } from \"../utils/logger.js\";\nimport { createDdlBootstrapper, hasInCauseChain, type SqlExec } from \"../boot/ddl-bootstrap.js\";\nimport { currentAmbientTransaction } from \"../db/ambient-transaction.js\";\nimport type { JobRecord } from \"./types.js\";\n\n/**\n * The queue's storage, as SQL against `rebase.jobs`.\n *\n * Split from the worker for the same reason `cron-store` is split from\n * `cron-scheduler`: the interesting parts here are three statements that have\n * to be exactly right under concurrency, and they are much easier to reason\n * about — and to test — away from a polling loop.\n */\n\nconst TABLE = \"rebase.jobs\";\n\n/** How long finished jobs are kept before the boot sweep removes them. */\nconst SUCCEEDED_RETENTION_DAYS = 3;\n/**\n * Failures outlive successes by a lot. A dead-lettered job is evidence, and the\n * person who needs it is usually looking on Monday for something that happened\n * on Friday night.\n */\nconst FAILED_RETENTION_DAYS = 30;\n\n/** A row as Postgres returns it. */\ninterface JobRow {\n    id: string;\n    task: string;\n    payload: unknown;\n    status: string;\n    run_at: string;\n    attempts: number;\n    max_attempts: number;\n    last_error: string | null;\n    created_at: string;\n    updated_at: string;\n}\n\nfunction toRecord(row: JobRow): JobRecord {\n    return {\n        id: row.id,\n        task: row.task,\n        payload: row.payload,\n        status: row.status as JobRecord[\"status\"],\n        runAt: new Date(row.run_at).toISOString(),\n        attempts: Number(row.attempts),\n        maxAttempts: Number(row.max_attempts),\n        lastError: row.last_error,\n        createdAt: new Date(row.created_at).toISOString(),\n        updatedAt: new Date(row.updated_at).toISOString()\n    };\n}\n\n/** Same rule as `cron-store`: match the SQLSTATE, never the message. */\nfunction isUniqueViolation(err: unknown): boolean {\n    return hasInCauseChain(err, (e) => e.code === \"23505\");\n}\n\n/**\n * How a job gets into `rebase.jobs` from inside somebody else's transaction.\n *\n * An enqueue from a collection callback has to ride the write's transaction —\n * committed with it, discarded with it, invisible to workers until then — and\n * that transaction runs as the request's restricted role, which has no access\n * to `rebase.jobs` at all (see the revoke in `ensureTable`). This function is\n * the one door: `SECURITY DEFINER`, so the insert runs with the owner's rights\n * for that one statement and the transaction's role never changes. Switching\n * the role for the insert instead would elevate the whole connection for as\n * long as the insert took, and a callback's un-awaited statement would run\n * in that window as the owner.\n *\n * The door is narrow on purpose. It takes the five columns an enqueue sets and\n * nothing else, so it cannot claim, complete or rewrite a job — and only the\n * request role is granted it, not PUBLIC. That role runs statements the server\n * writes; nobody outside gets SQL as it.\n *\n * `ON CONFLICT DO NOTHING` rather than a caught unique violation: an error\n * inside a transaction aborts the whole transaction, so an idempotency clash\n * would have failed the customer's write. A clash returns no row, hence NULL.\n */\nconst ENQUEUE_FUNCTION = \"rebase.enqueue_job\";\nconst ENQUEUE_SIGNATURE = `${ENQUEUE_FUNCTION}(text, jsonb, timestamptz, integer, text)`;\n\nexport interface JobStore {\n    ensureTable(): Promise<void>;\n    /** Returns the new job's id, or `null` if an idempotency key matched unfinished work. */\n    insert(job: {\n        task: string;\n        payload: unknown;\n        runAt: Date;\n        maxAttempts: number;\n        idempotencyKey?: string;\n    }): Promise<string | null>;\n    /** Atomically take up to `limit` runnable jobs for this worker. */\n    claim(limit: number, workerId: string): Promise<JobRecord[]>;\n    complete(id: string): Promise<void>;\n    /** Back to `pending` with a later `runAt`, or `failed` when out of attempts. */\n    fail(id: string, error: string, retryAt: Date | null): Promise<void>;\n    /** Return jobs stranded by a worker that died holding them. Resolves with how many. */\n    reapExpired(visibilityTimeoutMs: number): Promise<number>;\n    fetch(id: string): Promise<JobRecord | null>;\n}\n\nexport function createJobStore(driver: DataDriver): JobStore | undefined {\n    const admin = driver.admin;\n    if (!isSQLAdmin(admin)) {\n        logger.warn(\n            \"⚠️ [jobs] DataDriver does not support SQL admin — the durable job queue is unavailable. \" +\n            \"Work that would have been queued runs inline instead.\"\n        );\n        return undefined;\n    }\n\n    // Two shapes of the same call: the bootstrapper's `SqlExec` takes an\n    // options object, while everything below reads better with a positional\n    // parameter array.\n    const execRaw: SqlExec = (sqlText, options) =>\n        admin.executeSql(sqlText, options?.params ? { params: options.params } : undefined);\n    const exec = (sqlText: string, params?: unknown[]) =>\n        execRaw(sqlText, params ? { params } : undefined);\n\n    const ddl = createDdlBootstrapper(execRaw, \"jobs\");\n\n    /**\n     * Whether {@link ENQUEUE_FUNCTION} exists, so an enqueue inside a write can\n     * ride its transaction. Decided at boot rather than assumed: a database\n     * that refused the function would otherwise fail every write whose callback\n     * enqueues, where falling back to the old behaviour only loses atomicity.\n     */\n    let enqueueInTransaction = false;\n\n    return {\n        async ensureTable(): Promise<void> {\n            await ddl.ensureObject(\"Creating schema rebase\", \"CREATE SCHEMA IF NOT EXISTS rebase\");\n\n            await ddl.ensureObject(`Creating ${TABLE}`, `\n                CREATE TABLE IF NOT EXISTS ${TABLE} (\n                    id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,\n                    task TEXT NOT NULL,\n                    payload JSONB,\n                    status TEXT NOT NULL DEFAULT 'pending',\n                    run_at TIMESTAMPTZ NOT NULL DEFAULT now(),\n                    attempts INTEGER NOT NULL DEFAULT 0,\n                    max_attempts INTEGER NOT NULL DEFAULT 3,\n                    locked_at TIMESTAMPTZ,\n                    locked_by TEXT,\n                    idempotency_key TEXT,\n                    last_error TEXT,\n                    created_at TIMESTAMPTZ NOT NULL DEFAULT now(),\n                    updated_at TIMESTAMPTZ NOT NULL DEFAULT now()\n                )\n            `);\n\n            // The claim query's index. Partial, because the rows it has to find\n            // fast are a shrinking minority of a table that also holds every\n            // success and every dead letter.\n            await ddl.ensureObject(\"Creating idx_jobs_runnable\", `\n                CREATE INDEX IF NOT EXISTS idx_jobs_runnable\n                ON ${TABLE}(run_at, created_at)\n                WHERE status = 'pending'\n            `);\n\n            // Finds jobs stranded by a dead worker.\n            await ddl.ensureObject(\"Creating idx_jobs_running\", `\n                CREATE INDEX IF NOT EXISTS idx_jobs_running\n                ON ${TABLE}(locked_at)\n                WHERE status = 'running'\n            `);\n\n            // What makes `idempotencyKey` a guarantee rather than a\n            // check-then-act race: two instances reacting to one event both\n            // reach the INSERT, and the index decides. Partial on unfinished\n            // work — see `EnqueueOptions.idempotencyKey` for why a key must be\n            // reusable once its job is done.\n            await ddl.ensureObject(\"Creating idx_jobs_idempotency\", `\n                CREATE UNIQUE INDEX IF NOT EXISTS idx_jobs_idempotency\n                ON ${TABLE}(idempotency_key)\n                WHERE idempotency_key IS NOT NULL AND status IN ('pending', 'running')\n            `);\n\n            const ready = await ddl.isReadable(TABLE);\n\n            if (ready) {\n                await ddl.step(\"Job retention sweep\", async () => {\n                    await exec(\n                        `DELETE FROM ${TABLE}\n                         WHERE (status = 'succeeded' AND updated_at < now() - make_interval(days => $1))\n                            OR (status = 'failed'    AND updated_at < now() - make_interval(days => $2))`,\n                        [SUCCEEDED_RETENTION_DAYS, FAILED_RETENTION_DAYS]\n                    );\n                });\n\n                // Payloads are arbitrary application data — a webhook body, a\n                // user id, whatever was passed — and a writable queue lets any\n                // signed-in user schedule work of their choosing under the\n                // server's own authority. Same reasoning, and the same\n                // unconditional re-application, as `cron_claims`.\n                await ddl.step(\"Revoking end-user access to jobs\", () =>\n                    exec(revokeInternalTableSql(\"rebase\", \"jobs\")));\n\n                await ddl.ensureObject(`Creating ${ENQUEUE_FUNCTION}`, `\n                    CREATE OR REPLACE FUNCTION ${ENQUEUE_FUNCTION}(\n                        p_task text, p_payload jsonb, p_run_at timestamptz,\n                        p_max_attempts integer, p_idempotency_key text\n                    ) RETURNS text\n                    LANGUAGE sql\n                    SECURITY DEFINER\n                    SET search_path = pg_catalog, pg_temp\n                    AS $fn$\n                        INSERT INTO ${TABLE} (task, payload, run_at, max_attempts, idempotency_key)\n                        VALUES (p_task, p_payload, p_run_at, p_max_attempts, p_idempotency_key)\n                        ON CONFLICT DO NOTHING\n                        RETURNING id\n                    $fn$\n                `);\n                // Re-applied every boot: a new function is executable by PUBLIC\n                // until told otherwise, and the request role may be provisioned\n                // after the function was first made.\n                await ddl.step(`Granting ${ENQUEUE_FUNCTION} to the request role`, async () => {\n                    await exec(`REVOKE ALL ON FUNCTION ${ENQUEUE_SIGNATURE} FROM PUBLIC`);\n                    await exec(`\n                        DO $grant$ BEGIN\n                            IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = '${REBASE_USER_ROLE}') THEN\n                                GRANT EXECUTE ON FUNCTION ${ENQUEUE_SIGNATURE} TO ${REBASE_USER_ROLE};\n                            END IF;\n                        END $grant$\n                    `);\n                });\n                enqueueInTransaction = firstSqlRow<{ present: boolean }>(await exec(\n                    `SELECT to_regprocedure('${ENQUEUE_SIGNATURE}') IS NOT NULL AS present`\n                ))?.present === true;\n                if (!enqueueInTransaction) {\n                    logger.warn(\n                        `⚠️ [jobs] ${ENQUEUE_FUNCTION} could not be created, so a job enqueued inside a write ` +\n                        \"commits on its own: it stays queued if the write rolls back.\"\n                    );\n                }\n\n                logger.info(\"✅ Job queue table ready\");\n            } else {\n                logger.error(\n                    `❌ [jobs] ${TABLE} is unavailable — nothing can be queued and nothing queued earlier ` +\n                    \"will run. Callers fall back to running the work inline.\"\n                );\n            }\n        },\n\n        async insert(job): Promise<string | null> {\n            const params = [\n                job.task,\n                JSON.stringify(job.payload ?? null),\n                job.runAt.toISOString(),\n                job.maxAttempts,\n                job.idempotencyKey ?? null\n            ];\n            // Inside a write: on its transaction, through the definer function\n            // — see `ENQUEUE_FUNCTION`. Checked and used with no `await`\n            // between, so the transaction cannot close in the gap.\n            const ambient = enqueueInTransaction ? currentAmbientTransaction() : undefined;\n            if (ambient) {\n                const rows = await ambient.exec(\n                    `SELECT ${ENQUEUE_FUNCTION}($1::text, $2::jsonb, $3::timestamptz, $4::integer, $5::text) AS id`,\n                    params\n                );\n                return (rows?.[0]?.id as string | null | undefined) ?? null;\n            }\n            try {\n                const rows = await exec(\n                    `INSERT INTO ${TABLE} (task, payload, run_at, max_attempts, idempotency_key)\n                     VALUES ($1, $2::jsonb, $3, $4, $5)\n                     RETURNING id`,\n                    params\n                );\n                return (rows?.[0]?.id as string) ?? null;\n            } catch (error) {\n                // The losing side of an idempotency race. Not an error: the\n                // work the caller wanted is already queued, which is the\n                // outcome they asked for.\n                if (isUniqueViolation(error)) return null;\n                throw error;\n            }\n        },\n\n        async claim(limit: number, workerId: string): Promise<JobRecord[]> {\n            // `FOR UPDATE SKIP LOCKED` is the whole design. The inner select\n            // takes row locks on the jobs it picks and *skips* any a concurrent\n            // worker already holds, so N workers polling the same table divide\n            // the work instead of contending for the head of it — and no job is\n            // ever handed to two of them.\n            //\n            // `attempts` is incremented here, on claim, rather than on failure.\n            // A worker that is killed mid-job never reports anything, so\n            // counting on failure would let a job that crashes the process be\n            // retried forever, once per restart, taking the process down each\n            // time.\n            const rows = await exec(\n                `UPDATE ${TABLE} SET\n                    status = 'running',\n                    attempts = attempts + 1,\n                    locked_at = now(),\n                    locked_by = $2,\n                    updated_at = now()\n                 WHERE id IN (\n                     SELECT id FROM ${TABLE}\n                     WHERE status = 'pending' AND run_at <= now()\n                     ORDER BY run_at, created_at\n                     LIMIT $1\n                     FOR UPDATE SKIP LOCKED\n                 )\n                 RETURNING *`,\n                [limit, workerId]\n            );\n            return sqlRows<JobRow>(rows).map(toRecord);\n        },\n\n        async complete(id: string): Promise<void> {\n            await exec(\n                `UPDATE ${TABLE} SET status = 'succeeded', locked_at = NULL, locked_by = NULL,\n                        last_error = NULL, updated_at = now()\n                 WHERE id = $1`,\n                [id]\n            );\n        },\n\n        async fail(id: string, error: string, retryAt: Date | null): Promise<void> {\n            if (retryAt) {\n                await exec(\n                    `UPDATE ${TABLE} SET status = 'pending', run_at = $2, locked_at = NULL,\n                            locked_by = NULL, last_error = $3, updated_at = now()\n                     WHERE id = $1`,\n                    [id, retryAt.toISOString(), error]\n                );\n                return;\n            }\n            await exec(\n                `UPDATE ${TABLE} SET status = 'failed', locked_at = NULL, locked_by = NULL,\n                        last_error = $2, updated_at = now()\n                 WHERE id = $1`,\n                [id, error]\n            );\n        },\n\n        async reapExpired(visibilityTimeoutMs: number): Promise<number> {\n            // A worker killed while holding a job cannot release it, so nothing\n            // but a timeout will ever free the row. Jobs that still have\n            // attempts left go back to `pending`; the rest are dead-lettered\n            // with an error that says what happened, because \"attempts: 3,\n            // lastError: null\" is otherwise a genuinely baffling row to find.\n            const seconds = Math.max(1, Math.round(visibilityTimeoutMs / 1000));\n\n            const revived = await exec(\n                `UPDATE ${TABLE} SET status = 'pending', locked_at = NULL, locked_by = NULL,\n                        last_error = 'Worker stopped responding; the job was reclaimed', updated_at = now()\n                 WHERE status = 'running'\n                   AND locked_at < now() - make_interval(secs => $1)\n                   AND attempts < max_attempts\n                 RETURNING id`,\n                [seconds]\n            );\n\n            const buried = await exec(\n                `UPDATE ${TABLE} SET status = 'failed', locked_at = NULL, locked_by = NULL,\n                        last_error = 'Worker stopped responding on the final attempt', updated_at = now()\n                 WHERE status = 'running'\n                   AND locked_at < now() - make_interval(secs => $1)\n                   AND attempts >= max_attempts\n                 RETURNING id`,\n                [seconds]\n            );\n\n            const count = (revived?.length ?? 0) + (buried?.length ?? 0);\n            if (count > 0) {\n                logger.warn(\n                    `[jobs] Reclaimed ${count} job(s) from a worker that stopped responding ` +\n                    `(${revived?.length ?? 0} retryable, ${buried?.length ?? 0} dead-lettered)`\n                );\n            }\n            return count;\n        },\n\n        async fetch(id: string): Promise<JobRecord | null> {\n            const rows = await exec(`SELECT * FROM ${TABLE} WHERE id = $1`, [id]);\n            const row = firstSqlRow<JobRow>(rows);\n            return row ? toRecord(row) : null;\n        }\n    };\n}\n","import { randomUUID } from \"crypto\";\nimport { logger } from \"../utils/logger.js\";\nimport type { JobStore } from \"./job-store.js\";\nimport type { EnqueueOptions, JobHandler, JobQueueClient, JobQueueOptions, JobRecord } from \"./types.js\";\n\n/**\n * The worker: claim, run, record, repeat.\n *\n * Everything difficult about running jobs concurrently is in `job-store.ts`,\n * where one `UPDATE … FOR UPDATE SKIP LOCKED` does the arbitration. What is\n * left here is a loop and the decisions around a handler that throws.\n */\n\nconst DEFAULT_CONCURRENCY = 5;\nconst DEFAULT_POLL_INTERVAL_MS = 2_000;\nconst DEFAULT_VISIBILITY_TIMEOUT_MS = 5 * 60_000;\nconst DEFAULT_MAX_ATTEMPTS = 3;\n\n/** 1s, 5s, 25s, 125s … capped at an hour. */\nexport function defaultBackoff(attempt: number): number {\n    return Math.min(1_000 * Math.pow(5, Math.max(0, attempt - 1)), 60 * 60_000);\n}\n\n/**\n * How often the reaper runs, relative to the visibility timeout.\n *\n * A quarter of it, so a stranded job waits at most 1.25× the timeout rather\n * than 2× — and so the sweep is not itself a per-poll query against a table\n * whose interesting rows are, almost always, none.\n */\nconst REAP_INTERVAL_FACTOR = 0.25;\n\nexport interface JobQueue extends JobQueueClient {\n    start(): void;\n    stop(): Promise<void>;\n    /** Run one poll's worth of work and return how many jobs ran. For tests and for `/jobs/drain`. */\n    runOnce(): Promise<number>;\n    /** Registered after construction — how `tasks` from config and internal producers meet. */\n    register<P = unknown>(task: string, handler: JobHandler<P>): void;\n    isRunning(): boolean;\n}\n\nexport function createJobQueue(store: JobStore, options: JobQueueOptions = {}): JobQueue {\n    const concurrency = options.concurrency ?? DEFAULT_CONCURRENCY;\n    const pollIntervalMs = options.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;\n    const visibilityTimeoutMs = options.visibilityTimeoutMs ?? DEFAULT_VISIBILITY_TIMEOUT_MS;\n    const defaultMaxAttempts = options.maxAttempts ?? DEFAULT_MAX_ATTEMPTS;\n    const backoff = options.backoff ?? defaultBackoff;\n\n    const handlers = new Map<string, JobHandler<never>>();\n    for (const [task, handler] of Object.entries(options.tasks ?? {})) {\n        handlers.set(task, handler);\n    }\n\n    // Identifies this process in `locked_by`. Purely diagnostic — the claim is\n    // enforced by the row lock, not by this — but \"which pod had it when it\n    // stopped\" is the first question anyone asks of a stuck job.\n    const workerId = `${process.pid}-${randomUUID().slice(0, 8)}`;\n\n    let timer: NodeJS.Timeout | null = null;\n    let running = false;\n    let draining = false;\n    /** Resolves when the in-flight poll finishes, so `stop()` can wait for it. */\n    let inFlight: Promise<unknown> = Promise.resolve();\n    let lastReapAt = 0;\n\n    async function runJob(job: JobRecord): Promise<void> {\n        const handler = handlers.get(job.task);\n\n        if (!handler) {\n            // Not a failure. A rolling deploy runs old and new code at once, and\n            // an instance that has not been updated yet must not burn the\n            // attempts of a job belonging to one that has. Give the row back\n            // and let a peer — or this process after its next deploy — take it.\n            //\n            // The attempt increment from the claim is deliberately not undone:\n            // a task nobody in the fleet implements would otherwise cycle\n            // forever, and this way it dead-letters after `maxAttempts` with an\n            // error naming the task.\n            logger.warn(`[jobs] No handler registered for task \"${job.task}\" — returning the job to the queue`);\n            await store.fail(\n                job.id,\n                `No handler registered for task \"${job.task}\"`,\n                job.attempts < job.maxAttempts ? new Date(Date.now() + backoff(job.attempts)) : null\n            );\n            return;\n        }\n\n        try {\n            await handler({\n                id: job.id,\n                task: job.task,\n                payload: job.payload as never,\n                attempt: job.attempts,\n                maxAttempts: job.maxAttempts\n            } as never);\n            await store.complete(job.id);\n        } catch (error) {\n            const message = error instanceof Error ? (error.stack ?? error.message) : String(error);\n            const willRetry = job.attempts < job.maxAttempts;\n\n            // Truncated, because `last_error` holds a stack and a queue that\n            // accumulates megabytes of them is its own outage.\n            await store.fail(job.id, message.slice(0, 4_000), willRetry ? new Date(Date.now() + backoff(job.attempts)) : null);\n\n            if (willRetry) {\n                logger.warn(`[jobs] \"${job.task}\" failed on attempt ${job.attempts}/${job.maxAttempts}; retrying`, { jobId: job.id });\n            } else {\n                // The last attempt is an error, not a warning: nothing else will\n                // touch this job, and if nobody looks at the table it is simply\n                // lost work.\n                logger.error(`[jobs] \"${job.task}\" failed permanently after ${job.attempts} attempts`, { jobId: job.id, error: message });\n            }\n        }\n    }\n\n    async function poll(): Promise<number> {\n        // The reaper, on its own cadence.\n        const now = Date.now();\n        if (now - lastReapAt > visibilityTimeoutMs * REAP_INTERVAL_FACTOR) {\n            lastReapAt = now;\n            try {\n                await store.reapExpired(visibilityTimeoutMs);\n            } catch (error) {\n                logger.error(\"[jobs] Failed to reclaim expired jobs\", { error });\n            }\n        }\n\n        const jobs = await store.claim(concurrency, workerId);\n        if (jobs.length === 0) return 0;\n\n        // Settled, not `all`: `runJob` handles its own errors, but a store\n        // write failing inside it must not abandon this batch's siblings.\n        await Promise.allSettled(jobs.map(runJob));\n        return jobs.length;\n    }\n\n    function schedule(delayMs: number): void {\n        if (!running) return;\n        timer = setTimeout(() => {\n            void tick();\n        }, delayMs);\n        // Never hold the process open. A queue with nothing to do should not be\n        // the reason `rebase dev` will not exit.\n        timer.unref?.();\n    }\n\n    async function tick(): Promise<void> {\n        if (!running) return;\n        const work = (async () => {\n            try {\n                return await poll();\n            } catch (error) {\n                logger.error(\"[jobs] Poll failed\", { error });\n                return 0;\n            }\n        })();\n        inFlight = work;\n        const count = await work;\n\n        // A full batch means there is probably more waiting, so go straight\n        // back rather than sleeping through a backlog.\n        schedule(count >= concurrency ? 0 : pollIntervalMs);\n    }\n\n    return {\n        start(): void {\n            if (running) return;\n            running = true;\n            logger.info(`[jobs] Worker started (concurrency ${concurrency}, poll ${pollIntervalMs}ms)`);\n            schedule(0);\n        },\n\n        async stop(): Promise<void> {\n            running = false;\n            if (timer) {\n                clearTimeout(timer);\n                timer = null;\n            }\n            if (draining) return;\n            draining = true;\n            // Jobs in flight keep their claim until they finish or the\n            // visibility timeout expires, so waiting here is what turns a\n            // graceful shutdown into \"no job runs twice\".\n            await inFlight.catch(() => undefined);\n            draining = false;\n        },\n\n        runOnce(): Promise<number> {\n            return poll();\n        },\n\n        register<P = unknown>(task: string, handler: JobHandler<P>): void {\n            if (handlers.has(task)) {\n                logger.warn(`[jobs] Task \"${task}\" was already registered; the later handler wins`);\n            }\n            handlers.set(task, handler as JobHandler<never>);\n        },\n\n        isRunning(): boolean {\n            return running;\n        },\n\n        async enqueue<P = unknown>(task: string, payload?: P, enqueueOptions: EnqueueOptions = {}): Promise<string | null> {\n            return store.insert({\n                task,\n                payload: payload ?? null,\n                runAt: new Date(Date.now() + (enqueueOptions.delayMs ?? 0)),\n                maxAttempts: enqueueOptions.maxAttempts ?? defaultMaxAttempts,\n                idempotencyKey: enqueueOptions.idempotencyKey\n            });\n        }\n    };\n}\n","export { createJobStore } from \"./job-store\";\nexport type { JobStore } from \"./job-store\";\nexport { createJobQueue, defaultBackoff } from \"./job-queue\";\nexport type { JobQueue } from \"./job-queue\";\nexport type {\n    EnqueueOptions,\n    JobContext,\n    JobHandler,\n    JobQueueClient,\n    JobQueueOptions,\n    JobRecord,\n    JobStatus\n} from \"./types\";\n"],"mappings":";;;;;;;;;;;;;AA0CA,IAAM,gBAAgB,OAAO,IAAI,0CAA0C;;AAc3E,SAAgB,4BAA4D;CACxE,OAAQ,WAA4B,cAAc,GAAG;AACzD;;;;;;;;;;;ACzCA,IAAM,QAAQ;;AAGd,IAAM,2BAA2B;;;;;;AAMjC,IAAM,wBAAwB;AAgB9B,SAAS,SAAS,KAAwB;CACtC,OAAO;EACH,IAAI,IAAI;EACR,MAAM,IAAI;EACV,SAAS,IAAI;EACb,QAAQ,IAAI;EACZ,OAAO,IAAI,KAAK,IAAI,MAAM,CAAC,CAAC,YAAY;EACxC,UAAU,OAAO,IAAI,QAAQ;EAC7B,aAAa,OAAO,IAAI,YAAY;EACpC,WAAW,IAAI;EACf,WAAW,IAAI,KAAK,IAAI,UAAU,CAAC,CAAC,YAAY;EAChD,WAAW,IAAI,KAAK,IAAI,UAAU,CAAC,CAAC,YAAY;CACpD;AACJ;;AAGA,SAAS,kBAAkB,KAAuB;CAC9C,OAAO,gBAAgB,MAAM,MAAM,EAAE,SAAS,OAAO;AACzD;;;;;;;;;;;;;;;;;;;;;;;AAwBA,IAAM,mBAAmB;AACzB,IAAM,oBAAoB,GAAG,iBAAiB;AAsB9C,SAAgB,eAAe,QAA0C;CACrE,MAAM,QAAQ,OAAO;CACrB,IAAI,CAAC,WAAW,KAAK,GAAG;EACpB,OAAO,KACH,+IAEJ;EACA;CACJ;CAKA,MAAM,WAAoB,SAAS,YAC/B,MAAM,WAAW,SAAS,SAAS,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,KAAA,CAAS;CACtF,MAAM,QAAQ,SAAiB,WAC3B,QAAQ,SAAS,SAAS,EAAE,OAAO,IAAI,KAAA,CAAS;CAEpD,MAAM,MAAM,sBAAsB,SAAS,MAAM;;;;;;;CAQjD,IAAI,uBAAuB;CAE3B,OAAO;EACH,MAAM,cAA6B;GAC/B,MAAM,IAAI,aAAa,0BAA0B,oCAAoC;GAErF,MAAM,IAAI,aAAa,YAAY,SAAS;6CACX,MAAM;;;;;;;;;;;;;;;aAetC;GAKD,MAAM,IAAI,aAAa,8BAA8B;;qBAE5C,MAAM;;aAEd;GAGD,MAAM,IAAI,aAAa,6BAA6B;;qBAE3C,MAAM;;aAEd;GAOD,MAAM,IAAI,aAAa,iCAAiC;;qBAE/C,MAAM;;aAEd;GAID,IAAI,MAFgB,IAAI,WAAW,KAAK,GAE7B;IACP,MAAM,IAAI,KAAK,uBAAuB,YAAY;KAC9C,MAAM,KACF,eAAe,MAAM;;2GAGrB,CAAC,0BAA0B,qBAAqB,CACpD;IACJ,CAAC;IAOD,MAAM,IAAI,KAAK,0CACX,KAAK,uBAAuB,UAAU,MAAM,CAAC,CAAC;IAElD,MAAM,IAAI,aAAa,YAAY,oBAAoB;iDACtB,iBAAiB;;;;;;;;sCAQ5B,MAAM;;;;;iBAK3B;IAID,MAAM,IAAI,KAAK,YAAY,iBAAiB,uBAAuB,YAAY;KAC3E,MAAM,KAAK,0BAA0B,kBAAkB,aAAa;KACpE,MAAM,KAAK;;iFAEkD,iBAAiB;4DACtC,kBAAkB,MAAM,iBAAiB;;;qBAGhF;IACL,CAAC;IACD,uBAAuB,YAAkC,MAAM,KAC3D,2BAA2B,kBAAkB,0BACjD,CAAC,CAAC,EAAE,YAAY;IAChB,IAAI,CAAC,sBACD,OAAO,KACH,aAAa,iBAAiB,qHAElC;IAGJ,OAAO,KAAK,yBAAyB;GACzC,OACI,OAAO,MACH,YAAY,MAAM,2HAEtB;EAER;EAEA,MAAM,OAAO,KAA6B;GACtC,MAAM,SAAS;IACX,IAAI;IACJ,KAAK,UAAU,IAAI,WAAW,IAAI;IAClC,IAAI,MAAM,YAAY;IACtB,IAAI;IACJ,IAAI,kBAAkB;GAC1B;GAIA,MAAM,UAAU,uBAAuB,0BAA0B,IAAI,KAAA;GACrE,IAAI,SAKA,QAAQ,MAJW,QAAQ,KACvB,UAAU,iBAAiB,sEAC3B,MACJ,EAAA,GACe,EAAE,EAAE,MAAoC;GAE3D,IAAI;IAOA,QAAQ,MANW,KACf,eAAe,MAAM;;oCAGrB,MACJ,EAAA,GACe,EAAE,EAAE,MAAiB;GACxC,SAAS,OAAO;IAIZ,IAAI,kBAAkB,KAAK,GAAG,OAAO;IACrC,MAAM;GACV;EACJ;EAEA,MAAM,MAAM,OAAe,UAAwC;GA6B/D,OAAO,QAAgB,MAjBJ,KACf,UAAU,MAAM;;;;;;;sCAOM,MAAM;;;;;;+BAO5B,CAAC,OAAO,QAAQ,CACpB,CAC2B,CAAC,CAAC,IAAI,QAAQ;EAC7C;EAEA,MAAM,SAAS,IAA2B;GACtC,MAAM,KACF,UAAU,MAAM;;iCAGhB,CAAC,EAAE,CACP;EACJ;EAEA,MAAM,KAAK,IAAY,OAAe,SAAqC;GACvE,IAAI,SAAS;IACT,MAAM,KACF,UAAU,MAAM;;qCAGhB;KAAC;KAAI,QAAQ,YAAY;KAAG;IAAK,CACrC;IACA;GACJ;GACA,MAAM,KACF,UAAU,MAAM;;iCAGhB,CAAC,IAAI,KAAK,CACd;EACJ;EAEA,MAAM,YAAY,qBAA8C;GAM5D,MAAM,UAAU,KAAK,IAAI,GAAG,KAAK,MAAM,sBAAsB,GAAI,CAAC;GAElE,MAAM,UAAU,MAAM,KAClB,UAAU,MAAM;;;;;gCAMhB,CAAC,OAAO,CACZ;GAEA,MAAM,SAAS,MAAM,KACjB,UAAU,MAAM;;;;;gCAMhB,CAAC,OAAO,CACZ;GAEA,MAAM,SAAS,SAAS,UAAU,MAAM,QAAQ,UAAU;GAC1D,IAAI,QAAQ,GACR,OAAO,KACH,oBAAoB,MAAM,iDACtB,SAAS,UAAU,EAAE,cAAc,QAAQ,UAAU,EAAE,gBAC/D;GAEJ,OAAO;EACX;EAEA,MAAM,MAAM,IAAuC;GAE/C,MAAM,MAAM,YAAoB,MADb,KAAK,iBAAiB,MAAM,iBAAiB,CAAC,EAAE,CAAC,CAChC;GACpC,OAAO,MAAM,SAAS,GAAG,IAAI;EACjC;CACJ;AACJ;;;;;;;;;;ACzXA,IAAM,sBAAsB;AAC5B,IAAM,2BAA2B;AACjC,IAAM,gCAAgC,IAAI;AAC1C,IAAM,uBAAuB;;AAG7B,SAAgB,eAAe,SAAyB;CACpD,OAAO,KAAK,IAAI,MAAQ,KAAK,IAAI,GAAG,KAAK,IAAI,GAAG,UAAU,CAAC,CAAC,GAAG,KAAK,GAAM;AAC9E;;;;;;;;AASA,IAAM,uBAAuB;AAY7B,SAAgB,eAAe,OAAiB,UAA2B,CAAC,GAAa;CACrF,MAAM,cAAc,QAAQ,eAAe;CAC3C,MAAM,iBAAiB,QAAQ,kBAAkB;CACjD,MAAM,sBAAsB,QAAQ,uBAAuB;CAC3D,MAAM,qBAAqB,QAAQ,eAAe;CAClD,MAAM,UAAU,QAAQ,WAAW;CAEnC,MAAM,2BAAW,IAAI,IAA+B;CACpD,KAAK,MAAM,CAAC,MAAM,YAAY,OAAO,QAAQ,QAAQ,SAAS,CAAC,CAAC,GAC5D,SAAS,IAAI,MAAM,OAAO;CAM9B,MAAM,WAAW,GAAG,QAAQ,IAAI,GAAG,WAAW,CAAC,CAAC,MAAM,GAAG,CAAC;CAE1D,IAAI,QAA+B;CACnC,IAAI,UAAU;CACd,IAAI,WAAW;;CAEf,IAAI,WAA6B,QAAQ,QAAQ;CACjD,IAAI,aAAa;CAEjB,eAAe,OAAO,KAA+B;EACjD,MAAM,UAAU,SAAS,IAAI,IAAI,IAAI;EAErC,IAAI,CAAC,SAAS;GAUV,OAAO,KAAK,0CAA0C,IAAI,KAAK,mCAAmC;GAClG,MAAM,MAAM,KACR,IAAI,IACJ,mCAAmC,IAAI,KAAK,IAC5C,IAAI,WAAW,IAAI,cAAc,IAAI,KAAK,KAAK,IAAI,IAAI,QAAQ,IAAI,QAAQ,CAAC,IAAI,IACpF;GACA;EACJ;EAEA,IAAI;GACA,MAAM,QAAQ;IACV,IAAI,IAAI;IACR,MAAM,IAAI;IACV,SAAS,IAAI;IACb,SAAS,IAAI;IACb,aAAa,IAAI;GACrB,CAAU;GACV,MAAM,MAAM,SAAS,IAAI,EAAE;EAC/B,SAAS,OAAO;GACZ,MAAM,UAAU,iBAAiB,QAAS,MAAM,SAAS,MAAM,UAAW,OAAO,KAAK;GACtF,MAAM,YAAY,IAAI,WAAW,IAAI;GAIrC,MAAM,MAAM,KAAK,IAAI,IAAI,QAAQ,MAAM,GAAG,GAAK,GAAG,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,QAAQ,IAAI,QAAQ,CAAC,IAAI,IAAI;GAEjH,IAAI,WACA,OAAO,KAAK,WAAW,IAAI,KAAK,sBAAsB,IAAI,SAAS,GAAG,IAAI,YAAY,aAAa,EAAE,OAAO,IAAI,GAAG,CAAC;QAKpH,OAAO,MAAM,WAAW,IAAI,KAAK,6BAA6B,IAAI,SAAS,YAAY;IAAE,OAAO,IAAI;IAAI,OAAO;GAAQ,CAAC;EAEhI;CACJ;CAEA,eAAe,OAAwB;EAEnC,MAAM,MAAM,KAAK,IAAI;EACrB,IAAI,MAAM,aAAa,sBAAsB,sBAAsB;GAC/D,aAAa;GACb,IAAI;IACA,MAAM,MAAM,YAAY,mBAAmB;GAC/C,SAAS,OAAO;IACZ,OAAO,MAAM,yCAAyC,EAAE,MAAM,CAAC;GACnE;EACJ;EAEA,MAAM,OAAO,MAAM,MAAM,MAAM,aAAa,QAAQ;EACpD,IAAI,KAAK,WAAW,GAAG,OAAO;EAI9B,MAAM,QAAQ,WAAW,KAAK,IAAI,MAAM,CAAC;EACzC,OAAO,KAAK;CAChB;CAEA,SAAS,SAAS,SAAuB;EACrC,IAAI,CAAC,SAAS;EACd,QAAQ,iBAAiB;GACrB,KAAU;EACd,GAAG,OAAO;EAGV,MAAM,QAAQ;CAClB;CAEA,eAAe,OAAsB;EACjC,IAAI,CAAC,SAAS;EACd,MAAM,QAAQ,YAAY;GACtB,IAAI;IACA,OAAO,MAAM,KAAK;GACtB,SAAS,OAAO;IACZ,OAAO,MAAM,sBAAsB,EAAE,MAAM,CAAC;IAC5C,OAAO;GACX;EACJ,EAAA,CAAG;EACH,WAAW;EAKX,SAAS,MAJW,QAIF,cAAc,IAAI,cAAc;CACtD;CAEA,OAAO;EACH,QAAc;GACV,IAAI,SAAS;GACb,UAAU;GACV,OAAO,KAAK,sCAAsC,YAAY,SAAS,eAAe,IAAI;GAC1F,SAAS,CAAC;EACd;EAEA,MAAM,OAAsB;GACxB,UAAU;GACV,IAAI,OAAO;IACP,aAAa,KAAK;IAClB,QAAQ;GACZ;GACA,IAAI,UAAU;GACd,WAAW;GAIX,MAAM,SAAS,YAAY,KAAA,CAAS;GACpC,WAAW;EACf;EAEA,UAA2B;GACvB,OAAO,KAAK;EAChB;EAEA,SAAsB,MAAc,SAA8B;GAC9D,IAAI,SAAS,IAAI,IAAI,GACjB,OAAO,KAAK,gBAAgB,KAAK,iDAAiD;GAEtF,SAAS,IAAI,MAAM,OAA4B;EACnD;EAEA,YAAqB;GACjB,OAAO;EACX;EAEA,MAAM,QAAqB,MAAc,SAAa,iBAAiC,CAAC,GAA2B;GAC/G,OAAO,MAAM,OAAO;IAChB;IACA,SAAS,WAAW;IACpB,OAAO,IAAI,KAAK,KAAK,IAAI,KAAK,eAAe,WAAW,EAAE;IAC1D,aAAa,eAAe,eAAe;IAC3C,gBAAgB,eAAe;GACnC,CAAC;EACL;CACJ;AACJ"}

package/dist/{openapi-generator-D8ZIN_ss.js → openapi-generator-D8uFz-LW.js}

@@ -2,7 +2,7 @@ import { createRequire as __rebaseCreateRequire } from "module";
 import __rebaseProcess from "process";
 globalThis.process ??= __rebaseProcess;
 __rebaseCreateRequire(import.meta.url);
-import { B as findRelation, E as effectiveAccess, H as isRelationRequired, L as getTenantConfig, U as resolveCollectionRelations, ct as isToMany, z as fieldKeyForColumn } from "./src-BYax9_rm.js";
+import { B as fieldKeyForColumn, E as effectiveAccess, R as getTenantConfig, U as isRelationRequired, V as findRelation, W as resolveCollectionRelations, ut as isToMany } from "./src-1vL-I1Po.js";
 import "./src-Br6ARbs6.js";
 //#region src/api/openapi-generator.ts
 function generateOpenApiSpec(collections, options = {}) {
@@ -1426,4 +1426,4 @@ function toPascalCase(str) {
 //#endregion
 export { generateOpenApiSpec };
 
-//# sourceMappingURL=openapi-generator-D8ZIN_ss.js.map
+//# sourceMappingURL=openapi-generator-D8uFz-LW.js.map