@aphexcms/cms-core 9.8.0 → 9.9.0

package/dist/auth/sign-up-policy.d.ts

@@ -0,0 +1,62 @@
+import type { BootstrapPolicy, InstanceRole } from './bootstrap.js';
+import type { DatabaseAdapter } from '../db/interfaces/index.js';
+import type { UserProfile } from '../types/index.js';
+/**
+ * Thrown when sign-up is refused by policy.
+ *
+ * Providers translate this into whatever their transport expects — Better Auth
+ * raises an `APIError`, a REST handler might return 403. The message is written
+ * to be safe to show a user.
+ */
+export declare class SignUpBlockedError extends Error {
+    readonly code = "SIGN_UP_BLOCKED";
+    constructor(message: string);
+}
+export interface SignUpGateOptions {
+    db: DatabaseAdapter;
+    /** Address attempting to register. Matched case-insensitively. */
+    email: string | undefined;
+    /** When false the gate is disabled entirely and this is a no-op. */
+    inviteOnly: boolean;
+}
+/**
+ * Throws `SignUpBlockedError` unless this address may create an account.
+ *
+ * Two ways through: the instance is provably empty (nobody exists yet to have
+ * sent an invitation, so gating the first sign-up would lock the door with the
+ * keys inside), or the address holds a pending invitation.
+ *
+ * Narrowing that first exception is the bootstrap policy's job — see
+ * `resolveBootstrapRole` — not this gate's.
+ */
+export declare function assertSignUpAllowed({ db, email, inviteOnly }: SignUpGateOptions): Promise<void>;
+export interface BootstrapRoleOptions {
+    db: DatabaseAdapter;
+    user: {
+        id: string;
+        email: string;
+        emailVerified: boolean;
+    };
+    /** The request that triggered profile creation, when there is one. */
+    request?: Request;
+    bootstrap: BootstrapPolicy;
+}
+/**
+ * Runs the bootstrap policy for a brand-new user, returning the instance role to
+ * grant or `null` for none.
+ *
+ * Deliberately not wrapped in a transaction. SQLite allows a single writer, and
+ * holding that lock across the policy's own round-trips collides with the auth
+ * provider's concurrent user/session inserts (SQLITE_BUSY). The atomicity was
+ * only partial anyway — see `claimCode`: a claim is single-use, not mutually
+ * exclusive.
+ */
+export declare function resolveBootstrapRole({ db, user, request, bootstrap }: BootstrapRoleOptions): Promise<InstanceRole | null>;
+/**
+ * The one place a CMS user profile is created for a newly-authenticated user.
+ *
+ * Every `AuthProvider` should route new profiles through here so bootstrap
+ * promotion happens identically regardless of who did the authenticating.
+ */
+export declare function createUserProfileWithBootstrap(options: BootstrapRoleOptions): Promise<UserProfile>;
+//# sourceMappingURL=sign-up-policy.d.ts.map

package/dist/auth/sign-up-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-up-policy.d.ts","sourceRoot":"","sources":["../../src/lib/auth/sign-up-policy.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAElD;;;;;;GAMG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,IAAI,qBAAqB;gBACtB,OAAO,EAAE,MAAM;CAI3B;AAED,MAAM,WAAW,iBAAiB;IACjC,EAAE,EAAE,eAAe,CAAC;IACpB,kEAAkE;IAClE,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,oEAAoE;IACpE,UAAU,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;;;GASG;AACH,wBAAsB,mBAAmB,CAAC,EACzC,EAAE,EACF,KAAK,EACL,UAAU,EACV,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAmBnC;AAED,MAAM,WAAW,oBAAoB;IACpC,EAAE,EAAE,eAAe,CAAC;IACpB,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,OAAO,CAAA;KAAE,CAAC;IAC5D,sEAAsE;IACtE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,eAAe,CAAC;CAC3B;AAED;;;;;;;;;GASG;AACH,wBAAsB,oBAAoB,CAAC,EAC1C,EAAE,EACF,IAAI,EACJ,OAAO,EACP,SAAS,EACT,EAAE,oBAAoB,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAerD;AAuBD;;;;;GAKG;AACH,wBAAsB,8BAA8B,CACnD,OAAO,EAAE,oBAAoB,GAC3B,OAAO,CAAC,WAAW,CAAC,CA6BtB"}

package/dist/auth/sign-up-policy.js

@@ -0,0 +1,120 @@
+// Who may sign up, and what they get when they do.
+//
+// These are **CMS policy decisions, not auth-provider concerns**. Whether an
+// instance is invite-only, and who becomes its first administrator, should mean
+// the same thing whether the app authenticates with Better Auth, Keycloak,
+// Supabase, or something hand-rolled — so they live behind the `AuthProvider`
+// port rather than inside any one implementation of it.
+//
+// Before this existed, both rules were enforced inside `@aphexcms/auth`'s
+// Better Auth wiring, which meant a third-party provider silently inherited
+// neither: `inviteOnly: true` would be configured and quietly do nothing. An
+// implementation is free to call these wherever its lifecycle allows, but it is
+// no longer free to *re-derive* them.
+import { cmsLogger } from '../utils/logger.js';
+import { isInstanceEmpty, canDetermineInstanceEmptiness } from './instance-state.js';
+import { isPendingInvitation } from './invitation-status.js';
+/**
+ * Thrown when sign-up is refused by policy.
+ *
+ * Providers translate this into whatever their transport expects — Better Auth
+ * raises an `APIError`, a REST handler might return 403. The message is written
+ * to be safe to show a user.
+ */
+export class SignUpBlockedError extends Error {
+    code = 'SIGN_UP_BLOCKED';
+    constructor(message) {
+        super(message);
+        this.name = 'SignUpBlockedError';
+    }
+}
+/**
+ * Throws `SignUpBlockedError` unless this address may create an account.
+ *
+ * Two ways through: the instance is provably empty (nobody exists yet to have
+ * sent an invitation, so gating the first sign-up would lock the door with the
+ * keys inside), or the address holds a pending invitation.
+ *
+ * Narrowing that first exception is the bootstrap policy's job — see
+ * `resolveBootstrapRole` — not this gate's.
+ */
+export async function assertSignUpAllowed({ db, email, inviteOnly }) {
+    if (!inviteOnly)
+        return;
+    if (await isInstanceEmpty(db)) {
+        cmsLogger.info('[SignUp]', 'Allowing first sign-up on an empty instance');
+        return;
+    }
+    // Invitations are stored lower-cased and matched exactly, so a mixed-case
+    // sign-up would otherwise find nothing and be refused.
+    const address = email?.toLowerCase().trim();
+    const invitations = address ? await db.findInvitationsByEmail(address) : [];
+    if (!invitations.some((invitation) => isPendingInvitation(invitation))) {
+        cmsLogger.warn('[SignUp]', `Blocked sign-up for ${address} — no pending invitation`);
+        throw new SignUpBlockedError('Sign-up is by invitation only. Ask an administrator for an invite.');
+    }
+}
+/**
+ * Runs the bootstrap policy for a brand-new user, returning the instance role to
+ * grant or `null` for none.
+ *
+ * Deliberately not wrapped in a transaction. SQLite allows a single writer, and
+ * holding that lock across the policy's own round-trips collides with the auth
+ * provider's concurrent user/session inserts (SQLITE_BUSY). The atomicity was
+ * only partial anyway — see `claimCode`: a claim is single-use, not mutually
+ * exclusive.
+ */
+export async function resolveBootstrapRole({ db, user, request, bootstrap }) {
+    // "Provably empty", not "couldn't prove otherwise". An adapter that can't
+    // answer this must not read as "no users exist" — that inversion once
+    // promoted every single sign-up to super admin.
+    const isFirstUser = await isInstanceEmpty(db);
+    if (!canDetermineInstanceEmptiness(db)) {
+        cmsLogger.warn('[SignUp]', 'Database adapter does not implement hasAnyUserProfiles() — skipping bootstrap. ' +
+            'Provision the first administrator out of band.');
+    }
+    return bootstrap({ user, isFirstUser, request, db });
+}
+/**
+ * Take the one-time bootstrap claim, or report that somebody else has it.
+ *
+ * An adapter without `tryClaimBootstrap` keeps the old, racy behaviour rather
+ * than never promoting anyone — the opposite of the rule `isInstanceEmpty`
+ * follows, and on purpose. There, failing closed skips a promotion; here it
+ * would leave a fresh install with no administrator and no way to get one.
+ */
+async function claimBootstrapPromotion(db) {
+    const claim = db.tryClaimBootstrap?.bind(db);
+    if (!claim) {
+        cmsLogger.warn('[SignUp]', 'Database adapter does not implement tryClaimBootstrap() — bootstrap promotion is not ' +
+            'race-safe. Concurrent first sign-ups could both be promoted.');
+        return true;
+    }
+    return claim();
+}
+/**
+ * The one place a CMS user profile is created for a newly-authenticated user.
+ *
+ * Every `AuthProvider` should route new profiles through here so bootstrap
+ * promotion happens identically regardless of who did the authenticating.
+ */
+export async function createUserProfileWithBootstrap(options) {
+    const proposed = await resolveBootstrapRole(options);
+    // The policy decided *whether* this user qualifies; the claim decides whether
+    // they got there first. Both are needed: the policy's own `isFirstUser` check
+    // reads a snapshot taken before the profile insert, so two sign-ups racing on
+    // a fresh instance can both pass it and both be promoted. Every promotion in
+    // the instance's lifetime funnels through this one call, so claiming here
+    // covers every policy — including a custom one — without each having to know
+    // about the race.
+    const granted = proposed && (await claimBootstrapPromotion(options.db)) ? proposed : null;
+    if (proposed && !granted) {
+        cmsLogger.warn('[SignUp]', `Bootstrap promotion for ${options.user.id} lost the claim — another sign-up got there first. ` +
+            'Creating an ordinary profile instead.');
+    }
+    cmsLogger.info('[SignUp]', `Creating profile for ${options.user.id}${granted ? ` with role ${granted.toUpperCase()}` : ''}`);
+    return options.db.createUserProfile({
+        userId: options.user.id,
+        role: granted ?? 'editor'
+    });
+}

package/dist/components/admin/ActivityView.svelte

@@ -7,25 +7,58 @@
 	import { onMount } from 'svelte';
 	import { Button } from '@aphexcms/ui/shadcn/button';
 	import { Badge } from '@aphexcms/ui/shadcn/badge';
-	import { RefreshCw, CalendarClock, Radio, Sparkles, Undo2, ChevronDown } from '@lucide/svelte';
+	import {
+		RefreshCw,
+		CalendarClock,
+		Radio,
+		Sparkles,
+		Undo2,
+		ChevronDown,
+		RotateCcw,
+		Ban,
+		TriangleAlert
+	} from '@lucide/svelte';
 	import { toast } from 'svelte-sonner';
 	import { apiClient } from '../../api/client';
-	import type { Job, DomainEvent, JobStatus } from '../../types/events';
+	import type { Job, DomainEvent, JobStatus, OutboxHealth } from '../../types/events';
 	import type {
 		AgentChangeSet,
 		AgentChangeSetWithOperations,
 		AgentChangeSetStatus
 	} from '../../types/agent-change-sets';
 
+	type Props = {
+		/**
+		 * May the viewer retry/cancel jobs? `org.settings` — see `requireJobControl` in the
+		 * route. Gating here only hides buttons; the server is what enforces it.
+		 */
+		canControlJobs?: boolean;
+		/** Super admins can widen jobs/events past their active organization (`?scope=all`). */
+		isSuperAdmin?: boolean;
+	};
+	let { canControlJobs = false, isSuperAdmin = false }: Props = $props();
+
 	// The server resolves `createdBy` (a raw user id) to a display name — see
 	// `resolve-created-by.ts`, shared by GET /api/events and GET /api/agent/change-sets.
 	type WithCreatedByName<T> = T & { createdByName: string | null };
+	// …and `organizationId` to an org name, but only in the instance-wide view, where rows
+	// from several tenants share a table. Absent (not null) in the org-scoped view.
+	type WithOrganizationName<T> = T & { organizationName?: string | null };
 
 	type Tab = 'jobs' | 'events' | 'agent';
 	let tab = $state<Tab>('jobs');
 
-	let jobs = $state<Job[]>([]);
-	let events = $state<WithCreatedByName<DomainEvent>[]>([]);
+	/**
+	 * Whose history is on screen. `all` is a super-admin-only widening: the queue is
+	 * instance-wide (one worker claims across every org), so a failure in a tenant you
+	 * aren't currently switched into is otherwise invisible.
+	 */
+	let scope = $state<'organization' | 'all'>('organization');
+
+	let jobs = $state<WithOrganizationName<Job>[]>([]);
+	let events = $state<WithOrganizationName<WithCreatedByName<DomainEvent>>[]>([]);
+	let health = $state<OutboxHealth | null>(null);
+	let actingJobId = $state<string | null>(null);
 	let changeSets = $state<WithCreatedByName<AgentChangeSetWithOperations>[]>([]);
 	let loading = $state(false);
 	let error = $state<string | null>(null);
@@ -89,24 +122,86 @@
 		return Number.isNaN(date.getTime()) ? '—' : date.toLocaleString();
 	}
 
+	/** "3m", "2h", "4d" — coarse on purpose; this is a staleness signal, not a stopwatch. */
+	function age(d: string | Date): string {
+		const ms = Date.now() - new Date(d).getTime();
+		if (ms < 60_000) return `${Math.max(0, Math.round(ms / 1000))}s`;
+		if (ms < 3_600_000) return `${Math.round(ms / 60_000)}m`;
+		if (ms < 86_400_000) return `${Math.round(ms / 3_600_000)}h`;
+		return `${Math.round(ms / 86_400_000)}d`;
+	}
+
+	// A backlog older than this means the relay has stopped, not that it's busy. The
+	// self-hosted worker polls every 5s by default and platform cron runs at most once a
+	// minute, so a minute is the shortest gap that can't be explained by normal cadence.
+	const RELAY_STALE_MS = 60_000;
+
+	/**
+	 * The backlog, pre-chewed into exactly what the banner renders — or null when there's
+	 * nothing to say. Deriving the whole object (rather than a `stalled` flag beside the raw
+	 * `health`) is what lets the markup read `oldestAge` without re-proving that
+	 * `oldestPendingAt` is non-null: `pending > 0` implies a row exists, but only this
+	 * narrowing tells the compiler so.
+	 */
+	const relayBacklog = $derived.by(() => {
+		const oldest = health?.oldestPendingAt;
+		if (!health || health.pending === 0 || !oldest) return null;
+		return {
+			pending: health.pending,
+			oldestAge: age(oldest),
+			stalled: Date.now() - new Date(oldest).getTime() > RELAY_STALE_MS
+		};
+	});
+
+	/**
+	 * A job whose lease has run out but which is still marked `leased` — the worker holding
+	 * it died mid-run. It isn't lost (the next `claimDueJobs` reclaims expired leases), but
+	 * it looks identical to healthy in-flight work without this.
+	 */
+	function leaseExpired(job: Job): boolean {
+		return (
+			job.status === 'leased' && !!job.leaseExpiresAt && new Date(job.leaseExpiresAt) < new Date()
+		);
+	}
+
+	/** Requeue puts a dead letter back with a fresh attempt budget; cancel retires it. */
+	const canRetry = (job: Job) => job.status === 'failed' || job.status === 'cancelled';
+	const canCancel = (job: Job) => job.status === 'pending' || job.status === 'failed';
+
+	/** Only send `scope` when it's actually widened — keeps the default request unchanged. */
+	function scopeParam(): Record<string, string> {
+		return scope === 'all' ? { scope: 'all' } : {};
+	}
+
 	async function load() {
 		loading = true;
 		error = null;
 		try {
 			if (tab === 'jobs') {
-				const params: Record<string, string> = { limit: '100' };
+				const params: Record<string, string> = { limit: '100', ...scopeParam() };
 				if (statusFilter !== 'all') params.status = statusFilter;
-				const res = await apiClient.get<Job[]>('/jobs', params);
+				// Health rides along with the list: it's the context for everything below it,
+				// and a separate refresh button for one number would be its own small trap.
+				const [res, healthRes] = await Promise.all([
+					apiClient.get<WithOrganizationName<Job>[]>('/jobs', params),
+					apiClient.get<OutboxHealth>('/jobs/health', scopeParam())
+				]);
 				if (res.success) {
 					jobs = res.data ?? [];
 					total = res.pagination?.total ?? jobs.length;
 				} else {
 					error = res.error ?? 'Failed to load jobs';
 				}
+				// A failed health read shouldn't blank the page — the list is still useful.
+				health = healthRes.success ? (healthRes.data ?? null) : null;
 			} else if (tab === 'events') {
-				const res = await apiClient.get<WithCreatedByName<DomainEvent>[]>('/events', {
-					limit: '100'
-				});
+				const res = await apiClient.get<WithOrganizationName<WithCreatedByName<DomainEvent>>[]>(
+					'/events',
+					{
+						limit: '100',
+						...scopeParam()
+					}
+				);
 				if (res.success) {
 					events = res.data ?? [];
 					total = res.pagination?.total ?? events.length;
@@ -138,6 +233,34 @@
 		load();
 	}
 
+	/**
+	 * Retry and cancel share everything but the verb and the past-tense confirmation, so they
+	 * share a body. `organizationId` is always sent: in the instance-wide view the job may
+	 * belong to a tenant the caller isn't switched into, and the server needs to be told which
+	 * one (it rejects the mismatch unless you're a super admin).
+	 */
+	async function actOnJob(job: Job, action: 'retry' | 'cancel') {
+		if (actingJobId) return;
+		actingJobId = job.id;
+		try {
+			const res = await apiClient.post<Job>(`/jobs/${job.id}/${action}`, {
+				organizationId: job.organizationId
+			});
+			if (!res.success) {
+				toast.error(res.error ?? `Could not ${action} this job`);
+				return;
+			}
+			toast.success(
+				action === 'retry' ? 'Job requeued — it runs on the next tick.' : 'Job cancelled.'
+			);
+			await load();
+		} catch (err) {
+			toast.error(err instanceof Error ? err.message : `Could not ${action} this job`);
+		} finally {
+			actingJobId = null;
+		}
+	}
+
 	async function toggleExpand(changeSet: AgentChangeSet) {
 		if (expandedChangeSetId === changeSet.id) {
 			expandedChangeSetId = null;
@@ -196,6 +319,13 @@
 		if (tab === 'jobs') load();
 	});
 
+	// Scope applies to jobs and events alike, so this one reloads whichever is showing.
+	$effect(() => {
+		// eslint-disable-next-line @typescript-eslint/no-unused-expressions -- reactive dependency: re-run when scope changes
+		scope;
+		if (tab !== 'agent') load();
+	});
+
 	onMount(load);
 </script>
 
@@ -207,9 +337,32 @@
 				Scheduled jobs, the domain-event log, and the AI assistant's audit trail.
 			</p>
 		</div>
-		<Button variant="outline" size="sm" onclick={load} disabled={loading} class="gap-1.5">
-			<RefreshCw class="h-3.5 w-3.5 {loading ? 'animate-spin' : ''}" /> Refresh
-		</Button>
+		<div class="flex items-center gap-2">
+			{#if isSuperAdmin && tab !== 'agent'}
+				<!-- The queue is instance-wide; this is the only view that can show it that way. -->
+				<div class="border-rule flex items-center rounded-md border p-0.5 text-xs">
+					<button
+						class="rounded px-2 py-1 transition-colors {scope === 'organization'
+							? 'bg-muted text-foreground'
+							: 'text-muted-foreground hover:text-foreground'}"
+						onclick={() => (scope = 'organization')}
+					>
+						This workspace
+					</button>
+					<button
+						class="rounded px-2 py-1 transition-colors {scope === 'all'
+							? 'bg-muted text-foreground'
+							: 'text-muted-foreground hover:text-foreground'}"
+						onclick={() => (scope = 'all')}
+					>
+						All workspaces
+					</button>
+				</div>
+			{/if}
+			<Button variant="outline" size="sm" onclick={load} disabled={loading} class="gap-1.5">
+				<RefreshCw class="h-3.5 w-3.5 {loading ? 'animate-spin' : ''}" /> Refresh
+			</Button>
+		</div>
 	</div>
 
 	<!-- Tabs -->
@@ -244,6 +397,43 @@
 	</div>
 
 	{#if tab === 'jobs'}
+		{#if relayBacklog}
+			<!--
+				The relay backlog. A count on its own is meaningless — a busy instance always has
+				rows in flight — so the age of the oldest is what decides the tone: past a minute,
+				nothing is draining the outbox and every consumer has silently stopped.
+			-->
+			<div
+				class="mb-3 flex items-start gap-2 rounded-md border p-3 text-sm {relayBacklog.stalled
+					? 'border-destructive/40 bg-destructive/10 text-destructive'
+					: 'border-rule text-muted-foreground'}"
+			>
+				{#if relayBacklog.stalled}
+					<TriangleAlert class="mt-0.5 h-4 w-4 shrink-0" />
+				{:else}
+					<Radio class="mt-0.5 h-4 w-4 shrink-0" />
+				{/if}
+				<div>
+					{#if relayBacklog.stalled}
+						<p class="font-medium">
+							The relay looks stopped — {relayBacklog.pending} event{relayBacklog.pending === 1
+								? ''
+								: 's'} waiting, oldest {relayBacklog.oldestAge} old.
+						</p>
+						<p class="mt-0.5 text-xs">
+							Nothing is reacting to events: scheduled publishes, erasure and plugin consumers are
+							all paused until a worker calls <code>POST /api/internal/workers/run</code> again.
+						</p>
+					{:else}
+						<p>
+							{relayBacklog.pending} event{relayBacklog.pending === 1 ? '' : 's'} waiting to fan out,
+							oldest {relayBacklog.oldestAge} old — the relay is keeping up.
+						</p>
+					{/if}
+				</div>
+			</div>
+		{/if}
+
 		<div class="mb-3 flex flex-wrap items-center gap-1.5">
 			{#each statuses as s (s)}
 				<button
@@ -276,19 +466,42 @@
 					<thead class="bg-muted/50 text-muted-foreground text-xs">
 						<tr>
 							<th class="px-3 py-2 text-left font-medium">Type</th>
+							{#if scope === 'all'}
+								<th class="px-3 py-2 text-left font-medium">Workspace</th>
+							{/if}
 							<th class="px-3 py-2 text-left font-medium">Status</th>
 							<th class="px-3 py-2 text-left font-medium">Run at</th>
 							<th class="px-3 py-2 text-left font-medium">Attempts</th>
 							<th class="px-3 py-2 text-left font-medium">Last error</th>
 							<th class="px-3 py-2 text-left font-medium">Created</th>
+							{#if canControlJobs}
+								<th class="px-3 py-2 text-right font-medium">Actions</th>
+							{/if}
 						</tr>
 					</thead>
 					<tbody>
 						{#each jobs as job (job.id)}
 							<tr class="border-rule border-t">
 								<td class="px-3 py-2 font-mono text-xs">{job.type}</td>
-								<td class="px-3 py-2">
+								{#if scope === 'all'}
+									<td class="text-muted-foreground px-3 py-2 text-xs">
+										{job.organizationName ?? job.organizationId}
+									</td>
+								{/if}
+								<td class="px-3 py-2 whitespace-nowrap">
 									<Badge variant={statusVariant[job.status]} class="capitalize">{job.status}</Badge>
+									{#if leaseExpired(job)}
+										<!-- Still `leased` past its expiry: the worker that held it died. The next
+										     claim reclaims it, so this is a diagnosis, not an action item. -->
+										<span
+											class="text-destructive ml-1.5 text-xs"
+											title="Lease expired {age(
+												job.leaseExpiresAt ?? new Date()
+											)} ago — the worker holding this job stopped. It will be reclaimed on the next tick."
+										>
+											stalled
+										</span>
+									{/if}
 								</td>
 								<td class="px-3 py-2 whitespace-nowrap">{fmt(job.runAt)}</td>
 								<td class="px-3 py-2">{job.attempts}/{job.maxAttempts}</td>
@@ -301,6 +514,35 @@
 								<td class="text-muted-foreground px-3 py-2 whitespace-nowrap"
 									>{fmt(job.createdAt)}</td
 								>
+								{#if canControlJobs}
+									<td class="px-3 py-2 text-right whitespace-nowrap">
+										{#if canRetry(job)}
+											<Button
+												variant="ghost"
+												size="sm"
+												class="h-7 gap-1 px-2 text-xs"
+												disabled={actingJobId !== null}
+												onclick={() => actOnJob(job, 'retry')}
+											>
+												<RotateCcw class="h-3 w-3" /> Retry
+											</Button>
+										{/if}
+										{#if canCancel(job)}
+											<Button
+												variant="ghost"
+												size="sm"
+												class="text-muted-foreground h-7 gap-1 px-2 text-xs"
+												disabled={actingJobId !== null}
+												onclick={() => actOnJob(job, 'cancel')}
+											>
+												<Ban class="h-3 w-3" /> Cancel
+											</Button>
+										{/if}
+										{#if !canRetry(job) && !canCancel(job)}
+											<span class="text-muted-foreground text-xs">—</span>
+										{/if}
+									</td>
+								{/if}
 							</tr>
 						{/each}
 					</tbody>
@@ -317,6 +559,9 @@
 					<thead class="bg-muted/50 text-muted-foreground text-xs">
 						<tr>
 							<th class="px-3 py-2 text-left font-medium">Type</th>
+							{#if scope === 'all'}
+								<th class="px-3 py-2 text-left font-medium">Workspace</th>
+							{/if}
 							<th class="px-3 py-2 text-left font-medium">Payload</th>
 							<th class="px-3 py-2 text-left font-medium">By</th>
 							<th class="px-3 py-2 text-left font-medium">When</th>
@@ -326,6 +571,11 @@
 						{#each events as event (event.id)}
 							<tr class="border-rule border-t">
 								<td class="px-3 py-2 font-mono text-xs">{event.type}</td>
+								{#if scope === 'all'}
+									<td class="text-muted-foreground px-3 py-2 text-xs">
+										{event.organizationName ?? event.organizationId}
+									</td>
+								{/if}
 								<td
 									class="text-muted-foreground max-w-[320px] truncate px-3 py-2 font-mono text-xs"
 									title={JSON.stringify(event.payload)}

package/dist/components/admin/ActivityView.svelte.d.ts

@@ -1,4 +1,13 @@
-declare const ActivityView: import("svelte").Component<Record<string, never>, {}, "">;
+type Props = {
+    /**
+     * May the viewer retry/cancel jobs? `org.settings` — see `requireJobControl` in the
+     * route. Gating here only hides buttons; the server is what enforces it.
+     */
+    canControlJobs?: boolean;
+    /** Super admins can widen jobs/events past their active organization (`?scope=all`). */
+    isSuperAdmin?: boolean;
+};
+declare const ActivityView: import("svelte").Component<Props, {}, "">;
 type ActivityView = ReturnType<typeof ActivityView>;
 export default ActivityView;
 //# sourceMappingURL=ActivityView.svelte.d.ts.map

package/dist/components/admin/ActivityView.svelte.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ActivityView.svelte.d.ts","sourceRoot":"","sources":["../../../src/lib/components/admin/ActivityView.svelte.ts"],"names":[],"mappings":"AAoZA,QAAA,MAAM,YAAY,2DAAwC,CAAC;AAC3D,KAAK,YAAY,GAAG,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC;AACpD,eAAe,YAAY,CAAC"}
+{"version":3,"file":"ActivityView.svelte.d.ts","sourceRoot":"","sources":["../../../src/lib/components/admin/ActivityView.svelte.ts"],"names":[],"mappings":"AAgCC,KAAK,KAAK,GAAG;IACZ;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,wFAAwF;IACxF,YAAY,CAAC,EAAE,OAAO,CAAC;CACvB,CAAC;AA8kBH,QAAA,MAAM,YAAY,2CAAwC,CAAC;AAC3D,KAAK,YAAY,GAAG,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC;AACpD,eAAe,YAAY,CAAC"}

package/dist/db/interfaces/events.d.ts

@@ -1,4 +1,4 @@
-import type { DomainEvent, AppendEventInput, Job, ScheduleJobInput, ClaimJobsOptions, ListEventsOptions, ListJobsOptions, OutboxRow, ListUnprocessedOutboxOptions, Page } from '../../types/events.js';
+import type { DomainEvent, AppendEventInput, Job, ScheduleJobInput, ClaimJobsOptions, ListEventsOptions, ListJobsOptions, OutboxRow, ListUnprocessedOutboxOptions, OutboxHealth, Page } from '../../types/events.js';
 /**
  * The durable spine: an append-only domain-event log plus a DB-backed job queue.
  * All rows are organization-scoped. (The event-log read API — `listEvents` — lands
@@ -25,6 +25,13 @@ export interface EventJobAdapter {
     listUnprocessedOutbox(options: ListUnprocessedOutboxOptions): Promise<OutboxRow[]>;
     /** Stamp `processedAt` once an outbox row has been fanned out to every subscriber. */
     markOutboxProcessed(organizationId: string, id: string): Promise<void>;
+    /**
+     * Size and age of the unprocessed backlog — the "is the relay running?" signal.
+     * Omit `organizationId` for the instance-wide figure. See {@link OutboxHealth}.
+     */
+    outboxHealth(options: {
+        organizationId?: string;
+    }): Promise<OutboxHealth>;
     /** Schedule a job. Idempotent when `idempotencyKey` is set: a duplicate key returns the existing job. */
     scheduleJob(input: ScheduleJobInput): Promise<Job>;
     /**
@@ -49,7 +56,27 @@ export interface EventJobAdapter {
     }): Promise<void>;
     /** Cancel a job (e.g. a scheduled publish the user called off): status → `cancelled`, clear the lease. */
     cancelJob(organizationId: string, id: string): Promise<void>;
-    /** List jobs for the org, newest first (read-only history / observability). */
+    /** Read a single job by id (org-scoped). Null when it doesn't exist in that org. */
+    getJob(organizationId: string, id: string): Promise<Job | null>;
+    /**
+     * Put a finished job back on the queue by hand — the operator's undo for a dead letter.
+     *
+     * Distinct from `retryJob`, which is the *runner's* backoff transition and deliberately
+     * leaves `attempts` alone. A dead-lettered job sits at `attempts === maxAttempts`, so
+     * reusing `retryJob` would hand it back to the runner only for the next claim to exhaust
+     * it again immediately. This resets the attempt counter and clears `lastError`, giving
+     * the job a fresh budget once whatever broke has been fixed.
+     *
+     * Guarded to `failed` and `cancelled` in SQL: requeueing a `pending` job is pointless and
+     * requeueing a `leased` one would race the worker currently holding it, whose settle would
+     * then overwrite the status. Returns the updated job, or null when the id doesn't exist in
+     * the org or wasn't in a requeueable state — so callers can tell "gone" from "not allowed"
+     * with a follow-up `getJob`.
+     */
+    requeueJob(organizationId: string, id: string, options: {
+        runAt: Date;
+    }): Promise<Job | null>;
+    /** List jobs, newest first (read-only history / observability). Omit `organizationId` for instance-wide. */
     listJobs(options: ListJobsOptions): Promise<Page<Job>>;
 }
 //# sourceMappingURL=events.d.ts.map

package/dist/db/interfaces/events.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../../../src/lib/db/interfaces/events.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACX,WAAW,EACX,gBAAgB,EAChB,GAAG,EACH,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,SAAS,EACT,4BAA4B,EAC5B,IAAI,EACJ,MAAM,oBAAoB,CAAC;AAE5B;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAE/B;;;;;;OAMG;IACH,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAC3D,8CAA8C;IAC9C,QAAQ,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAC1E,wFAAwF;IACxF,UAAU,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IAGnE;;;;OAIG;IACH,qBAAqB,CAAC,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IACnF,sFAAsF;IACtF,mBAAmB,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAGvE,yGAAyG;IACzG,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IACnD;;;OAGG;IACH,YAAY,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACxD,oCAAoC;IACpC,WAAW,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CACP,cAAc,EAAE,MAAM,EACtB,EAAE,EAAE,MAAM,EACV,OAAO,EAAE;QAAE,KAAK,EAAE,IAAI,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GACrC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,uFAAuF;IACvF,OAAO,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvF,0GAA0G;IAC1G,SAAS,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7D,+EAA+E;IAC/E,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;CACvD"}
+{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../../../src/lib/db/interfaces/events.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACX,WAAW,EACX,gBAAgB,EAChB,GAAG,EACH,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,SAAS,EACT,4BAA4B,EAC5B,YAAY,EACZ,IAAI,EACJ,MAAM,oBAAoB,CAAC;AAE5B;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAE/B;;;;;;OAMG;IACH,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAC3D,8CAA8C;IAC9C,QAAQ,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAC1E,wFAAwF;IACxF,UAAU,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IAGnE;;;;OAIG;IACH,qBAAqB,CAAC,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IACnF,sFAAsF;IACtF,mBAAmB,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvE;;;OAGG;IACH,YAAY,CAAC,OAAO,EAAE;QAAE,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAG1E,yGAAyG;IACzG,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IACnD;;;OAGG;IACH,YAAY,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACxD,oCAAoC;IACpC,WAAW,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CACP,cAAc,EAAE,MAAM,EACtB,EAAE,EAAE,MAAM,EACV,OAAO,EAAE;QAAE,KAAK,EAAE,IAAI,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GACrC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,uFAAuF;IACvF,OAAO,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvF,0GAA0G;IAC1G,SAAS,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7D,oFAAoF;IACpF,MAAM,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;IAChE;;;;;;;;;;;;;;OAcG;IACH,UAAU,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,KAAK,EAAE,IAAI,CAAA;KAAE,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;IAC9F,4GAA4G;IAC5G,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;CACvD"}

package/dist/db/interfaces/index.d.ts

@@ -17,6 +17,7 @@ export type { UserProfileAdapter, NewUserProfileData } from './user.js';
 export type { SchemaAdapter } from './schema.js';
 export type { OrganizationAdapter } from './organization.js';
 export type { InstanceAdapter, InstanceSettings } from './instance.js';
+export { BOOTSTRAP_CLAIM_ID } from './instance.js';
 export type { RolesAdapter } from './role.js';
 export type { ReferenceAdapter, BackReferenceRow, BackReferenceLookup } from './reference.js';
 export type { PluginSettingsAdapter, PluginSettingsRow } from './plugin-settings.js';