@rebasepro/server 0.21.2-canary.g1ea48be → 0.23.0

package/dist/backup-DzI9jLwc.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"backup-DzI9jLwc.js","names":[],"sources":["../src/backup/backup-common.ts","../src/backup/backup-routes.ts","../src/backup/index.ts"],"sourcesContent":["/**\n * Storage-generic backup helpers used by the admin backup routes.\n *\n * These live in server (which owns {@link StorageController}) so the\n * admin API can list backups without depending on the Postgres driver —\n * `server` must not import from `server-postgres`. The `pg_dump`-side\n * copies of the tiny pure parsers live in `@rebasepro/server-postgres`;\n * keep the two in sync if the naming scheme ever changes.\n */\nimport fs from \"fs\";\nimport path from \"path\";\nimport type { BackupInfo, BackupDestinationKind } from \"@rebasepro/types\";\nimport type { StorageController } from \"../storage\";\n\nexport type BackupDestination =\n    | { kind: \"local\"; path: string }\n    | { kind: \"s3\"; bucket: string; prefix: string }\n    | { kind: \"gcs\"; bucket: string; prefix: string };\n\n/** Parse a destination string (`s3://…`, `gs://…`, or a local path). */\nexport function parseBackupDestination(out: string): BackupDestination {\n    const s3 = out.match(/^s3:\\/\\/([^/]+)\\/?(.*)$/);\n    if (s3) return { kind: \"s3\", bucket: s3[1], prefix: s3[2].replace(/\\/+$/, \"\") };\n    const gcs = out.match(/^gs:\\/\\/([^/]+)\\/?(.*)$/);\n    if (gcs) return { kind: \"gcs\", bucket: gcs[1], prefix: gcs[2].replace(/\\/+$/, \"\") };\n    return { kind: \"local\", path: out };\n}\n\n/**\n * Recover the UTC creation time encoded in a `rebase-<db>-<ts>.dump` name.\n * Returns `null` for names that don't match, so foreign objects are ignored.\n */\nexport function parseBackupTimestamp(fileName: string): Date | null {\n    const base = fileName.split(\"/\").pop() ?? fileName;\n    const match = base.match(/-(\\d{8})T(\\d{6})Z\\.dump$/);\n    if (!match) return null;\n    const [, ymd, hms] = match;\n    const iso =\n        `${ymd.slice(0, 4)}-${ymd.slice(4, 6)}-${ymd.slice(6, 8)}` +\n        `T${hms.slice(0, 2)}:${hms.slice(2, 4)}:${hms.slice(4, 6)}Z`;\n    const date = new Date(iso);\n    return Number.isNaN(date.getTime()) ? null : date;\n}\n\n/**\n * A backup is two files: the `.dump`, and beside it a `.globals.sql` holding\n * the cluster roles the dump's GRANTs and RLS policies name. Without that\n * sidecar a restore into a fresh cluster stops at the first GRANT to a role\n * that does not exist there. The CLI uploads, restores and prunes the two as\n * a pair. This listing used to know only the `.dump`, so a backup downloaded\n * from Studio arrived without its roles.\n *\n * The suffix mirrors `globalsFileForDump` in `@rebasepro/server-postgres`.\n */\nconst DUMP_SUFFIX = \".dump\";\nconst GLOBALS_SUFFIX = \".globals.sql\";\n\nfunction globalsKeyFor(dumpKey: string): string {\n    return dumpKey.slice(0, -DUMP_SUFFIX.length) + GLOBALS_SUFFIX;\n}\n\n/** The only files the download route will serve. */\nfunction isBackupFile(key: string): boolean {\n    return key.endsWith(DUMP_SUFFIX) || key.endsWith(GLOBALS_SUFFIX);\n}\n\n/**\n * List the backups at a destination as {@link BackupInfo}, newest first.\n * One entry per `.dump`, with its `.globals.sql` sidecar attached as\n * `globalsKey` when there is one.\n */\nexport async function listBackupObjects(\n    dest: BackupDestination,\n    storage?: StorageController\n): Promise<BackupInfo[]> {\n    if (dest.kind === \"local\") {\n        if (!fs.existsSync(dest.path)) return [];\n        const stat = fs.statSync(dest.path);\n        const dir = stat.isDirectory() ? dest.path : path.dirname(dest.path);\n        if (!fs.existsSync(dir)) return [];\n        const files = fs.readdirSync(dir);\n        const present = new Set(files);\n        return files\n            .filter((f) => f.endsWith(DUMP_SUFFIX))\n            .map((f): BackupInfo => {\n                const full = path.join(dir, f);\n                const st = fs.statSync(full);\n                const createdAt = parseBackupTimestamp(f) ?? st.mtime;\n                const globals = globalsKeyFor(f);\n                return {\n                    key: full,\n                    name: f,\n                    sizeBytes: st.size,\n                    createdAt: createdAt.toISOString(),\n                    destinationKind: \"local\",\n                    ...(present.has(globals) ? { globalsKey: path.join(dir, globals) } : {})\n                };\n            })\n            .sort(byNewest);\n    }\n\n    if (!storage) return [];\n    const result = await storage.listObjects(dest.prefix ? `${dest.prefix}/` : \"\", {\n        bucket: dest.bucket,\n        maxResults: 1000\n    });\n    const keys = result.items.map((item) => item.fullPath);\n    const present = new Set(keys);\n    return keys\n        .filter((key) => key.endsWith(DUMP_SUFFIX))\n        .map((key): BackupInfo => {\n            const createdAt = parseBackupTimestamp(key);\n            const globals = globalsKeyFor(key);\n            return {\n                key,\n                name: key.split(\"/\").pop() || key,\n                createdAt: createdAt ? createdAt.toISOString() : undefined,\n                destinationKind: dest.kind as BackupDestinationKind,\n                ...(present.has(globals) ? { globalsKey: globals } : {})\n            };\n        })\n        .sort(byNewest);\n}\n\nfunction byNewest(a: BackupInfo, b: BackupInfo): number {\n    const ta = a.createdAt ? Date.parse(a.createdAt) : 0;\n    const tb = b.createdAt ? Date.parse(b.createdAt) : 0;\n    return tb - ta;\n}\n\n/** Read a single backup's bytes. Guards against path traversal for local. */\nexport async function readBackupBytes(\n    dest: BackupDestination,\n    key: string,\n    storage?: StorageController\n): Promise<{ bytes: Uint8Array<ArrayBuffer>; name: string } | null> {\n    if (dest.kind === \"local\") {\n        const stat = fs.existsSync(dest.path) ? fs.statSync(dest.path) : null;\n        const dir = stat?.isDirectory() ? dest.path : path.dirname(dest.path);\n        const resolvedDir = path.resolve(dir);\n        const resolved = path.resolve(key);\n        // Only allow reads inside the backup directory, and only backup files.\n        if (!resolved.startsWith(resolvedDir + path.sep) || !isBackupFile(resolved)) {\n            return null;\n        }\n        if (!fs.existsSync(resolved)) return null;\n        return { bytes: new Uint8Array(fs.readFileSync(resolved)), name: path.basename(resolved) };\n    }\n\n    if (!storage) return null;\n    if (!isBackupFile(key)) return null;\n    const file = await storage.getObject(key, dest.bucket);\n    if (!file) return null;\n    return { bytes: new Uint8Array(await file.arrayBuffer()), name: key.split(\"/\").pop() || key };\n}\n","import { Hono } from \"hono\";\nimport type { HonoEnv } from \"../api/types\";\nimport { ApiError, errorHandler } from \"../api/errors\";\nimport type { StorageController } from \"../storage\";\nimport { BackupDestination, listBackupObjects, readBackupBytes } from \"./backup-common\";\n\nexport interface BackupRoutesConfig {\n    /**\n     * Resolve the current backup destination, or `null` when backups are not\n     * configured (`BACKUP_DESTINATION` unset). Read lazily so a restart isn't\n     * required to pick up config.\n     */\n    getDestination: () => BackupDestination | null;\n    /** Storage controller for object-storage destinations. */\n    storage?: StorageController;\n}\n\n/**\n * Admin REST routes for the Backups panel.\n *\n * Routes (mounted under `/admin/backups`, admin-guarded by the caller):\n *   GET /            → list available backups\n *   GET /download    → download a backup's bytes (?key=…)\n */\nexport function createBackupRoutes(config: BackupRoutesConfig): Hono<HonoEnv> {\n    const router = new Hono<HonoEnv>();\n    router.onError(errorHandler);\n\n    router.get(\"/\", async (c) => {\n        const dest = config.getDestination();\n        if (!dest) {\n            return c.json({ backups: [], destinationKind: \"local\" as const, configured: false });\n        }\n        const backups = await listBackupObjects(dest, config.storage);\n        return c.json({ backups, destinationKind: dest.kind, configured: true });\n    });\n\n    router.get(\"/download\", async (c) => {\n        const dest = config.getDestination();\n        if (!dest) {\n            throw ApiError.badRequest(\"Backups are not configured (set BACKUP_DESTINATION).\");\n        }\n        const key = c.req.query(\"key\");\n        if (!key) {\n            throw ApiError.badRequest(\"Missing 'key' query parameter.\");\n        }\n        const result = await readBackupBytes(dest, key, config.storage);\n        if (!result) {\n            throw ApiError.notFound(`Backup not found: ${key}`);\n        }\n        c.header(\"Content-Type\", \"application/octet-stream\");\n        c.header(\"Content-Disposition\", `attachment; filename=\"${result.name}\"`);\n        return c.body(result.bytes);\n    });\n\n    return router;\n}\n","/**\n * Storage-generic backup helpers and admin routes for the Backups panel.\n * The `pg_dump`/`pg_restore` machinery lives in `@rebasepro/server-postgres`.\n */\nexport * from \"./backup-common\";\nexport { createBackupRoutes } from \"./backup-routes\";\nexport type { BackupRoutesConfig } from \"./backup-routes\";\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAoBA,SAAgB,uBAAuB,KAAgC;CACnE,MAAM,KAAK,IAAI,MAAM,yBAAyB;CAC9C,IAAI,IAAI,OAAO;EAAE,MAAM;EAAM,QAAQ,GAAG;EAAI,QAAQ,GAAG,EAAE,CAAC,QAAQ,QAAQ,EAAE;CAAE;CAC9E,MAAM,MAAM,IAAI,MAAM,yBAAyB;CAC/C,IAAI,KAAK,OAAO;EAAE,MAAM;EAAO,QAAQ,IAAI;EAAI,QAAQ,IAAI,EAAE,CAAC,QAAQ,QAAQ,EAAE;CAAE;CAClF,OAAO;EAAE,MAAM;EAAS,MAAM;CAAI;AACtC;;;;;AAMA,SAAgB,qBAAqB,UAA+B;CAEhE,MAAM,SADO,SAAS,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK,SAAA,CACvB,MAAM,0BAA0B;CACnD,IAAI,CAAC,OAAO,OAAO;CACnB,MAAM,GAAG,KAAK,OAAO;CACrB,MAAM,MACF,GAAG,IAAI,MAAM,GAAG,CAAC,EAAE,GAAG,IAAI,MAAM,GAAG,CAAC,EAAE,GAAG,IAAI,MAAM,GAAG,CAAC,EAAA,GACnD,IAAI,MAAM,GAAG,CAAC,EAAE,GAAG,IAAI,MAAM,GAAG,CAAC,EAAE,GAAG,IAAI,MAAM,GAAG,CAAC,EAAE;CAC9D,MAAM,OAAO,IAAI,KAAK,GAAG;CACzB,OAAO,OAAO,MAAM,KAAK,QAAQ,CAAC,IAAI,OAAO;AACjD;;;;;;;;;;;AAYA,IAAM,cAAc;AACpB,IAAM,iBAAiB;AAEvB,SAAS,cAAc,SAAyB;CAC5C,OAAO,QAAQ,MAAM,GAAG,EAAmB,IAAI;AACnD;;AAGA,SAAS,aAAa,KAAsB;CACxC,OAAO,IAAI,SAAS,WAAW,KAAK,IAAI,SAAS,cAAc;AACnE;;;;;;AAOA,eAAsB,kBAClB,MACA,SACqB;CACrB,IAAI,KAAK,SAAS,SAAS;EACvB,IAAI,CAAC,GAAG,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC;EAEvC,MAAM,MADO,GAAG,SAAS,KAAK,IAClB,CAAA,CAAK,YAAY,IAAI,KAAK,OAAO,KAAK,QAAQ,KAAK,IAAI;EACnE,IAAI,CAAC,GAAG,WAAW,GAAG,GAAG,OAAO,CAAC;EACjC,MAAM,QAAQ,GAAG,YAAY,GAAG;EAChC,MAAM,UAAU,IAAI,IAAI,KAAK;EAC7B,OAAO,MACF,QAAQ,MAAM,EAAE,SAAS,WAAW,CAAC,CAAC,CACtC,KAAK,MAAkB;GACpB,MAAM,OAAO,KAAK,KAAK,KAAK,CAAC;GAC7B,MAAM,KAAK,GAAG,SAAS,IAAI;GAC3B,MAAM,YAAY,qBAAqB,CAAC,KAAK,GAAG;GAChD,MAAM,UAAU,cAAc,CAAC;GAC/B,OAAO;IACH,KAAK;IACL,MAAM;IACN,WAAW,GAAG;IACd,WAAW,UAAU,YAAY;IACjC,iBAAiB;IACjB,GAAI,QAAQ,IAAI,OAAO,IAAI,EAAE,YAAY,KAAK,KAAK,KAAK,OAAO,EAAE,IAAI,CAAC;GAC1E;EACJ,CAAC,CAAC,CACD,KAAK,QAAQ;CACtB;CAEA,IAAI,CAAC,SAAS,OAAO,CAAC;CAKtB,MAAM,QAAO,MAJQ,QAAQ,YAAY,KAAK,SAAS,GAAG,KAAK,OAAO,KAAK,IAAI;EAC3E,QAAQ,KAAK;EACb,YAAY;CAChB,CAAC,EAAA,CACmB,MAAM,KAAK,SAAS,KAAK,QAAQ;CACrD,MAAM,UAAU,IAAI,IAAI,IAAI;CAC5B,OAAO,KACF,QAAQ,QAAQ,IAAI,SAAS,WAAW,CAAC,CAAC,CAC1C,KAAK,QAAoB;EACtB,MAAM,YAAY,qBAAqB,GAAG;EAC1C,MAAM,UAAU,cAAc,GAAG;EACjC,OAAO;GACH;GACA,MAAM,IAAI,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK;GAC9B,WAAW,YAAY,UAAU,YAAY,IAAI,KAAA;GACjD,iBAAiB,KAAK;GACtB,GAAI,QAAQ,IAAI,OAAO,IAAI,EAAE,YAAY,QAAQ,IAAI,CAAC;EAC1D;CACJ,CAAC,CAAC,CACD,KAAK,QAAQ;AACtB;AAEA,SAAS,SAAS,GAAe,GAAuB;CACpD,MAAM,KAAK,EAAE,YAAY,KAAK,MAAM,EAAE,SAAS,IAAI;CAEnD,QADW,EAAE,YAAY,KAAK,MAAM,EAAE,SAAS,IAAI,KACvC;AAChB;;AAGA,eAAsB,gBAClB,MACA,KACA,SACgE;CAChE,IAAI,KAAK,SAAS,SAAS;EAEvB,MAAM,OADO,GAAG,WAAW,KAAK,IAAI,IAAI,GAAG,SAAS,KAAK,IAAI,IAAI,KAAA,EAC/C,YAAY,IAAI,KAAK,OAAO,KAAK,QAAQ,KAAK,IAAI;EACpE,MAAM,cAAc,KAAK,QAAQ,GAAG;EACpC,MAAM,WAAW,KAAK,QAAQ,GAAG;EAEjC,IAAI,CAAC,SAAS,WAAW,cAAc,KAAK,GAAG,KAAK,CAAC,aAAa,QAAQ,GACtE,OAAO;EAEX,IAAI,CAAC,GAAG,WAAW,QAAQ,GAAG,OAAO;EACrC,OAAO;GAAE,OAAO,IAAI,WAAW,GAAG,aAAa,QAAQ,CAAC;GAAG,MAAM,KAAK,SAAS,QAAQ;EAAE;CAC7F;CAEA,IAAI,CAAC,SAAS,OAAO;CACrB,IAAI,CAAC,aAAa,GAAG,GAAG,OAAO;CAC/B,MAAM,OAAO,MAAM,QAAQ,UAAU,KAAK,KAAK,MAAM;CACrD,IAAI,CAAC,MAAM,OAAO;CAClB,OAAO;EAAE,OAAO,IAAI,WAAW,MAAM,KAAK,YAAY,CAAC;EAAG,MAAM,IAAI,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK;CAAI;AAChG;;;;;;;;;;AClIA,SAAgB,mBAAmB,QAA2C;CAC1E,MAAM,SAAS,IAAI,KAAc;CACjC,OAAO,QAAQ,YAAY;CAE3B,OAAO,IAAI,KAAK,OAAO,MAAM;EACzB,MAAM,OAAO,OAAO,eAAe;EACnC,IAAI,CAAC,MACD,OAAO,EAAE,KAAK;GAAE,SAAS,CAAC;GAAG,iBAAiB;GAAkB,YAAY;EAAM,CAAC;EAEvF,MAAM,UAAU,MAAM,kBAAkB,MAAM,OAAO,OAAO;EAC5D,OAAO,EAAE,KAAK;GAAE;GAAS,iBAAiB,KAAK;GAAM,YAAY;EAAK,CAAC;CAC3E,CAAC;CAED,OAAO,IAAI,aAAa,OAAO,MAAM;EACjC,MAAM,OAAO,OAAO,eAAe;EACnC,IAAI,CAAC,MACD,MAAM,SAAS,WAAW,sDAAsD;EAEpF,MAAM,MAAM,EAAE,IAAI,MAAM,KAAK;EAC7B,IAAI,CAAC,KACD,MAAM,SAAS,WAAW,gCAAgC;EAE9D,MAAM,SAAS,MAAM,gBAAgB,MAAM,KAAK,OAAO,OAAO;EAC9D,IAAI,CAAC,QACD,MAAM,SAAS,SAAS,qBAAqB,KAAK;EAEtD,EAAE,OAAO,gBAAgB,0BAA0B;EACnD,EAAE,OAAO,uBAAuB,yBAAyB,OAAO,KAAK,EAAE;EACvE,OAAO,EAAE,KAAK,OAAO,KAAK;CAC9B,CAAC;CAED,OAAO;AACX"}

package/dist/cron-routes-cv0hSd-O.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"cron-routes-cv0hSd-O.js","names":[],"sources":["../src/cron/cron-routes.ts"],"sourcesContent":["import { Hono } from \"hono\";\nimport type { HonoEnv } from \"../api/types\";\nimport type { CronScheduler } from \"./cron-scheduler\";\nimport { ApiError, errorHandler } from \"../api/errors\";\nimport { resolveListLimitParam } from \"../api/rest/query-parser\";\n\n/**\n * Create admin REST routes for managing cron jobs.\n *\n * Routes:\n *   GET    /          → list all cron jobs\n *   GET    /:id       → get a single job's status\n *   POST   /:id/trigger → manually trigger a job\n *   GET    /:id/logs  → get execution logs for a job\n *   PUT    /:id       → update job (enable/disable)\n */\nexport function createCronRoutes(scheduler: CronScheduler, skipped = 0): Hono<HonoEnv> {\n    const router = new Hono<HonoEnv>();\n    // Hono's onError does NOT propagate from parent to child routers, so this\n    // child router registers its own handler to format thrown ApiErrors.\n    router.onError(errorHandler);\n\n    // List all jobs\n    router.get(\"/\", (c) => {\n        const jobs = scheduler.listJobs();\n        // A file that failed to load is not a job, so it appears nowhere in\n        // this list — and \"my job is missing\" and \"my job is not scheduled\"\n        // look identical from here. Say how many were dropped, as the\n        // functions listing does, so the Studio panel and anyone with curl can\n        // see it without boot-log access.\n        //\n        // Two ways to be dropped, counted together and reported apart. A file\n        // the loader could not read has only a count: the failure happened\n        // before there was a job to name. A schedule the scheduler refused has a\n        // name and a reason — most often \"Expected 5 fields, got 6\", from an\n        // expression copied out of a tool that supports seconds — and quoting it\n        // here turns a job that silently never fires into a one-line fix.\n        const rejected = scheduler.listRejectedJobs();\n        const total = skipped + rejected.length;\n        return c.json({\n            jobs,\n            ...(total > 0 && {\n                skipped: total,\n                ...(rejected.length > 0 && { rejected }),\n                note: [\n                    skipped > 0 ? `${skipped} cron file(s) failed to load` : undefined,\n                    rejected.length > 0 ? `${rejected.length} job(s) have an invalid schedule` : undefined\n                ].filter(Boolean).join(\" and \") +\n                    \" — NOT scheduled. \" +\n                    (rejected.length > 0\n                        ? \"See `rejected` for the reason; \"\n                        : \"\") +\n                    \"the server log has the rest.\"\n            })\n        });\n    });\n\n    // Get single job\n    router.get(\"/:id\", (c) => {\n        const id = c.req.param(\"id\");\n        const job = scheduler.getJob(id);\n        if (!job) {\n            throw ApiError.notFound(`Cron job \"${id}\" not found`);\n        }\n        return c.json({ job });\n    });\n\n    // Trigger a job manually\n    router.post(\"/:id/trigger\", async (c) => {\n        const id = c.req.param(\"id\");\n        const job = scheduler.getJob(id);\n        if (!job) {\n            throw ApiError.notFound(`Cron job \"${id}\" not found`);\n        }\n\n        const log = await scheduler.triggerJob(id);\n        return c.json({ log,\njob: scheduler.getJob(id) });\n    });\n\n    // Get job logs\n    router.get(\"/:id/logs\", async (c) => {\n        const id = c.req.param(\"id\");\n        // Validated, not `parseInt`-ed. `?limit=abc` used to reach the store as\n        // `NaN`, where Postgres refused `LIMIT NaN`, the store swallowed the\n        // error and returned `[]` — a 200 with an empty list, which reads as\n        // \"this job has never run\". The data plane answers 400 for the same\n        // input; so does this now.\n        const limit = resolveListLimitParam(c.req.query(\"limit\") ?? null, { defaultLimit: 50 });\n\n        const job = scheduler.getJob(id);\n        if (!job) {\n            throw ApiError.notFound(`Cron job \"${id}\" not found`);\n        }\n\n        const logs = await scheduler.getJobLogsFromDb(id, limit);\n        return c.json({ logs });\n    });\n\n    // Enable/disable a job\n    router.put(\"/:id\", async (c) => {\n        const id = c.req.param(\"id\");\n        const body = await c.req.json().catch(() => ({})) as { enabled: boolean };\n\n        if (typeof body.enabled !== \"boolean\") {\n            throw ApiError.badRequest(\"Missing 'enabled' boolean in body\");\n        }\n\n        const job = scheduler.setJobEnabled(id, body.enabled);\n        if (!job) {\n            throw ApiError.notFound(`Cron job \"${id}\" not found`);\n        }\n\n        return c.json({ job });\n    });\n\n    return router;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAgBA,SAAgB,iBAAiB,WAA0B,UAAU,GAAkB;CACnF,MAAM,SAAS,IAAI,KAAc;CAGjC,OAAO,QAAQ,YAAY;CAG3B,OAAO,IAAI,MAAM,MAAM;EACnB,MAAM,OAAO,UAAU,SAAS;EAahC,MAAM,WAAW,UAAU,iBAAiB;EAC5C,MAAM,QAAQ,UAAU,SAAS;EACjC,OAAO,EAAE,KAAK;GACV;GACA,GAAI,QAAQ,KAAK;IACb,SAAS;IACT,GAAI,SAAS,SAAS,KAAK,EAAE,SAAS;IACtC,MAAM,CACF,UAAU,IAAI,GAAG,QAAQ,gCAAgC,KAAA,GACzD,SAAS,SAAS,IAAI,GAAG,SAAS,OAAO,oCAAoC,KAAA,CACjF,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,KAAK,OAAO,IAC1B,wBACC,SAAS,SAAS,IACb,oCACA,MACN;GACR;EACJ,CAAC;CACL,CAAC;CAGD,OAAO,IAAI,SAAS,MAAM;EACtB,MAAM,KAAK,EAAE,IAAI,MAAM,IAAI;EAC3B,MAAM,MAAM,UAAU,OAAO,EAAE;EAC/B,IAAI,CAAC,KACD,MAAM,SAAS,SAAS,aAAa,GAAG,YAAY;EAExD,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC;CACzB,CAAC;CAGD,OAAO,KAAK,gBAAgB,OAAO,MAAM;EACrC,MAAM,KAAK,EAAE,IAAI,MAAM,IAAI;EAE3B,IAAI,CADQ,UAAU,OAAO,EACxB,GACD,MAAM,SAAS,SAAS,aAAa,GAAG,YAAY;EAGxD,MAAM,MAAM,MAAM,UAAU,WAAW,EAAE;EACzC,OAAO,EAAE,KAAK;GAAE;GACxB,KAAK,UAAU,OAAO,EAAE;EAAE,CAAC;CACvB,CAAC;CAGD,OAAO,IAAI,aAAa,OAAO,MAAM;EACjC,MAAM,KAAK,EAAE,IAAI,MAAM,IAAI;EAM3B,MAAM,QAAQ,sBAAsB,EAAE,IAAI,MAAM,OAAO,KAAK,MAAM,EAAE,cAAc,GAAG,CAAC;EAGtF,IAAI,CADQ,UAAU,OAAO,EACxB,GACD,MAAM,SAAS,SAAS,aAAa,GAAG,YAAY;EAGxD,MAAM,OAAO,MAAM,UAAU,iBAAiB,IAAI,KAAK;EACvD,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC;CAC1B,CAAC;CAGD,OAAO,IAAI,QAAQ,OAAO,MAAM;EAC5B,MAAM,KAAK,EAAE,IAAI,MAAM,IAAI;EAC3B,MAAM,OAAO,MAAM,EAAE,IAAI,KAAK,CAAC,CAAC,aAAa,CAAC,EAAE;EAEhD,IAAI,OAAO,KAAK,YAAY,WACxB,MAAM,SAAS,WAAW,mCAAmC;EAGjE,MAAM,MAAM,UAAU,cAAc,IAAI,KAAK,OAAO;EACpD,IAAI,CAAC,KACD,MAAM,SAAS,SAAS,aAAa,GAAG,YAAY;EAGxD,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC;CACzB,CAAC;CAED,OAAO;AACX"}

package/dist/cron-scheduler-COPQxlEq.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"cron-scheduler-COPQxlEq.js","names":[],"sources":["../../types/src/types/env_boolean.ts","../src/cron/scale-to-zero.ts","../src/cron/cron-scheduler.ts"],"sourcesContent":["const YES = new Set([\"true\", \"1\", \"yes\", \"on\"]);\nconst NO = new Set([\"false\", \"0\", \"no\", \"off\"]);\n\n/**\n * Read a boolean environment variable — one spelling rule for every reader.\n *\n * `true`, `1`, `yes` and `on` are true; `false`, `0`, `no` and `off` are\n * false. Case and surrounding whitespace are ignored. Anything else — unset,\n * blank, or a value that spells neither — is `undefined`, so the caller's\n * default decides and a typo lands on the side the caller chose:\n *\n * ```ts\n * parseEnvBoolean(env.FORCE_LOCAL_STORAGE) === true            // off unless said\n * parseEnvBoolean(env.REBASE_MCP_OPEN_REGISTRATION) !== false  // on unless said\n * ```\n *\n * It exists because every reader used to spell this itself, and they\n * disagreed. The reader that mattered tested the raw string for truthiness —\n * `!process.env.FORCE_LOCAL_STORAGE` — and every non-empty string is truthy,\n * so `FORCE_LOCAL_STORAGE=false`, written to say \"there is no durable volume\n * here\", switched the production storage guard off and sent uploads to a\n * container filesystem the next redeploy erased. Beside it, `=== \"true\"` made\n * `DISABLE_DB_ROLE_SWITCHING=1` do nothing and `!== \"false\"` made\n * `REBASE_MCP_OPEN_REGISTRATION=0` leave registration open.\n *\n * The boot schemas in `@rebasepro/server` (`loadEnv`, `loadBootEnv`) accept a\n * strict subset — `true`, `false` and blank — and refuse any other value\n * before the server starts. On that subset they read exactly what this reads,\n * so a variable a schema declares and something else reads lazily cannot mean\n * two different things.\n *\n * It lives in this package, with no dependencies, for the reason\n * {@link storageEnvSuffix} does: the runtime, its drivers and the CLI all read\n * these variables, and a second parser is a second chance to disagree.\n *\n * @group Models\n */\nexport function parseEnvBoolean(value: string | undefined): boolean | undefined {\n    if (value === undefined) return undefined;\n    const spelled = value.trim().toLowerCase();\n    if (YES.has(spelled)) return true;\n    if (NO.has(spelled)) return false;\n    return undefined;\n}\n","/**\n * Scale-to-zero detection for the cron scheduler.\n *\n * The scheduler drives jobs with in-process `setTimeout`. That works on any\n * always-running instance, but on a platform that freezes or evicts the\n * container between requests (Cloud Run with `--min-instances=0`, AWS Lambda,\n * Vercel functions) the timers simply never fire — the process boots, logs the\n * jobs as registered, and silently runs nothing.\n *\n * None of these platforms expose their scaling floor to the container, so this\n * detection is a heuristic: it identifies the *platform*, not the setting. It\n * is a warning only — it must never influence boot.\n *\n * Environment variables used here were verified against vendor documentation:\n *  - `K_SERVICE` / `K_REVISION` / `K_CONFIGURATION` — Cloud Run services\n *    (Cloud Run container contract; no variable exposes min-instances).\n *  - `CLOUD_RUN_JOB` — Cloud Run jobs (same contract).\n *  - `AWS_LAMBDA_FUNCTION_NAME` — reserved AWS Lambda runtime variable.\n *  - `VERCEL=1` — Vercel system environment variable, available at runtime.\n *  - `KUBERNETES_SERVICE_HOST` — injected into every pod by the kubelet. Used\n *    as an *exclusion*: a Deployment pod runs continuously, and Knative on\n *    Kubernetes also sets `K_SERVICE`, so a pod is never warned about.\n */\n\nimport { parseEnvBoolean } from \"@rebasepro/types\";\n\n/** Environment variable that permanently silences the scale-to-zero warning. */\nexport const CRON_ALWAYS_ON_ENV = \"REBASE_CRON_ALWAYS_ON\";\n\n/** The subset of `process.env` this module reads. */\nexport type EnvLike = Record<string, string | undefined>;\n\nexport interface FreezableRuntime {\n    /** Human-readable platform name, used verbatim in the warning. */\n    platform: string;\n    /** Names of the environment variables that identified the platform. */\n    signals: string[];\n}\n\n/** Minimal shape of a registered job needed to build the warning. */\nexport interface WarnableJob {\n    id: string;\n    enabled: boolean;\n}\n\nexport interface ScaleToZeroWarning {\n    message: string;\n    data: Record<string, unknown>;\n}\n\n/**\n * Identify a runtime whose instances can be frozen or torn down between\n * requests. Returns `undefined` when the platform is unknown or known to run\n * continuously.\n */\nexport function detectFreezableRuntime(env: EnvLike = process.env): FreezableRuntime | undefined {\n    // A Kubernetes pod (GKE, EKS, self-hosted) runs continuously. Knative and\n    // Cloud Run for Anthos set K_SERVICE *inside* a pod, so this exclusion has\n    // to come first or every Knative pod would be a false positive.\n    if (env.KUBERNETES_SERVICE_HOST) return undefined;\n\n    if (env.K_SERVICE) {\n        const signals = [\"K_SERVICE\"];\n        if (env.K_REVISION) signals.push(\"K_REVISION\");\n        if (env.K_CONFIGURATION) signals.push(\"K_CONFIGURATION\");\n        return { platform: \"Cloud Run\", signals };\n    }\n\n    if (env.CLOUD_RUN_JOB) {\n        return { platform: \"Cloud Run Jobs\", signals: [\"CLOUD_RUN_JOB\"] };\n    }\n\n    if (env.AWS_LAMBDA_FUNCTION_NAME) {\n        return { platform: \"AWS Lambda\", signals: [\"AWS_LAMBDA_FUNCTION_NAME\"] };\n    }\n\n    if (parseEnvBoolean(env.VERCEL) === true) {\n        return { platform: \"Vercel\", signals: [\"VERCEL\"] };\n    }\n\n    return undefined;\n}\n\n/** How many job ids to name before collapsing the rest into \"+N more\". */\nconst MAX_NAMED_JOBS = 10;\n\n/**\n * Build the boot-time warning, or `undefined` when it does not apply.\n *\n * Fires only when all of the following hold:\n *  1. `NODE_ENV=production` — a laptop or CI run is not at risk.\n *  2. At least one *enabled* job is registered — nothing to lose otherwise.\n *  3. The environment looks like a freezable platform (see above).\n *  4. `REBASE_CRON_ALWAYS_ON` is not set to a truthy value.\n */\nexport function buildScaleToZeroWarning(\n    jobs: WarnableJob[],\n    env: EnvLike = process.env\n): ScaleToZeroWarning | undefined {\n    if (env.NODE_ENV !== \"production\") return undefined;\n    if (parseEnvBoolean(env[CRON_ALWAYS_ON_ENV]) === true) return undefined;\n\n    const enabled = jobs.filter((job) => job.enabled).map((job) => job.id);\n    if (enabled.length === 0) return undefined;\n\n    const runtime = detectFreezableRuntime(env);\n    if (!runtime) return undefined;\n\n    const named = enabled.slice(0, MAX_NAMED_JOBS);\n    const list = enabled.length > named.length\n        ? `${named.join(\", \")} (+${enabled.length - named.length} more)`\n        : named.join(\", \");\n\n    const message = `[cron] ${runtime.platform} detected — in-process timers do not fire while an instance is frozen or scaled to zero, so ${enabled.length} enabled job(s) may never run: ${list}; drive them from an external scheduler instead (POST /api/cron/:id/trigger, e.g. Cloud Scheduler). ${runtime.platform} does not expose its scaling floor to the container, so an always-warm deployment cannot be confirmed from inside the process — set ${CRON_ALWAYS_ON_ENV}=1 to silence this if at least one instance is pinned warm.`;\n\n    return {\n        message,\n        data: {\n            platform: runtime.platform,\n            signals: runtime.signals,\n            jobs: enabled\n        }\n    };\n}\n","import type {\n    CronJobDefinition,\n    CronJobStatus,\n    CronJobLogEntry,\n    CronJobRunState,\n    CronJobContext\n} from \"@rebasepro/types\";\nimport type { RebaseServerClient } from \"@rebasepro/types\";\nimport type { LoadedCronJob } from \"./cron-loader\";\nimport type { CronStore } from \"./cron-store\";\nimport { logger, redactSensitiveText } from \"../utils/logger.js\";\nimport { buildScaleToZeroWarning } from \"./scale-to-zero.js\";\n\n// ─── Cron expression parser (minimal, no external dependency) ────────\n// Supports standard 5-field cron (minute hour dom month dow).\n// Returns the next Date after `after` that matches the expression.\n\n/**\n * Expand a single cron field into an ordered array of allowed values.\n * Supports: `*`, `N`, `N-M`, `N/S`, `N-M/S`, `*\\/S`, and comma-separated combinations.\n */\nfunction expandCronField(field: string, min: number, max: number): number[] {\n    const results = new Set<number>();\n    for (const segment of field.split(\",\")) {\n        const trimmed = segment.trim();\n        if (trimmed === \"*\") {\n            for (let i = min; i <= max; i++) results.add(i);\n        } else if (trimmed.includes(\"/\")) {\n            const [rangeStr, stepStr] = trimmed.split(\"/\");\n            const step = parseInt(stepStr, 10);\n            if (isNaN(step) || step <= 0) {\n                throw new Error(`Invalid step value \"${stepStr}\" in cron field \"${field}\"`);\n            }\n            let start = min;\n            let end = max;\n            if (rangeStr !== \"*\") {\n                if (rangeStr.includes(\"-\")) {\n                    const [a, b] = rangeStr.split(\"-\").map(Number);\n                    start = a;\n                    end = b;\n                } else {\n                    start = parseInt(rangeStr, 10);\n                }\n            }\n            for (let i = start; i <= end; i += step) results.add(i);\n        } else if (trimmed.includes(\"-\")) {\n            const [a, b] = trimmed.split(\"-\").map(Number);\n            for (let i = a; i <= b; i++) results.add(i);\n        } else {\n            const val = parseInt(trimmed, 10);\n            if (isNaN(val)) {\n                throw new Error(`Invalid value \"${trimmed}\" in cron field \"${field}\"`);\n            }\n            results.add(val);\n        }\n    }\n    return [...results].sort((a, b) => a - b);\n}\n\n/**\n * Validates a standard 5-field cron expression structurally and semantically.\n * Returns `{ valid: true }` or `{ valid: false, reason: string }`.\n */\nexport function validateCronExpression(schedule: string): { valid: true } | { valid: false; reason: string } {\n    if (!schedule || typeof schedule !== \"string\") {\n        return { valid: false,\nreason: \"Schedule must be a non-empty string\" };\n    }\n    const parts = schedule.trim().split(/\\s+/);\n    if (parts.length !== 5) {\n        return { valid: false,\nreason: `Expected 5 fields, got ${parts.length}` };\n    }\n    const fieldRanges: [string, number, number][] = [\n        [\"minute\", 0, 59],\n        [\"hour\", 0, 23],\n        [\"day of month\", 1, 31],\n        [\"month\", 1, 12],\n        [\"day of week\", 0, 6]\n    ];\n    for (let i = 0; i < 5; i++) {\n        const [name, min, max] = fieldRanges[i];\n        try {\n            const values = expandCronField(parts[i], min, max);\n            if (values.length === 0) {\n                return { valid: false,\nreason: `${name} field \"${parts[i]}\" produces no values` };\n            }\n            for (const v of values) {\n                if (v < min || v > max) {\n                    return { valid: false,\nreason: `${name} field value ${v} out of range [${min}–${max}]` };\n                }\n            }\n        } catch (err) {\n            return { valid: false,\nreason: `${name} field: ${err instanceof Error ? err.message : String(err)}` };\n        }\n    }\n    return { valid: true };\n}\n\n/** The five cron fields, pre-expanded into the values each one allows. */\ninterface CronFields {\n    minutes: number[];\n    hours: number[];\n    doms: number[];\n    months: number[];\n    dows: number[];\n}\n\n/** Expand all five fields of an expression. Throws on invalid expressions. */\nfunction parseCronFields(expression: string): CronFields {\n    const parts = expression.trim().split(/\\s+/);\n    if (parts.length < 5) {\n        throw new Error(`Invalid cron expression: \"${expression}\". Expected 5 fields.`);\n    }\n    const [minField, hourField, domField, monField, dowField] = parts;\n    return {\n        minutes: expandCronField(minField, 0, 59),\n        hours: expandCronField(hourField, 0, 23),\n        doms: expandCronField(domField, 1, 31),\n        months: expandCronField(monField, 1, 12),\n        dows: expandCronField(dowField, 0, 6) // 0=Sunday\n    };\n}\n\n/**\n * Whether an IANA zone name is one this runtime can read a schedule in.\n *\n * `Intl` is the authority: it throws a RangeError on a name it does not know,\n * which is the only check that tracks the tz database the process actually\n * ships. A misspelled zone must fail when the job loads, not silently read\n * the schedule as local time.\n */\nexport function isValidTimeZone(zone: string): boolean {\n    try {\n        new Intl.DateTimeFormat(\"en-US\", { timeZone: zone });\n        return true;\n    } catch {\n        return false;\n    }\n}\n\n/** Wall-clock parts of an instant, in a zone, as the cron fields see them. */\ninterface WallClock {\n    minute: number;\n    hour: number;\n    dom: number;\n    month: number;\n    dow: number;\n}\n\nconst formatters = new Map<string, Intl.DateTimeFormat>();\nconst DOW: Record<string, number> = { Sun: 0, Mon: 1, Tue: 2, Wed: 3, Thu: 4, Fri: 5, Sat: 6 };\n\nfunction wallClockIn(candidate: Date, zone: string): WallClock {\n    let formatter = formatters.get(zone);\n    if (!formatter) {\n        formatter = new Intl.DateTimeFormat(\"en-US\", {\n            timeZone: zone,\n            hourCycle: \"h23\",\n            weekday: \"short\",\n            month: \"numeric\",\n            day: \"numeric\",\n            hour: \"numeric\",\n            minute: \"numeric\"\n        });\n        formatters.set(zone, formatter);\n    }\n    const parts: Record<string, string> = {};\n    for (const part of formatter.formatToParts(candidate)) parts[part.type] = part.value;\n    return {\n        minute: Number(parts.minute),\n        hour: Number(parts.hour),\n        dom: Number(parts.day),\n        month: Number(parts.month),\n        dow: DOW[parts.weekday] ?? candidate.getDay()\n    };\n}\n\n/**\n * Whether a minute-precision instant matches every field of the expression.\n *\n * Read in `zone` when one is named, else in the process's own zone — which is\n * whatever the host is set to, UTC in nearly every container. A schedule that\n * names its zone means the same wall-clock hour on every host it runs on.\n */\nfunction matchesCronFields(candidate: Date, fields: CronFields, zone?: string): boolean {\n    const wall: WallClock = zone\n        ? wallClockIn(candidate, zone)\n        : {\n            minute: candidate.getMinutes(),\n            hour: candidate.getHours(),\n            dom: candidate.getDate(),\n            month: candidate.getMonth() + 1, // getMonth is 0-11\n            dow: candidate.getDay()\n        };\n    return fields.months.includes(wall.month)\n        && fields.doms.includes(wall.dom)\n        && fields.dows.includes(wall.dow)\n        && fields.hours.includes(wall.hour)\n        && fields.minutes.includes(wall.minute);\n}\n\n/** ~1 year in minutes — the walk bound for both search directions. */\n/**\n * How far forward to look for the next matching slot.\n *\n * Four years and a day, not one year. `0 0 29 2 *` — run on 29 February — is a\n * legitimate expression whose slot can be almost four years out, and a one-year\n * search never found it.\n */\nconst MAX_SLOT_SEARCH_MINUTES = 4 * 525960 + 1440;\n\n/**\n * Calculate the next Date after `after` that matches the cron expression.\n * Throws on invalid expressions.\n */\nexport function parseCronExpression(expression: string, after: Date, timezone?: string): Date {\n    const fields = parseCronFields(expression);\n\n    // Forward-search from `after + 1 minute`\n    const candidate = new Date(after);\n    candidate.setSeconds(0, 0);\n    candidate.setMinutes(candidate.getMinutes() + 1);\n\n    for (let i = 0; i < MAX_SLOT_SEARCH_MINUTES; i++) {\n        if (matchesCronFields(candidate, fields, timezone)) {\n            return candidate;\n        }\n        candidate.setMinutes(candidate.getMinutes() + 1);\n    }\n\n    // No slot inside the window. Refuse rather than invent one.\n    //\n    // This used to return `after + 1 minute`, which is indistinguishable from a\n    // schedule that really does fire every minute — so an expression with no\n    // reachable slot ran sixty times an hour, forever. `0 0 29 2 *` was caught\n    // by it while the search window was a single year: a job meant to run once\n    // every four years became the busiest job on the deployment.\n    //\n    // The caller schedules inside a `try` and reports a job it could not\n    // schedule, which is the correct outcome for an expression that names no\n    // time. Genuinely impossible dates (`0 0 31 2 *`) land here too, and should.\n    throw new Error(\n        `Cron expression \"${expression}\" has no matching time within ` +\n        `${Math.round(MAX_SLOT_SEARCH_MINUTES / 525960)} years of ${after.toISOString()}. ` +\n        \"Check the day-of-month and month fields — a date such as 31 February never occurs.\"\n    );\n}\n\n/**\n * The latest slot matching `expression` within the inclusive window\n * `[from, to]`, or `undefined` when the expression has no slot in it.\n *\n * Walks backwards a minute at a time from `to`, so the first hit is already\n * the answer — in the common case (a job that ran normally moments ago) that\n * is a handful of iterations, not a scan of the whole window.\n *\n * `to`'s own minute is included: an instance booting at 06:00:30 has *not* run\n * the 06:00 slot — `parseCronExpression` already skipped past it to tomorrow —\n * so that slot is genuinely missed and must be a candidate.\n *\n * Seconds and milliseconds are zeroed to match how `parseCronExpression`\n * builds a slot, so the same wall-clock slot serialises to a byte-identical\n * ISO string down either path. The claim key depends on that.\n */\nexport function findMostRecentSlot(expression: string, from: Date, to: Date, timezone?: string): Date | undefined {\n    const fields = parseCronFields(expression);\n\n    const candidate = new Date(to);\n    candidate.setSeconds(0, 0);\n\n    for (let i = 0; i < MAX_SLOT_SEARCH_MINUTES && candidate.getTime() >= from.getTime(); i++) {\n        if (matchesCronFields(candidate, fields, timezone)) {\n            return candidate;\n        }\n        candidate.setMinutes(candidate.getMinutes() - 1);\n    }\n\n    return undefined;\n}\n\n// ─── In-memory ring buffer for logs ──────────────────────────────────\n\nconst MAX_LOGS_PER_JOB = 50;\n\n/**\n * Minimum milliseconds between scheduled executions of the same job.\n * Prevents tight re-execution loops caused by jitter or clock drift.\n */\nconst MIN_SCHEDULE_INTERVAL_MS = 5_000; // 5 seconds\n\n/**\n * Largest delay setTimeout can hold. Node stores it in a 32-bit signed int;\n * anything larger silently clamps to 1ms and fires immediately, so a slot\n * further out than this must be reached in hops rather than one timer.\n */\nconst MAX_TIMER_DELAY_MS = 2_147_483_647; // 2^31 - 1, ~24.8 days\n\n// ─── CronScheduler ───────────────────────────────────────────────────\n\ninterface RegisteredJob {\n    id: string;\n    definition: CronJobDefinition;\n    enabled: boolean;\n    state: CronJobRunState;\n    lastRunAt?: Date;\n    nextRunAt?: Date;\n    lastDurationMs?: number;\n    lastError?: string;\n    totalRuns: number;\n    totalFailures: number;\n    timerId?: ReturnType<typeof setTimeout>;\n    logs: CronJobLogEntry[];\n    /** True while a handler is actively executing (prevents concurrent runs). */\n    executing: boolean;\n}\n\n/**\n * A job the scheduler refused, and why.\n *\n * It is not a `CronJobStatus`: it has no state, no next run and no counters,\n * because it was never registered. Reporting it as a job with `state: \"error\"`\n * would be a lie in the other direction — nothing is going to run it.\n */\nexport interface RejectedCronJob {\n    id: string;\n    name: string;\n    schedule: string;\n    reason: string;\n}\n\nexport class CronScheduler {\n    private jobs = new Map<string, RegisteredJob>();\n    private rejected = new Map<string, RejectedCronJob>();\n    private started = false;\n    private store?: CronStore;\n    private client?: RebaseServerClient;\n\n    /**\n     * Set the server singleton to make it available to cron job handlers.\n     *\n     * `RebaseServerClient`, not `RebaseClient`: the object `init.ts` passes is\n     * the same one it registers as the singleton, so this was always the true\n     * type — and the wider annotation is what let `ctx.client.data` look like a\n     * user-scoped plane inside a cron, when it is the admin-scoped one.\n     */\n    setClient(client: RebaseServerClient): void {\n        this.client = client;\n    }\n\n    /**\n     * Attach a persistence store for cron logs.\n     * When set, execution logs are written to the database after each run,\n     * and counters are seeded from the database on start.\n     */\n    setStore(store: CronStore): void {\n        this.store = store;\n    }\n\n    /**\n     * Register a batch of loaded cron jobs.\n     *\n     * If the scheduler is already started, newly registered jobs are\n     * automatically scheduled (so late-registered jobs don't sit idle).\n     *\n     * Validates the cron schedule on registration — invalid schedules\n     * are rejected with a warning and the job is NOT registered.\n     */\n    registerJobs(loadedJobs: LoadedCronJob[]): void {\n        for (const loaded of loadedJobs) {\n            // Validate schedule up-front — reject invalid schedules\n            const validation = validateCronExpression(loaded.definition.schedule);\n            if (!validation.valid) {\n                logger.error(`[cron] Rejecting job \"${loaded.id}\": invalid schedule \"${loaded.definition.schedule}\" — ${validation.reason}`);\n                // Kept, not just logged. A rejected job is absent from\n                // `listJobs()`, so from the Studio panel it is indistinguishable\n                // from a file that was never written — and the commonest reason\n                // to land here is a 6-field expression copied from a tool that\n                // supports seconds, which is a one-character fix nobody could\n                // see without boot-log access.\n                this.rejected.set(loaded.id, {\n                    id: loaded.id,\n                    name: loaded.definition.name ?? loaded.id,\n                    schedule: loaded.definition.schedule,\n                    reason: validation.reason\n                });\n                continue;\n            }\n            // Rejected, not read as local time: a misspelled zone that fell\n            // back silently would fire at the wrong hour on every host and\n            // look like a scheduler bug. Kept in `rejected` for the same reason\n            // a bad schedule is — otherwise the panel cannot tell it from a\n            // file nobody wrote.\n            if (loaded.definition.timezone !== undefined && !isValidTimeZone(loaded.definition.timezone)) {\n                const reason =\n                    `unknown timezone \"${loaded.definition.timezone}\" — ` +\n                    'use an IANA name such as \"Europe/Madrid\" or \"UTC\"';\n                logger.error(`[cron] Rejecting job \"${loaded.id}\": ${reason}.`);\n                this.rejected.set(loaded.id, {\n                    id: loaded.id,\n                    name: loaded.definition.name ?? loaded.id,\n                    schedule: loaded.definition.schedule,\n                    reason\n                });\n                continue;\n            }\n            // A re-register that now validates clears the earlier complaint.\n            this.rejected.delete(loaded.id);\n\n            const existing = this.jobs.get(loaded.id);\n            if (existing) {\n                logger.warn(`[cron] Duplicate cron job id: \"${loaded.id}\". Overwriting.`);\n                this.stopJob(loaded.id);\n            }\n\n            const enabled = loaded.definition.enabled !== false;\n\n            this.jobs.set(loaded.id, {\n                id: loaded.id,\n                definition: loaded.definition,\n                enabled,\n                state: enabled ? \"idle\" : \"disabled\",\n                totalRuns: 0,\n                totalFailures: 0,\n                logs: [],\n                executing: false\n            });\n\n            // If the scheduler is already running, auto-schedule new jobs\n            if (this.started && enabled) {\n                this.scheduleNext(loaded.id);\n            }\n        }\n    }\n\n    /**\n     * Start the scheduler — begins ticking all enabled jobs.\n     */\n    start(): void {\n        if (this.started) return;\n        this.started = true;\n\n        // Seed counters from DB (non-blocking — scheduler starts immediately)\n        if (this.store) {\n            this.store.fetchJobStats().then((stats) => {\n                for (const [jobId, data] of stats) {\n                    const job = this.jobs.get(jobId);\n                    if (job) {\n                        job.totalRuns = data.totalRuns;\n                        job.totalFailures = data.totalFailures;\n                        if (data.lastRunAt) {\n                            job.lastRunAt = new Date(data.lastRunAt);\n                        }\n                    }\n                }\n            }).catch((err) => {\n                logger.warn(\"[cron] Failed to seed job stats from database\", { error: err });\n            });\n        }\n\n        for (const [id, job] of this.jobs) {\n            if (job.enabled) {\n                this.scheduleNext(id);\n            }\n        }\n        if (!this.store) {\n            logger.warn(\"[cron] No cron store attached — runs are uncoordinated; with multiple app instances every instance will execute every job\");\n        }\n        this.warnIfScaleToZero();\n\n        // Recover slots that elapsed while nothing was ticking. Deliberately\n        // not awaited: catch-up reaches the database and runs handlers, and\n        // boot must not wait on either. Its own errors are contained inside.\n        void this.catchUpMissedSlots();\n\n        logger.info(`⏰ Cron scheduler started with ${this.jobs.size} job(s)`);\n    }\n\n    /**\n     * Stop the scheduler and clear all timers.\n     *\n     * Currently-executing handlers run to completion (they are async),\n     * but no further scheduling occurs after stop.\n     */\n    stop(): void {\n        this.started = false;\n        for (const [id] of this.jobs) {\n            this.stopJob(id);\n        }\n    }\n\n    /**\n     * List all registered jobs with their current status.\n     */\n    listJobs(): CronJobStatus[] {\n        return [...this.jobs.values()].map((job) => this.toStatus(job));\n    }\n\n    /**\n     * Jobs that loaded but whose schedule the scheduler refused.\n     *\n     * Kept apart from {@link listJobs} because they are not jobs — nothing will\n     * run them — but they must be reachable, or \"my cron is missing\" and \"my\n     * cron will never fire\" look identical from the admin panel.\n     */\n    listRejectedJobs(): RejectedCronJob[] {\n        return [...this.rejected.values()];\n    }\n\n    /**\n     * Get a single job status by ID.\n     */\n    getJob(id: string): CronJobStatus | undefined {\n        const job = this.jobs.get(id);\n        return job ? this.toStatus(job) : undefined;\n    }\n\n    /**\n     * Get log entries for a job.\n     */\n    getJobLogs(id: string, limit?: number): CronJobLogEntry[] {\n        const job = this.jobs.get(id);\n        if (!job) return [];\n        const logs = [...job.logs].reverse(); // newest first\n        return limit ? logs.slice(0, limit) : logs;\n    }\n\n    /**\n     * Get log entries for a job from the database (if store is available).\n     * Falls back to in-memory logs if no store is configured.\n     */\n    async getJobLogsFromDb(id: string, limit?: number): Promise<CronJobLogEntry[]> {\n        if (this.store) {\n            const dbLogs = await this.store.fetchLogs(id, limit);\n            if (dbLogs.length > 0) return dbLogs;\n        }\n        // Fallback to in-memory\n        return this.getJobLogs(id, limit);\n    }\n\n    /**\n     * Enable or disable a job at runtime.\n     */\n    setJobEnabled(id: string, enabled: boolean): CronJobStatus | undefined {\n        const job = this.jobs.get(id);\n        if (!job) return undefined;\n\n        job.enabled = enabled;\n\n        if (enabled && this.started) {\n            job.state = \"idle\";\n            this.scheduleNext(id);\n        } else if (!enabled) {\n            this.stopJob(id);\n            job.state = \"disabled\";\n        }\n\n        return this.toStatus(job);\n    }\n\n    /**\n     * Manually trigger a job execution immediately.\n     *\n     * Returns `undefined` if the job doesn't exist.\n     * If the job is currently executing, returns the log entry with\n     * a `skipped: true` result rather than running concurrently.\n     */\n    async triggerJob(id: string): Promise<CronJobLogEntry | undefined> {\n        const job = this.jobs.get(id);\n        if (!job) return undefined;\n\n        // Concurrency guard — don't run two instances simultaneously\n        if (job.executing) {\n            logger.warn(`[cron] Skipping manual trigger of \"${id}\" — already executing`);\n            return this.recordSkip(job, \"already_executing\", true);\n        }\n\n        return this.executeJob(job, true);\n    }\n\n    /**\n     * Record a run that did not happen because the previous one had not\n     * finished.\n     *\n     * Written to `cron_logs`, not only to the in-memory ring. An overlap is the\n     * signature of a job that has outgrown its schedule — the one thing you want\n     * to see in the history rather than infer from a gap in it — and until now\n     * the scheduled path left no trace at all beyond a warning in the process\n     * log, which is gone by the time anyone asks. The manual path wrote a ring\n     * entry that vanished on restart.\n     *\n     * `success: true` is deliberate: nothing failed. The `result.skipped` flag\n     * and the reason are what distinguishes it, and the Studio panel reads them.\n     */\n    private recordSkip(job: RegisteredJob, reason: string, manual: boolean): CronJobLogEntry {\n        const now = new Date().toISOString();\n        const logEntry: CronJobLogEntry = {\n            jobId: job.id,\n            startedAt: now,\n            finishedAt: now,\n            durationMs: 0,\n            success: true,\n            result: { skipped: true, reason },\n            logs: [`Skipped: ${reason === \"already_executing\" ? \"the previous run has not finished\" : reason}`],\n            manual\n        };\n\n        job.logs.push(logEntry);\n        if (job.logs.length > MAX_LOGS_PER_JOB) job.logs.shift();\n\n        this.store?.insertLog(logEntry).catch((persistErr) => {\n            logger.error(`[cron] Failed to persist skip for \"${job.id}\"`, { error: persistErr });\n        });\n\n        return logEntry;\n    }\n\n    // ─── Internal ────────────────────────────────────────────────────\n\n    /**\n     * Warn once at start when the process looks like it is running on a\n     * platform that freezes or evicts instances between requests, where the\n     * in-process timers this scheduler relies on never fire.\n     *\n     * Advisory only: any failure here is swallowed so a detection bug can\n     * never take a production boot down.\n     */\n    private warnIfScaleToZero(): void {\n        try {\n            const warning = buildScaleToZeroWarning(\n                [...this.jobs.values()].map((job) => ({ id: job.id, enabled: job.enabled }))\n            );\n            if (warning) {\n                logger.warn(warning.message, warning.data);\n            }\n        } catch {\n            // Never let the advisory check affect startup.\n        }\n    }\n\n    /**\n     * Schedule the next execution for a job.\n     *\n     * Safety guarantees:\n     * 1. Clears any existing timer first (prevents leaked/duplicate timers)\n     * 2. Enforces a minimum delay to prevent tight loops from jitter\n     * 3. Unref's the timer so it doesn't prevent process exit\n     * 4. Re-checks enabled & started state before executing\n     * 5. Concurrency guard prevents overlapping handler executions\n     */\n    private scheduleNext(id: string): void {\n        const job = this.jobs.get(id);\n        if (!job || !job.enabled || !this.started) return;\n\n        // Clear any previously scheduled timer to prevent double-firing\n        this.stopJob(id);\n\n        try {\n            const now = new Date();\n            const nextRun = parseCronExpression(job.definition.schedule, now, job.definition.timezone);\n            job.nextRunAt = nextRun;\n\n            const rawDelay = nextRun.getTime() - now.getTime();\n            // Enforce a minimum delay to prevent tight re-execution loops\n            // from event loop jitter or near-zero setTimeout drift\n            const delay = Math.max(rawDelay, MIN_SCHEDULE_INTERVAL_MS);\n\n            // A slot past the 32-bit timer ceiling cannot be armed directly:\n            // setTimeout would clamp it to 1ms and fire at once, and since the\n            // slot is already claimed by then, every wake re-schedules the same\n            // overflowing delay — a permanent hot loop, not a late job. Sleep\n            // to the ceiling and re-derive the delay on waking instead; the\n            // cron expression stays the source of truth across the hops.\n            if (delay > MAX_TIMER_DELAY_MS) {\n                const hop = setTimeout(() => {\n                    if (this.started && job.enabled) this.scheduleNext(id);\n                }, MAX_TIMER_DELAY_MS);\n                if (hop && typeof hop === \"object\" && \"unref\" in hop) {\n                    hop.unref();\n                }\n                job.timerId = hop;\n                return;\n            }\n\n            const timer = setTimeout(async () => {\n                // Re-check state: scheduler may have been stopped or job disabled\n                // between when we scheduled and when we fire\n                if (!job.enabled || !this.started) return;\n\n                // Concurrency guard: if somehow we're already executing, skip\n                if (job.executing) {\n                    logger.warn(`[cron] Skipping scheduled run of \"${id}\" — still executing from previous run`);\n                    // Recorded as well as logged: a job that keeps overlapping\n                    // has outgrown its schedule, and that is visible in the run\n                    // history or nowhere.\n                    this.recordSkip(job, \"already_executing\", false);\n                    // Re-schedule to try again later\n                    this.scheduleNext(id);\n                    return;\n                }\n\n                // A timer can wake before its slot: a delay past the 32-bit\n                // ceiling, a clock stepped backwards by NTP, a VM resuming from\n                // suspend. Claiming on an early wake is unrecoverable — claims\n                // are permanent, so the slot would be burned and the real run\n                // silently skipped when it came due. Re-derive from the wall\n                // clock and re-arm instead; only the fire that is genuinely due\n                // may claim.\n                if (Date.now() < nextRun.getTime()) {\n                    this.scheduleNext(id);\n                    return;\n                }\n\n                // Cross-instance guard: claim the scheduled slot in the store.\n                // The slot is the scheduled fire time — deterministic across\n                // instances — so exactly one instance wins each (job, slot) pair.\n                // A store without tryClaimRun (pre-claims custom implementation)\n                // runs uncoordinated; a throwing store fails open — either way\n                // this callback must never reject, or the job would silently\n                // stop rescheduling.\n                if (this.store?.tryClaimRun) {\n                    let claimed = true;\n                    try {\n                        claimed = await this.store.tryClaimRun(id, nextRun.toISOString());\n                    } catch (err) {\n                        logger.warn(`[cron] Claim check threw for \"${id}\" — running uncoordinated`, { error: err });\n                    }\n                    if (!claimed) {\n                        logger.info(`[cron] Slot ${nextRun.toISOString()} for \"${id}\" claimed by another instance — skipping`);\n                        if (this.started && job.enabled) {\n                            this.scheduleNext(id);\n                        }\n                        return;\n                    }\n                }\n\n                await this.executeJob(job, false);\n\n                // Schedule the next tick (only if still started + enabled)\n                if (this.started && job.enabled) {\n                    this.scheduleNext(id);\n                }\n            }, delay);\n\n            // Unref the timer so it doesn't prevent Node.js from exiting\n            // during graceful shutdown\n            if (timer && typeof timer === \"object\" && \"unref\" in timer) {\n                timer.unref();\n            }\n\n            job.timerId = timer;\n        } catch (err: unknown) {\n            logger.error(`[cron] Failed to schedule \"${id}\"`, { error: err });\n            job.state = \"error\";\n            job.lastError = err instanceof Error ? err.message : String(err);\n        }\n    }\n\n    /**\n     * Run any slot that elapsed while no instance was holding a timer for it.\n     *\n     * Only jobs that opted in via `catchUpWindowSeconds` are considered, and\n     * only their single most recent missed slot — see the field's docs for why\n     * both limits are deliberate.\n     *\n     * The claim is what makes this safe. In the ordinary case — an instance\n     * restarting minutes after a slot ran normally — the most recent slot is\n     * already claimed, so this costs one `tryClaimRun` per job per boot and\n     * does nothing. A slot is only executed when no instance, past or present,\n     * ever claimed it.\n     *\n     * Never throws: a failure here must not take down a scheduler that is\n     * otherwise ticking correctly.\n     */\n    private async catchUpMissedSlots(): Promise<void> {\n        const candidates = [...this.jobs.values()].filter(\n            job => job.enabled && (job.definition.catchUpWindowSeconds ?? 0) > 0\n        );\n        if (candidates.length === 0) return;\n\n        // A claims-capable store is the whole safety mechanism. Without one,\n        // every boot would look like \"this slot never ran\" and an instance\n        // recycled twice an hour would re-run the same hourly job twice an\n        // hour. Refusing to catch up is the correct degradation.\n        if (!this.store?.tryClaimRun) {\n            logger.warn(\n                `[cron] Catch-up is configured on ${candidates.length} job(s) but no claims-capable store is attached — skipping. ` +\n                \"Without claims a restart cannot tell an unrun slot from one the previous instance already ran.\"\n            );\n            return;\n        }\n\n        const now = new Date();\n\n        for (const job of candidates) {\n            try {\n                if (!this.started || !job.enabled || job.executing) continue;\n\n                const windowSeconds = job.definition.catchUpWindowSeconds!;\n                const from = new Date(now.getTime() - windowSeconds * 1000);\n                const slot = findMostRecentSlot(job.definition.schedule, from, now, job.definition.timezone);\n                if (!slot) continue;\n\n                const slotIso = slot.toISOString();\n\n                // Same key the scheduled path claims with, so a slot that fired\n                // normally is already taken and this is a no-op.\n                let claimed: boolean;\n                try {\n                    claimed = await this.store.tryClaimRun(job.id, slotIso);\n                } catch (err) {\n                    // Fail closed, unlike the scheduled path. A missed slot is\n                    // a recovery, not an obligation — running it against a\n                    // store that cannot tell us whether it already ran risks a\n                    // duplicate on every boot.\n                    logger.warn(`[cron] Catch-up claim threw for \"${job.id}\" — skipping catch-up`, { error: err });\n                    continue;\n                }\n\n                if (!claimed) continue;\n\n                const lateBy = Math.round((now.getTime() - slot.getTime()) / 1000);\n                logger.info(`[cron] Catching up missed slot ${slotIso} for \"${job.id}\" (${lateBy}s late)`);\n\n                await this.executeJob(job, false, `⏰ Catch-up run for missed slot ${slotIso} (${lateBy}s late)`);\n            } catch (err) {\n                logger.error(`[cron] Catch-up failed for \"${job.id}\"`, { error: err });\n            }\n        }\n    }\n\n    /**\n     * Stop a single job's timer and clear its next run state.\n     */\n    private stopJob(id: string): void {\n        const job = this.jobs.get(id);\n        if (job?.timerId) {\n            clearTimeout(job.timerId);\n            job.timerId = undefined;\n            job.nextRunAt = undefined;\n        }\n    }\n\n    /**\n     * Execute a job's handler with full isolation and safety.\n     *\n     * - Sets a concurrency flag to prevent overlapping runs\n     * - Wraps handler in a timeout race\n     * - Captures all logs, errors, and results\n     * - Persists to store (non-blocking) if available\n     * - Always restores state even on catastrophic errors\n     */\n    private async executeJob(\n        job: RegisteredJob,\n        manual: boolean,\n        seedLog?: string\n    ): Promise<CronJobLogEntry> {\n        const startedAt = new Date();\n        // A caller-supplied first line, stored with the run's own output. A\n        // catch-up uses it to say so in the persisted log, where an operator\n        // reading `cron_logs` will actually see it — `manual` is the only other\n        // provenance the entry carries, and a catch-up is not manual.\n        const capturedLogs: string[] = seedLog ? [seedLog] : [];\n\n        // Set executing flag — prevents concurrent runs\n        job.executing = true;\n\n        // Aborted when the timeout below wins the race. Without it the timeout\n        // only stopped the scheduler waiting: the handler's `fetch` kept its\n        // socket, so a job whose timeout matches its interval leaked one\n        // abandoned request per tick while every run was already marked failed.\n        const abort = new AbortController();\n\n        const ctx: CronJobContext = {\n            jobId: job.id,\n            scheduledAt: startedAt,\n            signal: abort.signal,\n            log: (...args: unknown[]) => {\n                const line = args.map((a) =>\n                    typeof a === \"string\" ? a : JSON.stringify(a)\n                ).join(\" \");\n                capturedLogs.push(line);\n            },\n            // `rebase`, and only `rebase`: it matches the singleton import and\n            // `defineFunction`'s context. The old `client` alias re-exposed\n            // `client.data`, the name `RebaseServerClient` deliberately omits so\n            // that the RLS-bypassing plane is spelled `dataAsAdmin` everywhere.\n            rebase: this.client!\n        };\n\n        job.state = \"running\";\n        job.lastRunAt = startedAt;\n        job.totalRuns++;\n\n        let success = true;\n        let error: string | undefined;\n        let result: unknown;\n\n        try {\n            // Race with timeout\n            const timeout = (job.definition.timeoutSeconds ?? 300) * 1000;\n            const handlerPromise = Promise.resolve(job.definition.handler(ctx));\n            let timeoutHandle: ReturnType<typeof setTimeout>;\n            const timeoutPromise = new Promise<never>((_, reject) => {\n                timeoutHandle = setTimeout(\n                    () => {\n                        // Abort first, so the handler's in-flight work is\n                        // cancelled rather than left running past the run it\n                        // belongs to.\n                        abort.abort(new Error(`Cron job \"${job.id}\" timed out after ${timeout}ms`));\n                        reject(new Error(`Cron job \"${job.id}\" timed out after ${timeout}ms`));\n                    },\n                    timeout\n                );\n            });\n\n            try {\n                result = await Promise.race([handlerPromise, timeoutPromise]);\n            } finally {\n                clearTimeout(timeoutHandle!);\n            }\n        } catch (err: unknown) {\n            success = false;\n            // Redacted at the point of capture, not just on the way to the log:\n            // this string is persisted into `cron_logs` and rendered in the\n            // Studio cron panel, and a job that fails on a query would\n            // otherwise store `Failed query: <sql>\\nparams: <values>` — the\n            // statement and every bound value — in a table, indefinitely.\n            error = redactSensitiveText(err instanceof Error ? err.message : String(err));\n            job.totalFailures++;\n        } finally {\n            // Always clear executing flag — even on catastrophic errors\n            job.executing = false;\n        }\n\n        const finishedAt = new Date();\n        const durationMs = finishedAt.getTime() - startedAt.getTime();\n\n        job.state = success ? (job.enabled ? \"idle\" : \"disabled\") : \"error\";\n        job.lastDurationMs = durationMs;\n        job.lastError = error;\n\n        const logEntry: CronJobLogEntry = {\n            jobId: job.id,\n            startedAt: startedAt.toISOString(),\n            finishedAt: finishedAt.toISOString(),\n            durationMs,\n            success,\n            error,\n            result: result !== undefined ? result : undefined,\n            logs: capturedLogs,\n            manual\n        };\n\n        // Push to ring buffer\n        job.logs.push(logEntry);\n        if (job.logs.length > MAX_LOGS_PER_JOB) {\n            job.logs.shift();\n        }\n\n        // Persist to database (non-blocking)\n        if (this.store) {\n            this.store.insertLog(logEntry).catch((persistErr) => {\n                logger.error(`[cron] Failed to persist log for \"${job.id}\"`, { error: persistErr });\n            });\n        }\n\n        if (success) {\n            logger.info(`✅ [cron] \"${job.id}\" completed in ${durationMs}ms`);\n        } else {\n            logger.error(`❌ [cron] \"${job.id}\" failed in ${durationMs}ms: ${error}`);\n        }\n\n        return logEntry;\n    }\n\n    private toStatus(job: RegisteredJob): CronJobStatus {\n        return {\n            id: job.id,\n            // Same fallback the two `listJobs` paths already applied: `name` is\n            // optional and the id is the file's own name.\n            name: job.definition.name ?? job.id,\n            description: job.definition.description,\n            schedule: job.definition.schedule,\n            enabled: job.enabled,\n            state: job.state,\n            lastRunAt: job.lastRunAt?.toISOString(),\n            nextRunAt: job.nextRunAt?.toISOString(),\n            lastDurationMs: job.lastDurationMs,\n            lastError: job.lastError,\n            totalRuns: job.totalRuns,\n            totalFailures: job.totalFailures\n        };\n    }\n}\n"],"mappings":";;;;;;;;AAAA,IAAM,sBAAM,IAAI,IAAI;CAAC;CAAQ;CAAK;CAAO;AAAI,CAAC;AAC9C,IAAM,qBAAK,IAAI,IAAI;CAAC;CAAS;CAAK;CAAM;AAAK,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoC9C,SAAgB,gBAAgB,OAAgD;CAC5E,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;CAChC,MAAM,UAAU,MAAM,KAAK,CAAC,CAAC,YAAY;CACzC,IAAI,IAAI,IAAI,OAAO,GAAG,OAAO;CAC7B,IAAI,GAAG,IAAI,OAAO,GAAG,OAAO;AAEhC;;;;;;;;;;;;;;;;;;;;;;;;;;;AChBA,IAAa,qBAAqB;;;;;;AA4BlC,SAAgB,uBAAuB,MAAe,QAAQ,KAAmC;CAI7F,IAAI,IAAI,yBAAyB,OAAO,KAAA;CAExC,IAAI,IAAI,WAAW;EACf,MAAM,UAAU,CAAC,WAAW;EAC5B,IAAI,IAAI,YAAY,QAAQ,KAAK,YAAY;EAC7C,IAAI,IAAI,iBAAiB,QAAQ,KAAK,iBAAiB;EACvD,OAAO;GAAE,UAAU;GAAa;EAAQ;CAC5C;CAEA,IAAI,IAAI,eACJ,OAAO;EAAE,UAAU;EAAkB,SAAS,CAAC,eAAe;CAAE;CAGpE,IAAI,IAAI,0BACJ,OAAO;EAAE,UAAU;EAAc,SAAS,CAAC,0BAA0B;CAAE;CAG3E,IAAI,gBAAgB,IAAI,MAAM,MAAM,MAChC,OAAO;EAAE,UAAU;EAAU,SAAS,CAAC,QAAQ;CAAE;AAIzD;;AAGA,IAAM,iBAAiB;;;;;;;;;;AAWvB,SAAgB,wBACZ,MACA,MAAe,QAAQ,KACO;CAC9B,IAAI,IAAI,aAAa,cAAc,OAAO,KAAA;CAC1C,IAAI,gBAAgB,IAAA,wBAAuB,MAAM,MAAM,OAAO,KAAA;CAE9D,MAAM,UAAU,KAAK,QAAQ,QAAQ,IAAI,OAAO,CAAC,CAAC,KAAK,QAAQ,IAAI,EAAE;CACrE,IAAI,QAAQ,WAAW,GAAG,OAAO,KAAA;CAEjC,MAAM,UAAU,uBAAuB,GAAG;CAC1C,IAAI,CAAC,SAAS,OAAO,KAAA;CAErB,MAAM,QAAQ,QAAQ,MAAM,GAAG,cAAc;CAC7C,MAAM,OAAO,QAAQ,SAAS,MAAM,SAC9B,GAAG,MAAM,KAAK,IAAI,EAAE,KAAK,QAAQ,SAAS,MAAM,OAAO,UACvD,MAAM,KAAK,IAAI;CAIrB,OAAO;EACH,SAAA,UAHsB,QAAQ,SAAS,8FAA8F,QAAQ,OAAO,iCAAiC,KAAK,sGAAsG,QAAQ,SAAS,sIAAsI,mBAAmB;EAI1c,MAAM;GACF,UAAU,QAAQ;GAClB,SAAS,QAAQ;GACjB,MAAM;EACV;CACJ;AACJ;;;;;;;;;;;;;;ACtGA,SAAS,gBAAgB,OAAe,KAAa,KAAuB;CACxE,MAAM,0BAAU,IAAI,IAAY;CAChC,KAAK,MAAM,WAAW,MAAM,MAAM,GAAG,GAAG;EACpC,MAAM,UAAU,QAAQ,KAAK;EAC7B,IAAI,YAAY,KACZ,KAAK,IAAI,IAAI,KAAK,KAAK,KAAK,KAAK,QAAQ,IAAI,CAAC;OAC3C,IAAI,QAAQ,SAAS,GAAG,GAAG;GAC9B,MAAM,CAAC,UAAU,WAAW,QAAQ,MAAM,GAAG;GAC7C,MAAM,OAAO,SAAS,SAAS,EAAE;GACjC,IAAI,MAAM,IAAI,KAAK,QAAQ,GACvB,MAAM,IAAI,MAAM,uBAAuB,QAAQ,mBAAmB,MAAM,EAAE;GAE9E,IAAI,QAAQ;GACZ,IAAI,MAAM;GACV,IAAI,aAAa,KACb,IAAI,SAAS,SAAS,GAAG,GAAG;IACxB,MAAM,CAAC,GAAG,KAAK,SAAS,MAAM,GAAG,CAAC,CAAC,IAAI,MAAM;IAC7C,QAAQ;IACR,MAAM;GACV,OACI,QAAQ,SAAS,UAAU,EAAE;GAGrC,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,KAAK,MAAM,QAAQ,IAAI,CAAC;EAC1D,OAAO,IAAI,QAAQ,SAAS,GAAG,GAAG;GAC9B,MAAM,CAAC,GAAG,KAAK,QAAQ,MAAM,GAAG,CAAC,CAAC,IAAI,MAAM;GAC5C,KAAK,IAAI,IAAI,GAAG,KAAK,GAAG,KAAK,QAAQ,IAAI,CAAC;EAC9C,OAAO;GACH,MAAM,MAAM,SAAS,SAAS,EAAE;GAChC,IAAI,MAAM,GAAG,GACT,MAAM,IAAI,MAAM,kBAAkB,QAAQ,mBAAmB,MAAM,EAAE;GAEzE,QAAQ,IAAI,GAAG;EACnB;CACJ;CACA,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,MAAM,GAAG,MAAM,IAAI,CAAC;AAC5C;;;;;AAMA,SAAgB,uBAAuB,UAAsE;CACzG,IAAI,CAAC,YAAY,OAAO,aAAa,UACjC,OAAO;EAAE,OAAO;EACxB,QAAQ;CAAsC;CAE1C,MAAM,QAAQ,SAAS,KAAK,CAAC,CAAC,MAAM,KAAK;CACzC,IAAI,MAAM,WAAW,GACjB,OAAO;EAAE,OAAO;EACxB,QAAQ,0BAA0B,MAAM;CAAS;CAE7C,MAAM,cAA0C;EAC5C;GAAC;GAAU;GAAG;EAAE;EAChB;GAAC;GAAQ;GAAG;EAAE;EACd;GAAC;GAAgB;GAAG;EAAE;EACtB;GAAC;GAAS;GAAG;EAAE;EACf;GAAC;GAAe;GAAG;EAAC;CACxB;CACA,KAAK,IAAI,IAAI,GAAG,IAAI,GAAG,KAAK;EACxB,MAAM,CAAC,MAAM,KAAK,OAAO,YAAY;EACrC,IAAI;GACA,MAAM,SAAS,gBAAgB,MAAM,IAAI,KAAK,GAAG;GACjD,IAAI,OAAO,WAAW,GAClB,OAAO;IAAE,OAAO;IAChC,QAAQ,GAAG,KAAK,UAAU,MAAM,GAAG;GAAsB;GAE7C,KAAK,MAAM,KAAK,QACZ,IAAI,IAAI,OAAO,IAAI,KACf,OAAO;IAAE,OAAO;IACpC,QAAQ,GAAG,KAAK,eAAe,EAAE,iBAAiB,IAAI,GAAG,IAAI;GAAG;EAGxD,SAAS,KAAK;GACV,OAAO;IAAE,OAAO;IAC5B,QAAQ,GAAG,KAAK,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;GAAI;EACrE;CACJ;CACA,OAAO,EAAE,OAAO,KAAK;AACzB;;AAYA,SAAS,gBAAgB,YAAgC;CACrD,MAAM,QAAQ,WAAW,KAAK,CAAC,CAAC,MAAM,KAAK;CAC3C,IAAI,MAAM,SAAS,GACf,MAAM,IAAI,MAAM,6BAA6B,WAAW,sBAAsB;CAElF,MAAM,CAAC,UAAU,WAAW,UAAU,UAAU,YAAY;CAC5D,OAAO;EACH,SAAS,gBAAgB,UAAU,GAAG,EAAE;EACxC,OAAO,gBAAgB,WAAW,GAAG,EAAE;EACvC,MAAM,gBAAgB,UAAU,GAAG,EAAE;EACrC,QAAQ,gBAAgB,UAAU,GAAG,EAAE;EACvC,MAAM,gBAAgB,UAAU,GAAG,CAAC;CACxC;AACJ;;;;;;;;;AAUA,SAAgB,gBAAgB,MAAuB;CACnD,IAAI;EACA,IAAI,KAAK,eAAe,SAAS,EAAE,UAAU,KAAK,CAAC;EACnD,OAAO;CACX,QAAQ;EACJ,OAAO;CACX;AACJ;AAWA,IAAM,6BAAa,IAAI,IAAiC;AACxD,IAAM,MAA8B;CAAE,KAAK;CAAG,KAAK;CAAG,KAAK;CAAG,KAAK;CAAG,KAAK;CAAG,KAAK;CAAG,KAAK;AAAE;AAE7F,SAAS,YAAY,WAAiB,MAAyB;CAC3D,IAAI,YAAY,WAAW,IAAI,IAAI;CACnC,IAAI,CAAC,WAAW;EACZ,YAAY,IAAI,KAAK,eAAe,SAAS;GACzC,UAAU;GACV,WAAW;GACX,SAAS;GACT,OAAO;GACP,KAAK;GACL,MAAM;GACN,QAAQ;EACZ,CAAC;EACD,WAAW,IAAI,MAAM,SAAS;CAClC;CACA,MAAM,QAAgC,CAAC;CACvC,KAAK,MAAM,QAAQ,UAAU,cAAc,SAAS,GAAG,MAAM,KAAK,QAAQ,KAAK;CAC/E,OAAO;EACH,QAAQ,OAAO,MAAM,MAAM;EAC3B,MAAM,OAAO,MAAM,IAAI;EACvB,KAAK,OAAO,MAAM,GAAG;EACrB,OAAO,OAAO,MAAM,KAAK;EACzB,KAAK,IAAI,MAAM,YAAY,UAAU,OAAO;CAChD;AACJ;;;;;;;;AASA,SAAS,kBAAkB,WAAiB,QAAoB,MAAwB;CACpF,MAAM,OAAkB,OAClB,YAAY,WAAW,IAAI,IAC3B;EACE,QAAQ,UAAU,WAAW;EAC7B,MAAM,UAAU,SAAS;EACzB,KAAK,UAAU,QAAQ;EACvB,OAAO,UAAU,SAAS,IAAI;EAC9B,KAAK,UAAU,OAAO;CAC1B;CACJ,OAAO,OAAO,OAAO,SAAS,KAAK,KAAK,KACjC,OAAO,KAAK,SAAS,KAAK,GAAG,KAC7B,OAAO,KAAK,SAAS,KAAK,GAAG,KAC7B,OAAO,MAAM,SAAS,KAAK,IAAI,KAC/B,OAAO,QAAQ,SAAS,KAAK,MAAM;AAC9C;;;;;;;;;AAUA,IAAM,0BAA0B;;;;;AAMhC,SAAgB,oBAAoB,YAAoB,OAAa,UAAyB;CAC1F,MAAM,SAAS,gBAAgB,UAAU;CAGzC,MAAM,YAAY,IAAI,KAAK,KAAK;CAChC,UAAU,WAAW,GAAG,CAAC;CACzB,UAAU,WAAW,UAAU,WAAW,IAAI,CAAC;CAE/C,KAAK,IAAI,IAAI,GAAG,IAAI,yBAAyB,KAAK;EAC9C,IAAI,kBAAkB,WAAW,QAAQ,QAAQ,GAC7C,OAAO;EAEX,UAAU,WAAW,UAAU,WAAW,IAAI,CAAC;CACnD;CAaA,MAAM,IAAI,MACN,oBAAoB,WAAW,gCAC5B,KAAK,MAAM,0BAA0B,MAAM,EAAE,YAAY,MAAM,YAAY,EAAE,qFAEpF;AACJ;;;;;;;;;;;;;;;;;AAkBA,SAAgB,mBAAmB,YAAoB,MAAY,IAAU,UAAqC;CAC9G,MAAM,SAAS,gBAAgB,UAAU;CAEzC,MAAM,YAAY,IAAI,KAAK,EAAE;CAC7B,UAAU,WAAW,GAAG,CAAC;CAEzB,KAAK,IAAI,IAAI,GAAG,IAAI,2BAA2B,UAAU,QAAQ,KAAK,KAAK,QAAQ,GAAG,KAAK;EACvF,IAAI,kBAAkB,WAAW,QAAQ,QAAQ,GAC7C,OAAO;EAEX,UAAU,WAAW,UAAU,WAAW,IAAI,CAAC;CACnD;AAGJ;AAIA,IAAM,mBAAmB;;;;;AAMzB,IAAM,2BAA2B;;;;;;AAOjC,IAAM,qBAAqB;AAmC3B,IAAa,gBAAb,MAA2B;CACvB,uBAAe,IAAI,IAA2B;CAC9C,2BAAmB,IAAI,IAA6B;CACpD,UAAkB;CAClB;CACA;;;;;;;;;CAUA,UAAU,QAAkC;EACxC,KAAK,SAAS;CAClB;;;;;;CAOA,SAAS,OAAwB;EAC7B,KAAK,QAAQ;CACjB;;;;;;;;;;CAWA,aAAa,YAAmC;EAC5C,KAAK,MAAM,UAAU,YAAY;GAE7B,MAAM,aAAa,uBAAuB,OAAO,WAAW,QAAQ;GACpE,IAAI,CAAC,WAAW,OAAO;IACnB,OAAO,MAAM,yBAAyB,OAAO,GAAG,uBAAuB,OAAO,WAAW,SAAS,MAAM,WAAW,QAAQ;IAO3H,KAAK,SAAS,IAAI,OAAO,IAAI;KACzB,IAAI,OAAO;KACX,MAAM,OAAO,WAAW,QAAQ,OAAO;KACvC,UAAU,OAAO,WAAW;KAC5B,QAAQ,WAAW;IACvB,CAAC;IACD;GACJ;GAMA,IAAI,OAAO,WAAW,aAAa,KAAA,KAAa,CAAC,gBAAgB,OAAO,WAAW,QAAQ,GAAG;IAC1F,MAAM,SACF,qBAAqB,OAAO,WAAW,SAAS;IAEpD,OAAO,MAAM,yBAAyB,OAAO,GAAG,KAAK,OAAO,EAAE;IAC9D,KAAK,SAAS,IAAI,OAAO,IAAI;KACzB,IAAI,OAAO;KACX,MAAM,OAAO,WAAW,QAAQ,OAAO;KACvC,UAAU,OAAO,WAAW;KAC5B;IACJ,CAAC;IACD;GACJ;GAEA,KAAK,SAAS,OAAO,OAAO,EAAE;GAG9B,IADiB,KAAK,KAAK,IAAI,OAAO,EAClC,GAAU;IACV,OAAO,KAAK,kCAAkC,OAAO,GAAG,gBAAgB;IACxE,KAAK,QAAQ,OAAO,EAAE;GAC1B;GAEA,MAAM,UAAU,OAAO,WAAW,YAAY;GAE9C,KAAK,KAAK,IAAI,OAAO,IAAI;IACrB,IAAI,OAAO;IACX,YAAY,OAAO;IACnB;IACA,OAAO,UAAU,SAAS;IAC1B,WAAW;IACX,eAAe;IACf,MAAM,CAAC;IACP,WAAW;GACf,CAAC;GAGD,IAAI,KAAK,WAAW,SAChB,KAAK,aAAa,OAAO,EAAE;EAEnC;CACJ;;;;CAKA,QAAc;EACV,IAAI,KAAK,SAAS;EAClB,KAAK,UAAU;EAGf,IAAI,KAAK,OACL,KAAK,MAAM,cAAc,CAAC,CAAC,MAAM,UAAU;GACvC,KAAK,MAAM,CAAC,OAAO,SAAS,OAAO;IAC/B,MAAM,MAAM,KAAK,KAAK,IAAI,KAAK;IAC/B,IAAI,KAAK;KACL,IAAI,YAAY,KAAK;KACrB,IAAI,gBAAgB,KAAK;KACzB,IAAI,KAAK,WACL,IAAI,YAAY,IAAI,KAAK,KAAK,SAAS;IAE/C;GACJ;EACJ,CAAC,CAAC,CAAC,OAAO,QAAQ;GACd,OAAO,KAAK,iDAAiD,EAAE,OAAO,IAAI,CAAC;EAC/E,CAAC;EAGL,KAAK,MAAM,CAAC,IAAI,QAAQ,KAAK,MACzB,IAAI,IAAI,SACJ,KAAK,aAAa,EAAE;EAG5B,IAAI,CAAC,KAAK,OACN,OAAO,KAAK,2HAA2H;EAE3I,KAAK,kBAAkB;EAKvB,KAAU,mBAAmB;EAE7B,OAAO,KAAK,iCAAiC,KAAK,KAAK,KAAK,QAAQ;CACxE;;;;;;;CAQA,OAAa;EACT,KAAK,UAAU;EACf,KAAK,MAAM,CAAC,OAAO,KAAK,MACpB,KAAK,QAAQ,EAAE;CAEvB;;;;CAKA,WAA4B;EACxB,OAAO,CAAC,GAAG,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,QAAQ,KAAK,SAAS,GAAG,CAAC;CAClE;;;;;;;;CASA,mBAAsC;EAClC,OAAO,CAAC,GAAG,KAAK,SAAS,OAAO,CAAC;CACrC;;;;CAKA,OAAO,IAAuC;EAC1C,MAAM,MAAM,KAAK,KAAK,IAAI,EAAE;EAC5B,OAAO,MAAM,KAAK,SAAS,GAAG,IAAI,KAAA;CACtC;;;;CAKA,WAAW,IAAY,OAAmC;EACtD,MAAM,MAAM,KAAK,KAAK,IAAI,EAAE;EAC5B,IAAI,CAAC,KAAK,OAAO,CAAC;EAClB,MAAM,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,QAAQ;EACnC,OAAO,QAAQ,KAAK,MAAM,GAAG,KAAK,IAAI;CAC1C;;;;;CAMA,MAAM,iBAAiB,IAAY,OAA4C;EAC3E,IAAI,KAAK,OAAO;GACZ,MAAM,SAAS,MAAM,KAAK,MAAM,UAAU,IAAI,KAAK;GACnD,IAAI,OAAO,SAAS,GAAG,OAAO;EAClC;EAEA,OAAO,KAAK,WAAW,IAAI,KAAK;CACpC;;;;CAKA,cAAc,IAAY,SAA6C;EACnE,MAAM,MAAM,KAAK,KAAK,IAAI,EAAE;EAC5B,IAAI,CAAC,KAAK,OAAO,KAAA;EAEjB,IAAI,UAAU;EAEd,IAAI,WAAW,KAAK,SAAS;GACzB,IAAI,QAAQ;GACZ,KAAK,aAAa,EAAE;EACxB,OAAO,IAAI,CAAC,SAAS;GACjB,KAAK,QAAQ,EAAE;GACf,IAAI,QAAQ;EAChB;EAEA,OAAO,KAAK,SAAS,GAAG;CAC5B;;;;;;;;CASA,MAAM,WAAW,IAAkD;EAC/D,MAAM,MAAM,KAAK,KAAK,IAAI,EAAE;EAC5B,IAAI,CAAC,KAAK,OAAO,KAAA;EAGjB,IAAI,IAAI,WAAW;GACf,OAAO,KAAK,sCAAsC,GAAG,sBAAsB;GAC3E,OAAO,KAAK,WAAW,KAAK,qBAAqB,IAAI;EACzD;EAEA,OAAO,KAAK,WAAW,KAAK,IAAI;CACpC;;;;;;;;;;;;;;;CAgBA,WAAmB,KAAoB,QAAgB,QAAkC;EACrF,MAAM,uBAAM,IAAI,KAAK,EAAA,CAAE,YAAY;EACnC,MAAM,WAA4B;GAC9B,OAAO,IAAI;GACX,WAAW;GACX,YAAY;GACZ,YAAY;GACZ,SAAS;GACT,QAAQ;IAAE,SAAS;IAAM;GAAO;GAChC,MAAM,CAAC,YAAY,WAAW,sBAAsB,sCAAsC,QAAQ;GAClG;EACJ;EAEA,IAAI,KAAK,KAAK,QAAQ;EACtB,IAAI,IAAI,KAAK,SAAS,kBAAkB,IAAI,KAAK,MAAM;EAEvD,KAAK,OAAO,UAAU,QAAQ,CAAC,CAAC,OAAO,eAAe;GAClD,OAAO,MAAM,sCAAsC,IAAI,GAAG,IAAI,EAAE,OAAO,WAAW,CAAC;EACvF,CAAC;EAED,OAAO;CACX;;;;;;;;;CAYA,oBAAkC;EAC9B,IAAI;GACA,MAAM,UAAU,wBACZ,CAAC,GAAG,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,SAAS;IAAE,IAAI,IAAI;IAAI,SAAS,IAAI;GAAQ,EAAE,CAC/E;GACA,IAAI,SACA,OAAO,KAAK,QAAQ,SAAS,QAAQ,IAAI;EAEjD,QAAQ,CAER;CACJ;;;;;;;;;;;CAYA,aAAqB,IAAkB;EACnC,MAAM,MAAM,KAAK,KAAK,IAAI,EAAE;EAC5B,IAAI,CAAC,OAAO,CAAC,IAAI,WAAW,CAAC,KAAK,SAAS;EAG3C,KAAK,QAAQ,EAAE;EAEf,IAAI;GACA,MAAM,sBAAM,IAAI,KAAK;GACrB,MAAM,UAAU,oBAAoB,IAAI,WAAW,UAAU,KAAK,IAAI,WAAW,QAAQ;GACzF,IAAI,YAAY;GAEhB,MAAM,WAAW,QAAQ,QAAQ,IAAI,IAAI,QAAQ;GAGjD,MAAM,QAAQ,KAAK,IAAI,UAAU,wBAAwB;GAQzD,IAAI,QAAQ,oBAAoB;IAC5B,MAAM,MAAM,iBAAiB;KACzB,IAAI,KAAK,WAAW,IAAI,SAAS,KAAK,aAAa,EAAE;IACzD,GAAG,kBAAkB;IACrB,IAAI,OAAO,OAAO,QAAQ,YAAY,WAAW,KAC7C,IAAI,MAAM;IAEd,IAAI,UAAU;IACd;GACJ;GAEA,MAAM,QAAQ,WAAW,YAAY;IAGjC,IAAI,CAAC,IAAI,WAAW,CAAC,KAAK,SAAS;IAGnC,IAAI,IAAI,WAAW;KACf,OAAO,KAAK,qCAAqC,GAAG,sCAAsC;KAI1F,KAAK,WAAW,KAAK,qBAAqB,KAAK;KAE/C,KAAK,aAAa,EAAE;KACpB;IACJ;IASA,IAAI,KAAK,IAAI,IAAI,QAAQ,QAAQ,GAAG;KAChC,KAAK,aAAa,EAAE;KACpB;IACJ;IASA,IAAI,KAAK,OAAO,aAAa;KACzB,IAAI,UAAU;KACd,IAAI;MACA,UAAU,MAAM,KAAK,MAAM,YAAY,IAAI,QAAQ,YAAY,CAAC;KACpE,SAAS,KAAK;MACV,OAAO,KAAK,iCAAiC,GAAG,4BAA4B,EAAE,OAAO,IAAI,CAAC;KAC9F;KACA,IAAI,CAAC,SAAS;MACV,OAAO,KAAK,eAAe,QAAQ,YAAY,EAAE,QAAQ,GAAG,yCAAyC;MACrG,IAAI,KAAK,WAAW,IAAI,SACpB,KAAK,aAAa,EAAE;MAExB;KACJ;IACJ;IAEA,MAAM,KAAK,WAAW,KAAK,KAAK;IAGhC,IAAI,KAAK,WAAW,IAAI,SACpB,KAAK,aAAa,EAAE;GAE5B,GAAG,KAAK;GAIR,IAAI,SAAS,OAAO,UAAU,YAAY,WAAW,OACjD,MAAM,MAAM;GAGhB,IAAI,UAAU;EAClB,SAAS,KAAc;GACnB,OAAO,MAAM,8BAA8B,GAAG,IAAI,EAAE,OAAO,IAAI,CAAC;GAChE,IAAI,QAAQ;GACZ,IAAI,YAAY,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;EACnE;CACJ;;;;;;;;;;;;;;;;;CAkBA,MAAc,qBAAoC;EAC9C,MAAM,aAAa,CAAC,GAAG,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,QACvC,QAAO,IAAI,YAAY,IAAI,WAAW,wBAAwB,KAAK,CACvE;EACA,IAAI,WAAW,WAAW,GAAG;EAM7B,IAAI,CAAC,KAAK,OAAO,aAAa;GAC1B,OAAO,KACH,oCAAoC,WAAW,OAAO,2JAE1D;GACA;EACJ;EAEA,MAAM,sBAAM,IAAI,KAAK;EAErB,KAAK,MAAM,OAAO,YACd,IAAI;GACA,IAAI,CAAC,KAAK,WAAW,CAAC,IAAI,WAAW,IAAI,WAAW;GAEpD,MAAM,gBAAgB,IAAI,WAAW;GACrC,MAAM,uBAAO,IAAI,KAAK,IAAI,QAAQ,IAAI,gBAAgB,GAAI;GAC1D,MAAM,OAAO,mBAAmB,IAAI,WAAW,UAAU,MAAM,KAAK,IAAI,WAAW,QAAQ;GAC3F,IAAI,CAAC,MAAM;GAEX,MAAM,UAAU,KAAK,YAAY;GAIjC,IAAI;GACJ,IAAI;IACA,UAAU,MAAM,KAAK,MAAM,YAAY,IAAI,IAAI,OAAO;GAC1D,SAAS,KAAK;IAKV,OAAO,KAAK,oCAAoC,IAAI,GAAG,wBAAwB,EAAE,OAAO,IAAI,CAAC;IAC7F;GACJ;GAEA,IAAI,CAAC,SAAS;GAEd,MAAM,SAAS,KAAK,OAAO,IAAI,QAAQ,IAAI,KAAK,QAAQ,KAAK,GAAI;GACjE,OAAO,KAAK,kCAAkC,QAAQ,QAAQ,IAAI,GAAG,KAAK,OAAO,QAAQ;GAEzF,MAAM,KAAK,WAAW,KAAK,OAAO,kCAAkC,QAAQ,IAAI,OAAO,QAAQ;EACnG,SAAS,KAAK;GACV,OAAO,MAAM,+BAA+B,IAAI,GAAG,IAAI,EAAE,OAAO,IAAI,CAAC;EACzE;CAER;;;;CAKA,QAAgB,IAAkB;EAC9B,MAAM,MAAM,KAAK,KAAK,IAAI,EAAE;EAC5B,IAAI,KAAK,SAAS;GACd,aAAa,IAAI,OAAO;GACxB,IAAI,UAAU,KAAA;GACd,IAAI,YAAY,KAAA;EACpB;CACJ;;;;;;;;;;CAWA,MAAc,WACV,KACA,QACA,SACwB;EACxB,MAAM,4BAAY,IAAI,KAAK;EAK3B,MAAM,eAAyB,UAAU,CAAC,OAAO,IAAI,CAAC;EAGtD,IAAI,YAAY;EAMhB,MAAM,QAAQ,IAAI,gBAAgB;EAElC,MAAM,MAAsB;GACxB,OAAO,IAAI;GACX,aAAa;GACb,QAAQ,MAAM;GACd,MAAM,GAAG,SAAoB;IACzB,MAAM,OAAO,KAAK,KAAK,MACnB,OAAO,MAAM,WAAW,IAAI,KAAK,UAAU,CAAC,CAChD,CAAC,CAAC,KAAK,GAAG;IACV,aAAa,KAAK,IAAI;GAC1B;GAKA,QAAQ,KAAK;EACjB;EAEA,IAAI,QAAQ;EACZ,IAAI,YAAY;EAChB,IAAI;EAEJ,IAAI,UAAU;EACd,IAAI;EACJ,IAAI;EAEJ,IAAI;GAEA,MAAM,WAAW,IAAI,WAAW,kBAAkB,OAAO;GACzD,MAAM,iBAAiB,QAAQ,QAAQ,IAAI,WAAW,QAAQ,GAAG,CAAC;GAClE,IAAI;GACJ,MAAM,iBAAiB,IAAI,SAAgB,GAAG,WAAW;IACrD,gBAAgB,iBACN;KAIF,MAAM,sBAAM,IAAI,MAAM,aAAa,IAAI,GAAG,oBAAoB,QAAQ,GAAG,CAAC;KAC1E,uBAAO,IAAI,MAAM,aAAa,IAAI,GAAG,oBAAoB,QAAQ,GAAG,CAAC;IACzE,GACA,OACJ;GACJ,CAAC;GAED,IAAI;IACA,SAAS,MAAM,QAAQ,KAAK,CAAC,gBAAgB,cAAc,CAAC;GAChE,UAAU;IACN,aAAa,aAAc;GAC/B;EACJ,SAAS,KAAc;GACnB,UAAU;GAMV,QAAQ,oBAAoB,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;GAC5E,IAAI;EACR,UAAU;GAEN,IAAI,YAAY;EACpB;EAEA,MAAM,6BAAa,IAAI,KAAK;EAC5B,MAAM,aAAa,WAAW,QAAQ,IAAI,UAAU,QAAQ;EAE5D,IAAI,QAAQ,UAAW,IAAI,UAAU,SAAS,aAAc;EAC5D,IAAI,iBAAiB;EACrB,IAAI,YAAY;EAEhB,MAAM,WAA4B;GAC9B,OAAO,IAAI;GACX,WAAW,UAAU,YAAY;GACjC,YAAY,WAAW,YAAY;GACnC;GACA;GACA;GACA,QAAQ,WAAW,KAAA,IAAY,SAAS,KAAA;GACxC,MAAM;GACN;EACJ;EAGA,IAAI,KAAK,KAAK,QAAQ;EACtB,IAAI,IAAI,KAAK,SAAS,kBAClB,IAAI,KAAK,MAAM;EAInB,IAAI,KAAK,OACL,KAAK,MAAM,UAAU,QAAQ,CAAC,CAAC,OAAO,eAAe;GACjD,OAAO,MAAM,qCAAqC,IAAI,GAAG,IAAI,EAAE,OAAO,WAAW,CAAC;EACtF,CAAC;EAGL,IAAI,SACA,OAAO,KAAK,aAAa,IAAI,GAAG,iBAAiB,WAAW,GAAG;OAE/D,OAAO,MAAM,aAAa,IAAI,GAAG,cAAc,WAAW,MAAM,OAAO;EAG3E,OAAO;CACX;CAEA,SAAiB,KAAmC;EAChD,OAAO;GACH,IAAI,IAAI;GAGR,MAAM,IAAI,WAAW,QAAQ,IAAI;GACjC,aAAa,IAAI,WAAW;GAC5B,UAAU,IAAI,WAAW;GACzB,SAAS,IAAI;GACb,OAAO,IAAI;GACX,WAAW,IAAI,WAAW,YAAY;GACtC,WAAW,IAAI,WAAW,YAAY;GACtC,gBAAgB,IAAI;GACpB,WAAW,IAAI;GACf,WAAW,IAAI;GACf,eAAe,IAAI;EACvB;CACJ;AACJ"}

package/dist/cron-store-Bdm7JqFB.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"cron-store-Bdm7JqFB.js","names":[],"sources":["../src/cron/cron-store.ts"],"sourcesContent":["import type { CronJobLogEntry } from \"@rebasepro/types\";\nimport type { DataDriver } from \"@rebasepro/types\";\nimport { isSQLAdmin } from \"@rebasepro/types\";\nimport { revokeInternalTableSql } from \"@rebasepro/common\";\nimport { logger } from \"../utils/logger.js\";\nimport { createDdlBootstrapper, hasInCauseChain } from \"../boot/ddl-bootstrap.js\";\n\n/**\n * Persistence layer for cron job execution logs.\n *\n * Uses the DataDriver's `admin.executeSql` capability to store logs in a\n * `rebase.cron_logs` table. Falls back gracefully if the driver doesn't\n * support SQL (e.g. MongoDB) — in that case, no persistence occurs.\n */\nexport interface CronStore {\n    /** Ensure the backing table exists. Called once on startup. */\n    ensureTable(): Promise<void>;\n\n    /** Persist a single log entry after execution. */\n    insertLog(entry: CronJobLogEntry): Promise<void>;\n\n    /**\n     * Fetch the most recent logs for a job.\n     * @param jobId  The job identifier\n     * @param limit  Max entries to return (default 50)\n     * @returns Logs sorted newest-first\n     */\n    fetchLogs(jobId: string, limit?: number): Promise<CronJobLogEntry[]>;\n\n    /**\n     * Fetch aggregate stats for all jobs (totalRuns, totalFailures, lastRunAt).\n     * Used to seed in-memory counters on startup.\n     */\n    fetchJobStats(): Promise<Map<string, { totalRuns: number; totalFailures: number; lastRunAt?: string }>>;\n\n    /**\n     * Atomically claim a scheduled run slot for a job.\n     *\n     * `slot` is the *scheduled* fire time (ISO string) derived from the cron\n     * expression — deterministic across instances regardless of timer drift,\n     * so all instances contend on the same (jobId, slot) key. Exactly one\n     * caller wins the insert against the unique constraint and executes;\n     * the rest skip.\n     *\n     * Fails open (returns true) on unexpected store errors, so a broken\n     * claims table degrades to uncoordinated execution rather than silently\n     * never running jobs.\n     *\n     * Optional so custom stores written against the pre-claims interface\n     * keep working — the scheduler treats a missing implementation as\n     * uncoordinated (always run).\n     */\n    tryClaimRun?(jobId: string, slot: string): Promise<boolean>;\n}\n\n// ─── SQL-based implementation ────────────────────────────────────────\n\nconst TABLE = \"rebase.cron_logs\";\nconst CLAIMS_TABLE = \"rebase.cron_claims\";\n\n/** Claims older than this are garbage-collected on startup. */\nconst CLAIM_RETENTION_DAYS = 7;\n\n/**\n * How far ahead a claim may legitimately sit. Slots are claimed as they fire,\n * so anything beyond this is a clock-skewed peer at best and a stranded claim\n * at worst; see the sweep in `ensureTable`.\n */\nconst FUTURE_CLAIM_SKEW_MINUTES = 2;\n\n/**\n * Detect a unique-constraint violation anywhere in an error's cause chain.\n * Match the SQLSTATE code, never message text. Also covers SQLite\n * (\"UNIQUE constraint failed\") and MySQL (ER_DUP_ENTRY 1062) for future SQL\n * drivers.\n *\n * Distinct from `isConcurrentDdlRace` in `boot/ddl-bootstrap.ts`, which shares\n * the 23505 code but asks a different question — that one is about a losing\n * `CREATE`, this one is about a losing claim, and only the latter means\n * \"another instance already has this slot\".\n */\nfunction isUniqueViolation(err: unknown): boolean {\n    return hasInCauseChain(err, (e) =>\n        e.code === \"23505\" ||\n        e.errno === 1062 ||\n        (typeof e.message === \"string\" && e.message.includes(\"UNIQUE constraint failed\"))\n    );\n}\n\nexport function createCronStore(driver: DataDriver): CronStore | undefined {\n    const admin = driver.admin;\n    if (!isSQLAdmin(admin)) {\n        logger.warn(\"⚠️ [cron-store] DataDriver does not support SQL admin — cron logs will not be persisted.\");\n        return undefined;\n    }\n\n    const exec = (sqlText: string, options?: { params?: unknown[] }) =>\n        admin.executeSql(sqlText, options?.params ? { params: options.params } : undefined);\n\n    const ddl = createDdlBootstrapper(exec, \"cron-store\");\n\n    return {\n        async ensureTable(): Promise<void> {\n            // Creation. Every statement here is idempotent, so losing the race\n            // to a peer that booted at the same moment is survivable — but only\n            // if the loser retries rather than abandoning everything below it.\n            // One step each, so a hard failure on any one of them does not take\n            // the others with it. The claims table in particular must not be\n            // lost because an index on the *logs* table could not be built.\n            await ddl.ensureObject(\"Creating schema rebase\", \"CREATE SCHEMA IF NOT EXISTS rebase\");\n\n            await ddl.ensureObject(`Creating ${TABLE}`, `\n                CREATE TABLE IF NOT EXISTS ${TABLE} (\n                    id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,\n                    job_id TEXT NOT NULL,\n                    started_at TIMESTAMPTZ NOT NULL,\n                    finished_at TIMESTAMPTZ NOT NULL,\n                    duration_ms INTEGER NOT NULL,\n                    success BOOLEAN NOT NULL DEFAULT true,\n                    error TEXT,\n                    result JSONB,\n                    logs JSONB,\n                    manual BOOLEAN NOT NULL DEFAULT false\n                )\n            `);\n\n            await ddl.ensureObject(\"Creating idx_cron_logs_job\", `\n                CREATE INDEX IF NOT EXISTS idx_cron_logs_job\n                ON ${TABLE}(job_id, started_at DESC)\n            `);\n\n            await ddl.ensureObject(`Creating ${CLAIMS_TABLE}`, `\n                CREATE TABLE IF NOT EXISTS ${CLAIMS_TABLE} (\n                    job_id TEXT NOT NULL,\n                    slot TIMESTAMPTZ NOT NULL,\n                    claimed_at TIMESTAMPTZ NOT NULL DEFAULT now(),\n                    PRIMARY KEY (job_id, slot)\n                )\n            `);\n\n            // Everything from here is keyed on what actually exists, not on\n            // whether *this* instance is the one that created it. A single\n            // failure above used to abandon the rest of this method, which meant\n            // the loser of a boot race skipped the sweeps and — far worse — the\n            // privilege revocation, leaving the claims table writable by end\n            // users on an instance that reported nothing but a warning about\n            // log persistence.\n            const [logsReady, claimsReady] = await Promise.all([\n                ddl.isReadable(TABLE),\n                ddl.isReadable(CLAIMS_TABLE)\n            ]);\n\n            if (claimsReady) {\n                // Garbage-collect old claims — they are only needed while\n                // instances could still contend on the same slot.\n                await ddl.step(\"Claim retention sweep\", async () => {\n                    await exec(\n                        `DELETE FROM ${CLAIMS_TABLE} WHERE claimed_at < now() - make_interval(days => $1)`,\n                        { params: [CLAIM_RETENTION_DAYS] }\n                    );\n                });\n\n                // Drop claims for slots that have not happened yet. A slot is\n                // claimed at the moment it fires, so a future one can only come\n                // from a timer that woke early — and because claims are\n                // permanent, that claim would silently skip the real run when it\n                // finally came due. The margin keeps a legitimate claim made\n                // moments early by a clock-skewed peer.\n                await ddl.step(\"Future-slot claim sweep\", async () => {\n                    const stranded = await exec(\n                        `DELETE FROM ${CLAIMS_TABLE}\n                         WHERE slot > now() + make_interval(mins => $1)\n                         RETURNING job_id, slot`,\n                        { params: [FUTURE_CLAIM_SKEW_MINUTES] }\n                    );\n                    // A driver that does not honour RETURNING gives back\n                    // nothing; the rows are only used to report, so treat that\n                    // as \"none\".\n                    for (const row of (stranded ?? []) as { job_id: string; slot: string }[]) {\n                        logger.warn(\n                            `[cron-store] Released a claim on the future slot ${new Date(row.slot).toISOString()} ` +\n                            `for \"${row.job_id}\" — it was claimed by a timer that fired early, and would ` +\n                            \"otherwise have skipped that run\"\n                        );\n                    }\n                });\n            }\n\n            // Neither table is a collection, so neither carries RLS, while the\n            // Postgres driver's schema-wide grant reaches both. Cron logs hold\n            // job output — arbitrary application data — and a writable\n            // `cron_claims` lets any signed-in user suppress a scheduled run by\n            // claiming its slot. This is a security control, so it is re-applied\n            // by every instance on every boot, whatever else went wrong.\n            if (logsReady) {\n                await ddl.step(\"Revoking end-user access to cron_logs\", () =>\n                    exec(revokeInternalTableSql(\"rebase\", \"cron_logs\")));\n            }\n            if (claimsReady) {\n                await ddl.step(\"Revoking end-user access to cron_claims\", () =>\n                    exec(revokeInternalTableSql(\"rebase\", \"cron_claims\")));\n            }\n\n            if (logsReady && claimsReady) {\n                logger.info(\"✅ Cron logs table ready\");\n                return;\n            }\n            // Say which capability is gone, and what it costs. \"Continuing\n            // without cron log persistence\" undersold this: the claims table is\n            // the only thing stopping every instance from running every job.\n            if (!claimsReady) {\n                logger.error(\n                    `❌ [cron-store] ${CLAIMS_TABLE} is unavailable — scheduled runs cannot be coordinated. ` +\n                    \"With more than one app instance, every instance will now run every job on every tick.\"\n                );\n            }\n            if (!logsReady) {\n                logger.warn(`⚠️ [cron-store] ${TABLE} is unavailable — cron run history will not be persisted.`);\n            }\n        },\n\n        async insertLog(entry: CronJobLogEntry): Promise<void> {\n            try {\n                const resultJson = entry.result !== undefined ? JSON.stringify(entry.result) : null;\n                const logsJson = entry.logs.length > 0 ? JSON.stringify(entry.logs) : null;\n\n                await exec(\n                    `INSERT INTO ${TABLE} (job_id, started_at, finished_at, duration_ms, success, error, result, logs, manual)\n                     VALUES ($1, $2, $3, $4, $5, $6, $7::jsonb, $8::jsonb, $9)`,\n                    { params: [\n                        entry.jobId,\n                        entry.startedAt,\n                        entry.finishedAt,\n                        entry.durationMs,\n                        entry.success,\n                        entry.error || null,\n                        resultJson,\n                        logsJson,\n                        entry.manual\n                    ]}\n                );\n            } catch (err) {\n                // Non-blocking — log persistence should never crash the scheduler\n                logger.error(`[cron-store] Failed to persist log for \"${entry.jobId}\"`, { error: err });\n            }\n        },\n\n        async fetchLogs(jobId: string, limit = 50): Promise<CronJobLogEntry[]> {\n            try {\n                const rows = await exec(\n                    `SELECT job_id, started_at, finished_at, duration_ms, success, error, result, logs, manual\n                     FROM ${TABLE}\n                     WHERE job_id = $1\n                     ORDER BY started_at DESC\n                     LIMIT $2`,\n                    { params: [jobId, limit] }\n                );\n\n                return rows.map(rowToLogEntry);\n            } catch (err) {\n                logger.error(`[cron-store] Failed to fetch logs for \"${jobId}\"`, { error: err });\n                return [];\n            }\n        },\n\n        async fetchJobStats(): Promise<Map<string, { totalRuns: number; totalFailures: number; lastRunAt?: string }>> {\n            const stats = new Map<string, { totalRuns: number; totalFailures: number; lastRunAt?: string }>();\n            try {\n                const rows = await exec(`\n                    SELECT\n                        job_id,\n                        COUNT(*)::int AS total_runs,\n                        COUNT(*) FILTER (WHERE NOT success)::int AS total_failures,\n                        MAX(started_at) AS last_run_at\n                    FROM ${TABLE}\n                    GROUP BY job_id\n                `);\n\n                for (const row of rows) {\n                    stats.set(row.job_id as string, {\n                        totalRuns: row.total_runs as number,\n                        totalFailures: row.total_failures as number,\n                        lastRunAt: row.last_run_at ? new Date(row.last_run_at as string).toISOString() : undefined\n                    });\n                }\n            } catch (err) {\n                logger.error(\"[cron-store] Failed to fetch job stats\", { error: err });\n            }\n            return stats;\n        },\n\n        async tryClaimRun(jobId: string, slot: string): Promise<boolean> {\n            try {\n                const rows = await exec(\n                    `INSERT INTO ${CLAIMS_TABLE} (job_id, slot)\n                     VALUES ($1, $2)\n                     ON CONFLICT (job_id, slot) DO NOTHING\n                     RETURNING job_id`,\n                    { params: [jobId, slot] }\n                );\n                return rows.length > 0;\n            } catch (err) {\n                if (isUniqueViolation(err)) {\n                    // Another instance won the race for this slot\n                    return false;\n                }\n                // Fail open: better to risk a duplicate run than to have a\n                // broken claims table silently stop all cron execution.\n                logger.warn(`[cron-store] Claim check failed for \"${jobId}\" — running uncoordinated`, { error: err });\n                return true;\n            }\n        }\n    };\n}\n\n// ─── Helpers ─────────────────────────────────────────────────────────\n\nfunction rowToLogEntry(row: Record<string, unknown>): CronJobLogEntry {\n    return {\n        jobId: row.job_id as string,\n        startedAt: new Date(row.started_at as string).toISOString(),\n        finishedAt: new Date(row.finished_at as string).toISOString(),\n        durationMs: row.duration_ms as number,\n        success: row.success as boolean,\n        error: (row.error as string) ?? undefined,\n        result: row.result ?? undefined,\n        logs: Array.isArray(row.logs) ? row.logs : (row.logs ? (() => { try { return JSON.parse(row.logs as string); } catch { return []; } })() : []),\n        manual: row.manual as boolean\n    };\n}\n"],"mappings":";;;;;;;;;;;AAyDA,IAAM,QAAQ;AACd,IAAM,eAAe;;AAGrB,IAAM,uBAAuB;;;;;;AAO7B,IAAM,4BAA4B;;;;;;;;;;;;AAalC,SAAS,kBAAkB,KAAuB;CAC9C,OAAO,gBAAgB,MAAM,MACzB,EAAE,SAAS,WACX,EAAE,UAAU,QACX,OAAO,EAAE,YAAY,YAAY,EAAE,QAAQ,SAAS,0BAA0B,CACnF;AACJ;AAEA,SAAgB,gBAAgB,QAA2C;CACvE,MAAM,QAAQ,OAAO;CACrB,IAAI,CAAC,WAAW,KAAK,GAAG;EACpB,OAAO,KAAK,0FAA0F;EACtG;CACJ;CAEA,MAAM,QAAQ,SAAiB,YAC3B,MAAM,WAAW,SAAS,SAAS,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,KAAA,CAAS;CAEtF,MAAM,MAAM,sBAAsB,MAAM,YAAY;CAEpD,OAAO;EACH,MAAM,cAA6B;GAO/B,MAAM,IAAI,aAAa,0BAA0B,oCAAoC;GAErF,MAAM,IAAI,aAAa,YAAY,SAAS;6CACX,MAAM;;;;;;;;;;;;aAYtC;GAED,MAAM,IAAI,aAAa,8BAA8B;;qBAE5C,MAAM;aACd;GAED,MAAM,IAAI,aAAa,YAAY,gBAAgB;6CAClB,aAAa;;;;;;aAM7C;GASD,MAAM,CAAC,WAAW,eAAe,MAAM,QAAQ,IAAI,CAC/C,IAAI,WAAW,KAAK,GACpB,IAAI,WAAW,YAAY,CAC/B,CAAC;GAED,IAAI,aAAa;IAGb,MAAM,IAAI,KAAK,yBAAyB,YAAY;KAChD,MAAM,KACF,eAAe,aAAa,wDAC5B,EAAE,QAAQ,CAAC,oBAAoB,EAAE,CACrC;IACJ,CAAC;IAQD,MAAM,IAAI,KAAK,2BAA2B,YAAY;KAClD,MAAM,WAAW,MAAM,KACnB,eAAe,aAAa;;kDAG5B,EAAE,QAAQ,CAAC,yBAAyB,EAAE,CAC1C;KAIA,KAAK,MAAM,OAAQ,YAAY,CAAC,GAC5B,OAAO,KACH,oDAAoD,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,YAAY,EAAE,QAC7E,IAAI,OAAO,0FAEvB;IAER,CAAC;GACL;GAQA,IAAI,WACA,MAAM,IAAI,KAAK,+CACX,KAAK,uBAAuB,UAAU,WAAW,CAAC,CAAC;GAE3D,IAAI,aACA,MAAM,IAAI,KAAK,iDACX,KAAK,uBAAuB,UAAU,aAAa,CAAC,CAAC;GAG7D,IAAI,aAAa,aAAa;IAC1B,OAAO,KAAK,yBAAyB;IACrC;GACJ;GAIA,IAAI,CAAC,aACD,OAAO,MACH,kBAAkB,aAAa,8IAEnC;GAEJ,IAAI,CAAC,WACD,OAAO,KAAK,mBAAmB,MAAM,0DAA0D;EAEvG;EAEA,MAAM,UAAU,OAAuC;GACnD,IAAI;IACA,MAAM,aAAa,MAAM,WAAW,KAAA,IAAY,KAAK,UAAU,MAAM,MAAM,IAAI;IAC/E,MAAM,WAAW,MAAM,KAAK,SAAS,IAAI,KAAK,UAAU,MAAM,IAAI,IAAI;IAEtE,MAAM,KACF,eAAe,MAAM;iFAErB,EAAE,QAAQ;KACN,MAAM;KACN,MAAM;KACN,MAAM;KACN,MAAM;KACN,MAAM;KACN,MAAM,SAAS;KACf;KACA;KACA,MAAM;IACV,EAAC,CACL;GACJ,SAAS,KAAK;IAEV,OAAO,MAAM,2CAA2C,MAAM,MAAM,IAAI,EAAE,OAAO,IAAI,CAAC;GAC1F;EACJ;EAEA,MAAM,UAAU,OAAe,QAAQ,IAAgC;GACnE,IAAI;IAUA,QAAO,MATY,KACf;4BACQ,MAAM;;;gCAId,EAAE,QAAQ,CAAC,OAAO,KAAK,EAAE,CAC7B,EAAA,CAEY,IAAI,aAAa;GACjC,SAAS,KAAK;IACV,OAAO,MAAM,0CAA0C,MAAM,IAAI,EAAE,OAAO,IAAI,CAAC;IAC/E,OAAO,CAAC;GACZ;EACJ;EAEA,MAAM,gBAAwG;GAC1G,MAAM,wBAAQ,IAAI,IAA8E;GAChG,IAAI;IACA,MAAM,OAAO,MAAM,KAAK;;;;;;2BAMb,MAAM;;iBAEhB;IAED,KAAK,MAAM,OAAO,MACd,MAAM,IAAI,IAAI,QAAkB;KAC5B,WAAW,IAAI;KACf,eAAe,IAAI;KACnB,WAAW,IAAI,cAAc,IAAI,KAAK,IAAI,WAAqB,CAAC,CAAC,YAAY,IAAI,KAAA;IACrF,CAAC;GAET,SAAS,KAAK;IACV,OAAO,MAAM,0CAA0C,EAAE,OAAO,IAAI,CAAC;GACzE;GACA,OAAO;EACX;EAEA,MAAM,YAAY,OAAe,MAAgC;GAC7D,IAAI;IAQA,QAAO,MAPY,KACf,eAAe,aAAa;;;wCAI5B,EAAE,QAAQ,CAAC,OAAO,IAAI,EAAE,CAC5B,EAAA,CACY,SAAS;GACzB,SAAS,KAAK;IACV,IAAI,kBAAkB,GAAG,GAErB,OAAO;IAIX,OAAO,KAAK,wCAAwC,MAAM,4BAA4B,EAAE,OAAO,IAAI,CAAC;IACpG,OAAO;GACX;EACJ;CACJ;AACJ;AAIA,SAAS,cAAc,KAA+C;CAClE,OAAO;EACH,OAAO,IAAI;EACX,WAAW,IAAI,KAAK,IAAI,UAAoB,CAAC,CAAC,YAAY;EAC1D,YAAY,IAAI,KAAK,IAAI,WAAqB,CAAC,CAAC,YAAY;EAC5D,YAAY,IAAI;EAChB,SAAS,IAAI;EACb,OAAQ,IAAI,SAAoB,KAAA;EAChC,QAAQ,IAAI,UAAU,KAAA;EACtB,MAAM,MAAM,QAAQ,IAAI,IAAI,IAAI,IAAI,OAAQ,IAAI,cAAc;GAAE,IAAI;IAAE,OAAO,KAAK,MAAM,IAAI,IAAc;GAAG,QAAQ;IAAE,OAAO,CAAC;GAAG;EAAE,EAAA,CAAG,IAAI,CAAC;EAC5I,QAAQ,IAAI;CAChB;AACJ"}

package/dist/ddl-bootstrap-CfNvxMuK.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"ddl-bootstrap-CfNvxMuK.js","names":[],"sources":["../../types/src/types/backend.ts","../src/boot/ddl-bootstrap.ts"],"sourcesContent":["import type { CollectionConfig, FilterValues, WhereFilterOp } from \"./collections\";\nimport type { OrderByTuple } from \"./filter-operators\";\nimport type { LogicalCondition } from \"../controllers/data\";\nimport type { AuthAdapter } from \"./auth_adapter\";\nimport type { HistoryConfig } from \"../controllers/client\";\nimport type { ChannelBusSetting } from \"./channel_bus\";\nimport type { SchemaEditingAdmin } from \"./schema_editing\";\n\n// =============================================================================\n// DATABASE CONNECTION INTERFACES\n// =============================================================================\n\n/**\n * Abstract database connection interface.\n * Represents a connection to any database system.\n */\nexport interface DatabaseConnection {\n    /**\n     * Type identifier for this database (e.g., 'postgres', 'mongodb', 'mysql')\n     */\n    readonly type: string;\n\n    /**\n     * Whether the connection is currently active\n     */\n    readonly isConnected?: boolean;\n\n    /**\n     * Close the database connection and release resources.\n     */\n    close?(): Promise<void>;\n}\n\n// =============================================================================\n// QUERY BUILDING INTERFACES\n// =============================================================================\n\n/**\n * A single filter condition for database queries\n */\nexport interface QueryFilter {\n    field: string;\n    operator: WhereFilterOp;\n    value: unknown;\n}\n\n/**\n * Options for fetching a collection of entities\n */\nexport interface FetchCollectionOptions<M extends Record<string, unknown> = Record<string, unknown>> {\n    filter?: FilterValues<Extract<keyof M, string>>;\n    /** See `FetchCollectionProps.orderBy`: a field name plus `order`, or a list of tuples. */\n    orderBy?: string | OrderByTuple[];\n    order?: \"desc\" | \"asc\";\n    limit?: number;\n    offset?: number;\n    startAfter?: unknown;\n    searchString?: string;\n    databaseId?: string;\n    collection?: CollectionConfig;\n}\n\n/**\n * Options for searching entities\n */\nexport interface SearchOptions<M extends Record<string, unknown> = Record<string, unknown>> {\n    filter?: FilterValues<Extract<keyof M, string>>;\n    /** See `FetchCollectionProps.orderBy`: a field name plus `order`, or a list of tuples. */\n    orderBy?: string | OrderByTuple[];\n    order?: \"desc\" | \"asc\";\n    limit?: number;\n    databaseId?: string;\n    collection?: CollectionConfig;\n}\n\n/**\n * Options for counting entities\n */\nexport interface CountOptions<M extends Record<string, unknown> = Record<string, unknown>> {\n    filter?: FilterValues<Extract<keyof M, string>>;\n    /**\n     * An `or(...)`/`and(...)` group, alongside `filter`.\n     *\n     * Counted as well as fetched, or `total` describes a different set of rows\n     * from the one that was served — the same reason `filter` is here.\n     */\n    logical?: LogicalCondition;\n    searchString?: string;\n    databaseId?: string;\n}\n\n/**\n * Abstract condition builder interface.\n * Implementations translate Rebase filter conditions to database-specific queries.\n *\n * Note: This interface can be implemented as instance methods or as a class with static methods.\n * For static implementations (like DrizzleConditionBuilder), use the ConditionBuilderStatic type.\n *\n * @template T The type of condition returned by the builder (e.g., SQL for PostgreSQL, Filter<Document> for MongoDB)\n */\nexport interface ConditionBuilder<T = unknown> {\n    /**\n     * Build filter conditions from Rebase FilterValues\n     */\n    buildFilterConditions<M extends Record<string, unknown>>(\n        filter: FilterValues<Extract<keyof M, string>>,\n        collectionPath: string,\n        ...args: unknown[]\n    ): T[];\n\n    /**\n     * Build search conditions for text search\n     */\n    buildSearchConditions(\n        searchString: string,\n        properties: Record<string, unknown>,\n        ...args: unknown[]\n    ): T[];\n\n    /**\n     * Combine multiple conditions with AND operator\n     */\n    combineConditionsWithAnd(conditions: T[]): T | undefined;\n\n    /**\n     * Combine multiple conditions with OR operator\n     */\n    combineConditionsWithOr(conditions: T[]): T | undefined;\n}\n\n/**\n * Static condition builder type for implementations using static methods.\n * Use this type when the class provides static methods rather than instance methods.\n *\n * @example\n * // DrizzleConditionBuilder satisfies this type\n * const builder: ConditionBuilderStatic<SQL> = DrizzleConditionBuilder;\n */\nexport type ConditionBuilderStatic<T = unknown> = {\n    buildFilterConditions<M extends Record<string, unknown>>(\n        filter: FilterValues<Extract<keyof M, string>>,\n        ...args: unknown[]\n    ): T[];\n    buildSearchConditions(\n        searchString: string,\n        properties: Record<string, unknown>,\n        ...args: unknown[]\n    ): T[];\n    combineConditionsWithAnd(conditions: T[]): T | undefined;\n    combineConditionsWithOr(conditions: T[]): T | undefined;\n};\n\n// =============================================================================\n// ENTITY REPOSITORY INTERFACES\n// =============================================================================\n\n/**\n * Abstract entity repository interface.\n * Handles all CRUD operations for entities in the database.\n *\n * Implementations should handle:\n * - Entity serialization/deserialization\n * - Relation resolution\n * - ID generation and conversion\n */\nexport interface DataRepository {\n    /**\n     * Fetch a single entity by ID\n     */\n    fetchOne<M extends Record<string, unknown>>(\n        collectionPath: string,\n        id: string | number,\n        databaseId?: string\n    ): Promise<Record<string, unknown> | undefined>;\n\n    /**\n     * Fetch a collection of entities with optional filtering, ordering, and pagination\n     */\n    fetchCollection<M extends Record<string, unknown>>(\n        collectionPath: string,\n        options?: FetchCollectionOptions<M>\n    ): Promise<Record<string, unknown>[]>;\n\n    /**\n     * Search entities by text\n     */\n    searchRows<M extends Record<string, unknown>>(\n        collectionPath: string,\n        searchString: string,\n        options?: SearchOptions<M>\n    ): Promise<Record<string, unknown>[]>;\n\n    /**\n     * Count entities in a collection\n     */\n    count<M extends Record<string, unknown>>(\n        collectionPath: string,\n        options?: CountOptions<M>\n    ): Promise<number>;\n\n    /**\n     * Save a entity (create or update)\n     */\n    save<M extends Record<string, unknown>>(\n        collectionPath: string,\n        values: Partial<M>,\n        id?: string | number,\n        databaseId?: string\n    ): Promise<Record<string, unknown>>;\n\n    /**\n     * Delete a entity by ID\n     */\n    delete(\n        collectionPath: string,\n        id: string | number,\n        databaseId?: string\n    ): Promise<void>;\n\n    /**\n     * Check if a field value is unique in a collection\n     */\n    checkUniqueField(\n        collectionPath: string,\n        fieldName: string,\n        value: unknown,\n        excludeEntityId?: string,\n        databaseId?: string\n    ): Promise<boolean>;\n\n}\n\n// =============================================================================\n// REALTIME INTERFACES\n// =============================================================================\n\n/**\n * Configuration for subscribing to a collection\n */\nexport interface CollectionSubscriptionConfig {\n    clientId: string;\n    path: string;\n    filter?: unknown;\n    /**\n     * An `or(...)`/`and(...)` group, applied alongside `filter`.\n     *\n     * Declared here because a subscription is a query, and every field a query\n     * has this one needs too. It was missing, so the type-checked boundary\n     * dropped it: the client sent the group, nothing rejected it, and the\n     * subscription re-fetched with the group gone — pushing every row the\n     * caller's policies allowed rather than the ones they asked for. The same\n     * defect `FetchCollectionProps.logical` documents, one layer up.\n     */\n    logical?: LogicalCondition;\n    /**\n     * Where the subscription's page starts. Missing for the same reason, with\n     * a quieter symptom: a subscriber watching page two was pushed page one,\n     * and a `collection_update` frame carries no window for it to notice with.\n     */\n    offset?: number;\n    /** See `FetchCollectionProps.orderBy`: a field name plus `order`, or a list of tuples. */\n    orderBy?: string | OrderByTuple[];\n    order?: \"desc\" | \"asc\";\n    limit?: number;\n    startAfter?: unknown;\n    databaseId?: string;\n    searchString?: string;\n    /** Ask each row which declared search field matched. */\n    searchExplain?: boolean;\n}\n\n/**\n * Configuration for subscribing to a single entity\n */\nexport interface SingleSubscriptionConfig {\n    clientId: string;\n    path: string;\n    id: string | number;\n}\n\n/**\n * Opt-in retention for one set of broadcast channels.\n *\n * Retention is configured on the server and nowhere else. A channel is created\n * by whoever names it, so letting a client ask for its own history depth would\n * let any visitor commit the backend to unbounded storage; and presence-only or\n * notification-only channels — the overwhelming majority — must not pay for a\n * feature they never use. With no rules configured nothing is written, no table\n * is created, and broadcast behaves exactly as it did before history existed.\n */\nexport interface ChannelRetentionRule {\n    /**\n     * Channel name to match. Either exact (`\"doc:42\"`) or a trailing-`*` prefix\n     * (`\"doc:*\"`). Deliberately not a full glob or RegExp: this decides what\n     * gets written to disk, and a rule whose blast radius is not obvious at a\n     * glance is the wrong shape for that.\n     */\n    match: string;\n    /** Keep at most this many of the most recent messages per channel. */\n    limit?: number;\n    /**\n     * Keep messages for at most this long. Accepts a millisecond count or a\n     * short duration string (`\"30s\"`, `\"15m\"`, `\"24h\"`, `\"7d\"`).\n     */\n    ttl?: number | string;\n}\n\n/**\n * Server-side realtime options.\n *\n * The channel bus contract and its config live in `./channel_bus` so that a\n * transport shipped as its own package depends on the contract alone.\n */\nexport interface RealtimeChannelsConfig {\n    /**\n     * Retention rules, most specific first — the first match wins. Omitted or\n     * empty means no channel retains anything.\n     */\n    channels?: ChannelRetentionRule[];\n    /**\n     * How channel broadcast and presence reach other backend instances.\n     * Defaults to `{ type: \"memory\" }` — i.e. they don't.\n     */\n    bus?: ChannelBusSetting;\n}\n\n/**\n * Abstract realtime provider interface.\n * Handles real-time subscriptions and notifications for entity changes.\n */\nexport interface RealtimeProvider {\n    /**\n     * Subscribe to collection changes.\n     *\n     * `onError` is called when a fetch behind the subscription fails, a\n     * refetch after a change included, with the error as it was thrown. It is\n     * not called for a fetch that newer rows have already overtaken, or after\n     * the subscription is gone. Without it, a subscriber whose fetch failed\n     * was told nothing and kept waiting for rows.\n     */\n    subscribeToCollection(\n        subscriptionId: string,\n        config: CollectionSubscriptionConfig,\n        callback?: (rows: Record<string, unknown>[]) => void,\n        onError?: (error: unknown) => void\n    ): void;\n\n    /**\n     * Subscribe to single entity changes. `onError` as for\n     * {@link RealtimeProvider.subscribeToCollection}.\n     */\n    subscribeToOne(\n        subscriptionId: string,\n        config: SingleSubscriptionConfig,\n        callback?: (row: Record<string, unknown> | null) => void,\n        onError?: (error: unknown) => void\n    ): void;\n\n    /**\n     * Unsubscribe from a subscription\n     */\n    unsubscribe(subscriptionId: string): void;\n\n    /**\n     * Notify all relevant subscribers of a entity update\n     */\n    notifyUpdate(\n        path: string,\n        id: string,\n        row: Record<string, unknown> | null,\n        databaseId?: string\n    ): Promise<void>;\n\n    /**\n     * Called when the HTTP server is ready and listening.\n     * Useful for providers that need the server address for callbacks.\n     */\n    onServerReady?(serverInfo: { port: number; hostname?: string }): void;\n\n    /**\n     * Gracefully shut down the realtime provider.\n     * Called during server shutdown to clean up resources.\n     */\n    destroy?(): Promise<void>;\n\n    /**\n     * Stop the internal LISTEN client (e.g., PostgreSQL LISTEN/NOTIFY).\n     * Called during graceful shutdown before closing database connections.\n     */\n    stopListening?(): Promise<void>;\n}\n\n// =============================================================================\n// COLLECTION REGISTRY INTERFACES\n// =============================================================================\n\n/**\n * Abstract collection registry interface.\n * Manages registration and lookup of entity collections.\n */\nexport interface CollectionRegistryInterface {\n    /**\n     * Register a collection\n     */\n    register(collection: CollectionConfig): void;\n\n    /**\n     * Get a collection by its path\n     */\n    getCollectionByPath(path: string): CollectionConfig | undefined;\n\n    /**\n     * Get all registered collections\n     */\n    getCollections(): CollectionConfig[];\n\n    /**\n     * Get the currently registered global callbacks, if any.\n     */\n    getGlobalCallbacks(): any | undefined;\n}\n\n// =============================================================================\n// DATA TRANSFORMER INTERFACES\n// =============================================================================\n\n/**\n * Abstract data transformer interface.\n * Handles serialization/deserialization between frontend and database formats.\n */\nexport interface DataTransformer {\n    /**\n     * Transform entity data for storage in the database\n     */\n    serializeToDatabase<M extends Record<string, unknown>>(\n        entity: M,\n        collection: CollectionConfig\n    ): Record<string, unknown>;\n\n    /**\n     * Transform database data back to entity format\n     */\n    deserializeFromDatabase<M extends Record<string, unknown>>(\n        data: Record<string, unknown>,\n        collection: CollectionConfig\n    ): Promise<M>;\n}\n\n// =============================================================================\n// DATABASE ADMIN — CAPABILITY-SPECIFIC INTERFACES (1.3)\n// =============================================================================\n\n/**\n * Administrative operations for SQL-based databases (PostgreSQL, MySQL, etc.).\n * Used by the SQL Editor, RLS Editor, and schema browser.\n *\n * @group Admin\n */\nexport interface SQLAdmin {\n    /**\n     * Execute raw SQL against the database.\n     */\n    executeSql(sql: string, options?: { database?: string; role?: string; params?: unknown[] }): Promise<Record<string, unknown>[]>;\n\n    /**\n     * Fetch the available databases on the server.\n     */\n    fetchAvailableDatabases?(): Promise<string[]>;\n\n    /**\n     * Fetch the available *native PostgreSQL* database roles (from `pg_roles`).\n     *\n     * These are connection-level roles — what the SQL editor can `SET ROLE` to,\n     * and what `SecurityRule.pgRoles` targets. They are NOT application roles;\n     * for those use {@link fetchApplicationRoles}.\n     */\n    fetchAvailableRoles?(): Promise<string[]>;\n\n    /**\n     * Fetch the *application-level* roles in use in this project.\n     *\n     * These are the strings stored on the users table's `roles` column and\n     * exposed to policies as `rebase.roles()` — what `SecurityRule.roles`\n     * matches against. Distinct from {@link fetchAvailableRoles}; the two are\n     * not interchangeable.\n     */\n    fetchApplicationRoles?(): Promise<string[]>;\n\n    /**\n     * Fetch the current database name.\n     */\n    fetchCurrentDatabase?(): Promise<string | undefined>;\n}\n\n/**\n * Administrative operations for document-based databases (MongoDB, Firestore, etc.).\n * Used by future document administration tools.\n *\n * @group Admin\n */\nexport interface DocumentAdmin {\n    /**\n     * Execute an aggregation pipeline or equivalent query.\n     */\n    executeAggregate?(pipeline: Record<string, unknown>[]): Promise<Record<string, unknown>[]>;\n\n    /**\n     * Fetch statistics for a collection (document count, size, etc.).\n     */\n    fetchCollectionStats?(collectionName: string): Promise<{ count: number; sizeBytes?: number }>;\n}\n\n/**\n * Administrative operations for schema management.\n * Shared across SQL and document databases.\n *\n * @group Admin\n */\nexport interface SchemaAdmin {\n    /**\n     * Fetch database tables/collections not yet mapped to a Rebase collection.\n     */\n    fetchUnmappedTables?(mappedPaths?: string[]): Promise<string[]>;\n\n    /**\n     * Fetch column/field metadata for a single table/collection.\n     * The return type is generic — SQL backends return TableMetadata,\n     * document backends may return a different shape.\n     */\n    fetchTableMetadata?(tableName: string): Promise<unknown>;\n}\n\n/**\n * Metadata for a database branch.\n * @group Admin\n */\nexport interface BranchInfo {\n    /** Branch name (without prefix). */\n    name: string;\n    /** The database this branch was created from. */\n    parentDatabase: string;\n    /** When the branch was created. */\n    createdAt: Date;\n    /** Size in bytes, if available from the server. */\n    sizeBytes?: number;\n}\n\n/**\n * Administrative operations for database branching.\n * Allows creating isolated database copies for development/preview workflows.\n *\n * @group Admin\n */\nexport interface BranchAdmin {\n    /** Create a new branch (database copy) from the current or specified source database. */\n    createBranch(name: string, options?: { source?: string }): Promise<BranchInfo>;\n\n    /** Delete a branch database. Cannot delete the main/default database. */\n    deleteBranch(name: string): Promise<void>;\n\n    /** List all branches (databases that were created via branching). */\n    listBranches(): Promise<BranchInfo[]>;\n\n    /** Get info about a specific branch. */\n    getBranchInfo(name: string): Promise<BranchInfo | undefined>;\n}\n\n/**\n * Union type for all admin capabilities.\n * A backend may implement any combination of these interfaces.\n *\n * Use type guards (`isSQLAdmin`, `isDocumentAdmin`, `isSchemaAdmin`, `isBranchAdmin`)\n * to safely narrow the type before calling methods.\n *\n * @group Admin\n */\nexport type DatabaseAdmin = Partial<SQLAdmin> & Partial<DocumentAdmin> & Partial<SchemaAdmin>\n    & Partial<BranchAdmin> & Partial<SchemaEditingAdmin>;\n\n/**\n * Type guard: can this admin plan a live schema change?\n *\n * Planning is engine-specific — it renders DDL, a Drizzle schema and the\n * declarative SQL artifacts — so the implementation lives in the driver\n * package. The server detects the capability structurally, exactly as it does\n * for SQL, rather than importing an engine it is supposed to know nothing\n * about.\n *\n * @group Admin\n */\nexport function isSchemaEditingAdmin(admin: DatabaseAdmin | undefined): admin is SchemaEditingAdmin {\n    return !!admin && typeof (admin as SchemaEditingAdmin).planSchemaChange === \"function\";\n}\n\n/**\n * Type guard: does this admin support SQL operations?\n * @group Admin\n */\nexport function isSQLAdmin(admin: DatabaseAdmin | undefined): admin is SQLAdmin {\n    return !!admin && typeof (admin as SQLAdmin).executeSql === \"function\";\n}\n\n/**\n * Type guard: does this admin support document operations?\n * @group Admin\n */\nexport function isDocumentAdmin(admin: DatabaseAdmin | undefined): admin is DocumentAdmin {\n    return !!admin && (\n        typeof (admin as DocumentAdmin).executeAggregate === \"function\" ||\n        typeof (admin as DocumentAdmin).fetchCollectionStats === \"function\"\n    );\n}\n\n/**\n * Type guard: does this admin support schema management?\n * @group Admin\n */\nexport function isSchemaAdmin(admin: DatabaseAdmin | undefined): admin is SchemaAdmin {\n    return !!admin && (\n        typeof (admin as SchemaAdmin).fetchUnmappedTables === \"function\" ||\n        typeof (admin as SchemaAdmin).fetchTableMetadata === \"function\"\n    );\n}\n\n/**\n * Type guard: does this admin support database branching?\n * @group Admin\n */\nexport function isBranchAdmin(admin: DatabaseAdmin | undefined): admin is BranchAdmin {\n    return !!admin && typeof (admin as BranchAdmin).createBranch === \"function\";\n}\n\n// =============================================================================\n// LIFECYCLE INTERFACES (1.4)\n// =============================================================================\n\n/**\n * Health check result returned by `healthCheck()`.\n * @group Lifecycle\n */\nexport interface HealthCheckResult {\n    /** Whether the backend is healthy and able to serve requests. */\n    healthy: boolean;\n    /** Round-trip latency to the database in milliseconds. */\n    latencyMs: number;\n    /** Optional details (e.g., pool stats, replication lag). */\n    details?: Record<string, unknown>;\n}\n\n/**\n * Lifecycle contract for backend components that hold resources\n * (database connections, WebSocket pools, timers, etc.).\n *\n * All methods are optional — simple backends (e.g., in-memory) can skip them.\n * @group Lifecycle\n */\nexport interface BackendLifecycle {\n    /**\n     * Initialize the backend: open connections, run migrations, seed data.\n     * Called once during startup. Idempotent.\n     */\n    initialize?(): Promise<void>;\n\n    /**\n     * Check whether the backend is healthy and reachable.\n     * Should be fast (< 1 s) and safe to call frequently.\n     */\n    healthCheck?(): Promise<HealthCheckResult>;\n\n    /**\n     * Gracefully shut down: close connections, flush buffers, cancel timers.\n     * After calling `destroy()`, no other methods should be called.\n     */\n    destroy?(): Promise<void>;\n}\n\n// =============================================================================\n// BACKEND FACTORY INTERFACES\n// =============================================================================\n\n/**\n * Configuration for creating a database backend\n */\nexport interface BackendConfig {\n    /**\n     * Type of database backend\n     */\n    type: string;\n\n    /**\n     * Database connection (implementation-specific)\n     */\n    connection: unknown;\n\n    /**\n     * Schema definition (implementation-specific, e.g., Drizzle schema for PostgreSQL)\n     */\n    schema?: unknown;\n}\n\n/**\n * A complete backend instance with all required services.\n *\n * Now includes optional lifecycle management and admin capabilities.\n */\nexport interface BackendInstance extends BackendLifecycle {\n    /**\n     * Entity repository for CRUD operations\n     */\n    entityRepository: DataRepository;\n\n    /**\n     * Realtime provider for subscriptions\n     */\n    realtimeProvider: RealtimeProvider;\n\n    /**\n     * Collection registry\n     */\n    collectionRegistry: CollectionRegistryInterface;\n\n    /**\n     * The underlying database connection\n     */\n    connection: DatabaseConnection;\n\n    /**\n     * Administrative operations (SQL, schema, documents).\n     * What's available depends on the backend type — use type guards\n     * (`isSQLAdmin`, `isSchemaAdmin`, etc.) to narrow.\n     */\n    admin?: DatabaseAdmin;\n}\n\n/**\n * Factory function type for creating backend instances\n */\nexport type BackendFactory<TConfig extends BackendConfig = BackendConfig> =\n    (config: TConfig) => BackendInstance;\n\n// =============================================================================\n// BACKEND BOOTSTRAPPER (1.2)\n// =============================================================================\n\n/**\n * A `BackendBootstrapper` encapsulates all driver-specific initialization logic.\n *\n * Instead of hard-coding Postgres setup into `initializeRebaseBackend()`,\n * each database backend provides its own bootstrapper that knows how to:\n * - Create the DataDriver from a config object\n * - Optionally initialize auth tables\n * - Optionally create a realtime service\n * - Mount driver-specific API routes\n *\n * The main `initializeRebaseBackend()` becomes a **coordinator** that iterates\n * registered bootstrappers, calls their hooks, and wires the results together.\n *\n * @group Backend\n *\n * @example\n * ```typescript\n * // Third-party MySQL bootstrapper\n * const mysqlBootstrapper: BackendBootstrapper = {\n *   type: \"mysql\",\n *   initializeDriver: async (config) => new MySQLDataDriver(config.connection),\n *   initializeRealtime: async (config) => new MySQLChangeStreamRealtime(config.connection),\n * };\n *\n * initializeRebaseBackend({\n *   ...config,\n *   bootstrappers: [postgresBootstrapper, mysqlBootstrapper]\n * });\n * ```\n */\nexport interface BackendBootstrapper {\n    /**\n     * Which driver type this bootstrapper handles.\n     * Must match the `type` field on the driver config object\n     * (e.g., `\"postgres\"`, `\"mongodb\"`, `\"mysql\"`).\n     */\n    type: string;\n\n    /**\n     * Unique identifier for this bootstrapper instance.\n     * Used to register the driver in the driver registry.\n     * Defaults to `type` if not set.\n     */\n    id?: string;\n\n    /**\n     * Whether this bootstrapper provides the default driver.\n     * When true, the coordinator uses this driver as the primary one.\n     */\n    isDefault?: boolean;\n\n    /**\n     * Run database migrations for this driver.\n     * Called by the coordinator after all drivers are initialized.\n     */\n    runMigrations?(config: unknown, driverResult: InitializedDriver): Promise<void>;\n\n    /**\n     * Create a DataDriver from the given config.\n     * This is the only **required** method.\n     */\n    initializeDriver(config: unknown): Promise<InitializedDriver>;\n\n    /**\n     * Initialize auth tables / services if this driver supports them.\n     * Return undefined if auth is not supported by this backend.\n     */\n    initializeAuth?(config: unknown, driverResult: InitializedDriver): Promise<BootstrappedAuth | undefined>;\n\n    /**\n     * Initialize history tables / services if this driver supports them.\n     * Return undefined if history is not supported by this backend.\n     */\n    initializeHistory?(config: HistoryConfig, driverResult: InitializedDriver): Promise<{ historyService: unknown } | undefined>;\n\n    /**\n     * Create a realtime provider for this driver.\n     * Return undefined if the driver does not support realtime.\n     */\n    initializeRealtime?(config: unknown, driverResult: InitializedDriver): Promise<RealtimeProvider | undefined>;\n\n    /**\n     * Mount any driver-specific HTTP routes (e.g., custom admin endpoints).\n     * Called after all drivers are initialized.\n     */\n    mountRoutes?(app: unknown, basePath: string, driverResult: InitializedDriver): void;\n\n    /**\n     * Return admin capabilities for this driver.\n     */\n    getAdmin?(driverResult: InitializedDriver): DatabaseAdmin | undefined;\n\n    /**\n     * Ask the database whether it is there, before anything else touches it.\n     *\n     * Boot's first database call is not `initializeDriver` — it is the schema\n     * provisioning that runs ahead of it, and a driver's connection diagnosis\n     * therefore never got the chance to run. A stopped database produced\n     * `Failed query: [redacted]` and a stack through drizzle internals: no host,\n     * no port, no `ECONNREFUSED`, and no hint about starting the thing.\n     *\n     * Implementations MUST issue the cheapest round trip they have (`SELECT 1`),\n     * MUST throw an error whose message names the host, the port and the\n     * driver's own reason, and MAY log a fuller diagnosis first. They MUST NOT\n     * throw for a reachable database that merely answered something unexpected —\n     * the caller treats a throw as fatal.\n     *\n     * `driverResult` is optional for the same reason as\n     * {@link ensureCollectionSchema}: this runs before `initializeDriver`, so an\n     * adapter that was constructed with its own connection has to fall back to\n     * it.\n     */\n    verifyConnection?(driverResult?: InitializedDriver): Promise<void>;\n\n    /**\n     * Bring the database's collection tables up to date, additively.\n     *\n     * Optional because it is only meaningful for schema-ful drivers. A managed\n     * runtime boots a compiled project against a database it has never seen; auth\n     * tables are ensured on boot but collection tables were created by nothing,\n     * so every data request answered 500 on a missing relation. The CLI's `db\n     * push` cannot fill the gap — it needs Atlas, and the runtime image ships no\n     * CLI.\n     *\n     * Implementations MUST be additive-only: create missing tables, columns and\n     * enum types, and never drop, narrow or rewrite anything. This runs\n     * unattended against live customer data with nobody reading a diff, so the\n     * destructive half stays a deliberate migration.\n     *\n     * `driverResult` is optional: this runs before `initializeDriver`, and only\n     * the bundle path has a pre-init stand-in to pass. An adapter built by an\n     * application already holds its own connection and MUST use it when this is\n     * `undefined` — dereferencing it unconditionally works for managed tenants\n     * and breaks every app that builds its own adapter.\n     */\n    ensureCollectionSchema?(\n        collections: unknown[],\n        driverResult?: InitializedDriver,\n        log?: (message: string) => void\n    ): Promise<{ applied: number }>;\n\n    /**\n     * Apply the collections' row-level-security policies, additively and\n     * idempotently — the companion to {@link ensureCollectionSchema}.\n     *\n     * That method creates the tables; a table with RLS disabled and no policies\n     * is not servable, because authenticated requests run as a restricted role:\n     * a read with no `SELECT` policy returns nothing (a public collection\n     * answers 401) and a write with no `INSERT`/`UPDATE` policy is denied. The\n     * `db push` CLI applies these from the same collections, but it cannot reach\n     * a managed tenant's in-cluster database — the runtime, already connected,\n     * is the only thing that can.\n     *\n     * MUST be idempotent (re-run on every boot) and MUST NOT be destructive.\n     * Runs after auth initialization, because the generated policies call the\n     * `auth.*` helper functions and `CREATE POLICY` validates they exist.\n     */\n    ensureCollectionPolicies?(\n        collections: unknown[],\n        driverResult?: InitializedDriver,\n        log?: (message: string) => void\n    ): Promise<{ applied: number }>;\n\n    /**\n     * Create the RLS helper functions on this source's database. See\n     * `DatabaseAdapter.ensureRlsRuntime`; needed on every source that is not\n     * the default, whose helpers arrive with the auth tables.\n     */\n    ensureRlsRuntime?(driverResult?: InitializedDriver): Promise<void>;\n\n    /**\n     * Re-check, after the schema exists, that requests will actually be\n     * constrained by the database's own authorization.\n     *\n     * A driver that isolates user requests by switching to a restricted role has\n     * to decide at connect time whether the switch is needed — and on a fresh\n     * database that question is asked before there is anything to answer with.\n     * The process then creates the schema, becomes its owner, and an owner is\n     * exempt from the policies on what it owns. So the answer that was true when\n     * the driver initialized can be false by the time it serves a request.\n     *\n     * This is where a driver asks again. It runs once, after collection tables,\n     * auth tables and policies are all in place, and it MUST fail rather than\n     * serve when the answer changed and cannot be acted on: booting anyway\n     * produces exactly the unenforced server this exists to prevent.\n     *\n     * Optional, because it is only meaningful for drivers whose isolation\n     * depends on state the schema affects. A driver with nothing to re-check\n     * omits it.\n     */\n    finalizeSecurityPosture?(driverResult: InitializedDriver): Promise<void>;\n\n    /**\n     * Read the collections schema version this database was last provisioned\n     * from, or `null` when nothing has ever stamped it.\n     *\n     * The companion to {@link stampCollectionsSchemaVersion}: one process writes\n     * what it applied, every other process compares itself to it. This is what\n     * lets a split deployment — several processes over one database, only one of\n     * which provisions — notice that a unit is serving against a schema it was\n     * not built for. That failure is otherwise silent in both directions: a\n     * column that does not exist is a SQL error on one route, and a policy that\n     * was never applied is a 200 with no rows.\n     *\n     * `null` is not an error and MUST NOT be treated as one — every database\n     * provisioned before the stamp existed reads this way, and so does every\n     * fresh one until its first provisioning boot finishes.\n     */\n    readCollectionsSchemaVersion?(\n        driverResult?: InitializedDriver\n    ): Promise<string | null>;\n\n    /**\n     * Record the collections schema version this process just applied.\n     *\n     * Called only by the process that provisions, and only after both\n     * {@link ensureCollectionSchema} and {@link ensureCollectionPolicies} have\n     * run — a stamp written before the policies would claim a schema that is\n     * only half in place, and the half that is missing is the one that fails\n     * without an error.\n     */\n    stampCollectionsSchemaVersion?(\n        version: string,\n        driverResult?: InitializedDriver\n    ): Promise<void>;\n\n    /**\n     * Initialize WebSocket server for realtime operations.\n     */\n    initializeWebsockets?(server: unknown, realtimeService: RealtimeProvider, driver: import(\"../controllers/data_driver\").DataDriver, config?: unknown, authAdapter?: AuthAdapter): Promise<void> | void;\n}\n\n/**\n * Result of `BackendBootstrapper.initializeDriver()`.\n * @group Backend\n */\nexport interface InitializedDriver {\n    /** The DataDriver instance, ready for use. */\n    driver: import(\"../controllers/data_driver\").DataDriver;\n\n    /** The realtime service, if the driver created one during init. */\n    realtimeProvider?: RealtimeProvider;\n\n    /** A collection registry to register schema / tables into. */\n    collectionRegistry?: CollectionRegistryInterface;\n\n    /**\n     * Collections the driver derived from the live database schema.\n     *\n     * Set by drivers that introspect in `baas` mode; the server serves these\n     * instead of collections loaded from config files.\n     */\n    collections?: import(\"./collections\").CollectionConfig[];\n\n    /** The underlying database connection (for lifecycle management). */\n    connection?: DatabaseConnection;\n\n    /**\n     * Opaque handle that the bootstrapper can use in subsequent hooks\n     * (e.g., `initializeAuth`, `mountRoutes`) to access driver internals.\n     * Not used by the coordinator.\n     */\n    internals?: unknown;\n}\n\n/**\n * Result of `BackendBootstrapper.initializeAuth()`.\n * @group Backend\n */\nexport interface BootstrappedAuth {\n    /** User management service. */\n    userService: unknown;\n    /** Role management service (optional, roles are now simple strings). */\n    roleService?: unknown;\n    /** Email service (optional). */\n    emailService?: unknown;\n    /** Combined Auth Repository for unified token and user management. */\n    authRepository?: unknown;\n    /**\n     * Whether the auth schema in the database is one this runtime can serve.\n     *\n     * Folded into `healthCheck()` so a schema mismatch shows up as a degraded\n     * health response. Without it, a server whose auth is entirely broken still\n     * reports healthy — the database connection it probes is fine, and the\n     * mismatch is only discovered one failed login at a time.\n     */\n    schemaHealthCheck?(): Promise<AuthSchemaHealth>;\n}\n\n/**\n * Result of {@link BootstrappedAuth.schemaHealthCheck}.\n * @group Lifecycle\n */\nexport interface AuthSchemaHealth {\n    /** False when this runtime cannot be trusted to serve auth against this database. */\n    healthy: boolean;\n    /** Human-readable descriptions of each mismatch found. Empty when healthy. */\n    problems: string[];\n    /** Auth schema version recorded in the database, when it records one. */\n    databaseVersion?: number | null;\n    /** Auth schema version this runtime expects. */\n    runtimeVersion?: number;\n}\n","import { logger } from \"../utils/logger.js\";\n\n/**\n * Helpers for the \"create my internal table if it isn't there yet\" bootstrap\n * that several stores run at boot.\n *\n * These all look trivially safe — every statement is `IF NOT EXISTS` — and they\n * are not, for two reasons that only show up with more than one app instance:\n *\n *  1. `CREATE … IF NOT EXISTS` reads the catalog and then writes to it, and\n *     those two steps are not one atomic operation. Instances starting together\n *     — a rolling deploy, a replica count going from 1 to N, a crash loop\n *     restarting the fleet — can both see \"absent\" and both try to create. The\n *     loser gets a duplicate key on a *catalog* index instead of the silent\n *     no-op the syntax appears to promise. Measured against Postgres 18: with\n *     five instances booting at once, 8 of 10 `ensureTable` calls hit it.\n *\n *  2. A bootstrap written as one long `try` block therefore abandons everything\n *     after the losing statement — including, in every store that has one, the\n *     `REVOKE` that takes the table back off the end-user role. That revoke is\n *     a security control and must not be collateral damage from a race.\n *\n * So: retry the race, contain each statement separately, and decide what to do\n * next from what actually exists rather than from who won.\n */\n\n/** A driver's `executeSql`, narrowed to what a bootstrap needs. */\nexport type SqlExec = (sqlText: string, options?: { params?: unknown[] }) => Promise<Record<string, unknown>[]>;\n\n\n/**\n * SQLSTATEs a *simultaneous boot* can raise from statements that are otherwise\n * idempotent. Retrying is always the right answer for these: the second attempt\n * finds the object present and does nothing.\n */\nexport const CONCURRENT_DDL_SQLSTATES = new Set([\n    \"23505\", // unique_violation on pg_type / pg_class / pg_namespace\n    \"42P06\", // duplicate_schema\n    \"42P07\", // duplicate_table\n    \"42710\", // duplicate_object — an index or a constraint\n    \"40P01\" // deadlock_detected — two boots taking catalog locks in step\n]);\n\n/** Attempts per idempotent DDL statement, including the first. */\nexport const DDL_ATTEMPTS = 4;\nconst DDL_RETRY_BASE_MS = 40;\n\n/**\n * Walk an error's `cause` chain, stopping at the first link `visit` accepts.\n * Drizzle wraps the driver error, so nothing useful is ever on the top level.\n */\nexport function hasInCauseChain(err: unknown, visit: (e: Record<string, unknown>) => boolean): boolean {\n    let current: unknown = err;\n    for (let depth = 0; depth < 10 && current; depth++) {\n        if (typeof current !== \"object\") break;\n        const e = current as Record<string, unknown>;\n        if (visit(e)) return true;\n        current = e.cause;\n    }\n    return false;\n}\n\n/**\n * Is this the loser of a race to create something that already exists?\n *\n * Deliberately narrow. A permission failure, an unreachable database or a typo\n * in the DDL must surface on the first attempt rather than being retried four\n * times and then reported as a race that never was.\n */\nexport function isConcurrentDdlRace(err: unknown): boolean {\n    return hasInCauseChain(err, (e) =>\n        (typeof e.code === \"string\" && CONCURRENT_DDL_SQLSTATES.has(e.code)) ||\n        // SQLite and MySQL say it in words rather than in a shared SQLSTATE.\n        (typeof e.message === \"string\" && /already exists/i.test(e.message))\n    );\n}\n\n/**\n * SQLSTATEs that mean, unambiguously, *the object is already there*.\n *\n * A subset of {@link CONCURRENT_DDL_SQLSTATES} and a stricter question. The\n * broad set answers \"should this be retried\"; this one answers \"is it safe to\n * carry on as though the statement had succeeded\", which is a claim about the\n * end state rather than about the attempt. Deadlock is not in it — a deadlocked\n * statement did nothing and must be retried, not skipped.\n */\nconst DUPLICATE_OBJECT_SQLSTATES = new Set([\n    \"42P06\", // duplicate_schema\n    \"42P07\", // duplicate_table\n    \"42710\" // duplicate_object — a type, an index, a constraint\n]);\n\n/**\n * Did this statement fail *because a peer already created the same object*?\n *\n * The narrow companion to {@link isConcurrentDdlRace}, for the one caller that\n * needs to tell \"someone beat me to it\" from \"this genuinely failed\": a loop\n * applying a schema plan, where treating every `23505` as a harmless race would\n * silently swallow the one that matters — a unique constraint that cannot be\n * added because the customer's existing rows violate it.\n *\n * `23505` is therefore only accepted when it names a `pg_catalog` index. That is\n * what a lost `CREATE TYPE`/`CREATE TABLE` race raises (`pg_type_typname_nsp_index`\n * is the one seen in practice); a unique violation on user data names the user's\n * own constraint and is left to the caller.\n *\n * With one exception, in {@link NOT_A_RACE_PG_INDEXES}.\n */\nexport function isDuplicateObjectRace(err: unknown): boolean {\n    return hasInCauseChain(err, (e) => {\n        if (typeof e.code !== \"string\") return false;\n        if (DUPLICATE_OBJECT_SQLSTATES.has(e.code)) return true;\n        if (e.code !== \"23505\") return false;\n        // node-postgres puts the violated index in `constraint`; some paths only\n        // carry it in the detail text, so check both rather than miss the race.\n        const constraint = typeof e.constraint === \"string\" ? e.constraint : \"\";\n        const detail = typeof e.detail === \"string\" ? e.detail : \"\";\n        for (const index of NOT_A_RACE_PG_INDEXES) {\n            if (constraint === index || detail.includes(index)) return false;\n        }\n        return constraint.startsWith(\"pg_\") || /\\bpg_[a-z_]+_index\\b/.test(detail);\n    });\n}\n\n/**\n * `pg_catalog` indexes whose `23505` is never a race.\n *\n * `pg_enum_typid_label_index` is unique on (type, label), and one statement\n * violates it on its own: `CREATE TYPE t AS ENUM ('draft', 'draft')` — which is\n * what a collection with two enum entries carrying the same `id` generates.\n * Under the `pg_` prefix rule that read as \"a peer created it first\", so the\n * type was never created, boot carried on, and the column fell back to `TEXT`\n * with no enum behind it. Verified against PGlite: the duplicate `CREATE TYPE`\n * raises exactly this.\n *\n * The concurrent-boot case this rule exists for does not come through here at\n * all. Two pods adding the same label race on `ALTER TYPE … ADD VALUE`, which\n * raises `42710` (already in {@link DUPLICATE_OBJECT_SQLSTATES}) — and the\n * generator writes `ADD VALUE IF NOT EXISTS`, so it usually raises nothing.\n *\n * The duplicate `id` is rejected earlier now, by `validate-config`, which names\n * the property. This is the second line: a config that reaches the database with\n * one fails loudly instead of degrading.\n */\nconst NOT_A_RACE_PG_INDEXES = [\"pg_enum_typid_label_index\"];\n\nexport interface DdlBootstrapper {\n    /**\n     * Run one idempotent statement — `CREATE … IF NOT EXISTS`, `ALTER TABLE …\n     * ADD COLUMN IF NOT EXISTS` — retrying the catalog race a simultaneous boot\n     * produces. Never throws: a statement that cannot be made to work is logged\n     * and the caller carries on to the next one.\n     */\n    ensureObject(label: string, sqlText: string): Promise<void>;\n\n    /** Contain one step's failure so that the steps after it still run. */\n    step(label: string, run: () => Promise<unknown>): Promise<void>;\n\n    /**\n     * Is this table there and readable? Asked with a query any SQL dialect\n     * answers, rather than `to_regclass`, so a future non-Postgres SQL driver\n     * gets a real answer instead of a syntax error read as \"missing\".\n     */\n    isReadable(table: string): Promise<boolean>;\n}\n\n/**\n * @param exec   the driver's SQL escape hatch\n * @param scope  log prefix identifying the caller, e.g. `\"cron-store\"`\n */\nexport function createDdlBootstrapper(exec: SqlExec, scope: string): DdlBootstrapper {\n    /** Jittered, so peers that collided once do not collide again in lockstep. */\n    const backoff = (attempt: number) =>\n        new Promise(resolve => setTimeout(resolve, DDL_RETRY_BASE_MS * attempt * (1 + Math.random())));\n\n    const step: DdlBootstrapper[\"step\"] = async (label, run) => {\n        try {\n            await run();\n        } catch (err) {\n            logger.error(`[${scope}] ${label} failed`, { error: err });\n        }\n    };\n\n    return {\n        step,\n\n        ensureObject(label, sqlText) {\n            return step(label, async () => {\n                for (let attempt = 1; ; attempt++) {\n                    try {\n                        await exec(sqlText);\n                        return;\n                    } catch (err) {\n                        if (!isConcurrentDdlRace(err) || attempt >= DDL_ATTEMPTS) throw err;\n                        logger.debug(\n                            `[${scope}] Lost a create race for ${label} with another instance ` +\n                            `(attempt ${attempt}/${DDL_ATTEMPTS}) — retrying`\n                        );\n                        await backoff(attempt);\n                    }\n                }\n            });\n        },\n\n        async isReadable(table) {\n            try {\n                await exec(`SELECT 1 FROM ${table} WHERE false`);\n                return true;\n            } catch {\n                return false;\n            }\n        }\n    };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AA8kBA,SAAgB,qBAAqB,OAA+D;CAChG,OAAO,CAAC,CAAC,SAAS,OAAQ,MAA6B,qBAAqB;AAChF;;;;;AAMA,SAAgB,WAAW,OAAqD;CAC5E,OAAO,CAAC,CAAC,SAAS,OAAQ,MAAmB,eAAe;AAChE;;;;;;;;ACrjBA,IAAa,2CAA2B,IAAI,IAAI;CAC5C;CACA;CACA;CACA;CACA;AACJ,CAAC;AAID,IAAM,oBAAoB;;;;;AAM1B,SAAgB,gBAAgB,KAAc,OAAyD;CACnG,IAAI,UAAmB;CACvB,KAAK,IAAI,QAAQ,GAAG,QAAQ,MAAM,SAAS,SAAS;EAChD,IAAI,OAAO,YAAY,UAAU;EACjC,MAAM,IAAI;EACV,IAAI,MAAM,CAAC,GAAG,OAAO;EACrB,UAAU,EAAE;CAChB;CACA,OAAO;AACX;;;;;;;;AASA,SAAgB,oBAAoB,KAAuB;CACvD,OAAO,gBAAgB,MAAM,MACxB,OAAO,EAAE,SAAS,YAAY,yBAAyB,IAAI,EAAE,IAAI,KAEjE,OAAO,EAAE,YAAY,YAAY,kBAAkB,KAAK,EAAE,OAAO,CACtE;AACJ;;;;;;;;;;AAWA,IAAM,6CAA6B,IAAI,IAAI;CACvC;CACA;CACA;AACJ,CAAC;;;;;;;;;;;;;;;;;AAkBD,SAAgB,sBAAsB,KAAuB;CACzD,OAAO,gBAAgB,MAAM,MAAM;EAC/B,IAAI,OAAO,EAAE,SAAS,UAAU,OAAO;EACvC,IAAI,2BAA2B,IAAI,EAAE,IAAI,GAAG,OAAO;EACnD,IAAI,EAAE,SAAS,SAAS,OAAO;EAG/B,MAAM,aAAa,OAAO,EAAE,eAAe,WAAW,EAAE,aAAa;EACrE,MAAM,SAAS,OAAO,EAAE,WAAW,WAAW,EAAE,SAAS;EACzD,KAAK,MAAM,SAAS,uBAChB,IAAI,eAAe,SAAS,OAAO,SAAS,KAAK,GAAG,OAAO;EAE/D,OAAO,WAAW,WAAW,KAAK,KAAK,uBAAuB,KAAK,MAAM;CAC7E,CAAC;AACL;;;;;;;;;;;;;;;;;;;;;AAsBA,IAAM,wBAAwB,CAAC,2BAA2B;;;;;AA0B1D,SAAgB,sBAAsB,MAAe,OAAgC;;CAEjF,MAAM,WAAW,YACb,IAAI,SAAQ,YAAW,WAAW,SAAS,oBAAoB,WAAW,IAAI,KAAK,OAAO,EAAE,CAAC;CAEjG,MAAM,OAAgC,OAAO,OAAO,QAAQ;EACxD,IAAI;GACA,MAAM,IAAI;EACd,SAAS,KAAK;GACV,OAAO,MAAM,IAAI,MAAM,IAAI,MAAM,UAAU,EAAE,OAAO,IAAI,CAAC;EAC7D;CACJ;CAEA,OAAO;EACH;EAEA,aAAa,OAAO,SAAS;GACzB,OAAO,KAAK,OAAO,YAAY;IAC3B,KAAK,IAAI,UAAU,IAAK,WACpB,IAAI;KACA,MAAM,KAAK,OAAO;KAClB;IACJ,SAAS,KAAK;KACV,IAAI,CAAC,oBAAoB,GAAG,KAAK,WAAA,GAAyB,MAAM;KAChE,OAAO,MACH,IAAI,MAAM,2BAA2B,MAAM,kCAC/B,QAAQ,eACxB;KACA,MAAM,QAAQ,OAAO;IACzB;GAER,CAAC;EACL;EAEA,MAAM,WAAW,OAAO;GACpB,IAAI;IACA,MAAM,KAAK,iBAAiB,MAAM,aAAa;IAC/C,OAAO;GACX,QAAQ;IACJ,OAAO;GACX;EACJ;CACJ;AACJ"}

package/dist/history-recorder-CYfkqP2X.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"history-recorder-CYfkqP2X.js","names":[],"sources":["../src/metrics/history-recorder.ts"],"sourcesContent":["/**\n * Wiring the history store to a driver and a timer.\n *\n * Split from `history-store.ts` so the store stays pure — every rule in it is\n * testable with a fake executor, and nothing there knows what a DataDriver is.\n * This half is the part that cannot be unit-tested meaningfully: it opens a\n * connection and starts an interval.\n */\nimport { monitorEventLoopDelay } from \"node:perf_hooks\";\nimport { logger } from \"../utils/logger.js\";\nimport type { DataDriver } from \"@rebasepro/types\";\nimport {\n    ensureMetricsHistory,\n    recordSamples,\n    readSeries,\n    sampleSelf,\n    SAMPLE_INTERVAL_MS,\n    type Exec,\n    type MetricSeries,\n    type SeriesPoint\n} from \"./history-store.js\";\n\nexport interface MetricsHistory {\n    /** Create the table and sweep what has aged out. */\n    ensure(): Promise<void>;\n    /** Begin sampling this process. Returns a stop. */\n    start(): () => void;\n    /** Read one series, for the route and for anything else that asks. */\n    read(series: MetricSeries, sinceMinutes: number): Promise<SeriesPoint[]>;\n}\n\n/** Narrow structural check, matching how the job store decides the same thing. */\nfunction sqlExecutorOf(driver: DataDriver): Exec | undefined {\n    const admin = (driver as { admin?: { executeSql?: unknown } }).admin;\n    if (!admin || typeof admin.executeSql !== \"function\") return undefined;\n    const executeSql = admin.executeSql as (sql: string, opts?: { params?: unknown[] }) => Promise<unknown>;\n    return (sql, params) => executeSql(sql, params ? { params } : undefined);\n}\n\n/**\n * History for this deployment, or `undefined` when it cannot have any.\n *\n * Undefined rather than a no-op: the route turns it into a named 501, because a\n * chart that renders empty is indistinguishable from a quiet period and this is\n * exactly the class of silence the panel it feeds exists to remove.\n */\nexport function createMetricsHistory(driver: DataDriver): MetricsHistory | undefined {\n    const exec = sqlExecutorOf(driver);\n    if (!exec) {\n        logger.debug(\"[metrics] driver has no SQL admin — no metrics history will be kept.\");\n        return undefined;\n    }\n\n    return {\n        ensure: () => ensureMetricsHistory(exec),\n        read: (series, sinceMinutes) => readSeries(exec, series, sinceMinutes),\n        start(): () => void {\n            // Which process this is. A tenant's replicas share one database and\n            // each records its own numbers, so a row needs to say whose they\n            // are — without it they overwrite each other and a scaled-out app\n            // charts one arbitrary pod.\n            //\n            // HOSTNAME is the pod name on Kubernetes and the container id under\n            // Docker; the pid fallback keeps two local processes distinct.\n            const instance = process.env.HOSTNAME?.trim() || `pid-${process.pid}`;\n            let cursor: { cpu: NodeJS.CpuUsage; at: number } | null = null;\n            let stopped = false;\n\n            // Event-loop delay: how long a callback waited past its schedule.\n            // The one number here that says whether this process is *healthy*\n            // rather than how much it is consuming — a pod can sit at 20% CPU\n            // and still be unable to answer, and nothing else recorded would\n            // show it.\n            //\n            // `monitorEventLoopDelay` samples in libuv at a fixed resolution and\n            // costs effectively nothing; `.enable()` is required, and the\n            // histogram is reset each tick so every sample describes its own\n            // minute rather than the process's whole life.\n            interface LoopHistogram { mean: number; enable(): void; reset(): void }\n            let loop: LoopHistogram | null = null;\n            try {\n                loop = monitorEventLoopDelay({ resolution: 20 }) as LoopHistogram;\n                loop.enable();\n            } catch {\n                // A runtime without it still records the other two.\n                loop = null;\n            }\n\n            const tick = async () => {\n                if (stopped) return;\n                // Nanoseconds from the histogram, milliseconds on the wire.\n                const delayMs = loop ? loop.mean / 1e6 : undefined;\n                loop?.reset();\n                const { samples, cursor: next } = sampleSelf(cursor, Date.now(), delayMs);\n                cursor = next;\n                try {\n                    await recordSamples(exec, samples, instance);\n                } catch (err) {\n                    // Never fatal, and never noisy: a sampler that crash-loops a\n                    // pod over a chart would be a far worse trade than a gap in\n                    // one. The gap is visible in the data; a restart loop is not.\n                    logger.debug(\"[metrics] could not record a sample\", { err });\n                }\n            };\n\n            // The first tick establishes the CPU cursor and publishes memory;\n            // the rate needs a second reading, which is why nothing claims a CPU\n            // figure until one interval has passed.\n            void tick();\n            const timer = setInterval(() => void tick(), SAMPLE_INTERVAL_MS);\n            // Not the reason this process should stay alive.\n            timer.unref?.();\n\n            return () => { stopped = true; clearInterval(timer); };\n        }\n    };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAgCA,SAAS,cAAc,QAAsC;CACzD,MAAM,QAAS,OAAgD;CAC/D,IAAI,CAAC,SAAS,OAAO,MAAM,eAAe,YAAY,OAAO,KAAA;CAC7D,MAAM,aAAa,MAAM;CACzB,QAAQ,KAAK,WAAW,WAAW,KAAK,SAAS,EAAE,OAAO,IAAI,KAAA,CAAS;AAC3E;;;;;;;;AASA,SAAgB,qBAAqB,QAAgD;CACjF,MAAM,OAAO,cAAc,MAAM;CACjC,IAAI,CAAC,MAAM;EACP,OAAO,MAAM,sEAAsE;EACnF;CACJ;CAEA,OAAO;EACH,cAAc,qBAAqB,IAAI;EACvC,OAAO,QAAQ,iBAAiB,WAAW,MAAM,QAAQ,YAAY;EACrE,QAAoB;GAQhB,MAAM,WAAW,QAAQ,IAAI,UAAU,KAAK,KAAK,OAAO,QAAQ;GAChE,IAAI,SAAsD;GAC1D,IAAI,UAAU;GAad,IAAI,OAA6B;GACjC,IAAI;IACA,OAAO,sBAAsB,EAAE,YAAY,GAAG,CAAC;IAC/C,KAAK,OAAO;GAChB,QAAQ;IAEJ,OAAO;GACX;GAEA,MAAM,OAAO,YAAY;IACrB,IAAI,SAAS;IAEb,MAAM,UAAU,OAAO,KAAK,OAAO,MAAM,KAAA;IACzC,MAAM,MAAM;IACZ,MAAM,EAAE,SAAS,QAAQ,SAAS,WAAW,QAAQ,KAAK,IAAI,GAAG,OAAO;IACxE,SAAS;IACT,IAAI;KACA,MAAM,cAAc,MAAM,SAAS,QAAQ;IAC/C,SAAS,KAAK;KAIV,OAAO,MAAM,uCAAuC,EAAE,IAAI,CAAC;IAC/D;GACJ;GAKA,KAAU;GACV,MAAM,QAAQ,kBAAkB,KAAK,KAAK,GAAG,kBAAkB;GAE/D,MAAM,QAAQ;GAEd,aAAa;IAAE,UAAU;IAAM,cAAc,KAAK;GAAG;EACzD;CACJ;AACJ"}

package/dist/jobs-2fO2BI8P.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"jobs-2fO2BI8P.js","names":[],"sources":["../src/db/ambient-transaction.ts","../src/jobs/job-store.ts","../src/jobs/job-queue.ts","../src/jobs/index.ts"],"sourcesContent":["/**\n * The write transaction the current code is running inside, when there is one.\n *\n * A collection callback runs inside the transaction that carries its write.\n * Work it hands off — a job, a queue message, a topic event, a webhook\n * delivery — has to share that write's fate: queued when it commits, never\n * queued when it rolls back, and invisible to a worker until the commit. The\n * code that queues it lives in this package and knows no driver; the\n * transaction belongs to the driver. So the driver publishes the transaction it\n * opened for a write, and the queueing code asks for it here.\n *\n * Until this existed the job store wrote through the default driver's own\n * connection, in autocommit, whatever called it. A job enqueued from an\n * `afterSave` that then threw stayed queued for a row that was never written,\n * and a worker could claim it before the row it was about committed.\n *\n * The resolver lives on `globalThis` under a registered symbol, like the\n * `rebase` singleton: a managed runtime can load two copies of this package,\n * and the copy a driver registers with must be the one the job store reads.\n * No Node imports — the store is reachable from code that has to stay portable.\n *\n * **The symbol's key is a contract between packages, and frozen.** The\n * Postgres driver writes the slot itself rather than importing a setter from\n * here: the managed runtime supplies this package from the image while a\n * bundle brings its own driver, and a driver importing a function an older\n * image does not export would fail to link and take the boot down. Written\n * through the slot, any pairing of versions degrades to the old behaviour —\n * jobs committing on their own — instead.\n */\nexport interface AmbientTransaction {\n    /**\n     * Run one statement on the transaction, `$1…` placeholders as\n     * `executeSql` takes them. It runs as the transaction's current role — on\n     * Postgres the request's restricted one — so a statement that needs more\n     * goes through a function granted to that role.\n     */\n    exec(sqlText: string, params?: unknown[]): Promise<Record<string, unknown>[]>;\n    /** Run `fn` after the transaction commits. Never runs if it rolls back. */\n    afterCommit(fn: () => void): void;\n}\n\n/** Frozen — see above. `server-postgres/src/services/write-transaction-scope.ts` writes it. */\nconst RESOLVER_SLOT = Symbol.for(\"rebase.server.ambientTransactionResolver\");\n\ntype ResolverSlot = { [RESOLVER_SLOT]?: () => AmbientTransaction | undefined };\n\n/**\n * Register how to find the write transaction the caller is inside; pass\n * `undefined` to unregister. For tests and for drivers in this repository's\n * lockstep — a driver shipped separately writes the slot, as above.\n */\nexport function setAmbientTransactionResolver(resolve: (() => AmbientTransaction | undefined) | undefined): void {\n    (globalThis as ResolverSlot)[RESOLVER_SLOT] = resolve;\n}\n\n/** The write transaction the caller is inside, or `undefined` outside one. */\nexport function currentAmbientTransaction(): AmbientTransaction | undefined {\n    return (globalThis as ResolverSlot)[RESOLVER_SLOT]?.();\n}\n","import type { DataDriver } from \"@rebasepro/types\";\nimport { isSQLAdmin } from \"@rebasepro/types\";\nimport { REBASE_USER_ROLE, revokeInternalTableSql, sqlRows, firstSqlRow } from \"@rebasepro/common\";\nimport { logger } from \"../utils/logger.js\";\nimport { createDdlBootstrapper, hasInCauseChain, type SqlExec } from \"../boot/ddl-bootstrap.js\";\nimport { currentAmbientTransaction } from \"../db/ambient-transaction.js\";\nimport type { JobRecord } from \"./types.js\";\n\n/**\n * The queue's storage, as SQL against `rebase.jobs`.\n *\n * Split from the worker for the same reason `cron-store` is split from\n * `cron-scheduler`: the interesting parts here are three statements that have\n * to be exactly right under concurrency, and they are much easier to reason\n * about — and to test — away from a polling loop.\n */\n\nconst TABLE = \"rebase.jobs\";\n\n/** How long finished jobs are kept before the boot sweep removes them. */\nconst SUCCEEDED_RETENTION_DAYS = 3;\n/**\n * Failures outlive successes by a lot. A dead-lettered job is evidence, and the\n * person who needs it is usually looking on Monday for something that happened\n * on Friday night.\n */\nconst FAILED_RETENTION_DAYS = 30;\n\n/** A row as Postgres returns it. */\ninterface JobRow {\n    id: string;\n    task: string;\n    payload: unknown;\n    status: string;\n    run_at: string;\n    attempts: number;\n    max_attempts: number;\n    last_error: string | null;\n    created_at: string;\n    updated_at: string;\n}\n\nfunction toRecord(row: JobRow): JobRecord {\n    return {\n        id: row.id,\n        task: row.task,\n        payload: row.payload,\n        status: row.status as JobRecord[\"status\"],\n        runAt: new Date(row.run_at).toISOString(),\n        attempts: Number(row.attempts),\n        maxAttempts: Number(row.max_attempts),\n        lastError: row.last_error,\n        createdAt: new Date(row.created_at).toISOString(),\n        updatedAt: new Date(row.updated_at).toISOString()\n    };\n}\n\n/** Same rule as `cron-store`: match the SQLSTATE, never the message. */\nfunction isUniqueViolation(err: unknown): boolean {\n    return hasInCauseChain(err, (e) => e.code === \"23505\");\n}\n\n/**\n * How a job gets into `rebase.jobs` from inside somebody else's transaction.\n *\n * An enqueue from a collection callback has to ride the write's transaction —\n * committed with it, discarded with it, invisible to workers until then — and\n * that transaction runs as the request's restricted role, which has no access\n * to `rebase.jobs` at all (see the revoke in `ensureTable`). This function is\n * the one door: `SECURITY DEFINER`, so the insert runs with the owner's rights\n * for that one statement and the transaction's role never changes. Switching\n * the role for the insert instead would elevate the whole connection for as\n * long as the insert took, and a callback's un-awaited statement would run\n * in that window as the owner.\n *\n * The door is narrow on purpose. It takes the five columns an enqueue sets and\n * nothing else, so it cannot claim, complete or rewrite a job — and only the\n * request role is granted it, not PUBLIC. That role runs statements the server\n * writes; nobody outside gets SQL as it.\n *\n * `ON CONFLICT DO NOTHING` rather than a caught unique violation: an error\n * inside a transaction aborts the whole transaction, so an idempotency clash\n * would have failed the customer's write. A clash returns no row, hence NULL.\n */\nconst ENQUEUE_FUNCTION = \"rebase.enqueue_job\";\nconst ENQUEUE_SIGNATURE = `${ENQUEUE_FUNCTION}(text, jsonb, timestamptz, integer, text)`;\n\nexport interface JobStore {\n    ensureTable(): Promise<void>;\n    /** Returns the new job's id, or `null` if an idempotency key matched unfinished work. */\n    insert(job: {\n        task: string;\n        payload: unknown;\n        runAt: Date;\n        maxAttempts: number;\n        idempotencyKey?: string;\n    }): Promise<string | null>;\n    /** Atomically take up to `limit` runnable jobs for this worker. */\n    claim(limit: number, workerId: string): Promise<JobRecord[]>;\n    complete(id: string): Promise<void>;\n    /** Back to `pending` with a later `runAt`, or `failed` when out of attempts. */\n    fail(id: string, error: string, retryAt: Date | null): Promise<void>;\n    /** Return jobs stranded by a worker that died holding them. Resolves with how many. */\n    reapExpired(visibilityTimeoutMs: number): Promise<number>;\n    fetch(id: string): Promise<JobRecord | null>;\n}\n\nexport function createJobStore(driver: DataDriver): JobStore | undefined {\n    const admin = driver.admin;\n    if (!isSQLAdmin(admin)) {\n        logger.warn(\n            \"⚠️ [jobs] DataDriver does not support SQL admin — the durable job queue is unavailable. \" +\n            \"Work that would have been queued runs inline instead.\"\n        );\n        return undefined;\n    }\n\n    // Two shapes of the same call: the bootstrapper's `SqlExec` takes an\n    // options object, while everything below reads better with a positional\n    // parameter array.\n    const execRaw: SqlExec = (sqlText, options) =>\n        admin.executeSql(sqlText, options?.params ? { params: options.params } : undefined);\n    const exec = (sqlText: string, params?: unknown[]) =>\n        execRaw(sqlText, params ? { params } : undefined);\n\n    const ddl = createDdlBootstrapper(execRaw, \"jobs\");\n\n    /**\n     * Whether {@link ENQUEUE_FUNCTION} exists, so an enqueue inside a write can\n     * ride its transaction. Decided at boot rather than assumed: a database\n     * that refused the function would otherwise fail every write whose callback\n     * enqueues, where falling back to the old behaviour only loses atomicity.\n     */\n    let enqueueInTransaction = false;\n\n    return {\n        async ensureTable(): Promise<void> {\n            await ddl.ensureObject(\"Creating schema rebase\", \"CREATE SCHEMA IF NOT EXISTS rebase\");\n\n            await ddl.ensureObject(`Creating ${TABLE}`, `\n                CREATE TABLE IF NOT EXISTS ${TABLE} (\n                    id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,\n                    task TEXT NOT NULL,\n                    payload JSONB,\n                    status TEXT NOT NULL DEFAULT 'pending',\n                    run_at TIMESTAMPTZ NOT NULL DEFAULT now(),\n                    attempts INTEGER NOT NULL DEFAULT 0,\n                    max_attempts INTEGER NOT NULL DEFAULT 3,\n                    locked_at TIMESTAMPTZ,\n                    locked_by TEXT,\n                    idempotency_key TEXT,\n                    last_error TEXT,\n                    created_at TIMESTAMPTZ NOT NULL DEFAULT now(),\n                    updated_at TIMESTAMPTZ NOT NULL DEFAULT now()\n                )\n            `);\n\n            // The claim query's index. Partial, because the rows it has to find\n            // fast are a shrinking minority of a table that also holds every\n            // success and every dead letter.\n            await ddl.ensureObject(\"Creating idx_jobs_runnable\", `\n                CREATE INDEX IF NOT EXISTS idx_jobs_runnable\n                ON ${TABLE}(run_at, created_at)\n                WHERE status = 'pending'\n            `);\n\n            // Finds jobs stranded by a dead worker.\n            await ddl.ensureObject(\"Creating idx_jobs_running\", `\n                CREATE INDEX IF NOT EXISTS idx_jobs_running\n                ON ${TABLE}(locked_at)\n                WHERE status = 'running'\n            `);\n\n            // What makes `idempotencyKey` a guarantee rather than a\n            // check-then-act race: two instances reacting to one event both\n            // reach the INSERT, and the index decides. Partial on unfinished\n            // work — see `EnqueueOptions.idempotencyKey` for why a key must be\n            // reusable once its job is done.\n            await ddl.ensureObject(\"Creating idx_jobs_idempotency\", `\n                CREATE UNIQUE INDEX IF NOT EXISTS idx_jobs_idempotency\n                ON ${TABLE}(idempotency_key)\n                WHERE idempotency_key IS NOT NULL AND status IN ('pending', 'running')\n            `);\n\n            const ready = await ddl.isReadable(TABLE);\n\n            if (ready) {\n                await ddl.step(\"Job retention sweep\", async () => {\n                    await exec(\n                        `DELETE FROM ${TABLE}\n                         WHERE (status = 'succeeded' AND updated_at < now() - make_interval(days => $1))\n                            OR (status = 'failed'    AND updated_at < now() - make_interval(days => $2))`,\n                        [SUCCEEDED_RETENTION_DAYS, FAILED_RETENTION_DAYS]\n                    );\n                });\n\n                // Payloads are arbitrary application data — a webhook body, a\n                // user id, whatever was passed — and a writable queue lets any\n                // signed-in user schedule work of their choosing under the\n                // server's own authority. Same reasoning, and the same\n                // unconditional re-application, as `cron_claims`.\n                await ddl.step(\"Revoking end-user access to jobs\", () =>\n                    exec(revokeInternalTableSql(\"rebase\", \"jobs\")));\n\n                await ddl.ensureObject(`Creating ${ENQUEUE_FUNCTION}`, `\n                    CREATE OR REPLACE FUNCTION ${ENQUEUE_FUNCTION}(\n                        p_task text, p_payload jsonb, p_run_at timestamptz,\n                        p_max_attempts integer, p_idempotency_key text\n                    ) RETURNS text\n                    LANGUAGE sql\n                    SECURITY DEFINER\n                    SET search_path = pg_catalog, pg_temp\n                    AS $fn$\n                        INSERT INTO ${TABLE} (task, payload, run_at, max_attempts, idempotency_key)\n                        VALUES (p_task, p_payload, p_run_at, p_max_attempts, p_idempotency_key)\n                        ON CONFLICT DO NOTHING\n                        RETURNING id\n                    $fn$\n                `);\n                // Re-applied every boot: a new function is executable by PUBLIC\n                // until told otherwise, and the request role may be provisioned\n                // after the function was first made.\n                await ddl.step(`Granting ${ENQUEUE_FUNCTION} to the request role`, async () => {\n                    await exec(`REVOKE ALL ON FUNCTION ${ENQUEUE_SIGNATURE} FROM PUBLIC`);\n                    await exec(`\n                        DO $grant$ BEGIN\n                            IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = '${REBASE_USER_ROLE}') THEN\n                                GRANT EXECUTE ON FUNCTION ${ENQUEUE_SIGNATURE} TO ${REBASE_USER_ROLE};\n                            END IF;\n                        END $grant$\n                    `);\n                });\n                enqueueInTransaction = firstSqlRow<{ present: boolean }>(await exec(\n                    `SELECT to_regprocedure('${ENQUEUE_SIGNATURE}') IS NOT NULL AS present`\n                ))?.present === true;\n                if (!enqueueInTransaction) {\n                    logger.warn(\n                        `⚠️ [jobs] ${ENQUEUE_FUNCTION} could not be created, so a job enqueued inside a write ` +\n                        \"commits on its own: it stays queued if the write rolls back.\"\n                    );\n                }\n\n                logger.info(\"✅ Job queue table ready\");\n            } else {\n                logger.error(\n                    `❌ [jobs] ${TABLE} is unavailable — nothing can be queued and nothing queued earlier ` +\n                    \"will run. Callers fall back to running the work inline.\"\n                );\n            }\n        },\n\n        async insert(job): Promise<string | null> {\n            const params = [\n                job.task,\n                JSON.stringify(job.payload ?? null),\n                job.runAt.toISOString(),\n                job.maxAttempts,\n                job.idempotencyKey ?? null\n            ];\n            // Inside a write: on its transaction, through the definer function\n            // — see `ENQUEUE_FUNCTION`. Checked and used with no `await`\n            // between, so the transaction cannot close in the gap.\n            const ambient = enqueueInTransaction ? currentAmbientTransaction() : undefined;\n            if (ambient) {\n                const rows = await ambient.exec(\n                    `SELECT ${ENQUEUE_FUNCTION}($1::text, $2::jsonb, $3::timestamptz, $4::integer, $5::text) AS id`,\n                    params\n                );\n                return (rows?.[0]?.id as string | null | undefined) ?? null;\n            }\n            try {\n                const rows = await exec(\n                    `INSERT INTO ${TABLE} (task, payload, run_at, max_attempts, idempotency_key)\n                     VALUES ($1, $2::jsonb, $3, $4, $5)\n                     RETURNING id`,\n                    params\n                );\n                return (rows?.[0]?.id as string) ?? null;\n            } catch (error) {\n                // The losing side of an idempotency race. Not an error: the\n                // work the caller wanted is already queued, which is the\n                // outcome they asked for.\n                if (isUniqueViolation(error)) return null;\n                throw error;\n            }\n        },\n\n        async claim(limit: number, workerId: string): Promise<JobRecord[]> {\n            // `FOR UPDATE SKIP LOCKED` is the whole design. The inner select\n            // takes row locks on the jobs it picks and *skips* any a concurrent\n            // worker already holds, so N workers polling the same table divide\n            // the work instead of contending for the head of it — and no job is\n            // ever handed to two of them.\n            //\n            // `attempts` is incremented here, on claim, rather than on failure.\n            // A worker that is killed mid-job never reports anything, so\n            // counting on failure would let a job that crashes the process be\n            // retried forever, once per restart, taking the process down each\n            // time.\n            const rows = await exec(\n                `UPDATE ${TABLE} SET\n                    status = 'running',\n                    attempts = attempts + 1,\n                    locked_at = now(),\n                    locked_by = $2,\n                    updated_at = now()\n                 WHERE id IN (\n                     SELECT id FROM ${TABLE}\n                     WHERE status = 'pending' AND run_at <= now()\n                     ORDER BY run_at, created_at\n                     LIMIT $1\n                     FOR UPDATE SKIP LOCKED\n                 )\n                 RETURNING *`,\n                [limit, workerId]\n            );\n            return sqlRows<JobRow>(rows).map(toRecord);\n        },\n\n        async complete(id: string): Promise<void> {\n            await exec(\n                `UPDATE ${TABLE} SET status = 'succeeded', locked_at = NULL, locked_by = NULL,\n                        last_error = NULL, updated_at = now()\n                 WHERE id = $1`,\n                [id]\n            );\n        },\n\n        async fail(id: string, error: string, retryAt: Date | null): Promise<void> {\n            if (retryAt) {\n                await exec(\n                    `UPDATE ${TABLE} SET status = 'pending', run_at = $2, locked_at = NULL,\n                            locked_by = NULL, last_error = $3, updated_at = now()\n                     WHERE id = $1`,\n                    [id, retryAt.toISOString(), error]\n                );\n                return;\n            }\n            await exec(\n                `UPDATE ${TABLE} SET status = 'failed', locked_at = NULL, locked_by = NULL,\n                        last_error = $2, updated_at = now()\n                 WHERE id = $1`,\n                [id, error]\n            );\n        },\n\n        async reapExpired(visibilityTimeoutMs: number): Promise<number> {\n            // A worker killed while holding a job cannot release it, so nothing\n            // but a timeout will ever free the row. Jobs that still have\n            // attempts left go back to `pending`; the rest are dead-lettered\n            // with an error that says what happened, because \"attempts: 3,\n            // lastError: null\" is otherwise a genuinely baffling row to find.\n            const seconds = Math.max(1, Math.round(visibilityTimeoutMs / 1000));\n\n            const revived = await exec(\n                `UPDATE ${TABLE} SET status = 'pending', locked_at = NULL, locked_by = NULL,\n                        last_error = 'Worker stopped responding; the job was reclaimed', updated_at = now()\n                 WHERE status = 'running'\n                   AND locked_at < now() - make_interval(secs => $1)\n                   AND attempts < max_attempts\n                 RETURNING id`,\n                [seconds]\n            );\n\n            const buried = await exec(\n                `UPDATE ${TABLE} SET status = 'failed', locked_at = NULL, locked_by = NULL,\n                        last_error = 'Worker stopped responding on the final attempt', updated_at = now()\n                 WHERE status = 'running'\n                   AND locked_at < now() - make_interval(secs => $1)\n                   AND attempts >= max_attempts\n                 RETURNING id`,\n                [seconds]\n            );\n\n            const count = (revived?.length ?? 0) + (buried?.length ?? 0);\n            if (count > 0) {\n                logger.warn(\n                    `[jobs] Reclaimed ${count} job(s) from a worker that stopped responding ` +\n                    `(${revived?.length ?? 0} retryable, ${buried?.length ?? 0} dead-lettered)`\n                );\n            }\n            return count;\n        },\n\n        async fetch(id: string): Promise<JobRecord | null> {\n            const rows = await exec(`SELECT * FROM ${TABLE} WHERE id = $1`, [id]);\n            const row = firstSqlRow<JobRow>(rows);\n            return row ? toRecord(row) : null;\n        }\n    };\n}\n","import { randomUUID } from \"crypto\";\nimport { logger } from \"../utils/logger.js\";\nimport type { JobStore } from \"./job-store.js\";\nimport type { EnqueueOptions, JobHandler, JobQueueClient, JobQueueOptions, JobRecord } from \"./types.js\";\n\n/**\n * The worker: claim, run, record, repeat.\n *\n * Everything difficult about running jobs concurrently is in `job-store.ts`,\n * where one `UPDATE … FOR UPDATE SKIP LOCKED` does the arbitration. What is\n * left here is a loop and the decisions around a handler that throws.\n */\n\nconst DEFAULT_CONCURRENCY = 5;\nconst DEFAULT_POLL_INTERVAL_MS = 2_000;\nconst DEFAULT_VISIBILITY_TIMEOUT_MS = 5 * 60_000;\nconst DEFAULT_MAX_ATTEMPTS = 3;\n\n/** 1s, 5s, 25s, 125s … capped at an hour. */\nexport function defaultBackoff(attempt: number): number {\n    return Math.min(1_000 * Math.pow(5, Math.max(0, attempt - 1)), 60 * 60_000);\n}\n\n/**\n * How often the reaper runs, relative to the visibility timeout.\n *\n * A quarter of it, so a stranded job waits at most 1.25× the timeout rather\n * than 2× — and so the sweep is not itself a per-poll query against a table\n * whose interesting rows are, almost always, none.\n */\nconst REAP_INTERVAL_FACTOR = 0.25;\n\nexport interface JobQueue extends JobQueueClient {\n    start(): void;\n    stop(): Promise<void>;\n    /** Run one poll's worth of work and return how many jobs ran. For tests and for `/jobs/drain`. */\n    runOnce(): Promise<number>;\n    /** Registered after construction — how `tasks` from config and internal producers meet. */\n    register<P = unknown>(task: string, handler: JobHandler<P>): void;\n    isRunning(): boolean;\n}\n\nexport function createJobQueue(store: JobStore, options: JobQueueOptions = {}): JobQueue {\n    const concurrency = options.concurrency ?? DEFAULT_CONCURRENCY;\n    const pollIntervalMs = options.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;\n    const visibilityTimeoutMs = options.visibilityTimeoutMs ?? DEFAULT_VISIBILITY_TIMEOUT_MS;\n    const defaultMaxAttempts = options.maxAttempts ?? DEFAULT_MAX_ATTEMPTS;\n    const backoff = options.backoff ?? defaultBackoff;\n\n    const handlers = new Map<string, JobHandler<never>>();\n    for (const [task, handler] of Object.entries(options.tasks ?? {})) {\n        handlers.set(task, handler);\n    }\n\n    // Identifies this process in `locked_by`. Purely diagnostic — the claim is\n    // enforced by the row lock, not by this — but \"which pod had it when it\n    // stopped\" is the first question anyone asks of a stuck job.\n    const workerId = `${process.pid}-${randomUUID().slice(0, 8)}`;\n\n    let timer: NodeJS.Timeout | null = null;\n    let running = false;\n    let draining = false;\n    /** Resolves when the in-flight poll finishes, so `stop()` can wait for it. */\n    let inFlight: Promise<unknown> = Promise.resolve();\n    let lastReapAt = 0;\n\n    async function runJob(job: JobRecord): Promise<void> {\n        const handler = handlers.get(job.task);\n\n        if (!handler) {\n            // Not a failure. A rolling deploy runs old and new code at once, and\n            // an instance that has not been updated yet must not burn the\n            // attempts of a job belonging to one that has. Give the row back\n            // and let a peer — or this process after its next deploy — take it.\n            //\n            // The attempt increment from the claim is deliberately not undone:\n            // a task nobody in the fleet implements would otherwise cycle\n            // forever, and this way it dead-letters after `maxAttempts` with an\n            // error naming the task.\n            logger.warn(`[jobs] No handler registered for task \"${job.task}\" — returning the job to the queue`);\n            await store.fail(\n                job.id,\n                `No handler registered for task \"${job.task}\"`,\n                job.attempts < job.maxAttempts ? new Date(Date.now() + backoff(job.attempts)) : null\n            );\n            return;\n        }\n\n        try {\n            await handler({\n                id: job.id,\n                task: job.task,\n                payload: job.payload as never,\n                attempt: job.attempts,\n                maxAttempts: job.maxAttempts\n            } as never);\n            await store.complete(job.id);\n        } catch (error) {\n            const message = error instanceof Error ? (error.stack ?? error.message) : String(error);\n            const willRetry = job.attempts < job.maxAttempts;\n\n            // Truncated, because `last_error` holds a stack and a queue that\n            // accumulates megabytes of them is its own outage.\n            await store.fail(job.id, message.slice(0, 4_000), willRetry ? new Date(Date.now() + backoff(job.attempts)) : null);\n\n            if (willRetry) {\n                logger.warn(`[jobs] \"${job.task}\" failed on attempt ${job.attempts}/${job.maxAttempts}; retrying`, { jobId: job.id });\n            } else {\n                // The last attempt is an error, not a warning: nothing else will\n                // touch this job, and if nobody looks at the table it is simply\n                // lost work.\n                logger.error(`[jobs] \"${job.task}\" failed permanently after ${job.attempts} attempts`, { jobId: job.id, error: message });\n            }\n        }\n    }\n\n    async function poll(): Promise<number> {\n        // The reaper, on its own cadence.\n        const now = Date.now();\n        if (now - lastReapAt > visibilityTimeoutMs * REAP_INTERVAL_FACTOR) {\n            lastReapAt = now;\n            try {\n                await store.reapExpired(visibilityTimeoutMs);\n            } catch (error) {\n                logger.error(\"[jobs] Failed to reclaim expired jobs\", { error });\n            }\n        }\n\n        const jobs = await store.claim(concurrency, workerId);\n        if (jobs.length === 0) return 0;\n\n        // Settled, not `all`: `runJob` handles its own errors, but a store\n        // write failing inside it must not abandon this batch's siblings.\n        await Promise.allSettled(jobs.map(runJob));\n        return jobs.length;\n    }\n\n    function schedule(delayMs: number): void {\n        if (!running) return;\n        timer = setTimeout(() => {\n            void tick();\n        }, delayMs);\n        // Never hold the process open. A queue with nothing to do should not be\n        // the reason `rebase dev` will not exit.\n        timer.unref?.();\n    }\n\n    async function tick(): Promise<void> {\n        if (!running) return;\n        const work = (async () => {\n            try {\n                return await poll();\n            } catch (error) {\n                logger.error(\"[jobs] Poll failed\", { error });\n                return 0;\n            }\n        })();\n        inFlight = work;\n        const count = await work;\n\n        // A full batch means there is probably more waiting, so go straight\n        // back rather than sleeping through a backlog.\n        schedule(count >= concurrency ? 0 : pollIntervalMs);\n    }\n\n    return {\n        start(): void {\n            if (running) return;\n            running = true;\n            logger.info(`[jobs] Worker started (concurrency ${concurrency}, poll ${pollIntervalMs}ms)`);\n            schedule(0);\n        },\n\n        async stop(): Promise<void> {\n            running = false;\n            if (timer) {\n                clearTimeout(timer);\n                timer = null;\n            }\n            if (draining) return;\n            draining = true;\n            // Jobs in flight keep their claim until they finish or the\n            // visibility timeout expires, so waiting here is what turns a\n            // graceful shutdown into \"no job runs twice\".\n            await inFlight.catch(() => undefined);\n            draining = false;\n        },\n\n        runOnce(): Promise<number> {\n            return poll();\n        },\n\n        register<P = unknown>(task: string, handler: JobHandler<P>): void {\n            if (handlers.has(task)) {\n                logger.warn(`[jobs] Task \"${task}\" was already registered; the later handler wins`);\n            }\n            handlers.set(task, handler as JobHandler<never>);\n        },\n\n        isRunning(): boolean {\n            return running;\n        },\n\n        async enqueue<P = unknown>(task: string, payload?: P, enqueueOptions: EnqueueOptions = {}): Promise<string | null> {\n            return store.insert({\n                task,\n                payload: payload ?? null,\n                runAt: new Date(Date.now() + (enqueueOptions.delayMs ?? 0)),\n                maxAttempts: enqueueOptions.maxAttempts ?? defaultMaxAttempts,\n                idempotencyKey: enqueueOptions.idempotencyKey\n            });\n        }\n    };\n}\n","export { createJobStore } from \"./job-store\";\nexport type { JobStore } from \"./job-store\";\nexport { createJobQueue, defaultBackoff } from \"./job-queue\";\nexport type { JobQueue } from \"./job-queue\";\nexport type {\n    EnqueueOptions,\n    JobContext,\n    JobHandler,\n    JobQueueClient,\n    JobQueueOptions,\n    JobRecord,\n    JobStatus\n} from \"./types\";\n"],"mappings":";;;;;;;;;;;;;AA0CA,IAAM,gBAAgB,OAAO,IAAI,0CAA0C;;AAc3E,SAAgB,4BAA4D;CACxE,OAAQ,WAA4B,cAAc,GAAG;AACzD;;;;;;;;;;;ACzCA,IAAM,QAAQ;;AAGd,IAAM,2BAA2B;;;;;;AAMjC,IAAM,wBAAwB;AAgB9B,SAAS,SAAS,KAAwB;CACtC,OAAO;EACH,IAAI,IAAI;EACR,MAAM,IAAI;EACV,SAAS,IAAI;EACb,QAAQ,IAAI;EACZ,OAAO,IAAI,KAAK,IAAI,MAAM,CAAC,CAAC,YAAY;EACxC,UAAU,OAAO,IAAI,QAAQ;EAC7B,aAAa,OAAO,IAAI,YAAY;EACpC,WAAW,IAAI;EACf,WAAW,IAAI,KAAK,IAAI,UAAU,CAAC,CAAC,YAAY;EAChD,WAAW,IAAI,KAAK,IAAI,UAAU,CAAC,CAAC,YAAY;CACpD;AACJ;;AAGA,SAAS,kBAAkB,KAAuB;CAC9C,OAAO,gBAAgB,MAAM,MAAM,EAAE,SAAS,OAAO;AACzD;;;;;;;;;;;;;;;;;;;;;;;AAwBA,IAAM,mBAAmB;AACzB,IAAM,oBAAoB,GAAG,iBAAiB;AAsB9C,SAAgB,eAAe,QAA0C;CACrE,MAAM,QAAQ,OAAO;CACrB,IAAI,CAAC,WAAW,KAAK,GAAG;EACpB,OAAO,KACH,+IAEJ;EACA;CACJ;CAKA,MAAM,WAAoB,SAAS,YAC/B,MAAM,WAAW,SAAS,SAAS,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,KAAA,CAAS;CACtF,MAAM,QAAQ,SAAiB,WAC3B,QAAQ,SAAS,SAAS,EAAE,OAAO,IAAI,KAAA,CAAS;CAEpD,MAAM,MAAM,sBAAsB,SAAS,MAAM;;;;;;;CAQjD,IAAI,uBAAuB;CAE3B,OAAO;EACH,MAAM,cAA6B;GAC/B,MAAM,IAAI,aAAa,0BAA0B,oCAAoC;GAErF,MAAM,IAAI,aAAa,YAAY,SAAS;6CACX,MAAM;;;;;;;;;;;;;;;aAetC;GAKD,MAAM,IAAI,aAAa,8BAA8B;;qBAE5C,MAAM;;aAEd;GAGD,MAAM,IAAI,aAAa,6BAA6B;;qBAE3C,MAAM;;aAEd;GAOD,MAAM,IAAI,aAAa,iCAAiC;;qBAE/C,MAAM;;aAEd;GAID,IAAI,MAFgB,IAAI,WAAW,KAAK,GAE7B;IACP,MAAM,IAAI,KAAK,uBAAuB,YAAY;KAC9C,MAAM,KACF,eAAe,MAAM;;2GAGrB,CAAC,0BAA0B,qBAAqB,CACpD;IACJ,CAAC;IAOD,MAAM,IAAI,KAAK,0CACX,KAAK,uBAAuB,UAAU,MAAM,CAAC,CAAC;IAElD,MAAM,IAAI,aAAa,YAAY,oBAAoB;iDACtB,iBAAiB;;;;;;;;sCAQ5B,MAAM;;;;;iBAK3B;IAID,MAAM,IAAI,KAAK,YAAY,iBAAiB,uBAAuB,YAAY;KAC3E,MAAM,KAAK,0BAA0B,kBAAkB,aAAa;KACpE,MAAM,KAAK;;iFAEkD,iBAAiB;4DACtC,kBAAkB,MAAM,iBAAiB;;;qBAGhF;IACL,CAAC;IACD,uBAAuB,YAAkC,MAAM,KAC3D,2BAA2B,kBAAkB,0BACjD,CAAC,CAAC,EAAE,YAAY;IAChB,IAAI,CAAC,sBACD,OAAO,KACH,aAAa,iBAAiB,qHAElC;IAGJ,OAAO,KAAK,yBAAyB;GACzC,OACI,OAAO,MACH,YAAY,MAAM,2HAEtB;EAER;EAEA,MAAM,OAAO,KAA6B;GACtC,MAAM,SAAS;IACX,IAAI;IACJ,KAAK,UAAU,IAAI,WAAW,IAAI;IAClC,IAAI,MAAM,YAAY;IACtB,IAAI;IACJ,IAAI,kBAAkB;GAC1B;GAIA,MAAM,UAAU,uBAAuB,0BAA0B,IAAI,KAAA;GACrE,IAAI,SAKA,QAAQ,MAJW,QAAQ,KACvB,UAAU,iBAAiB,sEAC3B,MACJ,EAAA,GACe,EAAE,EAAE,MAAoC;GAE3D,IAAI;IAOA,QAAQ,MANW,KACf,eAAe,MAAM;;oCAGrB,MACJ,EAAA,GACe,EAAE,EAAE,MAAiB;GACxC,SAAS,OAAO;IAIZ,IAAI,kBAAkB,KAAK,GAAG,OAAO;IACrC,MAAM;GACV;EACJ;EAEA,MAAM,MAAM,OAAe,UAAwC;GA6B/D,OAAO,QAAgB,MAjBJ,KACf,UAAU,MAAM;;;;;;;sCAOM,MAAM;;;;;;+BAO5B,CAAC,OAAO,QAAQ,CACpB,CAC2B,CAAC,CAAC,IAAI,QAAQ;EAC7C;EAEA,MAAM,SAAS,IAA2B;GACtC,MAAM,KACF,UAAU,MAAM;;iCAGhB,CAAC,EAAE,CACP;EACJ;EAEA,MAAM,KAAK,IAAY,OAAe,SAAqC;GACvE,IAAI,SAAS;IACT,MAAM,KACF,UAAU,MAAM;;qCAGhB;KAAC;KAAI,QAAQ,YAAY;KAAG;IAAK,CACrC;IACA;GACJ;GACA,MAAM,KACF,UAAU,MAAM;;iCAGhB,CAAC,IAAI,KAAK,CACd;EACJ;EAEA,MAAM,YAAY,qBAA8C;GAM5D,MAAM,UAAU,KAAK,IAAI,GAAG,KAAK,MAAM,sBAAsB,GAAI,CAAC;GAElE,MAAM,UAAU,MAAM,KAClB,UAAU,MAAM;;;;;gCAMhB,CAAC,OAAO,CACZ;GAEA,MAAM,SAAS,MAAM,KACjB,UAAU,MAAM;;;;;gCAMhB,CAAC,OAAO,CACZ;GAEA,MAAM,SAAS,SAAS,UAAU,MAAM,QAAQ,UAAU;GAC1D,IAAI,QAAQ,GACR,OAAO,KACH,oBAAoB,MAAM,iDACtB,SAAS,UAAU,EAAE,cAAc,QAAQ,UAAU,EAAE,gBAC/D;GAEJ,OAAO;EACX;EAEA,MAAM,MAAM,IAAuC;GAE/C,MAAM,MAAM,YAAoB,MADb,KAAK,iBAAiB,MAAM,iBAAiB,CAAC,EAAE,CAAC,CAChC;GACpC,OAAO,MAAM,SAAS,GAAG,IAAI;EACjC;CACJ;AACJ;;;;;;;;;;ACzXA,IAAM,sBAAsB;AAC5B,IAAM,2BAA2B;AACjC,IAAM,gCAAgC,IAAI;AAC1C,IAAM,uBAAuB;;AAG7B,SAAgB,eAAe,SAAyB;CACpD,OAAO,KAAK,IAAI,MAAQ,KAAK,IAAI,GAAG,KAAK,IAAI,GAAG,UAAU,CAAC,CAAC,GAAG,KAAK,GAAM;AAC9E;;;;;;;;AASA,IAAM,uBAAuB;AAY7B,SAAgB,eAAe,OAAiB,UAA2B,CAAC,GAAa;CACrF,MAAM,cAAc,QAAQ,eAAe;CAC3C,MAAM,iBAAiB,QAAQ,kBAAkB;CACjD,MAAM,sBAAsB,QAAQ,uBAAuB;CAC3D,MAAM,qBAAqB,QAAQ,eAAe;CAClD,MAAM,UAAU,QAAQ,WAAW;CAEnC,MAAM,2BAAW,IAAI,IAA+B;CACpD,KAAK,MAAM,CAAC,MAAM,YAAY,OAAO,QAAQ,QAAQ,SAAS,CAAC,CAAC,GAC5D,SAAS,IAAI,MAAM,OAAO;CAM9B,MAAM,WAAW,GAAG,QAAQ,IAAI,GAAG,WAAW,CAAC,CAAC,MAAM,GAAG,CAAC;CAE1D,IAAI,QAA+B;CACnC,IAAI,UAAU;CACd,IAAI,WAAW;;CAEf,IAAI,WAA6B,QAAQ,QAAQ;CACjD,IAAI,aAAa;CAEjB,eAAe,OAAO,KAA+B;EACjD,MAAM,UAAU,SAAS,IAAI,IAAI,IAAI;EAErC,IAAI,CAAC,SAAS;GAUV,OAAO,KAAK,0CAA0C,IAAI,KAAK,mCAAmC;GAClG,MAAM,MAAM,KACR,IAAI,IACJ,mCAAmC,IAAI,KAAK,IAC5C,IAAI,WAAW,IAAI,cAAc,IAAI,KAAK,KAAK,IAAI,IAAI,QAAQ,IAAI,QAAQ,CAAC,IAAI,IACpF;GACA;EACJ;EAEA,IAAI;GACA,MAAM,QAAQ;IACV,IAAI,IAAI;IACR,MAAM,IAAI;IACV,SAAS,IAAI;IACb,SAAS,IAAI;IACb,aAAa,IAAI;GACrB,CAAU;GACV,MAAM,MAAM,SAAS,IAAI,EAAE;EAC/B,SAAS,OAAO;GACZ,MAAM,UAAU,iBAAiB,QAAS,MAAM,SAAS,MAAM,UAAW,OAAO,KAAK;GACtF,MAAM,YAAY,IAAI,WAAW,IAAI;GAIrC,MAAM,MAAM,KAAK,IAAI,IAAI,QAAQ,MAAM,GAAG,GAAK,GAAG,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,QAAQ,IAAI,QAAQ,CAAC,IAAI,IAAI;GAEjH,IAAI,WACA,OAAO,KAAK,WAAW,IAAI,KAAK,sBAAsB,IAAI,SAAS,GAAG,IAAI,YAAY,aAAa,EAAE,OAAO,IAAI,GAAG,CAAC;QAKpH,OAAO,MAAM,WAAW,IAAI,KAAK,6BAA6B,IAAI,SAAS,YAAY;IAAE,OAAO,IAAI;IAAI,OAAO;GAAQ,CAAC;EAEhI;CACJ;CAEA,eAAe,OAAwB;EAEnC,MAAM,MAAM,KAAK,IAAI;EACrB,IAAI,MAAM,aAAa,sBAAsB,sBAAsB;GAC/D,aAAa;GACb,IAAI;IACA,MAAM,MAAM,YAAY,mBAAmB;GAC/C,SAAS,OAAO;IACZ,OAAO,MAAM,yCAAyC,EAAE,MAAM,CAAC;GACnE;EACJ;EAEA,MAAM,OAAO,MAAM,MAAM,MAAM,aAAa,QAAQ;EACpD,IAAI,KAAK,WAAW,GAAG,OAAO;EAI9B,MAAM,QAAQ,WAAW,KAAK,IAAI,MAAM,CAAC;EACzC,OAAO,KAAK;CAChB;CAEA,SAAS,SAAS,SAAuB;EACrC,IAAI,CAAC,SAAS;EACd,QAAQ,iBAAiB;GACrB,KAAU;EACd,GAAG,OAAO;EAGV,MAAM,QAAQ;CAClB;CAEA,eAAe,OAAsB;EACjC,IAAI,CAAC,SAAS;EACd,MAAM,QAAQ,YAAY;GACtB,IAAI;IACA,OAAO,MAAM,KAAK;GACtB,SAAS,OAAO;IACZ,OAAO,MAAM,sBAAsB,EAAE,MAAM,CAAC;IAC5C,OAAO;GACX;EACJ,EAAA,CAAG;EACH,WAAW;EAKX,SAAS,MAJW,QAIF,cAAc,IAAI,cAAc;CACtD;CAEA,OAAO;EACH,QAAc;GACV,IAAI,SAAS;GACb,UAAU;GACV,OAAO,KAAK,sCAAsC,YAAY,SAAS,eAAe,IAAI;GAC1F,SAAS,CAAC;EACd;EAEA,MAAM,OAAsB;GACxB,UAAU;GACV,IAAI,OAAO;IACP,aAAa,KAAK;IAClB,QAAQ;GACZ;GACA,IAAI,UAAU;GACd,WAAW;GAIX,MAAM,SAAS,YAAY,KAAA,CAAS;GACpC,WAAW;EACf;EAEA,UAA2B;GACvB,OAAO,KAAK;EAChB;EAEA,SAAsB,MAAc,SAA8B;GAC9D,IAAI,SAAS,IAAI,IAAI,GACjB,OAAO,KAAK,gBAAgB,KAAK,iDAAiD;GAEtF,SAAS,IAAI,MAAM,OAA4B;EACnD;EAEA,YAAqB;GACjB,OAAO;EACX;EAEA,MAAM,QAAqB,MAAc,SAAa,iBAAiC,CAAC,GAA2B;GAC/G,OAAO,MAAM,OAAO;IAChB;IACA,SAAS,WAAW;IACpB,OAAO,IAAI,KAAK,KAAK,IAAI,KAAK,eAAe,WAAW,EAAE;IAC1D,aAAa,eAAe,eAAe;IAC3C,gBAAgB,eAAe;GACnC,CAAC;EACL;CACJ;AACJ"}