{
  "type": "object",
  "properties": {
    "day": {
      "type": "string",
      "format": "date",
      "description": "A completed UTC day within the last 35 days."
    }
  },
  "required": [
    "day"
  ]
}

/**
 * POST /api/admin/jobs/rollup {day}: owner only, fresh step-up. Queues the AdminRollup function for one finished day
 * (within the last 35 days, the UsageDay retention; older days have nothing left to count) and audits the request as
 * `system.rollup.recompute` (the run itself audits `system.rollup`). 503 when the function isn't configured.
 */
export const POST = adminRoute("overview.read", async (request, ctx, _context, { session }) => {
  // Role first, then step-up, so a non-owner isn't asked to re-authenticate for something they can't do anyway.
  if (ctx.admin.role !== "owner") throw new CloudError(403, "forbidden", "Only owners can recompute rollups.");
  if (!stepUpFresh(session)) throw stepUpRequired();
  const { day } = await readBody(request, body);
  const today = utcDay();
  if (day >= today || day < addDays(today, -35)) throw new CloudError(400, "invalid_request", "Pick a finished day within the last 35 days.");
  try {
    const result = await audited(auditActor(ctx), { action: "system.rollup.recompute", targetType: "system", targetId: `rollup:${day}` }, () => invokeRollup(day));
    return adminJson({ ...result, day }, { status: 202 });
  } catch (error) {
    if (error instanceof CloudError) throw error;
    throw new CloudError(503, "rollup_unavailable", "The rollup job couldn't be started here. It runs nightly in production.");
  }
});