@open-mercato/events 0.6.8-develop.6942.1.dd382caa0f → 0.6.8-develop.6943.1.ed2e2cf6f6

package/dist/bridge.js

@@ -117,10 +117,11 @@ async function ensureCrossProcessListener() {
 async function publishCrossProcessEvent(event, payload, options) {
   const pool = getPublisherPool();
   if (!pool) return;
+  const bridgeOptions = options && Object.prototype.hasOwnProperty.call(options, "tenantId") && options.tenantId === void 0 ? { ...options, tenantId: null } : options;
   const envelope = {
     event,
     payload,
-    options,
+    options: bridgeOptions,
     originPid: process.pid
   };
   const serialized = JSON.stringify(envelope);

package/dist/bridge.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/bridge.ts"],
-  "sourcesContent": ["import { Client, Pool } from 'pg'\nimport { getSslConfig } from '@open-mercato/shared/lib/db/ssl'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport type { EmitOptions, EventPayload } from './types'\n\nconst BRIDGE_CHANNEL = 'om_event_bridge'\nconst MAX_MESSAGE_BYTES = 7_000\nconst RECONNECT_DELAY_MS = 1_000\n\nconst logger = createLogger('events')\n\ntype BridgeEnvelope = {\n  event: string\n  payload: EventPayload\n  options?: EmitOptions\n  originPid: number\n}\n\ntype CrossProcessEventListener = (envelope: BridgeEnvelope) => void | Promise<void>\ntype PgNotificationMessage = {\n  channel: string\n  payload?: string\n}\n\nlet publisherPool: InstanceType<typeof Pool> | null | undefined\nlet listenerClient: InstanceType<typeof Client> | null = null\nlet listenerConnectPromise: Promise<void> | null = null\nlet listenerReconnectTimer: ReturnType<typeof setTimeout> | null = null\nconst listeners = new Set<CrossProcessEventListener>()\n\nfunction getDatabaseUrl(): string | null {\n  const value = process.env.DATABASE_URL?.trim()\n  return value && value.length > 0 ? value : null\n}\n\nfunction getPgBridgeConnectionString(): string | null {\n  const connectionString = getDatabaseUrl()\n  if (!connectionString) return null\n\n  try {\n    const url = new URL(connectionString)\n    for (const key of ['sslmode', 'sslcert', 'sslkey', 'sslrootcert', 'sslcrl']) {\n      url.searchParams.delete(key)\n    }\n    return url.toString()\n  } catch {\n    return connectionString\n  }\n}\n\nfunction getPublisherPool(): InstanceType<typeof Pool> | null {\n  if (publisherPool !== undefined) return publisherPool\n  const connectionString = getPgBridgeConnectionString()\n  if (!connectionString) {\n    publisherPool = null\n    return null\n  }\n  const ssl = getSslConfig()\n  publisherPool = new Pool({\n    connectionString,\n    max: 2,\n    ...(ssl ? { ssl } : {}),\n  })\n  return publisherPool\n}\n\nasync function dispatchEnvelope(envelope: BridgeEnvelope): Promise<void> {\n  for (const listener of listeners) {\n    try {\n      await Promise.resolve(listener(envelope))\n    } catch (error) {\n      logger.error('Cross-process listener error', { event: envelope.event, err: error })\n    }\n  }\n}\n\nfunction clearReconnectTimer(): void {\n  if (!listenerReconnectTimer) return\n  clearTimeout(listenerReconnectTimer)\n  listenerReconnectTimer = null\n}\n\nasync function closeListenerClient(): Promise<void> {\n  if (!listenerClient) return\n  const client = listenerClient\n  listenerClient = null\n  try {\n    client.removeAllListeners('notification')\n    client.removeAllListeners('error')\n    client.removeAllListeners('end')\n    await client.end()\n  } catch {\n    // Ignore shutdown errors.\n  }\n}\n\nfunction scheduleReconnect(): void {\n  if (listenerReconnectTimer || listeners.size === 0) return\n  listenerReconnectTimer = setTimeout(() => {\n    listenerReconnectTimer = null\n    void ensureCrossProcessListener()\n  }, RECONNECT_DELAY_MS)\n}\n\nasync function ensureCrossProcessListener(): Promise<void> {\n  if (listenerClient || listenerConnectPromise || listeners.size === 0) return\n  const connectionString = getPgBridgeConnectionString()\n  if (!connectionString) return\n\n  listenerConnectPromise = (async () => {\n    const ssl = getSslConfig()\n    const client = new Client({\n      connectionString,\n      ...(ssl ? { ssl } : {}),\n    })\n\n    client.on('notification', (message: PgNotificationMessage) => {\n      if (message.channel !== BRIDGE_CHANNEL || !message.payload) return\n      try {\n        const parsed = JSON.parse(message.payload) as BridgeEnvelope\n        if (!parsed || typeof parsed.event !== 'string') return\n        void dispatchEnvelope(parsed)\n      } catch (error) {\n        logger.warn('Failed to parse cross-process bridge payload', { err: error })\n      }\n    })\n\n    const handleDisconnect = () => {\n      if (listenerClient === client) {\n        listenerClient = null\n      }\n      scheduleReconnect()\n    }\n\n    client.on('error', handleDisconnect)\n    client.on('end', handleDisconnect)\n\n    await client.connect()\n    await client.query(`LISTEN ${BRIDGE_CHANNEL}`)\n    listenerClient = client\n  })()\n    .catch((error) => {\n      logger.warn('Cross-process event bridge listener failed', { err: error })\n      scheduleReconnect()\n    })\n    .finally(() => {\n      listenerConnectPromise = null\n    })\n\n  await listenerConnectPromise\n}\n\nexport async function publishCrossProcessEvent(\n  event: string,\n  payload: EventPayload,\n  options?: EmitOptions,\n): Promise<void> {\n  const pool = getPublisherPool()\n  if (!pool) return\n\n  const envelope: BridgeEnvelope = {\n    event,\n    payload,\n    options,\n    originPid: process.pid,\n  }\n\n  const serialized = JSON.stringify(envelope)\n  if (Buffer.byteLength(serialized, 'utf8') > MAX_MESSAGE_BYTES) {\n    logger.warn('Cross-process event dropped: payload exceeds size limit', { event, maxBytes: MAX_MESSAGE_BYTES })\n    return\n  }\n\n  await pool.query('SELECT pg_notify($1, $2)', [BRIDGE_CHANNEL, serialized])\n}\n\nexport function registerCrossProcessEventListener(listener: CrossProcessEventListener): () => void {\n  listeners.add(listener)\n  void ensureCrossProcessListener()\n\n  return () => {\n    listeners.delete(listener)\n    if (listeners.size === 0) {\n      clearReconnectTimer()\n      void closeListenerClient()\n    }\n  }\n}\n"],
-  "mappings": "AAAA,SAAS,QAAQ,YAAY;AAC7B,SAAS,oBAAoB;AAC7B,SAAS,oBAAoB;AAG7B,MAAM,iBAAiB;AACvB,MAAM,oBAAoB;AAC1B,MAAM,qBAAqB;AAE3B,MAAM,SAAS,aAAa,QAAQ;AAepC,IAAI;AACJ,IAAI,iBAAqD;AACzD,IAAI,yBAA+C;AACnD,IAAI,yBAA+D;AACnE,MAAM,YAAY,oBAAI,IAA+B;AAErD,SAAS,iBAAgC;AACvC,QAAM,QAAQ,QAAQ,IAAI,cAAc,KAAK;AAC7C,SAAO,SAAS,MAAM,SAAS,IAAI,QAAQ;AAC7C;AAEA,SAAS,8BAA6C;AACpD,QAAM,mBAAmB,eAAe;AACxC,MAAI,CAAC,iBAAkB,QAAO;AAE9B,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,gBAAgB;AACpC,eAAW,OAAO,CAAC,WAAW,WAAW,UAAU,eAAe,QAAQ,GAAG;AAC3E,UAAI,aAAa,OAAO,GAAG;AAAA,IAC7B;AACA,WAAO,IAAI,SAAS;AAAA,EACtB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,mBAAqD;AAC5D,MAAI,kBAAkB,OAAW,QAAO;AACxC,QAAM,mBAAmB,4BAA4B;AACrD,MAAI,CAAC,kBAAkB;AACrB,oBAAgB;AAChB,WAAO;AAAA,EACT;AACA,QAAM,MAAM,aAAa;AACzB,kBAAgB,IAAI,KAAK;AAAA,IACvB;AAAA,IACA,KAAK;AAAA,IACL,GAAI,MAAM,EAAE,IAAI,IAAI,CAAC;AAAA,EACvB,CAAC;AACD,SAAO;AACT;AAEA,eAAe,iBAAiB,UAAyC;AACvE,aAAW,YAAY,WAAW;AAChC,QAAI;AACF,YAAM,QAAQ,QAAQ,SAAS,QAAQ,CAAC;AAAA,IAC1C,SAAS,OAAO;AACd,aAAO,MAAM,gCAAgC,EAAE,OAAO,SAAS,OAAO,KAAK,MAAM,CAAC;AAAA,IACpF;AAAA,EACF;AACF;AAEA,SAAS,sBAA4B;AACnC,MAAI,CAAC,uBAAwB;AAC7B,eAAa,sBAAsB;AACnC,2BAAyB;AAC3B;AAEA,eAAe,sBAAqC;AAClD,MAAI,CAAC,eAAgB;AACrB,QAAM,SAAS;AACf,mBAAiB;AACjB,MAAI;AACF,WAAO,mBAAmB,cAAc;AACxC,WAAO,mBAAmB,OAAO;AACjC,WAAO,mBAAmB,KAAK;AAC/B,UAAM,OAAO,IAAI;AAAA,EACnB,QAAQ;AAAA,EAER;AACF;AAEA,SAAS,oBAA0B;AACjC,MAAI,0BAA0B,UAAU,SAAS,EAAG;AACpD,2BAAyB,WAAW,MAAM;AACxC,6BAAyB;AACzB,SAAK,2BAA2B;AAAA,EAClC,GAAG,kBAAkB;AACvB;AAEA,eAAe,6BAA4C;AACzD,MAAI,kBAAkB,0BAA0B,UAAU,SAAS,EAAG;AACtE,QAAM,mBAAmB,4BAA4B;AACrD,MAAI,CAAC,iBAAkB;AAEvB,4BAA0B,YAAY;AACpC,UAAM,MAAM,aAAa;AACzB,UAAM,SAAS,IAAI,OAAO;AAAA,MACxB;AAAA,MACA,GAAI,MAAM,EAAE,IAAI,IAAI,CAAC;AAAA,IACvB,CAAC;AAED,WAAO,GAAG,gBAAgB,CAAC,YAAmC;AAC5D,UAAI,QAAQ,YAAY,kBAAkB,CAAC,QAAQ,QAAS;AAC5D,UAAI;AACF,cAAM,SAAS,KAAK,MAAM,QAAQ,OAAO;AACzC,YAAI,CAAC,UAAU,OAAO,OAAO,UAAU,SAAU;AACjD,aAAK,iBAAiB,MAAM;AAAA,MAC9B,SAAS,OAAO;AACd,eAAO,KAAK,gDAAgD,EAAE,KAAK,MAAM,CAAC;AAAA,MAC5E;AAAA,IACF,CAAC;AAED,UAAM,mBAAmB,MAAM;AAC7B,UAAI,mBAAmB,QAAQ;AAC7B,yBAAiB;AAAA,MACnB;AACA,wBAAkB;AAAA,IACpB;AAEA,WAAO,GAAG,SAAS,gBAAgB;AACnC,WAAO,GAAG,OAAO,gBAAgB;AAEjC,UAAM,OAAO,QAAQ;AACrB,UAAM,OAAO,MAAM,UAAU,cAAc,EAAE;AAC7C,qBAAiB;AAAA,EACnB,GAAG,EACA,MAAM,CAAC,UAAU;AAChB,WAAO,KAAK,8CAA8C,EAAE,KAAK,MAAM,CAAC;AACxE,sBAAkB;AAAA,EACpB,CAAC,EACA,QAAQ,MAAM;AACb,6BAAyB;AAAA,EAC3B,CAAC;AAEH,QAAM;AACR;AAEA,eAAsB,yBACpB,OACA,SACA,SACe;AACf,QAAM,OAAO,iBAAiB;AAC9B,MAAI,CAAC,KAAM;AAEX,QAAM,WAA2B;AAAA,IAC/B;AAAA,IACA;AAAA,IACA;AAAA,IACA,WAAW,QAAQ;AAAA,EACrB;AAEA,QAAM,aAAa,KAAK,UAAU,QAAQ;AAC1C,MAAI,OAAO,WAAW,YAAY,MAAM,IAAI,mBAAmB;AAC7D,WAAO,KAAK,2DAA2D,EAAE,OAAO,UAAU,kBAAkB,CAAC;AAC7G;AAAA,EACF;AAEA,QAAM,KAAK,MAAM,4BAA4B,CAAC,gBAAgB,UAAU,CAAC;AAC3E;AAEO,SAAS,kCAAkC,UAAiD;AACjG,YAAU,IAAI,QAAQ;AACtB,OAAK,2BAA2B;AAEhC,SAAO,MAAM;AACX,cAAU,OAAO,QAAQ;AACzB,QAAI,UAAU,SAAS,GAAG;AACxB,0BAAoB;AACpB,WAAK,oBAAoB;AAAA,IAC3B;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { Client, Pool } from 'pg'\nimport { getSslConfig } from '@open-mercato/shared/lib/db/ssl'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport type { EmitOptions, EventPayload } from './types'\n\nconst BRIDGE_CHANNEL = 'om_event_bridge'\nconst MAX_MESSAGE_BYTES = 7_000\nconst RECONNECT_DELAY_MS = 1_000\n\nconst logger = createLogger('events')\n\ntype BridgeEnvelope = {\n  event: string\n  payload: EventPayload\n  options?: EmitOptions\n  originPid: number\n}\n\ntype CrossProcessEventListener = (envelope: BridgeEnvelope) => void | Promise<void>\ntype PgNotificationMessage = {\n  channel: string\n  payload?: string\n}\n\nlet publisherPool: InstanceType<typeof Pool> | null | undefined\nlet listenerClient: InstanceType<typeof Client> | null = null\nlet listenerConnectPromise: Promise<void> | null = null\nlet listenerReconnectTimer: ReturnType<typeof setTimeout> | null = null\nconst listeners = new Set<CrossProcessEventListener>()\n\nfunction getDatabaseUrl(): string | null {\n  const value = process.env.DATABASE_URL?.trim()\n  return value && value.length > 0 ? value : null\n}\n\nfunction getPgBridgeConnectionString(): string | null {\n  const connectionString = getDatabaseUrl()\n  if (!connectionString) return null\n\n  try {\n    const url = new URL(connectionString)\n    for (const key of ['sslmode', 'sslcert', 'sslkey', 'sslrootcert', 'sslcrl']) {\n      url.searchParams.delete(key)\n    }\n    return url.toString()\n  } catch {\n    return connectionString\n  }\n}\n\nfunction getPublisherPool(): InstanceType<typeof Pool> | null {\n  if (publisherPool !== undefined) return publisherPool\n  const connectionString = getPgBridgeConnectionString()\n  if (!connectionString) {\n    publisherPool = null\n    return null\n  }\n  const ssl = getSslConfig()\n  publisherPool = new Pool({\n    connectionString,\n    max: 2,\n    ...(ssl ? { ssl } : {}),\n  })\n  return publisherPool\n}\n\nasync function dispatchEnvelope(envelope: BridgeEnvelope): Promise<void> {\n  for (const listener of listeners) {\n    try {\n      await Promise.resolve(listener(envelope))\n    } catch (error) {\n      logger.error('Cross-process listener error', { event: envelope.event, err: error })\n    }\n  }\n}\n\nfunction clearReconnectTimer(): void {\n  if (!listenerReconnectTimer) return\n  clearTimeout(listenerReconnectTimer)\n  listenerReconnectTimer = null\n}\n\nasync function closeListenerClient(): Promise<void> {\n  if (!listenerClient) return\n  const client = listenerClient\n  listenerClient = null\n  try {\n    client.removeAllListeners('notification')\n    client.removeAllListeners('error')\n    client.removeAllListeners('end')\n    await client.end()\n  } catch {\n    // Ignore shutdown errors.\n  }\n}\n\nfunction scheduleReconnect(): void {\n  if (listenerReconnectTimer || listeners.size === 0) return\n  listenerReconnectTimer = setTimeout(() => {\n    listenerReconnectTimer = null\n    void ensureCrossProcessListener()\n  }, RECONNECT_DELAY_MS)\n}\n\nasync function ensureCrossProcessListener(): Promise<void> {\n  if (listenerClient || listenerConnectPromise || listeners.size === 0) return\n  const connectionString = getPgBridgeConnectionString()\n  if (!connectionString) return\n\n  listenerConnectPromise = (async () => {\n    const ssl = getSslConfig()\n    const client = new Client({\n      connectionString,\n      ...(ssl ? { ssl } : {}),\n    })\n\n    client.on('notification', (message: PgNotificationMessage) => {\n      if (message.channel !== BRIDGE_CHANNEL || !message.payload) return\n      try {\n        const parsed = JSON.parse(message.payload) as BridgeEnvelope\n        if (!parsed || typeof parsed.event !== 'string') return\n        void dispatchEnvelope(parsed)\n      } catch (error) {\n        logger.warn('Failed to parse cross-process bridge payload', { err: error })\n      }\n    })\n\n    const handleDisconnect = () => {\n      if (listenerClient === client) {\n        listenerClient = null\n      }\n      scheduleReconnect()\n    }\n\n    client.on('error', handleDisconnect)\n    client.on('end', handleDisconnect)\n\n    await client.connect()\n    await client.query(`LISTEN ${BRIDGE_CHANNEL}`)\n    listenerClient = client\n  })()\n    .catch((error) => {\n      logger.warn('Cross-process event bridge listener failed', { err: error })\n      scheduleReconnect()\n    })\n    .finally(() => {\n      listenerConnectPromise = null\n    })\n\n  await listenerConnectPromise\n}\n\nexport async function publishCrossProcessEvent(\n  event: string,\n  payload: EventPayload,\n  options?: EmitOptions,\n): Promise<void> {\n  const pool = getPublisherPool()\n  if (!pool) return\n\n  const bridgeOptions = options\n    && Object.prototype.hasOwnProperty.call(options, 'tenantId')\n    && options.tenantId === undefined\n    ? { ...options, tenantId: null }\n    : options\n\n  const envelope: BridgeEnvelope = {\n    event,\n    payload,\n    options: bridgeOptions,\n    originPid: process.pid,\n  }\n\n  const serialized = JSON.stringify(envelope)\n  if (Buffer.byteLength(serialized, 'utf8') > MAX_MESSAGE_BYTES) {\n    logger.warn('Cross-process event dropped: payload exceeds size limit', { event, maxBytes: MAX_MESSAGE_BYTES })\n    return\n  }\n\n  await pool.query('SELECT pg_notify($1, $2)', [BRIDGE_CHANNEL, serialized])\n}\n\nexport function registerCrossProcessEventListener(listener: CrossProcessEventListener): () => void {\n  listeners.add(listener)\n  void ensureCrossProcessListener()\n\n  return () => {\n    listeners.delete(listener)\n    if (listeners.size === 0) {\n      clearReconnectTimer()\n      void closeListenerClient()\n    }\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,QAAQ,YAAY;AAC7B,SAAS,oBAAoB;AAC7B,SAAS,oBAAoB;AAG7B,MAAM,iBAAiB;AACvB,MAAM,oBAAoB;AAC1B,MAAM,qBAAqB;AAE3B,MAAM,SAAS,aAAa,QAAQ;AAepC,IAAI;AACJ,IAAI,iBAAqD;AACzD,IAAI,yBAA+C;AACnD,IAAI,yBAA+D;AACnE,MAAM,YAAY,oBAAI,IAA+B;AAErD,SAAS,iBAAgC;AACvC,QAAM,QAAQ,QAAQ,IAAI,cAAc,KAAK;AAC7C,SAAO,SAAS,MAAM,SAAS,IAAI,QAAQ;AAC7C;AAEA,SAAS,8BAA6C;AACpD,QAAM,mBAAmB,eAAe;AACxC,MAAI,CAAC,iBAAkB,QAAO;AAE9B,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,gBAAgB;AACpC,eAAW,OAAO,CAAC,WAAW,WAAW,UAAU,eAAe,QAAQ,GAAG;AAC3E,UAAI,aAAa,OAAO,GAAG;AAAA,IAC7B;AACA,WAAO,IAAI,SAAS;AAAA,EACtB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,mBAAqD;AAC5D,MAAI,kBAAkB,OAAW,QAAO;AACxC,QAAM,mBAAmB,4BAA4B;AACrD,MAAI,CAAC,kBAAkB;AACrB,oBAAgB;AAChB,WAAO;AAAA,EACT;AACA,QAAM,MAAM,aAAa;AACzB,kBAAgB,IAAI,KAAK;AAAA,IACvB;AAAA,IACA,KAAK;AAAA,IACL,GAAI,MAAM,EAAE,IAAI,IAAI,CAAC;AAAA,EACvB,CAAC;AACD,SAAO;AACT;AAEA,eAAe,iBAAiB,UAAyC;AACvE,aAAW,YAAY,WAAW;AAChC,QAAI;AACF,YAAM,QAAQ,QAAQ,SAAS,QAAQ,CAAC;AAAA,IAC1C,SAAS,OAAO;AACd,aAAO,MAAM,gCAAgC,EAAE,OAAO,SAAS,OAAO,KAAK,MAAM,CAAC;AAAA,IACpF;AAAA,EACF;AACF;AAEA,SAAS,sBAA4B;AACnC,MAAI,CAAC,uBAAwB;AAC7B,eAAa,sBAAsB;AACnC,2BAAyB;AAC3B;AAEA,eAAe,sBAAqC;AAClD,MAAI,CAAC,eAAgB;AACrB,QAAM,SAAS;AACf,mBAAiB;AACjB,MAAI;AACF,WAAO,mBAAmB,cAAc;AACxC,WAAO,mBAAmB,OAAO;AACjC,WAAO,mBAAmB,KAAK;AAC/B,UAAM,OAAO,IAAI;AAAA,EACnB,QAAQ;AAAA,EAER;AACF;AAEA,SAAS,oBAA0B;AACjC,MAAI,0BAA0B,UAAU,SAAS,EAAG;AACpD,2BAAyB,WAAW,MAAM;AACxC,6BAAyB;AACzB,SAAK,2BAA2B;AAAA,EAClC,GAAG,kBAAkB;AACvB;AAEA,eAAe,6BAA4C;AACzD,MAAI,kBAAkB,0BAA0B,UAAU,SAAS,EAAG;AACtE,QAAM,mBAAmB,4BAA4B;AACrD,MAAI,CAAC,iBAAkB;AAEvB,4BAA0B,YAAY;AACpC,UAAM,MAAM,aAAa;AACzB,UAAM,SAAS,IAAI,OAAO;AAAA,MACxB;AAAA,MACA,GAAI,MAAM,EAAE,IAAI,IAAI,CAAC;AAAA,IACvB,CAAC;AAED,WAAO,GAAG,gBAAgB,CAAC,YAAmC;AAC5D,UAAI,QAAQ,YAAY,kBAAkB,CAAC,QAAQ,QAAS;AAC5D,UAAI;AACF,cAAM,SAAS,KAAK,MAAM,QAAQ,OAAO;AACzC,YAAI,CAAC,UAAU,OAAO,OAAO,UAAU,SAAU;AACjD,aAAK,iBAAiB,MAAM;AAAA,MAC9B,SAAS,OAAO;AACd,eAAO,KAAK,gDAAgD,EAAE,KAAK,MAAM,CAAC;AAAA,MAC5E;AAAA,IACF,CAAC;AAED,UAAM,mBAAmB,MAAM;AAC7B,UAAI,mBAAmB,QAAQ;AAC7B,yBAAiB;AAAA,MACnB;AACA,wBAAkB;AAAA,IACpB;AAEA,WAAO,GAAG,SAAS,gBAAgB;AACnC,WAAO,GAAG,OAAO,gBAAgB;AAEjC,UAAM,OAAO,QAAQ;AACrB,UAAM,OAAO,MAAM,UAAU,cAAc,EAAE;AAC7C,qBAAiB;AAAA,EACnB,GAAG,EACA,MAAM,CAAC,UAAU;AAChB,WAAO,KAAK,8CAA8C,EAAE,KAAK,MAAM,CAAC;AACxE,sBAAkB;AAAA,EACpB,CAAC,EACA,QAAQ,MAAM;AACb,6BAAyB;AAAA,EAC3B,CAAC;AAEH,QAAM;AACR;AAEA,eAAsB,yBACpB,OACA,SACA,SACe;AACf,QAAM,OAAO,iBAAiB;AAC9B,MAAI,CAAC,KAAM;AAEX,QAAM,gBAAgB,WACjB,OAAO,UAAU,eAAe,KAAK,SAAS,UAAU,KACxD,QAAQ,aAAa,SACtB,EAAE,GAAG,SAAS,UAAU,KAAK,IAC7B;AAEJ,QAAM,WAA2B;AAAA,IAC/B;AAAA,IACA;AAAA,IACA,SAAS;AAAA,IACT,WAAW,QAAQ;AAAA,EACrB;AAEA,QAAM,aAAa,KAAK,UAAU,QAAQ;AAC1C,MAAI,OAAO,WAAW,YAAY,MAAM,IAAI,mBAAmB;AAC7D,WAAO,KAAK,2DAA2D,EAAE,OAAO,UAAU,kBAAkB,CAAC;AAC7G;AAAA,EACF;AAEA,QAAM,KAAK,MAAM,4BAA4B,CAAC,gBAAgB,UAAU,CAAC;AAC3E;AAEO,SAAS,kCAAkC,UAAiD;AACjG,YAAU,IAAI,QAAQ;AACtB,OAAK,2BAA2B;AAEhC,SAAO,MAAM;AACX,cAAU,OAAO,QAAQ;AACzB,QAAI,UAAU,SAAS,GAAG;AACxB,0BAAoB;AACpB,WAAK,oBAAoB;AAAA,IAC3B;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/bus.js

@@ -202,9 +202,9 @@ function createEventBus(opts) {
     }
     const enqueueOnly = Boolean(options?.persistent) && options?.deliverInline === false;
     const singleDelivery = isSingleDeliveryEnabled();
+    const skipPersistentInline = options?.skipPersistentSubscribersInline === true || Boolean(options?.persistent) && singleDelivery;
     let inlinePersistentFailed = false;
     if (!enqueueOnly) {
-      const skipPersistentInline = Boolean(options?.persistent) && singleDelivery;
       const delivered = await deliver(event, payload, options, skipPersistentInline);
       inlinePersistentFailed = delivered.persistentFailures > 0;
     }
@@ -228,7 +228,7 @@ function createEventBus(opts) {
         // dead-lettering. Without this, flipping the flag off (which the
         // `mercato server` guard can do automatically) silently downgrades
         // persistent delivery to at-most-once.
-        persistentDeliveredInline: !enqueueOnly && !singleDelivery && !inlinePersistentFailed
+        persistentDeliveredInline: !enqueueOnly && !skipPersistentInline && !inlinePersistentFailed
       });
     }
   }

package/dist/bus.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/bus.ts"],
-  "sourcesContent": ["import { createQueue } from '@open-mercato/queue'\nimport type { Queue } from '@open-mercato/queue'\nimport { parseBooleanWithDefault } from '@open-mercato/shared/lib/boolean'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { isSingleDeliveryRequested } from './single-delivery'\nimport { matchEventPattern } from '@open-mercato/shared/lib/events/patterns'\nimport { getRedisUrlOrThrow } from '@open-mercato/shared/lib/redis/connection'\nimport { isBroadcastEvent } from '@open-mercato/shared/modules/events'\nimport {\n  inferModuleIdFromResourceId,\n  withModuleResourceUsage,\n} from '@open-mercato/shared/lib/modules/resource-usage'\nexport { registerCrossProcessEventListener } from './bridge'\nimport { publishCrossProcessEvent } from './bridge'\nimport type {\n  EventBus,\n  CreateBusOptions,\n  SubscriberHandler,\n  SubscriberDescriptor,\n  EventPayload,\n  EmitOptions,\n  QueuedDispatchResult,\n} from './types'\n\n/** Queue name for persistent events */\nconst EVENTS_QUEUE_NAME = 'events'\n\nconst logger = createLogger('events')\n\ntype RegisteredSubscriber = {\n  id?: string\n  moduleId?: string\n  event: string\n  handler: SubscriberHandler\n  persistent?: boolean\n}\n\n/**\n * When enabled, a persistent emit delivers each subscriber on exactly one path:\n * persistent-marked subscribers are skipped inline (the events worker dispatches\n * them via pattern match, so wildcard persistent subscribers are reached), while\n * ephemeral subscribers keep running inline. Defaults ON.\n *\n * The bus never second-guesses this against \"is a worker running\": the queue is\n * durable, so a persistent emit with no worker yet is delayed, not lost, and a\n * worker started later drains the backlog. Delivering inline instead would move\n * the work back onto the caller's request path \u2014 exactly what a split app/worker\n * deployment sets `AUTO_SPAWN_WORKERS=false` to avoid.\n *\n * The events worker asks this same bus for its subscribers via `dispatchQueued`,\n * so both halves of single-delivery read one decision.\n */\nfunction isSingleDeliveryEnabled(): boolean {\n  return isSingleDeliveryRequested()\n}\n\ntype GlobalEventTap = (event: string, payload: EventPayload, options?: EmitOptions) => void | Promise<void>\nconst GLOBAL_EVENT_TAPS_KEY = '__openMercatoEventBusGlobalTaps__'\n\nfunction hasTenantScope(payload: EventPayload): boolean {\n  return typeof (payload as Record<string, unknown>)?.tenantId === 'string'\n    && String((payload as Record<string, unknown>).tenantId).trim().length > 0\n}\n\nfunction getGlobalEventTaps(): Set<GlobalEventTap> {\n  const existing = (globalThis as Record<string, unknown>)[GLOBAL_EVENT_TAPS_KEY]\n  if (existing instanceof Set) {\n    return existing as Set<GlobalEventTap>\n  }\n  const created = new Set<GlobalEventTap>()\n  ;(globalThis as Record<string, unknown>)[GLOBAL_EVENT_TAPS_KEY] = created\n  return created\n}\n\nexport function registerGlobalEventTap(handler: GlobalEventTap): () => void {\n  const taps = getGlobalEventTaps()\n  taps.add(handler)\n  return () => {\n    taps.delete(handler)\n  }\n}\n\n/** Job data structure for queued events */\ntype EventJobData = {\n  event: string\n  payload: EventPayload\n  options?: EmitOptions\n  /**\n   * Set by the producer when it already ran the persistent subscribers inline\n   * (single-delivery reconciled off). The worker skips such jobs, so the app and\n   * the worker staying exactly-once no longer depends on both processes agreeing\n   * about `OM_EVENTS_SINGLE_DELIVERY`. Absent on jobs queued before this field\n   * existed, which keeps their behavior unchanged.\n   */\n  persistentDeliveredInline?: boolean\n}\n\n// Process-wide cache of the async (BullMQ) persistent-events producer queue.\n// Each authenticated request builds a fresh DI container and event bus, so a\n// per-bus producer queue opened a new ioredis connection per write request that\n// was never closed \u2014 leaking one Redis connection per request until maxclients\n// exhaustion. Memoizing the producer on `globalThis` (keyed by Redis URL, so a\n// reconfigured URL still gets its own queue) keeps it at one connection per\n// process, mirroring the `GLOBAL_EVENT_TAPS_KEY` and `getCachedRateLimiterService`\n// patterns. The local (file-based) strategy holds no pooled connection and its\n// base dir is cwd-relative, so it stays per-bus.\nconst EVENTS_PRODUCER_QUEUE_KEY = '__openMercatoEventsProducerQueues__'\nconst EVENTS_PRODUCER_SHUTDOWN_KEY = '__openMercatoEventsProducerShutdown__'\n\nfunction isSharedProducerEnabled(): boolean {\n  return parseBooleanWithDefault(process.env.OM_EVENTS_SHARED_PRODUCER, true)\n}\n\nfunction getProducerQueueRegistry(): Map<string, Queue<EventJobData>> {\n  const existing = (globalThis as Record<string, unknown>)[EVENTS_PRODUCER_QUEUE_KEY]\n  if (existing instanceof Map) {\n    return existing as Map<string, Queue<EventJobData>>\n  }\n  const created = new Map<string, Queue<EventJobData>>()\n  ;(globalThis as Record<string, unknown>)[EVENTS_PRODUCER_QUEUE_KEY] = created\n  return created\n}\n\nfunction registerProducerShutdownHook(): void {\n  if ((globalThis as Record<string, unknown>)[EVENTS_PRODUCER_SHUTDOWN_KEY]) return\n  const shutdown = () => {\n    const registry = getProducerQueueRegistry()\n    for (const sharedQueue of registry.values()) {\n      Promise.resolve(sharedQueue.close()).catch(() => {})\n    }\n    registry.clear()\n  }\n  process.once('SIGTERM', shutdown)\n  process.once('SIGINT', shutdown)\n  ;(globalThis as Record<string, unknown>)[EVENTS_PRODUCER_SHUTDOWN_KEY] = true\n}\n\n/**\n * Creates an event bus instance.\n *\n * The event bus provides:\n * - In-memory event delivery to registered handlers\n * - Optional persistence via the queue package when `persistent: true`\n *\n * @param opts - Configuration options\n * @returns An EventBus instance\n *\n * @example\n * ```typescript\n * const bus = createEventBus({\n *   resolve: container.resolve.bind(container),\n *   queueStrategy: 'local', // or 'async' for BullMQ\n * })\n *\n * // Register a handler\n * bus.on('user.created', async (payload, ctx) => {\n *   const userService = ctx.resolve('userService')\n *   await userService.sendWelcomeEmail(payload.userId)\n * })\n *\n * // Emit an event (immediate delivery)\n * await bus.emit('user.created', { userId: '123' })\n *\n * // Emit with persistence (for async worker processing)\n * await bus.emit('order.placed', { orderId: '456' }, { persistent: true })\n * ```\n */\nexport function createEventBus(opts: CreateBusOptions): EventBus {\n  // In-memory listeners for immediate event delivery\n  const listeners = new Map<string, Set<RegisteredSubscriber>>()\n  // Subscribers registered as persistent (worker-dispatched). Used by the\n  // single-delivery path to skip them inline on a persistent emit.\n  const persistentSubscribers = new Set<RegisteredSubscriber>()\n\n  // Determine queue strategy from options or environment\n  const queueStrategy = opts.queueStrategy ??\n    (process.env.QUEUE_STRATEGY === 'async' ? 'async' : 'local')\n\n  // Lazy-initialized queue for persistent events\n  let queue: Queue<EventJobData> | null = null\n\n  /**\n   * Gets or creates the queue instance for persistent events.\n   *\n   * The async (BullMQ) producer is memoized process-wide so the per-request\n   * event bus reuses one Redis connection instead of leaking one per write\n   * request. The local strategy stays per-bus (no pooled connection, cwd-relative\n   * base dir). Set `OM_EVENTS_SHARED_PRODUCER=0` to fall back to per-bus producers.\n   */\n  function getQueue(): Queue<EventJobData> {\n    if (queueStrategy !== 'async' || !isSharedProducerEnabled()) {\n      if (!queue) {\n        queue = queueStrategy === 'async'\n          ? createQueue<EventJobData>(EVENTS_QUEUE_NAME, 'async', {\n              connection: { url: getRedisUrlOrThrow('QUEUE') },\n            })\n          : createQueue<EventJobData>(EVENTS_QUEUE_NAME, 'local')\n      }\n      return queue\n    }\n\n    const redisUrl = getRedisUrlOrThrow('QUEUE')\n    const registry = getProducerQueueRegistry()\n    const cacheKey = `async:${redisUrl}`\n    let shared = registry.get(cacheKey)\n    if (!shared) {\n      shared = createQueue<EventJobData>(EVENTS_QUEUE_NAME, 'async', {\n        connection: { url: redisUrl },\n      })\n      registry.set(cacheKey, shared)\n      registerProducerShutdownHook()\n    }\n    return shared\n  }\n\n  /**\n   * Delivers an event to all registered in-memory handlers.\n   * Supports wildcard pattern matching for event patterns.\n   *\n   * Handler errors are logged and delivery continues - one bad subscriber must\n   * not stop the others. The count of failed PERSISTENT handlers is returned so\n   * the caller can decide whether the inline run may be recorded as complete:\n   * a persistent subscriber that threw inline has no retry of its own, so the\n   * queued job must stay unstamped and let the worker run it again.\n   */\n  async function deliver(\n    event: string,\n    payload: EventPayload,\n    options?: EmitOptions,\n    skipPersistent = false,\n  ): Promise<{ persistentFailures: number }> {\n    let persistentFailures = 0\n    // Check all registered patterns (including wildcards)\n    for (const [pattern, handlers] of listeners) {\n      if (!matchEventPattern(event, pattern)) continue\n      if (!handlers || handlers.size === 0) continue\n\n      for (const subscriber of handlers) {\n        // Single-delivery: persistent subscribers are dispatched by the worker,\n        // so skip them inline to avoid double execution.\n        if (skipPersistent && persistentSubscribers.has(subscriber)) continue\n        try {\n          // Pass eventName in context for wildcard handlers\n          const moduleId = subscriber.moduleId ?? inferModuleIdFromResourceId(subscriber.id)\n          await withModuleResourceUsage(\n            {\n              moduleId,\n              surface: 'subscriber',\n              operation: `${event} -> ${subscriber.id ?? subscriber.event}`,\n              resourceId: subscriber.id ?? subscriber.event,\n            },\n            () => subscriber.handler(payload, {\n              resolve: opts.resolve,\n              eventName: event,\n              tenantId: options?.tenantId ?? null,\n              organizationId: options?.organizationId ?? null,\n            }),\n          )\n        } catch (error) {\n          if (persistentSubscribers.has(subscriber)) {\n            persistentFailures += 1\n          }\n          logger.error('Handler error', { event, pattern, err: error })\n          if (options?.rethrowHandlerErrors) {\n            throw error\n          }\n        }\n      }\n    }\n    return { persistentFailures }\n  }\n\n  /**\n   * Selects the subscribers the events worker owns for a queued event: every\n   * pattern matching `event`, keeping persistent subscribers only, so wildcard\n   * (`event: '*'`) persistent subscribers are reached exactly once here.\n   *\n   * Deliberately does NOT read `OM_EVENTS_SINGLE_DELIVERY`. Whether inline\n   * delivery already happened is carried by the job's `persistentDeliveredInline`\n   * stamp, so the producer owns that decision entirely and the worker cannot\n   * disagree with it across processes. Reading the flag here would reintroduce\n   * exactly that skew: a worker whose env has the flag off would fall back to\n   * exact-match, re-running ephemeral subscribers the producer already ran inline\n   * and never reaching wildcard persistent subscribers - the failure this whole\n   * change exists to remove.\n   *\n   * Every job that reaches this point wants persistent-pattern selection: a job\n   * is only dispatched when its stamp is false, which means either the producer\n   * had single-delivery on, or the emit was enqueue-only (`deliverInline: false`,\n   * documented as \"every subscriber to the event is persistent\").\n   */\n  function selectQueuedSubscribers(event: string): RegisteredSubscriber[] {\n    const matched: RegisteredSubscriber[] = []\n    for (const [pattern, handlers] of listeners) {\n      if (!matchEventPattern(event, pattern)) {\n        continue\n      }\n      for (const subscriber of handlers) {\n        if (subscriber.persistent) {\n          matched.push(subscriber)\n        }\n      }\n    }\n    return matched\n  }\n\n  /**\n   * Dispatches a queued event on behalf of the events worker.\n   *\n   * Handler failures are returned instead of logged-and-swallowed the way\n   * `deliver()` does them: the worker needs them to propagate so the queue retries\n   * the job and eventually dead-letters it.\n   *\n   * Subscribers run against the caller's `resolve` when one is given, falling back\n   * to the bus's own. The events worker passes its per-job `ctx.resolve`, which is\n   * the container `createPerJobWorkerHandler` built for that job - the handle the\n   * queue contract already hands it. Defaulting to `opts.resolve` instead would\n   * bind subscribers to whichever container built the bus; that is the same object\n   * on the default configuration, but not under `OM_BOOTSTRAP_CACHE`, where the\n   * cached bus is replayed into later containers while its captured resolver stays\n   * bound to the first.\n   */\n  async function dispatchQueued(\n    event: string,\n    payload: EventPayload,\n    options?: EmitOptions,\n    resolve?: <T = unknown>(name: string) => T,\n  ): Promise<QueuedDispatchResult[]> {\n    const subscribers = selectQueuedSubscribers(event)\n    if (subscribers.length === 0) {\n      return []\n    }\n\n    const resolver = resolve ?? opts.resolve\n\n    const settled = await Promise.allSettled(\n      subscribers.map((subscriber) =>\n        withModuleResourceUsage(\n          {\n            moduleId: subscriber.moduleId ?? inferModuleIdFromResourceId(subscriber.id),\n            surface: 'subscriber',\n            operation: `${event} -> ${subscriber.id ?? subscriber.event}`,\n            resourceId: subscriber.id ?? subscriber.event,\n          },\n          () => subscriber.handler(payload, {\n            resolve: resolver,\n            eventName: event,\n            tenantId: options?.tenantId ?? null,\n            organizationId: options?.organizationId ?? null,\n          }),\n        ),\n      ),\n    )\n\n    return settled.map((result, index) => {\n      const subscriberId = subscribers[index].id ?? subscribers[index].event\n      return result.status === 'rejected'\n        ? { subscriberId, ok: false, error: result.reason }\n        : { subscriberId, ok: true }\n    })\n  }\n\n  /**\n   * Registers a handler for an event. Pass `moduleId` whenever the subscribing\n   * module is known (e.g. a module reacting to another module's event) so\n   * resource-usage telemetry attributes the handler correctly instead of\n   * guessing a module id from the event name.\n   */\n  function on(\n    event: string,\n    handler: SubscriberHandler,\n    options?: { persistent?: boolean; moduleId?: string; id?: string },\n  ): void {\n    if (!listeners.has(event)) {\n      listeners.set(event, new Set())\n    }\n    const subscriber: RegisteredSubscriber = {\n      id: options?.id,\n      moduleId: options?.moduleId,\n      event,\n      handler,\n      persistent: options?.persistent,\n    }\n    listeners.get(event)!.add(subscriber)\n    if (options?.persistent) {\n      persistentSubscribers.add(subscriber)\n    }\n  }\n\n  /**\n   * Registers multiple module subscribers at once.\n   */\n  function registerModuleSubscribers(subs: SubscriberDescriptor[]): void {\n    for (const sub of subs) {\n      on(sub.event, sub.handler, { persistent: sub.persistent, moduleId: sub.moduleId, id: sub.id })\n    }\n  }\n\n  /**\n   * Emits an event to all registered handlers.\n   *\n   * If `persistent: true`, also enqueues the event for async processing.\n   */\n  async function emit(\n    event: string,\n    payload: EventPayload,\n    options?: EmitOptions\n  ): Promise<void> {\n    const taps = getGlobalEventTaps()\n    for (const tap of taps) {\n      try {\n        await Promise.resolve(tap(event, payload, options))\n      } catch (error) {\n        logger.error('Global tap error', { event, err: error })\n      }\n    }\n\n    // Deliver to in-memory handlers first. Under single-delivery, persistent\n    // subscribers are skipped inline on a persistent emit because the events\n    // worker will dispatch them from the queue.\n    //\n    // `deliverInline: false` on a persistent emit is enqueue-only: skip inline\n    // delivery entirely so a heavy persistent job runs solely in the events\n    // worker, off the caller's request path (the queued enqueue below still\n    // happens). Without this, a persistent emit dual-dispatches by default and\n    // runs the subscriber inline in the caller's request too.\n    const enqueueOnly = Boolean(options?.persistent) && options?.deliverInline === false\n    // Read the mode once so the inline skip and the stamp below cannot disagree.\n    const singleDelivery = isSingleDeliveryEnabled()\n    let inlinePersistentFailed = false\n    if (!enqueueOnly) {\n      const skipPersistentInline = Boolean(options?.persistent) && singleDelivery\n      const delivered = await deliver(event, payload, options, skipPersistentInline)\n      inlinePersistentFailed = delivered.persistentFailures > 0\n    }\n\n    if (isBroadcastEvent(event) && hasTenantScope(payload)) {\n      try {\n        await publishCrossProcessEvent(event, payload, options)\n      } catch (error) {\n        logger.error('Cross-process publish error', { event, err: error })\n      }\n    }\n\n    // If persistent, also enqueue for async processing\n    if (options?.persistent) {\n      const q = getQueue()\n      await q.enqueue({\n        event,\n        payload,\n        options,\n        // Only record the inline run as complete when every persistent\n        // subscriber actually succeeded. Inline delivery logs-and-continues, so a\n        // handler that threw has no retry of its own; leaving the job unstamped\n        // hands it to the worker, where a failure gets queue retry and\n        // dead-lettering. Without this, flipping the flag off (which the\n        // `mercato server` guard can do automatically) silently downgrades\n        // persistent delivery to at-most-once.\n        persistentDeliveredInline: !enqueueOnly && !singleDelivery && !inlinePersistentFailed,\n      })\n    }\n  }\n\n  /**\n   * Clears all events from the persistent queue.\n   */\n  async function clearQueue(): Promise<{ removed: number }> {\n    const q = getQueue()\n    return q.clear()\n  }\n\n  // Backward compatibility alias\n  const emitEvent = emit\n\n  return {\n    emit,\n    emitEvent, // Alias for backward compatibility\n    on,\n    registerModuleSubscribers,\n    dispatchQueued,\n    clearQueue,\n  }\n}\n"],
-  "mappings": "AAAA,SAAS,mBAAmB;AAE5B,SAAS,+BAA+B;AACxC,SAAS,oBAAoB;AAC7B,SAAS,iCAAiC;AAC1C,SAAS,yBAAyB;AAClC,SAAS,0BAA0B;AACnC,SAAS,wBAAwB;AACjC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,yCAAyC;AAClD,SAAS,gCAAgC;AAYzC,MAAM,oBAAoB;AAE1B,MAAM,SAAS,aAAa,QAAQ;AAyBpC,SAAS,0BAAmC;AAC1C,SAAO,0BAA0B;AACnC;AAGA,MAAM,wBAAwB;AAE9B,SAAS,eAAe,SAAgC;AACtD,SAAO,OAAQ,SAAqC,aAAa,YAC5D,OAAQ,QAAoC,QAAQ,EAAE,KAAK,EAAE,SAAS;AAC7E;AAEA,SAAS,qBAA0C;AACjD,QAAM,WAAY,WAAuC,qBAAqB;AAC9E,MAAI,oBAAoB,KAAK;AAC3B,WAAO;AAAA,EACT;AACA,QAAM,UAAU,oBAAI,IAAoB;AACvC,EAAC,WAAuC,qBAAqB,IAAI;AAClE,SAAO;AACT;AAEO,SAAS,uBAAuB,SAAqC;AAC1E,QAAM,OAAO,mBAAmB;AAChC,OAAK,IAAI,OAAO;AAChB,SAAO,MAAM;AACX,SAAK,OAAO,OAAO;AAAA,EACrB;AACF;AA0BA,MAAM,4BAA4B;AAClC,MAAM,+BAA+B;AAErC,SAAS,0BAAmC;AAC1C,SAAO,wBAAwB,QAAQ,IAAI,2BAA2B,IAAI;AAC5E;AAEA,SAAS,2BAA6D;AACpE,QAAM,WAAY,WAAuC,yBAAyB;AAClF,MAAI,oBAAoB,KAAK;AAC3B,WAAO;AAAA,EACT;AACA,QAAM,UAAU,oBAAI,IAAiC;AACpD,EAAC,WAAuC,yBAAyB,IAAI;AACtE,SAAO;AACT;AAEA,SAAS,+BAAqC;AAC5C,MAAK,WAAuC,4BAA4B,EAAG;AAC3E,QAAM,WAAW,MAAM;AACrB,UAAM,WAAW,yBAAyB;AAC1C,eAAW,eAAe,SAAS,OAAO,GAAG;AAC3C,cAAQ,QAAQ,YAAY,MAAM,CAAC,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAAA,IACrD;AACA,aAAS,MAAM;AAAA,EACjB;AACA,UAAQ,KAAK,WAAW,QAAQ;AAChC,UAAQ,KAAK,UAAU,QAAQ;AAC9B,EAAC,WAAuC,4BAA4B,IAAI;AAC3E;AAgCO,SAAS,eAAe,MAAkC;AAE/D,QAAM,YAAY,oBAAI,IAAuC;AAG7D,QAAM,wBAAwB,oBAAI,IAA0B;AAG5D,QAAM,gBAAgB,KAAK,kBACxB,QAAQ,IAAI,mBAAmB,UAAU,UAAU;AAGtD,MAAI,QAAoC;AAUxC,WAAS,WAAgC;AACvC,QAAI,kBAAkB,WAAW,CAAC,wBAAwB,GAAG;AAC3D,UAAI,CAAC,OAAO;AACV,gBAAQ,kBAAkB,UACtB,YAA0B,mBAAmB,SAAS;AAAA,UACpD,YAAY,EAAE,KAAK,mBAAmB,OAAO,EAAE;AAAA,QACjD,CAAC,IACD,YAA0B,mBAAmB,OAAO;AAAA,MAC1D;AACA,aAAO;AAAA,IACT;AAEA,UAAM,WAAW,mBAAmB,OAAO;AAC3C,UAAM,WAAW,yBAAyB;AAC1C,UAAM,WAAW,SAAS,QAAQ;AAClC,QAAI,SAAS,SAAS,IAAI,QAAQ;AAClC,QAAI,CAAC,QAAQ;AACX,eAAS,YAA0B,mBAAmB,SAAS;AAAA,QAC7D,YAAY,EAAE,KAAK,SAAS;AAAA,MAC9B,CAAC;AACD,eAAS,IAAI,UAAU,MAAM;AAC7B,mCAA6B;AAAA,IAC/B;AACA,WAAO;AAAA,EACT;AAYA,iBAAe,QACb,OACA,SACA,SACA,iBAAiB,OACwB;AACzC,QAAI,qBAAqB;AAEzB,eAAW,CAAC,SAAS,QAAQ,KAAK,WAAW;AAC3C,UAAI,CAAC,kBAAkB,OAAO,OAAO,EAAG;AACxC,UAAI,CAAC,YAAY,SAAS,SAAS,EAAG;AAEtC,iBAAW,cAAc,UAAU;AAGjC,YAAI,kBAAkB,sBAAsB,IAAI,UAAU,EAAG;AAC7D,YAAI;AAEF,gBAAM,WAAW,WAAW,YAAY,4BAA4B,WAAW,EAAE;AACjF,gBAAM;AAAA,YACJ;AAAA,cACE;AAAA,cACA,SAAS;AAAA,cACT,WAAW,GAAG,KAAK,OAAO,WAAW,MAAM,WAAW,KAAK;AAAA,cAC3D,YAAY,WAAW,MAAM,WAAW;AAAA,YAC1C;AAAA,YACA,MAAM,WAAW,QAAQ,SAAS;AAAA,cAChC,SAAS,KAAK;AAAA,cACd,WAAW;AAAA,cACX,UAAU,SAAS,YAAY;AAAA,cAC/B,gBAAgB,SAAS,kBAAkB;AAAA,YAC7C,CAAC;AAAA,UACH;AAAA,QACF,SAAS,OAAO;AACd,cAAI,sBAAsB,IAAI,UAAU,GAAG;AACzC,kCAAsB;AAAA,UACxB;AACA,iBAAO,MAAM,iBAAiB,EAAE,OAAO,SAAS,KAAK,MAAM,CAAC;AAC5D,cAAI,SAAS,sBAAsB;AACjC,kBAAM;AAAA,UACR;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,WAAO,EAAE,mBAAmB;AAAA,EAC9B;AAqBA,WAAS,wBAAwB,OAAuC;AACtE,UAAM,UAAkC,CAAC;AACzC,eAAW,CAAC,SAAS,QAAQ,KAAK,WAAW;AAC3C,UAAI,CAAC,kBAAkB,OAAO,OAAO,GAAG;AACtC;AAAA,MACF;AACA,iBAAW,cAAc,UAAU;AACjC,YAAI,WAAW,YAAY;AACzB,kBAAQ,KAAK,UAAU;AAAA,QACzB;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAkBA,iBAAe,eACb,OACA,SACA,SACA,SACiC;AACjC,UAAM,cAAc,wBAAwB,KAAK;AACjD,QAAI,YAAY,WAAW,GAAG;AAC5B,aAAO,CAAC;AAAA,IACV;AAEA,UAAM,WAAW,WAAW,KAAK;AAEjC,UAAM,UAAU,MAAM,QAAQ;AAAA,MAC5B,YAAY;AAAA,QAAI,CAAC,eACf;AAAA,UACE;AAAA,YACE,UAAU,WAAW,YAAY,4BAA4B,WAAW,EAAE;AAAA,YAC1E,SAAS;AAAA,YACT,WAAW,GAAG,KAAK,OAAO,WAAW,MAAM,WAAW,KAAK;AAAA,YAC3D,YAAY,WAAW,MAAM,WAAW;AAAA,UAC1C;AAAA,UACA,MAAM,WAAW,QAAQ,SAAS;AAAA,YAChC,SAAS;AAAA,YACT,WAAW;AAAA,YACX,UAAU,SAAS,YAAY;AAAA,YAC/B,gBAAgB,SAAS,kBAAkB;AAAA,UAC7C,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAEA,WAAO,QAAQ,IAAI,CAAC,QAAQ,UAAU;AACpC,YAAM,eAAe,YAAY,KAAK,EAAE,MAAM,YAAY,KAAK,EAAE;AACjE,aAAO,OAAO,WAAW,aACrB,EAAE,cAAc,IAAI,OAAO,OAAO,OAAO,OAAO,IAChD,EAAE,cAAc,IAAI,KAAK;AAAA,IAC/B,CAAC;AAAA,EACH;AAQA,WAAS,GACP,OACA,SACA,SACM;AACN,QAAI,CAAC,UAAU,IAAI,KAAK,GAAG;AACzB,gBAAU,IAAI,OAAO,oBAAI,IAAI,CAAC;AAAA,IAChC;AACA,UAAM,aAAmC;AAAA,MACvC,IAAI,SAAS;AAAA,MACb,UAAU,SAAS;AAAA,MACnB;AAAA,MACA;AAAA,MACA,YAAY,SAAS;AAAA,IACvB;AACA,cAAU,IAAI,KAAK,EAAG,IAAI,UAAU;AACpC,QAAI,SAAS,YAAY;AACvB,4BAAsB,IAAI,UAAU;AAAA,IACtC;AAAA,EACF;AAKA,WAAS,0BAA0B,MAAoC;AACrE,eAAW,OAAO,MAAM;AACtB,SAAG,IAAI,OAAO,IAAI,SAAS,EAAE,YAAY,IAAI,YAAY,UAAU,IAAI,UAAU,IAAI,IAAI,GAAG,CAAC;AAAA,IAC/F;AAAA,EACF;AAOA,iBAAe,KACb,OACA,SACA,SACe;AACf,UAAM,OAAO,mBAAmB;AAChC,eAAW,OAAO,MAAM;AACtB,UAAI;AACF,cAAM,QAAQ,QAAQ,IAAI,OAAO,SAAS,OAAO,CAAC;AAAA,MACpD,SAAS,OAAO;AACd,eAAO,MAAM,oBAAoB,EAAE,OAAO,KAAK,MAAM,CAAC;AAAA,MACxD;AAAA,IACF;AAWA,UAAM,cAAc,QAAQ,SAAS,UAAU,KAAK,SAAS,kBAAkB;AAE/E,UAAM,iBAAiB,wBAAwB;AAC/C,QAAI,yBAAyB;AAC7B,QAAI,CAAC,aAAa;AAChB,YAAM,uBAAuB,QAAQ,SAAS,UAAU,KAAK;AAC7D,YAAM,YAAY,MAAM,QAAQ,OAAO,SAAS,SAAS,oBAAoB;AAC7E,+BAAyB,UAAU,qBAAqB;AAAA,IAC1D;AAEA,QAAI,iBAAiB,KAAK,KAAK,eAAe,OAAO,GAAG;AACtD,UAAI;AACF,cAAM,yBAAyB,OAAO,SAAS,OAAO;AAAA,MACxD,SAAS,OAAO;AACd,eAAO,MAAM,+BAA+B,EAAE,OAAO,KAAK,MAAM,CAAC;AAAA,MACnE;AAAA,IACF;AAGA,QAAI,SAAS,YAAY;AACvB,YAAM,IAAI,SAAS;AACnB,YAAM,EAAE,QAAQ;AAAA,QACd;AAAA,QACA;AAAA,QACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAQA,2BAA2B,CAAC,eAAe,CAAC,kBAAkB,CAAC;AAAA,MACjE,CAAC;AAAA,IACH;AAAA,EACF;AAKA,iBAAe,aAA2C;AACxD,UAAM,IAAI,SAAS;AACnB,WAAO,EAAE,MAAM;AAAA,EACjB;AAGA,QAAM,YAAY;AAElB,SAAO;AAAA,IACL;AAAA,IACA;AAAA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { createQueue } from '@open-mercato/queue'\nimport type { Queue } from '@open-mercato/queue'\nimport { parseBooleanWithDefault } from '@open-mercato/shared/lib/boolean'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { isSingleDeliveryRequested } from './single-delivery'\nimport { matchEventPattern } from '@open-mercato/shared/lib/events/patterns'\nimport { getRedisUrlOrThrow } from '@open-mercato/shared/lib/redis/connection'\nimport { isBroadcastEvent } from '@open-mercato/shared/modules/events'\nimport {\n  inferModuleIdFromResourceId,\n  withModuleResourceUsage,\n} from '@open-mercato/shared/lib/modules/resource-usage'\nexport { registerCrossProcessEventListener } from './bridge'\nimport { publishCrossProcessEvent } from './bridge'\nimport type {\n  EventBus,\n  CreateBusOptions,\n  SubscriberHandler,\n  SubscriberDescriptor,\n  EventPayload,\n  EmitOptions,\n  QueuedDispatchResult,\n} from './types'\n\n/** Queue name for persistent events */\nconst EVENTS_QUEUE_NAME = 'events'\n\nconst logger = createLogger('events')\n\ntype RegisteredSubscriber = {\n  id?: string\n  moduleId?: string\n  event: string\n  handler: SubscriberHandler\n  persistent?: boolean\n}\n\n/**\n * When enabled, a persistent emit delivers each subscriber on exactly one path:\n * persistent-marked subscribers are skipped inline (the events worker dispatches\n * them via pattern match, so wildcard persistent subscribers are reached), while\n * ephemeral subscribers keep running inline. Defaults ON.\n *\n * The bus never second-guesses this against \"is a worker running\": the queue is\n * durable, so a persistent emit with no worker yet is delayed, not lost, and a\n * worker started later drains the backlog. Delivering inline instead would move\n * the work back onto the caller's request path \u2014 exactly what a split app/worker\n * deployment sets `AUTO_SPAWN_WORKERS=false` to avoid.\n *\n * The events worker asks this same bus for its subscribers via `dispatchQueued`,\n * so both halves of single-delivery read one decision.\n */\nfunction isSingleDeliveryEnabled(): boolean {\n  return isSingleDeliveryRequested()\n}\n\ntype GlobalEventTap = (event: string, payload: EventPayload, options?: EmitOptions) => void | Promise<void>\nconst GLOBAL_EVENT_TAPS_KEY = '__openMercatoEventBusGlobalTaps__'\n\nfunction hasTenantScope(payload: EventPayload): boolean {\n  return typeof (payload as Record<string, unknown>)?.tenantId === 'string'\n    && String((payload as Record<string, unknown>).tenantId).trim().length > 0\n}\n\nfunction getGlobalEventTaps(): Set<GlobalEventTap> {\n  const existing = (globalThis as Record<string, unknown>)[GLOBAL_EVENT_TAPS_KEY]\n  if (existing instanceof Set) {\n    return existing as Set<GlobalEventTap>\n  }\n  const created = new Set<GlobalEventTap>()\n  ;(globalThis as Record<string, unknown>)[GLOBAL_EVENT_TAPS_KEY] = created\n  return created\n}\n\nexport function registerGlobalEventTap(handler: GlobalEventTap): () => void {\n  const taps = getGlobalEventTaps()\n  taps.add(handler)\n  return () => {\n    taps.delete(handler)\n  }\n}\n\n/** Job data structure for queued events */\ntype EventJobData = {\n  event: string\n  payload: EventPayload\n  options?: EmitOptions\n  /**\n   * Set by the producer when it already ran the persistent subscribers inline\n   * (single-delivery reconciled off). The worker skips such jobs, so the app and\n   * the worker staying exactly-once no longer depends on both processes agreeing\n   * about `OM_EVENTS_SINGLE_DELIVERY`. Absent on jobs queued before this field\n   * existed, which keeps their behavior unchanged.\n   */\n  persistentDeliveredInline?: boolean\n}\n\n// Process-wide cache of the async (BullMQ) persistent-events producer queue.\n// Each authenticated request builds a fresh DI container and event bus, so a\n// per-bus producer queue opened a new ioredis connection per write request that\n// was never closed \u2014 leaking one Redis connection per request until maxclients\n// exhaustion. Memoizing the producer on `globalThis` (keyed by Redis URL, so a\n// reconfigured URL still gets its own queue) keeps it at one connection per\n// process, mirroring the `GLOBAL_EVENT_TAPS_KEY` and `getCachedRateLimiterService`\n// patterns. The local (file-based) strategy holds no pooled connection and its\n// base dir is cwd-relative, so it stays per-bus.\nconst EVENTS_PRODUCER_QUEUE_KEY = '__openMercatoEventsProducerQueues__'\nconst EVENTS_PRODUCER_SHUTDOWN_KEY = '__openMercatoEventsProducerShutdown__'\n\nfunction isSharedProducerEnabled(): boolean {\n  return parseBooleanWithDefault(process.env.OM_EVENTS_SHARED_PRODUCER, true)\n}\n\nfunction getProducerQueueRegistry(): Map<string, Queue<EventJobData>> {\n  const existing = (globalThis as Record<string, unknown>)[EVENTS_PRODUCER_QUEUE_KEY]\n  if (existing instanceof Map) {\n    return existing as Map<string, Queue<EventJobData>>\n  }\n  const created = new Map<string, Queue<EventJobData>>()\n  ;(globalThis as Record<string, unknown>)[EVENTS_PRODUCER_QUEUE_KEY] = created\n  return created\n}\n\nfunction registerProducerShutdownHook(): void {\n  if ((globalThis as Record<string, unknown>)[EVENTS_PRODUCER_SHUTDOWN_KEY]) return\n  const shutdown = () => {\n    const registry = getProducerQueueRegistry()\n    for (const sharedQueue of registry.values()) {\n      Promise.resolve(sharedQueue.close()).catch(() => {})\n    }\n    registry.clear()\n  }\n  process.once('SIGTERM', shutdown)\n  process.once('SIGINT', shutdown)\n  ;(globalThis as Record<string, unknown>)[EVENTS_PRODUCER_SHUTDOWN_KEY] = true\n}\n\n/**\n * Creates an event bus instance.\n *\n * The event bus provides:\n * - In-memory event delivery to registered handlers\n * - Optional persistence via the queue package when `persistent: true`\n *\n * @param opts - Configuration options\n * @returns An EventBus instance\n *\n * @example\n * ```typescript\n * const bus = createEventBus({\n *   resolve: container.resolve.bind(container),\n *   queueStrategy: 'local', // or 'async' for BullMQ\n * })\n *\n * // Register a handler\n * bus.on('user.created', async (payload, ctx) => {\n *   const userService = ctx.resolve('userService')\n *   await userService.sendWelcomeEmail(payload.userId)\n * })\n *\n * // Emit an event (immediate delivery)\n * await bus.emit('user.created', { userId: '123' })\n *\n * // Emit with persistence (for async worker processing)\n * await bus.emit('order.placed', { orderId: '456' }, { persistent: true })\n * ```\n */\nexport function createEventBus(opts: CreateBusOptions): EventBus {\n  // In-memory listeners for immediate event delivery\n  const listeners = new Map<string, Set<RegisteredSubscriber>>()\n  // Subscribers registered as persistent (worker-dispatched). Used by the\n  // single-delivery path to skip them inline on a persistent emit.\n  const persistentSubscribers = new Set<RegisteredSubscriber>()\n\n  // Determine queue strategy from options or environment\n  const queueStrategy = opts.queueStrategy ??\n    (process.env.QUEUE_STRATEGY === 'async' ? 'async' : 'local')\n\n  // Lazy-initialized queue for persistent events\n  let queue: Queue<EventJobData> | null = null\n\n  /**\n   * Gets or creates the queue instance for persistent events.\n   *\n   * The async (BullMQ) producer is memoized process-wide so the per-request\n   * event bus reuses one Redis connection instead of leaking one per write\n   * request. The local strategy stays per-bus (no pooled connection, cwd-relative\n   * base dir). Set `OM_EVENTS_SHARED_PRODUCER=0` to fall back to per-bus producers.\n   */\n  function getQueue(): Queue<EventJobData> {\n    if (queueStrategy !== 'async' || !isSharedProducerEnabled()) {\n      if (!queue) {\n        queue = queueStrategy === 'async'\n          ? createQueue<EventJobData>(EVENTS_QUEUE_NAME, 'async', {\n              connection: { url: getRedisUrlOrThrow('QUEUE') },\n            })\n          : createQueue<EventJobData>(EVENTS_QUEUE_NAME, 'local')\n      }\n      return queue\n    }\n\n    const redisUrl = getRedisUrlOrThrow('QUEUE')\n    const registry = getProducerQueueRegistry()\n    const cacheKey = `async:${redisUrl}`\n    let shared = registry.get(cacheKey)\n    if (!shared) {\n      shared = createQueue<EventJobData>(EVENTS_QUEUE_NAME, 'async', {\n        connection: { url: redisUrl },\n      })\n      registry.set(cacheKey, shared)\n      registerProducerShutdownHook()\n    }\n    return shared\n  }\n\n  /**\n   * Delivers an event to all registered in-memory handlers.\n   * Supports wildcard pattern matching for event patterns.\n   *\n   * Handler errors are logged and delivery continues - one bad subscriber must\n   * not stop the others. The count of failed PERSISTENT handlers is returned so\n   * the caller can decide whether the inline run may be recorded as complete:\n   * a persistent subscriber that threw inline has no retry of its own, so the\n   * queued job must stay unstamped and let the worker run it again.\n   */\n  async function deliver(\n    event: string,\n    payload: EventPayload,\n    options?: EmitOptions,\n    skipPersistent = false,\n  ): Promise<{ persistentFailures: number }> {\n    let persistentFailures = 0\n    // Check all registered patterns (including wildcards)\n    for (const [pattern, handlers] of listeners) {\n      if (!matchEventPattern(event, pattern)) continue\n      if (!handlers || handlers.size === 0) continue\n\n      for (const subscriber of handlers) {\n        // Single-delivery: persistent subscribers are dispatched by the worker,\n        // so skip them inline to avoid double execution.\n        if (skipPersistent && persistentSubscribers.has(subscriber)) continue\n        try {\n          // Pass eventName in context for wildcard handlers\n          const moduleId = subscriber.moduleId ?? inferModuleIdFromResourceId(subscriber.id)\n          await withModuleResourceUsage(\n            {\n              moduleId,\n              surface: 'subscriber',\n              operation: `${event} -> ${subscriber.id ?? subscriber.event}`,\n              resourceId: subscriber.id ?? subscriber.event,\n            },\n            () => subscriber.handler(payload, {\n              resolve: opts.resolve,\n              eventName: event,\n              tenantId: options?.tenantId ?? null,\n              organizationId: options?.organizationId ?? null,\n            }),\n          )\n        } catch (error) {\n          if (persistentSubscribers.has(subscriber)) {\n            persistentFailures += 1\n          }\n          logger.error('Handler error', { event, pattern, err: error })\n          if (options?.rethrowHandlerErrors) {\n            throw error\n          }\n        }\n      }\n    }\n    return { persistentFailures }\n  }\n\n  /**\n   * Selects the subscribers the events worker owns for a queued event: every\n   * pattern matching `event`, keeping persistent subscribers only, so wildcard\n   * (`event: '*'`) persistent subscribers are reached exactly once here.\n   *\n   * Deliberately does NOT read `OM_EVENTS_SINGLE_DELIVERY`. Whether inline\n   * delivery already happened is carried by the job's `persistentDeliveredInline`\n   * stamp, so the producer owns that decision entirely and the worker cannot\n   * disagree with it across processes. Reading the flag here would reintroduce\n   * exactly that skew: a worker whose env has the flag off would fall back to\n   * exact-match, re-running ephemeral subscribers the producer already ran inline\n   * and never reaching wildcard persistent subscribers - the failure this whole\n   * change exists to remove.\n   *\n   * Every job that reaches this point wants persistent-pattern selection: a job\n   * is only dispatched when its stamp is false, which means either the producer\n   * had single-delivery on, or the emit was enqueue-only (`deliverInline: false`,\n   * documented as \"every subscriber to the event is persistent\").\n   */\n  function selectQueuedSubscribers(event: string): RegisteredSubscriber[] {\n    const matched: RegisteredSubscriber[] = []\n    for (const [pattern, handlers] of listeners) {\n      if (!matchEventPattern(event, pattern)) {\n        continue\n      }\n      for (const subscriber of handlers) {\n        if (subscriber.persistent) {\n          matched.push(subscriber)\n        }\n      }\n    }\n    return matched\n  }\n\n  /**\n   * Dispatches a queued event on behalf of the events worker.\n   *\n   * Handler failures are returned instead of logged-and-swallowed the way\n   * `deliver()` does them: the worker needs them to propagate so the queue retries\n   * the job and eventually dead-letters it.\n   *\n   * Subscribers run against the caller's `resolve` when one is given, falling back\n   * to the bus's own. The events worker passes its per-job `ctx.resolve`, which is\n   * the container `createPerJobWorkerHandler` built for that job - the handle the\n   * queue contract already hands it. Defaulting to `opts.resolve` instead would\n   * bind subscribers to whichever container built the bus; that is the same object\n   * on the default configuration, but not under `OM_BOOTSTRAP_CACHE`, where the\n   * cached bus is replayed into later containers while its captured resolver stays\n   * bound to the first.\n   */\n  async function dispatchQueued(\n    event: string,\n    payload: EventPayload,\n    options?: EmitOptions,\n    resolve?: <T = unknown>(name: string) => T,\n  ): Promise<QueuedDispatchResult[]> {\n    const subscribers = selectQueuedSubscribers(event)\n    if (subscribers.length === 0) {\n      return []\n    }\n\n    const resolver = resolve ?? opts.resolve\n\n    const settled = await Promise.allSettled(\n      subscribers.map((subscriber) =>\n        withModuleResourceUsage(\n          {\n            moduleId: subscriber.moduleId ?? inferModuleIdFromResourceId(subscriber.id),\n            surface: 'subscriber',\n            operation: `${event} -> ${subscriber.id ?? subscriber.event}`,\n            resourceId: subscriber.id ?? subscriber.event,\n          },\n          () => subscriber.handler(payload, {\n            resolve: resolver,\n            eventName: event,\n            tenantId: options?.tenantId ?? null,\n            organizationId: options?.organizationId ?? null,\n          }),\n        ),\n      ),\n    )\n\n    return settled.map((result, index) => {\n      const subscriberId = subscribers[index].id ?? subscribers[index].event\n      return result.status === 'rejected'\n        ? { subscriberId, ok: false, error: result.reason }\n        : { subscriberId, ok: true }\n    })\n  }\n\n  /**\n   * Registers a handler for an event. Pass `moduleId` whenever the subscribing\n   * module is known (e.g. a module reacting to another module's event) so\n   * resource-usage telemetry attributes the handler correctly instead of\n   * guessing a module id from the event name.\n   */\n  function on(\n    event: string,\n    handler: SubscriberHandler,\n    options?: { persistent?: boolean; moduleId?: string; id?: string },\n  ): void {\n    if (!listeners.has(event)) {\n      listeners.set(event, new Set())\n    }\n    const subscriber: RegisteredSubscriber = {\n      id: options?.id,\n      moduleId: options?.moduleId,\n      event,\n      handler,\n      persistent: options?.persistent,\n    }\n    listeners.get(event)!.add(subscriber)\n    if (options?.persistent) {\n      persistentSubscribers.add(subscriber)\n    }\n  }\n\n  /**\n   * Registers multiple module subscribers at once.\n   */\n  function registerModuleSubscribers(subs: SubscriberDescriptor[]): void {\n    for (const sub of subs) {\n      on(sub.event, sub.handler, { persistent: sub.persistent, moduleId: sub.moduleId, id: sub.id })\n    }\n  }\n\n  /**\n   * Emits an event to all registered handlers.\n   *\n   * If `persistent: true`, also enqueues the event for async processing.\n   */\n  async function emit(\n    event: string,\n    payload: EventPayload,\n    options?: EmitOptions\n  ): Promise<void> {\n    const taps = getGlobalEventTaps()\n    for (const tap of taps) {\n      try {\n        await Promise.resolve(tap(event, payload, options))\n      } catch (error) {\n        logger.error('Global tap error', { event, err: error })\n      }\n    }\n\n    // Deliver to in-memory handlers first. Under single-delivery, persistent\n    // subscribers are skipped inline on a persistent emit because the events\n    // worker will dispatch them from the queue.\n    //\n    // `deliverInline: false` on a persistent emit is enqueue-only: skip inline\n    // delivery entirely so a heavy persistent job runs solely in the events\n    // worker, off the caller's request path (the queued enqueue below still\n    // happens). Without this, a persistent emit dual-dispatches by default and\n    // runs the subscriber inline in the caller's request too.\n    const enqueueOnly = Boolean(options?.persistent) && options?.deliverInline === false\n    // Read the mode once so the inline skip and the stamp below cannot disagree.\n    const singleDelivery = isSingleDeliveryEnabled()\n    const skipPersistentInline = options?.skipPersistentSubscribersInline === true\n      || (Boolean(options?.persistent) && singleDelivery)\n    let inlinePersistentFailed = false\n    if (!enqueueOnly) {\n      const delivered = await deliver(event, payload, options, skipPersistentInline)\n      inlinePersistentFailed = delivered.persistentFailures > 0\n    }\n\n    if (isBroadcastEvent(event) && hasTenantScope(payload)) {\n      try {\n        await publishCrossProcessEvent(event, payload, options)\n      } catch (error) {\n        logger.error('Cross-process publish error', { event, err: error })\n      }\n    }\n\n    // If persistent, also enqueue for async processing\n    if (options?.persistent) {\n      const q = getQueue()\n      await q.enqueue({\n        event,\n        payload,\n        options,\n        // Only record the inline run as complete when every persistent\n        // subscriber actually succeeded. Inline delivery logs-and-continues, so a\n        // handler that threw has no retry of its own; leaving the job unstamped\n        // hands it to the worker, where a failure gets queue retry and\n        // dead-lettering. Without this, flipping the flag off (which the\n        // `mercato server` guard can do automatically) silently downgrades\n        // persistent delivery to at-most-once.\n        persistentDeliveredInline: !enqueueOnly && !skipPersistentInline && !inlinePersistentFailed,\n      })\n    }\n  }\n\n  /**\n   * Clears all events from the persistent queue.\n   */\n  async function clearQueue(): Promise<{ removed: number }> {\n    const q = getQueue()\n    return q.clear()\n  }\n\n  // Backward compatibility alias\n  const emitEvent = emit\n\n  return {\n    emit,\n    emitEvent, // Alias for backward compatibility\n    on,\n    registerModuleSubscribers,\n    dispatchQueued,\n    clearQueue,\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,mBAAmB;AAE5B,SAAS,+BAA+B;AACxC,SAAS,oBAAoB;AAC7B,SAAS,iCAAiC;AAC1C,SAAS,yBAAyB;AAClC,SAAS,0BAA0B;AACnC,SAAS,wBAAwB;AACjC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,yCAAyC;AAClD,SAAS,gCAAgC;AAYzC,MAAM,oBAAoB;AAE1B,MAAM,SAAS,aAAa,QAAQ;AAyBpC,SAAS,0BAAmC;AAC1C,SAAO,0BAA0B;AACnC;AAGA,MAAM,wBAAwB;AAE9B,SAAS,eAAe,SAAgC;AACtD,SAAO,OAAQ,SAAqC,aAAa,YAC5D,OAAQ,QAAoC,QAAQ,EAAE,KAAK,EAAE,SAAS;AAC7E;AAEA,SAAS,qBAA0C;AACjD,QAAM,WAAY,WAAuC,qBAAqB;AAC9E,MAAI,oBAAoB,KAAK;AAC3B,WAAO;AAAA,EACT;AACA,QAAM,UAAU,oBAAI,IAAoB;AACvC,EAAC,WAAuC,qBAAqB,IAAI;AAClE,SAAO;AACT;AAEO,SAAS,uBAAuB,SAAqC;AAC1E,QAAM,OAAO,mBAAmB;AAChC,OAAK,IAAI,OAAO;AAChB,SAAO,MAAM;AACX,SAAK,OAAO,OAAO;AAAA,EACrB;AACF;AA0BA,MAAM,4BAA4B;AAClC,MAAM,+BAA+B;AAErC,SAAS,0BAAmC;AAC1C,SAAO,wBAAwB,QAAQ,IAAI,2BAA2B,IAAI;AAC5E;AAEA,SAAS,2BAA6D;AACpE,QAAM,WAAY,WAAuC,yBAAyB;AAClF,MAAI,oBAAoB,KAAK;AAC3B,WAAO;AAAA,EACT;AACA,QAAM,UAAU,oBAAI,IAAiC;AACpD,EAAC,WAAuC,yBAAyB,IAAI;AACtE,SAAO;AACT;AAEA,SAAS,+BAAqC;AAC5C,MAAK,WAAuC,4BAA4B,EAAG;AAC3E,QAAM,WAAW,MAAM;AACrB,UAAM,WAAW,yBAAyB;AAC1C,eAAW,eAAe,SAAS,OAAO,GAAG;AAC3C,cAAQ,QAAQ,YAAY,MAAM,CAAC,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAAA,IACrD;AACA,aAAS,MAAM;AAAA,EACjB;AACA,UAAQ,KAAK,WAAW,QAAQ;AAChC,UAAQ,KAAK,UAAU,QAAQ;AAC9B,EAAC,WAAuC,4BAA4B,IAAI;AAC3E;AAgCO,SAAS,eAAe,MAAkC;AAE/D,QAAM,YAAY,oBAAI,IAAuC;AAG7D,QAAM,wBAAwB,oBAAI,IAA0B;AAG5D,QAAM,gBAAgB,KAAK,kBACxB,QAAQ,IAAI,mBAAmB,UAAU,UAAU;AAGtD,MAAI,QAAoC;AAUxC,WAAS,WAAgC;AACvC,QAAI,kBAAkB,WAAW,CAAC,wBAAwB,GAAG;AAC3D,UAAI,CAAC,OAAO;AACV,gBAAQ,kBAAkB,UACtB,YAA0B,mBAAmB,SAAS;AAAA,UACpD,YAAY,EAAE,KAAK,mBAAmB,OAAO,EAAE;AAAA,QACjD,CAAC,IACD,YAA0B,mBAAmB,OAAO;AAAA,MAC1D;AACA,aAAO;AAAA,IACT;AAEA,UAAM,WAAW,mBAAmB,OAAO;AAC3C,UAAM,WAAW,yBAAyB;AAC1C,UAAM,WAAW,SAAS,QAAQ;AAClC,QAAI,SAAS,SAAS,IAAI,QAAQ;AAClC,QAAI,CAAC,QAAQ;AACX,eAAS,YAA0B,mBAAmB,SAAS;AAAA,QAC7D,YAAY,EAAE,KAAK,SAAS;AAAA,MAC9B,CAAC;AACD,eAAS,IAAI,UAAU,MAAM;AAC7B,mCAA6B;AAAA,IAC/B;AACA,WAAO;AAAA,EACT;AAYA,iBAAe,QACb,OACA,SACA,SACA,iBAAiB,OACwB;AACzC,QAAI,qBAAqB;AAEzB,eAAW,CAAC,SAAS,QAAQ,KAAK,WAAW;AAC3C,UAAI,CAAC,kBAAkB,OAAO,OAAO,EAAG;AACxC,UAAI,CAAC,YAAY,SAAS,SAAS,EAAG;AAEtC,iBAAW,cAAc,UAAU;AAGjC,YAAI,kBAAkB,sBAAsB,IAAI,UAAU,EAAG;AAC7D,YAAI;AAEF,gBAAM,WAAW,WAAW,YAAY,4BAA4B,WAAW,EAAE;AACjF,gBAAM;AAAA,YACJ;AAAA,cACE;AAAA,cACA,SAAS;AAAA,cACT,WAAW,GAAG,KAAK,OAAO,WAAW,MAAM,WAAW,KAAK;AAAA,cAC3D,YAAY,WAAW,MAAM,WAAW;AAAA,YAC1C;AAAA,YACA,MAAM,WAAW,QAAQ,SAAS;AAAA,cAChC,SAAS,KAAK;AAAA,cACd,WAAW;AAAA,cACX,UAAU,SAAS,YAAY;AAAA,cAC/B,gBAAgB,SAAS,kBAAkB;AAAA,YAC7C,CAAC;AAAA,UACH;AAAA,QACF,SAAS,OAAO;AACd,cAAI,sBAAsB,IAAI,UAAU,GAAG;AACzC,kCAAsB;AAAA,UACxB;AACA,iBAAO,MAAM,iBAAiB,EAAE,OAAO,SAAS,KAAK,MAAM,CAAC;AAC5D,cAAI,SAAS,sBAAsB;AACjC,kBAAM;AAAA,UACR;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,WAAO,EAAE,mBAAmB;AAAA,EAC9B;AAqBA,WAAS,wBAAwB,OAAuC;AACtE,UAAM,UAAkC,CAAC;AACzC,eAAW,CAAC,SAAS,QAAQ,KAAK,WAAW;AAC3C,UAAI,CAAC,kBAAkB,OAAO,OAAO,GAAG;AACtC;AAAA,MACF;AACA,iBAAW,cAAc,UAAU;AACjC,YAAI,WAAW,YAAY;AACzB,kBAAQ,KAAK,UAAU;AAAA,QACzB;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAkBA,iBAAe,eACb,OACA,SACA,SACA,SACiC;AACjC,UAAM,cAAc,wBAAwB,KAAK;AACjD,QAAI,YAAY,WAAW,GAAG;AAC5B,aAAO,CAAC;AAAA,IACV;AAEA,UAAM,WAAW,WAAW,KAAK;AAEjC,UAAM,UAAU,MAAM,QAAQ;AAAA,MAC5B,YAAY;AAAA,QAAI,CAAC,eACf;AAAA,UACE;AAAA,YACE,UAAU,WAAW,YAAY,4BAA4B,WAAW,EAAE;AAAA,YAC1E,SAAS;AAAA,YACT,WAAW,GAAG,KAAK,OAAO,WAAW,MAAM,WAAW,KAAK;AAAA,YAC3D,YAAY,WAAW,MAAM,WAAW;AAAA,UAC1C;AAAA,UACA,MAAM,WAAW,QAAQ,SAAS;AAAA,YAChC,SAAS;AAAA,YACT,WAAW;AAAA,YACX,UAAU,SAAS,YAAY;AAAA,YAC/B,gBAAgB,SAAS,kBAAkB;AAAA,UAC7C,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAEA,WAAO,QAAQ,IAAI,CAAC,QAAQ,UAAU;AACpC,YAAM,eAAe,YAAY,KAAK,EAAE,MAAM,YAAY,KAAK,EAAE;AACjE,aAAO,OAAO,WAAW,aACrB,EAAE,cAAc,IAAI,OAAO,OAAO,OAAO,OAAO,IAChD,EAAE,cAAc,IAAI,KAAK;AAAA,IAC/B,CAAC;AAAA,EACH;AAQA,WAAS,GACP,OACA,SACA,SACM;AACN,QAAI,CAAC,UAAU,IAAI,KAAK,GAAG;AACzB,gBAAU,IAAI,OAAO,oBAAI,IAAI,CAAC;AAAA,IAChC;AACA,UAAM,aAAmC;AAAA,MACvC,IAAI,SAAS;AAAA,MACb,UAAU,SAAS;AAAA,MACnB;AAAA,MACA;AAAA,MACA,YAAY,SAAS;AAAA,IACvB;AACA,cAAU,IAAI,KAAK,EAAG,IAAI,UAAU;AACpC,QAAI,SAAS,YAAY;AACvB,4BAAsB,IAAI,UAAU;AAAA,IACtC;AAAA,EACF;AAKA,WAAS,0BAA0B,MAAoC;AACrE,eAAW,OAAO,MAAM;AACtB,SAAG,IAAI,OAAO,IAAI,SAAS,EAAE,YAAY,IAAI,YAAY,UAAU,IAAI,UAAU,IAAI,IAAI,GAAG,CAAC;AAAA,IAC/F;AAAA,EACF;AAOA,iBAAe,KACb,OACA,SACA,SACe;AACf,UAAM,OAAO,mBAAmB;AAChC,eAAW,OAAO,MAAM;AACtB,UAAI;AACF,cAAM,QAAQ,QAAQ,IAAI,OAAO,SAAS,OAAO,CAAC;AAAA,MACpD,SAAS,OAAO;AACd,eAAO,MAAM,oBAAoB,EAAE,OAAO,KAAK,MAAM,CAAC;AAAA,MACxD;AAAA,IACF;AAWA,UAAM,cAAc,QAAQ,SAAS,UAAU,KAAK,SAAS,kBAAkB;AAE/E,UAAM,iBAAiB,wBAAwB;AAC/C,UAAM,uBAAuB,SAAS,oCAAoC,QACpE,QAAQ,SAAS,UAAU,KAAK;AACtC,QAAI,yBAAyB;AAC7B,QAAI,CAAC,aAAa;AAChB,YAAM,YAAY,MAAM,QAAQ,OAAO,SAAS,SAAS,oBAAoB;AAC7E,+BAAyB,UAAU,qBAAqB;AAAA,IAC1D;AAEA,QAAI,iBAAiB,KAAK,KAAK,eAAe,OAAO,GAAG;AACtD,UAAI;AACF,cAAM,yBAAyB,OAAO,SAAS,OAAO;AAAA,MACxD,SAAS,OAAO;AACd,eAAO,MAAM,+BAA+B,EAAE,OAAO,KAAK,MAAM,CAAC;AAAA,MACnE;AAAA,IACF;AAGA,QAAI,SAAS,YAAY;AACvB,YAAM,IAAI,SAAS;AACnB,YAAM,EAAE,QAAQ;AAAA,QACd;AAAA,QACA;AAAA,QACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAQA,2BAA2B,CAAC,eAAe,CAAC,wBAAwB,CAAC;AAAA,MACvE,CAAC;AAAA,IACH;AAAA,EACF;AAKA,iBAAe,aAA2C;AACxD,UAAM,IAAI,SAAS;AACnB,WAAO,EAAE,MAAM;AAAA,EACjB;AAGA,QAAM,YAAY;AAElB,SAAO;AAAA,IACL;AAAA,IACA;AAAA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/events/api/stream/route.js

@@ -20,12 +20,13 @@ function collectStringValues(input) {
   return values;
 }
 function normalizeAudience(data, options) {
+  const hasTrustedScope = options != null && Object.prototype.hasOwnProperty.call(options, "tenantId");
   const trustedTenantId = typeof options?.tenantId === "string" && options.tenantId.trim().length > 0 ? options.tenantId.trim() : null;
-  const tenantId = trustedTenantId ?? (typeof data.tenantId === "string" ? data.tenantId : null);
+  const tenantId = hasTrustedScope ? trustedTenantId : typeof data.tenantId === "string" ? data.tenantId : null;
   const organizationScopes = /* @__PURE__ */ new Set();
   const trustedOrganizationId = typeof options?.organizationId === "string" && options.organizationId.trim().length > 0 ? options.organizationId.trim() : null;
-  if (trustedOrganizationId) {
-    organizationScopes.add(trustedOrganizationId);
+  if (hasTrustedScope) {
+    if (trustedOrganizationId) organizationScopes.add(trustedOrganizationId);
   } else {
     if (typeof data.organizationId === "string" && data.organizationId.trim().length > 0) {
       organizationScopes.add(data.organizationId.trim());

package/dist/modules/events/api/stream/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/events/api/stream/route.ts"],
-  "sourcesContent": ["/**\n * SSE Event Stream \u2014 DOM Event Bridge\n *\n * Server-Sent Events endpoint that bridges server-side events to the browser.\n * Only events with `clientBroadcast: true` in their EventDefinition are sent.\n * Events are scoped to the authenticated user's tenant.\n *\n * Client consumer: `packages/ui/src/backend/injection/eventBridge.ts`\n */\n\nimport { resolveRequestContext } from '@open-mercato/shared/lib/api/context'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { isBroadcastEvent } from '@open-mercato/shared/modules/events'\nimport { registerCrossProcessEventListener, registerGlobalEventTap } from '../../../../bus'\nimport type { EmitOptions } from '../../../../types'\n\nexport const metadata = {\n  GET: { requireAuth: true },\n}\n\nconst HEARTBEAT_INTERVAL_MS = 30_000\nconst MAX_PAYLOAD_BYTES = 4096\n\nconst logger = createLogger('events').child({ component: 'stream' })\n\ntype SseConnection = {\n  tenantId: string\n  organizationId: string | null\n  userId: string\n  roleIds: string[]\n  send: (data: string) => void\n  close: () => void\n}\n\nfunction collectStringValues(input: unknown): string[] {\n  if (!Array.isArray(input)) return []\n  const values: string[] = []\n  for (const value of input) {\n    if (typeof value !== 'string') continue\n    const trimmed = value.trim()\n    if (!trimmed) continue\n    values.push(trimmed)\n  }\n  return values\n}\n\nfunction normalizeAudience(data: Record<string, unknown>, options?: EmitOptions): {\n  tenantId: string | null\n  organizationScopes: string[]\n  recipientUserScopes: string[]\n  recipientRoleScopes: string[]\n} {\n  const trustedTenantId = typeof options?.tenantId === 'string' && options.tenantId.trim().length > 0\n    ? options.tenantId.trim()\n    : null\n  const tenantId = trustedTenantId ?? (typeof data.tenantId === 'string' ? data.tenantId : null)\n  const organizationScopes = new Set<string>()\n  const trustedOrganizationId = typeof options?.organizationId === 'string' && options.organizationId.trim().length > 0\n    ? options.organizationId.trim()\n    : null\n  if (trustedOrganizationId) {\n    organizationScopes.add(trustedOrganizationId)\n  } else {\n    if (typeof data.organizationId === 'string' && data.organizationId.trim().length > 0) {\n      organizationScopes.add(data.organizationId.trim())\n    }\n    for (const organizationId of collectStringValues(data.organizationIds)) {\n      organizationScopes.add(organizationId)\n    }\n  }\n\n  const recipientUserScopes = new Set<string>()\n  if (typeof data.recipientUserId === 'string' && data.recipientUserId.trim().length > 0) {\n    recipientUserScopes.add(data.recipientUserId.trim())\n  }\n  for (const userId of collectStringValues(data.recipientUserIds)) {\n    recipientUserScopes.add(userId)\n  }\n\n  const recipientRoleScopes = new Set<string>()\n  if (typeof data.recipientRoleId === 'string' && data.recipientRoleId.trim().length > 0) {\n    recipientRoleScopes.add(data.recipientRoleId.trim())\n  }\n  for (const roleId of collectStringValues(data.recipientRoleIds)) {\n    recipientRoleScopes.add(roleId)\n  }\n\n  return {\n    tenantId,\n    organizationScopes: Array.from(organizationScopes),\n    recipientUserScopes: Array.from(recipientUserScopes),\n    recipientRoleScopes: Array.from(recipientRoleScopes),\n  }\n}\n\nfunction matchesAudience(conn: SseConnection, audience: ReturnType<typeof normalizeAudience>): boolean {\n  if (!audience.tenantId) return false\n  if (conn.tenantId !== audience.tenantId) return false\n\n  if (audience.organizationScopes.length > 0) {\n    if (!conn.organizationId) return false\n    if (!audience.organizationScopes.includes(conn.organizationId)) return false\n  }\n\n  if (audience.recipientUserScopes.length > 0 && !audience.recipientUserScopes.includes(conn.userId)) {\n    return false\n  }\n\n  if (audience.recipientRoleScopes.length > 0) {\n    const roleMatched = conn.roleIds.some((roleId) => audience.recipientRoleScopes.includes(roleId))\n    if (!roleMatched) return false\n  }\n\n  return true\n}\n\n/**\n * Global connection registry.\n * All active SSE connections are tracked here.\n * The event bus subscriber iterates this set on each broadcast event.\n */\nconst connections = new Set<SseConnection>()\n\nlet globalTapRegistered = false\n\nasync function broadcastEventToConnections(\n  eventName: string,\n  payload: Record<string, unknown>,\n  options?: EmitOptions,\n): Promise<void> {\n  if (!eventName || connections.size === 0) return\n\n  if (!isBroadcastEvent(eventName)) return\n\n  const data = payload ?? {}\n  const audience = normalizeAudience(data, options)\n\n  const organizationId = audience.organizationScopes[0] ?? ''\n  let ssePayload = buildSsePayload(eventName, data, organizationId)\n\n  if (new TextEncoder().encode(ssePayload).length > MAX_PAYLOAD_BYTES) {\n    ssePayload = buildTruncatedPayload(eventName, data, organizationId)\n    if (new TextEncoder().encode(ssePayload).length > MAX_PAYLOAD_BYTES) {\n      logger.warn('Event payload exceeds size limit, skipping', { event: eventName, maxBytes: MAX_PAYLOAD_BYTES })\n      return\n    }\n  }\n\n  for (const conn of connections) {\n    if (!matchesAudience(conn, audience)) continue\n\n    try {\n      conn.send(ssePayload)\n    } catch {\n      // Connection may have been closed; cleanup happens via abort handler\n    }\n  }\n}\n\nfunction buildSsePayload(eventName: string, data: Record<string, unknown>, organizationId: string): string {\n  return JSON.stringify({\n    id: eventName,\n    payload: data,\n    timestamp: Date.now(),\n    organizationId,\n  })\n}\n\nfunction buildTruncatedPayload(eventName: string, data: Record<string, unknown>, organizationId: string): string {\n  const entityRef: Record<string, unknown> = {\n    truncated: true,\n  }\n  if (typeof data.id === 'string' && data.id.trim().length > 0) {\n    entityRef.id = data.id.trim()\n  }\n  if (typeof data.entityId === 'string' && data.entityId.trim().length > 0) {\n    entityRef.entityId = data.entityId.trim()\n  }\n  if (typeof data.entityType === 'string' && data.entityType.trim().length > 0) {\n    entityRef.entityType = data.entityType.trim()\n  }\n  return JSON.stringify({\n    id: eventName,\n    payload: entityRef,\n    timestamp: Date.now(),\n    organizationId,\n  })\n}\n\n/**\n * Ensure a process-wide event tap is registered (once).\n * This captures emits from all request-scoped EventBus instances.\n */\nfunction ensureGlobalTapSubscription(): void {\n  if (globalTapRegistered) return\n  globalTapRegistered = true\n\n  registerGlobalEventTap(async (eventName, payload, options) => {\n    await broadcastEventToConnections(eventName, (payload ?? {}) as Record<string, unknown>, options)\n  })\n\n  registerCrossProcessEventListener(async (envelope) => {\n    if (envelope.originPid === process.pid) return\n    await broadcastEventToConnections(\n      envelope.event,\n      (envelope.payload ?? {}) as Record<string, unknown>,\n      envelope.options,\n    )\n  })\n}\n\nexport async function GET(req: Request): Promise<Response> {\n  const { ctx } = await resolveRequestContext(req)\n\n  if (!ctx.auth?.tenantId || !ctx.auth?.sub) {\n    return new Response('Unauthorized', { status: 401 })\n  }\n\n  const tenantId = ctx.auth.tenantId\n  const organizationId = (ctx.selectedOrganizationId as string) ?? ctx.auth.orgId ?? null\n  const userId = ctx.auth.sub\n  const roleIds = Array.isArray(ctx.auth.roles)\n    ? ctx.auth.roles.filter((role): role is string => typeof role === 'string' && role.trim().length > 0)\n    : []\n\n  ensureGlobalTapSubscription()\n\n  const encoder = new TextEncoder()\n  let heartbeatTimer: ReturnType<typeof setInterval> | null = null\n  let connection: SseConnection | null = null\n  const onAbort = () => cleanup()\n\n  const stream = new ReadableStream({\n    start(controller) {\n      const send = (data: string) => {\n        controller.enqueue(encoder.encode(`data: ${data}\\n\\n`))\n      }\n\n      connection = {\n        tenantId,\n        organizationId,\n        userId,\n        roleIds,\n        send,\n        close: () => controller.close(),\n      }\n      connections.add(connection)\n\n      // Flush an initial comment so the runtime sends the response headers and\n      // first body byte immediately. Without it, the streamed Response stays\n      // unflushed until the first heartbeat (30s) or matching event, which\n      // delays the browser EventSource `open` event \u2014 clients that gate work on\n      // a \"connected\" signal would otherwise stall for up to 30s after mount.\n      // Comment lines (`:` prefix) are ignored by EventSource message parsing.\n      controller.enqueue(encoder.encode(': connected\\n\\n'))\n\n      // Start heartbeat to keep connection alive\n      heartbeatTimer = setInterval(() => {\n        try {\n          controller.enqueue(encoder.encode(':heartbeat\\n\\n'))\n        } catch {\n          // Stream may have been closed\n        }\n      }, HEARTBEAT_INTERVAL_MS)\n    },\n    cancel() {\n      cleanup()\n    },\n  })\n\n  function cleanup() {\n    if (heartbeatTimer) {\n      clearInterval(heartbeatTimer)\n      heartbeatTimer = null\n    }\n    if (connection) {\n      connections.delete(connection)\n      connection = null\n    }\n    // Detach from the request signal so reconnect churn does not accumulate\n    // listeners and closures on long-lived AbortSignals.\n    req.signal.removeEventListener('abort', onAbort)\n  }\n\n  req.signal.addEventListener('abort', onAbort, { once: true })\n\n  return new Response(stream, {\n    status: 200,\n    headers: {\n      'Content-Type': 'text/event-stream',\n      'Cache-Control': 'no-cache, no-transform',\n      'Connection': 'keep-alive',\n      'X-Accel-Buffering': 'no',\n    },\n  })\n}\n\nexport const openApi = {\n  GET: {\n    summary: 'Subscribe to server events via SSE (DOM Event Bridge)',\n    description: 'Long-lived SSE connection that receives server-side events marked with clientBroadcast: true. Events are server-filtered by tenant, organization, recipient user, and recipient role.',\n    tags: ['Events'],\n    responses: {\n      200: {\n        description: 'Event stream (text/event-stream)',\n        content: {\n          'text/event-stream': {\n            schema: {\n              type: 'object',\n              properties: {\n                id: { type: 'string', description: 'Event identifier (e.g., example.todo.created)' },\n                payload: { type: 'object', description: 'Event-specific data' },\n                timestamp: { type: 'number', description: 'Server timestamp (ms since epoch)' },\n                organizationId: { type: 'string', description: 'Organization scope' },\n              },\n            },\n          },\n        },\n      },\n      401: { description: 'Not authenticated' },\n    },\n  },\n}\n"],
-  "mappings": "AAUA,SAAS,6BAA6B;AACtC,SAAS,oBAAoB;AAC7B,SAAS,wBAAwB;AACjC,SAAS,mCAAmC,8BAA8B;AAGnE,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,KAAK;AAC3B;AAEA,MAAM,wBAAwB;AAC9B,MAAM,oBAAoB;AAE1B,MAAM,SAAS,aAAa,QAAQ,EAAE,MAAM,EAAE,WAAW,SAAS,CAAC;AAWnE,SAAS,oBAAoB,OAA0B;AACrD,MAAI,CAAC,MAAM,QAAQ,KAAK,EAAG,QAAO,CAAC;AACnC,QAAM,SAAmB,CAAC;AAC1B,aAAW,SAAS,OAAO;AACzB,QAAI,OAAO,UAAU,SAAU;AAC/B,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,CAAC,QAAS;AACd,WAAO,KAAK,OAAO;AAAA,EACrB;AACA,SAAO;AACT;AAEA,SAAS,kBAAkB,MAA+B,SAKxD;AACA,QAAM,kBAAkB,OAAO,SAAS,aAAa,YAAY,QAAQ,SAAS,KAAK,EAAE,SAAS,IAC9F,QAAQ,SAAS,KAAK,IACtB;AACJ,QAAM,WAAW,oBAAoB,OAAO,KAAK,aAAa,WAAW,KAAK,WAAW;AACzF,QAAM,qBAAqB,oBAAI,IAAY;AAC3C,QAAM,wBAAwB,OAAO,SAAS,mBAAmB,YAAY,QAAQ,eAAe,KAAK,EAAE,SAAS,IAChH,QAAQ,eAAe,KAAK,IAC5B;AACJ,MAAI,uBAAuB;AACzB,uBAAmB,IAAI,qBAAqB;AAAA,EAC9C,OAAO;AACL,QAAI,OAAO,KAAK,mBAAmB,YAAY,KAAK,eAAe,KAAK,EAAE,SAAS,GAAG;AACpF,yBAAmB,IAAI,KAAK,eAAe,KAAK,CAAC;AAAA,IACnD;AACA,eAAW,kBAAkB,oBAAoB,KAAK,eAAe,GAAG;AACtE,yBAAmB,IAAI,cAAc;AAAA,IACvC;AAAA,EACF;AAEA,QAAM,sBAAsB,oBAAI,IAAY;AAC5C,MAAI,OAAO,KAAK,oBAAoB,YAAY,KAAK,gBAAgB,KAAK,EAAE,SAAS,GAAG;AACtF,wBAAoB,IAAI,KAAK,gBAAgB,KAAK,CAAC;AAAA,EACrD;AACA,aAAW,UAAU,oBAAoB,KAAK,gBAAgB,GAAG;AAC/D,wBAAoB,IAAI,MAAM;AAAA,EAChC;AAEA,QAAM,sBAAsB,oBAAI,IAAY;AAC5C,MAAI,OAAO,KAAK,oBAAoB,YAAY,KAAK,gBAAgB,KAAK,EAAE,SAAS,GAAG;AACtF,wBAAoB,IAAI,KAAK,gBAAgB,KAAK,CAAC;AAAA,EACrD;AACA,aAAW,UAAU,oBAAoB,KAAK,gBAAgB,GAAG;AAC/D,wBAAoB,IAAI,MAAM;AAAA,EAChC;AAEA,SAAO;AAAA,IACL;AAAA,IACA,oBAAoB,MAAM,KAAK,kBAAkB;AAAA,IACjD,qBAAqB,MAAM,KAAK,mBAAmB;AAAA,IACnD,qBAAqB,MAAM,KAAK,mBAAmB;AAAA,EACrD;AACF;AAEA,SAAS,gBAAgB,MAAqB,UAAyD;AACrG,MAAI,CAAC,SAAS,SAAU,QAAO;AAC/B,MAAI,KAAK,aAAa,SAAS,SAAU,QAAO;AAEhD,MAAI,SAAS,mBAAmB,SAAS,GAAG;AAC1C,QAAI,CAAC,KAAK,eAAgB,QAAO;AACjC,QAAI,CAAC,SAAS,mBAAmB,SAAS,KAAK,cAAc,EAAG,QAAO;AAAA,EACzE;AAEA,MAAI,SAAS,oBAAoB,SAAS,KAAK,CAAC,SAAS,oBAAoB,SAAS,KAAK,MAAM,GAAG;AAClG,WAAO;AAAA,EACT;AAEA,MAAI,SAAS,oBAAoB,SAAS,GAAG;AAC3C,UAAM,cAAc,KAAK,QAAQ,KAAK,CAAC,WAAW,SAAS,oBAAoB,SAAS,MAAM,CAAC;AAC/F,QAAI,CAAC,YAAa,QAAO;AAAA,EAC3B;AAEA,SAAO;AACT;AAOA,MAAM,cAAc,oBAAI,IAAmB;AAE3C,IAAI,sBAAsB;AAE1B,eAAe,4BACb,WACA,SACA,SACe;AACf,MAAI,CAAC,aAAa,YAAY,SAAS,EAAG;AAE1C,MAAI,CAAC,iBAAiB,SAAS,EAAG;AAElC,QAAM,OAAO,WAAW,CAAC;AACzB,QAAM,WAAW,kBAAkB,MAAM,OAAO;AAEhD,QAAM,iBAAiB,SAAS,mBAAmB,CAAC,KAAK;AACzD,MAAI,aAAa,gBAAgB,WAAW,MAAM,cAAc;AAEhE,MAAI,IAAI,YAAY,EAAE,OAAO,UAAU,EAAE,SAAS,mBAAmB;AACnE,iBAAa,sBAAsB,WAAW,MAAM,cAAc;AAClE,QAAI,IAAI,YAAY,EAAE,OAAO,UAAU,EAAE,SAAS,mBAAmB;AACnE,aAAO,KAAK,8CAA8C,EAAE,OAAO,WAAW,UAAU,kBAAkB,CAAC;AAC3G;AAAA,IACF;AAAA,EACF;AAEA,aAAW,QAAQ,aAAa;AAC9B,QAAI,CAAC,gBAAgB,MAAM,QAAQ,EAAG;AAEtC,QAAI;AACF,WAAK,KAAK,UAAU;AAAA,IACtB,QAAQ;AAAA,IAER;AAAA,EACF;AACF;AAEA,SAAS,gBAAgB,WAAmB,MAA+B,gBAAgC;AACzG,SAAO,KAAK,UAAU;AAAA,IACpB,IAAI;AAAA,IACJ,SAAS;AAAA,IACT,WAAW,KAAK,IAAI;AAAA,IACpB;AAAA,EACF,CAAC;AACH;AAEA,SAAS,sBAAsB,WAAmB,MAA+B,gBAAgC;AAC/G,QAAM,YAAqC;AAAA,IACzC,WAAW;AAAA,EACb;AACA,MAAI,OAAO,KAAK,OAAO,YAAY,KAAK,GAAG,KAAK,EAAE,SAAS,GAAG;AAC5D,cAAU,KAAK,KAAK,GAAG,KAAK;AAAA,EAC9B;AACA,MAAI,OAAO,KAAK,aAAa,YAAY,KAAK,SAAS,KAAK,EAAE,SAAS,GAAG;AACxE,cAAU,WAAW,KAAK,SAAS,KAAK;AAAA,EAC1C;AACA,MAAI,OAAO,KAAK,eAAe,YAAY,KAAK,WAAW,KAAK,EAAE,SAAS,GAAG;AAC5E,cAAU,aAAa,KAAK,WAAW,KAAK;AAAA,EAC9C;AACA,SAAO,KAAK,UAAU;AAAA,IACpB,IAAI;AAAA,IACJ,SAAS;AAAA,IACT,WAAW,KAAK,IAAI;AAAA,IACpB;AAAA,EACF,CAAC;AACH;AAMA,SAAS,8BAAoC;AAC3C,MAAI,oBAAqB;AACzB,wBAAsB;AAEtB,yBAAuB,OAAO,WAAW,SAAS,YAAY;AAC5D,UAAM,4BAA4B,WAAY,WAAW,CAAC,GAA+B,OAAO;AAAA,EAClG,CAAC;AAED,oCAAkC,OAAO,aAAa;AACpD,QAAI,SAAS,cAAc,QAAQ,IAAK;AACxC,UAAM;AAAA,MACJ,SAAS;AAAA,MACR,SAAS,WAAW,CAAC;AAAA,MACtB,SAAS;AAAA,IACX;AAAA,EACF,CAAC;AACH;AAEA,eAAsB,IAAI,KAAiC;AACzD,QAAM,EAAE,IAAI,IAAI,MAAM,sBAAsB,GAAG;AAE/C,MAAI,CAAC,IAAI,MAAM,YAAY,CAAC,IAAI,MAAM,KAAK;AACzC,WAAO,IAAI,SAAS,gBAAgB,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrD;AAEA,QAAM,WAAW,IAAI,KAAK;AAC1B,QAAM,iBAAkB,IAAI,0BAAqC,IAAI,KAAK,SAAS;AACnF,QAAM,SAAS,IAAI,KAAK;AACxB,QAAM,UAAU,MAAM,QAAQ,IAAI,KAAK,KAAK,IACxC,IAAI,KAAK,MAAM,OAAO,CAAC,SAAyB,OAAO,SAAS,YAAY,KAAK,KAAK,EAAE,SAAS,CAAC,IAClG,CAAC;AAEL,8BAA4B;AAE5B,QAAM,UAAU,IAAI,YAAY;AAChC,MAAI,iBAAwD;AAC5D,MAAI,aAAmC;AACvC,QAAM,UAAU,MAAM,QAAQ;AAE9B,QAAM,SAAS,IAAI,eAAe;AAAA,IAChC,MAAM,YAAY;AAChB,YAAM,OAAO,CAAC,SAAiB;AAC7B,mBAAW,QAAQ,QAAQ,OAAO,SAAS,IAAI;AAAA;AAAA,CAAM,CAAC;AAAA,MACxD;AAEA,mBAAa;AAAA,QACX;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,OAAO,MAAM,WAAW,MAAM;AAAA,MAChC;AACA,kBAAY,IAAI,UAAU;AAQ1B,iBAAW,QAAQ,QAAQ,OAAO,iBAAiB,CAAC;AAGpD,uBAAiB,YAAY,MAAM;AACjC,YAAI;AACF,qBAAW,QAAQ,QAAQ,OAAO,gBAAgB,CAAC;AAAA,QACrD,QAAQ;AAAA,QAER;AAAA,MACF,GAAG,qBAAqB;AAAA,IAC1B;AAAA,IACA,SAAS;AACP,cAAQ;AAAA,IACV;AAAA,EACF,CAAC;AAED,WAAS,UAAU;AACjB,QAAI,gBAAgB;AAClB,oBAAc,cAAc;AAC5B,uBAAiB;AAAA,IACnB;AACA,QAAI,YAAY;AACd,kBAAY,OAAO,UAAU;AAC7B,mBAAa;AAAA,IACf;AAGA,QAAI,OAAO,oBAAoB,SAAS,OAAO;AAAA,EACjD;AAEA,MAAI,OAAO,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;AAE5D,SAAO,IAAI,SAAS,QAAQ;AAAA,IAC1B,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,gBAAgB;AAAA,MAChB,iBAAiB;AAAA,MACjB,cAAc;AAAA,MACd,qBAAqB;AAAA,IACvB;AAAA,EACF,CAAC;AACH;AAEO,MAAM,UAAU;AAAA,EACrB,KAAK;AAAA,IACH,SAAS;AAAA,IACT,aAAa;AAAA,IACb,MAAM,CAAC,QAAQ;AAAA,IACf,WAAW;AAAA,MACT,KAAK;AAAA,QACH,aAAa;AAAA,QACb,SAAS;AAAA,UACP,qBAAqB;AAAA,YACnB,QAAQ;AAAA,cACN,MAAM;AAAA,cACN,YAAY;AAAA,gBACV,IAAI,EAAE,MAAM,UAAU,aAAa,gDAAgD;AAAA,gBACnF,SAAS,EAAE,MAAM,UAAU,aAAa,sBAAsB;AAAA,gBAC9D,WAAW,EAAE,MAAM,UAAU,aAAa,oCAAoC;AAAA,gBAC9E,gBAAgB,EAAE,MAAM,UAAU,aAAa,qBAAqB;AAAA,cACtE;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,MACA,KAAK,EAAE,aAAa,oBAAoB;AAAA,IAC1C;AAAA,EACF;AACF;",
+  "sourcesContent": ["/**\n * SSE Event Stream \u2014 DOM Event Bridge\n *\n * Server-Sent Events endpoint that bridges server-side events to the browser.\n * Only events with `clientBroadcast: true` in their EventDefinition are sent.\n * Events are scoped to the authenticated user's tenant.\n *\n * Client consumer: `packages/ui/src/backend/injection/eventBridge.ts`\n */\n\nimport { resolveRequestContext } from '@open-mercato/shared/lib/api/context'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { isBroadcastEvent } from '@open-mercato/shared/modules/events'\nimport { registerCrossProcessEventListener, registerGlobalEventTap } from '../../../../bus'\nimport type { EmitOptions } from '../../../../types'\n\nexport const metadata = {\n  GET: { requireAuth: true },\n}\n\nconst HEARTBEAT_INTERVAL_MS = 30_000\nconst MAX_PAYLOAD_BYTES = 4096\n\nconst logger = createLogger('events').child({ component: 'stream' })\n\ntype SseConnection = {\n  tenantId: string\n  organizationId: string | null\n  userId: string\n  roleIds: string[]\n  send: (data: string) => void\n  close: () => void\n}\n\nfunction collectStringValues(input: unknown): string[] {\n  if (!Array.isArray(input)) return []\n  const values: string[] = []\n  for (const value of input) {\n    if (typeof value !== 'string') continue\n    const trimmed = value.trim()\n    if (!trimmed) continue\n    values.push(trimmed)\n  }\n  return values\n}\n\nfunction normalizeAudience(data: Record<string, unknown>, options?: EmitOptions): {\n  tenantId: string | null\n  organizationScopes: string[]\n  recipientUserScopes: string[]\n  recipientRoleScopes: string[]\n} {\n  const hasTrustedScope = options != null\n    && Object.prototype.hasOwnProperty.call(options, 'tenantId')\n  const trustedTenantId = typeof options?.tenantId === 'string' && options.tenantId.trim().length > 0\n    ? options.tenantId.trim()\n    : null\n  const tenantId = hasTrustedScope\n    ? trustedTenantId\n    : (typeof data.tenantId === 'string' ? data.tenantId : null)\n  const organizationScopes = new Set<string>()\n  const trustedOrganizationId = typeof options?.organizationId === 'string' && options.organizationId.trim().length > 0\n    ? options.organizationId.trim()\n    : null\n  if (hasTrustedScope) {\n    if (trustedOrganizationId) organizationScopes.add(trustedOrganizationId)\n  } else {\n    if (typeof data.organizationId === 'string' && data.organizationId.trim().length > 0) {\n      organizationScopes.add(data.organizationId.trim())\n    }\n    for (const organizationId of collectStringValues(data.organizationIds)) {\n      organizationScopes.add(organizationId)\n    }\n  }\n\n  const recipientUserScopes = new Set<string>()\n  if (typeof data.recipientUserId === 'string' && data.recipientUserId.trim().length > 0) {\n    recipientUserScopes.add(data.recipientUserId.trim())\n  }\n  for (const userId of collectStringValues(data.recipientUserIds)) {\n    recipientUserScopes.add(userId)\n  }\n\n  const recipientRoleScopes = new Set<string>()\n  if (typeof data.recipientRoleId === 'string' && data.recipientRoleId.trim().length > 0) {\n    recipientRoleScopes.add(data.recipientRoleId.trim())\n  }\n  for (const roleId of collectStringValues(data.recipientRoleIds)) {\n    recipientRoleScopes.add(roleId)\n  }\n\n  return {\n    tenantId,\n    organizationScopes: Array.from(organizationScopes),\n    recipientUserScopes: Array.from(recipientUserScopes),\n    recipientRoleScopes: Array.from(recipientRoleScopes),\n  }\n}\n\nfunction matchesAudience(conn: SseConnection, audience: ReturnType<typeof normalizeAudience>): boolean {\n  if (!audience.tenantId) return false\n  if (conn.tenantId !== audience.tenantId) return false\n\n  if (audience.organizationScopes.length > 0) {\n    if (!conn.organizationId) return false\n    if (!audience.organizationScopes.includes(conn.organizationId)) return false\n  }\n\n  if (audience.recipientUserScopes.length > 0 && !audience.recipientUserScopes.includes(conn.userId)) {\n    return false\n  }\n\n  if (audience.recipientRoleScopes.length > 0) {\n    const roleMatched = conn.roleIds.some((roleId) => audience.recipientRoleScopes.includes(roleId))\n    if (!roleMatched) return false\n  }\n\n  return true\n}\n\n/**\n * Global connection registry.\n * All active SSE connections are tracked here.\n * The event bus subscriber iterates this set on each broadcast event.\n */\nconst connections = new Set<SseConnection>()\n\nlet globalTapRegistered = false\n\nasync function broadcastEventToConnections(\n  eventName: string,\n  payload: Record<string, unknown>,\n  options?: EmitOptions,\n): Promise<void> {\n  if (!eventName || connections.size === 0) return\n\n  if (!isBroadcastEvent(eventName)) return\n\n  const data = payload ?? {}\n  const audience = normalizeAudience(data, options)\n\n  const organizationId = audience.organizationScopes[0] ?? ''\n  let ssePayload = buildSsePayload(eventName, data, organizationId)\n\n  if (new TextEncoder().encode(ssePayload).length > MAX_PAYLOAD_BYTES) {\n    ssePayload = buildTruncatedPayload(eventName, data, organizationId)\n    if (new TextEncoder().encode(ssePayload).length > MAX_PAYLOAD_BYTES) {\n      logger.warn('Event payload exceeds size limit, skipping', { event: eventName, maxBytes: MAX_PAYLOAD_BYTES })\n      return\n    }\n  }\n\n  for (const conn of connections) {\n    if (!matchesAudience(conn, audience)) continue\n\n    try {\n      conn.send(ssePayload)\n    } catch {\n      // Connection may have been closed; cleanup happens via abort handler\n    }\n  }\n}\n\nfunction buildSsePayload(eventName: string, data: Record<string, unknown>, organizationId: string): string {\n  return JSON.stringify({\n    id: eventName,\n    payload: data,\n    timestamp: Date.now(),\n    organizationId,\n  })\n}\n\nfunction buildTruncatedPayload(eventName: string, data: Record<string, unknown>, organizationId: string): string {\n  const entityRef: Record<string, unknown> = {\n    truncated: true,\n  }\n  if (typeof data.id === 'string' && data.id.trim().length > 0) {\n    entityRef.id = data.id.trim()\n  }\n  if (typeof data.entityId === 'string' && data.entityId.trim().length > 0) {\n    entityRef.entityId = data.entityId.trim()\n  }\n  if (typeof data.entityType === 'string' && data.entityType.trim().length > 0) {\n    entityRef.entityType = data.entityType.trim()\n  }\n  return JSON.stringify({\n    id: eventName,\n    payload: entityRef,\n    timestamp: Date.now(),\n    organizationId,\n  })\n}\n\n/**\n * Ensure a process-wide event tap is registered (once).\n * This captures emits from all request-scoped EventBus instances.\n */\nfunction ensureGlobalTapSubscription(): void {\n  if (globalTapRegistered) return\n  globalTapRegistered = true\n\n  registerGlobalEventTap(async (eventName, payload, options) => {\n    await broadcastEventToConnections(eventName, (payload ?? {}) as Record<string, unknown>, options)\n  })\n\n  registerCrossProcessEventListener(async (envelope) => {\n    if (envelope.originPid === process.pid) return\n    await broadcastEventToConnections(\n      envelope.event,\n      (envelope.payload ?? {}) as Record<string, unknown>,\n      envelope.options,\n    )\n  })\n}\n\nexport async function GET(req: Request): Promise<Response> {\n  const { ctx } = await resolveRequestContext(req)\n\n  if (!ctx.auth?.tenantId || !ctx.auth?.sub) {\n    return new Response('Unauthorized', { status: 401 })\n  }\n\n  const tenantId = ctx.auth.tenantId\n  const organizationId = (ctx.selectedOrganizationId as string) ?? ctx.auth.orgId ?? null\n  const userId = ctx.auth.sub\n  const roleIds = Array.isArray(ctx.auth.roles)\n    ? ctx.auth.roles.filter((role): role is string => typeof role === 'string' && role.trim().length > 0)\n    : []\n\n  ensureGlobalTapSubscription()\n\n  const encoder = new TextEncoder()\n  let heartbeatTimer: ReturnType<typeof setInterval> | null = null\n  let connection: SseConnection | null = null\n  const onAbort = () => cleanup()\n\n  const stream = new ReadableStream({\n    start(controller) {\n      const send = (data: string) => {\n        controller.enqueue(encoder.encode(`data: ${data}\\n\\n`))\n      }\n\n      connection = {\n        tenantId,\n        organizationId,\n        userId,\n        roleIds,\n        send,\n        close: () => controller.close(),\n      }\n      connections.add(connection)\n\n      // Flush an initial comment so the runtime sends the response headers and\n      // first body byte immediately. Without it, the streamed Response stays\n      // unflushed until the first heartbeat (30s) or matching event, which\n      // delays the browser EventSource `open` event \u2014 clients that gate work on\n      // a \"connected\" signal would otherwise stall for up to 30s after mount.\n      // Comment lines (`:` prefix) are ignored by EventSource message parsing.\n      controller.enqueue(encoder.encode(': connected\\n\\n'))\n\n      // Start heartbeat to keep connection alive\n      heartbeatTimer = setInterval(() => {\n        try {\n          controller.enqueue(encoder.encode(':heartbeat\\n\\n'))\n        } catch {\n          // Stream may have been closed\n        }\n      }, HEARTBEAT_INTERVAL_MS)\n    },\n    cancel() {\n      cleanup()\n    },\n  })\n\n  function cleanup() {\n    if (heartbeatTimer) {\n      clearInterval(heartbeatTimer)\n      heartbeatTimer = null\n    }\n    if (connection) {\n      connections.delete(connection)\n      connection = null\n    }\n    // Detach from the request signal so reconnect churn does not accumulate\n    // listeners and closures on long-lived AbortSignals.\n    req.signal.removeEventListener('abort', onAbort)\n  }\n\n  req.signal.addEventListener('abort', onAbort, { once: true })\n\n  return new Response(stream, {\n    status: 200,\n    headers: {\n      'Content-Type': 'text/event-stream',\n      'Cache-Control': 'no-cache, no-transform',\n      'Connection': 'keep-alive',\n      'X-Accel-Buffering': 'no',\n    },\n  })\n}\n\nexport const openApi = {\n  GET: {\n    summary: 'Subscribe to server events via SSE (DOM Event Bridge)',\n    description: 'Long-lived SSE connection that receives server-side events marked with clientBroadcast: true. Events are server-filtered by tenant, organization, recipient user, and recipient role.',\n    tags: ['Events'],\n    responses: {\n      200: {\n        description: 'Event stream (text/event-stream)',\n        content: {\n          'text/event-stream': {\n            schema: {\n              type: 'object',\n              properties: {\n                id: { type: 'string', description: 'Event identifier (e.g., example.todo.created)' },\n                payload: { type: 'object', description: 'Event-specific data' },\n                timestamp: { type: 'number', description: 'Server timestamp (ms since epoch)' },\n                organizationId: { type: 'string', description: 'Organization scope' },\n              },\n            },\n          },\n        },\n      },\n      401: { description: 'Not authenticated' },\n    },\n  },\n}\n"],
+  "mappings": "AAUA,SAAS,6BAA6B;AACtC,SAAS,oBAAoB;AAC7B,SAAS,wBAAwB;AACjC,SAAS,mCAAmC,8BAA8B;AAGnE,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,KAAK;AAC3B;AAEA,MAAM,wBAAwB;AAC9B,MAAM,oBAAoB;AAE1B,MAAM,SAAS,aAAa,QAAQ,EAAE,MAAM,EAAE,WAAW,SAAS,CAAC;AAWnE,SAAS,oBAAoB,OAA0B;AACrD,MAAI,CAAC,MAAM,QAAQ,KAAK,EAAG,QAAO,CAAC;AACnC,QAAM,SAAmB,CAAC;AAC1B,aAAW,SAAS,OAAO;AACzB,QAAI,OAAO,UAAU,SAAU;AAC/B,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,CAAC,QAAS;AACd,WAAO,KAAK,OAAO;AAAA,EACrB;AACA,SAAO;AACT;AAEA,SAAS,kBAAkB,MAA+B,SAKxD;AACA,QAAM,kBAAkB,WAAW,QAC9B,OAAO,UAAU,eAAe,KAAK,SAAS,UAAU;AAC7D,QAAM,kBAAkB,OAAO,SAAS,aAAa,YAAY,QAAQ,SAAS,KAAK,EAAE,SAAS,IAC9F,QAAQ,SAAS,KAAK,IACtB;AACJ,QAAM,WAAW,kBACb,kBACC,OAAO,KAAK,aAAa,WAAW,KAAK,WAAW;AACzD,QAAM,qBAAqB,oBAAI,IAAY;AAC3C,QAAM,wBAAwB,OAAO,SAAS,mBAAmB,YAAY,QAAQ,eAAe,KAAK,EAAE,SAAS,IAChH,QAAQ,eAAe,KAAK,IAC5B;AACJ,MAAI,iBAAiB;AACnB,QAAI,sBAAuB,oBAAmB,IAAI,qBAAqB;AAAA,EACzE,OAAO;AACL,QAAI,OAAO,KAAK,mBAAmB,YAAY,KAAK,eAAe,KAAK,EAAE,SAAS,GAAG;AACpF,yBAAmB,IAAI,KAAK,eAAe,KAAK,CAAC;AAAA,IACnD;AACA,eAAW,kBAAkB,oBAAoB,KAAK,eAAe,GAAG;AACtE,yBAAmB,IAAI,cAAc;AAAA,IACvC;AAAA,EACF;AAEA,QAAM,sBAAsB,oBAAI,IAAY;AAC5C,MAAI,OAAO,KAAK,oBAAoB,YAAY,KAAK,gBAAgB,KAAK,EAAE,SAAS,GAAG;AACtF,wBAAoB,IAAI,KAAK,gBAAgB,KAAK,CAAC;AAAA,EACrD;AACA,aAAW,UAAU,oBAAoB,KAAK,gBAAgB,GAAG;AAC/D,wBAAoB,IAAI,MAAM;AAAA,EAChC;AAEA,QAAM,sBAAsB,oBAAI,IAAY;AAC5C,MAAI,OAAO,KAAK,oBAAoB,YAAY,KAAK,gBAAgB,KAAK,EAAE,SAAS,GAAG;AACtF,wBAAoB,IAAI,KAAK,gBAAgB,KAAK,CAAC;AAAA,EACrD;AACA,aAAW,UAAU,oBAAoB,KAAK,gBAAgB,GAAG;AAC/D,wBAAoB,IAAI,MAAM;AAAA,EAChC;AAEA,SAAO;AAAA,IACL;AAAA,IACA,oBAAoB,MAAM,KAAK,kBAAkB;AAAA,IACjD,qBAAqB,MAAM,KAAK,mBAAmB;AAAA,IACnD,qBAAqB,MAAM,KAAK,mBAAmB;AAAA,EACrD;AACF;AAEA,SAAS,gBAAgB,MAAqB,UAAyD;AACrG,MAAI,CAAC,SAAS,SAAU,QAAO;AAC/B,MAAI,KAAK,aAAa,SAAS,SAAU,QAAO;AAEhD,MAAI,SAAS,mBAAmB,SAAS,GAAG;AAC1C,QAAI,CAAC,KAAK,eAAgB,QAAO;AACjC,QAAI,CAAC,SAAS,mBAAmB,SAAS,KAAK,cAAc,EAAG,QAAO;AAAA,EACzE;AAEA,MAAI,SAAS,oBAAoB,SAAS,KAAK,CAAC,SAAS,oBAAoB,SAAS,KAAK,MAAM,GAAG;AAClG,WAAO;AAAA,EACT;AAEA,MAAI,SAAS,oBAAoB,SAAS,GAAG;AAC3C,UAAM,cAAc,KAAK,QAAQ,KAAK,CAAC,WAAW,SAAS,oBAAoB,SAAS,MAAM,CAAC;AAC/F,QAAI,CAAC,YAAa,QAAO;AAAA,EAC3B;AAEA,SAAO;AACT;AAOA,MAAM,cAAc,oBAAI,IAAmB;AAE3C,IAAI,sBAAsB;AAE1B,eAAe,4BACb,WACA,SACA,SACe;AACf,MAAI,CAAC,aAAa,YAAY,SAAS,EAAG;AAE1C,MAAI,CAAC,iBAAiB,SAAS,EAAG;AAElC,QAAM,OAAO,WAAW,CAAC;AACzB,QAAM,WAAW,kBAAkB,MAAM,OAAO;AAEhD,QAAM,iBAAiB,SAAS,mBAAmB,CAAC,KAAK;AACzD,MAAI,aAAa,gBAAgB,WAAW,MAAM,cAAc;AAEhE,MAAI,IAAI,YAAY,EAAE,OAAO,UAAU,EAAE,SAAS,mBAAmB;AACnE,iBAAa,sBAAsB,WAAW,MAAM,cAAc;AAClE,QAAI,IAAI,YAAY,EAAE,OAAO,UAAU,EAAE,SAAS,mBAAmB;AACnE,aAAO,KAAK,8CAA8C,EAAE,OAAO,WAAW,UAAU,kBAAkB,CAAC;AAC3G;AAAA,IACF;AAAA,EACF;AAEA,aAAW,QAAQ,aAAa;AAC9B,QAAI,CAAC,gBAAgB,MAAM,QAAQ,EAAG;AAEtC,QAAI;AACF,WAAK,KAAK,UAAU;AAAA,IACtB,QAAQ;AAAA,IAER;AAAA,EACF;AACF;AAEA,SAAS,gBAAgB,WAAmB,MAA+B,gBAAgC;AACzG,SAAO,KAAK,UAAU;AAAA,IACpB,IAAI;AAAA,IACJ,SAAS;AAAA,IACT,WAAW,KAAK,IAAI;AAAA,IACpB;AAAA,EACF,CAAC;AACH;AAEA,SAAS,sBAAsB,WAAmB,MAA+B,gBAAgC;AAC/G,QAAM,YAAqC;AAAA,IACzC,WAAW;AAAA,EACb;AACA,MAAI,OAAO,KAAK,OAAO,YAAY,KAAK,GAAG,KAAK,EAAE,SAAS,GAAG;AAC5D,cAAU,KAAK,KAAK,GAAG,KAAK;AAAA,EAC9B;AACA,MAAI,OAAO,KAAK,aAAa,YAAY,KAAK,SAAS,KAAK,EAAE,SAAS,GAAG;AACxE,cAAU,WAAW,KAAK,SAAS,KAAK;AAAA,EAC1C;AACA,MAAI,OAAO,KAAK,eAAe,YAAY,KAAK,WAAW,KAAK,EAAE,SAAS,GAAG;AAC5E,cAAU,aAAa,KAAK,WAAW,KAAK;AAAA,EAC9C;AACA,SAAO,KAAK,UAAU;AAAA,IACpB,IAAI;AAAA,IACJ,SAAS;AAAA,IACT,WAAW,KAAK,IAAI;AAAA,IACpB;AAAA,EACF,CAAC;AACH;AAMA,SAAS,8BAAoC;AAC3C,MAAI,oBAAqB;AACzB,wBAAsB;AAEtB,yBAAuB,OAAO,WAAW,SAAS,YAAY;AAC5D,UAAM,4BAA4B,WAAY,WAAW,CAAC,GAA+B,OAAO;AAAA,EAClG,CAAC;AAED,oCAAkC,OAAO,aAAa;AACpD,QAAI,SAAS,cAAc,QAAQ,IAAK;AACxC,UAAM;AAAA,MACJ,SAAS;AAAA,MACR,SAAS,WAAW,CAAC;AAAA,MACtB,SAAS;AAAA,IACX;AAAA,EACF,CAAC;AACH;AAEA,eAAsB,IAAI,KAAiC;AACzD,QAAM,EAAE,IAAI,IAAI,MAAM,sBAAsB,GAAG;AAE/C,MAAI,CAAC,IAAI,MAAM,YAAY,CAAC,IAAI,MAAM,KAAK;AACzC,WAAO,IAAI,SAAS,gBAAgB,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrD;AAEA,QAAM,WAAW,IAAI,KAAK;AAC1B,QAAM,iBAAkB,IAAI,0BAAqC,IAAI,KAAK,SAAS;AACnF,QAAM,SAAS,IAAI,KAAK;AACxB,QAAM,UAAU,MAAM,QAAQ,IAAI,KAAK,KAAK,IACxC,IAAI,KAAK,MAAM,OAAO,CAAC,SAAyB,OAAO,SAAS,YAAY,KAAK,KAAK,EAAE,SAAS,CAAC,IAClG,CAAC;AAEL,8BAA4B;AAE5B,QAAM,UAAU,IAAI,YAAY;AAChC,MAAI,iBAAwD;AAC5D,MAAI,aAAmC;AACvC,QAAM,UAAU,MAAM,QAAQ;AAE9B,QAAM,SAAS,IAAI,eAAe;AAAA,IAChC,MAAM,YAAY;AAChB,YAAM,OAAO,CAAC,SAAiB;AAC7B,mBAAW,QAAQ,QAAQ,OAAO,SAAS,IAAI;AAAA;AAAA,CAAM,CAAC;AAAA,MACxD;AAEA,mBAAa;AAAA,QACX;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,OAAO,MAAM,WAAW,MAAM;AAAA,MAChC;AACA,kBAAY,IAAI,UAAU;AAQ1B,iBAAW,QAAQ,QAAQ,OAAO,iBAAiB,CAAC;AAGpD,uBAAiB,YAAY,MAAM;AACjC,YAAI;AACF,qBAAW,QAAQ,QAAQ,OAAO,gBAAgB,CAAC;AAAA,QACrD,QAAQ;AAAA,QAER;AAAA,MACF,GAAG,qBAAqB;AAAA,IAC1B;AAAA,IACA,SAAS;AACP,cAAQ;AAAA,IACV;AAAA,EACF,CAAC;AAED,WAAS,UAAU;AACjB,QAAI,gBAAgB;AAClB,oBAAc,cAAc;AAC5B,uBAAiB;AAAA,IACnB;AACA,QAAI,YAAY;AACd,kBAAY,OAAO,UAAU;AAC7B,mBAAa;AAAA,IACf;AAGA,QAAI,OAAO,oBAAoB,SAAS,OAAO;AAAA,EACjD;AAEA,MAAI,OAAO,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;AAE5D,SAAO,IAAI,SAAS,QAAQ;AAAA,IAC1B,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,gBAAgB;AAAA,MAChB,iBAAiB;AAAA,MACjB,cAAc;AAAA,MACd,qBAAqB;AAAA,IACvB;AAAA,EACF,CAAC;AACH;AAEO,MAAM,UAAU;AAAA,EACrB,KAAK;AAAA,IACH,SAAS;AAAA,IACT,aAAa;AAAA,IACb,MAAM,CAAC,QAAQ;AAAA,IACf,WAAW;AAAA,MACT,KAAK;AAAA,QACH,aAAa;AAAA,QACb,SAAS;AAAA,UACP,qBAAqB;AAAA,YACnB,QAAQ;AAAA,cACN,MAAM;AAAA,cACN,YAAY;AAAA,gBACV,IAAI,EAAE,MAAM,UAAU,aAAa,gDAAgD;AAAA,gBACnF,SAAS,EAAE,MAAM,UAAU,aAAa,sBAAsB;AAAA,gBAC9D,WAAW,EAAE,MAAM,UAAU,aAAa,oCAAoC;AAAA,gBAC9E,gBAAgB,EAAE,MAAM,UAAU,aAAa,qBAAqB;AAAA,cACtE;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,MACA,KAAK,EAAE,aAAa,oBAAoB;AAAA,IAC1C;AAAA,EACF;AACF;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/events",
-  "version": "0.6.8-develop.6942.1.dd382caa0f",
+  "version": "0.6.8-develop.6943.1.ed2e2cf6f6",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -33,8 +33,8 @@
     }
   },
   "dependencies": {
-    "@open-mercato/queue": "0.6.8-develop.6942.1.dd382caa0f",
-    "@open-mercato/shared": "0.6.8-develop.6942.1.dd382caa0f",
+    "@open-mercato/queue": "0.6.8-develop.6943.1.ed2e2cf6f6",
+    "@open-mercato/shared": "0.6.8-develop.6943.1.ed2e2cf6f6",
     "pg": "8.22.0"
   },
   "devDependencies": {

package/src/__tests__/bridge-scope-serialization.test.ts

@@ -0,0 +1,47 @@
+const query = jest.fn(async () => undefined)
+
+jest.mock('pg', () => ({
+  Client: jest.fn(),
+  Pool: jest.fn(() => ({ query })),
+}))
+
+jest.mock('@open-mercato/shared/lib/db/ssl', () => ({
+  getSslConfig: jest.fn(() => null),
+}))
+
+jest.mock('@open-mercato/shared/lib/logger', () => ({
+  createLogger: jest.fn(() => ({
+    error: jest.fn(),
+    warn: jest.fn(),
+  })),
+}))
+
+import { publishCrossProcessEvent } from '../bridge'
+
+describe('cross-process event scope serialization', () => {
+  const originalDatabaseUrl = process.env.DATABASE_URL
+
+  beforeAll(() => {
+    process.env.DATABASE_URL = 'postgres://postgres:postgres@localhost:5432/mercato'
+  })
+
+  afterAll(() => {
+    if (originalDatabaseUrl === undefined) delete process.env.DATABASE_URL
+    else process.env.DATABASE_URL = originalDatabaseUrl
+  })
+
+  it('preserves an explicit undefined trusted tenant marker as null', async () => {
+    await publishCrossProcessEvent(
+      'example.todo.updated',
+      { tenantId: 'forged-tenant', organizationId: 'forged-organization' },
+      { tenantId: undefined },
+    )
+
+    const serializedEnvelope = query.mock.calls[0]?.[1]?.[1]
+    expect(typeof serializedEnvelope).toBe('string')
+    const envelope = JSON.parse(serializedEnvelope as string) as {
+      options?: { tenantId?: string | null }
+    }
+    expect(envelope.options).toEqual({ tenantId: null })
+  })
+})

package/src/__tests__/single-delivery.test.ts

@@ -146,6 +146,23 @@ describe('Event bus single-delivery (OM_EVENTS_SINGLE_DELIVERY)', () => {
     expect(calls).toEqual(['persistent-sub'])
   })
 
+  test('an opt-in non-persistent probe skips persistent subscribers inline', async () => {
+    process.env.OM_EVENTS_SINGLE_DELIVERY = 'true'
+    const calls: string[] = []
+    const bus = createEventBus({ resolve: ((name: string) => name) as never })
+    bus.registerModuleSubscribers([
+      makeSub('persistent-sub', 'demo', true, calls),
+      makeSub('ephemeral-sub', 'demo', false, calls),
+    ])
+
+    await bus.emit('demo', { a: 1 }, {
+      persistent: false,
+      skipPersistentSubscribersInline: true,
+    })
+
+    expect(calls).toEqual(['ephemeral-sub'])
+  })
+
   test('flag ON: persistent emit is still enqueued for the worker', async () => {
     process.env.OM_EVENTS_SINGLE_DELIVERY = 'true'
     const calls: string[] = []

package/src/bridge.ts

@@ -158,10 +158,16 @@ export async function publishCrossProcessEvent(
   const pool = getPublisherPool()
   if (!pool) return
 
+  const bridgeOptions = options
+    && Object.prototype.hasOwnProperty.call(options, 'tenantId')
+    && options.tenantId === undefined
+    ? { ...options, tenantId: null }
+    : options
+
   const envelope: BridgeEnvelope = {
     event,
     payload,
-    options,
+    options: bridgeOptions,
     originPid: process.pid,
   }
 

package/src/bus.ts

@@ -427,9 +427,10 @@ export function createEventBus(opts: CreateBusOptions): EventBus {
     const enqueueOnly = Boolean(options?.persistent) && options?.deliverInline === false
     // Read the mode once so the inline skip and the stamp below cannot disagree.
     const singleDelivery = isSingleDeliveryEnabled()
+    const skipPersistentInline = options?.skipPersistentSubscribersInline === true
+      || (Boolean(options?.persistent) && singleDelivery)
     let inlinePersistentFailed = false
     if (!enqueueOnly) {
-      const skipPersistentInline = Boolean(options?.persistent) && singleDelivery
       const delivered = await deliver(event, payload, options, skipPersistentInline)
       inlinePersistentFailed = delivered.persistentFailures > 0
     }
@@ -456,7 +457,7 @@ export function createEventBus(opts: CreateBusOptions): EventBus {
         // dead-lettering. Without this, flipping the flag off (which the
         // `mercato server` guard can do automatically) silently downgrades
         // persistent delivery to at-most-once.
-        persistentDeliveredInline: !enqueueOnly && !singleDelivery && !inlinePersistentFailed,
+        persistentDeliveredInline: !enqueueOnly && !skipPersistentInline && !inlinePersistentFailed,
       })
     }
   }

package/src/modules/events/api/stream/__tests__/route.test.ts

@@ -131,6 +131,78 @@ describe('SSE event stream — abort listener hygiene', () => {
     try { await reader.cancel() } catch {}
   })
 
+  it('ignores conflicting payload scope when trusted scope matches the connection', async () => {
+    const { req } = makeTrackedRequest()
+    const res = await GET(req)
+    expect(res.status).toBe(200)
+
+    const reader = (res.body as ReadableStream<Uint8Array>).getReader()
+    await reader.read()
+
+    expect(mockGlobalEventTap).toBeDefined()
+    await mockGlobalEventTap?.(
+      'progress.job.updated',
+      { tenantId: 'forged-tenant', organizationId: 'forged-organization', marker: 'expected' },
+      { tenantId: 't1', organizationId: 'o1' },
+    )
+
+    const { value, done } = await reader.read()
+    expect(done).toBe(false)
+    expect(new TextDecoder().decode(value)).toContain('\"marker\":\"expected\"')
+
+    try { await reader.cancel() } catch {}
+  })
+
+  it('preserves payload-authored scope for legacy emitters without a trusted scope marker', async () => {
+    const { req } = makeTrackedRequest()
+    const res = await GET(req)
+    expect(res.status).toBe(200)
+
+    const reader = (res.body as ReadableStream<Uint8Array>).getReader()
+    await reader.read()
+
+    expect(mockGlobalEventTap).toBeDefined()
+    await mockGlobalEventTap?.(
+      'progress.job.updated',
+      { tenantId: 't1', organizationId: 'o1', marker: 'legacy-expected' },
+    )
+
+    const { value, done } = await reader.read()
+    expect(done).toBe(false)
+    expect(new TextDecoder().decode(value)).toContain('"marker":"legacy-expected"')
+
+    try { await reader.cancel() } catch {}
+  })
+
+  it('does not fall back to payload scope when the trusted tenant marker is empty', async () => {
+    const { req } = makeTrackedRequest()
+    const res = await GET(req)
+    expect(res.status).toBe(200)
+
+    const reader = (res.body as ReadableStream<Uint8Array>).getReader()
+    await reader.read()
+
+    expect(mockGlobalEventTap).toBeDefined()
+    await mockGlobalEventTap?.(
+      'progress.job.updated',
+      { tenantId: 't1', organizationId: 'o1', marker: 'must-not-arrive' },
+      { tenantId: null, organizationId: null },
+    )
+    await mockGlobalEventTap?.(
+      'progress.job.updated',
+      { marker: 'expected' },
+      { tenantId: 't1', organizationId: 'o1' },
+    )
+
+    const { value, done } = await reader.read()
+    expect(done).toBe(false)
+    const decoded = new TextDecoder().decode(value)
+    expect(decoded).toContain('"marker":"expected"')
+    expect(decoded).not.toContain('"marker":"must-not-arrive"')
+
+    try { await reader.cancel() } catch {}
+  })
+
   it('does not retain listeners across many reconnects', async () => {
     for (let i = 0; i < 20; i += 1) {
       const { req, controller, addSpy, removeSpy } = makeTrackedRequest()

package/src/modules/events/api/stream/route.ts

@@ -50,16 +50,20 @@ function normalizeAudience(data: Record<string, unknown>, options?: EmitOptions)
   recipientUserScopes: string[]
   recipientRoleScopes: string[]
 } {
+  const hasTrustedScope = options != null
+    && Object.prototype.hasOwnProperty.call(options, 'tenantId')
   const trustedTenantId = typeof options?.tenantId === 'string' && options.tenantId.trim().length > 0
     ? options.tenantId.trim()
     : null
-  const tenantId = trustedTenantId ?? (typeof data.tenantId === 'string' ? data.tenantId : null)
+  const tenantId = hasTrustedScope
+    ? trustedTenantId
+    : (typeof data.tenantId === 'string' ? data.tenantId : null)
   const organizationScopes = new Set<string>()
   const trustedOrganizationId = typeof options?.organizationId === 'string' && options.organizationId.trim().length > 0
     ? options.organizationId.trim()
     : null
-  if (trustedOrganizationId) {
-    organizationScopes.add(trustedOrganizationId)
+  if (hasTrustedScope) {
+    if (trustedOrganizationId) organizationScopes.add(trustedOrganizationId)
   } else {
     if (typeof data.organizationId === 'string' && data.organizationId.trim().length > 0) {
       organizationScopes.add(data.organizationId.trim())

package/src/types.ts

@@ -90,6 +90,12 @@ export type EmitOptions = {
    * worker-dispatched (`persistent: true`).
    */
   deliverInline?: boolean
+  /**
+   * Skips subscribers registered as persistent during inline delivery while
+   * preserving ephemeral subscribers, global taps, and broadcast delivery.
+   * Persistent emits still enqueue those subscribers for worker dispatch.
+   */
+  skipPersistentSubscribersInline?: boolean
   /** Trusted tenant scope for subscribers that must not rely on payload scope */
   tenantId?: string | null
   /** Trusted organization scope for subscribers that must not rely on payload scope */