npm - @wildo-ai/saas-backend-lib - Versions diffs - 1.1.2 → 1.1.4 - Mend

@wildo-ai/saas-backend-lib 1.1.2 → 1.1.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1358) hide show

package/dist/esm/compliance/audit-trails/services/utils/siem-projection-contract.backend.utils.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"siem-projection-contract.backend.utils.d.ts","sourceRoot":"","sources":["~~../../../../../../../~~src/compliance/audit-trails/services/utils/siem-projection-contract.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,EAAE,kBAAkB,EAAE,KAAK,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AAC5F,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAE/E;;;;;;;;GAQG;AACH,MAAM,WAAW,qBAAqB,CAAC,CAAC,SAAS,MAAM;IACrD,yFAAyF;IACzF,QAAQ,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC;IACjD;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,EAAE,CAAC,GAAG,SAAS,EAAE,SAAS,MAAM,EAAE,KAAK,MAAM,CAAC;IAC3D,iGAAiG;IACjG,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;CAC9C;AAED;;;;;;GAMG;AACH,oBAAY,uBAAuB;IACjC,+EAA+E;IAC/E,SAAS,cAAc;IACvB,oDAAoD;IACpD,MAAM,WAAW;IACjB,2DAA2D;IAC3D,aAAa,kBAAkB;CAChC;AAED,sDAAsD;AACtD,MAAM,MAAM,mBAAmB,CAAC,CAAC,EAAE,CAAC,SAAS,MAAM,IAC/C;IACE,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC,SAAS,CAAC;IACjD;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC;IAC5B,6FAA6F;IAC7F,QAAQ,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,qBAAqB,CAAC,CAAC,CAAC,KAAK,MAAM,GAAG,SAAS,CAAC;CACzF,GACD;IACE;;;;;;;;OAQG;IACH,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC,MAAM,CAAC;IAC9C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC,aAAa,CAAC;IACrD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;AAEN;;;GAGG;AACH,MAAM,MAAM,sBAAsB,CAAC,CAAC,EAAE,CAAC,SAAS,MAAM,GAAG,MAAM,IAAI;IACjE,QAAQ,EAAE,CAAC,IAAI,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,mBAAmB,CAAC,CAAC,EAAE,CAAC,CAAC;CAC/D,CAAC;AAEF,+FAA+F;AAC/F,wBAAgB,YAAY,CAAC,CAAC,SAAS,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,mBAAmB,CAAC,0BAA0B,EAAE,CAAC,CAAC,CAEjH;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,kBAAkB,GAAG,MAAM,CAUlF;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,0BAA0B,YAAY,CAAC;AAEpD,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,kBAAkB,GAAG,SAAS,GAAG,MAAM,CAE5F;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,MAAM,CAUzE;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,4BAA4B,iCAAiC,CAAC;AAE3E;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAGnE;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB,QAGuC,CAAC;AAEvE;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,wBAAwB,QAWe,CAAC;AAErD;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,cAAc,EAAE,sBAAsB,CAAC,0BAA0B,EAAE,UAAU,CA8GzF,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,eAAe,EAAE,sBAAsB,CAAC,0BAA0B,EAAE,WAAW,CAiE3F,CAAC"}
1	+ {"version":3,"file":"siem-projection-contract.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../../src/compliance/audit-trails/services/utils/siem-projection-contract.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,EAAE,kBAAkB,EAAE,KAAK,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AAC5F,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAE/E;;;;;;;;GAQG;AACH,MAAM,WAAW,qBAAqB,CAAC,CAAC,SAAS,MAAM;IACrD,yFAAyF;IACzF,QAAQ,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC;IACjD;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,EAAE,CAAC,GAAG,SAAS,EAAE,SAAS,MAAM,EAAE,KAAK,MAAM,CAAC;IAC3D,iGAAiG;IACjG,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;CAC9C;AAED;;;;;;GAMG;AACH,oBAAY,uBAAuB;IACjC,+EAA+E;IAC/E,SAAS,cAAc;IACvB,oDAAoD;IACpD,MAAM,WAAW;IACjB,2DAA2D;IAC3D,aAAa,kBAAkB;CAChC;AAED,sDAAsD;AACtD,MAAM,MAAM,mBAAmB,CAAC,CAAC,EAAE,CAAC,SAAS,MAAM,IAC/C;IACE,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC,SAAS,CAAC;IACjD;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC;IAC5B,6FAA6F;IAC7F,QAAQ,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,qBAAqB,CAAC,CAAC,CAAC,KAAK,MAAM,GAAG,SAAS,CAAC;CACzF,GACD;IACE;;;;;;;;OAQG;IACH,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC,MAAM,CAAC;IAC9C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC,aAAa,CAAC;IACrD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;AAEN;;;GAGG;AACH,MAAM,MAAM,sBAAsB,CAAC,CAAC,EAAE,CAAC,SAAS,MAAM,GAAG,MAAM,IAAI;IACjE,QAAQ,EAAE,CAAC,IAAI,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,mBAAmB,CAAC,CAAC,EAAE,CAAC,CAAC;CAC/D,CAAC;AAEF,+FAA+F;AAC/F,wBAAgB,YAAY,CAAC,CAAC,SAAS,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,mBAAmB,CAAC,0BAA0B,EAAE,CAAC,CAAC,CAEjH;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,kBAAkB,GAAG,MAAM,CAUlF;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,0BAA0B,YAAY,CAAC;AAEpD,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,kBAAkB,GAAG,SAAS,GAAG,MAAM,CAE5F;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,MAAM,CAUzE;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,4BAA4B,iCAAiC,CAAC;AAE3E;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAGnE;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB,QAGuC,CAAC;AAEvE;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,wBAAwB,QAWe,CAAC;AAErD;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,cAAc,EAAE,sBAAsB,CAAC,0BAA0B,EAAE,UAAU,CA8GzF,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,eAAe,EAAE,sBAAsB,CAAC,0BAA0B,EAAE,WAAW,CAiE3F,CAAC"}

package/dist/esm/compliance/audit-trails/utils/audit-actor.backend.utils.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"audit-actor.backend.utils.d.ts","sourceRoot":"","sources":["~~../../../../../../~~src/compliance/audit-trails/utils/audit-actor.backend.utils.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAE5G;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,mBAAmB,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG,SAAS,GAAG,MAAM,CAoB/F"}
1	+ {"version":3,"file":"audit-actor.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/audit-trails/utils/audit-actor.backend.utils.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAE5G;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,mBAAmB,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG,SAAS,GAAG,MAAM,CAoB/F"}

package/dist/esm/compliance/audit-trails/utils/layer2-audit-provider-boot-diagnostic.backend.utils.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"layer2-audit-provider-boot-diagnostic.backend.utils.d.ts","sourceRoot":"","sources":["~~../../../../../../~~src/compliance/audit-trails/utils/layer2-audit-provider-boot-diagnostic.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,qCAAqC,CAAC,KAAK,EAAE;IAC3D;;;;;OAKG;IACH,yCAAyC,EAAE,OAAO,CAAC;IACnD;;;OAGG;IACH,2BAA2B,EAAE,OAAO,CAAC;IACrC;;;;OAIG;IACH,6BAA6B,EAAE,MAAM,CAAC;CACvC,GAAG,OAAO,CAMV"}
1	+ {"version":3,"file":"layer2-audit-provider-boot-diagnostic.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/audit-trails/utils/layer2-audit-provider-boot-diagnostic.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,qCAAqC,CAAC,KAAK,EAAE;IAC3D;;;;;OAKG;IACH,yCAAyC,EAAE,OAAO,CAAC;IACnD;;;OAGG;IACH,2BAA2B,EAAE,OAAO,CAAC;IACrC;;;;OAIG;IACH,6BAA6B,EAAE,MAAM,CAAC;CACvC,GAAG,OAAO,CAMV"}

package/dist/esm/compliance/index.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["~~../../../../~~src/compliance/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC"}
1	+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/compliance/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC"}

package/dist/esm/compliance/privacy/retention-hide-predicate.backend.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"retention-hide-predicate.backend.d.ts","sourceRoot":"","sources":["~~../../../../../~~src/compliance/privacy/retention-hide-predicate.backend.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE/E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DG;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,oBAAoB,CAAC;AAE7D;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,EAAE,eAA0C,CAAC;AAEjF;;;;;;GAMG;AACH,eAAO,MAAM,kDAAkD,EAAE,SAAS,qBAAqB,EAK9F,CAAC;AAEF;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;CACpC;AAED;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;CACnC;AAED;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CACzC,qBAAqB,EAAE,yBAAyB,GAAG,SAAS,GAAG,IAAI,GAClE,OAAO,CAET;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,IAAI,eAAe,EAAE,CAE/D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iCAAiC,IAAI,eAAe,GAAG,SAAS,CAG/E;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,8BAA8B,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAExE;AAED;;;;;;;;;GASG;AACH,wBAAgB,qCAAqC,CACnD,gBAAgB,EAAE,yBAAyB,EAC3C,qBAAqB,EAAE,qBAAqB,GAC3C,OAAO,CAGT;AAED;;;;;;;;;GASG;AACH,wBAAgB,4CAA4C,CAC1D,gBAAgB,EAAE,yBAAyB,GAAG,SAAS,GACtD,OAAO,CAET;AAOD;;;;;;;;;;GAUG;AACH,wBAAgB,gCAAgC,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAE1E;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9E,MAAM,EAAE,OAAO,GACd,OAAO,CAET;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,SAAS,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,IAAI,CAEzF;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,+BAA+B,CAAC,OAAO,SAAS,MAAM,EACpE,MAAM,EAAE,OAAO,EACf,qBAAqB,EAAE,yBAAyB,GAAG,SAAS,GAAG,IAAI,EACnE,gBAAgB,EAAE,yBAAyB,EAC3C,qBAAqB,EAAE,qBAAqB,GAC3C,OAAO,CAKT;AAMD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yCAAyC,CACvD,aAAa,EAAE,eAAe,GAC7B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzB;AAED;;;;;;;GAOG;AACH,wBAAgB,yCAAyC,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEnF;AAED;;;;;;;;;GASG;AACH,wBAAgB,iCAAiC,CAC/C,aAAa,EAAE,eAAe,GAC7B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzB;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,qCAAqC,CACnD,eAAe,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,MAAM,GAC9C,MAAM,CAER"}
1	+ {"version":3,"file":"retention-hide-predicate.backend.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/retention-hide-predicate.backend.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE/E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DG;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,oBAAoB,CAAC;AAE7D;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,EAAE,eAA0C,CAAC;AAEjF;;;;;;GAMG;AACH,eAAO,MAAM,kDAAkD,EAAE,SAAS,qBAAqB,EAK9F,CAAC;AAEF;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;CACpC;AAED;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;CACnC;AAED;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CACzC,qBAAqB,EAAE,yBAAyB,GAAG,SAAS,GAAG,IAAI,GAClE,OAAO,CAET;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,IAAI,eAAe,EAAE,CAE/D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iCAAiC,IAAI,eAAe,GAAG,SAAS,CAG/E;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,8BAA8B,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAExE;AAED;;;;;;;;;GASG;AACH,wBAAgB,qCAAqC,CACnD,gBAAgB,EAAE,yBAAyB,EAC3C,qBAAqB,EAAE,qBAAqB,GAC3C,OAAO,CAGT;AAED;;;;;;;;;GASG;AACH,wBAAgB,4CAA4C,CAC1D,gBAAgB,EAAE,yBAAyB,GAAG,SAAS,GACtD,OAAO,CAET;AAOD;;;;;;;;;;GAUG;AACH,wBAAgB,gCAAgC,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAE1E;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9E,MAAM,EAAE,OAAO,GACd,OAAO,CAET;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,SAAS,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,IAAI,CAEzF;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,+BAA+B,CAAC,OAAO,SAAS,MAAM,EACpE,MAAM,EAAE,OAAO,EACf,qBAAqB,EAAE,yBAAyB,GAAG,SAAS,GAAG,IAAI,EACnE,gBAAgB,EAAE,yBAAyB,EAC3C,qBAAqB,EAAE,qBAAqB,GAC3C,OAAO,CAKT;AAMD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yCAAyC,CACvD,aAAa,EAAE,eAAe,GAC7B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzB;AAED;;;;;;;GAOG;AACH,wBAAgB,yCAAyC,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEnF;AAED;;;;;;;;;GASG;AACH,wBAAgB,iCAAiC,CAC/C,aAAa,EAAE,eAAe,GAC7B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzB;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,qCAAqC,CACnD,eAAe,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,MAAM,GAC9C,MAAM,CAER"}

package/dist/esm/compliance/privacy/services/subject-erasure-external-effects.backend.service.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"subject-erasure-external-effects.backend.service.d.ts","sourceRoot":"","sources":["~~../../../../../../~~src/compliance/privacy/services/subject-erasure-external-effects.backend.service.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,mCAAmC,EACzC,MAAM,uBAAuB,CAAC;AAE/B;;;;;;;;;GASG;AACH,MAAM,WAAW,mCAAmC;IAClD,mBAAmB,EAAE,YAAY,CAAC;IAClC,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,YAAY,CAAC,EAAE;QAAE,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACrF;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,4BAA4B;IAC3C,6EAA6E;IAC7E,SAAS,EAAE,MAAM,CAAC;IAClB,0DAA0D;IAC1D,SAAS,CAAC,mBAAmB,EAAE,YAAY,GAAG,OAAO,CAAC;IACtD,GAAG,CAAC,OAAO,EAAE,mCAAmC,GAAG,OAAO,CAAC,mCAAmC,CAAC,CAAC;CACjG;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBACa,mDAAmD;IAC9D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAsC;IAE9D;;;OAGG;IACI,QAAQ,CAAC,MAAM,EAAE,4BAA4B,GAAG,IAAI;IAS3D,6FAA6F;IACtF,UAAU,CAAC,mBAAmB,EAAE,YAAY,GAAG,4BAA4B,EAAE;IAIpF;;;;;;OAMG;IACU,MAAM,CACjB,OAAO,EAAE,mCAAmC,EAC5C,WAAW,GAAE,MAAU,GACtB,OAAO,CAAC,mCAAmC,EAAE,CAAC;YAWnC,MAAM;CAgCrB;AAED;;;;;;GAMG;AACH,wBAAgB,+BAA+B,CAC7C,QAAQ,EAAE,SAAS,mCAAmC,EAAE,GACvD,mCAAmC,EAAE,CAEvC"}
1	+ {"version":3,"file":"subject-erasure-external-effects.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/services/subject-erasure-external-effects.backend.service.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,mCAAmC,EACzC,MAAM,uBAAuB,CAAC;AAE/B;;;;;;;;;GASG;AACH,MAAM,WAAW,mCAAmC;IAClD,mBAAmB,EAAE,YAAY,CAAC;IAClC,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,YAAY,CAAC,EAAE;QAAE,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACrF;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,4BAA4B;IAC3C,6EAA6E;IAC7E,SAAS,EAAE,MAAM,CAAC;IAClB,0DAA0D;IAC1D,SAAS,CAAC,mBAAmB,EAAE,YAAY,GAAG,OAAO,CAAC;IACtD,GAAG,CAAC,OAAO,EAAE,mCAAmC,GAAG,OAAO,CAAC,mCAAmC,CAAC,CAAC;CACjG;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBACa,mDAAmD;IAC9D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAsC;IAE9D;;;OAGG;IACI,QAAQ,CAAC,MAAM,EAAE,4BAA4B,GAAG,IAAI;IAS3D,6FAA6F;IACtF,UAAU,CAAC,mBAAmB,EAAE,YAAY,GAAG,4BAA4B,EAAE;IAIpF;;;;;;OAMG;IACU,MAAM,CACjB,OAAO,EAAE,mCAAmC,EAC5C,WAAW,GAAE,MAAU,GACtB,OAAO,CAAC,mCAAmC,EAAE,CAAC;YAWnC,MAAM;CAgCrB;AAED;;;;;;GAMG;AACH,wBAAgB,+BAA+B,CAC7C,QAAQ,EAAE,SAAS,mCAAmC,EAAE,GACvD,mCAAmC,EAAE,CAEvC"}

package/dist/esm/compliance/privacy/services/subject-session-revocation.backend.service.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"subject-session-revocation.backend.service.d.ts","sourceRoot":"","sources":["~~../../../../../../~~src/compliance/privacy/services/subject-session-revocation.backend.service.ts"],"names":[],"mappings":"AAEA,oHAAoH;AACpH,MAAM,MAAM,qBAAqB,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAEtE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBACa,sCAAsC;IACjD,OAAO,CAAC,OAAO,CAAsC;IAErD;;;;OAIG;IACI,QAAQ,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI;IAIrD,sGAAsG;IACtG,IAAW,YAAY,IAAI,OAAO,CAEjC;IAED;;;;;;OAMG;IACU,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CASrE"}
1	+ {"version":3,"file":"subject-session-revocation.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/services/subject-session-revocation.backend.service.ts"],"names":[],"mappings":"AAEA,oHAAoH;AACpH,MAAM,MAAM,qBAAqB,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAEtE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBACa,sCAAsC;IACjD,OAAO,CAAC,OAAO,CAAsC;IAErD;;;;OAIG;IACI,QAAQ,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI;IAIrD,sGAAsG;IACtG,IAAW,YAAY,IAAI,OAAO,CAEjC;IAED;;;;;;OAMG;IACU,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CASrE"}

package/dist/esm/config/bootstrap/application-runtime-profile.backend.d.ts CHANGED Viewed

@@ -118,6 +118,11 @@ export interface ApplicationRuntimeProfileBootAssertions {
      * and only there.
      */
     assertsLayer2AuditProviderPresence: boolean;
+    /**
+     * Whether ENABLED members of `ENGINE_CAPABILITIES_REQUIRING_A_PROVIDER_WHEN_ENABLED` must resolve a
+     * provider on this host (#328). The application's own `required` flags are asserted everywhere.
+     */
+    assertsEngineCapabilityProviderFloor: boolean;
     /**
      * Whether this runtime performs boot-time SCHEMA/DATA MAINTENANCE over the
      * application's collections — the retention-marker backfill and the drifted

package/dist/esm/config/bootstrap/application-runtime-profile.backend.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"application-runtime-profile.backend.d.ts","sourceRoot":"","sources":["~~../../../../../~~src/config/bootstrap/application-runtime-profile.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,oBAAY,yBAAyB;IACnC;;;;;;;OAOG;IACH,mBAAmB,wBAAwB;IAC3C;;;;;OAKG;IACH,MAAM,WAAW;CAClB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,uCAAuC;IACtD;;;;;;;;OAQG;IACH,2CAA2C,EAAE,OAAO,CAAC;IACrD;;;;;;;;;OASG;IACH,sCAAsC,EAAE,OAAO,CAAC;IAChD;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,kCAAkC,EAAE,OAAO,CAAC;IAC5C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACH,6BAA6B,EAAE,OAAO,CAAC;IAEvC;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,qCAAqC,EAAE,OAAO,CAAC;IAC/C;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,sCAAsC,EAAE,OAAO,CAAC;CACjD;AAED;;;;;;;GAOG;AACH,wBAAgB,8CAA8C,CAC5D,OAAO,EAAE,yBAAyB,GACjC,uCAAuC,~~CAoDzC~~;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,8BAA8B;IAC7C;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,+BAA+B,EAAE,OAAO,CAAC;CAC1C;AAED;;;;GAIG;AACH,wBAAgB,qCAAqC,CACnD,OAAO,EAAE,yBAAyB,GACjC,8BAA8B,CAahC"}
1	+ {"version":3,"file":"application-runtime-profile.backend.d.ts","sourceRoot":"","sources":["../../../../src/config/bootstrap/application-runtime-profile.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,oBAAY,yBAAyB;IACnC;;;;;;;OAOG;IACH,mBAAmB,wBAAwB;IAC3C;;;;;OAKG;IACH,MAAM,WAAW;CAClB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,uCAAuC;IACtD;;;;;;;;OAQG;IACH,2CAA2C,EAAE,OAAO,CAAC;IACrD;;;;;;;;;OASG;IACH,sCAAsC,EAAE,OAAO,CAAC;IAChD;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,kCAAkC,EAAE,OAAO,CAAC;IAC5C;;;OAGG;IACH,oCAAoC,EAAE,OAAO,CAAC;IAC9C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACH,6BAA6B,EAAE,OAAO,CAAC;IAEvC;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,qCAAqC,EAAE,OAAO,CAAC;IAC/C;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,sCAAsC,EAAE,OAAO,CAAC;CACjD;AAED;;;;;;;GAOG;AACH,wBAAgB,8CAA8C,CAC5D,OAAO,EAAE,yBAAyB,GACjC,uCAAuC,CA0DzC;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,8BAA8B;IAC7C;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,+BAA+B,EAAE,OAAO,CAAC;CAC1C;AAED;;;;GAIG;AACH,wBAAgB,qCAAqC,CACnD,OAAO,EAAE,yBAAyB,GACjC,8BAA8B,CAahC"}

package/dist/esm/config/bootstrap/application-runtime-profile.backend.js CHANGED Viewed

@@ -80,6 +80,9 @@ export function resolveApplicationRuntimeProfileBootAssertions(profile) {
                 // installed only here), so an enabled audit capability with no resolved
                 // provider is a genuine misconfiguration it must surface.
                 assertsLayer2AuditProviderPresence: true,
+                // The backend is the host that SERVES email, billing and SMS, so an enabled slot with
+                // nothing behind it is a misconfiguration it must refuse at boot (#328).
+                assertsEngineCapabilityProviderFloor: true,
                 // The backend owns application-wide schema maintenance. It is the one
                 // runtime holding database-wide authority, and a migration wants a
                 // single owner.
@@ -105,6 +108,9 @@ export function resolveApplicationRuntimeProfileBootAssertions(profile) {
                 // therefore correct, not a misconfiguration — warning on every restart
                 // would be false-alarm noise.
                 assertsLayer2AuditProviderPresence: false,
+                // A minion's registry is filtered to ITS scope; the backend serves the engine flows, so
+                // an enabled email/billing/SMS slot resolving nothing here is the normal topology (#328).
+                assertsEngineCapabilityProviderFloor: false,
                 // A minion must NOT. Its database user is collection-scoped to what
                 // `resourceAccess` declared, so a backfill over every retention-governed
                 // collection is both unauthorised and not its concern. The backend

package/dist/esm/config/bootstrap/application-runtime-profile.backend.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"application-runtime-profile.backend.js","sourceRoot":"","sources":["../../../../../src/config/bootstrap/application-runtime-profile.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,MAAM,CAAN,IAAY,yBAiBX;AAjBD,WAAY,yBAAyB;IACnC;;;;;;;OAOG;IACH,wEAA2C,CAAA;IAC3C;;;;;OAKG;IACH,8CAAiB,CAAA;AACnB,CAAC,EAjBW,yBAAyB,KAAzB,yBAAyB,QAiBpC;AA+ID;;;;;;;GAOG;AACH,MAAM,UAAU,8CAA8C,CAC5D,OAAkC;IAElC,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,yBAAyB,CAAC,mBAAmB;YAChD,OAAO;gBACL,2CAA2C,EAAE,IAAI;gBACjD,sCAAsC,EAAE,IAAI;gBAC5C,yEAAyE;gBACzE,wEAAwE;gBACxE,0DAA0D;gBAC1D,kCAAkC,EAAE,IAAI;gBACxC,sEAAsE;gBACtE,mEAAmE;gBACnE,gBAAgB;gBAChB,6BAA6B,EAAE,IAAI;gBACnC,qCAAqC,EAAE,IAAI;gBAC3C,sCAAsC,EAAE,IAAI;aAC7C,CAAC;QACJ,KAAK,yBAAyB,CAAC,MAAM;YACnC,OAAO;gBACL,8DAA8D;gBAC9D,sEAAsE;gBACtE,qEAAqE;gBACrE,mCAAmC;gBACnC,2CAA2C,EAAE,KAAK;gBAClD,uEAAuE;gBACvE,sEAAsE;gBACtE,qEAAqE;gBACrE,4DAA4D;gBAC5D,sCAAsC,EAAE,KAAK;gBAC7C,uEAAuE;gBACvE,yEAAyE;gBACzE,0EAA0E;gBAC1E,uEAAuE;gBACvE,8BAA8B;gBAC9B,kCAAkC,EAAE,KAAK;gBACzC,oEAAoE;gBACpE,yEAAyE;gBACzE,mEAAmE;gBACnE,mDAAmD;gBACnD,6BAA6B,EAAE,KAAK;gBACpC,qCAAqC,EAAE,KAAK;gBAC5C,yEAAyE;gBACzE,wEAAwE;gBACxE,sCAAsC,EAAE,KAAK;aAC9C,CAAC;QACJ,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,SAAS,GAAU,OAAO,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,wCAAwC,MAAM,CAAC,SAAS,CAAC,gEAAgE,CAC1H,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAyCD;;;;GAIG;AACH,MAAM,UAAU,qCAAqC,CACnD,OAAkC;IAElC,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,yBAAyB,CAAC,mBAAmB;YAChD,OAAO,EAAE,+BAA+B,EAAE,KAAK,EAAE,CAAC;QACpD,KAAK,yBAAyB,CAAC,MAAM;YACnC,OAAO,EAAE,+BAA+B,EAAE,IAAI,EAAE,CAAC;QACnD,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,SAAS,GAAU,OAAO,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,wCAAwC,MAAM,CAAC,SAAS,CAAC,8DAA8D,CACxH,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC","sourcesContent":["/*\n WHICH RUNTIME is booting the shared application lifecycle, and WHICH BOOT\n * ASSERTIONS therefore apply to it.\n \n ## The problem this solves\n \n `StartApplicationBackendService` is booted by more than one kind of runtime.\n * Historically it had no notion of which one, so every boot-time validator ran\n * against every runtime — including validators asserting things that are\n * structurally meaningless for that runtime. Each time one fired, the fix was to\n * make the runtime CARRY the declaration it could never use, which pushed the\n * runtime further from its own semantics:\n \n - a minion mounts no MCP/A2A transport, yet had to declare every named\n * resource-server instance or fail closed on `operation.mcp.servers`\n * membership refs;\n * - a minion had to carry a binding for EVERY generated-PDF field in the whole\n * application, including resources it can never touch.\n \n Both produced production-shaped crash-loops. The root cause is not the\n * individual declaration — it is that the framework had no way to ask \"does\n this assertion apply to the runtime I am booting?\".\n \n * ## Not the same concept as the runtime-control flags\n \n `headlessMode` / `skipCronSync` / `skipJobConsumers` answer a different\n * question: \"should I START this subsystem?\" They are host-authored controls\n * over what gets wired up. A runtime profile answers *\"does this DECLARATION\n CLASS apply to me at all?\"*. The two are deliberately not merged: a runtime\n may legitimately skip starting the HTTP server while still wanting its\n * transport declarations validated (a validation-only boot, for instance).\n \n ## Not the same concept as `BackgroundRuntimeType`\n \n `BackgroundRuntimeType` (`MINION` \| `WORKER`) is a deployable runtime kind —\n * a docker-compose service, a K8s workload, a provider-runtime scope. This enum\n * is about boot-assertion applicability inside a single process. Today the two\n * vocabularies partially overlap, but they answer different questions and must\n * not be collapsed because their members currently coincide. Notably, a WORKER\n * has no member here at all: workers never boot this lifecycle (they are\n * standalone by design, with no backing-service access), so giving them a\n * profile would invent a member with no referent.\n \n See `.claude/plans/minion-runtime-scope.md` (Step 2, OQ-2).\n /\nexport enum ApplicationRuntimeProfile {\n /\n The application's own backend service. Serves the full public surface — HTTP\n * API, MCP servers, A2A agents, generated-PDF rendering — so every boot\n * assertion applies to it. This is the default for any host that does not\n * declare otherwise, which keeps the fail-closed direction correct: a new\n * runtime that forgets to declare its profile is over-validated, never\n * under-validated.\n /\n APPLICATION_BACKEND = 'application_backend',\n /\n A minion — a background digital worker of the application owner. Boots the\n * shared lifecycle to obtain the resource graph, DI container, and provider\n * bindings, but mounts no externally-addressable transport and serves no\n * human-facing surface.\n /\n MINION = 'minion',\n}\n\n/\n Boot assertions whose applicability varies by runtime.\n \n Every trait is phrased as an ASSERTION the framework makes, not as a\n * capability the runtime has. That distinction is load-bearing: a minion may\n * well render a PDF, so the honest trait is not \"renders PDFs\" but \"is required\n * to carry a COMPLETE set of PDF bindings for the whole application\". Phrasing\n * these as capabilities would have quietly removed working functionality.\n /\nexport interface ApplicationRuntimeProfileBootAssertions {\n /\n Whether every `operation.mcp.servers` / agent `actorSystemRefs` membership\n * ref must resolve to a declared resource-server instance.\n \n Applies only to runtimes that actually SERVE those transports. For a runtime\n * that mounts none, an unresolvable ref describes a surface it does not\n * expose — asserting on it fails a boot over a declaration that could never be\n * read.\n /\n assertsResourceServerMembershipCompleteness: boolean;\n /\n Whether EVERY generated-PDF file field in the resource graph must have a\n * backend binding.\n \n Deliberately narrow: this gates only the COMPLETENESS half of PDF binding\n * validation. The coherence half — a binding declared for a field that is not\n * a generated PDF field, or pointing at the wrong template id — always runs,\n * for every runtime. What you DID declare must always be correct; being\n * required to declare ALL of it is what varies.\n /\n assertsGeneratedPdfBindingCompleteness: boolean;\n /\n Whether this runtime is EXPECTED to host the Layer-2 audit provider fan-out,\n * so an ENABLED `COMPLIANCE_AUDIT_TRAIL` capability that resolves NO provider is\n * a genuine misconfiguration worth a startup warning — as opposed to the\n * expected, by-design posture of a runtime that is legitimately Layer-1-only.\n \n Different in KIND from the two completeness assertions above: those gate\n * fail-CLOSED boot validators that THROW. This gates a fail-OPEN diagnostic — a\n * `logger.warn`, never a throw — because Layer-1 database audit is unaffected\n * either way and the runtime still boots. What varies by profile is only whether\n * \"enabled but nothing serves it\" is a SIGNAL or NOISE for this runtime.\n \n Only the application backend installs the Layer-2 audit sink — the immudb node\n * client is present only there — and its `immudb.audit-reconcile` cron backfills\n * every Layer-1 `AUDIT_LOGS` row, INCLUDING rows emitted by minions, into the\n * Layer-2 ledger. So an auxiliary runtime resolving no audit provider is correct\n * by construction; warning there is false-alarm noise on every restart that\n * trains operators to ignore the channel. The backend resolving no provider is\n * the real misconfiguration this diagnostic exists to surface — which is why the\n * fail-closed default profile (`APPLICATION_BACKEND`) asserts it.\n \n assurance-control: WILDO.AUDIT.SECURITY_EVENT — the absence of the Layer-2\n * provider audit fan-out is diagnosed on the runtime accountable for hosting it,\n * and only there.\n /\n assertsLayer2AuditProviderPresence: boolean;\n /\n Whether this runtime performs boot-time SCHEMA/DATA MAINTENANCE over the\n * application's collections — the retention-marker backfill and the drifted\n * unique-index reconciliation.\n \n Not a capability question (\"could it?\") but an ownership one (\"is it the\n * runtime accountable for it?\"). Maintenance of this kind is application-WIDE\n * and belongs to exactly one runtime:\n \n - it writes to every retention-governed collection, including ones a\n * confined runtime has no grant for and no business touching;\n * - several runtimes doing it concurrently race each other over the same rows\n * and indexes for no benefit;\n * - it is a migration, and a migration wants one owner.\n \n Covers THREE boot steps, and the third only became visible after the first\n * two were gated: the retention-marker backfill, the drifted-unique-index\n * reconciliation, and the declared-unique-index build+verification. The last\n * one BUILDS as well as asserts — `mongooseModel.init()` creates a declared\n * index, which is a write — so it belongs on the same side of the gate.\n \n Discovered the hard way (2026-08-12), twice in a row: once a minion's Mongo\n * user became collection-scoped, its boot ran `updateMany` on `users` — a\n * collection it had never declared — and crash-looped on `not authorized`.\n * Gating that surfaced the next one immediately: `create: \"organizations\"`,\n * 60 declared indexes it could not build and was not accountable for.\n \n The containment was right both times; the minion was doing the application\n * backend's job. Granting `users` to a scraper to \"fix\" it would have inverted\n * the whole point. The lesson generalises past these three: a boot step that\n * WRITES to the application's schema belongs to the runtime that owns the\n * schema, and adding one without asking which runtime owns it is how a\n * confined runtime acquires an authority nobody intended.\n /\n performsBootSchemaMaintenance: boolean;\n\n /\n Whether this runtime OBSERVES the administrative-continuity floors at boot — the report that\n * names organizations left without a usable owner, and applications left without a usable\n * super-administrator.\n \n A separate assertion from {@link performsBootSchemaMaintenance} rather than a reuse of it,\n * because the two are different authorities that happen to share a containment argument. One\n * WRITES the application's schema; this one READS the application's whole administrative\n * population. Collapsing them would make \"may this runtime repair the schema?\" and \"may this\n * runtime audit who administers the tenant?\" one switch, and a future profile that wants one\n * without the other would have nowhere to say so.\n \n FALSE for a confined runtime, for the reason `performsBootSchemaMaintenance` already generalises:\n * the report reads `users` and `organizations` across the whole application, which a table-scoped\n * role has neither the grants nor the accountability for. Observed 2026-08-24 on a clean-room\n * PostgreSQL boot — `permission denied for table users` / `for table organizations`, twice per\n * boot, from the marketing-scrapper minion. It never blocked the boot (the report is non-fatal by\n * design), which is exactly why it survived: a recurring, ignorable error in a healthy startup.\n \n Note that the sibling's JSDoc had ALREADY named this hazard — \"granting `users` to a scraper to\n * 'fix' it would have inverted the whole point\" — one boot step before it happened again. The\n * lesson was recorded; the next step added simply did not consult it.\n /\n reportsAdministrativeContinuityFloors: boolean;\n /\n Whether this runtime PROVES at boot that its persistence adapter can commit\n * the native transactions the application's authored boundaries require.\n \n The probe issues a transaction against a synthetic collection\n * (`__wildo_transaction_readiness_probe`) that no `resourceAccess` declares or\n * ever could, so a collection-scoped runtime is refused by construction.\n \n More importantly it proves an INFRASTRUCTURE property — \"does this Mongo\n * deployment support multi-document transactions?\" — which is identical for\n * every runtime pointed at that database, and which the application backend\n * already proves. The boundaries it enumerates are the backend's too\n * (`authentication.self-registration` is not something a minion serves; a\n * minion is never a user, D15).\n \n Stated trade: a minion no longer fails FAST on a deployment whose adapter\n * cannot do transactions — it would fail on its first transactional write\n * instead. Acceptable because the backend fails fast on the same deployment,\n * and because the alternative is granting every confined runtime access to a\n * probe collection nobody declared.\n /\n assertsPersistenceTransactionReadiness: boolean;\n}\n\n/\n The single authority mapping a runtime profile to its boot assertions.\n \n Exhaustive by construction: the `never` fallthrough makes adding a profile\n * member a COMPILE error until its assertions are decided. That is the point —\n * the failure mode this whole mechanism exists to prevent is a new runtime\n * silently inheriting assertions nobody considered.\n /\nexport function resolveApplicationRuntimeProfileBootAssertions(\n profile: ApplicationRuntimeProfile,\n): ApplicationRuntimeProfileBootAssertions {\n switch (profile) {\n case ApplicationRuntimeProfile.APPLICATION_BACKEND:\n return {\n assertsResourceServerMembershipCompleteness: true,\n assertsGeneratedPdfBindingCompleteness: true,\n // The backend is the SOLE host of the Layer-2 audit sink (immudb-node is\n // installed only here), so an enabled audit capability with no resolved\n // provider is a genuine misconfiguration it must surface.\n assertsLayer2AuditProviderPresence: true,\n // The backend owns application-wide schema maintenance. It is the one\n // runtime holding database-wide authority, and a migration wants a\n // single owner.\n performsBootSchemaMaintenance: true,\n reportsAdministrativeContinuityFloors: true,\n assertsPersistenceTransactionReadiness: true,\n };\n case ApplicationRuntimeProfile.MINION:\n return {\n // A minion mounts no MCP/A2A transport. It does not carry the\n // declarations at all (they are excluded from the minion projection),\n // so asserting membership against an empty registry would fail every\n // ref the resource graph declares.\n assertsResourceServerMembershipCompleteness: false,\n // A minion carries the application's PDF bindings and CAN render a PDF\n // if one is bound. What it is not required to do is account for every\n // generated-PDF field in the application, including on resources its\n // `resourceAccess` whitelist forbids it from ever touching.\n assertsGeneratedPdfBindingCompleteness: false,\n // A minion is Layer-1-only by design: it never hosts the Layer-2 audit\n // fan-out, and the backend's `immudb.audit-reconcile` cron backfills the\n // minion's `AUDIT_LOGS` rows into Layer-2. Resolving no audit provider is\n // therefore correct, not a misconfiguration — warning on every restart\n // would be false-alarm noise.\n assertsLayer2AuditProviderPresence: false,\n // A minion must NOT. Its database user is collection-scoped to what\n // `resourceAccess` declared, so a backfill over every retention-governed\n // collection is both unauthorised and not its concern. The backend\n // performs it; the minion simply reads the result.\n performsBootSchemaMaintenance: false,\n reportsAdministrativeContinuityFloors: false,\n // Same reason, one layer up: the probe touches a synthetic collection no\n // grant covers, and proves a deployment-wide property the backend owns.\n assertsPersistenceTransactionReadiness: false,\n };\n default: {\n const unhandled: never = profile;\n throw new Error(\n `Unhandled ApplicationRuntimeProfile '${String(unhandled)}' — every profile must declare its boot assertions explicitly.`,\n );\n }\n }\n}\n\n/\n Runtime access policy — how this runtime's PRIVILEGED accesses behave while it runs.\n \n Deliberately separate from {@link ApplicationRuntimeProfileBootAssertions}: boot\n * assertions are evaluated once, at startup, and answer \"is this configuration\n * coherent for me?\". This answers \"what must hold every time I exercise privilege?\",\n * which is a different lifecycle and a different failure mode. Folding them together\n * would mean a boot-time concern and a per-call concern share a shape and drift into\n * each other.\n /\nexport interface ApplicationRuntimeAccessPolicy {\n /\n Whether a privileged system-access READ must be PROVABLY audited before its data\n * is handed to the caller — i.e. if the audit cannot be written, the caller does not\n * get the data.\n \n This is the fail-closed half of the accountable-bypass doctrine (D9 + OQ-5). The\n * system-access door legitimately bypasses per-tenant authorization; what makes that\n * acceptable for a non-human background worker is that every passage leaves evidence.\n * An accountable bypass that stops being recorded is just a bypass.\n \n Scoped to the MINION profile ONLY, deliberately. Applying it to the application\n * backend would make the framework's most common internal read path depend on audit\n * availability — converting an audit hiccup into an application-wide outage, a\n * self-inflicted denial of service. A minion's privileged reads are the elevated,\n * least frequent, least latency-sensitive case, which is exactly where the trade\n * favours accountability over availability.\n \n READS only. A write cannot be unwound by refusing to report it — its audit is\n * already deferred to the transaction's post-commit queue, so failing afterwards\n * would leave the mutation committed AND the caller erroring, inviting a retry that\n * duplicates it. See the plan's Step 3b limitations.\n \n assurance-control: WILDO.AUDIT.SECURITY_EVENT — privileged access by a non-human\n * runtime is not merely audited, it is audited or refused.\n /\n requiresAccountableSystemAccess: boolean;\n}\n\n/\n The single authority mapping a runtime profile to its access policy. Exhaustive by\n * construction for the same reason as the boot-assertion resolver: a new runtime must\n * DECIDE this, never inherit it by omission.\n */\nexport function resolveApplicationRuntimeAccessPolicy(\n profile: ApplicationRuntimeProfile,\n): ApplicationRuntimeAccessPolicy {\n switch (profile) {\n case ApplicationRuntimeProfile.APPLICATION_BACKEND:\n return { requiresAccountableSystemAccess: false };\n case ApplicationRuntimeProfile.MINION:\n return { requiresAccountableSystemAccess: true };\n default: {\n const unhandled: never = profile;\n throw new Error(\n `Unhandled ApplicationRuntimeProfile '${String(unhandled)}' — every profile must declare its access policy explicitly.`,\n );\n }\n }\n}\n"]}
1	+ {"version":3,"file":"application-runtime-profile.backend.js","sourceRoot":"","sources":["../../../../src/config/bootstrap/application-runtime-profile.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,MAAM,CAAN,IAAY,yBAiBX;AAjBD,WAAY,yBAAyB;IACnC;;;;;;;OAOG;IACH,wEAA2C,CAAA;IAC3C;;;;;OAKG;IACH,8CAAiB,CAAA;AACnB,CAAC,EAjBW,yBAAyB,KAAzB,yBAAyB,QAiBpC;AAoJD;;;;;;;GAOG;AACH,MAAM,UAAU,8CAA8C,CAC5D,OAAkC;IAElC,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,yBAAyB,CAAC,mBAAmB;YAChD,OAAO;gBACL,2CAA2C,EAAE,IAAI;gBACjD,sCAAsC,EAAE,IAAI;gBAC5C,yEAAyE;gBACzE,wEAAwE;gBACxE,0DAA0D;gBAC1D,kCAAkC,EAAE,IAAI;gBACxC,sFAAsF;gBACtF,yEAAyE;gBACzE,oCAAoC,EAAE,IAAI;gBAC1C,sEAAsE;gBACtE,mEAAmE;gBACnE,gBAAgB;gBAChB,6BAA6B,EAAE,IAAI;gBACnC,qCAAqC,EAAE,IAAI;gBAC3C,sCAAsC,EAAE,IAAI;aAC7C,CAAC;QACJ,KAAK,yBAAyB,CAAC,MAAM;YACnC,OAAO;gBACL,8DAA8D;gBAC9D,sEAAsE;gBACtE,qEAAqE;gBACrE,mCAAmC;gBACnC,2CAA2C,EAAE,KAAK;gBAClD,uEAAuE;gBACvE,sEAAsE;gBACtE,qEAAqE;gBACrE,4DAA4D;gBAC5D,sCAAsC,EAAE,KAAK;gBAC7C,uEAAuE;gBACvE,yEAAyE;gBACzE,0EAA0E;gBAC1E,uEAAuE;gBACvE,8BAA8B;gBAC9B,kCAAkC,EAAE,KAAK;gBACzC,wFAAwF;gBACxF,0FAA0F;gBAC1F,oCAAoC,EAAE,KAAK;gBAC3C,oEAAoE;gBACpE,yEAAyE;gBACzE,mEAAmE;gBACnE,mDAAmD;gBACnD,6BAA6B,EAAE,KAAK;gBACpC,qCAAqC,EAAE,KAAK;gBAC5C,yEAAyE;gBACzE,wEAAwE;gBACxE,sCAAsC,EAAE,KAAK;aAC9C,CAAC;QACJ,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,SAAS,GAAU,OAAO,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,wCAAwC,MAAM,CAAC,SAAS,CAAC,gEAAgE,CAC1H,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAyCD;;;;GAIG;AACH,MAAM,UAAU,qCAAqC,CACnD,OAAkC;IAElC,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,yBAAyB,CAAC,mBAAmB;YAChD,OAAO,EAAE,+BAA+B,EAAE,KAAK,EAAE,CAAC;QACpD,KAAK,yBAAyB,CAAC,MAAM;YACnC,OAAO,EAAE,+BAA+B,EAAE,IAAI,EAAE,CAAC;QACnD,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,SAAS,GAAU,OAAO,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,wCAAwC,MAAM,CAAC,SAAS,CAAC,8DAA8D,CACxH,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC","sourcesContent":["/*\n WHICH RUNTIME is booting the shared application lifecycle, and WHICH BOOT\n * ASSERTIONS therefore apply to it.\n \n ## The problem this solves\n \n `StartApplicationBackendService` is booted by more than one kind of runtime.\n * Historically it had no notion of which one, so every boot-time validator ran\n * against every runtime — including validators asserting things that are\n * structurally meaningless for that runtime. Each time one fired, the fix was to\n * make the runtime CARRY the declaration it could never use, which pushed the\n * runtime further from its own semantics:\n \n - a minion mounts no MCP/A2A transport, yet had to declare every named\n * resource-server instance or fail closed on `operation.mcp.servers`\n * membership refs;\n * - a minion had to carry a binding for EVERY generated-PDF field in the whole\n * application, including resources it can never touch.\n \n Both produced production-shaped crash-loops. The root cause is not the\n * individual declaration — it is that the framework had no way to ask \"does\n this assertion apply to the runtime I am booting?\".\n \n * ## Not the same concept as the runtime-control flags\n \n `headlessMode` / `skipCronSync` / `skipJobConsumers` answer a different\n * question: \"should I START this subsystem?\" They are host-authored controls\n * over what gets wired up. A runtime profile answers *\"does this DECLARATION\n CLASS apply to me at all?\"*. The two are deliberately not merged: a runtime\n may legitimately skip starting the HTTP server while still wanting its\n * transport declarations validated (a validation-only boot, for instance).\n \n ## Not the same concept as `BackgroundRuntimeType`\n \n `BackgroundRuntimeType` (`MINION` \| `WORKER`) is a deployable runtime kind —\n * a docker-compose service, a K8s workload, a provider-runtime scope. This enum\n * is about boot-assertion applicability inside a single process. Today the two\n * vocabularies partially overlap, but they answer different questions and must\n * not be collapsed because their members currently coincide. Notably, a WORKER\n * has no member here at all: workers never boot this lifecycle (they are\n * standalone by design, with no backing-service access), so giving them a\n * profile would invent a member with no referent.\n \n See `.claude/plans/minion-runtime-scope.md` (Step 2, OQ-2).\n /\nexport enum ApplicationRuntimeProfile {\n /\n The application's own backend service. Serves the full public surface — HTTP\n * API, MCP servers, A2A agents, generated-PDF rendering — so every boot\n * assertion applies to it. This is the default for any host that does not\n * declare otherwise, which keeps the fail-closed direction correct: a new\n * runtime that forgets to declare its profile is over-validated, never\n * under-validated.\n /\n APPLICATION_BACKEND = 'application_backend',\n /\n A minion — a background digital worker of the application owner. Boots the\n * shared lifecycle to obtain the resource graph, DI container, and provider\n * bindings, but mounts no externally-addressable transport and serves no\n * human-facing surface.\n /\n MINION = 'minion',\n}\n\n/\n Boot assertions whose applicability varies by runtime.\n \n Every trait is phrased as an ASSERTION the framework makes, not as a\n * capability the runtime has. That distinction is load-bearing: a minion may\n * well render a PDF, so the honest trait is not \"renders PDFs\" but \"is required\n * to carry a COMPLETE set of PDF bindings for the whole application\". Phrasing\n * these as capabilities would have quietly removed working functionality.\n /\nexport interface ApplicationRuntimeProfileBootAssertions {\n /\n Whether every `operation.mcp.servers` / agent `actorSystemRefs` membership\n * ref must resolve to a declared resource-server instance.\n \n Applies only to runtimes that actually SERVE those transports. For a runtime\n * that mounts none, an unresolvable ref describes a surface it does not\n * expose — asserting on it fails a boot over a declaration that could never be\n * read.\n /\n assertsResourceServerMembershipCompleteness: boolean;\n /\n Whether EVERY generated-PDF file field in the resource graph must have a\n * backend binding.\n \n Deliberately narrow: this gates only the COMPLETENESS half of PDF binding\n * validation. The coherence half — a binding declared for a field that is not\n * a generated PDF field, or pointing at the wrong template id — always runs,\n * for every runtime. What you DID declare must always be correct; being\n * required to declare ALL of it is what varies.\n /\n assertsGeneratedPdfBindingCompleteness: boolean;\n /\n Whether this runtime is EXPECTED to host the Layer-2 audit provider fan-out,\n * so an ENABLED `COMPLIANCE_AUDIT_TRAIL` capability that resolves NO provider is\n * a genuine misconfiguration worth a startup warning — as opposed to the\n * expected, by-design posture of a runtime that is legitimately Layer-1-only.\n \n Different in KIND from the two completeness assertions above: those gate\n * fail-CLOSED boot validators that THROW. This gates a fail-OPEN diagnostic — a\n * `logger.warn`, never a throw — because Layer-1 database audit is unaffected\n * either way and the runtime still boots. What varies by profile is only whether\n * \"enabled but nothing serves it\" is a SIGNAL or NOISE for this runtime.\n \n Only the application backend installs the Layer-2 audit sink — the immudb node\n * client is present only there — and its `immudb.audit-reconcile` cron backfills\n * every Layer-1 `AUDIT_LOGS` row, INCLUDING rows emitted by minions, into the\n * Layer-2 ledger. So an auxiliary runtime resolving no audit provider is correct\n * by construction; warning there is false-alarm noise on every restart that\n * trains operators to ignore the channel. The backend resolving no provider is\n * the real misconfiguration this diagnostic exists to surface — which is why the\n * fail-closed default profile (`APPLICATION_BACKEND`) asserts it.\n \n assurance-control: WILDO.AUDIT.SECURITY_EVENT — the absence of the Layer-2\n * provider audit fan-out is diagnosed on the runtime accountable for hosting it,\n * and only there.\n /\n assertsLayer2AuditProviderPresence: boolean;\n /\n Whether ENABLED members of `ENGINE_CAPABILITIES_REQUIRING_A_PROVIDER_WHEN_ENABLED` must resolve a\n * provider on this host (#328). The application's own `required` flags are asserted everywhere.\n /\n assertsEngineCapabilityProviderFloor: boolean;\n /\n Whether this runtime performs boot-time SCHEMA/DATA MAINTENANCE over the\n * application's collections — the retention-marker backfill and the drifted\n * unique-index reconciliation.\n \n Not a capability question (\"could it?\") but an ownership one (\"is it the\n * runtime accountable for it?\"). Maintenance of this kind is application-WIDE\n * and belongs to exactly one runtime:\n \n - it writes to every retention-governed collection, including ones a\n * confined runtime has no grant for and no business touching;\n * - several runtimes doing it concurrently race each other over the same rows\n * and indexes for no benefit;\n * - it is a migration, and a migration wants one owner.\n \n Covers THREE boot steps, and the third only became visible after the first\n * two were gated: the retention-marker backfill, the drifted-unique-index\n * reconciliation, and the declared-unique-index build+verification. The last\n * one BUILDS as well as asserts — `mongooseModel.init()` creates a declared\n * index, which is a write — so it belongs on the same side of the gate.\n \n Discovered the hard way (2026-08-12), twice in a row: once a minion's Mongo\n * user became collection-scoped, its boot ran `updateMany` on `users` — a\n * collection it had never declared — and crash-looped on `not authorized`.\n * Gating that surfaced the next one immediately: `create: \"organizations\"`,\n * 60 declared indexes it could not build and was not accountable for.\n \n The containment was right both times; the minion was doing the application\n * backend's job. Granting `users` to a scraper to \"fix\" it would have inverted\n * the whole point. The lesson generalises past these three: a boot step that\n * WRITES to the application's schema belongs to the runtime that owns the\n * schema, and adding one without asking which runtime owns it is how a\n * confined runtime acquires an authority nobody intended.\n /\n performsBootSchemaMaintenance: boolean;\n\n /\n Whether this runtime OBSERVES the administrative-continuity floors at boot — the report that\n * names organizations left without a usable owner, and applications left without a usable\n * super-administrator.\n \n A separate assertion from {@link performsBootSchemaMaintenance} rather than a reuse of it,\n * because the two are different authorities that happen to share a containment argument. One\n * WRITES the application's schema; this one READS the application's whole administrative\n * population. Collapsing them would make \"may this runtime repair the schema?\" and \"may this\n * runtime audit who administers the tenant?\" one switch, and a future profile that wants one\n * without the other would have nowhere to say so.\n \n FALSE for a confined runtime, for the reason `performsBootSchemaMaintenance` already generalises:\n * the report reads `users` and `organizations` across the whole application, which a table-scoped\n * role has neither the grants nor the accountability for. Observed 2026-08-24 on a clean-room\n * PostgreSQL boot — `permission denied for table users` / `for table organizations`, twice per\n * boot, from the marketing-scrapper minion. It never blocked the boot (the report is non-fatal by\n * design), which is exactly why it survived: a recurring, ignorable error in a healthy startup.\n \n Note that the sibling's JSDoc had ALREADY named this hazard — \"granting `users` to a scraper to\n * 'fix' it would have inverted the whole point\" — one boot step before it happened again. The\n * lesson was recorded; the next step added simply did not consult it.\n /\n reportsAdministrativeContinuityFloors: boolean;\n /\n Whether this runtime PROVES at boot that its persistence adapter can commit\n * the native transactions the application's authored boundaries require.\n \n The probe issues a transaction against a synthetic collection\n * (`__wildo_transaction_readiness_probe`) that no `resourceAccess` declares or\n * ever could, so a collection-scoped runtime is refused by construction.\n \n More importantly it proves an INFRASTRUCTURE property — \"does this Mongo\n * deployment support multi-document transactions?\" — which is identical for\n * every runtime pointed at that database, and which the application backend\n * already proves. The boundaries it enumerates are the backend's too\n * (`authentication.self-registration` is not something a minion serves; a\n * minion is never a user, D15).\n \n Stated trade: a minion no longer fails FAST on a deployment whose adapter\n * cannot do transactions — it would fail on its first transactional write\n * instead. Acceptable because the backend fails fast on the same deployment,\n * and because the alternative is granting every confined runtime access to a\n * probe collection nobody declared.\n /\n assertsPersistenceTransactionReadiness: boolean;\n}\n\n/\n The single authority mapping a runtime profile to its boot assertions.\n \n Exhaustive by construction: the `never` fallthrough makes adding a profile\n * member a COMPILE error until its assertions are decided. That is the point —\n * the failure mode this whole mechanism exists to prevent is a new runtime\n * silently inheriting assertions nobody considered.\n /\nexport function resolveApplicationRuntimeProfileBootAssertions(\n profile: ApplicationRuntimeProfile,\n): ApplicationRuntimeProfileBootAssertions {\n switch (profile) {\n case ApplicationRuntimeProfile.APPLICATION_BACKEND:\n return {\n assertsResourceServerMembershipCompleteness: true,\n assertsGeneratedPdfBindingCompleteness: true,\n // The backend is the SOLE host of the Layer-2 audit sink (immudb-node is\n // installed only here), so an enabled audit capability with no resolved\n // provider is a genuine misconfiguration it must surface.\n assertsLayer2AuditProviderPresence: true,\n // The backend is the host that SERVES email, billing and SMS, so an enabled slot with\n // nothing behind it is a misconfiguration it must refuse at boot (#328).\n assertsEngineCapabilityProviderFloor: true,\n // The backend owns application-wide schema maintenance. It is the one\n // runtime holding database-wide authority, and a migration wants a\n // single owner.\n performsBootSchemaMaintenance: true,\n reportsAdministrativeContinuityFloors: true,\n assertsPersistenceTransactionReadiness: true,\n };\n case ApplicationRuntimeProfile.MINION:\n return {\n // A minion mounts no MCP/A2A transport. It does not carry the\n // declarations at all (they are excluded from the minion projection),\n // so asserting membership against an empty registry would fail every\n // ref the resource graph declares.\n assertsResourceServerMembershipCompleteness: false,\n // A minion carries the application's PDF bindings and CAN render a PDF\n // if one is bound. What it is not required to do is account for every\n // generated-PDF field in the application, including on resources its\n // `resourceAccess` whitelist forbids it from ever touching.\n assertsGeneratedPdfBindingCompleteness: false,\n // A minion is Layer-1-only by design: it never hosts the Layer-2 audit\n // fan-out, and the backend's `immudb.audit-reconcile` cron backfills the\n // minion's `AUDIT_LOGS` rows into Layer-2. Resolving no audit provider is\n // therefore correct, not a misconfiguration — warning on every restart\n // would be false-alarm noise.\n assertsLayer2AuditProviderPresence: false,\n // A minion's registry is filtered to ITS scope; the backend serves the engine flows, so\n // an enabled email/billing/SMS slot resolving nothing here is the normal topology (#328).\n assertsEngineCapabilityProviderFloor: false,\n // A minion must NOT. Its database user is collection-scoped to what\n // `resourceAccess` declared, so a backfill over every retention-governed\n // collection is both unauthorised and not its concern. The backend\n // performs it; the minion simply reads the result.\n performsBootSchemaMaintenance: false,\n reportsAdministrativeContinuityFloors: false,\n // Same reason, one layer up: the probe touches a synthetic collection no\n // grant covers, and proves a deployment-wide property the backend owns.\n assertsPersistenceTransactionReadiness: false,\n };\n default: {\n const unhandled: never = profile;\n throw new Error(\n `Unhandled ApplicationRuntimeProfile '${String(unhandled)}' — every profile must declare its boot assertions explicitly.`,\n );\n }\n }\n}\n\n/\n Runtime access policy — how this runtime's PRIVILEGED accesses behave while it runs.\n \n Deliberately separate from {@link ApplicationRuntimeProfileBootAssertions}: boot\n * assertions are evaluated once, at startup, and answer \"is this configuration\n * coherent for me?\". This answers \"what must hold every time I exercise privilege?\",\n * which is a different lifecycle and a different failure mode. Folding them together\n * would mean a boot-time concern and a per-call concern share a shape and drift into\n * each other.\n /\nexport interface ApplicationRuntimeAccessPolicy {\n /\n Whether a privileged system-access READ must be PROVABLY audited before its data\n * is handed to the caller — i.e. if the audit cannot be written, the caller does not\n * get the data.\n \n This is the fail-closed half of the accountable-bypass doctrine (D9 + OQ-5). The\n * system-access door legitimately bypasses per-tenant authorization; what makes that\n * acceptable for a non-human background worker is that every passage leaves evidence.\n * An accountable bypass that stops being recorded is just a bypass.\n \n Scoped to the MINION profile ONLY, deliberately. Applying it to the application\n * backend would make the framework's most common internal read path depend on audit\n * availability — converting an audit hiccup into an application-wide outage, a\n * self-inflicted denial of service. A minion's privileged reads are the elevated,\n * least frequent, least latency-sensitive case, which is exactly where the trade\n * favours accountability over availability.\n \n READS only. A write cannot be unwound by refusing to report it — its audit is\n * already deferred to the transaction's post-commit queue, so failing afterwards\n * would leave the mutation committed AND the caller erroring, inviting a retry that\n * duplicates it. See the plan's Step 3b limitations.\n \n assurance-control: WILDO.AUDIT.SECURITY_EVENT — privileged access by a non-human\n * runtime is not merely audited, it is audited or refused.\n /\n requiresAccountableSystemAccess: boolean;\n}\n\n/\n The single authority mapping a runtime profile to its access policy. Exhaustive by\n * construction for the same reason as the boot-assertion resolver: a new runtime must\n * DECIDE this, never inherit it by omission.\n */\nexport function resolveApplicationRuntimeAccessPolicy(\n profile: ApplicationRuntimeProfile,\n): ApplicationRuntimeAccessPolicy {\n switch (profile) {\n case ApplicationRuntimeProfile.APPLICATION_BACKEND:\n return { requiresAccountableSystemAccess: false };\n case ApplicationRuntimeProfile.MINION:\n return { requiresAccountableSystemAccess: true };\n default: {\n const unhandled: never = profile;\n throw new Error(\n `Unhandled ApplicationRuntimeProfile '${String(unhandled)}' — every profile must declare its access policy explicitly.`,\n );\n }\n }\n}\n"]}

package/dist/esm/config/bootstrap/minion-initialization-projection.backend.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"minion-initialization-projection.backend.d.ts","sourceRoot":"","sources":["~~../../../../../~~src/config/bootstrap/minion-initialization-projection.backend.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,uEAAuE,CAAC;AAC7H,OAAO,EAAE,yBAAyB,EAAE,MAAM,yEAAyE,CAAC;AAEpH;;;;;;;;GAQG;AACH,MAAM,WAAW,mCAAmC,CAClD,gBAAgB,GAAG,+BAA+B,CAAC,iBAAiB,CAAC,CACrE,SAAQ,IAAI,CACZ,+BAA+B,EAC7B,8BAA8B,GAC9B,gCAAgC,GAChC,6BAA6B,GAC7B,+BAA+B,GAC/B,iCAAiC,GACjC,8BAA8B,GAC9B,8BAA8B,GAC9B,aAAa,GACb,qBAAqB,GACrB,cAAc,GACd,yBAAyB,GAIzB,0BAA0B,GAS1B,qBAAqB,GACrB,eAAe,CAClB;IACC,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,eAAe,CAAC,EAAE,gBAAgB,CAAC;IACnC;;;;;OAKG;IACH,cAAc,EAAE,yBAAyB,CAAC,MAAM,CAAC;CAClD;AAED;;;;;GAKG;AACH,wBAAgB,8CAA8C,CAC5D,gBAAgB,GAAG,+BAA+B,CAAC,iBAAiB,CAAC,EACrE,KAAK,EAAE;IACP,iBAAiB,EAAE,IAAI,CAAC,+BAA+B,EAAE,iBAAiB,CAAC,GAAG;QAC5E,eAAe,CAAC,EAAE,gBAAgB,CAAC;KACpC,CAAC;IACF,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B,GAAG,mCAAmC,CAAC,gBAAgB,CAAC,CAuCxD"}
1	+ {"version":3,"file":"minion-initialization-projection.backend.d.ts","sourceRoot":"","sources":["../../../../src/config/bootstrap/minion-initialization-projection.backend.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,uEAAuE,CAAC;AAC7H,OAAO,EAAE,yBAAyB,EAAE,MAAM,yEAAyE,CAAC;AAEpH;;;;;;;;GAQG;AACH,MAAM,WAAW,mCAAmC,CAClD,gBAAgB,GAAG,+BAA+B,CAAC,iBAAiB,CAAC,CACrE,SAAQ,IAAI,CACZ,+BAA+B,EAC7B,8BAA8B,GAC9B,gCAAgC,GAChC,6BAA6B,GAC7B,+BAA+B,GAC/B,iCAAiC,GACjC,8BAA8B,GAC9B,8BAA8B,GAC9B,aAAa,GACb,qBAAqB,GACrB,cAAc,GACd,yBAAyB,GAIzB,0BAA0B,GAS1B,qBAAqB,GACrB,eAAe,CAClB;IACC,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,eAAe,CAAC,EAAE,gBAAgB,CAAC;IACnC;;;;;OAKG;IACH,cAAc,EAAE,yBAAyB,CAAC,MAAM,CAAC;CAClD;AAED;;;;;GAKG;AACH,wBAAgB,8CAA8C,CAC5D,gBAAgB,GAAG,+BAA+B,CAAC,iBAAiB,CAAC,EACrE,KAAK,EAAE;IACP,iBAAiB,EAAE,IAAI,CAAC,+BAA+B,EAAE,iBAAiB,CAAC,GAAG;QAC5E,eAAe,CAAC,EAAE,gBAAgB,CAAC;KACpC,CAAC;IACF,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B,GAAG,mCAAmC,CAAC,gBAAgB,CAAC,CAuCxD"}

package/dist/esm/config/bootstrap/runtime-principal-attestation.backend.service.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"runtime-principal-attestation.backend.service.d.ts","sourceRoot":"","sources":["~~../../../../../~~src/config/bootstrap/runtime-principal-attestation.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAEH,OAAO,kBAAkB,CAAC;~~AAS1B~~,OAAO,EAAE,uBAAuB,EAAE,MAAM,qEAAqE,CAAC;AAE9G,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAmBnH,qBACa,yCAAyC;IAKf,OAAO,CAAC,QAAQ,CAAC,MAAM;IACV,OAAO,CAAC,QAAQ,CAAC,YAAY;IAL/E,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAyD;IACzF,OAAO,CAAC,aAAa,CAA8B;gBAGG,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B;IAG3G;;;;;;;OAOG;IACU,cAAc,CAAC,QAAQ,EAAE,uBAAuB,GAAG,OAAO,CAAC,MAAM,CAAC;YAWjE,eAAe;IAsC7B,OAAO,CAAC,YAAY;~~CAqCrB~~"}
1	+ {"version":3,"file":"runtime-principal-attestation.backend.service.d.ts","sourceRoot":"","sources":["../../../../src/config/bootstrap/runtime-principal-attestation.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAEH,OAAO,kBAAkB,CAAC;AAU1B,OAAO,EAAE,uBAAuB,EAAE,MAAM,qEAAqE,CAAC;AAE9G,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAmBnH,qBACa,yCAAyC;IAKf,OAAO,CAAC,QAAQ,CAAC,MAAM;IACV,OAAO,CAAC,QAAQ,CAAC,YAAY;IAL/E,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAyD;IACzF,OAAO,CAAC,aAAa,CAA8B;gBAGG,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B;IAG3G;;;;;;;OAOG;IACU,cAAc,CAAC,QAAQ,EAAE,uBAAuB,GAAG,OAAO,CAAC,MAAM,CAAC;YAWjE,eAAe;IAsC7B,OAAO,CAAC,YAAY;CAuCrB"}

package/dist/esm/config/bootstrap/runtime-principal-attestation.backend.service.js CHANGED Viewed

@@ -65,6 +65,7 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 };
 import 'reflect-metadata';
 import axios from 'axios';
+import { APPS_MANAGER_REQUEST_TIMEOUT_MS } from '../../config/models/apps-manager-transport.backend.definitions.js';
 import { inject, injectable } from 'inversify';
 import { ErrorCustomMessageReference, ErrorType, WildoHeaderKeys } from '@wildo-ai/saas-models';
 import { ApplicationBackendBootstrapEnvKeys } from '@wildo-ai/platform-core-shared';
@@ -164,6 +165,8 @@ let RuntimePrincipalAttestationBackendService = class RuntimePrincipalAttestatio
         // way — from the secret, never from a parameter.
         this.axiosInstance = axios.create({
             baseURL: appsManagerUrl,
+            // `axios` defaults to `timeout: 0` — no deadline. Measured on axios@1.13.5, not assumed.
+            timeout: APPS_MANAGER_REQUEST_TIMEOUT_MS,
             headers: {
                 [WildoHeaderKeys.CONTENT_TYPE]: 'application/json',
                 [WildoHeaderKeys.SERVICE_ID]: serviceName ?? '',

package/dist/esm/config/bootstrap/runtime-principal-attestation.backend.service.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"runtime-principal-attestation.backend.service.js","sourceRoot":"","sources":["../../../../../src/config/bootstrap/runtime-principal-attestation.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;;;;;;;;;;;;;AAEH,OAAO,kBAAkB,CAAC;AAE1B,OAAO,KAA6B,MAAM,OAAO,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAE/C,OAAO,EAAE,2BAA2B,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAChG,OAAO,EAAE,kCAAkC,EAAE,MAAM,gCAAgC,CAAC;AAEpF,OAAO,EAAE,8BAA8B,EAAE,MAAM,kEAAkE,CAAC;AAElH,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAGpF,OAAO,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAE3H;;;;;;;GAOG;AACH,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAS3B,IAAM,yCAAyC,GAA/C,MAAM,yCAAyC;IAKE;IACa;IALlD,eAAe,GAAG,IAAI,GAAG,EAA8C,CAAC;IACjF,aAAa,GAAyB,IAAI,CAAC;IAEnD,YACsD,MAAqB,EACR,YAAwC;QADrD,WAAM,GAAN,MAAM,CAAe;QACR,iBAAY,GAAZ,YAAY,CAA4B;IACxG,CAAC;IAEJ;;;;;;;OAOG;IACI,KAAK,CAAC,cAAc,CAAC,QAAiC;QAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAClD,IAAI,MAAM,IAAI,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAChD,OAAO,MAAM,CAAC,KAAK,CAAC;QACtB,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC3C,OAAO,MAAM,CAAC,KAAK,CAAC;IACtB,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,QAAiC;QAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QAEnC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAChC,8BAA8B,CAAC,YAAY,CAAC,8BAA8B,EAAE,EAC5E,EAAE,QAAQ,EAAE,CACb,CAAC;YAEF,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;YACnC,MAAM,gBAAgB,GAAG,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;YACzD,IAAI,CAAC,KAAK,IAAI,OAAO,gBAAgB,KAAK,QAAQ,EAAE,CAAC;gBACnD,uEAAuE;gBACvE,oEAAoE;gBACpE,oEAAoE;gBACpE,wBAAwB;gBACxB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;oBACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;oBACjE,OAAO,EAAE,EAAE,OAAO,EAAE,iEAAiE,EAAE,QAAQ,EAAE;iBAClG,CAAC,CAAC;YACL,CAAC;YAED,OAAO;gBACL,KAAK;gBACL,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,gBAAgB,GAAG,sBAAsB,CAAC,GAAG,IAAI;aAC1F,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,4EAA4E;YAC5E,qEAAqE;YACrE,qEAAqE;YACrE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kDAAkD,EAAE;gBACnE,QAAQ;gBACR,GAAG,2BAA2B,CAAC,KAAK,CAAC;aACtC,CAAC,CAAC;YACH,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEO,YAAY;QAClB,IAAI,IAAI,CAAC,aAAa;YAAE,OAAO,IAAI,CAAC,aAAa,CAAC;QAElD,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,yBAAyB,CAAC,CAAC;QACjG,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,mCAAmC,CAAC,CAAC;QAC1G,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,cAAc,CAAC,CAAC;QACrF,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,YAAY,CAAC,CAAC;QAEjF,IAAI,CAAC,cAAc,IAAI,CAAC,aAAa,IAAI,CAAC,aAAa,EAAE,CAAC;YACxD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,OAAO,EAAE,wGAAwG;oBACjH,4DAA4D;oBAC5D,OAAO,EAAE;wBACP,CAAC,cAAc,IAAI,kCAAkC,CAAC,yBAAyB;wBAC/E,CAAC,aAAa,IAAI,kCAAkC,CAAC,mCAAmC;wBACxF,CAAC,aAAa,IAAI,kCAAkC,CAAC,cAAc;qBACpE,CAAC,MAAM,CAAC,OAAO,CAAC;iBAClB;aACF,CAAC,CAAC;QACL,CAAC;QAED,6EAA6E;QAC7E,0EAA0E;QAC1E,iDAAiD;QACjD,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC,MAAM,CAAC;YAChC,OAAO,EAAE,cAAc;YACvB,OAAO,EAAE;gBACP,CAAC,eAAe,CAAC,YAAY,CAAC,EAAE,kBAAkB;gBAClD,CAAC,eAAe,CAAC,UAAU,CAAC,EAAE,WAAW,IAAI,EAAE;gBAC/C,CAAC,eAAe,CAAC,eAAe,CAAC,EAAE,aAAa;gBAChD,CAAC,eAAe,CAAC,cAAc,CAAC,EAAE,aAAa;aAChD;SACF,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;CACF,CAAA;AAvGY,yCAAyC;IADrD,UAAU,EAAE;IAMR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;;GANtC,yCAAyC,CAuGrD","sourcesContent":["/*\n Exchanges this runtime's BOOTSTRAP SECRET for a short-lived attestation that\n * names it to a platform service (R4).\n \n ## Why an exchange exists at all\n \n A minion needs to ask a platform service a question about ITSELF, and none of\n * the credentials it already holds can carry that:\n \n - the application's `APPLICATION_PLATFORM_REQUEST` JWT is signed with a key\n * every runtime of the application holds — the credential-delivery strip\n * covers the nine `database.` paths and no JWT path — so a claim carried\n there could name a sibling minion, or the application backend;\n * - the bootstrap secret itself is verifiable only by apps-manager, and handing\n * it to a third service would spread exactly the identity material\n * per-runtime credentials exist to confine.\n \n So the secret stays where it is and buys a token instead. apps-manager learns\n * the principal from the secret PRESENTED rather than from anything asserted,\n * and signs with a key no runtime holds.\n \n ## The cache, and what it is not\n \n Attestations are cached per AUDIENCE and re-fetched before expiry. That is a\n * round-trip optimisation, not a lifetime extension: the cached token expires on\n * apps-manager's clock regardless, and the refresh margin is what keeps a token\n * from being presented in the seconds after it dies.\n \n Keyed by audience because an attestation is bound to one — a token obtained\n * for one platform surface must not be replayed at another, so one cache slot\n * per surface is the only shape that cannot accidentally do so.\n \n ## The revocation window, stated rather than left to be discovered\n \n A consuming service authorises from the scope INSIDE the token. So narrowing a\n * minion's `platformAccess` does not take effect immediately: this process keeps\n * using its cached attestation until the refresh margin is reached, and only then\n * asks for a new one — which apps-manager refuses. *Maximum exposure is\n therefore the TTL minus the margin, currently 4½ minutes.*\n \n * That is inherent to a bearer credential, and the short TTL is what bounds it;\n * it is not a defect and there is nothing to fix here. What WAS a defect was an\n * `invalidate()` method sitting on this class as though it closed the window. It\n * had no production caller and could not have had one — a runtime learns that its\n * declaration changed by being REFUSED at the next mint, and nothing pushes a\n * declaration change to a running process. A lever wired to nothing reads as a\n * control, so it is gone; the bound above is the honest description.\n \n Closing the window properly means either a much shorter TTL (more mint traffic\n * for a surface called once per tick) or a push channel from apps-manager to every\n * runtime (a new mechanism). Neither is worth it for the current consumers, and\n * both should be decided against a real need rather than pre-emptively.\n /\n\nimport 'reflect-metadata';\n\nimport axios, { type AxiosInstance } from 'axios';\nimport { inject, injectable } from 'inversify';\n\nimport { ErrorCustomMessageReference, ErrorType, WildoHeaderKeys } from '@wildo-ai/saas-models';\nimport { ApplicationBackendBootstrapEnvKeys } from '@wildo-ai/platform-core-shared';\n\nimport { API_ROUTES_BACKEND_DEFINITIONS } from '~wildo-backend-lib/requests/models/api-routes.backend.defintions';\nimport { PlatformApplicationType } from '~wildo-backend-lib/applications/models/applications.backend.schemas';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport type { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\n\n/\n Re-fetch this many seconds before the token expires.\n \n A token that expires mid-flight fails the request it was attached to, and the\n * caller cannot tell that from a real authorization failure. The margin has to\n * cover one platform round-trip plus clock skew between two containers; 30s is\n * comfortably more than both and still small against the 5-minute lifetime.\n /\nconst REFRESH_MARGIN_SECONDS = 30;\n\ninterface CachedAttestation {\n token: string;\n /* Epoch milliseconds, already reduced by {@link REFRESH_MARGIN_SECONDS}. /\n usableUntilMs: number;\n}\n\n@injectable()\nexport class RuntimePrincipalAttestationBackendService {\n private readonly cacheByAudience = new Map<PlatformApplicationType, CachedAttestation>();\n private axiosInstance: AxiosInstance \| null = null;\n\n constructor(\n @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private readonly errorBuilder: ErrorBuilderBackendService,\n ) {}\n\n /\n A currently-valid attestation naming this runtime to `audience`.\n \n Callers attach it as {@link WildoHeaderKeys.RUNTIME_PRINCIPAL_TOKEN}. They\n * should call this per request rather than holding the string: the cache is\n * here so that costs nothing, and a caller that caches it itself will\n * eventually present an expired one.\n /\n public async getAttestation(audience: PlatformApplicationType): Promise<string> {\n const cached = this.cacheByAudience.get(audience);\n if (cached && cached.usableUntilMs > Date.now()) {\n return cached.token;\n }\n\n const minted = await this.mintAttestation(audience);\n this.cacheByAudience.set(audience, minted);\n return minted.token;\n }\n\n private async mintAttestation(audience: PlatformApplicationType): Promise<CachedAttestation> {\n const client = this.ensureClient();\n\n try {\n const response = await client.post<{ token?: string; expiresInSeconds?: number }>(\n API_ROUTES_BACKEND_DEFINITIONS.APPS_MANAGER.CREATE_RUNTIME_PRINCIPAL_TOKEN(),\n { audience },\n );\n\n const token = response.data?.token;\n const expiresInSeconds = response.data?.expiresInSeconds;\n if (!token \|\| typeof expiresInSeconds !== 'number') {\n // A malformed 200 is a failure, not a partial success. Caching a token\n // with no usable lifetime would present it once and then re-mint on\n // every single call, turning a broken response into a request storm\n // against apps-manager.\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: { message: 'apps-manager returned a malformed runtime principal attestation', audience },\n });\n }\n\n return {\n token,\n usableUntilMs: Date.now() + Math.max(0, expiresInSeconds - REFRESH_MARGIN_SECONDS) 1000,\n };\n } catch (error) {\n // Deliberately NOT degraded. A runtime that cannot prove who it is must not\n // fall back to a credential that proves less — the whole reason this\n // exchange exists is that the alternatives name the wrong principal.\n this.logger.warn('Failed to obtain a runtime principal attestation', {\n audience,\n ...projectCaughtErrorLogFields(error),\n });\n throw error;\n }\n }\n\n private ensureClient(): AxiosInstance {\n if (this.axiosInstance) return this.axiosInstance;\n\n const appsManagerUrl = process.env[ApplicationBackendBootstrapEnvKeys.PLATFORM_APPS_MANAGER_URL];\n const primarySecret = process.env[ApplicationBackendBootstrapEnvKeys.PLATFORM_APPLICATION_PRIMARY_SECRET];\n const applicationId = process.env[ApplicationBackendBootstrapEnvKeys.APPLICATION_ID];\n const serviceName = process.env[ApplicationBackendBootstrapEnvKeys.SERVICE_NAME];\n\n if (!appsManagerUrl \|\| !primarySecret \|\| !applicationId) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message: 'Runtime principal attestations require the apps-manager URL, the primary secret and the application id',\n // Names WHICH are absent without echoing the secret itself.\n missing: [\n !appsManagerUrl && ApplicationBackendBootstrapEnvKeys.PLATFORM_APPS_MANAGER_URL,\n !primarySecret && ApplicationBackendBootstrapEnvKeys.PLATFORM_APPLICATION_PRIMARY_SECRET,\n !applicationId && ApplicationBackendBootstrapEnvKeys.APPLICATION_ID,\n ].filter(Boolean),\n },\n });\n }\n\n // The SAME three headers the config loader presents, because this route sits\n // on the same apps-to-manager channel and resolves the principal the same\n // way — from the secret, never from a parameter.\n this.axiosInstance = axios.create({\n baseURL: appsManagerUrl,\n headers: {\n [WildoHeaderKeys.CONTENT_TYPE]: 'application/json',\n [WildoHeaderKeys.SERVICE_ID]: serviceName ?? '',\n [WildoHeaderKeys.PLATFORM_SECRET]: primarySecret,\n [WildoHeaderKeys.APPLICATION_ID]: applicationId,\n },\n });\n return this.axiosInstance;\n }\n}\n"]}
1	+ {"version":3,"file":"runtime-principal-attestation.backend.service.js","sourceRoot":"","sources":["../../../../src/config/bootstrap/runtime-principal-attestation.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;;;;;;;;;;;;;AAEH,OAAO,kBAAkB,CAAC;AAE1B,OAAO,KAA6B,MAAM,OAAO,CAAC;AAClD,OAAO,EAAE,+BAA+B,EAAE,MAAM,6EAA6E,CAAC;AAC9H,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAE/C,OAAO,EAAE,2BAA2B,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAChG,OAAO,EAAE,kCAAkC,EAAE,MAAM,gCAAgC,CAAC;AAEpF,OAAO,EAAE,8BAA8B,EAAE,MAAM,kEAAkE,CAAC;AAElH,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAGpF,OAAO,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAE3H;;;;;;;GAOG;AACH,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAS3B,IAAM,yCAAyC,GAA/C,MAAM,yCAAyC;IAKE;IACa;IALlD,eAAe,GAAG,IAAI,GAAG,EAA8C,CAAC;IACjF,aAAa,GAAyB,IAAI,CAAC;IAEnD,YACsD,MAAqB,EACR,YAAwC;QADrD,WAAM,GAAN,MAAM,CAAe;QACR,iBAAY,GAAZ,YAAY,CAA4B;IACxG,CAAC;IAEJ;;;;;;;OAOG;IACI,KAAK,CAAC,cAAc,CAAC,QAAiC;QAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAClD,IAAI,MAAM,IAAI,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAChD,OAAO,MAAM,CAAC,KAAK,CAAC;QACtB,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC3C,OAAO,MAAM,CAAC,KAAK,CAAC;IACtB,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,QAAiC;QAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QAEnC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAChC,8BAA8B,CAAC,YAAY,CAAC,8BAA8B,EAAE,EAC5E,EAAE,QAAQ,EAAE,CACb,CAAC;YAEF,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;YACnC,MAAM,gBAAgB,GAAG,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;YACzD,IAAI,CAAC,KAAK,IAAI,OAAO,gBAAgB,KAAK,QAAQ,EAAE,CAAC;gBACnD,uEAAuE;gBACvE,oEAAoE;gBACpE,oEAAoE;gBACpE,wBAAwB;gBACxB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;oBACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;oBACjE,OAAO,EAAE,EAAE,OAAO,EAAE,iEAAiE,EAAE,QAAQ,EAAE;iBAClG,CAAC,CAAC;YACL,CAAC;YAED,OAAO;gBACL,KAAK;gBACL,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,gBAAgB,GAAG,sBAAsB,CAAC,GAAG,IAAI;aAC1F,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,4EAA4E;YAC5E,qEAAqE;YACrE,qEAAqE;YACrE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kDAAkD,EAAE;gBACnE,QAAQ;gBACR,GAAG,2BAA2B,CAAC,KAAK,CAAC;aACtC,CAAC,CAAC;YACH,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEO,YAAY;QAClB,IAAI,IAAI,CAAC,aAAa;YAAE,OAAO,IAAI,CAAC,aAAa,CAAC;QAElD,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,yBAAyB,CAAC,CAAC;QACjG,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,mCAAmC,CAAC,CAAC;QAC1G,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,cAAc,CAAC,CAAC;QACrF,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,YAAY,CAAC,CAAC;QAEjF,IAAI,CAAC,cAAc,IAAI,CAAC,aAAa,IAAI,CAAC,aAAa,EAAE,CAAC;YACxD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,OAAO,EAAE,wGAAwG;oBACjH,4DAA4D;oBAC5D,OAAO,EAAE;wBACP,CAAC,cAAc,IAAI,kCAAkC,CAAC,yBAAyB;wBAC/E,CAAC,aAAa,IAAI,kCAAkC,CAAC,mCAAmC;wBACxF,CAAC,aAAa,IAAI,kCAAkC,CAAC,cAAc;qBACpE,CAAC,MAAM,CAAC,OAAO,CAAC;iBAClB;aACF,CAAC,CAAC;QACL,CAAC;QAED,6EAA6E;QAC7E,0EAA0E;QAC1E,iDAAiD;QACjD,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC,MAAM,CAAC;YAChC,OAAO,EAAE,cAAc;YACvB,yFAAyF;YACzF,OAAO,EAAE,+BAA+B;YACxC,OAAO,EAAE;gBACP,CAAC,eAAe,CAAC,YAAY,CAAC,EAAE,kBAAkB;gBAClD,CAAC,eAAe,CAAC,UAAU,CAAC,EAAE,WAAW,IAAI,EAAE;gBAC/C,CAAC,eAAe,CAAC,eAAe,CAAC,EAAE,aAAa;gBAChD,CAAC,eAAe,CAAC,cAAc,CAAC,EAAE,aAAa;aAChD;SACF,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;CACF,CAAA;AAzGY,yCAAyC;IADrD,UAAU,EAAE;IAMR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;;GANtC,yCAAyC,CAyGrD","sourcesContent":["/*\n Exchanges this runtime's BOOTSTRAP SECRET for a short-lived attestation that\n * names it to a platform service (R4).\n \n ## Why an exchange exists at all\n \n A minion needs to ask a platform service a question about ITSELF, and none of\n * the credentials it already holds can carry that:\n \n - the application's `APPLICATION_PLATFORM_REQUEST` JWT is signed with a key\n * every runtime of the application holds — the credential-delivery strip\n * covers the nine `database.` paths and no JWT path — so a claim carried\n there could name a sibling minion, or the application backend;\n * - the bootstrap secret itself is verifiable only by apps-manager, and handing\n * it to a third service would spread exactly the identity material\n * per-runtime credentials exist to confine.\n \n So the secret stays where it is and buys a token instead. apps-manager learns\n * the principal from the secret PRESENTED rather than from anything asserted,\n * and signs with a key no runtime holds.\n \n ## The cache, and what it is not\n \n Attestations are cached per AUDIENCE and re-fetched before expiry. That is a\n * round-trip optimisation, not a lifetime extension: the cached token expires on\n * apps-manager's clock regardless, and the refresh margin is what keeps a token\n * from being presented in the seconds after it dies.\n \n Keyed by audience because an attestation is bound to one — a token obtained\n * for one platform surface must not be replayed at another, so one cache slot\n * per surface is the only shape that cannot accidentally do so.\n \n ## The revocation window, stated rather than left to be discovered\n \n A consuming service authorises from the scope INSIDE the token. So narrowing a\n * minion's `platformAccess` does not take effect immediately: this process keeps\n * using its cached attestation until the refresh margin is reached, and only then\n * asks for a new one — which apps-manager refuses. *Maximum exposure is\n therefore the TTL minus the margin, currently 4½ minutes.*\n \n * That is inherent to a bearer credential, and the short TTL is what bounds it;\n * it is not a defect and there is nothing to fix here. What WAS a defect was an\n * `invalidate()` method sitting on this class as though it closed the window. It\n * had no production caller and could not have had one — a runtime learns that its\n * declaration changed by being REFUSED at the next mint, and nothing pushes a\n * declaration change to a running process. A lever wired to nothing reads as a\n * control, so it is gone; the bound above is the honest description.\n \n Closing the window properly means either a much shorter TTL (more mint traffic\n * for a surface called once per tick) or a push channel from apps-manager to every\n * runtime (a new mechanism). Neither is worth it for the current consumers, and\n * both should be decided against a real need rather than pre-emptively.\n /\n\nimport 'reflect-metadata';\n\nimport axios, { type AxiosInstance } from 'axios';\nimport { APPS_MANAGER_REQUEST_TIMEOUT_MS } from '~wildo-backend-lib/config/models/apps-manager-transport.backend.definitions';\nimport { inject, injectable } from 'inversify';\n\nimport { ErrorCustomMessageReference, ErrorType, WildoHeaderKeys } from '@wildo-ai/saas-models';\nimport { ApplicationBackendBootstrapEnvKeys } from '@wildo-ai/platform-core-shared';\n\nimport { API_ROUTES_BACKEND_DEFINITIONS } from '~wildo-backend-lib/requests/models/api-routes.backend.defintions';\nimport { PlatformApplicationType } from '~wildo-backend-lib/applications/models/applications.backend.schemas';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport type { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\n\n/\n Re-fetch this many seconds before the token expires.\n \n A token that expires mid-flight fails the request it was attached to, and the\n * caller cannot tell that from a real authorization failure. The margin has to\n * cover one platform round-trip plus clock skew between two containers; 30s is\n * comfortably more than both and still small against the 5-minute lifetime.\n /\nconst REFRESH_MARGIN_SECONDS = 30;\n\ninterface CachedAttestation {\n token: string;\n /* Epoch milliseconds, already reduced by {@link REFRESH_MARGIN_SECONDS}. /\n usableUntilMs: number;\n}\n\n@injectable()\nexport class RuntimePrincipalAttestationBackendService {\n private readonly cacheByAudience = new Map<PlatformApplicationType, CachedAttestation>();\n private axiosInstance: AxiosInstance \| null = null;\n\n constructor(\n @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private readonly errorBuilder: ErrorBuilderBackendService,\n ) {}\n\n /\n A currently-valid attestation naming this runtime to `audience`.\n \n Callers attach it as {@link WildoHeaderKeys.RUNTIME_PRINCIPAL_TOKEN}. They\n * should call this per request rather than holding the string: the cache is\n * here so that costs nothing, and a caller that caches it itself will\n * eventually present an expired one.\n /\n public async getAttestation(audience: PlatformApplicationType): Promise<string> {\n const cached = this.cacheByAudience.get(audience);\n if (cached && cached.usableUntilMs > Date.now()) {\n return cached.token;\n }\n\n const minted = await this.mintAttestation(audience);\n this.cacheByAudience.set(audience, minted);\n return minted.token;\n }\n\n private async mintAttestation(audience: PlatformApplicationType): Promise<CachedAttestation> {\n const client = this.ensureClient();\n\n try {\n const response = await client.post<{ token?: string; expiresInSeconds?: number }>(\n API_ROUTES_BACKEND_DEFINITIONS.APPS_MANAGER.CREATE_RUNTIME_PRINCIPAL_TOKEN(),\n { audience },\n );\n\n const token = response.data?.token;\n const expiresInSeconds = response.data?.expiresInSeconds;\n if (!token \|\| typeof expiresInSeconds !== 'number') {\n // A malformed 200 is a failure, not a partial success. Caching a token\n // with no usable lifetime would present it once and then re-mint on\n // every single call, turning a broken response into a request storm\n // against apps-manager.\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: { message: 'apps-manager returned a malformed runtime principal attestation', audience },\n });\n }\n\n return {\n token,\n usableUntilMs: Date.now() + Math.max(0, expiresInSeconds - REFRESH_MARGIN_SECONDS) 1000,\n };\n } catch (error) {\n // Deliberately NOT degraded. A runtime that cannot prove who it is must not\n // fall back to a credential that proves less — the whole reason this\n // exchange exists is that the alternatives name the wrong principal.\n this.logger.warn('Failed to obtain a runtime principal attestation', {\n audience,\n ...projectCaughtErrorLogFields(error),\n });\n throw error;\n }\n }\n\n private ensureClient(): AxiosInstance {\n if (this.axiosInstance) return this.axiosInstance;\n\n const appsManagerUrl = process.env[ApplicationBackendBootstrapEnvKeys.PLATFORM_APPS_MANAGER_URL];\n const primarySecret = process.env[ApplicationBackendBootstrapEnvKeys.PLATFORM_APPLICATION_PRIMARY_SECRET];\n const applicationId = process.env[ApplicationBackendBootstrapEnvKeys.APPLICATION_ID];\n const serviceName = process.env[ApplicationBackendBootstrapEnvKeys.SERVICE_NAME];\n\n if (!appsManagerUrl \|\| !primarySecret \|\| !applicationId) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message: 'Runtime principal attestations require the apps-manager URL, the primary secret and the application id',\n // Names WHICH are absent without echoing the secret itself.\n missing: [\n !appsManagerUrl && ApplicationBackendBootstrapEnvKeys.PLATFORM_APPS_MANAGER_URL,\n !primarySecret && ApplicationBackendBootstrapEnvKeys.PLATFORM_APPLICATION_PRIMARY_SECRET,\n !applicationId && ApplicationBackendBootstrapEnvKeys.APPLICATION_ID,\n ].filter(Boolean),\n },\n });\n }\n\n // The SAME three headers the config loader presents, because this route sits\n // on the same apps-to-manager channel and resolves the principal the same\n // way — from the secret, never from a parameter.\n this.axiosInstance = axios.create({\n baseURL: appsManagerUrl,\n // `axios` defaults to `timeout: 0` — no deadline. Measured on axios@1.13.5, not assumed.\n timeout: APPS_MANAGER_REQUEST_TIMEOUT_MS,\n headers: {\n [WildoHeaderKeys.CONTENT_TYPE]: 'application/json',\n [WildoHeaderKeys.SERVICE_ID]: serviceName ?? '',\n [WildoHeaderKeys.PLATFORM_SECRET]: primarySecret,\n [WildoHeaderKeys.APPLICATION_ID]: applicationId,\n },\n });\n return this.axiosInstance;\n }\n}\n"]}

package/dist/esm/config/bootstrap/runtime-principal.backend.service.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"runtime-principal.backend.service.d.ts","sourceRoot":"","sources":["~~../../../../../~~src/config/bootstrap/runtime-principal.backend.service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,yBAAyB,EAAE,MAAM,yEAAyE,CAAC;AAEpH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,WAAW,0BAA0B;IACzC,6CAA6C;IAC7C,cAAc,EAAE,yBAAyB,CAAC;IAC1C;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;;;;;GAYG;AACH,qBACa,8BAA8B;IACzC,OAAO,CAAC,UAAU,CAMhB;IAEK,UAAU,CAAC,UAAU,EAAE,0BAA0B,GAAG,IAAI;IAIxD,QAAQ,IAAI,0BAA0B;IAI7C;;;;;;;OAOG;IACI,gBAAgB,IAAI;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;KAAE;CAOvG"}
1	+ {"version":3,"file":"runtime-principal.backend.service.d.ts","sourceRoot":"","sources":["../../../../src/config/bootstrap/runtime-principal.backend.service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,yBAAyB,EAAE,MAAM,yEAAyE,CAAC;AAEpH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,WAAW,0BAA0B;IACzC,6CAA6C;IAC7C,cAAc,EAAE,yBAAyB,CAAC;IAC1C;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;;;;;GAYG;AACH,qBACa,8BAA8B;IACzC,OAAO,CAAC,UAAU,CAMhB;IAEK,UAAU,CAAC,UAAU,EAAE,0BAA0B,GAAG,IAAI;IAIxD,QAAQ,IAAI,0BAA0B;IAI7C;;;;;;;OAOG;IACI,gBAAgB,IAAI;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;KAAE;CAOvG"}

package/dist/esm/config/custom/application-config-controller.backend.service.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"application-config-controller.backend.service.d.ts","sourceRoot":"","sources":["~~../../../../../~~src/config/custom/application-config-controller.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAG1B,OAAO,EAAE,gCAAgC,EAAE,MAAM,0FAA0F,CAAC;AAC5I,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAE/G,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,mBAAmB,EAAE,MAAM,kEAAkE,CAAC;AAEvG,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,mFAAmF,CAAC;AAUzI;;;;;;;;;;GAUG;AAEH,qBACa,yCAA0C,SAAQ,gCAAgC;IAE7F,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA0B;IAC3D,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAkC;gBAItC,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EACxC,YAAY,EAAE,mBAAmB,EACpC,gBAAgB,EAAE,uBAAuB,EAC1B,wBAAwB,EAAE,+BAA+B;IAOvH;;OAEG;IACH,SAAS,CAAC,WAAW,IAAI,IAAI;IAO7B;;;OAGG;YACW,oBAAoB;CA+EnC"}
1	+ {"version":3,"file":"application-config-controller.backend.service.d.ts","sourceRoot":"","sources":["../../../../src/config/custom/application-config-controller.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAG1B,OAAO,EAAE,gCAAgC,EAAE,MAAM,0FAA0F,CAAC;AAC5I,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAE/G,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,mBAAmB,EAAE,MAAM,kEAAkE,CAAC;AAEvG,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,mFAAmF,CAAC;AAUzI;;;;;;;;;;GAUG;AAEH,qBACa,yCAA0C,SAAQ,gCAAgC;IAE7F,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA0B;IAC3D,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAkC;gBAItC,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EACxC,YAAY,EAAE,mBAAmB,EACpC,gBAAgB,EAAE,uBAAuB,EAC1B,wBAAwB,EAAE,+BAA+B;IAOvH;;OAEG;IACH,SAAS,CAAC,WAAW,IAAI,IAAI;IAO7B;;;OAGG;YACW,oBAAoB;CA+EnC"}

package/dist/esm/config/models/app-config-secrets.backend.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"app-config-secrets.backend.schemas.d.ts","sourceRoot":"","sources":["~~../../../../../~~src/config/models/app-config-secrets.backend.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,wEAAwE,CAAC;AACxG,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAqExB,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA8CzC,CAAC;AAEH;;oEAEoE;AAEpE,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAerF,wBAAgB,+CAA+C,CAC7D,eAAe,EAAE,uBAAuB,EACxC,WAAW,EAAE,uBAAuB,GACnC;IACD,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,CAMA"}
1	+ {"version":3,"file":"app-config-secrets.backend.schemas.d.ts","sourceRoot":"","sources":["../../../../src/config/models/app-config-secrets.backend.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,wEAAwE,CAAC;AACxG,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAqExB,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA8CzC,CAAC;AAEH;;oEAEoE;AAEpE,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAerF,wBAAgB,+CAA+C,CAC7D,eAAe,EAAE,uBAAuB,EACxC,WAAW,EAAE,uBAAuB,GACnC;IACD,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,CAMA"}

package/dist/esm/config/models/app-config.backend-authored.definitions.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"app-config.backend-authored.definitions.d.ts","sourceRoot":"","sources":["~~../../../../../~~src/config/models/app-config.backend-authored.definitions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,gBAAgB,EAChB,wCAAwC,EACxC,gCAAgC,EACjC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,uBAAuB,CAAC;AAM/B,KAAK,WAAW,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,GAChC,CAAC,GACD,CAAC,SAAS,kBAAkB,GAC1B,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG;KACf,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;CACpD,GACD,CAAC,SAAS,KAAK,CAAC,MAAM,CAAC,CAAC,GACtB,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GACrB,CAAC,SAAS,MAAM,GACd;KAAG,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;CAAE,GACtC,CAAC,CAAC;AAEZ,KAAK,2BAA2B,GAAG,IAAI,CACrC,wCAAwC,CAAC,OAAO,CAAC,EACjD,6BAA6B,GAAG,yBAAyB,CAC1D,CAAC;AAEF,KAAK,8BAA8B,GAAG,IAAI,CACxC,wCAAwC,EACxC,aAAa,GAAG,SAAS,GAAG,SAAS,GAAG,oBAAoB,GAAG,WAAW,GAAG,wBAAwB,GAAG,OAAO,CAChH,GAAG;IACF,KAAK,EAAE,2BAA2B,CAAC;CACpC,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,gHAAgH;AAChH;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,gCAAgC,GAC1C,WAAW,CAAC,8BAA8B,CAAC,CAAC;AAC9C,sEAAsE;AAEtE,KAAK,0BAA0B,GAAG,gBAAgB,GAAG,gCAAgC,CAAC;AAkHtF,wBAAgB,gBAAgB,CAAC,CAAC,EAChC,SAAS,EAAE,CAAC,EACZ,aAAa,EAAE,OAAO,EACtB,IAAI,GAAE,SAAS,MAAM,EAAO,GAC3B,CAAC,CA4BH;AAED,wBAAgB,wCAAwC,CACtD,cAAc,EAAE,0BAA0B,EAC1C,UAAU,EAAE,0BAA0B,GACrC;IACD,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,CAiBA;AAED;;GAEG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,0BAA0B,EAClC,aAAa,EAAE,gCAAgC,GAC9C,0BAA0B,CAiB5B"}
1	+ {"version":3,"file":"app-config.backend-authored.definitions.d.ts","sourceRoot":"","sources":["../../../../src/config/models/app-config.backend-authored.definitions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,gBAAgB,EAChB,wCAAwC,EACxC,gCAAgC,EACjC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,uBAAuB,CAAC;AAM/B,KAAK,WAAW,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,GAChC,CAAC,GACD,CAAC,SAAS,kBAAkB,GAC1B,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG;KACf,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;CACpD,GACD,CAAC,SAAS,KAAK,CAAC,MAAM,CAAC,CAAC,GACtB,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GACrB,CAAC,SAAS,MAAM,GACd;KAAG,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;CAAE,GACtC,CAAC,CAAC;AAEZ,KAAK,2BAA2B,GAAG,IAAI,CACrC,wCAAwC,CAAC,OAAO,CAAC,EACjD,6BAA6B,GAAG,yBAAyB,CAC1D,CAAC;AAEF,KAAK,8BAA8B,GAAG,IAAI,CACxC,wCAAwC,EACxC,aAAa,GAAG,SAAS,GAAG,SAAS,GAAG,oBAAoB,GAAG,WAAW,GAAG,wBAAwB,GAAG,OAAO,CAChH,GAAG;IACF,KAAK,EAAE,2BAA2B,CAAC;CACpC,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,gHAAgH;AAChH;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,gCAAgC,GAC1C,WAAW,CAAC,8BAA8B,CAAC,CAAC;AAC9C,sEAAsE;AAEtE,KAAK,0BAA0B,GAAG,gBAAgB,GAAG,gCAAgC,CAAC;AAkHtF,wBAAgB,gBAAgB,CAAC,CAAC,EAChC,SAAS,EAAE,CAAC,EACZ,aAAa,EAAE,OAAO,EACtB,IAAI,GAAE,SAAS,MAAM,EAAO,GAC3B,CAAC,CA4BH;AAED,wBAAgB,wCAAwC,CACtD,cAAc,EAAE,0BAA0B,EAC1C,UAAU,EAAE,0BAA0B,GACrC;IACD,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,CAiBA;AAED;;GAEG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,0BAA0B,EAClC,aAAa,EAAE,gCAAgC,GAC9C,0BAA0B,CAiB5B"}