@onlineapps/mq-client-core 4.1.0 → 5.0.0

package/src/utils/decodeMessage.js

@@ -0,0 +1,123 @@
+'use strict';
+
+/**
+ * decodeMessage.js
+ *
+ * The one rail from "the broker delivered bytes" to "here is the message".
+ *
+ * `consume()` hands its handler the RAW amqplib delivery and decodes nothing for it, so
+ * every consumer on the platform wrote that translation itself. Measured in d.788: FOUR
+ * copies — `api_delivery_dispatcher` (`DeliveryDispatcher._parseMessage`), `api_scheduler`
+ * (`consumer/parseRequestMessage.js`), `@onlineapps/service-wrapper`
+ * (`_processWorkflowMessage`) and `api_services_registry` (`mqManager.consume`) — which
+ * disagree about the only thing that matters, what happens to a BAD message: one
+ * dead-letters it, one files it on a loss rail, one answers `INVALID_JSON`, and one
+ * requeues it for ever. Two of them also sniff the shape: a delivery with no `content` is
+ * passed on AS the body, so a message the strict one refuses by name travels through them
+ * as a valid one.
+ *
+ * The decoding itself was never missing — `./serializer.js` `deserialize()` has done it
+ * since the package was extracted. What was missing is the DOOR: `serializer` is not in
+ * `src/index.js`, and `src/…` is an internal path, not a contract. This module is that
+ * door plus the contract around it; it holds no second `JSON.parse`.
+ *
+ * ADDITIVE ONLY. Nothing in this package calls it yet and `consume()` is unchanged:
+ * converting the four consumers changes what happens to a malformed message, which is a
+ * BREAKING change that goes with the major wave — and, for the registry, only after its
+ * queue has a dead-letter route at all (d.784).
+ *
+ * @see ./serializer.js
+ * @see ../index.js — where it is exported
+ * @see api/docs/biz/10-invocation/mq-envelope.md — the envelope this decodes
+ */
+
+const { ValidationError } = require('./errorHandler');
+const serializer = require('./serializer');
+
+/** The one content type the platform's envelope travels as. */
+const JSON_CONTENT_TYPE = 'application/json';
+
+/**
+ * Translate one delivery into the message it carries.
+ *
+ * WHAT IT REFUSES, and with which class — both already this package's own, so a listener
+ * needs no new vocabulary:
+ *
+ *  - a delivery that is not a message, carries no readable `content`, declares a content
+ *    type this decoder does not read, or carries an empty body → `ValidationError`, the
+ *    class this package uses for a caller's mistake, naming what arrived
+ *    (`architecture-principles.md` §4 fail-fast, §5 message shape);
+ *  - a body that is not JSON → the `SerializationError` `deserialize()` throws, passed
+ *    through UNCHANGED, so the bytes it refused (`payload`) and the parser's own reason
+ *    (`cause`) survive. Rewrapping it would be a second rail over one failure.
+ *
+ * NO SHAPE-SNIFFING: an object without a body is not a body. That fallback is what lets a
+ * message nobody can read travel on as if it were the message (d.788).
+ *
+ * NO `retryable` FIELD, measured rather than forgotten: on the consume path nothing in
+ * this package reads `error.retryable` — the fate of a message is decided by the caller's
+ * injected `classify(error)`, and without one every error is `transient`
+ * (`../config/deliveryPolicy.js` § `defaultClassification`). A field no consumer reads is
+ * a declaration without one. What a caller keys on is the error's CLASS, which is
+ * exported and stable.
+ *
+ * The content type is checked only when the message DECLARES one: the envelope contract
+ * does not require the property, so demanding it here would be a change of that contract
+ * rather than one rail for the four parsers.
+ *
+ * @param {Object} raw - The delivery as `consume()` hands it over.
+ * @param {Buffer|string} raw.content - The body.
+ * @param {Object} [raw.properties] - AMQP properties, `headers` and `contentType` included.
+ * @param {Object} [raw.fields] - AMQP delivery fields (`deliveryTag`, `redelivered`, …).
+ * @returns {{body: Object, headers: Object|undefined, properties: Object|undefined, fields: Object|undefined}}
+ *   The decoded body, and everything else exactly as it arrived.
+ * @throws {ValidationError} When the delivery cannot be read at all.
+ * @throws {SerializationError} When the body is not JSON — thrown by `./serializer.js`.
+ */
+function decodeMessage(raw) {
+  if (raw === null || typeof raw !== 'object' || Array.isArray(raw)) {
+    throw new ValidationError(
+      `[mq-client-core] decodeMessage: the delivery is not a message - got ${Array.isArray(raw) ? 'array' : typeof raw}. `
+        + 'Expected: the AMQP delivery consume() hands a handler, carrying its body in `content`. '
+        + 'Fix: pass the message the handler received, unchanged; this function reads no other shape.'
+    );
+  }
+
+  const { content, properties, fields } = raw;
+
+  if (!Buffer.isBuffer(content) && typeof content !== 'string') {
+    throw new ValidationError(
+      '[mq-client-core] decodeMessage: the delivery carries no readable content - '
+        + `Expected: \`content\` as a Buffer or a string, got ${content === undefined ? 'nothing' : typeof content}. `
+        + 'Fix: publish the message with a JSON body; a delivery without one is not decoded into '
+        + 'itself, because an object that is not a body must not travel on as one.'
+    );
+  }
+
+  if (content.length === 0) {
+    throw new ValidationError(
+      '[mq-client-core] decodeMessage: the delivery carries an empty body - '
+        + 'Expected: bytes holding a JSON message. '
+        + 'Fix: correct the producer; an empty body names no message and is not decoded into an empty one.'
+    );
+  }
+
+  const declaredType = properties && properties.contentType;
+
+  if (declaredType !== undefined && declaredType !== null && declaredType !== JSON_CONTENT_TYPE) {
+    throw new ValidationError(
+      `[mq-client-core] decodeMessage: the message declares content type "${declaredType}" - `
+        + `Expected: "${JSON_CONTENT_TYPE}", the type the platform envelope travels as, or no `
+        + 'declaration at all. '
+        + 'Fix: publish the body as JSON, or decode this message with the reader its own type needs.'
+    );
+  }
+
+  // The one decoding rail of this package. A second JSON.parse here would be the copy
+  // this module exists to end.
+  const body = serializer.deserialize(content);
+
+  return { body, headers: properties && properties.headers, properties, fields };
+}
+
+module.exports = { decodeMessage, JSON_CONTENT_TYPE };

package/src/utils/publishErrors.js

@@ -5,6 +5,10 @@
  * These errors umožní čisté oddělení publish vrstvy a recovery workeru.
  */
 
+const { IllegalOperationError } = require('amqplib');
+
+const { ConnectionError, PublishError } = require('./errorHandler');
+
 class TransientPublishError extends Error {
   /**
    * @param {string} message - Human readable message
@@ -154,15 +158,254 @@ function missingQueueDefinitionMessage(queueName, isInfrastructure) {
       + 'Fix: add the template to src/config/queueConfig.js, or consume the name the owning service declares.';
 }
 
+
+/**
+ * amqplib's channel-level `NOT_FOUND`, as a NUMBER — that is how the library sets it
+ * (`err.code === 404`, measured against the dev broker beside `classId`/`methodId`).
+ *
+ * Exported since d.685a, because the publish path asks the same question in three places:
+ * the queue-existence pre-check types it as `QueueNotFoundError`, the consumer's
+ * infrastructure-queue check as `ConsumeError`, and a SEND the broker answered with it
+ * means the exchange was never declared (d.693). One literal, one owner
+ * (`change-discipline.md` § One rail per concern) — the number was spelled three more
+ * times as a bare `404` in `transports/rabbitmqClient.js` until d.693.
+ */
+const AMQP_NOT_FOUND = 404;
+
+/**
+ * amqplib's channel-level `PRECONDITION_FAILED`, as a NUMBER — the same shape
+ * `AMQP_NOT_FOUND` has, and set the same way (`err.code === 406` on the close frame the
+ * broker puts on the channel's `error` event).
+ *
+ * Exported since d.698, when the publisher channel's `error` handler stopped deciding
+ * from the frame's SENTENCE. What that handler really meets is measured, live:
+ *
+ *     Channel closed by server: 406 (PRECONDITION-FAILED) with message
+ *     "PRECONDITION_FAILED - unknown delivery tag 999999"   → code 406, classId 60
+ *
+ * The number is what says "the broker answered about THIS request"; the wording around it
+ * belongs to the broker and can be re-worded without warning. It lives here beside its
+ * sibling because a second spelling of a reply code somewhere else is a second owner of
+ * the same fact (`change-discipline.md` § One rail per concern).
+ */
+const AMQP_PRECONDITION_FAILED = 406;
+
 /**
- * Best-effort klasifikace chyb z publishu do specializovaných typů.
- * Vrací původní chybu, pokud neodpovídá žádnému známému patternu.
+ * The message a publisher gets when the channel it was sending on was closed by SOMEBODY
+ * ELSE'S refusal.
+ *
+ * A ConfirmChannel carries more than one unconfirmed publish at a time, and a numbered
+ * close frame is an answer about exactly ONE of them. amqplib answers all of them with
+ * the same close error (the `Channel` constructor's `'close'` listener, `lib/channel.js`, through `toClosed`), so the frame reaches
+ * sends the broker never said a word about — and until d.723 each of them was read as its
+ * own refusal. Measured 2026-09-20 in a vhost of its own, two publishes on one channel:
+ * one to an exchange nobody declared (the real refusal) and one to `good.fanout`, which
+ * the same client had declared a moment earlier. Both came back
+ * `PermanentPublishError: … Cannot publish to exchange "good.fanout": … 404 NOT-FOUND -
+ * nothing declares it`, while the broker's own sentence underneath named
+ * `no exchange 'no.such.exchange'`. The second message was dropped on a refusal that was
+ * not about it, and its publisher was sent to declare an exchange that existed.
+ *
+ * So this sentence says what happened instead: the send was not answered, the channel it
+ * was on went away under it, and the message is to be published again — which is what
+ * `PublishLayer` does with a `TransientPublishError`. `cause` carries the frame, so the
+ * refusal that DID happen stays readable.
+ *
+ * @param {'queue'|'exchange'} kind - What `target` is.
+ * @param {string} target - The queue or exchange THIS publish was addressed to.
+ * @param {number} code - The broker's reply code on the frame that closed the channel.
+ * @returns {string}
+ */
+function collateralCloseMessage(kind, target, code) {
+  if (kind !== 'queue' && kind !== 'exchange') {
+    throw new Error(
+      '[publishErrors] collateralCloseMessage needs to know what it is naming - '
+        + `Expected: 'queue' or 'exchange', got ${JSON.stringify(kind)}. `
+        + 'Fix: pass the leg the publish took — sendToQueue names a queue, publish names an exchange.'
+    );
+  }
+
+  if (typeof target !== 'string' || target === '') {
+    throw new Error(
+      '[publishErrors] collateralCloseMessage requires the name the publish was addressed to - '
+        + `Expected: a non-empty ${kind} name, got ${JSON.stringify(target)}. `
+        + 'Fix: pass the name the caller published to.'
+    );
+  }
+
+  if (typeof code !== 'number') {
+    throw new Error(
+      '[publishErrors] collateralCloseMessage requires the broker reply code as a number - '
+        + `Expected: the numeric code amqplib puts on the close frame, got ${JSON.stringify(code)}. `
+        + 'Fix: read it from the channel\'s recorded close error (_closeError.code); without a number '
+        + 'there is no refusal to be collateral of.'
+    );
+  }
+
+  return `[RabbitMQClient] The publish to ${kind} "${target}" was collateral of a channel close caused `
+    + `by another publish - the broker answered ${code} about a different send on the same channel, and `
+    + `said nothing about this ${kind}. `
+    + 'Expected: a refusal is an answer about ONE message; the others on that channel were never '
+    + 'answered at all, so they were not refused and were not stored either. '
+    + "Fix: nothing here — the message is republished on the channel's successor (PublishLayer retries "
+    + 'a transient publish and buffers it meanwhile). Read error.cause for the refusal that really '
+    + 'happened, and fix THAT one.';
+}
+
+/**
+ * The message a publisher gets when the broker REFUSED the send and closed the channel
+ * with a numbered frame.
+ *
+ * ONE producer for both statements, because they differ in exactly one thing — what the
+ * number means — and writing that difference as a ternary at the construction site puts
+ * the whole message where no test can reach it. It is the shape
+ * `missingQueueDefinitionMessage()` above already has, and the runtime half of
+ * `tests/unit/error-message-contract.test.js` asserts these strings beside the others.
+ *
+ *   - `404 NOT-FOUND` (d.693) says nobody DECLARED what was published to. A publisher
+ *     declares nothing — exchanges come into being from `config/queueConfig.js`, asserted
+ *     by the service that owns them — so this is the same answer `QueueNotFoundError`'s
+ *     `unowned` branch gives for a queue name nothing owns, about the other object;
+ *   - any other number (`403 ACCESS-REFUSED`, `406 PRECONDITION-FAILED`, measured) says
+ *     the broker refused THIS message.
+ *
+ * Both are permanent for one reason: the refusal is an answer about this request, and
+ * repeating the request repeats it.
+ *
+ * @param {'queue'|'exchange'} kind - What `target` is, so the sentence names it correctly.
+ *   Required and checked: a publish names one or the other, never "something".
+ * @param {string} target - The queue or exchange the publish was addressed to.
+ * @param {number} code - The broker's reply code, as amqplib sets it (a NUMBER).
+ * @returns {string}
+ */
+function refusedSendMessage(kind, target, code) {
+  if (kind !== 'queue' && kind !== 'exchange') {
+    throw new Error(
+      '[publishErrors] refusedSendMessage needs to know what it is naming - '
+        + `Expected: 'queue' or 'exchange', got ${JSON.stringify(kind)}. `
+        + 'Fix: pass the leg the publish took — sendToQueue names a queue, publish names an exchange.'
+    );
+  }
+
+  if (typeof target !== 'string' || target === '') {
+    throw new Error(
+      '[publishErrors] refusedSendMessage requires the name the publish was addressed to - '
+        + `Expected: a non-empty ${kind} name, got ${JSON.stringify(target)}. `
+        + 'Fix: pass the name the caller published to.'
+    );
+  }
+
+  if (typeof code !== 'number') {
+    throw new Error(
+      '[publishErrors] refusedSendMessage requires the broker reply code as a number - '
+        + `Expected: the numeric code amqplib puts on the close frame, got ${JSON.stringify(code)}. `
+        + 'Fix: read it from the channel\'s recorded close error (_closeError.code); a refusal with no '
+        + 'number is not a refusal, it is a channel death, and that one is transient.'
+    );
+  }
+
+  if (code === AMQP_NOT_FOUND) {
+    return `[RabbitMQClient] Cannot publish to ${kind} "${target}": the broker closed the channel with `
+      + '404 NOT-FOUND - nothing declares it. '
+      + `Expected: every ${kind} to come into being from a declaration — `
+      + 'src/config/queueConfig.js declares it and the service that owns it asserts exactly that '
+      + '(assertExchange() for an exchange, setupServiceQueues() for a queue). A publisher declares '
+      + 'nothing, so a name nobody declared has nothing to route with and the message was NOT stored. '
+      + `Fix: add the ${kind} to src/config/queueConfig.js (confirmation mq-consumer-contract 003) and `
+      + `let its owner declare it, or publish to a ${kind} that already has one. No reconnect creates it, `
+      + 'so this does not clear by retrying.';
+  }
+
+  return `[RabbitMQClient] The broker refused the publish to ${kind} "${target}" with ${code} and closed `
+    + 'the channel - Expected: a refusal is an answer about THIS message, so repeating the publish '
+    + 'repeats it; the message was NOT stored. '
+    + "Fix: read error.cause for the broker's own sentence — 403 means the account behind RABBITMQ_URL "
+    + 'has no write permission in this vhost, 406 means the message itself was refused (a user_id '
+    + 'property that is not the authenticated user, for instance). Neither clears by retrying.';
+}
+
+/**
+ * Klasifikace chyb z publishu do specializovaných typů — PODLE TŘÍDY A KÓDU,
+ * nikdy podle textu hlášky.
+ *
+ * Its verdict is a decision about the message, not a label: `PublishLayer` retries a
+ * `TransientPublishError` and fails a `PermanentPublishError` or a
+ * `QueueNotFoundError` immediately (`PublishLayer._publishWithRetry()`). Until d.677
+ * that decision was read out of substrings of the message — `'queue does not exist'`,
+ * `'no queue'`, `'connection closing'`, `'connection closed'`, `'connection ended'`,
+ * `'channel closed'`, `'channel is closed'`, `'channel ended'`, `'timeout'`,
+ * `'confirmation timeout'`, `'reconnecting'` — so a reworded sentence moved a message
+ * from "retried and buffered" to "dropped", and nothing reported the move. The
+ * contract says the opposite: `docs/biz/70-contracts/error-handling.md` §6
+ * ("Message-based routing; breaks on any wording change · Instead: Branch on
+ * `err.code`").
+ *
+ * WHAT DECIDES, and what each carrier stands for (measured d.677 against the dev
+ * broker, each scenario in its own vhost; the live table is
+ * `tests/integration/publish-classification-carriers.integration.test.js`):
+ *   - an error this package already typed — handed back untouched, because the publish
+ *     path decided it with facts this function does not have (which section of
+ *     `queueConfig` owns the name, above all);
+ *   - `code === 404` — amqplib's `NOT_FOUND`: the queue is not there;
+ *   - `IllegalOperationError` — amqplib's own class for a channel or connection used
+ *     after it died, exported from amqplib's entry point;
+ *   - `ConnectionError` / `PublishError` — what the publish path itself builds when the
+ *     channel is gone at send time (`ConnectionError`), and when the confirm never
+ *     arrives, when the channel closed mid-publish and when the delivery tag no longer
+ *     exists (`PublishError`, its five sites). Every one of them means "this attempt
+ *     did not get an answer", which is what a retry is for;
+ *   - everything else — permanent. Its measured members are a broker refusal OTHER
+ *     than 404 that the existence pre-check re-throws (`405 RESOURCE_LOCKED`,
+ *     `Operation failed: QueueDeclare; 405 …`, `code: 405`), a serialization failure,
+ *     and a broker nack (`'message nacked'`). A refusal is an answer about THIS
+ *     request, and repeating the request repeats the answer — which is also the
+ *     verdict every one of them has today.
+ *
+ * NOT ONE BRANCH READS THE SENTENCE — since d.683, not even by exact equality. Until
+ * then two carriers had to be matched by their text, because they carry nothing else:
+ * amqplib answers every unconfirmed publish of a channel that has just closed with
+ * `new Error('channel closed')` (the `Channel` constructor's `'close'` listener, `node_modules/amqplib/lib/channel.js`) and every
+ * RPC queued on a channel that ended with
+ * `new Error('Channel ended, no reply will be forthcoming')` (`_rejectPending()`, `lib/channel.js`) —
+ * own properties `stack` and `message`, no class, no code. They are now typed where
+ * they ARRIVE, by the two sites that know which channel died: `_publishOnce()`'s
+ * exchange callback answers with this package's `PublishError` and the queue-existence
+ * pre-check with `_publishPathTransient()`, each keeping amqplib's object in `cause`.
+ * So a bare sentence reaching THIS function means it got past a typing site, which is
+ * a defect to find rather than a message to retry — and it is answered like any other
+ * untyped error.
+ *
+ * WHAT DOES NOT ARRIVE, AND WHY IT NO LONGER MATTERS: the broker's numbered channel error
+ * for a refused SEND never reaches this function first-hand. That object goes to the
+ * channel's `error` event, while the publish callback is answered by amqplib's bare
+ * sentinel. Until d.685a the send legs answered it with their own `PublishError`, so a
+ * 403 or a 406 — a refusal of THIS message — was classified transient, retried
+ * `publishMaxRetries` times and then buffered, to be re-offered on every reconnect. Since
+ * d.685a both send legs read the close frame their own channel recorded
+ * (`_refusedSendPermanent()`, `src/transports/rabbitmqClient.js`) and hand over a
+ * `PermanentPublishError` with the broker's object in `cause` — which arrives here
+ * already typed and is passed through by the first rule. Since d.693 that includes the
+ * send's own `404` (an exchange nobody declared, carrier B1): it is permanent for the
+ * same reason, because no reconnect declares an exchange. What it is NOT is a
+ * `QueueNotFoundError` — that class belongs to the queue-existence pre-check, carries a
+ * `queueName` and an ownership `kind`, and still hands over the coded 404 and 405 it
+ * always did.
+ *
+ * NO SOCKET CODES HERE. `ECONNREFUSED`/`ENOTFOUND`/`ETIMEDOUT` never reach this
+ * function: `_ensurePublisherChannel()` runs BEFORE the `try` that calls it
+ * (`src/transports/rabbitmqClient.js`), so a publish with no connection fails above.
+ * A branch nothing reaches is a false guarantee (`automation-gates.md` §5).
+ *
+ * The cause chain is deliberately NOT walked: this function sits at the BOTTOM of the
+ * publish path — it is what builds the chain that `BaseClient.publish()` and
+ * `isQueueUnavailableError()` later read — and every carrier measured at this point is
+ * first-hand.
  *
  * The queue name comes from the CALLER, and is required. The missing-queue branch
  * below used to invent it — `new QueueNotFoundError('unknown', …)` — and the
- * invented name does not stay in the message: the error reaches `RecoveryWorker`
- * through the client's `error` channel, which reports it by `error.queueName`
- * ("Cannot create queue 'unknown'"), naming nothing anybody can act on. Every
+ * invented name does not stay in the error: `BaseClient.publish()` rejects the caller
+ * with a `PublishError` whose `cause` is this error, so the caller would read
+ * `error.cause.queueName === 'unknown'`, naming nothing anybody can act on. Every
  * caller has the real name in hand (`_publishOnce(queue, …)`,
  * `publishToMonitoringResilient(…, queueName, …)`), so it is asked for at entry
  * (`architecture-principles.md` §4) rather than guessed in one branch (§3, and the
@@ -195,10 +438,8 @@ function classifyPublishError(err, queueName) {
     return err;
   }
 
-  const message = (err.message || String(err)).toLowerCase();
-
   // Queue neexistuje – trvalý problém, nerozbitný retry
-  if (message.includes('queue does not exist') || message.includes('no queue') || err.code === 404) {
+  if (err.code === AMQP_NOT_FOUND) {
     // Which section of queueConfig owns the name is not known here — that lookup
     // belongs to the publish path, which asks it before this classification is ever
     // reached — so the error carries the name and `kind: 'unknown'`, whose message
@@ -208,15 +449,9 @@ function classifyPublishError(err, queueName) {
 
   // Typicky transientní problémy connection/channel
   if (
-    message.includes('connection closing') ||
-    message.includes('connection closed') ||
-    message.includes('connection ended') ||
-    message.includes('channel closed') ||
-    message.includes('channel is closed') ||
-    message.includes('channel ended') ||
-    message.includes('timeout') ||
-    message.includes('confirmation timeout') ||
-    message.includes('reconnecting')
+    err instanceof IllegalOperationError ||
+    err instanceof ConnectionError ||
+    err instanceof PublishError
   ) {
     return new TransientPublishError(err.message || String(err), err);
   }
@@ -226,8 +461,12 @@ function classifyPublishError(err, queueName) {
 }
 
 module.exports = {
+  AMQP_NOT_FOUND,
+  AMQP_PRECONDITION_FAILED,
+  collateralCloseMessage,
   missingInfrastructureQueueMessage,
   missingQueueDefinitionMessage,
+  refusedSendMessage,
   TransientPublishError,
   PermanentPublishError,
   QueueNotFoundError,

package/jest.config.js

@@ -1,15 +0,0 @@
-'use strict';
-
-/**
- * Default tier: unit + component only.
- *
- * `tests/integration` is excluded here and served by `jest.integration.config.js`
- * instead, because that tier fails fast on a missing `RABBITMQ_URL` — folding it
- * into the default run would make `npm test` unrunnable without a broker, and the
- * usual "fix" for that is a skip, which is how a suite quietly leaves the
- * regression loop (`.claude/rules/service-refactoring.md` #4).
- */
-module.exports = {
-  testEnvironment: 'node',
-  testPathIgnorePatterns: ['/node_modules/', '/tests/integration/']
-};

package/jest.integration.config.js

@@ -1,16 +0,0 @@
-'use strict';
-
-/**
- * Integration tier: runs against the live broker, never skipped.
- *
- * `globalSetup` aborts the whole run before Jest builds a describe tree when
- * `RABBITMQ_URL` is missing or the broker is unreachable — see
- * `tests/integration/setup.js`.
- */
-module.exports = {
-  testEnvironment: 'node',
-  testMatch: ['**/tests/integration/**/*.test.js'],
-  testTimeout: 30000,
-  globalSetup: './tests/integration/setup.js',
-  verbose: true
-};

package/src/workers/RecoveryWorker.js

@@ -1,130 +0,0 @@
-'use strict';
-
-const { QueueNotFoundError } = require('../utils/publishErrors');
-const { ValidationError } = require('../utils/errorHandler');
-const { assertLogger } = require('@onlineapps/logger-contract');
-
-/**
- * RecoveryWorker — odpovídá na problémy publish cesty (connection recovery,
- * hlášení chybějící fronty).
- *
- * Zakládání front — NEZAKLÁDÁ ŽÁDNOU. Fronta vzniká výhradně z deklarace:
- * infrastrukturní ji zakládá vlastnící infra služba při bootu, business ji
- * zakládá vlastnící služba přes `setupServiceQueues()` nad šablonou z
- * `queueConfig` po registraci, a jméno, které `queueConfig` neklasifikuje ani
- * jako jedno, nezakládá nikdo. Rozhodnutí vlastníka
- * (`docs/governance/confirmations/mq-consumer-contract.md` 006) říká obojí
- * větou: *„queues come into being only from declarations"* a *„A future family
- * of queues that a service must create ad hoc gets a `queueConfig` template
- * first, never a generic create-anything method."*
- *
- * Do d.419 tady byly DRUHÉ dveře k těm, které publish cesta v témže kroku
- * zavírala: `createQueue()` a delegující `queueCreationCallback` zakládaly
- * frontu bez vlastníka s `durable=true, arguments={}` — bez TTL a bez cesty pro
- * nedoručitelné zprávy. Taková fronta je od d.259 nekonzumovatelná
- * (`consume()` odmítne frontu, které konfigurace žádnou cestu nedeklaruje), takže
- * ty dveře vyráběly fronty, do kterých lze publikovat a nelze z nich číst.
- * Čtyři otázky (`change-discipline.md` § Removing something removes its
- * declaration) jsou zodpovězené v CHANGELOGu dávky.
- *
- * `scope` tedy už o zakládání front nerozhodoval; od d.419 neříkal nic a od d.514
- * tu není. Co rozhoduje o tvaru hlášení, je třída vlastnictví, kterou odpověděla
- * CENTRÁLNÍ deklarace — `error.kind` z `QueueNotFoundError` — takže dva klienti
- * namířené na tutéž frontu nemohou dostat různou odpověď podle toho, kdo je
- * postavil. Čtyři otázky k odstranění jsou zodpovězené v CHANGELOGu dávky.
- */
-class RecoveryWorker {
-  /**
-   * @param {Object} options
-   * @param {Object} options.client - RabbitMQClient instance
-   * @param {Object} options.logger - Logger s info/warn/error/debug (povinny)
-   */
-  constructor(options = {}) {
-    if (!options.client) {
-      throw new ValidationError(
-        '[RecoveryWorker] options.client is required - Expected: the RabbitMQClient whose publish failures the worker answers. '
-          + 'Fix: construct it as new RecoveryWorker({ client, logger }).'
-      );
-    }
-
-    this._client = options.client;
-    this._logger = assertLogger(
-      'RecoveryWorker',
-      options.logger,
-      'the worker reports every recovery decision it makes about a queue that does not exist',
-      'pass options.logger (the transport forwards the one your service built)'
-    );
-  }
-
-  /**
-   * Handle transient publish error
-   * @param {Error} error - TransientPublishError
-   * @param {Object} context - { queue, buffer, options }
-   */
-  async handleTransientError(error, context) {
-    // Transient errors jsou už bufferované v PublishLayer
-    // Recovery worker jen loguje a může triggerovat další akce
-    this._logger.warn(`[RecoveryWorker] Transient error handled (buffered): ${error.message}`, context);
-  }
-
-  /**
-   * Report a queue that does not exist, and rethrow.
-   *
-   * Every class of name ends the same way — the worker creates nothing — and the
-   * three branches differ only in which rule the reader has to act on: who owns
-   * the queue, and how it is meant to come into being.
-   *
-   * @param {QueueNotFoundError} error
-   * @param {Object} context - { queue, buffer, options }
-   */
-  async handleQueueNotFound(error, context) {
-    if (!(error instanceof QueueNotFoundError)) {
-      return;
-    }
-
-    // Infrastructure queues must exist - cannot create
-    if (error.isInfrastructure) {
-      this._logger.error(`[RecoveryWorker] Cannot create infrastructure queue '${error.queueName}' - must exist before publishing`);
-      throw error;
-    }
-
-    // Business queues ({service}.{workflow|queue|dlq}) must exist too — they are
-    // created by their owning service via setupServiceQueues() AFTER registration,
-    // with the arguments queueConfig prescribes.
-    //
-    // Measured 2026-08-28: without this branch the ownership guard in
-    // `_publishOnce` was defeated by its own error path. The publish was refused
-    // correctly, the caller saw PublishError — and then this worker, listening for
-    // QueueNotFoundError on the client's error event, created the very queue the
-    // guard had just refused ("[RecoveryWorker] ✓ Created queue '<q>' (direct)"),
-    // with default arguments and no TTL. Refusing at one door while opening the
-    // other is not a guard.
-    //
-    // `recoveryScope: 'business'` said the CLIENT belongs to a business service.
-    // It never meant "may create business queues", and `ConnectorMQClient` set it
-    // for every biz service, so that reading made the rule vacuous. The key is
-    // gone with the door it guarded (d.514); what decides here is `error.kind`,
-    // which the central declaration answers.
-    if (error.kind === 'business') {
-      this._logger.error(`[RecoveryWorker] Cannot create business queue '${error.queueName}' - it is created by its owning service via setupServiceQueues() after registration`);
-      throw error;
-    }
-
-    // Everything else — a name `queueConfig` classifies as neither. Until d.419
-    // this was the one branch that DID create, and it is the same "one door
-    // refuses while the other opens" the business branch above records, one class
-    // of name further out: the publish path refused the name and this handler,
-    // answering the very error that refusal raised, declared it anyway. There is
-    // no owner to start and no template to call, so the report names the only
-    // thing the reader can act on — the missing declaration.
-    this._logger.error(
-      `[RecoveryWorker] Cannot create queue '${error.queueName}' - no section of queueConfig declares it, `
-        + 'and a queue is only ever brought into being from a declaration. Fix: add a template for this '
-        + 'name to queueConfig and let its owner declare it (confirmation mq-consumer-contract 003), or '
-        + 'publish to a queue that already has one.'
-    );
-    throw error;
-  }
-}
-
-module.exports = RecoveryWorker;