@owox/backend 0.38.0 → 0.39.0

package/dist/src/plugin-host/services/plugin-publication.service.d.ts

@@ -22,6 +22,8 @@ export declare class PluginPublicationService {
     addToAudience(publicationId: string, projectIds: string[]): Promise<void>;
     removeFromAudience(publicationId: string, projectIds?: string[]): Promise<void>;
     findVisibleTo(projectId: string, userId: string): Promise<PluginPublication[]>;
+    findEverVisibleTo(projectId: string, userId: string): Promise<PluginPublication[]>;
+    private visibleTo;
     findDeploymentPluginIdByRepo(projectId: string, owner: string, name: string): Promise<string | null>;
     listManageable(scope: PluginPublicationScope, filters: {
         projectId?: string;

package/dist/src/plugin-host/services/plugin-publication.service.js

@@ -65,12 +65,15 @@ let PluginPublicationService = class PluginPublicationService {
         await this.audiences.update(projectIds ? { publicationId, projectId: (0, typeorm_2.In)(projectIds) } : { publicationId }, { isActive: false });
     }
     findVisibleTo(projectId, userId) {
-        return this.publications
-            .createQueryBuilder('publication')
-            .where('publication.isActive = :isActive', { isActive: true })
-            .andWhere(new typeorm_2.Brackets(scopes => {
+        return this.visibleTo(projectId, userId, true).getMany();
+    }
+    findEverVisibleTo(projectId, userId) {
+        return this.visibleTo(projectId, userId, false).getMany();
+    }
+    visibleTo(projectId, userId, activeOnly) {
+        const query = this.publications.createQueryBuilder('publication').where(new typeorm_2.Brackets(scopes => {
             scopes
-                .where(this.deploymentVisibleToProject(projectId))
+                .where(this.deploymentVisibleToProject(projectId, activeOnly))
                 .orWhere(new typeorm_2.Brackets(project => {
                 project
                     .where('publication.scope = :projectScope', {
@@ -86,9 +89,11 @@ let PluginPublicationService = class PluginPublicationService {
                     .andWhere('publication.projectId = :projectId')
                     .andWhere('publication.userId = :userId');
             }));
-        }))
-            .setParameters({ projectId, userId })
-            .getMany();
+        }));
+        if (activeOnly) {
+            query.andWhere('publication.isActive = :isActive', { isActive: true });
+        }
+        return query.setParameters({ projectId, userId });
     }
     async findDeploymentPluginIdByRepo(projectId, owner, name) {
         const publication = await this.publications
@@ -111,7 +116,10 @@ let PluginPublicationService = class PluginPublicationService {
             ...(filters.userId ? { userId: filters.userId } : {}),
         });
     }
-    deploymentVisibleToProject(projectId) {
+    deploymentVisibleToProject(projectId, activeAudienceOnly = true) {
+        const activeAudience = activeAudienceOnly
+            ? 'AND audience_row.isActive = :deploymentAudienceActive'
+            : '';
         return new typeorm_2.Brackets(deployment => {
             deployment
                 .where('publication.scope = :deploymentScope', {
@@ -126,7 +134,7 @@ let PluginPublicationService = class PluginPublicationService {
                 SELECT 1 FROM plugin_publication_project audience_row
                 WHERE audience_row.publicationId = publication.id
                   AND audience_row.projectId = :deploymentProjectId
-                  AND audience_row.isActive = :deploymentAudienceActive
+                  ${activeAudience}
               )`, { deploymentProjectId: projectId, deploymentAudienceActive: true });
             }));
         });

package/dist/src/plugin-host/services/plugin-runtime-authorizer.service.d.ts

@@ -1,7 +1,10 @@
-import { PluginRuntimeAuthorizerPort, PluginRuntimeIdentity } from '../../idp/ports/plugin-runtime-authorizer.port';
+import { PluginExecutionIdentity, PluginRuntimeAuthorizerPort, PluginRuntimeIdentity } from '../../idp/ports/plugin-runtime-authorizer.port';
 import { PluginInstallationLookupPort } from '../facades/plugin-installation-lookup.facade';
+import { PluginActionExecutionService } from './plugin-action-execution.service';
 export declare class PluginRuntimeAuthorizerService implements PluginRuntimeAuthorizerPort {
     private readonly installations;
-    constructor(installations: PluginInstallationLookupPort);
+    private readonly executions;
+    constructor(installations: PluginInstallationLookupPort, executions: PluginActionExecutionService);
     assertActiveInstallation(identity: PluginRuntimeIdentity): Promise<void>;
+    resolveExecutionToken(token: string): Promise<PluginExecutionIdentity | null>;
 }

package/dist/src/plugin-host/services/plugin-runtime-authorizer.service.js

@@ -16,27 +16,55 @@ exports.PluginRuntimeAuthorizerService = void 0;
 const common_1 = require("@nestjs/common");
 const idp_protocol_1 = require("@owox/idp-protocol");
 const plugin_installation_lookup_facade_1 = require("../facades/plugin-installation-lookup.facade");
+const plugin_host_errors_1 = require("../errors/plugin-host.errors");
+const execution_token_util_1 = require("../utils/execution-token.util");
+const plugin_action_execution_service_1 = require("./plugin-action-execution.service");
 let PluginRuntimeAuthorizerService = class PluginRuntimeAuthorizerService {
     installations;
-    constructor(installations) {
+    executions;
+    constructor(installations, executions) {
         this.installations = installations;
+        this.executions = executions;
     }
     async assertActiveInstallation(identity) {
         const installation = await this.installations.findSnapshot(identity.installationId);
         if (!installation ||
             !installation.isActive ||
-            installation.isSuspended ||
             installation.pluginId !== identity.pluginId ||
             installation.projectId !== identity.projectId ||
             installation.userId !== identity.userId) {
             throw new idp_protocol_1.AuthorizationError('Plugin runtime access denied');
         }
+        if (installation.isSuspended) {
+            throw new plugin_host_errors_1.PluginSuspendedError(installation.pluginId);
+        }
+    }
+    async resolveExecutionToken(token) {
+        if (!token) {
+            return null;
+        }
+        const execution = await this.executions.findRunningByTokenHash((0, execution_token_util_1.hashExecutionToken)(token), new Date());
+        if (!execution) {
+            return null;
+        }
+        const role = idp_protocol_1.RoleEnum.safeParse(execution.role);
+        if (!role.success) {
+            return null;
+        }
+        return {
+            executionId: execution.id,
+            pluginId: execution.pluginId,
+            installationId: execution.installationId,
+            projectId: execution.projectId,
+            userId: execution.userId,
+            role: role.data,
+        };
     }
 };
 exports.PluginRuntimeAuthorizerService = PluginRuntimeAuthorizerService;
 exports.PluginRuntimeAuthorizerService = PluginRuntimeAuthorizerService = __decorate([
     (0, common_1.Injectable)(),
     __param(0, (0, common_1.Inject)(plugin_installation_lookup_facade_1.PLUGIN_INSTALLATION_LOOKUP)),
-    __metadata("design:paramtypes", [Object])
+    __metadata("design:paramtypes", [Object, plugin_action_execution_service_1.PluginActionExecutionService])
 ], PluginRuntimeAuthorizerService);
 //# sourceMappingURL=plugin-runtime-authorizer.service.js.map

package/dist/src/plugin-host/services/plugin-version.service.d.ts

@@ -1,7 +1,7 @@
 import { DataSource, Repository } from 'typeorm';
 import { PluginVersion } from '../entities/plugin-version.entity';
 import { Plugin } from '../entities/plugin.entity';
-import type { PluginCollectionDeclaration } from '../utils/plugin-manifest.util';
+import type { PluginBackendDeclaration, PluginCollectionDeclaration } from '../utils/plugin-manifest.util';
 import type { StoredCredentialRequirement } from '../../data-marts/credentials/credential.types';
 export interface InsertPluginVersionInput {
     readonly pluginId: string;
@@ -14,6 +14,7 @@ export interface InsertPluginVersionInput {
     readonly deliveryUrl: string;
     readonly collections: readonly PluginCollectionDeclaration[];
     readonly credentialRequirements: readonly StoredCredentialRequirement[];
+    readonly backend: PluginBackendDeclaration | null;
     readonly releasePublishedAt: Date | null;
 }
 export declare class PluginVersionService {

package/dist/src/plugin-host/services/release-candidate-rules.service.d.ts

@@ -0,0 +1,51 @@
+import type { StoredCredentialRequirement } from '../../data-marts/credentials/credential.types';
+import { ReleaseRejectionCode } from '../enums/release-rejection-code.enum';
+import { GithubRepoRef } from '../utils/github-repo-locator.util';
+import { PluginManifest } from '../utils/plugin-manifest.util';
+import { ActionInputValidatorService } from './action-input-validator.service';
+import { ExternalCredentialDefinitionSyncService } from './external-credential-definition-sync.service';
+import { GithubApiService } from './github-api.service';
+import { PluginVersionService } from './plugin-version.service';
+import { RemoteUrlValidatorService } from './remote-url-validator.service';
+export interface ReleaseCandidate {
+    readonly pluginId: string;
+    readonly ref: GithubRepoRef;
+    readonly commitSha: string;
+    readonly semver: string | null;
+}
+export interface ReleaseCandidateIssue {
+    readonly code: ReleaseRejectionCode;
+    readonly detail: string;
+}
+type Rejection = {
+    readonly ok: false;
+} & ReleaseCandidateIssue;
+export type ReleaseCandidateVerdict = {
+    readonly ok: true;
+    readonly manifest: PluginManifest;
+    readonly credentialRequirements: readonly StoredCredentialRequirement[];
+} | Rejection;
+export interface ReleaseCandidateReport {
+    readonly issues: readonly ReleaseCandidateIssue[];
+    readonly baselineSemver: string | null;
+    readonly collectionsEvaluated: boolean;
+}
+export declare class ReleaseCandidateRulesService {
+    private readonly githubApi;
+    private readonly remoteUrlValidator;
+    private readonly versionService;
+    private readonly inputValidator;
+    private readonly externalCredentialDefinitions?;
+    constructor(githubApi: GithubApiService, remoteUrlValidator: RemoteUrlValidatorService, versionService: PluginVersionService, inputValidator: ActionInputValidatorService, externalCredentialDefinitions?: ExternalCredentialDefinitionSyncService | undefined);
+    firstFailure(candidate: ReleaseCandidate): Promise<ReleaseCandidateVerdict>;
+    collectAll(candidate: ReleaseCandidate): Promise<ReleaseCandidateReport>;
+    private fetchManifest;
+    private findBaseline;
+    private checkCollections;
+    private checkActions;
+    private checkBackendOrigin;
+    private lineIssue;
+    private checkBackendUrl;
+    private resolveCredentialRequirements;
+}
+export {};

package/dist/src/plugin-host/services/release-candidate-rules.service.js

@@ -0,0 +1,198 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ReleaseCandidateRulesService = void 0;
+const common_1 = require("@nestjs/common");
+const internal_helpers_1 = require("@owox/internal-helpers");
+const release_rejection_code_enum_1 = require("../enums/release-rejection-code.enum");
+const plugin_manifest_util_1 = require("../utils/plugin-manifest.util");
+const semver_util_1 = require("../utils/semver.util");
+const action_input_validator_service_1 = require("./action-input-validator.service");
+const external_credential_definition_sync_service_1 = require("./external-credential-definition-sync.service");
+const github_api_service_1 = require("./github-api.service");
+const plugin_version_service_1 = require("./plugin-version.service");
+const remote_url_validator_service_1 = require("./remote-url-validator.service");
+let ReleaseCandidateRulesService = class ReleaseCandidateRulesService {
+    githubApi;
+    remoteUrlValidator;
+    versionService;
+    inputValidator;
+    externalCredentialDefinitions;
+    constructor(githubApi, remoteUrlValidator, versionService, inputValidator, externalCredentialDefinitions) {
+        this.githubApi = githubApi;
+        this.remoteUrlValidator = remoteUrlValidator;
+        this.versionService = versionService;
+        this.inputValidator = inputValidator;
+        this.externalCredentialDefinitions = externalCredentialDefinitions;
+    }
+    async firstFailure(candidate) {
+        const parsed = await this.fetchManifest(candidate);
+        if (!parsed.ok)
+            return parsed;
+        const { manifest } = parsed;
+        const baseline = await this.findBaseline(candidate);
+        const collections = baseline && this.checkCollections(baseline, manifest);
+        if (collections)
+            return { ok: false, ...collections };
+        const actions = baseline && this.checkActions(baseline, manifest);
+        if (actions)
+            return { ok: false, ...actions };
+        const backendOrigin = baseline && this.checkBackendOrigin(baseline, manifest);
+        if (backendOrigin)
+            return { ok: false, ...backendOrigin };
+        const delivery = await this.remoteUrlValidator.validate(manifest.delivery.url);
+        if (!delivery.ok)
+            return delivery;
+        const backendUrl = await this.checkBackendUrl(manifest);
+        if (backendUrl)
+            return { ok: false, ...backendUrl };
+        const credentials = await this.resolveCredentialRequirements(manifest, 'resolve');
+        if (!credentials.ok)
+            return credentials;
+        return { ok: true, manifest, credentialRequirements: credentials.requirements };
+    }
+    async collectAll(candidate) {
+        const parsed = await this.fetchManifest(candidate);
+        const baseline = await this.findBaseline(candidate);
+        const baselineSemver = baseline?.semver ?? null;
+        if (!parsed.ok) {
+            return {
+                issues: [{ code: parsed.code, detail: parsed.detail }],
+                baselineSemver,
+                collectionsEvaluated: false,
+            };
+        }
+        const { manifest } = parsed;
+        const issues = [];
+        const collections = baseline && this.checkCollections(baseline, manifest);
+        if (collections)
+            issues.push(collections);
+        const actions = baseline && this.checkActions(baseline, manifest);
+        if (actions)
+            issues.push(actions);
+        const backendOrigin = baseline && this.checkBackendOrigin(baseline, manifest);
+        if (backendOrigin)
+            issues.push(backendOrigin);
+        const delivery = await this.remoteUrlValidator.validate(manifest.delivery.url);
+        if (!delivery.ok)
+            issues.push({ code: delivery.code, detail: delivery.detail });
+        const backendUrl = await this.checkBackendUrl(manifest);
+        if (backendUrl)
+            issues.push(backendUrl);
+        const credentials = await this.resolveCredentialRequirements(manifest, 'preview');
+        if (!credentials.ok)
+            issues.push({ code: credentials.code, detail: credentials.detail });
+        return {
+            issues,
+            baselineSemver,
+            collectionsEvaluated: baseline !== undefined,
+        };
+    }
+    async fetchManifest({ ref, commitSha }) {
+        const parsed = (0, plugin_manifest_util_1.parsePluginManifest)(await this.githubApi.getFileAtCommit(ref, 'plugin.json', commitSha));
+        if (!parsed.ok)
+            return parsed;
+        const refusal = await this.inputValidator.compile((0, plugin_manifest_util_1.listActionInputSchemas)(parsed.manifest.backend));
+        return refusal
+            ? { ok: false, code: release_rejection_code_enum_1.ReleaseRejectionCode.ACTION_INPUT_UNSUPPORTED, detail: refusal }
+            : parsed;
+    }
+    async findBaseline({ pluginId, semver, }) {
+        if (semver === null)
+            return undefined;
+        return (await this.versionService.findAllByPluginId(pluginId))
+            .filter(version => (0, semver_util_1.sameCompatibilityLine)(version.semver, semver))
+            .reduce((highest, version) => (!highest || (0, semver_util_1.compareSemver)(version.semver, highest.semver) > 0 ? version : highest), undefined);
+    }
+    checkCollections(baseline, manifest) {
+        const incompatibility = (0, plugin_manifest_util_1.findIncompatibleCollectionChange)(baseline.collections ?? [], manifest.collections);
+        return incompatibility
+            ? this.lineIssue(release_rejection_code_enum_1.ReleaseRejectionCode.COLLECTIONS_INCOMPATIBLE, incompatibility, baseline)
+            : null;
+    }
+    checkActions(baseline, manifest) {
+        const incompatibility = (0, plugin_manifest_util_1.findIncompatibleActionChange)(baseline.backend, manifest.backend);
+        return incompatibility
+            ? this.lineIssue(release_rejection_code_enum_1.ReleaseRejectionCode.ACTIONS_INCOMPATIBLE, incompatibility, baseline)
+            : null;
+    }
+    checkBackendOrigin(baseline, manifest) {
+        if (!manifest.backend)
+            return null;
+        const origin = new URL((0, plugin_manifest_util_1.resolveBackendUrl)(manifest.backend, manifest.delivery.url)).origin;
+        const baselineOrigin = baseline.backend && new URL((0, plugin_manifest_util_1.resolveBackendUrl)(baseline.backend, baseline.deliveryUrl)).origin;
+        if (origin === baselineOrigin)
+            return null;
+        const change = baselineOrigin
+            ? `The backend cannot move from ${baselineOrigin} to ${origin}`
+            : `A backend on ${origin} cannot be added`;
+        return this.lineIssue(release_rejection_code_enum_1.ReleaseRejectionCode.BACKEND_ORIGIN_CHANGED, change, baseline);
+    }
+    lineIssue(code, incompatibility, baseline) {
+        const escape = (0, semver_util_1.majorOf)(baseline.semver) === 0
+            ? 'bump the minor version to ship this breaking change while below 1.0.0'
+            : 'publish a new major version to ship this breaking change';
+        return {
+            code,
+            detail: `${incompatibility} within the ${baseline.semver} compatibility line; ${escape}`,
+        };
+    }
+    async checkBackendUrl(manifest) {
+        if (!manifest.backend)
+            return null;
+        const checked = await this.remoteUrlValidator.checkPublicHttps((0, plugin_manifest_util_1.resolveBackendUrl)(manifest.backend, manifest.delivery.url));
+        return checked.ok ? null : { code: checked.code, detail: `backend.url: ${checked.detail}` };
+    }
+    async resolveCredentialRequirements(manifest, mode) {
+        if (!manifest.credentials.some(externalLocator)) {
+            return { ok: true, requirements: manifest.credentials };
+        }
+        if (!this.externalCredentialDefinitions) {
+            throw new Error('External Credential definitions are not available');
+        }
+        try {
+            if (mode === 'preview') {
+                await this.externalCredentialDefinitions.previewRequirements(manifest.credentials);
+                return { ok: true, requirements: manifest.credentials };
+            }
+            return {
+                ok: true,
+                requirements: await this.externalCredentialDefinitions.resolveRequirements(manifest.credentials),
+            };
+        }
+        catch (error) {
+            if (!(error instanceof external_credential_definition_sync_service_1.ExternalCredentialRequirementError))
+                throw error;
+            return {
+                ok: false,
+                code: release_rejection_code_enum_1.ReleaseRejectionCode.MANIFEST_SCHEMA,
+                detail: (0, internal_helpers_1.castError)(error).message,
+            };
+        }
+    }
+};
+exports.ReleaseCandidateRulesService = ReleaseCandidateRulesService;
+exports.ReleaseCandidateRulesService = ReleaseCandidateRulesService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(4, (0, common_1.Optional)()),
+    __metadata("design:paramtypes", [github_api_service_1.GithubApiService,
+        remote_url_validator_service_1.RemoteUrlValidatorService,
+        plugin_version_service_1.PluginVersionService,
+        action_input_validator_service_1.ActionInputValidatorService,
+        external_credential_definition_sync_service_1.ExternalCredentialDefinitionSyncService])
+], ReleaseCandidateRulesService);
+function externalLocator(requirement) {
+    return (typeof requirement === 'string' ? requirement : requirement.id).startsWith('@');
+}
+//# sourceMappingURL=release-candidate-rules.service.js.map

package/dist/src/plugin-host/services/remote-url-validator.service.d.ts

@@ -13,6 +13,13 @@ export declare class RemoteUrlValidatorService {
     private readonly logger;
     constructor(config: PluginHostConfigService);
     validate(rawUrl: string): Promise<RemoteUrlCheckResult>;
+    checkPublicHttps(rawUrl: string): Promise<{
+        readonly ok: true;
+    } | {
+        readonly ok: false;
+        readonly code: ReleaseRejectionCode;
+        readonly detail: string;
+    }>;
     private run;
     private walk;
     private guard;

package/dist/src/plugin-host/services/remote-url-validator.service.js

@@ -34,6 +34,10 @@ let RemoteUrlValidatorService = RemoteUrlValidatorService_1 = class RemoteUrlVal
             return this.reject(release_rejection_code_enum_1.ReleaseRejectionCode.URL_UNREACHABLE, 'The delivery URL could not be read');
         }
     }
+    async checkPublicHttps(rawUrl) {
+        const guarded = await this.guard(rawUrl);
+        return guarded.ok ? { ok: true } : guarded;
+    }
     async run(rawUrl) {
         const walked = await this.walk(rawUrl, release_rejection_code_enum_1.ReleaseRejectionCode.URL_UNREACHABLE);
         if (!walked.ok) {

package/dist/src/plugin-host/system-triggers/plugin-action-execution-sweep.processor.d.ts

@@ -0,0 +1,14 @@
+import { SystemTrigger } from '../../common/scheduler/shared/entities/system-trigger.entity';
+import { BaseSystemTaskProcessor } from '../../common/scheduler/system-tasks/base-system-task.processor';
+import { SystemTriggerType } from '../../common/scheduler/system-tasks/system-trigger-type';
+import { PluginActionExecutionService } from '../services/plugin-action-execution.service';
+export declare class PluginActionExecutionSweepProcessor extends BaseSystemTaskProcessor {
+    private readonly executions;
+    private readonly logger;
+    constructor(executions: PluginActionExecutionService);
+    getType(): SystemTriggerType;
+    getDefaultCron(): string;
+    process(_trigger: SystemTrigger, options?: {
+        signal?: AbortSignal;
+    }): Promise<void>;
+}

package/dist/src/plugin-host/system-triggers/plugin-action-execution-sweep.processor.js

@@ -0,0 +1,50 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var PluginActionExecutionSweepProcessor_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PluginActionExecutionSweepProcessor = void 0;
+const common_1 = require("@nestjs/common");
+const base_system_task_processor_1 = require("../../common/scheduler/system-tasks/base-system-task.processor");
+const system_trigger_type_1 = require("../../common/scheduler/system-tasks/system-trigger-type");
+const plugin_action_limits_1 = require("../constants/plugin-action-limits");
+const plugin_action_execution_service_1 = require("../services/plugin-action-execution.service");
+const CRON = '* * * * *';
+const HOUR_MS = 60 * 60 * 1000;
+const DAY_MS = 24 * HOUR_MS;
+let PluginActionExecutionSweepProcessor = PluginActionExecutionSweepProcessor_1 = class PluginActionExecutionSweepProcessor extends base_system_task_processor_1.BaseSystemTaskProcessor {
+    executions;
+    logger = new common_1.Logger(PluginActionExecutionSweepProcessor_1.name);
+    constructor(executions) {
+        super();
+        this.executions = executions;
+    }
+    getType() {
+        return system_trigger_type_1.SystemTriggerType.PLUGIN_ACTION_EXECUTION_SWEEP;
+    }
+    getDefaultCron() {
+        return CRON;
+    }
+    async process(_trigger, options) {
+        const now = Date.now();
+        const timedOut = await this.executions.timeOutOrphans(new Date(now - plugin_action_limits_1.PLUGIN_ACTION_LIMITS.orphanGraceMs));
+        await this.executions.clearPayloads(new Date(now - plugin_action_limits_1.PLUGIN_ACTION_LIMITS.payloadRetentionHours * HOUR_MS), options?.signal);
+        await this.executions.deleteFinished(new Date(now - plugin_action_limits_1.PLUGIN_ACTION_LIMITS.rowRetentionDays * DAY_MS), options?.signal);
+        if (timedOut > 0) {
+            this.logger.warn(`${timedOut} plugin action executions outlived the replica that dispatched them and were marked TIMED_OUT`);
+        }
+    }
+};
+exports.PluginActionExecutionSweepProcessor = PluginActionExecutionSweepProcessor;
+exports.PluginActionExecutionSweepProcessor = PluginActionExecutionSweepProcessor = PluginActionExecutionSweepProcessor_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [plugin_action_execution_service_1.PluginActionExecutionService])
+], PluginActionExecutionSweepProcessor);
+//# sourceMappingURL=plugin-action-execution-sweep.processor.js.map

package/dist/src/plugin-host/use-cases/cancel-plugin-action-execution.service.d.ts

@@ -0,0 +1,8 @@
+import { CancelPluginActionExecutionCommand } from '../dto/domain/plugin-action-execution.command';
+import type { PluginActionExecutionView } from '../dto/domain/plugin-action-execution.dto';
+import { PluginActionExecutionService } from '../services/plugin-action-execution.service';
+export declare class CancelPluginActionExecutionService {
+    private readonly executions;
+    constructor(executions: PluginActionExecutionService);
+    run(command: CancelPluginActionExecutionCommand): Promise<PluginActionExecutionView>;
+}

package/dist/src/plugin-host/use-cases/cancel-plugin-action-execution.service.js

@@ -0,0 +1,39 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CancelPluginActionExecutionService = void 0;
+const common_1 = require("@nestjs/common");
+const plugin_action_errors_1 = require("../errors/plugin-action.errors");
+const plugin_action_execution_mapper_1 = require("../mappers/plugin-action-execution.mapper");
+const plugin_action_execution_service_1 = require("../services/plugin-action-execution.service");
+let CancelPluginActionExecutionService = class CancelPluginActionExecutionService {
+    executions;
+    constructor(executions) {
+        this.executions = executions;
+    }
+    async run(command) {
+        const installationId = command.context.installationId;
+        if (installationId) {
+            await this.executions.cancel(command.id, installationId);
+        }
+        const execution = await this.executions.findById(command.id);
+        if (!execution || execution.installationId !== installationId) {
+            throw new plugin_action_errors_1.ExecutionNotFoundError();
+        }
+        return (0, plugin_action_execution_mapper_1.toPluginActionExecutionView)(execution);
+    }
+};
+exports.CancelPluginActionExecutionService = CancelPluginActionExecutionService;
+exports.CancelPluginActionExecutionService = CancelPluginActionExecutionService = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [plugin_action_execution_service_1.PluginActionExecutionService])
+], CancelPluginActionExecutionService);
+//# sourceMappingURL=cancel-plugin-action-execution.service.js.map

package/dist/src/plugin-host/use-cases/check-plugin-release.service.d.ts

@@ -0,0 +1,22 @@
+import { PluginHostConfigService } from '../config/plugin-host.config';
+import { CheckPluginReleaseCommand, PluginReleaseCheckResultDto } from '../dto/domain/check-plugin-release.command';
+import { GithubApiService } from '../services/github-api.service';
+import { PluginPublicationService } from '../services/plugin-publication.service';
+import { PluginVersionService } from '../services/plugin-version.service';
+import { PluginService } from '../services/plugin.service';
+import { PublicationAuthorizationService } from '../services/publication-authorization.service';
+import { ReleaseCandidateRulesService } from '../services/release-candidate-rules.service';
+export declare class CheckPluginReleaseService {
+    private readonly pluginService;
+    private readonly authorization;
+    private readonly publications;
+    private readonly versionService;
+    private readonly githubApi;
+    private readonly candidateRules;
+    private readonly config;
+    private readonly lastCheckAt;
+    constructor(pluginService: PluginService, authorization: PublicationAuthorizationService, publications: PluginPublicationService, versionService: PluginVersionService, githubApi: GithubApiService, candidateRules: ReleaseCandidateRulesService, config: PluginHostConfigService);
+    run(command: CheckPluginReleaseCommand): Promise<PluginReleaseCheckResultDto>;
+    private versionConflict;
+    private claimSlot;
+}