Certification Expiry Nightly Cron Job

This component is medium complexity and is a coordinating orchestrator, meaning its own logic is relatively thin but its correctness depends entirely on the reliability of its two dependencies: Certification Reminder Service and Certification Management Service. Both must be stable and tested before end-to-end cron validation is possible. The scheduling infrastructure (cron host, timezone configuration, execution guarantees) must be decided early — whether this runs on a cloud scheduler (e.g., Supabase Edge Function cron, AWS EventBridge) affects the deployment model. Monitoring and alerting for failed nightly runs are non-negotiable acceptance criteria, as a silent failure would leave expiring certifications unprocessed.

Run logs must be retained for audit purposes.

The cron exposes scheduleNightlyRun(cronExpression) for configuration, executeExpiryCheck() as the main execution method, and onRunComplete(result)/onRunError(error) hooks for observability integration. Internally, executeExpiryCheck() should query certifications at the 30, 14, and 7-day thresholds by delegating to certification-reminder-service, and identify same-day expiries to trigger auto-pause via certification-management-service. Each invocation should be idempotent — running twice in a night must not double-send reminders or double-apply status transitions. Implement structured logging per run with a unique run ID.

Consider wrapping the entire execution in a try/catch that calls onRunError and emits an alert metric so operations teams can respond to failures before the next nightly window.