@aphexcms/cms-core 9.8.1 → 9.9.0

package/dist/lib/auth/invitation-status.d.ts

@@ -0,0 +1,25 @@
+import type { Invitation } from '../types/organization.js';
+/** The minimum shape these predicates need — so callers can pass rows from any layer. */
+export type InvitationState = Pick<Invitation, 'expiresAt' | 'acceptedAt'>;
+/** Default lifetime for a new invitation. */
+export declare const INVITATION_TTL_MS: number;
+/** When a freshly-created invitation should expire. */
+export declare function invitationExpiryFrom(now?: Date): Date;
+export declare function isAccepted(invitation: InvitationState): boolean;
+export declare function isExpired(invitation: InvitationState, now?: Date): boolean;
+/**
+ * Redeemable right now: not yet accepted and not yet expired.
+ *
+ * The only question worth asking in most places — whether a sign-up may proceed,
+ * whether to show it in the members list, whether a re-invite is redundant.
+ */
+export declare function isPendingInvitation(invitation: InvitationState, now?: Date): boolean;
+/**
+ * Lapsed without being used, so it is safe to clear and replace.
+ *
+ * Deliberately distinct from `!isPendingInvitation(...)`: an *accepted*
+ * invitation is also "not pending", but deleting it would erase the record that
+ * someone joined by invitation.
+ */
+export declare function isStaleInvitation(invitation: InvitationState, now?: Date): boolean;
+//# sourceMappingURL=invitation-status.d.ts.map

package/dist/lib/auth/invitation-status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invitation-status.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/invitation-status.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAExD,yFAAyF;AACzF,MAAM,MAAM,eAAe,GAAG,IAAI,CAAC,UAAU,EAAE,WAAW,GAAG,YAAY,CAAC,CAAC;AAE3E,6CAA6C;AAC7C,eAAO,MAAM,iBAAiB,QAA0B,CAAC;AAEzD,uDAAuD;AACvD,wBAAgB,oBAAoB,CAAC,GAAG,GAAE,IAAiB,GAAG,IAAI,CAEjE;AAED,wBAAgB,UAAU,CAAC,UAAU,EAAE,eAAe,GAAG,OAAO,CAE/D;AAED,wBAAgB,SAAS,CAAC,UAAU,EAAE,eAAe,EAAE,GAAG,GAAE,IAAiB,GAAG,OAAO,CAEtF;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,eAAe,EAAE,GAAG,GAAE,IAAiB,GAAG,OAAO,CAEhG;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,eAAe,EAAE,GAAG,GAAE,IAAiB,GAAG,OAAO,CAE9F"}

package/dist/lib/auth/invitation-status.js

@@ -0,0 +1,42 @@
+// The single definition of what an invitation's state means.
+//
+// This exists because three call sites independently decided what "pending"
+// meant and two of them drifted: the sign-up gate required unaccepted *and*
+// unexpired, the members list did the same, but the re-invite check tested only
+// `acceptedAt === null`. An expired invitation therefore blocked re-inviting
+// while being unusable and invisible — a permanent deadlock for that address.
+//
+// Anything that asks a question about invitation state imports from here. If a
+// rule changes (grace periods, revocation, resend windows), it changes once.
+/** Default lifetime for a new invitation. */
+export const INVITATION_TTL_MS = 7 * 24 * 60 * 60 * 1000;
+/** When a freshly-created invitation should expire. */
+export function invitationExpiryFrom(now = new Date()) {
+    return new Date(now.getTime() + INVITATION_TTL_MS);
+}
+export function isAccepted(invitation) {
+    return invitation.acceptedAt !== null;
+}
+export function isExpired(invitation, now = new Date()) {
+    return new Date(invitation.expiresAt).getTime() <= now.getTime();
+}
+/**
+ * Redeemable right now: not yet accepted and not yet expired.
+ *
+ * The only question worth asking in most places — whether a sign-up may proceed,
+ * whether to show it in the members list, whether a re-invite is redundant.
+ */
+export function isPendingInvitation(invitation, now = new Date()) {
+    return !isAccepted(invitation) && !isExpired(invitation, now);
+}
+/**
+ * Lapsed without being used, so it is safe to clear and replace.
+ *
+ * Deliberately distinct from `!isPendingInvitation(...)`: an *accepted*
+ * invitation is also "not pending", but deleting it would erase the record that
+ * someone joined by invitation.
+ */
+export function isStaleInvitation(invitation, now = new Date()) {
+    return !isAccepted(invitation) && isExpired(invitation, now);
+}
+//# sourceMappingURL=invitation-status.js.map

package/dist/lib/auth/invitation-status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invitation-status.js","sourceRoot":"","sources":["../../../src/lib/auth/invitation-status.ts"],"names":[],"mappings":"AAAA,6DAA6D;AAC7D,EAAE;AACF,4EAA4E;AAC5E,4EAA4E;AAC5E,gFAAgF;AAChF,6EAA6E;AAC7E,8EAA8E;AAC9E,EAAE;AACF,+EAA+E;AAC/E,6EAA6E;AAO7E,6CAA6C;AAC7C,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEzD,uDAAuD;AACvD,MAAM,UAAU,oBAAoB,CAAC,MAAY,IAAI,IAAI,EAAE;IAC1D,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,iBAAiB,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,UAA2B;IACrD,OAAO,UAAU,CAAC,UAAU,KAAK,IAAI,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,UAA2B,EAAE,MAAY,IAAI,IAAI,EAAE;IAC5E,OAAO,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;AAClE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,UAA2B,EAAE,MAAY,IAAI,IAAI,EAAE;IACtF,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAA2B,EAAE,MAAY,IAAI,IAAI,EAAE;IACpF,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;AAC9D,CAAC"}

package/dist/lib/auth/sign-up-policy.d.ts

@@ -0,0 +1,62 @@
+import type { BootstrapPolicy, InstanceRole } from './bootstrap.js';
+import type { DatabaseAdapter } from '../db/interfaces/index.js';
+import type { UserProfile } from '../types/index.js';
+/**
+ * Thrown when sign-up is refused by policy.
+ *
+ * Providers translate this into whatever their transport expects — Better Auth
+ * raises an `APIError`, a REST handler might return 403. The message is written
+ * to be safe to show a user.
+ */
+export declare class SignUpBlockedError extends Error {
+    readonly code = "SIGN_UP_BLOCKED";
+    constructor(message: string);
+}
+export interface SignUpGateOptions {
+    db: DatabaseAdapter;
+    /** Address attempting to register. Matched case-insensitively. */
+    email: string | undefined;
+    /** When false the gate is disabled entirely and this is a no-op. */
+    inviteOnly: boolean;
+}
+/**
+ * Throws `SignUpBlockedError` unless this address may create an account.
+ *
+ * Two ways through: the instance is provably empty (nobody exists yet to have
+ * sent an invitation, so gating the first sign-up would lock the door with the
+ * keys inside), or the address holds a pending invitation.
+ *
+ * Narrowing that first exception is the bootstrap policy's job — see
+ * `resolveBootstrapRole` — not this gate's.
+ */
+export declare function assertSignUpAllowed({ db, email, inviteOnly }: SignUpGateOptions): Promise<void>;
+export interface BootstrapRoleOptions {
+    db: DatabaseAdapter;
+    user: {
+        id: string;
+        email: string;
+        emailVerified: boolean;
+    };
+    /** The request that triggered profile creation, when there is one. */
+    request?: Request;
+    bootstrap: BootstrapPolicy;
+}
+/**
+ * Runs the bootstrap policy for a brand-new user, returning the instance role to
+ * grant or `null` for none.
+ *
+ * Deliberately not wrapped in a transaction. SQLite allows a single writer, and
+ * holding that lock across the policy's own round-trips collides with the auth
+ * provider's concurrent user/session inserts (SQLITE_BUSY). The atomicity was
+ * only partial anyway — see `claimCode`: a claim is single-use, not mutually
+ * exclusive.
+ */
+export declare function resolveBootstrapRole({ db, user, request, bootstrap }: BootstrapRoleOptions): Promise<InstanceRole | null>;
+/**
+ * The one place a CMS user profile is created for a newly-authenticated user.
+ *
+ * Every `AuthProvider` should route new profiles through here so bootstrap
+ * promotion happens identically regardless of who did the authenticating.
+ */
+export declare function createUserProfileWithBootstrap(options: BootstrapRoleOptions): Promise<UserProfile>;
+//# sourceMappingURL=sign-up-policy.d.ts.map

package/dist/lib/auth/sign-up-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-up-policy.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/sign-up-policy.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAElD;;;;;;GAMG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,IAAI,qBAAqB;gBACtB,OAAO,EAAE,MAAM;CAI3B;AAED,MAAM,WAAW,iBAAiB;IACjC,EAAE,EAAE,eAAe,CAAC;IACpB,kEAAkE;IAClE,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,oEAAoE;IACpE,UAAU,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;;;GASG;AACH,wBAAsB,mBAAmB,CAAC,EACzC,EAAE,EACF,KAAK,EACL,UAAU,EACV,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAmBnC;AAED,MAAM,WAAW,oBAAoB;IACpC,EAAE,EAAE,eAAe,CAAC;IACpB,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,OAAO,CAAA;KAAE,CAAC;IAC5D,sEAAsE;IACtE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,eAAe,CAAC;CAC3B;AAED;;;;;;;;;GASG;AACH,wBAAsB,oBAAoB,CAAC,EAC1C,EAAE,EACF,IAAI,EACJ,OAAO,EACP,SAAS,EACT,EAAE,oBAAoB,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAerD;AAuBD;;;;;GAKG;AACH,wBAAsB,8BAA8B,CACnD,OAAO,EAAE,oBAAoB,GAC3B,OAAO,CAAC,WAAW,CAAC,CA6BtB"}

package/dist/lib/auth/sign-up-policy.js

@@ -0,0 +1,121 @@
+// Who may sign up, and what they get when they do.
+//
+// These are **CMS policy decisions, not auth-provider concerns**. Whether an
+// instance is invite-only, and who becomes its first administrator, should mean
+// the same thing whether the app authenticates with Better Auth, Keycloak,
+// Supabase, or something hand-rolled — so they live behind the `AuthProvider`
+// port rather than inside any one implementation of it.
+//
+// Before this existed, both rules were enforced inside `@aphexcms/auth`'s
+// Better Auth wiring, which meant a third-party provider silently inherited
+// neither: `inviteOnly: true` would be configured and quietly do nothing. An
+// implementation is free to call these wherever its lifecycle allows, but it is
+// no longer free to *re-derive* them.
+import { cmsLogger } from '../utils/logger.js';
+import { isInstanceEmpty, canDetermineInstanceEmptiness } from './instance-state.js';
+import { isPendingInvitation } from './invitation-status.js';
+/**
+ * Thrown when sign-up is refused by policy.
+ *
+ * Providers translate this into whatever their transport expects — Better Auth
+ * raises an `APIError`, a REST handler might return 403. The message is written
+ * to be safe to show a user.
+ */
+export class SignUpBlockedError extends Error {
+    code = 'SIGN_UP_BLOCKED';
+    constructor(message) {
+        super(message);
+        this.name = 'SignUpBlockedError';
+    }
+}
+/**
+ * Throws `SignUpBlockedError` unless this address may create an account.
+ *
+ * Two ways through: the instance is provably empty (nobody exists yet to have
+ * sent an invitation, so gating the first sign-up would lock the door with the
+ * keys inside), or the address holds a pending invitation.
+ *
+ * Narrowing that first exception is the bootstrap policy's job — see
+ * `resolveBootstrapRole` — not this gate's.
+ */
+export async function assertSignUpAllowed({ db, email, inviteOnly }) {
+    if (!inviteOnly)
+        return;
+    if (await isInstanceEmpty(db)) {
+        cmsLogger.info('[SignUp]', 'Allowing first sign-up on an empty instance');
+        return;
+    }
+    // Invitations are stored lower-cased and matched exactly, so a mixed-case
+    // sign-up would otherwise find nothing and be refused.
+    const address = email?.toLowerCase().trim();
+    const invitations = address ? await db.findInvitationsByEmail(address) : [];
+    if (!invitations.some((invitation) => isPendingInvitation(invitation))) {
+        cmsLogger.warn('[SignUp]', `Blocked sign-up for ${address} — no pending invitation`);
+        throw new SignUpBlockedError('Sign-up is by invitation only. Ask an administrator for an invite.');
+    }
+}
+/**
+ * Runs the bootstrap policy for a brand-new user, returning the instance role to
+ * grant or `null` for none.
+ *
+ * Deliberately not wrapped in a transaction. SQLite allows a single writer, and
+ * holding that lock across the policy's own round-trips collides with the auth
+ * provider's concurrent user/session inserts (SQLITE_BUSY). The atomicity was
+ * only partial anyway — see `claimCode`: a claim is single-use, not mutually
+ * exclusive.
+ */
+export async function resolveBootstrapRole({ db, user, request, bootstrap }) {
+    // "Provably empty", not "couldn't prove otherwise". An adapter that can't
+    // answer this must not read as "no users exist" — that inversion once
+    // promoted every single sign-up to super admin.
+    const isFirstUser = await isInstanceEmpty(db);
+    if (!canDetermineInstanceEmptiness(db)) {
+        cmsLogger.warn('[SignUp]', 'Database adapter does not implement hasAnyUserProfiles() — skipping bootstrap. ' +
+            'Provision the first administrator out of band.');
+    }
+    return bootstrap({ user, isFirstUser, request, db });
+}
+/**
+ * Take the one-time bootstrap claim, or report that somebody else has it.
+ *
+ * An adapter without `tryClaimBootstrap` keeps the old, racy behaviour rather
+ * than never promoting anyone — the opposite of the rule `isInstanceEmpty`
+ * follows, and on purpose. There, failing closed skips a promotion; here it
+ * would leave a fresh install with no administrator and no way to get one.
+ */
+async function claimBootstrapPromotion(db) {
+    const claim = db.tryClaimBootstrap?.bind(db);
+    if (!claim) {
+        cmsLogger.warn('[SignUp]', 'Database adapter does not implement tryClaimBootstrap() — bootstrap promotion is not ' +
+            'race-safe. Concurrent first sign-ups could both be promoted.');
+        return true;
+    }
+    return claim();
+}
+/**
+ * The one place a CMS user profile is created for a newly-authenticated user.
+ *
+ * Every `AuthProvider` should route new profiles through here so bootstrap
+ * promotion happens identically regardless of who did the authenticating.
+ */
+export async function createUserProfileWithBootstrap(options) {
+    const proposed = await resolveBootstrapRole(options);
+    // The policy decided *whether* this user qualifies; the claim decides whether
+    // they got there first. Both are needed: the policy's own `isFirstUser` check
+    // reads a snapshot taken before the profile insert, so two sign-ups racing on
+    // a fresh instance can both pass it and both be promoted. Every promotion in
+    // the instance's lifetime funnels through this one call, so claiming here
+    // covers every policy — including a custom one — without each having to know
+    // about the race.
+    const granted = proposed && (await claimBootstrapPromotion(options.db)) ? proposed : null;
+    if (proposed && !granted) {
+        cmsLogger.warn('[SignUp]', `Bootstrap promotion for ${options.user.id} lost the claim — another sign-up got there first. ` +
+            'Creating an ordinary profile instead.');
+    }
+    cmsLogger.info('[SignUp]', `Creating profile for ${options.user.id}${granted ? ` with role ${granted.toUpperCase()}` : ''}`);
+    return options.db.createUserProfile({
+        userId: options.user.id,
+        role: granted ?? 'editor'
+    });
+}
+//# sourceMappingURL=sign-up-policy.js.map

package/dist/lib/auth/sign-up-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-up-policy.js","sourceRoot":"","sources":["../../../src/lib/auth/sign-up-policy.ts"],"names":[],"mappings":"AAAA,mDAAmD;AACnD,EAAE;AACF,6EAA6E;AAC7E,gFAAgF;AAChF,2EAA2E;AAC3E,8EAA8E;AAC9E,wDAAwD;AACxD,EAAE;AACF,0EAA0E;AAC1E,4EAA4E;AAC5E,6EAA6E;AAC7E,gFAAgF;AAChF,sCAAsC;AAEtC,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,6BAA6B,EAAE,MAAM,kBAAkB,CAAC;AAClF,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAK1D;;;;;;GAMG;AACH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IACnC,IAAI,GAAG,iBAAiB,CAAC;IAClC,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IAClC,CAAC;CACD;AAUD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EACzC,EAAE,EACF,KAAK,EACL,UAAU,EACS;IACnB,IAAI,CAAC,UAAU;QAAE,OAAO;IAExB,IAAI,MAAM,eAAe,CAAC,EAAE,CAAC,EAAE,CAAC;QAC/B,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,6CAA6C,CAAC,CAAC;QAC1E,OAAO;IACR,CAAC;IAED,0EAA0E;IAC1E,uDAAuD;IACvD,MAAM,OAAO,GAAG,KAAK,EAAE,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IAC5C,MAAM,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAE5E,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QACxE,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,uBAAuB,OAAO,0BAA0B,CAAC,CAAC;QACrF,MAAM,IAAI,kBAAkB,CAC3B,oEAAoE,CACpE,CAAC;IACH,CAAC;AACF,CAAC;AAUD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,EAC1C,EAAE,EACF,IAAI,EACJ,OAAO,EACP,SAAS,EACa;IACtB,0EAA0E;IAC1E,sEAAsE;IACtE,gDAAgD;IAChD,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,EAAE,CAAC,CAAC;IAE9C,IAAI,CAAC,6BAA6B,CAAC,EAAE,CAAC,EAAE,CAAC;QACxC,SAAS,CAAC,IAAI,CACb,UAAU,EACV,iFAAiF;YAChF,gDAAgD,CACjD,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,uBAAuB,CAAC,EAAmB;IACzD,MAAM,KAAK,GAAG,EAAE,CAAC,iBAAiB,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,SAAS,CAAC,IAAI,CACb,UAAU,EACV,uFAAuF;YACtF,8DAA8D,CAC/D,CAAC;QACF,OAAO,IAAI,CAAC;IACb,CAAC;IACD,OAAO,KAAK,EAAE,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CACnD,OAA6B;IAE7B,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAErD,8EAA8E;IAC9E,8EAA8E;IAC9E,8EAA8E;IAC9E,6EAA6E;IAC7E,0EAA0E;IAC1E,6EAA6E;IAC7E,kBAAkB;IAClB,MAAM,OAAO,GAAG,QAAQ,IAAI,CAAC,MAAM,uBAAuB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IAE1F,IAAI,QAAQ,IAAI,CAAC,OAAO,EAAE,CAAC;QAC1B,SAAS,CAAC,IAAI,CACb,UAAU,EACV,2BAA2B,OAAO,CAAC,IAAI,CAAC,EAAE,qDAAqD;YAC9F,uCAAuC,CACxC,CAAC;IACH,CAAC;IAED,SAAS,CAAC,IAAI,CACb,UAAU,EACV,wBAAwB,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,cAAc,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAChG,CAAC;IAEF,OAAO,OAAO,CAAC,EAAE,CAAC,iBAAiB,CAAC;QACnC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;QACvB,IAAI,EAAE,OAAO,IAAI,QAAQ;KACzB,CAAC,CAAC;AACJ,CAAC"}

package/dist/lib/db/interfaces/events.d.ts

@@ -1,4 +1,4 @@
-import type { DomainEvent, AppendEventInput, Job, ScheduleJobInput, ClaimJobsOptions, ListEventsOptions, ListJobsOptions, OutboxRow, ListUnprocessedOutboxOptions, Page } from '../../types/events.js';
+import type { DomainEvent, AppendEventInput, Job, ScheduleJobInput, ClaimJobsOptions, ListEventsOptions, ListJobsOptions, OutboxRow, ListUnprocessedOutboxOptions, OutboxHealth, Page } from '../../types/events.js';
 /**
  * The durable spine: an append-only domain-event log plus a DB-backed job queue.
  * All rows are organization-scoped. (The event-log read API — `listEvents` — lands
@@ -25,6 +25,13 @@ export interface EventJobAdapter {
     listUnprocessedOutbox(options: ListUnprocessedOutboxOptions): Promise<OutboxRow[]>;
     /** Stamp `processedAt` once an outbox row has been fanned out to every subscriber. */
     markOutboxProcessed(organizationId: string, id: string): Promise<void>;
+    /**
+     * Size and age of the unprocessed backlog — the "is the relay running?" signal.
+     * Omit `organizationId` for the instance-wide figure. See {@link OutboxHealth}.
+     */
+    outboxHealth(options: {
+        organizationId?: string;
+    }): Promise<OutboxHealth>;
     /** Schedule a job. Idempotent when `idempotencyKey` is set: a duplicate key returns the existing job. */
     scheduleJob(input: ScheduleJobInput): Promise<Job>;
     /**
@@ -49,7 +56,27 @@ export interface EventJobAdapter {
     }): Promise<void>;
     /** Cancel a job (e.g. a scheduled publish the user called off): status → `cancelled`, clear the lease. */
     cancelJob(organizationId: string, id: string): Promise<void>;
-    /** List jobs for the org, newest first (read-only history / observability). */
+    /** Read a single job by id (org-scoped). Null when it doesn't exist in that org. */
+    getJob(organizationId: string, id: string): Promise<Job | null>;
+    /**
+     * Put a finished job back on the queue by hand — the operator's undo for a dead letter.
+     *
+     * Distinct from `retryJob`, which is the *runner's* backoff transition and deliberately
+     * leaves `attempts` alone. A dead-lettered job sits at `attempts === maxAttempts`, so
+     * reusing `retryJob` would hand it back to the runner only for the next claim to exhaust
+     * it again immediately. This resets the attempt counter and clears `lastError`, giving
+     * the job a fresh budget once whatever broke has been fixed.
+     *
+     * Guarded to `failed` and `cancelled` in SQL: requeueing a `pending` job is pointless and
+     * requeueing a `leased` one would race the worker currently holding it, whose settle would
+     * then overwrite the status. Returns the updated job, or null when the id doesn't exist in
+     * the org or wasn't in a requeueable state — so callers can tell "gone" from "not allowed"
+     * with a follow-up `getJob`.
+     */
+    requeueJob(organizationId: string, id: string, options: {
+        runAt: Date;
+    }): Promise<Job | null>;
+    /** List jobs, newest first (read-only history / observability). Omit `organizationId` for instance-wide. */
     listJobs(options: ListJobsOptions): Promise<Page<Job>>;
 }
 //# sourceMappingURL=events.d.ts.map

package/dist/lib/db/interfaces/events.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../../../../src/lib/db/interfaces/events.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACX,WAAW,EACX,gBAAgB,EAChB,GAAG,EACH,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,SAAS,EACT,4BAA4B,EAC5B,IAAI,EACJ,MAAM,oBAAoB,CAAC;AAE5B;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAE/B;;;;;;OAMG;IACH,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAC3D,8CAA8C;IAC9C,QAAQ,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAC1E,wFAAwF;IACxF,UAAU,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IAGnE;;;;OAIG;IACH,qBAAqB,CAAC,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IACnF,sFAAsF;IACtF,mBAAmB,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAGvE,yGAAyG;IACzG,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IACnD;;;OAGG;IACH,YAAY,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACxD,oCAAoC;IACpC,WAAW,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CACP,cAAc,EAAE,MAAM,EACtB,EAAE,EAAE,MAAM,EACV,OAAO,EAAE;QAAE,KAAK,EAAE,IAAI,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GACrC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,uFAAuF;IACvF,OAAO,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvF,0GAA0G;IAC1G,SAAS,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7D,+EAA+E;IAC/E,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;CACvD"}
+{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../../../../src/lib/db/interfaces/events.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACX,WAAW,EACX,gBAAgB,EAChB,GAAG,EACH,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,SAAS,EACT,4BAA4B,EAC5B,YAAY,EACZ,IAAI,EACJ,MAAM,oBAAoB,CAAC;AAE5B;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAE/B;;;;;;OAMG;IACH,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAC3D,8CAA8C;IAC9C,QAAQ,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAC1E,wFAAwF;IACxF,UAAU,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IAGnE;;;;OAIG;IACH,qBAAqB,CAAC,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IACnF,sFAAsF;IACtF,mBAAmB,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvE;;;OAGG;IACH,YAAY,CAAC,OAAO,EAAE;QAAE,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAG1E,yGAAyG;IACzG,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IACnD;;;OAGG;IACH,YAAY,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACxD,oCAAoC;IACpC,WAAW,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CACP,cAAc,EAAE,MAAM,EACtB,EAAE,EAAE,MAAM,EACV,OAAO,EAAE;QAAE,KAAK,EAAE,IAAI,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GACrC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,uFAAuF;IACvF,OAAO,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvF,0GAA0G;IAC1G,SAAS,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7D,oFAAoF;IACpF,MAAM,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;IAChE;;;;;;;;;;;;;;OAcG;IACH,UAAU,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,KAAK,EAAE,IAAI,CAAA;KAAE,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;IAC9F,4GAA4G;IAC5G,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;CACvD"}

package/dist/lib/db/interfaces/index.d.ts

@@ -17,6 +17,7 @@ export type { UserProfileAdapter, NewUserProfileData } from './user.js';
 export type { SchemaAdapter } from './schema.js';
 export type { OrganizationAdapter } from './organization.js';
 export type { InstanceAdapter, InstanceSettings } from './instance.js';
+export { BOOTSTRAP_CLAIM_ID } from './instance.js';
 export type { RolesAdapter } from './role.js';
 export type { ReferenceAdapter, BackReferenceRow, BackReferenceLookup } from './reference.js';
 export type { PluginSettingsAdapter, PluginSettingsRow } from './plugin-settings.js';

package/dist/lib/db/interfaces/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/lib/db/interfaces/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,QAAQ,CAAC;AACjD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAC3C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAChD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAGjE,YAAY,EACX,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,kBAAkB,EAClB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC9E,YAAY,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,QAAQ,CAAC;AACrE,YAAY,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAC9C,YAAY,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACpE,YAAY,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAC3C,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAC3F,YAAY,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAClF,YAAY,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAChD,YAAY,EACX,oBAAoB,EACpB,mBAAmB,EACnB,uBAAuB,EACvB,wBAAwB,EACxB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAEjE;;;GAGG;AACH,MAAM,WAAW,eAChB,SACC,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,aAAa,EACb,mBAAmB,EACnB,eAAe,EACf,YAAY,EACZ,gBAAgB,EAChB,qBAAqB,EACrB,eAAe,EACf,oBAAoB,EACpB,qBAAqB;IAEtB,OAAO,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,UAAU,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAG7B,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAG9B;;OAEG;IACH,aAAa,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,gBAAgB,EAAE,OAAO,CAAC;IAE1B;;;OAGG;IACH,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAE7E;;OAEG;IACH,qBAAqB,CAAC,oBAAoB,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAEvE;;OAEG;IACH,kBAAkB,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAExC;;;;;;;;OAQG;IACH,eAAe,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,eAAe,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAC7E;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,IAAI,eAAe,CAAC;CACjC;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC9B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,GAAG,CAAC;IACb,OAAO,CAAC,EAAE;QACT,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,GAAG,CAAC,EAAE,OAAO,CAAC;QACd,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;KACnB,CAAC;CACF;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IACnC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,QAAQ,IAAI,OAAO,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,4BAA6B,SAAQ,eAAe;IACpE,gBAAgB,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACjD,eAAe,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,eAAe,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAC7E"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/lib/db/interfaces/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,QAAQ,CAAC;AACjD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAC3C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAChD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAGjE,YAAY,EACX,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,kBAAkB,EAClB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC9E,YAAY,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,QAAQ,CAAC;AACrE,YAAY,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAC9C,YAAY,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAChD,YAAY,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAC3C,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAC3F,YAAY,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAClF,YAAY,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAChD,YAAY,EACX,oBAAoB,EACpB,mBAAmB,EACnB,uBAAuB,EACvB,wBAAwB,EACxB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAEjE;;;GAGG;AACH,MAAM,WAAW,eAChB,SACC,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,aAAa,EACb,mBAAmB,EACnB,eAAe,EACf,YAAY,EACZ,gBAAgB,EAChB,qBAAqB,EACrB,eAAe,EACf,oBAAoB,EACpB,qBAAqB;IAEtB,OAAO,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,UAAU,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAG7B,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAG9B;;OAEG;IACH,aAAa,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,gBAAgB,EAAE,OAAO,CAAC;IAE1B;;;OAGG;IACH,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAE7E;;OAEG;IACH,qBAAqB,CAAC,oBAAoB,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAEvE;;OAEG;IACH,kBAAkB,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAExC;;;;;;;;OAQG;IACH,eAAe,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,eAAe,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAC7E;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,IAAI,eAAe,CAAC;CACjC;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC9B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,GAAG,CAAC;IACb,OAAO,CAAC,EAAE;QACT,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,GAAG,CAAC,EAAE,OAAO,CAAC;QACd,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;KACnB,CAAC;CACF;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IACnC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,QAAQ,IAAI,OAAO,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,4BAA6B,SAAQ,eAAe;IACpE,gBAAgB,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACjD,eAAe,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,eAAe,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAC7E"}

package/dist/lib/db/interfaces/index.js

@@ -1,2 +1,3 @@
 export { RevisionConflictError } from './document.js';
+export { BOOTSTRAP_CLAIM_ID } from './instance.js';
 //# sourceMappingURL=index.js.map

package/dist/lib/db/interfaces/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/lib/db/interfaces/index.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/lib/db/interfaces/index.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAMnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC"}

package/dist/lib/db/interfaces/instance.d.ts

@@ -1,7 +1,36 @@
 import type { InstanceSettings } from '../../types/instance.js';
 export type { InstanceSettings };
+/**
+ * Row id holding the one-time bootstrap claim.
+ *
+ * Deliberately not `'default'` — `get`/`updateInstanceSettings` are scoped to
+ * that row, so this one is invisible to them and can't be cleared by an ordinary
+ * settings write.
+ */
+export declare const BOOTSTRAP_CLAIM_ID = "aphex:bootstrap-claim";
 export interface InstanceAdapter {
     getInstanceSettings(): Promise<InstanceSettings>;
     updateInstanceSettings(settings: Partial<InstanceSettings>): Promise<InstanceSettings>;
+    /**
+     * Atomically claim the one-time bootstrap promotion. `true` means this caller
+     * won and may grant an instance role; `false` means somebody else already did.
+     *
+     * Exists because "is the instance empty?" and "insert the first profile" were
+     * two statements with a gap between them: two sign-ups arriving together could
+     * both observe an empty instance and both be promoted to super admin. Every
+     * bootstrap policy gates on `isFirstUser`, so at most one promotion is
+     * intended in all of them — this makes that atomic rather than likely.
+     *
+     * Implemented as an insert of a dedicated row that conflicts with itself, so
+     * the database decides the winner in a single statement. That matters more
+     * than it sounds: the obvious fix — wrapping the check and the insert in one
+     * transaction — holds SQLite's single write lock across the auth provider's
+     * own concurrent user and session inserts and fails sign-up with SQLITE_BUSY.
+     *
+     * Optional: an adapter that doesn't implement it keeps the old non-atomic
+     * behaviour (with a warning) rather than refusing to ever promote anyone,
+     * which would leave a fresh install with no way to get its first administrator.
+     */
+    tryClaimBootstrap?(): Promise<boolean>;
 }
 //# sourceMappingURL=instance.d.ts.map

package/dist/lib/db/interfaces/instance.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"instance.d.ts","sourceRoot":"","sources":["../../../../src/lib/db/interfaces/instance.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAE7D,YAAY,EAAE,gBAAgB,EAAE,CAAC;AAEjC,MAAM,WAAW,eAAe;IAC/B,mBAAmB,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACjD,sBAAsB,CAAC,QAAQ,EAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;CACvF"}
+{"version":3,"file":"instance.d.ts","sourceRoot":"","sources":["../../../../src/lib/db/interfaces/instance.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAE7D,YAAY,EAAE,gBAAgB,EAAE,CAAC;AAEjC;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,0BAA0B,CAAC;AAE1D,MAAM,WAAW,eAAe;IAC/B,mBAAmB,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACjD,sBAAsB,CAAC,QAAQ,EAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAEvF;;;;;;;;;;;;;;;;;;;OAmBG;IACH,iBAAiB,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;CACvC"}

package/dist/lib/db/interfaces/instance.js

@@ -1,2 +1,9 @@
-export {};
+/**
+ * Row id holding the one-time bootstrap claim.
+ *
+ * Deliberately not `'default'` — `get`/`updateInstanceSettings` are scoped to
+ * that row, so this one is invisible to them and can't be cleared by an ordinary
+ * settings write.
+ */
+export const BOOTSTRAP_CLAIM_ID = 'aphex:bootstrap-claim';
 //# sourceMappingURL=instance.js.map

package/dist/lib/db/interfaces/instance.js.map

@@ -1 +1 @@
-{"version":3,"file":"instance.js","sourceRoot":"","sources":["../../../../src/lib/db/interfaces/instance.ts"],"names":[],"mappings":""}
+{"version":3,"file":"instance.js","sourceRoot":"","sources":["../../../../src/lib/db/interfaces/instance.ts"],"names":[],"mappings":"AAKA;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,uBAAuB,CAAC"}

package/dist/lib/events/built-in-consumers.d.ts

@@ -0,0 +1,20 @@
+import type { EventConsumerPart } from '../plugins/types.js';
+/**
+ * Erase a deleted user's avatar — the file, not just the row.
+ *
+ * Account deletion removes the user record, and with it the only pointer to the avatar
+ * asset. Without this the image survives in object storage indefinitely, reachable by
+ * anyone holding its URL and invisible to the media browser (avatars are marked
+ * `system`), so nothing would ever surface it for cleanup. That is precisely the
+ * "personal data with no way left to find or erase it" case a right-to-erasure request
+ * has to be able to answer.
+ *
+ * Idempotent, as every consumer must be: a missing asset is a completed erasure, so a
+ * redelivery finds nothing and succeeds. It throws only when the delete itself fails, so
+ * a transient storage outage retries with backoff instead of silently giving up — the
+ * one outcome that would leave the data behind while reporting success.
+ */
+export declare const eraseUserAvatarConsumer: EventConsumerPart;
+/** Every consumer core ships. Seeded into the part resolver ahead of plugin parts. */
+export declare const BUILT_IN_EVENT_CONSUMERS: readonly EventConsumerPart[];
+//# sourceMappingURL=built-in-consumers.d.ts.map

package/dist/lib/events/built-in-consumers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"built-in-consumers.d.ts","sourceRoot":"","sources":["../../../src/lib/events/built-in-consumers.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAQ1D;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,uBAAuB,EAAE,iBAoCrC,CAAC;AAEF,sFAAsF;AACtF,eAAO,MAAM,wBAAwB,EAAE,SAAS,iBAAiB,EAA8B,CAAC"}

package/dist/lib/events/built-in-consumers.js

@@ -0,0 +1,50 @@
+import { userDeleted } from './catalog.js';
+/** Extract the asset id from an avatar path, or null if it isn't one of ours. */
+function avatarAssetId(image) {
+    return /^\/media\/([^/]+)\//.exec(image)?.[1] ?? null;
+}
+/**
+ * Erase a deleted user's avatar — the file, not just the row.
+ *
+ * Account deletion removes the user record, and with it the only pointer to the avatar
+ * asset. Without this the image survives in object storage indefinitely, reachable by
+ * anyone holding its URL and invisible to the media browser (avatars are marked
+ * `system`), so nothing would ever surface it for cleanup. That is precisely the
+ * "personal data with no way left to find or erase it" case a right-to-erasure request
+ * has to be able to answer.
+ *
+ * Idempotent, as every consumer must be: a missing asset is a completed erasure, so a
+ * redelivery finds nothing and succeeds. It throws only when the delete itself fails, so
+ * a transient storage outage retries with backoff instead of silently giving up — the
+ * one outcome that would leave the data behind while reporting success.
+ */
+export const eraseUserAvatarConsumer = {
+    implements: 'aphex/event/consumer',
+    id: 'aphex.erase-user-avatar',
+    events: [userDeleted.type],
+    async handler({ event, assetService, logger }) {
+        const image = event.payload.image;
+        if (typeof image !== 'string' || !image)
+            return;
+        const assetId = avatarAssetId(image);
+        if (!assetId) {
+            // An external provider's avatar, or one of the absolute storage URLs written
+            // before avatars moved to `/media/<id>/`. Nothing of ours to delete, and no
+            // asset id recoverable from it — flag it so it can be cleared by hand.
+            logger.warn('[erase-user-avatar]', `User ${event.payload.userId} had a non-asset avatar (${image}); nothing to erase automatically.`);
+            return;
+        }
+        if (!assetService) {
+            // Throwing would retry forever against a host that has no asset service at
+            // all. Say so loudly once per attempt and let the delivery dead-letter.
+            throw new Error(`Cannot erase avatar asset ${assetId}: no asset service is configured on this host.`);
+        }
+        const deleted = await assetService.deleteAsset(event.organizationId, assetId);
+        logger.info('[erase-user-avatar]', deleted
+            ? `Erased avatar asset ${assetId} for deleted user ${event.payload.userId}`
+            : `Avatar asset ${assetId} was already gone for user ${event.payload.userId}`);
+    }
+};
+/** Every consumer core ships. Seeded into the part resolver ahead of plugin parts. */
+export const BUILT_IN_EVENT_CONSUMERS = [eraseUserAvatarConsumer];
+//# sourceMappingURL=built-in-consumers.js.map

package/dist/lib/events/built-in-consumers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"built-in-consumers.js","sourceRoot":"","sources":["../../../src/lib/events/built-in-consumers.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAExC,iFAAiF;AACjF,SAAS,aAAa,CAAC,KAAa;IACnC,OAAO,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACvD,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAsB;IACzD,UAAU,EAAE,sBAAsB;IAClC,EAAE,EAAE,yBAAyB;IAC7B,MAAM,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC;IAC1B,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE;QAC5C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAClC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK;YAAE,OAAO;QAEhD,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,6EAA6E;YAC7E,4EAA4E;YAC5E,uEAAuE;YACvE,MAAM,CAAC,IAAI,CACV,qBAAqB,EACrB,QAAQ,KAAK,CAAC,OAAO,CAAC,MAAM,4BAA4B,KAAK,oCAAoC,CACjG,CAAC;YACF,OAAO;QACR,CAAC;QAED,IAAI,CAAC,YAAY,EAAE,CAAC;YACnB,2EAA2E;YAC3E,wEAAwE;YACxE,MAAM,IAAI,KAAK,CACd,6BAA6B,OAAO,gDAAgD,CACpF,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,KAAK,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;QAC9E,MAAM,CAAC,IAAI,CACV,qBAAqB,EACrB,OAAO;YACN,CAAC,CAAC,uBAAuB,OAAO,qBAAqB,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE;YAC3E,CAAC,CAAC,gBAAgB,OAAO,8BAA8B,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAC9E,CAAC;IACH,CAAC;CACD,CAAC;AAEF,sFAAsF;AACtF,MAAM,CAAC,MAAM,wBAAwB,GAAiC,CAAC,uBAAuB,CAAC,CAAC"}

package/dist/lib/events/catalog.d.ts

@@ -5,4 +5,20 @@ export declare const documentPublished: import("./define-event.js").EventDefinit
     documentType: z.ZodString;
     publishedHash: z.ZodNullable<z.ZodString>;
 }, z.core.$strip>>;
+/**
+ * Emitted when a user account is deleted, once per organization they belonged to — the
+ * erasure fan-out point. Consumers react by removing whatever that user left behind in
+ * *their* organization, so "delete my account" reaches per-org data without the deletion
+ * path having to know every consumer that cares.
+ *
+ * Carries `image` because it can't be looked up afterwards: the account row is gone by the
+ * time a consumer runs, taking the only pointer to the avatar asset with it. This is the
+ * one case where the payload holds a value rather than an identifier, and it's still not a
+ * secret — it's the same public CDN path the profile served.
+ */
+export declare const userDeleted: import("./define-event.js").EventDefinition<"user.deleted", z.ZodObject<{
+    userId: z.ZodString;
+    email: z.ZodNullable<z.ZodString>;
+    image: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>>;
 //# sourceMappingURL=catalog.d.ts.map

package/dist/lib/events/catalog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"catalog.d.ts","sourceRoot":"","sources":["../../../src/lib/events/catalog.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,+FAA+F;AAC/F,eAAO,MAAM,iBAAiB;;;;kBAO7B,CAAC"}
+{"version":3,"file":"catalog.d.ts","sourceRoot":"","sources":["../../../src/lib/events/catalog.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,+FAA+F;AAC/F,eAAO,MAAM,iBAAiB;;;;kBAO7B,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,WAAW;;;;kBAQvB,CAAC"}

package/dist/lib/events/catalog.js

@@ -9,4 +9,21 @@ export const documentPublished = defineEvent('document.published', z.object({
     documentType: z.string(),
     publishedHash: z.string().nullable()
 }));
+/**
+ * Emitted when a user account is deleted, once per organization they belonged to — the
+ * erasure fan-out point. Consumers react by removing whatever that user left behind in
+ * *their* organization, so "delete my account" reaches per-org data without the deletion
+ * path having to know every consumer that cares.
+ *
+ * Carries `image` because it can't be looked up afterwards: the account row is gone by the
+ * time a consumer runs, taking the only pointer to the avatar asset with it. This is the
+ * one case where the payload holds a value rather than an identifier, and it's still not a
+ * secret — it's the same public CDN path the profile served.
+ */
+export const userDeleted = defineEvent('user.deleted', z.object({
+    userId: z.string(),
+    email: z.string().nullable(),
+    /** The profile image as stored, or null. `/media/<assetId>/<filename>` when it's ours. */
+    image: z.string().nullable()
+}));
 //# sourceMappingURL=catalog.js.map

package/dist/lib/events/catalog.js.map

@@ -1 +1 @@
-{"version":3,"file":"catalog.js","sourceRoot":"","sources":["../../../src/lib/events/catalog.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAE7C,wFAAwF;AACxF,4FAA4F;AAC5F,kFAAkF;AAElF,+FAA+F;AAC/F,MAAM,CAAC,MAAM,iBAAiB,GAAG,WAAW,CAC3C,oBAAoB,EACpB,CAAC,CAAC,MAAM,CAAC;IACR,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACpC,CAAC,CACF,CAAC"}
+{"version":3,"file":"catalog.js","sourceRoot":"","sources":["../../../src/lib/events/catalog.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAE7C,wFAAwF;AACxF,4FAA4F;AAC5F,kFAAkF;AAElF,+FAA+F;AAC/F,MAAM,CAAC,MAAM,iBAAiB,GAAG,WAAW,CAC3C,oBAAoB,EACpB,CAAC,CAAC,MAAM,CAAC;IACR,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACpC,CAAC,CACF,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,WAAW,CACrC,cAAc,EACd,CAAC,CAAC,MAAM,CAAC;IACR,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,0FAA0F;IAC1F,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC5B,CAAC,CACF,CAAC"}

package/dist/lib/events/consumer.d.ts

@@ -32,11 +32,23 @@ export interface ConsumerSettingsReader {
     /** Decrypted settings for `pluginId` in the event's organization ({} if never configured). */
     get(pluginId: string): Promise<Record<string, unknown>>;
 }
+/**
+ * The asset operations a consumer may perform. Deliberately the *service*, not the database
+ * adapter: `databaseAdapter.deleteAsset` drops the row and leaves the file in object storage,
+ * which for an erasure consumer is the difference between deleting the pointer and deleting
+ * the data.
+ */
+export interface ConsumerAssetService {
+    findAssetById(organizationId: string, id: string): Promise<unknown>;
+    deleteAsset(organizationId: string, id: string): Promise<boolean>;
+}
 /** What an event-consumer handler receives. `databaseAdapter` is the live adapter (org-scoped calls take an org id). */
 export interface EventConsumerContext {
     event: ConsumedEvent;
     databaseAdapter: DatabaseAdapter;
     logger: Logger;
+    /** Assets in the event's organization, file included. `null` when the host wired none. */
+    assetService: ConsumerAssetService | null;
     /** Read this plugin's own decrypted settings for the event's org (e.g. a webhook URL secret). */
     settings: ConsumerSettingsReader;
     /**
@@ -49,6 +61,8 @@ export interface EventConsumerContext {
 /** Runtime services the consumer wrapper injects into each delivery's context. */
 export interface ConsumerHandlerDeps {
     pluginSettingsService: PluginSettingsReader;
+    /** The app's asset service, passed through to consumers that erase or rewrite media. */
+    assetService?: ConsumerAssetService | null;
     /** The app's email adapter (or `null` if email isn't configured). Passed straight to the consumer. */
     emailAdapter?: EmailAdapter | null;
 }

package/dist/lib/events/consumer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"consumer.d.ts","sourceRoot":"","sources":["../../../src/lib/events/consumer.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEhD;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,IAAI,CAAC;CAChB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACpC,GAAG,CAAC,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAChF;AAED,iFAAiF;AACjF,MAAM,WAAW,sBAAsB;IACtC,8FAA8F;IAC9F,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACxD;AAED,wHAAwH;AACxH,MAAM,WAAW,oBAAoB;IACpC,KAAK,EAAE,aAAa,CAAC;IACrB,eAAe,EAAE,eAAe,CAAC;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,iGAAiG;IACjG,QAAQ,EAAE,sBAAsB,CAAC;IACjC;;;;OAIG;IACH,YAAY,EAAE,YAAY,GAAG,IAAI,CAAC;CAClC;AAED,kFAAkF;AAClF,MAAM,WAAW,mBAAmB;IACnC,qBAAqB,EAAE,oBAAoB,CAAC;IAC5C,sGAAsG;IACtG,YAAY,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;CACnC;AAED;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,GAAG,EAAE,oBAAoB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAEhF;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,oBAAoB,CAAC;AAErD,+CAA+C;AAC/C,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE1D;AAqBD,sFAAsF;AACtF,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAa/E;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CACnC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,mBAAmB,GACvB,UAAU,CAcZ"}
+{"version":3,"file":"consumer.d.ts","sourceRoot":"","sources":["../../../src/lib/events/consumer.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEhD;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,IAAI,CAAC;CAChB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACpC,GAAG,CAAC,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAChF;AAED,iFAAiF;AACjF,MAAM,WAAW,sBAAsB;IACtC,8FAA8F;IAC9F,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACxD;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACpC,aAAa,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACpE,WAAW,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAClE;AAED,wHAAwH;AACxH,MAAM,WAAW,oBAAoB;IACpC,KAAK,EAAE,aAAa,CAAC;IACrB,eAAe,EAAE,eAAe,CAAC;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,0FAA0F;IAC1F,YAAY,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC1C,iGAAiG;IACjG,QAAQ,EAAE,sBAAsB,CAAC;IACjC;;;;OAIG;IACH,YAAY,EAAE,YAAY,GAAG,IAAI,CAAC;CAClC;AAED,kFAAkF;AAClF,MAAM,WAAW,mBAAmB;IACnC,qBAAqB,EAAE,oBAAoB,CAAC;IAC5C,wFAAwF;IACxF,YAAY,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC3C,sGAAsG;IACtG,YAAY,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;CACnC;AAED;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,GAAG,EAAE,oBAAoB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAEhF;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,oBAAoB,CAAC;AAErD,+CAA+C;AAC/C,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE1D;AAqBD,sFAAsF;AACtF,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAa/E;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CACnC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,mBAAmB,GACvB,UAAU,CAeZ"}

package/dist/lib/events/consumer.js

@@ -70,6 +70,7 @@ export function toConsumerJobHandler(handler, deps) {
             databaseAdapter,
             logger,
             settings,
+            assetService: deps.assetService ?? null,
             emailAdapter: deps.emailAdapter ?? null
         });
     };