@wildo-ai/saas-backend-lib 1.1.1 → 1.1.3

package/dist/esm/security/consumable-tokens/batches/consumable-tokens-cleanup.batch.backend.service.js

@@ -7,7 +7,24 @@
  * 3. Hard delete cleanup-eligible exhausted BOUNDED_REUSE tokens
  * 4. Hard delete cleanup-eligible revoked tokens older than 7 days
  *
- * Uses bulk `deleteMany` operations for performance at scale.
+ * Uses the infrastructure tier's bulk `deleteManyForInfrastructure` door for performance at scale.
+ *
+ * ## ADAPTER-NEUTRAL, and it was not until 2026-09-01
+ *
+ * `ConsumableTokenBackendService` moved off the native MongoDB collection onto the adapter-neutral
+ * repositories plane on 2026-08-25. This batch — the resource's only other database caller — was the
+ * one call site that migration missed, and it kept resolving `MongoDBService`, taking
+ * `getConnection()` and issuing four raw `collection.deleteMany(...)`.
+ *
+ * The consequence was invisible for as long as every application ran a mongod BESIDE PostgreSQL:
+ * tokens were written to whichever store the resource is bound to, and the sweep reaped them from
+ * Mongo. `wonder-crm` — PostgreSQL on both planes, no mongod at all — is the first application where
+ * the two disagree, and there the fail-closed throw below fired every six hours from the day it was
+ * created, so the framework's only credential-retention sweep had never run: spent password-reset,
+ * invitation, email-verification and magic-link rows accumulate with nothing to remove them.
+ *
+ * `.claude/rules/invariant-call-site-enumeration.md` is the shape — an invariant applied at one of
+ * its N sites, where the miss is silent because the surviving site is the one nobody watches.
  *
  * Integration with Queue System:
  * - Registered as a core engine batch in StartApplicationBackendService
@@ -17,14 +34,15 @@
 import { BackendResourceType } from '../../../resources/models/resources-types.backend.schemas.js';
 import { createCustomBatchExecutionService } from '../../../base-classes/services/batches/batches-cronjobs-custom-execution.service.js';
 import { ENGINE_CONSUMABLE_TOKENS_CLEANUP_BATCH_MANIFEST } from '../../../base-classes/services/batches/engine-custom-batch-manifests.js';
-import { SAAS_SERVICE_TYPES } from '../../../inject/models/service-types.js';
 import { projectCaughtErrorLogFields } from '../../../errors/utils/error-log-level-classification.backend.utils.js';
 import { z } from 'zod';
-import { ConsumableToken_ConsumptionMode, resolveSharedPersistenceCollectionName, } from '@wildo-ai/saas-models';
+import { ConsumableToken_ConsumptionMode } from '@wildo-ai/saas-models';
 // Input schema (empty for scheduled runs, optional overrides for testing)
 const ConsumableTokensCleanupInputSchema = z.object({
     /** Override: max age for revoked tokens before hard delete (ms). Default: 7 days */
     revokedRetentionMs: z.number().int().min(0).optional(),
+    /** Override: ceiling on the exhausted-BOUNDED_REUSE candidate scan. See its lane below. */
+    boundedReuseScanLimit: z.number().int().min(1).optional(),
 });
 // Output schema - cleanup statistics
 const ConsumableTokensCleanupOutputSchema = z.object({
@@ -37,6 +55,15 @@ const ConsumableTokensCleanupOutputSchema = z.object({
 });
 // Threshold constants (milliseconds)
 const SEVEN_DAYS_MS = 7 * 24 * 60 * 60 * 1000;
+/**
+ * Ceiling on lane 3's candidate read — see that lane for why the read exists at all.
+ *
+ * The population it scans is "BOUNDED_REUSE tokens that are live and not flagged consumed", which by
+ * construction is the set of multi-use links an application currently has outstanding, minus the two
+ * lanes that ran before it. Exceeding this is not a scale problem to page through; it is a signal
+ * that the assumption is wrong, so the lane logs and stops rather than silently reading more.
+ */
+const DEFAULT_BOUNDED_REUSE_SCAN_LIMIT = 5000;
 /**
  * Consumable tokens cleanup batch job factory.
  *
@@ -52,33 +79,8 @@ export function createConsumableTokensCleanupBatch() {
             operationIdentifier: ENGINE_CONSUMABLE_TOKENS_CLEANUP_BATCH_MANIFEST.operationIdentifier,
             cronJobExpression: ENGINE_CONSUMABLE_TOKENS_CLEANUP_BATCH_MANIFEST.cronExpression,
         },
-        resolveDependencies: ({ get }) => ({
-            mongoDBService: get(SAAS_SERVICE_TYPES.MongoDBService),
-        }),
-        doHandle: async (input, { logger, dependencies }) => {
+        doHandle: async (input, { logger, executionContext, repositoriesRegistry }) => {
             const startTime = Date.now();
-            // Access MongoDB collection directly for bulk deleteMany operations.
-            // The repository pattern's delete() works one-at-a-time; for cleanup
-            // we need bulk operations for performance at scale.
-            const { mongoDBService } = dependencies;
-            const connection = mongoDBService.getConnection();
-            if (!connection) {
-                // FAIL CLOSED. This sweep is the only thing that removes spent authentication
-                // tokens (password-reset, invitation, email-verification, phone-verification)
-                // from the store, so "deleted nothing" and "had nothing to delete" are NOT the
-                // same outcome and must not produce the same result.
-                //
-                // Returning a zeroed result here reported SUCCESS to the batch runner: the
-                // operator saw a green job, the retention obligation silently lapsed, and spent
-                // token rows accumulated indefinitely. Nothing has executed at this point, so
-                // there is no partial progress worth preserving — a failure is the only honest
-                // outcome. `execute()` does not catch, so this surfaces as a failed batch run.
-                throw new Error('Consumable tokens cleanup cannot run: MongoDB connection unavailable');
-            }
-            // The SAME authority the service and the Mongoose model use — see `getTokenCollection`'s JSDoc
-            // for the split this literal used to create. A cleanup batch pointed at the wrong collection is
-            // the quietest half of it: it reports rows reaped from a store nothing writes to.
-            const collection = connection.collection(resolveSharedPersistenceCollectionName(BackendResourceType.CONSUMABLE_TOKENS));
             /**
              * Retention lanes that threw.
              *
@@ -92,46 +94,90 @@ export function createConsumableTokensCleanupBatch() {
              */
             const failedRetentionLanes = [];
             const revokedRetentionMs = input.revokedRetentionMs ?? SEVEN_DAYS_MS;
+            const boundedReuseScanLimit = input.boundedReuseScanLimit ?? DEFAULT_BOUNDED_REUSE_SCAN_LIMIT;
             const now = new Date();
+            /**
+             * One retention lane: a bulk delete through the infrastructure tier, recorded on failure
+             * rather than swallowed.
+             *
+             * The filter is ADAPTER-NEUTRAL by contract — `$lt`, `$exists`, `$in` and equality are in
+             * `SUPPORTED_FILTER_OPERATORS`, so each lane compiles on both arms. The door refuses an empty
+             * filter, which is what stops a lane whose predicate came out undefined from emptying the
+             * table.
+             */
+            const runDeleteLane = async (lane, filter) => {
+                try {
+                    return await repositoriesRegistry.deleteManyForInfrastructure(BackendResourceType.CONSUMABLE_TOKENS, filter, executionContext);
+                }
+                catch (error) {
+                    failedRetentionLanes.push(lane);
+                    logger.warn(`Failed to delete ${lane} tokens`, {
+                        ...projectCaughtErrorLogFields(error),
+                    });
+                    return 0;
+                }
+            };
             // NOTE: Steps 1-3 may overlap (e.g., a consumed token that is also expired gets
             // deleted in step 1 so step 2 won't find it). This is intentional — each step is
             // defense-in-depth. The deletedCount accurately reflects what each step actually deleted.
             // 1. Delete expired tokens (expiresAt < now)
-            let expiredDeleted = 0;
-            try {
-                const result = await collection.deleteMany({
-                    expiresAt: { $lt: now },
-                });
-                expiredDeleted = result.deletedCount;
-            }
-            catch (error) {
-                failedRetentionLanes.push('expired');
-                logger.warn('Failed to delete expired tokens', {
-                    ...projectCaughtErrorLogFields(error),
-                });
-            }
+            const expiredDeleted = await runDeleteLane('expired', { expiresAt: { $lt: now } });
             // 2. Delete fully consumed tokens (isConsumed = true)
-            let consumedDeleted = 0;
-            try {
-                const result = await collection.deleteMany({ isConsumed: true });
-                consumedDeleted = result.deletedCount;
-            }
-            catch (error) {
-                failedRetentionLanes.push('consumed');
-                logger.warn('Failed to delete consumed tokens', {
-                    ...projectCaughtErrorLogFields(error),
-                });
-            }
-            // 3. Delete exhausted BOUNDED_REUSE tokens where usesCount >= maxUses
-            // This is defense-in-depth for the race condition edge case where isConsumed
-            // may not have been atomically set during concurrent consumption.
+            const consumedDeleted = await runDeleteLane('consumed', { isConsumed: true });
+            /**
+             * 3. Delete exhausted BOUNDED_REUSE tokens where `usesCount >= maxUses`.
+             *
+             * Defense-in-depth for the window in which `isConsumed` has not yet been settled:
+             * `ConsumableTokenBackendService.consumeToken` derives that flag from the POST-increment row
+             * and writes it best-effort, naming this lane as the bound on a failure — so lane 2 above can
+             * legitimately miss an exhausted token and this one must find it.
+             *
+             * **Why this lane READS instead of filtering.** The comparison is column-to-column, which
+             * MongoDB expresses as `$expr: { $gte: ['$usesCount', '$maxUses'] }` — an operator in
+             * `MONGODB_ONLY_OPERATORS`, so it throws on PostgreSQL. It could not simply be translated
+             * either: `maxUses` is a BOUNDED_REUSE *variant* field, which PostgreSQL stores inside the
+             * `variantConfig` jsonb rather than as a column, and `usesCount` is a base column. So the row
+             * is fetched (where `transformPersistenceRow` has already re-hydrated the variant field to the
+             * top level, identically to MongoDB) and the comparison is done here. Exactly the trade
+             * `consumeToken` records for the same pair of fields: keep the authoritative behaviour, pay a
+             * round trip, refuse to pin the framework to one adapter for a convenience operator.
+             *
+             * The candidate set is deliberately narrowed to what is still live and unflagged — lanes 1 and
+             * 2 have already removed the expired and the flagged — so this is normally a handful of rows.
+             * {@link DEFAULT_BOUNDED_REUSE_SCAN_LIMIT} bounds what the lane will PROCESS and says so out
+             * loud when it bites; the read itself is unbounded, which is honest rather than ideal — the
+             * infrastructure tier has no paginated raw read, and adding one for a lane that should return
+             * near-zero rows would be building for a shape we do not have.
+             */
             let exhaustedBoundedDeleted = 0;
             try {
-                const result = await collection.deleteMany({
-                    consumptionMode: ConsumableToken_ConsumptionMode.BOUNDED_REUSE,
-                    $expr: { $gte: ['$usesCount', '$maxUses'] },
-                });
-                exhaustedBoundedDeleted = result.deletedCount;
+                const boundedReuseCandidates = await repositoriesRegistry.findManyForInfrastructure(BackendResourceType.CONSUMABLE_TOKENS, { consumptionMode: ConsumableToken_ConsumptionMode.BOUNDED_REUSE, isConsumed: false }, executionContext);
+                if (boundedReuseCandidates.length > boundedReuseScanLimit) {
+                    logger.warn('Exhausted-BOUNDED_REUSE lane found more live candidates than expected — processing the '
+                        + 'scan limit only, and the excess stays until the next run', { candidates: boundedReuseCandidates.length, boundedReuseScanLimit });
+                }
+                /**
+                 * `String(token._id)`, NOT a `typeof … === 'string'` filter.
+                 *
+                 * The MongoDB arm returns rows through `document.toObject()`, which leaves `_id` as an
+                 * ObjectId INSTANCE; the PostgreSQL arm returns a text column. A string-typed guard would
+                 * therefore drop every candidate on MongoDB and delete nothing — the same "works on one
+                 * adapter" defect this whole change exists to remove, reintroduced one layer down. Coercing
+                 * is safe in the other direction too: mongoose casts a hex string back to an ObjectId when
+                 * the `_id` path is one, and leaves it alone when the path is a String. Same idiom as the
+                 * retention sweep's `String(row._id ?? '')`.
+                 */
+                const exhaustedIds = boundedReuseCandidates
+                    .slice(0, boundedReuseScanLimit)
+                    .filter((token) => typeof token.maxUses === 'number' && (token.usesCount ?? 0) >= token.maxUses)
+                    .map((token) => String(token._id ?? ''))
+                    .filter((id) => id.length > 0);
+                // The door refuses an empty filter, and `{ _id: { $in: [] } }` is a filter that matches
+                // nothing on one adapter and is a needless statement on the other. Ask nothing when there is
+                // nothing to ask.
+                if (exhaustedIds.length > 0) {
+                    exhaustedBoundedDeleted = await runDeleteLane('exhaustedBoundedReuse', { _id: { $in: exhaustedIds } });
+                }
             }
             catch (error) {
                 failedRetentionLanes.push('exhaustedBoundedReuse');
@@ -140,20 +186,10 @@ export function createConsumableTokensCleanupBatch() {
                 });
             }
             // 4. Delete revoked tokens older than retention period
-            let revokedDeleted = 0;
             const revokedCutoff = new Date(now.getTime() - revokedRetentionMs);
-            try {
-                const result = await collection.deleteMany({
-                    revokedAt: { $lt: revokedCutoff, $exists: true },
-                });
-                revokedDeleted = result.deletedCount;
-            }
-            catch (error) {
-                failedRetentionLanes.push('revoked');
-                logger.warn('Failed to delete revoked tokens', {
-                    ...projectCaughtErrorLogFields(error),
-                });
-            }
+            const revokedDeleted = await runDeleteLane('revoked', {
+                revokedAt: { $lt: revokedCutoff, $exists: true },
+            });
             const durationMs = Date.now() - startTime;
             const totalDeleted = expiredDeleted + consumedDeleted + exhaustedBoundedDeleted + revokedDeleted;
             if (failedRetentionLanes.length > 0) {

package/dist/esm/security/consumable-tokens/batches/consumable-tokens-cleanup.batch.backend.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"consumable-tokens-cleanup.batch.backend.service.js","sourceRoot":"","sources":["../../../../../../src/security/consumable-tokens/batches/consumable-tokens-cleanup.batch.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,qEAAqE,CAAC;AAC1G,OAAO,EAAE,iCAAiC,EAAE,MAAM,4FAA4F,CAAC;AAC/I,OAAO,EAAE,+CAA+C,EAAE,MAAM,gFAAgF,CAAC;AACjJ,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAE3H,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,+BAA+B,EACtC,sCAAsC,GACvC,MAAM,uBAAuB,CAAC;AAE/B,0EAA0E;AAC1E,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,oFAAoF;IACpF,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACvD,CAAC,CAAC;AAEH,qCAAqC;AACrC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxC,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACpC,CAAC,CAAC;AAEH,qCAAqC;AACrC,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE9C;;;;GAIG;AACH,MAAM,UAAU,kCAAkC;IAChD,OAAO,iCAAiC,CAAC;QACvC,KAAK,EAAE,kCAAkC;QACzC,MAAM,EAAE,mCAAmC;QAC3C,oBAAoB,EAAE;YACpB,IAAI,EAAE,+CAA+C,CAAC,IAAI;YAC1D,kBAAkB,EAAE,+CAA+C,CAAC,kBAAkB;YACtF,mBAAmB,EAAE,+CAA+C,CAAC,mBAAmB;YACxF,iBAAiB,EAAE,+CAA+C,CAAC,cAAc;SAClF;QACD,mBAAmB,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;YACjC,cAAc,EAAE,GAAG,CAAiB,kBAAkB,CAAC,cAAc,CAAC;SACvE,CAAC;QACF,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,EAAE;YAClD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAE7B,qEAAqE;YACrE,qEAAqE;YACrE,oDAAoD;YACpD,MAAM,EAAE,cAAc,EAAE,GAAG,YAAY,CAAC;YACxC,MAAM,UAAU,GAAG,cAAc,CAAC,aAAa,EAAE,CAAC;YAElD,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,8EAA8E;gBAC9E,8EAA8E;gBAC9E,+EAA+E;gBAC/E,qDAAqD;gBACrD,EAAE;gBACF,2EAA2E;gBAC3E,gFAAgF;gBAChF,8EAA8E;gBAC9E,+EAA+E;gBAC/E,+EAA+E;gBAC/E,MAAM,IAAI,KAAK,CACb,sEAAsE,CACvE,CAAC;YACJ,CAAC;YAED,+FAA+F;YAC/F,gGAAgG;YAChG,kFAAkF;YAClF,MAAM,UAAU,GAAG,UAAU,CAAC,UAAU,CACtC,sCAAsC,CAAC,mBAAmB,CAAC,iBAA0B,CAAC,CACvF,CAAC;YAEF;;;;;;;;;;eAUG;YACH,MAAM,oBAAoB,GAAa,EAAE,CAAC;YAC1C,MAAM,kBAAkB,GAAG,KAAK,CAAC,kBAAkB,IAAI,aAAa,CAAC;YACrE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;YAEvB,gFAAgF;YAChF,iFAAiF;YACjF,0FAA0F;YAE1F,6CAA6C;YAC7C,IAAI,cAAc,GAAG,CAAC,CAAC;YACvB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,UAAU,CAAC;oBACzC,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE;iBACxB,CAAC,CAAC;gBACH,cAAc,GAAG,MAAM,CAAC,YAAY,CAAC;YACvC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACrC,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE;oBAC7C,GAAG,2BAA2B,CAAC,KAAK,CAAC;iBACtC,CAAC,CAAC;YACL,CAAC;YAED,sDAAsD;YACtD,IAAI,eAAe,GAAG,CAAC,CAAC;YACxB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,UAAU,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;gBACjE,eAAe,GAAG,MAAM,CAAC,YAAY,CAAC;YACxC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBACtC,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE;oBAC9C,GAAG,2BAA2B,CAAC,KAAK,CAAC;iBACtC,CAAC,CAAC;YACL,CAAC;YAED,sEAAsE;YACtE,6EAA6E;YAC7E,kEAAkE;YAClE,IAAI,uBAAuB,GAAG,CAAC,CAAC;YAChC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,UAAU,CAAC;oBACzC,eAAe,EAAE,+BAA+B,CAAC,aAAa;oBAC9D,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,YAAY,EAAE,UAAU,CAAC,EAAE;iBAC5C,CAAC,CAAC;gBACH,uBAAuB,GAAG,MAAM,CAAC,YAAY,CAAC;YAChD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,oBAAoB,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;gBACnD,MAAM,CAAC,IAAI,CAAC,iDAAiD,EAAE;oBAC7D,GAAG,2BAA2B,CAAC,KAAK,CAAC;iBACtC,CAAC,CAAC;YACL,CAAC;YAED,uDAAuD;YACvD,IAAI,cAAc,GAAG,CAAC,CAAC;YACvB,MAAM,aAAa,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,kBAAkB,CAAC,CAAC;YACnE,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,UAAU,CAAC;oBACzC,SAAS,EAAE,EAAE,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE;iBACjD,CAAC,CAAC;gBACH,cAAc,GAAG,MAAM,CAAC,YAAY,CAAC;YACvC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACrC,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE;oBAC7C,GAAG,2BAA2B,CAAC,KAAK,CAAC;iBACtC,CAAC,CAAC;YACL,CAAC;YAED,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YAC1C,MAAM,YAAY,GAAG,cAAc,GAAG,eAAe,GAAG,uBAAuB,GAAG,cAAc,CAAC;YAEjG,IAAI,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpC,kFAAkF;gBAClF,gFAAgF;gBAChF,kFAAkF;gBAClF,oCAAoC;gBACpC,MAAM,CAAC,KAAK,CAAC,mEAAmE,EAAE;oBAChF,oBAAoB;oBACpB,cAAc;oBACd,eAAe;oBACf,uBAAuB;oBACvB,cAAc;oBACd,YAAY;oBACZ,UAAU;iBACX,CAAC,CAAC;gBACH,MAAM,IAAI,KAAK,CACb,2DAA2D,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC7F,CAAC;YACJ,CAAC;YAED,MAAM,CAAC,IAAI,CAAC,2CAA2C,EAAE;gBACvD,cAAc;gBACd,eAAe;gBACf,uBAAuB;gBACvB,cAAc;gBACd,YAAY;gBACZ,UAAU;aACX,CAAC,CAAC;YAEH,OAAO;gBACL,cAAc;gBACd,eAAe;gBACf,uBAAuB;gBACvB,cAAc;gBACd,YAAY;gBACZ,UAAU;aACX,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,wEAAwE;AACxE,kFAAkF;AAClF,2EAA2E;AAC3E,gDAAgD","sourcesContent":["/**\n * Consumable Tokens Cleanup Batch Job\n *\n * This batch job runs every 6 hours and performs:\n * 1. Hard delete cleanup-eligible expired tokens (past expiresAt)\n * 2. Hard delete cleanup-eligible fully consumed tokens (isConsumed = true)\n * 3. Hard delete cleanup-eligible exhausted BOUNDED_REUSE tokens\n * 4. Hard delete cleanup-eligible revoked tokens older than 7 days\n *\n * Uses bulk `deleteMany` operations for performance at scale.\n *\n * Integration with Queue System:\n * - Registered as a core engine batch in StartApplicationBackendService\n * - Scheduled via crontabs-batches-manager (every 6 hours)\n * - Executed by BatchesCronjobsExecutor_BackendService\n */\n\nimport { BackendResourceType } from '~wildo-backend-lib/resources/models/resources-types.backend.schemas';\nimport { createCustomBatchExecutionService } from '~wildo-backend-lib/base-classes/services/batches/batches-cronjobs-custom-execution.service';\nimport { ENGINE_CONSUMABLE_TOKENS_CLEANUP_BATCH_MANIFEST } from '~wildo-backend-lib/base-classes/services/batches/engine-custom-batch-manifests';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport type { MongoDBService } from '~wildo-backend-lib/databases/services/mongodb.service';\nimport { z } from 'zod';\nimport { ConsumableToken_ConsumptionMode,\n  resolveSharedPersistenceCollectionName,\n} from '@wildo-ai/saas-models';\n\n// Input schema (empty for scheduled runs, optional overrides for testing)\nconst ConsumableTokensCleanupInputSchema = z.object({\n  /** Override: max age for revoked tokens before hard delete (ms). Default: 7 days */\n  revokedRetentionMs: z.number().int().min(0).optional(),\n});\n\n// Output schema - cleanup statistics\nconst ConsumableTokensCleanupOutputSchema = z.object({\n  expiredDeleted: z.number().int().min(0),\n  consumedDeleted: z.number().int().min(0),\n  exhaustedBoundedDeleted: z.number().int().min(0),\n  revokedDeleted: z.number().int().min(0),\n  totalDeleted: z.number().int().min(0),\n  durationMs: z.number().int().min(0),\n});\n\n// Threshold constants (milliseconds)\nconst SEVEN_DAYS_MS = 7 * 24 * 60 * 60 * 1000;\n\n/**\n * Consumable tokens cleanup batch job factory.\n *\n * @returns Custom batch execution service for consumable tokens cleanup\n */\nexport function createConsumableTokensCleanupBatch(): ReturnType<typeof createCustomBatchExecutionService> {\n  return createCustomBatchExecutionService({\n    input: ConsumableTokensCleanupInputSchema,\n    output: ConsumableTokensCleanupOutputSchema,\n    batchCronjob_Context: {\n      kind: ENGINE_CONSUMABLE_TOKENS_CLEANUP_BATCH_MANIFEST.kind,\n      resourceIdentifier: ENGINE_CONSUMABLE_TOKENS_CLEANUP_BATCH_MANIFEST.resourceIdentifier,\n      operationIdentifier: ENGINE_CONSUMABLE_TOKENS_CLEANUP_BATCH_MANIFEST.operationIdentifier,\n      cronJobExpression: ENGINE_CONSUMABLE_TOKENS_CLEANUP_BATCH_MANIFEST.cronExpression,\n    },\n    resolveDependencies: ({ get }) => ({\n      mongoDBService: get<MongoDBService>(SAAS_SERVICE_TYPES.MongoDBService),\n    }),\n    doHandle: async (input, { logger, dependencies }) => {\n      const startTime = Date.now();\n\n      // Access MongoDB collection directly for bulk deleteMany operations.\n      // The repository pattern's delete() works one-at-a-time; for cleanup\n      // we need bulk operations for performance at scale.\n      const { mongoDBService } = dependencies;\n      const connection = mongoDBService.getConnection();\n\n      if (!connection) {\n        // FAIL CLOSED. This sweep is the only thing that removes spent authentication\n        // tokens (password-reset, invitation, email-verification, phone-verification)\n        // from the store, so \"deleted nothing\" and \"had nothing to delete\" are NOT the\n        // same outcome and must not produce the same result.\n        //\n        // Returning a zeroed result here reported SUCCESS to the batch runner: the\n        // operator saw a green job, the retention obligation silently lapsed, and spent\n        // token rows accumulated indefinitely. Nothing has executed at this point, so\n        // there is no partial progress worth preserving — a failure is the only honest\n        // outcome. `execute()` does not catch, so this surfaces as a failed batch run.\n        throw new Error(\n          'Consumable tokens cleanup cannot run: MongoDB connection unavailable',\n        );\n      }\n\n      // The SAME authority the service and the Mongoose model use — see `getTokenCollection`'s JSDoc\n      // for the split this literal used to create. A cleanup batch pointed at the wrong collection is\n      // the quietest half of it: it reports rows reaped from a store nothing writes to.\n      const collection = connection.collection(\n        resolveSharedPersistenceCollectionName(BackendResourceType.CONSUMABLE_TOKENS as never),\n      );\n\n      /**\n       * Retention lanes that threw.\n       *\n       * The four lanes stay independently guarded on purpose — they are defense-in-depth\n       * and partially overlapping, so a later lane can still reclaim rows when an earlier\n       * one fails, and that partial progress is worth keeping. What was wrong is that\n       * every failure was swallowed into a `warn`: with all four lanes broken the batch\n       * still returned `totalDeleted: 0` and logged \"cleanup batch completed\" at INFO.\n       *\n       * So: keep running, but remember, and fail the batch at the end.\n       */\n      const failedRetentionLanes: string[] = [];\n      const revokedRetentionMs = input.revokedRetentionMs ?? SEVEN_DAYS_MS;\n      const now = new Date();\n\n      // NOTE: Steps 1-3 may overlap (e.g., a consumed token that is also expired gets\n      // deleted in step 1 so step 2 won't find it). This is intentional — each step is\n      // defense-in-depth. The deletedCount accurately reflects what each step actually deleted.\n\n      // 1. Delete expired tokens (expiresAt < now)\n      let expiredDeleted = 0;\n      try {\n        const result = await collection.deleteMany({\n          expiresAt: { $lt: now },\n        });\n        expiredDeleted = result.deletedCount;\n      } catch (error) {\n        failedRetentionLanes.push('expired');\n        logger.warn('Failed to delete expired tokens', {\n          ...projectCaughtErrorLogFields(error),\n        });\n      }\n\n      // 2. Delete fully consumed tokens (isConsumed = true)\n      let consumedDeleted = 0;\n      try {\n        const result = await collection.deleteMany({ isConsumed: true });\n        consumedDeleted = result.deletedCount;\n      } catch (error) {\n        failedRetentionLanes.push('consumed');\n        logger.warn('Failed to delete consumed tokens', {\n          ...projectCaughtErrorLogFields(error),\n        });\n      }\n\n      // 3. Delete exhausted BOUNDED_REUSE tokens where usesCount >= maxUses\n      // This is defense-in-depth for the race condition edge case where isConsumed\n      // may not have been atomically set during concurrent consumption.\n      let exhaustedBoundedDeleted = 0;\n      try {\n        const result = await collection.deleteMany({\n          consumptionMode: ConsumableToken_ConsumptionMode.BOUNDED_REUSE,\n          $expr: { $gte: ['$usesCount', '$maxUses'] },\n        });\n        exhaustedBoundedDeleted = result.deletedCount;\n      } catch (error) {\n        failedRetentionLanes.push('exhaustedBoundedReuse');\n        logger.warn('Failed to delete exhausted BOUNDED_REUSE tokens', {\n          ...projectCaughtErrorLogFields(error),\n        });\n      }\n\n      // 4. Delete revoked tokens older than retention period\n      let revokedDeleted = 0;\n      const revokedCutoff = new Date(now.getTime() - revokedRetentionMs);\n      try {\n        const result = await collection.deleteMany({\n          revokedAt: { $lt: revokedCutoff, $exists: true },\n        });\n        revokedDeleted = result.deletedCount;\n      } catch (error) {\n        failedRetentionLanes.push('revoked');\n        logger.warn('Failed to delete revoked tokens', {\n          ...projectCaughtErrorLogFields(error),\n        });\n      }\n\n      const durationMs = Date.now() - startTime;\n      const totalDeleted = expiredDeleted + consumedDeleted + exhaustedBoundedDeleted + revokedDeleted;\n\n      if (failedRetentionLanes.length > 0) {\n        // Report what DID get reclaimed before failing — the partial progress is real and\n        // an operator diagnosing the failure needs it. Logged at error level (not warn)\n        // because the batch outcome is a failure, and the per-lane warns above carry only\n        // the cause, never the consequence.\n        logger.error('Consumable tokens cleanup completed PARTIALLY — failing the batch', {\n          failedRetentionLanes,\n          expiredDeleted,\n          consumedDeleted,\n          exhaustedBoundedDeleted,\n          revokedDeleted,\n          totalDeleted,\n          durationMs,\n        });\n        throw new Error(\n          `Consumable tokens cleanup failed for retention lane(s): ${failedRetentionLanes.join(', ')}`,\n        );\n      }\n\n      logger.info('Consumable tokens cleanup batch completed', {\n        expiredDeleted,\n        consumedDeleted,\n        exhaustedBoundedDeleted,\n        revokedDeleted,\n        totalDeleted,\n        durationMs,\n      });\n\n      return {\n        expiredDeleted,\n        consumedDeleted,\n        exhaustedBoundedDeleted,\n        revokedDeleted,\n        totalDeleted,\n        durationMs,\n      };\n    },\n  });\n}\n\n// Batch reference identifier lives in the declarative manifest registry\n// (`engine-custom-batch-manifests`); import `CONSUMABLE_TOKENS_CLEANUP_BATCH_REF`\n// from there to keep a single source of truth across runtime wiring, queue\n// dispatch, and specification cross-validation.\n"]}
+{"version":3,"file":"consumable-tokens-cleanup.batch.backend.service.js","sourceRoot":"","sources":["../../../../../../src/security/consumable-tokens/batches/consumable-tokens-cleanup.batch.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,qEAAqE,CAAC;AAC1G,OAAO,EAAE,iCAAiC,EAAE,MAAM,4FAA4F,CAAC;AAC/I,OAAO,EAAE,+CAA+C,EAAE,MAAM,gFAAgF,CAAC;AACjJ,OAAO,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAC3H,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,+BAA+B,EAAE,MAAM,uBAAuB,CAAC;AAIxE,0EAA0E;AAC1E,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,oFAAoF;IACpF,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtD,2FAA2F;IAC3F,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC1D,CAAC,CAAC;AAEH,qCAAqC;AACrC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxC,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACpC,CAAC,CAAC;AAEH,qCAAqC;AACrC,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE9C;;;;;;;GAOG;AACH,MAAM,gCAAgC,GAAG,IAAI,CAAC;AAE9C;;;;GAIG;AACH,MAAM,UAAU,kCAAkC;IAChD,OAAO,iCAAiC,CAAC;QACvC,KAAK,EAAE,kCAAkC;QACzC,MAAM,EAAE,mCAAmC;QAC3C,oBAAoB,EAAE;YACpB,IAAI,EAAE,+CAA+C,CAAC,IAAI;YAC1D,kBAAkB,EAAE,+CAA+C,CAAC,kBAAkB;YACtF,mBAAmB,EAAE,+CAA+C,CAAC,mBAAmB;YACxF,iBAAiB,EAAE,+CAA+C,CAAC,cAAc;SAClF;QACD,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,EAAE,EAAE;YAC5E,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAE7B;;;;;;;;;;eAUG;YACH,MAAM,oBAAoB,GAAa,EAAE,CAAC;YAC1C,MAAM,kBAAkB,GAAG,KAAK,CAAC,kBAAkB,IAAI,aAAa,CAAC;YACrE,MAAM,qBAAqB,GAAG,KAAK,CAAC,qBAAqB,IAAI,gCAAgC,CAAC;YAC9F,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;YAEvB;;;;;;;;eAQG;YACH,MAAM,aAAa,GAAG,KAAK,EAAE,IAAY,EAAE,MAA+B,EAAmB,EAAE;gBAC7F,IAAI,CAAC;oBACH,OAAO,MAAM,oBAAoB,CAAC,2BAA2B,CAC3D,mBAAmB,CAAC,iBAA0B,EAC9C,MAAM,EACN,gBAAgB,CACjB,CAAC;gBACJ,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAChC,MAAM,CAAC,IAAI,CAAC,oBAAoB,IAAI,SAAS,EAAE;wBAC7C,GAAG,2BAA2B,CAAC,KAAK,CAAC;qBACtC,CAAC,CAAC;oBACH,OAAO,CAAC,CAAC;gBACX,CAAC;YACH,CAAC,CAAC;YAEF,gFAAgF;YAChF,iFAAiF;YACjF,0FAA0F;YAE1F,6CAA6C;YAC7C,MAAM,cAAc,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YAEnF,sDAAsD;YACtD,MAAM,eAAe,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;YAE9E;;;;;;;;;;;;;;;;;;;;;;;;eAwBG;YACH,IAAI,uBAAuB,GAAG,CAAC,CAAC;YAChC,IAAI,CAAC;gBACH,MAAM,sBAAsB,GAAG,MAAM,oBAAoB,CAAC,yBAAyB,CACjF,mBAAmB,CAAC,iBAA0B,EAC9C,EAAE,eAAe,EAAE,+BAA+B,CAAC,aAAa,EAAE,UAAU,EAAE,KAAK,EAAE,EACrF,gBAAgB,CACjB,CAAC;gBAEF,IAAI,sBAAsB,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;oBAC1D,MAAM,CAAC,IAAI,CACT,yFAAyF;0BACvF,0DAA0D,EAC5D,EAAE,UAAU,EAAE,sBAAsB,CAAC,MAAM,EAAE,qBAAqB,EAAE,CACrE,CAAC;gBACJ,CAAC;gBAED;;;;;;;;;;mBAUG;gBACH,MAAM,YAAY,GAAG,sBAAsB;qBACxC,KAAK,CAAC,CAAC,EAAE,qBAAqB,CAAC;qBAC/B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC;qBAC/F,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;qBACvC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;gBAEjC,wFAAwF;gBACxF,6FAA6F;gBAC7F,kBAAkB;gBAClB,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC5B,uBAAuB,GAAG,MAAM,aAAa,CAAC,uBAAuB,EAAE,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;gBACzG,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,oBAAoB,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;gBACnD,MAAM,CAAC,IAAI,CAAC,iDAAiD,EAAE;oBAC7D,GAAG,2BAA2B,CAAC,KAAK,CAAC;iBACtC,CAAC,CAAC;YACL,CAAC;YAED,uDAAuD;YACvD,MAAM,aAAa,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,kBAAkB,CAAC,CAAC;YACnE,MAAM,cAAc,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE;gBACpD,SAAS,EAAE,EAAE,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE;aACjD,CAAC,CAAC;YAEH,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YAC1C,MAAM,YAAY,GAAG,cAAc,GAAG,eAAe,GAAG,uBAAuB,GAAG,cAAc,CAAC;YAEjG,IAAI,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpC,kFAAkF;gBAClF,gFAAgF;gBAChF,kFAAkF;gBAClF,oCAAoC;gBACpC,MAAM,CAAC,KAAK,CAAC,mEAAmE,EAAE;oBAChF,oBAAoB;oBACpB,cAAc;oBACd,eAAe;oBACf,uBAAuB;oBACvB,cAAc;oBACd,YAAY;oBACZ,UAAU;iBACX,CAAC,CAAC;gBACH,MAAM,IAAI,KAAK,CACb,2DAA2D,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC7F,CAAC;YACJ,CAAC;YAED,MAAM,CAAC,IAAI,CAAC,2CAA2C,EAAE;gBACvD,cAAc;gBACd,eAAe;gBACf,uBAAuB;gBACvB,cAAc;gBACd,YAAY;gBACZ,UAAU;aACX,CAAC,CAAC;YAEH,OAAO;gBACL,cAAc;gBACd,eAAe;gBACf,uBAAuB;gBACvB,cAAc;gBACd,YAAY;gBACZ,UAAU;aACX,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,wEAAwE;AACxE,kFAAkF;AAClF,2EAA2E;AAC3E,gDAAgD","sourcesContent":["/**\n * Consumable Tokens Cleanup Batch Job\n *\n * This batch job runs every 6 hours and performs:\n * 1. Hard delete cleanup-eligible expired tokens (past expiresAt)\n * 2. Hard delete cleanup-eligible fully consumed tokens (isConsumed = true)\n * 3. Hard delete cleanup-eligible exhausted BOUNDED_REUSE tokens\n * 4. Hard delete cleanup-eligible revoked tokens older than 7 days\n *\n * Uses the infrastructure tier's bulk `deleteManyForInfrastructure` door for performance at scale.\n *\n * ## ADAPTER-NEUTRAL, and it was not until 2026-09-01\n *\n * `ConsumableTokenBackendService` moved off the native MongoDB collection onto the adapter-neutral\n * repositories plane on 2026-08-25. This batch — the resource's only other database caller — was the\n * one call site that migration missed, and it kept resolving `MongoDBService`, taking\n * `getConnection()` and issuing four raw `collection.deleteMany(...)`.\n *\n * The consequence was invisible for as long as every application ran a mongod BESIDE PostgreSQL:\n * tokens were written to whichever store the resource is bound to, and the sweep reaped them from\n * Mongo. `wonder-crm` — PostgreSQL on both planes, no mongod at all — is the first application where\n * the two disagree, and there the fail-closed throw below fired every six hours from the day it was\n * created, so the framework's only credential-retention sweep had never run: spent password-reset,\n * invitation, email-verification and magic-link rows accumulate with nothing to remove them.\n *\n * `.claude/rules/invariant-call-site-enumeration.md` is the shape — an invariant applied at one of\n * its N sites, where the miss is silent because the surviving site is the one nobody watches.\n *\n * Integration with Queue System:\n * - Registered as a core engine batch in StartApplicationBackendService\n * - Scheduled via crontabs-batches-manager (every 6 hours)\n * - Executed by BatchesCronjobsExecutor_BackendService\n */\n\nimport { BackendResourceType } from '~wildo-backend-lib/resources/models/resources-types.backend.schemas';\nimport { createCustomBatchExecutionService } from '~wildo-backend-lib/base-classes/services/batches/batches-cronjobs-custom-execution.service';\nimport { ENGINE_CONSUMABLE_TOKENS_CLEANUP_BATCH_MANIFEST } from '~wildo-backend-lib/base-classes/services/batches/engine-custom-batch-manifests';\nimport { projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { z } from 'zod';\nimport { ConsumableToken_ConsumptionMode } from '@wildo-ai/saas-models';\n\nimport type { ConsumableToken } from '~wildo-backend-lib/security/consumable-tokens/models/consumable-tokens.shared.schemas';\n\n// Input schema (empty for scheduled runs, optional overrides for testing)\nconst ConsumableTokensCleanupInputSchema = z.object({\n  /** Override: max age for revoked tokens before hard delete (ms). Default: 7 days */\n  revokedRetentionMs: z.number().int().min(0).optional(),\n  /** Override: ceiling on the exhausted-BOUNDED_REUSE candidate scan. See its lane below. */\n  boundedReuseScanLimit: z.number().int().min(1).optional(),\n});\n\n// Output schema - cleanup statistics\nconst ConsumableTokensCleanupOutputSchema = z.object({\n  expiredDeleted: z.number().int().min(0),\n  consumedDeleted: z.number().int().min(0),\n  exhaustedBoundedDeleted: z.number().int().min(0),\n  revokedDeleted: z.number().int().min(0),\n  totalDeleted: z.number().int().min(0),\n  durationMs: z.number().int().min(0),\n});\n\n// Threshold constants (milliseconds)\nconst SEVEN_DAYS_MS = 7 * 24 * 60 * 60 * 1000;\n\n/**\n * Ceiling on lane 3's candidate read — see that lane for why the read exists at all.\n *\n * The population it scans is \"BOUNDED_REUSE tokens that are live and not flagged consumed\", which by\n * construction is the set of multi-use links an application currently has outstanding, minus the two\n * lanes that ran before it. Exceeding this is not a scale problem to page through; it is a signal\n * that the assumption is wrong, so the lane logs and stops rather than silently reading more.\n */\nconst DEFAULT_BOUNDED_REUSE_SCAN_LIMIT = 5000;\n\n/**\n * Consumable tokens cleanup batch job factory.\n *\n * @returns Custom batch execution service for consumable tokens cleanup\n */\nexport function createConsumableTokensCleanupBatch(): ReturnType<typeof createCustomBatchExecutionService> {\n  return createCustomBatchExecutionService({\n    input: ConsumableTokensCleanupInputSchema,\n    output: ConsumableTokensCleanupOutputSchema,\n    batchCronjob_Context: {\n      kind: ENGINE_CONSUMABLE_TOKENS_CLEANUP_BATCH_MANIFEST.kind,\n      resourceIdentifier: ENGINE_CONSUMABLE_TOKENS_CLEANUP_BATCH_MANIFEST.resourceIdentifier,\n      operationIdentifier: ENGINE_CONSUMABLE_TOKENS_CLEANUP_BATCH_MANIFEST.operationIdentifier,\n      cronJobExpression: ENGINE_CONSUMABLE_TOKENS_CLEANUP_BATCH_MANIFEST.cronExpression,\n    },\n    doHandle: async (input, { logger, executionContext, repositoriesRegistry }) => {\n      const startTime = Date.now();\n\n      /**\n       * Retention lanes that threw.\n       *\n       * The four lanes stay independently guarded on purpose — they are defense-in-depth\n       * and partially overlapping, so a later lane can still reclaim rows when an earlier\n       * one fails, and that partial progress is worth keeping. What was wrong is that\n       * every failure was swallowed into a `warn`: with all four lanes broken the batch\n       * still returned `totalDeleted: 0` and logged \"cleanup batch completed\" at INFO.\n       *\n       * So: keep running, but remember, and fail the batch at the end.\n       */\n      const failedRetentionLanes: string[] = [];\n      const revokedRetentionMs = input.revokedRetentionMs ?? SEVEN_DAYS_MS;\n      const boundedReuseScanLimit = input.boundedReuseScanLimit ?? DEFAULT_BOUNDED_REUSE_SCAN_LIMIT;\n      const now = new Date();\n\n      /**\n       * One retention lane: a bulk delete through the infrastructure tier, recorded on failure\n       * rather than swallowed.\n       *\n       * The filter is ADAPTER-NEUTRAL by contract — `$lt`, `$exists`, `$in` and equality are in\n       * `SUPPORTED_FILTER_OPERATORS`, so each lane compiles on both arms. The door refuses an empty\n       * filter, which is what stops a lane whose predicate came out undefined from emptying the\n       * table.\n       */\n      const runDeleteLane = async (lane: string, filter: Record<string, unknown>): Promise<number> => {\n        try {\n          return await repositoriesRegistry.deleteManyForInfrastructure(\n            BackendResourceType.CONSUMABLE_TOKENS as never,\n            filter,\n            executionContext,\n          );\n        } catch (error) {\n          failedRetentionLanes.push(lane);\n          logger.warn(`Failed to delete ${lane} tokens`, {\n            ...projectCaughtErrorLogFields(error),\n          });\n          return 0;\n        }\n      };\n\n      // NOTE: Steps 1-3 may overlap (e.g., a consumed token that is also expired gets\n      // deleted in step 1 so step 2 won't find it). This is intentional — each step is\n      // defense-in-depth. The deletedCount accurately reflects what each step actually deleted.\n\n      // 1. Delete expired tokens (expiresAt < now)\n      const expiredDeleted = await runDeleteLane('expired', { expiresAt: { $lt: now } });\n\n      // 2. Delete fully consumed tokens (isConsumed = true)\n      const consumedDeleted = await runDeleteLane('consumed', { isConsumed: true });\n\n      /**\n       * 3. Delete exhausted BOUNDED_REUSE tokens where `usesCount >= maxUses`.\n       *\n       * Defense-in-depth for the window in which `isConsumed` has not yet been settled:\n       * `ConsumableTokenBackendService.consumeToken` derives that flag from the POST-increment row\n       * and writes it best-effort, naming this lane as the bound on a failure — so lane 2 above can\n       * legitimately miss an exhausted token and this one must find it.\n       *\n       * **Why this lane READS instead of filtering.** The comparison is column-to-column, which\n       * MongoDB expresses as `$expr: { $gte: ['$usesCount', '$maxUses'] }` — an operator in\n       * `MONGODB_ONLY_OPERATORS`, so it throws on PostgreSQL. It could not simply be translated\n       * either: `maxUses` is a BOUNDED_REUSE *variant* field, which PostgreSQL stores inside the\n       * `variantConfig` jsonb rather than as a column, and `usesCount` is a base column. So the row\n       * is fetched (where `transformPersistenceRow` has already re-hydrated the variant field to the\n       * top level, identically to MongoDB) and the comparison is done here. Exactly the trade\n       * `consumeToken` records for the same pair of fields: keep the authoritative behaviour, pay a\n       * round trip, refuse to pin the framework to one adapter for a convenience operator.\n       *\n       * The candidate set is deliberately narrowed to what is still live and unflagged — lanes 1 and\n       * 2 have already removed the expired and the flagged — so this is normally a handful of rows.\n       * {@link DEFAULT_BOUNDED_REUSE_SCAN_LIMIT} bounds what the lane will PROCESS and says so out\n       * loud when it bites; the read itself is unbounded, which is honest rather than ideal — the\n       * infrastructure tier has no paginated raw read, and adding one for a lane that should return\n       * near-zero rows would be building for a shape we do not have.\n       */\n      let exhaustedBoundedDeleted = 0;\n      try {\n        const boundedReuseCandidates = await repositoriesRegistry.findManyForInfrastructure<ConsumableToken>(\n          BackendResourceType.CONSUMABLE_TOKENS as never,\n          { consumptionMode: ConsumableToken_ConsumptionMode.BOUNDED_REUSE, isConsumed: false },\n          executionContext,\n        );\n\n        if (boundedReuseCandidates.length > boundedReuseScanLimit) {\n          logger.warn(\n            'Exhausted-BOUNDED_REUSE lane found more live candidates than expected — processing the '\n            + 'scan limit only, and the excess stays until the next run',\n            { candidates: boundedReuseCandidates.length, boundedReuseScanLimit },\n          );\n        }\n\n        /**\n         * `String(token._id)`, NOT a `typeof … === 'string'` filter.\n         *\n         * The MongoDB arm returns rows through `document.toObject()`, which leaves `_id` as an\n         * ObjectId INSTANCE; the PostgreSQL arm returns a text column. A string-typed guard would\n         * therefore drop every candidate on MongoDB and delete nothing — the same \"works on one\n         * adapter\" defect this whole change exists to remove, reintroduced one layer down. Coercing\n         * is safe in the other direction too: mongoose casts a hex string back to an ObjectId when\n         * the `_id` path is one, and leaves it alone when the path is a String. Same idiom as the\n         * retention sweep's `String(row._id ?? '')`.\n         */\n        const exhaustedIds = boundedReuseCandidates\n          .slice(0, boundedReuseScanLimit)\n          .filter((token) => typeof token.maxUses === 'number' && (token.usesCount ?? 0) >= token.maxUses)\n          .map((token) => String(token._id ?? ''))\n          .filter((id) => id.length > 0);\n\n        // The door refuses an empty filter, and `{ _id: { $in: [] } }` is a filter that matches\n        // nothing on one adapter and is a needless statement on the other. Ask nothing when there is\n        // nothing to ask.\n        if (exhaustedIds.length > 0) {\n          exhaustedBoundedDeleted = await runDeleteLane('exhaustedBoundedReuse', { _id: { $in: exhaustedIds } });\n        }\n      } catch (error) {\n        failedRetentionLanes.push('exhaustedBoundedReuse');\n        logger.warn('Failed to delete exhausted BOUNDED_REUSE tokens', {\n          ...projectCaughtErrorLogFields(error),\n        });\n      }\n\n      // 4. Delete revoked tokens older than retention period\n      const revokedCutoff = new Date(now.getTime() - revokedRetentionMs);\n      const revokedDeleted = await runDeleteLane('revoked', {\n        revokedAt: { $lt: revokedCutoff, $exists: true },\n      });\n\n      const durationMs = Date.now() - startTime;\n      const totalDeleted = expiredDeleted + consumedDeleted + exhaustedBoundedDeleted + revokedDeleted;\n\n      if (failedRetentionLanes.length > 0) {\n        // Report what DID get reclaimed before failing — the partial progress is real and\n        // an operator diagnosing the failure needs it. Logged at error level (not warn)\n        // because the batch outcome is a failure, and the per-lane warns above carry only\n        // the cause, never the consequence.\n        logger.error('Consumable tokens cleanup completed PARTIALLY — failing the batch', {\n          failedRetentionLanes,\n          expiredDeleted,\n          consumedDeleted,\n          exhaustedBoundedDeleted,\n          revokedDeleted,\n          totalDeleted,\n          durationMs,\n        });\n        throw new Error(\n          `Consumable tokens cleanup failed for retention lane(s): ${failedRetentionLanes.join(', ')}`,\n        );\n      }\n\n      logger.info('Consumable tokens cleanup batch completed', {\n        expiredDeleted,\n        consumedDeleted,\n        exhaustedBoundedDeleted,\n        revokedDeleted,\n        totalDeleted,\n        durationMs,\n      });\n\n      return {\n        expiredDeleted,\n        consumedDeleted,\n        exhaustedBoundedDeleted,\n        revokedDeleted,\n        totalDeleted,\n        durationMs,\n      };\n    },\n  });\n}\n\n// Batch reference identifier lives in the declarative manifest registry\n// (`engine-custom-batch-manifests`); import `CONSUMABLE_TOKENS_CLEANUP_BATCH_REF`\n// from there to keep a single source of truth across runtime wiring, queue\n// dispatch, and specification cross-validation.\n"]}

package/dist/esm/security/consumable-tokens/consumable-token-models.exports.d.ts

@@ -0,0 +1,22 @@
+/**
+ * `@wildo-ai/saas-backend-lib/consumable-token-models` — the consumable-token MODEL surface for
+ * consumers that must not drag the full backend lib into their module graph.
+ *
+ * The third of its shape, and the argument is the same one `data-seeding-models` and
+ * `external-data-models` already make: `consumableTokens` is a `BackendResourceType`, so the
+ * specifications package authoring its resource specification needs the schema, the factory and the
+ * consumption-mode vocabulary — and reaching them through the package ROOT would pull the entire
+ * backend library (services, inversify, external connectors) into a package whose whole job is to
+ * describe contracts.
+ *
+ * The closure here is deliberately small: zod, `@wildo-ai/zod-decorators`, `@wildo-ai/saas-models`,
+ * and these two modules. Nothing service-tier.
+ *
+ * Note the schema module is ALSO re-exported from the package root (`index.ts`), for the backend's
+ * own service-tier consumers. That is not an overlap of doors onto the same room in the sense the
+ * entrypoint rule forbids — it is the same module reachable from a heavy surface and a light one,
+ * which is precisely the distinction these `*-models` entrypoints exist to draw.
+ */
+export * from './models/consumable-tokens.shared.schemas';
+export * from './models/consumable-tokens.backend.resources-config.schemas';
+//# sourceMappingURL=consumable-token-models.exports.d.ts.map

package/dist/esm/security/consumable-tokens/consumable-token-models.exports.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consumable-token-models.exports.d.ts","sourceRoot":"","sources":["../../../../../src/security/consumable-tokens/consumable-token-models.exports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,cAAc,2CAA2C,CAAC;AAC1D,cAAc,6DAA6D,CAAC"}

package/dist/esm/security/consumable-tokens/consumable-token-models.exports.js

@@ -0,0 +1,22 @@
+/**
+ * `@wildo-ai/saas-backend-lib/consumable-token-models` — the consumable-token MODEL surface for
+ * consumers that must not drag the full backend lib into their module graph.
+ *
+ * The third of its shape, and the argument is the same one `data-seeding-models` and
+ * `external-data-models` already make: `consumableTokens` is a `BackendResourceType`, so the
+ * specifications package authoring its resource specification needs the schema, the factory and the
+ * consumption-mode vocabulary — and reaching them through the package ROOT would pull the entire
+ * backend library (services, inversify, external connectors) into a package whose whole job is to
+ * describe contracts.
+ *
+ * The closure here is deliberately small: zod, `@wildo-ai/zod-decorators`, `@wildo-ai/saas-models`,
+ * and these two modules. Nothing service-tier.
+ *
+ * Note the schema module is ALSO re-exported from the package root (`index.ts`), for the backend's
+ * own service-tier consumers. That is not an overlap of doors onto the same room in the sense the
+ * entrypoint rule forbids — it is the same module reachable from a heavy surface and a light one,
+ * which is precisely the distinction these `*-models` entrypoints exist to draw.
+ */
+export * from './models/consumable-tokens.shared.schemas.js';
+export * from './models/consumable-tokens.backend.resources-config.schemas.js';
+//# sourceMappingURL=consumable-token-models.exports.js.map

package/dist/esm/security/consumable-tokens/consumable-token-models.exports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consumable-token-models.exports.js","sourceRoot":"","sources":["../../../../../src/security/consumable-tokens/consumable-token-models.exports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,cAAc,2CAA2C,CAAC;AAC1D,cAAc,6DAA6D,CAAC","sourcesContent":["/**\n * `@wildo-ai/saas-backend-lib/consumable-token-models` — the consumable-token MODEL surface for\n * consumers that must not drag the full backend lib into their module graph.\n *\n * The third of its shape, and the argument is the same one `data-seeding-models` and\n * `external-data-models` already make: `consumableTokens` is a `BackendResourceType`, so the\n * specifications package authoring its resource specification needs the schema, the factory and the\n * consumption-mode vocabulary — and reaching them through the package ROOT would pull the entire\n * backend library (services, inversify, external connectors) into a package whose whole job is to\n * describe contracts.\n *\n * The closure here is deliberately small: zod, `@wildo-ai/zod-decorators`, `@wildo-ai/saas-models`,\n * and these two modules. Nothing service-tier.\n *\n * Note the schema module is ALSO re-exported from the package root (`index.ts`), for the backend's\n * own service-tier consumers. That is not an overlap of doors onto the same room in the sense the\n * entrypoint rule forbids — it is the same module reachable from a heavy surface and a light one,\n * which is precisely the distinction these `*-models` entrypoints exist to draw.\n */\nexport * from './models/consumable-tokens.shared.schemas';\nexport * from './models/consumable-tokens.backend.resources-config.schemas';\n"]}

package/dist/esm/security/consumable-tokens/models/consumable-tokens.backend.resources-config.schemas.d.ts

@@ -1,4 +1,18 @@
-import { ResourceRelationship } from '@wildo-ai/saas-models';
-import { createResourceConfiguration_Initialization } from '@wildo-ai/saas-models';
-export declare const consumableTokens_ResourceConfiguration_InitializationFactory: (resourcesRelationships: ResourceRelationship[]) => ReturnType<typeof createResourceConfiguration_Initialization>;
+import { CoreResourceOperation, ResourceConfiguration, ResourceRelationship } from '@wildo-ai/saas-models';
+import { ConsumableTokenSchemaBase } from './consumable-tokens.shared.schemas';
+type ConsumableTokens_CoreOperations = CoreResourceOperation.READ | CoreResourceOperation.LIST | CoreResourceOperation.CREATE | CoreResourceOperation.DELETE;
+/**
+ * The return type is stated PRECISELY, not as `ReturnType<typeof createResourceConfiguration_Initialization>`.
+ *
+ * That erased form was what this declared until 2026-08-31, and it discards the resource's identity at
+ * its own public surface: `createResourceConfiguration_Initialization` is generic, so `ReturnType<>`
+ * of the unapplied function resolves its parameters to their constraints and the schema is gone. The
+ * consequence is invisible here and fatal one package away — `resourceSpecification(factory, schema,
+ * …)` infers `TSchema` from BOTH arguments, so the erased factory dragged the inference down to
+ * `ZodType<unknown>` and every `schemaShape.<field>.stringSpec(...)` in the specification failed to
+ * resolve. Its two sibling backend resources (`dataSeedRuns`, `etlPipelineStates`) both declare the
+ * precise form, which is why they were specifiable and this one was not.
+ */
+export declare const consumableTokens_ResourceConfiguration_InitializationFactory: (resourcesRelationships: ResourceRelationship[]) => ResourceConfiguration<undefined, ConsumableTokens_CoreOperations, typeof ConsumableTokenSchemaBase>;
+export {};
 //# sourceMappingURL=consumable-tokens.backend.resources-config.schemas.d.ts.map

package/dist/esm/security/consumable-tokens/models/consumable-tokens.backend.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"consumable-tokens.backend.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/security/consumable-tokens/models/consumable-tokens.backend.resources-config.schemas.ts"],"names":[],"mappings":"AAEA,OAAO,EAAyB,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAEpF,OAAO,EAAE,0CAA0C,EAAE,MAAM,uBAAuB,CAAC;AAYnF,eAAO,MAAM,4DAA4D,GAAI,wBAAwB,oBAAoB,EAAE,KAAG,UAAU,CAAC,OAAO,0CAA0C,CA0EzL,CAAC"}
+{"version":3,"file":"consumable-tokens.backend.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/security/consumable-tokens/models/consumable-tokens.backend.resources-config.schemas.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAM3G,OAAO,EAAyB,yBAAyB,EAAoC,MAAM,oCAAoC,CAAC;AAExI,KAAK,+BAA+B,GAChC,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,CAAC;AAEjC;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,4DAA4D,GACvE,wBAAwB,oBAAoB,EAAE,KAC7C,qBAAqB,CAAC,SAAS,EAAE,+BAA+B,EAAE,OAAO,yBAAyB,CA0EpG,CAAC"}

package/dist/esm/security/consumable-tokens/models/consumable-tokens.backend.resources-config.schemas.js

@@ -4,6 +4,18 @@ import { createResourceConfiguration_Initialization } from '@wildo-ai/saas-model
 import { CORE_ORG_ROLES } from '@wildo-ai/saas-models';
 import { BackendResourceType, BackendResourceFieldIdentifier } from '../../../resources/models/resources-types.backend.schemas.js';
 import { ConsumableTokenSchemaBase, ConsumableTokenSchemaInheritance } from './consumable-tokens.shared.schemas.js';
+/**
+ * The return type is stated PRECISELY, not as `ReturnType<typeof createResourceConfiguration_Initialization>`.
+ *
+ * That erased form was what this declared until 2026-08-31, and it discards the resource's identity at
+ * its own public surface: `createResourceConfiguration_Initialization` is generic, so `ReturnType<>`
+ * of the unapplied function resolves its parameters to their constraints and the schema is gone. The
+ * consequence is invisible here and fatal one package away — `resourceSpecification(factory, schema,
+ * …)` infers `TSchema` from BOTH arguments, so the erased factory dragged the inference down to
+ * `ZodType<unknown>` and every `schemaShape.<field>.stringSpec(...)` in the specification failed to
+ * resolve. Its two sibling backend resources (`dataSeedRuns`, `etlPipelineStates`) both declare the
+ * precise form, which is why they were specifiable and this one was not.
+ */
 export const consumableTokens_ResourceConfiguration_InitializationFactory = (resourcesRelationships) => {
     return createResourceConfiguration_Initialization({
         mainSchema: ConsumableTokenSchemaBase,

package/dist/esm/security/consumable-tokens/models/consumable-tokens.backend.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"consumable-tokens.backend.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../../src/security/consumable-tokens/models/consumable-tokens.backend.resources-config.schemas.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,qBAAqB,EAAwB,MAAM,uBAAuB,CAAC;AACpF,OAAO,EAAE,4BAA4B,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AACjG,OAAO,EAAE,0CAA0C,EAAE,MAAM,uBAAuB,CAAC;AACnF,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,8BAA8B,EAAE,MAAM,qEAAqE,CAAC;AAE1I,OAAO,EAAyB,yBAAyB,EAAE,gCAAgC,EAAE,MAAM,oCAAoC,CAAC;AAQxI,MAAM,CAAC,MAAM,4DAA4D,GAAG,CAAC,sBAA8C,EAAiE,EAAE;IAE5L,OAAO,0CAA0C,CAI/C;QACA,UAAU,EAAE,yBAAyB;QACrC,2BAA2B,EAAE,gCAAgC;QAC7D,kBAAkB,EAAE,mBAAmB,CAAC,iBAAiB;QACzD,uBAAuB,EAAE,8BAA8B,CAAC,mBAAmB,CAAC,iBAAiB,CAAC;QAC9F,qBAAqB,EAAE,sBAAsB;QAC7C,gBAAgB,EAAE,IAAI,EAAE,mCAAmC;QAE3D,cAAc,EAAE;YACd,qBAAqB,CAAC,IAAI;YAC1B,qBAAqB,CAAC,IAAI;YAC1B,qBAAqB,CAAC,MAAM;YAC5B,qBAAqB,CAAC,MAAM;SAC7B;QAED,uBAAuB,EAAE;YACvB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;gBAC9B,QAAQ,EAAE;oBACR;wBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;wBACvD,SAAS,EAAE,IAAI;wBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,+BAA+B;wBAClE,SAAS,EAAE,0BAA0B,CAAC,MAAM;wBAC5C,UAAU,EAAE,yBAAyB,CAAC,IAAI,CAAC;4BACzC,GAAG,EAAE,IAAI;4BACT,SAAS,EAAE,IAAI;4BACf,SAAS,EAAE,IAAI;4BACf,UAAU,EAAE,IAAI,EAAE,oBAAoB;4BACtC,SAAS,EAAE,IAAI,EAAE,gBAAgB;yBAClC,CAAC;qBACH;iBACF;aACF;YAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;gBAC5B,QAAQ,EAAE;oBACR;wBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;wBACvD,SAAS,EAAE,IAAI;wBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;qBAC1C;iBACF;aACF;YAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;gBAC5B,QAAQ,EAAE;oBACR;wBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;wBACvD,SAAS,EAAE,IAAI;wBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;qBAC1C;iBACF;aACF;YAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;gBAC9B,QAAQ,EAAE;oBACR;wBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;wBACvD,SAAS,EAAE,IAAI;wBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;qBAC1C;iBACF;aACF;SACF;KACF,CAAC,CAAC;AACL,CAAC,CAAC","sourcesContent":["import { z } from 'zod';\n\nimport { CoreResourceOperation, ResourceRelationship } from '@wildo-ai/saas-models';\nimport { ResourceOperationVariantType, ResourceOperationRiskLevel } from '@wildo-ai/saas-models';\nimport { createResourceConfiguration_Initialization } from '@wildo-ai/saas-models';\nimport { CORE_ORG_ROLES } from '@wildo-ai/saas-models';\nimport { BackendResourceType, BackendResourceFieldIdentifier } from '~wildo-backend-lib/resources/models/resources-types.backend.schemas';\n\nimport { ConsumableTokenSchema, ConsumableTokenSchemaBase, ConsumableTokenSchemaInheritance } from './consumable-tokens.shared.schemas';\n\ntype ConsumableTokens_CoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.DELETE;\n\nexport const consumableTokens_ResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]): ReturnType<typeof createResourceConfiguration_Initialization> => {\n\n  return createResourceConfiguration_Initialization<\n    undefined,\n    ConsumableTokens_CoreOperations,\n    typeof ConsumableTokenSchemaBase\n  >({\n    mainSchema: ConsumableTokenSchemaBase,\n    inheritenceSchemaDefinition: ConsumableTokenSchemaInheritance,\n    resourceIdentifier: BackendResourceType.CONSUMABLE_TOKENS,\n    resourceFieldIdentifier: BackendResourceFieldIdentifier[BackendResourceType.CONSUMABLE_TOKENS],\n    resourceRelationships: resourcesRelationships,\n    isSystemResource: true, // Backend infrastructure component\n\n    coreOperations: [\n      CoreResourceOperation.READ,\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.CREATE,\n      CoreResourceOperation.DELETE,\n    ],\n\n    operationsConfiguration: {\n      [CoreResourceOperation.CREATE]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.INTERNAL_CALL,\n            isDefault: true,\n            roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only admin can create tokens\n            riskLevel: ResourceOperationRiskLevel.MEDIUM,\n            requestDto: ConsumableTokenSchemaBase.omit({\n              _id: true,\n              createdAt: true,\n              updatedAt: true,\n              isConsumed: true, // Auto-set to false\n              usesCount: true, // Auto-set to 0\n            }),\n          }\n        ],\n      },\n\n      [CoreResourceOperation.READ]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.INTERNAL_CALL,\n            isDefault: true,\n            roles: [CORE_ORG_ROLES.ORG_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n          }\n        ]\n      },\n\n      [CoreResourceOperation.LIST]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.INTERNAL_CALL,\n            isDefault: true,\n            roles: [CORE_ORG_ROLES.ORG_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n          }\n        ]\n      },\n\n      [CoreResourceOperation.DELETE]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.INTERNAL_CALL,\n            isDefault: true,\n            roles: [CORE_ORG_ROLES.ORG_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n          }\n        ]\n      },\n    },\n  });\n};\n\n"]}
+{"version":3,"file":"consumable-tokens.backend.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../../src/security/consumable-tokens/models/consumable-tokens.backend.resources-config.schemas.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,qBAAqB,EAA+C,MAAM,uBAAuB,CAAC;AAC3G,OAAO,EAAE,4BAA4B,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AACjG,OAAO,EAAE,0CAA0C,EAAE,MAAM,uBAAuB,CAAC;AACnF,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,8BAA8B,EAAE,MAAM,qEAAqE,CAAC;AAE1I,OAAO,EAAyB,yBAAyB,EAAE,gCAAgC,EAAE,MAAM,oCAAoC,CAAC;AAQxI;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,4DAA4D,GAAG,CAC1E,sBAA8C,EACuD,EAAE;IAEvG,OAAO,0CAA0C,CAI/C;QACA,UAAU,EAAE,yBAAyB;QACrC,2BAA2B,EAAE,gCAAgC;QAC7D,kBAAkB,EAAE,mBAAmB,CAAC,iBAAiB;QACzD,uBAAuB,EAAE,8BAA8B,CAAC,mBAAmB,CAAC,iBAAiB,CAAC;QAC9F,qBAAqB,EAAE,sBAAsB;QAC7C,gBAAgB,EAAE,IAAI,EAAE,mCAAmC;QAE3D,cAAc,EAAE;YACd,qBAAqB,CAAC,IAAI;YAC1B,qBAAqB,CAAC,IAAI;YAC1B,qBAAqB,CAAC,MAAM;YAC5B,qBAAqB,CAAC,MAAM;SAC7B;QAED,uBAAuB,EAAE;YACvB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;gBAC9B,QAAQ,EAAE;oBACR;wBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;wBACvD,SAAS,EAAE,IAAI;wBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,+BAA+B;wBAClE,SAAS,EAAE,0BAA0B,CAAC,MAAM;wBAC5C,UAAU,EAAE,yBAAyB,CAAC,IAAI,CAAC;4BACzC,GAAG,EAAE,IAAI;4BACT,SAAS,EAAE,IAAI;4BACf,SAAS,EAAE,IAAI;4BACf,UAAU,EAAE,IAAI,EAAE,oBAAoB;4BACtC,SAAS,EAAE,IAAI,EAAE,gBAAgB;yBAClC,CAAC;qBACH;iBACF;aACF;YAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;gBAC5B,QAAQ,EAAE;oBACR;wBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;wBACvD,SAAS,EAAE,IAAI;wBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;qBAC1C;iBACF;aACF;YAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;gBAC5B,QAAQ,EAAE;oBACR;wBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;wBACvD,SAAS,EAAE,IAAI;wBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;qBAC1C;iBACF;aACF;YAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;gBAC9B,QAAQ,EAAE;oBACR;wBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;wBACvD,SAAS,EAAE,IAAI;wBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;qBAC1C;iBACF;aACF;SACF;KACF,CAAC,CAAC;AACL,CAAC,CAAC","sourcesContent":["import { z } from 'zod';\n\nimport { CoreResourceOperation, ResourceConfiguration, ResourceRelationship } from '@wildo-ai/saas-models';\nimport { ResourceOperationVariantType, ResourceOperationRiskLevel } from '@wildo-ai/saas-models';\nimport { createResourceConfiguration_Initialization } from '@wildo-ai/saas-models';\nimport { CORE_ORG_ROLES } from '@wildo-ai/saas-models';\nimport { BackendResourceType, BackendResourceFieldIdentifier } from '~wildo-backend-lib/resources/models/resources-types.backend.schemas';\n\nimport { ConsumableTokenSchema, ConsumableTokenSchemaBase, ConsumableTokenSchemaInheritance } from './consumable-tokens.shared.schemas';\n\ntype ConsumableTokens_CoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.DELETE;\n\n/**\n * The return type is stated PRECISELY, not as `ReturnType<typeof createResourceConfiguration_Initialization>`.\n *\n * That erased form was what this declared until 2026-08-31, and it discards the resource's identity at\n * its own public surface: `createResourceConfiguration_Initialization` is generic, so `ReturnType<>`\n * of the unapplied function resolves its parameters to their constraints and the schema is gone. The\n * consequence is invisible here and fatal one package away — `resourceSpecification(factory, schema,\n * …)` infers `TSchema` from BOTH arguments, so the erased factory dragged the inference down to\n * `ZodType<unknown>` and every `schemaShape.<field>.stringSpec(...)` in the specification failed to\n * resolve. Its two sibling backend resources (`dataSeedRuns`, `etlPipelineStates`) both declare the\n * precise form, which is why they were specifiable and this one was not.\n */\nexport const consumableTokens_ResourceConfiguration_InitializationFactory = (\n  resourcesRelationships: ResourceRelationship[],\n): ResourceConfiguration<undefined, ConsumableTokens_CoreOperations, typeof ConsumableTokenSchemaBase> => {\n\n  return createResourceConfiguration_Initialization<\n    undefined,\n    ConsumableTokens_CoreOperations,\n    typeof ConsumableTokenSchemaBase\n  >({\n    mainSchema: ConsumableTokenSchemaBase,\n    inheritenceSchemaDefinition: ConsumableTokenSchemaInheritance,\n    resourceIdentifier: BackendResourceType.CONSUMABLE_TOKENS,\n    resourceFieldIdentifier: BackendResourceFieldIdentifier[BackendResourceType.CONSUMABLE_TOKENS],\n    resourceRelationships: resourcesRelationships,\n    isSystemResource: true, // Backend infrastructure component\n\n    coreOperations: [\n      CoreResourceOperation.READ,\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.CREATE,\n      CoreResourceOperation.DELETE,\n    ],\n\n    operationsConfiguration: {\n      [CoreResourceOperation.CREATE]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.INTERNAL_CALL,\n            isDefault: true,\n            roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only admin can create tokens\n            riskLevel: ResourceOperationRiskLevel.MEDIUM,\n            requestDto: ConsumableTokenSchemaBase.omit({\n              _id: true,\n              createdAt: true,\n              updatedAt: true,\n              isConsumed: true, // Auto-set to false\n              usesCount: true, // Auto-set to 0\n            }),\n          }\n        ],\n      },\n\n      [CoreResourceOperation.READ]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.INTERNAL_CALL,\n            isDefault: true,\n            roles: [CORE_ORG_ROLES.ORG_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n          }\n        ]\n      },\n\n      [CoreResourceOperation.LIST]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.INTERNAL_CALL,\n            isDefault: true,\n            roles: [CORE_ORG_ROLES.ORG_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n          }\n        ]\n      },\n\n      [CoreResourceOperation.DELETE]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.INTERNAL_CALL,\n            isDefault: true,\n            roles: [CORE_ORG_ROLES.ORG_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n          }\n        ]\n      },\n    },\n  });\n};\n\n"]}

package/dist/esm/security/consumable-tokens/services/consumable-token.backend.service.d.ts

@@ -140,6 +140,14 @@ export declare class ConsumableTokenBackendService {
      * `tokenId` is guarded by the same non-string check as every other primitive here (`{ _id }` reaches
      * Mongo directly, so a `{$ne}`-shaped value would otherwise match an ARBITRARY token).
      */
+    /**
+     * Read a token row by its VALUE regardless of state — expired, consumed and revoked rows included.
+     *
+     * For status surfaces that must say WHY a token is unusable (`validateToken` refuses those rows, which
+     * is right for authentication and wrong for a status read). Callers hold the value already, so this
+     * discloses nothing they could not learn by presenting it. Never logs the value (R2).
+     */
+    findTokenByValue(tokenValue: string): Promise<ConsumableToken | null>;
     findTokenById(tokenId: string): Promise<ConsumableToken | null>;
     /**
      * Soft-revoke a token by setting revokedAt.
@@ -152,6 +160,18 @@ export declare class ConsumableTokenBackendService {
      * and never write a duplicate row under a race. Returns whether THIS call performed the revocation
      * (`false` = the token was already revoked, or does not exist).
      */
+    /**
+     * Record, on a redeemed FILE_UPLOAD_GRANT, the file its one upload produced (issue #312, D6/D10).
+     *
+     * Written AFTER the grant is consumed and the FILES row exists, so there is exactly one writer and
+     * a plain replace of `metadata` is safe. Best-effort by contract: the upload has already succeeded
+     * when this runs, so a failure here must not fail it — the caller logs and the status read falls
+     * back to "REDEEMED, file unknown; re-read the resource". Returns whether a row was written.
+     *
+     * Replaces the whole `metadata` object rather than a dotted path so the write is adapter-neutral:
+     * the PostgreSQL arm stores `metadata` as one JSON column.
+     */
+    recordFileUploadGrantProducedFile(tokenId: string, fileId: string): Promise<boolean>;
     revokeToken(tokenId: string): Promise<boolean>;
     /**
      * Revoke all tokens matching a relatedId and optionally a token type.
@@ -238,9 +258,27 @@ export declare class ConsumableTokenBackendService {
      */
     private getMongoSession;
     /**
-     * Match only the sparse active-generation index. `createToken` also writes
-     * other unique fields (notably the raw token), and collapsing their failures
-     * into a RESEND race would hide an unrelated persistence defect.
+     * Match only the sparse active-generation index. `createToken` also writes other unique fields
+     * (notably the raw token), and collapsing their failures into a RESEND race would hide an
+     * unrelated persistence defect.
+     *
+     * ## Branches on the CLASSIFIED conflict, never on driver internals
+     *
+     * This used to require a raw MongoDB error with `code: 11000` and a `keyPattern`, and could
+     * therefore never fire. `insertRawDocument` translates the duplicate before it escapes —
+     * `throw this.handleMongoDBError(error)` on the Mongo arm, `handlePostgresError` on the
+     * PostgreSQL one — so what reaches this catch is the classified CONFLICT, carrying no `code` and
+     * no `keyPattern`. The RESEND race surfaced as a generic CONFLICT and the specific
+     * `consumable_token_active_generation_conflict` reference was unreachable through the real stack.
+     *
+     * The infrastructure tier's own comment says why detecting on driver internals was the wrong
+     * shape in the first place: without the translation "every caller would need adapter-specific
+     * detection, which is precisely what this tier exists to remove". On PostgreSQL there is no
+     * `code: 11000` to match at ALL — a unique violation is SQLSTATE `23505` — so the old predicate
+     * was not merely unreachable, it was unwritable for the adapter both example applications now run.
+     *
+     * `violatedFields` is the adapter-neutral answer both arms populate: Mongo from `keyPattern`
+     * (falling back to the message), PostgreSQL from the constraint's columns.
      */
     private isActiveGenerationKeyDuplicate;
     /**

package/dist/esm/security/consumable-tokens/services/consumable-token.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"consumable-token.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/security/consumable-tokens/services/consumable-token.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAKH,OAAO,EACL,+BAA+B,EAK/B,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAE1B,KAAK,yBAAyB,EAC/B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAqB,KAAK,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAGjF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAE9G,OAAO,EAAE,cAAc,EAAE,MAAM,uDAAuD,CAAC;AACvF,OAAO,KAAK,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAIrK,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mEAAmE,CAAC;AAClH,OAAO,KAAK,EACV,eAAe,EAChB,MAAM,uFAAuF,CAAC;AAC/F,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,gEAAgE,CAAC;AAQxE,MAAM,WAAW,iBAAiB;IAChC,8GAA8G;IAC9G,SAAS,EAAE,oBAAoB,CAAC;IAChC,eAAe,EAAE,+BAA+B,CAAC;IACjD,SAAS,EAAE,aAAa,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iFAAiF;IACjF,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC/B,KAAK,CAAC,EAAE,yBAAyB,EAAE,CAAC;IACpC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,wFAAwF;IACxF,SAAS,CAAC,EAAE,UAAU,GAAG,kBAAkB,CAAC;IAC5C,2EAA2E;IAC3E,SAAS,CAAC,EAAE;QACV,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACvC,CAAC;IACF;;;OAGG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,MAAM,CAAC;CACtB;AAOD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,oCAAoC,QAAU,CAAC;AAE5D,qBACa,6BAA6B;IACxC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgB;IACvC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA6B;IAC1D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiB;IAChD,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAA2B;IAC9D,OAAO,CAAC,QAAQ,CAAC,4BAA4B,CAAC,CAA4C;gBAGrD,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EAC7C,cAAc,EAAE,cAAc,EAGR,iBAAiB,CAAC,EAAE,wBAAwB;IAC7G;;;;;;OAMG;IACwE,oBAAoB,CAAC,EAAE,yCAAyC;IAc7I;;;;;;OAMG;IACU,WAAW,CACtB,MAAM,EAAE,iBAAiB,EACzB,WAAW,CAAC,EAAE,kBAAkB,GAC/B,OAAO,CAAC,eAAe,GAAG;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IA+H/C;;;;;;;;OAQG;IACU,aAAa,CACxB,UAAU,EAAE,MAAM,EAClB,aAAa,CAAC,EAAE,oBAAoB,EAAE,GACrC,OAAO,CAAC,eAAe,CAAC;IA4E3B;;;;;;;;;;;OAWG;IACU,YAAY,CACvB,UAAU,EAAE,MAAM,EAClB,WAAW,CAAC,EAAE,kBAAkB,GAC/B,OAAO,CAAC,eAAe,CAAC;IA+J3B;;;;;;;;;;;OAWG;IACU,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAc5E;;;;;;;;;;OAUG;IACU,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAwB3D;;;;;OAKG;IACU,uBAAuB,CAClC,SAAS,EAAE,MAAM,EACjB,SAAS,CAAC,EAAE,oBAAoB,EAChC,WAAW,CAAC,EAAE,kBAAkB,GAC/B,OAAO,CAAC,MAAM,CAAC;IA4ClB;;;;;OAKG;IACU,qBAAqB,CAChC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,oBAAoB,GAC9B,OAAO,CAAC,eAAe,EAAE,CAAC;IAqB7B;;;;;OAKG;IACU,sBAAsB,CACjC,MAAM,EAAE,qBAAqB,EAC7B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACjC,gBAAgB,EAAE;QAChB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,EACD,WAAW,EAAE,kBAAkB,GAC9B,OAAO,CAAC,qBAAqB,CAAC;IA2EjC;;;;;OAKG;IACU,sBAAsB,CACjC,MAAM,EAAE,qBAAqB,EAC7B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACjC,iBAAiB,EAAE;QAAE,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,EAC9C,WAAW,CAAC,EAAE,kBAAkB,GAC/B,OAAO,CAAC,qBAAqB,CAAC;IA6CjC,OAAO,CAAC,wBAAwB;IAUhC,OAAO,CAAC,uBAAuB;IAO/B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,wBAAwB;IAQhC;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,OAAO,KAAK,oBAAoB,GAO/B;IAED;;;;;;;OAOG;IACH,OAAO,CAAC,eAAe;IAavB;;;;OAIG;IACH,OAAO,CAAC,8BAA8B;IA2BtC;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAK1B;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;CAM/B"}
+{"version":3,"file":"consumable-token.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/security/consumable-tokens/services/consumable-token.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAKH,OAAO,EACL,+BAA+B,EAQ/B,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAE1B,KAAK,yBAAyB,EAC/B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAqB,KAAK,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAGjF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAE9G,OAAO,EAAE,cAAc,EAAE,MAAM,uDAAuD,CAAC;AACvF,OAAO,KAAK,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAIrK,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mEAAmE,CAAC;AAClH,OAAO,KAAK,EACV,eAAe,EAChB,MAAM,uFAAuF,CAAC;AAC/F,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,gEAAgE,CAAC;AAQxE,MAAM,WAAW,iBAAiB;IAChC,8GAA8G;IAC9G,SAAS,EAAE,oBAAoB,CAAC;IAChC,eAAe,EAAE,+BAA+B,CAAC;IACjD,SAAS,EAAE,aAAa,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iFAAiF;IACjF,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC/B,KAAK,CAAC,EAAE,yBAAyB,EAAE,CAAC;IACpC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,wFAAwF;IACxF,SAAS,CAAC,EAAE,UAAU,GAAG,kBAAkB,CAAC;IAC5C,2EAA2E;IAC3E,SAAS,CAAC,EAAE;QACV,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACvC,CAAC;IACF;;;OAGG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,MAAM,CAAC;CACtB;AAOD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,oCAAoC,QAAU,CAAC;AAE5D,qBACa,6BAA6B;IACxC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgB;IACvC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA6B;IAC1D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiB;IAChD,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAA2B;IAC9D,OAAO,CAAC,QAAQ,CAAC,4BAA4B,CAAC,CAA4C;gBAGrD,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EAC7C,cAAc,EAAE,cAAc,EAGR,iBAAiB,CAAC,EAAE,wBAAwB;IAC7G;;;;;;OAMG;IACwE,oBAAoB,CAAC,EAAE,yCAAyC;IAc7I;;;;;;OAMG;IACU,WAAW,CACtB,MAAM,EAAE,iBAAiB,EACzB,WAAW,CAAC,EAAE,kBAAkB,GAC/B,OAAO,CAAC,eAAe,GAAG;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAoJ/C;;;;;;;;OAQG;IACU,aAAa,CACxB,UAAU,EAAE,MAAM,EAClB,aAAa,CAAC,EAAE,oBAAoB,EAAE,GACrC,OAAO,CAAC,eAAe,CAAC;IA4E3B;;;;;;;;;;;OAWG;IACU,YAAY,CACvB,UAAU,EAAE,MAAM,EAClB,WAAW,CAAC,EAAE,kBAAkB,GAC/B,OAAO,CAAC,eAAe,CAAC;IA+J3B;;;;;;;;;;;OAWG;IACH;;;;;;OAMG;IACU,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IASrE,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAc5E;;;;;;;;;;OAUG;IACH;;;;;;;;;;OAUG;IACU,iCAAiC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAcpF,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAwB3D;;;;;OAKG;IACU,uBAAuB,CAClC,SAAS,EAAE,MAAM,EACjB,SAAS,CAAC,EAAE,oBAAoB,EAChC,WAAW,CAAC,EAAE,kBAAkB,GAC/B,OAAO,CAAC,MAAM,CAAC;IA4ClB;;;;;OAKG;IACU,qBAAqB,CAChC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,oBAAoB,GAC9B,OAAO,CAAC,eAAe,EAAE,CAAC;IAqB7B;;;;;OAKG;IACU,sBAAsB,CACjC,MAAM,EAAE,qBAAqB,EAC7B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACjC,gBAAgB,EAAE;QAChB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,EACD,WAAW,EAAE,kBAAkB,GAC9B,OAAO,CAAC,qBAAqB,CAAC;IA2EjC;;;;;OAKG;IACU,sBAAsB,CACjC,MAAM,EAAE,qBAAqB,EAC7B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACjC,iBAAiB,EAAE;QAAE,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,EAC9C,WAAW,CAAC,EAAE,kBAAkB,GAC/B,OAAO,CAAC,qBAAqB,CAAC;IA6CjC,OAAO,CAAC,wBAAwB;IAUhC,OAAO,CAAC,uBAAuB;IAO/B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,wBAAwB;IAQhC;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,OAAO,KAAK,oBAAoB,GAO/B;IAED;;;;;;;OAOG;IACH,OAAO,CAAC,eAAe;IAavB;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,OAAO,CAAC,8BAA8B;IAQtC;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAK1B;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;CAM/B"}