@rubytech/create-maxy-code 0.1.474 → 0.1.476

package/payload/platform/plugins/scheduling/mcp/dist/lib/connector-sync-provision.js

@@ -0,0 +1,213 @@
+/**
+ * Task 1809 — the connector-sync provisioning gate.
+ *
+ * Task 1654 armed the recurring connector-sync turn only when the account
+ * carried an admin WhatsApp number, and read that number from a top-level
+ * `account.json` `adminPhones` key that exists on no account (the authoritative
+ * key is `whatsapp.adminPhones`). The two defects stacked: measured on the
+ * laptop on 2026-07-19, the provisioning block had logged `skipped` 7,868 times
+ * across four brands and had never once created an event.
+ *
+ * The gate was also on the wrong thing. The WhatsApp number is where the turn
+ * reports an EXCEPTION; it is not an input to the sync. So provisioning is
+ * gated here on the presence of a calendar connector — the work's actual input
+ * — and the exception destination is resolved separately.
+ *
+ * Where an account has a connector but no reachable exception destination, it
+ * is reported `unconfigured` rather than provisioned: a sync that fails and
+ * cannot report is not a clean sync, and arming one would reproduce the silence
+ * this task exists to remove. Making that case provisionable needs a
+ * destination-free operator route, which is Task 1812 (admin-webchat dispatch).
+ */
+import { existsSync, readdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { validateAgentDestination } from "./agent-dispatch.js";
+/** One entry per connector: the directory under `secrets/` whose per-identity
+ *  subdirectories each hold a `tokens.enc` once that identity is authorised. */
+const CONNECTOR_TOKEN_DIRS = [
+    { connector: "google", rel: ["google", "accounts"] },
+    { connector: "m365", rel: ["outlook", "mailboxes"] },
+];
+/**
+ * The calendar connectors currently authorised for an account, sorted. An
+ * authorised identity is one whose directory holds a `tokens.enc` — a
+ * half-registered identity (directory created, consent never completed) is
+ * deliberately NOT counted, so provisioning does not arm a turn that has
+ * nothing to read.
+ */
+export function detectCalendarConnectors(accountDir) {
+    const found = [];
+    for (const { connector, rel } of CONNECTOR_TOKEN_DIRS) {
+        const dir = join(accountDir, "secrets", ...rel);
+        // An ABSENT directory means the connector was never registered, which is
+        // the benign case. A directory that exists but cannot be read means the
+        // gate's input is unknown, NOT empty — reporting that as `not-applicable`
+        // would dress a real fault as the boring expected state, which is exactly
+        // the pathology Task 1809 exists to remove. So it throws, and the caller
+        // reports `error`.
+        if (!existsSync(dir))
+            continue;
+        let identities;
+        try {
+            identities = readdirSync(dir);
+        }
+        catch (err) {
+            throw new Error(`calendar connector directory ${dir} exists but is unreadable: ${err.message}`);
+        }
+        if (identities.some((id) => existsSync(join(dir, id, "tokens.enc")))) {
+            found.push(connector);
+        }
+    }
+    return found.sort();
+}
+/** Most actionable first: an install-wide fault outranks a per-account one, and
+ *  a specific rejection outranks the absence of any candidate at all. */
+const REFUSAL_PRECEDENCE = [
+    "house-unresolvable",
+    "unreadable-config",
+    "cross-account",
+    "not-registered",
+    "none-configured",
+];
+/**
+ * Where this account's connector-sync turn reports an exception, or the reason
+ * no channel destination is reachable.
+ *
+ * WhatsApp is preferred, Telegram is the fallback. Every candidate is passed
+ * through `validateAgentDestination` — the same authority the dispatcher's
+ * standing audit applies at fire time — so provisioning can never arm a binding
+ * the audit would immediately report as stale. `accountsDir` is the parent
+ * accounts directory (`$PLATFORM_ROOT/../data/accounts`).
+ */
+export function resolveDispatchDestination(accountsDir, accountId) {
+    let config;
+    try {
+        config = JSON.parse(readFileSync(join(accountsDir, accountId, "account.json"), "utf-8"));
+    }
+    catch {
+        // `main` enumerates accounts by the presence of this very file, so by the
+        // time we read it "absent" is the least likely cause and "malformed or
+        // unreadable" the most likely — the inverse of the obvious reading.
+        return { destination: null, reason: "unreadable-config" };
+    }
+    const refusals = [];
+    const wa = config.whatsapp ?? {};
+    const phones = Array.isArray(wa.adminPhones) ? wa.adminPhones : [];
+    for (const phone of phones) {
+        if (typeof phone !== "string" || phone.length === 0)
+            continue;
+        const check = classify(accountsDir, accountId, "whatsapp", phone);
+        if (check === null)
+            return { destination: { channel: "whatsapp", destination: phone }, reason: null };
+        refusals.push(check);
+    }
+    const tg = config.telegram ?? {};
+    const users = Array.isArray(tg.adminUsers) ? tg.adminUsers : [];
+    for (const user of users) {
+        if (typeof user !== "number" || !Number.isInteger(user))
+            continue;
+        const destination = String(user);
+        const check = classify(accountsDir, accountId, "telegram", destination);
+        if (check === null)
+            return { destination: { channel: "telegram", destination }, reason: null };
+        refusals.push(check);
+    }
+    const reason = REFUSAL_PRECEDENCE.find((r) => refusals.includes(r)) ?? "none-configured";
+    return { destination: null, reason };
+}
+/** null when the destination validates; otherwise why it did not.
+ *  `validateAgentDestination` resolves the house from disk and throws when the
+ *  house is unresolvable. That means "cannot confirm this destination", which
+ *  fails closed — but it is reported as its own install-wide reason rather than
+ *  collapsing into a per-account configuration gap. */
+function classify(accountsDir, accountId, channel, destination) {
+    let check;
+    try {
+        check = validateAgentDestination(accountsDir, accountId, channel, destination);
+    }
+    catch {
+        return "house-unresolvable";
+    }
+    return check.valid ? null : check.reason;
+}
+/** The comparison key for one observation. */
+export function provisionSignature(outcome, detail) {
+    return detail ? `${outcome}:${detail.slice(0, 80)}` : outcome;
+}
+/**
+ * Whether this tick reports the account's outcome.
+ *
+ * A permanent condition reported at tick rate is noise that hides its own
+ * meaning: the evidence for the Task 1809 defect was 5,688 identical lines that
+ * everyone read as benign. So a line is emitted when the outcome CHANGES, when
+ * the account has never been reported, or when the heartbeat window has
+ * elapsed — the heartbeat being what keeps "inert on every account" and "steady
+ * state" distinguishable without counting log lines by hand.
+ */
+export function shouldEmitProvisionLine(prev, nextSignature, nowMs, heartbeatMs) {
+    if (!prev)
+        return true;
+    if (prev.signature !== nextSignature)
+        return true;
+    const elapsed = nowMs - prev.loggedAtMs;
+    // A negative elapsed means the clock stepped backwards (an NTP correction on
+    // a Pi with no battery-backed RTC). Emitting is the safe side: the heartbeat
+    // is the only signal distinguishing "steady state" from "this loop stopped",
+    // and suppressing it for hours would hide precisely that.
+    return elapsed < 0 || elapsed >= heartbeatMs;
+}
+/** How this observation is labelled on the log line. `first` is NOT `change`:
+ *  labelling a first observation as a change means that any state loss produces
+ *  a synchronised fleet-wide burst of `emit=change`, indistinguishable from
+ *  every account genuinely flipping outcome at once — which is a real
+ *  emergency, and the one moment the label most needs to be trustworthy. */
+export function emitLabel(prev, nextSignature) {
+    if (!prev)
+        return "first";
+    return prev.signature === nextSignature ? "heartbeat" : "change";
+}
+/** Read the persisted state. An absent or corrupt file reads as empty, which
+ *  costs one redundant line per account and never suppresses one. A corrupt
+ *  file is reported: it is the trigger for a fleet-wide `emit=first` burst, and
+ *  that burst must carry its own explanation. */
+export function readProvisionState(path) {
+    let raw;
+    try {
+        raw = readFileSync(path, "utf-8");
+    }
+    catch {
+        return {}; // absent — the normal first-run case
+    }
+    try {
+        const parsed = JSON.parse(raw);
+        return parsed && typeof parsed === "object" ? parsed : {};
+    }
+    catch (err) {
+        console.error(`[calendar-availability] op=cal-sync-state result=unreadable path=${path} ` +
+            `reason=${JSON.stringify(err.message)} impact=every-account-reports-first`);
+        return {};
+    }
+}
+/**
+ * Persist the state. Written to a temp path and renamed, so a kill or a hard
+ * freeze mid-write cannot leave truncated JSON — which would read back as empty
+ * and produce the fleet-wide burst described above.
+ *
+ * A failed write must never abort the reconcile pass, but it must not be silent
+ * either: every realistic cause (disk full, filesystem remounted read-only,
+ * mode drift) is PERSISTENT, so the failure degrades emit-on-change back to
+ * per-tick logging indefinitely — worse than what it replaced, because every
+ * line then falsely claims to be a first observation.
+ */
+export function writeProvisionState(path, state) {
+    const tmp = `${path}.tmp`;
+    try {
+        writeFileSync(tmp, JSON.stringify(state));
+        renameSync(tmp, path);
+    }
+    catch (err) {
+        console.error(`[calendar-availability] op=cal-sync-state result=write-failed path=${path} ` +
+            `reason=${JSON.stringify(err.message)} impact=emit-on-change-degraded-to-per-tick`);
+    }
+}
+//# sourceMappingURL=connector-sync-provision.js.map

package/payload/platform/plugins/scheduling/mcp/dist/lib/connector-sync-provision.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connector-sync-provision.js","sourceRoot":"","sources":["../../src/lib/connector-sync-provision.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC3F,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,wBAAwB,EAAqB,MAAM,qBAAqB,CAAC;AA0BlF;gFACgF;AAChF,MAAM,oBAAoB,GAAmE;IAC3F,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE;IACpD,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE;CACrD,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CAAC,UAAkB;IACzD,MAAM,KAAK,GAAwB,EAAE,CAAC;IACtC,KAAK,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,oBAAoB,EAAE,CAAC;QACtD,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,GAAG,GAAG,CAAC,CAAC;QAChD,yEAAyE;QACzE,wEAAwE;QACxE,0EAA0E;QAC1E,0EAA0E;QAC1E,yEAAyE;QACzE,mBAAmB;QACnB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAC/B,IAAI,UAAoB,CAAC;QACzB,IAAI,CAAC;YACH,UAAU,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,gCAAgC,GAAG,8BAA+B,GAAa,CAAC,OAAO,EAAE,CAC1F,CAAC;QACJ,CAAC;QACD,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;AACtB,CAAC;AA2BD;yEACyE;AACzE,MAAM,kBAAkB,GAAyB;IAC/C,oBAAoB;IACpB,mBAAmB;IACnB,eAAe;IACf,gBAAgB;IAChB,iBAAiB;CAClB,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,UAAU,0BAA0B,CACxC,WAAmB,EACnB,SAAiB;IAEjB,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3F,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;QAC1E,uEAAuE;QACvE,oEAAoE;QACpE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAC5D,CAAC;IAED,MAAM,QAAQ,GAAyB,EAAE,CAAC;IAE1C,MAAM,EAAE,GAAI,MAAM,CAAC,QAAgD,IAAI,EAAE,CAAC;IAC1E,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;IACnE,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAC9D,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;QAClE,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACtG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAED,MAAM,EAAE,GAAI,MAAM,CAAC,QAAgD,IAAI,EAAE,CAAC;IAC1E,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC;YAAE,SAAS;QAClE,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;QACxE,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC/F,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAED,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,iBAAiB,CAAC;IACzF,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AACvC,CAAC;AAED;;;;uDAIuD;AACvD,SAAS,QAAQ,CACf,WAAmB,EACnB,SAAiB,EACjB,OAAqB,EACrB,WAAmB;IAEnB,IAAI,KAAkD,CAAC;IACvD,IAAI,CAAC;QACH,KAAK,GAAG,wBAAwB,CAAC,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;IACjF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IACD,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC;AAC3C,CAAC;AAoBD,8CAA8C;AAC9C,MAAM,UAAU,kBAAkB,CAAC,OAAyB,EAAE,MAAe;IAC3E,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;AAChE,CAAC;AAID;;;;;;;;;GASG;AACH,MAAM,UAAU,uBAAuB,CACrC,IAAqC,EACrC,aAAqB,EACrB,KAAa,EACb,WAAmB;IAEnB,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,IAAI,CAAC,SAAS,KAAK,aAAa;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,OAAO,GAAG,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC;IACxC,6EAA6E;IAC7E,6EAA6E;IAC7E,6EAA6E;IAC7E,0DAA0D;IAC1D,OAAO,OAAO,GAAG,CAAC,IAAI,OAAO,IAAI,WAAW,CAAC;AAC/C,CAAC;AAED;;;;4EAI4E;AAC5E,MAAM,UAAU,SAAS,CAAC,IAAqC,EAAE,aAAqB;IACpF,IAAI,CAAC,IAAI;QAAE,OAAO,OAAO,CAAC;IAC1B,OAAO,IAAI,CAAC,SAAS,KAAK,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;AACnE,CAAC;AAED;;;iDAGiD;AACjD,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,qCAAqC;IAClD,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAE,MAAyB,CAAC,CAAC,CAAC,EAAE,CAAC;IAChF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CACX,oEAAoE,IAAI,GAAG;YACzE,UAAU,IAAI,CAAC,SAAS,CAAE,GAAa,CAAC,OAAO,CAAC,qCAAqC,CACxF,CAAC;QACF,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,KAAqB;IACrE,MAAM,GAAG,GAAG,GAAG,IAAI,MAAM,CAAC;IAC1B,IAAI,CAAC;QACH,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1C,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CACX,sEAAsE,IAAI,GAAG;YAC3E,UAAU,IAAI,CAAC,SAAS,CAAE,GAAa,CAAC,OAAO,CAAC,6CAA6C,CAChG,CAAC;IACJ,CAAC;AACH,CAAC"}

package/payload/platform/plugins/scheduling/mcp/dist/lib/d1-command.d.ts

@@ -1,12 +1,84 @@
 /**
- * Build the argv for a D1 SQL read. Resolves wrangler via `npx` — the brand
- * server PATH carries no global `wrangler`, only `npx wrangler` resolves, the
- * same form the proven forward-path availability publisher uses. Keeping this
- * pure lets the argv be asserted without importing the side-effectful
- * dispatcher script (Task 1350).
+ * D1 access for booking reconcile, over Cloudflare's HTTP query API.
+ *
+ * Task 1805 — this module used to return an argv for `npx wrangler d1 execute`,
+ * which `reconcile-bookings.ts` ran through spawnSync once per SQL statement. On
+ * a four-brand laptop that was a continuous ~0.6 of a core: every statement paid
+ * a cold start of npm, then node, then wrangler's cli.js and its esbuild service.
+ * Nothing was failing; the cost was the transport choice, and it scaled with
+ * accounts x statements x tick rate. Task 1350's ENOENT finding (only `npx
+ * wrangler` resolves on the brand server PATH) is not reopened — it is retired,
+ * because no binary is resolved here at all.
+ *
+ * The two bounds the spawn carried are preserved deliberately, not incidentally:
+ * its `timeout: 60_000` becomes a request bound, and its `maxBuffer: 16MB`
+ * becomes a cap enforced *while streaming* the response. Both exist so a stalled
+ * Cloudflare cannot wedge a run that is holding the reconcile PID lock.
+ *
+ * The endpoint is keyed by database uuid but every caller holds a database name,
+ * so the client resolves name -> uuid once per run and caches it.
  */
-export declare function buildD1Command(dbName: string, sql: string): {
-    command: string;
-    args: string[];
+/** The bound each request runs under. Inherited from the spawnSync `timeout`. */
+export declare const D1_TIMEOUT_MS = 60000;
+/** The most response bytes we will read. Inherited from the spawnSync `maxBuffer`. */
+export declare const D1_RESPONSE_CAP_BYTES: number;
+export interface D1Response {
+    ok: boolean;
+    status: number;
+    /**
+     * The body as byte chunks. Deliberately not a `text()`: the cap has to be able
+     * to stop the read part-way, which is the property `maxBuffer` provided. A
+     * whole-body accessor could only check the size after paying for it.
+     */
+    chunks: AsyncIterable<Uint8Array>;
+}
+export interface D1RequestInit {
+    method: string;
+    headers: Record<string, string>;
+    body?: string;
+    signal: AbortSignal;
+}
+/** The HTTP seam. Injectable so the transport is unit-testable without a network. */
+export type D1Fetch = (url: string, init: D1RequestInit) => Promise<D1Response>;
+/** Compose the request that resolves a database name to its uuid. Pure. */
+export declare function buildD1LookupRequest(accountId: string, dbName: string, token: string): {
+    url: string;
+    init: Omit<D1RequestInit, "signal">;
 };
+/**
+ * Compose the request that runs one SQL statement. Pure.
+ *
+ * `params` binds the statement's values server-side (`?1`, `?2`, … in the SQL).
+ * The spawn this replaced had no parameter channel, so every value reached D1
+ * folded into the statement text; the HTTP API takes them separately, so the
+ * sweep's bookingId is bound rather than interpolated.
+ *
+ * Typed `string[]` because the API documents this field as an array of string.
+ * A wider type would let a caller pass a value the endpoint rejects at runtime,
+ * on a periodic path where that surfaces as a failed tick rather than a build error.
+ */
+export declare function buildD1QueryRequest(accountId: string, databaseId: string, sql: string, token: string, params?: string[]): {
+    url: string;
+    init: Omit<D1RequestInit, "signal">;
+};
+export interface D1Client {
+    /**
+     * Run one SQL statement against the named database and return its rows.
+     * Values go in `params` (`?1`, `?2`, … in the SQL), never in the statement text.
+     */
+    query(dbName: string, sql: string, params?: string[]): Promise<Record<string, unknown>[]>;
+    /** SQL statements issued so far. Name lookups are not statements and are excluded. */
+    readonly statements: number;
+    /** Total wall time spent in this client, lookups included. */
+    readonly elapsedMs: number;
+}
+/**
+ * One client per account run. It owns the name -> uuid cache, so a tick pays one
+ * lookup for its database and then issues statements against the resolved id.
+ */
+export declare function createD1Client(opts: {
+    accountId: string;
+    token: string;
+    fetchFn?: D1Fetch;
+}): D1Client;
 //# sourceMappingURL=d1-command.d.ts.map

package/payload/platform/plugins/scheduling/mcp/dist/lib/d1-command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"d1-command.d.ts","sourceRoot":"","sources":["../../src/lib/d1-command.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,GACV;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAKrC"}
+{"version":3,"file":"d1-command.d.ts","sourceRoot":"","sources":["../../src/lib/d1-command.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,iFAAiF;AACjF,eAAO,MAAM,aAAa,QAAS,CAAC;AAEpC,sFAAsF;AACtF,eAAO,MAAM,qBAAqB,QAAmB,CAAC;AAItD,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,MAAM,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,WAAW,CAAC;CACrB;AAED,qFAAqF;AACrF,MAAM,MAAM,OAAO,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;AAehF,2EAA2E;AAC3E,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GACZ;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAA;CAAE,CAMtD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,MAAM,GAAE,MAAM,EAAO,GACpB;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAA;CAAE,CAStD;AAkFD,MAAM,WAAW,QAAQ;IACvB;;;OAGG;IACH,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IAC1F,sFAAsF;IACtF,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,8DAA8D;IAC9D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,GAAG,QAAQ,CAwEX"}

package/payload/platform/plugins/scheduling/mcp/dist/lib/d1-command.js

@@ -1,14 +1,208 @@
 /**
- * Build the argv for a D1 SQL read. Resolves wrangler via `npx` — the brand
- * server PATH carries no global `wrangler`, only `npx wrangler` resolves, the
- * same form the proven forward-path availability publisher uses. Keeping this
- * pure lets the argv be asserted without importing the side-effectful
- * dispatcher script (Task 1350).
+ * D1 access for booking reconcile, over Cloudflare's HTTP query API.
+ *
+ * Task 1805 — this module used to return an argv for `npx wrangler d1 execute`,
+ * which `reconcile-bookings.ts` ran through spawnSync once per SQL statement. On
+ * a four-brand laptop that was a continuous ~0.6 of a core: every statement paid
+ * a cold start of npm, then node, then wrangler's cli.js and its esbuild service.
+ * Nothing was failing; the cost was the transport choice, and it scaled with
+ * accounts x statements x tick rate. Task 1350's ENOENT finding (only `npx
+ * wrangler` resolves on the brand server PATH) is not reopened — it is retired,
+ * because no binary is resolved here at all.
+ *
+ * The two bounds the spawn carried are preserved deliberately, not incidentally:
+ * its `timeout: 60_000` becomes a request bound, and its `maxBuffer: 16MB`
+ * becomes a cap enforced *while streaming* the response. Both exist so a stalled
+ * Cloudflare cannot wedge a run that is holding the reconcile PID lock.
+ *
+ * The endpoint is keyed by database uuid but every caller holds a database name,
+ * so the client resolves name -> uuid once per run and caches it.
  */
-export function buildD1Command(dbName, sql) {
+/** The bound each request runs under. Inherited from the spawnSync `timeout`. */
+export const D1_TIMEOUT_MS = 60_000;
+/** The most response bytes we will read. Inherited from the spawnSync `maxBuffer`. */
+export const D1_RESPONSE_CAP_BYTES = 16 * 1024 * 1024;
+const API = "https://api.cloudflare.com/client/v4";
+const defaultFetch = async (url, init) => {
+    const res = await fetch(url, init);
+    return { ok: res.ok, status: res.status, chunks: bodyChunks(res) };
+};
+async function* bodyChunks(res) {
+    // A bodyless response (204, or a HEAD-shaped reply) yields nothing. That reads
+    // as an empty body, which the envelope guard below rejects with its status —
+    // never as a silently empty row set.
+    if (!res.body)
+        return;
+    for await (const chunk of res.body)
+        yield chunk;
+}
+/** Compose the request that resolves a database name to its uuid. Pure. */
+export function buildD1LookupRequest(accountId, dbName, token) {
+    const qs = new URLSearchParams({ name: dbName });
+    return {
+        url: `${API}/accounts/${accountId}/d1/database?${qs}`,
+        init: { method: "GET", headers: { Authorization: `Bearer ${token}` } },
+    };
+}
+/**
+ * Compose the request that runs one SQL statement. Pure.
+ *
+ * `params` binds the statement's values server-side (`?1`, `?2`, … in the SQL).
+ * The spawn this replaced had no parameter channel, so every value reached D1
+ * folded into the statement text; the HTTP API takes them separately, so the
+ * sweep's bookingId is bound rather than interpolated.
+ *
+ * Typed `string[]` because the API documents this field as an array of string.
+ * A wider type would let a caller pass a value the endpoint rejects at runtime,
+ * on a periodic path where that surfaces as a failed tick rather than a build error.
+ */
+export function buildD1QueryRequest(accountId, databaseId, sql, token, params = []) {
+    return {
+        url: `${API}/accounts/${accountId}/d1/database/${databaseId}/query`,
+        init: {
+            method: "POST",
+            headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
+            body: JSON.stringify({ sql, params }),
+        },
+    };
+}
+/** Read the body, refusing to hold more than the cap. Stops mid-stream. */
+async function readCapped(chunks) {
+    const parts = [];
+    let total = 0;
+    for await (const chunk of chunks) {
+        total += chunk.byteLength;
+        if (total > D1_RESPONSE_CAP_BYTES) {
+            throw new Error(`response exceeded the ${D1_RESPONSE_CAP_BYTES}-byte cap`);
+        }
+        parts.push(chunk);
+    }
+    return Buffer.concat(parts).toString("utf-8");
+}
+/**
+ * Issue one request under the bound and return its parsed success envelope.
+ *
+ * Every failure surfaces the body it came with. A 2xx that is not a well-formed
+ * `success:true` envelope is an anomaly to report, never a silently empty result:
+ * this transport's callers read row sets, and an empty one means "no bookings".
+ */
+async function d1ApiJson(fetchFn, url, init, context) {
+    // An explicit controller rather than `AbortSignal.timeout`, for two reasons.
+    // It is cancellable, so a request that finishes early clears its timer instead
+    // of leaving a 60 s handle holding this short-lived dispatcher's event loop
+    // open past its work; and its timer is the ordinary global one, so the bound is
+    // reachable from a test rather than only from a real 60 s wall-clock wait.
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(new Error(`scheduling: ${context} timed out after ${D1_TIMEOUT_MS}ms`)), D1_TIMEOUT_MS);
+    try {
+        let res;
+        try {
+            res = await fetchFn(url, { ...init, signal: controller.signal });
+        }
+        catch (err) {
+            // The bound is load-bearing for the PID lock, so name it explicitly rather
+            // than relaying a bare DOMException the journal cannot be read for.
+            if (controller.signal.aborted) {
+                throw new Error(`scheduling: ${context} timed out after ${D1_TIMEOUT_MS}ms`);
+            }
+            throw new Error(`scheduling: ${context} failed: ${err.message}`);
+        }
+        let body;
+        try {
+            // Inside the bound deliberately: a response whose headers arrive promptly
+            // but whose body then stalls would otherwise hang here unbounded, which is
+            // the same wedge the timeout exists to prevent.
+            body = await readCapped(res.chunks);
+        }
+        catch (err) {
+            if (controller.signal.aborted) {
+                throw new Error(`scheduling: ${context} timed out after ${D1_TIMEOUT_MS}ms`);
+            }
+            // Keep the status: without it a capped error response is unattributable.
+            throw new Error(`scheduling: ${context} (status ${res.status}) ${err.message}`);
+        }
+        if (!res.ok) {
+            throw new Error(`scheduling: ${context} failed: ${res.status}\n${body}`);
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(body);
+        }
+        catch {
+            throw new Error(`scheduling: ${context} returned non-JSON: ${body}`);
+        }
+        if (parsed?.success !== true) {
+            throw new Error(`scheduling: ${context} API error: ${body}`);
+        }
+        return parsed;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/**
+ * One client per account run. It owns the name -> uuid cache, so a tick pays one
+ * lookup for its database and then issues statements against the resolved id.
+ */
+export function createD1Client(opts) {
+    const fetchFn = opts.fetchFn ?? defaultFetch;
+    const ids = new Map();
+    let statements = 0;
+    let elapsedMs = 0;
+    async function resolveId(dbName) {
+        const cached = ids.get(dbName);
+        if (cached !== undefined)
+            return cached;
+        const { url, init } = buildD1LookupRequest(opts.accountId, dbName, opts.token);
+        const parsed = (await d1ApiJson(fetchFn, url, init, "d1 database lookup"));
+        // Exact match on the name, never "the first result". `?name=` is a filter
+        // whose matching rule is not doc-confirmed; taking position on trust would
+        // let a near-name run this account's statements against the wrong database.
+        const hit = (parsed.result ?? []).find((d) => d.name === dbName);
+        if (!hit || typeof hit.uuid !== "string") {
+            throw new Error(`scheduling: no D1 database named "${dbName}" in account ${opts.accountId}`);
+        }
+        ids.set(dbName, hit.uuid);
+        return hit.uuid;
+    }
     return {
-        command: "npx",
-        args: ["wrangler", "d1", "execute", dbName, "--remote", "--json", "--command", sql],
+        async query(dbName, sql, params = []) {
+            const started = Date.now();
+            try {
+                const databaseId = await resolveId(dbName);
+                const { url, init } = buildD1QueryRequest(opts.accountId, databaseId, sql, opts.token, params);
+                // Counted before the await, not after: `statements` is what reached D1,
+                // and a statement that was issued and then errored still went. Counting
+                // successes only would report 0 both for "the lookup failed so nothing
+                // was sent" and for "one statement was sent and errored", which is
+                // exactly the distinction the op=d1 line exists to make.
+                statements++;
+                const parsed = (await d1ApiJson(fetchFn, url, init, "d1 query"));
+                // Same shape wrangler --json printed: an array of per-statement results,
+                // each carrying its own `results` row array. One statement in, so [0].
+                const first = parsed.result?.[0];
+                // The per-statement flag is authoritative *when present*. Its REST
+                // semantics are undocumented, so this refuses to let an unmeasured fact
+                // decide correctness: if a failed statement can arrive inside a
+                // success:true envelope, reading it as success would make a failed sweep
+                // look swept and leave the row behind silently. Absent is not false — an
+                // envelope that omits the flag is accepted, since requiring an
+                // undocumented field would reject healthy responses.
+                if (first?.success === false) {
+                    throw new Error(`scheduling: d1 query statement failed: ${first.error ?? JSON.stringify(first)}`);
+                }
+                return (Array.isArray(first?.results) ? first.results : []);
+            }
+            finally {
+                elapsedMs += Date.now() - started;
+            }
+        },
+        get statements() {
+            return statements;
+        },
+        get elapsedMs() {
+            return elapsedMs;
+        },
     };
 }
 //# sourceMappingURL=d1-command.js.map

package/payload/platform/plugins/scheduling/mcp/dist/lib/d1-command.js.map

@@ -1 +1 @@
-{"version":3,"file":"d1-command.js","sourceRoot":"","sources":["../../src/lib/d1-command.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAC5B,MAAc,EACd,GAAW;IAEX,OAAO;QACL,OAAO,EAAE,KAAK;QACd,IAAI,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,CAAC;KACpF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"d1-command.js","sourceRoot":"","sources":["../../src/lib/d1-command.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,iFAAiF;AACjF,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC;AAEpC,sFAAsF;AACtF,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAEtD,MAAM,GAAG,GAAG,sCAAsC,CAAC;AAuBnD,MAAM,YAAY,GAAY,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IAChD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,IAAmB,CAAC,CAAC;IAClD,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;AACrE,CAAC,CAAC;AAEF,KAAK,SAAS,CAAC,CAAC,UAAU,CAAC,GAAa;IACtC,+EAA+E;IAC/E,6EAA6E;IAC7E,qCAAqC;IACrC,IAAI,CAAC,GAAG,CAAC,IAAI;QAAE,OAAO;IACtB,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,CAAC,IAA4C;QAAE,MAAM,KAAK,CAAC;AAC1F,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,oBAAoB,CAClC,SAAiB,EACjB,MAAc,EACd,KAAa;IAEb,MAAM,EAAE,GAAG,IAAI,eAAe,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IACjD,OAAO;QACL,GAAG,EAAE,GAAG,GAAG,aAAa,SAAS,gBAAgB,EAAE,EAAE;QACrD,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,EAAE;KACvE,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CACjC,SAAiB,EACjB,UAAkB,EAClB,GAAW,EACX,KAAa,EACb,SAAmB,EAAE;IAErB,OAAO;QACL,GAAG,EAAE,GAAG,GAAG,aAAa,SAAS,gBAAgB,UAAU,QAAQ;QACnE,IAAI,EAAE;YACJ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YACjF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;SACtC;KACF,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,KAAK,UAAU,UAAU,CAAC,MAAiC;IACzD,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QACjC,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;QAC1B,IAAI,KAAK,GAAG,qBAAqB,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,yBAAyB,qBAAqB,WAAW,CAAC,CAAC;QAC7E,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,SAAS,CACtB,OAAgB,EAChB,GAAW,EACX,IAAmC,EACnC,OAAe;IAEf,6EAA6E;IAC7E,+EAA+E;IAC/E,4EAA4E;IAC5E,gFAAgF;IAChF,2EAA2E;IAC3E,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CACtB,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,eAAe,OAAO,oBAAoB,aAAa,IAAI,CAAC,CAAC,EAC9F,aAAa,CACd,CAAC;IACF,IAAI,CAAC;QACH,IAAI,GAAe,CAAC;QACpB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QACnE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,2EAA2E;YAC3E,oEAAoE;YACpE,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC9B,MAAM,IAAI,KAAK,CAAC,eAAe,OAAO,oBAAoB,aAAa,IAAI,CAAC,CAAC;YAC/E,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,eAAe,OAAO,YAAa,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,0EAA0E;YAC1E,2EAA2E;YAC3E,gDAAgD;YAChD,IAAI,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC9B,MAAM,IAAI,KAAK,CAAC,eAAe,OAAO,oBAAoB,aAAa,IAAI,CAAC,CAAC;YAC/E,CAAC;YACD,yEAAyE;YACzE,MAAM,IAAI,KAAK,CAAC,eAAe,OAAO,YAAY,GAAG,CAAC,MAAM,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,eAAe,OAAO,YAAY,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,MAAoC,CAAC;QACzC,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAiC,CAAC;QAC5D,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,eAAe,OAAO,uBAAuB,IAAI,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,MAAM,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,eAAe,OAAO,eAAe,IAAI,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAcD;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,IAI9B;IACC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,YAAY,CAAC;IAC7C,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,KAAK,UAAU,SAAS,CAAC,MAAc;QACrC,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC;QACxC,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,oBAAoB,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/E,MAAM,MAAM,GAAG,CAAC,MAAM,SAAS,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAoB,CAAC,CAExE,CAAC;QACF,0EAA0E;QAC1E,2EAA2E;QAC3E,4EAA4E;QAC5E,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;QACjE,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,qCAAqC,MAAM,gBAAgB,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1B,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC;IAED,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,EAAE;YAClC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC;gBAC3C,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,mBAAmB,CACvC,IAAI,CAAC,SAAS,EACd,UAAU,EACV,GAAG,EACH,IAAI,CAAC,KAAK,EACV,MAAM,CACP,CAAC;gBACF,wEAAwE;gBACxE,wEAAwE;gBACxE,uEAAuE;gBACvE,mEAAmE;gBACnE,yDAAyD;gBACzD,UAAU,EAAE,CAAC;gBACb,MAAM,MAAM,GAAG,CAAC,MAAM,SAAS,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,UAAU,CAAC,CAE9D,CAAC;gBACF,yEAAyE;gBACzE,uEAAuE;gBACvE,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;gBACjC,mEAAmE;gBACnE,wEAAwE;gBACxE,gEAAgE;gBAChE,yEAAyE;gBACzE,yEAAyE;gBACzE,+DAA+D;gBAC/D,qDAAqD;gBACrD,IAAI,KAAK,EAAE,OAAO,KAAK,KAAK,EAAE,CAAC;oBAC7B,MAAM,IAAI,KAAK,CACb,0CAA0C,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CACjF,CAAC;gBACJ,CAAC;gBACD,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAA8B,CAAC;YAC3F,CAAC;oBAAS,CAAC;gBACT,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;YACpC,CAAC;QACH,CAAC;QACD,IAAI,UAAU;YACZ,OAAO,UAAU,CAAC;QACpB,CAAC;QACD,IAAI,SAAS;YACX,OAAO,SAAS,CAAC;QACnB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/payload/platform/plugins/scheduling/mcp/dist/scripts/reconcile-bookings.d.ts

@@ -1,11 +1,13 @@
 /**
  * Dispatcher script: reconcile-bookings
  *
- * Self-contained, like check-due-events. Pulls accepted booking rows from each
+ * Self-contained, like check-due-events. Pulls eligible booking rows from each
  * account's Cloudflare D1 `bookings` table (written by the booking site's Pages
- * Function), writes each into Neo4j as a :Meeting so it appears on the admin
- * calendar, links the booker as a :Person, and notifies the admin. Marks each
- * row swept so it reconciles exactly once. Ends with the standing audit.
+ * Function), claims the ones with no :Meeting in the graph, writes each into
+ * Neo4j as a :Meeting so it appears on the admin calendar, links the booker as
+ * a :Person, and notifies the admin. A row is claimed on the absence of its
+ * meeting, not on a flag, so a meeting that later goes missing self-heals.
+ * Ends with the standing audit over that same population.
  *
  * Task 1654 — for each booking-site account it also create-only provisions the
  * recurring connector-sync :Event (the admin turn that reads the calendar connector

package/payload/platform/plugins/scheduling/mcp/dist/scripts/reconcile-bookings.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reconcile-bookings.d.ts","sourceRoot":"","sources":["../../src/scripts/reconcile-bookings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG"}
+{"version":3,"file":"reconcile-bookings.d.ts","sourceRoot":"","sources":["../../src/scripts/reconcile-bookings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG"}