@aphexcms/cms-core 9.8.1 → 9.10.0

package/dist/components/admin/ActivityView.svelte

@@ -7,25 +7,58 @@
 	import { onMount } from 'svelte';
 	import { Button } from '@aphexcms/ui/shadcn/button';
 	import { Badge } from '@aphexcms/ui/shadcn/badge';
-	import { RefreshCw, CalendarClock, Radio, Sparkles, Undo2, ChevronDown } from '@lucide/svelte';
+	import {
+		RefreshCw,
+		CalendarClock,
+		Radio,
+		Sparkles,
+		Undo2,
+		ChevronDown,
+		RotateCcw,
+		Ban,
+		TriangleAlert
+	} from '@lucide/svelte';
 	import { toast } from 'svelte-sonner';
 	import { apiClient } from '../../api/client';
-	import type { Job, DomainEvent, JobStatus } from '../../types/events';
+	import type { Job, DomainEvent, JobStatus, OutboxHealth } from '../../types/events';
 	import type {
 		AgentChangeSet,
 		AgentChangeSetWithOperations,
 		AgentChangeSetStatus
 	} from '../../types/agent-change-sets';
 
+	type Props = {
+		/**
+		 * May the viewer retry/cancel jobs? `org.settings` — see `requireJobControl` in the
+		 * route. Gating here only hides buttons; the server is what enforces it.
+		 */
+		canControlJobs?: boolean;
+		/** Super admins can widen jobs/events past their active organization (`?scope=all`). */
+		isSuperAdmin?: boolean;
+	};
+	let { canControlJobs = false, isSuperAdmin = false }: Props = $props();
+
 	// The server resolves `createdBy` (a raw user id) to a display name — see
 	// `resolve-created-by.ts`, shared by GET /api/events and GET /api/agent/change-sets.
 	type WithCreatedByName<T> = T & { createdByName: string | null };
+	// …and `organizationId` to an org name, but only in the instance-wide view, where rows
+	// from several tenants share a table. Absent (not null) in the org-scoped view.
+	type WithOrganizationName<T> = T & { organizationName?: string | null };
 
 	type Tab = 'jobs' | 'events' | 'agent';
 	let tab = $state<Tab>('jobs');
 
-	let jobs = $state<Job[]>([]);
-	let events = $state<WithCreatedByName<DomainEvent>[]>([]);
+	/**
+	 * Whose history is on screen. `all` is a super-admin-only widening: the queue is
+	 * instance-wide (one worker claims across every org), so a failure in a tenant you
+	 * aren't currently switched into is otherwise invisible.
+	 */
+	let scope = $state<'organization' | 'all'>('organization');
+
+	let jobs = $state<WithOrganizationName<Job>[]>([]);
+	let events = $state<WithOrganizationName<WithCreatedByName<DomainEvent>>[]>([]);
+	let health = $state<OutboxHealth | null>(null);
+	let actingJobId = $state<string | null>(null);
 	let changeSets = $state<WithCreatedByName<AgentChangeSetWithOperations>[]>([]);
 	let loading = $state(false);
 	let error = $state<string | null>(null);
@@ -89,24 +122,86 @@
 		return Number.isNaN(date.getTime()) ? '—' : date.toLocaleString();
 	}
 
+	/** "3m", "2h", "4d" — coarse on purpose; this is a staleness signal, not a stopwatch. */
+	function age(d: string | Date): string {
+		const ms = Date.now() - new Date(d).getTime();
+		if (ms < 60_000) return `${Math.max(0, Math.round(ms / 1000))}s`;
+		if (ms < 3_600_000) return `${Math.round(ms / 60_000)}m`;
+		if (ms < 86_400_000) return `${Math.round(ms / 3_600_000)}h`;
+		return `${Math.round(ms / 86_400_000)}d`;
+	}
+
+	// A backlog older than this means the relay has stopped, not that it's busy. The
+	// self-hosted worker polls every 5s by default and platform cron runs at most once a
+	// minute, so a minute is the shortest gap that can't be explained by normal cadence.
+	const RELAY_STALE_MS = 60_000;
+
+	/**
+	 * The backlog, pre-chewed into exactly what the banner renders — or null when there's
+	 * nothing to say. Deriving the whole object (rather than a `stalled` flag beside the raw
+	 * `health`) is what lets the markup read `oldestAge` without re-proving that
+	 * `oldestPendingAt` is non-null: `pending > 0` implies a row exists, but only this
+	 * narrowing tells the compiler so.
+	 */
+	const relayBacklog = $derived.by(() => {
+		const oldest = health?.oldestPendingAt;
+		if (!health || health.pending === 0 || !oldest) return null;
+		return {
+			pending: health.pending,
+			oldestAge: age(oldest),
+			stalled: Date.now() - new Date(oldest).getTime() > RELAY_STALE_MS
+		};
+	});
+
+	/**
+	 * A job whose lease has run out but which is still marked `leased` — the worker holding
+	 * it died mid-run. It isn't lost (the next `claimDueJobs` reclaims expired leases), but
+	 * it looks identical to healthy in-flight work without this.
+	 */
+	function leaseExpired(job: Job): boolean {
+		return (
+			job.status === 'leased' && !!job.leaseExpiresAt && new Date(job.leaseExpiresAt) < new Date()
+		);
+	}
+
+	/** Requeue puts a dead letter back with a fresh attempt budget; cancel retires it. */
+	const canRetry = (job: Job) => job.status === 'failed' || job.status === 'cancelled';
+	const canCancel = (job: Job) => job.status === 'pending' || job.status === 'failed';
+
+	/** Only send `scope` when it's actually widened — keeps the default request unchanged. */
+	function scopeParam(): Record<string, string> {
+		return scope === 'all' ? { scope: 'all' } : {};
+	}
+
 	async function load() {
 		loading = true;
 		error = null;
 		try {
 			if (tab === 'jobs') {
-				const params: Record<string, string> = { limit: '100' };
+				const params: Record<string, string> = { limit: '100', ...scopeParam() };
 				if (statusFilter !== 'all') params.status = statusFilter;
-				const res = await apiClient.get<Job[]>('/jobs', params);
+				// Health rides along with the list: it's the context for everything below it,
+				// and a separate refresh button for one number would be its own small trap.
+				const [res, healthRes] = await Promise.all([
+					apiClient.get<WithOrganizationName<Job>[]>('/jobs', params),
+					apiClient.get<OutboxHealth>('/jobs/health', scopeParam())
+				]);
 				if (res.success) {
 					jobs = res.data ?? [];
 					total = res.pagination?.total ?? jobs.length;
 				} else {
 					error = res.error ?? 'Failed to load jobs';
 				}
+				// A failed health read shouldn't blank the page — the list is still useful.
+				health = healthRes.success ? (healthRes.data ?? null) : null;
 			} else if (tab === 'events') {
-				const res = await apiClient.get<WithCreatedByName<DomainEvent>[]>('/events', {
-					limit: '100'
-				});
+				const res = await apiClient.get<WithOrganizationName<WithCreatedByName<DomainEvent>>[]>(
+					'/events',
+					{
+						limit: '100',
+						...scopeParam()
+					}
+				);
 				if (res.success) {
 					events = res.data ?? [];
 					total = res.pagination?.total ?? events.length;
@@ -138,6 +233,34 @@
 		load();
 	}
 
+	/**
+	 * Retry and cancel share everything but the verb and the past-tense confirmation, so they
+	 * share a body. `organizationId` is always sent: in the instance-wide view the job may
+	 * belong to a tenant the caller isn't switched into, and the server needs to be told which
+	 * one (it rejects the mismatch unless you're a super admin).
+	 */
+	async function actOnJob(job: Job, action: 'retry' | 'cancel') {
+		if (actingJobId) return;
+		actingJobId = job.id;
+		try {
+			const res = await apiClient.post<Job>(`/jobs/${job.id}/${action}`, {
+				organizationId: job.organizationId
+			});
+			if (!res.success) {
+				toast.error(res.error ?? `Could not ${action} this job`);
+				return;
+			}
+			toast.success(
+				action === 'retry' ? 'Job requeued — it runs on the next tick.' : 'Job cancelled.'
+			);
+			await load();
+		} catch (err) {
+			toast.error(err instanceof Error ? err.message : `Could not ${action} this job`);
+		} finally {
+			actingJobId = null;
+		}
+	}
+
 	async function toggleExpand(changeSet: AgentChangeSet) {
 		if (expandedChangeSetId === changeSet.id) {
 			expandedChangeSetId = null;
@@ -196,6 +319,13 @@
 		if (tab === 'jobs') load();
 	});
 
+	// Scope applies to jobs and events alike, so this one reloads whichever is showing.
+	$effect(() => {
+		// eslint-disable-next-line @typescript-eslint/no-unused-expressions -- reactive dependency: re-run when scope changes
+		scope;
+		if (tab !== 'agent') load();
+	});
+
 	onMount(load);
 </script>
 
@@ -207,9 +337,32 @@
 				Scheduled jobs, the domain-event log, and the AI assistant's audit trail.
 			</p>
 		</div>
-		<Button variant="outline" size="sm" onclick={load} disabled={loading} class="gap-1.5">
-			<RefreshCw class="h-3.5 w-3.5 {loading ? 'animate-spin' : ''}" /> Refresh
-		</Button>
+		<div class="flex items-center gap-2">
+			{#if isSuperAdmin && tab !== 'agent'}
+				<!-- The queue is instance-wide; this is the only view that can show it that way. -->
+				<div class="border-rule flex items-center rounded-md border p-0.5 text-xs">
+					<button
+						class="rounded px-2 py-1 transition-colors {scope === 'organization'
+							? 'bg-muted text-foreground'
+							: 'text-muted-foreground hover:text-foreground'}"
+						onclick={() => (scope = 'organization')}
+					>
+						This workspace
+					</button>
+					<button
+						class="rounded px-2 py-1 transition-colors {scope === 'all'
+							? 'bg-muted text-foreground'
+							: 'text-muted-foreground hover:text-foreground'}"
+						onclick={() => (scope = 'all')}
+					>
+						All workspaces
+					</button>
+				</div>
+			{/if}
+			<Button variant="outline" size="sm" onclick={load} disabled={loading} class="gap-1.5">
+				<RefreshCw class="h-3.5 w-3.5 {loading ? 'animate-spin' : ''}" /> Refresh
+			</Button>
+		</div>
 	</div>
 
 	<!-- Tabs -->
@@ -244,6 +397,43 @@
 	</div>
 
 	{#if tab === 'jobs'}
+		{#if relayBacklog}
+			<!--
+				The relay backlog. A count on its own is meaningless — a busy instance always has
+				rows in flight — so the age of the oldest is what decides the tone: past a minute,
+				nothing is draining the outbox and every consumer has silently stopped.
+			-->
+			<div
+				class="mb-3 flex items-start gap-2 rounded-md border p-3 text-sm {relayBacklog.stalled
+					? 'border-destructive/40 bg-destructive/10 text-destructive'
+					: 'border-rule text-muted-foreground'}"
+			>
+				{#if relayBacklog.stalled}
+					<TriangleAlert class="mt-0.5 h-4 w-4 shrink-0" />
+				{:else}
+					<Radio class="mt-0.5 h-4 w-4 shrink-0" />
+				{/if}
+				<div>
+					{#if relayBacklog.stalled}
+						<p class="font-medium">
+							The relay looks stopped — {relayBacklog.pending} event{relayBacklog.pending === 1
+								? ''
+								: 's'} waiting, oldest {relayBacklog.oldestAge} old.
+						</p>
+						<p class="mt-0.5 text-xs">
+							Nothing is reacting to events: scheduled publishes, erasure and plugin consumers are
+							all paused until a worker calls <code>POST /api/internal/workers/run</code> again.
+						</p>
+					{:else}
+						<p>
+							{relayBacklog.pending} event{relayBacklog.pending === 1 ? '' : 's'} waiting to fan out,
+							oldest {relayBacklog.oldestAge} old — the relay is keeping up.
+						</p>
+					{/if}
+				</div>
+			</div>
+		{/if}
+
 		<div class="mb-3 flex flex-wrap items-center gap-1.5">
 			{#each statuses as s (s)}
 				<button
@@ -276,19 +466,42 @@
 					<thead class="bg-muted/50 text-muted-foreground text-xs">
 						<tr>
 							<th class="px-3 py-2 text-left font-medium">Type</th>
+							{#if scope === 'all'}
+								<th class="px-3 py-2 text-left font-medium">Workspace</th>
+							{/if}
 							<th class="px-3 py-2 text-left font-medium">Status</th>
 							<th class="px-3 py-2 text-left font-medium">Run at</th>
 							<th class="px-3 py-2 text-left font-medium">Attempts</th>
 							<th class="px-3 py-2 text-left font-medium">Last error</th>
 							<th class="px-3 py-2 text-left font-medium">Created</th>
+							{#if canControlJobs}
+								<th class="px-3 py-2 text-right font-medium">Actions</th>
+							{/if}
 						</tr>
 					</thead>
 					<tbody>
 						{#each jobs as job (job.id)}
 							<tr class="border-rule border-t">
 								<td class="px-3 py-2 font-mono text-xs">{job.type}</td>
-								<td class="px-3 py-2">
+								{#if scope === 'all'}
+									<td class="text-muted-foreground px-3 py-2 text-xs">
+										{job.organizationName ?? job.organizationId}
+									</td>
+								{/if}
+								<td class="px-3 py-2 whitespace-nowrap">
 									<Badge variant={statusVariant[job.status]} class="capitalize">{job.status}</Badge>
+									{#if leaseExpired(job)}
+										<!-- Still `leased` past its expiry: the worker that held it died. The next
+										     claim reclaims it, so this is a diagnosis, not an action item. -->
+										<span
+											class="text-destructive ml-1.5 text-xs"
+											title="Lease expired {age(
+												job.leaseExpiresAt ?? new Date()
+											)} ago — the worker holding this job stopped. It will be reclaimed on the next tick."
+										>
+											stalled
+										</span>
+									{/if}
 								</td>
 								<td class="px-3 py-2 whitespace-nowrap">{fmt(job.runAt)}</td>
 								<td class="px-3 py-2">{job.attempts}/{job.maxAttempts}</td>
@@ -301,6 +514,35 @@
 								<td class="text-muted-foreground px-3 py-2 whitespace-nowrap"
 									>{fmt(job.createdAt)}</td
 								>
+								{#if canControlJobs}
+									<td class="px-3 py-2 text-right whitespace-nowrap">
+										{#if canRetry(job)}
+											<Button
+												variant="ghost"
+												size="sm"
+												class="h-7 gap-1 px-2 text-xs"
+												disabled={actingJobId !== null}
+												onclick={() => actOnJob(job, 'retry')}
+											>
+												<RotateCcw class="h-3 w-3" /> Retry
+											</Button>
+										{/if}
+										{#if canCancel(job)}
+											<Button
+												variant="ghost"
+												size="sm"
+												class="text-muted-foreground h-7 gap-1 px-2 text-xs"
+												disabled={actingJobId !== null}
+												onclick={() => actOnJob(job, 'cancel')}
+											>
+												<Ban class="h-3 w-3" /> Cancel
+											</Button>
+										{/if}
+										{#if !canRetry(job) && !canCancel(job)}
+											<span class="text-muted-foreground text-xs">—</span>
+										{/if}
+									</td>
+								{/if}
 							</tr>
 						{/each}
 					</tbody>
@@ -317,6 +559,9 @@
 					<thead class="bg-muted/50 text-muted-foreground text-xs">
 						<tr>
 							<th class="px-3 py-2 text-left font-medium">Type</th>
+							{#if scope === 'all'}
+								<th class="px-3 py-2 text-left font-medium">Workspace</th>
+							{/if}
 							<th class="px-3 py-2 text-left font-medium">Payload</th>
 							<th class="px-3 py-2 text-left font-medium">By</th>
 							<th class="px-3 py-2 text-left font-medium">When</th>
@@ -326,6 +571,11 @@
 						{#each events as event (event.id)}
 							<tr class="border-rule border-t">
 								<td class="px-3 py-2 font-mono text-xs">{event.type}</td>
+								{#if scope === 'all'}
+									<td class="text-muted-foreground px-3 py-2 text-xs">
+										{event.organizationName ?? event.organizationId}
+									</td>
+								{/if}
 								<td
 									class="text-muted-foreground max-w-[320px] truncate px-3 py-2 font-mono text-xs"
 									title={JSON.stringify(event.payload)}

package/dist/components/admin/ActivityView.svelte.d.ts

@@ -1,4 +1,13 @@
-declare const ActivityView: import("svelte").Component<Record<string, never>, {}, "">;
+type Props = {
+    /**
+     * May the viewer retry/cancel jobs? `org.settings` — see `requireJobControl` in the
+     * route. Gating here only hides buttons; the server is what enforces it.
+     */
+    canControlJobs?: boolean;
+    /** Super admins can widen jobs/events past their active organization (`?scope=all`). */
+    isSuperAdmin?: boolean;
+};
+declare const ActivityView: import("svelte").Component<Props, {}, "">;
 type ActivityView = ReturnType<typeof ActivityView>;
 export default ActivityView;
 //# sourceMappingURL=ActivityView.svelte.d.ts.map

package/dist/components/admin/ActivityView.svelte.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ActivityView.svelte.d.ts","sourceRoot":"","sources":["../../../src/lib/components/admin/ActivityView.svelte.ts"],"names":[],"mappings":"AAoZA,QAAA,MAAM,YAAY,2DAAwC,CAAC;AAC3D,KAAK,YAAY,GAAG,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC;AACpD,eAAe,YAAY,CAAC"}
+{"version":3,"file":"ActivityView.svelte.d.ts","sourceRoot":"","sources":["../../../src/lib/components/admin/ActivityView.svelte.ts"],"names":[],"mappings":"AAgCC,KAAK,KAAK,GAAG;IACZ;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,wFAAwF;IACxF,YAAY,CAAC,EAAE,OAAO,CAAC;CACvB,CAAC;AA8kBH,QAAA,MAAM,YAAY,2CAAwC,CAAC;AAC3D,KAAK,YAAY,GAAG,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC;AACpD,eAAe,YAAY,CAAC"}

package/dist/db/interfaces/document.d.ts

@@ -52,6 +52,15 @@ export interface DocumentAdapter {
      */
     updateDocDraft(organizationId: string, id: string, data: any, updatedBy?: string, expectedRevision?: number): Promise<Document | null>;
     deleteDocById(organizationId: string, id: string): Promise<boolean>;
+    /**
+     * Recompute the document's precomputed full-text search index (`search_text`
+     * column, and on SQLite the FTS5 shadow table row) from caller-supplied text.
+     * Called by `CollectionAPI` as a best-effort step after `createDocument`/
+     * `updateDocDraft` succeeds — same shape as reference-index sync: not folded
+     * into the write transaction, self-healing on the next edit if it's missed.
+     * Optional so adapters without full-text search aren't broken.
+     */
+    updateSearchText?(organizationId: string, id: string, searchText: string): Promise<void>;
     publishDoc(organizationId: string, id: string, expectedRevision?: number): Promise<Document | null>;
     unpublishDoc(organizationId: string, id: string, expectedRevision?: number): Promise<Document | null>;
     countDocsByType(organizationId: string, type: string): Promise<number>;

package/dist/db/interfaces/document.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"document.d.ts","sourceRoot":"","sources":["../../../src/lib/db/interfaces/document.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,KAAK,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAChF,OAAO,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAE1E,MAAM,WAAW,eAAe;IAC/B,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;CACjC;AAED,MAAM,WAAW,kBAAkB;IAClC,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,GAAG,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mEAAmE;IACnE,EAAE,CAAC,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,kBAAkB;IAClC,SAAS,CAAC,EAAE,GAAG,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;6DACyD;IACzD,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;aAG9B,UAAU,EAAE,MAAM;aAClB,gBAAgB,EAAE,MAAM;aACxB,eAAe,EAAE,MAAM;gBAHvC,OAAO,EAAE,MAAM,EACC,UAAU,EAAE,MAAM,EAClB,gBAAgB,EAAE,MAAM,EACxB,eAAe,EAAE,MAAM;CAKxC;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAE/B,cAAc,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5D;;;;;OAKG;IACH,cAAc,CACb,cAAc,EAAE,MAAM,EACtB,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,GAAG,EACT,SAAS,CAAC,EAAE,MAAM,EAClB,gBAAgB,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAC5B,aAAa,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAGpE,UAAU,CACT,cAAc,EAAE,MAAM,EACtB,EAAE,EAAE,MAAM,EACV,gBAAgB,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAC5B,YAAY,CACX,cAAc,EAAE,MAAM,EACtB,EAAE,EAAE,MAAM,EACV,gBAAgB,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAG5B,eAAe,CAAC,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACvE,kBAAkB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAG5E;;;;;;OAMG;IACH,mBAAmB,CAClB,cAAc,EAAE,MAAM,EACtB,cAAc,EAAE,MAAM,EACtB,OAAO,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEjC;;;;;;OAMG;IACH,mBAAmB,CAClB,cAAc,EAAE,MAAM,EACtB,EAAE,EAAE,MAAM,EACV,OAAO,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,GAC5B,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAE5B;;;;;;OAMG;IACH,cAAc,CAAC,cAAc,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAE/F;;;;;;OAMG;IACH,6BAA6B,CAAC,CAC7B,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,MAAM,EACf,UAAU,CAAC,EAAE,MAAM,EAAE,GACnB,OAAO,CAAC,KAAK,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC,CAAC;IAE9F;;;;;;OAMG;IACH,gCAAgC,CAAC,CAChC,cAAc,EAAE,MAAM,EACtB,QAAQ,EAAE,MAAM,EAAE,EAClB,UAAU,CAAC,EAAE,MAAM,EAAE,GACnB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAEnC;;;OAGG;IACH,2BAA2B,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAGvF,qBAAqB,CAAC,CAAC,IAAI,EAAE;QAC5B,UAAU,EAAE,MAAM,CAAC;QACnB,cAAc,EAAE,MAAM,CAAC;QACvB,SAAS,EAAE,OAAO,GAAG,SAAS,CAAC;QAC/B,IAAI,EAAE,GAAG,CAAC;QACV,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC1B,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;IAEpC,oBAAoB,CAAC,CACpB,cAAc,EAAE,MAAM,EACtB,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAC3C,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAEhC,kBAAkB,CAAC,CAClB,cAAc,EAAE,MAAM,EACtB,UAAU,EAAE,MAAM,EAClB,aAAa,EAAE,MAAM,GACnB,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;IAEnC,sBAAsB,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjF"}
+{"version":3,"file":"document.d.ts","sourceRoot":"","sources":["../../../src/lib/db/interfaces/document.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,KAAK,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAChF,OAAO,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAE1E,MAAM,WAAW,eAAe;IAC/B,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;CACjC;AAED,MAAM,WAAW,kBAAkB;IAClC,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,GAAG,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mEAAmE;IACnE,EAAE,CAAC,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,kBAAkB;IAClC,SAAS,CAAC,EAAE,GAAG,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;6DACyD;IACzD,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;aAG9B,UAAU,EAAE,MAAM;aAClB,gBAAgB,EAAE,MAAM;aACxB,eAAe,EAAE,MAAM;gBAHvC,OAAO,EAAE,MAAM,EACC,UAAU,EAAE,MAAM,EAClB,gBAAgB,EAAE,MAAM,EACxB,eAAe,EAAE,MAAM;CAKxC;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAE/B,cAAc,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5D;;;;;OAKG;IACH,cAAc,CACb,cAAc,EAAE,MAAM,EACtB,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,GAAG,EACT,SAAS,CAAC,EAAE,MAAM,EAClB,gBAAgB,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAC5B,aAAa,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEpE;;;;;;;OAOG;IACH,gBAAgB,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAGzF,UAAU,CACT,cAAc,EAAE,MAAM,EACtB,EAAE,EAAE,MAAM,EACV,gBAAgB,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAC5B,YAAY,CACX,cAAc,EAAE,MAAM,EACtB,EAAE,EAAE,MAAM,EACV,gBAAgB,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAG5B,eAAe,CAAC,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACvE,kBAAkB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAG5E;;;;;;OAMG;IACH,mBAAmB,CAClB,cAAc,EAAE,MAAM,EACtB,cAAc,EAAE,MAAM,EACtB,OAAO,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEjC;;;;;;OAMG;IACH,mBAAmB,CAClB,cAAc,EAAE,MAAM,EACtB,EAAE,EAAE,MAAM,EACV,OAAO,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,GAC5B,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAE5B;;;;;;OAMG;IACH,cAAc,CAAC,cAAc,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAE/F;;;;;;OAMG;IACH,6BAA6B,CAAC,CAC7B,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,MAAM,EACf,UAAU,CAAC,EAAE,MAAM,EAAE,GACnB,OAAO,CAAC,KAAK,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC,CAAC;IAE9F;;;;;;OAMG;IACH,gCAAgC,CAAC,CAChC,cAAc,EAAE,MAAM,EACtB,QAAQ,EAAE,MAAM,EAAE,EAClB,UAAU,CAAC,EAAE,MAAM,EAAE,GACnB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAEnC;;;OAGG;IACH,2BAA2B,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAGvF,qBAAqB,CAAC,CAAC,IAAI,EAAE;QAC5B,UAAU,EAAE,MAAM,CAAC;QACnB,cAAc,EAAE,MAAM,CAAC;QACvB,SAAS,EAAE,OAAO,GAAG,SAAS,CAAC;QAC/B,IAAI,EAAE,GAAG,CAAC;QACV,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC1B,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;IAEpC,oBAAoB,CAAC,CACpB,cAAc,EAAE,MAAM,EACtB,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAC3C,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAEhC,kBAAkB,CAAC,CAClB,cAAc,EAAE,MAAM,EACtB,UAAU,EAAE,MAAM,EAClB,aAAa,EAAE,MAAM,GACnB,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;IAEnC,sBAAsB,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjF"}

package/dist/db/interfaces/events.d.ts

@@ -1,4 +1,4 @@
-import type { DomainEvent, AppendEventInput, Job, ScheduleJobInput, ClaimJobsOptions, ListEventsOptions, ListJobsOptions, OutboxRow, ListUnprocessedOutboxOptions, Page } from '../../types/events.js';
+import type { DomainEvent, AppendEventInput, Job, ScheduleJobInput, ClaimJobsOptions, ListEventsOptions, ListJobsOptions, OutboxRow, ListUnprocessedOutboxOptions, OutboxHealth, Page } from '../../types/events.js';
 /**
  * The durable spine: an append-only domain-event log plus a DB-backed job queue.
  * All rows are organization-scoped. (The event-log read API — `listEvents` — lands
@@ -25,6 +25,13 @@ export interface EventJobAdapter {
     listUnprocessedOutbox(options: ListUnprocessedOutboxOptions): Promise<OutboxRow[]>;
     /** Stamp `processedAt` once an outbox row has been fanned out to every subscriber. */
     markOutboxProcessed(organizationId: string, id: string): Promise<void>;
+    /**
+     * Size and age of the unprocessed backlog — the "is the relay running?" signal.
+     * Omit `organizationId` for the instance-wide figure. See {@link OutboxHealth}.
+     */
+    outboxHealth(options: {
+        organizationId?: string;
+    }): Promise<OutboxHealth>;
     /** Schedule a job. Idempotent when `idempotencyKey` is set: a duplicate key returns the existing job. */
     scheduleJob(input: ScheduleJobInput): Promise<Job>;
     /**
@@ -49,7 +56,27 @@ export interface EventJobAdapter {
     }): Promise<void>;
     /** Cancel a job (e.g. a scheduled publish the user called off): status → `cancelled`, clear the lease. */
     cancelJob(organizationId: string, id: string): Promise<void>;
-    /** List jobs for the org, newest first (read-only history / observability). */
+    /** Read a single job by id (org-scoped). Null when it doesn't exist in that org. */
+    getJob(organizationId: string, id: string): Promise<Job | null>;
+    /**
+     * Put a finished job back on the queue by hand — the operator's undo for a dead letter.
+     *
+     * Distinct from `retryJob`, which is the *runner's* backoff transition and deliberately
+     * leaves `attempts` alone. A dead-lettered job sits at `attempts === maxAttempts`, so
+     * reusing `retryJob` would hand it back to the runner only for the next claim to exhaust
+     * it again immediately. This resets the attempt counter and clears `lastError`, giving
+     * the job a fresh budget once whatever broke has been fixed.
+     *
+     * Guarded to `failed` and `cancelled` in SQL: requeueing a `pending` job is pointless and
+     * requeueing a `leased` one would race the worker currently holding it, whose settle would
+     * then overwrite the status. Returns the updated job, or null when the id doesn't exist in
+     * the org or wasn't in a requeueable state — so callers can tell "gone" from "not allowed"
+     * with a follow-up `getJob`.
+     */
+    requeueJob(organizationId: string, id: string, options: {
+        runAt: Date;
+    }): Promise<Job | null>;
+    /** List jobs, newest first (read-only history / observability). Omit `organizationId` for instance-wide. */
     listJobs(options: ListJobsOptions): Promise<Page<Job>>;
 }
 //# sourceMappingURL=events.d.ts.map

package/dist/db/interfaces/events.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../../../src/lib/db/interfaces/events.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACX,WAAW,EACX,gBAAgB,EAChB,GAAG,EACH,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,SAAS,EACT,4BAA4B,EAC5B,IAAI,EACJ,MAAM,oBAAoB,CAAC;AAE5B;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAE/B;;;;;;OAMG;IACH,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAC3D,8CAA8C;IAC9C,QAAQ,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAC1E,wFAAwF;IACxF,UAAU,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IAGnE;;;;OAIG;IACH,qBAAqB,CAAC,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IACnF,sFAAsF;IACtF,mBAAmB,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAGvE,yGAAyG;IACzG,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IACnD;;;OAGG;IACH,YAAY,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACxD,oCAAoC;IACpC,WAAW,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CACP,cAAc,EAAE,MAAM,EACtB,EAAE,EAAE,MAAM,EACV,OAAO,EAAE;QAAE,KAAK,EAAE,IAAI,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GACrC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,uFAAuF;IACvF,OAAO,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvF,0GAA0G;IAC1G,SAAS,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7D,+EAA+E;IAC/E,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;CACvD"}
+{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../../../src/lib/db/interfaces/events.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACX,WAAW,EACX,gBAAgB,EAChB,GAAG,EACH,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,SAAS,EACT,4BAA4B,EAC5B,YAAY,EACZ,IAAI,EACJ,MAAM,oBAAoB,CAAC;AAE5B;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAE/B;;;;;;OAMG;IACH,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAC3D,8CAA8C;IAC9C,QAAQ,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAC1E,wFAAwF;IACxF,UAAU,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IAGnE;;;;OAIG;IACH,qBAAqB,CAAC,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IACnF,sFAAsF;IACtF,mBAAmB,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvE;;;OAGG;IACH,YAAY,CAAC,OAAO,EAAE;QAAE,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAG1E,yGAAyG;IACzG,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IACnD;;;OAGG;IACH,YAAY,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACxD,oCAAoC;IACpC,WAAW,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CACP,cAAc,EAAE,MAAM,EACtB,EAAE,EAAE,MAAM,EACV,OAAO,EAAE;QAAE,KAAK,EAAE,IAAI,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GACrC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,uFAAuF;IACvF,OAAO,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvF,0GAA0G;IAC1G,SAAS,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7D,oFAAoF;IACpF,MAAM,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;IAChE;;;;;;;;;;;;;;OAcG;IACH,UAAU,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,KAAK,EAAE,IAAI,CAAA;KAAE,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;IAC9F,4GAA4G;IAC5G,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;CACvD"}

package/dist/db/interfaces/index.d.ts

@@ -17,6 +17,7 @@ export type { UserProfileAdapter, NewUserProfileData } from './user.js';
 export type { SchemaAdapter } from './schema.js';
 export type { OrganizationAdapter } from './organization.js';
 export type { InstanceAdapter, InstanceSettings } from './instance.js';
+export { BOOTSTRAP_CLAIM_ID } from './instance.js';
 export type { RolesAdapter } from './role.js';
 export type { ReferenceAdapter, BackReferenceRow, BackReferenceLookup } from './reference.js';
 export type { PluginSettingsAdapter, PluginSettingsRow } from './plugin-settings.js';

package/dist/db/interfaces/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/db/interfaces/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,QAAQ,CAAC;AACjD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAC3C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAChD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAGjE,YAAY,EACX,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,kBAAkB,EAClB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC9E,YAAY,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,QAAQ,CAAC;AACrE,YAAY,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAC9C,YAAY,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACpE,YAAY,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAC3C,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAC3F,YAAY,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAClF,YAAY,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAChD,YAAY,EACX,oBAAoB,EACpB,mBAAmB,EACnB,uBAAuB,EACvB,wBAAwB,EACxB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAEjE;;;GAGG;AACH,MAAM,WAAW,eAChB,SACC,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,aAAa,EACb,mBAAmB,EACnB,eAAe,EACf,YAAY,EACZ,gBAAgB,EAChB,qBAAqB,EACrB,eAAe,EACf,oBAAoB,EACpB,qBAAqB;IAEtB,OAAO,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,UAAU,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAG7B,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAG9B;;OAEG;IACH,aAAa,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,gBAAgB,EAAE,OAAO,CAAC;IAE1B;;;OAGG;IACH,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAE7E;;OAEG;IACH,qBAAqB,CAAC,oBAAoB,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAEvE;;OAEG;IACH,kBAAkB,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAExC;;;;;;;;OAQG;IACH,eAAe,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,eAAe,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAC7E;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,IAAI,eAAe,CAAC;CACjC;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC9B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,GAAG,CAAC;IACb,OAAO,CAAC,EAAE;QACT,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,GAAG,CAAC,EAAE,OAAO,CAAC;QACd,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;KACnB,CAAC;CACF;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IACnC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,QAAQ,IAAI,OAAO,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,4BAA6B,SAAQ,eAAe;IACpE,gBAAgB,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACjD,eAAe,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,eAAe,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAC7E"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/db/interfaces/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,QAAQ,CAAC;AACjD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAC3C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAChD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAGjE,YAAY,EACX,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,kBAAkB,EAClB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC9E,YAAY,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,QAAQ,CAAC;AACrE,YAAY,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAC9C,YAAY,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAChD,YAAY,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAC3C,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAC3F,YAAY,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAClF,YAAY,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAChD,YAAY,EACX,oBAAoB,EACpB,mBAAmB,EACnB,uBAAuB,EACvB,wBAAwB,EACxB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAEjE;;;GAGG;AACH,MAAM,WAAW,eAChB,SACC,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,aAAa,EACb,mBAAmB,EACnB,eAAe,EACf,YAAY,EACZ,gBAAgB,EAChB,qBAAqB,EACrB,eAAe,EACf,oBAAoB,EACpB,qBAAqB;IAEtB,OAAO,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,UAAU,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAG7B,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAG9B;;OAEG;IACH,aAAa,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,gBAAgB,EAAE,OAAO,CAAC;IAE1B;;;OAGG;IACH,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAE7E;;OAEG;IACH,qBAAqB,CAAC,oBAAoB,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAEvE;;OAEG;IACH,kBAAkB,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAExC;;;;;;;;OAQG;IACH,eAAe,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,eAAe,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAC7E;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,IAAI,eAAe,CAAC;CACjC;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC9B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,GAAG,CAAC;IACb,OAAO,CAAC,EAAE;QACT,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,GAAG,CAAC,EAAE,OAAO,CAAC;QACd,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;KACnB,CAAC;CACF;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IACnC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,QAAQ,IAAI,OAAO,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,4BAA6B,SAAQ,eAAe;IACpE,gBAAgB,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACjD,eAAe,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,eAAe,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAC7E"}

package/dist/db/interfaces/index.js

@@ -1 +1,2 @@
 export { RevisionConflictError } from './document.js';
+export { BOOTSTRAP_CLAIM_ID } from './instance.js';

package/dist/db/interfaces/instance.d.ts

@@ -1,7 +1,36 @@
 import type { InstanceSettings } from '../../types/instance.js';
 export type { InstanceSettings };
+/**
+ * Row id holding the one-time bootstrap claim.
+ *
+ * Deliberately not `'default'` — `get`/`updateInstanceSettings` are scoped to
+ * that row, so this one is invisible to them and can't be cleared by an ordinary
+ * settings write.
+ */
+export declare const BOOTSTRAP_CLAIM_ID = "aphex:bootstrap-claim";
 export interface InstanceAdapter {
     getInstanceSettings(): Promise<InstanceSettings>;
     updateInstanceSettings(settings: Partial<InstanceSettings>): Promise<InstanceSettings>;
+    /**
+     * Atomically claim the one-time bootstrap promotion. `true` means this caller
+     * won and may grant an instance role; `false` means somebody else already did.
+     *
+     * Exists because "is the instance empty?" and "insert the first profile" were
+     * two statements with a gap between them: two sign-ups arriving together could
+     * both observe an empty instance and both be promoted to super admin. Every
+     * bootstrap policy gates on `isFirstUser`, so at most one promotion is
+     * intended in all of them — this makes that atomic rather than likely.
+     *
+     * Implemented as an insert of a dedicated row that conflicts with itself, so
+     * the database decides the winner in a single statement. That matters more
+     * than it sounds: the obvious fix — wrapping the check and the insert in one
+     * transaction — holds SQLite's single write lock across the auth provider's
+     * own concurrent user and session inserts and fails sign-up with SQLITE_BUSY.
+     *
+     * Optional: an adapter that doesn't implement it keeps the old non-atomic
+     * behaviour (with a warning) rather than refusing to ever promote anyone,
+     * which would leave a fresh install with no way to get its first administrator.
+     */
+    tryClaimBootstrap?(): Promise<boolean>;
 }
 //# sourceMappingURL=instance.d.ts.map

package/dist/db/interfaces/instance.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"instance.d.ts","sourceRoot":"","sources":["../../../src/lib/db/interfaces/instance.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAE7D,YAAY,EAAE,gBAAgB,EAAE,CAAC;AAEjC,MAAM,WAAW,eAAe;IAC/B,mBAAmB,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACjD,sBAAsB,CAAC,QAAQ,EAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;CACvF"}
+{"version":3,"file":"instance.d.ts","sourceRoot":"","sources":["../../../src/lib/db/interfaces/instance.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAE7D,YAAY,EAAE,gBAAgB,EAAE,CAAC;AAEjC;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,0BAA0B,CAAC;AAE1D,MAAM,WAAW,eAAe;IAC/B,mBAAmB,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACjD,sBAAsB,CAAC,QAAQ,EAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAEvF;;;;;;;;;;;;;;;;;;;OAmBG;IACH,iBAAiB,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;CACvC"}

package/dist/db/interfaces/instance.js

@@ -1 +1,8 @@
-export {};
+/**
+ * Row id holding the one-time bootstrap claim.
+ *
+ * Deliberately not `'default'` — `get`/`updateInstanceSettings` are scoped to
+ * that row, so this one is invisible to them and can't be cleared by an ordinary
+ * settings write.
+ */
+export const BOOTSTRAP_CLAIM_ID = 'aphex:bootstrap-claim';

package/dist/events/built-in-consumers.d.ts

@@ -0,0 +1,20 @@
+import type { EventConsumerPart } from '../plugins/types.js';
+/**
+ * Erase a deleted user's avatar — the file, not just the row.
+ *
+ * Account deletion removes the user record, and with it the only pointer to the avatar
+ * asset. Without this the image survives in object storage indefinitely, reachable by
+ * anyone holding its URL and invisible to the media browser (avatars are marked
+ * `system`), so nothing would ever surface it for cleanup. That is precisely the
+ * "personal data with no way left to find or erase it" case a right-to-erasure request
+ * has to be able to answer.
+ *
+ * Idempotent, as every consumer must be: a missing asset is a completed erasure, so a
+ * redelivery finds nothing and succeeds. It throws only when the delete itself fails, so
+ * a transient storage outage retries with backoff instead of silently giving up — the
+ * one outcome that would leave the data behind while reporting success.
+ */
+export declare const eraseUserAvatarConsumer: EventConsumerPart;
+/** Every consumer core ships. Seeded into the part resolver ahead of plugin parts. */
+export declare const BUILT_IN_EVENT_CONSUMERS: readonly EventConsumerPart[];
+//# sourceMappingURL=built-in-consumers.d.ts.map

package/dist/events/built-in-consumers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"built-in-consumers.d.ts","sourceRoot":"","sources":["../../src/lib/events/built-in-consumers.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAQ1D;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,uBAAuB,EAAE,iBAoCrC,CAAC;AAEF,sFAAsF;AACtF,eAAO,MAAM,wBAAwB,EAAE,SAAS,iBAAiB,EAA8B,CAAC"}