ghost 6.40.0 → 6.41.0

package/core/server/services/gifts/gift-reminder-scheduler.ts

@@ -0,0 +1,109 @@
+import logging from '@tryghost/logging';
+import {Gift} from './gift';
+import type {InternalApiKey, InternalKeys} from '../internal-keys';
+import type {SchedulerAdapter, SchedulerJob} from '../../adapters/scheduling/types';
+import {GIFT_REMINDER_LEAD_DAYS} from './constants';
+// Same-domain (scheduling) primitives, used unconditionally.
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const urlUtils = require('../../../shared/url-utils');
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const {getSignedAdminToken} = require('../../adapters/scheduling/utils');
+
+const MS_PER_DAY = 24 * 60 * 60 * 1000;
+const GIFT_REMINDER_LEAD_MS = GIFT_REMINDER_LEAD_DAYS * MS_PER_DAY;
+
+interface GiftReminderSchedulerDeps {
+    apiUrl: string;
+    // Optional in deps so the JS wrapper can pass options.schedulerAdapter
+    // through without TS complaining at the JS/TS boundary. The class field
+    // below is non-optional; the constructor's adapter.register(this) call
+    // throws if undefined is passed through in practice.
+    adapter?: SchedulerAdapter;
+    internalKeys: InternalKeys;
+    findUnsentReminders(): Promise<Gift[]>;
+}
+
+export class GiftReminderScheduler {
+    readonly #apiUrl: string;
+    readonly #adapter: SchedulerAdapter;
+    readonly #internalKeys: InternalKeys;
+    readonly #findUnsentReminders: () => Promise<Gift[]>;
+
+    constructor({apiUrl, adapter, internalKeys, findUnsentReminders}: GiftReminderSchedulerDeps) {
+        this.#apiUrl = apiUrl;
+        this.#adapter = adapter!;
+        this.#internalKeys = internalKeys;
+        this.#findUnsentReminders = findUnsentReminders;
+        this.#adapter.register(this);
+    }
+
+    /**
+     * Queue a single reminder callback for a freshly-redeemed gift. The
+     * callback fires at consumesAt - GIFT_REMINDER_LEAD_DAYS. Already-due
+     * reminders are skipped — the daily cron picks them up.
+     */
+    async scheduleFor(gift: Gift): Promise<void> {
+        if (!gift.consumesAt) {
+            return;
+        }
+        const time = gift.consumesAt.getTime() - GIFT_REMINDER_LEAD_MS;
+        if (time <= Date.now()) {
+            return;
+        }
+
+        try {
+            const key = await this.#internalKeys.get('ghost-scheduler');
+            this.#adapter.schedule(this.#buildJob(time, key));
+        } catch (err) {
+            logging.error({
+                event: {name: 'gift_reminder_scheduler.schedule.failed'},
+                err,
+                giftToken: gift.token
+            }, 'Failed to schedule gift reminder');
+        }
+    }
+
+    /**
+     * Re-issue every queued reminder under the current scheduler key. Pass
+     * the pre-rotation secret as `previousKey` so each adapter-queued URL
+     * can be reconstructed for unschedule before resigning with the new
+     * key. Reminders whose fire time has already passed are skipped — the
+     * daily cron picks them up.
+     */
+    async rescheduleAll({previousKey}: {previousKey?: InternalApiKey} = {}): Promise<void> {
+        const currentKey = await this.#internalKeys.get('ghost-scheduler');
+        const unscheduleKey = previousKey ?? currentKey;
+        const pending = await this.#findUnsentReminders();
+
+        // Same-key rebuild (no previousKey, boot path) → URL signature is
+        // identical to the about-to-be-scheduled job. The default adapter
+        // implements unschedule via tombstones keyed by URL+time, so a same-URL
+        // unschedule poisons the scheduled job. Bootstrap mode skips the
+        // tombstone write. Rotation (previousKey provided) → URLs differ, so
+        // the tombstone correctly targets the old queued entry.
+        const bootstrap = !previousKey;
+
+        for (const gift of pending) {
+            if (!gift.consumesAt) {
+                continue;
+            }
+            const time = gift.consumesAt.getTime() - GIFT_REMINDER_LEAD_MS;
+            if (time <= Date.now()) {
+                continue;
+            }
+            this.#adapter.unschedule(this.#buildJob(time, unscheduleKey), {bootstrap});
+            this.#adapter.schedule(this.#buildJob(time, currentKey));
+        }
+    }
+
+    #buildJob(time: number, key: InternalApiKey): SchedulerJob {
+        const signedAdminToken = getSignedAdminToken({
+            publishedAt: new Date(time).toISOString(),
+            apiUrl: this.#apiUrl,
+            key
+        });
+        const url = new URL(urlUtils.urlJoin(this.#apiUrl, 'gifts', 'flush_reminders'));
+        url.searchParams.set('token', signedAdminToken);
+        return {time, url: url.toString(), extra: {httpMethod: 'PUT'}};
+    }
+}

package/core/server/services/gifts/gift-repository.ts

@@ -20,6 +20,7 @@ export interface GiftRepository {
     findPendingConsumption(): Promise<Gift[]>;
     findPendingExpiration(): Promise<Gift[]>;
     findPendingReminder(options: FindPendingReminderOptions): Promise<Gift[]>;
+    findUnsentReminders(): Promise<Gift[]>;
     getActiveByMember(memberId: string, options?: RepositoryTransactionOptions): Promise<Gift | null>;
     getActiveByMembers(memberIds: string[], options?: RepositoryTransactionOptions): Promise<Map<string, Gift>>;
     create(gift: Gift, options?: RepositoryTransactionOptions): Promise<void>;

package/core/server/services/gifts/gift-service-wrapper.js

@@ -7,7 +7,7 @@
  * @typedef {object} InitOptions
  * @prop {string} [apiUrl]
  * @prop {SchedulerAdapter} [schedulerAdapter]
- * @prop {ReadonlyMap<string, Promise<{id: string, secret: string}>>} [internalKeys]
+ * @prop {import('../internal-keys').InternalKeys} [internalKeys]
  */
 
 class GiftServiceWrapper {
@@ -26,6 +26,7 @@ class GiftServiceWrapper {
         const {Gift: GiftModel} = require('../../models');
         const {GiftBookshelfRepository} = require('./gift-bookshelf-repository');
         const {GiftService} = require('./gift-service');
+        const {GiftReminderScheduler} = require('./gift-reminder-scheduler');
         const {GiftEmailService} = require('./gift-email-service');
         const {GiftController} = require('./gift-controller');
         const membersService = require('../members');
@@ -45,7 +46,6 @@ class GiftServiceWrapper {
         const settingsHelpers = require('../settings-helpers');
         const EmailAddressParser = require('../email-address/email-address-parser');
         const {blogIcon} = require('../../../server/lib/image');
-        const {getSignedAdminToken} = require('../../adapters/scheduling/utils');
         const {t} = require('../i18n');
 
         const repository = new GiftBookshelfRepository({
@@ -61,6 +61,13 @@ class GiftServiceWrapper {
             t
         });
 
+        const giftReminderScheduler = new GiftReminderScheduler({
+            apiUrl: options.apiUrl,
+            adapter: options.schedulerAdapter,
+            internalKeys: options.internalKeys,
+            findUnsentReminders: () => repository.findUnsentReminders()
+        });
+
         this.service = new GiftService({
             giftRepository: repository,
             get memberRepository() {
@@ -71,11 +78,7 @@ class GiftServiceWrapper {
             get staffServiceEmails() {
                 return staffService.api.emails;
             },
-            schedulerAdapter: options.schedulerAdapter ?? null,
-            getSchedulerKey: options.internalKeys ? () => options.internalKeys.get('ghost-scheduler') : null,
-            getSignedAdminToken,
-            urlJoin: urlUtils.urlJoin.bind(urlUtils),
-            apiUrl: options.apiUrl ?? null
+            giftReminderScheduler
         });
 
         this.controller = new GiftController({

package/core/server/services/gifts/gift-service.js

@@ -204,7 +204,7 @@ class GiftService {
             catch (err) {
                 logging_1.default.error('Failed to notify staff of gift redemption', err);
             }
-            await this.scheduleReminder(redeemed);
+            await this.deps.giftReminderScheduler.scheduleFor(redeemed);
         };
         if (options.transacting) {
             // Only notify once the transaction has finished
@@ -380,37 +380,6 @@ class GiftService {
         }
         return { expiredCount };
     }
-    async scheduleReminder(gift) {
-        const { schedulerAdapter, getSchedulerKey, getSignedAdminToken, urlJoin, apiUrl } = this.deps;
-        if (!schedulerAdapter || !getSchedulerKey || !getSignedAdminToken || !urlJoin || !apiUrl) {
-            return;
-        }
-        if (!gift.consumesAt) {
-            return;
-        }
-        const time = gift.consumesAt.getTime() - GIFT_REMINDER_LEAD_MS;
-        if (time <= Date.now()) {
-            return;
-        }
-        try {
-            const key = await getSchedulerKey();
-            const signedAdminToken = getSignedAdminToken({
-                publishedAt: new Date(time).toISOString(),
-                apiUrl,
-                key
-            });
-            const url = new URL(urlJoin(apiUrl, 'gifts', 'flush_reminders'));
-            url.searchParams.set('token', signedAdminToken);
-            schedulerAdapter.schedule({
-                time,
-                url: url.toString(),
-                extra: { httpMethod: 'PUT' }
-            });
-        }
-        catch (err) {
-            logging_1.default.error('Failed to schedule gift reminder', err);
-        }
-    }
     async processReminders() {
         const now = new Date();
         const toRemind = await this.deps.giftRepository.findPendingReminder({

package/core/server/services/gifts/gift-service.ts

@@ -3,7 +3,7 @@ import errors from '@tryghost/errors';
 import logging from '@tryghost/logging';
 import {Gift} from './gift';
 import type {GiftRepository} from './gift-repository';
-import type {InternalApiKey} from '../internal-keys';
+import type {GiftReminderScheduler} from './gift-reminder-scheduler';
 import tpl from '@tryghost/tpl';
 import {GIFT_REMINDER_FLOOR_DAYS, GIFT_REMINDER_LEAD_DAYS} from './constants';
 import {MEMBER_WELCOME_EMAIL_SLUGS} from '../member-welcome-emails/constants';
@@ -113,31 +113,13 @@ export interface GiftPurchaseData {
     stripePaymentIntentId: string;
 }
 
-interface SchedulerAdapter {
-    schedule(job: {time: number; url: string; extra: {httpMethod: string}}): void;
-}
-
-type GetSchedulerKey = () => Promise<InternalApiKey>;
-
-type GetSignedAdminToken = (options: {
-    publishedAt: string;
-    apiUrl: string;
-    key: InternalApiKey;
-}) => string;
-
-type UrlJoin = (...parts: string[]) => string;
-
 interface GiftServiceDeps {
     giftRepository: GiftRepository;
     memberRepository: MemberRepository;
     tiersService: TiersService;
     giftEmailService: GiftEmailService;
     staffServiceEmails: StaffServiceEmails;
-    schedulerAdapter: SchedulerAdapter | null;
-    getSchedulerKey: GetSchedulerKey | null;
-    getSignedAdminToken: GetSignedAdminToken | null;
-    urlJoin: UrlJoin | null;
-    apiUrl: string | null;
+    giftReminderScheduler: Pick<GiftReminderScheduler, 'scheduleFor'>;
 }
 
 interface ReminderSend {
@@ -355,7 +337,7 @@ export class GiftService {
                 logging.error('Failed to notify staff of gift redemption', err);
             }
 
-            await this.scheduleReminder(redeemed);
+            await this.deps.giftReminderScheduler.scheduleFor(redeemed);
         };
 
         if (options.transacting) {
@@ -595,44 +577,6 @@ export class GiftService {
         return {expiredCount};
     }
 
-    private async scheduleReminder(gift: Gift): Promise<void> {
-        const {schedulerAdapter, getSchedulerKey, getSignedAdminToken, urlJoin, apiUrl} = this.deps;
-
-        if (!schedulerAdapter || !getSchedulerKey || !getSignedAdminToken || !urlJoin || !apiUrl) {
-            return;
-        }
-
-        if (!gift.consumesAt) {
-            return;
-        }
-
-        const time = gift.consumesAt.getTime() - GIFT_REMINDER_LEAD_MS;
-
-        if (time <= Date.now()) {
-            return;
-        }
-
-        try {
-            const key = await getSchedulerKey();
-            const signedAdminToken = getSignedAdminToken({
-                publishedAt: new Date(time).toISOString(),
-                apiUrl,
-                key
-            });
-
-            const url = new URL(urlJoin(apiUrl, 'gifts', 'flush_reminders'));
-            url.searchParams.set('token', signedAdminToken);
-
-            schedulerAdapter.schedule({
-                time,
-                url: url.toString(),
-                extra: {httpMethod: 'PUT'}
-            });
-        } catch (err) {
-            logging.error('Failed to schedule gift reminder', err);
-        }
-    }
-
     async processReminders(): Promise<{remindedCount: number; skippedCount: number; failedCount: number}> {
         const now = new Date();
         const toRemind = await this.deps.giftRepository.findPendingReminder({

package/core/server/services/internal-keys/index.js

@@ -16,9 +16,7 @@ const SLUG_KEY_TYPE = {
 const models = require('../../models');
 /**
  * Process-lifetime cache of internal-integration API keys, keyed by slug.
- * Exposed to consumers as a `ReadonlyMap<InternalIntegrationSlug, Promise<InternalApiKey>>`
- * so they only see `.get(slug)`; rotation orchestration uses the full Map
- * surface (`.delete(slug)`, `.clear()`) to invalidate after rotating the
+ * Rotation orchestration calls `.clear()` to invalidate after rotating the
  * underlying api_keys row.
  */
 const internalKeys = new auto_filling_map_1.AutoFillingMap(slug => models.Integration.getApiKeyBySlug(slug, SLUG_KEY_TYPE[slug]));

package/core/server/services/internal-keys/index.ts

@@ -20,6 +20,16 @@ const SLUG_KEY_TYPE = {
 
 export type ApiKeyType = typeof SLUG_KEY_TYPE[InternalIntegrationSlug];
 
+/**
+ * The shape consumers receive when they import the singleton: an
+ * `AutoFillingMap` whose `get` returns `Promise<InternalApiKey>` directly
+ * (the override drops the `| undefined` from the structural `Map.get`
+ * signature). Rotation orchestration uses the inherited `Map` surface
+ * (`.clear()`, `.delete()`) to invalidate after rotating the underlying
+ * api_keys row.
+ */
+export type InternalKeys = AutoFillingMap<InternalIntegrationSlug, Promise<InternalApiKey>>;
+
 // models/index.js is the Bookshelf model registry — a JS module without
 // TypeScript declarations. Use a typed require so we can call the model
 // method without polluting the file with `any`. The generic constrains
@@ -35,9 +45,7 @@ const models = require('../../models') as {
 
 /**
  * Process-lifetime cache of internal-integration API keys, keyed by slug.
- * Exposed to consumers as a `ReadonlyMap<InternalIntegrationSlug, Promise<InternalApiKey>>`
- * so they only see `.get(slug)`; rotation orchestration uses the full Map
- * surface (`.delete(slug)`, `.clear()`) to invalidate after rotating the
+ * Rotation orchestration calls `.clear()` to invalidate after rotating the
  * underlying api_keys row.
  */
 const internalKeys = new AutoFillingMap<InternalIntegrationSlug, Promise<InternalApiKey>>(

package/core/server/services/post-scheduling/index.js

@@ -1,29 +1,17 @@
-const events = require('../../lib/common/events');
-const PostSchedulerService = require('./post-scheduler-service');
-const {sequence} = require('@tryghost/promise');
-
-const SCHEDULED_RESOURCES = ['post', 'page'];
-
-/**
- * @description Load all scheduled posts/pages from database.
- * @return {Promise}
- */
-const loadScheduledResources = async function () {
-    const api = require('../../api').endpoints;
-    const results = await sequence(SCHEDULED_RESOURCES.map(resourceType => async () => {
-        const result = await api.schedules.getScheduled.query({options: {resource: resourceType}});
-        return result[resourceType] || [];
-    }));
-    return SCHEDULED_RESOURCES.reduce((obj, entry, index) => Object.assign(obj, {[entry]: results[index]}), {});
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
 };
-
-const init = async ({adapter, apiUrl, internalKeys}) => {
-    const service = new PostSchedulerService({apiUrl, internalKeys, adapter, events});
-    if (adapter.rescheduleOnBoot) {
-        const scheduledResources = await loadScheduledResources();
-        await service.reschedule(scheduledResources);
-    }
-    return service;
-};
-
-exports.init = init;
+Object.defineProperty(exports, "__esModule", { value: true });
+const post_scheduling_1 = __importDefault(require("./post-scheduling"));
+const internal_keys_1 = __importDefault(require("../internal-keys"));
+// CJS modules without TS declarations — typed loosely at the boundary.
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const adapterManager = require('../adapter-manager');
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const urlUtils = require('../../../shared/url-utils');
+exports.default = new post_scheduling_1.default({
+    apiUrl: urlUtils.urlFor('api', { type: 'admin' }, true),
+    adapter: adapterManager.getAdapter('scheduling'),
+    internalKeys: internal_keys_1.default
+});

package/core/server/services/post-scheduling/index.ts

@@ -0,0 +1,14 @@
+import PostScheduling from './post-scheduling';
+import internalKeys from '../internal-keys';
+
+// CJS modules without TS declarations — typed loosely at the boundary.
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const adapterManager = require('../adapter-manager');
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const urlUtils = require('../../../shared/url-utils');
+
+export default new PostScheduling({
+    apiUrl: urlUtils.urlFor('api', {type: 'admin'}, true),
+    adapter: adapterManager.getAdapter('scheduling'),
+    internalKeys
+});

package/core/server/services/post-scheduling/post-scheduling.js

@@ -0,0 +1,115 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+/* eslint-disable @typescript-eslint/no-explicit-any */
+const moment_1 = __importDefault(require("moment"));
+const logging_1 = __importDefault(require("@tryghost/logging"));
+// CJS-only modules — typed loosely below. models is the Bookshelf registry
+// without TS declarations; the rest are JS modules without types.
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const models = require('../../models');
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const urlUtils = require('../../../shared/url-utils');
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const { getSignedAdminToken } = require('../../adapters/scheduling/utils');
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const events = require('../../lib/common/events');
+// Pages live in the posts table with type:'page', so both types are
+// queried through models.Post and discriminated via the type filter.
+const SCHEDULED_RESOURCES = ['post', 'page'];
+class PostScheduling {
+    #apiUrl;
+    #adapter;
+    #internalKeys;
+    constructor({ apiUrl, adapter, internalKeys }) {
+        this.#apiUrl = apiUrl;
+        this.#adapter = adapter;
+        this.#internalKeys = internalKeys;
+        SCHEDULED_RESOURCES.forEach((resource) => {
+            events.on(`${resource}.scheduled`, async (model) => {
+                try {
+                    const key = await internalKeys.get('ghost-scheduler');
+                    this.#adapter.schedule(this.#normalize({ model, key, resourceType: resource }));
+                }
+                catch (err) {
+                    logging_1.default.error({ event: { name: 'post-scheduling.schedule.error' }, err, resource, id: model.get('id') }, 'Failed to schedule resource');
+                }
+            });
+            // Reschedule = matched unschedule + fresh schedule, because tokens
+            // are signed against the published_at timestamp.
+            events.on(`${resource}.rescheduled`, async (model) => {
+                try {
+                    const key = await internalKeys.get('ghost-scheduler');
+                    this.#adapter.unschedule(this.#normalize({ model, key, resourceType: resource }, 'unscheduled'));
+                    this.#adapter.schedule(this.#normalize({ model, key, resourceType: resource }));
+                }
+                catch (err) {
+                    logging_1.default.error({ event: { name: 'post-scheduling.reschedule.error' }, err, resource, id: model.get('id') }, 'Failed to reschedule resource');
+                }
+            });
+            events.on(`${resource}.unscheduled`, async (model) => {
+                try {
+                    const key = await internalKeys.get('ghost-scheduler');
+                    this.#adapter.unschedule(this.#normalize({ model, key, resourceType: resource }, 'unscheduled'));
+                }
+                catch (err) {
+                    logging_1.default.error({ event: { name: 'post-scheduling.unschedule.error' }, err, resource, id: model.get('id') }, 'Failed to unschedule resource');
+                }
+            });
+        });
+        this.#adapter.register(this);
+    }
+    /**
+     * Re-issue every queued schedule under the current internal-keys cache.
+     * On boot the previous key is the same as the current key. For key
+     * rotation, the caller passes `previousKey` so unschedule URLs match
+     * the entries the adapter already holds (signed under the previous
+     * secret); schedule URLs are reissued under the current secret.
+     */
+    async rescheduleAll({ previousKey } = {}) {
+        const scheduledResources = await this.#loadScheduledResources();
+        const currentKey = await this.#internalKeys.get('ghost-scheduler');
+        const unscheduleKey = previousKey ?? currentKey;
+        // Same-key rebuild (no previousKey, boot path) → URL signature is
+        // identical to the about-to-be-scheduled job. The default adapter
+        // implements unschedule via tombstones keyed by URL+time, so a same-URL
+        // unschedule poisons the scheduled job. Bootstrap mode skips the
+        // tombstone write. Rotation (previousKey provided) → URLs differ, so
+        // the tombstone correctly targets the old queued entry.
+        const bootstrap = !previousKey;
+        for (const resourceType of Object.keys(scheduledResources)) {
+            for (const model of scheduledResources[resourceType]) {
+                this.#adapter.unschedule(this.#normalize({ model, key: unscheduleKey, resourceType }), { bootstrap });
+                this.#adapter.schedule(this.#normalize({ model, key: currentKey, resourceType }));
+            }
+        }
+    }
+    async #loadScheduledResources() {
+        const entries = await Promise.all(SCHEDULED_RESOURCES.map(async (resourceType) => {
+            const found = await models.Post.findAll({
+                filter: `status:scheduled+type:${resourceType}`,
+                columns: ['id', 'published_at', 'created_at', 'type']
+            });
+            return [resourceType, found];
+        }));
+        return Object.fromEntries(entries);
+    }
+    #normalize({ model, resourceType, key }, event = '') {
+        const resource = `${resourceType}s`;
+        const publishedAt = (event === 'unscheduled') ? model.previous('published_at') : model.get('published_at');
+        const signedAdminToken = getSignedAdminToken({ publishedAt, apiUrl: this.#apiUrl, key });
+        const url = `${urlUtils.urlJoin(this.#apiUrl, 'schedules', resource, model.get('id'))}/?token=${signedAdminToken}`;
+        return {
+            // NOTE: The scheduler expects a unix timestamp.
+            time: (0, moment_1.default)(publishedAt).valueOf(),
+            url,
+            extra: {
+                httpMethod: 'PUT',
+                oldTime: model.previous('published_at') ? (0, moment_1.default)(model.previous('published_at')).valueOf() : null
+            }
+        };
+    }
+}
+exports.default = PostScheduling;

package/core/server/services/post-scheduling/post-scheduling.ts

@@ -0,0 +1,138 @@
+/* eslint-disable @typescript-eslint/no-explicit-any */
+import moment from 'moment';
+import logging from '@tryghost/logging';
+import type {InternalApiKey, InternalKeys} from '../internal-keys';
+import type {SchedulerAdapter, SchedulerJob} from '../../adapters/scheduling/types';
+
+// CJS-only modules — typed loosely below. models is the Bookshelf registry
+// without TS declarations; the rest are JS modules without types.
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const models = require('../../models');
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const urlUtils = require('../../../shared/url-utils');
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const {getSignedAdminToken} = require('../../adapters/scheduling/utils');
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const events = require('../../lib/common/events');
+
+interface PostSchedulingDeps {
+    apiUrl: string;
+    // Optional in deps so the JS wrapper can pass options.schedulerAdapter
+    // through without TS complaining at the JS/TS boundary. The class field
+    // below is non-optional; the constructor's adapter.register(this) call
+    // throws if undefined is passed through in practice.
+    adapter?: SchedulerAdapter;
+    internalKeys: InternalKeys;
+}
+
+// Pages live in the posts table with type:'page', so both types are
+// queried through models.Post and discriminated via the type filter.
+const SCHEDULED_RESOURCES = ['post', 'page'] as const;
+type ScheduledResource = typeof SCHEDULED_RESOURCES[number];
+
+export default class PostScheduling {
+    readonly #apiUrl: string;
+    readonly #adapter: SchedulerAdapter;
+    readonly #internalKeys: InternalKeys;
+
+    constructor({apiUrl, adapter, internalKeys}: PostSchedulingDeps) {
+        this.#apiUrl = apiUrl;
+        this.#adapter = adapter!;
+        this.#internalKeys = internalKeys;
+
+        SCHEDULED_RESOURCES.forEach((resource) => {
+            events.on(`${resource}.scheduled`, async (model: any) => {
+                try {
+                    const key = await internalKeys.get('ghost-scheduler');
+                    this.#adapter.schedule(this.#normalize({model, key, resourceType: resource}));
+                } catch (err) {
+                    logging.error({event: {name: 'post-scheduling.schedule.error'}, err, resource, id: model.get('id')}, 'Failed to schedule resource');
+                }
+            });
+
+            // Reschedule = matched unschedule + fresh schedule, because tokens
+            // are signed against the published_at timestamp.
+            events.on(`${resource}.rescheduled`, async (model: any) => {
+                try {
+                    const key = await internalKeys.get('ghost-scheduler');
+                    this.#adapter.unschedule(this.#normalize({model, key, resourceType: resource}, 'unscheduled'));
+                    this.#adapter.schedule(this.#normalize({model, key, resourceType: resource}));
+                } catch (err) {
+                    logging.error({event: {name: 'post-scheduling.reschedule.error'}, err, resource, id: model.get('id')}, 'Failed to reschedule resource');
+                }
+            });
+
+            events.on(`${resource}.unscheduled`, async (model: any) => {
+                try {
+                    const key = await internalKeys.get('ghost-scheduler');
+                    this.#adapter.unschedule(this.#normalize({model, key, resourceType: resource}, 'unscheduled'));
+                } catch (err) {
+                    logging.error({event: {name: 'post-scheduling.unschedule.error'}, err, resource, id: model.get('id')}, 'Failed to unschedule resource');
+                }
+            });
+        });
+
+        this.#adapter.register(this);
+    }
+
+    /**
+     * Re-issue every queued schedule under the current internal-keys cache.
+     * On boot the previous key is the same as the current key. For key
+     * rotation, the caller passes `previousKey` so unschedule URLs match
+     * the entries the adapter already holds (signed under the previous
+     * secret); schedule URLs are reissued under the current secret.
+     */
+    async rescheduleAll({previousKey}: {previousKey?: InternalApiKey} = {}): Promise<void> {
+        const scheduledResources = await this.#loadScheduledResources();
+        const currentKey = await this.#internalKeys.get('ghost-scheduler');
+        const unscheduleKey = previousKey ?? currentKey;
+
+        // Same-key rebuild (no previousKey, boot path) → URL signature is
+        // identical to the about-to-be-scheduled job. The default adapter
+        // implements unschedule via tombstones keyed by URL+time, so a same-URL
+        // unschedule poisons the scheduled job. Bootstrap mode skips the
+        // tombstone write. Rotation (previousKey provided) → URLs differ, so
+        // the tombstone correctly targets the old queued entry.
+        const bootstrap = !previousKey;
+
+        for (const resourceType of Object.keys(scheduledResources) as ScheduledResource[]) {
+            for (const model of scheduledResources[resourceType]) {
+                this.#adapter.unschedule(
+                    this.#normalize({model, key: unscheduleKey, resourceType}),
+                    {bootstrap}
+                );
+                this.#adapter.schedule(
+                    this.#normalize({model, key: currentKey, resourceType})
+                );
+            }
+        }
+    }
+
+    async #loadScheduledResources(): Promise<Record<ScheduledResource, any[]>> {
+        const entries = await Promise.all(SCHEDULED_RESOURCES.map(async (resourceType) => {
+            const found = await models.Post.findAll({
+                filter: `status:scheduled+type:${resourceType}`,
+                columns: ['id', 'published_at', 'created_at', 'type']
+            });
+            return [resourceType, found];
+        }));
+        return Object.fromEntries(entries);
+    }
+
+    #normalize({model, resourceType, key}: {model: any; resourceType: ScheduledResource; key: InternalApiKey}, event: '' | 'unscheduled' = ''): SchedulerJob {
+        const resource = `${resourceType}s`;
+        const publishedAt = (event === 'unscheduled') ? model.previous('published_at') : model.get('published_at');
+        const signedAdminToken = getSignedAdminToken({publishedAt, apiUrl: this.#apiUrl, key});
+        const url = `${urlUtils.urlJoin(this.#apiUrl, 'schedules', resource, model.get('id'))}/?token=${signedAdminToken}`;
+
+        return {
+            // NOTE: The scheduler expects a unix timestamp.
+            time: moment(publishedAt).valueOf(),
+            url,
+            extra: {
+                httpMethod: 'PUT',
+                oldTime: model.previous('published_at') ? moment(model.previous('published_at')).valueOf() : null
+            }
+        };
+    }
+}