@capybara-hq/kernel 0.1.0-rc.23 → 0.1.0-rc.25

package/bootstrap.json

@@ -3,103 +3,103 @@
   "schemaVersion": 1,
   "marketplace": {
     "url": "https://github.com/capybara-hq/plugins.git",
-    "commit": "050de1403662d2ba04cb96839b742aaa0166c00e"
+    "commit": "4bfd588739e5cec6f2177d4e8f72e43a4dae50f3"
   },
   "plugins": [
     {
       "name": "openai-compatible",
       "source": "npm",
       "npm": "@capybara-hq/plugin-openai-compatible",
-      "version": "0.1.0-rc.7",
-      "integrity": "sha512-EVsWj0bJns6DirtzTXIbXrrktoiJbZi+8NeLzYpZ53Gwo4hNoNAaIhnfHge9RBhSgZ0xMTKEAP/PlyQ6uasAVA==",
+      "version": "0.1.0-rc.8",
+      "integrity": "sha512-IDINuU0r2JONeoEneACLhqnIeDCHX0AICaUJd8TeVmCbzsjMPlchTXngFQin66UN3jqi92yhFDGMKixLsArVCA==",
       "required": true
     },
     {
       "name": "object-store-s3",
       "source": "npm",
       "npm": "@capybara-hq/plugin-object-store-s3",
-      "version": "0.1.0-rc.6",
-      "integrity": "sha512-zoJ0DDzeZ1WHxZZyHL/D855FTI2Mdjb0Z5RCqWu745eHA4+5DbboBiHsxSwyzQHp7LixyVQLoWxjFgdXCOkcFw==",
+      "version": "0.1.0-rc.7",
+      "integrity": "sha512-7HHh45e2CiMxQVfMEKexdRkT7k2iUqznNWMEVazzd+rhT4tguLVY8TkWClv4EK246fqVXvnj48rmmL6Dd6oTvw==",
       "required": true
     },
     {
       "name": "anthropic",
       "source": "npm",
       "npm": "@capybara-hq/plugin-anthropic",
-      "version": "0.1.0-rc.6",
-      "integrity": "sha512-x3/vR09Rlcw+kikk9ztmD4fqG0ThscAjAP+R2IOfQxqMNLfcppF0S6zGAWibof3qJ0LG/dr3o0yyH3j20TGlRg==",
+      "version": "0.1.0-rc.7",
+      "integrity": "sha512-yjUyDqJppihZmhgLVomFbhf1Iek31xyJ4W4+It4Dy3K4wsyZV9khhWrm9x1xxtcb1RvDIGgUxRmvLgoTIeUTYQ==",
       "required": false
     },
     {
       "name": "openai",
       "source": "npm",
       "npm": "@capybara-hq/plugin-openai",
-      "version": "0.1.0-rc.7",
-      "integrity": "sha512-67wjrPJd8/CUzTLOxK+rw1dBL2iCzQ5nj9Zg4R6M6K046i/yp8RGLJiYfFags8SFk3yHCBdQIigBWRsFF7HOfg==",
+      "version": "0.1.0-rc.8",
+      "integrity": "sha512-n8IRL9u+yxmtd/aEntgSdTswjTDdhn2tjXTN9FWARGI+dTQnsbkX9108P4T31kmOBVcuwPYzNB09NG+im2LQIg==",
       "required": false
     },
     {
       "name": "deepseek",
       "source": "npm",
       "npm": "@capybara-hq/plugin-deepseek",
-      "version": "0.1.0-rc.6",
-      "integrity": "sha512-MO04BQm08JexZ+Pns/I8x6zWG5lSlXuADM2tZaE6/61hA3L1qKnZly9vmE8H6tt+JgbPZda+lMrINhbQ4biv2A==",
+      "version": "0.1.0-rc.7",
+      "integrity": "sha512-f0kYjYzvwxPtT2bnpf7fYkggMHvlLTJX7bacaWnIoR1cHeTxiNKuvOv8ptkztpkgTmKadjKqllI5b9AOhhILRg==",
       "required": false
     },
     {
       "name": "bailian",
       "source": "npm",
       "npm": "@capybara-hq/plugin-bailian",
-      "version": "0.1.0-rc.6",
-      "integrity": "sha512-dqj7fnUkjs5PnsJsqolkZMZ/a+MWz2yMSORiecyRPoM5hNNgc1LY0jtoTLTOFxG6b5sMJJ0iqyISDrZeV4ScyQ==",
+      "version": "0.1.0-rc.7",
+      "integrity": "sha512-VqTq6mjzka+iEW5BdcZspBdkWSQ1mLsLueg/XABaZzNDEAE/a6ErDE10GadzOTzorqAttXebTLJDjJebgLmtwA==",
       "required": false
     },
     {
       "name": "ark",
       "source": "npm",
       "npm": "@capybara-hq/plugin-ark",
-      "version": "0.1.0-rc.6",
-      "integrity": "sha512-VamP4U4zU6d9uvSAIo9KLxqh0Vt05EnexOF+78W3oY35YrNRXevk/ABFGMVwGEflq9LiJYJ6xisl38t3Aq5fDA==",
+      "version": "0.1.0-rc.7",
+      "integrity": "sha512-Ml/HS3w3fD4x0gh/Yh0jbz8Riv8x7Jkd5phPZUsKDtuE4pvr+hllRYOxs9p0/Lax11BDvbUK9EFzRkCa+xAQeQ==",
       "required": false
     },
     {
       "name": "connector-mcp",
       "source": "npm",
       "npm": "@capybara-hq/plugin-connector-mcp",
-      "version": "0.1.0-rc.6",
-      "integrity": "sha512-p8YmmutRTdj5auF5Ua5ox77S1tht+2URguehopjFaK8Cl34rURM4hY0f7WSJ5Xj884156HBua4AmsBTaDMiasQ==",
+      "version": "0.1.0-rc.7",
+      "integrity": "sha512-hJlW+u1iLt/mKJ9iPBbGT6tbpGevPVTS+8dvLtPbpf2fFRhM2eLrQy6+zuKUhuVQCcJYBrpz4vu5vh1ZBkqNZg==",
       "required": false
     },
     {
       "name": "connector-openapi",
       "source": "npm",
       "npm": "@capybara-hq/plugin-connector-openapi",
-      "version": "0.1.0-rc.7",
-      "integrity": "sha512-hcLe9Ay6ho6C1dFXtVk7VU6kL9NYmjjbh2+7dXl4BJYglGwrGbfVr0FN7TNRQ+Bsy2ni4BuSsJSGv6BYOp6/EA==",
+      "version": "0.1.0-rc.8",
+      "integrity": "sha512-2WU6sU0yAeWDy10DZ2I45uv2I6Q1FQDKvok2W0r6dfIO11G9iTsRNIMbtNsdVO2OUWY8nhAgh95BXBrpUELELQ==",
       "required": false
     },
     {
       "name": "jina",
       "source": "npm",
       "npm": "@capybara-hq/plugin-jina",
-      "version": "0.1.0-rc.6",
-      "integrity": "sha512-ViVwzmq4Ic4iJ7vnwYFSRHm3ON96npVDvcLQH7CqIkpUAKabt8GNBVuD5yAeadKmXY3Gn76VkfjjfmHzJgbOMw==",
+      "version": "0.1.0-rc.7",
+      "integrity": "sha512-rpr59xbQJg+DuzhnAjn7Ql0rW9Cw9gKWHpER9nKvILvEYjEurmhniJkkqeHMnMlPba8lNUeQRGzmxdmLfKA10g==",
       "required": false
     },
     {
       "name": "sandbox-docker",
       "source": "npm",
       "npm": "@capybara-hq/plugin-sandbox-docker",
-      "version": "0.1.0-rc.10",
-      "integrity": "sha512-nDdaWCgrGoAfOiaKMVGheCLTlbFtSo10+8sgPSmJCO4z2LJW0qDMuN7rPwd3QnFsBReNeBwDB5fT6eHscNWDqw==",
+      "version": "0.1.0-rc.12",
+      "integrity": "sha512-c1iTAu/ifkwfnvVOsxEDfxEJNU7HDVewDtX4vdibwpodIhBvxz8tGjGYJ0HXDL3ipGEodiiIgJsVpabnMQ6cBQ==",
       "required": false
     },
     {
       "name": "todo",
       "source": "npm",
       "npm": "@capybara-hq/plugin-todo",
-      "version": "0.1.0-rc.6",
-      "integrity": "sha512-AOKLpoaBfOQUWnP9nszg9DQWR+6z5gl+ZHoTlHysA9LAeC2h/zipjGE9hY69HF9rueSHzM2kGESJLvXIuQODAA==",
+      "version": "0.1.0-rc.8",
+      "integrity": "sha512-xNdzvAmOQmBaDj29hsvbhMJINy2xe+ILTqG+cQhUfsyar7gUJaVOehseufvIq+cVbTjkI2tW7XlwGrtP3E3NtA==",
       "required": false
     },
     {

package/dist/admin/admin.module.d.ts

@@ -1,6 +1,7 @@
 /**
  * Deployment administration: the setup wizard, the platform-level audit log and the admin overview
- * with its health read and seven-day usage aggregate (its controllers are the api role's, `ApiModule`).
+ * with its health read, seven-day usage aggregate and dead outbox rows (its controllers are the api
+ * role's, `ApiModule`).
  */
 export declare class AdminModule {
 }

package/dist/admin/admin.module.js

@@ -10,14 +10,16 @@ import { ChannelsModule } from "../channels/channels.module.js";
 import { TitlesModule } from "../conversations/titles.js";
 import { EvalsModule } from "../evals/evals.module.js";
 import { ExtensionsModule } from "../extensions/extensions.module.js";
+import { LifecycleHooksModule } from "../extensions/lifecycle-hooks.js";
 import { IdentityModule } from "../identity/identity.module.js";
 import { InboxModule } from "../inbox/inbox.module.js";
 import { ModelsModule } from "../models/models.module.js";
 import { OrgsModule } from "../orgs/orgs.module.js";
 import { ProvidersModule } from "../runtime/providers.js";
 import { RunJobsModule } from "../runtime/run-jobs.js";
-import { UsageReportJobsModule } from "../runtime/usage-report-jobs.js";
+import { UsageReportModule } from "../runtime/usage-report.js";
 import { AdminHealthService } from "./health.service.js";
+import { OutboxDeadService } from "./outbox-dead.service.js";
 import { AdminOverviewService } from "./overview.service.js";
 import { PlatformAuditService } from "./platform-audit.service.js";
 import { SetupService } from "./setup.service.js";
@@ -25,7 +27,8 @@ import { SetupLockModule } from "./setup-lock.js";
 import { AdminUsageService } from "./usage.service.js";
 /**
  * Deployment administration: the setup wizard, the platform-level audit log and the admin overview
- * with its health read and seven-day usage aggregate (its controllers are the api role's, `ApiModule`).
+ * with its health read, seven-day usage aggregate and dead outbox rows (its controllers are the api
+ * role's, `ApiModule`).
  */
 let AdminModule = class AdminModule {
 };
@@ -44,8 +47,9 @@ AdminModule = __decorate([
             RunJobsModule,
             ChannelsModule,
             TitlesModule,
-            UsageReportJobsModule,
+            UsageReportModule,
             EvalsModule,
+            LifecycleHooksModule,
             // the price table of the usage aggregate
             ModelsModule,
         ],
@@ -55,6 +59,7 @@ AdminModule = __decorate([
             AdminOverviewService,
             AdminHealthService,
             AdminUsageService,
+            OutboxDeadService,
         ],
         exports: [
             SetupService,
@@ -62,6 +67,7 @@ AdminModule = __decorate([
             AdminOverviewService,
             AdminHealthService,
             AdminUsageService,
+            OutboxDeadService,
         ],
     })
 ], AdminModule);

package/dist/admin/health.service.d.ts

@@ -4,7 +4,7 @@ import { KernelDb } from "../infra/database/kernel-db.js";
 import { type LiveReplica, ReplicaPresence } from "../infra/presence/replica-presence.js";
 import type { KernelLogger } from "../log.js";
 /** The kernel's own queues, in the order the overview lists them (extension queues are not read). */
-export declare const KERNEL_QUEUE_NAMES: readonly ["cap-kernel-runs", "cap-kernel-subagent-runs", "cap-kernel-channels", "cap-kernel-maintenance", "cap-kernel-plugin-scope", "cap-kernel-titles", "cap-kernel-usage-report", "cap-kernel-evals"];
+export declare const KERNEL_QUEUE_NAMES: readonly ["cap-kernel-runs", "cap-kernel-subagent-runs", "cap-kernel-channels", "cap-kernel-maintenance", "cap-kernel-plugin-scope", "cap-kernel-titles", "cap-kernel-usage-report", "cap-kernel-evals", "cap-kernel-lifecycle"];
 /** How long each source's reads may take before the answer marks it unavailable. */
 export declare const HEALTH_READ_TIMEOUT_MS = 3000;
 /** A live replica as the overview shows it. */
@@ -97,7 +97,7 @@ export declare class AdminHealthService {
     private readonly redis;
     private readonly log;
     private readonly queues;
-    constructor(presence: Pick<ReplicaPresence, "live">, db: KernelDb, redis: Pick<Redis, "zcount" | "status">, log: Pick<KernelLogger, "warn">, runs: Queue, subagentRuns: Queue, channels: Queue, maintenance: Queue, pluginScope: Queue, titles: Queue, usageReport: Queue, evals: Queue);
+    constructor(presence: Pick<ReplicaPresence, "live">, db: KernelDb, redis: Pick<Redis, "zcount" | "status">, log: Pick<KernelLogger, "warn">, runs: Queue, subagentRuns: Queue, channels: Queue, maintenance: Queue, pluginScope: Queue, titles: Queue, usageReport: Queue, evals: Queue, lifecycle: Queue);
     read(): Promise<AdminHealth>;
     private readRedis;
     private readDb;

package/dist/admin/health.service.js

@@ -14,6 +14,7 @@ import { PLUGIN_SCOPE_QUEUE } from "../catalog/scope-sync.js";
 import { CHANNEL_QUEUE_NAME } from "../channels/jobs.js";
 import { TITLE_QUEUE } from "../conversations/titles.js";
 import { EVAL_QUEUE_NAME } from "../evals/jobs.js";
+import { LIFECYCLE_QUEUE } from "../extensions/lifecycle-hooks.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { ReplicaPresence } from "../infra/presence/replica-presence.js";
 import { KERNEL_LOGGER, REDIS } from "../infra/tokens.js";
@@ -31,6 +32,7 @@ export const KERNEL_QUEUE_NAMES = [
     TITLE_QUEUE,
     USAGE_REPORT_QUEUE,
     EVAL_QUEUE_NAME,
+    LIFECYCLE_QUEUE,
 ];
 /** How long each source's reads may take before the answer marks it unavailable. */
 export const HEALTH_READ_TIMEOUT_MS = 3_000;
@@ -58,7 +60,7 @@ let AdminHealthService = class AdminHealthService {
     redis;
     log;
     queues;
-    constructor(presence, db, redis, log, runs, subagentRuns, channels, maintenance, pluginScope, titles, usageReport, evals) {
+    constructor(presence, db, redis, log, runs, subagentRuns, channels, maintenance, pluginScope, titles, usageReport, evals, lifecycle) {
         this.presence = presence;
         this.db = db;
         this.redis = redis;
@@ -73,6 +75,7 @@ let AdminHealthService = class AdminHealthService {
             titles,
             usageReport,
             evals,
+            lifecycle,
         ];
     }
     async read() {
@@ -241,6 +244,7 @@ AdminHealthService = __decorate([
     __param(8, Inject(getQueueToken(PLUGIN_SCOPE_QUEUE))),
     __param(9, Inject(getQueueToken(TITLE_QUEUE))),
     __param(10, Inject(getQueueToken(USAGE_REPORT_QUEUE))),
-    __param(11, Inject(getQueueToken(EVAL_QUEUE_NAME)))
+    __param(11, Inject(getQueueToken(EVAL_QUEUE_NAME))),
+    __param(12, Inject(getQueueToken(LIFECYCLE_QUEUE)))
 ], AdminHealthService);
 export { AdminHealthService };

package/dist/admin/outbox-dead.controller.d.ts

@@ -0,0 +1,23 @@
+import type { z } from "zod";
+import { type Principal } from "../identity/principal.js";
+import { OutboxDeadParams } from "./outbox-dead.schemas.js";
+import { type OutboxDeadRow, OutboxDeadService, type OutboxRetryOutcome } from "./outbox-dead.service.js";
+/**
+ * Dead outbox rows (`/api/v1/admin/outbox/dead*`, transactional outbox spec §3.4): background work
+ * the kernel could not queue after its last attempt. Super admins only; service tokens 403. Retry
+ * and discard are audited (`outbox.retried`, `outbox.discarded`); the list is not (decision D5).
+ */
+export declare class OutboxDeadController {
+    private readonly dead;
+    constructor(dead: OutboxDeadService);
+    /** The dead rows, oldest first (at most 200). */
+    list(): Promise<{
+        items: OutboxDeadRow[];
+    }>;
+    /** Makes the row due again, or discards it when the same job is owed already (`already_owed`). */
+    retry(principal: Principal, { id }: z.infer<typeof OutboxDeadParams>): Promise<{
+        outcome: OutboxRetryOutcome;
+    }>;
+    /** Deletes the row: its job is never delivered. */
+    discard(principal: Principal, { id }: z.infer<typeof OutboxDeadParams>): Promise<void>;
+}

package/dist/admin/outbox-dead.controller.js

@@ -0,0 +1,62 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Controller, Delete, Get, HttpCode, Inject, Post } from "@nestjs/common";
+import { CurrentPrincipal, SuperAdmin } from "../identity/principal.js";
+import { writeActorOf } from "../identity/write-actor.js";
+import { createZodDto } from "../infra/validation/create-zod-dto.js";
+import { ZParam } from "../infra/validation/zod-params.js";
+import { OutboxDeadParams } from "./outbox-dead.schemas.js";
+import { OutboxDeadService, } from "./outbox-dead.service.js";
+class OutboxDeadParamsDto extends createZodDto(OutboxDeadParams, "OutboxDeadParams") {
+}
+/**
+ * Dead outbox rows (`/api/v1/admin/outbox/dead*`, transactional outbox spec §3.4): background work
+ * the kernel could not queue after its last attempt. Super admins only; service tokens 403. Retry
+ * and discard are audited (`outbox.retried`, `outbox.discarded`); the list is not (decision D5).
+ */
+let OutboxDeadController = class OutboxDeadController {
+    dead;
+    constructor(dead) {
+        this.dead = dead;
+    }
+    /** The dead rows, oldest first (at most 200). */
+    list() {
+        return this.dead.list();
+    }
+    /** Makes the row due again, or discards it when the same job is owed already (`already_owed`). */
+    retry(principal, { id }) {
+        return this.dead.retry(id, writeActorOf(principal));
+    }
+    /** Deletes the row: its job is never delivered. */
+    async discard(principal, { id }) {
+        await this.dead.discard(id, writeActorOf(principal));
+    }
+};
+__decorate([
+    Get()
+], OutboxDeadController.prototype, "list", null);
+__decorate([
+    Post(":id/retry"),
+    HttpCode(200),
+    __param(0, CurrentPrincipal()),
+    __param(1, ZParam(OutboxDeadParamsDto))
+], OutboxDeadController.prototype, "retry", null);
+__decorate([
+    Delete(":id"),
+    HttpCode(204),
+    __param(0, CurrentPrincipal()),
+    __param(1, ZParam(OutboxDeadParamsDto))
+], OutboxDeadController.prototype, "discard", null);
+OutboxDeadController = __decorate([
+    Controller("api/v1/admin/outbox/dead"),
+    SuperAdmin(),
+    __param(0, Inject(OutboxDeadService))
+], OutboxDeadController);
+export { OutboxDeadController };

package/dist/admin/outbox-dead.schemas.d.ts

@@ -0,0 +1,8 @@
+import { z } from "zod";
+import type { RouteSchemas } from "../platform/route-schemas.js";
+/** A dead outbox row by id (`bigint` identity, read as a string; 400 when not digits). */
+export declare const OutboxDeadParams: z.ZodObject<{
+    id: z.ZodString;
+}, z.core.$strip>;
+/** The super admin's dead outbox rows (transactional outbox spec §3.4). */
+export declare const OUTBOX_DEAD_ROUTES: readonly RouteSchemas[];

package/dist/admin/outbox-dead.schemas.js

@@ -0,0 +1,18 @@
+import { z } from "zod";
+/** The largest `bigint` id; a larger one would make PG refuse the comparison. */
+const MAX_BIGINT = 9223372036854775807n;
+/** A dead outbox row by id (`bigint` identity, read as a string; 400 when not digits). */
+export const OutboxDeadParams = z.object({
+    id: z
+        .string()
+        .regex(/^\d{1,19}$/, "id must be an outbox row id (digits)")
+        // checks do not abort: only digits reach BigInt
+        .refine((v) => !/^\d{1,19}$/.test(v) || BigInt(v) <= MAX_BIGINT, "id must be an outbox row id")
+        .describe("The dead row's id, as admin.outbox-list-dead lists it."),
+});
+/** The super admin's dead outbox rows (transactional outbox spec §3.4). */
+export const OUTBOX_DEAD_ROUTES = [
+    { route: "GET /api/v1/admin/outbox/dead" },
+    { route: "POST /api/v1/admin/outbox/dead/:id/retry", params: OutboxDeadParams },
+    { route: "DELETE /api/v1/admin/outbox/dead/:id", params: OutboxDeadParams },
+];

package/dist/admin/outbox-dead.service.d.ts

@@ -0,0 +1,66 @@
+import type { WriteActor } from "../identity/write-actor.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { TransactionHost } from "../infra/database/transaction-host.js";
+import { type OutboxFastPath } from "../infra/outbox/outbox.service.js";
+/** The most dead rows `GET /api/v1/admin/outbox/dead` returns, oldest first. */
+export declare const OUTBOX_DEAD_LIST_MAX = 200;
+/** A dead outbox row as the super admin sees it (transactional outbox spec §3.4). */
+export interface OutboxDeadRow {
+    id: string;
+    queue: string;
+    jobName: string;
+    jobId: string;
+    /** The org the work belongs to; null for platform work (or an org deleted since). */
+    orgId: string | null;
+    attempts: number;
+    lastError: string | null;
+    deadAt: string;
+    createdAt: string;
+}
+/** Dead rows in all: how many and since when (the overview's `outbox_dead` attention item). */
+export interface OutboxDeadSummary {
+    count: number;
+    oldestAt: Date | null;
+}
+/**
+ * What a retry did: `retried` (the row is due again, the relay delivers it) or `already_owed`
+ * (the same job is owed by a pending row already, so the dead copy was discarded: ruling R8).
+ */
+export type OutboxRetryOutcome = "retried" | "already_owed";
+/**
+ * The super admin's dead outbox rows (transactional outbox spec §3.4): the rows the dispatcher
+ * gave up on after its last attempt. Nothing is dropped silently: a row stays until a super admin
+ * retries it (it is due again with fresh attempts) or discards it, each audited at platform level
+ * (`outbox.retried`, `outbox.discarded`). A retry does not look at what the job is about: every
+ * job name added through the outbox is harmless when its work is gone or done (spec §3.5).
+ */
+export declare class OutboxDeadService {
+    readonly txHost: TransactionHost;
+    private readonly db;
+    private readonly fastPath;
+    constructor(txHost: TransactionHost, db: KernelDb, fastPath: OutboxFastPath);
+    /** The dead rows, oldest first, at most {@link OUTBOX_DEAD_LIST_MAX}. */
+    list(): Promise<{
+        items: OutboxDeadRow[];
+    }>;
+    /** How many rows are dead, and the oldest one's `dead_at`. */
+    summary(): Promise<OutboxDeadSummary>;
+    /**
+     * Makes a dead row due again (`dead_at` cleared, no attempts, next attempt now) and hands it to
+     * the fast path after the commit; the relay delivers it otherwise. When the same (queue, job id)
+     * is owed by a pending row already, the dead row is deleted instead (`already_owed`). A pending
+     * row added between the check and the update fails the update on the unique index: the retry
+     * then runs once more and takes the `already_owed` branch. `outbox.not_found` (404) when no dead
+     * row has the id.
+     */
+    retry(id: string, actor: WriteActor, detail?: Record<string, unknown>): Promise<{
+        outcome: OutboxRetryOutcome;
+    }>;
+    private retryOnce;
+    /** Deletes a dead row: its job is never delivered. `outbox.not_found` (404) when none. */
+    discard(id: string, actor: WriteActor, detail?: Record<string, unknown>): Promise<void>;
+    /** The dead row `id`, locked for the transaction; `outbox.not_found` when it is not dead. */
+    private lockDead;
+    /** A platform-level audit event (no org: the outbox is the deployment's), naming the job. */
+    private audit;
+}

package/dist/admin/outbox-dead.service.js

@@ -0,0 +1,179 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Inject, Injectable } from "@nestjs/common";
+import { sql } from "kysely";
+import { ApiError } from "../errors.js";
+import { audit } from "../identity/audit.js";
+import { afterCommit } from "../infra/database/after-commit.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { TransactionHost } from "../infra/database/transaction-host.js";
+import { Transactional } from "../infra/database/transactional.decorator.js";
+import { OUTBOX_FAST_PATH } from "../infra/outbox/outbox.service.js";
+/** The most dead rows `GET /api/v1/admin/outbox/dead` returns, oldest first. */
+export const OUTBOX_DEAD_LIST_MAX = 200;
+/** The unique index of pending rows (0119): one pending row per (queue, job_id). */
+const PENDING_UNIQUE = "outbox_job_uniq";
+const isPendingConflict = (e) => typeof e === "object" &&
+    e !== null &&
+    e.code === "23505" &&
+    e.constraint === PENDING_UNIQUE;
+const notFound = (id) => new ApiError("outbox.not_found", `No dead outbox row ${id}; list them with GET /api/v1/admin/outbox/dead`);
+/**
+ * The super admin's dead outbox rows (transactional outbox spec §3.4): the rows the dispatcher
+ * gave up on after its last attempt. Nothing is dropped silently: a row stays until a super admin
+ * retries it (it is due again with fresh attempts) or discards it, each audited at platform level
+ * (`outbox.retried`, `outbox.discarded`). A retry does not look at what the job is about: every
+ * job name added through the outbox is harmless when its work is gone or done (spec §3.5).
+ */
+let OutboxDeadService = class OutboxDeadService {
+    txHost;
+    db;
+    fastPath;
+    constructor(txHost, db, fastPath) {
+        this.txHost = txHost;
+        this.db = db;
+        this.fastPath = fastPath;
+    }
+    /** The dead rows, oldest first, at most {@link OUTBOX_DEAD_LIST_MAX}. */
+    async list() {
+        const rows = await this.db.db
+            .selectFrom("outbox")
+            .select([
+            "id",
+            "queue",
+            "job_name",
+            "job_id",
+            "org_id",
+            "attempts",
+            "last_error",
+            "dead_at",
+            "created_at",
+        ])
+            .where("dead_at", "is not", null)
+            .orderBy("dead_at")
+            .orderBy("id")
+            .limit(OUTBOX_DEAD_LIST_MAX)
+            .execute();
+        return {
+            items: rows.map((r) => ({
+                id: String(r.id),
+                queue: r.queue,
+                jobName: r.job_name,
+                jobId: r.job_id,
+                orgId: r.org_id,
+                attempts: r.attempts,
+                lastError: r.last_error,
+                deadAt: r.dead_at.toISOString(),
+                createdAt: r.created_at.toISOString(),
+            })),
+        };
+    }
+    /** How many rows are dead, and the oldest one's `dead_at`. */
+    async summary() {
+        const row = await this.db.db
+            .selectFrom("outbox")
+            .select([sql `count(*)`.as("count"), sql `min(dead_at)`.as("oldest")])
+            .where("dead_at", "is not", null)
+            .executeTakeFirstOrThrow();
+        return { count: Number(row.count), oldestAt: row.oldest };
+    }
+    /**
+     * Makes a dead row due again (`dead_at` cleared, no attempts, next attempt now) and hands it to
+     * the fast path after the commit; the relay delivers it otherwise. When the same (queue, job id)
+     * is owed by a pending row already, the dead row is deleted instead (`already_owed`). A pending
+     * row added between the check and the update fails the update on the unique index: the retry
+     * then runs once more and takes the `already_owed` branch. `outbox.not_found` (404) when no dead
+     * row has the id.
+     */
+    async retry(id, actor, detail = {}) {
+        try {
+            return await this.retryOnce(id, actor, detail);
+        }
+        catch (e) {
+            if (!isPendingConflict(e))
+                throw e;
+            return this.retryOnce(id, actor, detail);
+        }
+    }
+    async retryOnce(id, actor, detail) {
+        const row = await this.lockDead(id);
+        const owed = await this.db.db
+            .selectFrom("outbox")
+            .select("id")
+            .where("queue", "=", row.queue)
+            .where("job_id", "=", row.job_id)
+            .where("dead_at", "is", null)
+            .executeTakeFirst();
+        let outcome;
+        if (owed) {
+            await this.db.db.deleteFrom("outbox").where("id", "=", id).execute();
+            outcome = "already_owed";
+        }
+        else {
+            await this.db.db
+                .updateTable("outbox")
+                .set({ dead_at: null, attempts: 0, next_attempt_at: sql `now()` })
+                .where("id", "=", id)
+                .execute();
+            outcome = "retried";
+            afterCommit(() => this.fastPath([id]));
+        }
+        await this.audit("outbox.retried", id, row, actor, { outcome, ...detail });
+        return { outcome };
+    }
+    /** Deletes a dead row: its job is never delivered. `outbox.not_found` (404) when none. */
+    async discard(id, actor, detail = {}) {
+        const row = await this.lockDead(id);
+        await this.db.db.deleteFrom("outbox").where("id", "=", id).execute();
+        await this.audit("outbox.discarded", id, row, actor, detail);
+    }
+    /** The dead row `id`, locked for the transaction; `outbox.not_found` when it is not dead. */
+    async lockDead(id) {
+        const row = await this.db.db
+            .selectFrom("outbox")
+            .select(["queue", "job_name", "job_id", "org_id", "attempts", "last_error"])
+            .where("id", "=", id)
+            .where("dead_at", "is not", null)
+            .forUpdate()
+            .executeTakeFirst();
+        if (!row)
+            throw notFound(id);
+        return row;
+    }
+    /** A platform-level audit event (no org: the outbox is the deployment's), naming the job. */
+    audit(action, id, row, actor, detail) {
+        return audit(this.db.db, {
+            actorAccountId: actor.accountId,
+            ...(actor.tokenId !== undefined && { actorTokenId: actor.tokenId }),
+            action,
+            target: id,
+            detail: {
+                queue: row.queue,
+                jobName: row.job_name,
+                jobId: row.job_id,
+                ...(row.org_id !== null && { orgId: row.org_id }),
+                ...detail,
+            },
+        });
+    }
+};
+__decorate([
+    Transactional()
+], OutboxDeadService.prototype, "retryOnce", null);
+__decorate([
+    Transactional()
+], OutboxDeadService.prototype, "discard", null);
+OutboxDeadService = __decorate([
+    Injectable(),
+    __param(0, Inject(TransactionHost)),
+    __param(1, Inject(KernelDb)),
+    __param(2, Inject(OUTBOX_FAST_PATH))
+], OutboxDeadService);
+export { OutboxDeadService };