pixivflow 2.20.5 → 2.22.0

package/dist/commands/SchedulerCommand.js

@@ -208,6 +208,65 @@ class SchedulerCommand extends Command_1.BaseCommand {
                             ? { requestId, slotId: slot.id, state: cell.status, slotStatus: slot.status }
                             : null;
                     },
+                    /**
+                     * Manual recovery of a FAILED target (§manual-recovery). Distinct
+                     * from refetch: there is no review chain to replace and no
+                     * replacement payload — the target is simply re-acquired under a
+                     * server-defined policy preset, and its outcome is reported through
+                     * the ordinary schedule-outcome channel so the automatic history is
+                     * never rewritten.
+                     */
+                    recover: async (targetId, requestId, retryMode, correlationId) => {
+                        const cfg = resolveConfig();
+                        const plans = (cfg.schedules ?? []).filter((plan) => plan.enabled !== false && (0, schedules_1.selectScheduleTargets)(cfg.targets, plan).some((target) => target.id === targetId));
+                        if (plans.length === 0)
+                            throw new Error('unknown target');
+                        if (plans.length !== 1)
+                            throw new Error('ambiguous target');
+                        const plan = plans[0];
+                        const target = (0, schedules_1.selectScheduleTargets)(cfg.targets, plan).find((item) => item.id === targetId);
+                        const deliveryName = target.delivery?.target;
+                        const delivery = deliveryName ? cfg.delivery?.targets?.[deliveryName] : undefined;
+                        if (delivery?.type !== 'httpMultipart' || !delivery.scheduleOutcomeUrl?.trim()) {
+                            throw new Error('schedule outcome endpoint not configured');
+                        }
+                        const now = new Date();
+                        const date = new Intl.DateTimeFormat('en-CA', {
+                            timeZone: plan.timezone ?? 'UTC', year: 'numeric', month: '2-digit', day: '2-digit',
+                        }).format(now);
+                        const slot = {
+                            slotId: `${plan.id}@recover-${requestId.toLowerCase()}`,
+                            scheduleId: plan.id,
+                            occurrenceAt: now.getTime(),
+                            occurrenceDate: date,
+                            occurrenceLabel: 'manual',
+                            timezone: plan.timezone ?? 'UTC',
+                            triggerSource: 'manual',
+                            slotName: retryMode === 'relaxed' ? '手动恢复（放宽条件重试）' : '手动恢复（再试一次）',
+                            slotDate: date,
+                            recoveryRequestId: requestId,
+                            recoveryMode: retryMode,
+                            correlationId: correlationId || undefined,
+                        };
+                        const existing = runtime.database.slots.getSlot(slot.slotId);
+                        if (existing && (existing.scheduleId !== plan.id || existing.targetIds.length !== 1 || existing.targetIds[0] !== targetId)) {
+                            throw new Error('ambiguous target');
+                        }
+                        const prepared = coordinator.prepare(slot, plan, [target]);
+                        if (prepared.alreadyCompleted)
+                            return { slotId: slot.slotId, disposition: 'already_completed' };
+                        // Same resource admission as every other Pixiv-consuming work
+                        // item: a busy account queues this run, it does not fail it.
+                        const started = manager.triggerSchedule(plan.id, { slot, onlyTarget: targetId, triggerSource: 'manual' });
+                        return { slotId: slot.slotId, disposition: started ? 'accepted' : 'queued' };
+                    },
+                    recoverStatus: (targetId, requestId) => {
+                        const slot = runtime.database.slots.findRecoverySlot(requestId, targetId);
+                        const cell = slot && runtime.database.slots.getCell(slot.id, targetId);
+                        return slot && cell
+                            ? { requestId, slotId: slot.id, state: cell.status, slotStatus: slot.status }
+                            : null;
+                    },
                     status: (scheduleId) => {
                         const cfg = resolveConfig();
                         const plan = findPlan(cfg, scheduleId);
@@ -258,6 +317,10 @@ class SchedulerCommand extends Command_1.BaseCommand {
                             // Second belt: never exit underneath an in-flight slot execution
                             // even if a durable row ever looks a beat early (§idle-inflight).
                             activeExecutions: runtime.activeExecutionCount(),
+                            // Third belt: work parked waiting for resource capacity is
+                            // unfinished work (§resource-governance) — a queued run must not
+                            // let the machine stop before it runs.
+                            waitingForResource: manager.waitingWorkCount(),
                         };
                     },
                     idleGraceMs: scheduling.idleGraceMs,

package/dist/commands/SchedulerIdleLifecycle.d.ts

@@ -50,6 +50,14 @@ export interface IdleSnapshot {
      * durable slot/outbox rows.
      */
     activeExecutions: number;
+    /**
+     * Work items parked in the resource admission queue (§resource-governance).
+     * Waiting for capacity is UNFINISHED work, not idleness: a queued run has a
+     * durable slot row (counted above) but may not have reached `claimRunLease`
+     * yet in internal mode, so this explicit belt prevents the worker from
+     * shutting down while a run is still waiting to start.
+     */
+    waitingForResource: number;
 }
 /** True only when the worker has no work of any kind left. */
 export declare function isIdle(snapshot: IdleSnapshot): boolean;

package/dist/commands/SchedulerIdleLifecycle.js

@@ -39,7 +39,8 @@ function isIdle(snapshot) {
     return (snapshot.activeSlots === 0 &&
         snapshot.processingOutbox === 0 &&
         snapshot.pendingOutbox === 0 &&
-        snapshot.activeExecutions === 0);
+        snapshot.activeExecutions === 0 &&
+        snapshot.waitingForResource === 0);
 }
 /** Default idle grace: long enough to merge two schedules ~10 minutes apart. */
 exports.DEFAULT_IDLE_GRACE_MS = 10 * 60 * 1000;

package/dist/commands/scheduler-runtime.js

@@ -58,6 +58,7 @@ const DeliveryDispatcher_1 = require("../delivery/DeliveryDispatcher");
 const token_maintenance_1 = require("../utils/token-maintenance");
 const schedules_1 = require("../scheduler/schedules");
 const SlotCoordinator_1 = require("../scheduler/SlotCoordinator");
+const RecoveryPolicy_1 = require("../scheduler/RecoveryPolicy");
 const DeliveryLedgerPort_1 = require("../delivery/DeliveryLedgerPort");
 const OutboxWorker_1 = require("../delivery/OutboxWorker");
 const settleDeliveryTerminal_1 = require("../delivery/settleDeliveryTerminal");
@@ -286,6 +287,20 @@ async function createSchedulerRuntime(configPathArg) {
             // "重抓/换一张" 只重跑产生该审核的那一个 target。
             targets = targets.filter((t) => t.id === onlyTarget);
         }
+        // Occurrence-scoped acquisition policy (§recovery-policy). A manual recovery
+        // slot carries a server-defined preset; `relaxed` widens only SOFT criteria
+        // (search range / candidate count / language window) for THIS occurrence.
+        // The global config is never written, so future schedules are unaffected.
+        const recoveryMode = providedSlot?.recoveryMode;
+        if (recoveryMode && recoveryMode !== 'normal') {
+            targets = targets.map((target) => (0, RecoveryPolicy_1.applyAcquisitionPolicy)(target, recoveryMode));
+            logger_1.logger.info('Manual recovery policy applied to this occurrence', {
+                scheduleId: schedule.id,
+                slot: providedSlot?.slotId,
+                recoveryMode,
+                targets: targets.map((t) => t.id),
+            });
+        }
         if (targets.length === 0) {
             logger_1.logger.warn('Scheduled plan has no selected targets; skipping', {
                 scheduleId: schedule.id,
@@ -639,6 +654,8 @@ async function createSchedulerRuntime(configPathArg) {
                             status: c.status,
                             workId: c.workId,
                             error: c.error ?? null,
+                            terminal_reason_code: c.terminalReasonCode ?? null,
+                            reason: c.terminalReasonMessage ?? null,
                         };
                     }));
                 }

package/dist/config/types.d.ts

@@ -279,6 +279,25 @@ export interface PixivCredentialConfig {
     deviceToken: string;
     refreshToken: string;
     userAgent: string;
+    /**
+     * Stable internal identity of this credential profile (§resource-governance).
+     * It is the RESOURCE identity used for admission keys (`pixiv-account:<id>`),
+     * never a token/cookie and never a bot/schedule/target name. Default 'default'.
+     */
+    accountId?: string;
+}
+/**
+ * Operator-level resource capacity configuration (§resource-governance).
+ * Concurrency is scoped by the real constrained resource, not by bot/schedule/
+ * target. Current production resource: the single Pixiv account profile, with
+ * `maxConcurrency: 1` recommended. This is deployment config — never exposed
+ * to ordinary manager UI.
+ */
+export interface ResourceGovernanceConfig {
+    /** Per-Pixiv-account-profile capacity. Keyed by `pixiv.accountId`. */
+    pixivAccounts?: Record<string, {
+        maxConcurrency?: number;
+    }>;
 }
 export interface NetworkConfig {
     /**
@@ -473,6 +492,13 @@ export interface SchedulerRuntimeConfig {
      * resumes from the same durable Slot/outbox rows. Default: 10800000ms (3h).
      */
     maxLifetimeMs?: number;
+    /**
+     * Operator-level resource capacity (§resource-governance). Concurrency is
+     * scoped by the real constrained resource (e.g. the shared Pixiv account),
+     * never by bot/schedule/target. Waiting for capacity is a normal state, not
+     * an execution failure. Not exposed to ordinary manager UI.
+     */
+    resourceGovernance?: ResourceGovernanceConfig;
     /**
      * External-mode HTTP trigger settings. Ignored in internal mode.
      */

package/dist/config/validation.js

@@ -473,6 +473,27 @@ function validateConfig(config, location, databasePath) {
                 errors.push('schedulerRuntime.trigger.graceMinutes: Must be a positive integer (minutes)');
             }
         }
+        const rg = rt.resourceGovernance;
+        if (rg) {
+            if (rg.pixivAccounts !== undefined && (typeof rg.pixivAccounts !== 'object' || rg.pixivAccounts === null || Array.isArray(rg.pixivAccounts))) {
+                errors.push('schedulerRuntime.resourceGovernance.pixivAccounts: Must be an object keyed by pixiv account id');
+            }
+            else if (rg.pixivAccounts) {
+                for (const [accountId, profile] of Object.entries(rg.pixivAccounts)) {
+                    if (!accountId.trim()) {
+                        errors.push('schedulerRuntime.resourceGovernance.pixivAccounts: account ids must be non-empty');
+                    }
+                    if (profile === null || typeof profile !== 'object' || Array.isArray(profile)) {
+                        errors.push(`schedulerRuntime.resourceGovernance.pixivAccounts.${accountId}: Must be an object`);
+                        continue;
+                    }
+                    const max = profile.maxConcurrency;
+                    if (max !== undefined && (!Number.isInteger(max) || max < 1 || max > 16)) {
+                        errors.push(`schedulerRuntime.resourceGovernance.pixivAccounts.${accountId}.maxConcurrency: Must be an integer between 1 and 16`);
+                    }
+                }
+            }
+        }
     }
     // Validate download config
     if (config.download) {

package/dist/delivery/types.d.ts

@@ -122,11 +122,26 @@ export interface DeliveryNotificationRequest {
         scheduleId: string;
         slotId: string;
         status: 'success' | 'partial' | 'failed';
+        /**
+         * Present when this terminal outcome belongs to a MANUAL RECOVERY run
+         * (§manual-recovery): the request id and the policy preset used. Lets the
+         * receiving service render "已恢复" instead of the daily summary.
+         */
+        recovery?: {
+            mode: 'normal' | 'relaxed';
+            requestId: string;
+        };
         targets?: Array<{
             targetId: string;
             workType: string;
             status: string;
             workId?: string | null;
+            /** Raw cell error (request-level observability; NOT user-safe text). */
+            error?: string | null;
+            /** Normalized terminal failure code (§terminal-reason). */
+            terminal_reason_code?: string | null;
+            /** User-facing business reason message for the failure. */
+            reason?: string | null;
         }>;
     };
 }

package/dist/notification/NotificationPolicy.d.ts

@@ -44,6 +44,8 @@ export declare class NotificationPolicy {
         status: string;
         workId: string | null;
         error: string | null;
+        terminal_reason_code?: string | null;
+        reason?: string | null;
     }>): void;
     /**
      * Delivery targets whose HTTP target declares the given outcome URL.

package/dist/notification/NotificationPolicy.js

@@ -88,7 +88,13 @@ class NotificationPolicy {
             (r.workId ? ` #${r.workId}` : '') +
             (r.status === 'delivery_pending' ? ' 投递中' : '') +
             (r.status === 'no_candidate' ? ' 无候选' : '') +
-            (r.status === 'failed' && r.error ? ` ${r.error.slice(0, 120)}` : ''));
+            // First-level cause, business language only: the durable normalized
+            // reason replaces any raw error text (§terminal-reason).
+            ((r.status === 'failed' || r.status === 'no_candidate' || r.status === 'duplicate') && r.reason
+                ? ` ${r.reason.slice(0, 80)}`
+                : r.status === 'failed' && r.error
+                    ? ` ${r.error.slice(0, 80)}`
+                    : ''));
         const submitted = rows.filter((r) => r.status === 'submitted').length;
         const text = [
             `${schedule.name?.trim() || schedule.id} · ${slot.occurrenceLabel}`,
@@ -102,11 +108,22 @@ class NotificationPolicy {
                 scheduleId: schedule.id,
                 slotId: slot.slotId,
                 status: outcomeStatus,
+                ...(slot.recoveryRequestId
+                    ? {
+                        recovery: {
+                            mode: slot.recoveryMode ?? 'normal',
+                            requestId: slot.recoveryRequestId,
+                        },
+                    }
+                    : {}),
                 targets: rows.map((r) => ({
                     targetId: r.targetId,
                     workType: r.workType,
                     status: r.status,
                     workId: r.workId,
+                    error: r.error,
+                    terminal_reason_code: r.terminal_reason_code ?? null,
+                    reason: r.reason ?? null,
                 })),
             });
         }

package/dist/package.json

@@ -1,6 +1,6 @@
 {
   "type": "commonjs",
   "name": "pixivflow",
-  "version": "2.20.5",
+  "version": "2.22.0",
   "private": true
 }

package/dist/scheduler/MultiScheduleManager.d.ts

@@ -34,7 +34,9 @@ export declare const RECOVERY_INTERVAL_MS: number;
 /**
  * Hosts many cron plans in one process. A validated config snapshot replaces
  * the complete cron table at once; invalid updates leave the previous table
- * running. All jobs share one bounded serial admission queue by default.
+ * running. All jobs that consume the same constrained resource (today: the
+ * shared Pixiv account) pass through ONE bounded resource admission; work for
+ * different resource identities runs concurrently.
  */
 export declare class MultiScheduleManager {
     private readonly options;
@@ -46,6 +48,15 @@ export declare class MultiScheduleManager {
     private watching;
     private readonly admission;
     constructor(options: MultiScheduleManagerOptions);
+    /**
+     * Deduplicated, log-safe observable: how many work items are parked waiting
+     * for any resource. Used by the idle lifecycle — waiting work is unfinished
+     * work and must prevent premature shutdown (§waiting-is-not-idle).
+     */
+    waitingWorkCount(): number;
+    /** The resource key a plan's work consumes (resource identity, never a bot/
+     *  schedule/target name). All Pixiv-consuming work shares the account id. */
+    private resourceKeyForPlan;
     start(initialConfig?: StandaloneConfig): ConfigReloadResult;
     private startRecoveryLoop;
     /**

package/dist/scheduler/MultiScheduleManager.js

@@ -9,6 +9,7 @@ const node_fs_1 = require("node:fs");
 const cron_parser_1 = __importDefault(require("cron-parser"));
 const logger_1 = require("../logger");
 const Scheduler_1 = require("./Scheduler");
+const ResourceAdmission_1 = require("./ResourceAdmission");
 const schedules_1 = require("./schedules");
 const OccurrenceResolver_1 = require("./OccurrenceResolver");
 /**
@@ -23,57 +24,26 @@ function asTriggerSource(value) {
         ? value
         : 'catchup';
 }
-class SerialJobAdmission {
-    queueLimit;
-    active = false;
-    pendingIds = new Set();
-    queue = [];
-    constructor(queueLimit) {
-        this.queueLimit = queueLimit;
-    }
-    setQueueLimit(queueLimit) {
-        this.queueLimit = Math.max(0, queueLimit);
-    }
-    acquire(scheduleId) {
-        if (!this.active) {
-            this.active = true;
-            return Promise.resolve(this.createLease());
-        }
-        // A slow task may span multiple cron ticks. Retain at most one pending run
-        // for each plan so a temporary outage cannot create an unbounded backlog.
-        if (this.pendingIds.has(scheduleId) || this.queue.length >= this.queueLimit) {
-            return Promise.resolve(null);
-        }
-        this.pendingIds.add(scheduleId);
-        return new Promise((resolve) => {
-            this.queue.push({ scheduleId, resolve });
-        });
-    }
-    createLease() {
-        let released = false;
-        return {
-            release: () => {
-                if (released)
-                    return;
-                released = true;
-                this.releaseNext();
-            },
-        };
-    }
-    releaseNext() {
-        const next = this.queue.shift();
-        if (!next) {
-            this.active = false;
-            return;
-        }
-        this.pendingIds.delete(next.scheduleId);
-        next.resolve(this.createLease());
-    }
+/**
+ * Capacity resolver for one resource key, from the configuration's
+ * resource-governance block (§resource-governance). Unknown resources default
+ * to capacity 1. The key encodes the resource identity (`pixiv-account:<id>`),
+ * so two different accounts get two independent capacities.
+ */
+function capacityOfResourceKey(config, key) {
+    const prefix = 'pixiv-account:';
+    if (!key.startsWith(prefix))
+        return 1;
+    const accountId = key.slice(prefix.length);
+    const profile = config?.schedulerRuntime?.resourceGovernance?.pixivAccounts?.[accountId];
+    return Math.max(1, profile?.maxConcurrency ?? 1);
 }
 /**
  * Hosts many cron plans in one process. A validated config snapshot replaces
  * the complete cron table at once; invalid updates leave the previous table
- * running. All jobs share one bounded serial admission queue by default.
+ * running. All jobs that consume the same constrained resource (today: the
+ * shared Pixiv account) pass through ONE bounded resource admission; work for
+ * different resource identities runs concurrently.
  */
 class MultiScheduleManager {
     options;
@@ -83,9 +53,25 @@ class MultiScheduleManager {
     reloadTimer = null;
     recoveryTimer = null;
     watching = false;
-    admission = new SerialJobAdmission(8);
+    admission;
     constructor(options) {
         this.options = options;
+        // Capacity is read lazily from the current config snapshot so a hot
+        // reload that changes `resourceGovernance` applies immediately.
+        this.admission = new ResourceAdmission_1.ResourceAdmission((key) => capacityOfResourceKey(this.activeConfig, key), 8);
+    }
+    /**
+     * Deduplicated, log-safe observable: how many work items are parked waiting
+     * for any resource. Used by the idle lifecycle — waiting work is unfinished
+     * work and must prevent premature shutdown (§waiting-is-not-idle).
+     */
+    waitingWorkCount() {
+        return this.admission.waitingTotal();
+    }
+    /** The resource key a plan's work consumes (resource identity, never a bot/
+     *  schedule/target name). All Pixiv-consuming work shares the account id. */
+    resourceKeyForPlan() {
+        return (0, ResourceAdmission_1.pixivAccountResourceKey)(this.activeConfig?.pixiv?.accountId);
     }
     start(initialConfig) {
         const config = initialConfig ?? this.options.loadConfig();
@@ -180,6 +166,12 @@ class MultiScheduleManager {
                 slotDate: slot.slotDate || slot.occurrenceDate,
                 manualRequestId: slot.manualRequestId ?? undefined,
                 correlationId: slot.correlationId ?? undefined,
+                // A crashed manual recovery resumes with the SAME occurrence-scoped
+                // policy, never a re-resolution that would lose the override.
+                recoveryRequestId: slot.recoveryRequestId ?? undefined,
+                recoveryMode: slot.recoveryMode === 'relaxed' || slot.recoveryMode === 'normal'
+                    ? slot.recoveryMode
+                    : undefined,
             };
             const admitted = this.triggerSchedule(slot.scheduleId, {
                 triggerSource: context.triggerSource,
@@ -284,12 +276,15 @@ class MultiScheduleManager {
         this.activeConfig = config;
         this.generation++;
         const generation = this.generation;
-        this.admission.setQueueLimit(queueLimit);
+        // Bounded wait queue across ALL resources (mirrors the legacy queueLimit
+        // guard against an unbounded backlog); capacity itself is per resource key.
+        this.admission.setMaxWaiting(queueLimit);
+        const resourceKey = this.resourceKeyForPlan();
         for (const plan of enabledPlans) {
             // Watchdog: schedules without an explicit timeout still get a cap so a
             // wedged run cannot hold the shared admission queue forever.
             const schedulerConfig = plan.timeout !== undefined ? plan : { ...plan, timeout: Scheduler_1.DEFAULT_SCHEDULE_TIMEOUT_MS };
-            const scheduler = new Scheduler_1.Scheduler(schedulerConfig, this.options.database, this.options.telemetry, plan.id, this.admission, (failure) => this.options.onFailure?.(config, plan, failure), (abandoned) => this.options.onAbandoned?.(config, plan, abandoned));
+            const scheduler = new Scheduler_1.Scheduler(schedulerConfig, this.options.database, this.options.telemetry, plan.id, this.admission, (failure) => this.options.onFailure?.(config, plan, failure), (abandoned) => this.options.onAbandoned?.(config, plan, abandoned), resourceKey);
             scheduler[registerCron ? 'start' : 'init'](async (options) => {
                 // The closure keeps the exact validated snapshot for an in-flight run.
                 // Cron fires pass no options (runJob resolves the occurrence for now);
@@ -308,6 +303,7 @@ class MultiScheduleManager {
                 targets: plan.targetIds?.length ?? 'all',
             })),
             queueLimit,
+            resourceKey,
         });
         return { ok: true, generation, schedules: scheduleIds };
     }

package/dist/scheduler/RecoveryPolicy.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Execution / acquisition policy preset (§recovery-policy).
+ *
+ * Operators do not tune `lookbackDays` / `candidateScanLimit` / language
+ * windows per attempt. The server defines a small number of named presets —
+ * `normal` and `relaxed` — and a recovery run reads the "effective policy"
+ * derived from the base config plus the occurrence-scoped override.
+ *
+ * Hard business constraints are NEVER relaxed by an ordinary recovery policy:
+ * security rules, explicit bans, wrong media type, data-integrity requirements,
+ * permission constraints, the selected topic/work-type boundary, delivery
+ * wiring and already-successfully-submitted exact duplicates are untouched.
+ * Only SOFT criteria (search range, candidate scan count, language-candidate
+ * window) may widen.
+ *
+ * The override is occurrence-scoped: `applyAcquisitionPolicy` is a pure
+ * function over a target snapshot. Nothing here ever writes the global config,
+ * so a manual relaxed recovery can never change future scheduled runs.
+ */
+import { TargetConfig } from '../config';
+export type RecoveryMode = 'normal' | 'relaxed';
+/** The soft levers an acquisition policy may adjust. */
+export interface AcquisitionPolicy {
+    /** Multiplier over the effective candidate scan limit (capped at 100). */
+    scanLimitMultiplier: number;
+    /** Multiplier over `noMatchPolicy.lookbackDays` (capped at the config max). */
+    lookbackDaysMultiplier: number;
+    /** Multiplier over the novel `languageCandidateLimit` search window. */
+    languageCandidateLimitMultiplier: number;
+}
+/**
+ * Server-defined presets. `normal` is the identity policy (the base config);
+ * `relaxed` widens only the soft criteria above.
+ */
+export declare const ACQUISITION_POLICIES: Record<RecoveryMode, AcquisitionPolicy>;
+/** Cap on the relaxed scan limit, mirroring the schedule fallback cap. */
+export declare const RELAXED_SCAN_LIMIT_CAP = 100;
+/** Cap on lookback days widened by a policy (matches the config validation cap). */
+export declare const RELAXED_LOOKBACK_DAYS_CAP = 7;
+/**
+ * Apply an acquisition policy to ONE target snapshot (pure; never mutates the
+ * input or global config). `normal` returns the target unchanged.
+ */
+export declare function applyAcquisitionPolicy(target: TargetConfig, mode: RecoveryMode): TargetConfig;
+//# sourceMappingURL=RecoveryPolicy.d.ts.map

package/dist/scheduler/RecoveryPolicy.js

@@ -0,0 +1,63 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RELAXED_LOOKBACK_DAYS_CAP = exports.RELAXED_SCAN_LIMIT_CAP = exports.ACQUISITION_POLICIES = void 0;
+exports.applyAcquisitionPolicy = applyAcquisitionPolicy;
+/**
+ * Server-defined presets. `normal` is the identity policy (the base config);
+ * `relaxed` widens only the soft criteria above.
+ */
+exports.ACQUISITION_POLICIES = {
+    normal: {
+        scanLimitMultiplier: 1,
+        lookbackDaysMultiplier: 1,
+        languageCandidateLimitMultiplier: 1,
+    },
+    relaxed: {
+        scanLimitMultiplier: 3,
+        lookbackDaysMultiplier: 3,
+        languageCandidateLimitMultiplier: 2,
+    },
+};
+/** Cap on the relaxed scan limit, mirroring the schedule fallback cap. */
+exports.RELAXED_SCAN_LIMIT_CAP = 100;
+/** Cap on lookback days widened by a policy (matches the config validation cap). */
+exports.RELAXED_LOOKBACK_DAYS_CAP = 7;
+/**
+ * Apply an acquisition policy to ONE target snapshot (pure; never mutates the
+ * input or global config). `normal` returns the target unchanged.
+ */
+function applyAcquisitionPolicy(target, mode) {
+    if (mode === 'normal')
+        return target;
+    const policy = exports.ACQUISITION_POLICIES[mode];
+    const scanLimit = target.candidateScanLimit !== undefined
+        ? cap(MULTIPLY(target.candidateScanLimit, policy.scanLimitMultiplier), exports.RELAXED_SCAN_LIMIT_CAP)
+        : undefined;
+    const languageCandidateLimit = target.languageCandidateLimit !== undefined
+        ? MULTIPLY(target.languageCandidateLimit, policy.languageCandidateLimitMultiplier)
+        : undefined;
+    const lookbackDays = widenLookback(target.noMatchPolicy?.lookbackDays, policy.lookbackDaysMultiplier);
+    if (scanLimit === undefined && languageCandidateLimit === undefined && lookbackDays === undefined) {
+        return target;
+    }
+    return {
+        ...target,
+        ...(scanLimit !== undefined ? { candidateScanLimit: scanLimit } : {}),
+        ...(languageCandidateLimit !== undefined ? { languageCandidateLimit } : {}),
+        ...(lookbackDays !== undefined
+            ? { noMatchPolicy: { ...(target.noMatchPolicy ?? {}), lookbackDays } }
+            : {}),
+    };
+}
+function MULTIPLY(value, multiplier) {
+    return Math.max(1, Math.floor(value * multiplier));
+}
+function cap(value, maximum) {
+    return Math.min(value, maximum);
+}
+function widenLookback(value, multiplier) {
+    if (value === undefined)
+        return undefined;
+    return Math.min(MULTIPLY(value, multiplier), exports.RELAXED_LOOKBACK_DAYS_CAP);
+}
+//# sourceMappingURL=RecoveryPolicy.js.map

package/dist/scheduler/ResourceAdmission.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Resource-scoped execution admission (§resource-governance).
+ *
+ * Concurrency is governed by the constrained RESOURCE a work item consumes
+ * (today: a Pixiv account), never by bot, schedule or target. Every work item
+ * that touches the scarce upstream — scheduled acquisition, fallback passes,
+ * manual refetch, manual normal/relaxed recovery — declares the resource key
+ * it needs and passes through this same bounded-capacity admission.
+ *
+ * Design constraints honoured here:
+ *
+ *  - Resource identity is a stable internal profile key (e.g.
+ *    `pixiv-account:<accountId>`). Tokens/cookies/session values are never a
+ *    resource key and never appear in logs.
+ *  - Capacity is config-driven per resource identity; the scheduler code does
+ *    not hardcode `1`.
+ *  - Waiting is FIFO (arrival order) per resource key, so no producer is
+ *    starved. Capacity is checked at the moment a lease is handed out, so a
+ *    single process never exceeds `capacity` active leases for one key.
+ *  - Different resource identities never block each other: account A and
+ *    account B run concurrently under independent capacities (no global lock).
+ *  - Waiting is NOT a failure: `acquire` resolves with `null` only when the
+ *    bounded wait queue itself is full (the caller then leaves the work in its
+ *    durable ledger for the recovery sweep). A queued work item is unfinished
+ *    work — it must keep the idle-detector from shutting the worker down
+ *    (see `waitingTotal` on the idle snapshot).
+ *
+ * Implementation level matches the production topology: one PixivFlow process
+ * owns the whole ledger on one machine, so an in-process FIFO semaphore is the
+ * correct mechanism. A durable/distributed lease would only be needed if the
+ * same resource could be consumed by multiple processes at once.
+ */
+export interface ResourceLease {
+    release(): void;
+}
+/**
+ * FIFO per-resource admission with config-driven capacity.
+ *
+ * `capacityOf(resourceKey)` returns the configured capacity for that key
+ * (default 1). `maxWaiting` bounds the TOTAL number of parked work items
+ * across all resources, mirroring the legacy `schedulerRuntime.queueLimit`
+ * guard against an unbounded backlog.
+ */
+export declare class ResourceAdmission {
+    private readonly capacityOf;
+    private maxWaiting;
+    private readonly active;
+    private readonly waiting;
+    constructor(capacityOf: (resourceKey: string) => number, maxWaiting?: number);
+    setMaxWaiting(maxWaiting: number): void;
+    /**
+     * Acquire a lease on `resourceKey`. Resolves immediately when capacity is
+     * available, parks the caller in a FIFO per-key queue otherwise, and resolves
+     * `null` (never rejects) when the bounded wait queue is full.
+     */
+    acquire(resourceKey: string): Promise<ResourceLease | null>;
+    private createLease;
+    private releaseNext;
+    /** Active leases for one resource key. */
+    activeCount(resourceKey: string): number;
+    /** Work items parked waiting for one resource key. */
+    waitingCount(resourceKey: string): number;
+    /** Work items parked waiting for ANY resource. Unfinished work, not failure. */
+    waitingTotal(): number;
+}
+/** The canonical resource identity for the process's Pixiv credential profile. */
+export declare function pixivAccountResourceKey(accountId: string | undefined): string;
+//# sourceMappingURL=ResourceAdmission.d.ts.map