@wildo-ai/saas-backend-lib 1.1.1 → 1.1.3

package/dist/esm/notifications/webhooks/controllers/webhook-auto-controller.backend.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"webhook-auto-controller.backend.service.js","sourceRoot":"","sources":["../../../../../../src/notifications/webhooks/controllers/webhook-auto-controller.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;;;;;;;;;;;;;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,EACL,sCAAsC,GAGvC,MAAM,sCAAsC,CAAC;AAG9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAMpF,OAAO,EAAE,gCAAgC,EAAE,MAAM,0FAA0F,CAAC;AAIrI,IAAM,mCAAmC,GAAzC,MAAM,mCAAoC,SAAQ,gCAAgC;IAoBT;IACE;IAnBhF,uEAAuE;IAC/D,kBAAkB,GAAG,IAAI,GAAG,EAAoC,CAAC;IAEjE,cAAc,GAAwC,IAAI,CAAC;IAEnE;;;;OAIG;IACK,eAAe,GAAG,IAAI,GAAG,EAA2B,CAAC;IAE7D,sEAAsE;IAEtE,YACqC,MAAqB,EACR,YAAwC,EACxC,YAAiC,EACL,uBAA8D,EAC5D,yBAAkE;QAEhJ,KAAK,CAAC,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,uBAAuB,CAAC,CAAC;QAHS,4BAAuB,GAAvB,uBAAuB,CAAuC;QAC5D,8BAAyB,GAAzB,yBAAyB,CAAyC;IAGlJ,CAAC;IAED,+DAA+D;IAC/D,iBAAiB;IACjB,+DAA+D;IAE/D;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACI,KAAK,CAAC,UAAU,CACrB,cAA4C;QAE5C,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QAErC,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,uBAAuB,CAAC,wBAAwB,CAAC,sCAAsC,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACxI,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;YAC1C,IAAI,CAAC;gBACH,IACE,CAAC,IAAI,CAAC,yBAAyB,CAAC,iBAAiB,CAC/C,WAAW,EACX,sCAAsC,CAAC,kBAAkB,CAC1D,EACD,CAAC;oBACD,SAAS;gBACX,CAAC;gBAED,MAAM,MAAM,GAAG,IAAI,CAAC,yBAAyB,CAAC,wBAAwB,CACpE,WAAW,EACX,sCAAsC,CAAC,kBAAkB,CAC1D,CAAC;gBACF,gEAAgE;gBAChE,mEAAmE;gBACnE,8DAA8D;gBAC9D,iEAAiE;gBACjE,qDAAqD;gBACrD,8DAA8D;gBAC9D,2DAA2D;gBAC3D,6DAA6D;gBAC7D,wBAAwB;gBACxB,MAAM,SAAS,GAAoB,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;gBAClE,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACzB,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;oBACjD,IAAI,CAAC,QAAQ,CAAC,cAAc,SAAS,CAAC,MAAM,4BAA4B,WAAW,EAAE,CAAC,CAAC;gBACzF,CAAC;qBAAM,CAAC;oBACN,kEAAkE;oBAClE,oEAAoE;oBACpE,qEAAqE;oBACrE,kEAAkE;oBAClE,kEAAkE;oBAClE,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,oCAAoC,WAAW,oGAAoG,CACpJ,CAAC;gBACJ,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2CAA2C,WAAW,EAAE,EAAE;oBACzE,KAAK,EAAG,KAAe,CAAC,OAAO;iBAChC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,4CAA4C,IAAI,CAAC,eAAe,CAAC,IAAI,cAAc,CAAC,CAAC;QAEnG,2EAA2E;QAC3E,IAAI,CAAC,qBAAqB,EAAE,CAAC;IAC/B,CAAC;IAED;;;OAGG;IACH,yBAAyB,CAAC,OAAiC;QACzD,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACzD,IAAI,CAAC,QAAQ,CAAC,6CAA6C,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IACnF,CAAC;IAED;;;;OAIG;IAEH,+DAA+D;IAC/D,SAAS;IACT,+DAA+D;IAE/D;;;;;;;;OAQG;IACO,WAAW;QACnB,mEAAmE;IACrE,CAAC;IAED;;;;;;OAMG;IACK,qBAAqB;QAC3B,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0FAA0F,CAAC,CAAC;YAC7G,OAAO;QACT,CAAC;QAED,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACpC,IAAI,CAAC,QAAQ,CAAC,wDAAwD,CAAC,CAAC;YACxE,OAAO;QACT,CAAC;QAED,KAAK,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YAC5D,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;gBACjC,MAAM,SAAS,GAAG,aAAa,WAAW,IAAI,QAAQ,CAAC,GAAG,EAAE,CAAC;gBAE7D,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,SAAS;gBACT,uEAAuE;gBACvE,uEAAuE;gBACvE,2CAA2C;gBAC3C,+DAA+D;gBAC/D,sEAAsE;gBACtE,sEAAsE;gBACtE,uEAAuE;gBACvE,wEAAwE;gBACxE,mCAAmC;gBACnC,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,EACzC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,KAAmB,EAAE,EAAE;oBAC3E,MAAM,IAAI,CAAC,oBAAoB,CAAC,WAAW,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;gBACnE,CAAC,CAAC,CACH,CAAC;gBAGF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qCAAqC,SAAS,EAAE,CAAC,CAAC;YACrE,CAAC;QACH,CAAC;IACH,CAAC;IAED,+DAA+D;IAC/D,UAAU;IACV,+DAA+D;IAEvD,KAAK,CAAC,oBAAoB,CAChC,WAAmB,EACnB,QAAuB,EACvB,GAAY,EACZ,GAAa;QAEb,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;YACnE,OAAO;QACT,CAAC;QAED,+DAA+D;QAC/D,uEAAuE;QACvE,2EAA2E;QAC3E,0EAA0E;QAC1E,yEAAyE;QACzE,yEAAyE;QACzE,oDAAoD;QACpD,mEAAmE;QACnE,8EAA8E;QAC9E,4EAA4E;QAC5E,6EAA6E;QAC7E,0EAA0E;QAC1E,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC;YAC1C,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;YAC/B,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;gBACzB,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAC5B,CAAC,CAAC,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ;oBAC5B,CAAC,CAAC,GAAG,CAAC,IAAI;oBACV,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAEjC,IAAI,MAAM,GAA+E,IAAI,CAAC;QAC9F,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC;gBAChD,WAAW;gBACX,WAAW,EAAE,QAAQ,CAAC,GAAG;gBACzB,QAAQ;gBACR,OAAO;gBACP,OAAO,EAAE,GAAG,CAAC,OAAiC;aAC/C,CAAC,CAAC;YAEH,0EAA0E;YAC1E,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;gBACzC,OAAO;YACT,CAAC;YAED,iCAAiC;YACjC,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YACjE,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;YACzE,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,KAAK,CAAC,6BAA6B,QAAQ,CAAC,UAAU,OAAO,WAAW,IAAI,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;YACxG,CAAC;YAED,MAAM,IAAI,CAAC,cAAc,CAAC,oBAAoB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;YACtE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,YAAY,GAAI,KAAe,CAAC,OAAO,IAAI,eAAe,CAAC;YACjE,MAAM,SAAS,GAAI,KAAa,EAAE,SAAS,CAAC;YAE5C,0BAA0B;YAC1B,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;gBAClC,IAAI,CAAC,QAAQ,CAAC,uCAAuC,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;gBACnG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;gBACrD,OAAO;YACT,CAAC;YAED,kDAAkD;YAClD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE;gBAC7C,WAAW;gBACX,WAAW,EAAE,QAAQ,CAAC,GAAG;gBACzB,KAAK,EAAE,YAAY;aACpB,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,cAAc,CAAC,mBAAmB,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;YACtE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;CACF,CAAA;AAnRY,mCAAmC;IAD/C,UAAU,EAAE;IAkBR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;IACzD,WAAA,MAAM,CAAC,kBAAkB,CAAC,gCAAgC,CAAC,CAAA;;GArBnD,mCAAmC,CAmR/C","sourcesContent":["/**\n * Webhook Auto-Controller Backend Service\n *\n * Auto-registers webhook routes from provider registry definitions.\n * At startup, iterates all providers with WEBHOOK_ORIGINATOR protocol,\n * then iterates each provider's endpoints, and registers:\n *   POST /webhooks/{providerRef}/{endpointKey}\n *\n * e.g., POST /webhooks/stripe/billing\n *       POST /webhooks/google/calendar\n *       POST /webhooks/google/drive\n *\n * This replaces manual per-provider webhook controllers (like BillingWebhookControllerBackendService).\n *\n * @see hook-protocol-webhook-callback.md\n */\n\nimport { injectable, inject } from 'inversify';\nimport express from 'express';\nimport type { Request, Response, NextFunction } from 'express';\nimport {\n  ExternalProvider_ExchangeProtocol_Kind,\n  type Hook_Endpoint,\n  type WebhookCapabilityHandler,\n} from '@wildo-ai/external-connectors-models';\nimport { HttpMethod } from '@wildo-ai/saas-models';\n\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport type { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport type { ErrorHandlerService } from '~wildo-backend-lib/errors/services/error-handler.backend.service';\nimport type { BackendProviderRegistryBackendService } from '~wildo-backend-lib/external-providers/services/backend-provider-registry.backend.service';\nimport type { ExternalProvidersRegistryBackendService } from '~wildo-backend-lib/external-providers/services/external-providers-registry.backend.service';\nimport { AbstractControllerBackendService } from '~wildo-backend-lib/base-classes/services/controllers/abstract-controller.backend.service';\nimport type { WebhookHandlerBackendService } from '~wildo-backend-lib/notifications/webhooks/services/webhook-handler.backend.service';\n\n@injectable()\nexport class WebhookAutoControllerBackendService extends AbstractControllerBackendService {\n\n  /** Capability handlers keyed by capability string (e.g., 'billing') */\n  private capabilityHandlers = new Map<string, WebhookCapabilityHandler>();\n\n  private webhookHandler: WebhookHandlerBackendService | null = null;\n\n  /**\n   * Pre-loaded endpoint configurations per provider.\n   * Populated during initialize() from first-class provider runtime contracts.\n   * setupRoutes() reads from this cache (sync) to register routes.\n   */\n  private loadedEndpoints = new Map<string, Hook_Endpoint[]>();\n\n  /** Routes recorded only after Express accepted their registration. */\n\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Logger) logger: LoggerService,\n    @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) errorBuilder: ErrorBuilderBackendService,\n    @inject(SAAS_SERVICE_TYPES.ErrorHandlerService) errorHandler: ErrorHandlerService,\n    @inject(SAAS_SERVICE_TYPES.BackendProviderRegistryService) private readonly backendProviderRegistry: BackendProviderRegistryBackendService,\n    @inject(SAAS_SERVICE_TYPES.ExternalProvidersRegistryService) private readonly externalProvidersRegistry: ExternalProvidersRegistryBackendService,\n  ) {\n    super(logger, errorBuilder, errorHandler, 'WebhookAutoController');\n  }\n\n  // ════════════════════════════════════════════════════════════\n  // Initialization\n  // ════════════════════════════════════════════════════════════\n\n  /**\n   * Initialize with required dependencies, pre-load endpoint configs, AND\n   * register the webhook routes.\n   *\n   * ── Why routes are registered HERE, not in `setupRoutes()` ──────────────\n   *\n   * `AbstractControllerBackendService` calls the abstract `setupRoutes()` hook\n   * synchronously from *inside its own constructor* (`super(...)`). At that\n   * point this controller has NOTHING to register:\n   *\n   *   1. The webhook handler is not injected via the constructor — it is\n   *      supplied to `initialize()` by `start-application` after the billing /\n   *      provider layers are wired.\n   *   2. The route SET is data-dependent (one route per provider webhook\n   *      endpoint), and those endpoint contracts are only knowable after the\n   *      provider registries have been initialized (which happens later in the\n   *      startup sequence than DI construction).\n   *\n   * So `setupRoutes()` is a deliberate no-op (see its JSDoc) and the real,\n   * data-dependent route registration runs here — the same lifecycle shape\n   * `ControllerResourceBackendService` uses for its per-resource routes.\n   *\n   * `start-application` calls this BEFORE the controllers registry mounts the\n   * router (via `getRouter()`), so the routes added here are present when the\n   * master router mounts this controller's router by reference. Errors thrown\n   * from webhook handlers propagate to the app-level error middleware\n   * (`HttpServerBackendService`), so no router-scoped error handler is needed\n   * after these routes.\n   */\n  public async initialize(\n    webhookHandler: WebhookHandlerBackendService,\n  ): Promise<void> {\n    this.webhookHandler = webhookHandler;\n\n    for (const provider of this.backendProviderRegistry.getProvidersWithProtocol(ExternalProvider_ExchangeProtocol_Kind.WEBHOOK_ORIGINATOR)) {\n      const providerRef = provider.metadata.ref;\n      try {\n        if (\n          !this.externalProvidersRegistry.isProviderEnabled(\n            providerRef,\n            ExternalProvider_ExchangeProtocol_Kind.WEBHOOK_ORIGINATOR,\n          )\n        ) {\n          continue;\n        }\n\n        const config = this.externalProvidersRegistry.getProviderConfiguration(\n          providerRef,\n          ExternalProvider_ExchangeProtocol_Kind.WEBHOOK_ORIGINATOR,\n        );\n        // `config.endpoints` is `ReadonlyArray<Hook_Endpoint>` post the\n        // 2026-05-06 webhook endpoint reshape: `Hook_Endpoint.displayName`\n        // is now optional (matches the runtime emission) and the dead\n        // extras (`providerRef` / `path` / `secretBinding`) were dropped\n        // from `buildWebhookEndpoints`. The local cache is a\n        // `Map<string, Hook_Endpoint[]>`, so we materialize a mutable\n        // copy here — the cache was historically `Hook_Endpoint[]`\n        // (mutable); preserving that semantics avoids touching every\n        // downstream signature.\n        const endpoints: Hook_Endpoint[] = [...(config?.endpoints ?? [])];\n        if (endpoints.length > 0) {\n          this.loadedEndpoints.set(providerRef, endpoints);\n          this.logDebug(`Pre-loaded ${endpoints.length} webhook endpoint(s) for ${providerRef}`);\n        } else {\n          // Genuine contract fault (not the expected \"no webhook providers\"\n          // case): the provider is ENABLED for WEBHOOK_ORIGINATOR yet exposes\n          // zero endpoints, so it will silently never receive inbound webhooks\n          // (e.g. Stripe would 404 on /webhooks/stripe/billing). Surface it\n          // once, clearly — this is a mis-sequence, not steady-state noise.\n          this.logger.warn(\n            `WebhookAutoController: provider '${providerRef}' is enabled for WEBHOOK_ORIGINATOR but exposes no endpoints — no routes will be registered for it`,\n          );\n        }\n      } catch (error) {\n        this.logger.warn(`Failed to pre-load webhook protocol for ${providerRef}`, {\n          error: (error as Error).message,\n        });\n      }\n    }\n\n    this.logDebug(`Webhook auto-controller initialized with ${this.loadedEndpoints.size} provider(s)`);\n\n    // Register the routes now that the handler + endpoint contracts are known.\n    this.registerWebhookRoutes();\n  }\n\n  /**\n   * Register a capability handler for dispatching processed events.\n   * Called at startup by capability modules (e.g., billing module).\n   */\n  registerCapabilityHandler(handler: WebhookCapabilityHandler): void {\n    this.capabilityHandlers.set(handler.capability, handler);\n    this.logDebug(`Registered webhook capability handler for ${handler.capability}`);\n  }\n\n  /**\n   * Return the sanitized inbound-provider routes that this controller actually\n   * registered. Provider configuration, signature material, endpoint payloads,\n   * and handler metadata are intentionally absent.\n   */\n\n  // ════════════════════════════════════════════════════════════\n  // Routes\n  // ════════════════════════════════════════════════════════════\n\n  /**\n   * Required by `AbstractControllerBackendService`, which invokes this hook\n   * synchronously from its constructor (`super(...)`). This controller\n   * intentionally registers NOTHING here: its route set is data-dependent\n   * (one route per provider webhook endpoint) and neither the webhook handler\n   * nor the provider endpoint contracts exist at construction time. The real\n   * registration happens in `initialize()` / `registerWebhookRoutes()` once\n   * that data is available — see `initialize()`'s JSDoc for the full rationale.\n   */\n  protected setupRoutes(): void {\n    // No-op by design — see JSDoc above and `registerWebhookRoutes()`.\n  }\n\n  /**\n   * Register one Express route per pre-loaded provider webhook endpoint.\n   * Invoked from `initialize()` after `webhookHandler` and `loadedEndpoints`\n   * have been populated. Idempotent-safe against an empty cache; guards on the\n   * handler so a mis-sequenced call fails visibly rather than registering dead\n   * routes.\n   */\n  private registerWebhookRoutes(): void {\n    if (!this.webhookHandler) {\n      this.logger.warn('WebhookAutoController: initialize() ran without a webhook handler — no routes registered');\n      return;\n    }\n\n    if (this.loadedEndpoints.size === 0) {\n      this.logDebug('No webhook endpoints pre-loaded — no routes registered');\n      return;\n    }\n\n    for (const [providerRef, endpoints] of this.loadedEndpoints) {\n      for (const endpoint of endpoints) {\n        const routePath = `/webhooks/${providerRef}/${endpoint.key}`;\n\n        this.router.post(\n          routePath,\n          // Defense-in-depth for a future streaming mount. If this controller is\n          // ever assigned the RAW_REQUEST_STREAM mount phase, this express.raw()\n          // makes req.body the raw Buffer. Under the\n          // current master-router mount it is an inert no-op: the global\n          // express.json (HttpServerBackendService.setupBodyParsing) parses the\n          // body first and sets req._body, so the signature-faithful bytes come\n          // from req.rawBody — captured by that same express.json `verify` hook.\n          // handleWebhookRequest reads rawBody first, then falls back to a Buffer\n          // req.body for the streaming case.\n          express.raw({ type: 'application/json' }),\n          this.asyncHandler(async (req: Request, res: Response, _next: NextFunction) => {\n            await this.handleWebhookRequest(providerRef, endpoint, req, res);\n          }),\n        );\n\n\n        this.logger.info(`Webhook endpoint registered: POST ${routePath}`);\n      }\n    }\n  }\n\n  // ════════════════════════════════════════════════════════════\n  // Handler\n  // ════════════════════════════════════════════════════════════\n\n  private async handleWebhookRequest(\n    providerRef: string,\n    endpoint: Hook_Endpoint,\n    req: Request,\n    res: Response,\n  ): Promise<void> {\n    if (!this.webhookHandler) {\n      res.status(503).json({ error: 'Webhook handler not initialized' });\n      return;\n    }\n\n    // Raw request bytes for signature verification. Order matters:\n    //   1. req.rawBody — captured by the global express.json `verify` hook\n    //      (HttpServerBackendService.setupBodyParsing). This is the provider's\n    //      EXACT original payload and the ONLY byte-faithful source under the\n    //      current master-router mount, where global express.json parses the\n    //      body before this route runs (making the per-route express.raw() a\n    //      no-op, so req.body is a parsed object here).\n    //   2. Buffer req.body — only populated if this controller is ever\n    //      streaming-mounted before body parsing (per-route express.raw() fires).\n    //   3. string / JSON.stringify — last-resort fallbacks; JSON.stringify will\n    //      NOT byte-match the provider (key ordering / whitespace), so it exists\n    //      only to avoid a crash, never as a correctness path for signatures.\n    const rawBody = Buffer.isBuffer(req.rawBody)\n      ? req.rawBody.toString('utf-8')\n      : Buffer.isBuffer(req.body)\n        ? req.body.toString('utf-8')\n        : typeof req.body === 'string'\n          ? req.body\n          : JSON.stringify(req.body);\n\n    let result: Awaited<ReturnType<WebhookHandlerBackendService['processWebhook']>> | null = null;\n    try {\n      result = await this.webhookHandler.processWebhook({\n        providerRef,\n        endpointKey: endpoint.key,\n        endpoint,\n        rawBody,\n        headers: req.headers as Record<string, string>,\n      });\n\n      // null = idempotent duplicate or unparseable event — already acknowledged\n      if (!result) {\n        res.status(200).json({ received: true });\n        return;\n      }\n\n      // Dispatch to capability handler\n      const handler = this.capabilityHandlers.get(endpoint.capability);\n      if (handler) {\n        await handler.handleEvent(result.executionContext, result.parsedEvent);\n      } else {\n        throw new Error(`No capability handler for ${endpoint.capability} on ${providerRef}/${endpoint.key}`);\n      }\n\n      await this.webhookHandler.markWebhookProcessed(result.idempotencyKey);\n      res.status(200).json({ received: true });\n    } catch (error) {\n      const errorMessage = (error as Error).message ?? 'Unknown error';\n      const errorType = (error as any)?.errorType;\n\n      // Signature failure → 401\n      if (errorType === 'AUTHORIZATION') {\n        this.logDebug('Webhook signature verification failed', { providerRef, endpointKey: endpoint.key });\n        res.status(401).json({ error: 'Invalid signature' });\n        return;\n      }\n\n      // All other errors → 500 (trigger provider retry)\n      this.logger.error('Webhook processing failed', {\n        providerRef,\n        endpointKey: endpoint.key,\n        error: errorMessage,\n      });\n      await this.webhookHandler.releaseWebhookClaim(result?.idempotencyKey);\n      res.status(500).json({ error: 'Processing failed' });\n    }\n  }\n}\n"]}
+{"version":3,"file":"webhook-auto-controller.backend.service.js","sourceRoot":"","sources":["../../../../../../src/notifications/webhooks/controllers/webhook-auto-controller.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;;;;;;;;;;;;;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,EACL,sCAAsC,GAGvC,MAAM,sCAAsC,CAAC;AAG9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAMpF,OAAO,EAAE,gCAAgC,EAAE,MAAM,0FAA0F,CAAC;AAG5I;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,6BAaX;AAbD,WAAY,6BAA6B;IACvC;;;;OAIG;IACH,gFAA+C,CAAA;IAC/C;;;;OAIG;IACH,4EAA2C,CAAA;AAC7C,CAAC,EAbW,6BAA6B,KAA7B,6BAA6B,QAaxC;AAYM,IAAM,mCAAmC,GAAzC,MAAM,mCAAoC,SAAQ,gCAAgC;IAoCT;IACE;IAnChF,uEAAuE;IAC/D,kBAAkB,GAAG,IAAI,GAAG,EAAoC,CAAC;IAEjE,cAAc,GAAwC,IAAI,CAAC;IAEnE;;;;OAIG;IACK,eAAe,GAAG,IAAI,GAAG,EAA2B,CAAC;IAE7D,2EAA2E;IACnE,oBAAoB,GAAa,EAAE,CAAC;IAE5C;;;;OAIG;IACK,cAAc,GAA8B,EAAE,CAAC;IAEvD;;;;;OAKG;IACK,gBAAgB,GAAG,KAAK,CAAC;IAEjC,YACqC,MAAqB,EACR,YAAwC,EACxC,YAAiC,EACL,uBAA8D,EAC5D,yBAAkE;QAEhJ,KAAK,CAAC,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,uBAAuB,CAAC,CAAC;QAHS,4BAAuB,GAAvB,uBAAuB,CAAuC;QAC5D,8BAAyB,GAAzB,yBAAyB,CAAyC;IAGlJ,CAAC;IAED,+DAA+D;IAC/D,iBAAiB;IACjB,+DAA+D;IAE/D;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACI,KAAK,CAAC,UAAU,CACrB,cAA4C;QAE5C,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QAErC,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,uBAAuB,CAAC,wBAAwB,CAAC,sCAAsC,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACxI,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;YAC1C,IAAI,CAAC;gBACH,IACE,CAAC,IAAI,CAAC,yBAAyB,CAAC,iBAAiB,CAC/C,WAAW,EACX,sCAAsC,CAAC,kBAAkB,CAC1D,EACD,CAAC;oBACD,SAAS;gBACX,CAAC;gBAED,MAAM,MAAM,GAAG,IAAI,CAAC,yBAAyB,CAAC,wBAAwB,CACpE,WAAW,EACX,sCAAsC,CAAC,kBAAkB,CAC1D,CAAC;gBACF,gEAAgE;gBAChE,mEAAmE;gBACnE,8DAA8D;gBAC9D,iEAAiE;gBACjE,qDAAqD;gBACrD,8DAA8D;gBAC9D,2DAA2D;gBAC3D,6DAA6D;gBAC7D,wBAAwB;gBACxB,MAAM,SAAS,GAAoB,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;gBAClE,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACzB,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;oBACjD,IAAI,CAAC,QAAQ,CAAC,cAAc,SAAS,CAAC,MAAM,4BAA4B,WAAW,EAAE,CAAC,CAAC;gBACzF,CAAC;qBAAM,CAAC;oBACN,kEAAkE;oBAClE,oEAAoE;oBACpE,qEAAqE;oBACrE,kEAAkE;oBAClE,kEAAkE;oBAClE,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,oCAAoC,WAAW,oGAAoG,CACpJ,CAAC;gBACJ,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2CAA2C,WAAW,EAAE,EAAE;oBACzE,KAAK,EAAG,KAAe,CAAC,OAAO;iBAChC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,4CAA4C,IAAI,CAAC,eAAe,CAAC,IAAI,cAAc,CAAC,CAAC;QAEnG,2EAA2E;QAC3E,IAAI,CAAC,qBAAqB,EAAE,CAAC;IAC/B,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,yBAAyB,CAAC,OAAiC;QACzD,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAEzD,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,kDAAkD,OAAO,CAAC,UAAU,sDAAsD;kBACxH,6HAA6H;kBAC7H,qFAAqF;kBACrF,4FAA4F,EAC9F;gBACE,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,cAAc,EAAE,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC;aAChF,CACF,CAAC;YACF,OAAO;QACT,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,6CAA6C,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IACnF,CAAC;IAED;;;;OAIG;IACI,8BAA8B;QACnC,OAAO,CAAC,GAAG,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACxC,CAAC;IAED;;;;OAIG;IACI,wBAAwB;QAC7B,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,WAAW,EAAE,OAAO,EAAE,CAAC,GAAG,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3G,CAAC;IAED,+DAA+D;IAC/D,SAAS;IACT,+DAA+D;IAE/D;;;;;;;;OAQG;IACO,WAAW;QACnB,mEAAmE;IACrE,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6CG;IACK,qBAAqB;QAC3B,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;QAE7B,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0FAA0F,CAAC,CAAC;YAC7G,OAAO;QACT,CAAC;QAED,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACpC,IAAI,CAAC,QAAQ,CAAC,wDAAwD,CAAC,CAAC;YACxE,OAAO;QACT,CAAC;QAED,KAAK,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YAC5D,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;gBACjC,MAAM,SAAS,GAAG,aAAa,WAAW,IAAI,QAAQ,CAAC,GAAG,EAAE,CAAC;gBAE7D,MAAM,WAAW,GAAG,IAAI,CAAC,0BAA0B,CAAC,WAAW,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;gBACtF,IAAI,WAAW,EAAE,CAAC;oBAChB,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;oBACtC,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,+CAA+C,SAAS,uDAAuD;0BAC7G,IAAI,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,iFAAiF;0BACnH,kHAAkH;0BAClH,gEAAgE;0BAChE,IAAI,QAAQ,CAAC,UAAU,6FAA6F;0BACpH,kHAAkH;0BAClH,0BAA0B,WAAW,IAAI,EAC3C;wBACE,WAAW;wBACX,WAAW,EAAE,QAAQ,CAAC,GAAG;wBACzB,UAAU,EAAE,QAAQ,CAAC,UAAU;wBAC/B,SAAS;wBACT,OAAO,EAAE,WAAW,CAAC,OAAO;qBAC7B,CACF,CAAC;oBACF,SAAS;gBACX,CAAC;gBAED,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,SAAS;gBACT,uEAAuE;gBACvE,uEAAuE;gBACvE,2CAA2C;gBAC3C,+DAA+D;gBAC/D,sEAAsE;gBACtE,sEAAsE;gBACtE,uEAAuE;gBACvE,wEAAwE;gBACxE,mCAAmC;gBACnC,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,EACzC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,KAAmB,EAAE,EAAE;oBAC3E,MAAM,IAAI,CAAC,oBAAoB,CAAC,WAAW,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;gBACnE,CAAC,CAAC,CACH,CAAC;gBAEF,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAC1C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qCAAqC,SAAS,EAAE,CAAC,CAAC;YACrE,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACK,0BAA0B,CAChC,WAAmB,EACnB,QAAuB,EACvB,SAAiB;QAEjB,MAAM,OAAO,GAAoC,EAAE,CAAC;QAEpD,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACtD,OAAO,CAAC,IAAI,CAAC,6BAA6B,CAAC,qBAAqB,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,UAAU,CAAC,WAAW,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAChE,OAAO,CAAC,IAAI,CAAC,6BAA6B,CAAC,mBAAmB,CAAC,CAAC;QAClE,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,CAAC,GAAG,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;IACzG,CAAC;IAED,+DAA+D;IAC/D,UAAU;IACV,+DAA+D;IAEvD,KAAK,CAAC,oBAAoB,CAChC,WAAmB,EACnB,QAAuB,EACvB,GAAY,EACZ,GAAa;QAEb,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;YACnE,OAAO;QACT,CAAC;QAED,+DAA+D;QAC/D,uEAAuE;QACvE,2EAA2E;QAC3E,0EAA0E;QAC1E,yEAAyE;QACzE,yEAAyE;QACzE,oDAAoD;QACpD,mEAAmE;QACnE,8EAA8E;QAC9E,4EAA4E;QAC5E,6EAA6E;QAC7E,0EAA0E;QAC1E,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC;YAC1C,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;YAC/B,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;gBACzB,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAC5B,CAAC,CAAC,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ;oBAC5B,CAAC,CAAC,GAAG,CAAC,IAAI;oBACV,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAEjC,IAAI,MAAM,GAA+E,IAAI,CAAC;QAC9F,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC;gBAChD,WAAW;gBACX,WAAW,EAAE,QAAQ,CAAC,GAAG;gBACzB,QAAQ;gBACR,OAAO;gBACP,OAAO,EAAE,GAAG,CAAC,OAAiC;aAC/C,CAAC,CAAC;YAEH,0EAA0E;YAC1E,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;gBACzC,OAAO;YACT,CAAC;YAED,kCAAkC;YAClC,EAAE;YACF,0EAA0E;YAC1E,4EAA4E;YAC5E,4EAA4E;YAC5E,2EAA2E;YAC3E,oEAAoE;YACpE,uDAAuD;YACvD,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YACjE,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;YACzE,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,KAAK,CAAC,6BAA6B,QAAQ,CAAC,UAAU,OAAO,WAAW,IAAI,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;YACxG,CAAC;YAED,MAAM,IAAI,CAAC,cAAc,CAAC,oBAAoB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;YACtE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,YAAY,GAAI,KAAe,CAAC,OAAO,IAAI,eAAe,CAAC;YACjE,MAAM,SAAS,GAAI,KAAa,EAAE,SAAS,CAAC;YAE5C,0BAA0B;YAC1B,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;gBAClC,IAAI,CAAC,QAAQ,CAAC,uCAAuC,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;gBACnG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;gBACrD,OAAO;YACT,CAAC;YAED,kDAAkD;YAClD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE;gBAC7C,WAAW;gBACX,WAAW,EAAE,QAAQ,CAAC,GAAG;gBACzB,KAAK,EAAE,YAAY;aACpB,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,cAAc,CAAC,mBAAmB,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;YACtE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;CACF,CAAA;AA3aY,mCAAmC;IAD/C,UAAU,EAAE;IAkCR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;IACzD,WAAA,MAAM,CAAC,kBAAkB,CAAC,gCAAgC,CAAC,CAAA;;GArCnD,mCAAmC,CA2a/C","sourcesContent":["/**\n * Webhook Auto-Controller Backend Service\n *\n * Auto-registers webhook routes from provider registry definitions.\n * At startup, iterates all providers with WEBHOOK_ORIGINATOR protocol,\n * then iterates each provider's endpoints, and registers:\n *   POST /webhooks/{providerRef}/{endpointKey}\n *\n * One provider declares the protocol today, and it declares one endpoint:\n *   POST /webhooks/stripe/billing\n *\n * A second provider registers here the moment it declares `WEBHOOK_ORIGINATOR` with its own\n * `endpoints`; no edit to this controller is needed.\n *\n * This replaces manual per-provider webhook controllers (like BillingWebhookControllerBackendService).\n *\n * @see hook-protocol-webhook-callback.md\n */\n\nimport { injectable, inject } from 'inversify';\nimport express from 'express';\nimport type { Request, Response, NextFunction } from 'express';\nimport {\n  ExternalProvider_ExchangeProtocol_Kind,\n  type Hook_Endpoint,\n  type WebhookCapabilityHandler,\n} from '@wildo-ai/external-connectors-models';\nimport { HttpMethod } from '@wildo-ai/saas-models';\n\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport type { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport type { ErrorHandlerService } from '~wildo-backend-lib/errors/services/error-handler.backend.service';\nimport type { BackendProviderRegistryBackendService } from '~wildo-backend-lib/external-providers/services/backend-provider-registry.backend.service';\nimport type { ExternalProvidersRegistryBackendService } from '~wildo-backend-lib/external-providers/services/external-providers-registry.backend.service';\nimport { AbstractControllerBackendService } from '~wildo-backend-lib/base-classes/services/controllers/abstract-controller.backend.service';\nimport type { WebhookHandlerBackendService } from '~wildo-backend-lib/notifications/webhooks/services/webhook-handler.backend.service';\n\n/**\n * Why a declared webhook endpoint did NOT get an Express route.\n *\n * A closed vocabulary rather than a free string: each member names a DIFFERENT\n * missing registration, with a different remedy, and an operator reading the\n * startup log has to be able to tell them apart. The two are independent — an\n * endpoint can be missing either, or both.\n */\nexport enum WebhookRouteWithholdingReason {\n  /**\n   * No {@link WebhookCapabilityHandler} is registered for the endpoint's\n   * `capability`. The route would reach `handleWebhookRequest`, complete\n   * signature verification and idempotency claiming, then fail at dispatch.\n   */\n  NO_CAPABILITY_HANDLER = 'NO_CAPABILITY_HANDLER',\n  /**\n   * No `WebhookCapabilityAdapter` is registered for `providerRef:endpointKey`\n   * on {@link WebhookHandlerBackendService}. The route would fail at the very\n   * top of `processWebhook`, before signature verification.\n   */\n  NO_ENDPOINT_ADAPTER = 'NO_ENDPOINT_ADAPTER',\n}\n\n/** One declared endpoint whose route was deliberately not mounted, and why. */\nexport interface WebhookRouteWithholding {\n  providerRef: string;\n  endpointKey: string;\n  capability: string;\n  routePath: string;\n  reasons: WebhookRouteWithholdingReason[];\n}\n\n@injectable()\nexport class WebhookAutoControllerBackendService extends AbstractControllerBackendService {\n\n  /** Capability handlers keyed by capability string (e.g., 'billing') */\n  private capabilityHandlers = new Map<string, WebhookCapabilityHandler>();\n\n  private webhookHandler: WebhookHandlerBackendService | null = null;\n\n  /**\n   * Pre-loaded endpoint configurations per provider.\n   * Populated during initialize() from first-class provider runtime contracts.\n   * setupRoutes() reads from this cache (sync) to register routes.\n   */\n  private loadedEndpoints = new Map<string, Hook_Endpoint[]>();\n\n  /** Route paths recorded only after Express accepted their registration. */\n  private registeredRoutePaths: string[] = [];\n\n  /**\n   * Declared endpoints whose route was WITHHELD because the capability could\n   * not be dispatched. Kept so the decision is inspectable after startup rather\n   * than only visible in a log line that has already scrolled past.\n   */\n  private withheldRoutes: WebhookRouteWithholding[] = [];\n\n  /**\n   * Set once {@link registerWebhookRoutes} has run. The mount decision is taken\n   * ONCE, from the registration state at that instant, so anything registered\n   * afterwards cannot change which routes exist — see\n   * {@link registerCapabilityHandler}, which refuses to let that be silent.\n   */\n  private routesRegistered = false;\n\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Logger) logger: LoggerService,\n    @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) errorBuilder: ErrorBuilderBackendService,\n    @inject(SAAS_SERVICE_TYPES.ErrorHandlerService) errorHandler: ErrorHandlerService,\n    @inject(SAAS_SERVICE_TYPES.BackendProviderRegistryService) private readonly backendProviderRegistry: BackendProviderRegistryBackendService,\n    @inject(SAAS_SERVICE_TYPES.ExternalProvidersRegistryService) private readonly externalProvidersRegistry: ExternalProvidersRegistryBackendService,\n  ) {\n    super(logger, errorBuilder, errorHandler, 'WebhookAutoController');\n  }\n\n  // ════════════════════════════════════════════════════════════\n  // Initialization\n  // ════════════════════════════════════════════════════════════\n\n  /**\n   * Initialize with required dependencies, pre-load endpoint configs, AND\n   * register the webhook routes.\n   *\n   * ── Why routes are registered HERE, not in `setupRoutes()` ──────────────\n   *\n   * `AbstractControllerBackendService` calls the abstract `setupRoutes()` hook\n   * synchronously from *inside its own constructor* (`super(...)`). At that\n   * point this controller has NOTHING to register:\n   *\n   *   1. The webhook handler is not injected via the constructor — it is\n   *      supplied to `initialize()` by `start-application` after the billing /\n   *      provider layers are wired.\n   *   2. The route SET is data-dependent (one route per provider webhook\n   *      endpoint), and those endpoint contracts are only knowable after the\n   *      provider registries have been initialized (which happens later in the\n   *      startup sequence than DI construction).\n   *\n   * So `setupRoutes()` is a deliberate no-op (see its JSDoc) and the real,\n   * data-dependent route registration runs here — the same lifecycle shape\n   * `ControllerResourceBackendService` uses for its per-resource routes.\n   *\n   * `start-application` calls this BEFORE the controllers registry mounts the\n   * router (via `getRouter()`), so the routes added here are present when the\n   * master router mounts this controller's router by reference. Errors thrown\n   * from webhook handlers propagate to the app-level error middleware\n   * (`HttpServerBackendService`), so no router-scoped error handler is needed\n   * after these routes.\n   */\n  public async initialize(\n    webhookHandler: WebhookHandlerBackendService,\n  ): Promise<void> {\n    this.webhookHandler = webhookHandler;\n\n    for (const provider of this.backendProviderRegistry.getProvidersWithProtocol(ExternalProvider_ExchangeProtocol_Kind.WEBHOOK_ORIGINATOR)) {\n      const providerRef = provider.metadata.ref;\n      try {\n        if (\n          !this.externalProvidersRegistry.isProviderEnabled(\n            providerRef,\n            ExternalProvider_ExchangeProtocol_Kind.WEBHOOK_ORIGINATOR,\n          )\n        ) {\n          continue;\n        }\n\n        const config = this.externalProvidersRegistry.getProviderConfiguration(\n          providerRef,\n          ExternalProvider_ExchangeProtocol_Kind.WEBHOOK_ORIGINATOR,\n        );\n        // `config.endpoints` is `ReadonlyArray<Hook_Endpoint>` post the\n        // 2026-05-06 webhook endpoint reshape: `Hook_Endpoint.displayName`\n        // is now optional (matches the runtime emission) and the dead\n        // extras (`providerRef` / `path` / `secretBinding`) were dropped\n        // from `buildWebhookEndpoints`. The local cache is a\n        // `Map<string, Hook_Endpoint[]>`, so we materialize a mutable\n        // copy here — the cache was historically `Hook_Endpoint[]`\n        // (mutable); preserving that semantics avoids touching every\n        // downstream signature.\n        const endpoints: Hook_Endpoint[] = [...(config?.endpoints ?? [])];\n        if (endpoints.length > 0) {\n          this.loadedEndpoints.set(providerRef, endpoints);\n          this.logDebug(`Pre-loaded ${endpoints.length} webhook endpoint(s) for ${providerRef}`);\n        } else {\n          // Genuine contract fault (not the expected \"no webhook providers\"\n          // case): the provider is ENABLED for WEBHOOK_ORIGINATOR yet exposes\n          // zero endpoints, so it will silently never receive inbound webhooks\n          // (e.g. Stripe would 404 on /webhooks/stripe/billing). Surface it\n          // once, clearly — this is a mis-sequence, not steady-state noise.\n          this.logger.warn(\n            `WebhookAutoController: provider '${providerRef}' is enabled for WEBHOOK_ORIGINATOR but exposes no endpoints — no routes will be registered for it`,\n          );\n        }\n      } catch (error) {\n        this.logger.warn(`Failed to pre-load webhook protocol for ${providerRef}`, {\n          error: (error as Error).message,\n        });\n      }\n    }\n\n    this.logDebug(`Webhook auto-controller initialized with ${this.loadedEndpoints.size} provider(s)`);\n\n    // Register the routes now that the handler + endpoint contracts are known.\n    this.registerWebhookRoutes();\n  }\n\n  /**\n   * Register a capability handler for dispatching processed events.\n   * Called at startup by capability modules (e.g., billing module).\n   *\n   * MUST be called before {@link initialize}. `start-application` satisfies this\n   * ordering today — step 4.5 initializes capability modules (which register\n   * here) and step 4.6 initializes this controller — and the guard below exists\n   * so a future step inserted the other way round is LOUD instead of silent.\n   *\n   * The failure it catches is genuinely confusing without it: a late-registered\n   * handler works perfectly at request time (the map is read per request), but\n   * the route it would serve was already withheld at mount time, so the endpoint\n   * answers 404 while a handler for it demonstrably exists.\n   */\n  registerCapabilityHandler(handler: WebhookCapabilityHandler): void {\n    this.capabilityHandlers.set(handler.capability, handler);\n\n    if (this.routesRegistered) {\n      this.logger.error(\n        `WebhookAutoController: capability handler for '${handler.capability}' was registered AFTER webhook routes were mounted. `\n        + 'Route mounting is decided once, from the registrations present at that moment, so this handler cannot bring back any route '\n        + 'that was withheld for a missing handler — those endpoints will keep answering 404. '\n        + 'Register capability handlers before WebhookAutoControllerBackendService.initialize() runs.',\n        {\n          capability: handler.capability,\n          withheldRoutes: this.withheldRoutes.map((withholding) => withholding.routePath),\n        },\n      );\n      return;\n    }\n\n    this.logDebug(`Registered webhook capability handler for ${handler.capability}`);\n  }\n\n  /**\n   * Return the sanitized inbound-provider routes that this controller actually\n   * registered. Provider configuration, signature material, endpoint payloads,\n   * and handler metadata are intentionally absent.\n   */\n  public getRegisteredWebhookRoutePaths(): ReadonlyArray<string> {\n    return [...this.registeredRoutePaths];\n  }\n\n  /**\n   * Return the declared endpoints whose route was deliberately NOT mounted,\n   * with the reason. Carries no provider configuration or signature material —\n   * only the route identity and which registration was missing.\n   */\n  public getWithheldWebhookRoutes(): ReadonlyArray<WebhookRouteWithholding> {\n    return this.withheldRoutes.map((withholding) => ({ ...withholding, reasons: [...withholding.reasons] }));\n  }\n\n  // ════════════════════════════════════════════════════════════\n  // Routes\n  // ════════════════════════════════════════════════════════════\n\n  /**\n   * Required by `AbstractControllerBackendService`, which invokes this hook\n   * synchronously from its constructor (`super(...)`). This controller\n   * intentionally registers NOTHING here: its route set is data-dependent\n   * (one route per provider webhook endpoint) and neither the webhook handler\n   * nor the provider endpoint contracts exist at construction time. The real\n   * registration happens in `initialize()` / `registerWebhookRoutes()` once\n   * that data is available — see `initialize()`'s JSDoc for the full rationale.\n   */\n  protected setupRoutes(): void {\n    // No-op by design — see JSDoc above and `registerWebhookRoutes()`.\n  }\n\n  /**\n   * Register one Express route per pre-loaded provider webhook endpoint —\n   * EXCEPT those whose capability cannot actually be dispatched.\n   *\n   * Invoked from `initialize()` after `webhookHandler` and `loadedEndpoints`\n   * have been populated. Idempotent-safe against an empty cache; guards on the\n   * handler so a mis-sequenced call fails visibly rather than registering dead\n   * routes.\n   *\n   * ── Why an undispatchable endpoint is WITHHELD rather than mounted ────────\n   *\n   * A declared endpoint needs two registrations that this controller does not\n   * own and cannot create: a `WebhookCapabilityAdapter` (verify + parse, on\n   * `WebhookHandlerBackendService`) and a `WebhookCapabilityHandler` (dispatch,\n   * here). Both are supplied by the capability module — for `billing`, inside\n   * `start-application.initializeBillingServices`, which is deliberately\n   * NON-FATAL: if it throws part-way, or if `billing.enabled` is false while the\n   * provider is still enabled for `WEBHOOK_ORIGINATOR`, the application boots\n   * with the provider's endpoint declared and neither registration present.\n   *\n   * Mounting a route in that state produces a 500 on every inbound delivery\n   * (`No webhook adapter registered for ...`, or `No capability handler for ...`\n   * below), and a 500 is precisely the answer that tells a vendor to RETRY — an\n   * instruction that can never be satisfied, because no retry supplies a missing\n   * startup registration. The endpoint therefore absorbs the vendor's full retry\n   * schedule and eventually gets disabled on the vendor's side, while the only\n   * local signal is a repeating error log.\n   *\n   * Not mounting says the true thing instead: this endpoint does not exist. The\n   * vendor gets a 404 rather than a retry instruction, and the operator gets one\n   * loud, remedy-naming error at startup — the moment the misconfiguration was\n   * actually introduced.\n   *\n   * REJECTED — refusing at BOOT (throwing from here). It is the shape the rest of\n   * the registry uses, and it is wrong at this site for three reasons. (1) It\n   * would not even be loud: `start-application.initializeWebhookAutoController`\n   * wraps `initialize()` in a non-fatal catch that downgrades a throw to a warn,\n   * so the net effect would be a quieter log AND the loss of every OTHER\n   * provider's working route. (2) It inverts a decision the engine already took\n   * explicitly — billing initialization failure is documented as survivable\n   * (\"the app can still run without billing\"); a failed optional subsystem must\n   * not become a refusal to start. (3) `billing.enabled: false` beside a\n   * registered Stripe provider is a COHERENT configuration, and refusing to boot\n   * over it would be a false alarm. The check is per-endpoint, so a capability\n   * that is wired keeps its route regardless of a sibling that is not.\n   */\n  private registerWebhookRoutes(): void {\n    this.routesRegistered = true;\n\n    if (!this.webhookHandler) {\n      this.logger.warn('WebhookAutoController: initialize() ran without a webhook handler — no routes registered');\n      return;\n    }\n\n    if (this.loadedEndpoints.size === 0) {\n      this.logDebug('No webhook endpoints pre-loaded — no routes registered');\n      return;\n    }\n\n    for (const [providerRef, endpoints] of this.loadedEndpoints) {\n      for (const endpoint of endpoints) {\n        const routePath = `/webhooks/${providerRef}/${endpoint.key}`;\n\n        const withholding = this.assessRouteDispatchability(providerRef, endpoint, routePath);\n        if (withholding) {\n          this.withheldRoutes.push(withholding);\n          this.logger.error(\n            `WebhookAutoController: NOT registering POST ${routePath} — the endpoint is declared but cannot be dispatched `\n            + `(${withholding.reasons.join(', ')}). A route mounted in this state can only ever answer 500, which instructs the `\n            + 'vendor to retry an inbound event that no retry can make processable. Withholding the route so the vendor gets a '\n            + '404 instead. Remedy: register the capability module that owns '\n            + `'${endpoint.capability}' before WebhookAutoControllerBackendService.initialize() runs (for billing, check whether `\n            + 'billing initialization was skipped or failed non-fatally earlier in startup), or disable the WEBHOOK_ORIGINATOR '\n            + `protocol for provider '${providerRef}'.`,\n            {\n              providerRef,\n              endpointKey: endpoint.key,\n              capability: endpoint.capability,\n              routePath,\n              reasons: withholding.reasons,\n            },\n          );\n          continue;\n        }\n\n        this.router.post(\n          routePath,\n          // Defense-in-depth for a future streaming mount. If this controller is\n          // ever assigned the RAW_REQUEST_STREAM mount phase, this express.raw()\n          // makes req.body the raw Buffer. Under the\n          // current master-router mount it is an inert no-op: the global\n          // express.json (HttpServerBackendService.setupBodyParsing) parses the\n          // body first and sets req._body, so the signature-faithful bytes come\n          // from req.rawBody — captured by that same express.json `verify` hook.\n          // handleWebhookRequest reads rawBody first, then falls back to a Buffer\n          // req.body for the streaming case.\n          express.raw({ type: 'application/json' }),\n          this.asyncHandler(async (req: Request, res: Response, _next: NextFunction) => {\n            await this.handleWebhookRequest(providerRef, endpoint, req, res);\n          }),\n        );\n\n        this.registeredRoutePaths.push(routePath);\n        this.logger.info(`Webhook endpoint registered: POST ${routePath}`);\n      }\n    }\n  }\n\n  /**\n   * Decide whether a declared endpoint can actually be served, and if not, say\n   * which registration is missing.\n   *\n   * Returns `null` when the route is dispatchable. Both prerequisites are\n   * evaluated (rather than short-circuiting on the first) so an operator gets\n   * the WHOLE remedy in one log line instead of fixing one registration and\n   * meeting the next on the following restart.\n   */\n  private assessRouteDispatchability(\n    providerRef: string,\n    endpoint: Hook_Endpoint,\n    routePath: string,\n  ): WebhookRouteWithholding | null {\n    const reasons: WebhookRouteWithholdingReason[] = [];\n\n    if (!this.capabilityHandlers.has(endpoint.capability)) {\n      reasons.push(WebhookRouteWithholdingReason.NO_CAPABILITY_HANDLER);\n    }\n    if (!this.webhookHandler?.hasAdapter(providerRef, endpoint.key)) {\n      reasons.push(WebhookRouteWithholdingReason.NO_ENDPOINT_ADAPTER);\n    }\n\n    if (reasons.length === 0) {\n      return null;\n    }\n    return { providerRef, endpointKey: endpoint.key, capability: endpoint.capability, routePath, reasons };\n  }\n\n  // ════════════════════════════════════════════════════════════\n  // Handler\n  // ════════════════════════════════════════════════════════════\n\n  private async handleWebhookRequest(\n    providerRef: string,\n    endpoint: Hook_Endpoint,\n    req: Request,\n    res: Response,\n  ): Promise<void> {\n    if (!this.webhookHandler) {\n      res.status(503).json({ error: 'Webhook handler not initialized' });\n      return;\n    }\n\n    // Raw request bytes for signature verification. Order matters:\n    //   1. req.rawBody — captured by the global express.json `verify` hook\n    //      (HttpServerBackendService.setupBodyParsing). This is the provider's\n    //      EXACT original payload and the ONLY byte-faithful source under the\n    //      current master-router mount, where global express.json parses the\n    //      body before this route runs (making the per-route express.raw() a\n    //      no-op, so req.body is a parsed object here).\n    //   2. Buffer req.body — only populated if this controller is ever\n    //      streaming-mounted before body parsing (per-route express.raw() fires).\n    //   3. string / JSON.stringify — last-resort fallbacks; JSON.stringify will\n    //      NOT byte-match the provider (key ordering / whitespace), so it exists\n    //      only to avoid a crash, never as a correctness path for signatures.\n    const rawBody = Buffer.isBuffer(req.rawBody)\n      ? req.rawBody.toString('utf-8')\n      : Buffer.isBuffer(req.body)\n        ? req.body.toString('utf-8')\n        : typeof req.body === 'string'\n          ? req.body\n          : JSON.stringify(req.body);\n\n    let result: Awaited<ReturnType<WebhookHandlerBackendService['processWebhook']>> | null = null;\n    try {\n      result = await this.webhookHandler.processWebhook({\n        providerRef,\n        endpointKey: endpoint.key,\n        endpoint,\n        rawBody,\n        headers: req.headers as Record<string, string>,\n      });\n\n      // null = idempotent duplicate or unparseable event — already acknowledged\n      if (!result) {\n        res.status(200).json({ received: true });\n        return;\n      }\n\n      // Dispatch to capability handler.\n      //\n      // Defence in depth only: `registerWebhookRoutes` refuses to MOUNT a route\n      // whose capability has no handler, so this branch is unreachable while that\n      // gate holds — reaching it means the handler map was mutated after mounting\n      // (which `registerCapabilityHandler` refuses to do silently). The throw is\n      // kept rather than removed because the alternative — dispatching to\n      // `undefined` — would 500 anyway, with no explanation.\n      const handler = this.capabilityHandlers.get(endpoint.capability);\n      if (handler) {\n        await handler.handleEvent(result.executionContext, result.parsedEvent);\n      } else {\n        throw new Error(`No capability handler for ${endpoint.capability} on ${providerRef}/${endpoint.key}`);\n      }\n\n      await this.webhookHandler.markWebhookProcessed(result.idempotencyKey);\n      res.status(200).json({ received: true });\n    } catch (error) {\n      const errorMessage = (error as Error).message ?? 'Unknown error';\n      const errorType = (error as any)?.errorType;\n\n      // Signature failure → 401\n      if (errorType === 'AUTHORIZATION') {\n        this.logDebug('Webhook signature verification failed', { providerRef, endpointKey: endpoint.key });\n        res.status(401).json({ error: 'Invalid signature' });\n        return;\n      }\n\n      // All other errors → 500 (trigger provider retry)\n      this.logger.error('Webhook processing failed', {\n        providerRef,\n        endpointKey: endpoint.key,\n        error: errorMessage,\n      });\n      await this.webhookHandler.releaseWebhookClaim(result?.idempotencyKey);\n      res.status(500).json({ error: 'Processing failed' });\n    }\n  }\n}\n"]}

package/dist/esm/notifications/webhooks/outbound/batches/m2m-webhook-delivery.batch.backend.service.d.ts

@@ -30,12 +30,6 @@
 import { z } from 'zod';
 import { AuthScopeType } from '@wildo-ai/saas-models';
 import { type BatchesCronjobsCustomExecution_Service } from '../../../../base-classes/services/batches/batches-cronjobs-custom-execution.service';
-/**
- * The dispatcher writes the row first, then enqueues this lightweight
- * payload. Keeping the payload minimal (id + scope) makes the worker
- * resilient to queue / DB race conditions: re-reading the row is the
- * source of truth.
- */
 export declare const M2MWebhookDeliveryBatchInputSchema: z.ZodObject<{
     scope: z.ZodObject<{
         type: z.ZodEnum<typeof AuthScopeType>;

package/dist/esm/notifications/webhooks/outbound/batches/m2m-webhook-delivery.batch.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"m2m-webhook-delivery.batch.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../../src/notifications/webhooks/outbound/batches/m2m-webhook-delivery.batch.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,aAAa,EACd,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAEL,KAAK,sCAAsC,EAC5C,MAAM,4FAA4F,CAAC;AAmBpG;;;;;GAKG;AACH,eAAO,MAAM,kCAAkC;;;;;;iBAM7C,CAAC;AAEH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F,eAAO,MAAM,mCAAmC;;;;;;;;;;;;iBAiB9C,CAAC;AAEH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAMhG,eAAO,MAAM,8BAA8B,EAAE,sCAAsC,CACjF,OAAO,kCAAkC,EACzC,OAAO,mCAAmC,CAsU1C,CAAC"}
+{"version":3,"file":"m2m-webhook-delivery.batch.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../../src/notifications/webhooks/outbound/batches/m2m-webhook-delivery.batch.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,aAAa,EAId,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAEL,KAAK,sCAAsC,EAC5C,MAAM,4FAA4F,CAAC;AAmDpG,eAAO,MAAM,kCAAkC;;;;;;iBAM7C,CAAC;AAEH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F,eAAO,MAAM,mCAAmC;;;;;;;;;;;;iBAiB9C,CAAC;AAEH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAMhG,eAAO,MAAM,8BAA8B,EAAE,sCAAsC,CACjF,OAAO,kCAAkC,EACzC,OAAO,mCAAmC,CA8V1C,CAAC"}

package/dist/esm/notifications/webhooks/outbound/batches/m2m-webhook-delivery.batch.backend.service.js

@@ -28,7 +28,7 @@
  *   (precedent: same pattern for an event-triggered custom batch).
  */
 import { z } from 'zod';
-import { AuthScopeType, } from '@wildo-ai/saas-models';
+import { AuthScopeType, M2M_WEBHOOK_DELIVERY_CONTRACT, webhookEndpointDestinationHost, webhookEndpointTransportIsPlaintext, } from '@wildo-ai/saas-models';
 import { createCustomBatchExecutionService, } from '../../../../base-classes/services/batches/batches-cronjobs-custom-execution.service.js';
 import { ENGINE_M2M_WEBHOOK_DELIVERY_BATCH_MANIFEST } from '../../../../base-classes/services/batches/engine-custom-batch-manifests.js';
 import { describeCaughtError, projectCaughtErrorLogFields } from '../../../../errors/utils/error-log-level-classification.backend.utils.js';
@@ -45,6 +45,31 @@ import { M2M_WEBHOOK_BODY_HASH_ALGORITHM, sendSignedWebhookRequest } from '../m2
  * resilient to queue / DB race conditions: re-reading the row is the
  * source of truth.
  */
+/**
+ * Endpoints already warned about in this process, so a permanently-plaintext destination costs one
+ * line rather than one per delivery (#492).
+ *
+ * ## Why the warning is HERE, and why it is once
+ *
+ * Plaintext endpoints are ADMITTED — a commercial accommodation recorded on
+ * `WebhookEndpointSchema.url` — and the cost of admitting them is that the decision becomes
+ * invisible. The obvious place to say so is the moment an endpoint is SAVED, and that place does
+ * not exist: `webhookConfig` declares CREATE and UPDATE `REPOSITORY_ONLY` with no admin route, and
+ * the only writer that exists (data seeding) reaches the row through `upsertByBusinessKey`, a raw
+ * repository call that no operation-pipeline hook observes. A postfix handler there would have been
+ * a mechanism nothing runs — the shape this whole review exists to remove.
+ *
+ * The delivery IS the exposure, so this is where it can be stated truthfully: every POST over
+ * `http://` puts the signature JWT on the wire in the clear, readable and replayable by anyone on
+ * the path until it expires.
+ *
+ * Once per endpoint per process, because a webhook configuration is stable: a WARN on every
+ * delivery would be a line an operator learns to filter, and a filtered warning is the same as no
+ * warning. The set is bounded by the endpoint population and is deliberately NOT time-based — the
+ * fact does not become news again after an hour, it becomes news again when the process restarts
+ * and re-reads a configuration somebody may have changed.
+ */
+const PLAINTEXT_ENDPOINTS_ALREADY_WARNED = new Set();
 export const M2MWebhookDeliveryBatchInputSchema = z.object({
     scope: z.object({
         type: z.enum(AuthScopeType),
@@ -204,12 +229,14 @@ export const m2mWebhookDeliveryBatchService = createCustomBatchExecutionService(
             // refreshed per attempt and so cannot serve as a replay marker.
             // See `m2m-webhook-dispatcher.backend.service.ts` (`signatureJti`
             // creation site) for the full consumer-contract JSDoc.
-            jti: row.signatureJti,
-            bodyHash: row.payloadHash,
-            bodyHashAlg: M2M_WEBHOOK_BODY_HASH_ALGORITHM,
-            eventChannel: row.channel,
-            resourceIdentifier: row.resourceIdentifier,
-            operationIdentifier: row.operationIdentifier,
+            // Claim NAMES come from the published receiver contract so the customer
+            // documentation and this signing site cannot drift apart.
+            [M2M_WEBHOOK_DELIVERY_CONTRACT.signatureClaims.deliveryId]: row.signatureJti,
+            [M2M_WEBHOOK_DELIVERY_CONTRACT.signatureClaims.bodyHash]: row.payloadHash,
+            [M2M_WEBHOOK_DELIVERY_CONTRACT.signatureClaims.bodyHashAlgorithm]: M2M_WEBHOOK_BODY_HASH_ALGORITHM,
+            [M2M_WEBHOOK_DELIVERY_CONTRACT.signatureClaims.eventChannel]: row.channel,
+            [M2M_WEBHOOK_DELIVERY_CONTRACT.signatureClaims.resourceIdentifier]: row.resourceIdentifier,
+            [M2M_WEBHOOK_DELIVERY_CONTRACT.signatureClaims.operationIdentifier]: row.operationIdentifier,
             // `iss`, `iat`, `exp`, `aud`, `kid` defaults come from
             // `JwtPrivateKeySignOptions[APPLICATION_WEBHOOK]`. We don't
             // override them here — the consumer-facing contract is the
@@ -251,6 +278,26 @@ export const m2mWebhookDeliveryBatchService = createCustomBatchExecutionService(
         // connectivity test must exercise THIS transport, not a parallel one,
         // or a green test would prove nothing about real deliveries.
         const bodyBytes = typeof row.payload === 'string' ? row.payload : JSON.stringify(row.payload);
+        if (webhookEndpointTransportIsPlaintext(row.httpUrl)) {
+            const warnedKey = `${input.scope.type}:${input.scope.id}:${row.endpointId}`;
+            if (!PLAINTEXT_ENDPOINTS_ALREADY_WARNED.has(warnedKey)) {
+                PLAINTEXT_ENDPOINTS_ALREADY_WARNED.add(warnedKey);
+                // NOT debug. The whole point is that an operator meets this without going looking, and
+                // `AbstractControllerBackendService` disables the debug channel — the same trap that made a
+                // readiness breakdown unreachable in #498.
+                logger.warn('Webhook endpoint is plaintext: the delivery signature is sent in the clear', {
+                    scopeType: input.scope.type,
+                    scopeId: input.scope.id,
+                    endpointId: row.endpointId,
+                    // Host only, never the URL — a customer endpoint's path routinely carries a per-tenant
+                    // token, and this line reaches the ordinary log stream.
+                    destinationHost: webhookEndpointDestinationHost(row.httpUrl),
+                    exposure: 'The signature JWT is readable on the network path and replayable against this '
+                        + 'endpoint until it expires, so an observer of one delivery can forge the next.',
+                    remedy: 'Reconfigure this endpoint with an https:// URL.',
+                });
+            }
+        }
         const { responseStatus, responseBodyTruncated, networkError } = await sendSignedWebhookRequest({
             url: row.httpUrl,
             body: bodyBytes,

package/dist/esm/notifications/webhooks/outbound/batches/m2m-webhook-delivery.batch.backend.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"m2m-webhook-delivery.batch.backend.service.js","sourceRoot":"","sources":["../../../../../../../src/notifications/webhooks/outbound/batches/m2m-webhook-delivery.batch.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,aAAa,GACd,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,iCAAiC,GAElC,MAAM,4FAA4F,CAAC;AACpG,OAAO,EAAE,0CAA0C,EAAE,MAAM,gFAAgF,CAAC;AAC5I,OAAO,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAChJ,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAEpF,OAAO,EAAE,cAAc,EAAE,MAAM,wEAAwE,CAAC;AAGxG,OAAO,EACL,YAAY,EACZ,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,+BAA+B,EAAE,wBAAwB,EAAE,MAAM,6CAA6C,CAAC;AAExH,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC;QAC3B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KACtB,CAAC;IACF,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACjC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB;;;;OAIG;IACH,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC;QACd,WAAW;QACX,iBAAiB;QACjB,iBAAiB;QACjB,qBAAqB;QACrB,wBAAwB;KACzB,CAAC;IACF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC5C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC3C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CAC3C,CAAC,CAAC;AAIH,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E,MAAM,CAAC,MAAM,8BAA8B,GAGvC,iCAAiC,CAAC;IACpC,KAAK,EAAE,kCAAkC;IACzC,MAAM,EAAE,mCAAmC;IAC3C,oBAAoB,EAAE;QACpB,iEAAiE;QACjE,wEAAwE;QACxE,qEAAqE;QACrE,iEAAiE;QACjE,6CAA6C;QAC7C,6CAA6C;QAC7C,sCAAsC;QACtC,6CAA6C;QAC7C,EAAE;QACF,4BAA4B;QAC5B,uEAAuE;QACvE,sEAAsE;QACtE,6DAA6D;QAC7D,oEAAoE;QACpE,uEAAuE;QACvE,sEAAsE;QACtE,mEAAmE;QACnE,8DAA8D;QAC9D,oEAAoE;QACpE,sEAAsE;QACtE,IAAI,EAAE,0CAA0C,CAAC,IAAI;QACrD,mBAAmB,EAAE,0CAA0C,CAAC,mBAAmB;QACnF,YAAY,EAAE,0CAA0C,CAAC,YAAY;KACtE;IACD,mBAAmB,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;QACjC,UAAU,EAAE,GAAG,CACb,kBAAkB,CAAC,+BAA+B,CACnD;QACD,UAAU,EAAE,GAAG,CAAoB,kBAAkB,CAAC,iBAAiB,CAAC;QACxE,cAAc,EAAE,GAAG,CAAiB,kBAAkB,CAAC,cAAc,CAAC;KACvE,CAAC;IACF,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,YAAY,EAAE,EAAE,EAAE;QACpE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,yBAAyB,CAAC,CAAC;QAC/D,MAAM,EACJ,UAAU,EAAE,IAAI,EAChB,UAAU,EACV,cAAc,GACf,GAAG,YAAY,CAAC;QAEjB;;;;;;;;;;;;;;;;;;;WAmBG;QACH,MAAM,eAAe,GAAG,CACtB,MAAqC,EACN,EAAE;YACjC,IAAI,CAAC;gBACH,cAAc,CAAC,+BAA+B,CAAC;oBAC7C,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;oBACvB,OAAO,EAAE,MAAM,CAAC,OAAO;iBACxB,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CAAC,sDAAsD,EAAE;oBAClE,aAAa,EAAE,KAAK,CAAC,aAAa;oBAClC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;oBAC3B,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE;oBACvB,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,GAAG,2BAA2B,CAAC,KAAK,CAAC;iBACtC,CAAC,CAAC;YACL,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC;QAEF,8DAA8D;QAC9D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,gBAAgB,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;QAChF,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,4DAA4D;YAC5D,+DAA+D;YAC/D,sDAAsD;YACtD,MAAM,CAAC,IAAI,CAAC,0CAA0C,EAAE;gBACtD,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;gBAC3B,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE;aACxB,CAAC,CAAC;YACH,OAAO,eAAe,CAAC;gBACrB,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,OAAO,EAAE,qBAAqB;gBAC9B,YAAY,EAAE,CAAC;gBACf,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,gBAAgB,GAAG,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAErD,8DAA8D;QAC9D,gEAAgE;QAChE,kEAAkE;QAClE,gEAAgE;QAChE,6DAA6D;QAC7D,0DAA0D;QAC1D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CACpC,KAAK,CAAC,KAAK,EACX,gBAAgB,EAChB,KAAK,CAAC,aAAa,EACnB,gBAAgB,CACjB,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,CAAC,IAAI,CAAC,iEAAiE,EAAE;gBAC7E,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;gBAC3B,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE;gBACvB,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,YAAY,EAAE,GAAG,CAAC,YAAY;gBAC9B,aAAa,EAAE,GAAG,CAAC,MAAM;aAC1B,CAAC,CAAC;YACH,OAAO,eAAe,CAAC;gBACrB,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,OAAO,EAAE,wBAAwB;gBACjC,YAAY,EAAE,GAAG,CAAC,YAAY,IAAI,CAAC;gBACnC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC,CAAC;QACL,CAAC;QAED,8DAA8D;QAC9D,iEAAiE;QACjE,8DAA8D;QAC9D,iEAAiE;QACjE,2CAA2C;QAC3C,MAAM,MAAM,GAAG;YACb,8DAA8D;YAC9D,8DAA8D;YAC9D,2DAA2D;YAC3D,6DAA6D;YAC7D,gEAAgE;YAChE,kEAAkE;YAClE,uDAAuD;YACvD,GAAG,EAAE,GAAG,CAAC,YAAY;YACrB,QAAQ,EAAE,GAAG,CAAC,WAAW;YACzB,WAAW,EAAE,+BAA+B;YAC5C,YAAY,EAAE,GAAG,CAAC,OAAO;YACzB,kBAAkB,EAAE,GAAG,CAAC,kBAAkB;YAC1C,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;YAC5C,uDAAuD;YACvD,4DAA4D;YAC5D,2DAA2D;YAC3D,6CAA6C;SAC9C,CAAC;QAEF,IAAI,SAAiB,CAAC;QACtB,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,mBAAmB,CAAC,CAAC;QAChF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,6DAA6D;YAC7D,+DAA+D;YAC/D,gEAAgE;YAChE,oBAAoB;YACpB,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;YAC1C,MAAM,CAAC,KAAK,CAAC,0DAA0D,EAAE;gBACvE,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;gBAC3B,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE;gBACvB,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,YAAY,EAAE,GAAG,CAAC,YAAY;gBAC9B,OAAO,EAAE,gBAAgB;gBACzB,KAAK;aACN,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,EAAE,gBAAgB,EAAE,KAAK,CAAC,aAAa,EAAE;gBAC/E,aAAa,EAAE,uBAAuB,MAAM,EAAE;aAC/C,CAAC,CAAC;YACH,OAAO,eAAe,CAAC;gBACrB,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,OAAO,EAAE,iBAAiB;gBAC1B,YAAY,EAAE,gBAAgB;gBAC9B,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC,CAAC;QACL,CAAC;QAED,8DAA8D;QAC9D,0DAA0D;QAC1D,mEAAmE;QACnE,sEAAsE;QACtE,6DAA6D;QAC7D,MAAM,SAAS,GACb,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC9E,MAAM,EAAE,cAAc,EAAE,qBAAqB,EAAE,YAAY,EAAE,GAAG,MAAM,wBAAwB,CAAC;YAC7F,GAAG,EAAE,GAAG,CAAC,OAAO;YAChB,IAAI,EAAE,SAAS;YACf,SAAS;SACV,CAAC,CAAC;QAEH,2EAA2E;QAC3E,uEAAuE;QACvE,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAE1C,8DAA8D;QAC9D,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACjC,MAAM,OAAO,GAAG,sBAAsB,CAAC,cAAc,CAAC,CAAC;YAEvD,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;gBAC5B,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,EAAE,gBAAgB,EAAE,KAAK,CAAC,aAAa,EAAE;oBAC3E,cAAc;oBACd,qBAAqB;iBACtB,CAAC,CAAC;gBACH,QAAQ,CAAC,mBAAmB,EAAE;oBAC5B,aAAa,EAAE,KAAK,CAAC,aAAa;oBAClC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;oBAC3B,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE;oBACvB,UAAU,EAAE,GAAG,CAAC,UAAU;oBAC1B,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,YAAY,EAAE,GAAG,CAAC,YAAY;oBAC9B,UAAU,EAAE,cAAc;oBAC1B,UAAU;oBACV,OAAO,EAAE,gBAAgB;iBAC1B,CAAC,CAAC;gBACH,OAAO,eAAe,CAAC;oBACrB,aAAa,EAAE,KAAK,CAAC,aAAa;oBAClC,OAAO,EAAE,WAAW;oBACpB,YAAY,EAAE,gBAAgB;oBAC9B,cAAc;oBACd,UAAU;iBACX,CAAC,CAAC;YACL,CAAC;YAED,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;gBACxB,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,EAAE,gBAAgB,EAAE,KAAK,CAAC,aAAa,EAAE;oBAC/E,cAAc;oBACd,qBAAqB;oBACrB,aAAa,EAAE,6BAA6B,cAAc,EAAE;iBAC7D,CAAC,CAAC;gBACH,MAAM,CAAC,IAAI,CAAC,yCAAyC,EAAE;oBACrD,aAAa,EAAE,KAAK,CAAC,aAAa;oBAClC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;oBAC3B,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE;oBACvB,UAAU,EAAE,GAAG,CAAC,UAAU;oBAC1B,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,YAAY,EAAE,GAAG,CAAC,YAAY;oBAC9B,UAAU,EAAE,cAAc;oBAC1B,UAAU;oBACV,OAAO,EAAE,gBAAgB;iBAC1B,CAAC,CAAC;gBACH,OAAO,eAAe,CAAC;oBACrB,aAAa,EAAE,KAAK,CAAC,aAAa;oBAClC,OAAO,EAAE,iBAAiB;oBAC1B,YAAY,EAAE,gBAAgB;oBAC9B,cAAc;oBACd,UAAU;iBACX,CAAC,CAAC;YACL,CAAC;YAED,gEAAgE;QAClE,CAAC;QAED,6DAA6D;QAC7D,oDAAoD;QACpD,MAAM,aAAa,GACjB,YAAY,IAAI,yBAAyB,cAAc,IAAI,SAAS,EAAE,CAAC;QAEzE,IAAI,gBAAgB,IAAI,YAAY,EAAE,CAAC;YACrC,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,EAAE,gBAAgB,EAAE,KAAK,CAAC,aAAa,EAAE;gBAC/E,cAAc;gBACd,qBAAqB;gBACrB,aAAa,EAAE,GAAG,aAAa,eAAe,YAAY,WAAW;aACtE,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,6CAA6C,EAAE;gBACzD,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;gBAC3B,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE;gBACvB,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,YAAY,EAAE,GAAG,CAAC,YAAY;gBAC9B,UAAU,EAAE,cAAc;gBAC1B,UAAU;gBACV,OAAO,EAAE,gBAAgB;gBACzB,aAAa;aACd,CAAC,CAAC;YACH,OAAO,eAAe,CAAC;gBACrB,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,OAAO,EAAE,iBAAiB;gBAC1B,YAAY,EAAE,gBAAgB;gBAC9B,cAAc;gBACd,UAAU;aACX,CAAC,CAAC;QACL,CAAC;QAED,MAAM,aAAa,GAAG,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;QAC7D,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,EAAE,gBAAgB,EAAE,KAAK,CAAC,aAAa,EAAE;YAC/E,cAAc;YACd,qBAAqB;YACrB,aAAa;YACb,aAAa;SACd,CAAC,CAAC;QACH,QAAQ,CAAC,kCAAkC,EAAE;YAC3C,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;YAC3B,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE;YACvB,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,YAAY,EAAE,GAAG,CAAC,YAAY;YAC9B,UAAU,EAAE,cAAc;YAC1B,UAAU;YACV,OAAO,EAAE,gBAAgB;YACzB,aAAa,EAAE,aAAa,CAAC,WAAW,EAAE;YAC1C,aAAa;SACd,CAAC,CAAC;QACH,OAAO,eAAe,CAAC;YACrB,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,OAAO,EAAE,iBAAiB;YAC1B,YAAY,EAAE,gBAAgB;YAC9B,cAAc;YACd,UAAU;SACX,CAAC,CAAC;IACL,CAAC;CACF,CAAC,CAAC;AAEH,wEAAwE;AACxE,6EAA6E;AAC7E,qEAAqE;AACrE,sDAAsD","sourcesContent":["/**\n * M2M Webhook Delivery Batch Worker\n *\n * Event-triggered custom batch — one job per delivery row enqueued by\n * `M2MWebhookDispatcherBackendService.enqueueDelivery`. The worker:\n *   1. Re-reads the row from `M2MWebhookDeliveryLog` (ground truth —\n *      we never trust in-flight queue state for the body or signature).\n *   2. Marks it `IN_FLIGHT` (incrementing `attemptCount`).\n *   3. Builds the JWT signature with `JwtPrivateKeys.APPLICATION_WEBHOOK`.\n *   4. POSTs the body with a 30s `AbortController` timeout.\n *   5. Classifies the response and records the terminal/intermediate\n *      transition on the row.\n *\n * Status classification (D6):\n *   - 2xx                            → DELIVERED (terminal success).\n *   - 4xx, excluding 408 / 429       → FAILED (terminal — non-retryable).\n *   - 408 / 429 / 5xx / network      → mark failed attempt; if\n *                                       `attemptCount >= MAX_ATTEMPTS`,\n *                                       transition to FAILED.\n *\n * Custom batches are factory-created rather than constructor-injected. This\n * batch therefore declares its exact services through `resolveDependencies`;\n * the executor resolves them lazily for each invocation and `doHandle`\n * receives only the typed named result.\n *\n * @see m2m-webhook-organization-delivery.md — Phase 3 / Step 10\n * @see notifications/email/services/email-batch-send.batch.backend.service.ts\n *   (precedent: same pattern for an event-triggered custom batch).\n */\n\nimport { z } from 'zod';\nimport {\n  AuthScopeType,\n} from '@wildo-ai/saas-models';\nimport {\n  createCustomBatchExecutionService,\n  type BatchesCronjobsCustomExecution_Service,\n} from '~wildo-backend-lib/base-classes/services/batches/batches-cronjobs-custom-execution.service';\nimport { ENGINE_M2M_WEBHOOK_DELIVERY_BATCH_MANIFEST } from '~wildo-backend-lib/base-classes/services/batches/engine-custom-batch-manifests';\nimport { describeCaughtError, projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { JwtBackendService } from '~wildo-backend-lib/security/jwt/services/jwt.backend.service';\nimport { JwtPrivateKeys } from '~wildo-backend-lib/security/authentications/models/jwt.backend.schemas';\nimport type { MetricsService } from '~wildo-backend-lib/monitoring/observability/services/metrics.service';\nimport type { M2MWebhookDeliveryLogRepository } from '~wildo-backend-lib/notifications/webhooks/outbound/services/m2m-webhook-delivery-log.repository';\nimport {\n  MAX_ATTEMPTS,\n  classifyResponseStatus,\n  computeNextAttemptAt,\n} from './m2m-webhook-delivery.batch.utils';\nimport { M2M_WEBHOOK_BODY_HASH_ALGORITHM, sendSignedWebhookRequest } from '../m2m-webhook-signed-request.backend.utils';\n\n// ═══════════════════════════════════════════════════════════════════════════\n// Input / Output schemas\n// ═══════════════════════════════════════════════════════════════════════════\n\n/**\n * The dispatcher writes the row first, then enqueues this lightweight\n * payload. Keeping the payload minimal (id + scope) makes the worker\n * resilient to queue / DB race conditions: re-reading the row is the\n * source of truth.\n */\nexport const M2MWebhookDeliveryBatchInputSchema = z.object({\n  scope: z.object({\n    type: z.enum(AuthScopeType),\n    id: z.string().min(1),\n  }),\n  deliveryLogId: z.string().min(1),\n});\n\nexport type M2MWebhookDeliveryBatchInput = z.infer<typeof M2MWebhookDeliveryBatchInputSchema>;\n\nexport const M2MWebhookDeliveryBatchOutputSchema = z.object({\n  deliveryLogId: z.string(),\n  /**\n   * High-level outcome string. Stored only in the worker output for\n   * cron / log inspection; the persisted truth lives on the row's\n   * `status` field.\n   */\n  outcome: z.enum([\n    'delivered',\n    'retry_scheduled',\n    'failed_terminal',\n    'skipped_missing_row',\n    'skipped_already_leased',\n  ]),\n  attemptCount: z.number().int().nonnegative(),\n  responseStatus: z.number().int().optional(),\n  durationMs: z.number().int().nonnegative(),\n});\n\nexport type M2MWebhookDeliveryBatchOutput = z.infer<typeof M2MWebhookDeliveryBatchOutputSchema>;\n\n// ═══════════════════════════════════════════════════════════════════════════\n// Batch Service\n// ═══════════════════════════════════════════════════════════════════════════\n\nexport const m2mWebhookDeliveryBatchService: BatchesCronjobsCustomExecution_Service<\n  typeof M2MWebhookDeliveryBatchInputSchema,\n  typeof M2MWebhookDeliveryBatchOutputSchema\n> = createCustomBatchExecutionService({\n  input: M2MWebhookDeliveryBatchInputSchema,\n  output: M2MWebhookDeliveryBatchOutputSchema,\n  batchCronjob_Context: {\n    // Anchored on the `APPLICATION` primary scope rather than a fake\n    // `ORGANIZATION_M2M_WEBHOOK_DELIVERY_LOG` operation: an event-triggered\n    // polymorphic worker has no honest \"primary\" resource (each enqueued\n    // row carries its own `scope: { type, id }` and routes to either\n    // `ORGANIZATION_M2M_WEBHOOK_DELIVERY_LOG` or\n    // `APPLICATION_M2M_WEBHOOK_DELIVERY_LOG` via\n    // `resolveDeliveryLogResourceType` in\n    // `m2m-webhook-delivery-log.repository.ts`).\n    //\n    // The bootstrap path inside\n    // `ExecutionContextCreatorBackendService.createForInternalCustomBatch`\n    // resolves an `APPLICATION.READ` operation, populates the application\n    // id, then swaps in `notifications:m2m-webhook-delivery` via\n    // `withOperation()`. Audit trails surface the honest batch identity\n    // and authorization runs against `APP_ADMIN_SUPER_ADMIN @ APPLICATION`\n    // (see `createInternalSystemRoles()`), exactly as before, but without\n    // pretending the worker mutates the org-variant log on every job —\n    // including for app-scoped deliveries where that anchor was a\n    // flat-out lie. Per-row resource-type resolution (org vs app) stays\n    // inside the worker and is driven off the per-row `input.scope.type`.\n    kind: ENGINE_M2M_WEBHOOK_DELIVERY_BATCH_MANIFEST.kind,\n    operationIdentifier: ENGINE_M2M_WEBHOOK_DELIVERY_BATCH_MANIFEST.operationIdentifier,\n    primaryScope: ENGINE_M2M_WEBHOOK_DELIVERY_BATCH_MANIFEST.primaryScope,\n  },\n  resolveDependencies: ({ get }) => ({\n    repository: get<M2MWebhookDeliveryLogRepository>(\n      SAAS_SERVICE_TYPES.M2MWebhookDeliveryLogRepository,\n    ),\n    jwtService: get<JwtBackendService>(SAAS_SERVICE_TYPES.JwtBackendService),\n    metricsService: get<MetricsService>(SAAS_SERVICE_TYPES.MetricsService),\n  }),\n  doHandle: async (input, { logger, executionContext, dependencies }) => {\n    const startedAt = Date.now();\n    const logDebug = logger.debugByType('M2MWebhookDeliveryBatch');\n    const {\n      repository: repo,\n      jwtService,\n      metricsService,\n    } = dependencies;\n\n    /**\n     * Single funnel for every `doHandle` return-point. Mirrors the\n     * batch output back to the caller while firing the Phase 5 /\n     * Step 17 outcome counter exactly once per worker invocation.\n     *\n     * Kept inline (not extracted to a module-level helper) because it\n     * closes over `metricsService` and `input.scope.type` — lifting it\n     * would need re-threading both via parameters on every call site\n     * and would dilute the fire-exactly-once contract this funnel\n     * enforces.\n     *\n     * Metric emission is error-isolated for the same reason the audit\n     * helper swallows its failures: observability MUST NEVER fail the\n     * main flow. By the time `recordAndReturn` runs, the row has\n     * already been persisted with the correct terminal/intermediate\n     * status — letting an OpenTelemetry exporter glitch abort the\n     * batch invocation here would leave the custom-batch runner\n     * reporting the run as failed even though the real delivery\n     * completed and the truth-source row reflects success.\n     */\n    const recordAndReturn = (\n      output: M2MWebhookDeliveryBatchOutput,\n    ): M2MWebhookDeliveryBatchOutput => {\n      try {\n        metricsService.recordM2MWebhookDeliveryOutcome({\n          scope: input.scope.type,\n          outcome: output.outcome,\n        });\n      } catch (error) {\n        logger.warn('Failed to record M2M webhook delivery outcome metric', {\n          deliveryLogId: input.deliveryLogId,\n          scopeType: input.scope.type,\n          scopeId: input.scope.id,\n          outcome: output.outcome,\n          ...projectCaughtErrorLogFields(error),\n        });\n      }\n      return output;\n    };\n\n    // ── Load the row (ground truth) ────────────────────────────\n    const row = await repo.read(input.scope, executionContext, input.deliveryLogId);\n    if (!row) {\n      // Possible if the row was purged between enqueue and worker\n      // execution (admin `PURGE_OLD`). Quiet skip — there is nothing\n      // to deliver and no caller to surface the absence to.\n      logger.warn('Webhook delivery row not found; skipping', {\n        deliveryLogId: input.deliveryLogId,\n        scopeType: input.scope.type,\n        scopeId: input.scope.id,\n      });\n      return recordAndReturn({\n        deliveryLogId: input.deliveryLogId,\n        outcome: 'skipped_missing_row',\n        attemptCount: 0,\n        durationMs: Date.now() - startedAt,\n      });\n    }\n\n    const nextAttemptCount = (row.attemptCount ?? 0) + 1;\n\n    // ── Lease the row (atomic CAS) ─────────────────────────────\n    // `markInFlight` is a compare-and-swap on `status: PENDING`. If\n    // another worker already leased the row (cron retry sweep + queue\n    // redelivery race), the CAS returns false and we exit cleanly —\n    // double-POSTs and double-counted attempts would corrupt the\n    // retry budget and the consumer's idempotency guarantees.\n    const leased = await repo.markInFlight(\n      input.scope,\n      executionContext,\n      input.deliveryLogId,\n      nextAttemptCount,\n    );\n    if (!leased) {\n      logger.warn('Webhook delivery row already leased by another worker; skipping', {\n        deliveryLogId: input.deliveryLogId,\n        scopeType: input.scope.type,\n        scopeId: input.scope.id,\n        endpointId: row.endpointId,\n        httpUrl: row.httpUrl,\n        signatureJti: row.signatureJti,\n        currentStatus: row.status,\n      });\n      return recordAndReturn({\n        deliveryLogId: input.deliveryLogId,\n        outcome: 'skipped_already_leased',\n        attemptCount: row.attemptCount ?? 0,\n        durationMs: Date.now() - startedAt,\n      });\n    }\n\n    // ── Build the JWT signature (D5: claims-JWT) ───────────────\n    // The body itself is NOT in the JWT — only its sha256 hash. This\n    // keeps the header small (some HTTP intermediaries cap header\n    // size) and lets consumers verify integrity independently of the\n    // raw body bytes (which they can re-hash).\n    const claims = {\n      // `jti` is the consumer-facing dedup key. It is stable across\n      // every retry of THIS delivery row (same value re-signed each\n      // attempt) and unique across rows. Consumers MUST dedup on\n      // `jti` — the rest of the token (`iat`, `exp`, signature) is\n      // refreshed per attempt and so cannot serve as a replay marker.\n      // See `m2m-webhook-dispatcher.backend.service.ts` (`signatureJti`\n      // creation site) for the full consumer-contract JSDoc.\n      jti: row.signatureJti,\n      bodyHash: row.payloadHash,\n      bodyHashAlg: M2M_WEBHOOK_BODY_HASH_ALGORITHM,\n      eventChannel: row.channel,\n      resourceIdentifier: row.resourceIdentifier,\n      operationIdentifier: row.operationIdentifier,\n      // `iss`, `iat`, `exp`, `aud`, `kid` defaults come from\n      // `JwtPrivateKeySignOptions[APPLICATION_WEBHOOK]`. We don't\n      // override them here — the consumer-facing contract is the\n      // signing options table, not this call site.\n    };\n\n    let signature: string;\n    try {\n      signature = await jwtService.sign(claims, JwtPrivateKeys.APPLICATION_WEBHOOK);\n    } catch (error) {\n      // Signing failure is a configuration problem (missing key) —\n      // re-trying won't help until the operator fixes secrets, so we\n      // mark the row as terminally failed and let admin RETRY pick it\n      // up after the fix.\n      const reason = describeCaughtError(error);\n      logger.error('Failed to sign webhook payload — marking delivery FAILED', {\n        deliveryLogId: input.deliveryLogId,\n        scopeType: input.scope.type,\n        scopeId: input.scope.id,\n        endpointId: row.endpointId,\n        httpUrl: row.httpUrl,\n        signatureJti: row.signatureJti,\n        attempt: nextAttemptCount,\n        error,\n      });\n      await repo.markFinallyFailed(input.scope, executionContext, input.deliveryLogId, {\n        failureReason: `JWT signing failed: ${reason}`,\n      });\n      return recordAndReturn({\n        deliveryLogId: input.deliveryLogId,\n        outcome: 'failed_terminal',\n        attemptCount: nextAttemptCount,\n        durationMs: Date.now() - startedAt,\n      });\n    }\n\n    // ── POST the body ──────────────────────────────────────────\n    // Shared with the `webhookConfig.testEndpoint` probe (see\n    // `../m2m-webhook-signed-request.backend.utils`). The admin-facing\n    // connectivity test must exercise THIS transport, not a parallel one,\n    // or a green test would prove nothing about real deliveries.\n    const bodyBytes =\n      typeof row.payload === 'string' ? row.payload : JSON.stringify(row.payload);\n    const { responseStatus, responseBodyTruncated, networkError } = await sendSignedWebhookRequest({\n      url: row.httpUrl,\n      body: bodyBytes,\n      signature,\n    });\n\n    // Job-level duration: spans the row re-read and lease as well as the POST,\n    // so it stays the batch's own measurement rather than the transport's.\n    const durationMs = Date.now() - startedAt;\n\n    // ── Classify + persist transition ──────────────────────────\n    if (responseStatus !== undefined) {\n      const verdict = classifyResponseStatus(responseStatus);\n\n      if (verdict === 'delivered') {\n        await repo.markDelivered(input.scope, executionContext, input.deliveryLogId, {\n          responseStatus,\n          responseBodyTruncated,\n        });\n        logDebug('Webhook delivered', {\n          deliveryLogId: input.deliveryLogId,\n          scopeType: input.scope.type,\n          scopeId: input.scope.id,\n          endpointId: row.endpointId,\n          httpUrl: row.httpUrl,\n          signatureJti: row.signatureJti,\n          httpStatus: responseStatus,\n          durationMs,\n          attempt: nextAttemptCount,\n        });\n        return recordAndReturn({\n          deliveryLogId: input.deliveryLogId,\n          outcome: 'delivered',\n          attemptCount: nextAttemptCount,\n          responseStatus,\n          durationMs,\n        });\n      }\n\n      if (verdict === 'fatal') {\n        await repo.markFinallyFailed(input.scope, executionContext, input.deliveryLogId, {\n          responseStatus,\n          responseBodyTruncated,\n          failureReason: `non-retryable HTTP status ${responseStatus}`,\n        });\n        logger.warn('Webhook delivery failed (non-retryable)', {\n          deliveryLogId: input.deliveryLogId,\n          scopeType: input.scope.type,\n          scopeId: input.scope.id,\n          endpointId: row.endpointId,\n          httpUrl: row.httpUrl,\n          signatureJti: row.signatureJti,\n          httpStatus: responseStatus,\n          durationMs,\n          attempt: nextAttemptCount,\n        });\n        return recordAndReturn({\n          deliveryLogId: input.deliveryLogId,\n          outcome: 'failed_terminal',\n          attemptCount: nextAttemptCount,\n          responseStatus,\n          durationMs,\n        });\n      }\n\n      // verdict === 'retry' — fall through to the retry branch below.\n    }\n\n    // Retryable failure (5xx, 408, 429, network/timeout). Decide\n    // between scheduling another attempt and giving up.\n    const failureReason =\n      networkError ?? `retryable HTTP status ${responseStatus ?? 'unknown'}`;\n\n    if (nextAttemptCount >= MAX_ATTEMPTS) {\n      await repo.markFinallyFailed(input.scope, executionContext, input.deliveryLogId, {\n        responseStatus,\n        responseBodyTruncated,\n        failureReason: `${failureReason} (retry cap ${MAX_ATTEMPTS} reached)`,\n      });\n      logger.warn('Webhook delivery failed (retry cap reached)', {\n        deliveryLogId: input.deliveryLogId,\n        scopeType: input.scope.type,\n        scopeId: input.scope.id,\n        endpointId: row.endpointId,\n        httpUrl: row.httpUrl,\n        signatureJti: row.signatureJti,\n        httpStatus: responseStatus,\n        durationMs,\n        attempt: nextAttemptCount,\n        failureReason,\n      });\n      return recordAndReturn({\n        deliveryLogId: input.deliveryLogId,\n        outcome: 'failed_terminal',\n        attemptCount: nextAttemptCount,\n        responseStatus,\n        durationMs,\n      });\n    }\n\n    const nextAttemptAt = computeNextAttemptAt(nextAttemptCount);\n    await repo.markFailedAttempt(input.scope, executionContext, input.deliveryLogId, {\n      responseStatus,\n      responseBodyTruncated,\n      failureReason,\n      nextAttemptAt,\n    });\n    logDebug('Webhook delivery retry scheduled', {\n      deliveryLogId: input.deliveryLogId,\n      scopeType: input.scope.type,\n      scopeId: input.scope.id,\n      endpointId: row.endpointId,\n      httpUrl: row.httpUrl,\n      signatureJti: row.signatureJti,\n      httpStatus: responseStatus,\n      durationMs,\n      attempt: nextAttemptCount,\n      nextAttemptAt: nextAttemptAt.toISOString(),\n      failureReason,\n    });\n    return recordAndReturn({\n      deliveryLogId: input.deliveryLogId,\n      outcome: 'retry_scheduled',\n      attemptCount: nextAttemptCount,\n      responseStatus,\n      durationMs,\n    });\n  },\n});\n\n// Batch reference identifier lives in the declarative manifest registry\n// (`engine-custom-batch-manifests`); import `M2M_WEBHOOK_DELIVERY_BATCH_REF`\n// from there to keep a single source of truth across runtime wiring,\n// queue dispatch, and specification cross-validation.\n"]}
+{"version":3,"file":"m2m-webhook-delivery.batch.backend.service.js","sourceRoot":"","sources":["../../../../../../../src/notifications/webhooks/outbound/batches/m2m-webhook-delivery.batch.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,aAAa,EACb,6BAA6B,EAC7B,8BAA8B,EAC9B,mCAAmC,GACpC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,iCAAiC,GAElC,MAAM,4FAA4F,CAAC;AACpG,OAAO,EAAE,0CAA0C,EAAE,MAAM,gFAAgF,CAAC;AAC5I,OAAO,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAChJ,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAEpF,OAAO,EAAE,cAAc,EAAE,MAAM,wEAAwE,CAAC;AAGxG,OAAO,EACL,YAAY,EACZ,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,+BAA+B,EAAE,wBAAwB,EAAE,MAAM,6CAA6C,CAAC;AAExH,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E;;;;;GAKG;AACH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,kCAAkC,GAAG,IAAI,GAAG,EAAU,CAAC;AAE7D,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC;QAC3B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KACtB,CAAC;IACF,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACjC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB;;;;OAIG;IACH,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC;QACd,WAAW;QACX,iBAAiB;QACjB,iBAAiB;QACjB,qBAAqB;QACrB,wBAAwB;KACzB,CAAC;IACF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC5C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC3C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CAC3C,CAAC,CAAC;AAIH,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E,MAAM,CAAC,MAAM,8BAA8B,GAGvC,iCAAiC,CAAC;IACpC,KAAK,EAAE,kCAAkC;IACzC,MAAM,EAAE,mCAAmC;IAC3C,oBAAoB,EAAE;QACpB,iEAAiE;QACjE,wEAAwE;QACxE,qEAAqE;QACrE,iEAAiE;QACjE,6CAA6C;QAC7C,6CAA6C;QAC7C,sCAAsC;QACtC,6CAA6C;QAC7C,EAAE;QACF,4BAA4B;QAC5B,uEAAuE;QACvE,sEAAsE;QACtE,6DAA6D;QAC7D,oEAAoE;QACpE,uEAAuE;QACvE,sEAAsE;QACtE,mEAAmE;QACnE,8DAA8D;QAC9D,oEAAoE;QACpE,sEAAsE;QACtE,IAAI,EAAE,0CAA0C,CAAC,IAAI;QACrD,mBAAmB,EAAE,0CAA0C,CAAC,mBAAmB;QACnF,YAAY,EAAE,0CAA0C,CAAC,YAAY;KACtE;IACD,mBAAmB,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;QACjC,UAAU,EAAE,GAAG,CACb,kBAAkB,CAAC,+BAA+B,CACnD;QACD,UAAU,EAAE,GAAG,CAAoB,kBAAkB,CAAC,iBAAiB,CAAC;QACxE,cAAc,EAAE,GAAG,CAAiB,kBAAkB,CAAC,cAAc,CAAC;KACvE,CAAC;IACF,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,YAAY,EAAE,EAAE,EAAE;QACpE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,yBAAyB,CAAC,CAAC;QAC/D,MAAM,EACJ,UAAU,EAAE,IAAI,EAChB,UAAU,EACV,cAAc,GACf,GAAG,YAAY,CAAC;QAEjB;;;;;;;;;;;;;;;;;;;WAmBG;QACH,MAAM,eAAe,GAAG,CACtB,MAAqC,EACN,EAAE;YACjC,IAAI,CAAC;gBACH,cAAc,CAAC,+BAA+B,CAAC;oBAC7C,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;oBACvB,OAAO,EAAE,MAAM,CAAC,OAAO;iBACxB,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CAAC,sDAAsD,EAAE;oBAClE,aAAa,EAAE,KAAK,CAAC,aAAa;oBAClC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;oBAC3B,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE;oBACvB,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,GAAG,2BAA2B,CAAC,KAAK,CAAC;iBACtC,CAAC,CAAC;YACL,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC;QAEF,8DAA8D;QAC9D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,gBAAgB,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;QAChF,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,4DAA4D;YAC5D,+DAA+D;YAC/D,sDAAsD;YACtD,MAAM,CAAC,IAAI,CAAC,0CAA0C,EAAE;gBACtD,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;gBAC3B,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE;aACxB,CAAC,CAAC;YACH,OAAO,eAAe,CAAC;gBACrB,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,OAAO,EAAE,qBAAqB;gBAC9B,YAAY,EAAE,CAAC;gBACf,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,gBAAgB,GAAG,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAErD,8DAA8D;QAC9D,gEAAgE;QAChE,kEAAkE;QAClE,gEAAgE;QAChE,6DAA6D;QAC7D,0DAA0D;QAC1D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CACpC,KAAK,CAAC,KAAK,EACX,gBAAgB,EAChB,KAAK,CAAC,aAAa,EACnB,gBAAgB,CACjB,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,CAAC,IAAI,CAAC,iEAAiE,EAAE;gBAC7E,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;gBAC3B,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE;gBACvB,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,YAAY,EAAE,GAAG,CAAC,YAAY;gBAC9B,aAAa,EAAE,GAAG,CAAC,MAAM;aAC1B,CAAC,CAAC;YACH,OAAO,eAAe,CAAC;gBACrB,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,OAAO,EAAE,wBAAwB;gBACjC,YAAY,EAAE,GAAG,CAAC,YAAY,IAAI,CAAC;gBACnC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC,CAAC;QACL,CAAC;QAED,8DAA8D;QAC9D,iEAAiE;QACjE,8DAA8D;QAC9D,iEAAiE;QACjE,2CAA2C;QAC3C,MAAM,MAAM,GAAG;YACb,8DAA8D;YAC9D,8DAA8D;YAC9D,2DAA2D;YAC3D,6DAA6D;YAC7D,gEAAgE;YAChE,kEAAkE;YAClE,uDAAuD;YACvD,wEAAwE;YACxE,0DAA0D;YAC1D,CAAC,6BAA6B,CAAC,eAAe,CAAC,UAAU,CAAC,EAAE,GAAG,CAAC,YAAY;YAC5E,CAAC,6BAA6B,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,WAAW;YACzE,CAAC,6BAA6B,CAAC,eAAe,CAAC,iBAAiB,CAAC,EAAE,+BAA+B;YAClG,CAAC,6BAA6B,CAAC,eAAe,CAAC,YAAY,CAAC,EAAE,GAAG,CAAC,OAAO;YACzE,CAAC,6BAA6B,CAAC,eAAe,CAAC,kBAAkB,CAAC,EAAE,GAAG,CAAC,kBAAkB;YAC1F,CAAC,6BAA6B,CAAC,eAAe,CAAC,mBAAmB,CAAC,EAAE,GAAG,CAAC,mBAAmB;YAC5F,uDAAuD;YACvD,4DAA4D;YAC5D,2DAA2D;YAC3D,6CAA6C;SAC9C,CAAC;QAEF,IAAI,SAAiB,CAAC;QACtB,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,mBAAmB,CAAC,CAAC;QAChF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,6DAA6D;YAC7D,+DAA+D;YAC/D,gEAAgE;YAChE,oBAAoB;YACpB,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;YAC1C,MAAM,CAAC,KAAK,CAAC,0DAA0D,EAAE;gBACvE,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;gBAC3B,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE;gBACvB,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,YAAY,EAAE,GAAG,CAAC,YAAY;gBAC9B,OAAO,EAAE,gBAAgB;gBACzB,KAAK;aACN,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,EAAE,gBAAgB,EAAE,KAAK,CAAC,aAAa,EAAE;gBAC/E,aAAa,EAAE,uBAAuB,MAAM,EAAE;aAC/C,CAAC,CAAC;YACH,OAAO,eAAe,CAAC;gBACrB,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,OAAO,EAAE,iBAAiB;gBAC1B,YAAY,EAAE,gBAAgB;gBAC9B,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC,CAAC;QACL,CAAC;QAED,8DAA8D;QAC9D,0DAA0D;QAC1D,mEAAmE;QACnE,sEAAsE;QACtE,6DAA6D;QAC7D,MAAM,SAAS,GACb,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAE9E,IAAI,mCAAmC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACrD,MAAM,SAAS,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,EAAE,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;YAC5E,IAAI,CAAC,kCAAkC,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBACvD,kCAAkC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBAClD,uFAAuF;gBACvF,4FAA4F;gBAC5F,2CAA2C;gBAC3C,MAAM,CAAC,IAAI,CAAC,4EAA4E,EAAE;oBACxF,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;oBAC3B,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE;oBACvB,UAAU,EAAE,GAAG,CAAC,UAAU;oBAC1B,uFAAuF;oBACvF,wDAAwD;oBACxD,eAAe,EAAE,8BAA8B,CAAC,GAAG,CAAC,OAAO,CAAC;oBAC5D,QAAQ,EAAE,gFAAgF;0BACtF,+EAA+E;oBACnF,MAAM,EAAE,iDAAiD;iBAC1D,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,MAAM,EAAE,cAAc,EAAE,qBAAqB,EAAE,YAAY,EAAE,GAAG,MAAM,wBAAwB,CAAC;YAC7F,GAAG,EAAE,GAAG,CAAC,OAAO;YAChB,IAAI,EAAE,SAAS;YACf,SAAS;SACV,CAAC,CAAC;QAEH,2EAA2E;QAC3E,uEAAuE;QACvE,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAE1C,8DAA8D;QAC9D,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACjC,MAAM,OAAO,GAAG,sBAAsB,CAAC,cAAc,CAAC,CAAC;YAEvD,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;gBAC5B,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,EAAE,gBAAgB,EAAE,KAAK,CAAC,aAAa,EAAE;oBAC3E,cAAc;oBACd,qBAAqB;iBACtB,CAAC,CAAC;gBACH,QAAQ,CAAC,mBAAmB,EAAE;oBAC5B,aAAa,EAAE,KAAK,CAAC,aAAa;oBAClC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;oBAC3B,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE;oBACvB,UAAU,EAAE,GAAG,CAAC,UAAU;oBAC1B,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,YAAY,EAAE,GAAG,CAAC,YAAY;oBAC9B,UAAU,EAAE,cAAc;oBAC1B,UAAU;oBACV,OAAO,EAAE,gBAAgB;iBAC1B,CAAC,CAAC;gBACH,OAAO,eAAe,CAAC;oBACrB,aAAa,EAAE,KAAK,CAAC,aAAa;oBAClC,OAAO,EAAE,WAAW;oBACpB,YAAY,EAAE,gBAAgB;oBAC9B,cAAc;oBACd,UAAU;iBACX,CAAC,CAAC;YACL,CAAC;YAED,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;gBACxB,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,EAAE,gBAAgB,EAAE,KAAK,CAAC,aAAa,EAAE;oBAC/E,cAAc;oBACd,qBAAqB;oBACrB,aAAa,EAAE,6BAA6B,cAAc,EAAE;iBAC7D,CAAC,CAAC;gBACH,MAAM,CAAC,IAAI,CAAC,yCAAyC,EAAE;oBACrD,aAAa,EAAE,KAAK,CAAC,aAAa;oBAClC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;oBAC3B,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE;oBACvB,UAAU,EAAE,GAAG,CAAC,UAAU;oBAC1B,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,YAAY,EAAE,GAAG,CAAC,YAAY;oBAC9B,UAAU,EAAE,cAAc;oBAC1B,UAAU;oBACV,OAAO,EAAE,gBAAgB;iBAC1B,CAAC,CAAC;gBACH,OAAO,eAAe,CAAC;oBACrB,aAAa,EAAE,KAAK,CAAC,aAAa;oBAClC,OAAO,EAAE,iBAAiB;oBAC1B,YAAY,EAAE,gBAAgB;oBAC9B,cAAc;oBACd,UAAU;iBACX,CAAC,CAAC;YACL,CAAC;YAED,gEAAgE;QAClE,CAAC;QAED,6DAA6D;QAC7D,oDAAoD;QACpD,MAAM,aAAa,GACjB,YAAY,IAAI,yBAAyB,cAAc,IAAI,SAAS,EAAE,CAAC;QAEzE,IAAI,gBAAgB,IAAI,YAAY,EAAE,CAAC;YACrC,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,EAAE,gBAAgB,EAAE,KAAK,CAAC,aAAa,EAAE;gBAC/E,cAAc;gBACd,qBAAqB;gBACrB,aAAa,EAAE,GAAG,aAAa,eAAe,YAAY,WAAW;aACtE,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,6CAA6C,EAAE;gBACzD,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;gBAC3B,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE;gBACvB,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,YAAY,EAAE,GAAG,CAAC,YAAY;gBAC9B,UAAU,EAAE,cAAc;gBAC1B,UAAU;gBACV,OAAO,EAAE,gBAAgB;gBACzB,aAAa;aACd,CAAC,CAAC;YACH,OAAO,eAAe,CAAC;gBACrB,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,OAAO,EAAE,iBAAiB;gBAC1B,YAAY,EAAE,gBAAgB;gBAC9B,cAAc;gBACd,UAAU;aACX,CAAC,CAAC;QACL,CAAC;QAED,MAAM,aAAa,GAAG,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;QAC7D,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,EAAE,gBAAgB,EAAE,KAAK,CAAC,aAAa,EAAE;YAC/E,cAAc;YACd,qBAAqB;YACrB,aAAa;YACb,aAAa;SACd,CAAC,CAAC;QACH,QAAQ,CAAC,kCAAkC,EAAE;YAC3C,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;YAC3B,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE;YACvB,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,YAAY,EAAE,GAAG,CAAC,YAAY;YAC9B,UAAU,EAAE,cAAc;YAC1B,UAAU;YACV,OAAO,EAAE,gBAAgB;YACzB,aAAa,EAAE,aAAa,CAAC,WAAW,EAAE;YAC1C,aAAa;SACd,CAAC,CAAC;QACH,OAAO,eAAe,CAAC;YACrB,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,OAAO,EAAE,iBAAiB;YAC1B,YAAY,EAAE,gBAAgB;YAC9B,cAAc;YACd,UAAU;SACX,CAAC,CAAC;IACL,CAAC;CACF,CAAC,CAAC;AAEH,wEAAwE;AACxE,6EAA6E;AAC7E,qEAAqE;AACrE,sDAAsD","sourcesContent":["/**\n * M2M Webhook Delivery Batch Worker\n *\n * Event-triggered custom batch — one job per delivery row enqueued by\n * `M2MWebhookDispatcherBackendService.enqueueDelivery`. The worker:\n *   1. Re-reads the row from `M2MWebhookDeliveryLog` (ground truth —\n *      we never trust in-flight queue state for the body or signature).\n *   2. Marks it `IN_FLIGHT` (incrementing `attemptCount`).\n *   3. Builds the JWT signature with `JwtPrivateKeys.APPLICATION_WEBHOOK`.\n *   4. POSTs the body with a 30s `AbortController` timeout.\n *   5. Classifies the response and records the terminal/intermediate\n *      transition on the row.\n *\n * Status classification (D6):\n *   - 2xx                            → DELIVERED (terminal success).\n *   - 4xx, excluding 408 / 429       → FAILED (terminal — non-retryable).\n *   - 408 / 429 / 5xx / network      → mark failed attempt; if\n *                                       `attemptCount >= MAX_ATTEMPTS`,\n *                                       transition to FAILED.\n *\n * Custom batches are factory-created rather than constructor-injected. This\n * batch therefore declares its exact services through `resolveDependencies`;\n * the executor resolves them lazily for each invocation and `doHandle`\n * receives only the typed named result.\n *\n * @see m2m-webhook-organization-delivery.md — Phase 3 / Step 10\n * @see notifications/email/services/email-batch-send.batch.backend.service.ts\n *   (precedent: same pattern for an event-triggered custom batch).\n */\n\nimport { z } from 'zod';\nimport {\n  AuthScopeType,\n  M2M_WEBHOOK_DELIVERY_CONTRACT,\n  webhookEndpointDestinationHost,\n  webhookEndpointTransportIsPlaintext,\n} from '@wildo-ai/saas-models';\nimport {\n  createCustomBatchExecutionService,\n  type BatchesCronjobsCustomExecution_Service,\n} from '~wildo-backend-lib/base-classes/services/batches/batches-cronjobs-custom-execution.service';\nimport { ENGINE_M2M_WEBHOOK_DELIVERY_BATCH_MANIFEST } from '~wildo-backend-lib/base-classes/services/batches/engine-custom-batch-manifests';\nimport { describeCaughtError, projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { JwtBackendService } from '~wildo-backend-lib/security/jwt/services/jwt.backend.service';\nimport { JwtPrivateKeys } from '~wildo-backend-lib/security/authentications/models/jwt.backend.schemas';\nimport type { MetricsService } from '~wildo-backend-lib/monitoring/observability/services/metrics.service';\nimport type { M2MWebhookDeliveryLogRepository } from '~wildo-backend-lib/notifications/webhooks/outbound/services/m2m-webhook-delivery-log.repository';\nimport {\n  MAX_ATTEMPTS,\n  classifyResponseStatus,\n  computeNextAttemptAt,\n} from './m2m-webhook-delivery.batch.utils';\nimport { M2M_WEBHOOK_BODY_HASH_ALGORITHM, sendSignedWebhookRequest } from '../m2m-webhook-signed-request.backend.utils';\n\n// ═══════════════════════════════════════════════════════════════════════════\n// Input / Output schemas\n// ═══════════════════════════════════════════════════════════════════════════\n\n/**\n * The dispatcher writes the row first, then enqueues this lightweight\n * payload. Keeping the payload minimal (id + scope) makes the worker\n * resilient to queue / DB race conditions: re-reading the row is the\n * source of truth.\n */\n/**\n * Endpoints already warned about in this process, so a permanently-plaintext destination costs one\n * line rather than one per delivery (#492).\n *\n * ## Why the warning is HERE, and why it is once\n *\n * Plaintext endpoints are ADMITTED — a commercial accommodation recorded on\n * `WebhookEndpointSchema.url` — and the cost of admitting them is that the decision becomes\n * invisible. The obvious place to say so is the moment an endpoint is SAVED, and that place does\n * not exist: `webhookConfig` declares CREATE and UPDATE `REPOSITORY_ONLY` with no admin route, and\n * the only writer that exists (data seeding) reaches the row through `upsertByBusinessKey`, a raw\n * repository call that no operation-pipeline hook observes. A postfix handler there would have been\n * a mechanism nothing runs — the shape this whole review exists to remove.\n *\n * The delivery IS the exposure, so this is where it can be stated truthfully: every POST over\n * `http://` puts the signature JWT on the wire in the clear, readable and replayable by anyone on\n * the path until it expires.\n *\n * Once per endpoint per process, because a webhook configuration is stable: a WARN on every\n * delivery would be a line an operator learns to filter, and a filtered warning is the same as no\n * warning. The set is bounded by the endpoint population and is deliberately NOT time-based — the\n * fact does not become news again after an hour, it becomes news again when the process restarts\n * and re-reads a configuration somebody may have changed.\n */\nconst PLAINTEXT_ENDPOINTS_ALREADY_WARNED = new Set<string>();\n\nexport const M2MWebhookDeliveryBatchInputSchema = z.object({\n  scope: z.object({\n    type: z.enum(AuthScopeType),\n    id: z.string().min(1),\n  }),\n  deliveryLogId: z.string().min(1),\n});\n\nexport type M2MWebhookDeliveryBatchInput = z.infer<typeof M2MWebhookDeliveryBatchInputSchema>;\n\nexport const M2MWebhookDeliveryBatchOutputSchema = z.object({\n  deliveryLogId: z.string(),\n  /**\n   * High-level outcome string. Stored only in the worker output for\n   * cron / log inspection; the persisted truth lives on the row's\n   * `status` field.\n   */\n  outcome: z.enum([\n    'delivered',\n    'retry_scheduled',\n    'failed_terminal',\n    'skipped_missing_row',\n    'skipped_already_leased',\n  ]),\n  attemptCount: z.number().int().nonnegative(),\n  responseStatus: z.number().int().optional(),\n  durationMs: z.number().int().nonnegative(),\n});\n\nexport type M2MWebhookDeliveryBatchOutput = z.infer<typeof M2MWebhookDeliveryBatchOutputSchema>;\n\n// ═══════════════════════════════════════════════════════════════════════════\n// Batch Service\n// ═══════════════════════════════════════════════════════════════════════════\n\nexport const m2mWebhookDeliveryBatchService: BatchesCronjobsCustomExecution_Service<\n  typeof M2MWebhookDeliveryBatchInputSchema,\n  typeof M2MWebhookDeliveryBatchOutputSchema\n> = createCustomBatchExecutionService({\n  input: M2MWebhookDeliveryBatchInputSchema,\n  output: M2MWebhookDeliveryBatchOutputSchema,\n  batchCronjob_Context: {\n    // Anchored on the `APPLICATION` primary scope rather than a fake\n    // `ORGANIZATION_M2M_WEBHOOK_DELIVERY_LOG` operation: an event-triggered\n    // polymorphic worker has no honest \"primary\" resource (each enqueued\n    // row carries its own `scope: { type, id }` and routes to either\n    // `ORGANIZATION_M2M_WEBHOOK_DELIVERY_LOG` or\n    // `APPLICATION_M2M_WEBHOOK_DELIVERY_LOG` via\n    // `resolveDeliveryLogResourceType` in\n    // `m2m-webhook-delivery-log.repository.ts`).\n    //\n    // The bootstrap path inside\n    // `ExecutionContextCreatorBackendService.createForInternalCustomBatch`\n    // resolves an `APPLICATION.READ` operation, populates the application\n    // id, then swaps in `notifications:m2m-webhook-delivery` via\n    // `withOperation()`. Audit trails surface the honest batch identity\n    // and authorization runs against `APP_ADMIN_SUPER_ADMIN @ APPLICATION`\n    // (see `createInternalSystemRoles()`), exactly as before, but without\n    // pretending the worker mutates the org-variant log on every job —\n    // including for app-scoped deliveries where that anchor was a\n    // flat-out lie. Per-row resource-type resolution (org vs app) stays\n    // inside the worker and is driven off the per-row `input.scope.type`.\n    kind: ENGINE_M2M_WEBHOOK_DELIVERY_BATCH_MANIFEST.kind,\n    operationIdentifier: ENGINE_M2M_WEBHOOK_DELIVERY_BATCH_MANIFEST.operationIdentifier,\n    primaryScope: ENGINE_M2M_WEBHOOK_DELIVERY_BATCH_MANIFEST.primaryScope,\n  },\n  resolveDependencies: ({ get }) => ({\n    repository: get<M2MWebhookDeliveryLogRepository>(\n      SAAS_SERVICE_TYPES.M2MWebhookDeliveryLogRepository,\n    ),\n    jwtService: get<JwtBackendService>(SAAS_SERVICE_TYPES.JwtBackendService),\n    metricsService: get<MetricsService>(SAAS_SERVICE_TYPES.MetricsService),\n  }),\n  doHandle: async (input, { logger, executionContext, dependencies }) => {\n    const startedAt = Date.now();\n    const logDebug = logger.debugByType('M2MWebhookDeliveryBatch');\n    const {\n      repository: repo,\n      jwtService,\n      metricsService,\n    } = dependencies;\n\n    /**\n     * Single funnel for every `doHandle` return-point. Mirrors the\n     * batch output back to the caller while firing the Phase 5 /\n     * Step 17 outcome counter exactly once per worker invocation.\n     *\n     * Kept inline (not extracted to a module-level helper) because it\n     * closes over `metricsService` and `input.scope.type` — lifting it\n     * would need re-threading both via parameters on every call site\n     * and would dilute the fire-exactly-once contract this funnel\n     * enforces.\n     *\n     * Metric emission is error-isolated for the same reason the audit\n     * helper swallows its failures: observability MUST NEVER fail the\n     * main flow. By the time `recordAndReturn` runs, the row has\n     * already been persisted with the correct terminal/intermediate\n     * status — letting an OpenTelemetry exporter glitch abort the\n     * batch invocation here would leave the custom-batch runner\n     * reporting the run as failed even though the real delivery\n     * completed and the truth-source row reflects success.\n     */\n    const recordAndReturn = (\n      output: M2MWebhookDeliveryBatchOutput,\n    ): M2MWebhookDeliveryBatchOutput => {\n      try {\n        metricsService.recordM2MWebhookDeliveryOutcome({\n          scope: input.scope.type,\n          outcome: output.outcome,\n        });\n      } catch (error) {\n        logger.warn('Failed to record M2M webhook delivery outcome metric', {\n          deliveryLogId: input.deliveryLogId,\n          scopeType: input.scope.type,\n          scopeId: input.scope.id,\n          outcome: output.outcome,\n          ...projectCaughtErrorLogFields(error),\n        });\n      }\n      return output;\n    };\n\n    // ── Load the row (ground truth) ────────────────────────────\n    const row = await repo.read(input.scope, executionContext, input.deliveryLogId);\n    if (!row) {\n      // Possible if the row was purged between enqueue and worker\n      // execution (admin `PURGE_OLD`). Quiet skip — there is nothing\n      // to deliver and no caller to surface the absence to.\n      logger.warn('Webhook delivery row not found; skipping', {\n        deliveryLogId: input.deliveryLogId,\n        scopeType: input.scope.type,\n        scopeId: input.scope.id,\n      });\n      return recordAndReturn({\n        deliveryLogId: input.deliveryLogId,\n        outcome: 'skipped_missing_row',\n        attemptCount: 0,\n        durationMs: Date.now() - startedAt,\n      });\n    }\n\n    const nextAttemptCount = (row.attemptCount ?? 0) + 1;\n\n    // ── Lease the row (atomic CAS) ─────────────────────────────\n    // `markInFlight` is a compare-and-swap on `status: PENDING`. If\n    // another worker already leased the row (cron retry sweep + queue\n    // redelivery race), the CAS returns false and we exit cleanly —\n    // double-POSTs and double-counted attempts would corrupt the\n    // retry budget and the consumer's idempotency guarantees.\n    const leased = await repo.markInFlight(\n      input.scope,\n      executionContext,\n      input.deliveryLogId,\n      nextAttemptCount,\n    );\n    if (!leased) {\n      logger.warn('Webhook delivery row already leased by another worker; skipping', {\n        deliveryLogId: input.deliveryLogId,\n        scopeType: input.scope.type,\n        scopeId: input.scope.id,\n        endpointId: row.endpointId,\n        httpUrl: row.httpUrl,\n        signatureJti: row.signatureJti,\n        currentStatus: row.status,\n      });\n      return recordAndReturn({\n        deliveryLogId: input.deliveryLogId,\n        outcome: 'skipped_already_leased',\n        attemptCount: row.attemptCount ?? 0,\n        durationMs: Date.now() - startedAt,\n      });\n    }\n\n    // ── Build the JWT signature (D5: claims-JWT) ───────────────\n    // The body itself is NOT in the JWT — only its sha256 hash. This\n    // keeps the header small (some HTTP intermediaries cap header\n    // size) and lets consumers verify integrity independently of the\n    // raw body bytes (which they can re-hash).\n    const claims = {\n      // `jti` is the consumer-facing dedup key. It is stable across\n      // every retry of THIS delivery row (same value re-signed each\n      // attempt) and unique across rows. Consumers MUST dedup on\n      // `jti` — the rest of the token (`iat`, `exp`, signature) is\n      // refreshed per attempt and so cannot serve as a replay marker.\n      // See `m2m-webhook-dispatcher.backend.service.ts` (`signatureJti`\n      // creation site) for the full consumer-contract JSDoc.\n      // Claim NAMES come from the published receiver contract so the customer\n      // documentation and this signing site cannot drift apart.\n      [M2M_WEBHOOK_DELIVERY_CONTRACT.signatureClaims.deliveryId]: row.signatureJti,\n      [M2M_WEBHOOK_DELIVERY_CONTRACT.signatureClaims.bodyHash]: row.payloadHash,\n      [M2M_WEBHOOK_DELIVERY_CONTRACT.signatureClaims.bodyHashAlgorithm]: M2M_WEBHOOK_BODY_HASH_ALGORITHM,\n      [M2M_WEBHOOK_DELIVERY_CONTRACT.signatureClaims.eventChannel]: row.channel,\n      [M2M_WEBHOOK_DELIVERY_CONTRACT.signatureClaims.resourceIdentifier]: row.resourceIdentifier,\n      [M2M_WEBHOOK_DELIVERY_CONTRACT.signatureClaims.operationIdentifier]: row.operationIdentifier,\n      // `iss`, `iat`, `exp`, `aud`, `kid` defaults come from\n      // `JwtPrivateKeySignOptions[APPLICATION_WEBHOOK]`. We don't\n      // override them here — the consumer-facing contract is the\n      // signing options table, not this call site.\n    };\n\n    let signature: string;\n    try {\n      signature = await jwtService.sign(claims, JwtPrivateKeys.APPLICATION_WEBHOOK);\n    } catch (error) {\n      // Signing failure is a configuration problem (missing key) —\n      // re-trying won't help until the operator fixes secrets, so we\n      // mark the row as terminally failed and let admin RETRY pick it\n      // up after the fix.\n      const reason = describeCaughtError(error);\n      logger.error('Failed to sign webhook payload — marking delivery FAILED', {\n        deliveryLogId: input.deliveryLogId,\n        scopeType: input.scope.type,\n        scopeId: input.scope.id,\n        endpointId: row.endpointId,\n        httpUrl: row.httpUrl,\n        signatureJti: row.signatureJti,\n        attempt: nextAttemptCount,\n        error,\n      });\n      await repo.markFinallyFailed(input.scope, executionContext, input.deliveryLogId, {\n        failureReason: `JWT signing failed: ${reason}`,\n      });\n      return recordAndReturn({\n        deliveryLogId: input.deliveryLogId,\n        outcome: 'failed_terminal',\n        attemptCount: nextAttemptCount,\n        durationMs: Date.now() - startedAt,\n      });\n    }\n\n    // ── POST the body ──────────────────────────────────────────\n    // Shared with the `webhookConfig.testEndpoint` probe (see\n    // `../m2m-webhook-signed-request.backend.utils`). The admin-facing\n    // connectivity test must exercise THIS transport, not a parallel one,\n    // or a green test would prove nothing about real deliveries.\n    const bodyBytes =\n      typeof row.payload === 'string' ? row.payload : JSON.stringify(row.payload);\n\n    if (webhookEndpointTransportIsPlaintext(row.httpUrl)) {\n      const warnedKey = `${input.scope.type}:${input.scope.id}:${row.endpointId}`;\n      if (!PLAINTEXT_ENDPOINTS_ALREADY_WARNED.has(warnedKey)) {\n        PLAINTEXT_ENDPOINTS_ALREADY_WARNED.add(warnedKey);\n        // NOT debug. The whole point is that an operator meets this without going looking, and\n        // `AbstractControllerBackendService` disables the debug channel — the same trap that made a\n        // readiness breakdown unreachable in #498.\n        logger.warn('Webhook endpoint is plaintext: the delivery signature is sent in the clear', {\n          scopeType: input.scope.type,\n          scopeId: input.scope.id,\n          endpointId: row.endpointId,\n          // Host only, never the URL — a customer endpoint's path routinely carries a per-tenant\n          // token, and this line reaches the ordinary log stream.\n          destinationHost: webhookEndpointDestinationHost(row.httpUrl),\n          exposure: 'The signature JWT is readable on the network path and replayable against this '\n            + 'endpoint until it expires, so an observer of one delivery can forge the next.',\n          remedy: 'Reconfigure this endpoint with an https:// URL.',\n        });\n      }\n    }\n\n    const { responseStatus, responseBodyTruncated, networkError } = await sendSignedWebhookRequest({\n      url: row.httpUrl,\n      body: bodyBytes,\n      signature,\n    });\n\n    // Job-level duration: spans the row re-read and lease as well as the POST,\n    // so it stays the batch's own measurement rather than the transport's.\n    const durationMs = Date.now() - startedAt;\n\n    // ── Classify + persist transition ──────────────────────────\n    if (responseStatus !== undefined) {\n      const verdict = classifyResponseStatus(responseStatus);\n\n      if (verdict === 'delivered') {\n        await repo.markDelivered(input.scope, executionContext, input.deliveryLogId, {\n          responseStatus,\n          responseBodyTruncated,\n        });\n        logDebug('Webhook delivered', {\n          deliveryLogId: input.deliveryLogId,\n          scopeType: input.scope.type,\n          scopeId: input.scope.id,\n          endpointId: row.endpointId,\n          httpUrl: row.httpUrl,\n          signatureJti: row.signatureJti,\n          httpStatus: responseStatus,\n          durationMs,\n          attempt: nextAttemptCount,\n        });\n        return recordAndReturn({\n          deliveryLogId: input.deliveryLogId,\n          outcome: 'delivered',\n          attemptCount: nextAttemptCount,\n          responseStatus,\n          durationMs,\n        });\n      }\n\n      if (verdict === 'fatal') {\n        await repo.markFinallyFailed(input.scope, executionContext, input.deliveryLogId, {\n          responseStatus,\n          responseBodyTruncated,\n          failureReason: `non-retryable HTTP status ${responseStatus}`,\n        });\n        logger.warn('Webhook delivery failed (non-retryable)', {\n          deliveryLogId: input.deliveryLogId,\n          scopeType: input.scope.type,\n          scopeId: input.scope.id,\n          endpointId: row.endpointId,\n          httpUrl: row.httpUrl,\n          signatureJti: row.signatureJti,\n          httpStatus: responseStatus,\n          durationMs,\n          attempt: nextAttemptCount,\n        });\n        return recordAndReturn({\n          deliveryLogId: input.deliveryLogId,\n          outcome: 'failed_terminal',\n          attemptCount: nextAttemptCount,\n          responseStatus,\n          durationMs,\n        });\n      }\n\n      // verdict === 'retry' — fall through to the retry branch below.\n    }\n\n    // Retryable failure (5xx, 408, 429, network/timeout). Decide\n    // between scheduling another attempt and giving up.\n    const failureReason =\n      networkError ?? `retryable HTTP status ${responseStatus ?? 'unknown'}`;\n\n    if (nextAttemptCount >= MAX_ATTEMPTS) {\n      await repo.markFinallyFailed(input.scope, executionContext, input.deliveryLogId, {\n        responseStatus,\n        responseBodyTruncated,\n        failureReason: `${failureReason} (retry cap ${MAX_ATTEMPTS} reached)`,\n      });\n      logger.warn('Webhook delivery failed (retry cap reached)', {\n        deliveryLogId: input.deliveryLogId,\n        scopeType: input.scope.type,\n        scopeId: input.scope.id,\n        endpointId: row.endpointId,\n        httpUrl: row.httpUrl,\n        signatureJti: row.signatureJti,\n        httpStatus: responseStatus,\n        durationMs,\n        attempt: nextAttemptCount,\n        failureReason,\n      });\n      return recordAndReturn({\n        deliveryLogId: input.deliveryLogId,\n        outcome: 'failed_terminal',\n        attemptCount: nextAttemptCount,\n        responseStatus,\n        durationMs,\n      });\n    }\n\n    const nextAttemptAt = computeNextAttemptAt(nextAttemptCount);\n    await repo.markFailedAttempt(input.scope, executionContext, input.deliveryLogId, {\n      responseStatus,\n      responseBodyTruncated,\n      failureReason,\n      nextAttemptAt,\n    });\n    logDebug('Webhook delivery retry scheduled', {\n      deliveryLogId: input.deliveryLogId,\n      scopeType: input.scope.type,\n      scopeId: input.scope.id,\n      endpointId: row.endpointId,\n      httpUrl: row.httpUrl,\n      signatureJti: row.signatureJti,\n      httpStatus: responseStatus,\n      durationMs,\n      attempt: nextAttemptCount,\n      nextAttemptAt: nextAttemptAt.toISOString(),\n      failureReason,\n    });\n    return recordAndReturn({\n      deliveryLogId: input.deliveryLogId,\n      outcome: 'retry_scheduled',\n      attemptCount: nextAttemptCount,\n      responseStatus,\n      durationMs,\n    });\n  },\n});\n\n// Batch reference identifier lives in the declarative manifest registry\n// (`engine-custom-batch-manifests`); import `M2M_WEBHOOK_DELIVERY_BATCH_REF`\n// from there to keep a single source of truth across runtime wiring,\n// queue dispatch, and specification cross-validation.\n"]}

package/dist/esm/notifications/webhooks/outbound/batches/m2m-webhook-delivery.batch.utils.d.ts

@@ -16,17 +16,17 @@
  * @see m2m-webhook-delivery.batch.backend.service.ts (consumes these).
  */
 /** Maximum number of POST attempts before terminal FAILED. */
-export declare const MAX_ATTEMPTS = 5;
+export declare const MAX_ATTEMPTS: number;
 /** Hard timeout on each outbound POST attempt. */
-export declare const REQUEST_TIMEOUT_MS = 30000;
+export declare const REQUEST_TIMEOUT_MS: number;
 /** Cap on the body slice persisted as `responseBodyTruncated` (D3). */
 export declare const RESPONSE_BODY_TRUNCATION_BYTES: number;
 /** User-Agent advertised on every outbound webhook POST. */
-export declare const WEBHOOK_USER_AGENT = "Wildo-Webhook/1";
+export declare const WEBHOOK_USER_AGENT: string;
 /**
  * Exponential backoff in seconds, capped at MAX_ATTEMPTS-1 retries.
- * Index = next attempt count (1 = first retry slot, etc.). Mirrors the
- * "1m, 5m, 30m, 2h" cadence sketched in the plan §D6.
+ * Index = next attempt count (1 = first retry slot, etc.). The
+ * "1m, 5m, 30m, 2h" cadence sketched in the plan §D6 lives on the contract.
  */
 export declare const BACKOFF_SCHEDULE_SECONDS: readonly number[];
 /**

package/dist/esm/notifications/webhooks/outbound/batches/m2m-webhook-delivery.batch.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"m2m-webhook-delivery.batch.utils.d.ts","sourceRoot":"","sources":["../../../../../../../src/notifications/webhooks/outbound/batches/m2m-webhook-delivery.batch.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,8DAA8D;AAC9D,eAAO,MAAM,YAAY,IAAI,CAAC;AAE9B,kDAAkD;AAClD,eAAO,MAAM,kBAAkB,QAAS,CAAC;AAEzC,uEAAuE;AACvE,eAAO,MAAM,8BAA8B,QAAW,CAAC;AAEvD,4DAA4D;AAC5D,eAAO,MAAM,kBAAkB,oBAAoB,CAAC;AAEpD;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,EAAE,SAAS,MAAM,EAK5C,CAAC;AAIX;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAEtD;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,GACb,WAAW,GAAG,OAAO,GAAG,OAAO,CASjC;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CA0BjD;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAInE"}
+{"version":3,"file":"m2m-webhook-delivery.batch.utils.d.ts","sourceRoot":"","sources":["../../../../../../../src/notifications/webhooks/outbound/batches/m2m-webhook-delivery.batch.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAWH,8DAA8D;AAC9D,eAAO,MAAM,YAAY,EAAE,MAAkD,CAAC;AAE9E,kDAAkD;AAClD,eAAO,MAAM,kBAAkB,EAAE,MAAuD,CAAC;AAEzF,uEAAuE;AACvE,eAAO,MAAM,8BAA8B,EAAE,MAAkE,CAAC;AAEhH,4DAA4D;AAC5D,eAAO,MAAM,kBAAkB,EAAE,MAAgD,CAAC;AAElF;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,EAAE,SAAS,MAAM,EAAyD,CAAC;AAIhH;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAEtD;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,GACb,WAAW,GAAG,OAAO,GAAG,OAAO,CASjC;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CA0BjD;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAInE"}

package/dist/esm/notifications/webhooks/outbound/batches/m2m-webhook-delivery.batch.utils.js

@@ -15,26 +15,27 @@
  *
  * @see m2m-webhook-delivery.batch.backend.service.ts (consumes these).
  */
+import { M2M_WEBHOOK_DELIVERY_CONTRACT } from '@wildo-ai/saas-models';
 // ─── Tunables (D6 lock-in) ─────────────────────────────────────
+//
+// Every value below is DERIVED from `M2M_WEBHOOK_DELIVERY_CONTRACT` in
+// `@wildo-ai/saas-models`, which is also what the application's customer
+// documentation projects. Keep the local names: they are the vocabulary the
+// worker, its tests and the delivery-log repository already speak.
 /** Maximum number of POST attempts before terminal FAILED. */
-export const MAX_ATTEMPTS = 5;
+export const MAX_ATTEMPTS = M2M_WEBHOOK_DELIVERY_CONTRACT.maxAttempts;
 /** Hard timeout on each outbound POST attempt. */
-export const REQUEST_TIMEOUT_MS = 30_000;
+export const REQUEST_TIMEOUT_MS = M2M_WEBHOOK_DELIVERY_CONTRACT.requestTimeoutMs;
 /** Cap on the body slice persisted as `responseBodyTruncated` (D3). */
-export const RESPONSE_BODY_TRUNCATION_BYTES = 4 * 1024;
+export const RESPONSE_BODY_TRUNCATION_BYTES = M2M_WEBHOOK_DELIVERY_CONTRACT.responseBodyTruncationBytes;
 /** User-Agent advertised on every outbound webhook POST. */
-export const WEBHOOK_USER_AGENT = 'Wildo-Webhook/1';
+export const WEBHOOK_USER_AGENT = M2M_WEBHOOK_DELIVERY_CONTRACT.userAgent;
 /**
  * Exponential backoff in seconds, capped at MAX_ATTEMPTS-1 retries.
- * Index = next attempt count (1 = first retry slot, etc.). Mirrors the
- * "1m, 5m, 30m, 2h" cadence sketched in the plan §D6.
+ * Index = next attempt count (1 = first retry slot, etc.). The
+ * "1m, 5m, 30m, 2h" cadence sketched in the plan §D6 lives on the contract.
  */
-export const BACKOFF_SCHEDULE_SECONDS = [
-    60,
-    300,
-    1800,
-    7200,
-];
+export const BACKOFF_SCHEDULE_SECONDS = M2M_WEBHOOK_DELIVERY_CONTRACT.backoffScheduleSeconds;
 // ─── Pure decision functions ───────────────────────────────────
 /**
  * 4xx codes considered transient. 408 = request timeout; 429 = rate
@@ -43,7 +44,7 @@ export const BACKOFF_SCHEDULE_SECONDS = [
  * the exact same payload), so a 4xx will repeat forever.
  */
 export function isRetryable4xx(status) {
-    return status === 408 || status === 429;
+    return M2M_WEBHOOK_DELIVERY_CONTRACT.retryableHttpStatuses.includes(status);
 }
 /**
  * Classify a response status into a delivery verdict.

package/dist/esm/notifications/webhooks/outbound/batches/m2m-webhook-delivery.batch.utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"m2m-webhook-delivery.batch.utils.js","sourceRoot":"","sources":["../../../../../../../src/notifications/webhooks/outbound/batches/m2m-webhook-delivery.batch.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,kEAAkE;AAElE,8DAA8D;AAC9D,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC;AAE9B,kDAAkD;AAClD,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAEzC,uEAAuE;AACvE,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,GAAG,IAAI,CAAC;AAEvD,4DAA4D;AAC5D,MAAM,CAAC,MAAM,kBAAkB,GAAG,iBAAiB,CAAC;AAEpD;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAsB;IACzD,EAAE;IACF,GAAG;IACH,IAAI;IACJ,IAAI;CACI,CAAC;AAEX,kEAAkE;AAElE;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,OAAO,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAc;IAEd,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG;QAAE,OAAO,OAAO,CAAC;IAClD,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG;QAAE,OAAO,WAAW,CAAC;IACtD,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG;QAAE,OAAO,OAAO,CAAC;IAClD,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;QAClC,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;IACpD,CAAC;IACD,yBAAyB;IACzB,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,mDAAmD;IACnD,IAAI,IAAI,CAAC,MAAM,IAAI,8BAA8B,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACjF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,KAAK,CAAC,MAAM,IAAI,8BAA8B;QAAE,OAAO,IAAI,CAAC;IAEhE,oEAAoE;IACpE,qEAAqE;IACrE,+DAA+D;IAC/D,oEAAoE;IACpE,iEAAiE;IACjE,yDAAyD;IACzD,EAAE;IACF,6DAA6D;IAC7D,iEAAiE;IACjE,gEAAgE;IAChE,mEAAmE;IACnE,gCAAgC;IAChC,IAAI,GAAG,GAAG,8BAA8B,CAAC;IACzC,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QAC/C,GAAG,EAAE,CAAC;IACR,CAAC;IACD,OAAO,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;AACnF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,gBAAwB;IAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,gBAAgB,GAAG,CAAC,EAAE,wBAAwB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAChF,MAAM,YAAY,GAAG,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAChE,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,GAAG,IAAI,CAAC,CAAC;AACpD,CAAC","sourcesContent":["/**\n * Pure helpers for the M2M webhook delivery batch worker.\n *\n * Why a separate module rather than exporting from the batch service?\n * The batch service file imports the framework's batches/services\n * machinery (via `createCustomBatchExecutionService`,\n * `engine-custom-batch-manifests`, the JWT service, etc.), which\n * transitively pulls in the full DI graph. That's fine in production —\n * the worker IS the consumer of those modules — but it makes the unit\n * tests on the pure decision logic (status classification, body\n * truncation, backoff scheduling) impossible to load in isolation\n * (Vite chokes on the connector packages and full DI). Splitting the\n * helpers into their own zero-dep file keeps the test suite cheap and\n * surface-targeted.\n *\n * @see m2m-webhook-delivery.batch.backend.service.ts (consumes these).\n */\n\n// ─── Tunables (D6 lock-in) ─────────────────────────────────────\n\n/** Maximum number of POST attempts before terminal FAILED. */\nexport const MAX_ATTEMPTS = 5;\n\n/** Hard timeout on each outbound POST attempt. */\nexport const REQUEST_TIMEOUT_MS = 30_000;\n\n/** Cap on the body slice persisted as `responseBodyTruncated` (D3). */\nexport const RESPONSE_BODY_TRUNCATION_BYTES = 4 * 1024;\n\n/** User-Agent advertised on every outbound webhook POST. */\nexport const WEBHOOK_USER_AGENT = 'Wildo-Webhook/1';\n\n/**\n * Exponential backoff in seconds, capped at MAX_ATTEMPTS-1 retries.\n * Index = next attempt count (1 = first retry slot, etc.). Mirrors the\n * \"1m, 5m, 30m, 2h\" cadence sketched in the plan §D6.\n */\nexport const BACKOFF_SCHEDULE_SECONDS: readonly number[] = [\n  60,\n  300,\n  1800,\n  7200,\n] as const;\n\n// ─── Pure decision functions ───────────────────────────────────\n\n/**\n * 4xx codes considered transient. 408 = request timeout; 429 = rate\n * limit. Everything else in 4xx is consumer-facing \"you sent something\n * wrong\" and should not be retried — the body is fixed (we always send\n * the exact same payload), so a 4xx will repeat forever.\n */\nexport function isRetryable4xx(status: number): boolean {\n  return status === 408 || status === 429;\n}\n\n/**\n * Classify a response status into a delivery verdict.\n *\n * - 1xx: informational, never the final response — `fetch()` already\n *   waits past these, so observing a 1xx here means a misbehaving\n *   intermediate. Treat as `retry` (redirect-style oddity, harmless to\n *   re-POST since the body is fixed).\n * - 2xx: terminal success (`delivered`).\n * - 3xx: webhooks must NOT redirect. A 3xx is a configuration error\n *   on the consumer side (wrong URL → CDN/proxy redirect) and will\n *   loop forever if retried. Treat as `fatal` so the row terminates\n *   with a clear failure reason and the operator can fix the URL.\n * - 408 / 429: transient (`retry`).\n * - other 4xx: caller-error — body is fixed, retry will repeat\n *   forever (`fatal`).\n * - 5xx: server-side transient (`retry`).\n * - anything else (very rare, but e.g. odd proxy codes): `retry` to\n *   err on the side of redelivery rather than silent data loss.\n */\nexport function classifyResponseStatus(\n  status: number,\n): 'delivered' | 'retry' | 'fatal' {\n  if (status >= 100 && status < 200) return 'retry';\n  if (status >= 200 && status < 300) return 'delivered';\n  if (status >= 300 && status < 400) return 'fatal';\n  if (status >= 400 && status < 500) {\n    return isRetryable4xx(status) ? 'retry' : 'fatal';\n  }\n  // 5xx and anything else.\n  return 'retry';\n}\n\n/**\n * Byte-precise truncation: caps the persisted slice at\n * `RESPONSE_BODY_TRUNCATION_BYTES` measured in **UTF-8 bytes**, not\n * JavaScript `.length` (which counts UTF-16 code units). A 4 KiB cap\n * applied to `.length` lets a payload of 4096 emoji past the cap (each\n * counts as 1 UTF-16 unit but encodes to 4 bytes), and conversely\n * truncates dense multi-byte text earlier than the budget. Truncates\n * on a UTF-8 boundary so the persisted slice is always valid UTF-8.\n */\nexport function truncateBody(body: string): string {\n  // Fast path: ASCII-only bodies bypass the encoder.\n  if (body.length <= RESPONSE_BODY_TRUNCATION_BYTES && /^[\\x00-\\x7F]*$/.test(body)) {\n    return body;\n  }\n  const encoder = new TextEncoder();\n  const bytes = encoder.encode(body);\n  if (bytes.length <= RESPONSE_BODY_TRUNCATION_BYTES) return body;\n\n  // Walk back from the byte cap to the start of the most recent UTF-8\n  // code point. UTF-8 continuation bytes have the high bits `10xxxxxx`\n  // — any byte at offset N where (bytes[N] & 0xC0) === 0x80 is a\n  // continuation byte, meaning N is mid-sequence. The first byte of a\n  // multi-byte sequence is `0xxxxxxx` (1-byte / ASCII), `110xxxxx`\n  // (2-byte), `1110xxxx` (3-byte), or `11110xxx` (4-byte).\n  //\n  // Slicing at a continuation boundary leaves stray bytes that\n  // `TextDecoder` (non-fatal) replaces with U+FFFD — and U+FFFD is\n  // 3 bytes UTF-8, so the replacement can blow past the byte cap.\n  // Cutting cleanly at a code-point boundary guarantees the result's\n  // UTF-8 length is `<=` the cap.\n  let cut = RESPONSE_BODY_TRUNCATION_BYTES;\n  while (cut > 0 && (bytes[cut] & 0xc0) === 0x80) {\n    cut--;\n  }\n  return new TextDecoder('utf-8', { fatal: false }).decode(bytes.subarray(0, cut));\n}\n\n/**\n * Compute the next attempt timestamp for a transient failure.\n *\n * `nextAttemptCount` is the post-increment value (1 = scheduling the\n * second attempt after the first failure). Indexes past the schedule\n * length clamp to the last entry so we never return `undefined` /\n * `NaN` delays for an unexpected attempt count.\n */\nexport function computeNextAttemptAt(nextAttemptCount: number): Date {\n  const idx = Math.min(nextAttemptCount - 1, BACKOFF_SCHEDULE_SECONDS.length - 1);\n  const delaySeconds = BACKOFF_SCHEDULE_SECONDS[Math.max(0, idx)];\n  return new Date(Date.now() + delaySeconds * 1000);\n}\n"]}
+{"version":3,"file":"m2m-webhook-delivery.batch.utils.js","sourceRoot":"","sources":["../../../../../../../src/notifications/webhooks/outbound/batches/m2m-webhook-delivery.batch.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,6BAA6B,EAAE,MAAM,uBAAuB,CAAC;AAEtE,kEAAkE;AAClE,EAAE;AACF,uEAAuE;AACvE,yEAAyE;AACzE,4EAA4E;AAC5E,mEAAmE;AAEnE,8DAA8D;AAC9D,MAAM,CAAC,MAAM,YAAY,GAAW,6BAA6B,CAAC,WAAW,CAAC;AAE9E,kDAAkD;AAClD,MAAM,CAAC,MAAM,kBAAkB,GAAW,6BAA6B,CAAC,gBAAgB,CAAC;AAEzF,uEAAuE;AACvE,MAAM,CAAC,MAAM,8BAA8B,GAAW,6BAA6B,CAAC,2BAA2B,CAAC;AAEhH,4DAA4D;AAC5D,MAAM,CAAC,MAAM,kBAAkB,GAAW,6BAA6B,CAAC,SAAS,CAAC;AAElF;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAsB,6BAA6B,CAAC,sBAAsB,CAAC;AAEhH,kEAAkE;AAElE;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,OAAQ,6BAA6B,CAAC,qBAA2C,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACrG,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAc;IAEd,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG;QAAE,OAAO,OAAO,CAAC;IAClD,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG;QAAE,OAAO,WAAW,CAAC;IACtD,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG;QAAE,OAAO,OAAO,CAAC;IAClD,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;QAClC,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;IACpD,CAAC;IACD,yBAAyB;IACzB,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,mDAAmD;IACnD,IAAI,IAAI,CAAC,MAAM,IAAI,8BAA8B,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACjF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,KAAK,CAAC,MAAM,IAAI,8BAA8B;QAAE,OAAO,IAAI,CAAC;IAEhE,oEAAoE;IACpE,qEAAqE;IACrE,+DAA+D;IAC/D,oEAAoE;IACpE,iEAAiE;IACjE,yDAAyD;IACzD,EAAE;IACF,6DAA6D;IAC7D,iEAAiE;IACjE,gEAAgE;IAChE,mEAAmE;IACnE,gCAAgC;IAChC,IAAI,GAAG,GAAG,8BAA8B,CAAC;IACzC,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QAC/C,GAAG,EAAE,CAAC;IACR,CAAC;IACD,OAAO,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;AACnF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,gBAAwB;IAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,gBAAgB,GAAG,CAAC,EAAE,wBAAwB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAChF,MAAM,YAAY,GAAG,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAChE,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,GAAG,IAAI,CAAC,CAAC;AACpD,CAAC","sourcesContent":["/**\n * Pure helpers for the M2M webhook delivery batch worker.\n *\n * Why a separate module rather than exporting from the batch service?\n * The batch service file imports the framework's batches/services\n * machinery (via `createCustomBatchExecutionService`,\n * `engine-custom-batch-manifests`, the JWT service, etc.), which\n * transitively pulls in the full DI graph. That's fine in production —\n * the worker IS the consumer of those modules — but it makes the unit\n * tests on the pure decision logic (status classification, body\n * truncation, backoff scheduling) impossible to load in isolation\n * (Vite chokes on the connector packages and full DI). Splitting the\n * helpers into their own zero-dep file keeps the test suite cheap and\n * surface-targeted.\n *\n * @see m2m-webhook-delivery.batch.backend.service.ts (consumes these).\n */\n\nimport { M2M_WEBHOOK_DELIVERY_CONTRACT } from '@wildo-ai/saas-models';\n\n// ─── Tunables (D6 lock-in) ─────────────────────────────────────\n//\n// Every value below is DERIVED from `M2M_WEBHOOK_DELIVERY_CONTRACT` in\n// `@wildo-ai/saas-models`, which is also what the application's customer\n// documentation projects. Keep the local names: they are the vocabulary the\n// worker, its tests and the delivery-log repository already speak.\n\n/** Maximum number of POST attempts before terminal FAILED. */\nexport const MAX_ATTEMPTS: number = M2M_WEBHOOK_DELIVERY_CONTRACT.maxAttempts;\n\n/** Hard timeout on each outbound POST attempt. */\nexport const REQUEST_TIMEOUT_MS: number = M2M_WEBHOOK_DELIVERY_CONTRACT.requestTimeoutMs;\n\n/** Cap on the body slice persisted as `responseBodyTruncated` (D3). */\nexport const RESPONSE_BODY_TRUNCATION_BYTES: number = M2M_WEBHOOK_DELIVERY_CONTRACT.responseBodyTruncationBytes;\n\n/** User-Agent advertised on every outbound webhook POST. */\nexport const WEBHOOK_USER_AGENT: string = M2M_WEBHOOK_DELIVERY_CONTRACT.userAgent;\n\n/**\n * Exponential backoff in seconds, capped at MAX_ATTEMPTS-1 retries.\n * Index = next attempt count (1 = first retry slot, etc.). The\n * \"1m, 5m, 30m, 2h\" cadence sketched in the plan §D6 lives on the contract.\n */\nexport const BACKOFF_SCHEDULE_SECONDS: readonly number[] = M2M_WEBHOOK_DELIVERY_CONTRACT.backoffScheduleSeconds;\n\n// ─── Pure decision functions ───────────────────────────────────\n\n/**\n * 4xx codes considered transient. 408 = request timeout; 429 = rate\n * limit. Everything else in 4xx is consumer-facing \"you sent something\n * wrong\" and should not be retried — the body is fixed (we always send\n * the exact same payload), so a 4xx will repeat forever.\n */\nexport function isRetryable4xx(status: number): boolean {\n  return (M2M_WEBHOOK_DELIVERY_CONTRACT.retryableHttpStatuses as readonly number[]).includes(status);\n}\n\n/**\n * Classify a response status into a delivery verdict.\n *\n * - 1xx: informational, never the final response — `fetch()` already\n *   waits past these, so observing a 1xx here means a misbehaving\n *   intermediate. Treat as `retry` (redirect-style oddity, harmless to\n *   re-POST since the body is fixed).\n * - 2xx: terminal success (`delivered`).\n * - 3xx: webhooks must NOT redirect. A 3xx is a configuration error\n *   on the consumer side (wrong URL → CDN/proxy redirect) and will\n *   loop forever if retried. Treat as `fatal` so the row terminates\n *   with a clear failure reason and the operator can fix the URL.\n * - 408 / 429: transient (`retry`).\n * - other 4xx: caller-error — body is fixed, retry will repeat\n *   forever (`fatal`).\n * - 5xx: server-side transient (`retry`).\n * - anything else (very rare, but e.g. odd proxy codes): `retry` to\n *   err on the side of redelivery rather than silent data loss.\n */\nexport function classifyResponseStatus(\n  status: number,\n): 'delivered' | 'retry' | 'fatal' {\n  if (status >= 100 && status < 200) return 'retry';\n  if (status >= 200 && status < 300) return 'delivered';\n  if (status >= 300 && status < 400) return 'fatal';\n  if (status >= 400 && status < 500) {\n    return isRetryable4xx(status) ? 'retry' : 'fatal';\n  }\n  // 5xx and anything else.\n  return 'retry';\n}\n\n/**\n * Byte-precise truncation: caps the persisted slice at\n * `RESPONSE_BODY_TRUNCATION_BYTES` measured in **UTF-8 bytes**, not\n * JavaScript `.length` (which counts UTF-16 code units). A 4 KiB cap\n * applied to `.length` lets a payload of 4096 emoji past the cap (each\n * counts as 1 UTF-16 unit but encodes to 4 bytes), and conversely\n * truncates dense multi-byte text earlier than the budget. Truncates\n * on a UTF-8 boundary so the persisted slice is always valid UTF-8.\n */\nexport function truncateBody(body: string): string {\n  // Fast path: ASCII-only bodies bypass the encoder.\n  if (body.length <= RESPONSE_BODY_TRUNCATION_BYTES && /^[\\x00-\\x7F]*$/.test(body)) {\n    return body;\n  }\n  const encoder = new TextEncoder();\n  const bytes = encoder.encode(body);\n  if (bytes.length <= RESPONSE_BODY_TRUNCATION_BYTES) return body;\n\n  // Walk back from the byte cap to the start of the most recent UTF-8\n  // code point. UTF-8 continuation bytes have the high bits `10xxxxxx`\n  // — any byte at offset N where (bytes[N] & 0xC0) === 0x80 is a\n  // continuation byte, meaning N is mid-sequence. The first byte of a\n  // multi-byte sequence is `0xxxxxxx` (1-byte / ASCII), `110xxxxx`\n  // (2-byte), `1110xxxx` (3-byte), or `11110xxx` (4-byte).\n  //\n  // Slicing at a continuation boundary leaves stray bytes that\n  // `TextDecoder` (non-fatal) replaces with U+FFFD — and U+FFFD is\n  // 3 bytes UTF-8, so the replacement can blow past the byte cap.\n  // Cutting cleanly at a code-point boundary guarantees the result's\n  // UTF-8 length is `<=` the cap.\n  let cut = RESPONSE_BODY_TRUNCATION_BYTES;\n  while (cut > 0 && (bytes[cut] & 0xc0) === 0x80) {\n    cut--;\n  }\n  return new TextDecoder('utf-8', { fatal: false }).decode(bytes.subarray(0, cut));\n}\n\n/**\n * Compute the next attempt timestamp for a transient failure.\n *\n * `nextAttemptCount` is the post-increment value (1 = scheduling the\n * second attempt after the first failure). Indexes past the schedule\n * length clamp to the last entry so we never return `undefined` /\n * `NaN` delays for an unexpected attempt count.\n */\nexport function computeNextAttemptAt(nextAttemptCount: number): Date {\n  const idx = Math.min(nextAttemptCount - 1, BACKOFF_SCHEDULE_SECONDS.length - 1);\n  const delaySeconds = BACKOFF_SCHEDULE_SECONDS[Math.max(0, idx)];\n  return new Date(Date.now() + delaySeconds * 1000);\n}\n"]}

package/dist/esm/notifications/webhooks/outbound/m2m-webhook-signed-request.backend.utils.d.ts

@@ -23,8 +23,9 @@
  * @see batches/m2m-webhook-delivery.batch.backend.service.ts — real deliveries.
  * @see services/webhook-config-test-endpoint.custom-impl.backend.service.ts — synthetic probe.
  */
+import { M2M_WEBHOOK_DELIVERY_CONTRACT } from '@wildo-ai/saas-models';
 /** Consumer-facing digest algorithm carried in every outbound webhook JWT. */
-export declare const M2M_WEBHOOK_BODY_HASH_ALGORITHM: "sha256";
+export declare const M2M_WEBHOOK_BODY_HASH_ALGORITHM: typeof M2M_WEBHOOK_DELIVERY_CONTRACT.bodyHashAlgorithm;
 /**
  * Outcome of one attempt at the wire level.
  *

package/dist/esm/notifications/webhooks/outbound/m2m-webhook-signed-request.backend.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"m2m-webhook-signed-request.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../../src/notifications/webhooks/outbound/m2m-webhook-signed-request.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAoEH,8EAA8E;AAC9E,eAAO,MAAM,+BAA+B,EAAG,QAAiB,CAAC;AAEjE;;;;;;;;GAQG;AACH,MAAM,MAAM,0BAA0B,GAAG;IACvC,2DAA2D;IAC3D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,0FAA0F;IAC1F,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,uFAAuF;IACvF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iFAAiF;IACjF,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAuCF;;;;;;;;;GASG;AACH,wBAAsB,wBAAwB,CAAC,MAAM,EAAE;IACrD,gCAAgC;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,6EAA6E;IAC7E,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAsEtC"}
+{"version":3,"file":"m2m-webhook-signed-request.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../../src/notifications/webhooks/outbound/m2m-webhook-signed-request.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,6BAA6B,EAAmB,MAAM,uBAAuB,CAAC;AA4EvF,8EAA8E;AAC9E,eAAO,MAAM,+BAA+B,EAAE,OAAO,6BAA6B,CAAC,iBAAmE,CAAC;AAEvJ;;;;;;;;GAQG;AACH,MAAM,MAAM,0BAA0B,GAAG;IACvC,2DAA2D;IAC3D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,0FAA0F;IAC1F,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,uFAAuF;IACvF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iFAAiF;IACjF,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAuCF;;;;;;;;;GASG;AACH,wBAAsB,wBAAwB,CAAC,MAAM,EAAE;IACrD,gCAAgC;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,6EAA6E;IAC7E,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAsEtC"}

package/dist/esm/notifications/webhooks/outbound/m2m-webhook-signed-request.backend.utils.js

@@ -23,18 +23,28 @@
  * @see batches/m2m-webhook-delivery.batch.backend.service.ts — real deliveries.
  * @see services/webhook-config-test-endpoint.custom-impl.backend.service.ts — synthetic probe.
  */
-import { WildoHeaderKeys } from '@wildo-ai/saas-models';
+import { M2M_WEBHOOK_DELIVERY_CONTRACT, WildoHeaderKeys } from '@wildo-ai/saas-models';
 import { OutboundTargetRejection, classifyOutboundTargetUrl, } from '../../../security/ssrf/outbound-target-guard.backend.utils.js';
 import { REQUEST_TIMEOUT_MS, WEBHOOK_USER_AGENT, truncateBody, } from './batches/m2m-webhook-delivery.batch.utils.js';
 /**
  * Schemes an outbound webhook delivery may use.
  *
- * `http:` is admitted, and that is a DEFERRED decision rather than an endorsement. The A2A sibling
- * requires HTTPS unconditionally, and the same argument applies here — the signature JWT in transit
- * is a credential. But `WebhookEndpointSchema.url` is a bare `z.url()`, so plaintext endpoints are
- * authorable today and may already be authored; refusing them here would silently stop deliveries for
- * tenants whose configuration was accepted by the framework. Tightening this is a product decision
- * with a migration, not a hardening pass.
+ * `http:` is admitted. DECIDED 2026-09-08 (#492): keep admitting it, and document the exposure where
+ * a customer authors the endpoint — which is now done, on `WebhookEndpointSchema.url`.
+ *
+ * This is a COMMERCIAL accommodation, not a security assessment, and the distinction is the whole
+ * point of writing it down. The A2A sibling requires HTTPS unconditionally and the same argument
+ * applies here — the signature JWT in transit is a credential, readable on the path and replayable
+ * until it expires, so an observer of one delivery can forge the next. What was chosen is not to break
+ * endpoints that a previous version of the framework accepted.
+ *
+ * The two options NOT taken, either of which is the better security answer: require HTTPS with a
+ * migration that identifies and notifies existing plaintext endpoints, or require it for new endpoints
+ * and grandfather existing ones behind an explicit acknowledgement. The second is the one to revisit
+ * first — it stops the plaintext population growing without breaking anyone today.
+ *
+ * Reopen on an observed interception, or on a customer compliance requirement. Do not reopen it as a
+ * tidy-up: the asymmetry with the A2A caller is deliberate and is recorded at both sites.
  */
 const M2M_WEBHOOK_ADMITTED_PROTOCOLS = ['https:', 'http:'];
 /**
@@ -80,7 +90,7 @@ function refuseUnsafeWebhookTarget(url) {
     }
 }
 /** Consumer-facing digest algorithm carried in every outbound webhook JWT. */
-export const M2M_WEBHOOK_BODY_HASH_ALGORITHM = 'sha256';
+export const M2M_WEBHOOK_BODY_HASH_ALGORITHM = M2M_WEBHOOK_DELIVERY_CONTRACT.bodyHashAlgorithm;
 /**
  * Render a `fetch` rejection into something an operator can act on.
  *