@capybara-hq/kernel 0.1.0-rc.23 → 0.1.0-rc.25

package/dist/runtime/subagents/skill-fork.js

@@ -1,7 +1,7 @@
 import { ApiError } from "../../errors.js";
 import { AGENT_STOPPED_WITH_RUN_TEXT } from "../../tools/builtins/agent.js";
 import { subagentsWait } from "../loop.js";
-import { TERMINAL_STATUSES } from "../run-finish.js";
+import { TERMINAL_STATUSES } from "../run-jobs.js";
 import { childResult, dispatchOfCall, finishedEvent } from "./child.js";
 import { dispatchSubagent } from "./dispatch.js";
 /**
@@ -10,8 +10,8 @@ import { dispatchSubagent } from "./dispatch.js";
  * through phase C's `dispatchSubagent` before any model call and waits on it (`subagents` wait
  * `sa-<runId>-0`; the dispatch row has `for_skill`, agent map spec §5.4: a fork stays in the
  * foreground while `Agent` calls run in the background). When the child has ended, `prepare` appends the model-visible
- * `skill_fork_result` and the parent's model answers. Every terminal path of the run (and the wait
- * sweep) pairs a fork invocation without a report ({@link pairStoppedForks}), so the log never holds
+ * `skill_fork_result` and the parent's model answers. Every terminal path of the run
+ * (`RunFinish.finishIn`) pairs a fork invocation without a report ({@link pairStoppedForks}), so the log never holds
  * a fork lead whose report is missing before the next model call.
  */
 /** The dispatch's parent call id (no `:`; there is no tool call). */
@@ -125,8 +125,11 @@ export async function advanceSkillForks(d, a) {
             agentVersion: ctx.agentVersion,
             agent: ctx.agent,
             accountId: ctx.triggerAccountId,
+            source: ctx.source,
+            ownerAccountId: ctx.ownerAccountId,
+            role: ctx.role,
             signal: ctx.signal,
-            deadline: ctx.limits.deadline,
+            ...(ctx.limits.deadline !== undefined && { deadline: ctx.limits.deadline }),
             ...(ctx.conversationKind !== undefined &&
                 ctx.conversationKind !== "eval" && { conversationKind: ctx.conversationKind }),
         },
@@ -188,7 +191,7 @@ export const recordedSkillForks = (eventLog, recorded) => ({
     },
 });
 /**
- * In the transaction of a run's terminal path (or the wait sweep): the run's fork invocation
+ * In the transaction of a run's terminal path (`RunFinish.finishIn`): the run's fork invocation
  * (its trigger message, by the run boundary) without a report gets one now: the ended child's
  * result (and the parent's missing `subagent_finished`), {@link AGENT_STOPPED_WITH_RUN_TEXT} for a
  * child still active (the caller stops it after its commit, as for `Agent` calls), or

package/dist/runtime/subagents/subagents.service.js

@@ -53,7 +53,7 @@ let SubagentsService = class SubagentsService {
             purposes,
             registry,
             config,
-            enqueue: (data, jobId, kind) => jobs.enqueue(data, jobId, kind),
+            owe: (data, jobId, kind, orgId) => jobs.owe(data, jobId, kind, orgId),
             log,
             invoker,
             commitDispatch: (a, plan, child) => this.commitDispatch(a, plan, child),

package/dist/runtime/subagents/tree-jobs.d.ts

@@ -0,0 +1,61 @@
+import type { OutboxService } from "../../infra/outbox/outbox.service.js";
+import type { Waits } from "../waits.js";
+/**
+ * The stops a transaction owes a sub-agent tree (transactional outbox spec §6 "Sub-agents"), on
+ * the maintenance queue. Two shapes:
+ * - `{ runId }`: what a run's terminal transaction owes its children: its active fork invocation
+ *   child stops (`Waits.stopChildren`, sub-agents spec §12), and a sub-agent run a person stopped
+ *   stops its descendants (`Waits.stopDescendantsOfStopped`, agent map spec §6);
+ * - `{ conversationId, byAccountId }`: a deleted root's whole tree below it stops
+ *   (`Waits.stopTree` without the root, agent map spec §10).
+ *
+ * The caller still stops them right after its commit; the job is the backstop for a process that
+ * died in between, {@link TREE_JOB_BACKSTOP_MS} later.
+ */
+export declare const STOP_TREE_JOB = "stop-tree";
+/**
+ * A finished sub-agent run's delivery to its parent (`Waits.childFinished`: a background child's
+ * `subagent_finished` and `finished` delivery, a fork child's `subagent_finished` and its parent
+ * run's resume), owed by the child run's terminal transaction. The delivery is not written in that
+ * transaction: it holds the child's conversation and run rows, and the parent's conversation row
+ * comes before the child's in the dispatch's lock order (parent conversation, parent run, budget
+ * run, child conversation), so taking it there could deadlock with a follow-up dispatch. The
+ * caller delivers right after its commit; the job is the backstop, {@link TREE_JOB_BACKSTOP_MS}
+ * later.
+ */
+export declare const DELIVER_TO_PARENT_JOB = "deliver-to-parent";
+/** How long after its transaction a tree job fires (a backstop of the direct call, not a second). */
+export declare const TREE_JOB_BACKSTOP_MS = 30000;
+/** The `stop-tree` job's data. */
+export type StopTreeJobData = {
+    runId: string;
+} | {
+    conversationId: string;
+    byAccountId: string | null;
+};
+/** The `deliver-to-parent` job's data. */
+export interface DeliverToParentJobData {
+    childRunId: string;
+}
+/** The `stop-tree` job id of a finished run's children (no `:`). */
+export declare const stopChildrenJobId: (runId: string) => string;
+/** The `stop-tree` job id of a deleted root's tree (a conversation is deleted once; no `:`). */
+export declare const stopDeletedTreeJobId: (conversationId: string) => string;
+/** The `deliver-to-parent` job id: one per child run (no `:`). */
+export declare const deliverToParentJobId: (childRunId: string) => string;
+/** Owes the stops of `runId`'s children in the caller's transaction (throws outside one). */
+export declare function oweStopChildren(outbox: Pick<OutboxService, "add">, runId: string, orgId: string): Promise<boolean>;
+/** Owes the stop of a deleted root's tree in the caller's transaction (throws outside one). */
+export declare function oweStopDeletedTree(outbox: Pick<OutboxService, "add">, conversationId: string, byAccountId: string | null, orgId: string): Promise<boolean>;
+/** Owes a finished child run's delivery to its parent in the caller's transaction. */
+export declare function oweDeliverToParent(outbox: Pick<OutboxService, "add">, childRunId: string, orgId: string): Promise<boolean>;
+/**
+ * The `stop-tree` job (`MaintenanceProcessor`): every stop reads the active runs and stops only
+ * those, so a run the direct call already stopped is not stopped again.
+ */
+export declare function processStopTree(waits: Pick<Waits, "stopChildren" | "stopDescendantsOfStopped" | "stopTree">, data: StopTreeJobData): Promise<void>;
+/**
+ * The `deliver-to-parent` job (`MaintenanceProcessor`): `Waits.childFinished` writes the delivery
+ * once by the child run (idempotency keys under the parent conversation's row lock).
+ */
+export declare function processDeliverToParent(waits: Pick<Waits, "childFinished">, data: DeliverToParentJobData): Promise<void>;

package/dist/runtime/subagents/tree-jobs.js

@@ -0,0 +1,86 @@
+import { MAINTENANCE_QUEUE_NAME } from "../maintenance-queue.js";
+/**
+ * The stops a transaction owes a sub-agent tree (transactional outbox spec §6 "Sub-agents"), on
+ * the maintenance queue. Two shapes:
+ * - `{ runId }`: what a run's terminal transaction owes its children: its active fork invocation
+ *   child stops (`Waits.stopChildren`, sub-agents spec §12), and a sub-agent run a person stopped
+ *   stops its descendants (`Waits.stopDescendantsOfStopped`, agent map spec §6);
+ * - `{ conversationId, byAccountId }`: a deleted root's whole tree below it stops
+ *   (`Waits.stopTree` without the root, agent map spec §10).
+ *
+ * The caller still stops them right after its commit; the job is the backstop for a process that
+ * died in between, {@link TREE_JOB_BACKSTOP_MS} later.
+ */
+export const STOP_TREE_JOB = "stop-tree";
+/**
+ * A finished sub-agent run's delivery to its parent (`Waits.childFinished`: a background child's
+ * `subagent_finished` and `finished` delivery, a fork child's `subagent_finished` and its parent
+ * run's resume), owed by the child run's terminal transaction. The delivery is not written in that
+ * transaction: it holds the child's conversation and run rows, and the parent's conversation row
+ * comes before the child's in the dispatch's lock order (parent conversation, parent run, budget
+ * run, child conversation), so taking it there could deadlock with a follow-up dispatch. The
+ * caller delivers right after its commit; the job is the backstop, {@link TREE_JOB_BACKSTOP_MS}
+ * later.
+ */
+export const DELIVER_TO_PARENT_JOB = "deliver-to-parent";
+/** How long after its transaction a tree job fires (a backstop of the direct call, not a second). */
+export const TREE_JOB_BACKSTOP_MS = 30_000;
+/** The `stop-tree` job id of a finished run's children (no `:`). */
+export const stopChildrenJobId = (runId) => `stop-tree-run-${runId}`;
+/** The `stop-tree` job id of a deleted root's tree (a conversation is deleted once; no `:`). */
+export const stopDeletedTreeJobId = (conversationId) => `stop-tree-deleted-${conversationId}`;
+/** The `deliver-to-parent` job id: one per child run (no `:`). */
+export const deliverToParentJobId = (childRunId) => `deliver-to-parent-${childRunId}`;
+const backstopAt = () => new Date(Date.now() + TREE_JOB_BACKSTOP_MS);
+/** Owes the stops of `runId`'s children in the caller's transaction (throws outside one). */
+export function oweStopChildren(outbox, runId, orgId) {
+    return outbox.add({
+        queue: MAINTENANCE_QUEUE_NAME,
+        name: STOP_TREE_JOB,
+        jobId: stopChildrenJobId(runId),
+        data: { runId },
+        runAt: backstopAt(),
+        orgId,
+    });
+}
+/** Owes the stop of a deleted root's tree in the caller's transaction (throws outside one). */
+export function oweStopDeletedTree(outbox, conversationId, byAccountId, orgId) {
+    return outbox.add({
+        queue: MAINTENANCE_QUEUE_NAME,
+        name: STOP_TREE_JOB,
+        jobId: stopDeletedTreeJobId(conversationId),
+        data: { conversationId, byAccountId },
+        runAt: backstopAt(),
+        orgId,
+    });
+}
+/** Owes a finished child run's delivery to its parent in the caller's transaction. */
+export function oweDeliverToParent(outbox, childRunId, orgId) {
+    return outbox.add({
+        queue: MAINTENANCE_QUEUE_NAME,
+        name: DELIVER_TO_PARENT_JOB,
+        jobId: deliverToParentJobId(childRunId),
+        data: { childRunId },
+        runAt: backstopAt(),
+        orgId,
+    });
+}
+/**
+ * The `stop-tree` job (`MaintenanceProcessor`): every stop reads the active runs and stops only
+ * those, so a run the direct call already stopped is not stopped again.
+ */
+export async function processStopTree(waits, data) {
+    if ("runId" in data) {
+        await waits.stopChildren(data.runId, null);
+        await waits.stopDescendantsOfStopped(data.runId);
+        return;
+    }
+    await waits.stopTree(data.conversationId, data.byAccountId, { includeSelf: false });
+}
+/**
+ * The `deliver-to-parent` job (`MaintenanceProcessor`): `Waits.childFinished` writes the delivery
+ * once by the child run (idempotency keys under the parent conversation's row lock).
+ */
+export async function processDeliverToParent(waits, data) {
+    await waits.childFinished(data.childRunId);
+}

package/dist/runtime/usage-report-jobs.d.ts

@@ -1,20 +1,17 @@
-import type { Logger } from "@capybara-hq/plugin-sdk";
-import { type OnApplicationShutdown } from "@nestjs/common";
-import type { JobsOptions, Queue } from "bullmq";
-import type { KernelSchemaDb } from "../db/kernel-schema.js";
-import { KernelConfigService } from "../infra/config/kernel-config.service.js";
+import type { ConversationEvent } from "../conversations/events.js";
+import { UsageSubscribers } from "../extensions/usage-subscribers.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
-import { KernelEvents } from "../infra/events/kernel-events.js";
+import { TransactionHost } from "../infra/database/transaction-host.js";
+import { OutboxService } from "../infra/outbox/outbox.service.js";
 /**
- * The producer half of `usage.report` delivery for `model_usage` rows, and the queue's ids and job
- * options shared with the reporter (`usage-report.ts`). The `ctx.models` broker sits below the
- * extension host and must not register a queue there (CLI contexts that build the extensions
- * module never connect to Redis eagerly), so it only announces a row (`model_usage.recorded`) and
- * {@link ModelUsageJobs} enqueues it here.
+ * The producer half of `usage.report` delivery, and the queue's ids shared with the reporter
+ * (`usage-report.ts`): a delivery is owed in the transaction that writes the usage it reports
+ * (transactional outbox spec §8.1). It registers no queue (the outbox dispatcher adds the job), so
+ * the `ctx.models` broker below the extension host and the step writes can use it.
  */
 /** Queue of `usage.report` deliveries (no `:` in the name). */
 export declare const USAGE_REPORT_QUEUE = "cap-kernel-usage-report";
-/** The job name of every delivery. */
+/** The job name of every delivery (its outbox registry entry holds the job options). */
 export declare const USAGE_REPORT_JOB = "usage-report";
 /** One job per `usage` event (no `:`: conversation ids are UUIDs, seq is a number). */
 export declare const usageReportJobId: (conversationId: string, seq: number) => string;
@@ -42,47 +39,25 @@ export type UsageReportJob = ({
      */
     dropped?: Record<string, string>;
 };
-/** First attempt plus 5 retries (F11). */
-export declare const USAGE_REPORT_ATTEMPTS = 6;
-/** Retry backoff: 2 s, doubling (2, 4, 8, 16, 32 s). */
-export declare const USAGE_REPORT_BACKOFF_MS = 2000;
-/** The delivery retry policy: attempts and the first exponential backoff. */
-export interface UsageReportRetry {
-    attempts: number;
-    backoffMs: number;
-}
-/** Optional provider: the {@link UsageReportRetry} instead of the defaults above (tests). */
-export declare const USAGE_REPORT_RETRY: unique symbol;
-/** The options of one delivery job: its id, the retry policy and the retention of finished jobs. */
-export declare function usageReportJobOpts(jobId: string, retry: UsageReportRetry, keepHours: number): JobsOptions;
-/**
- * Plugins that subscribe to `usage.report` according to deployment state: an approved permission
- * snapshot that declares the `usage.report` hook, for a plugin the deployment still knows: an enabled
- * install, or a config-declared plugin with a replica status row that is not `unloaded`. With `orgId`, only plugins
- * the organization enabled (org config rows and required bootstrap plugins).
- */
-export declare function queryUsageSubscribers(db: KernelSchemaDb, orgId?: string): Promise<Set<string>>;
 /**
- * Enqueues the `usage.report` delivery of `model_usage` rows on `model_usage.recorded` (fast path;
- * the reporter's sweep re-enqueues rows still unreported, so a lost event or enqueue is caught up).
+ * Owes `usage.report` deliveries in the caller's transaction, only while the deployment has a
+ * subscriber ({@link UsageSubscribers}): usage written while no plugin subscribes is never
+ * reported.
  */
-export declare class ModelUsageJobs implements OnApplicationShutdown {
+export declare class UsageReportJobs {
     private readonly kdb;
-    private readonly queue;
-    private readonly config;
-    private readonly log;
-    private readonly retry;
-    private readonly unsubscribe;
-    /** Set at shutdown: a late event enqueues nothing (the sweep offers the row later). */
-    private closed;
-    constructor(kdb: KernelDb, queue: Queue<UsageReportJob>, config: Pick<KernelConfigService, "get">, log: Logger, retry: UsageReportRetry | undefined, events: KernelEvents);
-    onApplicationShutdown(): void;
+    private readonly outbox;
+    private readonly subscribers;
+    readonly txHost: TransactionHost;
+    constructor(kdb: KernelDb, outbox: Pick<OutboxService, "add">, subscribers: Pick<UsageSubscribers, "any">, txHost: TransactionHost);
     /**
-     * Enqueues the delivery of one row (job `usage-model-<rowId>`). Without any subscriber nothing is
-     * enqueued (the sweep marks the row). Never throws: a failure only logs; the sweep catches up.
+     * Owes the delivery of every `usage` event among `events` (the events this transaction wrote
+     * to the conversation's log), job `usage-<conversationId>-<seq>`.
      */
-    enqueue(usageId: string): Promise<void>;
+    oweEvents(conversationId: string, events: readonly ConversationEvent[]): Promise<void>;
+    /** Owes the delivery of one `model_usage` row (job `usage-model-<rowId>`). */
+    oweModelUsage(usageId: string, orgId: string): Promise<void>;
 }
-/** The usage report queue and its `model_usage` producer (no dependency on the extension host). */
+/** The usage report producer (no queue, no dependency on the extension host). */
 export declare class UsageReportJobsModule {
 }

package/dist/runtime/usage-report-jobs.js

@@ -7,152 +7,100 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-import { getQueueToken } from "@nestjs/bullmq";
-import { Inject, Injectable, Module, Optional } from "@nestjs/common";
-import { sql } from "kysely";
-import { enabledExtensionsQuery } from "../extensions/enabled.js";
-import { KernelConfigService } from "../infra/config/kernel-config.service.js";
+import { Inject, Injectable, Module } from "@nestjs/common";
+import { UsageSubscribers, UsageSubscribersModule } from "../extensions/usage-subscribers.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
-import { KernelEvents } from "../infra/events/kernel-events.js";
-import { QueueModule } from "../infra/queue/queue.module.js";
-import { KERNEL_LOGGER } from "../infra/tokens.js";
+import { TransactionHost } from "../infra/database/transaction-host.js";
+import { Transactional } from "../infra/database/transactional.decorator.js";
+import { OutboxService } from "../infra/outbox/outbox.service.js";
 /**
- * The producer half of `usage.report` delivery for `model_usage` rows, and the queue's ids and job
- * options shared with the reporter (`usage-report.ts`). The `ctx.models` broker sits below the
- * extension host and must not register a queue there (CLI contexts that build the extensions
- * module never connect to Redis eagerly), so it only announces a row (`model_usage.recorded`) and
- * {@link ModelUsageJobs} enqueues it here.
+ * The producer half of `usage.report` delivery, and the queue's ids shared with the reporter
+ * (`usage-report.ts`): a delivery is owed in the transaction that writes the usage it reports
+ * (transactional outbox spec §8.1). It registers no queue (the outbox dispatcher adds the job), so
+ * the `ctx.models` broker below the extension host and the step writes can use it.
  */
 /** Queue of `usage.report` deliveries (no `:` in the name). */
 export const USAGE_REPORT_QUEUE = "cap-kernel-usage-report";
-/** The job name of every delivery. */
+/** The job name of every delivery (its outbox registry entry holds the job options). */
 export const USAGE_REPORT_JOB = "usage-report";
 /** One job per `usage` event (no `:`: conversation ids are UUIDs, seq is a number). */
 export const usageReportJobId = (conversationId, seq) => `usage-${conversationId}-${seq}`;
 /** One job per `model_usage` row (spec B §5.4; row ids are UUIDs, so no clash with the above). */
 export const modelUsageJobId = (usageId) => `usage-model-${usageId}`;
-/** First attempt plus 5 retries (F11). */
-export const USAGE_REPORT_ATTEMPTS = 6;
-/** Retry backoff: 2 s, doubling (2, 4, 8, 16, 32 s). */
-export const USAGE_REPORT_BACKOFF_MS = 2000;
-/** Optional provider: the {@link UsageReportRetry} instead of the defaults above (tests). */
-export const USAGE_REPORT_RETRY = Symbol("USAGE_REPORT_RETRY");
-/** Failed jobs (given up) are kept for inspection, at most {@link KEEP_FAILED_MAX} of them. */
-const KEEP_FAILED_S = 7 * 86_400;
-/** Upper bound on kept failed jobs (I-2): a long outage of a billing endpoint cannot grow Redis. */
-const KEEP_FAILED_MAX = 100_000;
 /**
- * Upper bound on kept finished jobs (Redis memory). At the default retention it only bites above
- * ~1.1 usage events per second sustained for a day; dedupe needs the jobs only for the sweeper overlap.
+ * Owes `usage.report` deliveries in the caller's transaction, only while the deployment has a
+ * subscriber ({@link UsageSubscribers}): usage written while no plugin subscribes is never
+ * reported.
  */
-const KEEP_COMPLETED_MAX = 100_000;
-/** The options of one delivery job: its id, the retry policy and the retention of finished jobs. */
-export function usageReportJobOpts(jobId, retry, keepHours) {
-    return {
-        jobId,
-        attempts: retry.attempts,
-        backoff: { type: "exponential", delay: retry.backoffMs },
-        removeOnComplete: { age: keepHours * 3600, count: KEEP_COMPLETED_MAX },
-        removeOnFail: { age: KEEP_FAILED_S, count: KEEP_FAILED_MAX },
-    };
-}
-/**
- * Plugins that subscribe to `usage.report` according to deployment state: an approved permission
- * snapshot that declares the `usage.report` hook, for a plugin the deployment still knows: an enabled
- * install, or a config-declared plugin with a replica status row that is not `unloaded`. With `orgId`, only plugins
- * the organization enabled (org config rows and required bootstrap plugins).
- */
-export async function queryUsageSubscribers(db, orgId) {
-    let q = db
-        .selectFrom("extension_permission_snapshots as s")
-        .select("s.plugin")
-        .where(sql `s.permissions -> 'permissions' -> 'hooks' ? 'usage.report'`)
-        .where((eb) => eb.or([
-        eb.exists(eb
-            .selectFrom("extension_installs as i")
-            .select(sql `1`.as("one"))
-            .whereRef("i.name", "=", "s.plugin")
-            .where("i.desired_state", "=", "enabled")),
-        // config-declared plugins still declared (and not unloaded) on some replica; installs are
-        // covered by desired_state above (their replica rows linger as `unloaded` when disabled)
-        eb.exists(eb
-            .selectFrom("extension_replica_status as r")
-            .select(sql `1`.as("one"))
-            .whereRef("r.plugin", "=", "s.plugin")
-            .where("r.source", "=", "config")
-            .where("r.state", "<>", "unloaded")),
-    ]));
-    if (orgId !== undefined) {
-        q = q.where("s.plugin", "in", enabledExtensionsQuery(db, orgId));
-    }
-    return new Set((await q.execute()).map((r) => r.plugin));
-}
-/**
- * Enqueues the `usage.report` delivery of `model_usage` rows on `model_usage.recorded` (fast path;
- * the reporter's sweep re-enqueues rows still unreported, so a lost event or enqueue is caught up).
- */
-let ModelUsageJobs = class ModelUsageJobs {
+let UsageReportJobs = class UsageReportJobs {
     kdb;
-    queue;
-    config;
-    log;
-    retry;
-    unsubscribe;
-    /** Set at shutdown: a late event enqueues nothing (the sweep offers the row later). */
-    closed = false;
-    constructor(kdb, queue, config, log, retry = {
-        attempts: USAGE_REPORT_ATTEMPTS,
-        backoffMs: USAGE_REPORT_BACKOFF_MS,
-    }, events) {
+    outbox;
+    subscribers;
+    txHost;
+    constructor(kdb, outbox, subscribers, txHost) {
         this.kdb = kdb;
-        this.queue = queue;
-        this.config = config;
-        this.log = log;
-        this.retry = retry;
-        this.unsubscribe = events.on("model_usage.recorded", ({ id }) => this.enqueue(id));
-    }
-    onApplicationShutdown() {
-        this.closed = true;
-        this.unsubscribe();
+        this.outbox = outbox;
+        this.subscribers = subscribers;
+        this.txHost = txHost;
     }
     /**
-     * Enqueues the delivery of one row (job `usage-model-<rowId>`). Without any subscriber nothing is
-     * enqueued (the sweep marks the row). Never throws: a failure only logs; the sweep catches up.
+     * Owes the delivery of every `usage` event among `events` (the events this transaction wrote
+     * to the conversation's log), job `usage-<conversationId>-<seq>`.
      */
-    async enqueue(usageId) {
-        if (this.closed)
+    async oweEvents(conversationId, events) {
+        const usage = events.filter((e) => e.type === "usage");
+        if (usage.length === 0 || !(await this.subscribers.any()))
             return;
-        try {
-            if ((await queryUsageSubscribers(this.kdb.db)).size === 0)
-                return;
-            await this.queue.add(USAGE_REPORT_JOB, { usageId }, usageReportJobOpts(modelUsageJobId(usageId), this.retry, this.config.get().hooks.usageReportKeepHours));
-        }
-        catch (err) {
-            this.log.warn("cannot enqueue model usage report", { usageId, err });
+        const conv = await this.kdb.db
+            .selectFrom("conversations")
+            .select("org_id")
+            .where("id", "=", conversationId)
+            .executeTakeFirst();
+        for (const e of usage) {
+            await this.outbox.add({
+                queue: USAGE_REPORT_QUEUE,
+                name: USAGE_REPORT_JOB,
+                jobId: usageReportJobId(conversationId, e.seq),
+                data: { conversationId, seq: e.seq },
+                ...(conv !== undefined && { orgId: conv.org_id }),
+            });
         }
     }
+    /** Owes the delivery of one `model_usage` row (job `usage-model-<rowId>`). */
+    async oweModelUsage(usageId, orgId) {
+        if (!(await this.subscribers.any()))
+            return;
+        await this.outbox.add({
+            queue: USAGE_REPORT_QUEUE,
+            name: USAGE_REPORT_JOB,
+            jobId: modelUsageJobId(usageId),
+            data: { usageId },
+            orgId,
+        });
+    }
 };
-ModelUsageJobs = __decorate([
+__decorate([
+    Transactional({ propagation: "mandatory" })
+], UsageReportJobs.prototype, "oweEvents", null);
+__decorate([
+    Transactional({ propagation: "mandatory" })
+], UsageReportJobs.prototype, "oweModelUsage", null);
+UsageReportJobs = __decorate([
     Injectable(),
     __param(0, Inject(KernelDb)),
-    __param(1, Inject(getQueueToken(USAGE_REPORT_QUEUE))),
-    __param(2, Inject(KernelConfigService)),
-    __param(3, Inject(KERNEL_LOGGER)),
-    __param(4, Optional()),
-    __param(4, Inject(USAGE_REPORT_RETRY)),
-    __param(5, Inject(KernelEvents))
-], ModelUsageJobs);
-export { ModelUsageJobs };
-/** The usage report queue's registration, shared by the producer and the reporter's module. */
-const USAGE_REPORT_QUEUE_MODULE = QueueModule.registerQueue(USAGE_REPORT_QUEUE);
-/** The usage report queue and its `model_usage` producer (no dependency on the extension host). */
+    __param(1, Inject(OutboxService)),
+    __param(2, Inject(UsageSubscribers)),
+    __param(3, Inject(TransactionHost))
+], UsageReportJobs);
+export { UsageReportJobs };
+/** The usage report producer (no queue, no dependency on the extension host). */
 let UsageReportJobsModule = class UsageReportJobsModule {
 };
 UsageReportJobsModule = __decorate([
     Module({
-        imports: [USAGE_REPORT_QUEUE_MODULE],
-        providers: [ModelUsageJobs],
-        exports: [ModelUsageJobs, USAGE_REPORT_QUEUE_MODULE],
+        imports: [UsageSubscribersModule],
+        providers: [UsageReportJobs],
+        exports: [UsageReportJobs],
     })
 ], UsageReportJobsModule);
 export { UsageReportJobsModule };