cursedbelt 2.7.0 → 3.0.0

package/dist/server/drivers/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/server/drivers/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EACL,sBAAsB,EACtB,SAAS,EACT,aAAa,EACb,0BAA0B,EAC1B,yBAAyB,EACzB,wBAAwB,EACxB,iBAAiB,EACjB,4BAA4B,EAC5B,uBAAuB,EACvB,eAAe,EACf,mBAAmB,EACnB,KAAK,UAAU,EACf,KAAK,OAAO,EACZ,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,QAAQ,EACb,KAAK,eAAe,EACpB,KAAK,2BAA2B,EAChC,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,UAAU,EACV,QAAQ,EACR,aAAa,EACb,KAAK,0BAA0B,EAC/B,KAAK,eAAe,EACpB,KAAK,OAAO,EACZ,KAAK,cAAc,GACpB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,mBAAmB,EACnB,KAAK,QAAQ,EACb,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,uBAAuB,EAC5B,KAAK,iBAAiB,EACtB,sBAAsB,EACtB,mBAAmB,EACnB,KAAK,QAAQ,EACb,KAAK,QAAQ,EACb,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,oBAAoB,EACpB,KAAK,aAAa,EAClB,KAAK,OAAO,EACZ,KAAK,OAAO,EACZ,KAAK,aAAa,GACnB,MAAM,oBAAoB,CAAC;AAI5B,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EACzB,iBAAiB,EACjB,KAAK,sBAAsB,EAC3B,oBAAoB,EACpB,gBAAgB,EAChB,qBAAqB,EACrB,YAAY,EACZ,mBAAmB,EACnB,KAAK,kBAAkB,EACvB,wBAAwB,EACxB,KAAK,aAAa,EAClB,KAAK,oBAAoB,EACzB,qBAAqB,EACrB,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,oBAAoB,EACpB,0BAA0B,EAC1B,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,SAAS,EACd,uBAAuB,EACvB,KAAK,mBAAmB,EACxB,uBAAuB,EACvB,qBAAqB,EACrB,KAAK,mBAAmB,EACxB,yBAAyB,EACzB,KAAK,qBAAqB,EAC1B,yBAAyB,EACzB,KAAK,mBAAmB,EACxB,iBAAiB,EACjB,SAAS,EACT,YAAY,EACZ,YAAY,GACb,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,oBAAoB,EACpB,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,KAAK,EACV,KAAK,SAAS,EACd,KAAK,OAAO,EACZ,KAAK,cAAc,EACnB,KAAK,qBAAqB,EAC1B,kBAAkB,GACnB,MAAM,aAAa,CAAC;AAIrB,OAAO,EACL,KAAK,sBAAsB,EAC3B,uBAAuB,EACvB,0BAA0B,EAC1B,0BAA0B,EAC1B,6BAA6B,EAC7B,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,kBAAkB,EAClB,KAAK,iBAAiB,EACtB,eAAe,GAChB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,mBAAmB,EACnB,KAAK,YAAY,EACjB,KAAK,SAAS,EACd,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,GACtB,MAAM,iBAAiB,CAAC;AAIzB,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,KAAK,aAAa,EAClB,KAAK,oBAAoB,GAC1B,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,KAAK,qBAAqB,EAC1B,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,wBAAwB,GACzB,MAAM,sBAAsB,CAAC;AAM9B,OAAO,EACL,sBAAsB,EACtB,2BAA2B,EAC3B,uBAAuB,EACvB,4BAA4B,EAC5B,eAAe,EACf,iBAAiB,EACjB,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAO/B,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,2BAA2B,EAC3B,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,aAAa,EACb,oBAAoB,EACpB,yBAAyB,EACzB,sBAAsB,EACtB,gCAAgC,EAChC,kBAAkB,EAClB,kBAAkB,EAClB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,gBAAgB,GACtB,MAAM,mBAAmB,CAAC;AAK3B,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,sBAAsB,EACtB,gBAAgB,EAChB,aAAa,EACb,eAAe,EACf,KAAK,aAAa,GACnB,MAAM,YAAY,CAAC;AAKpB,OAAO,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/server/drivers/index.js

@@ -1,42 +0,0 @@
-/**
- * Execution & cognition drivers (03 §7) — the profile-switchable server seams
- * the engine mixins are handed, never construct.
- *
- * `ExecutionDriver` is deliberately absent from the general `MixinContext` and
- * present only on `DevMixinContext` (J3-4): OS execution is a DevStudio power,
- * and the type system is what keeps it out of a public-facing media route.
- */
-export { assertRunnableCommands, buildArgv, commandParams, createLocalExecutionDriver, createSaasExecutionDriver, DEFAULT_SANDBOX_CEILINGS, EXEC_ARG_REJECTED, EXEC_COMMAND_NOT_WHITELISTED, EXEC_COMMAND_UNRUNNABLE, EXEC_CWD_ESCAPE, EXEC_HANDLE_UNKNOWN, resolveCwd, SAFE_ARG, safeArgSchema, } from './executionDriver';
-export { AI_CAPABILITY_UNSUPPORTED, AI_DRIVER_UNAVAILABLE, AI_SCHEMA_VIOLATION, createCognitiveGateway, DATA_BLOCK_PREAMBLE, renderUserDataBlocks, } from './cognitiveGateway';
-// The concrete providers (03 §1) — the drivers that turn every AI feature in the
-// product from "wired but un-runnable" into something a host can actually boot.
-export { ANTHROPIC_DEFAULT_ENDPOINT, ANTHROPIC_STRUCTURED_TOOL, ANTHROPIC_VERSION, AUDIO_OBJECT_MISSING, AI_PROVIDER_HTTP, AI_PROVIDER_MALFORMED, attachTokens, buildOllamaMessages, COMFYUI_DEFAULT_ENDPOINT, createAnthropicDriver, createComfyuiDriver, createOllamaDriver, createOpenAiDriver, createOpenclawDriver, createProviderDriver, defaultTextToImageWorkflow, OLLAMA_DEFAULT_ENDPOINT, OPENAI_DEFAULT_ENDPOINT, OPENAI_JSON_DIRECTIVE, OPENCLAW_DEFAULT_ENDPOINT, PROVIDER_DEFAULT_ENDPOINT, providerHttpError, readUsage, trimEndpoint, withDeadline, } from './providers';
-export { createLocalJobBroker, requeueStalledJobs, } from './jobBroker';
-// Durable, cross-process completion — the half of `JobBroker` that makes the
-// SaaS profile a swap rather than a rewrite (§2.1/§2.2).
-export { awaitRecordedCompletion, createMemoryJobResultStore, createSqliteJobResultStore, createStatementJobResultStore, JOB_RESULT_PAGE, JOB_RESULTS_DDL, JOB_RESULTS_INDEX, JOB_RESULTS_TABLE, recordWorkerResult, UNSCOPED_TENANT, } from './jobResults';
-export { createSaasJobBroker, } from './saasJobBroker';
-// The worker runtime that EXECUTES leased jobs (08 §4a) — the far side of the
-// broker seam, plus the reference BullMQ adapter that backs it.
-export { JOB_HANDLER_UNREGISTERED, runSaasJobWorker, } from './saasJobWorker';
-export { createBullmqQueueAdapter, } from './bullmqQueueAdapter';
-// The SHARED control-plane stores (04 §1). The per-node sqlite/memory stores
-// above are correct for one process; these are the same contracts over the
-// deployment's ONE pool, which is what makes multi-node completion and
-// cross-node session revocation true rather than promised.
-export { createPgJobResultStore, createPooledControlExecutor, createPgRevocationStore, ensureSaasControlPlaneSchema, REVOCATIONS_DDL, REVOCATIONS_INDEX, REVOCATIONS_TABLE, SAAS_CONTROL_PLANE_DDL, } from './pooledControlStores';
-// The retention WINDOWS, as control-plane state rather than a number on a cron
-// line (owner decision D30). Same tier as the two stores above — one table in
-// the deployment's Postgres, reached through the control executor — and the
-// reason it is a table at all is that nobody can stay on top of a value that
-// only exists inside a scheduler's environment.
-export { assertRetainDays, describeRetentionWindow, ensureRetentionPolicySchema, readRetentionPolicy, RETENTION_MAX_DAYS, RETENTION_MIN_DAYS, RETENTION_OFF, RETENTION_POLICY_DDL, RETENTION_POLICY_DEFAULTS, RETENTION_POLICY_TABLE, RETENTION_RECOMMENDED_METER_DAYS, RETENTION_SUBJECTS, setRetentionWindow, } from './retentionPolicy';
-// D36 — the marketing-copy store (overrides + the platform-admin-tenant row).
-// The generated local server wires its governance executor through this; the
-// deploy pipeline's owner-seed step calls `setPlatformAdminTenant`.
-export { assertSiteCopyWrite, clearSiteCopyValue, ensureSiteCopySchema, platformAdminTenant, readSiteCopyEntries, readSiteCopyOverrides, setPlatformAdminTenant, setSiteCopyValue, SITE_COPY_DDL, SITE_COPY_TABLE, } from './siteCopy';
-// The saas IDENTITY tier (04 §1a, owner decision E18). Same reasoning one layer
-// up: `createRegistryIdentityStore` is a file on ONE machine, so every saas
-// branch was unbootable until accounts could live on the shared substrate.
-export { createPgIdentityStore, ensureSaasIdentitySchema, SAAS_IDENTITY_DDL } from './pooledIdentityStore';
-//# sourceMappingURL=index.js.map

package/dist/server/drivers/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/server/drivers/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EACL,sBAAsB,EACtB,SAAS,EACT,aAAa,EACb,0BAA0B,EAC1B,yBAAyB,EACzB,wBAAwB,EACxB,iBAAiB,EACjB,4BAA4B,EAC5B,uBAAuB,EACvB,eAAe,EACf,mBAAmB,EAUnB,UAAU,EACV,QAAQ,EACR,aAAa,GAKd,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,mBAAmB,EAMnB,sBAAsB,EACtB,mBAAmB,EAOnB,oBAAoB,GAKrB,MAAM,oBAAoB,CAAC;AAE5B,iFAAiF;AACjF,gFAAgF;AAChF,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EACzB,iBAAiB,EAEjB,oBAAoB,EACpB,gBAAgB,EAChB,qBAAqB,EACrB,YAAY,EACZ,mBAAmB,EAEnB,wBAAwB,EAGxB,qBAAqB,EACrB,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,oBAAoB,EACpB,0BAA0B,EAI1B,uBAAuB,EAEvB,uBAAuB,EACvB,qBAAqB,EAErB,yBAAyB,EAEzB,yBAAyB,EAEzB,iBAAiB,EACjB,SAAS,EACT,YAAY,EACZ,YAAY,GACb,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,oBAAoB,EASpB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AAErB,6EAA6E;AAC7E,yDAAyD;AACzD,OAAO,EAEL,uBAAuB,EACvB,0BAA0B,EAC1B,0BAA0B,EAC1B,6BAA6B,EAC7B,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,iBAAiB,EAGjB,kBAAkB,EAElB,eAAe,GAChB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,mBAAmB,GASpB,MAAM,iBAAiB,CAAC;AAEzB,8EAA8E;AAC9E,gEAAgE;AAChE,OAAO,EACL,wBAAwB,EACxB,gBAAgB,GAGjB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAML,wBAAwB,GACzB,MAAM,sBAAsB,CAAC;AAE9B,6EAA6E;AAC7E,2EAA2E;AAC3E,uEAAuE;AACvE,2DAA2D;AAC3D,OAAO,EACL,sBAAsB,EACtB,2BAA2B,EAC3B,uBAAuB,EACvB,4BAA4B,EAC5B,eAAe,EACf,iBAAiB,EACjB,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAE/B,+EAA+E;AAC/E,8EAA8E;AAC9E,4EAA4E;AAC5E,6EAA6E;AAC7E,gDAAgD;AAChD,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,2BAA2B,EAC3B,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,aAAa,EACb,oBAAoB,EACpB,yBAAyB,EACzB,sBAAsB,EACtB,gCAAgC,EAChC,kBAAkB,EAClB,kBAAkB,GAInB,MAAM,mBAAmB,CAAC;AAE3B,8EAA8E;AAC9E,6EAA6E;AAC7E,oEAAoE;AACpE,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,sBAAsB,EACtB,gBAAgB,EAChB,aAAa,EACb,eAAe,GAEhB,MAAM,YAAY,CAAC;AAEpB,gFAAgF;AAChF,4EAA4E;AAC5E,2EAA2E;AAC3E,OAAO,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/server/drivers/jobBroker.d.ts

@@ -1,133 +0,0 @@
-/**
- * `JobBroker` (03 §7.3) — durable long-running work.
- *
- * Long AI pipelines, staging promotions, deploys and reindex jobs go through the
- * broker, never a bare `setTimeout` loop. The distinction that matters is
- * durability: a `setTimeout` chain evaporates on restart and takes a half-run
- * deploy with it, whereas an enqueued job is a committed SQLite row that is
- * re-leased when the process comes back.
- *
- * This is a facade over **plainjob** — the same queue primitive the cron
- * {@link ../jobs/runner | JobRunner} uses, sharing its `bun:sqlite` connection
- * adapter. The two are different concerns (recurring schedule vs. durable
- * one-shot work) over one storage primitive, which is why this module adds a
- * facade rather than a second queue.
- */
-import type { Database } from 'bun:sqlite';
-import type { JobLogger } from '../jobs/types';
-import { type AwaitCompletionOptions, type JobResultStore } from './jobResults';
-export type JobId = string;
-export interface JobSpec {
-    /** Handler selector — `exec`, `promote`, `reindex`, `deploy`, `ai-pipeline`, … */
-    kind: string;
-    tenantId: string;
-    instanceId?: string;
-    payload: Record<string, unknown>;
-    /** Delay before the job becomes eligible, in ms. */
-    delayMs?: number;
-}
-export interface JobResult {
-    jobId: JobId;
-    ok: boolean;
-    output?: unknown;
-    error?: string;
-}
-export interface JobHandlerContext {
-    jobId: JobId;
-    tenantId: string;
-    instanceId?: string;
-    /**
-     * Aborted when the broker stops OR when THIS job is cancelled — handlers must
-     * observe it and short-circuit. A long AI pipeline or deploy that ignores it
-     * keeps running after a `cancel()` "succeeds" (the flag flips but the work
-     * doesn't stop), so a cancel-aware handler must pass this signal into every
-     * fetch/spawn it starts and bail when it fires.
-     */
-    signal: AbortSignal;
-    logger: JobLogger;
-}
-export type JobHandler = (payload: Record<string, unknown>, ctx: JobHandlerContext) => Promise<unknown> | unknown;
-export interface JobBroker {
-    enqueue(job: JobSpec): Promise<JobId>;
-    /**
-     * Register a completion callback. Called at most once per job id; registering
-     * after the job already finished fires the callback with the recorded result
-     * rather than hanging forever — a restart-racing caller is the common case,
-     * not an error.
-     *
-     * Implemented over {@link JobBroker.awaitCompletion}, so it works when the
-     * worker is a different process. The original in-heap callback registry did
-     * not: a job enqueued on API node A and run by worker B completed in B's
-     * memory and A's callback never fired. Same call, same semantics, now true in
-     * every topology.
-     */
-    onComplete(id: JobId, cb: (result: JobResult) => void): void;
-    /**
-     * Wait for a terminal outcome. Reads the DURABLE result record, so any
-     * process may wait on any process's job — this is the cross-process
-     * completion contract, and `onComplete` is sugar over it.
-     */
-    awaitCompletion(id: JobId, options?: AwaitCompletionOptions): Promise<JobResult>;
-    cancel(id: JobId): Promise<void>;
-    status(id: JobId): Promise<JobResult | {
-        jobId: JobId;
-        ok: null;
-    }>;
-    /**
-     * Release whatever transport the broker holds. OPTIONAL because the local
-     * broker holds only the caller's own sqlite handle and has nothing of its own
-     * to give back; the saas broker holds Redis sockets, and a worker that drained
-     * its lease without closing them stays alive forever with the loop held open —
-     * so the supervisor SIGKILLs it, which is the abort the drain existed to
-     * avoid. Declared here rather than only on `SaasJobBroker` because the caller
-     * that must run it is the GENERATED worker, which sees a `JobBroker`.
-     */
-    close?(): void;
-}
-export interface LocalJobBrokerOptions {
-    /** The app's shared SQLite handle — the journal lives in the same file as the data. */
-    db: Database;
-    handlers: Readonly<Record<string, JobHandler>>;
-    logger?: JobLogger;
-    pollIntervalMs?: number;
-    /** Retry ceiling per job before it is recorded failed. Default 3. */
-    maxAttempts?: number;
-    /**
-     * Where terminal outcomes are recorded. Defaults to a table in `db`, which is
-     * what makes `status()` survive a restart and lets a second process (a CLI, a
-     * sidecar worker) observe a completion it did not run.
-     */
-    results?: JobResultStore;
-    /**
-     * How long {@link JobBroker.onComplete} waits before giving up on a job that
-     * never terminates. Default 24h — long enough that a legitimate overnight
-     * pipeline still notifies, short enough that a lost job does not pin a
-     * pending promise forever.
-     */
-    completionTimeoutMs?: number;
-}
-export interface LocalJobBroker extends JobBroker {
-    /** Start the workers (one per registered kind). */
-    start(): void;
-    /** Stop workers and abort in-flight handler signals. Idempotent. */
-    stop(): Promise<void>;
-    /** Return jobs stuck in `Processing` past `timeoutMs` to the pending pool. */
-    requeueTimedOut(timeoutMs: number): void;
-}
-/**
- * Local profile: in-process workers over a SQLite-journalled queue.
- *
- * Completion is DURABLE, not heap-local: every terminal outcome is written to
- * the result store before anyone is notified, so `status()` survives a restart
- * and a waiter in another process sees the same answer as the worker's own. The
- * in-process notification is an optimization on top — it wakes local waiters
- * immediately instead of at the next poll — never the source of truth.
- */
-export declare function createLocalJobBroker(options: LocalJobBrokerOptions): LocalJobBroker;
-/**
- * Requeue jobs whose worker died mid-flight (a killed process leaves them
- * `Processing` forever otherwise). Call from the app's maintenance tick; the
- * SaaS profile gets the same guarantee from BullMQ's at-least-once lease.
- */
-export declare const requeueStalledJobs: (broker: LocalJobBroker, timeoutMs: number) => void;
-//# sourceMappingURL=jobBroker.d.ts.map

package/dist/server/drivers/jobBroker.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"jobBroker.d.ts","sourceRoot":"","sources":["../../../src/server/drivers/jobBroker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAK3C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EACL,KAAK,sBAAsB,EAG3B,KAAK,cAAc,EAGpB,MAAM,cAAc,CAAC;AAEtB,MAAM,MAAM,KAAK,GAAG,MAAM,CAAC;AAE3B,MAAM,WAAW,OAAO;IACtB,kFAAkF;IAClF,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,oDAAoD;IACpD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,KAAK,CAAC;IACb,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,KAAK,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;OAMG;IACH,MAAM,EAAE,WAAW,CAAC;IACpB,MAAM,EAAE,SAAS,CAAC;CACnB;AAED,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,iBAAiB,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;AAElH,MAAM,WAAW,SAAS;IACxB,OAAO,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IACtC;;;;;;;;;;;OAWG;IACH,UAAU,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,MAAM,EAAE,SAAS,KAAK,IAAI,GAAG,IAAI,CAAC;IAC7D;;;;OAIG;IACH,eAAe,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,sBAAsB,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACjF,MAAM,CAAC,EAAE,EAAE,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,CAAC,EAAE,EAAE,KAAK,GAAG,OAAO,CAAC,SAAS,GAAG;QAAE,KAAK,EAAE,KAAK,CAAC;QAAC,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC;IACnE;;;;;;;;OAQG;IACH,KAAK,CAAC,IAAI,IAAI,CAAC;CAChB;AASD,MAAM,WAAW,qBAAqB;IACpC,uFAAuF;IACvF,EAAE,EAAE,QAAQ,CAAC;IACb,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IAC/C,MAAM,CAAC,EAAE,SAAS,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,qEAAqE;IACrE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,cAAe,SAAQ,SAAS;IAC/C,mDAAmD;IACnD,KAAK,IAAI,IAAI,CAAC;IACd,oEAAoE;IACpE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB,8EAA8E;IAC9E,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1C;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,qBAAqB,GAAG,cAAc,CAsMnF;AAED;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,GAAI,QAAQ,cAAc,EAAE,WAAW,MAAM,KAAG,IAE9E,CAAC"}

package/dist/server/drivers/jobBroker.js

@@ -1,211 +0,0 @@
-import { defineQueue, defineWorker } from 'plainjob';
-import { AppError } from '../errors';
-import { defaultJobLogger } from '../jobs/logger';
-import { createPlainjobConnection } from '../jobs/plainjobAdapter';
-import { awaitRecordedCompletion, createSqliteJobResultStore, UNSCOPED_TENANT, } from './jobResults';
-/**
- * Local profile: in-process workers over a SQLite-journalled queue.
- *
- * Completion is DURABLE, not heap-local: every terminal outcome is written to
- * the result store before anyone is notified, so `status()` survives a restart
- * and a waiter in another process sees the same answer as the worker's own. The
- * in-process notification is an optimization on top — it wakes local waiters
- * immediately instead of at the next poll — never the source of truth.
- */
-export function createLocalJobBroker(options) {
-    const logger = options.logger ?? defaultJobLogger;
-    const connection = createPlainjobConnection(options.db);
-    const queue = defineQueue({ connection, logger });
-    const results = options.results ?? createSqliteJobResultStore(options.db);
-    const completionTimeoutMs = options.completionTimeoutMs ?? 86_400_000;
-    const workers = [];
-    const stopController = new AbortController();
-    const cancelled = new Set();
-    /** Tenancy/routing captured at enqueue, so a settle can record a scoped row. */
-    const routing = new Map();
-    /** Local wake-ups for `awaitCompletion` — the poll is the fallback, not the mechanism. */
-    const waiters = new Set();
-    /** Per-job abort controllers for the currently-executing handlers, so a
-     *  `cancel(id)` can abort THAT job's signal, not just flip a flag. */
-    const inFlight = new Map();
-    let started = false;
-    const settle = async (result, scope) => {
-        const route = scope ?? routing.get(result.jobId);
-        const record = {
-            ...result,
-            // A job whose routing was lost (recorded by a different process, then
-            // cancelled here) still needs a tenant: the queue row's is unavailable, so
-            // fall back to a sentinel rather than writing a NULL that no reader can scope.
-            tenantId: route?.tenantId ?? UNSCOPED_TENANT,
-            instanceId: route?.instanceId,
-        };
-        // Record, THEN wake — a waiter must never observe the wake without the row
-        // it is being woken for. Awaiting the write is what keeps that true now
-        // that the store may live across a network.
-        await results.record(record);
-        routing.delete(result.jobId);
-        for (const wake of [...waiters]) {
-            try {
-                wake();
-            }
-            catch (error) {
-                logger.error(`JobBroker completion waiter for ${result.jobId} threw`, error);
-            }
-        }
-    };
-    /**
-     * Settle from a SYNCHRONOUS callback (plainjob's `onFailed`). The store write
-     * is fire-and-forget there because the queue library gives us nowhere to
-     * return a promise — but a failure must still be logged rather than becoming
-     * an unhandled rejection that takes the process down.
-     */
-    const settleDetached = (result, scope) => {
-        void settle(result, scope).catch((error) => {
-            logger.error(`JobBroker failed to record the outcome of ${result.jobId}`, error);
-        });
-    };
-    const readResult = async (id) => {
-        const recorded = await results.read(id);
-        if (!recorded)
-            return null;
-        return { jobId: recorded.jobId, ok: recorded.ok, output: recorded.output, error: recorded.error };
-    };
-    const subscribeWaiter = (cb) => {
-        waiters.add(cb);
-        return () => {
-            waiters.delete(cb);
-        };
-    };
-    return {
-        async enqueue(job) {
-            if (!options.handlers[job.kind])
-                throw new AppError(`No JobBroker handler registered for kind '${job.kind}'.`, {
-                    code: 'JOB_KIND_UNREGISTERED',
-                    status: 500,
-                    // Count, not the full handler list — this can surface to a caller and
-                    // the set of registered job kinds is reconnaissance surface (§3.2).
-                    context: { kind: job.kind, registeredCount: Object.keys(options.handlers).length },
-                });
-            const spec = { tenantId: job.tenantId, instanceId: job.instanceId, payload: job.payload };
-            const { id } = queue.add(job.kind, spec, job.delayMs === undefined ? undefined : { delay: job.delayMs });
-            const jobId = String(id);
-            routing.set(jobId, { tenantId: job.tenantId, instanceId: job.instanceId });
-            return jobId;
-        },
-        onComplete(id, cb) {
-            // ONE path, not a pre-read plus a wait: `awaitRecordedCompletion` reads
-            // the store before it arms anything, so an already-finished job still
-            // replays rather than hanging (the contract above). The pre-read only
-            // ever bought a SYNCHRONOUS callback, which the contract never promised
-            // and an async store cannot give — and keeping it would mean two code
-            // paths to the same callback, one of them exercised only by a race.
-            void awaitRecordedCompletion(results, id, {
-                timeoutMs: completionTimeoutMs,
-                subscribe: subscribeWaiter,
-            }).then((result) => cb({ jobId: result.jobId, ok: result.ok, output: result.output, error: result.error }), (error) => logger.error(`JobBroker completion wait for ${id} failed`, error));
-        },
-        async awaitCompletion(id, waitOptions = {}) {
-            const result = await awaitRecordedCompletion(results, id, { ...waitOptions, subscribe: subscribeWaiter });
-            return { jobId: result.jobId, ok: result.ok, output: result.output, error: result.error };
-        },
-        async cancel(id) {
-            cancelled.add(id);
-            // Abort the running handler's signal so a cancel-aware job actually stops,
-            // not merely gets recorded failed while it keeps burning CPU/tokens.
-            inFlight.get(id)?.abort(new DOMException(`Job ${id} cancelled`, 'AbortError'));
-            const numeric = Number(id);
-            if (Number.isFinite(numeric))
-                queue.markJobAsFailed(numeric, 'cancelled');
-            await settle({ jobId: id, ok: false, error: 'cancelled' });
-        },
-        async status(id) {
-            return (await readResult(id)) ?? { jobId: id, ok: null };
-        },
-        start() {
-            if (started)
-                return;
-            started = true;
-            for (const [kind, handler] of Object.entries(options.handlers)) {
-                const worker = defineWorker(kind, async (job) => {
-                    const jobId = String(job.id);
-                    if (cancelled.has(jobId))
-                        return;
-                    const spec = JSON.parse(job.data);
-                    // A per-job signal that fires on EITHER a broker-wide stop or a
-                    // targeted cancel(jobId). Linking the broker stop in means a handler
-                    // only has to watch one signal.
-                    const controller = new AbortController();
-                    const relayStop = () => controller.abort(stopController.signal.reason);
-                    if (stopController.signal.aborted)
-                        controller.abort(stopController.signal.reason);
-                    else
-                        stopController.signal.addEventListener('abort', relayStop, { once: true });
-                    inFlight.set(jobId, controller);
-                    try {
-                        const output = await handler(spec.payload, {
-                            jobId,
-                            tenantId: spec.tenantId,
-                            instanceId: spec.instanceId,
-                            signal: controller.signal,
-                            logger,
-                        });
-                        // If the job was cancelled while the handler was running, its
-                        // late normal return must NOT overwrite the recorded `cancelled`
-                        // result — that is the last-writer-wins race in §2.3.
-                        //
-                        // Scope comes off the PERSISTED spec, not the in-heap routing map:
-                        // a worker in another process never saw the enqueue, and a result
-                        // row it writes must still carry the right tenant.
-                        if (!cancelled.has(jobId))
-                            await settle({ jobId, ok: true, output }, { tenantId: spec.tenantId, instanceId: spec.instanceId });
-                    }
-                    finally {
-                        stopController.signal.removeEventListener('abort', relayStop);
-                        inFlight.delete(jobId);
-                    }
-                }, {
-                    queue,
-                    logger,
-                    pollIntervall: options.pollIntervalMs ?? 1000,
-                    onFailed: (job, error) => {
-                        const jobId = String(job.id);
-                        if (cancelled.has(jobId))
-                            return;
-                        let scope;
-                        try {
-                            const spec = JSON.parse(job.data);
-                            scope = { tenantId: spec.tenantId, instanceId: spec.instanceId };
-                        }
-                        catch {
-                            // Unparseable payload is itself the failure being recorded; the
-                            // routing map (if this process enqueued it) is the fallback.
-                        }
-                        settleDetached({ jobId, ok: false, error }, scope);
-                    },
-                });
-                workers.push(worker);
-                void worker.start();
-            }
-        },
-        async stop() {
-            if (!started)
-                return;
-            started = false;
-            stopController.abort();
-            await Promise.all(workers.splice(0).map((w) => w.stop()));
-            queue.close();
-        },
-        requeueTimedOut(timeoutMs) {
-            queue.requeueTimedOutJobs(timeoutMs);
-        },
-    };
-}
-/**
- * Requeue jobs whose worker died mid-flight (a killed process leaves them
- * `Processing` forever otherwise). Call from the app's maintenance tick; the
- * SaaS profile gets the same guarantee from BullMQ's at-least-once lease.
- */
-export const requeueStalledJobs = (broker, timeoutMs) => {
-    broker.requeueTimedOut(timeoutMs);
-};
-//# sourceMappingURL=jobBroker.js.map

package/dist/server/drivers/jobBroker.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"jobBroker.js","sourceRoot":"","sources":["../../../src/server/drivers/jobBroker.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,WAAW,EAAE,YAAY,EAA2B,MAAM,UAAU,CAAC;AAC9E,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AAEnE,OAAO,EAEL,uBAAuB,EACvB,0BAA0B,EAG1B,eAAe,GAChB,MAAM,cAAc,CAAC;AAgHtB;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAA8B;IACjE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,gBAAgB,CAAC;IAClD,MAAM,UAAU,GAAG,wBAAwB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACxD,MAAM,KAAK,GAAU,WAAW,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,0BAA0B,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC1E,MAAM,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,IAAI,UAAU,CAAC;IAEtE,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,cAAc,GAAG,IAAI,eAAe,EAAE,CAAC;IAC7C,MAAM,SAAS,GAAG,IAAI,GAAG,EAAS,CAAC;IACnC,gFAAgF;IAChF,MAAM,OAAO,GAAG,IAAI,GAAG,EAAoD,CAAC;IAC5E,0FAA0F;IAC1F,MAAM,OAAO,GAAG,IAAI,GAAG,EAAc,CAAC;IACtC;0EACsE;IACtE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA0B,CAAC;IACnD,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,MAAM,MAAM,GAAG,KAAK,EAAE,MAAiB,EAAE,KAAiD,EAAiB,EAAE;QAC3G,MAAM,KAAK,GAAG,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACjD,MAAM,MAAM,GAAsB;YAChC,GAAG,MAAM;YACT,sEAAsE;YACtE,2EAA2E;YAC3E,+EAA+E;YAC/E,QAAQ,EAAE,KAAK,EAAE,QAAQ,IAAI,eAAe;YAC5C,UAAU,EAAE,KAAK,EAAE,UAAU;SAC9B,CAAC;QACF,2EAA2E;QAC3E,wEAAwE;QACxE,4CAA4C;QAC5C,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC7B,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7B,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,OAAO,CAAC,EAAE,CAAC;YAChC,IAAI,CAAC;gBACH,IAAI,EAAE,CAAC;YACT,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,CAAC,mCAAmC,MAAM,CAAC,KAAK,QAAQ,EAAE,KAAK,CAAC,CAAC;YAC/E,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IAEF;;;;;OAKG;IACH,MAAM,cAAc,GAAG,CAAC,MAAiB,EAAE,KAAiD,EAAQ,EAAE;QACpG,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACzC,MAAM,CAAC,KAAK,CAAC,6CAA6C,MAAM,CAAC,KAAK,EAAE,EAAE,KAAK,CAAC,CAAC;QACnF,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,MAAM,UAAU,GAAG,KAAK,EAAE,EAAS,EAA6B,EAAE;QAChE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;IACpG,CAAC,CAAC;IAEF,MAAM,eAAe,GAAG,CAAC,EAAc,EAAgB,EAAE;QACvD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,GAAG,EAAE;YACV,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrB,CAAC,CAAC;IACJ,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,GAAY;YACxB,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;gBAC7B,MAAM,IAAI,QAAQ,CAAC,6CAA6C,GAAG,CAAC,IAAI,IAAI,EAAE;oBAC5E,IAAI,EAAE,uBAAuB;oBAC7B,MAAM,EAAE,GAAG;oBACX,sEAAsE;oBACtE,oEAAoE;oBACpE,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE;iBACnF,CAAC,CAAC;YACL,MAAM,IAAI,GAAkB,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;YACzG,MAAM,EAAE,EAAE,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACzG,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;YACzB,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;YAC3E,OAAO,KAAK,CAAC;QACf,CAAC;QAED,UAAU,CAAC,EAAS,EAAE,EAA+B;YACnD,wEAAwE;YACxE,sEAAsE;YACtE,sEAAsE;YACtE,wEAAwE;YACxE,sEAAsE;YACtE,oEAAoE;YACpE,KAAK,uBAAuB,CAAC,OAAO,EAAE,EAAE,EAAE;gBACxC,SAAS,EAAE,mBAAmB;gBAC9B,SAAS,EAAE,eAAe;aAC3B,CAAC,CAAC,IAAI,CACL,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,EAClG,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE,SAAS,EAAE,KAAK,CAAC,CAC7E,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,eAAe,CAAC,EAAS,EAAE,cAAsC,EAAE;YACvE,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,GAAG,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC,CAAC;YAC1G,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QAC5F,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,EAAS;YACpB,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAClB,2EAA2E;YAC3E,qEAAqE;YACrE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,IAAI,YAAY,CAAC,OAAO,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC;YAC/E,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;YAC3B,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,KAAK,CAAC,eAAe,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YAC1E,MAAM,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QAC7D,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,EAAS;YACpB,OAAO,CAAC,MAAM,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QAC3D,CAAC;QAED,KAAK;YACH,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC/D,MAAM,MAAM,GAAG,YAAY,CACzB,IAAI,EACJ,KAAK,EAAE,GAAG,EAAE,EAAE;oBACZ,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBAC7B,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC;wBAAE,OAAO;oBACjC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAkB,CAAC;oBAEnD,gEAAgE;oBAChE,qEAAqE;oBACrE,gCAAgC;oBAChC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;oBACzC,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;oBACvE,IAAI,cAAc,CAAC,MAAM,CAAC,OAAO;wBAAE,UAAU,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;;wBAC7E,cAAc,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;oBAChF,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;oBAEhC,IAAI,CAAC;wBACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE;4BACzC,KAAK;4BACL,QAAQ,EAAE,IAAI,CAAC,QAAQ;4BACvB,UAAU,EAAE,IAAI,CAAC,UAAU;4BAC3B,MAAM,EAAE,UAAU,CAAC,MAAM;4BACzB,MAAM;yBACP,CAAC,CAAC;wBACH,8DAA8D;wBAC9D,iEAAiE;wBACjE,sDAAsD;wBACtD,EAAE;wBACF,mEAAmE;wBACnE,kEAAkE;wBAClE,mDAAmD;wBACnD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC;4BACvB,MAAM,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;oBACxG,CAAC;4BAAS,CAAC;wBACT,cAAc,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;wBAC9D,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;oBACzB,CAAC;gBACH,CAAC,EACD;oBACE,KAAK;oBACL,MAAM;oBACN,aAAa,EAAE,OAAO,CAAC,cAAc,IAAI,IAAI;oBAC7C,QAAQ,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;wBACvB,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;wBAC7B,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC;4BAAE,OAAO;wBACjC,IAAI,KAA4D,CAAC;wBACjE,IAAI,CAAC;4BACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAkB,CAAC;4BACnD,KAAK,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;wBACnE,CAAC;wBAAC,MAAM,CAAC;4BACP,gEAAgE;4BAChE,6DAA6D;wBAC/D,CAAC;wBACD,cAAc,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,KAAK,CAAC,CAAC;oBACrD,CAAC;iBACF,CACF,CAAC;gBACF,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACrB,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC;YACtB,CAAC;QACH,CAAC;QAED,KAAK,CAAC,IAAI;YACR,IAAI,CAAC,OAAO;gBAAE,OAAO;YACrB,OAAO,GAAG,KAAK,CAAC;YAChB,cAAc,CAAC,KAAK,EAAE,CAAC;YACvB,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAC1D,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,CAAC;QAED,eAAe,CAAC,SAAiB;YAC/B,KAAK,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;QACvC,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,MAAsB,EAAE,SAAiB,EAAQ,EAAE;IACpF,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;AACpC,CAAC,CAAC"}

package/dist/server/drivers/jobResults.d.ts

@@ -1,158 +0,0 @@
-/**
- * Durable job outcomes — the cross-process half of `JobBroker` (03 §7.3).
- *
- * The original broker kept completion in two in-memory maps. That is correct for
- * one process and silently wrong for every other topology: a job enqueued on
- * API node A and executed by worker B completes in **B's heap**, so A's
- * `onComplete` callback never fires and A's `status()` reports "still running"
- * forever. A stateless multi-worker deployment is the whole point of the SaaS
- * profile, so a completion model that only works when enqueuer, worker and
- * subscriber share a heap is not a seam — it is a local implementation detail
- * that the interface promised to hide.
- *
- * The fix is to make the RESULT durable and shared rather than the callback
- * registry: a worker records the terminal outcome where anyone can read it, and
- * waiting is `awaitCompletion` (read-through, optionally push-accelerated)
- * instead of a heap-local callback. `onComplete` survives as sugar over that —
- * the same call now works across processes, which is what "just swap the impl"
- * always claimed.
- */
-import type { Database } from 'bun:sqlite';
-import { type StatementExecutor } from 'cwip/storage';
-import type { JobId, JobResult } from './jobBroker';
-/**
- * Tenant recorded when a terminal outcome is written by a path that cannot know
- * the job's tenant — a `cancel(id)` from a process that did not enqueue it. It
- * is a sentinel, not a real tenant: a scoped reader must treat it as "not mine",
- * which is why it is a named constant rather than an empty string that could be
- * mistaken for a missing column.
- */
-export declare const UNSCOPED_TENANT = "unknown";
-/** A terminal outcome plus the routing needed to scope and prune it. */
-export interface RecordedJobResult extends JobResult {
-    tenantId: string;
-    instanceId?: string;
-    /** ISO-8601 UTC. Stamped by the store when absent. */
-    at?: string;
-}
-/**
- * Where terminal outcomes live. Local profile: a table in the app's SQLite file.
- * SaaS: the same rows in Postgres, or a Redis hash with a TTL — the contract is
- * the same, which is the point.
- */
-/** What a scoped read of the outcome log asks for (03 §1e, the `orchestration` surface). */
-export interface JobResultQuery {
-    /**
-     * REQUIRED. A job outcome is tenant data, and the one read that lists rows
-     * rather than fetching a known id is exactly where a missing scope becomes a
-     * cross-tenant leak — so there is no "all tenants" overload to forget.
-     * {@link UNSCOPED_TENANT} rows belong to nobody and are never returned.
-     */
-    tenantId: string;
-    /** Cap the page. Default 50; a run log is read from the top, not exhausted. */
-    limit?: number;
-}
-/**
- * Every verb is ASYNC, and that is load-bearing rather than stylistic.
- *
- * The interface was synchronous for its first two arcs, which quietly limited
- * it to the two stores that could be: `bun:sqlite` (synchronous, and therefore
- * PER-NODE — it cannot be shared) and a heap map (which is the exact thing this
- * module's docstring rules out). A Postgres or Redis store — the only kind that
- * is actually SHARED, and so the only kind that makes the promise at the top of
- * this file true — cannot implement a synchronous interface at all. So the
- * multi-node completion story was unimplementable as designed: a job completed
- * by worker B was invisible to a waiter on node A, which is precisely the
- * failure this module exists to prevent.
- *
- * `AsyncRevocationStore` is async for exactly the same reason and has been since
- * it landed; this is that shape, applied where it was missed (owner decision E17).
- */
-export interface JobResultStore {
-    /** Record a terminal outcome. Idempotent: the first write for an id wins. */
-    record(result: RecordedJobResult): Promise<void>;
-    /** Read a recorded outcome, or `null` while the job is still in flight. */
-    read(id: JobId): Promise<RecordedJobResult | null>;
-    /** The tenant's most recent outcomes, newest first. */
-    list(query: JobResultQuery): Promise<readonly RecordedJobResult[]>;
-    /** Drop outcomes older than `maxAgeMs`. Returns the number removed. */
-    prune(maxAgeMs: number): Promise<number>;
-}
-/** Default page size for {@link JobResultStore.list}. */
-export declare const JOB_RESULT_PAGE = 50;
-export declare const JOB_RESULTS_TABLE = "cc_job_results";
-/**
- * `ok` is stored as INTEGER because SQLite has no boolean; `output` is JSON
- * because a job's return value is arbitrary. `tenant_id` is NOT NULL under the
- * same law as every other table (01 §2) — a result row is data, and untenanted
- * data is the thing that leaks.
- */
-export declare const JOB_RESULTS_DDL = "CREATE TABLE IF NOT EXISTS cc_job_results (\n  job_id      TEXT PRIMARY KEY NOT NULL,\n  tenant_id   TEXT NOT NULL,\n  instance_id TEXT,\n  ok          INTEGER NOT NULL,\n  output      TEXT,\n  error       TEXT,\n  at          TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now'))\n)";
-export declare const JOB_RESULTS_INDEX = "CREATE INDEX IF NOT EXISTS cc_job_results_at ON cc_job_results(at)";
-/**
- * The store over any {@link StatementExecutor} — the ONE implementation.
- *
- * Both the per-node SQLite store and the shared Postgres store are this
- * function with a different executor, which is what makes "the contract is the
- * same, which is the point" (the docstring at the top of this file) a fact
- * about the code rather than an aspiration about two hand-written copies.
- *
- * It does NOT create the table: DDL ownership differs per substrate (the app's
- * own file versus a migration a deployment runs once against a shared
- * database), and a library that quietly issued DDL against a shared Postgres
- * would be a second schema owner.
- */
-export declare const createStatementJobResultStore: (executor: StatementExecutor) => JobResultStore;
-/**
- * SQLite-backed store. Shares the app's DB handle, so a result is committed in
- * the same file the queue journal lives in — a crash between "job done" and
- * "result recorded" is the only remaining gap, and re-leasing re-runs the job.
- *
- * PER-NODE by construction, which is why it is not the saas answer: two API
- * nodes have two files, so a completion recorded by one is invisible to the
- * other. Use the pooled store for that (`createPgJobResultStore`).
- */
-export declare const createSqliteJobResultStore: (db: Database) => JobResultStore;
-/** In-memory store — tests and single-process hosts with no DB handle. */
-export declare const createMemoryJobResultStore: () => JobResultStore;
-/**
- * Record a stateless worker's terminal outcome in the shared store.
- *
- * A SaaS worker owns no waiter registry and no callback map — it runs in a
- * different process from every enqueuer and subscriber. Writing the row IS its
- * only completion notification: API nodes read it through {@link
- * awaitRecordedCompletion}, and the backend's own `completed` event (fired when
- * the worker acks the lease AFTER this write) is what wakes them from a poll to
- * an immediate re-read. Hence the ordering law the worker must honor — record
- * here, THEN ack the lease — so a waiter woken by the completed event always
- * finds the row already durable.
- *
- * `record` is first-writer-wins (the store's law), which is exactly what makes
- * this safe to call after a `cancel(id)` already wrote a `cancelled` row: a
- * handler that finishes normally moments after being cancelled does not
- * resurrect the job. The helper exists as a named seam so that law has one
- * documented call site rather than a bare `store.record` scattered through the
- * worker loop.
- */
-export declare const recordWorkerResult: (store: JobResultStore, result: RecordedJobResult) => Promise<void>;
-export interface AwaitCompletionOptions {
-    /** Give up after this long. Default 5 minutes. */
-    timeoutMs?: number;
-    /** Read-through interval. Default 250ms. */
-    pollMs?: number;
-    /** Abort the wait (request cancelled, server stopping). */
-    signal?: AbortSignal;
-}
-/**
- * Wait for a terminal outcome by READING the shared store.
- *
- * Polling is the floor, not the mechanism: a broker with a completion bus wakes
- * the wait immediately and the poll is only the safety net for a missed
- * notification. Getting that ordering right is what makes the contract
- * identical in-process and across a Redis-backed fleet — the caller cannot tell
- * which one delivered.
- */
-export declare const awaitRecordedCompletion: (store: JobResultStore, id: JobId, options?: AwaitCompletionOptions & {
-    subscribe?: (cb: () => void) => () => void;
-}) => Promise<RecordedJobResult>;
-//# sourceMappingURL=jobResults.d.ts.map

package/dist/server/drivers/jobResults.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"jobResults.d.ts","sourceRoot":"","sources":["../../../src/server/drivers/jobResults.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAwC,KAAK,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAE5F,OAAO,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAEpD;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,YAAY,CAAC;AAEzC,wEAAwE;AACxE,MAAM,WAAW,iBAAkB,SAAQ,SAAS;IAClD,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sDAAsD;IACtD,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAED;;;;GAIG;AACH,4FAA4F;AAC5F,MAAM,WAAW,cAAc;IAC7B;;;;;OAKG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,cAAc;IAC7B,6EAA6E;IAC7E,MAAM,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,2EAA2E;IAC3E,IAAI,CAAC,EAAE,EAAE,KAAK,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;IACnD,uDAAuD;IACvD,IAAI,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,SAAS,iBAAiB,EAAE,CAAC,CAAC;IACnE,uEAAuE;IACvE,KAAK,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC1C;AAED,yDAAyD;AACzD,eAAO,MAAM,eAAe,KAAK,CAAC;AAElC,eAAO,MAAM,iBAAiB,mBAAmB,CAAC;AAElD;;;;;GAKG;AACH,eAAO,MAAM,eAAe,uSAQ1B,CAAC;AAEH,eAAO,MAAM,iBAAiB,uEAA6E,CAAC;AA2E5G;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,6BAA6B,GAAI,UAAU,iBAAiB,KAAG,cAgB1E,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B,GAAI,IAAI,QAAQ,KAAG,cAIzD,CAAC;AAEF,0EAA0E;AAC1E,eAAO,MAAM,0BAA0B,QAAO,cA4B7C,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,kBAAkB,GAAU,OAAO,cAAc,EAAE,QAAQ,iBAAiB,KAAG,OAAO,CAAC,IAAI,CAEvG,CAAC;AAIF,MAAM,WAAW,sBAAsB;IACrC,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4CAA4C;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2DAA2D;IAC3D,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,GAClC,OAAO,cAAc,EACrB,IAAI,KAAK,EACT,UAAS,sBAAsB,GAAG;IAAE,SAAS,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,IAAI,KAAK,MAAM,IAAI,CAAA;CAAO,KACpF,OAAO,CAAC,iBAAiB,CA0I3B,CAAC"}