@marinoscar/platform-api 0.0.0-stage → 0.1.0-next.10

package/dist/nodes/node-telemetry.service.js

@@ -0,0 +1,178 @@
+"use strict";
+// =============================================================================
+// The node span relay (issue #608)
+// =============================================================================
+//
+// `POST /api/nodes/:id/telemetry` lands here. A node reports the phases of a
+// job it ran (download, execute, upload, submit, secret) and this service
+// re-emits each accepted phase as a real OpenTelemetry span through the
+// server's own tracer, parented on the span that ENQUEUED the job
+// (`jobs.trace_context`, #607). The result, in the trace explorer: the request
+// that queued a backup, then the node's download/execute/upload/submit under
+// it, in one trace — and a node that never learns where the collector is.
+//
+// -----------------------------------------------------------------------------
+// THE ORDER OF OPERATIONS IS THE SECURITY ARGUMENT
+// -----------------------------------------------------------------------------
+//
+//   1. OWNERSHIP (`NodesService.assertOwnership`): 404/403 before anything
+//      else, so a caller learns nothing about a node that is not theirs, and
+//      so the rate-limit bucket below can only ever be keyed by a node the
+//      caller owns.
+//   2. RATE LIMIT (`NodeTelemetryRateLimiter`): 429 for the whole request.
+//   3. VALIDATION AND ATTRIBUTION, PER SPAN: a span that failed validation is
+//      dropped (the body schema parsed it to a marker), and a span is accepted
+//      only when its job is held by
+//      THIS node right now (`claimedByNodeId === :id`) or was settled by this
+//      node within the grace window (`NodeSettlementLedger`). Anything else —
+//      a job that does not exist, one held by another node, one this node ran
+//      last week — is DROPPED AND COUNTED, never accepted. Dropping rather than
+//      refusing the batch means one stale span cannot cost a node the rest of
+//      a legitimate batch, and the count tells the node (and a test) exactly
+//      what happened without saying anything about another node's jobs.
+//   4. EMISSION: identity attributes come from the PATH and the ROWS
+//      (`node.id`, `node.name`, `job.id`, `job.type`), never from the payload.
+//
+// ⚠ EMISSION NEVER THROWS. Tracing is an observer: a misbehaving exporter or
+// processor loses a span, never the request. An accepted span with tracing
+// off is discarded by the API's no-op tracer, and still counted as accepted —
+// "accepted" means "attributed and handed over", which is what the node can
+// act on.
+//
+// A JOB WITH NO STORED TRACE CONTEXT still gets its spans, as a root trace of
+// its own (the same choice `JobWorker.withJobSpan` makes for a server-run job
+// with no parent): `job.id` on every span still ties them together, and
+// dropping them would hide exactly the jobs enqueued outside a traced request
+// — crons, which are most of the background work.
+// =============================================================================
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var NodeTelemetryService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NodeTelemetryService = void 0;
+const common_1 = require("@nestjs/common");
+const api_1 = require("@opentelemetry/api");
+const index_1 = require("../otel-core/index");
+const index_2 = require("../jobs/index");
+const index_3 = require("../core/index");
+const node_telemetry_dto_1 = require("./dto/node-telemetry.dto");
+const node_span_attribute_registry_1 = require("./node-span-attribute.registry");
+const node_settlement_ledger_1 = require("./node-settlement-ledger");
+const node_telemetry_rate_limiter_1 = require("./node-telemetry-rate-limiter");
+const nodes_service_1 = require("./nodes.service");
+let NodeTelemetryService = NodeTelemetryService_1 = class NodeTelemetryService {
+    prisma;
+    nodes;
+    ledger;
+    limiter;
+    logger = new common_1.Logger(NodeTelemetryService_1.name);
+    constructor(prisma, nodes, ledger, limiter) {
+        this.prisma = prisma;
+        this.nodes = nodes;
+        this.ledger = ledger;
+        this.limiter = limiter;
+    }
+    async relay(userId, nodeId, dto) {
+        // 1. Ownership — see the header for why it comes first.
+        const node = await this.nodes.assertOwnership(userId, nodeId);
+        // 2. Budget.
+        const verdict = this.limiter.take(node.id, dto.spans.length);
+        if (!verdict.allowed) {
+            throw new common_1.HttpException({
+                message: `Worker node ${node.id} is sending spans faster than this server relays them. ` +
+                    `Drop this batch; do not retry it.`,
+                details: { nodeId: node.id, reason: 'rate_limited', retryAfterMs: verdict.retryAfterMs },
+            }, common_1.HttpStatus.TOO_MANY_REQUESTS);
+        }
+        // 3. Attribution — one query for the whole batch (at most 50 distinct ids).
+        //    A span that failed validation was parsed to the marker: it is dropped
+        //    here, individually, and never reaches the query.
+        const valid = dto.spans.filter(node_telemetry_dto_1.isValidNodeSpan);
+        if (valid.length === 0)
+            return { accepted: 0, dropped: dto.spans.length };
+        const jobIds = [...new Set(valid.map((span) => span.jobId))];
+        const rows = await this.prisma.job.findMany({
+            where: { id: { in: jobIds } },
+            select: { id: true, type: true, claimedByNodeId: true, traceContext: true, orgId: true },
+        });
+        const attributable = new Map();
+        for (const row of rows) {
+            if (row.claimedByNodeId === node.id || this.ledger.settledRecentlyBy(row.id, node.id)) {
+                attributable.set(row.id, row);
+            }
+        }
+        // 4. Emission.
+        let accepted = 0;
+        for (const span of valid) {
+            const job = attributable.get(span.jobId);
+            if (!job)
+                continue;
+            accepted += 1;
+            this.emit(node.id, node.name, job, span);
+        }
+        const dropped = dto.spans.length - accepted;
+        if (dropped > 0) {
+            this.logger.debug(`Node ${node.id}: dropped ${dropped} of ${dto.spans.length} relayed span(s) ` +
+                `(invalid, or for jobs not held or recently settled by this node)`);
+        }
+        return { accepted, dropped };
+    }
+    /** Re-emits one node phase span. Never throws — see the header. */
+    emit(nodeId, nodeName, job, span) {
+        try {
+            const attributes = {
+                'job.id': job.id,
+                'job.type': job.type,
+                'job.executor': 'node',
+                // The job's organization, when it has one (#734); never a metric label.
+                ...(0, index_2.jobOrgSpanAttributes)(job.orgId),
+                'node.id': nodeId,
+                'node.name': nodeName,
+                // Provenance: this span was reported by a node, not observed here.
+                'telemetry.relay': 'node',
+            };
+            // Only the allowlist is relayed (the platform's four integers and the
+            // app's registered ones); anything else, or a value the registry's type
+            // and bounds refuse, is dropped from the span.
+            for (const [key, value] of Object.entries(span.attributes ?? {})) {
+                const relayed = (0, node_span_attribute_registry_1.resolveRelayedAttribute)(key, value);
+                if (relayed !== undefined)
+                    attributes[relayed.name] = relayed.value;
+            }
+            if (span.status === 'error' && span.errorType !== undefined) {
+                attributes['error.type'] = span.errorType;
+            }
+            const otelSpan = api_1.trace.getTracer((0, index_1.resolveServiceName)()).startSpan(span.name, {
+                kind: api_1.SpanKind.INTERNAL,
+                startTime: span.startTimeUnixMs,
+                attributes,
+            }, (0, index_2.jobParentContext)(job.traceContext));
+            if (span.status === 'error') {
+                otelSpan.setStatus({ code: api_1.SpanStatusCode.ERROR, message: span.errorType ?? 'error' });
+            }
+            otelSpan.end(span.startTimeUnixMs + span.durationMs);
+        }
+        catch {
+            // Best-effort; see the header.
+        }
+    }
+};
+exports.NodeTelemetryService = NodeTelemetryService;
+exports.NodeTelemetryService = NodeTelemetryService = NodeTelemetryService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(index_3.PLATFORM_PRISMA)),
+    __metadata("design:paramtypes", [Object, nodes_service_1.NodesService,
+        node_settlement_ledger_1.NodeSettlementLedger,
+        node_telemetry_rate_limiter_1.NodeTelemetryRateLimiter])
+], NodeTelemetryService);
+//# sourceMappingURL=node-telemetry.service.js.map

package/dist/nodes/node-telemetry.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-telemetry.service.js","sourceRoot":"","sources":["../../src/nodes/node-telemetry.service.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,mCAAmC;AACnC,gFAAgF;AAChF,EAAE;AACF,6EAA6E;AAC7E,0EAA0E;AAC1E,wEAAwE;AACxE,kEAAkE;AAClE,+EAA+E;AAC/E,6EAA6E;AAC7E,0EAA0E;AAC1E,EAAE;AACF,gFAAgF;AAChF,mDAAmD;AACnD,gFAAgF;AAChF,EAAE;AACF,2EAA2E;AAC3E,6EAA6E;AAC7E,2EAA2E;AAC3E,oBAAoB;AACpB,2EAA2E;AAC3E,8EAA8E;AAC9E,+EAA+E;AAC/E,oCAAoC;AACpC,8EAA8E;AAC9E,8EAA8E;AAC9E,8EAA8E;AAC9E,gFAAgF;AAChF,8EAA8E;AAC9E,6EAA6E;AAC7E,wEAAwE;AACxE,qEAAqE;AACrE,+EAA+E;AAC/E,EAAE;AACF,6EAA6E;AAC7E,2EAA2E;AAC3E,8EAA8E;AAC9E,4EAA4E;AAC5E,UAAU;AACV,EAAE;AACF,8EAA8E;AAC9E,8EAA8E;AAC9E,wEAAwE;AACxE,8EAA8E;AAC9E,kDAAkD;AAClD,gFAAgF;;;;;;;;;;;;;;;;AAEhF,2CAAuF;AACvF,4CAAiF;AAEjF,8CAAwD;AACxD,yCAAuE;AAEvE,yCAAgD;AAChD,iEAAuF;AACvF,iFAAyE;AACzE,qEAAgE;AAChE,+EAAyE;AACzE,mDAA+C;AAkBxC,IAAM,oBAAoB,4BAA1B,MAAM,oBAAoB;IAIa;IACzB;IACA;IACA;IANF,MAAM,GAAG,IAAI,eAAM,CAAC,sBAAoB,CAAC,IAAI,CAAC,CAAC;IAEhE,YAC4C,MAAkB,EAC3C,KAAmB,EACnB,MAA4B,EAC5B,OAAiC;QAHR,WAAM,GAAN,MAAM,CAAY;QAC3C,UAAK,GAAL,KAAK,CAAc;QACnB,WAAM,GAAN,MAAM,CAAsB;QAC5B,YAAO,GAAP,OAAO,CAA0B;IACjD,CAAC;IAEJ,KAAK,CAAC,KAAK,CAAC,MAAc,EAAE,MAAc,EAAE,GAAqB;QAC/D,wDAAwD;QACxD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAE9D,aAAa;QACb,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7D,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,IAAI,sBAAa,CACrB;gBACE,OAAO,EACL,eAAe,IAAI,CAAC,EAAE,yDAAyD;oBAC/E,mCAAmC;gBACrC,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE;aACzF,EACD,mBAAU,CAAC,iBAAiB,CAC7B,CAAC;QACJ,CAAC;QAED,4EAA4E;QAC5E,2EAA2E;QAC3E,sDAAsD;QACtD,MAAM,KAAK,GAAe,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,oCAAe,CAAC,CAAC;QAC5D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAE1E,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC7D,MAAM,IAAI,GAAwB,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAC/D,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE;YAC7B,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE;SACzF,CAAC,CAAC;QACH,MAAM,YAAY,GAAG,IAAI,GAAG,EAA6B,CAAC;QAC1D,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,GAAG,CAAC,eAAe,KAAK,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;gBACtF,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QAED,eAAe;QACf,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACzC,IAAI,CAAC,GAAG;gBAAE,SAAS;YAEnB,QAAQ,IAAI,CAAC,CAAC;YACd,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAC3C,CAAC;QAED,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,QAAQ,CAAC;QAC5C,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,QAAQ,IAAI,CAAC,EAAE,aAAa,OAAO,OAAO,GAAG,CAAC,KAAK,CAAC,MAAM,mBAAmB;gBAC3E,kEAAkE,CACrE,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAC/B,CAAC;IAED,mEAAmE;IAC3D,IAAI,CAAC,MAAc,EAAE,QAAgB,EAAE,GAAsB,EAAE,IAAc;QACnF,IAAI,CAAC;YACH,MAAM,UAAU,GAAe;gBAC7B,QAAQ,EAAE,GAAG,CAAC,EAAE;gBAChB,UAAU,EAAE,GAAG,CAAC,IAAI;gBACpB,cAAc,EAAE,MAAM;gBACtB,wEAAwE;gBACxE,GAAG,IAAA,4BAAoB,EAAC,GAAG,CAAC,KAAK,CAAC;gBAClC,SAAS,EAAE,MAAM;gBACjB,WAAW,EAAE,QAAQ;gBACrB,mEAAmE;gBACnE,iBAAiB,EAAE,MAAM;aAC1B,CAAC;YAEF,sEAAsE;YACtE,wEAAwE;YACxE,+CAA+C;YAC/C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,CAAC;gBACjE,MAAM,OAAO,GAAG,IAAA,sDAAuB,EAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBACpD,IAAI,OAAO,KAAK,SAAS;oBAAE,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC;YACtE,CAAC;YAED,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5D,UAAU,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;YAC5C,CAAC;YAED,MAAM,QAAQ,GAAG,WAAK,CAAC,SAAS,CAAC,IAAA,0BAAkB,GAAE,CAAC,CAAC,SAAS,CAC9D,IAAI,CAAC,IAAI,EACT;gBACE,IAAI,EAAE,cAAQ,CAAC,QAAQ;gBACvB,SAAS,EAAE,IAAI,CAAC,eAAe;gBAC/B,UAAU;aACX,EACD,IAAA,wBAAgB,EAAC,GAAG,CAAC,YAAY,CAAC,CACnC,CAAC;YAEF,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;gBAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,oBAAc,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,IAAI,OAAO,EAAE,CAAC,CAAC;YACzF,CAAC;YAED,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,+BAA+B;QACjC,CAAC;IACH,CAAC;CACF,CAAA;AAjHY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;IAKR,WAAA,IAAA,eAAM,EAAC,uBAAe,CAAC,CAAA;6CACA,4BAAY;QACX,6CAAoB;QACnB,sDAAwB;GAPzC,oBAAoB,CAiHhC"}

package/dist/nodes/nodes-admin.controller.d.ts

@@ -0,0 +1,12 @@
+import { AdminNodeCredentialDto, AdminNodeDto } from './dto/node-admin.dto';
+import { NodesAdminService } from './nodes-admin.service';
+export declare class NodesAdminController {
+    private readonly nodes;
+    constructor(nodes: NodesAdminService);
+    listCredentials(): Promise<AdminNodeCredentialDto[]>;
+    revokeCredential(id: string): Promise<void>;
+    list(): Promise<AdminNodeDto[]>;
+    get(id: string): Promise<AdminNodeDto>;
+    remove(id: string): Promise<void>;
+}
+//# sourceMappingURL=nodes-admin.controller.d.ts.map

package/dist/nodes/nodes-admin.controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nodes-admin.controller.d.ts","sourceRoot":"","sources":["../../src/nodes/nodes-admin.controller.ts"],"names":[],"mappings":"AAqEA,OAAO,EAAE,sBAAsB,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE1D,qBAEa,oBAAoB;IACnB,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAAL,KAAK,EAAE,iBAAiB;IAqB/C,eAAe,IAAI,OAAO,CAAC,sBAAsB,EAAE,CAAC;IAoBpD,gBAAgB,CAA6B,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAmBvE,IAAI,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;IAqB/B,GAAG,CAA6B,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAsBlE,MAAM,CAA6B,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGpE"}

package/dist/nodes/nodes-admin.controller.js

@@ -0,0 +1,218 @@
+"use strict";
+// =============================================================================
+// /api/admin/nodes — the fleet as an administrator sees it (issue #270, epic #254)
+// =============================================================================
+//
+// The admin counterpart to `NodesController`, and mounted on a DIFFERENT
+// PREFIX for a reason that is not organisational:
+//
+//   `JwtAuthGuard` admits a `nod_` credential on `/api/nodes` and paths
+//   beneath it, and refuses it everywhere else (#267). Every route mounted
+//   under `NodesController` is therefore reachable by an unattended,
+//   months-old worker token on somebody else's box. These routes list every
+//   node in the deployment with its OWNER'S EMAIL, and delete nodes and
+//   credentials belonging to other people — none of which belongs inside that
+//   blast radius. Mounting them at `admin/nodes` puts them outside the
+//   allowlist by construction rather than by a check somebody has to remember.
+//
+// The controller binds, documents and authorizes; every decision lives in
+// `nodes-admin.service.ts`, including the derived health verdict and the
+// single `groupBy` behind the job counts.
+//
+// -----------------------------------------------------------------------------
+// ⚠ THE `credentials` LITERALS ARE DECLARED BEFORE `:id`, AND THE ORDER IS
+// LOAD-BEARING
+// -----------------------------------------------------------------------------
+//
+// Nest matches routes in DECLARATION ORDER, not by specificity.
+// `GET /admin/nodes/credentials` is one segment past the prefix — exactly the
+// shape `GET /admin/nodes/:id` matches — so declaring `:id` first captures it
+// with `id = 'credentials'`, `ParseUUIDPipe` rejects that, and an
+// administrator pressing "credentials" is told
+// `400 Validation failed (uuid is expected)`: a message that names nothing
+// about the real mistake, in a file nobody would think to open. No error at
+// boot, no warning in the log.
+//
+// `DELETE /admin/nodes/credentials/:id` is two segments and could not be
+// captured by today's one-segment `:id` whatever the order — but it is
+// declared with the other literal anyway. The rule that survives is "every
+// literal above every parameterised route", not "every literal that would
+// currently break"; a later `:id/:action` route would swallow it silently, and
+// by then nobody is re-deriving which literals were safe by accident. This is
+// the same rule `job-admin.controller.ts` and `nodes.controller.ts` state, and
+// `test/nodes/nodes-admin.integration.spec.ts` drives
+// `GET /api/admin/nodes/credentials` through the real router to prove it did
+// not resolve as `:id`.
+//
+// -----------------------------------------------------------------------------
+// PERMISSIONS: THE SAME PAIR THE OWNER-SCOPED PLANE USES
+// -----------------------------------------------------------------------------
+//
+// `nodes:read` for the two lists and the detail, `nodes:write` for the two
+// deletions, both additionally gated on the Admin role — matching
+// `job-admin.controller.ts`, where the role admits and the permission is what
+// the guard checks. Deliberately NOT a new `nodes:admin` permission: the split
+// that matters is read-versus-write (an operations role that may AUDIT the
+// fleet without being able to delete any of it), and the deployment-versus-own
+// scope is already expressed by the route prefix and the Admin role. A third
+// string would have to be seeded, documented and mirrored in a settings card,
+// and would express nothing the two existing ones plus the role do not.
+//
+// These exact strings are the API half of the contract a settings card's
+// `permission` field must mirror byte for byte (CLAUDE.md, Settings UI Pattern
+// rule 3).
+// =============================================================================
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NodesAdminController = void 0;
+const common_1 = require("@nestjs/common");
+const swagger_1 = require("@nestjs/swagger");
+const index_1 = require("../identity/index");
+const nodes_constants_1 = require("./nodes.constants");
+const node_admin_dto_1 = require("./dto/node-admin.dto");
+const nodes_admin_service_1 = require("./nodes-admin.service");
+let NodesAdminController = class NodesAdminController {
+    nodes;
+    constructor(nodes) {
+        this.nodes = nodes;
+    }
+    // ---------------------------------------------------------------------------
+    // Literal routes. Nothing parameterised may be declared above this block —
+    // see the file header.
+    // ---------------------------------------------------------------------------
+    async listCredentials() {
+        return this.nodes.listCredentials();
+    }
+    async revokeCredential(id) {
+        await this.nodes.revokeCredential(id);
+    }
+    async list() {
+        return this.nodes.listFleet();
+    }
+    // ---------------------------------------------------------------------------
+    // Parameterised routes. Nothing literal may be declared below this line.
+    // ---------------------------------------------------------------------------
+    async get(id) {
+        return this.nodes.getNode(id);
+    }
+    async remove(id) {
+        await this.nodes.deleteNode(id);
+    }
+};
+exports.NodesAdminController = NodesAdminController;
+__decorate([
+    (0, common_1.Get)('credentials'),
+    (0, index_1.Auth)({ roles: [nodes_constants_1.ROLES.ADMIN], permissions: [nodes_constants_1.PERMISSIONS.NODES_READ] }),
+    (0, swagger_1.ApiOperation)({
+        summary: 'List every node credential in the deployment, with its owner',
+        description: 'The audit view of the `nod_` tokens that can reach `/api/nodes`. A node credential has ' +
+            'no mandatory expiry — a worker runs unattended for months, and revocation rather than a ' +
+            'clock is the intended control — so this list is how an administrator answers "which ' +
+            'long-lived tokens exist, whose are they, and which have not been used in a year". ' +
+            'Masked: the raw token is shown exactly once at creation and the stored hash is never ' +
+            'returned. Revoked credentials are included, with `revokedAt` set, because a revoked ' +
+            'token is part of the audit trail.',
+    }),
+    (0, swagger_1.ApiResponse)({ status: 200, description: 'Every credential', type: [node_admin_dto_1.AdminNodeCredentialDto] }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], NodesAdminController.prototype, "listCredentials", null);
+__decorate([
+    (0, common_1.Delete)('credentials/:id'),
+    (0, index_1.Auth)({ roles: [nodes_constants_1.ROLES.ADMIN], permissions: [nodes_constants_1.PERMISSIONS.NODES_WRITE] }),
+    (0, common_1.HttpCode)(common_1.HttpStatus.NO_CONTENT),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Revoke any node credential',
+        description: 'Cuts a worker token off immediately, whoever owns it — the control that replaces a ' +
+            'mandatory expiry. Revocation is a one-way door: `revokedAt` is stamped once and never ' +
+            'cleared, and a node holding the token gets `401` on its very next request. Revoking an ' +
+            'already-revoked credential is `404` rather than a silent success, so an administrator ' +
+            'racing another one is told the state changed under them. Deleting the credential is NOT ' +
+            'the same thing and is not offered: the row is the record that the token existed.',
+    }),
+    (0, swagger_1.ApiParam)({ name: 'id', type: String, format: 'uuid' }),
+    (0, swagger_1.ApiResponse)({ status: 204, description: 'Credential revoked' }),
+    (0, swagger_1.ApiResponse)({ status: 404, description: 'No such credential, or it was already revoked' }),
+    __param(0, (0, common_1.Param)('id', common_1.ParseUUIDPipe)),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", Promise)
+], NodesAdminController.prototype, "revokeCredential", null);
+__decorate([
+    (0, common_1.Get)(),
+    (0, index_1.Auth)({ roles: [nodes_constants_1.ROLES.ADMIN], permissions: [nodes_constants_1.PERMISSIONS.NODES_READ] }),
+    (0, swagger_1.ApiOperation)({
+        summary: 'List the whole fleet, with derived health and job counts',
+        description: 'Every worker node in the deployment, whoever registered it, with its owner and its job ' +
+            'counts by status. Read `status` and `health` together and do not confuse them: `status` ' +
+            'is operator state (`disabled` refuses claims, `draining` finishes what it holds), while ' +
+            '`health` is DERIVED from `lastHeartbeatAt` at read time — `healthy` inside the ' +
+            '`nodes.staleHeartbeatSeconds` window, `stale` outside it, `offline` when the status ' +
+            'already says so. A node that crashed reads `stale` until the fleet sweep marks it ' +
+            '`offline`, and `offline` thereafter. Counts come from one grouped query for the whole ' +
+            'fleet, so this endpoint is safe to poll.',
+    }),
+    (0, swagger_1.ApiResponse)({ status: 200, description: 'The whole fleet', type: [node_admin_dto_1.AdminNodeDto] }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], NodesAdminController.prototype, "list", null);
+__decorate([
+    (0, common_1.Get)(':id'),
+    (0, index_1.Auth)({ roles: [nodes_constants_1.ROLES.ADMIN], permissions: [nodes_constants_1.PERMISSIONS.NODES_READ] }),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Get one node, whoever owns it',
+        description: 'The same shape the fleet list returns, for a single node — including the health verdict, ' +
+            'which is computed by the same function against the same policy, so this view and the ' +
+            'list can never disagree about whether a node is stale. `404` when there is no such ' +
+            'node; never `403`, because an administrator’s scope is the whole deployment.',
+    }),
+    (0, swagger_1.ApiParam)({ name: 'id', type: String, format: 'uuid' }),
+    (0, swagger_1.ApiResponse)({ status: 200, description: 'The node', type: node_admin_dto_1.AdminNodeDto }),
+    (0, swagger_1.ApiResponse)({ status: 404, description: 'No such node' }),
+    __param(0, (0, common_1.Param)('id', common_1.ParseUUIDPipe)),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", Promise)
+], NodesAdminController.prototype, "get", null);
+__decorate([
+    (0, common_1.Delete)(':id'),
+    (0, index_1.Auth)({ roles: [nodes_constants_1.ROLES.ADMIN], permissions: [nodes_constants_1.PERMISSIONS.NODES_WRITE] }),
+    (0, common_1.HttpCode)(common_1.HttpStatus.NO_CONTENT),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Delete a node record, whoever owns it',
+        description: 'Forgets the node — the manual equivalent of what the retention prune does on a timer. ' +
+            'Jobs are NOT deleted: their `claimedByNodeId` is cleared and the rows stay exactly as ' +
+            'they were, so a job this node was running is picked up by the lease reaper and requeued ' +
+            'or failed on its normal attempt budget. Unlike the automatic prune this is allowed even ' +
+            'while the node holds running jobs, because the node an administrator deletes is usually ' +
+            'the one that is never coming back and whose jobs they are trying to unstick. Deleting a ' +
+            'node does NOT revoke its credential: the same token can register a new node, so revoke ' +
+            'it too if the machine is gone for good.',
+    }),
+    (0, swagger_1.ApiParam)({ name: 'id', type: String, format: 'uuid' }),
+    (0, swagger_1.ApiResponse)({ status: 204, description: 'Node deleted' }),
+    (0, swagger_1.ApiResponse)({ status: 404, description: 'No such node' }),
+    __param(0, (0, common_1.Param)('id', common_1.ParseUUIDPipe)),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", Promise)
+], NodesAdminController.prototype, "remove", null);
+exports.NodesAdminController = NodesAdminController = __decorate([
+    (0, swagger_1.ApiTags)('Worker Nodes'),
+    (0, common_1.Controller)('admin/nodes'),
+    __metadata("design:paramtypes", [nodes_admin_service_1.NodesAdminService])
+], NodesAdminController);
+//# sourceMappingURL=nodes-admin.controller.js.map

package/dist/nodes/nodes-admin.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nodes-admin.controller.js","sourceRoot":"","sources":["../../src/nodes/nodes-admin.controller.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,mFAAmF;AACnF,gFAAgF;AAChF,EAAE;AACF,yEAAyE;AACzE,kDAAkD;AAClD,EAAE;AACF,wEAAwE;AACxE,2EAA2E;AAC3E,qEAAqE;AACrE,4EAA4E;AAC5E,wEAAwE;AACxE,8EAA8E;AAC9E,uEAAuE;AACvE,+EAA+E;AAC/E,EAAE;AACF,0EAA0E;AAC1E,yEAAyE;AACzE,0CAA0C;AAC1C,EAAE;AACF,gFAAgF;AAChF,2EAA2E;AAC3E,eAAe;AACf,gFAAgF;AAChF,EAAE;AACF,gEAAgE;AAChE,8EAA8E;AAC9E,8EAA8E;AAC9E,kEAAkE;AAClE,+CAA+C;AAC/C,2EAA2E;AAC3E,4EAA4E;AAC5E,+BAA+B;AAC/B,EAAE;AACF,yEAAyE;AACzE,uEAAuE;AACvE,2EAA2E;AAC3E,0EAA0E;AAC1E,+EAA+E;AAC/E,8EAA8E;AAC9E,+EAA+E;AAC/E,sDAAsD;AACtD,6EAA6E;AAC7E,wBAAwB;AACxB,EAAE;AACF,gFAAgF;AAChF,yDAAyD;AACzD,gFAAgF;AAChF,EAAE;AACF,2EAA2E;AAC3E,kEAAkE;AAClE,8EAA8E;AAC9E,+EAA+E;AAC/E,2EAA2E;AAC3E,+EAA+E;AAC/E,6EAA6E;AAC7E,8EAA8E;AAC9E,wEAAwE;AACxE,EAAE;AACF,yEAAyE;AACzE,+EAA+E;AAC/E,WAAW;AACX,gFAAgF;;;;;;;;;;;;;;;AAEhF,2CAAqG;AACrG,6CAA+E;AAE/E,6CAAyC;AACzC,uDAAuD;AACvD,yDAA4E;AAC5E,+DAA0D;AAInD,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IACF;IAA7B,YAA6B,KAAwB;QAAxB,UAAK,GAAL,KAAK,CAAmB;IAAG,CAAC;IAEzD,8EAA8E;IAC9E,2EAA2E;IAC3E,uBAAuB;IACvB,8EAA8E;IAgBxE,AAAN,KAAK,CAAC,eAAe;QACnB,OAAO,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;IACtC,CAAC;IAkBK,AAAN,KAAK,CAAC,gBAAgB,CAA6B,EAAU;QAC3D,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;IACxC,CAAC;IAiBK,AAAN,KAAK,CAAC,IAAI;QACR,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;IAChC,CAAC;IAED,8EAA8E;IAC9E,yEAAyE;IACzE,8EAA8E;IAexE,AAAN,KAAK,CAAC,GAAG,CAA6B,EAAU;QAC9C,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAChC,CAAC;IAoBK,AAAN,KAAK,CAAC,MAAM,CAA6B,EAAU;QACjD,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAClC,CAAC;CACF,CAAA;AA3GY,oDAAoB;AAsBzB;IAdL,IAAA,YAAG,EAAC,aAAa,CAAC;IAClB,IAAA,YAAI,EAAC,EAAE,KAAK,EAAE,CAAC,uBAAK,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC,6BAAW,CAAC,UAAU,CAAC,EAAE,CAAC;IACrE,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,8DAA8D;QACvE,WAAW,EACT,yFAAyF;YACzF,0FAA0F;YAC1F,sFAAsF;YACtF,oFAAoF;YACpF,uFAAuF;YACvF,sFAAsF;YACtF,mCAAmC;KACtC,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,uCAAsB,CAAC,EAAE,CAAC;;;;2DAG7F;AAkBK;IAhBL,IAAA,eAAM,EAAC,iBAAiB,CAAC;IACzB,IAAA,YAAI,EAAC,EAAE,KAAK,EAAE,CAAC,uBAAK,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC,6BAAW,CAAC,WAAW,CAAC,EAAE,CAAC;IACtE,IAAA,iBAAQ,EAAC,mBAAU,CAAC,UAAU,CAAC;IAC/B,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,4BAA4B;QACrC,WAAW,EACT,qFAAqF;YACrF,wFAAwF;YACxF,yFAAyF;YACzF,wFAAwF;YACxF,0FAA0F;YAC1F,kFAAkF;KACrF,CAAC;IACD,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACtD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,oBAAoB,EAAE,CAAC;IAC/D,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,+CAA+C,EAAE,CAAC;IACnE,WAAA,IAAA,cAAK,EAAC,IAAI,EAAE,sBAAa,CAAC,CAAA;;;;4DAEjD;AAiBK;IAfL,IAAA,YAAG,GAAE;IACL,IAAA,YAAI,EAAC,EAAE,KAAK,EAAE,CAAC,uBAAK,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC,6BAAW,CAAC,UAAU,CAAC,EAAE,CAAC;IACrE,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,0DAA0D;QACnE,WAAW,EACT,yFAAyF;YACzF,0FAA0F;YAC1F,0FAA0F;YAC1F,iFAAiF;YACjF,sFAAsF;YACtF,oFAAoF;YACpF,wFAAwF;YACxF,0CAA0C;KAC7C,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,6BAAY,CAAC,EAAE,CAAC;;;;gDAGlF;AAmBK;IAbL,IAAA,YAAG,EAAC,KAAK,CAAC;IACV,IAAA,YAAI,EAAC,EAAE,KAAK,EAAE,CAAC,uBAAK,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC,6BAAW,CAAC,UAAU,CAAC,EAAE,CAAC;IACrE,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,+BAA+B;QACxC,WAAW,EACT,2FAA2F;YAC3F,uFAAuF;YACvF,qFAAqF;YACrF,8EAA8E;KACjF,CAAC;IACD,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACtD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,6BAAY,EAAE,CAAC;IACzE,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC;IAC/C,WAAA,IAAA,cAAK,EAAC,IAAI,EAAE,sBAAa,CAAC,CAAA;;;;+CAEpC;AAoBK;IAlBL,IAAA,eAAM,EAAC,KAAK,CAAC;IACb,IAAA,YAAI,EAAC,EAAE,KAAK,EAAE,CAAC,uBAAK,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC,6BAAW,CAAC,WAAW,CAAC,EAAE,CAAC;IACtE,IAAA,iBAAQ,EAAC,mBAAU,CAAC,UAAU,CAAC;IAC/B,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,uCAAuC;QAChD,WAAW,EACT,wFAAwF;YACxF,wFAAwF;YACxF,0FAA0F;YAC1F,0FAA0F;YAC1F,0FAA0F;YAC1F,0FAA0F;YAC1F,yFAAyF;YACzF,yCAAyC;KAC5C,CAAC;IACD,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACtD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC;IACzD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC;IAC5C,WAAA,IAAA,cAAK,EAAC,IAAI,EAAE,sBAAa,CAAC,CAAA;;;;kDAEvC;+BA1GU,oBAAoB;IAFhC,IAAA,iBAAO,EAAC,cAAc,CAAC;IACvB,IAAA,mBAAU,EAAC,aAAa,CAAC;qCAEY,uCAAiB;GAD1C,oBAAoB,CA2GhC"}

package/dist/nodes/nodes-admin.service.d.ts

@@ -0,0 +1,111 @@
+import { type JobsPrisma } from '../jobs/index';
+import { AdminNodeCredentialDto, AdminNodeDto } from './dto/node-admin.dto';
+import { NodeLifecycleService } from './node-lifecycle.service';
+import { NodeCredentialService } from './node-credential.service';
+/**
+ * The owner columns every admin response carries, selected explicitly.
+ *
+ * The column on `User` is `displayName`; the wire field is `owner.name`. The
+ * two names are deliberately different and `toAdminNodeDto` maps between them
+ * — selecting `name` here is not a fix, it is a Prisma validation error.
+ *
+ * Exported (not module-private) so
+ * `test/nodes/worker-node-model-fields.spec.ts` can assert its keys are real
+ * `User` scalar columns without duplicating this literal — issue #340 was
+ * exactly this select naming a column, `name`, that does not exist, and every
+ * existing test mocked `PrismaService` so nothing caught it.
+  *
+  * @stability experimental
+ */
+export declare const OWNER_SELECT: {
+    /** The owner columns joined: id, email and display name only. */
+    readonly select: {
+        readonly [K in 'id' | 'email' | 'displayName']: true;
+    };
+};
+/**
+ * The `/api/admin/nodes` fleet read side: nodes, their vitals and job counts, and every node credential.
+ *
+ * @stability experimental
+ */
+export declare class NodesAdminService {
+    private readonly prisma;
+    private readonly lifecycle;
+    private readonly credentials;
+    private readonly logger;
+    constructor(prisma: JobsPrisma, lifecycle: NodeLifecycleService, credentials: NodeCredentialService);
+    /**
+     * Every node in the deployment, with derived health and job counts.
+     *
+     * THREE QUERIES, AND THE NUMBER DOES NOT DEPEND ON THE FLEET SIZE: the
+     * nodes, the settings row behind the stale window, and one `groupBy` for
+     * every node's counts at once. See the file header.
+     *
+     * Ordered by name, matching `NodesService.listNodes`, so a node keeps the
+     * same position in the admin table and the owner's own list.
+     *
+     * Not paginated, for the reason `listCredentials` gives: a fleet is bounded
+     * by machines an operator physically runs, and a page cursor over a list
+     * somebody is scanning for the one red row hides that row on page two.
+     */
+    listFleet(): Promise<AdminNodeDto[]>;
+    /**
+     * One node, whoever owns it.
+     *
+     * The detail half of the pair, and it exists so `deriveNodeHealth` has TWO
+     * callers rather than one: a single caller is a function that has not yet
+     * been proven shared, and the next surface that needs a verdict is the one
+     * that writes its own. It is also the natural place an admin lands from a
+     * row in the fleet table.
+     *
+     * `404` when there is no such node — never a `403`, because an
+     * administrator's scope is the deployment and there is no other user's row
+     * for them to be refused.
+     */
+    getNode(nodeId: string): Promise<AdminNodeDto>;
+    /** Every node credential in the deployment, masked, with its owner. */
+    listCredentials(): Promise<AdminNodeCredentialDto[]>;
+    /**
+     * Removes a node record, whoever owns it.
+     *
+     * ⚠ THIS IS ALLOWED EVEN WHILE THE NODE HOLDS `running` JOBS, which is the
+     * opposite of what `NodeOfflinePruneTask` does, and the difference is
+     * intent. The prune is a TIMER acting on a guess about a machine nobody has
+     * looked at; when it is wrong it destroys a registration silently, so it
+     * declines the ambiguous case. This is an ADMINISTRATOR who has looked and
+     * decided — most often at a node they know is never coming back, which is
+     * precisely the node whose jobs are stuck and which they are deleting in
+     * order to unstick them. Refusing here would make the tool useless in the
+     * only situation anybody reaches for it.
+     *
+     * Held jobs are NOT deleted and NOT requeued here. `Job.claimedByNode` is
+     * `onDelete: SetNull`, so their claim pointer is nulled and the rows stay
+     * exactly as they were — still `running`, still carrying their lease. The
+     * lease reaper then finds them by the signal it already has (an expired
+     * lease belonging to nobody) and requeues or fails them on the normal
+     * budget. REJECTED: requeueing them here. It would be a second, hand-written
+     * copy of the reaper's two-phase decision — including the attempt-budget
+     * give-up — living in an admin service, and the first divergence between the
+     * two is a poison-pill job that becomes eternal when an admin deletes its
+     * node.
+     */
+    deleteNode(nodeId: string): Promise<void>;
+    /** Revokes any node credential, whoever owns it. */
+    revokeCredential(credentialId: string): Promise<void>;
+    /**
+     * Job counts for every node at once, as `nodeId -> counts`.
+     *
+     * ONE `groupBy`, whatever the fleet size — the whole point of the file
+     * header. `nodeId` narrows it to a single node for the detail read; the
+     * shape of the query is identical either way, so the list and the detail
+     * cannot end up counting differently.
+     *
+     * `claimedByNodeId: { not: null }` keeps the server's own in-process jobs
+     * out of the grouping: they are the majority of rows in a single-server
+     * deployment and belong to no node.
+     */
+    private jobCountsByNode;
+    /** A row plus its derived verdict and counts, as the wire shape. */
+    private toAdminNodeDto;
+}
+//# sourceMappingURL=nodes-admin.service.d.ts.map

package/dist/nodes/nodes-admin.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nodes-admin.service.d.ts","sourceRoot":"","sources":["../../src/nodes/nodes-admin.service.ts"],"names":[],"mappings":"AA6DA,OAAO,EAAE,KAAK,UAAU,EAAmB,MAAM,eAAe,CAAC;AAGjE,OAAO,EACL,sBAAsB,EACtB,YAAY,EAGb,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAoB,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAClF,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAElE;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,YAAY,EAAE;IACzB,iEAAiE;IACjE,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,CAAC,IAAI,IAAI,GAAG,OAAO,GAAG,aAAa,GAAG,IAAI;KAAE,CAAC;CAChB,CAAC;AAO7D;;;;GAIG;AACH,qBACa,iBAAiB;IAID,OAAO,CAAC,QAAQ,CAAC,MAAM;IAChD,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAL9B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsC;gBAGjB,MAAM,EAAE,UAAU,EAC3C,SAAS,EAAE,oBAAoB,EAC/B,WAAW,EAAE,qBAAqB;IAOrD;;;;;;;;;;;;;OAaG;IACG,SAAS,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;IAiB1C;;;;;;;;;;;;OAYG;IACG,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAyBpD,uEAAuE;IACjE,eAAe,IAAI,OAAO,CAAC,sBAAsB,EAAE,CAAC;IAmB1D;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACG,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAsB/C,oDAAoD;IAC9C,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ3D;;;;;;;;;;;OAWG;YACW,eAAe;IA4B7B,oEAAoE;IACpE,OAAO,CAAC,cAAc;CAmCvB"}