@pattern-stack/codegen 0.14.0 → 0.14.2

package/CHANGELOG.md

@@ -4,6 +4,51 @@ All notable changes to this project will be documented in this file.
 
 ## [Unreleased]
 
+## [0.14.2] — 2026-06-02
+
+Package-mode bridge fixes — the two gaps that left the event→job bridge wired but
+inert when the runtime is consumed from the package (`runtime: package`, ADR-037)
+rather than vendored. Both are follow-ons to 0.14.1's package-mode subsystem
+support. Vendored mode is unchanged; these are additive.
+
+### Fixed
+
+- **Embedded worker now drains the reserved `events_*` bridge pools.** The
+  subsystem barrel emitted `JobWorkerModule.forRoot({ mode: 'embedded' })` with no
+  pool list, so the in-process worker polled only `interactive` + `batch` and
+  bridge wrappers sat pending forever (the BRIDGE-8 footgun, just past the boot
+  guard). When `bridge` is in `subsystems.install`, the embedded worker now
+  defaults to `allPools: true` (every lane in-process — exactly the knob
+  `BridgeModule`'s reserved-pool guard short-circuits on).
+- **A package-mode consumer's `@JobHandler.triggers` now bind.** Previously
+  `BridgeModule` hardwired the bundled `./generated/registry` placeholder (frozen
+  `{}` inside the package), and the registry generator skipped entirely in package
+  mode (it gated on a vendored `bridge.protocol.ts` that doesn't exist), so no
+  event ever routed to a job. The registry is now generated into the consumer's
+  `src/generated/bridge-registry.ts` (type imported from
+  `@pattern-stack/codegen/runtime/subsystems/bridge/index`, install gated on
+  `subsystems.install`) and threaded into `BridgeModule.forRoot({ registry })` by
+  the barrel. `subsystem install bridge` drops an empty-registry stub so the
+  import never dangles before the next `entity new`.
+
+### Added
+
+- **`BridgeModuleOptions.registry?: BridgeRegistry`** — lets the generated barrel
+  supply the consumer's scanned registry. Omitted ⇒ falls back to the bundled
+  `./generated/registry` (which IS the consumer's generated file in vendored
+  mode), so existing consumers and tests are unaffected.
+- **`jobs.worker_pools: string[]` and `jobs.all_pools: true`** config knobs on the
+  embedded worker. Precedence: explicit `worker_pools` (→ `pools: [...]`) >
+  `all_pools` (→ `allPools: true`) > bridge-installed default (`allPools: true`) >
+  the non-reserved default (unchanged).
+
+### Known gaps
+
+- Package-mode trigger-event **validation** against the events registry is skipped
+  (the event codegen generator is not yet mode-aware, so its registry isn't found
+  under the package-mode generated path). Triggers still generate and bind; only
+  the build-time "unknown event" check is inert. Tracked for a follow-on.
+
 ## [0.13.0] — 2026-05-31
 
 Track D round-2/3 — the integration codegen now emits the **full** integration

package/dist/runtime/subsystems/bridge/bridge-delivery.memory-backend.d.ts

@@ -22,7 +22,7 @@ declare class MemoryBridgeDeliveryRepo implements IJobBridge {
      * Unlike `insertDelivery`, this read does NOT call `assertTenantId`:
      * `tenantId === undefined` is the supported cross-tenant admin view.
      */
-    getStatusHistogram(windowHours: number, tenantId?: string | null): Promise<StatusHistogram>;
+    getStatusHistogram(windowHours: number, tenantId?: string | null, nowMs?: number): Promise<StatusHistogram>;
     /** All deliveries for a given event (any status, declaration order). */
     getDeliveriesForEvent(eventId: string): BridgeDeliveryRecord[];
     /** All deliveries currently in the given status. */

package/dist/runtime/subsystems/bridge/bridge-delivery.memory-backend.js

@@ -80,11 +80,11 @@ var MemoryBridgeDeliveryRepo = class {
    * Unlike `insertDelivery`, this read does NOT call `assertTenantId`:
    * `tenantId === undefined` is the supported cross-tenant admin view.
    */
-  async getStatusHistogram(windowHours, tenantId) {
+  async getStatusHistogram(windowHours, tenantId, nowMs = Date.now()) {
     if (!Number.isFinite(windowHours) || windowHours <= 0) {
       throw new RangeError("windowHours must be positive");
     }
-    const cutoffMs = Date.now() - windowHours * 36e5;
+    const cutoffMs = nowMs - windowHours * 36e5;
     const histogram = {
       pending: 0,
       delivered: 0,

package/dist/runtime/subsystems/bridge/bridge-delivery.memory-backend.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../runtime/subsystems/bridge/bridge-delivery.memory-backend.ts","../../../../runtime/subsystems/bridge/bridge-errors.ts"],"sourcesContent":["/**\n * MemoryBridgeDeliveryRepo — in-memory `IJobBridge` (BRIDGE-3, ADR-023 Phase 2).\n *\n * Behavioral twin of the Drizzle backend (BRIDGE-4) for use in\n * `just test-unit`. No Docker, no Postgres, fully synchronous. Backs a\n * `Map<\"${eventId}::${triggerId}\", BridgeDeliveryRecord>` so the UNIQUE\n * `(event_id, trigger_id)` constraint can be simulated cheaply.\n *\n * Precedent: `MemoryEventBus` (EVT-5), `MemoryJobOrchestrator`\n * (jobs subsystem). Same shape — a class implementing the protocol plus\n * test-only helpers (`getDeliveriesForEvent`, `getByStatus`, `clear`) that\n * BRIDGE-5's framework-handler tests and BRIDGE-7's facade tests will\n * exercise.\n *\n * The synthetic `UniqueConstraintError` carries a `constraint` field equal\n * to the Drizzle constraint name (`uq_bridge_delivery_event_trigger`, set\n * in BRIDGE-1's schema) so consumers — including BRIDGE-4's\n * `INSERT … ON CONFLICT (event_id, trigger_id) DO NOTHING` path and\n * BRIDGE-7's Case B dedup tests — can branch on the same discriminator\n * regardless of which backend is wired up. ADR-023 explicitly relies on\n * this constraint as the dedup mechanism in two places (replay; facade-\n * vs-drain Case B); a typed error makes both call sites checkable.\n */\nimport { randomUUID } from 'node:crypto';\n\nimport type {\n  BridgeDeliveryInsert,\n  IJobBridge,\n  StatusHistogram,\n} from './bridge.protocol';\nimport type { BridgeDeliveryRecord } from './bridge-delivery.schema';\nimport { UniqueConstraintError } from './bridge-errors';\n\nconst BRIDGE_DELIVERY_UNIQUE_CONSTRAINT =\n  'uq_bridge_delivery_event_trigger' as const;\n\nfunction key(eventId: string, triggerId: string): string {\n  return `${eventId}::${triggerId}`;\n}\n\nexport class MemoryBridgeDeliveryRepo implements IJobBridge {\n  private readonly deliveries = new Map<string, BridgeDeliveryRecord>();\n\n  async insertDelivery(row: BridgeDeliveryInsert): Promise<void> {\n    const k = key(row.eventId, row.triggerId);\n    if (this.deliveries.has(k)) {\n      throw new UniqueConstraintError(\n        BRIDGE_DELIVERY_UNIQUE_CONSTRAINT,\n        row.eventId,\n        row.triggerId,\n      );\n    }\n    // Materialize a full BridgeDeliveryRecord — fill in DB defaults that\n    // the insert payload allowed to be omitted.\n    const record: BridgeDeliveryRecord = {\n      id: row.id ?? randomUUID(),\n      eventId: row.eventId,\n      triggerId: row.triggerId,\n      wrapperRunId: row.wrapperRunId ?? null,\n      userRunId: row.userRunId ?? null,\n      status: row.status ?? 'pending',\n      skipReason: row.skipReason ?? null,\n      error: (row.error as Record<string, unknown> | null | undefined) ?? null,\n      tenantId: row.tenantId ?? null,\n      attemptedAt:\n        row.attemptedAt instanceof Date ? row.attemptedAt : new Date(),\n      deliveredAt:\n        row.deliveredAt instanceof Date ? row.deliveredAt : null,\n    };\n    this.deliveries.set(k, record);\n  }\n\n  async findDelivery(\n    eventId: string,\n    triggerId: string,\n  ): Promise<BridgeDeliveryRecord | null> {\n    return this.deliveries.get(key(eventId, triggerId)) ?? null;\n  }\n\n  async findDeliveryById(id: string): Promise<BridgeDeliveryRecord | null> {\n    for (const record of this.deliveries.values()) {\n      if (record.id === id) return record;\n    }\n    return null;\n  }\n\n  async markDelivered(id: string, userRunId: string): Promise<void> {\n    const record = this.findById(id);\n    record.status = 'delivered';\n    record.userRunId = userRunId;\n    record.deliveredAt = new Date();\n  }\n\n  async markSkipped(id: string, reason: string): Promise<void> {\n    const record = this.findById(id);\n    record.status = 'skipped';\n    record.skipReason = reason;\n  }\n\n  async markFailed(\n    id: string,\n    error: Record<string, unknown>,\n  ): Promise<void> {\n    const record = this.findById(id);\n    record.status = 'failed';\n    record.error = error;\n  }\n\n  /**\n   * Observability read — see `IJobBridge.getStatusHistogram` JSDoc for the\n   * tenant-filter and windowHours contract.\n   *\n   * Unlike `insertDelivery`, this read does NOT call `assertTenantId`:\n   * `tenantId === undefined` is the supported cross-tenant admin view.\n   */\n  async getStatusHistogram(\n    windowHours: number,\n    tenantId?: string | null,\n  ): Promise<StatusHistogram> {\n    if (!Number.isFinite(windowHours) || windowHours <= 0) {\n      throw new RangeError('windowHours must be positive');\n    }\n\n    const cutoffMs = Date.now() - windowHours * 3_600_000;\n    const histogram: StatusHistogram = {\n      pending: 0,\n      delivered: 0,\n      skipped: 0,\n      failed: 0,\n    };\n\n    for (const record of this.deliveries.values()) {\n      if (record.attemptedAt.getTime() < cutoffMs) continue;\n      if (tenantId === null && record.tenantId !== null) continue;\n      if (typeof tenantId === 'string' && record.tenantId !== tenantId) {\n        continue;\n      }\n      // tenantId === undefined → no tenant filter.\n      histogram[record.status] += 1;\n    }\n\n    return histogram;\n  }\n\n  // ─── Test helpers ────────────────────────────────────────────────────────\n\n  /** All deliveries for a given event (any status, declaration order). */\n  getDeliveriesForEvent(eventId: string): BridgeDeliveryRecord[] {\n    return [...this.deliveries.values()].filter((r) => r.eventId === eventId);\n  }\n\n  /** All deliveries currently in the given status. */\n  getByStatus(\n    status: BridgeDeliveryRecord['status'],\n  ): BridgeDeliveryRecord[] {\n    return [...this.deliveries.values()].filter((r) => r.status === status);\n  }\n\n  /** Reset the store. Tests use this in `beforeEach`. */\n  clear(): void {\n    this.deliveries.clear();\n  }\n\n  // ─── Internals ───────────────────────────────────────────────────────────\n\n  private findById(id: string): BridgeDeliveryRecord {\n    for (const record of this.deliveries.values()) {\n      if (record.id === id) return record;\n    }\n    throw new Error(\n      `MemoryBridgeDeliveryRepo: no delivery with id '${id}' (transition ` +\n        `methods may not be called for unknown rows; the framework handler ` +\n        `should always findDelivery first or operate on a row it just ` +\n        `inserted).`,\n    );\n  }\n}\n","/**\n * Typed errors for the bridge subsystem (ADR-023 Phase 2, BRIDGE-2).\n *\n * All thrown by the three enforcement sites named in ADR-023 §Multi-tenancy:\n *   - `EventFlowService.publishAndStart` entry (BRIDGE-7)\n *   - `BridgeDeliveryHandler.handle` entry (BRIDGE-5)\n *   - `DrizzleBridgeDeliveryRepo.insertDelivery` pre-write (BRIDGE-4)\n *\n * Same shape as `runtime/subsystems/jobs/jobs-errors.ts` and\n * `runtime/subsystems/events/events-errors.ts` so consumers can catch them\n * with the same exception-filter pattern across all three subsystems.\n */\n\n/**\n * Thrown when `BridgeModule` was configured with `multiTenant: true` but\n * the caller did not pass a `tenantId` at one of the three enforcement\n * sites listed above.\n *\n * **Strict enforcement rationale (mirrors JOB-8 / SYNC-6 stance, locked\n * 2026-04-18 for jobs; same rationale applies here).** Cross-tenant data\n * leakage is the worst class of bug a multi-tenant system can ship;\n * surfacing the misuse loudly at the call site (rather than silently\n * defaulting to `null` or to \"the last tenant seen\") prevents both\n * accidental global writes and sneaky reads that return a union of tenants.\n *\n * - `undefined` `tenantId` → throw this error.\n * - Explicit `null` `tenantId` → passes; opts the call into cross-tenant\n *   work (e.g. a system housekeeping event with no owning tenant). The\n *   `bridge_delivery` row is persisted with `tenant_id = NULL`.\n *\n * The `callSite` constructor argument names which of the three enforcement\n * sites threw — review reports and ops dashboards rely on a stable site\n * name, so use the canonical strings: `'EventFlowService.publishAndStart'`,\n * `'BridgeDeliveryHandler.handle'`,\n * `'DrizzleBridgeDeliveryRepo.insertDelivery'`.\n */\nexport class MissingTenantIdError extends Error {\n  override readonly name = 'MissingTenantIdError';\n  constructor(public readonly callSite: string) {\n    super(\n      `MissingTenantIdError: BridgeModule was configured with ` +\n        `multiTenant=true but ${callSite} was called without tenantId ` +\n        `(undefined). Pass an explicit tenantId, or pass null for ` +\n        `cross-tenant work.`,\n    );\n  }\n}\n\n/**\n * Synthetic error thrown by `MemoryBridgeDeliveryRepo.insertDelivery` when\n * a duplicate `(event_id, trigger_id)` insert hits the simulated UNIQUE\n * constraint (BRIDGE-3).\n *\n * Carries a `constraint` field equal to the Drizzle constraint name\n * declared in BRIDGE-1's schema (`uq_bridge_delivery_event_trigger`) so\n * call sites can branch on the same discriminator regardless of which\n * backend is wired up. This matters because ADR-023 explicitly leans on\n * the constraint as the dedup mechanism in two places — outbox replay\n * and `publishAndStart` Case B — and BRIDGE-4 / BRIDGE-7 will share a\n * type-check path with BRIDGE-3-driven tests.\n *\n * The Drizzle backend (BRIDGE-4) does NOT throw this error: it uses\n * `INSERT … ON CONFLICT (event_id, trigger_id) DO NOTHING RETURNING id`\n * per the BRIDGE-4 spec recommendation, so collisions surface as an empty\n * result set rather than an exception. The error exists so the memory\n * backend can faithfully model the \"duplicate raises\" behaviour for tests\n * that want to assert the constraint actually fires.\n */\n/**\n * Thrown by `BridgeModule.onModuleInit` when `JobWorkerModule` is wired\n * alongside the bridge but its active `pools` list does not include one\n * or more of the three reserved bridge pools (`events_inbound`,\n * `events_change`, `events_outbound`).\n *\n * Without a worker polling those pools, the wrapper `job_run` rows the\n * outbox drain inserts (BRIDGE-4) sit `pending` forever — a silent\n * footgun where `eventFlow.publish(...)` returns success but no user\n * job ever spawns. The boot-time check converts that into a fail-fast.\n *\n * Operators can either (a) add `...BRIDGE_RESERVED_POOLS` to their\n * `JobWorkerModule.forRoot({ pools })` configuration so the same\n * process polls the reserved pools, or (b) run a separate worker\n * process per reserved pool for lane isolation (ADR-022 §Pool\n * isolation).\n */\nexport class BridgeReservedPoolsNotPolledError extends Error {\n  override readonly name = 'BridgeReservedPoolsNotPolledError';\n  constructor(public readonly missingPools: readonly string[]) {\n    super(\n      `BridgeModule loaded but JobWorkerModule is not polling reserved ` +\n        `pool '${missingPools[0]}'. Add ...BRIDGE_RESERVED_POOLS to your ` +\n        `JobWorkerModule.forRoot({ pools }) configuration. Missing pools: ` +\n        `${missingPools.join(', ')}. (Bridge-fanout wrappers will sit ` +\n        `pending forever without these pollers.)`,\n    );\n  }\n}\n\nexport class UniqueConstraintError extends Error {\n  override readonly name = 'UniqueConstraintError';\n  constructor(\n    public readonly constraint: string,\n    public readonly eventId: string,\n    public readonly triggerId: string,\n  ) {\n    super(\n      `UniqueConstraintError: duplicate insert into bridge_delivery for ` +\n        `(event_id='${eventId}', trigger_id='${triggerId}') — violates ` +\n        `constraint '${constraint}'.`,\n    );\n  }\n}\n"],"mappings":";AAuBA,SAAS,kBAAkB;;;AC2EpB,IAAM,wBAAN,cAAoC,MAAM;AAAA,EAE/C,YACkB,YACA,SACA,WAChB;AACA;AAAA,MACE,+EACgB,OAAO,kBAAkB,SAAS,kCACjC,UAAU;AAAA,IAC7B;AARgB;AACA;AACA;AAAA,EAOlB;AAAA,EATkB;AAAA,EACA;AAAA,EACA;AAAA,EAJA,OAAO;AAY3B;;;AD9EA,IAAM,oCACJ;AAEF,SAAS,IAAI,SAAiB,WAA2B;AACvD,SAAO,GAAG,OAAO,KAAK,SAAS;AACjC;AAEO,IAAM,2BAAN,MAAqD;AAAA,EACzC,aAAa,oBAAI,IAAkC;AAAA,EAEpE,MAAM,eAAe,KAA0C;AAC7D,UAAM,IAAI,IAAI,IAAI,SAAS,IAAI,SAAS;AACxC,QAAI,KAAK,WAAW,IAAI,CAAC,GAAG;AAC1B,YAAM,IAAI;AAAA,QACR;AAAA,QACA,IAAI;AAAA,QACJ,IAAI;AAAA,MACN;AAAA,IACF;AAGA,UAAM,SAA+B;AAAA,MACnC,IAAI,IAAI,MAAM,WAAW;AAAA,MACzB,SAAS,IAAI;AAAA,MACb,WAAW,IAAI;AAAA,MACf,cAAc,IAAI,gBAAgB;AAAA,MAClC,WAAW,IAAI,aAAa;AAAA,MAC5B,QAAQ,IAAI,UAAU;AAAA,MACtB,YAAY,IAAI,cAAc;AAAA,MAC9B,OAAQ,IAAI,SAAwD;AAAA,MACpE,UAAU,IAAI,YAAY;AAAA,MAC1B,aACE,IAAI,uBAAuB,OAAO,IAAI,cAAc,oBAAI,KAAK;AAAA,MAC/D,aACE,IAAI,uBAAuB,OAAO,IAAI,cAAc;AAAA,IACxD;AACA,SAAK,WAAW,IAAI,GAAG,MAAM;AAAA,EAC/B;AAAA,EAEA,MAAM,aACJ,SACA,WACsC;AACtC,WAAO,KAAK,WAAW,IAAI,IAAI,SAAS,SAAS,CAAC,KAAK;AAAA,EACzD;AAAA,EAEA,MAAM,iBAAiB,IAAkD;AACvE,eAAW,UAAU,KAAK,WAAW,OAAO,GAAG;AAC7C,UAAI,OAAO,OAAO,GAAI,QAAO;AAAA,IAC/B;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,cAAc,IAAY,WAAkC;AAChE,UAAM,SAAS,KAAK,SAAS,EAAE;AAC/B,WAAO,SAAS;AAChB,WAAO,YAAY;AACnB,WAAO,cAAc,oBAAI,KAAK;AAAA,EAChC;AAAA,EAEA,MAAM,YAAY,IAAY,QAA+B;AAC3D,UAAM,SAAS,KAAK,SAAS,EAAE;AAC/B,WAAO,SAAS;AAChB,WAAO,aAAa;AAAA,EACtB;AAAA,EAEA,MAAM,WACJ,IACA,OACe;AACf,UAAM,SAAS,KAAK,SAAS,EAAE;AAC/B,WAAO,SAAS;AAChB,WAAO,QAAQ;AAAA,EACjB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,mBACJ,aACA,UAC0B;AAC1B,QAAI,CAAC,OAAO,SAAS,WAAW,KAAK,eAAe,GAAG;AACrD,YAAM,IAAI,WAAW,8BAA8B;AAAA,IACrD;AAEA,UAAM,WAAW,KAAK,IAAI,IAAI,cAAc;AAC5C,UAAM,YAA6B;AAAA,MACjC,SAAS;AAAA,MACT,WAAW;AAAA,MACX,SAAS;AAAA,MACT,QAAQ;AAAA,IACV;AAEA,eAAW,UAAU,KAAK,WAAW,OAAO,GAAG;AAC7C,UAAI,OAAO,YAAY,QAAQ,IAAI,SAAU;AAC7C,UAAI,aAAa,QAAQ,OAAO,aAAa,KAAM;AACnD,UAAI,OAAO,aAAa,YAAY,OAAO,aAAa,UAAU;AAChE;AAAA,MACF;AAEA,gBAAU,OAAO,MAAM,KAAK;AAAA,IAC9B;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA,EAKA,sBAAsB,SAAyC;AAC7D,WAAO,CAAC,GAAG,KAAK,WAAW,OAAO,CAAC,EAAE,OAAO,CAAC,MAAM,EAAE,YAAY,OAAO;AAAA,EAC1E;AAAA;AAAA,EAGA,YACE,QACwB;AACxB,WAAO,CAAC,GAAG,KAAK,WAAW,OAAO,CAAC,EAAE,OAAO,CAAC,MAAM,EAAE,WAAW,MAAM;AAAA,EACxE;AAAA;AAAA,EAGA,QAAc;AACZ,SAAK,WAAW,MAAM;AAAA,EACxB;AAAA;AAAA,EAIQ,SAAS,IAAkC;AACjD,eAAW,UAAU,KAAK,WAAW,OAAO,GAAG;AAC7C,UAAI,OAAO,OAAO,GAAI,QAAO;AAAA,IAC/B;AACA,UAAM,IAAI;AAAA,MACR,kDAAkD,EAAE;AAAA,IAItD;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../../../runtime/subsystems/bridge/bridge-delivery.memory-backend.ts","../../../../runtime/subsystems/bridge/bridge-errors.ts"],"sourcesContent":["/**\n * MemoryBridgeDeliveryRepo — in-memory `IJobBridge` (BRIDGE-3, ADR-023 Phase 2).\n *\n * Behavioral twin of the Drizzle backend (BRIDGE-4) for use in\n * `just test-unit`. No Docker, no Postgres, fully synchronous. Backs a\n * `Map<\"${eventId}::${triggerId}\", BridgeDeliveryRecord>` so the UNIQUE\n * `(event_id, trigger_id)` constraint can be simulated cheaply.\n *\n * Precedent: `MemoryEventBus` (EVT-5), `MemoryJobOrchestrator`\n * (jobs subsystem). Same shape — a class implementing the protocol plus\n * test-only helpers (`getDeliveriesForEvent`, `getByStatus`, `clear`) that\n * BRIDGE-5's framework-handler tests and BRIDGE-7's facade tests will\n * exercise.\n *\n * The synthetic `UniqueConstraintError` carries a `constraint` field equal\n * to the Drizzle constraint name (`uq_bridge_delivery_event_trigger`, set\n * in BRIDGE-1's schema) so consumers — including BRIDGE-4's\n * `INSERT … ON CONFLICT (event_id, trigger_id) DO NOTHING` path and\n * BRIDGE-7's Case B dedup tests — can branch on the same discriminator\n * regardless of which backend is wired up. ADR-023 explicitly relies on\n * this constraint as the dedup mechanism in two places (replay; facade-\n * vs-drain Case B); a typed error makes both call sites checkable.\n */\nimport { randomUUID } from 'node:crypto';\n\nimport type {\n  BridgeDeliveryInsert,\n  IJobBridge,\n  StatusHistogram,\n} from './bridge.protocol';\nimport type { BridgeDeliveryRecord } from './bridge-delivery.schema';\nimport { UniqueConstraintError } from './bridge-errors';\n\nconst BRIDGE_DELIVERY_UNIQUE_CONSTRAINT =\n  'uq_bridge_delivery_event_trigger' as const;\n\nfunction key(eventId: string, triggerId: string): string {\n  return `${eventId}::${triggerId}`;\n}\n\nexport class MemoryBridgeDeliveryRepo implements IJobBridge {\n  private readonly deliveries = new Map<string, BridgeDeliveryRecord>();\n\n  async insertDelivery(row: BridgeDeliveryInsert): Promise<void> {\n    const k = key(row.eventId, row.triggerId);\n    if (this.deliveries.has(k)) {\n      throw new UniqueConstraintError(\n        BRIDGE_DELIVERY_UNIQUE_CONSTRAINT,\n        row.eventId,\n        row.triggerId,\n      );\n    }\n    // Materialize a full BridgeDeliveryRecord — fill in DB defaults that\n    // the insert payload allowed to be omitted.\n    const record: BridgeDeliveryRecord = {\n      id: row.id ?? randomUUID(),\n      eventId: row.eventId,\n      triggerId: row.triggerId,\n      wrapperRunId: row.wrapperRunId ?? null,\n      userRunId: row.userRunId ?? null,\n      status: row.status ?? 'pending',\n      skipReason: row.skipReason ?? null,\n      error: (row.error as Record<string, unknown> | null | undefined) ?? null,\n      tenantId: row.tenantId ?? null,\n      attemptedAt:\n        row.attemptedAt instanceof Date ? row.attemptedAt : new Date(),\n      deliveredAt:\n        row.deliveredAt instanceof Date ? row.deliveredAt : null,\n    };\n    this.deliveries.set(k, record);\n  }\n\n  async findDelivery(\n    eventId: string,\n    triggerId: string,\n  ): Promise<BridgeDeliveryRecord | null> {\n    return this.deliveries.get(key(eventId, triggerId)) ?? null;\n  }\n\n  async findDeliveryById(id: string): Promise<BridgeDeliveryRecord | null> {\n    for (const record of this.deliveries.values()) {\n      if (record.id === id) return record;\n    }\n    return null;\n  }\n\n  async markDelivered(id: string, userRunId: string): Promise<void> {\n    const record = this.findById(id);\n    record.status = 'delivered';\n    record.userRunId = userRunId;\n    record.deliveredAt = new Date();\n  }\n\n  async markSkipped(id: string, reason: string): Promise<void> {\n    const record = this.findById(id);\n    record.status = 'skipped';\n    record.skipReason = reason;\n  }\n\n  async markFailed(\n    id: string,\n    error: Record<string, unknown>,\n  ): Promise<void> {\n    const record = this.findById(id);\n    record.status = 'failed';\n    record.error = error;\n  }\n\n  /**\n   * Observability read — see `IJobBridge.getStatusHistogram` JSDoc for the\n   * tenant-filter and windowHours contract.\n   *\n   * Unlike `insertDelivery`, this read does NOT call `assertTenantId`:\n   * `tenantId === undefined` is the supported cross-tenant admin view.\n   */\n  async getStatusHistogram(\n    windowHours: number,\n    tenantId?: string | null,\n    // Reference instant for the window cutoff. Defaults to the wall clock; exposed\n    // as a test-injection seam so a caller can pin the cutoff to the same `now` it\n    // positioned a boundary row from. Without it the cutoff is re-sampled here a few\n    // ms later, pushing an \"exactly at the boundary\" row just below the window\n    // (the OBS-3 boundary test flake). The drizzle backend has no analogue — it\n    // evaluates the cutoff once in SQL via `now()`.\n    nowMs: number = Date.now(),\n  ): Promise<StatusHistogram> {\n    if (!Number.isFinite(windowHours) || windowHours <= 0) {\n      throw new RangeError('windowHours must be positive');\n    }\n\n    const cutoffMs = nowMs - windowHours * 3_600_000;\n    const histogram: StatusHistogram = {\n      pending: 0,\n      delivered: 0,\n      skipped: 0,\n      failed: 0,\n    };\n\n    for (const record of this.deliveries.values()) {\n      if (record.attemptedAt.getTime() < cutoffMs) continue;\n      if (tenantId === null && record.tenantId !== null) continue;\n      if (typeof tenantId === 'string' && record.tenantId !== tenantId) {\n        continue;\n      }\n      // tenantId === undefined → no tenant filter.\n      histogram[record.status] += 1;\n    }\n\n    return histogram;\n  }\n\n  // ─── Test helpers ────────────────────────────────────────────────────────\n\n  /** All deliveries for a given event (any status, declaration order). */\n  getDeliveriesForEvent(eventId: string): BridgeDeliveryRecord[] {\n    return [...this.deliveries.values()].filter((r) => r.eventId === eventId);\n  }\n\n  /** All deliveries currently in the given status. */\n  getByStatus(\n    status: BridgeDeliveryRecord['status'],\n  ): BridgeDeliveryRecord[] {\n    return [...this.deliveries.values()].filter((r) => r.status === status);\n  }\n\n  /** Reset the store. Tests use this in `beforeEach`. */\n  clear(): void {\n    this.deliveries.clear();\n  }\n\n  // ─── Internals ───────────────────────────────────────────────────────────\n\n  private findById(id: string): BridgeDeliveryRecord {\n    for (const record of this.deliveries.values()) {\n      if (record.id === id) return record;\n    }\n    throw new Error(\n      `MemoryBridgeDeliveryRepo: no delivery with id '${id}' (transition ` +\n        `methods may not be called for unknown rows; the framework handler ` +\n        `should always findDelivery first or operate on a row it just ` +\n        `inserted).`,\n    );\n  }\n}\n","/**\n * Typed errors for the bridge subsystem (ADR-023 Phase 2, BRIDGE-2).\n *\n * All thrown by the three enforcement sites named in ADR-023 §Multi-tenancy:\n *   - `EventFlowService.publishAndStart` entry (BRIDGE-7)\n *   - `BridgeDeliveryHandler.handle` entry (BRIDGE-5)\n *   - `DrizzleBridgeDeliveryRepo.insertDelivery` pre-write (BRIDGE-4)\n *\n * Same shape as `runtime/subsystems/jobs/jobs-errors.ts` and\n * `runtime/subsystems/events/events-errors.ts` so consumers can catch them\n * with the same exception-filter pattern across all three subsystems.\n */\n\n/**\n * Thrown when `BridgeModule` was configured with `multiTenant: true` but\n * the caller did not pass a `tenantId` at one of the three enforcement\n * sites listed above.\n *\n * **Strict enforcement rationale (mirrors JOB-8 / SYNC-6 stance, locked\n * 2026-04-18 for jobs; same rationale applies here).** Cross-tenant data\n * leakage is the worst class of bug a multi-tenant system can ship;\n * surfacing the misuse loudly at the call site (rather than silently\n * defaulting to `null` or to \"the last tenant seen\") prevents both\n * accidental global writes and sneaky reads that return a union of tenants.\n *\n * - `undefined` `tenantId` → throw this error.\n * - Explicit `null` `tenantId` → passes; opts the call into cross-tenant\n *   work (e.g. a system housekeeping event with no owning tenant). The\n *   `bridge_delivery` row is persisted with `tenant_id = NULL`.\n *\n * The `callSite` constructor argument names which of the three enforcement\n * sites threw — review reports and ops dashboards rely on a stable site\n * name, so use the canonical strings: `'EventFlowService.publishAndStart'`,\n * `'BridgeDeliveryHandler.handle'`,\n * `'DrizzleBridgeDeliveryRepo.insertDelivery'`.\n */\nexport class MissingTenantIdError extends Error {\n  override readonly name = 'MissingTenantIdError';\n  constructor(public readonly callSite: string) {\n    super(\n      `MissingTenantIdError: BridgeModule was configured with ` +\n        `multiTenant=true but ${callSite} was called without tenantId ` +\n        `(undefined). Pass an explicit tenantId, or pass null for ` +\n        `cross-tenant work.`,\n    );\n  }\n}\n\n/**\n * Synthetic error thrown by `MemoryBridgeDeliveryRepo.insertDelivery` when\n * a duplicate `(event_id, trigger_id)` insert hits the simulated UNIQUE\n * constraint (BRIDGE-3).\n *\n * Carries a `constraint` field equal to the Drizzle constraint name\n * declared in BRIDGE-1's schema (`uq_bridge_delivery_event_trigger`) so\n * call sites can branch on the same discriminator regardless of which\n * backend is wired up. This matters because ADR-023 explicitly leans on\n * the constraint as the dedup mechanism in two places — outbox replay\n * and `publishAndStart` Case B — and BRIDGE-4 / BRIDGE-7 will share a\n * type-check path with BRIDGE-3-driven tests.\n *\n * The Drizzle backend (BRIDGE-4) does NOT throw this error: it uses\n * `INSERT … ON CONFLICT (event_id, trigger_id) DO NOTHING RETURNING id`\n * per the BRIDGE-4 spec recommendation, so collisions surface as an empty\n * result set rather than an exception. The error exists so the memory\n * backend can faithfully model the \"duplicate raises\" behaviour for tests\n * that want to assert the constraint actually fires.\n */\n/**\n * Thrown by `BridgeModule.onModuleInit` when `JobWorkerModule` is wired\n * alongside the bridge but its active `pools` list does not include one\n * or more of the three reserved bridge pools (`events_inbound`,\n * `events_change`, `events_outbound`).\n *\n * Without a worker polling those pools, the wrapper `job_run` rows the\n * outbox drain inserts (BRIDGE-4) sit `pending` forever — a silent\n * footgun where `eventFlow.publish(...)` returns success but no user\n * job ever spawns. The boot-time check converts that into a fail-fast.\n *\n * Operators can either (a) add `...BRIDGE_RESERVED_POOLS` to their\n * `JobWorkerModule.forRoot({ pools })` configuration so the same\n * process polls the reserved pools, or (b) run a separate worker\n * process per reserved pool for lane isolation (ADR-022 §Pool\n * isolation).\n */\nexport class BridgeReservedPoolsNotPolledError extends Error {\n  override readonly name = 'BridgeReservedPoolsNotPolledError';\n  constructor(public readonly missingPools: readonly string[]) {\n    super(\n      `BridgeModule loaded but JobWorkerModule is not polling reserved ` +\n        `pool '${missingPools[0]}'. Add ...BRIDGE_RESERVED_POOLS to your ` +\n        `JobWorkerModule.forRoot({ pools }) configuration. Missing pools: ` +\n        `${missingPools.join(', ')}. (Bridge-fanout wrappers will sit ` +\n        `pending forever without these pollers.)`,\n    );\n  }\n}\n\nexport class UniqueConstraintError extends Error {\n  override readonly name = 'UniqueConstraintError';\n  constructor(\n    public readonly constraint: string,\n    public readonly eventId: string,\n    public readonly triggerId: string,\n  ) {\n    super(\n      `UniqueConstraintError: duplicate insert into bridge_delivery for ` +\n        `(event_id='${eventId}', trigger_id='${triggerId}') — violates ` +\n        `constraint '${constraint}'.`,\n    );\n  }\n}\n"],"mappings":";AAuBA,SAAS,kBAAkB;;;AC2EpB,IAAM,wBAAN,cAAoC,MAAM;AAAA,EAE/C,YACkB,YACA,SACA,WAChB;AACA;AAAA,MACE,+EACgB,OAAO,kBAAkB,SAAS,kCACjC,UAAU;AAAA,IAC7B;AARgB;AACA;AACA;AAAA,EAOlB;AAAA,EATkB;AAAA,EACA;AAAA,EACA;AAAA,EAJA,OAAO;AAY3B;;;AD9EA,IAAM,oCACJ;AAEF,SAAS,IAAI,SAAiB,WAA2B;AACvD,SAAO,GAAG,OAAO,KAAK,SAAS;AACjC;AAEO,IAAM,2BAAN,MAAqD;AAAA,EACzC,aAAa,oBAAI,IAAkC;AAAA,EAEpE,MAAM,eAAe,KAA0C;AAC7D,UAAM,IAAI,IAAI,IAAI,SAAS,IAAI,SAAS;AACxC,QAAI,KAAK,WAAW,IAAI,CAAC,GAAG;AAC1B,YAAM,IAAI;AAAA,QACR;AAAA,QACA,IAAI;AAAA,QACJ,IAAI;AAAA,MACN;AAAA,IACF;AAGA,UAAM,SAA+B;AAAA,MACnC,IAAI,IAAI,MAAM,WAAW;AAAA,MACzB,SAAS,IAAI;AAAA,MACb,WAAW,IAAI;AAAA,MACf,cAAc,IAAI,gBAAgB;AAAA,MAClC,WAAW,IAAI,aAAa;AAAA,MAC5B,QAAQ,IAAI,UAAU;AAAA,MACtB,YAAY,IAAI,cAAc;AAAA,MAC9B,OAAQ,IAAI,SAAwD;AAAA,MACpE,UAAU,IAAI,YAAY;AAAA,MAC1B,aACE,IAAI,uBAAuB,OAAO,IAAI,cAAc,oBAAI,KAAK;AAAA,MAC/D,aACE,IAAI,uBAAuB,OAAO,IAAI,cAAc;AAAA,IACxD;AACA,SAAK,WAAW,IAAI,GAAG,MAAM;AAAA,EAC/B;AAAA,EAEA,MAAM,aACJ,SACA,WACsC;AACtC,WAAO,KAAK,WAAW,IAAI,IAAI,SAAS,SAAS,CAAC,KAAK;AAAA,EACzD;AAAA,EAEA,MAAM,iBAAiB,IAAkD;AACvE,eAAW,UAAU,KAAK,WAAW,OAAO,GAAG;AAC7C,UAAI,OAAO,OAAO,GAAI,QAAO;AAAA,IAC/B;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,cAAc,IAAY,WAAkC;AAChE,UAAM,SAAS,KAAK,SAAS,EAAE;AAC/B,WAAO,SAAS;AAChB,WAAO,YAAY;AACnB,WAAO,cAAc,oBAAI,KAAK;AAAA,EAChC;AAAA,EAEA,MAAM,YAAY,IAAY,QAA+B;AAC3D,UAAM,SAAS,KAAK,SAAS,EAAE;AAC/B,WAAO,SAAS;AAChB,WAAO,aAAa;AAAA,EACtB;AAAA,EAEA,MAAM,WACJ,IACA,OACe;AACf,UAAM,SAAS,KAAK,SAAS,EAAE;AAC/B,WAAO,SAAS;AAChB,WAAO,QAAQ;AAAA,EACjB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,mBACJ,aACA,UAOA,QAAgB,KAAK,IAAI,GACC;AAC1B,QAAI,CAAC,OAAO,SAAS,WAAW,KAAK,eAAe,GAAG;AACrD,YAAM,IAAI,WAAW,8BAA8B;AAAA,IACrD;AAEA,UAAM,WAAW,QAAQ,cAAc;AACvC,UAAM,YAA6B;AAAA,MACjC,SAAS;AAAA,MACT,WAAW;AAAA,MACX,SAAS;AAAA,MACT,QAAQ;AAAA,IACV;AAEA,eAAW,UAAU,KAAK,WAAW,OAAO,GAAG;AAC7C,UAAI,OAAO,YAAY,QAAQ,IAAI,SAAU;AAC7C,UAAI,aAAa,QAAQ,OAAO,aAAa,KAAM;AACnD,UAAI,OAAO,aAAa,YAAY,OAAO,aAAa,UAAU;AAChE;AAAA,MACF;AAEA,gBAAU,OAAO,MAAM,KAAK;AAAA,IAC9B;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA,EAKA,sBAAsB,SAAyC;AAC7D,WAAO,CAAC,GAAG,KAAK,WAAW,OAAO,CAAC,EAAE,OAAO,CAAC,MAAM,EAAE,YAAY,OAAO;AAAA,EAC1E;AAAA;AAAA,EAGA,YACE,QACwB;AACxB,WAAO,CAAC,GAAG,KAAK,WAAW,OAAO,CAAC,EAAE,OAAO,CAAC,MAAM,EAAE,WAAW,MAAM;AAAA,EACxE;AAAA;AAAA,EAGA,QAAc;AACZ,SAAK,WAAW,MAAM;AAAA,EACxB;AAAA;AAAA,EAIQ,SAAS,IAAkC;AACjD,eAAW,UAAU,KAAK,WAAW,OAAO,GAAG;AAC7C,UAAI,OAAO,OAAO,GAAI,QAAO;AAAA,IAC/B;AACA,UAAM,IAAI;AAAA,MACR,kDAAkD,EAAE;AAAA,IAItD;AAAA,EACF;AACF;","names":[]}

package/dist/runtime/subsystems/bridge/bridge.module.d.ts

@@ -1,5 +1,6 @@
 import { OnModuleInit, DynamicModule } from '@nestjs/common';
 import { JobWorkerModuleOptions } from '../jobs/job-worker.module.js';
+import { BridgeRegistry } from './bridge.protocol.js';
 import '@nestjs/core';
 import '../../types/drizzle.js';
 import 'drizzle-orm/node-postgres';
@@ -15,6 +16,7 @@ import '../events/generated/types.js';
 import '../jobs/job-run-service.protocol.js';
 import '../jobs/job-step-service.protocol.js';
 import '../jobs/job-worker.js';
+import './bridge-delivery.schema.js';
 
 /**
  * BridgeModule — `DynamicModule.forRoot({ backend, multiTenant })`
@@ -75,6 +77,26 @@ interface BridgeModuleOptions {
      * `null` always passes (cross-tenant work). Defaults to `false`.
      */
     multiTenant?: boolean;
+    /**
+     * The codegen-emitted `Record<EventTypeName, BridgeTriggerEntry[]>` that
+     * drives outbox-drain trigger lookup (BRIDGE-4) and the facade's Case B
+     * dedup (BRIDGE-7).
+     *
+     * **Package mode (ADR-037).** When the runtime is imported from
+     * `@pattern-stack/codegen` (not vendored), the bundled
+     * `./generated/registry` is a frozen empty placeholder (`{}`) — a
+     * consumer's `@JobHandler.triggers` are scanned into a registry that lives
+     * in THEIR `src/generated/bridge-registry.ts`, which the package can't
+     * import. The generated subsystem barrel therefore threads that registry in
+     * here: `BridgeModule.forRoot({ ..., registry: bridgeRegistry })`. Omitted
+     * (vendored mode / tests) ⇒ falls back to the bundled `./generated/registry`,
+     * which in vendored mode IS the consumer's freshly-generated file.
+     *
+     * Without this, package-mode consumers' triggers never bind and the bridge
+     * routes nothing (the "wrappers sit pending" footgun's silent twin —
+     * nothing is ever enqueued in the first place).
+     */
+    registry?: BridgeRegistry;
 }
 declare class BridgeModule implements OnModuleInit {
     private readonly workerOpts?;