@wildo-ai/saas-backend-lib 1.1.1 → 1.1.3

package/dist/esm/compliance/audit-trails/services/composite-audit-log-sink.backend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"composite-audit-log-sink.backend.d.ts","sourceRoot":"","sources":["../../../../../../src/compliance/audit-trails/services/composite-audit-log-sink.backend.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,YAAY,EACZ,qBAAqB,EACrB,6BAA6B,EAC7B,oBAAoB,EACrB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,4FAA4F,CAAC;AAC1J,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,0FAA0F,CAAC;AACtJ,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sEAAsE,CAAC;AAa3G;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,qBACa,qBAAsB,YAAW,YAAY;IAMtD,OAAO,CAAC,QAAQ,CAAC,yBAAyB;IAE1C,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IAExC,OAAO,CAAC,QAAQ,CAAC,cAAc;IATjC,oFAAoF;IACpF,OAAO,CAAC,aAAa,CAA8C;gBAIhD,yBAAyB,EAAE,uCAAuC,EAElE,uBAAuB,EAAE,qCAAqC,EAE9D,cAAc,EAAE,cAAc;IAGjD;;;;OAIG;IACH,OAAO,CAAC,cAAc;IAuDtB,2DAA2D;IACpD,QAAQ,IAAI,OAAO;IAI1B;;;;;;;;OAQG;IACI,oBAAoB,IAAI,KAAK,CAAC,YAAY,GAAG,6BAA6B,CAAC;IAUlF;;;;;;;OAOG;IACI,kBAAkB,IAAI,KAAK,CAAC,YAAY,GAAG,oBAAoB,CAAC;IASvE;;;;OAIG;IACU,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC;IAwB1E,mEAAmE;IACtD,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;CAcvC"}
+{"version":3,"file":"composite-audit-log-sink.backend.d.ts","sourceRoot":"","sources":["../../../../../../src/compliance/audit-trails/services/composite-audit-log-sink.backend.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,YAAY,EACZ,qBAAqB,EACrB,6BAA6B,EAC7B,oBAAoB,EACrB,MAAM,uBAAuB,CAAC;AAS/B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,4FAA4F,CAAC;AAC1J,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,0FAA0F,CAAC;AACtJ,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sEAAsE,CAAC;AAa3G;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,qBACa,qBAAsB,YAAW,YAAY;IAMtD,OAAO,CAAC,QAAQ,CAAC,yBAAyB;IAE1C,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IAExC,OAAO,CAAC,QAAQ,CAAC,cAAc;IATjC,oFAAoF;IACpF,OAAO,CAAC,aAAa,CAA8C;gBAIhD,yBAAyB,EAAE,uCAAuC,EAElE,uBAAuB,EAAE,qCAAqC,EAE9D,cAAc,EAAE,cAAc;IAGjD;;;;OAIG;IACH,OAAO,CAAC,cAAc;IAuDtB,2DAA2D;IACpD,QAAQ,IAAI,OAAO;IAI1B;;;;;;;;OAQG;IACI,oBAAoB,IAAI,KAAK,CAAC,YAAY,GAAG,6BAA6B,CAAC;IAUlF;;;;;;;OAOG;IACI,kBAAkB,IAAI,KAAK,CAAC,YAAY,GAAG,oBAAoB,CAAC;IASvE;;;;OAIG;IACU,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC;IAwB1E,mEAAmE;IACtD,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;CAcvC"}

package/dist/esm/compliance/audit-trails/services/composite-audit-log-sink.backend.js

@@ -12,7 +12,13 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 };
 import { injectable, inject } from 'inversify';
 import { EngineCapability } from '@wildo-ai/saas-models';
-import { buildAuditLogSinkFromModule } from '@wildo-ai/external-connectors-private/backend';
+/*
+ * `/backend-runtime`, not `/backend` (#330). The two barrels expose the same builder; `/backend` also
+ * re-exports the engine's EAGERLY composed provider catalogue, and ES module semantics mean that one
+ * value import evaluates all twenty-two provider modules — six of them pulling an `@ai-sdk/*` client
+ * — into whatever process imports this file. This file is in every backend's boot graph.
+ */
+import { buildAuditLogSinkFromModule } from '@wildo-ai/external-connectors-private/backend-runtime';
 import { SAAS_SERVICE_TYPES } from '../../../inject/models/service-types.js';
 import { projectCaughtErrorLogFields } from '../../../errors/utils/error-log-level-classification.backend.utils.js';
 /**

package/dist/esm/compliance/audit-trails/services/composite-audit-log-sink.backend.js.map

@@ -1 +1 @@
-{"version":3,"file":"composite-audit-log-sink.backend.js","sourceRoot":"","sources":["../../../../../../src/compliance/audit-trails/services/composite-audit-log-sink.backend.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAOzD,OAAO,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AAC5F,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAIpF,OAAO,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAY3H;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEI,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;IAMb;IAEA;IAEA;IATnB,oFAAoF;IAC5E,aAAa,GAAoC,SAAS,CAAC;IAEnE,YAEmB,yBAAkE,EAElE,uBAA8D,EAE9D,cAA8B;QAJ9B,8BAAyB,GAAzB,yBAAyB,CAAyC;QAElE,4BAAuB,GAAvB,uBAAuB,CAAuC;QAE9D,mBAAc,GAAd,cAAc,CAAgB;IAC9C,CAAC;IAEJ;;;;OAIG;IACK,cAAc;QACpB,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACrC,OAAO,IAAI,CAAC,aAAa,CAAC;QAC5B,CAAC;QACD,4EAA4E;QAC5E,6EAA6E;QAC7E,uDAAuD;QACvD,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,OAAO,EAAE,EAAE,CAAC;YAC9C,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,IAAI,CAAC,yBAAyB,CAAC,oCAAoC,CACtF,gBAAgB,CAAC,sBAAsB,CACxC,CAAC;YACF,MAAM,KAAK,GAAwB,EAAE,CAAC;YACtC,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;gBACvC,MAAM,MAAM,GAAG,IAAI,CAAC,uBAAuB,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;gBACrE,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,SAAS;gBACX,CAAC;gBACD,2FAA2F;gBAC3F,2FAA2F;gBAC3F,2FAA2F;gBAC3F,+EAA+E;gBAC/E,MAAM,IAAI,GAAG,2BAA2B,CACtC,MAAM,EACN,OAAO,EACP,GAAG,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,yBAAyB,CAAC,EAAE,WAAW,EAAE,CAAC;gBACpE,+FAA+F;gBAC/F,iGAAiG;gBACjG,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,qCAAqC,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAC/F,CAAC;gBACF,IAAI,IAAI,EAAE,CAAC;oBACT,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;gBACzC,CAAC;YACH,CAAC;YACD,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;YAC3B,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,0EAA0E;YAC1E,0EAA0E;YAC1E,sEAAsE;YACtE,wEAAwE;YACxE,kCAAkC;YAClC,sEAAsE;YACtE,+EAA+E;YAC/E,yEAAyE;YACzE,OAAO,CAAC,KAAK,CACX,kEAAkE,EAClE,2BAA2B,CAAC,GAAG,CAAC,CACjC,CAAC;YACF,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,2DAA2D;IACpD,QAAQ;QACb,OAAO,IAAI,CAAC,cAAc,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1C,CAAC;IAED;;;;;;;;OAQG;IACI,oBAAoB;QACzB,OAAO,IAAI,CAAC,cAAc,EAAE;aACzB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;aAC1B,MAAM,CACL,CAAC,IAAI,EAAwD,EAAE,CAC7D,OAAQ,IAA+C,CAAC,2BAA2B,KAAK,UAAU;YAClG,OAAQ,IAA+C,CAAC,2BAA2B,KAAK,UAAU,CACrG,CAAC;IACN,CAAC;IAED;;;;;;;OAOG;IACI,kBAAkB;QACvB,OAAO,IAAI,CAAC,cAAc,EAAE;aACzB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;aAC1B,MAAM,CACL,CAAC,IAAI,EAA+C,EAAE,CACpD,OAAQ,IAAsC,CAAC,gBAAgB,KAAK,UAAU,CACjF,CAAC;IACN,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,gBAAgB,CAAC,KAA4B;QACxD,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACpC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO;QACT,CAAC;QACD,MAAM,OAAO,CAAC,GAAG,CACf,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE;YAChC,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;YACrC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,0EAA0E;gBAC1E,wEAAwE;gBACxE,wEAAwE;gBACxE,gDAAgD;gBAChD,IAAI,CAAC,cAAc,CAAC,sBAAsB,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC;gBACjE,OAAO,CAAC,KAAK,CAAC,0CAA0C,EAAE;oBACxD,WAAW,EAAE,GAAG;oBAChB,GAAG,2BAA2B,CAAC,GAAG,CAAC;iBACpC,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IAED,mEAAmE;IAC5D,KAAK,CAAC,QAAQ;QACnB,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACrC,OAAO;QACT,CAAC;QACD,MAAM,OAAO,CAAC,GAAG,CACf,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;YACxC,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;YAC1B,CAAC;YAAC,MAAM,CAAC;gBACP,oBAAoB;YACtB,CAAC;QACH,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;CACF,CAAA;AA9JY,qBAAqB;IADjC,UAAU,EAAE;IAMR,WAAA,MAAM,CAAC,kBAAkB,CAAC,gCAAgC,CAAC,CAAA;IAE3D,WAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;IAEzD,WAAA,MAAM,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAA;;GATjC,qBAAqB,CA8JjC","sourcesContent":["import { injectable, inject } from 'inversify';\nimport { EngineCapability } from '@wildo-ai/saas-models';\nimport type {\n  AuditLogSink,\n  AuditLogEventEmission,\n  AuditReconcileCheckpointStore,\n  AuditLogVerification,\n} from '@wildo-ai/saas-models';\nimport { buildAuditLogSinkFromModule } from '@wildo-ai/external-connectors-private/backend';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { ExternalProvidersRegistryBackendService } from '~wildo-backend-lib/external-providers/services/external-providers-registry.backend.service';\nimport type { BackendProviderRegistryBackendService } from '~wildo-backend-lib/external-providers/services/backend-provider-registry.backend.service';\nimport type { MetricsService } from '~wildo-backend-lib/monitoring/observability/services/metrics.service';\nimport { projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\n\n/**\n * A resolved audit sink paired with the provider ref it was built from. Keeping\n * the ref lets failure metrics + logs name the offending provider (immudb, a\n * SIEM, …) instead of an anonymous index.\n */\ninterface ResolvedAuditSink {\n  ref: string;\n  sink: AuditLogSink;\n}\n\n/**\n * Engine-side `AuditLogSink` that fans EVERY audit event out to ALL providers\n * declaring `EngineCapability.COMPLIANCE_AUDIT_TRAIL` (a FAN_OUT capability),\n * resolved LAZILY from the app's `defineSaaSProviders` config.\n *\n * This is the Layer-2 provider fan-out — layered ON TOP of the always-on Layer-1\n * database audit store (`AuditLogsBackendService`). It is NOT the authoritative\n * store; a backend with zero audit providers keeps this a byte-identical no-op.\n *\n * **Why lazy.** The selection-aware registry only knows the declared providers\n * after `initialize()` (during startup, after the DI container is built), and\n * `AuditLogsBackendService` caches this reference at construction. So this object\n * is bound EAGERLY (a stable reference) but resolves providers on first use — by\n * which point (an actual audit event) the registry is initialized. Mirrors\n * `LlmObservabilityAgentCallTraceSink` / `EmailBackendService`.\n *\n * **Delivery.** Every resolved sink receives every event; a single sink's failure\n * is ISOLATED and never thrown onto the caller (the business-op path — F7). A\n * failure is ALSO made OBSERVABLE via `MetricsService.recordAuditSinkFailure`\n * (F6): fire-and-forget is correct (audit must never break the business op), but\n * a silently-failing sink must not masquerade as a healthy pipeline — the metric\n * lets \"we think we're auditing but we aren't\" surface on the observability layer\n * (→ an alert via the alerting workstream), not just a swallowed log line. This\n * honours the `AuditLogSink` contract (at-least-once per sink, non-blocking) —\n * the sinks own their own durable buffering + retry.\n *\n * Each resolved sink is kept paired with the provider ref it was built from, so\n * the completeness reconciler ({@link getReconcilableSinks}) and external-auditor\n * verification ({@link getVerifiableSinks}) can narrow to the sinks supporting\n * those optional capabilities.\n */\n@injectable()\nexport class CompositeAuditLogSink implements AuditLogSink {\n  /** `undefined` = not yet resolved; else the (possibly empty) resolved sink list. */\n  private resolvedSinks: ResolvedAuditSink[] | undefined = undefined;\n\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.ExternalProvidersRegistryService)\n    private readonly externalProvidersRegistry: ExternalProvidersRegistryBackendService,\n    @inject(SAAS_SERVICE_TYPES.BackendProviderRegistryService)\n    private readonly backendProviderRegistry: BackendProviderRegistryBackendService,\n    @inject(SAAS_SERVICE_TYPES.MetricsService)\n    private readonly metricsService: MetricsService,\n  ) {}\n\n  /**\n   * Resolve (once) every declared audit-provider sink. Caches the result,\n   * including an empty list. If the registry is not yet initialized (a call before\n   * startup completes), the attempt is NOT cached so a later call retries.\n   */\n  private ensureResolved(): ResolvedAuditSink[] {\n    if (this.resolvedSinks !== undefined) {\n      return this.resolvedSinks;\n    }\n    // Expected pre-startup window: the selection-aware registry isn't populated\n    // until initialize() runs. Stay unresolved (retry on the next event) WITHOUT\n    // logging — this is normal boot ordering, not a fault.\n    if (!this.externalProvidersRegistry.isReady()) {\n      return [];\n    }\n    try {\n      const providerRefs = this.externalProvidersRegistry.getResolvedProviderRefsForCapability(\n        EngineCapability.COMPLIANCE_AUDIT_TRAIL,\n      );\n      const sinks: ResolvedAuditSink[] = [];\n      for (const providerRef of providerRefs) {\n        const module = this.backendProviderRegistry.getProvider(providerRef);\n        if (!module) {\n          continue;\n        }\n        // Thread a tamper-metric hook bound to this provider ref: a sink that PROVES its store was\n        // rolled back/tampered (immudb's durable-state consistency proof) surfaces on the distinct\n        // `audit_tamper_detected_total{provider}` counter. The sink cannot import `MetricsService`\n        // (dependency direction), so this callback is how the signal crosses the wall.\n        const sink = buildAuditLogSinkFromModule(\n          module,\n          console,\n          () => this.metricsService.recordAuditTamperDetected({ providerRef }),\n          // Assurance DEGRADATION (ephemeral / corrupt anchor / un-pinned identity change / per-op proof\n          // failure) — distinct `audit_integrity_assurance_degraded_total{provider,reason}`, non-latching.\n          (reason) => this.metricsService.recordAuditIntegrityAssuranceDegraded({ providerRef, reason }),\n        );\n        if (sink) {\n          sinks.push({ ref: providerRef, sink });\n        }\n      }\n      this.resolvedSinks = sinks;\n      return sinks;\n    } catch (err) {\n      // Post-init resolution fault (a mis-projected registry, a throwing module\n      // factory) — NOT the expected pre-init path (guarded above). Do NOT cache\n      // (so a later event retries) and SURFACE it: a silently-failing audit\n      // pipeline masquerading as \"no providers declared\" is exactly the audit\n      // black hole this guards against.\n      // `projectCaughtErrorLogFields`, not an `instanceof Error` ternary: a\n      // `WildoError_Backend` is a plain object, so the ternary would render the very\n      // fault this guard exists to surface as the literal `'[object Object]'`.\n      console.error(\n        '[audit] failed to resolve provider sinks (non-fatal, will retry)',\n        projectCaughtErrorLogFields(err),\n      );\n      return [];\n    }\n  }\n\n  /** Whether any audit provider is declared + configured. */\n  public isActive(): boolean {\n    return this.ensureResolved().length > 0;\n  }\n\n  /**\n   * The resolved audit sinks that ALSO support reconcile-checkpointing\n   * ({@link AuditReconcileCheckpointStore}) — i.e. can persist the completeness\n   * reconciler's high-water mark in their own store (immudb). The reconciler drives\n   * these per-sink (get checkpoint → replay DB events since it → set checkpoint); a\n   * sink that can't checkpoint (a fire-and-forget SIEM webhook) is simply absent.\n   * Returns the SAME sink instances the real-time fan-out uses, so the reconciler\n   * shares ONE immudb connection with the live write path.\n   */\n  public getReconcilableSinks(): Array<AuditLogSink & AuditReconcileCheckpointStore> {\n    return this.ensureResolved()\n      .map((entry) => entry.sink)\n      .filter(\n        (sink): sink is AuditLogSink & AuditReconcileCheckpointStore =>\n          typeof (sink as Partial<AuditReconcileCheckpointStore>).getAuditReconcileCheckpoint === 'function' &&\n          typeof (sink as Partial<AuditReconcileCheckpointStore>).setAuditReconcileCheckpoint === 'function',\n      );\n  }\n\n  /**\n   * The resolved audit sinks that ALSO support cryptographic VERIFICATION\n   * ({@link AuditLogVerification}) — i.e. can prove a recorded event is present +\n   * untampered (immudb inclusion proofs). This is an EXTERNAL-AUDITOR read path,\n   * resolved SEPARATELY from the write fan-out; a sink whose technology can't prove\n   * non-tampering (a fire-and-forget SIEM webhook) is simply absent. Returns the\n   * SAME sink instances the fan-out uses, sharing their live connection.\n   */\n  public getVerifiableSinks(): Array<AuditLogSink & AuditLogVerification> {\n    return this.ensureResolved()\n      .map((entry) => entry.sink)\n      .filter(\n        (sink): sink is AuditLogSink & AuditLogVerification =>\n          typeof (sink as Partial<AuditLogVerification>).verifyAuditEvent === 'function',\n      );\n  }\n\n  /**\n   * Fan the event out to EVERY resolved sink, isolating per-sink failures so one\n   * never affects the others (each destination is independent — F7), and NEVER\n   * throwing onto the caller (fire-and-forget from the business op).\n   */\n  public async recordAuditEvent(event: AuditLogEventEmission): Promise<void> {\n    const sinks = this.ensureResolved();\n    if (sinks.length === 0) {\n      return;\n    }\n    await Promise.all(\n      sinks.map(async ({ ref, sink }) => {\n        try {\n          await sink.recordAuditEvent(event);\n        } catch (err) {\n          // F6 (Phase 5): a sink failing mid-operation must be OBSERVABLE, not just\n          // a swallowed log line — emit a metric so a silently-failing audit sink\n          // surfaces on the observability layer (→ alert). Still fire-and-forget:\n          // the throw never reaches the business-op path.\n          this.metricsService.recordAuditSinkFailure({ providerRef: ref });\n          console.error('[audit] provider sink failed (non-fatal)', {\n            providerRef: ref,\n            ...projectCaughtErrorLogFields(err),\n          });\n        }\n      }),\n    );\n  }\n\n  /** Drain every already-resolved sink on shutdown (best-effort). */\n  public async shutdown(): Promise<void> {\n    if (this.resolvedSinks === undefined) {\n      return;\n    }\n    await Promise.all(\n      this.resolvedSinks.map(async ({ sink }) => {\n        try {\n          await sink.shutdown?.();\n        } catch {\n          // best-effort drain\n        }\n      }),\n    );\n  }\n}\n"]}
+{"version":3,"file":"composite-audit-log-sink.backend.js","sourceRoot":"","sources":["../../../../../../src/compliance/audit-trails/services/composite-audit-log-sink.backend.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAOzD;;;;;GAKG;AACH,OAAO,EAAE,2BAA2B,EAAE,MAAM,uDAAuD,CAAC;AACpG,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAIpF,OAAO,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAY3H;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEI,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;IAMb;IAEA;IAEA;IATnB,oFAAoF;IAC5E,aAAa,GAAoC,SAAS,CAAC;IAEnE,YAEmB,yBAAkE,EAElE,uBAA8D,EAE9D,cAA8B;QAJ9B,8BAAyB,GAAzB,yBAAyB,CAAyC;QAElE,4BAAuB,GAAvB,uBAAuB,CAAuC;QAE9D,mBAAc,GAAd,cAAc,CAAgB;IAC9C,CAAC;IAEJ;;;;OAIG;IACK,cAAc;QACpB,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACrC,OAAO,IAAI,CAAC,aAAa,CAAC;QAC5B,CAAC;QACD,4EAA4E;QAC5E,6EAA6E;QAC7E,uDAAuD;QACvD,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,OAAO,EAAE,EAAE,CAAC;YAC9C,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,IAAI,CAAC,yBAAyB,CAAC,oCAAoC,CACtF,gBAAgB,CAAC,sBAAsB,CACxC,CAAC;YACF,MAAM,KAAK,GAAwB,EAAE,CAAC;YACtC,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;gBACvC,MAAM,MAAM,GAAG,IAAI,CAAC,uBAAuB,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;gBACrE,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,SAAS;gBACX,CAAC;gBACD,2FAA2F;gBAC3F,2FAA2F;gBAC3F,2FAA2F;gBAC3F,+EAA+E;gBAC/E,MAAM,IAAI,GAAG,2BAA2B,CACtC,MAAM,EACN,OAAO,EACP,GAAG,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,yBAAyB,CAAC,EAAE,WAAW,EAAE,CAAC;gBACpE,+FAA+F;gBAC/F,iGAAiG;gBACjG,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,qCAAqC,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAC/F,CAAC;gBACF,IAAI,IAAI,EAAE,CAAC;oBACT,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;gBACzC,CAAC;YACH,CAAC;YACD,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;YAC3B,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,0EAA0E;YAC1E,0EAA0E;YAC1E,sEAAsE;YACtE,wEAAwE;YACxE,kCAAkC;YAClC,sEAAsE;YACtE,+EAA+E;YAC/E,yEAAyE;YACzE,OAAO,CAAC,KAAK,CACX,kEAAkE,EAClE,2BAA2B,CAAC,GAAG,CAAC,CACjC,CAAC;YACF,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,2DAA2D;IACpD,QAAQ;QACb,OAAO,IAAI,CAAC,cAAc,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1C,CAAC;IAED;;;;;;;;OAQG;IACI,oBAAoB;QACzB,OAAO,IAAI,CAAC,cAAc,EAAE;aACzB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;aAC1B,MAAM,CACL,CAAC,IAAI,EAAwD,EAAE,CAC7D,OAAQ,IAA+C,CAAC,2BAA2B,KAAK,UAAU;YAClG,OAAQ,IAA+C,CAAC,2BAA2B,KAAK,UAAU,CACrG,CAAC;IACN,CAAC;IAED;;;;;;;OAOG;IACI,kBAAkB;QACvB,OAAO,IAAI,CAAC,cAAc,EAAE;aACzB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;aAC1B,MAAM,CACL,CAAC,IAAI,EAA+C,EAAE,CACpD,OAAQ,IAAsC,CAAC,gBAAgB,KAAK,UAAU,CACjF,CAAC;IACN,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,gBAAgB,CAAC,KAA4B;QACxD,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACpC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO;QACT,CAAC;QACD,MAAM,OAAO,CAAC,GAAG,CACf,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE;YAChC,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;YACrC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,0EAA0E;gBAC1E,wEAAwE;gBACxE,wEAAwE;gBACxE,gDAAgD;gBAChD,IAAI,CAAC,cAAc,CAAC,sBAAsB,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC;gBACjE,OAAO,CAAC,KAAK,CAAC,0CAA0C,EAAE;oBACxD,WAAW,EAAE,GAAG;oBAChB,GAAG,2BAA2B,CAAC,GAAG,CAAC;iBACpC,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IAED,mEAAmE;IAC5D,KAAK,CAAC,QAAQ;QACnB,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACrC,OAAO;QACT,CAAC;QACD,MAAM,OAAO,CAAC,GAAG,CACf,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;YACxC,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;YAC1B,CAAC;YAAC,MAAM,CAAC;gBACP,oBAAoB;YACtB,CAAC;QACH,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;CACF,CAAA;AA9JY,qBAAqB;IADjC,UAAU,EAAE;IAMR,WAAA,MAAM,CAAC,kBAAkB,CAAC,gCAAgC,CAAC,CAAA;IAE3D,WAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;IAEzD,WAAA,MAAM,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAA;;GATjC,qBAAqB,CA8JjC","sourcesContent":["import { injectable, inject } from 'inversify';\nimport { EngineCapability } from '@wildo-ai/saas-models';\nimport type {\n  AuditLogSink,\n  AuditLogEventEmission,\n  AuditReconcileCheckpointStore,\n  AuditLogVerification,\n} from '@wildo-ai/saas-models';\n/*\n * `/backend-runtime`, not `/backend` (#330). The two barrels expose the same builder; `/backend` also\n * re-exports the engine's EAGERLY composed provider catalogue, and ES module semantics mean that one\n * value import evaluates all twenty-two provider modules — six of them pulling an `@ai-sdk/*` client\n * — into whatever process imports this file. This file is in every backend's boot graph.\n */\nimport { buildAuditLogSinkFromModule } from '@wildo-ai/external-connectors-private/backend-runtime';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { ExternalProvidersRegistryBackendService } from '~wildo-backend-lib/external-providers/services/external-providers-registry.backend.service';\nimport type { BackendProviderRegistryBackendService } from '~wildo-backend-lib/external-providers/services/backend-provider-registry.backend.service';\nimport type { MetricsService } from '~wildo-backend-lib/monitoring/observability/services/metrics.service';\nimport { projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\n\n/**\n * A resolved audit sink paired with the provider ref it was built from. Keeping\n * the ref lets failure metrics + logs name the offending provider (immudb, a\n * SIEM, …) instead of an anonymous index.\n */\ninterface ResolvedAuditSink {\n  ref: string;\n  sink: AuditLogSink;\n}\n\n/**\n * Engine-side `AuditLogSink` that fans EVERY audit event out to ALL providers\n * declaring `EngineCapability.COMPLIANCE_AUDIT_TRAIL` (a FAN_OUT capability),\n * resolved LAZILY from the app's `defineSaaSProviders` config.\n *\n * This is the Layer-2 provider fan-out — layered ON TOP of the always-on Layer-1\n * database audit store (`AuditLogsBackendService`). It is NOT the authoritative\n * store; a backend with zero audit providers keeps this a byte-identical no-op.\n *\n * **Why lazy.** The selection-aware registry only knows the declared providers\n * after `initialize()` (during startup, after the DI container is built), and\n * `AuditLogsBackendService` caches this reference at construction. So this object\n * is bound EAGERLY (a stable reference) but resolves providers on first use — by\n * which point (an actual audit event) the registry is initialized. Mirrors\n * `LlmObservabilityAgentCallTraceSink` / `EmailBackendService`.\n *\n * **Delivery.** Every resolved sink receives every event; a single sink's failure\n * is ISOLATED and never thrown onto the caller (the business-op path — F7). A\n * failure is ALSO made OBSERVABLE via `MetricsService.recordAuditSinkFailure`\n * (F6): fire-and-forget is correct (audit must never break the business op), but\n * a silently-failing sink must not masquerade as a healthy pipeline — the metric\n * lets \"we think we're auditing but we aren't\" surface on the observability layer\n * (→ an alert via the alerting workstream), not just a swallowed log line. This\n * honours the `AuditLogSink` contract (at-least-once per sink, non-blocking) —\n * the sinks own their own durable buffering + retry.\n *\n * Each resolved sink is kept paired with the provider ref it was built from, so\n * the completeness reconciler ({@link getReconcilableSinks}) and external-auditor\n * verification ({@link getVerifiableSinks}) can narrow to the sinks supporting\n * those optional capabilities.\n */\n@injectable()\nexport class CompositeAuditLogSink implements AuditLogSink {\n  /** `undefined` = not yet resolved; else the (possibly empty) resolved sink list. */\n  private resolvedSinks: ResolvedAuditSink[] | undefined = undefined;\n\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.ExternalProvidersRegistryService)\n    private readonly externalProvidersRegistry: ExternalProvidersRegistryBackendService,\n    @inject(SAAS_SERVICE_TYPES.BackendProviderRegistryService)\n    private readonly backendProviderRegistry: BackendProviderRegistryBackendService,\n    @inject(SAAS_SERVICE_TYPES.MetricsService)\n    private readonly metricsService: MetricsService,\n  ) {}\n\n  /**\n   * Resolve (once) every declared audit-provider sink. Caches the result,\n   * including an empty list. If the registry is not yet initialized (a call before\n   * startup completes), the attempt is NOT cached so a later call retries.\n   */\n  private ensureResolved(): ResolvedAuditSink[] {\n    if (this.resolvedSinks !== undefined) {\n      return this.resolvedSinks;\n    }\n    // Expected pre-startup window: the selection-aware registry isn't populated\n    // until initialize() runs. Stay unresolved (retry on the next event) WITHOUT\n    // logging — this is normal boot ordering, not a fault.\n    if (!this.externalProvidersRegistry.isReady()) {\n      return [];\n    }\n    try {\n      const providerRefs = this.externalProvidersRegistry.getResolvedProviderRefsForCapability(\n        EngineCapability.COMPLIANCE_AUDIT_TRAIL,\n      );\n      const sinks: ResolvedAuditSink[] = [];\n      for (const providerRef of providerRefs) {\n        const module = this.backendProviderRegistry.getProvider(providerRef);\n        if (!module) {\n          continue;\n        }\n        // Thread a tamper-metric hook bound to this provider ref: a sink that PROVES its store was\n        // rolled back/tampered (immudb's durable-state consistency proof) surfaces on the distinct\n        // `audit_tamper_detected_total{provider}` counter. The sink cannot import `MetricsService`\n        // (dependency direction), so this callback is how the signal crosses the wall.\n        const sink = buildAuditLogSinkFromModule(\n          module,\n          console,\n          () => this.metricsService.recordAuditTamperDetected({ providerRef }),\n          // Assurance DEGRADATION (ephemeral / corrupt anchor / un-pinned identity change / per-op proof\n          // failure) — distinct `audit_integrity_assurance_degraded_total{provider,reason}`, non-latching.\n          (reason) => this.metricsService.recordAuditIntegrityAssuranceDegraded({ providerRef, reason }),\n        );\n        if (sink) {\n          sinks.push({ ref: providerRef, sink });\n        }\n      }\n      this.resolvedSinks = sinks;\n      return sinks;\n    } catch (err) {\n      // Post-init resolution fault (a mis-projected registry, a throwing module\n      // factory) — NOT the expected pre-init path (guarded above). Do NOT cache\n      // (so a later event retries) and SURFACE it: a silently-failing audit\n      // pipeline masquerading as \"no providers declared\" is exactly the audit\n      // black hole this guards against.\n      // `projectCaughtErrorLogFields`, not an `instanceof Error` ternary: a\n      // `WildoError_Backend` is a plain object, so the ternary would render the very\n      // fault this guard exists to surface as the literal `'[object Object]'`.\n      console.error(\n        '[audit] failed to resolve provider sinks (non-fatal, will retry)',\n        projectCaughtErrorLogFields(err),\n      );\n      return [];\n    }\n  }\n\n  /** Whether any audit provider is declared + configured. */\n  public isActive(): boolean {\n    return this.ensureResolved().length > 0;\n  }\n\n  /**\n   * The resolved audit sinks that ALSO support reconcile-checkpointing\n   * ({@link AuditReconcileCheckpointStore}) — i.e. can persist the completeness\n   * reconciler's high-water mark in their own store (immudb). The reconciler drives\n   * these per-sink (get checkpoint → replay DB events since it → set checkpoint); a\n   * sink that can't checkpoint (a fire-and-forget SIEM webhook) is simply absent.\n   * Returns the SAME sink instances the real-time fan-out uses, so the reconciler\n   * shares ONE immudb connection with the live write path.\n   */\n  public getReconcilableSinks(): Array<AuditLogSink & AuditReconcileCheckpointStore> {\n    return this.ensureResolved()\n      .map((entry) => entry.sink)\n      .filter(\n        (sink): sink is AuditLogSink & AuditReconcileCheckpointStore =>\n          typeof (sink as Partial<AuditReconcileCheckpointStore>).getAuditReconcileCheckpoint === 'function' &&\n          typeof (sink as Partial<AuditReconcileCheckpointStore>).setAuditReconcileCheckpoint === 'function',\n      );\n  }\n\n  /**\n   * The resolved audit sinks that ALSO support cryptographic VERIFICATION\n   * ({@link AuditLogVerification}) — i.e. can prove a recorded event is present +\n   * untampered (immudb inclusion proofs). This is an EXTERNAL-AUDITOR read path,\n   * resolved SEPARATELY from the write fan-out; a sink whose technology can't prove\n   * non-tampering (a fire-and-forget SIEM webhook) is simply absent. Returns the\n   * SAME sink instances the fan-out uses, sharing their live connection.\n   */\n  public getVerifiableSinks(): Array<AuditLogSink & AuditLogVerification> {\n    return this.ensureResolved()\n      .map((entry) => entry.sink)\n      .filter(\n        (sink): sink is AuditLogSink & AuditLogVerification =>\n          typeof (sink as Partial<AuditLogVerification>).verifyAuditEvent === 'function',\n      );\n  }\n\n  /**\n   * Fan the event out to EVERY resolved sink, isolating per-sink failures so one\n   * never affects the others (each destination is independent — F7), and NEVER\n   * throwing onto the caller (fire-and-forget from the business op).\n   */\n  public async recordAuditEvent(event: AuditLogEventEmission): Promise<void> {\n    const sinks = this.ensureResolved();\n    if (sinks.length === 0) {\n      return;\n    }\n    await Promise.all(\n      sinks.map(async ({ ref, sink }) => {\n        try {\n          await sink.recordAuditEvent(event);\n        } catch (err) {\n          // F6 (Phase 5): a sink failing mid-operation must be OBSERVABLE, not just\n          // a swallowed log line — emit a metric so a silently-failing audit sink\n          // surfaces on the observability layer (→ alert). Still fire-and-forget:\n          // the throw never reaches the business-op path.\n          this.metricsService.recordAuditSinkFailure({ providerRef: ref });\n          console.error('[audit] provider sink failed (non-fatal)', {\n            providerRef: ref,\n            ...projectCaughtErrorLogFields(err),\n          });\n        }\n      }),\n    );\n  }\n\n  /** Drain every already-resolved sink on shutdown (best-effort). */\n  public async shutdown(): Promise<void> {\n    if (this.resolvedSinks === undefined) {\n      return;\n    }\n    await Promise.all(\n      this.resolvedSinks.map(async ({ sink }) => {\n        try {\n          await sink.shutdown?.();\n        } catch {\n          // best-effort drain\n        }\n      }),\n    );\n  }\n}\n"]}

package/dist/esm/compliance/audit-trails/services/siem-export-config-cache-invalidation.custom-impl.backend.service.d.ts

@@ -0,0 +1,16 @@
+import { type ResourceCustomServiceImplementationFactory } from '../../../base-classes/services/services/resource-operation-custom-implementation.factory.backend';
+/**
+ * Registers the postfix invalidation on the ORGANIZATION SIEM-export-config CREATE and UPDATE.
+ *
+ * The handler is synchronous and cannot fail. `invalidateSiemConfig` drops a map entry and then kicks a
+ * fire-and-forget Redis publish that swallows its own error — so unlike the Redis-backed feature-cache
+ * equivalent, which awaits its `del`, there is still nothing here to await and no error path. That is a
+ * deliberate property of `invalidateSiemConfig`, not an accident of it: a broadcast that fails leaves
+ * the other replicas exactly where the lease already puts them, and refusing a configuration write to
+ * protect a cache would invert the priority.
+ * A `logger.warn` on an unresolvable organization id keeps the gap observable rather than silent:
+ * failing the write would be the wrong trade, because refusing a config edit to protect a cache
+ * inverts the priority, but a silently un-invalidated entry is the exact defect this file fixes.
+ */
+export declare function createSiemExportConfigCacheInvalidationFactories(): ResourceCustomServiceImplementationFactory[];
+//# sourceMappingURL=siem-export-config-cache-invalidation.custom-impl.backend.service.d.ts.map

package/dist/esm/compliance/audit-trails/services/siem-export-config-cache-invalidation.custom-impl.backend.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"siem-export-config-cache-invalidation.custom-impl.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/compliance/audit-trails/services/siem-export-config-cache-invalidation.custom-impl.backend.service.ts"],"names":[],"mappings":"AAoEA,OAAO,EAEL,KAAK,0CAA0C,EAChD,MAAM,4GAA4G,CAAC;AAkDpH;;;;;;;;;;;;GAYG;AACH,wBAAgB,gDAAgD,IAAI,0CAA0C,EAAE,CAuC/G"}

package/dist/esm/compliance/audit-trails/services/siem-export-config-cache-invalidation.custom-impl.backend.service.js

@@ -0,0 +1,140 @@
+/**
+ * Postfix-hook custom-service implementation that drops an organization's cached SIEM export
+ * config after an engine-routed write to `ORGANIZATION_SIEM_EXPORT_CONFIG`.
+ *
+ * Without this, `AuditEventDispatcherBackendService` served a stale config for up to
+ * `SIEM_CONFIG_REFRESH_AFTER_MS` with no invalidation of any kind, so an organization that ENABLED its
+ * SIEM sink kept resolving the cached `null` and had its authenticated audit events routed to no sink
+ * for that window. Audit events are not replayed, so those deliveries were lost rather than delayed.
+ *
+ * **The "N independent windows" this file's first revision described is CLOSED.** That revision noted
+ * the window was PER PROCESS because the cache is an in-process `Map`, and stopped there — which left
+ * the hook correct for exactly one replica and inert for the rest of a real deployment.
+ * `invalidateSiemConfig` now drops the local entry AND publishes the organization id on a Redis channel
+ * every replica subscribes to, so an engine-routed write converges fleet-wide in milliseconds. Read that
+ * method's JSDoc for the broadcast, and `SIEM_CONFIG_REFRESH_AFTER_MS` for the lease that still carries
+ * everything the broadcast cannot reach.
+ *
+ * ## Why the hook sits on the RESOURCE and not on the config service
+ *
+ * `AuthOrganizationConfigurationService.saveSiemExportConfig` is the obvious call site and is only
+ * ONE of the writers: the config is an ordinary resource, so an update also lands through
+ * `ServicesRegistryHandler.update` on `organizationSiemExportConfig` directly. Hooking the service
+ * would have applied the invariant at one of two sites — the shape
+ * `.claude/rules/invariant-call-site-enumeration.md` records twenty-odd times. The resource
+ * operation is the chokepoint both writers pass through, because `saveSiemExportConfig` dispatches
+ * its own write via `ServicesRegistryHandler`.
+ *
+ * ## Coverage matrix
+ *
+ * | Operation | Variant          | Covered | Why |
+ * |-----------|------------------|---------|-----|
+ * | `CREATE`  | `INTERNAL_CALL`  | ✅      | The lazy `createAsSystem` materialisation on the userless login path, and the first real configuration. Service tier, so a postfix hook is reachable. |
+ * | `UPDATE`  | `INTERNAL_CALL`  | ✅      | Every edit, including `saveSiemExportConfig`. Service tier. |
+ * | `DELETE`  | `REPOSITORY_ONLY`| ❌      | Deliberate, twice over: `doOperation` throws on `REPOSITORY_ONLY`, so the service tier where custom implementations run is unreachable BY CONSTRUCTION and a registration here would fail startup; and its only caller is the `onParentDelete` cascade, which fires when the owning organization is itself being hard-deleted — nothing dispatches audit events for a deleted tenant, so the entry is moot and TTL-expires. |
+ * | `READ`    | `API_CALL`       | ❌      | Reads do not stale a cache. |
+ *
+ * **`APPLICATION_SIEM_EXPORT_CONFIG` is deliberately NOT registered.** The dispatcher's cache is
+ * keyed by `organizationId` and it only ever loads the ORGANIZATION variant
+ * (`loadSiemExportConfig(ec, ORGANIZATION, orgId)`), because SIEM fan-out is per authenticated
+ * tenant. The APPLICATION variant is settable and inert — no producer emits app-scoped deliveries —
+ * so there is no app-scoped cache entry to invalidate. When an app-scoped producer lands, it gets
+ * its own cache and its own registration in the same change.
+ *
+ * **The framework default-seed is also not covered, and does not need to be.**
+ * `organizationSiemExportConfigDefaultSeed` writes a DISABLED default at the repository tier during
+ * organization creation, before the organization can have raised an audit event, so there is no
+ * entry in the map to stale.
+ *
+ * ## What no hook on this tier can ever cover — and who relies on it today
+ *
+ * Repository-direct writes and raw database writes never reach the service tier, so they raise no
+ * postfix hook and produce no broadcast. This is not hypothetical: `examples/wonder-todos/e2e/adapter.ts`
+ * (`case 'siem'`) repoints an organization's export config with
+ * `upsertOrganizationSingleton('organizationSiemExportConfig', …)`, straight at the store. Its own
+ * comment records the consequence — the lane works *"because a freshly provisioned org has a cold
+ * config cache"*, i.e. by ORDERING itself before the organization's first audited action rather than by
+ * anything invalidating.
+ *
+ * For that class of write the LEASE is the entire guarantee, which is why
+ * `SIEM_CONFIG_REFRESH_AFTER_MS` states its number, its arithmetic and its reason rather than being an
+ * incidental five minutes. Do not read this file as "engine writes are covered, the rest is someone
+ * else's problem": the two mechanisms are one guarantee, and the lease is the half that has no hook.
+ */
+import { CoreResourceOperation, CoreResourceType, ResourceOperationVariantType, } from '@wildo-ai/saas-models';
+import { createResourceCustomServiceImplementation, } from '../../../base-classes/services/services/resource-operation-custom-implementation.factory.backend.js';
+import { SAAS_SERVICE_TYPES } from '../../../inject/models/service-types.js';
+/** The operations whose writes can stale the dispatcher's cache. See the coverage matrix above. */
+const INVALIDATING_OPERATIONS = [
+    CoreResourceOperation.CREATE,
+    CoreResourceOperation.UPDATE,
+];
+const INTERNAL_DEFAULT_PATH = {
+    variantType: ResourceOperationVariantType.INTERNAL_CALL,
+    isOperationDefault: true,
+};
+/**
+ * Resolve the organization whose cache entry must go, with a three-tier fallback.
+ *
+ * 1. **The postfix result** — the persisted row. CREATE and UPDATE both return it, and it carries
+ *    `organizationId` (injected by the polymorphism engine), so this is the normal path.
+ * 2. **`utils.currentObject`** — fetched by the framework before a non-CREATE custom impl runs.
+ *    Load-bearing when an implementation returns something other than the row.
+ * 3. **`executionContext.organizationId`** — the scope the request runs under.
+ *
+ * Mirrors `resolveOrgIdsForInvalidation` in
+ * `scope-features-cache-invalidation.custom-impl.backend.service.ts`; see that file for the
+ * reasoning behind each tier.
+ */
+function resolveOrganizationId(result, utils, executionContext) {
+    const fromResult = result != null && typeof result === 'object' && 'organizationId' in result
+        ? result.organizationId
+        : undefined;
+    if (fromResult)
+        return fromResult;
+    const fromCurrent = utils.currentObject?.organizationId;
+    if (fromCurrent)
+        return fromCurrent;
+    return executionContext.organizationId ?? undefined;
+}
+/**
+ * Registers the postfix invalidation on the ORGANIZATION SIEM-export-config CREATE and UPDATE.
+ *
+ * The handler is synchronous and cannot fail. `invalidateSiemConfig` drops a map entry and then kicks a
+ * fire-and-forget Redis publish that swallows its own error — so unlike the Redis-backed feature-cache
+ * equivalent, which awaits its `del`, there is still nothing here to await and no error path. That is a
+ * deliberate property of `invalidateSiemConfig`, not an accident of it: a broadcast that fails leaves
+ * the other replicas exactly where the lease already puts them, and refusing a configuration write to
+ * protect a cache would invert the priority.
+ * A `logger.warn` on an unresolvable organization id keeps the gap observable rather than silent:
+ * failing the write would be the wrong trade, because refusing a config edit to protect a cache
+ * inverts the priority, but a silently un-invalidated entry is the exact defect this file fixes.
+ */
+export function createSiemExportConfigCacheInvalidationFactories() {
+    return INVALIDATING_OPERATIONS.map((operationIdentifier) => (_rr, container) => {
+        const dispatcher = container.get(SAAS_SERVICE_TYPES.AuditEventDispatcherService);
+        return createResourceCustomServiceImplementation({
+            operationPath: {
+                resourceIdentifier: CoreResourceType.ORGANIZATION_SIEM_EXPORT_CONFIG,
+                operationIdentifier,
+                ...INTERNAL_DEFAULT_PATH,
+            },
+            handlers: {
+                postfixCoreOperations: async (_id, res, executionContext, operationPath, utils) => {
+                    const organizationId = resolveOrganizationId(res, utils, executionContext);
+                    if (!organizationId) {
+                        utils.logger.warn('Could not resolve organizationId for SIEM export config cache invalidation — the dispatcher may serve a stale config for up to its TTL', {
+                            operationIdentifier: String(operationPath.operationIdentifier),
+                            resourceIdentifier: operationPath.resourceIdentifier,
+                            rowId: _id,
+                        });
+                        return res;
+                    }
+                    dispatcher.invalidateSiemConfig(organizationId);
+                    return res;
+                },
+            },
+        });
+    });
+}
+//# sourceMappingURL=siem-export-config-cache-invalidation.custom-impl.backend.service.js.map

package/dist/esm/compliance/audit-trails/services/siem-export-config-cache-invalidation.custom-impl.backend.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"siem-export-config-cache-invalidation.custom-impl.backend.service.js","sourceRoot":"","sources":["../../../../../../src/compliance/audit-trails/services/siem-export-config-cache-invalidation.custom-impl.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;AACH,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAChB,4BAA4B,GAC7B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,yCAAyC,GAE1C,MAAM,4GAA4G,CAAC;AAEpH,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAKpF,mGAAmG;AACnG,MAAM,uBAAuB,GAAG;IAC9B,qBAAqB,CAAC,MAAM;IAC5B,qBAAqB,CAAC,MAAM;CACpB,CAAC;AAEX,MAAM,qBAAqB,GAAG;IAC5B,WAAW,EAAE,4BAA4B,CAAC,aAAa;IACvD,kBAAkB,EAAE,IAAI;CAChB,CAAC;AAIX;;;;;;;;;;;;GAYG;AACH,SAAS,qBAAqB,CAC5B,MAAe,EACf,KAAmD,EACnD,gBAAuC;IAEvC,MAAM,UAAU,GACd,MAAM,IAAI,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,gBAAgB,IAAI,MAAM;QACxE,CAAC,CAAE,MAAgC,CAAC,cAAc;QAClD,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAElC,MAAM,WAAW,GAAI,KAAK,CAAC,aAAmD,EAAE,cAAc,CAAC;IAC/F,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IAEpC,OAAO,gBAAgB,CAAC,cAAc,IAAI,SAAS,CAAC;AACtD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,gDAAgD;IAC9D,OAAO,uBAAuB,CAAC,GAAG,CAChC,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE;QAC1C,MAAM,UAAU,GAAG,SAAS,CAAC,GAAG,CAC9B,kBAAkB,CAAC,2BAA2B,CAC/C,CAAC;QACF,OAAO,yCAAyC,CAAC;YAC/C,aAAa,EAAE;gBACb,kBAAkB,EAAE,gBAAgB,CAAC,+BAA+B;gBACpE,mBAAmB;gBACnB,GAAG,qBAAqB;aACzB;YACD,QAAQ,EAAE;gBACR,qBAAqB,EAAE,KAAK,EAC1B,GAAuB,EACvB,GAAY,EACZ,gBAAuC,EACvC,aAA4D,EAC5D,KAAmD,EACjC,EAAE;oBACpB,MAAM,cAAc,GAAG,qBAAqB,CAAC,GAAG,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAC;oBAC3E,IAAI,CAAC,cAAc,EAAE,CAAC;wBACpB,KAAK,CAAC,MAAM,CAAC,IAAI,CACf,wIAAwI,EACxI;4BACE,mBAAmB,EAAE,MAAM,CAAC,aAAa,CAAC,mBAAmB,CAAC;4BAC9D,kBAAkB,EAAE,aAAa,CAAC,kBAAkB;4BACpD,KAAK,EAAE,GAAG;yBACX,CACF,CAAC;wBACF,OAAO,GAAG,CAAC;oBACb,CAAC;oBACD,UAAU,CAAC,oBAAoB,CAAC,cAAc,CAAC,CAAC;oBAChD,OAAO,GAAG,CAAC;gBACb,CAAC;aACF;SACF,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Postfix-hook custom-service implementation that drops an organization's cached SIEM export\n * config after an engine-routed write to `ORGANIZATION_SIEM_EXPORT_CONFIG`.\n *\n * Without this, `AuditEventDispatcherBackendService` served a stale config for up to\n * `SIEM_CONFIG_REFRESH_AFTER_MS` with no invalidation of any kind, so an organization that ENABLED its\n * SIEM sink kept resolving the cached `null` and had its authenticated audit events routed to no sink\n * for that window. Audit events are not replayed, so those deliveries were lost rather than delayed.\n *\n * **The \"N independent windows\" this file's first revision described is CLOSED.** That revision noted\n * the window was PER PROCESS because the cache is an in-process `Map`, and stopped there — which left\n * the hook correct for exactly one replica and inert for the rest of a real deployment.\n * `invalidateSiemConfig` now drops the local entry AND publishes the organization id on a Redis channel\n * every replica subscribes to, so an engine-routed write converges fleet-wide in milliseconds. Read that\n * method's JSDoc for the broadcast, and `SIEM_CONFIG_REFRESH_AFTER_MS` for the lease that still carries\n * everything the broadcast cannot reach.\n *\n * ## Why the hook sits on the RESOURCE and not on the config service\n *\n * `AuthOrganizationConfigurationService.saveSiemExportConfig` is the obvious call site and is only\n * ONE of the writers: the config is an ordinary resource, so an update also lands through\n * `ServicesRegistryHandler.update` on `organizationSiemExportConfig` directly. Hooking the service\n * would have applied the invariant at one of two sites — the shape\n * `.claude/rules/invariant-call-site-enumeration.md` records twenty-odd times. The resource\n * operation is the chokepoint both writers pass through, because `saveSiemExportConfig` dispatches\n * its own write via `ServicesRegistryHandler`.\n *\n * ## Coverage matrix\n *\n * | Operation | Variant          | Covered | Why |\n * |-----------|------------------|---------|-----|\n * | `CREATE`  | `INTERNAL_CALL`  | ✅      | The lazy `createAsSystem` materialisation on the userless login path, and the first real configuration. Service tier, so a postfix hook is reachable. |\n * | `UPDATE`  | `INTERNAL_CALL`  | ✅      | Every edit, including `saveSiemExportConfig`. Service tier. |\n * | `DELETE`  | `REPOSITORY_ONLY`| ❌      | Deliberate, twice over: `doOperation` throws on `REPOSITORY_ONLY`, so the service tier where custom implementations run is unreachable BY CONSTRUCTION and a registration here would fail startup; and its only caller is the `onParentDelete` cascade, which fires when the owning organization is itself being hard-deleted — nothing dispatches audit events for a deleted tenant, so the entry is moot and TTL-expires. |\n * | `READ`    | `API_CALL`       | ❌      | Reads do not stale a cache. |\n *\n * **`APPLICATION_SIEM_EXPORT_CONFIG` is deliberately NOT registered.** The dispatcher's cache is\n * keyed by `organizationId` and it only ever loads the ORGANIZATION variant\n * (`loadSiemExportConfig(ec, ORGANIZATION, orgId)`), because SIEM fan-out is per authenticated\n * tenant. The APPLICATION variant is settable and inert — no producer emits app-scoped deliveries —\n * so there is no app-scoped cache entry to invalidate. When an app-scoped producer lands, it gets\n * its own cache and its own registration in the same change.\n *\n * **The framework default-seed is also not covered, and does not need to be.**\n * `organizationSiemExportConfigDefaultSeed` writes a DISABLED default at the repository tier during\n * organization creation, before the organization can have raised an audit event, so there is no\n * entry in the map to stale.\n *\n * ## What no hook on this tier can ever cover — and who relies on it today\n *\n * Repository-direct writes and raw database writes never reach the service tier, so they raise no\n * postfix hook and produce no broadcast. This is not hypothetical: `examples/wonder-todos/e2e/adapter.ts`\n * (`case 'siem'`) repoints an organization's export config with\n * `upsertOrganizationSingleton('organizationSiemExportConfig', …)`, straight at the store. Its own\n * comment records the consequence — the lane works *\"because a freshly provisioned org has a cold\n * config cache\"*, i.e. by ORDERING itself before the organization's first audited action rather than by\n * anything invalidating.\n *\n * For that class of write the LEASE is the entire guarantee, which is why\n * `SIEM_CONFIG_REFRESH_AFTER_MS` states its number, its arithmetic and its reason rather than being an\n * incidental five minutes. Do not read this file as \"engine writes are covered, the rest is someone\n * else's problem\": the two mechanisms are one guarantee, and the lease is the half that has no hook.\n */\nimport {\n  CoreResourceOperation,\n  CoreResourceType,\n  ResourceOperationVariantType,\n} from '@wildo-ai/saas-models';\nimport {\n  createResourceCustomServiceImplementation,\n  type ResourceCustomServiceImplementationFactory,\n} from '~wildo-backend-lib/base-classes/services/services/resource-operation-custom-implementation.factory.backend';\nimport { AuditEventDispatcherBackendService } from '~wildo-backend-lib/compliance/audit-trails/services/audit-event-dispatcher.backend.service';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { ResourceOperation_CustomImplementation_Utils } from '~wildo-backend-lib/base-classes/services/services/resource-operation-custom-implementation-base.backend.service';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport type { ResourceConfiguration_OperationPath } from '@wildo-ai/saas-models';\n\n/** The operations whose writes can stale the dispatcher's cache. See the coverage matrix above. */\nconst INVALIDATING_OPERATIONS = [\n  CoreResourceOperation.CREATE,\n  CoreResourceOperation.UPDATE,\n] as const;\n\nconst INTERNAL_DEFAULT_PATH = {\n  variantType: ResourceOperationVariantType.INTERNAL_CALL,\n  isOperationDefault: true,\n} as const;\n\ntype RowWithOrganizationId = { organizationId?: string };\n\n/**\n * Resolve the organization whose cache entry must go, with a three-tier fallback.\n *\n * 1. **The postfix result** — the persisted row. CREATE and UPDATE both return it, and it carries\n *    `organizationId` (injected by the polymorphism engine), so this is the normal path.\n * 2. **`utils.currentObject`** — fetched by the framework before a non-CREATE custom impl runs.\n *    Load-bearing when an implementation returns something other than the row.\n * 3. **`executionContext.organizationId`** — the scope the request runs under.\n *\n * Mirrors `resolveOrgIdsForInvalidation` in\n * `scope-features-cache-invalidation.custom-impl.backend.service.ts`; see that file for the\n * reasoning behind each tier.\n */\nfunction resolveOrganizationId(\n  result: unknown,\n  utils: ResourceOperation_CustomImplementation_Utils,\n  executionContext: ExecutionContext<any>,\n): string | undefined {\n  const fromResult =\n    result != null && typeof result === 'object' && 'organizationId' in result\n      ? (result as RowWithOrganizationId).organizationId\n      : undefined;\n  if (fromResult) return fromResult;\n\n  const fromCurrent = (utils.currentObject as RowWithOrganizationId | undefined)?.organizationId;\n  if (fromCurrent) return fromCurrent;\n\n  return executionContext.organizationId ?? undefined;\n}\n\n/**\n * Registers the postfix invalidation on the ORGANIZATION SIEM-export-config CREATE and UPDATE.\n *\n * The handler is synchronous and cannot fail. `invalidateSiemConfig` drops a map entry and then kicks a\n * fire-and-forget Redis publish that swallows its own error — so unlike the Redis-backed feature-cache\n * equivalent, which awaits its `del`, there is still nothing here to await and no error path. That is a\n * deliberate property of `invalidateSiemConfig`, not an accident of it: a broadcast that fails leaves\n * the other replicas exactly where the lease already puts them, and refusing a configuration write to\n * protect a cache would invert the priority.\n * A `logger.warn` on an unresolvable organization id keeps the gap observable rather than silent:\n * failing the write would be the wrong trade, because refusing a config edit to protect a cache\n * inverts the priority, but a silently un-invalidated entry is the exact defect this file fixes.\n */\nexport function createSiemExportConfigCacheInvalidationFactories(): ResourceCustomServiceImplementationFactory[] {\n  return INVALIDATING_OPERATIONS.map(\n    (operationIdentifier) => (_rr, container) => {\n      const dispatcher = container.get<AuditEventDispatcherBackendService>(\n        SAAS_SERVICE_TYPES.AuditEventDispatcherService,\n      );\n      return createResourceCustomServiceImplementation({\n        operationPath: {\n          resourceIdentifier: CoreResourceType.ORGANIZATION_SIEM_EXPORT_CONFIG,\n          operationIdentifier,\n          ...INTERNAL_DEFAULT_PATH,\n        },\n        handlers: {\n          postfixCoreOperations: async (\n            _id: string | undefined,\n            res: unknown,\n            executionContext: ExecutionContext<any>,\n            operationPath: ResourceConfiguration_OperationPath<any, any>,\n            utils: ResourceOperation_CustomImplementation_Utils,\n          ): Promise<unknown> => {\n            const organizationId = resolveOrganizationId(res, utils, executionContext);\n            if (!organizationId) {\n              utils.logger.warn(\n                'Could not resolve organizationId for SIEM export config cache invalidation — the dispatcher may serve a stale config for up to its TTL',\n                {\n                  operationIdentifier: String(operationPath.operationIdentifier),\n                  resourceIdentifier: operationPath.resourceIdentifier,\n                  rowId: _id,\n                },\n              );\n              return res;\n            }\n            dispatcher.invalidateSiemConfig(organizationId);\n            return res;\n          },\n        },\n      });\n    },\n  );\n}\n"]}

package/dist/esm/compliance/audit-trails/services/siem-webhook-delivery.backend.service.d.ts

@@ -230,8 +230,50 @@ export declare class SIEMWebhookDeliveryBackendService {
     private _buildHeaders;
     /**
      * Send HTTP POST to the SIEM webhook endpoint.
+     *
+     * ## Why this is not a plain `fetch`
+     *
+     * `webhookUrl` is TENANT-authored: an organization administrator types it, and this worker POSTs
+     * to it holding the deployment's own network position. That is the fifth of the five outbound
+     * target classes `security/ssrf/outbound-target-guard.backend.utils.ts` was written for — its
+     * header names "SIEM collectors" explicitly — and it was the one class that never called it. A
+     * `webhookUrl` of `http://169.254.169.254/latest/meta-data/iam/security-credentials/` was
+     * delivered to, with the tenant's own auth headers attached, and the response body came back
+     * inside the thrown error's message.
+     *
+     * {@link pinnedOutboundFetch} closes three separate holes here, not one:
+     *
+     * 1. **No classification at all.** The shape check now refuses a literal internal address and a
+     *    reserved special-use hostname before anything leaves the process.
+     * 2. **Check-then-connect.** The address is classified inside the connection's `lookup` hook, so a
+     *    name that answers public to a validator and private to the socket never gets one.
+     * 3. **Redirects.** The old call omitted `redirect: 'error'`, so even a perfect check would have
+     *    been walked past by a collector answering `302 Location: http://169.254.169.254/`. This
+     *    client cannot follow a redirect at all — a 302 arrives as a 302 and fails the `ok` test
+     *    below, landing in the retry/DLQ path like any other bad response.
+     *
+     * ## The behaviour change, stated rather than discovered
+     *
+     * A collector that today answers a redirect stops being followed and starts failing. That is
+     * deliberate: a redirect is precisely how the guard is bypassed, and a SIEM endpoint that needs
+     * one should be reconfigured to its final address. A collector on a PRIVATE network keeps working
+     * only when the operator has declared
+     * `auditTrail.allowPrivateNetworkSiemCollectors` — see {@link _admitsPrivateNetworkCollectors}.
      */
     private _sendHttpPost;
+    /**
+     * Has the DEPLOYMENT OPERATOR declared that SIEM collectors may sit on a private network?
+     *
+     * Read from the application configuration, never from the SIEM config row. The row is authored by
+     * an organization administrator — the same party that supplies the URL — so a flag there would let
+     * the attacker disarm the guard aimed at them. The operator declares the network posture; the
+     * tenant chooses a destination within it.
+     *
+     * Absent reads as `false`. The field is deliberately un-defaulted in
+     * {@link AuditTrailConfigSchema} so that an application which never authored the block gets the
+     * refusing posture by doing nothing.
+     */
+    private _admitsPrivateNetworkCollectors;
     private _isCircuitOpen;
     private _recordSuccess;
     private _recordFailure;

package/dist/esm/compliance/audit-trails/services/siem-webhook-delivery.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"siem-webhook-delivery.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/compliance/audit-trails/services/siem-webhook-delivery.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,kBAAkB,CAAC;AAI1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,kCAAkC,EAAE,MAAM,0CAA0C,CAAC;AAC9F,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAChK,OAAO,EAAE,qCAAqC,EAAE,MAAM,+EAA+E,CAAC;AACtI,OAAO,EACL,KAAK,0BAA0B,EAU/B,aAAa,EAEd,MAAM,uBAAuB,CAAC;AAgC/B,mEAAmE;AACnE,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,0BAA0B,CAAC;IACrC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE;QACV,UAAU,EAAE,MAAM,CAAC;QACnB,UAAU,EAAE,MAAM,CAAC;QACnB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,WAAW,EAAE,MAAM,CAAC;QACpB,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACvC,QAAQ,EAAE;YACR,SAAS,EAAE,MAAM,CAAC;YAClB,kBAAkB,EAAE,MAAM,CAAC;YAC3B,aAAa,EAAE,MAAM,CAAC;YACtB,mBAAmB,EAAE,MAAM,CAAC;YAC5B,cAAc,EAAE,MAAM,CAAC;SACxB,CAAC;KACH,CAAC;CACH;AAiDD,qBACa,iCAAiC;IAKP,OAAO,CAAC,QAAQ,CAAC,MAAM;IACb,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACtB,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IAC9B,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IAClC,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IAR5G,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;IACxF,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA+C;gBAGzB,MAAM,EAAE,aAAa,EACX,gBAAgB,EAAE,uBAAuB,EAC9B,oBAAoB,EAAE,kCAAkC,EACjD,oBAAoB,EAAE,yCAAyC,EAC5D,uBAAuB,EAAE,qCAAqC;IAMnJ;;;OAGG;IACU,eAAe,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC;IA2F5E;;;;;;;;OAQG;IACH,OAAO,CAAC,WAAW;IAgBnB;;;OAGG;IACH,OAAO,CAAC,YAAY;IA0BpB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,aAAa;IA4BrB;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,OAAO,CAAC,yBAAyB;IA4DjC;;;;;;;OAOG;IACH,OAAO,CAAC,eAAe;IAmBvB;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,wBAAwB;IAQhC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,gBAAgB;IAoBxB;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,sBAAsB;IAS9B;;;;;;OAMG;IACH,OAAO,CAAC,iBAAiB;IAczB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,SAAS;IASjB;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,CAAC,uBAAuB;IA6B/B;;;;;;OAMG;IACH,OAAO,CAAC,uBAAuB;IAa/B;;;;;;;;;OASG;IACH,OAAO,CAAC,kBAAkB;IAK1B;;OAEG;IACH,OAAO,CAAC,aAAa;IA0DrB;;OAEG;YACW,aAAa;IAgC3B,OAAO,CAAC,cAAc;IAYtB,OAAO,CAAC,cAAc;IAItB,OAAO,CAAC,cAAc;IAwBtB;;;;OAIG;YACW,aAAa;IA0D3B;;;;;;;;;;;;;;;;;;OAkBG;YACW,uBAAuB;IAoBrC;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IAOhC;;;OAGG;IACH,OAAO,CAAC,kBAAkB;IAmC1B;;;;;OAKG;IACI,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAWnD;;OAEG;IACH,OAAO,CAAC,MAAM;CAGf"}
+{"version":3,"file":"siem-webhook-delivery.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/compliance/audit-trails/services/siem-webhook-delivery.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,kBAAkB,CAAC;AAI1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,kCAAkC,EAAE,MAAM,0CAA0C,CAAC;AAC9F,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAChK,OAAO,EAAE,qCAAqC,EAAE,MAAM,+EAA+E,CAAC;AACtI,OAAO,EACL,KAAK,0BAA0B,EAU/B,aAAa,EAId,MAAM,uBAAuB,CAAC;AAiC/B,mEAAmE;AACnE,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,0BAA0B,CAAC;IACrC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE;QACV,UAAU,EAAE,MAAM,CAAC;QACnB,UAAU,EAAE,MAAM,CAAC;QACnB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,WAAW,EAAE,MAAM,CAAC;QACpB,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACvC,QAAQ,EAAE;YACR,SAAS,EAAE,MAAM,CAAC;YAClB,kBAAkB,EAAE,MAAM,CAAC;YAC3B,aAAa,EAAE,MAAM,CAAC;YACtB,mBAAmB,EAAE,MAAM,CAAC;YAC5B,cAAc,EAAE,MAAM,CAAC;SACxB,CAAC;KACH,CAAC;CACH;AAoDD,qBACa,iCAAiC;IAKP,OAAO,CAAC,QAAQ,CAAC,MAAM;IACb,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACtB,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IAC9B,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IAClC,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IAR5G,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;IACxF,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA+C;gBAGzB,MAAM,EAAE,aAAa,EACX,gBAAgB,EAAE,uBAAuB,EAC9B,oBAAoB,EAAE,kCAAkC,EACjD,oBAAoB,EAAE,yCAAyC,EAC5D,uBAAuB,EAAE,qCAAqC;IAMnJ;;;OAGG;IACU,eAAe,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC;IA2F5E;;;;;;;;OAQG;IACH,OAAO,CAAC,WAAW;IAgBnB;;;OAGG;IACH,OAAO,CAAC,YAAY;IA0BpB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,aAAa;IA4BrB;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,OAAO,CAAC,yBAAyB;IA4DjC;;;;;;;OAOG;IACH,OAAO,CAAC,eAAe;IAmBvB;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,wBAAwB;IAQhC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,gBAAgB;IAoBxB;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,sBAAsB;IAS9B;;;;;;OAMG;IACH,OAAO,CAAC,iBAAiB;IAczB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,SAAS;IASjB;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,CAAC,uBAAuB;IA6B/B;;;;;;OAMG;IACH,OAAO,CAAC,uBAAuB;IAa/B;;;;;;;;;OASG;IACH,OAAO,CAAC,kBAAkB;IAK1B;;OAEG;IACH,OAAO,CAAC,aAAa;IA0DrB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;YACW,aAAa;IAuC3B;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,+BAA+B;IAQvC,OAAO,CAAC,cAAc;IAYtB,OAAO,CAAC,cAAc;IAItB,OAAO,CAAC,cAAc;IAwBtB;;;;OAIG;YACW,aAAa;IA0D3B;;;;;;;;;;;;;;;;;;OAkBG;YACW,uBAAuB;IAoBrC;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IAOhC;;;OAGG;IACH,OAAO,CAAC,kBAAkB;IAmC1B;;;;;OAKG;IACI,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAWnD;;OAEG;IACH,OAAO,CAAC,MAAM;CAGf"}

package/dist/esm/compliance/audit-trails/services/siem-webhook-delivery.backend.service.js

@@ -34,15 +34,19 @@ import { AppConfigurationService } from '../../../config/services/app-configurat
 import { AuditEventDispatcherBackendService } from './audit-event-dispatcher.backend.service.js';
 import { RepositoriesRegistryHandlerBackendService } from '../../../base-classes/services/repositories/repositories-registry-handler.backend.service.js';
 import { ExecutionContextCreatorBackendService } from '../../../runtime/services/execution-context-creator.backend.service.js';
-import { CoreResourceType, CoreResourceOperation, CORE_APP_ROLES, ResourcePrimaryScope, WildoHeaderKeys, SiemDeliveryDlqStatus, SIEMEventFormat, AuthScopeType, coreResourceShared_FieldIdentifier, } from '@wildo-ai/saas-models';
+import { CoreResourceType, CoreResourceOperation, CORE_APP_ROLES, ResourcePrimaryScope, WildoHeaderKeys, SiemDeliveryDlqStatus, SIEMEventFormat, AuthScopeType, coreResourceShared_FieldIdentifier, SIEM_DELIVERY_RELIABILITY_CONTRACT, SIEM_CIRCUIT_BREAKER_COOLDOWN_MS, } from '@wildo-ai/saas-models';
 import { CEF_PROJECTION, LEEF_PROJECTION, cefAgentSeverityHeaderValue, SiemFieldProjectionKind, } from './utils/siem-projection-contract.backend.utils.js';
 import { buildOcsfEvent } from './utils/siem-ocsf-projection.backend.utils.js';
 import { CEF_HEADER_MAX_CHARACTERS, CEF_MAX_CHARACTERS, LEEF_HEADER_MAX_CHARACTERS, LEEF_MAX_CHARACTERS, LEEF_TAB_DELIMITER_HEADER_VALUE, } from './utils/siem-dictionary.backend.utils.js';
 import { describeCaughtError, projectCaughtErrorLogFields, } from '../../../errors/utils/error-log-level-classification.backend.utils.js';
-/** Default circuit breaker threshold */
-const CIRCUIT_BREAKER_THRESHOLD = 5;
-/** Circuit breaker cooldown (ms) */
-const CIRCUIT_BREAKER_COOLDOWN_MS = 5 * 60 * 1000; // 5 minutes
+import { pinnedOutboundFetch } from '../../../security/ssrf/pinned-outbound-fetch.backend.utils.js';
+/**
+ * Circuit-breaker bounds come from `SIEM_DELIVERY_RELIABILITY_CONTRACT`, which the customer
+ * documentation also projects: what an operator is told about a paused destination is what this
+ * service applies.
+ */
+const CIRCUIT_BREAKER_THRESHOLD = SIEM_DELIVERY_RELIABILITY_CONTRACT.circuitBreakerFailureThreshold;
+const CIRCUIT_BREAKER_COOLDOWN_MS = SIEM_CIRCUIT_BREAKER_COOLDOWN_MS;
 /** Prefix for encrypted credentials (H6) */
 const ENCRYPTED_CREDENTIAL_PREFIX = 'encrypted:aes-256-gcm:';
 /** HKDF-like domain separator for SIEM encryption key derivation */
@@ -599,16 +603,56 @@ let SIEMWebhookDeliveryBackendService = class SIEMWebhookDeliveryBackendService
     }
     /**
      * Send HTTP POST to the SIEM webhook endpoint.
+     *
+     * ## Why this is not a plain `fetch`
+     *
+     * `webhookUrl` is TENANT-authored: an organization administrator types it, and this worker POSTs
+     * to it holding the deployment's own network position. That is the fifth of the five outbound
+     * target classes `security/ssrf/outbound-target-guard.backend.utils.ts` was written for — its
+     * header names "SIEM collectors" explicitly — and it was the one class that never called it. A
+     * `webhookUrl` of `http://169.254.169.254/latest/meta-data/iam/security-credentials/` was
+     * delivered to, with the tenant's own auth headers attached, and the response body came back
+     * inside the thrown error's message.
+     *
+     * {@link pinnedOutboundFetch} closes three separate holes here, not one:
+     *
+     * 1. **No classification at all.** The shape check now refuses a literal internal address and a
+     *    reserved special-use hostname before anything leaves the process.
+     * 2. **Check-then-connect.** The address is classified inside the connection's `lookup` hook, so a
+     *    name that answers public to a validator and private to the socket never gets one.
+     * 3. **Redirects.** The old call omitted `redirect: 'error'`, so even a perfect check would have
+     *    been walked past by a collector answering `302 Location: http://169.254.169.254/`. This
+     *    client cannot follow a redirect at all — a 302 arrives as a 302 and fails the `ok` test
+     *    below, landing in the retry/DLQ path like any other bad response.
+     *
+     * ## The behaviour change, stated rather than discovered
+     *
+     * A collector that today answers a redirect stops being followed and starts failing. That is
+     * deliberate: a redirect is precisely how the guard is bypassed, and a SIEM endpoint that needs
+     * one should be reconfigured to its final address. A collector on a PRIVATE network keeps working
+     * only when the operator has declared
+     * `auditTrail.allowPrivateNetworkSiemCollectors` — see {@link _admitsPrivateNetworkCollectors}.
      */
     async _sendHttpPost(url, body, headers, timeoutMs) {
         const controller = new AbortController();
         const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
         try {
-            const response = await fetch(url, {
+            const response = await pinnedOutboundFetch(url, {
                 method: 'POST',
                 headers,
                 body,
                 signal: controller.signal,
+                /**
+                 * BOTH schemes, unlike CIMD's https-only policy, and the asymmetry is deliberate rather than
+                 * an oversight. `webhookUrl` is authored configuration that predates this guard and `http:`
+                 * collectors exist in the field on trusted internal networks; refusing plaintext here would
+                 * silently stop delivering security events for those deployments, which is a worse security
+                 * outcome than the transport weakness it would remove. Narrowing this to `https:` is a
+                 * separate, operator-visible decision with its own migration — not a side effect of adding
+                 * an SSRF guard.
+                 */
+                admittedProtocols: ['https:', 'http:'],
+                admitPrivateAddresses: this._admitsPrivateNetworkCollectors(),
             });
             if (!response.ok) {
                 const responseText = await response.text().catch(() => '');
@@ -619,6 +663,21 @@ let SIEMWebhookDeliveryBackendService = class SIEMWebhookDeliveryBackendService
             clearTimeout(timeoutId);
         }
     }
+    /**
+     * Has the DEPLOYMENT OPERATOR declared that SIEM collectors may sit on a private network?
+     *
+     * Read from the application configuration, never from the SIEM config row. The row is authored by
+     * an organization administrator — the same party that supplies the URL — so a flag there would let
+     * the attacker disarm the guard aimed at them. The operator declares the network posture; the
+     * tenant chooses a destination within it.
+     *
+     * Absent reads as `false`. The field is deliberately un-defaulted in
+     * {@link AuditTrailConfigSchema} so that an application which never authored the block gets the
+     * refusing posture by doing nothing.
+     */
+    _admitsPrivateNetworkCollectors() {
+        return this.appConfigService.config?.auditTrail?.allowPrivateNetworkSiemCollectors === true;
+    }
     // ─────────────────────────────────────────────────────────────
     // Circuit Breaker
     // ─────────────────────────────────────────────────────────────