fix(server): schedule secret-proposal expiry from committed changes (#17446)

## Thinking Path > - Paperclip is the open source app people use to manage AI agents for work. > - Agents can propose secrets and bindings for approval. > - Pending proposals already contain their expiry and encrypted value. > - The server scans for expired proposals on every maintenance tick, even when none exist. > - Committed proposal changes and saved expiry times provide the required triggers. > - This PR uses those triggers and preserves scrubbing, approval checks, and recovery. > - Empty and completed proposal history no longer causes recurring expiry queries. ## Linked Issues or Issue Description Refs #17443. This is the second PR in the sleep migration stack and targets its branch. **What problem does this solve?** The periodic proposal scan contacts PostgreSQL when no proposal needs maintenance. That obstructs idle database behavior across tenant instances. **What is the proposed solution?** Use transaction-aware notifications for creation and resolution. Reconstruct the earliest pending expiry at startup. Run cleanup at that deadline, or retry while reconciliation remains unfinished. **Why is this useful?** It removes an idle scan while retaining security checks and physical ciphertext cleanup. No queue table or migration is required. ## What Changed - Added intent notifications before secret/binding creation, approval, terminal transitions, and linked interaction resolution. The existing outer transaction owns settlement. - Kept expiry selection, ciphertext scrubbing, dependent rejection, and authorization in the secret-proposal service. - Registered a startup and deadline worker in place of the aggregate maintenance sweep. Empty/terminal states disarm; overdue batches and failures retain retries. - Reused shared scoped deadline dispatch for secret expiry. The service owns company-filtered SQL and expiry policy. Custom-image expiry continues to use `registerDeadlineWork`. - Added real PostgreSQL producer, outer-transaction, concurrent-write, expiry, restart, interaction resolution, and drain/resume tests. Updated startup wiring fixtures and documented the supported writer/lifecycle contract. ## Verification - Landing reconciliation at `c10eb1bcf752b058713e05d3345e5cf38dd3fa72`: 160 tests pass across the complete secret-proposal, scoped deadline, company batch, coordinator, startup, custom-image service and custom-image worker suites; no cases skipped in the accepted runs. Server typecheck passes. This integrates master after #17443 landed; fresh remote CI and Ponytail review are required before merge. Current head: `5bbe17ad9ebc4573b08ed1a9323644ef9608ca09`. This remains a single-duty PR stacked on #17443. - Integrated pinned master `8548173fc9efdc0fa07644fb92dcc0b6851a95e5` with normal merges. Every branch passed generated-schema checks and its target-branch migration-order gate. Existing SQL is unchanged; the 25 stack migrations follow master’s new migration. - Duty-specific producer coverage, lifecycle tests, and earlier failure records: [2026-10-08-instance-sleep-and-scheduler-inventory.md](https://github.com/paperclipai/paperclip/blob/5bbe17ad9ebc4573b08ed1a9323644ef9608ca09/doc/plans/2026-10-08-instance-sleep-and-scheduler-inventory.md), [2026-10-24-recurring-server-sleep-stack.md](https://github.com/paperclipai/paperclip/blob/5bbe17ad9ebc4573b08ed1a9323644ef9608ca09/doc/plans/2026-10-24-recurring-server-sleep-stack.md). - Combined tip `51e6cbe67979b55b340ea9f0f434c5b5c682ccd6`: **355 startup/cancellation/recovery/dispatch/preservation tests**, **75 connection-management tests**, and production server typechecking pass. These combined checks do not mean every intermediate PR independently ran the full repository suite. - Real master-to-stack database upgrade passes: **379 unchanged prior migration receipts plus 25 new migrations**, with the gateway responsibility fixture preserved. - Owning-branch checks: 84 runner installation/settlement cases plus runner typechecking and generated TypeScript/Rust profile agreement; 253 GitHub review workflow cases. Stop-attribution and held-worker readiness regressions failed before their fixes. - Failure accounting: the initial combined run passed 349 cases and failed six idle assertions in a reused preservation database containing old cancelled runs. Repeating the combined command with a fresh preservation database passed. Earlier invalid project selection, merge import/type errors, and the interrupted full local suite are not counted as passing checks. - **Latest-head CI and review remain required.** Prior CI findings include GitHub idle observation, route teardown, attention cleanup, touch-picker E2E, workspace health, and voice-cleanup timing; local passes do not erase those failures. No full local repository-suite, deployed sleep, fleet cost, or live Copilot qualification claim is made. ## Risks - Notifications cover supported writers sharing the database signal owner. Independent SQL writers and other process roots require a separate ingress contract; startup recovery alone is not live replica support. - The shared coordinator and scoped worker also serve later stack duties. Their defaults remain intact; existing voice, chat, native, and startup consumers are included in integrated verification. - Startup now checks overdue proposals immediately. During drain, physical cleanup waits; approval still rejects expired proposals synchronously. - Each due company pass remains bounded to 100 rows. Failed scopes back off from 30 seconds to five minutes; healthy overdue work keeps draining. Self-generated write hints coalesce and do not erase a failed sweep's backoff. - Heartbeat-disabled behavior and Cloud sleep-safety gates remain unchanged. This does not establish deployed suspension or external wake coverage. Tool review and gateway token cleanup remain separate slices. ## Model Used OpenAI Codex, GPT-6 family, with reasoning and code execution. The exact serving model identifier and context window were not exposed. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [ ] All Paperclip CI gates are green - [ ] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Paperclip <noreply@paperclip.ing>
2026-11-10 20:46:28 +01:00 · 2026-10-27 14:36:28 -05:00
1 parent 5982246771
commit 623f1dc289
@@ -61,6 +61,7 @@ export async function deleteCompany(db: Db, id: string) {
          .where(eq(companies.id, id)).for("no key update");
        if (!existing) return null;
        await notifyDeliveryWork(tx, DELIVERY_QUEUES.skillSourceSync);
+        await notifyDeliveryWork(tx, DELIVERY_QUEUES.secretProposalExpiry, id);
        await agentObservabilityService(tx as unknown as Db).removeForCompanyDeletion(id);
        // Finance can reference costs and both can reference runs. Incidents
        // reference policies and approvals; delete these dependents first.
@@ -0,0 +1,28 @@
+export function takeCompanyWorkBatch<T extends { companyId: string }>(
+  ordered: readonly T[],
+  limit: number,
+  afterCompany: string | null = null,
+): { entries: T[]; lastCompany: string | null } {
+  const grouped = new Map<string, T[]>();
+  for (const entry of ordered) {
+    const group = grouped.get(entry.companyId);
+    if (group) group.push(entry); else grouped.set(entry.companyId, [entry]);
+  }
+  const companies = [...grouped.keys()].sort();
+  const next = afterCompany === null ? 0 : companies.findIndex(id => id > afterCompany);
+  const start = next < 0 ? 0 : next;
+  const rotation = [...companies.slice(start), ...companies.slice(0, start)];
+  const entries: T[] = [];
+  let lastCompany = afterCompany;
+  for (let round = 0; entries.length < limit; round++) {
+    let added = false;
+    for (const companyId of rotation) {
+      const entry = grouped.get(companyId)![round];
+      if (!entry) continue;
+      entries.push(entry); lastCompany = companyId; added = true;
+      if (entries.length === limit) break;
+    }
+    if (!added) break;
+  }
+  return { entries, lastCompany };
+}
@@ -1,5 +1,6 @@
 import { logger } from "../middleware/logger.js";
 import type { createDeliveryWorkCoordinator } from "./delivery-work-coordinator.js";
+import { registerDeadlineWork } from "./deadline-work.js";
 import { DELIVERY_QUEUES } from "./delivery-work-notifications.js";
 import type { environmentCustomImageService } from "./environment-custom-images.js";

@@ -9,27 +10,13 @@ export function registerCustomImageCleanupWork(
  canRun: () => boolean,
  retryMs = 30_000,
 ) {
-  let requested = 1, reconciled = 0;
-  let next: number | null = null;
-  let earliest = 0;
-  return coordinator.register(DELIVERY_QUEUES.customImageExpiry, {
+  return registerDeadlineWork(coordinator, DELIVERY_QUEUES.customImageExpiry, {
    retryMs,
-    pausePassiveMaintenance: true,
-    onSettled: () => { requested++; },
+    canRun,
    run: async () => {
-      if (!canRun()) { requested++; return; }
-      if (Date.now() < earliest) { next = earliest; return; }
-      const generation = ++requested;
-      earliest = Date.now() + retryMs;
      const result = await service.cleanupExpiredSetupSessions();
      if (result.timedOut > 0 || result.failed > 0) logger.warn(result, "environment customImage setup cleanup changed sessions");
-      const deadline = await service.nextSetupCleanupAt();
-      // Back off failed or still-overdue work, not a successfully read future deadline.
-      if (deadline === null || deadline > Date.now()) earliest = 0;
-      next = deadline === null ? null : Math.max(earliest, deadline);
-      reconciled = generation;
    },
-    hasPending: async () => requested !== reconciled,
-    nextRunAt: () => next,
+    next: () => service.nextSetupCleanupAt(),
  });
 }
@@ -0,0 +1,36 @@
+import type { createDeliveryWorkCoordinator } from "./delivery-work-coordinator.js";
+import type { DeliveryQueue } from "./delivery-work-notifications.js";
+
+export function registerDeadlineWork(
+  coordinator: ReturnType<typeof createDeliveryWorkCoordinator>,
+  queue: DeliveryQueue,
+  task: {
+    run: () => Promise<unknown>;
+    next: () => Promise<number | null>;
+    canRun: () => boolean;
+    retryMs: number;
+  },
+) {
+  let requested = 1, reconciled = 0;
+  let next: number | null = null;
+  let earliest = 0;
+  return coordinator.register(queue, {
+    retryMs: task.retryMs,
+    pausePassiveMaintenance: true,
+    onSettled: () => { requested++; },
+    run: async () => {
+      if (!task.canRun()) { requested++; return; }
+      if (Date.now() < earliest) { next = earliest; return; }
+      const generation = ++requested;
+      earliest = Date.now() + task.retryMs;
+      await task.run();
+      const deadline = await task.next();
+      // Back off failed or still-overdue work, not a successfully read future deadline.
+      if (deadline === null || deadline > Date.now()) earliest = 0;
+      next = deadline === null ? null : Math.max(earliest, deadline);
+      reconciled = generation;
+    },
+    hasPending: async () => requested !== reconciled,
+    nextRunAt: () => next,
+  });
+}
@@ -26,6 +26,9 @@ export function createDeliveryWorkCoordinator(input: {
      onSettled?: (hints?: ReadonlySet<string>) => void;
      // Optional maintenance/retry deadline restored from durable state.
      nextRunAt?: () => number | null;
+      // Opt in only when run has recorded per-item failure backoffs. Other
+      // eligible items may already be due, unlike an unchanged failed deadline.
+      nextRunAtOnError?: () => number | null;
      // An empty queue's maintenance may wait until dispatch admission reopens.
      // Notifications and unresolved producer writes still reconcile in drain.
      pausePassiveMaintenance?: boolean;
@@ -65,9 +68,10 @@ export function createDeliveryWorkCoordinator(input: {
        dirty = false;
        const finish = beginIdleTrackedWork();
        const attempt = new AbortController();
+        let runFailed = false;
        controller = attempt;
        running = Promise.resolve().then(() => reconcileDatabaseWork(input.owner, queue))
-          .then(() => workerStopped || !(input.canRun() || (task.runDuringDrain && input.canReconcile?.())) ? undefined : task.run(attempt.signal)).then(() => workerStopped ? false : task.hasPending()).then(pending => {
+          .then(() => workerStopped || !(input.canRun() || (task.runDuringDrain && input.canReconcile?.())) ? undefined : task.run(attempt.signal).catch(error => { runFailed = true; throw error; })).then(() => workerStopped ? false : task.hasPending()).then(pending => {
          pendingWork = pending || databaseWorkPending(input.owner, queue);
          if (pendingWork) schedule(task.retryMs);
          else { finishIntent?.(); finishIntent = undefined; }
@@ -78,9 +82,17 @@ export function createDeliveryWorkCoordinator(input: {
          }
        }).catch(error => {
          schedule(task.retryMs);
+          let failure = error;
+          try {
+            const scopedRetry = runFailed && task.nextRunAtOnError;
+            const next = input.canRun() ? (scopedRetry ? scopedRetry() : task.nextRunAt?.()) : null;
+            if (next != null && (scopedRetry || next > Date.now())) schedule(0, Math.max(Date.now(), next));
+          } catch (deadlineError) {
+            failure = new AggregateError([error, deadlineError], "Delivery failure deadline could not be read");
+          }
          // Logging must never turn a recoverable sweep failure into an
          // unhandled rejection or prevent other queues from running.
-          try { if (!workerStopped) input.onError(error, queue); } catch { /* Recovery remains scheduled. */ }
+          try { if (!workerStopped) input.onError(failure, queue); } catch { /* Recovery remains scheduled. */ }
        }).finally(() => {
          running = null;
          controller = null;
@@ -9,6 +9,7 @@ export const DELIVERY_QUEUES = {
  executionStatus: "execution-status",
  executionDisposition: "execution-disposition",
  environmentCleanup: "environment-cleanup",
+  secretProposalExpiry: "secret-proposal-expiry",
  customImageExpiry: "custom-image-expiry",
  historicalCleanup: "historical-cleanup",
  adapterLoginCleanup: "adapter-login-cleanup",
@@ -1159,6 +1159,7 @@ async function resolveLinkedSecretProposal(
 ) {
  const proposalId = linkedSecretProposalId(interaction);
  if (!proposalId) return;
+  await notifyDeliveryWork(db, DELIVERY_QUEUES.secretProposalExpiry, interaction.companyId);
  const [proposal] = await db
    .update(companySecretProposals)
    .set({
@@ -3181,6 +3182,7 @@ export function issueThreadInteractionService(
          : execution.status;
        if (executionStatus === "failed" && proposal.status === "pending") {
          const resolutionReason = `Interaction acceptance failed: ${execution.errorCode ?? "secret_proposal_execution_failed"}`;
+          await notifyDeliveryWork(tx, DELIVERY_QUEUES.secretProposalExpiry, proposal.companyId);
          await tx
            .update(companySecretProposals)
            .set({
@@ -0,0 +1,99 @@
+import { takeCompanyWorkBatch } from "./company-work-batch.js";
+import type { createDeliveryWorkCoordinator } from "./delivery-work-coordinator.js";
+import type { DeliveryQueue } from "./delivery-work-notifications.js";
+
+type ScheduledEntry = { id: string; companyId: string; dueAt: number };
+
+/** Coalesced scope reconstruction and fair deadline dispatch. Domain owners
+ * supply persistence, eligibility, and execution; this helper owns no SQL. */
+export function registerScopedDeadlineWork<Entry extends ScheduledEntry, Scope>(
+  coordinator: ReturnType<typeof createDeliveryWorkCoordinator>,
+  options: {
+    queue: DeliveryQueue;
+    batchSize?: number;
+    minimumPassIntervalMs?: number;
+    decodeScope(hint: string): Scope | undefined;
+    matches(entry: Entry, scope?: Scope): boolean;
+    load(scope?: Scope, signal?: AbortSignal): Promise<Entry[]>;
+    check(entry: Entry, signal?: AbortSignal): Promise<Entry | null>;
+  },
+  canRun: () => boolean,
+) {
+  const dirty = new Set<string>(["*"]);
+  const entries = new Map<string, Entry>();
+  const failures = new Map<string, { count: number; retryAt: number }>();
+  const scopeFailures = new Map<string, { count: number; retryAt: number }>();
+  let earliest = 0;
+  let lastCompany: string | null = null;
+  function failed(map: typeof failures, id: string) {
+    const count = Math.min((map.get(id)?.count ?? 0) + 1, 5);
+    map.set(id, { count, retryAt: Date.now() + Math.min(300_000, 30_000 * 2 ** (count - 1)) });
+  }
+  function dirtyScopes() {
+    return [...dirty].map(hint => { try { return options.decodeScope(hint); } catch { return undefined; } });
+  }
+  function next() {
+    if (!canRun()) return dirty.size > 0 || entries.size > 0 ? Date.now() + 30_000 : null;
+    let nextAt: number | null = null;
+    const take = (at: number) => { nextAt = nextAt === null ? at : Math.min(nextAt, at); };
+    for (const hint of dirty.has("*") ? ["*"] : dirty) take(Math.max(earliest, scopeFailures.get(hint)?.retryAt ?? 0));
+    const unavailable = dirtyScopes();
+    for (const entry of entries.values()) if (!unavailable.some(scope => options.matches(entry, scope)))
+      take(Math.max(earliest, entry.dueAt, failures.get(entry.id)?.retryAt ?? 0));
+    return nextAt;
+  }
+  const worker = coordinator.register(options.queue, {
+    retryMs: 30_000,
+    pausePassiveMaintenance: true,
+    onSettled: hints => { for (const hint of hints ?? ["*"]) dirty.add(hint); },
+    run: async signal => {
+      if (!canRun() || Date.now() < earliest) return;
+      earliest = Date.now() + (options.minimumPassIntervalMs ?? 1000);
+      const errors: unknown[] = [];
+      const requested = (dirty.has("*") ? ["*"] : [...dirty]).filter(hint => (scopeFailures.get(hint)?.retryAt ?? 0) <= Date.now());
+      const covered = requested.includes("*") ? [...dirty] : requested;
+      for (const hint of covered) dirty.delete(hint);
+      for (let index = 0; index < requested.length; index++) {
+        if (signal.aborted || !canRun()) { for (const hint of requested.includes("*") ? covered : requested.slice(index)) dirty.add(hint); return; }
+        const hint = requested[index];
+        let scope: Scope | undefined;
+        let decoded = false;
+        try {
+          scope = options.decodeScope(hint); decoded = true;
+          const rows = await options.load(scope, signal), retained = new Set(rows.map(row => row.id));
+          for (const entry of entries.values()) if (options.matches(entry, scope) && !retained.has(entry.id)) {
+            entries.delete(entry.id); failures.delete(entry.id);
+          }
+          for (const entry of rows) entries.set(entry.id, entry);
+          if (!scope) scopeFailures.clear(); else scopeFailures.delete(hint);
+        } catch (error) {
+          const retryHint = decoded ? hint : "*";
+          dirty.add(retryHint); failed(scopeFailures, retryHint); errors.push(error);
+        }
+      }
+      const unavailable = dirtyScopes();
+      const due = [...entries.values()].filter(entry => !unavailable.some(scope => options.matches(entry, scope))
+        && Math.max(entry.dueAt, failures.get(entry.id)?.retryAt ?? 0) <= Date.now())
+        .sort((a, b) => a.dueAt - b.dueAt || a.id.localeCompare(b.id));
+      const batch = takeCompanyWorkBatch(due, options.batchSize ?? 25, lastCompany); lastCompany = batch.lastCompany;
+      for (const entry of batch.entries) {
+        if (signal.aborted || !canRun()) break;
+        try {
+          const current = await options.check(entry, signal);
+          if (current) entries.set(entry.id, current); else entries.delete(entry.id);
+          failures.delete(entry.id);
+        } catch (error) { failed(failures, entry.id); errors.push(error); }
+      }
+      if (errors.length) throw new AggregateError(errors, `${options.queue} could not settle`);
+    },
+    // Retain scopes/deadlines for resume without retaining a settled write's
+    // idle hold during drain. The coordinator still fences unresolved XIDs.
+    hasPending: async () => canRun() && dirty.size > 0,
+    nextRunAt: next,
+    nextRunAtOnError: next,
+  });
+  return { ...worker, invalidate(hint = "*") {
+    dirty.add(hint);
+    worker.wake();
+  } };
+}
@@ -0,0 +1,29 @@
+import { logger } from "../middleware/logger.js";
+import type { createDeliveryWorkCoordinator } from "./delivery-work-coordinator.js";
+import { DELIVERY_QUEUES } from "./delivery-work-notifications.js";
+import { registerScopedDeadlineWork } from "./scoped-deadline-work.js";
+import type { createSecretProposalsService } from "./secret-proposals.js";
+
+export function registerSecretProposalExpiryWork(
+  coordinator: ReturnType<typeof createDeliveryWorkCoordinator>,
+  service: Pick<ReturnType<typeof createSecretProposalsService>, "sweepExpiredForCompany" | "expiryDeadlines">,
+  canRun: () => boolean,
+) {
+  return registerScopedDeadlineWork(coordinator, {
+    queue: DELIVERY_QUEUES.secretProposalExpiry,
+    batchSize: 1,
+    // Saved expiry deadlines are authoritative, including deadlines less than
+    // a second away. Only actual failures require a recovery backoff.
+    minimumPassIntervalMs: 0,
+    decodeScope: hint => hint === "*" ? undefined : hint,
+    matches: (entry, companyId?: string) => companyId === undefined || entry.companyId === companyId,
+    load: async (companyId?: string) => (await service.expiryDeadlines(companyId))
+      .map(row => ({ ...row, id: row.companyId })),
+    check: async entry => {
+      const expired = await service.sweepExpiredForCompany(entry.companyId);
+      if (expired > 0) logger.warn({ companyId: entry.companyId, expired }, "secret proposal expiry scrubbed proposals");
+      const [next] = await service.expiryDeadlines(entry.companyId);
+      return next ? { ...next, id: next.companyId } : null;
+    },
+  }, canRun);
+}
@@ -1,3 +1,4 @@
+import { DELIVERY_QUEUES, notifyDeliveryWork } from "./delivery-work-notifications.js";
 import { updateAgentConfigurationInTransaction } from "./agent-configuration-transaction.js";
 import { withAgentAppearance } from "@paperclipai/shared";
 import { and, count, desc, eq, gte, inArray, lte, or, sql } from "drizzle-orm";
@@ -144,6 +145,7 @@ export function createSecretProposalsService(db: Db) {
        });
        return { denial, value: null };
      }
+      await notifyDeliveryWork(txDb, DELIVERY_QUEUES.secretProposalExpiry, input.companyId);
      return { denial: null, value: await create(txDb) };
    });
    if (result.denial) throw unprocessable(result.denial.message);
@@ -619,6 +621,7 @@ export function createSecretProposalsService(db: Db) {
    appliedBindingConfigPath?: string | null;
  }) {
    const now = new Date();
+    await notifyDeliveryWork(txDb, DELIVERY_QUEUES.secretProposalExpiry, proposal.companyId);
    const updated = await txDb.update(companySecretProposals).set({
      status: "approved",
      resolvedByUserId: input.resolvedByUserId,
@@ -794,6 +797,7 @@ export function createSecretProposalsService(db: Db) {
    const now = new Date();
    return db.transaction(async (tx) => {
      const txDb = tx as unknown as Db;
+      await notifyDeliveryWork(tx, DELIVERY_QUEUES.secretProposalExpiry, companyId);
      const updated = await tx.update(companySecretProposals).set({
        status,
        resolvedByUserId: input.resolvedByUserId ?? null,
@@ -868,10 +872,12 @@ export function createSecretProposalsService(db: Db) {
    limit = DEFAULT_EXPIRY_SWEEP_LIMIT,
    expireProposal: (companyId: string, proposalId: string) => Promise<unknown> =
      (companyId, proposalId) => transition(companyId, proposalId, "expired", { reason: "Pending proposal expired" }),
+    companyId?: string,
  ) {
    const expired = await db.select({ id: companySecretProposals.id, companyId: companySecretProposals.companyId })
      .from(companySecretProposals)
-      .where(and(eq(companySecretProposals.status, "pending"), lte(companySecretProposals.expiresAt, now)))
+      .where(and(eq(companySecretProposals.status, "pending"), lte(companySecretProposals.expiresAt, now),
+        companyId === undefined ? undefined : eq(companySecretProposals.companyId, companyId)))
      .orderBy(companySecretProposals.expiresAt)
      .limit(limit);
    let expiredCount = 0;
@@ -887,5 +893,25 @@ export function createSecretProposalsService(db: Db) {
    return expiredCount;
  }

-  return { getById, view: enrich, createSecret, createBinding, listForAgent, listForBoard, assertBindingSnapshotCurrent, approve, transition, sweepExpired };
+  async function sweepExpiredForCompany(companyId: string) {
+    return sweepExpired(new Date(), DEFAULT_EXPIRY_SWEEP_LIMIT, undefined, companyId);
+  }
+
+  async function expiryDeadlines(companyId?: string) {
+    const rows = await db.select({ companyId: companySecretProposals.companyId,
+      at: sql<string | Date>`min(${companySecretProposals.expiresAt})` })
+      .from(companySecretProposals)
+      .where(and(eq(companySecretProposals.status, "pending"),
+        companyId === undefined ? undefined : eq(companySecretProposals.companyId, companyId)))
+      .groupBy(companySecretProposals.companyId);
+    return rows.map(row => ({ companyId: row.companyId, dueAt: new Date(row.at).getTime() }));
+  }
+
+  async function nextExpiryAt(): Promise<number | null> {
+    const [row] = await db.select({ at: sql<string | Date | null>`min(${companySecretProposals.expiresAt})` })
+      .from(companySecretProposals).where(eq(companySecretProposals.status, "pending"));
+    return row?.at == null ? null : new Date(row.at).getTime();
+  }
+
+  return { getById, view: enrich, createSecret, createBinding, listForAgent, listForBoard, assertBindingSnapshotCurrent, approve, transition, sweepExpired, sweepExpiredForCompany, expiryDeadlines, nextExpiryAt };
 }