nucleus-core-ts 0.9.781 → 0.9.783

package/dist/src/Client/ApiCaller/system-tables.d.ts

@@ -4283,5 +4283,510 @@ export declare const SYSTEM_TABLES: readonly [{
     }, {
         readonly columns: readonly ["scope"];
     }];
+}, {
+    readonly table_name: "integration_sources";
+    readonly feature_set: readonly ["integrations"];
+    readonly add_base_columns: true;
+    readonly is_form_data: false;
+    readonly available_app_ids: readonly ["default_be"];
+    readonly available_schemas: readonly ["*"];
+    readonly excluded_schemas: readonly [];
+    readonly excluded_methods: readonly [];
+    readonly bulk_endpoints_enabled: false;
+    readonly group_name: "Integrations";
+    readonly columns: readonly [{
+        readonly name: "name";
+        readonly type: "varchar";
+        readonly length: 150;
+        readonly notNull: true;
+    }, {
+        readonly name: "slug";
+        readonly type: "varchar";
+        readonly length: 150;
+        readonly notNull: true;
+        readonly comment: "Stable machine name; referenced by exports and by operators in logs";
+    }, {
+        readonly name: "base_url";
+        readonly type: "varchar";
+        readonly length: 500;
+        readonly notNull: true;
+        readonly comment: "Any scheme, host and port — https, plain http, in-cluster DNS, IP. HTTPS is NOT required and must never be enforced: reaching a service inside the same cluster over http is a legitimate deployment.";
+    }, {
+        readonly name: "description";
+        readonly type: "text";
+    }, {
+        readonly name: "enabled";
+        readonly type: "boolean";
+        readonly default: true;
+    }, {
+        readonly name: "auth_type";
+        readonly type: "varchar";
+        readonly length: 20;
+        readonly notNull: true;
+        readonly default: "none";
+        readonly enumValues: readonly ["none", "bearer", "api_key", "basic", "oauth2"];
+    }, {
+        readonly name: "auth_token_encrypted";
+        readonly type: "text";
+        readonly sensitive: true;
+        readonly comment: "Static credential (bearer / api key / basic blob), encrypted at rest";
+    }, {
+        readonly name: "auth_token_hint";
+        readonly type: "varchar";
+        readonly length: 24;
+    }, {
+        readonly name: "auth_header_name";
+        readonly type: "varchar";
+        readonly length: 80;
+        readonly default: "Authorization";
+    }, {
+        readonly name: "auth_query_param";
+        readonly type: "varchar";
+        readonly length: 80;
+        readonly comment: "When set, an api_key credential travels as this query parameter instead of a header";
+    }, {
+        readonly name: "extra_headers";
+        readonly type: "jsonb";
+        readonly default: {};
+    }, {
+        readonly name: "token_url";
+        readonly type: "varchar";
+        readonly length: 500;
+    }, {
+        readonly name: "oauth_grant_type";
+        readonly type: "varchar";
+        readonly length: 40;
+        readonly default: "password";
+        readonly enumValues: readonly ["password", "client_credentials"];
+    }, {
+        readonly name: "oauth_client_id";
+        readonly type: "varchar";
+        readonly length: 200;
+    }, {
+        readonly name: "oauth_client_secret_encrypted";
+        readonly type: "text";
+        readonly sensitive: true;
+    }, {
+        readonly name: "oauth_client_secret_hint";
+        readonly type: "varchar";
+        readonly length: 24;
+    }, {
+        readonly name: "oauth_username";
+        readonly type: "varchar";
+        readonly length: 200;
+    }, {
+        readonly name: "oauth_password_encrypted";
+        readonly type: "text";
+        readonly sensitive: true;
+    }, {
+        readonly name: "oauth_password_hint";
+        readonly type: "varchar";
+        readonly length: 24;
+    }, {
+        readonly name: "oauth_scope";
+        readonly type: "varchar";
+        readonly length: 300;
+    }, {
+        readonly name: "oauth_client_auth";
+        readonly type: "varchar";
+        readonly length: 20;
+        readonly default: "basic";
+        readonly enumValues: readonly ["basic", "body"];
+    }, {
+        readonly name: "tls_verify";
+        readonly type: "boolean";
+        readonly notNull: true;
+        readonly default: true;
+        readonly comment: "Per-source certificate verification. Turning it off applies to THIS source's connections only — never to the process, which is what a NODE_TLS_REJECT_UNAUTHORIZED toggle would do.";
+    }, {
+        readonly name: "timeout_ms";
+        readonly type: "integer";
+        readonly notNull: true;
+        readonly default: 30000;
+    }, {
+        readonly name: "spec_url";
+        readonly type: "varchar";
+        readonly length: 500;
+        readonly comment: "Optional API description document (OpenAPI/Swagger/Postman/Bruno). Discovery is a convenience: every endpoint can always be defined by hand instead.";
+    }, {
+        readonly name: "spec_format";
+        readonly type: "varchar";
+        readonly length: 20;
+        readonly default: "manual";
+        readonly enumValues: readonly ["manual", "openapi", "swagger", "postman", "bruno", "har"];
+    }];
+    readonly constraints: {
+        readonly unique: readonly [{
+            readonly name: "uniq_integration_source_slug";
+            readonly columns: readonly ["slug"];
+        }];
+    };
+    readonly indexes: readonly [{
+        readonly columns: readonly ["enabled"];
+    }];
+}, {
+    readonly table_name: "integration_endpoints";
+    readonly feature_set: readonly ["integrations"];
+    readonly add_base_columns: true;
+    readonly is_form_data: false;
+    readonly available_app_ids: readonly ["default_be"];
+    readonly available_schemas: readonly ["*"];
+    readonly excluded_schemas: readonly [];
+    readonly excluded_methods: readonly [];
+    readonly bulk_endpoints_enabled: false;
+    readonly group_name: "Integrations";
+    readonly columns: readonly [{
+        readonly name: "source_id";
+        readonly type: "uuid";
+        readonly notNull: true;
+        readonly references: {
+            readonly table: "integrationSources";
+            readonly column: "id";
+            readonly onDelete: "cascade";
+        };
+    }, {
+        readonly name: "tag";
+        readonly type: "varchar";
+        readonly length: 120;
+        readonly notNull: true;
+    }, {
+        readonly name: "name";
+        readonly type: "varchar";
+        readonly length: 200;
+    }, {
+        readonly name: "method";
+        readonly type: "varchar";
+        readonly length: 10;
+        readonly notNull: true;
+        readonly default: "GET";
+        readonly enumValues: readonly ["GET", "POST", "PUT", "PATCH", "DELETE"];
+    }, {
+        readonly name: "path";
+        readonly type: "varchar";
+        readonly length: 500;
+        readonly notNull: true;
+        readonly comment: "Appended to the source base URL. May carry {brace} or :colon path tokens, whose values come from param_bindings.";
+    }, {
+        readonly name: "description";
+        readonly type: "text";
+    }, {
+        readonly name: "query_params";
+        readonly type: "jsonb";
+        readonly default: {};
+    }, {
+        readonly name: "request_body";
+        readonly type: "jsonb";
+        readonly default: {};
+    }, {
+        readonly name: "param_bindings";
+        readonly type: "jsonb";
+        readonly default: readonly [];
+        readonly comment: "Where each path/query parameter comes from: a static value, another endpoint's records (fan-out), or a column of one of our own tables.";
+    }, {
+        readonly name: "pagination";
+        readonly type: "jsonb";
+        readonly default: {};
+        readonly comment: "Explicitly chosen paging profile (none/page_number/offset/cursor/link_header). Never guessed — a wrong guess silently imports one page.";
+    }, {
+        readonly name: "response_root_path";
+        readonly type: "varchar";
+        readonly length: 200;
+    }, {
+        readonly name: "sample_response";
+        readonly type: "jsonb";
+        readonly default: {};
+        readonly comment: "A few real records captured by a live test, so the mapping screen still shows fields when the source is unreachable";
+    }, {
+        readonly name: "enabled";
+        readonly type: "boolean";
+        readonly default: true;
+    }];
+    readonly indexes: readonly [{
+        readonly columns: readonly ["source_id"];
+    }, {
+        readonly columns: readonly ["source_id", "tag"];
+    }];
+}, {
+    readonly table_name: "integration_mappings";
+    readonly feature_set: readonly ["integrations"];
+    readonly add_base_columns: true;
+    readonly is_form_data: false;
+    readonly available_app_ids: readonly ["default_be"];
+    readonly available_schemas: readonly ["*"];
+    readonly excluded_schemas: readonly [];
+    readonly excluded_methods: readonly [];
+    readonly bulk_endpoints_enabled: false;
+    readonly group_name: "Integrations";
+    readonly columns: readonly [{
+        readonly name: "endpoint_id";
+        readonly type: "uuid";
+        readonly notNull: true;
+        readonly references: {
+            readonly table: "integrationEndpoints";
+            readonly column: "id";
+            readonly onDelete: "cascade";
+        };
+    }, {
+        readonly name: "name";
+        readonly type: "varchar";
+        readonly length: 200;
+        readonly notNull: true;
+    }, {
+        readonly name: "target_entity";
+        readonly type: "varchar";
+        readonly length: 120;
+        readonly notNull: true;
+        readonly comment: "snake_case table name this mapping writes into";
+    }, {
+        readonly name: "field_mappings";
+        readonly type: "jsonb";
+        readonly notNull: true;
+        readonly default: readonly [];
+    }, {
+        readonly name: "dedup_source_field";
+        readonly type: "varchar";
+        readonly length: 200;
+    }, {
+        readonly name: "dedup_target_field";
+        readonly type: "varchar";
+        readonly length: 200;
+        readonly comment: "Target column that identifies the same record across runs. Without it nothing can be matched and every run appends.";
+    }, {
+        readonly name: "write_mode";
+        readonly type: "varchar";
+        readonly length: 20;
+        readonly notNull: true;
+        readonly default: "upsert";
+        readonly enumValues: readonly ["upsert", "append", "replace"];
+        readonly comment: "replace is the destructive wipe-and-rewrite; it is no longer the default and is gated by the completeness check.";
+    }, {
+        readonly name: "missing_record_policy";
+        readonly type: "varchar";
+        readonly length: 20;
+        readonly notNull: true;
+        readonly default: "ignore";
+        readonly enumValues: readonly ["ignore", "deactivate", "delete"];
+        readonly comment: "What happens to a row that exists here but no longer in the source. deactivate is the right answer for most HR data and could not be expressed before.";
+    }, {
+        readonly name: "missing_record_column";
+        readonly type: "varchar";
+        readonly length: 120;
+    }, {
+        readonly name: "missing_record_value";
+        readonly type: "varchar";
+        readonly length: 200;
+    }, {
+        readonly name: "schedule_cron";
+        readonly type: "varchar";
+        readonly length: 120;
+    }, {
+        readonly name: "schedule_timezone";
+        readonly type: "varchar";
+        readonly length: 64;
+        readonly comment: "IANA zone the cron expression is read in. Without it a nightly job drifts with the container's clock.";
+    }, {
+        readonly name: "schedule_enabled";
+        readonly type: "boolean";
+        readonly notNull: true;
+        readonly default: false;
+    }, {
+        readonly name: "last_run_at";
+        readonly type: "timestamptz";
+    }, {
+        readonly name: "enabled";
+        readonly type: "boolean";
+        readonly default: true;
+    }];
+    readonly indexes: readonly [{
+        readonly columns: readonly ["endpoint_id"];
+    }, {
+        readonly columns: readonly ["target_entity"];
+    }, {
+        readonly columns: readonly ["schedule_enabled"];
+    }];
+}, {
+    readonly table_name: "integration_runs";
+    readonly feature_set: readonly ["integrations"];
+    readonly add_base_columns: true;
+    readonly is_form_data: false;
+    readonly available_app_ids: readonly ["default_be"];
+    readonly available_schemas: readonly ["*"];
+    readonly excluded_schemas: readonly [];
+    readonly excluded_methods: readonly ["POST", "PUT", "PATCH", "DELETE"];
+    readonly bulk_endpoints_enabled: false;
+    readonly group_name: "Integrations";
+    readonly columns: readonly [{
+        readonly name: "mapping_id";
+        readonly type: "uuid";
+        readonly references: {
+            readonly table: "integrationMappings";
+            readonly column: "id";
+            readonly onDelete: "set null";
+        };
+        readonly comment: "Nullable and NOT cascaded: deleting a mapping must not erase the record that it once rewrote a table.";
+    }, {
+        readonly name: "target_entity";
+        readonly type: "varchar";
+        readonly length: 120;
+    }, {
+        readonly name: "write_mode";
+        readonly type: "varchar";
+        readonly length: 20;
+        readonly enumValues: readonly ["upsert", "append", "replace"];
+    }, {
+        readonly name: "status";
+        readonly type: "varchar";
+        readonly length: 20;
+        readonly notNull: true;
+        readonly default: "queued";
+        readonly enumValues: readonly ["queued", "running", "succeeded", "failed", "cancelled", "reverted"];
+        readonly comment: "There is deliberately no 'partial': a run either applied in full or not at all.";
+    }, {
+        readonly name: "trigger";
+        readonly type: "varchar";
+        readonly length: 20;
+        readonly notNull: true;
+        readonly default: "manual";
+        readonly enumValues: readonly ["manual", "schedule", "api"];
+    }, {
+        readonly name: "total_fetched";
+        readonly type: "integer";
+        readonly notNull: true;
+        readonly default: 0;
+    }, {
+        readonly name: "source_reported_total";
+        readonly type: "integer";
+        readonly comment: "What the source said it had. When this and total_fetched disagree, a destructive run refuses to start.";
+    }, {
+        readonly name: "created_count";
+        readonly type: "integer";
+        readonly notNull: true;
+        readonly default: 0;
+    }, {
+        readonly name: "updated_count";
+        readonly type: "integer";
+        readonly notNull: true;
+        readonly default: 0;
+    }, {
+        readonly name: "skipped_count";
+        readonly type: "integer";
+        readonly notNull: true;
+        readonly default: 0;
+    }, {
+        readonly name: "deleted_count";
+        readonly type: "integer";
+        readonly notNull: true;
+        readonly default: 0;
+    }, {
+        readonly name: "deactivated_count";
+        readonly type: "integer";
+        readonly notNull: true;
+        readonly default: 0;
+    }, {
+        readonly name: "error_count";
+        readonly type: "integer";
+        readonly notNull: true;
+        readonly default: 0;
+    }, {
+        readonly name: "external_call_count";
+        readonly type: "integer";
+        readonly notNull: true;
+        readonly default: 0;
+    }, {
+        readonly name: "issues";
+        readonly type: "jsonb";
+        readonly default: readonly [];
+    }, {
+        readonly name: "errors";
+        readonly type: "jsonb";
+        readonly default: readonly [];
+    }, {
+        readonly name: "cancel_requested";
+        readonly type: "boolean";
+        readonly notNull: true;
+        readonly default: false;
+        readonly comment: "Set by the cancel endpoint; the engine checks it at every batch boundary. A dropped HTTP connection is NOT a cancellation.";
+    }, {
+        readonly name: "started_at";
+        readonly type: "timestamptz";
+    }, {
+        readonly name: "finished_at";
+        readonly type: "timestamptz";
+    }, {
+        readonly name: "pre_images_expire_at";
+        readonly type: "timestamptz";
+        readonly comment: "After this, the run can no longer be reverted and the UI says so rather than offering a button that quietly does nothing.";
+    }, {
+        readonly name: "reverted_at";
+        readonly type: "timestamptz";
+    }, {
+        readonly name: "reverted_by";
+        readonly type: "uuid";
+        readonly references: {
+            readonly table: "users";
+            readonly column: "id";
+        };
+    }, {
+        readonly name: "reverted_run_id";
+        readonly type: "uuid";
+    }];
+    readonly indexes: readonly [{
+        readonly columns: readonly ["mapping_id"];
+    }, {
+        readonly columns: readonly ["status"];
+    }, {
+        readonly columns: readonly ["target_entity"];
+    }, {
+        readonly columns: readonly ["created_at"];
+    }];
+}, {
+    readonly table_name: "integration_run_items";
+    readonly feature_set: readonly ["integrations"];
+    readonly add_base_columns: true;
+    readonly is_form_data: false;
+    readonly available_app_ids: readonly ["default_be"];
+    readonly available_schemas: readonly ["*"];
+    readonly excluded_schemas: readonly [];
+    readonly excluded_methods: readonly ["POST", "PUT", "PATCH", "DELETE"];
+    readonly bulk_endpoints_enabled: false;
+    readonly group_name: "Integrations";
+    readonly columns: readonly [{
+        readonly name: "run_id";
+        readonly type: "uuid";
+        readonly notNull: true;
+        readonly references: {
+            readonly table: "integrationRuns";
+            readonly column: "id";
+            readonly onDelete: "cascade";
+        };
+    }, {
+        readonly name: "target_entity";
+        readonly type: "varchar";
+        readonly length: 120;
+        readonly notNull: true;
+    }, {
+        readonly name: "row_id";
+        readonly type: "uuid";
+    }, {
+        readonly name: "action";
+        readonly type: "varchar";
+        readonly length: 20;
+        readonly notNull: true;
+        readonly enumValues: readonly ["create", "update", "delete", "deactivate"];
+    }, {
+        readonly name: "before";
+        readonly type: "jsonb";
+        readonly comment: "The row as it stood before this run touched it. This is what makes a successful run reversible; the bulk delete path already produced these rows and threw them away.";
+    }, {
+        readonly name: "after";
+        readonly type: "jsonb";
+    }];
+    readonly indexes: readonly [{
+        readonly columns: readonly ["run_id"];
+    }, {
+        readonly columns: readonly ["run_id", "action"];
+    }, {
+        readonly columns: readonly ["target_entity", "row_id"];
+    }];
 }];
 export type SystemTables = typeof SYSTEM_TABLES;

package/dist/src/Client/Proxy/wsProxy.js

@@ -16,6 +16,30 @@ import { addQueryParam, createProxyLogger, httpToWs, matchPath, parseCookies, re
         return true;
     }
 }
+/**
+ * Keeps the proxy→backend socket alive with a PROTOCOL ping, not a data frame.
+ *
+ * This used to send `''`. An empty text frame is still application data, so it
+ * arrived at the backend's `message` handler, where `JSON.parse('')` throws —
+ * and nucleus' own PubSub route logged "Failed to parse client message" once per
+ * interval per connected client. On a busy IDP that is the entire debug log, and
+ * it names the proxy's own heartbeat as a misbehaving client.
+ *
+ * `ping()` is a control frame: it never reaches `message`, the peer answers with
+ * pong automatically, and it resets the idle timer the same way. Bun's WebSocket
+ * client implements it; the JSON heartbeat is the fallback for a runtime that
+ * does not, because `{"type":"ping"}` is a frame the PubSub route understands and
+ * replies to, rather than one it can only fail to parse.
+ */ function pingBackend(backendWs) {
+    const withPing = backendWs;
+    if (typeof withPing.ping === 'function') {
+        withPing.ping();
+        return;
+    }
+    backendWs.send(JSON.stringify({
+        type: 'ping'
+    }));
+}
 export function createWsProxyHandler(config) {
     const logger = createProxyLogger('WS Proxy', config.debug ?? false);
     const pingIntervalMs = config.pingIntervalMs ?? 0;
@@ -189,7 +213,7 @@ export function createWsProxyHandler(config) {
                         state.pingTimer = setInterval(()=>{
                             try {
                                 if (ws.readyState <= 1) ws.ping();
-                                if (backendWs.readyState === WebSocket.OPEN) backendWs.send('');
+                                if (backendWs.readyState === WebSocket.OPEN) pingBackend(backendWs);
                             } catch  {
                             /* connection already closing */ }
                         }, pingIntervalMs);

package/dist/src/ElysiaPlugin/routes/backup/types.d.ts

@@ -1,5 +1,5 @@
 import type { NodePgDatabase } from 'drizzle-orm/node-postgres';
-import type { BackupConfig } from 'src/Services/Backup';
+import type { BackupConfig, BackupServiceConfig } from 'src/Services/Backup';
 import type { Logger } from 'src/Services/Logger';
 import type { TenantRegistry } from 'src/Services/Tenant';
 export type BackupRouteConfig = {
@@ -9,4 +9,6 @@ export type BackupRouteConfig = {
     schemaTables: Record<string, unknown>;
     schemaName: string;
     tenantRegistry?: TenantRegistry | null;
+    /** Cross-replica scheduler lock — see BackupServiceConfig['lock']. */
+    lock?: BackupServiceConfig['lock'];
 };

package/dist/src/ElysiaPlugin/routes/integrations/index.d.ts

@@ -0,0 +1,49 @@
+/**
+ * The endpoints an operator's panel drives.
+ *
+ * Only the ACTIONS live here. Listing sources, endpoints, mappings and runs is
+ * the generic entity API's job — which already pages, filters, searches and
+ * sorts on the server — so this file adds nothing that would duplicate it worse.
+ *
+ * ## A run is a job, not a request
+ *
+ * `POST /runs` answers 202 with an identifier and gets on with it. A chained
+ * import legitimately takes minutes, and the alternative — holding the HTTP
+ * request open — means the browser, the ingress and the server each get their
+ * own opinion about when to give up, none of which stops the work. That is how
+ * the engine this replaces could show "failed" on screen while still deleting
+ * rows, with the retry button already enabled.
+ */
+import Elysia from 'elysia';
+import type { IntegrationsRouteConfig } from './types';
+export type { IntegrationsRouteConfig } from './types';
+export declare function createIntegrationRoutes(routeConfig: IntegrationsRouteConfig): Elysia<string, {
+    decorator: {};
+    store: {};
+    derive: {};
+    resolve: {};
+}, {
+    typebox: {};
+    error: {};
+}, {
+    schema: {};
+    standaloneSchema: {};
+    macro: {};
+    macroFn: {};
+    parser: {};
+    response: {};
+}, {}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}>;
+/** `30d`, `12h`, `45m` → milliseconds. Undefined for an unparseable value. */
+export declare function parseDuration(value: string | undefined): number | undefined;