@wildo-ai/saas-backend-lib 1.1.8 → 1.1.9

package/dist/esm/queue/scheduled-message-verifier.backend.service.d.ts

@@ -9,7 +9,7 @@
 import { LoggerService } from '../monitoring/logger/services/logger.service';
 import { JwtBackendService } from '../security/jwt/services/jwt.backend.service';
 import { ErrorBuilderBackendService } from '../errors/services/error-builder.backend.service';
-import { JobPayload, JobType } from '@wildo-ai/saas-models';
+import { JobPayload, JobType, ScheduledDeliveryLateness } from '@wildo-ai/saas-models';
 import { z } from 'zod';
 /**
  * Schema for the SCHEDULED_CRON arm of the scheduled-job token (the
@@ -78,16 +78,46 @@ export type ScheduledJobToken = z.infer<typeof ScheduledJobTokenSchema>;
 export type ScheduledCronJobToken = z.infer<typeof ScheduledCronJobTokenSchema>;
 export type MinionTickJobToken = z.infer<typeof MinionTickJobTokenSchema>;
 /**
- * Result of scheduled message verification.
+ * What a scheduled delivery IS, decided before anything durable happens (#2212).
+ *
+ * Three answers, not two, because "not admissible" hid two opposite situations behind one
+ * `AUTHENTICATION` error: a genuine token that waited out its window in a queue nobody consumed
+ * (operational — the application was down) and a token that cannot be proven genuine (a trust
+ * signal). Logged identically, 139 of the first per restart read as a credential outage and sent the
+ * diagnosis to the wrong service.
  */
-export interface ScheduledMessageVerificationResult {
-    /** Whether the message is valid */
-    isValid: boolean;
-    /** The verified token payload (if valid) */
-    token?: ScheduledJobToken;
-    /** Error message (if invalid) */
-    error?: string;
+export declare enum ScheduledDeliveryVerdict {
+    /** Authentic, inside its admission window: admit it. */
+    ADMISSIBLE = "admissible",
+    /** Authentic (signature, issuer, audience, structure all proven) but past its admission deadline: the occurrence was MISSED. */
+    LATE = "late",
+    /** Not provably authentic, or it names an occurrence in the future: a trust failure. */
+    REJECTED = "rejected"
 }
+/** Result of scheduled message verification. */
+export type ScheduledMessageVerificationResult = {
+    verdict: ScheduledDeliveryVerdict.ADMISSIBLE;
+    token: ScheduledJobToken;
+} | {
+    verdict: ScheduledDeliveryVerdict.LATE;
+    token: ScheduledJobToken;
+    lateness: ScheduledDeliveryLateness;
+} | {
+    verdict: ScheduledDeliveryVerdict.REJECTED;
+    error: string;
+};
+/**
+ * An authentic delivery, converted for its consumer. Only the two authentic verdicts are
+ * representable here; a rejection is thrown by the `verifyAnd…` entry points.
+ */
+export type AuthenticScheduledDelivery<T> = {
+    verdict: ScheduledDeliveryVerdict.ADMISSIBLE;
+    value: T;
+} | {
+    verdict: ScheduledDeliveryVerdict.LATE;
+    value: T;
+    lateness: ScheduledDeliveryLateness;
+};
 export declare class ScheduledMessageVerifierBackendService {
     private readonly jwtService;
     private readonly logger;
@@ -95,12 +125,32 @@ export declare class ScheduledMessageVerifierBackendService {
     protected logDebug: (message: string, context?: Record<string, unknown>) => void;
     constructor(jwtService: JwtBackendService, logger: LoggerService, errorBuilder: ErrorBuilderBackendService);
     /**
-     * Verify a scheduled job message token.
+     * Classify a scheduled job message token: admissible, late, or rejected.
+     *
+     * Only a REJECTED verdict logs here (warn), because only it is a trust signal. A LATE delivery is
+     * reported by the consumer's runner as one digest per drain, not once per message.
      *
      * @param token - The JWT token from the message
-     * @returns Verification result with token payload if valid
      */
     verifyScheduledMessage(token: string): Promise<ScheduledMessageVerificationResult>;
+    /**
+     * The payload of a token whose ONLY defect is expiry — or, when it is not provably that, why.
+     *
+     * `jsonwebtoken` checks expiry before audience and issuer, so a `TokenExpiredError` alone proves
+     * the signature and nothing more. Re-verifying with expiry ignored — quietly, through the same key
+     * set, rotation included — proves issuer and audience too, and the `exp` check below confirms the
+     * first failure really was the clock. Any other first failure (bad signature, wrong audience, an
+     * unknown key) fails this re-verification and stays a rejection. The late payload is never ADMITTED,
+     * so this cannot turn an expired token into a run; it only decides how the miss is reported.
+     *
+     * A token that expired longer ago than `SCHEDULED_LATE_DELIVERY_HORIZON_MS` is refused too: no
+     * genuine backlog is that old, and an authentic-but-ancient token is what a replay looks like.
+     *
+     * `refused` carries the re-verification's own error when it threw, and is `undefined` when the
+     * token re-verified but is not a recordable late delivery (not expired, or past the horizon).
+     */
+    private authenticatedExpiredPayload;
+    private rejected;
     /**
      * Convert a verified `SCHEDULED_CRON` token to a JobPayload for
      * execution by the resource-operation / custom-batch executor pipeline.
@@ -113,19 +163,20 @@ export declare class ScheduledMessageVerifierBackendService {
     convertToJobPayload(token: ScheduledCronJobToken): JobPayload;
     /**
      * Verify and convert a `SCHEDULED_CRON` scheduled message in one step.
-     * Throws if verification fails OR if the token is a `MINION_TICK`
-     * (which the resource-operation / custom-batch executor cannot
-     * dispatch; the minion runtime owns those — use
-     * `verifyAndExtractMinionTick`).
+     *
+     * Returns the converted payload with its verdict — ADMISSIBLE, or LATE with why — and throws only
+     * when the delivery is not authentic, or is a `MINION_TICK` (which the resource-operation /
+     * custom-batch executor cannot dispatch; the minion runtime owns those — use
+     * `verifyAndExtractMinionTick`). A LATE delivery is returned, never thrown: it is genuine, and the
+     * consumer records it as a missed occurrence instead of failing it (#2212).
      *
      * @param token - The JWT token from the message
-     * @returns JobPayload ready for execution
      * @throws WildoError if verification fails or the token targets a minion
      */
-    verifyAndConvert(token: string): Promise<JobPayload>;
+    verifyAndConvert(token: string): Promise<AuthenticScheduledDelivery<JobPayload>>;
     /**
      * Verify a scheduled message and extract a `MinionTickJobToken` if and
-     * only if the token targets the given minion (KD-12).
+     * only if the token targets the given minion (KD-12), with its verdict.
      *
      * Returns `null` (not throws) for the two non-actionable cases that the
      * minion runtime should silently skip:
@@ -133,8 +184,9 @@ export declare class ScheduledMessageVerifierBackendService {
      * - the token is a `MINION_TICK` whose `minionName` does not match
      *   `expectedMinionName`.
      *
-     * Throws (typed authentication error) only when verification itself
-     * fails — invalid signature, malformed payload, wrong issuer/audience.
+     * A LATE tick is returned with its lateness, exactly like `verifyAndConvert` (#2212). Throws (typed
+     * authentication error) only when the delivery is not authentic — invalid signature, malformed
+     * payload, wrong issuer/audience, a future occurrence.
      *
      * The minion-side consumer passes its compiled-in `minionName` (from
      * `defineMinionInit({ minionName })`, cross-validated against the fetched
@@ -143,7 +195,7 @@ export declare class ScheduledMessageVerifierBackendService {
      * should be NACK'd back to the queue (or skipped, depending on the
      * queue-routing strategy chosen for the minion fan-out).
      */
-    verifyAndExtractMinionTick(token: string, expectedMinionName: string): Promise<MinionTickJobToken | null>;
+    verifyAndExtractMinionTick(token: string, expectedMinionName: string): Promise<AuthenticScheduledDelivery<MinionTickJobToken> | null>;
 }
 export {};
 //# sourceMappingURL=scheduled-message-verifier.backend.service.d.ts.map

package/dist/esm/queue/scheduled-message-verifier.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scheduled-message-verifier.backend.service.d.ts","sourceRoot":"","sources":["../../../../src/queue/scheduled-message-verifier.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,iBAAiB,EAAE,MAAM,8DAA8D,CAAC;AAEjG,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EACL,UAAU,EACV,OAAO,EAMR,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA6BxB;;;GAGG;AACH,QAAA,MAAM,2BAA2B;;;;;;;;;;;;iBAQ/B,CAAC;AAEH;;;;GAIG;AACH,QAAA,MAAM,wBAAwB;;;;;;;;;;;iBAM5B,CAAC;AAEH;;;;GAIG;AACH,QAAA,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;8BAG3B,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AACxE,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E;;GAEG;AACH,MAAM,WAAW,kCAAkC;IACjD,mCAAmC;IACnC,OAAO,EAAE,OAAO,CAAC;IAEjB,4CAA4C;IAC5C,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAE1B,iCAAiC;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,qBACa,sCAAsC;IAK/C,OAAO,CAAC,QAAQ,CAAC,UAAU;IAE3B,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAR/B,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;gBAI9D,UAAU,EAAE,iBAAiB,EAE7B,MAAM,EAAE,aAAa,EAErB,YAAY,EAAE,0BAA0B;IAM3D;;;;;OAKG;IACG,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kCAAkC,CAAC;IA6FxF;;;;;;;;OAQG;IACH,mBAAmB,CAAC,KAAK,EAAE,qBAAqB,GAAG,UAAU;IAiC7D;;;;;;;;;;OAUG;IACG,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAqC1D;;;;;;;;;;;;;;;;;;;OAmBG;IACG,0BAA0B,CAC9B,KAAK,EAAE,MAAM,EACb,kBAAkB,EAAE,MAAM,GACzB,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;CAoCtC"}
+{"version":3,"file":"scheduled-message-verifier.backend.service.d.ts","sourceRoot":"","sources":["../../../../src/queue/scheduled-message-verifier.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,iBAAiB,EAAE,MAAM,8DAA8D,CAAC;AAEjG,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EACL,UAAU,EACV,OAAO,EAMP,yBAAyB,EAC1B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA6BxB;;;GAGG;AACH,QAAA,MAAM,2BAA2B;;;;;;;;;;;;iBAQ/B,CAAC;AAEH;;;;GAIG;AACH,QAAA,MAAM,wBAAwB;;;;;;;;;;;iBAM5B,CAAC;AAEH;;;;GAIG;AACH,QAAA,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;8BAG3B,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AACxE,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E;;;;;;;;GAQG;AACH,oBAAY,wBAAwB;IAClC,wDAAwD;IACxD,UAAU,eAAe;IACzB,gIAAgI;IAChI,IAAI,SAAS;IACb,wFAAwF;IACxF,QAAQ,aAAa;CACtB;AAED,gDAAgD;AAChD,MAAM,MAAM,kCAAkC,GAC1C;IAAE,OAAO,EAAE,wBAAwB,CAAC,UAAU,CAAC;IAAC,KAAK,EAAE,iBAAiB,CAAA;CAAE,GAC1E;IAAE,OAAO,EAAE,wBAAwB,CAAC,IAAI,CAAC;IAAC,KAAK,EAAE,iBAAiB,CAAC;IAAC,QAAQ,EAAE,yBAAyB,CAAA;CAAE,GACzG;IAAE,OAAO,EAAE,wBAAwB,CAAC,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAElE;;;GAGG;AACH,MAAM,MAAM,0BAA0B,CAAC,CAAC,IACpC;IAAE,OAAO,EAAE,wBAAwB,CAAC,UAAU,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAC1D;IAAE,OAAO,EAAE,wBAAwB,CAAC,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAC;IAAC,QAAQ,EAAE,yBAAyB,CAAA;CAAE,CAAC;AAE9F,qBACa,sCAAsC;IAK/C,OAAO,CAAC,QAAQ,CAAC,UAAU;IAE3B,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAR/B,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;gBAI9D,UAAU,EAAE,iBAAiB,EAE7B,MAAM,EAAE,aAAa,EAErB,YAAY,EAAE,0BAA0B;IAM3D;;;;;;;OAOG;IACG,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kCAAkC,CAAC;IAqExF;;;;;;;;;;;;;;;OAeG;YACW,2BAA2B;IAqBzC,OAAO,CAAC,QAAQ;IA+BhB;;;;;;;;OAQG;IACH,mBAAmB,CAAC,KAAK,EAAE,qBAAqB,GAAG,UAAU;IAiC7D;;;;;;;;;;;OAWG;IACG,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,0BAA0B,CAAC,UAAU,CAAC,CAAC;IAwCtF;;;;;;;;;;;;;;;;;;;;OAoBG;IACG,0BAA0B,CAC9B,KAAK,EAAE,MAAM,EACb,kBAAkB,EAAE,MAAM,GACzB,OAAO,CAAC,0BAA0B,CAAC,kBAAkB,CAAC,GAAG,IAAI,CAAC;CAsClE"}

package/dist/esm/queue/scheduled-message-verifier.backend.service.js

@@ -18,14 +18,14 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-import { SCHEDULED_INITIAL_ADMISSION_MAX_AGE_MS, SCHEDULED_INITIAL_ADMISSION_FUTURE_SKEW_MS } from '@wildo-ai/saas-models';
+import { SCHEDULED_INITIAL_ADMISSION_MAX_AGE_MS, SCHEDULED_INITIAL_ADMISSION_FUTURE_SKEW_MS, SCHEDULED_LATE_DELIVERY_HORIZON_MS } from '@wildo-ai/saas-models';
 import { injectable, inject } from 'inversify';
 import { SAAS_SERVICE_TYPES } from '../inject/models/service-types.js';
 import { LoggerService } from '../monitoring/logger/services/logger.service.js';
 import { JwtBackendService } from '../security/jwt/services/jwt.backend.service.js';
 import { JwtPublicKeys } from '../security/authentications/models/jwt.backend.schemas.js';
 import { ErrorBuilderBackendService } from '../errors/services/error-builder.backend.service.js';
-import { JobType, JobInitiator, JobPriority, ErrorType, ErrorCustomMessageReference, isWildoBackendError, } from '@wildo-ai/saas-models';
+import { JobType, JobInitiator, JobPriority, ErrorType, ErrorCustomMessageReference, isWildoBackendError, ScheduledDeliveryLateness, } from '@wildo-ai/saas-models';
 import { z } from 'zod';
 import { describeCaughtError } from '../errors/utils/error-log-level-classification.backend.utils.js';
 /**
@@ -81,6 +81,24 @@ const ScheduledJobTokenSchema = z.discriminatedUnion('jobType', [
     ScheduledCronJobTokenSchema,
     MinionTickJobTokenSchema,
 ]);
+/**
+ * What a scheduled delivery IS, decided before anything durable happens (#2212).
+ *
+ * Three answers, not two, because "not admissible" hid two opposite situations behind one
+ * `AUTHENTICATION` error: a genuine token that waited out its window in a queue nobody consumed
+ * (operational — the application was down) and a token that cannot be proven genuine (a trust
+ * signal). Logged identically, 139 of the first per restart read as a credential outage and sent the
+ * diagnosis to the wrong service.
+ */
+export var ScheduledDeliveryVerdict;
+(function (ScheduledDeliveryVerdict) {
+    /** Authentic, inside its admission window: admit it. */
+    ScheduledDeliveryVerdict["ADMISSIBLE"] = "admissible";
+    /** Authentic (signature, issuer, audience, structure all proven) but past its admission deadline: the occurrence was MISSED. */
+    ScheduledDeliveryVerdict["LATE"] = "late";
+    /** Not provably authentic, or it names an occurrence in the future: a trust failure. */
+    ScheduledDeliveryVerdict["REJECTED"] = "rejected";
+})(ScheduledDeliveryVerdict || (ScheduledDeliveryVerdict = {}));
 let ScheduledMessageVerifierBackendService = class ScheduledMessageVerifierBackendService {
     jwtService;
     logger;
@@ -94,91 +112,140 @@ let ScheduledMessageVerifierBackendService = class ScheduledMessageVerifierBacke
         this.logger.setDebugTypeLogging('ScheduledMessageVerifierBackendService', false);
     }
     /**
-     * Verify a scheduled job message token.
+     * Classify a scheduled job message token: admissible, late, or rejected.
+     *
+     * Only a REJECTED verdict logs here (warn), because only it is a trust signal. A LATE delivery is
+     * reported by the consumer's runner as one digest per drain, not once per message.
      *
      * @param token - The JWT token from the message
-     * @returns Verification result with token payload if valid
      */
     async verifyScheduledMessage(token) {
+        let decoded;
+        let lateness;
         try {
             // Verify the JWT using the crontabs-batches-manager public key
-            const decoded = await this.jwtService.verify(token, JwtPublicKeys.PLATFORM_CRONTABS_BATCHES_MANAGER);
-            // Parse and validate the token payload
-            const parseResult = ScheduledJobTokenSchema.safeParse(decoded);
-            if (!parseResult.success) {
-                this.logger.warn('Scheduled message token has invalid structure', {
-                    issues: parseResult.error.issues,
-                });
-                return {
-                    isValid: false,
-                    error: 'Invalid token structure',
-                };
+            decoded = await this.jwtService.verify(token, JwtPublicKeys.PLATFORM_CRONTABS_BATCHES_MANAGER);
+        }
+        catch (error) {
+            const expired = await this.authenticatedExpiredPayload(token);
+            // When the first failure was the clock and the re-verification refused, the REAL reason is the
+            // re-verification's (a wrong audience behind an expiry, say): logging "jwt expired" there would
+            // be the exact misdirection #2212 exists to remove, aimed the other way.
+            if ('refused' in expired)
+                return this.rejected(expired.refused ?? error);
+            decoded = expired.payload;
+            lateness = ScheduledDeliveryLateness.TOKEN_EXPIRED;
+        }
+        // Parse and validate the token payload
+        const parseResult = ScheduledJobTokenSchema.safeParse(decoded);
+        if (!parseResult.success) {
+            this.logger.warn('Scheduled message token has invalid structure', {
+                issues: parseResult.error.issues,
+            });
+            return { verdict: ScheduledDeliveryVerdict.REJECTED, error: 'Invalid token structure' };
+        }
+        const tokenPayload = parseResult.data;
+        if (tokenPayload.scheduledAt) {
+            const age = Date.now() - Date.parse(tokenPayload.scheduledAt);
+            // A FUTURE occurrence is not lateness: a signer whose clock runs ahead, or a token minted for
+            // an instant that has not happened, is a trust question and stays a rejection.
+            if (age < -SCHEDULED_INITIAL_ADMISSION_FUTURE_SKEW_MS) {
+                return this.rejected(undefined, 'Scheduled occurrence is outside the initial admission window (in the future)');
             }
-            const tokenPayload = parseResult.data;
-            if (tokenPayload.scheduledAt) {
-                const age = Date.now() - Date.parse(tokenPayload.scheduledAt);
-                if (age > SCHEDULED_INITIAL_ADMISSION_MAX_AGE_MS || age < -SCHEDULED_INITIAL_ADMISSION_FUTURE_SKEW_MS) {
-                    return { isValid: false, error: 'Scheduled occurrence is outside the initial admission window' };
+            // An occurrence older than the window is LATE, not a trust failure: the token is authentic and
+            // current, and the delay is shared between the scheduler's signing and this application's
+            // consumption (`ScheduledDeliveryLateness.OUTSIDE_ADMISSION_WINDOW`). Decided with #2212, whose
+            // first wording named only the expired-token case: reporting a genuine, merely late token as an
+            // authentication failure is the misdirection that issue removes, whichever gate fires.
+            if (age > SCHEDULED_INITIAL_ADMISSION_MAX_AGE_MS)
+                lateness ??= ScheduledDeliveryLateness.OUTSIDE_ADMISSION_WINDOW;
+        }
+        // Note: issuer + audience are already enforced by `JwtBackendService.verify`
+        // via `JwtVerifyOptions[PLATFORM_CRONTABS_BATCHES_MANAGER]`
+        // (`issuer: 'platform_crontabs_batches_manager'` + `audience: 'SCHEDULED_JOB'`), and by the
+        // expiry-ignoring re-verification in `authenticatedExpiredPayload` for a late token.
+        if (lateness !== undefined) {
+            return { verdict: ScheduledDeliveryVerdict.LATE, token: tokenPayload, lateness };
+        }
+        this.logDebug('Scheduled message verified successfully', {
+            jobId: tokenPayload.jobId,
+            jobType: tokenPayload.jobType,
+            applicationId: tokenPayload.applicationId,
+            ...(tokenPayload.jobType === JobType.SCHEDULED_CRON
+                ? {
+                    hasBatchRef: !!tokenPayload.batchRef,
+                    hasOperationPathKey: !!tokenPayload.operationPathKey,
                 }
-            }
-            // Note: issuer + audience are already enforced by `JwtBackendService.verify`
-            // via `JwtVerifyOptions[PLATFORM_CRONTABS_BATCHES_MANAGER]`
-            // (`issuer: 'platform_crontabs_batches_manager'` + `audience: 'SCHEDULED_JOB'`).
-            // Any token that reaches this point passed those checks; the
-            // post-verify uppercase-issuer / audience checks that previously
-            // lived here were dead code and have been removed (L5 fix per the
-            // implementation review).
-            this.logDebug('Scheduled message verified successfully', {
-                jobId: tokenPayload.jobId,
-                jobType: tokenPayload.jobType,
-                applicationId: tokenPayload.applicationId,
-                ...(tokenPayload.jobType === JobType.SCHEDULED_CRON
-                    ? {
-                        hasBatchRef: !!tokenPayload.batchRef,
-                        hasOperationPathKey: !!tokenPayload.operationPathKey,
-                    }
-                    : { minionName: tokenPayload.minionName }),
-            });
-            return {
-                isValid: true,
-                token: tokenPayload,
-            };
+                : { minionName: tokenPayload.minionName }),
+        });
+        return { verdict: ScheduledDeliveryVerdict.ADMISSIBLE, token: tokenPayload };
+    }
+    /**
+     * The payload of a token whose ONLY defect is expiry — or, when it is not provably that, why.
+     *
+     * `jsonwebtoken` checks expiry before audience and issuer, so a `TokenExpiredError` alone proves
+     * the signature and nothing more. Re-verifying with expiry ignored — quietly, through the same key
+     * set, rotation included — proves issuer and audience too, and the `exp` check below confirms the
+     * first failure really was the clock. Any other first failure (bad signature, wrong audience, an
+     * unknown key) fails this re-verification and stays a rejection. The late payload is never ADMITTED,
+     * so this cannot turn an expired token into a run; it only decides how the miss is reported.
+     *
+     * A token that expired longer ago than `SCHEDULED_LATE_DELIVERY_HORIZON_MS` is refused too: no
+     * genuine backlog is that old, and an authentic-but-ancient token is what a replay looks like.
+     *
+     * `refused` carries the re-verification's own error when it threw, and is `undefined` when the
+     * token re-verified but is not a recordable late delivery (not expired, or past the horizon).
+     */
+    async authenticatedExpiredPayload(token) {
+        let decoded;
+        try {
+            decoded = await this.jwtService.verifyWithoutBackendErrorActions(token, JwtPublicKeys.PLATFORM_CRONTABS_BATCHES_MANAGER, { ignoreExpiration: true });
         }
         catch (error) {
-            // Surface the REAL reason. A `WildoBackendError` is NOT `instanceof Error`, so the previous
-            // `... : 'Unknown error'` guard MASKED the actual cause (e.g. an empty/absent
-            // PLATFORM_CRONTABS_BATCHES_MANAGER verify key vs a genuine signature mismatch) — which hid a
-            // whole-platform "every scheduled tick dead-letters" bug for weeks. Never swallow it again.
-            // The unmask must reach the JWT diagnostic, not stop at the error TYPE.
-            //
-            // `verifyRaw` builds its AUTHENTICATION error with `context.jwtErrorName` +
-            // `context.jwtErrorMessage` and NO `context.message`, so a `context.message ?? type`
-            // fallback printed a bare "AUTHENTICATION" and discarded the only fields that say
-            // WHY — expired vs bad signature vs wrong audience. That is the same swallowing this
-            // block was written to end, one level deeper: a minion tick that sat in its durable
-            // queue past the 5-minute token TTL and a genuinely forged token were indistinguishable
-            // in the log, which is why the real cause went unread for days.
-            const detail = isWildoBackendError(error)
-                ? (error.context?.message
-                    ?? (error.context?.jwtErrorName
-                        ? `${String(error.context.jwtErrorName)}: ${String(error.context.jwtErrorMessage ?? '')}`.trim()
-                        : undefined)
-                    ?? error.type)
-                : describeCaughtError(error);
-            this.logger.warn('Scheduled message verification failed', {
-                error: detail,
-                // Kept as discrete fields too so a log query can facet on the JWT failure kind
-                // (`TokenExpiredError` is an operational signal — the consumer was down longer
-                // than the token TTL — while `JsonWebTokenError` is a trust signal).
-                ...(isWildoBackendError(error) && error.context?.jwtErrorName
-                    ? { jwtErrorName: error.context.jwtErrorName, jwtErrorMessage: error.context.jwtErrorMessage }
-                    : {}),
-            });
-            return {
-                isValid: false,
-                error: detail,
-            };
+            return { refused: error };
         }
+        const exp = decoded?.exp;
+        if (typeof exp !== 'number')
+            return { refused: undefined };
+        const expiredForMs = Date.now() - exp * 1000;
+        if (expiredForMs < 0)
+            return { refused: undefined };
+        if (expiredForMs > SCHEDULED_LATE_DELIVERY_HORIZON_MS) {
+            return { refused: this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {
+                    customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,
+                    context: { message: `Scheduled delivery token expired ${Math.round(expiredForMs / 86400000)} day(s) ago, beyond the late-delivery horizon` },
+                }) };
+        }
+        return { payload: decoded };
+    }
+    rejected(error, reason) {
+        // Surface the REAL reason. A `WildoBackendError` is NOT `instanceof Error`, so the previous
+        // `... : 'Unknown error'` guard MASKED the actual cause (e.g. an empty/absent
+        // PLATFORM_CRONTABS_BATCHES_MANAGER verify key vs a genuine signature mismatch) — which hid a
+        // whole-platform "every scheduled tick dead-letters" bug for weeks. Never swallow it again.
+        // The unmask must reach the JWT diagnostic, not stop at the error TYPE.
+        //
+        // `verifyRaw` builds its AUTHENTICATION error with `context.jwtErrorName` +
+        // `context.jwtErrorMessage` and NO `context.message`, so a `context.message ?? type`
+        // fallback printed a bare "AUTHENTICATION" and discarded the only fields that say
+        // WHY — bad signature vs wrong audience vs unknown key.
+        const detail = reason ?? (isWildoBackendError(error)
+            ? (error.context?.message
+                ?? (error.context?.jwtErrorName
+                    ? `${String(error.context.jwtErrorName)}: ${String(error.context.jwtErrorMessage ?? '')}`.trim()
+                    : undefined)
+                ?? error.type)
+            : describeCaughtError(error));
+        this.logger.warn('Scheduled message verification failed', {
+            error: detail,
+            // Kept as discrete fields too so a log query can facet on the JWT failure kind. An expired
+            // but authentic token within the horizon never reaches here — it is a LATE verdict (#2212) —
+            // so what lands here is a trust signal, named by the check that actually refused it.
+            ...(isWildoBackendError(error) && error.context?.jwtErrorName
+                ? { jwtErrorName: error.context.jwtErrorName, jwtErrorMessage: error.context.jwtErrorMessage }
+                : {}),
+        });
+        return { verdict: ScheduledDeliveryVerdict.REJECTED, error: detail };
     }
     /**
      * Convert a verified `SCHEDULED_CRON` token to a JobPayload for
@@ -219,18 +286,19 @@ let ScheduledMessageVerifierBackendService = class ScheduledMessageVerifierBacke
     }
     /**
      * Verify and convert a `SCHEDULED_CRON` scheduled message in one step.
-     * Throws if verification fails OR if the token is a `MINION_TICK`
-     * (which the resource-operation / custom-batch executor cannot
-     * dispatch; the minion runtime owns those — use
-     * `verifyAndExtractMinionTick`).
+     *
+     * Returns the converted payload with its verdict — ADMISSIBLE, or LATE with why — and throws only
+     * when the delivery is not authentic, or is a `MINION_TICK` (which the resource-operation /
+     * custom-batch executor cannot dispatch; the minion runtime owns those — use
+     * `verifyAndExtractMinionTick`). A LATE delivery is returned, never thrown: it is genuine, and the
+     * consumer records it as a missed occurrence instead of failing it (#2212).
      *
      * @param token - The JWT token from the message
-     * @returns JobPayload ready for execution
      * @throws WildoError if verification fails or the token targets a minion
      */
     async verifyAndConvert(token) {
         const result = await this.verifyScheduledMessage(token);
-        if (!result.isValid || !result.token) {
+        if (result.verdict === ScheduledDeliveryVerdict.REJECTED) {
             throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {
                 customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,
                 context: {
@@ -250,11 +318,14 @@ let ScheduledMessageVerifierBackendService = class ScheduledMessageVerifierBacke
                 },
             });
         }
-        return this.convertToJobPayload(result.token);
+        const value = this.convertToJobPayload(result.token);
+        return result.verdict === ScheduledDeliveryVerdict.LATE
+            ? { verdict: ScheduledDeliveryVerdict.LATE, value, lateness: result.lateness }
+            : { verdict: ScheduledDeliveryVerdict.ADMISSIBLE, value };
     }
     /**
      * Verify a scheduled message and extract a `MinionTickJobToken` if and
-     * only if the token targets the given minion (KD-12).
+     * only if the token targets the given minion (KD-12), with its verdict.
      *
      * Returns `null` (not throws) for the two non-actionable cases that the
      * minion runtime should silently skip:
@@ -262,8 +333,9 @@ let ScheduledMessageVerifierBackendService = class ScheduledMessageVerifierBacke
      * - the token is a `MINION_TICK` whose `minionName` does not match
      *   `expectedMinionName`.
      *
-     * Throws (typed authentication error) only when verification itself
-     * fails — invalid signature, malformed payload, wrong issuer/audience.
+     * A LATE tick is returned with its lateness, exactly like `verifyAndConvert` (#2212). Throws (typed
+     * authentication error) only when the delivery is not authentic — invalid signature, malformed
+     * payload, wrong issuer/audience, a future occurrence.
      *
      * The minion-side consumer passes its compiled-in `minionName` (from
      * `defineMinionInit({ minionName })`, cross-validated against the fetched
@@ -274,7 +346,7 @@ let ScheduledMessageVerifierBackendService = class ScheduledMessageVerifierBacke
      */
     async verifyAndExtractMinionTick(token, expectedMinionName) {
         const result = await this.verifyScheduledMessage(token);
-        if (!result.isValid || !result.token) {
+        if (result.verdict === ScheduledDeliveryVerdict.REJECTED) {
             throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {
                 customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,
                 context: {
@@ -298,7 +370,9 @@ let ScheduledMessageVerifierBackendService = class ScheduledMessageVerifierBacke
             });
             return null;
         }
-        return result.token;
+        return result.verdict === ScheduledDeliveryVerdict.LATE
+            ? { verdict: ScheduledDeliveryVerdict.LATE, value: result.token, lateness: result.lateness }
+            : { verdict: ScheduledDeliveryVerdict.ADMISSIBLE, value: result.token };
     }
 };
 ScheduledMessageVerifierBackendService = __decorate([

package/dist/esm/queue/scheduled-message-verifier.backend.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"scheduled-message-verifier.backend.service.js","sourceRoot":"","sources":["../../../../src/queue/scheduled-message-verifier.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;;;;;;;;;;;;;AAEH,OAAO,EAAE,sCAAsC,EAAE,0CAA0C,EAAE,MAAM,uBAAuB,CAAC;AAC3H,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,iBAAiB,EAAE,MAAM,8DAA8D,CAAC;AACjG,OAAO,EAAE,aAAa,EAAE,MAAM,wEAAwE,CAAC;AACvG,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAEL,OAAO,EACP,YAAY,EACZ,WAAW,EACX,SAAS,EACT,2BAA2B,EAC3B,mBAAmB,GACpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,mBAAmB,EAAE,MAAM,8EAA8E,CAAC;AACnH;;GAEG;AACH,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,oCAAoC;IACpC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAExB,wCAAwC;IACxC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IAEzB,mFAAmF;IACnF,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAExC,2CAA2C;IAC3C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IAEf,wCAAwC;IACxC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IAEf,2DAA2D;IAC3D,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IAEf,yCAAyC;IACzC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;CAChB,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,2BAA2B,GAAG,+BAA+B,CAAC,MAAM,CAAC;IACzE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC;IAC1C,yHAAyH;IACzH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,6BAA6B;IAC7B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,gDAAgD;IAChD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,wBAAwB,GAAG,+BAA+B,CAAC,MAAM,CAAC;IACtE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC;IACvC,yNAAyN;IACzN,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,0DAA0D;IAC1D,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,uBAAuB,GAAG,CAAC,CAAC,kBAAkB,CAAC,SAAS,EAAE;IAC9D,2BAA2B;IAC3B,wBAAwB;CACzB,CAAC,CAAC;AAqBI,IAAM,sCAAsC,GAA5C,MAAM,sCAAsC;IAK9B;IAEA;IAEA;IART,QAAQ,CAA+D;IAEjF,YAEmB,UAA6B,EAE7B,MAAqB,EAErB,YAAwC;QAJxC,eAAU,GAAV,UAAU,CAAmB;QAE7B,WAAM,GAAN,MAAM,CAAe;QAErB,iBAAY,GAAZ,YAAY,CAA4B;QAEzD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,wCAAwC,CAAC,CAAC;QAClF,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,wCAAwC,EAAE,KAAK,CAAC,CAAC;IACnF,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,sBAAsB,CAAC,KAAa;QACxC,IAAI,CAAC;YACH,+DAA+D;YAC/D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAC1C,KAAK,EACL,aAAa,CAAC,iCAAiC,CAChD,CAAC;YAEF,uCAAuC;YACvC,MAAM,WAAW,GAAG,uBAAuB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YAE/D,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;gBACzB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+CAA+C,EAAE;oBAChE,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC,MAAM;iBACjC,CAAC,CAAC;gBACH,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,yBAAyB;iBACjC,CAAC;YACJ,CAAC;YAED,MAAM,YAAY,GAAG,WAAW,CAAC,IAAI,CAAC;YACtC,IAAI,YAAY,CAAC,WAAW,EAAE,CAAC;gBAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;gBAC9D,IAAI,GAAG,GAAG,sCAAsC,IAAI,GAAG,GAAG,CAAC,0CAA0C,EAAE,CAAC;oBACtG,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,8DAA8D,EAAE,CAAC;gBACnG,CAAC;YACH,CAAC;YAGD,6EAA6E;YAC7E,4DAA4D;YAC5D,iFAAiF;YACjF,6DAA6D;YAC7D,iEAAiE;YACjE,kEAAkE;YAClE,0BAA0B;YAE1B,IAAI,CAAC,QAAQ,CAAC,yCAAyC,EAAE;gBACvD,KAAK,EAAE,YAAY,CAAC,KAAK;gBACzB,OAAO,EAAE,YAAY,CAAC,OAAO;gBAC7B,aAAa,EAAE,YAAY,CAAC,aAAa;gBACzC,GAAG,CAAC,YAAY,CAAC,OAAO,KAAK,OAAO,CAAC,cAAc;oBACjD,CAAC,CAAC;wBACE,WAAW,EAAE,CAAC,CAAC,YAAY,CAAC,QAAQ;wBACpC,mBAAmB,EAAE,CAAC,CAAC,YAAY,CAAC,gBAAgB;qBACrD;oBACH,CAAC,CAAC,EAAE,UAAU,EAAE,YAAY,CAAC,UAAU,EAAE,CAAC;aAC7C,CAAC,CAAC;YAEH,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,KAAK,EAAE,YAAY;aACpB,CAAC;QAEJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,4FAA4F;YAC5F,8EAA8E;YAC9E,8FAA8F;YAC9F,4FAA4F;YAC5F,wEAAwE;YACxE,EAAE;YACF,4EAA4E;YAC5E,qFAAqF;YACrF,kFAAkF;YAClF,qFAAqF;YACrF,oFAAoF;YACpF,wFAAwF;YACxF,gEAAgE;YAChE,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC;gBACvC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO;uBAClB,CAAC,KAAK,CAAC,OAAO,EAAE,YAAY;wBAC7B,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE;wBAChG,CAAC,CAAC,SAAS,CAAC;uBACX,KAAK,CAAC,IAAI,CAAC;gBAClB,CAAC,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;YAC/B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uCAAuC,EAAE;gBACxD,KAAK,EAAE,MAAM;gBACb,+EAA+E;gBAC/E,+EAA+E;gBAC/E,qEAAqE;gBACrE,GAAG,CAAC,mBAAmB,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,YAAY;oBAC3D,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,eAAe,EAAE;oBAC9F,CAAC,CAAC,EAAE,CAAC;aACR,CAAC,CAAC;YAEH,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,MAAM;aACd,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,mBAAmB,CAAC,KAA4B;QAC9C,kGAAkG;QAClG,gGAAgG;QAChG,iGAAiG;QACjG,gGAAgG;QAChG,kEAAkE;QAClE,OAAO;YACL,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,OAAO,EAAE,OAAO,CAAC,cAAc;YAC/B,aAAa,EAAE,KAAK,CAAC,aAAa;YAElC,8DAA8D;YAC9D,8FAA8F;YAC9F,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YAExB,aAAa,EAAE,KAAK,CAAC,aAAa;YAElC,WAAW,EAAE,YAAY,CAAC,OAAO;YACjC,QAAQ,EAAE,WAAW,CAAC,MAAM;YAC5B,UAAU,EAAE,CAAC;YACb,UAAU,EAAE,CAAC;YACb,2EAA2E;YAC3E,8EAA8E;YAC9E,SAAS,EAAE,MAAM;YAEjB,SAAS,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC;YACrC,sEAAsE;YACtE,sEAAsE;YACtE,WAAW,EAAE,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC;SACvF,CAAC;IACJ,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,gBAAgB,CAAC,KAAa;QAClC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;QAExD,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACrC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,cAAc,EACxB,SAAS,EACT;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;gBAChF,OAAO,EAAE;oBACP,MAAM,EAAE,MAAM,CAAC,KAAK,IAAI,uCAAuC;oBAC/D,MAAM,EAAE,0BAA0B;iBACnC;aACF,CACF,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC,cAAc,EAAE,CAAC;YACpD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,cAAc,EACxB,SAAS,EACT;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;gBAChF,OAAO,EAAE;oBACP,MAAM,EACJ,oDAAoD,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI;wBAC5E,4EAA4E;wBAC5E,6FAA6F;oBAC/F,MAAM,EAAE,0BAA0B;iBACnC;aACF,CACF,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACH,KAAK,CAAC,0BAA0B,CAC9B,KAAa,EACb,kBAA0B;QAE1B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;QAExD,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACrC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,cAAc,EACxB,SAAS,EACT;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;gBAChF,OAAO,EAAE;oBACP,MAAM,EAAE,MAAM,CAAC,KAAK,IAAI,uCAAuC;oBAC/D,MAAM,EAAE,0BAA0B;iBACnC;aACF,CACF,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC;YACjD,IAAI,CAAC,QAAQ,CAAC,4CAA4C,EAAE;gBAC1D,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK;gBACzB,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO;aAC9B,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,MAAM,CAAC,KAAK,CAAC,UAAU,KAAK,kBAAkB,EAAE,CAAC;YACnD,IAAI,CAAC,QAAQ,CAAC,qDAAqD,EAAE;gBACnE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK;gBACzB,gBAAgB,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU;gBACzC,kBAAkB;aACnB,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,MAAM,CAAC,KAAK,CAAC;IACtB,CAAC;CACF,CAAA;AAvQY,sCAAsC;IADlD,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAA;IAE5C,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IAEjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;qCAHlB,iBAAiB;QAErB,aAAa;QAEP,0BAA0B;GAThD,sCAAsC,CAuQlD","sourcesContent":["/**\n * Scheduled Message Verifier Backend Service\n *\n * Verifies JWT signatures on scheduled job messages from crontabs-batches-manager.\n * Only messages signed by the platform's crontabs-batches-manager are accepted.\n *\n * This prevents unauthorized job execution in horizontally scaled K8s environments.\n */\n\nimport { SCHEDULED_INITIAL_ADMISSION_MAX_AGE_MS, SCHEDULED_INITIAL_ADMISSION_FUTURE_SKEW_MS } from '@wildo-ai/saas-models';\nimport { injectable, inject } from 'inversify';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { JwtBackendService } from '~wildo-backend-lib/security/jwt/services/jwt.backend.service';\nimport { JwtPublicKeys } from '~wildo-backend-lib/security/authentications/models/jwt.backend.schemas';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport {\n  JobPayload,\n  JobType,\n  JobInitiator,\n  JobPriority,\n  ErrorType,\n  ErrorCustomMessageReference,\n  isWildoBackendError,\n} from '@wildo-ai/saas-models';\nimport { z } from 'zod';\n\nimport { describeCaughtError } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\n/**\n * Common JWT envelope fields shared by every scheduled-job token shape.\n */\nconst ScheduledJobTokenEnvelopeSchema = z.object({\n  /** Job ID (unique per execution) */\n  jobId: z.string().uuid(),\n\n  /** Application ID the job belongs to */\n  applicationId: z.string(),\n\n  /** Scheduled occurrence time; manual invocations intentionally omit this claim. */\n  scheduledAt: z.iso.datetime().optional(),\n\n  /** Token issued at (standard JWT claim) */\n  iat: z.number(),\n\n  /** Token expiry (standard JWT claim) */\n  exp: z.number(),\n\n  /** Issuer (should be PLATFORM_CRONTABS_BATCHES_MANAGER) */\n  iss: z.string(),\n\n  /** Audience (should be SCHEDULED_JOB) */\n  aud: z.string(),\n});\n\n/**\n * Schema for the SCHEDULED_CRON arm of the scheduled-job token (the\n * pre-existing resource-operation / custom-batch tick).\n */\nconst ScheduledCronJobTokenSchema = ScheduledJobTokenEnvelopeSchema.extend({\n  jobType: z.literal(JobType.SCHEDULED_CRON),\n  /** Operation path key for resource operations (format: \"resource | operation | variantType | variant | isBulk:false\") */\n  operationPathKey: z.string().optional(),\n  /** Custom batch reference */\n  batchRef: z.string().optional(),\n  /** Input data for the job (JSON stringified) */\n  inputDataJson: z.string().optional(),\n});\n\n/**\n * Schema for the MINION_TICK arm of the scheduled-job token (KD-12).\n * Carries the minion identity discriminator that the minion runtime uses\n * to filter inbound ticks.\n */\nconst MinionTickJobTokenSchema = ScheduledJobTokenEnvelopeSchema.extend({\n  jobType: z.literal(JobType.MINION_TICK),\n  /** Minion name — matches `wildo.saas.config.ts > minions.<key>`, which the minion runtime knows via its compiled-in `defineMinionInit({ minionName })` identity (NOT read from the `APP_OWNED_SERVICE_NAME` env var). */\n  minionName: z.string().min(1),\n  /** Optional input data for the tick (JSON stringified) */\n  inputDataJson: z.string().optional(),\n});\n\n/**\n * Discriminated union over the two scheduled-job token shapes. Per KD-12,\n * dispatch is a pure switch on `jobType` rather than \"which optional\n * field is set\".\n */\nconst ScheduledJobTokenSchema = z.discriminatedUnion('jobType', [\n  ScheduledCronJobTokenSchema,\n  MinionTickJobTokenSchema,\n]);\n\nexport type ScheduledJobToken = z.infer<typeof ScheduledJobTokenSchema>;\nexport type ScheduledCronJobToken = z.infer<typeof ScheduledCronJobTokenSchema>;\nexport type MinionTickJobToken = z.infer<typeof MinionTickJobTokenSchema>;\n\n/**\n * Result of scheduled message verification.\n */\nexport interface ScheduledMessageVerificationResult {\n  /** Whether the message is valid */\n  isValid: boolean;\n\n  /** The verified token payload (if valid) */\n  token?: ScheduledJobToken;\n\n  /** Error message (if invalid) */\n  error?: string;\n}\n\n@injectable()\nexport class ScheduledMessageVerifierBackendService {\n  protected logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.JwtBackendService)\n    private readonly jwtService: JwtBackendService,\n    @inject(SAAS_SERVICE_TYPES.Logger)\n    private readonly logger: LoggerService,\n    @inject(SAAS_SERVICE_TYPES.ErrorBuilderService)\n    private readonly errorBuilder: ErrorBuilderBackendService,\n  ) {\n    this.logDebug = this.logger.debugByType('ScheduledMessageVerifierBackendService');\n    this.logger.setDebugTypeLogging('ScheduledMessageVerifierBackendService', false);\n  }\n\n  /**\n   * Verify a scheduled job message token.\n   *\n   * @param token - The JWT token from the message\n   * @returns Verification result with token payload if valid\n   */\n  async verifyScheduledMessage(token: string): Promise<ScheduledMessageVerificationResult> {\n    try {\n      // Verify the JWT using the crontabs-batches-manager public key\n      const decoded = await this.jwtService.verify(\n        token,\n        JwtPublicKeys.PLATFORM_CRONTABS_BATCHES_MANAGER\n      );\n\n      // Parse and validate the token payload\n      const parseResult = ScheduledJobTokenSchema.safeParse(decoded);\n\n      if (!parseResult.success) {\n        this.logger.warn('Scheduled message token has invalid structure', {\n          issues: parseResult.error.issues,\n        });\n        return {\n          isValid: false,\n          error: 'Invalid token structure',\n        };\n      }\n\n      const tokenPayload = parseResult.data;\n      if (tokenPayload.scheduledAt) {\n        const age = Date.now() - Date.parse(tokenPayload.scheduledAt);\n        if (age > SCHEDULED_INITIAL_ADMISSION_MAX_AGE_MS || age < -SCHEDULED_INITIAL_ADMISSION_FUTURE_SKEW_MS) {\n          return { isValid: false, error: 'Scheduled occurrence is outside the initial admission window' };\n        }\n      }\n\n\n      // Note: issuer + audience are already enforced by `JwtBackendService.verify`\n      // via `JwtVerifyOptions[PLATFORM_CRONTABS_BATCHES_MANAGER]`\n      // (`issuer: 'platform_crontabs_batches_manager'` + `audience: 'SCHEDULED_JOB'`).\n      // Any token that reaches this point passed those checks; the\n      // post-verify uppercase-issuer / audience checks that previously\n      // lived here were dead code and have been removed (L5 fix per the\n      // implementation review).\n\n      this.logDebug('Scheduled message verified successfully', {\n        jobId: tokenPayload.jobId,\n        jobType: tokenPayload.jobType,\n        applicationId: tokenPayload.applicationId,\n        ...(tokenPayload.jobType === JobType.SCHEDULED_CRON\n          ? {\n              hasBatchRef: !!tokenPayload.batchRef,\n              hasOperationPathKey: !!tokenPayload.operationPathKey,\n            }\n          : { minionName: tokenPayload.minionName }),\n      });\n\n      return {\n        isValid: true,\n        token: tokenPayload,\n      };\n\n    } catch (error) {\n      // Surface the REAL reason. A `WildoBackendError` is NOT `instanceof Error`, so the previous\n      // `... : 'Unknown error'` guard MASKED the actual cause (e.g. an empty/absent\n      // PLATFORM_CRONTABS_BATCHES_MANAGER verify key vs a genuine signature mismatch) — which hid a\n      // whole-platform \"every scheduled tick dead-letters\" bug for weeks. Never swallow it again.\n      // The unmask must reach the JWT diagnostic, not stop at the error TYPE.\n      //\n      // `verifyRaw` builds its AUTHENTICATION error with `context.jwtErrorName` +\n      // `context.jwtErrorMessage` and NO `context.message`, so a `context.message ?? type`\n      // fallback printed a bare \"AUTHENTICATION\" and discarded the only fields that say\n      // WHY — expired vs bad signature vs wrong audience. That is the same swallowing this\n      // block was written to end, one level deeper: a minion tick that sat in its durable\n      // queue past the 5-minute token TTL and a genuinely forged token were indistinguishable\n      // in the log, which is why the real cause went unread for days.\n      const detail = isWildoBackendError(error)\n        ? (error.context?.message\n            ?? (error.context?.jwtErrorName\n              ? `${String(error.context.jwtErrorName)}: ${String(error.context.jwtErrorMessage ?? '')}`.trim()\n              : undefined)\n            ?? error.type)\n        : describeCaughtError(error);\n      this.logger.warn('Scheduled message verification failed', {\n        error: detail,\n        // Kept as discrete fields too so a log query can facet on the JWT failure kind\n        // (`TokenExpiredError` is an operational signal — the consumer was down longer\n        // than the token TTL — while `JsonWebTokenError` is a trust signal).\n        ...(isWildoBackendError(error) && error.context?.jwtErrorName\n          ? { jwtErrorName: error.context.jwtErrorName, jwtErrorMessage: error.context.jwtErrorMessage }\n          : {}),\n      });\n\n      return {\n        isValid: false,\n        error: detail,\n      };\n    }\n  }\n\n  /**\n   * Convert a verified `SCHEDULED_CRON` token to a JobPayload for\n   * execution by the resource-operation / custom-batch executor pipeline.\n   *\n   * MINION_TICK conversion belongs to the minion consumer, which uses the\n   * same durable coordinator but dispatches a different local handler.\n   * The verification entry point refuses those tokens here —\n   * see `verifyAndConvert` and `verifyAndExtractMinionTick` below.\n   */\n  convertToJobPayload(token: ScheduledCronJobToken): JobPayload {\n    // No `originCorrelationId` — deliberate, and the one JobPayload writer for which that is correct.\n    // A scheduled cron tick is SCHEDULE-originated: no request enqueued it, so there is no upstream\n    // trace to join. The consumer mints a fresh id per tick, which is the accurate attribution. (The\n    // other two writers — `buildJobPayload` and `enqueueCustomBatch` — both seed it; see the writer\n    // enumeration in `.claude/plans/traceability-correlation-id.md`.)\n    return {\n      jobId: token.jobId,\n      jobType: JobType.SCHEDULED_CRON,\n      applicationId: token.applicationId,\n\n      // operationPathKey is the human-readable key format, NOT JSON\n      // The executor will parse it using ResourcesConfig_OperationPathUtils.parseOperationPathKey()\n      operationPathKey: token.operationPathKey,\n      batchRef: token.batchRef,\n\n      inputDataJson: token.inputDataJson,\n\n      initiatedBy: JobInitiator.CRONTAB,\n      priority: JobPriority.NORMAL,\n      retryCount: 0,\n      maxRetries: 0,\n      // Ordinary queue retry metadata is deliberately absent. Scheduled recovery\n      // resolves the local handler contract and persists its own attempts/deadline.\n      timeoutMs: 300000,\n\n      createdAt: new Date(token.iat * 1000),\n      // Occurrence time is not publication time. Preserve the authenticated\n      // instant in durable recovery input; manual triggers leave it absent.\n      scheduledAt: token.scheduledAt === undefined ? undefined : new Date(token.scheduledAt),\n    };\n  }\n\n  /**\n   * Verify and convert a `SCHEDULED_CRON` scheduled message in one step.\n   * Throws if verification fails OR if the token is a `MINION_TICK`\n   * (which the resource-operation / custom-batch executor cannot\n   * dispatch; the minion runtime owns those — use\n   * `verifyAndExtractMinionTick`).\n   *\n   * @param token - The JWT token from the message\n   * @returns JobPayload ready for execution\n   * @throws WildoError if verification fails or the token targets a minion\n   */\n  async verifyAndConvert(token: string): Promise<JobPayload> {\n    const result = await this.verifyScheduledMessage(token);\n\n    if (!result.isValid || !result.token) {\n      throw this.errorBuilder.buildError(\n        ErrorType.AUTHENTICATION,\n        undefined,\n        {\n          customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n          context: {\n            reason: result.error || 'Scheduled message verification failed',\n            source: 'crontabs-batches-manager',\n          },\n        }\n      );\n    }\n\n    if (result.token.jobType !== JobType.SCHEDULED_CRON) {\n      throw this.errorBuilder.buildError(\n        ErrorType.AUTHENTICATION,\n        undefined,\n        {\n          customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n          context: {\n            reason:\n              `verifyAndConvert() received a token with jobType=${result.token.jobType}; ` +\n              `the resource-operation / custom-batch executor cannot dispatch this kind. ` +\n              `MINION_TICK tokens belong to the minion runtime — use verifyAndExtractMinionTick() instead.`,\n            source: 'crontabs-batches-manager',\n          },\n        }\n      );\n    }\n\n    return this.convertToJobPayload(result.token);\n  }\n\n  /**\n   * Verify a scheduled message and extract a `MinionTickJobToken` if and\n   * only if the token targets the given minion (KD-12).\n   *\n   * Returns `null` (not throws) for the two non-actionable cases that the\n   * minion runtime should silently skip:\n   * - the token is a `SCHEDULED_CRON` (belongs to the backend-api),\n   * - the token is a `MINION_TICK` whose `minionName` does not match\n   *   `expectedMinionName`.\n   *\n   * Throws (typed authentication error) only when verification itself\n   * fails — invalid signature, malformed payload, wrong issuer/audience.\n   *\n   * The minion-side consumer passes its compiled-in `minionName` (from\n   * `defineMinionInit({ minionName })`, cross-validated against the fetched\n   * `appConfig.minions[minionName]`) as `expectedMinionName` — NOT an\n   * env-projected `APP_OWNED_SERVICE_NAME`; tokens that fail the filter\n   * should be NACK'd back to the queue (or skipped, depending on the\n   * queue-routing strategy chosen for the minion fan-out).\n   */\n  async verifyAndExtractMinionTick(\n    token: string,\n    expectedMinionName: string,\n  ): Promise<MinionTickJobToken | null> {\n    const result = await this.verifyScheduledMessage(token);\n\n    if (!result.isValid || !result.token) {\n      throw this.errorBuilder.buildError(\n        ErrorType.AUTHENTICATION,\n        undefined,\n        {\n          customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n          context: {\n            reason: result.error || 'Scheduled message verification failed',\n            source: 'crontabs-batches-manager',\n          },\n        }\n      );\n    }\n\n    if (result.token.jobType !== JobType.MINION_TICK) {\n      this.logDebug('Skipping non-minion-tick scheduled message', {\n        jobId: result.token.jobId,\n        jobType: result.token.jobType,\n      });\n      return null;\n    }\n\n    if (result.token.minionName !== expectedMinionName) {\n      this.logDebug('Skipping minion tick targeted at a different minion', {\n        jobId: result.token.jobId,\n        targetMinionName: result.token.minionName,\n        expectedMinionName,\n      });\n      return null;\n    }\n\n    return result.token;\n  }\n}\n"]}
+{"version":3,"file":"scheduled-message-verifier.backend.service.js","sourceRoot":"","sources":["../../../../src/queue/scheduled-message-verifier.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;;;;;;;;;;;;;AAEH,OAAO,EAAE,sCAAsC,EAAE,0CAA0C,EAAE,kCAAkC,EAAE,MAAM,uBAAuB,CAAC;AAC/J,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,iBAAiB,EAAE,MAAM,8DAA8D,CAAC;AACjG,OAAO,EAAE,aAAa,EAAE,MAAM,wEAAwE,CAAC;AACvG,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAEL,OAAO,EACP,YAAY,EACZ,WAAW,EACX,SAAS,EACT,2BAA2B,EAC3B,mBAAmB,EACnB,yBAAyB,GAC1B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,mBAAmB,EAAE,MAAM,8EAA8E,CAAC;AACnH;;GAEG;AACH,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,oCAAoC;IACpC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAExB,wCAAwC;IACxC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IAEzB,mFAAmF;IACnF,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAExC,2CAA2C;IAC3C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IAEf,wCAAwC;IACxC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IAEf,2DAA2D;IAC3D,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IAEf,yCAAyC;IACzC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;CAChB,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,2BAA2B,GAAG,+BAA+B,CAAC,MAAM,CAAC;IACzE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC;IAC1C,yHAAyH;IACzH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,6BAA6B;IAC7B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,gDAAgD;IAChD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,wBAAwB,GAAG,+BAA+B,CAAC,MAAM,CAAC;IACtE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC;IACvC,yNAAyN;IACzN,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,0DAA0D;IAC1D,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,uBAAuB,GAAG,CAAC,CAAC,kBAAkB,CAAC,SAAS,EAAE;IAC9D,2BAA2B;IAC3B,wBAAwB;CACzB,CAAC,CAAC;AAMH;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,wBAOX;AAPD,WAAY,wBAAwB;IAClC,wDAAwD;IACxD,qDAAyB,CAAA;IACzB,gIAAgI;IAChI,yCAAa,CAAA;IACb,wFAAwF;IACxF,iDAAqB,CAAA;AACvB,CAAC,EAPW,wBAAwB,KAAxB,wBAAwB,QAOnC;AAiBM,IAAM,sCAAsC,GAA5C,MAAM,sCAAsC;IAK9B;IAEA;IAEA;IART,QAAQ,CAA+D;IAEjF,YAEmB,UAA6B,EAE7B,MAAqB,EAErB,YAAwC;QAJxC,eAAU,GAAV,UAAU,CAAmB;QAE7B,WAAM,GAAN,MAAM,CAAe;QAErB,iBAAY,GAAZ,YAAY,CAA4B;QAEzD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,wCAAwC,CAAC,CAAC;QAClF,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,wCAAwC,EAAE,KAAK,CAAC,CAAC;IACnF,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,sBAAsB,CAAC,KAAa;QACxC,IAAI,OAAgB,CAAC;QACrB,IAAI,QAA+C,CAAC;QACpD,IAAI,CAAC;YACH,+DAA+D;YAC/D,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CACpC,KAAK,EACL,aAAa,CAAC,iCAAiC,CAChD,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,KAAK,CAAC,CAAC;YAC9D,+FAA+F;YAC/F,gGAAgG;YAChG,yEAAyE;YACzE,IAAI,SAAS,IAAI,OAAO;gBAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,IAAI,KAAK,CAAC,CAAC;YACzE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;YAC1B,QAAQ,GAAG,yBAAyB,CAAC,aAAa,CAAC;QACrD,CAAC;QAED,uCAAuC;QACvC,MAAM,WAAW,GAAG,uBAAuB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAE/D,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;YACzB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+CAA+C,EAAE;gBAChE,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC,MAAM;aACjC,CAAC,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,wBAAwB,CAAC,QAAQ,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;QAC1F,CAAC;QAED,MAAM,YAAY,GAAG,WAAW,CAAC,IAAI,CAAC;QACtC,IAAI,YAAY,CAAC,WAAW,EAAE,CAAC;YAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;YAC9D,8FAA8F;YAC9F,+EAA+E;YAC/E,IAAI,GAAG,GAAG,CAAC,0CAA0C,EAAE,CAAC;gBACtD,OAAO,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,8EAA8E,CAAC,CAAC;YAClH,CAAC;YACD,+FAA+F;YAC/F,0FAA0F;YAC1F,gGAAgG;YAChG,gGAAgG;YAChG,uFAAuF;YACvF,IAAI,GAAG,GAAG,sCAAsC;gBAAE,QAAQ,KAAK,yBAAyB,CAAC,wBAAwB,CAAC;QACpH,CAAC;QAED,6EAA6E;QAC7E,4DAA4D;QAC5D,4FAA4F;QAC5F,qFAAqF;QAErF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,EAAE,OAAO,EAAE,wBAAwB,CAAC,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC;QACnF,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,yCAAyC,EAAE;YACvD,KAAK,EAAE,YAAY,CAAC,KAAK;YACzB,OAAO,EAAE,YAAY,CAAC,OAAO;YAC7B,aAAa,EAAE,YAAY,CAAC,aAAa;YACzC,GAAG,CAAC,YAAY,CAAC,OAAO,KAAK,OAAO,CAAC,cAAc;gBACjD,CAAC,CAAC;oBACE,WAAW,EAAE,CAAC,CAAC,YAAY,CAAC,QAAQ;oBACpC,mBAAmB,EAAE,CAAC,CAAC,YAAY,CAAC,gBAAgB;iBACrD;gBACH,CAAC,CAAC,EAAE,UAAU,EAAE,YAAY,CAAC,UAAU,EAAE,CAAC;SAC7C,CAAC,CAAC;QAEH,OAAO,EAAE,OAAO,EAAE,wBAAwB,CAAC,UAAU,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;IAC/E,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACK,KAAK,CAAC,2BAA2B,CAAC,KAAa;QACrD,IAAI,OAAgB,CAAC;QACrB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,gCAAgC,CAC9D,KAAK,EAAE,aAAa,CAAC,iCAAiC,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;QACxF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QACD,MAAM,GAAG,GAAI,OAAoC,EAAE,GAAG,CAAC;QACvD,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;QAC3D,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,IAAI,CAAC;QAC7C,IAAI,YAAY,GAAG,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;QACpD,IAAI,YAAY,GAAG,kCAAkC,EAAE,CAAC;YACtD,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;oBAClF,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;oBAChF,OAAO,EAAE,EAAE,OAAO,EAAE,oCAAoC,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,QAAQ,CAAC,+CAA+C,EAAE;iBAC7I,CAAC,EAAE,CAAC;QACP,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAC9B,CAAC;IAEO,QAAQ,CAAC,KAAc,EAAE,MAAe;QAC9C,4FAA4F;QAC5F,8EAA8E;QAC9E,8FAA8F;QAC9F,4FAA4F;QAC5F,wEAAwE;QACxE,EAAE;QACF,4EAA4E;QAC5E,qFAAqF;QACrF,kFAAkF;QAClF,wDAAwD;QACxD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC;YAClD,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO;mBAClB,CAAC,KAAK,CAAC,OAAO,EAAE,YAAY;oBAC7B,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE;oBAChG,CAAC,CAAC,SAAS,CAAC;mBACX,KAAK,CAAC,IAAI,CAAC;YAClB,CAAC,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC;QAChC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uCAAuC,EAAE;YACxD,KAAK,EAAE,MAAM;YACb,2FAA2F;YAC3F,6FAA6F;YAC7F,qFAAqF;YACrF,GAAG,CAAC,mBAAmB,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,YAAY;gBAC3D,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,eAAe,EAAE;gBAC9F,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;QAEH,OAAO,EAAE,OAAO,EAAE,wBAAwB,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACvE,CAAC;IAED;;;;;;;;OAQG;IACH,mBAAmB,CAAC,KAA4B;QAC9C,kGAAkG;QAClG,gGAAgG;QAChG,iGAAiG;QACjG,gGAAgG;QAChG,kEAAkE;QAClE,OAAO;YACL,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,OAAO,EAAE,OAAO,CAAC,cAAc;YAC/B,aAAa,EAAE,KAAK,CAAC,aAAa;YAElC,8DAA8D;YAC9D,8FAA8F;YAC9F,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YAExB,aAAa,EAAE,KAAK,CAAC,aAAa;YAElC,WAAW,EAAE,YAAY,CAAC,OAAO;YACjC,QAAQ,EAAE,WAAW,CAAC,MAAM;YAC5B,UAAU,EAAE,CAAC;YACb,UAAU,EAAE,CAAC;YACb,2EAA2E;YAC3E,8EAA8E;YAC9E,SAAS,EAAE,MAAM;YAEjB,SAAS,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC;YACrC,sEAAsE;YACtE,sEAAsE;YACtE,WAAW,EAAE,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC;SACvF,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,gBAAgB,CAAC,KAAa;QAClC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;QAExD,IAAI,MAAM,CAAC,OAAO,KAAK,wBAAwB,CAAC,QAAQ,EAAE,CAAC;YACzD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,cAAc,EACxB,SAAS,EACT;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;gBAChF,OAAO,EAAE;oBACP,MAAM,EAAE,MAAM,CAAC,KAAK,IAAI,uCAAuC;oBAC/D,MAAM,EAAE,0BAA0B;iBACnC;aACF,CACF,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC,cAAc,EAAE,CAAC;YACpD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,cAAc,EACxB,SAAS,EACT;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;gBAChF,OAAO,EAAE;oBACP,MAAM,EACJ,oDAAoD,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI;wBAC5E,4EAA4E;wBAC5E,6FAA6F;oBAC/F,MAAM,EAAE,0BAA0B;iBACnC;aACF,CACF,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrD,OAAO,MAAM,CAAC,OAAO,KAAK,wBAAwB,CAAC,IAAI;YACrD,CAAC,CAAC,EAAE,OAAO,EAAE,wBAAwB,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE;YAC9E,CAAC,CAAC,EAAE,OAAO,EAAE,wBAAwB,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC;IAC9D,CAAC;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,KAAK,CAAC,0BAA0B,CAC9B,KAAa,EACb,kBAA0B;QAE1B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;QAExD,IAAI,MAAM,CAAC,OAAO,KAAK,wBAAwB,CAAC,QAAQ,EAAE,CAAC;YACzD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,cAAc,EACxB,SAAS,EACT;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;gBAChF,OAAO,EAAE;oBACP,MAAM,EAAE,MAAM,CAAC,KAAK,IAAI,uCAAuC;oBAC/D,MAAM,EAAE,0BAA0B;iBACnC;aACF,CACF,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC;YACjD,IAAI,CAAC,QAAQ,CAAC,4CAA4C,EAAE;gBAC1D,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK;gBACzB,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO;aAC9B,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,MAAM,CAAC,KAAK,CAAC,UAAU,KAAK,kBAAkB,EAAE,CAAC;YACnD,IAAI,CAAC,QAAQ,CAAC,qDAAqD,EAAE;gBACnE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK;gBACzB,gBAAgB,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU;gBACzC,kBAAkB;aACnB,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,MAAM,CAAC,OAAO,KAAK,wBAAwB,CAAC,IAAI;YACrD,CAAC,CAAC,EAAE,OAAO,EAAE,wBAAwB,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE;YAC5F,CAAC,CAAC,EAAE,OAAO,EAAE,wBAAwB,CAAC,UAAU,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IAC5E,CAAC;CACF,CAAA;AA5TY,sCAAsC;IADlD,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAA;IAE5C,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IAEjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;qCAHlB,iBAAiB;QAErB,aAAa;QAEP,0BAA0B;GAThD,sCAAsC,CA4TlD","sourcesContent":["/**\n * Scheduled Message Verifier Backend Service\n *\n * Verifies JWT signatures on scheduled job messages from crontabs-batches-manager.\n * Only messages signed by the platform's crontabs-batches-manager are accepted.\n *\n * This prevents unauthorized job execution in horizontally scaled K8s environments.\n */\n\nimport { SCHEDULED_INITIAL_ADMISSION_MAX_AGE_MS, SCHEDULED_INITIAL_ADMISSION_FUTURE_SKEW_MS, SCHEDULED_LATE_DELIVERY_HORIZON_MS } from '@wildo-ai/saas-models';\nimport { injectable, inject } from 'inversify';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { JwtBackendService } from '~wildo-backend-lib/security/jwt/services/jwt.backend.service';\nimport { JwtPublicKeys } from '~wildo-backend-lib/security/authentications/models/jwt.backend.schemas';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport {\n  JobPayload,\n  JobType,\n  JobInitiator,\n  JobPriority,\n  ErrorType,\n  ErrorCustomMessageReference,\n  isWildoBackendError,\n  ScheduledDeliveryLateness,\n} from '@wildo-ai/saas-models';\nimport { z } from 'zod';\n\nimport { describeCaughtError } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\n/**\n * Common JWT envelope fields shared by every scheduled-job token shape.\n */\nconst ScheduledJobTokenEnvelopeSchema = z.object({\n  /** Job ID (unique per execution) */\n  jobId: z.string().uuid(),\n\n  /** Application ID the job belongs to */\n  applicationId: z.string(),\n\n  /** Scheduled occurrence time; manual invocations intentionally omit this claim. */\n  scheduledAt: z.iso.datetime().optional(),\n\n  /** Token issued at (standard JWT claim) */\n  iat: z.number(),\n\n  /** Token expiry (standard JWT claim) */\n  exp: z.number(),\n\n  /** Issuer (should be PLATFORM_CRONTABS_BATCHES_MANAGER) */\n  iss: z.string(),\n\n  /** Audience (should be SCHEDULED_JOB) */\n  aud: z.string(),\n});\n\n/**\n * Schema for the SCHEDULED_CRON arm of the scheduled-job token (the\n * pre-existing resource-operation / custom-batch tick).\n */\nconst ScheduledCronJobTokenSchema = ScheduledJobTokenEnvelopeSchema.extend({\n  jobType: z.literal(JobType.SCHEDULED_CRON),\n  /** Operation path key for resource operations (format: \"resource | operation | variantType | variant | isBulk:false\") */\n  operationPathKey: z.string().optional(),\n  /** Custom batch reference */\n  batchRef: z.string().optional(),\n  /** Input data for the job (JSON stringified) */\n  inputDataJson: z.string().optional(),\n});\n\n/**\n * Schema for the MINION_TICK arm of the scheduled-job token (KD-12).\n * Carries the minion identity discriminator that the minion runtime uses\n * to filter inbound ticks.\n */\nconst MinionTickJobTokenSchema = ScheduledJobTokenEnvelopeSchema.extend({\n  jobType: z.literal(JobType.MINION_TICK),\n  /** Minion name — matches `wildo.saas.config.ts > minions.<key>`, which the minion runtime knows via its compiled-in `defineMinionInit({ minionName })` identity (NOT read from the `APP_OWNED_SERVICE_NAME` env var). */\n  minionName: z.string().min(1),\n  /** Optional input data for the tick (JSON stringified) */\n  inputDataJson: z.string().optional(),\n});\n\n/**\n * Discriminated union over the two scheduled-job token shapes. Per KD-12,\n * dispatch is a pure switch on `jobType` rather than \"which optional\n * field is set\".\n */\nconst ScheduledJobTokenSchema = z.discriminatedUnion('jobType', [\n  ScheduledCronJobTokenSchema,\n  MinionTickJobTokenSchema,\n]);\n\nexport type ScheduledJobToken = z.infer<typeof ScheduledJobTokenSchema>;\nexport type ScheduledCronJobToken = z.infer<typeof ScheduledCronJobTokenSchema>;\nexport type MinionTickJobToken = z.infer<typeof MinionTickJobTokenSchema>;\n\n/**\n * What a scheduled delivery IS, decided before anything durable happens (#2212).\n *\n * Three answers, not two, because \"not admissible\" hid two opposite situations behind one\n * `AUTHENTICATION` error: a genuine token that waited out its window in a queue nobody consumed\n * (operational — the application was down) and a token that cannot be proven genuine (a trust\n * signal). Logged identically, 139 of the first per restart read as a credential outage and sent the\n * diagnosis to the wrong service.\n */\nexport enum ScheduledDeliveryVerdict {\n  /** Authentic, inside its admission window: admit it. */\n  ADMISSIBLE = 'admissible',\n  /** Authentic (signature, issuer, audience, structure all proven) but past its admission deadline: the occurrence was MISSED. */\n  LATE = 'late',\n  /** Not provably authentic, or it names an occurrence in the future: a trust failure. */\n  REJECTED = 'rejected',\n}\n\n/** Result of scheduled message verification. */\nexport type ScheduledMessageVerificationResult =\n  | { verdict: ScheduledDeliveryVerdict.ADMISSIBLE; token: ScheduledJobToken }\n  | { verdict: ScheduledDeliveryVerdict.LATE; token: ScheduledJobToken; lateness: ScheduledDeliveryLateness }\n  | { verdict: ScheduledDeliveryVerdict.REJECTED; error: string };\n\n/**\n * An authentic delivery, converted for its consumer. Only the two authentic verdicts are\n * representable here; a rejection is thrown by the `verifyAnd…` entry points.\n */\nexport type AuthenticScheduledDelivery<T> =\n  | { verdict: ScheduledDeliveryVerdict.ADMISSIBLE; value: T }\n  | { verdict: ScheduledDeliveryVerdict.LATE; value: T; lateness: ScheduledDeliveryLateness };\n\n@injectable()\nexport class ScheduledMessageVerifierBackendService {\n  protected logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.JwtBackendService)\n    private readonly jwtService: JwtBackendService,\n    @inject(SAAS_SERVICE_TYPES.Logger)\n    private readonly logger: LoggerService,\n    @inject(SAAS_SERVICE_TYPES.ErrorBuilderService)\n    private readonly errorBuilder: ErrorBuilderBackendService,\n  ) {\n    this.logDebug = this.logger.debugByType('ScheduledMessageVerifierBackendService');\n    this.logger.setDebugTypeLogging('ScheduledMessageVerifierBackendService', false);\n  }\n\n  /**\n   * Classify a scheduled job message token: admissible, late, or rejected.\n   *\n   * Only a REJECTED verdict logs here (warn), because only it is a trust signal. A LATE delivery is\n   * reported by the consumer's runner as one digest per drain, not once per message.\n   *\n   * @param token - The JWT token from the message\n   */\n  async verifyScheduledMessage(token: string): Promise<ScheduledMessageVerificationResult> {\n    let decoded: unknown;\n    let lateness: ScheduledDeliveryLateness | undefined;\n    try {\n      // Verify the JWT using the crontabs-batches-manager public key\n      decoded = await this.jwtService.verify(\n        token,\n        JwtPublicKeys.PLATFORM_CRONTABS_BATCHES_MANAGER\n      );\n    } catch (error) {\n      const expired = await this.authenticatedExpiredPayload(token);\n      // When the first failure was the clock and the re-verification refused, the REAL reason is the\n      // re-verification's (a wrong audience behind an expiry, say): logging \"jwt expired\" there would\n      // be the exact misdirection #2212 exists to remove, aimed the other way.\n      if ('refused' in expired) return this.rejected(expired.refused ?? error);\n      decoded = expired.payload;\n      lateness = ScheduledDeliveryLateness.TOKEN_EXPIRED;\n    }\n\n    // Parse and validate the token payload\n    const parseResult = ScheduledJobTokenSchema.safeParse(decoded);\n\n    if (!parseResult.success) {\n      this.logger.warn('Scheduled message token has invalid structure', {\n        issues: parseResult.error.issues,\n      });\n      return { verdict: ScheduledDeliveryVerdict.REJECTED, error: 'Invalid token structure' };\n    }\n\n    const tokenPayload = parseResult.data;\n    if (tokenPayload.scheduledAt) {\n      const age = Date.now() - Date.parse(tokenPayload.scheduledAt);\n      // A FUTURE occurrence is not lateness: a signer whose clock runs ahead, or a token minted for\n      // an instant that has not happened, is a trust question and stays a rejection.\n      if (age < -SCHEDULED_INITIAL_ADMISSION_FUTURE_SKEW_MS) {\n        return this.rejected(undefined, 'Scheduled occurrence is outside the initial admission window (in the future)');\n      }\n      // An occurrence older than the window is LATE, not a trust failure: the token is authentic and\n      // current, and the delay is shared between the scheduler's signing and this application's\n      // consumption (`ScheduledDeliveryLateness.OUTSIDE_ADMISSION_WINDOW`). Decided with #2212, whose\n      // first wording named only the expired-token case: reporting a genuine, merely late token as an\n      // authentication failure is the misdirection that issue removes, whichever gate fires.\n      if (age > SCHEDULED_INITIAL_ADMISSION_MAX_AGE_MS) lateness ??= ScheduledDeliveryLateness.OUTSIDE_ADMISSION_WINDOW;\n    }\n\n    // Note: issuer + audience are already enforced by `JwtBackendService.verify`\n    // via `JwtVerifyOptions[PLATFORM_CRONTABS_BATCHES_MANAGER]`\n    // (`issuer: 'platform_crontabs_batches_manager'` + `audience: 'SCHEDULED_JOB'`), and by the\n    // expiry-ignoring re-verification in `authenticatedExpiredPayload` for a late token.\n\n    if (lateness !== undefined) {\n      return { verdict: ScheduledDeliveryVerdict.LATE, token: tokenPayload, lateness };\n    }\n\n    this.logDebug('Scheduled message verified successfully', {\n      jobId: tokenPayload.jobId,\n      jobType: tokenPayload.jobType,\n      applicationId: tokenPayload.applicationId,\n      ...(tokenPayload.jobType === JobType.SCHEDULED_CRON\n        ? {\n            hasBatchRef: !!tokenPayload.batchRef,\n            hasOperationPathKey: !!tokenPayload.operationPathKey,\n          }\n        : { minionName: tokenPayload.minionName }),\n    });\n\n    return { verdict: ScheduledDeliveryVerdict.ADMISSIBLE, token: tokenPayload };\n  }\n\n  /**\n   * The payload of a token whose ONLY defect is expiry — or, when it is not provably that, why.\n   *\n   * `jsonwebtoken` checks expiry before audience and issuer, so a `TokenExpiredError` alone proves\n   * the signature and nothing more. Re-verifying with expiry ignored — quietly, through the same key\n   * set, rotation included — proves issuer and audience too, and the `exp` check below confirms the\n   * first failure really was the clock. Any other first failure (bad signature, wrong audience, an\n   * unknown key) fails this re-verification and stays a rejection. The late payload is never ADMITTED,\n   * so this cannot turn an expired token into a run; it only decides how the miss is reported.\n   *\n   * A token that expired longer ago than `SCHEDULED_LATE_DELIVERY_HORIZON_MS` is refused too: no\n   * genuine backlog is that old, and an authentic-but-ancient token is what a replay looks like.\n   *\n   * `refused` carries the re-verification's own error when it threw, and is `undefined` when the\n   * token re-verified but is not a recordable late delivery (not expired, or past the horizon).\n   */\n  private async authenticatedExpiredPayload(token: string): Promise<{ payload: unknown } | { refused: unknown }> {\n    let decoded: unknown;\n    try {\n      decoded = await this.jwtService.verifyWithoutBackendErrorActions(\n        token, JwtPublicKeys.PLATFORM_CRONTABS_BATCHES_MANAGER, { ignoreExpiration: true });\n    } catch (error) {\n      return { refused: error };\n    }\n    const exp = (decoded as { exp?: unknown } | null)?.exp;\n    if (typeof exp !== 'number') return { refused: undefined };\n    const expiredForMs = Date.now() - exp * 1000;\n    if (expiredForMs < 0) return { refused: undefined };\n    if (expiredForMs > SCHEDULED_LATE_DELIVERY_HORIZON_MS) {\n      return { refused: this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n        context: { message: `Scheduled delivery token expired ${Math.round(expiredForMs / 86400000)} day(s) ago, beyond the late-delivery horizon` },\n      }) };\n    }\n    return { payload: decoded };\n  }\n\n  private rejected(error: unknown, reason?: string): ScheduledMessageVerificationResult {\n    // Surface the REAL reason. A `WildoBackendError` is NOT `instanceof Error`, so the previous\n    // `... : 'Unknown error'` guard MASKED the actual cause (e.g. an empty/absent\n    // PLATFORM_CRONTABS_BATCHES_MANAGER verify key vs a genuine signature mismatch) — which hid a\n    // whole-platform \"every scheduled tick dead-letters\" bug for weeks. Never swallow it again.\n    // The unmask must reach the JWT diagnostic, not stop at the error TYPE.\n    //\n    // `verifyRaw` builds its AUTHENTICATION error with `context.jwtErrorName` +\n    // `context.jwtErrorMessage` and NO `context.message`, so a `context.message ?? type`\n    // fallback printed a bare \"AUTHENTICATION\" and discarded the only fields that say\n    // WHY — bad signature vs wrong audience vs unknown key.\n    const detail = reason ?? (isWildoBackendError(error)\n      ? (error.context?.message\n          ?? (error.context?.jwtErrorName\n            ? `${String(error.context.jwtErrorName)}: ${String(error.context.jwtErrorMessage ?? '')}`.trim()\n            : undefined)\n          ?? error.type)\n      : describeCaughtError(error));\n    this.logger.warn('Scheduled message verification failed', {\n      error: detail,\n      // Kept as discrete fields too so a log query can facet on the JWT failure kind. An expired\n      // but authentic token within the horizon never reaches here — it is a LATE verdict (#2212) —\n      // so what lands here is a trust signal, named by the check that actually refused it.\n      ...(isWildoBackendError(error) && error.context?.jwtErrorName\n        ? { jwtErrorName: error.context.jwtErrorName, jwtErrorMessage: error.context.jwtErrorMessage }\n        : {}),\n    });\n\n    return { verdict: ScheduledDeliveryVerdict.REJECTED, error: detail };\n  }\n\n  /**\n   * Convert a verified `SCHEDULED_CRON` token to a JobPayload for\n   * execution by the resource-operation / custom-batch executor pipeline.\n   *\n   * MINION_TICK conversion belongs to the minion consumer, which uses the\n   * same durable coordinator but dispatches a different local handler.\n   * The verification entry point refuses those tokens here —\n   * see `verifyAndConvert` and `verifyAndExtractMinionTick` below.\n   */\n  convertToJobPayload(token: ScheduledCronJobToken): JobPayload {\n    // No `originCorrelationId` — deliberate, and the one JobPayload writer for which that is correct.\n    // A scheduled cron tick is SCHEDULE-originated: no request enqueued it, so there is no upstream\n    // trace to join. The consumer mints a fresh id per tick, which is the accurate attribution. (The\n    // other two writers — `buildJobPayload` and `enqueueCustomBatch` — both seed it; see the writer\n    // enumeration in `.claude/plans/traceability-correlation-id.md`.)\n    return {\n      jobId: token.jobId,\n      jobType: JobType.SCHEDULED_CRON,\n      applicationId: token.applicationId,\n\n      // operationPathKey is the human-readable key format, NOT JSON\n      // The executor will parse it using ResourcesConfig_OperationPathUtils.parseOperationPathKey()\n      operationPathKey: token.operationPathKey,\n      batchRef: token.batchRef,\n\n      inputDataJson: token.inputDataJson,\n\n      initiatedBy: JobInitiator.CRONTAB,\n      priority: JobPriority.NORMAL,\n      retryCount: 0,\n      maxRetries: 0,\n      // Ordinary queue retry metadata is deliberately absent. Scheduled recovery\n      // resolves the local handler contract and persists its own attempts/deadline.\n      timeoutMs: 300000,\n\n      createdAt: new Date(token.iat * 1000),\n      // Occurrence time is not publication time. Preserve the authenticated\n      // instant in durable recovery input; manual triggers leave it absent.\n      scheduledAt: token.scheduledAt === undefined ? undefined : new Date(token.scheduledAt),\n    };\n  }\n\n  /**\n   * Verify and convert a `SCHEDULED_CRON` scheduled message in one step.\n   *\n   * Returns the converted payload with its verdict — ADMISSIBLE, or LATE with why — and throws only\n   * when the delivery is not authentic, or is a `MINION_TICK` (which the resource-operation /\n   * custom-batch executor cannot dispatch; the minion runtime owns those — use\n   * `verifyAndExtractMinionTick`). A LATE delivery is returned, never thrown: it is genuine, and the\n   * consumer records it as a missed occurrence instead of failing it (#2212).\n   *\n   * @param token - The JWT token from the message\n   * @throws WildoError if verification fails or the token targets a minion\n   */\n  async verifyAndConvert(token: string): Promise<AuthenticScheduledDelivery<JobPayload>> {\n    const result = await this.verifyScheduledMessage(token);\n\n    if (result.verdict === ScheduledDeliveryVerdict.REJECTED) {\n      throw this.errorBuilder.buildError(\n        ErrorType.AUTHENTICATION,\n        undefined,\n        {\n          customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n          context: {\n            reason: result.error || 'Scheduled message verification failed',\n            source: 'crontabs-batches-manager',\n          },\n        }\n      );\n    }\n\n    if (result.token.jobType !== JobType.SCHEDULED_CRON) {\n      throw this.errorBuilder.buildError(\n        ErrorType.AUTHENTICATION,\n        undefined,\n        {\n          customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n          context: {\n            reason:\n              `verifyAndConvert() received a token with jobType=${result.token.jobType}; ` +\n              `the resource-operation / custom-batch executor cannot dispatch this kind. ` +\n              `MINION_TICK tokens belong to the minion runtime — use verifyAndExtractMinionTick() instead.`,\n            source: 'crontabs-batches-manager',\n          },\n        }\n      );\n    }\n\n    const value = this.convertToJobPayload(result.token);\n    return result.verdict === ScheduledDeliveryVerdict.LATE\n      ? { verdict: ScheduledDeliveryVerdict.LATE, value, lateness: result.lateness }\n      : { verdict: ScheduledDeliveryVerdict.ADMISSIBLE, value };\n  }\n\n  /**\n   * Verify a scheduled message and extract a `MinionTickJobToken` if and\n   * only if the token targets the given minion (KD-12), with its verdict.\n   *\n   * Returns `null` (not throws) for the two non-actionable cases that the\n   * minion runtime should silently skip:\n   * - the token is a `SCHEDULED_CRON` (belongs to the backend-api),\n   * - the token is a `MINION_TICK` whose `minionName` does not match\n   *   `expectedMinionName`.\n   *\n   * A LATE tick is returned with its lateness, exactly like `verifyAndConvert` (#2212). Throws (typed\n   * authentication error) only when the delivery is not authentic — invalid signature, malformed\n   * payload, wrong issuer/audience, a future occurrence.\n   *\n   * The minion-side consumer passes its compiled-in `minionName` (from\n   * `defineMinionInit({ minionName })`, cross-validated against the fetched\n   * `appConfig.minions[minionName]`) as `expectedMinionName` — NOT an\n   * env-projected `APP_OWNED_SERVICE_NAME`; tokens that fail the filter\n   * should be NACK'd back to the queue (or skipped, depending on the\n   * queue-routing strategy chosen for the minion fan-out).\n   */\n  async verifyAndExtractMinionTick(\n    token: string,\n    expectedMinionName: string,\n  ): Promise<AuthenticScheduledDelivery<MinionTickJobToken> | null> {\n    const result = await this.verifyScheduledMessage(token);\n\n    if (result.verdict === ScheduledDeliveryVerdict.REJECTED) {\n      throw this.errorBuilder.buildError(\n        ErrorType.AUTHENTICATION,\n        undefined,\n        {\n          customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n          context: {\n            reason: result.error || 'Scheduled message verification failed',\n            source: 'crontabs-batches-manager',\n          },\n        }\n      );\n    }\n\n    if (result.token.jobType !== JobType.MINION_TICK) {\n      this.logDebug('Skipping non-minion-tick scheduled message', {\n        jobId: result.token.jobId,\n        jobType: result.token.jobType,\n      });\n      return null;\n    }\n\n    if (result.token.minionName !== expectedMinionName) {\n      this.logDebug('Skipping minion tick targeted at a different minion', {\n        jobId: result.token.jobId,\n        targetMinionName: result.token.minionName,\n        expectedMinionName,\n      });\n      return null;\n    }\n\n    return result.verdict === ScheduledDeliveryVerdict.LATE\n      ? { verdict: ScheduledDeliveryVerdict.LATE, value: result.token, lateness: result.lateness }\n      : { verdict: ScheduledDeliveryVerdict.ADMISSIBLE, value: result.token };\n  }\n}\n"]}