cursedbelt 2.8.0 → 3.0.0

package/dist/server/drivers/providers/transport.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"transport.js","sourceRoot":"","sources":["../../../../src/server/drivers/providers/transport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAGxC,iDAAiD;AACjD,MAAM,CAAC,MAAM,gBAAgB,GAAG,kBAAkB,CAAC;AACnD,mEAAmE;AACnE,MAAM,CAAC,MAAM,qBAAqB,GAAG,uBAAuB,CAAC;AAwB7D,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,QAAgB,EAAU,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAEvF;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,MAA+B,EAAE,SAAiB;IAI7E,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;IACvC,IAAI,MAAM,EAAE,OAAO;QAAE,UAAU,CAAC,KAAK,EAAE,CAAC;IACxC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAC3C,OAAO;QACL,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,KAAK,EAAE,GAAG,EAAE;YACV,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC9C,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAI,KAAQ,EAAE,QAAgB,EAAE,SAAiB;IAC3E,OAAO,MAAM,CAAC,MAAM,CAAC,KAAe,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAM,CAAC;AACtE,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,SAAS,CAAC,QAAiB,EAAE,SAAkB;IAC7D,MAAM,IAAI,GAAG,OAAO,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,IAAI,CAAC,CAAC;IACxF,MAAM,KAAK,GAAG,OAAO,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC,CAAC;IAC5F,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;IACjF,+EAA+E;IAC/E,6EAA6E;IAC7E,OAAO;QACL,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAE,QAAmB,CAAC,CAAC,CAAC,CAAC;QACzC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAE,SAAoB,CAAC,CAAC,CAAC,CAAC;QAC5C,GAAG,CAAC,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;KACpD,CAAC;AACJ,CAAC;AAUD,qFAAqF;AACrF,MAAM,cAAc,GAAG,GAAG,CAAC;AAE3B,MAAM,UAAU,iBAAiB,CAAC,OAAiC;IACjE,MAAM,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtG,OAAO,IAAI,QAAQ,CAAC,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,aAAa,OAAO,CAAC,MAAM,GAAG,MAAM,EAAE,EAAE;QAC7F,IAAI,EAAE,gBAAgB;QACtB,0EAA0E;QAC1E,4EAA4E;QAC5E,uDAAuD;QACvD,MAAM,EAAE,GAAG;QACX,QAAQ,EAAE,UAAU;QACpB,aAAa,EAAE,IAAI;QACnB,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,cAAc,EAAE,OAAO,CAAC,MAAM,EAAE;KAC5F,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,QAA2B,EAAE,IAAY,EAAE,IAAY;IACvF,OAAO,IAAI,QAAQ,CAAC,GAAG,QAAQ,IAAI,IAAI,6CAA6C,IAAI,EAAE,EAAE;QAC1F,IAAI,EAAE,qBAAqB;QAC3B,MAAM,EAAE,GAAG;QACX,QAAQ,EAAE,UAAU;QACpB,aAAa,EAAE,IAAI;QACnB,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;KAC5B,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAa;IAC/C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAChE,MAAM,KAAK,GAAI,IAA4B,CAAC,KAAK,CAAC;IAClD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,MAAM,OAAO,GAAI,KAA+B,CAAC,OAAO,CAAC;QACzD,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,OAAO,CAAC;IAClD,CAAC;IACD,MAAM,OAAO,GAAI,IAA8B,CAAC,OAAO,CAAC;IACxD,OAAO,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3D,CAAC;AAYD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAI,OAAwB;IACxD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE;QACpD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE;QACnE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC;QAClC,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,2EAA2E;QAC3E,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,SAAS,CAAC;QACrB,CAAC;QACD,MAAM,iBAAiB,CAAC;YACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,eAAe,EAAE,mBAAmB,CAAC,MAAM,CAAC;SAC7C,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAM,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,iBAAiB,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACtE,CAAC;AACH,CAAC"}

package/dist/server/drivers/retentionPolicy.d.ts

@@ -1,146 +0,0 @@
-/**
- * The retention WINDOWS, as state a deployment can read and change — owner
- * decision **D30**.
- *
- * ## What D30 actually asked for
- *
- * The previous arc landed {@link runRetentionJob} with the meter sweep OFF and
- * the window taken from `CC_METER_RETENTION_DAYS` on a cron line, and escalated
- * the number as a billing decision. The answer was *"Option A (400 days), but
- * make that an admin setting or something that I can stay on top of, then make
- * it be 1 month for now, so I can enable the 13 month version when this has
- * finally made real sales and accounts."*
- *
- * Two requirements, and the first is the one that changes the design: a number
- * living only in a crontab is not something anyone can stay on top of. Nothing
- * can show it, nothing records when it last changed, and the only way to read it
- * is to find the machine that runs the job. So the window becomes a ROW in the
- * control plane, with provenance, and `retention --show` prints it.
- *
- * ## One source of truth, and the env var is a WRITER rather than a rival
- *
- * The sweep reads the stored row and nothing else. `CC_METER_RETENTION_DAYS`
- * still works, but it is applied as an explicit {@link setRetentionWindow} with
- * `updatedBy: "env:CC_METER_RETENTION_DAYS"` *before* the sweep — so a deployment
- * that keeps its number in a cron line still gets a table that says the truth,
- * and `--show` can never disagree with what the last sweep actually used. Two
- * rules about one number means the untested one wins; this is one rule plus a
- * recorded writer.
- *
- * ## Why 30 days is the default and 400 is not
- *
- * A deleted meter row is a bill you can no longer justify to a customer, so 400
- * days (13 months — any monthly invoice re-derivable plus a month of slack for a
- * late dispute) remains the RECOMMENDED window for a deployment with real
- * revenue, and {@link RETENTION_RECOMMENDED_METER_DAYS} names it. Until then the
- * owner's answer is 30: pre-revenue, the rows are development traffic, nobody
- * will ever dispute one, and an unbounded table is the failure that actually
- * threatens the deployment. Raising it later is one `--set-meter-days 400`.
- *
- * ## A floor exists, and it is not a style preference
- *
- * {@link RETENTION_MIN_DAYS} refuses a window under a day. `--set-meter-days 0`
- * would not be "sweep aggressively", it would be *delete every row ever written
- * including the one from a second ago*, which is the single worst typo available
- * at this keyboard. Turning a sweep OFF is spelled {@link RETENTION_OFF} — a
- * distinct value, so "off" and "delete everything" cannot be one fat-finger
- * apart.
- */
-import type { StatementExecutor } from 'cwip/storage';
-/** The two append-only tables E35/D25 left growing. Extend deliberately: every
- *  subject added here is a new class of row somebody may need to produce later. */
-export type RetentionSubject = 'audit' | 'meter';
-export declare const RETENTION_SUBJECTS: readonly RetentionSubject[];
-/** Windows below this are refused — see the header. A day is already extreme. */
-export declare const RETENTION_MIN_DAYS = 1;
-/**
- * The sentinel for "do not sweep this table at all", stored as a real row so
- * that OFF is a decision somebody made on a date rather than an absent row that
- * could equally mean "never configured".
- */
-export declare const RETENTION_OFF = 0;
-/** A century. A window past this is a typo (an extra digit), not a policy. */
-export declare const RETENTION_MAX_DAYS = 36500;
-/**
- * What a deployment gets before anyone sets anything.
- *
- * `audit: 90` matches `AUDIT_TRAIL_RETENTION_MS` and the local profile's
- * per-node janitor, so the two profiles keep entries for the same time.
- * `meter: 30` is D30's answer for the pre-revenue phase; see the header.
- */
-export declare const RETENTION_POLICY_DEFAULTS: Readonly<Record<RetentionSubject, number>>;
-/** The window to move the meter to once invoices are real. Named so the runbook,
- *  the CLI hint and the report cannot each quote a different number. */
-export declare const RETENTION_RECOMMENDED_METER_DAYS = 400;
-export declare const RETENTION_POLICY_TABLE = "cc_retention_policy";
-/**
- * Authored for SQLite and compiled to Postgres by `toPostgresDdl`, like every
- * other control-plane table — one authored schema cannot drift from itself.
- *
- * `updated_by` is NOT NULL with no default on purpose: every write to this table
- * is somebody changing how long billing evidence survives, and "who" is the
- * first question anyone asks afterwards. `"env:CC_METER_RETENTION_DAYS"` and
- * `"cli"` are both real answers; an empty string is not.
- */
-export declare const RETENTION_POLICY_DDL = "CREATE TABLE IF NOT EXISTS cc_retention_policy (\n  subject TEXT PRIMARY KEY NOT NULL,\n  retain_days INTEGER NOT NULL,\n  updated_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now')),\n  updated_by TEXT NOT NULL\n)";
-export interface RetentionWindow {
-    readonly subject: RetentionSubject;
-    /** Days of history kept. {@link RETENTION_OFF} ⇒ this table is not swept. */
-    readonly retainDays: number;
-    /**
-     * `'default'` means no row exists — the deployment is running on
-     * {@link RETENTION_POLICY_DEFAULTS} and nobody has ever chosen. The CLI says
-     * so out loud, because "30 days because that is the default" and "30 days
-     * because the owner picked it" are very different states to be in when a
-     * customer disputes a charge.
-     */
-    readonly source: 'default' | 'stored';
-    readonly updatedAt?: string;
-    readonly updatedBy?: string;
-}
-/**
- * The set of billing/audit retention WINDOWS a deployment runs with — one per
- * subject. Named `RetentionWindows` (not `RetentionPolicy`) since DEDUP-8(c):
- * the canonical fleet `RetentionPolicy` is the category-based opt-in design in
- * `cursedbelt/server/retention`, and this billing-evidence concern is
- * deliberately distinct — a meter row is a bill you must keep, not diagnostic
- * data an owner can lose, so it is not expressible as a retention category.
- */
-export type RetentionWindows = Readonly<Record<RetentionSubject, RetentionWindow>>;
-/**
- * Validate a proposed window, or throw naming the bound it broke.
- *
- * Exported because the CLI validates argv before it opens a pool: refusing
- * `--set-meter-days -1` should not depend on a database being reachable.
- */
-export declare const assertRetainDays: (subject: RetentionSubject, retainDays: number) => number;
-/** Create the policy table if it is absent. Ships inside `SAAS_CONTROL_PLANE_DDL`
- *  too, so a deployment that runs the documented migration step needs no extra
- *  call; this exists for tests and for a SQLite-backed operator tool. */
-export declare const ensureRetentionPolicySchema: (executor: StatementExecutor) => Promise<void>;
-/**
- * Read every window, filling absent subjects from
- * {@link RETENTION_POLICY_DEFAULTS}.
- *
- * One statement for the whole policy: two subjects today, and a per-subject
- * `get` would make the read cost grow with a list this module expects to extend.
- */
-export declare const readRetentionPolicy: (executor: StatementExecutor) => Promise<RetentionWindows>;
-/**
- * Set one window, recording who did it and when — by the DATABASE clock, for the
- * same reason the sweep's cutoff uses it: two nodes and the database disagree
- * about the time, and a provenance record stamped by whichever machine happened
- * to run the CLI is a record nobody can line up against the sweep's own logs.
- */
-export declare const setRetentionWindow: (executor: StatementExecutor, options: {
-    readonly subject: RetentionSubject;
-    readonly retainDays: number;
-    readonly updatedBy: string;
-}) => Promise<RetentionWindow>;
-/**
- * The line an operator reads. Same text in `--show` and in the sweep's own log,
- * so a scheduled run and a hand check cannot describe the deployment
- * differently.
- */
-export declare const describeRetentionWindow: (window: RetentionWindow) => string;
-//# sourceMappingURL=retentionPolicy.d.ts.map

package/dist/server/drivers/retentionPolicy.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"retentionPolicy.d.ts","sourceRoot":"","sources":["../../../src/server/drivers/retentionPolicy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEtD;mFACmF;AACnF,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,OAAO,CAAC;AAEjD,eAAO,MAAM,kBAAkB,EAAE,SAAS,gBAAgB,EAAuB,CAAC;AAElF,iFAAiF;AACjF,eAAO,MAAM,kBAAkB,IAAI,CAAC;AAEpC;;;;GAIG;AACH,eAAO,MAAM,aAAa,IAAI,CAAC;AAE/B,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB,QAAS,CAAC;AAEzC;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAGhF,CAAC;AAEF;wEACwE;AACxE,eAAO,MAAM,gCAAgC,MAAM,CAAC;AAEpD,eAAO,MAAM,sBAAsB,wBAAwB,CAAC;AAE5D;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,uOAK/B,CAAC;AAEH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAC;IACnC,6EAA6E;IAC7E,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;;;;OAMG;IACH,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,QAAQ,CAAC;IACtC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,gBAAgB,GAAG,QAAQ,CAAC,MAAM,CAAC,gBAAgB,EAAE,eAAe,CAAC,CAAC,CAAC;AAYnF;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,GAAI,SAAS,gBAAgB,EAAE,YAAY,MAAM,KAAG,MAWhF,CAAC;AAEF;;yEAEyE;AACzE,eAAO,MAAM,2BAA2B,GAAU,UAAU,iBAAiB,KAAG,OAAO,CAAC,IAAI,CAE3F,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,GAAU,UAAU,iBAAiB,KAAG,OAAO,CAAC,gBAAgB,CAyB/F,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAC7B,UAAU,iBAAiB,EAC3B,SAAS;IAAE,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,KACvG,OAAO,CAAC,eAAe,CAkBzB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,GAAI,QAAQ,eAAe,KAAG,MAQjE,CAAC"}

package/dist/server/drivers/retentionPolicy.js

@@ -1,135 +0,0 @@
-export const RETENTION_SUBJECTS = ['audit', 'meter'];
-/** Windows below this are refused — see the header. A day is already extreme. */
-export const RETENTION_MIN_DAYS = 1;
-/**
- * The sentinel for "do not sweep this table at all", stored as a real row so
- * that OFF is a decision somebody made on a date rather than an absent row that
- * could equally mean "never configured".
- */
-export const RETENTION_OFF = 0;
-/** A century. A window past this is a typo (an extra digit), not a policy. */
-export const RETENTION_MAX_DAYS = 36_500;
-/**
- * What a deployment gets before anyone sets anything.
- *
- * `audit: 90` matches `AUDIT_TRAIL_RETENTION_MS` and the local profile's
- * per-node janitor, so the two profiles keep entries for the same time.
- * `meter: 30` is D30's answer for the pre-revenue phase; see the header.
- */
-export const RETENTION_POLICY_DEFAULTS = {
-    audit: 90,
-    meter: 30,
-};
-/** The window to move the meter to once invoices are real. Named so the runbook,
- *  the CLI hint and the report cannot each quote a different number. */
-export const RETENTION_RECOMMENDED_METER_DAYS = 400;
-export const RETENTION_POLICY_TABLE = 'cc_retention_policy';
-/**
- * Authored for SQLite and compiled to Postgres by `toPostgresDdl`, like every
- * other control-plane table — one authored schema cannot drift from itself.
- *
- * `updated_by` is NOT NULL with no default on purpose: every write to this table
- * is somebody changing how long billing evidence survives, and "who" is the
- * first question anyone asks afterwards. `"env:CC_METER_RETENTION_DAYS"` and
- * `"cli"` are both real answers; an empty string is not.
- */
-export const RETENTION_POLICY_DDL = `CREATE TABLE IF NOT EXISTS ${RETENTION_POLICY_TABLE} (
-  subject TEXT PRIMARY KEY NOT NULL,
-  retain_days INTEGER NOT NULL,
-  updated_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now')),
-  updated_by TEXT NOT NULL
-)`;
-const isSubject = (value) => RETENTION_SUBJECTS.includes(value);
-/**
- * Validate a proposed window, or throw naming the bound it broke.
- *
- * Exported because the CLI validates argv before it opens a pool: refusing
- * `--set-meter-days -1` should not depend on a database being reachable.
- */
-export const assertRetainDays = (subject, retainDays) => {
-    if (!Number.isInteger(retainDays))
-        throw new Error(`The ${subject} retention window must be a whole number of days, got ${JSON.stringify(retainDays)}.`);
-    if (retainDays === RETENTION_OFF)
-        return RETENTION_OFF;
-    if (retainDays < RETENTION_MIN_DAYS)
-        throw new Error(`A ${subject} retention window of ${retainDays} days is refused. Use ${RETENTION_OFF} to turn the sweep OFF; anything between that and ${RETENTION_MIN_DAYS} would delete rows written moments ago.`);
-    if (retainDays > RETENTION_MAX_DAYS)
-        throw new Error(`A ${subject} retention window of ${retainDays} days is past the ${RETENTION_MAX_DAYS}-day ceiling — that is an extra digit, not a policy.`);
-    return retainDays;
-};
-/** Create the policy table if it is absent. Ships inside `SAAS_CONTROL_PLANE_DDL`
- *  too, so a deployment that runs the documented migration step needs no extra
- *  call; this exists for tests and for a SQLite-backed operator tool. */
-export const ensureRetentionPolicySchema = async (executor) => {
-    await executor.write({ sql: RETENTION_POLICY_DDL });
-};
-/**
- * Read every window, filling absent subjects from
- * {@link RETENTION_POLICY_DEFAULTS}.
- *
- * One statement for the whole policy: two subjects today, and a per-subject
- * `get` would make the read cost grow with a list this module expects to extend.
- */
-export const readRetentionPolicy = async (executor) => {
-    const rows = await executor.all({
-        sql: `SELECT subject, retain_days, updated_at, updated_by FROM ${RETENTION_POLICY_TABLE}`,
-    });
-    const stored = new Map();
-    for (const row of rows)
-        if (isSubject(row.subject))
-            stored.set(row.subject, row);
-    const policy = {};
-    for (const subject of RETENTION_SUBJECTS) {
-        const row = stored.get(subject);
-        policy[subject] =
-            row === undefined
-                ? { subject, retainDays: RETENTION_POLICY_DEFAULTS[subject], source: 'default' }
-                : {
-                    subject,
-                    // A pg `bigint` arrives as a string. `Number` here rather than at the
-                    // call site, so no caller can compare a window against a string and
-                    // silently always lose.
-                    retainDays: Number(row.retain_days),
-                    source: 'stored',
-                    updatedAt: row.updated_at,
-                    updatedBy: row.updated_by,
-                };
-    }
-    return policy;
-};
-/**
- * Set one window, recording who did it and when — by the DATABASE clock, for the
- * same reason the sweep's cutoff uses it: two nodes and the database disagree
- * about the time, and a provenance record stamped by whichever machine happened
- * to run the CLI is a record nobody can line up against the sweep's own logs.
- */
-export const setRetentionWindow = async (executor, options) => {
-    const retainDays = assertRetainDays(options.subject, options.retainDays);
-    const updatedBy = options.updatedBy.trim();
-    if (updatedBy.length === 0)
-        throw new Error('setRetentionWindow requires a non-empty `updatedBy` — "who changed how long billing evidence survives" is the first question asked afterwards.');
-    await executor.write({
-        sql: `INSERT INTO ${RETENTION_POLICY_TABLE} (subject, retain_days, updated_at, updated_by)
-          VALUES (?, ?, {{now}}, ?)
-          ON CONFLICT (subject) DO UPDATE SET
-            retain_days = excluded.retain_days,
-            updated_at = excluded.updated_at,
-            updated_by = excluded.updated_by`,
-        params: [options.subject, retainDays, updatedBy],
-    });
-    const policy = await readRetentionPolicy(executor);
-    return policy[options.subject];
-};
-/**
- * The line an operator reads. Same text in `--show` and in the sweep's own log,
- * so a scheduled run and a hand check cannot describe the deployment
- * differently.
- */
-export const describeRetentionWindow = (window) => {
-    const value = window.retainDays === RETENTION_OFF ? 'OFF (never swept)' : `${window.retainDays} day${window.retainDays === 1 ? '' : 's'}`;
-    const provenance = window.source === 'default'
-        ? 'default — nobody has chosen yet'
-        : `set by ${window.updatedBy ?? 'unknown'} at ${window.updatedAt ?? 'unknown'}`;
-    return `${window.subject.padEnd(6)} ${value.padEnd(20)} (${provenance})`;
-};
-//# sourceMappingURL=retentionPolicy.js.map

package/dist/server/drivers/retentionPolicy.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"retentionPolicy.js","sourceRoot":"","sources":["../../../src/server/drivers/retentionPolicy.ts"],"names":[],"mappings":"AAsDA,MAAM,CAAC,MAAM,kBAAkB,GAAgC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAElF,iFAAiF;AACjF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAEpC;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC;AAE/B,8EAA8E;AAC9E,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAEzC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAA+C;IACnF,KAAK,EAAE,EAAE;IACT,KAAK,EAAE,EAAE;CACV,CAAC;AAEF;wEACwE;AACxE,MAAM,CAAC,MAAM,gCAAgC,GAAG,GAAG,CAAC;AAEpD,MAAM,CAAC,MAAM,sBAAsB,GAAG,qBAAqB,CAAC;AAE5D;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,8BAA8B,sBAAsB;;;;;EAKtF,CAAC;AAmCH,MAAM,SAAS,GAAG,CAAC,KAAa,EAA6B,EAAE,CAC5D,kBAAwC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAE5D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,OAAyB,EAAE,UAAkB,EAAU,EAAE;IACxF,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,OAAO,OAAO,yDAAyD,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACxH,IAAI,UAAU,KAAK,aAAa;QAAE,OAAO,aAAa,CAAC;IACvD,IAAI,UAAU,GAAG,kBAAkB;QACjC,MAAM,IAAI,KAAK,CACb,KAAK,OAAO,wBAAwB,UAAU,yBAAyB,aAAa,qDAAqD,kBAAkB,yCAAyC,CACrM,CAAC;IACJ,IAAI,UAAU,GAAG,kBAAkB;QACjC,MAAM,IAAI,KAAK,CAAC,KAAK,OAAO,wBAAwB,UAAU,qBAAqB,kBAAkB,sDAAsD,CAAC,CAAC;IAC/J,OAAO,UAAU,CAAC;AACpB,CAAC,CAAC;AAEF;;yEAEyE;AACzE,MAAM,CAAC,MAAM,2BAA2B,GAAG,KAAK,EAAE,QAA2B,EAAiB,EAAE;IAC9F,MAAM,QAAQ,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,oBAAoB,EAAE,CAAC,CAAC;AACtD,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EAAE,QAA2B,EAA6B,EAAE;IAClG,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAY;QACzC,GAAG,EAAE,4DAA4D,sBAAsB,EAAE;KAC1F,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,IAAI,GAAG,EAA+B,CAAC;IACtD,KAAK,MAAM,GAAG,IAAI,IAAI;QAAE,IAAI,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAEjF,MAAM,MAAM,GAAG,EAA+C,CAAC;IAC/D,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;QACzC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAChC,MAAM,CAAC,OAAO,CAAC;YACb,GAAG,KAAK,SAAS;gBACf,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,yBAAyB,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE;gBAChF,CAAC,CAAC;oBACE,OAAO;oBACP,sEAAsE;oBACtE,oEAAoE;oBACpE,wBAAwB;oBACxB,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC;oBACnC,MAAM,EAAE,QAAQ;oBAChB,SAAS,EAAE,GAAG,CAAC,UAAU;oBACzB,SAAS,EAAE,GAAG,CAAC,UAAU;iBAC1B,CAAC;IACV,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,EACrC,QAA2B,EAC3B,OAAwG,EAC9E,EAAE;IAC5B,MAAM,UAAU,GAAG,gBAAgB,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IACzE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;IAC3C,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,gJAAgJ,CAAC,CAAC;IAEpK,MAAM,QAAQ,CAAC,KAAK,CAAC;QACnB,GAAG,EAAE,eAAe,sBAAsB;;;;;6CAKD;QACzC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,CAAC;KACjD,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IACnD,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;AACjC,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,MAAuB,EAAU,EAAE;IACzE,MAAM,KAAK,GACT,MAAM,CAAC,UAAU,KAAK,aAAa,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,OAAO,MAAM,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IAC9H,MAAM,UAAU,GACd,MAAM,CAAC,MAAM,KAAK,SAAS;QACzB,CAAC,CAAC,iCAAiC;QACnC,CAAC,CAAC,UAAU,MAAM,CAAC,SAAS,IAAI,SAAS,OAAO,MAAM,CAAC,SAAS,IAAI,SAAS,EAAE,CAAC;IACpF,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,UAAU,GAAG,CAAC;AAC3E,CAAC,CAAC"}

package/dist/server/drivers/retentionPolicy.pg.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=retentionPolicy.pg.test.d.ts.map

package/dist/server/drivers/retentionPolicy.pg.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"retentionPolicy.pg.test.d.ts","sourceRoot":"","sources":["../../../src/server/drivers/retentionPolicy.pg.test.ts"],"names":[],"mappings":""}

package/dist/server/drivers/retentionPolicy.pg.test.js

@@ -1,89 +0,0 @@
-/**
- * The retention policy table against a REAL Postgres (D30).
- *
- * `retentionPolicy.spec.ts` proves the behavior over SQLite and runs on every
- * gate. Three things only an engine can answer for, each of which fails by
- * producing a plausible WRONG value rather than an error:
- *
- *   * **`retain_days` is `bigint` on Postgres** (the `toPostgresDdl` mapping for
- *     `INTEGER`), and Bun's driver hands a bigint back as a **string**. A
- *     comparison like `days > 0` against `"30"` is true, and `days === 30` is
- *     false — so a policy read that skipped the coercion would turn the sweep
- *     off in exactly the deployment that configured it.
- *   * **`{{now}}` renders as `to_char(now() …)` here and `strftime` there.** The
- *     provenance stamp has to be an ISO-8601 string in both.
- *   * **The upsert is `ON CONFLICT (subject) DO UPDATE`** over a control-plane
- *     table, reached through `createPooledControlExecutor` — the same executor
- *     the sweep uses, and the same one the FORCE-RLS trap would silently defeat.
- *
- * SKIPPED, loudly, when `CC_PG_URL` is absent — a skip is a missing proof.
- */
-import { SQL } from 'bun';
-import { afterAll, beforeAll, beforeEach, describe, expect, it } from 'bun:test';
-import { toPostgresDdl } from 'cwip/storage';
-import { createPooledControlExecutor } from './pooledControlStores';
-import { readRetentionPolicy, RETENTION_POLICY_DDL, RETENTION_POLICY_DEFAULTS, RETENTION_POLICY_TABLE, setRetentionWindow, } from './retentionPolicy';
-const URL_ = process.env.CC_PG_URL;
-let sql;
-let executor;
-// SKIPPED unless CC_PG_URL names a throwaway Postgres — this suite's subject IS the engine. `bun run test:pg` supplies one.
-describe.skipIf(!URL_)('the retention policy table against a real Postgres (D30)', () => {
-    beforeAll(async () => {
-        sql = new SQL(URL_);
-        const connection = {
-            async query(text, params = []) {
-                return (await sql.unsafe(text, [...params]));
-            },
-            async execute(text, params = []) {
-                const result = await sql.unsafe(text, [...params]);
-                return { rowCount: result.count ?? 0 };
-            },
-        };
-        const pool = {
-            async withConnection(fn) {
-                return await fn(connection);
-            },
-        };
-        executor = createPooledControlExecutor(pool);
-        await sql.unsafe(`DROP TABLE IF EXISTS ${RETENTION_POLICY_TABLE}`);
-        // Through the COMPILER, exactly as `SAAS_CONTROL_PLANE_DDL` does it — a test
-        // that hand-wrote the pg form would prove the hand-written copy, not the
-        // chain a deployment runs.
-        await sql.unsafe(toPostgresDdl(RETENTION_POLICY_DDL));
-    }, 120_000);
-    afterAll(async () => {
-        await sql?.close();
-    });
-    beforeEach(async () => {
-        await sql.unsafe(`DELETE FROM ${RETENTION_POLICY_TABLE}`);
-    });
-    it('reads the defaults from an empty table', async () => {
-        const policy = await readRetentionPolicy(executor);
-        expect(policy.meter).toMatchObject({ retainDays: RETENTION_POLICY_DEFAULTS.meter, source: 'default' });
-    });
-    it('🔴 returns retain_days as a NUMBER, not the bigint STRING the driver hands back', async () => {
-        await setRetentionWindow(executor, { subject: 'meter', retainDays: 400, updatedBy: 'cli:pg-test' });
-        const window = (await readRetentionPolicy(executor)).meter;
-        // `toBe(400)` is the assertion — `"400"` would pass a truthiness check, pass
-        // `> 0`, and then fail every comparison the sweep actually makes.
-        expect(window.retainDays).toBe(400);
-        expect(typeof window.retainDays).toBe('number');
-        expect(window.source).toBe('stored');
-    });
-    it('stamps `updated_at` from POSTGRES’ clock as an ISO-8601 string', async () => {
-        const window = await setRetentionWindow(executor, { subject: 'audit', retainDays: 120, updatedBy: 'cli:pg-test' });
-        expect(window.updatedAt).toMatch(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/);
-        // Same rendering as every other `{{now}}` column in this deployment, so a
-        // policy change can be lined up against the audit row it explains.
-        const drift = Math.abs(Date.parse(window.updatedAt) - Date.now());
-        expect(drift).toBeLessThan(60_000);
-    });
-    it('upserts in place — `ON CONFLICT (subject) DO UPDATE`, one row per subject', async () => {
-        await setRetentionWindow(executor, { subject: 'meter', retainDays: 30, updatedBy: 'env:CC_METER_RETENTION_DAYS' });
-        await setRetentionWindow(executor, { subject: 'meter', retainDays: 400, updatedBy: 'cli:curt' });
-        const rows = (await sql.unsafe(`SELECT COUNT(*)::int AS n FROM ${RETENTION_POLICY_TABLE}`));
-        expect(rows[0]?.n).toBe(1);
-        expect((await readRetentionPolicy(executor)).meter).toMatchObject({ retainDays: 400, updatedBy: 'cli:curt' });
-    });
-});
-//# sourceMappingURL=retentionPolicy.pg.test.js.map

package/dist/server/drivers/retentionPolicy.pg.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"retentionPolicy.pg.test.js","sourceRoot":"","sources":["../../../src/server/drivers/retentionPolicy.pg.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,GAAG,EAAE,MAAM,KAAK,CAAC;AAC1B,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,UAAU,CAAC;AACjF,OAAO,EAAE,aAAa,EAA8D,MAAM,cAAc,CAAC;AACzG,OAAO,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,yBAAyB,EACzB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;AAEnC,IAAI,GAAQ,CAAC;AACb,IAAI,QAA2B,CAAC;AAEhC,4HAA4H;AAC5H,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,0DAA0D,EAAE,GAAG,EAAE;IACtF,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,GAAG,GAAG,IAAI,GAAG,CAAC,IAAc,CAAC,CAAC;QAC9B,MAAM,UAAU,GAAmB;YACjC,KAAK,CAAC,KAAK,CAAI,IAAY,EAAE,SAA6B,EAAE;gBAC1D,OAAO,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAQ,CAAC;YACtD,CAAC;YACD,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,SAA6B,EAAE;gBACzD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC;gBACnD,OAAO,EAAE,QAAQ,EAAG,MAA6B,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;YACjE,CAAC;SACF,CAAC;QACF,MAAM,IAAI,GAAa;YACrB,KAAK,CAAC,cAAc,CAAC,EAAE;gBACrB,OAAO,MAAM,EAAE,CAAC,UAAU,CAAC,CAAC;YAC9B,CAAC;SACF,CAAC;QACF,QAAQ,GAAG,2BAA2B,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,GAAG,CAAC,MAAM,CAAC,wBAAwB,sBAAsB,EAAE,CAAC,CAAC;QACnE,6EAA6E;QAC7E,yEAAyE;QACzE,2BAA2B;QAC3B,MAAM,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,oBAAoB,CAAC,CAAC,CAAC;IACxD,CAAC,EAAE,OAAO,CAAC,CAAC;IAEZ,QAAQ,CAAC,KAAK,IAAI,EAAE;QAClB,MAAM,GAAG,EAAE,KAAK,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,UAAU,CAAC,KAAK,IAAI,EAAE;QACpB,MAAM,GAAG,CAAC,MAAM,CAAC,eAAe,sBAAsB,EAAE,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;QACtD,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QACnD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,aAAa,CAAC,EAAE,UAAU,EAAE,yBAAyB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IACzG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iFAAiF,EAAE,KAAK,IAAI,EAAE;QAC/F,MAAM,kBAAkB,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC,CAAC;QACpG,MAAM,MAAM,GAAG,CAAC,MAAM,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;QAC3D,6EAA6E;QAC7E,kEAAkE;QAClE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpC,MAAM,CAAC,OAAO,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC,CAAC;QACnH,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,+CAA+C,CAAC,CAAC;QAClF,0EAA0E;QAC1E,mEAAmE;QACnE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAmB,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC5E,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QACzF,MAAM,kBAAkB,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,6BAA6B,EAAE,CAAC,CAAC;QACnH,MAAM,kBAAkB,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC;QACjG,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,kCAAkC,sBAAsB,EAAE,CAAC,CAAyB,CAAC;QACpH,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,CAAC,CAAC,MAAM,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,aAAa,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC;IAChH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/server/drivers/saasJobBroker.d.ts

@@ -1,96 +0,0 @@
-import type { JobLogger } from '../jobs/types';
-import type { JobBroker, JobId } from './jobBroker';
-import { type JobResultStore, type RecordedJobResult } from './jobResults';
-/** What the broker persists for a worker to pick up. */
-export interface SaasQueuePayload {
-    kind: string;
-    tenantId: string;
-    instanceId?: string;
-    payload: Record<string, unknown>;
-}
-/**
- * A payload the backend has DELIVERED to a worker — the persisted envelope plus
- * the queue's own id, which is the {@link JobId} everywhere else. The consumer
- * side of {@link SaasQueueBackend.lease} hands one of these to the processor.
- */
-export interface LeasedJob extends SaasQueuePayload {
-    id: JobId;
-}
-/**
- * The worker's processor. Resolving ACKNOWLEDGES the lease (the backend marks
- * the job completed and stops redelivering it); throwing leaves the lease to
- * expire so the backend redelivers per its own retry policy. The processor is
- * expected to have made the outcome durable (recorded in the shared
- * {@link JobResultStore}) BEFORE it resolves — see {@link runSaasJobWorker}.
- */
-export type LeaseProcessor = (job: LeasedJob) => Promise<void>;
-export interface LeaseOptions {
-    /** How many leased jobs the backend may run through the processor at once. */
-    concurrency: number;
-}
-/**
- * A running lease subscription. {@link LeaseControl.close} DRAINS: it stops
- * accepting new leases and resolves once the jobs already handed to the
- * processor have settled — the graceful-shutdown primitive a deploy needs so a
- * rolling restart does not strand in-flight work (the lease timeout is the
- * backstop for a handler that ignores the drain, never the mechanism).
- */
-export interface LeaseControl {
-    close(): Promise<void>;
-}
-/**
- * The deployment's queue. A BullMQ adapter is `add` → `queue.add`, `remove` →
- * `job.remove`, `subscribe` → a `QueueEvents` `completed` listener, and
- * `lease` → a `new Worker(name, processor, { concurrency })`. Nothing else
- * about BullMQ leaks into the framework — see `bullmqQueueAdapter.ts` for the
- * reference wiring of exactly those four calls.
- */
-export interface SaasQueueBackend {
-    /** Enqueue and return the queue's own id — that id is the `JobId` everywhere. */
-    add(payload: SaasQueuePayload, options?: {
-        delayMs?: number;
-    }): Promise<JobId>;
-    /**
-     * Best-effort cancellation. A job already leased by a worker cannot be pulled
-     * back; the worker observes the recorded `cancelled` result through its own
-     * handler context, so cancellation is cooperative — same as local.
-     */
-    remove(id: JobId): Promise<void>;
-    /**
-     * Optional push notification that SOME job finished (the id is not needed —
-     * waiters re-read the store). Without it, waiting degrades to pure polling,
-     * which is correct but slower.
-     */
-    subscribe?(onCompletion: () => void): () => void;
-    /**
-     * CONSUMER side — a long-running worker begins leasing payloads and dispatches
-     * each to `process`. The backend owns at-least-once delivery and the
-     * lease/visibility timeout; the framework owns everything that makes
-     * completion correct on top of it ({@link runSaasJobWorker}). Producer-only
-     * deployments (API nodes that enqueue but never execute) never call this, so
-     * it is optional on the seam — an API node's backend can omit it entirely.
-     */
-    lease?(process: LeaseProcessor, options: LeaseOptions): LeaseControl;
-}
-export interface SaasJobBrokerOptions {
-    queue: SaasQueueBackend;
-    /** Shared across every API node and worker — Postgres table, Redis hash, … */
-    results: JobResultStore;
-    logger?: JobLogger;
-    /** Read-through interval when no push notification arrives. Default 500ms. */
-    pollMs?: number;
-    /** `onComplete` giving-up horizon. Default 24h. */
-    completionTimeoutMs?: number;
-}
-export interface SaasJobBroker extends JobBroker {
-    /**
-     * Called by a WORKER when its handler terminates. Workers are stateless and
-     * own no callback registry; recording the outcome IS the notification, and it
-     * is what every waiting process reads.
-     */
-    recordCompletion(result: RecordedJobResult): Promise<void>;
-    /** Detach the completion subscription. */
-    close(): void;
-}
-export declare const createSaasJobBroker: (options: SaasJobBrokerOptions) => SaasJobBroker;
-//# sourceMappingURL=saasJobBroker.d.ts.map

package/dist/server/drivers/saasJobBroker.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"saasJobBroker.d.ts","sourceRoot":"","sources":["../../../src/server/drivers/saasJobBroker.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,KAAK,EAAE,SAAS,EAAE,KAAK,EAAsB,MAAM,aAAa,CAAC;AACxE,OAAO,EAGL,KAAK,cAAc,EACnB,KAAK,iBAAiB,EAEvB,MAAM,cAAc,CAAC;AAEtB,wDAAwD;AACxD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED;;;;GAIG;AACH,MAAM,WAAW,SAAU,SAAQ,gBAAgB;IACjD,EAAE,EAAE,KAAK,CAAC;CACX;AAED;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAE/D,MAAM,WAAW,YAAY;IAC3B,8EAA8E;IAC9E,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,iFAAiF;IACjF,GAAG,CAAC,OAAO,EAAE,gBAAgB,EAAE,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC/E;;;;OAIG;IACH,MAAM,CAAC,EAAE,EAAE,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC;;;;OAIG;IACH,SAAS,CAAC,CAAC,YAAY,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC;IACjD;;;;;;;OAOG;IACH,KAAK,CAAC,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,YAAY,GAAG,YAAY,CAAC;CACtE;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,gBAAgB,CAAC;IACxB,8EAA8E;IAC9E,OAAO,EAAE,cAAc,CAAC;IACxB,MAAM,CAAC,EAAE,SAAS,CAAC;IACnB,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mDAAmD;IACnD,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,aAAc,SAAQ,SAAS;IAC9C;;;;OAIG;IACH,gBAAgB,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,0CAA0C;IAC1C,KAAK,IAAI,IAAI,CAAC;CACf;AAED,eAAO,MAAM,mBAAmB,GAAI,SAAS,oBAAoB,KAAG,aA0FnE,CAAC"}

package/dist/server/drivers/saasJobBroker.js

@@ -1,101 +0,0 @@
-/**
- * SaaS profile `JobBroker` (03 §7.3) — stateless workers, at-least-once leases,
- * durable cross-process completion.
- *
- * cursedbelt does not depend on Redis, BullMQ or any hosted queue: shipping one
- * would put a native/service dependency into a library every generated app
- * links, and the choice is genuinely the deployment's. So the queue is an injected
- * seam ({@link SaasQueueBackend}) — twenty lines of adapter around whatever the
- * deployment runs — while everything that makes completion CORRECT across
- * processes lives here and is shared with the local profile:
- *
- *   * outcomes are recorded in a shared {@link JobResultStore}, never a heap;
- *   * waiting is read-through with an optional push wake, so a waiter on API
- *     node A sees a completion produced by worker B;
- *   * `onComplete` is sugar over that wait, with identical semantics to local.
- *
- * That is the difference between "the interface has a SaaS variant" and "the
- * SaaS variant honors the interface". The previous shape (`onComplete` over an
- * in-memory callback map) could not be honored at all off-process — a caller
- * that worked locally silently stopped receiving completions in production.
- */
-import { AppError } from '../errors';
-import { defaultJobLogger } from '../jobs/logger';
-import { awaitRecordedCompletion, UNSCOPED_TENANT, } from './jobResults';
-export const createSaasJobBroker = (options) => {
-    const logger = options.logger ?? defaultJobLogger;
-    const pollMs = options.pollMs ?? 500;
-    const completionTimeoutMs = options.completionTimeoutMs ?? 86_400_000;
-    const waiters = new Set();
-    const wakeAll = () => {
-        for (const wake of [...waiters]) {
-            try {
-                wake();
-            }
-            catch (error) {
-                logger.error('SaaS JobBroker completion waiter threw', error);
-            }
-        }
-    };
-    const detach = options.queue.subscribe?.(wakeAll) ?? null;
-    const subscribeWaiter = (cb) => {
-        waiters.add(cb);
-        return () => {
-            waiters.delete(cb);
-        };
-    };
-    const readResult = async (id) => {
-        const recorded = await options.results.read(id);
-        if (!recorded)
-            return null;
-        return { jobId: recorded.jobId, ok: recorded.ok, output: recorded.output, error: recorded.error };
-    };
-    return {
-        async enqueue(job) {
-            if (typeof job.kind !== 'string' || job.kind.length === 0)
-                throw new AppError('A JobSpec needs a non-empty `kind` — it is the worker selector.', {
-                    code: 'JOB_KIND_UNREGISTERED',
-                    status: 500,
-                    context: { tenantId: job.tenantId },
-                });
-            return await options.queue.add({ kind: job.kind, tenantId: job.tenantId, instanceId: job.instanceId, payload: job.payload }, job.delayMs === undefined ? undefined : { delayMs: job.delayMs });
-        },
-        onComplete(id, cb) {
-            // One path — see the note on the local broker's `onComplete`.
-            // `awaitRecordedCompletion` reads before it arms anything.
-            void awaitRecordedCompletion(options.results, id, {
-                timeoutMs: completionTimeoutMs,
-                pollMs,
-                subscribe: subscribeWaiter,
-            }).then((result) => cb({ jobId: result.jobId, ok: result.ok, output: result.output, error: result.error }), (error) => logger.error(`SaaS JobBroker completion wait for ${id} failed`, error));
-        },
-        async awaitCompletion(id, waitOptions = {}) {
-            const result = await awaitRecordedCompletion(options.results, id, {
-                pollMs,
-                ...waitOptions,
-                subscribe: subscribeWaiter,
-            });
-            return { jobId: result.jobId, ok: result.ok, output: result.output, error: result.error };
-        },
-        async cancel(id) {
-            await options.queue.remove(id);
-            // Record first, then wake: a waiter must never observe the wake without
-            // the row it is being woken for. The `await` is what keeps that ordering
-            // real against a shared store that answers over a network.
-            await options.results.record({ jobId: id, ok: false, error: 'cancelled', tenantId: UNSCOPED_TENANT });
-            wakeAll();
-        },
-        async status(id) {
-            return (await readResult(id)) ?? { jobId: id, ok: null };
-        },
-        async recordCompletion(result) {
-            await options.results.record(result);
-            wakeAll();
-        },
-        close() {
-            detach?.();
-            waiters.clear();
-        },
-    };
-};
-//# sourceMappingURL=saasJobBroker.js.map

package/dist/server/drivers/saasJobBroker.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"saasJobBroker.js","sourceRoot":"","sources":["../../../src/server/drivers/saasJobBroker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAGlD,OAAO,EAEL,uBAAuB,EAGvB,eAAe,GAChB,MAAM,cAAc,CAAC;AAmGtB,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,OAA6B,EAAiB,EAAE;IAClF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,gBAAgB,CAAC;IAClD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC;IACrC,MAAM,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,IAAI,UAAU,CAAC;IAEtE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAc,CAAC;IACtC,MAAM,OAAO,GAAG,GAAS,EAAE;QACzB,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,OAAO,CAAC,EAAE,CAAC;YAChC,IAAI,CAAC;gBACH,IAAI,EAAE,CAAC;YACT,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,CAAC,wCAAwC,EAAE,KAAK,CAAC,CAAC;YAChE,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC;IAE1D,MAAM,eAAe,GAAG,CAAC,EAAc,EAAgB,EAAE;QACvD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,GAAG,EAAE;YACV,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrB,CAAC,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,UAAU,GAAG,KAAK,EAAE,EAAS,EAA6B,EAAE;QAChE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;IACpG,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,GAAY;YACxB,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;gBACvD,MAAM,IAAI,QAAQ,CAAC,iEAAiE,EAAE;oBACpF,IAAI,EAAE,uBAAuB;oBAC7B,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE;iBACpC,CAAC,CAAC;YACL,OAAO,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,CAC5B,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,EAC5F,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CACjE,CAAC;QACJ,CAAC;QAED,UAAU,CAAC,EAAS,EAAE,EAA+B;YACnD,8DAA8D;YAC9D,2DAA2D;YAC3D,KAAK,uBAAuB,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,EAAE;gBAChD,SAAS,EAAE,mBAAmB;gBAC9B,MAAM;gBACN,SAAS,EAAE,eAAe;aAC3B,CAAC,CAAC,IAAI,CACL,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,EAClG,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,sCAAsC,EAAE,SAAS,EAAE,KAAK,CAAC,CAClF,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,eAAe,CAAC,EAAS,EAAE,cAAsC,EAAE;YACvE,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,EAAE;gBAChE,MAAM;gBACN,GAAG,WAAW;gBACd,SAAS,EAAE,eAAe;aAC3B,CAAC,CAAC;YACH,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QAC5F,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,EAAS;YACpB,MAAM,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC/B,wEAAwE;YACxE,yEAAyE;YACzE,2DAA2D;YAC3D,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC;YACtG,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,EAAS;YACpB,OAAO,CAAC,MAAM,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QAC3D,CAAC;QAED,KAAK,CAAC,gBAAgB,CAAC,MAAyB;YAC9C,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACrC,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,KAAK;YACH,MAAM,EAAE,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,CAAC;KACF,CAAC;AACJ,CAAC,CAAC"}