@wildo-ai/saas-backend-lib 1.1.1 → 1.1.3

package/dist/esm/base-classes/services/batches/credential-expiry-sweep.batch.backend.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-expiry-sweep.batch.backend.service.js","sourceRoot":"","sources":["../../../../../../src/base-classes/services/batches/credential-expiry-sweep.batch.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,YAAY,EACZ,qBAAqB,EACrB,0BAA0B,EAC1B,cAAc,EACd,qBAAqB,EACrB,gBAAgB,EAChB,iBAAiB,EACjB,qBAAqB,EACrB,0BAA0B,EAC1B,yBAAyB,EACzB,+BAA+B,EAC/B,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iCAAiC,EAAE,MAAM,4FAA4F,CAAC;AAC/I,OAAO,EAAE,6CAA6C,EAAE,MAAM,gFAAgF,CAAC;AAC/I,OAAO,EAAE,mBAAmB,EAAE,MAAM,8EAA8E,CAAC;AAEnH,4FAA4F;AAC5F,MAAM,cAAc,GAAG,IAAI,CAAC;AAE5B,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,2DAA2D;IAC3D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC9C,CAAC,CAAC;AAEH,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACpC,CAAC,CAAC;AAoBH,MAAM,+BAA+B,GAA2C,MAAM,CAAC,MAAM,CAAC;IAC5F;QACE,YAAY,EAAE,gBAAgB,CAAC,oBAAoB;QACnD,YAAY,EAAE,YAAY,CAAC,MAAM;QACjC,eAAe,EAAE,qBAAqB,CAAC,MAAM;QAC7C,OAAO,EAAE,oBAAoB;KAC9B;IACD;QACE,YAAY,EAAE,gBAAgB,CAAC,YAAY;QAC3C,YAAY,EAAE,YAAY,CAAC,MAAM;QACjC,eAAe,EAAE,qBAAqB,CAAC,MAAM;QAC7C,OAAO,EAAE,oBAAoB;KAC9B;IACD;QACE,YAAY,EAAE,gBAAgB,CAAC,yBAAyB;QACxD,YAAY,EAAE,iBAAiB,CAAC,MAAM;QACtC,eAAe,EAAE,0BAA0B,CAAC,MAAM;QAClD,OAAO,EAAE,oBAAoB;KAC9B;IACD;QACE,YAAY,EAAE,gBAAgB,CAAC,0BAA0B;QACzD,YAAY,EAAE,iBAAiB,CAAC,MAAM;QACtC,eAAe,EAAE,0BAA0B,CAAC,MAAM;QAClD,OAAO,EAAE,oBAAoB;KAC9B;IACD;QACE,YAAY,EAAE,gBAAgB,CAAC,sBAAsB;QACrD,YAAY,EAAE,yBAAyB,CAAC,MAAM;QAC9C,eAAe,EAAE,+BAA+B,CAAC,MAAM;QACvD,OAAO,EAAE,eAAe;KACzB;CACF,CAAC,CAAC;AAEH,MAAM,UAAU,gCAAgC;IAC9C,OAAO,iCAAiC,CAAC;QACvC,KAAK,EAAE,gCAAgC;QACvC,MAAM,EAAE,iCAAiC;QACzC,oBAAoB,EAAE;YACpB,IAAI,EAAE,6CAA6C,CAAC,IAAI;YACxD,kBAAkB,EAAE,6CAA6C,CAAC,kBAAkB;YACpF,mBAAmB,EAAE,6CAA6C,CAAC,mBAAmB;YACtF,iBAAiB,EAAE,6CAA6C,CAAC,cAAc;SAChF;QACD,QAAQ,EAAE,KAAK,EACb,KAAK,EACL,EAAE,MAAM,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,EACxE,EAAE;YACF,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC7B,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,GAAG,CAAC;YACzC,4FAA4F;YAC5F,8FAA8F;YAC9F,2FAA2F;YAC3F,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;YAE7B,MAAM,eAAe,GAAG,CAAC;oBACvB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,mBAAmB,EAAE,oBAAoB,CAAC,WAAW;iBACtD,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,KAAK,EAAE,YAA8B,EAAE,SAAyC,EAAE,EAAE,CAC/F,uBAAuB,CAAC,0BAA0B,CAAC;gBACjD,SAAS,EAAE,iBAAiB,CAAC,8BAA8B,CAAC,YAAY,EAAE,SAAS,CAAC;gBACpF,+BAA+B,EAAE,IAAI,GAAG,EAAE;gBAC1C,YAAY,EAAE,IAAI;gBAClB,cAAc,EAAE,eAAe;aAChC,CAAC,CAAC;YAEL,MAAM,QAAQ,GAAG,EAAE,kBAAkB,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC;YAC7D,IAAI,MAAM,GAAG,CAAC,CAAC;YAEf,KAAK,MAAM,MAAM,IAAI,+BAA+B,EAAE,CAAC;gBACrD,4FAA4F;gBAC5F,2FAA2F;gBAC3F,+EAA+E;gBAC/E,IAAI,SAAS,GAAG,CAAC,CAAC;gBAClB,IAAI,OAAO,GAAG,IAAI,CAAC;gBACnB,IAAI,mBAAmB,GAAG,CAAC,CAAC;gBAE5B,OAAO,OAAO,IAAI,SAAS,GAAG,cAAc,EAAE,CAAC;oBAC7C,SAAS,EAAE,CAAC;oBACZ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC;oBAC3E,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAC5C,MAAM,CAAC,YAAY,EACnB,MAAM,EACN;wBACE,MAAM,EAAE,MAAM,CAAC,YAAY;wBAC3B,qFAAqF;wBACrF,iFAAiF;wBACjF,SAAS,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE;qBACzC,EACD,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAC9B,CAAC;oBACF,8DAA8D;oBAC9D,MAAM,IAAI,GAAU,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;oBAC7E,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;wBAAC,OAAO,GAAG,KAAK,CAAC;wBAAC,MAAM;oBAAC,CAAC;oBAElD,IAAI,eAAe,GAAG,CAAC,CAAC;oBACxB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;wBACvB,IAAI,CAAC;4BACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;4BACzE,MAAM,gBAAgB,CAAC,sBAAsB,CAC3C,MAAM,CAAC,YAAY,EACnB,MAAM,CAAC,eAAe,EACtB,QAAQ,EACR,GAAG,CAAC,GAAG,EACP,EAAE,CACH,CAAC;4BACF,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;4BAC3B,eAAe,EAAE,CAAC;wBACpB,CAAC;wBAAC,OAAO,KAAK,EAAE,CAAC;4BACf,MAAM,EAAE,CAAC;4BACT,MAAM,CAAC,IAAI,CAAC,kEAAkE,EAAE;gCAC9E,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;gCACzC,KAAK,EAAE,GAAG,EAAE,GAAG;gCACf,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC;gCACzC,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;6BAClC,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC;oBAED,0FAA0F;oBAC1F,2FAA2F;oBAC3F,2DAA2D;oBAC3D,IAAI,eAAe,KAAK,CAAC,EAAE,CAAC;wBAC1B,mBAAmB,EAAE,CAAC;wBACtB,IAAI,mBAAmB,IAAI,CAAC,EAAE,CAAC;4BAC7B,MAAM,CAAC,KAAK,CAAC,2EAA2E,EAAE;gCACxF,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;gCACzC,WAAW,EAAE,IAAI,CAAC,MAAM;6BACzB,CAAC,CAAC;4BACH,OAAO,GAAG,KAAK,CAAC;wBAClB,CAAC;oBACH,CAAC;yBAAM,CAAC;wBACN,mBAAmB,GAAG,CAAC,CAAC;oBAC1B,CAAC;gBACH,CAAC;gBAED,IAAI,SAAS,IAAI,cAAc,EAAE,CAAC;oBAChC,MAAM,CAAC,KAAK,CAAC,kGAAkG,EAAE;wBAC/G,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;wBACzC,aAAa,EAAE,cAAc;qBAC9B,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,OAAO;gBACL,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;gBAC/C,aAAa,EAAE,QAAQ,CAAC,aAAa;gBACrC,MAAM;gBACN,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * Credential Expiry Sweep — relabels machine credentials and platform access grants whose window\n * has elapsed.\n *\n * ## What this batch is for, and what it is NOT\n *\n * It is NOT a control, and reading it as one is the mistake to avoid. Access is already refused\n * correctly without it: `isCredentialExpired` gates every machine front at auth time, and a grant's\n * admission predicate compares `expiresAt` against now. An elapsed credential stops working whether\n * or not this batch has ever run.\n *\n * What it fixes is the RECORD. Until 2026-09-08 nothing anywhere wrote `EXPIRED` on any of these\n * three populations — no producer, no store TTL, no sweep — so a listing of API keys, OAuth clients\n * or access grants showed elapsed ones as ACTIVE forever, and an operator reading it could not tell\n * which credentials still worked (#413). Two places in the tree said so independently:\n * `credential-rotation-grace.backend.utils.ts` in its own docstring, and a comment beside the OIDC\n * authorization-code guard.\n *\n * **`expiresAt` remains the control, and the label must never become one.** If a guard ever starts\n * reading `status` instead, a sweep that lags — and it always lags, see below — turns a stale\n * display into an authorization hole. The pin for that lives beside the auth-time guard, not here.\n *\n * ## Why a sweep rather than a store-level TTL\n *\n * A Mongo TTL index DELETES a row; it cannot transition a status, and PostgreSQL has no native TTL\n * at all. Deletion is the wrong outcome for a record a customer inspects — the history of an\n * operator's access to their tenant is exactly the thing worth keeping — so a TTL is only the right\n * mechanism where disappearance is the intent, which this is not.\n *\n * ## The lag is inherent, and is the accepted cost of the option chosen\n *\n * Between the instant a credential elapses and the next run, the row still reads ACTIVE. Daily at\n * 02:30. Hourly was rejected: unlike the suspension sweep beside it — where a caller expresses DAYS\n * and a daily run overshoots a one-day suspension by 100% — nothing here waits on the label, because\n * the access already stopped. The extra 23 passes would buy a shorter display lag and nothing else.\n *\n * ## Every transition goes through the resource's own verb\n *\n * Never a direct `status` write. Each `expire` verb carries an ACTIVE-only precondition, and that\n * guard is the reason the verbs exist: an INACTIVE api-key was retired by an administrator and a\n * DENIED grant was refused by a tenant, so relabelling either EXPIRED would erase who ended it. A\n * direct write would be a second authority over the field and would skip the check — the same\n * reasoning the suspension sweep and the invitation sweep both apply.\n *\n * assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — a credential whose validity window has\n * elapsed is recorded as expired, so an access review reads the same state the runtime enforces.\n */\n\nimport { z } from 'zod';\nimport {\n  ApiKeyStatus,\n  AppApiKeys_Operations,\n  AppOAuthClients_Operations,\n  CORE_APP_ROLES,\n  CoreResourceOperation,\n  CoreResourceType,\n  OAuthClientStatus,\n  OrgApiKeys_Operations,\n  OrgOAuthClients_Operations,\n  PlatformAccessGrantStatus,\n  PlatformAccessGrants_Operations,\n  ResourcePrimaryScope,\n} from '@wildo-ai/saas-models';\nimport { createCustomBatchExecutionService } from '~wildo-backend-lib/base-classes/services/batches/batches-cronjobs-custom-execution.service';\nimport { ENGINE_CREDENTIAL_EXPIRY_SWEEP_BATCH_MANIFEST } from '~wildo-backend-lib/base-classes/services/batches/engine-custom-batch-manifests';\nimport { describeCaughtError } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\n\n/** Backstop against an unbounded loop if expiries silently fail to shrink the match set. */\nconst MAX_ITERATIONS = 1000;\n\nconst CredentialExpirySweepInputSchema = z.object({\n  /** Override: page size for the scan loops. Default: 100 */\n  batchSize: z.number().int().min(1).optional(),\n});\n\nconst CredentialExpirySweepOutputSchema = z.object({\n  credentialsExpired: z.number().int().min(0),\n  grantsExpired: z.number().int().min(0),\n  errors: z.number().int().min(0),\n  durationMs: z.number().int().min(0),\n});\n\n/**\n * One sweepable population: which rows are due, and which verb relabels them.\n *\n * Declared as data for the same reason the suspension sweep declares its targets that way — the\n * population here is FIVE resources, not the \"credentials and grants\" it is tempting to say, and a\n * hand-rolled loop per resource is how the sixth one comes to page, log or count differently. The\n * api-key and OAuth-client families each carry an APPLICATION and an ORGANIZATION resource.\n */\ninterface CredentialExpirySweepTarget {\n  resourceType: CoreResourceType;\n  /** The status a row must currently hold to be due. An already-retired row is left alone. */\n  activeStatus: string;\n  /** The verb that relabels it — never a direct `status` write. */\n  expireOperation: string;\n  /** Human label for the counter this target increments. */\n  counter: 'credentialsExpired' | 'grantsExpired';\n}\n\nconst CREDENTIAL_EXPIRY_SWEEP_TARGETS: readonly CredentialExpirySweepTarget[] = Object.freeze([\n  {\n    resourceType: CoreResourceType.APPLICATION_API_KEYS,\n    activeStatus: ApiKeyStatus.ACTIVE,\n    expireOperation: AppApiKeys_Operations.EXPIRE,\n    counter: 'credentialsExpired',\n  },\n  {\n    resourceType: CoreResourceType.ORG_API_KEYS,\n    activeStatus: ApiKeyStatus.ACTIVE,\n    expireOperation: OrgApiKeys_Operations.EXPIRE,\n    counter: 'credentialsExpired',\n  },\n  {\n    resourceType: CoreResourceType.OAUTH_CLIENTS_APPLICATION,\n    activeStatus: OAuthClientStatus.ACTIVE,\n    expireOperation: AppOAuthClients_Operations.EXPIRE,\n    counter: 'credentialsExpired',\n  },\n  {\n    resourceType: CoreResourceType.OAUTH_CLIENTS_ORGANIZATION,\n    activeStatus: OAuthClientStatus.ACTIVE,\n    expireOperation: OrgOAuthClients_Operations.EXPIRE,\n    counter: 'credentialsExpired',\n  },\n  {\n    resourceType: CoreResourceType.PLATFORM_ACCESS_GRANTS,\n    activeStatus: PlatformAccessGrantStatus.ACTIVE,\n    expireOperation: PlatformAccessGrants_Operations.EXPIRE,\n    counter: 'grantsExpired',\n  },\n]);\n\nexport function createCredentialExpirySweepBatch(): ReturnType<typeof createCustomBatchExecutionService> {\n  return createCustomBatchExecutionService({\n    input: CredentialExpirySweepInputSchema,\n    output: CredentialExpirySweepOutputSchema,\n    batchCronjob_Context: {\n      kind: ENGINE_CREDENTIAL_EXPIRY_SWEEP_BATCH_MANIFEST.kind,\n      resourceIdentifier: ENGINE_CREDENTIAL_EXPIRY_SWEEP_BATCH_MANIFEST.resourceIdentifier,\n      operationIdentifier: ENGINE_CREDENTIAL_EXPIRY_SWEEP_BATCH_MANIFEST.operationIdentifier,\n      cronJobExpression: ENGINE_CREDENTIAL_EXPIRY_SWEEP_BATCH_MANIFEST.cronExpression,\n    },\n    doHandle: async (\n      input,\n      { logger, servicesRegistry, resourcesRegistry, executionContextCreator },\n    ) => {\n      const startTime = Date.now();\n      const batchSize = input.batchSize ?? 100;\n      // Resolved ONCE for the whole run, like the suspension sweep: re-reading the clock per page\n      // would let a credential that elapses mid-run be picked up by a later page of the same sweep,\n      // making the run's own counters unreproducible for no benefit. Tomorrow's pass catches it.\n      const dueBefore = new Date();\n\n      const superAdminRoles = [{\n        roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n        relatedPrimaryScope: ResourcePrimaryScope.APPLICATION,\n      }];\n      const mkEc = async (resourceType: CoreResourceType, operation: string | CoreResourceOperation) =>\n        executionContextCreator.createForInternalOperation({\n          operation: resourcesRegistry.getServiceOperationPathDefault(resourceType, operation),\n          contextResourcesFieldIdentifier: new Map(),\n          initiatorIds: null,\n          initiatorRoles: superAdminRoles,\n        });\n\n      const counters = { credentialsExpired: 0, grantsExpired: 0 };\n      let errors = 0;\n\n      for (const target of CREDENTIAL_EXPIRY_SWEEP_TARGETS) {\n        // Every listed row is relabelled OUT of the matched status, so re-querying page 1 walks the\n        // shrinking match set down to zero — the same loop shape as the sibling sweeps. A row that\n        // errors stays in the set, which is what makes MAX_ITERATIONS a real backstop.\n        let iteration = 0;\n        let hasMore = true;\n        let consecutiveFailures = 0;\n\n        while (hasMore && iteration < MAX_ITERATIONS) {\n          iteration++;\n          const listEc = await mkEc(target.resourceType, CoreResourceOperation.LIST);\n          const listResult = await servicesRegistry.list(\n            target.resourceType,\n            listEc,\n            {\n              status: target.activeStatus,\n              // `$ne: null` matters: a credential with NO expiry never expires, and on the api-key\n              // resources that is the common case. Without it every perpetual key would match.\n              expiresAt: { $ne: null, $lt: dueBefore },\n            },\n            { page: 1, limit: batchSize },\n          );\n          // eslint-disable-next-line @typescript-eslint/no-explicit-any\n          const rows: any[] = Array.isArray(listResult) ? listResult : listResult.data;\n          if (rows.length === 0) { hasMore = false; break; }\n\n          let expiredThisPage = 0;\n          for (const row of rows) {\n            try {\n              const expireEc = await mkEc(target.resourceType, target.expireOperation);\n              await servicesRegistry.executeCustomOperation(\n                target.resourceType,\n                target.expireOperation,\n                expireEc,\n                row._id,\n                {},\n              );\n              counters[target.counter]++;\n              expiredThisPage++;\n            } catch (error) {\n              errors++;\n              logger.warn('Credential expiry sweep: failed to relabel an elapsed credential', {\n                resourceType: String(target.resourceType),\n                rowId: row?._id,\n                operation: String(target.expireOperation),\n                error: describeCaughtError(error),\n              });\n            }\n          }\n\n          // A full page that relabelled NOTHING cannot shrink, so page 1 would return the same rows\n          // forever. Stop this target rather than burn the iteration budget re-failing the identical\n          // set — the errors are logged and tomorrow's pass retries.\n          if (expiredThisPage === 0) {\n            consecutiveFailures++;\n            if (consecutiveFailures >= 2) {\n              logger.error('Credential expiry sweep: a full page failed twice, abandoning this target', {\n                resourceType: String(target.resourceType),\n                pendingRows: rows.length,\n              });\n              hasMore = false;\n            }\n          } else {\n            consecutiveFailures = 0;\n          }\n        }\n\n        if (iteration >= MAX_ITERATIONS) {\n          logger.error('Credential expiry sweep: iteration cap reached, some rows still read as active past their expiry', {\n            resourceType: String(target.resourceType),\n            maxIterations: MAX_ITERATIONS,\n          });\n        }\n      }\n\n      return {\n        credentialsExpired: counters.credentialsExpired,\n        grantsExpired: counters.grantsExpired,\n        errors,\n        durationMs: Date.now() - startTime,\n      };\n    },\n  });\n}\n"]}

package/dist/esm/base-classes/services/batches/engine-custom-batch-manifests.d.ts

@@ -194,6 +194,80 @@ export declare const ORGANIZATION_MEMBER_INVITATION_SWEEP_BATCH_REF: "organizati
  * while staying far cheaper than the per-minute alternative.
  */
 export declare const SUSPENSION_REACTIVATION_SWEEP_BATCH_REF: "suspension-reactivation-sweep";
+/**
+ * Nightly relabelling of machine credentials and platform access grants whose window has elapsed.
+ *
+ * ## What it is, and emphatically what it is NOT
+ *
+ * It is NOT a control. Nothing about access changes when it runs: every guard already compares
+ * `expiresAt` against now — `isCredentialExpired` on both machine fronts, the admission predicate
+ * on a grant — so an elapsed credential stops working whether or not this batch has ever executed.
+ * That separation must survive: if a guard ever starts reading `status` instead, a sweep that lags
+ * becomes an authorization hole rather than a stale display.
+ *
+ * What it fixes is the RECORD. Before it, nothing anywhere wrote `EXPIRED`: no producer, no store
+ * TTL, no sweep. So a listing of API keys, OAuth clients or access grants showed elapsed ones as
+ * ACTIVE forever, and an operator or a customer reading it could not tell which credentials still
+ * worked (#413). `credential-rotation-grace.backend.utils.ts` said so in its own docstring, and a
+ * test comment beside the OIDC guard said it independently.
+ *
+ * ## Why a sweep and not a store TTL
+ *
+ * A Mongo TTL index DELETES a row; it cannot transition a status. Deletion is the wrong outcome for
+ * a record a customer inspects — the history of an operator's access to their tenant is the point —
+ * so a TTL is only the answer where disappearance is intended, which this is not.
+ *
+ * ## The lag is inherent and is the accepted cost
+ *
+ * Between the instant a credential elapses and the next run, the row still reads ACTIVE. Daily at
+ * 02:30, staggered off the 03:00/04:00 sweeps. Hourly was rejected: unlike a time-boxed suspension,
+ * where the caller expresses DAYS and a daily run overshoots by 100%, nothing here is waiting on the
+ * label — the access already stopped — so the extra 23 passes buy a shorter display lag and nothing
+ * else.
+ *
+ * Every transition is dispatched through the resource's own `expire` verb rather than writing
+ * `status` directly, so it inherits each resource's ACTIVE-only precondition. That guard is the
+ * reason the verbs exist: an INACTIVE key was retired by an administrator and a DENIED grant was
+ * refused by a tenant, and relabelling either EXPIRED would erase who ended it.
+ */
+export declare const CREDENTIAL_EXPIRY_SWEEP_BATCH_REF: "credential-expiry-sweep";
+/**
+ * The scheduled flush that makes a METERED product actually bill (#415).
+ *
+ * `UsageMeteringBackendService.flushToProvider` had NO CALLER — not in the engine, not in the
+ * platform, not in either dogfood application. So a metered product could be declared, priced and
+ * synced to the provider while no usage was ever reported: everything up to the local
+ * `usageRecords` row worked, and the last hop to money did not exist. The resources registry's own
+ * comment already said no cron called it.
+ *
+ * **The cadence here is a CEILING, not the interval.** Each product authors its own
+ * `metering.flushIntervalMinutes`, and the flush itself decides per product whether enough time has
+ * passed since its oldest pending row. This tick has to be at least as fast as the fastest interval
+ * an author can reasonably want, and the work it does when nothing is due is one indexed query per
+ * billing scope returning nothing.
+ *
+ * `*​/5 * * * *` — every five minutes. Fast enough that a product asking for 5 gets roughly 5;
+ * `cronExpressionConfigurable` so an application metering something sharper can go faster. A slower
+ * default would silently cap every product's authored interval at the tick, which is the failure this
+ * whole issue is about: an authored value that the runtime quietly overrides.
+ */
+export declare const USAGE_FLUSH_BATCH_REF: "usage-flush";
+/**
+ * Hourly reconciliation of local billing state against the billing provider.
+ *
+ * Anchored on `ORGANIZATION_SUBSCRIPTIONS | UPDATE` because the subscription repair is the write
+ * that can change what a customer is entitled to; the invoice half of the same run only inserts.
+ *
+ * Hourly is a deliberate floor and a deliberate ceiling. It must be slower than the provider's own
+ * webhook retry schedule — Stripe retries a failed delivery for up to three days — or the sweep
+ * spends its time "repairing" state a retry was about to deliver, and every transient webhook
+ * failure is reported as drift. It must be fast enough that a subscription whose cancellation
+ * webhook was lost stops granting entitlements within an hour rather than within a billing period.
+ *
+ * `cronExpressionConfigurable` — an application with thousands of subscriptions may want it slower,
+ * because the run costs one provider call per live subscription plus one per billing account.
+ */
+export declare const BILLING_RECONCILIATION_BATCH_REF: "billing-reconciliation";
 /**
  * Daily tenant purge — the DESTRUCTIVE half of tenant teardown (WS-A).
  *
@@ -228,6 +302,16 @@ export declare const ORGANIZATION_PURGE_DEFAULT_CRON: "0 3 * * *";
  */
 export declare const DORMANCY_DETECTION_BATCH_REF: "lifecycle:dormancy-detection";
 /** Event-triggered email batch send (no cron — dispatched by upstream work). */
+/**
+ * Deferred child-lifecycle teardown — the runtime behind `ChildLifecycleMode.LAZY` (#427).
+ *
+ * Event-triggered, never scheduled: one job per relationship edge whose parent was just deleted,
+ * enqueued by `ServiceResourceBackendService.queueChildDeletion`. The consumer re-enters the SAME
+ * cascade the IMMEDIATE mode runs, so discovery, the grandchild recursion, file orchestration, the
+ * repository delete and the RAG chunk removal all happen exactly once and exactly as they would
+ * have — just off the request path, which is the entire meaning of LAZY.
+ */
+export declare const CHILD_LIFECYCLE_TEARDOWN_BATCH_REF: "child-teardown";
 export declare const EMAIL_BATCH_SEND_BATCH_REF: "email.batch-send";
 /**
  * Configurable data-seeding scheduled-rerun batch (Phase 7 / Item 47).
@@ -476,6 +560,24 @@ export declare const ENGINE_ORGANIZATION_PURGE_BATCH_MANIFEST: ResourceAnchoredC
  *
  * `0 * * * *` — hourly on the hour. See the ref's documentation for why not daily.
  */
+/**
+ * Resource-anchored on APPLICATION_API_KEYS/UPDATE — one of the five operations the sweep genuinely
+ * dispatches (the others are the org api-keys, both OAuth-client resources and platform access
+ * grants, each borrowing UPDATE through its own `expire` verb). Anchoring names a real dispatched
+ * operation rather than a synthetic label, per the convention above.
+ *
+ * `30 2 * * *` — daily at 02:30, staggered off the 03:00 anonymous-session cleanup and the 04:00
+ * invitation sweep. See the ref's documentation for why daily rather than hourly.
+ */
+/**
+ * Resource-anchored on ORGANIZATION_USAGE_RECORDS/UPDATE — the operation the flush genuinely
+ * dispatches when it marks rows reported. The USER-scope usage records are swept in the same run
+ * through the same operation; anchoring names one real dispatched operation rather than a synthetic
+ * label, per the convention above.
+ */
+export declare const ENGINE_USAGE_FLUSH_BATCH_MANIFEST: ResourceAnchoredCustomBatchManifest;
+export declare const ENGINE_BILLING_RECONCILIATION_BATCH_MANIFEST: ResourceAnchoredCustomBatchManifest;
+export declare const ENGINE_CREDENTIAL_EXPIRY_SWEEP_BATCH_MANIFEST: ResourceAnchoredCustomBatchManifest;
 export declare const ENGINE_SUSPENSION_REACTIVATION_SWEEP_BATCH_MANIFEST: ResourceAnchoredCustomBatchManifest;
 export declare const ENGINE_DORMANCY_DETECTION_BATCH_MANIFEST: ResourceAnchoredCustomBatchManifest;
 /**
@@ -488,6 +590,15 @@ export declare const ENGINE_DORMANCY_DETECTION_BATCH_MANIFEST: ResourceAnchoredC
  * `withOperation()` swaps in `notifications:email.batch-send` so audit
  * trails surface the honest batch identity.
  */
+/**
+ * Deferred child-lifecycle teardown (#427). Anchored on the `APPLICATION` primary scope for the
+ * same reason as the email and webhook drains: it is event-triggered and CROSS-RESOURCE — the
+ * child resource differs per job, so there is no honest single target resource to anchor on.
+ *
+ * No `cronExpression`: nothing schedules it. A job exists only because a parent delete chose LAZY
+ * for one of its edges.
+ */
+export declare const ENGINE_CHILD_LIFECYCLE_TEARDOWN_BATCH_MANIFEST: ScopeAnchoredCustomBatchManifest;
 export declare const ENGINE_EMAIL_BATCH_SEND_BATCH_MANIFEST: ScopeAnchoredCustomBatchManifest;
 /**
  * Event-triggered M2M outbound webhook delivery — anchored on the `APPLICATION`

package/dist/esm/base-classes/services/batches/engine-custom-batch-manifests.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"engine-custom-batch-manifests.d.ts","sourceRoot":"","sources":["../../../../../../src/base-classes/services/batches/engine-custom-batch-manifests.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAA2C,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAGtG;;;;GAIG;AACH,UAAU,yBAAyB;IACjC,8FAA8F;IAC9F,QAAQ,EAAE,MAAM,CAAC;IACjB,oEAAoE;IACpE,mBAAmB,EAAE,MAAM,CAAC;IAC5B;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;;;;;;;;;;;;;OAkBG;IACH,0BAA0B,CAAC,EAAE,OAAO,CAAC;CACtC;AAED,yEAAyE;AACzE,oBAAY,uBAAuB;IACjC,iBAAiB,sBAAsB;IACvC,cAAc,mBAAmB;CAClC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,MAAM,MAAM,mBAAmB,GAC3B,CAAC,yBAAyB,GAAG;IAC3B,IAAI,EAAE,uBAAuB,CAAC,iBAAiB,CAAC;IAChD,mEAAmE;IACnE,kBAAkB,EAAE,MAAM,CAAC;CAC5B,CAAC,GACF,CAAC,yBAAyB,GAAG;IAC3B,IAAI,EAAE,uBAAuB,CAAC,cAAc,CAAC;IAC7C;;;;;OAKG;IACH,YAAY,EAAE,oBAAoB,CAAC;CACpC,CAAC,CAAC;AAEP;;;;;;;GAOG;AACH,MAAM,MAAM,mCAAmC,GAAG,OAAO,CAAC,mBAAmB,EAAE;IAAE,IAAI,EAAE,uBAAuB,CAAC,iBAAiB,CAAA;CAAE,CAAC,CAAC;AACpI,4FAA4F;AAC5F,MAAM,MAAM,gCAAgC,GAAG,OAAO,CAAC,mBAAmB,EAAE;IAAE,IAAI,EAAE,uBAAuB,CAAC,cAAc,CAAA;CAAE,CAAC,CAAC;AAI9H,sEAAsE;AACtE,eAAO,MAAM,uBAAuB,EAAG,eAAwB,CAAC;AAEhE,8EAA8E;AAC9E,eAAO,MAAM,mCAAmC,EAAG,2BAAoC,CAAC;AACxF,0EAA0E;AAC1E,eAAO,MAAM,kCAAkC,EAAG,0BAAmC,CAAC;AAEtF;;;;;;GAMG;AACH,eAAO,MAAM,wCAAwC,EAAG,gCAAyC,CAAC;AAClG,eAAO,MAAM,6CAA6C,EAAG,qCAA8C,CAAC;AAE5G,iFAAiF;AACjF,eAAO,MAAM,mCAAmC,EAAG,2BAAoC,CAAC;AAExF;;;;;;;GAOG;AACH,eAAO,MAAM,8CAA8C,EAAG,sCAA+C,CAAC;AAE9G;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,uCAAuC,EAAG,+BAAwC,CAAC;AAEhG;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4BAA4B,EAAG,oBAA6B,CAAC;AAE1E;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,EAAG,WAAoB,CAAC;AAEpE;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,EAAG,8BAAuC,CAAC;AAEpF,gFAAgF;AAChF,eAAO,MAAM,0BAA0B,EAAG,kBAA2B,CAAC;AAEtE;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,sCAAsC,EAAG,iBAA0B,CAAC;AAEjF;;;;;;;;;GASG;AACH,eAAO,MAAM,yCAAyC,EAAG,WAAoB,CAAC;AAE9E;;;;;;GAMG;AACH,eAAO,MAAM,8CAA8C,EAAG,eAAwB,CAAC;AAEvF,6GAA6G;AAC7G,eAAO,MAAM,iDAAiD,EAAG,WAAoB,CAAC;AAEtF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,kCAAkC,EAAG,aAAsB,CAAC;AAEzE;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,6BAA6B,EAAG,YAAqB,CAAC;AAEnE;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,8BAA8B,EAAG,sBAA+B,CAAC;AAE9E;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,2BAA2B,EAAG,mBAA4B,CAAC;AAExE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,+BAA+B,EAAG,uBAAgC,CAAC;AAEhF;;;;;;;GAOG;AACH,eAAO,MAAM,gCAAgC,EAAG,wBAAiC,CAAC;AAElF;;;;;;;;;GASG;AACH,eAAO,MAAM,4BAA4B,EAAG,oBAA6B,CAAC;AAE1E;;;;;;;;;GASG;AACH,eAAO,MAAM,uBAAuB,EAAG,WAAoB,CAAC;AAE5D;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,kCAAkC,EAAG,sBAA+B,CAAC;AAElF,6FAA6F;AAC7F,eAAO,MAAM,6BAA6B,EAAG,WAAoB,CAAC;AAElE;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,6BAA6B,EAAG,iBAA0B,CAAC;AAExE;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,EAAG,aAAsB,CAAC;AAI/D,eAAO,MAAM,mCAAmC,EAAE,mCAMhD,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,8CAA8C,EAAE,mCAM3D,CAAC;AAEH,eAAO,MAAM,mDAAmD,EAAE,mCAMhE,CAAC;AAEH,eAAO,MAAM,+CAA+C,EAAE,mCAM5D,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,8CAA8C,EAAE,mCAM3D,CAAC;AAEH,eAAO,MAAM,+CAA+C,EAAE,mCAM5D,CAAC;AAEH,eAAO,MAAM,0DAA0D,EAAE,mCAQvE,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,wCAAwC,EAAE,mCAOrD,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,mDAAmD,EAAE,mCAOhE,CAAC;AAEH,eAAO,MAAM,wCAAwC,EAAE,mCAYrD,CAAC;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,sCAAsC,EAAE,gCAKnD,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,0CAA0C,EAAE,gCAKvD,CAAC;AAEH;;;;;;;;;;GAUG;AACH;;;;GAIG;AACH,eAAO,MAAM,uCAAuC,EAAE,gCAKpD,CAAC;AAEH,eAAO,MAAM,2CAA2C,EAAE,gCAKxD,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,4CAA4C,EAAE,gCAMzD,CAAC;AAEH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,wCAAwC,EAAE,gCAMrD,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,0DAA0D,EAAE,gCAOvE,CAAC;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,kDAAkD,EAAE,gCAO/D,CAAC;AAEH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,8CAA8C,EAAE,gCAM3D,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,8CAA8C,EAAE,gCAM3D,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,yCAAyC,EAAE,gCAMtD,CAAC;AAIH;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B,EAAE,SAAS,mBAAmB,EAsBtE,CAAC"}
+{"version":3,"file":"engine-custom-batch-manifests.d.ts","sourceRoot":"","sources":["../../../../../../src/base-classes/services/batches/engine-custom-batch-manifests.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAA2C,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAGtG;;;;GAIG;AACH,UAAU,yBAAyB;IACjC,8FAA8F;IAC9F,QAAQ,EAAE,MAAM,CAAC;IACjB,oEAAoE;IACpE,mBAAmB,EAAE,MAAM,CAAC;IAC5B;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;;;;;;;;;;;;;OAkBG;IACH,0BAA0B,CAAC,EAAE,OAAO,CAAC;CACtC;AAED,yEAAyE;AACzE,oBAAY,uBAAuB;IACjC,iBAAiB,sBAAsB;IACvC,cAAc,mBAAmB;CAClC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,MAAM,MAAM,mBAAmB,GAC3B,CAAC,yBAAyB,GAAG;IAC3B,IAAI,EAAE,uBAAuB,CAAC,iBAAiB,CAAC;IAChD,mEAAmE;IACnE,kBAAkB,EAAE,MAAM,CAAC;CAC5B,CAAC,GACF,CAAC,yBAAyB,GAAG;IAC3B,IAAI,EAAE,uBAAuB,CAAC,cAAc,CAAC;IAC7C;;;;;OAKG;IACH,YAAY,EAAE,oBAAoB,CAAC;CACpC,CAAC,CAAC;AAEP;;;;;;;GAOG;AACH,MAAM,MAAM,mCAAmC,GAAG,OAAO,CAAC,mBAAmB,EAAE;IAAE,IAAI,EAAE,uBAAuB,CAAC,iBAAiB,CAAA;CAAE,CAAC,CAAC;AACpI,4FAA4F;AAC5F,MAAM,MAAM,gCAAgC,GAAG,OAAO,CAAC,mBAAmB,EAAE;IAAE,IAAI,EAAE,uBAAuB,CAAC,cAAc,CAAA;CAAE,CAAC,CAAC;AAI9H,sEAAsE;AACtE,eAAO,MAAM,uBAAuB,EAAG,eAAwB,CAAC;AAEhE,8EAA8E;AAC9E,eAAO,MAAM,mCAAmC,EAAG,2BAAoC,CAAC;AACxF,0EAA0E;AAC1E,eAAO,MAAM,kCAAkC,EAAG,0BAAmC,CAAC;AAEtF;;;;;;GAMG;AACH,eAAO,MAAM,wCAAwC,EAAG,gCAAyC,CAAC;AAClG,eAAO,MAAM,6CAA6C,EAAG,qCAA8C,CAAC;AAE5G,iFAAiF;AACjF,eAAO,MAAM,mCAAmC,EAAG,2BAAoC,CAAC;AAExF;;;;;;;GAOG;AACH,eAAO,MAAM,8CAA8C,EAAG,sCAA+C,CAAC;AAE9G;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,uCAAuC,EAAG,+BAAwC,CAAC;AAEhG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,eAAO,MAAM,iCAAiC,EAAG,yBAAkC,CAAC;AAEpF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,qBAAqB,EAAG,aAAsB,CAAC;AAE5D;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,gCAAgC,EAAG,wBAAiC,CAAC;AAElF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4BAA4B,EAAG,oBAA6B,CAAC;AAE1E;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,EAAG,WAAoB,CAAC;AAEpE;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,EAAG,8BAAuC,CAAC;AAEpF,gFAAgF;AAChF;;;;;;;;GAQG;AACH,eAAO,MAAM,kCAAkC,EAAG,gBAAyB,CAAC;AAE5E,eAAO,MAAM,0BAA0B,EAAG,kBAA2B,CAAC;AAEtE;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,sCAAsC,EAAG,iBAA0B,CAAC;AAEjF;;;;;;;;;GASG;AACH,eAAO,MAAM,yCAAyC,EAAG,WAAoB,CAAC;AAE9E;;;;;;GAMG;AACH,eAAO,MAAM,8CAA8C,EAAG,eAAwB,CAAC;AAEvF,6GAA6G;AAC7G,eAAO,MAAM,iDAAiD,EAAG,WAAoB,CAAC;AAEtF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,kCAAkC,EAAG,aAAsB,CAAC;AAEzE;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,6BAA6B,EAAG,YAAqB,CAAC;AAEnE;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,8BAA8B,EAAG,sBAA+B,CAAC;AAE9E;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,2BAA2B,EAAG,mBAA4B,CAAC;AAExE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,+BAA+B,EAAG,uBAAgC,CAAC;AAEhF;;;;;;;GAOG;AACH,eAAO,MAAM,gCAAgC,EAAG,wBAAiC,CAAC;AAElF;;;;;;;;;GASG;AACH,eAAO,MAAM,4BAA4B,EAAG,oBAA6B,CAAC;AAE1E;;;;;;;;;GASG;AACH,eAAO,MAAM,uBAAuB,EAAG,WAAoB,CAAC;AAE5D;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,kCAAkC,EAAG,sBAA+B,CAAC;AAElF,6FAA6F;AAC7F,eAAO,MAAM,6BAA6B,EAAG,WAAoB,CAAC;AAElE;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,6BAA6B,EAAG,iBAA0B,CAAC;AAExE;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,EAAG,aAAsB,CAAC;AAI/D,eAAO,MAAM,mCAAmC,EAAE,mCAMhD,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,8CAA8C,EAAE,mCAM3D,CAAC;AAEH,eAAO,MAAM,mDAAmD,EAAE,mCAMhE,CAAC;AAEH,eAAO,MAAM,+CAA+C,EAAE,mCAM5D,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,8CAA8C,EAAE,mCAM3D,CAAC;AAEH,eAAO,MAAM,+CAA+C,EAAE,mCAM5D,CAAC;AAEH,eAAO,MAAM,0DAA0D,EAAE,mCAQvE,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,wCAAwC,EAAE,mCAOrD,CAAC;AAEH;;;;;;GAMG;AACH;;;;;;;;GAQG;AACH;;;;;GAKG;AACH,eAAO,MAAM,iCAAiC,EAAE,mCAO9C,CAAC;AAEH,eAAO,MAAM,4CAA4C,EAAE,mCAOzD,CAAC;AAEH,eAAO,MAAM,6CAA6C,EAAE,mCAM1D,CAAC;AAEH,eAAO,MAAM,mDAAmD,EAAE,mCAOhE,CAAC;AAEH,eAAO,MAAM,wCAAwC,EAAE,mCAYrD,CAAC;AAEH;;;;;;;;;GASG;AACH;;;;;;;GAOG;AACH,eAAO,MAAM,8CAA8C,EAAE,gCAK3D,CAAC;AAEH,eAAO,MAAM,sCAAsC,EAAE,gCAKnD,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,0CAA0C,EAAE,gCAKvD,CAAC;AAEH;;;;;;;;;;GAUG;AACH;;;;GAIG;AACH,eAAO,MAAM,uCAAuC,EAAE,gCAKpD,CAAC;AAEH,eAAO,MAAM,2CAA2C,EAAE,gCAKxD,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,4CAA4C,EAAE,gCAMzD,CAAC;AAEH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,wCAAwC,EAAE,gCAMrD,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,0DAA0D,EAAE,gCAOvE,CAAC;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,kDAAkD,EAAE,gCAO/D,CAAC;AAEH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,8CAA8C,EAAE,gCAM3D,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,8CAA8C,EAAE,gCAM3D,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,yCAAyC,EAAE,gCAMtD,CAAC;AAIH;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B,EAAE,SAAS,mBAAmB,EA0BtE,CAAC"}

package/dist/esm/base-classes/services/batches/engine-custom-batch-manifests.js

@@ -86,6 +86,80 @@ export const ORGANIZATION_MEMBER_INVITATION_SWEEP_BATCH_REF = 'organization-memb
  * while staying far cheaper than the per-minute alternative.
  */
 export const SUSPENSION_REACTIVATION_SWEEP_BATCH_REF = 'suspension-reactivation-sweep';
+/**
+ * Nightly relabelling of machine credentials and platform access grants whose window has elapsed.
+ *
+ * ## What it is, and emphatically what it is NOT
+ *
+ * It is NOT a control. Nothing about access changes when it runs: every guard already compares
+ * `expiresAt` against now — `isCredentialExpired` on both machine fronts, the admission predicate
+ * on a grant — so an elapsed credential stops working whether or not this batch has ever executed.
+ * That separation must survive: if a guard ever starts reading `status` instead, a sweep that lags
+ * becomes an authorization hole rather than a stale display.
+ *
+ * What it fixes is the RECORD. Before it, nothing anywhere wrote `EXPIRED`: no producer, no store
+ * TTL, no sweep. So a listing of API keys, OAuth clients or access grants showed elapsed ones as
+ * ACTIVE forever, and an operator or a customer reading it could not tell which credentials still
+ * worked (#413). `credential-rotation-grace.backend.utils.ts` said so in its own docstring, and a
+ * test comment beside the OIDC guard said it independently.
+ *
+ * ## Why a sweep and not a store TTL
+ *
+ * A Mongo TTL index DELETES a row; it cannot transition a status. Deletion is the wrong outcome for
+ * a record a customer inspects — the history of an operator's access to their tenant is the point —
+ * so a TTL is only the answer where disappearance is intended, which this is not.
+ *
+ * ## The lag is inherent and is the accepted cost
+ *
+ * Between the instant a credential elapses and the next run, the row still reads ACTIVE. Daily at
+ * 02:30, staggered off the 03:00/04:00 sweeps. Hourly was rejected: unlike a time-boxed suspension,
+ * where the caller expresses DAYS and a daily run overshoots by 100%, nothing here is waiting on the
+ * label — the access already stopped — so the extra 23 passes buy a shorter display lag and nothing
+ * else.
+ *
+ * Every transition is dispatched through the resource's own `expire` verb rather than writing
+ * `status` directly, so it inherits each resource's ACTIVE-only precondition. That guard is the
+ * reason the verbs exist: an INACTIVE key was retired by an administrator and a DENIED grant was
+ * refused by a tenant, and relabelling either EXPIRED would erase who ended it.
+ */
+export const CREDENTIAL_EXPIRY_SWEEP_BATCH_REF = 'credential-expiry-sweep';
+/**
+ * The scheduled flush that makes a METERED product actually bill (#415).
+ *
+ * `UsageMeteringBackendService.flushToProvider` had NO CALLER — not in the engine, not in the
+ * platform, not in either dogfood application. So a metered product could be declared, priced and
+ * synced to the provider while no usage was ever reported: everything up to the local
+ * `usageRecords` row worked, and the last hop to money did not exist. The resources registry's own
+ * comment already said no cron called it.
+ *
+ * **The cadence here is a CEILING, not the interval.** Each product authors its own
+ * `metering.flushIntervalMinutes`, and the flush itself decides per product whether enough time has
+ * passed since its oldest pending row. This tick has to be at least as fast as the fastest interval
+ * an author can reasonably want, and the work it does when nothing is due is one indexed query per
+ * billing scope returning nothing.
+ *
+ * `*​/5 * * * *` — every five minutes. Fast enough that a product asking for 5 gets roughly 5;
+ * `cronExpressionConfigurable` so an application metering something sharper can go faster. A slower
+ * default would silently cap every product's authored interval at the tick, which is the failure this
+ * whole issue is about: an authored value that the runtime quietly overrides.
+ */
+export const USAGE_FLUSH_BATCH_REF = 'usage-flush';
+/**
+ * Hourly reconciliation of local billing state against the billing provider.
+ *
+ * Anchored on `ORGANIZATION_SUBSCRIPTIONS | UPDATE` because the subscription repair is the write
+ * that can change what a customer is entitled to; the invoice half of the same run only inserts.
+ *
+ * Hourly is a deliberate floor and a deliberate ceiling. It must be slower than the provider's own
+ * webhook retry schedule — Stripe retries a failed delivery for up to three days — or the sweep
+ * spends its time "repairing" state a retry was about to deliver, and every transient webhook
+ * failure is reported as drift. It must be fast enough that a subscription whose cancellation
+ * webhook was lost stops granting entitlements within an hour rather than within a billing period.
+ *
+ * `cronExpressionConfigurable` — an application with thousands of subscriptions may want it slower,
+ * because the run costs one provider call per live subscription plus one per billing account.
+ */
+export const BILLING_RECONCILIATION_BATCH_REF = 'billing-reconciliation';
 /**
  * Daily tenant purge — the DESTRUCTIVE half of tenant teardown (WS-A).
  *
@@ -120,6 +194,16 @@ export const ORGANIZATION_PURGE_DEFAULT_CRON = '0 3 * * *';
  */
 export const DORMANCY_DETECTION_BATCH_REF = 'lifecycle:dormancy-detection';
 /** Event-triggered email batch send (no cron — dispatched by upstream work). */
+/**
+ * Deferred child-lifecycle teardown — the runtime behind `ChildLifecycleMode.LAZY` (#427).
+ *
+ * Event-triggered, never scheduled: one job per relationship edge whose parent was just deleted,
+ * enqueued by `ServiceResourceBackendService.queueChildDeletion`. The consumer re-enters the SAME
+ * cascade the IMMEDIATE mode runs, so discovery, the grandchild recursion, file orchestration, the
+ * repository delete and the RAG chunk removal all happen exactly once and exactly as they would
+ * have — just off the request path, which is the entire meaning of LAZY.
+ */
+export const CHILD_LIFECYCLE_TEARDOWN_BATCH_REF = 'child-teardown';
 export const EMAIL_BATCH_SEND_BATCH_REF = 'email.batch-send';
 /**
  * Configurable data-seeding scheduled-rerun batch (Phase 7 / Item 47).
@@ -420,6 +504,44 @@ export const ENGINE_ORGANIZATION_PURGE_BATCH_MANIFEST = Object.freeze({
  *
  * `0 * * * *` — hourly on the hour. See the ref's documentation for why not daily.
  */
+/**
+ * Resource-anchored on APPLICATION_API_KEYS/UPDATE — one of the five operations the sweep genuinely
+ * dispatches (the others are the org api-keys, both OAuth-client resources and platform access
+ * grants, each borrowing UPDATE through its own `expire` verb). Anchoring names a real dispatched
+ * operation rather than a synthetic label, per the convention above.
+ *
+ * `30 2 * * *` — daily at 02:30, staggered off the 03:00 anonymous-session cleanup and the 04:00
+ * invitation sweep. See the ref's documentation for why daily rather than hourly.
+ */
+/**
+ * Resource-anchored on ORGANIZATION_USAGE_RECORDS/UPDATE — the operation the flush genuinely
+ * dispatches when it marks rows reported. The USER-scope usage records are swept in the same run
+ * through the same operation; anchoring names one real dispatched operation rather than a synthetic
+ * label, per the convention above.
+ */
+export const ENGINE_USAGE_FLUSH_BATCH_MANIFEST = Object.freeze({
+    kind: CustomBatchManifestKind.RESOURCE_ANCHORED,
+    batchRef: USAGE_FLUSH_BATCH_REF,
+    resourceIdentifier: CoreResourceType.ORGANIZATION_USAGE_RECORDS,
+    operationIdentifier: CoreResourceOperation.UPDATE,
+    cronExpression: '*/5 * * * *',
+    cronExpressionConfigurable: true,
+});
+export const ENGINE_BILLING_RECONCILIATION_BATCH_MANIFEST = Object.freeze({
+    kind: CustomBatchManifestKind.RESOURCE_ANCHORED,
+    batchRef: BILLING_RECONCILIATION_BATCH_REF,
+    resourceIdentifier: CoreResourceType.ORGANIZATION_SUBSCRIPTIONS,
+    operationIdentifier: CoreResourceOperation.UPDATE,
+    cronExpression: '17 * * * *',
+    cronExpressionConfigurable: true,
+});
+export const ENGINE_CREDENTIAL_EXPIRY_SWEEP_BATCH_MANIFEST = Object.freeze({
+    kind: CustomBatchManifestKind.RESOURCE_ANCHORED,
+    batchRef: CREDENTIAL_EXPIRY_SWEEP_BATCH_REF,
+    resourceIdentifier: CoreResourceType.APPLICATION_API_KEYS,
+    operationIdentifier: CoreResourceOperation.UPDATE,
+    cronExpression: '30 2 * * *',
+});
 export const ENGINE_SUSPENSION_REACTIVATION_SWEEP_BATCH_MANIFEST = Object.freeze({
     kind: CustomBatchManifestKind.RESOURCE_ANCHORED,
     batchRef: SUSPENSION_REACTIVATION_SWEEP_BATCH_REF,
@@ -451,6 +573,20 @@ export const ENGINE_DORMANCY_DETECTION_BATCH_MANIFEST = Object.freeze({
  * `withOperation()` swaps in `notifications:email.batch-send` so audit
  * trails surface the honest batch identity.
  */
+/**
+ * Deferred child-lifecycle teardown (#427). Anchored on the `APPLICATION` primary scope for the
+ * same reason as the email and webhook drains: it is event-triggered and CROSS-RESOURCE — the
+ * child resource differs per job, so there is no honest single target resource to anchor on.
+ *
+ * No `cronExpression`: nothing schedules it. A job exists only because a parent delete chose LAZY
+ * for one of its edges.
+ */
+export const ENGINE_CHILD_LIFECYCLE_TEARDOWN_BATCH_MANIFEST = Object.freeze({
+    kind: CustomBatchManifestKind.SCOPE_ANCHORED,
+    batchRef: CHILD_LIFECYCLE_TEARDOWN_BATCH_REF,
+    primaryScope: ResourcePrimaryScope.APPLICATION,
+    operationIdentifier: 'lifecycle:child-teardown',
+});
 export const ENGINE_EMAIL_BATCH_SEND_BATCH_MANIFEST = Object.freeze({
     kind: CustomBatchManifestKind.SCOPE_ANCHORED,
     batchRef: EMAIL_BATCH_SEND_BATCH_REF,
@@ -630,8 +766,12 @@ export const ENGINE_CUSTOM_BATCH_MANIFESTS = Object.freeze([
     ENGINE_A2A_ABANDONED_TASK_SWEEP_BATCH_MANIFEST,
     ENGINE_ORGANIZATION_MEMBER_INVITATION_SWEEP_BATCH_MANIFEST,
     ENGINE_SUSPENSION_REACTIVATION_SWEEP_BATCH_MANIFEST,
+    ENGINE_CREDENTIAL_EXPIRY_SWEEP_BATCH_MANIFEST,
+    ENGINE_USAGE_FLUSH_BATCH_MANIFEST,
+    ENGINE_BILLING_RECONCILIATION_BATCH_MANIFEST,
     ENGINE_ORGANIZATION_PURGE_BATCH_MANIFEST,
     ENGINE_DORMANCY_DETECTION_BATCH_MANIFEST,
+    ENGINE_CHILD_LIFECYCLE_TEARDOWN_BATCH_MANIFEST,
     ENGINE_EMAIL_BATCH_SEND_BATCH_MANIFEST,
     ENGINE_M2M_WEBHOOK_DELIVERY_BATCH_MANIFEST,
     ENGINE_A2A_PUSH_DELIVERY_BATCH_MANIFEST,