@ultimat3/jobs 11.3.0 → 13.0.0

package/src/export-pass.ts

@@ -0,0 +1,178 @@
+// One `exportRows()` pass: the iteration, its durable checkpoints, and the manifest that closes
+// the artifact. Split out of `export.ts` for the reason `backfill-pass.ts` is split out of
+// `backfill.ts` — that file declares an export, this one runs it.
+//
+// THE PAGING IS `backfill-pass.ts`'s, not a second idiom. `inBatches()` reads the source one
+// statement per page, each page runs inside its own `step.run`, and what a step persists is the
+// CURSOR and two counters, never the page: `steps.ts` hands a completed step's output back for the
+// whole run, so checkpointing rows would retain every row already exported until the job ended —
+// which is the leak that turns an export of a large table into an OOM.
+//
+// THE PART KEY IS WHAT MAKES AT-LEAST-ONCE SAFE. A page is named by its INDEX, so a page that ran
+// twice rewrites the same object with the same bytes. There is no idempotency argument to make
+// about the app's rows and no append anywhere, because a duplicate part cannot be expressed.
+
+import { assert, logger } from '@ultimat3/core';
+import type { BatchIterator } from '@ultimat3/entity';
+import { JobAbortedError } from './errors';
+import type { ExportPlan, ExportReport } from './export';
+import { ExportPartTooLargeError } from './export-errors';
+import { encodeExportPage } from './export-format';
+import type { ExportManifest } from './export-sink';
+import { exportManifestKey, exportPartKey } from './export-sink';
+import type { JobRunArgs } from './job';
+
+/** Every page is a step, and this is the name it is checkpointed under. */
+const STEP_PREFIX = 'page:';
+/** The manifest is a step too, so a retry after a written manifest does not write a second one. */
+const MANIFEST_STEP = 'manifest';
+
+/** What a page persists: a bounded position and two counters. Never the page. See the header. */
+interface Checkpoint {
+  /** Where the next page starts; `null` once the source is exhausted. */
+  readonly cursor: string | null;
+  readonly rows: number;
+  readonly bytes: number;
+}
+
+interface Iteration<Row> {
+  readonly batches: BatchIterator<Row>;
+  readonly pull: AsyncIterator<readonly Row[]>;
+}
+
+const fieldOf = (value: unknown, key: string): unknown =>
+  typeof value === 'object' && value !== null ? (value as Record<string, unknown>)[key] : undefined;
+
+/**
+ * `steps.ts` hands a completed step's output back through an unchecked `as T`, so a checkpoint READ
+ * from storage is this shape by claim and never by check. Checked here because the failure is
+ * silent and expensive in both directions: an absent cursor is not `null`, so the loop would reopen
+ * the source at the top and export the whole table a second time into part 0 onward.
+ */
+function asCheckpoint(value: unknown, step: string): Checkpoint {
+  const cursor = fieldOf(value, 'cursor');
+  const rows = fieldOf(value, 'rows');
+  const bytes = fieldOf(value, 'bytes');
+  assert(
+    (cursor === null || typeof cursor === 'string') &&
+      typeof rows === 'number' &&
+      typeof bytes === 'number',
+    `step "${step}" replayed ${JSON.stringify(value)}, which is not an export checkpoint`,
+    `x jobs show <jobId> --json prints the run's steps — a run id whose "${step}" was written by something other than this export has to be retired, not resumed`,
+  );
+  return { cursor, rows, bytes };
+}
+
+export async function exportPass<Row, I>(
+  plan: ExportPlan<Row, I>,
+  args: JobRunArgs<I>,
+): Promise<ExportReport> {
+  const { definition, size, maxPartBytes, pace } = plan;
+  const { step, runId, input, ctx } = args;
+  const name = definition.name;
+  const prefix = definition.prefix(input);
+  assert(
+    prefix.length > 0 && !prefix.startsWith('/') && !prefix.includes('..'),
+    `export "${name}" prefix() answered "${prefix}", which is not a key prefix`,
+    `return a relative, non-empty prefix from prefix() on exportRows("${name}") — "exports/<orgId>/<exportId>" is the shape, and a leading slash or a ".." reaches keys this export does not own`,
+  );
+
+  let cursor: string | null = null;
+  let rows = 0;
+  let bytes = 0;
+  let parts = 0;
+  let live: Iteration<Row> | undefined;
+
+  /**
+   * The iteration positioned at `cursor`, opened on the first page this attempt actually runs, so a
+   * resumed pass sends no statement for a page it already wrote. `batches.cursor` IS where the next
+   * statement starts, so comparing it with the checkpoint's is the whole staleness test.
+   */
+  const iterate = async (): Promise<Iteration<Row>> => {
+    if (live !== undefined && live.batches.cursor === cursor) return live;
+    await live?.batches.close();
+    const opened = definition.source({ input, ctx }).after(cursor).inBatches(size);
+    live = { batches: opened, pull: opened[Symbol.asyncIterator]() };
+    return live;
+  };
+
+  try {
+    for (let index = 0; ; index += 1) {
+      const stepName = `${STEP_PREFIX}${index}`;
+      const checkpoint = asCheckpoint(
+        await step.run(stepName, async (signal): Promise<Checkpoint> => {
+          // INSIDE the body, which is the whole of it: a completed step is served from storage
+          // without its body running, so an attempt resuming at page 500 replays 500 checkpoints
+          // and pays none of their pauses.
+          await pace?.wait({ signal, step: stepName });
+          const iteration = await iterate();
+          const next = await iteration.pull.next();
+          if (next.done === true) return { cursor: null, rows: 0, bytes: 0 };
+          const body = encodeExportPage({
+            subject: name,
+            format: definition.format,
+            columns: definition.columns,
+            records: next.value.map((record) => definition.row(record)),
+            // Part 0 only: the header belongs in the file once, and every line in both formats
+            // ends in a newline, so the parts concatenate into one valid file.
+            header: index === 0,
+          });
+          if (body.byteLength > maxPartBytes) {
+            throw new ExportPartTooLargeError({
+              export: name,
+              part: index,
+              bytes: body.byteLength,
+              maxBytes: maxPartBytes,
+            });
+          }
+          // Asked before the write and not only before the read: past the deadline this attempt no
+          // longer owns the run, and `steps.ts` would refuse the checkpoint anyway — so a `put`
+          // here is an object written by a worker whose successor is already re-running the page.
+          if (signal.aborted) throw new JobAbortedError({ job: name, step: stepName });
+          await definition.sink.put(exportPartKey(prefix, index, definition.format), body);
+          return {
+            cursor: iteration.batches.cursor,
+            rows: next.value.length,
+            bytes: body.byteLength,
+          };
+        }),
+        stepName,
+      );
+      rows += checkpoint.rows;
+      bytes += checkpoint.bytes;
+      cursor = checkpoint.cursor;
+      // `inBatches()` never yields an empty page, so `rows` is what tells a written part from the
+      // one step an exhausted source costs.
+      if (checkpoint.rows > 0) parts += 1;
+      if (cursor === null) break;
+    }
+  } finally {
+    // Whatever the iteration holds belongs to this attempt, and an attempt that failed, was
+    // cancelled or finished is done with it either way.
+    await live?.batches.close();
+  }
+
+  const manifestKey = exportManifestKey(prefix);
+  // A step of its own, so a retry after the manifest landed does not write a second one — and so
+  // that "the artifact is closed" is a checkpoint like every other fact this pass records.
+  await step.run(MANIFEST_STEP, async (): Promise<null> => {
+    const manifest: ExportManifest = {
+      export: name,
+      runId,
+      prefix,
+      format: definition.format,
+      columns: [...definition.columns],
+      parts,
+      rows,
+      bytes,
+      // `toISOString()` is UTC by definition and carries its zone in the string — the one date in
+      // this framework that needs no `timeZone` argument, because it names no locale's calendar.
+      completedAt: new Date(plan.nowMs()).toISOString(),
+    };
+    await definition.sink.put(manifestKey, new TextEncoder().encode(JSON.stringify(manifest)));
+    return null;
+  });
+
+  logger.info('jobs.export.completed', { export: name, prefix, parts, rows, bytes });
+  return { name, prefix, manifestKey, parts, rows, bytes };
+}

package/src/export-sink.ts

@@ -0,0 +1,105 @@
+// Where an export's bytes land, and what the artifact says about itself when it is finished.
+//
+// A SEAM and not a `@ultimat3/storage` import, for the reason `PurgeTarget` is one: this package
+// holds no storage dependency, and taking one so a queue could name a disk would put the object
+// store on tier 3's import graph. A `StorageDriver` satisfies this by having the method it already
+// has — `put(key, body, options?)` with a `Uint8Array` as a legal `StorageBody`
+// (`packages/storage/src/driver.ts:117`) — so `disk('exports')` IS an `ExportSink`.
+
+import { assert } from '@ultimat3/core';
+import type { ExportFormat } from './export-format';
+import { EXPORT_EXTENSION } from './export-format';
+
+/**
+ * One object, written whole.
+ *
+ * ONE OBJECT PER PAGE is the design, not a simplification. `put()` buffers by construction — its
+ * own header says the server-side path "is for objects that FIT IN MEMORY" — so an export that
+ * wrote one object would hold the entire dataset, which is the exact failure this factory exists
+ * to prevent. A page is bounded, so a page-sized object is bounded, and the artifact is the parts
+ * concatenated: both formats end every line in a newline so that concatenation is a valid file.
+ *
+ * It is also what makes at-least-once SAFE here. The key is derived from the page INDEX, so a
+ * replayed page rewrites the same key with the same bytes — an overwrite, never an append. No
+ * idempotency argument is needed about the app's rows, because a duplicate part is impossible to
+ * express.
+ */
+export interface ExportSink {
+  /**
+   * `Promise<unknown>`, never `Promise<void>`. `StorageDriver.put` answers
+   * `Promise<StorageObject>` (`packages/storage/src/driver.ts:117`), and a `Promise<void>` return
+   * makes it **not assignable** — so this file's own header, `export.ts` and the README all claimed
+   * `disk('exports')` IS an `ExportSink` while the type refused the assignment. Measured:
+   * `TS2322: Type 'Promise<StorageObject>' is not assignable to type 'Promise<void>'`.
+   *
+   * The pass discards the answer either way; `unknown` is what says so without forbidding a driver
+   * from returning one. `scripts/export-sink.test.ts` compiles the assignment, because three
+   * comments asserting it and nothing checking it is what let this ship.
+   */
+  put(key: string, body: Uint8Array): Promise<unknown>;
+}
+
+/** Zero-padded so a lexical listing of the parts is their order. */
+export const EXPORT_PART_DIGITS = 5;
+
+export const exportPartKey = (prefix: string, index: number, format: ExportFormat): string =>
+  `${prefix}/part-${String(index).padStart(EXPORT_PART_DIGITS, '0')}.${EXPORT_EXTENSION[format]}`;
+
+export const exportManifestKey = (prefix: string): string => `${prefix}/manifest.json`;
+
+/**
+ * What the artifact says about itself. A COUNT of parts and never a list of them: the keys are
+ * derived from the index, so `exportPartKey(prefix, i, format)` rebuilds every one — and a list
+ * would be the one thing in this whole pass that grows with the size of the export.
+ */
+export interface ExportManifest {
+  readonly export: string;
+  readonly runId: string;
+  readonly prefix: string;
+  readonly format: ExportFormat;
+  readonly columns: readonly string[];
+  readonly parts: number;
+  readonly rows: number;
+  readonly bytes: number;
+  /** ISO 8601, UTC. The one instant an export has, and it is not a date anybody formats. */
+  readonly completedAt: string;
+}
+
+export interface MemoryExportSink extends ExportSink {
+  /** Key -> the bytes last written under it. A rewritten part replaces, exactly as S3 would. */
+  objects(): ReadonlyMap<string, Uint8Array>;
+  /** Every `put` in order, key and length — a rewrite appears twice, which is what proves replay. */
+  writes(): readonly { readonly key: string; readonly bytes: number }[];
+  reset(): void;
+}
+
+/**
+ * The dev and test sink, and honest about being one: one heap, nothing survives a restart. It is
+ * deliberately UNBOUNDED, unlike `memoryWebhookLedger`'s ring — a sink that silently dropped parts
+ * would make a test of "the artifact is complete" pass over an artifact that is not.
+ */
+export function memoryExportSink(
+  options: { readonly onPut?: (key: string, body: Uint8Array) => void } = {},
+): MemoryExportSink {
+  const objects = new Map<string, Uint8Array>();
+  const writes: { key: string; bytes: number }[] = [];
+  return {
+    put(key: string, body: Uint8Array): Promise<void> {
+      assert(
+        key.length > 0,
+        'an export sink was handed an empty key',
+        'return a non-empty prefix from prefix() on the exportRows() declaration',
+      );
+      options.onPut?.(key, body);
+      objects.set(key, body);
+      writes.push({ key, bytes: body.byteLength });
+      return Promise.resolve();
+    },
+    objects: (): ReadonlyMap<string, Uint8Array> => new Map(objects),
+    writes: (): readonly { readonly key: string; readonly bytes: number }[] => [...writes],
+    reset(): void {
+      objects.clear();
+      writes.length = 0;
+    },
+  };
+}

package/src/export.ts

@@ -0,0 +1,187 @@
+// `exportRows()` — a paged read streamed to object storage with a resumable cursor, declared as a
+// `job` and NOT as a ninth primitive. An export is durable background work with an input schema, a
+// retry policy, an idempotency key and a queue, which is the definition of a `job` — so this file
+// is a FACTORY over `job()`, exactly as `backfill()`, `purge()` and `webhook()` are and as `llm()`
+// is over `action()`. That is what gives an export `.enqueue()`, the worker's cancellation, the
+// dead-letter path, `x jobs show` and a manifest row without a line here.
+//
+// WHY IT IS THE FRAMEWORK'S: the memory bound. Accumulating a result set before writing it is the
+// failure this exists to prevent, and it is the failure every hand-rolled exporter starts with —
+// `const all = await repo.all(); await disk.put(key, csv(all))` works on the developer's 200 rows
+// and OOM-kills the pod on the customer's two million. What ships is the paging, the checkpoint,
+// the one-object-per-page artifact and the csv the reviewer's spreadsheet will not execute. What
+// never ships is which columns leave the building, or who may ask for them.
+//
+// The declaration lives here and the pass lives in `export-pass.ts` — the same split `backfill.ts`
+// and `backfill-pass.ts` already have.
+
+import type { Clock, Ctx } from '@ultimat3/core';
+import { assert, systemClock } from '@ultimat3/core';
+import type { ReadBuilder } from '@ultimat3/entity';
+import type { StandardSchemaV1 } from '@ultimat3/schema';
+import type { Pacer } from './backfill-rate';
+import { createPacer } from './backfill-rate';
+import type { DurationInput } from './clock';
+import { nowMs } from './clock';
+import type { ExportFormat, ExportRecord } from './export-format';
+import { EXPORT_FORMATS } from './export-format';
+import { exportPass } from './export-pass';
+import type { ExportSink } from './export-sink';
+import type { JobHandle } from './job';
+import { job } from './job';
+import type { RetryPolicy } from './retry';
+import { DEFAULT_RETRY } from './retry';
+import type { JobTenant } from './tenant';
+
+/**
+ * Rows per statement, per durable step and per part. The same reasoning `DEFAULT_BACKFILL_BATCH`
+ * carries: one statement's worth of work a worker can finish inside a lease. Smaller than a
+ * backfill's because every page here is also an OBJECT — a page is encoded whole before it is
+ * written, so the page size is the heap bound as well as the statement size.
+ */
+export const DEFAULT_EXPORT_BATCH = 500;
+
+/**
+ * The largest a single part may encode to. A heap bound, not a file-size preference: a page of 500
+ * rows that are each 2 KB is a megabyte held at once, and a row that is a megabyte of JSON turns
+ * the same page into half a gigabyte. Past it the pass refuses (`X_EXPORT_PART_TOO_LARGE`) instead
+ * of finding out on a pod with a memory limit.
+ */
+export const DEFAULT_EXPORT_MAX_PART_BYTES = 8 * 1_024 * 1_024;
+
+export interface ExportDefinition<Row, I> {
+  /**
+   * REQUIRED, unlike a job's. An export's name is a durable key — the queue row, the step trace and
+   * every part's own step all carry it — so it is never left to whichever export name a module used.
+   */
+  readonly name: string;
+  /**
+   * The payload, declared by the APP. Unlike `backfill()`, which takes no parameters, an export is
+   * always an export OF something: an org, a date range, a saved filter. A pointer, never a record
+   * — what to read is resolved from the app's own tables inside `source`.
+   */
+  readonly input: StandardSchemaV1<unknown, I>;
+  /**
+   * REQUIRED, exactly as on `job()`, and the security boundary of this whole feature: an export
+   * concentrates a tenant's rows into ONE downloadable object, so a pass that runs under the wrong
+   * org is the worst shape a cross-tenant read can take.
+   *
+   * `tenant: 'none'` STRIPS the org and every tenant-scoped read inside the pass then fails closed
+   * with `X_TENANCY_ACTOR_ORG_REQUIRED` — which is correct and is deliberately NOT relaxed.
+   * `backfill()` gets a cross-tenant scope opened for it (`backfill-scope.ts`) because its lazy
+   * chain leaves an author nothing to wrap; an export gets no such grant, and the difference is
+   * the direction of the data. A sweep that rewrites every tenant's rows is an operator action
+   * with an audit trail; an export that READS every tenant's rows writes them into one artifact
+   * somebody can download. Use `'none'` for a table that has no tenant column at all.
+   */
+  readonly tenant: JobTenant<I>;
+  /**
+   * The rows to export, as a chain: `({ input }) => db.orders.where({ orgId: input.orgId })`. Read
+   * once per attempt and never enqueued, so what a run exports cannot drift from what was declared.
+   * `orderBy` is optional — the driver's own total order ends in the primary key, which is what
+   * lets every page resume from the last one's cursor.
+   */
+  source(args: { readonly input: I; readonly ctx: Ctx }): ReadBuilder<Row>;
+  /** The artifact's key prefix: `<prefix>/part-00000.csv`, `<prefix>/manifest.json`. */
+  prefix(input: I): string;
+  readonly format: ExportFormat;
+  /**
+   * The columns, in order, and the app's alone. Both encoders project through this list, so a
+   * `row()` answering a key it does not carry is refused rather than dropped — which is what stops
+   * `row: (r) => ({ ...r })` shipping every column the entity gains from the next migration on.
+   */
+  readonly columns: readonly string[];
+  /** One row -> its cells. Where a date gets its explicit zone and a Money its currency. */
+  row(record: Row): ExportRecord;
+  /** Where the parts land. A `StorageDriver` satisfies this by having the method it already has. */
+  readonly sink: ExportSink;
+  /** Rows per statement, per step and per part. Defaults to `DEFAULT_EXPORT_BATCH`. */
+  readonly batch?: number;
+  /** Defaults to `DEFAULT_EXPORT_MAX_PART_BYTES`. */
+  readonly maxPartBytes?: number;
+  /**
+   * Pages per second. NO DEFAULT, which is where an export differs from a backfill: that one
+   * throttles by default because it competes for WRITE capacity on the rows the app is still
+   * serving, and this is a bounded read somebody is usually waiting for. Declare it for an export
+   * big enough to matter to the pool; there is no way to spell "unthrottled" except by omitting it.
+   */
+  readonly rate?: number;
+  /** The clock the manifest's `completedAt` and the pacer are read from. */
+  readonly clock?: Clock;
+  readonly queue?: string;
+  readonly retry?: RetryPolicy;
+  /** Per attempt, not per pass: a resumed attempt picks up at the last checkpoint. */
+  readonly timeout?: DurationInput;
+}
+
+/** What one completed pass reports — bounded, so `x jobs show` can print it. */
+export interface ExportReport {
+  readonly name: string;
+  readonly prefix: string;
+  readonly manifestKey: string;
+  readonly parts: number;
+  readonly rows: number;
+  readonly bytes: number;
+}
+
+/** Everything fixed at declaration, validated and built once. Read by `exportPass`. */
+export interface ExportPlan<Row, I> {
+  readonly definition: ExportDefinition<Row, I>;
+  readonly size: number;
+  readonly maxPartBytes: number;
+  /** Absent unless a `rate` was declared — see `ExportDefinition.rate`. */
+  readonly pace: Pacer | undefined;
+  nowMs(): number;
+}
+
+export function exportRows<Row, I>(definition: ExportDefinition<Row, I>): JobHandle<I> {
+  const size = definition.batch ?? DEFAULT_EXPORT_BATCH;
+  // Refused where it was written. `inBatches()` refuses the same number one statement in, which for
+  // an export means a dead-lettered job and a stack trace instead of a failing build.
+  assert(
+    Number.isSafeInteger(size) && size >= 1,
+    `export "${definition.name}" declares batch: ${String(size)} — a batch is a whole number of rows, at least one`,
+    `set batch: ${DEFAULT_EXPORT_BATCH} on exportRows("${definition.name}") — the rows one statement reads, one step checkpoints and one part holds`,
+  );
+  const maxPartBytes = definition.maxPartBytes ?? DEFAULT_EXPORT_MAX_PART_BYTES;
+  assert(
+    Number.isSafeInteger(maxPartBytes) && maxPartBytes >= 1,
+    `export "${definition.name}" declares maxPartBytes: ${String(maxPartBytes)}, which no part can fit in`,
+    `set maxPartBytes: ${DEFAULT_EXPORT_MAX_PART_BYTES} on exportRows("${definition.name}"), or leave it out — the number is the heap one page may occupy`,
+  );
+  assert(
+    (EXPORT_FORMATS as readonly string[]).includes(definition.format),
+    `export "${definition.name}" declares format: ${String(definition.format)}`,
+    `set format to one of ${EXPORT_FORMATS.join(' | ')} on exportRows("${definition.name}")`,
+  );
+  // A column list nothing can be projected through is an artifact with no data in it, and both
+  // encoders would happily write one — an empty csv row per source row, forever.
+  assert(
+    definition.columns.length > 0 && new Set(definition.columns).size === definition.columns.length,
+    `export "${definition.name}" declares ${definition.columns.length} column(s) and ${new Set(definition.columns).size} distinct one(s)`,
+    `declare at least one column on exportRows("${definition.name}") and no duplicates — the list is the csv header and the ndjson key order, and a repeat writes the same cell twice`,
+  );
+  const clock = definition.clock ?? systemClock;
+  // Built at declaration for the reason `backfill()` builds its own there: the interval belongs to
+  // the table and the pool, not to whichever attempt holds the run.
+  const pace =
+    definition.rate === undefined
+      ? undefined
+      : createPacer({ rate: definition.rate, job: definition.name, clock });
+
+  return job<I>({
+    name: definition.name,
+    input: definition.input,
+    // ONE live pass per artifact, derived rather than declared: two runs writing the same prefix
+    // race over every part key, and the loser's bytes win half the objects. It is also why there is
+    // no `idempotencyKey` on this declaration — a second spelling of "which artifact is this" is a
+    // second answer to the question the key exists to settle.
+    idempotencyKey: (input) => `${definition.name}:${definition.prefix(input)}`,
+    tenant: definition.tenant,
+    retry: definition.retry ?? DEFAULT_RETRY,
+    ...(definition.queue === undefined ? {} : { queue: definition.queue }),
+    ...(definition.timeout === undefined ? {} : { timeout: definition.timeout }),
+    run: (args) =>
+      exportPass<Row, I>({ definition, size, maxPartBytes, pace, nowMs: () => nowMs(clock) }, args),
+  });
+}

package/src/index.ts

@@ -7,6 +7,23 @@
 // bypasses `defineApi`'s own result — the ambiguity axiom 1 exists to refuse.
 import './register';
 
+// The wire format, RE-EXPORTED from `@ultimat3/core` and never re-declared: it is one module at
+// the tier both halves can reach, because this package signs a delivery, `@ultimat3/http` verifies
+// one, and neither may import the other. Re-exported here so a `job` file needs one import rather
+// than two — the same reason `t` is re-exported above.
+export type { WebhookMacInput, WebhookSigningInput } from '@ultimat3/core';
+export {
+  isCanonicalWebhookField,
+  WEBHOOK_FIELD_MAX,
+  WEBHOOK_ID_HEADER,
+  WEBHOOK_SIGNATURE_HEADER,
+  WEBHOOK_SIGNATURE_VERSION,
+  WEBHOOK_TOPIC_HEADER,
+  webhookHeaders,
+  webhookMac,
+  webhookSignature,
+  webhookSigningString,
+} from '@ultimat3/core';
 /** Re-exported so a `job`/`task` file needs one import, not two. Same object as schema's. */
 export type { Infer } from '@ultimat3/schema';
 export { t } from '@ultimat3/schema';
@@ -84,6 +101,7 @@ export type {
   QueueStats,
 } from './driver';
 export {
+  assertClaimQueues,
   DEFAULT_QUEUE,
   DEFAULT_VISIBILITY_TIMEOUT_MS,
   isJobState,
@@ -134,6 +152,7 @@ export type { JobErrorCode } from './errors';
 export {
   ActionJobUnbridgedError,
   CancelUnsupportedError,
+  ClaimQueuesEmptyError,
   ConcurrencyUnenforceableError,
   DriverUnavailableError,
   IdempotencyRequiredError,
@@ -159,6 +178,18 @@ export type { PgEventBusOptions } from './events-pg';
 export { createPgEventBus } from './events-pg';
 export type { ExecuteJobOptions, JobExecution, JobOutcome } from './execute';
 export { executeJob } from './execute';
+export type { ExportDefinition, ExportReport } from './export';
+export { DEFAULT_EXPORT_BATCH, DEFAULT_EXPORT_MAX_PART_BYTES, exportRows } from './export';
+export { ExportPartTooLargeError, ExportRowInvalidError } from './export-errors';
+export type { EncodePageInput, ExportFormat, ExportRecord, ExportValue } from './export-format';
+export { csvHeader, EXPORT_EXTENSION, EXPORT_FORMATS, encodeExportPage } from './export-format';
+export type { ExportManifest, ExportSink, MemoryExportSink } from './export-sink';
+export {
+  EXPORT_PART_DIGITS,
+  exportManifestKey,
+  exportPartKey,
+  memoryExportSink,
+} from './export-sink';
 export type {
   DeadLetterEntry,
   JobsManifest,
@@ -220,7 +251,6 @@ export {
 export { DEFAULT_OUTBOX_CLAIM_LEASE_MS } from './outbox-lease';
 export type { PgOutboxOptions } from './outbox-pg';
 export { createPgOutboxStore } from './outbox-pg';
-
 export type {
   PurgeDefinition,
   PurgeInput,
@@ -285,5 +315,26 @@ export { getTask, isTaskHandle, registeredTasks, resetTasks, task } from './task
  * "whose tenant is this", which is the thing this declaration exists to make singular.
  */
 export type { JobTenant } from './tenant';
+export type {
+  WebhookDefinition,
+  WebhookDeliveryInput,
+  WebhookEndpoint,
+  WebhookEvent,
+  WebhookFetch,
+  WebhookReport,
+} from './webhook';
+export { DEFAULT_WEBHOOK_DISABLE_AFTER, WEBHOOK_CONTENT_TYPE, webhook } from './webhook';
+export {
+  WebhookDeliveryFailedError,
+  WebhookDeliveryRejectedError,
+  WebhookDeliveryThrottledError,
+  WebhookEndpointDisabledError,
+  WebhookEndpointInvalidError,
+  WebhookEndpointUnknownError,
+  WebhookEventInvalidError,
+  WebhookEventUnknownError,
+} from './webhook-errors';
+export type { MemoryWebhookLedger, WebhookAttempt, WebhookLedger } from './webhook-ledger';
+export { DEFAULT_MAX_WEBHOOK_ATTEMPTS, memoryWebhookLedger } from './webhook-ledger';
 export type { Worker, WorkerOptions, WorkerStats } from './worker';
 export { createWorker } from './worker';