@gadmin2n/schematics 0.0.141 → 0.0.143

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/humanApproval/human-approval.service.ts

@@ -21,8 +21,6 @@ import { HumanApprovalDomainError } from './human-approval.errors';
 
 type SignalResult = 'APPROVED' | 'REJECTED' | 'CANCELLED';
 type SignalReason = 'RULE_SATISFIED' | 'TIMEOUT' | 'WORKFLOW_CANCELLED';
-type DispatchState = 'DISPATCHING' | 'WAITING_APPROVAL' | 'DISPATCH_FAILED';
-
 @Injectable()
 export class HumanApprovalService {
   constructor(
@@ -48,23 +46,36 @@ export class HumanApprovalService {
       where: {
         workflowInstanceId_nodeId: { workflowInstanceId, nodeId: input.nodeId },
       },
+      include: { candidates: true },
     });
-    if (existing) return existing;
 
-    const channelRef = input.configSnapshot.channelRef?.trim();
-    if (channelRef) {
-      const channel = await this.prisma.approvalChannel.findUnique({
-        where: { code: channelRef },
-        select: { isEnabled: true },
+    const approvalWorkflowId = input.configSnapshot.approvalWorkflowId?.trim();
+    let approvalWorkflow: { isEnabled: boolean; status: string } | null = null;
+    if (approvalWorkflowId) {
+      approvalWorkflow = await this.prisma.workflow.findUnique({
+        where: { id: toBigInt(approvalWorkflowId) },
+        select: { isEnabled: true, status: true },
       });
-      if (!channel?.isEnabled)
+      if (
+        !approvalWorkflow?.isEnabled ||
+        approvalWorkflow.status !== 'PUBLISHED'
+      )
         throw approvalError(
           'APPROVAL_CONFIG_MISMATCH',
-          `Approval channel ${channelRef} was not found or is disabled`,
+          `Approval Workflow ${approvalWorkflowId} was not found, published, or enabled`,
           HttpStatus.BAD_REQUEST,
         );
     }
 
+    if (existing) {
+      return attachApprovalWorkflowInvocation(
+        existing,
+        existing.candidates,
+        approvalWorkflowId,
+        input,
+      );
+    }
+
     let materializedSubjects;
     try {
       materializedSubjects = mergeSubjectSources(
@@ -116,59 +127,40 @@ export class HumanApprovalService {
           candidates: { create: resolved.candidates },
         },
       });
-      if (channelRef && !blocked) {
+      if (approvalWorkflowId && !blocked) {
+        if (
+          !this.externalInteractions ||
+          !input.tenantNamespace ||
+          !input.approvalWorkflowRunId ||
+          !input.callbackToken ||
+          !approvalWorkflow
+        )
+          throw approvalError(
+            'APPROVAL_CONFIG_MISMATCH',
+            'External approval callback runtime is not configured',
+            HttpStatus.BAD_REQUEST,
+          );
         const interaction =
-          this.externalInteractions &&
-          input.tenantNamespace &&
-          input.temporalRunId
-            ? await this.externalInteractions.createInteractionInTransaction(
-                {
-                  tenantNamespace: input.tenantNamespace,
-                  handlerType: 'HUMAN_APPROVAL',
-                  handlerConfig: {
-                    approvalRequestId: String(request.id),
-                    allowedOutcomes: ['APPROVE', 'REJECT'],
-                  },
-                  workflowInstanceId: String(workflowInstanceId),
-                  workflowVersionId: String(workflowVersionId),
-                  temporalRunId: input.temporalRunId,
-                  nodeId: input.nodeId,
-                  ...(expiresAt && { expiresAt: expiresAt.toISOString() }),
-                },
-                tx,
-              )
-            : undefined;
-        await tx.workflowEventOutbox.create({
-          data: {
-            eventName: `approval.requested.${channelRef}`,
-            payload: {
-              workflow: input.channelInputs ?? {},
-              system: {
-                approval: {
-                  channel: channelRef,
-                  requestId: String(request.id),
-                  candidates: resolved.candidates.map((candidate) => ({
-                    approverId: candidate.principalRef,
-                    displayName: candidate.displayName,
-                    principalType: candidate.principalType,
-                  })),
-                  expiresAt: expiresAt?.toISOString() ?? null,
-                },
-                caller: {
-                  workflowInstanceId: String(workflowInstanceId),
-                  workflowVersionId: String(workflowVersionId),
-                  nodeId: input.nodeId,
-                },
-                invocation: {
-                  id: `approval:${request.id}:${channelRef}`,
-                },
-                ...(interaction && {
-                  callback: { token: interaction.callbackToken },
-                }),
-              },
-            } as Prisma.InputJsonValue,
-          },
-        });
+          await this.externalInteractions.createInteractionInTransaction(
+            {
+              callbackToken: input.callbackToken,
+              tenantNamespace: input.tenantNamespace,
+              handlerType: 'EXTERNAL_WAIT',
+              handlerConfig: { allowedOutcomes: ['RECEIVED'] },
+              workflowInstanceId: String(workflowInstanceId),
+              workflowVersionId: String(workflowVersionId),
+              temporalRunId: input.approvalWorkflowRunId,
+              nodeId: input.nodeId,
+              ...(expiresAt && { expiresAt: expiresAt.toISOString() }),
+            },
+            tx,
+          );
+        return attachApprovalWorkflowInvocation(
+          request,
+          resolved.candidates,
+          approvalWorkflowId,
+          { ...input, callbackToken: interaction.callbackToken },
+        );
       }
       return request;
     });
@@ -228,10 +220,10 @@ export class HumanApprovalService {
       if (!request) throw notFound(requestId);
 
       const snapshot = asObject(request.configSnapshot);
-      if (snapshot.channelRef !== input.channelRef)
+      if (snapshot.approvalWorkflowId !== input.approvalWorkflowId)
         throw approvalError(
-          'APPROVAL_CHANNEL_MISMATCH',
-          'Callback channel does not match the channel selected by this approval request',
+          'APPROVAL_WORKFLOW_MISMATCH',
+          'Result Workflow does not match the Workflow selected by this approval request',
           HttpStatus.FORBIDDEN,
         );
 
@@ -246,20 +238,18 @@ export class HumanApprovalService {
           HttpStatus.FORBIDDEN,
         );
 
-      return (
-        await this.recordDecision(
-          tx,
-          request,
-          candidate,
-          input,
-          `external:${input.channelRef}:${input.approverId}`,
-          {
-            ...(input.payload ?? {}),
-            externalEventId: input.eventId,
-            approvalChannel: input.channelRef,
-          },
-        )
-      ).decision;
+      return this.recordDecision(
+        tx,
+        request,
+        candidate,
+        input,
+        `external:${input.approvalWorkflowId}:${input.approverId}`,
+        {
+          ...(input.payload ?? {}),
+          externalEventId: input.eventId,
+          approvalWorkflowId: input.approvalWorkflowId,
+        },
+      );
     });
   }
 
@@ -423,24 +413,9 @@ export class HumanApprovalService {
       },
       orderBy: { activeFrom: 'desc' },
     });
-    return Promise.all(
-      items.map(async (item) => {
-        const channelRef = stringValue(
-          asObject(item.request.configSnapshot).channelRef,
-        );
-        return {
-          ...item,
-          request: {
-            ...item.request,
-            ...(channelRef && {
-              dispatch: await this.getDispatchStatus(
-                item.request.id,
-                channelRef,
-              ),
-            }),
-          },
-        };
-      }),
+    return items.filter(
+      (item) =>
+        !stringValue(asObject(item.request.configSnapshot).approvalWorkflowId),
     );
   }
 
@@ -458,44 +433,8 @@ export class HumanApprovalService {
         updatedAt: true,
       },
     });
-    const { configSnapshot, ...publicRequest } = request;
-    const channelRef = stringValue(asObject(configSnapshot).channelRef);
-    return {
-      ...publicRequest,
-      ...(channelRef && {
-        dispatch: await this.getDispatchStatus(requestId, channelRef),
-      }),
-    };
-  }
-
-  async retryDispatch(requestId: bigint) {
-    const request = await this.getRequest(requestId);
-    if (request.status !== 'PENDING') throw closed(request.id, request.status);
-
-    const channelRef = stringValue(asObject(request.configSnapshot).channelRef);
-    if (!channelRef)
-      throw approvalError(
-        'APPROVAL_CONFIG_MISMATCH',
-        'This approval request does not use an external channel',
-        HttpStatus.BAD_REQUEST,
-      );
-
-    const attempt = await this.findLatestDispatch(requestId, channelRef);
-    const dispatch = dispatchStatusFrom(attempt);
-    if (!attempt.outbox || dispatch.state !== 'DISPATCH_FAILED')
-      throw approvalError(
-        'APPROVAL_REQUEST_CLOSED',
-        'The approval request can only be resent after dispatch fails',
-        HttpStatus.CONFLICT,
-      );
-
-    await this.prisma.workflowEventOutbox.create({
-      data: {
-        eventName: `approval.requested.${channelRef}`,
-        payload: attempt.outbox.payload as Prisma.InputJsonValue,
-      },
-    });
-    return { success: true };
+    const { configSnapshot: _configSnapshot, ...publicRequest } = request;
+    return publicRequest;
   }
 
   private async finishPending(
@@ -527,33 +466,6 @@ export class HumanApprovalService {
     return request;
   }
 
-  private async getDispatchStatus(requestId: bigint, channelRef: string) {
-    return dispatchStatusFrom(
-      await this.findLatestDispatch(requestId, channelRef),
-    );
-  }
-
-  private async findLatestDispatch(requestId: bigint, channelRef: string) {
-    const outbox = await this.prisma.workflowEventOutbox.findFirst({
-      where: {
-        eventName: `approval.requested.${channelRef}`,
-        payload: {
-          path: ['requestId'],
-          equals: String(requestId),
-        },
-      },
-      orderBy: { createdAt: 'desc' },
-    });
-    const instance = outbox
-      ? await this.prisma.workflowInstance.findFirst({
-          where: { sourceOutboxId: outbox.id },
-          orderBy: { createdAt: 'desc' },
-          select: { status: true, result: true },
-        })
-      : null;
-    return { outbox, instance };
-  }
-
   private async resolveSubjects(
     configuredSubjects: Array<{ provider: string; refs: string[] }>,
     actor: ActorContext,
@@ -638,6 +550,40 @@ export class HumanApprovalService {
   }
 }
 
+function attachApprovalWorkflowInvocation(
+  request: any,
+  candidates: any[],
+  approvalWorkflowId: string | undefined,
+  input: StartApprovalRequestDto,
+) {
+  if (
+    !approvalWorkflowId ||
+    request.status !== 'PENDING' ||
+    !input.callbackToken
+  )
+    return request;
+  const expiresAt = request.expiresAt
+    ? new Date(request.expiresAt).toISOString()
+    : null;
+  return {
+    ...request,
+    approvalWorkflowInvocation: {
+      workflowId: approvalWorkflowId,
+      workflow: {
+        ...(input.approvalWorkflowInputs ?? {}),
+        requestId: String(request.id),
+        callbackToken: input.callbackToken,
+        candidates: candidates.map((candidate) => ({
+          approverId: candidate.principalRef,
+          displayName: candidate.displayName,
+          principalType: candidate.principalType,
+        })),
+        expiresAt,
+      },
+    },
+  };
+}
+
 function candidateKey(value: { principalType: string; principalRef: string }) {
   return `${value.principalType}\u0000${value.principalRef}`;
 }
@@ -691,69 +637,6 @@ function stringValue(value: unknown): string | null {
   return typeof value === 'string' && value.trim() ? value.trim() : null;
 }
 
-function dispatchStatusFrom(attempt: {
-  outbox: {
-    processed: boolean;
-    lastError: string | null;
-  } | null;
-  instance: {
-    status: string;
-    result: unknown;
-  } | null;
-}): {
-  state: DispatchState;
-  canRetry: boolean;
-  error?: string;
-} {
-  if (!attempt.outbox)
-    return {
-      state: 'DISPATCH_FAILED',
-      canRetry: false,
-      error: 'Approval dispatch event was not created',
-    };
-
-  if (!attempt.outbox.processed)
-    return {
-      state: 'DISPATCHING',
-      canRetry: false,
-      ...(attempt.outbox.lastError && { error: attempt.outbox.lastError }),
-    };
-
-  if (attempt.outbox.lastError)
-    return {
-      state: 'DISPATCH_FAILED',
-      canRetry: true,
-      error: attempt.outbox.lastError,
-    };
-
-  if (!attempt.instance)
-    return {
-      state: 'DISPATCH_FAILED',
-      canRetry: true,
-      error: 'Approval dispatch Workflow did not start',
-    };
-
-  if (attempt.instance.status === 'COMPLETED')
-    return { state: 'WAITING_APPROVAL', canRetry: false };
-  if (
-    attempt.instance.status === 'FAILED' ||
-    attempt.instance.status === 'CANCELLED'
-  )
-    return {
-      state: 'DISPATCH_FAILED',
-      canRetry: true,
-      ...(workflowError(attempt.instance.result) && {
-        error: workflowError(attempt.instance.result),
-      }),
-    };
-  return { state: 'DISPATCHING', canRetry: false };
-}
-
-function workflowError(result: unknown): string | undefined {
-  const error = asObject(result).error;
-  return typeof error === 'string' && error.trim() ? error : undefined;
-}
-
 function mergeSubjectSources(
   ...groups: Array<Array<{ provider: string; refs: string[] }>>
 ) {

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/humanApproval/humanApproval.module.ts

@@ -10,7 +10,6 @@ import { ApprovalSignalOutboxService } from './approval-signal-outbox.service';
 import { HumanApprovalController } from './human-approval.controller';
 import { HumanApprovalService } from './human-approval.service';
 import { HumanApprovalRuntimeController } from './runtime/human-approval-runtime.controller';
-import { RuntimeTokenGuard } from './runtime/runtime-token.guard';
 
 @Injectable()
 class HumanApprovalWidgetRegistrar implements OnModuleInit {
@@ -38,7 +37,6 @@ class HumanApprovalWidgetRegistrar implements OnModuleInit {
     HumanApprovalService,
     ApprovalSignalOutboxService,
     HumanApprovalWidgetRegistrar,
-    RuntimeTokenGuard,
     HumanApprovalHandler,
   ],
   exports: [HumanApprovalService],

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/humanApproval/runtime/human-approval-runtime.controller.ts

@@ -8,9 +8,10 @@ import {
   Post,
   UseGuards,
 } from '@nestjs/common';
-import { ConfigService } from '@nestjs/config';
 import { PrismaService } from 'nestjs-prisma';
 import { AllowUnauthorizedRequest } from '../../../lib/auth.guard';
+import { WorkflowCallbackUrlService } from '../../externalInteraction/workflow-callback-url.service';
+import { WorkflowRuntimeConfigService } from '../../workflowRuntimeConfig/workflow-runtime-config.service';
 import { SubmitExternalApprovalDecisionDto } from '../human-approval.dto';
 import { HumanApprovalService } from '../human-approval.service';
 import {
@@ -25,21 +26,14 @@ export class HumanApprovalRuntimeController {
   constructor(
     private readonly prisma: PrismaService,
     private readonly approvals: HumanApprovalService,
-    private readonly config: ConfigService,
+    private readonly runtimeConfig: WorkflowRuntimeConfigService,
+    private readonly callbackUrls: WorkflowCallbackUrlService,
   ) {}
 
   @Post('start')
   @AllowUnauthorizedRequest()
   async start(@Body() input: StartHumanApprovalRuntimeDto) {
-    const runtime = this.config.get<{ tenantNamespace: string }>(
-      'humanApprovalRuntime',
-    );
-    if (input.tenantNamespace !== runtime?.tenantNamespace)
-      throw new BadRequestException({
-        code: 'WORKFLOW_RUNTIME_TENANT_MISMATCH',
-        message: 'Runtime tenant does not match this application',
-        retryable: false,
-      });
+    await this.runtimeConfig.assertTenant(input.tenantNamespace);
     const instanceId = parseId(input.workflowInstanceId);
     const versionId = parseId(input.workflowVersionId);
     const instance = await this.prisma.workflowInstance.findUnique({
@@ -84,19 +78,32 @@ export class HumanApprovalRuntimeController {
         workflowVersionId: input.workflowVersionId,
         tenantNamespace: input.tenantNamespace,
         temporalRunId: input.temporalRunId,
+        approvalWorkflowRunId: input.approvalWorkflowRunId,
+        callbackToken: input.callbackToken,
         nodeId: input.nodeId,
         configHash: node.source.configHash,
         configSnapshot: node.config,
         dynamicInputs: input.dynamicInputs,
-        channelInputs: input.channelInputs,
+        approvalWorkflowInputs: input.approvalWorkflowInputs,
         resolvedSubjects: input.resolvedSubjects,
       },
       { userId: `runtime:${input.tenantNamespace}` },
     );
+    const approvalWorkflowInvocation = (request as any)
+      .approvalWorkflowInvocation;
     return {
       requestId: String(request.id),
       status: request.status,
       signalName: 'humanApprovalResolved',
+      ...(approvalWorkflowInvocation && {
+        approvalWorkflowInvocation: {
+          ...approvalWorkflowInvocation,
+          workflow: {
+            ...approvalWorkflowInvocation.workflow,
+            callbackUrl: await this.callbackUrls.resolveExternalCallback(),
+          },
+        },
+      }),
     };
   }
 
@@ -106,18 +113,16 @@ export class HumanApprovalRuntimeController {
     return this.approvals.status(parseId(requestId));
   }
 
+  @Post(':requestId/expire')
+  @AllowUnauthorizedRequest()
+  expire(@Param('requestId') requestId: string) {
+    return this.approvals.expireRequest(parseId(requestId));
+  }
+
   @Post('external-decisions')
   @AllowUnauthorizedRequest()
-  submitApprovalResult(@Body() input: SubmitApprovalResultRuntimeDto) {
-    const runtime = this.config.get<{ tenantNamespace: string }>(
-      'humanApprovalRuntime',
-    );
-    if (input.tenantNamespace !== runtime?.tenantNamespace)
-      throw new BadRequestException({
-        code: 'WORKFLOW_RUNTIME_TENANT_MISMATCH',
-        message: 'Runtime tenant does not match this application',
-        retryable: false,
-      });
+  async submitApprovalResult(@Body() input: SubmitApprovalResultRuntimeDto) {
+    await this.runtimeConfig.assertTenant(input.tenantNamespace);
     const {
       requestId,
       tenantNamespace: _tenantNamespace,

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/humanApproval/runtime/human-approval-runtime.dto.ts

@@ -48,7 +48,7 @@ export class StartHumanApprovalRuntimeDto {
 
   @IsOptional()
   @IsObject()
-  channelInputs?: Record<string, unknown>;
+  approvalWorkflowInputs?: Record<string, unknown>;
 
   @IsOptional()
   @IsArray()
@@ -59,6 +59,14 @@ export class StartHumanApprovalRuntimeDto {
   @IsString()
   @IsNotEmpty()
   temporalRunId: string;
+
+  @IsString()
+  @IsNotEmpty()
+  approvalWorkflowRunId: string;
+
+  @IsString()
+  @IsNotEmpty()
+  callbackToken: string;
 }
 
 export class SubmitApprovalResultRuntimeDto extends SubmitExternalApprovalDecisionDto {

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/humanApproval/runtime/runtime-token.guard.spec.ts

@@ -0,0 +1,30 @@
+import { RuntimeTokenGuard } from './runtime-token.guard';
+
+function context(token: string) {
+  return {
+    switchToHttp: () => ({
+      getRequest: () => ({
+        headers: { 'x-workflow-runtime-token': token },
+      }),
+    }),
+  } as any;
+}
+
+describe('RuntimeTokenGuard', () => {
+  it('authenticates with the token stored during service registration', async () => {
+    const guard = new RuntimeTokenGuard({
+      getRequired: jest.fn().mockResolvedValue({
+        runtimeToken: 'registered-runtime-token',
+      }),
+    } as any);
+
+    await expect(
+      guard.canActivate(context('registered-runtime-token')),
+    ).resolves.toBe(true);
+    await expect(
+      guard.canActivate(context('old-environment-token')),
+    ).rejects.toMatchObject({
+      response: { code: 'WORKFLOW_RUNTIME_UNAUTHORIZED' },
+    });
+  });
+});

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/humanApproval/runtime/runtime-token.guard.ts

@@ -2,31 +2,24 @@ import {
   CanActivate,
   ExecutionContext,
   Injectable,
-  ServiceUnavailableException,
   UnauthorizedException,
 } from '@nestjs/common';
-import { ConfigService } from '@nestjs/config';
 import { timingSafeEqual } from 'crypto';
+import { WorkflowRuntimeConfigService } from '../../workflowRuntimeConfig/workflow-runtime-config.service';
 
 @Injectable()
 export class RuntimeTokenGuard implements CanActivate {
-  constructor(private readonly config: ConfigService) {}
+  constructor(private readonly runtimeConfig: WorkflowRuntimeConfigService) {}
 
-  canActivate(context: ExecutionContext): boolean {
-    const runtime = this.config.get<{
-      enabled: boolean;
-      token: string;
-    }>('humanApprovalRuntime');
-    if (!runtime?.enabled)
-      throw new ServiceUnavailableException({
-        code: 'WORKFLOW_RUNTIME_DISABLED',
-        message: 'Workflow runtime is disabled',
-        retryable: false,
-      });
+  async canActivate(context: ExecutionContext): Promise<boolean> {
+    const runtime = await this.runtimeConfig.getRequired();
     const supplied = context.switchToHttp().getRequest().headers[
       'x-workflow-runtime-token'
     ];
-    if (typeof supplied !== 'string' || !safeEqual(supplied, runtime.token))
+    if (
+      typeof supplied !== 'string' ||
+      !safeEqual(supplied, runtime.runtimeToken)
+    )
       throw new UnauthorizedException({
         code: 'WORKFLOW_RUNTIME_UNAUTHORIZED',
         message: 'Invalid workflow runtime token',

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/index.ts

@@ -1,5 +1,4 @@
 import generatedModules from '../generated/modules.index';
-import { ApprovalChannelModule } from './approvalChannel/approvalChannel.module';
 import { CanvasModule } from './canvas/canvas.module';
 import { CodeRuntimeModule } from './codeRuntime/codeRuntime.module';
 import { ExternalInteractionModule } from './externalInteraction/externalInteraction.module';
@@ -12,7 +11,6 @@ import { WorkflowModule } from './workflow/workflow.module';
 
 export default [
   ...generatedModules,
-  ApprovalChannelModule,
   CanvasModule,
   CodeRuntimeModule,
   ExternalInteractionModule,

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/temporalTenantConfig/runtime-connectivity-probe.service.spec.ts

@@ -0,0 +1,14 @@
+import { RuntimeConnectivityProbeService } from './runtime-connectivity-probe.service';
+
+describe('RuntimeConnectivityProbeService', () => {
+  it('creates a short-lived signed probe without using the runtime token', () => {
+    const service = new RuntimeConnectivityProbeService({
+      get: jest.fn().mockReturnValue('integration-secret'),
+    } as any);
+
+    const probe = service.create();
+
+    expect(service.verify(probe)).toBe(true);
+    expect(service.verify(`${probe}tampered`)).toBe(false);
+  });
+});

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/temporalTenantConfig/runtime-connectivity-probe.service.ts

@@ -0,0 +1,37 @@
+import { Injectable, ServiceUnavailableException } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { createHmac, randomUUID, timingSafeEqual } from 'node:crypto';
+
+@Injectable()
+export class RuntimeConnectivityProbeService {
+  constructor(private readonly config: ConfigService) {}
+
+  create(): string {
+    const expiresAt = Date.now() + 30_000;
+    const payload = `${expiresAt}.${randomUUID()}`;
+    return `${payload}.${this.sign(payload)}`;
+  }
+
+  verify(token: string): boolean {
+    const separator = token.lastIndexOf('.');
+    if (separator < 1) return false;
+    const payload = token.slice(0, separator);
+    const signature = token.slice(separator + 1);
+    const expiresAt = Number(payload.slice(0, payload.indexOf('.')));
+    if (!Number.isFinite(expiresAt) || expiresAt < Date.now()) return false;
+    const expected = Buffer.from(this.sign(payload));
+    const supplied = Buffer.from(signature);
+    return (
+      expected.length === supplied.length && timingSafeEqual(expected, supplied)
+    );
+  }
+
+  private sign(payload: string): string {
+    const secret = this.config.get<string>('integration.secretKey')?.trim();
+    if (!secret)
+      throw new ServiceUnavailableException(
+        'INTEGRATION_SECRET_KEY is required for connectivity testing',
+      );
+    return createHmac('sha256', secret).update(payload).digest('base64url');
+  }
+}