@voyantjs/distribution 0.20.0 → 0.21.0

package/dist/channel-push/admin-routes.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Admin API for the channel-push operator dashboard.
+ *
+ * Ships the data layer for "channel sync" views per §9 + §10 (Phase D)
+ * + §14.5 — operators want to see (a) which booking links are stuck,
+ * (b) the delivery log per booking, (c) per-channel throttling, and
+ * (d) a one-click retry button. The React surface lives in templates;
+ * this file is the backing API.
+ *
+ * Routes are mounted under `/v1/admin/distribution/channel-push/*`.
+ *
+ *   GET  /links              — counts + filterable list of channel_booking_links
+ *   POST /retry/:bookingId   — drain pending links for one booking
+ *   GET  /deliveries         — webhook_deliveries scoped by booking/channel
+ *   GET  /throttling         — per-channel rate-limited count in last hour
+ *   POST /reconcile/:flow    — manually trigger a reconciler scanner
+ *
+ * Per docs/architecture/channel-push-architecture.md §9 + §14.5.
+ */
+import type { PostgresJsDatabase } from "drizzle-orm/postgres-js";
+import { Hono } from "hono";
+type Env = {
+    Variables: {
+        db: PostgresJsDatabase;
+        userId?: string;
+    };
+};
+export type ChannelPushAdminRoutes = ReturnType<typeof createChannelPushAdminRoutes>;
+export declare function createChannelPushAdminRoutes(): Hono<Env, import("hono/types").BlankSchema, "/">;
+export {};
+//# sourceMappingURL=admin-routes.d.ts.map

package/dist/channel-push/admin-routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-routes.d.ts","sourceRoot":"","sources":["../../src/channel-push/admin-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AACjE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAM3B,KAAK,GAAG,GAAG;IACT,SAAS,EAAE;QACT,EAAE,EAAE,kBAAkB,CAAA;QACtB,MAAM,CAAC,EAAE,MAAM,CAAA;KAChB,CAAA;CACF,CAAA;AAED,MAAM,MAAM,sBAAsB,GAAG,UAAU,CAAC,OAAO,4BAA4B,CAAC,CAAA;AAEpF,wBAAgB,4BAA4B,qDA2J3C"}

package/dist/channel-push/admin-routes.js

@@ -0,0 +1,165 @@
+/**
+ * Admin API for the channel-push operator dashboard.
+ *
+ * Ships the data layer for "channel sync" views per §9 + §10 (Phase D)
+ * + §14.5 — operators want to see (a) which booking links are stuck,
+ * (b) the delivery log per booking, (c) per-channel throttling, and
+ * (d) a one-click retry button. The React surface lives in templates;
+ * this file is the backing API.
+ *
+ * Routes are mounted under `/v1/admin/distribution/channel-push/*`.
+ *
+ *   GET  /links              — counts + filterable list of channel_booking_links
+ *   POST /retry/:bookingId   — drain pending links for one booking
+ *   GET  /deliveries         — webhook_deliveries scoped by booking/channel
+ *   GET  /throttling         — per-channel rate-limited count in last hour
+ *   POST /reconcile/:flow    — manually trigger a reconciler scanner
+ *
+ * Per docs/architecture/channel-push-architecture.md §9 + §14.5.
+ */
+import { infraWebhookDeliveriesTable } from "@voyantjs/db/schema/infra";
+import { and, desc, eq, gte, sql } from "drizzle-orm";
+import { Hono } from "hono";
+import { channelBookingLinks, channels } from "../schema.js";
+import { reconcileAvailability, reconcileBookingLinks, reconcileContent } from "./reconciler.js";
+import { triggerBookingPushForBooking } from "./subscriber.js";
+export function createChannelPushAdminRoutes() {
+    const app = new Hono();
+    // ── GET /links ───────────────────────────────────────────────────
+    // Status counts + filterable list of channel_booking_links. The
+    // dashboard's "channel sync" view consumes this for both the summary
+    // tiles ("X pending, Y failed, Z compensated") and the row table.
+    app.get("/links", async (c) => {
+        const db = c.get("db");
+        const status = c.req.query("status");
+        const channelId = c.req.query("channelId");
+        const bookingId = c.req.query("bookingId");
+        const limit = clampLimit(c.req.query("limit"));
+        const filters = [
+            status ? eq(channelBookingLinks.pushStatus, status) : sql `true`,
+            channelId ? eq(channelBookingLinks.channelId, channelId) : sql `true`,
+            bookingId ? eq(channelBookingLinks.bookingId, bookingId) : sql `true`,
+        ];
+        const rows = await db
+            .select({
+            link: channelBookingLinks,
+            channelName: channels.name,
+            channelKind: channels.kind,
+        })
+            .from(channelBookingLinks)
+            .innerJoin(channels, eq(channelBookingLinks.channelId, channels.id))
+            .where(and(...filters))
+            .orderBy(desc(channelBookingLinks.lastPushAt), desc(channelBookingLinks.createdAt))
+            .limit(limit);
+        const counts = await db
+            .select({
+            status: channelBookingLinks.pushStatus,
+            count: sql `count(*)::int`,
+        })
+            .from(channelBookingLinks)
+            .where(and(...filters))
+            .groupBy(channelBookingLinks.pushStatus);
+        return c.json({
+            data: rows,
+            counts: Object.fromEntries(counts.map((c) => [c.status, c.count])),
+        });
+    });
+    // ── POST /retry/:bookingId ───────────────────────────────────────
+    // Operator-driven retry. Re-resolves push targets, upserts pending
+    // intent rows, and runs processBookingPush inline. Idempotent on
+    // the booking_links unique constraint, so accidental double-clicks
+    // are safe.
+    app.post("/retry/:bookingId", async (c) => {
+        const bookingId = c.req.param("bookingId");
+        try {
+            await triggerBookingPushForBooking(bookingId);
+            return c.json({ data: { ok: true, bookingId } });
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            return c.json({ error: message }, 500);
+        }
+    });
+    // ── GET /deliveries ──────────────────────────────────────────────
+    // Drilldown view: every webhook_deliveries row scoped to a booking,
+    // channel, or both. Used by the "show me what we sent" link in the
+    // dashboard's failure rows.
+    app.get("/deliveries", async (c) => {
+        const db = c.get("db");
+        const bookingId = c.req.query("bookingId");
+        const channelId = c.req.query("channelId");
+        const limit = clampLimit(c.req.query("limit"));
+        const filters = [
+            eq(infraWebhookDeliveriesTable.sourceModule, "distribution"),
+            bookingId
+                ? and(eq(infraWebhookDeliveriesTable.sourceEntityModule, "bookings"), eq(infraWebhookDeliveriesTable.sourceEntityId, bookingId))
+                : sql `true`,
+            channelId ? eq(infraWebhookDeliveriesTable.targetRef, channelId) : sql `true`,
+        ];
+        const rows = (await db
+            .select()
+            .from(infraWebhookDeliveriesTable)
+            .where(and(...filters))
+            .orderBy(desc(infraWebhookDeliveriesTable.createdAt))
+            .limit(limit));
+        return c.json({ data: rows });
+    });
+    // ── GET /throttling ──────────────────────────────────────────────
+    // Per-channel rate-limited count in the last hour. The dashboard
+    // shows a yellow "throttled" badge when any channel has > 0
+    // rate_limited rows in the window. Per §14.5.
+    app.get("/throttling", async (c) => {
+        const db = c.get("db");
+        const sinceMs = Number.parseInt(c.req.query("sinceMs") ?? String(60 * 60 * 1000), 10);
+        const since = new Date(Date.now() - (Number.isFinite(sinceMs) ? sinceMs : 60 * 60 * 1000));
+        const rows = await db
+            .select({
+            channelId: infraWebhookDeliveriesTable.targetRef,
+            count: sql `count(*)::int`,
+        })
+            .from(infraWebhookDeliveriesTable)
+            .where(and(eq(infraWebhookDeliveriesTable.sourceModule, "distribution"), eq(infraWebhookDeliveriesTable.errorClass, "rate_limited"), gte(infraWebhookDeliveriesTable.createdAt, since)))
+            .groupBy(infraWebhookDeliveriesTable.targetRef);
+        return c.json({
+            data: rows.filter((r) => r.channelId != null),
+            sinceMs,
+        });
+    });
+    // ── POST /reconcile/:flow ────────────────────────────────────────
+    // Manual reconciler trigger for ops — useful when a channel comes
+    // back up after a long outage and you don't want to wait for the
+    // next scheduled run. `flow` is one of "bookings", "availability",
+    // "content".
+    app.post("/reconcile/:flow", async (c) => {
+        const flow = c.req.param("flow");
+        try {
+            switch (flow) {
+                case "bookings": {
+                    const result = await reconcileBookingLinks({});
+                    return c.json({ data: result });
+                }
+                case "availability": {
+                    const result = await reconcileAvailability({});
+                    return c.json({ data: result });
+                }
+                case "content": {
+                    const result = await reconcileContent({});
+                    return c.json({ data: result });
+                }
+                default:
+                    return c.json({ error: `unknown flow "${flow}"` }, 400);
+            }
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            return c.json({ error: message }, 500);
+        }
+    });
+    return app;
+}
+function clampLimit(raw) {
+    const parsed = raw ? Number.parseInt(raw, 10) : 50;
+    if (!Number.isFinite(parsed) || parsed <= 0)
+        return 50;
+    return Math.min(parsed, 500);
+}

package/dist/channel-push/availability-push.d.ts

@@ -0,0 +1,76 @@
+/**
+ * Availability-push pipeline.
+ *
+ * Triggered by `availability.slot.changed`. The subscriber upserts a
+ * `channel_availability_push_intents` row per (channel, slot) — concurrent
+ * supersession events collapse to one row via the unique constraint.
+ * The processor (`processAvailabilityPushIntents`) drains intents per
+ * channel, reads the *current* slot state, and dispatches via
+ * `adapter.pushAvailability()`. Stale-event protection comes from
+ * reading current state at processing time, not the event payload.
+ *
+ * Per docs/architecture/channel-push-architecture.md §5 + §12.2.
+ */
+import type { AnyDrizzleDb } from "@voyantjs/db";
+import { channelProductMappings, channels } from "../schema.js";
+import { type ChannelPushDeps } from "./types.js";
+/** Stable string identifier for the availability-push workflow. */
+export declare const CHANNEL_AVAILABILITY_PUSH_WORKFLOW_ID: "channel.availability.push";
+export interface ResolveAllotmentTargetsForSlotInput {
+    slotId: string;
+    productId: string;
+    optionId: string | null;
+}
+/**
+ * Resolve the channels that hold an allotment for this slot/product/option.
+ * Per §7.4 — availability push uses `channel_inventory_allotments` (NOT
+ * `channel_product_mappings`), so channels mapped to the product but
+ * with no per-slot allotment don't receive pushes.
+ *
+ * v1 returns one row per channel that has an active allotment whose
+ * scope matches the slot (by product, optionally by option). Per-slot
+ * targeting via `channel_inventory_allotment_targets` is consulted in a
+ * future iteration; v1 dispatches at allotment-level so any allotment
+ * row covering the product/option triggers a push.
+ */
+export declare function resolveAllotmentTargetsForSlot(db: AnyDrizzleDb, input: ResolveAllotmentTargetsForSlotInput): Promise<Array<{
+    channelId: string;
+    sourceConnectionId: string;
+    mapping: typeof channelProductMappings.$inferSelect;
+    channel: typeof channels.$inferSelect;
+}>>;
+/**
+ * Insert/update an intent row per (channel, slot). The unique
+ * constraint on `(channel_id, slot_id)` collapses concurrent
+ * supersession events to one row; the worker reads the *current* slot
+ * state when it processes, so stale event payloads never propagate.
+ */
+export declare function upsertAvailabilityIntent(db: AnyDrizzleDb, input: {
+    channelId: string;
+    sourceConnectionId: string;
+    slotId: string;
+    productId: string;
+    optionId: string | null;
+    startsAt: Date;
+}): Promise<void>;
+export interface ProcessAvailabilityPushInput {
+    /** When set, drain intents only for this channel. Otherwise drain all. */
+    channelId?: string;
+    /** Max intents to process per call (across all channels). Default 100. */
+    limit?: number;
+}
+export interface ProcessAvailabilityPushResult {
+    attempted: number;
+    succeeded: number;
+    failed: number;
+    skipped: number;
+}
+/**
+ * Drain pending availability intents. Reads CURRENT slot state for each
+ * intent (so superseded values never propagate). On success, deletes the
+ * intent row. On failure, increments `attempts` and stamps `last_error`.
+ *
+ * Per §5.3 + §12.2.
+ */
+export declare function processAvailabilityPushIntents(input?: ProcessAvailabilityPushInput, deps?: ChannelPushDeps): Promise<ProcessAvailabilityPushResult>;
+//# sourceMappingURL=availability-push.d.ts.map

package/dist/channel-push/availability-push.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"availability-push.d.ts","sourceRoot":"","sources":["../../src/channel-push/availability-push.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAQH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAIhD,OAAO,EAGL,sBAAsB,EACtB,QAAQ,EACT,MAAM,cAAc,CAAA;AAGrB,OAAO,EAAE,KAAK,eAAe,EAA4C,MAAM,YAAY,CAAA;AAE3F,mEAAmE;AACnE,eAAO,MAAM,qCAAqC,EAAG,2BAAoC,CAAA;AAEzF,MAAM,WAAW,mCAAmC;IAClD,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CACxB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,8BAA8B,CAClD,EAAE,EAAE,YAAY,EAChB,KAAK,EAAE,mCAAmC,GACzC,OAAO,CACR,KAAK,CAAC;IACJ,SAAS,EAAE,MAAM,CAAA;IACjB,kBAAkB,EAAE,MAAM,CAAA;IAC1B,OAAO,EAAE,OAAO,sBAAsB,CAAC,YAAY,CAAA;IACnD,OAAO,EAAE,OAAO,QAAQ,CAAC,YAAY,CAAA;CACtC,CAAC,CACH,CAkDA;AAED;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAC5C,EAAE,EAAE,YAAY,EAChB,KAAK,EAAE;IACL,SAAS,EAAE,MAAM,CAAA;IACjB,kBAAkB,EAAE,MAAM,CAAA;IAC1B,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,QAAQ,EAAE,IAAI,CAAA;CACf,GACA,OAAO,CAAC,IAAI,CAAC,CAsBf;AAED,MAAM,WAAW,4BAA4B;IAC3C,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,0EAA0E;IAC1E,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,6BAA6B;IAC5C,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;CAChB;AAED;;;;;;GAMG;AACH,wBAAsB,8BAA8B,CAClD,KAAK,GAAE,4BAAiC,EACxC,IAAI,CAAC,EAAE,eAAe,GACrB,OAAO,CAAC,6BAA6B,CAAC,CA+JxC"}

package/dist/channel-push/availability-push.js

@@ -0,0 +1,238 @@
+/**
+ * Availability-push pipeline.
+ *
+ * Triggered by `availability.slot.changed`. The subscriber upserts a
+ * `channel_availability_push_intents` row per (channel, slot) — concurrent
+ * supersession events collapse to one row via the unique constraint.
+ * The processor (`processAvailabilityPushIntents`) drains intents per
+ * channel, reads the *current* slot state, and dispatches via
+ * `adapter.pushAvailability()`. Stale-event protection comes from
+ * reading current state at processing time, not the event payload.
+ *
+ * Per docs/architecture/channel-push-architecture.md §5 + §12.2.
+ */
+import { availabilitySlots } from "@voyantjs/availability/schema";
+import { AdapterRateLimitedError, } from "@voyantjs/catalog";
+import { newId } from "@voyantjs/db/lib/typeid";
+import { and, asc, eq, inArray, sql } from "drizzle-orm";
+import { acquireToken, channelScopeKey, drainBucket } from "../rate-limit.js";
+import { channelAvailabilityPushIntents, channelInventoryAllotments, channelProductMappings, channels, } from "../schema.js";
+import { prepareOutboundEnvelope } from "../webhook-deliveries.js";
+import { defaultLogger, getChannelPushDepsOrThrow } from "./types.js";
+/** Stable string identifier for the availability-push workflow. */
+export const CHANNEL_AVAILABILITY_PUSH_WORKFLOW_ID = "channel.availability.push";
+/**
+ * Resolve the channels that hold an allotment for this slot/product/option.
+ * Per §7.4 — availability push uses `channel_inventory_allotments` (NOT
+ * `channel_product_mappings`), so channels mapped to the product but
+ * with no per-slot allotment don't receive pushes.
+ *
+ * v1 returns one row per channel that has an active allotment whose
+ * scope matches the slot (by product, optionally by option). Per-slot
+ * targeting via `channel_inventory_allotment_targets` is consulted in a
+ * future iteration; v1 dispatches at allotment-level so any allotment
+ * row covering the product/option triggers a push.
+ */
+export async function resolveAllotmentTargetsForSlot(db, input) {
+    // Resolve allotments for this product (optionally option-scoped).
+    const allotmentRows = (await db
+        .select({
+        channelId: channelInventoryAllotments.channelId,
+    })
+        .from(channelInventoryAllotments)
+        .innerJoin(channels, eq(channelInventoryAllotments.channelId, channels.id))
+        .where(and(eq(channelInventoryAllotments.productId, input.productId), eq(channelInventoryAllotments.active, true), eq(channels.status, "active"), input.optionId
+        ? sql `(${channelInventoryAllotments.optionId} IS NULL OR ${channelInventoryAllotments.optionId} = ${input.optionId})`
+        : sql `${channelInventoryAllotments.optionId} IS NULL`)));
+    if (allotmentRows.length === 0)
+        return [];
+    const channelIds = Array.from(new Set(allotmentRows.map((r) => r.channelId)));
+    const mappings = (await db
+        .select({
+        mapping: channelProductMappings,
+        channel: channels,
+    })
+        .from(channelProductMappings)
+        .innerJoin(channels, eq(channelProductMappings.channelId, channels.id))
+        .where(and(eq(channelProductMappings.productId, input.productId), eq(channelProductMappings.active, true), eq(channelProductMappings.pushAvailability, true), inArray(channelProductMappings.channelId, channelIds))));
+    return mappings
+        .filter((row) => row.mapping.sourceConnectionId)
+        .map((row) => ({
+        channelId: row.channel.id,
+        sourceConnectionId: row.mapping.sourceConnectionId,
+        mapping: row.mapping,
+        channel: row.channel,
+    }));
+}
+/**
+ * Insert/update an intent row per (channel, slot). The unique
+ * constraint on `(channel_id, slot_id)` collapses concurrent
+ * supersession events to one row; the worker reads the *current* slot
+ * state when it processes, so stale event payloads never propagate.
+ */
+export async function upsertAvailabilityIntent(db, input) {
+    await db
+        .insert(channelAvailabilityPushIntents)
+        .values({
+        id: newId("channel_availability_push_intents"),
+        channelId: input.channelId,
+        sourceConnectionId: input.sourceConnectionId,
+        slotId: input.slotId,
+        productId: input.productId,
+        optionId: input.optionId,
+        startsAt: input.startsAt,
+    })
+        .onConflictDoUpdate({
+        target: [channelAvailabilityPushIntents.channelId, channelAvailabilityPushIntents.slotId],
+        set: {
+            requestedAt: new Date(),
+            updatedAt: new Date(),
+            // Reset attempts when a new event lands — fresh chance.
+            attempts: 0,
+            lastError: null,
+        },
+    });
+}
+/**
+ * Drain pending availability intents. Reads CURRENT slot state for each
+ * intent (so superseded values never propagate). On success, deletes the
+ * intent row. On failure, increments `attempts` and stamps `last_error`.
+ *
+ * Per §5.3 + §12.2.
+ */
+export async function processAvailabilityPushIntents(input = {}, deps) {
+    const { db, registry, logger = defaultLogger } = deps ?? getChannelPushDepsOrThrow();
+    const limit = input.limit ?? 100;
+    const intents = (await db
+        .select({
+        intent: channelAvailabilityPushIntents,
+        channel: channels,
+    })
+        .from(channelAvailabilityPushIntents)
+        .innerJoin(channels, eq(channelAvailabilityPushIntents.channelId, channels.id))
+        .where(and(input.channelId ? eq(channelAvailabilityPushIntents.channelId, input.channelId) : sql `true`, eq(channels.status, "active")))
+        .orderBy(asc(channelAvailabilityPushIntents.requestedAt))
+        .limit(limit));
+    let succeeded = 0;
+    let failed = 0;
+    let skipped = 0;
+    for (const { intent, channel } of intents) {
+        // Read current slot state — stale events naturally don't propagate.
+        const [slot] = (await db
+            .select()
+            .from(availabilitySlots)
+            .where(eq(availabilitySlots.id, intent.slotId))
+            .limit(1));
+        if (!slot) {
+            // Slot deleted; drop the intent. Reconciler covers any drift.
+            await db
+                .delete(channelAvailabilityPushIntents)
+                .where(eq(channelAvailabilityPushIntents.id, intent.id));
+            skipped += 1;
+            continue;
+        }
+        const adapter = registry.resolveByConnection(intent.sourceConnectionId);
+        if (!adapter?.capabilities.supportsAvailabilityPush || !adapter.pushAvailability) {
+            await stampIntentError(db, intent.id, intent.attempts + 1, adapter ? "adapter_unsupported" : "no_adapter_registered");
+            failed += 1;
+            continue;
+        }
+        // Look up external ids via channel_product_mappings.
+        const [mapping] = (await db
+            .select()
+            .from(channelProductMappings)
+            .where(and(eq(channelProductMappings.channelId, channel.id), eq(channelProductMappings.productId, intent.productId)))
+            .limit(1));
+        if (!mapping) {
+            await stampIntentError(db, intent.id, intent.attempts + 1, "no_mapping");
+            failed += 1;
+            continue;
+        }
+        // Rate limit before dispatching. Availability uses the gated
+        // priority (default 0.3) so bookings always pre-empt.
+        const rlConfig = rateLimitConfigForChannel(channel);
+        if (rlConfig) {
+            const acq = await acquireToken(db, channelScopeKey(channel.id, intent.sourceConnectionId), rlConfig, "availability");
+            if (!acq.acquired) {
+                // Per §14.3: availability denials don't sleep. The next event
+                // for the same key supersedes; intent stays for next pass.
+                await stampIntentError(db, intent.id, intent.attempts + 1, "rate_limited");
+                failed += 1;
+                continue;
+            }
+        }
+        const request = {
+            channelId: channel.id,
+            externalProductId: mapping.externalProductId ?? "",
+            externalRateId: mapping.externalRateId ?? undefined,
+            externalCategoryId: mapping.externalCategoryId ?? undefined,
+            slotId: slot.id,
+            productId: slot.productId,
+            optionId: slot.optionId ?? undefined,
+            startsAt: slot.startsAt,
+            remainingPax: slot.unlimited ? Number.MAX_SAFE_INTEGER : (slot.remainingPax ?? 0),
+            source: "refresh",
+        };
+        const adapterCtx = {
+            connection_id: intent.sourceConnectionId,
+        };
+        const envelope = await prepareOutboundEnvelope(db, {
+            sourceModule: "distribution",
+            sourceEvent: "channel.availability.push",
+            sourceEntityModule: "availability",
+            sourceEntityId: slot.id,
+            targetUrl: `adapter:${adapter.kind}`,
+            targetKind: `channel:${adapter.kind}`,
+            targetRef: channel.id,
+            requestMethod: "POST",
+            requestBody: request,
+            attemptNumber: intent.attempts + 1,
+        });
+        try {
+            const result = await adapter.pushAvailability(adapterCtx, request);
+            await envelope.complete({ responseStatus: 200, responseBody: result });
+            // Drain on success.
+            await db
+                .delete(channelAvailabilityPushIntents)
+                .where(eq(channelAvailabilityPushIntents.id, intent.id));
+            succeeded += 1;
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            const isRateLimited = err instanceof AdapterRateLimitedError;
+            if (isRateLimited) {
+                await drainBucket(db, channelScopeKey(channel.id, intent.sourceConnectionId), err.retryAfterMs);
+            }
+            await envelope.complete({
+                errorClass: isRateLimited ? "rate_limited" : "adapter_error",
+                errorMessage: message,
+            });
+            await stampIntentError(db, intent.id, intent.attempts + 1, message);
+            failed += 1;
+            logger.error?.(`pushAvailability failed for slot ${slot.id} channel ${channel.id}`, {
+                error: message,
+            });
+        }
+    }
+    return {
+        attempted: intents.length,
+        succeeded,
+        failed,
+        skipped,
+    };
+}
+async function stampIntentError(db, id, attempts, message) {
+    await db
+        .update(channelAvailabilityPushIntents)
+        .set({ attempts, lastError: message, updatedAt: new Date() })
+        .where(eq(channelAvailabilityPushIntents.id, id));
+}
+function rateLimitConfigForChannel(channel) {
+    if (!channel.rateLimitRps || !channel.rateLimitBurst)
+        return null;
+    return {
+        rps: channel.rateLimitRps,
+        burst: channel.rateLimitBurst,
+        priorityGates: channel.rateLimitPriorityGates ?? undefined,
+    };
+}

package/dist/channel-push/booking-push.d.ts

@@ -0,0 +1,114 @@
+/**
+ * Booking-push pipeline.
+ *
+ * Triggered by `booking.confirmed`. The subscriber writes pending
+ * `channel_booking_links` rows and returns immediately (per the EventBus
+ * fire-and-forget contract). The durable processor (`processBookingPush`)
+ * drains those rows, calls `adapter.pushBooking()` per link, and marks
+ * each row `ok` or `failed`.
+ *
+ * The processor is a plain async function so it's callable from:
+ *   - The `booking.confirmed` subscriber (inline, dev/single-process)
+ *   - The `channel.booking.push` durable workflow's body (production)
+ *   - The reconciler (Phase G) for catch-up after long outages
+ *   - Tests / admin retry endpoints
+ *
+ * Per docs/architecture/channel-push-architecture.md §4 + §12.1.
+ */
+import type { AnyDrizzleDb } from "@voyantjs/db";
+import { channelProductMappings, channels } from "@voyantjs/distribution/schema";
+import { type ChannelPushDeps } from "./types.js";
+/** Stable string identifier for the booking-push workflow. */
+export declare const CHANNEL_BOOKING_PUSH_WORKFLOW_ID: "channel.booking.push";
+export interface ProcessBookingPushInput {
+    bookingId: string;
+}
+export interface ProcessBookingPushResult {
+    bookingId: string;
+    attempted: number;
+    succeeded: number;
+    failed: number;
+    /**
+     * Number of succeeded links that were compensated (rolled back via
+     * `adapter.cancel`) because the contract's `compensation` policy is
+     * `"strict-atomic"` and at least one sibling failed. Always 0 under
+     * the default `"eventually-consistent"` policy.
+     */
+    compensated: number;
+    /** Per-link outcomes for diagnostics. */
+    outcomes: Array<{
+        channelId: string;
+        bookingItemId: string | null;
+        status: "ok" | "failed" | "skipped" | "compensated";
+        upstreamRef?: string;
+        error?: string;
+    }>;
+}
+/**
+ * Compensation modes per `channel_contracts.policy.compensation`.
+ *
+ * - `eventually-consistent` (default): partial successes stay; ops gets
+ *   alerted via `webhook_deliveries` and retries via the reconciler.
+ *   Usually correct for travel inventory — succeeded channels know
+ *   about the booking and will honor it; the failed ones converge.
+ * - `strict-atomic`: on any per-link failure, the engine calls
+ *   `adapter.cancel` for succeeded siblings and marks them
+ *   `push_status = 'compensated'`. Use only when ALL channels MUST
+ *   agree on the booking's existence (rare).
+ *
+ * Per docs/architecture/channel-push-architecture.md §4.2 + §9.
+ */
+export type CompensationPolicy = "strict-atomic" | "eventually-consistent";
+/**
+ * Build the stable idempotency key the upstream uses to dedupe pushes
+ * across retries. Per §3.
+ */
+export declare function bookingPushIdempotencyKey(bookingId: string, bookingItemId: string | null, channelId: string): string;
+/**
+ * Resolve the channels that want a push for this booking. One row per
+ * (booking_item, channel) pair where the mapping has push_bookings =
+ * true and the channel is active. Booking-level pushes (no item id) are
+ * supported via a synthetic item id of null.
+ *
+ * Per §7.4 — booking push uses `channel_product_mappings` (not
+ * `channel_inventory_allotments`) so channels mapped to a product
+ * without a slot allotment still receive the push.
+ */
+export declare function resolveBookingPushTargets(db: AnyDrizzleDb, bookingId: string): Promise<Array<{
+    bookingItemId: string | null;
+    productId: string;
+    mapping: typeof channelProductMappings.$inferSelect;
+    channel: typeof channels.$inferSelect;
+}>>;
+/**
+ * Insert pending `channel_booking_links` rows for each push target.
+ * `INSERT ... ON CONFLICT DO NOTHING` against the
+ * `(channel_id, booking_id, COALESCE(booking_item_id, ''))` unique
+ * index — durable handoff with no doubled-push risk per §7.1.
+ *
+ * Returns the count of newly-inserted rows. Subscribers don't strictly
+ * need this — the processor reads pending rows by query — but tests
+ * find it useful.
+ */
+export declare function upsertPendingBookingLinks(db: AnyDrizzleDb, bookingId: string, targets: Array<{
+    bookingItemId: string | null;
+    mapping: typeof channelProductMappings.$inferSelect;
+    channel: typeof channels.$inferSelect;
+}>): Promise<number>;
+/**
+ * Drain pending `channel_booking_links` rows for one booking and call
+ * `adapter.pushBooking()` per link. Idempotent: re-running the
+ * processor against the same booking is safe — the `idempotency_key`
+ * column ensures retries don't double-push upstream.
+ *
+ * Each adapter call:
+ *   1. Acquires a token from the per-channel/connection bucket.
+ *   2. Calls the adapter through `prepareOutboundEnvelope` so every
+ *      attempt lands in `webhook_deliveries` with redacted headers.
+ *   3. Updates the link to `ok` (with upstream_ref, hash) or `failed`
+ *      (with last_error, attempts++).
+ *
+ * Per §4.2 + §12.1.
+ */
+export declare function processBookingPush(input: ProcessBookingPushInput, deps?: ChannelPushDeps): Promise<ProcessBookingPushResult>;
+//# sourceMappingURL=booking-push.d.ts.map

package/dist/channel-push/booking-push.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"booking-push.d.ts","sourceRoot":"","sources":["../../src/channel-push/booking-push.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AASH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAEhD,OAAO,EAGL,sBAAsB,EACtB,QAAQ,EACT,MAAM,+BAA+B,CAAA;AAMtC,OAAO,EAAE,KAAK,eAAe,EAA4C,MAAM,YAAY,CAAA;AAE3F,8DAA8D;AAC9D,eAAO,MAAM,gCAAgC,EAAG,sBAA+B,CAAA;AAE/E,MAAM,WAAW,uBAAuB;IACtC,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;IACd;;;;;OAKG;IACH,WAAW,EAAE,MAAM,CAAA;IACnB,yCAAyC;IACzC,QAAQ,EAAE,KAAK,CAAC;QACd,SAAS,EAAE,MAAM,CAAA;QACjB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;QAC5B,MAAM,EAAE,IAAI,GAAG,QAAQ,GAAG,SAAS,GAAG,aAAa,CAAA;QACnD,WAAW,CAAC,EAAE,MAAM,CAAA;QACpB,KAAK,CAAC,EAAE,MAAM,CAAA;KACf,CAAC,CAAA;CACH;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,kBAAkB,GAAG,eAAe,GAAG,uBAAuB,CAAA;AAE1E;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,GAAG,IAAI,EAC5B,SAAS,EAAE,MAAM,GAChB,MAAM,CAER;AAED;;;;;;;;;GASG;AACH,wBAAsB,yBAAyB,CAC7C,EAAE,EAAE,YAAY,EAChB,SAAS,EAAE,MAAM,GAChB,OAAO,CACR,KAAK,CAAC;IACJ,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,OAAO,sBAAsB,CAAC,YAAY,CAAA;IACnD,OAAO,EAAE,OAAO,QAAQ,CAAC,YAAY,CAAA;CACtC,CAAC,CACH,CAyDA;AAED;;;;;;;;;GASG;AACH,wBAAsB,yBAAyB,CAC7C,EAAE,EAAE,YAAY,EAChB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,KAAK,CAAC;IACb,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,OAAO,EAAE,OAAO,sBAAsB,CAAC,YAAY,CAAA;IACnD,OAAO,EAAE,OAAO,QAAQ,CAAC,YAAY,CAAA;CACtC,CAAC,GACD,OAAO,CAAC,MAAM,CAAC,CAuBjB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,uBAAuB,EAC9B,IAAI,CAAC,EAAE,eAAe,GACrB,OAAO,CAAC,wBAAwB,CAAC,CA8PnC"}