@wildo-ai/saas-backend-lib 1.1.2 → 1.1.4

package/dist/esm/errors/utils/rate-limit-environment-relaxation.backend.utils.d.ts

@@ -80,4 +80,37 @@ export declare function resolveRateLimitEnvironmentMultiplier(applicationEnv: Ru
  * @returns `authoredMax` in `STAGING` / `PRODUCTION`; the relaxed ceiling otherwise.
  */
 export declare function relaxAbuseThrottleMaxForEnvironment(authoredMax: number, applicationEnv: RuntimeEnvironment): number;
+/**
+ * Every abuse throttle this relaxation reaches, named so the boot announcement can list them (#499).
+ *
+ * A line saying "abuse limits relaxed" would be accurate and still misleading: an operator would
+ * reasonably read it as ALL of them, and it is not — a counter whose maximum is a product or tenant
+ * policy is deliberately untouched, as is any counter used as an audit de-duplication window (see the
+ * module header). Naming the reached set is what makes the announcement actionable rather than
+ * atmospheric.
+ *
+ * Maintained by hand against the import sites, which is a list re-stating another file's population —
+ * exactly the shape `invariant-call-site-enumeration.md` warns about. It is tolerable ONLY because it
+ * feeds a log line rather than a decision: a stale entry here misinforms an operator, it does not
+ * change a ceiling. Keep it in step when a site is added, and prefer deleting it over letting it rot.
+ */
+export declare const RELAXED_ABUSE_THROTTLE_SITES: readonly string[];
+/** What a boot announcement should say, or `null` when the environment relaxes nothing. */
+export interface AbuseThrottleRelaxationAnnouncement {
+    readonly applicationEnv: RuntimeEnvironment;
+    readonly multiplier: number;
+    readonly relaxedSites: readonly string[];
+}
+/**
+ * Describe the relaxation in force, for an unmissable line at startup (#499).
+ *
+ * The relaxation is keyed on the resolved environment and nothing else — a deliberate decision, so
+ * there is one source of truth for "what kind of host is this" rather than a second flag that can
+ * disagree with it. The residual risk is that a host which merely REPORTS development (a demonstration
+ * box, a staging-like environment mis-declared) runs with maxima multiplied by a thousand. That risk is
+ * accepted, and this function is the whole of what makes it visible instead of silent.
+ *
+ * Returns `null` in `STAGING` / `PRODUCTION`, so a caller logs nothing where nothing is relaxed.
+ */
+export declare function describeAbuseThrottleRelaxation(applicationEnv: RuntimeEnvironment): AbuseThrottleRelaxationAnnouncement | null;
 //# sourceMappingURL=rate-limit-environment-relaxation.backend.utils.d.ts.map

package/dist/esm/errors/utils/rate-limit-environment-relaxation.backend.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limit-environment-relaxation.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../src/errors/utils/rate-limit-environment-relaxation.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAE3D;;;;;;;GAOG;AACH,eAAO,MAAM,oCAAoC,OAAO,CAAC;AAEzD;;;;;;GAMG;AACH,wBAAgB,qCAAqC,CAAC,cAAc,EAAE,kBAAkB,GAAG,MAAM,CAIhG;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mCAAmC,CAAC,WAAW,EAAE,MAAM,EAAE,cAAc,EAAE,kBAAkB,GAAG,MAAM,CAEnH"}
+{"version":3,"file":"rate-limit-environment-relaxation.backend.utils.d.ts","sourceRoot":"","sources":["../../../../src/errors/utils/rate-limit-environment-relaxation.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAE3D;;;;;;;GAOG;AACH,eAAO,MAAM,oCAAoC,OAAO,CAAC;AAEzD;;;;;;GAMG;AACH,wBAAgB,qCAAqC,CAAC,cAAc,EAAE,kBAAkB,GAAG,MAAM,CAIhG;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mCAAmC,CAAC,WAAW,EAAE,MAAM,EAAE,cAAc,EAAE,kBAAkB,GAAG,MAAM,CAEnH;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4BAA4B,EAAE,SAAS,MAAM,EAQzD,CAAC;AAEF,2FAA2F;AAC3F,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,cAAc,EAAE,kBAAkB,CAAC;IAC5C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,+BAA+B,CAC7C,cAAc,EAAE,kBAAkB,GACjC,mCAAmC,GAAG,IAAI,CAK5C"}

package/dist/esm/errors/utils/rate-limit-environment-relaxation.backend.utils.js

@@ -86,4 +86,44 @@ export function resolveRateLimitEnvironmentMultiplier(applicationEnv) {
 export function relaxAbuseThrottleMaxForEnvironment(authoredMax, applicationEnv) {
     return authoredMax * resolveRateLimitEnvironmentMultiplier(applicationEnv);
 }
+/**
+ * Every abuse throttle this relaxation reaches, named so the boot announcement can list them (#499).
+ *
+ * A line saying "abuse limits relaxed" would be accurate and still misleading: an operator would
+ * reasonably read it as ALL of them, and it is not — a counter whose maximum is a product or tenant
+ * policy is deliberately untouched, as is any counter used as an audit de-duplication window (see the
+ * module header). Naming the reached set is what makes the announcement actionable rather than
+ * atmospheric.
+ *
+ * Maintained by hand against the import sites, which is a list re-stating another file's population —
+ * exactly the shape `invariant-call-site-enumeration.md` warns about. It is tolerable ONLY because it
+ * feeds a log line rather than a decision: a stale entry here misinforms an operator, it does not
+ * change a ceiling. Keep it in step when a site is added, and prefer deleting it over letting it rot.
+ */
+export const RELAXED_ABUSE_THROTTLE_SITES = [
+    'HTTP perimeter limiter',
+    'WebSocket per-event limiter',
+    'machine-credential failure guard',
+    'external-turn throttle (A2A / MCP)',
+    'authorization-denial audit sampler',
+    'webhook endpoint-test cap',
+    'rate-limit policy service',
+];
+/**
+ * Describe the relaxation in force, for an unmissable line at startup (#499).
+ *
+ * The relaxation is keyed on the resolved environment and nothing else — a deliberate decision, so
+ * there is one source of truth for "what kind of host is this" rather than a second flag that can
+ * disagree with it. The residual risk is that a host which merely REPORTS development (a demonstration
+ * box, a staging-like environment mis-declared) runs with maxima multiplied by a thousand. That risk is
+ * accepted, and this function is the whole of what makes it visible instead of silent.
+ *
+ * Returns `null` in `STAGING` / `PRODUCTION`, so a caller logs nothing where nothing is relaxed.
+ */
+export function describeAbuseThrottleRelaxation(applicationEnv) {
+    const multiplier = resolveRateLimitEnvironmentMultiplier(applicationEnv);
+    return multiplier === 1
+        ? null
+        : { applicationEnv, multiplier, relaxedSites: RELAXED_ABUSE_THROTTLE_SITES };
+}
 //# sourceMappingURL=rate-limit-environment-relaxation.backend.utils.js.map

package/dist/esm/errors/utils/rate-limit-environment-relaxation.backend.utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limit-environment-relaxation.backend.utils.js","sourceRoot":"","sources":["../../../../../src/errors/utils/rate-limit-environment-relaxation.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAE3D;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,IAAI,CAAC;AAEzD;;;;;;GAMG;AACH,MAAM,UAAU,qCAAqC,CAAC,cAAkC;IACtF,OAAO,cAAc,KAAK,kBAAkB,CAAC,WAAW,IAAI,cAAc,KAAK,kBAAkB,CAAC,IAAI;QACpG,CAAC,CAAC,oCAAoC;QACtC,CAAC,CAAC,CAAC,CAAC;AACR,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,mCAAmC,CAAC,WAAmB,EAAE,cAAkC;IACzG,OAAO,WAAW,GAAG,qCAAqC,CAAC,cAAc,CAAC,CAAC;AAC7E,CAAC","sourcesContent":["/**\n * Non-production relaxation of ABUSE-THROTTLE maxima — the single seam.\n *\n * ## Why this module exists\n *\n * Every rate-limit maximum in the engine is authored for a PRODUCTION threat model\n * (credential stuffing, registration spam, enumeration, LLM-spend abuse, unmetered\n * egress). Applied unchanged, those same numbers turn ordinary local development and\n * automated e2e/integration runs — which legitimately fire the same endpoint from the\n * same IP, the same email and the same principal dozens of times in seconds — into a\n * 429 flood.\n *\n * The relaxation used to live as a private constant inside\n * `RateLimitBackendService`, so it reached only that service's three surfaces\n * (`checkRateLimit`, `checkPolicy`, `checkPolicyForVariant`). Five other enforcement\n * sites carry their own hard-coded maxima and never saw it. The one that hurt most in\n * practice was the machine-credential failure guard\n * (`assertMachineAuthAttemptWithinRate`, 50 failures / 600 s / source IP): on a dev\n * machine every process shares `127.0.0.1`, so fifty failed `sk_*` / `oc_*`\n * presentations from ANY source lock out every machine-credential path for ten\n * minutes — including the ones a developer is actively debugging.\n *\n * This module is that single seam. Import it at every abuse-throttle site rather than\n * re-deriving an environment branch locally; a second copy of the branch is how the\n * first one drifted (see `.claude/rules/invariant-call-site-enumeration.md`).\n *\n * ## What it deliberately does NOT do\n *\n * - **It does not bypass enforcement.** The counters still increment through the real\n *   Redis `INCR` + `EXPIRE` path, so a genuine regression (windows not incrementing,\n *   keys colliding, TTL never set) still reproduces locally. Only the ceiling moves.\n * - **It does not touch `STAGING` / `PRODUCTION`.** {@link resolveRateLimitEnvironmentMultiplier}\n *   returns `1` for every environment other than `DEVELOPMENT` and `TEST`, so the\n *   authored number IS the enforced number wherever the threat model is real.\n * - **It must not be applied to business-semantic counters.** A counter whose maximum\n *   is a product or tenant policy — SSO grace logins (`enforcement.graceLoginAttempts`),\n *   trial quotas, plan entitlements — is not an abuse throttle. Multiplying it would\n *   change observable product behavior in dev/test and make local runs disagree with\n *   production semantics, which is the opposite of what this exists for. The same goes\n *   for counters used as audit/log DE-DUPLICATION windows (the authorization-denial\n *   audit sampler, the SAML assertion warning de-dup): relaxing those produces an\n *   audit/log flood, not headroom.\n *\n * @see `.claude/rules/invariant-call-site-enumeration.md` — the per-site enumeration\n *   discipline that produced this module.\n */\n\nimport { RuntimeEnvironment } from '@wildo-ai/saas-models';\n\n/**\n * Factor applied to an abuse-throttle maximum in `DEVELOPMENT` / `TEST`.\n *\n * Large on purpose. The goal is that no honest local or automated run can reach a\n * ceiling, while the counter itself still exercises the real enforcement path. A\n * smaller factor (10×, 100×) merely moves the flood later into a long e2e suite,\n * which is the worst of both worlds: still flaky, still hard to attribute.\n */\nexport const NON_PRODUCTION_RATE_LIMIT_MULTIPLIER = 1000;\n\n/**\n * `NON_PRODUCTION_RATE_LIMIT_MULTIPLIER` in `DEVELOPMENT` / `TEST`, `1` everywhere\n * else. The single branch point for the relaxation.\n *\n * @param applicationEnv - the resolved runtime environment, normally\n *   `AppConfigurationService.applicationEnv`.\n */\nexport function resolveRateLimitEnvironmentMultiplier(applicationEnv: RuntimeEnvironment): number {\n  return applicationEnv === RuntimeEnvironment.DEVELOPMENT || applicationEnv === RuntimeEnvironment.TEST\n    ? NON_PRODUCTION_RATE_LIMIT_MULTIPLIER\n    : 1;\n}\n\n/**\n * Scale one abuse-throttle maximum for the current environment. The canonical call\n * shape at an enforcement site:\n *\n * ```ts\n * const effectiveMax = relaxAbuseThrottleMaxForEnvironment(MACHINE_AUTH_FAILURE_MAX, applicationEnv);\n * if (failureCount >= effectiveMax) { … }\n * ```\n *\n * Compare the LIVE count against the returned value — never scale the count itself,\n * and never scale the window length. Shortening the window in dev would make a local\n * run stop reproducing the production timing behavior; raising the ceiling does not.\n *\n * @param authoredMax - the production-authored maximum for the window.\n * @param applicationEnv - the resolved runtime environment.\n * @returns `authoredMax` in `STAGING` / `PRODUCTION`; the relaxed ceiling otherwise.\n */\nexport function relaxAbuseThrottleMaxForEnvironment(authoredMax: number, applicationEnv: RuntimeEnvironment): number {\n  return authoredMax * resolveRateLimitEnvironmentMultiplier(applicationEnv);\n}\n"]}
+{"version":3,"file":"rate-limit-environment-relaxation.backend.utils.js","sourceRoot":"","sources":["../../../../src/errors/utils/rate-limit-environment-relaxation.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAE3D;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,IAAI,CAAC;AAEzD;;;;;;GAMG;AACH,MAAM,UAAU,qCAAqC,CAAC,cAAkC;IACtF,OAAO,cAAc,KAAK,kBAAkB,CAAC,WAAW,IAAI,cAAc,KAAK,kBAAkB,CAAC,IAAI;QACpG,CAAC,CAAC,oCAAoC;QACtC,CAAC,CAAC,CAAC,CAAC;AACR,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,mCAAmC,CAAC,WAAmB,EAAE,cAAkC;IACzG,OAAO,WAAW,GAAG,qCAAqC,CAAC,cAAc,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAsB;IAC7D,wBAAwB;IACxB,6BAA6B;IAC7B,kCAAkC;IAClC,oCAAoC;IACpC,oCAAoC;IACpC,2BAA2B;IAC3B,2BAA2B;CAC5B,CAAC;AASF;;;;;;;;;;GAUG;AACH,MAAM,UAAU,+BAA+B,CAC7C,cAAkC;IAElC,MAAM,UAAU,GAAG,qCAAqC,CAAC,cAAc,CAAC,CAAC;IACzE,OAAO,UAAU,KAAK,CAAC;QACrB,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,EAAE,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,4BAA4B,EAAE,CAAC;AACjF,CAAC","sourcesContent":["/**\n * Non-production relaxation of ABUSE-THROTTLE maxima — the single seam.\n *\n * ## Why this module exists\n *\n * Every rate-limit maximum in the engine is authored for a PRODUCTION threat model\n * (credential stuffing, registration spam, enumeration, LLM-spend abuse, unmetered\n * egress). Applied unchanged, those same numbers turn ordinary local development and\n * automated e2e/integration runs — which legitimately fire the same endpoint from the\n * same IP, the same email and the same principal dozens of times in seconds — into a\n * 429 flood.\n *\n * The relaxation used to live as a private constant inside\n * `RateLimitBackendService`, so it reached only that service's three surfaces\n * (`checkRateLimit`, `checkPolicy`, `checkPolicyForVariant`). Five other enforcement\n * sites carry their own hard-coded maxima and never saw it. The one that hurt most in\n * practice was the machine-credential failure guard\n * (`assertMachineAuthAttemptWithinRate`, 50 failures / 600 s / source IP): on a dev\n * machine every process shares `127.0.0.1`, so fifty failed `sk_*` / `oc_*`\n * presentations from ANY source lock out every machine-credential path for ten\n * minutes — including the ones a developer is actively debugging.\n *\n * This module is that single seam. Import it at every abuse-throttle site rather than\n * re-deriving an environment branch locally; a second copy of the branch is how the\n * first one drifted (see `.claude/rules/invariant-call-site-enumeration.md`).\n *\n * ## What it deliberately does NOT do\n *\n * - **It does not bypass enforcement.** The counters still increment through the real\n *   Redis `INCR` + `EXPIRE` path, so a genuine regression (windows not incrementing,\n *   keys colliding, TTL never set) still reproduces locally. Only the ceiling moves.\n * - **It does not touch `STAGING` / `PRODUCTION`.** {@link resolveRateLimitEnvironmentMultiplier}\n *   returns `1` for every environment other than `DEVELOPMENT` and `TEST`, so the\n *   authored number IS the enforced number wherever the threat model is real.\n * - **It must not be applied to business-semantic counters.** A counter whose maximum\n *   is a product or tenant policy — SSO grace logins (`enforcement.graceLoginAttempts`),\n *   trial quotas, plan entitlements — is not an abuse throttle. Multiplying it would\n *   change observable product behavior in dev/test and make local runs disagree with\n *   production semantics, which is the opposite of what this exists for. The same goes\n *   for counters used as audit/log DE-DUPLICATION windows (the authorization-denial\n *   audit sampler, the SAML assertion warning de-dup): relaxing those produces an\n *   audit/log flood, not headroom.\n *\n * @see `.claude/rules/invariant-call-site-enumeration.md` — the per-site enumeration\n *   discipline that produced this module.\n */\n\nimport { RuntimeEnvironment } from '@wildo-ai/saas-models';\n\n/**\n * Factor applied to an abuse-throttle maximum in `DEVELOPMENT` / `TEST`.\n *\n * Large on purpose. The goal is that no honest local or automated run can reach a\n * ceiling, while the counter itself still exercises the real enforcement path. A\n * smaller factor (10×, 100×) merely moves the flood later into a long e2e suite,\n * which is the worst of both worlds: still flaky, still hard to attribute.\n */\nexport const NON_PRODUCTION_RATE_LIMIT_MULTIPLIER = 1000;\n\n/**\n * `NON_PRODUCTION_RATE_LIMIT_MULTIPLIER` in `DEVELOPMENT` / `TEST`, `1` everywhere\n * else. The single branch point for the relaxation.\n *\n * @param applicationEnv - the resolved runtime environment, normally\n *   `AppConfigurationService.applicationEnv`.\n */\nexport function resolveRateLimitEnvironmentMultiplier(applicationEnv: RuntimeEnvironment): number {\n  return applicationEnv === RuntimeEnvironment.DEVELOPMENT || applicationEnv === RuntimeEnvironment.TEST\n    ? NON_PRODUCTION_RATE_LIMIT_MULTIPLIER\n    : 1;\n}\n\n/**\n * Scale one abuse-throttle maximum for the current environment. The canonical call\n * shape at an enforcement site:\n *\n * ```ts\n * const effectiveMax = relaxAbuseThrottleMaxForEnvironment(MACHINE_AUTH_FAILURE_MAX, applicationEnv);\n * if (failureCount >= effectiveMax) { … }\n * ```\n *\n * Compare the LIVE count against the returned value — never scale the count itself,\n * and never scale the window length. Shortening the window in dev would make a local\n * run stop reproducing the production timing behavior; raising the ceiling does not.\n *\n * @param authoredMax - the production-authored maximum for the window.\n * @param applicationEnv - the resolved runtime environment.\n * @returns `authoredMax` in `STAGING` / `PRODUCTION`; the relaxed ceiling otherwise.\n */\nexport function relaxAbuseThrottleMaxForEnvironment(authoredMax: number, applicationEnv: RuntimeEnvironment): number {\n  return authoredMax * resolveRateLimitEnvironmentMultiplier(applicationEnv);\n}\n\n/**\n * Every abuse throttle this relaxation reaches, named so the boot announcement can list them (#499).\n *\n * A line saying \"abuse limits relaxed\" would be accurate and still misleading: an operator would\n * reasonably read it as ALL of them, and it is not — a counter whose maximum is a product or tenant\n * policy is deliberately untouched, as is any counter used as an audit de-duplication window (see the\n * module header). Naming the reached set is what makes the announcement actionable rather than\n * atmospheric.\n *\n * Maintained by hand against the import sites, which is a list re-stating another file's population —\n * exactly the shape `invariant-call-site-enumeration.md` warns about. It is tolerable ONLY because it\n * feeds a log line rather than a decision: a stale entry here misinforms an operator, it does not\n * change a ceiling. Keep it in step when a site is added, and prefer deleting it over letting it rot.\n */\nexport const RELAXED_ABUSE_THROTTLE_SITES: readonly string[] = [\n  'HTTP perimeter limiter',\n  'WebSocket per-event limiter',\n  'machine-credential failure guard',\n  'external-turn throttle (A2A / MCP)',\n  'authorization-denial audit sampler',\n  'webhook endpoint-test cap',\n  'rate-limit policy service',\n];\n\n/** What a boot announcement should say, or `null` when the environment relaxes nothing. */\nexport interface AbuseThrottleRelaxationAnnouncement {\n  readonly applicationEnv: RuntimeEnvironment;\n  readonly multiplier: number;\n  readonly relaxedSites: readonly string[];\n}\n\n/**\n * Describe the relaxation in force, for an unmissable line at startup (#499).\n *\n * The relaxation is keyed on the resolved environment and nothing else — a deliberate decision, so\n * there is one source of truth for \"what kind of host is this\" rather than a second flag that can\n * disagree with it. The residual risk is that a host which merely REPORTS development (a demonstration\n * box, a staging-like environment mis-declared) runs with maxima multiplied by a thousand. That risk is\n * accepted, and this function is the whole of what makes it visible instead of silent.\n *\n * Returns `null` in `STAGING` / `PRODUCTION`, so a caller logs nothing where nothing is relaxed.\n */\nexport function describeAbuseThrottleRelaxation(\n  applicationEnv: RuntimeEnvironment,\n): AbuseThrottleRelaxationAnnouncement | null {\n  const multiplier = resolveRateLimitEnvironmentMultiplier(applicationEnv);\n  return multiplier === 1\n    ? null\n    : { applicationEnv, multiplier, relaxedSites: RELAXED_ABUSE_THROTTLE_SITES };\n}\n"]}

package/dist/esm/external-data/batches/external-data-pipeline-scheduled-run.batch.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"external-data-pipeline-scheduled-run.batch.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/external-data/batches/external-data-pipeline-scheduled-run.batch.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,iCAAiC,EAAE,MAAM,4FAA4F,CAAC;AAa/I,QAAA,MAAM,4CAA4C;;;;;;;;;iBAWhD,CAAC;AAEH,MAAM,MAAM,sCAAsC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4CAA4C,CAAC,CAAC;AAElH,wBAAgB,2CAA2C,IAAI,UAAU,CAAC,OAAO,iCAAiC,CAAC,CAyDlH"}
+{"version":3,"file":"external-data-pipeline-scheduled-run.batch.backend.service.d.ts","sourceRoot":"","sources":["../../../../src/external-data/batches/external-data-pipeline-scheduled-run.batch.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,iCAAiC,EAAE,MAAM,4FAA4F,CAAC;AAa/I,QAAA,MAAM,4CAA4C;;;;;;;;;iBAWhD,CAAC;AAEH,MAAM,MAAM,sCAAsC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4CAA4C,CAAC,CAAC;AAElH,wBAAgB,2CAA2C,IAAI,UAAU,CAAC,OAAO,iCAAiC,CAAC,CAyDlH"}

package/dist/esm/external-data/controllers/external-data-admin.backend.contracts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"external-data-admin.backend.contracts.d.ts","sourceRoot":"","sources":["../../../../../src/external-data/controllers/external-data-admin.backend.contracts.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,mHAAmH;AACnH;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,EAAG,0BAAmC,CAAC;AAEnF,2FAA2F;AAC3F,eAAO,MAAM,kCAAkC,EAAG,gBAAyB,CAAC;AAE5E;;;GAGG;AACH,eAAO,MAAM,sCAAsC,EAAG,+BAAwC,CAAC;AAE/F,6EAA6E;AAC7E,eAAO,MAAM,6BAA6B;IACxC,oFAAoF;;IAEpF;;;;;;;OAOG;;CAEK,CAAC;AAEX,MAAM,MAAM,kCAAkC,GAC5C,CAAC,OAAO,6BAA6B,CAAC,CAAC,MAAM,OAAO,6BAA6B,CAAC,CAAC;AACrF,gEAAgE"}
+{"version":3,"file":"external-data-admin.backend.contracts.d.ts","sourceRoot":"","sources":["../../../../src/external-data/controllers/external-data-admin.backend.contracts.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,mHAAmH;AACnH;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,EAAG,0BAAmC,CAAC;AAEnF,2FAA2F;AAC3F,eAAO,MAAM,kCAAkC,EAAG,gBAAyB,CAAC;AAE5E;;;GAGG;AACH,eAAO,MAAM,sCAAsC,EAAG,+BAAwC,CAAC;AAE/F,6EAA6E;AAC7E,eAAO,MAAM,6BAA6B;IACxC,oFAAoF;;IAEpF;;;;;;;OAOG;;CAEK,CAAC;AAEX,MAAM,MAAM,kCAAkC,GAC5C,CAAC,OAAO,6BAA6B,CAAC,CAAC,MAAM,OAAO,6BAA6B,CAAC,CAAC;AACrF,gEAAgE"}

package/dist/esm/external-data/controllers/external-data-admin.backend.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"external-data-admin.backend.controller.d.ts","sourceRoot":"","sources":["../../../../../src/external-data/controllers/external-data-admin.backend.controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,kBAAkB,CAAC;AAO1B,OAAO,EAAE,gCAAgC,EAAE,MAAM,0FAA0F,CAAC;AAC5I,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,mBAAmB,EAAE,MAAM,kEAAkE,CAAC;AACvG,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAE7F,OAAO,EAAE,qCAAqC,EAAE,MAAM,+EAA+E,CAAC;AACtI,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAKhK,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,6EAA6E,CAAC;AAczI,qBACa,kCAAmC,SAAQ,gCAAgC;IAMpF,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IAEnC,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IAErC,OAAO,CAAC,QAAQ,CAAC,uBAAuB;gBARL,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EACxC,YAAY,EAAE,mBAAmB,EAEhE,kBAAkB,EAAE,qCAAqC,EAEzD,oBAAoB,EAAE,yCAAyC,EAE/D,uBAAuB,EAAE,qCAAqC;IAKjF,gFAAgF;IACzE,sBAAsB,IAAI,MAAM;IAIvC,SAAS,CAAC,WAAW,IAAI,IAAI;IAgB7B;;;;OAIG;IACH,OAAO,CAAC,kBAAkB;IAgC1B;;;;;;OAMG;YACW,mBAAmB;IAmCjC,wEAAwE;YAC1D,iBAAiB;CA6BhC"}
+{"version":3,"file":"external-data-admin.backend.controller.d.ts","sourceRoot":"","sources":["../../../../src/external-data/controllers/external-data-admin.backend.controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,kBAAkB,CAAC;AAO1B,OAAO,EAAE,gCAAgC,EAAE,MAAM,0FAA0F,CAAC;AAC5I,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,mBAAmB,EAAE,MAAM,kEAAkE,CAAC;AACvG,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAE7F,OAAO,EAAE,qCAAqC,EAAE,MAAM,+EAA+E,CAAC;AACtI,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAKhK,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,6EAA6E,CAAC;AAczI,qBACa,kCAAmC,SAAQ,gCAAgC;IAMpF,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IAEnC,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IAErC,OAAO,CAAC,QAAQ,CAAC,uBAAuB;gBARL,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EACxC,YAAY,EAAE,mBAAmB,EAEhE,kBAAkB,EAAE,qCAAqC,EAEzD,oBAAoB,EAAE,yCAAyC,EAE/D,uBAAuB,EAAE,qCAAqC;IAKjF,gFAAgF;IACzE,sBAAsB,IAAI,MAAM;IAIvC,SAAS,CAAC,WAAW,IAAI,IAAI;IAgB7B;;;;OAIG;IACH,OAAO,CAAC,kBAAkB;IAgC1B;;;;;;OAMG;YACW,mBAAmB;IAmCjC,wEAAwE;YAC1D,iBAAiB;CA6BhC"}

package/dist/esm/external-data/external-data-extraction-source.backend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"external-data-extraction-source.backend.d.ts","sourceRoot":"","sources":["../../../../src/external-data/external-data-extraction-source.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAGL,KAAK,+BAA+B,EACrC,MAAM,qCAAqC,CAAC;AAE7C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAC5G,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,6FAA6F,CAAC;AAKrI,kGAAkG;AAClG,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACrC;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mFAAmF;IACnF,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;;GAGG;AACH,MAAM,WAAW,4BAA4B;IAC3C,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAC;IAC9F;;;;;;;;OAQG;IACH,qBAAqB,CAAC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CAC7C;AAED,uFAAuF;AACvF,qBAAa,mCAAoC,YAAW,4BAA4B;IAKpF,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IANnC,8FAA8F;IAC9F,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAoB;gBAGpC,WAAW,EAAE,+BAA+B,EAC5C,UAAU,EAAE,iBAAiB,EAC7B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC;IAS7C,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,CAAC;IAe1G;;;;;;;OAOG;IACU,qBAAqB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YASzC,gBAAgB;YAwBhB,eAAe;CA+B9B"}
+{"version":3,"file":"external-data-extraction-source.backend.d.ts","sourceRoot":"","sources":["../../../src/external-data/external-data-extraction-source.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAGL,KAAK,+BAA+B,EACrC,MAAM,qCAAqC,CAAC;AAE7C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAC5G,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,6FAA6F,CAAC;AAKrI,kGAAkG;AAClG,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACrC;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mFAAmF;IACnF,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;;GAGG;AACH,MAAM,WAAW,4BAA4B;IAC3C,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAC;IAC9F;;;;;;;;OAQG;IACH,qBAAqB,CAAC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CAC7C;AAED,uFAAuF;AACvF,qBAAa,mCAAoC,YAAW,4BAA4B;IAKpF,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IANnC,8FAA8F;IAC9F,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAoB;gBAGpC,WAAW,EAAE,+BAA+B,EAC5C,UAAU,EAAE,iBAAiB,EAC7B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC;IAS7C,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,CAAC;IAe1G;;;;;;;OAOG;IACU,qBAAqB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YASzC,gBAAgB;YAwBhB,eAAe;CA+B9B"}

package/dist/esm/external-data/external-data-models.exports.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"external-data-models.exports.d.ts","sourceRoot":"","sources":["../../../../src/external-data/external-data-models.exports.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,cAAc,uDAAuD,CAAC;AACtE,cAAc,mCAAmC,CAAC"}
+{"version":3,"file":"external-data-models.exports.d.ts","sourceRoot":"","sources":["../../../src/external-data/external-data-models.exports.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,cAAc,uDAAuD,CAAC;AACtE,cAAc,mCAAmC,CAAC"}

package/dist/esm/external-data/external-data-pipeline-run.backend.service.d.ts

@@ -55,6 +55,7 @@ import type { ResourcesRegistryBackendService } from '../resources/services/reso
 import type { ErrorBuilderBackendService } from '../errors/services/error-builder.backend.service';
 import type { LoggerService } from '../monitoring/logger/services/logger.service';
 import type { HttpApiAuditLogsResolver } from '../base-classes/services/repositories/http-api/http-api-resource-repository.backend.service';
+import { type AuditObservationLossMetricsRecorder } from '../monitoring/observability/audit-observation-emission.backend';
 import { type ExternalDataExtractionSource } from './external-data-extraction-source.backend';
 export interface ExternalDataPipelineRunInput {
     /** The DESTINATION resource type declaring the `externalDataPipeline`. */
@@ -109,6 +110,30 @@ export declare class ExternalDataPipelineRunBackendService {
     private readonly auditLogsResolver?;
     /** Test seam — production leaves it unset and gets the HTTP source over the shared client. */
     private readonly extractionSourceFactory?;
+    /**
+     * The PRODUCTION door to the read-through audit sink — and it had to be added, because the
+     * `@unmanaged()` thunk above cannot be one.
+     *
+     * `@unmanaged()` tells Inversify not to resolve a parameter, and this class is bound with
+     * `.to(...)`, so the container constructs it and passes `undefined` there. That made the seam a
+     * TEST-ONLY door: every scheduled ETL run in production reached `recordRunReadThroughAccess`,
+     * found no resolver, and emitted nothing. The sink itself exists
+     * (`AuditLogsBackendService.logHttpApiReadThroughAccess`), so nothing was refusing — the row was
+     * simply never written, silently, which is exactly the shape the loss counter now makes visible.
+     *
+     * Two suppliers, and they cannot collide: `@unmanaged()` is structurally unfillable by the
+     * container, so the thunk is only ever set by a test constructing this class with `new`, and it
+     * takes precedence there so a suite can substitute a double. `@optional()` here for the usual
+     * reason — a minimal container binds no audit service and an ETL run must still run.
+     *
+     * assurance-control: WILDO.AUDIT.ATTRIBUTION — an ETL run's external read is recorded.
+     */
+    private readonly auditLogsService?;
+    /**
+     * The loss counter behind that emission. Appended LAST and `@optional()`, so a container with no
+     * metrics binding degrades a dropped attribution row to the log channel rather than to nothing.
+     */
+    private readonly metricsService?;
     private readonly inFlight;
     private readonly logDebug;
     constructor(logger: LoggerService, errorBuilder: ErrorBuilderBackendService, repositoriesRegistry: RepositoriesRegistryHandlerBackendService, resourcesRegistry: ResourcesRegistryBackendService, syncEngine: SyncSeedEngineBackendService, upgradeEngine: UpgradeSeedEngineBackendService, executionContextCreator: ExecutionContextCreatorBackendService, 
@@ -125,7 +150,31 @@ export declare class ExternalDataPipelineRunBackendService {
      */
     auditLogsResolver?: HttpApiAuditLogsResolver, 
     /** Test seam — production leaves it unset and gets the HTTP source over the shared client. */
-    extractionSourceFactory?: ExternalDataExtractionSourceFactory);
+    extractionSourceFactory?: ExternalDataExtractionSourceFactory, 
+    /**
+     * The PRODUCTION door to the read-through audit sink — and it had to be added, because the
+     * `@unmanaged()` thunk above cannot be one.
+     *
+     * `@unmanaged()` tells Inversify not to resolve a parameter, and this class is bound with
+     * `.to(...)`, so the container constructs it and passes `undefined` there. That made the seam a
+     * TEST-ONLY door: every scheduled ETL run in production reached `recordRunReadThroughAccess`,
+     * found no resolver, and emitted nothing. The sink itself exists
+     * (`AuditLogsBackendService.logHttpApiReadThroughAccess`), so nothing was refusing — the row was
+     * simply never written, silently, which is exactly the shape the loss counter now makes visible.
+     *
+     * Two suppliers, and they cannot collide: `@unmanaged()` is structurally unfillable by the
+     * container, so the thunk is only ever set by a test constructing this class with `new`, and it
+     * takes precedence there so a suite can substitute a double. `@optional()` here for the usual
+     * reason — a minimal container binds no audit service and an ETL run must still run.
+     *
+     * assurance-control: WILDO.AUDIT.ATTRIBUTION — an ETL run's external read is recorded.
+     */
+    auditLogsService?: NonNullable<ReturnType<HttpApiAuditLogsResolver>>, 
+    /**
+     * The loss counter behind that emission. Appended LAST and `@optional()`, so a container with no
+     * metrics binding degrades a dropped attribution row to the log channel rather than to nothing.
+     */
+    metricsService?: AuditObservationLossMetricsRecorder);
     /** The on-demand door (PR-12). The scheduled batch calls this per due pipeline. */
     runPipeline(input: ExternalDataPipelineRunInput): Promise<ExternalDataPipelineRunReport>;
     /** Every registered resource that declares an `externalDataPipeline` — the scheduled batch's population. */
@@ -156,7 +205,15 @@ export declare class ExternalDataPipelineRunBackendService {
     private buildHttpExtractionSource;
     private resolveApplicationScopeAnchor;
     private logRejections;
-    /** PR-10 — one audit row per run, fire-and-forget through the shared seam. */
+    /**
+     * PR-10 — one audit row per run, fire-and-forget through the shared seam.
+     *
+     * The emission goes through {@link emitAuditObservation}, so a run whose attribution row never
+     * reached the pipeline lands on `audit_observation_dropped_total` instead of nowhere. The feature
+     * detection decides an ARGUMENT rather than an early return: handing the seam `undefined` is how
+     * this site reports `SERVICE_UNAVAILABLE`, and returning early would restore the silence that let
+     * this seam sit unwired in production without anything saying so.
+     */
     private recordRunReadThroughAccess;
 }
 //# sourceMappingURL=external-data-pipeline-run.backend.service.d.ts.map

package/dist/esm/external-data/external-data-pipeline-run.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"external-data-pipeline-run.backend.service.d.ts","sourceRoot":"","sources":["../../../../src/external-data/external-data-pipeline-run.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AASH,OAAO,EAGL,KAAK,+BAA+B,EACrC,MAAM,qCAAqC,CAAC;AAE7C,OAAO,EAML,qBAAqB,EAGtB,MAAM,iEAAiE,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qEAAqE,CAAC;AAExG,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,mFAAmF,CAAC;AACtI,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,sFAAsF,CAAC;AAC5I,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAC5G,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,+EAA+E,CAAC;AAC3I,OAAO,KAAK,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AACrK,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,0EAA0E,CAAC;AAChI,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AACnH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAMlG,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,6GAA6G,CAAC;AAC5J,OAAO,EAAuC,KAAK,4BAA4B,EAAE,MAAM,2CAA2C,CAAC;AAanI,MAAM,WAAW,4BAA4B;IAC3C,0EAA0E;IAC1E,YAAY,EAAE,MAAM,CAAC;IACrB,2FAA2F;IAC3F,aAAa,EAAE,qBAAqB,CAAC,YAAY,GAAG,qBAAqB,CAAC,eAAe,CAAC;IAC1F,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED,MAAM,WAAW,6BAA6B;IAC5C,OAAO,EAAE,gBAAgB,GAAG,cAAc,GAAG,iBAAiB,CAAC;IAC/D,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,gBAAgB,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,UAAU,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACrC,4FAA4F;IAC5F,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,wEAAwE;IACxE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,gGAAgG;AAChG,MAAM,MAAM,mCAAmC,GAAG,CAChD,WAAW,EAAE,+BAA+B,EAC5C,eAAe,EAAE,gBAAgB,CAAC,GAAG,CAAC,KACnC,4BAA4B,CAAC;AAElC,qBACa,qCAAqC;IAKX,OAAO,CAAC,QAAQ,CAAC,MAAM;IACV,OAAO,CAAC,QAAQ,CAAC,YAAY;IACd,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IAChD,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAC3C,OAAO,CAAC,QAAQ,CAAC,UAAU;IACxB,OAAO,CAAC,QAAQ,CAAC,aAAa;IACV,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IAC1G;;;;OAIG;IACsE,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAC;IACpH;;;;OAIG;IASU,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IAChD,8FAA8F;IACjF,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAC;IAhCxD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqB;IAC9C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA4C;gBAGf,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EACzB,oBAAoB,EAAE,yCAAyC,EAC1E,iBAAiB,EAAE,+BAA+B,EAC3D,UAAU,EAAE,4BAA4B,EACrC,aAAa,EAAE,+BAA+B,EAC1B,uBAAuB,EAAE,qCAAqC;IACjJ;;;;OAIG;IACuF,yBAAyB,CAAC,EAAE,OAAO;IAC7H;;;;OAIG;IAS2B,iBAAiB,CAAC,EAAE,wBAAwB;IAC1E,8FAA8F;IAChE,uBAAuB,CAAC,EAAE,mCAAmC;IAM7F,mFAAmF;IACtE,WAAW,CAAC,KAAK,EAAE,4BAA4B,GAAG,OAAO,CAAC,6BAA6B,CAAC;IAerG,4GAA4G;IACrG,qBAAqB,IAAI,KAAK,CAAC;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,+BAA+B,CAAA;KAAE,CAAC;YAU/F,UAAU;IA8HxB;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;IAsB9B;;;;OAIG;IACH,OAAO,CAAC,eAAe;IAWvB;;;;;OAKG;IACH,OAAO,CAAC,qBAAqB;IAI7B,OAAO,CAAC,yBAAyB;YAWnB,6BAA6B;IAY3C,OAAO,CAAC,aAAa;IAQrB,8EAA8E;IAC9E,OAAO,CAAC,0BAA0B;CAuBnC"}
+{"version":3,"file":"external-data-pipeline-run.backend.service.d.ts","sourceRoot":"","sources":["../../../src/external-data/external-data-pipeline-run.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AASH,OAAO,EAGL,KAAK,+BAA+B,EACrC,MAAM,qCAAqC,CAAC;AAE7C,OAAO,EAML,qBAAqB,EAGtB,MAAM,iEAAiE,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qEAAqE,CAAC;AAExG,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,mFAAmF,CAAC;AACtI,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,sFAAsF,CAAC;AAC5I,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAC5G,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,+EAA+E,CAAC;AAC3I,OAAO,KAAK,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AACrK,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,0EAA0E,CAAC;AAChI,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AACnH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAMlG,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,6GAA6G,CAAC;AAC5J,OAAO,EAEL,KAAK,mCAAmC,EAEzC,MAAM,gFAAgF,CAAC;AACxF,OAAO,EAAuC,KAAK,4BAA4B,EAAE,MAAM,2CAA2C,CAAC;AAanI,MAAM,WAAW,4BAA4B;IAC3C,0EAA0E;IAC1E,YAAY,EAAE,MAAM,CAAC;IACrB,2FAA2F;IAC3F,aAAa,EAAE,qBAAqB,CAAC,YAAY,GAAG,qBAAqB,CAAC,eAAe,CAAC;IAC1F,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED,MAAM,WAAW,6BAA6B;IAC5C,OAAO,EAAE,gBAAgB,GAAG,cAAc,GAAG,iBAAiB,CAAC;IAC/D,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,gBAAgB,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,UAAU,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACrC,4FAA4F;IAC5F,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,wEAAwE;IACxE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,gGAAgG;AAChG,MAAM,MAAM,mCAAmC,GAAG,CAChD,WAAW,EAAE,+BAA+B,EAC5C,eAAe,EAAE,gBAAgB,CAAC,GAAG,CAAC,KACnC,4BAA4B,CAAC;AAElC,qBACa,qCAAqC;IAKX,OAAO,CAAC,QAAQ,CAAC,MAAM;IACV,OAAO,CAAC,QAAQ,CAAC,YAAY;IACd,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IAChD,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAC3C,OAAO,CAAC,QAAQ,CAAC,UAAU;IACxB,OAAO,CAAC,QAAQ,CAAC,aAAa;IACV,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IAC1G;;;;OAIG;IACsE,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAC;IACpH;;;;OAIG;IASU,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IAChD,8FAA8F;IACjF,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAC;IACtD;;;;;;;;;;;;;;;;;OAiBG;IAEH,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;IAClC;;;OAGG;IAEH,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IA1DlC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqB;IAC9C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA4C;gBAGf,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EACzB,oBAAoB,EAAE,yCAAyC,EAC1E,iBAAiB,EAAE,+BAA+B,EAC3D,UAAU,EAAE,4BAA4B,EACrC,aAAa,EAAE,+BAA+B,EAC1B,uBAAuB,EAAE,qCAAqC;IACjJ;;;;OAIG;IACuF,yBAAyB,CAAC,EAAE,OAAO;IAC7H;;;;OAIG;IAS2B,iBAAiB,CAAC,EAAE,wBAAwB;IAC1E,8FAA8F;IAChE,uBAAuB,CAAC,EAAE,mCAAmC;IAC3F;;;;;;;;;;;;;;;;;OAiBG;IAEc,gBAAgB,CAAC,EAAE,WAAW,CAAC,UAAU,CAAC,wBAAwB,CAAC,CAAC;IACrF;;;OAGG;IAEc,cAAc,CAAC,EAAE,mCAAmC;IAMvE,mFAAmF;IACtE,WAAW,CAAC,KAAK,EAAE,4BAA4B,GAAG,OAAO,CAAC,6BAA6B,CAAC;IAerG,4GAA4G;IACrG,qBAAqB,IAAI,KAAK,CAAC;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,+BAA+B,CAAA;KAAE,CAAC;YAU/F,UAAU;IA8HxB;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;IAsB9B;;;;OAIG;IACH,OAAO,CAAC,eAAe;IAWvB;;;;;OAKG;IACH,OAAO,CAAC,qBAAqB;IAI7B,OAAO,CAAC,yBAAyB;YAWnB,6BAA6B;IAY3C,OAAO,CAAC,aAAa;IAQrB;;;;;;;;OAQG;IACH,OAAO,CAAC,0BAA0B;CA2CnC"}

package/dist/esm/external-data/external-data-pipeline-run.backend.service.js

@@ -63,6 +63,7 @@ import { SAAS_SERVICE_TYPES } from '../inject/models/service-types.js';
 import { BackendResourceType } from '../resources/models/resources-types.backend.schemas.js';
 import { HttpApiReadClient } from '../base-classes/services/repositories/http-api/http-api-read-client.backend.js';
 import { ExternalProvidersHttpApiAccessResolver } from '../base-classes/services/repositories/http-api/http-api-provider-access.backend.js';
+import { AuditObservationKind, emitAuditObservation, } from '../monitoring/observability/audit-observation-emission.backend.js';
 import { HttpApiExternalDataExtractionSource } from './external-data-extraction-source.backend.js';
 /*
  * entrypoint-closure-waiver: `etl-transform.backend` is published only by `./external-data-models` (one
@@ -85,9 +86,11 @@ let ExternalDataPipelineRunBackendService = class ExternalDataPipelineRunBackend
     externalProvidersRegistry;
     auditLogsResolver;
     extractionSourceFactory;
+    auditLogsService;
+    metricsService;
     inFlight = new Set();
     logDebug;
-    constructor(logger, errorBuilder, repositoriesRegistry, resourcesRegistry, syncEngine, upgradeEngine, executionContextCreator, externalProvidersRegistry, auditLogsResolver, extractionSourceFactory) {
+    constructor(logger, errorBuilder, repositoriesRegistry, resourcesRegistry, syncEngine, upgradeEngine, executionContextCreator, externalProvidersRegistry, auditLogsResolver, extractionSourceFactory, auditLogsService, metricsService) {
         this.logger = logger;
         this.errorBuilder = errorBuilder;
         this.repositoriesRegistry = repositoriesRegistry;
@@ -98,6 +101,8 @@ let ExternalDataPipelineRunBackendService = class ExternalDataPipelineRunBackend
         this.externalProvidersRegistry = externalProvidersRegistry;
         this.auditLogsResolver = auditLogsResolver;
         this.extractionSourceFactory = extractionSourceFactory;
+        this.auditLogsService = auditLogsService;
+        this.metricsService = metricsService;
         this.logDebug = this.logger.debugByType('ExternalDataPipelineRun');
         this.logger.setDebugTypeLogging('ExternalDataPipelineRun', false);
     }
@@ -306,26 +311,52 @@ let ExternalDataPipelineRunBackendService = class ExternalDataPipelineRunBackend
             truncated: rejections.length > MAX_LOGGED_REJECTIONS,
         });
     }
-    /** PR-10 — one audit row per run, fire-and-forget through the shared seam. */
+    /**
+     * PR-10 — one audit row per run, fire-and-forget through the shared seam.
+     *
+     * The emission goes through {@link emitAuditObservation}, so a run whose attribution row never
+     * reached the pipeline lands on `audit_observation_dropped_total` instead of nowhere. The feature
+     * detection decides an ARGUMENT rather than an early return: handing the seam `undefined` is how
+     * this site reports `SERVICE_UNAVAILABLE`, and returning early would restore the silence that let
+     * this seam sit unwired in production without anything saying so.
+     */
     recordRunReadThroughAccess(executionContext, resourceType, declaration, counts) {
+        let emit;
         try {
-            const auditLogsService = this.auditLogsResolver?.();
-            if (typeof auditLogsService?.logHttpApiReadThroughAccess !== 'function')
-                return;
-            void auditLogsService.logHttpApiReadThroughAccess({
-                resourceType,
-                operationIdentifier: 'externalDataPipelineRun',
-                providerRef: declaration.binding.providerRef,
-                remoteEntityRef: declaration.binding.entityRef,
-                dialect: declaration.binding.dialect,
-                rowCount: counts.extractedRows,
-                rejectedRows: counts.rejectedRows,
-                completedPass: counts.completedPass,
-            }, executionContext)?.catch?.(() => undefined);
+            // The test thunk first, the injected production service second — see the constructor.
+            const auditLogsService = this.auditLogsResolver?.() ?? this.auditLogsService;
+            const sink = auditLogsService?.logHttpApiReadThroughAccess;
+            if (typeof sink === 'function') {
+                emit = () => sink.call(auditLogsService, {
+                    resourceType,
+                    operationIdentifier: 'externalDataPipelineRun',
+                    providerRef: declaration.binding.providerRef,
+                    remoteEntityRef: declaration.binding.entityRef,
+                    dialect: declaration.binding.dialect,
+                    rowCount: counts.extractedRows,
+                    rejectedRows: counts.rejectedRows,
+                    completedPass: counts.completedPass,
+                }, executionContext);
+            }
         }
         catch {
-            // Observation only — never the reason a run fails.
+            // A thunk that throws leaves `emit` undefined, so the observation is reported as UNAVAILABLE
+            // rather than swallowed. Observation only — never the reason a run fails.
         }
+        emitAuditObservation({
+            observation: AuditObservationKind.HTTP_API_READ_THROUGH_ACCESS,
+            emit,
+            metricsService: this.metricsService,
+            logger: this.logger,
+            // Enough to name WHICH run went unrecorded, and how much it moved — the counts are what
+            // separate a run that read nothing from one that read a tenant's whole remote table.
+            context: {
+                observedResourceType: resourceType,
+                observedProviderRef: declaration.binding.providerRef,
+                observedRemoteEntityRef: declaration.binding.entityRef,
+                observedRowCount: counts.extractedRows,
+            },
+        });
     }
 };
 ExternalDataPipelineRunBackendService = __decorate([
@@ -341,7 +372,11 @@ ExternalDataPipelineRunBackendService = __decorate([
     __param(7, optional()),
     __param(8, unmanaged()),
     __param(9, unmanaged()),
-    __metadata("design:paramtypes", [Function, Function, Function, Function, Function, Function, Function, Object, Function, Function])
+    __param(10, inject(SAAS_SERVICE_TYPES.AuditLogsService)),
+    __param(10, optional()),
+    __param(11, inject(SAAS_SERVICE_TYPES.MetricsService)),
+    __param(11, optional()),
+    __metadata("design:paramtypes", [Function, Function, Function, Function, Function, Function, Function, Object, Function, Function, Object, Object])
 ], ExternalDataPipelineRunBackendService);
 export { ExternalDataPipelineRunBackendService };
 //# sourceMappingURL=external-data-pipeline-run.backend.service.js.map

package/dist/esm/external-data/external-data-pipeline-run.backend.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"external-data-pipeline-run.backend.service.js","sourceRoot":"","sources":["../../../../src/external-data/external-data-pipeline-run.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;;;;;;;;;;;;;AAEH,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACpE,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,SAAS,GAEV,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,iCAAiC,EACjC,wBAAwB,GAEzB,MAAM,qCAAqC,CAAC;AAE7C,OAAO,EACL,YAAY,EACZ,yBAAyB,EACzB,iBAAiB,EACjB,wBAAwB,EACxB,mBAAmB,GAIpB,MAAM,iEAAiE,CAAC;AAWzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,qEAAqE,CAAC;AAE1G,OAAO,EAAE,iBAAiB,EAAE,MAAM,6FAA6F,CAAC;AAChI,OAAO,EAAE,sCAAsC,EAAE,MAAM,iGAAiG,CAAC;AAEzJ,OAAO,EAAE,mCAAmC,EAAqC,MAAM,2CAA2C,CAAC;AACnI;;;;;;GAMG;AACH,OAAO,EAAE,yBAAyB,EAAiC,MAAM,mCAAmC,CAAC;AAE7G,yFAAyF;AACzF,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAwC1B,IAAM,qCAAqC,GAA3C,MAAM,qCAAqC;IAKM;IACa;IACe;IACX;IACT;IACG;IACoB;IAMO;IAc5D;IAEA;IAhCf,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IAC7B,QAAQ,CAA4C;IAErE,YACsD,MAAqB,EACR,YAAwC,EACzB,oBAA+D,EAC1E,iBAAkD,EAC3D,UAAwC,EACrC,aAA8C,EAC1B,uBAA8D,EAMvD,yBAAmC,EAc/F,iBAA4C,EAE5C,uBAA6D;QA5BvC,WAAM,GAAN,MAAM,CAAe;QACR,iBAAY,GAAZ,YAAY,CAA4B;QACzB,yBAAoB,GAApB,oBAAoB,CAA2C;QAC1E,sBAAiB,GAAjB,iBAAiB,CAAiC;QAC3D,eAAU,GAAV,UAAU,CAA8B;QACrC,kBAAa,GAAb,aAAa,CAAiC;QAC1B,4BAAuB,GAAvB,uBAAuB,CAAuC;QAMvD,8BAAyB,GAAzB,yBAAyB,CAAU;QAc/F,sBAAiB,GAAjB,iBAAiB,CAA2B;QAE5C,4BAAuB,GAAvB,uBAAuB,CAAsC;QAE3F,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,yBAAyB,CAAC,CAAC;QACnE,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;IACpE,CAAC;IAED,mFAAmF;IAC5E,KAAK,CAAC,WAAW,CAAC,KAAmC;QAC1D,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;YAC1C,OAAO;gBACL,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC;gBAC7D,gBAAgB,EAAE,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;aACpF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACtC,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACtC,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAED,4GAA4G;IACrG,qBAAqB;QAC1B,OAAQ,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,EAAe;aAC3D,OAAO,CAAC,CAAC,YAAY,EAAE,EAAE;YACxB,MAAM,aAAa,GAAG,IAAI,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,YAA4B,CAErF,CAAC;YACd,OAAO,aAAa,EAAE,oBAAoB,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,aAAa,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACxH,CAAC,CAAC,CAAC;IACP,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,KAAmC;QAC1D,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC/B,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,iBAAiB,EAAE,GAAG,KAAK,CAAC;QAEjE,MAAM,aAAa,GAAG,IAAI,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,YAA4B,CAEjG,CAAC;QACF,MAAM,WAAW,GAAG,aAAa,EAAE,oBAAoB,CAAC;QACxD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,wCAAwC;gBAC5F,OAAO,EAAE,EAAE,MAAM,EAAE,kCAAkC,EAAE,YAAY,EAAE;aACtE,CAAC,CAAC;QACL,CAAC;QAED,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,gCAAgC,EAAE,CAAC;QAC9F,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,oCAAoC,CAAC;YAC3F,YAAY,EAAE,mBAAmB,CAAC,4BAA4B;YAC9D,mBAAmB,EAAE,qBAAqB,CAAC,MAAM;SAClD,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,CAAC,oBAAoB,CAAC,oBAAoB,CAC9D,mBAAmB,CAAC,4BAAuD,EAC3E,YAAY,CACb,CAAC;QAEF,IAAI,KAAK,GAAG,MAAM,SAAS,CAAC,IAAI,CAA4B,YAAY,EAAE,EAAE,oBAAoB,EAAE,YAAY,EAAE,CAAC,CAAC;QAClH,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,YAAY,EAAE;gBAC5C,oBAAoB,EAAE,YAAY;gBAClC,MAAM,EAAE,IAAI;gBACZ,aAAa,EAAE,IAAI;gBACnB,SAAS,EAAE,IAAI;gBACf,cAAc,EAAE,IAAI;aACZ,CAAC,CAAyC,CAAC;QACvD,CAAC;QACD,MAAM,cAAc,GAAG,KAAK,CAAC,MAAM,IAAI,SAAS,CAAC;QACjD,MAAM,aAAa,GAAG,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;QAEtG,+EAA+E;QAC/E,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,uBAAuB,IAAI,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;QACzH,qFAAqF;QACrF,mEAAmE;QACnE,IAAI,CAAC;YACH,KAAK,MAAM,OAAO,IAAI,CAAC,MAAM,MAAM,CAAC,qBAAqB,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;gBACrE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,YAAY,qBAAqB,OAAO,EAAE,CAAC,CAAC;YAC1F,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,mBAAmB;QACrB,CAAC;QACD,MAAM,aAAa,GAAmC,EAAE,CAAC;QACzD,IAAI,MAAM,GAAG,cAAc,CAAC;QAC5B,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,OAAO,aAAa,CAAC,MAAM,GAAG,WAAW,CAAC,aAAa,EAAE,CAAC;YACxD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,aAAa,GAAG,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;YACjH,aAAa,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;YACjC,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC;YACzB,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAClB,YAAY,GAAG,IAAI,CAAC;gBACpB,MAAM;YACR,CAAC;QACH,CAAC;QAED,+EAA+E;QAC/E,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,yBAAyB,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QACnF,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QAC7C,MAAM,OAAO,GAA0B,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACxD,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,mBAAmB,CAAC,EAAE,GAAG,CAAC,gBAAgB,EAAE;YACxE,IAAI,EAAE,GAAG,CAAC,IAAI;SACf,CAAC,CAAC,CAAC;QAEJ,+EAA+E;QAC/E,MAAM,IAAI,GAAG,IAAI,CAAC,sBAAsB,CAAC,YAAY,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC;QAClF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,6BAA6B,CAAC,eAAe,CAAC,CAAC;QACxE,MAAM,WAAW,GAAG;YAClB,IAAI;YACJ,OAAO,EAAE,EAAE,WAAW,EAAE,mBAAmB,CAAC,oBAA6B,EAAE;YAC3E,aAAa;YACb,KAAK;YACL,OAAO;YACP,iBAAiB;YACjB,iBAAiB,EAAE,iBAAiB,YAAY,EAAE;YAClD,eAAe;SAChB,CAAC;QACF,MAAM,UAAU,GAAG,YAAY;YAC7B,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,WAAW,CAAC;YAChD,CAAC,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;QAEzD,+EAA+E;QAC/E,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC;QAC5C,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,IAAI,IAAI,CAAC;QAC3C,4FAA4F;QAC5F,8FAA8F;QAC9F,gFAAgF;QAChF,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,IAAI,IAAI,CAAC;QAC7C,MAAM,SAAS,CAAC,MAAM,CAAC,YAAY,EAAE,KAAK,CAAC,GAAG,EAAE;YAC9C,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC;YAC9C,aAAa,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa;YAClD,SAAS,EAAE,IAAI,IAAI,CAAC,WAAW,CAAC;YAChC,cAAc,EAAE;gBACd,aAAa,EAAE,YAAY;gBAC3B,aAAa,EAAE,aAAa,CAAC,MAAM;gBACnC,YAAY,EAAE,UAAU,CAAC,MAAM;gBAC/B,UAAU;gBACV,SAAS;gBACT,UAAU;aACX;SACO,CAAC,CAAC;QAEZ,IAAI,CAAC,0BAA0B,CAAC,eAAe,EAAE,YAAY,EAAE,WAAW,EAAE;YAC1E,aAAa,EAAE,aAAa,CAAC,MAAM;YACnC,YAAY,EAAE,UAAU,CAAC,MAAM;YAC/B,aAAa,EAAE,YAAY;SAC5B,CAAC,CAAC;QAEH,OAAO;YACL,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,cAAc;YACzD,aAAa,EAAE,aAAa,CAAC,MAAM;YACnC,YAAY,EAAE,UAAU,CAAC,MAAM;YAC/B,gBAAgB,EAAE,OAAO,CAAC,MAAM;YAChC,UAAU;YACV,SAAS;YACT,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC;YAC9C,UAAU;SACX,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACK,sBAAsB,CAC5B,YAAoB,EACpB,WAA4C,EAC5C,YAAqB;QAErB,MAAM,aAAa,GAAG;YACpB,WAAW,CAAC,mBAAmB;YAC/B,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC;SACxD,CAAC;QACF,OAAO;YACL,OAAO,EAAE,iBAAiB,YAAY,EAAE;YACxC,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,CAAC,WAAW,EAAE;YAC9C,YAAY;YACZ,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,mBAAmB,CAAC,oBAAoB,EAAE,CAAC;YACrE,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO;YAC7D,OAAO,EAAE,CAAC;YACV,aAAa;YACb,iBAAiB,EAAE,yBAAyB,CAAC,OAAO;YACpD,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/E,CAAC;IAC1B,CAAC;IAED;;;;OAIG;IACK,eAAe,CAAC,YAAsC;QAC5D,QAAQ,YAAY,EAAE,CAAC;YACrB,KAAK,wBAAwB,CAAC,MAAM;gBAClC,OAAO,wBAAwB,CAAC,MAAM,CAAC;YACzC,KAAK,wBAAwB,CAAC,SAAS;gBACrC,OAAO,wBAAwB,CAAC,SAAS,CAAC;YAC5C,KAAK,wBAAwB,CAAC,MAAM;gBAClC,OAAO,wBAAwB,CAAC,MAAM,CAAC;QAC3C,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,qBAAqB,CAAC,WAA4C;QACxE,OAAO,WAAW,CAAC,UAAU,KAAK,iCAAiC,CAAC,IAAI,CAAC,CAAC,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,YAAY,CAAC;IACxI,CAAC;IAEO,yBAAyB,CAC/B,WAA4C,EAC5C,eAAsC;QAEtC,MAAM,UAAU,GAAG,IAAI,iBAAiB,CACtC,WAAW,CAAC,OAAO,EACnB,IAAI,sCAAsC,CAAC,IAAI,CAAC,yBAAkC,CAAC,CACpF,CAAC;QACF,OAAO,IAAI,mCAAmC,CAAC,WAAW,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC;IAC3F,CAAC;IAEO,KAAK,CAAC,6BAA6B,CAAC,eAAsC;QAChF,MAAM,OAAO,GAAG,IAAI,CAAC,oBAAoB,CAAC,oBAAoB,CAAC,cAA8B,EAAE,eAAe,CAAC,CAAC;QAChH,MAAM,WAAW,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,CAAkB,eAAe,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC;QACvF,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,eAAe,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,QAAQ;gBAC5D,OAAO,EAAE,EAAE,OAAO,EAAE,iFAAiF,EAAE;aACxG,CAAC,CAAC;QACL,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,iBAAiB,CAAC,WAAW,EAAE,SAAS,EAAE,WAAW,CAAC,GAAG,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC;IAC7G,CAAC;IAEO,aAAa,CAAC,YAAoB,EAAE,UAAsC;QAChF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACpC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,YAAY,MAAM,UAAU,CAAC,MAAM,4DAA4D,EAAE;YAC3I,UAAU,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,qBAAqB,CAAC;YACtD,SAAS,EAAE,UAAU,CAAC,MAAM,GAAG,qBAAqB;SACrD,CAAC,CAAC;IACL,CAAC;IAED,8EAA8E;IACtE,0BAA0B,CAChC,gBAAuC,EACvC,YAAoB,EACpB,WAA4C,EAC5C,MAA+E;QAE/E,IAAI,CAAC;YACH,MAAM,gBAAgB,GAAG,IAAI,CAAC,iBAAiB,EAAE,EAAE,CAAC;YACpD,IAAI,OAAO,gBAAgB,EAAE,2BAA2B,KAAK,UAAU;gBAAE,OAAO;YAChF,KAAK,gBAAgB,CAAC,2BAA2B,CAAC;gBAChD,YAAY;gBACZ,mBAAmB,EAAE,yBAAyB;gBAC9C,WAAW,EAAE,WAAW,CAAC,OAAO,CAAC,WAAW;gBAC5C,eAAe,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS;gBAC9C,OAAO,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO;gBACpC,QAAQ,EAAE,MAAM,CAAC,aAAa;gBAC9B,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,aAAa,EAAE,MAAM,CAAC,aAAa;aACpC,EAAE,gBAAgB,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,mDAAmD;QACrD,CAAC;IACH,CAAC;CACF,CAAA;AA5SY,qCAAqC;IADjD,UAAU,EAAE;IAMR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,kCAAkC,CAAC,CAAA;IAC7D,WAAA,MAAM,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAA;IAClD,WAAA,MAAM,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAA;IACzC,WAAA,MAAM,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAA;IAC5C,WAAA,MAAM,CAAC,kBAAkB,CAAC,qCAAqC,CAAC,CAAA;IAMhE,WAAA,MAAM,CAAC,kBAAkB,CAAC,gCAAgC,CAAC,CAAA;IAAE,WAAA,QAAQ,EAAE,CAAA;IAcvE,WAAA,SAAS,EAAE,CAAA;IAEX,WAAA,SAAS,EAAE,CAAA;;GAjCH,qCAAqC,CA4SjD","sourcesContent":["/**\n * The ETL pipeline RUN service (partial-resource paper v3.1, PR-5/PR-6/PR-9/PR-10/PR-12) — the\n * orchestrator that turns a declared `externalDataPipeline` into destination rows: E (extraction source over\n * the shared read client) → T (pure transform) → L (the data-seeding engines' imperative doors).\n *\n * ## The one decision that carries the paper's ⚠ traps: MODE SELECTION (PR-6)\n *\n * A run that COMPLETES a pass over the remote population loads through `runSyncSeed` — the full\n * reconcile INCLUDING the Stage-4 orphan walk (a destination row whose remote sibling vanished is\n * handled per the declared `orphanPolicy`). A run that stops mid-pass (`maxRowsPerRun` reached)\n * loads through `runUpgradeSeed` — the SAME reconcile loop with NO orphan stage, because \"absent\n * from a partial extraction\" is not evidence of remote deletion. A partial run orphans NOTHING;\n * the persisted cursor lets the next run continue the pass where this one stopped.\n *\n * ## Change detection (PR-30)\n *\n * The assembled seed pins `version: 1` forever and declares\n * `reconcileStrategy: CONTENT` — a pipeline's change signal is the REMOTE VALUE, not a version\n * bump. Managed-field content comparison decides write-vs-skip per row, so an unchanged remote\n * population costs zero destination writes (and zero RAG re-ingestions) per pass.\n *\n * ## Ledger split (PR-9)\n *\n * Per-entry load outcome lives on the `DataSeedRun` ledger row every run writes through the\n * engines (one row per pipeline — `seedKey` + constant version, recovered and reset each run).\n * The `ExternalDataPipelineState` row carries what data-seeding cannot know: the extraction CURSOR\n * (surviving restarts, so populations larger than one run's budget eventually sync end to end)\n * and the ETL-side last-run summary (extracted/rejected happen BEFORE the seed engine sees\n * anything). Transform rejections are logged per row (bounded) and counted on the summary; the\n * rejected rows' previous destination versions simply survive.\n *\n * ## Attribution (PR-10)\n *\n * ONE read-through audit row per run through the same lazily-resolved seam as the virtual\n * repository (`logHttpApiReadThroughAccess`), carrying the run outcome counts — a pipeline run\n * is bulk read-through access to an external system and lands in the same audit lane.\n *\n * ## Concurrency\n *\n * Single-flight per pipeline is IN-PROCESS (a second `runPipeline` for the same resource while\n * one is in flight answers `already-running`). A cross-instance double run is deliberately not\n * locked out: every load is an idempotent business-key MERGE and extraction pages are\n * drift-safe, so the second run wastes work but corrupts nothing — the same posture as\n * concurrent seed passes.\n */\n\nimport { inject, injectable, optional, unmanaged } from 'inversify';\nimport {\n  CoreResourceOperation,\n  ErrorCustomMessageReference,\n  ErrorType,\n  type ResourceType,\n} from '@wildo-ai/saas-models';\nimport {\n  ExternalDataDestinationPopulation,\n  ExternalDataOrphanPolicy,\n  type ExternalDataPipelineDeclaration,\n} from '@wildo-ai/saas-models/external-data';\n\nimport {\n  DataSeedMode,\n  DataSeedReconcileStrategy,\n  DataSeedScopeKind,\n  DataSeedSyncOrphanPolicy,\n  DataSeedTriggerKind,\n  DataSeedTriggerOrigin,\n  type DataSeedDefinition,\n  type DataSeedStaticEntry,\n} from '~wildo-backend-lib/data-seeding/models/data-seed.shared.schemas';\nimport { DataSeedRunStatus } from '~wildo-backend-lib/data-seeding/models/data-seed-run.shared.schemas';\nimport type { DataSeedScopeAnchor } from '~wildo-backend-lib/data-seeding/services/shared/data-seed-scope-anchor.shared.types';\nimport type { SyncSeedEngineBackendService } from '~wildo-backend-lib/data-seeding/services/engines/sync-seed-engine.backend.service';\nimport type { UpgradeSeedEngineBackendService } from '~wildo-backend-lib/data-seeding/services/engines/upgrade-seed-engine.backend.service';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport type { ExecutionContextCreatorBackendService } from '~wildo-backend-lib/runtime/services/execution-context-creator.backend.service';\nimport type { RepositoriesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/repositories/repositories-registry-handler.backend.service';\nimport type { ResourcesRegistryBackendService } from '~wildo-backend-lib/resources/services/resources-registry.backend.service';\nimport type { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport type { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { BackendResourceType } from '~wildo-backend-lib/resources/models/resources-types.backend.schemas';\nimport type { ExternalDataPipelineState } from '~wildo-backend-lib/external-data/models/external-data-pipeline-state.backend.schemas';\nimport { HttpApiReadClient } from '~wildo-backend-lib/base-classes/services/repositories/http-api/http-api-read-client.backend';\nimport { ExternalProvidersHttpApiAccessResolver } from '~wildo-backend-lib/base-classes/services/repositories/http-api/http-api-provider-access.backend';\nimport type { HttpApiAuditLogsResolver } from '~wildo-backend-lib/base-classes/services/repositories/http-api/http-api-resource-repository.backend.service';\nimport { HttpApiExternalDataExtractionSource, type ExternalDataExtractionSource } from './external-data-extraction-source.backend';\n/*\n * entrypoint-closure-waiver: `etl-transform.backend` is published only by `./external-data-models` (one\n * door per room), and nothing nominal crosses into this root-exported module's public surface —\n * `ExternalDataTransformedRow`/`ExternalDataRowRejection` are structural interfaces and `ExternalDataPipelineRunReport`\n * names none of them nominally. Probed 2026-08-28 after the barrel split:\n * `tsc -p tsconfig.build.json --noEmit` with declaration emit — zero TS2742/TS2883/TS7056.\n */\nimport { transformExternalDataPage, type ExternalDataRowRejection } from './external-data-transform.backend';\n\n/** How many per-row rejection reasons are LOGGED per run — the count is always exact. */\nconst MAX_LOGGED_REJECTIONS = 25;\n\nexport interface ExternalDataPipelineRunInput {\n  /** The DESTINATION resource type declaring the `externalDataPipeline`. */\n  resourceType: string;\n  /** `ADMIN_MANUAL` for the on-demand door, `SCHEDULED_RERUN` for the cron batch (PR-12). */\n  triggerOrigin: DataSeedTriggerOrigin.ADMIN_MANUAL | DataSeedTriggerOrigin.SCHEDULED_RERUN;\n  triggeredByUserId: string | null;\n}\n\nexport interface ExternalDataPipelineRunReport {\n  outcome: 'completed-pass' | 'partial-pass' | 'already-running';\n  extractedRows: number;\n  rejectedRows: number;\n  /**\n   * Declared entries HANDED TO the seed engine (extracted − rejected) — what was submitted, never\n   * what was written. Named `submittedEntries` rather than `loadedEntries` because the old name\n   * read as a write count and was believed as one: a run reporting `loadedEntries: 2` had in fact\n   * written one row and failed the other. `loadStatus` is the field that answers what landed.\n   */\n  submittedEntries: number;\n  /**\n   * The seed engine's verdict on the LOAD — `PARTIAL`/`FAILED` means go read `seedRunId`. Distinct\n   * from `outcome`, which reports only whether the EXTRACTION pass completed.\n   */\n  loadStatus: DataSeedRunStatus | null;\n  /** `_id` of the `DataSeedRun` ledger row (per-entry outcome detail); null when none ran. */\n  seedRunId: string | null;\n  /** The persisted continuation — non-null exactly for `partial-pass`. */\n  cursor: string | null;\n  durationMs: number;\n}\n\n/** Test seam: build the extraction source for one run (production default: the HTTP source). */\nexport type ExternalDataExtractionSourceFactory = (\n  declaration: ExternalDataPipelineDeclaration,\n  internalContext: ExecutionContext<any>,\n) => ExternalDataExtractionSource;\n\n@injectable()\nexport class ExternalDataPipelineRunBackendService {\n  private readonly inFlight = new Set<string>();\n  private readonly logDebug: (message: string, data?: unknown) => void;\n\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n    @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private readonly errorBuilder: ErrorBuilderBackendService,\n    @inject(SAAS_SERVICE_TYPES.RepositoriesRegistryHandlerService) private readonly repositoriesRegistry: RepositoriesRegistryHandlerBackendService,\n    @inject(SAAS_SERVICE_TYPES.ResourceRegistryService) private readonly resourcesRegistry: ResourcesRegistryBackendService,\n    @inject(SAAS_SERVICE_TYPES.SyncSeedEngine) private readonly syncEngine: SyncSeedEngineBackendService,\n    @inject(SAAS_SERVICE_TYPES.UpgradeSeedEngine) private readonly upgradeEngine: UpgradeSeedEngineBackendService,\n    @inject(SAAS_SERVICE_TYPES.ExecutionContextCreatorBackendService) private readonly executionContextCreator: ExecutionContextCreatorBackendService,\n    /**\n     * Resolves provider credentials for the extraction client. `@optional()` so a container\n     * without external-connector bindings still constructs the service — a run then fails with\n     * the resolver's own actionable error, never at boot.\n     */\n    @inject(SAAS_SERVICE_TYPES.ExternalProvidersRegistryService) @optional() private readonly externalProvidersRegistry?: unknown,\n    /**\n     * The read-through audit seam (PR-10) — same structural, lazily-resolved contract as the\n     * virtual repository's: absent binding means no emission, and emission failure never fails\n     * the run it observes.\n     */\n    /*\n     * `@unmanaged()`, because this class IS container-constructed and the two seams below are not the\n     * container's to resolve. The contract was copied from `HttpApiResourceRepositoryBackendService`,\n     * where an undecorated optional parameter is fine — that class carries no `@injectable()` and is\n     * built with `new`. Under `@injectable()` the same shape is a boot failure: Inversify validates\n     * EVERY constructor parameter, so an undecorated one aborts container setup with\n     * \"unexpected missing metadata\" long before any ETL code runs.\n     */\n    @unmanaged() private readonly auditLogsResolver?: HttpApiAuditLogsResolver,\n    /** Test seam — production leaves it unset and gets the HTTP source over the shared client. */\n    @unmanaged() private readonly extractionSourceFactory?: ExternalDataExtractionSourceFactory,\n  ) {\n    this.logDebug = this.logger.debugByType('ExternalDataPipelineRun');\n    this.logger.setDebugTypeLogging('ExternalDataPipelineRun', false);\n  }\n\n  /** The on-demand door (PR-12). The scheduled batch calls this per due pipeline. */\n  public async runPipeline(input: ExternalDataPipelineRunInput): Promise<ExternalDataPipelineRunReport> {\n    if (this.inFlight.has(input.resourceType)) {\n      return {\n        outcome: 'already-running', extractedRows: 0, rejectedRows: 0,\n        submittedEntries: 0, loadStatus: null, seedRunId: null, cursor: null, durationMs: 0,\n      };\n    }\n    this.inFlight.add(input.resourceType);\n    try {\n      return await this.executeRun(input);\n    } finally {\n      this.inFlight.delete(input.resourceType);\n    }\n  }\n\n  /** Every registered resource that declares an `externalDataPipeline` — the scheduled batch's population. */\n  public listDeclaredPipelines(): Array<{ resourceType: string; declaration: ExternalDataPipelineDeclaration }> {\n    return (this.resourcesRegistry.getResourceTypes() as string[])\n      .flatMap((resourceType) => {\n        const configuration = this.resourcesRegistry.getResourceConfiguration(resourceType as ResourceType) as\n          | { externalDataPipeline?: ExternalDataPipelineDeclaration }\n          | undefined;\n        return configuration?.externalDataPipeline ? [{ resourceType, declaration: configuration.externalDataPipeline }] : [];\n      });\n  }\n\n  private async executeRun(input: ExternalDataPipelineRunInput): Promise<ExternalDataPipelineRunReport> {\n    const startedAtMs = Date.now();\n    const { resourceType, triggerOrigin, triggeredByUserId } = input;\n\n    const configuration = this.resourcesRegistry.getResourceConfiguration(resourceType as ResourceType) as {\n      externalDataPipeline?: ExternalDataPipelineDeclaration;\n    };\n    const declaration = configuration?.externalDataPipeline;\n    if (!declaration) {\n      throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.RESOURCES_REGISTRY_INITIALIZATION_FAILED,\n        context: { reason: 'etl_pipeline_without_declaration', resourceType },\n      });\n    }\n\n    const internalContext = await this.executionContextCreator.createForInternalSystemOperation();\n    const stateContext = await this.executionContextCreator.createForInternalRepositoryOperation({\n      resourceType: BackendResourceType.EXTERNAL_DATA_PIPELINE_STATE,\n      operationIdentifier: CoreResourceOperation.CREATE,\n    });\n    const stateRepo = this.repositoriesRegistry.getRepositoryOrThrow(\n      BackendResourceType.EXTERNAL_DATA_PIPELINE_STATE as unknown as ResourceType,\n      stateContext,\n    );\n\n    let state = await stateRepo.read<ExternalDataPipelineState>(stateContext, { pipelineResourceType: resourceType });\n    if (!state) {\n      state = (await stateRepo.create(stateContext, {\n        pipelineResourceType: resourceType,\n        cursor: null,\n        passStartedAt: null,\n        lastRunAt: null,\n        lastRunSummary: null,\n      } as never)) as unknown as ExternalDataPipelineState;\n    }\n    const resumingCursor = state.cursor ?? undefined;\n    const passStartedAt = resumingCursor === undefined ? new Date() : (state.passStartedAt ?? new Date());\n\n    // ── E: bounded page walk from the persisted cursor ──────────────────────────\n    const source = (this.extractionSourceFactory ?? this.buildHttpExtractionSource.bind(this))(declaration, internalContext);\n    // PR-21 — WARN-only drift probe, once per run, before extraction. A probe failure is\n    // swallowed: drift detection must never be the reason a run fails.\n    try {\n      for (const warning of (await source.describeContractDrift?.()) ?? []) {\n        this.logger.warn(`ExternalDataPipelineRun[${resourceType}]: schema drift — ${warning}`);\n      }\n    } catch {\n      // Diagnostic only.\n    }\n    const extractedRows: Array<Record<string, unknown>> = [];\n    let cursor = resumingCursor;\n    let passComplete = false;\n    while (extractedRows.length < declaration.maxRowsPerRun) {\n      const page = await source.extractPage(cursor, Math.min(declaration.maxRowsPerRun - extractedRows.length, 1_000));\n      extractedRows.push(...page.rows);\n      cursor = page.nextCursor;\n      if (page.complete) {\n        passComplete = true;\n        break;\n      }\n    }\n\n    // ── T: pure transform; per-row rejections reported, never fatal ─────────────\n    const { rows, rejections } = transformExternalDataPage(declaration, extractedRows);\n    this.logRejections(resourceType, rejections);\n    const entries: DataSeedStaticEntry[] = rows.map((row) => ({\n      businessKey: { [declaration.remoteKeyLocalField]: row.businessKeyValue },\n      data: row.data,\n    }));\n\n    // ── L: mode selection is THE PR-6 guard — a partial run orphans NOTHING ─────\n    const seed = this.assembleSeedDefinition(resourceType, declaration, passComplete);\n    const scope = await this.resolveApplicationScopeAnchor(internalContext);\n    const engineInput = {\n      seed,\n      trigger: { triggerKind: DataSeedTriggerKind.ON_SCHEDULED_REFRESH as const },\n      triggerOrigin,\n      scope,\n      entries,\n      triggeredByUserId,\n      rowMetadataSource: `external-data:${resourceType}`,\n      internalContext,\n    };\n    const seedReport = passComplete\n      ? await this.syncEngine.runSyncSeed(engineInput)\n      : await this.upgradeEngine.runUpgradeSeed(engineInput);\n\n    // ── Persist the state row: the cursor IS the pass continuation ──────────────\n    const durationMs = Date.now() - startedAtMs;\n    const seedRunId = seedReport.runId ?? null;\n    // The LOAD verdict, carried separately from `outcome` (which is about the EXTRACTION pass).\n    // Both are reported: a full pass that failed to write part of what it read is neither a clean\n    // success nor a partial pass, and collapsing them would hide exactly that case.\n    const loadStatus = seedReport.status ?? null;\n    await stateRepo.update(stateContext, state._id, {\n      cursor: passComplete ? null : (cursor ?? null),\n      passStartedAt: passComplete ? null : passStartedAt,\n      lastRunAt: new Date(startedAtMs),\n      lastRunSummary: {\n        completedPass: passComplete,\n        extractedRows: extractedRows.length,\n        rejectedRows: rejections.length,\n        loadStatus,\n        seedRunId,\n        durationMs,\n      },\n    } as never);\n\n    this.recordRunReadThroughAccess(internalContext, resourceType, declaration, {\n      extractedRows: extractedRows.length,\n      rejectedRows: rejections.length,\n      completedPass: passComplete,\n    });\n\n    return {\n      outcome: passComplete ? 'completed-pass' : 'partial-pass',\n      extractedRows: extractedRows.length,\n      rejectedRows: rejections.length,\n      submittedEntries: entries.length,\n      loadStatus,\n      seedRunId,\n      cursor: passComplete ? null : (cursor ?? null),\n      durationMs,\n    };\n  }\n\n  /**\n   * The assembled seed is EPHEMERAL (never registered): `version` is pinned at 1 forever and\n   * `reconcileStrategy: CONTENT` carries change detection (PR-30) — bumping the version per run\n   * would route every row through the migrator path and rewrite the whole corpus each pass.\n   */\n  private assembleSeedDefinition(\n    resourceType: string,\n    declaration: ExternalDataPipelineDeclaration,\n    passComplete: boolean,\n  ): DataSeedDefinition {\n    const managedFields = [\n      declaration.remoteKeyLocalField,\n      ...declaration.mapping.map((entry) => entry.localField),\n    ];\n    return {\n      seedKey: `external-data:${resourceType}`,\n      scope: { kind: DataSeedScopeKind.APPLICATION },\n      resourceType,\n      triggers: [{ triggerKind: DataSeedTriggerKind.ON_SCHEDULED_REFRESH }],\n      mode: passComplete ? DataSeedMode.SYNC : DataSeedMode.UPGRADE,\n      version: 1,\n      managedFields,\n      reconcileStrategy: DataSeedReconcileStrategy.CONTENT,\n      ...(passComplete ? { onOrphan: this.mapOrphanPolicy(this.effectiveOrphanPolicy(declaration)) } : {}),\n    } as DataSeedDefinition;\n  }\n\n  /**\n   * The seam between the two closed vocabularies (never merged by value overlap — the ETL\n   * declaration must not depend on data-seeding's enum, and each member's semantics are owned\n   * where it is declared).\n   */\n  private mapOrphanPolicy(orphanPolicy: ExternalDataOrphanPolicy): DataSeedSyncOrphanPolicy {\n    switch (orphanPolicy) {\n      case ExternalDataOrphanPolicy.DELETE:\n        return DataSeedSyncOrphanPolicy.DELETE;\n      case ExternalDataOrphanPolicy.DEPRECATE:\n        return DataSeedSyncOrphanPolicy.DEPRECATE;\n      case ExternalDataOrphanPolicy.REPORT:\n        return DataSeedSyncOrphanPolicy.REPORT;\n    }\n  }\n\n  /**\n   * ⚠ OPEN-population caveat, named where it is decided: the SYNC orphan walk considers every\n   * row of the destination, including caller-minted rows on an OPEN population. Those rows have\n   * no `__seed` metadata and a business key outside the declared set, so DELETE/DEPRECATE would\n   * hit them. Slice 1 therefore downgrades OPEN populations' orphan handling to REPORT.\n   */\n  private effectiveOrphanPolicy(declaration: ExternalDataPipelineDeclaration): ExternalDataOrphanPolicy {\n    return declaration.population === ExternalDataDestinationPopulation.OPEN ? ExternalDataOrphanPolicy.REPORT : declaration.orphanPolicy;\n  }\n\n  private buildHttpExtractionSource(\n    declaration: ExternalDataPipelineDeclaration,\n    internalContext: ExecutionContext<any>,\n  ): ExternalDataExtractionSource {\n    const readClient = new HttpApiReadClient(\n      declaration.binding,\n      new ExternalProvidersHttpApiAccessResolver(this.externalProvidersRegistry as never),\n    );\n    return new HttpApiExternalDataExtractionSource(declaration, readClient, internalContext);\n  }\n\n  private async resolveApplicationScopeAnchor(internalContext: ExecutionContext<any>): Promise<DataSeedScopeAnchor> {\n    const appRepo = this.repositoriesRegistry.getRepositoryOrThrow('applications' as ResourceType, internalContext);\n    const application = (await appRepo.read<{ _id: string }>(internalContext, {})) ?? null;\n    if (!application) {\n      throw this.errorBuilder.buildError(ErrorType.INTERNAL, internalContext, {\n        customMessageReference: ErrorCustomMessageReference.INTERNAL,\n        context: { message: 'ExternalDataPipelineRun: no APPLICATION row exists — bootstrap order violation.' },\n      });\n    }\n    return { scopeKind: DataSeedScopeKind.APPLICATION, relatedId: application._id, relatedResourceType: null };\n  }\n\n  private logRejections(resourceType: string, rejections: ExternalDataRowRejection[]): void {\n    if (rejections.length === 0) return;\n    this.logger.warn(`ExternalDataPipelineRun[${resourceType}]: ${rejections.length} row(s) rejected by transform (previous versions survive).`, {\n      rejections: rejections.slice(0, MAX_LOGGED_REJECTIONS),\n      truncated: rejections.length > MAX_LOGGED_REJECTIONS,\n    });\n  }\n\n  /** PR-10 — one audit row per run, fire-and-forget through the shared seam. */\n  private recordRunReadThroughAccess(\n    executionContext: ExecutionContext<any>,\n    resourceType: string,\n    declaration: ExternalDataPipelineDeclaration,\n    counts: { extractedRows: number; rejectedRows: number; completedPass: boolean },\n  ): void {\n    try {\n      const auditLogsService = this.auditLogsResolver?.();\n      if (typeof auditLogsService?.logHttpApiReadThroughAccess !== 'function') return;\n      void auditLogsService.logHttpApiReadThroughAccess({\n        resourceType,\n        operationIdentifier: 'externalDataPipelineRun',\n        providerRef: declaration.binding.providerRef,\n        remoteEntityRef: declaration.binding.entityRef,\n        dialect: declaration.binding.dialect,\n        rowCount: counts.extractedRows,\n        rejectedRows: counts.rejectedRows,\n        completedPass: counts.completedPass,\n      }, executionContext)?.catch?.(() => undefined);\n    } catch {\n      // Observation only — never the reason a run fails.\n    }\n  }\n}\n"]}
+{"version":3,"file":"external-data-pipeline-run.backend.service.js","sourceRoot":"","sources":["../../../src/external-data/external-data-pipeline-run.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;;;;;;;;;;;;;AAEH,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACpE,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,SAAS,GAEV,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,iCAAiC,EACjC,wBAAwB,GAEzB,MAAM,qCAAqC,CAAC;AAE7C,OAAO,EACL,YAAY,EACZ,yBAAyB,EACzB,iBAAiB,EACjB,wBAAwB,EACxB,mBAAmB,GAIpB,MAAM,iEAAiE,CAAC;AAWzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,qEAAqE,CAAC;AAE1G,OAAO,EAAE,iBAAiB,EAAE,MAAM,6FAA6F,CAAC;AAChI,OAAO,EAAE,sCAAsC,EAAE,MAAM,iGAAiG,CAAC;AAEzJ,OAAO,EACL,oBAAoB,EAEpB,oBAAoB,GACrB,MAAM,gFAAgF,CAAC;AACxF,OAAO,EAAE,mCAAmC,EAAqC,MAAM,2CAA2C,CAAC;AACnI;;;;;;GAMG;AACH,OAAO,EAAE,yBAAyB,EAAiC,MAAM,mCAAmC,CAAC;AAE7G,yFAAyF;AACzF,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAwC1B,IAAM,qCAAqC,GAA3C,MAAM,qCAAqC;IAKM;IACa;IACe;IACX;IACT;IACG;IACoB;IAMO;IAc5D;IAEA;IAoBb;IAMA;IA1DF,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IAC7B,QAAQ,CAA4C;IAErE,YACsD,MAAqB,EACR,YAAwC,EACzB,oBAA+D,EAC1E,iBAAkD,EAC3D,UAAwC,EACrC,aAA8C,EAC1B,uBAA8D,EAMvD,yBAAmC,EAc/F,iBAA4C,EAE5C,uBAA6D,EAoB1E,gBAAoE,EAMpE,cAAoD;QAtDjB,WAAM,GAAN,MAAM,CAAe;QACR,iBAAY,GAAZ,YAAY,CAA4B;QACzB,yBAAoB,GAApB,oBAAoB,CAA2C;QAC1E,sBAAiB,GAAjB,iBAAiB,CAAiC;QAC3D,eAAU,GAAV,UAAU,CAA8B;QACrC,kBAAa,GAAb,aAAa,CAAiC;QAC1B,4BAAuB,GAAvB,uBAAuB,CAAuC;QAMvD,8BAAyB,GAAzB,yBAAyB,CAAU;QAc/F,sBAAiB,GAAjB,iBAAiB,CAA2B;QAE5C,4BAAuB,GAAvB,uBAAuB,CAAsC;QAoB1E,qBAAgB,GAAhB,gBAAgB,CAAoD;QAMpE,mBAAc,GAAd,cAAc,CAAsC;QAErE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,yBAAyB,CAAC,CAAC;QACnE,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;IACpE,CAAC;IAED,mFAAmF;IAC5E,KAAK,CAAC,WAAW,CAAC,KAAmC;QAC1D,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;YAC1C,OAAO;gBACL,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC;gBAC7D,gBAAgB,EAAE,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;aACpF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACtC,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACtC,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAED,4GAA4G;IACrG,qBAAqB;QAC1B,OAAQ,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,EAAe;aAC3D,OAAO,CAAC,CAAC,YAAY,EAAE,EAAE;YACxB,MAAM,aAAa,GAAG,IAAI,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,YAA4B,CAErF,CAAC;YACd,OAAO,aAAa,EAAE,oBAAoB,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,aAAa,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACxH,CAAC,CAAC,CAAC;IACP,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,KAAmC;QAC1D,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC/B,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,iBAAiB,EAAE,GAAG,KAAK,CAAC;QAEjE,MAAM,aAAa,GAAG,IAAI,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,YAA4B,CAEjG,CAAC;QACF,MAAM,WAAW,GAAG,aAAa,EAAE,oBAAoB,CAAC;QACxD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,wCAAwC;gBAC5F,OAAO,EAAE,EAAE,MAAM,EAAE,kCAAkC,EAAE,YAAY,EAAE;aACtE,CAAC,CAAC;QACL,CAAC;QAED,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,gCAAgC,EAAE,CAAC;QAC9F,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,oCAAoC,CAAC;YAC3F,YAAY,EAAE,mBAAmB,CAAC,4BAA4B;YAC9D,mBAAmB,EAAE,qBAAqB,CAAC,MAAM;SAClD,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,CAAC,oBAAoB,CAAC,oBAAoB,CAC9D,mBAAmB,CAAC,4BAAuD,EAC3E,YAAY,CACb,CAAC;QAEF,IAAI,KAAK,GAAG,MAAM,SAAS,CAAC,IAAI,CAA4B,YAAY,EAAE,EAAE,oBAAoB,EAAE,YAAY,EAAE,CAAC,CAAC;QAClH,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,YAAY,EAAE;gBAC5C,oBAAoB,EAAE,YAAY;gBAClC,MAAM,EAAE,IAAI;gBACZ,aAAa,EAAE,IAAI;gBACnB,SAAS,EAAE,IAAI;gBACf,cAAc,EAAE,IAAI;aACZ,CAAC,CAAyC,CAAC;QACvD,CAAC;QACD,MAAM,cAAc,GAAG,KAAK,CAAC,MAAM,IAAI,SAAS,CAAC;QACjD,MAAM,aAAa,GAAG,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;QAEtG,+EAA+E;QAC/E,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,uBAAuB,IAAI,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;QACzH,qFAAqF;QACrF,mEAAmE;QACnE,IAAI,CAAC;YACH,KAAK,MAAM,OAAO,IAAI,CAAC,MAAM,MAAM,CAAC,qBAAqB,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;gBACrE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,YAAY,qBAAqB,OAAO,EAAE,CAAC,CAAC;YAC1F,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,mBAAmB;QACrB,CAAC;QACD,MAAM,aAAa,GAAmC,EAAE,CAAC;QACzD,IAAI,MAAM,GAAG,cAAc,CAAC;QAC5B,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,OAAO,aAAa,CAAC,MAAM,GAAG,WAAW,CAAC,aAAa,EAAE,CAAC;YACxD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,aAAa,GAAG,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;YACjH,aAAa,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;YACjC,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC;YACzB,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAClB,YAAY,GAAG,IAAI,CAAC;gBACpB,MAAM;YACR,CAAC;QACH,CAAC;QAED,+EAA+E;QAC/E,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,yBAAyB,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QACnF,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QAC7C,MAAM,OAAO,GAA0B,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACxD,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,mBAAmB,CAAC,EAAE,GAAG,CAAC,gBAAgB,EAAE;YACxE,IAAI,EAAE,GAAG,CAAC,IAAI;SACf,CAAC,CAAC,CAAC;QAEJ,+EAA+E;QAC/E,MAAM,IAAI,GAAG,IAAI,CAAC,sBAAsB,CAAC,YAAY,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC;QAClF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,6BAA6B,CAAC,eAAe,CAAC,CAAC;QACxE,MAAM,WAAW,GAAG;YAClB,IAAI;YACJ,OAAO,EAAE,EAAE,WAAW,EAAE,mBAAmB,CAAC,oBAA6B,EAAE;YAC3E,aAAa;YACb,KAAK;YACL,OAAO;YACP,iBAAiB;YACjB,iBAAiB,EAAE,iBAAiB,YAAY,EAAE;YAClD,eAAe;SAChB,CAAC;QACF,MAAM,UAAU,GAAG,YAAY;YAC7B,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,WAAW,CAAC;YAChD,CAAC,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;QAEzD,+EAA+E;QAC/E,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC;QAC5C,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,IAAI,IAAI,CAAC;QAC3C,4FAA4F;QAC5F,8FAA8F;QAC9F,gFAAgF;QAChF,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,IAAI,IAAI,CAAC;QAC7C,MAAM,SAAS,CAAC,MAAM,CAAC,YAAY,EAAE,KAAK,CAAC,GAAG,EAAE;YAC9C,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC;YAC9C,aAAa,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa;YAClD,SAAS,EAAE,IAAI,IAAI,CAAC,WAAW,CAAC;YAChC,cAAc,EAAE;gBACd,aAAa,EAAE,YAAY;gBAC3B,aAAa,EAAE,aAAa,CAAC,MAAM;gBACnC,YAAY,EAAE,UAAU,CAAC,MAAM;gBAC/B,UAAU;gBACV,SAAS;gBACT,UAAU;aACX;SACO,CAAC,CAAC;QAEZ,IAAI,CAAC,0BAA0B,CAAC,eAAe,EAAE,YAAY,EAAE,WAAW,EAAE;YAC1E,aAAa,EAAE,aAAa,CAAC,MAAM;YACnC,YAAY,EAAE,UAAU,CAAC,MAAM;YAC/B,aAAa,EAAE,YAAY;SAC5B,CAAC,CAAC;QAEH,OAAO;YACL,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,cAAc;YACzD,aAAa,EAAE,aAAa,CAAC,MAAM;YACnC,YAAY,EAAE,UAAU,CAAC,MAAM;YAC/B,gBAAgB,EAAE,OAAO,CAAC,MAAM;YAChC,UAAU;YACV,SAAS;YACT,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC;YAC9C,UAAU;SACX,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACK,sBAAsB,CAC5B,YAAoB,EACpB,WAA4C,EAC5C,YAAqB;QAErB,MAAM,aAAa,GAAG;YACpB,WAAW,CAAC,mBAAmB;YAC/B,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC;SACxD,CAAC;QACF,OAAO;YACL,OAAO,EAAE,iBAAiB,YAAY,EAAE;YACxC,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,CAAC,WAAW,EAAE;YAC9C,YAAY;YACZ,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,mBAAmB,CAAC,oBAAoB,EAAE,CAAC;YACrE,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO;YAC7D,OAAO,EAAE,CAAC;YACV,aAAa;YACb,iBAAiB,EAAE,yBAAyB,CAAC,OAAO;YACpD,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/E,CAAC;IAC1B,CAAC;IAED;;;;OAIG;IACK,eAAe,CAAC,YAAsC;QAC5D,QAAQ,YAAY,EAAE,CAAC;YACrB,KAAK,wBAAwB,CAAC,MAAM;gBAClC,OAAO,wBAAwB,CAAC,MAAM,CAAC;YACzC,KAAK,wBAAwB,CAAC,SAAS;gBACrC,OAAO,wBAAwB,CAAC,SAAS,CAAC;YAC5C,KAAK,wBAAwB,CAAC,MAAM;gBAClC,OAAO,wBAAwB,CAAC,MAAM,CAAC;QAC3C,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,qBAAqB,CAAC,WAA4C;QACxE,OAAO,WAAW,CAAC,UAAU,KAAK,iCAAiC,CAAC,IAAI,CAAC,CAAC,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,YAAY,CAAC;IACxI,CAAC;IAEO,yBAAyB,CAC/B,WAA4C,EAC5C,eAAsC;QAEtC,MAAM,UAAU,GAAG,IAAI,iBAAiB,CACtC,WAAW,CAAC,OAAO,EACnB,IAAI,sCAAsC,CAAC,IAAI,CAAC,yBAAkC,CAAC,CACpF,CAAC;QACF,OAAO,IAAI,mCAAmC,CAAC,WAAW,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC;IAC3F,CAAC;IAEO,KAAK,CAAC,6BAA6B,CAAC,eAAsC;QAChF,MAAM,OAAO,GAAG,IAAI,CAAC,oBAAoB,CAAC,oBAAoB,CAAC,cAA8B,EAAE,eAAe,CAAC,CAAC;QAChH,MAAM,WAAW,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,CAAkB,eAAe,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC;QACvF,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,eAAe,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,QAAQ;gBAC5D,OAAO,EAAE,EAAE,OAAO,EAAE,iFAAiF,EAAE;aACxG,CAAC,CAAC;QACL,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,iBAAiB,CAAC,WAAW,EAAE,SAAS,EAAE,WAAW,CAAC,GAAG,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC;IAC7G,CAAC;IAEO,aAAa,CAAC,YAAoB,EAAE,UAAsC;QAChF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACpC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,YAAY,MAAM,UAAU,CAAC,MAAM,4DAA4D,EAAE;YAC3I,UAAU,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,qBAAqB,CAAC;YACtD,SAAS,EAAE,UAAU,CAAC,MAAM,GAAG,qBAAqB;SACrD,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACK,0BAA0B,CAChC,gBAAuC,EACvC,YAAoB,EACpB,WAA4C,EAC5C,MAA+E;QAE/E,IAAI,IAAiC,CAAC;QACtC,IAAI,CAAC;YACH,sFAAsF;YACtF,MAAM,gBAAgB,GAAG,IAAI,CAAC,iBAAiB,EAAE,EAAE,IAAI,IAAI,CAAC,gBAAgB,CAAC;YAC7E,MAAM,IAAI,GAAG,gBAAgB,EAAE,2BAA2B,CAAC;YAC3D,IAAI,OAAO,IAAI,KAAK,UAAU,EAAE,CAAC;gBAC/B,IAAI,GAAG,GAAY,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE;oBAChD,YAAY;oBACZ,mBAAmB,EAAE,yBAAyB;oBAC9C,WAAW,EAAE,WAAW,CAAC,OAAO,CAAC,WAAW;oBAC5C,eAAe,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS;oBAC9C,OAAO,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO;oBACpC,QAAQ,EAAE,MAAM,CAAC,aAAa;oBAC9B,YAAY,EAAE,MAAM,CAAC,YAAY;oBACjC,aAAa,EAAE,MAAM,CAAC,aAAa;iBACpC,EAAE,gBAAgB,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,6FAA6F;YAC7F,0EAA0E;QAC5E,CAAC;QAED,oBAAoB,CAAC;YACnB,WAAW,EAAE,oBAAoB,CAAC,4BAA4B;YAC9D,IAAI;YACJ,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,wFAAwF;YACxF,qFAAqF;YACrF,OAAO,EAAE;gBACP,oBAAoB,EAAE,YAAY;gBAClC,mBAAmB,EAAE,WAAW,CAAC,OAAO,CAAC,WAAW;gBACpD,uBAAuB,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS;gBACtD,gBAAgB,EAAE,MAAM,CAAC,aAAa;aACvC;SACF,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AAlWY,qCAAqC;IADjD,UAAU,EAAE;IAMR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,kCAAkC,CAAC,CAAA;IAC7D,WAAA,MAAM,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAA;IAClD,WAAA,MAAM,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAA;IACzC,WAAA,MAAM,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAA;IAC5C,WAAA,MAAM,CAAC,kBAAkB,CAAC,qCAAqC,CAAC,CAAA;IAMhE,WAAA,MAAM,CAAC,kBAAkB,CAAC,gCAAgC,CAAC,CAAA;IAAE,WAAA,QAAQ,EAAE,CAAA;IAcvE,WAAA,SAAS,EAAE,CAAA;IAEX,WAAA,SAAS,EAAE,CAAA;IAmBX,YAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAAE,YAAA,QAAQ,EAAE,CAAA;IAMvD,YAAA,MAAM,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAA;IAAE,YAAA,QAAQ,EAAE,CAAA;;GA1D7C,qCAAqC,CAkWjD","sourcesContent":["/**\n * The ETL pipeline RUN service (partial-resource paper v3.1, PR-5/PR-6/PR-9/PR-10/PR-12) — the\n * orchestrator that turns a declared `externalDataPipeline` into destination rows: E (extraction source over\n * the shared read client) → T (pure transform) → L (the data-seeding engines' imperative doors).\n *\n * ## The one decision that carries the paper's ⚠ traps: MODE SELECTION (PR-6)\n *\n * A run that COMPLETES a pass over the remote population loads through `runSyncSeed` — the full\n * reconcile INCLUDING the Stage-4 orphan walk (a destination row whose remote sibling vanished is\n * handled per the declared `orphanPolicy`). A run that stops mid-pass (`maxRowsPerRun` reached)\n * loads through `runUpgradeSeed` — the SAME reconcile loop with NO orphan stage, because \"absent\n * from a partial extraction\" is not evidence of remote deletion. A partial run orphans NOTHING;\n * the persisted cursor lets the next run continue the pass where this one stopped.\n *\n * ## Change detection (PR-30)\n *\n * The assembled seed pins `version: 1` forever and declares\n * `reconcileStrategy: CONTENT` — a pipeline's change signal is the REMOTE VALUE, not a version\n * bump. Managed-field content comparison decides write-vs-skip per row, so an unchanged remote\n * population costs zero destination writes (and zero RAG re-ingestions) per pass.\n *\n * ## Ledger split (PR-9)\n *\n * Per-entry load outcome lives on the `DataSeedRun` ledger row every run writes through the\n * engines (one row per pipeline — `seedKey` + constant version, recovered and reset each run).\n * The `ExternalDataPipelineState` row carries what data-seeding cannot know: the extraction CURSOR\n * (surviving restarts, so populations larger than one run's budget eventually sync end to end)\n * and the ETL-side last-run summary (extracted/rejected happen BEFORE the seed engine sees\n * anything). Transform rejections are logged per row (bounded) and counted on the summary; the\n * rejected rows' previous destination versions simply survive.\n *\n * ## Attribution (PR-10)\n *\n * ONE read-through audit row per run through the same lazily-resolved seam as the virtual\n * repository (`logHttpApiReadThroughAccess`), carrying the run outcome counts — a pipeline run\n * is bulk read-through access to an external system and lands in the same audit lane.\n *\n * ## Concurrency\n *\n * Single-flight per pipeline is IN-PROCESS (a second `runPipeline` for the same resource while\n * one is in flight answers `already-running`). A cross-instance double run is deliberately not\n * locked out: every load is an idempotent business-key MERGE and extraction pages are\n * drift-safe, so the second run wastes work but corrupts nothing — the same posture as\n * concurrent seed passes.\n */\n\nimport { inject, injectable, optional, unmanaged } from 'inversify';\nimport {\n  CoreResourceOperation,\n  ErrorCustomMessageReference,\n  ErrorType,\n  type ResourceType,\n} from '@wildo-ai/saas-models';\nimport {\n  ExternalDataDestinationPopulation,\n  ExternalDataOrphanPolicy,\n  type ExternalDataPipelineDeclaration,\n} from '@wildo-ai/saas-models/external-data';\n\nimport {\n  DataSeedMode,\n  DataSeedReconcileStrategy,\n  DataSeedScopeKind,\n  DataSeedSyncOrphanPolicy,\n  DataSeedTriggerKind,\n  DataSeedTriggerOrigin,\n  type DataSeedDefinition,\n  type DataSeedStaticEntry,\n} from '~wildo-backend-lib/data-seeding/models/data-seed.shared.schemas';\nimport { DataSeedRunStatus } from '~wildo-backend-lib/data-seeding/models/data-seed-run.shared.schemas';\nimport type { DataSeedScopeAnchor } from '~wildo-backend-lib/data-seeding/services/shared/data-seed-scope-anchor.shared.types';\nimport type { SyncSeedEngineBackendService } from '~wildo-backend-lib/data-seeding/services/engines/sync-seed-engine.backend.service';\nimport type { UpgradeSeedEngineBackendService } from '~wildo-backend-lib/data-seeding/services/engines/upgrade-seed-engine.backend.service';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport type { ExecutionContextCreatorBackendService } from '~wildo-backend-lib/runtime/services/execution-context-creator.backend.service';\nimport type { RepositoriesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/repositories/repositories-registry-handler.backend.service';\nimport type { ResourcesRegistryBackendService } from '~wildo-backend-lib/resources/services/resources-registry.backend.service';\nimport type { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport type { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { BackendResourceType } from '~wildo-backend-lib/resources/models/resources-types.backend.schemas';\nimport type { ExternalDataPipelineState } from '~wildo-backend-lib/external-data/models/external-data-pipeline-state.backend.schemas';\nimport { HttpApiReadClient } from '~wildo-backend-lib/base-classes/services/repositories/http-api/http-api-read-client.backend';\nimport { ExternalProvidersHttpApiAccessResolver } from '~wildo-backend-lib/base-classes/services/repositories/http-api/http-api-provider-access.backend';\nimport type { HttpApiAuditLogsResolver } from '~wildo-backend-lib/base-classes/services/repositories/http-api/http-api-resource-repository.backend.service';\nimport {\n  AuditObservationKind,\n  type AuditObservationLossMetricsRecorder,\n  emitAuditObservation,\n} from '~wildo-backend-lib/monitoring/observability/audit-observation-emission.backend';\nimport { HttpApiExternalDataExtractionSource, type ExternalDataExtractionSource } from './external-data-extraction-source.backend';\n/*\n * entrypoint-closure-waiver: `etl-transform.backend` is published only by `./external-data-models` (one\n * door per room), and nothing nominal crosses into this root-exported module's public surface —\n * `ExternalDataTransformedRow`/`ExternalDataRowRejection` are structural interfaces and `ExternalDataPipelineRunReport`\n * names none of them nominally. Probed 2026-08-28 after the barrel split:\n * `tsc -p tsconfig.build.json --noEmit` with declaration emit — zero TS2742/TS2883/TS7056.\n */\nimport { transformExternalDataPage, type ExternalDataRowRejection } from './external-data-transform.backend';\n\n/** How many per-row rejection reasons are LOGGED per run — the count is always exact. */\nconst MAX_LOGGED_REJECTIONS = 25;\n\nexport interface ExternalDataPipelineRunInput {\n  /** The DESTINATION resource type declaring the `externalDataPipeline`. */\n  resourceType: string;\n  /** `ADMIN_MANUAL` for the on-demand door, `SCHEDULED_RERUN` for the cron batch (PR-12). */\n  triggerOrigin: DataSeedTriggerOrigin.ADMIN_MANUAL | DataSeedTriggerOrigin.SCHEDULED_RERUN;\n  triggeredByUserId: string | null;\n}\n\nexport interface ExternalDataPipelineRunReport {\n  outcome: 'completed-pass' | 'partial-pass' | 'already-running';\n  extractedRows: number;\n  rejectedRows: number;\n  /**\n   * Declared entries HANDED TO the seed engine (extracted − rejected) — what was submitted, never\n   * what was written. Named `submittedEntries` rather than `loadedEntries` because the old name\n   * read as a write count and was believed as one: a run reporting `loadedEntries: 2` had in fact\n   * written one row and failed the other. `loadStatus` is the field that answers what landed.\n   */\n  submittedEntries: number;\n  /**\n   * The seed engine's verdict on the LOAD — `PARTIAL`/`FAILED` means go read `seedRunId`. Distinct\n   * from `outcome`, which reports only whether the EXTRACTION pass completed.\n   */\n  loadStatus: DataSeedRunStatus | null;\n  /** `_id` of the `DataSeedRun` ledger row (per-entry outcome detail); null when none ran. */\n  seedRunId: string | null;\n  /** The persisted continuation — non-null exactly for `partial-pass`. */\n  cursor: string | null;\n  durationMs: number;\n}\n\n/** Test seam: build the extraction source for one run (production default: the HTTP source). */\nexport type ExternalDataExtractionSourceFactory = (\n  declaration: ExternalDataPipelineDeclaration,\n  internalContext: ExecutionContext<any>,\n) => ExternalDataExtractionSource;\n\n@injectable()\nexport class ExternalDataPipelineRunBackendService {\n  private readonly inFlight = new Set<string>();\n  private readonly logDebug: (message: string, data?: unknown) => void;\n\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n    @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private readonly errorBuilder: ErrorBuilderBackendService,\n    @inject(SAAS_SERVICE_TYPES.RepositoriesRegistryHandlerService) private readonly repositoriesRegistry: RepositoriesRegistryHandlerBackendService,\n    @inject(SAAS_SERVICE_TYPES.ResourceRegistryService) private readonly resourcesRegistry: ResourcesRegistryBackendService,\n    @inject(SAAS_SERVICE_TYPES.SyncSeedEngine) private readonly syncEngine: SyncSeedEngineBackendService,\n    @inject(SAAS_SERVICE_TYPES.UpgradeSeedEngine) private readonly upgradeEngine: UpgradeSeedEngineBackendService,\n    @inject(SAAS_SERVICE_TYPES.ExecutionContextCreatorBackendService) private readonly executionContextCreator: ExecutionContextCreatorBackendService,\n    /**\n     * Resolves provider credentials for the extraction client. `@optional()` so a container\n     * without external-connector bindings still constructs the service — a run then fails with\n     * the resolver's own actionable error, never at boot.\n     */\n    @inject(SAAS_SERVICE_TYPES.ExternalProvidersRegistryService) @optional() private readonly externalProvidersRegistry?: unknown,\n    /**\n     * The read-through audit seam (PR-10) — same structural, lazily-resolved contract as the\n     * virtual repository's: absent binding means no emission, and emission failure never fails\n     * the run it observes.\n     */\n    /*\n     * `@unmanaged()`, because this class IS container-constructed and the two seams below are not the\n     * container's to resolve. The contract was copied from `HttpApiResourceRepositoryBackendService`,\n     * where an undecorated optional parameter is fine — that class carries no `@injectable()` and is\n     * built with `new`. Under `@injectable()` the same shape is a boot failure: Inversify validates\n     * EVERY constructor parameter, so an undecorated one aborts container setup with\n     * \"unexpected missing metadata\" long before any ETL code runs.\n     */\n    @unmanaged() private readonly auditLogsResolver?: HttpApiAuditLogsResolver,\n    /** Test seam — production leaves it unset and gets the HTTP source over the shared client. */\n    @unmanaged() private readonly extractionSourceFactory?: ExternalDataExtractionSourceFactory,\n    /**\n     * The PRODUCTION door to the read-through audit sink — and it had to be added, because the\n     * `@unmanaged()` thunk above cannot be one.\n     *\n     * `@unmanaged()` tells Inversify not to resolve a parameter, and this class is bound with\n     * `.to(...)`, so the container constructs it and passes `undefined` there. That made the seam a\n     * TEST-ONLY door: every scheduled ETL run in production reached `recordRunReadThroughAccess`,\n     * found no resolver, and emitted nothing. The sink itself exists\n     * (`AuditLogsBackendService.logHttpApiReadThroughAccess`), so nothing was refusing — the row was\n     * simply never written, silently, which is exactly the shape the loss counter now makes visible.\n     *\n     * Two suppliers, and they cannot collide: `@unmanaged()` is structurally unfillable by the\n     * container, so the thunk is only ever set by a test constructing this class with `new`, and it\n     * takes precedence there so a suite can substitute a double. `@optional()` here for the usual\n     * reason — a minimal container binds no audit service and an ETL run must still run.\n     *\n     * assurance-control: WILDO.AUDIT.ATTRIBUTION — an ETL run's external read is recorded.\n     */\n    @inject(SAAS_SERVICE_TYPES.AuditLogsService) @optional()\n    private readonly auditLogsService?: NonNullable<ReturnType<HttpApiAuditLogsResolver>>,\n    /**\n     * The loss counter behind that emission. Appended LAST and `@optional()`, so a container with no\n     * metrics binding degrades a dropped attribution row to the log channel rather than to nothing.\n     */\n    @inject(SAAS_SERVICE_TYPES.MetricsService) @optional()\n    private readonly metricsService?: AuditObservationLossMetricsRecorder,\n  ) {\n    this.logDebug = this.logger.debugByType('ExternalDataPipelineRun');\n    this.logger.setDebugTypeLogging('ExternalDataPipelineRun', false);\n  }\n\n  /** The on-demand door (PR-12). The scheduled batch calls this per due pipeline. */\n  public async runPipeline(input: ExternalDataPipelineRunInput): Promise<ExternalDataPipelineRunReport> {\n    if (this.inFlight.has(input.resourceType)) {\n      return {\n        outcome: 'already-running', extractedRows: 0, rejectedRows: 0,\n        submittedEntries: 0, loadStatus: null, seedRunId: null, cursor: null, durationMs: 0,\n      };\n    }\n    this.inFlight.add(input.resourceType);\n    try {\n      return await this.executeRun(input);\n    } finally {\n      this.inFlight.delete(input.resourceType);\n    }\n  }\n\n  /** Every registered resource that declares an `externalDataPipeline` — the scheduled batch's population. */\n  public listDeclaredPipelines(): Array<{ resourceType: string; declaration: ExternalDataPipelineDeclaration }> {\n    return (this.resourcesRegistry.getResourceTypes() as string[])\n      .flatMap((resourceType) => {\n        const configuration = this.resourcesRegistry.getResourceConfiguration(resourceType as ResourceType) as\n          | { externalDataPipeline?: ExternalDataPipelineDeclaration }\n          | undefined;\n        return configuration?.externalDataPipeline ? [{ resourceType, declaration: configuration.externalDataPipeline }] : [];\n      });\n  }\n\n  private async executeRun(input: ExternalDataPipelineRunInput): Promise<ExternalDataPipelineRunReport> {\n    const startedAtMs = Date.now();\n    const { resourceType, triggerOrigin, triggeredByUserId } = input;\n\n    const configuration = this.resourcesRegistry.getResourceConfiguration(resourceType as ResourceType) as {\n      externalDataPipeline?: ExternalDataPipelineDeclaration;\n    };\n    const declaration = configuration?.externalDataPipeline;\n    if (!declaration) {\n      throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.RESOURCES_REGISTRY_INITIALIZATION_FAILED,\n        context: { reason: 'etl_pipeline_without_declaration', resourceType },\n      });\n    }\n\n    const internalContext = await this.executionContextCreator.createForInternalSystemOperation();\n    const stateContext = await this.executionContextCreator.createForInternalRepositoryOperation({\n      resourceType: BackendResourceType.EXTERNAL_DATA_PIPELINE_STATE,\n      operationIdentifier: CoreResourceOperation.CREATE,\n    });\n    const stateRepo = this.repositoriesRegistry.getRepositoryOrThrow(\n      BackendResourceType.EXTERNAL_DATA_PIPELINE_STATE as unknown as ResourceType,\n      stateContext,\n    );\n\n    let state = await stateRepo.read<ExternalDataPipelineState>(stateContext, { pipelineResourceType: resourceType });\n    if (!state) {\n      state = (await stateRepo.create(stateContext, {\n        pipelineResourceType: resourceType,\n        cursor: null,\n        passStartedAt: null,\n        lastRunAt: null,\n        lastRunSummary: null,\n      } as never)) as unknown as ExternalDataPipelineState;\n    }\n    const resumingCursor = state.cursor ?? undefined;\n    const passStartedAt = resumingCursor === undefined ? new Date() : (state.passStartedAt ?? new Date());\n\n    // ── E: bounded page walk from the persisted cursor ──────────────────────────\n    const source = (this.extractionSourceFactory ?? this.buildHttpExtractionSource.bind(this))(declaration, internalContext);\n    // PR-21 — WARN-only drift probe, once per run, before extraction. A probe failure is\n    // swallowed: drift detection must never be the reason a run fails.\n    try {\n      for (const warning of (await source.describeContractDrift?.()) ?? []) {\n        this.logger.warn(`ExternalDataPipelineRun[${resourceType}]: schema drift — ${warning}`);\n      }\n    } catch {\n      // Diagnostic only.\n    }\n    const extractedRows: Array<Record<string, unknown>> = [];\n    let cursor = resumingCursor;\n    let passComplete = false;\n    while (extractedRows.length < declaration.maxRowsPerRun) {\n      const page = await source.extractPage(cursor, Math.min(declaration.maxRowsPerRun - extractedRows.length, 1_000));\n      extractedRows.push(...page.rows);\n      cursor = page.nextCursor;\n      if (page.complete) {\n        passComplete = true;\n        break;\n      }\n    }\n\n    // ── T: pure transform; per-row rejections reported, never fatal ─────────────\n    const { rows, rejections } = transformExternalDataPage(declaration, extractedRows);\n    this.logRejections(resourceType, rejections);\n    const entries: DataSeedStaticEntry[] = rows.map((row) => ({\n      businessKey: { [declaration.remoteKeyLocalField]: row.businessKeyValue },\n      data: row.data,\n    }));\n\n    // ── L: mode selection is THE PR-6 guard — a partial run orphans NOTHING ─────\n    const seed = this.assembleSeedDefinition(resourceType, declaration, passComplete);\n    const scope = await this.resolveApplicationScopeAnchor(internalContext);\n    const engineInput = {\n      seed,\n      trigger: { triggerKind: DataSeedTriggerKind.ON_SCHEDULED_REFRESH as const },\n      triggerOrigin,\n      scope,\n      entries,\n      triggeredByUserId,\n      rowMetadataSource: `external-data:${resourceType}`,\n      internalContext,\n    };\n    const seedReport = passComplete\n      ? await this.syncEngine.runSyncSeed(engineInput)\n      : await this.upgradeEngine.runUpgradeSeed(engineInput);\n\n    // ── Persist the state row: the cursor IS the pass continuation ──────────────\n    const durationMs = Date.now() - startedAtMs;\n    const seedRunId = seedReport.runId ?? null;\n    // The LOAD verdict, carried separately from `outcome` (which is about the EXTRACTION pass).\n    // Both are reported: a full pass that failed to write part of what it read is neither a clean\n    // success nor a partial pass, and collapsing them would hide exactly that case.\n    const loadStatus = seedReport.status ?? null;\n    await stateRepo.update(stateContext, state._id, {\n      cursor: passComplete ? null : (cursor ?? null),\n      passStartedAt: passComplete ? null : passStartedAt,\n      lastRunAt: new Date(startedAtMs),\n      lastRunSummary: {\n        completedPass: passComplete,\n        extractedRows: extractedRows.length,\n        rejectedRows: rejections.length,\n        loadStatus,\n        seedRunId,\n        durationMs,\n      },\n    } as never);\n\n    this.recordRunReadThroughAccess(internalContext, resourceType, declaration, {\n      extractedRows: extractedRows.length,\n      rejectedRows: rejections.length,\n      completedPass: passComplete,\n    });\n\n    return {\n      outcome: passComplete ? 'completed-pass' : 'partial-pass',\n      extractedRows: extractedRows.length,\n      rejectedRows: rejections.length,\n      submittedEntries: entries.length,\n      loadStatus,\n      seedRunId,\n      cursor: passComplete ? null : (cursor ?? null),\n      durationMs,\n    };\n  }\n\n  /**\n   * The assembled seed is EPHEMERAL (never registered): `version` is pinned at 1 forever and\n   * `reconcileStrategy: CONTENT` carries change detection (PR-30) — bumping the version per run\n   * would route every row through the migrator path and rewrite the whole corpus each pass.\n   */\n  private assembleSeedDefinition(\n    resourceType: string,\n    declaration: ExternalDataPipelineDeclaration,\n    passComplete: boolean,\n  ): DataSeedDefinition {\n    const managedFields = [\n      declaration.remoteKeyLocalField,\n      ...declaration.mapping.map((entry) => entry.localField),\n    ];\n    return {\n      seedKey: `external-data:${resourceType}`,\n      scope: { kind: DataSeedScopeKind.APPLICATION },\n      resourceType,\n      triggers: [{ triggerKind: DataSeedTriggerKind.ON_SCHEDULED_REFRESH }],\n      mode: passComplete ? DataSeedMode.SYNC : DataSeedMode.UPGRADE,\n      version: 1,\n      managedFields,\n      reconcileStrategy: DataSeedReconcileStrategy.CONTENT,\n      ...(passComplete ? { onOrphan: this.mapOrphanPolicy(this.effectiveOrphanPolicy(declaration)) } : {}),\n    } as DataSeedDefinition;\n  }\n\n  /**\n   * The seam between the two closed vocabularies (never merged by value overlap — the ETL\n   * declaration must not depend on data-seeding's enum, and each member's semantics are owned\n   * where it is declared).\n   */\n  private mapOrphanPolicy(orphanPolicy: ExternalDataOrphanPolicy): DataSeedSyncOrphanPolicy {\n    switch (orphanPolicy) {\n      case ExternalDataOrphanPolicy.DELETE:\n        return DataSeedSyncOrphanPolicy.DELETE;\n      case ExternalDataOrphanPolicy.DEPRECATE:\n        return DataSeedSyncOrphanPolicy.DEPRECATE;\n      case ExternalDataOrphanPolicy.REPORT:\n        return DataSeedSyncOrphanPolicy.REPORT;\n    }\n  }\n\n  /**\n   * ⚠ OPEN-population caveat, named where it is decided: the SYNC orphan walk considers every\n   * row of the destination, including caller-minted rows on an OPEN population. Those rows have\n   * no `__seed` metadata and a business key outside the declared set, so DELETE/DEPRECATE would\n   * hit them. Slice 1 therefore downgrades OPEN populations' orphan handling to REPORT.\n   */\n  private effectiveOrphanPolicy(declaration: ExternalDataPipelineDeclaration): ExternalDataOrphanPolicy {\n    return declaration.population === ExternalDataDestinationPopulation.OPEN ? ExternalDataOrphanPolicy.REPORT : declaration.orphanPolicy;\n  }\n\n  private buildHttpExtractionSource(\n    declaration: ExternalDataPipelineDeclaration,\n    internalContext: ExecutionContext<any>,\n  ): ExternalDataExtractionSource {\n    const readClient = new HttpApiReadClient(\n      declaration.binding,\n      new ExternalProvidersHttpApiAccessResolver(this.externalProvidersRegistry as never),\n    );\n    return new HttpApiExternalDataExtractionSource(declaration, readClient, internalContext);\n  }\n\n  private async resolveApplicationScopeAnchor(internalContext: ExecutionContext<any>): Promise<DataSeedScopeAnchor> {\n    const appRepo = this.repositoriesRegistry.getRepositoryOrThrow('applications' as ResourceType, internalContext);\n    const application = (await appRepo.read<{ _id: string }>(internalContext, {})) ?? null;\n    if (!application) {\n      throw this.errorBuilder.buildError(ErrorType.INTERNAL, internalContext, {\n        customMessageReference: ErrorCustomMessageReference.INTERNAL,\n        context: { message: 'ExternalDataPipelineRun: no APPLICATION row exists — bootstrap order violation.' },\n      });\n    }\n    return { scopeKind: DataSeedScopeKind.APPLICATION, relatedId: application._id, relatedResourceType: null };\n  }\n\n  private logRejections(resourceType: string, rejections: ExternalDataRowRejection[]): void {\n    if (rejections.length === 0) return;\n    this.logger.warn(`ExternalDataPipelineRun[${resourceType}]: ${rejections.length} row(s) rejected by transform (previous versions survive).`, {\n      rejections: rejections.slice(0, MAX_LOGGED_REJECTIONS),\n      truncated: rejections.length > MAX_LOGGED_REJECTIONS,\n    });\n  }\n\n  /**\n   * PR-10 — one audit row per run, fire-and-forget through the shared seam.\n   *\n   * The emission goes through {@link emitAuditObservation}, so a run whose attribution row never\n   * reached the pipeline lands on `audit_observation_dropped_total` instead of nowhere. The feature\n   * detection decides an ARGUMENT rather than an early return: handing the seam `undefined` is how\n   * this site reports `SERVICE_UNAVAILABLE`, and returning early would restore the silence that let\n   * this seam sit unwired in production without anything saying so.\n   */\n  private recordRunReadThroughAccess(\n    executionContext: ExecutionContext<any>,\n    resourceType: string,\n    declaration: ExternalDataPipelineDeclaration,\n    counts: { extractedRows: number; rejectedRows: number; completedPass: boolean },\n  ): void {\n    let emit: (() => unknown) | undefined;\n    try {\n      // The test thunk first, the injected production service second — see the constructor.\n      const auditLogsService = this.auditLogsResolver?.() ?? this.auditLogsService;\n      const sink = auditLogsService?.logHttpApiReadThroughAccess;\n      if (typeof sink === 'function') {\n        emit = (): unknown => sink.call(auditLogsService, {\n          resourceType,\n          operationIdentifier: 'externalDataPipelineRun',\n          providerRef: declaration.binding.providerRef,\n          remoteEntityRef: declaration.binding.entityRef,\n          dialect: declaration.binding.dialect,\n          rowCount: counts.extractedRows,\n          rejectedRows: counts.rejectedRows,\n          completedPass: counts.completedPass,\n        }, executionContext);\n      }\n    } catch {\n      // A thunk that throws leaves `emit` undefined, so the observation is reported as UNAVAILABLE\n      // rather than swallowed. Observation only — never the reason a run fails.\n    }\n\n    emitAuditObservation({\n      observation: AuditObservationKind.HTTP_API_READ_THROUGH_ACCESS,\n      emit,\n      metricsService: this.metricsService,\n      logger: this.logger,\n      // Enough to name WHICH run went unrecorded, and how much it moved — the counts are what\n      // separate a run that read nothing from one that read a tenant's whole remote table.\n      context: {\n        observedResourceType: resourceType,\n        observedProviderRef: declaration.binding.providerRef,\n        observedRemoteEntityRef: declaration.binding.entityRef,\n        observedRowCount: counts.extractedRows,\n      },\n    });\n  }\n}\n"]}

package/dist/esm/external-data/external-data-transform.backend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"external-data-transform.backend.d.ts","sourceRoot":"","sources":["../../../../src/external-data/external-data-transform.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAKH,OAAO,EAGL,KAAK,+BAA+B,EACrC,MAAM,qCAAqC,CAAC;AAE7C,2FAA2F;AAC3F,MAAM,WAAW,0BAA0B;IACzC,wFAAwF;IACxF,gBAAgB,EAAE,MAAM,CAAC;IACzB,gGAAgG;IAChG,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,wEAAwE;AACxE,MAAM,WAAW,wBAAwB;IACvC,gGAAgG;IAChG,QAAQ,EAAE,MAAM,CAAC;IACjB,qFAAqF;IACrF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,2BAA2B;IAC1C,IAAI,EAAE,0BAA0B,EAAE,CAAC;IACnC,UAAU,EAAE,wBAAwB,EAAE,CAAC;CACxC;AAED,wEAAwE;AACxE,wBAAgB,yBAAyB,CACvC,WAAW,EAAE,+BAA+B,EAC5C,UAAU,EAAE,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACjD,2BAA2B,CA2C7B"}
+{"version":3,"file":"external-data-transform.backend.d.ts","sourceRoot":"","sources":["../../../src/external-data/external-data-transform.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAKH,OAAO,EAGL,KAAK,+BAA+B,EACrC,MAAM,qCAAqC,CAAC;AAE7C,2FAA2F;AAC3F,MAAM,WAAW,0BAA0B;IACzC,wFAAwF;IACxF,gBAAgB,EAAE,MAAM,CAAC;IACzB,gGAAgG;IAChG,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,wEAAwE;AACxE,MAAM,WAAW,wBAAwB;IACvC,gGAAgG;IAChG,QAAQ,EAAE,MAAM,CAAC;IACjB,qFAAqF;IACrF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,2BAA2B;IAC1C,IAAI,EAAE,0BAA0B,EAAE,CAAC;IACnC,UAAU,EAAE,wBAAwB,EAAE,CAAC;CACxC;AAED,wEAAwE;AACxE,wBAAgB,yBAAyB,CACvC,WAAW,EAAE,+BAA+B,EAC5C,UAAU,EAAE,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACjD,2BAA2B,CA2C7B"}

package/dist/esm/external-data/models/external-data-pipeline-state.backend.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"external-data-pipeline-state.backend.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/external-data/models/external-data-pipeline-state.backend.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAEL,qBAAqB,EAIrB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EAC1B,MAAM,uBAAuB,CAAC;AAU/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,wDAAwD,CAAC;AAM3F;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;iBAgD1C,CAAC;AAEH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF,oBAAY,mCAAmC;IAC7C,QAAQ,aAAa;CACtB;AAED,KAAK,wCAAwC,GACzC,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,CAAC;AAWjC,eAAO,MAAM,oEAAoE,GAC/E,wBAAwB,oBAAoB,EAAE,KAC7C,qBAAqB,CAAC,SAAS,EAAE,wCAAwC,EAAE,OAAO,+BAA+B,CA0BnH,CAAC"}
+{"version":3,"file":"external-data-pipeline-state.backend.schemas.d.ts","sourceRoot":"","sources":["../../../../src/external-data/models/external-data-pipeline-state.backend.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAEL,qBAAqB,EAIrB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EAC1B,MAAM,uBAAuB,CAAC;AAU/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,wDAAwD,CAAC;AAM3F;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;iBAgD1C,CAAC;AAEH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF,oBAAY,mCAAmC;IAC7C,QAAQ,aAAa;CACtB;AAED,KAAK,wCAAwC,GACzC,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,CAAC;AAWjC,eAAO,MAAM,oEAAoE,GAC/E,wBAAwB,oBAAoB,EAAE,KAC7C,qBAAqB,CAAC,SAAS,EAAE,wCAAwC,EAAE,OAAO,+BAA+B,CA0BnH,CAAC"}

package/dist/esm/external-providers/models/external-providers.backend.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"external-providers.backend.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/external-providers/models/external-providers.backend.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAgC,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC7F,OAAO,EAEL,4BAA4B,EAM5B,2BAA2B,EAC3B,gBAAgB,EAChB,+BAA+B,EAC/B,kBAAkB,EACnB,MAAM,sCAAsC,CAAC;AAM9C;;;GAGG;AACH,eAAO,MAAM,+BAA+B;;;;;;;iBAkB1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAMxF;;;GAGG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;iBAMxC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAMpF;;;GAGG;AACH,eAAO,MAAM,8BAA8B;;;;;;;iBAgBzC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAMtF;;;GAGG;AACH,eAAO,MAAM,+BAA+B;;;;;;;;;;;iBAS1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAMxF;;;GAGG;AACH,eAAO,MAAM,uBAAuB;;;iBAMlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAMxE;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,4CAA6C,SAAQ,4BAA4B;IAEhG,WAAW,EAAE,yBAAyB,CAAC;IAGvC,gBAAgB,EAAE,uBAAuB,CAAC;IAG1C,YAAY,EAAE,wBAAwB,CAAC;IAGvC,eAAe,EAAE,yBAAyB,CAAC;IAG3C,IAAI,EAAE,iBAAiB,CAAC;IAoBxB,UAAU,EAAE,sBAAsB,CAAC;IAGnC,YAAY,CAAC,EAAE,2BAA2B,CAAC;CAC5C;AAED;;;;GAIG;AACH,eAAO,MAAM,kDAAkD,EAAE,CAAC,CAAC,OAAO,CAAC,4CAA4C,CA+BrH,CAAC;AAMH;;;GAGG;AACH,MAAM,WAAW,8BAA8B;IAC7C,SAAS,EAAE,OAAO,gBAAgB,CAAC,kBAAkB,CAAC;IACtD,WAAW,EAAE,yBAAyB,CAAC;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,uBAAuB,EAAE,+BAA+B,CAAC;CAC1D;AAED;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,OAAO,gBAAgB,CAAC,UAAU,CAAC;IAC9C,WAAW,EAAE,IAAI,CAAC,yBAAyB,EAAE,qBAAqB,GAAG,eAAe,GAAG,OAAO,CAAC,CAAC;IAChG,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB"}
+{"version":3,"file":"external-providers.backend.schemas.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/models/external-providers.backend.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAgC,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC7F,OAAO,EAEL,4BAA4B,EAM5B,2BAA2B,EAC3B,gBAAgB,EAChB,+BAA+B,EAC/B,kBAAkB,EACnB,MAAM,sCAAsC,CAAC;AAM9C;;;GAGG;AACH,eAAO,MAAM,+BAA+B;;;;;;;iBAkB1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAMxF;;;GAGG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;iBAMxC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAMpF;;;GAGG;AACH,eAAO,MAAM,8BAA8B;;;;;;;iBAgBzC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAMtF;;;GAGG;AACH,eAAO,MAAM,+BAA+B;;;;;;;;;;;iBAS1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAMxF;;;GAGG;AACH,eAAO,MAAM,uBAAuB;;;iBAMlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAMxE;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,4CAA6C,SAAQ,4BAA4B;IAEhG,WAAW,EAAE,yBAAyB,CAAC;IAGvC,gBAAgB,EAAE,uBAAuB,CAAC;IAG1C,YAAY,EAAE,wBAAwB,CAAC;IAGvC,eAAe,EAAE,yBAAyB,CAAC;IAG3C,IAAI,EAAE,iBAAiB,CAAC;IAoBxB,UAAU,EAAE,sBAAsB,CAAC;IAGnC,YAAY,CAAC,EAAE,2BAA2B,CAAC;CAC5C;AAED;;;;GAIG;AACH,eAAO,MAAM,kDAAkD,EAAE,CAAC,CAAC,OAAO,CAAC,4CAA4C,CA+BrH,CAAC;AAMH;;;GAGG;AACH,MAAM,WAAW,8BAA8B;IAC7C,SAAS,EAAE,OAAO,gBAAgB,CAAC,kBAAkB,CAAC;IACtD,WAAW,EAAE,yBAAyB,CAAC;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,uBAAuB,EAAE,+BAA+B,CAAC;CAC1D;AAED;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,OAAO,gBAAgB,CAAC,UAAU,CAAC;IAC9C,WAAW,EAAE,IAAI,CAAC,yBAAyB,EAAE,qBAAqB,GAAG,eAAe,GAAG,OAAO,CAAC,CAAC;IAChG,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB"}

package/dist/esm/external-providers/models/provider-selection-resolution-evidence.backend.definitions.d.ts

@@ -13,9 +13,11 @@ export interface ExternalProviderSelectionResolutionEvidence {
     readonly authorityKind: ExternalProviderSelectionAuthorityKind;
     readonly overrideStatus: ExternalProviderSelectionOverrideStatus;
     readonly applicationPrimaryProviderRef: string | null;
-    readonly applicationFallbackProviderRefs: readonly string[];
+    /** The selection's `whenUnavailable` refs — substitutes for an unavailable primary, never a failover chain. */
+    readonly applicationSubstituteProviderRefs: readonly string[];
     readonly environmentPrimaryProviderRef: string | null;
-    readonly environmentFallbackProviderRefs: readonly string[];
+    /** The environment override's `whenUnavailable` refs. Same semantics as the application's. */
+    readonly environmentSubstituteProviderRefs: readonly string[];
     readonly providerRuntimeArtifact: ProviderRuntimeArtifactEvidenceMetadata | null;
 }
 //# sourceMappingURL=provider-selection-resolution-evidence.backend.definitions.d.ts.map

package/dist/esm/external-providers/models/provider-selection-resolution-evidence.backend.definitions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-selection-resolution-evidence.backend.definitions.d.ts","sourceRoot":"","sources":["../../../../../src/external-providers/models/provider-selection-resolution-evidence.backend.definitions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,+DAA+D,CAAC;AAE7H,oBAAY,sCAAsC;IAChD,4BAA4B,iCAAiC;IAC7D,kBAAkB,uBAAuB;IACzC,oBAAoB,yBAAyB;CAC9C;AAED,oBAAY,uCAAuC;IACjD,MAAM,WAAW;IACjB,OAAO,YAAY;IACnB,SAAS,cAAc;CACxB;AAED,MAAM,WAAW,2CAA2C;IAC1D,QAAQ,CAAC,aAAa,EAAE,sCAAsC,CAAC;IAC/D,QAAQ,CAAC,cAAc,EAAE,uCAAuC,CAAC;IACjE,QAAQ,CAAC,6BAA6B,EAAE,MAAM,GAAG,IAAI,CAAC;IACtD,QAAQ,CAAC,+BAA+B,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5D,QAAQ,CAAC,6BAA6B,EAAE,MAAM,GAAG,IAAI,CAAC;IACtD,QAAQ,CAAC,+BAA+B,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5D,QAAQ,CAAC,uBAAuB,EAAE,uCAAuC,GAAG,IAAI,CAAC;CAClF"}
+{"version":3,"file":"provider-selection-resolution-evidence.backend.definitions.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/models/provider-selection-resolution-evidence.backend.definitions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,+DAA+D,CAAC;AAE7H,oBAAY,sCAAsC;IAChD,4BAA4B,iCAAiC;IAC7D,kBAAkB,uBAAuB;IACzC,oBAAoB,yBAAyB;CAC9C;AAED,oBAAY,uCAAuC;IACjD,MAAM,WAAW;IACjB,OAAO,YAAY;IACnB,SAAS,cAAc;CACxB;AAED,MAAM,WAAW,2CAA2C;IAC1D,QAAQ,CAAC,aAAa,EAAE,sCAAsC,CAAC;IAC/D,QAAQ,CAAC,cAAc,EAAE,uCAAuC,CAAC;IACjE,QAAQ,CAAC,6BAA6B,EAAE,MAAM,GAAG,IAAI,CAAC;IACtD,+GAA+G;IAC/G,QAAQ,CAAC,iCAAiC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9D,QAAQ,CAAC,6BAA6B,EAAE,MAAM,GAAG,IAAI,CAAC;IACtD,8FAA8F;IAC9F,QAAQ,CAAC,iCAAiC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9D,QAAQ,CAAC,uBAAuB,EAAE,uCAAuC,GAAG,IAAI,CAAC;CAClF"}