@wildo-ai/platform-infra-providers 1.1.2

package/dist/esm/postgres-self/postgres-self.infra.module.js

@@ -0,0 +1,328 @@
+/**
+ * `PostgresSelfInfraProviderModule` — third concrete `InfraProviderModule`
+ * (Slice 4.B.2 of `infra-provider-planner.md`, generalizing the
+ * Slice 2 / 4.B.1 pattern).
+ *
+ * Implements the `POSTGRES_SELF` `InfraProvider` over the
+ * `IPostgresAdminClient` transport (raw `pg` Pool against the
+ * Postgres admin connection, exposed by
+ * `PostgreSQLConnectionManagerService` after the Slice 4.B.2 5C
+ * policy/transport split). Owns ALL per-app naming policy — the
+ * per-app database-name + role-name conventions (`wildo_<sanitized>_user`,
+ * `wildo_<sanitized>` mirroring the legacy
+ * `PlatformInfrastructureManagerService.provisionPostgreSQLDatabase`).
+ *
+ * **What this module reads from `AppCredentialMintingContext`**:
+ * - `appSlug` — used as the source for the sanitized database +
+ *   user name. Mirrors the legacy convention at
+ *   `platform-infrastructure-manager.service.ts:300-302`
+ *   (`sanitizedName = sanitizeForPostgreSQL(applicationName)`,
+ *   `databaseName = wildo_${sanitizedName}`,
+ *   `username = wildo_${sanitizedName}_user`).
+ * - `secretInputs['database.postgresql.password']` — orchestrator-
+ *   supplied password (module is upsert-only, never generator).
+ * - `applicationConfigInputs?.['databaseName']` — optional override
+ *   for the derived database name. Mirrors the legacy
+ *   `provisionPostgreSQLDatabase(appSlug, { databaseName? })` arg.
+ * - `adminClient` — narrowed to `IPostgresAdminClient`.
+ *
+ * **What this module IGNORES from the context** (Slice 4.A.2 / M4
+ * forward-compat documentation):
+ * - `applicationNamespace` — Postgres per-app DB names use the
+ *   slug-derived sanitized form (env-suffix isolation comes from
+ *   the surrounding env-scoped admin connection). Future modules
+ *   may switch to namespace-scoped naming if cross-env collision
+ *   risk surfaces.
+ * - `wildoApplicationId` — Postgres role names embed the
+ *   sanitized slug, NOT the application id. This is the legacy
+ *   convention; preserved for back-compat with apps already
+ *   provisioned.
+ *
+ * **Two audiences this module serves:**
+ *
+ * 1. **Audience-1 (platform-admin, declared via `plan().platformAdmin`)**:
+ *    cluster-wide Postgres admin creds. Consumers: `apps-manager`
+ *    (mints per-app DB+role via `mintAppCredentials`), `companion`
+ *    (mirrors apps-manager admin role for local dev).
+ *
+ * 2. **Audience-3 (app-scoped, via `plan().appRuntime` +
+ *    `mintAppCredentials`)**: per-customer-app Postgres database +
+ *    role. Result threaded into
+ *    `Wildo_Application_Secrets.database.postgresql.{
+ *    databaseName, username, connectUrl}` via
+ *    `_merge_WildoApplicationSecrets`. Note: the password is
+ *    embedded in `connectUrl` — there is no separate
+ *    `database.postgresql.password` blob path today (matches the
+ *    legacy persistence shape at
+ *    `wildo-application-lifecycle.service.ts:2191-2200`).
+ *
+ * **NOT served (D-4 of Slice 4.B locked decisions, 2026-05-10)**:
+ * - **Audience-2 (platform-service-scoped)**: no platform service
+ *   uses Postgres for inter-service messaging today. Method omitted.
+ *
+ * **`revokeAppCredentials`**: declared and tested, but the integration
+ * call site does NOT exist in `wildo-application-lifecycle.service.ts`
+ * (no app-deletion ceremony today — F6 of plan review 2026-05-06).
+ * Method ships as a forward-compat seam.
+ */
+import { InfraCapability, InfraPlatformAdminConsumer, InfraProvider, ApplicationRuntimePrincipalKind, resolveGrantStorageNames, } from '@wildo-ai/platform-config-lib';
+/**
+ * Default Postgres port (matches `INFRA_DEFAULT_PORTS.POSTGRES` in
+ * the shared platform constants — duplicated as a literal because
+ * the planner output is consumed by the CLI which materializes it
+ * into `Wildo_Application_Config` blob paths).
+ */
+const DEFAULT_POSTGRES_PORT = 5432;
+/**
+ * The `Wildo_Application_Secrets` JSON paths this module writes
+ * through `mintAppCredentials`. Declared once and reused as
+ * `appRuntime.perAppSecretBlobPaths` in `plan()` AND as the keys of
+ * `secretBlobValues` in the result, so a refactor that renames a
+ * path fails loudly at one place.
+ *
+ * Note: the password is embedded in `connectUrl` (Postgres
+ * convention); there is no separate `database.postgresql.password`
+ * blob path today. The orchestrator persists `connectUrl`
+ * verbatim into `Wildo_Application_Secrets`.
+ */
+const POSTGRES_DATABASE_NAME_PATH = 'database.postgresql.databaseName';
+const POSTGRES_USERNAME_PATH = 'database.postgresql.username';
+const POSTGRES_CONNECT_URL_PATH = 'database.postgresql.connectUrl';
+/**
+ * The paths this module mints PER RUNTIME PRINCIPAL — the single source for both consumers.
+ *
+ * Read by `InfraProviderModule.perPrincipalSecretBlobPaths` (statically, so apps-manager can strip
+ * these from the application blob before delivering a principal's own material) AND spread into
+ * `appRuntime.perAppSecretBlobPaths` inside `plan()`. Declaring the list twice is how the delivery
+ * path would silently stop covering a path this module still mints.
+ */
+const PER_PRINCIPAL_SECRET_BLOB_PATHS = [
+    POSTGRES_DATABASE_NAME_PATH,
+    POSTGRES_USERNAME_PATH,
+    POSTGRES_CONNECT_URL_PATH,
+];
+/**
+ * Key the module looks for in `secretInputs` to read the
+ * orchestrator-supplied password.
+ */
+const POSTGRES_PASSWORD_INPUT_KEY = 'database.postgresql.password';
+/**
+ * Optional key the module looks for in `applicationConfigInputs`
+ * for an authored database-name override. When omitted, the module
+ * derives the database name from `appSlug` via `sanitizeForPostgreSQL`.
+ */
+const POSTGRES_DATABASE_NAME_INPUT_KEY = 'databaseName';
+/**
+ * Sanitize an application slug for Postgres identifier rules.
+ * Mirrors the legacy `sanitizeForPostgreSQL` at
+ * `platform-infrastructure-manager.service.ts:371-378`:
+ * - lowercase
+ * - `[^a-z0-9_]` → `_`
+ * - collapse multiple `_`
+ * - strip leading/trailing `_`
+ * - cap at 50 chars (Postgres identifier limit is 63; leaves room
+ *   for the `wildo_` prefix and `_user` suffix).
+ *
+ * Centralized here so the module owns the convention; if the cap
+ * or escape rules change, one site changes.
+ */
+function sanitizeForPostgres(value) {
+    return value
+        .toLowerCase()
+        .replace(/[^a-z0-9_]/g, '_')
+        .replace(/_+/g, '_')
+        .replace(/^_|_$/g, '')
+        .substring(0, 50);
+}
+/**
+ * Compute the per-app database name. Mirrors legacy convention at
+ * `platform-infrastructure-manager.service.ts:301`:
+ *   `wildo_<sanitized>`
+ */
+function buildDatabaseName(appSlug) {
+    return `wildo_${sanitizeForPostgres(appSlug)}`;
+}
+/**
+ * Compute the per-app database role. Mirrors legacy convention at
+ * `platform-infrastructure-manager.service.ts:302`:
+ *   `wildo_<sanitized>_user`
+ */
+function buildUsername(appSlug) {
+    return `wildo_${sanitizeForPostgres(appSlug)}_user`;
+}
+/**
+ * The schema a per-app database's resource tables live in.
+ *
+ * `public` is what the schema planner targets today. Named as a constant rather
+ * than inlined at the four sites that need it because a grant issued into one
+ * schema and revoked from another is a revocation that silently succeeds while
+ * narrowing nothing.
+ */
+const POSTGRES_APPLICATION_SCHEMA = 'public';
+/**
+ * Per-principal Postgres role name — the SAME derivation the revoke path uses.
+ *
+ * Fourth time this shape appears (Redis, RabbitMQ, Mongo, now Postgres), and the
+ * consequence is worse here than anywhere else: a revoke that derived the name
+ * differently would miss the minion's role AND, on the pre-existing
+ * `dropApplicationDatabase` path, take the application's entire database with
+ * it. The application backend keeps `wildo_<slug>_user` VERBATIM so an existing
+ * deployment's owner role is never orphaned.
+ */
+function buildPostgresPrincipalUsername(appSlug, principal) {
+    if (!principal || principal.kind === ApplicationRuntimePrincipalKind.APPLICATION_BACKEND) {
+        return buildUsername(appSlug);
+    }
+    return `wildo_${sanitizeForPostgres(appSlug)}_${sanitizeForPostgres(principal.kind)}_`
+        + `${sanitizeForPostgres(principal.name ?? '')}_user`;
+}
+export const PostgresSelfInfraProviderModule = {
+    provider: InfraProvider.POSTGRES_SELF,
+    supportedCapabilities: [InfraCapability.RELATIONAL_DATABASE],
+    perPrincipalSecretBlobPaths: PER_PRINCIPAL_SECRET_BLOB_PATHS,
+    plan() {
+        return {
+            dockerComposeServices: ['postgres'],
+            k8sResources: ['templates/infra/k8s/internal/postgres/deployment.yaml.hbs'],
+            platformAdmin: {
+                envVars: {
+                    PG_HOST: 'postgres',
+                    PG_PORT: String(DEFAULT_POSTGRES_PORT),
+                },
+                // Admin user + password to provision per-app DBs/roles. The
+                // legacy admin-init code reads these from `PG_ADMIN_USER` /
+                // `PG_ADMIN_PASSWORD`; the planner emits the keys, the
+                // CLI's `env-vars-builder` writes the values at sync time.
+                secretEnvVars: ['PG_ADMIN_USER', 'PG_ADMIN_PASSWORD'],
+                // Audience-1 only (DB-admin access). No audience-2
+                // platform-service-scoped Postgres use case today (D-4).
+                consumers: [
+                    InfraPlatformAdminConsumer.APPS_MANAGER,
+                    InfraPlatformAdminConsumer.COMPANION,
+                ],
+            },
+            appRuntime: {
+                // Static topology — same for every app in this env. The
+                // per-app values (databaseName, username, connectUrl) flow
+                // through `perAppSecretBlobPaths`.
+                perAppConfigBlobPaths: {
+                    'database.postgresql.host': 'postgres',
+                    'database.postgresql.port': DEFAULT_POSTGRES_PORT,
+                },
+                perAppSecretBlobPaths: [...PER_PRINCIPAL_SECRET_BLOB_PATHS],
+            },
+        };
+    },
+    async mintAppCredentials(context) {
+        const adminClient = context.adminClient;
+        const password = context.secretInputs[POSTGRES_PASSWORD_INPUT_KEY];
+        if (!password) {
+            throw new Error(`PostgresSelfInfraProviderModule.mintAppCredentials: ` +
+                `secretInputs is missing '${POSTGRES_PASSWORD_INPUT_KEY}'. ` +
+                `The orchestrator MUST supply the Postgres password — modules are upsert-only.`);
+        }
+        if (!context.appSlug) {
+            throw new Error(`PostgresSelfInfraProviderModule.mintAppCredentials: ` +
+                `appSlug is empty. ` +
+                `The orchestrator MUST supply a non-empty slug.`);
+        }
+        // Allow operator override of the derived database name. Without
+        // an override, derive from `appSlug` via the legacy convention.
+        const databaseName = context.applicationConfigInputs?.[POSTGRES_DATABASE_NAME_INPUT_KEY]
+            || buildDatabaseName(context.appSlug);
+        const username = buildPostgresPrincipalUsername(context.appSlug, context.principal);
+        if (context.principal && context.principal.kind !== ApplicationRuntimePrincipalKind.APPLICATION_BACKEND) {
+            // A named principal gets a TABLE-SCOPED role (Step 3 / R1 / D14): exactly
+            // the verbs its `resourceAccess` derived, on exactly the tables that
+            // declaration names, inside a database it does not own.
+            //
+            // `resourceGrants` is REQUIRED and its absence is an error rather than a
+            // default. Falling through to `upsertApplicationDatabase` would make the
+            // minion the OWNER of the application's database with `ALL PRIVILEGES` —
+            // the exact over-grant this path replaces, arriving silently through a
+            // code path that reads as if it were doing the narrow thing.
+            const grants = context.resourceGrants;
+            if (!grants) {
+                throw new Error(`PostgresSelfInfraProviderModule.mintAppCredentials: `
+                    + `principal '${context.principal.kind}:${context.principal.name}' has no resourceGrants. `
+                    + `Refusing to fall back to the database-wide application role — a minion with no declared `
+                    + `access must get NO database role at all (D11/R3), which is the orchestrator's decision to make.`);
+            }
+            const { connectionUrl: principalConnectionUrl } = await adminClient.upsertTableScopedDatabaseRole({
+                databaseName,
+                username,
+                password,
+                schemaName: POSTGRES_APPLICATION_SCHEMA,
+                // Resource types → table names HERE, at the adapter that speaks
+                // Postgres. The grant contract itself stays in the platform vocabulary,
+                // and passes through the SAME translation Mongo uses, so the two
+                // adapters cannot disagree about which rows a resource type addresses.
+                readTables: resolveGrantStorageNames(grants.read),
+                writeTables: resolveGrantStorageNames(grants.write),
+            });
+            return {
+                secretBlobValues: {
+                    [POSTGRES_DATABASE_NAME_PATH]: databaseName,
+                    [POSTGRES_USERNAME_PATH]: username,
+                    [POSTGRES_CONNECT_URL_PATH]: principalConnectionUrl,
+                },
+            };
+        }
+        // CREATE/ALTER USER + CREATE DATABASE — idempotent upsert. The
+        // admin-client reapplies privileges every time so the call is
+        // safe to repeat.
+        const { connectionUrl } = await adminClient.upsertApplicationDatabase({
+            databaseName,
+            username,
+            password,
+        });
+        return {
+            secretBlobValues: {
+                [POSTGRES_DATABASE_NAME_PATH]: databaseName,
+                [POSTGRES_USERNAME_PATH]: username,
+                [POSTGRES_CONNECT_URL_PATH]: connectionUrl,
+            },
+        };
+    },
+    /**
+     * Tear down the per-app Postgres database + role. Idempotent: the
+     * underlying admin client treats missing DB / missing user as
+     * no-ops.
+     *
+     * **Caller status** (F6 of 2026-05-06 plan review): no caller
+     * wires this in Slices 1–4.B.2. Method ships as a forward-compat
+     * seam for whichever future slice designs the app-deletion
+     * lifecycle.
+     *
+     * **Defensive validation** (Slice 4.A.2 / L4 pattern): empty
+     * `appSlug` would derive an empty database name; we fail-loud
+     * instead so a bad caller surfaces immediately.
+     */
+    async revokeAppCredentials(context) {
+        if (!context.appSlug) {
+            throw new Error(`PostgresSelfInfraProviderModule.revokeAppCredentials: ` +
+                `appSlug is empty. ` +
+                `The orchestrator MUST supply a non-empty slug.`);
+        }
+        const adminClient = context.adminClient;
+        const databaseName = context.applicationConfigInputs?.[POSTGRES_DATABASE_NAME_INPUT_KEY]
+            || buildDatabaseName(context.appSlug);
+        const username = buildPostgresPrincipalUsername(context.appSlug, context.principal);
+        if (context.principal && context.principal.kind !== ApplicationRuntimePrincipalKind.APPLICATION_BACKEND) {
+            // A named principal owns NOTHING but its own role. Routing it through
+            // `dropApplicationDatabase` — which is what this method did before named
+            // principals existed — would DROP THE APPLICATION'S DATABASE while
+            // believing it was retiring one minion's access.
+            await adminClient.dropTableScopedDatabaseRole({
+                databaseName,
+                username,
+                schemaName: POSTGRES_APPLICATION_SCHEMA,
+            });
+            return;
+        }
+        await adminClient.dropApplicationDatabase({ databaseName, username });
+    },
+    // No `mintPlatformServiceCredentials` (D-4 of Slice 4.B —
+    // audience-2 not applicable to Postgres_Self today).
+};
+//# sourceMappingURL=postgres-self.infra.module.js.map

package/dist/esm/postgres-self/postgres-self.infra.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgres-self.infra.module.js","sourceRoot":"","sources":["../../../../src/postgres-self/postgres-self.infra.module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkEG;AAEH,OAAO,EAIL,eAAe,EACf,0BAA0B,EAC1B,aAAa,EAIb,+BAA+B,EAC/B,wBAAwB,GACzB,MAAM,+BAA+B,CAAC;AAEvC;;;;;GAKG;AACH,MAAM,qBAAqB,GAAG,IAAI,CAAC;AAEnC;;;;;;;;;;;GAWG;AACH,MAAM,2BAA2B,GAAG,kCAAkC,CAAC;AACvE,MAAM,sBAAsB,GAAG,8BAA8B,CAAC;AAC9D,MAAM,yBAAyB,GAAG,gCAAgC,CAAC;AACnE;;;;;;;GAOG;AACH,MAAM,+BAA+B,GAA0B;IAC7D,2BAA2B;IAC3B,sBAAsB;IACtB,yBAAyB;CAC1B,CAAC;AAGF;;;GAGG;AACH,MAAM,2BAA2B,GAAG,8BAA8B,CAAC;AAEnE;;;;GAIG;AACH,MAAM,gCAAgC,GAAG,cAAc,CAAC;AAExD;;;;;;;;;;;;;GAaG;AACH,SAAS,mBAAmB,CAAC,KAAa;IACxC,OAAO,KAAK;SACT,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;SACrB,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACtB,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,OAAe;IACxC,OAAO,SAAS,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAAC;AACjD,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,OAAe;IACpC,OAAO,SAAS,mBAAmB,CAAC,OAAO,CAAC,OAAO,CAAC;AACtD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,2BAA2B,GAAG,QAAQ,CAAC;AAE7C;;;;;;;;;GASG;AACH,SAAS,8BAA8B,CACrC,OAAe,EACf,SAAkD;IAElD,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,IAAI,KAAK,+BAA+B,CAAC,mBAAmB,EAAE,CAAC;QACzF,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,SAAS,mBAAmB,CAAC,OAAO,CAAC,IAAI,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG;UAClF,GAAG,mBAAmB,CAAC,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC,OAAO,CAAC;AAC1D,CAAC;AAED,MAAM,CAAC,MAAM,+BAA+B,GAAwB;IAClE,QAAQ,EAAE,aAAa,CAAC,aAAa;IACrC,qBAAqB,EAAE,CAAC,eAAe,CAAC,mBAAmB,CAAC;IAC5D,2BAA2B,EAAE,+BAA+B;IAE5D,IAAI;QACF,OAAO;YACL,qBAAqB,EAAE,CAAC,UAAU,CAAC;YACnC,YAAY,EAAE,CAAC,2DAA2D,CAAC;YAC3E,aAAa,EAAE;gBACb,OAAO,EAAE;oBACP,OAAO,EAAE,UAAU;oBACnB,OAAO,EAAE,MAAM,CAAC,qBAAqB,CAAC;iBACvC;gBACD,4DAA4D;gBAC5D,4DAA4D;gBAC5D,uDAAuD;gBACvD,2DAA2D;gBAC3D,aAAa,EAAE,CAAC,eAAe,EAAE,mBAAmB,CAAC;gBACrD,mDAAmD;gBACnD,yDAAyD;gBACzD,SAAS,EAAE;oBACT,0BAA0B,CAAC,YAAY;oBACvC,0BAA0B,CAAC,SAAS;iBACrC;aACF;YACD,UAAU,EAAE;gBACV,wDAAwD;gBACxD,2DAA2D;gBAC3D,mCAAmC;gBACnC,qBAAqB,EAAE;oBACrB,0BAA0B,EAAE,UAAU;oBACtC,0BAA0B,EAAE,qBAAqB;iBAClD;gBACD,qBAAqB,EAAE,CAAC,GAAG,+BAA+B,CAAC;aAC5D;SACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,OAAoC;QAEpC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAmC,CAAC;QAChE,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAC,2BAA2B,CAAC,CAAC;QACnE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CACb,sDAAsD;gBACtD,4BAA4B,2BAA2B,KAAK;gBAC5D,+EAA+E,CAChF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACb,sDAAsD;gBACtD,oBAAoB;gBACpB,gDAAgD,CACjD,CAAC;QACJ,CAAC;QAED,gEAAgE;QAChE,gEAAgE;QAChE,MAAM,YAAY,GAChB,OAAO,CAAC,uBAAuB,EAAE,CAAC,gCAAgC,CAAC;eAChE,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,8BAA8B,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAEpF,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS,CAAC,IAAI,KAAK,+BAA+B,CAAC,mBAAmB,EAAE,CAAC;YACxG,0EAA0E;YAC1E,qEAAqE;YACrE,wDAAwD;YACxD,EAAE;YACF,yEAAyE;YACzE,yEAAyE;YACzE,yEAAyE;YACzE,uEAAuE;YACvE,6DAA6D;YAC7D,MAAM,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;YACtC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CACb,sDAAsD;sBACpD,cAAc,OAAO,CAAC,SAAS,CAAC,IAAI,IAAI,OAAO,CAAC,SAAS,CAAC,IAAI,2BAA2B;sBACzF,0FAA0F;sBAC1F,iGAAiG,CACpG,CAAC;YACJ,CAAC;YACD,MAAM,EAAE,aAAa,EAAE,sBAAsB,EAAE,GAAG,MAAM,WAAW,CAAC,6BAA6B,CAAC;gBAChG,YAAY;gBACZ,QAAQ;gBACR,QAAQ;gBACR,UAAU,EAAE,2BAA2B;gBACvC,gEAAgE;gBAChE,wEAAwE;gBACxE,iEAAiE;gBACjE,uEAAuE;gBACvE,UAAU,EAAE,wBAAwB,CAAC,MAAM,CAAC,IAAI,CAAC;gBACjD,WAAW,EAAE,wBAAwB,CAAC,MAAM,CAAC,KAAK,CAAC;aACpD,CAAC,CAAC;YAEH,OAAO;gBACL,gBAAgB,EAAE;oBAChB,CAAC,2BAA2B,CAAC,EAAE,YAAY;oBAC3C,CAAC,sBAAsB,CAAC,EAAE,QAAQ;oBAClC,CAAC,yBAAyB,CAAC,EAAE,sBAAsB;iBACpD;aACF,CAAC;QACJ,CAAC;QAED,+DAA+D;QAC/D,8DAA8D;QAC9D,kBAAkB;QAClB,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,WAAW,CAAC,yBAAyB,CAAC;YACpE,YAAY;YACZ,QAAQ;YACR,QAAQ;SACT,CAAC,CAAC;QAEH,OAAO;YACL,gBAAgB,EAAE;gBAChB,CAAC,2BAA2B,CAAC,EAAE,YAAY;gBAC3C,CAAC,sBAAsB,CAAC,EAAE,QAAQ;gBAClC,CAAC,yBAAyB,CAAC,EAAE,aAAa;aAC3C;SACF,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,oBAAoB,CAAC,OAAoC;QAC7D,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACb,wDAAwD;gBACxD,oBAAoB;gBACpB,gDAAgD,CACjD,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAmC,CAAC;QAChE,MAAM,YAAY,GAChB,OAAO,CAAC,uBAAuB,EAAE,CAAC,gCAAgC,CAAC;eAChE,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,8BAA8B,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAEpF,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS,CAAC,IAAI,KAAK,+BAA+B,CAAC,mBAAmB,EAAE,CAAC;YACxG,sEAAsE;YACtE,yEAAyE;YACzE,mEAAmE;YACnE,iDAAiD;YACjD,MAAM,WAAW,CAAC,2BAA2B,CAAC;gBAC5C,YAAY;gBACZ,QAAQ;gBACR,UAAU,EAAE,2BAA2B;aACxC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,MAAM,WAAW,CAAC,uBAAuB,CAAC,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC,CAAC;IACxE,CAAC;IAED,0DAA0D;IAC1D,qDAAqD;CACtD,CAAC","sourcesContent":["/**\n * `PostgresSelfInfraProviderModule` — third concrete `InfraProviderModule`\n * (Slice 4.B.2 of `infra-provider-planner.md`, generalizing the\n * Slice 2 / 4.B.1 pattern).\n *\n * Implements the `POSTGRES_SELF` `InfraProvider` over the\n * `IPostgresAdminClient` transport (raw `pg` Pool against the\n * Postgres admin connection, exposed by\n * `PostgreSQLConnectionManagerService` after the Slice 4.B.2 5C\n * policy/transport split). Owns ALL per-app naming policy — the\n * per-app database-name + role-name conventions (`wildo_<sanitized>_user`,\n * `wildo_<sanitized>` mirroring the legacy\n * `PlatformInfrastructureManagerService.provisionPostgreSQLDatabase`).\n *\n * **What this module reads from `AppCredentialMintingContext`**:\n * - `appSlug` — used as the source for the sanitized database +\n *   user name. Mirrors the legacy convention at\n *   `platform-infrastructure-manager.service.ts:300-302`\n *   (`sanitizedName = sanitizeForPostgreSQL(applicationName)`,\n *   `databaseName = wildo_${sanitizedName}`,\n *   `username = wildo_${sanitizedName}_user`).\n * - `secretInputs['database.postgresql.password']` — orchestrator-\n *   supplied password (module is upsert-only, never generator).\n * - `applicationConfigInputs?.['databaseName']` — optional override\n *   for the derived database name. Mirrors the legacy\n *   `provisionPostgreSQLDatabase(appSlug, { databaseName? })` arg.\n * - `adminClient` — narrowed to `IPostgresAdminClient`.\n *\n * **What this module IGNORES from the context** (Slice 4.A.2 / M4\n * forward-compat documentation):\n * - `applicationNamespace` — Postgres per-app DB names use the\n *   slug-derived sanitized form (env-suffix isolation comes from\n *   the surrounding env-scoped admin connection). Future modules\n *   may switch to namespace-scoped naming if cross-env collision\n *   risk surfaces.\n * - `wildoApplicationId` — Postgres role names embed the\n *   sanitized slug, NOT the application id. This is the legacy\n *   convention; preserved for back-compat with apps already\n *   provisioned.\n *\n * **Two audiences this module serves:**\n *\n * 1. **Audience-1 (platform-admin, declared via `plan().platformAdmin`)**:\n *    cluster-wide Postgres admin creds. Consumers: `apps-manager`\n *    (mints per-app DB+role via `mintAppCredentials`), `companion`\n *    (mirrors apps-manager admin role for local dev).\n *\n * 2. **Audience-3 (app-scoped, via `plan().appRuntime` +\n *    `mintAppCredentials`)**: per-customer-app Postgres database +\n *    role. Result threaded into\n *    `Wildo_Application_Secrets.database.postgresql.{\n *    databaseName, username, connectUrl}` via\n *    `_merge_WildoApplicationSecrets`. Note: the password is\n *    embedded in `connectUrl` — there is no separate\n *    `database.postgresql.password` blob path today (matches the\n *    legacy persistence shape at\n *    `wildo-application-lifecycle.service.ts:2191-2200`).\n *\n * **NOT served (D-4 of Slice 4.B locked decisions, 2026-05-10)**:\n * - **Audience-2 (platform-service-scoped)**: no platform service\n *   uses Postgres for inter-service messaging today. Method omitted.\n *\n * **`revokeAppCredentials`**: declared and tested, but the integration\n * call site does NOT exist in `wildo-application-lifecycle.service.ts`\n * (no app-deletion ceremony today — F6 of plan review 2026-05-06).\n * Method ships as a forward-compat seam.\n */\n\nimport {\n  AppCredentialMintingContext,\n  AppCredentialMintingResult,\n  IPostgresAdminClient,\n  InfraCapability,\n  InfraPlatformAdminConsumer,\n  InfraProvider,\n  InfraProviderModule,\n  InfraProviderPlanContribution,\n  ApplicationRuntimePrincipal,\n  ApplicationRuntimePrincipalKind,\n  resolveGrantStorageNames,\n} from '@wildo-ai/platform-config-lib';\n\n/**\n * Default Postgres port (matches `INFRA_DEFAULT_PORTS.POSTGRES` in\n * the shared platform constants — duplicated as a literal because\n * the planner output is consumed by the CLI which materializes it\n * into `Wildo_Application_Config` blob paths).\n */\nconst DEFAULT_POSTGRES_PORT = 5432;\n\n/**\n * The `Wildo_Application_Secrets` JSON paths this module writes\n * through `mintAppCredentials`. Declared once and reused as\n * `appRuntime.perAppSecretBlobPaths` in `plan()` AND as the keys of\n * `secretBlobValues` in the result, so a refactor that renames a\n * path fails loudly at one place.\n *\n * Note: the password is embedded in `connectUrl` (Postgres\n * convention); there is no separate `database.postgresql.password`\n * blob path today. The orchestrator persists `connectUrl`\n * verbatim into `Wildo_Application_Secrets`.\n */\nconst POSTGRES_DATABASE_NAME_PATH = 'database.postgresql.databaseName';\nconst POSTGRES_USERNAME_PATH = 'database.postgresql.username';\nconst POSTGRES_CONNECT_URL_PATH = 'database.postgresql.connectUrl';\n/**\n * The paths this module mints PER RUNTIME PRINCIPAL — the single source for both consumers.\n *\n * Read by `InfraProviderModule.perPrincipalSecretBlobPaths` (statically, so apps-manager can strip\n * these from the application blob before delivering a principal's own material) AND spread into\n * `appRuntime.perAppSecretBlobPaths` inside `plan()`. Declaring the list twice is how the delivery\n * path would silently stop covering a path this module still mints.\n */\nconst PER_PRINCIPAL_SECRET_BLOB_PATHS: ReadonlyArray<string> = [\n  POSTGRES_DATABASE_NAME_PATH,\n  POSTGRES_USERNAME_PATH,\n  POSTGRES_CONNECT_URL_PATH,\n];\n\n\n/**\n * Key the module looks for in `secretInputs` to read the\n * orchestrator-supplied password.\n */\nconst POSTGRES_PASSWORD_INPUT_KEY = 'database.postgresql.password';\n\n/**\n * Optional key the module looks for in `applicationConfigInputs`\n * for an authored database-name override. When omitted, the module\n * derives the database name from `appSlug` via `sanitizeForPostgreSQL`.\n */\nconst POSTGRES_DATABASE_NAME_INPUT_KEY = 'databaseName';\n\n/**\n * Sanitize an application slug for Postgres identifier rules.\n * Mirrors the legacy `sanitizeForPostgreSQL` at\n * `platform-infrastructure-manager.service.ts:371-378`:\n * - lowercase\n * - `[^a-z0-9_]` → `_`\n * - collapse multiple `_`\n * - strip leading/trailing `_`\n * - cap at 50 chars (Postgres identifier limit is 63; leaves room\n *   for the `wildo_` prefix and `_user` suffix).\n *\n * Centralized here so the module owns the convention; if the cap\n * or escape rules change, one site changes.\n */\nfunction sanitizeForPostgres(value: string): string {\n  return value\n    .toLowerCase()\n    .replace(/[^a-z0-9_]/g, '_')\n    .replace(/_+/g, '_')\n    .replace(/^_|_$/g, '')\n    .substring(0, 50);\n}\n\n/**\n * Compute the per-app database name. Mirrors legacy convention at\n * `platform-infrastructure-manager.service.ts:301`:\n *   `wildo_<sanitized>`\n */\nfunction buildDatabaseName(appSlug: string): string {\n  return `wildo_${sanitizeForPostgres(appSlug)}`;\n}\n\n/**\n * Compute the per-app database role. Mirrors legacy convention at\n * `platform-infrastructure-manager.service.ts:302`:\n *   `wildo_<sanitized>_user`\n */\nfunction buildUsername(appSlug: string): string {\n  return `wildo_${sanitizeForPostgres(appSlug)}_user`;\n}\n\n/**\n * The schema a per-app database's resource tables live in.\n *\n * `public` is what the schema planner targets today. Named as a constant rather\n * than inlined at the four sites that need it because a grant issued into one\n * schema and revoked from another is a revocation that silently succeeds while\n * narrowing nothing.\n */\nconst POSTGRES_APPLICATION_SCHEMA = 'public';\n\n/**\n * Per-principal Postgres role name — the SAME derivation the revoke path uses.\n *\n * Fourth time this shape appears (Redis, RabbitMQ, Mongo, now Postgres), and the\n * consequence is worse here than anywhere else: a revoke that derived the name\n * differently would miss the minion's role AND, on the pre-existing\n * `dropApplicationDatabase` path, take the application's entire database with\n * it. The application backend keeps `wildo_<slug>_user` VERBATIM so an existing\n * deployment's owner role is never orphaned.\n */\nfunction buildPostgresPrincipalUsername(\n  appSlug: string,\n  principal: ApplicationRuntimePrincipal | undefined,\n): string {\n  if (!principal || principal.kind === ApplicationRuntimePrincipalKind.APPLICATION_BACKEND) {\n    return buildUsername(appSlug);\n  }\n  return `wildo_${sanitizeForPostgres(appSlug)}_${sanitizeForPostgres(principal.kind)}_`\n    + `${sanitizeForPostgres(principal.name ?? '')}_user`;\n}\n\nexport const PostgresSelfInfraProviderModule: InfraProviderModule = {\n  provider: InfraProvider.POSTGRES_SELF,\n  supportedCapabilities: [InfraCapability.RELATIONAL_DATABASE],\n  perPrincipalSecretBlobPaths: PER_PRINCIPAL_SECRET_BLOB_PATHS,\n\n  plan(): InfraProviderPlanContribution {\n    return {\n      dockerComposeServices: ['postgres'],\n      k8sResources: ['templates/infra/k8s/internal/postgres/deployment.yaml.hbs'],\n      platformAdmin: {\n        envVars: {\n          PG_HOST: 'postgres',\n          PG_PORT: String(DEFAULT_POSTGRES_PORT),\n        },\n        // Admin user + password to provision per-app DBs/roles. The\n        // legacy admin-init code reads these from `PG_ADMIN_USER` /\n        // `PG_ADMIN_PASSWORD`; the planner emits the keys, the\n        // CLI's `env-vars-builder` writes the values at sync time.\n        secretEnvVars: ['PG_ADMIN_USER', 'PG_ADMIN_PASSWORD'],\n        // Audience-1 only (DB-admin access). No audience-2\n        // platform-service-scoped Postgres use case today (D-4).\n        consumers: [\n          InfraPlatformAdminConsumer.APPS_MANAGER,\n          InfraPlatformAdminConsumer.COMPANION,\n        ],\n      },\n      appRuntime: {\n        // Static topology — same for every app in this env. The\n        // per-app values (databaseName, username, connectUrl) flow\n        // through `perAppSecretBlobPaths`.\n        perAppConfigBlobPaths: {\n          'database.postgresql.host': 'postgres',\n          'database.postgresql.port': DEFAULT_POSTGRES_PORT,\n        },\n        perAppSecretBlobPaths: [...PER_PRINCIPAL_SECRET_BLOB_PATHS],\n      },\n    };\n  },\n\n  async mintAppCredentials(\n    context: AppCredentialMintingContext,\n  ): Promise<AppCredentialMintingResult> {\n    const adminClient = context.adminClient as IPostgresAdminClient;\n    const password = context.secretInputs[POSTGRES_PASSWORD_INPUT_KEY];\n    if (!password) {\n      throw new Error(\n        `PostgresSelfInfraProviderModule.mintAppCredentials: ` +\n        `secretInputs is missing '${POSTGRES_PASSWORD_INPUT_KEY}'. ` +\n        `The orchestrator MUST supply the Postgres password — modules are upsert-only.`,\n      );\n    }\n    if (!context.appSlug) {\n      throw new Error(\n        `PostgresSelfInfraProviderModule.mintAppCredentials: ` +\n        `appSlug is empty. ` +\n        `The orchestrator MUST supply a non-empty slug.`,\n      );\n    }\n\n    // Allow operator override of the derived database name. Without\n    // an override, derive from `appSlug` via the legacy convention.\n    const databaseName =\n      context.applicationConfigInputs?.[POSTGRES_DATABASE_NAME_INPUT_KEY]\n      || buildDatabaseName(context.appSlug);\n    const username = buildPostgresPrincipalUsername(context.appSlug, context.principal);\n\n    if (context.principal && context.principal.kind !== ApplicationRuntimePrincipalKind.APPLICATION_BACKEND) {\n      // A named principal gets a TABLE-SCOPED role (Step 3 / R1 / D14): exactly\n      // the verbs its `resourceAccess` derived, on exactly the tables that\n      // declaration names, inside a database it does not own.\n      //\n      // `resourceGrants` is REQUIRED and its absence is an error rather than a\n      // default. Falling through to `upsertApplicationDatabase` would make the\n      // minion the OWNER of the application's database with `ALL PRIVILEGES` —\n      // the exact over-grant this path replaces, arriving silently through a\n      // code path that reads as if it were doing the narrow thing.\n      const grants = context.resourceGrants;\n      if (!grants) {\n        throw new Error(\n          `PostgresSelfInfraProviderModule.mintAppCredentials: `\n          + `principal '${context.principal.kind}:${context.principal.name}' has no resourceGrants. `\n          + `Refusing to fall back to the database-wide application role — a minion with no declared `\n          + `access must get NO database role at all (D11/R3), which is the orchestrator's decision to make.`,\n        );\n      }\n      const { connectionUrl: principalConnectionUrl } = await adminClient.upsertTableScopedDatabaseRole({\n        databaseName,\n        username,\n        password,\n        schemaName: POSTGRES_APPLICATION_SCHEMA,\n        // Resource types → table names HERE, at the adapter that speaks\n        // Postgres. The grant contract itself stays in the platform vocabulary,\n        // and passes through the SAME translation Mongo uses, so the two\n        // adapters cannot disagree about which rows a resource type addresses.\n        readTables: resolveGrantStorageNames(grants.read),\n        writeTables: resolveGrantStorageNames(grants.write),\n      });\n\n      return {\n        secretBlobValues: {\n          [POSTGRES_DATABASE_NAME_PATH]: databaseName,\n          [POSTGRES_USERNAME_PATH]: username,\n          [POSTGRES_CONNECT_URL_PATH]: principalConnectionUrl,\n        },\n      };\n    }\n\n    // CREATE/ALTER USER + CREATE DATABASE — idempotent upsert. The\n    // admin-client reapplies privileges every time so the call is\n    // safe to repeat.\n    const { connectionUrl } = await adminClient.upsertApplicationDatabase({\n      databaseName,\n      username,\n      password,\n    });\n\n    return {\n      secretBlobValues: {\n        [POSTGRES_DATABASE_NAME_PATH]: databaseName,\n        [POSTGRES_USERNAME_PATH]: username,\n        [POSTGRES_CONNECT_URL_PATH]: connectionUrl,\n      },\n    };\n  },\n\n  /**\n   * Tear down the per-app Postgres database + role. Idempotent: the\n   * underlying admin client treats missing DB / missing user as\n   * no-ops.\n   *\n   * **Caller status** (F6 of 2026-05-06 plan review): no caller\n   * wires this in Slices 1–4.B.2. Method ships as a forward-compat\n   * seam for whichever future slice designs the app-deletion\n   * lifecycle.\n   *\n   * **Defensive validation** (Slice 4.A.2 / L4 pattern): empty\n   * `appSlug` would derive an empty database name; we fail-loud\n   * instead so a bad caller surfaces immediately.\n   */\n  async revokeAppCredentials(context: AppCredentialMintingContext): Promise<void> {\n    if (!context.appSlug) {\n      throw new Error(\n        `PostgresSelfInfraProviderModule.revokeAppCredentials: ` +\n        `appSlug is empty. ` +\n        `The orchestrator MUST supply a non-empty slug.`,\n      );\n    }\n    const adminClient = context.adminClient as IPostgresAdminClient;\n    const databaseName =\n      context.applicationConfigInputs?.[POSTGRES_DATABASE_NAME_INPUT_KEY]\n      || buildDatabaseName(context.appSlug);\n    const username = buildPostgresPrincipalUsername(context.appSlug, context.principal);\n\n    if (context.principal && context.principal.kind !== ApplicationRuntimePrincipalKind.APPLICATION_BACKEND) {\n      // A named principal owns NOTHING but its own role. Routing it through\n      // `dropApplicationDatabase` — which is what this method did before named\n      // principals existed — would DROP THE APPLICATION'S DATABASE while\n      // believing it was retiring one minion's access.\n      await adminClient.dropTableScopedDatabaseRole({\n        databaseName,\n        username,\n        schemaName: POSTGRES_APPLICATION_SCHEMA,\n      });\n      return;\n    }\n\n    await adminClient.dropApplicationDatabase({ databaseName, username });\n  },\n\n  // No `mintPlatformServiceCredentials` (D-4 of Slice 4.B —\n  // audience-2 not applicable to Postgres_Self today).\n};\n"]}

package/dist/esm/rabbitmq-self/rabbitmq-self.infra.module.d.ts

@@ -0,0 +1,88 @@
+/**
+ * `RabbitmqSelfInfraProviderModule` — first concrete `InfraProviderModule`
+ * (Slices 1–2.5 of `infra-provider-planner.md`).
+ *
+ * Implements the `RABBITMQ_SELF` `InfraProvider` over the
+ * `IRabbitMQManagementClient` transport (raw HTTP `PUT /api/users` etc.,
+ * exposed by `RabbitMQConnectionManagerService` after the 5C policy/
+ * transport split). Owns ALL per-app and per-platform-service
+ * permission policy — the regex shapes, the broader-permission
+ * special case for `crontabs-batches-manager`, the per-app username
+ * convention, the optional vhost activation.
+ *
+ * **What this module reads from `AppCredentialMintingContext`**:
+ * - `applicationNamespace` — used as the rabbit username
+ *   (`<appSlug>-<envId>`, the legacy convention from
+ *   `wildo-application-lifecycle.service.ts`).
+ * - `wildoApplicationId` — used as the permission-regex disambiguator
+ *   (matches `^wildo\.(queue|reply)\.<id>\..*`).
+ * - `secretInputs['database.rabbitmq.password']` — orchestrator-
+ *   supplied password (module is upsert-only, never generator).
+ * - `applicationConfigInputs?.['vhost']` — optional per-app vhost
+ *   for true vhost-level isolation (Slice 2.5c-3).
+ * - `adminClient` — narrowed to `IRabbitMQManagementClient`.
+ *
+ * **What this module IGNORES from the context** (Slice 4.A.2 / M4):
+ * - `appSlug` — RabbitMQ resources are namespace-scoped, not slug-
+ *   scoped. Future modules (MongoDB DB name, etc.) WILL use `appSlug`.
+ *   This is documented forward-compat for module authors: not every
+ *   module reads every context field; each declares which it consumes.
+ *
+ * **Three audiences this module serves:**
+ *
+ * 1. **Audience-1 (platform-admin, declared via `plan().platformAdmin`)**:
+ *    cluster-wide management-API creds (`RABBITMQ_ADMIN_USERNAME` /
+ *    `RABBITMQ_ADMIN_PASSWORD`). Consumers: `apps-manager`,
+ *    `companion`. Delivered through process.env (the CLI's
+ *    `env-vars-builder` writes them per-env). No method.
+ *
+ * 2. **Audience-2 (platform-service-scoped, via
+ *    `mintPlatformServiceCredentials`)**: per-platform-service broker
+ *    users for inter-service messaging (`apps-manager`,
+ *    `crontabs-batches-manager`, `file-generator`). Username =
+ *    `serviceName`; permission regex is service-namespaced
+ *    (`^wildo\.platform\.<slug>\..*`); crontabs gets the broader
+ *    `^wildo\.(queue|reply|platform)\..*` per the legacy override.
+ *
+ *    **Slice 2.5 behavior-parity note**: the legacy code paths
+ *    `provisionServiceCredentials` and `ensureAppsManagerCredentials`
+ *    produced slightly different topic-permission regexes for the
+ *    same apps-manager user (`wildo\.platform\.apps_manager\..*` vs
+ *    `wildo.platform.apps_manager.*`). User permissions were therefore
+ *    order-dependent. This module unifies on the dot-escaped variant.
+ *    Functionally equivalent for real queue names; tighter spec.
+ *
+ *    **Slice 4.A.2 / M2 design note**: the legacy
+ *    `getDefaultRabbitMQPermissions.read` field declared a BROADER
+ *    regex than `configure`/`write` (included
+ *    `wildo.platform.broadcast.*`) — but that widening NEVER reached
+ *    the broker (the legacy `upsertTenantUserPermissions` ignored
+ *    the `read` arg and used `resourceNameRegex` for both
+ *    `configure` and `read`). This module preserves that behavior:
+ *    `read === configure`. If platform services need a broadcast
+ *    namespace in the future, extend `mintPlatformServiceCredentials`
+ *    with an explicit broadcast-read regex.
+ *
+ * 3. **Audience-3 (app-scoped, via `plan().appRuntime` +
+ *    `mintAppCredentials`)**: per-customer-app broker user. Username
+ *    = `applicationNamespace`; permission regex disambiguates by
+ *    `wildoApplicationId` (Mongo ObjectId — globally unique). Result
+ *    threaded into `Wildo_Application_Secrets.database.rabbitmq.{
+ *    username, password}` via `_merge_WildoApplicationSecrets`.
+ *
+ * **Vhost activation (Slice 2.5c-3, opt-in)**: when the operator
+ * authors `backingServices.rabbitmq.vhost` in
+ * `wildo.infra.<envName>.config.ts`, the CLI emits `RABBITMQ_VHOST`
+ * into apps-manager's process.env; the lifecycle service threads it
+ * via `applicationConfigInputs.vhost`; this module
+ * `ensureVhost`-then-permissions-on-it. Without the field, the
+ * module falls back to `/` (legacy permission-regex isolation).
+ *
+ * **`revokeAppCredentials`**: declared and tested, but the integration
+ * call site does NOT exist in `wildo-application-lifecycle.service.ts`
+ * (no app-deletion ceremony today — F6 of plan review 2026-05-06).
+ * Method ships as a forward-compat seam.
+ */
+import { InfraProviderModule } from '@wildo-ai/platform-config-lib';
+export declare const RabbitmqSelfInfraProviderModule: InfraProviderModule;
+//# sourceMappingURL=rabbitmq-self.infra.module.d.ts.map

package/dist/esm/rabbitmq-self/rabbitmq-self.infra.module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rabbitmq-self.infra.module.d.ts","sourceRoot":"","sources":["../../../../src/rabbitmq-self/rabbitmq-self.infra.module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoFG;AAEH,OAAO,EAOL,mBAAmB,EAOpB,MAAM,+BAA+B,CAAC;AAwMvC,eAAO,MAAM,+BAA+B,EAAE,mBAsO7C,CAAC"}