@remit/backend 0.0.144 → 0.0.145

package/dist/src/serve.js

@@ -0,0 +1,117 @@
+import { redactCalendarFeedPath } from "@remit/calendar-service";
+import { logger, withLogContext } from "@remit/logger";
+import { api } from "./api.js";
+import { defaultErrorCode, handleError } from "./error.js";
+import { normalizeRequest } from "./request.js";
+import { envelopeHeaders } from "./response.js";
+const unauthenticated = () => ({
+    statusCode: 401,
+    body: { code: defaultErrorCode(401), message: "Unauthorized" },
+});
+const isDefined = (value) => value !== undefined;
+const entriesOf = (record) => Object.entries(record).flatMap(([key, value]) => isDefined(value) ? [[key, value]] : []);
+/**
+ * Register a host's operations and return the two ways in: a normalised
+ * request, or a Fetch `Request`. Each request's host supplies the client, and
+ * the client's queues must cover every operation in the registry.
+ */
+export const serveApi = (registry) => {
+    api.register({
+        ...Object.fromEntries(entriesOf(registry.handlers).map(([operationId, handler]) => [
+            operationId,
+            async (c, host) => {
+                const identity = await host.identity();
+                if (identity.kind === "anonymous")
+                    return unauthenticated();
+                return handler(c, {
+                    client: await host.client(),
+                    identity,
+                    config: host.config,
+                });
+            },
+        ])),
+        ...Object.fromEntries(entriesOf(registry.publicHandlers).map(([operationId, handler]) => [
+            operationId,
+            async (c, host) => handler(c, { client: await host.client(), config: host.config }),
+        ])),
+    });
+    return { dispatch, handleFetch };
+};
+const readHeader = (headers, name) => {
+    for (const [key, value] of Object.entries(headers ?? {})) {
+        if (key.toLowerCase() === name && typeof value === "string")
+            return value;
+    }
+    return undefined;
+};
+const dispatch = async (request, host, correlationId) => {
+    // A calendar feed carries its credential in the path, so the raw path is a
+    // secret and cannot be a log field (issue #1065). Redacted once, here, where
+    // every line inside the request picks it up from the scope.
+    const path = redactCalendarFeedPath(request.path);
+    const { method } = request;
+    return withLogContext({ path, method }, async () => {
+        logger.debug({ method, path }, "Request received");
+        const startedAt = Date.now();
+        const answered = await api
+            .handleRequest(request, host)
+            .catch(handleError);
+        const result = {
+            ...answered,
+            headers: {
+                ...envelopeHeaders({
+                    origin: readHeader(request.headers, "origin"),
+                    allowedOrigins: host.config.corsAllowedOrigins,
+                    correlationId,
+                }),
+                ...answered.headers,
+            },
+        };
+        // One structured access line per request: method, path, status, and
+        // duration. The correlation id is inlined as a top-level field so a bug
+        // report quoting the id can grep logs by it directly, and emitted at
+        // info so it is on by default in production (the debug "Request
+        // received" above already filters out under normal log levels).
+        // biome-ignore lint/plugin/no-logger-info: one access line per request is an audit-grade signal (issue #1054)
+        logger.info({
+            method,
+            path,
+            statusCode: result.statusCode,
+            durationMs: Date.now() - startedAt,
+            correlationId,
+        }, "Request completed");
+        return result;
+    });
+};
+const queryOf = (params) => {
+    const query = {};
+    for (const [key, value] of params) {
+        query[key] = [...(query[key] ?? []), value];
+    }
+    return query;
+};
+const NULL_BODY_STATUSES = new Set([101, 103, 204, 205, 304]);
+const toFetchResponse = (result) => {
+    const headers = new Headers();
+    for (const [name, value] of Object.entries(result.headers ?? {})) {
+        headers.set(name, String(value));
+    }
+    for (const [name, values] of Object.entries(result.multiValueHeaders ?? {})) {
+        for (const value of values)
+            headers.append(name, String(value));
+    }
+    const body = NULL_BODY_STATUSES.has(result.statusCode) ? null : result.body;
+    return new Response(body, { status: result.statusCode, headers });
+};
+const handleFetch = async (request, host, correlationId) => {
+    const url = new URL(request.url);
+    const body = request.body === null ? null : await request.text();
+    const result = await dispatch(normalizeRequest({
+        method: request.method,
+        path: url.pathname,
+        query: queryOf(url.searchParams),
+        headers: Object.fromEntries(request.headers),
+        body,
+    }), host, correlationId);
+    return toFetchResponse(result);
+};

package/dist/src/service/account-deletion.d.ts

@@ -1,10 +1,8 @@
-import { type SQSClient } from "@aws-sdk/client-sqs";
-import type { AccountItem, IAccountRepository, IConfigImportRepository } from "@remit/data-ports";
+import type { AccountDataPurgeEvent, AccountItem, IAccountRepository, IConfigImportRepository, QueueProducer } from "@remit/data-ports";
 import type { Logger } from "@remit/logger";
 export interface AccountDeletionDeps {
     account: Pick<IAccountRepository, "update">;
-    sqsClient: SQSClient;
-    accountFanoutQueueUrl: string;
+    queue: QueueProducer<AccountDataPurgeEvent>;
     log: Logger;
 }
 export declare const deleteAccount: (deps: AccountDeletionDeps, account: Pick<AccountItem, "accountId" | "accountConfigId">, deletedAt: number) => Promise<void>;

package/dist/src/service/account-deletion.js

@@ -1,16 +1,10 @@
-import { SendMessageCommand } from "@aws-sdk/client-sqs";
 import { readConfigDocument } from "@remit/config-format";
 export const deleteAccount = async (deps, account, deletedAt) => {
     const { accountId, accountConfigId } = account;
     // Purge first: an account whose request never left still reads as not deleted, so it is found and asked for again.
-    await deps.sqsClient.send(new SendMessageCommand({
-        QueueUrl: deps.accountFanoutQueueUrl,
-        MessageBody: JSON.stringify({
-            type: "AccountDataPurge",
-            accountId,
-            accountConfigId,
-        }),
-    }));
+    await deps.queue.send({
+        body: { type: "AccountDataPurge", accountId, accountConfigId },
+    });
     await deps.account.update(accountId, { deletedAt, isActive: false });
     deps.log.info({ accountId, accountConfigId }, "Account data purge initiated");
 };

package/dist/src/service/compose-sqlite.d.ts

@@ -1,2 +1,3 @@
-import { type RemitClient } from "./create-remit-client.js";
+import { type RemitClient, type RemitClientSharedDeps } from "./create-remit-client.js";
+export declare const composeSqliteClient: (shared: RemitClientSharedDeps) => Promise<RemitClient>;
 export declare const buildSqliteClient: () => Promise<RemitClient>;

package/dist/src/service/compose-sqlite.js

@@ -1,11 +1,13 @@
 import { createSqliteRepositories, openSqliteDatabases, sqliteDatabasePathsFromEnv, } from "@remit/drizzle-service";
-import { buildSharedDeps, createRemitClient, } from "./create-remit-client.js";
+import { createRemitClient, } from "./create-remit-client.js";
+import { buildSharedDeps, sqsQueues, sqsQueueUrlsFromEnv, } from "./shared-deps.js";
 // The SQLite adapter composition (RFC 036). Every repo runs on the database
 // that holds its tables: app, tenant mail or tenant search (#1420).
-export const buildSqliteClient = async () => {
+export const composeSqliteClient = async (shared) => {
     const databases = await openSqliteDatabases(sqliteDatabasePathsFromEnv());
     return createRemitClient({
         repositories: createSqliteRepositories(databases),
-        ...buildSharedDeps(),
+        ...shared,
     });
 };
+export const buildSqliteClient = () => composeSqliteClient(buildSharedDeps(sqsQueues(sqsQueueUrlsFromEnv())));

package/dist/src/service/create-remit-client.d.ts

@@ -2,11 +2,12 @@ import type { IAccountConfigRepository, IAccountExportRequestRepository, IAccoun
 import { BodySyncQueueService, BodySyncService, type FilterConfig, FlagQueueService, type IImapConnection, MailboxQueueService, MessageMoveService, OutboxAttachmentService, OutboxQueueService, SpamReportService } from "@remit/mailbox-service";
 import { type SecretsService } from "@remit/secrets-service";
 import type { StorageService } from "@remit/storage-service";
+import type { QueueName, RemitClientQueues } from "./queues.js";
 export interface ConnectionScope {
     getConnection: () => Promise<IImapConnection>;
     disconnect: () => Promise<void>;
 }
-export interface RemitClient {
+export interface RemitClientCore {
     accountConfig: IAccountConfigRepository;
     account: IAccountRepository;
     accountSetting: IAccountSettingRepository;
@@ -36,18 +37,29 @@ export interface RemitClient {
     calendarStore: ICalendarStore;
     storage: StorageService;
     secrets: SecretsService;
-    bodySync: BodySyncService;
-    bodySyncQueue?: BodySyncQueueService;
     placementMove: IMessagePlacementMoveRepository;
     flagPush: IMessageFlagPushRepository;
+    outboxAttachment: OutboxAttachmentService;
+    createConnectionScope: (accountId: string) => Promise<ConnectionScope>;
+}
+export interface SyncQueueServices {
     flagQueue: FlagQueueService;
     mailboxQueue: MailboxQueueService;
     messageMove: MessageMoveService;
-    outboxAttachment: OutboxAttachmentService;
-    outboxQueue: OutboxQueueService;
     spamReport: SpamReportService;
-    createConnectionScope: (accountId: string) => Promise<ConnectionScope>;
 }
+export interface SmtpQueueServices {
+    outboxQueue: OutboxQueueService;
+}
+export interface BodyQueueServices {
+    bodySyncQueue: BodySyncQueueService;
+}
+export interface ReadPathServices {
+    bodySync: BodySyncService;
+}
+export type RemitClient<K extends QueueName = QueueName> = RemitClientCore & {
+    queues: Pick<RemitClientQueues, K>;
+} & ("sync" extends K ? SyncQueueServices : unknown) & ("smtp" extends K ? SmtpQueueServices : unknown) & ("body" extends K ? BodyQueueServices : unknown) & ("sync" | "messageManagement" extends K ? ReadPathServices : unknown);
 export interface RemitClientRepositories {
     accountConfig: IAccountConfigRepository;
     account: IAccountRepository;
@@ -83,13 +95,15 @@ export interface RemitClientRepositories {
 export interface RemitClientSharedDeps {
     storage: StorageService;
     secrets: SecretsService;
-    sqsQueueUrl: string;
-    sqsSmtpQueueUrl: string;
-    bodySyncQueue?: BodySyncQueueService;
+    queues: RemitClientQueues;
 }
 export interface RemitClientDeps extends RemitClientSharedDeps {
     repositories: RemitClientRepositories;
 }
-export declare const buildSharedDeps: () => RemitClientSharedDeps;
-export declare const buildReadPathFilterConfig: (repositories: RemitClientRepositories) => FilterConfig | undefined;
+export declare const buildReadPathFilterConfig: (repositories: Pick<RemitClientRepositories, "filter" | "messageLabel" | "mailbox" | "message" | "threadMessage" | "placementMove" | "address" | "mailboxSpecialUse">, queues: Pick<RemitClientQueues, "messageManagement">) => FilterConfig;
+export declare const createRemitCore: (deps: Omit<RemitClientDeps, "queues">) => RemitClientCore;
+export declare const composeSyncServices: (core: RemitClientCore, queues: Pick<RemitClientQueues, "sync">) => SyncQueueServices;
+export declare const composeSmtpServices: (core: RemitClientCore, queues: Pick<RemitClientQueues, "smtp">) => SmtpQueueServices;
+export declare const composeBodyServices: (queues: Pick<RemitClientQueues, "body">) => BodyQueueServices;
+export declare const composeReadPathServices: (core: RemitClientCore, queues: Pick<RemitClientQueues, "messageManagement">, sync: Pick<SyncQueueServices, "flagQueue">) => ReadPathServices;
 export declare const createRemitClient: (deps: RemitClientDeps) => RemitClient;

package/dist/src/service/create-remit-client.js

@@ -1,9 +1,7 @@
 import { logger } from "@remit/logger";
 import { BodySyncQueueService, BodySyncService, createConnection, FlagPushService, FlagQueueService, MailboxQueueService, MessageMoveService, OutboxAttachmentService, OutboxQueueService, PlacementMoveService, SpamReportService, SyncWarningService, } from "@remit/mailbox-service";
 import { buildFilterConfig } from "@remit/mailbox-service/filter-config";
-import { createCachedDataKeyProvider, createKmsDataKeyProvider, createSecretsService, deserializeEncryptedPayload, FAKE_KMS_KEY_ID, } from "@remit/secrets-service";
-import { createStorageService } from "@remit/storage-service/s3";
-import { env } from "expect-env";
+import { deserializeEncryptedPayload, } from "@remit/secrets-service";
 const buildConnectionScope = (accountService, secretsService) => async (accountId) => {
     const account = await accountService.get(accountId);
     if (!account.passwordHash) {
@@ -36,34 +34,6 @@ const buildConnectionScope = (accountService, secretsService) => async (accountI
     };
     return { getConnection, disconnect };
 };
-// The body queue lives on the worker infra; the API only knows it locally
-// (dev / e2e set SQS_QUEUE_URL_BODY). When unset the read path still returns a
-// retryable 202 — it just cannot re-arm the cue itself.
-const buildBodySyncQueue = () => {
-    const bodyQueueUrl = process.env.SQS_QUEUE_URL_BODY;
-    if (!bodyQueueUrl)
-        return undefined;
-    return new BodySyncQueueService({ sqsQueueUrl: bodyQueueUrl, logger });
-};
-// Everything a RemitClient needs that is chosen from the environment and does
-// not vary by data backend: storage, secrets, the SQS queue URLs, and
-// the optional body-sync queue. Each composition root builds its backend's
-// repositories and merges them with this.
-export const buildSharedDeps = () => {
-    const storage = createStorageService();
-    const kmsKeyId = process.env.KMS_KEY_ID ?? FAKE_KMS_KEY_ID;
-    const dataKeyProvider = createCachedDataKeyProvider(createKmsDataKeyProvider(kmsKeyId));
-    const secrets = createSecretsService(dataKeyProvider);
-    const sqsQueueUrl = env.SQS_QUEUE_URL;
-    const sqsSmtpQueueUrl = process.env.SQS_QUEUE_URL_SMTP ?? sqsQueueUrl;
-    return {
-        storage,
-        secrets,
-        sqsQueueUrl,
-        sqsSmtpQueueUrl,
-        bodySyncQueue: buildBodySyncQueue(),
-    };
-};
 // The read-path body backfill (describeMessage / getRawMessage →
 // fetchAndGetBody) materializes a body that was never sync-synced, and must run
 // the account's standing filters the same way the imap-worker's sync path does.
@@ -73,77 +43,26 @@ export const buildSharedDeps = () => {
 // #223). Only the explicit user-rule half is wired here; heuristic classifier
 // placement stays on the sync path. It shares `buildFilterConfig` with
 // `sync-message-body.ts`, so a filter fires on either (issue #298). Over the
-// message-management queue's
-// local-first PlacementMoveService; filters stay off when that queue is unset.
-export const buildReadPathFilterConfig = (repositories) => {
-    const placementMoveQueueUrl = process.env.SQS_QUEUE_URL_MESSAGE_MGMT;
+// message-management queue's local-first PlacementMoveService.
+export const buildReadPathFilterConfig = (repositories, queues) => {
+    const { messageManagement } = queues;
     return buildFilterConfig({
         filterService: repositories.filter,
         messageLabelService: repositories.messageLabel,
         mailboxService: repositories.mailbox,
-        placementMoveService: placementMoveQueueUrl
-            ? new PlacementMoveService({
-                messageService: repositories.message,
-                threadMessageService: repositories.threadMessage,
-                markerService: repositories.placementMove,
-                addressService: repositories.address,
-                mailboxSpecialUseService: repositories.mailboxSpecialUse,
-                mailboxService: repositories.mailbox,
-                sqsQueueUrl: placementMoveQueueUrl,
-            })
-            : undefined,
+        placementMoveService: new PlacementMoveService({
+            messageService: repositories.message,
+            threadMessageService: repositories.threadMessage,
+            markerService: repositories.placementMove,
+            addressService: repositories.address,
+            mailboxSpecialUseService: repositories.mailboxSpecialUse,
+            mailboxService: repositories.mailbox,
+            queue: messageManagement,
+        }),
     });
 };
-// Backend-neutral composition root: given repositories (from any data-ports
-// implementation) and the shared services, wire the domain and queue services
-// and assemble a RemitClient. Imports neither ElectroDB nor Drizzle — the
-// caller chooses the backend.
-export const createRemitClient = (deps) => {
-    const { repositories, storage, secrets, sqsQueueUrl, sqsSmtpQueueUrl, bodySyncQueue, } = deps;
-    const filterConfig = buildReadPathFilterConfig(repositories);
-    const flagPushService = new FlagPushService({
-        markerService: repositories.flagPush,
-        sqsQueueUrl,
-        logger,
-    });
-    // Shared with the returned `flagQueue` below (issue #302): body sync
-    // auto-marks-read a message from an unsubscribed sender through the exact
-    // same `FlagQueueService.markAsRead` a manual mark-as-read goes through, not
-    // a second instance or a second primitive.
-    const flagQueueService = new FlagQueueService({
-        messageFlagService: repositories.messageFlag,
-        messageService: repositories.message,
-        threadMessageService: repositories.threadMessage,
-        flagPushService,
-        logger,
-    });
-    const messageMoveService = new MessageMoveService({
-        messageService: repositories.message,
-        mailboxService: repositories.mailbox,
-        mailboxSpecialUseService: repositories.mailboxSpecialUse,
-        threadMessageService: repositories.threadMessage,
-        addressService: repositories.address,
-        sqsQueueUrl,
-        logger,
-    });
-    // One instance, shared with the queue service below: the per-draft chain that
-    // makes the attachment cap safe under concurrency lives on it, and a discard
-    // racing an upload has to take the same lock the upload does.
-    const outboxAttachmentService = new OutboxAttachmentService({
-        outboxMessageService: repositories.outboxMessage,
-        outboxAttachmentService: repositories.outboxAttachment,
-        storage,
-    });
-    const bodySync = new BodySyncService(repositories.message, storage, repositories.threadMessage, repositories.address, repositories.envelope, new SyncWarningService(repositories.syncWarning), logger, undefined, filterConfig, undefined, { flagQueueService }, 
-    // The read-path backfill materializes a body the sync path never got to,
-    // so it is a message's first sight as much as the sync pass is — and an
-    // invitation the user opens before background sync must still get its
-    // card (issue #1033, the same argument as the filter wiring above).
-    {
-        calendarSuggestionService: repositories.calendarSuggestion,
-        calendarStore: repositories.calendarStore,
-        filterService: repositories.filter,
-    });
+export const createRemitCore = (deps) => {
+    const { repositories, storage, secrets } = deps;
     return {
         accountConfig: repositories.accountConfig,
         account: repositories.account,
@@ -174,34 +93,96 @@ export const createRemitClient = (deps) => {
         calendarStore: repositories.calendarStore,
         storage,
         secrets,
-        bodySync,
-        bodySyncQueue,
         placementMove: repositories.placementMove,
         flagPush: repositories.flagPush,
-        flagQueue: flagQueueService,
-        mailboxQueue: new MailboxQueueService({
-            mailboxService: repositories.mailbox,
-            sqsQueueUrl,
+        // One instance, shared with the outbox queue service: the per-draft chain
+        // that makes the attachment cap safe under concurrency lives on it, and a
+        // discard racing an upload has to take the same lock the upload does.
+        outboxAttachment: new OutboxAttachmentService({
+            outboxMessageService: repositories.outboxMessage,
+            outboxAttachmentService: repositories.outboxAttachment,
+            storage,
+        }),
+        createConnectionScope: buildConnectionScope(repositories.account, secrets),
+    };
+};
+export const composeSyncServices = (core, queues) => {
+    const flagPushService = new FlagPushService({
+        markerService: core.flagPush,
+        queue: queues.sync,
+        logger,
+    });
+    const messageMove = new MessageMoveService({
+        messageService: core.message,
+        mailboxService: core.mailbox,
+        mailboxSpecialUseService: core.mailboxSpecialUse,
+        threadMessageService: core.threadMessage,
+        addressService: core.address,
+        queue: queues.sync,
+        logger,
+    });
+    return {
+        flagQueue: new FlagQueueService({
+            messageFlagService: core.messageFlag,
+            messageService: core.message,
+            threadMessageService: core.threadMessage,
+            flagPushService,
             logger,
         }),
-        messageMove: messageMoveService,
-        outboxAttachment: outboxAttachmentService,
-        outboxQueue: new OutboxQueueService({
-            outboxMessageService: repositories.outboxMessage,
-            outboxAttachmentService,
-            accountService: repositories.account,
-            sqsSmtpQueueUrl,
+        mailboxQueue: new MailboxQueueService({
+            mailboxService: core.mailbox,
+            queue: queues.sync,
             logger,
         }),
+        messageMove,
         spamReport: new SpamReportService({
-            messageService: repositories.message,
-            addressService: repositories.address,
-            accountService: repositories.account,
-            mailboxSpecialUseService: repositories.mailboxSpecialUse,
-            messageMoveService,
+            messageService: core.message,
+            addressService: core.address,
+            accountService: core.account,
+            mailboxSpecialUseService: core.mailboxSpecialUse,
+            messageMoveService: messageMove,
             flagPushService,
             logger,
         }),
-        createConnectionScope: buildConnectionScope(repositories.account, secrets),
+    };
+};
+export const composeSmtpServices = (core, queues) => ({
+    outboxQueue: new OutboxQueueService({
+        outboxMessageService: core.outboxMessage,
+        outboxAttachmentService: core.outboxAttachment,
+        accountService: core.account,
+        queue: queues.smtp,
+        logger,
+    }),
+});
+export const composeBodyServices = (queues) => ({
+    bodySyncQueue: new BodySyncQueueService({ queue: queues.body, logger }),
+});
+export const composeReadPathServices = (core, queues, sync) => ({
+    // The flag service is the one `flagQueue` is (issue #302): body sync
+    // auto-marks-read a message from an unsubscribed sender through the exact
+    // same `FlagQueueService.markAsRead` a manual mark-as-read goes through.
+    bodySync: new BodySyncService(core.message, core.storage, core.threadMessage, core.address, core.envelope, new SyncWarningService(core.syncWarning), logger, undefined, buildReadPathFilterConfig(core, queues), undefined, { flagQueueService: sync.flagQueue }, 
+    // The read-path backfill materializes a body the sync path never got to,
+    // so it is a message's first sight as much as the sync pass is — and an
+    // invitation the user opens before background sync must still get its
+    // card (issue #1033, the same argument as the filter wiring above).
+    {
+        calendarSuggestionService: core.calendarSuggestion,
+        calendarStore: core.calendarStore,
+        filterService: core.filter,
+    }),
+});
+export const createRemitClient = (deps) => {
+    const { queues } = deps;
+    const core = createRemitCore(deps);
+    const sync = composeSyncServices(core, queues);
+    return {
+        ...core,
+        queues,
+        ...sync,
+        ...composeSmtpServices(core, queues),
+        ...composeBodyServices(queues),
+        ...composeReadPathServices(core, queues, sync),
     };
 };

package/dist/src/service/data-client.js

@@ -30,11 +30,9 @@ const buildRelationalClient = async () => {
     return composition.buildSqliteClient();
 };
 export const getClient = () => {
-    if (!clientPromise) {
-        clientPromise = injected
-            ? Promise.resolve(injected)
-            : buildRelationalClient();
-    }
+    clientPromise ??= injected
+        ? Promise.resolve(injected)
+        : buildRelationalClient();
     return clientPromise;
 };
 /** Reset the singleton and any injected client — test use only. */

package/dist/src/service/export-identity.d.ts

@@ -1,3 +1,4 @@
 import type { ConfigExportIdentity } from "@remit/config-transfer";
+import type { ApiConfig } from "../config/api-config.js";
 /** Who wrote a configuration file, and from where. Provenance only. */
-export declare const exportIdentity: (now?: Date) => ConfigExportIdentity;
+export declare const exportIdentity: (config: Pick<ApiConfig, "updateControlDir" | "publicOrigin">, now?: Date) => ConfigExportIdentity;

package/dist/src/service/export-identity.js

@@ -1,6 +1,5 @@
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
-const DEFAULT_CONTROL_DIR = "/data/control";
 /**
  * The version a file says it was written by. The updater owns this fact: it
  * reads the tag from `.env` and writes it into `state.json`, which is the only
@@ -9,8 +8,7 @@ const DEFAULT_CONTROL_DIR = "/data/control";
  * stamp, and an export says so rather than inventing a version an importing
  * reader would then trust.
  */
-const runningVersion = () => {
-    const dir = process.env.REMIT_UPDATE_CONTROL_DIR ?? DEFAULT_CONTROL_DIR;
+const runningVersion = (dir) => {
     let raw;
     try {
         raw = readFileSync(join(dir, "state.json"), "utf8");
@@ -27,9 +25,9 @@ const runningVersion = () => {
         : "unknown";
 };
 /** Who wrote a configuration file, and from where. Provenance only. */
-export const exportIdentity = (now = new Date()) => ({
+export const exportIdentity = (config, now = new Date()) => ({
     app: "reader",
-    version: runningVersion(),
+    version: runningVersion(config.updateControlDir),
     exportedAt: now.toISOString(),
-    instance: process.env.PUBLIC_ORIGIN ?? "",
+    instance: config.publicOrigin,
 });

package/dist/src/service/fire-and-forget.js

@@ -1,4 +1,3 @@
-import { inspect } from "node:util";
 import { logger } from "@remit/logger";
 /**
  * Run unawaited background work that MUST NOT be able to fail the request that
@@ -32,7 +31,7 @@ export const fireAndForget = async (work, context) => {
             errorName: error?.name,
             errorCode: error?.Code ??
                 error?.code,
-            error: inspect(error),
+            error,
         }, context.message);
     });
 };

package/dist/src/service/organize.d.ts

@@ -117,22 +117,19 @@ export declare const organizePredicateRejection: (predicate: OrganizePredicate)
  */
 export declare const matchOrganize: (deps: OrganizeMatchDeps, accountConfigId: string, predicate: OrganizePredicate, limit?: number, scope?: OrganizeMatchScope) => Promise<OrganizeMatchResult>;
 /** The matcher deps for the running backend/worker. */
-export declare const buildOrganizeMatchDeps: (client: RemitClient) => OrganizeMatchDeps;
+export declare const buildOrganizeMatchDeps: (client: RemitClient<never>) => OrganizeMatchDeps;
 /**
  * The exclusive-move arm of a back-apply, wired exactly like the body-sync
  * placement mover (`sync-message-body.ts`): the local-first
  * {@link PlacementMoveService} over the shared message-management queue. A move
  * commits locally (marker + ThreadMessage + Message row) and enqueues a
  * `PLACEMENT_MOVE_PUSH` for the reconciler; its marker state engine makes a
- * redelivered job idempotent (mirrors #1297). Returns `undefined` when no
- * message-management queue is wired — the same gate body sync uses to keep the
- * move path off — so a move requested in that environment is counted as failed
- * rather than silently dropped (see {@link applyOrganize}).
+ * redelivered job idempotent (mirrors #1297).
  */
-export declare const buildOrganizeMoveService: (client: RemitClient) => PlacementMoveService | undefined;
+export declare const buildOrganizeMoveService: (client: RemitClient<"messageManagement">) => PlacementMoveService;
 export interface ApplyOrganizeDeps {
-    client: RemitClient;
-    moveService?: PlacementMoveService;
+    client: RemitClient<never>;
+    moveService: PlacementMoveService;
 }
 export interface ApplyOrganizeResult {
     applied: number;
@@ -165,9 +162,9 @@ export interface FilterBackApplyResult {
     failures: string[];
 }
 export interface FilterBackApplyDeps {
-    client: RemitClient;
+    client: RemitClient<never>;
     matchDeps: OrganizeMatchDeps;
-    moveService?: PlacementMoveService;
+    moveService: PlacementMoveService;
 }
 /**
  * Run one standing filter over the inbox as if each matching message had just