bunqueue 2.8.48 → 2.8.50

package/dist/client/workflow/workflowDefinition.js

@@ -0,0 +1,123 @@
+/**
+ * Stable workflow-definition identity and sealing.
+ *
+ * Executions persist the hash produced here. It describes the durable graph, while
+ * `revision` lets callers explicitly mark handler/condition changes that cannot be
+ * inferred safely from closures.
+ */
+import { createHash } from 'node:crypto';
+function stepShape(def) {
+    return {
+        name: def.name,
+        retry: def.retry,
+        timeout: def.timeout,
+        compensates: def.compensate !== undefined,
+        validatesInput: def.inputSchema !== undefined,
+        validatesOutput: def.outputSchema !== undefined,
+    };
+}
+function nodeShape(node) {
+    if (node.type === 'step')
+        return { type: node.type, step: stepShape(node.def) };
+    if (node.type === 'branch') {
+        return {
+            type: node.type,
+            paths: [...node.def.paths.entries()]
+                .sort(([left], [right]) => left.localeCompare(right))
+                .map(([name, steps]) => [name, steps.map(stepShape)]),
+        };
+    }
+    if (node.type === 'parallel') {
+        return { type: node.type, steps: node.def.steps.map(stepShape) };
+    }
+    if (node.type === 'subWorkflow') {
+        return {
+            type: node.type,
+            name: node.name,
+            timeout: node.timeout,
+            pollInterval: node.pollInterval,
+        };
+    }
+    if (node.type === 'waitFor') {
+        return { type: node.type, event: node.event, timeout: node.timeout ?? null };
+    }
+    if (node.type === 'doUntil' || node.type === 'doWhile') {
+        return {
+            type: node.type,
+            maxIterations: node.def.maxIterations,
+            steps: node.def.steps.map(stepShape),
+        };
+    }
+    if (node.type === 'forEach') {
+        return {
+            type: node.type,
+            maxIterations: node.def.maxIterations,
+            step: stepShape(node.def.step),
+        };
+    }
+    if (node.type === 'map')
+        return { type: node.type, name: node.def.name };
+    return { type: 'pivot' };
+}
+export function workflowDefinitionHash(workflow) {
+    const definition = {
+        name: workflow.name,
+        revision: workflow.revision,
+        nodes: workflow.nodes.map(nodeShape),
+    };
+    return createHash('sha256').update(JSON.stringify(definition)).digest('hex');
+}
+function sealMap(map) {
+    const immutable = () => {
+        throw new Error('A registered workflow definition is sealed');
+    };
+    Object.defineProperties(map, {
+        set: { value: immutable },
+        delete: { value: immutable },
+        clear: { value: immutable },
+    });
+    Object.freeze(map);
+}
+function sealStep(def) {
+    Object.freeze(def);
+}
+function sealNode(node) {
+    if (node.type === 'step')
+        sealStep(node.def);
+    else if (node.type === 'branch') {
+        for (const steps of node.def.paths.values()) {
+            for (const step of steps)
+                sealStep(step);
+            Object.freeze(steps);
+        }
+        sealMap(node.def.paths);
+        Object.freeze(node.def);
+    }
+    else if (node.type === 'parallel') {
+        for (const step of node.def.steps)
+            sealStep(step);
+        Object.freeze(node.def.steps);
+        Object.freeze(node.def);
+    }
+    else if (node.type === 'doUntil' || node.type === 'doWhile') {
+        for (const step of node.def.steps)
+            sealStep(step);
+        Object.freeze(node.def.steps);
+        Object.freeze(node.def);
+    }
+    else if (node.type === 'forEach') {
+        sealStep(node.def.step);
+        Object.freeze(node.def);
+    }
+    else if (node.type === 'map') {
+        Object.freeze(node.def);
+    }
+    Object.freeze(node);
+}
+export function sealWorkflowDefinition(workflow) {
+    const hash = workflowDefinitionHash(workflow);
+    for (const node of workflow.nodes)
+        sealNode(node);
+    Object.freeze(workflow.nodes);
+    return hash;
+}

package/dist/client/workflow/workflowIntrospection.d.ts

@@ -0,0 +1,5 @@
+import type { WorkflowNode } from './types';
+/** Names that produce indexed records such as `name:0`. */
+export declare function indexedStepNames(nodes: readonly WorkflowNode[]): string[];
+/** Every record name declared by a workflow graph. */
+export declare function stepNames(nodes: readonly WorkflowNode[]): string[];

package/dist/client/workflow/workflowIntrospection.js

@@ -0,0 +1,46 @@
+/** Names that produce indexed records such as `name:0`. */
+export function indexedStepNames(nodes) {
+    const names = [];
+    for (const node of nodes) {
+        if (node.type === 'doUntil' || node.type === 'doWhile') {
+            for (const step of node.def.steps)
+                names.push(step.name);
+        }
+        else if (node.type === 'forEach') {
+            names.push(node.def.step.name);
+        }
+    }
+    return names;
+}
+/** Every record name declared by a workflow graph. */
+export function stepNames(nodes) {
+    const names = [];
+    for (const node of nodes) {
+        if (node.type === 'step')
+            names.push(node.def.name);
+        else if (node.type === 'branch') {
+            for (const steps of node.def.paths.values()) {
+                for (const step of steps)
+                    names.push(step.name);
+            }
+        }
+        else if (node.type === 'parallel') {
+            for (const step of node.def.steps)
+                names.push(step.name);
+        }
+        else if (node.type === 'subWorkflow') {
+            names.push(`sub:${node.name}`);
+        }
+        else if (node.type === 'doUntil' || node.type === 'doWhile') {
+            for (const step of node.def.steps)
+                names.push(step.name);
+        }
+        else if (node.type === 'forEach') {
+            names.push(node.def.step.name);
+        }
+        else if (node.type === 'map') {
+            names.push(node.def.name);
+        }
+    }
+    return names;
+}

package/dist/client/workflow/workflowValidation.d.ts

@@ -0,0 +1,44 @@
+import type { StepDefinition, WorkflowNode } from './types';
+/**
+ * Extract step definitions from an inline builder. Inline nodes run inside one
+ * `wf:step` job, so only plain steps have executable semantics there.
+ */
+export declare function onlySteps(sub: {
+    nodes: readonly WorkflowNode[];
+}, where: string, label?: string): StepDefinition[];
+/** Why an event name cannot be used as a gate, or `null` when it can. */
+export declare function unusableEventName(event: unknown): string | null;
+/**
+ * A delivered signal is retained by event name rather than consumed, so two gates
+ * sharing a name would both be opened by one delivery.
+ */
+export declare function assertNoDuplicateWaitFor(wf: {
+    name: string;
+    nodes: readonly {
+        type: string;
+        event?: string;
+    }[];
+}): void;
+type RegistrableWorkflow = {
+    name: string;
+    nodes: readonly WorkflowNode[];
+    getStepNames(): string[];
+    getIndexedStepNames(): string[];
+};
+/**
+ * Reject both engine namespace collisions and names colliding with the
+ * `name:index` records generated by loops.
+ */
+export declare function assertNoIndexCollision(wf: RegistrableWorkflow): void;
+/**
+ * `retry` is the total number of attempts. Zero/non-integral values would make the
+ * runner skip the handler and fabricate a failure record.
+ */
+export declare function assertUsableRetry(step: string, retry: number | undefined): void;
+/** Timeout values are finite milliseconds; zero deliberately means no forward bound. */
+export declare function assertUsableTimeout(where: string, timeout: number | undefined): void;
+/** Polling delays and child deadlines cannot be disabled or spin at zero. */
+export declare function assertPositiveDuration(where: string, duration: number | undefined): void;
+/** Loop limits must bound the number of body executions exactly. */
+export declare function assertUsableIterations(where: string, maxIterations: number | undefined): void;
+export {};

package/dist/client/workflow/workflowValidation.js

@@ -0,0 +1,143 @@
+/**
+ * Extract step definitions from an inline builder. Inline nodes run inside one
+ * `wf:step` job, so only plain steps have executable semantics there.
+ */
+export function onlySteps(sub, where, label) {
+    const rejected = sub.nodes.filter((node) => node.type !== 'step');
+    if (rejected.length > 0) {
+        const kinds = [...new Set(rejected.map((node) => node.type))].join(', ');
+        const which = label ? ` (path "${label}")` : '';
+        throw new Error(`${where} accepts step() nodes only${which}, but received: ${kinds}. ` +
+            `Move those nodes to the top level of the workflow, or extract them into a ` +
+            `separate workflow and call it with subWorkflow().`);
+    }
+    return sub.nodes
+        .filter((node) => node.type === 'step')
+        .map((node) => node.def);
+}
+/** Why an event name cannot be used as a gate, or `null` when it can. */
+export function unusableEventName(event) {
+    if (typeof event !== 'string' || event.length === 0)
+        return 'with no event name';
+    if (event === '__proto__') {
+        return 'named "__proto__", which cannot be stored as a signal key and would never receive its signal';
+    }
+    return null;
+}
+/**
+ * A delivered signal is retained by event name rather than consumed, so two gates
+ * sharing a name would both be opened by one delivery.
+ */
+export function assertNoDuplicateWaitFor(wf) {
+    const seen = new Set();
+    for (const node of wf.nodes) {
+        if (node.type !== 'waitFor')
+            continue;
+        const bad = unusableEventName(node.event);
+        if (bad !== null)
+            throw new Error(`Workflow "${wf.name}" has a waitFor gate ${bad}`);
+        const event = node.event;
+        if (seen.has(event)) {
+            throw new Error(`Workflow "${wf.name}" waits for the event "${event}" more than once. ` +
+                `One signal would open every one of those gates, because a delivered signal ` +
+                `is never consumed. Give each gate its own event name.`);
+        }
+        seen.add(event);
+    }
+}
+/**
+ * Engine records use `__*` for bookkeeping and `sub:*` for child handles. A user
+ * step in either namespace would be skipped or misclassified during unwind.
+ */
+function assertNoReservedStepNames(wf) {
+    for (const name of userStepNames(wf.nodes)) {
+        if (name.startsWith('__') || name.startsWith('sub:')) {
+            throw new Error(`Step name "${name}" in workflow "${wf.name}" uses a reserved engine namespace. ` +
+                `Names beginning with "__" or "sub:" are reserved for workflow bookkeeping.`);
+        }
+    }
+}
+/**
+ * Reject both engine namespace collisions and names colliding with the
+ * `name:index` records generated by loops.
+ */
+export function assertNoIndexCollision(wf) {
+    assertNoReservedStepNames(wf);
+    const generators = wf.getIndexedStepNames();
+    if (generators.length === 0)
+        return;
+    for (const declared of wf.getStepNames()) {
+        for (const base of generators) {
+            if (declared !== base && new RegExp(`^${escapeRe(base)}:\\d+$`).test(declared)) {
+                throw new Error(`Step "${declared}" in "${wf.name}" collides with the per-iteration names ` +
+                    `reserved by the loop step "${base}" ("${base}:0", "${base}:1", ...). ` +
+                    `Rename one of them.`);
+            }
+        }
+    }
+}
+/** All user-declared record names, excluding legitimate generated subworkflow handles. */
+function userStepNames(nodes) {
+    const names = [];
+    for (const node of nodes) {
+        if (node.type === 'step')
+            names.push(node.def.name);
+        else if (node.type === 'branch') {
+            for (const steps of node.def.paths.values()) {
+                for (const step of steps)
+                    names.push(step.name);
+            }
+        }
+        else if (node.type === 'parallel') {
+            for (const step of node.def.steps)
+                names.push(step.name);
+        }
+        else if (node.type === 'doUntil' || node.type === 'doWhile') {
+            for (const step of node.def.steps)
+                names.push(step.name);
+        }
+        else if (node.type === 'forEach')
+            names.push(node.def.step.name);
+        else if (node.type === 'map')
+            names.push(node.def.name);
+    }
+    return names;
+}
+function escapeRe(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+/**
+ * `retry` is the total number of attempts. Zero/non-integral values would make the
+ * runner skip the handler and fabricate a failure record.
+ */
+export function assertUsableRetry(step, retry) {
+    if (retry === undefined)
+        return;
+    if (!Number.isSafeInteger(retry) || retry < 1) {
+        throw new Error(`Step "${step}" declares retry: ${retry}. retry is the number of attempts, so it must be an integer of 1 or more (1 means a single attempt with no retry).`);
+    }
+}
+/** Timeout values are finite milliseconds; zero deliberately means no forward bound. */
+export function assertUsableTimeout(where, timeout) {
+    if (timeout === undefined)
+        return;
+    if (!Number.isFinite(timeout) || timeout < 0) {
+        throw new Error(`${where} timeout must be a finite number of milliseconds at least 0`);
+    }
+}
+/** Polling delays and child deadlines cannot be disabled or spin at zero. */
+export function assertPositiveDuration(where, duration) {
+    if (duration === undefined)
+        return;
+    if (!Number.isFinite(duration) || duration <= 0) {
+        throw new Error(`${where} must be a finite number of milliseconds greater than 0`);
+    }
+}
+/** Loop limits must bound the number of body executions exactly. */
+export function assertUsableIterations(where, maxIterations) {
+    if (maxIterations === undefined)
+        return;
+    if (!Number.isSafeInteger(maxIterations) || maxIterations < 1) {
+        throw new Error(`${where} maxIterations must be an integer of 1 or more`);
+    }
+}

package/dist/domain/types/command.d.ts

@@ -3,6 +3,7 @@
  * All supported commands for TCP/HTTP protocol
  */
 import type { JobInput, JobState } from './job';
+import type { AtomicFlowJobInput } from './flow';
 import type { CronJobOptions } from './cron';
 /** Base command interface */
 interface BaseCommand {
@@ -81,6 +82,11 @@ export interface PushBatchCommand extends BaseCommand {
     readonly queue: string;
     readonly jobs: JobInput[];
 }
+/** Atomically commit a fully-resolved multi-queue flow graph. */
+export interface PushFlowCommand extends BaseCommand {
+    readonly cmd: 'PUSHF';
+    readonly jobs: AtomicFlowJobInput[];
+}
 export interface PullCommand extends BaseCommand {
     readonly cmd: 'PULL';
     readonly queue: string;
@@ -510,7 +516,7 @@ export interface HelloCommand extends BaseCommand {
     readonly capabilities?: 'pipelining'[];
 }
 /** Union of all commands */
-export type Command = PushCommand | PushBatchCommand | PullCommand | PullBatchCommand | AckCommand | AckBatchCommand | FailCommand | GetJobCommand | GetStateCommand | GetResultCommand | GetJobsCommand | GetJobCountsCommand | GetCountsPerPriorityCommand | GetJobByCustomIdCommand | CountCommand | GetProgressCommand | CancelCommand | ProgressCommand | UpdateCommand | ChangePriorityCommand | PromoteCommand | WaitJobCommand | MoveToDelayedCommand | DiscardCommand | PauseCommand | ResumeCommand | IsPausedCommand | DrainCommand | ObliterateCommand | ListQueuesCommand | CleanCommand | DlqCommand | RetryDlqCommand | PurgeDlqCommand | RetryCompletedCommand | RateLimitCommand | SetConcurrencyCommand | RateLimitClearCommand | ClearConcurrencyCommand | SetStallConfigCommand | GetStallConfigCommand | SetDlqConfigCommand | GetDlqConfigCommand | CronCommand | CronDeleteCommand | CronListCommand | AddLogCommand | GetLogsCommand | HeartbeatCommand | JobHeartbeatCommand | JobHeartbeatBatchCommand | PingCommand | RegisterWorkerCommand | UnregisterWorkerCommand | ListWorkersCommand | AddWebhookCommand | RemoveWebhookCommand | ListWebhooksCommand | StatsCommand | MetricsCommand | PrometheusCommand | CronGetCommand | GetChildrenValuesCommand | StorageStatusCommand | ClearLogsCommand | ExtendLockCommand | ExtendLocksCommand | ChangeDelayCommand | SetWebhookEnabledCommand | CompactMemoryCommand | UpdateParentCommand | MoveToWaitCommand | PromoteJobsCommand | DashboardOverviewCommand | DashboardQueuesCommand | DashboardQueueCommand | AuthCommand | GetFailedChildrenValuesCommand | GetIgnoredChildrenFailuresCommand | RemoveChildDependencyCommand | RemoveUnprocessedChildrenCommand | HelloCommand;
+export type Command = PushCommand | PushBatchCommand | PushFlowCommand | PullCommand | PullBatchCommand | AckCommand | AckBatchCommand | FailCommand | GetJobCommand | GetStateCommand | GetResultCommand | GetJobsCommand | GetJobCountsCommand | GetCountsPerPriorityCommand | GetJobByCustomIdCommand | CountCommand | GetProgressCommand | CancelCommand | ProgressCommand | UpdateCommand | ChangePriorityCommand | PromoteCommand | WaitJobCommand | MoveToDelayedCommand | DiscardCommand | PauseCommand | ResumeCommand | IsPausedCommand | DrainCommand | ObliterateCommand | ListQueuesCommand | CleanCommand | DlqCommand | RetryDlqCommand | PurgeDlqCommand | RetryCompletedCommand | RateLimitCommand | SetConcurrencyCommand | RateLimitClearCommand | ClearConcurrencyCommand | SetStallConfigCommand | GetStallConfigCommand | SetDlqConfigCommand | GetDlqConfigCommand | CronCommand | CronDeleteCommand | CronListCommand | AddLogCommand | GetLogsCommand | HeartbeatCommand | JobHeartbeatCommand | JobHeartbeatBatchCommand | PingCommand | RegisterWorkerCommand | UnregisterWorkerCommand | ListWorkersCommand | AddWebhookCommand | RemoveWebhookCommand | ListWebhooksCommand | StatsCommand | MetricsCommand | PrometheusCommand | CronGetCommand | GetChildrenValuesCommand | StorageStatusCommand | ClearLogsCommand | ExtendLockCommand | ExtendLocksCommand | ChangeDelayCommand | SetWebhookEnabledCommand | CompactMemoryCommand | UpdateParentCommand | MoveToWaitCommand | PromoteJobsCommand | DashboardOverviewCommand | DashboardQueuesCommand | DashboardQueueCommand | AuthCommand | GetFailedChildrenValuesCommand | GetIgnoredChildrenFailuresCommand | RemoveChildDependencyCommand | RemoveUnprocessedChildrenCommand | HelloCommand;
 /** Extract command type */
 export type CommandType = Command['cmd'];
 export {};

package/dist/domain/types/flow.d.ts

@@ -0,0 +1,25 @@
+import type { Job, JobId, JobInput } from './job';
+/** One fully-resolved job in an atomic flow commit. */
+export interface AtomicFlowJobInput {
+    readonly id: JobId;
+    readonly queue: string;
+    readonly input: JobInput;
+}
+/** Wire-neutral batch consumed by embedded and TCP FlowProducer paths. */
+export interface AtomicFlowBatchInput {
+    readonly jobs: AtomicFlowJobInput[];
+}
+/** Authoritative snapshots returned after a successful flow commit. */
+export interface AtomicFlowBatchResult {
+    readonly jobs: Job[];
+}
+export type FlowFailureMode = 'fail' | 'remove' | 'ignore' | 'continue';
+/** Durable recovery record for a terminal child failure. */
+export interface FlowFailureRecord {
+    readonly parentId: JobId;
+    readonly childId: JobId;
+    readonly childQueue: string;
+    readonly mode: FlowFailureMode;
+    readonly error: string;
+    readonly createdAt: number;
+}

package/dist/domain/types/flow.js

@@ -0,0 +1 @@
+export {};

package/dist/infrastructure/persistence/schema.d.ts

@@ -4,10 +4,10 @@
 /** SQLite PRAGMA settings for optimal performance */
 export declare const PRAGMA_SETTINGS = "\nPRAGMA journal_mode = WAL;\nPRAGMA synchronous = NORMAL;\nPRAGMA cache_size = -64000;\nPRAGMA temp_store = MEMORY;\nPRAGMA mmap_size = 268435456;\nPRAGMA page_size = 4096;\nPRAGMA busy_timeout = 5000;\n";
 /** Main schema creation */
-export declare const SCHEMA = "\n-- Jobs table (using UUIDv7 for job IDs)\n-- Uses BLOB for data fields (MessagePack serialization for ~2-3x faster than JSON)\nCREATE TABLE IF NOT EXISTS jobs (\n    id TEXT PRIMARY KEY,\n    queue TEXT NOT NULL,\n    data BLOB NOT NULL,\n    priority INTEGER NOT NULL DEFAULT 0,\n    created_at INTEGER NOT NULL,\n    run_at INTEGER NOT NULL,\n    started_at INTEGER,\n    completed_at INTEGER,\n    attempts INTEGER NOT NULL DEFAULT 0,\n    max_attempts INTEGER NOT NULL DEFAULT 3,\n    backoff INTEGER NOT NULL DEFAULT 1000,\n    ttl INTEGER,\n    timeout INTEGER,\n    unique_key TEXT,\n    custom_id TEXT,\n    depends_on BLOB,\n    parent_id TEXT,\n    children_ids BLOB,\n    tags BLOB,\n    state TEXT NOT NULL DEFAULT 'waiting',\n    lifo INTEGER NOT NULL DEFAULT 0,\n    group_id TEXT,\n    progress INTEGER DEFAULT 0,\n    progress_msg TEXT,\n    remove_on_complete INTEGER DEFAULT 0,\n    remove_on_fail INTEGER DEFAULT 0,\n    stall_timeout INTEGER,\n    last_heartbeat INTEGER,\n    stall_count INTEGER NOT NULL DEFAULT 0,\n    timeline BLOB,\n    stacktrace BLOB\n);\n\n-- Indexes for common queries\nCREATE INDEX IF NOT EXISTS idx_jobs_queue_state\n    ON jobs(queue, state);\n-- Stable createdAt/id pagination for unfiltered and logical-state queue views\nCREATE INDEX IF NOT EXISTS idx_jobs_queue_created\n    ON jobs(queue, created_at, id);\nCREATE INDEX IF NOT EXISTS idx_jobs_queue_state_created\n    ON jobs(queue, state, created_at, id);\nCREATE INDEX IF NOT EXISTS idx_jobs_run_at\n    ON jobs(run_at) WHERE state IN ('waiting', 'delayed');\nCREATE INDEX IF NOT EXISTS idx_jobs_unique\n    ON jobs(queue, unique_key) WHERE unique_key IS NOT NULL;\nCREATE INDEX IF NOT EXISTS idx_jobs_custom_id\n    ON jobs(custom_id) WHERE custom_id IS NOT NULL;\nCREATE INDEX IF NOT EXISTS idx_jobs_parent\n    ON jobs(parent_id) WHERE parent_id IS NOT NULL;\n\n-- Job results storage (BLOB for MessagePack)\nCREATE TABLE IF NOT EXISTS job_results (\n    job_id TEXT PRIMARY KEY,\n    result BLOB,\n    completed_at INTEGER NOT NULL\n);\n\n-- Dead letter queue (BLOB for MessagePack - stores full DlqEntry)\nCREATE TABLE IF NOT EXISTS dlq (\n    id INTEGER PRIMARY KEY AUTOINCREMENT,\n    job_id TEXT NOT NULL,\n    queue TEXT NOT NULL,\n    entry BLOB NOT NULL,\n    entered_at INTEGER NOT NULL\n);\n\nCREATE INDEX IF NOT EXISTS idx_dlq_queue ON dlq(queue);\nCREATE INDEX IF NOT EXISTS idx_dlq_job_id ON dlq(job_id);\nCREATE INDEX IF NOT EXISTS idx_dlq_entered_at ON dlq(entered_at);\n\n-- Performance indexes for high-throughput operations\n-- Stall detection: runs every 5s, needs fast lookup of active jobs by started_at\nCREATE INDEX IF NOT EXISTS idx_jobs_state_started\n    ON jobs(state, started_at) WHERE state = 'active';\n\n-- Group operations: fast lookup by group_id\nCREATE INDEX IF NOT EXISTS idx_jobs_group_id\n    ON jobs(group_id) WHERE group_id IS NOT NULL;\n\n-- Pending jobs: compound index for priority-ordered retrieval\nCREATE INDEX IF NOT EXISTS idx_jobs_pending_priority\n    ON jobs(queue, state, priority DESC, run_at ASC) WHERE state IN ('waiting', 'delayed');\n\n-- Completed jobs: index for recovery ordering (issue #84)\nCREATE INDEX IF NOT EXISTS idx_jobs_completed_order\n    ON jobs(completed_at DESC) WHERE state = 'completed';\n\n-- Cron jobs (BLOB for MessagePack)\nCREATE TABLE IF NOT EXISTS cron_jobs (\n    name TEXT PRIMARY KEY,\n    queue TEXT NOT NULL,\n    data BLOB NOT NULL,\n    schedule TEXT,\n    repeat_every INTEGER,\n    priority INTEGER NOT NULL DEFAULT 0,\n    next_run INTEGER NOT NULL,\n    executions INTEGER NOT NULL DEFAULT 0,\n    max_limit INTEGER,\n    timezone TEXT,\n    unique_key TEXT,\n    dedup BLOB,\n    skip_missed_on_restart INTEGER NOT NULL DEFAULT 0,\n    skip_if_no_worker INTEGER NOT NULL DEFAULT 0,\n    prevent_overlap INTEGER NOT NULL DEFAULT 1,\n    job_options BLOB\n);\n\n-- Queue state persistence (optional)\nCREATE TABLE IF NOT EXISTS queue_state (\n    name TEXT PRIMARY KEY,\n    paused INTEGER NOT NULL DEFAULT 0,\n    rate_limit INTEGER,\n    concurrency_limit INTEGER,\n    rate_limit_duration INTEGER,\n    rate_limit_expires_at INTEGER,\n    stall_enabled INTEGER,\n    stall_interval INTEGER,\n    max_stalls INTEGER,\n    stall_grace_period INTEGER,\n    dlq_config BLOB\n);\n";
+export declare const SCHEMA = "\n-- Jobs table (using UUIDv7 for job IDs)\n-- Uses BLOB for data fields (MessagePack serialization for ~2-3x faster than JSON)\nCREATE TABLE IF NOT EXISTS jobs (\n    id TEXT PRIMARY KEY,\n    queue TEXT NOT NULL,\n    data BLOB NOT NULL,\n    priority INTEGER NOT NULL DEFAULT 0,\n    created_at INTEGER NOT NULL,\n    run_at INTEGER NOT NULL,\n    started_at INTEGER,\n    completed_at INTEGER,\n    attempts INTEGER NOT NULL DEFAULT 0,\n    max_attempts INTEGER NOT NULL DEFAULT 3,\n    backoff INTEGER NOT NULL DEFAULT 1000,\n    ttl INTEGER,\n    timeout INTEGER,\n    unique_key TEXT,\n    custom_id TEXT,\n    depends_on BLOB,\n    parent_id TEXT,\n    children_ids BLOB,\n    tags BLOB,\n    state TEXT NOT NULL DEFAULT 'waiting',\n    lifo INTEGER NOT NULL DEFAULT 0,\n    group_id TEXT,\n    progress INTEGER DEFAULT 0,\n    progress_msg TEXT,\n    remove_on_complete INTEGER DEFAULT 0,\n    remove_on_fail INTEGER DEFAULT 0,\n    fail_parent_on_failure INTEGER NOT NULL DEFAULT 0,\n    remove_dependency_on_failure INTEGER NOT NULL DEFAULT 0,\n    continue_parent_on_failure INTEGER NOT NULL DEFAULT 0,\n    ignore_dependency_on_failure INTEGER NOT NULL DEFAULT 0,\n    stall_timeout INTEGER,\n    last_heartbeat INTEGER,\n    stall_count INTEGER NOT NULL DEFAULT 0,\n    timeline BLOB,\n    stacktrace BLOB\n);\n\n-- Indexes for common queries\nCREATE INDEX IF NOT EXISTS idx_jobs_queue_state\n    ON jobs(queue, state);\n-- Stable createdAt/id pagination for unfiltered and logical-state queue views\nCREATE INDEX IF NOT EXISTS idx_jobs_queue_created\n    ON jobs(queue, created_at, id);\nCREATE INDEX IF NOT EXISTS idx_jobs_queue_state_created\n    ON jobs(queue, state, created_at, id);\nCREATE INDEX IF NOT EXISTS idx_jobs_run_at\n    ON jobs(run_at) WHERE state IN ('waiting', 'prioritized', 'waiting-children', 'delayed');\nCREATE INDEX IF NOT EXISTS idx_jobs_unique\n    ON jobs(queue, unique_key) WHERE unique_key IS NOT NULL;\nCREATE INDEX IF NOT EXISTS idx_jobs_custom_id\n    ON jobs(custom_id) WHERE custom_id IS NOT NULL;\nCREATE INDEX IF NOT EXISTS idx_jobs_parent\n    ON jobs(parent_id) WHERE parent_id IS NOT NULL;\n\n-- Durable outbox/state for terminal child failure propagation.\nCREATE TABLE IF NOT EXISTS flow_failures (\n    parent_id TEXT NOT NULL,\n    child_id TEXT NOT NULL,\n    child_queue TEXT NOT NULL,\n    mode TEXT NOT NULL,\n    error TEXT NOT NULL,\n    created_at INTEGER NOT NULL,\n    PRIMARY KEY (parent_id, child_id)\n);\nCREATE INDEX IF NOT EXISTS idx_flow_failures_parent ON flow_failures(parent_id);\n\n-- Job results storage (BLOB for MessagePack)\nCREATE TABLE IF NOT EXISTS job_results (\n    job_id TEXT PRIMARY KEY,\n    result BLOB,\n    completed_at INTEGER NOT NULL\n);\n\n-- Dead letter queue (BLOB for MessagePack - stores full DlqEntry)\nCREATE TABLE IF NOT EXISTS dlq (\n    id INTEGER PRIMARY KEY AUTOINCREMENT,\n    job_id TEXT NOT NULL,\n    queue TEXT NOT NULL,\n    entry BLOB NOT NULL,\n    entered_at INTEGER NOT NULL\n);\n\nCREATE INDEX IF NOT EXISTS idx_dlq_queue ON dlq(queue);\nCREATE INDEX IF NOT EXISTS idx_dlq_job_id ON dlq(job_id);\nCREATE INDEX IF NOT EXISTS idx_dlq_entered_at ON dlq(entered_at);\n\n-- Performance indexes for high-throughput operations\n-- Stall detection: runs every 5s, needs fast lookup of active jobs by started_at\nCREATE INDEX IF NOT EXISTS idx_jobs_state_started\n    ON jobs(state, started_at) WHERE state = 'active';\n\n-- Group operations: fast lookup by group_id\nCREATE INDEX IF NOT EXISTS idx_jobs_group_id\n    ON jobs(group_id) WHERE group_id IS NOT NULL;\n\n-- Pending jobs: compound index for priority-ordered retrieval\nCREATE INDEX IF NOT EXISTS idx_jobs_pending_priority\n    ON jobs(queue, state, priority DESC, run_at ASC) WHERE state IN ('waiting', 'prioritized', 'waiting-children', 'delayed');\n\n-- Completed jobs: index for recovery ordering (issue #84)\nCREATE INDEX IF NOT EXISTS idx_jobs_completed_order\n    ON jobs(completed_at DESC) WHERE state = 'completed';\n\n-- Cron jobs (BLOB for MessagePack)\nCREATE TABLE IF NOT EXISTS cron_jobs (\n    name TEXT PRIMARY KEY,\n    queue TEXT NOT NULL,\n    data BLOB NOT NULL,\n    schedule TEXT,\n    repeat_every INTEGER,\n    priority INTEGER NOT NULL DEFAULT 0,\n    next_run INTEGER NOT NULL,\n    executions INTEGER NOT NULL DEFAULT 0,\n    max_limit INTEGER,\n    timezone TEXT,\n    unique_key TEXT,\n    dedup BLOB,\n    skip_missed_on_restart INTEGER NOT NULL DEFAULT 0,\n    skip_if_no_worker INTEGER NOT NULL DEFAULT 0,\n    prevent_overlap INTEGER NOT NULL DEFAULT 1,\n    job_options BLOB\n);\n\n-- Queue state persistence (optional)\nCREATE TABLE IF NOT EXISTS queue_state (\n    name TEXT PRIMARY KEY,\n    paused INTEGER NOT NULL DEFAULT 0,\n    rate_limit INTEGER,\n    concurrency_limit INTEGER,\n    rate_limit_duration INTEGER,\n    rate_limit_expires_at INTEGER,\n    stall_enabled INTEGER,\n    stall_interval INTEGER,\n    max_stalls INTEGER,\n    stall_grace_period INTEGER,\n    dlq_config BLOB\n);\n";
 /** Migration version table */
 export declare const MIGRATION_TABLE = "\nCREATE TABLE IF NOT EXISTS migrations (\n    version INTEGER PRIMARY KEY,\n    applied_at INTEGER NOT NULL\n);\n";
 /** Current schema version */
-export declare const SCHEMA_VERSION = 22;
+export declare const SCHEMA_VERSION = 27;
 /** All migrations in order */
 export declare const MIGRATIONS: Record<number, string>;

package/dist/infrastructure/persistence/schema.js

@@ -42,6 +42,10 @@ CREATE TABLE IF NOT EXISTS jobs (
     progress_msg TEXT,
     remove_on_complete INTEGER DEFAULT 0,
     remove_on_fail INTEGER DEFAULT 0,
+    fail_parent_on_failure INTEGER NOT NULL DEFAULT 0,
+    remove_dependency_on_failure INTEGER NOT NULL DEFAULT 0,
+    continue_parent_on_failure INTEGER NOT NULL DEFAULT 0,
+    ignore_dependency_on_failure INTEGER NOT NULL DEFAULT 0,
     stall_timeout INTEGER,
     last_heartbeat INTEGER,
     stall_count INTEGER NOT NULL DEFAULT 0,
@@ -58,7 +62,7 @@ CREATE INDEX IF NOT EXISTS idx_jobs_queue_created
 CREATE INDEX IF NOT EXISTS idx_jobs_queue_state_created
     ON jobs(queue, state, created_at, id);
 CREATE INDEX IF NOT EXISTS idx_jobs_run_at
-    ON jobs(run_at) WHERE state IN ('waiting', 'delayed');
+    ON jobs(run_at) WHERE state IN ('waiting', 'prioritized', 'waiting-children', 'delayed');
 CREATE INDEX IF NOT EXISTS idx_jobs_unique
     ON jobs(queue, unique_key) WHERE unique_key IS NOT NULL;
 CREATE INDEX IF NOT EXISTS idx_jobs_custom_id
@@ -66,6 +70,18 @@ CREATE INDEX IF NOT EXISTS idx_jobs_custom_id
 CREATE INDEX IF NOT EXISTS idx_jobs_parent
     ON jobs(parent_id) WHERE parent_id IS NOT NULL;
 
+-- Durable outbox/state for terminal child failure propagation.
+CREATE TABLE IF NOT EXISTS flow_failures (
+    parent_id TEXT NOT NULL,
+    child_id TEXT NOT NULL,
+    child_queue TEXT NOT NULL,
+    mode TEXT NOT NULL,
+    error TEXT NOT NULL,
+    created_at INTEGER NOT NULL,
+    PRIMARY KEY (parent_id, child_id)
+);
+CREATE INDEX IF NOT EXISTS idx_flow_failures_parent ON flow_failures(parent_id);
+
 -- Job results storage (BLOB for MessagePack)
 CREATE TABLE IF NOT EXISTS job_results (
     job_id TEXT PRIMARY KEY,
@@ -97,7 +113,7 @@ CREATE INDEX IF NOT EXISTS idx_jobs_group_id
 
 -- Pending jobs: compound index for priority-ordered retrieval
 CREATE INDEX IF NOT EXISTS idx_jobs_pending_priority
-    ON jobs(queue, state, priority DESC, run_at ASC) WHERE state IN ('waiting', 'delayed');
+    ON jobs(queue, state, priority DESC, run_at ASC) WHERE state IN ('waiting', 'prioritized', 'waiting-children', 'delayed');
 
 -- Completed jobs: index for recovery ordering (issue #84)
 CREATE INDEX IF NOT EXISTS idx_jobs_completed_order
@@ -146,7 +162,7 @@ CREATE TABLE IF NOT EXISTS migrations (
 );
 `;
 /** Current schema version */
-export const SCHEMA_VERSION = 22;
+export const SCHEMA_VERSION = 27;
 /** All migrations in order */
 export const MIGRATIONS = {
     1: SCHEMA,
@@ -240,5 +256,38 @@ ALTER TABLE queue_state ADD COLUMN stall_grace_period INTEGER;
     // Migration 22: Persist the complete per-queue DLQ policy atomically.
     22: `
 ALTER TABLE queue_state ADD COLUMN dlq_config BLOB;
+`,
+    // Migrations 23-26: flow failure policy must survive active-job recovery.
+    23: `
+ALTER TABLE jobs ADD COLUMN fail_parent_on_failure INTEGER NOT NULL DEFAULT 0;
+`,
+    24: `
+ALTER TABLE jobs ADD COLUMN remove_dependency_on_failure INTEGER NOT NULL DEFAULT 0;
+`,
+    25: `
+ALTER TABLE jobs ADD COLUMN continue_parent_on_failure INTEGER NOT NULL DEFAULT 0;
+`,
+    26: `
+ALTER TABLE jobs ADD COLUMN ignore_dependency_on_failure INTEGER NOT NULL DEFAULT 0;
+`,
+    27: `
+CREATE TABLE IF NOT EXISTS flow_failures (
+    parent_id TEXT NOT NULL,
+    child_id TEXT NOT NULL,
+    child_queue TEXT NOT NULL,
+    mode TEXT NOT NULL,
+    error TEXT NOT NULL,
+    created_at INTEGER NOT NULL,
+    PRIMARY KEY (parent_id, child_id)
+);
+CREATE INDEX IF NOT EXISTS idx_flow_failures_parent ON flow_failures(parent_id);
+
+DROP INDEX IF EXISTS idx_jobs_run_at;
+CREATE INDEX idx_jobs_run_at
+    ON jobs(run_at) WHERE state IN ('waiting', 'prioritized', 'waiting-children', 'delayed');
+
+DROP INDEX IF EXISTS idx_jobs_pending_priority;
+CREATE INDEX idx_jobs_pending_priority
+    ON jobs(queue, state, priority DESC, run_at ASC) WHERE state IN ('waiting', 'prioritized', 'waiting-children', 'delayed');
 `,
 };

package/dist/infrastructure/persistence/sqlite.d.ts

@@ -4,6 +4,7 @@
  * Uses MessagePack for ~2-3x faster serialization than JSON
  */
 import type { Job, JobId, JobTimelineEntry } from '../../domain/types/job';
+import type { FlowFailureRecord } from '../../domain/types/flow';
 import type { StallConfig } from '../../domain/types/stall';
 import type { CronJob } from '../../domain/types/cron';
 import { type DlqConfig, type DlqEntry } from '../../domain/types/dlq';
@@ -98,6 +99,11 @@ export declare class SqliteStorage {
     markFailed(job: Job, error: string | null): void;
     /** Save DLQ entry with full metadata */
     saveDlqEntry(entry: DlqEntry): void;
+    /**
+     * Commit a terminal child outcome, its optional DLQ row, and its flow outbox
+     * record together. Recovery therefore never observes only half the transition.
+     */
+    commitFailedJob(jobId: JobId, entry: DlqEntry | null, flowFailure: FlowFailureRecord | null): void;
     /** Delete DLQ entry by job ID */
     deleteDlqEntry(jobId: JobId): void;
     /** Clear all DLQ entries for a queue */
@@ -129,6 +135,16 @@ export declare class SqliteStorage {
     updateRunAt(jobId: JobId, runAt: number): void;
     /** Update a job's children_ids blob and parent_id */
     updateJobChildrenIds(jobId: JobId, childrenIds: JobId[]): void;
+    /** Persist both sides of a legacy parent link in one SQLite transaction. */
+    updateFlowLink(child: Pick<Job, 'id' | 'parentId' | 'data'>, parent: Pick<Job, 'id' | 'childrenIds' | 'dependsOn' | 'data'>, parentState: 'waiting-children' | 'waiting' | 'prioritized' | 'delayed'): void;
+    /** Persist both sides of a removed parent/child relationship atomically. */
+    removeFlowLink(child: Pick<Job, 'id' | 'parentId' | 'data'>, parent: Pick<Job, 'id' | 'childrenIds' | 'dependsOn' | 'data' | 'runAt'>, parentState: 'waiting-children' | 'waiting' | 'prioritized'): void;
+    /** Record terminal child propagation before applying its parent-side effect. */
+    saveFlowFailure(record: FlowFailureRecord): void;
+    loadFlowFailures(): FlowFailureRecord[];
+    deleteFlowFailure(parentId: JobId, childId?: JobId): void;
+    /** Persist dependency removal/promotion as one parent-side recovery checkpoint. */
+    updateFlowParentResolution(job: Pick<Job, 'id' | 'dependsOn' | 'runAt' | 'priority'>): void;
     getJob(id: JobId): Job | null;
     storeResult(jobId: JobId, result: unknown): void;
     getResult(jobId: JobId): unknown;