@rebasepro/server 0.9.1-canary.09aaf62 → 0.9.1-canary.0fce67c

package/dist/cron/cron-store.d.ts

@@ -28,23 +28,5 @@ export interface CronStore {
         totalFailures: number;
         lastRunAt?: string;
     }>>;
-    /**
-     * Atomically claim a scheduled run slot for a job.
-     *
-     * `slot` is the *scheduled* fire time (ISO string) derived from the cron
-     * expression — deterministic across instances regardless of timer drift,
-     * so all instances contend on the same (jobId, slot) key. Exactly one
-     * caller wins the insert against the unique constraint and executes;
-     * the rest skip.
-     *
-     * Fails open (returns true) on unexpected store errors, so a broken
-     * claims table degrades to uncoordinated execution rather than silently
-     * never running jobs.
-     *
-     * Optional so custom stores written against the pre-claims interface
-     * keep working — the scheduler treats a missing implementation as
-     * uncoordinated (always run).
-     */
-    tryClaimRun?(jobId: string, slot: string): Promise<boolean>;
 }
 export declare function createCronStore(driver: DataDriver): CronStore | undefined;

package/dist/env.d.ts

@@ -55,9 +55,6 @@ declare const rebaseEnvSchema: z.ZodObject<{
         true: "true";
         false: "false";
     }>>, z.ZodTransform<boolean, "" | "true" | "false" | undefined>>;
-    GCS_BUCKET: z.ZodOptional<z.ZodString>;
-    GCS_PROJECT_ID: z.ZodOptional<z.ZodString>;
-    GCS_KEY_FILENAME: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 /** Inferred type of the validated environment. */
 export type RebaseEnv = z.infer<typeof rebaseEnvSchema>;

package/dist/index.es.js

@@ -11623,21 +11623,11 @@ var LocalStorageController = class {
 		}
 	}
 	/**
-	* Get the full filesystem path for a storage path, with a traversal guard
-	* that keeps the result inside the bucket directory.
-	*
-	* Defaults the bucket the way `putObject` does.
-	*
-	* `putObject` has always written into `default` when given no bucket, while
-	* the read side resolved a bare key against the storage root — where
-	* nothing is. The two disagreed silently: `getObject` returned null (reads
-	* as "file missing"), `deleteObject` deleted nothing (404s are swallowed by
-	* design), and `listObjects` returned an empty page. So the obvious
-	* `putObject({ key })` → `getObject(key)` did not round-trip and nothing
-	* said why. One default, applied everywhere, removes the whole class.
+	* Get the full filesystem path for a storage path.
+	* Includes a path traversal guard to prevent escaping the base directory.
 	*/
 	getFullPath(storagePath, bucket) {
-		const bucketPath = path$1.join(this.basePath, bucket ?? "default");
+		const bucketPath = bucket ? path$1.join(this.basePath, bucket) : this.basePath;
 		const resolved = path$1.resolve(path$1.join(bucketPath, storagePath));
 		if (!resolved.startsWith(bucketPath + path$1.sep) && resolved !== bucketPath) throw new Error("Path traversal detected: resolved storage path is outside the bucket directory.");
 		return resolved;
@@ -11798,10 +11788,8 @@ var LocalStorageController = class {
 			let count = 0;
 			const maxResults = options?.maxResults ?? 1e3;
 			const startIndex = options?.pageToken ? parseInt(options.pageToken, 10) : 0;
-			let scanned = startIndex;
 			for (let i = startIndex; i < entries.length && count < maxResults; i++) {
 				const entry = entries[i];
-				scanned = i + 1;
 				if (entry.name.endsWith(".metadata.json")) continue;
 				const entryPath = prefix ? `${prefix}/${entry.name}` : entry.name;
 				const bucket = options?.bucket ?? "default";
@@ -11820,7 +11808,7 @@ var LocalStorageController = class {
 			return {
 				items,
 				prefixes,
-				nextPageToken: scanned < entries.length ? String(scanned) : void 0
+				nextPageToken: startIndex + count < entries.length ? String(startIndex + count) : void 0
 			};
 		} catch (error) {
 			const code = error?.code;
@@ -13771,14 +13759,12 @@ var UPLOAD_EXPIRY_MS = 1440 * 60 * 1e3;
 var TusHandler = class {
 	storageController;
 	storageRegistry;
-	authorizeUpload;
 	uploads = /* @__PURE__ */ new Map();
 	tusDir;
 	cleanupTimer;
-	constructor(storageBaseDir, storageController, storageRegistry, authorizeUpload) {
+	constructor(storageBaseDir, storageController, storageRegistry) {
 		this.storageController = storageController;
 		this.storageRegistry = storageRegistry;
-		this.authorizeUpload = authorizeUpload;
 		this.tusDir = join(storageBaseDir, ".tus-uploads");
 	}
 	/** Ensure the temp directory exists. */
@@ -13842,10 +13828,6 @@ var TusHandler = class {
 		if (Number.isNaN(uploadLength) || uploadLength <= 0) throw ApiError.badRequest("Invalid Upload-Length");
 		if (uploadLength > MAX_UPLOAD_SIZE) throw new ApiError(413, "PAYLOAD_TOO_LARGE", `Upload-Length exceeds maximum of ${MAX_UPLOAD_SIZE} bytes`);
 		const metadata = this.parseMetadata(c.req.header("Upload-Metadata") || "");
-		if (this.authorizeUpload) {
-			const key = metadata.key || metadata.filename || "";
-			await this.authorizeUpload(c, key, metadata.bucket || "default");
-		}
 		const id = randomUUID$1();
 		const filePath = join(this.tusDir, id);
 		await writeFile(filePath, Buffer.alloc(0));
@@ -14053,34 +14035,7 @@ function buildAdapterAuthMiddleware(adapter, requireAuth, publicRead) {
 function createStorageRoutes(config) {
 	const router = new Hono();
 	router.onError(errorHandler);
-	const { controller, registry, sources: declaredSources, requireAuth: requireAuth$1 = true, publicRead = false, authAdapter, authorize } = config;
-	/**
-	* Run the per-object authorization hook, if one is configured.
-	*
-	* Denials are 403 rather than 404: the route already established that the
-	* caller is authenticated, so hiding existence buys nothing, and a
-	* distinguishable status is what makes a misconfigured policy debuggable.
-	* A hook that throws denies too — an ownership lookup that fails must not
-	* fall open.
-	*/
-	const checkAuthorized = async (c, operation, key, bucket, storageId) => {
-		if (!authorize) return;
-		const user = c.get("user") ?? null;
-		if (user?.userId === "download-token" || user?.userId === "public") return;
-		let allowed;
-		try {
-			allowed = await authorize({
-				key,
-				bucket,
-				operation,
-				user,
-				storageId: storageId ?? void 0
-			});
-		} catch {
-			allowed = false;
-		}
-		if (!allowed) throw ApiError.forbidden("Not authorized for this object");
-	};
+	const { controller, registry, sources: declaredSources, requireAuth: requireAuth$1 = true, publicRead = false, authAdapter } = config;
 	/**
 	* Resolve the storage controller for a request.
 	* Looks up by `storageId` in the registry, falls back to the single
@@ -14130,7 +14085,6 @@ function createStorageRoutes(config) {
 		const finalKey = sanitizeStorageKey(key || uploadedFile.name || "unnamed");
 		const metadata = {};
 		for (const [k, value] of Object.entries(body)) if (k.startsWith("metadata_")) metadata[k.replace("metadata_", "")] = value;
-		await checkAuthorized(c, "write", finalKey, bucket ?? "default", storageId);
 		const result = await resolveController(storageId).putObject({
 			file: uploadedFile,
 			key: finalKey,
@@ -14151,12 +14105,7 @@ function createStorageRoutes(config) {
 		const rawPath = extractWildcardPath(c);
 		if (!rawPath) throw ApiError.notFound("File not found");
 		const filePath = decodeURIComponent(rawPath);
-		const storageId = c.req.query("storageId");
-		const resolved = resolveController(storageId);
-		{
-			const { bucket, resolvedPath } = parseBucketAndPath(filePath);
-			await checkAuthorized(c, "read", resolvedPath, bucket, storageId);
-		}
+		const resolved = resolveController(c.req.query("storageId"));
 		const transformOpts = parseTransformOptions(c.req.query());
 		if (resolved.getType() === "local") {
 			const localController = resolved;
@@ -14219,10 +14168,8 @@ function createStorageRoutes(config) {
 			fileNotFound: true
 		}, 404);
 		const filePath = decodeURIComponent(rawPath);
-		const storageId = c.req.query("storageId");
-		const resolved = resolveController(storageId);
+		const resolved = resolveController(c.req.query("storageId"));
 		const { bucket, resolvedPath } = parseBucketAndPath(filePath);
-		await checkAuthorized(c, "read", resolvedPath, bucket, storageId);
 		const downloadConfig = await resolved.getSignedUrl(resolvedPath, bucket);
 		if (downloadConfig.fileNotFound) throw ApiError.notFound("File not found");
 		if (downloadConfig.metadata) {
@@ -14248,10 +14195,8 @@ function createStorageRoutes(config) {
 			message: "No file to delete"
 		});
 		const filePath = decodeURIComponent(rawPath);
-		const storageId = c.req.query("storageId");
-		const resolved = resolveController(storageId);
+		const resolved = resolveController(c.req.query("storageId"));
 		const { bucket, resolvedPath } = parseBucketAndPath(filePath);
-		await checkAuthorized(c, "delete", resolvedPath, bucket, storageId);
 		await resolved.deleteObject(resolvedPath, bucket);
 		return c.json({
 			success: true,
@@ -14266,9 +14211,7 @@ function createStorageRoutes(config) {
 		const bucket = c.req.query("bucket");
 		const maxResults = c.req.query("maxResults");
 		const pageToken = c.req.query("pageToken");
-		const storageId = c.req.query("storageId");
-		const resolved = resolveController(storageId);
-		await checkAuthorized(c, "list", storagePrefix, bucket ?? "default", storageId);
+		const resolved = resolveController(c.req.query("storageId"));
 		const result = await resolved.listObjects(storagePrefix, {
 			bucket: bucket ?? (resolved.getType() === "local" ? "default" : void 0),
 			maxResults: maxResults ? parseInt(maxResults, 10) : void 0,
@@ -14291,7 +14234,6 @@ function createStorageRoutes(config) {
 		const resolved = resolveController(storageId);
 		const { bucket, resolvedPath } = parseBucketAndPath(folderPath);
 		if (!resolvedPath || resolvedPath.trim() === "") throw ApiError.badRequest("Invalid folder path");
-		await checkAuthorized(c, "write", resolvedPath, bucket, storageId);
 		if (resolved.getType() === "local") {
 			const absolutePath = resolved.getAbsolutePath(resolvedPath, bucket);
 			fs$1.mkdirSync(absolutePath, { recursive: true });
@@ -14309,9 +14251,7 @@ function createStorageRoutes(config) {
 		}, 201);
 	});
 	const defaultCtrl = getDefaultController();
-	const tusHandler = new TusHandler(defaultCtrl.getType() === "local" ? defaultCtrl.getBasePath() : process.env.STORAGE_PATH || "./uploads", defaultCtrl, registry, authorize ? async (c, key, bucket) => {
-		await checkAuthorized(c, "write", sanitizeStorageKey(key), bucket, c.req.query("storageId"));
-	} : void 0);
+	const tusHandler = new TusHandler(defaultCtrl.getType() === "local" ? defaultCtrl.getBasePath() : process.env.STORAGE_PATH || "./uploads", defaultCtrl, registry);
 	tusHandler.startCleanup();
 	router.options("/tus", (_c) => tusHandler.options());
 	router.post("/tus", writeAuthMiddleware, async (c) => tusHandler.create(c));
@@ -14452,7 +14392,7 @@ async function initializeStorage(storageConfig, isProduction) {
 	const toController = async (entry, label) => {
 		if (typeof entry.putObject === "function") return entry;
 		const conf = entry;
-		if (isProduction && conf.type === "local" && !process.env.FORCE_LOCAL_STORAGE) throw new Error(`Storage backend "${label}" is set to "local" in production. Local storage is the container filesystem, so uploaded files are destroyed on the next restart or redeploy. Configure S3-compatible storage (STORAGE_TYPE=s3) or GCS (STORAGE_TYPE=gcs), or pass a custom StorageController. If this deployment really does have a durable volume mounted at the storage path, set FORCE_LOCAL_STORAGE=true to proceed.`);
+		if (isProduction && conf.type === "local") logger.warn(`Storage backend "${label}" uses local filesystem in production. Files will be lost on container restart. Configure S3-compatible storage or a custom StorageController.`);
 		return await createStorageController(conf);
 	};
 	if (typeof storageConfig === "object" && ("type" in storageConfig || typeof storageConfig.putObject === "function")) controllers[DEFAULT_STORAGE_ID] = await toController(storageConfig, DEFAULT_STORAGE_ID);
@@ -16015,23 +15955,6 @@ var RebaseWebSocketClient = class {
 	getAuthToken;
 	subscriptions = /* @__PURE__ */ new Map();
 	listeners = /* @__PURE__ */ new Map();
-	/** Channel-name → handlers, for broadcast and presence frames. */
-	channelHandlers = /* @__PURE__ */ new Map();
-	/** Subscribe to broadcast/presence frames for one channel. */
-	onChannelMessage(channel, handler) {
-		if (!this.channelHandlers.has(channel)) this.channelHandlers.set(channel, /* @__PURE__ */ new Set());
-		this.channelHandlers.get(channel).add(handler);
-		return () => {
-			const handlers = this.channelHandlers.get(channel);
-			if (!handlers) return;
-			handlers.delete(handler);
-			if (handlers.size === 0) this.channelHandlers.delete(channel);
-		};
-	}
-	/** Notified after the socket comes back, so channels can re-join. */
-	onReconnect(handler) {
-		return this.on("reconnect", handler);
-	}
 	on(event, cb) {
 		if (!this.listeners.has(event)) this.listeners.set(event, /* @__PURE__ */ new Set());
 		this.listeners.get(event).add(cb);
@@ -16298,15 +16221,6 @@ var RebaseWebSocketClient = class {
 			}
 			return;
 		}
-		if (typeof message.channel === "string" && (type === "broadcast" || type === "presence_state" || type === "presence_diff")) {
-			const handlers = this.channelHandlers.get(message.channel);
-			if (handlers) for (const handler of [...handlers]) try {
-				handler(message);
-			} catch (error) {
-				console.error("Error in channel handler:", error);
-			}
-			return;
-		}
 		if (subscriptionId && type === "collection_update") {
 			const subscriptionKey = this.backendToCollectionKey.get(subscriptionId);
 			if (subscriptionKey) {
@@ -16495,10 +16409,6 @@ var RebaseWebSocketClient = class {
 			throw error;
 		}
 	}
-	/**
-	* Public because `RebaseRealtimeChannel` sends channel frames through it.
-	* Not part of the stable surface — prefer `client.realtime.channel(name)`.
-	*/
 	sendMessage(message) {
 		const queuedMsg = message;
 		if (queuedMsg._queuedResolve && queuedMsg._queuedReject) return this.doSendMessage(message, queuedMsg._queuedResolve, queuedMsg._queuedReject);
@@ -17079,188 +16989,6 @@ var RebaseWebSocketClient = class {
 	}
 };
 /**
-* Re-send presence comfortably inside the server's 30s expiry.
-*
-* Two-thirds of the window: one lost heartbeat still leaves time for the next
-* before the entry is reaped, so a single dropped frame is not a disappearance.
-*/
-var PRESENCE_HEARTBEAT_MS = 2e4;
-var RebaseRealtimeChannel = class {
-	name;
-	transport;
-	presenceHandlers = /* @__PURE__ */ new Set();
-	broadcastHandlers = /* @__PURE__ */ new Set();
-	unsubscribers = [];
-	/** Last known roster, kept so handlers always get a full picture. */
-	presences = {};
-	/** What this client last tracked, replayed on reconnect and heartbeat. */
-	trackedState = null;
-	heartbeat = null;
-	joined = false;
-	constructor(name, transport) {
-		this.name = name;
-		this.transport = transport;
-	}
-	/**
-	* Join the channel and ask for the current roster.
-	*
-	* Called automatically by `track`, `broadcast`, `onPresence` and
-	* `onBroadcast`; calling it directly is only needed to start receiving
-	* before there is anything to send.
-	*/
-	async join() {
-		if (this.joined) return;
-		this.joined = true;
-		this.unsubscribers.push(this.transport.onChannelMessage(this.name, (message) => this.handle(message)));
-		this.unsubscribers.push(this.transport.onReconnect(() => {
-			this.rejoin();
-		}));
-		await this.transport.sendMessage({
-			type: "join_channel",
-			channel: this.name
-		});
-		await this.transport.sendMessage({
-			type: "presence_state",
-			channel: this.name
-		});
-	}
-	async rejoin() {
-		try {
-			await this.transport.sendMessage({
-				type: "join_channel",
-				channel: this.name
-			});
-			await this.transport.sendMessage({
-				type: "presence_state",
-				channel: this.name
-			});
-			if (this.trackedState) await this.transport.sendMessage({
-				type: "presence_track",
-				channel: this.name,
-				state: this.trackedState
-			});
-		} catch {}
-	}
-	/**
-	* Publish this client's presence state, and keep publishing it.
-	*
-	* Calling `track` again replaces the state (and restarts the heartbeat),
-	* which is how you update e.g. a cursor position.
-	*/
-	async track(state) {
-		await this.join();
-		this.trackedState = state;
-		await this.transport.sendMessage({
-			type: "presence_track",
-			channel: this.name,
-			state
-		});
-		if (!this.heartbeat) {
-			this.heartbeat = setInterval(() => {
-				if (!this.trackedState) return;
-				this.transport.sendMessage({
-					type: "presence_track",
-					channel: this.name,
-					state: this.trackedState
-				}).catch(() => {});
-			}, PRESENCE_HEARTBEAT_MS);
-			this.heartbeat.unref?.();
-		}
-	}
-	/** Stop publishing presence, without leaving the channel. */
-	async untrack() {
-		this.stopHeartbeat();
-		this.trackedState = null;
-		if (this.joined) await this.transport.sendMessage({
-			type: "presence_untrack",
-			channel: this.name
-		});
-	}
-	/**
-	* Observe the roster. The handler fires immediately with what is already
-	* known, then on every change.
-	*/
-	onPresence(handler) {
-		this.presenceHandlers.add(handler);
-		this.join();
-		if (Object.keys(this.presences).length > 0) handler({ ...this.presences });
-		return () => this.presenceHandlers.delete(handler);
-	}
-	/** Send a broadcast. The sender does not receive its own message. */
-	async broadcast(event, payload) {
-		await this.join();
-		await this.transport.sendMessage({
-			type: "broadcast",
-			channel: this.name,
-			event,
-			payload
-		});
-	}
-	onBroadcast(eventOrHandler, maybeHandler) {
-		const wrapped = typeof eventOrHandler === "string" ? (e) => {
-			if (e.event === eventOrHandler) maybeHandler(e.payload);
-		} : eventOrHandler;
-		this.broadcastHandlers.add(wrapped);
-		this.join();
-		return () => this.broadcastHandlers.delete(wrapped);
-	}
-	/** Leave the channel and release every listener and timer. */
-	async leave() {
-		this.stopHeartbeat();
-		this.trackedState = null;
-		this.presences = {};
-		this.presenceHandlers.clear();
-		this.broadcastHandlers.clear();
-		for (const off of this.unsubscribers) off();
-		this.unsubscribers = [];
-		if (this.joined) {
-			this.joined = false;
-			await this.transport.sendMessage({
-				type: "leave_channel",
-				channel: this.name
-			});
-		}
-	}
-	stopHeartbeat() {
-		if (this.heartbeat) {
-			clearInterval(this.heartbeat);
-			this.heartbeat = null;
-		}
-	}
-	/** Fold an incoming frame into the roster and fan it out. */
-	handle(message) {
-		switch (message.type) {
-			case "presence_state":
-				this.presences = message.presences ?? {};
-				this.emitPresence();
-				break;
-			case "presence_diff": {
-				const joins = message.joins ?? {};
-				const leaves = message.leaves ?? {};
-				for (const [id, state] of Object.entries(joins)) this.presences[id] = state;
-				for (const id of Object.keys(leaves)) delete this.presences[id];
-				this.emitPresence({
-					joins,
-					leaves
-				});
-				break;
-			}
-			case "broadcast": {
-				const event = {
-					event: message.event,
-					payload: message.payload
-				};
-				for (const handler of this.broadcastHandlers) handler(event);
-				break;
-			}
-		}
-	}
-	emitPresence(diff) {
-		const snapshot = { ...this.presences };
-		for (const handler of this.presenceHandlers) handler(snapshot, diff);
-	}
-};
-/**
 * Derive a WebSocket URL from an HTTP base URL.
 * `http://` → `ws://`, `https://` → `wss://`.
 */
@@ -17309,8 +17037,6 @@ function createRebaseClient(options) {
 	};
 	const resolvedWsUrl = options.realtime !== false ? options.websocketUrl ?? deriveWebSocketUrl(options.baseUrl) : void 0;
 	let ws;
-	/** One channel object per name — see `realtime.channel`. */
-	const realtimeChannels = /* @__PURE__ */ new Map();
 	if (resolvedWsUrl) {
 		ws = new RebaseWebSocketClient({
 			websocketUrl: resolvedWsUrl,
@@ -17421,24 +17147,6 @@ function createRebaseClient(options) {
 		createStorageSource,
 		fetchStorageSources,
 		ws,
-		realtime: { 
-		/**
-		* Join a broadcast/presence channel.
-		*
-		* Repeated calls with the same name return the same channel, so
-		* separate components can attach handlers without each opening its
-		* own membership — and `leave()` from one would otherwise silently
-		* cut off the others.
-		*/
-channel: (name) => {
-			if (!ws) throw new RebaseClientError("Realtime is disabled on this client (realtime: false), so channels are unavailable.");
-			let existing = realtimeChannels.get(name);
-			if (!existing) {
-				existing = new RebaseRealtimeChannel(name, ws);
-				realtimeChannels.set(name, existing);
-			}
-			return existing;
-		} },
 		/**
 		* Release the realtime socket and its reconnect timer.
 		*
@@ -17447,8 +17155,6 @@ channel: (name) => {
 		* was never started, and safe to call twice.
 		*/
 		close: () => {
-			for (const channel of realtimeChannels.values()) channel.leave();
-			realtimeChannels.clear();
 			ws?.disconnect();
 		},
 		setToken: transport.setToken,
@@ -18090,8 +17796,7 @@ async function _initializeRebaseBackend(config) {
 			registry: storageRegistry,
 			sources: config.storageSources,
 			requireAuth: resolveRequireAuth(config.auth),
-			authAdapter,
-			authorize: config.storageAuthorize
+			authAdapter
 		});
 		const storageRouter = new Hono();
 		if (apiKeyPreAuth) storageRouter.use("/*", apiKeyPreAuth, createStorageApiKeyGuard());
@@ -18763,7 +18468,6 @@ var CronScheduler = class {
 			logger.warn("[cron] Failed to seed job stats from database", { error: err });
 		});
 		for (const [id, job] of this.jobs) if (job.enabled) this.scheduleNext(id);
-		if (!this.store) logger.warn("[cron] No cron store attached — runs are uncoordinated; with multiple app instances every instance will execute every job");
 		logger.info(`⏰ Cron scheduler started with ${this.jobs.size} job(s)`);
 	}
 	/**
@@ -18882,19 +18586,6 @@ var CronScheduler = class {
 					this.scheduleNext(id);
 					return;
 				}
-				if (this.store?.tryClaimRun) {
-					let claimed = true;
-					try {
-						claimed = await this.store.tryClaimRun(id, nextRun.toISOString());
-					} catch (err) {
-						logger.warn(`[cron] Claim check threw for "${id}" — running uncoordinated`, { error: err });
-					}
-					if (!claimed) {
-						logger.info(`[cron] Slot ${nextRun.toISOString()} for "${id}" claimed by another instance — skipping`);
-						if (this.started && job.enabled) this.scheduleNext(id);
-						return;
-					}
-				}
 				await this.executeJob(job, false);
 				if (this.started && job.enabled) this.scheduleNext(id);
 			}, Math.max(rawDelay, MIN_SCHEDULE_INTERVAL_MS));
@@ -19063,25 +18754,6 @@ function createCronRoutes(scheduler) {
 //#region src/cron/cron-store.ts
 var cron_store_exports = /* @__PURE__ */ __exportAll({ createCronStore: () => createCronStore });
 var TABLE = "rebase.cron_logs";
-var CLAIMS_TABLE = "rebase.cron_claims";
-/** Claims older than this are garbage-collected on startup. */
-var CLAIM_RETENTION_DAYS = 7;
-/**
-* Detect a unique-constraint violation anywhere in an error's cause chain.
-* Drizzle wraps the PG error — match the SQLSTATE code, never message text.
-* Also covers SQLite ("UNIQUE constraint failed") and MySQL (ER_DUP_ENTRY 1062)
-* for future SQL drivers.
-*/
-function isUniqueViolation(err) {
-	let current = err;
-	for (let depth = 0; depth < 10 && current; depth++) if (typeof current === "object") {
-		const e = current;
-		if (e.code === "23505" || e.errno === 1062) return true;
-		if (typeof e.message === "string" && e.message.includes("UNIQUE constraint failed")) return true;
-		current = e.cause;
-	} else break;
-	return false;
-}
 function createCronStore(driver) {
 	const admin = driver.admin;
 	if (!isSQLAdmin(admin)) {
@@ -19111,15 +18783,6 @@ function createCronStore(driver) {
                     CREATE INDEX IF NOT EXISTS idx_cron_logs_job
                     ON ${TABLE}(job_id, started_at DESC)
                 `);
-				await exec(`
-                    CREATE TABLE IF NOT EXISTS ${CLAIMS_TABLE} (
-                        job_id TEXT NOT NULL,
-                        slot TIMESTAMPTZ NOT NULL,
-                        claimed_at TIMESTAMPTZ NOT NULL DEFAULT now(),
-                        PRIMARY KEY (job_id, slot)
-                    )
-                `);
-				await exec(`DELETE FROM ${CLAIMS_TABLE} WHERE claimed_at < now() - make_interval(days => $1)`, { params: [CLAIM_RETENTION_DAYS] });
 				logger.info("✅ Cron logs table ready");
 			} catch (err) {
 				logger.error("❌ Failed to create cron logs table", { error: err });
@@ -19179,18 +18842,6 @@ function createCronStore(driver) {
 				logger.error("[cron-store] Failed to fetch job stats", { error: err });
 			}
 			return stats;
-		},
-		async tryClaimRun(jobId, slot) {
-			try {
-				return (await exec(`INSERT INTO ${CLAIMS_TABLE} (job_id, slot)
-                     VALUES ($1, $2)
-                     ON CONFLICT (job_id, slot) DO NOTHING
-                     RETURNING job_id`, { params: [jobId, slot] })).length > 0;
-			} catch (err) {
-				if (isUniqueViolation(err)) return false;
-				logger.warn(`[cron-store] Claim check failed for "${jobId}" — running uncoordinated`, { error: err });
-				return true;
-			}
 		}
 	};
 }
@@ -19490,10 +19141,7 @@ var rebaseEnvSchema = object({
 	S3_ACCESS_KEY_ID: string().optional(),
 	S3_SECRET_ACCESS_KEY: string().optional(),
 	S3_ENDPOINT: string().url().optional(),
-	S3_FORCE_PATH_STYLE: optionalBoolString,
-	GCS_BUCKET: string().optional(),
-	GCS_PROJECT_ID: string().optional(),
-	GCS_KEY_FILENAME: string().optional()
+	S3_FORCE_PATH_STYLE: optionalBoolString
 });
 function loadEnv(options) {
 	const isProduction = process.env.NODE_ENV === "production";