@capybara-hq/kernel 0.1.0-rc.24 → 0.1.0-rc.26

package/dist/catalog/scope-sync.d.ts

@@ -1,13 +1,12 @@
-import { WorkerHost } from "@nestjs/bullmq";
-import type { Job, Queue, Worker } from "bullmq";
 import { ExtensionLifecycle } from "../extensions/lifecycle.js";
 import { ExtensionRegistry } from "../extensions/registry.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
 import { LockService } from "../infra/lock/lock.service.js";
-import type { OneJob } from "../infra/queue/add-job-once.js";
+import { OutboxService } from "../infra/outbox/outbox.service.js";
 import type { KernelLogger } from "../log.js";
 import { PluginInstaller } from "./plugin-install.js";
+import { type ScopeJob } from "./scope-jobs.js";
 /**
  * The plugin scope sync (plugin and component management spec §5, phase 1): converges every org
  * to each platform plugin's scope. In phase 1 "on in an org" is the org's plugin install, so for
@@ -30,55 +29,29 @@ import { PluginInstaller } from "./plugin-install.js";
  * super admin's inbox, until a later sync of the pair does not fail) and not retried until the next
  * enqueue. An error outside those steps (a read, the failure write itself) ends the attempt without
  * touching the pair's row, so an older failure stays open.
- * Every worker start enqueues every live item once ({@link PluginScopeSync.enqueueAll}), which
- * also catches a lost enqueue.
  *
  * Jobs (queue {@link PLUGIN_SCOPE_QUEUE}): one per item and scope version
  * (`scope-item-<itemId>-<scope_version>`, every org), one per org (`scope-org-<orgId>`, every item,
- * enqueued after the org is created). Both are removed when done, so the next enqueue with the same
+ * owed by the org's creation). Both are owed in the outbox by the transaction that changes what
+ * they converge to (transactional outbox spec §8.1), so none is lost; a migration that changes a
+ * scope inserts its outbox rows itself. A confirmation (import, permissions, org upload) owes the
+ * immediate item job after its deploy and, in its commit, a backstop `scope-item-backstop` due
+ * five minutes later (ruling R24) that waits, retrying, for the extension to be enabled. Both are removed when done, so the next add with the same
  * id is not swallowed. Pairs of one org are serialized across replicas by a Redis lock per org; the
  * installer's org row lock and its one-live-install rule are the backstop.
  */
-/** The scope sync queue (no `:` in the name). */
-export declare const PLUGIN_SCOPE_QUEUE = "cap-kernel-plugin-scope";
-/** The job converging one item in every org. */
-export declare const SCOPE_ITEM_JOB = "scope-item";
-/** The job converging every item in one org. */
-export declare const SCOPE_ORG_JOB = "scope-org";
-/** One item job per scope version (no `:`: item ids are UUIDs). */
-export declare const scopeItemJobId: (itemId: string, version: number) => string;
-/** One org job at a time per org. */
-export declare const scopeOrgJobId: (orgId: string) => string;
-/**
- * The delayed retry `n` of an item job whose extension this replica had not loaded yet (ruling
- * P3-38); deterministic, so replicas deferring the same item add it once.
- */
-export declare const scopeRetryJobId: (itemId: string, version: number, n: number) => string;
+export { PLUGIN_SCOPE_QUEUE, SCOPE_BACKSTOP_DELAY, SCOPE_BACKSTOP_DELAY_MS, SCOPE_BACKSTOP_JOB, SCOPE_ITEM_JOB, SCOPE_ORG_JOB, type ScopeJob, scopeBackstopJobId, scopeItemJobId, scopeOrgJobId, scopeRetryJobId, } from "./scope-jobs.js";
 /** How many delayed retries an item job gets while its extension is not loaded here (P3-38). */
 export declare const SCOPE_LOAD_RETRIES = 6;
 /** The delay of each such retry. */
 export declare const SCOPE_LOAD_RETRY_DELAY_MS = 5000;
 /** How long a pair waits for this replica's reconcile before deferring (P3-38). */
 export declare const SCOPE_RECONCILE_WAIT_MS = 10000;
-/**
- * The job's data. `retry`: the item job's delayed retry number (P3-38); at
- * {@link SCOPE_LOAD_RETRIES} an extension still not loaded is a failure as before.
- */
-export type ScopeJob = {
-    kind: "item";
-    itemId: string;
-    retry?: number;
-} | {
-    kind: "org";
-    orgId: string;
-};
 /**
  * Awaits this replica's extension reconcile for at most `ms` (a slower one carries on in the
  * background); a failure only warns.
  */
 export declare function reconcileWithin(lifecycle: Pick<ExtensionLifecycle, "reconcile">, reason: string, ms: number, log: Pick<KernelLogger, "warn">): Promise<void>;
-/** The item job of a scope version (what {@link PluginScopeSync.enqueueItem} adds). */
-export declare function scopeItemJob(itemId: string, version: number): OneJob<ScopeJob>;
 /**
  * What a sync of one (item, org) did. `deferred`: the plugin's extension is enabled on the
  * deployment but not loaded on this replica yet (P3-38); the item job retries later.
@@ -88,7 +61,7 @@ export type ScopeSyncResult = "installed" | "removed" | "needs_config" | "unchan
 export declare const PLUGIN_SCOPE_CONCURRENCY = 2;
 export declare class PluginScopeSync {
     private readonly kdb;
-    private readonly queue;
+    private readonly outbox;
     private readonly installer;
     private readonly registry;
     /** This replica's reconcile, awaited (bounded) before deferring an install (P3-38). */
@@ -96,23 +69,44 @@ export declare class PluginScopeSync {
     private readonly locks;
     private readonly log;
     readonly txHost: TransactionHost;
-    constructor(kdb: KernelDb, queue: Queue<ScopeJob>, installer: PluginInstaller, registry: ExtensionRegistry, 
+    /** The backstop's delay (a test seam; default {@link SCOPE_BACKSTOP_DELAY_MS}). */
+    private readonly backstopDelayMs;
+    constructor(kdb: KernelDb, outbox: Pick<OutboxService, "add">, installer: PluginInstaller, registry: ExtensionRegistry, 
     /** This replica's reconcile, awaited (bounded) before deferring an install (P3-38). */
-    lifecycle: ExtensionLifecycle, locks: LockService, log: KernelLogger, txHost: TransactionHost);
+    lifecycle: ExtensionLifecycle, locks: LockService, log: KernelLogger, txHost: TransactionHost, 
+    /** The backstop's delay (a test seam; default {@link SCOPE_BACKSTOP_DELAY_MS}). */
+    backstopDelayMs?: number);
     private get db();
-    /** Enqueues the sync of an item in every org, once per scope version. Call after the commit. */
+    /**
+     * Owes the sync of an item in every org, once per scope version (the version read in the
+     * caller's transaction, so after its own bump), in the transaction that changes the scope.
+     */
     enqueueItem(itemId: string): Promise<void>;
     /**
-     * Enqueues the sync of every live, not builtin item (a worker start): retries what failed or was
-     * never enqueued (a lost `afterCommit` enqueue, a migrated scope). The job ids are the items'
-     * scope versions, so replicas starting together add each one once.
+     * Owes the delayed backstop of the item's sync (ruling R24) in the transaction in context: a
+     * confirmation owes it before (or with) its deploy, so a crash before its post-deploy add still
+     * converges the orgs.
      */
-    enqueueAll(): Promise<void>;
-    /** Enqueues the sync of every item in an org (a new org). Call after the commit. */
+    enqueueBackstop(itemId: string): Promise<void>;
+    /** Owes the sync of every item in an org, in the transaction that creates the org. */
     enqueueOrg(orgId: string): Promise<void>;
-    /** One job: every org of an item, or every item of an org; `signal` stops between pairs. */
+    /**
+     * One job: every org of an item, or every item of an org; `signal` stops between pairs. A
+     * backstop job first checks the item's extension is deployed ({@link assertDeployed}).
+     */
     process(data: ScopeJob, signal?: AbortSignal): Promise<void>;
-    /** The delayed retry `n` of an item job (deterministic id, P3-38). */
+    /**
+     * A backstop job (ruling R24) runs only once the item's extension is loaded here or enabled on
+     * the deployment; otherwise it throws, so BullMQ retries it with its backoff (bounded by its
+     * attempts) and no pair records a `catalog.not_deployed` failure that nothing would retry. An item without an
+     * extension, or one no longer live (deleted, disabled, still waiting, builtin), passes: its pairs
+     * converge (or change nothing) as for an immediate job.
+     */
+    private assertDeployed;
+    /**
+     * Owes the delayed retry `n` of an item job (deterministic id, P3-38) in a transaction of its
+     * own: the job's own follow-up, delivered by the relay once due.
+     */
     private enqueueRetry;
     /**
      * Whether the install of the item's `version` may go ahead on this replica (P3-38): its
@@ -155,22 +149,3 @@ export declare class PluginScopeSync {
     private failed;
     private recordFailure;
 }
-/** The consumer of {@link PLUGIN_SCOPE_QUEUE}: {@link PluginScopeSync}. */
-export declare class PluginScopeSyncProcessor extends WorkerHost<Worker<ScopeJob>> {
-    private readonly sync;
-    private readonly log;
-    private readonly stopping;
-    constructor(sync: PluginScopeSync, log: Pick<KernelLogger, "error">);
-    process(job: Job<ScopeJob>): Promise<void>;
-    /** Starts consuming (worker role, after the extensions loaded; built with `autorun: false`). */
-    start(): void;
-    /**
-     * Enqueues every live item's sync once (the worker role, after the start gate opened), in the
-     * background; a failure is only logged (the next worker start, or the next change, enqueues).
-     */
-    resync(): void;
-    /** Stops between pairs and closes the worker. */
-    close(): Promise<void>;
-    failed(job: Job<ScopeJob> | undefined, err: Error): void;
-    error(err: Error): void;
-}

package/dist/catalog/scope-sync.js

@@ -7,8 +7,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-import { getQueueToken, OnWorkerEvent, WorkerHost } from "@nestjs/bullmq";
-import { Inject, Injectable } from "@nestjs/common";
+import { Inject, Injectable, Optional } from "@nestjs/common";
 import { ApiError } from "../errors.js";
 import { ExtensionLifecycle } from "../extensions/lifecycle.js";
 import { ExtensionRegistry } from "../extensions/registry.js";
@@ -17,12 +16,13 @@ import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
 import { Transactional } from "../infra/database/transactional.decorator.js";
 import { LockService } from "../infra/lock/lock.service.js";
-import { runJob } from "../infra/queue/run-job.js";
+import { OutboxService } from "../infra/outbox/outbox.service.js";
 import { KERNEL_LOGGER } from "../infra/tokens.js";
 import { connectorTemplatesOn, templateIdOfPath } from "./component-state.js";
 import { isUsable } from "./ownership.js";
 import { PluginInstaller } from "./plugin-install.js";
 import { wantedOn } from "./scope.js";
+import { oweScopeItem, PLUGIN_SCOPE_QUEUE, SCOPE_BACKSTOP_DELAY, SCOPE_BACKSTOP_DELAY_MS, SCOPE_ITEM_JOB, SCOPE_ORG_JOB, scopeOrgJobId, scopeRetryJobId, } from "./scope-jobs.js";
 import { ScopeNoLongerWanted, ScopeStillWanted } from "./scope-state.js";
 /**
  * The plugin scope sync (plugin and component management spec §5, phase 1): converges every org
@@ -46,30 +46,18 @@ import { ScopeNoLongerWanted, ScopeStillWanted } from "./scope-state.js";
  * super admin's inbox, until a later sync of the pair does not fail) and not retried until the next
  * enqueue. An error outside those steps (a read, the failure write itself) ends the attempt without
  * touching the pair's row, so an older failure stays open.
- * Every worker start enqueues every live item once ({@link PluginScopeSync.enqueueAll}), which
- * also catches a lost enqueue.
  *
  * Jobs (queue {@link PLUGIN_SCOPE_QUEUE}): one per item and scope version
  * (`scope-item-<itemId>-<scope_version>`, every org), one per org (`scope-org-<orgId>`, every item,
- * enqueued after the org is created). Both are removed when done, so the next enqueue with the same
+ * owed by the org's creation). Both are owed in the outbox by the transaction that changes what
+ * they converge to (transactional outbox spec §8.1), so none is lost; a migration that changes a
+ * scope inserts its outbox rows itself. A confirmation (import, permissions, org upload) owes the
+ * immediate item job after its deploy and, in its commit, a backstop `scope-item-backstop` due
+ * five minutes later (ruling R24) that waits, retrying, for the extension to be enabled. Both are removed when done, so the next add with the same
  * id is not swallowed. Pairs of one org are serialized across replicas by a Redis lock per org; the
  * installer's org row lock and its one-live-install rule are the backstop.
  */
-/** The scope sync queue (no `:` in the name). */
-export const PLUGIN_SCOPE_QUEUE = "cap-kernel-plugin-scope";
-/** The job converging one item in every org. */
-export const SCOPE_ITEM_JOB = "scope-item";
-/** The job converging every item in one org. */
-export const SCOPE_ORG_JOB = "scope-org";
-/** One item job per scope version (no `:`: item ids are UUIDs). */
-export const scopeItemJobId = (itemId, version) => `scope-item-${itemId}-${version}`;
-/** One org job at a time per org. */
-export const scopeOrgJobId = (orgId) => `scope-org-${orgId}`;
-/**
- * The delayed retry `n` of an item job whose extension this replica had not loaded yet (ruling
- * P3-38); deterministic, so replicas deferring the same item add it once.
- */
-export const scopeRetryJobId = (itemId, version, n) => `scope-item-${itemId}-${version}-r${n}`;
+export { PLUGIN_SCOPE_QUEUE, SCOPE_BACKSTOP_DELAY, SCOPE_BACKSTOP_DELAY_MS, SCOPE_BACKSTOP_JOB, SCOPE_ITEM_JOB, SCOPE_ORG_JOB, scopeBackstopJobId, scopeItemJobId, scopeOrgJobId, scopeRetryJobId, } from "./scope-jobs.js";
 /** How many delayed retries an item job gets while its extension is not loaded here (P3-38). */
 export const SCOPE_LOAD_RETRIES = 6;
 /** The delay of each such retry. */
@@ -98,19 +86,6 @@ export async function reconcileWithin(lifecycle, reason, ms, log) {
             clearTimeout(timer);
     }
 }
-/** The item job of a scope version (what {@link PluginScopeSync.enqueueItem} adds). */
-export function scopeItemJob(itemId, version) {
-    return {
-        name: SCOPE_ITEM_JOB,
-        data: { kind: "item", itemId },
-        opts: {
-            jobId: scopeItemJobId(itemId, version),
-            attempts: 1,
-            removeOnComplete: true,
-            removeOnFail: true,
-        },
-    };
-}
 /** How long one org's pairs wait for each other (an install can take a while). */
 const ORG_LOCK_TTL_MS = 60_000;
 const ORG_LOCK_WAIT_MS = 10 * 60_000;
@@ -119,62 +94,67 @@ export const PLUGIN_SCOPE_CONCURRENCY = 2;
 const LIVE = ["installing", "installed", "upgrading"];
 let PluginScopeSync = class PluginScopeSync {
     kdb;
-    queue;
+    outbox;
     installer;
     registry;
     lifecycle;
     locks;
     log;
     txHost;
-    constructor(kdb, queue, installer, registry, 
+    backstopDelayMs;
+    constructor(kdb, outbox, installer, registry, 
     /** This replica's reconcile, awaited (bounded) before deferring an install (P3-38). */
-    lifecycle, locks, log, txHost) {
+    lifecycle, locks, log, txHost, 
+    /** The backstop's delay (a test seam; default {@link SCOPE_BACKSTOP_DELAY_MS}). */
+    backstopDelayMs = SCOPE_BACKSTOP_DELAY_MS) {
         this.kdb = kdb;
-        this.queue = queue;
+        this.outbox = outbox;
         this.installer = installer;
         this.registry = registry;
         this.lifecycle = lifecycle;
         this.locks = locks;
         this.log = log;
         this.txHost = txHost;
+        this.backstopDelayMs = backstopDelayMs;
     }
     get db() {
         return this.kdb.db;
     }
-    /** Enqueues the sync of an item in every org, once per scope version. Call after the commit. */
+    /**
+     * Owes the sync of an item in every org, once per scope version (the version read in the
+     * caller's transaction, so after its own bump), in the transaction that changes the scope.
+     */
     async enqueueItem(itemId) {
-        const row = await this.db
-            .selectFrom("catalog_items")
-            .select("scope_version")
-            .where("id", "=", itemId)
-            .executeTakeFirst();
-        if (!row)
-            return;
-        const job = scopeItemJob(itemId, row.scope_version);
-        await this.queue.add(job.name, job.data, job.opts);
+        await oweScopeItem(this.outbox, this.db, itemId);
     }
     /**
-     * Enqueues the sync of every live, not builtin item (a worker start): retries what failed or was
-     * never enqueued (a lost `afterCommit` enqueue, a migrated scope). The job ids are the items'
-     * scope versions, so replicas starting together add each one once.
+     * Owes the delayed backstop of the item's sync (ruling R24) in the transaction in context: a
+     * confirmation owes it before (or with) its deploy, so a crash before its post-deploy add still
+     * converges the orgs.
      */
-    async enqueueAll() {
-        const items = await this.db
-            .selectFrom("catalog_items")
-            .select("id")
-            .where("deleted_at", "is", null)
-            .where("builtin", "=", false)
-            .orderBy("id")
-            .execute();
-        for (const i of items)
-            await this.enqueueItem(i.id);
+    async enqueueBackstop(itemId) {
+        await oweScopeItem(this.outbox, this.db, itemId, {
+            backstop: true,
+            backstopDelayMs: this.backstopDelayMs,
+        });
     }
-    /** Enqueues the sync of every item in an org (a new org). Call after the commit. */
+    /** Owes the sync of every item in an org, in the transaction that creates the org. */
     async enqueueOrg(orgId) {
-        await this.queue.add(SCOPE_ORG_JOB, { kind: "org", orgId }, { jobId: scopeOrgJobId(orgId), attempts: 1, removeOnComplete: true, removeOnFail: true });
+        await this.outbox.add({
+            queue: PLUGIN_SCOPE_QUEUE,
+            name: SCOPE_ORG_JOB,
+            jobId: scopeOrgJobId(orgId),
+            data: { kind: "org", orgId },
+            orgId,
+        });
     }
-    /** One job: every org of an item, or every item of an org; `signal` stops between pairs. */
+    /**
+     * One job: every org of an item, or every item of an org; `signal` stops between pairs. A
+     * backstop job first checks the item's extension is deployed ({@link assertDeployed}).
+     */
     async process(data, signal) {
+        if (data.kind === "item" && data.backstop === true)
+            await this.assertDeployed(data.itemId);
         const pairs = data.kind === "item"
             ? (await this.db
                 .selectFrom("orgs")
@@ -214,7 +194,55 @@ let PluginScopeSync = class PluginScopeSync {
             }
         }
     }
-    /** The delayed retry `n` of an item job (deterministic id, P3-38). */
+    /**
+     * A backstop job (ruling R24) runs only once the item's extension is loaded here or enabled on
+     * the deployment; otherwise it throws, so BullMQ retries it with its backoff (bounded by its
+     * attempts) and no pair records a `catalog.not_deployed` failure that nothing would retry. An item without an
+     * extension, or one no longer live (deleted, disabled, still waiting, builtin), passes: its pairs
+     * converge (or change nothing) as for an immediate job.
+     */
+    async assertDeployed(itemId) {
+        const item = await this.db
+            .selectFrom("catalog_items")
+            .select([
+            "builtin",
+            "disabled",
+            "deleted_at",
+            "awaiting_confirmation",
+            "latest_version",
+            "platform_synced_version",
+        ])
+            .where("id", "=", itemId)
+            .executeTakeFirst();
+        if (!item || item.builtin || !isUsable(item))
+            return;
+        const version = item.platform_synced_version ?? item.latest_version;
+        const v = await this.db
+            .selectFrom("catalog_item_versions")
+            .select("manifest")
+            .where("item_id", "=", itemId)
+            .where("version", "=", version)
+            .executeTakeFirst();
+        const m = v?.manifest;
+        if (!m?.extension)
+            return;
+        // loaded here (a config-declared extension has no install record), or enabled on the
+        // deployment (a replica that has not loaded it yet defers as P3-38 says)
+        if (this.registry.manifests().some((x) => x.name === m.name))
+            return;
+        const install = await this.db
+            .selectFrom("extension_installs")
+            .select("desired_state")
+            .where("name", "=", m.name)
+            .executeTakeFirst();
+        if (install?.desired_state === "enabled")
+            return;
+        throw new Error(`the extension ${m.name} of catalog item ${itemId} is not enabled on the deployment yet; the scope sync backstop is retried`);
+    }
+    /**
+     * Owes the delayed retry `n` of an item job (deterministic id, P3-38) in a transaction of its
+     * own: the job's own follow-up, delivered by the relay once due.
+     */
     async enqueueRetry(itemId, n) {
         const row = await this.db
             .selectFrom("catalog_items")
@@ -223,12 +251,12 @@ let PluginScopeSync = class PluginScopeSync {
             .executeTakeFirst();
         if (!row)
             return;
-        await this.queue.add(SCOPE_ITEM_JOB, { kind: "item", itemId, retry: n }, {
+        await this.outbox.add({
+            queue: PLUGIN_SCOPE_QUEUE,
+            name: SCOPE_ITEM_JOB,
             jobId: scopeRetryJobId(itemId, row.scope_version, n),
-            delay: SCOPE_LOAD_RETRY_DELAY_MS,
-            attempts: 1,
-            removeOnComplete: true,
-            removeOnFail: true,
+            data: { kind: "item", itemId, retry: n },
+            runAt: new Date(Date.now() + SCOPE_LOAD_RETRY_DELAY_MS),
         });
     }
     /**
@@ -509,68 +537,32 @@ let PluginScopeSync = class PluginScopeSync {
             .execute();
     }
 };
+__decorate([
+    Transactional({ propagation: "mandatory" })
+], PluginScopeSync.prototype, "enqueueItem", null);
+__decorate([
+    Transactional({ propagation: "mandatory" })
+], PluginScopeSync.prototype, "enqueueBackstop", null);
+__decorate([
+    Transactional({ propagation: "mandatory" })
+], PluginScopeSync.prototype, "enqueueOrg", null);
+__decorate([
+    Transactional()
+], PluginScopeSync.prototype, "enqueueRetry", null);
 __decorate([
     Transactional({ propagation: "requires_new" })
 ], PluginScopeSync.prototype, "recordFailure", null);
 PluginScopeSync = __decorate([
     Injectable(),
     __param(0, Inject(KernelDb)),
-    __param(1, Inject(getQueueToken(PLUGIN_SCOPE_QUEUE))),
+    __param(1, Inject(OutboxService)),
     __param(2, Inject(PluginInstaller)),
     __param(3, Inject(ExtensionRegistry)),
     __param(4, Inject(ExtensionLifecycle)),
     __param(5, Inject(LockService)),
     __param(6, Inject(KERNEL_LOGGER)),
-    __param(7, Inject(TransactionHost))
+    __param(7, Inject(TransactionHost)),
+    __param(8, Optional()),
+    __param(8, Inject(SCOPE_BACKSTOP_DELAY))
 ], PluginScopeSync);
 export { PluginScopeSync };
-/** The consumer of {@link PLUGIN_SCOPE_QUEUE}: {@link PluginScopeSync}. */
-let PluginScopeSyncProcessor = class PluginScopeSyncProcessor extends WorkerHost {
-    sync;
-    log;
-    stopping = new AbortController();
-    constructor(sync, log) {
-        super();
-        this.sync = sync;
-        this.log = log;
-    }
-    process(job) {
-        return runJob(PLUGIN_SCOPE_QUEUE, job, () => this.sync.process(job.data, this.stopping.signal));
-    }
-    /** Starts consuming (worker role, after the extensions loaded; built with `autorun: false`). */
-    start() {
-        void this.worker.run().catch((err) => this.error(err));
-    }
-    /**
-     * Enqueues every live item's sync once (the worker role, after the start gate opened), in the
-     * background; a failure is only logged (the next worker start, or the next change, enqueues).
-     */
-    resync() {
-        void this.sync
-            .enqueueAll()
-            .catch((err) => this.log.error("plugin scope resync failed", { err }));
-    }
-    /** Stops between pairs and closes the worker. */
-    async close() {
-        this.stopping.abort();
-        await this.worker.close();
-    }
-    failed(job, err) {
-        this.log.error("plugin scope job failed", { name: job?.name, jobId: job?.id, err });
-    }
-    error(err) {
-        this.log.error("plugin scope worker error", { err });
-    }
-};
-__decorate([
-    OnWorkerEvent("failed")
-], PluginScopeSyncProcessor.prototype, "failed", null);
-__decorate([
-    OnWorkerEvent("error")
-], PluginScopeSyncProcessor.prototype, "error", null);
-PluginScopeSyncProcessor = __decorate([
-    Injectable(),
-    __param(0, Inject(PluginScopeSync)),
-    __param(1, Inject(KERNEL_LOGGER))
-], PluginScopeSyncProcessor);
-export { PluginScopeSyncProcessor };

package/dist/channels/channels.module.d.ts

@@ -9,14 +9,15 @@ import { ChannelOutbound } from "./outbound.js";
  * Channels on every role: the org's channel connections, inbound (dedupe and enqueue; the inbound
  * jobs), the outbound delivery, the producer of the channel queue `cap-kernel-channels`, the
  * anonymous guests. The roles' parts are the role modules': the queue's consumer
- * ({@link ChannelWorkersModule}) and the gateway check job are the worker role's, the long-connection
- * supervisor and the webhook inbound the gateway role's (`GatewayModule`).
+ * ({@link ChannelWorkersModule}) and the gateway check job are the worker role's, the
+ * long-connection supervisor and the webhook inbound the gateway role's (`GatewayModule`).
  */
 export declare class ChannelsModule {
 }
 /**
  * The consumer of `cap-kernel-channels`: deliveries (`DELIVER_JOB`, owed through the outbox or
- * hinted) and inbound jobs (`INBOUND_JOB`), both handled by {@link ChannelOutbound}.
+ * hinted), a connection's catch-up (`RESUME_JOB`, owed) and inbound jobs (`INBOUND_JOB`), all
+ * handled by {@link ChannelOutbound}.
  */
 export declare class ChannelsProcessor extends WorkerHost<Worker<ChannelJobData>> {
     private readonly outbound;
@@ -32,11 +33,11 @@ export declare class ChannelsProcessor extends WorkerHost<Worker<ChannelJobData>
  */
 export declare function channelsProcessorOptions(config: Pick<KernelConfig, "runtime" | "channels">): ProcessorWorkerOptions;
 /**
- * The consumer of the channel queue (concurrency `channels.deliveryConcurrency`, the run queue's job
- * lock and stalled detection, the delivery backoff). Imported only by the worker role
- * (`WorkerModule`), so other roles get no processor and no BullMQ worker. It never starts by itself:
- * the worker role (`WorkerRole`) starts it after the extension load; `ChannelOutbound.close` closes it
- * on stop.
+ * The consumer of the channel queue (concurrency `channels.deliveryConcurrency`, the run queue's
+ * job lock and stalled detection, the delivery backoff). Imported only by the worker role
+ * (`WorkerModule`), so other roles get no processor and no BullMQ worker. It never starts by
+ * itself: the worker role (`WorkerRole`) starts it after the extension load;
+ * `ChannelOutbound.close` closes it on stop.
  */
 export declare class ChannelWorkersModule {
     static forRoot(config: KernelConfig): DynamicModule;

package/dist/channels/channels.module.js

@@ -26,7 +26,7 @@ import { SchedulesModule } from "../schedules/schedules.module.js";
 import { ToolsModule } from "../tools/tools.module.js";
 import { ChannelConnections } from "./connections.service.js";
 import { ChannelInbound } from "./inbound.js";
-import { CHANNEL_QUEUE_NAME, ChannelJobs, DELIVER_JOB, INBOUND_JOB, } from "./jobs.js";
+import { CHANNEL_QUEUE_NAME, ChannelJobs, DELIVER_JOB, INBOUND_JOB, RESUME_JOB, } from "./jobs.js";
 import { ChannelOutbound, deliverBackoff } from "./outbound.js";
 import { AnonymousGuestLock, AnonymousGuests } from "./threads.js";
 /** The channel queue's registration (its producer here; the admin health reads its counts). */
@@ -35,8 +35,8 @@ const CHANNEL_QUEUE_MODULE = QueueModule.registerQueue(CHANNEL_QUEUE_NAME);
  * Channels on every role: the org's channel connections, inbound (dedupe and enqueue; the inbound
  * jobs), the outbound delivery, the producer of the channel queue `cap-kernel-channels`, the
  * anonymous guests. The roles' parts are the role modules': the queue's consumer
- * ({@link ChannelWorkersModule}) and the gateway check job are the worker role's, the long-connection
- * supervisor and the webhook inbound the gateway role's (`GatewayModule`).
+ * ({@link ChannelWorkersModule}) and the gateway check job are the worker role's, the
+ * long-connection supervisor and the webhook inbound the gateway role's (`GatewayModule`).
  */
 let ChannelsModule = class ChannelsModule {
 };
@@ -77,7 +77,8 @@ ChannelsModule = __decorate([
 export { ChannelsModule };
 /**
  * The consumer of `cap-kernel-channels`: deliveries (`DELIVER_JOB`, owed through the outbox or
- * hinted) and inbound jobs (`INBOUND_JOB`), both handled by {@link ChannelOutbound}.
+ * hinted), a connection's catch-up (`RESUME_JOB`, owed) and inbound jobs (`INBOUND_JOB`), all
+ * handled by {@link ChannelOutbound}.
  */
 let ChannelsProcessor = class ChannelsProcessor extends WorkerHost {
     outbound;
@@ -86,7 +87,7 @@ let ChannelsProcessor = class ChannelsProcessor extends WorkerHost {
         this.outbound = outbound;
     }
     process(job, token) {
-        if (job.name !== DELIVER_JOB && job.name !== INBOUND_JOB) {
+        if (job.name !== DELIVER_JOB && job.name !== INBOUND_JOB && job.name !== RESUME_JOB) {
             return Promise.reject(new UnrecoverableError(`unknown channel job "${job.name}"`));
         }
         return runJob(CHANNEL_QUEUE_NAME, job, () => this.outbound.process(job, token));
@@ -124,11 +125,11 @@ export function channelsProcessorOptions(config) {
     };
 }
 /**
- * The consumer of the channel queue (concurrency `channels.deliveryConcurrency`, the run queue's job
- * lock and stalled detection, the delivery backoff). Imported only by the worker role
- * (`WorkerModule`), so other roles get no processor and no BullMQ worker. It never starts by itself:
- * the worker role (`WorkerRole`) starts it after the extension load; `ChannelOutbound.close` closes it
- * on stop.
+ * The consumer of the channel queue (concurrency `channels.deliveryConcurrency`, the run queue's
+ * job lock and stalled detection, the delivery backoff). Imported only by the worker role
+ * (`WorkerModule`), so other roles get no processor and no BullMQ worker. It never starts by
+ * itself: the worker role (`WorkerRole`) starts it after the extension load;
+ * `ChannelOutbound.close` closes it on stop.
  */
 let ChannelWorkersModule = ChannelWorkersModule_1 = class ChannelWorkersModule {
     static forRoot(config) {

package/dist/channels/connections.service.d.ts

@@ -123,7 +123,7 @@ export declare class ChannelConnections implements OnApplicationShutdown {
     private readonly registry;
     private readonly bus;
     private readonly redis;
-    /** A connection that can deliver again catches up its conversations (`resumeConnection`). */
+    /** A connection that can deliver again owes its conversations' catch-up (`oweResume`). */
     private readonly jobs;
     /** `channels.webhookBaseUrl`: without it webhook mode is unavailable. */
     private readonly config;
@@ -138,8 +138,8 @@ export declare class ChannelConnections implements OnApplicationShutdown {
     constructor(db: KernelDb, 
     /** The org row lock (orgs/org-lock.ts): joins the transaction of the write. */
     orgLock: Pick<OrgLock, "lockAndAuthorize">, keyring: Keyring, registry: Pick<ExtensionRegistry, "list">, bus: ExtensionContext["bus"], redis: Pick<Redis, "del">, 
-    /** A connection that can deliver again catches up its conversations (`resumeConnection`). */
-    jobs: Pick<ChannelJobs, "resumeConnection">, 
+    /** A connection that can deliver again owes its conversations' catch-up (`oweResume`). */
+    jobs: Pick<ChannelJobs, "oweResume">, 
     /** `channels.webhookBaseUrl`: without it webhook mode is unavailable. */
     config: Pick<KernelConfigService, "get">, events: Pick<KernelEvents, "on">, 
     /** Secret values handled here (written or decrypted) are redacted from the logs (`addOrgSecrets`). */

package/dist/channels/connections.service.js

@@ -154,7 +154,7 @@ let ChannelConnections = class ChannelConnections {
     constructor(db, 
     /** The org row lock (orgs/org-lock.ts): joins the transaction of the write. */
     orgLock, keyring, registry, bus, redis, 
-    /** A connection that can deliver again catches up its conversations (`resumeConnection`). */
+    /** A connection that can deliver again owes its conversations' catch-up (`oweResume`). */
     jobs, 
     /** `channels.webhookBaseUrl`: without it webhook mode is unavailable. */
     config, events, 
@@ -546,11 +546,6 @@ let ChannelConnections = class ChannelConnections {
         }
         // A mode switch also reconnects: the holder drops the long connection when going to webhook (F9)
         await this.changed(id, rotated !== undefined || patch.status !== undefined || modeChanged);
-        if ((rotated || patch.status === "active") && row.status === "active") {
-            await this.jobs
-                .resumeConnection(id)
-                .catch((err) => this.log.warn("cannot resume channel deliveries", { err }));
-        }
         return { channel: await this.viewOf(row), verifySkipped };
     }
     /** The rows of {@link update}, in their own transaction (the caller publishes after the commit). */
@@ -592,6 +587,11 @@ let ChannelConnections = class ChannelConnections {
             .executeTakeFirst();
         if (!updated)
             throw notFound();
+        // can deliver again (re-enabled, or new credentials while active): the conversations that fell
+        // behind meanwhile are caught up by a job owed here (transactional outbox spec §3.1)
+        if ((rotated || patch.status === "active") && updated.status === "active") {
+            await this.jobs.oweResume(id, orgId, updated.updated_at);
+        }
         await audit(this.db.db, {
             actorAccountId,
             ...(actorTokenId !== undefined && { actorTokenId }),