@wildo-ai/saas-backend-lib 1.1.2 → 1.1.3

package/dist/esm/base-classes/services/repositories/http-api/http-api-resource-repository.backend.service.d.ts

@@ -21,6 +21,7 @@ import type { ErrorBuilderBackendService } from '../../../../errors/services/err
 import type { ResourcesRegistryBackendService } from '../../../../resources/services/resources-registry.backend.service';
 import type { ExecutionContext } from '../../../../runtime/models/execution-context.backend.schemas';
 import type { RepositoryOptions } from '../../../../base-classes/models/repositories.backend.schemas';
+import { type AuditObservationLossMetricsResolver } from '../../../../monitoring/observability/audit-observation-emission.backend';
 import { type HttpApiFetchLike } from './http-api-transport.backend';
 import { type HttpApiProviderAccessResolver } from './http-api-provider-access.backend';
 type ListCallOptions = RepositoryOptions & {
@@ -55,12 +56,26 @@ export declare class HttpApiResourceRepositoryBackendService {
     private readonly providerAccessResolver;
     private readonly fetchImpl;
     private readonly auditLogsResolver?;
+    /**
+     * The loss counter behind {@link recordReadThroughAccess}, resolved the same way and for the
+     * same reason as the audit seam beside it: this class is built with `new`, holds no container,
+     * and must construct in a unit harness that binds neither. A thunk rather than the recorder
+     * itself so nothing is resolved on the happy path — see the seam's own type.
+     */
+    private readonly metricsResolver?;
     private readonly resourceConfiguration;
     private readonly binding;
     private readonly operationsMap;
     private readonly readClient;
     private readonly logDebug;
-    constructor(resourceType: ResourceType, logger: LoggerService, errorBuilder: ErrorBuilderBackendService, resourceRegistry: ResourcesRegistryBackendService, providerAccessResolver: HttpApiProviderAccessResolver, fetchImpl?: HttpApiFetchLike, auditLogsResolver?: HttpApiAuditLogsResolver);
+    constructor(resourceType: ResourceType, logger: LoggerService, errorBuilder: ErrorBuilderBackendService, resourceRegistry: ResourcesRegistryBackendService, providerAccessResolver: HttpApiProviderAccessResolver, fetchImpl?: HttpApiFetchLike, auditLogsResolver?: HttpApiAuditLogsResolver, 
+    /**
+     * The loss counter behind {@link recordReadThroughAccess}, resolved the same way and for the
+     * same reason as the audit seam beside it: this class is built with `new`, holds no container,
+     * and must construct in a unit harness that binds neither. A thunk rather than the recorder
+     * itself so nothing is resolved on the happy path — see the seam's own type.
+     */
+    metricsResolver?: AuditObservationLossMetricsResolver);
     doByPath<T = any, U = any>(operationRepositoryPath: Parameters<typeof ResourcesConfig_OperationPathUtils.createOperationRepositoryPathKey>[0], executionContext: ExecutionContext<any>, id_or_ids_or_filter?: any, data?: U, options?: RepositoryOptions): Promise<T>;
     doByKey<T = any, U = any>(operationRepositoryPathKey: string, executionContext: ExecutionContext<any>, id_or_ids_or_filter?: any, data?: U, options?: RepositoryOptions): Promise<T>;
     doByExecutionContext<T = any>(executionContext: ExecutionContext<any>, data?: any, options?: RepositoryOptions): Promise<T>;
@@ -90,6 +105,19 @@ export declare class HttpApiResourceRepositoryBackendService {
     private _doCount;
     private _doSearch;
     private translate;
+    /**
+     * The ONE place a REST_JSON read member becomes a compilable spec — and, since S3a (#331), the
+     * one place a CATALOGUE REFERENCE is resolved into one.
+     *
+     * Async because a reference loads the provider's catalogue, which is lazy by contract. All four
+     * call sites were already inside async methods, so this cost nothing at the boundary; what it
+     * buys is that a reference is resolved at the same chokepoint an inline spec is read, so no
+     * compiler and no caller ever learns which form the binding used.
+     *
+     * Resolved per call rather than cached here: the resolver memoizes the CATALOGUE (which is the
+     * expensive part), and caching the projected spec as well would put a second copy of provider
+     * state in every repository instance for no measurable gain.
+     */
     private restOperationSpec;
     private executeKeyAddressedRead;
     private executeCollectionRead;
@@ -102,6 +130,14 @@ export declare class HttpApiResourceRepositoryBackendService {
      * never fail the read it observes. Emitted ONLY after a remote round-trip actually happened —
      * match-nothing short-circuits touch no external system and record nothing.
      *
+     * Every emission goes through {@link emitAuditObservation}, so a lost one lands on
+     * `audit_observation_dropped_total` instead of nowhere. The feature detection therefore decides an
+     * ARGUMENT rather than an early return: handing the seam `undefined` is how this site reports
+     * `SERVICE_UNAVAILABLE`, the loss shape that reaches no `_createAuditLog` and used to leave nothing
+     * behind at all. An early return would restore that silence — and the silence is expensive here,
+     * because ATTRIBUTION is the whole point of the row: without it the third party's own logs show
+     * one shared service principal and nothing anywhere resolves it back to a person.
+     *
      * Emission lives at the ADAPTER, deliberately inverting the services-tier precedent
      * (`recordPlatformDirectoryAccess`'s "the repository exists once per adapter" argument):
      * HTTP_API has exactly ONE adapter, and it is the only tier that witnesses EVERY remote access
@@ -122,9 +158,16 @@ export declare class HttpApiResourceRepositoryBackendService {
      *
      * ## Identity-less by design
      *
-     * The internal context below is inert on this path, verified per consumer: translation runs
-     * `excludeContextualFilter` (an erasure must reach the subject's rows in EVERY tenant — the FK
-     * equality is the confinement), and `resolveAccess` ignores the context for SERVICE_PRINCIPAL.
+     * The internal context below is inert on this path for translation, verified per consumer:
+     * translation runs `excludeContextualFilter` (an erasure must reach the subject's rows in EVERY
+     * tenant — the FK equality is the confinement).
+     *
+     * It is NOT inert for access. This said `resolveAccess` "ignores the context for
+     * SERVICE_PRINCIPAL", and since #333 the context is what NAMES the owner whose account a
+     * tenant-owned or user-owned binding spends. An erasure sweep runs on an internal context, so a
+     * binding that declares anything but an application-owned connection refuses here rather than
+     * erasing under the wrong account — which is the fail-closed direction, and is why the refusal is
+     * worth meeting as an explicit error rather than a silent fallback.
      * Attribution lives in the `HTTP_API_EXTERNAL_ERASURE` audit row the calling effect emits;
      * discovery reads here deliberately do NOT emit read-through events (the read exists only to
      * address the deletion the event already records — double-recording would be noise with no

package/dist/esm/base-classes/services/repositories/http-api/http-api-resource-repository.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-api-resource-repository.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../../src/base-classes/services/repositories/http-api/http-api-resource-repository.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAML,kCAAkC,EAGlC,KAAK,YAAY,EACjB,KAAK,yBAAyB,EAC9B,KAAK,2BAA2B,EACjC,MAAM,uBAAuB,CAAC;AAS/B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AACnH,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,0EAA0E,CAAC;AAChI,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAE5G,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qEAAqE,CAAC;AAE7G,OAAO,EAGL,KAAK,gBAAgB,EAEtB,MAAM,8BAA8B,CAAC;AAgCtC,OAAO,EAEL,KAAK,6BAA6B,EACnC,MAAM,oCAAoC,CAAC;AAI5C,KAAK,eAAe,GAAG,iBAAiB,GAAG;IACzC,WAAW,CAAC,EAAE,OAAO,CAAC,2BAA2B,CAAC,GAAG;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;KAAE,CAAC;CACxF,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,wBAAwB,GAAG,MAAM;IAC3C,2BAA2B,CAAC,EAAE,CAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,uBAAuB,CAAC,EAAE,gBAAgB,CAAC,GAAG,CAAC,KAC5C,OAAO,CAAC,IAAI,CAAC,CAAC;CACpB,GAAG,SAAS,CAAC;AAEd;;;;;GAKG;AACH,qBAAa,2BAA4B,SAAQ,KAAK;aAGlC,YAAY,EAAE,MAAM;aACpB,KAAK,CAAC,EAAE,OAAO;gBAF/B,OAAO,EAAE,MAAM,EACC,YAAY,EAAE,MAAM,EACpB,KAAK,CAAC,EAAE,OAAO;CAKlC;AASD,qBAAa,uCAAuC;IAShD,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IACvC,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IAbrC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAM;IAC5C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAyB;IACjD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAmC;IACjE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAoB;IAC/C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA4C;gBAGnE,YAAY,EAAE,YAAY,EACT,MAAM,EAAE,aAAa,EACrB,YAAY,EAAE,0BAA0B,EACxC,gBAAgB,EAAE,+BAA+B,EACjD,sBAAsB,EAAE,6BAA6B,EACrD,SAAS,GAAE,gBAAsC,EACjD,iBAAiB,CAAC,EAAE,wBAAwB;IAqClD,QAAQ,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,GAAG,EACpC,uBAAuB,EAAE,UAAU,CAAC,OAAO,kCAAkC,CAAC,gCAAgC,CAAC,CAAC,CAAC,CAAC,EAClH,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,mBAAmB,CAAC,EAAE,GAAG,EACzB,IAAI,CAAC,EAAE,CAAC,EACR,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,CAAC,CAAC;IAKA,OAAO,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,GAAG,EACnC,0BAA0B,EAAE,MAAM,EAClC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,mBAAmB,CAAC,EAAE,GAAG,EACzB,IAAI,CAAC,EAAE,CAAC,EACR,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,CAAC,CAAC;IAoBA,oBAAoB,CAAC,CAAC,GAAG,GAAG,EACvC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,IAAI,CAAC,EAAE,GAAG,EACV,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,CAAC,CAAC;YAQC,WAAW;IAuCZ,IAAI,CAAC,CAAC,GAAG,SAAS,EAC7B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,YAAY,EAAE,GAAG,EACjB,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,GAAG,CAAC;IAMF,mBAAmB,CAAC,CAAC,GAAG,SAAS,EAC5C,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,YAAY,EAAE,GAAG,EACjB,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,GAAG,CAAC;IAIF,IAAI,CAAC,CAAC,GAAG,SAAS,EAC7B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,aAAa,EAAE,GAAG,EAClB,OAAO,CAAC,EAAE,eAAe,GACxB,OAAO,CAAC,GAAG,CAAC;IAaF,mBAAmB,CAAC,CAAC,GAAG,SAAS,EAC5C,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,aAAa,EAAE,GAAG,EAClB,OAAO,CAAC,EAAE,eAAe,GACxB,OAAO,CAAC,GAAG,CAAC;IAMF,MAAM,CAAC,CAAC,GAAG,GAAG,EACzB,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,WAAW,EAAE,MAAM,EACnB,MAAM,CAAC,EAAE,GAAG,EACZ,aAAa,CAAC,EAAE,GAAG,EACnB,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC;IAU3B,KAAK,CAChB,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,MAAM,CAAC,EAAE,GAAG,EACZ,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAMtB,iBAAiB,CAAC,mBAAmB,EAAE,MAAM,GAAG,OAAO;YAYhD,OAAO;IA+BrB;;;;;;;;;OASG;YACW,uBAAuB;YAsDvB,OAAO;YAyDP,QAAQ;YAeR,SAAS;IAqDvB,OAAO,CAAC,SAAS;IAoBjB,OAAO,CAAC,iBAAiB;YAWX,uBAAuB;YA2BvB,qBAAqB;YAuBrB,8BAA8B;YA6B9B,gBAAgB;IAsC9B;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,CAAC,uBAAuB;IA4B/B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACU,iCAAiC,CAC5C,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IAkEpC;;;;OAIG;IACU,wBAAwB,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAU/F,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAAM;IACpD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gCAAgC,CAAO;IAE/D;;;;;OAKG;IACH,OAAO,CAAC,6BAA6B;IAQrC,8FAA8F;YAChF,qBAAqB;IAyDnC,OAAO,CAAC,cAAc;IAYtB,sFAAsF;YACxE,OAAO;IAkCrB,OAAO,CAAC,eAAe;IAavB,OAAO,CAAC,oBAAoB;IAM5B,OAAO,CAAC,kBAAkB;IAYb,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC;IACxB,UAAU,IAAI,OAAO,CAAC,KAAK,CAAC;IAC5B,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC;IACxB,UAAU,IAAI,OAAO,CAAC,KAAK,CAAC;IAC5B,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC;IACxB,UAAU,IAAI,OAAO,CAAC,KAAK,CAAC;IAC5B,oBAAoB,IAAI,OAAO,CAAC,KAAK,CAAC;IACtC,oBAAoB,IAAI,OAAO,CAAC,KAAK,CAAC;IACtC,qBAAqB,IAAI,OAAO,CAAC,KAAK,CAAC;IACvC,qBAAqB,IAAI,OAAO,CAAC,KAAK,CAAC;IACvC,qBAAqB,IAAI,OAAO,CAAC,KAAK,CAAC;IACvC,iBAAiB,IAAI,OAAO,CAAC,KAAK,CAAC;IACnC,mBAAmB,IAAI,OAAO,CAAC,KAAK,CAAC;IACrC,gBAAgB,IAAI,OAAO,CAAC,KAAK,CAAC;IAClC,iBAAiB,IAAI,OAAO,CAAC,KAAK,CAAC;IACnC,yBAAyB,IAAI,OAAO,CAAC,KAAK,CAAC;IAC3C,cAAc,IAAI,OAAO,CAAC,KAAK,CAAC;IAChC,iBAAiB,IAAI,OAAO,CAAC,KAAK,CAAC;IACnC,sBAAsB,IAAI,OAAO,CAAC,KAAK,CAAC;IACxC,mBAAmB,IAAI,OAAO,CAAC,KAAK,CAAC;IACrC,cAAc,IAAI,OAAO,CAAC,KAAK,CAAC;IAChC,kBAAkB,IAAI,OAAO,CAAC,KAAK,CAAC;CAClD"}
+{"version":3,"file":"http-api-resource-repository.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../../src/base-classes/services/repositories/http-api/http-api-resource-repository.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAML,kCAAkC,EAGlC,KAAK,YAAY,EACjB,KAAK,yBAAyB,EAC9B,KAAK,2BAA2B,EACjC,MAAM,uBAAuB,CAAC;AAU/B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AACnH,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,0EAA0E,CAAC;AAChI,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAE5G,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qEAAqE,CAAC;AAC7G,OAAO,EAEL,KAAK,mCAAmC,EAEzC,MAAM,gFAAgF,CAAC;AAExF,OAAO,EAGL,KAAK,gBAAgB,EAEtB,MAAM,8BAA8B,CAAC;AAiCtC,OAAO,EAEL,KAAK,6BAA6B,EACnC,MAAM,oCAAoC,CAAC;AAI5C,KAAK,eAAe,GAAG,iBAAiB,GAAG;IACzC,WAAW,CAAC,EAAE,OAAO,CAAC,2BAA2B,CAAC,GAAG;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;KAAE,CAAC;CACxF,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,wBAAwB,GAAG,MAAM;IAC3C,2BAA2B,CAAC,EAAE,CAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,uBAAuB,CAAC,EAAE,gBAAgB,CAAC,GAAG,CAAC,KAC5C,OAAO,CAAC,IAAI,CAAC,CAAC;CACpB,GAAG,SAAS,CAAC;AAEd;;;;;GAKG;AACH,qBAAa,2BAA4B,SAAQ,KAAK;aAGlC,YAAY,EAAE,MAAM;aACpB,KAAK,CAAC,EAAE,OAAO;gBAF/B,OAAO,EAAE,MAAM,EACC,YAAY,EAAE,MAAM,EACpB,KAAK,CAAC,EAAE,OAAO;CAKlC;AASD,qBAAa,uCAAuC;IAShD,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IACvC,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IACnC;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IApBnC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAM;IAC5C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAyB;IACjD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAmC;IACjE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAoB;IAC/C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA4C;gBAGnE,YAAY,EAAE,YAAY,EACT,MAAM,EAAE,aAAa,EACrB,YAAY,EAAE,0BAA0B,EACxC,gBAAgB,EAAE,+BAA+B,EACjD,sBAAsB,EAAE,6BAA6B,EACrD,SAAS,GAAE,gBAAsC,EACjD,iBAAiB,CAAC,EAAE,wBAAwB;IAC7D;;;;;OAKG;IACc,eAAe,CAAC,EAAE,mCAAmC;IAqC3D,QAAQ,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,GAAG,EACpC,uBAAuB,EAAE,UAAU,CAAC,OAAO,kCAAkC,CAAC,gCAAgC,CAAC,CAAC,CAAC,CAAC,EAClH,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,mBAAmB,CAAC,EAAE,GAAG,EACzB,IAAI,CAAC,EAAE,CAAC,EACR,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,CAAC,CAAC;IAKA,OAAO,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,GAAG,EACnC,0BAA0B,EAAE,MAAM,EAClC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,mBAAmB,CAAC,EAAE,GAAG,EACzB,IAAI,CAAC,EAAE,CAAC,EACR,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,CAAC,CAAC;IAoBA,oBAAoB,CAAC,CAAC,GAAG,GAAG,EACvC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,IAAI,CAAC,EAAE,GAAG,EACV,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,CAAC,CAAC;YAQC,WAAW;IAuCZ,IAAI,CAAC,CAAC,GAAG,SAAS,EAC7B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,YAAY,EAAE,GAAG,EACjB,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,GAAG,CAAC;IAMF,mBAAmB,CAAC,CAAC,GAAG,SAAS,EAC5C,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,YAAY,EAAE,GAAG,EACjB,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,GAAG,CAAC;IAIF,IAAI,CAAC,CAAC,GAAG,SAAS,EAC7B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,aAAa,EAAE,GAAG,EAClB,OAAO,CAAC,EAAE,eAAe,GACxB,OAAO,CAAC,GAAG,CAAC;IAaF,mBAAmB,CAAC,CAAC,GAAG,SAAS,EAC5C,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,aAAa,EAAE,GAAG,EAClB,OAAO,CAAC,EAAE,eAAe,GACxB,OAAO,CAAC,GAAG,CAAC;IAMF,MAAM,CAAC,CAAC,GAAG,GAAG,EACzB,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,WAAW,EAAE,MAAM,EACnB,MAAM,CAAC,EAAE,GAAG,EACZ,aAAa,CAAC,EAAE,GAAG,EACnB,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC;IAU3B,KAAK,CAChB,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,MAAM,CAAC,EAAE,GAAG,EACZ,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAMtB,iBAAiB,CAAC,mBAAmB,EAAE,MAAM,GAAG,OAAO;YAYhD,OAAO;IA+BrB;;;;;;;;;OASG;YACW,uBAAuB;YAsDvB,OAAO;YAyDP,QAAQ;YAeR,SAAS;IAqDvB,OAAO,CAAC,SAAS;IAoBjB;;;;;;;;;;;;OAYG;YACW,iBAAiB;YAyBjB,uBAAuB;YA2BvB,qBAAqB;YAuBrB,8BAA8B;YA6B9B,gBAAgB;IAsC9B;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,OAAO,CAAC,uBAAuB;IAgD/B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAqCG;IACU,iCAAiC,CAC5C,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IAkEpC;;;;OAIG;IACU,wBAAwB,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAU/F,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAAM;IACpD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gCAAgC,CAAO;IAE/D;;;;;OAKG;IACH,OAAO,CAAC,6BAA6B;IAQrC,8FAA8F;YAChF,qBAAqB;IAyDnC,OAAO,CAAC,cAAc;IAYtB,sFAAsF;YACxE,OAAO;IAkCrB,OAAO,CAAC,eAAe;IAavB,OAAO,CAAC,oBAAoB;IAM5B,OAAO,CAAC,kBAAkB;IAYb,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC;IACxB,UAAU,IAAI,OAAO,CAAC,KAAK,CAAC;IAC5B,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC;IACxB,UAAU,IAAI,OAAO,CAAC,KAAK,CAAC;IAC5B,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC;IACxB,UAAU,IAAI,OAAO,CAAC,KAAK,CAAC;IAC5B,oBAAoB,IAAI,OAAO,CAAC,KAAK,CAAC;IACtC,oBAAoB,IAAI,OAAO,CAAC,KAAK,CAAC;IACtC,qBAAqB,IAAI,OAAO,CAAC,KAAK,CAAC;IACvC,qBAAqB,IAAI,OAAO,CAAC,KAAK,CAAC;IACvC,qBAAqB,IAAI,OAAO,CAAC,KAAK,CAAC;IACvC,iBAAiB,IAAI,OAAO,CAAC,KAAK,CAAC;IACnC,mBAAmB,IAAI,OAAO,CAAC,KAAK,CAAC;IACrC,gBAAgB,IAAI,OAAO,CAAC,KAAK,CAAC;IAClC,iBAAiB,IAAI,OAAO,CAAC,KAAK,CAAC;IACnC,yBAAyB,IAAI,OAAO,CAAC,KAAK,CAAC;IAC3C,cAAc,IAAI,OAAO,CAAC,KAAK,CAAC;IAChC,iBAAiB,IAAI,OAAO,CAAC,KAAK,CAAC;IACnC,sBAAsB,IAAI,OAAO,CAAC,KAAK,CAAC;IACxC,mBAAmB,IAAI,OAAO,CAAC,KAAK,CAAC;IACrC,cAAc,IAAI,OAAO,CAAC,KAAK,CAAC;IAChC,kBAAkB,IAAI,OAAO,CAAC,KAAK,CAAC;CAClD"}

package/dist/esm/base-classes/services/repositories/http-api/http-api-resource-repository.backend.service.js

@@ -16,14 +16,16 @@
  * IS `null` — that is a genuine "no row".
  */
 import { CoreResourceOperation, ErrorType, HttpApiResourceIdError, PRIMARY_SCOPE_TO_FIELD_IDENTIFIER, ResourceOperationVariantType, ResourcesConfig_OperationPathUtils, ResourceOperationsUtils, resolveHttpApiKeyComponents, } from '@wildo-ai/saas-models';
-import { HttpApiErasureStance, HttpApiTenancyStance, HttpApiTransportDialect, } from '@wildo-ai/saas-models/external-data';
+import { HttpApiErasureStance, HttpApiTenancyStance, HttpApiTransportDialect, isHttpApiRestOperationReference, } from '@wildo-ai/saas-models/external-data';
 import { ErrorCustomMessageReference } from '@wildo-ai/saas-models';
+import { AuditObservationKind, emitAuditObservation, } from '../../../../monitoring/observability/audit-observation-emission.backend.js';
 import { HttpApiTransportError, } from './http-api-transport.backend.js';
 import { HttpApiReadClient, defaultHttpApiFetch } from './http-api-read-client.backend.js';
 import { HttpApiTranslationRefusal, translateHttpApiReadInputs, } from './http-api-filter-translation.backend.js';
 import { compileODataCollectionRead, compileODataCountRead, compileODataKeyAddressedRead, } from './odata-query-compiler.backend.js';
 import { RestJsonTranslationRefusal, compileRestJsonCollectionRead, compileRestJsonDeclaredErasure, compileRestJsonKeyAddressedRead, } from './rest-json-query-compiler.backend.js';
 import { HttpApiRemoteContractError, projectHttpApiRemoteRow, resolveHttpApiResultPath, } from './http-api-row-projection.backend.js';
+import { projectProviderOperationOntoReadSurface } from './http-api-rest-operation-reference.backend.js';
 import { compileOdooCanonicalDelete, compileOdooCollectionRead, compileOdooCountRead, compileOdooKeyAddressedRead, } from './odoo-jsonrpc-compiler.backend.js';
 import { HttpApiProviderAccessError, } from './http-api-provider-access.backend.js';
 /**
@@ -55,18 +57,27 @@ export class HttpApiResourceRepositoryBackendService {
     providerAccessResolver;
     fetchImpl;
     auditLogsResolver;
+    metricsResolver;
     resourceConfiguration;
     binding;
     operationsMap = new Map();
     readClient;
     logDebug;
-    constructor(resourceType, logger, errorBuilder, resourceRegistry, providerAccessResolver, fetchImpl = defaultHttpApiFetch, auditLogsResolver) {
+    constructor(resourceType, logger, errorBuilder, resourceRegistry, providerAccessResolver, fetchImpl = defaultHttpApiFetch, auditLogsResolver, 
+    /**
+     * The loss counter behind {@link recordReadThroughAccess}, resolved the same way and for the
+     * same reason as the audit seam beside it: this class is built with `new`, holds no container,
+     * and must construct in a unit harness that binds neither. A thunk rather than the recorder
+     * itself so nothing is resolved on the happy path — see the seam's own type.
+     */
+    metricsResolver) {
         this.logger = logger;
         this.errorBuilder = errorBuilder;
         this.resourceRegistry = resourceRegistry;
         this.providerAccessResolver = providerAccessResolver;
         this.fetchImpl = fetchImpl;
         this.auditLogsResolver = auditLogsResolver;
+        this.metricsResolver = metricsResolver;
         this.resourceConfiguration = this.resourceRegistry.getResourceConfiguration(resourceType);
         const binding = this.resourceConfiguration.httpApiBinding;
         if (!binding) {
@@ -380,14 +391,37 @@ export class HttpApiResourceRepositoryBackendService {
             pagination,
         });
     }
-    restOperationSpec(member) {
+    /**
+     * The ONE place a REST_JSON read member becomes a compilable spec — and, since S3a (#331), the
+     * one place a CATALOGUE REFERENCE is resolved into one.
+     *
+     * Async because a reference loads the provider's catalogue, which is lazy by contract. All four
+     * call sites were already inside async methods, so this cost nothing at the boundary; what it
+     * buys is that a reference is resolved at the same chokepoint an inline spec is read, so no
+     * compiler and no caller ever learns which form the binding used.
+     *
+     * Resolved per call rather than cached here: the resolver memoizes the CATALOGUE (which is the
+     * expensive part), and caching the projected spec as well would put a second copy of provider
+     * state in every repository instance for no measurable gain.
+     */
+    async restOperationSpec(member) {
         if (this.binding.dialect !== HttpApiTransportDialect.REST_JSON)
             return undefined;
-        const spec = this.binding.operations[member];
-        if (!spec) {
+        const declaration = this.binding.operations[member];
+        if (!declaration) {
             throw new RestJsonTranslationRefusal(`This REST_JSON binding declares no '${member}' operation — the member is refused for this binding, never emulated.`);
         }
-        return spec;
+        if (!isHttpApiRestOperationReference(declaration))
+            return declaration;
+        if (typeof this.providerAccessResolver.resolveProviderOperation !== 'function') {
+            // Named rather than a TypeError three frames down: an operator can act on this sentence.
+            throw new RestJsonTranslationRefusal(`The '${member}' member references provider operation '${declaration.providerOperationId}', and the configured provider-access resolver `
+                + 'cannot load a provider catalogue. Wire the production resolver, or state the operation inline on the binding.');
+        }
+        const operation = await this.providerAccessResolver.resolveProviderOperation(this.binding.providerRef, declaration.providerOperationId, declaration.domain);
+        return projectProviderOperationOntoReadSurface({
+            reference: declaration, operation, providerRef: this.binding.providerRef, member,
+        });
     }
     async executeKeyAddressedRead(executionContext, resourceId) {
         let body;
@@ -404,7 +438,7 @@ export class HttpApiResourceRepositoryBackendService {
             return rows.length > 0 ? rows[0] : null;
         }
         else {
-            const spec = this.restOperationSpec('read');
+            const spec = await this.restOperationSpec('read');
             const compiled = compileRestJsonKeyAddressedRead(this.binding, spec, resourceId);
             const response = await this.readClient.restJsonReadOrNull(executionContext, compiled);
             if (response === null)
@@ -422,7 +456,7 @@ export class HttpApiResourceRepositoryBackendService {
         if (this.binding.dialect === HttpApiTransportDialect.ODOO_JSONRPC) {
             return this.expectRowArray(await this.readClient.odooExecuteKw(executionContext, compileOdooCollectionRead(this.binding, query)), "the Odoo 'search_read' result array");
         }
-        const spec = this.restOperationSpec(member === 'search' ? 'search' : 'list');
+        const spec = await this.restOperationSpec(member === 'search' ? 'search' : 'list');
         const compiled = compileRestJsonCollectionRead(this.binding, spec, query);
         const body = await this.readClient.restJson(executionContext, compiled);
         return this.expectRowArray(resolveHttpApiResultPath(body, compiled.resultPath), `the declared resultPath '${compiled.resultPath ?? '(body)'}'`);
@@ -442,7 +476,7 @@ export class HttpApiResourceRepositoryBackendService {
         // a paginated envelope needs a total, and an undeclared count operation must refuse before
         // any remote list call is spent.
         if (this.binding.dialect === HttpApiTransportDialect.REST_JSON) {
-            this.restOperationSpec('count');
+            await this.restOperationSpec('count');
         }
         const rows = await this.executeCollectionRead(executionContext, query, operation, searchMember ? 'search' : 'list');
         const total = await this.executeCountRead(executionContext, { ...query, pagination: undefined, sort: [] }, operation);
@@ -465,7 +499,7 @@ export class HttpApiResourceRepositoryBackendService {
             }
             return result;
         }
-        const spec = this.restOperationSpec('count');
+        const spec = await this.restOperationSpec('count');
         const compiled = compileRestJsonCollectionRead(this.binding, spec, { ...query, pagination: undefined });
         const body = await this.readClient.restJson(executionContext, compiled);
         const payload = resolveHttpApiResultPath(body, compiled.resultPath);
@@ -484,6 +518,14 @@ export class HttpApiResourceRepositoryBackendService {
      * never fail the read it observes. Emitted ONLY after a remote round-trip actually happened —
      * match-nothing short-circuits touch no external system and record nothing.
      *
+     * Every emission goes through {@link emitAuditObservation}, so a lost one lands on
+     * `audit_observation_dropped_total` instead of nowhere. The feature detection therefore decides an
+     * ARGUMENT rather than an early return: handing the seam `undefined` is how this site reports
+     * `SERVICE_UNAVAILABLE`, the loss shape that reaches no `_createAuditLog` and used to leave nothing
+     * behind at all. An early return would restore that silence — and the silence is expensive here,
+     * because ATTRIBUTION is the whole point of the row: without it the third party's own logs show
+     * one shared service principal and nothing anywhere resolves it back to a person.
+     *
      * Emission lives at the ADAPTER, deliberately inverting the services-tier precedent
      * (`recordPlatformDirectoryAccess`'s "the repository exists once per adapter" argument):
      * HTTP_API has exactly ONE adapter, and it is the only tier that witnesses EVERY remote access
@@ -495,27 +537,45 @@ export class HttpApiResourceRepositoryBackendService {
      * real initiating user carried through the shared service principal.
      */
     recordReadThroughAccess(executionContext, operationIdentifier, extras = {}) {
+        let emit;
         try {
             const auditLogsService = this.auditLogsResolver?.();
-            if (typeof auditLogsService?.logHttpApiReadThroughAccess !== 'function')
-                return;
-            const initiatorIds = executionContext.initiatorIds;
-            void auditLogsService.logHttpApiReadThroughAccess({
-                resourceType: String(this.resourceConfiguration.resourceIdentifier),
-                operationIdentifier: String(operationIdentifier),
-                providerRef: this.binding.providerRef,
-                remoteEntityRef: this.binding.entityRef,
-                dialect: this.binding.dialect,
-                initiatorUserId: initiatorIds?.userId,
-                executionType: executionContext.executionType,
-                organizationId: initiatorIds?.organizationId
-                    ?? executionContext.getContextResourceId?.('organizationId'),
-                ...extras,
-            }, executionContext)?.catch?.(() => undefined);
+            if (typeof auditLogsService?.logHttpApiReadThroughAccess === 'function') {
+                const initiatorIds = executionContext.initiatorIds;
+                const data = {
+                    resourceType: String(this.resourceConfiguration.resourceIdentifier),
+                    operationIdentifier: String(operationIdentifier),
+                    providerRef: this.binding.providerRef,
+                    remoteEntityRef: this.binding.entityRef,
+                    dialect: this.binding.dialect,
+                    initiatorUserId: initiatorIds?.userId,
+                    executionType: executionContext.executionType,
+                    organizationId: initiatorIds?.organizationId
+                        ?? executionContext.getContextResourceId?.('organizationId'),
+                    ...extras,
+                };
+                emit = () => auditLogsService.logHttpApiReadThroughAccess(data, executionContext);
+            }
         }
         catch {
-            // Observation only — never the reason a read fails.
+            // A thunk or a context accessor that throws leaves `emit` undefined, so the observation is
+            // reported as UNAVAILABLE rather than swallowed. The one thing this method may never do is
+            // fail the read it observes.
         }
+        emitAuditObservation({
+            observation: AuditObservationKind.HTTP_API_READ_THROUGH_ACCESS,
+            emit,
+            metricsResolver: this.metricsResolver,
+            logger: this.logger,
+            // Enough to name WHICH read went unrecorded — the resource, the operation and the remote
+            // entity are what a reviewer would reconstruct the missing attribution row from.
+            context: {
+                observedResourceType: String(this.resourceConfiguration.resourceIdentifier),
+                observedOperationIdentifier: String(operationIdentifier),
+                observedProviderRef: this.binding.providerRef,
+                observedRemoteEntityRef: this.binding.entityRef,
+            },
+        });
     }
     // ── D6 stance 6b: the declared external-erasure door ─────────────────────────
     /**
@@ -527,9 +587,16 @@ export class HttpApiResourceRepositoryBackendService {
      *
      * ## Identity-less by design
      *
-     * The internal context below is inert on this path, verified per consumer: translation runs
-     * `excludeContextualFilter` (an erasure must reach the subject's rows in EVERY tenant — the FK
-     * equality is the confinement), and `resolveAccess` ignores the context for SERVICE_PRINCIPAL.
+     * The internal context below is inert on this path for translation, verified per consumer:
+     * translation runs `excludeContextualFilter` (an erasure must reach the subject's rows in EVERY
+     * tenant — the FK equality is the confinement).
+     *
+     * It is NOT inert for access. This said `resolveAccess` "ignores the context for
+     * SERVICE_PRINCIPAL", and since #333 the context is what NAMES the owner whose account a
+     * tenant-owned or user-owned binding spends. An erasure sweep runs on an internal context, so a
+     * binding that declares anything but an application-owned connection refuses here rather than
+     * erasing under the wrong account — which is the fail-closed direction, and is why the refusal is
+     * worth meeting as an explicit error rather than a silent fallback.
      * Attribution lives in the `HTTP_API_EXTERNAL_ERASURE` audit row the calling effect emits;
      * discovery reads here deliberately do NOT emit read-through events (the read exists only to
      * address the deletion the event already records — double-recording would be noise with no