/api/comprehensive/sweep

// POST /api/comprehensive/sweep — the "someone comes back and asks" half of
// reaping a `running` comprehensive pull that next/server's after() never
// finished (see ../route.js's header for the full honest limitation, and
// what this endpoint does and does not close).
//
// Resolves every STALE `running` pull the AUTHENTICATED CALLER owns to a
// terminal `failed` state — never `partial`, never `passed`, and per
// debitForPull (src/local/credits.mjs) a `failed` pull is NEVER charged. See
// hosted-app/lib/comprehensive-pull-handler.mjs's reapStaleRunningPull for
// the idempotency and ownership-scoping guarantees this shares with the lazy
// GET-poll reap in ../route.js.
//
// This is still NOT a cron: it only reaps when something calls it. A pull
// whose owner never polls it (GET ../route.js) and never hits this endpoint
// either stays `running` forever — the same gap ../route.js's header names.
export const runtime = "nodejs";
export const dynamic = "force-dynamic";
// A handful of independent single-row PATCHes (default limit 50, see
// sweepStaleComprehensivePullsForUser) against PostgREST — generous but far
// under the platform ceiling; see ../route.js's header on that ceiling.
export const maxDuration = 30;

import { NextResponse } from "next/server";
import { supabaseConfigFromEnv } from "../../../../lib/supabase-rest.mjs";
import {
  sweepStaleComprehensivePullsForUser,
  bearerTokenFromHeader
} from "../../../../lib/comprehensive-pull-handler.mjs";

export async function POST(request) {
  const token = bearerTokenFromHeader(request.headers.get("authorization"));
  const config = supabaseConfigFromEnv(process.env);
  const result = await sweepStaleComprehensivePullsForUser({ token, config });
  return NextResponse.json(result.body, { status: result.http_status });
}