@getstrata/core 2.0.2 → 2.0.3

package/dist/index.js

@@ -221,6 +221,12 @@ var init_dialect = __esm(() => {
     nowExpression() {
       return "NOW()";
     },
+    epochMillisecondsExpression() {
+      return "CAST(EXTRACT(EPOCH FROM clock_timestamp()) * 1000 AS BIGINT)";
+    },
+    rowLockClause(skipLocked = false) {
+      return ` FOR UPDATE${skipLocked ? " SKIP LOCKED" : ""}`;
+    },
     timestampValue(value) {
       return value.toISOString();
     },
@@ -259,6 +265,12 @@ var init_dialect = __esm(() => {
     nowExpression() {
       return "CURRENT_TIMESTAMP";
     },
+    epochMillisecondsExpression() {
+      return "CAST(UNIX_TIMESTAMP(CURRENT_TIMESTAMP(3)) * 1000 AS UNSIGNED)";
+    },
+    rowLockClause(skipLocked = false) {
+      return ` FOR UPDATE${skipLocked ? " SKIP LOCKED" : ""}`;
+    },
     timestampValue(value) {
       return value.toISOString().slice(0, 19).replace("T", " ");
     },
@@ -297,6 +309,12 @@ var init_dialect = __esm(() => {
     nowExpression() {
       return "strftime('%Y-%m-%dT%H:%M:%fZ', 'now')";
     },
+    epochMillisecondsExpression() {
+      return "CAST((julianday('now') - 2440587.5) * 86400000 AS INTEGER)";
+    },
+    rowLockClause() {
+      return "";
+    },
     timestampValue(value) {
       return value.toISOString();
     },
@@ -446,6 +464,9 @@ function unwrapTransactionRollback(error, depth = 0) {
   }
   return unwrapTransactionRollback(error.cause, depth + 1);
 }
+function hasActiveTransaction() {
+  return hasActiveDatabaseConnection() && (transactionScopes.getStore()?.rollback.length ?? 0) > 0;
+}
 function requestTransactionRollback() {
   const state = transactionScopes.getStore();
   const index = state ? state.rollback.length - 1 : -1;
@@ -499,6 +520,7 @@ async function runWithTransactionScope(callback) {
 var TransactionRollback, transactionScopes;
 var init_transactionControl = __esm(() => {
   init_asyncContextStore();
+  init_connectionContext();
   TransactionRollback = class TransactionRollback extends Error {
     result;
     constructor(result) {
@@ -711,6 +733,11 @@ var init_transaction = __esm(() => {
 });
 
 // ../../src/core/tenant/databaseTenantContext.ts
+async function applyBypassToTransaction(transaction, bypass) {
+  await transaction.unsafe(`SELECT set_config('app.bypass_rls', $1, true)`, [
+    bypass ? "true" : "false"
+  ]);
+}
 function stringifyBypassIdentifier(identifier) {
   if (typeof identifier === "number") {
     return String(identifier);
@@ -763,6 +790,9 @@ async function runWithScopedTenantTransaction(apply, callback) {
     });
   }));
 }
+async function runWithMigrationBypass(callback) {
+  return await runWithScopedTenantTransaction((transaction) => applyBypassToTransaction(transaction, true), callback);
+}
 async function runWithMigrationBypassForIdentifier(identifier, callback) {
   assertBypassIdentifier(identifier);
   return await runWithScopedTenantTransaction((transaction) => applyIdentifierToTransaction(transaction, identifier), callback);
@@ -2349,50 +2379,133 @@ function resetDnsLookupForTests() {
 
 // ../../src/core/security/safeFetch.ts
 var DEFAULT_FETCH_TIMEOUT_MS = 1e4;
+function untilAborted(work, signal) {
+  signal.throwIfAborted();
+  return new Promise((resolve, reject) => {
+    const onAbort = () => reject(signal.reason);
+    signal.addEventListener("abort", onAbort, { once: true });
+    work.then(resolve, reject).finally(() => signal.removeEventListener("abort", onAbort));
+  });
+}
+function preserveResponseMetadata(response, original) {
+  Object.defineProperties(response, {
+    url: { value: original.url },
+    redirected: { value: original.redirected },
+    type: { value: original.type }
+  });
+  const clone = response.clone.bind(response);
+  response.clone = () => preserveResponseMetadata(clone(), original);
+  return response;
+}
+function withBodyDeadline(response, signal, release) {
+  if (!response.body) {
+    release();
+    return response;
+  }
+  const reader = response.body.getReader();
+  let stopped = false;
+  let bodyController;
+  const stop = (reason, errorBody) => {
+    if (stopped)
+      return;
+    stopped = true;
+    release();
+    signal.removeEventListener("abort", onAbort);
+    if (errorBody)
+      bodyController.error(reason);
+    reader.cancel(reason).catch(() => {}).finally(() => reader.releaseLock());
+  };
+  const onAbort = () => stop(signal.reason, true);
+  const body = new ReadableStream({
+    start(controller) {
+      bodyController = controller;
+      signal.addEventListener("abort", onAbort, { once: true });
+      if (signal.aborted)
+        onAbort();
+    },
+    async pull(controller) {
+      try {
+        const result = await untilAborted(reader.read(), signal);
+        if (stopped)
+          return;
+        if (result.done) {
+          stopped = true;
+          release();
+          signal.removeEventListener("abort", onAbort);
+          reader.releaseLock();
+          controller.close();
+        } else {
+          controller.enqueue(result.value);
+        }
+      } catch (error) {
+        stop(error, true);
+      }
+    },
+    cancel(reason) {
+      stop(reason, false);
+    }
+  }, { highWaterMark: 0 });
+  return preserveResponseMetadata(new Response(body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers: response.headers
+  }), response);
+}
 async function safeFetch(input, init = {}, options = {}) {
+  init.signal?.throwIfAborted();
   const timeoutMs = options.timeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
+  if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) {
+    throw new RangeError("safeFetch timeoutMs must be a positive finite number.");
+  }
   const maxRedirects = options.maxRedirects ?? 0;
-  const resolveDns = options.resolveDns ?? true;
   const urlOptions = {
     allowHttp: options.allowHttp,
-    resolveDns,
+    resolveDns: options.resolveDns ?? true,
     allowPrivate: options.allowPrivate
   };
   const controller = new AbortController;
-  const timeout = setTimeout(() => controller.abort(), timeoutMs);
+  const forwardAbort = () => controller.abort(init.signal?.reason);
+  init.signal?.addEventListener("abort", forwardAbort, { once: true });
+  const timeout = setTimeout(() => controller.abort(new DOMException("The operation timed out.", "TimeoutError")), timeoutMs);
+  const release = () => {
+    clearTimeout(timeout);
+    init.signal?.removeEventListener("abort", forwardAbort);
+  };
   try {
-    let current = await resolveSafeOutboundTarget(input, urlOptions);
+    let current = await untilAborted(resolveSafeOutboundTarget(input, urlOptions), controller.signal);
     let redirectCount = 0;
     while (true) {
+      controller.signal.throwIfAborted();
       const address = current.addresses[0];
       const fetchUrl = address ? pinUrlToAddress(current.url, address).toString() : current.url.toString();
       const headers = new Headers(init.headers);
-      if (address && !headers.has("host")) {
+      if (address && !headers.has("host"))
         headers.set("Host", current.url.host);
-      }
       const fetchInit = {
         ...init,
         headers,
         signal: controller.signal,
         redirect: "manual"
       };
-      if (address) {
+      if (address)
         fetchInit.tls = { serverName: current.url.hostname };
-      }
-      const response = await fetch(fetchUrl, fetchInit);
+      const response = await untilAborted(fetch(fetchUrl, fetchInit), controller.signal);
       if (response.status >= 300 && response.status < 400) {
         const location = response.headers.get("location");
-        if (!location || redirectCount >= maxRedirects) {
-          return response;
+        if (location && redirectCount < maxRedirects) {
+          if (response.body)
+            await untilAborted(response.body.cancel(), controller.signal);
+          current = await untilAborted(resolveSafeOutboundTarget(new URL(location, current.url).toString(), urlOptions), controller.signal);
+          redirectCount++;
+          continue;
         }
-        current = await resolveSafeOutboundTarget(new URL(location, current.url).toString(), urlOptions);
-        redirectCount += 1;
-        continue;
       }
-      return response;
+      return withBodyDeadline(response, controller.signal, release);
     }
-  } finally {
-    clearTimeout(timeout);
+  } catch (error) {
+    controller.abort(error);
+    release();
+    throw error;
   }
 }
 
@@ -7269,6 +7382,7 @@ function registerModelRepository(model, repository) {
   return model;
 }
 // ../../src/core/database/mysqlConnection.ts
+init_connectionContext();
 var MYSQL_SESSION_UTC = "SET time_zone = '+00:00'";
 var mysqlModule;
 var mysqlPending;
@@ -7324,18 +7438,71 @@ function rowsFromResult(result) {
   }
   return [];
 }
-function createMysqlConnectionFromPool(pool) {
-  return {
+async function executeMysql(target, query, params) {
+  const [result] = params.length === 0 && target.query ? await target.query(query) : await target.execute(query, [...params]);
+  return rowsFromResult(result);
+}
+function createMysqlAdapter(getPool, close) {
+  const transactions = new WeakSet;
+  const connection = {
     async unsafe(query, params = []) {
-      const [result] = await pool.execute(query, [...params]);
-      return rowsFromResult(result);
+      const active = getActiveDatabaseConnection(connection);
+      if (transactions.has(active))
+        return active.unsafe(query, params);
+      return executeMysql(await getPool(), query, params);
     },
-    async close() {
-      if (typeof pool.end === "function") {
-        await pool.end();
+    async begin(callback) {
+      if (transactions.has(getActiveDatabaseConnection(connection))) {
+        throw new Error("Use runInTransaction for nested MySQL transactions.");
       }
-    }
+      const pool = await getPool();
+      if (!pool.getConnection)
+        throw new Error("MySQL transactions require a pool with getConnection().");
+      const reserved = await pool.getConnection();
+      let open = false;
+      let discard = false;
+      const transaction = {
+        async unsafe(query, params = []) {
+          if (!open)
+            throw new Error("MySQL transaction is no longer active.");
+          return executeMysql(reserved, query, params);
+        }
+      };
+      transactions.add(transaction);
+      try {
+        await reserved.beginTransaction();
+        open = true;
+        const result = await runWithDatabaseConnection(transaction, () => callback(transaction));
+        await reserved.commit();
+        return result;
+      } catch (error) {
+        if (open) {
+          try {
+            await reserved.rollback();
+          } catch (rollbackError) {
+            discard = true;
+            reserved.destroy();
+            throw new AggregateError([error, rollbackError], "MySQL rollback failed; connection discarded.");
+          }
+        } else {
+          discard = true;
+          reserved.destroy();
+        }
+        throw error;
+      } finally {
+        open = false;
+        if (!discard)
+          reserved.release();
+      }
+    },
+    close
   };
+  return connection;
+}
+function createMysqlConnectionFromPool(pool) {
+  return createMysqlAdapter(async () => pool, async () => {
+    await pool.end?.();
+  });
 }
 function pinSessionToUtc(connection) {
   connection.query(MYSQL_SESSION_UTC, (error) => {
@@ -7368,23 +7535,16 @@ function createMysqlConnection(url) {
     }
     return poolPending;
   }
-  return {
-    async unsafe(query, params = []) {
-      const [result] = await (await ensurePool()).execute(query, [...params]);
-      return rowsFromResult(result);
-    },
-    async close() {
-      if (!poolPending) {
-        return;
-      }
-      const pending = poolPending;
-      poolPending = undefined;
-      const pool = await pending.catch(() => {
-        return;
-      });
-      await pool?.end();
-    }
-  };
+  return createMysqlAdapter(ensurePool, async () => {
+    if (!poolPending)
+      return;
+    const pending = poolPending;
+    poolPending = undefined;
+    const pool = await pending.catch(() => {
+      return;
+    });
+    await pool?.end();
+  });
 }
 // ../../src/core/database/namedConnections.ts
 init_connectionContext();
@@ -8046,6 +8206,7 @@ async function runSeedersFromDirectory(directory, db, options) {
   return seeders.length;
 }
 // ../../src/core/database/sqliteConnection.ts
+init_connectionContext();
 import { Database } from "bun:sqlite";
 function isRowReturning(sql) {
   const upper = sql.replace(/\s+/g, " ").trim().toUpperCase();
@@ -8065,20 +8226,70 @@ function createSqliteConnection(filename) {
     db.exec("PRAGMA journal_mode = WAL");
     db.exec("PRAGMA synchronous = NORMAL");
   }
-  return {
+  let tail = Promise.resolve();
+  let pending = 0;
+  let closed = false;
+  const transactions = new WeakSet;
+  function execute(query, params) {
+    const statement = db.query(query);
+    const args = [...params];
+    if (isRowReturning(query))
+      return statement.all(...args);
+    statement.run(...args);
+    return [];
+  }
+  function enqueue(operation) {
+    if (closed)
+      return Promise.reject(new Error("SQLite connection is closed."));
+    pending++;
+    const result = tail.then(operation).finally(() => {
+      pending--;
+    });
+    tail = result.then(() => {}, () => {});
+    return result;
+  }
+  const connection = {
     async unsafe(query, params = []) {
-      const statement = db.query(query);
-      const args = [...params];
-      if (isRowReturning(query)) {
-        return statement.all(...args);
+      const active = getActiveDatabaseConnection(connection);
+      if (transactions.has(active))
+        return active.unsafe(query, params);
+      return enqueue(() => execute(query, params));
+    },
+    async begin(callback) {
+      if (transactions.has(getActiveDatabaseConnection(connection))) {
+        throw new Error("Use runInTransaction for nested SQLite transactions.");
       }
-      statement.run(...args);
-      return [];
+      return enqueue(async () => {
+        db.exec("BEGIN IMMEDIATE");
+        let open = true;
+        const transaction = {
+          async unsafe(query, params = []) {
+            if (!open)
+              throw new Error("SQLite transaction is no longer active.");
+            return execute(query, params);
+          }
+        };
+        transactions.add(transaction);
+        try {
+          const result = await runWithDatabaseConnection(transaction, () => callback(transaction));
+          db.exec("COMMIT");
+          return result;
+        } catch (error) {
+          db.exec("ROLLBACK");
+          throw error;
+        } finally {
+          open = false;
+        }
+      });
     },
     close() {
+      if (pending > 0)
+        throw new Error("Drain SQLite operations before closing the connection.");
+      closed = true;
       db.close();
     }
   };
+  return connection;
 }
 // ../../src/core/database/table.ts
 function defineTable(definition) {
@@ -8089,6 +8300,333 @@ function defineTable(definition) {
 init_transaction();
 init_eventBus();
 
+// ../../src/core/events/outbox/index.ts
+init_dialect();
+init_repositoryConnection();
+init_transaction();
+init_databaseTenantContext();
+init_tenantContext();
+init_tenantDatabaseScope();
+
+// ../../src/core/events/outbox/migration.ts
+function createOutboxMigration(name, driver, options = {}) {
+  const identity = driver === "mysql" ? " CHARACTER SET ascii COLLATE ascii_bin" : "";
+  const payloadType = driver === "mysql" ? "MEDIUMTEXT" : "TEXT";
+  const inlineIndex = driver === "mysql" ? ", INDEX strata_outbox_due (status, available_at, event_id, listener_name), INDEX strata_outbox_expired (status, lease_until, event_id, listener_name)" : "";
+  return {
+    name,
+    async up(db) {
+      await db.unsafe(`CREATE TABLE IF NOT EXISTS strata_outbox_event (
+        id VARCHAR(64)${identity} PRIMARY KEY, name VARCHAR(128)${identity} NOT NULL, version INTEGER NOT NULL CHECK (version > 0),
+        tenant_id BIGINT, payload ${payloadType} NOT NULL, created_at BIGINT NOT NULL,
+        publication_token VARCHAR(64)${identity} NOT NULL)`);
+      await db.unsafe(`CREATE TABLE IF NOT EXISTS strata_outbox_delivery (
+        event_id VARCHAR(64)${identity} NOT NULL,
+        listener_name VARCHAR(128)${identity} NOT NULL, status VARCHAR(16) NOT NULL CHECK (status IN ('pending', 'processing', 'failed', 'completed')),
+        attempts INTEGER NOT NULL DEFAULT 0 CHECK (attempts >= 0), max_attempts INTEGER NOT NULL CHECK (max_attempts > 0),
+        available_at BIGINT NOT NULL, lease_token VARCHAR(64)${identity}, lease_until BIGINT,
+        completed_at BIGINT, error_code VARCHAR(64), PRIMARY KEY (event_id, listener_name)${inlineIndex},
+        FOREIGN KEY (event_id) REFERENCES strata_outbox_event(id) ON DELETE CASCADE)`);
+      if (driver !== "mysql") {
+        await db.unsafe("CREATE INDEX IF NOT EXISTS strata_outbox_due ON strata_outbox_delivery (status, available_at, event_id, listener_name)");
+        await db.unsafe("CREATE INDEX IF NOT EXISTS strata_outbox_expired ON strata_outbox_delivery (status, lease_until, event_id, listener_name)");
+      }
+      if (driver === "pgsql" && options.rls) {
+        await db.unsafe(`ALTER TABLE strata_outbox_event ENABLE ROW LEVEL SECURITY`);
+        await db.unsafe(`ALTER TABLE strata_outbox_event FORCE ROW LEVEL SECURITY`);
+        await db.unsafe(`DROP POLICY IF EXISTS strata_outbox_scope ON strata_outbox_event`);
+        await db.unsafe(`CREATE POLICY strata_outbox_scope ON strata_outbox_event USING (
+          current_setting('app.bypass_rls', true) = 'true' OR
+          tenant_id = NULLIF(current_setting('app.tenant_id', true), '')::bigint OR
+          (tenant_id IS NULL AND NULLIF(current_setting('app.tenant_id', true), '') IS NULL))`);
+        await db.unsafe(`ALTER TABLE strata_outbox_delivery ENABLE ROW LEVEL SECURITY`);
+        await db.unsafe(`ALTER TABLE strata_outbox_delivery FORCE ROW LEVEL SECURITY`);
+        await db.unsafe(`DROP POLICY IF EXISTS strata_outbox_scope ON strata_outbox_delivery`);
+        await db.unsafe(`CREATE POLICY strata_outbox_scope ON strata_outbox_delivery USING (
+          current_setting('app.bypass_rls', true) = 'true' OR EXISTS (
+          SELECT 1 FROM strata_outbox_event WHERE id = strata_outbox_delivery.event_id))`);
+      }
+    },
+    async down(db) {
+      const [row] = await db.unsafe("SELECT COUNT(*) AS pending FROM strata_outbox_delivery WHERE status <> 'completed'");
+      if (Number(row?.pending) > 0)
+        throw new Error("Cannot drop outbox tables while undelivered events remain.");
+      await db.unsafe("DROP TABLE strata_outbox_delivery");
+      await db.unsafe("DROP TABLE strata_outbox_event");
+    }
+  };
+}
+
+// ../../src/core/events/outbox/index.ts
+function positiveInteger(value, name) {
+  if (!Number.isSafeInteger(value) || value < 1)
+    throw new Error(`${name} must be a positive integer.`);
+  return value;
+}
+function identifier(value, max) {
+  if (!value || value.length > max || !/^[\w.:-]+$/.test(value))
+    throw new Error("Invalid durable event/listener identifier.");
+  return value;
+}
+function placeholders(count) {
+  return Array.from({ length: count }, (_, index) => currentSqlDialect().placeholder(index + 1));
+}
+async function clock() {
+  const [row] = await repositoryConnection.unsafe(`SELECT ${currentSqlDialect().epochMillisecondsExpression()} AS now_ms`);
+  const now = Number(row?.now_ms);
+  if (!Number.isSafeInteger(now))
+    throw new Error("Database did not return a valid outbox clock.");
+  return now;
+}
+async function privileged(work) {
+  if (hasActiveTransaction())
+    throw new Error("Outbox coordination must run outside business transactions.");
+  for (let attempt = 0;; attempt++) {
+    try {
+      return await runWithMigrationBypass(() => runInTransaction(work));
+    } catch (error) {
+      const failure = error !== null && typeof error === "object" ? error : {};
+      const code = String(failure.errno ?? failure.code);
+      if (attempt >= 4 || !["40001", "40P01", "1213"].includes(code))
+        throw error;
+      await Bun.sleep(10 * (attempt + 1));
+    }
+  }
+}
+
+class SqlOutbox {
+  listeners = new Map;
+  leaseMs;
+  maxAttempts;
+  retryDelayMs;
+  maxPayloadBytes;
+  tenantResolver;
+  constructor(options) {
+    this.leaseMs = positiveInteger(options.leaseMs ?? 60000, "leaseMs");
+    if (this.leaseMs < 30)
+      throw new Error("leaseMs must be at least 30 milliseconds.");
+    this.maxAttempts = positiveInteger(options.maxAttempts ?? 5, "maxAttempts");
+    this.retryDelayMs = positiveInteger(options.retryDelayMs ?? 1000, "retryDelayMs");
+    this.maxPayloadBytes = positiveInteger(options.maxPayloadBytes ?? 65536, "maxPayloadBytes");
+    this.tenantResolver = options.resolveTenant ?? resolveTenant;
+    for (const listener of options.listeners) {
+      identifier(listener.name, 128);
+      identifier(listener.event, 128);
+      if (this.listeners.has(listener.name))
+        throw new Error("Durable listener names must be unique.");
+      this.listeners.set(listener.name, listener);
+    }
+  }
+  async publish(name, payload, options = {}) {
+    if (!hasActiveTransaction())
+      throw new Error("Durable publication requires an active business transaction.");
+    return runInTransaction(() => this.persist(name, payload, options));
+  }
+  async persist(name, payload, options) {
+    identifier(name, 128);
+    const id = identifier(options.id ?? crypto.randomUUID(), 64);
+    const version = positiveInteger(options.version ?? 1, "version");
+    const serialized = JSON.stringify(payload);
+    if (serialized === undefined || new TextEncoder().encode(serialized).byteLength > this.maxPayloadBytes)
+      throw new Error("Invalid or oversized durable payload.");
+    const listeners = [...this.listeners.values()].filter((listener) => listener.event === name);
+    if (listeners.length === 0)
+      throw new Error("No durable listeners registered for this event.");
+    const tenantId = currentTenant()?.id ?? null;
+    if (tenantId !== null)
+      positiveInteger(tenantId, "tenantId");
+    const token = crypto.randomUUID();
+    const now = await clock();
+    await repositoryConnection.unsafe(`INSERT INTO strata_outbox_event (id, name, version, tenant_id, payload, created_at, publication_token)
+      VALUES (${placeholders(7).join(", ")})${currentSqlDialect().upsertSuffix(["id"], [])}`, [id, name, version, tenantId, serialized, now, token]);
+    const [existing] = await repositoryConnection.unsafe(`SELECT * FROM strata_outbox_event WHERE id = ${placeholders(1)[0]}`, [id]);
+    if (!existing || existing.name !== name || Number(existing.version) !== version || (existing.tenant_id === null ? null : Number(existing.tenant_id)) !== tenantId || existing.payload !== serialized)
+      throw new Error("Conflicting durable event ID.");
+    if (existing.publication_token !== token)
+      return id;
+    for (const listener of listeners) {
+      await repositoryConnection.unsafe(`INSERT INTO strata_outbox_delivery (event_id, listener_name, status, max_attempts, available_at)
+        VALUES (${placeholders(5).join(", ")})`, [id, listener.name, "pending", this.maxAttempts, now]);
+    }
+    return id;
+  }
+  async claim() {
+    return privileged(async () => {
+      const now = await clock();
+      const p = placeholders(2);
+      const columns = "event_id, listener_name, attempts, max_attempts";
+      const [expired] = await repositoryConnection.unsafe(`SELECT ${columns} FROM strata_outbox_delivery WHERE status = 'processing' AND lease_until <= ${p[0]}
+        ORDER BY lease_until, event_id, listener_name LIMIT 1${currentSqlDialect().rowLockClause(true)}`, [now]);
+      const delivery = expired ?? (await repositoryConnection.unsafe(`SELECT ${columns} FROM strata_outbox_delivery WHERE status = 'pending' AND available_at <= ${p[0]}
+        ORDER BY available_at, event_id, listener_name LIMIT 1${currentSqlDialect().rowLockClause(true)}`, [now]))[0];
+      if (!delivery)
+        return null;
+      const [event] = await repositoryConnection.unsafe(`SELECT * FROM strata_outbox_event WHERE id = ${p[0]}`, [delivery.event_id]);
+      if (!event)
+        throw new Error("Outbox event missing for delivery.");
+      const candidate = { ...event, ...delivery };
+      const token = crypto.randomUUID();
+      const exhausted = Number(candidate.attempts) >= Number(candidate.max_attempts);
+      const q = placeholders(9);
+      await repositoryConnection.unsafe(`UPDATE strata_outbox_delivery SET status = ${q[0]}, lease_token = ${q[1]}, lease_until = ${q[2]},
+        attempts = ${q[3]}, error_code = ${exhausted ? "'attempts_exhausted'" : "error_code"} WHERE event_id = ${q[4]} AND listener_name = ${q[5]} AND
+        ((status = 'pending' AND available_at <= ${q[6]}) OR (status = 'processing' AND lease_until <= ${q[7]})) AND attempts = ${q[8]}`, [
+        exhausted ? "failed" : "processing",
+        token,
+        exhausted ? null : now + this.leaseMs,
+        Number(candidate.attempts) + (exhausted ? 0 : 1),
+        candidate.id,
+        candidate.listener_name,
+        now,
+        now,
+        candidate.attempts
+      ]);
+      const [owner] = await repositoryConnection.unsafe(`SELECT lease_token FROM strata_outbox_delivery WHERE event_id = ${p[0]} AND listener_name = ${p[1]}${currentSqlDialect().rowLockClause()}`, [candidate.id, candidate.listener_name]);
+      if (owner?.lease_token !== token)
+        return null;
+      if (exhausted)
+        return "exhausted";
+      return { ...candidate, attempts: Number(candidate.attempts) + 1, lease_token: token };
+    });
+  }
+  async renew(claim) {
+    return privileged(async () => {
+      const now = await clock();
+      const p = placeholders(5);
+      await repositoryConnection.unsafe(`UPDATE strata_outbox_delivery SET lease_until = ${p[0]} WHERE event_id = ${p[1]}
+        AND listener_name = ${p[2]} AND lease_token = ${p[3]} AND status = 'processing' AND lease_until > ${p[4]}`, [now + this.leaseMs, claim.id, claim.listener_name, claim.lease_token, now]);
+      const q = placeholders(3);
+      const [owner] = await repositoryConnection.unsafe(`SELECT lease_until FROM strata_outbox_delivery WHERE event_id = ${q[0]} AND listener_name = ${q[1]} AND lease_token = ${q[2]} AND status = 'processing'${currentSqlDialect().rowLockClause()}`, [claim.id, claim.listener_name, claim.lease_token]);
+      return Number(owner?.lease_until) > now;
+    });
+  }
+  async finish(claim, success) {
+    await privileged(async () => {
+      const now = await clock();
+      const status = success ? "completed" : claim.attempts >= Number(claim.max_attempts) ? "failed" : "pending";
+      const delay = Math.min(this.retryDelayMs * 2 ** Math.min(claim.attempts - 1, 16), 300000);
+      const p = placeholders(9);
+      await repositoryConnection.unsafe(`UPDATE strata_outbox_delivery SET status = ${p[0]}, available_at = ${p[1]}, completed_at = ${p[2]},
+        error_code = ${p[3]}, lease_until = NULL WHERE event_id = ${p[4]} AND listener_name = ${p[5]}
+        AND lease_token = ${p[6]} AND status = 'processing' AND lease_until > ${p[7]} AND attempts = ${p[8]}`, [
+        status,
+        now + delay,
+        success ? now : null,
+        success ? null : "listener_failed",
+        claim.id,
+        claim.listener_name,
+        claim.lease_token,
+        now,
+        claim.attempts
+      ]);
+    });
+  }
+  async processNext(options = {}) {
+    if (hasActiveTransaction())
+      throw new Error("Outbox workers must run outside business transactions.");
+    options.signal?.throwIfAborted();
+    const claim = await this.claim();
+    if (!claim)
+      return false;
+    if (claim === "exhausted")
+      return true;
+    const controller = new AbortController;
+    const forward = () => controller.abort(options.signal?.reason);
+    options.signal?.addEventListener("abort", forward, { once: true });
+    if (options.signal?.aborted)
+      forward();
+    let renewal;
+    let watchdog = setTimeout(() => controller.abort(new Error("Outbox lease expired.")), this.leaseMs);
+    const heartbeat = setInterval(() => {
+      if (renewal || controller.signal.aborted)
+        return;
+      renewal = (async () => {
+        try {
+          if (!await this.renew(claim))
+            controller.abort(new Error("Outbox ownership lost."));
+          else {
+            clearTimeout(watchdog);
+            watchdog = setTimeout(() => controller.abort(new Error("Outbox lease expired.")), this.leaseMs);
+          }
+        } catch {
+          controller.abort(new Error("Outbox lease renewal failed."));
+        } finally {
+          renewal = undefined;
+        }
+      })();
+    }, Math.max(10, Math.floor(this.leaseMs / 3)));
+    let success = false;
+    try {
+      const listener = this.listeners.get(claim.listener_name);
+      if (!listener || listener.event !== claim.name)
+        throw new Error("Durable listener is not registered.");
+      const event = {
+        id: claim.id,
+        name: claim.name,
+        version: Number(claim.version),
+        tenantId: claim.tenant_id === null ? null : Number(claim.tenant_id),
+        payload: JSON.parse(claim.payload)
+      };
+      const tenant = event.tenantId === null ? null : await privileged(() => this.tenantResolver(Number(event.tenantId)));
+      if (event.tenantId !== null && (!tenant || tenant.id !== event.tenantId))
+        throw new Error("Outbox tenant could not be resolved.");
+      const handle = async () => {
+        controller.signal.throwIfAborted();
+        await listener.handle(event, { signal: controller.signal });
+        controller.signal.throwIfAborted();
+      };
+      if (tenant)
+        await runWithTenantDatabase(tenant, handle);
+      else
+        await handle();
+      success = true;
+    } catch {
+      success = false;
+    } finally {
+      clearInterval(heartbeat);
+      await renewal;
+      clearTimeout(watchdog);
+      options.signal?.removeEventListener("abort", forward);
+    }
+    await this.finish(claim, success && !controller.signal.aborted);
+    return true;
+  }
+  async work(options) {
+    const pollMs = positiveInteger(options.pollMs ?? 1000, "pollMs");
+    while (!options.signal.aborted) {
+      try {
+        if (await this.processNext({ signal: options.signal }))
+          continue;
+      } catch (error) {
+        if (options.signal.aborted)
+          return;
+        throw error;
+      }
+      await new Promise((resolve) => {
+        const done = () => {
+          clearTimeout(timer);
+          options.signal.removeEventListener("abort", done);
+          resolve();
+        };
+        const timer = setTimeout(done, pollMs);
+        options.signal.addEventListener("abort", done, { once: true });
+        if (options.signal.aborted)
+          done();
+      });
+    }
+  }
+  async replay(eventId, listenerName) {
+    identifier(eventId, 64);
+    identifier(listenerName, 128);
+    await privileged(async () => {
+      const now = await clock();
+      const p = placeholders(3);
+      await repositoryConnection.unsafe(`UPDATE strata_outbox_delivery SET status = 'pending', attempts = 0, available_at = ${p[0]},
+        lease_token = NULL, lease_until = NULL, completed_at = NULL, error_code = NULL
+        WHERE event_id = ${p[1]} AND listener_name = ${p[2]} AND status = 'failed'`, [now, eventId, listenerName]);
+    });
+  }
+}
 // ../../src/core/mail/mailer.ts
 function resolveSmtpConfig() {
   const host = process.env.MAIL_HOST?.trim();
@@ -9895,7 +10433,7 @@ function logServerError(error, mappedError) {
   });
 }
 async function webErrorResponse(error, request) {
-  if (!request || !isViewsEnabled() || requestPrefersJson(request)) {
+  if (currentRequestMeta().errorFormat === "json" || !request || !isViewsEnabled() || requestPrefersJson(request)) {
     return null;
   }
   const mappedError = toHttpError(error) ?? mapDatabaseError(error);
@@ -12408,6 +12946,7 @@ export {
   Schedule,
   Schema,
   ServiceContainer,
+  SqlOutbox,
   SqliteGrammar,
   StorageManager,
   SyncQueue,
@@ -12502,6 +13041,7 @@ export {
   createMysqlPool,
   createNotificationDispatcher,
   createOidcHandshake,
+  createOutboxMigration,
   createProductionQueue,
   createQueue,
   createQueueWorker,
@@ -12567,6 +13107,7 @@ export {
   grammarForDriver,
   guestCanViewResource,
   hasActiveDatabaseConnection,
+  hasActiveTransaction,
   hasMany,
   hasManyThrough,
   hasMinimumOrgRole2 as hasMinimumOrgRole,