@wildo-ai/saas-backend-lib 1.1.2 → 1.1.3

package/dist/esm/notifications/webhooks/controllers/webhook-auto-controller.backend.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"webhook-auto-controller.backend.service.js","sourceRoot":"","sources":["../../../../../../src/notifications/webhooks/controllers/webhook-auto-controller.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;;;;;;;;;;;;;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,EACL,sCAAsC,GAGvC,MAAM,sCAAsC,CAAC;AAG9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAMpF,OAAO,EAAE,gCAAgC,EAAE,MAAM,0FAA0F,CAAC;AAIrI,IAAM,mCAAmC,GAAzC,MAAM,mCAAoC,SAAQ,gCAAgC;IAoBT;IACE;IAnBhF,uEAAuE;IAC/D,kBAAkB,GAAG,IAAI,GAAG,EAAoC,CAAC;IAEjE,cAAc,GAAwC,IAAI,CAAC;IAEnE;;;;OAIG;IACK,eAAe,GAAG,IAAI,GAAG,EAA2B,CAAC;IAE7D,sEAAsE;IAEtE,YACqC,MAAqB,EACR,YAAwC,EACxC,YAAiC,EACL,uBAA8D,EAC5D,yBAAkE;QAEhJ,KAAK,CAAC,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,uBAAuB,CAAC,CAAC;QAHS,4BAAuB,GAAvB,uBAAuB,CAAuC;QAC5D,8BAAyB,GAAzB,yBAAyB,CAAyC;IAGlJ,CAAC;IAED,+DAA+D;IAC/D,iBAAiB;IACjB,+DAA+D;IAE/D;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACI,KAAK,CAAC,UAAU,CACrB,cAA4C;QAE5C,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QAErC,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,uBAAuB,CAAC,wBAAwB,CAAC,sCAAsC,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACxI,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;YAC1C,IAAI,CAAC;gBACH,IACE,CAAC,IAAI,CAAC,yBAAyB,CAAC,iBAAiB,CAC/C,WAAW,EACX,sCAAsC,CAAC,kBAAkB,CAC1D,EACD,CAAC;oBACD,SAAS;gBACX,CAAC;gBAED,MAAM,MAAM,GAAG,IAAI,CAAC,yBAAyB,CAAC,wBAAwB,CACpE,WAAW,EACX,sCAAsC,CAAC,kBAAkB,CAC1D,CAAC;gBACF,gEAAgE;gBAChE,mEAAmE;gBACnE,8DAA8D;gBAC9D,iEAAiE;gBACjE,qDAAqD;gBACrD,8DAA8D;gBAC9D,2DAA2D;gBAC3D,6DAA6D;gBAC7D,wBAAwB;gBACxB,MAAM,SAAS,GAAoB,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;gBAClE,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACzB,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;oBACjD,IAAI,CAAC,QAAQ,CAAC,cAAc,SAAS,CAAC,MAAM,4BAA4B,WAAW,EAAE,CAAC,CAAC;gBACzF,CAAC;qBAAM,CAAC;oBACN,kEAAkE;oBAClE,oEAAoE;oBACpE,qEAAqE;oBACrE,kEAAkE;oBAClE,kEAAkE;oBAClE,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,oCAAoC,WAAW,oGAAoG,CACpJ,CAAC;gBACJ,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2CAA2C,WAAW,EAAE,EAAE;oBACzE,KAAK,EAAG,KAAe,CAAC,OAAO;iBAChC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,4CAA4C,IAAI,CAAC,eAAe,CAAC,IAAI,cAAc,CAAC,CAAC;QAEnG,2EAA2E;QAC3E,IAAI,CAAC,qBAAqB,EAAE,CAAC;IAC/B,CAAC;IAED;;;OAGG;IACH,yBAAyB,CAAC,OAAiC;QACzD,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACzD,IAAI,CAAC,QAAQ,CAAC,6CAA6C,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IACnF,CAAC;IAED;;;;OAIG;IAEH,+DAA+D;IAC/D,SAAS;IACT,+DAA+D;IAE/D;;;;;;;;OAQG;IACO,WAAW;QACnB,mEAAmE;IACrE,CAAC;IAED;;;;;;OAMG;IACK,qBAAqB;QAC3B,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0FAA0F,CAAC,CAAC;YAC7G,OAAO;QACT,CAAC;QAED,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACpC,IAAI,CAAC,QAAQ,CAAC,wDAAwD,CAAC,CAAC;YACxE,OAAO;QACT,CAAC;QAED,KAAK,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YAC5D,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;gBACjC,MAAM,SAAS,GAAG,aAAa,WAAW,IAAI,QAAQ,CAAC,GAAG,EAAE,CAAC;gBAE7D,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,SAAS;gBACT,uEAAuE;gBACvE,uEAAuE;gBACvE,2CAA2C;gBAC3C,+DAA+D;gBAC/D,sEAAsE;gBACtE,sEAAsE;gBACtE,uEAAuE;gBACvE,wEAAwE;gBACxE,mCAAmC;gBACnC,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,EACzC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,KAAmB,EAAE,EAAE;oBAC3E,MAAM,IAAI,CAAC,oBAAoB,CAAC,WAAW,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;gBACnE,CAAC,CAAC,CACH,CAAC;gBAGF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qCAAqC,SAAS,EAAE,CAAC,CAAC;YACrE,CAAC;QACH,CAAC;IACH,CAAC;IAED,+DAA+D;IAC/D,UAAU;IACV,+DAA+D;IAEvD,KAAK,CAAC,oBAAoB,CAChC,WAAmB,EACnB,QAAuB,EACvB,GAAY,EACZ,GAAa;QAEb,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;YACnE,OAAO;QACT,CAAC;QAED,+DAA+D;QAC/D,uEAAuE;QACvE,2EAA2E;QAC3E,0EAA0E;QAC1E,yEAAyE;QACzE,yEAAyE;QACzE,oDAAoD;QACpD,mEAAmE;QACnE,8EAA8E;QAC9E,4EAA4E;QAC5E,6EAA6E;QAC7E,0EAA0E;QAC1E,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC;YAC1C,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;YAC/B,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;gBACzB,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAC5B,CAAC,CAAC,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ;oBAC5B,CAAC,CAAC,GAAG,CAAC,IAAI;oBACV,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAEjC,IAAI,MAAM,GAA+E,IAAI,CAAC;QAC9F,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC;gBAChD,WAAW;gBACX,WAAW,EAAE,QAAQ,CAAC,GAAG;gBACzB,QAAQ;gBACR,OAAO;gBACP,OAAO,EAAE,GAAG,CAAC,OAAiC;aAC/C,CAAC,CAAC;YAEH,0EAA0E;YAC1E,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;gBACzC,OAAO;YACT,CAAC;YAED,iCAAiC;YACjC,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YACjE,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;YACzE,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,KAAK,CAAC,6BAA6B,QAAQ,CAAC,UAAU,OAAO,WAAW,IAAI,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;YACxG,CAAC;YAED,MAAM,IAAI,CAAC,cAAc,CAAC,oBAAoB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;YACtE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,YAAY,GAAI,KAAe,CAAC,OAAO,IAAI,eAAe,CAAC;YACjE,MAAM,SAAS,GAAI,KAAa,EAAE,SAAS,CAAC;YAE5C,0BAA0B;YAC1B,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;gBAClC,IAAI,CAAC,QAAQ,CAAC,uCAAuC,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;gBACnG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;gBACrD,OAAO;YACT,CAAC;YAED,kDAAkD;YAClD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE;gBAC7C,WAAW;gBACX,WAAW,EAAE,QAAQ,CAAC,GAAG;gBACzB,KAAK,EAAE,YAAY;aACpB,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,cAAc,CAAC,mBAAmB,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;YACtE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;CACF,CAAA;AAnRY,mCAAmC;IAD/C,UAAU,EAAE;IAkBR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;IACzD,WAAA,MAAM,CAAC,kBAAkB,CAAC,gCAAgC,CAAC,CAAA;;GArBnD,mCAAmC,CAmR/C","sourcesContent":["/**\n * Webhook Auto-Controller Backend Service\n *\n * Auto-registers webhook routes from provider registry definitions.\n * At startup, iterates all providers with WEBHOOK_ORIGINATOR protocol,\n * then iterates each provider's endpoints, and registers:\n *   POST /webhooks/{providerRef}/{endpointKey}\n *\n * e.g., POST /webhooks/stripe/billing\n *       POST /webhooks/google/calendar\n *       POST /webhooks/google/drive\n *\n * This replaces manual per-provider webhook controllers (like BillingWebhookControllerBackendService).\n *\n * @see hook-protocol-webhook-callback.md\n */\n\nimport { injectable, inject } from 'inversify';\nimport express from 'express';\nimport type { Request, Response, NextFunction } from 'express';\nimport {\n  ExternalProvider_ExchangeProtocol_Kind,\n  type Hook_Endpoint,\n  type WebhookCapabilityHandler,\n} from '@wildo-ai/external-connectors-models';\nimport { HttpMethod } from '@wildo-ai/saas-models';\n\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport type { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport type { ErrorHandlerService } from '~wildo-backend-lib/errors/services/error-handler.backend.service';\nimport type { BackendProviderRegistryBackendService } from '~wildo-backend-lib/external-providers/services/backend-provider-registry.backend.service';\nimport type { ExternalProvidersRegistryBackendService } from '~wildo-backend-lib/external-providers/services/external-providers-registry.backend.service';\nimport { AbstractControllerBackendService } from '~wildo-backend-lib/base-classes/services/controllers/abstract-controller.backend.service';\nimport type { WebhookHandlerBackendService } from '~wildo-backend-lib/notifications/webhooks/services/webhook-handler.backend.service';\n\n@injectable()\nexport class WebhookAutoControllerBackendService extends AbstractControllerBackendService {\n\n  /** Capability handlers keyed by capability string (e.g., 'billing') */\n  private capabilityHandlers = new Map<string, WebhookCapabilityHandler>();\n\n  private webhookHandler: WebhookHandlerBackendService | null = null;\n\n  /**\n   * Pre-loaded endpoint configurations per provider.\n   * Populated during initialize() from first-class provider runtime contracts.\n   * setupRoutes() reads from this cache (sync) to register routes.\n   */\n  private loadedEndpoints = new Map<string, Hook_Endpoint[]>();\n\n  /** Routes recorded only after Express accepted their registration. */\n\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Logger) logger: LoggerService,\n    @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) errorBuilder: ErrorBuilderBackendService,\n    @inject(SAAS_SERVICE_TYPES.ErrorHandlerService) errorHandler: ErrorHandlerService,\n    @inject(SAAS_SERVICE_TYPES.BackendProviderRegistryService) private readonly backendProviderRegistry: BackendProviderRegistryBackendService,\n    @inject(SAAS_SERVICE_TYPES.ExternalProvidersRegistryService) private readonly externalProvidersRegistry: ExternalProvidersRegistryBackendService,\n  ) {\n    super(logger, errorBuilder, errorHandler, 'WebhookAutoController');\n  }\n\n  // ════════════════════════════════════════════════════════════\n  // Initialization\n  // ════════════════════════════════════════════════════════════\n\n  /**\n   * Initialize with required dependencies, pre-load endpoint configs, AND\n   * register the webhook routes.\n   *\n   * ── Why routes are registered HERE, not in `setupRoutes()` ──────────────\n   *\n   * `AbstractControllerBackendService` calls the abstract `setupRoutes()` hook\n   * synchronously from *inside its own constructor* (`super(...)`). At that\n   * point this controller has NOTHING to register:\n   *\n   *   1. The webhook handler is not injected via the constructor — it is\n   *      supplied to `initialize()` by `start-application` after the billing /\n   *      provider layers are wired.\n   *   2. The route SET is data-dependent (one route per provider webhook\n   *      endpoint), and those endpoint contracts are only knowable after the\n   *      provider registries have been initialized (which happens later in the\n   *      startup sequence than DI construction).\n   *\n   * So `setupRoutes()` is a deliberate no-op (see its JSDoc) and the real,\n   * data-dependent route registration runs here — the same lifecycle shape\n   * `ControllerResourceBackendService` uses for its per-resource routes.\n   *\n   * `start-application` calls this BEFORE the controllers registry mounts the\n   * router (via `getRouter()`), so the routes added here are present when the\n   * master router mounts this controller's router by reference. Errors thrown\n   * from webhook handlers propagate to the app-level error middleware\n   * (`HttpServerBackendService`), so no router-scoped error handler is needed\n   * after these routes.\n   */\n  public async initialize(\n    webhookHandler: WebhookHandlerBackendService,\n  ): Promise<void> {\n    this.webhookHandler = webhookHandler;\n\n    for (const provider of this.backendProviderRegistry.getProvidersWithProtocol(ExternalProvider_ExchangeProtocol_Kind.WEBHOOK_ORIGINATOR)) {\n      const providerRef = provider.metadata.ref;\n      try {\n        if (\n          !this.externalProvidersRegistry.isProviderEnabled(\n            providerRef,\n            ExternalProvider_ExchangeProtocol_Kind.WEBHOOK_ORIGINATOR,\n          )\n        ) {\n          continue;\n        }\n\n        const config = this.externalProvidersRegistry.getProviderConfiguration(\n          providerRef,\n          ExternalProvider_ExchangeProtocol_Kind.WEBHOOK_ORIGINATOR,\n        );\n        // `config.endpoints` is `ReadonlyArray<Hook_Endpoint>` post the\n        // 2026-05-06 webhook endpoint reshape: `Hook_Endpoint.displayName`\n        // is now optional (matches the runtime emission) and the dead\n        // extras (`providerRef` / `path` / `secretBinding`) were dropped\n        // from `buildWebhookEndpoints`. The local cache is a\n        // `Map<string, Hook_Endpoint[]>`, so we materialize a mutable\n        // copy here — the cache was historically `Hook_Endpoint[]`\n        // (mutable); preserving that semantics avoids touching every\n        // downstream signature.\n        const endpoints: Hook_Endpoint[] = [...(config?.endpoints ?? [])];\n        if (endpoints.length > 0) {\n          this.loadedEndpoints.set(providerRef, endpoints);\n          this.logDebug(`Pre-loaded ${endpoints.length} webhook endpoint(s) for ${providerRef}`);\n        } else {\n          // Genuine contract fault (not the expected \"no webhook providers\"\n          // case): the provider is ENABLED for WEBHOOK_ORIGINATOR yet exposes\n          // zero endpoints, so it will silently never receive inbound webhooks\n          // (e.g. Stripe would 404 on /webhooks/stripe/billing). Surface it\n          // once, clearly — this is a mis-sequence, not steady-state noise.\n          this.logger.warn(\n            `WebhookAutoController: provider '${providerRef}' is enabled for WEBHOOK_ORIGINATOR but exposes no endpoints — no routes will be registered for it`,\n          );\n        }\n      } catch (error) {\n        this.logger.warn(`Failed to pre-load webhook protocol for ${providerRef}`, {\n          error: (error as Error).message,\n        });\n      }\n    }\n\n    this.logDebug(`Webhook auto-controller initialized with ${this.loadedEndpoints.size} provider(s)`);\n\n    // Register the routes now that the handler + endpoint contracts are known.\n    this.registerWebhookRoutes();\n  }\n\n  /**\n   * Register a capability handler for dispatching processed events.\n   * Called at startup by capability modules (e.g., billing module).\n   */\n  registerCapabilityHandler(handler: WebhookCapabilityHandler): void {\n    this.capabilityHandlers.set(handler.capability, handler);\n    this.logDebug(`Registered webhook capability handler for ${handler.capability}`);\n  }\n\n  /**\n   * Return the sanitized inbound-provider routes that this controller actually\n   * registered. Provider configuration, signature material, endpoint payloads,\n   * and handler metadata are intentionally absent.\n   */\n\n  // ════════════════════════════════════════════════════════════\n  // Routes\n  // ════════════════════════════════════════════════════════════\n\n  /**\n   * Required by `AbstractControllerBackendService`, which invokes this hook\n   * synchronously from its constructor (`super(...)`). This controller\n   * intentionally registers NOTHING here: its route set is data-dependent\n   * (one route per provider webhook endpoint) and neither the webhook handler\n   * nor the provider endpoint contracts exist at construction time. The real\n   * registration happens in `initialize()` / `registerWebhookRoutes()` once\n   * that data is available — see `initialize()`'s JSDoc for the full rationale.\n   */\n  protected setupRoutes(): void {\n    // No-op by design — see JSDoc above and `registerWebhookRoutes()`.\n  }\n\n  /**\n   * Register one Express route per pre-loaded provider webhook endpoint.\n   * Invoked from `initialize()` after `webhookHandler` and `loadedEndpoints`\n   * have been populated. Idempotent-safe against an empty cache; guards on the\n   * handler so a mis-sequenced call fails visibly rather than registering dead\n   * routes.\n   */\n  private registerWebhookRoutes(): void {\n    if (!this.webhookHandler) {\n      this.logger.warn('WebhookAutoController: initialize() ran without a webhook handler — no routes registered');\n      return;\n    }\n\n    if (this.loadedEndpoints.size === 0) {\n      this.logDebug('No webhook endpoints pre-loaded — no routes registered');\n      return;\n    }\n\n    for (const [providerRef, endpoints] of this.loadedEndpoints) {\n      for (const endpoint of endpoints) {\n        const routePath = `/webhooks/${providerRef}/${endpoint.key}`;\n\n        this.router.post(\n          routePath,\n          // Defense-in-depth for a future streaming mount. If this controller is\n          // ever assigned the RAW_REQUEST_STREAM mount phase, this express.raw()\n          // makes req.body the raw Buffer. Under the\n          // current master-router mount it is an inert no-op: the global\n          // express.json (HttpServerBackendService.setupBodyParsing) parses the\n          // body first and sets req._body, so the signature-faithful bytes come\n          // from req.rawBody — captured by that same express.json `verify` hook.\n          // handleWebhookRequest reads rawBody first, then falls back to a Buffer\n          // req.body for the streaming case.\n          express.raw({ type: 'application/json' }),\n          this.asyncHandler(async (req: Request, res: Response, _next: NextFunction) => {\n            await this.handleWebhookRequest(providerRef, endpoint, req, res);\n          }),\n        );\n\n\n        this.logger.info(`Webhook endpoint registered: POST ${routePath}`);\n      }\n    }\n  }\n\n  // ════════════════════════════════════════════════════════════\n  // Handler\n  // ════════════════════════════════════════════════════════════\n\n  private async handleWebhookRequest(\n    providerRef: string,\n    endpoint: Hook_Endpoint,\n    req: Request,\n    res: Response,\n  ): Promise<void> {\n    if (!this.webhookHandler) {\n      res.status(503).json({ error: 'Webhook handler not initialized' });\n      return;\n    }\n\n    // Raw request bytes for signature verification. Order matters:\n    //   1. req.rawBody — captured by the global express.json `verify` hook\n    //      (HttpServerBackendService.setupBodyParsing). This is the provider's\n    //      EXACT original payload and the ONLY byte-faithful source under the\n    //      current master-router mount, where global express.json parses the\n    //      body before this route runs (making the per-route express.raw() a\n    //      no-op, so req.body is a parsed object here).\n    //   2. Buffer req.body — only populated if this controller is ever\n    //      streaming-mounted before body parsing (per-route express.raw() fires).\n    //   3. string / JSON.stringify — last-resort fallbacks; JSON.stringify will\n    //      NOT byte-match the provider (key ordering / whitespace), so it exists\n    //      only to avoid a crash, never as a correctness path for signatures.\n    const rawBody = Buffer.isBuffer(req.rawBody)\n      ? req.rawBody.toString('utf-8')\n      : Buffer.isBuffer(req.body)\n        ? req.body.toString('utf-8')\n        : typeof req.body === 'string'\n          ? req.body\n          : JSON.stringify(req.body);\n\n    let result: Awaited<ReturnType<WebhookHandlerBackendService['processWebhook']>> | null = null;\n    try {\n      result = await this.webhookHandler.processWebhook({\n        providerRef,\n        endpointKey: endpoint.key,\n        endpoint,\n        rawBody,\n        headers: req.headers as Record<string, string>,\n      });\n\n      // null = idempotent duplicate or unparseable event — already acknowledged\n      if (!result) {\n        res.status(200).json({ received: true });\n        return;\n      }\n\n      // Dispatch to capability handler\n      const handler = this.capabilityHandlers.get(endpoint.capability);\n      if (handler) {\n        await handler.handleEvent(result.executionContext, result.parsedEvent);\n      } else {\n        throw new Error(`No capability handler for ${endpoint.capability} on ${providerRef}/${endpoint.key}`);\n      }\n\n      await this.webhookHandler.markWebhookProcessed(result.idempotencyKey);\n      res.status(200).json({ received: true });\n    } catch (error) {\n      const errorMessage = (error as Error).message ?? 'Unknown error';\n      const errorType = (error as any)?.errorType;\n\n      // Signature failure → 401\n      if (errorType === 'AUTHORIZATION') {\n        this.logDebug('Webhook signature verification failed', { providerRef, endpointKey: endpoint.key });\n        res.status(401).json({ error: 'Invalid signature' });\n        return;\n      }\n\n      // All other errors → 500 (trigger provider retry)\n      this.logger.error('Webhook processing failed', {\n        providerRef,\n        endpointKey: endpoint.key,\n        error: errorMessage,\n      });\n      await this.webhookHandler.releaseWebhookClaim(result?.idempotencyKey);\n      res.status(500).json({ error: 'Processing failed' });\n    }\n  }\n}\n"]}
+{"version":3,"file":"webhook-auto-controller.backend.service.js","sourceRoot":"","sources":["../../../../../../src/notifications/webhooks/controllers/webhook-auto-controller.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;;;;;;;;;;;;;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,EACL,sCAAsC,GAGvC,MAAM,sCAAsC,CAAC;AAG9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAMpF,OAAO,EAAE,gCAAgC,EAAE,MAAM,0FAA0F,CAAC;AAG5I;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,6BAaX;AAbD,WAAY,6BAA6B;IACvC;;;;OAIG;IACH,gFAA+C,CAAA;IAC/C;;;;OAIG;IACH,4EAA2C,CAAA;AAC7C,CAAC,EAbW,6BAA6B,KAA7B,6BAA6B,QAaxC;AAYM,IAAM,mCAAmC,GAAzC,MAAM,mCAAoC,SAAQ,gCAAgC;IAoCT;IACE;IAnChF,uEAAuE;IAC/D,kBAAkB,GAAG,IAAI,GAAG,EAAoC,CAAC;IAEjE,cAAc,GAAwC,IAAI,CAAC;IAEnE;;;;OAIG;IACK,eAAe,GAAG,IAAI,GAAG,EAA2B,CAAC;IAE7D,2EAA2E;IACnE,oBAAoB,GAAa,EAAE,CAAC;IAE5C;;;;OAIG;IACK,cAAc,GAA8B,EAAE,CAAC;IAEvD;;;;;OAKG;IACK,gBAAgB,GAAG,KAAK,CAAC;IAEjC,YACqC,MAAqB,EACR,YAAwC,EACxC,YAAiC,EACL,uBAA8D,EAC5D,yBAAkE;QAEhJ,KAAK,CAAC,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,uBAAuB,CAAC,CAAC;QAHS,4BAAuB,GAAvB,uBAAuB,CAAuC;QAC5D,8BAAyB,GAAzB,yBAAyB,CAAyC;IAGlJ,CAAC;IAED,+DAA+D;IAC/D,iBAAiB;IACjB,+DAA+D;IAE/D;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACI,KAAK,CAAC,UAAU,CACrB,cAA4C;QAE5C,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QAErC,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,uBAAuB,CAAC,wBAAwB,CAAC,sCAAsC,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACxI,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;YAC1C,IAAI,CAAC;gBACH,IACE,CAAC,IAAI,CAAC,yBAAyB,CAAC,iBAAiB,CAC/C,WAAW,EACX,sCAAsC,CAAC,kBAAkB,CAC1D,EACD,CAAC;oBACD,SAAS;gBACX,CAAC;gBAED,MAAM,MAAM,GAAG,IAAI,CAAC,yBAAyB,CAAC,wBAAwB,CACpE,WAAW,EACX,sCAAsC,CAAC,kBAAkB,CAC1D,CAAC;gBACF,gEAAgE;gBAChE,mEAAmE;gBACnE,8DAA8D;gBAC9D,iEAAiE;gBACjE,qDAAqD;gBACrD,8DAA8D;gBAC9D,2DAA2D;gBAC3D,6DAA6D;gBAC7D,wBAAwB;gBACxB,MAAM,SAAS,GAAoB,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;gBAClE,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACzB,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;oBACjD,IAAI,CAAC,QAAQ,CAAC,cAAc,SAAS,CAAC,MAAM,4BAA4B,WAAW,EAAE,CAAC,CAAC;gBACzF,CAAC;qBAAM,CAAC;oBACN,kEAAkE;oBAClE,oEAAoE;oBACpE,qEAAqE;oBACrE,kEAAkE;oBAClE,kEAAkE;oBAClE,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,oCAAoC,WAAW,oGAAoG,CACpJ,CAAC;gBACJ,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2CAA2C,WAAW,EAAE,EAAE;oBACzE,KAAK,EAAG,KAAe,CAAC,OAAO;iBAChC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,4CAA4C,IAAI,CAAC,eAAe,CAAC,IAAI,cAAc,CAAC,CAAC;QAEnG,2EAA2E;QAC3E,IAAI,CAAC,qBAAqB,EAAE,CAAC;IAC/B,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,yBAAyB,CAAC,OAAiC;QACzD,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAEzD,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,kDAAkD,OAAO,CAAC,UAAU,sDAAsD;kBACxH,6HAA6H;kBAC7H,qFAAqF;kBACrF,4FAA4F,EAC9F;gBACE,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,cAAc,EAAE,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC;aAChF,CACF,CAAC;YACF,OAAO;QACT,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,6CAA6C,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IACnF,CAAC;IAED;;;;OAIG;IACI,8BAA8B;QACnC,OAAO,CAAC,GAAG,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACxC,CAAC;IAED;;;;OAIG;IACI,wBAAwB;QAC7B,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,WAAW,EAAE,OAAO,EAAE,CAAC,GAAG,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3G,CAAC;IAED,+DAA+D;IAC/D,SAAS;IACT,+DAA+D;IAE/D;;;;;;;;OAQG;IACO,WAAW;QACnB,mEAAmE;IACrE,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6CG;IACK,qBAAqB;QAC3B,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;QAE7B,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0FAA0F,CAAC,CAAC;YAC7G,OAAO;QACT,CAAC;QAED,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACpC,IAAI,CAAC,QAAQ,CAAC,wDAAwD,CAAC,CAAC;YACxE,OAAO;QACT,CAAC;QAED,KAAK,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YAC5D,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;gBACjC,MAAM,SAAS,GAAG,aAAa,WAAW,IAAI,QAAQ,CAAC,GAAG,EAAE,CAAC;gBAE7D,MAAM,WAAW,GAAG,IAAI,CAAC,0BAA0B,CAAC,WAAW,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;gBACtF,IAAI,WAAW,EAAE,CAAC;oBAChB,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;oBACtC,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,+CAA+C,SAAS,uDAAuD;0BAC7G,IAAI,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,iFAAiF;0BACnH,kHAAkH;0BAClH,gEAAgE;0BAChE,IAAI,QAAQ,CAAC,UAAU,6FAA6F;0BACpH,kHAAkH;0BAClH,0BAA0B,WAAW,IAAI,EAC3C;wBACE,WAAW;wBACX,WAAW,EAAE,QAAQ,CAAC,GAAG;wBACzB,UAAU,EAAE,QAAQ,CAAC,UAAU;wBAC/B,SAAS;wBACT,OAAO,EAAE,WAAW,CAAC,OAAO;qBAC7B,CACF,CAAC;oBACF,SAAS;gBACX,CAAC;gBAED,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,SAAS;gBACT,uEAAuE;gBACvE,uEAAuE;gBACvE,2CAA2C;gBAC3C,+DAA+D;gBAC/D,sEAAsE;gBACtE,sEAAsE;gBACtE,uEAAuE;gBACvE,wEAAwE;gBACxE,mCAAmC;gBACnC,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,EACzC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,KAAmB,EAAE,EAAE;oBAC3E,MAAM,IAAI,CAAC,oBAAoB,CAAC,WAAW,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;gBACnE,CAAC,CAAC,CACH,CAAC;gBAEF,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAC1C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qCAAqC,SAAS,EAAE,CAAC,CAAC;YACrE,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACK,0BAA0B,CAChC,WAAmB,EACnB,QAAuB,EACvB,SAAiB;QAEjB,MAAM,OAAO,GAAoC,EAAE,CAAC;QAEpD,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACtD,OAAO,CAAC,IAAI,CAAC,6BAA6B,CAAC,qBAAqB,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,UAAU,CAAC,WAAW,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAChE,OAAO,CAAC,IAAI,CAAC,6BAA6B,CAAC,mBAAmB,CAAC,CAAC;QAClE,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,CAAC,GAAG,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;IACzG,CAAC;IAED,+DAA+D;IAC/D,UAAU;IACV,+DAA+D;IAEvD,KAAK,CAAC,oBAAoB,CAChC,WAAmB,EACnB,QAAuB,EACvB,GAAY,EACZ,GAAa;QAEb,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;YACnE,OAAO;QACT,CAAC;QAED,+DAA+D;QAC/D,uEAAuE;QACvE,2EAA2E;QAC3E,0EAA0E;QAC1E,yEAAyE;QACzE,yEAAyE;QACzE,oDAAoD;QACpD,mEAAmE;QACnE,8EAA8E;QAC9E,4EAA4E;QAC5E,6EAA6E;QAC7E,0EAA0E;QAC1E,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC;YAC1C,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;YAC/B,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;gBACzB,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAC5B,CAAC,CAAC,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ;oBAC5B,CAAC,CAAC,GAAG,CAAC,IAAI;oBACV,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAEjC,IAAI,MAAM,GAA+E,IAAI,CAAC;QAC9F,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC;gBAChD,WAAW;gBACX,WAAW,EAAE,QAAQ,CAAC,GAAG;gBACzB,QAAQ;gBACR,OAAO;gBACP,OAAO,EAAE,GAAG,CAAC,OAAiC;aAC/C,CAAC,CAAC;YAEH,0EAA0E;YAC1E,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;gBACzC,OAAO;YACT,CAAC;YAED,kCAAkC;YAClC,EAAE;YACF,0EAA0E;YAC1E,4EAA4E;YAC5E,4EAA4E;YAC5E,2EAA2E;YAC3E,oEAAoE;YACpE,uDAAuD;YACvD,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YACjE,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;YACzE,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,KAAK,CAAC,6BAA6B,QAAQ,CAAC,UAAU,OAAO,WAAW,IAAI,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;YACxG,CAAC;YAED,MAAM,IAAI,CAAC,cAAc,CAAC,oBAAoB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;YACtE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,YAAY,GAAI,KAAe,CAAC,OAAO,IAAI,eAAe,CAAC;YACjE,MAAM,SAAS,GAAI,KAAa,EAAE,SAAS,CAAC;YAE5C,0BAA0B;YAC1B,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;gBAClC,IAAI,CAAC,QAAQ,CAAC,uCAAuC,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;gBACnG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;gBACrD,OAAO;YACT,CAAC;YAED,kDAAkD;YAClD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE;gBAC7C,WAAW;gBACX,WAAW,EAAE,QAAQ,CAAC,GAAG;gBACzB,KAAK,EAAE,YAAY;aACpB,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,cAAc,CAAC,mBAAmB,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;YACtE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;CACF,CAAA;AA3aY,mCAAmC;IAD/C,UAAU,EAAE;IAkCR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;IACzD,WAAA,MAAM,CAAC,kBAAkB,CAAC,gCAAgC,CAAC,CAAA;;GArCnD,mCAAmC,CA2a/C","sourcesContent":["/**\n * Webhook Auto-Controller Backend Service\n *\n * Auto-registers webhook routes from provider registry definitions.\n * At startup, iterates all providers with WEBHOOK_ORIGINATOR protocol,\n * then iterates each provider's endpoints, and registers:\n *   POST /webhooks/{providerRef}/{endpointKey}\n *\n * One provider declares the protocol today, and it declares one endpoint:\n *   POST /webhooks/stripe/billing\n *\n * A second provider registers here the moment it declares `WEBHOOK_ORIGINATOR` with its own\n * `endpoints`; no edit to this controller is needed.\n *\n * This replaces manual per-provider webhook controllers (like BillingWebhookControllerBackendService).\n *\n * @see hook-protocol-webhook-callback.md\n */\n\nimport { injectable, inject } from 'inversify';\nimport express from 'express';\nimport type { Request, Response, NextFunction } from 'express';\nimport {\n  ExternalProvider_ExchangeProtocol_Kind,\n  type Hook_Endpoint,\n  type WebhookCapabilityHandler,\n} from '@wildo-ai/external-connectors-models';\nimport { HttpMethod } from '@wildo-ai/saas-models';\n\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport type { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport type { ErrorHandlerService } from '~wildo-backend-lib/errors/services/error-handler.backend.service';\nimport type { BackendProviderRegistryBackendService } from '~wildo-backend-lib/external-providers/services/backend-provider-registry.backend.service';\nimport type { ExternalProvidersRegistryBackendService } from '~wildo-backend-lib/external-providers/services/external-providers-registry.backend.service';\nimport { AbstractControllerBackendService } from '~wildo-backend-lib/base-classes/services/controllers/abstract-controller.backend.service';\nimport type { WebhookHandlerBackendService } from '~wildo-backend-lib/notifications/webhooks/services/webhook-handler.backend.service';\n\n/**\n * Why a declared webhook endpoint did NOT get an Express route.\n *\n * A closed vocabulary rather than a free string: each member names a DIFFERENT\n * missing registration, with a different remedy, and an operator reading the\n * startup log has to be able to tell them apart. The two are independent — an\n * endpoint can be missing either, or both.\n */\nexport enum WebhookRouteWithholdingReason {\n  /**\n   * No {@link WebhookCapabilityHandler} is registered for the endpoint's\n   * `capability`. The route would reach `handleWebhookRequest`, complete\n   * signature verification and idempotency claiming, then fail at dispatch.\n   */\n  NO_CAPABILITY_HANDLER = 'NO_CAPABILITY_HANDLER',\n  /**\n   * No `WebhookCapabilityAdapter` is registered for `providerRef:endpointKey`\n   * on {@link WebhookHandlerBackendService}. The route would fail at the very\n   * top of `processWebhook`, before signature verification.\n   */\n  NO_ENDPOINT_ADAPTER = 'NO_ENDPOINT_ADAPTER',\n}\n\n/** One declared endpoint whose route was deliberately not mounted, and why. */\nexport interface WebhookRouteWithholding {\n  providerRef: string;\n  endpointKey: string;\n  capability: string;\n  routePath: string;\n  reasons: WebhookRouteWithholdingReason[];\n}\n\n@injectable()\nexport class WebhookAutoControllerBackendService extends AbstractControllerBackendService {\n\n  /** Capability handlers keyed by capability string (e.g., 'billing') */\n  private capabilityHandlers = new Map<string, WebhookCapabilityHandler>();\n\n  private webhookHandler: WebhookHandlerBackendService | null = null;\n\n  /**\n   * Pre-loaded endpoint configurations per provider.\n   * Populated during initialize() from first-class provider runtime contracts.\n   * setupRoutes() reads from this cache (sync) to register routes.\n   */\n  private loadedEndpoints = new Map<string, Hook_Endpoint[]>();\n\n  /** Route paths recorded only after Express accepted their registration. */\n  private registeredRoutePaths: string[] = [];\n\n  /**\n   * Declared endpoints whose route was WITHHELD because the capability could\n   * not be dispatched. Kept so the decision is inspectable after startup rather\n   * than only visible in a log line that has already scrolled past.\n   */\n  private withheldRoutes: WebhookRouteWithholding[] = [];\n\n  /**\n   * Set once {@link registerWebhookRoutes} has run. The mount decision is taken\n   * ONCE, from the registration state at that instant, so anything registered\n   * afterwards cannot change which routes exist — see\n   * {@link registerCapabilityHandler}, which refuses to let that be silent.\n   */\n  private routesRegistered = false;\n\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Logger) logger: LoggerService,\n    @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) errorBuilder: ErrorBuilderBackendService,\n    @inject(SAAS_SERVICE_TYPES.ErrorHandlerService) errorHandler: ErrorHandlerService,\n    @inject(SAAS_SERVICE_TYPES.BackendProviderRegistryService) private readonly backendProviderRegistry: BackendProviderRegistryBackendService,\n    @inject(SAAS_SERVICE_TYPES.ExternalProvidersRegistryService) private readonly externalProvidersRegistry: ExternalProvidersRegistryBackendService,\n  ) {\n    super(logger, errorBuilder, errorHandler, 'WebhookAutoController');\n  }\n\n  // ════════════════════════════════════════════════════════════\n  // Initialization\n  // ════════════════════════════════════════════════════════════\n\n  /**\n   * Initialize with required dependencies, pre-load endpoint configs, AND\n   * register the webhook routes.\n   *\n   * ── Why routes are registered HERE, not in `setupRoutes()` ──────────────\n   *\n   * `AbstractControllerBackendService` calls the abstract `setupRoutes()` hook\n   * synchronously from *inside its own constructor* (`super(...)`). At that\n   * point this controller has NOTHING to register:\n   *\n   *   1. The webhook handler is not injected via the constructor — it is\n   *      supplied to `initialize()` by `start-application` after the billing /\n   *      provider layers are wired.\n   *   2. The route SET is data-dependent (one route per provider webhook\n   *      endpoint), and those endpoint contracts are only knowable after the\n   *      provider registries have been initialized (which happens later in the\n   *      startup sequence than DI construction).\n   *\n   * So `setupRoutes()` is a deliberate no-op (see its JSDoc) and the real,\n   * data-dependent route registration runs here — the same lifecycle shape\n   * `ControllerResourceBackendService` uses for its per-resource routes.\n   *\n   * `start-application` calls this BEFORE the controllers registry mounts the\n   * router (via `getRouter()`), so the routes added here are present when the\n   * master router mounts this controller's router by reference. Errors thrown\n   * from webhook handlers propagate to the app-level error middleware\n   * (`HttpServerBackendService`), so no router-scoped error handler is needed\n   * after these routes.\n   */\n  public async initialize(\n    webhookHandler: WebhookHandlerBackendService,\n  ): Promise<void> {\n    this.webhookHandler = webhookHandler;\n\n    for (const provider of this.backendProviderRegistry.getProvidersWithProtocol(ExternalProvider_ExchangeProtocol_Kind.WEBHOOK_ORIGINATOR)) {\n      const providerRef = provider.metadata.ref;\n      try {\n        if (\n          !this.externalProvidersRegistry.isProviderEnabled(\n            providerRef,\n            ExternalProvider_ExchangeProtocol_Kind.WEBHOOK_ORIGINATOR,\n          )\n        ) {\n          continue;\n        }\n\n        const config = this.externalProvidersRegistry.getProviderConfiguration(\n          providerRef,\n          ExternalProvider_ExchangeProtocol_Kind.WEBHOOK_ORIGINATOR,\n        );\n        // `config.endpoints` is `ReadonlyArray<Hook_Endpoint>` post the\n        // 2026-05-06 webhook endpoint reshape: `Hook_Endpoint.displayName`\n        // is now optional (matches the runtime emission) and the dead\n        // extras (`providerRef` / `path` / `secretBinding`) were dropped\n        // from `buildWebhookEndpoints`. The local cache is a\n        // `Map<string, Hook_Endpoint[]>`, so we materialize a mutable\n        // copy here — the cache was historically `Hook_Endpoint[]`\n        // (mutable); preserving that semantics avoids touching every\n        // downstream signature.\n        const endpoints: Hook_Endpoint[] = [...(config?.endpoints ?? [])];\n        if (endpoints.length > 0) {\n          this.loadedEndpoints.set(providerRef, endpoints);\n          this.logDebug(`Pre-loaded ${endpoints.length} webhook endpoint(s) for ${providerRef}`);\n        } else {\n          // Genuine contract fault (not the expected \"no webhook providers\"\n          // case): the provider is ENABLED for WEBHOOK_ORIGINATOR yet exposes\n          // zero endpoints, so it will silently never receive inbound webhooks\n          // (e.g. Stripe would 404 on /webhooks/stripe/billing). Surface it\n          // once, clearly — this is a mis-sequence, not steady-state noise.\n          this.logger.warn(\n            `WebhookAutoController: provider '${providerRef}' is enabled for WEBHOOK_ORIGINATOR but exposes no endpoints — no routes will be registered for it`,\n          );\n        }\n      } catch (error) {\n        this.logger.warn(`Failed to pre-load webhook protocol for ${providerRef}`, {\n          error: (error as Error).message,\n        });\n      }\n    }\n\n    this.logDebug(`Webhook auto-controller initialized with ${this.loadedEndpoints.size} provider(s)`);\n\n    // Register the routes now that the handler + endpoint contracts are known.\n    this.registerWebhookRoutes();\n  }\n\n  /**\n   * Register a capability handler for dispatching processed events.\n   * Called at startup by capability modules (e.g., billing module).\n   *\n   * MUST be called before {@link initialize}. `start-application` satisfies this\n   * ordering today — step 4.5 initializes capability modules (which register\n   * here) and step 4.6 initializes this controller — and the guard below exists\n   * so a future step inserted the other way round is LOUD instead of silent.\n   *\n   * The failure it catches is genuinely confusing without it: a late-registered\n   * handler works perfectly at request time (the map is read per request), but\n   * the route it would serve was already withheld at mount time, so the endpoint\n   * answers 404 while a handler for it demonstrably exists.\n   */\n  registerCapabilityHandler(handler: WebhookCapabilityHandler): void {\n    this.capabilityHandlers.set(handler.capability, handler);\n\n    if (this.routesRegistered) {\n      this.logger.error(\n        `WebhookAutoController: capability handler for '${handler.capability}' was registered AFTER webhook routes were mounted. `\n        + 'Route mounting is decided once, from the registrations present at that moment, so this handler cannot bring back any route '\n        + 'that was withheld for a missing handler — those endpoints will keep answering 404. '\n        + 'Register capability handlers before WebhookAutoControllerBackendService.initialize() runs.',\n        {\n          capability: handler.capability,\n          withheldRoutes: this.withheldRoutes.map((withholding) => withholding.routePath),\n        },\n      );\n      return;\n    }\n\n    this.logDebug(`Registered webhook capability handler for ${handler.capability}`);\n  }\n\n  /**\n   * Return the sanitized inbound-provider routes that this controller actually\n   * registered. Provider configuration, signature material, endpoint payloads,\n   * and handler metadata are intentionally absent.\n   */\n  public getRegisteredWebhookRoutePaths(): ReadonlyArray<string> {\n    return [...this.registeredRoutePaths];\n  }\n\n  /**\n   * Return the declared endpoints whose route was deliberately NOT mounted,\n   * with the reason. Carries no provider configuration or signature material —\n   * only the route identity and which registration was missing.\n   */\n  public getWithheldWebhookRoutes(): ReadonlyArray<WebhookRouteWithholding> {\n    return this.withheldRoutes.map((withholding) => ({ ...withholding, reasons: [...withholding.reasons] }));\n  }\n\n  // ════════════════════════════════════════════════════════════\n  // Routes\n  // ════════════════════════════════════════════════════════════\n\n  /**\n   * Required by `AbstractControllerBackendService`, which invokes this hook\n   * synchronously from its constructor (`super(...)`). This controller\n   * intentionally registers NOTHING here: its route set is data-dependent\n   * (one route per provider webhook endpoint) and neither the webhook handler\n   * nor the provider endpoint contracts exist at construction time. The real\n   * registration happens in `initialize()` / `registerWebhookRoutes()` once\n   * that data is available — see `initialize()`'s JSDoc for the full rationale.\n   */\n  protected setupRoutes(): void {\n    // No-op by design — see JSDoc above and `registerWebhookRoutes()`.\n  }\n\n  /**\n   * Register one Express route per pre-loaded provider webhook endpoint —\n   * EXCEPT those whose capability cannot actually be dispatched.\n   *\n   * Invoked from `initialize()` after `webhookHandler` and `loadedEndpoints`\n   * have been populated. Idempotent-safe against an empty cache; guards on the\n   * handler so a mis-sequenced call fails visibly rather than registering dead\n   * routes.\n   *\n   * ── Why an undispatchable endpoint is WITHHELD rather than mounted ────────\n   *\n   * A declared endpoint needs two registrations that this controller does not\n   * own and cannot create: a `WebhookCapabilityAdapter` (verify + parse, on\n   * `WebhookHandlerBackendService`) and a `WebhookCapabilityHandler` (dispatch,\n   * here). Both are supplied by the capability module — for `billing`, inside\n   * `start-application.initializeBillingServices`, which is deliberately\n   * NON-FATAL: if it throws part-way, or if `billing.enabled` is false while the\n   * provider is still enabled for `WEBHOOK_ORIGINATOR`, the application boots\n   * with the provider's endpoint declared and neither registration present.\n   *\n   * Mounting a route in that state produces a 500 on every inbound delivery\n   * (`No webhook adapter registered for ...`, or `No capability handler for ...`\n   * below), and a 500 is precisely the answer that tells a vendor to RETRY — an\n   * instruction that can never be satisfied, because no retry supplies a missing\n   * startup registration. The endpoint therefore absorbs the vendor's full retry\n   * schedule and eventually gets disabled on the vendor's side, while the only\n   * local signal is a repeating error log.\n   *\n   * Not mounting says the true thing instead: this endpoint does not exist. The\n   * vendor gets a 404 rather than a retry instruction, and the operator gets one\n   * loud, remedy-naming error at startup — the moment the misconfiguration was\n   * actually introduced.\n   *\n   * REJECTED — refusing at BOOT (throwing from here). It is the shape the rest of\n   * the registry uses, and it is wrong at this site for three reasons. (1) It\n   * would not even be loud: `start-application.initializeWebhookAutoController`\n   * wraps `initialize()` in a non-fatal catch that downgrades a throw to a warn,\n   * so the net effect would be a quieter log AND the loss of every OTHER\n   * provider's working route. (2) It inverts a decision the engine already took\n   * explicitly — billing initialization failure is documented as survivable\n   * (\"the app can still run without billing\"); a failed optional subsystem must\n   * not become a refusal to start. (3) `billing.enabled: false` beside a\n   * registered Stripe provider is a COHERENT configuration, and refusing to boot\n   * over it would be a false alarm. The check is per-endpoint, so a capability\n   * that is wired keeps its route regardless of a sibling that is not.\n   */\n  private registerWebhookRoutes(): void {\n    this.routesRegistered = true;\n\n    if (!this.webhookHandler) {\n      this.logger.warn('WebhookAutoController: initialize() ran without a webhook handler — no routes registered');\n      return;\n    }\n\n    if (this.loadedEndpoints.size === 0) {\n      this.logDebug('No webhook endpoints pre-loaded — no routes registered');\n      return;\n    }\n\n    for (const [providerRef, endpoints] of this.loadedEndpoints) {\n      for (const endpoint of endpoints) {\n        const routePath = `/webhooks/${providerRef}/${endpoint.key}`;\n\n        const withholding = this.assessRouteDispatchability(providerRef, endpoint, routePath);\n        if (withholding) {\n          this.withheldRoutes.push(withholding);\n          this.logger.error(\n            `WebhookAutoController: NOT registering POST ${routePath} — the endpoint is declared but cannot be dispatched `\n            + `(${withholding.reasons.join(', ')}). A route mounted in this state can only ever answer 500, which instructs the `\n            + 'vendor to retry an inbound event that no retry can make processable. Withholding the route so the vendor gets a '\n            + '404 instead. Remedy: register the capability module that owns '\n            + `'${endpoint.capability}' before WebhookAutoControllerBackendService.initialize() runs (for billing, check whether `\n            + 'billing initialization was skipped or failed non-fatally earlier in startup), or disable the WEBHOOK_ORIGINATOR '\n            + `protocol for provider '${providerRef}'.`,\n            {\n              providerRef,\n              endpointKey: endpoint.key,\n              capability: endpoint.capability,\n              routePath,\n              reasons: withholding.reasons,\n            },\n          );\n          continue;\n        }\n\n        this.router.post(\n          routePath,\n          // Defense-in-depth for a future streaming mount. If this controller is\n          // ever assigned the RAW_REQUEST_STREAM mount phase, this express.raw()\n          // makes req.body the raw Buffer. Under the\n          // current master-router mount it is an inert no-op: the global\n          // express.json (HttpServerBackendService.setupBodyParsing) parses the\n          // body first and sets req._body, so the signature-faithful bytes come\n          // from req.rawBody — captured by that same express.json `verify` hook.\n          // handleWebhookRequest reads rawBody first, then falls back to a Buffer\n          // req.body for the streaming case.\n          express.raw({ type: 'application/json' }),\n          this.asyncHandler(async (req: Request, res: Response, _next: NextFunction) => {\n            await this.handleWebhookRequest(providerRef, endpoint, req, res);\n          }),\n        );\n\n        this.registeredRoutePaths.push(routePath);\n        this.logger.info(`Webhook endpoint registered: POST ${routePath}`);\n      }\n    }\n  }\n\n  /**\n   * Decide whether a declared endpoint can actually be served, and if not, say\n   * which registration is missing.\n   *\n   * Returns `null` when the route is dispatchable. Both prerequisites are\n   * evaluated (rather than short-circuiting on the first) so an operator gets\n   * the WHOLE remedy in one log line instead of fixing one registration and\n   * meeting the next on the following restart.\n   */\n  private assessRouteDispatchability(\n    providerRef: string,\n    endpoint: Hook_Endpoint,\n    routePath: string,\n  ): WebhookRouteWithholding | null {\n    const reasons: WebhookRouteWithholdingReason[] = [];\n\n    if (!this.capabilityHandlers.has(endpoint.capability)) {\n      reasons.push(WebhookRouteWithholdingReason.NO_CAPABILITY_HANDLER);\n    }\n    if (!this.webhookHandler?.hasAdapter(providerRef, endpoint.key)) {\n      reasons.push(WebhookRouteWithholdingReason.NO_ENDPOINT_ADAPTER);\n    }\n\n    if (reasons.length === 0) {\n      return null;\n    }\n    return { providerRef, endpointKey: endpoint.key, capability: endpoint.capability, routePath, reasons };\n  }\n\n  // ════════════════════════════════════════════════════════════\n  // Handler\n  // ════════════════════════════════════════════════════════════\n\n  private async handleWebhookRequest(\n    providerRef: string,\n    endpoint: Hook_Endpoint,\n    req: Request,\n    res: Response,\n  ): Promise<void> {\n    if (!this.webhookHandler) {\n      res.status(503).json({ error: 'Webhook handler not initialized' });\n      return;\n    }\n\n    // Raw request bytes for signature verification. Order matters:\n    //   1. req.rawBody — captured by the global express.json `verify` hook\n    //      (HttpServerBackendService.setupBodyParsing). This is the provider's\n    //      EXACT original payload and the ONLY byte-faithful source under the\n    //      current master-router mount, where global express.json parses the\n    //      body before this route runs (making the per-route express.raw() a\n    //      no-op, so req.body is a parsed object here).\n    //   2. Buffer req.body — only populated if this controller is ever\n    //      streaming-mounted before body parsing (per-route express.raw() fires).\n    //   3. string / JSON.stringify — last-resort fallbacks; JSON.stringify will\n    //      NOT byte-match the provider (key ordering / whitespace), so it exists\n    //      only to avoid a crash, never as a correctness path for signatures.\n    const rawBody = Buffer.isBuffer(req.rawBody)\n      ? req.rawBody.toString('utf-8')\n      : Buffer.isBuffer(req.body)\n        ? req.body.toString('utf-8')\n        : typeof req.body === 'string'\n          ? req.body\n          : JSON.stringify(req.body);\n\n    let result: Awaited<ReturnType<WebhookHandlerBackendService['processWebhook']>> | null = null;\n    try {\n      result = await this.webhookHandler.processWebhook({\n        providerRef,\n        endpointKey: endpoint.key,\n        endpoint,\n        rawBody,\n        headers: req.headers as Record<string, string>,\n      });\n\n      // null = idempotent duplicate or unparseable event — already acknowledged\n      if (!result) {\n        res.status(200).json({ received: true });\n        return;\n      }\n\n      // Dispatch to capability handler.\n      //\n      // Defence in depth only: `registerWebhookRoutes` refuses to MOUNT a route\n      // whose capability has no handler, so this branch is unreachable while that\n      // gate holds — reaching it means the handler map was mutated after mounting\n      // (which `registerCapabilityHandler` refuses to do silently). The throw is\n      // kept rather than removed because the alternative — dispatching to\n      // `undefined` — would 500 anyway, with no explanation.\n      const handler = this.capabilityHandlers.get(endpoint.capability);\n      if (handler) {\n        await handler.handleEvent(result.executionContext, result.parsedEvent);\n      } else {\n        throw new Error(`No capability handler for ${endpoint.capability} on ${providerRef}/${endpoint.key}`);\n      }\n\n      await this.webhookHandler.markWebhookProcessed(result.idempotencyKey);\n      res.status(200).json({ received: true });\n    } catch (error) {\n      const errorMessage = (error as Error).message ?? 'Unknown error';\n      const errorType = (error as any)?.errorType;\n\n      // Signature failure → 401\n      if (errorType === 'AUTHORIZATION') {\n        this.logDebug('Webhook signature verification failed', { providerRef, endpointKey: endpoint.key });\n        res.status(401).json({ error: 'Invalid signature' });\n        return;\n      }\n\n      // All other errors → 500 (trigger provider retry)\n      this.logger.error('Webhook processing failed', {\n        providerRef,\n        endpointKey: endpoint.key,\n        error: errorMessage,\n      });\n      await this.webhookHandler.releaseWebhookClaim(result?.idempotencyKey);\n      res.status(500).json({ error: 'Processing failed' });\n    }\n  }\n}\n"]}

package/dist/esm/notifications/webhooks/outbound/batches/m2m-webhook-delivery.batch.backend.service.d.ts

@@ -30,12 +30,6 @@
 import { z } from 'zod';
 import { AuthScopeType } from '@wildo-ai/saas-models';
 import { type BatchesCronjobsCustomExecution_Service } from '../../../../base-classes/services/batches/batches-cronjobs-custom-execution.service';
-/**
- * The dispatcher writes the row first, then enqueues this lightweight
- * payload. Keeping the payload minimal (id + scope) makes the worker
- * resilient to queue / DB race conditions: re-reading the row is the
- * source of truth.
- */
 export declare const M2MWebhookDeliveryBatchInputSchema: z.ZodObject<{
     scope: z.ZodObject<{
         type: z.ZodEnum<typeof AuthScopeType>;

package/dist/esm/notifications/webhooks/outbound/batches/m2m-webhook-delivery.batch.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"m2m-webhook-delivery.batch.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../../src/notifications/webhooks/outbound/batches/m2m-webhook-delivery.batch.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,aAAa,EAEd,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAEL,KAAK,sCAAsC,EAC5C,MAAM,4FAA4F,CAAC;AAmBpG;;;;;GAKG;AACH,eAAO,MAAM,kCAAkC;;;;;;iBAM7C,CAAC;AAEH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F,eAAO,MAAM,mCAAmC;;;;;;;;;;;;iBAiB9C,CAAC;AAEH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAMhG,eAAO,MAAM,8BAA8B,EAAE,sCAAsC,CACjF,OAAO,kCAAkC,EACzC,OAAO,mCAAmC,CAwU1C,CAAC"}
+{"version":3,"file":"m2m-webhook-delivery.batch.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../../src/notifications/webhooks/outbound/batches/m2m-webhook-delivery.batch.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,aAAa,EAId,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAEL,KAAK,sCAAsC,EAC5C,MAAM,4FAA4F,CAAC;AAmDpG,eAAO,MAAM,kCAAkC;;;;;;iBAM7C,CAAC;AAEH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F,eAAO,MAAM,mCAAmC;;;;;;;;;;;;iBAiB9C,CAAC;AAEH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAMhG,eAAO,MAAM,8BAA8B,EAAE,sCAAsC,CACjF,OAAO,kCAAkC,EACzC,OAAO,mCAAmC,CA8V1C,CAAC"}

package/dist/esm/notifications/webhooks/outbound/batches/m2m-webhook-delivery.batch.backend.service.js

@@ -28,7 +28,7 @@
  *   (precedent: same pattern for an event-triggered custom batch).
  */
 import { z } from 'zod';
-import { AuthScopeType, M2M_WEBHOOK_DELIVERY_CONTRACT, } from '@wildo-ai/saas-models';
+import { AuthScopeType, M2M_WEBHOOK_DELIVERY_CONTRACT, webhookEndpointDestinationHost, webhookEndpointTransportIsPlaintext, } from '@wildo-ai/saas-models';
 import { createCustomBatchExecutionService, } from '../../../../base-classes/services/batches/batches-cronjobs-custom-execution.service.js';
 import { ENGINE_M2M_WEBHOOK_DELIVERY_BATCH_MANIFEST } from '../../../../base-classes/services/batches/engine-custom-batch-manifests.js';
 import { describeCaughtError, projectCaughtErrorLogFields } from '../../../../errors/utils/error-log-level-classification.backend.utils.js';
@@ -45,6 +45,31 @@ import { M2M_WEBHOOK_BODY_HASH_ALGORITHM, sendSignedWebhookRequest } from '../m2
  * resilient to queue / DB race conditions: re-reading the row is the
  * source of truth.
  */
+/**
+ * Endpoints already warned about in this process, so a permanently-plaintext destination costs one
+ * line rather than one per delivery (#492).
+ *
+ * ## Why the warning is HERE, and why it is once
+ *
+ * Plaintext endpoints are ADMITTED — a commercial accommodation recorded on
+ * `WebhookEndpointSchema.url` — and the cost of admitting them is that the decision becomes
+ * invisible. The obvious place to say so is the moment an endpoint is SAVED, and that place does
+ * not exist: `webhookConfig` declares CREATE and UPDATE `REPOSITORY_ONLY` with no admin route, and
+ * the only writer that exists (data seeding) reaches the row through `upsertByBusinessKey`, a raw
+ * repository call that no operation-pipeline hook observes. A postfix handler there would have been
+ * a mechanism nothing runs — the shape this whole review exists to remove.
+ *
+ * The delivery IS the exposure, so this is where it can be stated truthfully: every POST over
+ * `http://` puts the signature JWT on the wire in the clear, readable and replayable by anyone on
+ * the path until it expires.
+ *
+ * Once per endpoint per process, because a webhook configuration is stable: a WARN on every
+ * delivery would be a line an operator learns to filter, and a filtered warning is the same as no
+ * warning. The set is bounded by the endpoint population and is deliberately NOT time-based — the
+ * fact does not become news again after an hour, it becomes news again when the process restarts
+ * and re-reads a configuration somebody may have changed.
+ */
+const PLAINTEXT_ENDPOINTS_ALREADY_WARNED = new Set();
 export const M2MWebhookDeliveryBatchInputSchema = z.object({
     scope: z.object({
         type: z.enum(AuthScopeType),
@@ -253,6 +278,26 @@ export const m2mWebhookDeliveryBatchService = createCustomBatchExecutionService(
         // connectivity test must exercise THIS transport, not a parallel one,
         // or a green test would prove nothing about real deliveries.
         const bodyBytes = typeof row.payload === 'string' ? row.payload : JSON.stringify(row.payload);
+        if (webhookEndpointTransportIsPlaintext(row.httpUrl)) {
+            const warnedKey = `${input.scope.type}:${input.scope.id}:${row.endpointId}`;
+            if (!PLAINTEXT_ENDPOINTS_ALREADY_WARNED.has(warnedKey)) {
+                PLAINTEXT_ENDPOINTS_ALREADY_WARNED.add(warnedKey);
+                // NOT debug. The whole point is that an operator meets this without going looking, and
+                // `AbstractControllerBackendService` disables the debug channel — the same trap that made a
+                // readiness breakdown unreachable in #498.
+                logger.warn('Webhook endpoint is plaintext: the delivery signature is sent in the clear', {
+                    scopeType: input.scope.type,
+                    scopeId: input.scope.id,
+                    endpointId: row.endpointId,
+                    // Host only, never the URL — a customer endpoint's path routinely carries a per-tenant
+                    // token, and this line reaches the ordinary log stream.
+                    destinationHost: webhookEndpointDestinationHost(row.httpUrl),
+                    exposure: 'The signature JWT is readable on the network path and replayable against this '
+                        + 'endpoint until it expires, so an observer of one delivery can forge the next.',
+                    remedy: 'Reconfigure this endpoint with an https:// URL.',
+                });
+            }
+        }
         const { responseStatus, responseBodyTruncated, networkError } = await sendSignedWebhookRequest({
             url: row.httpUrl,
             body: bodyBytes,

package/dist/esm/notifications/webhooks/outbound/batches/m2m-webhook-delivery.batch.backend.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"m2m-webhook-delivery.batch.backend.service.js","sourceRoot":"","sources":["../../../../../../../src/notifications/webhooks/outbound/batches/m2m-webhook-delivery.batch.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,aAAa,EACb,6BAA6B,GAC9B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,iCAAiC,GAElC,MAAM,4FAA4F,CAAC;AACpG,OAAO,EAAE,0CAA0C,EAAE,MAAM,gFAAgF,CAAC;AAC5I,OAAO,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAChJ,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAEpF,OAAO,EAAE,cAAc,EAAE,MAAM,wEAAwE,CAAC;AAGxG,OAAO,EACL,YAAY,EACZ,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,+BAA+B,EAAE,wBAAwB,EAAE,MAAM,6CAA6C,CAAC;AAExH,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC;QAC3B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KACtB,CAAC;IACF,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACjC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB;;;;OAIG;IACH,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC;QACd,WAAW;QACX,iBAAiB;QACjB,iBAAiB;QACjB,qBAAqB;QACrB,wBAAwB;KACzB,CAAC;IACF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC5C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC3C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CAC3C,CAAC,CAAC;AAIH,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E,MAAM,CAAC,MAAM,8BAA8B,GAGvC,iCAAiC,CAAC;IACpC,KAAK,EAAE,kCAAkC;IACzC,MAAM,EAAE,mCAAmC;IAC3C,oBAAoB,EAAE;QACpB,iEAAiE;QACjE,wEAAwE;QACxE,qEAAqE;QACrE,iEAAiE;QACjE,6CAA6C;QAC7C,6CAA6C;QAC7C,sCAAsC;QACtC,6CAA6C;QAC7C,EAAE;QACF,4BAA4B;QAC5B,uEAAuE;QACvE,sEAAsE;QACtE,6DAA6D;QAC7D,oEAAoE;QACpE,uEAAuE;QACvE,sEAAsE;QACtE,mEAAmE;QACnE,8DAA8D;QAC9D,oEAAoE;QACpE,sEAAsE;QACtE,IAAI,EAAE,0CAA0C,CAAC,IAAI;QACrD,mBAAmB,EAAE,0CAA0C,CAAC,mBAAmB;QACnF,YAAY,EAAE,0CAA0C,CAAC,YAAY;KACtE;IACD,mBAAmB,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;QACjC,UAAU,EAAE,GAAG,CACb,kBAAkB,CAAC,+BAA+B,CACnD;QACD,UAAU,EAAE,GAAG,CAAoB,kBAAkB,CAAC,iBAAiB,CAAC;QACxE,cAAc,EAAE,GAAG,CAAiB,kBAAkB,CAAC,cAAc,CAAC;KACvE,CAAC;IACF,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,YAAY,EAAE,EAAE,EAAE;QACpE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,yBAAyB,CAAC,CAAC;QAC/D,MAAM,EACJ,UAAU,EAAE,IAAI,EAChB,UAAU,EACV,cAAc,GACf,GAAG,YAAY,CAAC;QAEjB;;;;;;;;;;;;;;;;;;;WAmBG;QACH,MAAM,eAAe,GAAG,CACtB,MAAqC,EACN,EAAE;YACjC,IAAI,CAAC;gBACH,cAAc,CAAC,+BAA+B,CAAC;oBAC7C,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;oBACvB,OAAO,EAAE,MAAM,CAAC,OAAO;iBACxB,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CAAC,sDAAsD,EAAE;oBAClE,aAAa,EAAE,KAAK,CAAC,aAAa;oBAClC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;oBAC3B,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE;oBACvB,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,GAAG,2BAA2B,CAAC,KAAK,CAAC;iBACtC,CAAC,CAAC;YACL,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC;QAEF,8DAA8D;QAC9D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,gBAAgB,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;QAChF,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,4DAA4D;YAC5D,+DAA+D;YAC/D,sDAAsD;YACtD,MAAM,CAAC,IAAI,CAAC,0CAA0C,EAAE;gBACtD,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;gBAC3B,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE;aACxB,CAAC,CAAC;YACH,OAAO,eAAe,CAAC;gBACrB,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,OAAO,EAAE,qBAAqB;gBAC9B,YAAY,EAAE,CAAC;gBACf,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,gBAAgB,GAAG,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAErD,8DAA8D;QAC9D,gEAAgE;QAChE,kEAAkE;QAClE,gEAAgE;QAChE,6DAA6D;QAC7D,0DAA0D;QAC1D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CACpC,KAAK,CAAC,KAAK,EACX,gBAAgB,EAChB,KAAK,CAAC,aAAa,EACnB,gBAAgB,CACjB,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,CAAC,IAAI,CAAC,iEAAiE,EAAE;gBAC7E,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;gBAC3B,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE;gBACvB,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,YAAY,EAAE,GAAG,CAAC,YAAY;gBAC9B,aAAa,EAAE,GAAG,CAAC,MAAM;aAC1B,CAAC,CAAC;YACH,OAAO,eAAe,CAAC;gBACrB,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,OAAO,EAAE,wBAAwB;gBACjC,YAAY,EAAE,GAAG,CAAC,YAAY,IAAI,CAAC;gBACnC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC,CAAC;QACL,CAAC;QAED,8DAA8D;QAC9D,iEAAiE;QACjE,8DAA8D;QAC9D,iEAAiE;QACjE,2CAA2C;QAC3C,MAAM,MAAM,GAAG;YACb,8DAA8D;YAC9D,8DAA8D;YAC9D,2DAA2D;YAC3D,6DAA6D;YAC7D,gEAAgE;YAChE,kEAAkE;YAClE,uDAAuD;YACvD,wEAAwE;YACxE,0DAA0D;YAC1D,CAAC,6BAA6B,CAAC,eAAe,CAAC,UAAU,CAAC,EAAE,GAAG,CAAC,YAAY;YAC5E,CAAC,6BAA6B,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,WAAW;YACzE,CAAC,6BAA6B,CAAC,eAAe,CAAC,iBAAiB,CAAC,EAAE,+BAA+B;YAClG,CAAC,6BAA6B,CAAC,eAAe,CAAC,YAAY,CAAC,EAAE,GAAG,CAAC,OAAO;YACzE,CAAC,6BAA6B,CAAC,eAAe,CAAC,kBAAkB,CAAC,EAAE,GAAG,CAAC,kBAAkB;YAC1F,CAAC,6BAA6B,CAAC,eAAe,CAAC,mBAAmB,CAAC,EAAE,GAAG,CAAC,mBAAmB;YAC5F,uDAAuD;YACvD,4DAA4D;YAC5D,2DAA2D;YAC3D,6CAA6C;SAC9C,CAAC;QAEF,IAAI,SAAiB,CAAC;QACtB,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,mBAAmB,CAAC,CAAC;QAChF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,6DAA6D;YAC7D,+DAA+D;YAC/D,gEAAgE;YAChE,oBAAoB;YACpB,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;YAC1C,MAAM,CAAC,KAAK,CAAC,0DAA0D,EAAE;gBACvE,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;gBAC3B,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE;gBACvB,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,YAAY,EAAE,GAAG,CAAC,YAAY;gBAC9B,OAAO,EAAE,gBAAgB;gBACzB,KAAK;aACN,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,EAAE,gBAAgB,EAAE,KAAK,CAAC,aAAa,EAAE;gBAC/E,aAAa,EAAE,uBAAuB,MAAM,EAAE;aAC/C,CAAC,CAAC;YACH,OAAO,eAAe,CAAC;gBACrB,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,OAAO,EAAE,iBAAiB;gBAC1B,YAAY,EAAE,gBAAgB;gBAC9B,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC,CAAC;QACL,CAAC;QAED,8DAA8D;QAC9D,0DAA0D;QAC1D,mEAAmE;QACnE,sEAAsE;QACtE,6DAA6D;QAC7D,MAAM,SAAS,GACb,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC9E,MAAM,EAAE,cAAc,EAAE,qBAAqB,EAAE,YAAY,EAAE,GAAG,MAAM,wBAAwB,CAAC;YAC7F,GAAG,EAAE,GAAG,CAAC,OAAO;YAChB,IAAI,EAAE,SAAS;YACf,SAAS;SACV,CAAC,CAAC;QAEH,2EAA2E;QAC3E,uEAAuE;QACvE,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAE1C,8DAA8D;QAC9D,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACjC,MAAM,OAAO,GAAG,sBAAsB,CAAC,cAAc,CAAC,CAAC;YAEvD,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;gBAC5B,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,EAAE,gBAAgB,EAAE,KAAK,CAAC,aAAa,EAAE;oBAC3E,cAAc;oBACd,qBAAqB;iBACtB,CAAC,CAAC;gBACH,QAAQ,CAAC,mBAAmB,EAAE;oBAC5B,aAAa,EAAE,KAAK,CAAC,aAAa;oBAClC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;oBAC3B,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE;oBACvB,UAAU,EAAE,GAAG,CAAC,UAAU;oBAC1B,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,YAAY,EAAE,GAAG,CAAC,YAAY;oBAC9B,UAAU,EAAE,cAAc;oBAC1B,UAAU;oBACV,OAAO,EAAE,gBAAgB;iBAC1B,CAAC,CAAC;gBACH,OAAO,eAAe,CAAC;oBACrB,aAAa,EAAE,KAAK,CAAC,aAAa;oBAClC,OAAO,EAAE,WAAW;oBACpB,YAAY,EAAE,gBAAgB;oBAC9B,cAAc;oBACd,UAAU;iBACX,CAAC,CAAC;YACL,CAAC;YAED,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;gBACxB,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,EAAE,gBAAgB,EAAE,KAAK,CAAC,aAAa,EAAE;oBAC/E,cAAc;oBACd,qBAAqB;oBACrB,aAAa,EAAE,6BAA6B,cAAc,EAAE;iBAC7D,CAAC,CAAC;gBACH,MAAM,CAAC,IAAI,CAAC,yCAAyC,EAAE;oBACrD,aAAa,EAAE,KAAK,CAAC,aAAa;oBAClC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;oBAC3B,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE;oBACvB,UAAU,EAAE,GAAG,CAAC,UAAU;oBAC1B,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,YAAY,EAAE,GAAG,CAAC,YAAY;oBAC9B,UAAU,EAAE,cAAc;oBAC1B,UAAU;oBACV,OAAO,EAAE,gBAAgB;iBAC1B,CAAC,CAAC;gBACH,OAAO,eAAe,CAAC;oBACrB,aAAa,EAAE,KAAK,CAAC,aAAa;oBAClC,OAAO,EAAE,iBAAiB;oBAC1B,YAAY,EAAE,gBAAgB;oBAC9B,cAAc;oBACd,UAAU;iBACX,CAAC,CAAC;YACL,CAAC;YAED,gEAAgE;QAClE,CAAC;QAED,6DAA6D;QAC7D,oDAAoD;QACpD,MAAM,aAAa,GACjB,YAAY,IAAI,yBAAyB,cAAc,IAAI,SAAS,EAAE,CAAC;QAEzE,IAAI,gBAAgB,IAAI,YAAY,EAAE,CAAC;YACrC,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,EAAE,gBAAgB,EAAE,KAAK,CAAC,aAAa,EAAE;gBAC/E,cAAc;gBACd,qBAAqB;gBACrB,aAAa,EAAE,GAAG,aAAa,eAAe,YAAY,WAAW;aACtE,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,6CAA6C,EAAE;gBACzD,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;gBAC3B,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE;gBACvB,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,YAAY,EAAE,GAAG,CAAC,YAAY;gBAC9B,UAAU,EAAE,cAAc;gBAC1B,UAAU;gBACV,OAAO,EAAE,gBAAgB;gBACzB,aAAa;aACd,CAAC,CAAC;YACH,OAAO,eAAe,CAAC;gBACrB,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,OAAO,EAAE,iBAAiB;gBAC1B,YAAY,EAAE,gBAAgB;gBAC9B,cAAc;gBACd,UAAU;aACX,CAAC,CAAC;QACL,CAAC;QAED,MAAM,aAAa,GAAG,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;QAC7D,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,EAAE,gBAAgB,EAAE,KAAK,CAAC,aAAa,EAAE;YAC/E,cAAc;YACd,qBAAqB;YACrB,aAAa;YACb,aAAa;SACd,CAAC,CAAC;QACH,QAAQ,CAAC,kCAAkC,EAAE;YAC3C,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;YAC3B,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE;YACvB,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,YAAY,EAAE,GAAG,CAAC,YAAY;YAC9B,UAAU,EAAE,cAAc;YAC1B,UAAU;YACV,OAAO,EAAE,gBAAgB;YACzB,aAAa,EAAE,aAAa,CAAC,WAAW,EAAE;YAC1C,aAAa;SACd,CAAC,CAAC;QACH,OAAO,eAAe,CAAC;YACrB,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,OAAO,EAAE,iBAAiB;YAC1B,YAAY,EAAE,gBAAgB;YAC9B,cAAc;YACd,UAAU;SACX,CAAC,CAAC;IACL,CAAC;CACF,CAAC,CAAC;AAEH,wEAAwE;AACxE,6EAA6E;AAC7E,qEAAqE;AACrE,sDAAsD","sourcesContent":["/**\n * M2M Webhook Delivery Batch Worker\n *\n * Event-triggered custom batch — one job per delivery row enqueued by\n * `M2MWebhookDispatcherBackendService.enqueueDelivery`. The worker:\n *   1. Re-reads the row from `M2MWebhookDeliveryLog` (ground truth —\n *      we never trust in-flight queue state for the body or signature).\n *   2. Marks it `IN_FLIGHT` (incrementing `attemptCount`).\n *   3. Builds the JWT signature with `JwtPrivateKeys.APPLICATION_WEBHOOK`.\n *   4. POSTs the body with a 30s `AbortController` timeout.\n *   5. Classifies the response and records the terminal/intermediate\n *      transition on the row.\n *\n * Status classification (D6):\n *   - 2xx                            → DELIVERED (terminal success).\n *   - 4xx, excluding 408 / 429       → FAILED (terminal — non-retryable).\n *   - 408 / 429 / 5xx / network      → mark failed attempt; if\n *                                       `attemptCount >= MAX_ATTEMPTS`,\n *                                       transition to FAILED.\n *\n * Custom batches are factory-created rather than constructor-injected. This\n * batch therefore declares its exact services through `resolveDependencies`;\n * the executor resolves them lazily for each invocation and `doHandle`\n * receives only the typed named result.\n *\n * @see m2m-webhook-organization-delivery.md — Phase 3 / Step 10\n * @see notifications/email/services/email-batch-send.batch.backend.service.ts\n *   (precedent: same pattern for an event-triggered custom batch).\n */\n\nimport { z } from 'zod';\nimport {\n  AuthScopeType,\n  M2M_WEBHOOK_DELIVERY_CONTRACT,\n} from '@wildo-ai/saas-models';\nimport {\n  createCustomBatchExecutionService,\n  type BatchesCronjobsCustomExecution_Service,\n} from '~wildo-backend-lib/base-classes/services/batches/batches-cronjobs-custom-execution.service';\nimport { ENGINE_M2M_WEBHOOK_DELIVERY_BATCH_MANIFEST } from '~wildo-backend-lib/base-classes/services/batches/engine-custom-batch-manifests';\nimport { describeCaughtError, projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { JwtBackendService } from '~wildo-backend-lib/security/jwt/services/jwt.backend.service';\nimport { JwtPrivateKeys } from '~wildo-backend-lib/security/authentications/models/jwt.backend.schemas';\nimport type { MetricsService } from '~wildo-backend-lib/monitoring/observability/services/metrics.service';\nimport type { M2MWebhookDeliveryLogRepository } from '~wildo-backend-lib/notifications/webhooks/outbound/services/m2m-webhook-delivery-log.repository';\nimport {\n  MAX_ATTEMPTS,\n  classifyResponseStatus,\n  computeNextAttemptAt,\n} from './m2m-webhook-delivery.batch.utils';\nimport { M2M_WEBHOOK_BODY_HASH_ALGORITHM, sendSignedWebhookRequest } from '../m2m-webhook-signed-request.backend.utils';\n\n// ═══════════════════════════════════════════════════════════════════════════\n// Input / Output schemas\n// ═══════════════════════════════════════════════════════════════════════════\n\n/**\n * The dispatcher writes the row first, then enqueues this lightweight\n * payload. Keeping the payload minimal (id + scope) makes the worker\n * resilient to queue / DB race conditions: re-reading the row is the\n * source of truth.\n */\nexport const M2MWebhookDeliveryBatchInputSchema = z.object({\n  scope: z.object({\n    type: z.enum(AuthScopeType),\n    id: z.string().min(1),\n  }),\n  deliveryLogId: z.string().min(1),\n});\n\nexport type M2MWebhookDeliveryBatchInput = z.infer<typeof M2MWebhookDeliveryBatchInputSchema>;\n\nexport const M2MWebhookDeliveryBatchOutputSchema = z.object({\n  deliveryLogId: z.string(),\n  /**\n   * High-level outcome string. Stored only in the worker output for\n   * cron / log inspection; the persisted truth lives on the row's\n   * `status` field.\n   */\n  outcome: z.enum([\n    'delivered',\n    'retry_scheduled',\n    'failed_terminal',\n    'skipped_missing_row',\n    'skipped_already_leased',\n  ]),\n  attemptCount: z.number().int().nonnegative(),\n  responseStatus: z.number().int().optional(),\n  durationMs: z.number().int().nonnegative(),\n});\n\nexport type M2MWebhookDeliveryBatchOutput = z.infer<typeof M2MWebhookDeliveryBatchOutputSchema>;\n\n// ═══════════════════════════════════════════════════════════════════════════\n// Batch Service\n// ═══════════════════════════════════════════════════════════════════════════\n\nexport const m2mWebhookDeliveryBatchService: BatchesCronjobsCustomExecution_Service<\n  typeof M2MWebhookDeliveryBatchInputSchema,\n  typeof M2MWebhookDeliveryBatchOutputSchema\n> = createCustomBatchExecutionService({\n  input: M2MWebhookDeliveryBatchInputSchema,\n  output: M2MWebhookDeliveryBatchOutputSchema,\n  batchCronjob_Context: {\n    // Anchored on the `APPLICATION` primary scope rather than a fake\n    // `ORGANIZATION_M2M_WEBHOOK_DELIVERY_LOG` operation: an event-triggered\n    // polymorphic worker has no honest \"primary\" resource (each enqueued\n    // row carries its own `scope: { type, id }` and routes to either\n    // `ORGANIZATION_M2M_WEBHOOK_DELIVERY_LOG` or\n    // `APPLICATION_M2M_WEBHOOK_DELIVERY_LOG` via\n    // `resolveDeliveryLogResourceType` in\n    // `m2m-webhook-delivery-log.repository.ts`).\n    //\n    // The bootstrap path inside\n    // `ExecutionContextCreatorBackendService.createForInternalCustomBatch`\n    // resolves an `APPLICATION.READ` operation, populates the application\n    // id, then swaps in `notifications:m2m-webhook-delivery` via\n    // `withOperation()`. Audit trails surface the honest batch identity\n    // and authorization runs against `APP_ADMIN_SUPER_ADMIN @ APPLICATION`\n    // (see `createInternalSystemRoles()`), exactly as before, but without\n    // pretending the worker mutates the org-variant log on every job —\n    // including for app-scoped deliveries where that anchor was a\n    // flat-out lie. Per-row resource-type resolution (org vs app) stays\n    // inside the worker and is driven off the per-row `input.scope.type`.\n    kind: ENGINE_M2M_WEBHOOK_DELIVERY_BATCH_MANIFEST.kind,\n    operationIdentifier: ENGINE_M2M_WEBHOOK_DELIVERY_BATCH_MANIFEST.operationIdentifier,\n    primaryScope: ENGINE_M2M_WEBHOOK_DELIVERY_BATCH_MANIFEST.primaryScope,\n  },\n  resolveDependencies: ({ get }) => ({\n    repository: get<M2MWebhookDeliveryLogRepository>(\n      SAAS_SERVICE_TYPES.M2MWebhookDeliveryLogRepository,\n    ),\n    jwtService: get<JwtBackendService>(SAAS_SERVICE_TYPES.JwtBackendService),\n    metricsService: get<MetricsService>(SAAS_SERVICE_TYPES.MetricsService),\n  }),\n  doHandle: async (input, { logger, executionContext, dependencies }) => {\n    const startedAt = Date.now();\n    const logDebug = logger.debugByType('M2MWebhookDeliveryBatch');\n    const {\n      repository: repo,\n      jwtService,\n      metricsService,\n    } = dependencies;\n\n    /**\n     * Single funnel for every `doHandle` return-point. Mirrors the\n     * batch output back to the caller while firing the Phase 5 /\n     * Step 17 outcome counter exactly once per worker invocation.\n     *\n     * Kept inline (not extracted to a module-level helper) because it\n     * closes over `metricsService` and `input.scope.type` — lifting it\n     * would need re-threading both via parameters on every call site\n     * and would dilute the fire-exactly-once contract this funnel\n     * enforces.\n     *\n     * Metric emission is error-isolated for the same reason the audit\n     * helper swallows its failures: observability MUST NEVER fail the\n     * main flow. By the time `recordAndReturn` runs, the row has\n     * already been persisted with the correct terminal/intermediate\n     * status — letting an OpenTelemetry exporter glitch abort the\n     * batch invocation here would leave the custom-batch runner\n     * reporting the run as failed even though the real delivery\n     * completed and the truth-source row reflects success.\n     */\n    const recordAndReturn = (\n      output: M2MWebhookDeliveryBatchOutput,\n    ): M2MWebhookDeliveryBatchOutput => {\n      try {\n        metricsService.recordM2MWebhookDeliveryOutcome({\n          scope: input.scope.type,\n          outcome: output.outcome,\n        });\n      } catch (error) {\n        logger.warn('Failed to record M2M webhook delivery outcome metric', {\n          deliveryLogId: input.deliveryLogId,\n          scopeType: input.scope.type,\n          scopeId: input.scope.id,\n          outcome: output.outcome,\n          ...projectCaughtErrorLogFields(error),\n        });\n      }\n      return output;\n    };\n\n    // ── Load the row (ground truth) ────────────────────────────\n    const row = await repo.read(input.scope, executionContext, input.deliveryLogId);\n    if (!row) {\n      // Possible if the row was purged between enqueue and worker\n      // execution (admin `PURGE_OLD`). Quiet skip — there is nothing\n      // to deliver and no caller to surface the absence to.\n      logger.warn('Webhook delivery row not found; skipping', {\n        deliveryLogId: input.deliveryLogId,\n        scopeType: input.scope.type,\n        scopeId: input.scope.id,\n      });\n      return recordAndReturn({\n        deliveryLogId: input.deliveryLogId,\n        outcome: 'skipped_missing_row',\n        attemptCount: 0,\n        durationMs: Date.now() - startedAt,\n      });\n    }\n\n    const nextAttemptCount = (row.attemptCount ?? 0) + 1;\n\n    // ── Lease the row (atomic CAS) ─────────────────────────────\n    // `markInFlight` is a compare-and-swap on `status: PENDING`. If\n    // another worker already leased the row (cron retry sweep + queue\n    // redelivery race), the CAS returns false and we exit cleanly —\n    // double-POSTs and double-counted attempts would corrupt the\n    // retry budget and the consumer's idempotency guarantees.\n    const leased = await repo.markInFlight(\n      input.scope,\n      executionContext,\n      input.deliveryLogId,\n      nextAttemptCount,\n    );\n    if (!leased) {\n      logger.warn('Webhook delivery row already leased by another worker; skipping', {\n        deliveryLogId: input.deliveryLogId,\n        scopeType: input.scope.type,\n        scopeId: input.scope.id,\n        endpointId: row.endpointId,\n        httpUrl: row.httpUrl,\n        signatureJti: row.signatureJti,\n        currentStatus: row.status,\n      });\n      return recordAndReturn({\n        deliveryLogId: input.deliveryLogId,\n        outcome: 'skipped_already_leased',\n        attemptCount: row.attemptCount ?? 0,\n        durationMs: Date.now() - startedAt,\n      });\n    }\n\n    // ── Build the JWT signature (D5: claims-JWT) ───────────────\n    // The body itself is NOT in the JWT — only its sha256 hash. This\n    // keeps the header small (some HTTP intermediaries cap header\n    // size) and lets consumers verify integrity independently of the\n    // raw body bytes (which they can re-hash).\n    const claims = {\n      // `jti` is the consumer-facing dedup key. It is stable across\n      // every retry of THIS delivery row (same value re-signed each\n      // attempt) and unique across rows. Consumers MUST dedup on\n      // `jti` — the rest of the token (`iat`, `exp`, signature) is\n      // refreshed per attempt and so cannot serve as a replay marker.\n      // See `m2m-webhook-dispatcher.backend.service.ts` (`signatureJti`\n      // creation site) for the full consumer-contract JSDoc.\n      // Claim NAMES come from the published receiver contract so the customer\n      // documentation and this signing site cannot drift apart.\n      [M2M_WEBHOOK_DELIVERY_CONTRACT.signatureClaims.deliveryId]: row.signatureJti,\n      [M2M_WEBHOOK_DELIVERY_CONTRACT.signatureClaims.bodyHash]: row.payloadHash,\n      [M2M_WEBHOOK_DELIVERY_CONTRACT.signatureClaims.bodyHashAlgorithm]: M2M_WEBHOOK_BODY_HASH_ALGORITHM,\n      [M2M_WEBHOOK_DELIVERY_CONTRACT.signatureClaims.eventChannel]: row.channel,\n      [M2M_WEBHOOK_DELIVERY_CONTRACT.signatureClaims.resourceIdentifier]: row.resourceIdentifier,\n      [M2M_WEBHOOK_DELIVERY_CONTRACT.signatureClaims.operationIdentifier]: row.operationIdentifier,\n      // `iss`, `iat`, `exp`, `aud`, `kid` defaults come from\n      // `JwtPrivateKeySignOptions[APPLICATION_WEBHOOK]`. We don't\n      // override them here — the consumer-facing contract is the\n      // signing options table, not this call site.\n    };\n\n    let signature: string;\n    try {\n      signature = await jwtService.sign(claims, JwtPrivateKeys.APPLICATION_WEBHOOK);\n    } catch (error) {\n      // Signing failure is a configuration problem (missing key) —\n      // re-trying won't help until the operator fixes secrets, so we\n      // mark the row as terminally failed and let admin RETRY pick it\n      // up after the fix.\n      const reason = describeCaughtError(error);\n      logger.error('Failed to sign webhook payload — marking delivery FAILED', {\n        deliveryLogId: input.deliveryLogId,\n        scopeType: input.scope.type,\n        scopeId: input.scope.id,\n        endpointId: row.endpointId,\n        httpUrl: row.httpUrl,\n        signatureJti: row.signatureJti,\n        attempt: nextAttemptCount,\n        error,\n      });\n      await repo.markFinallyFailed(input.scope, executionContext, input.deliveryLogId, {\n        failureReason: `JWT signing failed: ${reason}`,\n      });\n      return recordAndReturn({\n        deliveryLogId: input.deliveryLogId,\n        outcome: 'failed_terminal',\n        attemptCount: nextAttemptCount,\n        durationMs: Date.now() - startedAt,\n      });\n    }\n\n    // ── POST the body ──────────────────────────────────────────\n    // Shared with the `webhookConfig.testEndpoint` probe (see\n    // `../m2m-webhook-signed-request.backend.utils`). The admin-facing\n    // connectivity test must exercise THIS transport, not a parallel one,\n    // or a green test would prove nothing about real deliveries.\n    const bodyBytes =\n      typeof row.payload === 'string' ? row.payload : JSON.stringify(row.payload);\n    const { responseStatus, responseBodyTruncated, networkError } = await sendSignedWebhookRequest({\n      url: row.httpUrl,\n      body: bodyBytes,\n      signature,\n    });\n\n    // Job-level duration: spans the row re-read and lease as well as the POST,\n    // so it stays the batch's own measurement rather than the transport's.\n    const durationMs = Date.now() - startedAt;\n\n    // ── Classify + persist transition ──────────────────────────\n    if (responseStatus !== undefined) {\n      const verdict = classifyResponseStatus(responseStatus);\n\n      if (verdict === 'delivered') {\n        await repo.markDelivered(input.scope, executionContext, input.deliveryLogId, {\n          responseStatus,\n          responseBodyTruncated,\n        });\n        logDebug('Webhook delivered', {\n          deliveryLogId: input.deliveryLogId,\n          scopeType: input.scope.type,\n          scopeId: input.scope.id,\n          endpointId: row.endpointId,\n          httpUrl: row.httpUrl,\n          signatureJti: row.signatureJti,\n          httpStatus: responseStatus,\n          durationMs,\n          attempt: nextAttemptCount,\n        });\n        return recordAndReturn({\n          deliveryLogId: input.deliveryLogId,\n          outcome: 'delivered',\n          attemptCount: nextAttemptCount,\n          responseStatus,\n          durationMs,\n        });\n      }\n\n      if (verdict === 'fatal') {\n        await repo.markFinallyFailed(input.scope, executionContext, input.deliveryLogId, {\n          responseStatus,\n          responseBodyTruncated,\n          failureReason: `non-retryable HTTP status ${responseStatus}`,\n        });\n        logger.warn('Webhook delivery failed (non-retryable)', {\n          deliveryLogId: input.deliveryLogId,\n          scopeType: input.scope.type,\n          scopeId: input.scope.id,\n          endpointId: row.endpointId,\n          httpUrl: row.httpUrl,\n          signatureJti: row.signatureJti,\n          httpStatus: responseStatus,\n          durationMs,\n          attempt: nextAttemptCount,\n        });\n        return recordAndReturn({\n          deliveryLogId: input.deliveryLogId,\n          outcome: 'failed_terminal',\n          attemptCount: nextAttemptCount,\n          responseStatus,\n          durationMs,\n        });\n      }\n\n      // verdict === 'retry' — fall through to the retry branch below.\n    }\n\n    // Retryable failure (5xx, 408, 429, network/timeout). Decide\n    // between scheduling another attempt and giving up.\n    const failureReason =\n      networkError ?? `retryable HTTP status ${responseStatus ?? 'unknown'}`;\n\n    if (nextAttemptCount >= MAX_ATTEMPTS) {\n      await repo.markFinallyFailed(input.scope, executionContext, input.deliveryLogId, {\n        responseStatus,\n        responseBodyTruncated,\n        failureReason: `${failureReason} (retry cap ${MAX_ATTEMPTS} reached)`,\n      });\n      logger.warn('Webhook delivery failed (retry cap reached)', {\n        deliveryLogId: input.deliveryLogId,\n        scopeType: input.scope.type,\n        scopeId: input.scope.id,\n        endpointId: row.endpointId,\n        httpUrl: row.httpUrl,\n        signatureJti: row.signatureJti,\n        httpStatus: responseStatus,\n        durationMs,\n        attempt: nextAttemptCount,\n        failureReason,\n      });\n      return recordAndReturn({\n        deliveryLogId: input.deliveryLogId,\n        outcome: 'failed_terminal',\n        attemptCount: nextAttemptCount,\n        responseStatus,\n        durationMs,\n      });\n    }\n\n    const nextAttemptAt = computeNextAttemptAt(nextAttemptCount);\n    await repo.markFailedAttempt(input.scope, executionContext, input.deliveryLogId, {\n      responseStatus,\n      responseBodyTruncated,\n      failureReason,\n      nextAttemptAt,\n    });\n    logDebug('Webhook delivery retry scheduled', {\n      deliveryLogId: input.deliveryLogId,\n      scopeType: input.scope.type,\n      scopeId: input.scope.id,\n      endpointId: row.endpointId,\n      httpUrl: row.httpUrl,\n      signatureJti: row.signatureJti,\n      httpStatus: responseStatus,\n      durationMs,\n      attempt: nextAttemptCount,\n      nextAttemptAt: nextAttemptAt.toISOString(),\n      failureReason,\n    });\n    return recordAndReturn({\n      deliveryLogId: input.deliveryLogId,\n      outcome: 'retry_scheduled',\n      attemptCount: nextAttemptCount,\n      responseStatus,\n      durationMs,\n    });\n  },\n});\n\n// Batch reference identifier lives in the declarative manifest registry\n// (`engine-custom-batch-manifests`); import `M2M_WEBHOOK_DELIVERY_BATCH_REF`\n// from there to keep a single source of truth across runtime wiring,\n// queue dispatch, and specification cross-validation.\n"]}
+{"version":3,"file":"m2m-webhook-delivery.batch.backend.service.js","sourceRoot":"","sources":["../../../../../../../src/notifications/webhooks/outbound/batches/m2m-webhook-delivery.batch.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,aAAa,EACb,6BAA6B,EAC7B,8BAA8B,EAC9B,mCAAmC,GACpC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,iCAAiC,GAElC,MAAM,4FAA4F,CAAC;AACpG,OAAO,EAAE,0CAA0C,EAAE,MAAM,gFAAgF,CAAC;AAC5I,OAAO,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAChJ,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAEpF,OAAO,EAAE,cAAc,EAAE,MAAM,wEAAwE,CAAC;AAGxG,OAAO,EACL,YAAY,EACZ,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,+BAA+B,EAAE,wBAAwB,EAAE,MAAM,6CAA6C,CAAC;AAExH,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E;;;;;GAKG;AACH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,kCAAkC,GAAG,IAAI,GAAG,EAAU,CAAC;AAE7D,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC;QAC3B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KACtB,CAAC;IACF,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACjC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB;;;;OAIG;IACH,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC;QACd,WAAW;QACX,iBAAiB;QACjB,iBAAiB;QACjB,qBAAqB;QACrB,wBAAwB;KACzB,CAAC;IACF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC5C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC3C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CAC3C,CAAC,CAAC;AAIH,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E,MAAM,CAAC,MAAM,8BAA8B,GAGvC,iCAAiC,CAAC;IACpC,KAAK,EAAE,kCAAkC;IACzC,MAAM,EAAE,mCAAmC;IAC3C,oBAAoB,EAAE;QACpB,iEAAiE;QACjE,wEAAwE;QACxE,qEAAqE;QACrE,iEAAiE;QACjE,6CAA6C;QAC7C,6CAA6C;QAC7C,sCAAsC;QACtC,6CAA6C;QAC7C,EAAE;QACF,4BAA4B;QAC5B,uEAAuE;QACvE,sEAAsE;QACtE,6DAA6D;QAC7D,oEAAoE;QACpE,uEAAuE;QACvE,sEAAsE;QACtE,mEAAmE;QACnE,8DAA8D;QAC9D,oEAAoE;QACpE,sEAAsE;QACtE,IAAI,EAAE,0CAA0C,CAAC,IAAI;QACrD,mBAAmB,EAAE,0CAA0C,CAAC,mBAAmB;QACnF,YAAY,EAAE,0CAA0C,CAAC,YAAY;KACtE;IACD,mBAAmB,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;QACjC,UAAU,EAAE,GAAG,CACb,kBAAkB,CAAC,+BAA+B,CACnD;QACD,UAAU,EAAE,GAAG,CAAoB,kBAAkB,CAAC,iBAAiB,CAAC;QACxE,cAAc,EAAE,GAAG,CAAiB,kBAAkB,CAAC,cAAc,CAAC;KACvE,CAAC;IACF,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,YAAY,EAAE,EAAE,EAAE;QACpE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,yBAAyB,CAAC,CAAC;QAC/D,MAAM,EACJ,UAAU,EAAE,IAAI,EAChB,UAAU,EACV,cAAc,GACf,GAAG,YAAY,CAAC;QAEjB;;;;;;;;;;;;;;;;;;;WAmBG;QACH,MAAM,eAAe,GAAG,CACtB,MAAqC,EACN,EAAE;YACjC,IAAI,CAAC;gBACH,cAAc,CAAC,+BAA+B,CAAC;oBAC7C,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;oBACvB,OAAO,EAAE,MAAM,CAAC,OAAO;iBACxB,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CAAC,sDAAsD,EAAE;oBAClE,aAAa,EAAE,KAAK,CAAC,aAAa;oBAClC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;oBAC3B,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE;oBACvB,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,GAAG,2BAA2B,CAAC,KAAK,CAAC;iBACtC,CAAC,CAAC;YACL,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC;QAEF,8DAA8D;QAC9D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,gBAAgB,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;QAChF,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,4DAA4D;YAC5D,+DAA+D;YAC/D,sDAAsD;YACtD,MAAM,CAAC,IAAI,CAAC,0CAA0C,EAAE;gBACtD,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;gBAC3B,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE;aACxB,CAAC,CAAC;YACH,OAAO,eAAe,CAAC;gBACrB,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,OAAO,EAAE,qBAAqB;gBAC9B,YAAY,EAAE,CAAC;gBACf,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,gBAAgB,GAAG,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAErD,8DAA8D;QAC9D,gEAAgE;QAChE,kEAAkE;QAClE,gEAAgE;QAChE,6DAA6D;QAC7D,0DAA0D;QAC1D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CACpC,KAAK,CAAC,KAAK,EACX,gBAAgB,EAChB,KAAK,CAAC,aAAa,EACnB,gBAAgB,CACjB,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,CAAC,IAAI,CAAC,iEAAiE,EAAE;gBAC7E,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;gBAC3B,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE;gBACvB,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,YAAY,EAAE,GAAG,CAAC,YAAY;gBAC9B,aAAa,EAAE,GAAG,CAAC,MAAM;aAC1B,CAAC,CAAC;YACH,OAAO,eAAe,CAAC;gBACrB,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,OAAO,EAAE,wBAAwB;gBACjC,YAAY,EAAE,GAAG,CAAC,YAAY,IAAI,CAAC;gBACnC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC,CAAC;QACL,CAAC;QAED,8DAA8D;QAC9D,iEAAiE;QACjE,8DAA8D;QAC9D,iEAAiE;QACjE,2CAA2C;QAC3C,MAAM,MAAM,GAAG;YACb,8DAA8D;YAC9D,8DAA8D;YAC9D,2DAA2D;YAC3D,6DAA6D;YAC7D,gEAAgE;YAChE,kEAAkE;YAClE,uDAAuD;YACvD,wEAAwE;YACxE,0DAA0D;YAC1D,CAAC,6BAA6B,CAAC,eAAe,CAAC,UAAU,CAAC,EAAE,GAAG,CAAC,YAAY;YAC5E,CAAC,6BAA6B,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,WAAW;YACzE,CAAC,6BAA6B,CAAC,eAAe,CAAC,iBAAiB,CAAC,EAAE,+BAA+B;YAClG,CAAC,6BAA6B,CAAC,eAAe,CAAC,YAAY,CAAC,EAAE,GAAG,CAAC,OAAO;YACzE,CAAC,6BAA6B,CAAC,eAAe,CAAC,kBAAkB,CAAC,EAAE,GAAG,CAAC,kBAAkB;YAC1F,CAAC,6BAA6B,CAAC,eAAe,CAAC,mBAAmB,CAAC,EAAE,GAAG,CAAC,mBAAmB;YAC5F,uDAAuD;YACvD,4DAA4D;YAC5D,2DAA2D;YAC3D,6CAA6C;SAC9C,CAAC;QAEF,IAAI,SAAiB,CAAC;QACtB,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,mBAAmB,CAAC,CAAC;QAChF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,6DAA6D;YAC7D,+DAA+D;YAC/D,gEAAgE;YAChE,oBAAoB;YACpB,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;YAC1C,MAAM,CAAC,KAAK,CAAC,0DAA0D,EAAE;gBACvE,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;gBAC3B,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE;gBACvB,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,YAAY,EAAE,GAAG,CAAC,YAAY;gBAC9B,OAAO,EAAE,gBAAgB;gBACzB,KAAK;aACN,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,EAAE,gBAAgB,EAAE,KAAK,CAAC,aAAa,EAAE;gBAC/E,aAAa,EAAE,uBAAuB,MAAM,EAAE;aAC/C,CAAC,CAAC;YACH,OAAO,eAAe,CAAC;gBACrB,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,OAAO,EAAE,iBAAiB;gBAC1B,YAAY,EAAE,gBAAgB;gBAC9B,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC,CAAC;QACL,CAAC;QAED,8DAA8D;QAC9D,0DAA0D;QAC1D,mEAAmE;QACnE,sEAAsE;QACtE,6DAA6D;QAC7D,MAAM,SAAS,GACb,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAE9E,IAAI,mCAAmC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACrD,MAAM,SAAS,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,EAAE,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;YAC5E,IAAI,CAAC,kCAAkC,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBACvD,kCAAkC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBAClD,uFAAuF;gBACvF,4FAA4F;gBAC5F,2CAA2C;gBAC3C,MAAM,CAAC,IAAI,CAAC,4EAA4E,EAAE;oBACxF,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;oBAC3B,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE;oBACvB,UAAU,EAAE,GAAG,CAAC,UAAU;oBAC1B,uFAAuF;oBACvF,wDAAwD;oBACxD,eAAe,EAAE,8BAA8B,CAAC,GAAG,CAAC,OAAO,CAAC;oBAC5D,QAAQ,EAAE,gFAAgF;0BACtF,+EAA+E;oBACnF,MAAM,EAAE,iDAAiD;iBAC1D,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,MAAM,EAAE,cAAc,EAAE,qBAAqB,EAAE,YAAY,EAAE,GAAG,MAAM,wBAAwB,CAAC;YAC7F,GAAG,EAAE,GAAG,CAAC,OAAO;YAChB,IAAI,EAAE,SAAS;YACf,SAAS;SACV,CAAC,CAAC;QAEH,2EAA2E;QAC3E,uEAAuE;QACvE,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAE1C,8DAA8D;QAC9D,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACjC,MAAM,OAAO,GAAG,sBAAsB,CAAC,cAAc,CAAC,CAAC;YAEvD,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;gBAC5B,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,EAAE,gBAAgB,EAAE,KAAK,CAAC,aAAa,EAAE;oBAC3E,cAAc;oBACd,qBAAqB;iBACtB,CAAC,CAAC;gBACH,QAAQ,CAAC,mBAAmB,EAAE;oBAC5B,aAAa,EAAE,KAAK,CAAC,aAAa;oBAClC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;oBAC3B,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE;oBACvB,UAAU,EAAE,GAAG,CAAC,UAAU;oBAC1B,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,YAAY,EAAE,GAAG,CAAC,YAAY;oBAC9B,UAAU,EAAE,cAAc;oBAC1B,UAAU;oBACV,OAAO,EAAE,gBAAgB;iBAC1B,CAAC,CAAC;gBACH,OAAO,eAAe,CAAC;oBACrB,aAAa,EAAE,KAAK,CAAC,aAAa;oBAClC,OAAO,EAAE,WAAW;oBACpB,YAAY,EAAE,gBAAgB;oBAC9B,cAAc;oBACd,UAAU;iBACX,CAAC,CAAC;YACL,CAAC;YAED,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;gBACxB,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,EAAE,gBAAgB,EAAE,KAAK,CAAC,aAAa,EAAE;oBAC/E,cAAc;oBACd,qBAAqB;oBACrB,aAAa,EAAE,6BAA6B,cAAc,EAAE;iBAC7D,CAAC,CAAC;gBACH,MAAM,CAAC,IAAI,CAAC,yCAAyC,EAAE;oBACrD,aAAa,EAAE,KAAK,CAAC,aAAa;oBAClC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;oBAC3B,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE;oBACvB,UAAU,EAAE,GAAG,CAAC,UAAU;oBAC1B,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,YAAY,EAAE,GAAG,CAAC,YAAY;oBAC9B,UAAU,EAAE,cAAc;oBAC1B,UAAU;oBACV,OAAO,EAAE,gBAAgB;iBAC1B,CAAC,CAAC;gBACH,OAAO,eAAe,CAAC;oBACrB,aAAa,EAAE,KAAK,CAAC,aAAa;oBAClC,OAAO,EAAE,iBAAiB;oBAC1B,YAAY,EAAE,gBAAgB;oBAC9B,cAAc;oBACd,UAAU;iBACX,CAAC,CAAC;YACL,CAAC;YAED,gEAAgE;QAClE,CAAC;QAED,6DAA6D;QAC7D,oDAAoD;QACpD,MAAM,aAAa,GACjB,YAAY,IAAI,yBAAyB,cAAc,IAAI,SAAS,EAAE,CAAC;QAEzE,IAAI,gBAAgB,IAAI,YAAY,EAAE,CAAC;YACrC,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,EAAE,gBAAgB,EAAE,KAAK,CAAC,aAAa,EAAE;gBAC/E,cAAc;gBACd,qBAAqB;gBACrB,aAAa,EAAE,GAAG,aAAa,eAAe,YAAY,WAAW;aACtE,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,6CAA6C,EAAE;gBACzD,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;gBAC3B,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE;gBACvB,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,YAAY,EAAE,GAAG,CAAC,YAAY;gBAC9B,UAAU,EAAE,cAAc;gBAC1B,UAAU;gBACV,OAAO,EAAE,gBAAgB;gBACzB,aAAa;aACd,CAAC,CAAC;YACH,OAAO,eAAe,CAAC;gBACrB,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,OAAO,EAAE,iBAAiB;gBAC1B,YAAY,EAAE,gBAAgB;gBAC9B,cAAc;gBACd,UAAU;aACX,CAAC,CAAC;QACL,CAAC;QAED,MAAM,aAAa,GAAG,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;QAC7D,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,EAAE,gBAAgB,EAAE,KAAK,CAAC,aAAa,EAAE;YAC/E,cAAc;YACd,qBAAqB;YACrB,aAAa;YACb,aAAa;SACd,CAAC,CAAC;QACH,QAAQ,CAAC,kCAAkC,EAAE;YAC3C,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;YAC3B,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE;YACvB,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,YAAY,EAAE,GAAG,CAAC,YAAY;YAC9B,UAAU,EAAE,cAAc;YAC1B,UAAU;YACV,OAAO,EAAE,gBAAgB;YACzB,aAAa,EAAE,aAAa,CAAC,WAAW,EAAE;YAC1C,aAAa;SACd,CAAC,CAAC;QACH,OAAO,eAAe,CAAC;YACrB,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,OAAO,EAAE,iBAAiB;YAC1B,YAAY,EAAE,gBAAgB;YAC9B,cAAc;YACd,UAAU;SACX,CAAC,CAAC;IACL,CAAC;CACF,CAAC,CAAC;AAEH,wEAAwE;AACxE,6EAA6E;AAC7E,qEAAqE;AACrE,sDAAsD","sourcesContent":["/**\n * M2M Webhook Delivery Batch Worker\n *\n * Event-triggered custom batch — one job per delivery row enqueued by\n * `M2MWebhookDispatcherBackendService.enqueueDelivery`. The worker:\n *   1. Re-reads the row from `M2MWebhookDeliveryLog` (ground truth —\n *      we never trust in-flight queue state for the body or signature).\n *   2. Marks it `IN_FLIGHT` (incrementing `attemptCount`).\n *   3. Builds the JWT signature with `JwtPrivateKeys.APPLICATION_WEBHOOK`.\n *   4. POSTs the body with a 30s `AbortController` timeout.\n *   5. Classifies the response and records the terminal/intermediate\n *      transition on the row.\n *\n * Status classification (D6):\n *   - 2xx                            → DELIVERED (terminal success).\n *   - 4xx, excluding 408 / 429       → FAILED (terminal — non-retryable).\n *   - 408 / 429 / 5xx / network      → mark failed attempt; if\n *                                       `attemptCount >= MAX_ATTEMPTS`,\n *                                       transition to FAILED.\n *\n * Custom batches are factory-created rather than constructor-injected. This\n * batch therefore declares its exact services through `resolveDependencies`;\n * the executor resolves them lazily for each invocation and `doHandle`\n * receives only the typed named result.\n *\n * @see m2m-webhook-organization-delivery.md — Phase 3 / Step 10\n * @see notifications/email/services/email-batch-send.batch.backend.service.ts\n *   (precedent: same pattern for an event-triggered custom batch).\n */\n\nimport { z } from 'zod';\nimport {\n  AuthScopeType,\n  M2M_WEBHOOK_DELIVERY_CONTRACT,\n  webhookEndpointDestinationHost,\n  webhookEndpointTransportIsPlaintext,\n} from '@wildo-ai/saas-models';\nimport {\n  createCustomBatchExecutionService,\n  type BatchesCronjobsCustomExecution_Service,\n} from '~wildo-backend-lib/base-classes/services/batches/batches-cronjobs-custom-execution.service';\nimport { ENGINE_M2M_WEBHOOK_DELIVERY_BATCH_MANIFEST } from '~wildo-backend-lib/base-classes/services/batches/engine-custom-batch-manifests';\nimport { describeCaughtError, projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { JwtBackendService } from '~wildo-backend-lib/security/jwt/services/jwt.backend.service';\nimport { JwtPrivateKeys } from '~wildo-backend-lib/security/authentications/models/jwt.backend.schemas';\nimport type { MetricsService } from '~wildo-backend-lib/monitoring/observability/services/metrics.service';\nimport type { M2MWebhookDeliveryLogRepository } from '~wildo-backend-lib/notifications/webhooks/outbound/services/m2m-webhook-delivery-log.repository';\nimport {\n  MAX_ATTEMPTS,\n  classifyResponseStatus,\n  computeNextAttemptAt,\n} from './m2m-webhook-delivery.batch.utils';\nimport { M2M_WEBHOOK_BODY_HASH_ALGORITHM, sendSignedWebhookRequest } from '../m2m-webhook-signed-request.backend.utils';\n\n// ═══════════════════════════════════════════════════════════════════════════\n// Input / Output schemas\n// ═══════════════════════════════════════════════════════════════════════════\n\n/**\n * The dispatcher writes the row first, then enqueues this lightweight\n * payload. Keeping the payload minimal (id + scope) makes the worker\n * resilient to queue / DB race conditions: re-reading the row is the\n * source of truth.\n */\n/**\n * Endpoints already warned about in this process, so a permanently-plaintext destination costs one\n * line rather than one per delivery (#492).\n *\n * ## Why the warning is HERE, and why it is once\n *\n * Plaintext endpoints are ADMITTED — a commercial accommodation recorded on\n * `WebhookEndpointSchema.url` — and the cost of admitting them is that the decision becomes\n * invisible. The obvious place to say so is the moment an endpoint is SAVED, and that place does\n * not exist: `webhookConfig` declares CREATE and UPDATE `REPOSITORY_ONLY` with no admin route, and\n * the only writer that exists (data seeding) reaches the row through `upsertByBusinessKey`, a raw\n * repository call that no operation-pipeline hook observes. A postfix handler there would have been\n * a mechanism nothing runs — the shape this whole review exists to remove.\n *\n * The delivery IS the exposure, so this is where it can be stated truthfully: every POST over\n * `http://` puts the signature JWT on the wire in the clear, readable and replayable by anyone on\n * the path until it expires.\n *\n * Once per endpoint per process, because a webhook configuration is stable: a WARN on every\n * delivery would be a line an operator learns to filter, and a filtered warning is the same as no\n * warning. The set is bounded by the endpoint population and is deliberately NOT time-based — the\n * fact does not become news again after an hour, it becomes news again when the process restarts\n * and re-reads a configuration somebody may have changed.\n */\nconst PLAINTEXT_ENDPOINTS_ALREADY_WARNED = new Set<string>();\n\nexport const M2MWebhookDeliveryBatchInputSchema = z.object({\n  scope: z.object({\n    type: z.enum(AuthScopeType),\n    id: z.string().min(1),\n  }),\n  deliveryLogId: z.string().min(1),\n});\n\nexport type M2MWebhookDeliveryBatchInput = z.infer<typeof M2MWebhookDeliveryBatchInputSchema>;\n\nexport const M2MWebhookDeliveryBatchOutputSchema = z.object({\n  deliveryLogId: z.string(),\n  /**\n   * High-level outcome string. Stored only in the worker output for\n   * cron / log inspection; the persisted truth lives on the row's\n   * `status` field.\n   */\n  outcome: z.enum([\n    'delivered',\n    'retry_scheduled',\n    'failed_terminal',\n    'skipped_missing_row',\n    'skipped_already_leased',\n  ]),\n  attemptCount: z.number().int().nonnegative(),\n  responseStatus: z.number().int().optional(),\n  durationMs: z.number().int().nonnegative(),\n});\n\nexport type M2MWebhookDeliveryBatchOutput = z.infer<typeof M2MWebhookDeliveryBatchOutputSchema>;\n\n// ═══════════════════════════════════════════════════════════════════════════\n// Batch Service\n// ═══════════════════════════════════════════════════════════════════════════\n\nexport const m2mWebhookDeliveryBatchService: BatchesCronjobsCustomExecution_Service<\n  typeof M2MWebhookDeliveryBatchInputSchema,\n  typeof M2MWebhookDeliveryBatchOutputSchema\n> = createCustomBatchExecutionService({\n  input: M2MWebhookDeliveryBatchInputSchema,\n  output: M2MWebhookDeliveryBatchOutputSchema,\n  batchCronjob_Context: {\n    // Anchored on the `APPLICATION` primary scope rather than a fake\n    // `ORGANIZATION_M2M_WEBHOOK_DELIVERY_LOG` operation: an event-triggered\n    // polymorphic worker has no honest \"primary\" resource (each enqueued\n    // row carries its own `scope: { type, id }` and routes to either\n    // `ORGANIZATION_M2M_WEBHOOK_DELIVERY_LOG` or\n    // `APPLICATION_M2M_WEBHOOK_DELIVERY_LOG` via\n    // `resolveDeliveryLogResourceType` in\n    // `m2m-webhook-delivery-log.repository.ts`).\n    //\n    // The bootstrap path inside\n    // `ExecutionContextCreatorBackendService.createForInternalCustomBatch`\n    // resolves an `APPLICATION.READ` operation, populates the application\n    // id, then swaps in `notifications:m2m-webhook-delivery` via\n    // `withOperation()`. Audit trails surface the honest batch identity\n    // and authorization runs against `APP_ADMIN_SUPER_ADMIN @ APPLICATION`\n    // (see `createInternalSystemRoles()`), exactly as before, but without\n    // pretending the worker mutates the org-variant log on every job —\n    // including for app-scoped deliveries where that anchor was a\n    // flat-out lie. Per-row resource-type resolution (org vs app) stays\n    // inside the worker and is driven off the per-row `input.scope.type`.\n    kind: ENGINE_M2M_WEBHOOK_DELIVERY_BATCH_MANIFEST.kind,\n    operationIdentifier: ENGINE_M2M_WEBHOOK_DELIVERY_BATCH_MANIFEST.operationIdentifier,\n    primaryScope: ENGINE_M2M_WEBHOOK_DELIVERY_BATCH_MANIFEST.primaryScope,\n  },\n  resolveDependencies: ({ get }) => ({\n    repository: get<M2MWebhookDeliveryLogRepository>(\n      SAAS_SERVICE_TYPES.M2MWebhookDeliveryLogRepository,\n    ),\n    jwtService: get<JwtBackendService>(SAAS_SERVICE_TYPES.JwtBackendService),\n    metricsService: get<MetricsService>(SAAS_SERVICE_TYPES.MetricsService),\n  }),\n  doHandle: async (input, { logger, executionContext, dependencies }) => {\n    const startedAt = Date.now();\n    const logDebug = logger.debugByType('M2MWebhookDeliveryBatch');\n    const {\n      repository: repo,\n      jwtService,\n      metricsService,\n    } = dependencies;\n\n    /**\n     * Single funnel for every `doHandle` return-point. Mirrors the\n     * batch output back to the caller while firing the Phase 5 /\n     * Step 17 outcome counter exactly once per worker invocation.\n     *\n     * Kept inline (not extracted to a module-level helper) because it\n     * closes over `metricsService` and `input.scope.type` — lifting it\n     * would need re-threading both via parameters on every call site\n     * and would dilute the fire-exactly-once contract this funnel\n     * enforces.\n     *\n     * Metric emission is error-isolated for the same reason the audit\n     * helper swallows its failures: observability MUST NEVER fail the\n     * main flow. By the time `recordAndReturn` runs, the row has\n     * already been persisted with the correct terminal/intermediate\n     * status — letting an OpenTelemetry exporter glitch abort the\n     * batch invocation here would leave the custom-batch runner\n     * reporting the run as failed even though the real delivery\n     * completed and the truth-source row reflects success.\n     */\n    const recordAndReturn = (\n      output: M2MWebhookDeliveryBatchOutput,\n    ): M2MWebhookDeliveryBatchOutput => {\n      try {\n        metricsService.recordM2MWebhookDeliveryOutcome({\n          scope: input.scope.type,\n          outcome: output.outcome,\n        });\n      } catch (error) {\n        logger.warn('Failed to record M2M webhook delivery outcome metric', {\n          deliveryLogId: input.deliveryLogId,\n          scopeType: input.scope.type,\n          scopeId: input.scope.id,\n          outcome: output.outcome,\n          ...projectCaughtErrorLogFields(error),\n        });\n      }\n      return output;\n    };\n\n    // ── Load the row (ground truth) ────────────────────────────\n    const row = await repo.read(input.scope, executionContext, input.deliveryLogId);\n    if (!row) {\n      // Possible if the row was purged between enqueue and worker\n      // execution (admin `PURGE_OLD`). Quiet skip — there is nothing\n      // to deliver and no caller to surface the absence to.\n      logger.warn('Webhook delivery row not found; skipping', {\n        deliveryLogId: input.deliveryLogId,\n        scopeType: input.scope.type,\n        scopeId: input.scope.id,\n      });\n      return recordAndReturn({\n        deliveryLogId: input.deliveryLogId,\n        outcome: 'skipped_missing_row',\n        attemptCount: 0,\n        durationMs: Date.now() - startedAt,\n      });\n    }\n\n    const nextAttemptCount = (row.attemptCount ?? 0) + 1;\n\n    // ── Lease the row (atomic CAS) ─────────────────────────────\n    // `markInFlight` is a compare-and-swap on `status: PENDING`. If\n    // another worker already leased the row (cron retry sweep + queue\n    // redelivery race), the CAS returns false and we exit cleanly —\n    // double-POSTs and double-counted attempts would corrupt the\n    // retry budget and the consumer's idempotency guarantees.\n    const leased = await repo.markInFlight(\n      input.scope,\n      executionContext,\n      input.deliveryLogId,\n      nextAttemptCount,\n    );\n    if (!leased) {\n      logger.warn('Webhook delivery row already leased by another worker; skipping', {\n        deliveryLogId: input.deliveryLogId,\n        scopeType: input.scope.type,\n        scopeId: input.scope.id,\n        endpointId: row.endpointId,\n        httpUrl: row.httpUrl,\n        signatureJti: row.signatureJti,\n        currentStatus: row.status,\n      });\n      return recordAndReturn({\n        deliveryLogId: input.deliveryLogId,\n        outcome: 'skipped_already_leased',\n        attemptCount: row.attemptCount ?? 0,\n        durationMs: Date.now() - startedAt,\n      });\n    }\n\n    // ── Build the JWT signature (D5: claims-JWT) ───────────────\n    // The body itself is NOT in the JWT — only its sha256 hash. This\n    // keeps the header small (some HTTP intermediaries cap header\n    // size) and lets consumers verify integrity independently of the\n    // raw body bytes (which they can re-hash).\n    const claims = {\n      // `jti` is the consumer-facing dedup key. It is stable across\n      // every retry of THIS delivery row (same value re-signed each\n      // attempt) and unique across rows. Consumers MUST dedup on\n      // `jti` — the rest of the token (`iat`, `exp`, signature) is\n      // refreshed per attempt and so cannot serve as a replay marker.\n      // See `m2m-webhook-dispatcher.backend.service.ts` (`signatureJti`\n      // creation site) for the full consumer-contract JSDoc.\n      // Claim NAMES come from the published receiver contract so the customer\n      // documentation and this signing site cannot drift apart.\n      [M2M_WEBHOOK_DELIVERY_CONTRACT.signatureClaims.deliveryId]: row.signatureJti,\n      [M2M_WEBHOOK_DELIVERY_CONTRACT.signatureClaims.bodyHash]: row.payloadHash,\n      [M2M_WEBHOOK_DELIVERY_CONTRACT.signatureClaims.bodyHashAlgorithm]: M2M_WEBHOOK_BODY_HASH_ALGORITHM,\n      [M2M_WEBHOOK_DELIVERY_CONTRACT.signatureClaims.eventChannel]: row.channel,\n      [M2M_WEBHOOK_DELIVERY_CONTRACT.signatureClaims.resourceIdentifier]: row.resourceIdentifier,\n      [M2M_WEBHOOK_DELIVERY_CONTRACT.signatureClaims.operationIdentifier]: row.operationIdentifier,\n      // `iss`, `iat`, `exp`, `aud`, `kid` defaults come from\n      // `JwtPrivateKeySignOptions[APPLICATION_WEBHOOK]`. We don't\n      // override them here — the consumer-facing contract is the\n      // signing options table, not this call site.\n    };\n\n    let signature: string;\n    try {\n      signature = await jwtService.sign(claims, JwtPrivateKeys.APPLICATION_WEBHOOK);\n    } catch (error) {\n      // Signing failure is a configuration problem (missing key) —\n      // re-trying won't help until the operator fixes secrets, so we\n      // mark the row as terminally failed and let admin RETRY pick it\n      // up after the fix.\n      const reason = describeCaughtError(error);\n      logger.error('Failed to sign webhook payload — marking delivery FAILED', {\n        deliveryLogId: input.deliveryLogId,\n        scopeType: input.scope.type,\n        scopeId: input.scope.id,\n        endpointId: row.endpointId,\n        httpUrl: row.httpUrl,\n        signatureJti: row.signatureJti,\n        attempt: nextAttemptCount,\n        error,\n      });\n      await repo.markFinallyFailed(input.scope, executionContext, input.deliveryLogId, {\n        failureReason: `JWT signing failed: ${reason}`,\n      });\n      return recordAndReturn({\n        deliveryLogId: input.deliveryLogId,\n        outcome: 'failed_terminal',\n        attemptCount: nextAttemptCount,\n        durationMs: Date.now() - startedAt,\n      });\n    }\n\n    // ── POST the body ──────────────────────────────────────────\n    // Shared with the `webhookConfig.testEndpoint` probe (see\n    // `../m2m-webhook-signed-request.backend.utils`). The admin-facing\n    // connectivity test must exercise THIS transport, not a parallel one,\n    // or a green test would prove nothing about real deliveries.\n    const bodyBytes =\n      typeof row.payload === 'string' ? row.payload : JSON.stringify(row.payload);\n\n    if (webhookEndpointTransportIsPlaintext(row.httpUrl)) {\n      const warnedKey = `${input.scope.type}:${input.scope.id}:${row.endpointId}`;\n      if (!PLAINTEXT_ENDPOINTS_ALREADY_WARNED.has(warnedKey)) {\n        PLAINTEXT_ENDPOINTS_ALREADY_WARNED.add(warnedKey);\n        // NOT debug. The whole point is that an operator meets this without going looking, and\n        // `AbstractControllerBackendService` disables the debug channel — the same trap that made a\n        // readiness breakdown unreachable in #498.\n        logger.warn('Webhook endpoint is plaintext: the delivery signature is sent in the clear', {\n          scopeType: input.scope.type,\n          scopeId: input.scope.id,\n          endpointId: row.endpointId,\n          // Host only, never the URL — a customer endpoint's path routinely carries a per-tenant\n          // token, and this line reaches the ordinary log stream.\n          destinationHost: webhookEndpointDestinationHost(row.httpUrl),\n          exposure: 'The signature JWT is readable on the network path and replayable against this '\n            + 'endpoint until it expires, so an observer of one delivery can forge the next.',\n          remedy: 'Reconfigure this endpoint with an https:// URL.',\n        });\n      }\n    }\n\n    const { responseStatus, responseBodyTruncated, networkError } = await sendSignedWebhookRequest({\n      url: row.httpUrl,\n      body: bodyBytes,\n      signature,\n    });\n\n    // Job-level duration: spans the row re-read and lease as well as the POST,\n    // so it stays the batch's own measurement rather than the transport's.\n    const durationMs = Date.now() - startedAt;\n\n    // ── Classify + persist transition ──────────────────────────\n    if (responseStatus !== undefined) {\n      const verdict = classifyResponseStatus(responseStatus);\n\n      if (verdict === 'delivered') {\n        await repo.markDelivered(input.scope, executionContext, input.deliveryLogId, {\n          responseStatus,\n          responseBodyTruncated,\n        });\n        logDebug('Webhook delivered', {\n          deliveryLogId: input.deliveryLogId,\n          scopeType: input.scope.type,\n          scopeId: input.scope.id,\n          endpointId: row.endpointId,\n          httpUrl: row.httpUrl,\n          signatureJti: row.signatureJti,\n          httpStatus: responseStatus,\n          durationMs,\n          attempt: nextAttemptCount,\n        });\n        return recordAndReturn({\n          deliveryLogId: input.deliveryLogId,\n          outcome: 'delivered',\n          attemptCount: nextAttemptCount,\n          responseStatus,\n          durationMs,\n        });\n      }\n\n      if (verdict === 'fatal') {\n        await repo.markFinallyFailed(input.scope, executionContext, input.deliveryLogId, {\n          responseStatus,\n          responseBodyTruncated,\n          failureReason: `non-retryable HTTP status ${responseStatus}`,\n        });\n        logger.warn('Webhook delivery failed (non-retryable)', {\n          deliveryLogId: input.deliveryLogId,\n          scopeType: input.scope.type,\n          scopeId: input.scope.id,\n          endpointId: row.endpointId,\n          httpUrl: row.httpUrl,\n          signatureJti: row.signatureJti,\n          httpStatus: responseStatus,\n          durationMs,\n          attempt: nextAttemptCount,\n        });\n        return recordAndReturn({\n          deliveryLogId: input.deliveryLogId,\n          outcome: 'failed_terminal',\n          attemptCount: nextAttemptCount,\n          responseStatus,\n          durationMs,\n        });\n      }\n\n      // verdict === 'retry' — fall through to the retry branch below.\n    }\n\n    // Retryable failure (5xx, 408, 429, network/timeout). Decide\n    // between scheduling another attempt and giving up.\n    const failureReason =\n      networkError ?? `retryable HTTP status ${responseStatus ?? 'unknown'}`;\n\n    if (nextAttemptCount >= MAX_ATTEMPTS) {\n      await repo.markFinallyFailed(input.scope, executionContext, input.deliveryLogId, {\n        responseStatus,\n        responseBodyTruncated,\n        failureReason: `${failureReason} (retry cap ${MAX_ATTEMPTS} reached)`,\n      });\n      logger.warn('Webhook delivery failed (retry cap reached)', {\n        deliveryLogId: input.deliveryLogId,\n        scopeType: input.scope.type,\n        scopeId: input.scope.id,\n        endpointId: row.endpointId,\n        httpUrl: row.httpUrl,\n        signatureJti: row.signatureJti,\n        httpStatus: responseStatus,\n        durationMs,\n        attempt: nextAttemptCount,\n        failureReason,\n      });\n      return recordAndReturn({\n        deliveryLogId: input.deliveryLogId,\n        outcome: 'failed_terminal',\n        attemptCount: nextAttemptCount,\n        responseStatus,\n        durationMs,\n      });\n    }\n\n    const nextAttemptAt = computeNextAttemptAt(nextAttemptCount);\n    await repo.markFailedAttempt(input.scope, executionContext, input.deliveryLogId, {\n      responseStatus,\n      responseBodyTruncated,\n      failureReason,\n      nextAttemptAt,\n    });\n    logDebug('Webhook delivery retry scheduled', {\n      deliveryLogId: input.deliveryLogId,\n      scopeType: input.scope.type,\n      scopeId: input.scope.id,\n      endpointId: row.endpointId,\n      httpUrl: row.httpUrl,\n      signatureJti: row.signatureJti,\n      httpStatus: responseStatus,\n      durationMs,\n      attempt: nextAttemptCount,\n      nextAttemptAt: nextAttemptAt.toISOString(),\n      failureReason,\n    });\n    return recordAndReturn({\n      deliveryLogId: input.deliveryLogId,\n      outcome: 'retry_scheduled',\n      attemptCount: nextAttemptCount,\n      responseStatus,\n      durationMs,\n    });\n  },\n});\n\n// Batch reference identifier lives in the declarative manifest registry\n// (`engine-custom-batch-manifests`); import `M2M_WEBHOOK_DELIVERY_BATCH_REF`\n// from there to keep a single source of truth across runtime wiring,\n// queue dispatch, and specification cross-validation.\n"]}

package/dist/esm/notifications/webhooks/outbound/m2m-webhook-signed-request.backend.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"m2m-webhook-signed-request.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../../src/notifications/webhooks/outbound/m2m-webhook-signed-request.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,6BAA6B,EAAmB,MAAM,uBAAuB,CAAC;AAkEvF,8EAA8E;AAC9E,eAAO,MAAM,+BAA+B,EAAE,OAAO,6BAA6B,CAAC,iBAAmE,CAAC;AAEvJ;;;;;;;;GAQG;AACH,MAAM,MAAM,0BAA0B,GAAG;IACvC,2DAA2D;IAC3D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,0FAA0F;IAC1F,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,uFAAuF;IACvF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iFAAiF;IACjF,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAuCF;;;;;;;;;GASG;AACH,wBAAsB,wBAAwB,CAAC,MAAM,EAAE;IACrD,gCAAgC;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,6EAA6E;IAC7E,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAsEtC"}
+{"version":3,"file":"m2m-webhook-signed-request.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../../src/notifications/webhooks/outbound/m2m-webhook-signed-request.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,6BAA6B,EAAmB,MAAM,uBAAuB,CAAC;AA4EvF,8EAA8E;AAC9E,eAAO,MAAM,+BAA+B,EAAE,OAAO,6BAA6B,CAAC,iBAAmE,CAAC;AAEvJ;;;;;;;;GAQG;AACH,MAAM,MAAM,0BAA0B,GAAG;IACvC,2DAA2D;IAC3D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,0FAA0F;IAC1F,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,uFAAuF;IACvF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iFAAiF;IACjF,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAuCF;;;;;;;;;GASG;AACH,wBAAsB,wBAAwB,CAAC,MAAM,EAAE;IACrD,gCAAgC;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,6EAA6E;IAC7E,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAsEtC"}

package/dist/esm/notifications/webhooks/outbound/m2m-webhook-signed-request.backend.utils.js

@@ -29,12 +29,22 @@ import { REQUEST_TIMEOUT_MS, WEBHOOK_USER_AGENT, truncateBody, } from './batches
 /**
  * Schemes an outbound webhook delivery may use.
  *
- * `http:` is admitted, and that is a DEFERRED decision rather than an endorsement. The A2A sibling
- * requires HTTPS unconditionally, and the same argument applies here — the signature JWT in transit
- * is a credential. But `WebhookEndpointSchema.url` is a bare `z.url()`, so plaintext endpoints are
- * authorable today and may already be authored; refusing them here would silently stop deliveries for
- * tenants whose configuration was accepted by the framework. Tightening this is a product decision
- * with a migration, not a hardening pass.
+ * `http:` is admitted. DECIDED 2026-09-08 (#492): keep admitting it, and document the exposure where
+ * a customer authors the endpoint — which is now done, on `WebhookEndpointSchema.url`.
+ *
+ * This is a COMMERCIAL accommodation, not a security assessment, and the distinction is the whole
+ * point of writing it down. The A2A sibling requires HTTPS unconditionally and the same argument
+ * applies here — the signature JWT in transit is a credential, readable on the path and replayable
+ * until it expires, so an observer of one delivery can forge the next. What was chosen is not to break
+ * endpoints that a previous version of the framework accepted.
+ *
+ * The two options NOT taken, either of which is the better security answer: require HTTPS with a
+ * migration that identifies and notifies existing plaintext endpoints, or require it for new endpoints
+ * and grandfather existing ones behind an explicit acknowledgement. The second is the one to revisit
+ * first — it stops the plaintext population growing without breaking anyone today.
+ *
+ * Reopen on an observed interception, or on a customer compliance requirement. Do not reopen it as a
+ * tidy-up: the asymmetry with the A2A caller is deliberate and is recorded at both sites.
  */
 const M2M_WEBHOOK_ADMITTED_PROTOCOLS = ['https:', 'http:'];
 /**

package/dist/esm/notifications/webhooks/outbound/m2m-webhook-signed-request.backend.utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"m2m-webhook-signed-request.backend.utils.js","sourceRoot":"","sources":["../../../../../../src/notifications/webhooks/outbound/m2m-webhook-signed-request.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,6BAA6B,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACvF,OAAO,EACL,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,sEAAsE,CAAC;AAC9E,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,YAAY,GACb,MAAM,4CAA4C,CAAC;AAEpD;;;;;;;;;GASG;AACH,MAAM,8BAA8B,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAU,CAAC;AAEpE;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,SAAS,yBAAyB,CAAC,GAAW;IAC5C,MAAM,SAAS,GAAG,yBAAyB,CAAC,GAAG,EAAE,EAAE,iBAAiB,EAAE,8BAA8B,EAAE,CAAC,CAAC;IACxG,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,SAAS;YACZ,OAAO,SAAS,CAAC;QACnB,KAAK,uBAAuB,CAAC,4BAA4B;YACvD,OAAO,kDAAkD,CAAC;QAC5D,KAAK,uBAAuB,CAAC,kBAAkB;YAC7C,0FAA0F;YAC1F,wCAAwC;YACxC,OAAO,oDAAoD,CAAC;QAC9D,KAAK,uBAAuB,CAAC,2BAA2B;YACtD,OAAO,6FAA6F,CAAC;QACvG,KAAK,uBAAuB,CAAC,6BAA6B;YACxD,OAAO,wDAAwD,CAAC;IACpE,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,MAAM,+BAA+B,GAA2D,6BAA6B,CAAC,iBAAiB,CAAC;AAsBvJ;;;;;;;;;;;;;;GAcG;AACH,SAAS,oBAAoB,CAAC,KAAc;IAC1C,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IAEpD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,OAAO,GAAY,KAAK,CAAC;IAE7B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,IAAI,OAAO,YAAY,KAAK,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACtE,kGAAkG;QAClG,MAAM,IAAI,GAAI,OAAiC,CAAC,IAAI,CAAC;QACrD,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QACzG,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAChB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC;QACD,MAAM,UAAU,GAAG,OAAO,YAAY,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACvF,OAAO,GAAG,UAAU,IAAK,OAA+B,CAAC,KAAK,CAAC;IACjE,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC;AAC5C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,MAyB9C;IACC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,iGAAiG;IACjG,oGAAoG;IACpG,8FAA8F;IAC9F,iGAAiG;IACjG,MAAM,OAAO,GAAG,yBAAyB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACtD,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC;IACvE,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;IACpC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,kBAAkB,CAAC,CAAC;IAElE,IAAI,cAAkC,CAAC;IACvC,IAAI,qBAAyC,CAAC;IAC9C,IAAI,YAAgC,CAAC;IAErC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE;YACvC,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB;;;;;;;;;;;;;;;eAeG;YACH,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,YAAY,EAAE,kBAAkB;gBAChC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,eAAe,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxF,GAAG,MAAM,CAAC,OAAO;aAClB;YACD,IAAI,EAAE,MAAM,CAAC,IAAI;SAClB,CAAC,CAAC;QACH,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,qBAAqB,GAAG,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAChE,CAAC;QAAC,MAAM,CAAC;YACP,4EAA4E;YAC5E,qBAAqB,GAAG,SAAS,CAAC;QACpC,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,YAAY,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO;YACjC,CAAC,CAAC,2BAA2B,kBAAkB,IAAI;YACnD,CAAC,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IAED,OAAO;QACL,cAAc;QACd,qBAAqB;QACrB,YAAY;QACZ,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;KACnC,CAAC;AACJ,CAAC","sourcesContent":["/**\n * The single outbound-transport primitive for M2M webhooks.\n *\n * Every signed request Wildo emits to a customer endpoint goes through\n * {@link sendSignedWebhookRequest} — the retry worker's real deliveries AND the\n * `webhookConfig.testEndpoint` synthetic probe. Two call sites, one implementation, on\n * purpose: a probe that reached the endpoint through a *different* code path would\n * validate that path rather than the delivery path, which is precisely the reassurance an\n * admin is asking for when they press \"test\". Timeout, User-Agent, signature header name,\n * and body-truncation behaviour are therefore not re-decided per caller.\n *\n * Scope boundary — this module owns the WIRE, nothing else. It does not sign (callers hold\n * their own claims), does not classify (see `classifyResponseStatus`), does not persist,\n * and never throws on a transport failure: an unreachable endpoint is data the caller must\n * report, not an exception. The only way to get an exception out of here is to pass\n * something that is not a valid request.\n *\n * The tunables come from `./batches/m2m-webhook-delivery.batch.utils`, which is\n * deliberately import-free so its pure-decision tests load without the DI graph. They are\n * left there rather than moved up here precisely to preserve that property — this module\n * performs I/O and would drag `@wildo-ai/saas-models` into those tests.\n *\n * @see batches/m2m-webhook-delivery.batch.backend.service.ts — real deliveries.\n * @see services/webhook-config-test-endpoint.custom-impl.backend.service.ts — synthetic probe.\n */\n\nimport { M2M_WEBHOOK_DELIVERY_CONTRACT, WildoHeaderKeys } from '@wildo-ai/saas-models';\nimport {\n  OutboundTargetRejection,\n  classifyOutboundTargetUrl,\n} from '~wildo-backend-lib/security/ssrf/outbound-target-guard.backend.utils';\nimport {\n  REQUEST_TIMEOUT_MS,\n  WEBHOOK_USER_AGENT,\n  truncateBody,\n} from './batches/m2m-webhook-delivery.batch.utils';\n\n/**\n * Schemes an outbound webhook delivery may use.\n *\n * `http:` is admitted, and that is a DEFERRED decision rather than an endorsement. The A2A sibling\n * requires HTTPS unconditionally, and the same argument applies here — the signature JWT in transit\n * is a credential. But `WebhookEndpointSchema.url` is a bare `z.url()`, so plaintext endpoints are\n * authorable today and may already be authored; refusing them here would silently stop deliveries for\n * tenants whose configuration was accepted by the framework. Tightening this is a product decision\n * with a migration, not a hardening pass.\n */\nconst M2M_WEBHOOK_ADMITTED_PROTOCOLS = ['https:', 'http:'] as const;\n\n/**\n * Refuse a destination that would turn this server into a request-forgery tool.\n *\n * ## Why the guard is HERE and not on the schema\n *\n * `WebhookEndpointSchema.url` validates shape (`z.url()`) and nothing else, so an admin could author\n * `http://169.254.169.254/latest/meta-data/` and the engine would POST signed payloads to the cloud\n * instance-metadata service — then capture the answer into the delivery log as\n * `responseBodyTruncated`. That makes it a READ primitive, not a blind SSRF, and\n * `webhookConfig.testEndpoint` is a low-friction oracle for it.\n *\n * A schema refine would leave two holes this placement does not have: it would not cover endpoints\n * ALREADY STORED before the refine existed, and it would not cover the A2A push-delivery worker,\n * which reaches this same primitive with a URL its own (separate) guard validated at configuration\n * time. Putting the check at the wire makes it unbypassable for every caller — present and future —\n * which is what `.claude/rules/invariant-call-site-enumeration.md` means by preferring one\n * chokepoint over N hand-applied predicates.\n *\n * ## What it cannot do\n *\n * An ordinary hostname is not resolved, so `hook.attacker.test` with an A record of `169.254.169.254`\n * still passes. That residual is inherited from the shared classifier and is stated there; closing it\n * needs either a resolving check (a check-then-connect, still open to rebinding) or egress-path\n * enforcement. It is a deliberate open item, not an oversight.\n */\nfunction refuseUnsafeWebhookTarget(url: string): string | undefined {\n  const rejection = classifyOutboundTargetUrl(url, { admittedProtocols: M2M_WEBHOOK_ADMITTED_PROTOCOLS });\n  switch (rejection) {\n    case undefined:\n      return undefined;\n    case OutboundTargetRejection.NOT_ABSOLUTE_ADMITTED_SCHEME:\n      return 'refused: endpoint is not an absolute http(s) URL';\n    case OutboundTargetRejection.CREDENTIALS_IN_URL:\n      // Credentials in the URL would be replayed on every delivery and would land in any log or\n      // delivery row that records the target.\n      return 'refused: endpoint URL carries embedded credentials';\n    case OutboundTargetRejection.PRIVATE_OR_RESERVED_ADDRESS:\n      return 'refused: endpoint resolves to a private, loopback, link-local or otherwise reserved address';\n    case OutboundTargetRejection.RESERVED_SPECIAL_USE_HOSTNAME:\n      return 'refused: endpoint uses a reserved special-use hostname';\n  }\n}\n\n/** Consumer-facing digest algorithm carried in every outbound webhook JWT. */\nexport const M2M_WEBHOOK_BODY_HASH_ALGORITHM: typeof M2M_WEBHOOK_DELIVERY_CONTRACT.bodyHashAlgorithm = M2M_WEBHOOK_DELIVERY_CONTRACT.bodyHashAlgorithm;\n\n/**\n * Outcome of one attempt at the wire level.\n *\n * `responseStatus` and `networkError` are mutually exclusive and exhaustive: either the\n * endpoint produced an HTTP response or it did not. Callers classify from there — this\n * type deliberately carries no verdict of its own, because \"429 is retryable\" is a\n * delivery-policy question and \"429 means the endpoint is reachable\" is a probe question,\n * and the same status answers both differently.\n */\nexport type SignedWebhookRequestResult = {\n  /** Set when the endpoint answered, whatever the status. */\n  responseStatus?: number;\n  /** Best-effort capture of the consumer's response body, truncated on a UTF-8 boundary. */\n  responseBodyTruncated?: string;\n  /** Set when no HTTP response was obtained (DNS/TLS/connection failure, or timeout). */\n  networkError?: string;\n  /** Wall-clock duration of this attempt alone, excluding any caller-side work. */\n  durationMs: number;\n};\n\n/**\n * Render a `fetch` rejection into something an operator can act on.\n *\n * Node's `fetch` (undici) rejects with a flat `TypeError: fetch failed` and buries the actual\n * cause — `ECONNREFUSED`, `ENOTFOUND`, `EHOSTUNREACH`, a TLS failure — one or more levels down in\n * `error.cause`. Reporting only `error.message` tells an admin their endpoint failed without\n * telling them whether the hostname is wrong, the port is closed, or the certificate is bad; for a\n * diagnostic whose entire job is to explain a failure, that is barely better than the silent\n * success this operation used to return. So walk the cause chain and append what it names.\n *\n * `AggregateError` (emitted when every resolved address fails, e.g. happy-eyeballs against a dead\n * host) carries its detail in `errors[]` rather than `cause`, so that shape is unwrapped too.\n * Depth-capped and de-duplicated: the chain is attacker-adjacent input in the sense that a hostile\n * endpoint controls how deep it goes, and a repeated message adds nothing.\n */\nfunction describeFetchFailure(error: unknown): string {\n  if (!(error instanceof Error)) return String(error);\n\n  const parts: string[] = [];\n  const seen = new Set<string>();\n  let current: unknown = error;\n\n  for (let depth = 0; depth < 4 && current instanceof Error; depth += 1) {\n    // `code` is where Node puts the actionable token (ECONNREFUSED, …); the message often repeats it.\n    const code = (current as NodeJS.ErrnoException).code;\n    const label = code && !current.message.includes(code) ? `${current.message} (${code})` : current.message;\n    if (label && !seen.has(label)) {\n      seen.add(label);\n      parts.push(label);\n    }\n    const aggregated = current instanceof AggregateError ? current.errors?.[0] : undefined;\n    current = aggregated ?? (current as { cause?: unknown }).cause;\n  }\n\n  return parts.join(': ') || 'fetch failed';\n}\n\n/**\n * POST a pre-signed body to a webhook endpoint under a hard timeout.\n *\n * Never throws for a transport failure — a refused connection, a DNS miss and a timeout\n * all come back as `networkError`. A timeout is reported with its budget spelled out\n * because \"timed out\" alone sends an operator hunting for the wrong thing.\n *\n * Body capture is best-effort: a consumer that returns an unreadable body still produced a\n * valid status, and losing the body must not turn a successful attempt into a failed one.\n */\nexport async function sendSignedWebhookRequest(params: {\n  /** Absolute destination URL. */\n  url: string;\n  /** Exact bytes to send — already the string whose hash the caller signed. */\n  body: string;\n  /**\n   * Value for the `X-Webhook-Signature` header. Omit when the caller authenticates by another\n   * mechanism and supplies its own {@link headers} — see below.\n   */\n  signature?: string;\n  /**\n   * Caller-supplied headers, MERGED OVER the defaults.\n   *\n   * Added for the A2A push-notification worker, which authenticates with the CLIENT's declared\n   * scheme (`Authorization: {scheme} {credentials}`) and sends `application/a2a+json` rather than\n   * Wildo's own ES256 signature and `application/json`.\n   *\n   * Widening this primitive instead of writing a second POST is deliberate, and follows the module\n   * header's own claim to own THE WIRE: timeout, abort handling, failure description and body\n   * truncation are the parts that are easy to get subtly wrong and expensive to have two of. What\n   * varies between callers is authentication and media type — which are exactly the two things a\n   * caller is in a position to decide. Purely additive: `signature` stays optional-by-absence for\n   * the two existing M2M call sites, whose behaviour is byte-for-byte unchanged.\n   */\n  headers?: Record<string, string>;\n}): Promise<SignedWebhookRequestResult> {\n  const startedAt = Date.now();\n\n  // Refused BEFORE any timer or connection: a target the guard rejects must produce no DNS lookup,\n  // no socket, and no signed body on the wire. Reported as `networkError` rather than thrown, because\n  // this module's contract is that a destination problem is DATA the caller reports — the probe\n  // surfaces it to the admin as UNREACHABLE and the delivery worker records it on the attempt row.\n  const refusal = refuseUnsafeWebhookTarget(params.url);\n  if (refusal) {\n    return { networkError: refusal, durationMs: Date.now() - startedAt };\n  }\n\n  const abort = new AbortController();\n  const timer = setTimeout(() => abort.abort(), REQUEST_TIMEOUT_MS);\n\n  let responseStatus: number | undefined;\n  let responseBodyTruncated: string | undefined;\n  let networkError: string | undefined;\n\n  try {\n    const response = await fetch(params.url, {\n      method: 'POST',\n      signal: abort.signal,\n      /**\n       * A redirect is REPORTED, never followed.\n       *\n       * Following one re-points the request at a target the guard above never saw, which is the\n       * guard's most obvious bypass — an admin authors a public URL that 302s to\n       * `http://169.254.169.254/`. It also silently defeats a decision this subsystem had ALREADY\n       * taken and could not enforce: `classifyResponseStatus` classifies 3xx as `fatal` and\n       * `resolveProbeOutcome` classifies it as REJECTED (\"webhooks must not redirect, and a\n       * CDN/proxy redirect on a wrong URL is one of the most common real misconfigurations an admin\n       * uses this probe to find\") — but with `fetch`'s default follow behaviour neither of those\n       * branches could ever execute, because a 3xx never reached them.\n       *\n       * `'manual'` rather than `'error'` on purpose: `'error'` would surface as an opaque network\n       * failure, whereas `'manual'` hands back the 3xx status so both classifiers see the redirect\n       * and tell the admin exactly what their endpoint did.\n       */\n      redirect: 'manual',\n      headers: {\n        'Content-Type': 'application/json',\n        'User-Agent': WEBHOOK_USER_AGENT,\n        ...(params.signature ? { [WildoHeaderKeys.X_WEBHOOK_SIGNATURE]: params.signature } : {}),\n        ...params.headers,\n      },\n      body: params.body,\n    });\n    responseStatus = response.status;\n    try {\n      const text = await response.text();\n      responseBodyTruncated = text ? truncateBody(text) : undefined;\n    } catch {\n      // Best-effort body capture — never fail the attempt on a non-readable body.\n      responseBodyTruncated = undefined;\n    }\n  } catch (error) {\n    networkError = abort.signal.aborted\n      ? `request timed out after ${REQUEST_TIMEOUT_MS}ms`\n      : describeFetchFailure(error);\n  } finally {\n    clearTimeout(timer);\n  }\n\n  return {\n    responseStatus,\n    responseBodyTruncated,\n    networkError,\n    durationMs: Date.now() - startedAt,\n  };\n}\n"]}
+{"version":3,"file":"m2m-webhook-signed-request.backend.utils.js","sourceRoot":"","sources":["../../../../../../src/notifications/webhooks/outbound/m2m-webhook-signed-request.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,6BAA6B,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACvF,OAAO,EACL,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,sEAAsE,CAAC;AAC9E,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,YAAY,GACb,MAAM,4CAA4C,CAAC;AAEpD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,8BAA8B,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAU,CAAC;AAEpE;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,SAAS,yBAAyB,CAAC,GAAW;IAC5C,MAAM,SAAS,GAAG,yBAAyB,CAAC,GAAG,EAAE,EAAE,iBAAiB,EAAE,8BAA8B,EAAE,CAAC,CAAC;IACxG,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,SAAS;YACZ,OAAO,SAAS,CAAC;QACnB,KAAK,uBAAuB,CAAC,4BAA4B;YACvD,OAAO,kDAAkD,CAAC;QAC5D,KAAK,uBAAuB,CAAC,kBAAkB;YAC7C,0FAA0F;YAC1F,wCAAwC;YACxC,OAAO,oDAAoD,CAAC;QAC9D,KAAK,uBAAuB,CAAC,2BAA2B;YACtD,OAAO,6FAA6F,CAAC;QACvG,KAAK,uBAAuB,CAAC,6BAA6B;YACxD,OAAO,wDAAwD,CAAC;IACpE,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,MAAM,+BAA+B,GAA2D,6BAA6B,CAAC,iBAAiB,CAAC;AAsBvJ;;;;;;;;;;;;;;GAcG;AACH,SAAS,oBAAoB,CAAC,KAAc;IAC1C,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IAEpD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,OAAO,GAAY,KAAK,CAAC;IAE7B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,IAAI,OAAO,YAAY,KAAK,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACtE,kGAAkG;QAClG,MAAM,IAAI,GAAI,OAAiC,CAAC,IAAI,CAAC;QACrD,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QACzG,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAChB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC;QACD,MAAM,UAAU,GAAG,OAAO,YAAY,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACvF,OAAO,GAAG,UAAU,IAAK,OAA+B,CAAC,KAAK,CAAC;IACjE,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC;AAC5C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,MAyB9C;IACC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,iGAAiG;IACjG,oGAAoG;IACpG,8FAA8F;IAC9F,iGAAiG;IACjG,MAAM,OAAO,GAAG,yBAAyB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACtD,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC;IACvE,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;IACpC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,kBAAkB,CAAC,CAAC;IAElE,IAAI,cAAkC,CAAC;IACvC,IAAI,qBAAyC,CAAC;IAC9C,IAAI,YAAgC,CAAC;IAErC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE;YACvC,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB;;;;;;;;;;;;;;;eAeG;YACH,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,YAAY,EAAE,kBAAkB;gBAChC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,eAAe,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxF,GAAG,MAAM,CAAC,OAAO;aAClB;YACD,IAAI,EAAE,MAAM,CAAC,IAAI;SAClB,CAAC,CAAC;QACH,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,qBAAqB,GAAG,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAChE,CAAC;QAAC,MAAM,CAAC;YACP,4EAA4E;YAC5E,qBAAqB,GAAG,SAAS,CAAC;QACpC,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,YAAY,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO;YACjC,CAAC,CAAC,2BAA2B,kBAAkB,IAAI;YACnD,CAAC,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IAED,OAAO;QACL,cAAc;QACd,qBAAqB;QACrB,YAAY;QACZ,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;KACnC,CAAC;AACJ,CAAC","sourcesContent":["/**\n * The single outbound-transport primitive for M2M webhooks.\n *\n * Every signed request Wildo emits to a customer endpoint goes through\n * {@link sendSignedWebhookRequest} — the retry worker's real deliveries AND the\n * `webhookConfig.testEndpoint` synthetic probe. Two call sites, one implementation, on\n * purpose: a probe that reached the endpoint through a *different* code path would\n * validate that path rather than the delivery path, which is precisely the reassurance an\n * admin is asking for when they press \"test\". Timeout, User-Agent, signature header name,\n * and body-truncation behaviour are therefore not re-decided per caller.\n *\n * Scope boundary — this module owns the WIRE, nothing else. It does not sign (callers hold\n * their own claims), does not classify (see `classifyResponseStatus`), does not persist,\n * and never throws on a transport failure: an unreachable endpoint is data the caller must\n * report, not an exception. The only way to get an exception out of here is to pass\n * something that is not a valid request.\n *\n * The tunables come from `./batches/m2m-webhook-delivery.batch.utils`, which is\n * deliberately import-free so its pure-decision tests load without the DI graph. They are\n * left there rather than moved up here precisely to preserve that property — this module\n * performs I/O and would drag `@wildo-ai/saas-models` into those tests.\n *\n * @see batches/m2m-webhook-delivery.batch.backend.service.ts — real deliveries.\n * @see services/webhook-config-test-endpoint.custom-impl.backend.service.ts — synthetic probe.\n */\n\nimport { M2M_WEBHOOK_DELIVERY_CONTRACT, WildoHeaderKeys } from '@wildo-ai/saas-models';\nimport {\n  OutboundTargetRejection,\n  classifyOutboundTargetUrl,\n} from '~wildo-backend-lib/security/ssrf/outbound-target-guard.backend.utils';\nimport {\n  REQUEST_TIMEOUT_MS,\n  WEBHOOK_USER_AGENT,\n  truncateBody,\n} from './batches/m2m-webhook-delivery.batch.utils';\n\n/**\n * Schemes an outbound webhook delivery may use.\n *\n * `http:` is admitted. DECIDED 2026-09-08 (#492): keep admitting it, and document the exposure where\n * a customer authors the endpoint — which is now done, on `WebhookEndpointSchema.url`.\n *\n * This is a COMMERCIAL accommodation, not a security assessment, and the distinction is the whole\n * point of writing it down. The A2A sibling requires HTTPS unconditionally and the same argument\n * applies here — the signature JWT in transit is a credential, readable on the path and replayable\n * until it expires, so an observer of one delivery can forge the next. What was chosen is not to break\n * endpoints that a previous version of the framework accepted.\n *\n * The two options NOT taken, either of which is the better security answer: require HTTPS with a\n * migration that identifies and notifies existing plaintext endpoints, or require it for new endpoints\n * and grandfather existing ones behind an explicit acknowledgement. The second is the one to revisit\n * first — it stops the plaintext population growing without breaking anyone today.\n *\n * Reopen on an observed interception, or on a customer compliance requirement. Do not reopen it as a\n * tidy-up: the asymmetry with the A2A caller is deliberate and is recorded at both sites.\n */\nconst M2M_WEBHOOK_ADMITTED_PROTOCOLS = ['https:', 'http:'] as const;\n\n/**\n * Refuse a destination that would turn this server into a request-forgery tool.\n *\n * ## Why the guard is HERE and not on the schema\n *\n * `WebhookEndpointSchema.url` validates shape (`z.url()`) and nothing else, so an admin could author\n * `http://169.254.169.254/latest/meta-data/` and the engine would POST signed payloads to the cloud\n * instance-metadata service — then capture the answer into the delivery log as\n * `responseBodyTruncated`. That makes it a READ primitive, not a blind SSRF, and\n * `webhookConfig.testEndpoint` is a low-friction oracle for it.\n *\n * A schema refine would leave two holes this placement does not have: it would not cover endpoints\n * ALREADY STORED before the refine existed, and it would not cover the A2A push-delivery worker,\n * which reaches this same primitive with a URL its own (separate) guard validated at configuration\n * time. Putting the check at the wire makes it unbypassable for every caller — present and future —\n * which is what `.claude/rules/invariant-call-site-enumeration.md` means by preferring one\n * chokepoint over N hand-applied predicates.\n *\n * ## What it cannot do\n *\n * An ordinary hostname is not resolved, so `hook.attacker.test` with an A record of `169.254.169.254`\n * still passes. That residual is inherited from the shared classifier and is stated there; closing it\n * needs either a resolving check (a check-then-connect, still open to rebinding) or egress-path\n * enforcement. It is a deliberate open item, not an oversight.\n */\nfunction refuseUnsafeWebhookTarget(url: string): string | undefined {\n  const rejection = classifyOutboundTargetUrl(url, { admittedProtocols: M2M_WEBHOOK_ADMITTED_PROTOCOLS });\n  switch (rejection) {\n    case undefined:\n      return undefined;\n    case OutboundTargetRejection.NOT_ABSOLUTE_ADMITTED_SCHEME:\n      return 'refused: endpoint is not an absolute http(s) URL';\n    case OutboundTargetRejection.CREDENTIALS_IN_URL:\n      // Credentials in the URL would be replayed on every delivery and would land in any log or\n      // delivery row that records the target.\n      return 'refused: endpoint URL carries embedded credentials';\n    case OutboundTargetRejection.PRIVATE_OR_RESERVED_ADDRESS:\n      return 'refused: endpoint resolves to a private, loopback, link-local or otherwise reserved address';\n    case OutboundTargetRejection.RESERVED_SPECIAL_USE_HOSTNAME:\n      return 'refused: endpoint uses a reserved special-use hostname';\n  }\n}\n\n/** Consumer-facing digest algorithm carried in every outbound webhook JWT. */\nexport const M2M_WEBHOOK_BODY_HASH_ALGORITHM: typeof M2M_WEBHOOK_DELIVERY_CONTRACT.bodyHashAlgorithm = M2M_WEBHOOK_DELIVERY_CONTRACT.bodyHashAlgorithm;\n\n/**\n * Outcome of one attempt at the wire level.\n *\n * `responseStatus` and `networkError` are mutually exclusive and exhaustive: either the\n * endpoint produced an HTTP response or it did not. Callers classify from there — this\n * type deliberately carries no verdict of its own, because \"429 is retryable\" is a\n * delivery-policy question and \"429 means the endpoint is reachable\" is a probe question,\n * and the same status answers both differently.\n */\nexport type SignedWebhookRequestResult = {\n  /** Set when the endpoint answered, whatever the status. */\n  responseStatus?: number;\n  /** Best-effort capture of the consumer's response body, truncated on a UTF-8 boundary. */\n  responseBodyTruncated?: string;\n  /** Set when no HTTP response was obtained (DNS/TLS/connection failure, or timeout). */\n  networkError?: string;\n  /** Wall-clock duration of this attempt alone, excluding any caller-side work. */\n  durationMs: number;\n};\n\n/**\n * Render a `fetch` rejection into something an operator can act on.\n *\n * Node's `fetch` (undici) rejects with a flat `TypeError: fetch failed` and buries the actual\n * cause — `ECONNREFUSED`, `ENOTFOUND`, `EHOSTUNREACH`, a TLS failure — one or more levels down in\n * `error.cause`. Reporting only `error.message` tells an admin their endpoint failed without\n * telling them whether the hostname is wrong, the port is closed, or the certificate is bad; for a\n * diagnostic whose entire job is to explain a failure, that is barely better than the silent\n * success this operation used to return. So walk the cause chain and append what it names.\n *\n * `AggregateError` (emitted when every resolved address fails, e.g. happy-eyeballs against a dead\n * host) carries its detail in `errors[]` rather than `cause`, so that shape is unwrapped too.\n * Depth-capped and de-duplicated: the chain is attacker-adjacent input in the sense that a hostile\n * endpoint controls how deep it goes, and a repeated message adds nothing.\n */\nfunction describeFetchFailure(error: unknown): string {\n  if (!(error instanceof Error)) return String(error);\n\n  const parts: string[] = [];\n  const seen = new Set<string>();\n  let current: unknown = error;\n\n  for (let depth = 0; depth < 4 && current instanceof Error; depth += 1) {\n    // `code` is where Node puts the actionable token (ECONNREFUSED, …); the message often repeats it.\n    const code = (current as NodeJS.ErrnoException).code;\n    const label = code && !current.message.includes(code) ? `${current.message} (${code})` : current.message;\n    if (label && !seen.has(label)) {\n      seen.add(label);\n      parts.push(label);\n    }\n    const aggregated = current instanceof AggregateError ? current.errors?.[0] : undefined;\n    current = aggregated ?? (current as { cause?: unknown }).cause;\n  }\n\n  return parts.join(': ') || 'fetch failed';\n}\n\n/**\n * POST a pre-signed body to a webhook endpoint under a hard timeout.\n *\n * Never throws for a transport failure — a refused connection, a DNS miss and a timeout\n * all come back as `networkError`. A timeout is reported with its budget spelled out\n * because \"timed out\" alone sends an operator hunting for the wrong thing.\n *\n * Body capture is best-effort: a consumer that returns an unreadable body still produced a\n * valid status, and losing the body must not turn a successful attempt into a failed one.\n */\nexport async function sendSignedWebhookRequest(params: {\n  /** Absolute destination URL. */\n  url: string;\n  /** Exact bytes to send — already the string whose hash the caller signed. */\n  body: string;\n  /**\n   * Value for the `X-Webhook-Signature` header. Omit when the caller authenticates by another\n   * mechanism and supplies its own {@link headers} — see below.\n   */\n  signature?: string;\n  /**\n   * Caller-supplied headers, MERGED OVER the defaults.\n   *\n   * Added for the A2A push-notification worker, which authenticates with the CLIENT's declared\n   * scheme (`Authorization: {scheme} {credentials}`) and sends `application/a2a+json` rather than\n   * Wildo's own ES256 signature and `application/json`.\n   *\n   * Widening this primitive instead of writing a second POST is deliberate, and follows the module\n   * header's own claim to own THE WIRE: timeout, abort handling, failure description and body\n   * truncation are the parts that are easy to get subtly wrong and expensive to have two of. What\n   * varies between callers is authentication and media type — which are exactly the two things a\n   * caller is in a position to decide. Purely additive: `signature` stays optional-by-absence for\n   * the two existing M2M call sites, whose behaviour is byte-for-byte unchanged.\n   */\n  headers?: Record<string, string>;\n}): Promise<SignedWebhookRequestResult> {\n  const startedAt = Date.now();\n\n  // Refused BEFORE any timer or connection: a target the guard rejects must produce no DNS lookup,\n  // no socket, and no signed body on the wire. Reported as `networkError` rather than thrown, because\n  // this module's contract is that a destination problem is DATA the caller reports — the probe\n  // surfaces it to the admin as UNREACHABLE and the delivery worker records it on the attempt row.\n  const refusal = refuseUnsafeWebhookTarget(params.url);\n  if (refusal) {\n    return { networkError: refusal, durationMs: Date.now() - startedAt };\n  }\n\n  const abort = new AbortController();\n  const timer = setTimeout(() => abort.abort(), REQUEST_TIMEOUT_MS);\n\n  let responseStatus: number | undefined;\n  let responseBodyTruncated: string | undefined;\n  let networkError: string | undefined;\n\n  try {\n    const response = await fetch(params.url, {\n      method: 'POST',\n      signal: abort.signal,\n      /**\n       * A redirect is REPORTED, never followed.\n       *\n       * Following one re-points the request at a target the guard above never saw, which is the\n       * guard's most obvious bypass — an admin authors a public URL that 302s to\n       * `http://169.254.169.254/`. It also silently defeats a decision this subsystem had ALREADY\n       * taken and could not enforce: `classifyResponseStatus` classifies 3xx as `fatal` and\n       * `resolveProbeOutcome` classifies it as REJECTED (\"webhooks must not redirect, and a\n       * CDN/proxy redirect on a wrong URL is one of the most common real misconfigurations an admin\n       * uses this probe to find\") — but with `fetch`'s default follow behaviour neither of those\n       * branches could ever execute, because a 3xx never reached them.\n       *\n       * `'manual'` rather than `'error'` on purpose: `'error'` would surface as an opaque network\n       * failure, whereas `'manual'` hands back the 3xx status so both classifiers see the redirect\n       * and tell the admin exactly what their endpoint did.\n       */\n      redirect: 'manual',\n      headers: {\n        'Content-Type': 'application/json',\n        'User-Agent': WEBHOOK_USER_AGENT,\n        ...(params.signature ? { [WildoHeaderKeys.X_WEBHOOK_SIGNATURE]: params.signature } : {}),\n        ...params.headers,\n      },\n      body: params.body,\n    });\n    responseStatus = response.status;\n    try {\n      const text = await response.text();\n      responseBodyTruncated = text ? truncateBody(text) : undefined;\n    } catch {\n      // Best-effort body capture — never fail the attempt on a non-readable body.\n      responseBodyTruncated = undefined;\n    }\n  } catch (error) {\n    networkError = abort.signal.aborted\n      ? `request timed out after ${REQUEST_TIMEOUT_MS}ms`\n      : describeFetchFailure(error);\n  } finally {\n    clearTimeout(timer);\n  }\n\n  return {\n    responseStatus,\n    responseBodyTruncated,\n    networkError,\n    durationMs: Date.now() - startedAt,\n  };\n}\n"]}

package/dist/esm/notifications/webhooks/outbound/services/webhook-config-test-endpoint.custom-impl.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"webhook-config-test-endpoint.custom-impl.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../../src/notifications/webhooks/outbound/services/webhook-config-test-endpoint.custom-impl.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAGH,OAAO,EAWL,2BAA2B,EAK5B,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAEL,KAAK,0CAA0C,EAChD,MAAM,4GAA4G,CAAC;AAiDpH;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,GAAG,2BAA2B,CAKnG;AAED,wBAAgB,wCAAwC,IAAI,0CAA0C,EAAE,CAgMvG"}
+{"version":3,"file":"webhook-config-test-endpoint.custom-impl.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../../src/notifications/webhooks/outbound/services/webhook-config-test-endpoint.custom-impl.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAGH,OAAO,EAWL,2BAA2B,EAO5B,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAEL,KAAK,0CAA0C,EAChD,MAAM,4GAA4G,CAAC;AAyCpH;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,GAAG,2BAA2B,CAKnG;AAED,wBAAgB,wCAAwC,IAAI,0CAA0C,EAAE,CAyMvG"}

package/dist/esm/notifications/webhooks/outbound/services/webhook-config-test-endpoint.custom-impl.backend.service.js

@@ -38,7 +38,7 @@
  * @see m2m-webhook-delivery-log.custom-impl.backend.service.ts — sibling REPLACE impls.
  */
 import { createHash, randomUUID } from 'node:crypto';
-import { AuthScopeType, CoreAuditableEventType, CoreM2MNotificationChannel, CoreResourceType, ErrorCustomMessageReference, ErrorType, ResourceOperationRiskLevel, ResourceOperationVariantType, WebhookConfig_Operations, WebhookConfig_TestEndpointRequestDto, WebhookEndpointProbeOutcome, M2M_WEBHOOK_DELIVERY_CONTRACT, } from '@wildo-ai/saas-models';
+import { AuthScopeType, CoreAuditableEventType, CoreM2MNotificationChannel, CoreResourceType, ErrorCustomMessageReference, ErrorType, ResourceOperationRiskLevel, ResourceOperationVariantType, WebhookConfig_Operations, WebhookConfig_TestEndpointRequestDto, WebhookEndpointProbeOutcome, webhookEndpointDestinationHost, webhookEndpointTransportIsPlaintext, M2M_WEBHOOK_DELIVERY_CONTRACT, } from '@wildo-ai/saas-models';
 import { createResourceCustomServiceImplementation, } from '../../../../base-classes/services/services/resource-operation-custom-implementation.factory.backend.js';
 import { describeCaughtError } from '../../../../errors/utils/error-log-level-classification.backend.utils.js';
 import { relaxAbuseThrottleMaxForEnvironment } from '../../../../errors/utils/rate-limit-environment-relaxation.backend.utils.js';
@@ -71,15 +71,6 @@ const WEBHOOK_CONFIG_VARIANTS = [
  */
 const PROBE_RATE_LIMIT_WINDOW_SECONDS = 60;
 const PROBE_RATE_LIMIT_MAX_PER_WINDOW = 5;
-/** Host-only projection for the audit trail — see the audit schema for why the path is withheld. */
-function extractHost(url) {
-    try {
-        return new URL(url).host;
-    }
-    catch {
-        return 'unparseable';
-    }
-}
 /**
  * Map a transport result onto the reported verdict.
  *
@@ -217,6 +208,10 @@ export function createWebhookConfigTestEndpointFactories() {
                             const notSent = {
                                 endpointId,
                                 url: endpoint.url,
+                                // Reported even though nothing left the platform: the scheme is a property of the
+                                // STORED destination, not of this attempt, so an admin fixing a signing fault is
+                                // still told what the endpoint will cost them once it works (#492).
+                                transportIsPlaintext: webhookEndpointTransportIsPlaintext(endpoint.url),
                                 outcome: WebhookEndpointProbeOutcome.NOT_SENT,
                                 failureReason,
                                 durationMs: 0,
@@ -234,9 +229,13 @@ export function createWebhookConfigTestEndpointFactories() {
                         // ── Send ──────────────────────────────────────────────────
                         const result = await sendSignedWebhookRequest({ url: endpoint.url, body, signature });
                         const outcome = resolveProbeOutcome(result.responseStatus);
+                        const transportIsPlaintext = webhookEndpointTransportIsPlaintext(endpoint.url);
                         utils.logger.info('Webhook endpoint test dispatched', {
                             scopeType, scopeId, endpointId,
-                            destinationHost: extractHost(endpoint.url),
+                            destinationHost: webhookEndpointDestinationHost(endpoint.url),
+                            // A probe is the moment an operator is looking at ONE endpoint, so it is also the
+                            // cheapest moment to notice the signature JWT is going out in the clear (#492).
+                            transportIsPlaintext,
                             outcome,
                             responseStatus: result.responseStatus,
                             durationMs: result.durationMs,
@@ -253,6 +252,7 @@ export function createWebhookConfigTestEndpointFactories() {
                         return {
                             endpointId,
                             url: endpoint.url,
+                            transportIsPlaintext,
                             outcome,
                             responseStatus: result.responseStatus,
                             responseBodyTruncated: result.responseBodyTruncated,
@@ -297,7 +297,7 @@ async function recordProbeAudit(container, executionContext, data) {
         // over it — an unattributable egress probe is itself the thing worth noticing.
         dispatchedBy: actorUserId ?? 'unattributed',
         endpointId: data.endpointId,
-        destinationHost: extractHost(data.url),
+        destinationHost: webhookEndpointDestinationHost(data.url),
         outcome: data.outcome,
         responseStatus: data.responseStatus,
         durationMs: data.durationMs,