bullpane 0.5.1

package/migrations/mysql/0001_init.sql

@@ -0,0 +1,102 @@
+-- Bullpane — initial schema. Applied by src/db/migrate.ts (statements split on ";\n").
+
+CREATE TABLE IF NOT EXISTS users (
+  id VARCHAR(36) NOT NULL,
+  email VARCHAR(255) NOT NULL,
+  name VARCHAR(80) NOT NULL,
+  password_hash VARCHAR(255) NOT NULL,
+  role ENUM('admin', 'operator', 'viewer') NOT NULL DEFAULT 'viewer',
+  created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+  last_login_at DATETIME(3) NULL,
+  PRIMARY KEY (id),
+  UNIQUE KEY users_email_unique (email)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE IF NOT EXISTS sessions (
+  id VARCHAR(64) NOT NULL,
+  user_id VARCHAR(36) NOT NULL,
+  expires_at DATETIME(3) NOT NULL,
+  created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+  PRIMARY KEY (id),
+  KEY sessions_user_id_idx (user_id),
+  KEY sessions_expires_at_idx (expires_at),
+  CONSTRAINT sessions_user_id_fk FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE IF NOT EXISTS connections (
+  id VARCHAR(36) NOT NULL,
+  name VARCHAR(80) NOT NULL,
+  url TEXT NOT NULL,
+  prefix VARCHAR(64) NOT NULL DEFAULT 'bull',
+  cluster TINYINT(1) NOT NULL DEFAULT 0,
+  queue_filter VARCHAR(200) NULL,
+  created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+  PRIMARY KEY (id)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE IF NOT EXISTS folders (
+  id VARCHAR(36) NOT NULL,
+  name VARCHAR(80) NOT NULL,
+  color VARCHAR(20) NULL,
+  parent_id VARCHAR(36) NULL,
+  position INT NOT NULL DEFAULT 0,
+  PRIMARY KEY (id),
+  KEY folders_parent_id_idx (parent_id)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE IF NOT EXISTS folder_queues (
+  folder_id VARCHAR(36) NOT NULL,
+  connection_id VARCHAR(36) NOT NULL,
+  queue_name VARCHAR(255) NOT NULL,
+  PRIMARY KEY (folder_id, connection_id, queue_name),
+  CONSTRAINT folder_queues_folder_id_fk FOREIGN KEY (folder_id) REFERENCES folders (id) ON DELETE CASCADE
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE IF NOT EXISTS alerts (
+  id VARCHAR(36) NOT NULL,
+  name VARCHAR(120) NOT NULL,
+  enabled TINYINT(1) NOT NULL DEFAULT 1,
+  connection_id VARCHAR(36) NOT NULL,
+  queue_name VARCHAR(255) NULL,
+  `condition` JSON NOT NULL,
+  channels JSON NOT NULL,
+  cooldown_minutes INT NOT NULL DEFAULT 30,
+  created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+  last_fired_at DATETIME(3) NULL,
+  firing TINYINT(1) NOT NULL DEFAULT 0,
+  PRIMARY KEY (id),
+  KEY alerts_connection_id_idx (connection_id)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE IF NOT EXISTS alert_events (
+  id VARCHAR(36) NOT NULL,
+  alert_id VARCHAR(36) NOT NULL,
+  alert_name VARCHAR(120) NOT NULL,
+  connection_id VARCHAR(36) NOT NULL,
+  queue_name VARCHAR(255) NULL,
+  kind VARCHAR(40) NOT NULL,
+  status VARCHAR(20) NOT NULL,
+  message TEXT NOT NULL,
+  value DOUBLE NULL,
+  created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+  PRIMARY KEY (id),
+  KEY alert_events_created_at_idx (created_at),
+  KEY alert_events_alert_id_idx (alert_id)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE IF NOT EXISTS flow_edges (
+  id VARCHAR(36) NOT NULL,
+  connection_id VARCHAR(36) NOT NULL,
+  from_queue VARCHAR(255) NOT NULL,
+  to_queue VARCHAR(255) NOT NULL,
+  label VARCHAR(120) NULL,
+  created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+  PRIMARY KEY (id),
+  UNIQUE KEY flow_edges_unique (connection_id, from_queue, to_queue)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE IF NOT EXISTS settings (
+  `key` VARCHAR(64) NOT NULL,
+  value TEXT NOT NULL,
+  PRIMARY KEY (`key`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

package/migrations/mysql/0002_alert_scopes.sql

@@ -0,0 +1,9 @@
+-- Alerts are scoped to a queue or a folder; connection-level alerts are gone.
+ALTER TABLE alerts MODIFY connection_id VARCHAR(36) NULL;
+ALTER TABLE alerts ADD COLUMN scope_type ENUM('queue','folder') NOT NULL DEFAULT 'queue' AFTER enabled;
+ALTER TABLE alerts ADD COLUMN folder_id VARCHAR(36) NULL AFTER queue_name;
+ALTER TABLE alerts ADD KEY alerts_folder_id_idx (folder_id);
+ALTER TABLE alert_events MODIFY connection_id VARCHAR(36) NULL;
+-- Rows that cannot be expressed in the new model (connection_down, "all queues of a connection").
+DELETE FROM alerts WHERE JSON_UNQUOTE(JSON_EXTRACT(`condition`, '$.kind')) = 'connection_down';
+DELETE FROM alerts WHERE scope_type = 'queue' AND queue_name IS NULL;

package/migrations/mysql/0003_hidden_queues.sql

@@ -0,0 +1,21 @@
+-- Hidden queues: a queue the team no longer wants to SEE, per instance.
+--
+-- Deliberately NOT a per-user preference. If a lead hides a dead queue it is
+-- dead for everyone; a dashboard that differs per person is a liability in the
+-- middle of an incident. `hidden_by` records who did it so the choice can be
+-- traced back, and the row is the whole state (present = hidden).
+--
+-- Nothing here touches Redis. The queue keeps running, keeps being measured by
+-- alerts, and stays reachable by direct URL. This is the opposite of
+-- `obliterate`, which deletes the queue and its jobs and cannot be undone.
+--
+-- No FK to `connections`: the queue name is a discovered string, not a row, and
+-- ConnectionsService.remove() cleans these up alongside folder_queues.
+
+CREATE TABLE IF NOT EXISTS hidden_queues (
+  connection_id VARCHAR(36) NOT NULL,
+  queue_name VARCHAR(255) NOT NULL,
+  hidden_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+  hidden_by VARCHAR(36) NULL,
+  PRIMARY KEY (connection_id, queue_name)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

package/migrations/mysql/0004_audit_log.sql

@@ -0,0 +1,57 @@
+-- Audit log: the durable answer to "who did this to my production queue?".
+--
+-- The trail already existed as pino lines ({ queue, jobId, by }) in every
+-- mutating handler. A log file that dies with the container and that nobody can
+-- query is not an audit trail, it is a debugging aid. This table is the same
+-- information, persisted, filterable and exportable.
+--
+-- WHY THE ACTOR IS DENORMALISED (actor_email / actor_name / actor_role):
+-- an audit row whose only pointer to the person is a foreign key stops meaning
+-- anything the moment that user is deleted — and "the person who did it left the
+-- company" is precisely the case an auditor cares about. So there is deliberately
+-- NO FK to `users`, and no FK to `connections` either: the connection name is
+-- copied in, because a deleted connection must not erase what was done to it.
+-- Rows are append-only by design; no route updates or deletes them (retention
+-- pruning by age is the single exception).
+--
+-- WHAT IS NOT HERE: the job's `data`. `detail` carries the PARAMETERS of the
+-- action (clean state/grace/limit, how many jobs were removed, the job name,
+-- payload size in bytes) and never the payload itself, which routinely holds
+-- customer PII. That rule is in CLAUDE.md ("never log job data") and is covered
+-- by a test.
+--
+-- SIZE: a typical row is ~350-600 bytes on disk including the two indexes
+-- (fixed columns ~120 B, user agent ~120 B, detail JSON usually < 200 B). At
+-- 10k mutating actions/day that is ~2 GB/year; a dashboard where humans click
+-- buttons is more like 200/day, i.e. ~40 MB/year. Retention is
+-- BULLPANE_AUDIT_RETENTION_DAYS (default 365) and the prune runs with the alerts
+-- engine tick.
+
+CREATE TABLE IF NOT EXISTS audit_log (
+  id VARCHAR(36) NOT NULL,
+  created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+  -- Denormalised actor. NULL actor_id = anonymous call (failed login on an
+  -- unknown email). The other three survive the user row being deleted.
+  actor_id VARCHAR(36) NULL,
+  actor_email VARCHAR(255) NULL,
+  actor_name VARCHAR(80) NULL,
+  actor_role VARCHAR(20) NULL,
+  action VARCHAR(40) NOT NULL,
+  -- Denormalised target. Queues are discovered strings, not rows, so there is
+  -- nothing to reference even in principle.
+  connection_id VARCHAR(36) NULL,
+  connection_name VARCHAR(80) NULL,
+  queue_name VARCHAR(255) NULL,
+  job_id VARCHAR(255) NULL,
+  result VARCHAR(10) NOT NULL DEFAULT 'ok',
+  error_message VARCHAR(500) NULL,
+  detail JSON NULL,
+  ip VARCHAR(45) NULL,
+  user_agent VARCHAR(255) NULL,
+  PRIMARY KEY (id),
+  -- The main query is "newest first, optionally filtered". Paging is keyset on
+  -- (created_at, id), so this index serves both the ordering and the cursor.
+  KEY audit_log_created_at_idx (created_at, id),
+  KEY audit_log_actor_id_idx (actor_id),
+  KEY audit_log_queue_idx (connection_id, queue_name)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci

package/migrations/mysql/0005_sso.sql

@@ -0,0 +1,48 @@
+-- SSO (Pro): the customer's admin registers their own identity provider from
+-- the Settings UI, so a self-hosted install can fix a bad issuer in the browser
+-- instead of editing a compose file and redeploying.
+--
+-- WHY THE CONFIG IS A JSON COLUMN: the two protocols share almost no fields
+-- (OIDC has issuer/client_id/scopes, SAML has entry_point/idp_cert), the shape
+-- is validated by zod in @bullpane/shared before it ever reaches here, and no
+-- query ever filters on a field inside it — providers are read whole, by id or
+-- as a short list. Columns per protocol would mean half the table NULL and a
+-- migration for every IdP quirk.
+--
+-- WHY THE SECRET IS ENCRYPTED AND NOT HASHED: we have to SEND the OIDC client
+-- secret to the token endpoint, so it must be recoverable — unlike a password,
+-- which only ever needs comparing. It is stored AES-256-GCM with a key derived
+-- (HKDF) from SESSION_SECRET, in `secret_enc`, and is never returned by the API
+-- (SsoProvider.hasSecret is the only thing the UI learns). Consequence the
+-- operator must know: rotating SESSION_SECRET makes existing secrets
+-- undecryptable and every provider has to have its secret re-entered.
+-- SAML needs no secret: it verifies the IdP's signature with a public cert,
+-- which lives in `config` in the clear on purpose.
+
+CREATE TABLE IF NOT EXISTS sso_providers (
+  id VARCHAR(36) NOT NULL,
+  kind VARCHAR(10) NOT NULL,
+  name VARCHAR(60) NOT NULL,
+  enabled TINYINT(1) NOT NULL DEFAULT 1,
+  config JSON NOT NULL,
+  -- AES-256-GCM ciphertext (iv.tag.data, base64url). NULL for SAML, and for an
+  -- OIDC row whose secret has not been set yet.
+  secret_enc TEXT NULL,
+  created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+  updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+  PRIMARY KEY (id),
+  -- The login page lists enabled providers on every render; keep it off a scan.
+  KEY sso_providers_enabled_idx (enabled)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+-- A user who only ever signs in through the IdP has no password, and inventing
+-- one for them (a) is a credential nobody rotates and (b) is exactly the
+-- friction SSO exists to remove. So the column becomes nullable; verifyPassword
+-- refuses a NULL hash outright, which means such an account CANNOT fall back to
+-- the password form even when the escape hatch is open.
+ALTER TABLE users MODIFY password_hash VARCHAR(255) NULL;
+
+-- How each live session was authenticated, so the audit log can say "signed in
+-- with SSO" and a future forced-logout-on-SSO-change can target the right rows.
+-- Existing sessions predate SSO, so 'password' is the correct backfill.
+ALTER TABLE sessions ADD COLUMN auth_method VARCHAR(10) NOT NULL DEFAULT 'password';

package/migrations/mysql/0006_connection_position.sql

@@ -0,0 +1,29 @@
+-- Manual ordering for connections in the sidebar.
+--
+-- Deliberately NOT a per-user preference, and for the same reason as
+-- `hidden_queues`: if a lead puts the production Redis at the top, it is at the
+-- top for everyone. A sidebar whose order differs per person is a liability in
+-- the middle of an incident, when one person is reading another's screen share.
+--
+-- `folders` already had `position` with these exact semantics; connections were
+-- the odd one out, ordered by `created_at`, which meant the order was decided by
+-- the accident of which Redis was added first and could never be changed.
+--
+-- Backfill: existing rows keep their current visible order. They were sorted by
+-- `created_at`, so numbering them in that order makes this migration invisible.
+--
+-- WHY A SELF-JOIN AND NOT `SET @row := -1`: the migrator runs each statement
+-- through `pool.query()`, and a pool hands out an arbitrary connection per call.
+-- A user variable set in one statement would be NULL in the next one, silently
+-- backfilling every row to 0. This counts predecessors per row instead, so it is
+-- correct as a SINGLE statement regardless of which connection runs it.
+
+ALTER TABLE connections ADD COLUMN position INT NOT NULL DEFAULT 0;
+
+UPDATE connections AS c
+SET position = (
+  SELECT COUNT(*)
+  FROM (SELECT id, created_at FROM connections) AS earlier
+  WHERE earlier.created_at < c.created_at
+     OR (earlier.created_at = c.created_at AND earlier.id < c.id)
+);

package/migrations/mysql/0007_user_disabled.sql

@@ -0,0 +1,12 @@
+-- Users are disabled, never deleted.
+--
+-- A deleted row takes the id with it, and the id is what everything else
+-- remembers: audit rows name their actor by id, alert history and folder
+-- ownership point at whoever created them, and an admin re-inviting the same
+-- email got a NEW id that matched none of it. Disabling keeps the row, revokes
+-- every session and refuses the next login (password or SSO), and can be undone.
+--
+-- Nullable timestamp rather than a boolean: "since when" is the first question
+-- on the users page, and NULL stays the common case so no backfill is needed.
+
+ALTER TABLE users ADD COLUMN disabled_at DATETIME(3) NULL;

package/migrations/mysql/0008_alert_wide_scopes.sql

@@ -0,0 +1,18 @@
+-- Alert rules can now cover every queue on one connection, or every queue on
+-- every connection. They are also what drives "Needs attention" on the
+-- Overview in Pro, so a rule with no channels (dashboard only) is valid.
+--
+-- `connection` reuses connection_id with queue_name NULL; `global` uses no
+-- column at all. Hidden queues are excluded from both at evaluation time.
+ALTER TABLE alerts MODIFY scope_type ENUM('queue','folder','connection','global') NOT NULL DEFAULT 'queue';
+
+-- One starting rule, so the Overview has something to say on day one:
+-- failure rate above 10% over 15 minutes on any queue with at least 20
+-- finished jobs, measured from BullMQ metrics, notifying nobody. Only
+-- inserted when the install has no alerts yet; edit or delete it freely.
+INSERT INTO alerts (id, name, enabled, scope_type, connection_id, queue_name, folder_id, `condition`, channels, cooldown_minutes, created_at, last_fired_at, firing)
+SELECT 'default-failure-rate', 'Failure rate above 10%', 1, 'global', NULL, NULL, NULL,
+       JSON_OBJECT('kind', 'failed_rate_above', 'percent', 10, 'windowMinutes', 15, 'minSample', 20),
+       JSON_ARRAY(), 30, UTC_TIMESTAMP(3), NULL, 0
+FROM DUAL
+WHERE NOT EXISTS (SELECT 1 FROM alerts);

package/migrations/mysql/0009_mcp.sql

@@ -0,0 +1,62 @@
+-- MCP (Pro): Claude and other MCP clients connect to /mcp with OAuth 2.1. The
+-- user signs in to Bullpane the way they always do (password or SSO), approves
+-- the client on a consent screen, and the client gets tokens tied to that user.
+--
+-- THREE TABLES, AND WHY NOT AN ACCESS-TOKEN TABLE. Access tokens are short-lived
+-- (1 h) and signed (HMAC, key derived from SESSION_SECRET) with the grant id
+-- inside, so a call needs no lookup of the token itself. It still loads the grant
+-- and its user on every call — that is what makes revoking a client, disabling a
+-- user or lowering the admin's ceiling take effect at once instead of at expiry.
+--
+--  * mcp_clients     : dynamically registered clients (RFC 7591). Public clients,
+--                      no secret: PKCE is what binds the code to the client.
+--  * mcp_auth_codes  : single-use authorization codes, 60 s. In MySQL rather than
+--                      in memory so two replicas behind a load balancer work.
+--  * mcp_grants      : one row per approved consent = one refresh-token family.
+--                      Refresh tokens rotate on use; presenting the previous one
+--                      again means it leaked, and the whole grant is deleted.
+--
+-- Codes and refresh tokens are stored as SHA-256 hashes: a database dump does
+-- not yield a usable token.
+
+CREATE TABLE IF NOT EXISTS mcp_clients (
+  id VARCHAR(64) NOT NULL,
+  name VARCHAR(120) NOT NULL,
+  redirect_uris JSON NOT NULL,
+  created_at DATETIME(3) NOT NULL,
+  PRIMARY KEY (id),
+  KEY mcp_clients_created_at_idx (created_at)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE IF NOT EXISTS mcp_auth_codes (
+  code_hash VARCHAR(64) NOT NULL,
+  client_id VARCHAR(64) NOT NULL,
+  user_id VARCHAR(36) NOT NULL,
+  access VARCHAR(10) NOT NULL,
+  redirect_uri VARCHAR(2048) NOT NULL,
+  code_challenge VARCHAR(128) NOT NULL,
+  expires_at DATETIME(3) NOT NULL,
+  PRIMARY KEY (code_hash),
+  KEY mcp_auth_codes_expires_at_idx (expires_at),
+  CONSTRAINT mcp_auth_codes_user_fk FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE,
+  CONSTRAINT mcp_auth_codes_client_fk FOREIGN KEY (client_id) REFERENCES mcp_clients (id) ON DELETE CASCADE
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE IF NOT EXISTS mcp_grants (
+  id VARCHAR(36) NOT NULL,
+  client_id VARCHAR(64) NOT NULL,
+  user_id VARCHAR(36) NOT NULL,
+  access VARCHAR(10) NOT NULL,
+  refresh_hash VARCHAR(64) NOT NULL,
+  -- the refresh token this one replaced; seeing it again = reuse = revoke
+  prev_refresh_hash VARCHAR(64) NULL,
+  refresh_expires_at DATETIME(3) NOT NULL,
+  created_at DATETIME(3) NOT NULL,
+  last_used_at DATETIME(3) NULL,
+  PRIMARY KEY (id),
+  UNIQUE KEY mcp_grants_refresh_hash_unique (refresh_hash),
+  KEY mcp_grants_prev_refresh_hash_idx (prev_refresh_hash),
+  KEY mcp_grants_user_id_idx (user_id),
+  CONSTRAINT mcp_grants_user_fk FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE,
+  CONSTRAINT mcp_grants_client_fk FOREIGN KEY (client_id) REFERENCES mcp_clients (id) ON DELETE CASCADE
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

package/migrations/sqlite/0001_init.sql

@@ -0,0 +1,158 @@
+-- Bullpane — SQLite schema, the zero-setup default when DATABASE_URL is unset.
+--
+-- This is the MySQL schema as of migrations/mysql/0008, created in one go: a
+-- SQLite install has no history to replay. The reasoning behind each table and
+-- column lives in the MySQL migration that introduced it; this file only notes
+-- where SQLite differs.
+--
+-- Type mapping (see src/db/schema.sqlite.ts): DATETIME(3) → INTEGER epoch ms,
+-- TINYINT(1) → INTEGER 0/1, JSON → TEXT, ENUM/VARCHAR → TEXT with a CHECK where
+-- MySQL had an ENUM. Foreign keys are declared for documentation; the services
+-- delete child rows explicitly, so nothing depends on them being enforced.
+
+CREATE TABLE IF NOT EXISTS users (
+  id TEXT NOT NULL PRIMARY KEY,
+  email TEXT NOT NULL,
+  name TEXT NOT NULL,
+  password_hash TEXT NULL,
+  role TEXT NOT NULL DEFAULT 'viewer' CHECK (role IN ('admin', 'operator', 'viewer')),
+  created_at INTEGER NOT NULL DEFAULT (CAST(unixepoch('subsec') * 1000 AS INTEGER)),
+  last_login_at INTEGER NULL,
+  disabled_at INTEGER NULL
+);
+CREATE UNIQUE INDEX IF NOT EXISTS users_email_unique ON users (email);
+
+CREATE TABLE IF NOT EXISTS sessions (
+  id TEXT NOT NULL PRIMARY KEY,
+  user_id TEXT NOT NULL REFERENCES users (id) ON DELETE CASCADE,
+  expires_at INTEGER NOT NULL,
+  created_at INTEGER NOT NULL DEFAULT (CAST(unixepoch('subsec') * 1000 AS INTEGER)),
+  auth_method TEXT NOT NULL DEFAULT 'password'
+);
+CREATE INDEX IF NOT EXISTS sessions_user_id_idx ON sessions (user_id);
+CREATE INDEX IF NOT EXISTS sessions_expires_at_idx ON sessions (expires_at);
+
+CREATE TABLE IF NOT EXISTS sso_providers (
+  id TEXT NOT NULL PRIMARY KEY,
+  kind TEXT NOT NULL,
+  name TEXT NOT NULL,
+  enabled INTEGER NOT NULL DEFAULT 1,
+  config TEXT NOT NULL,
+  secret_enc TEXT NULL,
+  created_at INTEGER NOT NULL DEFAULT (CAST(unixepoch('subsec') * 1000 AS INTEGER)),
+  updated_at INTEGER NOT NULL DEFAULT (CAST(unixepoch('subsec') * 1000 AS INTEGER))
+);
+CREATE INDEX IF NOT EXISTS sso_providers_enabled_idx ON sso_providers (enabled);
+
+CREATE TABLE IF NOT EXISTS connections (
+  id TEXT NOT NULL PRIMARY KEY,
+  name TEXT NOT NULL,
+  url TEXT NOT NULL,
+  prefix TEXT NOT NULL DEFAULT 'bull',
+  cluster INTEGER NOT NULL DEFAULT 0,
+  queue_filter TEXT NULL,
+  position INTEGER NOT NULL DEFAULT 0,
+  created_at INTEGER NOT NULL DEFAULT (CAST(unixepoch('subsec') * 1000 AS INTEGER))
+);
+
+CREATE TABLE IF NOT EXISTS folders (
+  id TEXT NOT NULL PRIMARY KEY,
+  name TEXT NOT NULL,
+  color TEXT NULL,
+  parent_id TEXT NULL,
+  position INTEGER NOT NULL DEFAULT 0
+);
+CREATE INDEX IF NOT EXISTS folders_parent_id_idx ON folders (parent_id);
+
+CREATE TABLE IF NOT EXISTS folder_queues (
+  folder_id TEXT NOT NULL REFERENCES folders (id) ON DELETE CASCADE,
+  connection_id TEXT NOT NULL,
+  queue_name TEXT NOT NULL,
+  PRIMARY KEY (folder_id, connection_id, queue_name)
+);
+
+CREATE TABLE IF NOT EXISTS hidden_queues (
+  connection_id TEXT NOT NULL,
+  queue_name TEXT NOT NULL,
+  hidden_at INTEGER NOT NULL DEFAULT (CAST(unixepoch('subsec') * 1000 AS INTEGER)),
+  hidden_by TEXT NULL,
+  PRIMARY KEY (connection_id, queue_name)
+);
+
+CREATE TABLE IF NOT EXISTS alerts (
+  id TEXT NOT NULL PRIMARY KEY,
+  name TEXT NOT NULL,
+  enabled INTEGER NOT NULL DEFAULT 1,
+  scope_type TEXT NOT NULL DEFAULT 'queue' CHECK (scope_type IN ('queue', 'folder', 'connection', 'global')),
+  connection_id TEXT NULL,
+  queue_name TEXT NULL,
+  folder_id TEXT NULL,
+  "condition" TEXT NOT NULL,
+  channels TEXT NOT NULL,
+  cooldown_minutes INTEGER NOT NULL DEFAULT 30,
+  created_at INTEGER NOT NULL DEFAULT (CAST(unixepoch('subsec') * 1000 AS INTEGER)),
+  last_fired_at INTEGER NULL,
+  firing INTEGER NOT NULL DEFAULT 0
+);
+CREATE INDEX IF NOT EXISTS alerts_connection_id_idx ON alerts (connection_id);
+CREATE INDEX IF NOT EXISTS alerts_folder_id_idx ON alerts (folder_id);
+
+CREATE TABLE IF NOT EXISTS alert_events (
+  id TEXT NOT NULL PRIMARY KEY,
+  alert_id TEXT NOT NULL,
+  alert_name TEXT NOT NULL,
+  connection_id TEXT NULL,
+  queue_name TEXT NULL,
+  kind TEXT NOT NULL,
+  status TEXT NOT NULL,
+  message TEXT NOT NULL,
+  value REAL NULL,
+  created_at INTEGER NOT NULL DEFAULT (CAST(unixepoch('subsec') * 1000 AS INTEGER))
+);
+CREATE INDEX IF NOT EXISTS alert_events_created_at_idx ON alert_events (created_at);
+CREATE INDEX IF NOT EXISTS alert_events_alert_id_idx ON alert_events (alert_id);
+
+CREATE TABLE IF NOT EXISTS audit_log (
+  id TEXT NOT NULL PRIMARY KEY,
+  created_at INTEGER NOT NULL DEFAULT (CAST(unixepoch('subsec') * 1000 AS INTEGER)),
+  actor_id TEXT NULL,
+  actor_email TEXT NULL,
+  actor_name TEXT NULL,
+  actor_role TEXT NULL,
+  action TEXT NOT NULL,
+  connection_id TEXT NULL,
+  connection_name TEXT NULL,
+  queue_name TEXT NULL,
+  job_id TEXT NULL,
+  result TEXT NOT NULL DEFAULT 'ok',
+  error_message TEXT NULL,
+  detail TEXT NULL,
+  ip TEXT NULL,
+  user_agent TEXT NULL
+);
+-- Keyset paging on (created_at, id), newest first — same index as MySQL.
+CREATE INDEX IF NOT EXISTS audit_log_created_at_idx ON audit_log (created_at, id);
+CREATE INDEX IF NOT EXISTS audit_log_actor_id_idx ON audit_log (actor_id);
+CREATE INDEX IF NOT EXISTS audit_log_queue_idx ON audit_log (connection_id, queue_name);
+
+CREATE TABLE IF NOT EXISTS flow_edges (
+  id TEXT NOT NULL PRIMARY KEY,
+  connection_id TEXT NOT NULL,
+  from_queue TEXT NOT NULL,
+  to_queue TEXT NOT NULL,
+  label TEXT NULL,
+  created_at INTEGER NOT NULL DEFAULT (CAST(unixepoch('subsec') * 1000 AS INTEGER))
+);
+CREATE UNIQUE INDEX IF NOT EXISTS flow_edges_unique ON flow_edges (connection_id, from_queue, to_queue);
+
+CREATE TABLE IF NOT EXISTS settings (
+  "key" TEXT NOT NULL PRIMARY KEY,
+  value TEXT NOT NULL
+);
+
+-- The starting alert rule from migrations/mysql/0008_alert_wide_scopes.sql.
+INSERT INTO alerts (id, name, enabled, scope_type, connection_id, queue_name, folder_id, "condition", channels, cooldown_minutes, created_at, last_fired_at, firing)
+SELECT 'default-failure-rate', 'Failure rate above 10%', 1, 'global', NULL, NULL, NULL,
+       json_object('kind', 'failed_rate_above', 'percent', 10, 'windowMinutes', 15, 'minSample', 20),
+       json_array(), 30, CAST(unixepoch('subsec') * 1000 AS INTEGER), NULL, 0
+WHERE NOT EXISTS (SELECT 1 FROM alerts);

package/migrations/sqlite/0002_mcp.sql

@@ -0,0 +1,38 @@
+-- MCP (Pro): OAuth clients, single-use authorization codes and grants.
+-- Same tables as migrations/mysql/0009_mcp.sql, which explains the design
+-- (why there is no access-token table, why codes and refresh tokens are hashes).
+
+CREATE TABLE IF NOT EXISTS mcp_clients (
+  id TEXT NOT NULL PRIMARY KEY,
+  name TEXT NOT NULL,
+  redirect_uris TEXT NOT NULL,
+  created_at INTEGER NOT NULL
+);
+CREATE INDEX IF NOT EXISTS mcp_clients_created_at_idx ON mcp_clients (created_at);
+
+CREATE TABLE IF NOT EXISTS mcp_auth_codes (
+  code_hash TEXT NOT NULL PRIMARY KEY,
+  client_id TEXT NOT NULL REFERENCES mcp_clients (id) ON DELETE CASCADE,
+  user_id TEXT NOT NULL REFERENCES users (id) ON DELETE CASCADE,
+  access TEXT NOT NULL,
+  redirect_uri TEXT NOT NULL,
+  code_challenge TEXT NOT NULL,
+  expires_at INTEGER NOT NULL
+);
+CREATE INDEX IF NOT EXISTS mcp_auth_codes_expires_at_idx ON mcp_auth_codes (expires_at);
+
+CREATE TABLE IF NOT EXISTS mcp_grants (
+  id TEXT NOT NULL PRIMARY KEY,
+  client_id TEXT NOT NULL REFERENCES mcp_clients (id) ON DELETE CASCADE,
+  user_id TEXT NOT NULL REFERENCES users (id) ON DELETE CASCADE,
+  access TEXT NOT NULL,
+  refresh_hash TEXT NOT NULL,
+  -- the refresh token this one replaced; seeing it again = reuse = revoke
+  prev_refresh_hash TEXT NULL,
+  refresh_expires_at INTEGER NOT NULL,
+  created_at INTEGER NOT NULL,
+  last_used_at INTEGER NULL
+);
+CREATE UNIQUE INDEX IF NOT EXISTS mcp_grants_refresh_hash_unique ON mcp_grants (refresh_hash);
+CREATE INDEX IF NOT EXISTS mcp_grants_prev_refresh_hash_idx ON mcp_grants (prev_refresh_hash);
+CREATE INDEX IF NOT EXISTS mcp_grants_user_id_idx ON mcp_grants (user_id);

package/package.json

@@ -0,0 +1,56 @@
+{
+  "name": "bullpane",
+  "version": "0.5.1",
+  "description": "Self-hosted dashboard for BullMQ and BullMQ Pro: queues, jobs, failures, metrics, Redis health, flows and Pro groups. A bull-board alternative you can run with npx.",
+  "keywords": [
+    "bullmq",
+    "bullmq-pro",
+    "bull",
+    "dashboard",
+    "ui",
+    "queue",
+    "redis",
+    "jobs",
+    "monitoring",
+    "bull-board",
+    "admin",
+    "self-hosted"
+  ],
+  "homepage": "https://bullpane.com",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/madmorett/bullpane.git"
+  },
+  "bugs": "https://github.com/madmorett/bullpane/issues",
+  "license": "SEE LICENSE IN LICENSE",
+  "type": "module",
+  "bin": {
+    "bullpane": "bin/bullpane.mjs"
+  },
+  "files": [
+    "bin",
+    "dist",
+    "migrations",
+    "web",
+    "README.md",
+    "LICENSE",
+    "LICENSE-ee"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "dependencies": {
+    "@fastify/cookie": "^11.0.1",
+    "@fastify/static": "^8.0.3",
+    "@libsql/client": "^0.18.0",
+    "@node-saml/node-saml": "^5.1.0",
+    "bcryptjs": "^2.4.3",
+    "bullmq": "^6.3.4",
+    "drizzle-orm": "^0.38.3",
+    "fastify": "^5.2.0",
+    "ioredis": "^5.4.2",
+    "mysql2": "^3.11.5",
+    "nanoid": "^5.0.9",
+    "zod": "^3.24.1"
+  }
+}

package/web/assets/FlowsPage-CxMz_9Et.js

@@ -0,0 +1,6 @@
+import{c as ae,u as $,a as Z,j as e,L as G,P as _,S as J,E as A,W as O,N as ne,r as N,b as oe,d as re,e as le,f as c,g as ie,h as de,i as ce,k as S,l as v,B as b,R as ue,m as me,n as F,I as xe,o as R,p as K,q as U,t as E,T as ge,s as P,v as X,D as he,w as pe,x as fe}from"./index-DuAopWKm.js";import{u as be,a as je,l as H,i as ve,B as Ne,b as we,C as ye,M as ke,c as Ce,H as V,P as Q}from"./flowLayout-DoC2dCG0.js";/**
+ * @license lucide-react v0.469.0 - ISC
+ *
+ * This source code is licensed under the ISC license.
+ * See the LICENSE file in the root directory of this source tree.
+ */const Ee=ae("Link2",[["path",{d:"M9 17H7A5 5 0 0 1 7 7h2",key:"8i5ue5"}],["path",{d:"M15 7h2a5 5 0 1 1 0 10h-2",key:"1b9ql8"}],["line",{x1:"8",x2:"16",y1:"12",y2:"12",key:"1jonct"}]]),B=220,I=84;function Me(){var i;const{has:t}=$(),o=Z();if(!t("flows"))return e.jsx(G,{feature:"flows"});if(o.isLoading)return e.jsx(_,{children:e.jsx(J,{label:"Loading…"})});const u=(i=o.data)==null?void 0:i[0];return u?e.jsx(ne,{to:N.flows(u.id),replace:!0}):e.jsx(_,{children:e.jsx(A,{icon:e.jsx(O,{}),title:"No connections",description:"Add a Redis connection first; flows are detected per connection."})})}function Ae(){const{has:t}=$();return t("flows")?e.jsx(Le,{}):e.jsx(G,{feature:"flows"})}const Se=c.memo(function({data:o,selected:u}){const{node:i,connectionId:p}=o,m=i.counts;return e.jsxs("div",{className:X("rounded-lg border bg-surface px-3 py-2 text-fg shadow-sm transition-colors",u?"border-accent ring-2 ring-accent/30":"border-border-strong",i.isPaused&&"border-dashed"),style:{width:B,height:I},children:[e.jsx(V,{type:"target",position:Q.Left,className:"!size-2 !border-0 !bg-fg-subtle"}),e.jsxs("div",{className:"flex items-center gap-2",children:[e.jsx("span",{className:"truncate text-[13px] font-semibold",title:i.queueName,children:i.queueName}),i.isPaused&&e.jsx(R,{variant:"warning",size:"xs",className:"ml-auto",children:"paused"})]}),e.jsxs("div",{className:"mt-1.5 grid grid-cols-3 gap-1 text-[11px]",children:[e.jsx(M,{label:"waiting",value:m.waiting+m.prioritized,tone:P.waiting.textClass}),e.jsx(M,{label:"active",value:m.active,tone:P.active.textClass}),e.jsx(M,{label:"failed",value:m.failed,tone:m.failed>0?P.failed.textClass:"text-fg-subtle"})]}),e.jsx(K,{to:N.queue(p,i.queueName),className:"absolute top-1.5 right-1.5 rounded p-0.5 text-fg-subtle hover:text-fg",title:"Open queue","aria-label":"Open queue",children:e.jsx(U,{className:"size-3"})}),e.jsx(V,{type:"source",position:Q.Right,className:"!size-2 !border-0 !bg-fg-subtle"})]})});function M({label:t,value:o,tone:u}){return e.jsxs("span",{className:"flex flex-col leading-tight",children:[e.jsx("span",{className:X("num font-semibold",u),children:fe(o)}),e.jsx("span",{className:"text-[10px] text-fg-subtle",children:t})]})}const qe={queue:Se};function ze(t){const o=t.source==="manual";return{id:t.id,source:t.from,target:t.to,type:"smoothstep",data:{edge:t},label:o?t.label??void 0:`×${v(t.evidence)}${t.label?` · ${t.label}`:""}`,labelStyle:{fontSize:10,fill:"var(--fg-muted)"},labelBgStyle:{fill:"var(--surface)",fillOpacity:.9},labelBgPadding:[4,2],labelBgBorderRadius:3,style:o?{stroke:"var(--accent)",strokeDasharray:"6 4",strokeWidth:1.5}:{stroke:"var(--fg-subtle)",strokeWidth:Math.min(4,1+Math.log10(Math.max(1,t.evidence)))},markerEnd:{type:Ce.ArrowClosed,color:o?"var(--accent)":"var(--fg-subtle)",width:16,height:16},animated:!1}}function Le(){var W,T;const{connectionId:t=""}=oe(),o=re(),{isOperator:u}=le(),i=Z(),[p,m]=c.useState(200),n=ie(t,p),w=de(),g=ce(),[q,h,z]=be([]),[y,r,L]=je([]),k=c.useRef(new Map),[d,j]=c.useState(null),[f,C]=c.useState(null),[Y,D]=c.useState(!1);c.useEffect(()=>{const s=n.data;if(!s)return;const l=H(s.nodes.map(a=>({id:a.id})),s.edges.map(a=>({from:a.from,to:a.to})),{nodeWidth:B,nodeHeight:I});h(s.nodes.map(a=>{const x=k.current.get(a.id)??l.get(a.id)??{x:0,y:0};return{id:a.id,type:"queue",position:{x:x.x,y:x.y},data:{node:a,connectionId:t},draggable:!0}})),r(s.edges.map(ze)),j(a=>a?s.edges.find(x=>x.id===a.id)??null:null),C(a=>a?s.nodes.find(x=>x.id===a.id)??null:null)},[n.data,t,h,r]),c.useEffect(()=>{k.current.clear()},[t]);const ee=c.useCallback(()=>{k.current.clear();const s=n.data;if(!s)return;const l=H(s.nodes.map(a=>({id:a.id})),s.edges.map(a=>({from:a.from,to:a.to})),{nodeWidth:B,nodeHeight:I});h(a=>a.map(x=>({...x,position:l.get(x.id)??x.position})))},[n.data,h]),se=((W=n.data)==null?void 0:W.edges.filter(s=>s.source==="detected").length)??0,te=((T=n.data)==null?void 0:T.edges.filter(s=>s.source==="manual").length)??0;return e.jsxs("div",{className:"flex h-full flex-col",children:[e.jsxs("div",{className:"flex flex-wrap items-center gap-2 border-b border-border bg-surface px-4 py-2",children:[e.jsx(O,{className:"size-4 text-pro","aria-hidden":!0}),e.jsx("h1",{className:"text-sm font-semibold",children:"Flows"}),e.jsx(S,{"aria-label":"Connection",className:"!h-7 !w-auto text-xs",value:t,onChange:s=>o(N.flows(s.target.value)),options:(i.data??[]).map(s=>({value:s.id,label:s.name}))}),e.jsx(S,{"aria-label":"Sample size",className:"!h-7 !w-auto text-xs",value:String(p),onChange:s=>m(Number(s.target.value)),options:[50,200,500,1e3].map(s=>({value:String(s),label:`sample ${s} jobs/queue`}))}),e.jsx("span",{className:"text-xs text-fg-muted",children:n.data?e.jsxs(e.Fragment,{children:[v(n.data.nodes.length)," queues · ",se," detected · ",te," manual · sampled ",v(n.data.sampledJobs)," jobs"]}):n.isLoading?e.jsx(J,{label:"Detecting flows…"}):null}),e.jsxs("div",{className:"ml-auto flex items-center gap-2",children:[e.jsx(b,{size:"sm",variant:"ghost",leftIcon:e.jsx(ue,{}),onClick:()=>n.refetch(),loading:n.isFetching,children:"Refresh"}),e.jsx(b,{size:"sm",variant:"ghost",onClick:ee,children:"Re-layout"}),u&&e.jsx(b,{size:"sm",variant:"primary",leftIcon:e.jsx(me,{}),onClick:()=>D(!0),disabled:!n.data||n.data.nodes.length<2,children:"Add edge"})]})]}),e.jsxs("div",{className:"relative min-h-0 flex-1",children:[n.isError&&!n.data&&e.jsx("div",{className:"absolute inset-0 z-10 flex items-center justify-center",children:e.jsx(A,{title:"Could not load flows",description:F(n.error)})}),n.data&&n.data.nodes.length===0&&e.jsx("div",{className:"absolute inset-0 z-10 flex items-center justify-center",children:e.jsx(A,{icon:e.jsx(O,{}),title:"No queues on this connection",description:"Flows are built from the queues discovered on the connection."})}),e.jsxs(ve,{nodes:q,edges:y,nodeTypes:qe,onNodesChange:z,onEdgesChange:L,onNodeDragStop:(s,l)=>k.current.set(l.id,l.position),onEdgeClick:(s,l)=>{var a;j(((a=l.data)==null?void 0:a.edge)??null),C(null)},onNodeClick:(s,l)=>{C(l.data.node),j(null)},onPaneClick:()=>{j(null),C(null)},onNodeDoubleClick:(s,l)=>o(N.queue(t,l.data.node.queueName)),fitView:!0,fitViewOptions:{padding:.2,maxZoom:1},minZoom:.2,maxZoom:1.75,nodesConnectable:!1,proOptions:{hideAttribution:!0},colorMode:"system",className:"bg-bg",children:[e.jsx(Ne,{variant:we.Dots,gap:20,size:1}),e.jsx(ye,{showInteractive:!1,position:"bottom-right"}),e.jsx(ke,{pannable:!0,zoomable:!0,position:"bottom-left",nodeColor:()=>"var(--surface-3)",maskColor:"color-mix(in srgb, var(--bg) 70%, transparent)",style:{width:160,height:100}})]}),e.jsxs("div",{className:"pointer-events-none absolute top-3 left-3 flex flex-col gap-2",children:[e.jsxs("div",{className:"pointer-events-auto rounded-md border border-border bg-surface/95 px-3 py-2 text-[11px] text-fg-muted shadow-sm",children:[e.jsx("div",{className:"mb-1 font-semibold tracking-wider text-fg-subtle uppercase",children:"Legend"}),e.jsxs("div",{className:"flex items-center gap-2",children:[e.jsx("svg",{width:"36",height:"8",children:e.jsx("line",{x1:"0",y1:"4",x2:"36",y2:"4",stroke:"var(--fg-subtle)",strokeWidth:"2"})}),"detected · ",e.jsx("span",{className:"font-mono",children:"×n"})," = jobs evidencing it"]}),e.jsxs("div",{className:"mt-1 flex items-center gap-2",children:[e.jsx("svg",{width:"36",height:"8",children:e.jsx("line",{x1:"0",y1:"4",x2:"36",y2:"4",stroke:"var(--accent)",strokeWidth:"1.5",strokeDasharray:"6 4"})}),"manual edge"]}),e.jsxs("div",{className:"mt-1 flex items-center gap-2",children:[e.jsx("span",{className:"inline-block h-3 w-9 rounded border border-dashed border-border-strong"})," paused queue"]})]}),e.jsxs("div",{className:"pointer-events-auto flex max-w-sm items-start gap-2 rounded-md border border-border bg-surface/95 px-3 py-2 text-[11px] text-fg-muted shadow-sm",children:[e.jsx(xe,{className:"mt-px size-3.5 shrink-0 text-info","aria-hidden":!0}),e.jsxs("span",{children:["Detected edges come from BullMQ flows: children carry a ",e.jsx("span",{className:"font-mono",children:"parent"})," reference, so the arrow points from the child queue to the parent that waits for it. A worker that simply calls ",e.jsx("span",{className:"font-mono",children:"otherQueue.add()"})," leaves no trace in Redis; draw those with a manual edge. Double-click a queue to open it."]})]})]}),(d||f)&&e.jsxs("div",{className:"absolute top-3 right-3 w-72 rounded-lg border border-border bg-surface p-3 text-xs shadow-[var(--shadow)]",children:[f&&e.jsxs(e.Fragment,{children:[e.jsxs("div",{className:"mb-2 flex items-center justify-between",children:[e.jsx("span",{className:"text-sm font-semibold",children:f.queueName}),f.isPaused&&e.jsx(R,{variant:"warning",size:"xs",children:"paused"})]}),e.jsx("dl",{className:"grid grid-cols-2 gap-x-3 gap-y-1 text-fg-muted",children:Object.entries(f.counts).map(([s,l])=>e.jsxs("div",{className:"flex justify-between border-b border-border/60 py-0.5",children:[e.jsx("dt",{children:s}),e.jsx("dd",{className:"num text-fg",children:v(l)})]},s))}),e.jsxs(K,{to:N.queue(t,f.queueName),className:"mt-3 inline-flex items-center gap-1 text-accent hover:underline",children:["Open queue ",e.jsx(U,{className:"size-3"})]})]}),d&&e.jsxs(e.Fragment,{children:[e.jsxs("div",{className:"mb-2 flex items-center gap-2",children:[e.jsx(Ee,{className:"size-4 text-fg-subtle","aria-hidden":!0}),e.jsxs("span",{className:"font-mono text-[13px] font-semibold",children:[d.from," → ",d.to]})]}),e.jsxs("div",{className:"space-y-1 text-fg-muted",children:[e.jsxs("p",{children:["Source: ",e.jsx(R,{variant:d.source==="manual"?"accent":"neutral",size:"xs",children:d.source})]}),d.source==="detected"&&e.jsxs("p",{children:["Evidence: ",v(d.evidence)," sampled jobs referenced this parent."]}),d.label&&e.jsxs("p",{children:["Label: ",d.label]})]}),d.source==="manual"&&u&&e.jsx(b,{size:"sm",variant:"ghost",className:"mt-3 hover:text-danger",leftIcon:e.jsx(ge,{}),loading:g.isPending,onClick:()=>g.mutate(d.id,{onSuccess:()=>(j(null),E.success("Edge removed")),onError:s=>E.error(F(s))}),children:"Delete manual edge"}),d.source==="detected"&&e.jsx("p",{className:"mt-2 text-fg-subtle",children:"Detected edges disappear on their own once no sampled job references the parent."})]})]})]}),n.data&&e.jsx(De,{open:Y,onClose:()=>D(!1),queues:n.data.nodes.map(s=>s.queueName),saving:w.isPending,onSave:(s,l,a)=>w.mutate({connectionId:t,from:s,to:l,label:a||null},{onSuccess:()=>(D(!1),E.success("Edge added")),onError:x=>E.error(F(x))})})]})}function De({open:t,onClose:o,queues:u,onSave:i,saving:p}){const m=c.useMemo(()=>[...u].sort((r,L)=>r.localeCompare(L)),[u]),[n,w]=c.useState(m[0]??""),[g,q]=c.useState(m[1]??""),[h,z]=c.useState(""),y=n===g;return e.jsx(he,{open:t,onClose:o,size:"sm",title:"Add manual edge",description:"Document a producer → consumer relationship that Redis cannot observe.",footer:e.jsxs(e.Fragment,{children:[e.jsx(b,{variant:"ghost",size:"sm",onClick:o,children:"Cancel"}),e.jsx(b,{variant:"primary",size:"sm",disabled:y||!n||!g,loading:p,onClick:()=>i(n,g,h.trim()),children:"Add edge"})]}),children:e.jsxs("div",{className:"space-y-3",children:[e.jsx(S,{label:"From (producer)",value:n,onChange:r=>w(r.target.value),options:m.map(r=>({value:r,label:r}))}),e.jsx(S,{label:"To (consumer)",value:g,onChange:r=>q(r.target.value),options:m.map(r=>({value:r,label:r})),error:y?"Pick two different queues":void 0}),e.jsx(pe,{label:"Label (optional)",value:h,onChange:r=>z(r.target.value),maxLength:120,placeholder:"e.g. enqueues on success"})]})})}export{Me as FlowsIndexPage,Ae as FlowsPage};