npm - @wildo-ai/saas-backend-lib - Versions diffs - 1.1.2 → 1.1.3 - Mend

@wildo-ai/saas-backend-lib 1.1.2 → 1.1.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (853) hide show

package/dist/esm/notifications/webhooks/outbound/services/webhook-config-test-endpoint.custom-impl.backend.service.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"webhook-config-test-endpoint.custom-impl.backend.service.js","sourceRoot":"","sources":["../../../../../../../src/notifications/webhooks/outbound/services/webhook-config-test-endpoint.custom-impl.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EACL,aAAa,EACb,sBAAsB,EACtB,0BAA0B,EAC1B,gBAAgB,EAChB,2BAA2B,EAC3B,SAAS,EACT,0BAA0B,EAC1B,4BAA4B,EAC5B,wBAAwB,EACxB,oCAAoC,EACpC,2BAA2B,EAI3B,6BAA6B,GAC9B,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,yCAAyC,GAE1C,MAAM,4GAA4G,CAAC;AAGpH,OAAO,EAAE,mBAAmB,EAAE,MAAM,8EAA8E,CAAC;AACnH,OAAO,EAAE,mCAAmC,EAAE,MAAM,iFAAiF,CAAC;AACtI,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAGpF,OAAO,EAAE,cAAc,EAAE,MAAM,wEAAwE,CAAC;AAExG,OAAO,EAAE,+BAA+B,EAAE,wBAAwB,EAAE,MAAM,6CAA6C,CAAC;AAExH;;;GAGG;AACH,MAAM,uBAAuB,GAAG;IAC9B;QACE,YAAY,EAAE,gBAAgB,CAAC,2BAA2B;QAC1D,SAAS,EAAE,aAAa,CAAC,YAAY;QACrC,OAAO,EAAE,0BAA0B,CAAC,oBAAoB;KACzD;IACD;QACE,YAAY,EAAE,gBAAgB,CAAC,0BAA0B;QACzD,SAAS,EAAE,aAAa,CAAC,WAAW;QACpC,OAAO,EAAE,0BAA0B,CAAC,mBAAmB;KACxD;CACO,CAAC;AAEX;;;;;;;GAOG;AACH,MAAM,+BAA+B,GAAG,EAAE,CAAC;AAC3C,MAAM,+BAA+B,GAAG,CAAC,CAAC;AAE1C,oGAAoG;AACpG,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,aAAa,CAAC;IACvB,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,cAAkC;IACpE,IAAI,cAAc,KAAK,SAAS;QAAE,OAAO,2BAA2B,CAAC,WAAW,CAAC;IACjF,OAAO,cAAc,IAAI,GAAG,IAAI,cAAc,GAAG,GAAG;QAClD,CAAC,CAAC,2BAA2B,CAAC,QAAQ;QACtC,CAAC,CAAC,2BAA2B,CAAC,QAAQ,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,wCAAwC;IACtD,OAAO,uBAAuB,CAAC,GAAG,CAAC,CAAC,EAAE,YAAY,EAAE,SAAS,EAAE,OAAO,EAAE,EAA8C,EAAE;QACtH,OAAO,CAAC,yBAAyB,EAAE,SAAoB,EAAE,EAAE;YACzD,OAAO,yCAAyC,CAAC;gBAC/C,aAAa,EAAE;oBACb,kBAAkB,EAAE,YAAY;oBAChC,mBAAmB,EAAE,wBAAwB,CAAC,aAAa;oBAC3D,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,kBAAkB,EAAE,IAAI;iBACzB;gBACD,gBAAgB,EAAE,oCAAoC;gBACtD,QAAQ,EAAE;oBACR,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE;wBACnF,MAAM,EAAE,UAAU,EAAE,GAAG,KAA+B,CAAC;wBAEvD,MAAM,OAAO,GAAG,SAAS,KAAK,aAAa,CAAC,YAAY;4BACtD,CAAC,CAAC,gBAAgB,CAAC,cAAc;4BACjC,CAAC,CAAC,gBAAgB,CAAC,aAAa,CAAC;wBACnC,IAAI,CAAC,OAAO,EAAE,CAAC;4BACb,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE;gCAC1E,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;gCAC9D,OAAO,EAAE,EAAE,OAAO,EAAE,oCAAoC,SAAS,4BAA4B,EAAE;6BAChG,CAAC,CAAC;wBACL,CAAC;wBAED,6DAA6D;wBAC7D,0EAA0E;wBAC1E,gEAAgE;wBAChE,uEAAuE;wBACvE,uEAAuE;wBACvE,6BAA6B;wBAC7B,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAe,kBAAkB,CAAC,YAAY,CAAC,CAAC;wBAC3E,oEAAoE;wBACpE,gFAAgF;wBAChF,kFAAkF;wBAClF,mFAAmF;wBACnF,gFAAgF;wBAChF,MAAM,gBAAgB,GAAG,SAAS,CAAC,GAAG,CAA0B,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;wBACrG,MAAM,0BAA0B,GAAG,mCAAmC,CACpE,+BAA+B,EAC/B,gBAAgB,CAAC,cAAc,CAChC,CAAC;wBACF,MAAM,gBAAgB,GAAG,MAAM,KAAK,CAAC,kBAAkB,CACrD,yBAAyB,SAAS,IAAI,OAAO,IAAI,UAAU,EAAE,EAC7D,+BAA+B,CAChC,CAAC;wBACF,IAAI,gBAAgB,GAAG,0BAA0B,EAAE,CAAC;4BAClD,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE;gCAC1E,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;gCAC9D,OAAO,EAAE;oCACP,OAAO,EAAE,iCAAiC,0BAA0B,QAAQ,+BAA+B,iEAAiE;oCAC5K,UAAU;oCACV,iBAAiB,EAAE,+BAA+B;iCACnD;6BACF,CAAC,CAAC;wBACL,CAAC;wBAED,6DAA6D;wBAC7D,8EAA8E;wBAC9E,8EAA8E;wBAC9E,+EAA+E;wBAC/E,iFAAiF;wBACjF,IAAI,CAAC,KAAK,CAAC,mBAAmB,EAAE,CAAC;4BAC/B,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,gBAAgB,EAAE;gCAC7E,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gCACjE,OAAO,EAAE,EAAE,OAAO,EAAE,oFAAoF,EAAE;6BAC3G,CAAC,CAAC;wBACL,CAAC;wBACD,MAAM,cAAc,GAAG,SAAS,KAAK,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,eAAe,CAAC;wBACrG,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,mBAAmB,CAAC,YAAY,CACzD,YAAY,EACZ,EAAE,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,EAC7B,EAAE,YAAY,EAAE,EAAE,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,EAAE,CAChD,CAAC;wBACF,IAAI,CAAC,MAAM,EAAE,CAAC;4BACZ,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,gBAAgB,EAAE;gCACzE,sBAAsB,EAAE,2BAA2B,CAAC,SAAS;gCAC7D,OAAO,EAAE,EAAE,OAAO,EAAE,iDAAiD,EAAE;6BACxE,CAAC,CAAC;wBACL,CAAC;wBAED,MAAM,QAAQ,GAAgC,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,UAAU,CAAC,CAAC;wBACxG,IAAI,CAAC,QAAQ,EAAE,CAAC;4BACd,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,gBAAgB,EAAE;gCACzE,sBAAsB,EAAE,2BAA2B,CAAC,SAAS;gCAC7D,OAAO,EAAE,EAAE,OAAO,EAAE,+DAA+D,EAAE,UAAU,EAAE;6BAClG,CAAC,CAAC;wBACL,CAAC;wBACD,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;4BAClB,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE;gCAC1E,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;gCAC9D,OAAO,EAAE,EAAE,OAAO,EAAE,oEAAoE,EAAE,UAAU,EAAE;6BACvG,CAAC,CAAC;wBACL,CAAC;wBACD,gFAAgF;wBAChF,gFAAgF;wBAChF,8DAA8D;wBAE9D,6DAA6D;wBAC7D,MAAM,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC;wBAC/B,MAAM,YAAY,GAAG,UAAU,EAAE,CAAC;wBAClC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;4BAC1B,SAAS,EAAE,IAAI;4BACf,OAAO,EAAE,sFAAsF;4BAC/F,UAAU;4BACV,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE;4BACvC,QAAQ,EAAE,WAAW,CAAC,WAAW,EAAE;yBACpC,CAAC,CAAC;wBACH,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;wBAEjE,MAAM,UAAU,GAAG,SAAS,CAAC,GAAG,CAAoB,kBAAkB,CAAC,iBAAiB,CAAC,CAAC;wBAC1F,IAAI,SAAiB,CAAC;wBACtB,IAAI,CAAC;4BACH,SAAS,GAAG,MAAM,UAAU,CAAC,IAAI,CAC/B;gCACE,wEAAwE;gCACxE,oFAAoF;gCACpF,CAAC,6BAA6B,CAAC,eAAe,CAAC,UAAU,CAAC,EAAE,YAAY;gCACxE,CAAC,6BAA6B,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,QAAQ;gCAClE,CAAC,6BAA6B,CAAC,eAAe,CAAC,iBAAiB,CAAC,EAAE,+BAA+B;gCAClG,CAAC,6BAA6B,CAAC,eAAe,CAAC,YAAY,CAAC,EAAE,OAAO;gCACrE,CAAC,6BAA6B,CAAC,eAAe,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC,YAAY,CAAC;gCACxF,CAAC,6BAA6B,CAAC,eAAe,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC,wBAAwB,CAAC,aAAa,CAAC;gCACnH,oEAAoE;gCACpE,2EAA2E;gCAC3E,SAAS,EAAE,IAAI;6BAChB,EACD,cAAc,CAAC,mBAAmB,CACnC,CAAC;wBACJ,CAAC;wBAAC,OAAO,KAAK,EAAE,CAAC;4BACf,2EAA2E;4BAC3E,6EAA6E;4BAC7E,MAAM,aAAa,GAAG,uBAAuB,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;4BAC1E,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,6DAA6D,EAAE;gCAChF,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK;6BACtC,CAAC,CAAC;4BACH,MAAM,OAAO,GAAG;gCACd,UAAU;gCACV,GAAG,EAAE,QAAQ,CAAC,GAAG;gCACjB,OAAO,EAAE,2BAA2B,CAAC,QAAQ;gCAC7C,aAAa;gCACb,UAAU,EAAE,CAAC;gCACb,YAAY;gCACZ,WAAW;6BACZ,CAAC;4BACF,MAAM,gBAAgB,CAAC,SAAS,EAAE,gBAAgB,EAAE;gCAClD,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG;gCACjD,OAAO,EAAE,2BAA2B,CAAC,QAAQ;gCAC7C,UAAU,EAAE,CAAC;gCACb,YAAY;6BACb,CAAC,CAAC;4BACH,OAAO,OAAO,CAAC;wBACjB,CAAC;wBAED,6DAA6D;wBAC7D,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;wBACtF,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;wBAE3D,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE;4BACpD,SAAS,EAAE,OAAO,EAAE,UAAU;4BAC9B,eAAe,EAAE,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC;4BAC1C,OAAO;4BACP,cAAc,EAAE,MAAM,CAAC,cAAc;4BACrC,UAAU,EAAE,MAAM,CAAC,UAAU;4BAC7B,YAAY;yBACb,CAAC,CAAC;wBAEH,MAAM,gBAAgB,CAAC,SAAS,EAAE,gBAAgB,EAAE;4BAClD,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG;4BACjD,OAAO;4BACP,cAAc,EAAE,MAAM,CAAC,cAAc;4BACrC,UAAU,EAAE,MAAM,CAAC,UAAU;4BAC7B,YAAY;yBACb,CAAC,CAAC;wBAEH,mDAAmD;wBACnD,OAAO;4BACL,UAAU;4BACV,GAAG,EAAE,QAAQ,CAAC,GAAG;4BACjB,OAAO;4BACP,cAAc,EAAE,MAAM,CAAC,cAAc;4BACrC,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;4BACnD,aAAa,EAAE,MAAM,CAAC,YAAY;4BAClC,UAAU,EAAE,MAAM,CAAC,UAAU;4BAC7B,YAAY;4BACZ,WAAW;yBACZ,CAAC;oBACJ,CAAC;iBACF;aACF,CAAC,CAAC;QACL,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,KAAK,UAAU,gBAAgB,CAC7B,SAAoB,EACpB,gBAAuC,EACvC,IASC;IAED,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,CAA0B,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;IAC9F,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,KAAK,aAAa,CAAC,YAAY,CAAC;IACjE,MAAM,WAAW,GAAG,gBAAgB,CAAC,YAAY,EAAE,MAAM,CAAC;IAE1D,MAAM,SAAS,GAA2D;QACxE,SAAS,EAAE,sBAAsB,CAAC,gCAAgC;QAClE,cAAc,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;QACrD,aAAa,EAAE,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO;QACpD,gFAAgF;QAChF,oFAAoF;QACpF,+EAA+E;QAC/E,YAAY,EAAE,WAAW,IAAI,cAAc;QAC3C,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,eAAe,EAAE,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC;QACtC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,YAAY,EAAE,IAAI,CAAC,YAAY;KAChC,CAAC;IAEF,MAAM,SAAS,CAAC,QAAQ,CACtB;QACE,MAAM,EAAE,WAAW;QACnB,qFAAqF;QACrF,yEAAyE;QACzE,cAAc,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;QACrD,aAAa,EAAE,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO;QACpD,0FAA0F;QAC1F,mCAAmC;QACnC,SAAS,EAAE,0BAA0B,CAAC,MAAM;QAC5C,SAAS,EAAE,sBAAsB,CAAC,gCAAgC;QAClE,SAAS,EAAE,SAAgC;KAC5C,EACD,gBAAgB,CACjB,CAAC;AACJ,CAAC","sourcesContent":["/*\n Webhook Config TEST_ENDPOINT — REPLACE_CORE_OPERATIONS factory.\n \n Makes `webhookConfig.testEndpoint` (org + app variants) do the thing it is named after:\n * fire one signed synthetic delivery at a single stored endpoint and report what came back.\n \n Before this implementation the operation was declared `resourceOperationLike: READ` with\n * no handler, so the generic core read answered 200 with the config row. An admin pressing\n * \"test\" on an endpoint whose URL had rotted was told it worked. A connectivity probe that\n * cannot fail is worse than no probe — it converts an unknown into a false assurance — so\n * every failure mode is now a distinct, reported outcome.\n \n Design commitments:\n \n - Same transport as real deliveries. The POST goes through\n * {@link sendSignedWebhookRequest}, shared verbatim with the delivery worker. A probe\n * that reached the endpoint by a different route would attest to that route, not to the\n * delivery path the admin actually cares about.\n * - Signed like a real delivery. Same key (`JwtPrivateKeys.APPLICATION_WEBHOOK`), same\n * claim shape, same `X-Webhook-Signature` header, so the consumer's verification code is\n * genuinely exercised rather than bypassed.\n * - Unmistakably synthetic. The claims carry `synthetic: true` and the body is a\n * self-describing test envelope. We are POSTing to a customer's production listener; a\n * probe indistinguishable from a real event would invite consumers to act on a fake one.\n * Unknown claims are ignored by existing consumers, so this adds no breaking change.\n * - No delivery-log row. Per the operation contract, test traffic stays out of the user\n * event log. The audit trail below is where a probe is recorded.\n * - A dead endpoint is a 200. Transport failure at the customer's side is a successful\n * probe carrying `outcome: UNREACHABLE`. HTTP errors are reserved for faults in the\n * request itself — unknown `endpointId`, absent config, rate limit exceeded.\n \n Scope resolution mirrors the sibling delivery-log impls: the ORG variant reads\n * `executionContext.organizationId`, the APP variant `applicationId`. The endpoint is then\n * selected by `endpointId` within that scope's config only, so a caller cannot aim the\n * probe at another tenant's endpoint — or at an arbitrary URL of their own choosing.\n \n @see ../m2m-webhook-signed-request.backend.utils.ts — the shared transport.\n * @see m2m-webhook-delivery-log.custom-impl.backend.service.ts — sibling REPLACE impls.\n /\n\nimport { createHash, randomUUID } from 'node:crypto';\nimport {\n AuthScopeType,\n CoreAuditableEventType,\n CoreM2MNotificationChannel,\n CoreResourceType,\n ErrorCustomMessageReference,\n ErrorType,\n ResourceOperationRiskLevel,\n ResourceOperationVariantType,\n WebhookConfig_Operations,\n WebhookConfig_TestEndpointRequestDto,\n WebhookEndpointProbeOutcome,\n type AuditableEvent_Webhook_EndpointTestDispatchedEventData,\n type WebhookConfigBase,\n type WebhookEndpoint,\n M2M_WEBHOOK_DELIVERY_CONTRACT,\n} from '@wildo-ai/saas-models';\nimport type { Container } from 'inversify';\nimport {\n createResourceCustomServiceImplementation,\n type ResourceCustomServiceImplementationFactory,\n} from '~wildo-backend-lib/base-classes/services/services/resource-operation-custom-implementation.factory.backend';\nimport type { AuditLogsBackendService } from '~wildo-backend-lib/compliance/audit-trails/services/audit-logs.backend.service';\nimport type { RedisService } from '~wildo-backend-lib/databases/services/redis.service';\nimport { describeCaughtError } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { relaxAbuseThrottleMaxForEnvironment } from '~wildo-backend-lib/errors/utils/rate-limit-environment-relaxation.backend.utils';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport { JwtPrivateKeys } from '~wildo-backend-lib/security/authentications/models/jwt.backend.schemas';\nimport type { JwtBackendService } from '~wildo-backend-lib/security/jwt/services/jwt.backend.service';\nimport { M2M_WEBHOOK_BODY_HASH_ALGORITHM, sendSignedWebhookRequest } from '../m2m-webhook-signed-request.backend.utils';\n\n/\n Variant → (scope type, notification channel) pairing. The channel rides the signed claims\n * so the probe presents itself on the same channel a real delivery from this scope would.\n /\nconst WEBHOOK_CONFIG_VARIANTS = [\n {\n resourceType: CoreResourceType.ORGANIZATION_WEBHOOK_CONFIG,\n scopeType: AuthScopeType.ORGANIZATION,\n channel: CoreM2MNotificationChannel.WEBHOOK_ORGANIZATION,\n },\n {\n resourceType: CoreResourceType.APPLICATION_WEBHOOK_CONFIG,\n scopeType: AuthScopeType.APPLICATION,\n channel: CoreM2MNotificationChannel.WEBHOOK_APPLICATION,\n },\n] as const;\n\n/\n Probe budget: at most this many attempts per endpoint per window.\n \n Scoped per ENDPOINT rather than per admin: the resource being protected is the customer's\n * listener, which does not care which of our admins is iterating on it. The allowance is\n * loose enough for the real workflow (tweak a URL, retest) and tight enough that the\n * operation cannot be used to generate sustained traffic at a third party.\n /\nconst PROBE_RATE_LIMIT_WINDOW_SECONDS = 60;\nconst PROBE_RATE_LIMIT_MAX_PER_WINDOW = 5;\n\n/* Host-only projection for the audit trail — see the audit schema for why the path is withheld. /\nfunction extractHost(url: string): string {\n try {\n return new URL(url).host;\n } catch {\n return 'unparseable';\n }\n}\n\n/\n Map a transport result onto the reported verdict.\n \n Deliberately NOT `classifyResponseStatus`: that function answers a delivery-retry question\n * (\"should we send this again?\"), where 429 and 503 are `retry`. A probe answers a\n * reachability question, where 429 and 503 both mean the endpoint is very much reachable and\n * chose to refuse. Reusing the retry classifier here would report a live, throttling endpoint\n * as though nothing had been learned about it.\n /\nexport function resolveProbeOutcome(responseStatus: number \| undefined): WebhookEndpointProbeOutcome {\n if (responseStatus === undefined) return WebhookEndpointProbeOutcome.UNREACHABLE;\n return responseStatus >= 200 && responseStatus < 300\n ? WebhookEndpointProbeOutcome.ACCEPTED\n : WebhookEndpointProbeOutcome.REJECTED;\n}\n\nexport function createWebhookConfigTestEndpointFactories(): ResourceCustomServiceImplementationFactory[] {\n return WEBHOOK_CONFIG_VARIANTS.map(({ resourceType, scopeType, channel }): ResourceCustomServiceImplementationFactory => {\n return (_resourcesRegistryService, container: Container) => {\n return createResourceCustomServiceImplementation({\n operationPath: {\n resourceIdentifier: resourceType,\n operationIdentifier: WebhookConfig_Operations.TEST_ENDPOINT,\n variantType: ResourceOperationVariantType.API_CALL,\n isOperationDefault: true,\n },\n requestDtoSchema: WebhookConfig_TestEndpointRequestDto,\n handlers: {\n replaceCoreOperations: async (_id, input, executionContext, _operationPath, utils) => {\n const { endpointId } = input as { endpointId: string };\n\n const scopeId = scopeType === AuthScopeType.ORGANIZATION\n ? executionContext.organizationId\n : executionContext.applicationId;\n if (!scopeId) {\n throw utils.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {\n customMessageReference: ErrorCustomMessageReference.VALIDATION,\n context: { message: `Webhook endpoint test requires a ${scopeType}-scoped execution context.` },\n });\n }\n\n // ── Rate limit ────────────────────────────────────────────\n // Fails CLOSED when the limiter is unavailable. This operation is the one\n // admin surface that makes the platform open a connection to an\n // operator-supplied URL; running it unmetered because Redis is down is\n // exactly the window an abuse path would want. An honest 4xx/5xx beats\n // silently unbounded egress.\n const redis = container.get<RedisService>(SAAS_SERVICE_TYPES.RedisService);\n // Non-production relaxation of the probe ceiling (shared seam — see\n // `rate-limit-environment-relaxation.backend.utils`). Five probes per minute is\n // a production egress guard; iterating on a webhook endpoint locally legitimately\n // exceeds it in seconds. The live-traffic warning in the message below still holds\n // in dev — the relaxation raises the ceiling, it does not make the probe cheap.\n const appConfigService = container.get<AppConfigurationService>(SAAS_SERVICE_TYPES.AppConfigService);\n const effectiveProbeMaxPerWindow = relaxAbuseThrottleMaxForEnvironment(\n PROBE_RATE_LIMIT_MAX_PER_WINDOW,\n appConfigService.applicationEnv,\n );\n const attemptsInWindow = await redis.incrementRateLimit(\n `webhook_endpoint_test:${scopeType}:${scopeId}:${endpointId}`,\n PROBE_RATE_LIMIT_WINDOW_SECONDS,\n );\n if (attemptsInWindow > effectiveProbeMaxPerWindow) {\n throw utils.errorBuilder.buildError(ErrorType.RATE_LIMIT, executionContext, {\n customMessageReference: ErrorCustomMessageReference.RATE_LIMIT,\n context: {\n message: `Endpoint tests are limited to ${effectiveProbeMaxPerWindow} per ${PROBE_RATE_LIMIT_WINDOW_SECONDS}s per endpoint; each one sends live traffic to the destination.`,\n endpointId,\n retryAfterSeconds: PROBE_RATE_LIMIT_WINDOW_SECONDS,\n },\n });\n }\n\n // ── Resolve the endpoint (scope-confined) ─────────────────\n // `readAsSystem` is the sanctioned privileged path and the resource opts into\n // it (`systemAccessPolicy: { read: ALLOWED }`). The caller has already passed\n // the org-admin / app-super-admin gate on this operation; the system read only\n // avoids re-deriving row visibility, and the filter pins the caller's own scope.\n if (!utils.systemAccessService) {\n throw utils.errorBuilder.buildError(ErrorType.CONFIGURATION, executionContext, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: { message: 'System access service is unavailable; cannot resolve the webhook endpoint to test.' },\n });\n }\n const scopeFieldName = scopeType === AuthScopeType.ORGANIZATION ? 'organizationId' : 'applicationId';\n const config = await utils.systemAccessService.readAsSystem<WebhookConfigBase>(\n resourceType,\n { [scopeFieldName]: scopeId },\n { scopeContext: { [scopeFieldName]: scopeId } },\n );\n if (!config) {\n throw utils.errorBuilder.buildError(ErrorType.NOT_FOUND, executionContext, {\n customMessageReference: ErrorCustomMessageReference.NOT_FOUND,\n context: { message: 'No webhook configuration exists for this scope.' },\n });\n }\n\n const endpoint: WebhookEndpoint \| undefined = (config.endpoints ?? []).find((e) => e.id === endpointId);\n if (!endpoint) {\n throw utils.errorBuilder.buildError(ErrorType.NOT_FOUND, executionContext, {\n customMessageReference: ErrorCustomMessageReference.NOT_FOUND,\n context: { message: 'No endpoint with this id exists on the webhook configuration.', endpointId },\n });\n }\n if (!endpoint.url) {\n throw utils.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {\n customMessageReference: ErrorCustomMessageReference.VALIDATION,\n context: { message: 'The stored endpoint has no URL, so no meaningful test can be sent.', endpointId },\n });\n }\n // A DISABLED endpoint is still probed on purpose: \"validate before enabling\" is\n // the primary workflow this operation exists for, and refusing here would force\n // an admin to enable an unverified URL in order to verify it.\n\n // ── Build + sign the synthetic delivery ───────────────────\n const attemptedAt = new Date();\n const signatureJti = randomUUID();\n const body = JSON.stringify({\n synthetic: true,\n message: 'Wildo webhook connectivity test. This is not a real event; do not process it as one.',\n endpointId,\n scope: { type: scopeType, id: scopeId },\n issuedAt: attemptedAt.toISOString(),\n });\n const bodyHash = createHash('sha256').update(body).digest('hex');\n\n const jwtService = container.get<JwtBackendService>(SAAS_SERVICE_TYPES.JwtBackendService);\n let signature: string;\n try {\n signature = await jwtService.sign(\n {\n // Claim names come from the published receiver contract, exactly as the\n // delivery worker signs them; a probe must be verifiable by the same receiver code.\n [M2M_WEBHOOK_DELIVERY_CONTRACT.signatureClaims.deliveryId]: signatureJti,\n [M2M_WEBHOOK_DELIVERY_CONTRACT.signatureClaims.bodyHash]: bodyHash,\n [M2M_WEBHOOK_DELIVERY_CONTRACT.signatureClaims.bodyHashAlgorithm]: M2M_WEBHOOK_BODY_HASH_ALGORITHM,\n [M2M_WEBHOOK_DELIVERY_CONTRACT.signatureClaims.eventChannel]: channel,\n [M2M_WEBHOOK_DELIVERY_CONTRACT.signatureClaims.resourceIdentifier]: String(resourceType),\n [M2M_WEBHOOK_DELIVERY_CONTRACT.signatureClaims.operationIdentifier]: String(WebhookConfig_Operations.TEST_ENDPOINT),\n // Present ONLY on probes. Lets a consumer that wants to hard-refuse\n // synthetic traffic do so on the signed envelope rather than on body text.\n synthetic: true,\n },\n JwtPrivateKeys.APPLICATION_WEBHOOK,\n );\n } catch (error) {\n // Signing failure is ours, not the endpoint's. Reporting it as UNREACHABLE\n // would send an admin to debug a customer endpoint over a missing local key.\n const failureReason = `JWT signing failed: ${describeCaughtError(error)}`;\n utils.logger.error('Webhook endpoint test could not be signed; nothing was sent', {\n scopeType, scopeId, endpointId, error,\n });\n const notSent = {\n endpointId,\n url: endpoint.url,\n outcome: WebhookEndpointProbeOutcome.NOT_SENT,\n failureReason,\n durationMs: 0,\n signatureJti,\n attemptedAt,\n };\n await recordProbeAudit(container, executionContext, {\n scopeType, scopeId, endpointId, url: endpoint.url,\n outcome: WebhookEndpointProbeOutcome.NOT_SENT,\n durationMs: 0,\n signatureJti,\n });\n return notSent;\n }\n\n // ── Send ──────────────────────────────────────────────────\n const result = await sendSignedWebhookRequest({ url: endpoint.url, body, signature });\n const outcome = resolveProbeOutcome(result.responseStatus);\n\n utils.logger.info('Webhook endpoint test dispatched', {\n scopeType, scopeId, endpointId,\n destinationHost: extractHost(endpoint.url),\n outcome,\n responseStatus: result.responseStatus,\n durationMs: result.durationMs,\n signatureJti,\n });\n\n await recordProbeAudit(container, executionContext, {\n scopeType, scopeId, endpointId, url: endpoint.url,\n outcome,\n responseStatus: result.responseStatus,\n durationMs: result.durationMs,\n signatureJti,\n });\n\n // Matches `WebhookConfig_TestEndpointResponseDto`.\n return {\n endpointId,\n url: endpoint.url,\n outcome,\n responseStatus: result.responseStatus,\n responseBodyTruncated: result.responseBodyTruncated,\n failureReason: result.networkError,\n durationMs: result.durationMs,\n signatureJti,\n attemptedAt,\n };\n },\n },\n });\n };\n });\n}\n\n/\n Record the probe on the audit trail.\n \n Emitted for EVERY attempt, not only failures: the security signal is the pattern of\n * outbound probing (who, which hosts, how often), which only reads correctly if successes\n * are present too.\n \n Uses the generic `logEvent` rather than a dedicated `log` method so the audit service's\n public surface does not grow — partial `AuditLogsBackendService` mocks across the test\n * suite would otherwise start failing on a method they do not stub.\n \n Best-effort by construction: `logEvent` swallows its own failures, and an audit-store\n * outage must not convert a completed probe into an error the admin cannot act on.\n \n assurance-control: WILDO.INTEGRATION.OUTBOUND_ACTIVITY_AUDIT — attributable outbound connection\n * initiated from an administrative surface.\n */\nasync function recordProbeAudit(\n container: Container,\n executionContext: ExecutionContext<any>,\n data: {\n scopeType: AuthScopeType;\n scopeId: string;\n endpointId: string;\n url: string;\n outcome: WebhookEndpointProbeOutcome;\n responseStatus?: number;\n durationMs: number;\n signatureJti: string;\n },\n): Promise<void> {\n const auditLogs = container.get<AuditLogsBackendService>(SAAS_SERVICE_TYPES.AuditLogsService);\n const isOrgScope = data.scopeType === AuthScopeType.ORGANIZATION;\n const actorUserId = executionContext.initiatorIds?.userId;\n\n const eventData: AuditableEvent_Webhook_EndpointTestDispatchedEventData = {\n eventType: CoreAuditableEventType.WEBHOOK_ENDPOINT_TEST_DISPATCHED,\n organizationId: isOrgScope ? data.scopeId : undefined,\n applicationId: isOrgScope ? undefined : data.scopeId,\n // The operation is role-gated to a human admin, so an absent actor id means the\n // execution context was not shaped as expected. Record the gap rather than papering\n // over it — an unattributable egress probe is itself the thing worth noticing.\n dispatchedBy: actorUserId ?? 'unattributed',\n endpointId: data.endpointId,\n destinationHost: extractHost(data.url),\n outcome: data.outcome,\n responseStatus: data.responseStatus,\n durationMs: data.durationMs,\n signatureJti: data.signatureJti,\n };\n\n await auditLogs.logEvent(\n {\n userId: actorUserId,\n // Scope FK as event DATA. Per-org SIEM routing is resolved by the audit service from\n // the authenticated request context passed below, never from this field.\n organizationId: isOrgScope ? data.scopeId : undefined,\n applicationId: isOrgScope ? undefined : data.scopeId,\n // Matches the operation's declared `riskLevel` — outbound traffic to an operator-supplied\n // URL, gated behind an admin role.\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.WEBHOOK_ENDPOINT_TEST_DISPATCHED,\n eventData: eventData as Record<string, any>,\n },\n executionContext,\n );\n}\n"]}
1	+ {"version":3,"file":"webhook-config-test-endpoint.custom-impl.backend.service.js","sourceRoot":"","sources":["../../../../../../../src/notifications/webhooks/outbound/services/webhook-config-test-endpoint.custom-impl.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EACL,aAAa,EACb,sBAAsB,EACtB,0BAA0B,EAC1B,gBAAgB,EAChB,2BAA2B,EAC3B,SAAS,EACT,0BAA0B,EAC1B,4BAA4B,EAC5B,wBAAwB,EACxB,oCAAoC,EACpC,2BAA2B,EAC3B,8BAA8B,EAC9B,mCAAmC,EAInC,6BAA6B,GAC9B,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,yCAAyC,GAE1C,MAAM,4GAA4G,CAAC;AAGpH,OAAO,EAAE,mBAAmB,EAAE,MAAM,8EAA8E,CAAC;AACnH,OAAO,EAAE,mCAAmC,EAAE,MAAM,iFAAiF,CAAC;AACtI,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAGpF,OAAO,EAAE,cAAc,EAAE,MAAM,wEAAwE,CAAC;AAExG,OAAO,EAAE,+BAA+B,EAAE,wBAAwB,EAAE,MAAM,6CAA6C,CAAC;AAExH;;;GAGG;AACH,MAAM,uBAAuB,GAAG;IAC9B;QACE,YAAY,EAAE,gBAAgB,CAAC,2BAA2B;QAC1D,SAAS,EAAE,aAAa,CAAC,YAAY;QACrC,OAAO,EAAE,0BAA0B,CAAC,oBAAoB;KACzD;IACD;QACE,YAAY,EAAE,gBAAgB,CAAC,0BAA0B;QACzD,SAAS,EAAE,aAAa,CAAC,WAAW;QACpC,OAAO,EAAE,0BAA0B,CAAC,mBAAmB;KACxD;CACO,CAAC;AAEX;;;;;;;GAOG;AACH,MAAM,+BAA+B,GAAG,EAAE,CAAC;AAC3C,MAAM,+BAA+B,GAAG,CAAC,CAAC;AAG1C;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,cAAkC;IACpE,IAAI,cAAc,KAAK,SAAS;QAAE,OAAO,2BAA2B,CAAC,WAAW,CAAC;IACjF,OAAO,cAAc,IAAI,GAAG,IAAI,cAAc,GAAG,GAAG;QAClD,CAAC,CAAC,2BAA2B,CAAC,QAAQ;QACtC,CAAC,CAAC,2BAA2B,CAAC,QAAQ,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,wCAAwC;IACtD,OAAO,uBAAuB,CAAC,GAAG,CAAC,CAAC,EAAE,YAAY,EAAE,SAAS,EAAE,OAAO,EAAE,EAA8C,EAAE;QACtH,OAAO,CAAC,yBAAyB,EAAE,SAAoB,EAAE,EAAE;YACzD,OAAO,yCAAyC,CAAC;gBAC/C,aAAa,EAAE;oBACb,kBAAkB,EAAE,YAAY;oBAChC,mBAAmB,EAAE,wBAAwB,CAAC,aAAa;oBAC3D,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,kBAAkB,EAAE,IAAI;iBACzB;gBACD,gBAAgB,EAAE,oCAAoC;gBACtD,QAAQ,EAAE;oBACR,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE;wBACnF,MAAM,EAAE,UAAU,EAAE,GAAG,KAA+B,CAAC;wBAEvD,MAAM,OAAO,GAAG,SAAS,KAAK,aAAa,CAAC,YAAY;4BACtD,CAAC,CAAC,gBAAgB,CAAC,cAAc;4BACjC,CAAC,CAAC,gBAAgB,CAAC,aAAa,CAAC;wBACnC,IAAI,CAAC,OAAO,EAAE,CAAC;4BACb,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE;gCAC1E,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;gCAC9D,OAAO,EAAE,EAAE,OAAO,EAAE,oCAAoC,SAAS,4BAA4B,EAAE;6BAChG,CAAC,CAAC;wBACL,CAAC;wBAED,6DAA6D;wBAC7D,0EAA0E;wBAC1E,gEAAgE;wBAChE,uEAAuE;wBACvE,uEAAuE;wBACvE,6BAA6B;wBAC7B,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAe,kBAAkB,CAAC,YAAY,CAAC,CAAC;wBAC3E,oEAAoE;wBACpE,gFAAgF;wBAChF,kFAAkF;wBAClF,mFAAmF;wBACnF,gFAAgF;wBAChF,MAAM,gBAAgB,GAAG,SAAS,CAAC,GAAG,CAA0B,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;wBACrG,MAAM,0BAA0B,GAAG,mCAAmC,CACpE,+BAA+B,EAC/B,gBAAgB,CAAC,cAAc,CAChC,CAAC;wBACF,MAAM,gBAAgB,GAAG,MAAM,KAAK,CAAC,kBAAkB,CACrD,yBAAyB,SAAS,IAAI,OAAO,IAAI,UAAU,EAAE,EAC7D,+BAA+B,CAChC,CAAC;wBACF,IAAI,gBAAgB,GAAG,0BAA0B,EAAE,CAAC;4BAClD,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE;gCAC1E,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;gCAC9D,OAAO,EAAE;oCACP,OAAO,EAAE,iCAAiC,0BAA0B,QAAQ,+BAA+B,iEAAiE;oCAC5K,UAAU;oCACV,iBAAiB,EAAE,+BAA+B;iCACnD;6BACF,CAAC,CAAC;wBACL,CAAC;wBAED,6DAA6D;wBAC7D,8EAA8E;wBAC9E,8EAA8E;wBAC9E,+EAA+E;wBAC/E,iFAAiF;wBACjF,IAAI,CAAC,KAAK,CAAC,mBAAmB,EAAE,CAAC;4BAC/B,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,gBAAgB,EAAE;gCAC7E,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gCACjE,OAAO,EAAE,EAAE,OAAO,EAAE,oFAAoF,EAAE;6BAC3G,CAAC,CAAC;wBACL,CAAC;wBACD,MAAM,cAAc,GAAG,SAAS,KAAK,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,eAAe,CAAC;wBACrG,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,mBAAmB,CAAC,YAAY,CACzD,YAAY,EACZ,EAAE,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,EAC7B,EAAE,YAAY,EAAE,EAAE,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,EAAE,CAChD,CAAC;wBACF,IAAI,CAAC,MAAM,EAAE,CAAC;4BACZ,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,gBAAgB,EAAE;gCACzE,sBAAsB,EAAE,2BAA2B,CAAC,SAAS;gCAC7D,OAAO,EAAE,EAAE,OAAO,EAAE,iDAAiD,EAAE;6BACxE,CAAC,CAAC;wBACL,CAAC;wBAED,MAAM,QAAQ,GAAgC,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,UAAU,CAAC,CAAC;wBACxG,IAAI,CAAC,QAAQ,EAAE,CAAC;4BACd,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,gBAAgB,EAAE;gCACzE,sBAAsB,EAAE,2BAA2B,CAAC,SAAS;gCAC7D,OAAO,EAAE,EAAE,OAAO,EAAE,+DAA+D,EAAE,UAAU,EAAE;6BAClG,CAAC,CAAC;wBACL,CAAC;wBACD,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;4BAClB,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE;gCAC1E,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;gCAC9D,OAAO,EAAE,EAAE,OAAO,EAAE,oEAAoE,EAAE,UAAU,EAAE;6BACvG,CAAC,CAAC;wBACL,CAAC;wBACD,gFAAgF;wBAChF,gFAAgF;wBAChF,8DAA8D;wBAE9D,6DAA6D;wBAC7D,MAAM,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC;wBAC/B,MAAM,YAAY,GAAG,UAAU,EAAE,CAAC;wBAClC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;4BAC1B,SAAS,EAAE,IAAI;4BACf,OAAO,EAAE,sFAAsF;4BAC/F,UAAU;4BACV,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE;4BACvC,QAAQ,EAAE,WAAW,CAAC,WAAW,EAAE;yBACpC,CAAC,CAAC;wBACH,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;wBAEjE,MAAM,UAAU,GAAG,SAAS,CAAC,GAAG,CAAoB,kBAAkB,CAAC,iBAAiB,CAAC,CAAC;wBAC1F,IAAI,SAAiB,CAAC;wBACtB,IAAI,CAAC;4BACH,SAAS,GAAG,MAAM,UAAU,CAAC,IAAI,CAC/B;gCACE,wEAAwE;gCACxE,oFAAoF;gCACpF,CAAC,6BAA6B,CAAC,eAAe,CAAC,UAAU,CAAC,EAAE,YAAY;gCACxE,CAAC,6BAA6B,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,QAAQ;gCAClE,CAAC,6BAA6B,CAAC,eAAe,CAAC,iBAAiB,CAAC,EAAE,+BAA+B;gCAClG,CAAC,6BAA6B,CAAC,eAAe,CAAC,YAAY,CAAC,EAAE,OAAO;gCACrE,CAAC,6BAA6B,CAAC,eAAe,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC,YAAY,CAAC;gCACxF,CAAC,6BAA6B,CAAC,eAAe,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC,wBAAwB,CAAC,aAAa,CAAC;gCACnH,oEAAoE;gCACpE,2EAA2E;gCAC3E,SAAS,EAAE,IAAI;6BAChB,EACD,cAAc,CAAC,mBAAmB,CACnC,CAAC;wBACJ,CAAC;wBAAC,OAAO,KAAK,EAAE,CAAC;4BACf,2EAA2E;4BAC3E,6EAA6E;4BAC7E,MAAM,aAAa,GAAG,uBAAuB,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;4BAC1E,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,6DAA6D,EAAE;gCAChF,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK;6BACtC,CAAC,CAAC;4BACH,MAAM,OAAO,GAAG;gCACd,UAAU;gCACV,GAAG,EAAE,QAAQ,CAAC,GAAG;gCACjB,kFAAkF;gCAClF,iFAAiF;gCACjF,oEAAoE;gCACpE,oBAAoB,EAAE,mCAAmC,CAAC,QAAQ,CAAC,GAAG,CAAC;gCACvE,OAAO,EAAE,2BAA2B,CAAC,QAAQ;gCAC7C,aAAa;gCACb,UAAU,EAAE,CAAC;gCACb,YAAY;gCACZ,WAAW;6BACZ,CAAC;4BACF,MAAM,gBAAgB,CAAC,SAAS,EAAE,gBAAgB,EAAE;gCAClD,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG;gCACjD,OAAO,EAAE,2BAA2B,CAAC,QAAQ;gCAC7C,UAAU,EAAE,CAAC;gCACb,YAAY;6BACb,CAAC,CAAC;4BACH,OAAO,OAAO,CAAC;wBACjB,CAAC;wBAED,6DAA6D;wBAC7D,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;wBACtF,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;wBAC3D,MAAM,oBAAoB,GAAG,mCAAmC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;wBAE/E,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE;4BACpD,SAAS,EAAE,OAAO,EAAE,UAAU;4BAC9B,eAAe,EAAE,8BAA8B,CAAC,QAAQ,CAAC,GAAG,CAAC;4BAC7D,kFAAkF;4BAClF,gFAAgF;4BAChF,oBAAoB;4BACpB,OAAO;4BACP,cAAc,EAAE,MAAM,CAAC,cAAc;4BACrC,UAAU,EAAE,MAAM,CAAC,UAAU;4BAC7B,YAAY;yBACb,CAAC,CAAC;wBAEH,MAAM,gBAAgB,CAAC,SAAS,EAAE,gBAAgB,EAAE;4BAClD,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG;4BACjD,OAAO;4BACP,cAAc,EAAE,MAAM,CAAC,cAAc;4BACrC,UAAU,EAAE,MAAM,CAAC,UAAU;4BAC7B,YAAY;yBACb,CAAC,CAAC;wBAEH,mDAAmD;wBACnD,OAAO;4BACL,UAAU;4BACV,GAAG,EAAE,QAAQ,CAAC,GAAG;4BACjB,oBAAoB;4BACpB,OAAO;4BACP,cAAc,EAAE,MAAM,CAAC,cAAc;4BACrC,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;4BACnD,aAAa,EAAE,MAAM,CAAC,YAAY;4BAClC,UAAU,EAAE,MAAM,CAAC,UAAU;4BAC7B,YAAY;4BACZ,WAAW;yBACZ,CAAC;oBACJ,CAAC;iBACF;aACF,CAAC,CAAC;QACL,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,KAAK,UAAU,gBAAgB,CAC7B,SAAoB,EACpB,gBAAuC,EACvC,IASC;IAED,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,CAA0B,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;IAC9F,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,KAAK,aAAa,CAAC,YAAY,CAAC;IACjE,MAAM,WAAW,GAAG,gBAAgB,CAAC,YAAY,EAAE,MAAM,CAAC;IAE1D,MAAM,SAAS,GAA2D;QACxE,SAAS,EAAE,sBAAsB,CAAC,gCAAgC;QAClE,cAAc,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;QACrD,aAAa,EAAE,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO;QACpD,gFAAgF;QAChF,oFAAoF;QACpF,+EAA+E;QAC/E,YAAY,EAAE,WAAW,IAAI,cAAc;QAC3C,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,eAAe,EAAE,8BAA8B,CAAC,IAAI,CAAC,GAAG,CAAC;QACzD,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,YAAY,EAAE,IAAI,CAAC,YAAY;KAChC,CAAC;IAEF,MAAM,SAAS,CAAC,QAAQ,CACtB;QACE,MAAM,EAAE,WAAW;QACnB,qFAAqF;QACrF,yEAAyE;QACzE,cAAc,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;QACrD,aAAa,EAAE,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO;QACpD,0FAA0F;QAC1F,mCAAmC;QACnC,SAAS,EAAE,0BAA0B,CAAC,MAAM;QAC5C,SAAS,EAAE,sBAAsB,CAAC,gCAAgC;QAClE,SAAS,EAAE,SAAgC;KAC5C,EACD,gBAAgB,CACjB,CAAC;AACJ,CAAC","sourcesContent":["/*\n Webhook Config TEST_ENDPOINT — REPLACE_CORE_OPERATIONS factory.\n \n Makes `webhookConfig.testEndpoint` (org + app variants) do the thing it is named after:\n * fire one signed synthetic delivery at a single stored endpoint and report what came back.\n \n Before this implementation the operation was declared `resourceOperationLike: READ` with\n * no handler, so the generic core read answered 200 with the config row. An admin pressing\n * \"test\" on an endpoint whose URL had rotted was told it worked. A connectivity probe that\n * cannot fail is worse than no probe — it converts an unknown into a false assurance — so\n * every failure mode is now a distinct, reported outcome.\n \n Design commitments:\n \n - Same transport as real deliveries. The POST goes through\n * {@link sendSignedWebhookRequest}, shared verbatim with the delivery worker. A probe\n * that reached the endpoint by a different route would attest to that route, not to the\n * delivery path the admin actually cares about.\n * - Signed like a real delivery. Same key (`JwtPrivateKeys.APPLICATION_WEBHOOK`), same\n * claim shape, same `X-Webhook-Signature` header, so the consumer's verification code is\n * genuinely exercised rather than bypassed.\n * - Unmistakably synthetic. The claims carry `synthetic: true` and the body is a\n * self-describing test envelope. We are POSTing to a customer's production listener; a\n * probe indistinguishable from a real event would invite consumers to act on a fake one.\n * Unknown claims are ignored by existing consumers, so this adds no breaking change.\n * - No delivery-log row. Per the operation contract, test traffic stays out of the user\n * event log. The audit trail below is where a probe is recorded.\n * - A dead endpoint is a 200. Transport failure at the customer's side is a successful\n * probe carrying `outcome: UNREACHABLE`. HTTP errors are reserved for faults in the\n * request itself — unknown `endpointId`, absent config, rate limit exceeded.\n \n Scope resolution mirrors the sibling delivery-log impls: the ORG variant reads\n * `executionContext.organizationId`, the APP variant `applicationId`. The endpoint is then\n * selected by `endpointId` within that scope's config only, so a caller cannot aim the\n * probe at another tenant's endpoint — or at an arbitrary URL of their own choosing.\n \n @see ../m2m-webhook-signed-request.backend.utils.ts — the shared transport.\n * @see m2m-webhook-delivery-log.custom-impl.backend.service.ts — sibling REPLACE impls.\n /\n\nimport { createHash, randomUUID } from 'node:crypto';\nimport {\n AuthScopeType,\n CoreAuditableEventType,\n CoreM2MNotificationChannel,\n CoreResourceType,\n ErrorCustomMessageReference,\n ErrorType,\n ResourceOperationRiskLevel,\n ResourceOperationVariantType,\n WebhookConfig_Operations,\n WebhookConfig_TestEndpointRequestDto,\n WebhookEndpointProbeOutcome,\n webhookEndpointDestinationHost,\n webhookEndpointTransportIsPlaintext,\n type AuditableEvent_Webhook_EndpointTestDispatchedEventData,\n type WebhookConfigBase,\n type WebhookEndpoint,\n M2M_WEBHOOK_DELIVERY_CONTRACT,\n} from '@wildo-ai/saas-models';\nimport type { Container } from 'inversify';\nimport {\n createResourceCustomServiceImplementation,\n type ResourceCustomServiceImplementationFactory,\n} from '~wildo-backend-lib/base-classes/services/services/resource-operation-custom-implementation.factory.backend';\nimport type { AuditLogsBackendService } from '~wildo-backend-lib/compliance/audit-trails/services/audit-logs.backend.service';\nimport type { RedisService } from '~wildo-backend-lib/databases/services/redis.service';\nimport { describeCaughtError } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { relaxAbuseThrottleMaxForEnvironment } from '~wildo-backend-lib/errors/utils/rate-limit-environment-relaxation.backend.utils';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport { JwtPrivateKeys } from '~wildo-backend-lib/security/authentications/models/jwt.backend.schemas';\nimport type { JwtBackendService } from '~wildo-backend-lib/security/jwt/services/jwt.backend.service';\nimport { M2M_WEBHOOK_BODY_HASH_ALGORITHM, sendSignedWebhookRequest } from '../m2m-webhook-signed-request.backend.utils';\n\n/\n Variant → (scope type, notification channel) pairing. The channel rides the signed claims\n * so the probe presents itself on the same channel a real delivery from this scope would.\n /\nconst WEBHOOK_CONFIG_VARIANTS = [\n {\n resourceType: CoreResourceType.ORGANIZATION_WEBHOOK_CONFIG,\n scopeType: AuthScopeType.ORGANIZATION,\n channel: CoreM2MNotificationChannel.WEBHOOK_ORGANIZATION,\n },\n {\n resourceType: CoreResourceType.APPLICATION_WEBHOOK_CONFIG,\n scopeType: AuthScopeType.APPLICATION,\n channel: CoreM2MNotificationChannel.WEBHOOK_APPLICATION,\n },\n] as const;\n\n/\n Probe budget: at most this many attempts per endpoint per window.\n \n Scoped per ENDPOINT rather than per admin: the resource being protected is the customer's\n * listener, which does not care which of our admins is iterating on it. The allowance is\n * loose enough for the real workflow (tweak a URL, retest) and tight enough that the\n * operation cannot be used to generate sustained traffic at a third party.\n /\nconst PROBE_RATE_LIMIT_WINDOW_SECONDS = 60;\nconst PROBE_RATE_LIMIT_MAX_PER_WINDOW = 5;\n\n\n/\n Map a transport result onto the reported verdict.\n \n Deliberately NOT `classifyResponseStatus`: that function answers a delivery-retry question\n * (\"should we send this again?\"), where 429 and 503 are `retry`. A probe answers a\n * reachability question, where 429 and 503 both mean the endpoint is very much reachable and\n * chose to refuse. Reusing the retry classifier here would report a live, throttling endpoint\n * as though nothing had been learned about it.\n /\nexport function resolveProbeOutcome(responseStatus: number \| undefined): WebhookEndpointProbeOutcome {\n if (responseStatus === undefined) return WebhookEndpointProbeOutcome.UNREACHABLE;\n return responseStatus >= 200 && responseStatus < 300\n ? WebhookEndpointProbeOutcome.ACCEPTED\n : WebhookEndpointProbeOutcome.REJECTED;\n}\n\nexport function createWebhookConfigTestEndpointFactories(): ResourceCustomServiceImplementationFactory[] {\n return WEBHOOK_CONFIG_VARIANTS.map(({ resourceType, scopeType, channel }): ResourceCustomServiceImplementationFactory => {\n return (_resourcesRegistryService, container: Container) => {\n return createResourceCustomServiceImplementation({\n operationPath: {\n resourceIdentifier: resourceType,\n operationIdentifier: WebhookConfig_Operations.TEST_ENDPOINT,\n variantType: ResourceOperationVariantType.API_CALL,\n isOperationDefault: true,\n },\n requestDtoSchema: WebhookConfig_TestEndpointRequestDto,\n handlers: {\n replaceCoreOperations: async (_id, input, executionContext, _operationPath, utils) => {\n const { endpointId } = input as { endpointId: string };\n\n const scopeId = scopeType === AuthScopeType.ORGANIZATION\n ? executionContext.organizationId\n : executionContext.applicationId;\n if (!scopeId) {\n throw utils.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {\n customMessageReference: ErrorCustomMessageReference.VALIDATION,\n context: { message: `Webhook endpoint test requires a ${scopeType}-scoped execution context.` },\n });\n }\n\n // ── Rate limit ────────────────────────────────────────────\n // Fails CLOSED when the limiter is unavailable. This operation is the one\n // admin surface that makes the platform open a connection to an\n // operator-supplied URL; running it unmetered because Redis is down is\n // exactly the window an abuse path would want. An honest 4xx/5xx beats\n // silently unbounded egress.\n const redis = container.get<RedisService>(SAAS_SERVICE_TYPES.RedisService);\n // Non-production relaxation of the probe ceiling (shared seam — see\n // `rate-limit-environment-relaxation.backend.utils`). Five probes per minute is\n // a production egress guard; iterating on a webhook endpoint locally legitimately\n // exceeds it in seconds. The live-traffic warning in the message below still holds\n // in dev — the relaxation raises the ceiling, it does not make the probe cheap.\n const appConfigService = container.get<AppConfigurationService>(SAAS_SERVICE_TYPES.AppConfigService);\n const effectiveProbeMaxPerWindow = relaxAbuseThrottleMaxForEnvironment(\n PROBE_RATE_LIMIT_MAX_PER_WINDOW,\n appConfigService.applicationEnv,\n );\n const attemptsInWindow = await redis.incrementRateLimit(\n `webhook_endpoint_test:${scopeType}:${scopeId}:${endpointId}`,\n PROBE_RATE_LIMIT_WINDOW_SECONDS,\n );\n if (attemptsInWindow > effectiveProbeMaxPerWindow) {\n throw utils.errorBuilder.buildError(ErrorType.RATE_LIMIT, executionContext, {\n customMessageReference: ErrorCustomMessageReference.RATE_LIMIT,\n context: {\n message: `Endpoint tests are limited to ${effectiveProbeMaxPerWindow} per ${PROBE_RATE_LIMIT_WINDOW_SECONDS}s per endpoint; each one sends live traffic to the destination.`,\n endpointId,\n retryAfterSeconds: PROBE_RATE_LIMIT_WINDOW_SECONDS,\n },\n });\n }\n\n // ── Resolve the endpoint (scope-confined) ─────────────────\n // `readAsSystem` is the sanctioned privileged path and the resource opts into\n // it (`systemAccessPolicy: { read: ALLOWED }`). The caller has already passed\n // the org-admin / app-super-admin gate on this operation; the system read only\n // avoids re-deriving row visibility, and the filter pins the caller's own scope.\n if (!utils.systemAccessService) {\n throw utils.errorBuilder.buildError(ErrorType.CONFIGURATION, executionContext, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: { message: 'System access service is unavailable; cannot resolve the webhook endpoint to test.' },\n });\n }\n const scopeFieldName = scopeType === AuthScopeType.ORGANIZATION ? 'organizationId' : 'applicationId';\n const config = await utils.systemAccessService.readAsSystem<WebhookConfigBase>(\n resourceType,\n { [scopeFieldName]: scopeId },\n { scopeContext: { [scopeFieldName]: scopeId } },\n );\n if (!config) {\n throw utils.errorBuilder.buildError(ErrorType.NOT_FOUND, executionContext, {\n customMessageReference: ErrorCustomMessageReference.NOT_FOUND,\n context: { message: 'No webhook configuration exists for this scope.' },\n });\n }\n\n const endpoint: WebhookEndpoint \| undefined = (config.endpoints ?? []).find((e) => e.id === endpointId);\n if (!endpoint) {\n throw utils.errorBuilder.buildError(ErrorType.NOT_FOUND, executionContext, {\n customMessageReference: ErrorCustomMessageReference.NOT_FOUND,\n context: { message: 'No endpoint with this id exists on the webhook configuration.', endpointId },\n });\n }\n if (!endpoint.url) {\n throw utils.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {\n customMessageReference: ErrorCustomMessageReference.VALIDATION,\n context: { message: 'The stored endpoint has no URL, so no meaningful test can be sent.', endpointId },\n });\n }\n // A DISABLED endpoint is still probed on purpose: \"validate before enabling\" is\n // the primary workflow this operation exists for, and refusing here would force\n // an admin to enable an unverified URL in order to verify it.\n\n // ── Build + sign the synthetic delivery ───────────────────\n const attemptedAt = new Date();\n const signatureJti = randomUUID();\n const body = JSON.stringify({\n synthetic: true,\n message: 'Wildo webhook connectivity test. This is not a real event; do not process it as one.',\n endpointId,\n scope: { type: scopeType, id: scopeId },\n issuedAt: attemptedAt.toISOString(),\n });\n const bodyHash = createHash('sha256').update(body).digest('hex');\n\n const jwtService = container.get<JwtBackendService>(SAAS_SERVICE_TYPES.JwtBackendService);\n let signature: string;\n try {\n signature = await jwtService.sign(\n {\n // Claim names come from the published receiver contract, exactly as the\n // delivery worker signs them; a probe must be verifiable by the same receiver code.\n [M2M_WEBHOOK_DELIVERY_CONTRACT.signatureClaims.deliveryId]: signatureJti,\n [M2M_WEBHOOK_DELIVERY_CONTRACT.signatureClaims.bodyHash]: bodyHash,\n [M2M_WEBHOOK_DELIVERY_CONTRACT.signatureClaims.bodyHashAlgorithm]: M2M_WEBHOOK_BODY_HASH_ALGORITHM,\n [M2M_WEBHOOK_DELIVERY_CONTRACT.signatureClaims.eventChannel]: channel,\n [M2M_WEBHOOK_DELIVERY_CONTRACT.signatureClaims.resourceIdentifier]: String(resourceType),\n [M2M_WEBHOOK_DELIVERY_CONTRACT.signatureClaims.operationIdentifier]: String(WebhookConfig_Operations.TEST_ENDPOINT),\n // Present ONLY on probes. Lets a consumer that wants to hard-refuse\n // synthetic traffic do so on the signed envelope rather than on body text.\n synthetic: true,\n },\n JwtPrivateKeys.APPLICATION_WEBHOOK,\n );\n } catch (error) {\n // Signing failure is ours, not the endpoint's. Reporting it as UNREACHABLE\n // would send an admin to debug a customer endpoint over a missing local key.\n const failureReason = `JWT signing failed: ${describeCaughtError(error)}`;\n utils.logger.error('Webhook endpoint test could not be signed; nothing was sent', {\n scopeType, scopeId, endpointId, error,\n });\n const notSent = {\n endpointId,\n url: endpoint.url,\n // Reported even though nothing left the platform: the scheme is a property of the\n // STORED destination, not of this attempt, so an admin fixing a signing fault is\n // still told what the endpoint will cost them once it works (#492).\n transportIsPlaintext: webhookEndpointTransportIsPlaintext(endpoint.url),\n outcome: WebhookEndpointProbeOutcome.NOT_SENT,\n failureReason,\n durationMs: 0,\n signatureJti,\n attemptedAt,\n };\n await recordProbeAudit(container, executionContext, {\n scopeType, scopeId, endpointId, url: endpoint.url,\n outcome: WebhookEndpointProbeOutcome.NOT_SENT,\n durationMs: 0,\n signatureJti,\n });\n return notSent;\n }\n\n // ── Send ──────────────────────────────────────────────────\n const result = await sendSignedWebhookRequest({ url: endpoint.url, body, signature });\n const outcome = resolveProbeOutcome(result.responseStatus);\n const transportIsPlaintext = webhookEndpointTransportIsPlaintext(endpoint.url);\n\n utils.logger.info('Webhook endpoint test dispatched', {\n scopeType, scopeId, endpointId,\n destinationHost: webhookEndpointDestinationHost(endpoint.url),\n // A probe is the moment an operator is looking at ONE endpoint, so it is also the\n // cheapest moment to notice the signature JWT is going out in the clear (#492).\n transportIsPlaintext,\n outcome,\n responseStatus: result.responseStatus,\n durationMs: result.durationMs,\n signatureJti,\n });\n\n await recordProbeAudit(container, executionContext, {\n scopeType, scopeId, endpointId, url: endpoint.url,\n outcome,\n responseStatus: result.responseStatus,\n durationMs: result.durationMs,\n signatureJti,\n });\n\n // Matches `WebhookConfig_TestEndpointResponseDto`.\n return {\n endpointId,\n url: endpoint.url,\n transportIsPlaintext,\n outcome,\n responseStatus: result.responseStatus,\n responseBodyTruncated: result.responseBodyTruncated,\n failureReason: result.networkError,\n durationMs: result.durationMs,\n signatureJti,\n attemptedAt,\n };\n },\n },\n });\n };\n });\n}\n\n/\n Record the probe on the audit trail.\n \n Emitted for EVERY attempt, not only failures: the security signal is the pattern of\n * outbound probing (who, which hosts, how often), which only reads correctly if successes\n * are present too.\n \n Uses the generic `logEvent` rather than a dedicated `log` method so the audit service's\n public surface does not grow — partial `AuditLogsBackendService` mocks across the test\n * suite would otherwise start failing on a method they do not stub.\n \n Best-effort by construction: `logEvent` swallows its own failures, and an audit-store\n * outage must not convert a completed probe into an error the admin cannot act on.\n \n assurance-control: WILDO.INTEGRATION.OUTBOUND_ACTIVITY_AUDIT — attributable outbound connection\n * initiated from an administrative surface.\n */\nasync function recordProbeAudit(\n container: Container,\n executionContext: ExecutionContext<any>,\n data: {\n scopeType: AuthScopeType;\n scopeId: string;\n endpointId: string;\n url: string;\n outcome: WebhookEndpointProbeOutcome;\n responseStatus?: number;\n durationMs: number;\n signatureJti: string;\n },\n): Promise<void> {\n const auditLogs = container.get<AuditLogsBackendService>(SAAS_SERVICE_TYPES.AuditLogsService);\n const isOrgScope = data.scopeType === AuthScopeType.ORGANIZATION;\n const actorUserId = executionContext.initiatorIds?.userId;\n\n const eventData: AuditableEvent_Webhook_EndpointTestDispatchedEventData = {\n eventType: CoreAuditableEventType.WEBHOOK_ENDPOINT_TEST_DISPATCHED,\n organizationId: isOrgScope ? data.scopeId : undefined,\n applicationId: isOrgScope ? undefined : data.scopeId,\n // The operation is role-gated to a human admin, so an absent actor id means the\n // execution context was not shaped as expected. Record the gap rather than papering\n // over it — an unattributable egress probe is itself the thing worth noticing.\n dispatchedBy: actorUserId ?? 'unattributed',\n endpointId: data.endpointId,\n destinationHost: webhookEndpointDestinationHost(data.url),\n outcome: data.outcome,\n responseStatus: data.responseStatus,\n durationMs: data.durationMs,\n signatureJti: data.signatureJti,\n };\n\n await auditLogs.logEvent(\n {\n userId: actorUserId,\n // Scope FK as event DATA. Per-org SIEM routing is resolved by the audit service from\n // the authenticated request context passed below, never from this field.\n organizationId: isOrgScope ? data.scopeId : undefined,\n applicationId: isOrgScope ? undefined : data.scopeId,\n // Matches the operation's declared `riskLevel` — outbound traffic to an operator-supplied\n // URL, gated behind an admin role.\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.WEBHOOK_ENDPOINT_TEST_DISPATCHED,\n eventData: eventData as Record<string, any>,\n },\n executionContext,\n );\n}\n"]}

package/dist/esm/notifications/webhooks/services/webhook-handler.backend.service.d.ts CHANGED Viewed

@@ -45,6 +45,22 @@ export declare class WebhookHandlerBackendService {
      * Called at startup by capability modules (e.g., billing module).
      */
     registerAdapter(providerRef: string, endpointKey: string, adapter: WebhookCapabilityAdapter): void;
+    /**
+     * Whether a capability adapter is registered for `providerRef:endpointKey`.
+     *
+     * Read-only mount-time predicate for {@link WebhookAutoControllerBackendService}:
+     * without an adapter, `processWebhook` throws `INTERNAL` at the very top of the
+     * pipeline (`No webhook adapter registered for ...`), which the controller answers
+     * as a 500 — i.e. an instruction to the VENDOR to retry an event that can never be
+     * processed, because nothing about a retry supplies the missing registration. The
+     * auto-controller therefore asks this BEFORE mounting a route, and withholds the
+     * route instead of mounting one that can only fail.
+     *
+     * Deliberately not exposing the adapter itself: the caller needs an admission
+     * decision, not the verify/parse surface, and handing out the adapter would let a
+     * consumer route around `processWebhook`'s signature/idempotency pipeline.
+     */
+    hasAdapter(providerRef: string, endpointKey: string): boolean;
     /**
      * Register a custom scope resolver to override declarative scope resolution.
      * This is an escape hatch for complex cases where Hook_EndpointScopeBinding is insufficient.

package/dist/esm/notifications/webhooks/services/webhook-handler.backend.service.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"webhook-handler.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/notifications/webhooks/services/webhook-handler.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,EAEL,KAAK,aAAa,EAGlB,KAAK,wBAAwB,EAE7B,KAAK,wBAAwB,EAC7B,KAAK,0BAA0B,EAChC,MAAM,sCAAsC,CAAC;AAI9C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACxF,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AACnH,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,+EAA+E,CAAC;AAC3I,OAAO,KAAK,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AACrK,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,4FAA4F,CAAC;AAC1J,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AACpH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAC5G,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,sCAAsC,CAAC;AAc5F,qBACa,4BAA4B;IAWF,OAAO,CAAC,QAAQ,CAAC,MAAM;IACjB,OAAO,CAAC,QAAQ,CAAC,YAAY;IACtB,OAAO,CAAC,QAAQ,CAAC,YAAY;IACX,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IAC3C,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IACvC,OAAO,CAAC,QAAQ,CAAC,yBAAyB;IAC1D,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACzB,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAhBzF,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;IAExF,6DAA6D;IAC7D,OAAO,CAAC,QAAQ,CAA+C;IAE/D,gFAAgF;IAChF,OAAO,CAAC,eAAe,CAAiD;gBAGlB,MAAM,EAAE,aAAa,EACf,YAAY,EAAE,YAAY,EACnB,YAAY,EAAE,0BAA0B,EACtB,uBAAuB,EAAE,qCAAqC,EACjE,oBAAoB,EAAE,yCAAyC,EACjE,yBAAyB,EAAE,uCAAuC,EAClF,gBAAgB,EAAE,uBAAuB,EACjC,iBAAiB,EAAE,+BAA+B;IAU1H;;;OAGG;IACH,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,wBAAwB,GAAG,IAAI;IAMlG;;;OAGG;IACH,2BAA2B,CAAC,QAAQ,EAAE,0BAA0B,GAAG,IAAI;IAUvE;;;;;;OAMG;IACG,cAAc,CAAC,MAAM,EAAE;QAC3B,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;QACpB,QAAQ,EAAE,aAAa,CAAC;QACxB,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;QACzB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACjC,GAAG,OAAO,CAAC;QAAE,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAAC,WAAW,EAAE,wBAAwB,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;YA0HjH,uBAAuB;IAoB/B,oBAAoB,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBvE,mBAAmB,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAe5E;;;;;;OAMG;YACW,YAAY;IA0H1B;;;;OAIG;YACW,uBAAuB;IAuFrC,mEAAmE;IACnE,OAAO,CAAC,kBAAkB;IAc1B,+EAA+E;YACjE,oBAAoB;IAkBlC,sDAAsD;IACtD,OAAO,CAAC,iBAAiB;IAQzB;;;OAGG;IACG,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAKjG"}
1	+ {"version":3,"file":"webhook-handler.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/notifications/webhooks/services/webhook-handler.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,EAEL,KAAK,aAAa,EAGlB,KAAK,wBAAwB,EAE7B,KAAK,wBAAwB,EAC7B,KAAK,0BAA0B,EAChC,MAAM,sCAAsC,CAAC;AAI9C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACxF,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AACnH,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,+EAA+E,CAAC;AAC3I,OAAO,KAAK,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AACrK,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,4FAA4F,CAAC;AAC1J,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AACpH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAC5G,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,sCAAsC,CAAC;AAc5F,qBACa,4BAA4B;IAWF,OAAO,CAAC,QAAQ,CAAC,MAAM;IACjB,OAAO,CAAC,QAAQ,CAAC,YAAY;IACtB,OAAO,CAAC,QAAQ,CAAC,YAAY;IACX,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IAC3C,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IACvC,OAAO,CAAC,QAAQ,CAAC,yBAAyB;IAC1D,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACzB,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAhBzF,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;IAExF,6DAA6D;IAC7D,OAAO,CAAC,QAAQ,CAA+C;IAE/D,gFAAgF;IAChF,OAAO,CAAC,eAAe,CAAiD;gBAGlB,MAAM,EAAE,aAAa,EACf,YAAY,EAAE,YAAY,EACnB,YAAY,EAAE,0BAA0B,EACtB,uBAAuB,EAAE,qCAAqC,EACjE,oBAAoB,EAAE,yCAAyC,EACjE,yBAAyB,EAAE,uCAAuC,EAClF,gBAAgB,EAAE,uBAAuB,EACjC,iBAAiB,EAAE,+BAA+B;IAU1H;;;OAGG;IACH,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,wBAAwB,GAAG,IAAI;IAMlG;;;;;;;;;;;;;;OAcG;IACH,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO;IAI7D;;;OAGG;IACH,2BAA2B,CAAC,QAAQ,EAAE,0BAA0B,GAAG,IAAI;IAUvE;;;;;;OAMG;IACG,cAAc,CAAC,MAAM,EAAE;QAC3B,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;QACpB,QAAQ,EAAE,aAAa,CAAC;QACxB,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;QACzB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACjC,GAAG,OAAO,CAAC;QAAE,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAAC,WAAW,EAAE,wBAAwB,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;YA0HjH,uBAAuB;IAoB/B,oBAAoB,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBvE,mBAAmB,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAe5E;;;;;;OAMG;YACW,YAAY;IA0H1B;;;;OAIG;YACW,uBAAuB;IAuFrC,mEAAmE;IACnE,OAAO,CAAC,kBAAkB;IAc1B,+EAA+E;YACjE,oBAAoB;IAkBlC,sDAAsD;IACtD,OAAO,CAAC,iBAAiB;IAQzB;;;OAGG;IACG,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAKjG"}

package/dist/esm/notifications/webhooks/services/webhook-handler.backend.service.js CHANGED Viewed

@@ -78,6 +78,24 @@ let WebhookHandlerBackendService = class WebhookHandlerBackendService {
         this.adapters.set(key, adapter);
         this.logDebug(`Registered webhook adapter for ${key}`);
     }
+    /**
+     * Whether a capability adapter is registered for `providerRef:endpointKey`.
+     *
+     * Read-only mount-time predicate for {@link WebhookAutoControllerBackendService}:
+     * without an adapter, `processWebhook` throws `INTERNAL` at the very top of the
+     * pipeline (`No webhook adapter registered for ...`), which the controller answers
+     * as a 500 — i.e. an instruction to the VENDOR to retry an event that can never be
+     * processed, because nothing about a retry supplies the missing registration. The
+     * auto-controller therefore asks this BEFORE mounting a route, and withholds the
+     * route instead of mounting one that can only fail.
+     *
+     * Deliberately not exposing the adapter itself: the caller needs an admission
+     * decision, not the verify/parse surface, and handing out the adapter would let a
+     * consumer route around `processWebhook`'s signature/idempotency pipeline.
+     */
+    hasAdapter(providerRef, endpointKey) {
+        return this.adapters.has(`${providerRef}:${endpointKey}`);
+    }
     /**
      * Register a custom scope resolver to override declarative scope resolution.
      * This is an escape hatch for complex cases where Hook_EndpointScopeBinding is insufficient.

package/dist/esm/notifications/webhooks/services/webhook-handler.backend.service.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"webhook-handler.backend.service.js","sourceRoot":"","sources":["../../../../../../src/notifications/webhooks/services/webhook-handler.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;;;;;;;;;;;;;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EACL,sCAAsC,GAQvC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AAEtG,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAWpF,wDAAwD;AACxD,YAAY;AACZ,wDAAwD;AAExD,wCAAwC;AACxC,MAAM,+BAA+B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AACrD,MAAM,sBAAsB,GAAG,UAAU,CAAC;AAE1C,wDAAwD;AACxD,UAAU;AACV,wDAAwD;AAGjD,IAAM,4BAA4B,GAAlC,MAAM,4BAA4B;IAWe;IACM;IACO;IACkB;IACH;IACF;IAChB;IACQ;IAhBvD,QAAQ,CAA+D;IAExF,6DAA6D;IACrD,QAAQ,GAAG,IAAI,GAAG,EAAoC,CAAC;IAE/D,gFAAgF;IACxE,eAAe,GAAG,IAAI,GAAG,EAAsC,CAAC;IAExE,YACsD,MAAqB,EACf,YAA0B,EACnB,YAAwC,EACtB,uBAA8D,EACjE,oBAA+D,EACjE,yBAAkE,EAClF,gBAAyC,EACjC,iBAAkD;QAPpE,WAAM,GAAN,MAAM,CAAe;QACf,iBAAY,GAAZ,YAAY,CAAc;QACnB,iBAAY,GAAZ,YAAY,CAA4B;QACtB,4BAAuB,GAAvB,uBAAuB,CAAuC;QACjE,yBAAoB,GAApB,oBAAoB,CAA2C;QACjE,8BAAyB,GAAzB,yBAAyB,CAAyC;QAClF,qBAAgB,GAAhB,gBAAgB,CAAyB;QACjC,sBAAiB,GAAjB,iBAAiB,CAAiC;QAExH,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;IAC3D,CAAC;IAED,+DAA+D;IAC/D,eAAe;IACf,+DAA+D;IAE/D;;;OAGG;IACH,eAAe,CAAC,WAAmB,EAAE,WAAmB,EAAE,OAAiC;QACzF,MAAM,GAAG,GAAG,GAAG,WAAW,IAAI,WAAW,EAAE,CAAC;QAC5C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAChC,IAAI,CAAC,QAAQ,CAAC,kCAAkC,GAAG,EAAE,CAAC,CAAC;IACzD,CAAC;IAED;;;OAGG;IACH,2BAA2B,CAAC,QAAoC;QAC9D,MAAM,GAAG,GAAG,GAAG,QAAQ,CAAC,WAAW,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC9D,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACxC,IAAI,CAAC,QAAQ,CAAC,wCAAwC,GAAG,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,+DAA+D;IAC/D,gBAAgB;IAChB,+DAA+D;IAE/D;;;;;;OAMG;IACH,KAAK,CAAC,cAAc,CAAC,MAMpB;QACC,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;QACxE,MAAM,UAAU,GAAG,GAAG,WAAW,IAAI,WAAW,EAAE,CAAC;QACnD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAE9C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,QAAQ,EAClB,SAAS,EACT,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,qCAAqC,UAAU,EAAE,EAAE,EAAE,CAC5E,CAAC;QACJ,CAAC;QAED,mDAAmD;QACnD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QAEzE,6CAA6C;QAC7C,MAAM,eAAe,GAAG,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QAC3E,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC,OAAO,EAAE,eAAe,EAAE,MAAM,CAAC,CAAC;YAChF,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,SAAS,EACT,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,yBAAyB,EAAE,CAClF,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAAa,EAAE,SAAS,KAAK,SAAS,CAAC,aAAa;gBAAE,MAAM,KAAK,CAAC;YACvE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sCAAsC,EAAE,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC;YACzH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,SAAS,EACT,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,yBAAyB,EAAE,CAClF,CAAC;QACJ,CAAC;QAED,mEAAmE;QACnE,MAAM,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACzD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,mDAAmD;YACnD,IAAI,CAAC,QAAQ,CAAC,mDAAmD,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC;YACjG,OAAO,IAAI,CAAC;QACd,CAAC;QACD,2BAA2B;QAC3B,WAAW,CAAC,WAAW,GAAG,WAAW,CAAC;QACtC,IACE,QAAQ,CAAC,UAAU,EAAE,MAAM;eACxB,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,iBAAiB,CAAC,EAC/D,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,6DAA6D,EAAE;gBAC3E,WAAW;gBACX,WAAW;gBACX,SAAS,EAAE,WAAW,CAAC,iBAAiB;aACzC,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QAED,yEAAyE;QACzE,yEAAyE;QACzE,yEAAyE;QACzE,IAAI,cAAkC,CAAC;QACvC,IAAI,kBAAkB,GAAG,KAAK,CAAC;QAC/B,IAAI,CAAC;YACH,cAAc,GAAG,GAAG,sBAAsB,GAAG,WAAW,IAAI,WAAW,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;YACjG,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,cAAc,CAAC,CAAC;YACvE,IAAI,WAAW,KAAK,WAAW,EAAE,CAAC;gBAChC,IAAI,CAAC,QAAQ,CAAC,2CAA2C,EAAE,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC7F,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,WAAW,KAAK,aAAa,EAAE,CAAC;gBAClC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,QAAQ,EAClB,SAAS,EACT,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,6CAA6C,WAAW,CAAC,OAAO,EAAE,EAAE,EAAE,CAC7F,CAAC;YACJ,CAAC;YACD,kBAAkB,GAAG,IAAI,CAAC;QAC5B,CAAC;QAAC,OAAO,UAAU,EAAE,CAAC;YACpB,IAAK,UAAkB,EAAE,SAAS,KAAK,SAAS,CAAC,QAAQ;gBAAE,MAAM,UAAU,CAAC;YAC5E,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,kEAAkE,EAAE;gBACpF,KAAK,EAAG,UAAoB,CAAC,OAAO;aACrC,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,QAAQ,EAClB,SAAS,EACT,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,iDAAiD,EAAE,EAAE,CAC5E,CAAC;QACJ,CAAC;QAED,IAAI,gBAAuC,CAAC;QAC5C,IAAI,aAAyC,CAAC;QAC9C,IAAI,CAAC;YACH,2CAA2C;YAC3C,aAAa,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;YAEzF,8CAA8C;YAC9C,gBAAgB,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,wBAAwB,CAC5E,aAAa,EACb,WAAW,CACZ,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,kBAAkB,EAAE,CAAC;gBACvB,MAAM,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAAC,CAAC;YACjD,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE;YAC1C,WAAW;YACX,WAAW;YACX,OAAO,EAAE,WAAW,CAAC,OAAO;YAC5B,SAAS,EAAE,WAAW,CAAC,SAAS;YAChC,aAAa,EAAE;gBACb,cAAc,EAAE,aAAa,CAAC,cAAc;gBAC5C,MAAM,EAAE,aAAa,CAAC,MAAM;aAC7B;SACF,CAAC,CAAC;QAEH,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC;IAC3D,CAAC;IAEO,KAAK,CAAC,uBAAuB,CAAC,cAAsB;QAC1D,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CACzC;;;;;;;OAOC,EACD,CAAC,QAAQ,CAAC,EACV,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAChC,CAAC;QAEF,IAAI,MAAM,KAAK,aAAa,IAAI,MAAM,KAAK,WAAW;YAAE,OAAO,WAAW,CAAC;QAC3E,IAAI,MAAM,KAAK,eAAe,IAAI,MAAM,KAAK,aAAa;YAAE,OAAO,aAAa,CAAC;QACjF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,cAAkC;QAC3D,IAAI,CAAC,cAAc;YAAE,OAAO;QAC5B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAC1B,oEAAoE,EACpE,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,EAC5C,CAAC,WAAW,EAAE,MAAM,CAAC,+BAA+B,CAAC,CAAC,CACvD,CAAC;QACJ,CAAC;QAAC,OAAO,UAAU,EAAE,CAAC;YACpB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sDAAsD,EAAE;gBACxE,KAAK,EAAG,UAAoB,CAAC,OAAO;aACrC,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,QAAQ,EAClB,SAAS,EACT,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,sDAAsD,EAAE,EAAE,CACjF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,cAAkC;QAC1D,IAAI,CAAC,cAAc;YAAE,OAAO;QAC5B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAC1E,CAAC;QAAC,OAAO,UAAU,EAAE,CAAC;YACpB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mDAAmD,EAAE;gBACrE,KAAK,EAAG,UAAoB,CAAC,OAAO;aACrC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,+DAA+D;IAC/D,+BAA+B;IAC/B,+DAA+D;IAE/D;;;;;;OAMG;IACK,KAAK,CAAC,YAAY,CACxB,WAAmB,EACnB,WAAmB,EACnB,QAAuB,EACvB,WAAqC;QAErC,6CAA6C;QAC7C,MAAM,cAAc,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,WAAW,IAAI,WAAW,EAAE,CAAC,CAAC;QACjF,IAAI,cAAc,EAAE,CAAC;YACnB,OAAO,cAAc,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;QAClD,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC;QAC1D,MAAM,OAAO,GAAG,QAAQ,CAAC,YAAY,CAAC;QAEtC,uCAAuC;QACvC,IAAI,cAAc,IAAI,OAAO,IAAI,OAAO,CAAC,YAAY,KAAK,aAAa,EAAE,CAAC;YACxE,OAAO,EAAE,aAAa,EAAE,CAAC;QAC3B,CAAC;QAED,wEAAwE;QACxE,IAAI,uBAAuB,IAAI,OAAO,IAAI,OAAO,CAAC,qBAAqB,EAAE,QAAQ,CAAC,WAAW,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACjH,IAAI,CAAC,QAAQ,CAAC,mDAAmD,EAAE;gBACjE,SAAS,EAAE,WAAW,CAAC,iBAAiB;aACzC,CAAC,CAAC;YACH,OAAO,EAAE,aAAa,EAAE,CAAC;QAC3B,CAAC;QAED,2BAA2B;QAC3B,mFAAmF;QACnF,IAAI,MAAM,IAAI,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YACxD,OAAO,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;QAC3E,CAAC;QAED,4BAA4B;QAC5B,mFAAmF;QACnF,MAAM,aAAa,GAAG,OAA6E,CAAC;QAEpG,0DAA0D;QAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,UAAU,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC;QAClG,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,QAAQ,EAClB,SAAS,EACT;gBACE,OAAO,EAAE;oBACP,OAAO,EAAE,sDAAsD,aAAa,CAAC,kBAAkB,cAAc,WAAW,CAAC,OAAO,EAAE;iBACnI;aACF,CACF,CAAC;QACJ,CAAC;QAED,+CAA+C;QAC/C,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,gCAAgC,EAAE,CAAC;QAC1F,MAAM,UAAU,GAAG,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC,aAAa,CAAC,kBAAkB,CAAC,CAAC;QAC7F,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gDAAgD,EAAE;gBACjE,kBAAkB,EAAE,aAAa,CAAC,kBAAkB;gBACpD,OAAO,EAAE,WAAW,CAAC,OAAO;aAC7B,CAAC,CAAC;YACH,OAAO,EAAE,aAAa,EAAE,CAAC;QAC3B,CAAC;QAED,IAAI,QAAa,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,QAAQ,CACvC,EAAE,kBAAkB,EAAE,aAAa,CAAC,kBAAkB,EAAE,mBAAmB,EAAE,qBAAqB,CAAC,IAAI,EAAE,EACzG,WAAW,EACX,EAAE,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,CACzC,CAAC;YACF,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QAC3D,CAAC;QAAC,OAAO,WAAW,EAAE,CAAC;YACrB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yCAAyC,EAAE;gBAC1D,kBAAkB,EAAE,aAAa,CAAC,kBAAkB;gBACpD,WAAW,EAAE,aAAa,CAAC,WAAW;gBACtC,OAAO;gBACP,OAAO,EAAE,WAAW,CAAC,OAAO;gBAC5B,KAAK,EAAG,WAAqB,CAAC,OAAO;aACtC,CAAC,CAAC;YACH,OAAO,EAAE,aAAa,EAAE,CAAC;QAC3B,CAAC;QAED,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,8CAA8C,EAAE;gBAC/D,kBAAkB,EAAE,aAAa,CAAC,kBAAkB;gBACpD,WAAW,EAAE,aAAa,CAAC,WAAW;gBACtC,OAAO;gBACP,OAAO,EAAE,WAAW,CAAC,OAAO;aAC7B,CAAC,CAAC;YACH,OAAO,EAAE,aAAa,EAAE,CAAC;QAC3B,CAAC;QAED,0BAA0B;QAC1B,MAAM,kBAAkB,GAAG,aAAa,CAAC,kBAAkB,IAAI,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QAClH,MAAM,gBAAgB,GAAG,QAAQ,CAAC,kBAAkB,CAAC,CAAC;QAEtD,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6DAA6D,EAAE;gBAC9E,kBAAkB;gBAClB,kBAAkB,EAAE,aAAa,CAAC,kBAAkB;gBACpD,OAAO,EAAE,WAAW,CAAC,OAAO;aAC7B,CAAC,CAAC;YACH,OAAO,EAAE,aAAa,EAAE,CAAC;QAC3B,CAAC;QAED,sBAAsB;QACtB,MAAM,KAAK,GAA+B;YACxC,aAAa;YACb,gBAAgB,EAAE,EAAE,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE;SAC3D,CAAC;QACF,QAAQ,aAAa,CAAC,YAAY,EAAE,CAAC;YACnC,KAAK,eAAe;gBAClB,KAAK,CAAC,cAAc,GAAG,gBAAgB,CAAC;gBACxC,MAAM;YACR,KAAK,WAAW;gBACd,KAAK,CAAC,MAAM,GAAG,gBAAgB,CAAC;gBAChC,MAAM;QACV,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,uBAAuB,CACnC,OAAoE,EACpE,WAAqC,EACrC,aAAqB;QAErB,4FAA4F;QAC5F,MAAM,oBAAoB,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,WAAW,CAAC,iBAAiB,CAAC,EAAE,kBAAkB;eACvG,OAAO,CAAC,kBAAkB,CAAC;QAEhC,oCAAoC;QACpC,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,UAAU,EAAE,oBAAoB,CAAC,CAAC;QAC1F,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,QAAQ,EAClB,SAAS,EACT;gBACE,OAAO,EAAE;oBACP,OAAO,EAAE,kEAAkE,oBAAoB,cAAc,WAAW,CAAC,OAAO,EAAE;iBACnI;aACF,CACF,CAAC;QACJ,CAAC;QAED,+FAA+F;QAC/F,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,gCAAgC,EAAE,CAAC;QAC1F,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,oBAAoB,CAC9D,OAAO,CAAC,QAAQ,EAChB,OAAO,CAAC,WAAW,EACnB,WAAW,EACX,WAAW,CACZ,CAAC;QAEF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+DAA+D,EAAE;gBAChF,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,WAAW;gBACX,YAAY,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM;gBACrC,OAAO,EAAE,WAAW,CAAC,OAAO;aAC7B,CAAC,CAAC;YACH,OAAO,EAAE,aAAa,EAAE,CAAC;QAC3B,CAAC;QAED,qDAAqD;QACrD,MAAM,gBAAgB,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;QACvE,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yEAAyE,EAAE;gBAC1F,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;gBACnD,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,OAAO,EAAE,WAAW,CAAC,OAAO;aAC7B,CAAC,CAAC;YACH,OAAO,EAAE,aAAa,EAAE,CAAC;QAC3B,CAAC;QAED,2DAA2D;QAC3D,MAAM,KAAK,GAA+B;YACxC,aAAa;YACb,gBAAgB,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,WAAW,EAAE;SACzD,CAAC;QACF,QAAQ,MAAM,CAAC,qBAAqB,EAAE,CAAC;YACrC,KAAK,gBAAgB;gBACnB,KAAK,CAAC,cAAc,GAAG,gBAAgB,CAAC;gBACxC,MAAM;YACR,KAAK,QAAQ;gBACX,KAAK,CAAC,MAAM,GAAG,gBAAgB,CAAC;gBAChC,MAAM;YACR;gBACE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uEAAuE,EAAE;oBACxF,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;oBACnD,YAAY,EAAE,MAAM,CAAC,YAAY;oBACjC,OAAO,EAAE,WAAW,CAAC,OAAO;iBAC7B,CAAC,CAAC;gBACH,MAAM;QACV,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,4BAA4B,EAAE;YAC1C,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;YACnD,gBAAgB;SACjB,CAAC,CAAC;QAEH,OAAO,KAAK,CAAC;IACf,CAAC;IAED,+DAA+D;IAC/D,UAAU;IACV,+DAA+D;IAE/D,mEAAmE;IAC3D,kBAAkB,CAAC,OAAgB,EAAE,OAAe;QAC1D,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAU,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;gBAC7D,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,IAAK,GAA+B,EAAE,CAAC;oBAC9E,OAAQ,GAA+B,CAAC,GAAG,CAAC,CAAC;gBAC/C,CAAC;gBACD,OAAO,SAAS,CAAC;YACnB,CAAC,EAAE,OAAO,CAAC,CAAC;YACZ,OAAO,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACtF,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,+EAA+E;IACvE,KAAK,CAAC,oBAAoB,CAAC,WAAmB,EAAE,WAAmB;QACzE,MAAM,MAAM,GAAG,IAAI,CAAC,yBAAyB,CAAC,wBAAwB,CACpE,WAAW,EACX,sCAAsC,CAAC,kBAAkB,CACP,CAAC;QAErD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kEAAkE,WAAW,EAAE,CAAC,CAAC;YAClG,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,SAAS,CAAC;QAC/C,MAAM,SAAS,GAAG,SAAS;YACzB,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,iBAAiB,CAAC,WAAW,EAAE,sCAAsC,CAAC,kBAAkB,EAAE,SAAS,CAAC;YACrI,CAAC,CAAC,SAAS,CAAC;QACd,OAAO,MAAM,CAAC,eAAe,EAAE,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,aAAa,IAAI,SAAS,IAAI,EAAE,CAAC;IAC1F,CAAC;IAED,sDAAsD;IAC9C,iBAAiB,CAAC,YAAoB;QAC5C,QAAQ,YAAY,EAAE,CAAC;YACrB,KAAK,eAAe,CAAC,CAAC,OAAO,gBAAgB,CAAC;YAC9C,KAAK,WAAW,CAAC,CAAC,OAAO,QAAQ,CAAC;YAClC,OAAO,CAAC,CAAC,OAAO,gBAAgB,CAAC;QACnC,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,gBAAgB,CAAC,WAAmB,EAAE,WAAmB,EAAE,OAAe;QAC9E,MAAM,GAAG,GAAG,GAAG,sBAAsB,GAAG,WAAW,IAAI,WAAW,IAAI,OAAO,EAAE,CAAC;QAChF,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mCAAmC,GAAG,EAAE,CAAC,CAAC;IAC7D,CAAC;CACF,CAAA;AAngBY,4BAA4B;IADxC,UAAU,EAAE;IAYR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAA;IACvC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,qCAAqC,CAAC,CAAA;IAChE,WAAA,MAAM,CAAC,kBAAkB,CAAC,kCAAkC,CAAC,CAAA;IAC7D,WAAA,MAAM,CAAC,kBAAkB,CAAC,gCAAgC,CAAC,CAAA;IAC3D,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,wBAAwB,CAAC,CAAA;;GAlB3C,4BAA4B,CAmgBxC","sourcesContent":["/*\n Webhook Handler Backend Service\n \n Generic pipeline that processes incoming webhook events through:\n * 1. Signature verification (via capability adapter)\n * 2. Event parsing (via capability adapter)\n * 3. Idempotency check (Redis)\n * 4. Declarative scope resolution (via Hook_EndpointScopeBinding config)\n * 5. WEBHOOK_CALLBACK ExecutionContext creation\n \n The pipeline is provider-agnostic. Provider-specific logic is injected via:\n * - WebhookCapabilityAdapter (verify + parse)\n * - Hook_EndpointScopeBinding configuration (declarative scope resolution)\n * - Hook_ScopeResolverStrategy (optional escape hatch)\n \n @see hook-protocol-webhook-callback.md\n /\n\nimport { injectable, inject } from 'inversify';\nimport {\n ExternalProvider_ExchangeProtocol_Kind,\n type Hook_Endpoint,\n type Hook_EndpointScopeBinding,\n type HookInitiatorProvider_Configuration,\n type StandardHook_ParsedEvent,\n type StandardHook_ResolvedScope,\n type WebhookCapabilityAdapter,\n type Hook_ScopeResolverStrategy,\n} from '@wildo-ai/external-connectors-models';\nimport { ErrorType, CoreResourceOperation, ErrorCustomMessageReference } from '@wildo-ai/saas-models';\n\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport type { RedisService } from '~wildo-backend-lib/databases/services/redis.service';\nimport type { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport type { ExecutionContextCreatorBackendService } from '~wildo-backend-lib/runtime/services/execution-context-creator.backend.service';\nimport type { RepositoriesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/repositories/repositories-registry-handler.backend.service';\nimport type { ExternalProvidersRegistryBackendService } from '~wildo-backend-lib/external-providers/services/external-providers-registry.backend.service';\nimport type { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport type { PolymorphicLookupBackendService } from './polymorphic-lookup.backend.service';\n\n// =====================================================\n// Constants\n// =====================================================\n\n/* Default idempotency TTL: 24 hours /\nconst DEFAULT_IDEMPOTENCY_TTL_SECONDS = 24 60 * 60;\nconst IDEMPOTENCY_KEY_PREFIX = 'webhook:';\n\n// =====================================================\n// Service\n// =====================================================\n\n@injectable()\nexport class WebhookHandlerBackendService {\n\n private readonly logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n /** Capability adapters keyed by \"providerRef:endpointKey\" /\n private adapters = new Map<string, WebhookCapabilityAdapter>();\n\n /* Custom scope resolvers (escape hatch), keyed by \"providerRef:endpointKey\" /\n private customResolvers = new Map<string, Hook_ScopeResolverStrategy>();\n\n constructor(\n @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n @inject(SAAS_SERVICE_TYPES.RedisService) private readonly redisService: RedisService,\n @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private readonly errorBuilder: ErrorBuilderBackendService,\n @inject(SAAS_SERVICE_TYPES.ExecutionContextCreatorBackendService) private readonly executionContextCreator: ExecutionContextCreatorBackendService,\n @inject(SAAS_SERVICE_TYPES.RepositoriesRegistryHandlerService) private readonly repositoriesRegistry: RepositoriesRegistryHandlerBackendService,\n @inject(SAAS_SERVICE_TYPES.ExternalProvidersRegistryService) private readonly externalProvidersRegistry: ExternalProvidersRegistryBackendService,\n @inject(SAAS_SERVICE_TYPES.AppConfigService) private readonly appConfigService: AppConfigurationService,\n @inject(SAAS_SERVICE_TYPES.PolymorphicLookupService) private readonly polymorphicLookup: PolymorphicLookupBackendService,\n ) {\n this.logDebug = this.logger.debugByType('WebhookHandler');\n this.logger.setDebugTypeLogging('WebhookHandler', false);\n }\n\n // ════════════════════════════════════════════════════════════\n // Registration\n // ════════════════════════════════════════════════════════════\n\n /\n Register a capability adapter for a specific provider endpoint.\n * Called at startup by capability modules (e.g., billing module).\n /\n registerAdapter(providerRef: string, endpointKey: string, adapter: WebhookCapabilityAdapter): void {\n const key = `${providerRef}:${endpointKey}`;\n this.adapters.set(key, adapter);\n this.logDebug(`Registered webhook adapter for ${key}`);\n }\n\n /\n Register a custom scope resolver to override declarative scope resolution.\n * This is an escape hatch for complex cases where Hook_EndpointScopeBinding is insufficient.\n /\n registerCustomScopeResolver(resolver: Hook_ScopeResolverStrategy): void {\n const key = `${resolver.providerRef}:${resolver.endpointKey}`;\n this.customResolvers.set(key, resolver);\n this.logDebug(`Registered custom scope resolver for ${key}`);\n }\n\n // ════════════════════════════════════════════════════════════\n // Main Pipeline\n // ════════════════════════════════════════════════════════════\n\n /\n Process a raw webhook through the full pipeline.\n * Called by WebhookAutoControllerBackendService's auto-registered routes.\n \n Returns null if the event was already processed (idempotent) or unparseable (acknowledged).\n * Throws on signature failure, scope extraction failure, or handler errors.\n /\n async processWebhook(params: {\n providerRef: string;\n endpointKey: string;\n endpoint: Hook_Endpoint;\n rawBody: string \| Buffer;\n headers: Record<string, string>;\n }): Promise<{ executionContext: ExecutionContext<any>; parsedEvent: StandardHook_ParsedEvent; idempotencyKey?: string } \| null> {\n const { providerRef, endpointKey, endpoint, rawBody, headers } = params;\n const adapterKey = `${providerRef}:${endpointKey}`;\n const adapter = this.adapters.get(adapterKey);\n\n if (!adapter) {\n throw this.errorBuilder.buildError(\n ErrorType.INTERNAL,\n undefined,\n { context: { message: `No webhook adapter registered for ${adapterKey}` } }\n );\n }\n\n // 1. Resolve webhook secret from app configuration\n const secret = await this.resolveWebhookSecret(providerRef, endpointKey);\n\n // 2. Verify signature via capability adapter\n const signatureHeader = headers[endpoint.signatureConfig.headerName] ?? '';\n try {\n const isValid = await adapter.verifySignature(rawBody, signatureHeader, secret);\n if (!isValid) {\n throw this.errorBuilder.buildError(\n ErrorType.AUTHORIZATION,\n undefined,\n { customMessageReference: ErrorCustomMessageReference.WEBHOOK_SIGNATURE_INVALID }\n );\n }\n } catch (error) {\n if ((error as any)?.errorType === ErrorType.AUTHORIZATION) throw error;\n this.logger.error('Webhook signature verification error', { error: (error as Error).message, providerRef, endpointKey });\n throw this.errorBuilder.buildError(\n ErrorType.AUTHORIZATION,\n undefined,\n { customMessageReference: ErrorCustomMessageReference.WEBHOOK_SIGNATURE_INVALID }\n );\n }\n\n // 3. Parse event via capability adapter → StandardHook_ParsedEvent\n const parsedEvent = adapter.parseEvent(rawBody, headers);\n if (!parsedEvent) {\n // Unknown event type — acknowledge to stop retries\n this.logDebug('Unparseable/unknown webhook event — acknowledging', { providerRef, endpointKey });\n return null;\n }\n // Enrich with endpoint key\n parsedEvent.endpointKey = endpointKey;\n if (\n endpoint.eventTypes?.length\n && !endpoint.eventTypes.includes(parsedEvent.providerEventType)\n ) {\n this.logDebug('Webhook event type not declared on endpoint — acknowledging', {\n providerRef,\n endpointKey,\n eventType: parsedEvent.providerEventType,\n });\n return null;\n }\n\n // 4. Idempotency check (Redis). Completion is recorded by the controller\n // only after the capability handler succeeds, otherwise provider retries\n // would be acknowledged as duplicates after a failed processing attempt.\n let idempotencyKey: string \| undefined;\n let claimedIdempotency = false;\n try {\n idempotencyKey = `${IDEMPOTENCY_KEY_PREFIX}${providerRef}:${endpointKey}:${parsedEvent.eventId}`;\n const claimStatus = await this.claimWebhookIdempotency(idempotencyKey);\n if (claimStatus === 'completed') {\n this.logDebug('Duplicate webhook event — idempotent skip', { eventId: parsedEvent.eventId });\n return null;\n }\n if (claimStatus === 'in_progress') {\n throw this.errorBuilder.buildError(\n ErrorType.INTERNAL,\n undefined,\n { context: { message: `Webhook event is already being processed: ${parsedEvent.eventId}` } },\n );\n }\n claimedIdempotency = true;\n } catch (redisError) {\n if ((redisError as any)?.errorType === ErrorType.INTERNAL) throw redisError;\n this.logger.error('Redis unavailable for webhook idempotency check — failing closed', {\n error: (redisError as Error).message,\n });\n throw this.errorBuilder.buildError(\n ErrorType.INTERNAL,\n undefined,\n { context: { message: 'Redis unavailable for webhook idempotency check' } },\n );\n }\n\n let executionContext: ExecutionContext<any>;\n let resolvedScope: StandardHook_ResolvedScope;\n try {\n // 5. Resolve scope (declarative or custom)\n resolvedScope = await this.resolveScope(providerRef, endpointKey, endpoint, parsedEvent);\n\n // 6. Create WEBHOOK_CALLBACK ExecutionContext\n executionContext = await this.executionContextCreator.createForWebhookCallback(\n resolvedScope,\n parsedEvent,\n );\n } catch (error) {\n if (claimedIdempotency) {\n await this.releaseWebhookClaim(idempotencyKey);\n }\n throw error;\n }\n\n this.logger.info('Webhook event processed', {\n providerRef,\n endpointKey,\n eventId: parsedEvent.eventId,\n eventType: parsedEvent.eventType,\n resolvedScope: {\n organizationId: resolvedScope.organizationId,\n userId: resolvedScope.userId,\n },\n });\n\n return { executionContext, parsedEvent, idempotencyKey };\n }\n\n private async claimWebhookIdempotency(idempotencyKey: string): Promise<'claimed' \| 'in_progress' \| 'completed'> {\n const redisKey = this.redisService.buildKey(idempotencyKey);\n const result = await this.redisService.eval(\n `\n local existing = redis.call('GET', KEYS[1])\n if existing == false then\n redis.call('SET', KEYS[1], ARGV[1], 'EX', ARGV[2])\n return 'claimed'\n end\n return existing\n `,\n [redisKey],\n ['in_progress', String(5 60)],\n );\n\n if (result === '\"completed\"' \|\| result === 'completed') return 'completed';\n if (result === '\"in_progress\"' \|\| result === 'in_progress') return 'in_progress';\n return 'claimed';\n }\n\n async markWebhookProcessed(idempotencyKey: string \| undefined): Promise<void> {\n if (!idempotencyKey) return;\n try {\n await this.redisService.eval(\n \"redis.call('SET', KEYS[1], ARGV[1], 'EX', ARGV[2]); return ARGV[1]\",\n [this.redisService.buildKey(idempotencyKey)],\n ['completed', String(DEFAULT_IDEMPOTENCY_TTL_SECONDS)],\n );\n } catch (redisError) {\n this.logger.error('Redis unavailable for webhook idempotency completion', {\n error: (redisError as Error).message,\n });\n throw this.errorBuilder.buildError(\n ErrorType.INTERNAL,\n undefined,\n { context: { message: 'Redis unavailable for webhook idempotency completion' } },\n );\n }\n }\n\n async releaseWebhookClaim(idempotencyKey: string \| undefined): Promise<void> {\n if (!idempotencyKey) return;\n try {\n await this.redisService.del(this.redisService.buildKey(idempotencyKey));\n } catch (redisError) {\n this.logger.error('Redis unavailable for webhook idempotency release', {\n error: (redisError as Error).message,\n });\n }\n }\n\n // ════════════════════════════════════════════════════════════\n // Declarative Scope Resolution\n // ════════════════════════════════════════════════════════════\n\n /*\n Resolve the engine scope from a webhook event.\n \n Priority:\n * 1. Custom resolver (escape hatch) if registered for this endpoint\n * 2. Declarative resolution via Hook_EndpointScopeBinding config\n /\n private async resolveScope(\n providerRef: string,\n endpointKey: string,\n endpoint: Hook_Endpoint,\n parsedEvent: StandardHook_ParsedEvent\n ): Promise<StandardHook_ResolvedScope> {\n // Check custom resolver first (escape hatch)\n const customResolver = this.customResolvers.get(`${providerRef}:${endpointKey}`);\n if (customResolver) {\n return customResolver.resolveScope(parsedEvent);\n }\n\n const applicationId = this.appConfigService.applicationId;\n const binding = endpoint.scopeBinding;\n\n // APPLICATION scope — no lookup needed\n if ('primaryScope' in binding && binding.primaryScope === 'APPLICATION') {\n return { applicationId };\n }\n\n // Check scope-exempt events (e.g., product.updated → APPLICATION scope)\n if ('scopeExemptEventTypes' in binding && binding.scopeExemptEventTypes?.includes(parsedEvent.providerEventType)) {\n this.logDebug('Scope-exempt event type — using APPLICATION scope', {\n eventType: parsedEvent.providerEventType,\n });\n return { applicationId };\n }\n\n // ─── Polymorphic mode ───\n // Queries N variant collections and resolves scope from whichever variant matches.\n if ('mode' in binding && binding.mode === 'polymorphic') {\n return this.resolvePolymorphicScope(binding, parsedEvent, applicationId);\n }\n\n // ─── Single-scope mode ───\n // After APPLICATION and polymorphic early returns, narrow to single-scope binding.\n const singleBinding = binding as Extract<Hook_EndpointScopeBinding, { lookupResourceType: string }>;\n\n // Extract scope ID from payload using configured dot-path\n const scopeId = this.extractFromPayload(parsedEvent.rawPayload, singleBinding.payloadScopeIdPath);\n if (!scopeId) {\n throw this.errorBuilder.buildError(\n ErrorType.INTERNAL,\n undefined,\n {\n context: {\n message: `Webhook scope resolution failed: no value at path '${singleBinding.payloadScopeIdPath}' in event ${parsedEvent.eventId}`,\n },\n }\n );\n }\n\n // Lookup resource to find the scope entity ID.\n const internalCtx = await this.executionContextCreator.createForInternalSystemOperation();\n const repository = this.repositoriesRegistry.getRepository(singleBinding.lookupResourceType);\n if (!repository) {\n this.logger.warn('Webhook scope resolution: repository not found', {\n lookupResourceType: singleBinding.lookupResourceType,\n eventId: parsedEvent.eventId,\n });\n return { applicationId };\n }\n\n let resource: any;\n try {\n const results = await repository.doByPath(\n { resourceIdentifier: singleBinding.lookupResourceType, operationIdentifier: CoreResourceOperation.LIST },\n internalCtx,\n { [singleBinding.lookupField]: scopeId },\n );\n resource = Array.isArray(results) ? results[0] : results;\n } catch (lookupError) {\n this.logger.warn('Webhook scope resolution: lookup failed', {\n lookupResourceType: singleBinding.lookupResourceType,\n lookupField: singleBinding.lookupField,\n scopeId,\n eventId: parsedEvent.eventId,\n error: (lookupError as Error).message,\n });\n return { applicationId };\n }\n\n if (!resource) {\n this.logger.warn('Webhook scope resolution: resource not found', {\n lookupResourceType: singleBinding.lookupResourceType,\n lookupField: singleBinding.lookupField,\n scopeId,\n eventId: parsedEvent.eventId,\n });\n return { applicationId };\n }\n\n // Extract scope entity ID\n const scopeEntityIdField = singleBinding.scopeEntityIdField ?? this.defaultScopeField(singleBinding.primaryScope);\n const resolvedEntityId = resource[scopeEntityIdField];\n\n if (!resolvedEntityId) {\n this.logger.warn('Webhook scope resolution: entity ID field empty on resource', {\n scopeEntityIdField,\n lookupResourceType: singleBinding.lookupResourceType,\n eventId: parsedEvent.eventId,\n });\n return { applicationId };\n }\n\n // Map to engine scope\n const scope: StandardHook_ResolvedScope = {\n applicationId,\n providerScopeIds: { [singleBinding.lookupField]: scopeId },\n };\n switch (singleBinding.primaryScope) {\n case 'ORGANIZATIONS':\n scope.organizationId = resolvedEntityId;\n break;\n case 'USER_SELF':\n scope.userId = resolvedEntityId;\n break;\n }\n\n return scope;\n }\n\n /\n Resolve scope using polymorphic lookup — queries N variant collections.\n * Delegates to PolymorphicLookupBackendService for the multi-collection query,\n * then maps the result to the engine scope.\n /\n private async resolvePolymorphicScope(\n binding: Extract<Hook_EndpointScopeBinding, { mode: 'polymorphic' }>,\n parsedEvent: StandardHook_ParsedEvent,\n applicationId: string,\n ): Promise<StandardHook_ResolvedScope> {\n // Resolve the payload path — check per-event-type override first, then fall back to default\n const effectiveScopeIdPath = binding.eventTypeOverrides?.[parsedEvent.providerEventType]?.payloadScopeIdPath\n ?? binding.payloadScopeIdPath;\n\n // Extract lookup value from payload\n const lookupValue = this.extractFromPayload(parsedEvent.rawPayload, effectiveScopeIdPath);\n if (!lookupValue) {\n throw this.errorBuilder.buildError(\n ErrorType.INTERNAL,\n undefined,\n {\n context: {\n message: `Webhook polymorphic scope resolution failed: no value at path '${effectiveScopeIdPath}' in event ${parsedEvent.eventId}`,\n },\n }\n );\n }\n\n // Query across all variant collections (pass the internal context to avoid redundant creation)\n const internalCtx = await this.executionContextCreator.createForInternalSystemOperation();\n const result = await this.polymorphicLookup.lookupAcrossVariants(\n binding.variants,\n binding.lookupField,\n lookupValue,\n internalCtx,\n );\n\n if (!result) {\n this.logger.warn('Webhook polymorphic scope resolution: no match in any variant', {\n lookupField: binding.lookupField,\n lookupValue,\n variantCount: binding.variants.length,\n eventId: parsedEvent.eventId,\n });\n return { applicationId };\n }\n\n // Read the scope entity ID from the matched document\n const resolvedEntityId = result.document[result.parentFieldIdentifier];\n if (!resolvedEntityId) {\n this.logger.warn('Webhook polymorphic scope resolution: entity ID field empty on document', {\n parentFieldIdentifier: result.parentFieldIdentifier,\n resourceType: result.resourceType,\n eventId: parsedEvent.eventId,\n });\n return { applicationId };\n }\n\n // Map to engine scope based on the parent field identifier\n const scope: StandardHook_ResolvedScope = {\n applicationId,\n providerScopeIds: { [binding.lookupField]: lookupValue },\n };\n switch (result.parentFieldIdentifier) {\n case 'organizationId':\n scope.organizationId = resolvedEntityId;\n break;\n case 'userId':\n scope.userId = resolvedEntityId;\n break;\n default:\n this.logger.warn('Webhook polymorphic scope resolution: unknown parent field identifier', {\n parentFieldIdentifier: result.parentFieldIdentifier,\n resourceType: result.resourceType,\n eventId: parsedEvent.eventId,\n });\n break;\n }\n\n this.logDebug('Polymorphic scope resolved', {\n resourceType: result.resourceType,\n parentFieldIdentifier: result.parentFieldIdentifier,\n resolvedEntityId,\n });\n\n return scope;\n }\n\n // ════════════════════════════════════════════════════════════\n // Helpers\n // ════════════════════════════════════════════════════════════\n\n /* Extract a value from a nested object using dot-notation path /\n private extractFromPayload(payload: unknown, dotPath: string): string \| null {\n try {\n const result = dotPath.split('.').reduce<unknown>((obj, key) => {\n if (obj && typeof obj === 'object' && key in (obj as Record<string, unknown>)) {\n return (obj as Record<string, unknown>)[key];\n }\n return undefined;\n }, payload);\n return typeof result === 'string' ? result : result != null ? String(result) : null;\n } catch {\n return null;\n }\n }\n\n /* Resolve webhook secret from app configuration (per-endpoint or fallback) /\n private async resolveWebhookSecret(providerRef: string, endpointKey: string): Promise<string> {\n const config = this.externalProvidersRegistry.getProviderConfiguration(\n providerRef,\n ExternalProvider_ExchangeProtocol_Kind.WEBHOOK_ORIGINATOR,\n ) as HookInitiatorProvider_Configuration \| undefined;\n\n if (!config) {\n this.logger.warn(`No WEBHOOK_ORIGINATOR runtime configuration found for provider ${providerRef}`);\n return '';\n }\n\n const secretRef = config.authConfig?.secretRef;\n const envSecret = secretRef\n ? this.externalProvidersRegistry.getProviderSecret(providerRef, ExternalProvider_ExchangeProtocol_Kind.WEBHOOK_ORIGINATOR, secretRef)\n : undefined;\n return config.endpointSecrets?.[endpointKey] ?? config.webhookSecret ?? envSecret ?? '';\n }\n\n /* Default scope field name based on primary scope /\n private defaultScopeField(primaryScope: string): string {\n switch (primaryScope) {\n case 'ORGANIZATIONS': return 'organizationId';\n case 'USER_SELF': return 'userId';\n default: return 'organizationId';\n }\n }\n\n /\n Admin method: clear idempotency for forced reprocessing.\n * Use during debugging or when an event needs to be reprocessed.\n */\n async clearIdempotency(providerRef: string, endpointKey: string, eventId: string): Promise<void> {\n const key = `${IDEMPOTENCY_KEY_PREFIX}${providerRef}:${endpointKey}:${eventId}`;\n await this.redisService.del(this.redisService.buildKey(key));\n this.logger.info(`Cleared webhook idempotency for ${key}`);\n }\n}\n"]}
1	+ {"version":3,"file":"webhook-handler.backend.service.js","sourceRoot":"","sources":["../../../../../../src/notifications/webhooks/services/webhook-handler.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;;;;;;;;;;;;;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EACL,sCAAsC,GAQvC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AAEtG,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAWpF,wDAAwD;AACxD,YAAY;AACZ,wDAAwD;AAExD,wCAAwC;AACxC,MAAM,+BAA+B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AACrD,MAAM,sBAAsB,GAAG,UAAU,CAAC;AAE1C,wDAAwD;AACxD,UAAU;AACV,wDAAwD;AAGjD,IAAM,4BAA4B,GAAlC,MAAM,4BAA4B;IAWe;IACM;IACO;IACkB;IACH;IACF;IAChB;IACQ;IAhBvD,QAAQ,CAA+D;IAExF,6DAA6D;IACrD,QAAQ,GAAG,IAAI,GAAG,EAAoC,CAAC;IAE/D,gFAAgF;IACxE,eAAe,GAAG,IAAI,GAAG,EAAsC,CAAC;IAExE,YACsD,MAAqB,EACf,YAA0B,EACnB,YAAwC,EACtB,uBAA8D,EACjE,oBAA+D,EACjE,yBAAkE,EAClF,gBAAyC,EACjC,iBAAkD;QAPpE,WAAM,GAAN,MAAM,CAAe;QACf,iBAAY,GAAZ,YAAY,CAAc;QACnB,iBAAY,GAAZ,YAAY,CAA4B;QACtB,4BAAuB,GAAvB,uBAAuB,CAAuC;QACjE,yBAAoB,GAApB,oBAAoB,CAA2C;QACjE,8BAAyB,GAAzB,yBAAyB,CAAyC;QAClF,qBAAgB,GAAhB,gBAAgB,CAAyB;QACjC,sBAAiB,GAAjB,iBAAiB,CAAiC;QAExH,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;IAC3D,CAAC;IAED,+DAA+D;IAC/D,eAAe;IACf,+DAA+D;IAE/D;;;OAGG;IACH,eAAe,CAAC,WAAmB,EAAE,WAAmB,EAAE,OAAiC;QACzF,MAAM,GAAG,GAAG,GAAG,WAAW,IAAI,WAAW,EAAE,CAAC;QAC5C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAChC,IAAI,CAAC,QAAQ,CAAC,kCAAkC,GAAG,EAAE,CAAC,CAAC;IACzD,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,UAAU,CAAC,WAAmB,EAAE,WAAmB;QACjD,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,WAAW,IAAI,WAAW,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED;;;OAGG;IACH,2BAA2B,CAAC,QAAoC;QAC9D,MAAM,GAAG,GAAG,GAAG,QAAQ,CAAC,WAAW,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC9D,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACxC,IAAI,CAAC,QAAQ,CAAC,wCAAwC,GAAG,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,+DAA+D;IAC/D,gBAAgB;IAChB,+DAA+D;IAE/D;;;;;;OAMG;IACH,KAAK,CAAC,cAAc,CAAC,MAMpB;QACC,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;QACxE,MAAM,UAAU,GAAG,GAAG,WAAW,IAAI,WAAW,EAAE,CAAC;QACnD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAE9C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,QAAQ,EAClB,SAAS,EACT,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,qCAAqC,UAAU,EAAE,EAAE,EAAE,CAC5E,CAAC;QACJ,CAAC;QAED,mDAAmD;QACnD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QAEzE,6CAA6C;QAC7C,MAAM,eAAe,GAAG,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QAC3E,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC,OAAO,EAAE,eAAe,EAAE,MAAM,CAAC,CAAC;YAChF,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,SAAS,EACT,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,yBAAyB,EAAE,CAClF,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAAa,EAAE,SAAS,KAAK,SAAS,CAAC,aAAa;gBAAE,MAAM,KAAK,CAAC;YACvE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sCAAsC,EAAE,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC;YACzH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,SAAS,EACT,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,yBAAyB,EAAE,CAClF,CAAC;QACJ,CAAC;QAED,mEAAmE;QACnE,MAAM,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACzD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,mDAAmD;YACnD,IAAI,CAAC,QAAQ,CAAC,mDAAmD,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC;YACjG,OAAO,IAAI,CAAC;QACd,CAAC;QACD,2BAA2B;QAC3B,WAAW,CAAC,WAAW,GAAG,WAAW,CAAC;QACtC,IACE,QAAQ,CAAC,UAAU,EAAE,MAAM;eACxB,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,iBAAiB,CAAC,EAC/D,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,6DAA6D,EAAE;gBAC3E,WAAW;gBACX,WAAW;gBACX,SAAS,EAAE,WAAW,CAAC,iBAAiB;aACzC,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QAED,yEAAyE;QACzE,yEAAyE;QACzE,yEAAyE;QACzE,IAAI,cAAkC,CAAC;QACvC,IAAI,kBAAkB,GAAG,KAAK,CAAC;QAC/B,IAAI,CAAC;YACH,cAAc,GAAG,GAAG,sBAAsB,GAAG,WAAW,IAAI,WAAW,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;YACjG,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,cAAc,CAAC,CAAC;YACvE,IAAI,WAAW,KAAK,WAAW,EAAE,CAAC;gBAChC,IAAI,CAAC,QAAQ,CAAC,2CAA2C,EAAE,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC7F,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,WAAW,KAAK,aAAa,EAAE,CAAC;gBAClC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,QAAQ,EAClB,SAAS,EACT,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,6CAA6C,WAAW,CAAC,OAAO,EAAE,EAAE,EAAE,CAC7F,CAAC;YACJ,CAAC;YACD,kBAAkB,GAAG,IAAI,CAAC;QAC5B,CAAC;QAAC,OAAO,UAAU,EAAE,CAAC;YACpB,IAAK,UAAkB,EAAE,SAAS,KAAK,SAAS,CAAC,QAAQ;gBAAE,MAAM,UAAU,CAAC;YAC5E,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,kEAAkE,EAAE;gBACpF,KAAK,EAAG,UAAoB,CAAC,OAAO;aACrC,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,QAAQ,EAClB,SAAS,EACT,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,iDAAiD,EAAE,EAAE,CAC5E,CAAC;QACJ,CAAC;QAED,IAAI,gBAAuC,CAAC;QAC5C,IAAI,aAAyC,CAAC;QAC9C,IAAI,CAAC;YACH,2CAA2C;YAC3C,aAAa,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;YAEzF,8CAA8C;YAC9C,gBAAgB,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,wBAAwB,CAC5E,aAAa,EACb,WAAW,CACZ,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,kBAAkB,EAAE,CAAC;gBACvB,MAAM,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAAC,CAAC;YACjD,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE;YAC1C,WAAW;YACX,WAAW;YACX,OAAO,EAAE,WAAW,CAAC,OAAO;YAC5B,SAAS,EAAE,WAAW,CAAC,SAAS;YAChC,aAAa,EAAE;gBACb,cAAc,EAAE,aAAa,CAAC,cAAc;gBAC5C,MAAM,EAAE,aAAa,CAAC,MAAM;aAC7B;SACF,CAAC,CAAC;QAEH,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC;IAC3D,CAAC;IAEO,KAAK,CAAC,uBAAuB,CAAC,cAAsB;QAC1D,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CACzC;;;;;;;OAOC,EACD,CAAC,QAAQ,CAAC,EACV,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAChC,CAAC;QAEF,IAAI,MAAM,KAAK,aAAa,IAAI,MAAM,KAAK,WAAW;YAAE,OAAO,WAAW,CAAC;QAC3E,IAAI,MAAM,KAAK,eAAe,IAAI,MAAM,KAAK,aAAa;YAAE,OAAO,aAAa,CAAC;QACjF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,cAAkC;QAC3D,IAAI,CAAC,cAAc;YAAE,OAAO;QAC5B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAC1B,oEAAoE,EACpE,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,EAC5C,CAAC,WAAW,EAAE,MAAM,CAAC,+BAA+B,CAAC,CAAC,CACvD,CAAC;QACJ,CAAC;QAAC,OAAO,UAAU,EAAE,CAAC;YACpB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sDAAsD,EAAE;gBACxE,KAAK,EAAG,UAAoB,CAAC,OAAO;aACrC,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,QAAQ,EAClB,SAAS,EACT,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,sDAAsD,EAAE,EAAE,CACjF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,cAAkC;QAC1D,IAAI,CAAC,cAAc;YAAE,OAAO;QAC5B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAC1E,CAAC;QAAC,OAAO,UAAU,EAAE,CAAC;YACpB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mDAAmD,EAAE;gBACrE,KAAK,EAAG,UAAoB,CAAC,OAAO;aACrC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,+DAA+D;IAC/D,+BAA+B;IAC/B,+DAA+D;IAE/D;;;;;;OAMG;IACK,KAAK,CAAC,YAAY,CACxB,WAAmB,EACnB,WAAmB,EACnB,QAAuB,EACvB,WAAqC;QAErC,6CAA6C;QAC7C,MAAM,cAAc,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,WAAW,IAAI,WAAW,EAAE,CAAC,CAAC;QACjF,IAAI,cAAc,EAAE,CAAC;YACnB,OAAO,cAAc,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;QAClD,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC;QAC1D,MAAM,OAAO,GAAG,QAAQ,CAAC,YAAY,CAAC;QAEtC,uCAAuC;QACvC,IAAI,cAAc,IAAI,OAAO,IAAI,OAAO,CAAC,YAAY,KAAK,aAAa,EAAE,CAAC;YACxE,OAAO,EAAE,aAAa,EAAE,CAAC;QAC3B,CAAC;QAED,wEAAwE;QACxE,IAAI,uBAAuB,IAAI,OAAO,IAAI,OAAO,CAAC,qBAAqB,EAAE,QAAQ,CAAC,WAAW,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACjH,IAAI,CAAC,QAAQ,CAAC,mDAAmD,EAAE;gBACjE,SAAS,EAAE,WAAW,CAAC,iBAAiB;aACzC,CAAC,CAAC;YACH,OAAO,EAAE,aAAa,EAAE,CAAC;QAC3B,CAAC;QAED,2BAA2B;QAC3B,mFAAmF;QACnF,IAAI,MAAM,IAAI,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YACxD,OAAO,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;QAC3E,CAAC;QAED,4BAA4B;QAC5B,mFAAmF;QACnF,MAAM,aAAa,GAAG,OAA6E,CAAC;QAEpG,0DAA0D;QAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,UAAU,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC;QAClG,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,QAAQ,EAClB,SAAS,EACT;gBACE,OAAO,EAAE;oBACP,OAAO,EAAE,sDAAsD,aAAa,CAAC,kBAAkB,cAAc,WAAW,CAAC,OAAO,EAAE;iBACnI;aACF,CACF,CAAC;QACJ,CAAC;QAED,+CAA+C;QAC/C,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,gCAAgC,EAAE,CAAC;QAC1F,MAAM,UAAU,GAAG,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC,aAAa,CAAC,kBAAkB,CAAC,CAAC;QAC7F,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gDAAgD,EAAE;gBACjE,kBAAkB,EAAE,aAAa,CAAC,kBAAkB;gBACpD,OAAO,EAAE,WAAW,CAAC,OAAO;aAC7B,CAAC,CAAC;YACH,OAAO,EAAE,aAAa,EAAE,CAAC;QAC3B,CAAC;QAED,IAAI,QAAa,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,QAAQ,CACvC,EAAE,kBAAkB,EAAE,aAAa,CAAC,kBAAkB,EAAE,mBAAmB,EAAE,qBAAqB,CAAC,IAAI,EAAE,EACzG,WAAW,EACX,EAAE,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,CACzC,CAAC;YACF,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QAC3D,CAAC;QAAC,OAAO,WAAW,EAAE,CAAC;YACrB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yCAAyC,EAAE;gBAC1D,kBAAkB,EAAE,aAAa,CAAC,kBAAkB;gBACpD,WAAW,EAAE,aAAa,CAAC,WAAW;gBACtC,OAAO;gBACP,OAAO,EAAE,WAAW,CAAC,OAAO;gBAC5B,KAAK,EAAG,WAAqB,CAAC,OAAO;aACtC,CAAC,CAAC;YACH,OAAO,EAAE,aAAa,EAAE,CAAC;QAC3B,CAAC;QAED,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,8CAA8C,EAAE;gBAC/D,kBAAkB,EAAE,aAAa,CAAC,kBAAkB;gBACpD,WAAW,EAAE,aAAa,CAAC,WAAW;gBACtC,OAAO;gBACP,OAAO,EAAE,WAAW,CAAC,OAAO;aAC7B,CAAC,CAAC;YACH,OAAO,EAAE,aAAa,EAAE,CAAC;QAC3B,CAAC;QAED,0BAA0B;QAC1B,MAAM,kBAAkB,GAAG,aAAa,CAAC,kBAAkB,IAAI,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QAClH,MAAM,gBAAgB,GAAG,QAAQ,CAAC,kBAAkB,CAAC,CAAC;QAEtD,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6DAA6D,EAAE;gBAC9E,kBAAkB;gBAClB,kBAAkB,EAAE,aAAa,CAAC,kBAAkB;gBACpD,OAAO,EAAE,WAAW,CAAC,OAAO;aAC7B,CAAC,CAAC;YACH,OAAO,EAAE,aAAa,EAAE,CAAC;QAC3B,CAAC;QAED,sBAAsB;QACtB,MAAM,KAAK,GAA+B;YACxC,aAAa;YACb,gBAAgB,EAAE,EAAE,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE;SAC3D,CAAC;QACF,QAAQ,aAAa,CAAC,YAAY,EAAE,CAAC;YACnC,KAAK,eAAe;gBAClB,KAAK,CAAC,cAAc,GAAG,gBAAgB,CAAC;gBACxC,MAAM;YACR,KAAK,WAAW;gBACd,KAAK,CAAC,MAAM,GAAG,gBAAgB,CAAC;gBAChC,MAAM;QACV,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,uBAAuB,CACnC,OAAoE,EACpE,WAAqC,EACrC,aAAqB;QAErB,4FAA4F;QAC5F,MAAM,oBAAoB,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,WAAW,CAAC,iBAAiB,CAAC,EAAE,kBAAkB;eACvG,OAAO,CAAC,kBAAkB,CAAC;QAEhC,oCAAoC;QACpC,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,UAAU,EAAE,oBAAoB,CAAC,CAAC;QAC1F,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,QAAQ,EAClB,SAAS,EACT;gBACE,OAAO,EAAE;oBACP,OAAO,EAAE,kEAAkE,oBAAoB,cAAc,WAAW,CAAC,OAAO,EAAE;iBACnI;aACF,CACF,CAAC;QACJ,CAAC;QAED,+FAA+F;QAC/F,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,gCAAgC,EAAE,CAAC;QAC1F,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,oBAAoB,CAC9D,OAAO,CAAC,QAAQ,EAChB,OAAO,CAAC,WAAW,EACnB,WAAW,EACX,WAAW,CACZ,CAAC;QAEF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+DAA+D,EAAE;gBAChF,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,WAAW;gBACX,YAAY,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM;gBACrC,OAAO,EAAE,WAAW,CAAC,OAAO;aAC7B,CAAC,CAAC;YACH,OAAO,EAAE,aAAa,EAAE,CAAC;QAC3B,CAAC;QAED,qDAAqD;QACrD,MAAM,gBAAgB,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;QACvE,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yEAAyE,EAAE;gBAC1F,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;gBACnD,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,OAAO,EAAE,WAAW,CAAC,OAAO;aAC7B,CAAC,CAAC;YACH,OAAO,EAAE,aAAa,EAAE,CAAC;QAC3B,CAAC;QAED,2DAA2D;QAC3D,MAAM,KAAK,GAA+B;YACxC,aAAa;YACb,gBAAgB,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,WAAW,EAAE;SACzD,CAAC;QACF,QAAQ,MAAM,CAAC,qBAAqB,EAAE,CAAC;YACrC,KAAK,gBAAgB;gBACnB,KAAK,CAAC,cAAc,GAAG,gBAAgB,CAAC;gBACxC,MAAM;YACR,KAAK,QAAQ;gBACX,KAAK,CAAC,MAAM,GAAG,gBAAgB,CAAC;gBAChC,MAAM;YACR;gBACE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uEAAuE,EAAE;oBACxF,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;oBACnD,YAAY,EAAE,MAAM,CAAC,YAAY;oBACjC,OAAO,EAAE,WAAW,CAAC,OAAO;iBAC7B,CAAC,CAAC;gBACH,MAAM;QACV,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,4BAA4B,EAAE;YAC1C,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;YACnD,gBAAgB;SACjB,CAAC,CAAC;QAEH,OAAO,KAAK,CAAC;IACf,CAAC;IAED,+DAA+D;IAC/D,UAAU;IACV,+DAA+D;IAE/D,mEAAmE;IAC3D,kBAAkB,CAAC,OAAgB,EAAE,OAAe;QAC1D,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAU,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;gBAC7D,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,IAAK,GAA+B,EAAE,CAAC;oBAC9E,OAAQ,GAA+B,CAAC,GAAG,CAAC,CAAC;gBAC/C,CAAC;gBACD,OAAO,SAAS,CAAC;YACnB,CAAC,EAAE,OAAO,CAAC,CAAC;YACZ,OAAO,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACtF,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,+EAA+E;IACvE,KAAK,CAAC,oBAAoB,CAAC,WAAmB,EAAE,WAAmB;QACzE,MAAM,MAAM,GAAG,IAAI,CAAC,yBAAyB,CAAC,wBAAwB,CACpE,WAAW,EACX,sCAAsC,CAAC,kBAAkB,CACP,CAAC;QAErD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kEAAkE,WAAW,EAAE,CAAC,CAAC;YAClG,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,SAAS,CAAC;QAC/C,MAAM,SAAS,GAAG,SAAS;YACzB,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,iBAAiB,CAAC,WAAW,EAAE,sCAAsC,CAAC,kBAAkB,EAAE,SAAS,CAAC;YACrI,CAAC,CAAC,SAAS,CAAC;QACd,OAAO,MAAM,CAAC,eAAe,EAAE,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,aAAa,IAAI,SAAS,IAAI,EAAE,CAAC;IAC1F,CAAC;IAED,sDAAsD;IAC9C,iBAAiB,CAAC,YAAoB;QAC5C,QAAQ,YAAY,EAAE,CAAC;YACrB,KAAK,eAAe,CAAC,CAAC,OAAO,gBAAgB,CAAC;YAC9C,KAAK,WAAW,CAAC,CAAC,OAAO,QAAQ,CAAC;YAClC,OAAO,CAAC,CAAC,OAAO,gBAAgB,CAAC;QACnC,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,gBAAgB,CAAC,WAAmB,EAAE,WAAmB,EAAE,OAAe;QAC9E,MAAM,GAAG,GAAG,GAAG,sBAAsB,GAAG,WAAW,IAAI,WAAW,IAAI,OAAO,EAAE,CAAC;QAChF,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mCAAmC,GAAG,EAAE,CAAC,CAAC;IAC7D,CAAC;CACF,CAAA;AAthBY,4BAA4B;IADxC,UAAU,EAAE;IAYR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAA;IACvC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,qCAAqC,CAAC,CAAA;IAChE,WAAA,MAAM,CAAC,kBAAkB,CAAC,kCAAkC,CAAC,CAAA;IAC7D,WAAA,MAAM,CAAC,kBAAkB,CAAC,gCAAgC,CAAC,CAAA;IAC3D,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,wBAAwB,CAAC,CAAA;;GAlB3C,4BAA4B,CAshBxC","sourcesContent":["/*\n Webhook Handler Backend Service\n \n Generic pipeline that processes incoming webhook events through:\n * 1. Signature verification (via capability adapter)\n * 2. Event parsing (via capability adapter)\n * 3. Idempotency check (Redis)\n * 4. Declarative scope resolution (via Hook_EndpointScopeBinding config)\n * 5. WEBHOOK_CALLBACK ExecutionContext creation\n \n The pipeline is provider-agnostic. Provider-specific logic is injected via:\n * - WebhookCapabilityAdapter (verify + parse)\n * - Hook_EndpointScopeBinding configuration (declarative scope resolution)\n * - Hook_ScopeResolverStrategy (optional escape hatch)\n \n @see hook-protocol-webhook-callback.md\n /\n\nimport { injectable, inject } from 'inversify';\nimport {\n ExternalProvider_ExchangeProtocol_Kind,\n type Hook_Endpoint,\n type Hook_EndpointScopeBinding,\n type HookInitiatorProvider_Configuration,\n type StandardHook_ParsedEvent,\n type StandardHook_ResolvedScope,\n type WebhookCapabilityAdapter,\n type Hook_ScopeResolverStrategy,\n} from '@wildo-ai/external-connectors-models';\nimport { ErrorType, CoreResourceOperation, ErrorCustomMessageReference } from '@wildo-ai/saas-models';\n\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport type { RedisService } from '~wildo-backend-lib/databases/services/redis.service';\nimport type { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport type { ExecutionContextCreatorBackendService } from '~wildo-backend-lib/runtime/services/execution-context-creator.backend.service';\nimport type { RepositoriesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/repositories/repositories-registry-handler.backend.service';\nimport type { ExternalProvidersRegistryBackendService } from '~wildo-backend-lib/external-providers/services/external-providers-registry.backend.service';\nimport type { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport type { PolymorphicLookupBackendService } from './polymorphic-lookup.backend.service';\n\n// =====================================================\n// Constants\n// =====================================================\n\n/* Default idempotency TTL: 24 hours /\nconst DEFAULT_IDEMPOTENCY_TTL_SECONDS = 24 60 * 60;\nconst IDEMPOTENCY_KEY_PREFIX = 'webhook:';\n\n// =====================================================\n// Service\n// =====================================================\n\n@injectable()\nexport class WebhookHandlerBackendService {\n\n private readonly logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n /** Capability adapters keyed by \"providerRef:endpointKey\" /\n private adapters = new Map<string, WebhookCapabilityAdapter>();\n\n /* Custom scope resolvers (escape hatch), keyed by \"providerRef:endpointKey\" /\n private customResolvers = new Map<string, Hook_ScopeResolverStrategy>();\n\n constructor(\n @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n @inject(SAAS_SERVICE_TYPES.RedisService) private readonly redisService: RedisService,\n @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private readonly errorBuilder: ErrorBuilderBackendService,\n @inject(SAAS_SERVICE_TYPES.ExecutionContextCreatorBackendService) private readonly executionContextCreator: ExecutionContextCreatorBackendService,\n @inject(SAAS_SERVICE_TYPES.RepositoriesRegistryHandlerService) private readonly repositoriesRegistry: RepositoriesRegistryHandlerBackendService,\n @inject(SAAS_SERVICE_TYPES.ExternalProvidersRegistryService) private readonly externalProvidersRegistry: ExternalProvidersRegistryBackendService,\n @inject(SAAS_SERVICE_TYPES.AppConfigService) private readonly appConfigService: AppConfigurationService,\n @inject(SAAS_SERVICE_TYPES.PolymorphicLookupService) private readonly polymorphicLookup: PolymorphicLookupBackendService,\n ) {\n this.logDebug = this.logger.debugByType('WebhookHandler');\n this.logger.setDebugTypeLogging('WebhookHandler', false);\n }\n\n // ════════════════════════════════════════════════════════════\n // Registration\n // ════════════════════════════════════════════════════════════\n\n /\n Register a capability adapter for a specific provider endpoint.\n * Called at startup by capability modules (e.g., billing module).\n /\n registerAdapter(providerRef: string, endpointKey: string, adapter: WebhookCapabilityAdapter): void {\n const key = `${providerRef}:${endpointKey}`;\n this.adapters.set(key, adapter);\n this.logDebug(`Registered webhook adapter for ${key}`);\n }\n\n /\n Whether a capability adapter is registered for `providerRef:endpointKey`.\n \n Read-only mount-time predicate for {@link WebhookAutoControllerBackendService}:\n * without an adapter, `processWebhook` throws `INTERNAL` at the very top of the\n * pipeline (`No webhook adapter registered for ...`), which the controller answers\n * as a 500 — i.e. an instruction to the VENDOR to retry an event that can never be\n * processed, because nothing about a retry supplies the missing registration. The\n * auto-controller therefore asks this BEFORE mounting a route, and withholds the\n * route instead of mounting one that can only fail.\n \n Deliberately not exposing the adapter itself: the caller needs an admission\n * decision, not the verify/parse surface, and handing out the adapter would let a\n * consumer route around `processWebhook`'s signature/idempotency pipeline.\n /\n hasAdapter(providerRef: string, endpointKey: string): boolean {\n return this.adapters.has(`${providerRef}:${endpointKey}`);\n }\n\n /\n Register a custom scope resolver to override declarative scope resolution.\n * This is an escape hatch for complex cases where Hook_EndpointScopeBinding is insufficient.\n /\n registerCustomScopeResolver(resolver: Hook_ScopeResolverStrategy): void {\n const key = `${resolver.providerRef}:${resolver.endpointKey}`;\n this.customResolvers.set(key, resolver);\n this.logDebug(`Registered custom scope resolver for ${key}`);\n }\n\n // ════════════════════════════════════════════════════════════\n // Main Pipeline\n // ════════════════════════════════════════════════════════════\n\n /\n Process a raw webhook through the full pipeline.\n * Called by WebhookAutoControllerBackendService's auto-registered routes.\n \n Returns null if the event was already processed (idempotent) or unparseable (acknowledged).\n * Throws on signature failure, scope extraction failure, or handler errors.\n /\n async processWebhook(params: {\n providerRef: string;\n endpointKey: string;\n endpoint: Hook_Endpoint;\n rawBody: string \| Buffer;\n headers: Record<string, string>;\n }): Promise<{ executionContext: ExecutionContext<any>; parsedEvent: StandardHook_ParsedEvent; idempotencyKey?: string } \| null> {\n const { providerRef, endpointKey, endpoint, rawBody, headers } = params;\n const adapterKey = `${providerRef}:${endpointKey}`;\n const adapter = this.adapters.get(adapterKey);\n\n if (!adapter) {\n throw this.errorBuilder.buildError(\n ErrorType.INTERNAL,\n undefined,\n { context: { message: `No webhook adapter registered for ${adapterKey}` } }\n );\n }\n\n // 1. Resolve webhook secret from app configuration\n const secret = await this.resolveWebhookSecret(providerRef, endpointKey);\n\n // 2. Verify signature via capability adapter\n const signatureHeader = headers[endpoint.signatureConfig.headerName] ?? '';\n try {\n const isValid = await adapter.verifySignature(rawBody, signatureHeader, secret);\n if (!isValid) {\n throw this.errorBuilder.buildError(\n ErrorType.AUTHORIZATION,\n undefined,\n { customMessageReference: ErrorCustomMessageReference.WEBHOOK_SIGNATURE_INVALID }\n );\n }\n } catch (error) {\n if ((error as any)?.errorType === ErrorType.AUTHORIZATION) throw error;\n this.logger.error('Webhook signature verification error', { error: (error as Error).message, providerRef, endpointKey });\n throw this.errorBuilder.buildError(\n ErrorType.AUTHORIZATION,\n undefined,\n { customMessageReference: ErrorCustomMessageReference.WEBHOOK_SIGNATURE_INVALID }\n );\n }\n\n // 3. Parse event via capability adapter → StandardHook_ParsedEvent\n const parsedEvent = adapter.parseEvent(rawBody, headers);\n if (!parsedEvent) {\n // Unknown event type — acknowledge to stop retries\n this.logDebug('Unparseable/unknown webhook event — acknowledging', { providerRef, endpointKey });\n return null;\n }\n // Enrich with endpoint key\n parsedEvent.endpointKey = endpointKey;\n if (\n endpoint.eventTypes?.length\n && !endpoint.eventTypes.includes(parsedEvent.providerEventType)\n ) {\n this.logDebug('Webhook event type not declared on endpoint — acknowledging', {\n providerRef,\n endpointKey,\n eventType: parsedEvent.providerEventType,\n });\n return null;\n }\n\n // 4. Idempotency check (Redis). Completion is recorded by the controller\n // only after the capability handler succeeds, otherwise provider retries\n // would be acknowledged as duplicates after a failed processing attempt.\n let idempotencyKey: string \| undefined;\n let claimedIdempotency = false;\n try {\n idempotencyKey = `${IDEMPOTENCY_KEY_PREFIX}${providerRef}:${endpointKey}:${parsedEvent.eventId}`;\n const claimStatus = await this.claimWebhookIdempotency(idempotencyKey);\n if (claimStatus === 'completed') {\n this.logDebug('Duplicate webhook event — idempotent skip', { eventId: parsedEvent.eventId });\n return null;\n }\n if (claimStatus === 'in_progress') {\n throw this.errorBuilder.buildError(\n ErrorType.INTERNAL,\n undefined,\n { context: { message: `Webhook event is already being processed: ${parsedEvent.eventId}` } },\n );\n }\n claimedIdempotency = true;\n } catch (redisError) {\n if ((redisError as any)?.errorType === ErrorType.INTERNAL) throw redisError;\n this.logger.error('Redis unavailable for webhook idempotency check — failing closed', {\n error: (redisError as Error).message,\n });\n throw this.errorBuilder.buildError(\n ErrorType.INTERNAL,\n undefined,\n { context: { message: 'Redis unavailable for webhook idempotency check' } },\n );\n }\n\n let executionContext: ExecutionContext<any>;\n let resolvedScope: StandardHook_ResolvedScope;\n try {\n // 5. Resolve scope (declarative or custom)\n resolvedScope = await this.resolveScope(providerRef, endpointKey, endpoint, parsedEvent);\n\n // 6. Create WEBHOOK_CALLBACK ExecutionContext\n executionContext = await this.executionContextCreator.createForWebhookCallback(\n resolvedScope,\n parsedEvent,\n );\n } catch (error) {\n if (claimedIdempotency) {\n await this.releaseWebhookClaim(idempotencyKey);\n }\n throw error;\n }\n\n this.logger.info('Webhook event processed', {\n providerRef,\n endpointKey,\n eventId: parsedEvent.eventId,\n eventType: parsedEvent.eventType,\n resolvedScope: {\n organizationId: resolvedScope.organizationId,\n userId: resolvedScope.userId,\n },\n });\n\n return { executionContext, parsedEvent, idempotencyKey };\n }\n\n private async claimWebhookIdempotency(idempotencyKey: string): Promise<'claimed' \| 'in_progress' \| 'completed'> {\n const redisKey = this.redisService.buildKey(idempotencyKey);\n const result = await this.redisService.eval(\n `\n local existing = redis.call('GET', KEYS[1])\n if existing == false then\n redis.call('SET', KEYS[1], ARGV[1], 'EX', ARGV[2])\n return 'claimed'\n end\n return existing\n `,\n [redisKey],\n ['in_progress', String(5 60)],\n );\n\n if (result === '\"completed\"' \|\| result === 'completed') return 'completed';\n if (result === '\"in_progress\"' \|\| result === 'in_progress') return 'in_progress';\n return 'claimed';\n }\n\n async markWebhookProcessed(idempotencyKey: string \| undefined): Promise<void> {\n if (!idempotencyKey) return;\n try {\n await this.redisService.eval(\n \"redis.call('SET', KEYS[1], ARGV[1], 'EX', ARGV[2]); return ARGV[1]\",\n [this.redisService.buildKey(idempotencyKey)],\n ['completed', String(DEFAULT_IDEMPOTENCY_TTL_SECONDS)],\n );\n } catch (redisError) {\n this.logger.error('Redis unavailable for webhook idempotency completion', {\n error: (redisError as Error).message,\n });\n throw this.errorBuilder.buildError(\n ErrorType.INTERNAL,\n undefined,\n { context: { message: 'Redis unavailable for webhook idempotency completion' } },\n );\n }\n }\n\n async releaseWebhookClaim(idempotencyKey: string \| undefined): Promise<void> {\n if (!idempotencyKey) return;\n try {\n await this.redisService.del(this.redisService.buildKey(idempotencyKey));\n } catch (redisError) {\n this.logger.error('Redis unavailable for webhook idempotency release', {\n error: (redisError as Error).message,\n });\n }\n }\n\n // ════════════════════════════════════════════════════════════\n // Declarative Scope Resolution\n // ════════════════════════════════════════════════════════════\n\n /*\n Resolve the engine scope from a webhook event.\n \n Priority:\n * 1. Custom resolver (escape hatch) if registered for this endpoint\n * 2. Declarative resolution via Hook_EndpointScopeBinding config\n /\n private async resolveScope(\n providerRef: string,\n endpointKey: string,\n endpoint: Hook_Endpoint,\n parsedEvent: StandardHook_ParsedEvent\n ): Promise<StandardHook_ResolvedScope> {\n // Check custom resolver first (escape hatch)\n const customResolver = this.customResolvers.get(`${providerRef}:${endpointKey}`);\n if (customResolver) {\n return customResolver.resolveScope(parsedEvent);\n }\n\n const applicationId = this.appConfigService.applicationId;\n const binding = endpoint.scopeBinding;\n\n // APPLICATION scope — no lookup needed\n if ('primaryScope' in binding && binding.primaryScope === 'APPLICATION') {\n return { applicationId };\n }\n\n // Check scope-exempt events (e.g., product.updated → APPLICATION scope)\n if ('scopeExemptEventTypes' in binding && binding.scopeExemptEventTypes?.includes(parsedEvent.providerEventType)) {\n this.logDebug('Scope-exempt event type — using APPLICATION scope', {\n eventType: parsedEvent.providerEventType,\n });\n return { applicationId };\n }\n\n // ─── Polymorphic mode ───\n // Queries N variant collections and resolves scope from whichever variant matches.\n if ('mode' in binding && binding.mode === 'polymorphic') {\n return this.resolvePolymorphicScope(binding, parsedEvent, applicationId);\n }\n\n // ─── Single-scope mode ───\n // After APPLICATION and polymorphic early returns, narrow to single-scope binding.\n const singleBinding = binding as Extract<Hook_EndpointScopeBinding, { lookupResourceType: string }>;\n\n // Extract scope ID from payload using configured dot-path\n const scopeId = this.extractFromPayload(parsedEvent.rawPayload, singleBinding.payloadScopeIdPath);\n if (!scopeId) {\n throw this.errorBuilder.buildError(\n ErrorType.INTERNAL,\n undefined,\n {\n context: {\n message: `Webhook scope resolution failed: no value at path '${singleBinding.payloadScopeIdPath}' in event ${parsedEvent.eventId}`,\n },\n }\n );\n }\n\n // Lookup resource to find the scope entity ID.\n const internalCtx = await this.executionContextCreator.createForInternalSystemOperation();\n const repository = this.repositoriesRegistry.getRepository(singleBinding.lookupResourceType);\n if (!repository) {\n this.logger.warn('Webhook scope resolution: repository not found', {\n lookupResourceType: singleBinding.lookupResourceType,\n eventId: parsedEvent.eventId,\n });\n return { applicationId };\n }\n\n let resource: any;\n try {\n const results = await repository.doByPath(\n { resourceIdentifier: singleBinding.lookupResourceType, operationIdentifier: CoreResourceOperation.LIST },\n internalCtx,\n { [singleBinding.lookupField]: scopeId },\n );\n resource = Array.isArray(results) ? results[0] : results;\n } catch (lookupError) {\n this.logger.warn('Webhook scope resolution: lookup failed', {\n lookupResourceType: singleBinding.lookupResourceType,\n lookupField: singleBinding.lookupField,\n scopeId,\n eventId: parsedEvent.eventId,\n error: (lookupError as Error).message,\n });\n return { applicationId };\n }\n\n if (!resource) {\n this.logger.warn('Webhook scope resolution: resource not found', {\n lookupResourceType: singleBinding.lookupResourceType,\n lookupField: singleBinding.lookupField,\n scopeId,\n eventId: parsedEvent.eventId,\n });\n return { applicationId };\n }\n\n // Extract scope entity ID\n const scopeEntityIdField = singleBinding.scopeEntityIdField ?? this.defaultScopeField(singleBinding.primaryScope);\n const resolvedEntityId = resource[scopeEntityIdField];\n\n if (!resolvedEntityId) {\n this.logger.warn('Webhook scope resolution: entity ID field empty on resource', {\n scopeEntityIdField,\n lookupResourceType: singleBinding.lookupResourceType,\n eventId: parsedEvent.eventId,\n });\n return { applicationId };\n }\n\n // Map to engine scope\n const scope: StandardHook_ResolvedScope = {\n applicationId,\n providerScopeIds: { [singleBinding.lookupField]: scopeId },\n };\n switch (singleBinding.primaryScope) {\n case 'ORGANIZATIONS':\n scope.organizationId = resolvedEntityId;\n break;\n case 'USER_SELF':\n scope.userId = resolvedEntityId;\n break;\n }\n\n return scope;\n }\n\n /\n Resolve scope using polymorphic lookup — queries N variant collections.\n * Delegates to PolymorphicLookupBackendService for the multi-collection query,\n * then maps the result to the engine scope.\n /\n private async resolvePolymorphicScope(\n binding: Extract<Hook_EndpointScopeBinding, { mode: 'polymorphic' }>,\n parsedEvent: StandardHook_ParsedEvent,\n applicationId: string,\n ): Promise<StandardHook_ResolvedScope> {\n // Resolve the payload path — check per-event-type override first, then fall back to default\n const effectiveScopeIdPath = binding.eventTypeOverrides?.[parsedEvent.providerEventType]?.payloadScopeIdPath\n ?? binding.payloadScopeIdPath;\n\n // Extract lookup value from payload\n const lookupValue = this.extractFromPayload(parsedEvent.rawPayload, effectiveScopeIdPath);\n if (!lookupValue) {\n throw this.errorBuilder.buildError(\n ErrorType.INTERNAL,\n undefined,\n {\n context: {\n message: `Webhook polymorphic scope resolution failed: no value at path '${effectiveScopeIdPath}' in event ${parsedEvent.eventId}`,\n },\n }\n );\n }\n\n // Query across all variant collections (pass the internal context to avoid redundant creation)\n const internalCtx = await this.executionContextCreator.createForInternalSystemOperation();\n const result = await this.polymorphicLookup.lookupAcrossVariants(\n binding.variants,\n binding.lookupField,\n lookupValue,\n internalCtx,\n );\n\n if (!result) {\n this.logger.warn('Webhook polymorphic scope resolution: no match in any variant', {\n lookupField: binding.lookupField,\n lookupValue,\n variantCount: binding.variants.length,\n eventId: parsedEvent.eventId,\n });\n return { applicationId };\n }\n\n // Read the scope entity ID from the matched document\n const resolvedEntityId = result.document[result.parentFieldIdentifier];\n if (!resolvedEntityId) {\n this.logger.warn('Webhook polymorphic scope resolution: entity ID field empty on document', {\n parentFieldIdentifier: result.parentFieldIdentifier,\n resourceType: result.resourceType,\n eventId: parsedEvent.eventId,\n });\n return { applicationId };\n }\n\n // Map to engine scope based on the parent field identifier\n const scope: StandardHook_ResolvedScope = {\n applicationId,\n providerScopeIds: { [binding.lookupField]: lookupValue },\n };\n switch (result.parentFieldIdentifier) {\n case 'organizationId':\n scope.organizationId = resolvedEntityId;\n break;\n case 'userId':\n scope.userId = resolvedEntityId;\n break;\n default:\n this.logger.warn('Webhook polymorphic scope resolution: unknown parent field identifier', {\n parentFieldIdentifier: result.parentFieldIdentifier,\n resourceType: result.resourceType,\n eventId: parsedEvent.eventId,\n });\n break;\n }\n\n this.logDebug('Polymorphic scope resolved', {\n resourceType: result.resourceType,\n parentFieldIdentifier: result.parentFieldIdentifier,\n resolvedEntityId,\n });\n\n return scope;\n }\n\n // ════════════════════════════════════════════════════════════\n // Helpers\n // ════════════════════════════════════════════════════════════\n\n /* Extract a value from a nested object using dot-notation path /\n private extractFromPayload(payload: unknown, dotPath: string): string \| null {\n try {\n const result = dotPath.split('.').reduce<unknown>((obj, key) => {\n if (obj && typeof obj === 'object' && key in (obj as Record<string, unknown>)) {\n return (obj as Record<string, unknown>)[key];\n }\n return undefined;\n }, payload);\n return typeof result === 'string' ? result : result != null ? String(result) : null;\n } catch {\n return null;\n }\n }\n\n /* Resolve webhook secret from app configuration (per-endpoint or fallback) /\n private async resolveWebhookSecret(providerRef: string, endpointKey: string): Promise<string> {\n const config = this.externalProvidersRegistry.getProviderConfiguration(\n providerRef,\n ExternalProvider_ExchangeProtocol_Kind.WEBHOOK_ORIGINATOR,\n ) as HookInitiatorProvider_Configuration \| undefined;\n\n if (!config) {\n this.logger.warn(`No WEBHOOK_ORIGINATOR runtime configuration found for provider ${providerRef}`);\n return '';\n }\n\n const secretRef = config.authConfig?.secretRef;\n const envSecret = secretRef\n ? this.externalProvidersRegistry.getProviderSecret(providerRef, ExternalProvider_ExchangeProtocol_Kind.WEBHOOK_ORIGINATOR, secretRef)\n : undefined;\n return config.endpointSecrets?.[endpointKey] ?? config.webhookSecret ?? envSecret ?? '';\n }\n\n /* Default scope field name based on primary scope /\n private defaultScopeField(primaryScope: string): string {\n switch (primaryScope) {\n case 'ORGANIZATIONS': return 'organizationId';\n case 'USER_SELF': return 'userId';\n default: return 'organizationId';\n }\n }\n\n /\n Admin method: clear idempotency for forced reprocessing.\n * Use during debugging or when an event needs to be reprocessed.\n */\n async clearIdempotency(providerRef: string, endpointKey: string, eventId: string): Promise<void> {\n const key = `${IDEMPOTENCY_KEY_PREFIX}${providerRef}:${endpointKey}:${eventId}`;\n await this.redisService.del(this.redisService.buildKey(key));\n this.logger.info(`Cleared webhook idempotency for ${key}`);\n }\n}\n"]}

package/dist/esm/organizations/batches/organization-purge.batch.backend.service.d.ts CHANGED Viewed

@@ -2,8 +2,8 @@
  * Organization Purge Batch — the DESTRUCTIVE half of tenant teardown (WS-A).
  *
  * Tenant deletion is two phases. `request_deletion` marks a tenant: it writes `status: DELETED`,
- * `deletedAt` and `purgeScheduledAt`, reconciles every affected user's global `userTypes` and
- * invalidates their tokens — so the tenant is authorization-dead immediately while every row it
+ * `deletionRequestedAt` and `purgeScheduledAt`, reconciles every affected user's global `userTypes`
+ * and invalidates their tokens — so the tenant is authorization-dead immediately while every row it
  * owns is still present and restorable. This batch is the second phase: once a tenant's
  * `purgeScheduledAt` deadline has passed, it destroys it.
  *

package/dist/esm/organizations/batches/organization-purge.batch.backend.service.js CHANGED Viewed

@@ -2,8 +2,8 @@
  * Organization Purge Batch — the DESTRUCTIVE half of tenant teardown (WS-A).
  *
  * Tenant deletion is two phases. `request_deletion` marks a tenant: it writes `status: DELETED`,
- * `deletedAt` and `purgeScheduledAt`, reconciles every affected user's global `userTypes` and
- * invalidates their tokens — so the tenant is authorization-dead immediately while every row it
+ * `deletionRequestedAt` and `purgeScheduledAt`, reconciles every affected user's global `userTypes`
+ * and invalidates their tokens — so the tenant is authorization-dead immediately while every row it
  * owns is still present and restorable. This batch is the second phase: once a tenant's
  * `purgeScheduledAt` deadline has passed, it destroys it.
  *

package/dist/esm/organizations/batches/organization-purge.batch.backend.service.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"organization-purge.batch.backend.service.js","sourceRoot":"","sources":["../../../../../src/organizations/batches/organization-purge.batch.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,EAAE,iCAAiC,EAAE,MAAM,4FAA4F,CAAC;AAC/I,OAAO,EACL,wCAAwC,EACxC,+BAA+B,GAChC,MAAM,gFAAgF,CAAC;AACxF,OAAO,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAC3H,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,+BAA+B,GAGhC,MAAM,uBAAuB,CAAC;AAE/B;;;GAGG;AACH,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,oEAAoE;IACpE,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpD;;;;;;;OAOG;IACH,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAEH,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,qEAAqE;IACrE,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,sCAAsC;IACtC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,+EAA+E;IAC/E,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACpC,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,UAAU,4BAA4B,CAC1C,oBAA2C;IAE3C,OAAO,iCAAiC,CAAC;QACvC,KAAK,EAAE,4BAA4B;QACnC,MAAM,EAAE,6BAA6B;QACrC,oBAAoB,EAAE;YACpB,IAAI,EAAE,wCAAwC,CAAC,IAAI;YACnD,kBAAkB,EAAE,wCAAwC,CAAC,kBAAkB;YAC/E,mBAAmB,EAAE,wCAAwC,CAAC,mBAAmB;YACjF,iBAAiB,EAAE,oBAAoB,EAAE,iBAAiB,IAAI,+BAA+B;SAC9F;QACD,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,EAAE,gBAAgB,EAAE,EAAE,EAAE;YAC9F,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC7B,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;YACpC,MAAM,gBAAgB,GAAG,KAAK,CAAC,gBAAgB;mBAC1C,oBAAoB,EAAE,cAAc;mBACpC,+BAA+B,CAAC,cAAc,CAAC;YAEpD,MAAM,uBAAuB,GAAG,oBAAoB,CAAC,aAAa,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;YAEnG,+FAA+F;YAC/F,6FAA6F;YAC7F,wFAAwF;YACxF,6CAA6C;YAC7C,MAAM,gBAAgB,GAAG,MAAM,uBAAuB,CAAC,IAAI,CAAe,gBAAgB,EAAE;gBAC1F,MAAM,EAAE,kBAAkB,CAAC,OAAO;gBAClC,gBAAgB,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE;aAC9C,CAAmB,CAAC;YAErB,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;YAC9D,IAAI,gBAAgB,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC;gBAC/C,sFAAsF;gBACtF,0CAA0C;gBAC1C,MAAM,CAAC,IAAI,CAAC,6FAA6F,EAAE;oBACzG,GAAG,EAAE,gBAAgB,CAAC,MAAM;oBAC5B,UAAU,EAAE,SAAS,CAAC,MAAM;oBAC5B,gBAAgB;iBACjB,CAAC,CAAC;YACL,CAAC;YAED,IAAI,MAAM,GAAG,CAAC,CAAC;YACf,IAAI,MAAM,GAAG,CAAC,CAAC;YAEf,KAAK,MAAM,YAAY,IAAI,SAAS,EAAE,CAAC;gBACrC,IAAI,CAAC,YAAY,EAAE,GAAG;oBAAE,SAAS;gBACjC,IAAI,CAAC;oBACH,uFAAuF;oBACvF,wFAAwF;oBACxF,2EAA2E;oBAC3E,MAAM,gBAAgB,CAAC,MAAM,CAC3B,gBAAgB,CAAC,aAAa,EAC9B,gBAAgB,EAChB,YAAY,CAAC,GAAG,CACjB,CAAC;oBACF,MAAM,EAAE,CAAC;gBACX,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,EAAE,CAAC;oBACT,mFAAmF;oBACnF,0FAA0F;oBAC1F,qFAAqF;oBACrF,4BAA4B;oBAC5B,MAAM,CAAC,KAAK,CAAC,oEAAoE,EAAE;wBACjF,cAAc,EAAE,YAAY,CAAC,GAAG;wBAChC,gBAAgB,EAAE,YAAY,CAAC,gBAAgB;wBAC/C,GAAG,2BAA2B,CAAC,KAAK,CAAC;qBACtC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YAC1C,MAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE;gBAChD,gBAAgB,EAAE,SAAS,CAAC,MAAM;gBAClC,MAAM;gBACN,MAAM;gBACN,UAAU;aACX,CAAC,CAAC;YAEH,OAAO;gBACL,gBAAgB,EAAE,SAAS,CAAC,MAAM;gBAClC,MAAM;gBACN,MAAM;gBACN,UAAU;aACX,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;AACL,CAAC","sourcesContent":["/*\n Organization Purge Batch — the DESTRUCTIVE half of tenant teardown (WS-A).\n \n Tenant deletion is two phases. `request_deletion` marks a tenant: it writes `status: DELETED`,\n * `deletedAt` and `purgeScheduledAt`, reconciles every affected user's global `userTypes` and\n * invalidates their tokens — so the tenant is authorization-dead immediately while every row it\n * owns is still present and restorable. This batch is the second phase: once a tenant's\n * `purgeScheduledAt` deadline has passed, it destroys it.\n \n ## Why this batch owns NO teardown logic\n \n It dispatches each due tenant through the ordinary `ORGANIZATIONS \| DELETE` core operation and\n * lets the existing `onParentDelete` cascade do the work. That is the single most important\n * property of this file, and the thing not to \"optimize\" later:\n \n `dispatchLifecycleCascadeForRelationship` is the ONE dispatcher for every teardown edge, and it\n * already switches on `ChildLifecycleStrategy` — `DELETE` versus `IMPERSONALIZE_AND_RETAIN` — and\n * already skips edges whose author declared `onParentDelete.enabled: false` (which is how the\n * retained billing rows are expressed). A purge that deleted rows itself, however carefully, would\n * bypass that dispatch and hard-delete children a retention or compliance decision had explicitly\n * marked to keep, while reporting success. The composition with the retention/impersonalization\n * capability is therefore FREE here precisely because nothing is re-implemented.\n \n It also means the `ORGANIZATION_DELETED` audit event still emits from its existing POSTFIX hook\n * on the DELETE operation, so the GDPR Art. 17 evidence obligation needs no separate mechanism.\n \n ## Why per-tenant isolation rather than one transaction\n \n Each tenant is its own attempt inside its own try/catch. A cascade that spans mixed persistence\n * adapters throws `CONFIGURATION` by design (`buildRepositoryOptionsForResource` fails closed\n * rather than degrading to a non-atomic teardown), and a single tenant can fail for its own\n * reasons. Isolating attempts means one undeletable tenant is logged and skipped instead of\n * wedging the queue for every other tenant whose deadline has also passed — which is exactly the\n * lockout the fail-closed adapter guard would otherwise create for a whole application.\n \n Mirrors the failure posture of `files-cleanup`, the engine's existing soft-delete + purge batch.\n \n assurance-control: WILDO.DATA.SECURE_LIFECYCLE — scheduled destruction of data at the end of a\n * declared retention period, with evidence emitted per tenant destroyed.\n /\n\nimport { createCustomBatchExecutionService } from '~wildo-backend-lib/base-classes/services/batches/batches-cronjobs-custom-execution.service';\nimport {\n ENGINE_ORGANIZATION_PURGE_BATCH_MANIFEST,\n ORGANIZATION_PURGE_DEFAULT_CRON,\n} from '~wildo-backend-lib/base-classes/services/batches/engine-custom-batch-manifests';\nimport { projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { z } from 'zod';\nimport {\n CoreResourceType,\n OrganizationStatus,\n TENANT_TEARDOWN_CONFIG_DEFAULTS,\n type Organization,\n type TenantTeardownConfig,\n} from '@wildo-ai/saas-models';\n\n/\n Scheduled runs send no input. The overrides exist for tests and for an operator who needs to\n * drain a backlog in one pass, and both are bounded by the same code path as the scheduled run.\n /\nconst OrganizationPurgeInputSchema = z.object({\n /* Overrides `TenantTeardownConfig.purgeBatchSize` for this run. /\n maxOrganizations: z.number().int().min(1).optional(),\n /\n Treat this instant as \"now\" when comparing against `purgeScheduledAt`.\n \n Test-only in practice. It can only ever be used to purge tenants whose deadline has ALREADY\n * passed relative to the supplied instant — it does not bypass the window for a tenant that is\n * still inside one, because the predicate is still a comparison against the deadline the mark\n * pinned.\n /\n now: z.coerce.date().optional(),\n});\n\nconst OrganizationPurgeOutputSchema = z.object({\n /* Tenants whose deadline had passed and that this run attempted. /\n dueOrganizations: z.number().int().min(0),\n /* Tenants destroyed successfully. /\n purged: z.number().int().min(0),\n /* Tenants that failed their own attempt and remain marked for a later run. /\n failed: z.number().int().min(0),\n durationMs: z.number().int().min(0),\n});\n\n/\n Organization purge batch factory.\n \n @param tenantTeardownConfig operator configuration, when the application declares it. Every field\n * has a default, so an application that declares nothing still purges on a working 30-day window —\n * the alternative (no schedule) would accumulate marked-but-never-destroyed tenants, which is the\n * failure a retention window exists to prevent.\n */\nexport function createOrganizationPurgeBatch(\n tenantTeardownConfig?: TenantTeardownConfig,\n): ReturnType<typeof createCustomBatchExecutionService> {\n return createCustomBatchExecutionService({\n input: OrganizationPurgeInputSchema,\n output: OrganizationPurgeOutputSchema,\n batchCronjob_Context: {\n kind: ENGINE_ORGANIZATION_PURGE_BATCH_MANIFEST.kind,\n resourceIdentifier: ENGINE_ORGANIZATION_PURGE_BATCH_MANIFEST.resourceIdentifier,\n operationIdentifier: ENGINE_ORGANIZATION_PURGE_BATCH_MANIFEST.operationIdentifier,\n cronJobExpression: tenantTeardownConfig?.purgeCronSchedule ?? ORGANIZATION_PURGE_DEFAULT_CRON,\n },\n doHandle: async (input, { servicesRegistry, repositoriesRegistry, logger, executionContext }) => {\n const startTime = Date.now();\n const now = input.now ?? new Date();\n const maxOrganizations = input.maxOrganizations\n ?? tenantTeardownConfig?.purgeBatchSize\n ?? TENANT_TEARDOWN_CONFIG_DEFAULTS.purgeBatchSize;\n\n const organizationsRepository = repositoriesRegistry.getRepository(CoreResourceType.ORGANIZATIONS);\n\n // `status: DELETED` is the hard gate and is deliberately not merely a hint. `purgeScheduledAt`\n // is cleared on restore, and a comparison against a cleared/absent value must never select a\n // row — pairing the deadline with the status means a restored tenant is excluded by the\n // status alone, whatever its timestamps say.\n const dueOrganizations = await organizationsRepository.list<Organization>(executionContext, {\n status: OrganizationStatus.DELETED,\n purgeScheduledAt: { $lt: now, $exists: true },\n }) as Organization[];\n\n const attempted = dueOrganizations.slice(0, maxOrganizations);\n if (dueOrganizations.length > attempted.length) {\n // Never silently truncate: an operator reading \"purged 50\" with no other signal would\n // reasonably conclude the queue is empty.\n logger.info('Organization purge run bounded by batch size — remaining tenants are purged by the next run', {\n due: dueOrganizations.length,\n attempting: attempted.length,\n maxOrganizations,\n });\n }\n\n let purged = 0;\n let failed = 0;\n\n for (const organization of attempted) {\n if (!organization?._id) continue;\n try {\n // The ordinary DELETE. Resolves to the route-less INTERNAL_CALL default variant, whose\n // POSTFIX emits `ORGANIZATION_DELETED` — the evidence of what was destroyed — and whose\n // core persistence runs the `onParentDelete` cascade for every child edge.\n await servicesRegistry.delete(\n CoreResourceType.ORGANIZATIONS,\n executionContext,\n organization._id,\n );\n purged++;\n } catch (error) {\n failed++;\n // ERROR, not WARN: a tenant whose retention window has expired and which cannot be\n // destroyed is a standing compliance exposure, not routine noise. It stays marked, so the\n // next run retries it — but a permanently failing tenant must be visible rather than\n // retried silently forever.\n logger.error('Failed to purge an organization whose retention window has elapsed', {\n organizationId: organization._id,\n purgeScheduledAt: organization.purgeScheduledAt,\n ...projectCaughtErrorLogFields(error),\n });\n }\n }\n\n const durationMs = Date.now() - startTime;\n logger.info('Organization purge batch completed', {\n dueOrganizations: attempted.length,\n purged,\n failed,\n durationMs,\n });\n\n return {\n dueOrganizations: attempted.length,\n purged,\n failed,\n durationMs,\n };\n },\n });\n}\n"]}
1	+ {"version":3,"file":"organization-purge.batch.backend.service.js","sourceRoot":"","sources":["../../../../../src/organizations/batches/organization-purge.batch.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,EAAE,iCAAiC,EAAE,MAAM,4FAA4F,CAAC;AAC/I,OAAO,EACL,wCAAwC,EACxC,+BAA+B,GAChC,MAAM,gFAAgF,CAAC;AACxF,OAAO,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAC3H,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,+BAA+B,GAGhC,MAAM,uBAAuB,CAAC;AAE/B;;;GAGG;AACH,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,oEAAoE;IACpE,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpD;;;;;;;OAOG;IACH,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAEH,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,qEAAqE;IACrE,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,sCAAsC;IACtC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,+EAA+E;IAC/E,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACpC,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,UAAU,4BAA4B,CAC1C,oBAA2C;IAE3C,OAAO,iCAAiC,CAAC;QACvC,KAAK,EAAE,4BAA4B;QACnC,MAAM,EAAE,6BAA6B;QACrC,oBAAoB,EAAE;YACpB,IAAI,EAAE,wCAAwC,CAAC,IAAI;YACnD,kBAAkB,EAAE,wCAAwC,CAAC,kBAAkB;YAC/E,mBAAmB,EAAE,wCAAwC,CAAC,mBAAmB;YACjF,iBAAiB,EAAE,oBAAoB,EAAE,iBAAiB,IAAI,+BAA+B;SAC9F;QACD,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,EAAE,gBAAgB,EAAE,EAAE,EAAE;YAC9F,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC7B,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;YACpC,MAAM,gBAAgB,GAAG,KAAK,CAAC,gBAAgB;mBAC1C,oBAAoB,EAAE,cAAc;mBACpC,+BAA+B,CAAC,cAAc,CAAC;YAEpD,MAAM,uBAAuB,GAAG,oBAAoB,CAAC,aAAa,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;YAEnG,+FAA+F;YAC/F,6FAA6F;YAC7F,wFAAwF;YACxF,6CAA6C;YAC7C,MAAM,gBAAgB,GAAG,MAAM,uBAAuB,CAAC,IAAI,CAAe,gBAAgB,EAAE;gBAC1F,MAAM,EAAE,kBAAkB,CAAC,OAAO;gBAClC,gBAAgB,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE;aAC9C,CAAmB,CAAC;YAErB,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;YAC9D,IAAI,gBAAgB,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC;gBAC/C,sFAAsF;gBACtF,0CAA0C;gBAC1C,MAAM,CAAC,IAAI,CAAC,6FAA6F,EAAE;oBACzG,GAAG,EAAE,gBAAgB,CAAC,MAAM;oBAC5B,UAAU,EAAE,SAAS,CAAC,MAAM;oBAC5B,gBAAgB;iBACjB,CAAC,CAAC;YACL,CAAC;YAED,IAAI,MAAM,GAAG,CAAC,CAAC;YACf,IAAI,MAAM,GAAG,CAAC,CAAC;YAEf,KAAK,MAAM,YAAY,IAAI,SAAS,EAAE,CAAC;gBACrC,IAAI,CAAC,YAAY,EAAE,GAAG;oBAAE,SAAS;gBACjC,IAAI,CAAC;oBACH,uFAAuF;oBACvF,wFAAwF;oBACxF,2EAA2E;oBAC3E,MAAM,gBAAgB,CAAC,MAAM,CAC3B,gBAAgB,CAAC,aAAa,EAC9B,gBAAgB,EAChB,YAAY,CAAC,GAAG,CACjB,CAAC;oBACF,MAAM,EAAE,CAAC;gBACX,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,EAAE,CAAC;oBACT,mFAAmF;oBACnF,0FAA0F;oBAC1F,qFAAqF;oBACrF,4BAA4B;oBAC5B,MAAM,CAAC,KAAK,CAAC,oEAAoE,EAAE;wBACjF,cAAc,EAAE,YAAY,CAAC,GAAG;wBAChC,gBAAgB,EAAE,YAAY,CAAC,gBAAgB;wBAC/C,GAAG,2BAA2B,CAAC,KAAK,CAAC;qBACtC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YAC1C,MAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE;gBAChD,gBAAgB,EAAE,SAAS,CAAC,MAAM;gBAClC,MAAM;gBACN,MAAM;gBACN,UAAU;aACX,CAAC,CAAC;YAEH,OAAO;gBACL,gBAAgB,EAAE,SAAS,CAAC,MAAM;gBAClC,MAAM;gBACN,MAAM;gBACN,UAAU;aACX,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;AACL,CAAC","sourcesContent":["/*\n Organization Purge Batch — the DESTRUCTIVE half of tenant teardown (WS-A).\n \n Tenant deletion is two phases. `request_deletion` marks a tenant: it writes `status: DELETED`,\n * `deletionRequestedAt` and `purgeScheduledAt`, reconciles every affected user's global `userTypes`\n * and invalidates their tokens — so the tenant is authorization-dead immediately while every row it\n * owns is still present and restorable. This batch is the second phase: once a tenant's\n * `purgeScheduledAt` deadline has passed, it destroys it.\n \n ## Why this batch owns NO teardown logic\n \n It dispatches each due tenant through the ordinary `ORGANIZATIONS \| DELETE` core operation and\n * lets the existing `onParentDelete` cascade do the work. That is the single most important\n * property of this file, and the thing not to \"optimize\" later:\n \n `dispatchLifecycleCascadeForRelationship` is the ONE dispatcher for every teardown edge, and it\n * already switches on `ChildLifecycleStrategy` — `DELETE` versus `IMPERSONALIZE_AND_RETAIN` — and\n * already skips edges whose author declared `onParentDelete.enabled: false` (which is how the\n * retained billing rows are expressed). A purge that deleted rows itself, however carefully, would\n * bypass that dispatch and hard-delete children a retention or compliance decision had explicitly\n * marked to keep, while reporting success. The composition with the retention/impersonalization\n * capability is therefore FREE here precisely because nothing is re-implemented.\n \n It also means the `ORGANIZATION_DELETED` audit event still emits from its existing POSTFIX hook\n * on the DELETE operation, so the GDPR Art. 17 evidence obligation needs no separate mechanism.\n \n ## Why per-tenant isolation rather than one transaction\n \n Each tenant is its own attempt inside its own try/catch. A cascade that spans mixed persistence\n * adapters throws `CONFIGURATION` by design (`buildRepositoryOptionsForResource` fails closed\n * rather than degrading to a non-atomic teardown), and a single tenant can fail for its own\n * reasons. Isolating attempts means one undeletable tenant is logged and skipped instead of\n * wedging the queue for every other tenant whose deadline has also passed — which is exactly the\n * lockout the fail-closed adapter guard would otherwise create for a whole application.\n \n Mirrors the failure posture of `files-cleanup`, the engine's existing soft-delete + purge batch.\n \n assurance-control: WILDO.DATA.SECURE_LIFECYCLE — scheduled destruction of data at the end of a\n * declared retention period, with evidence emitted per tenant destroyed.\n /\n\nimport { createCustomBatchExecutionService } from '~wildo-backend-lib/base-classes/services/batches/batches-cronjobs-custom-execution.service';\nimport {\n ENGINE_ORGANIZATION_PURGE_BATCH_MANIFEST,\n ORGANIZATION_PURGE_DEFAULT_CRON,\n} from '~wildo-backend-lib/base-classes/services/batches/engine-custom-batch-manifests';\nimport { projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { z } from 'zod';\nimport {\n CoreResourceType,\n OrganizationStatus,\n TENANT_TEARDOWN_CONFIG_DEFAULTS,\n type Organization,\n type TenantTeardownConfig,\n} from '@wildo-ai/saas-models';\n\n/\n Scheduled runs send no input. The overrides exist for tests and for an operator who needs to\n * drain a backlog in one pass, and both are bounded by the same code path as the scheduled run.\n /\nconst OrganizationPurgeInputSchema = z.object({\n /* Overrides `TenantTeardownConfig.purgeBatchSize` for this run. /\n maxOrganizations: z.number().int().min(1).optional(),\n /\n Treat this instant as \"now\" when comparing against `purgeScheduledAt`.\n \n Test-only in practice. It can only ever be used to purge tenants whose deadline has ALREADY\n * passed relative to the supplied instant — it does not bypass the window for a tenant that is\n * still inside one, because the predicate is still a comparison against the deadline the mark\n * pinned.\n /\n now: z.coerce.date().optional(),\n});\n\nconst OrganizationPurgeOutputSchema = z.object({\n /* Tenants whose deadline had passed and that this run attempted. /\n dueOrganizations: z.number().int().min(0),\n /* Tenants destroyed successfully. /\n purged: z.number().int().min(0),\n /* Tenants that failed their own attempt and remain marked for a later run. /\n failed: z.number().int().min(0),\n durationMs: z.number().int().min(0),\n});\n\n/\n Organization purge batch factory.\n \n @param tenantTeardownConfig operator configuration, when the application declares it. Every field\n * has a default, so an application that declares nothing still purges on a working 30-day window —\n * the alternative (no schedule) would accumulate marked-but-never-destroyed tenants, which is the\n * failure a retention window exists to prevent.\n */\nexport function createOrganizationPurgeBatch(\n tenantTeardownConfig?: TenantTeardownConfig,\n): ReturnType<typeof createCustomBatchExecutionService> {\n return createCustomBatchExecutionService({\n input: OrganizationPurgeInputSchema,\n output: OrganizationPurgeOutputSchema,\n batchCronjob_Context: {\n kind: ENGINE_ORGANIZATION_PURGE_BATCH_MANIFEST.kind,\n resourceIdentifier: ENGINE_ORGANIZATION_PURGE_BATCH_MANIFEST.resourceIdentifier,\n operationIdentifier: ENGINE_ORGANIZATION_PURGE_BATCH_MANIFEST.operationIdentifier,\n cronJobExpression: tenantTeardownConfig?.purgeCronSchedule ?? ORGANIZATION_PURGE_DEFAULT_CRON,\n },\n doHandle: async (input, { servicesRegistry, repositoriesRegistry, logger, executionContext }) => {\n const startTime = Date.now();\n const now = input.now ?? new Date();\n const maxOrganizations = input.maxOrganizations\n ?? tenantTeardownConfig?.purgeBatchSize\n ?? TENANT_TEARDOWN_CONFIG_DEFAULTS.purgeBatchSize;\n\n const organizationsRepository = repositoriesRegistry.getRepository(CoreResourceType.ORGANIZATIONS);\n\n // `status: DELETED` is the hard gate and is deliberately not merely a hint. `purgeScheduledAt`\n // is cleared on restore, and a comparison against a cleared/absent value must never select a\n // row — pairing the deadline with the status means a restored tenant is excluded by the\n // status alone, whatever its timestamps say.\n const dueOrganizations = await organizationsRepository.list<Organization>(executionContext, {\n status: OrganizationStatus.DELETED,\n purgeScheduledAt: { $lt: now, $exists: true },\n }) as Organization[];\n\n const attempted = dueOrganizations.slice(0, maxOrganizations);\n if (dueOrganizations.length > attempted.length) {\n // Never silently truncate: an operator reading \"purged 50\" with no other signal would\n // reasonably conclude the queue is empty.\n logger.info('Organization purge run bounded by batch size — remaining tenants are purged by the next run', {\n due: dueOrganizations.length,\n attempting: attempted.length,\n maxOrganizations,\n });\n }\n\n let purged = 0;\n let failed = 0;\n\n for (const organization of attempted) {\n if (!organization?._id) continue;\n try {\n // The ordinary DELETE. Resolves to the route-less INTERNAL_CALL default variant, whose\n // POSTFIX emits `ORGANIZATION_DELETED` — the evidence of what was destroyed — and whose\n // core persistence runs the `onParentDelete` cascade for every child edge.\n await servicesRegistry.delete(\n CoreResourceType.ORGANIZATIONS,\n executionContext,\n organization._id,\n );\n purged++;\n } catch (error) {\n failed++;\n // ERROR, not WARN: a tenant whose retention window has expired and which cannot be\n // destroyed is a standing compliance exposure, not routine noise. It stays marked, so the\n // next run retries it — but a permanently failing tenant must be visible rather than\n // retried silently forever.\n logger.error('Failed to purge an organization whose retention window has elapsed', {\n organizationId: organization._id,\n purgeScheduledAt: organization.purgeScheduledAt,\n ...projectCaughtErrorLogFields(error),\n });\n }\n }\n\n const durationMs = Date.now() - startTime;\n logger.info('Organization purge batch completed', {\n dueOrganizations: attempted.length,\n purged,\n failed,\n durationMs,\n });\n\n return {\n dueOrganizations: attempted.length,\n purged,\n failed,\n durationMs,\n };\n },\n });\n}\n"]}

package/dist/esm/organizations/services/organization-custom-implementation.backend.service.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"organization-custom-implementation.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/organizations/services/organization-custom-implementation.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;~~AAiBH~~,OAAO,EAEL,KAAK,0CAA0C,EAChD,MAAM,4GAA4G,CAAC;~~AAsIpH~~,wBAAgB,iCAAiC,IAAI,0CAA0C,EAAE,CAMhG;AAsqBD;;;;;;;GAOG;AACH,wBAAgB,oCAAoC,IAAI,0CAA0C,EAAE,CAQnG"}
1	+ {"version":3,"file":"organization-custom-implementation.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/organizations/services/organization-custom-implementation.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAkBH,OAAO,EAEL,KAAK,0CAA0C,EAChD,MAAM,4GAA4G,CAAC;AAsNpH,wBAAgB,iCAAiC,IAAI,0CAA0C,EAAE,CAMhG;AAsqBD;;;;;;;GAOG;AACH,wBAAgB,oCAAoC,IAAI,0CAA0C,EAAE,CAQnG"}

package/dist/esm/organizations/services/organization-custom-implementation.backend.service.js CHANGED Viewed

@@ -6,7 +6,7 @@
  * Rejects invalid types with VALIDATION error.
  */
 import { resolveAuditActorId } from '../../compliance/audit-trails/utils/audit-actor.backend.utils.js';
-import { CoreResourceOperation, CoreResourceType, ErrorType, ErrorCustomMessageReference, Organization_Lifecycle_Operations, OrganizationMemberStatus, OrganizationStatus, ResourceOperationVariantType, resolveOrganizationPurgeScheduledAt, } from '@wildo-ai/saas-models';
+import { CORE_ORG_ROLES, CoreResourceOperation, CoreResourceType, ErrorType, ErrorCustomMessageReference, Organization_Lifecycle_Operations, OrganizationMemberStatus, OrganizationStatus, ResourceOperationVariantType, resolveOrganizationPurgeScheduledAt, } from '@wildo-ai/saas-models';
 import { createResourceCustomServiceImplementation, } from '../../base-classes/services/services/resource-operation-custom-implementation.factory.backend.js';
 import { registerTransactionPostCommitEffect } from '../../databases/models/transaction.shared.schemas.js';
 import { projectCaughtErrorLogFields } from '../../errors/utils/error-log-level-classification.backend.utils.js';
@@ -73,7 +73,28 @@ function validateOrganizationTypeForCreation(organizationTypes, type, errorBuild
  * implementation can never execute on that variant under any configuration.
  */
 function createOrganizationCreateFactory(variantType, variantKey) {
-    const factory = (resourcesRegistryService) => {
+    /*
+     * Whether this path must ESTABLISH THE FOUNDING OWNER (#436).
+     *
+     * The default API_CALL is self-service tenant creation: an authenticated user creating their own
+     * organization. Its configuration has always said "ownership is established by the create flow,
+     * not a role", and until 2026-09-08 that was FALSE for this path — the prefix validated the type
+     * and the name, the core write created the row, and nothing made anyone a member. A successful
+     * self-service create produced a tenant with ZERO members and ZERO owners: precisely the stranded
+     * state the organization-owner floor exists to prevent, reached through the front door.
+     *
+     * The other two paths are deliberately excluded, for opposite reasons:
+     *
+     *   - INTERNAL_CALL is registration, and `createOrgOnRegistration` already writes the owner
+     *     membership. Adding one here would write it twice.
+     *   - The `admin` variant is a PLATFORM operator creating a tenant for someone else. Making the
+     *     operator its owner would place a platform administrator inside a customer tenant as a
+     *     standing member — the exact shape zero-standing-privilege work removed. That tenant is
+     *     ownerless on purpose, and `organizationMembers.grantOwnership` is the audited, justified
+     *     door for naming its first owner. Do not "fix" this by extending the postfix to it.
+     */
+    const establishesFoundingOwner = variantType === ResourceOperationVariantType.API_CALL && variantKey === undefined;
+    const factory = (resourcesRegistryService, container) => {
         return createResourceCustomServiceImplementation({
             operationPath: {
                 resourceIdentifier: CoreResourceType.ORGANIZATIONS,
@@ -100,6 +121,46 @@ function createOrganizationCreateFactory(variantType, variantKey) {
                     }
                     return input;
                 },
+                ...(establishesFoundingOwner
+                    ? {
+                        postfixCoreOperations: async (_id, createdOrganization, executionContext, _operationPath, utils) => {
+                            const organizationId = createdOrganization?._id;
+                            const userId = executionContext.initiatorIds?.userId;
+                            /*
+                             * FAIL CLOSED — deliberately not wrapped in a catch.
+                             *
+                             * A create that answers 200 having produced a tenant nobody can administer is worse
+                             * than one that fails: the caller retries a failure, and cannot even see the other.
+                             * The membership write joins the caller's unit of work through `utils.serviceOptions`,
+                             * so a failure here takes the organization row with it rather than leaving the
+                             * stranded tenant this postfix exists to prevent.
+                             */
+                            if (!organizationId || !userId) {
+                                throw utils.errorBuilder.buildError(ErrorType.INTERNAL, executionContext, {
+                                    customMessageReference: ErrorCustomMessageReference.INTERNAL,
+                                    context: {
+                                        // diagnostic (log-only)
+                                        message: 'Self-service organization create cannot establish a founding owner',
+                                        organizationId,
+                                        hasInitiatorUserId: Boolean(userId),
+                                    },
+                                });
+                            }
+                            const organizationTypes = resourcesRegistryService.getOrganizationTypesConfig();
+                            const type = createdOrganization?.type;
+                            // The SAME resolution registration uses, so the two creation paths cannot disagree
+                            // about which role owns a tenant of a given type.
+                            const ownerRole = (type ? organizationTypes?.[type] : undefined)?.creationPolicy?.defaultOwnerRole
+                                ?? CORE_ORG_ROLES.ORG_OWNER;
+                            const systemAccess = container.get(SAAS_SERVICE_TYPES.SystemAccessService);
+                            // Trusted write: the client-shaped CREATE DTO strips `userId` / `organizationId`,
+                            // and `createAsSystem` re-attaches both after the strict parse — the same reason
+                            // `createOrgOnRegistration` uses it for the identical row.
+                            await systemAccess.createAsSystem(CoreResourceType.ORGANIZATION_MEMBERS, { userId, organizationId, roles: [ownerRole] }, utils.serviceOptions);
+                            return createdOrganization;
+                        },
+                    }
+                    : {}),
             },
         });
     };