pixivflow 2.19.3 → 2.19.4

package/dist/commands/scheduler-runtime.js

@@ -59,6 +59,7 @@ const schedules_1 = require("../scheduler/schedules");
 const SlotCoordinator_1 = require("../scheduler/SlotCoordinator");
 const DeliveryLedgerPort_1 = require("../delivery/DeliveryLedgerPort");
 const OutboxWorker_1 = require("../delivery/OutboxWorker");
+const settleDeliveryTerminal_1 = require("../delivery/settleDeliveryTerminal");
 const LegacyOutboxMigration_1 = require("../delivery/LegacyOutboxMigration");
 const NotificationPolicy_1 = require("../notification/NotificationPolicy");
 const node_crypto_1 = require("node:crypto");
@@ -241,22 +242,10 @@ async function createSchedulerRuntime(configPathArg) {
     const outboxWorker = new OutboxWorker_1.OutboxWorker(database, deliveryDispatcher, {
         retryBaseMs: config.delivery?.outboxRetryBaseMs,
         retryMaxMs: config.delivery?.outboxRetryMaxMs,
-        // A confirmed ACK promotes the delivery_pending cell to submitted.
+        // A confirmed ACK settles the owning Slot cell (submitted / duplicate /
+        // failed); see settleDeliveryTerminal for the invariant it enforces.
         onDeliveryTerminal: (deliveryId, ack) => {
-            const row = database.deliveries.getById(deliveryId);
-            if (!row || !row.slotId || !row.targetId)
-                return;
-            if (ack.kind === 'duplicate_existing') {
-                const coord = new SlotCoordinator_1.SlotCoordinator(database);
-                coord.applyOutcome(row.slotId, row.targetId, {
-                    kind: 'duplicate',
-                    workId: row.pixivId,
-                    reason: 'downstream attested historical duplicate',
-                });
-                return;
-            }
-            const coord = new SlotCoordinator_1.SlotCoordinator(database);
-            coord.markDelivered(row.slotId, row.targetId, row.pixivId, row.workType);
+            (0, settleDeliveryTerminal_1.settleDeliveryTerminal)(database, deliveryId, ack);
         },
     });
     const notificationPolicy = new NotificationPolicy_1.NotificationPolicy(database, config);

package/dist/delivery/DeliveryAck.d.ts

@@ -35,6 +35,20 @@ export type DeliveryAck = {
     matchedKey?: string;
     raw?: unknown;
 }
+/**
+ * The provider accepted the request and persisted a record, but that record
+ * is in a TERMINAL FAILURE state (`failed`/`rejected`/`invalid`/`expired`).
+ * Nothing will ever be published from this intent, and because the provider
+ * keys its record by OUR idempotency_key, another attempt only returns the
+ * same failed record. Terminal: never retried, never reported as delivered.
+ */
+ | {
+    kind: 'remote_failed';
+    remoteId?: string;
+    remoteStatus: string;
+    error: string;
+    raw?: unknown;
+}
 /** Transient failure: timeouts, 5xx, 429, connection errors. Retryable. */
  | {
     kind: 'retryable_failure';

package/dist/delivery/DeliveryAck.js

@@ -1,6 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.parseDeliveryAck = parseDeliveryAck;
+/** Downstream record states that will never become a published delivery. */
+const TERMINAL_REMOTE_STATUSES = new Set(['failed', 'rejected', 'invalid', 'expired']);
 const DEFAULT_HINTS = {
     dataPath: 'data',
     idField: 'review_id',
@@ -49,6 +51,22 @@ function parseDeliveryAck(status, body, hints = {}) {
     const remoteId = typeof idValue === 'number' ? String(idValue) : asString(idValue);
     const remoteStatus = asString(rec[h.statusField]);
     const reused = rec[h.reusedField] === true;
+    // A 2xx envelope can still describe a RECORD THAT FAILED downstream: the
+    // provider persists the record before doing the real work, so "accepted" and
+    // "the persisted record is broken" arrive on the same HTTP status. The record
+    // is what gets published (and what a retry will find again), so its terminal
+    // state outranks the transport-level success of this request — otherwise a
+    // remote failure is recorded here as an end-to-end success.
+    const terminalStatus = remoteStatus?.trim().toLowerCase();
+    if (terminalStatus && TERMINAL_REMOTE_STATUSES.has(terminalStatus)) {
+        return {
+            kind: 'remote_failed',
+            remoteId,
+            remoteStatus: terminalStatus,
+            error: `delivery endpoint reported terminal status ${terminalStatus}`,
+            raw: body,
+        };
+    }
     if (!reused) {
         return { kind: 'accepted', remoteId, remoteStatus, raw: body };
     }

package/dist/delivery/OutboxWorker.js

@@ -312,6 +312,19 @@ class OutboxWorker {
                 });
                 this.onDeliveryTerminal?.(row.deliveryId, ack, payload);
                 break;
+            case 'remote_failed':
+                // The provider persisted the record, but it will never publish and the
+                // idempotency key pins us to that same record forever: retrying cannot
+                // change the outcome. Terminal, so the failure reaches the Slot instead
+                // of being masked as a delivered cell. Content is kept for inspection.
+                this.database.deliveries.recordAck(row.deliveryId, {
+                    status: 'failed',
+                    remoteId: ack.remoteId,
+                    remoteStatus: ack.remoteStatus,
+                    error: ack.error,
+                });
+                this.onDeliveryTerminal?.(row.deliveryId, ack, payload);
+                break;
             case 'permanent_failure':
                 // Deterministic rejection: still retry a couple times to survive a
                 // misconfigured blip, the outbox max-attempts then dead-letters it.

package/dist/delivery/settleDeliveryTerminal.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Terminal-ACK settlement: the ONE place a confirmed downstream delivery ACK
+ * becomes a Slot cell state.
+ *
+ * The outbox worker already recorded the durable delivery ledger outcome before
+ * calling here; this maps that ack onto the Slot FSM. Keeping it as a named,
+ * dependency-light function (instead of an inline closure in the scheduler
+ * runtime) is what makes the central invariant directly testable:
+ *
+ *   REMOTE FAILURE MUST NOT BE REPORTED AS END-TO-END SUCCESS.
+ *
+ * A provider can answer HTTP 2xx while the record it persisted is terminally
+ * broken. The provider keys that record by OUR idempotency key, so a retry only
+ * returns the same broken record. Such an ack must settle the cell as `failed`,
+ * never promote it to `submitted` as though the content had been published.
+ */
+import type { Database } from '../storage/Database';
+import type { DeliveryAck } from './DeliveryAck';
+/**
+ * Apply a terminal delivery ack to the Slot cell that owns the delivery intent.
+ * Returns false when the delivery has no Slot cell (ad-hoc / batch runs), which
+ * is a normal no-op rather than an error.
+ */
+export declare function settleDeliveryTerminal(database: Database, deliveryId: string, ack: DeliveryAck): boolean;
+//# sourceMappingURL=settleDeliveryTerminal.d.ts.map

package/dist/delivery/settleDeliveryTerminal.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.settleDeliveryTerminal = settleDeliveryTerminal;
+const SlotCoordinator_1 = require("../scheduler/SlotCoordinator");
+/**
+ * Apply a terminal delivery ack to the Slot cell that owns the delivery intent.
+ * Returns false when the delivery has no Slot cell (ad-hoc / batch runs), which
+ * is a normal no-op rather than an error.
+ */
+function settleDeliveryTerminal(database, deliveryId, ack) {
+    const row = database.deliveries.getById(deliveryId);
+    if (!row || !row.slotId || !row.targetId)
+        return false;
+    const coord = new SlotCoordinator_1.SlotCoordinator(database);
+    if (ack.kind === 'duplicate_existing') {
+        // Historical duplicate: a record from a DIFFERENT intent already exists, so
+        // THIS intent published nothing. Never a successful submission.
+        coord.applyOutcome(row.slotId, row.targetId, {
+            kind: 'duplicate',
+            workId: row.pixivId,
+            reason: 'downstream attested historical duplicate',
+        });
+        return true;
+    }
+    if (ack.kind === 'remote_failed') {
+        // The downstream record is terminally broken, so nothing was published:
+        // settle the cell as failed instead of promoting it to submitted. Not
+        // retryable — the same idempotency key can only return that record.
+        coord.applyOutcome(row.slotId, row.targetId, {
+            kind: 'failed',
+            retryable: false,
+            error: `downstream reported terminal status ${ack.remoteStatus} (review ${ack.remoteId ?? 'unknown'})`,
+        });
+        return true;
+    }
+    // accepted / idempotent_replay: a confirmed ACK is the sole path to submitted.
+    coord.markDelivered(row.slotId, row.targetId, row.pixivId, row.workType);
+    return true;
+}
+//# sourceMappingURL=settleDeliveryTerminal.js.map

package/dist/package.json

@@ -1,6 +1,6 @@
 {
   "type": "commonjs",
   "name": "pixivflow",
-  "version": "2.19.3",
+  "version": "2.19.4",
   "private": true
 }

package/dist/version.js

@@ -2,5 +2,5 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.BUILD = void 0;
 // GENERATED by scripts/write-version.js — do not edit manually.
-exports.BUILD = { version: '2.19.3', commit: '699f027bb45a' };
+exports.BUILD = { version: '2.19.4', commit: 'f331cd4bb164' };
 //# sourceMappingURL=version.js.map

package/dist/webui/package.json

@@ -1,6 +1,6 @@
 {
   "type": "commonjs",
   "name": "pixivflow-webui-backend",
-  "version": "2.19.3",
+  "version": "2.19.4",
   "description": "PixivFlow WebUI Backend - CommonJS module"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pixivflow",
-  "version": "2.19.3",
+  "version": "2.19.4",
   "description": "🎨 智能的 Pixiv 自动化下载工具 - 支持批量下载插画和小说、定时任务、Docker部署 | Intelligent Pixiv Automation Downloader with batch download, scheduler, and Docker support",
   "repository": {
     "type": "git",