@wildo-ai/saas-backend-lib 1.1.2 → 1.1.3

package/dist/esm/compliance/audit-trails/services/audit-event-dispatcher.backend.service.js

@@ -21,7 +21,7 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
 import 'reflect-metadata';
-import { inject, injectable } from 'inversify';
+import { inject, injectable, optional } from 'inversify';
 import { v4 as uuidv4 } from 'uuid';
 import { createHmac, createHash, timingSafeEqual } from 'crypto';
 import { SAAS_SERVICE_TYPES } from '../../../inject/models/service-types.js';
@@ -30,18 +30,85 @@ import { AppConfigurationService } from '../../../config/services/app-configurat
 import { AuthOrganizationConfigurationService } from '../../../security/authentications/services/admin-config/auth-organization-configuration.service.js';
 import { RepositoriesRegistryHandlerBackendService } from '../../../base-classes/services/repositories/repositories-registry-handler.backend.service.js';
 import { QueueBackendService } from '../../../queue/queue.backend.service.js';
+import { LeasedValueCache } from '../../../compliance/audit-trails/services/utils/leased-value-cache.backend.utils.js';
+import { projectCaughtErrorLogFields } from '../../../errors/utils/error-log-level-classification.backend.utils.js';
 import { SIEM_WEBHOOK_DELIVERY_BATCH_REF } from '../../../base-classes/services/batches/engine-custom-batch-manifests.js';
 import { AuditEventOutcome, CoreAuditableEventType, CoreResourceType, getAuditEventClassification, AuthScopeType, } from '@wildo-ai/saas-models';
 /** F6: HMAC domain separator for event integrity */
 const SIEM_HMAC_DOMAIN = 'wildo:siem:event-integrity:v1';
-/** F3: Org name cache TTL (5 minutes) */
-const ORG_NAME_CACHE_TTL_MS = 5 * 60 * 1000;
-/** B4: Max entries in org name cache to prevent unbounded growth */
-const ORG_NAME_CACHE_MAX_SIZE = 1000;
-/** R2: SIEM-config cache TTL (5 min) — the config is otherwise read (via an audited, self-elevating `readAsSystem`) per event per org. */
-const SIEM_CONFIG_CACHE_TTL_MS = 5 * 60 * 1000;
-/** R2: Max entries in the SIEM-config cache to prevent unbounded growth. */
+/**
+ * **A SIEM export configuration change takes effect on EVERY replica within 60 seconds — and within
+ * milliseconds when the change goes through the engine.**
+ *
+ * That sentence is the guarantee this subsystem makes, and the two halves come from two different
+ * mechanisms, so read both before changing either.
+ *
+ * ## Why the number is 60 seconds, and why it used to be 300
+ *
+ * The lease is the ONLY thing that covers a write no hook can see — a repository-tier write, or a
+ * direct database write. There is a live one: `examples/wonder-todos/e2e/adapter.ts` (`case 'siem'`)
+ * repoints an organization's export config with `upsertOrganizationSingleton(...)`, straight at the
+ * store, bypassing the engine entirely. Its own comment records what the old 300 s cost — *"A freshly
+ * provisioned org has a cold 5-min config cache, so the first login cold-reads this"* — i.e. the lane
+ * is correct only because it is ORDERED to run before the organization's first audited action. A
+ * five-minute convergence bound is not something a scenario, or an operator doing surgery, can wait
+ * for; it is something they have to design around. Sixty seconds is something they can wait for.
+ *
+ * The old 300 s was never chosen for that job — it was chosen to bound READ AMPLIFICATION, because a
+ * miss costs more than a repository read: `AuthOrganizationConfigurationService.loadSiemExportConfig`
+ * reads through `readAsSystem`, which emits its own `system_context_read` audit row to the database
+ * AND to immudb. So shortening the lease multiplies audit-trail plumbing noise, not just queries.
+ * Two properties make 60 s affordable anyway:
+ *
+ * - **Refreshes are LAZY and STALE-WHILE-REVALIDATE** ({@link LeasedValueCache}). A quiet organization
+ *   costs one read per event, not one per minute; only a continuously busy one reaches the ceiling of
+ *   one read per lease per replica. At 60 s that ceiling is 60 reads/hour/replica per ACTIVE
+ *   organization — for an organization emitting 1000 audit events an hour, under 5 % amplification of
+ *   its own audit volume, against 12/hour before.
+ * - **Nothing blocks on it.** Past the lease the cached value is served immediately and the re-read
+ *   runs off the emission path, so shortening it costs read volume and never latency.
+ *
+ * ## The other half: the engine-routed write converges in milliseconds
+ *
+ * {@link AuditEventDispatcherBackendService.invalidateSiemConfig} drops the local entry AND publishes
+ * the organization id on {@link SIEM_CONFIG_INVALIDATION_CHANNEL_SUFFIX}, which every replica
+ * subscribes to. Before that broadcast the invalidation reached exactly ONE process — the one that
+ * happened to handle the write — and every other replica served the stale value for the rest of the
+ * lease, which is the defect this constant's neighbours document.
+ *
+ * **Do not raise this back toward the read-amplification number.** If the amplification ever needs to
+ * come down, the right lever is the `system_context_read` row on the config read itself:
+ * `SystemAccessBackendService.readAsSystem` already takes `suppressSystemAudit`, and its own JSDoc
+ * names this exact read — *"the audit pipeline resolving … an org's SIEM config to ROUTE an audit
+ * event"* — as the case it exists for. `loadSiemExportConfig` is the one such reader that does not
+ * pass it. Fixing that makes a miss cost a single indexed read and removes the constraint entirely.
+ */
+export const SIEM_CONFIG_REFRESH_AFTER_MS = 60 * 1000;
+/** R2: Max entries in the SIEM-config cache to prevent unbounded growth. Least-recently-used is evicted. */
 const SIEM_CONFIG_CACHE_MAX_SIZE = 1000;
+/**
+ * F3: how long a cached organization NAME is served before a background re-read.
+ *
+ * Deliberately NOT the same constant as {@link SIEM_CONFIG_REFRESH_AFTER_MS}, though the mechanism is
+ * now shared. A stale name is a stale LABEL on an exported envelope — the `organizationId` beside it
+ * is authoritative and unaffected, so a rename showing up late is cosmetic. A stale export config
+ * decides whether the event is routed AT ALL. Same defect shape, different consequence class, so they
+ * get the same machinery and their own numbers: five minutes buys back the read volume that the
+ * config's sixty seconds spends, and nothing depends on a rename propagating faster.
+ */
+const ORG_NAME_REFRESH_AFTER_MS = 5 * 60 * 1000;
+/** B4: Max entries in org name cache to prevent unbounded growth. Least-recently-used is evicted. */
+const ORG_NAME_CACHE_MAX_SIZE = 1000;
+/**
+ * The Redis channel carrying cross-replica SIEM-config invalidations. App-prefixed at use, so tenants
+ * of one Redis never cross — the convention {@link RedisService.getAppPrefix} exists for.
+ *
+ * Broadcast rather than a shared cache, and the distinction is the whole design: the emission path
+ * never touches Redis, so a Redis outage degrades convergence to the lease instead of degrading
+ * ROUTING. A shared-store cache would have put a network round trip on the path an audit event takes
+ * and made delivery depend on a store that can be down.
+ */
+const SIEM_CONFIG_INVALIDATION_CHANNEL_SUFFIX = 'audit:siem-export-config:invalidate';
 /** Severity ordering for minimum severity filtering */
 const SEVERITY_ORDER = {
     'info': 0,
@@ -64,17 +131,53 @@ let AuditEventDispatcherBackendService = class AuditEventDispatcherBackendServic
     orgConfigService;
     queueService;
     repositoriesRegistry;
+    redisService;
     logDebug;
-    /** F3: Lightweight org name cache to avoid per-event DB lookups */
-    _orgNameCache = new Map();
-    /** R2: per-org SIEM-config cache — avoids a per-event per-org audited `readAsSystem` config load. */
-    _siemConfigCache = new Map();
-    constructor(logger, appConfigService, orgConfigService, queueService, repositoriesRegistry) {
+    /**
+     * F3: org NAME cache — a display label on the envelope. See {@link ORG_NAME_REFRESH_AFTER_MS}.
+     *
+     * No `onRefreshFailure`, and it would be dead code if there were one: {@link _resolveOrgName}'s loader
+     * swallows its own error and yields `undefined`, so nothing this cache runs can ever reject. That
+     * swallow is what makes the negative result CACHEABLE, which is the amplification fix described there;
+     * the price is that a persistently unreadable organization row is silent, which is the right trade for
+     * an optional label whose authoritative sibling (`organizationId`) is on the envelope regardless.
+     */
+    _orgNameCache = new LeasedValueCache({
+        refreshAfterMs: ORG_NAME_REFRESH_AFTER_MS,
+        maxEntries: ORG_NAME_CACHE_MAX_SIZE,
+    });
+    /** R2: per-org SIEM-config cache — the value that decides ROUTING. See {@link SIEM_CONFIG_REFRESH_AFTER_MS}. */
+    _siemConfigCache = new LeasedValueCache({
+        refreshAfterMs: SIEM_CONFIG_REFRESH_AFTER_MS,
+        maxEntries: SIEM_CONFIG_CACHE_MAX_SIZE,
+        onRefreshFailure: (organizationId, error) => 
+        // ERROR, not WARN, and the asymmetry with the org-name cache above is the point: while this keeps
+        // failing the replica is routing on a configuration nobody can confirm, so the guarantee stated on
+        // `SIEM_CONFIG_REFRESH_AFTER_MS` is suspended for this organization. Backed off one lease by the
+        // cache, so a persistently unreadable config produces one line a minute, not one an event.
+        this.logger.error?.('Background refresh of an organization SIEM export config failed — routing continues on the LAST KNOWN config for this replica', {
+            organizationId,
+            refreshAfterMs: SIEM_CONFIG_REFRESH_AFTER_MS,
+            ...projectCaughtErrorLogFields(error),
+        }),
+    });
+    /**
+     * Latch so {@link _ensureInvalidationSubscriber} is idempotent; cleared on `end` so a dropped
+     * subscriber re-arms.
+     *
+     * Deliberately the ONLY subscriber state kept. `A2ATaskCancellationBackendService` also holds the
+     * client itself, because it has a shutdown path that closes it; this service has none, and a field
+     * nothing reads is a field the next reader has to reason about for nothing. The socket keeps the
+     * subscriber alive on its own, and a connection that emitted `end` is already closed.
+     */
+    _invalidationSubscribeStarted = false;
+    constructor(logger, appConfigService, orgConfigService, queueService, repositoriesRegistry, redisService) {
         this.logger = logger;
         this.appConfigService = appConfigService;
         this.orgConfigService = orgConfigService;
         this.queueService = queueService;
         this.repositoriesRegistry = repositoriesRegistry;
+        this.redisService = redisService;
         this.logDebug = this.logger.debugByType('AuditEventDispatcherBackendService');
         this.logger.setDebugTypeLogging('AuditEventDispatcherBackendService', false);
     }
@@ -131,6 +234,11 @@ let AuditEventDispatcherBackendService = class AuditEventDispatcherBackendServic
         // No authenticated org → no per-org dispatch (fail-closed, F4).
         if (!organizationId)
             return;
+        // Arm the fleet invalidation subscriber on first use, so nothing has to order it at startup. Never
+        // awaited: it performs a Redis duplicate + connect + subscribe on the first dispatch, and this
+        // event must not wait for it. The window it leaves — one connect — is bounded by the lease, which
+        // is what covers every un-broadcast change anyway.
+        void this._ensureInvalidationSubscriber();
         let sinks;
         try {
             sinks = await this._resolveOrgAuditSinks(ec, organizationId);
@@ -196,28 +304,26 @@ let AuditEventDispatcherBackendService = class AuditEventDispatcherBackendServic
         return sinks;
     }
     /**
-     * R2: load the org's SIEM config through a short-TTL cache. Without it,
-     * {@link _resolveOrgAuditSinks} reads the config via a self-elevating `readAsSystem` PER
-     * EVENT PER ORG — and `readAsSystem` ALSO emits a `SYSTEM_CONTEXT_READ` audit — so every
-     * routed audit event (× N orgs on the multi-org fan-out) doubled the audit-write volume to
-     * the DB + immudb. Mirrors {@link _orgNameCache}: an enable/disable/rename takes effect within
-     * the TTL, acceptable for a rarely-changed config. `null` is cached too (an org with no SIEM
-     * config) so a non-configured org is not re-read every event.
+     * R2: load the org's SIEM config through the leased cache.
+     *
+     * Without a cache, {@link _resolveOrgAuditSinks} reads the config via a self-elevating `readAsSystem`
+     * PER EVENT PER ORG — and `readAsSystem` ALSO emits a `SYSTEM_CONTEXT_READ` audit — so every routed
+     * audit event (× N orgs on the multi-org fan-out) doubled the audit-write volume to the DB + immudb.
+     * `null` is cached too (an org whose config load failed) so a non-configured org is not re-read every
+     * event.
+     *
+     * The cache is STALE-WHILE-REVALIDATE ({@link LeasedValueCache}), so only the very first event for an
+     * organization waits on a read; every later one is served from memory while the refresh runs off this
+     * path. That is what lets {@link SIEM_CONFIG_REFRESH_AFTER_MS} be sixty seconds rather than five
+     * minutes — read the guarantee stated there before changing it.
+     *
+     * The loader closes over `ec`, which is the audit service's synthesised super-admin APPLICATION-scoped
+     * temp context (`audit-logs.backend.service.ts:284`, handed here at `:349`) and is therefore equally
+     * privileged on every call — the precondition {@link LeasedValueCache} states for joining an in-flight
+     * load. `loadSiemExportConfig` in fact ignores `ec` entirely (`void ec`) and reads system-context.
      */
     async _loadSiemConfigCached(ec, organizationId) {
-        const cached = this._siemConfigCache.get(organizationId);
-        if (cached && Date.now() - cached.cachedAt < SIEM_CONFIG_CACHE_TTL_MS) {
-            return cached.config;
-        }
-        const config = await this.orgConfigService.loadSiemExportConfig(ec, AuthScopeType.ORGANIZATION, organizationId);
-        if (this._siemConfigCache.size >= SIEM_CONFIG_CACHE_MAX_SIZE) {
-            const oldestKey = this._siemConfigCache.keys().next().value;
-            if (oldestKey !== undefined) {
-                this._siemConfigCache.delete(oldestKey);
-            }
-        }
-        this._siemConfigCache.set(organizationId, { config, cachedAt: Date.now() });
-        return config;
+        return this._siemConfigCache.get(organizationId, () => this.orgConfigService.loadSiemExportConfig(ec, AuthScopeType.ORGANIZATION, organizationId));
     }
     /**
      * Drop one organization's cached SIEM config so the NEXT event re-reads it.
@@ -255,9 +361,115 @@ let AuditEventDispatcherBackendService = class AuditEventDispatcherBackendServic
      * organization with no entry — which is the common case, since only organizations that have
      * raised an audit event since the last eviction are in the map at all. Synchronous and
      * infallible on purpose, so the caller needs no error handling.
+     *
+     * ## It reaches EVERY replica, which it did not before
+     *
+     * The local drop above is only ever correct for ONE process — the one that happened to handle the
+     * write. With N replicas behind a load balancer, the other N-1 went on serving the pre-write config
+     * for the rest of the lease, so "the invalidation covers engine-routed writes" was true of a single
+     * instance and false of every real deployment. The broadcast closes that: the organization id goes
+     * out on {@link SIEM_CONFIG_INVALIDATION_CHANNEL_SUFFIX} and every replica's subscriber drops its own
+     * entry within milliseconds.
+     *
+     * The publish is fire-and-forget and cannot fail this call: a broadcast that does not go out degrades
+     * the OTHER replicas to the lease, which is exactly where they were before, and refusing a
+     * configuration write to protect a cache would invert the priority. This method's synchronous,
+     * infallible contract therefore still holds for its caller.
+     *
+     * **What it still does NOT cover, and cannot.** A write that never reaches the service tier — a
+     * repository-tier write, or a direct database write like `examples/wonder-todos/e2e/adapter.ts`'s
+     * `upsertOrganizationSingleton('organizationSiemExportConfig', …)` — raises no postfix hook, so
+     * nothing calls this and nothing is broadcast. For those the lease is the entire guarantee; that is
+     * why it is chosen and argued at {@link SIEM_CONFIG_REFRESH_AFTER_MS} rather than left incidental.
      */
     invalidateSiemConfig(organizationId) {
-        this._siemConfigCache.delete(organizationId);
+        this._siemConfigCache.invalidate(organizationId);
+        this._publishSiemConfigInvalidation(organizationId);
+    }
+    /**
+     * Tell the rest of the fleet to drop this organization's cached SIEM config.
+     *
+     * Returns nothing and awaits nothing — the caller is a postfix write hook whose contract is that it
+     * cannot fail the write it follows.
+     */
+    _publishSiemConfigInvalidation(organizationId) {
+        const client = this.redisService?.getReadyClient();
+        // A not-ready client is the normal state wherever Redis is unconfigured (single-replica, local dev,
+        // several test containers). It is not an error: the local drop already happened, and there is no
+        // other replica to tell.
+        if (!client)
+            return;
+        void client
+            .publish(this._invalidationChannel(), organizationId)
+            .catch((error) => this.logger.error?.('Failed to broadcast a SIEM export config invalidation — other replicas converge on the lease instead', {
+            organizationId,
+            refreshAfterMs: SIEM_CONFIG_REFRESH_AFTER_MS,
+            ...projectCaughtErrorLogFields(error),
+        }));
+    }
+    /** App-prefixed so two applications sharing one Redis never invalidate each other's caches. */
+    _invalidationChannel() {
+        return `${this.redisService?.getAppPrefix() ?? ''}${SIEM_CONFIG_INVALIDATION_CHANNEL_SUFFIX}`;
+    }
+    /**
+     * Arm this replica's single subscriber to the invalidation channel. Idempotent.
+     *
+     * Called (never awaited) from {@link dispatchToOrganizationAuditSinks}, so no startup ordering is
+     * required and nothing has to be wired in `start-application` — the same lazy-arm pattern
+     * `A2ATaskCancellationBackendService.ensureSubscriber` uses, for the same reason.
+     *
+     * Fails OPEN by design: a replica that cannot subscribe still routes audit events, converging on the
+     * lease instead of on the broadcast. The failure is logged at ERROR because a persistent one silently
+     * returns that replica to the per-process behaviour this mechanism exists to remove.
+     *
+     * Two details are copied deliberately rather than reinvented, because each was a recorded defect in
+     * the A2A original: the `end` handler RE-ARMS (a subscriber that connected and then dropped — a Redis
+     * restart, a failover, an idle reap — otherwise stayed dead for the life of the process while every
+     * other signal looked healthy), and the catch DESTROYS a half-built connection (`connect()` can
+     * succeed while `subscribe()` throws, and retrying without destroying leaks one socket per attempt).
+     */
+    async _ensureInvalidationSubscriber() {
+        if (this._invalidationSubscribeStarted)
+            return;
+        this._invalidationSubscribeStarted = true;
+        const client = this.redisService?.getReadyClient();
+        if (!client) {
+            // Not an error: no Redis means no other replica to hear from. Latched so this is decided once.
+            this.logDebug('Redis unavailable — cross-replica SIEM-config invalidation is disabled for this replica');
+            return;
+        }
+        let subscriber;
+        try {
+            // `node-redis` forbids ordinary commands on a subscribed connection, so this MUST be a duplicate
+            // rather than the shared client.
+            subscriber = client.duplicate();
+            subscriber.on('error', (error) => this.logger.error?.('SIEM-config invalidation subscriber error', { ...projectCaughtErrorLogFields(error) }));
+            subscriber.on('end', () => {
+                this.logger.warn?.('SIEM-config invalidation subscriber closed; re-arming so the next dispatch rebuilds it');
+                this._invalidationSubscribeStarted = false;
+            });
+            await subscriber.connect();
+            await subscriber.subscribe(this._invalidationChannel(), (organizationId) => {
+                // Local drop only — never a re-publish, or one write would loop the fleet forever.
+                this._siemConfigCache.invalidate(organizationId);
+                this.logDebug('Dropped a cached SIEM export config on a fleet invalidation', { organizationId });
+            });
+        }
+        catch (error) {
+            if (subscriber) {
+                try {
+                    await subscriber.destroy();
+                }
+                catch {
+                    /* already dead — nothing to reclaim */
+                }
+            }
+            this._invalidationSubscribeStarted = false; // allow a later dispatch to retry
+            this.logger.error?.('Failed to subscribe to the SIEM-config invalidation channel — this replica converges on the lease only', {
+                refreshAfterMs: SIEM_CONFIG_REFRESH_AFTER_MS,
+                ...projectCaughtErrorLogFields(error),
+            });
+        }
     }
     /**
      * Deliver one event to an org's SIEM webhook sink: apply the sink's per-event filter,
@@ -382,7 +594,7 @@ let AuditEventDispatcherBackendService = class AuditEventDispatcherBackendServic
     _buildEnvelope(auditEvent, organizationId, classification, organizationName, applicationId, applicationName) {
         const eventData = auditEvent.eventData;
         return {
-            eventId: uuidv4(),
+            eventId: this._resolveEnvelopeEventId(auditEvent),
             eventType: auditEvent.eventType,
             eventCategory: classification.category,
             severity: classification.severity,
@@ -412,6 +624,66 @@ let AuditEventDispatcherBackendService = class AuditEventDispatcherBackendServic
             outcomeReason: eventData.failureReason || eventData.reason || undefined,
         };
     }
+    /**
+     * The id the DELIVERED envelope carries — the audit row's OWN `eventId`, never a freshly minted one.
+     *
+     * ## Why it must be the audit event's id
+     *
+     * `SecurityAuditEventEnvelope.eventId` is the only identifier that leaves the application on a SIEM
+     * delivery, and it is doing two jobs at once:
+     *
+     *  1. it is what a RECEIVER deduplicates on — the delivery service's own header says "Idempotency via
+     *     eventId", and every wire format carries this one field through to the receiver's dedup key
+     *     (CEF `externalId`, LEEF `eventId`, OCSF `metadata.uid`, and the verbatim `json_structured` body's
+     *     top-level `eventId`); and
+     *  2. it is the only handle an analyst has for joining a record in the customer's SIEM back to the
+     *     audit row it was projected from.
+     *
+     * Minting a fresh uuid here satisfied (1) and silently destroyed (2). The id was ALREADY on the value
+     * being projected: `AuditableEvent.eventId` is minted in `AuditLogsBackendService._createAuditLog`
+     * BEFORE the DB write, is documented on the schema as the "store-agnostic, server-minted correlation
+     * key", and already joins the DB row to its immudb record and to `verifyAuditEvent(eventId)`. It
+     * survives the `Omit` on this method's parameter type, so it was in hand and thrown away — the
+     * envelope replaced it with an id that exists nowhere else in the system, making a delivered SIEM
+     * event deduplicable but unexplainable.
+     *
+     * ## Why the cutover is safe — the risk this looks like it carries, it does not
+     *
+     * Changing what a receiver deduplicates on normally risks re-accepting events at the switch. Not here:
+     * the OLD value was a per-delivery random uuid, never reused and not re-derivable from anything, so
+     * every id crossing the cutover is still one no receiver has ever seen. Nothing is re-delivered and
+     * nothing is newly deduped away.
+     *
+     * What genuinely changes is the FAN-OUT. `AuditLogsBackendService` dispatches one audit event to each
+     * of the user's verified member orgs, so those N deliveries now carry ONE id instead of N. They go to
+     * N different tenants' sinks, so there is no cross-receiver dedup interaction — and one id is the
+     * truthful statement, because it is one event. (The DLQ row records this id too, so a dead letter is
+     * now joinable to its audit row as well; `SiemDeliveryDlqBaseSchema.eventId` carries no unique index,
+     * so the shared id cannot collide there.)
+     *
+     * Per-attempt idempotency is untouched: the envelope is built ONCE, and both the in-process retry loop
+     * in `SIEMWebhookDeliveryBackendService.processDelivery` and the DLQ drain re-send that same stored
+     * object — so one delivery keeps one id across every attempt, which is exactly what a receiver's dedup
+     * needs.
+     *
+     * ## The fallback, and why it is not a hedge
+     *
+     * `eventId` is required on `AuditableEvent` and the sole production caller always sets it, so this
+     * branch should be unreachable. It exists because the two failures are ASYMMETRIC: an absent id is not
+     * merely an unjoinable delivery, it is a delivery with NO dedup key at all — every projection renders
+     * the field only `if (e.eventId)`, so the receiver stores `dedupKey: null` and answers `deduped: false`
+     * forever against a service that retries and drains a DLQ. Losing the join degrades an investigation;
+     * losing idempotency duplicates events inside a customer's SIEM. So an absent id still gets a minted
+     * one, and is logged loudly rather than shipping a blank.
+     */
+    _resolveEnvelopeEventId(auditEvent) {
+        if (auditEvent.eventId) {
+            return auditEvent.eventId;
+        }
+        const mintedEventId = uuidv4();
+        this.logger.warn?.('Audit event reached SIEM dispatch with no eventId — the delivered envelope cannot be joined back to its audit row; minting a delivery-local id so receiver idempotency survives', { eventType: auditEvent.eventType, mintedEventId });
+        return mintedEventId;
+    }
     /**
      * Infer success/failure outcome from event type.
      */
@@ -431,35 +703,39 @@ let AuditEventDispatcherBackendService = class AuditEventDispatcherBackendServic
     // F3: Organization Name Cache
     // ─────────────────────────────────────────────────────────────
     /**
-     * F3: Resolve organization name with a lightweight in-memory cache.
-     * Cache entries expire after ORG_NAME_CACHE_TTL_MS to pick up renames.
-     * Returns undefined if lookup fails (fire-and-forget context — don't throw).
+     * F3: resolve an organization NAME for SIEM-analyst readability, through the leased cache.
+     *
+     * Renames are picked up within {@link ORG_NAME_REFRESH_AFTER_MS} — read that constant for why this
+     * lease is five minutes while the routing config's is sixty seconds. There is no invalidation hook on
+     * this one, deliberately: a stale label costs a reader nothing (the `organizationId` beside it in the
+     * envelope is authoritative and always current), so the lease alone is a proportionate answer.
+     *
+     * Never throws — a missing name is optional in the envelope, and this runs on a fire-and-forget path.
+     * The loader therefore swallows its own failure and yields `undefined`, which means the COLD path of
+     * {@link LeasedValueCache} can never reject here.
+     *
+     * **`undefined` IS cached, and that is a fix rather than an oversight.** Before this, a lookup that
+     * failed or returned a nameless row cached nothing, so an organization whose read kept failing was
+     * re-read on EVERY exported event — the read amplification a cache exists to prevent, arriving
+     * precisely when the repository is already unhealthy. Caching the negative bounds it to one read per
+     * lease, and a rename or a repaired read still lands within that lease.
+     *
+     * The loader closes over `ec` — the audit service's synthesised super-admin APPLICATION-scoped temp
+     * context (`audit-logs.backend.service.ts:284` → `:349`), identical in privilege on every dispatch —
+     * which is the precondition {@link LeasedValueCache} states for joining an in-flight load.
      */
     async _resolveOrgName(ec, organizationId) {
-        // Check cache first
-        const cached = this._orgNameCache.get(organizationId);
-        if (cached && (Date.now() - cached.cachedAt) < ORG_NAME_CACHE_TTL_MS) {
-            return cached.name;
-        }
-        try {
-            const orgsRepo = this.repositoriesRegistry.getRepositoryOrThrow(CoreResourceType.ORGANIZATIONS);
-            const org = await orgsRepo.read(ec, organizationId);
-            if (org?.name) {
-                // B4: Evict oldest entries when cache exceeds max size (simple LRU approximation)
-                if (this._orgNameCache.size >= ORG_NAME_CACHE_MAX_SIZE) {
-                    const oldestKey = this._orgNameCache.keys().next().value;
-                    if (oldestKey !== undefined) {
-                        this._orgNameCache.delete(oldestKey);
-                    }
-                }
-                this._orgNameCache.set(organizationId, { name: org.name, cachedAt: Date.now() });
-                return org.name;
+        return this._orgNameCache.get(organizationId, async () => {
+            try {
+                const orgsRepo = this.repositoriesRegistry.getRepositoryOrThrow(CoreResourceType.ORGANIZATIONS);
+                const org = await orgsRepo.read(ec, organizationId);
+                return org?.name || undefined;
             }
-        }
-        catch {
-            // Fire-and-forget — org name is optional in the envelope
-        }
-        return undefined;
+            catch {
+                // Fire-and-forget — org name is optional in the envelope.
+                return undefined;
+            }
+        });
     }
     // ─────────────────────────────────────────────────────────────
     // F6: Event Integrity (HMAC)
@@ -504,11 +780,13 @@ AuditEventDispatcherBackendService = __decorate([
     __param(2, inject(SAAS_SERVICE_TYPES.AuthOrganizationConfigurationService)),
     __param(3, inject(SAAS_SERVICE_TYPES.QueueBackendService)),
     __param(4, inject(SAAS_SERVICE_TYPES.RepositoriesRegistryHandlerService)),
+    __param(5, inject(SAAS_SERVICE_TYPES.RedisService)),
+    __param(5, optional()),
     __metadata("design:paramtypes", [LoggerService,
         AppConfigurationService,
         AuthOrganizationConfigurationService,
         QueueBackendService,
-        RepositoriesRegistryHandlerBackendService])
+        RepositoriesRegistryHandlerBackendService, Function])
 ], AuditEventDispatcherBackendService);
 export { AuditEventDispatcherBackendService };
 //# sourceMappingURL=audit-event-dispatcher.backend.service.js.map