@wildo-ai/platform-infra-providers 1.1.2

package/dist/esm/rabbitmq-self/rabbitmq-self.infra.module.js

@@ -0,0 +1,473 @@
+/**
+ * `RabbitmqSelfInfraProviderModule` — first concrete `InfraProviderModule`
+ * (Slices 1–2.5 of `infra-provider-planner.md`).
+ *
+ * Implements the `RABBITMQ_SELF` `InfraProvider` over the
+ * `IRabbitMQManagementClient` transport (raw HTTP `PUT /api/users` etc.,
+ * exposed by `RabbitMQConnectionManagerService` after the 5C policy/
+ * transport split). Owns ALL per-app and per-platform-service
+ * permission policy — the regex shapes, the broader-permission
+ * special case for `crontabs-batches-manager`, the per-app username
+ * convention, the optional vhost activation.
+ *
+ * **What this module reads from `AppCredentialMintingContext`**:
+ * - `applicationNamespace` — used as the rabbit username
+ *   (`<appSlug>-<envId>`, the legacy convention from
+ *   `wildo-application-lifecycle.service.ts`).
+ * - `wildoApplicationId` — used as the permission-regex disambiguator
+ *   (matches `^wildo\.(queue|reply)\.<id>\..*`).
+ * - `secretInputs['database.rabbitmq.password']` — orchestrator-
+ *   supplied password (module is upsert-only, never generator).
+ * - `applicationConfigInputs?.['vhost']` — optional per-app vhost
+ *   for true vhost-level isolation (Slice 2.5c-3).
+ * - `adminClient` — narrowed to `IRabbitMQManagementClient`.
+ *
+ * **What this module IGNORES from the context** (Slice 4.A.2 / M4):
+ * - `appSlug` — RabbitMQ resources are namespace-scoped, not slug-
+ *   scoped. Future modules (MongoDB DB name, etc.) WILL use `appSlug`.
+ *   This is documented forward-compat for module authors: not every
+ *   module reads every context field; each declares which it consumes.
+ *
+ * **Three audiences this module serves:**
+ *
+ * 1. **Audience-1 (platform-admin, declared via `plan().platformAdmin`)**:
+ *    cluster-wide management-API creds (`RABBITMQ_ADMIN_USERNAME` /
+ *    `RABBITMQ_ADMIN_PASSWORD`). Consumers: `apps-manager`,
+ *    `companion`. Delivered through process.env (the CLI's
+ *    `env-vars-builder` writes them per-env). No method.
+ *
+ * 2. **Audience-2 (platform-service-scoped, via
+ *    `mintPlatformServiceCredentials`)**: per-platform-service broker
+ *    users for inter-service messaging (`apps-manager`,
+ *    `crontabs-batches-manager`, `file-generator`). Username =
+ *    `serviceName`; permission regex is service-namespaced
+ *    (`^wildo\.platform\.<slug>\..*`); crontabs gets the broader
+ *    `^wildo\.(queue|reply|platform)\..*` per the legacy override.
+ *
+ *    **Slice 2.5 behavior-parity note**: the legacy code paths
+ *    `provisionServiceCredentials` and `ensureAppsManagerCredentials`
+ *    produced slightly different topic-permission regexes for the
+ *    same apps-manager user (`wildo\.platform\.apps_manager\..*` vs
+ *    `wildo.platform.apps_manager.*`). User permissions were therefore
+ *    order-dependent. This module unifies on the dot-escaped variant.
+ *    Functionally equivalent for real queue names; tighter spec.
+ *
+ *    **Slice 4.A.2 / M2 design note**: the legacy
+ *    `getDefaultRabbitMQPermissions.read` field declared a BROADER
+ *    regex than `configure`/`write` (included
+ *    `wildo.platform.broadcast.*`) — but that widening NEVER reached
+ *    the broker (the legacy `upsertTenantUserPermissions` ignored
+ *    the `read` arg and used `resourceNameRegex` for both
+ *    `configure` and `read`). This module preserves that behavior:
+ *    `read === configure`. If platform services need a broadcast
+ *    namespace in the future, extend `mintPlatformServiceCredentials`
+ *    with an explicit broadcast-read regex.
+ *
+ * 3. **Audience-3 (app-scoped, via `plan().appRuntime` +
+ *    `mintAppCredentials`)**: per-customer-app broker user. Username
+ *    = `applicationNamespace`; permission regex disambiguates by
+ *    `wildoApplicationId` (Mongo ObjectId — globally unique). Result
+ *    threaded into `Wildo_Application_Secrets.database.rabbitmq.{
+ *    username, password}` via `_merge_WildoApplicationSecrets`.
+ *
+ * **Vhost activation (Slice 2.5c-3, opt-in)**: when the operator
+ * authors `backingServices.rabbitmq.vhost` in
+ * `wildo.infra.<envName>.config.ts`, the CLI emits `RABBITMQ_VHOST`
+ * into apps-manager's process.env; the lifecycle service threads it
+ * via `applicationConfigInputs.vhost`; this module
+ * `ensureVhost`-then-permissions-on-it. Without the field, the
+ * module falls back to `/` (legacy permission-regex isolation).
+ *
+ * **`revokeAppCredentials`**: declared and tested, but the integration
+ * call site does NOT exist in `wildo-application-lifecycle.service.ts`
+ * (no app-deletion ceremony today — F6 of plan review 2026-05-06).
+ * Method ships as a forward-compat seam.
+ */
+import { InfraCapability, InfraPlatformAdminConsumer, InfraProvider, ApplicationRuntimePrincipalKind, buildRuntimePrincipalQueueSegment, } from '@wildo-ai/platform-config-lib';
+/**
+ * Default vhost — apps share `/` with regex-based per-user permission
+ * isolation. Per-app vhost is intentionally NOT modeled (engine has no
+ * `RABBITMQ_VHOST` consumer; isolation comes from the permission regex
+ * on the per-app user, not from a per-app vhost).
+ *
+ * **No `ensureVhost(DEFAULT_VHOST)` call** is needed: vhost `/` is
+ * created by RabbitMQ at server boot. Any future module variant that
+ * uses a non-default vhost MUST call `adminClient.ensureVhost(...)`
+ * before user/permissions setup.
+ */
+const DEFAULT_VHOST = '/';
+/**
+ * Topic exchange used by every Wildo runtime publisher / consumer.
+ * Matches the value already in use at
+ * `wildo-application-lifecycle.service.ts:568` and
+ * `platform-infrastructure-manager.service.ts:485`.
+ */
+const TOPIC_EXCHANGE = 'amq.topic';
+/**
+ * The `Wildo_Application_Secrets` JSON paths this module writes through
+ * `mintAppCredentials`. Declared once and reused as
+ * `appRuntime.perAppSecretBlobPaths` in `plan()` AND as the keys of
+ * `secretBlobValues` in the result, so a refactor that renames a path
+ * fails loudly at one place instead of drifting silently.
+ */
+const RABBITMQ_USERNAME_PATH = 'database.rabbitmq.username';
+const RABBITMQ_PASSWORD_PATH = 'database.rabbitmq.password';
+/**
+ * The paths this module mints PER RUNTIME PRINCIPAL — the single source for both consumers.
+ *
+ * Read by `InfraProviderModule.perPrincipalSecretBlobPaths` (statically, so apps-manager can strip
+ * these from the application blob before delivering a principal's own material) AND spread into
+ * `appRuntime.perAppSecretBlobPaths` inside `plan()`. Declaring the list twice is how the delivery
+ * path would silently stop covering a path this module still mints.
+ */
+const PER_PRINCIPAL_SECRET_BLOB_PATHS = [RABBITMQ_USERNAME_PATH, RABBITMQ_PASSWORD_PATH];
+/**
+ * Key the module looks for in
+ * `AppCredentialMintingContext.applicationConfigInputs` to read the
+ * optional per-app virtual host. Documented here as the public
+ * contract: the orchestrator supplies the vhost via this key, the
+ * module reads it via this key. Slice 2.5c-3 of
+ * `infra-provider-planner.md`.
+ */
+const VHOST_INPUT_KEY = 'vhost';
+/**
+ * Key the module looks for in
+ * `PlatformServiceCredentialMintingContext.secretInputs` to read the
+ * orchestrator-supplied platform-service password. Slice 4.A.2 / M5
+ * of `infra-provider-planner.md` — extracted as a constant for
+ * symmetry with `RABBITMQ_PASSWORD_PATH` (used by `mintAppCredentials`),
+ * so a future rename touches one site instead of drifting silently.
+ */
+const PLATFORM_SERVICE_PASSWORD_INPUT_KEY = 'password';
+/**
+ * Compute the per-app rabbit username. Mirrors the existing convention
+ * at `wildo-application-lifecycle.service.ts:434, 440` — username is
+ * the application namespace (`<appSlug>-<environmentId>` per
+ * `buildApplicationNamespace`), NOT the raw slug. Centralized here so
+ * future changes touch one site.
+ */
+function buildRabbitUsername(applicationNamespace) {
+    return applicationNamespace;
+}
+/**
+ * Identifier of the platform-crontabs-batches-manager service. The
+ * crontabs special case (broader permissions covering all per-app
+ * queue/reply names so it can fan out scheduled jobs) lives here so
+ * the legacy hard-coded check at
+ * `platform-infrastructure-manager.service.ts:466-475` becomes a
+ * module-internal concern.
+ *
+ * Hardcoded as a string literal rather than imported from
+ * `PlatformApplicationType` because that enum lives in saas-models
+ * and importing it here would couple the module to that enum's
+ * runtime shape — the value `'platform_crontabs_batches_manager'` is
+ * stable and small.
+ */
+const PLATFORM_CRONTABS_BATCHES_MANAGER_SERVICE_NAME = 'platform_crontabs_batches_manager';
+/**
+ * Compute the per-platform-service permission regex.
+ *
+ * Default policy (apps-manager, file-generator, …): the service can
+ * configure / write / read on `^wildo\.platform\.<serviceSlug>\..*`
+ * where `serviceSlug = serviceName.replace('platform_', '')`. Mirrors
+ * the legacy `getDefaultRabbitMQPermissions` at
+ * `credentials-provisioner.service.ts:267-275`.
+ *
+ * Crontabs-batches-manager override: broader regex
+ * `^wildo\.(queue|reply|platform)\..*` so the crontab can publish
+ * scheduled jobs onto every per-app queue and read replies. Mirrors
+ * the legacy inline override at
+ * `platform-infrastructure-manager.service.ts:466-475`.
+ */
+function buildPlatformServiceRegex(serviceName) {
+    if (serviceName === PLATFORM_CRONTABS_BATCHES_MANAGER_SERVICE_NAME) {
+        return '^wildo\\.(queue|reply|platform)\\..*';
+    }
+    const serviceSlug = serviceName.replace('platform_', '');
+    return `^wildo\\.platform\\.${serviceSlug}\\..*`;
+}
+/**
+ * Compute the per-app permission regex. Matches the convention at
+ * `wildo-application-lifecycle.service.ts:552`:
+ *   `^wildo\.(queue|reply)\.${wildoApplicationId}\..*`
+ * The disambiguator is the application ID, NOT the slug — slugs could
+ * theoretically be reassigned; the id is forever-stable. The `^` and
+ * `\.` escaping is required by the RabbitMQ regex evaluator.
+ */
+function buildPermissionRegex(wildoApplicationId) {
+    // Escape regex metacharacters that may appear in application ids
+    // (today they're Mongo ObjectId hex strings — no specials — but the
+    // contract only commits to "stable opaque string", so guard).
+    const escapedId = wildoApplicationId.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    return `^wildo\\.(queue|reply)\\.${escapedId}\\..*`;
+}
+/**
+ * The queues a MINION may CONSUME from — its own tick queue only.
+ *
+ * ## Why only `read` narrows, measured rather than assumed
+ *
+ * A minion runs the full backend pipeline headless, so the three RabbitMQ
+ * permission axes are not interchangeable here:
+ *
+ * - **`read`** governs CONSUMING. Narrowing it is the containment that matters:
+ *   without it a minion can drain the application backend's job queue, consume
+ *   another minion's ticks, or read RPC replies addressed to the backend.
+ * - **`configure`** governs DECLARE. The tick consumer declares its own queue
+ *   (`channel.assertQueue`) — but the delayed-publish path can declare a delay
+ *   queue too, so narrowing this risks breaking a legitimate publish.
+ * - **`write`** governs PUBLISHING. A minion legitimately enqueues jobs and
+ *   sends RPC replies into the application's namespace; `publish` calls
+ *   `sendToQueue` WITHOUT asserting (verified in
+ *   `rabbitmq-adapter.backend.service.ts`), so it needs `write` on the app
+ *   namespace and nothing more.
+ *
+ * **What this therefore does NOT prevent, stated plainly:** a minion can still
+ * PUBLISH anywhere in its application's queue namespace — it could enqueue a job
+ * the backend will run. Constraining that is a different control (who may
+ * request what work), not a broker permission, and pretending otherwise would
+ * overstate the boundary.
+ *
+ * The trailing `(\..*)?$` admits the tick queue itself and any suffixed
+ * variant, while the anchored `$` stops it matching a SIBLING whose name merely
+ * starts with this one's.
+ */
+/**
+ * Per-principal broker username — the SAME derivation `revokeAppCredentials`
+ * must use.
+ *
+ * The application backend keeps `applicationNamespace` VERBATIM so an existing
+ * deployment's user is never orphaned. A revoke that derived this differently
+ * would delete the BACKEND's broker user while believing it was removing a
+ * minion's — the identical trap already caught on the Redis side.
+ */
+function buildRabbitPrincipalUsername(applicationNamespace, principal) {
+    if (!principal || principal.kind === ApplicationRuntimePrincipalKind.APPLICATION_BACKEND) {
+        return buildRabbitUsername(applicationNamespace);
+    }
+    const sanitizedName = (principal.name ?? '').replace(/[^a-zA-Z0-9]+/g, '-').replace(/^-+|-+$/g, '');
+    return `${applicationNamespace}-${principal.kind}-${sanitizedName}`;
+}
+function buildMinionConsumeRegex(wildoApplicationId, minionName) {
+    const escape = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const appId = escape(wildoApplicationId);
+    const name = escape(minionName);
+    // Two alternatives, and nothing else:
+    //   its tick queue      — wildo.queue.<appId>.minion-tick.<name>
+    //   its OWN reply queue — wildo.reply.<appId>.<segment>.<podId>
+    // The reply segment is IMPORTED from the same builder the minion's own AMQP
+    // adapter uses, not reproduced here. It used to be hand-written as
+    // `minion-<name>` with a comment saying it "mirrors" what the adapter emits —
+    // which agreed only while every minion name survived sanitisation unchanged.
+    // The application backend gets no segment at all (the builder returns
+    // undefined for it), keeping the historical layout, so this cannot match its
+    // replies.
+    const replySegment = escape(buildRuntimePrincipalQueueSegment(ApplicationRuntimePrincipalKind.MINION, minionName) ?? '');
+    return `^(wildo\\.queue\\.${appId}\\.minion-tick\\.${name}(\\..*)?`
+        + `|wildo\\.reply\\.${appId}\\.${replySegment}\\..*)$`;
+}
+export const RabbitmqSelfInfraProviderModule = {
+    provider: InfraProvider.RABBITMQ_SELF,
+    supportedCapabilities: [InfraCapability.QUEUING_SYSTEM],
+    perPrincipalSecretBlobPaths: PER_PRINCIPAL_SECRET_BLOB_PATHS,
+    plan() {
+        return {
+            dockerComposeServices: ['rabbitmq'],
+            k8sResources: ['templates/infra/k8s/internal/rabbitmq/deployment.yaml.hbs'],
+            platformAdmin: {
+                envVars: {
+                    RABBITMQ_HOST: 'rabbitmq',
+                    RABBITMQ_PORT: '5672',
+                    RABBITMQ_MANAGEMENT_PORT: '15672',
+                },
+                secretEnvVars: ['RABBITMQ_ADMIN_USERNAME', 'RABBITMQ_ADMIN_PASSWORD'],
+                // Audience-1 only (management-API access). audience-2 platform-
+                // service-scoped consumers (apps-manager / crontabs / file-
+                // generator publish-consume creds via `provisionAllPlatformServices`)
+                // are LD-8 territory, deferred to Slice 2.5 — they get their
+                // own `mintPlatformServiceCredentials` method then.
+                consumers: [
+                    InfraPlatformAdminConsumer.APPS_MANAGER,
+                    InfraPlatformAdminConsumer.COMPANION,
+                ],
+            },
+            appRuntime: {
+                // Declared for forward-compat with Slice 2.5's
+                // `_merge_WildoApplicationConfig` integration. Not consumed by
+                // any planner path in Slice 2 — the existing hard-coded values
+                // at `wildo-application-lifecycle.service.ts:1796-1799` stay in
+                // effect (host: 'localhost', port: 5672) until the planner
+                // wires this slice's contribution.
+                perAppConfigBlobPaths: {
+                    'database.rabbitmq.host': 'rabbitmq',
+                    'database.rabbitmq.port': 5672,
+                },
+                perAppSecretBlobPaths: [...PER_PRINCIPAL_SECRET_BLOB_PATHS],
+            },
+        };
+    },
+    async mintAppCredentials(context) {
+        const adminClient = context.adminClient;
+        const password = context.secretInputs[RABBITMQ_PASSWORD_PATH];
+        if (!password) {
+            throw new Error(`RabbitmqSelfInfraProviderModule.mintAppCredentials: ` +
+                `secretInputs is missing '${RABBITMQ_PASSWORD_PATH}'. ` +
+                `The orchestrator MUST supply the rabbit password — modules are upsert-only.`);
+        }
+        const username = buildRabbitPrincipalUsername(context.applicationNamespace, context.principal);
+        const permissionRegex = buildPermissionRegex(context.wildoApplicationId);
+        // A MINION consumes exactly two things: its own tick queue, and its own RPC
+        // REPLY queue. Both are admitted; everything else in the application's
+        // namespace is refused.
+        //
+        // The reply half is why an earlier attempt at this failed. Reply queues used
+        // to be `wildo.reply.<appId>.<podId>`, and `podId` is a per-PROCESS token
+        // carrying no principal — so no regex could admit a minion's replies while
+        // refusing the backend's, and narrowing `read` crash-looped the minion on
+        // its own replies. `buildReplyQueueName` now embeds the owning runtime,
+        // which is what makes this expressible at all.
+        const readRegex = context.principal?.kind === ApplicationRuntimePrincipalKind.MINION && context.principal.name
+            ? buildMinionConsumeRegex(context.wildoApplicationId, context.principal.name)
+            : permissionRegex;
+        // Slice 2.5c-3: optional per-app vhost. When the orchestrator
+        // supplies a non-empty `applicationConfigInputs.vhost`, the module
+        // ensures the vhost exists and sets permissions ON THAT vhost
+        // (provides true vhost-level isolation). When omitted, the module
+        // falls back to the default vhost `/` (legacy Slice 2 behavior:
+        // permission-regex isolation only). This is the opt-in seam — apps
+        // without an authored `backingServices.rabbitmq.vhost` continue to
+        // share `/`.
+        const vhost = context.applicationConfigInputs?.[VHOST_INPUT_KEY] || DEFAULT_VHOST;
+        if (vhost !== DEFAULT_VHOST) {
+            await adminClient.ensureVhost(vhost);
+        }
+        // PUT /api/users — idempotent upsert (replaces password + tags on conflict).
+        await adminClient.putUser(username, password, []);
+        // PUT /api/permissions — `configure` and `read` use the per-app
+        // queue/reply regex; `write` widens to allow `amq.default` (the
+        // default exchange RabbitMQ uses for direct routing) and the empty
+        // string (broker-internal). Mirrors the legacy
+        // `upsertTenantUserPermissions` write-regex shape so the Wonder
+        // Todos behavior is unchanged.
+        const writeRegex = `(^$|amq\\.default|${permissionRegex})`;
+        await adminClient.setPermissions(vhost, username, {
+            configure: permissionRegex,
+            write: writeRegex,
+            read: readRegex,
+        });
+        // PUT /api/topic-permissions — same regex on the topic exchange.
+        await adminClient.setTopicPermissions(vhost, username, {
+            exchange: TOPIC_EXCHANGE,
+            write: permissionRegex,
+            read: readRegex,
+        });
+        // Per-app-vhost cron delivery (`.claude/plans/crontab-publisher-vhost-gap.md`).
+        //
+        // A per-app vhost is a HARD broker isolation boundary: the platform
+        // cron/minion publisher (`platform_crontabs_batches_manager`) — a single
+        // global user that fans scheduled jobs into every app — cannot reach THIS
+        // app's queues until granted access on THIS vhost. On the default vhost `/`
+        // it already holds a broad publish grant (see `mintPlatformServiceCredentials`),
+        // so the grant is only needed for a non-default per-app vhost.
+        //
+        // Scope it to this app's own queue namespace (`^wildo\.(queue|reply)\.<appId>\..*`)
+        // — the publisher gets exactly the reach it needs and no more, TIGHTER than
+        // its broad default-vhost grant. It is PUBLISH-ONLY: `configure` for the
+        // passive `checkQueue` existence probe the publisher runs before sending +
+        // any declare, `write` (`amq.default`) for `basic.publish`; NO `read` (never
+        // consumes) and NO topic permissions (uses the default exchange, not
+        // `amq.topic`). The crontabs user is provisioned before any app
+        // (apps-manager INIT Phase 4 < Phase 5), so it reliably exists here, and
+        // `setPermissions` is an idempotent PUT — a re-init safely re-applies it.
+        if (vhost !== DEFAULT_VHOST) {
+            await adminClient.setPermissions(vhost, PLATFORM_CRONTABS_BATCHES_MANAGER_SERVICE_NAME, {
+                configure: permissionRegex,
+                write: writeRegex,
+                read: '',
+            });
+        }
+        return {
+            secretBlobValues: {
+                [RABBITMQ_USERNAME_PATH]: username,
+                // Echo the orchestrator-supplied password — proves the module
+                // is upsert-only, not generator. The orchestrator persists
+                // this exact value into `Wildo_Application_Secrets`.
+                [RABBITMQ_PASSWORD_PATH]: password,
+            },
+        };
+    },
+    /**
+     * Tear down the per-app rabbit user. RabbitMQ users are global, so
+     * `deleteUser` removes the user (and its permissions on every vhost
+     * it had access to) atomically.
+     *
+     * **Vhost retention** (Slice 4.A.2 / M6): when `mintAppCredentials`
+     * provisioned a per-app vhost (Slice 2.5c-3), `revokeAppCredentials`
+     * does NOT delete the vhost. Reasoning: vhost deletion drops every
+     * queue and exchange inside it, which would destroy in-flight
+     * messages mid-flight if a redeploy or restart is happening
+     * concurrently. The user-deletion alone is sufficient to revoke
+     * access; the empty vhost lingers as a paper trail. A future
+     * "app-deletion lifecycle" slice can layer vhost cleanup with
+     * proper drain semantics.
+     *
+     * **Caller status** (F6 of 2026-05-06 plan review): no caller wires
+     * this in Slices 1–2.5. `wildo-application-lifecycle.service.ts`
+     * has no app-deletion ceremony to invoke it from. Method ships as a
+     * forward-compat seam for whichever future slice designs the
+     * app-deletion lifecycle.
+     *
+     * **Defensive validation** (Slice 4.A.2 / L4): empty
+     * `applicationNamespace` would call `DELETE /api/users/` and
+     * silently 404; we fail-loud instead so a bad caller surfaces
+     * immediately.
+     */
+    async revokeAppCredentials(context) {
+        if (!context.applicationNamespace) {
+            throw new Error(`RabbitmqSelfInfraProviderModule.revokeAppCredentials: ` +
+                `applicationNamespace is empty. ` +
+                `The orchestrator MUST supply a non-empty namespace.`);
+        }
+        const adminClient = context.adminClient;
+        const username = buildRabbitPrincipalUsername(context.applicationNamespace, context.principal);
+        await adminClient.deleteUser(username);
+    },
+    async mintPlatformServiceCredentials(context) {
+        const adminClient = context.adminClient;
+        const password = context.secretInputs[PLATFORM_SERVICE_PASSWORD_INPUT_KEY];
+        if (!password) {
+            throw new Error(`RabbitmqSelfInfraProviderModule.mintPlatformServiceCredentials: ` +
+                `secretInputs is missing '${PLATFORM_SERVICE_PASSWORD_INPUT_KEY}'. ` +
+                `The orchestrator MUST supply the platform-service password — modules are upsert-only.`);
+        }
+        // Username is the platform service identifier verbatim — preserves
+        // the legacy convention from
+        // `PlatformInfrastructureManagerService.provisionServiceCredentials`
+        // (line 478: `username: serviceName`).
+        const username = context.serviceName;
+        const permissionRegex = buildPlatformServiceRegex(context.serviceName);
+        // PUT /api/users — idempotent upsert.
+        await adminClient.putUser(username, password, []);
+        // Permissions: configure/read use the per-service regex; write
+        // widens to allow `amq.default` + empty string (broker-internal),
+        // matching the `upsertTenantUserPermissions` write-regex shape so
+        // post-Slice-2.5 broker permissions match pre-Slice-2.5.
+        const writeRegex = `(^$|amq\\.default|${permissionRegex})`;
+        await adminClient.setPermissions(DEFAULT_VHOST, username, {
+            configure: permissionRegex,
+            write: writeRegex,
+            read: permissionRegex,
+        });
+        // Topic permissions: same dot-escaped regex on amq.topic. The
+        // legacy two-caller divergence (one path stripped the `^` and
+        // produced `wildo\.platform\.<slug>\..*`; the other produced
+        // `wildo.platform.<slug>.*` with literal dots) is unified here on
+        // the dot-escaped variant — see module JSDoc behavior-parity note.
+        await adminClient.setTopicPermissions(DEFAULT_VHOST, username, {
+            exchange: TOPIC_EXCHANGE,
+            write: permissionRegex,
+            read: permissionRegex,
+        });
+        return { username };
+    },
+};
+//# sourceMappingURL=rabbitmq-self.infra.module.js.map

package/dist/esm/rabbitmq-self/rabbitmq-self.infra.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rabbitmq-self.infra.module.js","sourceRoot":"","sources":["../../../../src/rabbitmq-self/rabbitmq-self.infra.module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoFG;AAEH,OAAO,EAIL,eAAe,EACf,0BAA0B,EAC1B,aAAa,EAKb,+BAA+B,EAC/B,iCAAiC,GAElC,MAAM,+BAA+B,CAAC;AAEvC;;;;;;;;;;GAUG;AACH,MAAM,aAAa,GAAG,GAAG,CAAC;AAE1B;;;;;GAKG;AACH,MAAM,cAAc,GAAG,WAAW,CAAC;AAEnC;;;;;;GAMG;AACH,MAAM,sBAAsB,GAAG,4BAA4B,CAAC;AAC5D,MAAM,sBAAsB,GAAG,4BAA4B,CAAC;AAC5D;;;;;;;GAOG;AACH,MAAM,+BAA+B,GAA0B,CAAC,sBAAsB,EAAE,sBAAsB,CAAC,CAAC;AAGhH;;;;;;;GAOG;AACH,MAAM,eAAe,GAAG,OAAO,CAAC;AAEhC;;;;;;;GAOG;AACH,MAAM,mCAAmC,GAAG,UAAU,CAAC;AAEvD;;;;;;GAMG;AACH,SAAS,mBAAmB,CAAC,oBAA4B;IACvD,OAAO,oBAAoB,CAAC;AAC9B,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,8CAA8C,GAAG,mCAAmC,CAAC;AAE3F;;;;;;;;;;;;;;GAcG;AACH,SAAS,yBAAyB,CAAC,WAAmB;IACpD,IAAI,WAAW,KAAK,8CAA8C,EAAE,CAAC;QACnE,OAAO,sCAAsC,CAAC;IAChD,CAAC;IACD,MAAM,WAAW,GAAG,WAAW,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACzD,OAAO,uBAAuB,WAAW,OAAO,CAAC;AACnD,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,oBAAoB,CAAC,kBAA0B;IACtD,iEAAiE;IACjE,oEAAoE;IACpE,8DAA8D;IAC9D,MAAM,SAAS,GAAG,kBAAkB,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;IAC5E,OAAO,4BAA4B,SAAS,OAAO,CAAC;AACtD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH;;;;;;;;GAQG;AACH,SAAS,4BAA4B,CACnC,oBAA4B,EAC5B,SAAkD;IAElD,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,IAAI,KAAK,+BAA+B,CAAC,mBAAmB,EAAE,CAAC;QACzF,OAAO,mBAAmB,CAAC,oBAAoB,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,aAAa,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACpG,OAAO,GAAG,oBAAoB,IAAI,SAAS,CAAC,IAAI,IAAI,aAAa,EAAE,CAAC;AACtE,CAAC;AAED,SAAS,uBAAuB,CAAC,kBAA0B,EAAE,UAAkB;IAC7E,MAAM,MAAM,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;IACvF,MAAM,KAAK,GAAG,MAAM,CAAC,kBAAkB,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;IAChC,sCAAsC;IACtC,iEAAiE;IACjE,gEAAgE;IAChE,4EAA4E;IAC5E,mEAAmE;IACnE,8EAA8E;IAC9E,6EAA6E;IAC7E,sEAAsE;IACtE,6EAA6E;IAC7E,WAAW;IACX,MAAM,YAAY,GAAG,MAAM,CACzB,iCAAiC,CAAC,+BAA+B,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,EAAE,CAC5F,CAAC;IACF,OAAO,qBAAqB,KAAK,oBAAoB,IAAI,UAAU;UAC/D,oBAAoB,KAAK,MAAM,YAAY,SAAS,CAAC;AAC3D,CAAC;AAED,MAAM,CAAC,MAAM,+BAA+B,GAAwB;IAClE,QAAQ,EAAE,aAAa,CAAC,aAAa;IACrC,qBAAqB,EAAE,CAAC,eAAe,CAAC,cAAc,CAAC;IACvD,2BAA2B,EAAE,+BAA+B;IAE5D,IAAI;QACF,OAAO;YACL,qBAAqB,EAAE,CAAC,UAAU,CAAC;YACnC,YAAY,EAAE,CAAC,2DAA2D,CAAC;YAC3E,aAAa,EAAE;gBACb,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU;oBACzB,aAAa,EAAE,MAAM;oBACrB,wBAAwB,EAAE,OAAO;iBAClC;gBACD,aAAa,EAAE,CAAC,yBAAyB,EAAE,yBAAyB,CAAC;gBACrE,gEAAgE;gBAChE,4DAA4D;gBAC5D,sEAAsE;gBACtE,6DAA6D;gBAC7D,oDAAoD;gBACpD,SAAS,EAAE;oBACT,0BAA0B,CAAC,YAAY;oBACvC,0BAA0B,CAAC,SAAS;iBACrC;aACF;YACD,UAAU,EAAE;gBACV,+CAA+C;gBAC/C,+DAA+D;gBAC/D,+DAA+D;gBAC/D,gEAAgE;gBAChE,2DAA2D;gBAC3D,mCAAmC;gBACnC,qBAAqB,EAAE;oBACrB,wBAAwB,EAAE,UAAU;oBACpC,wBAAwB,EAAE,IAAI;iBAC/B;gBACD,qBAAqB,EAAE,CAAC,GAAG,+BAA+B,CAAC;aAC5D;SACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,OAAoC;QAEpC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAwC,CAAC;QACrE,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAC,sBAAsB,CAAC,CAAC;QAC9D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CACb,sDAAsD;gBACtD,4BAA4B,sBAAsB,KAAK;gBACvD,6EAA6E,CAC9E,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,4BAA4B,CAAC,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAC/F,MAAM,eAAe,GAAG,oBAAoB,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;QACzE,4EAA4E;QAC5E,uEAAuE;QACvE,wBAAwB;QACxB,EAAE;QACF,6EAA6E;QAC7E,0EAA0E;QAC1E,2EAA2E;QAC3E,0EAA0E;QAC1E,wEAAwE;QACxE,+CAA+C;QAC/C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,EAAE,IAAI,KAAK,+BAA+B,CAAC,MAAM,IAAI,OAAO,CAAC,SAAS,CAAC,IAAI;YAC5G,CAAC,CAAC,uBAAuB,CAAC,OAAO,CAAC,kBAAkB,EAAE,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC;YAC7E,CAAC,CAAC,eAAe,CAAC;QAEpB,8DAA8D;QAC9D,mEAAmE;QACnE,8DAA8D;QAC9D,kEAAkE;QAClE,gEAAgE;QAChE,mEAAmE;QACnE,mEAAmE;QACnE,aAAa;QACb,MAAM,KAAK,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,eAAe,CAAC,IAAI,aAAa,CAAC;QAClF,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;YAC5B,MAAM,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC;QAED,6EAA6E;QAC7E,MAAM,WAAW,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QAElD,gEAAgE;QAChE,gEAAgE;QAChE,mEAAmE;QACnE,+CAA+C;QAC/C,gEAAgE;QAChE,+BAA+B;QAC/B,MAAM,UAAU,GAAG,qBAAqB,eAAe,GAAG,CAAC;QAC3D,MAAM,WAAW,CAAC,cAAc,CAAC,KAAK,EAAE,QAAQ,EAAE;YAChD,SAAS,EAAE,eAAe;YAC1B,KAAK,EAAE,UAAU;YACjB,IAAI,EAAE,SAAS;SAChB,CAAC,CAAC;QAEH,iEAAiE;QACjE,MAAM,WAAW,CAAC,mBAAmB,CAAC,KAAK,EAAE,QAAQ,EAAE;YACrD,QAAQ,EAAE,cAAc;YACxB,KAAK,EAAE,eAAe;YACtB,IAAI,EAAE,SAAS;SAChB,CAAC,CAAC;QAEH,gFAAgF;QAChF,EAAE;QACF,oEAAoE;QACpE,yEAAyE;QACzE,0EAA0E;QAC1E,4EAA4E;QAC5E,iFAAiF;QACjF,+DAA+D;QAC/D,EAAE;QACF,oFAAoF;QACpF,4EAA4E;QAC5E,yEAAyE;QACzE,2EAA2E;QAC3E,6EAA6E;QAC7E,qEAAqE;QACrE,gEAAgE;QAChE,yEAAyE;QACzE,0EAA0E;QAC1E,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;YAC5B,MAAM,WAAW,CAAC,cAAc,CAAC,KAAK,EAAE,8CAA8C,EAAE;gBACtF,SAAS,EAAE,eAAe;gBAC1B,KAAK,EAAE,UAAU;gBACjB,IAAI,EAAE,EAAE;aACT,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,gBAAgB,EAAE;gBAChB,CAAC,sBAAsB,CAAC,EAAE,QAAQ;gBAClC,8DAA8D;gBAC9D,2DAA2D;gBAC3D,qDAAqD;gBACrD,CAAC,sBAAsB,CAAC,EAAE,QAAQ;aACnC;SACF,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,KAAK,CAAC,oBAAoB,CAAC,OAAoC;QAC7D,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CACb,wDAAwD;gBACxD,iCAAiC;gBACjC,qDAAqD,CACtD,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAwC,CAAC;QACrE,MAAM,QAAQ,GAAG,4BAA4B,CAAC,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAC/F,MAAM,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,8BAA8B,CAClC,OAAgD;QAEhD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAwC,CAAC;QACrE,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAC,mCAAmC,CAAC,CAAC;QAC3E,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CACb,kEAAkE;gBAClE,4BAA4B,mCAAmC,KAAK;gBACpE,uFAAuF,CACxF,CAAC;QACJ,CAAC;QAED,mEAAmE;QACnE,6BAA6B;QAC7B,qEAAqE;QACrE,uCAAuC;QACvC,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC;QACrC,MAAM,eAAe,GAAG,yBAAyB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAEvE,sCAAsC;QACtC,MAAM,WAAW,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QAElD,+DAA+D;QAC/D,kEAAkE;QAClE,kEAAkE;QAClE,yDAAyD;QACzD,MAAM,UAAU,GAAG,qBAAqB,eAAe,GAAG,CAAC;QAC3D,MAAM,WAAW,CAAC,cAAc,CAAC,aAAa,EAAE,QAAQ,EAAE;YACxD,SAAS,EAAE,eAAe;YAC1B,KAAK,EAAE,UAAU;YACjB,IAAI,EAAE,eAAe;SACtB,CAAC,CAAC;QAEH,8DAA8D;QAC9D,8DAA8D;QAC9D,6DAA6D;QAC7D,kEAAkE;QAClE,mEAAmE;QACnE,MAAM,WAAW,CAAC,mBAAmB,CAAC,aAAa,EAAE,QAAQ,EAAE;YAC7D,QAAQ,EAAE,cAAc;YACxB,KAAK,EAAE,eAAe;YACtB,IAAI,EAAE,eAAe;SACtB,CAAC,CAAC;QAEH,OAAO,EAAE,QAAQ,EAAE,CAAC;IACtB,CAAC;CACF,CAAC","sourcesContent":["/**\n * `RabbitmqSelfInfraProviderModule` — first concrete `InfraProviderModule`\n * (Slices 1–2.5 of `infra-provider-planner.md`).\n *\n * Implements the `RABBITMQ_SELF` `InfraProvider` over the\n * `IRabbitMQManagementClient` transport (raw HTTP `PUT /api/users` etc.,\n * exposed by `RabbitMQConnectionManagerService` after the 5C policy/\n * transport split). Owns ALL per-app and per-platform-service\n * permission policy — the regex shapes, the broader-permission\n * special case for `crontabs-batches-manager`, the per-app username\n * convention, the optional vhost activation.\n *\n * **What this module reads from `AppCredentialMintingContext`**:\n * - `applicationNamespace` — used as the rabbit username\n *   (`<appSlug>-<envId>`, the legacy convention from\n *   `wildo-application-lifecycle.service.ts`).\n * - `wildoApplicationId` — used as the permission-regex disambiguator\n *   (matches `^wildo\\.(queue|reply)\\.<id>\\..*`).\n * - `secretInputs['database.rabbitmq.password']` — orchestrator-\n *   supplied password (module is upsert-only, never generator).\n * - `applicationConfigInputs?.['vhost']` — optional per-app vhost\n *   for true vhost-level isolation (Slice 2.5c-3).\n * - `adminClient` — narrowed to `IRabbitMQManagementClient`.\n *\n * **What this module IGNORES from the context** (Slice 4.A.2 / M4):\n * - `appSlug` — RabbitMQ resources are namespace-scoped, not slug-\n *   scoped. Future modules (MongoDB DB name, etc.) WILL use `appSlug`.\n *   This is documented forward-compat for module authors: not every\n *   module reads every context field; each declares which it consumes.\n *\n * **Three audiences this module serves:**\n *\n * 1. **Audience-1 (platform-admin, declared via `plan().platformAdmin`)**:\n *    cluster-wide management-API creds (`RABBITMQ_ADMIN_USERNAME` /\n *    `RABBITMQ_ADMIN_PASSWORD`). Consumers: `apps-manager`,\n *    `companion`. Delivered through process.env (the CLI's\n *    `env-vars-builder` writes them per-env). No method.\n *\n * 2. **Audience-2 (platform-service-scoped, via\n *    `mintPlatformServiceCredentials`)**: per-platform-service broker\n *    users for inter-service messaging (`apps-manager`,\n *    `crontabs-batches-manager`, `file-generator`). Username =\n *    `serviceName`; permission regex is service-namespaced\n *    (`^wildo\\.platform\\.<slug>\\..*`); crontabs gets the broader\n *    `^wildo\\.(queue|reply|platform)\\..*` per the legacy override.\n *\n *    **Slice 2.5 behavior-parity note**: the legacy code paths\n *    `provisionServiceCredentials` and `ensureAppsManagerCredentials`\n *    produced slightly different topic-permission regexes for the\n *    same apps-manager user (`wildo\\.platform\\.apps_manager\\..*` vs\n *    `wildo.platform.apps_manager.*`). User permissions were therefore\n *    order-dependent. This module unifies on the dot-escaped variant.\n *    Functionally equivalent for real queue names; tighter spec.\n *\n *    **Slice 4.A.2 / M2 design note**: the legacy\n *    `getDefaultRabbitMQPermissions.read` field declared a BROADER\n *    regex than `configure`/`write` (included\n *    `wildo.platform.broadcast.*`) — but that widening NEVER reached\n *    the broker (the legacy `upsertTenantUserPermissions` ignored\n *    the `read` arg and used `resourceNameRegex` for both\n *    `configure` and `read`). This module preserves that behavior:\n *    `read === configure`. If platform services need a broadcast\n *    namespace in the future, extend `mintPlatformServiceCredentials`\n *    with an explicit broadcast-read regex.\n *\n * 3. **Audience-3 (app-scoped, via `plan().appRuntime` +\n *    `mintAppCredentials`)**: per-customer-app broker user. Username\n *    = `applicationNamespace`; permission regex disambiguates by\n *    `wildoApplicationId` (Mongo ObjectId — globally unique). Result\n *    threaded into `Wildo_Application_Secrets.database.rabbitmq.{\n *    username, password}` via `_merge_WildoApplicationSecrets`.\n *\n * **Vhost activation (Slice 2.5c-3, opt-in)**: when the operator\n * authors `backingServices.rabbitmq.vhost` in\n * `wildo.infra.<envName>.config.ts`, the CLI emits `RABBITMQ_VHOST`\n * into apps-manager's process.env; the lifecycle service threads it\n * via `applicationConfigInputs.vhost`; this module\n * `ensureVhost`-then-permissions-on-it. Without the field, the\n * module falls back to `/` (legacy permission-regex isolation).\n *\n * **`revokeAppCredentials`**: declared and tested, but the integration\n * call site does NOT exist in `wildo-application-lifecycle.service.ts`\n * (no app-deletion ceremony today — F6 of plan review 2026-05-06).\n * Method ships as a forward-compat seam.\n */\n\nimport {\n  AppCredentialMintingContext,\n  AppCredentialMintingResult,\n  IRabbitMQManagementClient,\n  InfraCapability,\n  InfraPlatformAdminConsumer,\n  InfraProvider,\n  InfraProviderModule,\n  InfraProviderPlanContribution,\n  PlatformServiceCredentialMintingContext,\n  PlatformServiceCredentialMintingResult,\n  ApplicationRuntimePrincipalKind,\n  buildRuntimePrincipalQueueSegment,\n  type ApplicationRuntimePrincipal,\n} from '@wildo-ai/platform-config-lib';\n\n/**\n * Default vhost — apps share `/` with regex-based per-user permission\n * isolation. Per-app vhost is intentionally NOT modeled (engine has no\n * `RABBITMQ_VHOST` consumer; isolation comes from the permission regex\n * on the per-app user, not from a per-app vhost).\n *\n * **No `ensureVhost(DEFAULT_VHOST)` call** is needed: vhost `/` is\n * created by RabbitMQ at server boot. Any future module variant that\n * uses a non-default vhost MUST call `adminClient.ensureVhost(...)`\n * before user/permissions setup.\n */\nconst DEFAULT_VHOST = '/';\n\n/**\n * Topic exchange used by every Wildo runtime publisher / consumer.\n * Matches the value already in use at\n * `wildo-application-lifecycle.service.ts:568` and\n * `platform-infrastructure-manager.service.ts:485`.\n */\nconst TOPIC_EXCHANGE = 'amq.topic';\n\n/**\n * The `Wildo_Application_Secrets` JSON paths this module writes through\n * `mintAppCredentials`. Declared once and reused as\n * `appRuntime.perAppSecretBlobPaths` in `plan()` AND as the keys of\n * `secretBlobValues` in the result, so a refactor that renames a path\n * fails loudly at one place instead of drifting silently.\n */\nconst RABBITMQ_USERNAME_PATH = 'database.rabbitmq.username';\nconst RABBITMQ_PASSWORD_PATH = 'database.rabbitmq.password';\n/**\n * The paths this module mints PER RUNTIME PRINCIPAL — the single source for both consumers.\n *\n * Read by `InfraProviderModule.perPrincipalSecretBlobPaths` (statically, so apps-manager can strip\n * these from the application blob before delivering a principal's own material) AND spread into\n * `appRuntime.perAppSecretBlobPaths` inside `plan()`. Declaring the list twice is how the delivery\n * path would silently stop covering a path this module still mints.\n */\nconst PER_PRINCIPAL_SECRET_BLOB_PATHS: ReadonlyArray<string> = [RABBITMQ_USERNAME_PATH, RABBITMQ_PASSWORD_PATH];\n\n\n/**\n * Key the module looks for in\n * `AppCredentialMintingContext.applicationConfigInputs` to read the\n * optional per-app virtual host. Documented here as the public\n * contract: the orchestrator supplies the vhost via this key, the\n * module reads it via this key. Slice 2.5c-3 of\n * `infra-provider-planner.md`.\n */\nconst VHOST_INPUT_KEY = 'vhost';\n\n/**\n * Key the module looks for in\n * `PlatformServiceCredentialMintingContext.secretInputs` to read the\n * orchestrator-supplied platform-service password. Slice 4.A.2 / M5\n * of `infra-provider-planner.md` — extracted as a constant for\n * symmetry with `RABBITMQ_PASSWORD_PATH` (used by `mintAppCredentials`),\n * so a future rename touches one site instead of drifting silently.\n */\nconst PLATFORM_SERVICE_PASSWORD_INPUT_KEY = 'password';\n\n/**\n * Compute the per-app rabbit username. Mirrors the existing convention\n * at `wildo-application-lifecycle.service.ts:434, 440` — username is\n * the application namespace (`<appSlug>-<environmentId>` per\n * `buildApplicationNamespace`), NOT the raw slug. Centralized here so\n * future changes touch one site.\n */\nfunction buildRabbitUsername(applicationNamespace: string): string {\n  return applicationNamespace;\n}\n\n/**\n * Identifier of the platform-crontabs-batches-manager service. The\n * crontabs special case (broader permissions covering all per-app\n * queue/reply names so it can fan out scheduled jobs) lives here so\n * the legacy hard-coded check at\n * `platform-infrastructure-manager.service.ts:466-475` becomes a\n * module-internal concern.\n *\n * Hardcoded as a string literal rather than imported from\n * `PlatformApplicationType` because that enum lives in saas-models\n * and importing it here would couple the module to that enum's\n * runtime shape — the value `'platform_crontabs_batches_manager'` is\n * stable and small.\n */\nconst PLATFORM_CRONTABS_BATCHES_MANAGER_SERVICE_NAME = 'platform_crontabs_batches_manager';\n\n/**\n * Compute the per-platform-service permission regex.\n *\n * Default policy (apps-manager, file-generator, …): the service can\n * configure / write / read on `^wildo\\.platform\\.<serviceSlug>\\..*`\n * where `serviceSlug = serviceName.replace('platform_', '')`. Mirrors\n * the legacy `getDefaultRabbitMQPermissions` at\n * `credentials-provisioner.service.ts:267-275`.\n *\n * Crontabs-batches-manager override: broader regex\n * `^wildo\\.(queue|reply|platform)\\..*` so the crontab can publish\n * scheduled jobs onto every per-app queue and read replies. Mirrors\n * the legacy inline override at\n * `platform-infrastructure-manager.service.ts:466-475`.\n */\nfunction buildPlatformServiceRegex(serviceName: string): string {\n  if (serviceName === PLATFORM_CRONTABS_BATCHES_MANAGER_SERVICE_NAME) {\n    return '^wildo\\\\.(queue|reply|platform)\\\\..*';\n  }\n  const serviceSlug = serviceName.replace('platform_', '');\n  return `^wildo\\\\.platform\\\\.${serviceSlug}\\\\..*`;\n}\n\n/**\n * Compute the per-app permission regex. Matches the convention at\n * `wildo-application-lifecycle.service.ts:552`:\n *   `^wildo\\.(queue|reply)\\.${wildoApplicationId}\\..*`\n * The disambiguator is the application ID, NOT the slug — slugs could\n * theoretically be reassigned; the id is forever-stable. The `^` and\n * `\\.` escaping is required by the RabbitMQ regex evaluator.\n */\nfunction buildPermissionRegex(wildoApplicationId: string): string {\n  // Escape regex metacharacters that may appear in application ids\n  // (today they're Mongo ObjectId hex strings — no specials — but the\n  // contract only commits to \"stable opaque string\", so guard).\n  const escapedId = wildoApplicationId.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n  return `^wildo\\\\.(queue|reply)\\\\.${escapedId}\\\\..*`;\n}\n\n/**\n * The queues a MINION may CONSUME from — its own tick queue only.\n *\n * ## Why only `read` narrows, measured rather than assumed\n *\n * A minion runs the full backend pipeline headless, so the three RabbitMQ\n * permission axes are not interchangeable here:\n *\n * - **`read`** governs CONSUMING. Narrowing it is the containment that matters:\n *   without it a minion can drain the application backend's job queue, consume\n *   another minion's ticks, or read RPC replies addressed to the backend.\n * - **`configure`** governs DECLARE. The tick consumer declares its own queue\n *   (`channel.assertQueue`) — but the delayed-publish path can declare a delay\n *   queue too, so narrowing this risks breaking a legitimate publish.\n * - **`write`** governs PUBLISHING. A minion legitimately enqueues jobs and\n *   sends RPC replies into the application's namespace; `publish` calls\n *   `sendToQueue` WITHOUT asserting (verified in\n *   `rabbitmq-adapter.backend.service.ts`), so it needs `write` on the app\n *   namespace and nothing more.\n *\n * **What this therefore does NOT prevent, stated plainly:** a minion can still\n * PUBLISH anywhere in its application's queue namespace — it could enqueue a job\n * the backend will run. Constraining that is a different control (who may\n * request what work), not a broker permission, and pretending otherwise would\n * overstate the boundary.\n *\n * The trailing `(\\..*)?$` admits the tick queue itself and any suffixed\n * variant, while the anchored `$` stops it matching a SIBLING whose name merely\n * starts with this one's.\n */\n/**\n * Per-principal broker username — the SAME derivation `revokeAppCredentials`\n * must use.\n *\n * The application backend keeps `applicationNamespace` VERBATIM so an existing\n * deployment's user is never orphaned. A revoke that derived this differently\n * would delete the BACKEND's broker user while believing it was removing a\n * minion's — the identical trap already caught on the Redis side.\n */\nfunction buildRabbitPrincipalUsername(\n  applicationNamespace: string,\n  principal: ApplicationRuntimePrincipal | undefined,\n): string {\n  if (!principal || principal.kind === ApplicationRuntimePrincipalKind.APPLICATION_BACKEND) {\n    return buildRabbitUsername(applicationNamespace);\n  }\n  const sanitizedName = (principal.name ?? '').replace(/[^a-zA-Z0-9]+/g, '-').replace(/^-+|-+$/g, '');\n  return `${applicationNamespace}-${principal.kind}-${sanitizedName}`;\n}\n\nfunction buildMinionConsumeRegex(wildoApplicationId: string, minionName: string): string {\n  const escape = (value: string): string => value.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n  const appId = escape(wildoApplicationId);\n  const name = escape(minionName);\n  // Two alternatives, and nothing else:\n  //   its tick queue      — wildo.queue.<appId>.minion-tick.<name>\n  //   its OWN reply queue — wildo.reply.<appId>.<segment>.<podId>\n  // The reply segment is IMPORTED from the same builder the minion's own AMQP\n  // adapter uses, not reproduced here. It used to be hand-written as\n  // `minion-<name>` with a comment saying it \"mirrors\" what the adapter emits —\n  // which agreed only while every minion name survived sanitisation unchanged.\n  // The application backend gets no segment at all (the builder returns\n  // undefined for it), keeping the historical layout, so this cannot match its\n  // replies.\n  const replySegment = escape(\n    buildRuntimePrincipalQueueSegment(ApplicationRuntimePrincipalKind.MINION, minionName) ?? '',\n  );\n  return `^(wildo\\\\.queue\\\\.${appId}\\\\.minion-tick\\\\.${name}(\\\\..*)?`\n    + `|wildo\\\\.reply\\\\.${appId}\\\\.${replySegment}\\\\..*)$`;\n}\n\nexport const RabbitmqSelfInfraProviderModule: InfraProviderModule = {\n  provider: InfraProvider.RABBITMQ_SELF,\n  supportedCapabilities: [InfraCapability.QUEUING_SYSTEM],\n  perPrincipalSecretBlobPaths: PER_PRINCIPAL_SECRET_BLOB_PATHS,\n\n  plan(): InfraProviderPlanContribution {\n    return {\n      dockerComposeServices: ['rabbitmq'],\n      k8sResources: ['templates/infra/k8s/internal/rabbitmq/deployment.yaml.hbs'],\n      platformAdmin: {\n        envVars: {\n          RABBITMQ_HOST: 'rabbitmq',\n          RABBITMQ_PORT: '5672',\n          RABBITMQ_MANAGEMENT_PORT: '15672',\n        },\n        secretEnvVars: ['RABBITMQ_ADMIN_USERNAME', 'RABBITMQ_ADMIN_PASSWORD'],\n        // Audience-1 only (management-API access). audience-2 platform-\n        // service-scoped consumers (apps-manager / crontabs / file-\n        // generator publish-consume creds via `provisionAllPlatformServices`)\n        // are LD-8 territory, deferred to Slice 2.5 — they get their\n        // own `mintPlatformServiceCredentials` method then.\n        consumers: [\n          InfraPlatformAdminConsumer.APPS_MANAGER,\n          InfraPlatformAdminConsumer.COMPANION,\n        ],\n      },\n      appRuntime: {\n        // Declared for forward-compat with Slice 2.5's\n        // `_merge_WildoApplicationConfig` integration. Not consumed by\n        // any planner path in Slice 2 — the existing hard-coded values\n        // at `wildo-application-lifecycle.service.ts:1796-1799` stay in\n        // effect (host: 'localhost', port: 5672) until the planner\n        // wires this slice's contribution.\n        perAppConfigBlobPaths: {\n          'database.rabbitmq.host': 'rabbitmq',\n          'database.rabbitmq.port': 5672,\n        },\n        perAppSecretBlobPaths: [...PER_PRINCIPAL_SECRET_BLOB_PATHS],\n      },\n    };\n  },\n\n  async mintAppCredentials(\n    context: AppCredentialMintingContext,\n  ): Promise<AppCredentialMintingResult> {\n    const adminClient = context.adminClient as IRabbitMQManagementClient;\n    const password = context.secretInputs[RABBITMQ_PASSWORD_PATH];\n    if (!password) {\n      throw new Error(\n        `RabbitmqSelfInfraProviderModule.mintAppCredentials: ` +\n        `secretInputs is missing '${RABBITMQ_PASSWORD_PATH}'. ` +\n        `The orchestrator MUST supply the rabbit password — modules are upsert-only.`,\n      );\n    }\n\n    const username = buildRabbitPrincipalUsername(context.applicationNamespace, context.principal);\n    const permissionRegex = buildPermissionRegex(context.wildoApplicationId);\n    // A MINION consumes exactly two things: its own tick queue, and its own RPC\n    // REPLY queue. Both are admitted; everything else in the application's\n    // namespace is refused.\n    //\n    // The reply half is why an earlier attempt at this failed. Reply queues used\n    // to be `wildo.reply.<appId>.<podId>`, and `podId` is a per-PROCESS token\n    // carrying no principal — so no regex could admit a minion's replies while\n    // refusing the backend's, and narrowing `read` crash-looped the minion on\n    // its own replies. `buildReplyQueueName` now embeds the owning runtime,\n    // which is what makes this expressible at all.\n    const readRegex = context.principal?.kind === ApplicationRuntimePrincipalKind.MINION && context.principal.name\n      ? buildMinionConsumeRegex(context.wildoApplicationId, context.principal.name)\n      : permissionRegex;\n\n    // Slice 2.5c-3: optional per-app vhost. When the orchestrator\n    // supplies a non-empty `applicationConfigInputs.vhost`, the module\n    // ensures the vhost exists and sets permissions ON THAT vhost\n    // (provides true vhost-level isolation). When omitted, the module\n    // falls back to the default vhost `/` (legacy Slice 2 behavior:\n    // permission-regex isolation only). This is the opt-in seam — apps\n    // without an authored `backingServices.rabbitmq.vhost` continue to\n    // share `/`.\n    const vhost = context.applicationConfigInputs?.[VHOST_INPUT_KEY] || DEFAULT_VHOST;\n    if (vhost !== DEFAULT_VHOST) {\n      await adminClient.ensureVhost(vhost);\n    }\n\n    // PUT /api/users — idempotent upsert (replaces password + tags on conflict).\n    await adminClient.putUser(username, password, []);\n\n    // PUT /api/permissions — `configure` and `read` use the per-app\n    // queue/reply regex; `write` widens to allow `amq.default` (the\n    // default exchange RabbitMQ uses for direct routing) and the empty\n    // string (broker-internal). Mirrors the legacy\n    // `upsertTenantUserPermissions` write-regex shape so the Wonder\n    // Todos behavior is unchanged.\n    const writeRegex = `(^$|amq\\\\.default|${permissionRegex})`;\n    await adminClient.setPermissions(vhost, username, {\n      configure: permissionRegex,\n      write: writeRegex,\n      read: readRegex,\n    });\n\n    // PUT /api/topic-permissions — same regex on the topic exchange.\n    await adminClient.setTopicPermissions(vhost, username, {\n      exchange: TOPIC_EXCHANGE,\n      write: permissionRegex,\n      read: readRegex,\n    });\n\n    // Per-app-vhost cron delivery (`.claude/plans/crontab-publisher-vhost-gap.md`).\n    //\n    // A per-app vhost is a HARD broker isolation boundary: the platform\n    // cron/minion publisher (`platform_crontabs_batches_manager`) — a single\n    // global user that fans scheduled jobs into every app — cannot reach THIS\n    // app's queues until granted access on THIS vhost. On the default vhost `/`\n    // it already holds a broad publish grant (see `mintPlatformServiceCredentials`),\n    // so the grant is only needed for a non-default per-app vhost.\n    //\n    // Scope it to this app's own queue namespace (`^wildo\\.(queue|reply)\\.<appId>\\..*`)\n    // — the publisher gets exactly the reach it needs and no more, TIGHTER than\n    // its broad default-vhost grant. It is PUBLISH-ONLY: `configure` for the\n    // passive `checkQueue` existence probe the publisher runs before sending +\n    // any declare, `write` (`amq.default`) for `basic.publish`; NO `read` (never\n    // consumes) and NO topic permissions (uses the default exchange, not\n    // `amq.topic`). The crontabs user is provisioned before any app\n    // (apps-manager INIT Phase 4 < Phase 5), so it reliably exists here, and\n    // `setPermissions` is an idempotent PUT — a re-init safely re-applies it.\n    if (vhost !== DEFAULT_VHOST) {\n      await adminClient.setPermissions(vhost, PLATFORM_CRONTABS_BATCHES_MANAGER_SERVICE_NAME, {\n        configure: permissionRegex,\n        write: writeRegex,\n        read: '',\n      });\n    }\n\n    return {\n      secretBlobValues: {\n        [RABBITMQ_USERNAME_PATH]: username,\n        // Echo the orchestrator-supplied password — proves the module\n        // is upsert-only, not generator. The orchestrator persists\n        // this exact value into `Wildo_Application_Secrets`.\n        [RABBITMQ_PASSWORD_PATH]: password,\n      },\n    };\n  },\n\n  /**\n   * Tear down the per-app rabbit user. RabbitMQ users are global, so\n   * `deleteUser` removes the user (and its permissions on every vhost\n   * it had access to) atomically.\n   *\n   * **Vhost retention** (Slice 4.A.2 / M6): when `mintAppCredentials`\n   * provisioned a per-app vhost (Slice 2.5c-3), `revokeAppCredentials`\n   * does NOT delete the vhost. Reasoning: vhost deletion drops every\n   * queue and exchange inside it, which would destroy in-flight\n   * messages mid-flight if a redeploy or restart is happening\n   * concurrently. The user-deletion alone is sufficient to revoke\n   * access; the empty vhost lingers as a paper trail. A future\n   * \"app-deletion lifecycle\" slice can layer vhost cleanup with\n   * proper drain semantics.\n   *\n   * **Caller status** (F6 of 2026-05-06 plan review): no caller wires\n   * this in Slices 1–2.5. `wildo-application-lifecycle.service.ts`\n   * has no app-deletion ceremony to invoke it from. Method ships as a\n   * forward-compat seam for whichever future slice designs the\n   * app-deletion lifecycle.\n   *\n   * **Defensive validation** (Slice 4.A.2 / L4): empty\n   * `applicationNamespace` would call `DELETE /api/users/` and\n   * silently 404; we fail-loud instead so a bad caller surfaces\n   * immediately.\n   */\n  async revokeAppCredentials(context: AppCredentialMintingContext): Promise<void> {\n    if (!context.applicationNamespace) {\n      throw new Error(\n        `RabbitmqSelfInfraProviderModule.revokeAppCredentials: ` +\n        `applicationNamespace is empty. ` +\n        `The orchestrator MUST supply a non-empty namespace.`,\n      );\n    }\n    const adminClient = context.adminClient as IRabbitMQManagementClient;\n    const username = buildRabbitPrincipalUsername(context.applicationNamespace, context.principal);\n    await adminClient.deleteUser(username);\n  },\n\n  async mintPlatformServiceCredentials(\n    context: PlatformServiceCredentialMintingContext,\n  ): Promise<PlatformServiceCredentialMintingResult> {\n    const adminClient = context.adminClient as IRabbitMQManagementClient;\n    const password = context.secretInputs[PLATFORM_SERVICE_PASSWORD_INPUT_KEY];\n    if (!password) {\n      throw new Error(\n        `RabbitmqSelfInfraProviderModule.mintPlatformServiceCredentials: ` +\n        `secretInputs is missing '${PLATFORM_SERVICE_PASSWORD_INPUT_KEY}'. ` +\n        `The orchestrator MUST supply the platform-service password — modules are upsert-only.`,\n      );\n    }\n\n    // Username is the platform service identifier verbatim — preserves\n    // the legacy convention from\n    // `PlatformInfrastructureManagerService.provisionServiceCredentials`\n    // (line 478: `username: serviceName`).\n    const username = context.serviceName;\n    const permissionRegex = buildPlatformServiceRegex(context.serviceName);\n\n    // PUT /api/users — idempotent upsert.\n    await adminClient.putUser(username, password, []);\n\n    // Permissions: configure/read use the per-service regex; write\n    // widens to allow `amq.default` + empty string (broker-internal),\n    // matching the `upsertTenantUserPermissions` write-regex shape so\n    // post-Slice-2.5 broker permissions match pre-Slice-2.5.\n    const writeRegex = `(^$|amq\\\\.default|${permissionRegex})`;\n    await adminClient.setPermissions(DEFAULT_VHOST, username, {\n      configure: permissionRegex,\n      write: writeRegex,\n      read: permissionRegex,\n    });\n\n    // Topic permissions: same dot-escaped regex on amq.topic. The\n    // legacy two-caller divergence (one path stripped the `^` and\n    // produced `wildo\\.platform\\.<slug>\\..*`; the other produced\n    // `wildo.platform.<slug>.*` with literal dots) is unified here on\n    // the dot-escaped variant — see module JSDoc behavior-parity note.\n    await adminClient.setTopicPermissions(DEFAULT_VHOST, username, {\n      exchange: TOPIC_EXCHANGE,\n      write: permissionRegex,\n      read: permissionRegex,\n    });\n\n    return { username };\n  },\n};\n"]}

package/dist/esm/redis-self/redis-self.infra.module.d.ts

@@ -0,0 +1,89 @@
+/**
+ * `RedisSelfInfraProviderModule` — second concrete `InfraProviderModule`
+ * (Slice 4.B.1 of `infra-provider-planner.md`, generalizing the
+ * Slice 2 `RabbitmqSelfInfraProviderModule` pattern).
+ *
+ * Implements the `REDIS_SELF` `InfraProvider` over the
+ * `IRedisAclClient` transport (Valkey/Redis ACL commands, exposed by
+ * `RedisConnectionManagerService` after the Slice 4.B.1 5C policy/
+ * transport split). Owns ALL per-app ACL policy — the per-app
+ * keyPattern, the channel-pattern fan-out family, the per-app
+ * username convention.
+ *
+ * **What this module reads from `AppCredentialMintingContext`**:
+ * - `appSlug` — used as the **key-pattern** prefix
+ *   (`<appSlug>:*`). This MUST match the backend's effective
+ *   `dataServices.redis.keyPrefix`, which is the slug-derived key
+ *   namespace every backend write is rooted under (see
+ *   `engine/saas-backend-lib/src/databases/services/redis.service.ts`
+ *   `appPrefix` field — every `org:`/`global:` scope is composed with
+ *   that prefix). Slot owner: the SaaS app's authored config.
+ *   ACL invariant: `keyPrefix` MUST start with `<appSlug>:` so the
+ *   `~<appSlug>:*` grant covers every key the backend writes.
+ * - `applicationNamespace` — used as the Redis ACL **username** AND
+ *   as the channel-pattern prefix (`<ns>#*`, `<ns>-request#*`,
+ *   `<ns>-response#*`). Mirrors the legacy username convention from
+ *   `wildo-application-lifecycle.service.ts:441` (`redisUsername =
+ *   ns`). Channels stay namespace-scoped because the Socket.IO Redis
+ *   adapter (`engine/saas-backend-lib/src/requests/service/websocket
+ *   .service.ts:1501`) uses the Redis username as its `key:` — the
+ *   ACL channel pattern MUST match that.
+ * - `secretInputs['database.redis.password']` — orchestrator-supplied
+ *   password (module is upsert-only, never generator).
+ * - `adminClient` — narrowed to `IRedisAclClient`.
+ *
+ * **Key vs channel pattern split** (2026-05-26 framework-correct fix):
+ * Pre-fix, this module derived BOTH key and channel patterns from
+ * `applicationNamespace` (`<ns>:*` for keys, `<ns>#*` for channels).
+ * That was correct pre-Slice-3.6, when the backend used the username
+ * to namespace keys too. Slice 3.6 moved key namespacing to
+ * `dataServices.redis.keyPrefix` (default + recommended value
+ * `<appSlug>:`) but the ACL provisioner was not updated — every per-app
+ * Redis read/write returned `NOPERM No permissions to access a key`
+ * because the ACL only granted `<ns>:*` while the backend wrote
+ * `<appSlug>:*`. Fix: key pattern now derives from `appSlug`, channel
+ * patterns continue to derive from the username/namespace (Socket.IO
+ * adapter still uses the username as its channel key, so channels
+ * stay correct unchanged).
+ *
+ * **What this module IGNORES from the context** (Slice 4.A.2 / M4
+ * forward-compat documentation):
+ * - `wildoApplicationId` — the keyPattern uses appSlug + the channel
+ *   patterns use namespace; the application id is redundant for both
+ *   (no globally-shared key namespace risk because slug/namespace
+ *   already disambiguate by tenant and environment).
+ * - `applicationConfigInputs` — Redis_Self has no per-app authored
+ *   topology (no equivalent of RabbitMQ's vhost). Future modules may
+ *   read it for per-app db-index overrides etc.
+ *
+ * **Two audiences this module serves:**
+ *
+ * 1. **Audience-1 (platform-admin, declared via `plan().platformAdmin`)**:
+ *    cluster-wide ACL admin creds (`REDIS_HOST`, `REDIS_PORT`,
+ *    `REDIS_DATABASE` env + `REDIS_ADMIN_PASSWORD` secret env).
+ *    Consumers: `apps-manager` (mints per-app ACL users via
+ *    `mintAppCredentials`), `companion` (mirrors apps-manager admin
+ *    role for local dev).
+ *
+ * 2. **Audience-3 (app-scoped, via `plan().appRuntime` +
+ *    `mintAppCredentials`)**: per-customer-app Redis ACL user.
+ *    Username = `applicationNamespace`; keyPattern disambiguates by
+ *    the same namespace. Result threaded into
+ *    `Wildo_Application_Secrets.database.redis.{username, password}`
+ *    via `_merge_WildoApplicationSecrets`.
+ *
+ * **NOT served (D-4 of Slice 4.B locked decisions, 2026-05-10)**:
+ * - **Audience-2 (platform-service-scoped)**: Redis is currently NOT
+ *   used for inter-platform-service messaging (RabbitMQ is the bus).
+ *   `mintPlatformServiceCredentials` is therefore not implemented.
+ *   When/if a platform service surfaces a Redis-scoped per-service
+ *   credential need, this module gains the method.
+ *
+ * **`revokeAppCredentials`**: declared and tested, but the integration
+ * call site does NOT exist in `wildo-application-lifecycle.service.ts`
+ * (no app-deletion ceremony today — F6 of plan review 2026-05-06).
+ * Method ships as a forward-compat seam.
+ */
+import { InfraProviderModule } from '@wildo-ai/platform-config-lib';
+export declare const RedisSelfInfraProviderModule: InfraProviderModule;
+//# sourceMappingURL=redis-self.infra.module.d.ts.map

package/dist/esm/redis-self/redis-self.infra.module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redis-self.infra.module.d.ts","sourceRoot":"","sources":["../../../../src/redis-self/redis-self.infra.module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqFG;AAEH,OAAO,EAOL,mBAAmB,EAKpB,MAAM,+BAA+B,CAAC;AA+GvC,eAAO,MAAM,4BAA4B,EAAE,mBAiK1C,CAAC"}