@wildo-ai/saas-backend-lib 1.1.2 → 1.1.3

package/dist/esm/applications/services/worker-remote-client-factory.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"worker-remote-client-factory.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/applications/services/worker-remote-client-factory.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,kBAAkB,CAAC;AAG1B,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,OAAO,CAAC;AAKxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,8DAA8D,CAAC;AACtG,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAEnH,OAAO,EACL,8BAA8B,EAC9B,KAAK,+BAA+B,EACrC,MAAM,wEAAwE,CAAC;AAChF,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAG/G;;;;;;;;;GASG;AACH,qBAAa,gCAAiC,SAAQ,8BAA8B;IAOhF,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,4EAA4E;IAC5E,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,8FAA8F;IAC9F,OAAO,CAAC,QAAQ,CAAC,aAAa;IAVhC,OAAO,CAAC,mBAAmB,CAAS;gBAGlC,MAAM,EAAE,aAAa,EACrB,YAAY,EAAE,0BAA0B,EACxC,iBAAiB,EAAE,iBAAiB,EACnB,gBAAgB,EAAE,uBAAuB;IAC1D,4EAA4E;IAC3D,UAAU,EAAE,MAAM;IACnC,8FAA8F;IAC7E,aAAa,EAAE,MAAM;IAYxC;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;IA2BzB;;;;;;;;;OASG;IACY,oBAAoB,CAAC,OAAO,EAAE,0BAA0B,GAAG,OAAO,CAAC,MAAM,CAAC;IAWzF;;;;;;;;OAQG;cACsB,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;CAGvD;AAED;;;;;;;;GAQG;AACH,qBACa,uCAAuC;IAIb,OAAO,CAAC,QAAQ,CAAC,MAAM;IACV,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC/B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IACnC,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IANhF,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAuD;gBAGzB,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EAC1C,iBAAiB,EAAE,iBAAiB,EACrC,gBAAgB,EAAE,uBAAuB;IAGzG;;;;;;;;;OASG;IACH,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,+BAA+B;CAiC5D"}
+{"version":3,"file":"worker-remote-client-factory.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/applications/services/worker-remote-client-factory.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,kBAAkB,CAAC;AAG1B,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,OAAO,CAAC;AAKxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,8DAA8D,CAAC;AACtG,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAEnH,OAAO,EACL,8BAA8B,EAC9B,KAAK,+BAA+B,EACrC,MAAM,wEAAwE,CAAC;AAChF,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAG/G;;;;;;;;;GASG;AACH,qBAAa,gCAAiC,SAAQ,8BAA8B;IAOhF,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,4EAA4E;IAC5E,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,8FAA8F;IAC9F,OAAO,CAAC,QAAQ,CAAC,aAAa;IAVhC,OAAO,CAAC,mBAAmB,CAAS;gBAGlC,MAAM,EAAE,aAAa,EACrB,YAAY,EAAE,0BAA0B,EACxC,iBAAiB,EAAE,iBAAiB,EACnB,gBAAgB,EAAE,uBAAuB;IAC1D,4EAA4E;IAC3D,UAAU,EAAE,MAAM;IACnC,8FAA8F;IAC7E,aAAa,EAAE,MAAM;IA6BxC;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;IA4BzB;;;;;;;;;OASG;IACY,oBAAoB,CAAC,OAAO,EAAE,0BAA0B,GAAG,OAAO,CAAC,MAAM,CAAC;IAWzF;;;;;;;;OAQG;cACsB,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;CAGvD;AAED;;;;;;;;GAQG;AACH,qBACa,uCAAuC;IAIb,OAAO,CAAC,QAAQ,CAAC,MAAM;IACV,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC/B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IACnC,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IANhF,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAuD;gBAGzB,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EAC1C,iBAAiB,EAAE,iBAAiB,EACrC,gBAAgB,EAAE,uBAAuB;IAGzG;;;;;;;;;OASG;IACH,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,+BAA+B;CAiC5D"}

package/dist/esm/applications/services/worker-remote-client-factory.backend.service.js

@@ -68,6 +68,23 @@ export class WorkerRemoteClientBackendService extends RemoteClientBaseBackendSer
         this.appConfigService = appConfigService;
         this.workerName = workerName;
         this.workerBaseUrl = workerBaseUrl;
+        /*
+         * The base URL is set EAGERLY, and that is load-bearing rather than tidy.
+         *
+         * `RemoteClientBaseBackendService.post()` composes `${this.remoteServiceBaseUrl}${path}` at the
+         * moment it is called — BEFORE `request()` reaches `waitForReady()`. So a base URL assigned
+         * inside the lazy `ensureInitialized()` arrives strictly too late: the first dispatch built
+         * `undefined/tasks/…` and failed `ERR_INVALID_URL`, reported to the caller as a NETWORK 503
+         * naming no cause.
+         *
+         * Nothing about the URL needed deferring in the first place — the factory has it at
+         * construction. What genuinely must stay lazy is the axios wiring, because it reads the JWT
+         * signing key out of the app config, which may not be initialized when a client is first cached.
+         *
+         * This shipped broken and could not have been noticed: the factory had no caller anywhere, so
+         * the very first real dispatch was the first execution of this line (#426).
+         */
+        this.remoteServiceBaseUrl = workerBaseUrl;
         this.logDebug = this.logger.debugByType('WorkerRemoteClientBackendService');
         this.logger.setDebugTypeLogging('WorkerRemoteClientBackendService', false);
         // The calling process is the app backend (the only origin that mints
@@ -94,7 +111,8 @@ export class WorkerRemoteClientBackendService extends RemoteClientBaseBackendSer
                 },
             });
         }
-        this.remoteServiceBaseUrl = this.workerBaseUrl;
+        // `remoteServiceBaseUrl` is already set in the constructor — see the note there for why it
+        // cannot wait until here.
         this.initiateAxiosInstance({
             [WildoHeaderKeys.CONTENT_TYPE]: 'application/json',
             [WildoHeaderKeys.SERVICE_ID]: this.localServiceId,

package/dist/esm/applications/services/worker-remote-client-factory.backend.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"worker-remote-client-factory.backend.service.js","sourceRoot":"","sources":["../../../../../src/applications/services/worker-remote-client-factory.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;;;;;;;;;;;;;AAEH,OAAO,kBAAkB,CAAC;AAE1B,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAG/C,OAAO,EAAE,cAAc,EAAE,2BAA2B,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAChH,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAKtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EACL,8BAA8B,GAE/B,MAAM,wEAAwE,CAAC;AAChF,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,cAAc,EAAE,MAAM,wEAAwE,CAAC;AAExG;;;;;;;;;GASG;AACH,MAAM,OAAO,gCAAiC,SAAQ,8BAA8B;IAO/D;IAEA;IAEA;IAVX,mBAAmB,GAAG,KAAK,CAAC;IAEpC,YACE,MAAqB,EACrB,YAAwC,EACxC,iBAAoC,EACnB,gBAAyC;IAC1D,4EAA4E;IAC3D,UAAkB;IACnC,8FAA8F;IAC7E,aAAqB;QAEtC,4EAA4E;QAC5E,6EAA6E;QAC7E,KAAK,CAAC,MAAM,EAAE,YAAY,EAAE,iBAAiB,EAAE,UAAU,CAAC,CAAC;QAR1C,qBAAgB,GAAhB,gBAAgB,CAAyB;QAEzC,eAAU,GAAV,UAAU,CAAQ;QAElB,kBAAa,GAAb,aAAa,CAAQ;QAKtC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,kCAAkC,CAAC,CAAC;QAC5E,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,kCAAkC,EAAE,KAAK,CAAC,CAAC;QAC3E,qEAAqE;QACrE,0BAA0B;QAC1B,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC,gBAAgB,CAAC;IACxD,CAAC;IAED;;;;;OAKG;IACK,iBAAiB;QACvB,IAAI,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC7B,OAAO;QACT,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE,EAAE,CAAC;YAC3C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,OAAO,EACL,+EAA+E;0BAC7E,yEAAyE;oBAC7E,UAAU,EAAE,IAAI,CAAC,UAAU;iBAC5B;aACF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,oBAAoB,GAAG,IAAI,CAAC,aAAa,CAAC;QAC/C,IAAI,CAAC,qBAAqB,CAAC;YACzB,CAAC,eAAe,CAAC,YAAY,CAAC,EAAE,kBAAkB;YAClD,CAAC,eAAe,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,cAAc;YACjD,CAAC,eAAe,CAAC,cAAc,CAAC,EAAE,IAAI,CAAC,gBAAgB,CAAC,aAAa;YACrE,CAAC,eAAe,CAAC,UAAU,CAAC,EAAE,6BAA6B;SAC5D,CAAC,CAAC;QACH,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC;IAClC,CAAC;IAED;;;;;;;;;OASG;IACM,KAAK,CAAC,oBAAoB,CAAC,OAAmC;QACrE,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAChC;YACE,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC,aAAa;YAClD,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,EACD,cAAc,CAAC,0BAA0B,CAC1C,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACgB,KAAK,CAAC,YAAY;QACnC,IAAI,CAAC,iBAAiB,EAAE,CAAC;IAC3B,CAAC;CACF;AAED;;;;;;;;GAQG;AAEI,IAAM,uCAAuC,GAA7C,MAAM,uCAAuC;IAII;IACa;IACF;IACD;IAN/C,OAAO,GAAG,IAAI,GAAG,EAA4C,CAAC;IAE/E,YACsD,MAAqB,EACR,YAAwC,EAC1C,iBAAoC,EACrC,gBAAyC;QAHnD,WAAM,GAAN,MAAM,CAAe;QACR,iBAAY,GAAZ,YAAY,CAA4B;QAC1C,sBAAiB,GAAjB,iBAAiB,CAAmB;QACrC,qBAAgB,GAAhB,gBAAgB,CAAyB;IACtG,CAAC;IAEJ;;;;;;;;;OASG;IACH,MAAM,CAAC,UAAkB;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,MAAM,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;QAChD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,OAAO,EACL,+BAA+B,UAAU,oBAAoB,MAAM,KAAK;0BACtE,gFAAgF;0BAChF,+DAA+D;oBACnE,UAAU;oBACV,MAAM;iBACP;aACF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,gCAAgC,CACjD,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,iBAAiB,EACtB,IAAI,CAAC,gBAAgB,EACrB,UAAU,EACV,OAAO,CACR,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACrC,OAAO,MAAM,CAAC;IAChB,CAAC;CACF,CAAA;AArDY,uCAAuC;IADnD,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAA;IAC5C,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;mEAAoC,uBAAuB;GAP9F,uCAAuC,CAqDnD","sourcesContent":["/**\n * Backend → worker dispatch (gap G-8 / MW4 of\n * `.claude/plans/minions-and-workers-implementation.md`).\n *\n * A declared worker deploys as its own per-app k8s Deployment + ClusterIP\n * Service, but until now the backend had NO way to CALL it — the worker-request\n * JWT key family (G-7), the apps-manager keypair provisioning, and the\n * worker-side verifier all shipped, yet the call-side that mints + sends the\n * token never existed, so workers were uncallable end-to-end.\n *\n * This file closes that gap:\n *   - `WorkerRemoteClientBackendService` — a per-worker HTTP client (a thin\n *     `RemoteClientBaseBackendService` subclass) that signs an\n *     `APPLICATION_WORKER_REQUEST` JWT and reaches the worker at the URL injected\n *     as `WILDO_WORKER_<NAME>_URL` at deploy time.\n *   - `WorkerRemoteClientFactoryBackendService` — the DI-injectable factory app\n *     code uses: `inject(WorkerRemoteClientFactory).client('myNodeWorker').post('/echo', body)`.\n *\n * The worker verifies the token against the trusted `APPLICATION_WORKER_REQUEST`\n * public key it fetches from apps-manager (`WildoWorkerBootstrapClientService` +\n * `createWorkerJwtVerifierMiddleware`), pinning `iss='wildo-application'` /\n * `aud='APPLICATION_WORKER'` / ES256 — exactly what `sign(payload,\n * APPLICATION_WORKER_REQUEST)` produces from a BARE payload.\n */\n\nimport 'reflect-metadata';\n\nimport { inject, injectable } from 'inversify';\nimport type { InternalAxiosRequestConfig } from 'axios';\n\nimport { BackendApiType, ErrorCustomMessageReference, ErrorType, WildoHeaderKeys } from '@wildo-ai/saas-models';\nimport { wildoWorkerUrlEnvKey } from '@wildo-ai/platform-core-shared';\n\nimport type { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport type { JwtBackendService } from '~wildo-backend-lib/security/jwt/services/jwt.backend.service';\nimport type { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport {\n  RemoteClientBaseBackendService,\n  type IRemoteClientBaseBackendService,\n} from '~wildo-backend-lib/requests/service/remote-client-base.backend.service';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport { JwtPrivateKeys } from '~wildo-backend-lib/security/authentications/models/jwt.backend.schemas';\n\n/**\n * A single per-worker HTTP client. Constructed by\n * {@link WorkerRemoteClientFactoryBackendService} (NOT DI — it needs the\n * worker's runtime name + base URL), so it is a plain class, not `@injectable`.\n *\n * Mirrors the platform-service client pattern (`AppsCrontabManagerBackendService`)\n * with two deliberate divergences documented on the overrides below: the auth\n * token is a worker-request JWT (not a platform-request JWT), and the readiness\n * gate is skipped (the worker's ready path differs from the platform convention).\n */\nexport class WorkerRemoteClientBackendService extends RemoteClientBaseBackendService {\n  private isClientInitialized = false;\n\n  constructor(\n    logger: LoggerService,\n    errorBuilder: ErrorBuilderBackendService,\n    jwtBackendService: JwtBackendService,\n    private readonly appConfigService: AppConfigurationService,\n    /** The worker's `wildo.saas.config.ts` bucket key (e.g. `myNodeWorker`). */\n    private readonly workerName: string,\n    /** Base URL from `WILDO_WORKER_<NAME>_URL` (e.g. `http://{appSlug}-worker-{name}:{port}`). */\n    private readonly workerBaseUrl: string,\n  ) {\n    // The worker name IS the remote service id — `AllApplicationTypes` admits a\n    // bare `string`, so no cast is needed and logs/errors carry the worker name.\n    super(logger, errorBuilder, jwtBackendService, workerName);\n    this.logDebug = this.logger.debugByType('WorkerRemoteClientBackendService');\n    this.logger.setDebugTypeLogging('WorkerRemoteClientBackendService', false);\n    // The calling process is the app backend (the only origin that mints\n    // worker-request tokens).\n    this.localServiceId = BackendApiType.MAIN_BACKEND_API;\n  }\n\n  /**\n   * Lazily wire the axios instance + interceptors on first use. Deferred (not\n   * done in the constructor) so a client can be cached before the app config is\n   * ready; the first request materializes it. Fails closed if the app config is\n   * not initialized (the JWT signing key lives there).\n   */\n  private ensureInitialized(): void {\n    if (this.isClientInitialized) {\n      return;\n    }\n    if (!this.appConfigService.isInitialized()) {\n      throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n        context: {\n          message:\n            'Application configuration must be initialized before dispatching to a worker '\n            + '(the APPLICATION_WORKER_REQUEST signing key is loaded from app config).',\n          workerName: this.workerName,\n        },\n      });\n    }\n\n    this.remoteServiceBaseUrl = this.workerBaseUrl;\n    this.initiateAxiosInstance({\n      [WildoHeaderKeys.CONTENT_TYPE]: 'application/json',\n      [WildoHeaderKeys.SERVICE_ID]: this.localServiceId,\n      [WildoHeaderKeys.APPLICATION_ID]: this.appConfigService.applicationId,\n      [WildoHeaderKeys.USER_AGENT]: 'wildo-worker-dispatch/1.0.0',\n    });\n    this.setupInterceptors();\n    this.isClientInitialized = true;\n  }\n\n  /**\n   * Mint the per-request `APPLICATION_WORKER_REQUEST` bearer.\n   *\n   * CRITICAL: pass a BARE payload (no `iss`/`aud`) so\n   * `JwtPrivateKeySignOptions[APPLICATION_WORKER_REQUEST]` supplies\n   * `issuer='wildo-application'` + `audience='APPLICATION_WORKER'` — the exact\n   * values the worker's `createWorkerJwtVerifierMiddleware` pins. Unlike the\n   * platform-request client, this MUST NOT override `issuer` to the local\n   * service id (that would make the worker's verifier reject the token).\n   */\n  override async generateServiceToken(_config: InternalAxiosRequestConfig): Promise<string> {\n    this.ensureInitialized();\n    return this.jwtBackendService.sign(\n      {\n        applicationId: this.appConfigService.applicationId,\n        workerName: this.workerName,\n      },\n      JwtPrivateKeys.APPLICATION_WORKER_REQUEST,\n    );\n  }\n\n  /**\n   * Override the base readiness gate to a no-op (after ensuring the axios\n   * instance exists). The base polls `${baseUrl}/health/ready` — the\n   * platform-service convention — but a worker serves its authored\n   * `http.readyPath` (default `/readyz`), NOT `/health/ready`, and the backend\n   * does not carry the worker's ready path. Left un-overridden, the base gate\n   * would poll a 404 forever and hang the first dispatch. Worker dispatch\n   * instead fails fast on a down worker via the base request retry/backoff.\n   */\n  protected override async waitForReady(): Promise<void> {\n    this.ensureInitialized();\n  }\n}\n\n/**\n * DI-injectable factory that hands app code a ready-to-use HTTP client per\n * declared worker, caching one client per worker name. Registered singleton so\n * the cache is process-wide.\n *\n * @example\n * const worker = container.get(SAAS_SERVICE_TYPES.WorkerRemoteClientFactoryService);\n * const res = await worker.client('myNodeWorker').post('/echo', { hello: 'world' });\n */\n@injectable()\nexport class WorkerRemoteClientFactoryBackendService {\n  private readonly clients = new Map<string, WorkerRemoteClientBackendService>();\n\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n    @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private readonly errorBuilder: ErrorBuilderBackendService,\n    @inject(SAAS_SERVICE_TYPES.JwtBackendService) private readonly jwtBackendService: JwtBackendService,\n    @inject(SAAS_SERVICE_TYPES.AppConfigService) private readonly appConfigService: AppConfigurationService,\n  ) {}\n\n  /**\n   * Return a cached HTTP client for the named declared worker. `workerName` is\n   * the `wildo.saas.config.ts` `workers` bucket key (e.g. `myNodeWorker`).\n   *\n   * The base URL is read from `WILDO_WORKER_<NAME>_URL`, injected into the\n   * app-backend env at deploy time. A missing var fails CLOSED — the worker was\n   * not declared, or the deploy did not inject its URL — rather than silently\n   * dispatching to a bad address. No `localhost`/default fallback (per the MW4\n   * env discipline).\n   */\n  client(workerName: string): IRemoteClientBaseBackendService {\n    const cached = this.clients.get(workerName);\n    if (cached) {\n      return cached;\n    }\n\n    const envKey = wildoWorkerUrlEnvKey(workerName);\n    const baseUrl = process.env[envKey];\n    if (!baseUrl) {\n      throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n        context: {\n          message:\n            `No dispatch URL for worker '${workerName}': expected env '${envKey}'. `\n            + 'Declare the worker in wildo.saas.config.ts `workers` and re-run deploy so the '\n            + 'CLI injects WILDO_WORKER_<NAME>_URL into the app-backend env.',\n          workerName,\n          envKey,\n        },\n      });\n    }\n\n    const client = new WorkerRemoteClientBackendService(\n      this.logger,\n      this.errorBuilder,\n      this.jwtBackendService,\n      this.appConfigService,\n      workerName,\n      baseUrl,\n    );\n    this.clients.set(workerName, client);\n    return client;\n  }\n}\n"]}
+{"version":3,"file":"worker-remote-client-factory.backend.service.js","sourceRoot":"","sources":["../../../../../src/applications/services/worker-remote-client-factory.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;;;;;;;;;;;;;AAEH,OAAO,kBAAkB,CAAC;AAE1B,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAG/C,OAAO,EAAE,cAAc,EAAE,2BAA2B,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAChH,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAKtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EACL,8BAA8B,GAE/B,MAAM,wEAAwE,CAAC;AAChF,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,cAAc,EAAE,MAAM,wEAAwE,CAAC;AAExG;;;;;;;;;GASG;AACH,MAAM,OAAO,gCAAiC,SAAQ,8BAA8B;IAO/D;IAEA;IAEA;IAVX,mBAAmB,GAAG,KAAK,CAAC;IAEpC,YACE,MAAqB,EACrB,YAAwC,EACxC,iBAAoC,EACnB,gBAAyC;IAC1D,4EAA4E;IAC3D,UAAkB;IACnC,8FAA8F;IAC7E,aAAqB;QAEtC,4EAA4E;QAC5E,6EAA6E;QAC7E,KAAK,CAAC,MAAM,EAAE,YAAY,EAAE,iBAAiB,EAAE,UAAU,CAAC,CAAC;QAR1C,qBAAgB,GAAhB,gBAAgB,CAAyB;QAEzC,eAAU,GAAV,UAAU,CAAQ;QAElB,kBAAa,GAAb,aAAa,CAAQ;QAKtC;;;;;;;;;;;;;;;WAeG;QACH,IAAI,CAAC,oBAAoB,GAAG,aAAa,CAAC;QAC1C,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,kCAAkC,CAAC,CAAC;QAC5E,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,kCAAkC,EAAE,KAAK,CAAC,CAAC;QAC3E,qEAAqE;QACrE,0BAA0B;QAC1B,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC,gBAAgB,CAAC;IACxD,CAAC;IAED;;;;;OAKG;IACK,iBAAiB;QACvB,IAAI,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC7B,OAAO;QACT,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE,EAAE,CAAC;YAC3C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,OAAO,EACL,+EAA+E;0BAC7E,yEAAyE;oBAC7E,UAAU,EAAE,IAAI,CAAC,UAAU;iBAC5B;aACF,CAAC,CAAC;QACL,CAAC;QAED,2FAA2F;QAC3F,0BAA0B;QAC1B,IAAI,CAAC,qBAAqB,CAAC;YACzB,CAAC,eAAe,CAAC,YAAY,CAAC,EAAE,kBAAkB;YAClD,CAAC,eAAe,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,cAAc;YACjD,CAAC,eAAe,CAAC,cAAc,CAAC,EAAE,IAAI,CAAC,gBAAgB,CAAC,aAAa;YACrE,CAAC,eAAe,CAAC,UAAU,CAAC,EAAE,6BAA6B;SAC5D,CAAC,CAAC;QACH,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC;IAClC,CAAC;IAED;;;;;;;;;OASG;IACM,KAAK,CAAC,oBAAoB,CAAC,OAAmC;QACrE,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAChC;YACE,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC,aAAa;YAClD,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,EACD,cAAc,CAAC,0BAA0B,CAC1C,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACgB,KAAK,CAAC,YAAY;QACnC,IAAI,CAAC,iBAAiB,EAAE,CAAC;IAC3B,CAAC;CACF;AAED;;;;;;;;GAQG;AAEI,IAAM,uCAAuC,GAA7C,MAAM,uCAAuC;IAII;IACa;IACF;IACD;IAN/C,OAAO,GAAG,IAAI,GAAG,EAA4C,CAAC;IAE/E,YACsD,MAAqB,EACR,YAAwC,EAC1C,iBAAoC,EACrC,gBAAyC;QAHnD,WAAM,GAAN,MAAM,CAAe;QACR,iBAAY,GAAZ,YAAY,CAA4B;QAC1C,sBAAiB,GAAjB,iBAAiB,CAAmB;QACrC,qBAAgB,GAAhB,gBAAgB,CAAyB;IACtG,CAAC;IAEJ;;;;;;;;;OASG;IACH,MAAM,CAAC,UAAkB;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,MAAM,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;QAChD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,OAAO,EACL,+BAA+B,UAAU,oBAAoB,MAAM,KAAK;0BACtE,gFAAgF;0BAChF,+DAA+D;oBACnE,UAAU;oBACV,MAAM;iBACP;aACF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,gCAAgC,CACjD,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,iBAAiB,EACtB,IAAI,CAAC,gBAAgB,EACrB,UAAU,EACV,OAAO,CACR,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACrC,OAAO,MAAM,CAAC;IAChB,CAAC;CACF,CAAA;AArDY,uCAAuC;IADnD,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAA;IAC5C,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;mEAAoC,uBAAuB;GAP9F,uCAAuC,CAqDnD","sourcesContent":["/**\n * Backend → worker dispatch (gap G-8 / MW4 of\n * `.claude/plans/minions-and-workers-implementation.md`).\n *\n * A declared worker deploys as its own per-app k8s Deployment + ClusterIP\n * Service, but until now the backend had NO way to CALL it — the worker-request\n * JWT key family (G-7), the apps-manager keypair provisioning, and the\n * worker-side verifier all shipped, yet the call-side that mints + sends the\n * token never existed, so workers were uncallable end-to-end.\n *\n * This file closes that gap:\n *   - `WorkerRemoteClientBackendService` — a per-worker HTTP client (a thin\n *     `RemoteClientBaseBackendService` subclass) that signs an\n *     `APPLICATION_WORKER_REQUEST` JWT and reaches the worker at the URL injected\n *     as `WILDO_WORKER_<NAME>_URL` at deploy time.\n *   - `WorkerRemoteClientFactoryBackendService` — the DI-injectable factory app\n *     code uses: `inject(WorkerRemoteClientFactory).client('myNodeWorker').post('/echo', body)`.\n *\n * The worker verifies the token against the trusted `APPLICATION_WORKER_REQUEST`\n * public key it fetches from apps-manager (`WildoWorkerBootstrapClientService` +\n * `createWorkerJwtVerifierMiddleware`), pinning `iss='wildo-application'` /\n * `aud='APPLICATION_WORKER'` / ES256 — exactly what `sign(payload,\n * APPLICATION_WORKER_REQUEST)` produces from a BARE payload.\n */\n\nimport 'reflect-metadata';\n\nimport { inject, injectable } from 'inversify';\nimport type { InternalAxiosRequestConfig } from 'axios';\n\nimport { BackendApiType, ErrorCustomMessageReference, ErrorType, WildoHeaderKeys } from '@wildo-ai/saas-models';\nimport { wildoWorkerUrlEnvKey } from '@wildo-ai/platform-core-shared';\n\nimport type { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport type { JwtBackendService } from '~wildo-backend-lib/security/jwt/services/jwt.backend.service';\nimport type { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport {\n  RemoteClientBaseBackendService,\n  type IRemoteClientBaseBackendService,\n} from '~wildo-backend-lib/requests/service/remote-client-base.backend.service';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport { JwtPrivateKeys } from '~wildo-backend-lib/security/authentications/models/jwt.backend.schemas';\n\n/**\n * A single per-worker HTTP client. Constructed by\n * {@link WorkerRemoteClientFactoryBackendService} (NOT DI — it needs the\n * worker's runtime name + base URL), so it is a plain class, not `@injectable`.\n *\n * Mirrors the platform-service client pattern (`AppsCrontabManagerBackendService`)\n * with two deliberate divergences documented on the overrides below: the auth\n * token is a worker-request JWT (not a platform-request JWT), and the readiness\n * gate is skipped (the worker's ready path differs from the platform convention).\n */\nexport class WorkerRemoteClientBackendService extends RemoteClientBaseBackendService {\n  private isClientInitialized = false;\n\n  constructor(\n    logger: LoggerService,\n    errorBuilder: ErrorBuilderBackendService,\n    jwtBackendService: JwtBackendService,\n    private readonly appConfigService: AppConfigurationService,\n    /** The worker's `wildo.saas.config.ts` bucket key (e.g. `myNodeWorker`). */\n    private readonly workerName: string,\n    /** Base URL from `WILDO_WORKER_<NAME>_URL` (e.g. `http://{appSlug}-worker-{name}:{port}`). */\n    private readonly workerBaseUrl: string,\n  ) {\n    // The worker name IS the remote service id — `AllApplicationTypes` admits a\n    // bare `string`, so no cast is needed and logs/errors carry the worker name.\n    super(logger, errorBuilder, jwtBackendService, workerName);\n    /*\n     * The base URL is set EAGERLY, and that is load-bearing rather than tidy.\n     *\n     * `RemoteClientBaseBackendService.post()` composes `${this.remoteServiceBaseUrl}${path}` at the\n     * moment it is called — BEFORE `request()` reaches `waitForReady()`. So a base URL assigned\n     * inside the lazy `ensureInitialized()` arrives strictly too late: the first dispatch built\n     * `undefined/tasks/…` and failed `ERR_INVALID_URL`, reported to the caller as a NETWORK 503\n     * naming no cause.\n     *\n     * Nothing about the URL needed deferring in the first place — the factory has it at\n     * construction. What genuinely must stay lazy is the axios wiring, because it reads the JWT\n     * signing key out of the app config, which may not be initialized when a client is first cached.\n     *\n     * This shipped broken and could not have been noticed: the factory had no caller anywhere, so\n     * the very first real dispatch was the first execution of this line (#426).\n     */\n    this.remoteServiceBaseUrl = workerBaseUrl;\n    this.logDebug = this.logger.debugByType('WorkerRemoteClientBackendService');\n    this.logger.setDebugTypeLogging('WorkerRemoteClientBackendService', false);\n    // The calling process is the app backend (the only origin that mints\n    // worker-request tokens).\n    this.localServiceId = BackendApiType.MAIN_BACKEND_API;\n  }\n\n  /**\n   * Lazily wire the axios instance + interceptors on first use. Deferred (not\n   * done in the constructor) so a client can be cached before the app config is\n   * ready; the first request materializes it. Fails closed if the app config is\n   * not initialized (the JWT signing key lives there).\n   */\n  private ensureInitialized(): void {\n    if (this.isClientInitialized) {\n      return;\n    }\n    if (!this.appConfigService.isInitialized()) {\n      throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n        context: {\n          message:\n            'Application configuration must be initialized before dispatching to a worker '\n            + '(the APPLICATION_WORKER_REQUEST signing key is loaded from app config).',\n          workerName: this.workerName,\n        },\n      });\n    }\n\n    // `remoteServiceBaseUrl` is already set in the constructor — see the note there for why it\n    // cannot wait until here.\n    this.initiateAxiosInstance({\n      [WildoHeaderKeys.CONTENT_TYPE]: 'application/json',\n      [WildoHeaderKeys.SERVICE_ID]: this.localServiceId,\n      [WildoHeaderKeys.APPLICATION_ID]: this.appConfigService.applicationId,\n      [WildoHeaderKeys.USER_AGENT]: 'wildo-worker-dispatch/1.0.0',\n    });\n    this.setupInterceptors();\n    this.isClientInitialized = true;\n  }\n\n  /**\n   * Mint the per-request `APPLICATION_WORKER_REQUEST` bearer.\n   *\n   * CRITICAL: pass a BARE payload (no `iss`/`aud`) so\n   * `JwtPrivateKeySignOptions[APPLICATION_WORKER_REQUEST]` supplies\n   * `issuer='wildo-application'` + `audience='APPLICATION_WORKER'` — the exact\n   * values the worker's `createWorkerJwtVerifierMiddleware` pins. Unlike the\n   * platform-request client, this MUST NOT override `issuer` to the local\n   * service id (that would make the worker's verifier reject the token).\n   */\n  override async generateServiceToken(_config: InternalAxiosRequestConfig): Promise<string> {\n    this.ensureInitialized();\n    return this.jwtBackendService.sign(\n      {\n        applicationId: this.appConfigService.applicationId,\n        workerName: this.workerName,\n      },\n      JwtPrivateKeys.APPLICATION_WORKER_REQUEST,\n    );\n  }\n\n  /**\n   * Override the base readiness gate to a no-op (after ensuring the axios\n   * instance exists). The base polls `${baseUrl}/health/ready` — the\n   * platform-service convention — but a worker serves its authored\n   * `http.readyPath` (default `/readyz`), NOT `/health/ready`, and the backend\n   * does not carry the worker's ready path. Left un-overridden, the base gate\n   * would poll a 404 forever and hang the first dispatch. Worker dispatch\n   * instead fails fast on a down worker via the base request retry/backoff.\n   */\n  protected override async waitForReady(): Promise<void> {\n    this.ensureInitialized();\n  }\n}\n\n/**\n * DI-injectable factory that hands app code a ready-to-use HTTP client per\n * declared worker, caching one client per worker name. Registered singleton so\n * the cache is process-wide.\n *\n * @example\n * const worker = container.get(SAAS_SERVICE_TYPES.WorkerRemoteClientFactoryService);\n * const res = await worker.client('myNodeWorker').post('/echo', { hello: 'world' });\n */\n@injectable()\nexport class WorkerRemoteClientFactoryBackendService {\n  private readonly clients = new Map<string, WorkerRemoteClientBackendService>();\n\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n    @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private readonly errorBuilder: ErrorBuilderBackendService,\n    @inject(SAAS_SERVICE_TYPES.JwtBackendService) private readonly jwtBackendService: JwtBackendService,\n    @inject(SAAS_SERVICE_TYPES.AppConfigService) private readonly appConfigService: AppConfigurationService,\n  ) {}\n\n  /**\n   * Return a cached HTTP client for the named declared worker. `workerName` is\n   * the `wildo.saas.config.ts` `workers` bucket key (e.g. `myNodeWorker`).\n   *\n   * The base URL is read from `WILDO_WORKER_<NAME>_URL`, injected into the\n   * app-backend env at deploy time. A missing var fails CLOSED — the worker was\n   * not declared, or the deploy did not inject its URL — rather than silently\n   * dispatching to a bad address. No `localhost`/default fallback (per the MW4\n   * env discipline).\n   */\n  client(workerName: string): IRemoteClientBaseBackendService {\n    const cached = this.clients.get(workerName);\n    if (cached) {\n      return cached;\n    }\n\n    const envKey = wildoWorkerUrlEnvKey(workerName);\n    const baseUrl = process.env[envKey];\n    if (!baseUrl) {\n      throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n        context: {\n          message:\n            `No dispatch URL for worker '${workerName}': expected env '${envKey}'. `\n            + 'Declare the worker in wildo.saas.config.ts `workers` and re-run deploy so the '\n            + 'CLI injects WILDO_WORKER_<NAME>_URL into the app-backend env.',\n          workerName,\n          envKey,\n        },\n      });\n    }\n\n    const client = new WorkerRemoteClientBackendService(\n      this.logger,\n      this.errorBuilder,\n      this.jwtBackendService,\n      this.appConfigService,\n      workerName,\n      baseUrl,\n    );\n    this.clients.set(workerName, client);\n    return client;\n  }\n}\n"]}

package/dist/esm/base-classes/models/manual-controllers.backend.definition.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manual-controllers.backend.definition.d.ts","sourceRoot":"","sources":["../../../../../src/base-classes/models/manual-controllers.backend.definition.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,gCAAgC,EAAE,MAAM,0FAA0F,CAAC;AAmB5I,MAAM,WAAW,wBAAwB;IACrC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,4BAA4B,CAAC,EAAE,OAAO,CAAC;CAC1C;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,wBAAwB,GAAG,gCAAgC,EAAE,CAkCxI"}
+{"version":3,"file":"manual-controllers.backend.definition.d.ts","sourceRoot":"","sources":["../../../../../src/base-classes/models/manual-controllers.backend.definition.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,gCAAgC,EAAE,MAAM,0FAA0F,CAAC;AAoB5I,MAAM,WAAW,wBAAwB;IACrC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,4BAA4B,CAAC,EAAE,OAAO,CAAC;CAC1C;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,wBAAwB,GAAG,gCAAgC,EAAE,CAsCxI"}

package/dist/esm/base-classes/models/manual-controllers.backend.definition.js

@@ -10,6 +10,10 @@ export function getManualControllersBackend(container, options) {
         container.get(SAAS_SERVICE_TYPES.AuthenticationController),
         container.get(SAAS_SERVICE_TYPES.OAuthProviderController),
         container.get(SAAS_SERVICE_TYPES.AuthMethodManagementController),
+        // Connecting a third-party account. Unconditional: an application that declares no OAuth2
+        // provider simply has nothing to connect, and the routes answer PROVIDER_NOT_CONNECTABLE —
+        // which is a better answer than a route that does not exist, because it names why.
+        container.get(SAAS_SERVICE_TYPES.ProviderConnectionController),
         container.get(SAAS_SERVICE_TYPES.I18nController),
         container.get(SAAS_SERVICE_TYPES.FlowsActorsController),
         // === A2A (external actor exposure) ===

package/dist/esm/base-classes/models/manual-controllers.backend.definition.js.map

@@ -1 +1 @@
-{"version":3,"file":"manual-controllers.backend.definition.js","sourceRoot":"","sources":["../../../../../src/base-classes/models/manual-controllers.backend.definition.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAOpF;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CAAC,SAAoB,EAAE,OAAkC;IAChG,uGAAuG;IACvG,MAAM,WAAW,GAAuC;QACpD,SAAS,CAAC,GAAG,CAA4C,kBAAkB,CAAC,2BAA2B,CAAC;QACxG,SAAS,CAAC,GAAG,CAAyC,kBAAkB,CAAC,wBAAwB,CAAC;QAClG,SAAS,CAAC,GAAG,CAAwC,kBAAkB,CAAC,uBAAuB,CAAC;QAChG,SAAS,CAAC,GAAG,CAA+C,kBAAkB,CAAC,8BAA8B,CAAC;QAC9G,SAAS,CAAC,GAAG,CAA+B,kBAAkB,CAAC,cAAc,CAAC;QAC9E,SAAS,CAAC,GAAG,CAAsC,kBAAkB,CAAC,qBAAqB,CAAC;QAC5F,wCAAwC;QACxC,SAAS,CAAC,GAAG,CAA8B,kBAAkB,CAAC,aAAa,CAAC;QAC5E,SAAS,CAAC,GAAG,CAA8B,kBAAkB,CAAC,aAAa,CAAC;QAC5E,SAAS,CAAC,GAAG,CAAiB,kBAAkB,CAAC,cAAc,CAAC;QAChE,SAAS,CAAC,GAAG,CAAmC,kBAAkB,CAAC,kBAAkB,CAAC;QACtF,SAAS,CAAC,GAAG,CAAgC,kBAAkB,CAAC,eAAe,CAAC;QAChF,sFAAsF;QACtF,SAAS,CAAC,GAAG,CAAsC,kBAAkB,CAAC,qBAAqB,CAAC;KAC/F,CAAC;IAEF,iEAAiE;IACjE,IAAI,OAAO,EAAE,gBAAgB,EAAE,CAAC;QAC5B,WAAW,CAAC,IAAI,CACZ,SAAS,CAAC,GAAG,CAA6B,kBAAkB,CAAC,mBAAmB,CAAC,CACpF,CAAC;IACN,CAAC;IAED,4FAA4F;IAC5F,IAAI,OAAO,EAAE,4BAA4B,EAAE,CAAC;QACxC,WAAW,CAAC,IAAI,CACZ,SAAS,CAAC,GAAG,CAA+B,kBAAkB,CAAC,cAAc,CAAC,CACjF,CAAC;IACN,CAAC;IAED,OAAO,WAAW,CAAC;AACvB,CAAC","sourcesContent":["import { Container } from 'inversify';\nimport { AbstractControllerBackendService } from \"~wildo-backend-lib/base-classes/services/controllers/abstract-controller.backend.service\";\nimport { ApplicationConfigControllerBackendService } from \"~wildo-backend-lib/config/custom/application-config-controller.backend.service\";\nimport { AuthenticationControllerBackendService } from \"~wildo-backend-lib/security/authentications/controllers/authentication-controller.backend.service\";\nimport { OAuthProviderControllerBackendService } from \"~wildo-backend-lib/security/authentications/controllers/oauth-provider-controller.backend.service\";\nimport { I18nControllerBackendService } from \"~wildo-backend-lib/i18n/controllers/i18n-controller.backend.service\";\nimport { FlowsActorsControllerBackendService } from \"~wildo-backend-lib/flows-actors/controllers/flows-actors.controller\";\n// === A2A (external actor exposure) ===\nimport { A2AControllerBackendService } from \"~wildo-backend-lib/flows-actors/a2a/controllers/a2a.controller\";\nimport { MCPControllerBackendService } from \"~wildo-backend-lib/mcp/controllers/mcp.controller\";\nimport { FileController } from \"~wildo-backend-lib/files/controllers/file.controller\";\nimport { FeaturesControllerBackendService } from \"~wildo-backend-lib/features/controllers/features.backend.controller\";\nimport { ChartControllerBackendService } from \"~wildo-backend-lib/charts/controllers/chart.backend.controller\";\nimport { AnalyticsBackendController } from \"~wildo-backend-lib/monitoring/analytics/controllers/analytics.backend.controller\";\nimport { WebhookAutoControllerBackendService } from \"~wildo-backend-lib/notifications/webhooks/controllers/webhook-auto-controller.backend.service\";\nimport { SCIMControllerBackendService } from \"~wildo-backend-lib/security/scim/controllers/scim.backend.controller\";\nimport { AuthMethodManagementControllerBackendService } from \"~wildo-backend-lib/security/authentications/controllers/auth-method-management-controller.backend.service\";\n\nimport { SAAS_SERVICE_TYPES } from \"~wildo-backend-lib/inject/models/service-types\";\n\nexport interface ManualControllersOptions {\n    analyticsEnabled?: boolean;\n    directoryProvisioningEnabled?: boolean;\n}\n\n/**\n * Get manual controllers from initialized container\n * Must be called after container is fully initialized\n */\nexport function getManualControllersBackend(container: Container, options?: ManualControllersOptions): AbstractControllerBackendService[] {\n    // Note: HealthController is NOT included here - it's mounted at root level by HttpServerBackendService\n    const controllers: AbstractControllerBackendService[] = [\n        container.get<ApplicationConfigControllerBackendService>(SAAS_SERVICE_TYPES.ApplicationConfigController),\n        container.get<AuthenticationControllerBackendService>(SAAS_SERVICE_TYPES.AuthenticationController),\n        container.get<OAuthProviderControllerBackendService>(SAAS_SERVICE_TYPES.OAuthProviderController),\n        container.get<AuthMethodManagementControllerBackendService>(SAAS_SERVICE_TYPES.AuthMethodManagementController),\n        container.get<I18nControllerBackendService>(SAAS_SERVICE_TYPES.I18nController),\n        container.get<FlowsActorsControllerBackendService>(SAAS_SERVICE_TYPES.FlowsActorsController),\n        // === A2A (external actor exposure) ===\n        container.get<A2AControllerBackendService>(SAAS_SERVICE_TYPES.A2AController),\n        container.get<MCPControllerBackendService>(SAAS_SERVICE_TYPES.MCPController),\n        container.get<FileController>(SAAS_SERVICE_TYPES.FileController),\n        container.get<FeaturesControllerBackendService>(SAAS_SERVICE_TYPES.FeaturesController),\n        container.get<ChartControllerBackendService>(SAAS_SERVICE_TYPES.ChartController),\n        // Webhook auto-controller — auto-discovers providers with WEBHOOK_ORIGINATOR protocol\n        container.get<WebhookAutoControllerBackendService>(SAAS_SERVICE_TYPES.WebhookAutoController),\n    ];\n\n    // Analytics controller — only included when analytics is enabled\n    if (options?.analyticsEnabled) {\n        controllers.push(\n            container.get<AnalyticsBackendController>(SAAS_SERVICE_TYPES.AnalyticsController),\n        );\n    }\n\n    // SCIM controller — only included when directory provisioning is enabled (Critical Note #9)\n    if (options?.directoryProvisioningEnabled) {\n        controllers.push(\n            container.get<SCIMControllerBackendService>(SAAS_SERVICE_TYPES.SCIMController),\n        );\n    }\n\n    return controllers;\n}\n"]}
+{"version":3,"file":"manual-controllers.backend.definition.js","sourceRoot":"","sources":["../../../../../src/base-classes/models/manual-controllers.backend.definition.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAOpF;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CAAC,SAAoB,EAAE,OAAkC;IAChG,uGAAuG;IACvG,MAAM,WAAW,GAAuC;QACpD,SAAS,CAAC,GAAG,CAA4C,kBAAkB,CAAC,2BAA2B,CAAC;QACxG,SAAS,CAAC,GAAG,CAAyC,kBAAkB,CAAC,wBAAwB,CAAC;QAClG,SAAS,CAAC,GAAG,CAAwC,kBAAkB,CAAC,uBAAuB,CAAC;QAChG,SAAS,CAAC,GAAG,CAA+C,kBAAkB,CAAC,8BAA8B,CAAC;QAC9G,0FAA0F;QAC1F,2FAA2F;QAC3F,mFAAmF;QACnF,SAAS,CAAC,GAAG,CAA6C,kBAAkB,CAAC,4BAA4B,CAAC;QAC1G,SAAS,CAAC,GAAG,CAA+B,kBAAkB,CAAC,cAAc,CAAC;QAC9E,SAAS,CAAC,GAAG,CAAsC,kBAAkB,CAAC,qBAAqB,CAAC;QAC5F,wCAAwC;QACxC,SAAS,CAAC,GAAG,CAA8B,kBAAkB,CAAC,aAAa,CAAC;QAC5E,SAAS,CAAC,GAAG,CAA8B,kBAAkB,CAAC,aAAa,CAAC;QAC5E,SAAS,CAAC,GAAG,CAAiB,kBAAkB,CAAC,cAAc,CAAC;QAChE,SAAS,CAAC,GAAG,CAAmC,kBAAkB,CAAC,kBAAkB,CAAC;QACtF,SAAS,CAAC,GAAG,CAAgC,kBAAkB,CAAC,eAAe,CAAC;QAChF,sFAAsF;QACtF,SAAS,CAAC,GAAG,CAAsC,kBAAkB,CAAC,qBAAqB,CAAC;KAC/F,CAAC;IAEF,iEAAiE;IACjE,IAAI,OAAO,EAAE,gBAAgB,EAAE,CAAC;QAC5B,WAAW,CAAC,IAAI,CACZ,SAAS,CAAC,GAAG,CAA6B,kBAAkB,CAAC,mBAAmB,CAAC,CACpF,CAAC;IACN,CAAC;IAED,4FAA4F;IAC5F,IAAI,OAAO,EAAE,4BAA4B,EAAE,CAAC;QACxC,WAAW,CAAC,IAAI,CACZ,SAAS,CAAC,GAAG,CAA+B,kBAAkB,CAAC,cAAc,CAAC,CACjF,CAAC;IACN,CAAC;IAED,OAAO,WAAW,CAAC;AACvB,CAAC","sourcesContent":["import { Container } from 'inversify';\nimport { AbstractControllerBackendService } from \"~wildo-backend-lib/base-classes/services/controllers/abstract-controller.backend.service\";\nimport { ApplicationConfigControllerBackendService } from \"~wildo-backend-lib/config/custom/application-config-controller.backend.service\";\nimport { AuthenticationControllerBackendService } from \"~wildo-backend-lib/security/authentications/controllers/authentication-controller.backend.service\";\nimport { OAuthProviderControllerBackendService } from \"~wildo-backend-lib/security/authentications/controllers/oauth-provider-controller.backend.service\";\nimport { I18nControllerBackendService } from \"~wildo-backend-lib/i18n/controllers/i18n-controller.backend.service\";\nimport { FlowsActorsControllerBackendService } from \"~wildo-backend-lib/flows-actors/controllers/flows-actors.controller\";\n// === A2A (external actor exposure) ===\nimport { A2AControllerBackendService } from \"~wildo-backend-lib/flows-actors/a2a/controllers/a2a.controller\";\nimport { MCPControllerBackendService } from \"~wildo-backend-lib/mcp/controllers/mcp.controller\";\nimport { FileController } from \"~wildo-backend-lib/files/controllers/file.controller\";\nimport { FeaturesControllerBackendService } from \"~wildo-backend-lib/features/controllers/features.backend.controller\";\nimport { ChartControllerBackendService } from \"~wildo-backend-lib/charts/controllers/chart.backend.controller\";\nimport { AnalyticsBackendController } from \"~wildo-backend-lib/monitoring/analytics/controllers/analytics.backend.controller\";\nimport { WebhookAutoControllerBackendService } from \"~wildo-backend-lib/notifications/webhooks/controllers/webhook-auto-controller.backend.service\";\nimport { SCIMControllerBackendService } from \"~wildo-backend-lib/security/scim/controllers/scim.backend.controller\";\nimport { AuthMethodManagementControllerBackendService } from \"~wildo-backend-lib/security/authentications/controllers/auth-method-management-controller.backend.service\";\nimport { ProviderConnectionControllerBackendService } from \"~wildo-backend-lib/security/connected-accounts/controllers/provider-connection.controller.backend.service\";\n\nimport { SAAS_SERVICE_TYPES } from \"~wildo-backend-lib/inject/models/service-types\";\n\nexport interface ManualControllersOptions {\n    analyticsEnabled?: boolean;\n    directoryProvisioningEnabled?: boolean;\n}\n\n/**\n * Get manual controllers from initialized container\n * Must be called after container is fully initialized\n */\nexport function getManualControllersBackend(container: Container, options?: ManualControllersOptions): AbstractControllerBackendService[] {\n    // Note: HealthController is NOT included here - it's mounted at root level by HttpServerBackendService\n    const controllers: AbstractControllerBackendService[] = [\n        container.get<ApplicationConfigControllerBackendService>(SAAS_SERVICE_TYPES.ApplicationConfigController),\n        container.get<AuthenticationControllerBackendService>(SAAS_SERVICE_TYPES.AuthenticationController),\n        container.get<OAuthProviderControllerBackendService>(SAAS_SERVICE_TYPES.OAuthProviderController),\n        container.get<AuthMethodManagementControllerBackendService>(SAAS_SERVICE_TYPES.AuthMethodManagementController),\n        // Connecting a third-party account. Unconditional: an application that declares no OAuth2\n        // provider simply has nothing to connect, and the routes answer PROVIDER_NOT_CONNECTABLE —\n        // which is a better answer than a route that does not exist, because it names why.\n        container.get<ProviderConnectionControllerBackendService>(SAAS_SERVICE_TYPES.ProviderConnectionController),\n        container.get<I18nControllerBackendService>(SAAS_SERVICE_TYPES.I18nController),\n        container.get<FlowsActorsControllerBackendService>(SAAS_SERVICE_TYPES.FlowsActorsController),\n        // === A2A (external actor exposure) ===\n        container.get<A2AControllerBackendService>(SAAS_SERVICE_TYPES.A2AController),\n        container.get<MCPControllerBackendService>(SAAS_SERVICE_TYPES.MCPController),\n        container.get<FileController>(SAAS_SERVICE_TYPES.FileController),\n        container.get<FeaturesControllerBackendService>(SAAS_SERVICE_TYPES.FeaturesController),\n        container.get<ChartControllerBackendService>(SAAS_SERVICE_TYPES.ChartController),\n        // Webhook auto-controller — auto-discovers providers with WEBHOOK_ORIGINATOR protocol\n        container.get<WebhookAutoControllerBackendService>(SAAS_SERVICE_TYPES.WebhookAutoController),\n    ];\n\n    // Analytics controller — only included when analytics is enabled\n    if (options?.analyticsEnabled) {\n        controllers.push(\n            container.get<AnalyticsBackendController>(SAAS_SERVICE_TYPES.AnalyticsController),\n        );\n    }\n\n    // SCIM controller — only included when directory provisioning is enabled (Critical Note #9)\n    if (options?.directoryProvisioningEnabled) {\n        controllers.push(\n            container.get<SCIMControllerBackendService>(SAAS_SERVICE_TYPES.SCIMController),\n        );\n    }\n\n    return controllers;\n}\n"]}

package/dist/esm/base-classes/services/batches/child-lifecycle-teardown.batch.backend.service.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Deferred child-lifecycle teardown — the consumer behind `ChildLifecycleMode.LAZY` (#427).
+ *
+ * ## What this is, and what it deliberately is NOT
+ *
+ * It is not a delete implementation. `ServiceResourceBackendService.queueChildDeletion` publishes
+ * one job per relationship edge whose parent was just deleted, and this batch does exactly one
+ * thing with it: resolve the PARENT's service and call
+ * `runDeferredChildLifecycleTeardown`, which re-enters `deleteChildrenImmediate` — the same method
+ * `ChildLifecycleMode.IMMEDIATE` calls.
+ *
+ * That indirection is the whole design. Everything the immediate cascade does comes along without
+ * being restated: child discovery (against the rows that exist NOW, which is what LAZY means), the
+ * grandchild recursion, the file orchestration, the repository delete, and — the obligation this
+ * issue names explicitly — `runRagChunkRemovalForDeletedRows`. A second implementation here could
+ * drift from the first; there is no second implementation.
+ *
+ * ## Idempotency
+ *
+ * The queue is at-least-once, so this job can be redelivered. Re-running is safe because the
+ * teardown re-DISCOVERS its children each time: a redelivery after a successful run finds no
+ * children on the edge and returns having done nothing. It cannot delete a row twice, and it cannot
+ * delete a row created under a new parent, because discovery is scoped by the parent ids the job
+ * carries and those parents are gone.
+ *
+ * ## Failure
+ *
+ * A throw propagates to the custom-batch executor, which retries with backoff and finally
+ * dead-letters. That is the correct end state for an owed teardown: parked and visible, never
+ * silently dropped. The one thing this must not do is swallow — children that were not torn down
+ * with no record is the failure the fail-closed refusal used to prevent.
+ */
+import { createCustomBatchExecutionService } from '../../../base-classes/services/batches/batches-cronjobs-custom-execution.service';
+export declare function createChildLifecycleTeardownBatch(): ReturnType<typeof createCustomBatchExecutionService>;
+//# sourceMappingURL=child-lifecycle-teardown.batch.backend.service.d.ts.map

package/dist/esm/base-classes/services/batches/child-lifecycle-teardown.batch.backend.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"child-lifecycle-teardown.batch.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/base-classes/services/batches/child-lifecycle-teardown.batch.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAIH,OAAO,EAAE,iCAAiC,EAAE,MAAM,4FAA4F,CAAC;AA0B/I,wBAAgB,iCAAiC,IAAI,UAAU,CAAC,OAAO,iCAAiC,CAAC,CA0DxG"}

package/dist/esm/base-classes/services/batches/child-lifecycle-teardown.batch.backend.service.js

@@ -0,0 +1,111 @@
+/**
+ * Deferred child-lifecycle teardown — the consumer behind `ChildLifecycleMode.LAZY` (#427).
+ *
+ * ## What this is, and what it deliberately is NOT
+ *
+ * It is not a delete implementation. `ServiceResourceBackendService.queueChildDeletion` publishes
+ * one job per relationship edge whose parent was just deleted, and this batch does exactly one
+ * thing with it: resolve the PARENT's service and call
+ * `runDeferredChildLifecycleTeardown`, which re-enters `deleteChildrenImmediate` — the same method
+ * `ChildLifecycleMode.IMMEDIATE` calls.
+ *
+ * That indirection is the whole design. Everything the immediate cascade does comes along without
+ * being restated: child discovery (against the rows that exist NOW, which is what LAZY means), the
+ * grandchild recursion, the file orchestration, the repository delete, and — the obligation this
+ * issue names explicitly — `runRagChunkRemovalForDeletedRows`. A second implementation here could
+ * drift from the first; there is no second implementation.
+ *
+ * ## Idempotency
+ *
+ * The queue is at-least-once, so this job can be redelivered. Re-running is safe because the
+ * teardown re-DISCOVERS its children each time: a redelivery after a successful run finds no
+ * children on the edge and returns having done nothing. It cannot delete a row twice, and it cannot
+ * delete a row created under a new parent, because discovery is scoped by the parent ids the job
+ * carries and those parents are gone.
+ *
+ * ## Failure
+ *
+ * A throw propagates to the custom-batch executor, which retries with backoff and finally
+ * dead-letters. That is the correct end state for an owed teardown: parked and visible, never
+ * silently dropped. The one thing this must not do is swallow — children that were not torn down
+ * with no record is the failure the fail-closed refusal used to prevent.
+ */
+import { z } from 'zod';
+import { createCustomBatchExecutionService } from '../../../base-classes/services/batches/batches-cronjobs-custom-execution.service.js';
+import { ENGINE_CHILD_LIFECYCLE_TEARDOWN_BATCH_MANIFEST } from '../../../base-classes/services/batches/engine-custom-batch-manifests.js';
+import { projectCaughtErrorLogFields } from '../../../errors/utils/error-log-level-classification.backend.utils.js';
+/**
+ * The job payload. Two resource types and the parent ids — no relationship object, no child ids.
+ *
+ * Carrying the edge by NAME rather than by value is what lets the consumer re-derive it from the
+ * parent's CURRENT configuration and refuse if that configuration changed. Carrying child ids would
+ * additionally have frozen discovery at enqueue time, which is precisely the thing LAZY defers.
+ */
+const ChildLifecycleTeardownInputSchema = z.object({
+    parentResourceType: z.string().min(1),
+    childResourceType: z.string().min(1),
+    parentIds: z.array(z.string().min(1)).min(1),
+});
+const ChildLifecycleTeardownOutputSchema = z.object({
+    parentResourceType: z.string(),
+    childResourceType: z.string(),
+    parentIdsCount: z.number().int().min(0),
+    /** Whether the edge reported that it processed the teardown — the cascade's own `@returns`. */
+    processed: z.boolean(),
+    durationMs: z.number().int().min(0),
+});
+export function createChildLifecycleTeardownBatch() {
+    return createCustomBatchExecutionService({
+        input: ChildLifecycleTeardownInputSchema,
+        output: ChildLifecycleTeardownOutputSchema,
+        batchCronjob_Context: {
+            kind: ENGINE_CHILD_LIFECYCLE_TEARDOWN_BATCH_MANIFEST.kind,
+            primaryScope: ENGINE_CHILD_LIFECYCLE_TEARDOWN_BATCH_MANIFEST.primaryScope,
+            operationIdentifier: ENGINE_CHILD_LIFECYCLE_TEARDOWN_BATCH_MANIFEST.operationIdentifier,
+        },
+        doHandle: async (input, { logger, servicesRegistry, executionContext }) => {
+            const startTime = Date.now();
+            const { parentResourceType, childResourceType, parentIds } = input;
+            const parentService = servicesRegistry.getService(parentResourceType);
+            if (!parentService) {
+                // Not swallowed: an unresolvable parent means the job cannot be honoured at all, and the
+                // teardown is still owed. Throwing parks it in the dead-letter queue where it is visible,
+                // rather than reporting success for work that did not happen.
+                throw new Error(`[child-lifecycle-teardown] No registered service for parent resource '${parentResourceType}' — `
+                    + `cannot run the deferred teardown of '${childResourceType}' for ${parentIds.length} parent(s).`);
+            }
+            try {
+                const processed = await parentService.runDeferredChildLifecycleTeardown({
+                    childResourceType,
+                    parentIds,
+                    executionContext,
+                });
+                logger.info('[child-lifecycle-teardown] Deferred child teardown completed', {
+                    parentResourceType,
+                    childResourceType,
+                    parentIdsCount: parentIds.length,
+                    processed,
+                });
+                return {
+                    parentResourceType,
+                    childResourceType,
+                    parentIdsCount: parentIds.length,
+                    processed,
+                    durationMs: Date.now() - startTime,
+                };
+            }
+            catch (error) {
+                logger.error('[child-lifecycle-teardown] Deferred child teardown FAILED', {
+                    parentResourceType,
+                    childResourceType,
+                    parentIdsCount: parentIds.length,
+                    ...projectCaughtErrorLogFields(error),
+                });
+                // Rethrown so the executor retries and finally dead-letters. A teardown that is owed and
+                // failed must stay visible; reporting a partial success would lose it.
+                throw error;
+            }
+        },
+    });
+}
+//# sourceMappingURL=child-lifecycle-teardown.batch.backend.service.js.map

package/dist/esm/base-classes/services/batches/child-lifecycle-teardown.batch.backend.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"child-lifecycle-teardown.batch.backend.service.js","sourceRoot":"","sources":["../../../../../../src/base-classes/services/batches/child-lifecycle-teardown.batch.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,iCAAiC,EAAE,MAAM,4FAA4F,CAAC;AAC/I,OAAO,EAAE,8CAA8C,EAAE,MAAM,gFAAgF,CAAC;AAChJ,OAAO,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAE3H;;;;;;GAMG;AACH,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACpC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC7C,CAAC,CAAC;AAEH,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC9B,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC7B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvC,+FAA+F;IAC/F,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IACtB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACpC,CAAC,CAAC;AAEH,MAAM,UAAU,iCAAiC;IAC/C,OAAO,iCAAiC,CAAC;QACvC,KAAK,EAAE,iCAAiC;QACxC,MAAM,EAAE,kCAAkC;QAC1C,oBAAoB,EAAE;YACpB,IAAI,EAAE,8CAA8C,CAAC,IAAI;YACzD,YAAY,EAAE,8CAA8C,CAAC,YAAY;YACzE,mBAAmB,EAAE,8CAA8C,CAAC,mBAAmB;SACxF;QACD,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,EAAE,EAAE;YACxE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC7B,MAAM,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;YAEnE,MAAM,aAAa,GAAG,gBAAgB,CAAC,UAAU,CAAC,kBAA2B,CAAC,CAAC;YAC/E,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,yFAAyF;gBACzF,0FAA0F;gBAC1F,8DAA8D;gBAC9D,MAAM,IAAI,KAAK,CACb,yEAAyE,kBAAkB,MAAM;sBAC/F,wCAAwC,iBAAiB,SAAS,SAAS,CAAC,MAAM,aAAa,CAClG,CAAC;YACJ,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,iCAAiC,CAAC;oBACtE,iBAAiB;oBACjB,SAAS;oBACT,gBAAgB;iBACjB,CAAC,CAAC;gBAEH,MAAM,CAAC,IAAI,CAAC,8DAA8D,EAAE;oBAC1E,kBAAkB;oBAClB,iBAAiB;oBACjB,cAAc,EAAE,SAAS,CAAC,MAAM;oBAChC,SAAS;iBACV,CAAC,CAAC;gBAEH,OAAO;oBACL,kBAAkB;oBAClB,iBAAiB;oBACjB,cAAc,EAAE,SAAS,CAAC,MAAM;oBAChC,SAAS;oBACT,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;iBACnC,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,CAAC,2DAA2D,EAAE;oBACxE,kBAAkB;oBAClB,iBAAiB;oBACjB,cAAc,EAAE,SAAS,CAAC,MAAM;oBAChC,GAAG,2BAA2B,CAAC,KAAK,CAAC;iBACtC,CAAC,CAAC;gBACH,yFAAyF;gBACzF,uEAAuE;gBACvE,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;KACF,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * Deferred child-lifecycle teardown — the consumer behind `ChildLifecycleMode.LAZY` (#427).\n *\n * ## What this is, and what it deliberately is NOT\n *\n * It is not a delete implementation. `ServiceResourceBackendService.queueChildDeletion` publishes\n * one job per relationship edge whose parent was just deleted, and this batch does exactly one\n * thing with it: resolve the PARENT's service and call\n * `runDeferredChildLifecycleTeardown`, which re-enters `deleteChildrenImmediate` — the same method\n * `ChildLifecycleMode.IMMEDIATE` calls.\n *\n * That indirection is the whole design. Everything the immediate cascade does comes along without\n * being restated: child discovery (against the rows that exist NOW, which is what LAZY means), the\n * grandchild recursion, the file orchestration, the repository delete, and — the obligation this\n * issue names explicitly — `runRagChunkRemovalForDeletedRows`. A second implementation here could\n * drift from the first; there is no second implementation.\n *\n * ## Idempotency\n *\n * The queue is at-least-once, so this job can be redelivered. Re-running is safe because the\n * teardown re-DISCOVERS its children each time: a redelivery after a successful run finds no\n * children on the edge and returns having done nothing. It cannot delete a row twice, and it cannot\n * delete a row created under a new parent, because discovery is scoped by the parent ids the job\n * carries and those parents are gone.\n *\n * ## Failure\n *\n * A throw propagates to the custom-batch executor, which retries with backoff and finally\n * dead-letters. That is the correct end state for an owed teardown: parked and visible, never\n * silently dropped. The one thing this must not do is swallow — children that were not torn down\n * with no record is the failure the fail-closed refusal used to prevent.\n */\n\nimport { z } from 'zod';\n\nimport { createCustomBatchExecutionService } from '~wildo-backend-lib/base-classes/services/batches/batches-cronjobs-custom-execution.service';\nimport { ENGINE_CHILD_LIFECYCLE_TEARDOWN_BATCH_MANIFEST } from '~wildo-backend-lib/base-classes/services/batches/engine-custom-batch-manifests';\nimport { projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\n\n/**\n * The job payload. Two resource types and the parent ids — no relationship object, no child ids.\n *\n * Carrying the edge by NAME rather than by value is what lets the consumer re-derive it from the\n * parent's CURRENT configuration and refuse if that configuration changed. Carrying child ids would\n * additionally have frozen discovery at enqueue time, which is precisely the thing LAZY defers.\n */\nconst ChildLifecycleTeardownInputSchema = z.object({\n  parentResourceType: z.string().min(1),\n  childResourceType: z.string().min(1),\n  parentIds: z.array(z.string().min(1)).min(1),\n});\n\nconst ChildLifecycleTeardownOutputSchema = z.object({\n  parentResourceType: z.string(),\n  childResourceType: z.string(),\n  parentIdsCount: z.number().int().min(0),\n  /** Whether the edge reported that it processed the teardown — the cascade's own `@returns`. */\n  processed: z.boolean(),\n  durationMs: z.number().int().min(0),\n});\n\nexport function createChildLifecycleTeardownBatch(): ReturnType<typeof createCustomBatchExecutionService> {\n  return createCustomBatchExecutionService({\n    input: ChildLifecycleTeardownInputSchema,\n    output: ChildLifecycleTeardownOutputSchema,\n    batchCronjob_Context: {\n      kind: ENGINE_CHILD_LIFECYCLE_TEARDOWN_BATCH_MANIFEST.kind,\n      primaryScope: ENGINE_CHILD_LIFECYCLE_TEARDOWN_BATCH_MANIFEST.primaryScope,\n      operationIdentifier: ENGINE_CHILD_LIFECYCLE_TEARDOWN_BATCH_MANIFEST.operationIdentifier,\n    },\n    doHandle: async (input, { logger, servicesRegistry, executionContext }) => {\n      const startTime = Date.now();\n      const { parentResourceType, childResourceType, parentIds } = input;\n\n      const parentService = servicesRegistry.getService(parentResourceType as never);\n      if (!parentService) {\n        // Not swallowed: an unresolvable parent means the job cannot be honoured at all, and the\n        // teardown is still owed. Throwing parks it in the dead-letter queue where it is visible,\n        // rather than reporting success for work that did not happen.\n        throw new Error(\n          `[child-lifecycle-teardown] No registered service for parent resource '${parentResourceType}' — `\n          + `cannot run the deferred teardown of '${childResourceType}' for ${parentIds.length} parent(s).`,\n        );\n      }\n\n      try {\n        const processed = await parentService.runDeferredChildLifecycleTeardown({\n          childResourceType,\n          parentIds,\n          executionContext,\n        });\n\n        logger.info('[child-lifecycle-teardown] Deferred child teardown completed', {\n          parentResourceType,\n          childResourceType,\n          parentIdsCount: parentIds.length,\n          processed,\n        });\n\n        return {\n          parentResourceType,\n          childResourceType,\n          parentIdsCount: parentIds.length,\n          processed,\n          durationMs: Date.now() - startTime,\n        };\n      } catch (error) {\n        logger.error('[child-lifecycle-teardown] Deferred child teardown FAILED', {\n          parentResourceType,\n          childResourceType,\n          parentIdsCount: parentIds.length,\n          ...projectCaughtErrorLogFields(error),\n        });\n        // Rethrown so the executor retries and finally dead-letters. A teardown that is owed and\n        // failed must stay visible; reporting a partial success would lose it.\n        throw error;\n      }\n    },\n  });\n}\n"]}

package/dist/esm/base-classes/services/batches/credential-expiry-sweep.batch.backend.service.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Credential Expiry Sweep — relabels machine credentials and platform access grants whose window
+ * has elapsed.
+ *
+ * ## What this batch is for, and what it is NOT
+ *
+ * It is NOT a control, and reading it as one is the mistake to avoid. Access is already refused
+ * correctly without it: `isCredentialExpired` gates every machine front at auth time, and a grant's
+ * admission predicate compares `expiresAt` against now. An elapsed credential stops working whether
+ * or not this batch has ever run.
+ *
+ * What it fixes is the RECORD. Until 2026-09-08 nothing anywhere wrote `EXPIRED` on any of these
+ * three populations — no producer, no store TTL, no sweep — so a listing of API keys, OAuth clients
+ * or access grants showed elapsed ones as ACTIVE forever, and an operator reading it could not tell
+ * which credentials still worked (#413). Two places in the tree said so independently:
+ * `credential-rotation-grace.backend.utils.ts` in its own docstring, and a comment beside the OIDC
+ * authorization-code guard.
+ *
+ * **`expiresAt` remains the control, and the label must never become one.** If a guard ever starts
+ * reading `status` instead, a sweep that lags — and it always lags, see below — turns a stale
+ * display into an authorization hole. The pin for that lives beside the auth-time guard, not here.
+ *
+ * ## Why a sweep rather than a store-level TTL
+ *
+ * A Mongo TTL index DELETES a row; it cannot transition a status, and PostgreSQL has no native TTL
+ * at all. Deletion is the wrong outcome for a record a customer inspects — the history of an
+ * operator's access to their tenant is exactly the thing worth keeping — so a TTL is only the right
+ * mechanism where disappearance is the intent, which this is not.
+ *
+ * ## The lag is inherent, and is the accepted cost of the option chosen
+ *
+ * Between the instant a credential elapses and the next run, the row still reads ACTIVE. Daily at
+ * 02:30. Hourly was rejected: unlike the suspension sweep beside it — where a caller expresses DAYS
+ * and a daily run overshoots a one-day suspension by 100% — nothing here waits on the label, because
+ * the access already stopped. The extra 23 passes would buy a shorter display lag and nothing else.
+ *
+ * ## Every transition goes through the resource's own verb
+ *
+ * Never a direct `status` write. Each `expire` verb carries an ACTIVE-only precondition, and that
+ * guard is the reason the verbs exist: an INACTIVE api-key was retired by an administrator and a
+ * DENIED grant was refused by a tenant, so relabelling either EXPIRED would erase who ended it. A
+ * direct write would be a second authority over the field and would skip the check — the same
+ * reasoning the suspension sweep and the invitation sweep both apply.
+ *
+ * assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — a credential whose validity window has
+ * elapsed is recorded as expired, so an access review reads the same state the runtime enforces.
+ */
+import { createCustomBatchExecutionService } from '../../../base-classes/services/batches/batches-cronjobs-custom-execution.service';
+export declare function createCredentialExpirySweepBatch(): ReturnType<typeof createCustomBatchExecutionService>;
+//# sourceMappingURL=credential-expiry-sweep.batch.backend.service.d.ts.map

package/dist/esm/base-classes/services/batches/credential-expiry-sweep.batch.backend.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-expiry-sweep.batch.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/base-classes/services/batches/credential-expiry-sweep.batch.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAiBH,OAAO,EAAE,iCAAiC,EAAE,MAAM,4FAA4F,CAAC;AAsE/I,wBAAgB,gCAAgC,IAAI,UAAU,CAAC,OAAO,iCAAiC,CAAC,CAuHvG"}

package/dist/esm/base-classes/services/batches/credential-expiry-sweep.batch.backend.service.js

@@ -0,0 +1,199 @@
+/**
+ * Credential Expiry Sweep — relabels machine credentials and platform access grants whose window
+ * has elapsed.
+ *
+ * ## What this batch is for, and what it is NOT
+ *
+ * It is NOT a control, and reading it as one is the mistake to avoid. Access is already refused
+ * correctly without it: `isCredentialExpired` gates every machine front at auth time, and a grant's
+ * admission predicate compares `expiresAt` against now. An elapsed credential stops working whether
+ * or not this batch has ever run.
+ *
+ * What it fixes is the RECORD. Until 2026-09-08 nothing anywhere wrote `EXPIRED` on any of these
+ * three populations — no producer, no store TTL, no sweep — so a listing of API keys, OAuth clients
+ * or access grants showed elapsed ones as ACTIVE forever, and an operator reading it could not tell
+ * which credentials still worked (#413). Two places in the tree said so independently:
+ * `credential-rotation-grace.backend.utils.ts` in its own docstring, and a comment beside the OIDC
+ * authorization-code guard.
+ *
+ * **`expiresAt` remains the control, and the label must never become one.** If a guard ever starts
+ * reading `status` instead, a sweep that lags — and it always lags, see below — turns a stale
+ * display into an authorization hole. The pin for that lives beside the auth-time guard, not here.
+ *
+ * ## Why a sweep rather than a store-level TTL
+ *
+ * A Mongo TTL index DELETES a row; it cannot transition a status, and PostgreSQL has no native TTL
+ * at all. Deletion is the wrong outcome for a record a customer inspects — the history of an
+ * operator's access to their tenant is exactly the thing worth keeping — so a TTL is only the right
+ * mechanism where disappearance is the intent, which this is not.
+ *
+ * ## The lag is inherent, and is the accepted cost of the option chosen
+ *
+ * Between the instant a credential elapses and the next run, the row still reads ACTIVE. Daily at
+ * 02:30. Hourly was rejected: unlike the suspension sweep beside it — where a caller expresses DAYS
+ * and a daily run overshoots a one-day suspension by 100% — nothing here waits on the label, because
+ * the access already stopped. The extra 23 passes would buy a shorter display lag and nothing else.
+ *
+ * ## Every transition goes through the resource's own verb
+ *
+ * Never a direct `status` write. Each `expire` verb carries an ACTIVE-only precondition, and that
+ * guard is the reason the verbs exist: an INACTIVE api-key was retired by an administrator and a
+ * DENIED grant was refused by a tenant, so relabelling either EXPIRED would erase who ended it. A
+ * direct write would be a second authority over the field and would skip the check — the same
+ * reasoning the suspension sweep and the invitation sweep both apply.
+ *
+ * assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — a credential whose validity window has
+ * elapsed is recorded as expired, so an access review reads the same state the runtime enforces.
+ */
+import { z } from 'zod';
+import { ApiKeyStatus, AppApiKeys_Operations, AppOAuthClients_Operations, CORE_APP_ROLES, CoreResourceOperation, CoreResourceType, OAuthClientStatus, OrgApiKeys_Operations, OrgOAuthClients_Operations, PlatformAccessGrantStatus, PlatformAccessGrants_Operations, ResourcePrimaryScope, } from '@wildo-ai/saas-models';
+import { createCustomBatchExecutionService } from '../../../base-classes/services/batches/batches-cronjobs-custom-execution.service.js';
+import { ENGINE_CREDENTIAL_EXPIRY_SWEEP_BATCH_MANIFEST } from '../../../base-classes/services/batches/engine-custom-batch-manifests.js';
+import { describeCaughtError } from '../../../errors/utils/error-log-level-classification.backend.utils.js';
+/** Backstop against an unbounded loop if expiries silently fail to shrink the match set. */
+const MAX_ITERATIONS = 1000;
+const CredentialExpirySweepInputSchema = z.object({
+    /** Override: page size for the scan loops. Default: 100 */
+    batchSize: z.number().int().min(1).optional(),
+});
+const CredentialExpirySweepOutputSchema = z.object({
+    credentialsExpired: z.number().int().min(0),
+    grantsExpired: z.number().int().min(0),
+    errors: z.number().int().min(0),
+    durationMs: z.number().int().min(0),
+});
+const CREDENTIAL_EXPIRY_SWEEP_TARGETS = Object.freeze([
+    {
+        resourceType: CoreResourceType.APPLICATION_API_KEYS,
+        activeStatus: ApiKeyStatus.ACTIVE,
+        expireOperation: AppApiKeys_Operations.EXPIRE,
+        counter: 'credentialsExpired',
+    },
+    {
+        resourceType: CoreResourceType.ORG_API_KEYS,
+        activeStatus: ApiKeyStatus.ACTIVE,
+        expireOperation: OrgApiKeys_Operations.EXPIRE,
+        counter: 'credentialsExpired',
+    },
+    {
+        resourceType: CoreResourceType.OAUTH_CLIENTS_APPLICATION,
+        activeStatus: OAuthClientStatus.ACTIVE,
+        expireOperation: AppOAuthClients_Operations.EXPIRE,
+        counter: 'credentialsExpired',
+    },
+    {
+        resourceType: CoreResourceType.OAUTH_CLIENTS_ORGANIZATION,
+        activeStatus: OAuthClientStatus.ACTIVE,
+        expireOperation: OrgOAuthClients_Operations.EXPIRE,
+        counter: 'credentialsExpired',
+    },
+    {
+        resourceType: CoreResourceType.PLATFORM_ACCESS_GRANTS,
+        activeStatus: PlatformAccessGrantStatus.ACTIVE,
+        expireOperation: PlatformAccessGrants_Operations.EXPIRE,
+        counter: 'grantsExpired',
+    },
+]);
+export function createCredentialExpirySweepBatch() {
+    return createCustomBatchExecutionService({
+        input: CredentialExpirySweepInputSchema,
+        output: CredentialExpirySweepOutputSchema,
+        batchCronjob_Context: {
+            kind: ENGINE_CREDENTIAL_EXPIRY_SWEEP_BATCH_MANIFEST.kind,
+            resourceIdentifier: ENGINE_CREDENTIAL_EXPIRY_SWEEP_BATCH_MANIFEST.resourceIdentifier,
+            operationIdentifier: ENGINE_CREDENTIAL_EXPIRY_SWEEP_BATCH_MANIFEST.operationIdentifier,
+            cronJobExpression: ENGINE_CREDENTIAL_EXPIRY_SWEEP_BATCH_MANIFEST.cronExpression,
+        },
+        doHandle: async (input, { logger, servicesRegistry, resourcesRegistry, executionContextCreator }) => {
+            const startTime = Date.now();
+            const batchSize = input.batchSize ?? 100;
+            // Resolved ONCE for the whole run, like the suspension sweep: re-reading the clock per page
+            // would let a credential that elapses mid-run be picked up by a later page of the same sweep,
+            // making the run's own counters unreproducible for no benefit. Tomorrow's pass catches it.
+            const dueBefore = new Date();
+            const superAdminRoles = [{
+                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    relatedPrimaryScope: ResourcePrimaryScope.APPLICATION,
+                }];
+            const mkEc = async (resourceType, operation) => executionContextCreator.createForInternalOperation({
+                operation: resourcesRegistry.getServiceOperationPathDefault(resourceType, operation),
+                contextResourcesFieldIdentifier: new Map(),
+                initiatorIds: null,
+                initiatorRoles: superAdminRoles,
+            });
+            const counters = { credentialsExpired: 0, grantsExpired: 0 };
+            let errors = 0;
+            for (const target of CREDENTIAL_EXPIRY_SWEEP_TARGETS) {
+                // Every listed row is relabelled OUT of the matched status, so re-querying page 1 walks the
+                // shrinking match set down to zero — the same loop shape as the sibling sweeps. A row that
+                // errors stays in the set, which is what makes MAX_ITERATIONS a real backstop.
+                let iteration = 0;
+                let hasMore = true;
+                let consecutiveFailures = 0;
+                while (hasMore && iteration < MAX_ITERATIONS) {
+                    iteration++;
+                    const listEc = await mkEc(target.resourceType, CoreResourceOperation.LIST);
+                    const listResult = await servicesRegistry.list(target.resourceType, listEc, {
+                        status: target.activeStatus,
+                        // `$ne: null` matters: a credential with NO expiry never expires, and on the api-key
+                        // resources that is the common case. Without it every perpetual key would match.
+                        expiresAt: { $ne: null, $lt: dueBefore },
+                    }, { page: 1, limit: batchSize });
+                    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+                    const rows = Array.isArray(listResult) ? listResult : listResult.data;
+                    if (rows.length === 0) {
+                        hasMore = false;
+                        break;
+                    }
+                    let expiredThisPage = 0;
+                    for (const row of rows) {
+                        try {
+                            const expireEc = await mkEc(target.resourceType, target.expireOperation);
+                            await servicesRegistry.executeCustomOperation(target.resourceType, target.expireOperation, expireEc, row._id, {});
+                            counters[target.counter]++;
+                            expiredThisPage++;
+                        }
+                        catch (error) {
+                            errors++;
+                            logger.warn('Credential expiry sweep: failed to relabel an elapsed credential', {
+                                resourceType: String(target.resourceType),
+                                rowId: row?._id,
+                                operation: String(target.expireOperation),
+                                error: describeCaughtError(error),
+                            });
+                        }
+                    }
+                    // A full page that relabelled NOTHING cannot shrink, so page 1 would return the same rows
+                    // forever. Stop this target rather than burn the iteration budget re-failing the identical
+                    // set — the errors are logged and tomorrow's pass retries.
+                    if (expiredThisPage === 0) {
+                        consecutiveFailures++;
+                        if (consecutiveFailures >= 2) {
+                            logger.error('Credential expiry sweep: a full page failed twice, abandoning this target', {
+                                resourceType: String(target.resourceType),
+                                pendingRows: rows.length,
+                            });
+                            hasMore = false;
+                        }
+                    }
+                    else {
+                        consecutiveFailures = 0;
+                    }
+                }
+                if (iteration >= MAX_ITERATIONS) {
+                    logger.error('Credential expiry sweep: iteration cap reached, some rows still read as active past their expiry', {
+                        resourceType: String(target.resourceType),
+                        maxIterations: MAX_ITERATIONS,
+                    });
+                }
+            }
+            return {
+                credentialsExpired: counters.credentialsExpired,
+                grantsExpired: counters.grantsExpired,
+                errors,
+                durationMs: Date.now() - startTime,
+            };
+        },
+    });
+}
+//# sourceMappingURL=credential-expiry-sweep.batch.backend.service.js.map