@wildo-ai/saas-backend-lib 1.1.2 → 1.1.4

package/dist/esm/monitoring/observability/services/metrics.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"metrics.service.js","sourceRoot":"","sources":["../../../../../../src/monitoring/observability/services/metrics.service.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,OAAO,EAAS,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAIvC;;;;;;;;;;GAUG;AAEI,IAAM,cAAc,GAApB,MAAM,cAAc;IACjB,KAAK,CAAQ;IACb,kBAAkB,CAAoB;IAE9C;QACE,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC;QAC7D,IAAI,CAAC,iBAAiB,EAAE,CAAC;IAC3B,CAAC;IAEO,iBAAiB;QACvB,IAAI,CAAC,kBAAkB,GAAG;YACxB,wEAAwE;YACxE,gEAAgE;YAChE,wEAAwE;YACxE,gEAAgE;YAChE,mEAAmE;YACnE,sCAAsC;YACtC,gEAAgE;YAChE,kEAAkE;YAClE,2CAA2C;YAC3C,sEAAsE;YACtE,gEAAgE;YAChE,mEAAmE;YACnE,gDAAgD;YAChD,sEAAsE;YACtE,qEAAqE;YACrE,mEAAmE;YACnE,oCAAoC;YACpC,0BAA0B,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,uCAAuC,EAAE;gBAC5F,WAAW,EAAE,yGAAyG;aACvH,CAAC;YAEF,4BAA4B,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,yCAAyC,EAAE;gBAChG,WAAW,EAAE,2FAA2F;aACzG,CAAC;YAEF,6BAA6B,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,yCAAyC,EAAE;gBACjG,WAAW,EAAE,6GAA6G;aAC3H,CAAC;YAEF,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,wBAAwB,EAAE;gBACtE,WAAW,EAAE,gGAAgG;aAC9G,CAAC;YAEF,iCAAiC,EAAE,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,2CAA2C,EAAE;gBACzG,WAAW,EAAE,oGAAoG;aAClH,CAAC;YAEF,6DAA6D;YAC7D,4DAA4D;YAC5D,4EAA4E;YAC5E,6DAA6D;YAC7D,8DAA8D;YAC9D,6CAA6C;YAC7C,8DAA8D;YAC9D,6CAA6C;YAC7C,2DAA2D;YAC3D,uBAAuB,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,4BAA4B,EAAE;gBAC9E,WAAW,EAAE,qFAAqF;aACnG,CAAC;YAEF,6DAA6D;YAC7D,oEAAoE;YACpE,2EAA2E;YAC3E,uEAAuE;YACvE,yEAAyE;YACzE,iCAAiC;YACjC,2CAA2C;YAC3C,2EAA2E;YAC3E,qBAAqB,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,0BAA0B,EAAE;gBAC1E,WAAW,EAAE,uFAAuF;aACrG,CAAC;YAEF,kDAAkD;YAClD,yEAAyE;YACzE,6EAA6E;YAC7E,0EAA0E;YAC1E,2EAA2E;YAC3E,0EAA0E;YAC1E,UAAU;YACV,kDAAkD;YAClD,yDAAyD;YACzD,wBAAwB,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,6BAA6B,EAAE;gBAChF,WAAW,EAAE,kGAAkG;aAChH,CAAC;YAEF,uDAAuD;YACvD,8FAA8F;YAC9F,kGAAkG;YAClG,iGAAiG;YACjG,kGAAkG;YAClG,qGAAqG;YACrG,qBAAqB;YACrB,mFAAmF;YACnF,uFAAuF;YACvF,oCAAoC,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,0CAA0C,EAAE;gBACzG,WAAW,EACT,mHAAmH;aACtH,CAAC;YAEF,gFAAgF;YAChF,+FAA+F;YAC/F,2FAA2F;YAC3F,+FAA+F;YAC/F,+FAA+F;YAC/F,+FAA+F;YAC/F,4FAA4F;YAC5F,qBAAqB;YACrB,4CAA4C;YAC5C,8FAA8F;YAC9F,4FAA4F;YAC5F,sBAAsB,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,2BAA2B,EAAE;gBAC5E,WAAW,EAAE,4GAA4G;aAC1H,CAAC;SACH,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,0CAA0C;IAC1C,8EAA8E;IAC9E,yEAAyE;IACzE,uEAAuE;IACvE,kEAAkE;IAClE,sDAAsD;IACtD,8EAA8E;IAE9E;;;;OAIG;IACI,6BAA6B,CAAC,MAA8C;QACjF,IAAI,CAAC,kBAAkB,CAAC,0BAA0B,CAAC,GAAG,CAAC,CAAC,EAAE;YACxD,QAAQ,EAAE,MAAM,CAAC,OAAO;YACxB,UAAU,EAAE,MAAM,CAAC,SAAS;SAC7B,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACI,8BAA8B,CAAC,MAA8C;QAClF,IAAI,CAAC,kBAAkB,CAAC,4BAA4B,CAAC,GAAG,CAAC,CAAC,EAAE;YAC1D,QAAQ,EAAE,MAAM,CAAC,OAAO;YACxB,UAAU,EAAE,MAAM,CAAC,SAAS;SAC7B,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACI,kCAAkC,CAAC,MAIzC;QACC,IAAI,CAAC,kBAAkB,CAAC,6BAA6B,CAAC,GAAG,CAAC,CAAC,EAAE;YAC3D,QAAQ,EAAE,MAAM,CAAC,OAAO;YACxB,UAAU,EAAE,MAAM,CAAC,SAAS;YAC5B,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACI,oBAAoB,CAAC,MAM3B;QACC,IAAI,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,EAAE;YACjD,QAAQ,EAAE,MAAM,CAAC,OAAO;YACxB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,cAAc,EAAE,MAAM,CAAC,aAAa;YACpC,UAAU,EAAE,MAAM,CAAC,SAAS;SAC7B,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACI,uCAAuC,CAAC,MAG9C;QACC,MAAM,MAAM,GAAG,CAAC,GAAG,EAAE;YACnB,IAAI,MAAM,CAAC,SAAS,IAAI,CAAC;gBAAE,OAAO,GAAG,CAAC;YACtC,IAAI,MAAM,CAAC,SAAS,IAAI,EAAE;gBAAE,OAAO,MAAM,CAAC;YAC1C,IAAI,MAAM,CAAC,SAAS,IAAI,EAAE;gBAAE,OAAO,OAAO,CAAC;YAC3C,IAAI,MAAM,CAAC,SAAS,IAAI,GAAG;gBAAE,OAAO,QAAQ,CAAC;YAC7C,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC,EAAE,CAAC;QACL,IAAI,CAAC,kBAAkB,CAAC,iCAAiC,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE;YAClF,iBAAiB,EAAE,MAAM;SAC1B,CAAC,CAAC;IACL,CAAC;IAED,8EAA8E;IAC9E,4DAA4D;IAC5D,8EAA8E;IAC9E,0EAA0E;IAC1E,wEAAwE;IACxE,0EAA0E;IAC1E,2EAA2E;IAC3E,2EAA2E;IAC3E,8DAA8D;IAC9D,2CAA2C;IAC3C,EAAE;IACF,mBAAmB;IACnB,0EAA0E;IAC1E,iEAAiE;IACjE,uEAAuE;IACvE,wEAAwE;IACxE,gEAAgE;IAChE,kBAAkB;IAClB,EAAE;IACF,uEAAuE;IACvE,8EAA8E;IAE9E;;;;;;;;;;;;;;OAcG;IACI,+BAA+B,CAAC,MAQtC;QACC,IAAI,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,EAAE;YACrD,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC,CAAC;IACL,CAAC;IAED,8EAA8E;IAC9E,oDAAoD;IACpD,8EAA8E;IAE9E;;;;;;;;OAQG;IACI,sBAAsB,CAAC,MAA+B;QAC3D,IAAI,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,EAAE;YACnD,QAAQ,EAAE,MAAM,CAAC,WAAW;SAC7B,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;OASG;IACI,yBAAyB,CAAC,MAA+B;QAC9D,IAAI,CAAC,kBAAkB,CAAC,wBAAwB,CAAC,GAAG,CAAC,CAAC,EAAE;YACtD,QAAQ,EAAE,MAAM,CAAC,WAAW;SAC7B,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;OAUG;IACI,qCAAqC,CAAC,MAA+C;QAC1F,IAAI,CAAC,kBAAkB,CAAC,oCAAoC,CAAC,GAAG,CAAC,CAAC,EAAE;YAClE,QAAQ,EAAE,MAAM,CAAC,WAAW;YAC5B,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACI,uBAAuB;QAC5B,IAAI,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACxD,CAAC;CACF,CAAA;AAzWY,cAAc;IAD1B,UAAU,EAAE;;GACA,cAAc,CAyW1B","sourcesContent":["import { metrics, Meter } from '@opentelemetry/api';\nimport { injectable } from 'inversify';\nimport type { AuthScopeType } from '@wildo-ai/saas-models';\nimport { MetricDefinitions } from '~wildo-backend-lib/monitoring/observability/models/observability.backend.schemas';\n\n/**\n * Records the operator-facing metrics that have LIVE producers — the\n * data-seeding counters (dispatcher engines + shared ledger writers) and the\n * M2M outbound-webhook counter (delivery batch worker). All instruments are\n * created on the global meter, which the OTLP preload (`otel-preload.ts`) wires\n * to the OTLP metric exporter; with no preload the global meter is a no-op, so\n * recording is silently inert (never throws). The former HTTP/DB/auth/etc.\n * `record*` helpers were removed in Slice 2 Phase 3 — their only caller was the\n * dead observability middleware, and HTTP metrics now come from the preload's\n * auto-instrumentation (bounded, semconv) instead of unbounded org/user labels.\n */\n@injectable()\nexport class MetricsService {\n  private meter: Meter;\n  private metricsDefinitions: MetricDefinitions;\n\n  constructor() {\n    this.meter = metrics.getMeter('wildo-saas-metrics', '1.0.0');\n    this.initializeMetrics();\n  }\n\n  private initializeMetrics(): void {\n    this.metricsDefinitions = {\n      // ---------------------------------------------------------------------\n      // Data Seeding (Phase 6.D / F-17 — Prom-style operator metrics)\n      // ---------------------------------------------------------------------\n      // The data-seeding dispatcher exposes four observable concerns:\n      //   - LAZY C1 cache hit-rate (first-access bootstrap short-circuit\n      //     effectiveness on the hot path),\n      //   - LAZY thunder-herd bow-outs (concurrent first-access races\n      //     resolved silently, distinguishing the \"winner already done\"\n      //     vs \"winner still running\" branches),\n      //   - DataSeedRun terminal totals (every COMPLETED / PARTIAL / FAILED\n      //     ledger transition, per seed × mode × trigger origin — the\n      //     metric covers ALL engines, current and future, because it is\n      //     fired from the shared lifecycle writers).\n      // Counter names follow the Prometheus convention `_total` suffix; the\n      // OpenTelemetry meter is the existing `wildo-saas-metrics` meter, so\n      // the counters export via the OTLP metric reader configured in the\n      // preload without any extra wiring.\n      dataSeedingLazyC1CacheHits: this.meter.createCounter('data_seeding_lazy_c1_cache_hits_total', {\n        description: 'LAZY engine C1 idempotency-probe cache hits (already-completed scope, skipped without entry resolution)',\n      }),\n\n      dataSeedingLazyC1CacheMisses: this.meter.createCounter('data_seeding_lazy_c1_cache_misses_total', {\n        description: 'LAZY engine C1 idempotency-probe cache misses (cold-start, run-slot acquisition proceeds)',\n      }),\n\n      dataSeedingThunderHerdBowouts: this.meter.createCounter('data_seeding_thunder_herd_bowouts_total', {\n        description: 'LAZY engine concurrent-first-access races where the slot acquisition lost and the caller bowed out silently',\n      }),\n\n      dataSeedingRunTotal: this.meter.createCounter('data_seeding_run_total', {\n        description: 'DataSeedRun terminal-state writes (COMPLETED / PARTIAL / FAILED) across all dispatcher engines',\n      }),\n\n      dataSeedingAdminListSeedsDuration: this.meter.createHistogram('data_seeding_admin_list_seeds_duration_ms', {\n        description: 'Wall-clock duration of GET /internal/admin/data-seeding/seeds (N+1 lastRun lookup) in milliseconds',\n      }),\n\n      // ─── M2M Outbound Webhook Delivery (Phase 5 / Step 17) ────\n      // One counter covering every worker `doHandle` return — the\n      // outcome enum maps 1:1 to the five `M2MWebhookDeliveryBatchOutput.outcome`\n      // values (`delivered`, `retry_scheduled`, `failed_terminal`,\n      // `skipped_missing_row`, `skipped_already_leased`). Operators\n      // answer \"is webhook delivery healthy?\" with\n      //   rate(m2m_webhook_delivery_total{outcome=\"delivered\"}[5m])\n      //     / rate(m2m_webhook_delivery_total[5m])\n      // Cardinality: 2 `scope` × 5 `outcome` = 10 active series.\n      m2mWebhookDeliveryTotal: this.meter.createCounter('m2m_webhook_delivery_total', {\n        description: 'M2M outbound webhook delivery terminal / intermediate outcomes (one per worker run)',\n      }),\n\n      // ─── Compliance Audit-Log Sink Failures (Phase 5 / F6) ────\n      // A Layer-2 provider audit sink threw while recording an event. The\n      // composite (`CompositeAuditLogSink`) isolates the failure so the business\n      // op is unaffected, but a silently-failing audit sink (\"we think we're\n      // auditing but we aren't\") must not go unnoticed — this counter makes it\n      // observable. Operators alert on\n      //   rate(audit_sink_failure_total[5m]) > 0\n      // Cardinality: one series per declared audit `provider` (immudb, SIEM, …).\n      auditSinkFailureTotal: this.meter.createCounter('audit_sink_failure_total', {\n        description: 'Compliance audit-log provider sink failures (one per sink throw during event fan-out)',\n      }),\n\n      // ─── Compliance Audit-Log TAMPER detections ────\n      // A tamper-evident audit provider (immudb) PROVED, via its cryptographic\n      // durable-state consistency proof, that its store was rolled back / tampered\n      // between restarts. DISTINCT from `audit_sink_failure_total`: a transient\n      // write miss is backfilled by the reconciler and needs no human, whereas a\n      // proven rollback of the audit ledger is a compliance incident. Operators\n      // page on\n      //   increase(audit_tamper_detected_total[1h]) > 0\n      // Cardinality: one series per declared audit `provider`.\n      auditTamperDetectedTotal: this.meter.createCounter('audit_tamper_detected_total', {\n        description: 'Compliance audit-log store tamper/rollback detections (durable-state consistency-proof failures)',\n      }),\n\n      // ─── Compliance Audit-Log assurance DEGRADATIONS ────\n      // A tamper-evident audit provider dropped from FULL cross-restart tamper-evidence to a WEAKER\n      // assurance level — ephemeral mode (no durable anchor), a corrupt/unreadable anchor, an un-pinned\n      // server-identity change, or a per-op proof failure. DISTINCT from `audit_tamper_detected_total`\n      // (a PROVEN rollback → page) and `audit_sink_failure_total` (a write hiccup): a degradation means\n      // \"we may not detect a future tamper\" — it should be alerted so the guarantee never lapses silently.\n      // Operators alert on\n      //   increase(audit_integrity_assurance_degraded_total{reason=\"ephemeral\"}[1h]) > 0\n      // Cardinality: one series per (provider, reason) — `reason` is a small fixed slug set.\n      auditIntegrityAssuranceDegradedTotal: this.meter.createCounter('audit_integrity_assurance_degraded_total', {\n        description:\n          'Compliance audit-log assurance degradations (ephemeral / corrupt-anchor / identity-change / per-op proof failure)',\n      }),\n\n      // ─── Compliance Audit-Log LAYER-1 (authoritative DB store) write failures ────\n      // The always-on Layer-1 database audit store (`AuditLogsBackendService._createAuditLog`) threw\n      // while writing the authoritative row. DISTINCT from `audit_sink_failure_total` (a Layer-2\n      // provider sink — immudb/SIEM — hiccup, backfilled by the reconciler): a Layer-1 failure means\n      // the PRIMARY, authoritative audit record itself was NOT persisted — the most severe \"we think\n      // we're auditing but we aren't\" state. Emission is fire-and-forget (audit must never break the\n      // business op), so without this counter the outage is invisible past a swallowed warn line.\n      // Operators alert on\n      //   rate(audit_store_failure_total[5m]) > 0\n      // Cardinality: ONE label-free series (the authoritative store has no provider dimension). The\n      // alert rule is specified in `.claude/plans/alerting-system-design-analysis.md` Appendix D.\n      auditStoreFailureTotal: this.meter.createCounter('audit_store_failure_total', {\n        description: 'Compliance audit-log Layer-1 authoritative DB store write failures (one per _createAuditLog persist throw)',\n      }),\n    };\n  }\n\n  // ---------------------------------------------------------------------------\n  // Data Seeding metrics (Phase 6.D / F-17)\n  // ---------------------------------------------------------------------------\n  // Typed wrappers around the four data-seeding counters so the dispatcher\n  // never reaches into the raw OpenTelemetry meter and so all label keys\n  // stay consistent (snake_case to match Prometheus convention; the\n  // dispatcher passes already-stringified enum values).\n  // ---------------------------------------------------------------------------\n\n  /**\n   * LAZY engine — C1 idempotency-probe cache hit. Fired once per\n   * (seed × scope) when `runLazy` short-circuits because a prior\n   * COMPLETED `DataSeedRun` row already covers the scope.\n   */\n  public recordDataSeedingLazyCacheHit(params: { seedKey: string; scopeKind: string }): void {\n    this.metricsDefinitions.dataSeedingLazyC1CacheHits.add(1, {\n      seed_key: params.seedKey,\n      scope_kind: params.scopeKind,\n    });\n  }\n\n  /**\n   * LAZY engine — C1 idempotency-probe cache miss. Fired once per\n   * (seed × scope) when `runLazy` proceeds past the C1 probe and\n   * attempts to acquire a run-slot.\n   */\n  public recordDataSeedingLazyCacheMiss(params: { seedKey: string; scopeKind: string }): void {\n    this.metricsDefinitions.dataSeedingLazyC1CacheMisses.add(1, {\n      seed_key: params.seedKey,\n      scope_kind: params.scopeKind,\n    });\n  }\n\n  /**\n   * LAZY engine — concurrent first-access race resolved by silent\n   * bow-out. `reason` mirrors the dispatcher's\n   * `acquireLazyRunSlotWithRaceGuard` outcome:\n   *   - `concurrent-completed` — a winning concurrent caller already\n   *     wrote a COMPLETED row (data is there);\n   *   - `concurrent-running`   — a winning concurrent caller currently\n   *     owns the RUNNING slot (data is being written).\n   */\n  public recordDataSeedingThunderHerdBowout(params: {\n    seedKey: string;\n    scopeKind: string;\n    reason: 'concurrent-completed' | 'concurrent-running';\n  }): void {\n    this.metricsDefinitions.dataSeedingThunderHerdBowouts.add(1, {\n      seed_key: params.seedKey,\n      scope_kind: params.scopeKind,\n      reason: params.reason,\n    });\n  }\n\n  /**\n   * Terminal `DataSeedRun` write — fired exactly once per row\n   * transition into COMPLETED / PARTIAL / FAILED. The metric is\n   * emitted from the shared lifecycle writers\n   * (`completeDataSeedRun` / `failDataSeedRun` /\n   * `writeFreshFailedDataSeedRun`) so every dispatcher engine —\n   * Level-A application lifecycle, Level-B resource lifecycle, LAZY\n   * first-access, MANUAL re-runs, and the deferred Phase-7 cron —\n   * contributes uniformly without per-engine wiring.\n   *\n   * `mode`, `status`, `triggerOrigin`, and `scopeKind` are passed as\n   * raw enum string values (the dispatcher does the `.toString()`) so\n   * this service stays decoupled from the data-seeding domain enums.\n   *\n   * Phase 5/6 audit H-2 — `scope_kind` was added to align with the\n   * sibling LAZY-engine counters (hit / miss / bow-out) which all\n   * carry it. Without `scope_kind`, operators cannot answer\n   * \"are my org-scoped seeds healthier than my user-scoped seeds?\",\n   * and the deferred Phase-7 cron-scheduler dashboard cannot slice\n   * terminal-run health by scope at all (terminal counts are the\n   * only signal SYNC / ADDITIVE / UPGRADE seeds emit). Cardinality\n   * stays bounded: 5 `DataSeedScopeKind` values × ~200 seeds × 4\n   * modes × 4 statuses × ~6 trigger origins ≈ 96K series upper\n   * bound; in practice <1K active series.\n   */\n  public recordDataSeedingRun(params: {\n    seedKey: string;\n    mode: string;\n    status: string;\n    triggerOrigin: string;\n    scopeKind: string;\n  }): void {\n    this.metricsDefinitions.dataSeedingRunTotal.add(1, {\n      seed_key: params.seedKey,\n      mode: params.mode,\n      status: params.status,\n      trigger_origin: params.triggerOrigin,\n      scope_kind: params.scopeKind,\n    });\n  }\n\n  /**\n   * Wall-clock duration of the admin `GET /internal/admin/data-seeding/seeds`\n   * endpoint in milliseconds. Recorded in the controller around the full\n   * registry walk (which fans out N `lastRun` lookups, one per seed).\n   *\n   * Phase 5/6 audit L-4 — needed because the endpoint is N+1 by design\n   * (single registry-wide aggregate would couple the surface to the\n   * adapter's grammar; see the controller's `lookupLastRunSummary` JSDoc).\n   * The histogram lets operators spot when the seed registry crosses the\n   * \"switch to bulk aggregation\" threshold and surface it as a Phase-7\n   * dashboard SLO alert.\n   *\n   * `seedCount` is bucketed coarsely (0, 1-10, 11-50, 51-200, 201+) so\n   * label cardinality stays bounded across deployments with widely\n   * different seed counts.\n   */\n  public recordDataSeedingAdminListSeedsDuration(params: {\n    durationMs: number;\n    seedCount: number;\n  }): void {\n    const bucket = (() => {\n      if (params.seedCount <= 0) return '0';\n      if (params.seedCount <= 10) return '1-10';\n      if (params.seedCount <= 50) return '11-50';\n      if (params.seedCount <= 200) return '51-200';\n      return '201+';\n    })();\n    this.metricsDefinitions.dataSeedingAdminListSeedsDuration.record(params.durationMs, {\n      seed_count_bucket: bucket,\n    });\n  }\n\n  // ---------------------------------------------------------------------------\n  // M2M Outbound Webhook Delivery metrics (Phase 5 / Step 17)\n  // ---------------------------------------------------------------------------\n  // Typed wrapper around the single `m2m_webhook_delivery_total` counter so\n  // worker call sites never reach into the raw OpenTelemetry meter and so\n  // label keys (`scope` / `outcome`) stay consistent. The `scope` parameter\n  // is locked to the `AuthScopeType` enum (`'organization' | 'application'`)\n  // — passing a typo or a stale string fails type-check rather than silently\n  // creating a parallel time series — and `outcome` maps 1:1 to\n  // `M2MWebhookDeliveryBatchOutput.outcome`.\n  //\n  // Firing contract:\n  //   - Exactly ONCE per worker invocation, at each terminal / intermediate\n  //     return-point in `m2mWebhookDeliveryBatchService.doHandle`.\n  //   - NOT fired from the dispatcher's skip paths (feature off / config\n  //     off / no endpoints) — those never create a delivery row and never\n  //     emit outbound HTTP, so they are not webhook deliveries by\n  //     definition.\n  //\n  // See `.cursor/plans/m2m-webhook-organization-delivery-phase5.md` §D4.\n  // ---------------------------------------------------------------------------\n\n  /**\n   * M2M Outbound Webhook Delivery outcome counter.\n   *\n   * @param params.scope - `AuthScopeType.ORGANIZATION` (`'organization'`)\n   *   or `AuthScopeType.APPLICATION` (`'application'`). Locked to the\n   *   shared `AuthScopeType` enum so a typo or stale literal fails\n   *   type-check rather than silently creating a parallel time series\n   *   under a divergent label.\n   * @param params.outcome - One of the five\n   *   `M2MWebhookDeliveryBatchOutput.outcome` values. `delivered` and\n   *   `failed_terminal` are terminal; `retry_scheduled` is the\n   *   intermediate retry branch; `skipped_missing_row` /\n   *   `skipped_already_leased` cover the two skip branches that still\n   *   consumed a worker slot.\n   */\n  public recordM2MWebhookDeliveryOutcome(params: {\n    scope: AuthScopeType;\n    outcome:\n      | 'delivered'\n      | 'retry_scheduled'\n      | 'failed_terminal'\n      | 'skipped_missing_row'\n      | 'skipped_already_leased';\n  }): void {\n    this.metricsDefinitions.m2mWebhookDeliveryTotal.add(1, {\n      scope: params.scope,\n      outcome: params.outcome,\n    });\n  }\n\n  // ---------------------------------------------------------------------------\n  // Compliance Audit-Log Sink failures (Phase 5 / F6)\n  // ---------------------------------------------------------------------------\n\n  /**\n   * F6 (audit Phase 5) — a Layer-2 provider audit sink threw while recording an\n   * event. Fired by `CompositeAuditLogSink` in its per-sink catch, so an\n   * otherwise-swallowed sink failure is OBSERVABLE (→ alert). Synchronous, never\n   * throws (the global meter is a no-op without the OTLP preload).\n   *\n   * @param params.providerRef - The declared audit provider whose sink failed\n   *   (immudb, a SIEM webhook, …) — the stable, low-cardinality series label.\n   */\n  public recordAuditSinkFailure(params: { providerRef: string }): void {\n    this.metricsDefinitions.auditSinkFailureTotal.add(1, {\n      provider: params.providerRef,\n    });\n  }\n\n  /**\n   * A tamper-evident audit provider PROVED its store was rolled back / tampered between restarts\n   * (its durable-state cryptographic consistency proof failed). Fired by `CompositeAuditLogSink`\n   * via the `onIntegrityViolation` hook it threads into the provider sink factory (the sink cannot\n   * import this service across the dependency wall). DISTINCT from {@link recordAuditSinkFailure}:\n   * this is a compliance incident (page a human), not a backfillable transient miss. Synchronous,\n   * never throws (the global meter is a no-op without the OTLP preload).\n   *\n   * @param params.providerRef - The audit provider whose store proved tampered (immudb, …).\n   */\n  public recordAuditTamperDetected(params: { providerRef: string }): void {\n    this.metricsDefinitions.auditTamperDetectedTotal.add(1, {\n      provider: params.providerRef,\n    });\n  }\n\n  /**\n   * A tamper-evident audit provider DEGRADED from full cross-restart tamper-evidence to a weaker\n   * assurance level (ephemeral mode, a corrupt anchor, an un-pinned server-identity change, or a per-op\n   * proof failure). Fired by `CompositeAuditLogSink` via the `onAssuranceDegraded` hook it threads into\n   * the provider sink factory. DISTINCT from {@link recordAuditTamperDetected}: a degradation is not a\n   * proven tamper, but it means a future tamper may go UNDETECTED — alertable so the guarantee never\n   * lapses silently. Non-latching. Synchronous, never throws.\n   *\n   * @param params.providerRef - The audit provider that degraded (immudb, …).\n   * @param params.reason - Stable snake_case slug (`ephemeral`, `anchor_corrupt`, `anchor_identity_change`, `proof_failure_transient`).\n   */\n  public recordAuditIntegrityAssuranceDegraded(params: { providerRef: string; reason: string }): void {\n    this.metricsDefinitions.auditIntegrityAssuranceDegradedTotal.add(1, {\n      provider: params.providerRef,\n      reason: params.reason,\n    });\n  }\n\n  /**\n   * A-12 — the Layer-1 authoritative DB audit store threw while persisting an event. Fired by\n   * `AuditLogsBackendService._createAuditLog` in its Layer-1 catch, so the \"the primary audit record\n   * itself did not persist\" outage is OBSERVABLE (→ alert) rather than a swallowed warn line on a\n   * fire-and-forget path. DISTINCT from {@link recordAuditSinkFailure}: that is a Layer-2 provider sink\n   * (immudb/SIEM) hiccup the reconciler backfills; THIS is the authoritative store failing. Synchronous,\n   * never throws (the global meter is a no-op without the OTLP preload). Label-free — the authoritative\n   * store has no provider dimension. Alert rule: `alerting-system-design-analysis.md` Appendix D.\n   */\n  public recordAuditStoreFailure(): void {\n    this.metricsDefinitions.auditStoreFailureTotal.add(1);\n  }\n}\n"]}
+{"version":3,"file":"metrics.service.js","sourceRoot":"","sources":["../../../../../src/monitoring/observability/services/metrics.service.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,OAAO,EAAS,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAIvC;;;;;;;;;;GAUG;AAEI,IAAM,cAAc,GAApB,MAAM,cAAc;IACjB,KAAK,CAAQ;IACb,kBAAkB,CAAoB;IAE9C;QACE,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC;QAC7D,IAAI,CAAC,iBAAiB,EAAE,CAAC;IAC3B,CAAC;IAEO,iBAAiB;QACvB,IAAI,CAAC,kBAAkB,GAAG;YACxB,wEAAwE;YACxE,gEAAgE;YAChE,wEAAwE;YACxE,gEAAgE;YAChE,mEAAmE;YACnE,sCAAsC;YACtC,gEAAgE;YAChE,kEAAkE;YAClE,2CAA2C;YAC3C,sEAAsE;YACtE,gEAAgE;YAChE,mEAAmE;YACnE,gDAAgD;YAChD,sEAAsE;YACtE,qEAAqE;YACrE,mEAAmE;YACnE,oCAAoC;YACpC,0BAA0B,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,uCAAuC,EAAE;gBAC5F,WAAW,EAAE,yGAAyG;aACvH,CAAC;YAEF,4BAA4B,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,yCAAyC,EAAE;gBAChG,WAAW,EAAE,2FAA2F;aACzG,CAAC;YAEF,6BAA6B,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,yCAAyC,EAAE;gBACjG,WAAW,EAAE,6GAA6G;aAC3H,CAAC;YAEF,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,wBAAwB,EAAE;gBACtE,WAAW,EAAE,gGAAgG;aAC9G,CAAC;YAEF,iCAAiC,EAAE,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,2CAA2C,EAAE;gBACzG,WAAW,EAAE,oGAAoG;aAClH,CAAC;YAEF,6DAA6D;YAC7D,4DAA4D;YAC5D,4EAA4E;YAC5E,6DAA6D;YAC7D,8DAA8D;YAC9D,6CAA6C;YAC7C,8DAA8D;YAC9D,6CAA6C;YAC7C,2DAA2D;YAC3D,uBAAuB,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,4BAA4B,EAAE;gBAC9E,WAAW,EAAE,qFAAqF;aACnG,CAAC;YAEF,6DAA6D;YAC7D,oEAAoE;YACpE,2EAA2E;YAC3E,uEAAuE;YACvE,yEAAyE;YACzE,iCAAiC;YACjC,2CAA2C;YAC3C,2EAA2E;YAC3E,qBAAqB,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,0BAA0B,EAAE;gBAC1E,WAAW,EAAE,uFAAuF;aACrG,CAAC;YAEF,kDAAkD;YAClD,yEAAyE;YACzE,6EAA6E;YAC7E,0EAA0E;YAC1E,2EAA2E;YAC3E,0EAA0E;YAC1E,UAAU;YACV,kDAAkD;YAClD,yDAAyD;YACzD,wBAAwB,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,6BAA6B,EAAE;gBAChF,WAAW,EAAE,kGAAkG;aAChH,CAAC;YAEF,uDAAuD;YACvD,8FAA8F;YAC9F,kGAAkG;YAClG,iGAAiG;YACjG,kGAAkG;YAClG,qGAAqG;YACrG,qBAAqB;YACrB,mFAAmF;YACnF,uFAAuF;YACvF,oCAAoC,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,0CAA0C,EAAE;gBACzG,WAAW,EACT,mHAAmH;aACtH,CAAC;YAEF,gFAAgF;YAChF,+FAA+F;YAC/F,2FAA2F;YAC3F,+FAA+F;YAC/F,+FAA+F;YAC/F,+FAA+F;YAC/F,4FAA4F;YAC5F,qBAAqB;YACrB,4CAA4C;YAC5C,8FAA8F;YAC9F,4FAA4F;YAC5F,sBAAsB,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,2BAA2B,EAAE;gBAC5E,WAAW,EAAE,4GAA4G;aAC1H,CAAC;YAEF,4EAA4E;YAC5E,wFAAwF;YACxF,+FAA+F;YAC/F,4FAA4F;YAC5F,2FAA2F;YAC3F,4FAA4F;YAC5F,0FAA0F;YAC1F,8FAA8F;YAC9F,4FAA4F;YAC5F,yEAAyE;YACzE,uDAAuD;YACvD,4FAA4F;YAC5F,4BAA4B,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,iCAAiC,EAAE;gBACxF,WAAW,EACT,mIAAmI;aACtI,CAAC;SACH,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,0CAA0C;IAC1C,8EAA8E;IAC9E,yEAAyE;IACzE,uEAAuE;IACvE,kEAAkE;IAClE,sDAAsD;IACtD,8EAA8E;IAE9E;;;;OAIG;IACI,6BAA6B,CAAC,MAA8C;QACjF,IAAI,CAAC,kBAAkB,CAAC,0BAA0B,CAAC,GAAG,CAAC,CAAC,EAAE;YACxD,QAAQ,EAAE,MAAM,CAAC,OAAO;YACxB,UAAU,EAAE,MAAM,CAAC,SAAS;SAC7B,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACI,8BAA8B,CAAC,MAA8C;QAClF,IAAI,CAAC,kBAAkB,CAAC,4BAA4B,CAAC,GAAG,CAAC,CAAC,EAAE;YAC1D,QAAQ,EAAE,MAAM,CAAC,OAAO;YACxB,UAAU,EAAE,MAAM,CAAC,SAAS;SAC7B,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACI,kCAAkC,CAAC,MAIzC;QACC,IAAI,CAAC,kBAAkB,CAAC,6BAA6B,CAAC,GAAG,CAAC,CAAC,EAAE;YAC3D,QAAQ,EAAE,MAAM,CAAC,OAAO;YACxB,UAAU,EAAE,MAAM,CAAC,SAAS;YAC5B,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACI,oBAAoB,CAAC,MAM3B;QACC,IAAI,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,EAAE;YACjD,QAAQ,EAAE,MAAM,CAAC,OAAO;YACxB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,cAAc,EAAE,MAAM,CAAC,aAAa;YACpC,UAAU,EAAE,MAAM,CAAC,SAAS;SAC7B,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACI,uCAAuC,CAAC,MAG9C;QACC,MAAM,MAAM,GAAG,CAAC,GAAG,EAAE;YACnB,IAAI,MAAM,CAAC,SAAS,IAAI,CAAC;gBAAE,OAAO,GAAG,CAAC;YACtC,IAAI,MAAM,CAAC,SAAS,IAAI,EAAE;gBAAE,OAAO,MAAM,CAAC;YAC1C,IAAI,MAAM,CAAC,SAAS,IAAI,EAAE;gBAAE,OAAO,OAAO,CAAC;YAC3C,IAAI,MAAM,CAAC,SAAS,IAAI,GAAG;gBAAE,OAAO,QAAQ,CAAC;YAC7C,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC,EAAE,CAAC;QACL,IAAI,CAAC,kBAAkB,CAAC,iCAAiC,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE;YAClF,iBAAiB,EAAE,MAAM;SAC1B,CAAC,CAAC;IACL,CAAC;IAED,8EAA8E;IAC9E,4DAA4D;IAC5D,8EAA8E;IAC9E,0EAA0E;IAC1E,wEAAwE;IACxE,0EAA0E;IAC1E,2EAA2E;IAC3E,2EAA2E;IAC3E,8DAA8D;IAC9D,2CAA2C;IAC3C,EAAE;IACF,mBAAmB;IACnB,0EAA0E;IAC1E,iEAAiE;IACjE,uEAAuE;IACvE,wEAAwE;IACxE,gEAAgE;IAChE,kBAAkB;IAClB,EAAE;IACF,uEAAuE;IACvE,8EAA8E;IAE9E;;;;;;;;;;;;;;OAcG;IACI,+BAA+B,CAAC,MAQtC;QACC,IAAI,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,EAAE;YACrD,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC,CAAC;IACL,CAAC;IAED,8EAA8E;IAC9E,oDAAoD;IACpD,8EAA8E;IAE9E;;;;;;;;OAQG;IACI,sBAAsB,CAAC,MAA+B;QAC3D,IAAI,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,EAAE;YACnD,QAAQ,EAAE,MAAM,CAAC,WAAW;SAC7B,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;OASG;IACI,yBAAyB,CAAC,MAA+B;QAC9D,IAAI,CAAC,kBAAkB,CAAC,wBAAwB,CAAC,GAAG,CAAC,CAAC,EAAE;YACtD,QAAQ,EAAE,MAAM,CAAC,WAAW;SAC7B,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;OAUG;IACI,qCAAqC,CAAC,MAA+C;QAC1F,IAAI,CAAC,kBAAkB,CAAC,oCAAoC,CAAC,GAAG,CAAC,CAAC,EAAE;YAClE,QAAQ,EAAE,MAAM,CAAC,WAAW;YAC5B,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACI,uBAAuB;QAC5B,IAAI,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACxD,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACI,6BAA6B,CAAC,MAA+C;QAClF,IAAI,CAAC,kBAAkB,CAAC,4BAA4B,CAAC,GAAG,CAAC,CAAC,EAAE;YAC1D,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AAlZY,cAAc;IAD1B,UAAU,EAAE;;GACA,cAAc,CAkZ1B","sourcesContent":["import { metrics, Meter } from '@opentelemetry/api';\nimport { injectable } from 'inversify';\nimport type { AuthScopeType } from '@wildo-ai/saas-models';\nimport { MetricDefinitions } from '~wildo-backend-lib/monitoring/observability/models/observability.backend.schemas';\n\n/**\n * Records the operator-facing metrics that have LIVE producers — the\n * data-seeding counters (dispatcher engines + shared ledger writers) and the\n * M2M outbound-webhook counter (delivery batch worker). All instruments are\n * created on the global meter, which the OTLP preload (`otel-preload.ts`) wires\n * to the OTLP metric exporter; with no preload the global meter is a no-op, so\n * recording is silently inert (never throws). The former HTTP/DB/auth/etc.\n * `record*` helpers were removed in Slice 2 Phase 3 — their only caller was the\n * dead observability middleware, and HTTP metrics now come from the preload's\n * auto-instrumentation (bounded, semconv) instead of unbounded org/user labels.\n */\n@injectable()\nexport class MetricsService {\n  private meter: Meter;\n  private metricsDefinitions: MetricDefinitions;\n\n  constructor() {\n    this.meter = metrics.getMeter('wildo-saas-metrics', '1.0.0');\n    this.initializeMetrics();\n  }\n\n  private initializeMetrics(): void {\n    this.metricsDefinitions = {\n      // ---------------------------------------------------------------------\n      // Data Seeding (Phase 6.D / F-17 — Prom-style operator metrics)\n      // ---------------------------------------------------------------------\n      // The data-seeding dispatcher exposes four observable concerns:\n      //   - LAZY C1 cache hit-rate (first-access bootstrap short-circuit\n      //     effectiveness on the hot path),\n      //   - LAZY thunder-herd bow-outs (concurrent first-access races\n      //     resolved silently, distinguishing the \"winner already done\"\n      //     vs \"winner still running\" branches),\n      //   - DataSeedRun terminal totals (every COMPLETED / PARTIAL / FAILED\n      //     ledger transition, per seed × mode × trigger origin — the\n      //     metric covers ALL engines, current and future, because it is\n      //     fired from the shared lifecycle writers).\n      // Counter names follow the Prometheus convention `_total` suffix; the\n      // OpenTelemetry meter is the existing `wildo-saas-metrics` meter, so\n      // the counters export via the OTLP metric reader configured in the\n      // preload without any extra wiring.\n      dataSeedingLazyC1CacheHits: this.meter.createCounter('data_seeding_lazy_c1_cache_hits_total', {\n        description: 'LAZY engine C1 idempotency-probe cache hits (already-completed scope, skipped without entry resolution)',\n      }),\n\n      dataSeedingLazyC1CacheMisses: this.meter.createCounter('data_seeding_lazy_c1_cache_misses_total', {\n        description: 'LAZY engine C1 idempotency-probe cache misses (cold-start, run-slot acquisition proceeds)',\n      }),\n\n      dataSeedingThunderHerdBowouts: this.meter.createCounter('data_seeding_thunder_herd_bowouts_total', {\n        description: 'LAZY engine concurrent-first-access races where the slot acquisition lost and the caller bowed out silently',\n      }),\n\n      dataSeedingRunTotal: this.meter.createCounter('data_seeding_run_total', {\n        description: 'DataSeedRun terminal-state writes (COMPLETED / PARTIAL / FAILED) across all dispatcher engines',\n      }),\n\n      dataSeedingAdminListSeedsDuration: this.meter.createHistogram('data_seeding_admin_list_seeds_duration_ms', {\n        description: 'Wall-clock duration of GET /internal/admin/data-seeding/seeds (N+1 lastRun lookup) in milliseconds',\n      }),\n\n      // ─── M2M Outbound Webhook Delivery (Phase 5 / Step 17) ────\n      // One counter covering every worker `doHandle` return — the\n      // outcome enum maps 1:1 to the five `M2MWebhookDeliveryBatchOutput.outcome`\n      // values (`delivered`, `retry_scheduled`, `failed_terminal`,\n      // `skipped_missing_row`, `skipped_already_leased`). Operators\n      // answer \"is webhook delivery healthy?\" with\n      //   rate(m2m_webhook_delivery_total{outcome=\"delivered\"}[5m])\n      //     / rate(m2m_webhook_delivery_total[5m])\n      // Cardinality: 2 `scope` × 5 `outcome` = 10 active series.\n      m2mWebhookDeliveryTotal: this.meter.createCounter('m2m_webhook_delivery_total', {\n        description: 'M2M outbound webhook delivery terminal / intermediate outcomes (one per worker run)',\n      }),\n\n      // ─── Compliance Audit-Log Sink Failures (Phase 5 / F6) ────\n      // A Layer-2 provider audit sink threw while recording an event. The\n      // composite (`CompositeAuditLogSink`) isolates the failure so the business\n      // op is unaffected, but a silently-failing audit sink (\"we think we're\n      // auditing but we aren't\") must not go unnoticed — this counter makes it\n      // observable. Operators alert on\n      //   rate(audit_sink_failure_total[5m]) > 0\n      // Cardinality: one series per declared audit `provider` (immudb, SIEM, …).\n      auditSinkFailureTotal: this.meter.createCounter('audit_sink_failure_total', {\n        description: 'Compliance audit-log provider sink failures (one per sink throw during event fan-out)',\n      }),\n\n      // ─── Compliance Audit-Log TAMPER detections ────\n      // A tamper-evident audit provider (immudb) PROVED, via its cryptographic\n      // durable-state consistency proof, that its store was rolled back / tampered\n      // between restarts. DISTINCT from `audit_sink_failure_total`: a transient\n      // write miss is backfilled by the reconciler and needs no human, whereas a\n      // proven rollback of the audit ledger is a compliance incident. Operators\n      // page on\n      //   increase(audit_tamper_detected_total[1h]) > 0\n      // Cardinality: one series per declared audit `provider`.\n      auditTamperDetectedTotal: this.meter.createCounter('audit_tamper_detected_total', {\n        description: 'Compliance audit-log store tamper/rollback detections (durable-state consistency-proof failures)',\n      }),\n\n      // ─── Compliance Audit-Log assurance DEGRADATIONS ────\n      // A tamper-evident audit provider dropped from FULL cross-restart tamper-evidence to a WEAKER\n      // assurance level — ephemeral mode (no durable anchor), a corrupt/unreadable anchor, an un-pinned\n      // server-identity change, or a per-op proof failure. DISTINCT from `audit_tamper_detected_total`\n      // (a PROVEN rollback → page) and `audit_sink_failure_total` (a write hiccup): a degradation means\n      // \"we may not detect a future tamper\" — it should be alerted so the guarantee never lapses silently.\n      // Operators alert on\n      //   increase(audit_integrity_assurance_degraded_total{reason=\"ephemeral\"}[1h]) > 0\n      // Cardinality: one series per (provider, reason) — `reason` is a small fixed slug set.\n      auditIntegrityAssuranceDegradedTotal: this.meter.createCounter('audit_integrity_assurance_degraded_total', {\n        description:\n          'Compliance audit-log assurance degradations (ephemeral / corrupt-anchor / identity-change / per-op proof failure)',\n      }),\n\n      // ─── Compliance Audit-Log LAYER-1 (authoritative DB store) write failures ────\n      // The always-on Layer-1 database audit store (`AuditLogsBackendService._createAuditLog`) threw\n      // while writing the authoritative row. DISTINCT from `audit_sink_failure_total` (a Layer-2\n      // provider sink — immudb/SIEM — hiccup, backfilled by the reconciler): a Layer-1 failure means\n      // the PRIMARY, authoritative audit record itself was NOT persisted — the most severe \"we think\n      // we're auditing but we aren't\" state. Emission is fire-and-forget (audit must never break the\n      // business op), so without this counter the outage is invisible past a swallowed warn line.\n      // Operators alert on\n      //   rate(audit_store_failure_total[5m]) > 0\n      // Cardinality: ONE label-free series (the authoritative store has no provider dimension). The\n      // alert rule is specified in `.claude/plans/alerting-system-design-analysis.md` Appendix D.\n      auditStoreFailureTotal: this.meter.createCounter('audit_store_failure_total', {\n        description: 'Compliance audit-log Layer-1 authoritative DB store write failures (one per _createAuditLog persist throw)',\n      }),\n\n      // ─── Security audit observations DROPPED before the pipeline saw them ────\n      // A fire-and-forget security observation (an operator tenant crossing, an authorization\n      // refusal, a platform-access grant transition) never reached `AuditLogsBackendService` at all:\n      // the service was unbound or its `log*` method absent, the call threw synchronously, or the\n      // returned promise rejected. DISTINCT from `audit_store_failure_total`, which fires INSIDE\n      // `_createAuditLog` and therefore only sees emissions that got that far — the drops counted\n      // here are exactly the ones it structurally cannot see. Fire-and-forget is deliberate and\n      // stays (an observation must never fail the request it observes), so without this counter the\n      // loss is completely silent and \"no operator crossings this week\" is indistinguishable from\n      // \"the audit service has been unbound since Tuesday\". Operators alert on\n      //   increase(audit_observation_dropped_total[15m]) > 0\n      // Cardinality: 3 `observation` × 3 `reason` = 9 series today, both label sets closed enums.\n      auditObservationDroppedTotal: this.meter.createCounter('audit_observation_dropped_total', {\n        description:\n          'Security audit observations dropped before reaching the audit pipeline (service unavailable / emission threw / emission rejected)',\n      }),\n    };\n  }\n\n  // ---------------------------------------------------------------------------\n  // Data Seeding metrics (Phase 6.D / F-17)\n  // ---------------------------------------------------------------------------\n  // Typed wrappers around the four data-seeding counters so the dispatcher\n  // never reaches into the raw OpenTelemetry meter and so all label keys\n  // stay consistent (snake_case to match Prometheus convention; the\n  // dispatcher passes already-stringified enum values).\n  // ---------------------------------------------------------------------------\n\n  /**\n   * LAZY engine — C1 idempotency-probe cache hit. Fired once per\n   * (seed × scope) when `runLazy` short-circuits because a prior\n   * COMPLETED `DataSeedRun` row already covers the scope.\n   */\n  public recordDataSeedingLazyCacheHit(params: { seedKey: string; scopeKind: string }): void {\n    this.metricsDefinitions.dataSeedingLazyC1CacheHits.add(1, {\n      seed_key: params.seedKey,\n      scope_kind: params.scopeKind,\n    });\n  }\n\n  /**\n   * LAZY engine — C1 idempotency-probe cache miss. Fired once per\n   * (seed × scope) when `runLazy` proceeds past the C1 probe and\n   * attempts to acquire a run-slot.\n   */\n  public recordDataSeedingLazyCacheMiss(params: { seedKey: string; scopeKind: string }): void {\n    this.metricsDefinitions.dataSeedingLazyC1CacheMisses.add(1, {\n      seed_key: params.seedKey,\n      scope_kind: params.scopeKind,\n    });\n  }\n\n  /**\n   * LAZY engine — concurrent first-access race resolved by silent\n   * bow-out. `reason` mirrors the dispatcher's\n   * `acquireLazyRunSlotWithRaceGuard` outcome:\n   *   - `concurrent-completed` — a winning concurrent caller already\n   *     wrote a COMPLETED row (data is there);\n   *   - `concurrent-running`   — a winning concurrent caller currently\n   *     owns the RUNNING slot (data is being written).\n   */\n  public recordDataSeedingThunderHerdBowout(params: {\n    seedKey: string;\n    scopeKind: string;\n    reason: 'concurrent-completed' | 'concurrent-running';\n  }): void {\n    this.metricsDefinitions.dataSeedingThunderHerdBowouts.add(1, {\n      seed_key: params.seedKey,\n      scope_kind: params.scopeKind,\n      reason: params.reason,\n    });\n  }\n\n  /**\n   * Terminal `DataSeedRun` write — fired exactly once per row\n   * transition into COMPLETED / PARTIAL / FAILED. The metric is\n   * emitted from the shared lifecycle writers\n   * (`completeDataSeedRun` / `failDataSeedRun` /\n   * `writeFreshFailedDataSeedRun`) so every dispatcher engine —\n   * Level-A application lifecycle, Level-B resource lifecycle, LAZY\n   * first-access, MANUAL re-runs, and the deferred Phase-7 cron —\n   * contributes uniformly without per-engine wiring.\n   *\n   * `mode`, `status`, `triggerOrigin`, and `scopeKind` are passed as\n   * raw enum string values (the dispatcher does the `.toString()`) so\n   * this service stays decoupled from the data-seeding domain enums.\n   *\n   * Phase 5/6 audit H-2 — `scope_kind` was added to align with the\n   * sibling LAZY-engine counters (hit / miss / bow-out) which all\n   * carry it. Without `scope_kind`, operators cannot answer\n   * \"are my org-scoped seeds healthier than my user-scoped seeds?\",\n   * and the deferred Phase-7 cron-scheduler dashboard cannot slice\n   * terminal-run health by scope at all (terminal counts are the\n   * only signal SYNC / ADDITIVE / UPGRADE seeds emit). Cardinality\n   * stays bounded: 5 `DataSeedScopeKind` values × ~200 seeds × 4\n   * modes × 4 statuses × ~6 trigger origins ≈ 96K series upper\n   * bound; in practice <1K active series.\n   */\n  public recordDataSeedingRun(params: {\n    seedKey: string;\n    mode: string;\n    status: string;\n    triggerOrigin: string;\n    scopeKind: string;\n  }): void {\n    this.metricsDefinitions.dataSeedingRunTotal.add(1, {\n      seed_key: params.seedKey,\n      mode: params.mode,\n      status: params.status,\n      trigger_origin: params.triggerOrigin,\n      scope_kind: params.scopeKind,\n    });\n  }\n\n  /**\n   * Wall-clock duration of the admin `GET /internal/admin/data-seeding/seeds`\n   * endpoint in milliseconds. Recorded in the controller around the full\n   * registry walk (which fans out N `lastRun` lookups, one per seed).\n   *\n   * Phase 5/6 audit L-4 — needed because the endpoint is N+1 by design\n   * (single registry-wide aggregate would couple the surface to the\n   * adapter's grammar; see the controller's `lookupLastRunSummary` JSDoc).\n   * The histogram lets operators spot when the seed registry crosses the\n   * \"switch to bulk aggregation\" threshold and surface it as a Phase-7\n   * dashboard SLO alert.\n   *\n   * `seedCount` is bucketed coarsely (0, 1-10, 11-50, 51-200, 201+) so\n   * label cardinality stays bounded across deployments with widely\n   * different seed counts.\n   */\n  public recordDataSeedingAdminListSeedsDuration(params: {\n    durationMs: number;\n    seedCount: number;\n  }): void {\n    const bucket = (() => {\n      if (params.seedCount <= 0) return '0';\n      if (params.seedCount <= 10) return '1-10';\n      if (params.seedCount <= 50) return '11-50';\n      if (params.seedCount <= 200) return '51-200';\n      return '201+';\n    })();\n    this.metricsDefinitions.dataSeedingAdminListSeedsDuration.record(params.durationMs, {\n      seed_count_bucket: bucket,\n    });\n  }\n\n  // ---------------------------------------------------------------------------\n  // M2M Outbound Webhook Delivery metrics (Phase 5 / Step 17)\n  // ---------------------------------------------------------------------------\n  // Typed wrapper around the single `m2m_webhook_delivery_total` counter so\n  // worker call sites never reach into the raw OpenTelemetry meter and so\n  // label keys (`scope` / `outcome`) stay consistent. The `scope` parameter\n  // is locked to the `AuthScopeType` enum (`'organization' | 'application'`)\n  // — passing a typo or a stale string fails type-check rather than silently\n  // creating a parallel time series — and `outcome` maps 1:1 to\n  // `M2MWebhookDeliveryBatchOutput.outcome`.\n  //\n  // Firing contract:\n  //   - Exactly ONCE per worker invocation, at each terminal / intermediate\n  //     return-point in `m2mWebhookDeliveryBatchService.doHandle`.\n  //   - NOT fired from the dispatcher's skip paths (feature off / config\n  //     off / no endpoints) — those never create a delivery row and never\n  //     emit outbound HTTP, so they are not webhook deliveries by\n  //     definition.\n  //\n  // See `.cursor/plans/m2m-webhook-organization-delivery-phase5.md` §D4.\n  // ---------------------------------------------------------------------------\n\n  /**\n   * M2M Outbound Webhook Delivery outcome counter.\n   *\n   * @param params.scope - `AuthScopeType.ORGANIZATION` (`'organization'`)\n   *   or `AuthScopeType.APPLICATION` (`'application'`). Locked to the\n   *   shared `AuthScopeType` enum so a typo or stale literal fails\n   *   type-check rather than silently creating a parallel time series\n   *   under a divergent label.\n   * @param params.outcome - One of the five\n   *   `M2MWebhookDeliveryBatchOutput.outcome` values. `delivered` and\n   *   `failed_terminal` are terminal; `retry_scheduled` is the\n   *   intermediate retry branch; `skipped_missing_row` /\n   *   `skipped_already_leased` cover the two skip branches that still\n   *   consumed a worker slot.\n   */\n  public recordM2MWebhookDeliveryOutcome(params: {\n    scope: AuthScopeType;\n    outcome:\n      | 'delivered'\n      | 'retry_scheduled'\n      | 'failed_terminal'\n      | 'skipped_missing_row'\n      | 'skipped_already_leased';\n  }): void {\n    this.metricsDefinitions.m2mWebhookDeliveryTotal.add(1, {\n      scope: params.scope,\n      outcome: params.outcome,\n    });\n  }\n\n  // ---------------------------------------------------------------------------\n  // Compliance Audit-Log Sink failures (Phase 5 / F6)\n  // ---------------------------------------------------------------------------\n\n  /**\n   * F6 (audit Phase 5) — a Layer-2 provider audit sink threw while recording an\n   * event. Fired by `CompositeAuditLogSink` in its per-sink catch, so an\n   * otherwise-swallowed sink failure is OBSERVABLE (→ alert). Synchronous, never\n   * throws (the global meter is a no-op without the OTLP preload).\n   *\n   * @param params.providerRef - The declared audit provider whose sink failed\n   *   (immudb, a SIEM webhook, …) — the stable, low-cardinality series label.\n   */\n  public recordAuditSinkFailure(params: { providerRef: string }): void {\n    this.metricsDefinitions.auditSinkFailureTotal.add(1, {\n      provider: params.providerRef,\n    });\n  }\n\n  /**\n   * A tamper-evident audit provider PROVED its store was rolled back / tampered between restarts\n   * (its durable-state cryptographic consistency proof failed). Fired by `CompositeAuditLogSink`\n   * via the `onIntegrityViolation` hook it threads into the provider sink factory (the sink cannot\n   * import this service across the dependency wall). DISTINCT from {@link recordAuditSinkFailure}:\n   * this is a compliance incident (page a human), not a backfillable transient miss. Synchronous,\n   * never throws (the global meter is a no-op without the OTLP preload).\n   *\n   * @param params.providerRef - The audit provider whose store proved tampered (immudb, …).\n   */\n  public recordAuditTamperDetected(params: { providerRef: string }): void {\n    this.metricsDefinitions.auditTamperDetectedTotal.add(1, {\n      provider: params.providerRef,\n    });\n  }\n\n  /**\n   * A tamper-evident audit provider DEGRADED from full cross-restart tamper-evidence to a weaker\n   * assurance level (ephemeral mode, a corrupt anchor, an un-pinned server-identity change, or a per-op\n   * proof failure). Fired by `CompositeAuditLogSink` via the `onAssuranceDegraded` hook it threads into\n   * the provider sink factory. DISTINCT from {@link recordAuditTamperDetected}: a degradation is not a\n   * proven tamper, but it means a future tamper may go UNDETECTED — alertable so the guarantee never\n   * lapses silently. Non-latching. Synchronous, never throws.\n   *\n   * @param params.providerRef - The audit provider that degraded (immudb, …).\n   * @param params.reason - Stable snake_case slug (`ephemeral`, `anchor_corrupt`, `anchor_identity_change`, `proof_failure_transient`).\n   */\n  public recordAuditIntegrityAssuranceDegraded(params: { providerRef: string; reason: string }): void {\n    this.metricsDefinitions.auditIntegrityAssuranceDegradedTotal.add(1, {\n      provider: params.providerRef,\n      reason: params.reason,\n    });\n  }\n\n  /**\n   * A-12 — the Layer-1 authoritative DB audit store threw while persisting an event. Fired by\n   * `AuditLogsBackendService._createAuditLog` in its Layer-1 catch, so the \"the primary audit record\n   * itself did not persist\" outage is OBSERVABLE (→ alert) rather than a swallowed warn line on a\n   * fire-and-forget path. DISTINCT from {@link recordAuditSinkFailure}: that is a Layer-2 provider sink\n   * (immudb/SIEM) hiccup the reconciler backfills; THIS is the authoritative store failing. Synchronous,\n   * never throws (the global meter is a no-op without the OTLP preload). Label-free — the authoritative\n   * store has no provider dimension. Alert rule: `alerting-system-design-analysis.md` Appendix D.\n   */\n  public recordAuditStoreFailure(): void {\n    this.metricsDefinitions.auditStoreFailureTotal.add(1);\n  }\n\n  /**\n   * A fire-and-forget security audit observation was DROPPED before it reached the audit pipeline.\n   * Fired by the shared emission seam (`audit-observation-emission.backend.ts`), which every such\n   * observation routes through, so a new observation is counted the day it lands.\n   *\n   * DISTINCT from {@link recordAuditStoreFailure}, and the distinction is the reason this counter\n   * exists: that one fires INSIDE `_createAuditLog`, so it only ever sees an emission that reached\n   * the audit service. The three shapes counted here — an unbound service or absent `log*` method, a\n   * synchronous throw, a rejected promise — never get that far, and were previously invisible.\n   * Merging them into one counter would let a total wiring outage hide behind a store hiccup.\n   *\n   * Synchronous, never throws (the global meter is a no-op without the OTLP preload — which is why\n   * the seam ALSO logs, at a throttled `error`).\n   *\n   * @param params.observation - `AuditObservationKind` member — WHICH security event was lost.\n   * @param params.reason - `AuditObservationLossReason` member — WHICH of the three loss shapes.\n   */\n  public recordAuditObservationDropped(params: { observation: string; reason: string }): void {\n    this.metricsDefinitions.auditObservationDroppedTotal.add(1, {\n      observation: params.observation,\n      reason: params.reason,\n    });\n  }\n}\n"]}

package/dist/esm/monitoring/observability/services/observability.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"observability.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/monitoring/observability/services/observability.backend.service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAEhE,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,uCAAuC,EAAE,MAAM,4FAA4F,CAAC;AACrJ,OAAO,EAAE,mCAAmC,EAAE,MAAM,kEAAkE,CAAC;AAGvH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,qBACa,2BAA2B;IAKpC,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,OAAO,CAAC,QAAQ,CAAC,yBAAyB;IAE1C,OAAO,CAAC,QAAQ,CAAC,qBAAqB;IACtC;;;;OAIG;IAEH,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IAftC,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;gBAI9D,MAAM,EAAE,aAAa,EAErB,yBAAyB,EAAE,uCAAuC,EAElE,qBAAqB,EAAE,mCAAmC;IAC3E;;;;OAIG;IAEc,kBAAkB,CAAC,EAAE,kBAAkB;IAM1D;;;OAGG;IACI,UAAU,IAAI,IAAI;IAiBzB,yEAAyE;IACzE,OAAO,CAAC,SAAS;IAkCjB;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;IA4BzB;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,yBAAyB;CAuBlC"}
+{"version":3,"file":"observability.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/monitoring/observability/services/observability.backend.service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAEhE,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,uCAAuC,EAAE,MAAM,4FAA4F,CAAC;AACrJ,OAAO,EAAE,mCAAmC,EAAE,MAAM,kEAAkE,CAAC;AAGvH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,qBACa,2BAA2B;IAKpC,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,OAAO,CAAC,QAAQ,CAAC,yBAAyB;IAE1C,OAAO,CAAC,QAAQ,CAAC,qBAAqB;IACtC;;;;OAIG;IAEH,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IAftC,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;gBAI9D,MAAM,EAAE,aAAa,EAErB,yBAAyB,EAAE,uCAAuC,EAElE,qBAAqB,EAAE,mCAAmC;IAC3E;;;;OAIG;IAEc,kBAAkB,CAAC,EAAE,kBAAkB;IAM1D;;;OAGG;IACI,UAAU,IAAI,IAAI;IAiBzB,yEAAyE;IACzE,OAAO,CAAC,SAAS;IAkCjB;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;IA4BzB;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,yBAAyB;CAuBlC"}

package/dist/esm/notifications/email/components/email-components.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"email-components.d.ts","sourceRoot":"","sources":["../../../../../../src/notifications/email/components/email-components.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAmB/B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAG5G,YAAY,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAM5G,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,KAAK,EAAE,gBAAgB,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IACzB,MAAM,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;CAC1B;AAED;;;GAGG;AACH,eAAO,MAAM,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC,gBAAgB,CA+BlD,CAAC;AAMF,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,KAAK,EAAE,gBAAgB,CAAC;IACxB,KAAK,CAAC,EAAE,KAAK,CAAC,aAAa,CAAC;CAC7B;AAED;;;GAGG;AACH,eAAO,MAAM,aAAa,EAAE,KAAK,CAAC,EAAE,CAAC,WAAW,CAoB/C,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,KAAK,CAAC,EAAE,CAAC,WAAW,CAqBjD,CAAC;AAMF,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,KAAK,EAAE,gBAAgB,CAAC;IACxB,KAAK,CAAC,EAAE,KAAK,CAAC,aAAa,CAAC;CAC7B;AAED;;GAEG;AACH,eAAO,MAAM,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC,SAAS,CAcpC,CAAC;AAMF,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,gBAAgB,CAAC;IACxB,KAAK,CAAC,EAAE,KAAK,CAAC,aAAa,CAAC;CAC7B;AAED;;GAEG;AACH,eAAO,MAAM,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,YAAY,CAY1C,CAAC;AAMF;;;;;;;;;;;;;;GAcG;AACH,oBAAY,iBAAiB;IAC3B,iFAAiF;IACjF,OAAO,YAAY;IACnB,yEAAyE;IACzE,OAAO,YAAY;IACnB,2EAA2E;IAC3E,KAAK,UAAU;IACf,kEAAkE;IAClE,IAAI,SAAS;CACd;AAED;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,GAAG,iBAAiB,EAAE,CAAC;AAElD,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,YAAY,CAAC;IACtB,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,KAAK,EAAE,gBAAgB,CAAC;IACxB,KAAK,CAAC,EAAE,KAAK,CAAC,aAAa,CAAC;CAC7B;AAED;;GAEG;AACH,eAAO,MAAM,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,aAAa,CAgC5C,CAAC;AAMF,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACtB,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,KAAK,EAAE,gBAAgB,CAAC;IACxB,KAAK,CAAC,EAAE,KAAK,CAAC,aAAa,CAAC;CAC7B;AAED;;GAEG;AACH,eAAO,MAAM,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAwBlD,CAAC;AAEF,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,KAAK,EAAE,gBAAgB,CAAC;IACxB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,KAAK,CAAC,EAAE,KAAK,CAAC,aAAa,CAAC;CAC7B;AAED;;GAEG;AACH,eAAO,MAAM,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,aAAa,CAgB5C,CAAC;AAOF,OAAO,EACL,IAAI,EACJ,IAAI,EACJ,IAAI,EACJ,SAAS,EACT,OAAO,EACP,GAAG,EACH,MAAM,EACN,IAAI,EACJ,MAAM,EACN,IAAI,EACJ,GAAG,EACH,EAAE,EACF,OAAO,EACP,OAAO,GACR,MAAM,yBAAyB,CAAC"}
+{"version":3,"file":"email-components.d.ts","sourceRoot":"","sources":["../../../../../src/notifications/email/components/email-components.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAmB/B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAG5G,YAAY,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAM5G,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,KAAK,EAAE,gBAAgB,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IACzB,MAAM,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;CAC1B;AAED;;;GAGG;AACH,eAAO,MAAM,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC,gBAAgB,CA+BlD,CAAC;AAMF,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,KAAK,EAAE,gBAAgB,CAAC;IACxB,KAAK,CAAC,EAAE,KAAK,CAAC,aAAa,CAAC;CAC7B;AAED;;;GAGG;AACH,eAAO,MAAM,aAAa,EAAE,KAAK,CAAC,EAAE,CAAC,WAAW,CAoB/C,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,KAAK,CAAC,EAAE,CAAC,WAAW,CAqBjD,CAAC;AAMF,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,KAAK,EAAE,gBAAgB,CAAC;IACxB,KAAK,CAAC,EAAE,KAAK,CAAC,aAAa,CAAC;CAC7B;AAED;;GAEG;AACH,eAAO,MAAM,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC,SAAS,CAcpC,CAAC;AAMF,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,gBAAgB,CAAC;IACxB,KAAK,CAAC,EAAE,KAAK,CAAC,aAAa,CAAC;CAC7B;AAED;;GAEG;AACH,eAAO,MAAM,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,YAAY,CAY1C,CAAC;AAMF;;;;;;;;;;;;;;GAcG;AACH,oBAAY,iBAAiB;IAC3B,iFAAiF;IACjF,OAAO,YAAY;IACnB,yEAAyE;IACzE,OAAO,YAAY;IACnB,2EAA2E;IAC3E,KAAK,UAAU;IACf,kEAAkE;IAClE,IAAI,SAAS;CACd;AAED;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,GAAG,iBAAiB,EAAE,CAAC;AAElD,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,YAAY,CAAC;IACtB,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,KAAK,EAAE,gBAAgB,CAAC;IACxB,KAAK,CAAC,EAAE,KAAK,CAAC,aAAa,CAAC;CAC7B;AAED;;GAEG;AACH,eAAO,MAAM,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,aAAa,CAgC5C,CAAC;AAMF,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACtB,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,KAAK,EAAE,gBAAgB,CAAC;IACxB,KAAK,CAAC,EAAE,KAAK,CAAC,aAAa,CAAC;CAC7B;AAED;;GAEG;AACH,eAAO,MAAM,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAwBlD,CAAC;AAEF,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,KAAK,EAAE,gBAAgB,CAAC;IACxB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,KAAK,CAAC,EAAE,KAAK,CAAC,aAAa,CAAC;CAC7B;AAED;;GAEG;AACH,eAAO,MAAM,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,aAAa,CAgB5C,CAAC;AAOF,OAAO,EACL,IAAI,EACJ,IAAI,EACJ,IAAI,EACJ,SAAS,EACT,OAAO,EACP,GAAG,EACH,MAAM,EACN,IAAI,EACJ,MAAM,EACN,IAAI,EACJ,GAAG,EACH,EAAE,EACF,OAAO,EACP,OAAO,GACR,MAAM,yBAAyB,CAAC"}

package/dist/esm/notifications/email/models/email-template-definition.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"email-template-definition.d.ts","sourceRoot":"","sources":["../../../../../../src/notifications/email/models/email-template-definition.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,OAAO,CAAC;AAC1C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAC5G,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE1D;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAC5D,OAAO,EAAE,oBAAoB,CAAC;IAC9B,KAAK,EAAE,gBAAgB,CAAC;IACxB,gEAAgE;IAChE,MAAM,EAAE,CAAC,CAAC;CACX;AAED;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IACjE,+CAA+C;IAC/C,OAAO,EAAE,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC;IAClD,mDAAmD;IACnD,IAAI,EAAE,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC,CAAC,KAAK,YAAY,CAAC;IACrD,+DAA+D;IAC/D,IAAI,CAAC,EAAE,iBAAiB,CAAC;IACzB,mDAAmD;IACnD,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAID;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,uBAAuB,CAAC,GAAG,CAAC,CAAC;IACvC,kEAAkE;IAClE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAChD;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,2BAA2B,GAAG,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;AAC7E,oEAAoE"}
+{"version":3,"file":"email-template-definition.d.ts","sourceRoot":"","sources":["../../../../../src/notifications/email/models/email-template-definition.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,OAAO,CAAC;AAC1C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAC5G,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE1D;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAC5D,OAAO,EAAE,oBAAoB,CAAC;IAC9B,KAAK,EAAE,gBAAgB,CAAC;IACxB,gEAAgE;IAChE,MAAM,EAAE,CAAC,CAAC;CACX;AAED;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IACjE,+CAA+C;IAC/C,OAAO,EAAE,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC;IAClD,mDAAmD;IACnD,IAAI,EAAE,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC,CAAC,KAAK,YAAY,CAAC;IACrD,+DAA+D;IAC/D,IAAI,CAAC,EAAE,iBAAiB,CAAC;IACzB,mDAAmD;IACnD,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAID;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,uBAAuB,CAAC,GAAG,CAAC,CAAC;IACvC,kEAAkE;IAClE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAChD;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,2BAA2B,GAAG,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;AAC7E,oEAAoE"}

package/dist/esm/notifications/email/models/email-transport.backend.definitions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"email-transport.backend.definitions.d.ts","sourceRoot":"","sources":["../../../../../../src/notifications/email/models/email-transport.backend.definitions.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,eAAO,MAAM,mCAAmC,QAAS,CAAC"}
+{"version":3,"file":"email-transport.backend.definitions.d.ts","sourceRoot":"","sources":["../../../../../src/notifications/email/models/email-transport.backend.definitions.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,eAAO,MAAM,mCAAmC,QAAS,CAAC"}

package/dist/esm/notifications/email/services/email-batch-send.batch.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"email-batch-send.batch.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/notifications/email/services/email-batch-send.batch.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAEL,KAAK,sCAAsC,EAC5C,MAAM,4FAA4F,CAAC;AAKpG,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AA0CjE;;GAEG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAqBpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAwB5E;;GAEG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;iBASrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAM9E;;GAEG;AACH,eAAO,MAAM,qBAAqB,EAAE,sCAAsC,CACxE,OAAO,yBAAyB,EAChC,OAAO,0BAA0B,CAmKjC,CAAC"}
+{"version":3,"file":"email-batch-send.batch.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/notifications/email/services/email-batch-send.batch.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAEL,KAAK,sCAAsC,EAC5C,MAAM,4FAA4F,CAAC;AAKpG,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AA0CjE;;GAEG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAqBpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAwB5E;;GAEG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;iBASrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAM9E;;GAEG;AACH,eAAO,MAAM,qBAAqB,EAAE,sCAAsC,CACxE,OAAO,yBAAyB,EAChC,OAAO,0BAA0B,CAmKjC,CAAC"}

package/dist/esm/notifications/email/services/email-template-registry.backend.service.d.ts

@@ -51,9 +51,74 @@ export declare class EmailTemplateRegistryBackendService {
     resolveForConfiguredLocale(templateRef: string): ResolvedEmailTemplate;
     /** Return all registered keys as `{templateRef}/{locale}` (diagnostics). */
     getRegisteredKeys(): string[];
-    private validateSystemTemplates;
+    /**
+     * Report email-template coverage against EVERY locale the application enables, not only the one
+     * it authors natively.
+     *
+     * ## What was wrong
+     *
+     * This check resolved the configured primary locale once and tested only that. An application
+     * that declares `enabledLanguages: [en, fr]` and ships ninety-five `labels.en.ts` files and zero
+     * `labels.fr.ts` files started with a clean log — Wonder Todos, measured 2026-09-08. Every French
+     * recipient then silently received English, because {@link resolve} falls back through the
+     * configured chain and lands on the primary. Nothing anywhere said so: the frontend reads
+     * `enabledLanguages` and the dev companion reads it, but no backend surface did, so "the locale
+     * this application owns" was standing in for "the locales this application serves".
+     *
+     * ## Loudness — a WARNING, deliberately, and not an ERROR
+     *
+     * Enabling a language and authoring its email copy are separate acts that happen in that order:
+     * the copy is produced afterwards by the label/translate pipeline. Refusing to boot on the gap
+     * would mean an application cannot start between the two, which is the exact trade the operation
+     * email-template validator already settled in the other direction — "refusing to START an
+     * application because a notice is unauthored trades a missing email for a total outage, which is
+     * the worse failure" (`collectOperationEmailTemplateIssues`). A missing SECONDARY locale is
+     * strictly milder than the case that reasoning was written about: the notice is still delivered,
+     * in the wrong language.
+     *
+     * That is also why this stays inside the registry rather than being handed to the startup config
+     * validator, whose token-backed path is an ERROR that crash-loops a boot. Widening
+     * {@link resolveForConfiguredLocale} — the seam that validator resolves through — to demand every
+     * enabled locale would have converted "ninety-five emails arrive in English" into "this
+     * application cannot start", for the one application the finding came from.
+     *
+     * The warning is not a shrug: it is emitted per non-covered locale, separates the two severities
+     * below, and names the exact `labels.<locale>.ts` file an author has to create — so it is
+     * actionable from the log line alone rather than after an audit.
+     *
+     * ## The two severities it separates
+     *
+     * - **Primary locale** — nothing to fall back TO. A system ref absent here cannot be rendered at
+     *   all, and the send raises `CONFIGURATION`. This is the pre-existing check, unchanged in
+     *   meaning.
+     * - **Any other enabled locale** — the template resolves, in the wrong language. Reported for
+     *   every registered ref rather than only the twelve system ones, because the population that
+     *   goes untranslated is the whole catalog (83 of Wonder Todos' 95 are resource/operation
+     *   templates, which the system-ref loop cannot see).
+     *
+     * Coverage honours the SAME base-language fallback a runtime send uses, so an application that
+     * ships `fr` and enables `fr-CA` is covered rather than reported. It deliberately does NOT accept
+     * a fallback to the primary locale — landing there is the failure being reported.
+     */
+    private validateTemplateLocaleCoverage;
+    /**
+     * Does this ref have labels a recipient in `locale` would actually receive?
+     *
+     * Mirrors the first two candidates of {@link resolve} — exact locale, then base language — and
+     * stops there on purpose. The remaining candidates (configured fallback, configured primary) are
+     * what make an uncovered locale silent at runtime, so accepting them here would make the check
+     * agree with the defect instead of reporting it.
+     */
+    private hasTemplateForLocale;
     private computeStats;
     private buildNotFoundError;
     private getConfiguredPrimaryLocale;
+    /**
+     * Every locale this application enables, primary first. Delegates to the named config helper so
+     * the registry does not re-derive the enabled set — it is the same question the frontend's
+     * language switcher and the companion's translate pass answer, and three private derivations of
+     * one set is how they come to disagree.
+     */
+    private getConfiguredEnabledLocales;
 }
 //# sourceMappingURL=email-template-registry.backend.service.d.ts.map

package/dist/esm/notifications/email/services/email-template-registry.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"email-template-registry.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/notifications/email/services/email-template-registry.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AACnH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAMpH,OAAO,KAAK,EACV,uBAAuB,EACvB,2BAA2B,EAC5B,MAAM,yEAAyE,CAAC;AAEjF,qFAAqF;AACrF,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,uBAAuB,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,cAAc,EAAE,MAAM,CAAC;CACxB;AAOD,qBACa,mCAAmC;IAMT,OAAO,CAAC,QAAQ,CAAC,MAAM;IACV,OAAO,CAAC,QAAQ,CAAC,YAAY;IAE7E,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IARnC,OAAO,CAAC,OAAO,CAAuD;IAEtE,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;gBAG3B,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EAExF,gBAAgB,EAAE,uBAAuB;IAM5D;;;;;OAKG;IACH,UAAU,CAAC,WAAW,EAAE,2BAA2B,GAAG,IAAI;IAgB1D;;;;;;;;OAQG;IACH,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,qBAAqB;IAiCnH;;;;;OAKG;IACH,0BAA0B,CAAC,WAAW,EAAE,MAAM,GAAG,qBAAqB;IAatE,4EAA4E;IAC5E,iBAAiB,IAAI,MAAM,EAAE;IAY7B,OAAO,CAAC,uBAAuB;IAsB/B,OAAO,CAAC,YAAY;IAYpB,OAAO,CAAC,kBAAkB;IAc1B,OAAO,CAAC,0BAA0B;CAGnC"}
+{"version":3,"file":"email-template-registry.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/notifications/email/services/email-template-registry.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AACnH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAOpH,OAAO,KAAK,EACV,uBAAuB,EACvB,2BAA2B,EAC5B,MAAM,yEAAyE,CAAC;AAEjF,qFAAqF;AACrF,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,uBAAuB,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,cAAc,EAAE,MAAM,CAAC;CACxB;AAOD,qBACa,mCAAmC;IAMT,OAAO,CAAC,QAAQ,CAAC,MAAM;IACV,OAAO,CAAC,QAAQ,CAAC,YAAY;IAE7E,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IARnC,OAAO,CAAC,OAAO,CAAuD;IAEtE,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;gBAG3B,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EAExF,gBAAgB,EAAE,uBAAuB;IAM5D;;;;;OAKG;IACH,UAAU,CAAC,WAAW,EAAE,2BAA2B,GAAG,IAAI;IAgB1D;;;;;;;;OAQG;IACH,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,qBAAqB;IAiCnH;;;;;OAKG;IACH,0BAA0B,CAAC,WAAW,EAAE,MAAM,GAAG,qBAAqB;IAatE,4EAA4E;IAC5E,iBAAiB,IAAI,MAAM,EAAE;IAY7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgDG;IACH,OAAO,CAAC,8BAA8B;IAyCtC;;;;;;;OAOG;IACH,OAAO,CAAC,oBAAoB;IAc5B,OAAO,CAAC,YAAY;IAYpB,OAAO,CAAC,kBAAkB;IAc1B,OAAO,CAAC,0BAA0B;IAIlC;;;;;OAKG;IACH,OAAO,CAAC,2BAA2B;CAGpC"}

package/dist/esm/notifications/email/services/email-template-registry.backend.service.js

@@ -22,7 +22,7 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 };
 import { injectable, inject } from 'inversify';
 import { SAAS_SERVICE_TYPES } from '../../../inject/models/service-types.js';
-import { getConfiguredFallbackLanguage, getConfiguredPrimaryLanguage, } from '../../../config/services/app-configuration.backend.utils.js';
+import { getConfiguredEnabledLanguages, getConfiguredFallbackLanguage, getConfiguredPrimaryLanguage, } from '../../../config/services/app-configuration.backend.utils.js';
 import { ErrorType, getAllSystemTemplateRefs } from '@wildo-ai/saas-models';
 let EmailTemplateRegistryBackendService = class EmailTemplateRegistryBackendService {
     logger;
@@ -54,7 +54,7 @@ let EmailTemplateRegistryBackendService = class EmailTemplateRegistryBackendServ
         }
         const { templateCount, locales } = this.computeStats();
         this.logger.info(`✅ Email template registry: ${templateCount} template(s) across ${locales.size} locale(s)`);
-        this.validateSystemTemplates(locales);
+        this.validateTemplateLocaleCoverage(locales);
     }
     /**
      * Resolve a template by ref with i18n locale fallback.
@@ -116,22 +116,108 @@ let EmailTemplateRegistryBackendService = class EmailTemplateRegistryBackendServ
         return keys;
     }
     // ── Validation ─────────────────────────────────────────────────
-    validateSystemTemplates(registeredLocales) {
+    /**
+     * Report email-template coverage against EVERY locale the application enables, not only the one
+     * it authors natively.
+     *
+     * ## What was wrong
+     *
+     * This check resolved the configured primary locale once and tested only that. An application
+     * that declares `enabledLanguages: [en, fr]` and ships ninety-five `labels.en.ts` files and zero
+     * `labels.fr.ts` files started with a clean log — Wonder Todos, measured 2026-09-08. Every French
+     * recipient then silently received English, because {@link resolve} falls back through the
+     * configured chain and lands on the primary. Nothing anywhere said so: the frontend reads
+     * `enabledLanguages` and the dev companion reads it, but no backend surface did, so "the locale
+     * this application owns" was standing in for "the locales this application serves".
+     *
+     * ## Loudness — a WARNING, deliberately, and not an ERROR
+     *
+     * Enabling a language and authoring its email copy are separate acts that happen in that order:
+     * the copy is produced afterwards by the label/translate pipeline. Refusing to boot on the gap
+     * would mean an application cannot start between the two, which is the exact trade the operation
+     * email-template validator already settled in the other direction — "refusing to START an
+     * application because a notice is unauthored trades a missing email for a total outage, which is
+     * the worse failure" (`collectOperationEmailTemplateIssues`). A missing SECONDARY locale is
+     * strictly milder than the case that reasoning was written about: the notice is still delivered,
+     * in the wrong language.
+     *
+     * That is also why this stays inside the registry rather than being handed to the startup config
+     * validator, whose token-backed path is an ERROR that crash-loops a boot. Widening
+     * {@link resolveForConfiguredLocale} — the seam that validator resolves through — to demand every
+     * enabled locale would have converted "ninety-five emails arrive in English" into "this
+     * application cannot start", for the one application the finding came from.
+     *
+     * The warning is not a shrug: it is emitted per non-covered locale, separates the two severities
+     * below, and names the exact `labels.<locale>.ts` file an author has to create — so it is
+     * actionable from the log line alone rather than after an audit.
+     *
+     * ## The two severities it separates
+     *
+     * - **Primary locale** — nothing to fall back TO. A system ref absent here cannot be rendered at
+     *   all, and the send raises `CONFIGURATION`. This is the pre-existing check, unchanged in
+     *   meaning.
+     * - **Any other enabled locale** — the template resolves, in the wrong language. Reported for
+     *   every registered ref rather than only the twelve system ones, because the population that
+     *   goes untranslated is the whole catalog (83 of Wonder Todos' 95 are resource/operation
+     *   templates, which the system-ref loop cannot see).
+     *
+     * Coverage honours the SAME base-language fallback a runtime send uses, so an application that
+     * ships `fr` and enables `fr-CA` is covered rather than reported. It deliberately does NOT accept
+     * a fallback to the primary locale — landing there is the failure being reported.
+     */
+    validateTemplateLocaleCoverage(registeredLocales) {
         const systemRefs = getAllSystemTemplateRefs();
+        // The primary is asked for by name rather than taken off the front of the enabled set: the
+        // helper does put it first, but the two locales carry DIFFERENT severities below, and a
+        // severity split that depends on array order is one refactor away from being silently wrong.
         const configuredPrimaryLocale = this.getConfiguredPrimaryLocale();
+        const secondaryLocales = this.getConfiguredEnabledLocales().filter((locale) => locale !== configuredPrimaryLocale);
+        const registeredRefs = [...this.entries.keys()];
         if (!registeredLocales.has(configuredPrimaryLocale)) {
             this.logger.warn(`⚠️ No email templates registered for configured primary locale "${configuredPrimaryLocale}".`);
         }
-        const missing = [];
-        for (const ref of systemRefs) {
-            const localeMap = this.entries.get(ref);
-            if (!localeMap?.has(configuredPrimaryLocale)) {
-                missing.push(ref);
+        const missingSystemRefs = systemRefs.filter((ref) => !this.hasTemplateForLocale(ref, configuredPrimaryLocale));
+        if (missingSystemRefs.length > 0) {
+            this.logger.warn(`⚠️ Missing email templates for ${missingSystemRefs.length} system ref(s) in configured primary locale "${configuredPrimaryLocale}": ${missingSystemRefs.join(', ')}`);
+        }
+        for (const locale of secondaryLocales) {
+            const uncovered = registeredRefs.filter((ref) => !this.hasTemplateForLocale(ref, locale));
+            if (uncovered.length === 0) {
+                continue;
             }
+            // Two shapes, because "none of them" and "some of them" have different remedies. When the
+            // whole catalog is uncovered, enumerating it is noise — Wonder Todos would print ninety-five
+            // refs to say "translate everything" — so the headline states the total instead. When only
+            // some are, the names ARE the remedy and are printed.
+            //
+            // Note the totality is measured against `uncovered.length`, not against `registeredLocales`:
+            // that set is exact-match only, so an app shipping `fr` while enabling `fr-CA` would read as
+            // having nothing in `fr-CA` when every one of its templates in fact covers it.
+            if (uncovered.length === registeredRefs.length) {
+                this.logger.warn(`⚠️ No email templates registered for enabled locale "${locale}" — all ${registeredRefs.length} of them fall back to "${configuredPrimaryLocale}", so every email to a "${locale}" recipient is sent in the wrong language. Author labels.${locale}.ts beside each template.`);
+                continue;
+            }
+            this.logger.warn(`⚠️ Missing email templates for ${uncovered.length} ref(s) in enabled locale "${locale}" — these fall back to "${configuredPrimaryLocale}", so a "${locale}" recipient receives them in the wrong language. Create labels.${locale}.ts beside each: ${uncovered.join(', ')}`);
+        }
+    }
+    /**
+     * Does this ref have labels a recipient in `locale` would actually receive?
+     *
+     * Mirrors the first two candidates of {@link resolve} — exact locale, then base language — and
+     * stops there on purpose. The remaining candidates (configured fallback, configured primary) are
+     * what make an uncovered locale silent at runtime, so accepting them here would make the check
+     * agree with the defect instead of reporting it.
+     */
+    hasTemplateForLocale(templateRef, locale) {
+        const localeMap = this.entries.get(templateRef);
+        if (!localeMap) {
+            return false;
         }
-        if (missing.length > 0) {
-            this.logger.warn(`⚠️ Missing email templates for ${missing.length} system ref(s) in configured primary locale "${configuredPrimaryLocale}": ${missing.join(', ')}`);
+        if (localeMap.has(locale)) {
+            return true;
         }
+        const baseLanguage = locale.includes('-') ? locale.split('-')[0] : null;
+        return Boolean(baseLanguage && baseLanguage !== locale && localeMap.has(baseLanguage));
     }
     // ── Helpers ────────────────────────────────────────────────────
     computeStats() {
@@ -157,6 +243,15 @@ let EmailTemplateRegistryBackendService = class EmailTemplateRegistryBackendServ
     getConfiguredPrimaryLocale() {
         return getConfiguredPrimaryLanguage(this.appConfigService.config);
     }
+    /**
+     * Every locale this application enables, primary first. Delegates to the named config helper so
+     * the registry does not re-derive the enabled set — it is the same question the frontend's
+     * language switcher and the companion's translate pass answer, and three private derivations of
+     * one set is how they come to disagree.
+     */
+    getConfiguredEnabledLocales() {
+        return getConfiguredEnabledLanguages(this.appConfigService.config);
+    }
 };
 EmailTemplateRegistryBackendService = __decorate([
     injectable(),

package/dist/esm/notifications/email/services/email-template-registry.backend.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"email-template-registry.backend.service.js","sourceRoot":"","sources":["../../../../../../src/notifications/email/services/email-template-registry.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;;;;;;;;;;;;;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAIpF,OAAO,EACL,6BAA6B,EAC7B,4BAA4B,GAC7B,MAAM,oEAAoE,CAAC;AAC5E,OAAO,EAAE,SAAS,EAAE,wBAAwB,EAA2B,MAAM,uBAAuB,CAAC;AAmB9F,IAAM,mCAAmC,GAAzC,MAAM,mCAAmC;IAMQ;IACa;IAEhD;IARX,OAAO,GAAG,IAAI,GAAG,EAA4C,CAAC;IAE5D,QAAQ,CAA+D;IAEjF,YACsD,MAAqB,EACR,YAAwC,EAExF,gBAAyC;QAHN,WAAM,GAAN,MAAM,CAAe;QACR,iBAAY,GAAZ,YAAY,CAA4B;QAExF,qBAAgB,GAAhB,gBAAgB,CAAyB;QAE1D,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,uBAAuB,CAAC,CAAC;QACjE,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,uBAAuB,EAAE,KAAK,CAAC,CAAC;IAClE,CAAC;IAED;;;;;OAKG;IACH,UAAU,CAAC,WAAwC;QACjD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QAErB,KAAK,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/D,MAAM,SAAS,GAAG,IAAI,GAAG,EAA+B,CAAC;YACzD,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5D,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QAC3C,CAAC;QAED,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACvD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,8BAA8B,aAAa,uBAAuB,OAAO,CAAC,IAAI,YAAY,CAAC,CAAC;QAC7G,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;IAED;;;;;;;;OAQG;IACH,OAAO,CAAC,WAAmB,EAAE,MAAc,EAAE,aAAqB,EAAE,cAAuB;QACzF,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAChD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,kBAAkB,CAAC,WAAW,EAAE,CAAC,MAAM,EAAE,cAAc,EAAE,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QAClI,CAAC;QAED,MAAM,UAAU,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5B,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACxE,IAAI,YAAY,IAAI,YAAY,KAAK,MAAM,EAAE,CAAC;YAC5C,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAChC,CAAC;QACD,IAAI,cAAc,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YAC3D,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAClC,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YACxC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACjC,CAAC;QAED,KAAK,MAAM,eAAe,IAAI,UAAU,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;YAC7C,IAAI,KAAK,EAAE,CAAC;gBACV,IAAI,CAAC,QAAQ,CAAC,mBAAmB,EAAE,EAAE,WAAW,EAAE,cAAc,EAAE,eAAe,EAAE,CAAC,CAAC;gBACrF,OAAO;oBACL,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,cAAc,EAAE,eAAe;iBAChC,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,IAAI,CAAC,kBAAkB,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IACzD,CAAC;IAED;;;;;OAKG;IACH,0BAA0B,CAAC,WAAmB;QAC5C,MAAM,aAAa,GACjB,4BAA4B,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC7D,MAAM,cAAc,GAClB,6BAA6B,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC9D,OAAO,IAAI,CAAC,OAAO,CACjB,WAAW,EACX,aAAa,EACb,aAAa,EACb,cAAc,CACf,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,iBAAiB;QACf,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,KAAK,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACpD,KAAK,MAAM,MAAM,IAAI,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;gBACtC,IAAI,CAAC,IAAI,CAAC,GAAG,WAAW,IAAI,MAAM,EAAE,CAAC,CAAC;YACxC,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,kEAAkE;IAE1D,uBAAuB,CAAC,iBAA8B;QAC5D,MAAM,UAAU,GAAG,wBAAwB,EAAE,CAAC;QAC9C,MAAM,uBAAuB,GAAG,IAAI,CAAC,0BAA0B,EAAE,CAAC;QAClE,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,uBAAuB,CAAC,EAAE,CAAC;YACpD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mEAAmE,uBAAuB,IAAI,CAAC,CAAC;QACnH,CAAC;QAED,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;YAC7B,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACxC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,uBAAuB,CAAC,EAAE,CAAC;gBAC7C,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC;QACH,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kCAAkC,OAAO,CAAC,MAAM,gDAAgD,uBAAuB,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACtK,CAAC;IACH,CAAC;IAED,kEAAkE;IAE1D,YAAY;QAClB,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,IAAI,aAAa,GAAG,CAAC,CAAC;QACtB,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YAC9C,aAAa,IAAI,SAAS,CAAC,IAAI,CAAC;YAChC,KAAK,MAAM,MAAM,IAAI,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;gBACtC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;QACD,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;IACpC,CAAC;IAEO,kBAAkB,CAAC,WAAmB,EAAE,YAAsB;QACpE,OAAO,IAAI,CAAC,YAAY,CAAC,UAAU,CACjC,SAAS,CAAC,aAAa,EACvB,SAAS,EACT;YACE,OAAO,EAAE;gBACP,OAAO,EAAE,mBAAmB,WAAW,+BAA+B,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;gBAChG,WAAW;gBACX,YAAY;aACb;SACF,CACF,CAAC;IACJ,CAAC;IAEO,0BAA0B;QAChC,OAAO,4BAA4B,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACpE,CAAC;CACF,CAAA;AAlKY,mCAAmC;IAD/C,UAAU,EAAE;IAOR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;;GARnC,mCAAmC,CAkK/C","sourcesContent":["/**\n * Email Template Registry Backend Service\n *\n * In-memory registry for file-based email template definitions.\n * Templates are injected at startup from app-custom via initialize().\n * Resolution uses exact templateRef match with i18n locale fallback.\n *\n * Each template is a locale-agnostic definition (`template.tsx`) paired\n * with co-located per-locale label files (`labels.{locale}.ts`).\n */\n\nimport { injectable, inject } from 'inversify';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport type { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport type { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport {\n  getConfiguredFallbackLanguage,\n  getConfiguredPrimaryLanguage,\n} from '~wildo-backend-lib/config/services/app-configuration.backend.utils';\nimport { ErrorType, getAllSystemTemplateRefs, type WildoError_Backend } from '@wildo-ai/saas-models';\nimport type {\n  EmailTemplateDefinition,\n  EmailTemplateDefinitionsMap,\n} from '~wildo-backend-lib/notifications/email/models/email-template-definition';\n\n/** Resolved template returned by `resolve()`: definition + locale-matched labels. */\nexport interface ResolvedEmailTemplate {\n  definition: EmailTemplateDefinition<any>;\n  labels: Record<string, string>;\n  resolvedLocale: string;\n}\n\ninterface RegistryLocaleEntry {\n  definition: EmailTemplateDefinition<any>;\n  labels: Record<string, string>;\n}\n\n@injectable()\nexport class EmailTemplateRegistryBackendService {\n  private entries = new Map<string, Map<string, RegistryLocaleEntry>>();\n\n  protected logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n    @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private readonly errorBuilder: ErrorBuilderBackendService,\n    @inject(SAAS_SERVICE_TYPES.AppConfigService)\n    private readonly appConfigService: AppConfigurationService,\n  ) {\n    this.logDebug = this.logger.debugByType('EmailTemplateRegistry');\n    this.logger.setDebugTypeLogging('EmailTemplateRegistry', false);\n  }\n\n  /**\n   * Populate the registry from the app-custom template map.\n   *\n   * Keys are bare `templateRef` values. Each entry has a locale-agnostic\n   * template definition + per-locale label objects.\n   */\n  initialize(definitions: EmailTemplateDefinitionsMap): void {\n    this.entries.clear();\n\n    for (const [templateRef, entry] of Object.entries(definitions)) {\n      const localeMap = new Map<string, RegistryLocaleEntry>();\n      for (const [locale, labels] of Object.entries(entry.labels)) {\n        localeMap.set(locale, { definition: entry.template, labels });\n      }\n      this.entries.set(templateRef, localeMap);\n    }\n\n    const { templateCount, locales } = this.computeStats();\n    this.logger.info(`✅ Email template registry: ${templateCount} template(s) across ${locales.size} locale(s)`);\n    this.validateSystemTemplates(locales);\n  }\n\n  /**\n   * Resolve a template by ref with i18n locale fallback.\n   *\n   * 1. Exact locale match (e.g. fr-CA)\n   * 2. Base language fallback (e.g. fr)\n   * 3. Configured fallback locale\n   * 4. Configured primary locale\n   * 5. Throw if none found\n   */\n  resolve(templateRef: string, locale: string, primaryLocale: string, fallbackLocale?: string): ResolvedEmailTemplate {\n    const localeMap = this.entries.get(templateRef);\n    if (!localeMap) {\n      throw this.buildNotFoundError(templateRef, [locale, fallbackLocale, primaryLocale].filter((value): value is string => !!value));\n    }\n\n    const candidates = [locale];\n    const baseLanguage = locale.includes('-') ? locale.split('-')[0] : null;\n    if (baseLanguage && baseLanguage !== locale) {\n      candidates.push(baseLanguage);\n    }\n    if (fallbackLocale && !candidates.includes(fallbackLocale)) {\n      candidates.push(fallbackLocale);\n    }\n    if (!candidates.includes(primaryLocale)) {\n      candidates.push(primaryLocale);\n    }\n\n    for (const candidateLocale of candidates) {\n      const entry = localeMap.get(candidateLocale);\n      if (entry) {\n        this.logDebug('Template resolved', { templateRef, resolvedLocale: candidateLocale });\n        return {\n          definition: entry.definition,\n          labels: entry.labels,\n          resolvedLocale: candidateLocale,\n        };\n      }\n    }\n\n    throw this.buildNotFoundError(templateRef, candidates);\n  }\n\n  /**\n   * Resolve exactly as runtime email delivery does for the application's\n   * configured primary/fallback locales. Startup contract validation uses this\n   * seam so template existence is proven against the same locale semantics as\n   * a later send.\n   */\n  resolveForConfiguredLocale(templateRef: string): ResolvedEmailTemplate {\n    const primaryLocale =\n      getConfiguredPrimaryLanguage(this.appConfigService.config);\n    const fallbackLocale =\n      getConfiguredFallbackLanguage(this.appConfigService.config);\n    return this.resolve(\n      templateRef,\n      primaryLocale,\n      primaryLocale,\n      fallbackLocale,\n    );\n  }\n\n  /** Return all registered keys as `{templateRef}/{locale}` (diagnostics). */\n  getRegisteredKeys(): string[] {\n    const keys: string[] = [];\n    for (const [templateRef, localeMap] of this.entries) {\n      for (const locale of localeMap.keys()) {\n        keys.push(`${templateRef}/${locale}`);\n      }\n    }\n    return keys;\n  }\n\n  // ── Validation ─────────────────────────────────────────────────\n\n  private validateSystemTemplates(registeredLocales: Set<string>): void {\n    const systemRefs = getAllSystemTemplateRefs();\n    const configuredPrimaryLocale = this.getConfiguredPrimaryLocale();\n    if (!registeredLocales.has(configuredPrimaryLocale)) {\n      this.logger.warn(`⚠️ No email templates registered for configured primary locale \"${configuredPrimaryLocale}\".`);\n    }\n\n    const missing: string[] = [];\n    for (const ref of systemRefs) {\n      const localeMap = this.entries.get(ref);\n      if (!localeMap?.has(configuredPrimaryLocale)) {\n        missing.push(ref);\n      }\n    }\n\n    if (missing.length > 0) {\n      this.logger.warn(`⚠️ Missing email templates for ${missing.length} system ref(s) in configured primary locale \"${configuredPrimaryLocale}\": ${missing.join(', ')}`);\n    }\n  }\n\n  // ── Helpers ────────────────────────────────────────────────────\n\n  private computeStats(): { templateCount: number; locales: Set<string> } {\n    const locales = new Set<string>();\n    let templateCount = 0;\n    for (const localeMap of this.entries.values()) {\n      templateCount += localeMap.size;\n      for (const locale of localeMap.keys()) {\n        locales.add(locale);\n      }\n    }\n    return { templateCount, locales };\n  }\n\n  private buildNotFoundError(templateRef: string, triedLocales: string[]): WildoError_Backend {\n    return this.errorBuilder.buildError(\n      ErrorType.CONFIGURATION,\n      undefined,\n      {\n        context: {\n          message: `Email template \"${templateRef}\" not found for any locale [${triedLocales.join(', ')}]`,\n          templateRef,\n          triedLocales,\n        },\n      },\n    );\n  }\n\n  private getConfiguredPrimaryLocale(): string {\n    return getConfiguredPrimaryLanguage(this.appConfigService.config);\n  }\n}\n"]}
+{"version":3,"file":"email-template-registry.backend.service.js","sourceRoot":"","sources":["../../../../../src/notifications/email/services/email-template-registry.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;;;;;;;;;;;;;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAIpF,OAAO,EACL,6BAA6B,EAC7B,6BAA6B,EAC7B,4BAA4B,GAC7B,MAAM,oEAAoE,CAAC;AAC5E,OAAO,EAAE,SAAS,EAAE,wBAAwB,EAA2B,MAAM,uBAAuB,CAAC;AAmB9F,IAAM,mCAAmC,GAAzC,MAAM,mCAAmC;IAMQ;IACa;IAEhD;IARX,OAAO,GAAG,IAAI,GAAG,EAA4C,CAAC;IAE5D,QAAQ,CAA+D;IAEjF,YACsD,MAAqB,EACR,YAAwC,EAExF,gBAAyC;QAHN,WAAM,GAAN,MAAM,CAAe;QACR,iBAAY,GAAZ,YAAY,CAA4B;QAExF,qBAAgB,GAAhB,gBAAgB,CAAyB;QAE1D,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,uBAAuB,CAAC,CAAC;QACjE,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,uBAAuB,EAAE,KAAK,CAAC,CAAC;IAClE,CAAC;IAED;;;;;OAKG;IACH,UAAU,CAAC,WAAwC;QACjD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QAErB,KAAK,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/D,MAAM,SAAS,GAAG,IAAI,GAAG,EAA+B,CAAC;YACzD,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5D,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QAC3C,CAAC;QAED,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACvD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,8BAA8B,aAAa,uBAAuB,OAAO,CAAC,IAAI,YAAY,CAAC,CAAC;QAC7G,IAAI,CAAC,8BAA8B,CAAC,OAAO,CAAC,CAAC;IAC/C,CAAC;IAED;;;;;;;;OAQG;IACH,OAAO,CAAC,WAAmB,EAAE,MAAc,EAAE,aAAqB,EAAE,cAAuB;QACzF,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAChD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,kBAAkB,CAAC,WAAW,EAAE,CAAC,MAAM,EAAE,cAAc,EAAE,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QAClI,CAAC;QAED,MAAM,UAAU,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5B,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACxE,IAAI,YAAY,IAAI,YAAY,KAAK,MAAM,EAAE,CAAC;YAC5C,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAChC,CAAC;QACD,IAAI,cAAc,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YAC3D,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAClC,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YACxC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACjC,CAAC;QAED,KAAK,MAAM,eAAe,IAAI,UAAU,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;YAC7C,IAAI,KAAK,EAAE,CAAC;gBACV,IAAI,CAAC,QAAQ,CAAC,mBAAmB,EAAE,EAAE,WAAW,EAAE,cAAc,EAAE,eAAe,EAAE,CAAC,CAAC;gBACrF,OAAO;oBACL,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,cAAc,EAAE,eAAe;iBAChC,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,IAAI,CAAC,kBAAkB,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IACzD,CAAC;IAED;;;;;OAKG;IACH,0BAA0B,CAAC,WAAmB;QAC5C,MAAM,aAAa,GACjB,4BAA4B,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC7D,MAAM,cAAc,GAClB,6BAA6B,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC9D,OAAO,IAAI,CAAC,OAAO,CACjB,WAAW,EACX,aAAa,EACb,aAAa,EACb,cAAc,CACf,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,iBAAiB;QACf,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,KAAK,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACpD,KAAK,MAAM,MAAM,IAAI,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;gBACtC,IAAI,CAAC,IAAI,CAAC,GAAG,WAAW,IAAI,MAAM,EAAE,CAAC,CAAC;YACxC,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,kEAAkE;IAElE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgDG;IACK,8BAA8B,CAAC,iBAA8B;QACnE,MAAM,UAAU,GAAG,wBAAwB,EAAE,CAAC;QAC9C,2FAA2F;QAC3F,wFAAwF;QACxF,6FAA6F;QAC7F,MAAM,uBAAuB,GAAG,IAAI,CAAC,0BAA0B,EAAE,CAAC;QAClE,MAAM,gBAAgB,GAAG,IAAI,CAAC,2BAA2B,EAAE,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,uBAAuB,CAAC,CAAC;QACnH,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAEhD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,uBAAuB,CAAC,EAAE,CAAC;YACpD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mEAAmE,uBAAuB,IAAI,CAAC,CAAC;QACnH,CAAC;QAED,MAAM,iBAAiB,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC,CAAC;QAC/G,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kCAAkC,iBAAiB,CAAC,MAAM,gDAAgD,uBAAuB,MAAM,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1L,CAAC;QAED,KAAK,MAAM,MAAM,IAAI,gBAAgB,EAAE,CAAC;YACtC,MAAM,SAAS,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;YAC1F,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC3B,SAAS;YACX,CAAC;YAED,0FAA0F;YAC1F,6FAA6F;YAC7F,2FAA2F;YAC3F,sDAAsD;YACtD,EAAE;YACF,6FAA6F;YAC7F,6FAA6F;YAC7F,+EAA+E;YAC/E,IAAI,SAAS,CAAC,MAAM,KAAK,cAAc,CAAC,MAAM,EAAE,CAAC;gBAC/C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wDAAwD,MAAM,WAAW,cAAc,CAAC,MAAM,0BAA0B,uBAAuB,2BAA2B,MAAM,4DAA4D,MAAM,2BAA2B,CAAC,CAAC;gBAChS,SAAS;YACX,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kCAAkC,SAAS,CAAC,MAAM,8BAA8B,MAAM,2BAA2B,uBAAuB,YAAY,MAAM,kEAAkE,MAAM,oBAAoB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjS,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACK,oBAAoB,CAAC,WAAmB,EAAE,MAAc;QAC9D,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAChD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACxE,OAAO,OAAO,CAAC,YAAY,IAAI,YAAY,KAAK,MAAM,IAAI,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;IACzF,CAAC;IAED,kEAAkE;IAE1D,YAAY;QAClB,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,IAAI,aAAa,GAAG,CAAC,CAAC;QACtB,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YAC9C,aAAa,IAAI,SAAS,CAAC,IAAI,CAAC;YAChC,KAAK,MAAM,MAAM,IAAI,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;gBACtC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;QACD,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;IACpC,CAAC;IAEO,kBAAkB,CAAC,WAAmB,EAAE,YAAsB;QACpE,OAAO,IAAI,CAAC,YAAY,CAAC,UAAU,CACjC,SAAS,CAAC,aAAa,EACvB,SAAS,EACT;YACE,OAAO,EAAE;gBACP,OAAO,EAAE,mBAAmB,WAAW,+BAA+B,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;gBAChG,WAAW;gBACX,YAAY;aACb;SACF,CACF,CAAC;IACJ,CAAC;IAEO,0BAA0B;QAChC,OAAO,4BAA4B,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACpE,CAAC;IAED;;;;;OAKG;IACK,2BAA2B;QACjC,OAAO,6BAA6B,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACrE,CAAC;CACF,CAAA;AAtQY,mCAAmC;IAD/C,UAAU,EAAE;IAOR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;;GARnC,mCAAmC,CAsQ/C","sourcesContent":["/**\n * Email Template Registry Backend Service\n *\n * In-memory registry for file-based email template definitions.\n * Templates are injected at startup from app-custom via initialize().\n * Resolution uses exact templateRef match with i18n locale fallback.\n *\n * Each template is a locale-agnostic definition (`template.tsx`) paired\n * with co-located per-locale label files (`labels.{locale}.ts`).\n */\n\nimport { injectable, inject } from 'inversify';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport type { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport type { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport {\n  getConfiguredEnabledLanguages,\n  getConfiguredFallbackLanguage,\n  getConfiguredPrimaryLanguage,\n} from '~wildo-backend-lib/config/services/app-configuration.backend.utils';\nimport { ErrorType, getAllSystemTemplateRefs, type WildoError_Backend } from '@wildo-ai/saas-models';\nimport type {\n  EmailTemplateDefinition,\n  EmailTemplateDefinitionsMap,\n} from '~wildo-backend-lib/notifications/email/models/email-template-definition';\n\n/** Resolved template returned by `resolve()`: definition + locale-matched labels. */\nexport interface ResolvedEmailTemplate {\n  definition: EmailTemplateDefinition<any>;\n  labels: Record<string, string>;\n  resolvedLocale: string;\n}\n\ninterface RegistryLocaleEntry {\n  definition: EmailTemplateDefinition<any>;\n  labels: Record<string, string>;\n}\n\n@injectable()\nexport class EmailTemplateRegistryBackendService {\n  private entries = new Map<string, Map<string, RegistryLocaleEntry>>();\n\n  protected logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n    @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private readonly errorBuilder: ErrorBuilderBackendService,\n    @inject(SAAS_SERVICE_TYPES.AppConfigService)\n    private readonly appConfigService: AppConfigurationService,\n  ) {\n    this.logDebug = this.logger.debugByType('EmailTemplateRegistry');\n    this.logger.setDebugTypeLogging('EmailTemplateRegistry', false);\n  }\n\n  /**\n   * Populate the registry from the app-custom template map.\n   *\n   * Keys are bare `templateRef` values. Each entry has a locale-agnostic\n   * template definition + per-locale label objects.\n   */\n  initialize(definitions: EmailTemplateDefinitionsMap): void {\n    this.entries.clear();\n\n    for (const [templateRef, entry] of Object.entries(definitions)) {\n      const localeMap = new Map<string, RegistryLocaleEntry>();\n      for (const [locale, labels] of Object.entries(entry.labels)) {\n        localeMap.set(locale, { definition: entry.template, labels });\n      }\n      this.entries.set(templateRef, localeMap);\n    }\n\n    const { templateCount, locales } = this.computeStats();\n    this.logger.info(`✅ Email template registry: ${templateCount} template(s) across ${locales.size} locale(s)`);\n    this.validateTemplateLocaleCoverage(locales);\n  }\n\n  /**\n   * Resolve a template by ref with i18n locale fallback.\n   *\n   * 1. Exact locale match (e.g. fr-CA)\n   * 2. Base language fallback (e.g. fr)\n   * 3. Configured fallback locale\n   * 4. Configured primary locale\n   * 5. Throw if none found\n   */\n  resolve(templateRef: string, locale: string, primaryLocale: string, fallbackLocale?: string): ResolvedEmailTemplate {\n    const localeMap = this.entries.get(templateRef);\n    if (!localeMap) {\n      throw this.buildNotFoundError(templateRef, [locale, fallbackLocale, primaryLocale].filter((value): value is string => !!value));\n    }\n\n    const candidates = [locale];\n    const baseLanguage = locale.includes('-') ? locale.split('-')[0] : null;\n    if (baseLanguage && baseLanguage !== locale) {\n      candidates.push(baseLanguage);\n    }\n    if (fallbackLocale && !candidates.includes(fallbackLocale)) {\n      candidates.push(fallbackLocale);\n    }\n    if (!candidates.includes(primaryLocale)) {\n      candidates.push(primaryLocale);\n    }\n\n    for (const candidateLocale of candidates) {\n      const entry = localeMap.get(candidateLocale);\n      if (entry) {\n        this.logDebug('Template resolved', { templateRef, resolvedLocale: candidateLocale });\n        return {\n          definition: entry.definition,\n          labels: entry.labels,\n          resolvedLocale: candidateLocale,\n        };\n      }\n    }\n\n    throw this.buildNotFoundError(templateRef, candidates);\n  }\n\n  /**\n   * Resolve exactly as runtime email delivery does for the application's\n   * configured primary/fallback locales. Startup contract validation uses this\n   * seam so template existence is proven against the same locale semantics as\n   * a later send.\n   */\n  resolveForConfiguredLocale(templateRef: string): ResolvedEmailTemplate {\n    const primaryLocale =\n      getConfiguredPrimaryLanguage(this.appConfigService.config);\n    const fallbackLocale =\n      getConfiguredFallbackLanguage(this.appConfigService.config);\n    return this.resolve(\n      templateRef,\n      primaryLocale,\n      primaryLocale,\n      fallbackLocale,\n    );\n  }\n\n  /** Return all registered keys as `{templateRef}/{locale}` (diagnostics). */\n  getRegisteredKeys(): string[] {\n    const keys: string[] = [];\n    for (const [templateRef, localeMap] of this.entries) {\n      for (const locale of localeMap.keys()) {\n        keys.push(`${templateRef}/${locale}`);\n      }\n    }\n    return keys;\n  }\n\n  // ── Validation ─────────────────────────────────────────────────\n\n  /**\n   * Report email-template coverage against EVERY locale the application enables, not only the one\n   * it authors natively.\n   *\n   * ## What was wrong\n   *\n   * This check resolved the configured primary locale once and tested only that. An application\n   * that declares `enabledLanguages: [en, fr]` and ships ninety-five `labels.en.ts` files and zero\n   * `labels.fr.ts` files started with a clean log — Wonder Todos, measured 2026-09-08. Every French\n   * recipient then silently received English, because {@link resolve} falls back through the\n   * configured chain and lands on the primary. Nothing anywhere said so: the frontend reads\n   * `enabledLanguages` and the dev companion reads it, but no backend surface did, so \"the locale\n   * this application owns\" was standing in for \"the locales this application serves\".\n   *\n   * ## Loudness — a WARNING, deliberately, and not an ERROR\n   *\n   * Enabling a language and authoring its email copy are separate acts that happen in that order:\n   * the copy is produced afterwards by the label/translate pipeline. Refusing to boot on the gap\n   * would mean an application cannot start between the two, which is the exact trade the operation\n   * email-template validator already settled in the other direction — \"refusing to START an\n   * application because a notice is unauthored trades a missing email for a total outage, which is\n   * the worse failure\" (`collectOperationEmailTemplateIssues`). A missing SECONDARY locale is\n   * strictly milder than the case that reasoning was written about: the notice is still delivered,\n   * in the wrong language.\n   *\n   * That is also why this stays inside the registry rather than being handed to the startup config\n   * validator, whose token-backed path is an ERROR that crash-loops a boot. Widening\n   * {@link resolveForConfiguredLocale} — the seam that validator resolves through — to demand every\n   * enabled locale would have converted \"ninety-five emails arrive in English\" into \"this\n   * application cannot start\", for the one application the finding came from.\n   *\n   * The warning is not a shrug: it is emitted per non-covered locale, separates the two severities\n   * below, and names the exact `labels.<locale>.ts` file an author has to create — so it is\n   * actionable from the log line alone rather than after an audit.\n   *\n   * ## The two severities it separates\n   *\n   * - **Primary locale** — nothing to fall back TO. A system ref absent here cannot be rendered at\n   *   all, and the send raises `CONFIGURATION`. This is the pre-existing check, unchanged in\n   *   meaning.\n   * - **Any other enabled locale** — the template resolves, in the wrong language. Reported for\n   *   every registered ref rather than only the twelve system ones, because the population that\n   *   goes untranslated is the whole catalog (83 of Wonder Todos' 95 are resource/operation\n   *   templates, which the system-ref loop cannot see).\n   *\n   * Coverage honours the SAME base-language fallback a runtime send uses, so an application that\n   * ships `fr` and enables `fr-CA` is covered rather than reported. It deliberately does NOT accept\n   * a fallback to the primary locale — landing there is the failure being reported.\n   */\n  private validateTemplateLocaleCoverage(registeredLocales: Set<string>): void {\n    const systemRefs = getAllSystemTemplateRefs();\n    // The primary is asked for by name rather than taken off the front of the enabled set: the\n    // helper does put it first, but the two locales carry DIFFERENT severities below, and a\n    // severity split that depends on array order is one refactor away from being silently wrong.\n    const configuredPrimaryLocale = this.getConfiguredPrimaryLocale();\n    const secondaryLocales = this.getConfiguredEnabledLocales().filter((locale) => locale !== configuredPrimaryLocale);\n    const registeredRefs = [...this.entries.keys()];\n\n    if (!registeredLocales.has(configuredPrimaryLocale)) {\n      this.logger.warn(`⚠️ No email templates registered for configured primary locale \"${configuredPrimaryLocale}\".`);\n    }\n\n    const missingSystemRefs = systemRefs.filter((ref) => !this.hasTemplateForLocale(ref, configuredPrimaryLocale));\n    if (missingSystemRefs.length > 0) {\n      this.logger.warn(`⚠️ Missing email templates for ${missingSystemRefs.length} system ref(s) in configured primary locale \"${configuredPrimaryLocale}\": ${missingSystemRefs.join(', ')}`);\n    }\n\n    for (const locale of secondaryLocales) {\n      const uncovered = registeredRefs.filter((ref) => !this.hasTemplateForLocale(ref, locale));\n      if (uncovered.length === 0) {\n        continue;\n      }\n\n      // Two shapes, because \"none of them\" and \"some of them\" have different remedies. When the\n      // whole catalog is uncovered, enumerating it is noise — Wonder Todos would print ninety-five\n      // refs to say \"translate everything\" — so the headline states the total instead. When only\n      // some are, the names ARE the remedy and are printed.\n      //\n      // Note the totality is measured against `uncovered.length`, not against `registeredLocales`:\n      // that set is exact-match only, so an app shipping `fr` while enabling `fr-CA` would read as\n      // having nothing in `fr-CA` when every one of its templates in fact covers it.\n      if (uncovered.length === registeredRefs.length) {\n        this.logger.warn(`⚠️ No email templates registered for enabled locale \"${locale}\" — all ${registeredRefs.length} of them fall back to \"${configuredPrimaryLocale}\", so every email to a \"${locale}\" recipient is sent in the wrong language. Author labels.${locale}.ts beside each template.`);\n        continue;\n      }\n\n      this.logger.warn(`⚠️ Missing email templates for ${uncovered.length} ref(s) in enabled locale \"${locale}\" — these fall back to \"${configuredPrimaryLocale}\", so a \"${locale}\" recipient receives them in the wrong language. Create labels.${locale}.ts beside each: ${uncovered.join(', ')}`);\n    }\n  }\n\n  /**\n   * Does this ref have labels a recipient in `locale` would actually receive?\n   *\n   * Mirrors the first two candidates of {@link resolve} — exact locale, then base language — and\n   * stops there on purpose. The remaining candidates (configured fallback, configured primary) are\n   * what make an uncovered locale silent at runtime, so accepting them here would make the check\n   * agree with the defect instead of reporting it.\n   */\n  private hasTemplateForLocale(templateRef: string, locale: string): boolean {\n    const localeMap = this.entries.get(templateRef);\n    if (!localeMap) {\n      return false;\n    }\n    if (localeMap.has(locale)) {\n      return true;\n    }\n    const baseLanguage = locale.includes('-') ? locale.split('-')[0] : null;\n    return Boolean(baseLanguage && baseLanguage !== locale && localeMap.has(baseLanguage));\n  }\n\n  // ── Helpers ────────────────────────────────────────────────────\n\n  private computeStats(): { templateCount: number; locales: Set<string> } {\n    const locales = new Set<string>();\n    let templateCount = 0;\n    for (const localeMap of this.entries.values()) {\n      templateCount += localeMap.size;\n      for (const locale of localeMap.keys()) {\n        locales.add(locale);\n      }\n    }\n    return { templateCount, locales };\n  }\n\n  private buildNotFoundError(templateRef: string, triedLocales: string[]): WildoError_Backend {\n    return this.errorBuilder.buildError(\n      ErrorType.CONFIGURATION,\n      undefined,\n      {\n        context: {\n          message: `Email template \"${templateRef}\" not found for any locale [${triedLocales.join(', ')}]`,\n          templateRef,\n          triedLocales,\n        },\n      },\n    );\n  }\n\n  private getConfiguredPrimaryLocale(): string {\n    return getConfiguredPrimaryLanguage(this.appConfigService.config);\n  }\n\n  /**\n   * Every locale this application enables, primary first. Delegates to the named config helper so\n   * the registry does not re-derive the enabled set — it is the same question the frontend's\n   * language switcher and the companion's translate pass answer, and three private derivations of\n   * one set is how they come to disagree.\n   */\n  private getConfiguredEnabledLocales(): string[] {\n    return getConfiguredEnabledLanguages(this.appConfigService.config);\n  }\n}\n"]}

package/dist/esm/notifications/email/services/email-template-validator.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"email-template-validator.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/notifications/email/services/email-template-validator.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAMlG,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAMD;;;GAGG;AACH,eAAO,MAAM,8BAA8B,EAAE,MAAM,EAYlD,CAAC;AA0CF,qBACa,oCAAoC;IAIV,OAAO,CAAC,QAAQ,CAAC,MAAM;IAH5D,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;gBAG3B,MAAM,EAAE,aAAa;IAM3E;;;;;OAKG;IACG,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAyC/D;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAc9B;;OAEG;IACH,OAAO,CAAC,eAAe;IA2BvB;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IAsBhC;;OAEG;YACW,WAAW;IAwCzB;;OAEG;IACH,iBAAiB,IAAI,MAAM,EAAE;CAG9B"}
+{"version":3,"file":"email-template-validator.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/notifications/email/services/email-template-validator.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAMlG,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAMD;;;GAGG;AACH,eAAO,MAAM,8BAA8B,EAAE,MAAM,EAqBlD,CAAC;AA0CF,qBACa,oCAAoC;IAIV,OAAO,CAAC,QAAQ,CAAC,MAAM;IAH5D,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;gBAG3B,MAAM,EAAE,aAAa;IAM3E;;;;;OAKG;IACG,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAyC/D;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAc9B;;OAEG;IACH,OAAO,CAAC,eAAe;IA2BvB;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IAsBhC;;OAEG;YACW,WAAW;IAwCzB;;OAEG;IACH,iBAAiB,IAAI,MAAM,EAAE;CAG9B"}

package/dist/esm/notifications/email/services/email-template-validator.backend.service.js

@@ -32,7 +32,16 @@ export const EMAIL_TEMPLATE_ALLOWED_IMPORTS = [
     // React Email core
     '@react-email/components',
     '@react-email/render',
-    // Our predefined email components
+    // Our predefined email components. Exported from the package root
+    // (`saas-backend-lib/src/index.ts`) so an application's authored template can import it —
+    // and it is why `InversifyContainer` is aliased there, to avoid the clash with React Email's
+    // own `Container` re-exported from this module.
+    //
+    // NOTE (#475, 2026-09-08): the email-template SANDBOX used to be the thing that resolved this
+    // specifier at runtime, and it was deleted as unreachable. Permitting the import here is
+    // therefore no longer backed by a loader inside the engine; an application template importing
+    // it resolves through its own bundler against the package root export. Keep the entry — the
+    // export is public API — but do not read it as evidence that the engine loads the module.
     '@wildo-ai/email-components',
     // App-owned runtime helpers used by the filesystem email template pattern
     '@wildo-ai/saas-backend-lib',