@wildo-ai/saas-backend-lib 1.1.3 → 1.1.4

package/dist/esm/notifications/sms/services/sms.backend.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"sms.backend.service.js","sourceRoot":"","sources":["../../../../../../src/notifications/sms/services/sms.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;;;;;;;;;;;;;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAGpF,OAAO,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAGhJ,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACrF,OAAO,EACL,sCAAsC,EAGtC,2BAA2B,GAC5B,MAAM,sCAAsC,CAAC;AAqB9C,SAAS,mBAAmB,CAAC,WAAmB;IAC9C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAGpC,CAAC;QACF,IACE,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ;eAClC,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;eAC5B,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;eACpC,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAC9B,CAAC;YACD,OAAO;gBACL,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;aAC5B,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,6CAA6C;IAC/C,CAAC;IAED,MAAM,CAAC,UAAU,EAAE,SAAS,CAAC,GAAG,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC;QACvD,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;QAC3B,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC9B,IAAI,UAAU,IAAI,SAAS,EAAE,CAAC;QAC5B,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;IACnC,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,gFAAgF;AAChF,UAAU;AACV,gFAAgF;AAGzE,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAI0B;IACa;IACH;IACgB;IANtE,QAAQ,CAA+D;IAEjF,YACsD,MAAqB,EACR,YAAwC,EAC3C,aAAsC,EACtB,yBAAkE;QAH5F,WAAM,GAAN,MAAM,CAAe;QACR,iBAAY,GAAZ,YAAY,CAA4B;QAC3C,kBAAa,GAAb,aAAa,CAAyB;QACtB,8BAAyB,GAAzB,yBAAyB,CAAyC;QAEhJ,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,mBAAmB,CAAC,CAAC;IAC/D,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,IAAI,CAAC,EAAU,EAAE,IAAY,EAAE,IAAa;QACvD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,IAAI,CAAC;YACH,0BAA0B;YAC1B,MAAM,cAAc,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAEjD,4BAA4B;YAC5B,MAAM,OAAO,GAA4B;gBACvC,EAAE;gBACF,IAAI;gBACJ,IAAI,EAAE,IAAI,IAAI,cAAc,CAAC,UAAU;aACxC,CAAC;YAEF,0BAA0B;YAC1B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;YAE5E,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YAC1C,IAAI,CAAC,QAAQ,CAAC,uBAAuB,EAAE;gBACrC,EAAE;gBACF,UAAU,EAAE,cAAc,CAAC,UAAU;gBACrC,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,UAAU;aACX,CAAC,CAAC;YAEH,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,UAAU,EAAE,cAAc,CAAC,UAAU;aACtC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YAC1C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,EAAE;gBACtC,EAAE;gBACF,GAAG,2BAA2B,CAAC,KAAK,CAAC;gBACrC,UAAU;aACX,CAAC,CAAC;YAEH,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;aAClC,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,kBAAkB;QACxB,MAAM,UAAU,GAAG,IAAI,CAAC,yBAAyB,CAAC,qCAAqC,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAE9G,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,SAAS,EACT,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,gDAAgD,EAAE,UAAU,EAAE,gBAAgB,CAAC,GAAG,EAAE,EAAE,CAC7G,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,iBAAiB,CAAC,UAAU,EAAE,sCAAsC,CAAC,YAAY,CAAC,EAAE,CAAC;YACvH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,SAAS,EACT,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,gEAAgE,UAAU,EAAE,EAAE,UAAU,EAAE,EAAE,CACnH,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,yBAAyB,CAAC,8BAA8B,CAC7E,UAAU,EACV,sCAAsC,CAAC,YAAY,CACpD,CAAC;QACF,MAAM,kBAAkB,GAAG,SAAS;YAClC,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,iBAAiB,CAC9C,UAAU,EACV,sCAAsC,CAAC,YAAY,EACnD,SAAS,CACV;YACH,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,iBAAiB,GAAG,kBAAkB;YAC1C,CAAC,CAAC,mBAAmB,CAAC,kBAAkB,CAAC;YACzC,CAAC,CAAC,IAAI,CAAC;QAET,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,SAAS,EACT;gBACE,OAAO,EAAE;oBACP,OAAO,EAAE,4DAA4D,UAAU,EAAE;oBACjF,UAAU;oBACV,UAAU,EAAE,gBAAgB,CAAC,GAAG;oBAChC,SAAS;iBACV;aACF,CACF,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,yBAAyB,CAAC,0BAA0B,CAC3E,UAAU,EACV,sCAAsC,CAAC,YAAY,CACpD,CAAC;QACF,IAAI,WAAW,EAAE,IAAI,KAAK,2BAA2B,CAAC,GAAG,EAAE,CAAC;YAC1D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,SAAS,EACT;gBACE,OAAO,EAAE;oBACP,OAAO,EAAE,wDAAwD,UAAU,EAAE;oBAC7E,UAAU;oBACV,UAAU,EAAE,gBAAgB,CAAC,GAAG;iBACjC;aACF,CACF,CAAC;QACJ,CAAC;QACD,yFAAyF;QACzF,gEAAgE;QAChE,iEAAiE;QACjE,4DAA4D;QAC5D,+DAA+D;QAC/D,gEAAgE;QAChE,+DAA+D;QAC/D,iCAAiC;QACjC,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,MAAiC,CAAC;QACvE,gDAAgD;QAChD,MAAM,eAAe,GAAG,SAAS,EAAE,sBAER,CAAC;QAC5B,MAAM,YAAY,GAAG,eAAe,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,sCAAsC,CAAC,YAAY,CAAC,CAAC;QAE1G,OAAO;YACL,UAAU;YACV,UAAU,EAAE,iBAAiB,CAAC,UAAU;YACxC,SAAS,EAAE,iBAAiB,CAAC,SAAS;YACtC,QAAQ,EAAE,WAAW,CAAC,OAAO;YAC7B,UAAU,EAAE,YAAY,EAAE,UAAU;SACrC,CAAC;IACJ,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,sBAAsB,CAClC,cAAiC,EACjC,OAAgC;QAEhC,mEAAmE;QACnE,MAAM,GAAG,GAAG,GAAG,cAAc,CAAC,QAAQ,aAAa,cAAc,CAAC,UAAU,gBAAgB,CAAC;QAE7F,0BAA0B;QAC1B,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,UAAU,IAAI,cAAc,CAAC,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAE7G,kDAAkD;QAClD,MAAM,QAAQ,GAAG,IAAI,eAAe,CAAC;YACnC,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChD,CAAC,CAAC,QAAQ,EAAE,CAAC;QAEd,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,CAAC,eAAe,CAAC,YAAY,CAAC,EAAE,mCAAmC;gBACnE,CAAC,eAAe,CAAC,aAAa,CAAC,EAAE,SAAS,SAAS,EAAE;aACtD;YACD,IAAI,EAAE,QAAQ;SACf,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACxC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,gBAAgB,EAC1B,SAAS,EACT;gBACE,OAAO,EAAE;oBACP,OAAO,EAAE,gCAAgC,QAAQ,CAAC,MAAM,EAAE;oBAC1D,UAAU,EAAE,cAAc,CAAC,UAAU;oBACrC,UAAU,EAAE,QAAQ,CAAC,MAAM;oBAC3B,SAAS;iBACV;aACF,CACF,CAAC;QACJ,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,IAAI,EAA6B,CAAC;QACtE,MAAM,gBAAgB,GAAG,YAAY,CAAC,UAAU,KAAK,SAAS,IAAI,YAAY,CAAC,UAAU,KAAK,IAAI,CAAC;QAEnG,OAAO;YACL,OAAO,EAAE,CAAC,gBAAgB;YAC1B,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,GAAG,IAAI,YAAY,CAAC,SAAS,IAAI,GAAG,cAAc,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC7G,MAAM,EAAE,gBAAgB;gBACtB,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,OAAO,YAAY,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,MAA4C,CAAC,CAAC,CAAC,SAAS;SACpH,CAAC;IACJ,CAAC;CACF,CAAA;AAvNY,iBAAiB;IAD7B,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,gCAAgC,CAAC,CAAA;;GAPnD,iBAAiB,CAuN7B","sourcesContent":["/**\n * SMS Backend Service\n *\n * Main service for sending SMS messages. Orchestrates:\n * - Provider resolution via ExternalProvidersRegistryBackendService\n * - The provider's own `SMS_PROVIDER` runtime contract, read from the registry, which supplies the\n *   endpoint and the request/response projection\n * - Raw HTTP execution (Basic Auth for Twilio)\n *\n * Mirrors the pattern of EmailBackendService for consistency.\n */\n\nimport { injectable, inject } from 'inversify';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport type { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { describeCaughtError, projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport type { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport type { ExternalProvidersRegistryBackendService } from '~wildo-backend-lib/external-providers/services/external-providers-registry.backend.service';\nimport { EngineCapability, ErrorType, WildoHeaderKeys } from '@wildo-ai/saas-models';\nimport {\n  ExternalProvider_ExchangeProtocol_Kind,\n  type StandardSMS_SendRequest,\n  type StandardSMS_SendResponse,\n  ProviderProtocolRuntimeKind,\n} from '@wildo-ai/external-connectors-models';\n\n// ─────────────────────────────────────────────────────────────────────────────\n// TYPES\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface SMSSendResult {\n  success: boolean;\n  messageId?: string;\n  providerId?: string;\n  error?: string;\n}\n\ninterface SMSProviderConfig {\n  providerId: string;\n  accountSid: string;\n  authToken: string;\n  endpoint: string;\n  fromNumber?: string;\n}\n\nfunction parseSMSCredentials(secretValue: string): { accountSid: string; authToken: string } | null {\n  try {\n    const parsed = JSON.parse(secretValue) as {\n      accountSid?: unknown;\n      authToken?: unknown;\n    };\n    if (\n      typeof parsed.accountSid === 'string'\n      && parsed.accountSid.length > 0\n      && typeof parsed.authToken === 'string'\n      && parsed.authToken.length > 0\n    ) {\n      return {\n        accountSid: parsed.accountSid,\n        authToken: parsed.authToken,\n      };\n    }\n  } catch {\n    // Fallback below handles non-JSON encodings.\n  }\n\n  const [accountSid, authToken] = secretValue.includes('|')\n    ? secretValue.split('|', 2)\n    : secretValue.split(':', 2);\n  if (accountSid && authToken) {\n    return { accountSid, authToken };\n  }\n\n  return null;\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// SERVICE\n// ─────────────────────────────────────────────────────────────────────────────\n\n@injectable()\nexport class SMSBackendService {\n  protected logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n    @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private readonly errorBuilder: ErrorBuilderBackendService,\n    @inject(SAAS_SERVICE_TYPES.AppConfigService) private readonly configService: AppConfigurationService,\n    @inject(SAAS_SERVICE_TYPES.ExternalProvidersRegistryService) private readonly externalProvidersRegistry: ExternalProvidersRegistryBackendService,\n  ) {\n    this.logDebug = this.logger.debugByType('SMSBackendService');\n  }\n\n  /**\n   * Send an SMS message.\n   *\n   * @param to - Recipient phone number in E.164 format\n   * @param body - Message body\n   * @param from - Optional sender phone number (uses provider default if not set)\n   */\n  public async send(to: string, body: string, from?: string): Promise<SMSSendResult> {\n    const startTime = Date.now();\n\n    try {\n      // 1. Resolve SMS provider\n      const providerConfig = this.resolveSMSProvider();\n\n      // 2. Build standard request\n      const request: StandardSMS_SendRequest = {\n        to,\n        body,\n        from: from ?? providerConfig.fromNumber,\n      };\n\n      // 3. Execute via provider\n      const response = await this.executeProviderRequest(providerConfig, request);\n\n      const durationMs = Date.now() - startTime;\n      this.logDebug('SMS sent successfully', {\n        to,\n        providerId: providerConfig.providerId,\n        messageId: response.messageId,\n        durationMs,\n      });\n\n      return {\n        success: true,\n        messageId: response.messageId,\n        providerId: providerConfig.providerId,\n      };\n    } catch (error) {\n      const durationMs = Date.now() - startTime;\n      this.logger.error('Failed to send SMS', {\n        to,\n        ...projectCaughtErrorLogFields(error),\n        durationMs,\n      });\n\n      return {\n        success: false,\n        error: describeCaughtError(error),\n      };\n    }\n  }\n\n  /**\n   * Resolve the SMS provider for the SMS capability.\n   * Mirrors EmailBackendService.resolveEmailProvider() pattern.\n   */\n  private resolveSMSProvider(): SMSProviderConfig {\n    const providerId = this.externalProvidersRegistry.getPrimaryProviderForEngineCapability(EngineCapability.SMS);\n\n    if (!providerId) {\n      throw this.errorBuilder.buildError(\n        ErrorType.CONFIGURATION,\n        undefined,\n        { context: { message: 'No SMS provider configured for capability: SMS', capability: EngineCapability.SMS } }\n      );\n    }\n\n    if (!this.externalProvidersRegistry.isProviderEnabled(providerId, ExternalProvider_ExchangeProtocol_Kind.SMS_PROVIDER)) {\n      throw this.errorBuilder.buildError(\n        ErrorType.CONFIGURATION,\n        undefined,\n        { context: { message: `SMS provider is disabled by external provider configuration: ${providerId}`, providerId } },\n      );\n    }\n\n    const secretRef = this.externalProvidersRegistry.getConfiguredProviderSecretRef(\n      providerId,\n      ExternalProvider_ExchangeProtocol_Kind.SMS_PROVIDER,\n    );\n    const encodedCredentials = secretRef\n      ? this.externalProvidersRegistry.getProviderSecret(\n          providerId,\n          ExternalProvider_ExchangeProtocol_Kind.SMS_PROVIDER,\n          secretRef,\n        )\n      : undefined;\n    const parsedCredentials = encodedCredentials\n      ? parseSMSCredentials(encodedCredentials)\n      : null;\n\n    if (!parsedCredentials) {\n      throw this.errorBuilder.buildError(\n        ErrorType.CONFIGURATION,\n        undefined,\n        {\n          context: {\n            message: `No env-provided credentials configured for SMS provider: ${providerId}`,\n            providerId,\n            capability: EngineCapability.SMS,\n            secretRef,\n          },\n        }\n      );\n    }\n\n    const smsContract = this.externalProvidersRegistry.getProviderRuntimeContract(\n      providerId,\n      ExternalProvider_ExchangeProtocol_Kind.SMS_PROVIDER,\n    );\n    if (smsContract?.kind !== ProviderProtocolRuntimeKind.SMS) {\n      throw this.errorBuilder.buildError(\n        ErrorType.CONFIGURATION,\n        undefined,\n        {\n          context: {\n            message: `No SMS_PROVIDER runtime contract found for provider: ${providerId}`,\n            providerId,\n            capability: EngineCapability.SMS,\n          },\n        }\n      );\n    }\n    // The framework currently ships a single `kind: ProviderProtocolRuntimeKind.SMS` runtime\n    // contract (Twilio). The execute-request path below assumes the\n    // Twilio REST API shape (`/Accounts/{AccountSid}/Messages.json`,\n    // Basic Auth, form-encoded body). When a second SMS adapter\n    // arrives, factor the provider-specific request shape into the\n    // contract via `sdkFactory` / `buildSendPayload` (mirror of the\n    // email surface) — do NOT reintroduce a `provider === '<ref>'`\n    // literal at this consumer site.\n    const appConfig = this.configService.config as Record<string, unknown>;\n    // Get optional from number from provider config\n    const providersConfig = appConfig?.providerConfigurations as Record<string, Record<string, {\n      fromNumber?: string;\n    }> | undefined> | undefined;\n    const providerConf = providersConfig?.[providerId]?.[ExternalProvider_ExchangeProtocol_Kind.SMS_PROVIDER];\n\n    return {\n      providerId,\n      accountSid: parsedCredentials.accountSid,\n      authToken: parsedCredentials.authToken,\n      endpoint: smsContract.baseUrl,\n      fromNumber: providerConf?.fromNumber,\n    };\n  }\n\n  /**\n   * Execute the SMS send request via provider.\n   * Uses raw fetch() with Basic Auth for Twilio's REST API (form-encoded).\n   */\n  private async executeProviderRequest(\n    providerConfig: SMSProviderConfig,\n    request: StandardSMS_SendRequest\n  ): Promise<StandardSMS_SendResponse> {\n    // Build the URL (Twilio uses /Accounts/{AccountSid}/Messages.json)\n    const url = `${providerConfig.endpoint}/Accounts/${providerConfig.accountSid}/Messages.json`;\n\n    // Build Basic Auth header\n    const basicAuth = Buffer.from(`${providerConfig.accountSid}:${providerConfig.authToken}`).toString('base64');\n\n    // Build form-encoded body from transformer output\n    const formBody = new URLSearchParams({\n      To: request.to,\n      Body: request.body,\n      ...(request.from ? { From: request.from } : {}),\n    }).toString();\n\n    const response = await fetch(url, {\n      method: 'POST',\n      headers: {\n        [WildoHeaderKeys.CONTENT_TYPE]: 'application/x-www-form-urlencoded',\n        [WildoHeaderKeys.AUTHORIZATION]: `Basic ${basicAuth}`,\n      },\n      body: formBody,\n    });\n\n    if (!response.ok) {\n      const errorBody = await response.text();\n      throw this.errorBuilder.buildError(\n        ErrorType.EXTERNAL_SERVICE,\n        undefined,\n        {\n          context: {\n            message: `SMS provider returned error: ${response.status}`,\n            providerId: providerConfig.providerId,\n            statusCode: response.status,\n            errorBody,\n          }\n        }\n      );\n    }\n\n    const responseData = await response.json() as Record<string, unknown>;\n    const hasProviderError = responseData.error_code !== undefined && responseData.error_code !== null;\n\n    return {\n      success: !hasProviderError,\n      messageId: String(responseData.sid ?? responseData.messageId ?? `${providerConfig.providerId}-${Date.now()}`),\n      status: hasProviderError\n        ? 'failed'\n        : typeof responseData.status === 'string' ? responseData.status as StandardSMS_SendResponse['status'] : undefined,\n    };\n  }\n}\n"]}
+{"version":3,"file":"sms.backend.service.js","sourceRoot":"","sources":["../../../../../src/notifications/sms/services/sms.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;;;;;;;;;;;;;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAGpF,OAAO,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAGhJ,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACrF,OAAO,EACL,sCAAsC,EACtC,0BAA0B,EAC1B,8BAA8B,EAG9B,2BAA2B,GAC5B,MAAM,sCAAsC,CAAC;AAK9C,OAAO,EAAE,iCAAiC,EAAE,MAAM,+EAA+E,CAAC;AAClI,OAAO,EAAE,8BAA8B,EAAE,MAAM,8EAA8E,CAAC;AAC9H,OAAO,EAAE,sBAAsB,EAAE,MAAM,6EAA6E,CAAC;AA8CrH,iEAAiE;AACjE,MAAM,2BAA2B,GAAG,sBAAsB,CAAC;AAE3D;;;;;;;GAOG;AACH,SAAS,YAAY,CAAC,KAAa,EAAE,SAAiB;IACpD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACvC,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;AACxE,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,uBAAuB,CAAC,WAAmB;IAClD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAEpC,CAAC;QACF,MAAM,SAAS,GAAG,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;YACnF,CAAC,CAAC,MAAM,CAAC,SAAS;YAClB,CAAC,CAAC,CAAC,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC5G,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;YAC1E,CAAC,CAAC,MAAM,CAAC,MAAM;YACf,CAAC,CAAC,CAAC,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACzG,IAAI,SAAS,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACpD,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;QAC/B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,4DAA4D;IAC9D,CAAC;IAED,MAAM,KAAK,GAAG,YAAY,CAAC,WAAW,EAAE,GAAG,CAAC,IAAI,YAAY,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IAC/E,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAClE,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,oBAAoB,CAC3B,eAA2C,EAC3C,WAAmB;IAEnB,QAAQ,eAAe,EAAE,CAAC;QACxB,KAAK,0BAA0B,CAAC,qBAAqB,CAAC,CAAC,CAAC;YACtD,MAAM,MAAM,GAAG,uBAAuB,CAAC,WAAW,CAAC,CAAC;YACpD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO;gBACL,uFAAuF;gBACvF,yCAAyC;gBACzC,wBAAwB,EAAE,SAAS,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;gBAC3G,4DAA4D;gBAC5D,UAAU,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE;aAC5C,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,eAAe,GAAU,eAAe,CAAC;YAC/C,OAAO,eAAe,CAAC;QACzB,CAAC;IACH,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,UAAU;AACV,gFAAgF;AAGzE,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAI0B;IACa;IACH;IACgB;IANtE,QAAQ,CAA+D;IAEjF,YACsD,MAAqB,EACR,YAAwC,EAC3C,aAAsC,EACtB,yBAAkE;QAH5F,WAAM,GAAN,MAAM,CAAe;QACR,iBAAY,GAAZ,YAAY,CAA4B;QAC3C,kBAAa,GAAb,aAAa,CAAyB;QACtB,8BAAyB,GAAzB,yBAAyB,CAAyC;QAEhJ,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,mBAAmB,CAAC,CAAC;IAC/D,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,IAAI,CAAC,EAAU,EAAE,IAAY,EAAE,IAAa;QACvD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,IAAI,CAAC;YACH,0BAA0B;YAC1B,MAAM,cAAc,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAEjD,4BAA4B;YAC5B,MAAM,OAAO,GAA4B;gBACvC,EAAE;gBACF,IAAI;gBACJ,IAAI,EAAE,IAAI,IAAI,cAAc,CAAC,UAAU;aACxC,CAAC;YAEF,0BAA0B;YAC1B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;YAE5E,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YAC1C,IAAI,CAAC,QAAQ,CAAC,uBAAuB,EAAE;gBACrC,EAAE;gBACF,UAAU,EAAE,cAAc,CAAC,UAAU;gBACrC,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,UAAU;aACX,CAAC,CAAC;YAEH,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,UAAU,EAAE,cAAc,CAAC,UAAU;aACtC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YAC1C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,EAAE;gBACtC,EAAE;gBACF,GAAG,2BAA2B,CAAC,KAAK,CAAC;gBACrC,UAAU;aACX,CAAC,CAAC;YAEH,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;aAClC,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,kBAAkB;QACxB,MAAM,UAAU,GAAG,IAAI,CAAC,yBAAyB,CAAC,qCAAqC,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAE9G,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,SAAS,EACT,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,gDAAgD,EAAE,UAAU,EAAE,gBAAgB,CAAC,GAAG,EAAE,EAAE,CAC7G,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,iBAAiB,CAAC,UAAU,EAAE,sCAAsC,CAAC,YAAY,CAAC,EAAE,CAAC;YACvH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,SAAS,EACT,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,gEAAgE,UAAU,EAAE,EAAE,UAAU,EAAE,EAAE,CACnH,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,yBAAyB,CAAC,0BAA0B,CAC3E,UAAU,EACV,sCAAsC,CAAC,YAAY,CACpD,CAAC;QACF,IAAI,WAAW,EAAE,IAAI,KAAK,2BAA2B,CAAC,GAAG,EAAE,CAAC;YAC1D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,SAAS,EACT;gBACE,OAAO,EAAE;oBACP,OAAO,EAAE,wDAAwD,UAAU,EAAE;oBAC7E,UAAU;oBACV,UAAU,EAAE,gBAAgB,CAAC,GAAG;iBACjC;aACF,CACF,CAAC;QACJ,CAAC;QAED;;;;;;;;;;;;;;;;;WAiBG;QACH,IAAI,OAAO,WAAW,CAAC,gBAAgB,KAAK,UAAU,IAAI,OAAO,WAAW,CAAC,iBAAiB,KAAK,UAAU,EAAE,CAAC;YAC9G,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,SAAS,EACT;gBACE,OAAO,EAAE;oBACP,OAAO,EAAE,mEAAmE,UAAU,IAAI;0BACtF,wFAAwF;oBAC5F,UAAU;oBACV,UAAU,EAAE,gBAAgB,CAAC,GAAG;iBACjC;aACF,CACF,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,yBAAyB,CAAC,8BAA8B,CAC7E,UAAU,EACV,sCAAsC,CAAC,YAAY,CACpD,CAAC;QACF,MAAM,kBAAkB,GAAG,SAAS;YAClC,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,iBAAiB,CAC9C,UAAU,EACV,sCAAsC,CAAC,YAAY,EACnD,SAAS,CACV;YACH,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,UAAU,GAAG,kBAAkB;YACnC,CAAC,CAAC,oBAAoB,CAAC,WAAW,CAAC,IAAI,CAAC,eAAe,EAAE,kBAAkB,CAAC;YAC5E,CAAC,CAAC,IAAI,CAAC;QAET,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,SAAS,EACT;gBACE,OAAO,EAAE;oBACP,OAAO,EAAE,sDAAsD,UAAU,EAAE;oBAC3E,UAAU;oBACV,UAAU,EAAE,gBAAgB,CAAC,GAAG;oBAChC,SAAS;oBACT,+EAA+E;oBAC/E,eAAe,EAAE,WAAW,CAAC,IAAI,CAAC,eAAe;iBAClD;aACF,CACF,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,mBAAmB,CAAC,UAAU,EAAE,WAAW,CAAC,OAAO,EAAE,WAAW,CAAC,gBAAgB,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;QAEhI,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,MAAiC,CAAC;QACvE,gDAAgD;QAChD,MAAM,eAAe,GAAG,SAAS,EAAE,sBAER,CAAC;QAC5B,MAAM,YAAY,GAAG,eAAe,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,sCAAsC,CAAC,YAAY,CAAC,CAAC;QAE1G,OAAO;YACL,UAAU;YACV,QAAQ;YACR,wBAAwB,EAAE,UAAU,CAAC,wBAAwB;YAC7D,gBAAgB,EAAE,WAAW,CAAC,gBAAgB;YAC9C,iBAAiB,EAAE,WAAW,CAAC,iBAAiB;YAChD,UAAU,EAAE,YAAY,EAAE,UAAU;SACrC,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACK,mBAAmB,CACzB,UAAkB,EAClB,OAAe,EACf,gBAAwB,EACxB,UAA4C;QAE5C,MAAM,WAAW,GAAG,gBAAgB,CAAC,OAAO,CAC1C,2BAA2B,EAC3B,CAAC,OAAO,EAAE,KAAa,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,OAAO,CACzD,CAAC;QAEF,MAAM,aAAa,GAAG,WAAW,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;QACrE,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,SAAS,EACT;gBACE,OAAO,EAAE;oBACP,OAAO,EAAE,uEAAuE,UAAU,EAAE;oBAC5F,UAAU;oBACV,gBAAgB;oBAChB,mBAAmB,EAAE,aAAa;iBACnC;aACF,CACF,CAAC;QACJ,CAAC;QAED,OAAO,GAAG,OAAO,GAAG,WAAW,EAAE,CAAC;IACpC,CAAC;IAED;;;;;;;;;;;;;OAaG;IACK,KAAK,CAAC,sBAAsB,CAClC,cAAiC,EACjC,OAAgC;QAEhC,MAAM,eAAe,GAAG,cAAc,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAEjE;;;;;;;;;;;WAWG;QACH,MAAM,eAAe,GAAG,IAAI,eAAe,EAAE,CAAC;QAC9C,MAAM,aAAa,GAAG,UAAU,CAC9B,GAAG,EAAE,CAAC,eAAe,CAAC,KAAK,CACzB,IAAI,KAAK,CAAC,iCAAiC,iCAAiC,IAAI,CAAC,CAClF,EACD,iCAAiC,CAClC,CAAC;QAEF,IAAI,QAAkB,CAAC;QACvB,IAAI,YAAoB,CAAC;QACzB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,QAAQ,EAAE;gBAC9C,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,sBAAsB,CAAC,eAAe,CAAC,gBAAgB,EAAE;oBAChE,CAAC,eAAe,CAAC,aAAa,CAAC,EAAE,cAAc,CAAC,wBAAwB;iBACzE,CAAC;gBACF,IAAI,EAAE,eAAe,CAAC,IAAI;gBAC1B,MAAM,EAAE,eAAe,CAAC,MAAM;aAC/B,CAAC,CAAC;YAEH,YAAY,GAAG,MAAM,8BAA8B,CAAC,QAAQ,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC;QACxF,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,aAAa,CAAC,CAAC;QAC9B,CAAC;QAED,MAAM,WAAW,GAAiC;YAChD,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,OAAO,EAAE,IAAI,CAAC,uBAAuB,CAAC,QAAQ,CAAC,OAAO,CAAC;YACvD,IAAI,EAAE,IAAI,CAAC,2BAA2B,CAAC,YAAY,CAAC;SACrD,CAAC;QAEF;;;;;;;;WAQG;QACH,MAAM,MAAM,GAAG,8BAA8B,CAAC,SAAS,CACrD,cAAc,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAC9C,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,gBAAgB,EAC1B,SAAS,EACT;gBACE,OAAO,EAAE;oBACP,OAAO,EAAE,mEAAmE,cAAc,CAAC,UAAU,EAAE;oBACvG,UAAU,EAAE,cAAc,CAAC,UAAU;oBACrC,UAAU,EAAE,QAAQ,CAAC,MAAM;oBAC3B,eAAe,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO;iBACtC;aACF,CACF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YACzB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,gBAAgB,EAC1B,SAAS,EACT;gBACE,OAAO,EAAE;oBACP,OAAO,EAAE,sCAAsC,cAAc,CAAC,UAAU,EAAE;oBAC1E,UAAU,EAAE,cAAc,CAAC,UAAU;oBACrC,UAAU,EAAE,QAAQ,CAAC,MAAM;oBAC3B,SAAS,EAAE,YAAY;iBACxB;aACF,CACF,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;IAED,gGAAgG;IACxF,uBAAuB,CAAC,OAAgB;QAC9C,MAAM,MAAM,GAA2B,EAAE,CAAC;QAC1C,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAC7B,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,GAAG,KAAK,CAAC;QACpC,CAAC,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;OAIG;IACK,2BAA2B,CAAC,YAAoB;QACtD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,YAAY,CAAC;QACtB,CAAC;IACH,CAAC;CACF,CAAA;AA1WY,iBAAiB;IAD7B,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,gCAAgC,CAAC,CAAA;;GAPnD,iBAAiB,CA0W7B","sourcesContent":["/**\n * SMS Backend Service\n *\n * Sends one transactional SMS. Orchestrates:\n * - provider resolution via `ExternalProvidersRegistryBackendService`\n * - the provider's own `SMS_PROVIDER` runtime contract, read from the registry\n * - HTTP transport\n *\n * ## The line between engine and provider\n *\n * Until 2026-09-09 this service narrowed the runtime contract to\n * `kind: ProviderProtocolRuntimeKind.SMS` — a PROTOCOL many providers can speak — and then built\n * TWILIO's request unconditionally: `/Accounts/{AccountSid}/Messages.json`, Basic auth, a\n * form-encoded `To`/`Body`/`From` body, a response read for `sid` and `error_code`. A second\n * provider declaring `SMS_PROVIDER` would have been sent through Twilio's API carrying its own\n * credentials, and nothing would have refused it or logged it.\n *\n * It now mirrors `EmailBackendService`, which is the arm this problem already has a solved shape\n * for: the provider declares PURE FUNCTIONS on its contract and the engine owns transport.\n *\n *   ENGINE (here)    — resolve the secret, parse it per the declared `auth.credentialShape`,\n *                      compose the `Authorization` header, substitute `{accountId}` into the\n *                      contract's `sendEndpointPath`, issue the request, and validate the\n *                      provider's parsed response against `StandardSMS_SendResponseSchema`.\n *   PROVIDER         — the endpoint path shape, the request body and its `content-type`, and the\n *                      projection of the vendor response onto `StandardSMS_SendResponse`.\n *\n * There is deliberately no consumer-side adapter registry of the kind billing uses. That shape\n * exists only because a billing adapter is a CLASS in this package, which the provider package\n * cannot reach without a reverse dependency edge; an SMS provider owes functions over\n * `@wildo-ai/external-connectors-models` types, which it can supply directly.\n *\n * Every refusal below names the provider, so a misconfigured or unsupported second provider is a\n * legible failure rather than a silent send through somebody else's API.\n */\n\nimport { injectable, inject } from 'inversify';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport type { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { describeCaughtError, projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport type { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport type { ExternalProvidersRegistryBackendService } from '~wildo-backend-lib/external-providers/services/external-providers-registry.backend.service';\nimport { EngineCapability, ErrorType, WildoHeaderKeys } from '@wildo-ai/saas-models';\nimport {\n  ExternalProvider_ExchangeProtocol_Kind,\n  SmsProviderCredentialShape,\n  StandardSMS_SendResponseSchema,\n  type StandardSMS_SendRequest,\n  type StandardSMS_SendResponse,\n  ProviderProtocolRuntimeKind,\n} from '@wildo-ai/external-connectors-models';\nimport type {\n  SmsProviderSendRequest,\n  SmsProviderSendResponseInput,\n} from '@wildo-ai/external-connectors-private/backend';\nimport { SMS_PROVIDER_TRANSPORT_TIMEOUT_MS } from '~wildo-backend-lib/notifications/sms/models/sms-transport.backend.definitions';\nimport { readResponseTextWithinDeadline } from '~wildo-backend-lib/security/outbound/outbound-request-deadline.backend.utils';\nimport { withEngineOwnedHeaders } from '~wildo-backend-lib/security/outbound/outbound-request-headers.backend.utils';\n\n// ─────────────────────────────────────────────────────────────────────────────\n// TYPES\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface SMSSendResult {\n  success: boolean;\n  messageId?: string;\n  providerId?: string;\n  error?: string;\n}\n\n/**\n * A resolved SMS provider, carrying NO vendor-specific field.\n *\n * Contrast the shape this replaced, which held `accountSid` and `authToken` — Twilio's credential\n * parts, named in Twilio's words, on a type every SMS provider had to pass through. Those names\n * were the tell that one vendor's shape had become the framework's.\n */\ninterface SMSProviderConfig {\n  providerId: string;\n  /** Fully composed send URL: `baseUrl` + `sendEndpointPath`, with every token substituted. */\n  endpoint: string;\n  /** Value for the `Authorization` header, composed by the engine from the declared shape. */\n  authorizationHeaderValue: string;\n  buildSendRequest: (request: StandardSMS_SendRequest) => SmsProviderSendRequest;\n  parseSendResponse: (response: SmsProviderSendResponseInput) => StandardSMS_SendResponse;\n  fromNumber?: string;\n}\n\n/**\n * What the engine derives from a resolved secret, once it knows the declared shape.\n *\n * Both halves come out of ONE exhaustive `switch`, deliberately: authentication and path\n * substitution are two consequences of the same credential, and splitting them into two switches\n * is how a new shape comes to be handled in one place and not the other.\n *\n * `pathTokens` never carries secret material — an account identifier appears in a URL, a secret\n * must not.\n */\ninterface SMSResolvedCredential {\n  authorizationHeaderValue: string;\n  pathTokens: Readonly<Record<string, string>>;\n}\n\n/** Any `{token}` the contract's `sendEndpointPath` may carry. */\nconst ENDPOINT_PATH_TOKEN_PATTERN = /\\{([a-zA-Z0-9_]+)\\}/g;\n\n/**\n * Split a two-part credential bundle on the FIRST occurrence of `separator`, keeping the whole\n * remainder as the second part.\n *\n * `String.prototype.split(sep, 2)` truncates rather than keeping the remainder — `'a:b:c'` yields\n * `['a', 'b']` and silently drops `':c'` — so the previous implementation would have mangled any\n * secret containing the separator. Twilio's auth tokens are hex, which is why it never bit.\n */\nfunction splitOnFirst(value: string, separator: string): [string, string] | null {\n  const index = value.indexOf(separator);\n  if (index <= 0 || index === value.length - 1) {\n    return null;\n  }\n  return [value.slice(0, index), value.slice(index + separator.length)];\n}\n\n/**\n * Parse an `ACCOUNT_ID_AND_SECRET` bundle out of the resolved secret value.\n *\n * Three operator-facing encodings are accepted, in order: a JSON object, `<accountId>|<secret>`,\n * and `<accountId>:<secret>`. They are the ENV VAR's format, not a per-provider branch — every\n * provider declaring this credential shape reads the same three.\n *\n * The JSON object accepts the SHAPE's own field names (`accountId` / `secret`) and, as an alias,\n * Twilio's (`accountSid` / `authToken`). The alias is there because deployments already hold\n * `TWILIO_CREDENTIALS` in that form and breaking every environment buys nothing; the generic names\n * are preferred because a shape called `ACCOUNT_ID_AND_SECRET` whose only object encoding spoke one\n * vendor's vocabulary would be the same defect this whole change removes, one level down — a second\n * provider declaring this shape would have had to tell its operator to write Twilio's key names.\n */\nfunction parseAccountIdAndSecret(secretValue: string): { accountId: string; secret: string } | null {\n  try {\n    const parsed = JSON.parse(secretValue) as {\n      accountId?: unknown; secret?: unknown; accountSid?: unknown; authToken?: unknown;\n    };\n    const accountId = typeof parsed.accountId === 'string' && parsed.accountId.length > 0\n      ? parsed.accountId\n      : (typeof parsed.accountSid === 'string' && parsed.accountSid.length > 0 ? parsed.accountSid : undefined);\n    const secret = typeof parsed.secret === 'string' && parsed.secret.length > 0\n      ? parsed.secret\n      : (typeof parsed.authToken === 'string' && parsed.authToken.length > 0 ? parsed.authToken : undefined);\n    if (accountId !== undefined && secret !== undefined) {\n      return { accountId, secret };\n    }\n  } catch {\n    // Not JSON; the delimited encodings below are the fallback.\n  }\n\n  const parts = splitOnFirst(secretValue, '|') ?? splitOnFirst(secretValue, ':');\n  return parts ? { accountId: parts[0], secret: parts[1] } : null;\n}\n\n/**\n * Derive the authorization header and the substitutable path tokens for a declared credential\n * shape, or `null` when the resolved secret does not parse to that shape.\n *\n * The `never` check is what makes this the enforcement point for the whole arm: a member added to\n * `SmsProviderCredentialShape` without a branch here fails COMPILATION, so the vocabulary cannot\n * grow a member the engine is unable to authenticate.\n */\nfunction resolveSMSCredential(\n  credentialShape: SmsProviderCredentialShape,\n  secretValue: string,\n): SMSResolvedCredential | null {\n  switch (credentialShape) {\n    case SmsProviderCredentialShape.ACCOUNT_ID_AND_SECRET: {\n      const parsed = parseAccountIdAndSecret(secretValue);\n      if (!parsed) {\n        return null;\n      }\n      return {\n        // spec-cite: RFC 7617 §2 — Basic credentials are the base64 of `user-id \":\" password`,\n        // carried in the `Authorization` header.\n        authorizationHeaderValue: `Basic ${Buffer.from(`${parsed.accountId}:${parsed.secret}`).toString('base64')}`,\n        // The identifier only. The secret half never reaches a URL.\n        pathTokens: { accountId: parsed.accountId },\n      };\n    }\n    default: {\n      const exhaustiveCheck: never = credentialShape;\n      return exhaustiveCheck;\n    }\n  }\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// SERVICE\n// ─────────────────────────────────────────────────────────────────────────────\n\n@injectable()\nexport class SMSBackendService {\n  protected logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n    @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private readonly errorBuilder: ErrorBuilderBackendService,\n    @inject(SAAS_SERVICE_TYPES.AppConfigService) private readonly configService: AppConfigurationService,\n    @inject(SAAS_SERVICE_TYPES.ExternalProvidersRegistryService) private readonly externalProvidersRegistry: ExternalProvidersRegistryBackendService,\n  ) {\n    this.logDebug = this.logger.debugByType('SMSBackendService');\n  }\n\n  /**\n   * Send an SMS message.\n   *\n   * @param to - Recipient phone number in E.164 format\n   * @param body - Message body\n   * @param from - Optional sender phone number (uses provider default if not set)\n   */\n  public async send(to: string, body: string, from?: string): Promise<SMSSendResult> {\n    const startTime = Date.now();\n\n    try {\n      // 1. Resolve SMS provider\n      const providerConfig = this.resolveSMSProvider();\n\n      // 2. Build standard request\n      const request: StandardSMS_SendRequest = {\n        to,\n        body,\n        from: from ?? providerConfig.fromNumber,\n      };\n\n      // 3. Execute via provider\n      const response = await this.executeProviderRequest(providerConfig, request);\n\n      const durationMs = Date.now() - startTime;\n      this.logDebug('SMS sent successfully', {\n        to,\n        providerId: providerConfig.providerId,\n        messageId: response.messageId,\n        durationMs,\n      });\n\n      return {\n        success: true,\n        messageId: response.messageId,\n        providerId: providerConfig.providerId,\n      };\n    } catch (error) {\n      const durationMs = Date.now() - startTime;\n      this.logger.error('Failed to send SMS', {\n        to,\n        ...projectCaughtErrorLogFields(error),\n        durationMs,\n      });\n\n      return {\n        success: false,\n        error: describeCaughtError(error),\n      };\n    }\n  }\n\n  /**\n   * Resolve the SMS provider for the SMS capability, reading every vendor-specific decision off\n   * the provider's own runtime contract.\n   *\n   * Mirrors `EmailBackendService.resolveEmailProvider()`.\n   */\n  private resolveSMSProvider(): SMSProviderConfig {\n    const providerId = this.externalProvidersRegistry.getPrimaryProviderForEngineCapability(EngineCapability.SMS);\n\n    if (!providerId) {\n      throw this.errorBuilder.buildError(\n        ErrorType.CONFIGURATION,\n        undefined,\n        { context: { message: 'No SMS provider configured for capability: SMS', capability: EngineCapability.SMS } }\n      );\n    }\n\n    if (!this.externalProvidersRegistry.isProviderEnabled(providerId, ExternalProvider_ExchangeProtocol_Kind.SMS_PROVIDER)) {\n      throw this.errorBuilder.buildError(\n        ErrorType.CONFIGURATION,\n        undefined,\n        { context: { message: `SMS provider is disabled by external provider configuration: ${providerId}`, providerId } },\n      );\n    }\n\n    const smsContract = this.externalProvidersRegistry.getProviderRuntimeContract(\n      providerId,\n      ExternalProvider_ExchangeProtocol_Kind.SMS_PROVIDER,\n    );\n    if (smsContract?.kind !== ProviderProtocolRuntimeKind.SMS) {\n      throw this.errorBuilder.buildError(\n        ErrorType.CONFIGURATION,\n        undefined,\n        {\n          context: {\n            message: `No SMS_PROVIDER runtime contract found for provider: ${providerId}`,\n            providerId,\n            capability: EngineCapability.SMS,\n          },\n        }\n      );\n    }\n\n    /*\n     * A contract that reached the registry without an executable request shape.\n     *\n     * This is NOT belt-and-braces on top of the type system, and it must not be deleted as such.\n     * A provider reaches a running application through a COMPANION CONTRIBUTION, and that wire\n     * record is deliberately permissive at both ends:\n     * `ProviderCompanionContributionSchema` (`@wildo-ai/saas-models`,\n     * `src/companion/provider-discovery.shared.schemas.ts:120`) is a `z.looseObject` so a record\n     * from a package version this repository never compiled rides through instead of failing the\n     * parse, it announces its `protocols` as bare strings rather than the typed enum, and its\n     * `runtimeImportPath` is resolved and imported at runtime. So the module supplying an SMS\n     * contract can be one no compilation here ever checked.\n     *\n     * Without this guard that case is a `TypeError` from inside transport naming no provider.\n     * With it, the compile-time requirement on the arm and this refusal together are what make\n     * \"never silently handed another vendor's shape\" true for every declarer, not only the ones\n     * built in this repository.\n     */\n    if (typeof smsContract.buildSendRequest !== 'function' || typeof smsContract.parseSendResponse !== 'function') {\n      throw this.errorBuilder.buildError(\n        ErrorType.CONFIGURATION,\n        undefined,\n        {\n          context: {\n            message: `SMS provider declares no send-request shape and cannot be used: ${providerId}. `\n              + 'Its SMS_PROVIDER runtime contract must declare buildSendRequest and parseSendResponse.',\n            providerId,\n            capability: EngineCapability.SMS,\n          },\n        }\n      );\n    }\n\n    const secretRef = this.externalProvidersRegistry.getConfiguredProviderSecretRef(\n      providerId,\n      ExternalProvider_ExchangeProtocol_Kind.SMS_PROVIDER,\n    );\n    const encodedCredentials = secretRef\n      ? this.externalProvidersRegistry.getProviderSecret(\n          providerId,\n          ExternalProvider_ExchangeProtocol_Kind.SMS_PROVIDER,\n          secretRef,\n        )\n      : undefined;\n    const credential = encodedCredentials\n      ? resolveSMSCredential(smsContract.auth.credentialShape, encodedCredentials)\n      : null;\n\n    if (!credential) {\n      throw this.errorBuilder.buildError(\n        ErrorType.CONFIGURATION,\n        undefined,\n        {\n          context: {\n            message: `No usable credentials configured for SMS provider: ${providerId}`,\n            providerId,\n            capability: EngineCapability.SMS,\n            secretRef,\n            // The SHAPE, never the value: it is what an operator needs to fix the env var.\n            credentialShape: smsContract.auth.credentialShape,\n          },\n        }\n      );\n    }\n\n    const endpoint = this.composeSendEndpoint(providerId, smsContract.baseUrl, smsContract.sendEndpointPath, credential.pathTokens);\n\n    const appConfig = this.configService.config as Record<string, unknown>;\n    // Get optional from number from provider config\n    const providersConfig = appConfig?.providerConfigurations as Record<string, Record<string, {\n      fromNumber?: string;\n    }> | undefined> | undefined;\n    const providerConf = providersConfig?.[providerId]?.[ExternalProvider_ExchangeProtocol_Kind.SMS_PROVIDER];\n\n    return {\n      providerId,\n      endpoint,\n      authorizationHeaderValue: credential.authorizationHeaderValue,\n      buildSendRequest: smsContract.buildSendRequest,\n      parseSendResponse: smsContract.parseSendResponse,\n      fromNumber: providerConf?.fromNumber,\n    };\n  }\n\n  /**\n   * Compose the send URL from the contract's `baseUrl` and `sendEndpointPath`, substituting the\n   * tokens the resolved credential supplies.\n   *\n   * Refuses a path still holding a `{token}` afterwards. There is no declared token LIST to check\n   * against — this check IS the validation, and it is stronger than a list because it cannot drift\n   * from what substitution actually produced. A misspelled token would otherwise travel to the\n   * vendor as a literal path segment and come back as an opaque 404.\n   */\n  private composeSendEndpoint(\n    providerId: string,\n    baseUrl: string,\n    sendEndpointPath: string,\n    pathTokens: Readonly<Record<string, string>>,\n  ): string {\n    const substituted = sendEndpointPath.replace(\n      ENDPOINT_PATH_TOKEN_PATTERN,\n      (literal, token: string) => pathTokens[token] ?? literal,\n    );\n\n    const unsubstituted = substituted.match(ENDPOINT_PATH_TOKEN_PATTERN);\n    if (unsubstituted) {\n      throw this.errorBuilder.buildError(\n        ErrorType.CONFIGURATION,\n        undefined,\n        {\n          context: {\n            message: `SMS provider declares an endpoint path with unsubstitutable tokens: ${providerId}`,\n            providerId,\n            sendEndpointPath,\n            unsubstitutedTokens: unsubstituted,\n          },\n        }\n      );\n    }\n\n    return `${baseUrl}${substituted}`;\n  }\n\n  /**\n   * Issue the provider's own request and project its response.\n   *\n   * Every vendor-specific decision here comes off the contract. The engine contributes the\n   * `Authorization` header and nothing else.\n   *\n   * That last promise is delivered by `withEngineOwnedHeaders`, and NOT by the ordering this JSDoc\n   * used to cite. Until 2026-09-09 it read \"it is applied AFTER the provider's transport headers,\n   * so a provider cannot take authentication over by naming that header\" — true only of an\n   * identical spelling. Header names are case-insensitive on the wire and case-SENSITIVE as object\n   * keys, so a provider naming `Authorization` against the engine's `authorization` produced two\n   * keys that `fetch` combines into one comma-joined value, authenticating with neither. The shared\n   * helper drops every spelling of an engine-owned name before the engine's own value is applied.\n   */\n  private async executeProviderRequest(\n    providerConfig: SMSProviderConfig,\n    request: StandardSMS_SendRequest\n  ): Promise<StandardSMS_SendResponse> {\n    const providerRequest = providerConfig.buildSendRequest(request);\n\n    /*\n     * THE DEADLINE, and it stays armed through response-body consumption.\n     *\n     * This request had no bound at all until 2026-09-09. It is reached synchronously from phone\n     * verification and the SMS second factor, so a vendor that accepts a connection and then never\n     * answers held a sign-in open for as long as the socket lived — Node's `fetch` imposes no\n     * timeout of its own, and nothing above this frame imposed one either.\n     *\n     * `clearTimeout` sits in a `finally` that wraps BOTH the request and the body read, which is\n     * the half that is easy to lose: a provider that returns headers and then stalls its body\n     * retains the request exactly as effectively as one that never returns at all.\n     */\n    const abortController = new AbortController();\n    const timeoutHandle = setTimeout(\n      () => abortController.abort(\n        new Error(`SMS provider request exceeded ${SMS_PROVIDER_TRANSPORT_TIMEOUT_MS}ms`),\n      ),\n      SMS_PROVIDER_TRANSPORT_TIMEOUT_MS,\n    );\n\n    let response: Response;\n    let responseText: string;\n    try {\n      response = await fetch(providerConfig.endpoint, {\n        method: 'POST',\n        headers: withEngineOwnedHeaders(providerRequest.transportHeaders, {\n          [WildoHeaderKeys.AUTHORIZATION]: providerConfig.authorizationHeaderValue,\n        }),\n        body: providerRequest.body,\n        signal: abortController.signal,\n      });\n\n      responseText = await readResponseTextWithinDeadline(response, abortController.signal);\n    } finally {\n      clearTimeout(timeoutHandle);\n    }\n\n    const parserInput: SmsProviderSendResponseInput = {\n      status: response.status,\n      headers: this.responseHeadersToRecord(response.headers),\n      body: this.bestEffortParseResponseBody(responseText),\n    };\n\n    /*\n     * The provider decides acceptance, and the engine holds it to the standard shape.\n     *\n     * Both halves matter. Twilio reports a per-message failure inside a 2xx body, so an HTTP-status\n     * check alone is not an answer — that is why the decision is the provider's. And the validation\n     * replaces an unchecked `responseData.status as StandardSMS_SendResponse['status']` that let any\n     * string through: Twilio's own `accepted` would have landed in a field whose vocabulary does not\n     * contain it.\n     */\n    const parsed = StandardSMS_SendResponseSchema.safeParse(\n      providerConfig.parseSendResponse(parserInput),\n    );\n    if (!parsed.success) {\n      throw this.errorBuilder.buildError(\n        ErrorType.EXTERNAL_SERVICE,\n        undefined,\n        {\n          context: {\n            message: `SMS provider response parser violated StandardSMS_SendResponse: ${providerConfig.providerId}`,\n            providerId: providerConfig.providerId,\n            statusCode: response.status,\n            validationError: parsed.error.message,\n          },\n        }\n      );\n    }\n\n    if (!parsed.data.success) {\n      throw this.errorBuilder.buildError(\n        ErrorType.EXTERNAL_SERVICE,\n        undefined,\n        {\n          context: {\n            message: `SMS provider rejected the message: ${providerConfig.providerId}`,\n            providerId: providerConfig.providerId,\n            statusCode: response.status,\n            errorBody: responseText,\n          }\n        }\n      );\n    }\n\n    return parsed.data;\n  }\n\n  /** Lower-cased header projection, so a provider's parser can index headers by a stable name. */\n  private responseHeadersToRecord(headers: Headers): Record<string, string> {\n    const result: Record<string, string> = {};\n    headers.forEach((value, key) => {\n      result[key.toLowerCase()] = value;\n    });\n    return result;\n  }\n\n  /**\n   * Decode a response body without assuming it is JSON. A vendor error page is frequently HTML or\n   * plain text, and handing the raw string to the provider's parser is more useful than throwing\n   * before it gets a chance to classify.\n   */\n  private bestEffortParseResponseBody(responseText: string): unknown {\n    if (responseText.length === 0) {\n      return undefined;\n    }\n    try {\n      return JSON.parse(responseText);\n    } catch {\n      return responseText;\n    }\n  }\n}\n"]}

package/dist/esm/notifications/webhooks/controllers/webhook-auto-controller.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"webhook-auto-controller.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/notifications/webhooks/controllers/webhook-auto-controller.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAKH,OAAO,EAGL,KAAK,wBAAwB,EAC9B,MAAM,sCAAsC,CAAC;AAI9C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AACnH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kEAAkE,CAAC;AAC5G,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,0FAA0F,CAAC;AACtJ,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,4FAA4F,CAAC;AAC1J,OAAO,EAAE,gCAAgC,EAAE,MAAM,0FAA0F,CAAC;AAC5I,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,oFAAoF,CAAC;AAEvI;;;;;;;GAOG;AACH,oBAAY,6BAA6B;IACvC;;;;OAIG;IACH,qBAAqB,0BAA0B;IAC/C;;;;OAIG;IACH,mBAAmB,wBAAwB;CAC5C;AAED,+EAA+E;AAC/E,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,6BAA6B,EAAE,CAAC;CAC1C;AAED,qBACa,mCAAoC,SAAQ,gCAAgC;IAoC1B,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IACtC,OAAO,CAAC,QAAQ,CAAC,yBAAyB;IAnCzG,uEAAuE;IACvE,OAAO,CAAC,kBAAkB,CAA+C;IAEzE,OAAO,CAAC,cAAc,CAA6C;IAEnE;;;;OAIG;IACH,OAAO,CAAC,eAAe,CAAsC;IAE7D,2EAA2E;IAC3E,OAAO,CAAC,oBAAoB,CAAgB;IAE5C;;;;OAIG;IACH,OAAO,CAAC,cAAc,CAAiC;IAEvD;;;;;OAKG;IACH,OAAO,CAAC,gBAAgB,CAAS;gBAGI,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EACxC,YAAY,EAAE,mBAAmB,EACL,uBAAuB,EAAE,qCAAqC,EAC5D,yBAAyB,EAAE,uCAAuC;IASlJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACU,UAAU,CACrB,cAAc,EAAE,4BAA4B,GAC3C,OAAO,CAAC,IAAI,CAAC;IAuDhB;;;;;;;;;;;;;OAaG;IACH,yBAAyB,CAAC,OAAO,EAAE,wBAAwB,GAAG,IAAI;IAoBlE;;;;OAIG;IACI,8BAA8B,IAAI,aAAa,CAAC,MAAM,CAAC;IAI9D;;;;OAIG;IACI,wBAAwB,IAAI,aAAa,CAAC,uBAAuB,CAAC;IAQzE;;;;;;;;OAQG;IACH,SAAS,CAAC,WAAW,IAAI,IAAI;IAI7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6CG;IACH,OAAO,CAAC,qBAAqB;IA8D7B;;;;;;;;OAQG;IACH,OAAO,CAAC,0BAA0B;YAwBpB,oBAAoB;CAqFnC"}
+{"version":3,"file":"webhook-auto-controller.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/notifications/webhooks/controllers/webhook-auto-controller.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAKH,OAAO,EAGL,KAAK,wBAAwB,EAC9B,MAAM,sCAAsC,CAAC;AAI9C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AACnH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kEAAkE,CAAC;AAC5G,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,0FAA0F,CAAC;AACtJ,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,4FAA4F,CAAC;AAC1J,OAAO,EAAE,gCAAgC,EAAE,MAAM,0FAA0F,CAAC;AAC5I,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,oFAAoF,CAAC;AAEvI;;;;;;;GAOG;AACH,oBAAY,6BAA6B;IACvC;;;;OAIG;IACH,qBAAqB,0BAA0B;IAC/C;;;;OAIG;IACH,mBAAmB,wBAAwB;CAC5C;AAED,+EAA+E;AAC/E,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,6BAA6B,EAAE,CAAC;CAC1C;AAED,qBACa,mCAAoC,SAAQ,gCAAgC;IAoC1B,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IACtC,OAAO,CAAC,QAAQ,CAAC,yBAAyB;IAnCzG,uEAAuE;IACvE,OAAO,CAAC,kBAAkB,CAA+C;IAEzE,OAAO,CAAC,cAAc,CAA6C;IAEnE;;;;OAIG;IACH,OAAO,CAAC,eAAe,CAAsC;IAE7D,2EAA2E;IAC3E,OAAO,CAAC,oBAAoB,CAAgB;IAE5C;;;;OAIG;IACH,OAAO,CAAC,cAAc,CAAiC;IAEvD;;;;;OAKG;IACH,OAAO,CAAC,gBAAgB,CAAS;gBAGI,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EACxC,YAAY,EAAE,mBAAmB,EACL,uBAAuB,EAAE,qCAAqC,EAC5D,yBAAyB,EAAE,uCAAuC;IASlJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACU,UAAU,CACrB,cAAc,EAAE,4BAA4B,GAC3C,OAAO,CAAC,IAAI,CAAC;IAuDhB;;;;;;;;;;;;;OAaG;IACH,yBAAyB,CAAC,OAAO,EAAE,wBAAwB,GAAG,IAAI;IAoBlE;;;;OAIG;IACI,8BAA8B,IAAI,aAAa,CAAC,MAAM,CAAC;IAI9D;;;;OAIG;IACI,wBAAwB,IAAI,aAAa,CAAC,uBAAuB,CAAC;IAQzE;;;;;;;;OAQG;IACH,SAAS,CAAC,WAAW,IAAI,IAAI;IAI7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6CG;IACH,OAAO,CAAC,qBAAqB;IA8D7B;;;;;;;;OAQG;IACH,OAAO,CAAC,0BAA0B;YAwBpB,oBAAoB;CAqFnC"}

package/dist/esm/notifications/webhooks/controllers/webhook-auto-controller.backend.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"webhook-auto-controller.backend.service.js","sourceRoot":"","sources":["../../../../../../src/notifications/webhooks/controllers/webhook-auto-controller.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;;;;;;;;;;;;;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,EACL,sCAAsC,GAGvC,MAAM,sCAAsC,CAAC;AAG9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAMpF,OAAO,EAAE,gCAAgC,EAAE,MAAM,0FAA0F,CAAC;AAG5I;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,6BAaX;AAbD,WAAY,6BAA6B;IACvC;;;;OAIG;IACH,gFAA+C,CAAA;IAC/C;;;;OAIG;IACH,4EAA2C,CAAA;AAC7C,CAAC,EAbW,6BAA6B,KAA7B,6BAA6B,QAaxC;AAYM,IAAM,mCAAmC,GAAzC,MAAM,mCAAoC,SAAQ,gCAAgC;IAoCT;IACE;IAnChF,uEAAuE;IAC/D,kBAAkB,GAAG,IAAI,GAAG,EAAoC,CAAC;IAEjE,cAAc,GAAwC,IAAI,CAAC;IAEnE;;;;OAIG;IACK,eAAe,GAAG,IAAI,GAAG,EAA2B,CAAC;IAE7D,2EAA2E;IACnE,oBAAoB,GAAa,EAAE,CAAC;IAE5C;;;;OAIG;IACK,cAAc,GAA8B,EAAE,CAAC;IAEvD;;;;;OAKG;IACK,gBAAgB,GAAG,KAAK,CAAC;IAEjC,YACqC,MAAqB,EACR,YAAwC,EACxC,YAAiC,EACL,uBAA8D,EAC5D,yBAAkE;QAEhJ,KAAK,CAAC,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,uBAAuB,CAAC,CAAC;QAHS,4BAAuB,GAAvB,uBAAuB,CAAuC;QAC5D,8BAAyB,GAAzB,yBAAyB,CAAyC;IAGlJ,CAAC;IAED,+DAA+D;IAC/D,iBAAiB;IACjB,+DAA+D;IAE/D;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACI,KAAK,CAAC,UAAU,CACrB,cAA4C;QAE5C,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QAErC,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,uBAAuB,CAAC,wBAAwB,CAAC,sCAAsC,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACxI,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;YAC1C,IAAI,CAAC;gBACH,IACE,CAAC,IAAI,CAAC,yBAAyB,CAAC,iBAAiB,CAC/C,WAAW,EACX,sCAAsC,CAAC,kBAAkB,CAC1D,EACD,CAAC;oBACD,SAAS;gBACX,CAAC;gBAED,MAAM,MAAM,GAAG,IAAI,CAAC,yBAAyB,CAAC,wBAAwB,CACpE,WAAW,EACX,sCAAsC,CAAC,kBAAkB,CAC1D,CAAC;gBACF,gEAAgE;gBAChE,mEAAmE;gBACnE,8DAA8D;gBAC9D,iEAAiE;gBACjE,qDAAqD;gBACrD,8DAA8D;gBAC9D,2DAA2D;gBAC3D,6DAA6D;gBAC7D,wBAAwB;gBACxB,MAAM,SAAS,GAAoB,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;gBAClE,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACzB,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;oBACjD,IAAI,CAAC,QAAQ,CAAC,cAAc,SAAS,CAAC,MAAM,4BAA4B,WAAW,EAAE,CAAC,CAAC;gBACzF,CAAC;qBAAM,CAAC;oBACN,kEAAkE;oBAClE,oEAAoE;oBACpE,qEAAqE;oBACrE,kEAAkE;oBAClE,kEAAkE;oBAClE,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,oCAAoC,WAAW,oGAAoG,CACpJ,CAAC;gBACJ,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2CAA2C,WAAW,EAAE,EAAE;oBACzE,KAAK,EAAG,KAAe,CAAC,OAAO;iBAChC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,4CAA4C,IAAI,CAAC,eAAe,CAAC,IAAI,cAAc,CAAC,CAAC;QAEnG,2EAA2E;QAC3E,IAAI,CAAC,qBAAqB,EAAE,CAAC;IAC/B,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,yBAAyB,CAAC,OAAiC;QACzD,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAEzD,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,kDAAkD,OAAO,CAAC,UAAU,sDAAsD;kBACxH,6HAA6H;kBAC7H,qFAAqF;kBACrF,4FAA4F,EAC9F;gBACE,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,cAAc,EAAE,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC;aAChF,CACF,CAAC;YACF,OAAO;QACT,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,6CAA6C,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IACnF,CAAC;IAED;;;;OAIG;IACI,8BAA8B;QACnC,OAAO,CAAC,GAAG,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACxC,CAAC;IAED;;;;OAIG;IACI,wBAAwB;QAC7B,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,WAAW,EAAE,OAAO,EAAE,CAAC,GAAG,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3G,CAAC;IAED,+DAA+D;IAC/D,SAAS;IACT,+DAA+D;IAE/D;;;;;;;;OAQG;IACO,WAAW;QACnB,mEAAmE;IACrE,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6CG;IACK,qBAAqB;QAC3B,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;QAE7B,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0FAA0F,CAAC,CAAC;YAC7G,OAAO;QACT,CAAC;QAED,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACpC,IAAI,CAAC,QAAQ,CAAC,wDAAwD,CAAC,CAAC;YACxE,OAAO;QACT,CAAC;QAED,KAAK,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YAC5D,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;gBACjC,MAAM,SAAS,GAAG,aAAa,WAAW,IAAI,QAAQ,CAAC,GAAG,EAAE,CAAC;gBAE7D,MAAM,WAAW,GAAG,IAAI,CAAC,0BAA0B,CAAC,WAAW,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;gBACtF,IAAI,WAAW,EAAE,CAAC;oBAChB,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;oBACtC,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,+CAA+C,SAAS,uDAAuD;0BAC7G,IAAI,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,iFAAiF;0BACnH,kHAAkH;0BAClH,gEAAgE;0BAChE,IAAI,QAAQ,CAAC,UAAU,6FAA6F;0BACpH,kHAAkH;0BAClH,0BAA0B,WAAW,IAAI,EAC3C;wBACE,WAAW;wBACX,WAAW,EAAE,QAAQ,CAAC,GAAG;wBACzB,UAAU,EAAE,QAAQ,CAAC,UAAU;wBAC/B,SAAS;wBACT,OAAO,EAAE,WAAW,CAAC,OAAO;qBAC7B,CACF,CAAC;oBACF,SAAS;gBACX,CAAC;gBAED,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,SAAS;gBACT,uEAAuE;gBACvE,uEAAuE;gBACvE,2CAA2C;gBAC3C,+DAA+D;gBAC/D,sEAAsE;gBACtE,sEAAsE;gBACtE,uEAAuE;gBACvE,wEAAwE;gBACxE,mCAAmC;gBACnC,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,EACzC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,KAAmB,EAAE,EAAE;oBAC3E,MAAM,IAAI,CAAC,oBAAoB,CAAC,WAAW,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;gBACnE,CAAC,CAAC,CACH,CAAC;gBAEF,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAC1C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qCAAqC,SAAS,EAAE,CAAC,CAAC;YACrE,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACK,0BAA0B,CAChC,WAAmB,EACnB,QAAuB,EACvB,SAAiB;QAEjB,MAAM,OAAO,GAAoC,EAAE,CAAC;QAEpD,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACtD,OAAO,CAAC,IAAI,CAAC,6BAA6B,CAAC,qBAAqB,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,UAAU,CAAC,WAAW,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAChE,OAAO,CAAC,IAAI,CAAC,6BAA6B,CAAC,mBAAmB,CAAC,CAAC;QAClE,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,CAAC,GAAG,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;IACzG,CAAC;IAED,+DAA+D;IAC/D,UAAU;IACV,+DAA+D;IAEvD,KAAK,CAAC,oBAAoB,CAChC,WAAmB,EACnB,QAAuB,EACvB,GAAY,EACZ,GAAa;QAEb,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;YACnE,OAAO;QACT,CAAC;QAED,+DAA+D;QAC/D,uEAAuE;QACvE,2EAA2E;QAC3E,0EAA0E;QAC1E,yEAAyE;QACzE,yEAAyE;QACzE,oDAAoD;QACpD,mEAAmE;QACnE,8EAA8E;QAC9E,4EAA4E;QAC5E,6EAA6E;QAC7E,0EAA0E;QAC1E,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC;YAC1C,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;YAC/B,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;gBACzB,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAC5B,CAAC,CAAC,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ;oBAC5B,CAAC,CAAC,GAAG,CAAC,IAAI;oBACV,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAEjC,IAAI,MAAM,GAA+E,IAAI,CAAC;QAC9F,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC;gBAChD,WAAW;gBACX,WAAW,EAAE,QAAQ,CAAC,GAAG;gBACzB,QAAQ;gBACR,OAAO;gBACP,OAAO,EAAE,GAAG,CAAC,OAAiC;aAC/C,CAAC,CAAC;YAEH,0EAA0E;YAC1E,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;gBACzC,OAAO;YACT,CAAC;YAED,kCAAkC;YAClC,EAAE;YACF,0EAA0E;YAC1E,4EAA4E;YAC5E,4EAA4E;YAC5E,2EAA2E;YAC3E,oEAAoE;YACpE,uDAAuD;YACvD,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YACjE,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;YACzE,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,KAAK,CAAC,6BAA6B,QAAQ,CAAC,UAAU,OAAO,WAAW,IAAI,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;YACxG,CAAC;YAED,MAAM,IAAI,CAAC,cAAc,CAAC,oBAAoB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;YACtE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,YAAY,GAAI,KAAe,CAAC,OAAO,IAAI,eAAe,CAAC;YACjE,MAAM,SAAS,GAAI,KAAa,EAAE,SAAS,CAAC;YAE5C,0BAA0B;YAC1B,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;gBAClC,IAAI,CAAC,QAAQ,CAAC,uCAAuC,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;gBACnG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;gBACrD,OAAO;YACT,CAAC;YAED,kDAAkD;YAClD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE;gBAC7C,WAAW;gBACX,WAAW,EAAE,QAAQ,CAAC,GAAG;gBACzB,KAAK,EAAE,YAAY;aACpB,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,cAAc,CAAC,mBAAmB,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;YACtE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;CACF,CAAA;AA3aY,mCAAmC;IAD/C,UAAU,EAAE;IAkCR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;IACzD,WAAA,MAAM,CAAC,kBAAkB,CAAC,gCAAgC,CAAC,CAAA;;GArCnD,mCAAmC,CA2a/C","sourcesContent":["/**\n * Webhook Auto-Controller Backend Service\n *\n * Auto-registers webhook routes from provider registry definitions.\n * At startup, iterates all providers with WEBHOOK_ORIGINATOR protocol,\n * then iterates each provider's endpoints, and registers:\n *   POST /webhooks/{providerRef}/{endpointKey}\n *\n * One provider declares the protocol today, and it declares one endpoint:\n *   POST /webhooks/stripe/billing\n *\n * A second provider registers here the moment it declares `WEBHOOK_ORIGINATOR` with its own\n * `endpoints`; no edit to this controller is needed.\n *\n * This replaces manual per-provider webhook controllers (like BillingWebhookControllerBackendService).\n *\n * @see hook-protocol-webhook-callback.md\n */\n\nimport { injectable, inject } from 'inversify';\nimport express from 'express';\nimport type { Request, Response, NextFunction } from 'express';\nimport {\n  ExternalProvider_ExchangeProtocol_Kind,\n  type Hook_Endpoint,\n  type WebhookCapabilityHandler,\n} from '@wildo-ai/external-connectors-models';\nimport { HttpMethod } from '@wildo-ai/saas-models';\n\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport type { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport type { ErrorHandlerService } from '~wildo-backend-lib/errors/services/error-handler.backend.service';\nimport type { BackendProviderRegistryBackendService } from '~wildo-backend-lib/external-providers/services/backend-provider-registry.backend.service';\nimport type { ExternalProvidersRegistryBackendService } from '~wildo-backend-lib/external-providers/services/external-providers-registry.backend.service';\nimport { AbstractControllerBackendService } from '~wildo-backend-lib/base-classes/services/controllers/abstract-controller.backend.service';\nimport type { WebhookHandlerBackendService } from '~wildo-backend-lib/notifications/webhooks/services/webhook-handler.backend.service';\n\n/**\n * Why a declared webhook endpoint did NOT get an Express route.\n *\n * A closed vocabulary rather than a free string: each member names a DIFFERENT\n * missing registration, with a different remedy, and an operator reading the\n * startup log has to be able to tell them apart. The two are independent — an\n * endpoint can be missing either, or both.\n */\nexport enum WebhookRouteWithholdingReason {\n  /**\n   * No {@link WebhookCapabilityHandler} is registered for the endpoint's\n   * `capability`. The route would reach `handleWebhookRequest`, complete\n   * signature verification and idempotency claiming, then fail at dispatch.\n   */\n  NO_CAPABILITY_HANDLER = 'NO_CAPABILITY_HANDLER',\n  /**\n   * No `WebhookCapabilityAdapter` is registered for `providerRef:endpointKey`\n   * on {@link WebhookHandlerBackendService}. The route would fail at the very\n   * top of `processWebhook`, before signature verification.\n   */\n  NO_ENDPOINT_ADAPTER = 'NO_ENDPOINT_ADAPTER',\n}\n\n/** One declared endpoint whose route was deliberately not mounted, and why. */\nexport interface WebhookRouteWithholding {\n  providerRef: string;\n  endpointKey: string;\n  capability: string;\n  routePath: string;\n  reasons: WebhookRouteWithholdingReason[];\n}\n\n@injectable()\nexport class WebhookAutoControllerBackendService extends AbstractControllerBackendService {\n\n  /** Capability handlers keyed by capability string (e.g., 'billing') */\n  private capabilityHandlers = new Map<string, WebhookCapabilityHandler>();\n\n  private webhookHandler: WebhookHandlerBackendService | null = null;\n\n  /**\n   * Pre-loaded endpoint configurations per provider.\n   * Populated during initialize() from first-class provider runtime contracts.\n   * setupRoutes() reads from this cache (sync) to register routes.\n   */\n  private loadedEndpoints = new Map<string, Hook_Endpoint[]>();\n\n  /** Route paths recorded only after Express accepted their registration. */\n  private registeredRoutePaths: string[] = [];\n\n  /**\n   * Declared endpoints whose route was WITHHELD because the capability could\n   * not be dispatched. Kept so the decision is inspectable after startup rather\n   * than only visible in a log line that has already scrolled past.\n   */\n  private withheldRoutes: WebhookRouteWithholding[] = [];\n\n  /**\n   * Set once {@link registerWebhookRoutes} has run. The mount decision is taken\n   * ONCE, from the registration state at that instant, so anything registered\n   * afterwards cannot change which routes exist — see\n   * {@link registerCapabilityHandler}, which refuses to let that be silent.\n   */\n  private routesRegistered = false;\n\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Logger) logger: LoggerService,\n    @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) errorBuilder: ErrorBuilderBackendService,\n    @inject(SAAS_SERVICE_TYPES.ErrorHandlerService) errorHandler: ErrorHandlerService,\n    @inject(SAAS_SERVICE_TYPES.BackendProviderRegistryService) private readonly backendProviderRegistry: BackendProviderRegistryBackendService,\n    @inject(SAAS_SERVICE_TYPES.ExternalProvidersRegistryService) private readonly externalProvidersRegistry: ExternalProvidersRegistryBackendService,\n  ) {\n    super(logger, errorBuilder, errorHandler, 'WebhookAutoController');\n  }\n\n  // ════════════════════════════════════════════════════════════\n  // Initialization\n  // ════════════════════════════════════════════════════════════\n\n  /**\n   * Initialize with required dependencies, pre-load endpoint configs, AND\n   * register the webhook routes.\n   *\n   * ── Why routes are registered HERE, not in `setupRoutes()` ──────────────\n   *\n   * `AbstractControllerBackendService` calls the abstract `setupRoutes()` hook\n   * synchronously from *inside its own constructor* (`super(...)`). At that\n   * point this controller has NOTHING to register:\n   *\n   *   1. The webhook handler is not injected via the constructor — it is\n   *      supplied to `initialize()` by `start-application` after the billing /\n   *      provider layers are wired.\n   *   2. The route SET is data-dependent (one route per provider webhook\n   *      endpoint), and those endpoint contracts are only knowable after the\n   *      provider registries have been initialized (which happens later in the\n   *      startup sequence than DI construction).\n   *\n   * So `setupRoutes()` is a deliberate no-op (see its JSDoc) and the real,\n   * data-dependent route registration runs here — the same lifecycle shape\n   * `ControllerResourceBackendService` uses for its per-resource routes.\n   *\n   * `start-application` calls this BEFORE the controllers registry mounts the\n   * router (via `getRouter()`), so the routes added here are present when the\n   * master router mounts this controller's router by reference. Errors thrown\n   * from webhook handlers propagate to the app-level error middleware\n   * (`HttpServerBackendService`), so no router-scoped error handler is needed\n   * after these routes.\n   */\n  public async initialize(\n    webhookHandler: WebhookHandlerBackendService,\n  ): Promise<void> {\n    this.webhookHandler = webhookHandler;\n\n    for (const provider of this.backendProviderRegistry.getProvidersWithProtocol(ExternalProvider_ExchangeProtocol_Kind.WEBHOOK_ORIGINATOR)) {\n      const providerRef = provider.metadata.ref;\n      try {\n        if (\n          !this.externalProvidersRegistry.isProviderEnabled(\n            providerRef,\n            ExternalProvider_ExchangeProtocol_Kind.WEBHOOK_ORIGINATOR,\n          )\n        ) {\n          continue;\n        }\n\n        const config = this.externalProvidersRegistry.getProviderConfiguration(\n          providerRef,\n          ExternalProvider_ExchangeProtocol_Kind.WEBHOOK_ORIGINATOR,\n        );\n        // `config.endpoints` is `ReadonlyArray<Hook_Endpoint>` post the\n        // 2026-05-06 webhook endpoint reshape: `Hook_Endpoint.displayName`\n        // is now optional (matches the runtime emission) and the dead\n        // extras (`providerRef` / `path` / `secretBinding`) were dropped\n        // from `buildWebhookEndpoints`. The local cache is a\n        // `Map<string, Hook_Endpoint[]>`, so we materialize a mutable\n        // copy here — the cache was historically `Hook_Endpoint[]`\n        // (mutable); preserving that semantics avoids touching every\n        // downstream signature.\n        const endpoints: Hook_Endpoint[] = [...(config?.endpoints ?? [])];\n        if (endpoints.length > 0) {\n          this.loadedEndpoints.set(providerRef, endpoints);\n          this.logDebug(`Pre-loaded ${endpoints.length} webhook endpoint(s) for ${providerRef}`);\n        } else {\n          // Genuine contract fault (not the expected \"no webhook providers\"\n          // case): the provider is ENABLED for WEBHOOK_ORIGINATOR yet exposes\n          // zero endpoints, so it will silently never receive inbound webhooks\n          // (e.g. Stripe would 404 on /webhooks/stripe/billing). Surface it\n          // once, clearly — this is a mis-sequence, not steady-state noise.\n          this.logger.warn(\n            `WebhookAutoController: provider '${providerRef}' is enabled for WEBHOOK_ORIGINATOR but exposes no endpoints — no routes will be registered for it`,\n          );\n        }\n      } catch (error) {\n        this.logger.warn(`Failed to pre-load webhook protocol for ${providerRef}`, {\n          error: (error as Error).message,\n        });\n      }\n    }\n\n    this.logDebug(`Webhook auto-controller initialized with ${this.loadedEndpoints.size} provider(s)`);\n\n    // Register the routes now that the handler + endpoint contracts are known.\n    this.registerWebhookRoutes();\n  }\n\n  /**\n   * Register a capability handler for dispatching processed events.\n   * Called at startup by capability modules (e.g., billing module).\n   *\n   * MUST be called before {@link initialize}. `start-application` satisfies this\n   * ordering today — step 4.5 initializes capability modules (which register\n   * here) and step 4.6 initializes this controller — and the guard below exists\n   * so a future step inserted the other way round is LOUD instead of silent.\n   *\n   * The failure it catches is genuinely confusing without it: a late-registered\n   * handler works perfectly at request time (the map is read per request), but\n   * the route it would serve was already withheld at mount time, so the endpoint\n   * answers 404 while a handler for it demonstrably exists.\n   */\n  registerCapabilityHandler(handler: WebhookCapabilityHandler): void {\n    this.capabilityHandlers.set(handler.capability, handler);\n\n    if (this.routesRegistered) {\n      this.logger.error(\n        `WebhookAutoController: capability handler for '${handler.capability}' was registered AFTER webhook routes were mounted. `\n        + 'Route mounting is decided once, from the registrations present at that moment, so this handler cannot bring back any route '\n        + 'that was withheld for a missing handler — those endpoints will keep answering 404. '\n        + 'Register capability handlers before WebhookAutoControllerBackendService.initialize() runs.',\n        {\n          capability: handler.capability,\n          withheldRoutes: this.withheldRoutes.map((withholding) => withholding.routePath),\n        },\n      );\n      return;\n    }\n\n    this.logDebug(`Registered webhook capability handler for ${handler.capability}`);\n  }\n\n  /**\n   * Return the sanitized inbound-provider routes that this controller actually\n   * registered. Provider configuration, signature material, endpoint payloads,\n   * and handler metadata are intentionally absent.\n   */\n  public getRegisteredWebhookRoutePaths(): ReadonlyArray<string> {\n    return [...this.registeredRoutePaths];\n  }\n\n  /**\n   * Return the declared endpoints whose route was deliberately NOT mounted,\n   * with the reason. Carries no provider configuration or signature material —\n   * only the route identity and which registration was missing.\n   */\n  public getWithheldWebhookRoutes(): ReadonlyArray<WebhookRouteWithholding> {\n    return this.withheldRoutes.map((withholding) => ({ ...withholding, reasons: [...withholding.reasons] }));\n  }\n\n  // ════════════════════════════════════════════════════════════\n  // Routes\n  // ════════════════════════════════════════════════════════════\n\n  /**\n   * Required by `AbstractControllerBackendService`, which invokes this hook\n   * synchronously from its constructor (`super(...)`). This controller\n   * intentionally registers NOTHING here: its route set is data-dependent\n   * (one route per provider webhook endpoint) and neither the webhook handler\n   * nor the provider endpoint contracts exist at construction time. The real\n   * registration happens in `initialize()` / `registerWebhookRoutes()` once\n   * that data is available — see `initialize()`'s JSDoc for the full rationale.\n   */\n  protected setupRoutes(): void {\n    // No-op by design — see JSDoc above and `registerWebhookRoutes()`.\n  }\n\n  /**\n   * Register one Express route per pre-loaded provider webhook endpoint —\n   * EXCEPT those whose capability cannot actually be dispatched.\n   *\n   * Invoked from `initialize()` after `webhookHandler` and `loadedEndpoints`\n   * have been populated. Idempotent-safe against an empty cache; guards on the\n   * handler so a mis-sequenced call fails visibly rather than registering dead\n   * routes.\n   *\n   * ── Why an undispatchable endpoint is WITHHELD rather than mounted ────────\n   *\n   * A declared endpoint needs two registrations that this controller does not\n   * own and cannot create: a `WebhookCapabilityAdapter` (verify + parse, on\n   * `WebhookHandlerBackendService`) and a `WebhookCapabilityHandler` (dispatch,\n   * here). Both are supplied by the capability module — for `billing`, inside\n   * `start-application.initializeBillingServices`, which is deliberately\n   * NON-FATAL: if it throws part-way, or if `billing.enabled` is false while the\n   * provider is still enabled for `WEBHOOK_ORIGINATOR`, the application boots\n   * with the provider's endpoint declared and neither registration present.\n   *\n   * Mounting a route in that state produces a 500 on every inbound delivery\n   * (`No webhook adapter registered for ...`, or `No capability handler for ...`\n   * below), and a 500 is precisely the answer that tells a vendor to RETRY — an\n   * instruction that can never be satisfied, because no retry supplies a missing\n   * startup registration. The endpoint therefore absorbs the vendor's full retry\n   * schedule and eventually gets disabled on the vendor's side, while the only\n   * local signal is a repeating error log.\n   *\n   * Not mounting says the true thing instead: this endpoint does not exist. The\n   * vendor gets a 404 rather than a retry instruction, and the operator gets one\n   * loud, remedy-naming error at startup — the moment the misconfiguration was\n   * actually introduced.\n   *\n   * REJECTED — refusing at BOOT (throwing from here). It is the shape the rest of\n   * the registry uses, and it is wrong at this site for three reasons. (1) It\n   * would not even be loud: `start-application.initializeWebhookAutoController`\n   * wraps `initialize()` in a non-fatal catch that downgrades a throw to a warn,\n   * so the net effect would be a quieter log AND the loss of every OTHER\n   * provider's working route. (2) It inverts a decision the engine already took\n   * explicitly — billing initialization failure is documented as survivable\n   * (\"the app can still run without billing\"); a failed optional subsystem must\n   * not become a refusal to start. (3) `billing.enabled: false` beside a\n   * registered Stripe provider is a COHERENT configuration, and refusing to boot\n   * over it would be a false alarm. The check is per-endpoint, so a capability\n   * that is wired keeps its route regardless of a sibling that is not.\n   */\n  private registerWebhookRoutes(): void {\n    this.routesRegistered = true;\n\n    if (!this.webhookHandler) {\n      this.logger.warn('WebhookAutoController: initialize() ran without a webhook handler — no routes registered');\n      return;\n    }\n\n    if (this.loadedEndpoints.size === 0) {\n      this.logDebug('No webhook endpoints pre-loaded — no routes registered');\n      return;\n    }\n\n    for (const [providerRef, endpoints] of this.loadedEndpoints) {\n      for (const endpoint of endpoints) {\n        const routePath = `/webhooks/${providerRef}/${endpoint.key}`;\n\n        const withholding = this.assessRouteDispatchability(providerRef, endpoint, routePath);\n        if (withholding) {\n          this.withheldRoutes.push(withholding);\n          this.logger.error(\n            `WebhookAutoController: NOT registering POST ${routePath} — the endpoint is declared but cannot be dispatched `\n            + `(${withholding.reasons.join(', ')}). A route mounted in this state can only ever answer 500, which instructs the `\n            + 'vendor to retry an inbound event that no retry can make processable. Withholding the route so the vendor gets a '\n            + '404 instead. Remedy: register the capability module that owns '\n            + `'${endpoint.capability}' before WebhookAutoControllerBackendService.initialize() runs (for billing, check whether `\n            + 'billing initialization was skipped or failed non-fatally earlier in startup), or disable the WEBHOOK_ORIGINATOR '\n            + `protocol for provider '${providerRef}'.`,\n            {\n              providerRef,\n              endpointKey: endpoint.key,\n              capability: endpoint.capability,\n              routePath,\n              reasons: withholding.reasons,\n            },\n          );\n          continue;\n        }\n\n        this.router.post(\n          routePath,\n          // Defense-in-depth for a future streaming mount. If this controller is\n          // ever assigned the RAW_REQUEST_STREAM mount phase, this express.raw()\n          // makes req.body the raw Buffer. Under the\n          // current master-router mount it is an inert no-op: the global\n          // express.json (HttpServerBackendService.setupBodyParsing) parses the\n          // body first and sets req._body, so the signature-faithful bytes come\n          // from req.rawBody — captured by that same express.json `verify` hook.\n          // handleWebhookRequest reads rawBody first, then falls back to a Buffer\n          // req.body for the streaming case.\n          express.raw({ type: 'application/json' }),\n          this.asyncHandler(async (req: Request, res: Response, _next: NextFunction) => {\n            await this.handleWebhookRequest(providerRef, endpoint, req, res);\n          }),\n        );\n\n        this.registeredRoutePaths.push(routePath);\n        this.logger.info(`Webhook endpoint registered: POST ${routePath}`);\n      }\n    }\n  }\n\n  /**\n   * Decide whether a declared endpoint can actually be served, and if not, say\n   * which registration is missing.\n   *\n   * Returns `null` when the route is dispatchable. Both prerequisites are\n   * evaluated (rather than short-circuiting on the first) so an operator gets\n   * the WHOLE remedy in one log line instead of fixing one registration and\n   * meeting the next on the following restart.\n   */\n  private assessRouteDispatchability(\n    providerRef: string,\n    endpoint: Hook_Endpoint,\n    routePath: string,\n  ): WebhookRouteWithholding | null {\n    const reasons: WebhookRouteWithholdingReason[] = [];\n\n    if (!this.capabilityHandlers.has(endpoint.capability)) {\n      reasons.push(WebhookRouteWithholdingReason.NO_CAPABILITY_HANDLER);\n    }\n    if (!this.webhookHandler?.hasAdapter(providerRef, endpoint.key)) {\n      reasons.push(WebhookRouteWithholdingReason.NO_ENDPOINT_ADAPTER);\n    }\n\n    if (reasons.length === 0) {\n      return null;\n    }\n    return { providerRef, endpointKey: endpoint.key, capability: endpoint.capability, routePath, reasons };\n  }\n\n  // ════════════════════════════════════════════════════════════\n  // Handler\n  // ════════════════════════════════════════════════════════════\n\n  private async handleWebhookRequest(\n    providerRef: string,\n    endpoint: Hook_Endpoint,\n    req: Request,\n    res: Response,\n  ): Promise<void> {\n    if (!this.webhookHandler) {\n      res.status(503).json({ error: 'Webhook handler not initialized' });\n      return;\n    }\n\n    // Raw request bytes for signature verification. Order matters:\n    //   1. req.rawBody — captured by the global express.json `verify` hook\n    //      (HttpServerBackendService.setupBodyParsing). This is the provider's\n    //      EXACT original payload and the ONLY byte-faithful source under the\n    //      current master-router mount, where global express.json parses the\n    //      body before this route runs (making the per-route express.raw() a\n    //      no-op, so req.body is a parsed object here).\n    //   2. Buffer req.body — only populated if this controller is ever\n    //      streaming-mounted before body parsing (per-route express.raw() fires).\n    //   3. string / JSON.stringify — last-resort fallbacks; JSON.stringify will\n    //      NOT byte-match the provider (key ordering / whitespace), so it exists\n    //      only to avoid a crash, never as a correctness path for signatures.\n    const rawBody = Buffer.isBuffer(req.rawBody)\n      ? req.rawBody.toString('utf-8')\n      : Buffer.isBuffer(req.body)\n        ? req.body.toString('utf-8')\n        : typeof req.body === 'string'\n          ? req.body\n          : JSON.stringify(req.body);\n\n    let result: Awaited<ReturnType<WebhookHandlerBackendService['processWebhook']>> | null = null;\n    try {\n      result = await this.webhookHandler.processWebhook({\n        providerRef,\n        endpointKey: endpoint.key,\n        endpoint,\n        rawBody,\n        headers: req.headers as Record<string, string>,\n      });\n\n      // null = idempotent duplicate or unparseable event — already acknowledged\n      if (!result) {\n        res.status(200).json({ received: true });\n        return;\n      }\n\n      // Dispatch to capability handler.\n      //\n      // Defence in depth only: `registerWebhookRoutes` refuses to MOUNT a route\n      // whose capability has no handler, so this branch is unreachable while that\n      // gate holds — reaching it means the handler map was mutated after mounting\n      // (which `registerCapabilityHandler` refuses to do silently). The throw is\n      // kept rather than removed because the alternative — dispatching to\n      // `undefined` — would 500 anyway, with no explanation.\n      const handler = this.capabilityHandlers.get(endpoint.capability);\n      if (handler) {\n        await handler.handleEvent(result.executionContext, result.parsedEvent);\n      } else {\n        throw new Error(`No capability handler for ${endpoint.capability} on ${providerRef}/${endpoint.key}`);\n      }\n\n      await this.webhookHandler.markWebhookProcessed(result.idempotencyKey);\n      res.status(200).json({ received: true });\n    } catch (error) {\n      const errorMessage = (error as Error).message ?? 'Unknown error';\n      const errorType = (error as any)?.errorType;\n\n      // Signature failure → 401\n      if (errorType === 'AUTHORIZATION') {\n        this.logDebug('Webhook signature verification failed', { providerRef, endpointKey: endpoint.key });\n        res.status(401).json({ error: 'Invalid signature' });\n        return;\n      }\n\n      // All other errors → 500 (trigger provider retry)\n      this.logger.error('Webhook processing failed', {\n        providerRef,\n        endpointKey: endpoint.key,\n        error: errorMessage,\n      });\n      await this.webhookHandler.releaseWebhookClaim(result?.idempotencyKey);\n      res.status(500).json({ error: 'Processing failed' });\n    }\n  }\n}\n"]}
+{"version":3,"file":"webhook-auto-controller.backend.service.js","sourceRoot":"","sources":["../../../../../src/notifications/webhooks/controllers/webhook-auto-controller.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;;;;;;;;;;;;;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,EACL,sCAAsC,GAGvC,MAAM,sCAAsC,CAAC;AAG9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAMpF,OAAO,EAAE,gCAAgC,EAAE,MAAM,0FAA0F,CAAC;AAG5I;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,6BAaX;AAbD,WAAY,6BAA6B;IACvC;;;;OAIG;IACH,gFAA+C,CAAA;IAC/C;;;;OAIG;IACH,4EAA2C,CAAA;AAC7C,CAAC,EAbW,6BAA6B,KAA7B,6BAA6B,QAaxC;AAYM,IAAM,mCAAmC,GAAzC,MAAM,mCAAoC,SAAQ,gCAAgC;IAoCT;IACE;IAnChF,uEAAuE;IAC/D,kBAAkB,GAAG,IAAI,GAAG,EAAoC,CAAC;IAEjE,cAAc,GAAwC,IAAI,CAAC;IAEnE;;;;OAIG;IACK,eAAe,GAAG,IAAI,GAAG,EAA2B,CAAC;IAE7D,2EAA2E;IACnE,oBAAoB,GAAa,EAAE,CAAC;IAE5C;;;;OAIG;IACK,cAAc,GAA8B,EAAE,CAAC;IAEvD;;;;;OAKG;IACK,gBAAgB,GAAG,KAAK,CAAC;IAEjC,YACqC,MAAqB,EACR,YAAwC,EACxC,YAAiC,EACL,uBAA8D,EAC5D,yBAAkE;QAEhJ,KAAK,CAAC,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,uBAAuB,CAAC,CAAC;QAHS,4BAAuB,GAAvB,uBAAuB,CAAuC;QAC5D,8BAAyB,GAAzB,yBAAyB,CAAyC;IAGlJ,CAAC;IAED,+DAA+D;IAC/D,iBAAiB;IACjB,+DAA+D;IAE/D;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACI,KAAK,CAAC,UAAU,CACrB,cAA4C;QAE5C,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QAErC,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,uBAAuB,CAAC,wBAAwB,CAAC,sCAAsC,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACxI,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;YAC1C,IAAI,CAAC;gBACH,IACE,CAAC,IAAI,CAAC,yBAAyB,CAAC,iBAAiB,CAC/C,WAAW,EACX,sCAAsC,CAAC,kBAAkB,CAC1D,EACD,CAAC;oBACD,SAAS;gBACX,CAAC;gBAED,MAAM,MAAM,GAAG,IAAI,CAAC,yBAAyB,CAAC,wBAAwB,CACpE,WAAW,EACX,sCAAsC,CAAC,kBAAkB,CAC1D,CAAC;gBACF,gEAAgE;gBAChE,mEAAmE;gBACnE,8DAA8D;gBAC9D,iEAAiE;gBACjE,qDAAqD;gBACrD,8DAA8D;gBAC9D,2DAA2D;gBAC3D,6DAA6D;gBAC7D,wBAAwB;gBACxB,MAAM,SAAS,GAAoB,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;gBAClE,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACzB,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;oBACjD,IAAI,CAAC,QAAQ,CAAC,cAAc,SAAS,CAAC,MAAM,4BAA4B,WAAW,EAAE,CAAC,CAAC;gBACzF,CAAC;qBAAM,CAAC;oBACN,kEAAkE;oBAClE,oEAAoE;oBACpE,qEAAqE;oBACrE,kEAAkE;oBAClE,kEAAkE;oBAClE,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,oCAAoC,WAAW,oGAAoG,CACpJ,CAAC;gBACJ,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2CAA2C,WAAW,EAAE,EAAE;oBACzE,KAAK,EAAG,KAAe,CAAC,OAAO;iBAChC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,4CAA4C,IAAI,CAAC,eAAe,CAAC,IAAI,cAAc,CAAC,CAAC;QAEnG,2EAA2E;QAC3E,IAAI,CAAC,qBAAqB,EAAE,CAAC;IAC/B,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,yBAAyB,CAAC,OAAiC;QACzD,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAEzD,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,kDAAkD,OAAO,CAAC,UAAU,sDAAsD;kBACxH,6HAA6H;kBAC7H,qFAAqF;kBACrF,4FAA4F,EAC9F;gBACE,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,cAAc,EAAE,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC;aAChF,CACF,CAAC;YACF,OAAO;QACT,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,6CAA6C,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IACnF,CAAC;IAED;;;;OAIG;IACI,8BAA8B;QACnC,OAAO,CAAC,GAAG,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACxC,CAAC;IAED;;;;OAIG;IACI,wBAAwB;QAC7B,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,WAAW,EAAE,OAAO,EAAE,CAAC,GAAG,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3G,CAAC;IAED,+DAA+D;IAC/D,SAAS;IACT,+DAA+D;IAE/D;;;;;;;;OAQG;IACO,WAAW;QACnB,mEAAmE;IACrE,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6CG;IACK,qBAAqB;QAC3B,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;QAE7B,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0FAA0F,CAAC,CAAC;YAC7G,OAAO;QACT,CAAC;QAED,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACpC,IAAI,CAAC,QAAQ,CAAC,wDAAwD,CAAC,CAAC;YACxE,OAAO;QACT,CAAC;QAED,KAAK,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YAC5D,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;gBACjC,MAAM,SAAS,GAAG,aAAa,WAAW,IAAI,QAAQ,CAAC,GAAG,EAAE,CAAC;gBAE7D,MAAM,WAAW,GAAG,IAAI,CAAC,0BAA0B,CAAC,WAAW,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;gBACtF,IAAI,WAAW,EAAE,CAAC;oBAChB,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;oBACtC,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,+CAA+C,SAAS,uDAAuD;0BAC7G,IAAI,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,iFAAiF;0BACnH,kHAAkH;0BAClH,gEAAgE;0BAChE,IAAI,QAAQ,CAAC,UAAU,6FAA6F;0BACpH,kHAAkH;0BAClH,0BAA0B,WAAW,IAAI,EAC3C;wBACE,WAAW;wBACX,WAAW,EAAE,QAAQ,CAAC,GAAG;wBACzB,UAAU,EAAE,QAAQ,CAAC,UAAU;wBAC/B,SAAS;wBACT,OAAO,EAAE,WAAW,CAAC,OAAO;qBAC7B,CACF,CAAC;oBACF,SAAS;gBACX,CAAC;gBAED,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,SAAS;gBACT,uEAAuE;gBACvE,uEAAuE;gBACvE,2CAA2C;gBAC3C,+DAA+D;gBAC/D,sEAAsE;gBACtE,sEAAsE;gBACtE,uEAAuE;gBACvE,wEAAwE;gBACxE,mCAAmC;gBACnC,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,EACzC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,KAAmB,EAAE,EAAE;oBAC3E,MAAM,IAAI,CAAC,oBAAoB,CAAC,WAAW,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;gBACnE,CAAC,CAAC,CACH,CAAC;gBAEF,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAC1C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qCAAqC,SAAS,EAAE,CAAC,CAAC;YACrE,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACK,0BAA0B,CAChC,WAAmB,EACnB,QAAuB,EACvB,SAAiB;QAEjB,MAAM,OAAO,GAAoC,EAAE,CAAC;QAEpD,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACtD,OAAO,CAAC,IAAI,CAAC,6BAA6B,CAAC,qBAAqB,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,UAAU,CAAC,WAAW,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAChE,OAAO,CAAC,IAAI,CAAC,6BAA6B,CAAC,mBAAmB,CAAC,CAAC;QAClE,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,CAAC,GAAG,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;IACzG,CAAC;IAED,+DAA+D;IAC/D,UAAU;IACV,+DAA+D;IAEvD,KAAK,CAAC,oBAAoB,CAChC,WAAmB,EACnB,QAAuB,EACvB,GAAY,EACZ,GAAa;QAEb,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;YACnE,OAAO;QACT,CAAC;QAED,+DAA+D;QAC/D,uEAAuE;QACvE,2EAA2E;QAC3E,0EAA0E;QAC1E,yEAAyE;QACzE,yEAAyE;QACzE,oDAAoD;QACpD,mEAAmE;QACnE,8EAA8E;QAC9E,4EAA4E;QAC5E,6EAA6E;QAC7E,0EAA0E;QAC1E,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC;YAC1C,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;YAC/B,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;gBACzB,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAC5B,CAAC,CAAC,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ;oBAC5B,CAAC,CAAC,GAAG,CAAC,IAAI;oBACV,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAEjC,IAAI,MAAM,GAA+E,IAAI,CAAC;QAC9F,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC;gBAChD,WAAW;gBACX,WAAW,EAAE,QAAQ,CAAC,GAAG;gBACzB,QAAQ;gBACR,OAAO;gBACP,OAAO,EAAE,GAAG,CAAC,OAAiC;aAC/C,CAAC,CAAC;YAEH,0EAA0E;YAC1E,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;gBACzC,OAAO;YACT,CAAC;YAED,kCAAkC;YAClC,EAAE;YACF,0EAA0E;YAC1E,4EAA4E;YAC5E,4EAA4E;YAC5E,2EAA2E;YAC3E,oEAAoE;YACpE,uDAAuD;YACvD,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YACjE,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;YACzE,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,KAAK,CAAC,6BAA6B,QAAQ,CAAC,UAAU,OAAO,WAAW,IAAI,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;YACxG,CAAC;YAED,MAAM,IAAI,CAAC,cAAc,CAAC,oBAAoB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;YACtE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,YAAY,GAAI,KAAe,CAAC,OAAO,IAAI,eAAe,CAAC;YACjE,MAAM,SAAS,GAAI,KAAa,EAAE,SAAS,CAAC;YAE5C,0BAA0B;YAC1B,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;gBAClC,IAAI,CAAC,QAAQ,CAAC,uCAAuC,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;gBACnG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;gBACrD,OAAO;YACT,CAAC;YAED,kDAAkD;YAClD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE;gBAC7C,WAAW;gBACX,WAAW,EAAE,QAAQ,CAAC,GAAG;gBACzB,KAAK,EAAE,YAAY;aACpB,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,cAAc,CAAC,mBAAmB,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;YACtE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;CACF,CAAA;AA3aY,mCAAmC;IAD/C,UAAU,EAAE;IAkCR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;IACzD,WAAA,MAAM,CAAC,kBAAkB,CAAC,gCAAgC,CAAC,CAAA;;GArCnD,mCAAmC,CA2a/C","sourcesContent":["/**\n * Webhook Auto-Controller Backend Service\n *\n * Auto-registers webhook routes from provider registry definitions.\n * At startup, iterates all providers with WEBHOOK_ORIGINATOR protocol,\n * then iterates each provider's endpoints, and registers:\n *   POST /webhooks/{providerRef}/{endpointKey}\n *\n * One provider declares the protocol today, and it declares one endpoint:\n *   POST /webhooks/stripe/billing\n *\n * A second provider registers here the moment it declares `WEBHOOK_ORIGINATOR` with its own\n * `endpoints`; no edit to this controller is needed.\n *\n * This replaces manual per-provider webhook controllers (like BillingWebhookControllerBackendService).\n *\n * @see hook-protocol-webhook-callback.md\n */\n\nimport { injectable, inject } from 'inversify';\nimport express from 'express';\nimport type { Request, Response, NextFunction } from 'express';\nimport {\n  ExternalProvider_ExchangeProtocol_Kind,\n  type Hook_Endpoint,\n  type WebhookCapabilityHandler,\n} from '@wildo-ai/external-connectors-models';\nimport { HttpMethod } from '@wildo-ai/saas-models';\n\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport type { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport type { ErrorHandlerService } from '~wildo-backend-lib/errors/services/error-handler.backend.service';\nimport type { BackendProviderRegistryBackendService } from '~wildo-backend-lib/external-providers/services/backend-provider-registry.backend.service';\nimport type { ExternalProvidersRegistryBackendService } from '~wildo-backend-lib/external-providers/services/external-providers-registry.backend.service';\nimport { AbstractControllerBackendService } from '~wildo-backend-lib/base-classes/services/controllers/abstract-controller.backend.service';\nimport type { WebhookHandlerBackendService } from '~wildo-backend-lib/notifications/webhooks/services/webhook-handler.backend.service';\n\n/**\n * Why a declared webhook endpoint did NOT get an Express route.\n *\n * A closed vocabulary rather than a free string: each member names a DIFFERENT\n * missing registration, with a different remedy, and an operator reading the\n * startup log has to be able to tell them apart. The two are independent — an\n * endpoint can be missing either, or both.\n */\nexport enum WebhookRouteWithholdingReason {\n  /**\n   * No {@link WebhookCapabilityHandler} is registered for the endpoint's\n   * `capability`. The route would reach `handleWebhookRequest`, complete\n   * signature verification and idempotency claiming, then fail at dispatch.\n   */\n  NO_CAPABILITY_HANDLER = 'NO_CAPABILITY_HANDLER',\n  /**\n   * No `WebhookCapabilityAdapter` is registered for `providerRef:endpointKey`\n   * on {@link WebhookHandlerBackendService}. The route would fail at the very\n   * top of `processWebhook`, before signature verification.\n   */\n  NO_ENDPOINT_ADAPTER = 'NO_ENDPOINT_ADAPTER',\n}\n\n/** One declared endpoint whose route was deliberately not mounted, and why. */\nexport interface WebhookRouteWithholding {\n  providerRef: string;\n  endpointKey: string;\n  capability: string;\n  routePath: string;\n  reasons: WebhookRouteWithholdingReason[];\n}\n\n@injectable()\nexport class WebhookAutoControllerBackendService extends AbstractControllerBackendService {\n\n  /** Capability handlers keyed by capability string (e.g., 'billing') */\n  private capabilityHandlers = new Map<string, WebhookCapabilityHandler>();\n\n  private webhookHandler: WebhookHandlerBackendService | null = null;\n\n  /**\n   * Pre-loaded endpoint configurations per provider.\n   * Populated during initialize() from first-class provider runtime contracts.\n   * setupRoutes() reads from this cache (sync) to register routes.\n   */\n  private loadedEndpoints = new Map<string, Hook_Endpoint[]>();\n\n  /** Route paths recorded only after Express accepted their registration. */\n  private registeredRoutePaths: string[] = [];\n\n  /**\n   * Declared endpoints whose route was WITHHELD because the capability could\n   * not be dispatched. Kept so the decision is inspectable after startup rather\n   * than only visible in a log line that has already scrolled past.\n   */\n  private withheldRoutes: WebhookRouteWithholding[] = [];\n\n  /**\n   * Set once {@link registerWebhookRoutes} has run. The mount decision is taken\n   * ONCE, from the registration state at that instant, so anything registered\n   * afterwards cannot change which routes exist — see\n   * {@link registerCapabilityHandler}, which refuses to let that be silent.\n   */\n  private routesRegistered = false;\n\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Logger) logger: LoggerService,\n    @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) errorBuilder: ErrorBuilderBackendService,\n    @inject(SAAS_SERVICE_TYPES.ErrorHandlerService) errorHandler: ErrorHandlerService,\n    @inject(SAAS_SERVICE_TYPES.BackendProviderRegistryService) private readonly backendProviderRegistry: BackendProviderRegistryBackendService,\n    @inject(SAAS_SERVICE_TYPES.ExternalProvidersRegistryService) private readonly externalProvidersRegistry: ExternalProvidersRegistryBackendService,\n  ) {\n    super(logger, errorBuilder, errorHandler, 'WebhookAutoController');\n  }\n\n  // ════════════════════════════════════════════════════════════\n  // Initialization\n  // ════════════════════════════════════════════════════════════\n\n  /**\n   * Initialize with required dependencies, pre-load endpoint configs, AND\n   * register the webhook routes.\n   *\n   * ── Why routes are registered HERE, not in `setupRoutes()` ──────────────\n   *\n   * `AbstractControllerBackendService` calls the abstract `setupRoutes()` hook\n   * synchronously from *inside its own constructor* (`super(...)`). At that\n   * point this controller has NOTHING to register:\n   *\n   *   1. The webhook handler is not injected via the constructor — it is\n   *      supplied to `initialize()` by `start-application` after the billing /\n   *      provider layers are wired.\n   *   2. The route SET is data-dependent (one route per provider webhook\n   *      endpoint), and those endpoint contracts are only knowable after the\n   *      provider registries have been initialized (which happens later in the\n   *      startup sequence than DI construction).\n   *\n   * So `setupRoutes()` is a deliberate no-op (see its JSDoc) and the real,\n   * data-dependent route registration runs here — the same lifecycle shape\n   * `ControllerResourceBackendService` uses for its per-resource routes.\n   *\n   * `start-application` calls this BEFORE the controllers registry mounts the\n   * router (via `getRouter()`), so the routes added here are present when the\n   * master router mounts this controller's router by reference. Errors thrown\n   * from webhook handlers propagate to the app-level error middleware\n   * (`HttpServerBackendService`), so no router-scoped error handler is needed\n   * after these routes.\n   */\n  public async initialize(\n    webhookHandler: WebhookHandlerBackendService,\n  ): Promise<void> {\n    this.webhookHandler = webhookHandler;\n\n    for (const provider of this.backendProviderRegistry.getProvidersWithProtocol(ExternalProvider_ExchangeProtocol_Kind.WEBHOOK_ORIGINATOR)) {\n      const providerRef = provider.metadata.ref;\n      try {\n        if (\n          !this.externalProvidersRegistry.isProviderEnabled(\n            providerRef,\n            ExternalProvider_ExchangeProtocol_Kind.WEBHOOK_ORIGINATOR,\n          )\n        ) {\n          continue;\n        }\n\n        const config = this.externalProvidersRegistry.getProviderConfiguration(\n          providerRef,\n          ExternalProvider_ExchangeProtocol_Kind.WEBHOOK_ORIGINATOR,\n        );\n        // `config.endpoints` is `ReadonlyArray<Hook_Endpoint>` post the\n        // 2026-05-06 webhook endpoint reshape: `Hook_Endpoint.displayName`\n        // is now optional (matches the runtime emission) and the dead\n        // extras (`providerRef` / `path` / `secretBinding`) were dropped\n        // from `buildWebhookEndpoints`. The local cache is a\n        // `Map<string, Hook_Endpoint[]>`, so we materialize a mutable\n        // copy here — the cache was historically `Hook_Endpoint[]`\n        // (mutable); preserving that semantics avoids touching every\n        // downstream signature.\n        const endpoints: Hook_Endpoint[] = [...(config?.endpoints ?? [])];\n        if (endpoints.length > 0) {\n          this.loadedEndpoints.set(providerRef, endpoints);\n          this.logDebug(`Pre-loaded ${endpoints.length} webhook endpoint(s) for ${providerRef}`);\n        } else {\n          // Genuine contract fault (not the expected \"no webhook providers\"\n          // case): the provider is ENABLED for WEBHOOK_ORIGINATOR yet exposes\n          // zero endpoints, so it will silently never receive inbound webhooks\n          // (e.g. Stripe would 404 on /webhooks/stripe/billing). Surface it\n          // once, clearly — this is a mis-sequence, not steady-state noise.\n          this.logger.warn(\n            `WebhookAutoController: provider '${providerRef}' is enabled for WEBHOOK_ORIGINATOR but exposes no endpoints — no routes will be registered for it`,\n          );\n        }\n      } catch (error) {\n        this.logger.warn(`Failed to pre-load webhook protocol for ${providerRef}`, {\n          error: (error as Error).message,\n        });\n      }\n    }\n\n    this.logDebug(`Webhook auto-controller initialized with ${this.loadedEndpoints.size} provider(s)`);\n\n    // Register the routes now that the handler + endpoint contracts are known.\n    this.registerWebhookRoutes();\n  }\n\n  /**\n   * Register a capability handler for dispatching processed events.\n   * Called at startup by capability modules (e.g., billing module).\n   *\n   * MUST be called before {@link initialize}. `start-application` satisfies this\n   * ordering today — step 4.5 initializes capability modules (which register\n   * here) and step 4.6 initializes this controller — and the guard below exists\n   * so a future step inserted the other way round is LOUD instead of silent.\n   *\n   * The failure it catches is genuinely confusing without it: a late-registered\n   * handler works perfectly at request time (the map is read per request), but\n   * the route it would serve was already withheld at mount time, so the endpoint\n   * answers 404 while a handler for it demonstrably exists.\n   */\n  registerCapabilityHandler(handler: WebhookCapabilityHandler): void {\n    this.capabilityHandlers.set(handler.capability, handler);\n\n    if (this.routesRegistered) {\n      this.logger.error(\n        `WebhookAutoController: capability handler for '${handler.capability}' was registered AFTER webhook routes were mounted. `\n        + 'Route mounting is decided once, from the registrations present at that moment, so this handler cannot bring back any route '\n        + 'that was withheld for a missing handler — those endpoints will keep answering 404. '\n        + 'Register capability handlers before WebhookAutoControllerBackendService.initialize() runs.',\n        {\n          capability: handler.capability,\n          withheldRoutes: this.withheldRoutes.map((withholding) => withholding.routePath),\n        },\n      );\n      return;\n    }\n\n    this.logDebug(`Registered webhook capability handler for ${handler.capability}`);\n  }\n\n  /**\n   * Return the sanitized inbound-provider routes that this controller actually\n   * registered. Provider configuration, signature material, endpoint payloads,\n   * and handler metadata are intentionally absent.\n   */\n  public getRegisteredWebhookRoutePaths(): ReadonlyArray<string> {\n    return [...this.registeredRoutePaths];\n  }\n\n  /**\n   * Return the declared endpoints whose route was deliberately NOT mounted,\n   * with the reason. Carries no provider configuration or signature material —\n   * only the route identity and which registration was missing.\n   */\n  public getWithheldWebhookRoutes(): ReadonlyArray<WebhookRouteWithholding> {\n    return this.withheldRoutes.map((withholding) => ({ ...withholding, reasons: [...withholding.reasons] }));\n  }\n\n  // ════════════════════════════════════════════════════════════\n  // Routes\n  // ════════════════════════════════════════════════════════════\n\n  /**\n   * Required by `AbstractControllerBackendService`, which invokes this hook\n   * synchronously from its constructor (`super(...)`). This controller\n   * intentionally registers NOTHING here: its route set is data-dependent\n   * (one route per provider webhook endpoint) and neither the webhook handler\n   * nor the provider endpoint contracts exist at construction time. The real\n   * registration happens in `initialize()` / `registerWebhookRoutes()` once\n   * that data is available — see `initialize()`'s JSDoc for the full rationale.\n   */\n  protected setupRoutes(): void {\n    // No-op by design — see JSDoc above and `registerWebhookRoutes()`.\n  }\n\n  /**\n   * Register one Express route per pre-loaded provider webhook endpoint —\n   * EXCEPT those whose capability cannot actually be dispatched.\n   *\n   * Invoked from `initialize()` after `webhookHandler` and `loadedEndpoints`\n   * have been populated. Idempotent-safe against an empty cache; guards on the\n   * handler so a mis-sequenced call fails visibly rather than registering dead\n   * routes.\n   *\n   * ── Why an undispatchable endpoint is WITHHELD rather than mounted ────────\n   *\n   * A declared endpoint needs two registrations that this controller does not\n   * own and cannot create: a `WebhookCapabilityAdapter` (verify + parse, on\n   * `WebhookHandlerBackendService`) and a `WebhookCapabilityHandler` (dispatch,\n   * here). Both are supplied by the capability module — for `billing`, inside\n   * `start-application.initializeBillingServices`, which is deliberately\n   * NON-FATAL: if it throws part-way, or if `billing.enabled` is false while the\n   * provider is still enabled for `WEBHOOK_ORIGINATOR`, the application boots\n   * with the provider's endpoint declared and neither registration present.\n   *\n   * Mounting a route in that state produces a 500 on every inbound delivery\n   * (`No webhook adapter registered for ...`, or `No capability handler for ...`\n   * below), and a 500 is precisely the answer that tells a vendor to RETRY — an\n   * instruction that can never be satisfied, because no retry supplies a missing\n   * startup registration. The endpoint therefore absorbs the vendor's full retry\n   * schedule and eventually gets disabled on the vendor's side, while the only\n   * local signal is a repeating error log.\n   *\n   * Not mounting says the true thing instead: this endpoint does not exist. The\n   * vendor gets a 404 rather than a retry instruction, and the operator gets one\n   * loud, remedy-naming error at startup — the moment the misconfiguration was\n   * actually introduced.\n   *\n   * REJECTED — refusing at BOOT (throwing from here). It is the shape the rest of\n   * the registry uses, and it is wrong at this site for three reasons. (1) It\n   * would not even be loud: `start-application.initializeWebhookAutoController`\n   * wraps `initialize()` in a non-fatal catch that downgrades a throw to a warn,\n   * so the net effect would be a quieter log AND the loss of every OTHER\n   * provider's working route. (2) It inverts a decision the engine already took\n   * explicitly — billing initialization failure is documented as survivable\n   * (\"the app can still run without billing\"); a failed optional subsystem must\n   * not become a refusal to start. (3) `billing.enabled: false` beside a\n   * registered Stripe provider is a COHERENT configuration, and refusing to boot\n   * over it would be a false alarm. The check is per-endpoint, so a capability\n   * that is wired keeps its route regardless of a sibling that is not.\n   */\n  private registerWebhookRoutes(): void {\n    this.routesRegistered = true;\n\n    if (!this.webhookHandler) {\n      this.logger.warn('WebhookAutoController: initialize() ran without a webhook handler — no routes registered');\n      return;\n    }\n\n    if (this.loadedEndpoints.size === 0) {\n      this.logDebug('No webhook endpoints pre-loaded — no routes registered');\n      return;\n    }\n\n    for (const [providerRef, endpoints] of this.loadedEndpoints) {\n      for (const endpoint of endpoints) {\n        const routePath = `/webhooks/${providerRef}/${endpoint.key}`;\n\n        const withholding = this.assessRouteDispatchability(providerRef, endpoint, routePath);\n        if (withholding) {\n          this.withheldRoutes.push(withholding);\n          this.logger.error(\n            `WebhookAutoController: NOT registering POST ${routePath} — the endpoint is declared but cannot be dispatched `\n            + `(${withholding.reasons.join(', ')}). A route mounted in this state can only ever answer 500, which instructs the `\n            + 'vendor to retry an inbound event that no retry can make processable. Withholding the route so the vendor gets a '\n            + '404 instead. Remedy: register the capability module that owns '\n            + `'${endpoint.capability}' before WebhookAutoControllerBackendService.initialize() runs (for billing, check whether `\n            + 'billing initialization was skipped or failed non-fatally earlier in startup), or disable the WEBHOOK_ORIGINATOR '\n            + `protocol for provider '${providerRef}'.`,\n            {\n              providerRef,\n              endpointKey: endpoint.key,\n              capability: endpoint.capability,\n              routePath,\n              reasons: withholding.reasons,\n            },\n          );\n          continue;\n        }\n\n        this.router.post(\n          routePath,\n          // Defense-in-depth for a future streaming mount. If this controller is\n          // ever assigned the RAW_REQUEST_STREAM mount phase, this express.raw()\n          // makes req.body the raw Buffer. Under the\n          // current master-router mount it is an inert no-op: the global\n          // express.json (HttpServerBackendService.setupBodyParsing) parses the\n          // body first and sets req._body, so the signature-faithful bytes come\n          // from req.rawBody — captured by that same express.json `verify` hook.\n          // handleWebhookRequest reads rawBody first, then falls back to a Buffer\n          // req.body for the streaming case.\n          express.raw({ type: 'application/json' }),\n          this.asyncHandler(async (req: Request, res: Response, _next: NextFunction) => {\n            await this.handleWebhookRequest(providerRef, endpoint, req, res);\n          }),\n        );\n\n        this.registeredRoutePaths.push(routePath);\n        this.logger.info(`Webhook endpoint registered: POST ${routePath}`);\n      }\n    }\n  }\n\n  /**\n   * Decide whether a declared endpoint can actually be served, and if not, say\n   * which registration is missing.\n   *\n   * Returns `null` when the route is dispatchable. Both prerequisites are\n   * evaluated (rather than short-circuiting on the first) so an operator gets\n   * the WHOLE remedy in one log line instead of fixing one registration and\n   * meeting the next on the following restart.\n   */\n  private assessRouteDispatchability(\n    providerRef: string,\n    endpoint: Hook_Endpoint,\n    routePath: string,\n  ): WebhookRouteWithholding | null {\n    const reasons: WebhookRouteWithholdingReason[] = [];\n\n    if (!this.capabilityHandlers.has(endpoint.capability)) {\n      reasons.push(WebhookRouteWithholdingReason.NO_CAPABILITY_HANDLER);\n    }\n    if (!this.webhookHandler?.hasAdapter(providerRef, endpoint.key)) {\n      reasons.push(WebhookRouteWithholdingReason.NO_ENDPOINT_ADAPTER);\n    }\n\n    if (reasons.length === 0) {\n      return null;\n    }\n    return { providerRef, endpointKey: endpoint.key, capability: endpoint.capability, routePath, reasons };\n  }\n\n  // ════════════════════════════════════════════════════════════\n  // Handler\n  // ════════════════════════════════════════════════════════════\n\n  private async handleWebhookRequest(\n    providerRef: string,\n    endpoint: Hook_Endpoint,\n    req: Request,\n    res: Response,\n  ): Promise<void> {\n    if (!this.webhookHandler) {\n      res.status(503).json({ error: 'Webhook handler not initialized' });\n      return;\n    }\n\n    // Raw request bytes for signature verification. Order matters:\n    //   1. req.rawBody — captured by the global express.json `verify` hook\n    //      (HttpServerBackendService.setupBodyParsing). This is the provider's\n    //      EXACT original payload and the ONLY byte-faithful source under the\n    //      current master-router mount, where global express.json parses the\n    //      body before this route runs (making the per-route express.raw() a\n    //      no-op, so req.body is a parsed object here).\n    //   2. Buffer req.body — only populated if this controller is ever\n    //      streaming-mounted before body parsing (per-route express.raw() fires).\n    //   3. string / JSON.stringify — last-resort fallbacks; JSON.stringify will\n    //      NOT byte-match the provider (key ordering / whitespace), so it exists\n    //      only to avoid a crash, never as a correctness path for signatures.\n    const rawBody = Buffer.isBuffer(req.rawBody)\n      ? req.rawBody.toString('utf-8')\n      : Buffer.isBuffer(req.body)\n        ? req.body.toString('utf-8')\n        : typeof req.body === 'string'\n          ? req.body\n          : JSON.stringify(req.body);\n\n    let result: Awaited<ReturnType<WebhookHandlerBackendService['processWebhook']>> | null = null;\n    try {\n      result = await this.webhookHandler.processWebhook({\n        providerRef,\n        endpointKey: endpoint.key,\n        endpoint,\n        rawBody,\n        headers: req.headers as Record<string, string>,\n      });\n\n      // null = idempotent duplicate or unparseable event — already acknowledged\n      if (!result) {\n        res.status(200).json({ received: true });\n        return;\n      }\n\n      // Dispatch to capability handler.\n      //\n      // Defence in depth only: `registerWebhookRoutes` refuses to MOUNT a route\n      // whose capability has no handler, so this branch is unreachable while that\n      // gate holds — reaching it means the handler map was mutated after mounting\n      // (which `registerCapabilityHandler` refuses to do silently). The throw is\n      // kept rather than removed because the alternative — dispatching to\n      // `undefined` — would 500 anyway, with no explanation.\n      const handler = this.capabilityHandlers.get(endpoint.capability);\n      if (handler) {\n        await handler.handleEvent(result.executionContext, result.parsedEvent);\n      } else {\n        throw new Error(`No capability handler for ${endpoint.capability} on ${providerRef}/${endpoint.key}`);\n      }\n\n      await this.webhookHandler.markWebhookProcessed(result.idempotencyKey);\n      res.status(200).json({ received: true });\n    } catch (error) {\n      const errorMessage = (error as Error).message ?? 'Unknown error';\n      const errorType = (error as any)?.errorType;\n\n      // Signature failure → 401\n      if (errorType === 'AUTHORIZATION') {\n        this.logDebug('Webhook signature verification failed', { providerRef, endpointKey: endpoint.key });\n        res.status(401).json({ error: 'Invalid signature' });\n        return;\n      }\n\n      // All other errors → 500 (trigger provider retry)\n      this.logger.error('Webhook processing failed', {\n        providerRef,\n        endpointKey: endpoint.key,\n        error: errorMessage,\n      });\n      await this.webhookHandler.releaseWebhookClaim(result?.idempotencyKey);\n      res.status(500).json({ error: 'Processing failed' });\n    }\n  }\n}\n"]}

package/dist/esm/notifications/webhooks/outbound/batches/m2m-webhook-delivery.batch.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"m2m-webhook-delivery.batch.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../../src/notifications/webhooks/outbound/batches/m2m-webhook-delivery.batch.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,aAAa,EAId,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAEL,KAAK,sCAAsC,EAC5C,MAAM,4FAA4F,CAAC;AAmDpG,eAAO,MAAM,kCAAkC;;;;;;iBAM7C,CAAC;AAEH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F,eAAO,MAAM,mCAAmC;;;;;;;;;;;;iBAiB9C,CAAC;AAEH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAMhG,eAAO,MAAM,8BAA8B,EAAE,sCAAsC,CACjF,OAAO,kCAAkC,EACzC,OAAO,mCAAmC,CA8V1C,CAAC"}
+{"version":3,"file":"m2m-webhook-delivery.batch.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/notifications/webhooks/outbound/batches/m2m-webhook-delivery.batch.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,aAAa,EAId,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAEL,KAAK,sCAAsC,EAC5C,MAAM,4FAA4F,CAAC;AAmDpG,eAAO,MAAM,kCAAkC;;;;;;iBAM7C,CAAC;AAEH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F,eAAO,MAAM,mCAAmC;;;;;;;;;;;;iBAiB9C,CAAC;AAEH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAMhG,eAAO,MAAM,8BAA8B,EAAE,sCAAsC,CACjF,OAAO,kCAAkC,EACzC,OAAO,mCAAmC,CA8V1C,CAAC"}

package/dist/esm/notifications/webhooks/outbound/batches/m2m-webhook-delivery.batch.backend.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"m2m-webhook-delivery.batch.backend.service.js","sourceRoot":"","sources":["../../../../../../../src/notifications/webhooks/outbound/batches/m2m-webhook-delivery.batch.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,aAAa,EACb,6BAA6B,EAC7B,8BAA8B,EAC9B,mCAAmC,GACpC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,iCAAiC,GAElC,MAAM,4FAA4F,CAAC;AACpG,OAAO,EAAE,0CAA0C,EAAE,MAAM,gFAAgF,CAAC;AAC5I,OAAO,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAChJ,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAEpF,OAAO,EAAE,cAAc,EAAE,MAAM,wEAAwE,CAAC;AAGxG,OAAO,EACL,YAAY,EACZ,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,+BAA+B,EAAE,wBAAwB,EAAE,MAAM,6CAA6C,CAAC;AAExH,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E;;;;;GAKG;AACH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,kCAAkC,GAAG,IAAI,GAAG,EAAU,CAAC;AAE7D,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC;QAC3B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KACtB,CAAC;IACF,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACjC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB;;;;OAIG;IACH,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC;QACd,WAAW;QACX,iBAAiB;QACjB,iBAAiB;QACjB,qBAAqB;QACrB,wBAAwB;KACzB,CAAC;IACF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC5C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC3C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CAC3C,CAAC,CAAC;AAIH,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E,MAAM,CAAC,MAAM,8BAA8B,GAGvC,iCAAiC,CAAC;IACpC,KAAK,EAAE,kCAAkC;IACzC,MAAM,EAAE,mCAAmC;IAC3C,oBAAoB,EAAE;QACpB,iEAAiE;QACjE,wEAAwE;QACxE,qEAAqE;QACrE,iEAAiE;QACjE,6CAA6C;QAC7C,6CAA6C;QAC7C,sCAAsC;QACtC,6CAA6C;QAC7C,EAAE;QACF,4BAA4B;QAC5B,uEAAuE;QACvE,sEAAsE;QACtE,6DAA6D;QAC7D,oEAAoE;QACpE,uEAAuE;QACvE,sEAAsE;QACtE,mEAAmE;QACnE,8DAA8D;QAC9D,oEAAoE;QACpE,sEAAsE;QACtE,IAAI,EAAE,0CAA0C,CAAC,IAAI;QACrD,mBAAmB,EAAE,0CAA0C,CAAC,mBAAmB;QACnF,YAAY,EAAE,0CAA0C,CAAC,YAAY;KACtE;IACD,mBAAmB,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;QACjC,UAAU,EAAE,GAAG,CACb,kBAAkB,CAAC,+BAA+B,CACnD;QACD,UAAU,EAAE,GAAG,CAAoB,kBAAkB,CAAC,iBAAiB,CAAC;QACxE,cAAc,EAAE,GAAG,CAAiB,kBAAkB,CAAC,cAAc,CAAC;KACvE,CAAC;IACF,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,YAAY,EAAE,EAAE,EAAE;QACpE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,yBAAyB,CAAC,CAAC;QAC/D,MAAM,EACJ,UAAU,EAAE,IAAI,EAChB,UAAU,EACV,cAAc,GACf,GAAG,YAAY,CAAC;QAEjB;;;;;;;;;;;;;;;;;;;WAmBG;QACH,MAAM,eAAe,GAAG,CACtB,MAAqC,EACN,EAAE;YACjC,IAAI,CAAC;gBACH,cAAc,CAAC,+BAA+B,CAAC;oBAC7C,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;oBACvB,OAAO,EAAE,MAAM,CAAC,OAAO;iBACxB,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CAAC,sDAAsD,EAAE;oBAClE,aAAa,EAAE,KAAK,CAAC,aAAa;oBAClC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;oBAC3B,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE;oBACvB,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,GAAG,2BAA2B,CAAC,KAAK,CAAC;iBACtC,CAAC,CAAC;YACL,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC;QAEF,8DAA8D;QAC9D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,gBAAgB,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;QAChF,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,4DAA4D;YAC5D,+DAA+D;YAC/D,sDAAsD;YACtD,MAAM,CAAC,IAAI,CAAC,0CAA0C,EAAE;gBACtD,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;gBAC3B,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE;aACxB,CAAC,CAAC;YACH,OAAO,eAAe,CAAC;gBACrB,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,OAAO,EAAE,qBAAqB;gBAC9B,YAAY,EAAE,CAAC;gBACf,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,gBAAgB,GAAG,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAErD,8DAA8D;QAC9D,gEAAgE;QAChE,kEAAkE;QAClE,gEAAgE;QAChE,6DAA6D;QAC7D,0DAA0D;QAC1D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CACpC,KAAK,CAAC,KAAK,EACX,gBAAgB,EAChB,KAAK,CAAC,aAAa,EACnB,gBAAgB,CACjB,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,CAAC,IAAI,CAAC,iEAAiE,EAAE;gBAC7E,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;gBAC3B,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE;gBACvB,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,YAAY,EAAE,GAAG,CAAC,YAAY;gBAC9B,aAAa,EAAE,GAAG,CAAC,MAAM;aAC1B,CAAC,CAAC;YACH,OAAO,eAAe,CAAC;gBACrB,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,OAAO,EAAE,wBAAwB;gBACjC,YAAY,EAAE,GAAG,CAAC,YAAY,IAAI,CAAC;gBACnC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC,CAAC;QACL,CAAC;QAED,8DAA8D;QAC9D,iEAAiE;QACjE,8DAA8D;QAC9D,iEAAiE;QACjE,2CAA2C;QAC3C,MAAM,MAAM,GAAG;YACb,8DAA8D;YAC9D,8DAA8D;YAC9D,2DAA2D;YAC3D,6DAA6D;YAC7D,gEAAgE;YAChE,kEAAkE;YAClE,uDAAuD;YACvD,wEAAwE;YACxE,0DAA0D;YAC1D,CAAC,6BAA6B,CAAC,eAAe,CAAC,UAAU,CAAC,EAAE,GAAG,CAAC,YAAY;YAC5E,CAAC,6BAA6B,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,WAAW;YACzE,CAAC,6BAA6B,CAAC,eAAe,CAAC,iBAAiB,CAAC,EAAE,+BAA+B;YAClG,CAAC,6BAA6B,CAAC,eAAe,CAAC,YAAY,CAAC,EAAE,GAAG,CAAC,OAAO;YACzE,CAAC,6BAA6B,CAAC,eAAe,CAAC,kBAAkB,CAAC,EAAE,GAAG,CAAC,kBAAkB;YAC1F,CAAC,6BAA6B,CAAC,eAAe,CAAC,mBAAmB,CAAC,EAAE,GAAG,CAAC,mBAAmB;YAC5F,uDAAuD;YACvD,4DAA4D;YAC5D,2DAA2D;YAC3D,6CAA6C;SAC9C,CAAC;QAEF,IAAI,SAAiB,CAAC;QACtB,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,mBAAmB,CAAC,CAAC;QAChF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,6DAA6D;YAC7D,+DAA+D;YAC/D,gEAAgE;YAChE,oBAAoB;YACpB,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;YAC1C,MAAM,CAAC,KAAK,CAAC,0DAA0D,EAAE;gBACvE,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;gBAC3B,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE;gBACvB,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,YAAY,EAAE,GAAG,CAAC,YAAY;gBAC9B,OAAO,EAAE,gBAAgB;gBACzB,KAAK;aACN,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,EAAE,gBAAgB,EAAE,KAAK,CAAC,aAAa,EAAE;gBAC/E,aAAa,EAAE,uBAAuB,MAAM,EAAE;aAC/C,CAAC,CAAC;YACH,OAAO,eAAe,CAAC;gBACrB,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,OAAO,EAAE,iBAAiB;gBAC1B,YAAY,EAAE,gBAAgB;gBAC9B,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC,CAAC;QACL,CAAC;QAED,8DAA8D;QAC9D,0DAA0D;QAC1D,mEAAmE;QACnE,sEAAsE;QACtE,6DAA6D;QAC7D,MAAM,SAAS,GACb,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAE9E,IAAI,mCAAmC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACrD,MAAM,SAAS,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,EAAE,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;YAC5E,IAAI,CAAC,kCAAkC,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBACvD,kCAAkC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBAClD,uFAAuF;gBACvF,4FAA4F;gBAC5F,2CAA2C;gBAC3C,MAAM,CAAC,IAAI,CAAC,4EAA4E,EAAE;oBACxF,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;oBAC3B,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE;oBACvB,UAAU,EAAE,GAAG,CAAC,UAAU;oBAC1B,uFAAuF;oBACvF,wDAAwD;oBACxD,eAAe,EAAE,8BAA8B,CAAC,GAAG,CAAC,OAAO,CAAC;oBAC5D,QAAQ,EAAE,gFAAgF;0BACtF,+EAA+E;oBACnF,MAAM,EAAE,iDAAiD;iBAC1D,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,MAAM,EAAE,cAAc,EAAE,qBAAqB,EAAE,YAAY,EAAE,GAAG,MAAM,wBAAwB,CAAC;YAC7F,GAAG,EAAE,GAAG,CAAC,OAAO;YAChB,IAAI,EAAE,SAAS;YACf,SAAS;SACV,CAAC,CAAC;QAEH,2EAA2E;QAC3E,uEAAuE;QACvE,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAE1C,8DAA8D;QAC9D,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACjC,MAAM,OAAO,GAAG,sBAAsB,CAAC,cAAc,CAAC,CAAC;YAEvD,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;gBAC5B,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,EAAE,gBAAgB,EAAE,KAAK,CAAC,aAAa,EAAE;oBAC3E,cAAc;oBACd,qBAAqB;iBACtB,CAAC,CAAC;gBACH,QAAQ,CAAC,mBAAmB,EAAE;oBAC5B,aAAa,EAAE,KAAK,CAAC,aAAa;oBAClC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;oBAC3B,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE;oBACvB,UAAU,EAAE,GAAG,CAAC,UAAU;oBAC1B,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,YAAY,EAAE,GAAG,CAAC,YAAY;oBAC9B,UAAU,EAAE,cAAc;oBAC1B,UAAU;oBACV,OAAO,EAAE,gBAAgB;iBAC1B,CAAC,CAAC;gBACH,OAAO,eAAe,CAAC;oBACrB,aAAa,EAAE,KAAK,CAAC,aAAa;oBAClC,OAAO,EAAE,WAAW;oBACpB,YAAY,EAAE,gBAAgB;oBAC9B,cAAc;oBACd,UAAU;iBACX,CAAC,CAAC;YACL,CAAC;YAED,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;gBACxB,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,EAAE,gBAAgB,EAAE,KAAK,CAAC,aAAa,EAAE;oBAC/E,cAAc;oBACd,qBAAqB;oBACrB,aAAa,EAAE,6BAA6B,cAAc,EAAE;iBAC7D,CAAC,CAAC;gBACH,MAAM,CAAC,IAAI,CAAC,yCAAyC,EAAE;oBACrD,aAAa,EAAE,KAAK,CAAC,aAAa;oBAClC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;oBAC3B,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE;oBACvB,UAAU,EAAE,GAAG,CAAC,UAAU;oBAC1B,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,YAAY,EAAE,GAAG,CAAC,YAAY;oBAC9B,UAAU,EAAE,cAAc;oBAC1B,UAAU;oBACV,OAAO,EAAE,gBAAgB;iBAC1B,CAAC,CAAC;gBACH,OAAO,eAAe,CAAC;oBACrB,aAAa,EAAE,KAAK,CAAC,aAAa;oBAClC,OAAO,EAAE,iBAAiB;oBAC1B,YAAY,EAAE,gBAAgB;oBAC9B,cAAc;oBACd,UAAU;iBACX,CAAC,CAAC;YACL,CAAC;YAED,gEAAgE;QAClE,CAAC;QAED,6DAA6D;QAC7D,oDAAoD;QACpD,MAAM,aAAa,GACjB,YAAY,IAAI,yBAAyB,cAAc,IAAI,SAAS,EAAE,CAAC;QAEzE,IAAI,gBAAgB,IAAI,YAAY,EAAE,CAAC;YACrC,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,EAAE,gBAAgB,EAAE,KAAK,CAAC,aAAa,EAAE;gBAC/E,cAAc;gBACd,qBAAqB;gBACrB,aAAa,EAAE,GAAG,aAAa,eAAe,YAAY,WAAW;aACtE,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,6CAA6C,EAAE;gBACzD,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;gBAC3B,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE;gBACvB,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,YAAY,EAAE,GAAG,CAAC,YAAY;gBAC9B,UAAU,EAAE,cAAc;gBAC1B,UAAU;gBACV,OAAO,EAAE,gBAAgB;gBACzB,aAAa;aACd,CAAC,CAAC;YACH,OAAO,eAAe,CAAC;gBACrB,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,OAAO,EAAE,iBAAiB;gBAC1B,YAAY,EAAE,gBAAgB;gBAC9B,cAAc;gBACd,UAAU;aACX,CAAC,CAAC;QACL,CAAC;QAED,MAAM,aAAa,GAAG,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;QAC7D,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,EAAE,gBAAgB,EAAE,KAAK,CAAC,aAAa,EAAE;YAC/E,cAAc;YACd,qBAAqB;YACrB,aAAa;YACb,aAAa;SACd,CAAC,CAAC;QACH,QAAQ,CAAC,kCAAkC,EAAE;YAC3C,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;YAC3B,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE;YACvB,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,YAAY,EAAE,GAAG,CAAC,YAAY;YAC9B,UAAU,EAAE,cAAc;YAC1B,UAAU;YACV,OAAO,EAAE,gBAAgB;YACzB,aAAa,EAAE,aAAa,CAAC,WAAW,EAAE;YAC1C,aAAa;SACd,CAAC,CAAC;QACH,OAAO,eAAe,CAAC;YACrB,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,OAAO,EAAE,iBAAiB;YAC1B,YAAY,EAAE,gBAAgB;YAC9B,cAAc;YACd,UAAU;SACX,CAAC,CAAC;IACL,CAAC;CACF,CAAC,CAAC;AAEH,wEAAwE;AACxE,6EAA6E;AAC7E,qEAAqE;AACrE,sDAAsD","sourcesContent":["/**\n * M2M Webhook Delivery Batch Worker\n *\n * Event-triggered custom batch — one job per delivery row enqueued by\n * `M2MWebhookDispatcherBackendService.enqueueDelivery`. The worker:\n *   1. Re-reads the row from `M2MWebhookDeliveryLog` (ground truth —\n *      we never trust in-flight queue state for the body or signature).\n *   2. Marks it `IN_FLIGHT` (incrementing `attemptCount`).\n *   3. Builds the JWT signature with `JwtPrivateKeys.APPLICATION_WEBHOOK`.\n *   4. POSTs the body with a 30s `AbortController` timeout.\n *   5. Classifies the response and records the terminal/intermediate\n *      transition on the row.\n *\n * Status classification (D6):\n *   - 2xx                            → DELIVERED (terminal success).\n *   - 4xx, excluding 408 / 429       → FAILED (terminal — non-retryable).\n *   - 408 / 429 / 5xx / network      → mark failed attempt; if\n *                                       `attemptCount >= MAX_ATTEMPTS`,\n *                                       transition to FAILED.\n *\n * Custom batches are factory-created rather than constructor-injected. This\n * batch therefore declares its exact services through `resolveDependencies`;\n * the executor resolves them lazily for each invocation and `doHandle`\n * receives only the typed named result.\n *\n * @see m2m-webhook-organization-delivery.md — Phase 3 / Step 10\n * @see notifications/email/services/email-batch-send.batch.backend.service.ts\n *   (precedent: same pattern for an event-triggered custom batch).\n */\n\nimport { z } from 'zod';\nimport {\n  AuthScopeType,\n  M2M_WEBHOOK_DELIVERY_CONTRACT,\n  webhookEndpointDestinationHost,\n  webhookEndpointTransportIsPlaintext,\n} from '@wildo-ai/saas-models';\nimport {\n  createCustomBatchExecutionService,\n  type BatchesCronjobsCustomExecution_Service,\n} from '~wildo-backend-lib/base-classes/services/batches/batches-cronjobs-custom-execution.service';\nimport { ENGINE_M2M_WEBHOOK_DELIVERY_BATCH_MANIFEST } from '~wildo-backend-lib/base-classes/services/batches/engine-custom-batch-manifests';\nimport { describeCaughtError, projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { JwtBackendService } from '~wildo-backend-lib/security/jwt/services/jwt.backend.service';\nimport { JwtPrivateKeys } from '~wildo-backend-lib/security/authentications/models/jwt.backend.schemas';\nimport type { MetricsService } from '~wildo-backend-lib/monitoring/observability/services/metrics.service';\nimport type { M2MWebhookDeliveryLogRepository } from '~wildo-backend-lib/notifications/webhooks/outbound/services/m2m-webhook-delivery-log.repository';\nimport {\n  MAX_ATTEMPTS,\n  classifyResponseStatus,\n  computeNextAttemptAt,\n} from './m2m-webhook-delivery.batch.utils';\nimport { M2M_WEBHOOK_BODY_HASH_ALGORITHM, sendSignedWebhookRequest } from '../m2m-webhook-signed-request.backend.utils';\n\n// ═══════════════════════════════════════════════════════════════════════════\n// Input / Output schemas\n// ═══════════════════════════════════════════════════════════════════════════\n\n/**\n * The dispatcher writes the row first, then enqueues this lightweight\n * payload. Keeping the payload minimal (id + scope) makes the worker\n * resilient to queue / DB race conditions: re-reading the row is the\n * source of truth.\n */\n/**\n * Endpoints already warned about in this process, so a permanently-plaintext destination costs one\n * line rather than one per delivery (#492).\n *\n * ## Why the warning is HERE, and why it is once\n *\n * Plaintext endpoints are ADMITTED — a commercial accommodation recorded on\n * `WebhookEndpointSchema.url` — and the cost of admitting them is that the decision becomes\n * invisible. The obvious place to say so is the moment an endpoint is SAVED, and that place does\n * not exist: `webhookConfig` declares CREATE and UPDATE `REPOSITORY_ONLY` with no admin route, and\n * the only writer that exists (data seeding) reaches the row through `upsertByBusinessKey`, a raw\n * repository call that no operation-pipeline hook observes. A postfix handler there would have been\n * a mechanism nothing runs — the shape this whole review exists to remove.\n *\n * The delivery IS the exposure, so this is where it can be stated truthfully: every POST over\n * `http://` puts the signature JWT on the wire in the clear, readable and replayable by anyone on\n * the path until it expires.\n *\n * Once per endpoint per process, because a webhook configuration is stable: a WARN on every\n * delivery would be a line an operator learns to filter, and a filtered warning is the same as no\n * warning. The set is bounded by the endpoint population and is deliberately NOT time-based — the\n * fact does not become news again after an hour, it becomes news again when the process restarts\n * and re-reads a configuration somebody may have changed.\n */\nconst PLAINTEXT_ENDPOINTS_ALREADY_WARNED = new Set<string>();\n\nexport const M2MWebhookDeliveryBatchInputSchema = z.object({\n  scope: z.object({\n    type: z.enum(AuthScopeType),\n    id: z.string().min(1),\n  }),\n  deliveryLogId: z.string().min(1),\n});\n\nexport type M2MWebhookDeliveryBatchInput = z.infer<typeof M2MWebhookDeliveryBatchInputSchema>;\n\nexport const M2MWebhookDeliveryBatchOutputSchema = z.object({\n  deliveryLogId: z.string(),\n  /**\n   * High-level outcome string. Stored only in the worker output for\n   * cron / log inspection; the persisted truth lives on the row's\n   * `status` field.\n   */\n  outcome: z.enum([\n    'delivered',\n    'retry_scheduled',\n    'failed_terminal',\n    'skipped_missing_row',\n    'skipped_already_leased',\n  ]),\n  attemptCount: z.number().int().nonnegative(),\n  responseStatus: z.number().int().optional(),\n  durationMs: z.number().int().nonnegative(),\n});\n\nexport type M2MWebhookDeliveryBatchOutput = z.infer<typeof M2MWebhookDeliveryBatchOutputSchema>;\n\n// ═══════════════════════════════════════════════════════════════════════════\n// Batch Service\n// ═══════════════════════════════════════════════════════════════════════════\n\nexport const m2mWebhookDeliveryBatchService: BatchesCronjobsCustomExecution_Service<\n  typeof M2MWebhookDeliveryBatchInputSchema,\n  typeof M2MWebhookDeliveryBatchOutputSchema\n> = createCustomBatchExecutionService({\n  input: M2MWebhookDeliveryBatchInputSchema,\n  output: M2MWebhookDeliveryBatchOutputSchema,\n  batchCronjob_Context: {\n    // Anchored on the `APPLICATION` primary scope rather than a fake\n    // `ORGANIZATION_M2M_WEBHOOK_DELIVERY_LOG` operation: an event-triggered\n    // polymorphic worker has no honest \"primary\" resource (each enqueued\n    // row carries its own `scope: { type, id }` and routes to either\n    // `ORGANIZATION_M2M_WEBHOOK_DELIVERY_LOG` or\n    // `APPLICATION_M2M_WEBHOOK_DELIVERY_LOG` via\n    // `resolveDeliveryLogResourceType` in\n    // `m2m-webhook-delivery-log.repository.ts`).\n    //\n    // The bootstrap path inside\n    // `ExecutionContextCreatorBackendService.createForInternalCustomBatch`\n    // resolves an `APPLICATION.READ` operation, populates the application\n    // id, then swaps in `notifications:m2m-webhook-delivery` via\n    // `withOperation()`. Audit trails surface the honest batch identity\n    // and authorization runs against `APP_ADMIN_SUPER_ADMIN @ APPLICATION`\n    // (see `createInternalSystemRoles()`), exactly as before, but without\n    // pretending the worker mutates the org-variant log on every job —\n    // including for app-scoped deliveries where that anchor was a\n    // flat-out lie. Per-row resource-type resolution (org vs app) stays\n    // inside the worker and is driven off the per-row `input.scope.type`.\n    kind: ENGINE_M2M_WEBHOOK_DELIVERY_BATCH_MANIFEST.kind,\n    operationIdentifier: ENGINE_M2M_WEBHOOK_DELIVERY_BATCH_MANIFEST.operationIdentifier,\n    primaryScope: ENGINE_M2M_WEBHOOK_DELIVERY_BATCH_MANIFEST.primaryScope,\n  },\n  resolveDependencies: ({ get }) => ({\n    repository: get<M2MWebhookDeliveryLogRepository>(\n      SAAS_SERVICE_TYPES.M2MWebhookDeliveryLogRepository,\n    ),\n    jwtService: get<JwtBackendService>(SAAS_SERVICE_TYPES.JwtBackendService),\n    metricsService: get<MetricsService>(SAAS_SERVICE_TYPES.MetricsService),\n  }),\n  doHandle: async (input, { logger, executionContext, dependencies }) => {\n    const startedAt = Date.now();\n    const logDebug = logger.debugByType('M2MWebhookDeliveryBatch');\n    const {\n      repository: repo,\n      jwtService,\n      metricsService,\n    } = dependencies;\n\n    /**\n     * Single funnel for every `doHandle` return-point. Mirrors the\n     * batch output back to the caller while firing the Phase 5 /\n     * Step 17 outcome counter exactly once per worker invocation.\n     *\n     * Kept inline (not extracted to a module-level helper) because it\n     * closes over `metricsService` and `input.scope.type` — lifting it\n     * would need re-threading both via parameters on every call site\n     * and would dilute the fire-exactly-once contract this funnel\n     * enforces.\n     *\n     * Metric emission is error-isolated for the same reason the audit\n     * helper swallows its failures: observability MUST NEVER fail the\n     * main flow. By the time `recordAndReturn` runs, the row has\n     * already been persisted with the correct terminal/intermediate\n     * status — letting an OpenTelemetry exporter glitch abort the\n     * batch invocation here would leave the custom-batch runner\n     * reporting the run as failed even though the real delivery\n     * completed and the truth-source row reflects success.\n     */\n    const recordAndReturn = (\n      output: M2MWebhookDeliveryBatchOutput,\n    ): M2MWebhookDeliveryBatchOutput => {\n      try {\n        metricsService.recordM2MWebhookDeliveryOutcome({\n          scope: input.scope.type,\n          outcome: output.outcome,\n        });\n      } catch (error) {\n        logger.warn('Failed to record M2M webhook delivery outcome metric', {\n          deliveryLogId: input.deliveryLogId,\n          scopeType: input.scope.type,\n          scopeId: input.scope.id,\n          outcome: output.outcome,\n          ...projectCaughtErrorLogFields(error),\n        });\n      }\n      return output;\n    };\n\n    // ── Load the row (ground truth) ────────────────────────────\n    const row = await repo.read(input.scope, executionContext, input.deliveryLogId);\n    if (!row) {\n      // Possible if the row was purged between enqueue and worker\n      // execution (admin `PURGE_OLD`). Quiet skip — there is nothing\n      // to deliver and no caller to surface the absence to.\n      logger.warn('Webhook delivery row not found; skipping', {\n        deliveryLogId: input.deliveryLogId,\n        scopeType: input.scope.type,\n        scopeId: input.scope.id,\n      });\n      return recordAndReturn({\n        deliveryLogId: input.deliveryLogId,\n        outcome: 'skipped_missing_row',\n        attemptCount: 0,\n        durationMs: Date.now() - startedAt,\n      });\n    }\n\n    const nextAttemptCount = (row.attemptCount ?? 0) + 1;\n\n    // ── Lease the row (atomic CAS) ─────────────────────────────\n    // `markInFlight` is a compare-and-swap on `status: PENDING`. If\n    // another worker already leased the row (cron retry sweep + queue\n    // redelivery race), the CAS returns false and we exit cleanly —\n    // double-POSTs and double-counted attempts would corrupt the\n    // retry budget and the consumer's idempotency guarantees.\n    const leased = await repo.markInFlight(\n      input.scope,\n      executionContext,\n      input.deliveryLogId,\n      nextAttemptCount,\n    );\n    if (!leased) {\n      logger.warn('Webhook delivery row already leased by another worker; skipping', {\n        deliveryLogId: input.deliveryLogId,\n        scopeType: input.scope.type,\n        scopeId: input.scope.id,\n        endpointId: row.endpointId,\n        httpUrl: row.httpUrl,\n        signatureJti: row.signatureJti,\n        currentStatus: row.status,\n      });\n      return recordAndReturn({\n        deliveryLogId: input.deliveryLogId,\n        outcome: 'skipped_already_leased',\n        attemptCount: row.attemptCount ?? 0,\n        durationMs: Date.now() - startedAt,\n      });\n    }\n\n    // ── Build the JWT signature (D5: claims-JWT) ───────────────\n    // The body itself is NOT in the JWT — only its sha256 hash. This\n    // keeps the header small (some HTTP intermediaries cap header\n    // size) and lets consumers verify integrity independently of the\n    // raw body bytes (which they can re-hash).\n    const claims = {\n      // `jti` is the consumer-facing dedup key. It is stable across\n      // every retry of THIS delivery row (same value re-signed each\n      // attempt) and unique across rows. Consumers MUST dedup on\n      // `jti` — the rest of the token (`iat`, `exp`, signature) is\n      // refreshed per attempt and so cannot serve as a replay marker.\n      // See `m2m-webhook-dispatcher.backend.service.ts` (`signatureJti`\n      // creation site) for the full consumer-contract JSDoc.\n      // Claim NAMES come from the published receiver contract so the customer\n      // documentation and this signing site cannot drift apart.\n      [M2M_WEBHOOK_DELIVERY_CONTRACT.signatureClaims.deliveryId]: row.signatureJti,\n      [M2M_WEBHOOK_DELIVERY_CONTRACT.signatureClaims.bodyHash]: row.payloadHash,\n      [M2M_WEBHOOK_DELIVERY_CONTRACT.signatureClaims.bodyHashAlgorithm]: M2M_WEBHOOK_BODY_HASH_ALGORITHM,\n      [M2M_WEBHOOK_DELIVERY_CONTRACT.signatureClaims.eventChannel]: row.channel,\n      [M2M_WEBHOOK_DELIVERY_CONTRACT.signatureClaims.resourceIdentifier]: row.resourceIdentifier,\n      [M2M_WEBHOOK_DELIVERY_CONTRACT.signatureClaims.operationIdentifier]: row.operationIdentifier,\n      // `iss`, `iat`, `exp`, `aud`, `kid` defaults come from\n      // `JwtPrivateKeySignOptions[APPLICATION_WEBHOOK]`. We don't\n      // override them here — the consumer-facing contract is the\n      // signing options table, not this call site.\n    };\n\n    let signature: string;\n    try {\n      signature = await jwtService.sign(claims, JwtPrivateKeys.APPLICATION_WEBHOOK);\n    } catch (error) {\n      // Signing failure is a configuration problem (missing key) —\n      // re-trying won't help until the operator fixes secrets, so we\n      // mark the row as terminally failed and let admin RETRY pick it\n      // up after the fix.\n      const reason = describeCaughtError(error);\n      logger.error('Failed to sign webhook payload — marking delivery FAILED', {\n        deliveryLogId: input.deliveryLogId,\n        scopeType: input.scope.type,\n        scopeId: input.scope.id,\n        endpointId: row.endpointId,\n        httpUrl: row.httpUrl,\n        signatureJti: row.signatureJti,\n        attempt: nextAttemptCount,\n        error,\n      });\n      await repo.markFinallyFailed(input.scope, executionContext, input.deliveryLogId, {\n        failureReason: `JWT signing failed: ${reason}`,\n      });\n      return recordAndReturn({\n        deliveryLogId: input.deliveryLogId,\n        outcome: 'failed_terminal',\n        attemptCount: nextAttemptCount,\n        durationMs: Date.now() - startedAt,\n      });\n    }\n\n    // ── POST the body ──────────────────────────────────────────\n    // Shared with the `webhookConfig.testEndpoint` probe (see\n    // `../m2m-webhook-signed-request.backend.utils`). The admin-facing\n    // connectivity test must exercise THIS transport, not a parallel one,\n    // or a green test would prove nothing about real deliveries.\n    const bodyBytes =\n      typeof row.payload === 'string' ? row.payload : JSON.stringify(row.payload);\n\n    if (webhookEndpointTransportIsPlaintext(row.httpUrl)) {\n      const warnedKey = `${input.scope.type}:${input.scope.id}:${row.endpointId}`;\n      if (!PLAINTEXT_ENDPOINTS_ALREADY_WARNED.has(warnedKey)) {\n        PLAINTEXT_ENDPOINTS_ALREADY_WARNED.add(warnedKey);\n        // NOT debug. The whole point is that an operator meets this without going looking, and\n        // `AbstractControllerBackendService` disables the debug channel — the same trap that made a\n        // readiness breakdown unreachable in #498.\n        logger.warn('Webhook endpoint is plaintext: the delivery signature is sent in the clear', {\n          scopeType: input.scope.type,\n          scopeId: input.scope.id,\n          endpointId: row.endpointId,\n          // Host only, never the URL — a customer endpoint's path routinely carries a per-tenant\n          // token, and this line reaches the ordinary log stream.\n          destinationHost: webhookEndpointDestinationHost(row.httpUrl),\n          exposure: 'The signature JWT is readable on the network path and replayable against this '\n            + 'endpoint until it expires, so an observer of one delivery can forge the next.',\n          remedy: 'Reconfigure this endpoint with an https:// URL.',\n        });\n      }\n    }\n\n    const { responseStatus, responseBodyTruncated, networkError } = await sendSignedWebhookRequest({\n      url: row.httpUrl,\n      body: bodyBytes,\n      signature,\n    });\n\n    // Job-level duration: spans the row re-read and lease as well as the POST,\n    // so it stays the batch's own measurement rather than the transport's.\n    const durationMs = Date.now() - startedAt;\n\n    // ── Classify + persist transition ──────────────────────────\n    if (responseStatus !== undefined) {\n      const verdict = classifyResponseStatus(responseStatus);\n\n      if (verdict === 'delivered') {\n        await repo.markDelivered(input.scope, executionContext, input.deliveryLogId, {\n          responseStatus,\n          responseBodyTruncated,\n        });\n        logDebug('Webhook delivered', {\n          deliveryLogId: input.deliveryLogId,\n          scopeType: input.scope.type,\n          scopeId: input.scope.id,\n          endpointId: row.endpointId,\n          httpUrl: row.httpUrl,\n          signatureJti: row.signatureJti,\n          httpStatus: responseStatus,\n          durationMs,\n          attempt: nextAttemptCount,\n        });\n        return recordAndReturn({\n          deliveryLogId: input.deliveryLogId,\n          outcome: 'delivered',\n          attemptCount: nextAttemptCount,\n          responseStatus,\n          durationMs,\n        });\n      }\n\n      if (verdict === 'fatal') {\n        await repo.markFinallyFailed(input.scope, executionContext, input.deliveryLogId, {\n          responseStatus,\n          responseBodyTruncated,\n          failureReason: `non-retryable HTTP status ${responseStatus}`,\n        });\n        logger.warn('Webhook delivery failed (non-retryable)', {\n          deliveryLogId: input.deliveryLogId,\n          scopeType: input.scope.type,\n          scopeId: input.scope.id,\n          endpointId: row.endpointId,\n          httpUrl: row.httpUrl,\n          signatureJti: row.signatureJti,\n          httpStatus: responseStatus,\n          durationMs,\n          attempt: nextAttemptCount,\n        });\n        return recordAndReturn({\n          deliveryLogId: input.deliveryLogId,\n          outcome: 'failed_terminal',\n          attemptCount: nextAttemptCount,\n          responseStatus,\n          durationMs,\n        });\n      }\n\n      // verdict === 'retry' — fall through to the retry branch below.\n    }\n\n    // Retryable failure (5xx, 408, 429, network/timeout). Decide\n    // between scheduling another attempt and giving up.\n    const failureReason =\n      networkError ?? `retryable HTTP status ${responseStatus ?? 'unknown'}`;\n\n    if (nextAttemptCount >= MAX_ATTEMPTS) {\n      await repo.markFinallyFailed(input.scope, executionContext, input.deliveryLogId, {\n        responseStatus,\n        responseBodyTruncated,\n        failureReason: `${failureReason} (retry cap ${MAX_ATTEMPTS} reached)`,\n      });\n      logger.warn('Webhook delivery failed (retry cap reached)', {\n        deliveryLogId: input.deliveryLogId,\n        scopeType: input.scope.type,\n        scopeId: input.scope.id,\n        endpointId: row.endpointId,\n        httpUrl: row.httpUrl,\n        signatureJti: row.signatureJti,\n        httpStatus: responseStatus,\n        durationMs,\n        attempt: nextAttemptCount,\n        failureReason,\n      });\n      return recordAndReturn({\n        deliveryLogId: input.deliveryLogId,\n        outcome: 'failed_terminal',\n        attemptCount: nextAttemptCount,\n        responseStatus,\n        durationMs,\n      });\n    }\n\n    const nextAttemptAt = computeNextAttemptAt(nextAttemptCount);\n    await repo.markFailedAttempt(input.scope, executionContext, input.deliveryLogId, {\n      responseStatus,\n      responseBodyTruncated,\n      failureReason,\n      nextAttemptAt,\n    });\n    logDebug('Webhook delivery retry scheduled', {\n      deliveryLogId: input.deliveryLogId,\n      scopeType: input.scope.type,\n      scopeId: input.scope.id,\n      endpointId: row.endpointId,\n      httpUrl: row.httpUrl,\n      signatureJti: row.signatureJti,\n      httpStatus: responseStatus,\n      durationMs,\n      attempt: nextAttemptCount,\n      nextAttemptAt: nextAttemptAt.toISOString(),\n      failureReason,\n    });\n    return recordAndReturn({\n      deliveryLogId: input.deliveryLogId,\n      outcome: 'retry_scheduled',\n      attemptCount: nextAttemptCount,\n      responseStatus,\n      durationMs,\n    });\n  },\n});\n\n// Batch reference identifier lives in the declarative manifest registry\n// (`engine-custom-batch-manifests`); import `M2M_WEBHOOK_DELIVERY_BATCH_REF`\n// from there to keep a single source of truth across runtime wiring,\n// queue dispatch, and specification cross-validation.\n"]}
+{"version":3,"file":"m2m-webhook-delivery.batch.backend.service.js","sourceRoot":"","sources":["../../../../../../src/notifications/webhooks/outbound/batches/m2m-webhook-delivery.batch.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,aAAa,EACb,6BAA6B,EAC7B,8BAA8B,EAC9B,mCAAmC,GACpC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,iCAAiC,GAElC,MAAM,4FAA4F,CAAC;AACpG,OAAO,EAAE,0CAA0C,EAAE,MAAM,gFAAgF,CAAC;AAC5I,OAAO,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAChJ,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAEpF,OAAO,EAAE,cAAc,EAAE,MAAM,wEAAwE,CAAC;AAGxG,OAAO,EACL,YAAY,EACZ,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,+BAA+B,EAAE,wBAAwB,EAAE,MAAM,6CAA6C,CAAC;AAExH,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E;;;;;GAKG;AACH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,kCAAkC,GAAG,IAAI,GAAG,EAAU,CAAC;AAE7D,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC;QAC3B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KACtB,CAAC;IACF,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACjC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB;;;;OAIG;IACH,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC;QACd,WAAW;QACX,iBAAiB;QACjB,iBAAiB;QACjB,qBAAqB;QACrB,wBAAwB;KACzB,CAAC;IACF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC5C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC3C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CAC3C,CAAC,CAAC;AAIH,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E,MAAM,CAAC,MAAM,8BAA8B,GAGvC,iCAAiC,CAAC;IACpC,KAAK,EAAE,kCAAkC;IACzC,MAAM,EAAE,mCAAmC;IAC3C,oBAAoB,EAAE;QACpB,iEAAiE;QACjE,wEAAwE;QACxE,qEAAqE;QACrE,iEAAiE;QACjE,6CAA6C;QAC7C,6CAA6C;QAC7C,sCAAsC;QACtC,6CAA6C;QAC7C,EAAE;QACF,4BAA4B;QAC5B,uEAAuE;QACvE,sEAAsE;QACtE,6DAA6D;QAC7D,oEAAoE;QACpE,uEAAuE;QACvE,sEAAsE;QACtE,mEAAmE;QACnE,8DAA8D;QAC9D,oEAAoE;QACpE,sEAAsE;QACtE,IAAI,EAAE,0CAA0C,CAAC,IAAI;QACrD,mBAAmB,EAAE,0CAA0C,CAAC,mBAAmB;QACnF,YAAY,EAAE,0CAA0C,CAAC,YAAY;KACtE;IACD,mBAAmB,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;QACjC,UAAU,EAAE,GAAG,CACb,kBAAkB,CAAC,+BAA+B,CACnD;QACD,UAAU,EAAE,GAAG,CAAoB,kBAAkB,CAAC,iBAAiB,CAAC;QACxE,cAAc,EAAE,GAAG,CAAiB,kBAAkB,CAAC,cAAc,CAAC;KACvE,CAAC;IACF,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,YAAY,EAAE,EAAE,EAAE;QACpE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,yBAAyB,CAAC,CAAC;QAC/D,MAAM,EACJ,UAAU,EAAE,IAAI,EAChB,UAAU,EACV,cAAc,GACf,GAAG,YAAY,CAAC;QAEjB;;;;;;;;;;;;;;;;;;;WAmBG;QACH,MAAM,eAAe,GAAG,CACtB,MAAqC,EACN,EAAE;YACjC,IAAI,CAAC;gBACH,cAAc,CAAC,+BAA+B,CAAC;oBAC7C,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;oBACvB,OAAO,EAAE,MAAM,CAAC,OAAO;iBACxB,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CAAC,sDAAsD,EAAE;oBAClE,aAAa,EAAE,KAAK,CAAC,aAAa;oBAClC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;oBAC3B,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE;oBACvB,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,GAAG,2BAA2B,CAAC,KAAK,CAAC;iBACtC,CAAC,CAAC;YACL,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC;QAEF,8DAA8D;QAC9D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,gBAAgB,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;QAChF,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,4DAA4D;YAC5D,+DAA+D;YAC/D,sDAAsD;YACtD,MAAM,CAAC,IAAI,CAAC,0CAA0C,EAAE;gBACtD,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;gBAC3B,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE;aACxB,CAAC,CAAC;YACH,OAAO,eAAe,CAAC;gBACrB,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,OAAO,EAAE,qBAAqB;gBAC9B,YAAY,EAAE,CAAC;gBACf,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,gBAAgB,GAAG,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAErD,8DAA8D;QAC9D,gEAAgE;QAChE,kEAAkE;QAClE,gEAAgE;QAChE,6DAA6D;QAC7D,0DAA0D;QAC1D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CACpC,KAAK,CAAC,KAAK,EACX,gBAAgB,EAChB,KAAK,CAAC,aAAa,EACnB,gBAAgB,CACjB,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,CAAC,IAAI,CAAC,iEAAiE,EAAE;gBAC7E,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;gBAC3B,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE;gBACvB,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,YAAY,EAAE,GAAG,CAAC,YAAY;gBAC9B,aAAa,EAAE,GAAG,CAAC,MAAM;aAC1B,CAAC,CAAC;YACH,OAAO,eAAe,CAAC;gBACrB,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,OAAO,EAAE,wBAAwB;gBACjC,YAAY,EAAE,GAAG,CAAC,YAAY,IAAI,CAAC;gBACnC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC,CAAC;QACL,CAAC;QAED,8DAA8D;QAC9D,iEAAiE;QACjE,8DAA8D;QAC9D,iEAAiE;QACjE,2CAA2C;QAC3C,MAAM,MAAM,GAAG;YACb,8DAA8D;YAC9D,8DAA8D;YAC9D,2DAA2D;YAC3D,6DAA6D;YAC7D,gEAAgE;YAChE,kEAAkE;YAClE,uDAAuD;YACvD,wEAAwE;YACxE,0DAA0D;YAC1D,CAAC,6BAA6B,CAAC,eAAe,CAAC,UAAU,CAAC,EAAE,GAAG,CAAC,YAAY;YAC5E,CAAC,6BAA6B,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,WAAW;YACzE,CAAC,6BAA6B,CAAC,eAAe,CAAC,iBAAiB,CAAC,EAAE,+BAA+B;YAClG,CAAC,6BAA6B,CAAC,eAAe,CAAC,YAAY,CAAC,EAAE,GAAG,CAAC,OAAO;YACzE,CAAC,6BAA6B,CAAC,eAAe,CAAC,kBAAkB,CAAC,EAAE,GAAG,CAAC,kBAAkB;YAC1F,CAAC,6BAA6B,CAAC,eAAe,CAAC,mBAAmB,CAAC,EAAE,GAAG,CAAC,mBAAmB;YAC5F,uDAAuD;YACvD,4DAA4D;YAC5D,2DAA2D;YAC3D,6CAA6C;SAC9C,CAAC;QAEF,IAAI,SAAiB,CAAC;QACtB,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,mBAAmB,CAAC,CAAC;QAChF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,6DAA6D;YAC7D,+DAA+D;YAC/D,gEAAgE;YAChE,oBAAoB;YACpB,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;YAC1C,MAAM,CAAC,KAAK,CAAC,0DAA0D,EAAE;gBACvE,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;gBAC3B,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE;gBACvB,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,YAAY,EAAE,GAAG,CAAC,YAAY;gBAC9B,OAAO,EAAE,gBAAgB;gBACzB,KAAK;aACN,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,EAAE,gBAAgB,EAAE,KAAK,CAAC,aAAa,EAAE;gBAC/E,aAAa,EAAE,uBAAuB,MAAM,EAAE;aAC/C,CAAC,CAAC;YACH,OAAO,eAAe,CAAC;gBACrB,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,OAAO,EAAE,iBAAiB;gBAC1B,YAAY,EAAE,gBAAgB;gBAC9B,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC,CAAC;QACL,CAAC;QAED,8DAA8D;QAC9D,0DAA0D;QAC1D,mEAAmE;QACnE,sEAAsE;QACtE,6DAA6D;QAC7D,MAAM,SAAS,GACb,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAE9E,IAAI,mCAAmC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACrD,MAAM,SAAS,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,EAAE,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;YAC5E,IAAI,CAAC,kCAAkC,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBACvD,kCAAkC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBAClD,uFAAuF;gBACvF,4FAA4F;gBAC5F,2CAA2C;gBAC3C,MAAM,CAAC,IAAI,CAAC,4EAA4E,EAAE;oBACxF,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;oBAC3B,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE;oBACvB,UAAU,EAAE,GAAG,CAAC,UAAU;oBAC1B,uFAAuF;oBACvF,wDAAwD;oBACxD,eAAe,EAAE,8BAA8B,CAAC,GAAG,CAAC,OAAO,CAAC;oBAC5D,QAAQ,EAAE,gFAAgF;0BACtF,+EAA+E;oBACnF,MAAM,EAAE,iDAAiD;iBAC1D,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,MAAM,EAAE,cAAc,EAAE,qBAAqB,EAAE,YAAY,EAAE,GAAG,MAAM,wBAAwB,CAAC;YAC7F,GAAG,EAAE,GAAG,CAAC,OAAO;YAChB,IAAI,EAAE,SAAS;YACf,SAAS;SACV,CAAC,CAAC;QAEH,2EAA2E;QAC3E,uEAAuE;QACvE,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAE1C,8DAA8D;QAC9D,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACjC,MAAM,OAAO,GAAG,sBAAsB,CAAC,cAAc,CAAC,CAAC;YAEvD,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;gBAC5B,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,EAAE,gBAAgB,EAAE,KAAK,CAAC,aAAa,EAAE;oBAC3E,cAAc;oBACd,qBAAqB;iBACtB,CAAC,CAAC;gBACH,QAAQ,CAAC,mBAAmB,EAAE;oBAC5B,aAAa,EAAE,KAAK,CAAC,aAAa;oBAClC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;oBAC3B,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE;oBACvB,UAAU,EAAE,GAAG,CAAC,UAAU;oBAC1B,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,YAAY,EAAE,GAAG,CAAC,YAAY;oBAC9B,UAAU,EAAE,cAAc;oBAC1B,UAAU;oBACV,OAAO,EAAE,gBAAgB;iBAC1B,CAAC,CAAC;gBACH,OAAO,eAAe,CAAC;oBACrB,aAAa,EAAE,KAAK,CAAC,aAAa;oBAClC,OAAO,EAAE,WAAW;oBACpB,YAAY,EAAE,gBAAgB;oBAC9B,cAAc;oBACd,UAAU;iBACX,CAAC,CAAC;YACL,CAAC;YAED,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;gBACxB,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,EAAE,gBAAgB,EAAE,KAAK,CAAC,aAAa,EAAE;oBAC/E,cAAc;oBACd,qBAAqB;oBACrB,aAAa,EAAE,6BAA6B,cAAc,EAAE;iBAC7D,CAAC,CAAC;gBACH,MAAM,CAAC,IAAI,CAAC,yCAAyC,EAAE;oBACrD,aAAa,EAAE,KAAK,CAAC,aAAa;oBAClC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;oBAC3B,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE;oBACvB,UAAU,EAAE,GAAG,CAAC,UAAU;oBAC1B,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,YAAY,EAAE,GAAG,CAAC,YAAY;oBAC9B,UAAU,EAAE,cAAc;oBAC1B,UAAU;oBACV,OAAO,EAAE,gBAAgB;iBAC1B,CAAC,CAAC;gBACH,OAAO,eAAe,CAAC;oBACrB,aAAa,EAAE,KAAK,CAAC,aAAa;oBAClC,OAAO,EAAE,iBAAiB;oBAC1B,YAAY,EAAE,gBAAgB;oBAC9B,cAAc;oBACd,UAAU;iBACX,CAAC,CAAC;YACL,CAAC;YAED,gEAAgE;QAClE,CAAC;QAED,6DAA6D;QAC7D,oDAAoD;QACpD,MAAM,aAAa,GACjB,YAAY,IAAI,yBAAyB,cAAc,IAAI,SAAS,EAAE,CAAC;QAEzE,IAAI,gBAAgB,IAAI,YAAY,EAAE,CAAC;YACrC,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,EAAE,gBAAgB,EAAE,KAAK,CAAC,aAAa,EAAE;gBAC/E,cAAc;gBACd,qBAAqB;gBACrB,aAAa,EAAE,GAAG,aAAa,eAAe,YAAY,WAAW;aACtE,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,6CAA6C,EAAE;gBACzD,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;gBAC3B,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE;gBACvB,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,YAAY,EAAE,GAAG,CAAC,YAAY;gBAC9B,UAAU,EAAE,cAAc;gBAC1B,UAAU;gBACV,OAAO,EAAE,gBAAgB;gBACzB,aAAa;aACd,CAAC,CAAC;YACH,OAAO,eAAe,CAAC;gBACrB,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,OAAO,EAAE,iBAAiB;gBAC1B,YAAY,EAAE,gBAAgB;gBAC9B,cAAc;gBACd,UAAU;aACX,CAAC,CAAC;QACL,CAAC;QAED,MAAM,aAAa,GAAG,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;QAC7D,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,EAAE,gBAAgB,EAAE,KAAK,CAAC,aAAa,EAAE;YAC/E,cAAc;YACd,qBAAqB;YACrB,aAAa;YACb,aAAa;SACd,CAAC,CAAC;QACH,QAAQ,CAAC,kCAAkC,EAAE;YAC3C,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;YAC3B,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE;YACvB,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,YAAY,EAAE,GAAG,CAAC,YAAY;YAC9B,UAAU,EAAE,cAAc;YAC1B,UAAU;YACV,OAAO,EAAE,gBAAgB;YACzB,aAAa,EAAE,aAAa,CAAC,WAAW,EAAE;YAC1C,aAAa;SACd,CAAC,CAAC;QACH,OAAO,eAAe,CAAC;YACrB,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,OAAO,EAAE,iBAAiB;YAC1B,YAAY,EAAE,gBAAgB;YAC9B,cAAc;YACd,UAAU;SACX,CAAC,CAAC;IACL,CAAC;CACF,CAAC,CAAC;AAEH,wEAAwE;AACxE,6EAA6E;AAC7E,qEAAqE;AACrE,sDAAsD","sourcesContent":["/**\n * M2M Webhook Delivery Batch Worker\n *\n * Event-triggered custom batch — one job per delivery row enqueued by\n * `M2MWebhookDispatcherBackendService.enqueueDelivery`. The worker:\n *   1. Re-reads the row from `M2MWebhookDeliveryLog` (ground truth —\n *      we never trust in-flight queue state for the body or signature).\n *   2. Marks it `IN_FLIGHT` (incrementing `attemptCount`).\n *   3. Builds the JWT signature with `JwtPrivateKeys.APPLICATION_WEBHOOK`.\n *   4. POSTs the body with a 30s `AbortController` timeout.\n *   5. Classifies the response and records the terminal/intermediate\n *      transition on the row.\n *\n * Status classification (D6):\n *   - 2xx                            → DELIVERED (terminal success).\n *   - 4xx, excluding 408 / 429       → FAILED (terminal — non-retryable).\n *   - 408 / 429 / 5xx / network      → mark failed attempt; if\n *                                       `attemptCount >= MAX_ATTEMPTS`,\n *                                       transition to FAILED.\n *\n * Custom batches are factory-created rather than constructor-injected. This\n * batch therefore declares its exact services through `resolveDependencies`;\n * the executor resolves them lazily for each invocation and `doHandle`\n * receives only the typed named result.\n *\n * @see m2m-webhook-organization-delivery.md — Phase 3 / Step 10\n * @see notifications/email/services/email-batch-send.batch.backend.service.ts\n *   (precedent: same pattern for an event-triggered custom batch).\n */\n\nimport { z } from 'zod';\nimport {\n  AuthScopeType,\n  M2M_WEBHOOK_DELIVERY_CONTRACT,\n  webhookEndpointDestinationHost,\n  webhookEndpointTransportIsPlaintext,\n} from '@wildo-ai/saas-models';\nimport {\n  createCustomBatchExecutionService,\n  type BatchesCronjobsCustomExecution_Service,\n} from '~wildo-backend-lib/base-classes/services/batches/batches-cronjobs-custom-execution.service';\nimport { ENGINE_M2M_WEBHOOK_DELIVERY_BATCH_MANIFEST } from '~wildo-backend-lib/base-classes/services/batches/engine-custom-batch-manifests';\nimport { describeCaughtError, projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { JwtBackendService } from '~wildo-backend-lib/security/jwt/services/jwt.backend.service';\nimport { JwtPrivateKeys } from '~wildo-backend-lib/security/authentications/models/jwt.backend.schemas';\nimport type { MetricsService } from '~wildo-backend-lib/monitoring/observability/services/metrics.service';\nimport type { M2MWebhookDeliveryLogRepository } from '~wildo-backend-lib/notifications/webhooks/outbound/services/m2m-webhook-delivery-log.repository';\nimport {\n  MAX_ATTEMPTS,\n  classifyResponseStatus,\n  computeNextAttemptAt,\n} from './m2m-webhook-delivery.batch.utils';\nimport { M2M_WEBHOOK_BODY_HASH_ALGORITHM, sendSignedWebhookRequest } from '../m2m-webhook-signed-request.backend.utils';\n\n// ═══════════════════════════════════════════════════════════════════════════\n// Input / Output schemas\n// ═══════════════════════════════════════════════════════════════════════════\n\n/**\n * The dispatcher writes the row first, then enqueues this lightweight\n * payload. Keeping the payload minimal (id + scope) makes the worker\n * resilient to queue / DB race conditions: re-reading the row is the\n * source of truth.\n */\n/**\n * Endpoints already warned about in this process, so a permanently-plaintext destination costs one\n * line rather than one per delivery (#492).\n *\n * ## Why the warning is HERE, and why it is once\n *\n * Plaintext endpoints are ADMITTED — a commercial accommodation recorded on\n * `WebhookEndpointSchema.url` — and the cost of admitting them is that the decision becomes\n * invisible. The obvious place to say so is the moment an endpoint is SAVED, and that place does\n * not exist: `webhookConfig` declares CREATE and UPDATE `REPOSITORY_ONLY` with no admin route, and\n * the only writer that exists (data seeding) reaches the row through `upsertByBusinessKey`, a raw\n * repository call that no operation-pipeline hook observes. A postfix handler there would have been\n * a mechanism nothing runs — the shape this whole review exists to remove.\n *\n * The delivery IS the exposure, so this is where it can be stated truthfully: every POST over\n * `http://` puts the signature JWT on the wire in the clear, readable and replayable by anyone on\n * the path until it expires.\n *\n * Once per endpoint per process, because a webhook configuration is stable: a WARN on every\n * delivery would be a line an operator learns to filter, and a filtered warning is the same as no\n * warning. The set is bounded by the endpoint population and is deliberately NOT time-based — the\n * fact does not become news again after an hour, it becomes news again when the process restarts\n * and re-reads a configuration somebody may have changed.\n */\nconst PLAINTEXT_ENDPOINTS_ALREADY_WARNED = new Set<string>();\n\nexport const M2MWebhookDeliveryBatchInputSchema = z.object({\n  scope: z.object({\n    type: z.enum(AuthScopeType),\n    id: z.string().min(1),\n  }),\n  deliveryLogId: z.string().min(1),\n});\n\nexport type M2MWebhookDeliveryBatchInput = z.infer<typeof M2MWebhookDeliveryBatchInputSchema>;\n\nexport const M2MWebhookDeliveryBatchOutputSchema = z.object({\n  deliveryLogId: z.string(),\n  /**\n   * High-level outcome string. Stored only in the worker output for\n   * cron / log inspection; the persisted truth lives on the row's\n   * `status` field.\n   */\n  outcome: z.enum([\n    'delivered',\n    'retry_scheduled',\n    'failed_terminal',\n    'skipped_missing_row',\n    'skipped_already_leased',\n  ]),\n  attemptCount: z.number().int().nonnegative(),\n  responseStatus: z.number().int().optional(),\n  durationMs: z.number().int().nonnegative(),\n});\n\nexport type M2MWebhookDeliveryBatchOutput = z.infer<typeof M2MWebhookDeliveryBatchOutputSchema>;\n\n// ═══════════════════════════════════════════════════════════════════════════\n// Batch Service\n// ═══════════════════════════════════════════════════════════════════════════\n\nexport const m2mWebhookDeliveryBatchService: BatchesCronjobsCustomExecution_Service<\n  typeof M2MWebhookDeliveryBatchInputSchema,\n  typeof M2MWebhookDeliveryBatchOutputSchema\n> = createCustomBatchExecutionService({\n  input: M2MWebhookDeliveryBatchInputSchema,\n  output: M2MWebhookDeliveryBatchOutputSchema,\n  batchCronjob_Context: {\n    // Anchored on the `APPLICATION` primary scope rather than a fake\n    // `ORGANIZATION_M2M_WEBHOOK_DELIVERY_LOG` operation: an event-triggered\n    // polymorphic worker has no honest \"primary\" resource (each enqueued\n    // row carries its own `scope: { type, id }` and routes to either\n    // `ORGANIZATION_M2M_WEBHOOK_DELIVERY_LOG` or\n    // `APPLICATION_M2M_WEBHOOK_DELIVERY_LOG` via\n    // `resolveDeliveryLogResourceType` in\n    // `m2m-webhook-delivery-log.repository.ts`).\n    //\n    // The bootstrap path inside\n    // `ExecutionContextCreatorBackendService.createForInternalCustomBatch`\n    // resolves an `APPLICATION.READ` operation, populates the application\n    // id, then swaps in `notifications:m2m-webhook-delivery` via\n    // `withOperation()`. Audit trails surface the honest batch identity\n    // and authorization runs against `APP_ADMIN_SUPER_ADMIN @ APPLICATION`\n    // (see `createInternalSystemRoles()`), exactly as before, but without\n    // pretending the worker mutates the org-variant log on every job —\n    // including for app-scoped deliveries where that anchor was a\n    // flat-out lie. Per-row resource-type resolution (org vs app) stays\n    // inside the worker and is driven off the per-row `input.scope.type`.\n    kind: ENGINE_M2M_WEBHOOK_DELIVERY_BATCH_MANIFEST.kind,\n    operationIdentifier: ENGINE_M2M_WEBHOOK_DELIVERY_BATCH_MANIFEST.operationIdentifier,\n    primaryScope: ENGINE_M2M_WEBHOOK_DELIVERY_BATCH_MANIFEST.primaryScope,\n  },\n  resolveDependencies: ({ get }) => ({\n    repository: get<M2MWebhookDeliveryLogRepository>(\n      SAAS_SERVICE_TYPES.M2MWebhookDeliveryLogRepository,\n    ),\n    jwtService: get<JwtBackendService>(SAAS_SERVICE_TYPES.JwtBackendService),\n    metricsService: get<MetricsService>(SAAS_SERVICE_TYPES.MetricsService),\n  }),\n  doHandle: async (input, { logger, executionContext, dependencies }) => {\n    const startedAt = Date.now();\n    const logDebug = logger.debugByType('M2MWebhookDeliveryBatch');\n    const {\n      repository: repo,\n      jwtService,\n      metricsService,\n    } = dependencies;\n\n    /**\n     * Single funnel for every `doHandle` return-point. Mirrors the\n     * batch output back to the caller while firing the Phase 5 /\n     * Step 17 outcome counter exactly once per worker invocation.\n     *\n     * Kept inline (not extracted to a module-level helper) because it\n     * closes over `metricsService` and `input.scope.type` — lifting it\n     * would need re-threading both via parameters on every call site\n     * and would dilute the fire-exactly-once contract this funnel\n     * enforces.\n     *\n     * Metric emission is error-isolated for the same reason the audit\n     * helper swallows its failures: observability MUST NEVER fail the\n     * main flow. By the time `recordAndReturn` runs, the row has\n     * already been persisted with the correct terminal/intermediate\n     * status — letting an OpenTelemetry exporter glitch abort the\n     * batch invocation here would leave the custom-batch runner\n     * reporting the run as failed even though the real delivery\n     * completed and the truth-source row reflects success.\n     */\n    const recordAndReturn = (\n      output: M2MWebhookDeliveryBatchOutput,\n    ): M2MWebhookDeliveryBatchOutput => {\n      try {\n        metricsService.recordM2MWebhookDeliveryOutcome({\n          scope: input.scope.type,\n          outcome: output.outcome,\n        });\n      } catch (error) {\n        logger.warn('Failed to record M2M webhook delivery outcome metric', {\n          deliveryLogId: input.deliveryLogId,\n          scopeType: input.scope.type,\n          scopeId: input.scope.id,\n          outcome: output.outcome,\n          ...projectCaughtErrorLogFields(error),\n        });\n      }\n      return output;\n    };\n\n    // ── Load the row (ground truth) ────────────────────────────\n    const row = await repo.read(input.scope, executionContext, input.deliveryLogId);\n    if (!row) {\n      // Possible if the row was purged between enqueue and worker\n      // execution (admin `PURGE_OLD`). Quiet skip — there is nothing\n      // to deliver and no caller to surface the absence to.\n      logger.warn('Webhook delivery row not found; skipping', {\n        deliveryLogId: input.deliveryLogId,\n        scopeType: input.scope.type,\n        scopeId: input.scope.id,\n      });\n      return recordAndReturn({\n        deliveryLogId: input.deliveryLogId,\n        outcome: 'skipped_missing_row',\n        attemptCount: 0,\n        durationMs: Date.now() - startedAt,\n      });\n    }\n\n    const nextAttemptCount = (row.attemptCount ?? 0) + 1;\n\n    // ── Lease the row (atomic CAS) ─────────────────────────────\n    // `markInFlight` is a compare-and-swap on `status: PENDING`. If\n    // another worker already leased the row (cron retry sweep + queue\n    // redelivery race), the CAS returns false and we exit cleanly —\n    // double-POSTs and double-counted attempts would corrupt the\n    // retry budget and the consumer's idempotency guarantees.\n    const leased = await repo.markInFlight(\n      input.scope,\n      executionContext,\n      input.deliveryLogId,\n      nextAttemptCount,\n    );\n    if (!leased) {\n      logger.warn('Webhook delivery row already leased by another worker; skipping', {\n        deliveryLogId: input.deliveryLogId,\n        scopeType: input.scope.type,\n        scopeId: input.scope.id,\n        endpointId: row.endpointId,\n        httpUrl: row.httpUrl,\n        signatureJti: row.signatureJti,\n        currentStatus: row.status,\n      });\n      return recordAndReturn({\n        deliveryLogId: input.deliveryLogId,\n        outcome: 'skipped_already_leased',\n        attemptCount: row.attemptCount ?? 0,\n        durationMs: Date.now() - startedAt,\n      });\n    }\n\n    // ── Build the JWT signature (D5: claims-JWT) ───────────────\n    // The body itself is NOT in the JWT — only its sha256 hash. This\n    // keeps the header small (some HTTP intermediaries cap header\n    // size) and lets consumers verify integrity independently of the\n    // raw body bytes (which they can re-hash).\n    const claims = {\n      // `jti` is the consumer-facing dedup key. It is stable across\n      // every retry of THIS delivery row (same value re-signed each\n      // attempt) and unique across rows. Consumers MUST dedup on\n      // `jti` — the rest of the token (`iat`, `exp`, signature) is\n      // refreshed per attempt and so cannot serve as a replay marker.\n      // See `m2m-webhook-dispatcher.backend.service.ts` (`signatureJti`\n      // creation site) for the full consumer-contract JSDoc.\n      // Claim NAMES come from the published receiver contract so the customer\n      // documentation and this signing site cannot drift apart.\n      [M2M_WEBHOOK_DELIVERY_CONTRACT.signatureClaims.deliveryId]: row.signatureJti,\n      [M2M_WEBHOOK_DELIVERY_CONTRACT.signatureClaims.bodyHash]: row.payloadHash,\n      [M2M_WEBHOOK_DELIVERY_CONTRACT.signatureClaims.bodyHashAlgorithm]: M2M_WEBHOOK_BODY_HASH_ALGORITHM,\n      [M2M_WEBHOOK_DELIVERY_CONTRACT.signatureClaims.eventChannel]: row.channel,\n      [M2M_WEBHOOK_DELIVERY_CONTRACT.signatureClaims.resourceIdentifier]: row.resourceIdentifier,\n      [M2M_WEBHOOK_DELIVERY_CONTRACT.signatureClaims.operationIdentifier]: row.operationIdentifier,\n      // `iss`, `iat`, `exp`, `aud`, `kid` defaults come from\n      // `JwtPrivateKeySignOptions[APPLICATION_WEBHOOK]`. We don't\n      // override them here — the consumer-facing contract is the\n      // signing options table, not this call site.\n    };\n\n    let signature: string;\n    try {\n      signature = await jwtService.sign(claims, JwtPrivateKeys.APPLICATION_WEBHOOK);\n    } catch (error) {\n      // Signing failure is a configuration problem (missing key) —\n      // re-trying won't help until the operator fixes secrets, so we\n      // mark the row as terminally failed and let admin RETRY pick it\n      // up after the fix.\n      const reason = describeCaughtError(error);\n      logger.error('Failed to sign webhook payload — marking delivery FAILED', {\n        deliveryLogId: input.deliveryLogId,\n        scopeType: input.scope.type,\n        scopeId: input.scope.id,\n        endpointId: row.endpointId,\n        httpUrl: row.httpUrl,\n        signatureJti: row.signatureJti,\n        attempt: nextAttemptCount,\n        error,\n      });\n      await repo.markFinallyFailed(input.scope, executionContext, input.deliveryLogId, {\n        failureReason: `JWT signing failed: ${reason}`,\n      });\n      return recordAndReturn({\n        deliveryLogId: input.deliveryLogId,\n        outcome: 'failed_terminal',\n        attemptCount: nextAttemptCount,\n        durationMs: Date.now() - startedAt,\n      });\n    }\n\n    // ── POST the body ──────────────────────────────────────────\n    // Shared with the `webhookConfig.testEndpoint` probe (see\n    // `../m2m-webhook-signed-request.backend.utils`). The admin-facing\n    // connectivity test must exercise THIS transport, not a parallel one,\n    // or a green test would prove nothing about real deliveries.\n    const bodyBytes =\n      typeof row.payload === 'string' ? row.payload : JSON.stringify(row.payload);\n\n    if (webhookEndpointTransportIsPlaintext(row.httpUrl)) {\n      const warnedKey = `${input.scope.type}:${input.scope.id}:${row.endpointId}`;\n      if (!PLAINTEXT_ENDPOINTS_ALREADY_WARNED.has(warnedKey)) {\n        PLAINTEXT_ENDPOINTS_ALREADY_WARNED.add(warnedKey);\n        // NOT debug. The whole point is that an operator meets this without going looking, and\n        // `AbstractControllerBackendService` disables the debug channel — the same trap that made a\n        // readiness breakdown unreachable in #498.\n        logger.warn('Webhook endpoint is plaintext: the delivery signature is sent in the clear', {\n          scopeType: input.scope.type,\n          scopeId: input.scope.id,\n          endpointId: row.endpointId,\n          // Host only, never the URL — a customer endpoint's path routinely carries a per-tenant\n          // token, and this line reaches the ordinary log stream.\n          destinationHost: webhookEndpointDestinationHost(row.httpUrl),\n          exposure: 'The signature JWT is readable on the network path and replayable against this '\n            + 'endpoint until it expires, so an observer of one delivery can forge the next.',\n          remedy: 'Reconfigure this endpoint with an https:// URL.',\n        });\n      }\n    }\n\n    const { responseStatus, responseBodyTruncated, networkError } = await sendSignedWebhookRequest({\n      url: row.httpUrl,\n      body: bodyBytes,\n      signature,\n    });\n\n    // Job-level duration: spans the row re-read and lease as well as the POST,\n    // so it stays the batch's own measurement rather than the transport's.\n    const durationMs = Date.now() - startedAt;\n\n    // ── Classify + persist transition ──────────────────────────\n    if (responseStatus !== undefined) {\n      const verdict = classifyResponseStatus(responseStatus);\n\n      if (verdict === 'delivered') {\n        await repo.markDelivered(input.scope, executionContext, input.deliveryLogId, {\n          responseStatus,\n          responseBodyTruncated,\n        });\n        logDebug('Webhook delivered', {\n          deliveryLogId: input.deliveryLogId,\n          scopeType: input.scope.type,\n          scopeId: input.scope.id,\n          endpointId: row.endpointId,\n          httpUrl: row.httpUrl,\n          signatureJti: row.signatureJti,\n          httpStatus: responseStatus,\n          durationMs,\n          attempt: nextAttemptCount,\n        });\n        return recordAndReturn({\n          deliveryLogId: input.deliveryLogId,\n          outcome: 'delivered',\n          attemptCount: nextAttemptCount,\n          responseStatus,\n          durationMs,\n        });\n      }\n\n      if (verdict === 'fatal') {\n        await repo.markFinallyFailed(input.scope, executionContext, input.deliveryLogId, {\n          responseStatus,\n          responseBodyTruncated,\n          failureReason: `non-retryable HTTP status ${responseStatus}`,\n        });\n        logger.warn('Webhook delivery failed (non-retryable)', {\n          deliveryLogId: input.deliveryLogId,\n          scopeType: input.scope.type,\n          scopeId: input.scope.id,\n          endpointId: row.endpointId,\n          httpUrl: row.httpUrl,\n          signatureJti: row.signatureJti,\n          httpStatus: responseStatus,\n          durationMs,\n          attempt: nextAttemptCount,\n        });\n        return recordAndReturn({\n          deliveryLogId: input.deliveryLogId,\n          outcome: 'failed_terminal',\n          attemptCount: nextAttemptCount,\n          responseStatus,\n          durationMs,\n        });\n      }\n\n      // verdict === 'retry' — fall through to the retry branch below.\n    }\n\n    // Retryable failure (5xx, 408, 429, network/timeout). Decide\n    // between scheduling another attempt and giving up.\n    const failureReason =\n      networkError ?? `retryable HTTP status ${responseStatus ?? 'unknown'}`;\n\n    if (nextAttemptCount >= MAX_ATTEMPTS) {\n      await repo.markFinallyFailed(input.scope, executionContext, input.deliveryLogId, {\n        responseStatus,\n        responseBodyTruncated,\n        failureReason: `${failureReason} (retry cap ${MAX_ATTEMPTS} reached)`,\n      });\n      logger.warn('Webhook delivery failed (retry cap reached)', {\n        deliveryLogId: input.deliveryLogId,\n        scopeType: input.scope.type,\n        scopeId: input.scope.id,\n        endpointId: row.endpointId,\n        httpUrl: row.httpUrl,\n        signatureJti: row.signatureJti,\n        httpStatus: responseStatus,\n        durationMs,\n        attempt: nextAttemptCount,\n        failureReason,\n      });\n      return recordAndReturn({\n        deliveryLogId: input.deliveryLogId,\n        outcome: 'failed_terminal',\n        attemptCount: nextAttemptCount,\n        responseStatus,\n        durationMs,\n      });\n    }\n\n    const nextAttemptAt = computeNextAttemptAt(nextAttemptCount);\n    await repo.markFailedAttempt(input.scope, executionContext, input.deliveryLogId, {\n      responseStatus,\n      responseBodyTruncated,\n      failureReason,\n      nextAttemptAt,\n    });\n    logDebug('Webhook delivery retry scheduled', {\n      deliveryLogId: input.deliveryLogId,\n      scopeType: input.scope.type,\n      scopeId: input.scope.id,\n      endpointId: row.endpointId,\n      httpUrl: row.httpUrl,\n      signatureJti: row.signatureJti,\n      httpStatus: responseStatus,\n      durationMs,\n      attempt: nextAttemptCount,\n      nextAttemptAt: nextAttemptAt.toISOString(),\n      failureReason,\n    });\n    return recordAndReturn({\n      deliveryLogId: input.deliveryLogId,\n      outcome: 'retry_scheduled',\n      attemptCount: nextAttemptCount,\n      responseStatus,\n      durationMs,\n    });\n  },\n});\n\n// Batch reference identifier lives in the declarative manifest registry\n// (`engine-custom-batch-manifests`); import `M2M_WEBHOOK_DELIVERY_BATCH_REF`\n// from there to keep a single source of truth across runtime wiring,\n// queue dispatch, and specification cross-validation.\n"]}

package/dist/esm/notifications/webhooks/outbound/batches/m2m-webhook-delivery.batch.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"m2m-webhook-delivery.batch.utils.d.ts","sourceRoot":"","sources":["../../../../../../../src/notifications/webhooks/outbound/batches/m2m-webhook-delivery.batch.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAWH,8DAA8D;AAC9D,eAAO,MAAM,YAAY,EAAE,MAAkD,CAAC;AAE9E,kDAAkD;AAClD,eAAO,MAAM,kBAAkB,EAAE,MAAuD,CAAC;AAEzF,uEAAuE;AACvE,eAAO,MAAM,8BAA8B,EAAE,MAAkE,CAAC;AAEhH,4DAA4D;AAC5D,eAAO,MAAM,kBAAkB,EAAE,MAAgD,CAAC;AAElF;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,EAAE,SAAS,MAAM,EAAyD,CAAC;AAIhH;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAEtD;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,GACb,WAAW,GAAG,OAAO,GAAG,OAAO,CASjC;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CA0BjD;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAInE"}
+{"version":3,"file":"m2m-webhook-delivery.batch.utils.d.ts","sourceRoot":"","sources":["../../../../../../src/notifications/webhooks/outbound/batches/m2m-webhook-delivery.batch.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAWH,8DAA8D;AAC9D,eAAO,MAAM,YAAY,EAAE,MAAkD,CAAC;AAE9E,kDAAkD;AAClD,eAAO,MAAM,kBAAkB,EAAE,MAAuD,CAAC;AAEzF,uEAAuE;AACvE,eAAO,MAAM,8BAA8B,EAAE,MAAkE,CAAC;AAEhH,4DAA4D;AAC5D,eAAO,MAAM,kBAAkB,EAAE,MAAgD,CAAC;AAElF;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,EAAE,SAAS,MAAM,EAAyD,CAAC;AAIhH;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAEtD;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,GACb,WAAW,GAAG,OAAO,GAAG,OAAO,CASjC;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CA0BjD;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAInE"}

package/dist/esm/notifications/webhooks/outbound/m2m-webhook-signed-request.backend.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"m2m-webhook-signed-request.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../../src/notifications/webhooks/outbound/m2m-webhook-signed-request.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,6BAA6B,EAAmB,MAAM,uBAAuB,CAAC;AA4EvF,8EAA8E;AAC9E,eAAO,MAAM,+BAA+B,EAAE,OAAO,6BAA6B,CAAC,iBAAmE,CAAC;AAEvJ;;;;;;;;GAQG;AACH,MAAM,MAAM,0BAA0B,GAAG;IACvC,2DAA2D;IAC3D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,0FAA0F;IAC1F,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,uFAAuF;IACvF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iFAAiF;IACjF,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAuCF;;;;;;;;;GASG;AACH,wBAAsB,wBAAwB,CAAC,MAAM,EAAE;IACrD,gCAAgC;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,6EAA6E;IAC7E,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAsEtC"}
+{"version":3,"file":"m2m-webhook-signed-request.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../src/notifications/webhooks/outbound/m2m-webhook-signed-request.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,6BAA6B,EAAmB,MAAM,uBAAuB,CAAC;AA4EvF,8EAA8E;AAC9E,eAAO,MAAM,+BAA+B,EAAE,OAAO,6BAA6B,CAAC,iBAAmE,CAAC;AAEvJ;;;;;;;;GAQG;AACH,MAAM,MAAM,0BAA0B,GAAG;IACvC,2DAA2D;IAC3D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,0FAA0F;IAC1F,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,uFAAuF;IACvF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iFAAiF;IACjF,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAuCF;;;;;;;;;GASG;AACH,wBAAsB,wBAAwB,CAAC,MAAM,EAAE;IACrD,gCAAgC;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,6EAA6E;IAC7E,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAsEtC"}

package/dist/esm/notifications/webhooks/outbound/m2m-webhook-signed-request.backend.utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"m2m-webhook-signed-request.backend.utils.js","sourceRoot":"","sources":["../../../../../../src/notifications/webhooks/outbound/m2m-webhook-signed-request.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,6BAA6B,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACvF,OAAO,EACL,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,sEAAsE,CAAC;AAC9E,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,YAAY,GACb,MAAM,4CAA4C,CAAC;AAEpD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,8BAA8B,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAU,CAAC;AAEpE;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,SAAS,yBAAyB,CAAC,GAAW;IAC5C,MAAM,SAAS,GAAG,yBAAyB,CAAC,GAAG,EAAE,EAAE,iBAAiB,EAAE,8BAA8B,EAAE,CAAC,CAAC;IACxG,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,SAAS;YACZ,OAAO,SAAS,CAAC;QACnB,KAAK,uBAAuB,CAAC,4BAA4B;YACvD,OAAO,kDAAkD,CAAC;QAC5D,KAAK,uBAAuB,CAAC,kBAAkB;YAC7C,0FAA0F;YAC1F,wCAAwC;YACxC,OAAO,oDAAoD,CAAC;QAC9D,KAAK,uBAAuB,CAAC,2BAA2B;YACtD,OAAO,6FAA6F,CAAC;QACvG,KAAK,uBAAuB,CAAC,6BAA6B;YACxD,OAAO,wDAAwD,CAAC;IACpE,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,MAAM,+BAA+B,GAA2D,6BAA6B,CAAC,iBAAiB,CAAC;AAsBvJ;;;;;;;;;;;;;;GAcG;AACH,SAAS,oBAAoB,CAAC,KAAc;IAC1C,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IAEpD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,OAAO,GAAY,KAAK,CAAC;IAE7B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,IAAI,OAAO,YAAY,KAAK,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACtE,kGAAkG;QAClG,MAAM,IAAI,GAAI,OAAiC,CAAC,IAAI,CAAC;QACrD,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QACzG,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAChB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC;QACD,MAAM,UAAU,GAAG,OAAO,YAAY,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACvF,OAAO,GAAG,UAAU,IAAK,OAA+B,CAAC,KAAK,CAAC;IACjE,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC;AAC5C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,MAyB9C;IACC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,iGAAiG;IACjG,oGAAoG;IACpG,8FAA8F;IAC9F,iGAAiG;IACjG,MAAM,OAAO,GAAG,yBAAyB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACtD,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC;IACvE,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;IACpC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,kBAAkB,CAAC,CAAC;IAElE,IAAI,cAAkC,CAAC;IACvC,IAAI,qBAAyC,CAAC;IAC9C,IAAI,YAAgC,CAAC;IAErC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE;YACvC,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB;;;;;;;;;;;;;;;eAeG;YACH,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,YAAY,EAAE,kBAAkB;gBAChC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,eAAe,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxF,GAAG,MAAM,CAAC,OAAO;aAClB;YACD,IAAI,EAAE,MAAM,CAAC,IAAI;SAClB,CAAC,CAAC;QACH,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,qBAAqB,GAAG,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAChE,CAAC;QAAC,MAAM,CAAC;YACP,4EAA4E;YAC5E,qBAAqB,GAAG,SAAS,CAAC;QACpC,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,YAAY,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO;YACjC,CAAC,CAAC,2BAA2B,kBAAkB,IAAI;YACnD,CAAC,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IAED,OAAO;QACL,cAAc;QACd,qBAAqB;QACrB,YAAY;QACZ,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;KACnC,CAAC;AACJ,CAAC","sourcesContent":["/**\n * The single outbound-transport primitive for M2M webhooks.\n *\n * Every signed request Wildo emits to a customer endpoint goes through\n * {@link sendSignedWebhookRequest} — the retry worker's real deliveries AND the\n * `webhookConfig.testEndpoint` synthetic probe. Two call sites, one implementation, on\n * purpose: a probe that reached the endpoint through a *different* code path would\n * validate that path rather than the delivery path, which is precisely the reassurance an\n * admin is asking for when they press \"test\". Timeout, User-Agent, signature header name,\n * and body-truncation behaviour are therefore not re-decided per caller.\n *\n * Scope boundary — this module owns the WIRE, nothing else. It does not sign (callers hold\n * their own claims), does not classify (see `classifyResponseStatus`), does not persist,\n * and never throws on a transport failure: an unreachable endpoint is data the caller must\n * report, not an exception. The only way to get an exception out of here is to pass\n * something that is not a valid request.\n *\n * The tunables come from `./batches/m2m-webhook-delivery.batch.utils`, which is\n * deliberately import-free so its pure-decision tests load without the DI graph. They are\n * left there rather than moved up here precisely to preserve that property — this module\n * performs I/O and would drag `@wildo-ai/saas-models` into those tests.\n *\n * @see batches/m2m-webhook-delivery.batch.backend.service.ts — real deliveries.\n * @see services/webhook-config-test-endpoint.custom-impl.backend.service.ts — synthetic probe.\n */\n\nimport { M2M_WEBHOOK_DELIVERY_CONTRACT, WildoHeaderKeys } from '@wildo-ai/saas-models';\nimport {\n  OutboundTargetRejection,\n  classifyOutboundTargetUrl,\n} from '~wildo-backend-lib/security/ssrf/outbound-target-guard.backend.utils';\nimport {\n  REQUEST_TIMEOUT_MS,\n  WEBHOOK_USER_AGENT,\n  truncateBody,\n} from './batches/m2m-webhook-delivery.batch.utils';\n\n/**\n * Schemes an outbound webhook delivery may use.\n *\n * `http:` is admitted. DECIDED 2026-09-08 (#492): keep admitting it, and document the exposure where\n * a customer authors the endpoint — which is now done, on `WebhookEndpointSchema.url`.\n *\n * This is a COMMERCIAL accommodation, not a security assessment, and the distinction is the whole\n * point of writing it down. The A2A sibling requires HTTPS unconditionally and the same argument\n * applies here — the signature JWT in transit is a credential, readable on the path and replayable\n * until it expires, so an observer of one delivery can forge the next. What was chosen is not to break\n * endpoints that a previous version of the framework accepted.\n *\n * The two options NOT taken, either of which is the better security answer: require HTTPS with a\n * migration that identifies and notifies existing plaintext endpoints, or require it for new endpoints\n * and grandfather existing ones behind an explicit acknowledgement. The second is the one to revisit\n * first — it stops the plaintext population growing without breaking anyone today.\n *\n * Reopen on an observed interception, or on a customer compliance requirement. Do not reopen it as a\n * tidy-up: the asymmetry with the A2A caller is deliberate and is recorded at both sites.\n */\nconst M2M_WEBHOOK_ADMITTED_PROTOCOLS = ['https:', 'http:'] as const;\n\n/**\n * Refuse a destination that would turn this server into a request-forgery tool.\n *\n * ## Why the guard is HERE and not on the schema\n *\n * `WebhookEndpointSchema.url` validates shape (`z.url()`) and nothing else, so an admin could author\n * `http://169.254.169.254/latest/meta-data/` and the engine would POST signed payloads to the cloud\n * instance-metadata service — then capture the answer into the delivery log as\n * `responseBodyTruncated`. That makes it a READ primitive, not a blind SSRF, and\n * `webhookConfig.testEndpoint` is a low-friction oracle for it.\n *\n * A schema refine would leave two holes this placement does not have: it would not cover endpoints\n * ALREADY STORED before the refine existed, and it would not cover the A2A push-delivery worker,\n * which reaches this same primitive with a URL its own (separate) guard validated at configuration\n * time. Putting the check at the wire makes it unbypassable for every caller — present and future —\n * which is what `.claude/rules/invariant-call-site-enumeration.md` means by preferring one\n * chokepoint over N hand-applied predicates.\n *\n * ## What it cannot do\n *\n * An ordinary hostname is not resolved, so `hook.attacker.test` with an A record of `169.254.169.254`\n * still passes. That residual is inherited from the shared classifier and is stated there; closing it\n * needs either a resolving check (a check-then-connect, still open to rebinding) or egress-path\n * enforcement. It is a deliberate open item, not an oversight.\n */\nfunction refuseUnsafeWebhookTarget(url: string): string | undefined {\n  const rejection = classifyOutboundTargetUrl(url, { admittedProtocols: M2M_WEBHOOK_ADMITTED_PROTOCOLS });\n  switch (rejection) {\n    case undefined:\n      return undefined;\n    case OutboundTargetRejection.NOT_ABSOLUTE_ADMITTED_SCHEME:\n      return 'refused: endpoint is not an absolute http(s) URL';\n    case OutboundTargetRejection.CREDENTIALS_IN_URL:\n      // Credentials in the URL would be replayed on every delivery and would land in any log or\n      // delivery row that records the target.\n      return 'refused: endpoint URL carries embedded credentials';\n    case OutboundTargetRejection.PRIVATE_OR_RESERVED_ADDRESS:\n      return 'refused: endpoint resolves to a private, loopback, link-local or otherwise reserved address';\n    case OutboundTargetRejection.RESERVED_SPECIAL_USE_HOSTNAME:\n      return 'refused: endpoint uses a reserved special-use hostname';\n  }\n}\n\n/** Consumer-facing digest algorithm carried in every outbound webhook JWT. */\nexport const M2M_WEBHOOK_BODY_HASH_ALGORITHM: typeof M2M_WEBHOOK_DELIVERY_CONTRACT.bodyHashAlgorithm = M2M_WEBHOOK_DELIVERY_CONTRACT.bodyHashAlgorithm;\n\n/**\n * Outcome of one attempt at the wire level.\n *\n * `responseStatus` and `networkError` are mutually exclusive and exhaustive: either the\n * endpoint produced an HTTP response or it did not. Callers classify from there — this\n * type deliberately carries no verdict of its own, because \"429 is retryable\" is a\n * delivery-policy question and \"429 means the endpoint is reachable\" is a probe question,\n * and the same status answers both differently.\n */\nexport type SignedWebhookRequestResult = {\n  /** Set when the endpoint answered, whatever the status. */\n  responseStatus?: number;\n  /** Best-effort capture of the consumer's response body, truncated on a UTF-8 boundary. */\n  responseBodyTruncated?: string;\n  /** Set when no HTTP response was obtained (DNS/TLS/connection failure, or timeout). */\n  networkError?: string;\n  /** Wall-clock duration of this attempt alone, excluding any caller-side work. */\n  durationMs: number;\n};\n\n/**\n * Render a `fetch` rejection into something an operator can act on.\n *\n * Node's `fetch` (undici) rejects with a flat `TypeError: fetch failed` and buries the actual\n * cause — `ECONNREFUSED`, `ENOTFOUND`, `EHOSTUNREACH`, a TLS failure — one or more levels down in\n * `error.cause`. Reporting only `error.message` tells an admin their endpoint failed without\n * telling them whether the hostname is wrong, the port is closed, or the certificate is bad; for a\n * diagnostic whose entire job is to explain a failure, that is barely better than the silent\n * success this operation used to return. So walk the cause chain and append what it names.\n *\n * `AggregateError` (emitted when every resolved address fails, e.g. happy-eyeballs against a dead\n * host) carries its detail in `errors[]` rather than `cause`, so that shape is unwrapped too.\n * Depth-capped and de-duplicated: the chain is attacker-adjacent input in the sense that a hostile\n * endpoint controls how deep it goes, and a repeated message adds nothing.\n */\nfunction describeFetchFailure(error: unknown): string {\n  if (!(error instanceof Error)) return String(error);\n\n  const parts: string[] = [];\n  const seen = new Set<string>();\n  let current: unknown = error;\n\n  for (let depth = 0; depth < 4 && current instanceof Error; depth += 1) {\n    // `code` is where Node puts the actionable token (ECONNREFUSED, …); the message often repeats it.\n    const code = (current as NodeJS.ErrnoException).code;\n    const label = code && !current.message.includes(code) ? `${current.message} (${code})` : current.message;\n    if (label && !seen.has(label)) {\n      seen.add(label);\n      parts.push(label);\n    }\n    const aggregated = current instanceof AggregateError ? current.errors?.[0] : undefined;\n    current = aggregated ?? (current as { cause?: unknown }).cause;\n  }\n\n  return parts.join(': ') || 'fetch failed';\n}\n\n/**\n * POST a pre-signed body to a webhook endpoint under a hard timeout.\n *\n * Never throws for a transport failure — a refused connection, a DNS miss and a timeout\n * all come back as `networkError`. A timeout is reported with its budget spelled out\n * because \"timed out\" alone sends an operator hunting for the wrong thing.\n *\n * Body capture is best-effort: a consumer that returns an unreadable body still produced a\n * valid status, and losing the body must not turn a successful attempt into a failed one.\n */\nexport async function sendSignedWebhookRequest(params: {\n  /** Absolute destination URL. */\n  url: string;\n  /** Exact bytes to send — already the string whose hash the caller signed. */\n  body: string;\n  /**\n   * Value for the `X-Webhook-Signature` header. Omit when the caller authenticates by another\n   * mechanism and supplies its own {@link headers} — see below.\n   */\n  signature?: string;\n  /**\n   * Caller-supplied headers, MERGED OVER the defaults.\n   *\n   * Added for the A2A push-notification worker, which authenticates with the CLIENT's declared\n   * scheme (`Authorization: {scheme} {credentials}`) and sends `application/a2a+json` rather than\n   * Wildo's own ES256 signature and `application/json`.\n   *\n   * Widening this primitive instead of writing a second POST is deliberate, and follows the module\n   * header's own claim to own THE WIRE: timeout, abort handling, failure description and body\n   * truncation are the parts that are easy to get subtly wrong and expensive to have two of. What\n   * varies between callers is authentication and media type — which are exactly the two things a\n   * caller is in a position to decide. Purely additive: `signature` stays optional-by-absence for\n   * the two existing M2M call sites, whose behaviour is byte-for-byte unchanged.\n   */\n  headers?: Record<string, string>;\n}): Promise<SignedWebhookRequestResult> {\n  const startedAt = Date.now();\n\n  // Refused BEFORE any timer or connection: a target the guard rejects must produce no DNS lookup,\n  // no socket, and no signed body on the wire. Reported as `networkError` rather than thrown, because\n  // this module's contract is that a destination problem is DATA the caller reports — the probe\n  // surfaces it to the admin as UNREACHABLE and the delivery worker records it on the attempt row.\n  const refusal = refuseUnsafeWebhookTarget(params.url);\n  if (refusal) {\n    return { networkError: refusal, durationMs: Date.now() - startedAt };\n  }\n\n  const abort = new AbortController();\n  const timer = setTimeout(() => abort.abort(), REQUEST_TIMEOUT_MS);\n\n  let responseStatus: number | undefined;\n  let responseBodyTruncated: string | undefined;\n  let networkError: string | undefined;\n\n  try {\n    const response = await fetch(params.url, {\n      method: 'POST',\n      signal: abort.signal,\n      /**\n       * A redirect is REPORTED, never followed.\n       *\n       * Following one re-points the request at a target the guard above never saw, which is the\n       * guard's most obvious bypass — an admin authors a public URL that 302s to\n       * `http://169.254.169.254/`. It also silently defeats a decision this subsystem had ALREADY\n       * taken and could not enforce: `classifyResponseStatus` classifies 3xx as `fatal` and\n       * `resolveProbeOutcome` classifies it as REJECTED (\"webhooks must not redirect, and a\n       * CDN/proxy redirect on a wrong URL is one of the most common real misconfigurations an admin\n       * uses this probe to find\") — but with `fetch`'s default follow behaviour neither of those\n       * branches could ever execute, because a 3xx never reached them.\n       *\n       * `'manual'` rather than `'error'` on purpose: `'error'` would surface as an opaque network\n       * failure, whereas `'manual'` hands back the 3xx status so both classifiers see the redirect\n       * and tell the admin exactly what their endpoint did.\n       */\n      redirect: 'manual',\n      headers: {\n        'Content-Type': 'application/json',\n        'User-Agent': WEBHOOK_USER_AGENT,\n        ...(params.signature ? { [WildoHeaderKeys.X_WEBHOOK_SIGNATURE]: params.signature } : {}),\n        ...params.headers,\n      },\n      body: params.body,\n    });\n    responseStatus = response.status;\n    try {\n      const text = await response.text();\n      responseBodyTruncated = text ? truncateBody(text) : undefined;\n    } catch {\n      // Best-effort body capture — never fail the attempt on a non-readable body.\n      responseBodyTruncated = undefined;\n    }\n  } catch (error) {\n    networkError = abort.signal.aborted\n      ? `request timed out after ${REQUEST_TIMEOUT_MS}ms`\n      : describeFetchFailure(error);\n  } finally {\n    clearTimeout(timer);\n  }\n\n  return {\n    responseStatus,\n    responseBodyTruncated,\n    networkError,\n    durationMs: Date.now() - startedAt,\n  };\n}\n"]}
+{"version":3,"file":"m2m-webhook-signed-request.backend.utils.js","sourceRoot":"","sources":["../../../../../src/notifications/webhooks/outbound/m2m-webhook-signed-request.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,6BAA6B,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACvF,OAAO,EACL,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,sEAAsE,CAAC;AAC9E,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,YAAY,GACb,MAAM,4CAA4C,CAAC;AAEpD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,8BAA8B,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAU,CAAC;AAEpE;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,SAAS,yBAAyB,CAAC,GAAW;IAC5C,MAAM,SAAS,GAAG,yBAAyB,CAAC,GAAG,EAAE,EAAE,iBAAiB,EAAE,8BAA8B,EAAE,CAAC,CAAC;IACxG,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,SAAS;YACZ,OAAO,SAAS,CAAC;QACnB,KAAK,uBAAuB,CAAC,4BAA4B;YACvD,OAAO,kDAAkD,CAAC;QAC5D,KAAK,uBAAuB,CAAC,kBAAkB;YAC7C,0FAA0F;YAC1F,wCAAwC;YACxC,OAAO,oDAAoD,CAAC;QAC9D,KAAK,uBAAuB,CAAC,2BAA2B;YACtD,OAAO,6FAA6F,CAAC;QACvG,KAAK,uBAAuB,CAAC,6BAA6B;YACxD,OAAO,wDAAwD,CAAC;IACpE,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,MAAM,+BAA+B,GAA2D,6BAA6B,CAAC,iBAAiB,CAAC;AAsBvJ;;;;;;;;;;;;;;GAcG;AACH,SAAS,oBAAoB,CAAC,KAAc;IAC1C,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IAEpD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,OAAO,GAAY,KAAK,CAAC;IAE7B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,IAAI,OAAO,YAAY,KAAK,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACtE,kGAAkG;QAClG,MAAM,IAAI,GAAI,OAAiC,CAAC,IAAI,CAAC;QACrD,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QACzG,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAChB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC;QACD,MAAM,UAAU,GAAG,OAAO,YAAY,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACvF,OAAO,GAAG,UAAU,IAAK,OAA+B,CAAC,KAAK,CAAC;IACjE,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC;AAC5C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,MAyB9C;IACC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,iGAAiG;IACjG,oGAAoG;IACpG,8FAA8F;IAC9F,iGAAiG;IACjG,MAAM,OAAO,GAAG,yBAAyB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACtD,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC;IACvE,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;IACpC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,kBAAkB,CAAC,CAAC;IAElE,IAAI,cAAkC,CAAC;IACvC,IAAI,qBAAyC,CAAC;IAC9C,IAAI,YAAgC,CAAC;IAErC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE;YACvC,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB;;;;;;;;;;;;;;;eAeG;YACH,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,YAAY,EAAE,kBAAkB;gBAChC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,eAAe,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxF,GAAG,MAAM,CAAC,OAAO;aAClB;YACD,IAAI,EAAE,MAAM,CAAC,IAAI;SAClB,CAAC,CAAC;QACH,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,qBAAqB,GAAG,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAChE,CAAC;QAAC,MAAM,CAAC;YACP,4EAA4E;YAC5E,qBAAqB,GAAG,SAAS,CAAC;QACpC,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,YAAY,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO;YACjC,CAAC,CAAC,2BAA2B,kBAAkB,IAAI;YACnD,CAAC,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IAED,OAAO;QACL,cAAc;QACd,qBAAqB;QACrB,YAAY;QACZ,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;KACnC,CAAC;AACJ,CAAC","sourcesContent":["/**\n * The single outbound-transport primitive for M2M webhooks.\n *\n * Every signed request Wildo emits to a customer endpoint goes through\n * {@link sendSignedWebhookRequest} — the retry worker's real deliveries AND the\n * `webhookConfig.testEndpoint` synthetic probe. Two call sites, one implementation, on\n * purpose: a probe that reached the endpoint through a *different* code path would\n * validate that path rather than the delivery path, which is precisely the reassurance an\n * admin is asking for when they press \"test\". Timeout, User-Agent, signature header name,\n * and body-truncation behaviour are therefore not re-decided per caller.\n *\n * Scope boundary — this module owns the WIRE, nothing else. It does not sign (callers hold\n * their own claims), does not classify (see `classifyResponseStatus`), does not persist,\n * and never throws on a transport failure: an unreachable endpoint is data the caller must\n * report, not an exception. The only way to get an exception out of here is to pass\n * something that is not a valid request.\n *\n * The tunables come from `./batches/m2m-webhook-delivery.batch.utils`, which is\n * deliberately import-free so its pure-decision tests load without the DI graph. They are\n * left there rather than moved up here precisely to preserve that property — this module\n * performs I/O and would drag `@wildo-ai/saas-models` into those tests.\n *\n * @see batches/m2m-webhook-delivery.batch.backend.service.ts — real deliveries.\n * @see services/webhook-config-test-endpoint.custom-impl.backend.service.ts — synthetic probe.\n */\n\nimport { M2M_WEBHOOK_DELIVERY_CONTRACT, WildoHeaderKeys } from '@wildo-ai/saas-models';\nimport {\n  OutboundTargetRejection,\n  classifyOutboundTargetUrl,\n} from '~wildo-backend-lib/security/ssrf/outbound-target-guard.backend.utils';\nimport {\n  REQUEST_TIMEOUT_MS,\n  WEBHOOK_USER_AGENT,\n  truncateBody,\n} from './batches/m2m-webhook-delivery.batch.utils';\n\n/**\n * Schemes an outbound webhook delivery may use.\n *\n * `http:` is admitted. DECIDED 2026-09-08 (#492): keep admitting it, and document the exposure where\n * a customer authors the endpoint — which is now done, on `WebhookEndpointSchema.url`.\n *\n * This is a COMMERCIAL accommodation, not a security assessment, and the distinction is the whole\n * point of writing it down. The A2A sibling requires HTTPS unconditionally and the same argument\n * applies here — the signature JWT in transit is a credential, readable on the path and replayable\n * until it expires, so an observer of one delivery can forge the next. What was chosen is not to break\n * endpoints that a previous version of the framework accepted.\n *\n * The two options NOT taken, either of which is the better security answer: require HTTPS with a\n * migration that identifies and notifies existing plaintext endpoints, or require it for new endpoints\n * and grandfather existing ones behind an explicit acknowledgement. The second is the one to revisit\n * first — it stops the plaintext population growing without breaking anyone today.\n *\n * Reopen on an observed interception, or on a customer compliance requirement. Do not reopen it as a\n * tidy-up: the asymmetry with the A2A caller is deliberate and is recorded at both sites.\n */\nconst M2M_WEBHOOK_ADMITTED_PROTOCOLS = ['https:', 'http:'] as const;\n\n/**\n * Refuse a destination that would turn this server into a request-forgery tool.\n *\n * ## Why the guard is HERE and not on the schema\n *\n * `WebhookEndpointSchema.url` validates shape (`z.url()`) and nothing else, so an admin could author\n * `http://169.254.169.254/latest/meta-data/` and the engine would POST signed payloads to the cloud\n * instance-metadata service — then capture the answer into the delivery log as\n * `responseBodyTruncated`. That makes it a READ primitive, not a blind SSRF, and\n * `webhookConfig.testEndpoint` is a low-friction oracle for it.\n *\n * A schema refine would leave two holes this placement does not have: it would not cover endpoints\n * ALREADY STORED before the refine existed, and it would not cover the A2A push-delivery worker,\n * which reaches this same primitive with a URL its own (separate) guard validated at configuration\n * time. Putting the check at the wire makes it unbypassable for every caller — present and future —\n * which is what `.claude/rules/invariant-call-site-enumeration.md` means by preferring one\n * chokepoint over N hand-applied predicates.\n *\n * ## What it cannot do\n *\n * An ordinary hostname is not resolved, so `hook.attacker.test` with an A record of `169.254.169.254`\n * still passes. That residual is inherited from the shared classifier and is stated there; closing it\n * needs either a resolving check (a check-then-connect, still open to rebinding) or egress-path\n * enforcement. It is a deliberate open item, not an oversight.\n */\nfunction refuseUnsafeWebhookTarget(url: string): string | undefined {\n  const rejection = classifyOutboundTargetUrl(url, { admittedProtocols: M2M_WEBHOOK_ADMITTED_PROTOCOLS });\n  switch (rejection) {\n    case undefined:\n      return undefined;\n    case OutboundTargetRejection.NOT_ABSOLUTE_ADMITTED_SCHEME:\n      return 'refused: endpoint is not an absolute http(s) URL';\n    case OutboundTargetRejection.CREDENTIALS_IN_URL:\n      // Credentials in the URL would be replayed on every delivery and would land in any log or\n      // delivery row that records the target.\n      return 'refused: endpoint URL carries embedded credentials';\n    case OutboundTargetRejection.PRIVATE_OR_RESERVED_ADDRESS:\n      return 'refused: endpoint resolves to a private, loopback, link-local or otherwise reserved address';\n    case OutboundTargetRejection.RESERVED_SPECIAL_USE_HOSTNAME:\n      return 'refused: endpoint uses a reserved special-use hostname';\n  }\n}\n\n/** Consumer-facing digest algorithm carried in every outbound webhook JWT. */\nexport const M2M_WEBHOOK_BODY_HASH_ALGORITHM: typeof M2M_WEBHOOK_DELIVERY_CONTRACT.bodyHashAlgorithm = M2M_WEBHOOK_DELIVERY_CONTRACT.bodyHashAlgorithm;\n\n/**\n * Outcome of one attempt at the wire level.\n *\n * `responseStatus` and `networkError` are mutually exclusive and exhaustive: either the\n * endpoint produced an HTTP response or it did not. Callers classify from there — this\n * type deliberately carries no verdict of its own, because \"429 is retryable\" is a\n * delivery-policy question and \"429 means the endpoint is reachable\" is a probe question,\n * and the same status answers both differently.\n */\nexport type SignedWebhookRequestResult = {\n  /** Set when the endpoint answered, whatever the status. */\n  responseStatus?: number;\n  /** Best-effort capture of the consumer's response body, truncated on a UTF-8 boundary. */\n  responseBodyTruncated?: string;\n  /** Set when no HTTP response was obtained (DNS/TLS/connection failure, or timeout). */\n  networkError?: string;\n  /** Wall-clock duration of this attempt alone, excluding any caller-side work. */\n  durationMs: number;\n};\n\n/**\n * Render a `fetch` rejection into something an operator can act on.\n *\n * Node's `fetch` (undici) rejects with a flat `TypeError: fetch failed` and buries the actual\n * cause — `ECONNREFUSED`, `ENOTFOUND`, `EHOSTUNREACH`, a TLS failure — one or more levels down in\n * `error.cause`. Reporting only `error.message` tells an admin their endpoint failed without\n * telling them whether the hostname is wrong, the port is closed, or the certificate is bad; for a\n * diagnostic whose entire job is to explain a failure, that is barely better than the silent\n * success this operation used to return. So walk the cause chain and append what it names.\n *\n * `AggregateError` (emitted when every resolved address fails, e.g. happy-eyeballs against a dead\n * host) carries its detail in `errors[]` rather than `cause`, so that shape is unwrapped too.\n * Depth-capped and de-duplicated: the chain is attacker-adjacent input in the sense that a hostile\n * endpoint controls how deep it goes, and a repeated message adds nothing.\n */\nfunction describeFetchFailure(error: unknown): string {\n  if (!(error instanceof Error)) return String(error);\n\n  const parts: string[] = [];\n  const seen = new Set<string>();\n  let current: unknown = error;\n\n  for (let depth = 0; depth < 4 && current instanceof Error; depth += 1) {\n    // `code` is where Node puts the actionable token (ECONNREFUSED, …); the message often repeats it.\n    const code = (current as NodeJS.ErrnoException).code;\n    const label = code && !current.message.includes(code) ? `${current.message} (${code})` : current.message;\n    if (label && !seen.has(label)) {\n      seen.add(label);\n      parts.push(label);\n    }\n    const aggregated = current instanceof AggregateError ? current.errors?.[0] : undefined;\n    current = aggregated ?? (current as { cause?: unknown }).cause;\n  }\n\n  return parts.join(': ') || 'fetch failed';\n}\n\n/**\n * POST a pre-signed body to a webhook endpoint under a hard timeout.\n *\n * Never throws for a transport failure — a refused connection, a DNS miss and a timeout\n * all come back as `networkError`. A timeout is reported with its budget spelled out\n * because \"timed out\" alone sends an operator hunting for the wrong thing.\n *\n * Body capture is best-effort: a consumer that returns an unreadable body still produced a\n * valid status, and losing the body must not turn a successful attempt into a failed one.\n */\nexport async function sendSignedWebhookRequest(params: {\n  /** Absolute destination URL. */\n  url: string;\n  /** Exact bytes to send — already the string whose hash the caller signed. */\n  body: string;\n  /**\n   * Value for the `X-Webhook-Signature` header. Omit when the caller authenticates by another\n   * mechanism and supplies its own {@link headers} — see below.\n   */\n  signature?: string;\n  /**\n   * Caller-supplied headers, MERGED OVER the defaults.\n   *\n   * Added for the A2A push-notification worker, which authenticates with the CLIENT's declared\n   * scheme (`Authorization: {scheme} {credentials}`) and sends `application/a2a+json` rather than\n   * Wildo's own ES256 signature and `application/json`.\n   *\n   * Widening this primitive instead of writing a second POST is deliberate, and follows the module\n   * header's own claim to own THE WIRE: timeout, abort handling, failure description and body\n   * truncation are the parts that are easy to get subtly wrong and expensive to have two of. What\n   * varies between callers is authentication and media type — which are exactly the two things a\n   * caller is in a position to decide. Purely additive: `signature` stays optional-by-absence for\n   * the two existing M2M call sites, whose behaviour is byte-for-byte unchanged.\n   */\n  headers?: Record<string, string>;\n}): Promise<SignedWebhookRequestResult> {\n  const startedAt = Date.now();\n\n  // Refused BEFORE any timer or connection: a target the guard rejects must produce no DNS lookup,\n  // no socket, and no signed body on the wire. Reported as `networkError` rather than thrown, because\n  // this module's contract is that a destination problem is DATA the caller reports — the probe\n  // surfaces it to the admin as UNREACHABLE and the delivery worker records it on the attempt row.\n  const refusal = refuseUnsafeWebhookTarget(params.url);\n  if (refusal) {\n    return { networkError: refusal, durationMs: Date.now() - startedAt };\n  }\n\n  const abort = new AbortController();\n  const timer = setTimeout(() => abort.abort(), REQUEST_TIMEOUT_MS);\n\n  let responseStatus: number | undefined;\n  let responseBodyTruncated: string | undefined;\n  let networkError: string | undefined;\n\n  try {\n    const response = await fetch(params.url, {\n      method: 'POST',\n      signal: abort.signal,\n      /**\n       * A redirect is REPORTED, never followed.\n       *\n       * Following one re-points the request at a target the guard above never saw, which is the\n       * guard's most obvious bypass — an admin authors a public URL that 302s to\n       * `http://169.254.169.254/`. It also silently defeats a decision this subsystem had ALREADY\n       * taken and could not enforce: `classifyResponseStatus` classifies 3xx as `fatal` and\n       * `resolveProbeOutcome` classifies it as REJECTED (\"webhooks must not redirect, and a\n       * CDN/proxy redirect on a wrong URL is one of the most common real misconfigurations an admin\n       * uses this probe to find\") — but with `fetch`'s default follow behaviour neither of those\n       * branches could ever execute, because a 3xx never reached them.\n       *\n       * `'manual'` rather than `'error'` on purpose: `'error'` would surface as an opaque network\n       * failure, whereas `'manual'` hands back the 3xx status so both classifiers see the redirect\n       * and tell the admin exactly what their endpoint did.\n       */\n      redirect: 'manual',\n      headers: {\n        'Content-Type': 'application/json',\n        'User-Agent': WEBHOOK_USER_AGENT,\n        ...(params.signature ? { [WildoHeaderKeys.X_WEBHOOK_SIGNATURE]: params.signature } : {}),\n        ...params.headers,\n      },\n      body: params.body,\n    });\n    responseStatus = response.status;\n    try {\n      const text = await response.text();\n      responseBodyTruncated = text ? truncateBody(text) : undefined;\n    } catch {\n      // Best-effort body capture — never fail the attempt on a non-readable body.\n      responseBodyTruncated = undefined;\n    }\n  } catch (error) {\n    networkError = abort.signal.aborted\n      ? `request timed out after ${REQUEST_TIMEOUT_MS}ms`\n      : describeFetchFailure(error);\n  } finally {\n    clearTimeout(timer);\n  }\n\n  return {\n    responseStatus,\n    responseBodyTruncated,\n    networkError,\n    durationMs: Date.now() - startedAt,\n  };\n}\n"]}

package/dist/esm/notifications/webhooks/outbound/services/m2m-webhook-delivery-log.custom-impl.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"m2m-webhook-delivery-log.custom-impl.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../../src/notifications/webhooks/outbound/services/m2m-webhook-delivery-log.custom-impl.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAaH,OAAO,EAEL,KAAK,0CAA0C,EAChD,MAAM,4GAA4G,CAAC;AAiCpH,wBAAgB,yCAAyC,IAAI,0CAA0C,EAAE,CA2ExG;AAED,wBAAgB,4CAA4C,IAAI,0CAA0C,EAAE,CAyC3G"}
+{"version":3,"file":"m2m-webhook-delivery-log.custom-impl.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/notifications/webhooks/outbound/services/m2m-webhook-delivery-log.custom-impl.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAaH,OAAO,EAEL,KAAK,0CAA0C,EAChD,MAAM,4GAA4G,CAAC;AAiCpH,wBAAgB,yCAAyC,IAAI,0CAA0C,EAAE,CA2ExG;AAED,wBAAgB,4CAA4C,IAAI,0CAA0C,EAAE,CAyC3G"}