@pattern-stack/codegen 0.13.0 → 0.14.0

package/dist/runtime/subsystems/bridge/bridge-outbox-drain-hook.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../runtime/subsystems/bridge/bridge-outbox-drain-hook.ts","../../../../runtime/subsystems/bridge/bridge-delivery.schema.ts","../../../../runtime/subsystems/events/domain-events.schema.ts","../../../../runtime/subsystems/jobs/job-orchestration.schema.ts","../../../../runtime/subsystems/bridge/bridge.tokens.ts","../../../../runtime/subsystems/bridge/bridge-delivery-handler.ts","../../../../runtime/subsystems/jobs/jobs-domain.tokens.ts","../../../../runtime/subsystems/jobs/job-handler.base.ts","../../../../runtime/subsystems/events/events.tokens.ts","../../../../runtime/subsystems/bridge/bridge-errors.ts","../../../../runtime/subsystems/bridge/assert-tenant-id.ts"],"sourcesContent":["/**\n * BridgeOutboxDrainHook — drains-time bridge fanout writer (BRIDGE-4,\n * ADR-023 Phase 2).\n *\n * Implements `IBridgeOutboxDrainHook`. Called by `DrizzleEventBus`'s\n * modified `processBatch` once per drained event, INSIDE the per-event\n * transaction. For every trigger registered against the event's type in\n * the codegen-emitted `bridgeRegistry`, writes:\n *\n *   1. `bridge_delivery` ledger row — `INSERT … ON CONFLICT (event_id,\n *      trigger_id) DO NOTHING RETURNING id`. Empty result ⇒ Case B\n *      facade-eager pre-write OR drain-replay collision; skip wrapper\n *      insert for that trigger; sibling triggers still fire.\n *   2. `job_run` wrapper row — `type='@framework/bridge_delivery'`,\n *      `pool='events_<direction>'`, `input={ deliveryId }`,\n *      `trigger_source='event'`, `trigger_ref=event.id`. The wrapper is\n *      what the framework `BridgeDeliveryHandler` (BRIDGE-5) eventually\n *      claims via the worker that polls the corresponding reserved pool.\n *\n * Null `event.metadata.direction` is tolerated: the hook logs a one-line\n * warning per event and returns zeros without writing rows. The drain's\n * `processed_at` stamp + subscriber dispatch still fire normally.\n * Direction is null only for events published via the legacy\n * `IEventBus.publish(...)` path (`TypedEventBus.publish` always sets it);\n * such events are out of scope for bridge fanout.\n *\n * The wrapper insert generates its own `id` via Drizzle's `defaultRandom`\n * — we don't `RETURNING id` because nobody needs it at drain time;\n * `BridgeDeliveryHandler` later looks up the wrapper via the\n * `bridge_delivery.wrapper_run_id` link if needed. This keeps the drain\n * one-round-trip-per-trigger.\n */\nimport { Inject, Injectable, Logger, Optional } from '@nestjs/common';\nimport { randomUUID } from 'node:crypto';\n\nimport type { DomainEvent, DrizzleTransaction } from '../events/event-bus.protocol';\nimport { bridgeDelivery } from './bridge-delivery.schema';\nimport { jobRuns } from '../jobs/job-orchestration.schema';\n\nimport { BRIDGE_REGISTRY } from './bridge.tokens';\nimport type {\n  BridgeOutboxDrainResult,\n  BridgeRegistry,\n  BridgeTriggerEntry,\n  IBridgeOutboxDrainHook,\n} from './bridge.protocol';\nimport { BRIDGE_DELIVERY_JOB_TYPE } from './bridge-delivery-handler';\nimport type { EventTypeName } from '../events/generated/types';\n\n/** Reserved pools the wrapper rows route into; ADR-022 / ADR-024. */\nconst POOL_BY_DIRECTION: Record<string, string> = {\n  inbound: 'events_inbound',\n  change: 'events_change',\n  outbound: 'events_outbound',\n};\n\n@Injectable()\nexport class BridgeOutboxDrainHook implements IBridgeOutboxDrainHook {\n  private readonly logger = new Logger(BridgeOutboxDrainHook.name);\n  private warnedNullDirection = false;\n  private readonly warnedAuditTypes = new Set<string>();\n\n  constructor(\n    @Optional()\n    @Inject(BRIDGE_REGISTRY)\n    private readonly registry: BridgeRegistry = {},\n  ) {}\n\n  async processEvent(\n    event: DomainEvent,\n    tx: DrizzleTransaction,\n  ): Promise<BridgeOutboxDrainResult> {\n    // Audit-tier guard (defense-in-depth — AUDIT-4). Audit events are not\n    // bridge-eligible: the codegen-side validator (AUDIT-2) blocks the\n    // registry from listing them as triggers. Reaching this branch means\n    // registry/runtime drift — an out-of-band `bridge_trigger` insert, or\n    // version skew during deploy. Refuse fanout, surface drift via WARN.\n    if (event.metadata?.['tier'] === 'audit') {\n      this.warnAuditBlockedOnce(event);\n      return {\n        delivered: 0,\n        dedupSkips: 0,\n        triggerCount: 0,\n        auditBlocked: 1,\n      };\n    }\n\n    const triggers = this.lookupTriggers(event.type);\n    if (triggers.length === 0) {\n      return {\n        delivered: 0,\n        dedupSkips: 0,\n        triggerCount: 0,\n        auditBlocked: 0,\n      };\n    }\n\n    const direction =\n      (event.metadata?.['direction'] as string | undefined) ?? null;\n    const tenantId =\n      (event.metadata?.['tenantId'] as string | null | undefined) ?? null;\n    const wrapperPool = direction ? POOL_BY_DIRECTION[direction] : undefined;\n\n    if (!wrapperPool) {\n      // Null direction (or an unrecognised one — defensive). Bridge\n      // fanout requires a routed wrapper pool; without one we can't\n      // spawn. Log once per process so misconfiguration surfaces.\n      if (!this.warnedNullDirection) {\n        this.warnedNullDirection = true;\n        this.logger.warn(\n          `Skipping bridge fanout for events with null/unknown direction. ` +\n            `event.id=${event.id} event.type=${event.type} ` +\n            `direction=${String(direction)}. The wrapper pool is derived ` +\n            `from direction (events_<direction>); publishers must use ` +\n            `TypedEventBus.publish() so direction is stamped on the ` +\n            `outbox row.`,\n        );\n      }\n      return {\n        delivered: 0,\n        dedupSkips: 0,\n        triggerCount: triggers.length,\n        auditBlocked: 0,\n      };\n    }\n\n    let delivered = 0;\n    let dedupSkips = 0;\n    const client = tx as unknown as {\n      insert: (table: unknown) => {\n        values: (v: unknown) => {\n          onConflictDoNothing: (opts: unknown) => {\n            returning: (cols: unknown) => Promise<{ id: string }[]>;\n          };\n        } & {\n          // wrapper insert path — no ON CONFLICT\n          // (typed loosely via the same helper return shape)\n        };\n      };\n    };\n\n    for (const trigger of triggers) {\n      const deliveryId = randomUUID();\n      const wrapperRunId = randomUUID();\n\n      // 1. bridge_delivery insert with ON CONFLICT DO NOTHING + RETURNING.\n      const inserted = await (tx as unknown as {\n        insert: typeof client.insert;\n      })\n        .insert(bridgeDelivery)\n        .values({\n          id: deliveryId,\n          eventId: event.id,\n          triggerId: trigger.triggerId,\n          wrapperRunId,\n          status: 'pending',\n          tenantId,\n        })\n        .onConflictDoNothing({\n          target: [bridgeDelivery.eventId, bridgeDelivery.triggerId],\n        })\n        .returning({ id: bridgeDelivery.id });\n\n      if (inserted.length === 0) {\n        // Case B (facade pre-wrote `delivered`) or drain replay — skip\n        // wrapper insert for this trigger. Sibling triggers still fire.\n        dedupSkips++;\n        continue;\n      }\n\n      // 2. Wrapper job_run insert. We carry the deliveryId into the\n      //    wrapper input so BridgeDeliveryHandler.run(ctx) can locate\n      //    the row via repo.findDeliveryById(ctx.input.deliveryId).\n      await (tx as unknown as { insert: typeof client.insert })\n        .insert(jobRuns)\n        .values({\n          id: wrapperRunId,\n          jobType: BRIDGE_DELIVERY_JOB_TYPE,\n          jobVersion: 1,\n          rootRunId: wrapperRunId,\n          pool: wrapperPool,\n          status: 'pending',\n          input: { deliveryId },\n          triggerSource: 'event',\n          triggerRef: event.id,\n          tenantId,\n        });\n\n      delivered++;\n    }\n\n    return {\n      delivered,\n      dedupSkips,\n      triggerCount: triggers.length,\n      auditBlocked: 0,\n    };\n  }\n\n  private warnAuditBlockedOnce(event: DomainEvent): void {\n    if (this.warnedAuditTypes.has(event.type)) return;\n    this.warnedAuditTypes.add(event.type);\n    this.logger.warn(\n      `Bridge guard blocked audit-tier event '${event.type}' (event.id=${event.id}). ` +\n        `Registry says this event is not bridge-eligible; a bridge_trigger row exists ` +\n        `out-of-band. Investigate registry/runtime drift.`,\n    );\n  }\n\n  private lookupTriggers(\n    eventType: string,\n  ): BridgeTriggerEntry[] {\n    const candidates = this.registry[eventType as EventTypeName];\n    return (candidates ?? []) as BridgeTriggerEntry[];\n  }\n}\n","/**\n * Drizzle schema for the `bridge_delivery` ledger (ADR-023 Phase 2, BRIDGE-1).\n *\n * The `bridge_delivery` table is the idempotency ledger for the event-to-job\n * bridge. Every (event, trigger) pair the bridge is asked to spawn produces\n * exactly one row; the `UNIQUE (event_id, trigger_id)` constraint guarantees\n * that:\n *\n *   1. Outbox replays of an event do not double-spawn user job runs — the\n *      drain attempts to insert the duplicate, the constraint trips, and the\n *      drain skips that trigger.\n *   2. The `IEventFlow.publishAndStart` facade can pre-write a\n *      `(status='delivered')` row before the drain runs (Case B from ADR-023\n *      §`publishAndStart` + existing `triggers:` collision); the drain then\n *      hits UNIQUE on that trigger and skips it while still spawning any\n *      other triggers for the same event normally.\n *\n * Status values:\n *   - `pending`   — wrapper run exists; user job not yet started.\n *   - `delivered` — user job started; `user_run_id` populated.\n *   - `skipped`   — intentional no-op (`when:` returned false, or\n *                   facade-eager path pre-empted the bridge spawn).\n *   - `failed`    — wrapper exhausted retry policy; no auto-retry past that\n *                   (mirrors events outbox stance — ops eyes only).\n *\n * `wrapper_run_id` is **nullable**: the facade-eager path (Case B) pre-writes\n * `bridge_delivery` with no wrapper. The bridge-drain path always populates\n * it.\n *\n * `tenant_id` is emitted **unconditionally and nullable** (per JOB-8\n * 2026-04-20 reversal); enforcement is service-layer (BRIDGE-8) gated on the\n * `BRIDGE_MULTI_TENANT` DI token, not a DB constraint.\n *\n * Indexes:\n *   - `bridge_delivery_event_idx` — lookup all deliveries for an event.\n *   - `bridge_delivery_status_idx` — partial; ops dashboards filter by\n *     `pending | failed`.\n *   - `bridge_delivery_user_run_idx` — partial; reverse lookup from a\n *     spawned user run back to its delivery row.\n *\n * No service logic, no DI wiring — this is the schema foundation. Backends\n * (memory + drizzle) and the framework handler land in BRIDGE-3 / BRIDGE-4 /\n * BRIDGE-5.\n */\nimport {\n  index,\n  jsonb,\n  pgEnum,\n  pgTable,\n  text,\n  timestamp,\n  unique,\n  uuid,\n} from 'drizzle-orm/pg-core';\nimport { sql } from 'drizzle-orm';\nimport type { InferSelectModel } from 'drizzle-orm';\n\nimport { domainEvents } from '../events/domain-events.schema';\nimport { jobRuns } from '../jobs/job-orchestration.schema';\n\n// ─── Enum ───────────────────────────────────────────────────────────────────\n\nexport const bridgeDeliveryStatusEnum = pgEnum('bridge_delivery_status', [\n  'pending',\n  'delivered',\n  'skipped',\n  'failed',\n]);\n\n// ─── Table ──────────────────────────────────────────────────────────────────\n\nexport const bridgeDelivery = pgTable(\n  'bridge_delivery',\n  {\n    id: uuid('id').primaryKey().defaultRandom(),\n    /** FK to the source event in the outbox. */\n    eventId: uuid('event_id')\n      .notNull()\n      .references(() => domainEvents.id),\n    /**\n     * Stable codegen-emitted identifier for the (job, trigger) pair, of the\n     * form `<job_type>#<triggerIndex>` (BRIDGE-6). Forms the second half of\n     * the UNIQUE idempotency key.\n     */\n    triggerId: text('trigger_id').notNull(),\n    /**\n     * Wrapper `job_run.id` (the framework `@framework/bridge_delivery` run\n     * that drove this delivery). Nullable: the facade-eager path\n     * (`publishAndStart` Case B) pre-writes a delivered row with no wrapper.\n     */\n    wrapperRunId: uuid('wrapper_run_id').references(() => jobRuns.id),\n    /**\n     * Spawned user `job_run.id`. Null until status is `delivered`; remains\n     * null for `skipped` and `failed` deliveries.\n     */\n    userRunId: uuid('user_run_id').references(() => jobRuns.id),\n    status: bridgeDeliveryStatusEnum('status').notNull().default('pending'),\n    /** Populated when status=`skipped` (e.g. `'when_returned_false'`, `'trigger_unregistered'`). */\n    skipReason: text('skip_reason'),\n    /** Populated when status=`failed`. Mirrors `job_run.error` shape. */\n    error: jsonb('error').$type<Record<string, unknown>>(),\n    /**\n     * Emitted unconditionally and nullable (JOB-8 / SYNC-6 precedent).\n     * Enforcement gated on `BRIDGE_MULTI_TENANT` at the service layer\n     * (BRIDGE-8); no DB constraint.\n     */\n    tenantId: text('tenant_id'),\n    attemptedAt: timestamp('attempted_at', { withTimezone: true })\n      .notNull()\n      .defaultNow(),\n    deliveredAt: timestamp('delivered_at', { withTimezone: true }),\n  },\n  (t) => ({\n    /**\n     * Idempotency ledger. Outbox replays and facade-vs-drain collisions both\n     * dedup through this constraint.\n     */\n    uqBridgeDeliveryEventTrigger: unique('uq_bridge_delivery_event_trigger').on(\n      t.eventId,\n      t.triggerId,\n    ),\n    /** Lookup all deliveries for an event (fanout report, debugging). */\n    idxBridgeDeliveryEvent: index('idx_bridge_delivery_event').on(t.eventId),\n    /**\n     * Ops dashboard filter — only the actionable states. Partial index keeps\n     * it small at scale (the bulk of rows will be `delivered`).\n     */\n    idxBridgeDeliveryStatus: index('idx_bridge_delivery_status')\n      .on(t.status)\n      .where(sql`${t.status} IN ('pending','failed')`),\n    /**\n     * Reverse lookup from a spawned user run back to its delivery row.\n     * Partial — most rows in the bridge ledger but only successful\n     * deliveries have a `user_run_id`.\n     */\n    idxBridgeDeliveryUserRun: index('idx_bridge_delivery_user_run')\n      .on(t.userRunId)\n      .where(sql`${t.userRunId} IS NOT NULL`),\n  }),\n);\n\nexport type BridgeDeliveryRecord = InferSelectModel<typeof bridgeDelivery>;\n","/**\n * Drizzle schema for the domain_events outbox table.\n *\n * This table backs the DrizzleEventBus. Events are inserted within the\n * same database transaction as the domain write (outbox pattern). A\n * polling process reads unprocessed rows and dispatches to subscribers.\n *\n * First-class routing columns (EVT-1):\n *   - `pool`       — populated by DrizzleEventBus.publish() (EVT-4); enables\n *                    pool-filtered drain queries without unpacking metadata JSON.\n *                    NULL when `tier='audit'` (audit events are not routed).\n *   - `direction`  — `inbound` | `change` | `outbound`; mirrors the routing\n *                    dimension used by jobs' reserved `events_inbound` /\n *                    `events_change` / `events_outbound` pools.\n *                    NULL when `tier='audit'`.\n *   - `tenant_id`  — conditional: emitted only when `events.multi_tenant: true`\n *                    in `codegen.config.yaml`. The runtime source declares it\n *                    unconditionally; EVT-8's scaffold template handles the\n *                    config-driven include/exclude.\n *\n * Audit-tier column (AUDIT-1):\n *   - `tier`       — `'domain'` | `'audit'`. Defaults to `'domain'`. Audit-tier\n *                    rows are observability-only (subscribers may observe but\n *                    the bridge MUST NOT spawn jobs from them); they have null\n *                    `pool` and `direction` by construction. The CHECK\n *                    constraint `domain_events_tier_routing_check` enforces\n *                    `tier='audit' ⇔ (pool IS NULL AND direction IS NULL)`.\n *\n * The `metadata` JSON column continues to carry these values for protocol\n * stability; the first-class columns are an optimization for drain filtering.\n *\n * Indexes (declared below in the index callback):\n *   - (status, occurred_at)             — polling drain filter\n *   - (aggregate_id, aggregate_type)    — event replay per aggregate\n *   - (pool, status, occurred_at)       — per-pool drain filter (EVT-1)\n *   - (tier, status, occurred_at)       — per-tier filter for the observability\n *                                          viewer's tier toggle (AUDIT-1).\n */\nimport {\n  check,\n  index,\n  jsonb,\n  pgTable,\n  text,\n  timestamp,\n  uuid,\n} from 'drizzle-orm/pg-core';\nimport { sql } from 'drizzle-orm';\nimport type { InferSelectModel } from 'drizzle-orm';\n\nexport const domainEvents = pgTable(\n  'domain_events',\n  {\n    id: uuid('id').primaryKey(),\n    type: text('type').notNull(),\n    aggregateId: text('aggregate_id').notNull(),\n    aggregateType: text('aggregate_type').notNull(),\n    payload: jsonb('payload').notNull().$type<Record<string, unknown>>(),\n    occurredAt: timestamp('occurred_at', { withTimezone: true }).notNull(),\n    processedAt: timestamp('processed_at', { withTimezone: true }),\n    /** Lifecycle status: pending | processed | failed */\n    status: text('status').notNull().default('pending'),\n    /** Error message from the last failed dispatch attempt. */\n    error: text('error'),\n    metadata: jsonb('metadata').$type<Record<string, unknown>>(),\n    /** Routing pool (e.g. `events_inbound`, `events_change`, `events_outbound`). Populated by DrizzleEventBus.publish() in EVT-4. NULL when `tier='audit'`. */\n    pool: text('pool'),\n    /** Routing direction: `inbound` | `change` | `outbound`. Populated by DrizzleEventBus.publish() in EVT-4. NULL when `tier='audit'`. */\n    direction: text('direction'),\n    /**\n     * Event tier: `'domain'` (default) or `'audit'`. Audit-tier rows are\n     * observability-only and have null `pool`/`direction` by construction —\n     * enforced by the `domain_events_tier_routing_check` CHECK constraint\n     * declared below. (AUDIT-1)\n     */\n    tier: text('tier').notNull().default('domain'),\n    // conditional: emitted only when events.multi_tenant: true\n    tenantId: text('tenant_id'),\n  },\n  (t) => ({\n    /** Polling drain filter (existing — promoted from comment to declaration in EVT-1). */\n    idxDomainEventsStatusOccurredAt: index('idx_domain_events_status_occurred_at').on(\n      t.status,\n      t.occurredAt,\n    ),\n    /** Event replay per aggregate (existing — promoted from comment to declaration in EVT-1). */\n    idxDomainEventsAggregate: index('idx_domain_events_aggregate').on(\n      t.aggregateId,\n      t.aggregateType,\n    ),\n    /** Per-pool drain filter (EVT-1). Enables DrizzleEventBus to drain a single pool without scanning all events. */\n    idxDomainEventsPoolStatusOccurredAt: index(\n      'idx_domain_events_pool_status_occurred_at',\n    ).on(t.pool, t.status, t.occurredAt),\n    /** Per-tier filter (AUDIT-1). Backs the observability viewer's tier toggle. */\n    idxDomainEventsTierStatusOccurredAt: index(\n      'idx_domain_events_tier_status_occurred_at',\n    ).on(t.tier, t.status, t.occurredAt),\n    /**\n     * Tier ↔ routing-fields invariant (AUDIT-1):\n     *   - `tier` is one of `'domain' | 'audit'`.\n     *   - `tier='audit'` ⇔ `pool IS NULL AND direction IS NULL`.\n     *   - `tier='domain'` ⇒ `pool` and `direction` are populated (the\n     *     DrizzleEventBus inserts always supply them; the bus stamps them\n     *     in AUDIT-3).\n     */\n    tierRoutingCheck: check(\n      'domain_events_tier_routing_check',\n      sql`${t.tier} in ('domain','audit') AND ((${t.tier} = 'audit') = (${t.pool} is null and ${t.direction} is null))`,\n    ),\n  }),\n);\n\nexport type DomainEventRecord = InferSelectModel<typeof domainEvents>;\n","/**\n * Drizzle schema for the job orchestration domain (ADR-022).\n *\n * Three tables model the lifecycle of a durable job:\n *   - `job`       — definitions keyed by handler type (e.g. 'onboarding').\n *   - `job_run`   — one row per attempt to execute a job; worker claims\n *                   rows directly via SELECT ... FOR UPDATE SKIP LOCKED.\n *   - `job_step`  — individual steps within a run; memoises output for replay.\n *\n * Phase 1 ships only this layer. There is no `job_queue` table, no executor\n * port — see ADR-022 and `.claude/skills/jobs/SKILL.md` for the rationale.\n */\nimport {\n  pgEnum,\n  pgTable,\n  uuid,\n  text,\n  jsonb,\n  integer,\n  timestamp,\n  index,\n  uniqueIndex,\n} from 'drizzle-orm/pg-core';\nimport { sql } from 'drizzle-orm';\nimport type { InferSelectModel } from 'drizzle-orm';\n\n// ─── Internal $type<> helpers ───────────────────────────────────────────────\n// Annotation types for jsonb columns only. JOB-2 defines the public protocol\n// types; these remain private to this file.\n\ntype RetryPolicy = {\n  attempts: number;\n  backoff: 'fixed' | 'exponential';\n  baseMs: number;\n  nonRetryableErrors?: string[];\n};\n\ntype JobRunError = {\n  message: string;\n  stack?: string;\n  retryable: boolean;\n  attempt: number;\n};\n\n// ─── Enums ──────────────────────────────────────────────────────────────────\n\nexport const jobRunStatusEnum = pgEnum('job_run_status', [\n  'pending',\n  'running',\n  'waiting',\n  'completed',\n  'failed',\n  'timed_out',\n  'canceled',\n]);\n\n// extended in ADR-027: tool_call | llm_call | wait | checkpoint | message\nexport const jobStepKindEnum = pgEnum('job_step_kind', ['task']);\n\nexport const jobStepStatusEnum = pgEnum('job_step_status', [\n  'pending',\n  'running',\n  'completed',\n  'failed',\n  'skipped',\n]);\n\nexport const collisionModeEnum = pgEnum('job_collision_mode', [\n  'queue',\n  'reject',\n  'replace',\n]);\n\nexport const replayFromEnum = pgEnum('job_replay_from', [\n  'scratch',\n  'last_step',\n  'last_checkpoint',\n]);\n\nexport const parentClosePolicyEnum = pgEnum('job_parent_close_policy', [\n  'terminate',\n  'cancel',\n  'abandon',\n]);\n\n// Phase 3 placeholder — see ADR-025\nexport const waitKindEnum = pgEnum('job_wait_kind', ['signal']);\n\n// Phase 2 may add more sources; requires Atlas migration\nexport const triggerSourceEnum = pgEnum('job_trigger_source', [\n  'manual',\n  'schedule',\n  'event',\n  'parent',\n]);\n\n// ─── job ────────────────────────────────────────────────────────────────────\n\nexport const jobs = pgTable('job', {\n  type: text('type').primaryKey(),\n  version: integer('version').notNull().default(1),\n  pool: text('pool').notNull(),\n  scopeEntityType: text('scope_entity_type'),\n  retryPolicy: jsonb('retry_policy').notNull().$type<RetryPolicy>(),\n  timeoutMs: integer('timeout_ms'),\n  concurrencyKeyTemplate: text('concurrency_key_template'),\n  collisionMode: collisionModeEnum('collision_mode').notNull().default('queue'),\n  dedupeKeyTemplate: text('dedupe_key_template'),\n  dedupeWindowMs: integer('dedupe_window_ms'),\n  priorityDefault: integer('priority_default').notNull().default(0),\n  replayFrom: replayFromEnum('replay_from').notNull().default('last_checkpoint'),\n  createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),\n  updatedAt: timestamp('updated_at', { withTimezone: true }).notNull().defaultNow(),\n});\n\nexport type JobDefinitionRow = InferSelectModel<typeof jobs>;\n\n// ─── job_run ────────────────────────────────────────────────────────────────\n\nexport const jobRuns = pgTable(\n  'job_run',\n  {\n    id: uuid('id').primaryKey().defaultRandom(),\n    jobType: text('job_type').notNull().references(() => jobs.type),\n    jobVersion: integer('job_version').notNull(),\n    parentRunId: uuid('parent_run_id').references((): any => jobRuns.id),\n    /**\n     * Service generates `id` client-side via randomUUID() and sets\n     * root_run_id = id for root runs (single INSERT, no self-FK race).\n     */\n    rootRunId: uuid('root_run_id').notNull(),\n    parentClosePolicy: parentClosePolicyEnum('parent_close_policy')\n      .notNull()\n      .default('terminate'),\n    scopeEntityType: text('scope_entity_type'),\n    scopeEntityId: text('scope_entity_id'),\n    tenantId: text('tenant_id'),\n    tags: jsonb('tags').notNull().default({}).$type<Record<string, string>>(),\n    pool: text('pool').notNull(),\n    priority: integer('priority').notNull().default(0),\n    concurrencyKey: text('concurrency_key'),\n    dedupeKey: text('dedupe_key'),\n    status: jobRunStatusEnum('status').notNull().default('pending'),\n    input: jsonb('input').notNull().$type<Record<string, unknown>>(),\n    output: jsonb('output').$type<Record<string, unknown>>(),\n    error: jsonb('error').$type<JobRunError>(),\n    triggerSource: triggerSourceEnum('trigger_source').notNull(),\n    triggerRef: text('trigger_ref'),\n    runAt: timestamp('run_at', { withTimezone: true }).notNull().defaultNow(),\n    startedAt: timestamp('started_at', { withTimezone: true }),\n    finishedAt: timestamp('finished_at', { withTimezone: true }),\n    claimedAt: timestamp('claimed_at', { withTimezone: true }),\n    attempts: integer('attempts').notNull().default(0),\n    // Phase 3 placeholder — see ADR-025\n    waitKind: waitKindEnum('wait_kind'),\n    // Phase 3 placeholder — see ADR-025\n    resumeToken: text('resume_token'),\n    // Phase 3 placeholder — see ADR-025\n    waitDeadline: timestamp('wait_deadline', { withTimezone: true }),\n    createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),\n    updatedAt: timestamp('updated_at', { withTimezone: true }).notNull().defaultNow(),\n  },\n  (t) => ({\n    /** Claim query: ORDER BY priority DESC, run_at ASC. */\n    idxJobRunClaim: index('idx_job_run_claim').on(t.status, t.pool, t.runAt),\n    /** Tree traversal / cascade cancel. */\n    idxJobRunRoot: index('idx_job_run_root').on(t.rootRunId),\n    /** listForScope query. */\n    idxJobRunScope: index('idx_job_run_scope').on(t.scopeEntityType, t.scopeEntityId),\n    /** Idempotency collapse — partial index. */\n    idxJobRunDedupe: index('idx_job_run_dedupe')\n      .on(t.jobType, t.dedupeKey)\n      .where(sql`${t.dedupeKey} IS NOT NULL`),\n    /** Collision check — partial index. */\n    idxJobRunConcurrency: index('idx_job_run_concurrency')\n      .on(t.concurrencyKey)\n      .where(\n        sql`${t.concurrencyKey} IS NOT NULL AND ${t.status} IN ('pending','running')`,\n      ),\n  }),\n);\n\nexport type JobRunRow = InferSelectModel<typeof jobRuns>;\n\n// ─── job_step ───────────────────────────────────────────────────────────────\n\nexport const jobSteps = pgTable(\n  'job_step',\n  {\n    id: uuid('id').primaryKey().defaultRandom(),\n    jobRunId: uuid('job_run_id').notNull().references(() => jobRuns.id),\n    stepId: text('step_id').notNull(),\n    kind: jobStepKindEnum('kind').notNull().default('task'),\n    /**\n     * Monotonic within run. integer (max ~2B per run) is sufficient —\n     * downgraded from ADR-022's bigint; revisit only if a single run\n     * ever exceeds 2 billion steps.\n     */\n    seq: integer('seq').notNull(),\n    status: jobStepStatusEnum('status').notNull().default('pending'),\n    input: jsonb('input').$type<Record<string, unknown>>(),\n    /** Memoised on success for replay. */\n    output: jsonb('output').$type<Record<string, unknown>>(),\n    error: jsonb('error').$type<JobRunError>(),\n    attempts: integer('attempts').notNull().default(0),\n    startedAt: timestamp('started_at', { withTimezone: true }),\n    finishedAt: timestamp('finished_at', { withTimezone: true }),\n  },\n  (t) => ({\n    /** No duplicate step IDs per run. */\n    idxJobStepRunStep: uniqueIndex('idx_job_step_run_step').on(t.jobRunId, t.stepId),\n    /** Ordered timeline reads. */\n    idxJobStepTimeline: index('idx_job_step_timeline').on(t.jobRunId, t.seq),\n  }),\n);\n\nexport type JobStepRow = InferSelectModel<typeof jobSteps>;\n","/**\n * Injection tokens for the bridge subsystem (ADR-023 Phase 2, BRIDGE-2).\n *\n * String constants (not Symbols) so they match by value across import\n * boundaries — same convention as `EVENT_BUS` / `EVENTS_MULTI_TENANT` in the\n * events subsystem (per EVT-6 §Implementation Notes). The jobs subsystem\n * uses Symbols for its analogous tokens; we keep the bridge file internally\n * consistent with the events convention because the bridge is conceptually\n * downstream of (and imports from) the events module.\n */\n\n/**\n * Token for the `IJobBridge` repo backend (memory in BRIDGE-3, Drizzle in\n * BRIDGE-4). Consumed by `BridgeDeliveryHandler` (BRIDGE-5), the outbox\n * drain (BRIDGE-4 modification), and `EventFlowService` (BRIDGE-7).\n */\nexport const BRIDGE_DELIVERY_REPO = 'BRIDGE_DELIVERY_REPO' as const;\n\n/**\n * Token for the `IEventFlow` facade implementation (BRIDGE-7). Use cases\n * inject this in preference to `EVENT_BUS` / `TYPED_EVENT_BUS` — calling\n * `eventFlow.publish(...)` / `eventFlow.publishAndStart(...)` is the\n * sanctioned authoring surface (ADR-023 §Decision 7).\n */\nexport const EVENT_FLOW = 'EVENT_FLOW' as const;\n\n/**\n * Token for the resolved multi-tenancy flag, provided by\n * `BridgeModule.forRoot({ multiTenant })` in BRIDGE-8. Consumed by\n * `EventFlowService.publishAndStart` (entry), `BridgeDeliveryHandler.handle`\n * (entry), and `DrizzleBridgeDeliveryRepo.insertDelivery` (pre-write) — the\n * three enforcement sites called out in ADR-023 §Multi-tenancy.\n */\nexport const BRIDGE_MULTI_TENANT = 'BRIDGE_MULTI_TENANT' as const;\n\n/**\n * Token for the resolved `BridgeModuleOptions` object. Provided by\n * `BridgeModule.forRoot(...)` / `forRootAsync(...)` in BRIDGE-8.\n * Mirrors `EVENTS_MODULE_OPTIONS` and `JOBS_DOMAIN_OPTIONS` shape — backends\n * inject this when they need to observe additional module configuration\n * (e.g. pool overrides) without each adding a dedicated token.\n */\nexport const BRIDGE_MODULE_OPTIONS = 'BRIDGE_MODULE_OPTIONS' as const;\n\n/**\n * Token for the codegen-emitted `bridgeRegistry` — the\n * `Record<EventTypeName, BridgeTriggerEntry[]>` map that drives\n * outbox-drain trigger lookup (BRIDGE-4) and `EventFlowService` Case B\n * dedup (BRIDGE-7). Provider registration lands in BRIDGE-8; the token is\n * declared here so generated code (BRIDGE-6) can import it without\n * depending on the still-being-formalised module.\n */\nexport const BRIDGE_REGISTRY = 'BRIDGE_REGISTRY' as const;\n\n\n/**\n * Token for the `IBridgeOutboxDrainHook` implementation (BRIDGE-4).\n * Injected `@Optional()` into `DrizzleEventBus` — when the bridge\n * subsystem is not installed the token is undefined and the events\n * outbox drain skips the bridge block entirely (preserves EVT-4\n * baseline behaviour).\n *\n * Resolution order: `BridgeModule.forRoot()` provides this token in\n * BRIDGE-8 alongside the rest of the bridge subsystem. `EventsModule`\n * itself never provides it; the events subsystem stays unaware of the\n * bridge unless the consumer wires it.\n */\nexport const BRIDGE_OUTBOX_DRAIN_HOOK = 'BRIDGE_OUTBOX_DRAIN_HOOK' as const;\n","/**\n * BridgeDeliveryHandler — the framework `@JobHandler` that runs every\n * bridge-fanout wrapper on the reserved `events_*` pools (BRIDGE-5,\n * ADR-023 §Decision 2 flow diagram).\n *\n * Role: when the outbox drain (BRIDGE-4) inserts a `bridge_delivery + wrapper\n * job_run` pair, the worker that polls the wrapper's pool claims that\n * wrapper and dispatches it to this handler. The handler:\n *\n *   1. Loads the `bridge_delivery` row by `ctx.input.deliveryId`.\n *   2. Looks up the trigger entry in the codegen-emitted `bridgeRegistry`\n *      (`runtime/subsystems/bridge/generated/registry.ts`, BRIDGE-6).\n *      A missing entry means the trigger was renamed or removed since the\n *      delivery row was written; mark `skipped` with\n *      `skip_reason='trigger_unregistered'` per ADR-023 §Trigger rename\n *      or removal.\n *   3. Re-fetches the authoritative `domain_events` row (`IEventBus.findById`)\n *      so `when:` / `map:` callbacks see the committed payload — never a\n *      copy that drifted between drain and claim time.\n *   4. Evaluates `entry.when?.(event)`. False ⇒ mark `skipped` with\n *      `skip_reason='predicate_false'`.\n *   5. Calls `IJobOrchestrator.start(entry.jobType, entry.map(event), …)`\n *      INSIDE `ctx.step('spawn_user_run', …)`. The step memoization is\n *      what makes wrapper retries (BRIDGE-1 ledger says no auto-retry past\n *      the wrapper's own retry policy, but Phase 1 wrappers DO retry per\n *      JOB-3) idempotent — a successful spawn followed by a transient\n *      ledger-update failure would otherwise re-spawn on the next attempt.\n *   6. Marks `delivered` with the spawned `runId`.\n *\n * Pool registration: BRIDGE-5 ships ONE `@JobHandler` registration with\n * `pool: 'events_change'` (the default). The wrapper rows the drain\n * inserts carry `pool: events_<direction>` per row, so workers polling\n * `events_inbound` / `events_outbound` claim and dispatch to this same\n * handler class regardless of the metadata pool — the worker filter is on\n * `job_run.pool`, not on `@JobHandler.meta.pool`. BRIDGE-8 confirms the\n * three pools are active and registered at module init. The\n * `@framework/*` job-type prefix exempts this registration from the\n * reserved-pool validator (BRIDGE-5 added that exemption to\n * `job-worker.module.ts`).\n *\n * Tenant threading: when `BRIDGE_MULTI_TENANT=true`, the handler asserts\n * `delivery.tenantId !== undefined` before the spawn (the column is\n * nullable, so explicit `null` is allowed for cross-tenant work — same\n * contract as JOB-8). BRIDGE-8 wires the assertion via the\n * `BRIDGE_MULTI_TENANT` token.\n *\n * Failure path: any throw inside the handler propagates up; the worker's\n * normal retry policy (declared on the `@JobHandler` here as `attempts:\n * 3, backoff: exponential, baseMs: 250`) absorbs transient infra blips.\n * After exhaustion, the wrapper transitions to `failed`; the outer error\n * handler catches and calls `repo.markFailed(...)` so the delivery row\n * reflects the final state. Operators see `bridge_delivery.status='failed'`\n * surface via the `idx_bridge_delivery_status` partial index (BRIDGE-1).\n */\nimport { Inject, Injectable, Logger, Optional } from '@nestjs/common';\n\nimport { JOB_ORCHESTRATOR } from '../jobs/jobs-domain.tokens';\nimport type { IJobOrchestrator } from '../jobs/job-orchestrator.protocol';\nimport {\n  JobHandler,\n  JobHandlerBase,\n  type JobContext,\n} from '../jobs/job-handler.base';\n\nimport { EVENT_BUS } from '../events/events.tokens';\nimport type { IEventBus, DomainEvent } from '../events/event-bus.protocol';\nimport type { EventTypeName } from '../events/generated/types';\n\nimport {\n  BRIDGE_DELIVERY_REPO,\n  BRIDGE_MULTI_TENANT,\n  BRIDGE_REGISTRY,\n} from './bridge.tokens';\nimport type {\n  BridgeRegistry,\n  BridgeTriggerEntry,\n  IJobBridge,\n} from './bridge.protocol';\nimport { assertTenantId } from './assert-tenant-id';\n\n/** Stable canonical job type — referenced by BRIDGE-4 wrapper inserts. */\nexport const BRIDGE_DELIVERY_JOB_TYPE = '@framework/bridge_delivery' as const;\n\n/** Stable canonical step id — referenced for memoization across attempts. */\nconst SPAWN_USER_RUN_STEP = 'spawn_user_run' as const;\n\nexport interface BridgeDeliveryInput {\n  /** PK of the `bridge_delivery` row this wrapper services. */\n  deliveryId: string;\n}\n\n@Injectable()\n@JobHandler<BridgeDeliveryInput>(BRIDGE_DELIVERY_JOB_TYPE, {\n  pool: 'events_change',\n  retry: { attempts: 3, backoff: 'exponential', baseMs: 250 },\n  replayFrom: 'last_step',\n})\nexport class BridgeDeliveryHandler extends JobHandlerBase<\n  BridgeDeliveryInput,\n  { runId: string } | { skipped: true; reason: string }\n> {\n  private readonly classLogger = new Logger(BridgeDeliveryHandler.name);\n\n  constructor(\n    @Inject(BRIDGE_DELIVERY_REPO) private readonly repo: IJobBridge,\n    @Inject(JOB_ORCHESTRATOR) private readonly orchestrator: IJobOrchestrator,\n    @Inject(EVENT_BUS) private readonly events: IEventBus,\n    @Inject(BRIDGE_REGISTRY) private readonly registry: BridgeRegistry,\n    @Optional()\n    @Inject(BRIDGE_MULTI_TENANT)\n    private readonly multiTenant: boolean = false,\n  ) {\n    super();\n  }\n\n  async run(\n    ctx: JobContext<BridgeDeliveryInput>,\n  ): Promise<{ runId: string } | { skipped: true; reason: string }> {\n    const { deliveryId } = ctx.input;\n\n    // Step 1 — locate the delivery row by primary key.\n    const delivery = await this.repo.findDeliveryById(deliveryId);\n    if (!delivery) {\n      // The drain wrote a wrapper job_run but the delivery row is gone\n      // (manual ops cleanup, or delete-cascade from the parent event).\n      // No row → no work; return without throwing so the wrapper marks\n      // completed cleanly.\n      this.classLogger.warn(\n        `bridge_delivery row '${deliveryId}' not found; wrapper completes ` +\n          `without spawning a user job.`,\n      );\n      return { skipped: true, reason: 'delivery_row_missing' };\n    }\n\n    // Step 2 — multi-tenancy gate. Site (b) of the three ADR-023\n    // §Multi-tenancy enforcement sites; shared helper from BRIDGE-8.\n    // The DB always returns string|null, never undefined; this branch\n    // exists for the in-memory backend's older test fixtures and to\n    // pin the contract in shape-typed tests.\n    assertTenantId(\n      'BridgeDeliveryHandler.run',\n      this.multiTenant,\n      delivery.tenantId,\n    );\n\n    // Step 3 — load the typed event row.\n    const event = await this.events.findById(delivery.eventId);\n    if (!event) {\n      // FK from bridge_delivery.event_id → domain_events.id should make\n      // this impossible at the DB layer, but defensive: if the row is\n      // missing we mark skipped, not failed (no work the bridge can do).\n      this.classLogger.warn(\n        `domain_events row '${delivery.eventId}' missing for delivery ` +\n          `'${deliveryId}'; marking skipped.`,\n      );\n      await this.repo.markSkipped(delivery.id, 'event_row_missing');\n      return { skipped: true, reason: 'event_row_missing' };\n    }\n\n    // Step 4 — registry lookup. Handles trigger rename/removal cleanly.\n    const entry = this.findRegistryEntry(event.type, delivery.triggerId);\n    if (!entry) {\n      await this.repo.markSkipped(delivery.id, 'trigger_unregistered');\n      return { skipped: true, reason: 'trigger_unregistered' };\n    }\n\n    // Step 5 — `when:` predicate.\n    if (entry.when && !entry.when(event as never)) {\n      await this.repo.markSkipped(delivery.id, 'predicate_false');\n      return { skipped: true, reason: 'predicate_false' };\n    }\n\n    // Step 6 — memoized spawn. `ctx.step` records the result in\n    // `job_step` and on retry returns the cached `{ runId }` so a\n    // transient failure between `orchestrator.start` and `markDelivered`\n    // doesn't double-spawn the user job.\n    const input = entry.map(event as never);\n    const { runId } = await ctx.step<{ runId: string }>(\n      SPAWN_USER_RUN_STEP,\n      async () => {\n        const run = await this.orchestrator.start(entry.jobType, input, {\n          parentRunId: ctx.run.id,\n          triggerSource: 'event',\n          triggerRef: delivery.eventId,\n          tenantId: delivery.tenantId,\n        });\n        return { runId: run.id };\n      },\n    );\n\n    // Step 7 — ledger transition.\n    await this.repo.markDelivered(delivery.id, runId);\n    return { runId };\n  }\n\n  /**\n   * Locate the registry entry for `(eventType, triggerId)`. Linear scan\n   * over the per-event-type array — N is the number of triggers declared\n   * for one event, typically 1–5; the table is not big enough to warrant\n   * a secondary index.\n   */\n  private findRegistryEntry(\n    eventType: string,\n    triggerId: string,\n  ): BridgeTriggerEntry | undefined {\n    const candidates =\n      this.registry[eventType as EventTypeName] ?? undefined;\n    if (!candidates) return undefined;\n    return candidates.find((c) => c.triggerId === triggerId) as\n      | BridgeTriggerEntry\n      | undefined;\n  }\n}\n\n/**\n * Re-export for BRIDGE-7 facade Case B and BRIDGE-4 wrapper insert.\n * Single source of truth for the canonical type string keeps refactors\n * in one place.\n */\nexport { BRIDGE_DELIVERY_JOB_TYPE as BridgeDeliveryJobType };\n","/**\n * Injection tokens for the job orchestration domain layer (ADR-022, JOB-2).\n *\n * Consumer code injects these symbols via `@Inject(JOB_ORCHESTRATOR)` etc.;\n * concrete backends (JOB-3 Drizzle, JOB-4 Memory) provide the implementations\n * through `JobsDomainModule.forRoot({ backend })` in JOB-5.\n *\n * Each token is a unique `Symbol` — guaranteed distinct from every other\n * Symbol at runtime, which is exactly the uniqueness guarantee Nest's DI\n * container relies on for token-based lookup.\n */\nexport const JOB_ORCHESTRATOR = Symbol('JOB_ORCHESTRATOR');\nexport const JOB_RUN_SERVICE = Symbol('JOB_RUN_SERVICE');\nexport const JOB_STEP_SERVICE = Symbol('JOB_STEP_SERVICE');\n\n/**\n * Multi-tenancy opt-in flag (JOB-8). Bound to the boolean passed in via\n * `JobsDomainModule.forRoot({ multiTenant })`, defaulting to `false`.\n *\n * When `true`, the four service-layer backends (Drizzle + Memory orchestrator\n * and run-service) enforce `tenantId` on every mutating / targeted-read call:\n * `start`, `cancel`, `listForScope`, `cancelForScope`, `rescheduleForScope`.\n * Missing (`undefined`) `tenantId` throws `MissingTenantIdError`; explicit\n * `null` opts into cross-tenant background work and passes through.\n *\n * The JobWorker claim loop is **cross-tenant by design** — the worker has no\n * tenant context; `tenantId` is populated at write time and enforced on\n * targeted reads. See docs/specs/JOB-8.md.\n */\nexport const JOBS_MULTI_TENANT = Symbol('JOBS_MULTI_TENANT');\n","/**\n * Handler base class, JobContext, @JobHandler decorator, and policy types\n * for the job orchestration domain (ADR-022, JOB-2).\n *\n * User-authored jobs subclass `JobHandlerBase<TInput, TOutput>` and decorate\n * the class with `@JobHandler<TInput>('job_type', meta)`. The decorator\n *   1. stores metadata via `Reflect.defineMetadata` so Nest's reflector can\n *      pick it up at module boot, and\n *   2. populates `JOB_HANDLER_REGISTRY` — a module-singleton map consumed by\n *      `JobWorkerModule` (JOB-5) to materialise `job` rows and resolve\n *      handler classes during claim/execute.\n *\n * No runtime orchestration lives here; this file is a pure type + decorator\n * surface so downstream PRs (JOB-3..JOB-5) can implement against a stable\n * shape.\n */\n// TODO(logging-subsystem): swap to ILogger once ADR-028 lands\nimport type { Logger } from '@nestjs/common';\nimport type { EventOfType, EventTypeName } from '../events/generated/types';\nimport type { JobRun } from './job-orchestrator.protocol';\n\n// ─── ParentClosePolicy ──────────────────────────────────────────────────────\n\n/**\n * What happens to running child runs when a parent enters a terminal state.\n * Stored on the child at spawn; changes to the parent after spawn do NOT\n * retroactively rewrite children.\n */\nexport enum ParentClosePolicy {\n  Terminate = 'terminate',\n  Cancel = 'cancel',\n  Abandon = 'abandon',\n}\n\n// ─── Policy types ───────────────────────────────────────────────────────────\n\nexport interface RetryPolicy {\n  attempts: number;\n  backoff: 'fixed' | 'exponential';\n  baseMs: number;\n  nonRetryableErrors?: string[];\n}\n\nexport interface ConcurrencyPolicy<TInput> {\n  key: (input: TInput) => string;\n  collisionMode: 'queue' | 'reject' | 'replace';\n}\n\nexport interface DedupePolicy<TInput> {\n  key: (input: TInput) => string;\n  windowMs: number;\n}\n\n/**\n * Declarative scope reference. `TScope` is parameterised so JOB-7 can narrow\n * `entity` to the generated `ScopeEntityType` union at the call site without\n * modifying this file (OQ-1 resolution, 2026-04-20).\n */\nexport interface ScopeRef<TInput, TScope extends string = string> {\n  entity: TScope;\n  from: (input: TInput) => string;\n}\n\n/**\n * Bridge trigger authoring shape (BRIDGE-6 follow-up — BRIDGE-6 shipped the\n * generator + runtime for `@JobHandler({ triggers })` but never added the\n * authoring field to this type; the generator's tests scan source as strings,\n * so a real decorator was never compiled and the gap went uncaught).\n *\n * Declared on `@JobHandler({ triggers })`; the codegen bridge-registry\n * generator (`src/cli/shared/bridge-registry-generator.ts`) scans these from\n * source and emits `bridge/generated/registry.ts`, validating each `event`\n * against the generated `eventRegistry` at `gen-all`. The distributed union\n * narrows `map`/`when` per `event`, so callbacks are typed against the event\n * payload (ADR-023, \"typed against PayloadOfType<T>\").\n *\n * Typed against events' generated types — the same `import type` coupling the\n * bridge already has (erased at runtime). `jobs` must NOT import `bridge`, so\n * the post-gen `BridgeTriggerEntry` is deliberately not referenced here;\n * `triggerId`/`jobType` are computed by the generator, not authored.\n */\nexport type JobTrigger<TInput> = {\n  [T in EventTypeName]: {\n    /** Event type that fires this trigger. Validated against `eventRegistry`. */\n    event: T;\n    /** Maps the event to the job input. Inlined verbatim into the registry. */\n    map: (event: EventOfType<T>) => TInput;\n    /** Optional guard; `false` → wrapper records `status='skipped'`. */\n    when?: (event: EventOfType<T>) => boolean;\n  };\n}[EventTypeName];\n\nexport interface JobHandlerMeta<TInput> {\n  pool?: string;\n  scope?: ScopeRef<TInput>;\n  retry?: RetryPolicy;\n  concurrency?: ConcurrencyPolicy<TInput>;\n  dedupe?: DedupePolicy<TInput>;\n  timeoutMs?: number;\n  replayFrom?: 'scratch' | 'last_step' | 'last_checkpoint';\n  /**\n   * Bridge triggers (ADR-023 Tier 3). Codegen scans these into `bridgeRegistry`;\n   * the framework `BridgeDeliveryHandler` starts this job per matched event.\n   * Absent for jobs started directly or via `IEventFlow.publishAndStart`.\n   */\n  triggers?: readonly JobTrigger<TInput>[];\n}\n\n// ─── Runtime option shapes ──────────────────────────────────────────────────\n\nexport interface StepOptions {\n  retry?: RetryPolicy;\n  timeoutMs?: number;\n}\n\nexport interface SpawnChildOptions {\n  closePolicy?: ParentClosePolicy;\n  runAt?: Date;\n  priority?: number;\n  tags?: Record<string, string>;\n}\n\n// ─── JobContext ─────────────────────────────────────────────────────────────\n\nexport interface JobContext<TInput> {\n  readonly input: TInput;\n  readonly run: JobRun;\n  step<TOutput>(\n    stepId: string,\n    fn: () => Promise<TOutput>,\n    opts?: StepOptions,\n  ): Promise<TOutput>;\n  spawnChild(type: string, input: unknown, opts?: SpawnChildOptions): Promise<JobRun>;\n  readonly logger: Logger;\n  // NOT in Phase 1 — deferred to ADR-025:\n  //   waitFor(kind, token, opts)\n  //   signal(token, payload)\n  //   sleep(ms)\n}\n\n// ─── JobHandlerBase ─────────────────────────────────────────────────────────\n\nexport abstract class JobHandlerBase<TInput, TOutput = unknown> {\n  abstract run(ctx: JobContext<TInput>): Promise<TOutput>;\n}\n\n// ─── Registry + decorator ───────────────────────────────────────────────────\n\n/**\n * Module-singleton map keyed by job type. Populated by the `@JobHandler`\n * decorator at class definition time; consumed by `JobWorkerModule` (JOB-5)\n * to upsert `job` rows and resolve handler classes during claim/execute.\n */\nexport const JOB_HANDLER_REGISTRY = new Map<\n  string,\n  {\n    type: string;\n    meta: JobHandlerMeta<unknown>;\n    handlerClass: new (...args: unknown[]) => JobHandlerBase<unknown>;\n  }\n>();\n\nexport const JOB_HANDLER_METADATA_KEY = Symbol('JobHandlerMeta');\n\n/**\n * Class decorator that registers a handler with the job type, the full\n * metadata shape, and the target class constructor.\n *\n * Duplicate-type behaviour (OQ-3, resolved 2026-04-18):\n *   - `NODE_ENV === 'production'` → throw; silent overwrite in prod is a\n *     correctness bug.\n *   - `NODE_ENV === 'test'`       → silent overwrite (tests intentionally\n *     re-register handlers).\n *   - otherwise (dev)             → `console.warn` + overwrite. `console`\n *     is used intentionally instead of the Nest `Logger` — decorators run\n *     at module-load time before any Nest container exists.\n */\nexport function JobHandler<TInput>(\n  type: string,\n  meta: JobHandlerMeta<TInput>,\n): ClassDecorator {\n  return (target) => {\n    if (JOB_HANDLER_REGISTRY.has(type)) {\n      const env = process.env.NODE_ENV;\n      if (env === 'production') {\n        throw new Error(\n          `[JobHandler] Duplicate registration for job type '${type}'. ` +\n            `Each @JobHandler must declare a unique type.`,\n        );\n      }\n      if (env !== 'test') {\n        // eslint-disable-next-line no-console\n        console.warn(\n          `[JobHandler] Duplicate registration for job type '${type}'. ` +\n            `Overwriting previous handler — this is almost certainly a bug.`,\n        );\n      }\n    }\n\n    Reflect.defineMetadata(JOB_HANDLER_METADATA_KEY, { type, meta }, target);\n    JOB_HANDLER_REGISTRY.set(type, {\n      type,\n      meta: meta as JobHandlerMeta<unknown>,\n      handlerClass: target as unknown as new (\n        ...args: unknown[]\n      ) => JobHandlerBase<unknown>,\n    });\n  };\n}\n\n// ─── HandlerRegistry — read helpers consumed by JobWorkerModule (JOB-5) ─────\n\n/**\n * Single entry shape returned by `HandlerRegistry.getAll()` / `.get()` and\n * exposed to `JobWorkerModule.onModuleInit` for boot-time upserts.\n *\n * Structurally compatible with `IJobOrchestrator.upsertJobRows`'s\n * `JobUpsertEntry` so the worker module can pass entries through verbatim\n * without re-mapping.\n */\nexport interface HandlerRegistryEntry {\n  type: string;\n  meta: JobHandlerMeta<unknown>;\n  handlerClass: new (...args: unknown[]) => JobHandlerBase<unknown>;\n}\n\n/**\n * Read facade over `JOB_HANDLER_REGISTRY`. The decorator's write path is\n * unchanged; this namespace exists so consumers (the worker module, tests)\n * don't import the raw `Map` and accidentally mutate it.\n */\nexport namespace HandlerRegistry {\n  /** All registered entries in insertion order. */\n  export function getAll(): HandlerRegistryEntry[] {\n    return Array.from(JOB_HANDLER_REGISTRY.values());\n  }\n\n  /** Lookup by job type, or `undefined` if no `@JobHandler` is registered. */\n  export function get(type: string): HandlerRegistryEntry | undefined {\n    return JOB_HANDLER_REGISTRY.get(type);\n  }\n}\n","/**\n * Injection token for the event bus.\n *\n * String constant (not Symbol) so it matches by value across import boundaries.\n * Matches the token in runtime/constants/tokens.ts — both are 'EVENT_BUS'.\n *\n * Usage in use cases:\n * ```typescript\n * constructor(@Inject(EVENT_BUS) private readonly eventBus: IEventBus) {}\n * ```\n */\nexport const EVENT_BUS = 'EVENT_BUS' as const;\n\n/**\n * Injection token for the read-side `IEventReadPort` over `domain_events`\n * (OBS-LIST-1).\n *\n * Bound by `EventsModule.forRoot` to the same backend instance as\n * `EVENT_BUS` for the `drizzle` and `memory` backends (both implement\n * `IEventReadPort`). The `redis` backend retains no history and therefore\n * does NOT provide this token — consumers composing it (e.g. the\n * observability combiner) inject it `@Optional()` and degrade to empty\n * results.\n *\n * String constant (not Symbol) so it matches by value across import\n * boundaries — same convention as `EVENT_BUS`.\n */\nexport const EVENT_READ_PORT = 'EVENT_READ_PORT' as const;\n\n/**\n * Injection token for the generated `TypedEventBus` facade.\n *\n * `TypedEventBus` lives in `runtime/subsystems/events/generated/bus.ts` and\n * wraps `IEventBus` with project-specific `AppDomainEvent`-typed `publish<T>()`\n * and `subscribe<T>()`. Use cases inject this token in preference to\n * `EVENT_BUS` when they want compile-time type safety on event shapes.\n *\n * String constant (not Symbol) so it matches by value across import\n * boundaries — same convention as `EVENT_BUS`.\n *\n * Provider registration lands in EVT-6 (EventsModule wiring); the token is\n * declared here so generated code can import it without depending on the\n * still-being-formalised module.\n */\nexport const TYPED_EVENT_BUS = 'TYPED_EVENT_BUS' as const;\n\n/**\n * Injection token for the resolved multi-tenancy flag.\n *\n * Provided by `EventsModule.forRoot(...)` as `options.multiTenant ?? false`.\n * Consumed by `TypedEventBus` to enforce the tenantId-is-required rule at\n * publish time.\n *\n * String constant (not Symbol) so it matches by value across import\n * boundaries — same convention as the other events tokens. (The jobs\n * subsystem uses Symbols for the analogous token; events chose strings\n * from the start and we keep the file internally consistent.)\n */\nexport const EVENTS_MULTI_TENANT = 'EVENTS_MULTI_TENANT' as const;\n\n/**\n * Injection token for the Redis connection URL used by RedisEventBus.\n * Provided automatically by EventsModule.forRoot({ backend: 'redis' }).\n */\nexport const REDIS_URL = Symbol('REDIS_URL');\n\n/**\n * Injection token for the resolved `EventsModuleOptions` object.\n *\n * Provided automatically by `EventsModule.forRoot(...)` /\n * `EventsModule.forRootAsync(...)`. Backends that need to observe module\n * configuration (e.g. `DrizzleEventBus` reading `opts.pools` for\n * pool-filtered drain) inject via this token.\n *\n * String-valued (not `Symbol`) so it matches by value across import\n * boundaries — same convention as `EVENT_BUS`.\n */\nexport const EVENTS_MODULE_OPTIONS = 'EVENTS_MODULE_OPTIONS' as const;\n","/**\n * Typed errors for the bridge subsystem (ADR-023 Phase 2, BRIDGE-2).\n *\n * All thrown by the three enforcement sites named in ADR-023 §Multi-tenancy:\n *   - `EventFlowService.publishAndStart` entry (BRIDGE-7)\n *   - `BridgeDeliveryHandler.handle` entry (BRIDGE-5)\n *   - `DrizzleBridgeDeliveryRepo.insertDelivery` pre-write (BRIDGE-4)\n *\n * Same shape as `runtime/subsystems/jobs/jobs-errors.ts` and\n * `runtime/subsystems/events/events-errors.ts` so consumers can catch them\n * with the same exception-filter pattern across all three subsystems.\n */\n\n/**\n * Thrown when `BridgeModule` was configured with `multiTenant: true` but\n * the caller did not pass a `tenantId` at one of the three enforcement\n * sites listed above.\n *\n * **Strict enforcement rationale (mirrors JOB-8 / SYNC-6 stance, locked\n * 2026-04-18 for jobs; same rationale applies here).** Cross-tenant data\n * leakage is the worst class of bug a multi-tenant system can ship;\n * surfacing the misuse loudly at the call site (rather than silently\n * defaulting to `null` or to \"the last tenant seen\") prevents both\n * accidental global writes and sneaky reads that return a union of tenants.\n *\n * - `undefined` `tenantId` → throw this error.\n * - Explicit `null` `tenantId` → passes; opts the call into cross-tenant\n *   work (e.g. a system housekeeping event with no owning tenant). The\n *   `bridge_delivery` row is persisted with `tenant_id = NULL`.\n *\n * The `callSite` constructor argument names which of the three enforcement\n * sites threw — review reports and ops dashboards rely on a stable site\n * name, so use the canonical strings: `'EventFlowService.publishAndStart'`,\n * `'BridgeDeliveryHandler.handle'`,\n * `'DrizzleBridgeDeliveryRepo.insertDelivery'`.\n */\nexport class MissingTenantIdError extends Error {\n  override readonly name = 'MissingTenantIdError';\n  constructor(public readonly callSite: string) {\n    super(\n      `MissingTenantIdError: BridgeModule was configured with ` +\n        `multiTenant=true but ${callSite} was called without tenantId ` +\n        `(undefined). Pass an explicit tenantId, or pass null for ` +\n        `cross-tenant work.`,\n    );\n  }\n}\n\n/**\n * Synthetic error thrown by `MemoryBridgeDeliveryRepo.insertDelivery` when\n * a duplicate `(event_id, trigger_id)` insert hits the simulated UNIQUE\n * constraint (BRIDGE-3).\n *\n * Carries a `constraint` field equal to the Drizzle constraint name\n * declared in BRIDGE-1's schema (`uq_bridge_delivery_event_trigger`) so\n * call sites can branch on the same discriminator regardless of which\n * backend is wired up. This matters because ADR-023 explicitly leans on\n * the constraint as the dedup mechanism in two places — outbox replay\n * and `publishAndStart` Case B — and BRIDGE-4 / BRIDGE-7 will share a\n * type-check path with BRIDGE-3-driven tests.\n *\n * The Drizzle backend (BRIDGE-4) does NOT throw this error: it uses\n * `INSERT … ON CONFLICT (event_id, trigger_id) DO NOTHING RETURNING id`\n * per the BRIDGE-4 spec recommendation, so collisions surface as an empty\n * result set rather than an exception. The error exists so the memory\n * backend can faithfully model the \"duplicate raises\" behaviour for tests\n * that want to assert the constraint actually fires.\n */\n/**\n * Thrown by `BridgeModule.onModuleInit` when `JobWorkerModule` is wired\n * alongside the bridge but its active `pools` list does not include one\n * or more of the three reserved bridge pools (`events_inbound`,\n * `events_change`, `events_outbound`).\n *\n * Without a worker polling those pools, the wrapper `job_run` rows the\n * outbox drain inserts (BRIDGE-4) sit `pending` forever — a silent\n * footgun where `eventFlow.publish(...)` returns success but no user\n * job ever spawns. The boot-time check converts that into a fail-fast.\n *\n * Operators can either (a) add `...BRIDGE_RESERVED_POOLS` to their\n * `JobWorkerModule.forRoot({ pools })` configuration so the same\n * process polls the reserved pools, or (b) run a separate worker\n * process per reserved pool for lane isolation (ADR-022 §Pool\n * isolation).\n */\nexport class BridgeReservedPoolsNotPolledError extends Error {\n  override readonly name = 'BridgeReservedPoolsNotPolledError';\n  constructor(public readonly missingPools: readonly string[]) {\n    super(\n      `BridgeModule loaded but JobWorkerModule is not polling reserved ` +\n        `pool '${missingPools[0]}'. Add ...BRIDGE_RESERVED_POOLS to your ` +\n        `JobWorkerModule.forRoot({ pools }) configuration. Missing pools: ` +\n        `${missingPools.join(', ')}. (Bridge-fanout wrappers will sit ` +\n        `pending forever without these pollers.)`,\n    );\n  }\n}\n\nexport class UniqueConstraintError extends Error {\n  override readonly name = 'UniqueConstraintError';\n  constructor(\n    public readonly constraint: string,\n    public readonly eventId: string,\n    public readonly triggerId: string,\n  ) {\n    super(\n      `UniqueConstraintError: duplicate insert into bridge_delivery for ` +\n        `(event_id='${eventId}', trigger_id='${triggerId}') — violates ` +\n        `constraint '${constraint}'.`,\n    );\n  }\n}\n","/**\n * `assertTenantId` — shared multi-tenancy enforcement helper for the\n * bridge subsystem (BRIDGE-8, ADR-023 §Multi-tenancy null-tenantId).\n *\n * Single source of truth for the three enforcement sites named in\n * ADR-023 §Multi-tenancy and the BRIDGE-2 spec:\n *\n *   (a) `EventFlowService.publishAndStart`           — request-path entry\n *   (b) `BridgeDeliveryHandler.run`                  — wrapper handler entry\n *   (c) `DrizzleBridgeDeliveryRepo.insertDelivery`   — last-line repo defense\n *\n * Contract (mirrors JOB-8 / SYNC-6 — locked 2026-04-18 for jobs and\n * carried into the bridge here):\n *\n *   - `multiTenant === false`           → no-op (always passes).\n *   - `multiTenant === true`,\n *      `tenantId === undefined`         → throw `MissingTenantIdError(site)`.\n *   - `multiTenant === true`,\n *      `tenantId === null`              → passes; opts the call into\n *                                          cross-tenant work (system\n *                                          housekeeping, framework events\n *                                          with no owning tenant). Persists\n *                                          to the DB as `tenant_id = NULL`.\n *   - `multiTenant === true`,\n *      `tenantId` is a string           → passes.\n *\n * The strict `undefined`-vs-`null` discrimination is the entire point —\n * silent defaulting is exactly the failure mode that lets cross-tenant\n * leaks ship.\n */\nimport { MissingTenantIdError } from './bridge-errors';\n\n/**\n * Throws `MissingTenantIdError(site)` if `multiTenant === true` and\n * `tenantId === undefined`. Explicit `null` always passes.\n *\n * @param site         Canonical site name — one of:\n *                     `'EventFlowService.publishAndStart'`,\n *                     `'BridgeDeliveryHandler.run'`,\n *                     `'DrizzleBridgeDeliveryRepo.insertDelivery'`.\n *                     Stable strings; ops dashboards / review reports key\n *                     on these. Use the same string the existing tests\n *                     and `MissingTenantIdError` JSDoc enumerate.\n * @param multiTenant  Resolved `BRIDGE_MULTI_TENANT` flag (from\n *                     `BridgeModule.forRoot({ multiTenant })`).\n * @param tenantId     The tenantId the caller supplied (or didn't).\n */\nexport function assertTenantId(\n  site: string,\n  multiTenant: boolean,\n  tenantId: string | null | undefined,\n): void {\n  if (multiTenant && tenantId === undefined) {\n    throw new MissingTenantIdError(site);\n  }\n  // explicit null passes — opts into cross-tenant work\n}\n"],"mappings":";;;;;;;;;;;;;AAgCA,SAAS,UAAAA,SAAQ,cAAAC,aAAY,UAAAC,SAAQ,YAAAC,iBAAgB;AACrD,SAAS,kBAAkB;;;ACW3B;AAAA,EACE,SAAAC;AAAA,EACA,SAAAC;AAAA,EACA,UAAAC;AAAA,EACA,WAAAC;AAAA,EACA,QAAAC;AAAA,EACA,aAAAC;AAAA,EACA;AAAA,EACA,QAAAC;AAAA,OACK;AACP,SAAS,OAAAC,YAAW;;;AChBpB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,WAAW;AAGb,IAAM,eAAe;AAAA,EAC1B;AAAA,EACA;AAAA,IACE,IAAI,KAAK,IAAI,EAAE,WAAW;AAAA,IAC1B,MAAM,KAAK,MAAM,EAAE,QAAQ;AAAA,IAC3B,aAAa,KAAK,cAAc,EAAE,QAAQ;AAAA,IAC1C,eAAe,KAAK,gBAAgB,EAAE,QAAQ;AAAA,IAC9C,SAAS,MAAM,SAAS,EAAE,QAAQ,EAAE,MAA+B;AAAA,IACnE,YAAY,UAAU,eAAe,EAAE,cAAc,KAAK,CAAC,EAAE,QAAQ;AAAA,IACrE,aAAa,UAAU,gBAAgB,EAAE,cAAc,KAAK,CAAC;AAAA;AAAA,IAE7D,QAAQ,KAAK,QAAQ,EAAE,QAAQ,EAAE,QAAQ,SAAS;AAAA;AAAA,IAElD,OAAO,KAAK,OAAO;AAAA,IACnB,UAAU,MAAM,UAAU,EAAE,MAA+B;AAAA;AAAA,IAE3D,MAAM,KAAK,MAAM;AAAA;AAAA,IAEjB,WAAW,KAAK,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAO3B,MAAM,KAAK,MAAM,EAAE,QAAQ,EAAE,QAAQ,QAAQ;AAAA;AAAA,IAE7C,UAAU,KAAK,WAAW;AAAA,EAC5B;AAAA,EACA,CAAC,OAAO;AAAA;AAAA,IAEN,iCAAiC,MAAM,sCAAsC,EAAE;AAAA,MAC7E,EAAE;AAAA,MACF,EAAE;AAAA,IACJ;AAAA;AAAA,IAEA,0BAA0B,MAAM,6BAA6B,EAAE;AAAA,MAC7D,EAAE;AAAA,MACF,EAAE;AAAA,IACJ;AAAA;AAAA,IAEA,qCAAqC;AAAA,MACnC;AAAA,IACF,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU;AAAA;AAAA,IAEnC,qCAAqC;AAAA,MACnC;AAAA,IACF,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IASnC,kBAAkB;AAAA,MAChB;AAAA,MACA,MAAM,EAAE,IAAI,gCAAgC,EAAE,IAAI,kBAAkB,EAAE,IAAI,gBAAgB,EAAE,SAAS;AAAA,IACvG;AAAA,EACF;AACF;;;ACnGA;AAAA,EACE;AAAA,EACA,WAAAC;AAAA,EACA,QAAAC;AAAA,EACA,QAAAC;AAAA,EACA,SAAAC;AAAA,EACA;AAAA,EACA,aAAAC;AAAA,EACA,SAAAC;AAAA,EACA;AAAA,OACK;AACP,SAAS,OAAAC,YAAW;AAuBb,IAAM,mBAAmB,OAAO,kBAAkB;AAAA,EACvD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,kBAAkB,OAAO,iBAAiB,CAAC,MAAM,CAAC;AAExD,IAAM,oBAAoB,OAAO,mBAAmB;AAAA,EACzD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAEM,IAAM,oBAAoB,OAAO,sBAAsB;AAAA,EAC5D;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAEM,IAAM,iBAAiB,OAAO,mBAAmB;AAAA,EACtD;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAEM,IAAM,wBAAwB,OAAO,2BAA2B;AAAA,EACrE;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,eAAe,OAAO,iBAAiB,CAAC,QAAQ,CAAC;AAGvD,IAAM,oBAAoB,OAAO,sBAAsB;AAAA,EAC5D;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAIM,IAAM,OAAON,SAAQ,OAAO;AAAA,EACjC,MAAME,MAAK,MAAM,EAAE,WAAW;AAAA,EAC9B,SAAS,QAAQ,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC;AAAA,EAC/C,MAAMA,MAAK,MAAM,EAAE,QAAQ;AAAA,EAC3B,iBAAiBA,MAAK,mBAAmB;AAAA,EACzC,aAAaC,OAAM,cAAc,EAAE,QAAQ,EAAE,MAAmB;AAAA,EAChE,WAAW,QAAQ,YAAY;AAAA,EAC/B,wBAAwBD,MAAK,0BAA0B;AAAA,EACvD,eAAe,kBAAkB,gBAAgB,EAAE,QAAQ,EAAE,QAAQ,OAAO;AAAA,EAC5E,mBAAmBA,MAAK,qBAAqB;AAAA,EAC7C,gBAAgB,QAAQ,kBAAkB;AAAA,EAC1C,iBAAiB,QAAQ,kBAAkB,EAAE,QAAQ,EAAE,QAAQ,CAAC;AAAA,EAChE,YAAY,eAAe,aAAa,EAAE,QAAQ,EAAE,QAAQ,iBAAiB;AAAA,EAC7E,WAAWE,WAAU,cAAc,EAAE,cAAc,KAAK,CAAC,EAAE,QAAQ,EAAE,WAAW;AAAA,EAChF,WAAWA,WAAU,cAAc,EAAE,cAAc,KAAK,CAAC,EAAE,QAAQ,EAAE,WAAW;AAClF,CAAC;AAMM,IAAM,UAAUJ;AAAA,EACrB;AAAA,EACA;AAAA,IACE,IAAIC,MAAK,IAAI,EAAE,WAAW,EAAE,cAAc;AAAA,IAC1C,SAASC,MAAK,UAAU,EAAE,QAAQ,EAAE,WAAW,MAAM,KAAK,IAAI;AAAA,IAC9D,YAAY,QAAQ,aAAa,EAAE,QAAQ;AAAA,IAC3C,aAAaD,MAAK,eAAe,EAAE,WAAW,MAAW,QAAQ,EAAE;AAAA;AAAA;AAAA;AAAA;AAAA,IAKnE,WAAWA,MAAK,aAAa,EAAE,QAAQ;AAAA,IACvC,mBAAmB,sBAAsB,qBAAqB,EAC3D,QAAQ,EACR,QAAQ,WAAW;AAAA,IACtB,iBAAiBC,MAAK,mBAAmB;AAAA,IACzC,eAAeA,MAAK,iBAAiB;AAAA,IACrC,UAAUA,MAAK,WAAW;AAAA,IAC1B,MAAMC,OAAM,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,EAAE,MAA8B;AAAA,IACxE,MAAMD,MAAK,MAAM,EAAE,QAAQ;AAAA,IAC3B,UAAU,QAAQ,UAAU,EAAE,QAAQ,EAAE,QAAQ,CAAC;AAAA,IACjD,gBAAgBA,MAAK,iBAAiB;AAAA,IACtC,WAAWA,MAAK,YAAY;AAAA,IAC5B,QAAQ,iBAAiB,QAAQ,EAAE,QAAQ,EAAE,QAAQ,SAAS;AAAA,IAC9D,OAAOC,OAAM,OAAO,EAAE,QAAQ,EAAE,MAA+B;AAAA,IAC/D,QAAQA,OAAM,QAAQ,EAAE,MAA+B;AAAA,IACvD,OAAOA,OAAM,OAAO,EAAE,MAAmB;AAAA,IACzC,eAAe,kBAAkB,gBAAgB,EAAE,QAAQ;AAAA,IAC3D,YAAYD,MAAK,aAAa;AAAA,IAC9B,OAAOE,WAAU,UAAU,EAAE,cAAc,KAAK,CAAC,EAAE,QAAQ,EAAE,WAAW;AAAA,IACxE,WAAWA,WAAU,cAAc,EAAE,cAAc,KAAK,CAAC;AAAA,IACzD,YAAYA,WAAU,eAAe,EAAE,cAAc,KAAK,CAAC;AAAA,IAC3D,WAAWA,WAAU,cAAc,EAAE,cAAc,KAAK,CAAC;AAAA,IACzD,UAAU,QAAQ,UAAU,EAAE,QAAQ,EAAE,QAAQ,CAAC;AAAA;AAAA,IAEjD,UAAU,aAAa,WAAW;AAAA;AAAA,IAElC,aAAaF,MAAK,cAAc;AAAA;AAAA,IAEhC,cAAcE,WAAU,iBAAiB,EAAE,cAAc,KAAK,CAAC;AAAA,IAC/D,WAAWA,WAAU,cAAc,EAAE,cAAc,KAAK,CAAC,EAAE,QAAQ,EAAE,WAAW;AAAA,IAChF,WAAWA,WAAU,cAAc,EAAE,cAAc,KAAK,CAAC,EAAE,QAAQ,EAAE,WAAW;AAAA,EAClF;AAAA,EACA,CAAC,OAAO;AAAA;AAAA,IAEN,gBAAgBC,OAAM,mBAAmB,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK;AAAA;AAAA,IAEvE,eAAeA,OAAM,kBAAkB,EAAE,GAAG,EAAE,SAAS;AAAA;AAAA,IAEvD,gBAAgBA,OAAM,mBAAmB,EAAE,GAAG,EAAE,iBAAiB,EAAE,aAAa;AAAA;AAAA,IAEhF,iBAAiBA,OAAM,oBAAoB,EACxC,GAAG,EAAE,SAAS,EAAE,SAAS,EACzB,MAAMC,OAAM,EAAE,SAAS,cAAc;AAAA;AAAA,IAExC,sBAAsBD,OAAM,yBAAyB,EAClD,GAAG,EAAE,cAAc,EACnB;AAAA,MACCC,OAAM,EAAE,cAAc,oBAAoB,EAAE,MAAM;AAAA,IACpD;AAAA,EACJ;AACF;AAMO,IAAM,WAAWN;AAAA,EACtB;AAAA,EACA;AAAA,IACE,IAAIC,MAAK,IAAI,EAAE,WAAW,EAAE,cAAc;AAAA,IAC1C,UAAUA,MAAK,YAAY,EAAE,QAAQ,EAAE,WAAW,MAAM,QAAQ,EAAE;AAAA,IAClE,QAAQC,MAAK,SAAS,EAAE,QAAQ;AAAA,IAChC,MAAM,gBAAgB,MAAM,EAAE,QAAQ,EAAE,QAAQ,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMtD,KAAK,QAAQ,KAAK,EAAE,QAAQ;AAAA,IAC5B,QAAQ,kBAAkB,QAAQ,EAAE,QAAQ,EAAE,QAAQ,SAAS;AAAA,IAC/D,OAAOC,OAAM,OAAO,EAAE,MAA+B;AAAA;AAAA,IAErD,QAAQA,OAAM,QAAQ,EAAE,MAA+B;AAAA,IACvD,OAAOA,OAAM,OAAO,EAAE,MAAmB;AAAA,IACzC,UAAU,QAAQ,UAAU,EAAE,QAAQ,EAAE,QAAQ,CAAC;AAAA,IACjD,WAAWC,WAAU,cAAc,EAAE,cAAc,KAAK,CAAC;AAAA,IACzD,YAAYA,WAAU,eAAe,EAAE,cAAc,KAAK,CAAC;AAAA,EAC7D;AAAA,EACA,CAAC,OAAO;AAAA;AAAA,IAEN,mBAAmB,YAAY,uBAAuB,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM;AAAA;AAAA,IAE/E,oBAAoBC,OAAM,uBAAuB,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG;AAAA,EACzE;AACF;;;AFxJO,IAAM,2BAA2BE,QAAO,0BAA0B;AAAA,EACvE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAIM,IAAM,iBAAiBC;AAAA,EAC5B;AAAA,EACA;AAAA,IACE,IAAIC,MAAK,IAAI,EAAE,WAAW,EAAE,cAAc;AAAA;AAAA,IAE1C,SAASA,MAAK,UAAU,EACrB,QAAQ,EACR,WAAW,MAAM,aAAa,EAAE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMnC,WAAWC,MAAK,YAAY,EAAE,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMtC,cAAcD,MAAK,gBAAgB,EAAE,WAAW,MAAM,QAAQ,EAAE;AAAA;AAAA;AAAA;AAAA;AAAA,IAKhE,WAAWA,MAAK,aAAa,EAAE,WAAW,MAAM,QAAQ,EAAE;AAAA,IAC1D,QAAQ,yBAAyB,QAAQ,EAAE,QAAQ,EAAE,QAAQ,SAAS;AAAA;AAAA,IAEtE,YAAYC,MAAK,aAAa;AAAA;AAAA,IAE9B,OAAOC,OAAM,OAAO,EAAE,MAA+B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMrD,UAAUD,MAAK,WAAW;AAAA,IAC1B,aAAaE,WAAU,gBAAgB,EAAE,cAAc,KAAK,CAAC,EAC1D,QAAQ,EACR,WAAW;AAAA,IACd,aAAaA,WAAU,gBAAgB,EAAE,cAAc,KAAK,CAAC;AAAA,EAC/D;AAAA,EACA,CAAC,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA,IAKN,8BAA8B,OAAO,kCAAkC,EAAE;AAAA,MACvE,EAAE;AAAA,MACF,EAAE;AAAA,IACJ;AAAA;AAAA,IAEA,wBAAwBC,OAAM,2BAA2B,EAAE,GAAG,EAAE,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA,IAKvE,yBAAyBA,OAAM,4BAA4B,EACxD,GAAG,EAAE,MAAM,EACX,MAAMC,OAAM,EAAE,MAAM,0BAA0B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMjD,0BAA0BD,OAAM,8BAA8B,EAC3D,GAAG,EAAE,SAAS,EACd,MAAMC,OAAM,EAAE,SAAS,cAAc;AAAA,EAC1C;AACF;;;AG3HO,IAAM,uBAAuB;AAiB7B,IAAM,sBAAsB;AAmB5B,IAAM,kBAAkB;;;ACE/B,SAAS,QAAQ,YAAY,QAAQ,gBAAgB;;;AC3C9C,IAAM,mBAAmB,uBAAO,kBAAkB;;;ACmIlD,IAAe,iBAAf,MAAyD;AAEhE;AASO,IAAM,uBAAuB,oBAAI,IAOtC;AAEK,IAAM,2BAA2B,uBAAO,gBAAgB;AAexD,SAAS,WACd,MACA,MACgB;AAChB,SAAO,CAAC,WAAW;AACjB,QAAI,qBAAqB,IAAI,IAAI,GAAG;AAClC,YAAM,MAAM,QAAQ,IAAI;AACxB,UAAI,QAAQ,cAAc;AACxB,cAAM,IAAI;AAAA,UACR,qDAAqD,IAAI;AAAA,QAE3D;AAAA,MACF;AACA,UAAI,QAAQ,QAAQ;AAElB,gBAAQ;AAAA,UACN,qDAAqD,IAAI;AAAA,QAE3D;AAAA,MACF;AAAA,IACF;AAEA,YAAQ,eAAe,0BAA0B,EAAE,MAAM,KAAK,GAAG,MAAM;AACvE,yBAAqB,IAAI,MAAM;AAAA,MAC7B;AAAA,MACA;AAAA,MACA,cAAc;AAAA,IAGhB,CAAC;AAAA,EACH;AACF;AAuBO,IAAU;AAAA,CAAV,CAAUC,qBAAV;AAEE,WAAS,SAAiC;AAC/C,WAAO,MAAM,KAAK,qBAAqB,OAAO,CAAC;AAAA,EACjD;AAFO,EAAAA,iBAAS;AAKT,WAAS,IAAI,MAAgD;AAClE,WAAO,qBAAqB,IAAI,IAAI;AAAA,EACtC;AAFO,EAAAA,iBAAS;AAAA,GAPD;;;AC5NV,IAAM,YAAY;;;ACyBlB,IAAM,uBAAN,cAAmC,MAAM;AAAA,EAE9C,YAA4B,UAAkB;AAC5C;AAAA,MACE,+EAC0B,QAAQ;AAAA,IAGpC;AAN0B;AAAA,EAO5B;AAAA,EAP4B;AAAA,EADV,OAAO;AAS3B;;;ACCO,SAAS,eACd,MACA,aACA,UACM;AACN,MAAI,eAAe,aAAa,QAAW;AACzC,UAAM,IAAI,qBAAqB,IAAI;AAAA,EACrC;AAEF;;;ALyBO,IAAM,2BAA2B;AAGxC,IAAM,sBAAsB;AAarB,IAAM,wBAAN,cAAoC,eAGzC;AAAA,EAGA,YACiD,MACJ,cACP,QACM,UAGzB,cAAuB,OACxC;AACA,UAAM;AARyC;AACJ;AACP;AACM;AAGzB;AAAA,EAGnB;AAAA,EATiD;AAAA,EACJ;AAAA,EACP;AAAA,EACM;AAAA,EAGzB;AAAA,EATF,cAAc,IAAI,OAAO,sBAAsB,IAAI;AAAA,EAcpE,MAAM,IACJ,KACgE;AAChE,UAAM,EAAE,WAAW,IAAI,IAAI;AAG3B,UAAM,WAAW,MAAM,KAAK,KAAK,iBAAiB,UAAU;AAC5D,QAAI,CAAC,UAAU;AAKb,WAAK,YAAY;AAAA,QACf,wBAAwB,UAAU;AAAA,MAEpC;AACA,aAAO,EAAE,SAAS,MAAM,QAAQ,uBAAuB;AAAA,IACzD;AAOA;AAAA,MACE;AAAA,MACA,KAAK;AAAA,MACL,SAAS;AAAA,IACX;AAGA,UAAM,QAAQ,MAAM,KAAK,OAAO,SAAS,SAAS,OAAO;AACzD,QAAI,CAAC,OAAO;AAIV,WAAK,YAAY;AAAA,QACf,sBAAsB,SAAS,OAAO,2BAChC,UAAU;AAAA,MAClB;AACA,YAAM,KAAK,KAAK,YAAY,SAAS,IAAI,mBAAmB;AAC5D,aAAO,EAAE,SAAS,MAAM,QAAQ,oBAAoB;AAAA,IACtD;AAGA,UAAM,QAAQ,KAAK,kBAAkB,MAAM,MAAM,SAAS,SAAS;AACnE,QAAI,CAAC,OAAO;AACV,YAAM,KAAK,KAAK,YAAY,SAAS,IAAI,sBAAsB;AAC/D,aAAO,EAAE,SAAS,MAAM,QAAQ,uBAAuB;AAAA,IACzD;AAGA,QAAI,MAAM,QAAQ,CAAC,MAAM,KAAK,KAAc,GAAG;AAC7C,YAAM,KAAK,KAAK,YAAY,SAAS,IAAI,iBAAiB;AAC1D,aAAO,EAAE,SAAS,MAAM,QAAQ,kBAAkB;AAAA,IACpD;AAMA,UAAM,QAAQ,MAAM,IAAI,KAAc;AACtC,UAAM,EAAE,MAAM,IAAI,MAAM,IAAI;AAAA,MAC1B;AAAA,MACA,YAAY;AACV,cAAM,MAAM,MAAM,KAAK,aAAa,MAAM,MAAM,SAAS,OAAO;AAAA,UAC9D,aAAa,IAAI,IAAI;AAAA,UACrB,eAAe;AAAA,UACf,YAAY,SAAS;AAAA,UACrB,UAAU,SAAS;AAAA,QACrB,CAAC;AACD,eAAO,EAAE,OAAO,IAAI,GAAG;AAAA,MACzB;AAAA,IACF;AAGA,UAAM,KAAK,KAAK,cAAc,SAAS,IAAI,KAAK;AAChD,WAAO,EAAE,MAAM;AAAA,EACjB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQQ,kBACN,WACA,WACgC;AAChC,UAAM,aACJ,KAAK,SAAS,SAA0B,KAAK;AAC/C,QAAI,CAAC,WAAY,QAAO;AACxB,WAAO,WAAW,KAAK,CAAC,MAAM,EAAE,cAAc,SAAS;AAAA,EAGzD;AACF;AAnHa,wBAAN;AAAA,EANN,WAAW;AAAA,EACX,WAAgC,0BAA0B;AAAA,IACzD,MAAM;AAAA,IACN,OAAO,EAAE,UAAU,GAAG,SAAS,eAAe,QAAQ,IAAI;AAAA,IAC1D,YAAY;AAAA,EACd,CAAC;AAAA,EAQI,0BAAO,oBAAoB;AAAA,EAC3B,0BAAO,gBAAgB;AAAA,EACvB,0BAAO,SAAS;AAAA,EAChB,0BAAO,eAAe;AAAA,EACtB,4BAAS;AAAA,EACT,0BAAO,mBAAmB;AAAA,GAZlB;;;AL/Cb,IAAM,oBAA4C;AAAA,EAChD,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,UAAU;AACZ;AAGO,IAAM,wBAAN,MAA8D;AAAA,EAKnE,YAGmB,WAA2B,CAAC,GAC7C;AADiB;AAAA,EAChB;AAAA,EADgB;AAAA,EAPF,SAAS,IAAIC,QAAO,sBAAsB,IAAI;AAAA,EACvD,sBAAsB;AAAA,EACb,mBAAmB,oBAAI,IAAY;AAAA,EAQpD,MAAM,aACJ,OACA,IACkC;AAMlC,QAAI,MAAM,WAAW,MAAM,MAAM,SAAS;AACxC,WAAK,qBAAqB,KAAK;AAC/B,aAAO;AAAA,QACL,WAAW;AAAA,QACX,YAAY;AAAA,QACZ,cAAc;AAAA,QACd,cAAc;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,WAAW,KAAK,eAAe,MAAM,IAAI;AAC/C,QAAI,SAAS,WAAW,GAAG;AACzB,aAAO;AAAA,QACL,WAAW;AAAA,QACX,YAAY;AAAA,QACZ,cAAc;AAAA,QACd,cAAc;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,YACH,MAAM,WAAW,WAAW,KAA4B;AAC3D,UAAM,WACH,MAAM,WAAW,UAAU,KAAmC;AACjE,UAAM,cAAc,YAAY,kBAAkB,SAAS,IAAI;AAE/D,QAAI,CAAC,aAAa;AAIhB,UAAI,CAAC,KAAK,qBAAqB;AAC7B,aAAK,sBAAsB;AAC3B,aAAK,OAAO;AAAA,UACV,2EACc,MAAM,EAAE,eAAe,MAAM,IAAI,cAChC,OAAO,SAAS,CAAC;AAAA,QAIlC;AAAA,MACF;AACA,aAAO;AAAA,QACL,WAAW;AAAA,QACX,YAAY;AAAA,QACZ,cAAc,SAAS;AAAA,QACvB,cAAc;AAAA,MAChB;AAAA,IACF;AAEA,QAAI,YAAY;AAChB,QAAI,aAAa;AACjB,UAAM,SAAS;AAaf,eAAW,WAAW,UAAU;AAC9B,YAAM,aAAa,WAAW;AAC9B,YAAM,eAAe,WAAW;AAGhC,YAAM,WAAW,MAAO,GAGrB,OAAO,cAAc,EACrB,OAAO;AAAA,QACN,IAAI;AAAA,QACJ,SAAS,MAAM;AAAA,QACf,WAAW,QAAQ;AAAA,QACnB;AAAA,QACA,QAAQ;AAAA,QACR;AAAA,MACF,CAAC,EACA,oBAAoB;AAAA,QACnB,QAAQ,CAAC,eAAe,SAAS,eAAe,SAAS;AAAA,MAC3D,CAAC,EACA,UAAU,EAAE,IAAI,eAAe,GAAG,CAAC;AAEtC,UAAI,SAAS,WAAW,GAAG;AAGzB;AACA;AAAA,MACF;AAKA,YAAO,GACJ,OAAO,OAAO,EACd,OAAO;AAAA,QACN,IAAI;AAAA,QACJ,SAAS;AAAA,QACT,YAAY;AAAA,QACZ,WAAW;AAAA,QACX,MAAM;AAAA,QACN,QAAQ;AAAA,QACR,OAAO,EAAE,WAAW;AAAA,QACpB,eAAe;AAAA,QACf,YAAY,MAAM;AAAA,QAClB;AAAA,MACF,CAAC;AAEH;AAAA,IACF;AAEA,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,cAAc,SAAS;AAAA,MACvB,cAAc;AAAA,IAChB;AAAA,EACF;AAAA,EAEQ,qBAAqB,OAA0B;AACrD,QAAI,KAAK,iBAAiB,IAAI,MAAM,IAAI,EAAG;AAC3C,SAAK,iBAAiB,IAAI,MAAM,IAAI;AACpC,SAAK,OAAO;AAAA,MACV,0CAA0C,MAAM,IAAI,eAAe,MAAM,EAAE;AAAA,IAG7E;AAAA,EACF;AAAA,EAEQ,eACN,WACsB;AACtB,UAAM,aAAa,KAAK,SAAS,SAA0B;AAC3D,WAAQ,cAAc,CAAC;AAAA,EACzB;AACF;AA9Ja,wBAAN;AAAA,EADNC,YAAW;AAAA,EAOP,mBAAAC,UAAS;AAAA,EACT,mBAAAC,QAAO,eAAe;AAAA,GAPd;","names":["Inject","Injectable","Logger","Optional","index","jsonb","pgEnum","pgTable","text","timestamp","uuid","sql","pgTable","uuid","text","jsonb","timestamp","index","sql","pgEnum","pgTable","uuid","text","jsonb","timestamp","index","sql","HandlerRegistry","Logger","Injectable","Optional","Inject"]}
+{"version":3,"sources":["../../../../runtime/subsystems/bridge/bridge-outbox-drain-hook.ts","../../../../runtime/subsystems/bridge/bridge-delivery.schema.ts","../../../../runtime/subsystems/events/domain-events.schema.ts","../../../../runtime/subsystems/jobs/job-orchestration.schema.ts","../../../../runtime/subsystems/bridge/bridge.tokens.ts","../../../../runtime/subsystems/bridge/bridge-delivery-handler.ts","../../../../runtime/subsystems/token-key.ts","../../../../runtime/subsystems/jobs/jobs-domain.tokens.ts","../../../../runtime/subsystems/jobs/job-handler.base.ts","../../../../runtime/subsystems/events/events.tokens.ts","../../../../runtime/subsystems/bridge/bridge-errors.ts","../../../../runtime/subsystems/bridge/assert-tenant-id.ts"],"sourcesContent":["/**\n * BridgeOutboxDrainHook — drains-time bridge fanout writer (BRIDGE-4,\n * ADR-023 Phase 2).\n *\n * Implements `IBridgeOutboxDrainHook`. Called by `DrizzleEventBus`'s\n * modified `processBatch` once per drained event, INSIDE the per-event\n * transaction. For every trigger registered against the event's type in\n * the codegen-emitted `bridgeRegistry`, writes:\n *\n *   1. `bridge_delivery` ledger row — `INSERT … ON CONFLICT (event_id,\n *      trigger_id) DO NOTHING RETURNING id`. Empty result ⇒ Case B\n *      facade-eager pre-write OR drain-replay collision; skip wrapper\n *      insert for that trigger; sibling triggers still fire.\n *   2. `job_run` wrapper row — `type='@framework/bridge_delivery'`,\n *      `pool='events_<direction>'`, `input={ deliveryId }`,\n *      `trigger_source='event'`, `trigger_ref=event.id`. The wrapper is\n *      what the framework `BridgeDeliveryHandler` (BRIDGE-5) eventually\n *      claims via the worker that polls the corresponding reserved pool.\n *\n * Null `event.metadata.direction` is tolerated: the hook logs a one-line\n * warning per event and returns zeros without writing rows. The drain's\n * `processed_at` stamp + subscriber dispatch still fire normally.\n * Direction is null only for events published via the legacy\n * `IEventBus.publish(...)` path (`TypedEventBus.publish` always sets it);\n * such events are out of scope for bridge fanout.\n *\n * The wrapper insert generates its own `id` via Drizzle's `defaultRandom`\n * — we don't `RETURNING id` because nobody needs it at drain time;\n * `BridgeDeliveryHandler` later looks up the wrapper via the\n * `bridge_delivery.wrapper_run_id` link if needed. This keeps the drain\n * one-round-trip-per-trigger.\n */\nimport { Inject, Injectable, Logger, Optional } from '@nestjs/common';\nimport { randomUUID } from 'node:crypto';\n\nimport type { DomainEvent, DrizzleTransaction } from '../events/event-bus.protocol';\nimport { bridgeDelivery } from './bridge-delivery.schema';\nimport { jobRuns } from '../jobs/job-orchestration.schema';\n\nimport { BRIDGE_REGISTRY } from './bridge.tokens';\nimport type {\n  BridgeOutboxDrainResult,\n  BridgeRegistry,\n  BridgeTriggerEntry,\n  IBridgeOutboxDrainHook,\n} from './bridge.protocol';\nimport { BRIDGE_DELIVERY_JOB_TYPE } from './bridge-delivery-handler';\nimport type { EventTypeName } from '../events/generated/types';\n\n/** Reserved pools the wrapper rows route into; ADR-022 / ADR-024. */\nconst POOL_BY_DIRECTION: Record<string, string> = {\n  inbound: 'events_inbound',\n  change: 'events_change',\n  outbound: 'events_outbound',\n};\n\n@Injectable()\nexport class BridgeOutboxDrainHook implements IBridgeOutboxDrainHook {\n  private readonly logger = new Logger(BridgeOutboxDrainHook.name);\n  private warnedNullDirection = false;\n  private readonly warnedAuditTypes = new Set<string>();\n\n  constructor(\n    @Optional()\n    @Inject(BRIDGE_REGISTRY)\n    private readonly registry: BridgeRegistry = {},\n  ) {}\n\n  async processEvent(\n    event: DomainEvent,\n    tx: DrizzleTransaction,\n  ): Promise<BridgeOutboxDrainResult> {\n    // Audit-tier guard (defense-in-depth — AUDIT-4). Audit events are not\n    // bridge-eligible: the codegen-side validator (AUDIT-2) blocks the\n    // registry from listing them as triggers. Reaching this branch means\n    // registry/runtime drift — an out-of-band `bridge_trigger` insert, or\n    // version skew during deploy. Refuse fanout, surface drift via WARN.\n    if (event.metadata?.['tier'] === 'audit') {\n      this.warnAuditBlockedOnce(event);\n      return {\n        delivered: 0,\n        dedupSkips: 0,\n        triggerCount: 0,\n        auditBlocked: 1,\n      };\n    }\n\n    const triggers = this.lookupTriggers(event.type);\n    if (triggers.length === 0) {\n      return {\n        delivered: 0,\n        dedupSkips: 0,\n        triggerCount: 0,\n        auditBlocked: 0,\n      };\n    }\n\n    const direction =\n      (event.metadata?.['direction'] as string | undefined) ?? null;\n    const tenantId =\n      (event.metadata?.['tenantId'] as string | null | undefined) ?? null;\n    const wrapperPool = direction ? POOL_BY_DIRECTION[direction] : undefined;\n\n    if (!wrapperPool) {\n      // Null direction (or an unrecognised one — defensive). Bridge\n      // fanout requires a routed wrapper pool; without one we can't\n      // spawn. Log once per process so misconfiguration surfaces.\n      if (!this.warnedNullDirection) {\n        this.warnedNullDirection = true;\n        this.logger.warn(\n          `Skipping bridge fanout for events with null/unknown direction. ` +\n            `event.id=${event.id} event.type=${event.type} ` +\n            `direction=${String(direction)}. The wrapper pool is derived ` +\n            `from direction (events_<direction>); publishers must use ` +\n            `TypedEventBus.publish() so direction is stamped on the ` +\n            `outbox row.`,\n        );\n      }\n      return {\n        delivered: 0,\n        dedupSkips: 0,\n        triggerCount: triggers.length,\n        auditBlocked: 0,\n      };\n    }\n\n    let delivered = 0;\n    let dedupSkips = 0;\n    const client = tx as unknown as {\n      insert: (table: unknown) => {\n        values: (v: unknown) => {\n          onConflictDoNothing: (opts: unknown) => {\n            returning: (cols: unknown) => Promise<{ id: string }[]>;\n          };\n        } & {\n          // wrapper insert path — no ON CONFLICT\n          // (typed loosely via the same helper return shape)\n        };\n      };\n    };\n\n    for (const trigger of triggers) {\n      const deliveryId = randomUUID();\n      const wrapperRunId = randomUUID();\n\n      // 1. bridge_delivery insert with ON CONFLICT DO NOTHING + RETURNING.\n      const inserted = await (tx as unknown as {\n        insert: typeof client.insert;\n      })\n        .insert(bridgeDelivery)\n        .values({\n          id: deliveryId,\n          eventId: event.id,\n          triggerId: trigger.triggerId,\n          wrapperRunId,\n          status: 'pending',\n          tenantId,\n        })\n        .onConflictDoNothing({\n          target: [bridgeDelivery.eventId, bridgeDelivery.triggerId],\n        })\n        .returning({ id: bridgeDelivery.id });\n\n      if (inserted.length === 0) {\n        // Case B (facade pre-wrote `delivered`) or drain replay — skip\n        // wrapper insert for this trigger. Sibling triggers still fire.\n        dedupSkips++;\n        continue;\n      }\n\n      // 2. Wrapper job_run insert. We carry the deliveryId into the\n      //    wrapper input so BridgeDeliveryHandler.run(ctx) can locate\n      //    the row via repo.findDeliveryById(ctx.input.deliveryId).\n      await (tx as unknown as { insert: typeof client.insert })\n        .insert(jobRuns)\n        .values({\n          id: wrapperRunId,\n          jobType: BRIDGE_DELIVERY_JOB_TYPE,\n          jobVersion: 1,\n          rootRunId: wrapperRunId,\n          pool: wrapperPool,\n          status: 'pending',\n          input: { deliveryId },\n          triggerSource: 'event',\n          triggerRef: event.id,\n          tenantId,\n        });\n\n      delivered++;\n    }\n\n    return {\n      delivered,\n      dedupSkips,\n      triggerCount: triggers.length,\n      auditBlocked: 0,\n    };\n  }\n\n  private warnAuditBlockedOnce(event: DomainEvent): void {\n    if (this.warnedAuditTypes.has(event.type)) return;\n    this.warnedAuditTypes.add(event.type);\n    this.logger.warn(\n      `Bridge guard blocked audit-tier event '${event.type}' (event.id=${event.id}). ` +\n        `Registry says this event is not bridge-eligible; a bridge_trigger row exists ` +\n        `out-of-band. Investigate registry/runtime drift.`,\n    );\n  }\n\n  private lookupTriggers(\n    eventType: string,\n  ): BridgeTriggerEntry[] {\n    const candidates = this.registry[eventType as EventTypeName];\n    return (candidates ?? []) as BridgeTriggerEntry[];\n  }\n}\n","/**\n * Drizzle schema for the `bridge_delivery` ledger (ADR-023 Phase 2, BRIDGE-1).\n *\n * The `bridge_delivery` table is the idempotency ledger for the event-to-job\n * bridge. Every (event, trigger) pair the bridge is asked to spawn produces\n * exactly one row; the `UNIQUE (event_id, trigger_id)` constraint guarantees\n * that:\n *\n *   1. Outbox replays of an event do not double-spawn user job runs — the\n *      drain attempts to insert the duplicate, the constraint trips, and the\n *      drain skips that trigger.\n *   2. The `IEventFlow.publishAndStart` facade can pre-write a\n *      `(status='delivered')` row before the drain runs (Case B from ADR-023\n *      §`publishAndStart` + existing `triggers:` collision); the drain then\n *      hits UNIQUE on that trigger and skips it while still spawning any\n *      other triggers for the same event normally.\n *\n * Status values:\n *   - `pending`   — wrapper run exists; user job not yet started.\n *   - `delivered` — user job started; `user_run_id` populated.\n *   - `skipped`   — intentional no-op (`when:` returned false, or\n *                   facade-eager path pre-empted the bridge spawn).\n *   - `failed`    — wrapper exhausted retry policy; no auto-retry past that\n *                   (mirrors events outbox stance — ops eyes only).\n *\n * `wrapper_run_id` is **nullable**: the facade-eager path (Case B) pre-writes\n * `bridge_delivery` with no wrapper. The bridge-drain path always populates\n * it.\n *\n * `tenant_id` is emitted **unconditionally and nullable** (per JOB-8\n * 2026-04-20 reversal); enforcement is service-layer (BRIDGE-8) gated on the\n * `BRIDGE_MULTI_TENANT` DI token, not a DB constraint.\n *\n * Indexes:\n *   - `bridge_delivery_event_idx` — lookup all deliveries for an event.\n *   - `bridge_delivery_status_idx` — partial; ops dashboards filter by\n *     `pending | failed`.\n *   - `bridge_delivery_user_run_idx` — partial; reverse lookup from a\n *     spawned user run back to its delivery row.\n *\n * No service logic, no DI wiring — this is the schema foundation. Backends\n * (memory + drizzle) and the framework handler land in BRIDGE-3 / BRIDGE-4 /\n * BRIDGE-5.\n */\nimport {\n  index,\n  jsonb,\n  pgEnum,\n  pgTable,\n  text,\n  timestamp,\n  unique,\n  uuid,\n} from 'drizzle-orm/pg-core';\nimport { sql } from 'drizzle-orm';\nimport type { InferSelectModel } from 'drizzle-orm';\n\nimport { domainEvents } from '../events/domain-events.schema';\nimport { jobRuns } from '../jobs/job-orchestration.schema';\n\n// ─── Enum ───────────────────────────────────────────────────────────────────\n\nexport const bridgeDeliveryStatusEnum = pgEnum('bridge_delivery_status', [\n  'pending',\n  'delivered',\n  'skipped',\n  'failed',\n]);\n\n// ─── Table ──────────────────────────────────────────────────────────────────\n\nexport const bridgeDelivery = pgTable(\n  'bridge_delivery',\n  {\n    id: uuid('id').primaryKey().defaultRandom(),\n    /** FK to the source event in the outbox. */\n    eventId: uuid('event_id')\n      .notNull()\n      .references(() => domainEvents.id),\n    /**\n     * Stable codegen-emitted identifier for the (job, trigger) pair, of the\n     * form `<job_type>#<triggerIndex>` (BRIDGE-6). Forms the second half of\n     * the UNIQUE idempotency key.\n     */\n    triggerId: text('trigger_id').notNull(),\n    /**\n     * Wrapper `job_run.id` (the framework `@framework/bridge_delivery` run\n     * that drove this delivery). Nullable: the facade-eager path\n     * (`publishAndStart` Case B) pre-writes a delivered row with no wrapper.\n     */\n    wrapperRunId: uuid('wrapper_run_id').references(() => jobRuns.id),\n    /**\n     * Spawned user `job_run.id`. Null until status is `delivered`; remains\n     * null for `skipped` and `failed` deliveries.\n     */\n    userRunId: uuid('user_run_id').references(() => jobRuns.id),\n    status: bridgeDeliveryStatusEnum('status').notNull().default('pending'),\n    /** Populated when status=`skipped` (e.g. `'when_returned_false'`, `'trigger_unregistered'`). */\n    skipReason: text('skip_reason'),\n    /** Populated when status=`failed`. Mirrors `job_run.error` shape. */\n    error: jsonb('error').$type<Record<string, unknown>>(),\n    /**\n     * Emitted unconditionally and nullable (JOB-8 / SYNC-6 precedent).\n     * Enforcement gated on `BRIDGE_MULTI_TENANT` at the service layer\n     * (BRIDGE-8); no DB constraint.\n     */\n    tenantId: text('tenant_id'),\n    attemptedAt: timestamp('attempted_at', { withTimezone: true })\n      .notNull()\n      .defaultNow(),\n    deliveredAt: timestamp('delivered_at', { withTimezone: true }),\n  },\n  (t) => ({\n    /**\n     * Idempotency ledger. Outbox replays and facade-vs-drain collisions both\n     * dedup through this constraint.\n     */\n    uqBridgeDeliveryEventTrigger: unique('uq_bridge_delivery_event_trigger').on(\n      t.eventId,\n      t.triggerId,\n    ),\n    /** Lookup all deliveries for an event (fanout report, debugging). */\n    idxBridgeDeliveryEvent: index('idx_bridge_delivery_event').on(t.eventId),\n    /**\n     * Ops dashboard filter — only the actionable states. Partial index keeps\n     * it small at scale (the bulk of rows will be `delivered`).\n     */\n    idxBridgeDeliveryStatus: index('idx_bridge_delivery_status')\n      .on(t.status)\n      .where(sql`${t.status} IN ('pending','failed')`),\n    /**\n     * Reverse lookup from a spawned user run back to its delivery row.\n     * Partial — most rows in the bridge ledger but only successful\n     * deliveries have a `user_run_id`.\n     */\n    idxBridgeDeliveryUserRun: index('idx_bridge_delivery_user_run')\n      .on(t.userRunId)\n      .where(sql`${t.userRunId} IS NOT NULL`),\n  }),\n);\n\nexport type BridgeDeliveryRecord = InferSelectModel<typeof bridgeDelivery>;\n","/**\n * Drizzle schema for the domain_events outbox table.\n *\n * This table backs the DrizzleEventBus. Events are inserted within the\n * same database transaction as the domain write (outbox pattern). A\n * polling process reads unprocessed rows and dispatches to subscribers.\n *\n * First-class routing columns (EVT-1):\n *   - `pool`       — populated by DrizzleEventBus.publish() (EVT-4); enables\n *                    pool-filtered drain queries without unpacking metadata JSON.\n *                    NULL when `tier='audit'` (audit events are not routed).\n *   - `direction`  — `inbound` | `change` | `outbound`; mirrors the routing\n *                    dimension used by jobs' reserved `events_inbound` /\n *                    `events_change` / `events_outbound` pools.\n *                    NULL when `tier='audit'`.\n *   - `tenant_id`  — conditional: emitted only when `events.multi_tenant: true`\n *                    in `codegen.config.yaml`. The runtime source declares it\n *                    unconditionally; EVT-8's scaffold template handles the\n *                    config-driven include/exclude.\n *\n * Audit-tier column (AUDIT-1):\n *   - `tier`       — `'domain'` | `'audit'`. Defaults to `'domain'`. Audit-tier\n *                    rows are observability-only (subscribers may observe but\n *                    the bridge MUST NOT spawn jobs from them); they have null\n *                    `pool` and `direction` by construction. The CHECK\n *                    constraint `domain_events_tier_routing_check` enforces\n *                    `tier='audit' ⇔ (pool IS NULL AND direction IS NULL)`.\n *\n * The `metadata` JSON column continues to carry these values for protocol\n * stability; the first-class columns are an optimization for drain filtering.\n *\n * Indexes (declared below in the index callback):\n *   - (status, occurred_at)             — polling drain filter\n *   - (aggregate_id, aggregate_type)    — event replay per aggregate\n *   - (pool, status, occurred_at)       — per-pool drain filter (EVT-1)\n *   - (tier, status, occurred_at)       — per-tier filter for the observability\n *                                          viewer's tier toggle (AUDIT-1).\n */\nimport {\n  check,\n  index,\n  jsonb,\n  pgTable,\n  text,\n  timestamp,\n  uuid,\n} from 'drizzle-orm/pg-core';\nimport { sql } from 'drizzle-orm';\nimport type { InferSelectModel } from 'drizzle-orm';\n\nexport const domainEvents = pgTable(\n  'domain_events',\n  {\n    id: uuid('id').primaryKey(),\n    type: text('type').notNull(),\n    aggregateId: text('aggregate_id').notNull(),\n    aggregateType: text('aggregate_type').notNull(),\n    payload: jsonb('payload').notNull().$type<Record<string, unknown>>(),\n    occurredAt: timestamp('occurred_at', { withTimezone: true }).notNull(),\n    processedAt: timestamp('processed_at', { withTimezone: true }),\n    /** Lifecycle status: pending | processed | failed */\n    status: text('status').notNull().default('pending'),\n    /** Error message from the last failed dispatch attempt. */\n    error: text('error'),\n    metadata: jsonb('metadata').$type<Record<string, unknown>>(),\n    /** Routing pool (e.g. `events_inbound`, `events_change`, `events_outbound`). Populated by DrizzleEventBus.publish() in EVT-4. NULL when `tier='audit'`. */\n    pool: text('pool'),\n    /** Routing direction: `inbound` | `change` | `outbound`. Populated by DrizzleEventBus.publish() in EVT-4. NULL when `tier='audit'`. */\n    direction: text('direction'),\n    /**\n     * Event tier: `'domain'` (default) or `'audit'`. Audit-tier rows are\n     * observability-only and have null `pool`/`direction` by construction —\n     * enforced by the `domain_events_tier_routing_check` CHECK constraint\n     * declared below. (AUDIT-1)\n     */\n    tier: text('tier').notNull().default('domain'),\n    // conditional: emitted only when events.multi_tenant: true\n    tenantId: text('tenant_id'),\n  },\n  (t) => ({\n    /** Polling drain filter (existing — promoted from comment to declaration in EVT-1). */\n    idxDomainEventsStatusOccurredAt: index('idx_domain_events_status_occurred_at').on(\n      t.status,\n      t.occurredAt,\n    ),\n    /** Event replay per aggregate (existing — promoted from comment to declaration in EVT-1). */\n    idxDomainEventsAggregate: index('idx_domain_events_aggregate').on(\n      t.aggregateId,\n      t.aggregateType,\n    ),\n    /** Per-pool drain filter (EVT-1). Enables DrizzleEventBus to drain a single pool without scanning all events. */\n    idxDomainEventsPoolStatusOccurredAt: index(\n      'idx_domain_events_pool_status_occurred_at',\n    ).on(t.pool, t.status, t.occurredAt),\n    /** Per-tier filter (AUDIT-1). Backs the observability viewer's tier toggle. */\n    idxDomainEventsTierStatusOccurredAt: index(\n      'idx_domain_events_tier_status_occurred_at',\n    ).on(t.tier, t.status, t.occurredAt),\n    /**\n     * Tier ↔ routing-fields invariant (AUDIT-1):\n     *   - `tier` is one of `'domain' | 'audit'`.\n     *   - `tier='audit'` ⇔ `pool IS NULL AND direction IS NULL`.\n     *   - `tier='domain'` ⇒ `pool` and `direction` are populated (the\n     *     DrizzleEventBus inserts always supply them; the bus stamps them\n     *     in AUDIT-3).\n     */\n    tierRoutingCheck: check(\n      'domain_events_tier_routing_check',\n      sql`${t.tier} in ('domain','audit') AND ((${t.tier} = 'audit') = (${t.pool} is null and ${t.direction} is null))`,\n    ),\n  }),\n);\n\nexport type DomainEventRecord = InferSelectModel<typeof domainEvents>;\n","/**\n * Drizzle schema for the job orchestration domain (ADR-022).\n *\n * Three tables model the lifecycle of a durable job:\n *   - `job`       — definitions keyed by handler type (e.g. 'onboarding').\n *   - `job_run`   — one row per attempt to execute a job; worker claims\n *                   rows directly via SELECT ... FOR UPDATE SKIP LOCKED.\n *   - `job_step`  — individual steps within a run; memoises output for replay.\n *\n * Phase 1 ships only this layer. There is no `job_queue` table, no executor\n * port — see ADR-022 and `.claude/skills/jobs/SKILL.md` for the rationale.\n */\nimport {\n  pgEnum,\n  pgTable,\n  uuid,\n  text,\n  jsonb,\n  integer,\n  timestamp,\n  index,\n  uniqueIndex,\n} from 'drizzle-orm/pg-core';\nimport { sql } from 'drizzle-orm';\nimport type { InferSelectModel } from 'drizzle-orm';\n\n// ─── Internal $type<> helpers ───────────────────────────────────────────────\n// Annotation types for jsonb columns only. JOB-2 defines the public protocol\n// types; these remain private to this file.\n\ntype RetryPolicy = {\n  attempts: number;\n  backoff: 'fixed' | 'exponential';\n  baseMs: number;\n  nonRetryableErrors?: string[];\n};\n\ntype JobRunError = {\n  message: string;\n  stack?: string;\n  retryable: boolean;\n  attempt: number;\n};\n\n// ─── Enums ──────────────────────────────────────────────────────────────────\n\nexport const jobRunStatusEnum = pgEnum('job_run_status', [\n  'pending',\n  'running',\n  'waiting',\n  'completed',\n  'failed',\n  'timed_out',\n  'canceled',\n]);\n\n// extended in ADR-027: tool_call | llm_call | wait | checkpoint | message\nexport const jobStepKindEnum = pgEnum('job_step_kind', ['task']);\n\nexport const jobStepStatusEnum = pgEnum('job_step_status', [\n  'pending',\n  'running',\n  'completed',\n  'failed',\n  'skipped',\n]);\n\nexport const collisionModeEnum = pgEnum('job_collision_mode', [\n  'queue',\n  'reject',\n  'replace',\n]);\n\nexport const replayFromEnum = pgEnum('job_replay_from', [\n  'scratch',\n  'last_step',\n  'last_checkpoint',\n]);\n\nexport const parentClosePolicyEnum = pgEnum('job_parent_close_policy', [\n  'terminate',\n  'cancel',\n  'abandon',\n]);\n\n// Phase 3 placeholder — see ADR-025\nexport const waitKindEnum = pgEnum('job_wait_kind', ['signal']);\n\n// Phase 2 may add more sources; requires Atlas migration\nexport const triggerSourceEnum = pgEnum('job_trigger_source', [\n  'manual',\n  'schedule',\n  'event',\n  'parent',\n]);\n\n// ─── job ────────────────────────────────────────────────────────────────────\n\nexport const jobs = pgTable('job', {\n  type: text('type').primaryKey(),\n  version: integer('version').notNull().default(1),\n  pool: text('pool').notNull(),\n  scopeEntityType: text('scope_entity_type'),\n  retryPolicy: jsonb('retry_policy').notNull().$type<RetryPolicy>(),\n  timeoutMs: integer('timeout_ms'),\n  concurrencyKeyTemplate: text('concurrency_key_template'),\n  collisionMode: collisionModeEnum('collision_mode').notNull().default('queue'),\n  dedupeKeyTemplate: text('dedupe_key_template'),\n  dedupeWindowMs: integer('dedupe_window_ms'),\n  priorityDefault: integer('priority_default').notNull().default(0),\n  replayFrom: replayFromEnum('replay_from').notNull().default('last_checkpoint'),\n  createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),\n  updatedAt: timestamp('updated_at', { withTimezone: true }).notNull().defaultNow(),\n});\n\nexport type JobDefinitionRow = InferSelectModel<typeof jobs>;\n\n// ─── job_run ────────────────────────────────────────────────────────────────\n\nexport const jobRuns = pgTable(\n  'job_run',\n  {\n    id: uuid('id').primaryKey().defaultRandom(),\n    jobType: text('job_type').notNull().references(() => jobs.type),\n    jobVersion: integer('job_version').notNull(),\n    parentRunId: uuid('parent_run_id').references((): any => jobRuns.id),\n    /**\n     * Service generates `id` client-side via randomUUID() and sets\n     * root_run_id = id for root runs (single INSERT, no self-FK race).\n     */\n    rootRunId: uuid('root_run_id').notNull(),\n    parentClosePolicy: parentClosePolicyEnum('parent_close_policy')\n      .notNull()\n      .default('terminate'),\n    scopeEntityType: text('scope_entity_type'),\n    scopeEntityId: text('scope_entity_id'),\n    tenantId: text('tenant_id'),\n    tags: jsonb('tags').notNull().default({}).$type<Record<string, string>>(),\n    pool: text('pool').notNull(),\n    priority: integer('priority').notNull().default(0),\n    concurrencyKey: text('concurrency_key'),\n    dedupeKey: text('dedupe_key'),\n    status: jobRunStatusEnum('status').notNull().default('pending'),\n    input: jsonb('input').notNull().$type<Record<string, unknown>>(),\n    output: jsonb('output').$type<Record<string, unknown>>(),\n    error: jsonb('error').$type<JobRunError>(),\n    triggerSource: triggerSourceEnum('trigger_source').notNull(),\n    triggerRef: text('trigger_ref'),\n    runAt: timestamp('run_at', { withTimezone: true }).notNull().defaultNow(),\n    startedAt: timestamp('started_at', { withTimezone: true }),\n    finishedAt: timestamp('finished_at', { withTimezone: true }),\n    claimedAt: timestamp('claimed_at', { withTimezone: true }),\n    attempts: integer('attempts').notNull().default(0),\n    // Phase 3 placeholder — see ADR-025\n    waitKind: waitKindEnum('wait_kind'),\n    // Phase 3 placeholder — see ADR-025\n    resumeToken: text('resume_token'),\n    // Phase 3 placeholder — see ADR-025\n    waitDeadline: timestamp('wait_deadline', { withTimezone: true }),\n    createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),\n    updatedAt: timestamp('updated_at', { withTimezone: true }).notNull().defaultNow(),\n  },\n  (t) => ({\n    /** Claim query: ORDER BY priority DESC, run_at ASC. */\n    idxJobRunClaim: index('idx_job_run_claim').on(t.status, t.pool, t.runAt),\n    /** Tree traversal / cascade cancel. */\n    idxJobRunRoot: index('idx_job_run_root').on(t.rootRunId),\n    /** listForScope query. */\n    idxJobRunScope: index('idx_job_run_scope').on(t.scopeEntityType, t.scopeEntityId),\n    /** Idempotency collapse — partial index. */\n    idxJobRunDedupe: index('idx_job_run_dedupe')\n      .on(t.jobType, t.dedupeKey)\n      .where(sql`${t.dedupeKey} IS NOT NULL`),\n    /** Collision check — partial index. */\n    idxJobRunConcurrency: index('idx_job_run_concurrency')\n      .on(t.concurrencyKey)\n      .where(\n        sql`${t.concurrencyKey} IS NOT NULL AND ${t.status} IN ('pending','running')`,\n      ),\n  }),\n);\n\nexport type JobRunRow = InferSelectModel<typeof jobRuns>;\n\n// ─── job_step ───────────────────────────────────────────────────────────────\n\nexport const jobSteps = pgTable(\n  'job_step',\n  {\n    id: uuid('id').primaryKey().defaultRandom(),\n    jobRunId: uuid('job_run_id').notNull().references(() => jobRuns.id),\n    stepId: text('step_id').notNull(),\n    kind: jobStepKindEnum('kind').notNull().default('task'),\n    /**\n     * Monotonic within run. integer (max ~2B per run) is sufficient —\n     * downgraded from ADR-022's bigint; revisit only if a single run\n     * ever exceeds 2 billion steps.\n     */\n    seq: integer('seq').notNull(),\n    status: jobStepStatusEnum('status').notNull().default('pending'),\n    input: jsonb('input').$type<Record<string, unknown>>(),\n    /** Memoised on success for replay. */\n    output: jsonb('output').$type<Record<string, unknown>>(),\n    error: jsonb('error').$type<JobRunError>(),\n    attempts: integer('attempts').notNull().default(0),\n    startedAt: timestamp('started_at', { withTimezone: true }),\n    finishedAt: timestamp('finished_at', { withTimezone: true }),\n  },\n  (t) => ({\n    /** No duplicate step IDs per run. */\n    idxJobStepRunStep: uniqueIndex('idx_job_step_run_step').on(t.jobRunId, t.stepId),\n    /** Ordered timeline reads. */\n    idxJobStepTimeline: index('idx_job_step_timeline').on(t.jobRunId, t.seq),\n  }),\n);\n\nexport type JobStepRow = InferSelectModel<typeof jobSteps>;\n","/**\n * Injection tokens for the bridge subsystem (ADR-023 Phase 2, BRIDGE-2).\n *\n * String constants (not Symbols) so they match by value across import\n * boundaries — same convention as `EVENT_BUS` / `EVENTS_MULTI_TENANT` in the\n * events subsystem (per EVT-6 §Implementation Notes). The jobs subsystem\n * uses Symbols for its analogous tokens; we keep the bridge file internally\n * consistent with the events convention because the bridge is conceptually\n * downstream of (and imports from) the events module.\n */\n\n/**\n * Token for the `IJobBridge` repo backend (memory in BRIDGE-3, Drizzle in\n * BRIDGE-4). Consumed by `BridgeDeliveryHandler` (BRIDGE-5), the outbox\n * drain (BRIDGE-4 modification), and `EventFlowService` (BRIDGE-7).\n */\nexport const BRIDGE_DELIVERY_REPO = 'BRIDGE_DELIVERY_REPO' as const;\n\n/**\n * Token for the `IEventFlow` facade implementation (BRIDGE-7). Use cases\n * inject this in preference to `EVENT_BUS` / `TYPED_EVENT_BUS` — calling\n * `eventFlow.publish(...)` / `eventFlow.publishAndStart(...)` is the\n * sanctioned authoring surface (ADR-023 §Decision 7).\n */\nexport const EVENT_FLOW = 'EVENT_FLOW' as const;\n\n/**\n * Token for the resolved multi-tenancy flag, provided by\n * `BridgeModule.forRoot({ multiTenant })` in BRIDGE-8. Consumed by\n * `EventFlowService.publishAndStart` (entry), `BridgeDeliveryHandler.handle`\n * (entry), and `DrizzleBridgeDeliveryRepo.insertDelivery` (pre-write) — the\n * three enforcement sites called out in ADR-023 §Multi-tenancy.\n */\nexport const BRIDGE_MULTI_TENANT = 'BRIDGE_MULTI_TENANT' as const;\n\n/**\n * Token for the resolved `BridgeModuleOptions` object. Provided by\n * `BridgeModule.forRoot(...)` / `forRootAsync(...)` in BRIDGE-8.\n * Mirrors `EVENTS_MODULE_OPTIONS` and `JOBS_DOMAIN_OPTIONS` shape — backends\n * inject this when they need to observe additional module configuration\n * (e.g. pool overrides) without each adding a dedicated token.\n */\nexport const BRIDGE_MODULE_OPTIONS = 'BRIDGE_MODULE_OPTIONS' as const;\n\n/**\n * Token for the codegen-emitted `bridgeRegistry` — the\n * `Record<EventTypeName, BridgeTriggerEntry[]>` map that drives\n * outbox-drain trigger lookup (BRIDGE-4) and `EventFlowService` Case B\n * dedup (BRIDGE-7). Provider registration lands in BRIDGE-8; the token is\n * declared here so generated code (BRIDGE-6) can import it without\n * depending on the still-being-formalised module.\n */\nexport const BRIDGE_REGISTRY = 'BRIDGE_REGISTRY' as const;\n\n\n/**\n * Token for the `IBridgeOutboxDrainHook` implementation (BRIDGE-4).\n * Injected `@Optional()` into `DrizzleEventBus` — when the bridge\n * subsystem is not installed the token is undefined and the events\n * outbox drain skips the bridge block entirely (preserves EVT-4\n * baseline behaviour).\n *\n * Resolution order: `BridgeModule.forRoot()` provides this token in\n * BRIDGE-8 alongside the rest of the bridge subsystem. `EventsModule`\n * itself never provides it; the events subsystem stays unaware of the\n * bridge unless the consumer wires it.\n */\nexport const BRIDGE_OUTBOX_DRAIN_HOOK = 'BRIDGE_OUTBOX_DRAIN_HOOK' as const;\n","/**\n * BridgeDeliveryHandler — the framework `@JobHandler` that runs every\n * bridge-fanout wrapper on the reserved `events_*` pools (BRIDGE-5,\n * ADR-023 §Decision 2 flow diagram).\n *\n * Role: when the outbox drain (BRIDGE-4) inserts a `bridge_delivery + wrapper\n * job_run` pair, the worker that polls the wrapper's pool claims that\n * wrapper and dispatches it to this handler. The handler:\n *\n *   1. Loads the `bridge_delivery` row by `ctx.input.deliveryId`.\n *   2. Looks up the trigger entry in the codegen-emitted `bridgeRegistry`\n *      (`runtime/subsystems/bridge/generated/registry.ts`, BRIDGE-6).\n *      A missing entry means the trigger was renamed or removed since the\n *      delivery row was written; mark `skipped` with\n *      `skip_reason='trigger_unregistered'` per ADR-023 §Trigger rename\n *      or removal.\n *   3. Re-fetches the authoritative `domain_events` row (`IEventBus.findById`)\n *      so `when:` / `map:` callbacks see the committed payload — never a\n *      copy that drifted between drain and claim time.\n *   4. Evaluates `entry.when?.(event)`. False ⇒ mark `skipped` with\n *      `skip_reason='predicate_false'`.\n *   5. Calls `IJobOrchestrator.start(entry.jobType, entry.map(event), …)`\n *      INSIDE `ctx.step('spawn_user_run', …)`. The step memoization is\n *      what makes wrapper retries (BRIDGE-1 ledger says no auto-retry past\n *      the wrapper's own retry policy, but Phase 1 wrappers DO retry per\n *      JOB-3) idempotent — a successful spawn followed by a transient\n *      ledger-update failure would otherwise re-spawn on the next attempt.\n *   6. Marks `delivered` with the spawned `runId`.\n *\n * Pool registration: BRIDGE-5 ships ONE `@JobHandler` registration with\n * `pool: 'events_change'` (the default). The wrapper rows the drain\n * inserts carry `pool: events_<direction>` per row, so workers polling\n * `events_inbound` / `events_outbound` claim and dispatch to this same\n * handler class regardless of the metadata pool — the worker filter is on\n * `job_run.pool`, not on `@JobHandler.meta.pool`. BRIDGE-8 confirms the\n * three pools are active and registered at module init. The\n * `@framework/*` job-type prefix exempts this registration from the\n * reserved-pool validator (BRIDGE-5 added that exemption to\n * `job-worker.module.ts`).\n *\n * Tenant threading: when `BRIDGE_MULTI_TENANT=true`, the handler asserts\n * `delivery.tenantId !== undefined` before the spawn (the column is\n * nullable, so explicit `null` is allowed for cross-tenant work — same\n * contract as JOB-8). BRIDGE-8 wires the assertion via the\n * `BRIDGE_MULTI_TENANT` token.\n *\n * Failure path: any throw inside the handler propagates up; the worker's\n * normal retry policy (declared on the `@JobHandler` here as `attempts:\n * 3, backoff: exponential, baseMs: 250`) absorbs transient infra blips.\n * After exhaustion, the wrapper transitions to `failed`; the outer error\n * handler catches and calls `repo.markFailed(...)` so the delivery row\n * reflects the final state. Operators see `bridge_delivery.status='failed'`\n * surface via the `idx_bridge_delivery_status` partial index (BRIDGE-1).\n */\nimport { Inject, Injectable, Logger, Optional } from '@nestjs/common';\n\nimport { JOB_ORCHESTRATOR } from '../jobs/jobs-domain.tokens';\nimport type { IJobOrchestrator } from '../jobs/job-orchestrator.protocol';\nimport {\n  JobHandler,\n  JobHandlerBase,\n  type JobContext,\n} from '../jobs/job-handler.base';\n\nimport { EVENT_BUS } from '../events/events.tokens';\nimport type { IEventBus, DomainEvent } from '../events/event-bus.protocol';\nimport type { EventTypeName } from '../events/generated/types';\n\nimport {\n  BRIDGE_DELIVERY_REPO,\n  BRIDGE_MULTI_TENANT,\n  BRIDGE_REGISTRY,\n} from './bridge.tokens';\nimport type {\n  BridgeRegistry,\n  BridgeTriggerEntry,\n  IJobBridge,\n} from './bridge.protocol';\nimport { assertTenantId } from './assert-tenant-id';\n\n/** Stable canonical job type — referenced by BRIDGE-4 wrapper inserts. */\nexport const BRIDGE_DELIVERY_JOB_TYPE = '@framework/bridge_delivery' as const;\n\n/** Stable canonical step id — referenced for memoization across attempts. */\nconst SPAWN_USER_RUN_STEP = 'spawn_user_run' as const;\n\nexport interface BridgeDeliveryInput {\n  /** PK of the `bridge_delivery` row this wrapper services. */\n  deliveryId: string;\n}\n\n@Injectable()\n@JobHandler<BridgeDeliveryInput>(BRIDGE_DELIVERY_JOB_TYPE, {\n  pool: 'events_change',\n  retry: { attempts: 3, backoff: 'exponential', baseMs: 250 },\n  replayFrom: 'last_step',\n})\nexport class BridgeDeliveryHandler extends JobHandlerBase<\n  BridgeDeliveryInput,\n  { runId: string } | { skipped: true; reason: string }\n> {\n  private readonly classLogger = new Logger(BridgeDeliveryHandler.name);\n\n  constructor(\n    @Inject(BRIDGE_DELIVERY_REPO) private readonly repo: IJobBridge,\n    @Inject(JOB_ORCHESTRATOR) private readonly orchestrator: IJobOrchestrator,\n    @Inject(EVENT_BUS) private readonly events: IEventBus,\n    @Inject(BRIDGE_REGISTRY) private readonly registry: BridgeRegistry,\n    @Optional()\n    @Inject(BRIDGE_MULTI_TENANT)\n    private readonly multiTenant: boolean = false,\n  ) {\n    super();\n  }\n\n  async run(\n    ctx: JobContext<BridgeDeliveryInput>,\n  ): Promise<{ runId: string } | { skipped: true; reason: string }> {\n    const { deliveryId } = ctx.input;\n\n    // Step 1 — locate the delivery row by primary key.\n    const delivery = await this.repo.findDeliveryById(deliveryId);\n    if (!delivery) {\n      // The drain wrote a wrapper job_run but the delivery row is gone\n      // (manual ops cleanup, or delete-cascade from the parent event).\n      // No row → no work; return without throwing so the wrapper marks\n      // completed cleanly.\n      this.classLogger.warn(\n        `bridge_delivery row '${deliveryId}' not found; wrapper completes ` +\n          `without spawning a user job.`,\n      );\n      return { skipped: true, reason: 'delivery_row_missing' };\n    }\n\n    // Step 2 — multi-tenancy gate. Site (b) of the three ADR-023\n    // §Multi-tenancy enforcement sites; shared helper from BRIDGE-8.\n    // The DB always returns string|null, never undefined; this branch\n    // exists for the in-memory backend's older test fixtures and to\n    // pin the contract in shape-typed tests.\n    assertTenantId(\n      'BridgeDeliveryHandler.run',\n      this.multiTenant,\n      delivery.tenantId,\n    );\n\n    // Step 3 — load the typed event row.\n    const event = await this.events.findById(delivery.eventId);\n    if (!event) {\n      // FK from bridge_delivery.event_id → domain_events.id should make\n      // this impossible at the DB layer, but defensive: if the row is\n      // missing we mark skipped, not failed (no work the bridge can do).\n      this.classLogger.warn(\n        `domain_events row '${delivery.eventId}' missing for delivery ` +\n          `'${deliveryId}'; marking skipped.`,\n      );\n      await this.repo.markSkipped(delivery.id, 'event_row_missing');\n      return { skipped: true, reason: 'event_row_missing' };\n    }\n\n    // Step 4 — registry lookup. Handles trigger rename/removal cleanly.\n    const entry = this.findRegistryEntry(event.type, delivery.triggerId);\n    if (!entry) {\n      await this.repo.markSkipped(delivery.id, 'trigger_unregistered');\n      return { skipped: true, reason: 'trigger_unregistered' };\n    }\n\n    // Step 5 — `when:` predicate.\n    if (entry.when && !entry.when(event as never)) {\n      await this.repo.markSkipped(delivery.id, 'predicate_false');\n      return { skipped: true, reason: 'predicate_false' };\n    }\n\n    // Step 6 — memoized spawn. `ctx.step` records the result in\n    // `job_step` and on retry returns the cached `{ runId }` so a\n    // transient failure between `orchestrator.start` and `markDelivered`\n    // doesn't double-spawn the user job.\n    const input = entry.map(event as never);\n    const { runId } = await ctx.step<{ runId: string }>(\n      SPAWN_USER_RUN_STEP,\n      async () => {\n        const run = await this.orchestrator.start(entry.jobType, input, {\n          parentRunId: ctx.run.id,\n          triggerSource: 'event',\n          triggerRef: delivery.eventId,\n          tenantId: delivery.tenantId,\n        });\n        return { runId: run.id };\n      },\n    );\n\n    // Step 7 — ledger transition.\n    await this.repo.markDelivered(delivery.id, runId);\n    return { runId };\n  }\n\n  /**\n   * Locate the registry entry for `(eventType, triggerId)`. Linear scan\n   * over the per-event-type array — N is the number of triggers declared\n   * for one event, typically 1–5; the table is not big enough to warrant\n   * a secondary index.\n   */\n  private findRegistryEntry(\n    eventType: string,\n    triggerId: string,\n  ): BridgeTriggerEntry | undefined {\n    const candidates =\n      this.registry[eventType as EventTypeName] ?? undefined;\n    if (!candidates) return undefined;\n    return candidates.find((c) => c.triggerId === triggerId) as\n      | BridgeTriggerEntry\n      | undefined;\n  }\n}\n\n/**\n * Re-export for BRIDGE-7 facade Case B and BRIDGE-4 wrapper insert.\n * Single source of truth for the canonical type string keeps refactors\n * in one place.\n */\nexport { BRIDGE_DELIVERY_JOB_TYPE as BridgeDeliveryJobType };\n","/** Canonical package namespace for cross-boundary DI token keys. MUST be a hardcoded\n *  constant (NOT derived from package.json) so a vendored copy — which lives inside the\n *  CONSUMER's package — produces the identical key and the two copies share the symbol. */\nexport const PKG = '@pattern-stack/codegen';\n// TODO(token-version): if/when a runtime contract version is adopted, inject it HERE only\n//   (e.g. `${PKG}#${ABI}.${area}.${name}`) — this helper is the single chokepoint.\nexport const tokenKey = (area: string, name: string): string => `${PKG}.${area}.${name}`;\n","/**\n * Injection tokens for the job orchestration domain layer (ADR-022, JOB-2).\n *\n * Consumer code injects these symbols via `@Inject(JOB_ORCHESTRATOR)` etc.;\n * concrete backends (JOB-3 Drizzle, JOB-4 Memory) provide the implementations\n * through `JobsDomainModule.forRoot({ backend })` in JOB-5.\n *\n * Each token is a namespaced `Symbol.for(...)` (ADR-037, via `tokenKey()`) —\n * distinct per key, so Nest's DI lookup is unambiguous, AND matching by VALUE\n * across import boundaries so the package and a (legacy) vendored runtime copy\n * resolve to the same symbol.\n */\nimport { tokenKey } from '../token-key';\n\nexport const JOB_ORCHESTRATOR = Symbol.for(tokenKey('jobs', 'orchestrator'));\nexport const JOB_RUN_SERVICE = Symbol.for(tokenKey('jobs', 'run-service'));\nexport const JOB_STEP_SERVICE = Symbol.for(tokenKey('jobs', 'step-service'));\n\n/**\n * Multi-tenancy opt-in flag (JOB-8). Bound to the boolean passed in via\n * `JobsDomainModule.forRoot({ multiTenant })`, defaulting to `false`.\n *\n * When `true`, the four service-layer backends (Drizzle + Memory orchestrator\n * and run-service) enforce `tenantId` on every mutating / targeted-read call:\n * `start`, `cancel`, `listForScope`, `cancelForScope`, `rescheduleForScope`.\n * Missing (`undefined`) `tenantId` throws `MissingTenantIdError`; explicit\n * `null` opts into cross-tenant background work and passes through.\n *\n * The JobWorker claim loop is **cross-tenant by design** — the worker has no\n * tenant context; `tenantId` is populated at write time and enforced on\n * targeted reads. See docs/specs/JOB-8.md.\n */\nexport const JOBS_MULTI_TENANT = Symbol.for(tokenKey('jobs', 'multi-tenant'));\n","/**\n * Handler base class, JobContext, @JobHandler decorator, and policy types\n * for the job orchestration domain (ADR-022, JOB-2).\n *\n * User-authored jobs subclass `JobHandlerBase<TInput, TOutput>` and decorate\n * the class with `@JobHandler<TInput>('job_type', meta)`. The decorator\n *   1. stores metadata via `Reflect.defineMetadata` so Nest's reflector can\n *      pick it up at module boot, and\n *   2. populates `JOB_HANDLER_REGISTRY` — a module-singleton map consumed by\n *      `JobWorkerModule` (JOB-5) to materialise `job` rows and resolve\n *      handler classes during claim/execute.\n *\n * No runtime orchestration lives here; this file is a pure type + decorator\n * surface so downstream PRs (JOB-3..JOB-5) can implement against a stable\n * shape.\n */\n// TODO(logging-subsystem): swap to ILogger once ADR-028 lands\nimport type { Logger } from '@nestjs/common';\nimport { tokenKey } from '../token-key';\nimport type { EventOfType, EventTypeName } from '../events/generated/types';\nimport type { JobRun } from './job-orchestrator.protocol';\n\n// ─── ParentClosePolicy ──────────────────────────────────────────────────────\n\n/**\n * What happens to running child runs when a parent enters a terminal state.\n * Stored on the child at spawn; changes to the parent after spawn do NOT\n * retroactively rewrite children.\n */\nexport enum ParentClosePolicy {\n  Terminate = 'terminate',\n  Cancel = 'cancel',\n  Abandon = 'abandon',\n}\n\n// ─── Policy types ───────────────────────────────────────────────────────────\n\nexport interface RetryPolicy {\n  attempts: number;\n  backoff: 'fixed' | 'exponential';\n  baseMs: number;\n  nonRetryableErrors?: string[];\n}\n\nexport interface ConcurrencyPolicy<TInput> {\n  key: (input: TInput) => string;\n  collisionMode: 'queue' | 'reject' | 'replace';\n}\n\nexport interface DedupePolicy<TInput> {\n  key: (input: TInput) => string;\n  windowMs: number;\n}\n\n/**\n * Declarative scope reference. `TScope` is parameterised so JOB-7 can narrow\n * `entity` to the generated `ScopeEntityType` union at the call site without\n * modifying this file (OQ-1 resolution, 2026-04-20).\n */\nexport interface ScopeRef<TInput, TScope extends string = string> {\n  entity: TScope;\n  from: (input: TInput) => string;\n}\n\n/**\n * Bridge trigger authoring shape (BRIDGE-6 follow-up — BRIDGE-6 shipped the\n * generator + runtime for `@JobHandler({ triggers })` but never added the\n * authoring field to this type; the generator's tests scan source as strings,\n * so a real decorator was never compiled and the gap went uncaught).\n *\n * Declared on `@JobHandler({ triggers })`; the codegen bridge-registry\n * generator (`src/cli/shared/bridge-registry-generator.ts`) scans these from\n * source and emits `bridge/generated/registry.ts`, validating each `event`\n * against the generated `eventRegistry` at `gen-all`. The distributed union\n * narrows `map`/`when` per `event`, so callbacks are typed against the event\n * payload (ADR-023, \"typed against PayloadOfType<T>\").\n *\n * Typed against events' generated types — the same `import type` coupling the\n * bridge already has (erased at runtime). `jobs` must NOT import `bridge`, so\n * the post-gen `BridgeTriggerEntry` is deliberately not referenced here;\n * `triggerId`/`jobType` are computed by the generator, not authored.\n */\nexport type JobTrigger<TInput> = {\n  [T in EventTypeName]: {\n    /** Event type that fires this trigger. Validated against `eventRegistry`. */\n    event: T;\n    /** Maps the event to the job input. Inlined verbatim into the registry. */\n    map: (event: EventOfType<T>) => TInput;\n    /** Optional guard; `false` → wrapper records `status='skipped'`. */\n    when?: (event: EventOfType<T>) => boolean;\n  };\n}[EventTypeName];\n\nexport interface JobHandlerMeta<TInput> {\n  pool?: string;\n  scope?: ScopeRef<TInput>;\n  retry?: RetryPolicy;\n  concurrency?: ConcurrencyPolicy<TInput>;\n  dedupe?: DedupePolicy<TInput>;\n  timeoutMs?: number;\n  replayFrom?: 'scratch' | 'last_step' | 'last_checkpoint';\n  /**\n   * Bridge triggers (ADR-023 Tier 3). Codegen scans these into `bridgeRegistry`;\n   * the framework `BridgeDeliveryHandler` starts this job per matched event.\n   * Absent for jobs started directly or via `IEventFlow.publishAndStart`.\n   */\n  triggers?: readonly JobTrigger<TInput>[];\n}\n\n// ─── Runtime option shapes ──────────────────────────────────────────────────\n\nexport interface StepOptions {\n  retry?: RetryPolicy;\n  timeoutMs?: number;\n}\n\nexport interface SpawnChildOptions {\n  closePolicy?: ParentClosePolicy;\n  runAt?: Date;\n  priority?: number;\n  tags?: Record<string, string>;\n}\n\n// ─── JobContext ─────────────────────────────────────────────────────────────\n\nexport interface JobContext<TInput> {\n  readonly input: TInput;\n  readonly run: JobRun;\n  step<TOutput>(\n    stepId: string,\n    fn: () => Promise<TOutput>,\n    opts?: StepOptions,\n  ): Promise<TOutput>;\n  spawnChild(type: string, input: unknown, opts?: SpawnChildOptions): Promise<JobRun>;\n  readonly logger: Logger;\n  // NOT in Phase 1 — deferred to ADR-025:\n  //   waitFor(kind, token, opts)\n  //   signal(token, payload)\n  //   sleep(ms)\n}\n\n// ─── JobHandlerBase ─────────────────────────────────────────────────────────\n\nexport abstract class JobHandlerBase<TInput, TOutput = unknown> {\n  abstract run(ctx: JobContext<TInput>): Promise<TOutput>;\n}\n\n// ─── Registry + decorator ───────────────────────────────────────────────────\n\n/**\n * Module-singleton map keyed by job type. Populated by the `@JobHandler`\n * decorator at class definition time; consumed by `JobWorkerModule` (JOB-5)\n * to upsert `job` rows and resolve handler classes during claim/execute.\n */\nexport const JOB_HANDLER_REGISTRY = new Map<\n  string,\n  {\n    type: string;\n    meta: JobHandlerMeta<unknown>;\n    handlerClass: new (...args: unknown[]) => JobHandlerBase<unknown>;\n  }\n>();\n\n// ADR-037: namespaced `Symbol.for(...)` (via `tokenKey()`) so the reflection-metadata\n// key matches by value across import boundaries (the @JobHandler decorator and the\n// reader may resolve different runtime copies). Distinct from the DI tokens but\n// subject to the same dual-package identity hazard.\nexport const JOB_HANDLER_METADATA_KEY = Symbol.for(tokenKey('jobs', 'handler-metadata'));\n\n/**\n * Class decorator that registers a handler with the job type, the full\n * metadata shape, and the target class constructor.\n *\n * Duplicate-type behaviour (OQ-3, resolved 2026-04-18):\n *   - `NODE_ENV === 'production'` → throw; silent overwrite in prod is a\n *     correctness bug.\n *   - `NODE_ENV === 'test'`       → silent overwrite (tests intentionally\n *     re-register handlers).\n *   - otherwise (dev)             → `console.warn` + overwrite. `console`\n *     is used intentionally instead of the Nest `Logger` — decorators run\n *     at module-load time before any Nest container exists.\n */\nexport function JobHandler<TInput>(\n  type: string,\n  meta: JobHandlerMeta<TInput>,\n): ClassDecorator {\n  return (target) => {\n    if (JOB_HANDLER_REGISTRY.has(type)) {\n      const env = process.env.NODE_ENV;\n      if (env === 'production') {\n        throw new Error(\n          `[JobHandler] Duplicate registration for job type '${type}'. ` +\n            `Each @JobHandler must declare a unique type.`,\n        );\n      }\n      if (env !== 'test') {\n        // eslint-disable-next-line no-console\n        console.warn(\n          `[JobHandler] Duplicate registration for job type '${type}'. ` +\n            `Overwriting previous handler — this is almost certainly a bug.`,\n        );\n      }\n    }\n\n    Reflect.defineMetadata(JOB_HANDLER_METADATA_KEY, { type, meta }, target);\n    JOB_HANDLER_REGISTRY.set(type, {\n      type,\n      meta: meta as JobHandlerMeta<unknown>,\n      handlerClass: target as unknown as new (\n        ...args: unknown[]\n      ) => JobHandlerBase<unknown>,\n    });\n  };\n}\n\n// ─── HandlerRegistry — read helpers consumed by JobWorkerModule (JOB-5) ─────\n\n/**\n * Single entry shape returned by `HandlerRegistry.getAll()` / `.get()` and\n * exposed to `JobWorkerModule.onModuleInit` for boot-time upserts.\n *\n * Structurally compatible with `IJobOrchestrator.upsertJobRows`'s\n * `JobUpsertEntry` so the worker module can pass entries through verbatim\n * without re-mapping.\n */\nexport interface HandlerRegistryEntry {\n  type: string;\n  meta: JobHandlerMeta<unknown>;\n  handlerClass: new (...args: unknown[]) => JobHandlerBase<unknown>;\n}\n\n/**\n * Read facade over `JOB_HANDLER_REGISTRY`. The decorator's write path is\n * unchanged; this namespace exists so consumers (the worker module, tests)\n * don't import the raw `Map` and accidentally mutate it.\n */\nexport namespace HandlerRegistry {\n  /** All registered entries in insertion order. */\n  export function getAll(): HandlerRegistryEntry[] {\n    return Array.from(JOB_HANDLER_REGISTRY.values());\n  }\n\n  /** Lookup by job type, or `undefined` if no `@JobHandler` is registered. */\n  export function get(type: string): HandlerRegistryEntry | undefined {\n    return JOB_HANDLER_REGISTRY.get(type);\n  }\n}\n","/**\n * Injection token for the event bus.\n *\n * String constant (not Symbol) so it matches by value across import boundaries.\n * Matches the token in runtime/constants/tokens.ts — both are 'EVENT_BUS'.\n *\n * Usage in use cases:\n * ```typescript\n * constructor(@Inject(EVENT_BUS) private readonly eventBus: IEventBus) {}\n * ```\n */\nimport { tokenKey } from '../token-key';\n\nexport const EVENT_BUS = 'EVENT_BUS' as const;\n\n/**\n * Injection token for the read-side `IEventReadPort` over `domain_events`\n * (OBS-LIST-1).\n *\n * Bound by `EventsModule.forRoot` to the same backend instance as\n * `EVENT_BUS` for the `drizzle` and `memory` backends (both implement\n * `IEventReadPort`). The `redis` backend retains no history and therefore\n * does NOT provide this token — consumers composing it (e.g. the\n * observability combiner) inject it `@Optional()` and degrade to empty\n * results.\n *\n * String constant (not Symbol) so it matches by value across import\n * boundaries — same convention as `EVENT_BUS`.\n */\nexport const EVENT_READ_PORT = 'EVENT_READ_PORT' as const;\n\n/**\n * Injection token for the generated `TypedEventBus` facade.\n *\n * `TypedEventBus` lives in `runtime/subsystems/events/generated/bus.ts` and\n * wraps `IEventBus` with project-specific `AppDomainEvent`-typed `publish<T>()`\n * and `subscribe<T>()`. Use cases inject this token in preference to\n * `EVENT_BUS` when they want compile-time type safety on event shapes.\n *\n * String constant (not Symbol) so it matches by value across import\n * boundaries — same convention as `EVENT_BUS`.\n *\n * Provider registration lands in EVT-6 (EventsModule wiring); the token is\n * declared here so generated code can import it without depending on the\n * still-being-formalised module.\n */\nexport const TYPED_EVENT_BUS = 'TYPED_EVENT_BUS' as const;\n\n/**\n * Injection token for the resolved multi-tenancy flag.\n *\n * Provided by `EventsModule.forRoot(...)` as `options.multiTenant ?? false`.\n * Consumed by `TypedEventBus` to enforce the tenantId-is-required rule at\n * publish time.\n *\n * String constant (not Symbol) so it matches by value across import\n * boundaries — same convention as the other events tokens. (The jobs\n * subsystem uses Symbols for the analogous token; events chose strings\n * from the start and we keep the file internally consistent.)\n */\nexport const EVENTS_MULTI_TENANT = 'EVENTS_MULTI_TENANT' as const;\n\n/**\n * Injection token for the Redis connection URL used by RedisEventBus.\n * Provided automatically by EventsModule.forRoot({ backend: 'redis' }).\n *\n * ADR-037: namespaced `Symbol.for(...)` (via `tokenKey()`) so it matches by value\n * across runtime copies (the sibling string tokens above are already value-stable).\n * Note the jobs subsystem defines its own `REDIS_URL`-equivalent; this is the\n * events one.\n */\nexport const REDIS_URL = Symbol.for(tokenKey('events', 'redis-url'));\n\n/**\n * Injection token for the resolved `EventsModuleOptions` object.\n *\n * Provided automatically by `EventsModule.forRoot(...)` /\n * `EventsModule.forRootAsync(...)`. Backends that need to observe module\n * configuration (e.g. `DrizzleEventBus` reading `opts.pools` for\n * pool-filtered drain) inject via this token.\n *\n * String-valued (not `Symbol`) so it matches by value across import\n * boundaries — same convention as `EVENT_BUS`.\n */\nexport const EVENTS_MODULE_OPTIONS = 'EVENTS_MODULE_OPTIONS' as const;\n","/**\n * Typed errors for the bridge subsystem (ADR-023 Phase 2, BRIDGE-2).\n *\n * All thrown by the three enforcement sites named in ADR-023 §Multi-tenancy:\n *   - `EventFlowService.publishAndStart` entry (BRIDGE-7)\n *   - `BridgeDeliveryHandler.handle` entry (BRIDGE-5)\n *   - `DrizzleBridgeDeliveryRepo.insertDelivery` pre-write (BRIDGE-4)\n *\n * Same shape as `runtime/subsystems/jobs/jobs-errors.ts` and\n * `runtime/subsystems/events/events-errors.ts` so consumers can catch them\n * with the same exception-filter pattern across all three subsystems.\n */\n\n/**\n * Thrown when `BridgeModule` was configured with `multiTenant: true` but\n * the caller did not pass a `tenantId` at one of the three enforcement\n * sites listed above.\n *\n * **Strict enforcement rationale (mirrors JOB-8 / SYNC-6 stance, locked\n * 2026-04-18 for jobs; same rationale applies here).** Cross-tenant data\n * leakage is the worst class of bug a multi-tenant system can ship;\n * surfacing the misuse loudly at the call site (rather than silently\n * defaulting to `null` or to \"the last tenant seen\") prevents both\n * accidental global writes and sneaky reads that return a union of tenants.\n *\n * - `undefined` `tenantId` → throw this error.\n * - Explicit `null` `tenantId` → passes; opts the call into cross-tenant\n *   work (e.g. a system housekeeping event with no owning tenant). The\n *   `bridge_delivery` row is persisted with `tenant_id = NULL`.\n *\n * The `callSite` constructor argument names which of the three enforcement\n * sites threw — review reports and ops dashboards rely on a stable site\n * name, so use the canonical strings: `'EventFlowService.publishAndStart'`,\n * `'BridgeDeliveryHandler.handle'`,\n * `'DrizzleBridgeDeliveryRepo.insertDelivery'`.\n */\nexport class MissingTenantIdError extends Error {\n  override readonly name = 'MissingTenantIdError';\n  constructor(public readonly callSite: string) {\n    super(\n      `MissingTenantIdError: BridgeModule was configured with ` +\n        `multiTenant=true but ${callSite} was called without tenantId ` +\n        `(undefined). Pass an explicit tenantId, or pass null for ` +\n        `cross-tenant work.`,\n    );\n  }\n}\n\n/**\n * Synthetic error thrown by `MemoryBridgeDeliveryRepo.insertDelivery` when\n * a duplicate `(event_id, trigger_id)` insert hits the simulated UNIQUE\n * constraint (BRIDGE-3).\n *\n * Carries a `constraint` field equal to the Drizzle constraint name\n * declared in BRIDGE-1's schema (`uq_bridge_delivery_event_trigger`) so\n * call sites can branch on the same discriminator regardless of which\n * backend is wired up. This matters because ADR-023 explicitly leans on\n * the constraint as the dedup mechanism in two places — outbox replay\n * and `publishAndStart` Case B — and BRIDGE-4 / BRIDGE-7 will share a\n * type-check path with BRIDGE-3-driven tests.\n *\n * The Drizzle backend (BRIDGE-4) does NOT throw this error: it uses\n * `INSERT … ON CONFLICT (event_id, trigger_id) DO NOTHING RETURNING id`\n * per the BRIDGE-4 spec recommendation, so collisions surface as an empty\n * result set rather than an exception. The error exists so the memory\n * backend can faithfully model the \"duplicate raises\" behaviour for tests\n * that want to assert the constraint actually fires.\n */\n/**\n * Thrown by `BridgeModule.onModuleInit` when `JobWorkerModule` is wired\n * alongside the bridge but its active `pools` list does not include one\n * or more of the three reserved bridge pools (`events_inbound`,\n * `events_change`, `events_outbound`).\n *\n * Without a worker polling those pools, the wrapper `job_run` rows the\n * outbox drain inserts (BRIDGE-4) sit `pending` forever — a silent\n * footgun where `eventFlow.publish(...)` returns success but no user\n * job ever spawns. The boot-time check converts that into a fail-fast.\n *\n * Operators can either (a) add `...BRIDGE_RESERVED_POOLS` to their\n * `JobWorkerModule.forRoot({ pools })` configuration so the same\n * process polls the reserved pools, or (b) run a separate worker\n * process per reserved pool for lane isolation (ADR-022 §Pool\n * isolation).\n */\nexport class BridgeReservedPoolsNotPolledError extends Error {\n  override readonly name = 'BridgeReservedPoolsNotPolledError';\n  constructor(public readonly missingPools: readonly string[]) {\n    super(\n      `BridgeModule loaded but JobWorkerModule is not polling reserved ` +\n        `pool '${missingPools[0]}'. Add ...BRIDGE_RESERVED_POOLS to your ` +\n        `JobWorkerModule.forRoot({ pools }) configuration. Missing pools: ` +\n        `${missingPools.join(', ')}. (Bridge-fanout wrappers will sit ` +\n        `pending forever without these pollers.)`,\n    );\n  }\n}\n\nexport class UniqueConstraintError extends Error {\n  override readonly name = 'UniqueConstraintError';\n  constructor(\n    public readonly constraint: string,\n    public readonly eventId: string,\n    public readonly triggerId: string,\n  ) {\n    super(\n      `UniqueConstraintError: duplicate insert into bridge_delivery for ` +\n        `(event_id='${eventId}', trigger_id='${triggerId}') — violates ` +\n        `constraint '${constraint}'.`,\n    );\n  }\n}\n","/**\n * `assertTenantId` — shared multi-tenancy enforcement helper for the\n * bridge subsystem (BRIDGE-8, ADR-023 §Multi-tenancy null-tenantId).\n *\n * Single source of truth for the three enforcement sites named in\n * ADR-023 §Multi-tenancy and the BRIDGE-2 spec:\n *\n *   (a) `EventFlowService.publishAndStart`           — request-path entry\n *   (b) `BridgeDeliveryHandler.run`                  — wrapper handler entry\n *   (c) `DrizzleBridgeDeliveryRepo.insertDelivery`   — last-line repo defense\n *\n * Contract (mirrors JOB-8 / SYNC-6 — locked 2026-04-18 for jobs and\n * carried into the bridge here):\n *\n *   - `multiTenant === false`           → no-op (always passes).\n *   - `multiTenant === true`,\n *      `tenantId === undefined`         → throw `MissingTenantIdError(site)`.\n *   - `multiTenant === true`,\n *      `tenantId === null`              → passes; opts the call into\n *                                          cross-tenant work (system\n *                                          housekeeping, framework events\n *                                          with no owning tenant). Persists\n *                                          to the DB as `tenant_id = NULL`.\n *   - `multiTenant === true`,\n *      `tenantId` is a string           → passes.\n *\n * The strict `undefined`-vs-`null` discrimination is the entire point —\n * silent defaulting is exactly the failure mode that lets cross-tenant\n * leaks ship.\n */\nimport { MissingTenantIdError } from './bridge-errors';\n\n/**\n * Throws `MissingTenantIdError(site)` if `multiTenant === true` and\n * `tenantId === undefined`. Explicit `null` always passes.\n *\n * @param site         Canonical site name — one of:\n *                     `'EventFlowService.publishAndStart'`,\n *                     `'BridgeDeliveryHandler.run'`,\n *                     `'DrizzleBridgeDeliveryRepo.insertDelivery'`.\n *                     Stable strings; ops dashboards / review reports key\n *                     on these. Use the same string the existing tests\n *                     and `MissingTenantIdError` JSDoc enumerate.\n * @param multiTenant  Resolved `BRIDGE_MULTI_TENANT` flag (from\n *                     `BridgeModule.forRoot({ multiTenant })`).\n * @param tenantId     The tenantId the caller supplied (or didn't).\n */\nexport function assertTenantId(\n  site: string,\n  multiTenant: boolean,\n  tenantId: string | null | undefined,\n): void {\n  if (multiTenant && tenantId === undefined) {\n    throw new MissingTenantIdError(site);\n  }\n  // explicit null passes — opts into cross-tenant work\n}\n"],"mappings":";;;;;;;;;;;;;AAgCA,SAAS,UAAAA,SAAQ,cAAAC,aAAY,UAAAC,SAAQ,YAAAC,iBAAgB;AACrD,SAAS,kBAAkB;;;ACW3B;AAAA,EACE,SAAAC;AAAA,EACA,SAAAC;AAAA,EACA,UAAAC;AAAA,EACA,WAAAC;AAAA,EACA,QAAAC;AAAA,EACA,aAAAC;AAAA,EACA;AAAA,EACA,QAAAC;AAAA,OACK;AACP,SAAS,OAAAC,YAAW;;;AChBpB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,WAAW;AAGb,IAAM,eAAe;AAAA,EAC1B;AAAA,EACA;AAAA,IACE,IAAI,KAAK,IAAI,EAAE,WAAW;AAAA,IAC1B,MAAM,KAAK,MAAM,EAAE,QAAQ;AAAA,IAC3B,aAAa,KAAK,cAAc,EAAE,QAAQ;AAAA,IAC1C,eAAe,KAAK,gBAAgB,EAAE,QAAQ;AAAA,IAC9C,SAAS,MAAM,SAAS,EAAE,QAAQ,EAAE,MAA+B;AAAA,IACnE,YAAY,UAAU,eAAe,EAAE,cAAc,KAAK,CAAC,EAAE,QAAQ;AAAA,IACrE,aAAa,UAAU,gBAAgB,EAAE,cAAc,KAAK,CAAC;AAAA;AAAA,IAE7D,QAAQ,KAAK,QAAQ,EAAE,QAAQ,EAAE,QAAQ,SAAS;AAAA;AAAA,IAElD,OAAO,KAAK,OAAO;AAAA,IACnB,UAAU,MAAM,UAAU,EAAE,MAA+B;AAAA;AAAA,IAE3D,MAAM,KAAK,MAAM;AAAA;AAAA,IAEjB,WAAW,KAAK,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAO3B,MAAM,KAAK,MAAM,EAAE,QAAQ,EAAE,QAAQ,QAAQ;AAAA;AAAA,IAE7C,UAAU,KAAK,WAAW;AAAA,EAC5B;AAAA,EACA,CAAC,OAAO;AAAA;AAAA,IAEN,iCAAiC,MAAM,sCAAsC,EAAE;AAAA,MAC7E,EAAE;AAAA,MACF,EAAE;AAAA,IACJ;AAAA;AAAA,IAEA,0BAA0B,MAAM,6BAA6B,EAAE;AAAA,MAC7D,EAAE;AAAA,MACF,EAAE;AAAA,IACJ;AAAA;AAAA,IAEA,qCAAqC;AAAA,MACnC;AAAA,IACF,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU;AAAA;AAAA,IAEnC,qCAAqC;AAAA,MACnC;AAAA,IACF,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IASnC,kBAAkB;AAAA,MAChB;AAAA,MACA,MAAM,EAAE,IAAI,gCAAgC,EAAE,IAAI,kBAAkB,EAAE,IAAI,gBAAgB,EAAE,SAAS;AAAA,IACvG;AAAA,EACF;AACF;;;ACnGA;AAAA,EACE;AAAA,EACA,WAAAC;AAAA,EACA,QAAAC;AAAA,EACA,QAAAC;AAAA,EACA,SAAAC;AAAA,EACA;AAAA,EACA,aAAAC;AAAA,EACA,SAAAC;AAAA,EACA;AAAA,OACK;AACP,SAAS,OAAAC,YAAW;AAuBb,IAAM,mBAAmB,OAAO,kBAAkB;AAAA,EACvD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,kBAAkB,OAAO,iBAAiB,CAAC,MAAM,CAAC;AAExD,IAAM,oBAAoB,OAAO,mBAAmB;AAAA,EACzD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAEM,IAAM,oBAAoB,OAAO,sBAAsB;AAAA,EAC5D;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAEM,IAAM,iBAAiB,OAAO,mBAAmB;AAAA,EACtD;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAEM,IAAM,wBAAwB,OAAO,2BAA2B;AAAA,EACrE;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,eAAe,OAAO,iBAAiB,CAAC,QAAQ,CAAC;AAGvD,IAAM,oBAAoB,OAAO,sBAAsB;AAAA,EAC5D;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAIM,IAAM,OAAON,SAAQ,OAAO;AAAA,EACjC,MAAME,MAAK,MAAM,EAAE,WAAW;AAAA,EAC9B,SAAS,QAAQ,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC;AAAA,EAC/C,MAAMA,MAAK,MAAM,EAAE,QAAQ;AAAA,EAC3B,iBAAiBA,MAAK,mBAAmB;AAAA,EACzC,aAAaC,OAAM,cAAc,EAAE,QAAQ,EAAE,MAAmB;AAAA,EAChE,WAAW,QAAQ,YAAY;AAAA,EAC/B,wBAAwBD,MAAK,0BAA0B;AAAA,EACvD,eAAe,kBAAkB,gBAAgB,EAAE,QAAQ,EAAE,QAAQ,OAAO;AAAA,EAC5E,mBAAmBA,MAAK,qBAAqB;AAAA,EAC7C,gBAAgB,QAAQ,kBAAkB;AAAA,EAC1C,iBAAiB,QAAQ,kBAAkB,EAAE,QAAQ,EAAE,QAAQ,CAAC;AAAA,EAChE,YAAY,eAAe,aAAa,EAAE,QAAQ,EAAE,QAAQ,iBAAiB;AAAA,EAC7E,WAAWE,WAAU,cAAc,EAAE,cAAc,KAAK,CAAC,EAAE,QAAQ,EAAE,WAAW;AAAA,EAChF,WAAWA,WAAU,cAAc,EAAE,cAAc,KAAK,CAAC,EAAE,QAAQ,EAAE,WAAW;AAClF,CAAC;AAMM,IAAM,UAAUJ;AAAA,EACrB;AAAA,EACA;AAAA,IACE,IAAIC,MAAK,IAAI,EAAE,WAAW,EAAE,cAAc;AAAA,IAC1C,SAASC,MAAK,UAAU,EAAE,QAAQ,EAAE,WAAW,MAAM,KAAK,IAAI;AAAA,IAC9D,YAAY,QAAQ,aAAa,EAAE,QAAQ;AAAA,IAC3C,aAAaD,MAAK,eAAe,EAAE,WAAW,MAAW,QAAQ,EAAE;AAAA;AAAA;AAAA;AAAA;AAAA,IAKnE,WAAWA,MAAK,aAAa,EAAE,QAAQ;AAAA,IACvC,mBAAmB,sBAAsB,qBAAqB,EAC3D,QAAQ,EACR,QAAQ,WAAW;AAAA,IACtB,iBAAiBC,MAAK,mBAAmB;AAAA,IACzC,eAAeA,MAAK,iBAAiB;AAAA,IACrC,UAAUA,MAAK,WAAW;AAAA,IAC1B,MAAMC,OAAM,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,EAAE,MAA8B;AAAA,IACxE,MAAMD,MAAK,MAAM,EAAE,QAAQ;AAAA,IAC3B,UAAU,QAAQ,UAAU,EAAE,QAAQ,EAAE,QAAQ,CAAC;AAAA,IACjD,gBAAgBA,MAAK,iBAAiB;AAAA,IACtC,WAAWA,MAAK,YAAY;AAAA,IAC5B,QAAQ,iBAAiB,QAAQ,EAAE,QAAQ,EAAE,QAAQ,SAAS;AAAA,IAC9D,OAAOC,OAAM,OAAO,EAAE,QAAQ,EAAE,MAA+B;AAAA,IAC/D,QAAQA,OAAM,QAAQ,EAAE,MAA+B;AAAA,IACvD,OAAOA,OAAM,OAAO,EAAE,MAAmB;AAAA,IACzC,eAAe,kBAAkB,gBAAgB,EAAE,QAAQ;AAAA,IAC3D,YAAYD,MAAK,aAAa;AAAA,IAC9B,OAAOE,WAAU,UAAU,EAAE,cAAc,KAAK,CAAC,EAAE,QAAQ,EAAE,WAAW;AAAA,IACxE,WAAWA,WAAU,cAAc,EAAE,cAAc,KAAK,CAAC;AAAA,IACzD,YAAYA,WAAU,eAAe,EAAE,cAAc,KAAK,CAAC;AAAA,IAC3D,WAAWA,WAAU,cAAc,EAAE,cAAc,KAAK,CAAC;AAAA,IACzD,UAAU,QAAQ,UAAU,EAAE,QAAQ,EAAE,QAAQ,CAAC;AAAA;AAAA,IAEjD,UAAU,aAAa,WAAW;AAAA;AAAA,IAElC,aAAaF,MAAK,cAAc;AAAA;AAAA,IAEhC,cAAcE,WAAU,iBAAiB,EAAE,cAAc,KAAK,CAAC;AAAA,IAC/D,WAAWA,WAAU,cAAc,EAAE,cAAc,KAAK,CAAC,EAAE,QAAQ,EAAE,WAAW;AAAA,IAChF,WAAWA,WAAU,cAAc,EAAE,cAAc,KAAK,CAAC,EAAE,QAAQ,EAAE,WAAW;AAAA,EAClF;AAAA,EACA,CAAC,OAAO;AAAA;AAAA,IAEN,gBAAgBC,OAAM,mBAAmB,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK;AAAA;AAAA,IAEvE,eAAeA,OAAM,kBAAkB,EAAE,GAAG,EAAE,SAAS;AAAA;AAAA,IAEvD,gBAAgBA,OAAM,mBAAmB,EAAE,GAAG,EAAE,iBAAiB,EAAE,aAAa;AAAA;AAAA,IAEhF,iBAAiBA,OAAM,oBAAoB,EACxC,GAAG,EAAE,SAAS,EAAE,SAAS,EACzB,MAAMC,OAAM,EAAE,SAAS,cAAc;AAAA;AAAA,IAExC,sBAAsBD,OAAM,yBAAyB,EAClD,GAAG,EAAE,cAAc,EACnB;AAAA,MACCC,OAAM,EAAE,cAAc,oBAAoB,EAAE,MAAM;AAAA,IACpD;AAAA,EACJ;AACF;AAMO,IAAM,WAAWN;AAAA,EACtB;AAAA,EACA;AAAA,IACE,IAAIC,MAAK,IAAI,EAAE,WAAW,EAAE,cAAc;AAAA,IAC1C,UAAUA,MAAK,YAAY,EAAE,QAAQ,EAAE,WAAW,MAAM,QAAQ,EAAE;AAAA,IAClE,QAAQC,MAAK,SAAS,EAAE,QAAQ;AAAA,IAChC,MAAM,gBAAgB,MAAM,EAAE,QAAQ,EAAE,QAAQ,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMtD,KAAK,QAAQ,KAAK,EAAE,QAAQ;AAAA,IAC5B,QAAQ,kBAAkB,QAAQ,EAAE,QAAQ,EAAE,QAAQ,SAAS;AAAA,IAC/D,OAAOC,OAAM,OAAO,EAAE,MAA+B;AAAA;AAAA,IAErD,QAAQA,OAAM,QAAQ,EAAE,MAA+B;AAAA,IACvD,OAAOA,OAAM,OAAO,EAAE,MAAmB;AAAA,IACzC,UAAU,QAAQ,UAAU,EAAE,QAAQ,EAAE,QAAQ,CAAC;AAAA,IACjD,WAAWC,WAAU,cAAc,EAAE,cAAc,KAAK,CAAC;AAAA,IACzD,YAAYA,WAAU,eAAe,EAAE,cAAc,KAAK,CAAC;AAAA,EAC7D;AAAA,EACA,CAAC,OAAO;AAAA;AAAA,IAEN,mBAAmB,YAAY,uBAAuB,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM;AAAA;AAAA,IAE/E,oBAAoBC,OAAM,uBAAuB,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG;AAAA,EACzE;AACF;;;AFxJO,IAAM,2BAA2BE,QAAO,0BAA0B;AAAA,EACvE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAIM,IAAM,iBAAiBC;AAAA,EAC5B;AAAA,EACA;AAAA,IACE,IAAIC,MAAK,IAAI,EAAE,WAAW,EAAE,cAAc;AAAA;AAAA,IAE1C,SAASA,MAAK,UAAU,EACrB,QAAQ,EACR,WAAW,MAAM,aAAa,EAAE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMnC,WAAWC,MAAK,YAAY,EAAE,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMtC,cAAcD,MAAK,gBAAgB,EAAE,WAAW,MAAM,QAAQ,EAAE;AAAA;AAAA;AAAA;AAAA;AAAA,IAKhE,WAAWA,MAAK,aAAa,EAAE,WAAW,MAAM,QAAQ,EAAE;AAAA,IAC1D,QAAQ,yBAAyB,QAAQ,EAAE,QAAQ,EAAE,QAAQ,SAAS;AAAA;AAAA,IAEtE,YAAYC,MAAK,aAAa;AAAA;AAAA,IAE9B,OAAOC,OAAM,OAAO,EAAE,MAA+B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMrD,UAAUD,MAAK,WAAW;AAAA,IAC1B,aAAaE,WAAU,gBAAgB,EAAE,cAAc,KAAK,CAAC,EAC1D,QAAQ,EACR,WAAW;AAAA,IACd,aAAaA,WAAU,gBAAgB,EAAE,cAAc,KAAK,CAAC;AAAA,EAC/D;AAAA,EACA,CAAC,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA,IAKN,8BAA8B,OAAO,kCAAkC,EAAE;AAAA,MACvE,EAAE;AAAA,MACF,EAAE;AAAA,IACJ;AAAA;AAAA,IAEA,wBAAwBC,OAAM,2BAA2B,EAAE,GAAG,EAAE,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA,IAKvE,yBAAyBA,OAAM,4BAA4B,EACxD,GAAG,EAAE,MAAM,EACX,MAAMC,OAAM,EAAE,MAAM,0BAA0B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMjD,0BAA0BD,OAAM,8BAA8B,EAC3D,GAAG,EAAE,SAAS,EACd,MAAMC,OAAM,EAAE,SAAS,cAAc;AAAA,EAC1C;AACF;;;AG3HO,IAAM,uBAAuB;AAiB7B,IAAM,sBAAsB;AAmB5B,IAAM,kBAAkB;;;ACE/B,SAAS,QAAQ,YAAY,QAAQ,gBAAgB;;;ACnD9C,IAAM,MAAM;AAGZ,IAAM,WAAW,CAAC,MAAc,SAAyB,GAAG,GAAG,IAAI,IAAI,IAAI,IAAI;;;ACQ/E,IAAM,mBAAmB,OAAO,IAAI,SAAS,QAAQ,cAAc,CAAC;AACpE,IAAM,kBAAkB,OAAO,IAAI,SAAS,QAAQ,aAAa,CAAC;AAClE,IAAM,mBAAmB,OAAO,IAAI,SAAS,QAAQ,cAAc,CAAC;AAgBpE,IAAM,oBAAoB,OAAO,IAAI,SAAS,QAAQ,cAAc,CAAC;;;AC+GrE,IAAe,iBAAf,MAAyD;AAEhE;AASO,IAAM,uBAAuB,oBAAI,IAOtC;AAMK,IAAM,2BAA2B,OAAO,IAAI,SAAS,QAAQ,kBAAkB,CAAC;AAehF,SAAS,WACd,MACA,MACgB;AAChB,SAAO,CAAC,WAAW;AACjB,QAAI,qBAAqB,IAAI,IAAI,GAAG;AAClC,YAAM,MAAM,QAAQ,IAAI;AACxB,UAAI,QAAQ,cAAc;AACxB,cAAM,IAAI;AAAA,UACR,qDAAqD,IAAI;AAAA,QAE3D;AAAA,MACF;AACA,UAAI,QAAQ,QAAQ;AAElB,gBAAQ;AAAA,UACN,qDAAqD,IAAI;AAAA,QAE3D;AAAA,MACF;AAAA,IACF;AAEA,YAAQ,eAAe,0BAA0B,EAAE,MAAM,KAAK,GAAG,MAAM;AACvE,yBAAqB,IAAI,MAAM;AAAA,MAC7B;AAAA,MACA;AAAA,MACA,cAAc;AAAA,IAGhB,CAAC;AAAA,EACH;AACF;AAuBO,IAAU;AAAA,CAAV,CAAUC,qBAAV;AAEE,WAAS,SAAiC;AAC/C,WAAO,MAAM,KAAK,qBAAqB,OAAO,CAAC;AAAA,EACjD;AAFO,EAAAA,iBAAS;AAKT,WAAS,IAAI,MAAgD;AAClE,WAAO,qBAAqB,IAAI,IAAI;AAAA,EACtC;AAFO,EAAAA,iBAAS;AAAA,GAPD;;;AC/NV,IAAM,YAAY;AA0DlB,IAAM,YAAY,OAAO,IAAI,SAAS,UAAU,WAAW,CAAC;;;ACnC5D,IAAM,uBAAN,cAAmC,MAAM;AAAA,EAE9C,YAA4B,UAAkB;AAC5C;AAAA,MACE,+EAC0B,QAAQ;AAAA,IAGpC;AAN0B;AAAA,EAO5B;AAAA,EAP4B;AAAA,EADV,OAAO;AAS3B;;;ACCO,SAAS,eACd,MACA,aACA,UACM;AACN,MAAI,eAAe,aAAa,QAAW;AACzC,UAAM,IAAI,qBAAqB,IAAI;AAAA,EACrC;AAEF;;;ANyBO,IAAM,2BAA2B;AAGxC,IAAM,sBAAsB;AAarB,IAAM,wBAAN,cAAoC,eAGzC;AAAA,EAGA,YACiD,MACJ,cACP,QACM,UAGzB,cAAuB,OACxC;AACA,UAAM;AARyC;AACJ;AACP;AACM;AAGzB;AAAA,EAGnB;AAAA,EATiD;AAAA,EACJ;AAAA,EACP;AAAA,EACM;AAAA,EAGzB;AAAA,EATF,cAAc,IAAI,OAAO,sBAAsB,IAAI;AAAA,EAcpE,MAAM,IACJ,KACgE;AAChE,UAAM,EAAE,WAAW,IAAI,IAAI;AAG3B,UAAM,WAAW,MAAM,KAAK,KAAK,iBAAiB,UAAU;AAC5D,QAAI,CAAC,UAAU;AAKb,WAAK,YAAY;AAAA,QACf,wBAAwB,UAAU;AAAA,MAEpC;AACA,aAAO,EAAE,SAAS,MAAM,QAAQ,uBAAuB;AAAA,IACzD;AAOA;AAAA,MACE;AAAA,MACA,KAAK;AAAA,MACL,SAAS;AAAA,IACX;AAGA,UAAM,QAAQ,MAAM,KAAK,OAAO,SAAS,SAAS,OAAO;AACzD,QAAI,CAAC,OAAO;AAIV,WAAK,YAAY;AAAA,QACf,sBAAsB,SAAS,OAAO,2BAChC,UAAU;AAAA,MAClB;AACA,YAAM,KAAK,KAAK,YAAY,SAAS,IAAI,mBAAmB;AAC5D,aAAO,EAAE,SAAS,MAAM,QAAQ,oBAAoB;AAAA,IACtD;AAGA,UAAM,QAAQ,KAAK,kBAAkB,MAAM,MAAM,SAAS,SAAS;AACnE,QAAI,CAAC,OAAO;AACV,YAAM,KAAK,KAAK,YAAY,SAAS,IAAI,sBAAsB;AAC/D,aAAO,EAAE,SAAS,MAAM,QAAQ,uBAAuB;AAAA,IACzD;AAGA,QAAI,MAAM,QAAQ,CAAC,MAAM,KAAK,KAAc,GAAG;AAC7C,YAAM,KAAK,KAAK,YAAY,SAAS,IAAI,iBAAiB;AAC1D,aAAO,EAAE,SAAS,MAAM,QAAQ,kBAAkB;AAAA,IACpD;AAMA,UAAM,QAAQ,MAAM,IAAI,KAAc;AACtC,UAAM,EAAE,MAAM,IAAI,MAAM,IAAI;AAAA,MAC1B;AAAA,MACA,YAAY;AACV,cAAM,MAAM,MAAM,KAAK,aAAa,MAAM,MAAM,SAAS,OAAO;AAAA,UAC9D,aAAa,IAAI,IAAI;AAAA,UACrB,eAAe;AAAA,UACf,YAAY,SAAS;AAAA,UACrB,UAAU,SAAS;AAAA,QACrB,CAAC;AACD,eAAO,EAAE,OAAO,IAAI,GAAG;AAAA,MACzB;AAAA,IACF;AAGA,UAAM,KAAK,KAAK,cAAc,SAAS,IAAI,KAAK;AAChD,WAAO,EAAE,MAAM;AAAA,EACjB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQQ,kBACN,WACA,WACgC;AAChC,UAAM,aACJ,KAAK,SAAS,SAA0B,KAAK;AAC/C,QAAI,CAAC,WAAY,QAAO;AACxB,WAAO,WAAW,KAAK,CAAC,MAAM,EAAE,cAAc,SAAS;AAAA,EAGzD;AACF;AAnHa,wBAAN;AAAA,EANN,WAAW;AAAA,EACX,WAAgC,0BAA0B;AAAA,IACzD,MAAM;AAAA,IACN,OAAO,EAAE,UAAU,GAAG,SAAS,eAAe,QAAQ,IAAI;AAAA,IAC1D,YAAY;AAAA,EACd,CAAC;AAAA,EAQI,0BAAO,oBAAoB;AAAA,EAC3B,0BAAO,gBAAgB;AAAA,EACvB,0BAAO,SAAS;AAAA,EAChB,0BAAO,eAAe;AAAA,EACtB,4BAAS;AAAA,EACT,0BAAO,mBAAmB;AAAA,GAZlB;;;AL/Cb,IAAM,oBAA4C;AAAA,EAChD,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,UAAU;AACZ;AAGO,IAAM,wBAAN,MAA8D;AAAA,EAKnE,YAGmB,WAA2B,CAAC,GAC7C;AADiB;AAAA,EAChB;AAAA,EADgB;AAAA,EAPF,SAAS,IAAIC,QAAO,sBAAsB,IAAI;AAAA,EACvD,sBAAsB;AAAA,EACb,mBAAmB,oBAAI,IAAY;AAAA,EAQpD,MAAM,aACJ,OACA,IACkC;AAMlC,QAAI,MAAM,WAAW,MAAM,MAAM,SAAS;AACxC,WAAK,qBAAqB,KAAK;AAC/B,aAAO;AAAA,QACL,WAAW;AAAA,QACX,YAAY;AAAA,QACZ,cAAc;AAAA,QACd,cAAc;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,WAAW,KAAK,eAAe,MAAM,IAAI;AAC/C,QAAI,SAAS,WAAW,GAAG;AACzB,aAAO;AAAA,QACL,WAAW;AAAA,QACX,YAAY;AAAA,QACZ,cAAc;AAAA,QACd,cAAc;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,YACH,MAAM,WAAW,WAAW,KAA4B;AAC3D,UAAM,WACH,MAAM,WAAW,UAAU,KAAmC;AACjE,UAAM,cAAc,YAAY,kBAAkB,SAAS,IAAI;AAE/D,QAAI,CAAC,aAAa;AAIhB,UAAI,CAAC,KAAK,qBAAqB;AAC7B,aAAK,sBAAsB;AAC3B,aAAK,OAAO;AAAA,UACV,2EACc,MAAM,EAAE,eAAe,MAAM,IAAI,cAChC,OAAO,SAAS,CAAC;AAAA,QAIlC;AAAA,MACF;AACA,aAAO;AAAA,QACL,WAAW;AAAA,QACX,YAAY;AAAA,QACZ,cAAc,SAAS;AAAA,QACvB,cAAc;AAAA,MAChB;AAAA,IACF;AAEA,QAAI,YAAY;AAChB,QAAI,aAAa;AACjB,UAAM,SAAS;AAaf,eAAW,WAAW,UAAU;AAC9B,YAAM,aAAa,WAAW;AAC9B,YAAM,eAAe,WAAW;AAGhC,YAAM,WAAW,MAAO,GAGrB,OAAO,cAAc,EACrB,OAAO;AAAA,QACN,IAAI;AAAA,QACJ,SAAS,MAAM;AAAA,QACf,WAAW,QAAQ;AAAA,QACnB;AAAA,QACA,QAAQ;AAAA,QACR;AAAA,MACF,CAAC,EACA,oBAAoB;AAAA,QACnB,QAAQ,CAAC,eAAe,SAAS,eAAe,SAAS;AAAA,MAC3D,CAAC,EACA,UAAU,EAAE,IAAI,eAAe,GAAG,CAAC;AAEtC,UAAI,SAAS,WAAW,GAAG;AAGzB;AACA;AAAA,MACF;AAKA,YAAO,GACJ,OAAO,OAAO,EACd,OAAO;AAAA,QACN,IAAI;AAAA,QACJ,SAAS;AAAA,QACT,YAAY;AAAA,QACZ,WAAW;AAAA,QACX,MAAM;AAAA,QACN,QAAQ;AAAA,QACR,OAAO,EAAE,WAAW;AAAA,QACpB,eAAe;AAAA,QACf,YAAY,MAAM;AAAA,QAClB;AAAA,MACF,CAAC;AAEH;AAAA,IACF;AAEA,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,cAAc,SAAS;AAAA,MACvB,cAAc;AAAA,IAChB;AAAA,EACF;AAAA,EAEQ,qBAAqB,OAA0B;AACrD,QAAI,KAAK,iBAAiB,IAAI,MAAM,IAAI,EAAG;AAC3C,SAAK,iBAAiB,IAAI,MAAM,IAAI;AACpC,SAAK,OAAO;AAAA,MACV,0CAA0C,MAAM,IAAI,eAAe,MAAM,EAAE;AAAA,IAG7E;AAAA,EACF;AAAA,EAEQ,eACN,WACsB;AACtB,UAAM,aAAa,KAAK,SAAS,SAA0B;AAC3D,WAAQ,cAAc,CAAC;AAAA,EACzB;AACF;AA9Ja,wBAAN;AAAA,EADNC,YAAW;AAAA,EAOP,mBAAAC,UAAS;AAAA,EACT,mBAAAC,QAAO,eAAe;AAAA,GAPd;","names":["Inject","Injectable","Logger","Optional","index","jsonb","pgEnum","pgTable","text","timestamp","uuid","sql","pgTable","uuid","text","jsonb","timestamp","index","sql","pgEnum","pgTable","uuid","text","jsonb","timestamp","index","sql","HandlerRegistry","Logger","Injectable","Optional","Inject"]}

package/dist/runtime/subsystems/bridge/bridge.module.d.ts

@@ -6,7 +6,7 @@ import 'drizzle-orm/node-postgres';
 import '../jobs/jobs-domain.module.js';
 import '../jobs/bullmq.config.js';
 import '../jobs/pool-config.loader.js';
-import '../../../job-orchestrator.protocol-CHOEqBDk.js';
+import '../../../job-orchestrator.protocol-CARhMLCO.js';
 import '../events/event-bus.protocol.js';
 import '../jobs/job-orchestration.schema.js';
 import 'drizzle-orm/pg-core';

package/dist/runtime/subsystems/bridge/bridge.module.js

@@ -26,6 +26,10 @@ import {
   Optional as Optional2
 } from "@nestjs/common";
 
+// runtime/subsystems/token-key.ts
+var PKG = "@pattern-stack/codegen";
+var tokenKey = (area, name) => `${PKG}.${area}.${name}`;
+
 // runtime/constants/tokens.ts
 var DRIZZLE = "DRIZZLE";
 
@@ -33,7 +37,7 @@ var DRIZZLE = "DRIZZLE";
 var JobHandlerBase = class {
 };
 var JOB_HANDLER_REGISTRY = /* @__PURE__ */ new Map();
-var JOB_HANDLER_METADATA_KEY = /* @__PURE__ */ Symbol("JobHandlerMeta");
+var JOB_HANDLER_METADATA_KEY = Symbol.for(tokenKey("jobs", "handler-metadata"));
 function JobHandler(type, meta) {
   return (target) => {
     if (JOB_HANDLER_REGISTRY.has(type)) {
@@ -73,10 +77,10 @@ var HandlerRegistry;
 import { Module } from "@nestjs/common";
 
 // runtime/subsystems/jobs/jobs-domain.tokens.ts
-var JOB_ORCHESTRATOR = /* @__PURE__ */ Symbol("JOB_ORCHESTRATOR");
-var JOB_RUN_SERVICE = /* @__PURE__ */ Symbol("JOB_RUN_SERVICE");
-var JOB_STEP_SERVICE = /* @__PURE__ */ Symbol("JOB_STEP_SERVICE");
-var JOBS_MULTI_TENANT = /* @__PURE__ */ Symbol("JOBS_MULTI_TENANT");
+var JOB_ORCHESTRATOR = Symbol.for(tokenKey("jobs", "orchestrator"));
+var JOB_RUN_SERVICE = Symbol.for(tokenKey("jobs", "run-service"));
+var JOB_STEP_SERVICE = Symbol.for(tokenKey("jobs", "step-service"));
+var JOBS_MULTI_TENANT = Symbol.for(tokenKey("jobs", "multi-tenant"));
 
 // runtime/subsystems/jobs/job-orchestrator.drizzle-backend.ts
 import { randomUUID } from "crypto";
@@ -1940,8 +1944,8 @@ function extractUserPools(raw) {
 }
 
 // runtime/subsystems/jobs/bullmq.config.ts
-var BULLMQ_CONNECTION = /* @__PURE__ */ Symbol("BULLMQ_CONNECTION");
-var BULLMQ_RESOLVED_CONFIG = /* @__PURE__ */ Symbol("BULLMQ_RESOLVED_CONFIG");
+var BULLMQ_CONNECTION = Symbol.for(tokenKey("jobs", "bullmq-connection"));
+var BULLMQ_RESOLVED_CONFIG = Symbol.for(tokenKey("jobs", "bullmq-resolved-config"));
 var DEFAULT_REDIS_URL = "redis://localhost:6379";
 var DEFAULT_BULL_BOARD_MOUNT = "/admin/queues";
 function resolveBullMqConfig(ext) {
@@ -2034,7 +2038,7 @@ JobsDomainModule = __decorateClass([
 // runtime/subsystems/jobs/job-worker.ts
 import { Inject as Inject6, Injectable as Injectable7, Logger as Logger3 } from "@nestjs/common";
 import { and as and4, asc as asc2, desc as desc3, eq as eq4, inArray as inArray3, lt as lt2, lte, sql as sql4 } from "drizzle-orm";
-var JOB_WORKER_OPTIONS = /* @__PURE__ */ Symbol("JOB_WORKER_OPTIONS");
+var JOB_WORKER_OPTIONS = Symbol.for(tokenKey("jobs", "worker-options"));
 var DEFAULT_POLL_INTERVAL_MS = 1e3;
 var DEFAULT_STALE_SWEEPER_INTERVAL_MS = 6e4;
 var DEFAULT_STALE_THRESHOLD_MS = 5 * 6e4;
@@ -2428,7 +2432,7 @@ JobWorker = __decorateClass([
 
 // runtime/subsystems/jobs/job-worker.module.ts
 var DEFAULT_SHUTDOWN_TIMEOUT_MS2 = 3e4;
-var JOB_WORKER_MODULE_OPTIONS = /* @__PURE__ */ Symbol("JOB_WORKER_MODULE_OPTIONS");
+var JOB_WORKER_MODULE_OPTIONS = Symbol.for(tokenKey("jobs", "worker-module-options"));
 var JobWorkerOrchestrator = class {
   constructor(orchestrator, runService, stepService, options, db = null, moduleRef, bullConnection = null, bullConfig = null) {
     this.orchestrator = orchestrator;
@@ -3090,6 +3094,7 @@ import { Inject as Inject9, Injectable as Injectable10, Logger as Logger5, Optio
 
 // runtime/subsystems/events/events.tokens.ts
 var EVENT_BUS = "EVENT_BUS";
+var REDIS_URL = Symbol.for(tokenKey("events", "redis-url"));
 
 // runtime/subsystems/bridge/bridge-delivery-handler.ts
 var BRIDGE_DELIVERY_JOB_TYPE = "@framework/bridge_delivery";