@unbrained/pm-web 2026.9.26 → 2026.10.5

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 2026.10.5 - 2026-10-05
+
+### Fixed
+
+- Two limiters counted one request twice, halving every published budget on the affected routes ([pm-web-s552](https://github.com/unbraind/pm-web/blob/main/.agents/pm/issues/pm-web-s552.toon))
+
+### Security
+
+- The per-IP rate limiter trusted a client-supplied forwarded address by default, so any caller could rotate a header to a fresh bucket ([pm-web-25nv](https://github.com/unbraind/pm-web/blob/main/.agents/pm/issues/pm-web-25nv.toon))
+- Offline mutation queue is not bound to the originating account or idempotency key ([pm-web-ccie](https://github.com/unbraind/pm-web/blob/main/.agents/pm/issues/pm-web-ccie.toon))
+
+### Other
+
+- Auto-merge green Dependabot updates and group the pm toolchain into one daily PR ([pm-web-56no](https://github.com/unbraind/pm-web/blob/main/.agents/pm/tasks/pm-web-56no.toon))
+
 ## 2026.9.26 - 2026-09-26
 
 ### Other

package/README.md

@@ -301,3 +301,66 @@ itself lists each affected stream in its output; `pm history --verify <id>` spot
 content, so `reconcile` only re-greens the hash chain (no data loss) — see the authoritative
 [pm-cli merge-safety guide](https://github.com/unbraind/pm-cli/blob/main/docs/MERGE_SAFETY.md). The
 older blunt `pm history-repair --all` remains available as a lower-level primitive.
+
+
+### Offline mutation identity and recovery
+
+Each service-worker write outside `/api/auth` gets an `Idempotency-Key` and
+captures its originating account before its first network attempt. If that
+response is lost, the queued record keeps the same key, body and account.
+Every replay sends `X-PM-Expected-Account`; the server refuses a different or
+missing account with 409 before executing or claiming a key, and the worker
+keeps the record. The session is resent when a worker first controls the page or changes;
+session writes and explicit adoption extend the worker event lifetime.
+
+The SPA displays blocked offline records. For unknown-owner records, the
+signed-in user may click **These changes are mine — adopt for my signed-in
+account** after reviewing the listed paths. The recovery message carries the
+approving account and adoption verifies it against the current server session.
+Adoption and flush share one operation chain. Adoption reads and updates
+ownership in one IndexedDB transaction, preserves any existing key and assigns
+only missing keys, then retries the queue.
+Records owned by another account remain blocked until that account signs in.
+Auth routes always use live responses and are never keyed or queued; legacy
+auth records remain blocked. Deleted or unknown token accounts bypass keying
+and receive the route's normal authentication outcome. Retention cleanup runs
+before key claims so a cleanup failure leaves the request retryable.
+
+API rate limits apply before idempotency, including to replay attempts. Explicit
+pre-mutation refusals (425 and 429) release the intent and are never replayed.
+Handlers may call `markIdempotencyPreCommitFailure` only when they can prove
+no mutation committed. Group creation does so on connection acquisition failure
+or a successful rollback before any COMMIT attempt. A later rollback cannot
+prove that an attempted COMMIT failed. Proven pre-commit 5xx failures release
+the claim, allowing the same key to retry. Every other 5xx and premature response
+close settles into terminal `outcome_unknown`, returning 409 with
+`PM_IDEMPOTENCY_OUTCOME_UNKNOWN` on retries without re-executing. Live duplicates
+wait up to `PM_WEB_IDEMPOTENCY_WAIT_MS` (default 30 seconds), then receive 409
+with `PM_IDEMPOTENCY_IN_FLIGHT`. After `PM_WEB_IDEMPOTENCY_PENDING_TIMEOUT_MS`
+(default five minutes), pending rows settle as unknown on duplicate lookup or
+the next retention sweep, including intents stranded by process termination.
+Outcome persistence failures are caught and logged without request contents.
+
+The worker durably marks unknown outcomes and three consecutive 5xx responses
+as **needs attention**, then stops automatic attempts for that record. Replays
+preserve FIFO within each owner's workspace; later records in other workspaces
+may continue. Paths under `/projects/<id>/` define a workspace, including legacy
+records. Account-level paths are barriers: they wait for earlier unresolved
+owned work and block all later owned work until resolved. Other accounts have
+separate ordering. Network or local persistence failures stop the flush.
+
+The recovery notice offers the originating owner **Retry as a new request**
+and **Discard**. Retrying requires a confirmation that the original might
+already have committed; it assigns a fresh key at the same queue position,
+then resumes ordered replay. Each new request is deduplicated separately:
+the user's approved retry can duplicate an unknown original commit. Discard
+removes only the queued record and does not undo any server commit. Recovery
+verifies the approving account against the server and updates IndexedDB in a
+single transaction. The keyboard-accessible **Dismiss** control hides the
+notice until the blocked record set changes; dismissing preserves all records.
+
+Completed responses and terminal unknown outcomes are retained for
+`PM_WEB_IDEMPOTENCY_RETENTION_MS` (default seven days) from settlement.
+Deduplication is bounded by that window; a retry after expiry may execute again.
+Cleanup uses a partial `updated_at` index and runs at most once per minute per
+guard instance. Pending intents are settled before retention can remove them.

package/dist/app.js

@@ -15,6 +15,7 @@ import { githubRouter } from "./routes/github.js";
 import { adminRouter } from "./routes/admin.js";
 import { createTierLimiters, resolveTrustProxy } from "./rate-limit.js";
 import { csrfProtection } from "./csrf.js";
+import { idempotencyGuard } from "./idempotency.js";
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const PUBLIC_DIR = path.resolve(__dirname, "..", "public");
 /**
@@ -215,18 +216,20 @@ export function createApp(deps) {
     // /api/projects/... request matched the /api/projects prefix before its own
     // nested mount. Each shared prefix therefore carries its limiters once, and
     // the routers mount behind them.
-    app.use("/api/auth", limiters.auth);
+    // Charge every attempt (including replays) before touching the idempotency store.
+    const keyedWrites = idempotencyGuard();
+    app.use("/api/auth", limiters.auth, keyedWrites);
     app.use("/api/auth", oidcRouter);
     app.use("/api/auth", authRouter);
-    app.use("/api/projects", limiters.read, limiters.write);
+    app.use("/api/projects", limiters.read, limiters.write, keyedWrites);
     app.use("/api/projects", projectsRouter);
     app.use("/api/projects/:projectId/pm", pmRouter);
     app.use("/api/projects/:projectId/extensions", extensionsRouter);
     app.use("/api/projects/:id/shares", sharesRouter);
     app.use("/api/projects/:id/github", githubRouter);
-    app.use("/api/groups", limiters.read, limiters.write, groupsRouter);
-    app.use("/api/shared", limiters.read, limiters.write, sharedWithMeRouter);
-    app.use("/api/admin", limiters.admin, adminRouter);
+    app.use("/api/groups", limiters.read, limiters.write, keyedWrites, groupsRouter);
+    app.use("/api/shared", limiters.read, limiters.write, keyedWrites, sharedWithMeRouter);
+    app.use("/api/admin", limiters.admin, keyedWrites, adminRouter);
     // Unknown API routes get a JSON 404 instead of falling through to the SPA
     // shell, which would hand HTML to API clients expecting JSON.
     app.all("/api/{*splat}", (_req, res) => {

package/dist/app.js.map

@@ -1 +1 @@
-{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,OAAyB,MAAM,SAAS,CAAC;AAChD,OAAO,YAAY,MAAM,eAAe,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjG,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAwB,MAAM,aAAa,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAE3C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;AAE3D;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,cAAc;IACd,gBAAgB;IAChB,OAAO;IACP,iBAAiB;CACT,CAAC;AAEX,gFAAgF;AAChF,MAAM,CAAC,MAAM,eAAe,GAA2B;IACrD,YAAY,EAAE,eAAe;IAC7B,cAAc,EAAE,iBAAiB;IACjC,MAAM,EAAE,QAAQ;IAChB,UAAU,EAAE,kBAAkB;CAC/B,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG;IACvE,MAAM,UAAU,GAAG,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC;IAChD,IAAI,CAAC,UAAU;QAAE,OAAO,UAAU,CAAC;IACnC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,IAAI,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;IACtC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC;QAClD,IAAI,CAAC;YACH,IAAI,SAAS,CAAC,SAAS,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,oCAAoC,CAAC,CAAC;YACrF,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACvD,MAAM,IAAI,KAAK,CAAC,6CAA6C,IAAI,QAAQ,CAAC,CAAC;YAC7E,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,QAAQ,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YAC/E,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,kDAAkD,CAAC,CAAC;QACnG,CAAC;QACD,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CACpB,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAC5C,CAAC;QAC1B,OAAO,GAAG,CAAC,OAAO,IAAI,SAAS,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAqBD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,SAAS,CAAC,IAAoB;IAC5C,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,MAAM,aAAa,GAAG,oBAAoB,EAAE,CAAC;IAE7C,yEAAyE;IACzE,4EAA4E;IAC5E,yEAAyE;IACzE,yEAAyE;IACzE,4EAA4E;IAC5E,yEAAyE;IACzE,yEAAyE;IACzE,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAEvD,2EAA2E;IAC3E,mEAAmE;IACnE,wEAAwE;IACxE,WAAW;IACX,MAAM,QAAQ,GAAG,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAEjD,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACxC,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC;IAExB,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACrD,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,uDAAuD,CAAC,CAAC;QACxF,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACpC,GAAG,CAAC,SAAS,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAC9B,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CACL,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE;QACzB,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;KACzD,CAAC,CACH,CAAC;IAEF,mBAAmB;IACnB,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC1B,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;QACnD,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;QAC/C,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,iCAAiC,CAAC,CAAC;QACpE,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,+EAA+E;IAC/E,MAAM,cAAc,GAAG,kBAAkB,EAAE,CAAC;IAC5C,IAAI,IAAI,EAAE,MAAM,EAAE,CAAC;QACjB,qEAAqE;QACrE,oEAAoE;QACpE,uEAAuE;QACvE,sBAAsB;QACtB,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IACxD,CAAC;SAAM,CAAC;QACN,yEAAyE;QACzE,oEAAoE;QACpE,sEAAsE;QACtE,uEAAuE;QACvE,sEAAsE;QACtE,qEAAqE;QACrE,sEAAsE;QACtE,0EAA0E;QAC1E,0EAA0E;QAC1E,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAChC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAC7D,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,GAAG,CAAS,WAAW,CAAC,CAAC;IAEhD,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE;QACrD,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;YAC1B,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACxB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,CAAC,eAAe,EAAE,iBAAiB,EAAE,QAAQ,EAAE,kBAAkB,CAAC,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC9G,wEAAwE;QACxE,mEAAmE;QACnE,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACnD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QACD,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC3C,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,4EAA4E;IAC5E,+BAA+B;IAC/B,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC;IAE1B,8EAA8E;IAC9E,iFAAiF;IACjF,kFAAkF;IAClF,yEAAyE;IACzE,wEAAwE;IACxE,wEAAwE;IACxE,0EAA0E;IAC1E,6EAA6E;IAC7E,gEAAgE;IAChE,6EAA6E;IAC7E,6EAA6E;IAC7E,4EAA4E;IAC5E,+DAA+D;IAC/D,4EAA4E;IAC5E,4EAA4E;IAC5E,iCAAiC;IACjC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IACpC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IACjC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IACjC,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;IACxD,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC;IACzC,GAAG,CAAC,GAAG,CAAC,6BAA6B,EAAE,QAAQ,CAAC,CAAC;IACjD,GAAG,CAAC,GAAG,CAAC,qCAAqC,EAAE,gBAAgB,CAAC,CAAC;IACjE,GAAG,CAAC,GAAG,CAAC,0BAA0B,EAAE,YAAY,CAAC,CAAC;IAClD,GAAG,CAAC,GAAG,CAAC,0BAA0B,EAAE,YAAY,CAAC,CAAC;IAClD,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IACpE,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;IAC1E,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAEnD,0EAA0E;IAC1E,8DAA8D;IAC9D,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACrC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,yDAAyD;IACzD,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACxD,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,OAAyB,MAAM,SAAS,CAAC;AAChD,OAAO,YAAY,MAAM,eAAe,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjG,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAwB,MAAM,aAAa,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEpD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;AAE3D;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,cAAc;IACd,gBAAgB;IAChB,OAAO;IACP,iBAAiB;CACT,CAAC;AAEX,gFAAgF;AAChF,MAAM,CAAC,MAAM,eAAe,GAA2B;IACrD,YAAY,EAAE,eAAe;IAC7B,cAAc,EAAE,iBAAiB;IACjC,MAAM,EAAE,QAAQ;IAChB,UAAU,EAAE,kBAAkB;CAC/B,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG;IACvE,MAAM,UAAU,GAAG,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC;IAChD,IAAI,CAAC,UAAU;QAAE,OAAO,UAAU,CAAC;IACnC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,IAAI,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;IACtC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC;QAClD,IAAI,CAAC;YACH,IAAI,SAAS,CAAC,SAAS,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,oCAAoC,CAAC,CAAC;YACrF,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACvD,MAAM,IAAI,KAAK,CAAC,6CAA6C,IAAI,QAAQ,CAAC,CAAC;YAC7E,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,QAAQ,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YAC/E,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,kDAAkD,CAAC,CAAC;QACnG,CAAC;QACD,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CACpB,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAC5C,CAAC;QAC1B,OAAO,GAAG,CAAC,OAAO,IAAI,SAAS,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAqBD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,SAAS,CAAC,IAAoB;IAC5C,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,MAAM,aAAa,GAAG,oBAAoB,EAAE,CAAC;IAE7C,yEAAyE;IACzE,4EAA4E;IAC5E,yEAAyE;IACzE,yEAAyE;IACzE,4EAA4E;IAC5E,yEAAyE;IACzE,yEAAyE;IACzE,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAEvD,2EAA2E;IAC3E,mEAAmE;IACnE,wEAAwE;IACxE,WAAW;IACX,MAAM,QAAQ,GAAG,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAEjD,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACxC,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC;IAExB,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACrD,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,uDAAuD,CAAC,CAAC;QACxF,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACpC,GAAG,CAAC,SAAS,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAC9B,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CACL,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE;QACzB,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;KACzD,CAAC,CACH,CAAC;IAEF,mBAAmB;IACnB,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC1B,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;QACnD,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;QAC/C,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,iCAAiC,CAAC,CAAC;QACpE,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,+EAA+E;IAC/E,MAAM,cAAc,GAAG,kBAAkB,EAAE,CAAC;IAC5C,IAAI,IAAI,EAAE,MAAM,EAAE,CAAC;QACjB,qEAAqE;QACrE,oEAAoE;QACpE,uEAAuE;QACvE,sBAAsB;QACtB,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IACxD,CAAC;SAAM,CAAC;QACN,yEAAyE;QACzE,oEAAoE;QACpE,sEAAsE;QACtE,uEAAuE;QACvE,sEAAsE;QACtE,qEAAqE;QACrE,sEAAsE;QACtE,0EAA0E;QAC1E,0EAA0E;QAC1E,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAChC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAC7D,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,GAAG,CAAS,WAAW,CAAC,CAAC;IAEhD,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE;QACrD,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;YAC1B,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACxB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,CAAC,eAAe,EAAE,iBAAiB,EAAE,QAAQ,EAAE,kBAAkB,CAAC,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC9G,wEAAwE;QACxE,mEAAmE;QACnE,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACnD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QACD,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC3C,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,4EAA4E;IAC5E,+BAA+B;IAC/B,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC;IAE1B,8EAA8E;IAC9E,iFAAiF;IACjF,kFAAkF;IAClF,yEAAyE;IACzE,wEAAwE;IACxE,wEAAwE;IACxE,0EAA0E;IAC1E,6EAA6E;IAC7E,gEAAgE;IAChE,6EAA6E;IAC7E,6EAA6E;IAC7E,4EAA4E;IAC5E,+DAA+D;IAC/D,4EAA4E;IAC5E,4EAA4E;IAC5E,iCAAiC;IACjC,kFAAkF;IAClF,MAAM,WAAW,GAAG,gBAAgB,EAAE,CAAC;IACvC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACjD,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IACjC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IACjC,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IACrE,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC;IACzC,GAAG,CAAC,GAAG,CAAC,6BAA6B,EAAE,QAAQ,CAAC,CAAC;IACjD,GAAG,CAAC,GAAG,CAAC,qCAAqC,EAAE,gBAAgB,CAAC,CAAC;IACjE,GAAG,CAAC,GAAG,CAAC,0BAA0B,EAAE,YAAY,CAAC,CAAC;IAClD,GAAG,CAAC,GAAG,CAAC,0BAA0B,EAAE,YAAY,CAAC,CAAC;IAClD,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC;IACjF,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,EAAE,WAAW,EAAE,kBAAkB,CAAC,CAAC;IACvF,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,QAAQ,CAAC,KAAK,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;IAEhE,0EAA0E;IAC1E,8DAA8D;IAC9D,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACrC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,yDAAyD;IACzD,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACxD,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/db.d.ts

@@ -22,8 +22,8 @@ export declare const pool: import("pg").Pool;
  *
  * Issues `CREATE TABLE IF NOT EXISTS` for users, projects, groups, group
  * members, project shares, external (OIDC) identities, the admin audit log,
- * and GitHub item links, plus their indexes; runs idempotent `ADD COLUMN IF
- * NOT EXISTS` migrations for later-added columns; and, when
+ * GitHub item links and idempotency keys, plus their indexes; runs idempotent
+ * `ADD COLUMN IF NOT EXISTS` migrations for later-added columns; and, when
  * `PM_WEB_BOOTSTRAP_ADMIN_EMAIL` is set, promotes that (lower-cased) user to
  * admin. Safe to call on every boot.
  */

package/dist/db.js

@@ -67,8 +67,8 @@ const bootstrapAdminEmail = (process.env.PM_WEB_BOOTSTRAP_ADMIN_EMAIL || "")
  *
  * Issues `CREATE TABLE IF NOT EXISTS` for users, projects, groups, group
  * members, project shares, external (OIDC) identities, the admin audit log,
- * and GitHub item links, plus their indexes; runs idempotent `ADD COLUMN IF
- * NOT EXISTS` migrations for later-added columns; and, when
+ * GitHub item links and idempotency keys, plus their indexes; runs idempotent
+ * `ADD COLUMN IF NOT EXISTS` migrations for later-added columns; and, when
  * `PM_WEB_BOOTSTRAP_ADMIN_EMAIL` is set, promotes that (lower-cased) user to
  * admin. Safe to call on every boot.
  */
@@ -173,6 +173,34 @@ export async function initSchema() {
     );
   `);
     await pool.query(`CREATE INDEX IF NOT EXISTS pm_github_item_links_project ON pm_github_item_links(project_id)`);
+    // Idempotency keys: one row per (account, key) recording the outcome of a
+    // mutating request that carried that key, so a retry after an ambiguous
+    // (lost) response replays the stored outcome instead of re-executing. A row
+    // with a NULL status_code marks an execution still in flight (or crashed
+    // before responding); see src/idempotency.ts for the unknown-outcome policy.
+    await pool.query(`
+    CREATE TABLE IF NOT EXISTS pm_idempotency_keys (
+      id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+      user_id UUID NOT NULL REFERENCES pm_users(id) ON DELETE CASCADE,
+      idempotency_key TEXT NOT NULL,
+      method TEXT NOT NULL,
+      path TEXT NOT NULL,
+      request_fingerprint TEXT NOT NULL,
+      outcome_state TEXT NOT NULL DEFAULT 'pending' CHECK (outcome_state IN ('pending', 'completed', 'outcome_unknown')),
+      status_code INTEGER,
+      response_body TEXT,
+      response_content_type TEXT,
+      created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+      updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+      UNIQUE (user_id, idempotency_key)
+    );
+  `);
+    await pool.query("ALTER TABLE pm_idempotency_keys ADD COLUMN IF NOT EXISTS response_content_type TEXT");
+    await pool.query("ALTER TABLE pm_idempotency_keys ADD COLUMN IF NOT EXISTS outcome_state TEXT NOT NULL DEFAULT 'pending' CHECK (outcome_state IN ('pending', 'completed', 'outcome_unknown'))");
+    await pool.query("UPDATE pm_idempotency_keys SET outcome_state = 'completed' WHERE outcome_state = 'pending' AND status_code IS NOT NULL");
+    await pool.query("CREATE INDEX IF NOT EXISTS idx_pm_idempotency_created_at ON pm_idempotency_keys (created_at) WHERE status_code IS NOT NULL");
+    await pool.query("CREATE INDEX IF NOT EXISTS idx_pm_idempotency_settled_at ON pm_idempotency_keys (updated_at) WHERE status_code IS NOT NULL");
+    await pool.query("CREATE INDEX IF NOT EXISTS idx_pm_idempotency_pending_at ON pm_idempotency_keys (created_at) WHERE status_code IS NULL");
     if (bootstrapAdminEmail) {
         await pool.query(`UPDATE pm_users SET is_admin = TRUE, updated_at = NOW() WHERE lower(email) = lower($1)`, [bootstrapAdminEmail]);
     }

package/dist/db.js.map

@@ -1 +1 @@
-{"version":3,"file":"db.js","sourceRoot":"","sources":["../src/db.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AAEpB,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AAEpB;;;;;;;GAOG;AACH,SAAS,iBAAiB;IACxB,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;QAC7B,OAAO,EAAE,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;IACxD,CAAC;IAED,oEAAoE;IACpE,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;QACzD,OAAO;YACL,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa;YAC/B,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,MAAM,EAAE,EAAE,CAAC;YACvD,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa;YAC/B,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB;YACvC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW;SAClC,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB;IAChC,MAAM,UAAU,GACd,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QACjC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAChE,IAAI,UAAU;QAAE,OAAO;IACvB,MAAM,IAAI,KAAK,CACb,mEAAmE;QACjE,mCAAmC;QACnC,qEAAqE;QACrE,yEAAyE,CAC5E,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC;IAC3B,GAAG,iBAAiB,EAAE;IACtB,2EAA2E;IAC3E,wEAAwE;IACxE,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;IAC5E,iBAAiB,EAAE,MAAM;IACzB,uBAAuB,EAAE,KAAK;CAC/B,CAAC,CAAC;AAEH,MAAM,mBAAmB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,4BAA4B,IAAI,EAAE,CAAC;KACzE,IAAI,EAAE;KACN,WAAW,EAAE,CAAC;AAEjB;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU;IAC9B,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDhB,CAAC,CAAC;IAEH,0CAA0C;IAC1C,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;GAMhB,CAAC,CAAC;IAEH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;;;;;;GAahB,CAAC,CAAC;IAEH,MAAM,IAAI,CAAC,KAAK,CACd;;;;;;MAME,CACH,CAAC;IAEF,MAAM,IAAI,CAAC,KAAK,CACd,yFAAyF,CAC1F,CAAC;IAEF,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;;;GAUhB,CAAC,CAAC;IAEH,MAAM,IAAI,CAAC,KAAK,CACd,6FAA6F,CAC9F,CAAC;IAEF,IAAI,mBAAmB,EAAE,CAAC;QACxB,MAAM,IAAI,CAAC,KAAK,CACd,wFAAwF,EACxF,CAAC,mBAAmB,CAAC,CACtB,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"db.js","sourceRoot":"","sources":["../src/db.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AAEpB,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AAEpB;;;;;;;GAOG;AACH,SAAS,iBAAiB;IACxB,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;QAC7B,OAAO,EAAE,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;IACxD,CAAC;IAED,oEAAoE;IACpE,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;QACzD,OAAO;YACL,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa;YAC/B,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,MAAM,EAAE,EAAE,CAAC;YACvD,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa;YAC/B,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB;YACvC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW;SAClC,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB;IAChC,MAAM,UAAU,GACd,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QACjC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAChE,IAAI,UAAU;QAAE,OAAO;IACvB,MAAM,IAAI,KAAK,CACb,mEAAmE;QACjE,mCAAmC;QACnC,qEAAqE;QACrE,yEAAyE,CAC5E,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC;IAC3B,GAAG,iBAAiB,EAAE;IACtB,2EAA2E;IAC3E,wEAAwE;IACxE,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;IAC5E,iBAAiB,EAAE,MAAM;IACzB,uBAAuB,EAAE,KAAK;CAC/B,CAAC,CAAC;AAEH,MAAM,mBAAmB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,4BAA4B,IAAI,EAAE,CAAC;KACzE,IAAI,EAAE;KACN,WAAW,EAAE,CAAC;AAEjB;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU;IAC9B,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDhB,CAAC,CAAC;IAEH,0CAA0C;IAC1C,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;GAMhB,CAAC,CAAC;IAEH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;;;;;;GAahB,CAAC,CAAC;IAEH,MAAM,IAAI,CAAC,KAAK,CACd;;;;;;MAME,CACH,CAAC;IAEF,MAAM,IAAI,CAAC,KAAK,CACd,yFAAyF,CAC1F,CAAC;IAEF,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;;;GAUhB,CAAC,CAAC;IAEH,MAAM,IAAI,CAAC,KAAK,CACd,6FAA6F,CAC9F,CAAC;IAEF,0EAA0E;IAC1E,wEAAwE;IACxE,4EAA4E;IAC5E,yEAAyE;IACzE,6EAA6E;IAC7E,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;;;;;;;;;GAgBhB,CAAC,CAAC;IAEH,MAAM,IAAI,CAAC,KAAK,CAAC,qFAAqF,CAAC,CAAC;IACxG,MAAM,IAAI,CAAC,KAAK,CAAC,6KAA6K,CAAC,CAAC;IAChM,MAAM,IAAI,CAAC,KAAK,CAAC,wHAAwH,CAAC,CAAC;IAC3I,MAAM,IAAI,CAAC,KAAK,CAAC,4HAA4H,CAAC,CAAC;IAC/I,MAAM,IAAI,CAAC,KAAK,CAAC,4HAA4H,CAAC,CAAC;IAC/I,MAAM,IAAI,CAAC,KAAK,CAAC,wHAAwH,CAAC,CAAC;IAE3I,IAAI,mBAAmB,EAAE,CAAC;QACxB,MAAM,IAAI,CAAC,KAAK,CACd,wFAAwF,EACxF,CAAC,mBAAmB,CAAC,CACtB,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/idempotency.d.ts

@@ -0,0 +1,59 @@
+import type { RequestHandler, Response } from "express";
+/**
+ * Minimum length an `Idempotency-Key` header value may have.
+ *
+ * Keys are generated by the offline mutation queue as 128-bit UUID-shaped
+ * strings, so anything shorter than this is a client bug rather than a key,
+ * and accepting it would let a truncated or hand-typed value collide with a
+ * future real key.
+ */
+export declare const IDEMPOTENCY_KEY_MIN_LENGTH = 8;
+/**
+ * Maximum length an `Idempotency-Key` header value may have.
+ *
+ * Bounds the stored key so a hostile client cannot stuff multi-kilobyte
+ * strings into the unique index; real keys are 36-character UUID strings.
+ */
+export declare const IDEMPOTENCY_KEY_MAX_LENGTH = 200;
+/** Mark a failure only after proving no mutation committed (for example, confirmed rollback before COMMIT was attempted). */
+export declare function markIdempotencyPreCommitFailure(res: Response): void;
+/**
+ * Compute the fingerprint that binds one idempotency key to one request.
+ *
+ * The fingerprint covers the method, the full path with query string, and the
+ * parsed JSON body, so a key can only ever be replayed for the identical
+ * request it was created for. Re-serializing the parsed body is stable here
+ * because a retry sends the same bytes (the offline queue persists the exact
+ * body string), which parses to the same property order; a different body —
+ * different properties or different values — produces a different fingerprint
+ * and is rejected rather than silently deduplicated.
+ *
+ * @param method - The HTTP method of the request.
+ * @param path - The request path including any query string.
+ * @param body - The parsed request body, or `null` when the request has none.
+ * @returns A hex SHA-256 digest over the request identity.
+ */
+export declare function requestFingerprint(method: string, path: string, body: unknown): string;
+/**
+ * Build the middleware that makes keyed mutating requests at-most-once.
+ *
+ * Scope: keyed mutating `/api` requests outside `/api/auth`. Auth responses
+ * always execute live so session cookies are never lost to body-only replay.
+ * An expected-account header is checked against an existing authenticated user
+ * before execution or claiming, including recovery probes to `/api/auth/me`.
+ *
+ * Exactly-once per account: the key is stored together with the authenticated
+ * user, so two accounts using the same key never interfere. The first
+ * execution atomically claims the (account, key) pair, stores its outcome
+ * when the response finishes, and any duplicate — a retry after an ambiguous
+ * response the client never saw, or a concurrent duplicate of an in-flight
+ * request — is answered from that stored outcome without re-executing. A key
+ * reused for a *different* request is rejected with 422 rather than silently
+ * deduplicated; an unfinished record older than the pending timeout is
+ * answered with 409 outcome unknown without re-execution; an in-flight
+ * duplicate waits for it to settle and answers 409 only at the
+ * deadline.
+ *
+ * @returns An Express middleware enforcing the contract on its mount.
+ */
+export declare function idempotencyGuard(): RequestHandler;

package/dist/idempotency.js

@@ -0,0 +1,361 @@
+import crypto from "node:crypto";
+import { pool } from "./db.js";
+import { extractToken, verifyToken } from "./auth.js";
+import { isUnsafeMethod } from "./rate-limit.js";
+/**
+ * Minimum length an `Idempotency-Key` header value may have.
+ *
+ * Keys are generated by the offline mutation queue as 128-bit UUID-shaped
+ * strings, so anything shorter than this is a client bug rather than a key,
+ * and accepting it would let a truncated or hand-typed value collide with a
+ * future real key.
+ */
+export const IDEMPOTENCY_KEY_MIN_LENGTH = 8;
+/**
+ * Maximum length an `Idempotency-Key` header value may have.
+ *
+ * Bounds the stored key so a hostile client cannot stuff multi-kilobyte
+ * strings into the unique index; real keys are 36-character UUID strings.
+ */
+export const IDEMPOTENCY_KEY_MAX_LENGTH = 200;
+/**
+ * How long a duplicate waits for the in-flight original to settle, in
+ * milliseconds, before answering 409. Override: `PM_WEB_IDEMPOTENCY_WAIT_MS`.
+ *
+ * The default covers the longest mutating route (pm CLI commands time out at
+ * 30 s), so a concurrent duplicate normally observes the original's stored
+ * outcome instead of being told to retry.
+ */
+const DEFAULT_WAIT_MS = 30_000;
+/** How often a waiting duplicate re-checks the store, in milliseconds. */
+const DEFAULT_POLL_MS = 25;
+/** Age after which an unfinished execution is reported as outcome unknown. */
+const DEFAULT_PENDING_TIMEOUT_MS = 300_000;
+/**
+ * How long a settled idempotency record is kept before it is swept, in
+ * milliseconds. Override: `PM_WEB_IDEMPOTENCY_RETENTION_MS`.
+ *
+ * Completed outcomes are deduplicated within this window. A retry after expiry
+ * can execute again. Unknown outcomes have the same bounded retention, measured
+ * from settlement; stale pending intents must settle before they can expire.
+ */
+const DEFAULT_RETENTION_MS = 7 * 24 * 60 * 60 * 1000;
+/** Handler assertions are process-local and cannot be forged through request headers. */
+const preCommitFailures = new WeakSet();
+/** Mark a failure only after proving no mutation committed (for example, confirmed rollback before COMMIT was attempted). */
+export function markIdempotencyPreCommitFailure(res) {
+    preCommitFailures.add(res);
+}
+/** Machine-readable refusal reused by failure settlement and stale-intent recovery. */
+const UNKNOWN_OUTCOME = JSON.stringify({
+    code: "PM_IDEMPOTENCY_OUTCOME_UNKNOWN",
+    error: "Idempotency outcome unknown; reconcile the original mutation before submitting new work",
+});
+/**
+ * Compute the fingerprint that binds one idempotency key to one request.
+ *
+ * The fingerprint covers the method, the full path with query string, and the
+ * parsed JSON body, so a key can only ever be replayed for the identical
+ * request it was created for. Re-serializing the parsed body is stable here
+ * because a retry sends the same bytes (the offline queue persists the exact
+ * body string), which parses to the same property order; a different body —
+ * different properties or different values — produces a different fingerprint
+ * and is rejected rather than silently deduplicated.
+ *
+ * @param method - The HTTP method of the request.
+ * @param path - The request path including any query string.
+ * @param body - The parsed request body, or `null` when the request has none.
+ * @returns A hex SHA-256 digest over the request identity.
+ */
+export function requestFingerprint(method, path, body) {
+    return crypto
+        .createHash("sha256")
+        .update(`${method}\n${path}\n${JSON.stringify(body ?? null)}`)
+        .digest("hex");
+}
+/**
+ * Resolve a positive millisecond duration from the environment.
+ *
+ * Accepts only finite positive numbers; anything else (unset, empty, zero,
+ * negative, non-numeric) falls back to the shipped default so a typo in an
+ * environment variable degrades to the documented behaviour instead of
+ * disabling a timeout entirely.
+ *
+ * @param name - The environment variable to read.
+ * @param fallback - The default used when the variable is unusable.
+ * @returns The resolved duration in milliseconds.
+ */
+function envDurationMs(name, fallback) {
+    const parsed = Number(process.env[name]);
+    return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
+}
+/**
+ * Insert the intent to execute one keyed request, or report a conflict.
+ *
+ * `ON CONFLICT DO NOTHING` makes the insert atomic against a concurrent
+ * duplicate: exactly one request can own a (user, key) pair at a time, and
+ * the loser learns it lost by receiving no row rather than by an error it
+ * would have to disambiguate from a genuine failure.
+ *
+ * @returns The id of the inserted row when this call owns the execution, or
+ *   `null` when the key is already held.
+ */
+async function insertPendingKey(userId, key, method, path, fingerprint) {
+    const result = await pool.query(`INSERT INTO pm_idempotency_keys (user_id, idempotency_key, method, path, request_fingerprint)
+     SELECT id, $2, $3, $4, $5 FROM pm_users WHERE id = $1 FOR KEY SHARE
+     ON CONFLICT (user_id, idempotency_key) DO NOTHING
+     RETURNING id`, [userId, key, method, path, fingerprint]);
+    const row = result.rows[0];
+    return row?.id ?? null;
+}
+/** Check that a verified token still names an existing account before keying. */
+async function accountExists(userId) {
+    if (typeof userId !== "string" || !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(userId))
+        return false;
+    const result = await pool.query("SELECT id FROM pm_users WHERE id = $1", [userId]);
+    return result.rows.length > 0;
+}
+/**
+ * Read the current idempotency record for one (account, key) pair.
+ *
+ * @returns The record, or `null` when no row exists (which can only happen
+ *   transiently: a settled record is swept only by retention, and a pending
+ *   one only by an explicit transient refusal).
+ */
+async function selectKey(userId, key) {
+    const result = await pool.query(`SELECT id, request_fingerprint, status_code, response_body, response_content_type, created_at, outcome_state
+     FROM pm_idempotency_keys
+     WHERE user_id = $1 AND idempotency_key = $2`, [userId, key]);
+    return result.rows[0] ?? null;
+}
+/**
+ * Sweep idempotency records past the retention window.
+ *
+ * Called at most once per minute per guard instance. Stale pending records first
+ * become terminal unknown outcomes; retention starts at that settlement time.
+ */
+async function deleteExpiredKeys() {
+    await pool.query(`UPDATE pm_idempotency_keys SET outcome_state = 'outcome_unknown', status_code = 409,
+     response_body = $2, response_content_type = 'application/json', updated_at = NOW()
+     WHERE status_code IS NULL AND outcome_state = 'pending'
+     AND created_at < NOW() - ($1::double precision * interval '1 ms')`, [envDurationMs("PM_WEB_IDEMPOTENCY_PENDING_TIMEOUT_MS", DEFAULT_PENDING_TIMEOUT_MS), UNKNOWN_OUTCOME]);
+    await pool.query(`DELETE FROM pm_idempotency_keys
+     WHERE status_code IS NOT NULL AND updated_at < NOW() - ($1::double precision * interval '1 ms')`, [envDurationMs("PM_WEB_IDEMPOTENCY_RETENTION_MS", DEFAULT_RETENTION_MS)]);
+}
+/**
+ * Store a definitive outcome. Release only explicit pre-mutation refusals
+ * (425, 429, or handler-proven pre-commit failures). All other server failures
+ * settle as terminal unknown outcomes because they may follow a commit.
+ */
+async function persistOutcome(rowId, statusCode, body, contentType, preCommit = false) {
+    if (statusCode === 425 || statusCode === 429 || (statusCode >= 500 && preCommit)) {
+        await pool.query(`DELETE FROM pm_idempotency_keys WHERE id = $1 AND outcome_state = 'pending'`, [rowId]);
+        return;
+    }
+    const unknown = statusCode >= 500;
+    await pool.query(`UPDATE pm_idempotency_keys
+     SET status_code = $2, response_body = $3, response_content_type = $4, outcome_state = $5, updated_at = NOW()
+     WHERE id = $1 AND outcome_state = 'pending'`, [rowId, unknown ? 409 : statusCode, unknown ? UNKNOWN_OUTCOME : body,
+        unknown ? "application/json" : contentType, unknown ? "outcome_unknown" : "completed"]);
+}
+/**
+ * Answer a duplicate from the stored outcome of the original request.
+ *
+ * The `Idempotency-Replayed` header lets the client (and the tests) tell a
+ * replay from a fresh execution without diffing bodies. Responses that had no
+ * body keep having none; responses that had one are served with the content
+ * type they originally carried.
+ */
+function replayStored(record, res) {
+    res.setHeader("Idempotency-Replayed", "true");
+    if (record.response_body === null) {
+        res.status(record.status_code ?? 500).end();
+        return;
+    }
+    res.setHeader("Content-Type", record.response_content_type ?? "application/json");
+    res.status(record.status_code ?? 500).send(record.response_body);
+}
+/**
+ * Answer a settled record, or reject a key recycled onto a different request.
+ *
+ * @param record - The settled record held under the client's key.
+ * @param fingerprint - The fingerprint of the request being answered.
+ * @param res - The response to answer on.
+ */
+function finishSettled(record, fingerprint, res) {
+    if (record.request_fingerprint !== fingerprint) {
+        res.status(422).json({
+            error: "Idempotency-Key was already used for a different request",
+        });
+        return;
+    }
+    replayStored(record, res);
+}
+/**
+ * Capture the executing request's response and persist it when it finishes.
+ *
+ * `res.json`/`res.send` are wrapped once to record the body the handler
+ * produced, and the `finish` listener persists whatever status the response
+ * left with — so handlers that never call `json`/`send` (204s, `end()`) are
+ * still memoized, just without a body.
+ *
+ * @param rowId - The id of this execution's idempotency record.
+ * @param res - The executing response.
+ */
+function captureOutcome(rowId, res) {
+    let capturedBody = null;
+    const originalJson = res.json.bind(res);
+    const originalSend = res.send.bind(res);
+    /** Capture the first response serialization without recording request content. */
+    const capture = (body) => {
+        if (capturedBody !== null)
+            return;
+        capturedBody = typeof body === "string" ? body : JSON.stringify(body ?? null);
+    };
+    res.json = (body) => {
+        capture(body);
+        return originalJson(body);
+    };
+    res.send = (body) => {
+        capture(body);
+        return originalSend(body);
+    };
+    let finished = false;
+    /** Finish and premature close share one persistence path, avoiding conflicting writes. */
+    const settle = (statusCode) => {
+        const contentType = res.getHeader("Content-Type");
+        void persistOutcome(rowId, statusCode, capturedBody, typeof contentType === "string" ? contentType : null, preCommitFailures.has(res)).catch((error) => {
+            // Do not log response bodies, tokens or database error details.
+            console.error("Failed to persist idempotency outcome; key remains pending", error instanceof Error ? error.name : "unknown error");
+        });
+    };
+    res.on("finish", () => {
+        finished = true;
+        settle(res.statusCode);
+    });
+    res.on("close", () => {
+        if (!finished)
+            settle(500);
+    });
+}
+/**
+ * Build the middleware that makes keyed mutating requests at-most-once.
+ *
+ * Scope: keyed mutating `/api` requests outside `/api/auth`. Auth responses
+ * always execute live so session cookies are never lost to body-only replay.
+ * An expected-account header is checked against an existing authenticated user
+ * before execution or claiming, including recovery probes to `/api/auth/me`.
+ *
+ * Exactly-once per account: the key is stored together with the authenticated
+ * user, so two accounts using the same key never interfere. The first
+ * execution atomically claims the (account, key) pair, stores its outcome
+ * when the response finishes, and any duplicate — a retry after an ambiguous
+ * response the client never saw, or a concurrent duplicate of an in-flight
+ * request — is answered from that stored outcome without re-executing. A key
+ * reused for a *different* request is rejected with 422 rather than silently
+ * deduplicated; an unfinished record older than the pending timeout is
+ * answered with 409 outcome unknown without re-execution; an in-flight
+ * duplicate waits for it to settle and answers 409 only at the
+ * deadline.
+ *
+ * @returns An Express middleware enforcing the contract on its mount.
+ */
+export function idempotencyGuard() {
+    let nextSweepAt = 0;
+    return async (req, res, next) => {
+        const authRoute = /^\/api\/auth(?:\/|$)/i.test(req.originalUrl.split("?")[0]);
+        const expectedAccount = req.get("x-pm-expected-account");
+        const checkExpected = expectedAccount !== undefined
+            && (!authRoute || /^\/api\/auth\/me\/?(?:\?|$)/i.test(req.originalUrl));
+        const header = req.get("idempotency-key");
+        const keyed = isUnsafeMethod(req.method) && !authRoute && header !== undefined;
+        if (!keyed && !checkExpected) {
+            next();
+            return;
+        }
+        // Only record requests we can attribute to an account; an unauthenticated
+        // or invalid-session request is passed through for the route to refuse,
+        // so an anonymous probe can never occupy a key.
+        let userId = null;
+        const token = extractToken(req);
+        if (token) {
+            try {
+                userId = verifyToken(token).userId;
+            }
+            catch {
+                userId = null;
+            }
+        }
+        if (userId !== null && !await accountExists(userId))
+            userId = null;
+        if (checkExpected && (userId === null || expectedAccount !== userId)) {
+            res.status(409).json({ code: "PM_EXPECTED_ACCOUNT_MISMATCH", error: "The signed-in account differs from the account that approved this work" });
+            return;
+        }
+        if (!keyed || userId === null) {
+            next();
+            return;
+        }
+        const key = header.trim();
+        if (key.length < IDEMPOTENCY_KEY_MIN_LENGTH || key.length > IDEMPOTENCY_KEY_MAX_LENGTH) {
+            res.status(400).json({
+                error: `Idempotency-Key must be between ${IDEMPOTENCY_KEY_MIN_LENGTH} and ${IDEMPOTENCY_KEY_MAX_LENGTH} characters`,
+            });
+            return;
+        }
+        if (Date.now() >= nextSweepAt) {
+            // Cleanup can fail only before an intent exists, leaving the key retryable.
+            nextSweepAt = Date.now() + 60_000;
+            await deleteExpiredKeys();
+        }
+        const fingerprint = requestFingerprint(req.method, req.originalUrl, req.body);
+        const deadline = Date.now() + envDurationMs("PM_WEB_IDEMPOTENCY_WAIT_MS", DEFAULT_WAIT_MS);
+        let rowId = await insertPendingKey(userId, key, req.method, req.originalUrl, fingerprint);
+        while (rowId === null) {
+            const record = await selectKey(userId, key);
+            if (record && record.status_code !== null) {
+                // The original settled before this duplicate arrived: replay it.
+                finishSettled(record, fingerprint, res);
+                return;
+            }
+            if (record && record.request_fingerprint !== fingerprint) {
+                res.status(422).json({
+                    error: "Idempotency-Key was already used for a different request",
+                });
+                return;
+            }
+            if (record === null) {
+                // Deletion can race token validation; the locked INSERT SELECT refuses
+                // a missing user without a foreign-key failure or a permanent wait.
+                if (!await accountExists(userId)) {
+                    next();
+                    return;
+                }
+                rowId = await insertPendingKey(userId, key, req.method, req.originalUrl, fingerprint);
+                continue;
+            }
+            if (isStalePending(record)) {
+                await persistOutcome(record.id, 500, null, null);
+                continue;
+            }
+            if (Date.now() >= deadline) {
+                res.status(409).json({ code: "PM_IDEMPOTENCY_IN_FLIGHT", error: "The request with this Idempotency-Key is still executing; retry later" });
+                return;
+            }
+            await new Promise((resolve) => { setTimeout(resolve, envDurationMs("PM_WEB_IDEMPOTENCY_POLL_MS", DEFAULT_POLL_MS)); });
+        }
+        captureOutcome(rowId, res);
+        next();
+    };
+}
+/**
+ * Report whether a pending record is old enough to be a crashed execution.
+ *
+ * @param record - The still-pending record to age-check.
+ * @returns `true` when the record predates the pending timeout.
+ */
+function isStalePending(record) {
+    const timeoutMs = envDurationMs("PM_WEB_IDEMPOTENCY_PENDING_TIMEOUT_MS", DEFAULT_PENDING_TIMEOUT_MS);
+    return Date.now() - record.created_at.getTime() > timeoutMs;
+}
+//# sourceMappingURL=idempotency.js.map