@wildo-ai/platform-infra-providers 1.1.2 → 1.1.4

package/dist/esm/aws-s3/aws-s3.infra.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"aws-s3.infra.module.d.ts","sourceRoot":"","sources":["../../../../src/aws-s3/aws-s3.infra.module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AAEH,OAAO,EAIL,mBAAmB,EAEpB,MAAM,+BAA+B,CAAC;AAEvC,eAAO,MAAM,wBAAwB,EAAE,mBAkDtC,CAAC"}
+{"version":3,"file":"aws-s3.infra.module.d.ts","sourceRoot":"","sources":["../../../src/aws-s3/aws-s3.infra.module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AAEH,OAAO,EAIL,mBAAmB,EAEpB,MAAM,+BAA+B,CAAC;AAEvC,eAAO,MAAM,wBAAwB,EAAE,mBAkDtC,CAAC"}

package/dist/esm/clamav-self/clamav-self.infra.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"clamav-self.infra.module.d.ts","sourceRoot":"","sources":["../../../../src/clamav-self/clamav-self.infra.module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAIL,mBAAmB,EAEpB,MAAM,+BAA+B,CAAC;AAIvC,eAAO,MAAM,6BAA6B,EAAE,mBAiC3C,CAAC"}
+{"version":3,"file":"clamav-self.infra.module.d.ts","sourceRoot":"","sources":["../../../src/clamav-self/clamav-self.infra.module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAIL,mBAAmB,EAEpB,MAAM,+BAA+B,CAAC;AAIvC,eAAO,MAAM,6BAA6B,EAAE,mBAiC3C,CAAC"}

package/dist/esm/index.d.ts

@@ -25,7 +25,6 @@ export { MongodbSelfInfraProviderModule } from './mongodb-self/mongodb-self.infr
 export { MinioSelfInfraProviderModule } from './minio-self/minio-self.infra.module';
 export { AwsS3InfraProviderModule } from './aws-s3/aws-s3.infra.module';
 export { ClamavSelfInfraProviderModule } from './clamav-self/clamav-self.infra.module';
-export { GotenbergSelfInfraProviderModule } from './gotenberg-self/gotenberg-self.infra.module';
 /**
  * Canonical `InfraProvider` → `InfraProviderModule` catalog. Caller
  * (CLI, apps-manager) builds a `Map<InfraProvider, InfraProviderModule>`
@@ -43,8 +42,8 @@ export { GotenbergSelfInfraProviderModule } from './gotenberg-self/gotenberg-sel
  *   methods.
  * - `MINIO_SELF`, `AWS_S3` — object storage (shared-bucket model;
  *   no per-app credentials).
- * - `CLAMAV_SELF`, `GOTENBERG_SELF` — stateless infra (no auth, no
- *   per-app state; `plan()` only).
+ * - `CLAMAV_SELF` — stateless infra (no auth, no per-app state;
+ *   `plan()` only).
  *
  * **NOT covered** (catalog entries without modules):
  * - `POSTGRES_MANAGED`, `POSTGRES_AWS_RDS`, `POSTGRES_GCP_CLOUD_SQL`,

package/dist/esm/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAaxF,OAAO,EAAE,+BAA+B,EAAE,MAAM,4CAA4C,CAAC;AAC7F,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AACpF,OAAO,EAAE,+BAA+B,EAAE,MAAM,4CAA4C,CAAC;AAC7F,OAAO,EAAE,+BAA+B,EAAE,MAAM,4CAA4C,CAAC;AAC7F,OAAO,EAAE,8BAA8B,EAAE,MAAM,0CAA0C,CAAC;AAC1F,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AACpF,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AACxE,OAAO,EAAE,6BAA6B,EAAE,MAAM,wCAAwC,CAAC;AACvF,OAAO,EAAE,gCAAgC,EAAE,MAAM,8CAA8C,CAAC;AAEhG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,sBAAsB,EAAE,aAAa,CAAC,mBAAmB,CAUrE,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,kCAAkC,IAAI,WAAW,CAAC,MAAM,CAAC,CAQxE;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,IAAI,WAAW,CAAC,aAAa,EAAE,mBAAmB,CAAC,CAY7F"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAYxF,OAAO,EAAE,+BAA+B,EAAE,MAAM,4CAA4C,CAAC;AAC7F,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AACpF,OAAO,EAAE,+BAA+B,EAAE,MAAM,4CAA4C,CAAC;AAC7F,OAAO,EAAE,+BAA+B,EAAE,MAAM,4CAA4C,CAAC;AAC7F,OAAO,EAAE,8BAA8B,EAAE,MAAM,0CAA0C,CAAC;AAC1F,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AACpF,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AACxE,OAAO,EAAE,6BAA6B,EAAE,MAAM,wCAAwC,CAAC;AAEvF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,sBAAsB,EAAE,aAAa,CAAC,mBAAmB,CASrE,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,kCAAkC,IAAI,WAAW,CAAC,MAAM,CAAC,CAQxE;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,IAAI,WAAW,CAAC,aAAa,EAAE,mBAAmB,CAAC,CAY7F"}

package/dist/esm/index.js

@@ -25,7 +25,6 @@ import { MongodbSelfInfraProviderModule } from './mongodb-self/mongodb-self.infr
 import { MinioSelfInfraProviderModule } from './minio-self/minio-self.infra.module.js';
 import { AwsS3InfraProviderModule } from './aws-s3/aws-s3.infra.module.js';
 import { ClamavSelfInfraProviderModule } from './clamav-self/clamav-self.infra.module.js';
-import { GotenbergSelfInfraProviderModule } from './gotenberg-self/gotenberg-self.infra.module.js';
 export { RabbitmqSelfInfraProviderModule } from './rabbitmq-self/rabbitmq-self.infra.module.js';
 export { RedisSelfInfraProviderModule } from './redis-self/redis-self.infra.module.js';
 export { PostgresSelfInfraProviderModule } from './postgres-self/postgres-self.infra.module.js';
@@ -34,7 +33,6 @@ export { MongodbSelfInfraProviderModule } from './mongodb-self/mongodb-self.infr
 export { MinioSelfInfraProviderModule } from './minio-self/minio-self.infra.module.js';
 export { AwsS3InfraProviderModule } from './aws-s3/aws-s3.infra.module.js';
 export { ClamavSelfInfraProviderModule } from './clamav-self/clamav-self.infra.module.js';
-export { GotenbergSelfInfraProviderModule } from './gotenberg-self/gotenberg-self.infra.module.js';
 /**
  * Canonical `InfraProvider` → `InfraProviderModule` catalog. Caller
  * (CLI, apps-manager) builds a `Map<InfraProvider, InfraProviderModule>`
@@ -52,8 +50,8 @@ export { GotenbergSelfInfraProviderModule } from './gotenberg-self/gotenberg-sel
  *   methods.
  * - `MINIO_SELF`, `AWS_S3` — object storage (shared-bucket model;
  *   no per-app credentials).
- * - `CLAMAV_SELF`, `GOTENBERG_SELF` — stateless infra (no auth, no
- *   per-app state; `plan()` only).
+ * - `CLAMAV_SELF` — stateless infra (no auth, no per-app state;
+ *   `plan()` only).
  *
  * **NOT covered** (catalog entries without modules):
  * - `POSTGRES_MANAGED`, `POSTGRES_AWS_RDS`, `POSTGRES_GCP_CLOUD_SQL`,
@@ -74,7 +72,6 @@ export const INFRA_PROVIDER_MODULES = [
     MinioSelfInfraProviderModule,
     AwsS3InfraProviderModule,
     ClamavSelfInfraProviderModule,
-    GotenbergSelfInfraProviderModule,
 ];
 /**
  * Every `Wildo_Application_Secrets` JSON path that ANY provider module can mint per runtime

package/dist/esm/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,OAAO,EAAE,+BAA+B,EAAE,MAAM,4CAA4C,CAAC;AAC7F,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AACpF,OAAO,EAAE,+BAA+B,EAAE,MAAM,4CAA4C,CAAC;AAC7F,OAAO,EAAE,+BAA+B,EAAE,MAAM,4CAA4C,CAAC;AAC7F,OAAO,EAAE,8BAA8B,EAAE,MAAM,0CAA0C,CAAC;AAC1F,6EAA6E;AAC7E,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AACpF,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AACxE,OAAO,EAAE,6BAA6B,EAAE,MAAM,wCAAwC,CAAC;AACvF,OAAO,EAAE,gCAAgC,EAAE,MAAM,8CAA8C,CAAC;AAEhG,OAAO,EAAE,+BAA+B,EAAE,MAAM,4CAA4C,CAAC;AAC7F,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AACpF,OAAO,EAAE,+BAA+B,EAAE,MAAM,4CAA4C,CAAC;AAC7F,OAAO,EAAE,+BAA+B,EAAE,MAAM,4CAA4C,CAAC;AAC7F,OAAO,EAAE,8BAA8B,EAAE,MAAM,0CAA0C,CAAC;AAC1F,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AACpF,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AACxE,OAAO,EAAE,6BAA6B,EAAE,MAAM,wCAAwC,CAAC;AACvF,OAAO,EAAE,gCAAgC,EAAE,MAAM,8CAA8C,CAAC;AAEhG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAuC;IACxE,+BAA+B;IAC/B,4BAA4B;IAC5B,+BAA+B;IAC/B,+BAA+B;IAC/B,8BAA8B;IAC9B,4BAA4B;IAC5B,wBAAwB;IACxB,6BAA6B;IAC7B,gCAAgC;CACjC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,kCAAkC;IAChD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,MAAM,IAAI,sBAAsB,EAAE,CAAC;QAC5C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,2BAA2B,EAAE,CAAC;YACtD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B;IACzC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAsC,CAAC;IAC1D,KAAK,MAAM,CAAC,IAAI,sBAAsB,EAAE,CAAC;QACvC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACb,uDAAuD,CAAC,CAAC,QAAQ,MAAM;gBACvE,iDAAiD,CAClD,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC","sourcesContent":["/**\n * `@wildo-ai/platform-infra-providers` — concrete `InfraProviderModule`\n * catalog (Slice 2.5c-1 of `infra-provider-planner.md`).\n *\n * Tier-portable: the modules import only `@wildo-ai/platform-config-lib`\n * (contracts) and have no DI / mongoose / axios runtime dependencies.\n * This lets both `platform-apps-manager` (orchestrator) and\n * `wildo-cli` (lockfile materializer) consume the same module\n * objects — apps-manager passes a real admin-client implementation\n * via `AppCredentialMintingContext.adminClient`; wildo-cli only\n * needs `module.plan()` for the lockfile digest.\n *\n * Each module is exported by name (no intermediary barrels per\n * platform/CLAUDE.md \"no intermediary index.ts barrels\"). The\n * `INFRA_PROVIDER_MODULES` map below is the canonical catalog —\n * consumers iterate it (or look up by `InfraProvider` value) instead\n * of importing modules one by one.\n */\n\nimport type { InfraProvider, InfraProviderModule } from '@wildo-ai/platform-config-lib';\n\nimport { RabbitmqSelfInfraProviderModule } from './rabbitmq-self/rabbitmq-self.infra.module';\nimport { RedisSelfInfraProviderModule } from './redis-self/redis-self.infra.module';\nimport { PostgresSelfInfraProviderModule } from './postgres-self/postgres-self.infra.module';\nimport { MongodbAtlasInfraProviderModule } from './mongodb-atlas/mongodb-atlas.infra.module';\nimport { MongodbSelfInfraProviderModule } from './mongodb-self/mongodb-self.infra.module';\n// Slice 5 of `infra-provider-planner.md` — object-storage + stateless infra.\nimport { MinioSelfInfraProviderModule } from './minio-self/minio-self.infra.module';\nimport { AwsS3InfraProviderModule } from './aws-s3/aws-s3.infra.module';\nimport { ClamavSelfInfraProviderModule } from './clamav-self/clamav-self.infra.module';\nimport { GotenbergSelfInfraProviderModule } from './gotenberg-self/gotenberg-self.infra.module';\n\nexport { RabbitmqSelfInfraProviderModule } from './rabbitmq-self/rabbitmq-self.infra.module';\nexport { RedisSelfInfraProviderModule } from './redis-self/redis-self.infra.module';\nexport { PostgresSelfInfraProviderModule } from './postgres-self/postgres-self.infra.module';\nexport { MongodbAtlasInfraProviderModule } from './mongodb-atlas/mongodb-atlas.infra.module';\nexport { MongodbSelfInfraProviderModule } from './mongodb-self/mongodb-self.infra.module';\nexport { MinioSelfInfraProviderModule } from './minio-self/minio-self.infra.module';\nexport { AwsS3InfraProviderModule } from './aws-s3/aws-s3.infra.module';\nexport { ClamavSelfInfraProviderModule } from './clamav-self/clamav-self.infra.module';\nexport { GotenbergSelfInfraProviderModule } from './gotenberg-self/gotenberg-self.infra.module';\n\n/**\n * Canonical `InfraProvider` → `InfraProviderModule` catalog. Caller\n * (CLI, apps-manager) builds a `Map<InfraProvider, InfraProviderModule>`\n * from this constant when threading modules into\n * `materializeInfraSection`.\n *\n * **Why a const array instead of a `Map` literal**: arrays serialize\n * stably under tsc and roll up to a deterministic order. The\n * downstream `Map` is built once at program start; the catalog\n * itself is a value-level fixture.\n *\n * **Coverage** (Slice 5 baseline, 2026-05-10):\n * - `RABBITMQ_SELF`, `REDIS_SELF`, `POSTGRES_SELF`, `MONGODB_SELF`,\n *   `MONGODB_ATLAS` — five stateful modules with mint/revoke\n *   methods.\n * - `MINIO_SELF`, `AWS_S3` — object storage (shared-bucket model;\n *   no per-app credentials).\n * - `CLAMAV_SELF`, `GOTENBERG_SELF` — stateless infra (no auth, no\n *   per-app state; `plan()` only).\n *\n * **NOT covered** (catalog entries without modules):\n * - `POSTGRES_MANAGED`, `POSTGRES_AWS_RDS`, `POSTGRES_GCP_CLOUD_SQL`,\n *   `POSTGRES_AZURE_DATABASE`, `POSTGRES_SUPABASE`, `POSTGRES_NEON`,\n *   `POSTGRES_RENDER` — managed-Postgres brand catalog entries\n *   (Slice 4.B.0). No module yet; trigger = real customer.\n *\n * `materializeInfraSection` falls back to the authored-entry digest\n * when a selected `InfraProvider` is not in the map (preserves the\n * Slice 2.5b behavior for uncovered providers).\n */\nexport const INFRA_PROVIDER_MODULES: ReadonlyArray<InfraProviderModule> = [\n  RabbitmqSelfInfraProviderModule,\n  RedisSelfInfraProviderModule,\n  PostgresSelfInfraProviderModule,\n  MongodbAtlasInfraProviderModule,\n  MongodbSelfInfraProviderModule,\n  MinioSelfInfraProviderModule,\n  AwsS3InfraProviderModule,\n  ClamavSelfInfraProviderModule,\n  GotenbergSelfInfraProviderModule,\n];\n\n/**\n * Every `Wildo_Application_Secrets` JSON path that ANY provider module can mint per runtime\n * principal — the union of the catalog's own static declarations.\n *\n * ## Why this is derived rather than written down\n *\n * The consumer is the secret-DELIVERY path in apps-manager: it strips exactly this set from the\n * application blob before overlaying a principal's own material, so a principal receives a\n * credential only where one was minted FOR IT. A hand-maintained copy at that consumer would be a\n * second source — add a provider that mints a new credential path and delivery keeps shipping the\n * APPLICATION's value for it, silently. That is the defect class this repo has paid for twice: the\n * party that CONSTRAINS is not the party that DECLARES.\n *\n * Derived from `INFRA_PROVIDER_MODULES`, so a new module is covered the day it enters the catalog.\n *\n * Deliberately the union across ALL modules, not the ones a given application selected: a principal\n * must not receive an application-wide credential for a provider it does not use either, and the\n * selected set is not knowable at the delivery call site without threading app config through it.\n * Stripping a path no module minted for this app is harmless — it is absent from the blob anyway.\n */\nexport function collectPerPrincipalSecretBlobPaths(): ReadonlySet<string> {\n  const paths = new Set<string>();\n  for (const module of INFRA_PROVIDER_MODULES) {\n    for (const path of module.perPrincipalSecretBlobPaths) {\n      paths.add(path);\n    }\n  }\n  return paths;\n}\n\n/**\n * Build a `Map<InfraProvider, InfraProviderModule>` for the\n * canonical catalog. Callers store the result once at startup and\n * pass it to `materializeInfraSection` (digest derivation) or to\n * orchestrator paths that look up modules by `InfraProvider`.\n */\nexport function buildInfraProviderModuleMap(): ReadonlyMap<InfraProvider, InfraProviderModule> {\n  const map = new Map<InfraProvider, InfraProviderModule>();\n  for (const m of INFRA_PROVIDER_MODULES) {\n    if (map.has(m.provider)) {\n      throw new Error(\n        `INFRA_PROVIDER_MODULES contains duplicate provider '${m.provider}' — ` +\n        `each InfraProvider may have at most one module.`,\n      );\n    }\n    map.set(m.provider, m);\n  }\n  return map;\n}\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,OAAO,EAAE,+BAA+B,EAAE,MAAM,4CAA4C,CAAC;AAC7F,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AACpF,OAAO,EAAE,+BAA+B,EAAE,MAAM,4CAA4C,CAAC;AAC7F,OAAO,EAAE,+BAA+B,EAAE,MAAM,4CAA4C,CAAC;AAC7F,OAAO,EAAE,8BAA8B,EAAE,MAAM,0CAA0C,CAAC;AAC1F,6EAA6E;AAC7E,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AACpF,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AACxE,OAAO,EAAE,6BAA6B,EAAE,MAAM,wCAAwC,CAAC;AAEvF,OAAO,EAAE,+BAA+B,EAAE,MAAM,4CAA4C,CAAC;AAC7F,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AACpF,OAAO,EAAE,+BAA+B,EAAE,MAAM,4CAA4C,CAAC;AAC7F,OAAO,EAAE,+BAA+B,EAAE,MAAM,4CAA4C,CAAC;AAC7F,OAAO,EAAE,8BAA8B,EAAE,MAAM,0CAA0C,CAAC;AAC1F,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AACpF,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AACxE,OAAO,EAAE,6BAA6B,EAAE,MAAM,wCAAwC,CAAC;AAEvF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAuC;IACxE,+BAA+B;IAC/B,4BAA4B;IAC5B,+BAA+B;IAC/B,+BAA+B;IAC/B,8BAA8B;IAC9B,4BAA4B;IAC5B,wBAAwB;IACxB,6BAA6B;CAC9B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,kCAAkC;IAChD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,MAAM,IAAI,sBAAsB,EAAE,CAAC;QAC5C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,2BAA2B,EAAE,CAAC;YACtD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B;IACzC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAsC,CAAC;IAC1D,KAAK,MAAM,CAAC,IAAI,sBAAsB,EAAE,CAAC;QACvC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACb,uDAAuD,CAAC,CAAC,QAAQ,MAAM;gBACvE,iDAAiD,CAClD,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC","sourcesContent":["/**\n * `@wildo-ai/platform-infra-providers` — concrete `InfraProviderModule`\n * catalog (Slice 2.5c-1 of `infra-provider-planner.md`).\n *\n * Tier-portable: the modules import only `@wildo-ai/platform-config-lib`\n * (contracts) and have no DI / mongoose / axios runtime dependencies.\n * This lets both `platform-apps-manager` (orchestrator) and\n * `wildo-cli` (lockfile materializer) consume the same module\n * objects — apps-manager passes a real admin-client implementation\n * via `AppCredentialMintingContext.adminClient`; wildo-cli only\n * needs `module.plan()` for the lockfile digest.\n *\n * Each module is exported by name (no intermediary barrels per\n * platform/CLAUDE.md \"no intermediary index.ts barrels\"). The\n * `INFRA_PROVIDER_MODULES` map below is the canonical catalog —\n * consumers iterate it (or look up by `InfraProvider` value) instead\n * of importing modules one by one.\n */\n\nimport type { InfraProvider, InfraProviderModule } from '@wildo-ai/platform-config-lib';\n\nimport { RabbitmqSelfInfraProviderModule } from './rabbitmq-self/rabbitmq-self.infra.module';\nimport { RedisSelfInfraProviderModule } from './redis-self/redis-self.infra.module';\nimport { PostgresSelfInfraProviderModule } from './postgres-self/postgres-self.infra.module';\nimport { MongodbAtlasInfraProviderModule } from './mongodb-atlas/mongodb-atlas.infra.module';\nimport { MongodbSelfInfraProviderModule } from './mongodb-self/mongodb-self.infra.module';\n// Slice 5 of `infra-provider-planner.md` — object-storage + stateless infra.\nimport { MinioSelfInfraProviderModule } from './minio-self/minio-self.infra.module';\nimport { AwsS3InfraProviderModule } from './aws-s3/aws-s3.infra.module';\nimport { ClamavSelfInfraProviderModule } from './clamav-self/clamav-self.infra.module';\n\nexport { RabbitmqSelfInfraProviderModule } from './rabbitmq-self/rabbitmq-self.infra.module';\nexport { RedisSelfInfraProviderModule } from './redis-self/redis-self.infra.module';\nexport { PostgresSelfInfraProviderModule } from './postgres-self/postgres-self.infra.module';\nexport { MongodbAtlasInfraProviderModule } from './mongodb-atlas/mongodb-atlas.infra.module';\nexport { MongodbSelfInfraProviderModule } from './mongodb-self/mongodb-self.infra.module';\nexport { MinioSelfInfraProviderModule } from './minio-self/minio-self.infra.module';\nexport { AwsS3InfraProviderModule } from './aws-s3/aws-s3.infra.module';\nexport { ClamavSelfInfraProviderModule } from './clamav-self/clamav-self.infra.module';\n\n/**\n * Canonical `InfraProvider` → `InfraProviderModule` catalog. Caller\n * (CLI, apps-manager) builds a `Map<InfraProvider, InfraProviderModule>`\n * from this constant when threading modules into\n * `materializeInfraSection`.\n *\n * **Why a const array instead of a `Map` literal**: arrays serialize\n * stably under tsc and roll up to a deterministic order. The\n * downstream `Map` is built once at program start; the catalog\n * itself is a value-level fixture.\n *\n * **Coverage** (Slice 5 baseline, 2026-05-10):\n * - `RABBITMQ_SELF`, `REDIS_SELF`, `POSTGRES_SELF`, `MONGODB_SELF`,\n *   `MONGODB_ATLAS` — five stateful modules with mint/revoke\n *   methods.\n * - `MINIO_SELF`, `AWS_S3` — object storage (shared-bucket model;\n *   no per-app credentials).\n * - `CLAMAV_SELF` — stateless infra (no auth, no per-app state;\n *   `plan()` only).\n *\n * **NOT covered** (catalog entries without modules):\n * - `POSTGRES_MANAGED`, `POSTGRES_AWS_RDS`, `POSTGRES_GCP_CLOUD_SQL`,\n *   `POSTGRES_AZURE_DATABASE`, `POSTGRES_SUPABASE`, `POSTGRES_NEON`,\n *   `POSTGRES_RENDER` — managed-Postgres brand catalog entries\n *   (Slice 4.B.0). No module yet; trigger = real customer.\n *\n * `materializeInfraSection` falls back to the authored-entry digest\n * when a selected `InfraProvider` is not in the map (preserves the\n * Slice 2.5b behavior for uncovered providers).\n */\nexport const INFRA_PROVIDER_MODULES: ReadonlyArray<InfraProviderModule> = [\n  RabbitmqSelfInfraProviderModule,\n  RedisSelfInfraProviderModule,\n  PostgresSelfInfraProviderModule,\n  MongodbAtlasInfraProviderModule,\n  MongodbSelfInfraProviderModule,\n  MinioSelfInfraProviderModule,\n  AwsS3InfraProviderModule,\n  ClamavSelfInfraProviderModule,\n];\n\n/**\n * Every `Wildo_Application_Secrets` JSON path that ANY provider module can mint per runtime\n * principal — the union of the catalog's own static declarations.\n *\n * ## Why this is derived rather than written down\n *\n * The consumer is the secret-DELIVERY path in apps-manager: it strips exactly this set from the\n * application blob before overlaying a principal's own material, so a principal receives a\n * credential only where one was minted FOR IT. A hand-maintained copy at that consumer would be a\n * second source — add a provider that mints a new credential path and delivery keeps shipping the\n * APPLICATION's value for it, silently. That is the defect class this repo has paid for twice: the\n * party that CONSTRAINS is not the party that DECLARES.\n *\n * Derived from `INFRA_PROVIDER_MODULES`, so a new module is covered the day it enters the catalog.\n *\n * Deliberately the union across ALL modules, not the ones a given application selected: a principal\n * must not receive an application-wide credential for a provider it does not use either, and the\n * selected set is not knowable at the delivery call site without threading app config through it.\n * Stripping a path no module minted for this app is harmless — it is absent from the blob anyway.\n */\nexport function collectPerPrincipalSecretBlobPaths(): ReadonlySet<string> {\n  const paths = new Set<string>();\n  for (const module of INFRA_PROVIDER_MODULES) {\n    for (const path of module.perPrincipalSecretBlobPaths) {\n      paths.add(path);\n    }\n  }\n  return paths;\n}\n\n/**\n * Build a `Map<InfraProvider, InfraProviderModule>` for the\n * canonical catalog. Callers store the result once at startup and\n * pass it to `materializeInfraSection` (digest derivation) or to\n * orchestrator paths that look up modules by `InfraProvider`.\n */\nexport function buildInfraProviderModuleMap(): ReadonlyMap<InfraProvider, InfraProviderModule> {\n  const map = new Map<InfraProvider, InfraProviderModule>();\n  for (const m of INFRA_PROVIDER_MODULES) {\n    if (map.has(m.provider)) {\n      throw new Error(\n        `INFRA_PROVIDER_MODULES contains duplicate provider '${m.provider}' — ` +\n        `each InfraProvider may have at most one module.`,\n      );\n    }\n    map.set(m.provider, m);\n  }\n  return map;\n}\n"]}

package/dist/esm/minio-self/minio-self.infra.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"minio-self.infra.module.d.ts","sourceRoot":"","sources":["../../../../src/minio-self/minio-self.infra.module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;AAEH,OAAO,EAIL,mBAAmB,EAEpB,MAAM,+BAA+B,CAAC;AAIvC,eAAO,MAAM,4BAA4B,EAAE,mBA2C1C,CAAC"}
+{"version":3,"file":"minio-self.infra.module.d.ts","sourceRoot":"","sources":["../../../src/minio-self/minio-self.infra.module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;AAEH,OAAO,EAIL,mBAAmB,EAEpB,MAAM,+BAA+B,CAAC;AAIvC,eAAO,MAAM,4BAA4B,EAAE,mBA2C1C,CAAC"}

package/dist/esm/mongodb-atlas/mongodb-atlas.infra.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mongodb-atlas.infra.module.d.ts","sourceRoot":"","sources":["../../../../src/mongodb-atlas/mongodb-atlas.infra.module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAEH,OAAO,EAOL,mBAAmB,EAEpB,MAAM,+BAA+B,CAAC;AAqDvC,eAAO,MAAM,+BAA+B,EAAE,mBA2H7C,CAAC"}
+{"version":3,"file":"mongodb-atlas.infra.module.d.ts","sourceRoot":"","sources":["../../../src/mongodb-atlas/mongodb-atlas.infra.module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAEH,OAAO,EAOL,mBAAmB,EAEpB,MAAM,+BAA+B,CAAC;AAqDvC,eAAO,MAAM,+BAA+B,EAAE,mBA2H7C,CAAC"}

package/dist/esm/mongodb-self/mongodb-self.infra.module.d.ts

@@ -76,6 +76,8 @@ export declare function buildMinionMongodbPrivileges(input: {
     databaseName: string;
     readCollections: readonly string[];
     writeCollections: readonly string[];
+    /** Insert-only — see {@link MONGODB_APPEND_ACTIONS}. Optional so existing pins read unchanged. */
+    appendCollections?: readonly string[];
 }): MongodbCollectionPrivilege[];
 export declare const MongodbSelfInfraProviderModule: InfraProviderModule;
 //# sourceMappingURL=mongodb-self.infra.module.d.ts.map

package/dist/esm/mongodb-self/mongodb-self.infra.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mongodb-self.infra.module.d.ts","sourceRoot":"","sources":["../../../../src/mongodb-self/mongodb-self.infra.module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,OAAO,EAOL,mBAAmB,EAKpB,MAAM,+BAA+B,CAAC;AAmDvC,qDAAqD;AACrD,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IACxE,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE;IAClD,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC,GAAG,0BAA0B,EAAE,CAS/B;AA+CD,eAAO,MAAM,8BAA8B,EAAE,mBA4L5C,CAAC"}
+{"version":3,"file":"mongodb-self.infra.module.d.ts","sourceRoot":"","sources":["../../../src/mongodb-self/mongodb-self.infra.module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,OAAO,EAOL,mBAAmB,EAMpB,MAAM,+BAA+B,CAAC;AAyDvC,qDAAqD;AACrD,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IACxE,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE;IAClD,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,kGAAkG;IAClG,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACvC,GAAG,0BAA0B,EAAE,CAY/B;AA+CD,eAAO,MAAM,8BAA8B,EAAE,mBAkM5C,CAAC"}

package/dist/esm/mongodb-self/mongodb-self.infra.module.js

@@ -40,7 +40,7 @@
  *
  * **NOT served (D-4)**: audience-2 not applicable.
  */
-import { InfraCapability, InfraPlatformAdminConsumer, InfraProvider, ApplicationRuntimePrincipalKind, resolveGrantStorageNames, } from '@wildo-ai/platform-config-lib';
+import { InfraCapability, InfraPlatformAdminConsumer, InfraProvider, ApplicationRuntimePrincipalKind, deriveMinionDatabaseGrants, resolveGrantStorageNames, } from '@wildo-ai/platform-config-lib';
 const MONGODB_USERNAME_PATH = 'database.mongodb.username';
 const MONGODB_PASSWORD_PATH = 'database.mongodb.password';
 /**
@@ -83,6 +83,12 @@ function buildMongodbUsername(applicationNamespace) {
  */
 const MONGODB_READ_ACTIONS = ['find'];
 const MONGODB_WRITE_ACTIONS = ['insert', 'update', 'remove'];
+/**
+ * Append-only: `insert` WITHOUT `update` or `remove`, the Mongo counterpart of
+ * `GRANT INSERT`. Carries the engine's audit-log floor, where a principal must
+ * be able to record what it did and must never be able to unrecord it.
+ */
+const MONGODB_APPEND_ACTIONS = ['insert'];
 /**
  * Turn a minion's grants into collection-scoped MongoDB privileges (D14, R1).
  *
@@ -114,6 +120,9 @@ export function buildMinionMongodbPrivileges(input) {
     for (const collection of input.writeCollections) {
         privileges.push({ resource: { db: input.databaseName, collection }, actions: [...MONGODB_WRITE_ACTIONS] });
     }
+    for (const collection of input.appendCollections ?? []) {
+        privileges.push({ resource: { db: input.databaseName, collection }, actions: [...MONGODB_APPEND_ACTIONS] });
+    }
     return privileges;
 }
 /**
@@ -221,6 +230,7 @@ export const MongodbSelfInfraProviderModule = {
                     + `Refusing to fall back to the database-wide application user — a minion with no declared `
                     + `access must get NO database user at all (D11/R3), which is the orchestrator's decision to make.`);
             }
+            const databaseGrants = deriveMinionDatabaseGrants(grants);
             await adminClient.upsertCollectionScopedDatabaseUser({
                 adminConnectUrl,
                 databaseName,
@@ -229,10 +239,14 @@ export const MongodbSelfInfraProviderModule = {
                 roleName: `${username}_role`,
                 // Resource types → collection names HERE, at the adapter that speaks
                 // Mongo. The grant contract itself stays in the platform vocabulary.
+                // Authored declaration + the engine floor, through the SAME derivation
+                // the PostgreSQL adapter uses — so the two cannot disagree about what
+                // the framework itself requires of every runtime principal.
                 privileges: buildMinionMongodbPrivileges({
                     databaseName,
-                    readCollections: resolveGrantStorageNames(grants.read),
-                    writeCollections: resolveGrantStorageNames(grants.write),
+                    readCollections: resolveGrantStorageNames(databaseGrants.read),
+                    writeCollections: resolveGrantStorageNames(databaseGrants.write),
+                    appendCollections: resolveGrantStorageNames(databaseGrants.append),
                 }),
             });
         }

package/dist/esm/mongodb-self/mongodb-self.infra.module.js.map

@@ -1 +1 @@
-{"version":3,"file":"mongodb-self.infra.module.js","sourceRoot":"","sources":["../../../../src/mongodb-self/mongodb-self.infra.module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,OAAO,EAIL,eAAe,EACf,0BAA0B,EAC1B,aAAa,EAGb,+BAA+B,EAC/B,wBAAwB,GAEzB,MAAM,+BAA+B,CAAC;AAEvC,MAAM,qBAAqB,GAAG,2BAA2B,CAAC;AAC1D,MAAM,qBAAqB,GAAG,2BAA2B,CAAC;AAC1D;;;;;;;GAOG;AACH,MAAM,+BAA+B,GAA0B,CAAC,qBAAqB,EAAE,qBAAqB,CAAC,CAAC;AAG9G,MAAM,0BAA0B,GAAG,2BAA2B,CAAC;AAE/D,MAAM,uBAAuB,GAAG,cAAc,CAAC;AAC/C,MAAM,2BAA2B,GAAG,iBAAiB,CAAC;AAEtD,MAAM,8BAA8B,GAAG,kBAAkB,CAAC;AAE1D;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,oBAA4B;IACxD,OAAO,GAAG,oBAAoB,OAAO,CAAC;AACxC,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,oBAAoB,GAAsB,CAAC,MAAM,CAAC,CAAC;AACzD,MAAM,qBAAqB,GAAsB,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAQhF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,4BAA4B,CAAC,KAI5C;IACC,MAAM,UAAU,GAAiC,EAAE,CAAC;IACpD,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;QAC/C,UAAU,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,YAAY,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,CAAC,GAAG,oBAAoB,CAAC,EAAE,CAAC,CAAC;IAC5G,CAAC;IACD,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAChD,UAAU,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,YAAY,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,CAAC,GAAG,qBAAqB,CAAC,EAAE,CAAC,CAAC;IAC7G,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,qBAAqB,CAC5B,eAAuB,EACvB,YAAoB,EACpB,QAAgB,EAChB,QAAgB;IAEhB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IACxC,MAAM,CAAC,QAAQ,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,CAAC,QAAQ,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,CAAC,QAAQ,GAAG,GAAG,GAAG,YAAY,CAAC;IACrC,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,6BAA6B,CACpC,oBAA4B,EAC5B,SAAkD;IAElD,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,IAAI,KAAK,+BAA+B,CAAC,mBAAmB,EAAE,CAAC;QACzF,OAAO,oBAAoB,CAAC,oBAAoB,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,aAAa,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACpG,OAAO,GAAG,oBAAoB,IAAI,SAAS,CAAC,IAAI,IAAI,aAAa,OAAO,CAAC;AAC3E,CAAC;AAED,MAAM,CAAC,MAAM,8BAA8B,GAAwB;IACjE,QAAQ,EAAE,aAAa,CAAC,YAAY;IACpC,qBAAqB,EAAE,CAAC,eAAe,CAAC,iBAAiB,CAAC;IAC1D,2BAA2B,EAAE,+BAA+B;IAE5D,IAAI;QACF,OAAO;YACL,qBAAqB,EAAE,CAAC,SAAS,CAAC;YAClC,YAAY,EAAE,CAAC,0DAA0D,CAAC;YAC1E,aAAa,EAAE;gBACb,OAAO,EAAE,EAAE;gBACX,wDAAwD;gBACxD,qDAAqD;gBACrD,aAAa,EAAE,CAAC,mBAAmB,CAAC;gBACpC,SAAS,EAAE;oBACT,0BAA0B,CAAC,YAAY;oBACvC,0BAA0B,CAAC,SAAS;iBACrC;aACF;YACD,UAAU,EAAE;gBACV,uDAAuD;gBACvD,2DAA2D;gBAC3D,0DAA0D;gBAC1D,2CAA2C;gBAC3C,qBAAqB,EAAE,CAAC,GAAG,+BAA+B,CAAC;aAC5D;SACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,OAAoC;QAEpC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAoC,CAAC;QACjE,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAC,0BAA0B,CAAC,CAAC;QAClE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CACb,qDAAqD;gBACrD,4BAA4B,0BAA0B,KAAK;gBAC3D,4EAA4E,CAC7E,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CACb,qDAAqD;gBACrD,iCAAiC;gBACjC,qDAAqD,CACtD,CAAC;QACJ,CAAC;QACD,MAAM,YAAY,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,uBAAuB,CAAC,CAAC;QAChF,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CACb,qDAAqD;gBACrD,uCAAuC,uBAAuB,KAAK;gBACnE,yDAAyD,CAC1D,CAAC;QACJ,CAAC;QACD,MAAM,eAAe,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,2BAA2B,CAAC,CAAC;QACvF,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACb,qDAAqD;gBACrD,uCAAuC,2BAA2B,KAAK;gBACvE,2DAA2D,CAC5D,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,6BAA6B,CAAC,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAEhG,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS,CAAC,IAAI,KAAK,+BAA+B,CAAC,mBAAmB,EAAE,CAAC;YACxG,uEAAuE;YACvE,uEAAuE;YACvE,kCAAkC;YAClC,EAAE;YACF,uEAAuE;YACvE,0EAA0E;YAC1E,uEAAuE;YACvE,0EAA0E;YAC1E,2CAA2C;YAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;YACtC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CACb,qDAAqD;sBACnD,cAAc,OAAO,CAAC,SAAS,CAAC,IAAI,IAAI,OAAO,CAAC,SAAS,CAAC,IAAI,2BAA2B;sBACzF,0FAA0F;sBAC1F,iGAAiG,CACpG,CAAC;YACJ,CAAC;YACD,MAAM,WAAW,CAAC,kCAAkC,CAAC;gBACnD,eAAe;gBACf,YAAY;gBACZ,QAAQ;gBACR,QAAQ;gBACR,QAAQ,EAAE,GAAG,QAAQ,OAAO;gBAC5B,qEAAqE;gBACrE,qEAAqE;gBACrE,UAAU,EAAE,4BAA4B,CAAC;oBACvC,YAAY;oBACZ,eAAe,EAAE,wBAAwB,CAAC,MAAM,CAAC,IAAI,CAAC;oBACtD,gBAAgB,EAAE,wBAAwB,CAAC,MAAM,CAAC,KAAK,CAAC;iBACzD,CAAC;aACH,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,yDAAyD;YACzD,kCAAkC;YAClC,MAAM,WAAW,CAAC,6BAA6B,CAAC;gBAC9C,eAAe;gBACf,YAAY;gBACZ,QAAQ;gBACR,QAAQ;aACT,CAAC,CAAC;QACL,CAAC;QAED,+DAA+D;QAC/D,4DAA4D;QAC5D,6CAA6C;QAC7C,MAAM,gBAAgB,GAAG,qBAAqB,CAC5C,eAAe,EACf,YAAY,EACZ,QAAQ,EACR,QAAQ,CACT,CAAC;QAEF,OAAO;YACL,gBAAgB,EAAE;gBAChB,CAAC,qBAAqB,CAAC,EAAE,QAAQ;gBACjC,CAAC,qBAAqB,CAAC,EAAE,QAAQ;aAClC;YACD,gBAAgB,EAAE;gBAChB,CAAC,8BAA8B,CAAC,EAAE,gBAAgB;aACnD;SACF,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,oBAAoB,CAAC,OAAoC;QAC7D,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CACb,uDAAuD;gBACvD,iCAAiC;gBACjC,qDAAqD,CACtD,CAAC;QACJ,CAAC;QACD,MAAM,eAAe,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,2BAA2B,CAAC,CAAC;QACvF,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACb,uDAAuD;gBACvD,uCAAuC,2BAA2B,KAAK;gBACvE,2DAA2D,CAC5D,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAoC,CAAC;QACjE,6EAA6E;QAC7E,6EAA6E;QAC7E,yEAAyE;QACzE,8DAA8D;QAC9D,kDAAkD;QAClD,MAAM,QAAQ,GAAG,6BAA6B,CAAC,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAEhG,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS,CAAC,IAAI,KAAK,+BAA+B,CAAC,mBAAmB,EAAE,CAAC;YACxG,2EAA2E;YAC3E,yEAAyE;YACzE,uCAAuC;YACvC,MAAM,YAAY,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,uBAAuB,CAAC,CAAC;YAChF,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,IAAI,KAAK,CACb,uDAAuD;sBACrD,uCAAuC,uBAAuB,kBAAkB;sBAChF,IAAI,OAAO,CAAC,SAAS,CAAC,IAAI,IAAI,OAAO,CAAC,SAAS,CAAC,IAAI,oCAAoC;sBACxF,wFAAwF,CAC3F,CAAC;YACJ,CAAC;YACD,MAAM,WAAW,CAAC,gCAAgC,CAAC;gBACjD,eAAe;gBACf,YAAY;gBACZ,QAAQ;gBACR,QAAQ,EAAE,GAAG,QAAQ,OAAO;aAC7B,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,MAAM,WAAW,CAAC,6BAA6B,CAAC,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,CAAC;IACjF,CAAC;IAED,6CAA6C;CAC9C,CAAC","sourcesContent":["/**\n * `MongodbSelfInfraProviderModule` — fifth concrete `InfraProviderModule`\n * (Slice 4.B.3 of `infra-provider-planner.md`, generalizing the\n * pattern to self-managed MongoDB).\n *\n * Implements the `MONGODB_SELF` `InfraProvider` over the\n * `IMongoSelfAdminClient` transport (admin-side mongoose connection,\n * exposed by `MongoSelfManagerService` after the Slice 4.B.3 5C\n * policy/transport split). Owns ALL per-app naming policy +\n * URL-derivation policy — the per-app username convention\n * (`<applicationNamespace>_user`, mirroring the Atlas variant) and\n * the per-app SRV URL derivation by swapping admin credentials\n * with per-app credentials in the authored\n * `BASE_MONGO_SERVER_URL`-derived admin connect URL.\n *\n * **What this module reads from `AppCredentialMintingContext`**:\n * - `applicationNamespace` — used as the source for the per-app\n *   username (legacy convention `${ns}_user`).\n * - `secretInputs['database.mongodb.password']` — orchestrator-\n *   supplied password (module is upsert-only, never generator).\n * - `applicationConfigInputs['databaseName']` — required.\n * - `applicationConfigInputs['adminConnectUrl']` — required, the\n *   admin-scoped MongoDB connect URL the orchestrator reads from\n *   `MONGO_CONNECT_URL` env at app-init time.\n * - `adminClient` — narrowed to `IMongoSelfAdminClient`.\n *\n * **Two audiences this module serves:**\n *\n * 1. **Audience-1 (platform-admin)**: cluster-wide Mongo admin\n *    connect URL (`MONGO_CONNECT_URL`). Consumers: `apps-manager`\n *    (mints per-app users via `mintAppCredentials`), `companion`\n *    (mirrors apps-manager admin role for local dev).\n *\n * 2. **Audience-3 (app-scoped, via `mintAppCredentials`)**:\n *    per-customer-app Mongo database user. Result threaded into\n *    `Wildo_Application_Secrets.database.mongodb.{username,password}`\n *    via `_merge_WildoApplicationSecrets`; the per-app connect URL\n *    returned via `runtimeArtifacts.connectionString` for\n *    transient app-init operations.\n *\n * **NOT served (D-4)**: audience-2 not applicable.\n */\n\nimport {\n  AppCredentialMintingContext,\n  AppCredentialMintingResult,\n  IMongoSelfAdminClient,\n  InfraCapability,\n  InfraPlatformAdminConsumer,\n  InfraProvider,\n  InfraProviderModule,\n  InfraProviderPlanContribution,\n  ApplicationRuntimePrincipalKind,\n  resolveGrantStorageNames,\n  type ApplicationRuntimePrincipal,\n} from '@wildo-ai/platform-config-lib';\n\nconst MONGODB_USERNAME_PATH = 'database.mongodb.username';\nconst MONGODB_PASSWORD_PATH = 'database.mongodb.password';\n/**\n * The paths this module mints PER RUNTIME PRINCIPAL — the single source for both consumers.\n *\n * Read by `InfraProviderModule.perPrincipalSecretBlobPaths` (statically, so apps-manager can strip\n * these from the application blob before delivering a principal's own material) AND spread into\n * `appRuntime.perAppSecretBlobPaths` inside `plan()`. Declaring the list twice is how the delivery\n * path would silently stop covering a path this module still mints.\n */\nconst PER_PRINCIPAL_SECRET_BLOB_PATHS: ReadonlyArray<string> = [MONGODB_USERNAME_PATH, MONGODB_PASSWORD_PATH];\n\n\nconst MONGODB_PASSWORD_INPUT_KEY = 'database.mongodb.password';\n\nconst DATABASE_NAME_INPUT_KEY = 'databaseName';\nconst ADMIN_CONNECT_URL_INPUT_KEY = 'adminConnectUrl';\n\nconst CONNECTION_STRING_ARTIFACT_KEY = 'connectionString';\n\n/**\n * Compute the per-app username. Mirrors the Atlas module's\n * convention (`${ns}_user`) so the persistence shape is identical\n * regardless of provider.\n */\nfunction buildMongodbUsername(applicationNamespace: string): string {\n  return `${applicationNamespace}_user`;\n}\n\n/**\n * MongoDB privilege ACTIONS, per grant axis.\n *\n * Named here rather than inlined because these ARE the security semantics: what\n * \"read\" and \"write\" mean once they reach the database. Mongo's action\n * vocabulary is an external one, so it lives at this adapter — the module that\n * speaks Mongo — and never leaks into the platform's grant model.\n *\n * `find` alone for read: no `listCollections`, no `collStats`, nothing that\n * enumerates. A minion granted read on one resource should not be able to\n * discover what else exists.\n *\n * `insert`/`update`/`remove` for write, and deliberately NOT `find`. The\n * platform-level derivation refuses to widen write into read, and re-adding it\n * here would defeat that decision at the last hop — see\n * `deriveMinionResourceGrants`.\n */\nconst MONGODB_READ_ACTIONS: readonly string[] = ['find'];\nconst MONGODB_WRITE_ACTIONS: readonly string[] = ['insert', 'update', 'remove'];\n\n/** One `createRole`/`updateRole` privilege entry. */\nexport interface MongodbCollectionPrivilege {\n  readonly resource: { readonly db: string; readonly collection: string };\n  readonly actions: readonly string[];\n}\n\n/**\n * Turn a minion's grants into collection-scoped MongoDB privileges (D14, R1).\n *\n * ## What this deliberately never produces\n *\n * No `dbAdmin` and no `readWrite` — the two roles the application backend\n * currently holds on the whole database. `dbAdmin` is banned outright by D14;\n * `readWrite` is database-WIDE, so granting it to a minion would make every\n * collection reachable regardless of what `resourceAccess` declared, which is\n * the containment this exists to create.\n *\n * No privilege on the database RESOURCE either (`{ db, collection: '' }`), which\n * is Mongo's way of saying \"every collection in this database\". Every entry\n * names one collection explicitly.\n *\n * ## Read and write are separate entries on purpose\n *\n * A collection granted both axes yields TWO privilege entries rather than one\n * merged action list. Mongo unions them identically, but the emitted role then\n * reads back as the declaration that produced it — which is what makes an\n * operator inspecting `db.getRole()` able to check the grant against the config\n * without re-deriving it.\n */\nexport function buildMinionMongodbPrivileges(input: {\n  databaseName: string;\n  readCollections: readonly string[];\n  writeCollections: readonly string[];\n}): MongodbCollectionPrivilege[] {\n  const privileges: MongodbCollectionPrivilege[] = [];\n  for (const collection of input.readCollections) {\n    privileges.push({ resource: { db: input.databaseName, collection }, actions: [...MONGODB_READ_ACTIONS] });\n  }\n  for (const collection of input.writeCollections) {\n    privileges.push({ resource: { db: input.databaseName, collection }, actions: [...MONGODB_WRITE_ACTIONS] });\n  }\n  return privileges;\n}\n\n/**\n * Derive the per-app connect URL by swapping admin credentials and\n * the database path in the authored `adminConnectUrl`. Mirrors the\n * legacy logic at\n * `wildo-application-lifecycle.service.ts:469-479`:\n *\n *   const parsed = new URL(adminConnectUrl);\n *   parsed.username = perAppUsername;\n *   parsed.password = perAppPassword;\n *   parsed.pathname = '/' + databaseName;\n *\n * URL-encoding handled automatically by the WHATWG URL class.\n */\nfunction buildPerAppConnectUrl(\n  adminConnectUrl: string,\n  databaseName: string,\n  username: string,\n  password: string,\n): string {\n  const parsed = new URL(adminConnectUrl);\n  parsed.username = encodeURIComponent(username);\n  parsed.password = encodeURIComponent(password);\n  parsed.pathname = '/' + databaseName;\n  return parsed.toString();\n}\n\n/**\n * Per-principal Mongo username — the SAME derivation the revoke path must use.\n *\n * The application backend keeps `<namespace>_user` VERBATIM so an existing\n * deployment's user is never orphaned. Third time this shape appears (Redis,\n * RabbitMQ, now Mongo): a revoke deriving it differently deletes the BACKEND's\n * database user while believing it is removing a minion's.\n */\nfunction buildMongodbPrincipalUsername(\n  applicationNamespace: string,\n  principal: ApplicationRuntimePrincipal | undefined,\n): string {\n  if (!principal || principal.kind === ApplicationRuntimePrincipalKind.APPLICATION_BACKEND) {\n    return buildMongodbUsername(applicationNamespace);\n  }\n  const sanitizedName = (principal.name ?? '').replace(/[^a-zA-Z0-9]+/g, '_').replace(/^_+|_+$/g, '');\n  return `${applicationNamespace}_${principal.kind}_${sanitizedName}_user`;\n}\n\nexport const MongodbSelfInfraProviderModule: InfraProviderModule = {\n  provider: InfraProvider.MONGODB_SELF,\n  supportedCapabilities: [InfraCapability.DOCUMENT_DATABASE],\n  perPrincipalSecretBlobPaths: PER_PRINCIPAL_SECRET_BLOB_PATHS,\n\n  plan(): InfraProviderPlanContribution {\n    return {\n      dockerComposeServices: ['mongodb'],\n      k8sResources: ['templates/infra/k8s/internal/mongodb/deployment.yaml.hbs'],\n      platformAdmin: {\n        envVars: {},\n        // The single MONGO_CONNECT_URL secret carries the admin\n        // credentials embedded; legacy field name preserved.\n        secretEnvVars: ['MONGO_CONNECT_URL'],\n        consumers: [\n          InfraPlatformAdminConsumer.APPS_MANAGER,\n          InfraPlatformAdminConsumer.COMPANION,\n        ],\n      },\n      appRuntime: {\n        // Same persistence shape as Atlas — per-app username +\n        // password go into secrets; the host/protocol/options come\n        // from `_merge_WildoApplicationConfig` which derives them\n        // from env-config (BASE_MONGO_SERVER_URL).\n        perAppSecretBlobPaths: [...PER_PRINCIPAL_SECRET_BLOB_PATHS],\n      },\n    };\n  },\n\n  async mintAppCredentials(\n    context: AppCredentialMintingContext,\n  ): Promise<AppCredentialMintingResult> {\n    const adminClient = context.adminClient as IMongoSelfAdminClient;\n    const password = context.secretInputs[MONGODB_PASSWORD_INPUT_KEY];\n    if (!password) {\n      throw new Error(\n        `MongodbSelfInfraProviderModule.mintAppCredentials: ` +\n        `secretInputs is missing '${MONGODB_PASSWORD_INPUT_KEY}'. ` +\n        `The orchestrator MUST supply the Mongo password — modules are upsert-only.`,\n      );\n    }\n    if (!context.applicationNamespace) {\n      throw new Error(\n        `MongodbSelfInfraProviderModule.mintAppCredentials: ` +\n        `applicationNamespace is empty. ` +\n        `The orchestrator MUST supply a non-empty namespace.`,\n      );\n    }\n    const databaseName = context.applicationConfigInputs?.[DATABASE_NAME_INPUT_KEY];\n    if (!databaseName) {\n      throw new Error(\n        `MongodbSelfInfraProviderModule.mintAppCredentials: ` +\n        `applicationConfigInputs is missing '${DATABASE_NAME_INPUT_KEY}'. ` +\n        `The orchestrator MUST supply the per-app database name.`,\n      );\n    }\n    const adminConnectUrl = context.applicationConfigInputs?.[ADMIN_CONNECT_URL_INPUT_KEY];\n    if (!adminConnectUrl) {\n      throw new Error(\n        `MongodbSelfInfraProviderModule.mintAppCredentials: ` +\n        `applicationConfigInputs is missing '${ADMIN_CONNECT_URL_INPUT_KEY}'. ` +\n        `The orchestrator MUST supply the admin Mongo connect URL.`,\n      );\n    }\n\n    const username = buildMongodbPrincipalUsername(context.applicationNamespace, context.principal);\n\n    if (context.principal && context.principal.kind !== ApplicationRuntimePrincipalKind.APPLICATION_BACKEND) {\n      // A named principal gets a COLLECTION-SCOPED user (Step 3 / R1 / D14):\n      // one custom role carrying exactly the privileges its `resourceAccess`\n      // derived, and nothing inherited.\n      //\n      // `resourceGrants` is REQUIRED here and its absence is an error rather\n      // than a default. Falling back to the app-wide upsert would hand a minion\n      // `readWrite` + `dbAdmin` on the whole database — the exact over-grant\n      // this path exists to replace, arriving silently through a code path that\n      // looks like it is doing the narrow thing.\n      const grants = context.resourceGrants;\n      if (!grants) {\n        throw new Error(\n          `MongodbSelfInfraProviderModule.mintAppCredentials: `\n          + `principal '${context.principal.kind}:${context.principal.name}' has no resourceGrants. `\n          + `Refusing to fall back to the database-wide application user — a minion with no declared `\n          + `access must get NO database user at all (D11/R3), which is the orchestrator's decision to make.`,\n        );\n      }\n      await adminClient.upsertCollectionScopedDatabaseUser({\n        adminConnectUrl,\n        databaseName,\n        username,\n        password,\n        roleName: `${username}_role`,\n        // Resource types → collection names HERE, at the adapter that speaks\n        // Mongo. The grant contract itself stays in the platform vocabulary.\n        privileges: buildMinionMongodbPrivileges({\n          databaseName,\n          readCollections: resolveGrantStorageNames(grants.read),\n          writeCollections: resolveGrantStorageNames(grants.write),\n        }),\n      });\n    } else {\n      // createUser-or-updateUser over an admin-scoped mongoose\n      // connection — idempotent upsert.\n      await adminClient.upsertApplicationDatabaseUser({\n        adminConnectUrl,\n        databaseName,\n        username,\n        password,\n      });\n    }\n\n    // Derive the per-app SRV URL by swapping credentials + db path\n    // in the authored admin URL. The orchestrator uses this for\n    // transient app-init seeding; not persisted.\n    const connectionString = buildPerAppConnectUrl(\n      adminConnectUrl,\n      databaseName,\n      username,\n      password,\n    );\n\n    return {\n      secretBlobValues: {\n        [MONGODB_USERNAME_PATH]: username,\n        [MONGODB_PASSWORD_PATH]: password,\n      },\n      runtimeArtifacts: {\n        [CONNECTION_STRING_ARTIFACT_KEY]: connectionString,\n      },\n    };\n  },\n\n  /**\n   * Tear down the per-app Mongo database user.\n   *\n   * **Caller status**: no caller wires this in Slices 1–4.B.3.\n   * Forward-compat seam.\n   */\n  async revokeAppCredentials(context: AppCredentialMintingContext): Promise<void> {\n    if (!context.applicationNamespace) {\n      throw new Error(\n        `MongodbSelfInfraProviderModule.revokeAppCredentials: ` +\n        `applicationNamespace is empty. ` +\n        `The orchestrator MUST supply a non-empty namespace.`,\n      );\n    }\n    const adminConnectUrl = context.applicationConfigInputs?.[ADMIN_CONNECT_URL_INPUT_KEY];\n    if (!adminConnectUrl) {\n      throw new Error(\n        `MongodbSelfInfraProviderModule.revokeAppCredentials: ` +\n        `applicationConfigInputs is missing '${ADMIN_CONNECT_URL_INPUT_KEY}'. ` +\n        `The orchestrator MUST supply the admin Mongo connect URL.`,\n      );\n    }\n    const adminClient = context.adminClient as IMongoSelfAdminClient;\n    // Derived through the SAME function the mint uses. Deriving it independently\n    // here — which is what this line did before named principals existed — meant\n    // revoking a minion left its credential live AND dropped the APPLICATION\n    // BACKEND's database user, because the backend's name is what\n    // `buildMongodbUsername` returns for every input.\n    const username = buildMongodbPrincipalUsername(context.applicationNamespace, context.principal);\n\n    if (context.principal && context.principal.kind !== ApplicationRuntimePrincipalKind.APPLICATION_BACKEND) {\n      // A scoped principal owns a user AND a custom role. Routing it through the\n      // user-only door would leave a privileged role behind that the next mint\n      // adopts without anybody declaring it.\n      const databaseName = context.applicationConfigInputs?.[DATABASE_NAME_INPUT_KEY];\n      if (!databaseName) {\n        throw new Error(\n          `MongodbSelfInfraProviderModule.revokeAppCredentials: `\n          + `applicationConfigInputs is missing '${DATABASE_NAME_INPUT_KEY}' for principal `\n          + `'${context.principal.kind}:${context.principal.name}'. The role to drop lives IN that `\n          + `database — revoking without it would drop the user and silently orphan its privileges.`,\n        );\n      }\n      await adminClient.dropCollectionScopedDatabaseUser({\n        adminConnectUrl,\n        databaseName,\n        username,\n        roleName: `${username}_role`,\n      });\n      return;\n    }\n\n    await adminClient.deleteApplicationDatabaseUser({ adminConnectUrl, username });\n  },\n\n  // No `mintPlatformServiceCredentials` (D-4).\n};\n"]}
+{"version":3,"file":"mongodb-self.infra.module.js","sourceRoot":"","sources":["../../../src/mongodb-self/mongodb-self.infra.module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,OAAO,EAIL,eAAe,EACf,0BAA0B,EAC1B,aAAa,EAGb,+BAA+B,EAC/B,0BAA0B,EAC1B,wBAAwB,GAEzB,MAAM,+BAA+B,CAAC;AAEvC,MAAM,qBAAqB,GAAG,2BAA2B,CAAC;AAC1D,MAAM,qBAAqB,GAAG,2BAA2B,CAAC;AAC1D;;;;;;;GAOG;AACH,MAAM,+BAA+B,GAA0B,CAAC,qBAAqB,EAAE,qBAAqB,CAAC,CAAC;AAG9G,MAAM,0BAA0B,GAAG,2BAA2B,CAAC;AAE/D,MAAM,uBAAuB,GAAG,cAAc,CAAC;AAC/C,MAAM,2BAA2B,GAAG,iBAAiB,CAAC;AAEtD,MAAM,8BAA8B,GAAG,kBAAkB,CAAC;AAE1D;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,oBAA4B;IACxD,OAAO,GAAG,oBAAoB,OAAO,CAAC;AACxC,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,oBAAoB,GAAsB,CAAC,MAAM,CAAC,CAAC;AACzD,MAAM,qBAAqB,GAAsB,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAChF;;;;GAIG;AACH,MAAM,sBAAsB,GAAsB,CAAC,QAAQ,CAAC,CAAC;AAQ7D;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,4BAA4B,CAAC,KAM5C;IACC,MAAM,UAAU,GAAiC,EAAE,CAAC;IACpD,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;QAC/C,UAAU,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,YAAY,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,CAAC,GAAG,oBAAoB,CAAC,EAAE,CAAC,CAAC;IAC5G,CAAC;IACD,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAChD,UAAU,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,YAAY,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,CAAC,GAAG,qBAAqB,CAAC,EAAE,CAAC,CAAC;IAC7G,CAAC;IACD,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,iBAAiB,IAAI,EAAE,EAAE,CAAC;QACvD,UAAU,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,YAAY,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,CAAC,GAAG,sBAAsB,CAAC,EAAE,CAAC,CAAC;IAC9G,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,qBAAqB,CAC5B,eAAuB,EACvB,YAAoB,EACpB,QAAgB,EAChB,QAAgB;IAEhB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IACxC,MAAM,CAAC,QAAQ,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,CAAC,QAAQ,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,CAAC,QAAQ,GAAG,GAAG,GAAG,YAAY,CAAC;IACrC,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,6BAA6B,CACpC,oBAA4B,EAC5B,SAAkD;IAElD,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,IAAI,KAAK,+BAA+B,CAAC,mBAAmB,EAAE,CAAC;QACzF,OAAO,oBAAoB,CAAC,oBAAoB,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,aAAa,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACpG,OAAO,GAAG,oBAAoB,IAAI,SAAS,CAAC,IAAI,IAAI,aAAa,OAAO,CAAC;AAC3E,CAAC;AAED,MAAM,CAAC,MAAM,8BAA8B,GAAwB;IACjE,QAAQ,EAAE,aAAa,CAAC,YAAY;IACpC,qBAAqB,EAAE,CAAC,eAAe,CAAC,iBAAiB,CAAC;IAC1D,2BAA2B,EAAE,+BAA+B;IAE5D,IAAI;QACF,OAAO;YACL,qBAAqB,EAAE,CAAC,SAAS,CAAC;YAClC,YAAY,EAAE,CAAC,0DAA0D,CAAC;YAC1E,aAAa,EAAE;gBACb,OAAO,EAAE,EAAE;gBACX,wDAAwD;gBACxD,qDAAqD;gBACrD,aAAa,EAAE,CAAC,mBAAmB,CAAC;gBACpC,SAAS,EAAE;oBACT,0BAA0B,CAAC,YAAY;oBACvC,0BAA0B,CAAC,SAAS;iBACrC;aACF;YACD,UAAU,EAAE;gBACV,uDAAuD;gBACvD,2DAA2D;gBAC3D,0DAA0D;gBAC1D,2CAA2C;gBAC3C,qBAAqB,EAAE,CAAC,GAAG,+BAA+B,CAAC;aAC5D;SACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,OAAoC;QAEpC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAoC,CAAC;QACjE,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAC,0BAA0B,CAAC,CAAC;QAClE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CACb,qDAAqD;gBACrD,4BAA4B,0BAA0B,KAAK;gBAC3D,4EAA4E,CAC7E,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CACb,qDAAqD;gBACrD,iCAAiC;gBACjC,qDAAqD,CACtD,CAAC;QACJ,CAAC;QACD,MAAM,YAAY,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,uBAAuB,CAAC,CAAC;QAChF,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CACb,qDAAqD;gBACrD,uCAAuC,uBAAuB,KAAK;gBACnE,yDAAyD,CAC1D,CAAC;QACJ,CAAC;QACD,MAAM,eAAe,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,2BAA2B,CAAC,CAAC;QACvF,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACb,qDAAqD;gBACrD,uCAAuC,2BAA2B,KAAK;gBACvE,2DAA2D,CAC5D,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,6BAA6B,CAAC,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAEhG,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS,CAAC,IAAI,KAAK,+BAA+B,CAAC,mBAAmB,EAAE,CAAC;YACxG,uEAAuE;YACvE,uEAAuE;YACvE,kCAAkC;YAClC,EAAE;YACF,uEAAuE;YACvE,0EAA0E;YAC1E,uEAAuE;YACvE,0EAA0E;YAC1E,2CAA2C;YAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;YACtC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CACb,qDAAqD;sBACnD,cAAc,OAAO,CAAC,SAAS,CAAC,IAAI,IAAI,OAAO,CAAC,SAAS,CAAC,IAAI,2BAA2B;sBACzF,0FAA0F;sBAC1F,iGAAiG,CACpG,CAAC;YACJ,CAAC;YACD,MAAM,cAAc,GAAG,0BAA0B,CAAC,MAAM,CAAC,CAAC;YAE1D,MAAM,WAAW,CAAC,kCAAkC,CAAC;gBACnD,eAAe;gBACf,YAAY;gBACZ,QAAQ;gBACR,QAAQ;gBACR,QAAQ,EAAE,GAAG,QAAQ,OAAO;gBAC5B,qEAAqE;gBACrE,qEAAqE;gBACrE,uEAAuE;gBACvE,sEAAsE;gBACtE,4DAA4D;gBAC5D,UAAU,EAAE,4BAA4B,CAAC;oBACvC,YAAY;oBACZ,eAAe,EAAE,wBAAwB,CAAC,cAAc,CAAC,IAAI,CAAC;oBAC9D,gBAAgB,EAAE,wBAAwB,CAAC,cAAc,CAAC,KAAK,CAAC;oBAChE,iBAAiB,EAAE,wBAAwB,CAAC,cAAc,CAAC,MAAM,CAAC;iBACnE,CAAC;aACH,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,yDAAyD;YACzD,kCAAkC;YAClC,MAAM,WAAW,CAAC,6BAA6B,CAAC;gBAC9C,eAAe;gBACf,YAAY;gBACZ,QAAQ;gBACR,QAAQ;aACT,CAAC,CAAC;QACL,CAAC;QAED,+DAA+D;QAC/D,4DAA4D;QAC5D,6CAA6C;QAC7C,MAAM,gBAAgB,GAAG,qBAAqB,CAC5C,eAAe,EACf,YAAY,EACZ,QAAQ,EACR,QAAQ,CACT,CAAC;QAEF,OAAO;YACL,gBAAgB,EAAE;gBAChB,CAAC,qBAAqB,CAAC,EAAE,QAAQ;gBACjC,CAAC,qBAAqB,CAAC,EAAE,QAAQ;aAClC;YACD,gBAAgB,EAAE;gBAChB,CAAC,8BAA8B,CAAC,EAAE,gBAAgB;aACnD;SACF,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,oBAAoB,CAAC,OAAoC;QAC7D,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CACb,uDAAuD;gBACvD,iCAAiC;gBACjC,qDAAqD,CACtD,CAAC;QACJ,CAAC;QACD,MAAM,eAAe,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,2BAA2B,CAAC,CAAC;QACvF,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACb,uDAAuD;gBACvD,uCAAuC,2BAA2B,KAAK;gBACvE,2DAA2D,CAC5D,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAoC,CAAC;QACjE,6EAA6E;QAC7E,6EAA6E;QAC7E,yEAAyE;QACzE,8DAA8D;QAC9D,kDAAkD;QAClD,MAAM,QAAQ,GAAG,6BAA6B,CAAC,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAEhG,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS,CAAC,IAAI,KAAK,+BAA+B,CAAC,mBAAmB,EAAE,CAAC;YACxG,2EAA2E;YAC3E,yEAAyE;YACzE,uCAAuC;YACvC,MAAM,YAAY,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,uBAAuB,CAAC,CAAC;YAChF,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,IAAI,KAAK,CACb,uDAAuD;sBACrD,uCAAuC,uBAAuB,kBAAkB;sBAChF,IAAI,OAAO,CAAC,SAAS,CAAC,IAAI,IAAI,OAAO,CAAC,SAAS,CAAC,IAAI,oCAAoC;sBACxF,wFAAwF,CAC3F,CAAC;YACJ,CAAC;YACD,MAAM,WAAW,CAAC,gCAAgC,CAAC;gBACjD,eAAe;gBACf,YAAY;gBACZ,QAAQ;gBACR,QAAQ,EAAE,GAAG,QAAQ,OAAO;aAC7B,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,MAAM,WAAW,CAAC,6BAA6B,CAAC,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,CAAC;IACjF,CAAC;IAED,6CAA6C;CAC9C,CAAC","sourcesContent":["/**\n * `MongodbSelfInfraProviderModule` — fifth concrete `InfraProviderModule`\n * (Slice 4.B.3 of `infra-provider-planner.md`, generalizing the\n * pattern to self-managed MongoDB).\n *\n * Implements the `MONGODB_SELF` `InfraProvider` over the\n * `IMongoSelfAdminClient` transport (admin-side mongoose connection,\n * exposed by `MongoSelfManagerService` after the Slice 4.B.3 5C\n * policy/transport split). Owns ALL per-app naming policy +\n * URL-derivation policy — the per-app username convention\n * (`<applicationNamespace>_user`, mirroring the Atlas variant) and\n * the per-app SRV URL derivation by swapping admin credentials\n * with per-app credentials in the authored\n * `BASE_MONGO_SERVER_URL`-derived admin connect URL.\n *\n * **What this module reads from `AppCredentialMintingContext`**:\n * - `applicationNamespace` — used as the source for the per-app\n *   username (legacy convention `${ns}_user`).\n * - `secretInputs['database.mongodb.password']` — orchestrator-\n *   supplied password (module is upsert-only, never generator).\n * - `applicationConfigInputs['databaseName']` — required.\n * - `applicationConfigInputs['adminConnectUrl']` — required, the\n *   admin-scoped MongoDB connect URL the orchestrator reads from\n *   `MONGO_CONNECT_URL` env at app-init time.\n * - `adminClient` — narrowed to `IMongoSelfAdminClient`.\n *\n * **Two audiences this module serves:**\n *\n * 1. **Audience-1 (platform-admin)**: cluster-wide Mongo admin\n *    connect URL (`MONGO_CONNECT_URL`). Consumers: `apps-manager`\n *    (mints per-app users via `mintAppCredentials`), `companion`\n *    (mirrors apps-manager admin role for local dev).\n *\n * 2. **Audience-3 (app-scoped, via `mintAppCredentials`)**:\n *    per-customer-app Mongo database user. Result threaded into\n *    `Wildo_Application_Secrets.database.mongodb.{username,password}`\n *    via `_merge_WildoApplicationSecrets`; the per-app connect URL\n *    returned via `runtimeArtifacts.connectionString` for\n *    transient app-init operations.\n *\n * **NOT served (D-4)**: audience-2 not applicable.\n */\n\nimport {\n  AppCredentialMintingContext,\n  AppCredentialMintingResult,\n  IMongoSelfAdminClient,\n  InfraCapability,\n  InfraPlatformAdminConsumer,\n  InfraProvider,\n  InfraProviderModule,\n  InfraProviderPlanContribution,\n  ApplicationRuntimePrincipalKind,\n  deriveMinionDatabaseGrants,\n  resolveGrantStorageNames,\n  type ApplicationRuntimePrincipal,\n} from '@wildo-ai/platform-config-lib';\n\nconst MONGODB_USERNAME_PATH = 'database.mongodb.username';\nconst MONGODB_PASSWORD_PATH = 'database.mongodb.password';\n/**\n * The paths this module mints PER RUNTIME PRINCIPAL — the single source for both consumers.\n *\n * Read by `InfraProviderModule.perPrincipalSecretBlobPaths` (statically, so apps-manager can strip\n * these from the application blob before delivering a principal's own material) AND spread into\n * `appRuntime.perAppSecretBlobPaths` inside `plan()`. Declaring the list twice is how the delivery\n * path would silently stop covering a path this module still mints.\n */\nconst PER_PRINCIPAL_SECRET_BLOB_PATHS: ReadonlyArray<string> = [MONGODB_USERNAME_PATH, MONGODB_PASSWORD_PATH];\n\n\nconst MONGODB_PASSWORD_INPUT_KEY = 'database.mongodb.password';\n\nconst DATABASE_NAME_INPUT_KEY = 'databaseName';\nconst ADMIN_CONNECT_URL_INPUT_KEY = 'adminConnectUrl';\n\nconst CONNECTION_STRING_ARTIFACT_KEY = 'connectionString';\n\n/**\n * Compute the per-app username. Mirrors the Atlas module's\n * convention (`${ns}_user`) so the persistence shape is identical\n * regardless of provider.\n */\nfunction buildMongodbUsername(applicationNamespace: string): string {\n  return `${applicationNamespace}_user`;\n}\n\n/**\n * MongoDB privilege ACTIONS, per grant axis.\n *\n * Named here rather than inlined because these ARE the security semantics: what\n * \"read\" and \"write\" mean once they reach the database. Mongo's action\n * vocabulary is an external one, so it lives at this adapter — the module that\n * speaks Mongo — and never leaks into the platform's grant model.\n *\n * `find` alone for read: no `listCollections`, no `collStats`, nothing that\n * enumerates. A minion granted read on one resource should not be able to\n * discover what else exists.\n *\n * `insert`/`update`/`remove` for write, and deliberately NOT `find`. The\n * platform-level derivation refuses to widen write into read, and re-adding it\n * here would defeat that decision at the last hop — see\n * `deriveMinionResourceGrants`.\n */\nconst MONGODB_READ_ACTIONS: readonly string[] = ['find'];\nconst MONGODB_WRITE_ACTIONS: readonly string[] = ['insert', 'update', 'remove'];\n/**\n * Append-only: `insert` WITHOUT `update` or `remove`, the Mongo counterpart of\n * `GRANT INSERT`. Carries the engine's audit-log floor, where a principal must\n * be able to record what it did and must never be able to unrecord it.\n */\nconst MONGODB_APPEND_ACTIONS: readonly string[] = ['insert'];\n\n/** One `createRole`/`updateRole` privilege entry. */\nexport interface MongodbCollectionPrivilege {\n  readonly resource: { readonly db: string; readonly collection: string };\n  readonly actions: readonly string[];\n}\n\n/**\n * Turn a minion's grants into collection-scoped MongoDB privileges (D14, R1).\n *\n * ## What this deliberately never produces\n *\n * No `dbAdmin` and no `readWrite` — the two roles the application backend\n * currently holds on the whole database. `dbAdmin` is banned outright by D14;\n * `readWrite` is database-WIDE, so granting it to a minion would make every\n * collection reachable regardless of what `resourceAccess` declared, which is\n * the containment this exists to create.\n *\n * No privilege on the database RESOURCE either (`{ db, collection: '' }`), which\n * is Mongo's way of saying \"every collection in this database\". Every entry\n * names one collection explicitly.\n *\n * ## Read and write are separate entries on purpose\n *\n * A collection granted both axes yields TWO privilege entries rather than one\n * merged action list. Mongo unions them identically, but the emitted role then\n * reads back as the declaration that produced it — which is what makes an\n * operator inspecting `db.getRole()` able to check the grant against the config\n * without re-deriving it.\n */\nexport function buildMinionMongodbPrivileges(input: {\n  databaseName: string;\n  readCollections: readonly string[];\n  writeCollections: readonly string[];\n  /** Insert-only — see {@link MONGODB_APPEND_ACTIONS}. Optional so existing pins read unchanged. */\n  appendCollections?: readonly string[];\n}): MongodbCollectionPrivilege[] {\n  const privileges: MongodbCollectionPrivilege[] = [];\n  for (const collection of input.readCollections) {\n    privileges.push({ resource: { db: input.databaseName, collection }, actions: [...MONGODB_READ_ACTIONS] });\n  }\n  for (const collection of input.writeCollections) {\n    privileges.push({ resource: { db: input.databaseName, collection }, actions: [...MONGODB_WRITE_ACTIONS] });\n  }\n  for (const collection of input.appendCollections ?? []) {\n    privileges.push({ resource: { db: input.databaseName, collection }, actions: [...MONGODB_APPEND_ACTIONS] });\n  }\n  return privileges;\n}\n\n/**\n * Derive the per-app connect URL by swapping admin credentials and\n * the database path in the authored `adminConnectUrl`. Mirrors the\n * legacy logic at\n * `wildo-application-lifecycle.service.ts:469-479`:\n *\n *   const parsed = new URL(adminConnectUrl);\n *   parsed.username = perAppUsername;\n *   parsed.password = perAppPassword;\n *   parsed.pathname = '/' + databaseName;\n *\n * URL-encoding handled automatically by the WHATWG URL class.\n */\nfunction buildPerAppConnectUrl(\n  adminConnectUrl: string,\n  databaseName: string,\n  username: string,\n  password: string,\n): string {\n  const parsed = new URL(adminConnectUrl);\n  parsed.username = encodeURIComponent(username);\n  parsed.password = encodeURIComponent(password);\n  parsed.pathname = '/' + databaseName;\n  return parsed.toString();\n}\n\n/**\n * Per-principal Mongo username — the SAME derivation the revoke path must use.\n *\n * The application backend keeps `<namespace>_user` VERBATIM so an existing\n * deployment's user is never orphaned. Third time this shape appears (Redis,\n * RabbitMQ, now Mongo): a revoke deriving it differently deletes the BACKEND's\n * database user while believing it is removing a minion's.\n */\nfunction buildMongodbPrincipalUsername(\n  applicationNamespace: string,\n  principal: ApplicationRuntimePrincipal | undefined,\n): string {\n  if (!principal || principal.kind === ApplicationRuntimePrincipalKind.APPLICATION_BACKEND) {\n    return buildMongodbUsername(applicationNamespace);\n  }\n  const sanitizedName = (principal.name ?? '').replace(/[^a-zA-Z0-9]+/g, '_').replace(/^_+|_+$/g, '');\n  return `${applicationNamespace}_${principal.kind}_${sanitizedName}_user`;\n}\n\nexport const MongodbSelfInfraProviderModule: InfraProviderModule = {\n  provider: InfraProvider.MONGODB_SELF,\n  supportedCapabilities: [InfraCapability.DOCUMENT_DATABASE],\n  perPrincipalSecretBlobPaths: PER_PRINCIPAL_SECRET_BLOB_PATHS,\n\n  plan(): InfraProviderPlanContribution {\n    return {\n      dockerComposeServices: ['mongodb'],\n      k8sResources: ['templates/infra/k8s/internal/mongodb/deployment.yaml.hbs'],\n      platformAdmin: {\n        envVars: {},\n        // The single MONGO_CONNECT_URL secret carries the admin\n        // credentials embedded; legacy field name preserved.\n        secretEnvVars: ['MONGO_CONNECT_URL'],\n        consumers: [\n          InfraPlatformAdminConsumer.APPS_MANAGER,\n          InfraPlatformAdminConsumer.COMPANION,\n        ],\n      },\n      appRuntime: {\n        // Same persistence shape as Atlas — per-app username +\n        // password go into secrets; the host/protocol/options come\n        // from `_merge_WildoApplicationConfig` which derives them\n        // from env-config (BASE_MONGO_SERVER_URL).\n        perAppSecretBlobPaths: [...PER_PRINCIPAL_SECRET_BLOB_PATHS],\n      },\n    };\n  },\n\n  async mintAppCredentials(\n    context: AppCredentialMintingContext,\n  ): Promise<AppCredentialMintingResult> {\n    const adminClient = context.adminClient as IMongoSelfAdminClient;\n    const password = context.secretInputs[MONGODB_PASSWORD_INPUT_KEY];\n    if (!password) {\n      throw new Error(\n        `MongodbSelfInfraProviderModule.mintAppCredentials: ` +\n        `secretInputs is missing '${MONGODB_PASSWORD_INPUT_KEY}'. ` +\n        `The orchestrator MUST supply the Mongo password — modules are upsert-only.`,\n      );\n    }\n    if (!context.applicationNamespace) {\n      throw new Error(\n        `MongodbSelfInfraProviderModule.mintAppCredentials: ` +\n        `applicationNamespace is empty. ` +\n        `The orchestrator MUST supply a non-empty namespace.`,\n      );\n    }\n    const databaseName = context.applicationConfigInputs?.[DATABASE_NAME_INPUT_KEY];\n    if (!databaseName) {\n      throw new Error(\n        `MongodbSelfInfraProviderModule.mintAppCredentials: ` +\n        `applicationConfigInputs is missing '${DATABASE_NAME_INPUT_KEY}'. ` +\n        `The orchestrator MUST supply the per-app database name.`,\n      );\n    }\n    const adminConnectUrl = context.applicationConfigInputs?.[ADMIN_CONNECT_URL_INPUT_KEY];\n    if (!adminConnectUrl) {\n      throw new Error(\n        `MongodbSelfInfraProviderModule.mintAppCredentials: ` +\n        `applicationConfigInputs is missing '${ADMIN_CONNECT_URL_INPUT_KEY}'. ` +\n        `The orchestrator MUST supply the admin Mongo connect URL.`,\n      );\n    }\n\n    const username = buildMongodbPrincipalUsername(context.applicationNamespace, context.principal);\n\n    if (context.principal && context.principal.kind !== ApplicationRuntimePrincipalKind.APPLICATION_BACKEND) {\n      // A named principal gets a COLLECTION-SCOPED user (Step 3 / R1 / D14):\n      // one custom role carrying exactly the privileges its `resourceAccess`\n      // derived, and nothing inherited.\n      //\n      // `resourceGrants` is REQUIRED here and its absence is an error rather\n      // than a default. Falling back to the app-wide upsert would hand a minion\n      // `readWrite` + `dbAdmin` on the whole database — the exact over-grant\n      // this path exists to replace, arriving silently through a code path that\n      // looks like it is doing the narrow thing.\n      const grants = context.resourceGrants;\n      if (!grants) {\n        throw new Error(\n          `MongodbSelfInfraProviderModule.mintAppCredentials: `\n          + `principal '${context.principal.kind}:${context.principal.name}' has no resourceGrants. `\n          + `Refusing to fall back to the database-wide application user — a minion with no declared `\n          + `access must get NO database user at all (D11/R3), which is the orchestrator's decision to make.`,\n        );\n      }\n      const databaseGrants = deriveMinionDatabaseGrants(grants);\n\n      await adminClient.upsertCollectionScopedDatabaseUser({\n        adminConnectUrl,\n        databaseName,\n        username,\n        password,\n        roleName: `${username}_role`,\n        // Resource types → collection names HERE, at the adapter that speaks\n        // Mongo. The grant contract itself stays in the platform vocabulary.\n        // Authored declaration + the engine floor, through the SAME derivation\n        // the PostgreSQL adapter uses — so the two cannot disagree about what\n        // the framework itself requires of every runtime principal.\n        privileges: buildMinionMongodbPrivileges({\n          databaseName,\n          readCollections: resolveGrantStorageNames(databaseGrants.read),\n          writeCollections: resolveGrantStorageNames(databaseGrants.write),\n          appendCollections: resolveGrantStorageNames(databaseGrants.append),\n        }),\n      });\n    } else {\n      // createUser-or-updateUser over an admin-scoped mongoose\n      // connection — idempotent upsert.\n      await adminClient.upsertApplicationDatabaseUser({\n        adminConnectUrl,\n        databaseName,\n        username,\n        password,\n      });\n    }\n\n    // Derive the per-app SRV URL by swapping credentials + db path\n    // in the authored admin URL. The orchestrator uses this for\n    // transient app-init seeding; not persisted.\n    const connectionString = buildPerAppConnectUrl(\n      adminConnectUrl,\n      databaseName,\n      username,\n      password,\n    );\n\n    return {\n      secretBlobValues: {\n        [MONGODB_USERNAME_PATH]: username,\n        [MONGODB_PASSWORD_PATH]: password,\n      },\n      runtimeArtifacts: {\n        [CONNECTION_STRING_ARTIFACT_KEY]: connectionString,\n      },\n    };\n  },\n\n  /**\n   * Tear down the per-app Mongo database user.\n   *\n   * **Caller status**: no caller wires this in Slices 1–4.B.3.\n   * Forward-compat seam.\n   */\n  async revokeAppCredentials(context: AppCredentialMintingContext): Promise<void> {\n    if (!context.applicationNamespace) {\n      throw new Error(\n        `MongodbSelfInfraProviderModule.revokeAppCredentials: ` +\n        `applicationNamespace is empty. ` +\n        `The orchestrator MUST supply a non-empty namespace.`,\n      );\n    }\n    const adminConnectUrl = context.applicationConfigInputs?.[ADMIN_CONNECT_URL_INPUT_KEY];\n    if (!adminConnectUrl) {\n      throw new Error(\n        `MongodbSelfInfraProviderModule.revokeAppCredentials: ` +\n        `applicationConfigInputs is missing '${ADMIN_CONNECT_URL_INPUT_KEY}'. ` +\n        `The orchestrator MUST supply the admin Mongo connect URL.`,\n      );\n    }\n    const adminClient = context.adminClient as IMongoSelfAdminClient;\n    // Derived through the SAME function the mint uses. Deriving it independently\n    // here — which is what this line did before named principals existed — meant\n    // revoking a minion left its credential live AND dropped the APPLICATION\n    // BACKEND's database user, because the backend's name is what\n    // `buildMongodbUsername` returns for every input.\n    const username = buildMongodbPrincipalUsername(context.applicationNamespace, context.principal);\n\n    if (context.principal && context.principal.kind !== ApplicationRuntimePrincipalKind.APPLICATION_BACKEND) {\n      // A scoped principal owns a user AND a custom role. Routing it through the\n      // user-only door would leave a privileged role behind that the next mint\n      // adopts without anybody declaring it.\n      const databaseName = context.applicationConfigInputs?.[DATABASE_NAME_INPUT_KEY];\n      if (!databaseName) {\n        throw new Error(\n          `MongodbSelfInfraProviderModule.revokeAppCredentials: `\n          + `applicationConfigInputs is missing '${DATABASE_NAME_INPUT_KEY}' for principal `\n          + `'${context.principal.kind}:${context.principal.name}'. The role to drop lives IN that `\n          + `database — revoking without it would drop the user and silently orphan its privileges.`,\n        );\n      }\n      await adminClient.dropCollectionScopedDatabaseUser({\n        adminConnectUrl,\n        databaseName,\n        username,\n        roleName: `${username}_role`,\n      });\n      return;\n    }\n\n    await adminClient.deleteApplicationDatabaseUser({ adminConnectUrl, username });\n  },\n\n  // No `mintPlatformServiceCredentials` (D-4).\n};\n"]}

package/dist/esm/postgres-self/postgres-self.infra.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"postgres-self.infra.module.d.ts","sourceRoot":"","sources":["../../../../src/postgres-self/postgres-self.infra.module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkEG;AAEH,OAAO,EAOL,mBAAmB,EAKpB,MAAM,+BAA+B,CAAC;AA6HvC,eAAO,MAAM,+BAA+B,EAAE,mBA2K7C,CAAC"}
+{"version":3,"file":"postgres-self.infra.module.d.ts","sourceRoot":"","sources":["../../../src/postgres-self/postgres-self.infra.module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkEG;AAEH,OAAO,EAOL,mBAAmB,EAMpB,MAAM,+BAA+B,CAAC;AA6HvC,eAAO,MAAM,+BAA+B,EAAE,mBAqL7C,CAAC"}

package/dist/esm/postgres-self/postgres-self.infra.module.js

@@ -65,7 +65,7 @@
  * (no app-deletion ceremony today — F6 of plan review 2026-05-06).
  * Method ships as a forward-compat seam.
  */
-import { InfraCapability, InfraPlatformAdminConsumer, InfraProvider, ApplicationRuntimePrincipalKind, resolveGrantStorageNames, } from '@wildo-ai/platform-config-lib';
+import { InfraCapability, InfraPlatformAdminConsumer, InfraProvider, ApplicationRuntimePrincipalKind, deriveMinionDatabaseGrants, resolveGrantStorageNames, } from '@wildo-ai/platform-config-lib';
 /**
  * Default Postgres port (matches `INFRA_DEFAULT_PORTS.POSTGRES` in
  * the shared platform constants — duplicated as a literal because
@@ -248,6 +248,12 @@ export const PostgresSelfInfraProviderModule = {
                     + `Refusing to fall back to the database-wide application role — a minion with no declared `
                     + `access must get NO database role at all (D11/R3), which is the orchestrator's decision to make.`);
             }
+            // The authored declaration plus the engine's own floor — the reads and
+            // appends the framework performs for ANY principal, which no
+            // `resourceAccess` can express and none should have to. Applied through
+            // the shared derivation so this adapter and the Mongo one cannot disagree
+            // about what that floor is.
+            const databaseGrants = deriveMinionDatabaseGrants(grants);
             const { connectionUrl: principalConnectionUrl } = await adminClient.upsertTableScopedDatabaseRole({
                 databaseName,
                 username,
@@ -257,8 +263,11 @@ export const PostgresSelfInfraProviderModule = {
                 // Postgres. The grant contract itself stays in the platform vocabulary,
                 // and passes through the SAME translation Mongo uses, so the two
                 // adapters cannot disagree about which rows a resource type addresses.
-                readTables: resolveGrantStorageNames(grants.read),
-                writeTables: resolveGrantStorageNames(grants.write),
+                // SQL identifier casing is applied by the manager, which is the one site
+                // that issues the DDL and runs the existence check those names must match.
+                readTables: resolveGrantStorageNames(databaseGrants.read),
+                writeTables: resolveGrantStorageNames(databaseGrants.write),
+                appendTables: resolveGrantStorageNames(databaseGrants.append),
             });
             return {
                 secretBlobValues: {

package/dist/esm/postgres-self/postgres-self.infra.module.js.map

@@ -1 +1 @@
-{"version":3,"file":"postgres-self.infra.module.js","sourceRoot":"","sources":["../../../../src/postgres-self/postgres-self.infra.module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkEG;AAEH,OAAO,EAIL,eAAe,EACf,0BAA0B,EAC1B,aAAa,EAIb,+BAA+B,EAC/B,wBAAwB,GACzB,MAAM,+BAA+B,CAAC;AAEvC;;;;;GAKG;AACH,MAAM,qBAAqB,GAAG,IAAI,CAAC;AAEnC;;;;;;;;;;;GAWG;AACH,MAAM,2BAA2B,GAAG,kCAAkC,CAAC;AACvE,MAAM,sBAAsB,GAAG,8BAA8B,CAAC;AAC9D,MAAM,yBAAyB,GAAG,gCAAgC,CAAC;AACnE;;;;;;;GAOG;AACH,MAAM,+BAA+B,GAA0B;IAC7D,2BAA2B;IAC3B,sBAAsB;IACtB,yBAAyB;CAC1B,CAAC;AAGF;;;GAGG;AACH,MAAM,2BAA2B,GAAG,8BAA8B,CAAC;AAEnE;;;;GAIG;AACH,MAAM,gCAAgC,GAAG,cAAc,CAAC;AAExD;;;;;;;;;;;;;GAaG;AACH,SAAS,mBAAmB,CAAC,KAAa;IACxC,OAAO,KAAK;SACT,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;SACrB,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACtB,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,OAAe;IACxC,OAAO,SAAS,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAAC;AACjD,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,OAAe;IACpC,OAAO,SAAS,mBAAmB,CAAC,OAAO,CAAC,OAAO,CAAC;AACtD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,2BAA2B,GAAG,QAAQ,CAAC;AAE7C;;;;;;;;;GASG;AACH,SAAS,8BAA8B,CACrC,OAAe,EACf,SAAkD;IAElD,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,IAAI,KAAK,+BAA+B,CAAC,mBAAmB,EAAE,CAAC;QACzF,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,SAAS,mBAAmB,CAAC,OAAO,CAAC,IAAI,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG;UAClF,GAAG,mBAAmB,CAAC,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC,OAAO,CAAC;AAC1D,CAAC;AAED,MAAM,CAAC,MAAM,+BAA+B,GAAwB;IAClE,QAAQ,EAAE,aAAa,CAAC,aAAa;IACrC,qBAAqB,EAAE,CAAC,eAAe,CAAC,mBAAmB,CAAC;IAC5D,2BAA2B,EAAE,+BAA+B;IAE5D,IAAI;QACF,OAAO;YACL,qBAAqB,EAAE,CAAC,UAAU,CAAC;YACnC,YAAY,EAAE,CAAC,2DAA2D,CAAC;YAC3E,aAAa,EAAE;gBACb,OAAO,EAAE;oBACP,OAAO,EAAE,UAAU;oBACnB,OAAO,EAAE,MAAM,CAAC,qBAAqB,CAAC;iBACvC;gBACD,4DAA4D;gBAC5D,4DAA4D;gBAC5D,uDAAuD;gBACvD,2DAA2D;gBAC3D,aAAa,EAAE,CAAC,eAAe,EAAE,mBAAmB,CAAC;gBACrD,mDAAmD;gBACnD,yDAAyD;gBACzD,SAAS,EAAE;oBACT,0BAA0B,CAAC,YAAY;oBACvC,0BAA0B,CAAC,SAAS;iBACrC;aACF;YACD,UAAU,EAAE;gBACV,wDAAwD;gBACxD,2DAA2D;gBAC3D,mCAAmC;gBACnC,qBAAqB,EAAE;oBACrB,0BAA0B,EAAE,UAAU;oBACtC,0BAA0B,EAAE,qBAAqB;iBAClD;gBACD,qBAAqB,EAAE,CAAC,GAAG,+BAA+B,CAAC;aAC5D;SACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,OAAoC;QAEpC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAmC,CAAC;QAChE,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAC,2BAA2B,CAAC,CAAC;QACnE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CACb,sDAAsD;gBACtD,4BAA4B,2BAA2B,KAAK;gBAC5D,+EAA+E,CAChF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACb,sDAAsD;gBACtD,oBAAoB;gBACpB,gDAAgD,CACjD,CAAC;QACJ,CAAC;QAED,gEAAgE;QAChE,gEAAgE;QAChE,MAAM,YAAY,GAChB,OAAO,CAAC,uBAAuB,EAAE,CAAC,gCAAgC,CAAC;eAChE,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,8BAA8B,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAEpF,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS,CAAC,IAAI,KAAK,+BAA+B,CAAC,mBAAmB,EAAE,CAAC;YACxG,0EAA0E;YAC1E,qEAAqE;YACrE,wDAAwD;YACxD,EAAE;YACF,yEAAyE;YACzE,yEAAyE;YACzE,yEAAyE;YACzE,uEAAuE;YACvE,6DAA6D;YAC7D,MAAM,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;YACtC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CACb,sDAAsD;sBACpD,cAAc,OAAO,CAAC,SAAS,CAAC,IAAI,IAAI,OAAO,CAAC,SAAS,CAAC,IAAI,2BAA2B;sBACzF,0FAA0F;sBAC1F,iGAAiG,CACpG,CAAC;YACJ,CAAC;YACD,MAAM,EAAE,aAAa,EAAE,sBAAsB,EAAE,GAAG,MAAM,WAAW,CAAC,6BAA6B,CAAC;gBAChG,YAAY;gBACZ,QAAQ;gBACR,QAAQ;gBACR,UAAU,EAAE,2BAA2B;gBACvC,gEAAgE;gBAChE,wEAAwE;gBACxE,iEAAiE;gBACjE,uEAAuE;gBACvE,UAAU,EAAE,wBAAwB,CAAC,MAAM,CAAC,IAAI,CAAC;gBACjD,WAAW,EAAE,wBAAwB,CAAC,MAAM,CAAC,KAAK,CAAC;aACpD,CAAC,CAAC;YAEH,OAAO;gBACL,gBAAgB,EAAE;oBAChB,CAAC,2BAA2B,CAAC,EAAE,YAAY;oBAC3C,CAAC,sBAAsB,CAAC,EAAE,QAAQ;oBAClC,CAAC,yBAAyB,CAAC,EAAE,sBAAsB;iBACpD;aACF,CAAC;QACJ,CAAC;QAED,+DAA+D;QAC/D,8DAA8D;QAC9D,kBAAkB;QAClB,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,WAAW,CAAC,yBAAyB,CAAC;YACpE,YAAY;YACZ,QAAQ;YACR,QAAQ;SACT,CAAC,CAAC;QAEH,OAAO;YACL,gBAAgB,EAAE;gBAChB,CAAC,2BAA2B,CAAC,EAAE,YAAY;gBAC3C,CAAC,sBAAsB,CAAC,EAAE,QAAQ;gBAClC,CAAC,yBAAyB,CAAC,EAAE,aAAa;aAC3C;SACF,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,oBAAoB,CAAC,OAAoC;QAC7D,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACb,wDAAwD;gBACxD,oBAAoB;gBACpB,gDAAgD,CACjD,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAmC,CAAC;QAChE,MAAM,YAAY,GAChB,OAAO,CAAC,uBAAuB,EAAE,CAAC,gCAAgC,CAAC;eAChE,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,8BAA8B,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAEpF,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS,CAAC,IAAI,KAAK,+BAA+B,CAAC,mBAAmB,EAAE,CAAC;YACxG,sEAAsE;YACtE,yEAAyE;YACzE,mEAAmE;YACnE,iDAAiD;YACjD,MAAM,WAAW,CAAC,2BAA2B,CAAC;gBAC5C,YAAY;gBACZ,QAAQ;gBACR,UAAU,EAAE,2BAA2B;aACxC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,MAAM,WAAW,CAAC,uBAAuB,CAAC,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC,CAAC;IACxE,CAAC;IAED,0DAA0D;IAC1D,qDAAqD;CACtD,CAAC","sourcesContent":["/**\n * `PostgresSelfInfraProviderModule` — third concrete `InfraProviderModule`\n * (Slice 4.B.2 of `infra-provider-planner.md`, generalizing the\n * Slice 2 / 4.B.1 pattern).\n *\n * Implements the `POSTGRES_SELF` `InfraProvider` over the\n * `IPostgresAdminClient` transport (raw `pg` Pool against the\n * Postgres admin connection, exposed by\n * `PostgreSQLConnectionManagerService` after the Slice 4.B.2 5C\n * policy/transport split). Owns ALL per-app naming policy — the\n * per-app database-name + role-name conventions (`wildo_<sanitized>_user`,\n * `wildo_<sanitized>` mirroring the legacy\n * `PlatformInfrastructureManagerService.provisionPostgreSQLDatabase`).\n *\n * **What this module reads from `AppCredentialMintingContext`**:\n * - `appSlug` — used as the source for the sanitized database +\n *   user name. Mirrors the legacy convention at\n *   `platform-infrastructure-manager.service.ts:300-302`\n *   (`sanitizedName = sanitizeForPostgreSQL(applicationName)`,\n *   `databaseName = wildo_${sanitizedName}`,\n *   `username = wildo_${sanitizedName}_user`).\n * - `secretInputs['database.postgresql.password']` — orchestrator-\n *   supplied password (module is upsert-only, never generator).\n * - `applicationConfigInputs?.['databaseName']` — optional override\n *   for the derived database name. Mirrors the legacy\n *   `provisionPostgreSQLDatabase(appSlug, { databaseName? })` arg.\n * - `adminClient` — narrowed to `IPostgresAdminClient`.\n *\n * **What this module IGNORES from the context** (Slice 4.A.2 / M4\n * forward-compat documentation):\n * - `applicationNamespace` — Postgres per-app DB names use the\n *   slug-derived sanitized form (env-suffix isolation comes from\n *   the surrounding env-scoped admin connection). Future modules\n *   may switch to namespace-scoped naming if cross-env collision\n *   risk surfaces.\n * - `wildoApplicationId` — Postgres role names embed the\n *   sanitized slug, NOT the application id. This is the legacy\n *   convention; preserved for back-compat with apps already\n *   provisioned.\n *\n * **Two audiences this module serves:**\n *\n * 1. **Audience-1 (platform-admin, declared via `plan().platformAdmin`)**:\n *    cluster-wide Postgres admin creds. Consumers: `apps-manager`\n *    (mints per-app DB+role via `mintAppCredentials`), `companion`\n *    (mirrors apps-manager admin role for local dev).\n *\n * 2. **Audience-3 (app-scoped, via `plan().appRuntime` +\n *    `mintAppCredentials`)**: per-customer-app Postgres database +\n *    role. Result threaded into\n *    `Wildo_Application_Secrets.database.postgresql.{\n *    databaseName, username, connectUrl}` via\n *    `_merge_WildoApplicationSecrets`. Note: the password is\n *    embedded in `connectUrl` — there is no separate\n *    `database.postgresql.password` blob path today (matches the\n *    legacy persistence shape at\n *    `wildo-application-lifecycle.service.ts:2191-2200`).\n *\n * **NOT served (D-4 of Slice 4.B locked decisions, 2026-05-10)**:\n * - **Audience-2 (platform-service-scoped)**: no platform service\n *   uses Postgres for inter-service messaging today. Method omitted.\n *\n * **`revokeAppCredentials`**: declared and tested, but the integration\n * call site does NOT exist in `wildo-application-lifecycle.service.ts`\n * (no app-deletion ceremony today — F6 of plan review 2026-05-06).\n * Method ships as a forward-compat seam.\n */\n\nimport {\n  AppCredentialMintingContext,\n  AppCredentialMintingResult,\n  IPostgresAdminClient,\n  InfraCapability,\n  InfraPlatformAdminConsumer,\n  InfraProvider,\n  InfraProviderModule,\n  InfraProviderPlanContribution,\n  ApplicationRuntimePrincipal,\n  ApplicationRuntimePrincipalKind,\n  resolveGrantStorageNames,\n} from '@wildo-ai/platform-config-lib';\n\n/**\n * Default Postgres port (matches `INFRA_DEFAULT_PORTS.POSTGRES` in\n * the shared platform constants — duplicated as a literal because\n * the planner output is consumed by the CLI which materializes it\n * into `Wildo_Application_Config` blob paths).\n */\nconst DEFAULT_POSTGRES_PORT = 5432;\n\n/**\n * The `Wildo_Application_Secrets` JSON paths this module writes\n * through `mintAppCredentials`. Declared once and reused as\n * `appRuntime.perAppSecretBlobPaths` in `plan()` AND as the keys of\n * `secretBlobValues` in the result, so a refactor that renames a\n * path fails loudly at one place.\n *\n * Note: the password is embedded in `connectUrl` (Postgres\n * convention); there is no separate `database.postgresql.password`\n * blob path today. The orchestrator persists `connectUrl`\n * verbatim into `Wildo_Application_Secrets`.\n */\nconst POSTGRES_DATABASE_NAME_PATH = 'database.postgresql.databaseName';\nconst POSTGRES_USERNAME_PATH = 'database.postgresql.username';\nconst POSTGRES_CONNECT_URL_PATH = 'database.postgresql.connectUrl';\n/**\n * The paths this module mints PER RUNTIME PRINCIPAL — the single source for both consumers.\n *\n * Read by `InfraProviderModule.perPrincipalSecretBlobPaths` (statically, so apps-manager can strip\n * these from the application blob before delivering a principal's own material) AND spread into\n * `appRuntime.perAppSecretBlobPaths` inside `plan()`. Declaring the list twice is how the delivery\n * path would silently stop covering a path this module still mints.\n */\nconst PER_PRINCIPAL_SECRET_BLOB_PATHS: ReadonlyArray<string> = [\n  POSTGRES_DATABASE_NAME_PATH,\n  POSTGRES_USERNAME_PATH,\n  POSTGRES_CONNECT_URL_PATH,\n];\n\n\n/**\n * Key the module looks for in `secretInputs` to read the\n * orchestrator-supplied password.\n */\nconst POSTGRES_PASSWORD_INPUT_KEY = 'database.postgresql.password';\n\n/**\n * Optional key the module looks for in `applicationConfigInputs`\n * for an authored database-name override. When omitted, the module\n * derives the database name from `appSlug` via `sanitizeForPostgreSQL`.\n */\nconst POSTGRES_DATABASE_NAME_INPUT_KEY = 'databaseName';\n\n/**\n * Sanitize an application slug for Postgres identifier rules.\n * Mirrors the legacy `sanitizeForPostgreSQL` at\n * `platform-infrastructure-manager.service.ts:371-378`:\n * - lowercase\n * - `[^a-z0-9_]` → `_`\n * - collapse multiple `_`\n * - strip leading/trailing `_`\n * - cap at 50 chars (Postgres identifier limit is 63; leaves room\n *   for the `wildo_` prefix and `_user` suffix).\n *\n * Centralized here so the module owns the convention; if the cap\n * or escape rules change, one site changes.\n */\nfunction sanitizeForPostgres(value: string): string {\n  return value\n    .toLowerCase()\n    .replace(/[^a-z0-9_]/g, '_')\n    .replace(/_+/g, '_')\n    .replace(/^_|_$/g, '')\n    .substring(0, 50);\n}\n\n/**\n * Compute the per-app database name. Mirrors legacy convention at\n * `platform-infrastructure-manager.service.ts:301`:\n *   `wildo_<sanitized>`\n */\nfunction buildDatabaseName(appSlug: string): string {\n  return `wildo_${sanitizeForPostgres(appSlug)}`;\n}\n\n/**\n * Compute the per-app database role. Mirrors legacy convention at\n * `platform-infrastructure-manager.service.ts:302`:\n *   `wildo_<sanitized>_user`\n */\nfunction buildUsername(appSlug: string): string {\n  return `wildo_${sanitizeForPostgres(appSlug)}_user`;\n}\n\n/**\n * The schema a per-app database's resource tables live in.\n *\n * `public` is what the schema planner targets today. Named as a constant rather\n * than inlined at the four sites that need it because a grant issued into one\n * schema and revoked from another is a revocation that silently succeeds while\n * narrowing nothing.\n */\nconst POSTGRES_APPLICATION_SCHEMA = 'public';\n\n/**\n * Per-principal Postgres role name — the SAME derivation the revoke path uses.\n *\n * Fourth time this shape appears (Redis, RabbitMQ, Mongo, now Postgres), and the\n * consequence is worse here than anywhere else: a revoke that derived the name\n * differently would miss the minion's role AND, on the pre-existing\n * `dropApplicationDatabase` path, take the application's entire database with\n * it. The application backend keeps `wildo_<slug>_user` VERBATIM so an existing\n * deployment's owner role is never orphaned.\n */\nfunction buildPostgresPrincipalUsername(\n  appSlug: string,\n  principal: ApplicationRuntimePrincipal | undefined,\n): string {\n  if (!principal || principal.kind === ApplicationRuntimePrincipalKind.APPLICATION_BACKEND) {\n    return buildUsername(appSlug);\n  }\n  return `wildo_${sanitizeForPostgres(appSlug)}_${sanitizeForPostgres(principal.kind)}_`\n    + `${sanitizeForPostgres(principal.name ?? '')}_user`;\n}\n\nexport const PostgresSelfInfraProviderModule: InfraProviderModule = {\n  provider: InfraProvider.POSTGRES_SELF,\n  supportedCapabilities: [InfraCapability.RELATIONAL_DATABASE],\n  perPrincipalSecretBlobPaths: PER_PRINCIPAL_SECRET_BLOB_PATHS,\n\n  plan(): InfraProviderPlanContribution {\n    return {\n      dockerComposeServices: ['postgres'],\n      k8sResources: ['templates/infra/k8s/internal/postgres/deployment.yaml.hbs'],\n      platformAdmin: {\n        envVars: {\n          PG_HOST: 'postgres',\n          PG_PORT: String(DEFAULT_POSTGRES_PORT),\n        },\n        // Admin user + password to provision per-app DBs/roles. The\n        // legacy admin-init code reads these from `PG_ADMIN_USER` /\n        // `PG_ADMIN_PASSWORD`; the planner emits the keys, the\n        // CLI's `env-vars-builder` writes the values at sync time.\n        secretEnvVars: ['PG_ADMIN_USER', 'PG_ADMIN_PASSWORD'],\n        // Audience-1 only (DB-admin access). No audience-2\n        // platform-service-scoped Postgres use case today (D-4).\n        consumers: [\n          InfraPlatformAdminConsumer.APPS_MANAGER,\n          InfraPlatformAdminConsumer.COMPANION,\n        ],\n      },\n      appRuntime: {\n        // Static topology — same for every app in this env. The\n        // per-app values (databaseName, username, connectUrl) flow\n        // through `perAppSecretBlobPaths`.\n        perAppConfigBlobPaths: {\n          'database.postgresql.host': 'postgres',\n          'database.postgresql.port': DEFAULT_POSTGRES_PORT,\n        },\n        perAppSecretBlobPaths: [...PER_PRINCIPAL_SECRET_BLOB_PATHS],\n      },\n    };\n  },\n\n  async mintAppCredentials(\n    context: AppCredentialMintingContext,\n  ): Promise<AppCredentialMintingResult> {\n    const adminClient = context.adminClient as IPostgresAdminClient;\n    const password = context.secretInputs[POSTGRES_PASSWORD_INPUT_KEY];\n    if (!password) {\n      throw new Error(\n        `PostgresSelfInfraProviderModule.mintAppCredentials: ` +\n        `secretInputs is missing '${POSTGRES_PASSWORD_INPUT_KEY}'. ` +\n        `The orchestrator MUST supply the Postgres password — modules are upsert-only.`,\n      );\n    }\n    if (!context.appSlug) {\n      throw new Error(\n        `PostgresSelfInfraProviderModule.mintAppCredentials: ` +\n        `appSlug is empty. ` +\n        `The orchestrator MUST supply a non-empty slug.`,\n      );\n    }\n\n    // Allow operator override of the derived database name. Without\n    // an override, derive from `appSlug` via the legacy convention.\n    const databaseName =\n      context.applicationConfigInputs?.[POSTGRES_DATABASE_NAME_INPUT_KEY]\n      || buildDatabaseName(context.appSlug);\n    const username = buildPostgresPrincipalUsername(context.appSlug, context.principal);\n\n    if (context.principal && context.principal.kind !== ApplicationRuntimePrincipalKind.APPLICATION_BACKEND) {\n      // A named principal gets a TABLE-SCOPED role (Step 3 / R1 / D14): exactly\n      // the verbs its `resourceAccess` derived, on exactly the tables that\n      // declaration names, inside a database it does not own.\n      //\n      // `resourceGrants` is REQUIRED and its absence is an error rather than a\n      // default. Falling through to `upsertApplicationDatabase` would make the\n      // minion the OWNER of the application's database with `ALL PRIVILEGES` —\n      // the exact over-grant this path replaces, arriving silently through a\n      // code path that reads as if it were doing the narrow thing.\n      const grants = context.resourceGrants;\n      if (!grants) {\n        throw new Error(\n          `PostgresSelfInfraProviderModule.mintAppCredentials: `\n          + `principal '${context.principal.kind}:${context.principal.name}' has no resourceGrants. `\n          + `Refusing to fall back to the database-wide application role — a minion with no declared `\n          + `access must get NO database role at all (D11/R3), which is the orchestrator's decision to make.`,\n        );\n      }\n      const { connectionUrl: principalConnectionUrl } = await adminClient.upsertTableScopedDatabaseRole({\n        databaseName,\n        username,\n        password,\n        schemaName: POSTGRES_APPLICATION_SCHEMA,\n        // Resource types → table names HERE, at the adapter that speaks\n        // Postgres. The grant contract itself stays in the platform vocabulary,\n        // and passes through the SAME translation Mongo uses, so the two\n        // adapters cannot disagree about which rows a resource type addresses.\n        readTables: resolveGrantStorageNames(grants.read),\n        writeTables: resolveGrantStorageNames(grants.write),\n      });\n\n      return {\n        secretBlobValues: {\n          [POSTGRES_DATABASE_NAME_PATH]: databaseName,\n          [POSTGRES_USERNAME_PATH]: username,\n          [POSTGRES_CONNECT_URL_PATH]: principalConnectionUrl,\n        },\n      };\n    }\n\n    // CREATE/ALTER USER + CREATE DATABASE — idempotent upsert. The\n    // admin-client reapplies privileges every time so the call is\n    // safe to repeat.\n    const { connectionUrl } = await adminClient.upsertApplicationDatabase({\n      databaseName,\n      username,\n      password,\n    });\n\n    return {\n      secretBlobValues: {\n        [POSTGRES_DATABASE_NAME_PATH]: databaseName,\n        [POSTGRES_USERNAME_PATH]: username,\n        [POSTGRES_CONNECT_URL_PATH]: connectionUrl,\n      },\n    };\n  },\n\n  /**\n   * Tear down the per-app Postgres database + role. Idempotent: the\n   * underlying admin client treats missing DB / missing user as\n   * no-ops.\n   *\n   * **Caller status** (F6 of 2026-05-06 plan review): no caller\n   * wires this in Slices 1–4.B.2. Method ships as a forward-compat\n   * seam for whichever future slice designs the app-deletion\n   * lifecycle.\n   *\n   * **Defensive validation** (Slice 4.A.2 / L4 pattern): empty\n   * `appSlug` would derive an empty database name; we fail-loud\n   * instead so a bad caller surfaces immediately.\n   */\n  async revokeAppCredentials(context: AppCredentialMintingContext): Promise<void> {\n    if (!context.appSlug) {\n      throw new Error(\n        `PostgresSelfInfraProviderModule.revokeAppCredentials: ` +\n        `appSlug is empty. ` +\n        `The orchestrator MUST supply a non-empty slug.`,\n      );\n    }\n    const adminClient = context.adminClient as IPostgresAdminClient;\n    const databaseName =\n      context.applicationConfigInputs?.[POSTGRES_DATABASE_NAME_INPUT_KEY]\n      || buildDatabaseName(context.appSlug);\n    const username = buildPostgresPrincipalUsername(context.appSlug, context.principal);\n\n    if (context.principal && context.principal.kind !== ApplicationRuntimePrincipalKind.APPLICATION_BACKEND) {\n      // A named principal owns NOTHING but its own role. Routing it through\n      // `dropApplicationDatabase` — which is what this method did before named\n      // principals existed — would DROP THE APPLICATION'S DATABASE while\n      // believing it was retiring one minion's access.\n      await adminClient.dropTableScopedDatabaseRole({\n        databaseName,\n        username,\n        schemaName: POSTGRES_APPLICATION_SCHEMA,\n      });\n      return;\n    }\n\n    await adminClient.dropApplicationDatabase({ databaseName, username });\n  },\n\n  // No `mintPlatformServiceCredentials` (D-4 of Slice 4.B —\n  // audience-2 not applicable to Postgres_Self today).\n};\n"]}
+{"version":3,"file":"postgres-self.infra.module.js","sourceRoot":"","sources":["../../../src/postgres-self/postgres-self.infra.module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkEG;AAEH,OAAO,EAIL,eAAe,EACf,0BAA0B,EAC1B,aAAa,EAIb,+BAA+B,EAC/B,0BAA0B,EAC1B,wBAAwB,GACzB,MAAM,+BAA+B,CAAC;AAEvC;;;;;GAKG;AACH,MAAM,qBAAqB,GAAG,IAAI,CAAC;AAEnC;;;;;;;;;;;GAWG;AACH,MAAM,2BAA2B,GAAG,kCAAkC,CAAC;AACvE,MAAM,sBAAsB,GAAG,8BAA8B,CAAC;AAC9D,MAAM,yBAAyB,GAAG,gCAAgC,CAAC;AACnE;;;;;;;GAOG;AACH,MAAM,+BAA+B,GAA0B;IAC7D,2BAA2B;IAC3B,sBAAsB;IACtB,yBAAyB;CAC1B,CAAC;AAGF;;;GAGG;AACH,MAAM,2BAA2B,GAAG,8BAA8B,CAAC;AAEnE;;;;GAIG;AACH,MAAM,gCAAgC,GAAG,cAAc,CAAC;AAExD;;;;;;;;;;;;;GAaG;AACH,SAAS,mBAAmB,CAAC,KAAa;IACxC,OAAO,KAAK;SACT,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;SACrB,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACtB,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,OAAe;IACxC,OAAO,SAAS,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAAC;AACjD,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,OAAe;IACpC,OAAO,SAAS,mBAAmB,CAAC,OAAO,CAAC,OAAO,CAAC;AACtD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,2BAA2B,GAAG,QAAQ,CAAC;AAE7C;;;;;;;;;GASG;AACH,SAAS,8BAA8B,CACrC,OAAe,EACf,SAAkD;IAElD,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,IAAI,KAAK,+BAA+B,CAAC,mBAAmB,EAAE,CAAC;QACzF,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,SAAS,mBAAmB,CAAC,OAAO,CAAC,IAAI,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG;UAClF,GAAG,mBAAmB,CAAC,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC,OAAO,CAAC;AAC1D,CAAC;AAED,MAAM,CAAC,MAAM,+BAA+B,GAAwB;IAClE,QAAQ,EAAE,aAAa,CAAC,aAAa;IACrC,qBAAqB,EAAE,CAAC,eAAe,CAAC,mBAAmB,CAAC;IAC5D,2BAA2B,EAAE,+BAA+B;IAE5D,IAAI;QACF,OAAO;YACL,qBAAqB,EAAE,CAAC,UAAU,CAAC;YACnC,YAAY,EAAE,CAAC,2DAA2D,CAAC;YAC3E,aAAa,EAAE;gBACb,OAAO,EAAE;oBACP,OAAO,EAAE,UAAU;oBACnB,OAAO,EAAE,MAAM,CAAC,qBAAqB,CAAC;iBACvC;gBACD,4DAA4D;gBAC5D,4DAA4D;gBAC5D,uDAAuD;gBACvD,2DAA2D;gBAC3D,aAAa,EAAE,CAAC,eAAe,EAAE,mBAAmB,CAAC;gBACrD,mDAAmD;gBACnD,yDAAyD;gBACzD,SAAS,EAAE;oBACT,0BAA0B,CAAC,YAAY;oBACvC,0BAA0B,CAAC,SAAS;iBACrC;aACF;YACD,UAAU,EAAE;gBACV,wDAAwD;gBACxD,2DAA2D;gBAC3D,mCAAmC;gBACnC,qBAAqB,EAAE;oBACrB,0BAA0B,EAAE,UAAU;oBACtC,0BAA0B,EAAE,qBAAqB;iBAClD;gBACD,qBAAqB,EAAE,CAAC,GAAG,+BAA+B,CAAC;aAC5D;SACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,OAAoC;QAEpC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAmC,CAAC;QAChE,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAC,2BAA2B,CAAC,CAAC;QACnE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CACb,sDAAsD;gBACtD,4BAA4B,2BAA2B,KAAK;gBAC5D,+EAA+E,CAChF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACb,sDAAsD;gBACtD,oBAAoB;gBACpB,gDAAgD,CACjD,CAAC;QACJ,CAAC;QAED,gEAAgE;QAChE,gEAAgE;QAChE,MAAM,YAAY,GAChB,OAAO,CAAC,uBAAuB,EAAE,CAAC,gCAAgC,CAAC;eAChE,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,8BAA8B,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAEpF,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS,CAAC,IAAI,KAAK,+BAA+B,CAAC,mBAAmB,EAAE,CAAC;YACxG,0EAA0E;YAC1E,qEAAqE;YACrE,wDAAwD;YACxD,EAAE;YACF,yEAAyE;YACzE,yEAAyE;YACzE,yEAAyE;YACzE,uEAAuE;YACvE,6DAA6D;YAC7D,MAAM,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;YACtC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CACb,sDAAsD;sBACpD,cAAc,OAAO,CAAC,SAAS,CAAC,IAAI,IAAI,OAAO,CAAC,SAAS,CAAC,IAAI,2BAA2B;sBACzF,0FAA0F;sBAC1F,iGAAiG,CACpG,CAAC;YACJ,CAAC;YACD,uEAAuE;YACvE,6DAA6D;YAC7D,wEAAwE;YACxE,0EAA0E;YAC1E,4BAA4B;YAC5B,MAAM,cAAc,GAAG,0BAA0B,CAAC,MAAM,CAAC,CAAC;YAE1D,MAAM,EAAE,aAAa,EAAE,sBAAsB,EAAE,GAAG,MAAM,WAAW,CAAC,6BAA6B,CAAC;gBAChG,YAAY;gBACZ,QAAQ;gBACR,QAAQ;gBACR,UAAU,EAAE,2BAA2B;gBACvC,gEAAgE;gBAChE,wEAAwE;gBACxE,iEAAiE;gBACjE,uEAAuE;gBACvE,yEAAyE;gBACzE,2EAA2E;gBAC3E,UAAU,EAAE,wBAAwB,CAAC,cAAc,CAAC,IAAI,CAAC;gBACzD,WAAW,EAAE,wBAAwB,CAAC,cAAc,CAAC,KAAK,CAAC;gBAC3D,YAAY,EAAE,wBAAwB,CAAC,cAAc,CAAC,MAAM,CAAC;aAC9D,CAAC,CAAC;YAEH,OAAO;gBACL,gBAAgB,EAAE;oBAChB,CAAC,2BAA2B,CAAC,EAAE,YAAY;oBAC3C,CAAC,sBAAsB,CAAC,EAAE,QAAQ;oBAClC,CAAC,yBAAyB,CAAC,EAAE,sBAAsB;iBACpD;aACF,CAAC;QACJ,CAAC;QAED,+DAA+D;QAC/D,8DAA8D;QAC9D,kBAAkB;QAClB,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,WAAW,CAAC,yBAAyB,CAAC;YACpE,YAAY;YACZ,QAAQ;YACR,QAAQ;SACT,CAAC,CAAC;QAEH,OAAO;YACL,gBAAgB,EAAE;gBAChB,CAAC,2BAA2B,CAAC,EAAE,YAAY;gBAC3C,CAAC,sBAAsB,CAAC,EAAE,QAAQ;gBAClC,CAAC,yBAAyB,CAAC,EAAE,aAAa;aAC3C;SACF,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,oBAAoB,CAAC,OAAoC;QAC7D,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACb,wDAAwD;gBACxD,oBAAoB;gBACpB,gDAAgD,CACjD,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAmC,CAAC;QAChE,MAAM,YAAY,GAChB,OAAO,CAAC,uBAAuB,EAAE,CAAC,gCAAgC,CAAC;eAChE,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,8BAA8B,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAEpF,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS,CAAC,IAAI,KAAK,+BAA+B,CAAC,mBAAmB,EAAE,CAAC;YACxG,sEAAsE;YACtE,yEAAyE;YACzE,mEAAmE;YACnE,iDAAiD;YACjD,MAAM,WAAW,CAAC,2BAA2B,CAAC;gBAC5C,YAAY;gBACZ,QAAQ;gBACR,UAAU,EAAE,2BAA2B;aACxC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,MAAM,WAAW,CAAC,uBAAuB,CAAC,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC,CAAC;IACxE,CAAC;IAED,0DAA0D;IAC1D,qDAAqD;CACtD,CAAC","sourcesContent":["/**\n * `PostgresSelfInfraProviderModule` — third concrete `InfraProviderModule`\n * (Slice 4.B.2 of `infra-provider-planner.md`, generalizing the\n * Slice 2 / 4.B.1 pattern).\n *\n * Implements the `POSTGRES_SELF` `InfraProvider` over the\n * `IPostgresAdminClient` transport (raw `pg` Pool against the\n * Postgres admin connection, exposed by\n * `PostgreSQLConnectionManagerService` after the Slice 4.B.2 5C\n * policy/transport split). Owns ALL per-app naming policy — the\n * per-app database-name + role-name conventions (`wildo_<sanitized>_user`,\n * `wildo_<sanitized>` mirroring the legacy\n * `PlatformInfrastructureManagerService.provisionPostgreSQLDatabase`).\n *\n * **What this module reads from `AppCredentialMintingContext`**:\n * - `appSlug` — used as the source for the sanitized database +\n *   user name. Mirrors the legacy convention at\n *   `platform-infrastructure-manager.service.ts:300-302`\n *   (`sanitizedName = sanitizeForPostgreSQL(applicationName)`,\n *   `databaseName = wildo_${sanitizedName}`,\n *   `username = wildo_${sanitizedName}_user`).\n * - `secretInputs['database.postgresql.password']` — orchestrator-\n *   supplied password (module is upsert-only, never generator).\n * - `applicationConfigInputs?.['databaseName']` — optional override\n *   for the derived database name. Mirrors the legacy\n *   `provisionPostgreSQLDatabase(appSlug, { databaseName? })` arg.\n * - `adminClient` — narrowed to `IPostgresAdminClient`.\n *\n * **What this module IGNORES from the context** (Slice 4.A.2 / M4\n * forward-compat documentation):\n * - `applicationNamespace` — Postgres per-app DB names use the\n *   slug-derived sanitized form (env-suffix isolation comes from\n *   the surrounding env-scoped admin connection). Future modules\n *   may switch to namespace-scoped naming if cross-env collision\n *   risk surfaces.\n * - `wildoApplicationId` — Postgres role names embed the\n *   sanitized slug, NOT the application id. This is the legacy\n *   convention; preserved for back-compat with apps already\n *   provisioned.\n *\n * **Two audiences this module serves:**\n *\n * 1. **Audience-1 (platform-admin, declared via `plan().platformAdmin`)**:\n *    cluster-wide Postgres admin creds. Consumers: `apps-manager`\n *    (mints per-app DB+role via `mintAppCredentials`), `companion`\n *    (mirrors apps-manager admin role for local dev).\n *\n * 2. **Audience-3 (app-scoped, via `plan().appRuntime` +\n *    `mintAppCredentials`)**: per-customer-app Postgres database +\n *    role. Result threaded into\n *    `Wildo_Application_Secrets.database.postgresql.{\n *    databaseName, username, connectUrl}` via\n *    `_merge_WildoApplicationSecrets`. Note: the password is\n *    embedded in `connectUrl` — there is no separate\n *    `database.postgresql.password` blob path today (matches the\n *    legacy persistence shape at\n *    `wildo-application-lifecycle.service.ts:2191-2200`).\n *\n * **NOT served (D-4 of Slice 4.B locked decisions, 2026-05-10)**:\n * - **Audience-2 (platform-service-scoped)**: no platform service\n *   uses Postgres for inter-service messaging today. Method omitted.\n *\n * **`revokeAppCredentials`**: declared and tested, but the integration\n * call site does NOT exist in `wildo-application-lifecycle.service.ts`\n * (no app-deletion ceremony today — F6 of plan review 2026-05-06).\n * Method ships as a forward-compat seam.\n */\n\nimport {\n  AppCredentialMintingContext,\n  AppCredentialMintingResult,\n  IPostgresAdminClient,\n  InfraCapability,\n  InfraPlatformAdminConsumer,\n  InfraProvider,\n  InfraProviderModule,\n  InfraProviderPlanContribution,\n  ApplicationRuntimePrincipal,\n  ApplicationRuntimePrincipalKind,\n  deriveMinionDatabaseGrants,\n  resolveGrantStorageNames,\n} from '@wildo-ai/platform-config-lib';\n\n/**\n * Default Postgres port (matches `INFRA_DEFAULT_PORTS.POSTGRES` in\n * the shared platform constants — duplicated as a literal because\n * the planner output is consumed by the CLI which materializes it\n * into `Wildo_Application_Config` blob paths).\n */\nconst DEFAULT_POSTGRES_PORT = 5432;\n\n/**\n * The `Wildo_Application_Secrets` JSON paths this module writes\n * through `mintAppCredentials`. Declared once and reused as\n * `appRuntime.perAppSecretBlobPaths` in `plan()` AND as the keys of\n * `secretBlobValues` in the result, so a refactor that renames a\n * path fails loudly at one place.\n *\n * Note: the password is embedded in `connectUrl` (Postgres\n * convention); there is no separate `database.postgresql.password`\n * blob path today. The orchestrator persists `connectUrl`\n * verbatim into `Wildo_Application_Secrets`.\n */\nconst POSTGRES_DATABASE_NAME_PATH = 'database.postgresql.databaseName';\nconst POSTGRES_USERNAME_PATH = 'database.postgresql.username';\nconst POSTGRES_CONNECT_URL_PATH = 'database.postgresql.connectUrl';\n/**\n * The paths this module mints PER RUNTIME PRINCIPAL — the single source for both consumers.\n *\n * Read by `InfraProviderModule.perPrincipalSecretBlobPaths` (statically, so apps-manager can strip\n * these from the application blob before delivering a principal's own material) AND spread into\n * `appRuntime.perAppSecretBlobPaths` inside `plan()`. Declaring the list twice is how the delivery\n * path would silently stop covering a path this module still mints.\n */\nconst PER_PRINCIPAL_SECRET_BLOB_PATHS: ReadonlyArray<string> = [\n  POSTGRES_DATABASE_NAME_PATH,\n  POSTGRES_USERNAME_PATH,\n  POSTGRES_CONNECT_URL_PATH,\n];\n\n\n/**\n * Key the module looks for in `secretInputs` to read the\n * orchestrator-supplied password.\n */\nconst POSTGRES_PASSWORD_INPUT_KEY = 'database.postgresql.password';\n\n/**\n * Optional key the module looks for in `applicationConfigInputs`\n * for an authored database-name override. When omitted, the module\n * derives the database name from `appSlug` via `sanitizeForPostgreSQL`.\n */\nconst POSTGRES_DATABASE_NAME_INPUT_KEY = 'databaseName';\n\n/**\n * Sanitize an application slug for Postgres identifier rules.\n * Mirrors the legacy `sanitizeForPostgreSQL` at\n * `platform-infrastructure-manager.service.ts:371-378`:\n * - lowercase\n * - `[^a-z0-9_]` → `_`\n * - collapse multiple `_`\n * - strip leading/trailing `_`\n * - cap at 50 chars (Postgres identifier limit is 63; leaves room\n *   for the `wildo_` prefix and `_user` suffix).\n *\n * Centralized here so the module owns the convention; if the cap\n * or escape rules change, one site changes.\n */\nfunction sanitizeForPostgres(value: string): string {\n  return value\n    .toLowerCase()\n    .replace(/[^a-z0-9_]/g, '_')\n    .replace(/_+/g, '_')\n    .replace(/^_|_$/g, '')\n    .substring(0, 50);\n}\n\n/**\n * Compute the per-app database name. Mirrors legacy convention at\n * `platform-infrastructure-manager.service.ts:301`:\n *   `wildo_<sanitized>`\n */\nfunction buildDatabaseName(appSlug: string): string {\n  return `wildo_${sanitizeForPostgres(appSlug)}`;\n}\n\n/**\n * Compute the per-app database role. Mirrors legacy convention at\n * `platform-infrastructure-manager.service.ts:302`:\n *   `wildo_<sanitized>_user`\n */\nfunction buildUsername(appSlug: string): string {\n  return `wildo_${sanitizeForPostgres(appSlug)}_user`;\n}\n\n/**\n * The schema a per-app database's resource tables live in.\n *\n * `public` is what the schema planner targets today. Named as a constant rather\n * than inlined at the four sites that need it because a grant issued into one\n * schema and revoked from another is a revocation that silently succeeds while\n * narrowing nothing.\n */\nconst POSTGRES_APPLICATION_SCHEMA = 'public';\n\n/**\n * Per-principal Postgres role name — the SAME derivation the revoke path uses.\n *\n * Fourth time this shape appears (Redis, RabbitMQ, Mongo, now Postgres), and the\n * consequence is worse here than anywhere else: a revoke that derived the name\n * differently would miss the minion's role AND, on the pre-existing\n * `dropApplicationDatabase` path, take the application's entire database with\n * it. The application backend keeps `wildo_<slug>_user` VERBATIM so an existing\n * deployment's owner role is never orphaned.\n */\nfunction buildPostgresPrincipalUsername(\n  appSlug: string,\n  principal: ApplicationRuntimePrincipal | undefined,\n): string {\n  if (!principal || principal.kind === ApplicationRuntimePrincipalKind.APPLICATION_BACKEND) {\n    return buildUsername(appSlug);\n  }\n  return `wildo_${sanitizeForPostgres(appSlug)}_${sanitizeForPostgres(principal.kind)}_`\n    + `${sanitizeForPostgres(principal.name ?? '')}_user`;\n}\n\nexport const PostgresSelfInfraProviderModule: InfraProviderModule = {\n  provider: InfraProvider.POSTGRES_SELF,\n  supportedCapabilities: [InfraCapability.RELATIONAL_DATABASE],\n  perPrincipalSecretBlobPaths: PER_PRINCIPAL_SECRET_BLOB_PATHS,\n\n  plan(): InfraProviderPlanContribution {\n    return {\n      dockerComposeServices: ['postgres'],\n      k8sResources: ['templates/infra/k8s/internal/postgres/deployment.yaml.hbs'],\n      platformAdmin: {\n        envVars: {\n          PG_HOST: 'postgres',\n          PG_PORT: String(DEFAULT_POSTGRES_PORT),\n        },\n        // Admin user + password to provision per-app DBs/roles. The\n        // legacy admin-init code reads these from `PG_ADMIN_USER` /\n        // `PG_ADMIN_PASSWORD`; the planner emits the keys, the\n        // CLI's `env-vars-builder` writes the values at sync time.\n        secretEnvVars: ['PG_ADMIN_USER', 'PG_ADMIN_PASSWORD'],\n        // Audience-1 only (DB-admin access). No audience-2\n        // platform-service-scoped Postgres use case today (D-4).\n        consumers: [\n          InfraPlatformAdminConsumer.APPS_MANAGER,\n          InfraPlatformAdminConsumer.COMPANION,\n        ],\n      },\n      appRuntime: {\n        // Static topology — same for every app in this env. The\n        // per-app values (databaseName, username, connectUrl) flow\n        // through `perAppSecretBlobPaths`.\n        perAppConfigBlobPaths: {\n          'database.postgresql.host': 'postgres',\n          'database.postgresql.port': DEFAULT_POSTGRES_PORT,\n        },\n        perAppSecretBlobPaths: [...PER_PRINCIPAL_SECRET_BLOB_PATHS],\n      },\n    };\n  },\n\n  async mintAppCredentials(\n    context: AppCredentialMintingContext,\n  ): Promise<AppCredentialMintingResult> {\n    const adminClient = context.adminClient as IPostgresAdminClient;\n    const password = context.secretInputs[POSTGRES_PASSWORD_INPUT_KEY];\n    if (!password) {\n      throw new Error(\n        `PostgresSelfInfraProviderModule.mintAppCredentials: ` +\n        `secretInputs is missing '${POSTGRES_PASSWORD_INPUT_KEY}'. ` +\n        `The orchestrator MUST supply the Postgres password — modules are upsert-only.`,\n      );\n    }\n    if (!context.appSlug) {\n      throw new Error(\n        `PostgresSelfInfraProviderModule.mintAppCredentials: ` +\n        `appSlug is empty. ` +\n        `The orchestrator MUST supply a non-empty slug.`,\n      );\n    }\n\n    // Allow operator override of the derived database name. Without\n    // an override, derive from `appSlug` via the legacy convention.\n    const databaseName =\n      context.applicationConfigInputs?.[POSTGRES_DATABASE_NAME_INPUT_KEY]\n      || buildDatabaseName(context.appSlug);\n    const username = buildPostgresPrincipalUsername(context.appSlug, context.principal);\n\n    if (context.principal && context.principal.kind !== ApplicationRuntimePrincipalKind.APPLICATION_BACKEND) {\n      // A named principal gets a TABLE-SCOPED role (Step 3 / R1 / D14): exactly\n      // the verbs its `resourceAccess` derived, on exactly the tables that\n      // declaration names, inside a database it does not own.\n      //\n      // `resourceGrants` is REQUIRED and its absence is an error rather than a\n      // default. Falling through to `upsertApplicationDatabase` would make the\n      // minion the OWNER of the application's database with `ALL PRIVILEGES` —\n      // the exact over-grant this path replaces, arriving silently through a\n      // code path that reads as if it were doing the narrow thing.\n      const grants = context.resourceGrants;\n      if (!grants) {\n        throw new Error(\n          `PostgresSelfInfraProviderModule.mintAppCredentials: `\n          + `principal '${context.principal.kind}:${context.principal.name}' has no resourceGrants. `\n          + `Refusing to fall back to the database-wide application role — a minion with no declared `\n          + `access must get NO database role at all (D11/R3), which is the orchestrator's decision to make.`,\n        );\n      }\n      // The authored declaration plus the engine's own floor — the reads and\n      // appends the framework performs for ANY principal, which no\n      // `resourceAccess` can express and none should have to. Applied through\n      // the shared derivation so this adapter and the Mongo one cannot disagree\n      // about what that floor is.\n      const databaseGrants = deriveMinionDatabaseGrants(grants);\n\n      const { connectionUrl: principalConnectionUrl } = await adminClient.upsertTableScopedDatabaseRole({\n        databaseName,\n        username,\n        password,\n        schemaName: POSTGRES_APPLICATION_SCHEMA,\n        // Resource types → table names HERE, at the adapter that speaks\n        // Postgres. The grant contract itself stays in the platform vocabulary,\n        // and passes through the SAME translation Mongo uses, so the two\n        // adapters cannot disagree about which rows a resource type addresses.\n        // SQL identifier casing is applied by the manager, which is the one site\n        // that issues the DDL and runs the existence check those names must match.\n        readTables: resolveGrantStorageNames(databaseGrants.read),\n        writeTables: resolveGrantStorageNames(databaseGrants.write),\n        appendTables: resolveGrantStorageNames(databaseGrants.append),\n      });\n\n      return {\n        secretBlobValues: {\n          [POSTGRES_DATABASE_NAME_PATH]: databaseName,\n          [POSTGRES_USERNAME_PATH]: username,\n          [POSTGRES_CONNECT_URL_PATH]: principalConnectionUrl,\n        },\n      };\n    }\n\n    // CREATE/ALTER USER + CREATE DATABASE — idempotent upsert. The\n    // admin-client reapplies privileges every time so the call is\n    // safe to repeat.\n    const { connectionUrl } = await adminClient.upsertApplicationDatabase({\n      databaseName,\n      username,\n      password,\n    });\n\n    return {\n      secretBlobValues: {\n        [POSTGRES_DATABASE_NAME_PATH]: databaseName,\n        [POSTGRES_USERNAME_PATH]: username,\n        [POSTGRES_CONNECT_URL_PATH]: connectionUrl,\n      },\n    };\n  },\n\n  /**\n   * Tear down the per-app Postgres database + role. Idempotent: the\n   * underlying admin client treats missing DB / missing user as\n   * no-ops.\n   *\n   * **Caller status** (F6 of 2026-05-06 plan review): no caller\n   * wires this in Slices 1–4.B.2. Method ships as a forward-compat\n   * seam for whichever future slice designs the app-deletion\n   * lifecycle.\n   *\n   * **Defensive validation** (Slice 4.A.2 / L4 pattern): empty\n   * `appSlug` would derive an empty database name; we fail-loud\n   * instead so a bad caller surfaces immediately.\n   */\n  async revokeAppCredentials(context: AppCredentialMintingContext): Promise<void> {\n    if (!context.appSlug) {\n      throw new Error(\n        `PostgresSelfInfraProviderModule.revokeAppCredentials: ` +\n        `appSlug is empty. ` +\n        `The orchestrator MUST supply a non-empty slug.`,\n      );\n    }\n    const adminClient = context.adminClient as IPostgresAdminClient;\n    const databaseName =\n      context.applicationConfigInputs?.[POSTGRES_DATABASE_NAME_INPUT_KEY]\n      || buildDatabaseName(context.appSlug);\n    const username = buildPostgresPrincipalUsername(context.appSlug, context.principal);\n\n    if (context.principal && context.principal.kind !== ApplicationRuntimePrincipalKind.APPLICATION_BACKEND) {\n      // A named principal owns NOTHING but its own role. Routing it through\n      // `dropApplicationDatabase` — which is what this method did before named\n      // principals existed — would DROP THE APPLICATION'S DATABASE while\n      // believing it was retiring one minion's access.\n      await adminClient.dropTableScopedDatabaseRole({\n        databaseName,\n        username,\n        schemaName: POSTGRES_APPLICATION_SCHEMA,\n      });\n      return;\n    }\n\n    await adminClient.dropApplicationDatabase({ databaseName, username });\n  },\n\n  // No `mintPlatformServiceCredentials` (D-4 of Slice 4.B —\n  // audience-2 not applicable to Postgres_Self today).\n};\n"]}

package/dist/esm/rabbitmq-self/rabbitmq-self.infra.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rabbitmq-self.infra.module.d.ts","sourceRoot":"","sources":["../../../../src/rabbitmq-self/rabbitmq-self.infra.module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoFG;AAEH,OAAO,EAOL,mBAAmB,EAOpB,MAAM,+BAA+B,CAAC;AAwMvC,eAAO,MAAM,+BAA+B,EAAE,mBAsO7C,CAAC"}
+{"version":3,"file":"rabbitmq-self.infra.module.d.ts","sourceRoot":"","sources":["../../../src/rabbitmq-self/rabbitmq-self.infra.module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoFG;AAEH,OAAO,EAOL,mBAAmB,EAOpB,MAAM,+BAA+B,CAAC;AAwMvC,eAAO,MAAM,+BAA+B,EAAE,mBAsO7C,CAAC"}

package/dist/esm/redis-self/redis-self.infra.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redis-self.infra.module.d.ts","sourceRoot":"","sources":["../../../../src/redis-self/redis-self.infra.module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqFG;AAEH,OAAO,EAOL,mBAAmB,EAKpB,MAAM,+BAA+B,CAAC;AA+GvC,eAAO,MAAM,4BAA4B,EAAE,mBAiK1C,CAAC"}
+{"version":3,"file":"redis-self.infra.module.d.ts","sourceRoot":"","sources":["../../../src/redis-self/redis-self.infra.module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqFG;AAEH,OAAO,EAOL,mBAAmB,EAKpB,MAAM,+BAA+B,CAAC;AA+GvC,eAAO,MAAM,4BAA4B,EAAE,mBAiK1C,CAAC"}