npm - @wildo-ai/saas-backend-lib - Versions diffs - 1.1.2 → 1.1.4 - Mend

@wildo-ai/saas-backend-lib 1.1.2 → 1.1.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1358) hide show

package/dist/esm/compliance/audit-trails/batches/audit-logs-archive.batch.backend.service.js CHANGED Viewed

@@ -559,12 +559,19 @@ export const auditLogsArchiveBatchService = createCustomBatchExecutionService({
  * - wildo-managed: `upload` builds `effectiveFileId = folderPath/fileName` and calls
  *   `resolveApplicationObjectKey(effectiveFileId, ctx)`; `getMetadata` calls that identical
  *   resolver with `file.fileId`.
- * - local-directory: `upload` composes segments `[applicationId, folderPath, leaf]`;
- *   `getMetadata` with no `storageRef` resolves `${applicationId}/${file.fileId}`.
+ * - local-directory: `upload` calls `composeStorageKey(fileId, ctx, options)`; `getMetadata` with
+ *   no `storageRef` calls that same method with `file.fileId` and no options.
  *
- * Both therefore land on the byte-identical key. The one coupling is
+ * Both therefore land on the byte-identical key — and since 2026-09-09 on the SAME key as each
+ * other, because both route through `application-storage-key.backend.utils`. The one coupling is
  * `includeApplicationId: true` on the upload — flip that and the probe would address a different
- * blob, so the two must move together (pinned by the key-parity test).
+ * blob, so the two must move together.
+ *
+ * Parity is pinned in each provider's OWN suite (upload, then `getMetadata` with no ref, against a
+ * real store). It is NOT pinned here: this batch's tests drive a fake provider that stores and
+ * probes `<folderPath>/<fileName>` by construction, so it agrees with itself whatever the real
+ * providers do. An earlier revision of this comment claimed "pinned by the key-parity test"; no
+ * such test existed.
  *
  * FAIL-SAFE DIRECTION: any failure — genuinely absent, or a transient storage fault — answers
  * `false`, i.e. "archive it". Re-archiving is harmless by construction (the artifact key is

package/dist/esm/compliance/audit-trails/batches/audit-logs-archive.batch.backend.service.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"audit-logs-archive.batch.backend.service.js","sourceRoot":"","sources":["../../../../../../src/compliance/audit-trails/batches/audit-logs-archive.batch.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsFG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAEpC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,gBAAgB,EAChB,qBAAqB,EACrB,oBAAoB,EACpB,cAAc,GACf,MAAM,uBAAuB,CAAC;AAI/B,OAAO,EACL,mBAAmB,EACnB,2BAA2B,GAC5B,MAAM,8EAA8E,CAAC;AACtF,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EACL,iCAAiC,GAElC,MAAM,4FAA4F,CAAC;AACpG,OAAO,EAAE,wCAAwC,EAAE,MAAM,gFAAgF,CAAC;AAC1I,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAMpF,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E,MAAM,UAAU,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEvC,2EAA2E;AAC3E,MAAM,oBAAoB,GAAG,eAAe,CAAC;AAE7C;;;;GAIG;AACH,MAAM,SAAS,GAAG,GAAG,CAAC;AAEtB;;;;;GAKG;AACH,MAAM,oBAAoB,GAAG,KAAK,CAAC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,MAAM,sBAAsB,GAAG,OAAO,CAAC;AAEvC;;;;;GAKG;AACH,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAEhC;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAE/B;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,2BAA2B,GAAG,EAAE,CAAC;AAEvC,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,2EAA2E;IAC3E,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IACtE,2EAA2E;IAC3E,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,QAAQ,EAAE;IAC/E;;;OAGG;IACH,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,QAAQ,EAAE;CACrF,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ;;;GAGG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,sDAAsD;IACtD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,+EAA+E;IAC/E,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,kFAAkF;IAClF,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC7C,gFAAgF;IAChF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC3C,iEAAiE;IACjE,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE;IAC9B,gDAAgD;IAChD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,6EAA6E;IAC7E,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C;;;OAGG;IACH,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C,kFAAkF;IAClF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvC,kEAAkE;IAClE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxC,iEAAiE;IACjE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxC,iFAAiF;IACjF,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,2EAA2E;IAC3E,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACpC,CAAC,CAAC;AAaH;;;;;;;;GAQG;AACH,SAAS,WAAW,CAAC,GAAY;IAC/B,OAAO,mBAAmB,CAAC,GAAG,CAAC,CAAC;AAClC,CAAC;AAED,oDAAoD;AACpD,SAAS,aAAa,CAAC,CAAO;IAC5B,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,OAAO,CAAC,CAAO,EAAE,CAAS;IACjC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC;AAChD,CAAC;AAED,qDAAqD;AACrD,SAAS,MAAM,CAAC,QAAc;IAC5B,OAAO,QAAQ,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;GAKG;AACH,SAAS,uBAAuB,CAC9B,QAA4B,EAC5B,gBAAyC;IAEzC,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAClD,MAAM,UAAU,GAAG,gBAAgB,CAAC,MAAM,EAAE,UAAU,EAAE,gBAAgB,CAAC;IACzE,OAAO,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;AACjE,CAAC;AAED,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E,MAAM,CAAC,MAAM,4BAA4B,GAGrC,iCAAiC,CAAC;IACpC,KAAK,EAAE,gCAAgC;IACvC,MAAM,EAAE,iCAAiC;IACzC,oBAAoB,EAAE;QACpB,4EAA4E;QAC5E,4EAA4E;QAC5E,2EAA2E;QAC3E,2EAA2E;QAC3E,2BAA2B;QAC3B,IAAI,EAAE,wCAAwC,CAAC,IAAI;QACnD,mBAAmB,EAAE,wCAAwC,CAAC,mBAAmB;QACjF,YAAY,EAAE,wCAAwC,CAAC,YAAY;QACnE,iBAAiB,EAAE,wCAAwC,CAAC,cAAc;KAC3E;IACD,mBAAmB,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;QACjC,gBAAgB,EAAE,GAAG,CAA0B,kBAAkB,CAAC,gBAAgB,CAAC;QACnF,iBAAiB,EAAE,GAAG,CAAkC,kBAAkB,CAAC,iBAAiB,CAAC;KAC9F,CAAC;IACF,QAAQ,EAAE,KAAK,EACb,KAAK,EACL,EACE,MAAM,EACN,oBAAoB,EACpB,uBAAuB,EACvB,YAAY,GACb,EACD,EAAE;QACF,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;QACjD,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,uBAAuB,CAAC,CAAC;QAC7D,MAAM,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,GAAG,YAAY,CAAC;QAE7D,8EAA8E;QAC9E,4EAA4E;QAC5E,2EAA2E;QAC3E,oEAAoE;QACpE,yBAAyB;QACzB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,gBAAgB,GAAkB,IAAI,CAAC;QAC3C,IAAI,SAAS,GAAkB,IAAI,CAAC;QACpC,IAAI,iBAAiB,GAAG,KAAK,CAAC;QAC9B,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,IAAI,iBAAiB,GAAG,CAAC,CAAC;QAC1B,IAAI,cAAc,GAAG,CAAC,CAAC;QACvB,IAAI,eAAe,GAAG,CAAC,CAAC;QACxB,IAAI,iBAAiB,GAAG,CAAC,CAAC;QAC1B,IAAI,eAAe,GAAG,CAAC,CAAC;QACxB,IAAI,gBAAgB,GAAG,CAAC,CAAC;QAEzB,MAAM,OAAO,GAAG,CAAC,QAAuB,IAAI,EAA+B,EAAE,CAAC,CAAC;YAC7E,MAAM;YACN,OAAO;YACP,gBAAgB;YAChB,SAAS;YACT,iBAAiB;YACjB,YAAY;YACZ,iBAAiB;YACjB,cAAc;YACd,eAAe;YACf,iBAAiB;YACjB,eAAe;YACf,gBAAgB;YAChB,KAAK;YACL,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;SACnC,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,sEAAsE;YACtE,0EAA0E;YAC1E,MAAM,wBAAwB,GAAG,uBAAuB,CAAC,KAAK,CAAC,wBAAwB,EAAE,gBAAgB,CAAC,CAAC;YAC3G,IAAI,wBAAwB,KAAK,SAAS,EAAE,CAAC;gBAC3C,MAAM,CAAC,IAAI,CAAC,uFAAuF,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;gBACjH,OAAO,OAAO,EAAE,CAAC;YACnB,CAAC;YACD,OAAO,GAAG,IAAI,CAAC;YACf,gBAAgB,GAAG,wBAAwB,CAAC;YAE5C,0EAA0E;YAC1E,2CAA2C;YAC3C,IAAI,CAAC,iBAAiB,CAAC,YAAY,EAAE,EAAE,CAAC;gBACtC,MAAM,CAAC,IAAI,CAAC,iGAAiG,EAAE;oBAC7G,MAAM;oBACN,gBAAgB;iBACjB,CAAC,CAAC;gBACH,OAAO,OAAO,EAAE,CAAC;YACnB,CAAC;YACD,iBAAiB,GAAG,IAAI,CAAC;YACzB,iEAAiE;YACjE,gDAAgD;YAChD,MAAM,eAAe,GAAG,iBAAiB,CAAC,eAAe,CAAC;gBACxD,mBAAmB,CAAC,aAAa;gBACjC,mBAAmB,CAAC,eAAe;aACpC,CAAC,CAAC;YAEH,mEAAmE;YACnE,uEAAuE;YACvE,mEAAmE;YACnE,kEAAkE;YAClE,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,SAAS,GAAG,wBAAwB,GAAG,UAAU,CAAC,CAAC;YAC5E,SAAS,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;YAClC,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YACtD,YAAY,GAAG,IAAI,CAAC,GAAG,CACrB,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,oBAAoB,IAAI,qBAAqB,EAAE,CAAC,CAAC,EAChE,iBAAiB,CAClB,CAAC;YACF,uFAAuF;YACvF,sFAAsF;YACtF,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAC1B,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,yBAAyB,IAAI,2BAA2B,EAAE,CAAC,CAAC,EAC3E,IAAI,CAAC,GAAG,CAAC,iBAAiB,GAAG,YAAY,EAAE,CAAC,CAAC,CAC9C,CAAC;YAEF,0EAA0E;YAC1E,4EAA4E;YAC5E,iDAAiD;YACjD,EAAE;YACF,oEAAoE;YACpE,gEAAgE;YAChE,wEAAwE;YACxE,2CAA2C;YAC3C,4EAA4E;YAC5E,wEAAwE;YACxE,6EAA6E;YAC7E,wEAAwE;YACxE,+EAA+E;YAC/E,oEAAoE;YACpE,MAAM,gBAAgB,GAAG,MAAM,uBAAuB,CAAC,oCAAoC,CAAC;gBAC1F,YAAY,EAAE,gBAAgB,CAAC,UAAU;gBACzC,mBAAmB,EAAE,qBAAqB,CAAC,IAAI;gBAC/C,+BAA+B,EAAE,IAAI,GAAG,EAAE;gBAC1C,YAAY,EAAE,IAAI;gBAClB,cAAc,EAAE;oBACd,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,mBAAmB,EAAE,oBAAoB,CAAC,WAAW,EAAE;iBACzG;aACF,CAAC,CAAC;YACH,MAAM,SAAS,GAAG,oBAAoB,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC;YAE3G,MAAM,aAAa,GAAG,gBAAgB,CAAC,aAAa,IAAI,gBAAgB,CAAC,aAAa,CAAC;YAEvF,0FAA0F;YAC1F,iCAAiC;YACjC,EAAE;YACF,sCAAsC;YACtC,yFAAyF;YACzF,sEAAsE;YACtE,yFAAyF;YACzF,4FAA4F;YAC5F,0FAA0F;YAC1F,MAAM,cAAc,GAAG,YAAY,CAAC;YACpC,MAAM,YAAY,GAAG,YAAY,GAAG,iBAAiB,CAAC,CAAC,YAAY;YACnE,MAAM,OAAO,GAAa,EAAE,CAAC;YAC7B,KAAK,IAAI,CAAC,GAAG,YAAY,GAAG,CAAC,EAAE,CAAC,IAAI,cAAc,EAAE,CAAC,IAAI,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC5E,KAAK,IAAI,CAAC,GAAG,YAAY,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAE/D,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACxB,MAAM,WAAW,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC3C,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;gBAC1C,MAAM,WAAW,GAAG,CAAC,IAAI,cAAc,CAAC;gBAExC,IAAI,WAAW,EAAE,CAAC;oBAChB,mFAAmF;oBACnF,4EAA4E;oBAC5E,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC;wBACzC,eAAe;wBACf,gBAAgB;wBAChB,GAAG,EAAE,MAAM,CAAC,WAAW,CAAC;qBACzB,CAAC,CAAC;oBACH,IAAI,MAAM;wBAAE,SAAS;gBACvB,CAAC;gBAED,cAAc,IAAI,CAAC,CAAC;gBAEpB,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,MAAM,oBAAoB,CAAC,SAAS,EAAE,gBAAgB,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;gBAC/G,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACzB,wFAAwF;oBACxF,0FAA0F;oBAC1F,oFAAoF;oBACpF,4DAA4D;oBAC5D,SAAS;gBACX,CAAC;gBACD,IAAI,SAAS,EAAE,CAAC;oBACd,gBAAgB,IAAI,CAAC,CAAC;oBACtB,oEAAoE;oBACpE,wEAAwE;oBACxE,qEAAqE;oBACrE,0DAA0D;oBAC1D,MAAM,CAAC,IAAI,CACT,iGAAiG;0BAC/F,kGAAkG,EACpG,EAAE,GAAG,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,sBAAsB,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE,CACpF,CAAC;gBACJ,CAAC;gBAED,MAAM,oBAAoB,CAAC;oBACzB,eAAe;oBACf,gBAAgB;oBAChB,aAAa;oBACb,WAAW;oBACX,SAAS;oBACT,UAAU,EAAE,MAAM;oBAClB,OAAO;oBACP,SAAS;iBACV,CAAC,CAAC;gBAEH,eAAe,IAAI,CAAC,CAAC;gBACrB,eAAe,IAAI,OAAO,CAAC,MAAM,CAAC;gBAClC,IAAI,WAAW,EAAE,CAAC;oBAChB,iBAAiB,IAAI,CAAC,CAAC;oBACvB,oFAAoF;oBACpF,uFAAuF;oBACvF,gCAAgC;oBAChC,MAAM,CAAC,IAAI,CAAC,kGAAkG,EAAE;wBAC9G,GAAG,EAAE,MAAM,CAAC,WAAW,CAAC;wBACxB,WAAW,EAAE,OAAO,CAAC,MAAM;qBAC5B,CAAC,CAAC;gBACL,CAAC;gBACD,QAAQ,CAAC,2BAA2B,EAAE;oBACpC,GAAG,EAAE,MAAM,CAAC,WAAW,CAAC;oBACxB,WAAW,EAAE,OAAO,CAAC,MAAM;oBAC3B,SAAS;oBACT,UAAU,EAAE,WAAW;iBACxB,CAAC,CAAC;YACL,CAAC;YAED,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE;gBAC3C,MAAM;gBACN,gBAAgB;gBAChB,SAAS;gBACT,YAAY;gBACZ,iBAAiB;gBACjB,cAAc;gBACd,eAAe;gBACf,iBAAiB;gBACjB,eAAe;gBACf,gBAAgB;aACjB,CAAC,CAAC;YAEH,OAAO,OAAO,EAAE,CAAC;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,yEAAyE;YACzE,0EAA0E;YAC1E,0EAA0E;YAC1E,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;YACnC,MAAM,CAAC,KAAK,EAAE,CAAC,gFAAgF,EAAE;gBAC/F,GAAG,2BAA2B,CAAC,KAAK,CAAC;gBACrC,MAAM;aACP,CAAC,CAAC;YACH,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;CACF,CAAC,CAAC;AAEH,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,KAAK,UAAU,qBAAqB,CAAC,IAIpC;IACC,MAAM,EAAE,eAAe,EAAE,gBAAgB,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IACxD,IAAI,CAAC;QACH,MAAM,eAAe,CAAC,WAAW,CAC/B;YACE,MAAM,EAAE,GAAG,oBAAoB,kBAAkB,GAAG,OAAO;YAC3D,eAAe,EAAE,SAAS;YAC1B,UAAU,EAAE,SAAS;SAC0C,EACjE,gBAAgB,CACjB,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,SAAwF,EACxF,gBAAoH,EACpH,WAAiB,EACjB,SAAe;IAEf,MAAM,WAAW,GAAG,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,CAAC;IACzE,MAAM,OAAO,GAAqB,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,4EAA4E;IAC5E,IAAI,MAAM,GAAgD,IAAI,CAAC;IAE/D,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,IAAI,oBAAoB,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC;QAC3D,yFAAyF;QACzF,+DAA+D;QAC/D,MAAM,MAAM,GAA4B,MAAM,KAAK,IAAI;YACrD,CAAC,CAAC,WAAW;YACb,CAAC,CAAC;gBACA,IAAI,EAAE;oBACJ,WAAW;oBACX;wBACE,GAAG,EAAE;4BACH,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,EAAE;4BACxC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE;yBAClE;qBACF;iBACF;aACF,CAAC;QAEJ,2FAA2F;QAC3F,0FAA0F;QAC1F,yFAAyF;QACzF,0FAA0F;QAC1F,oFAAoF;QACpF,2FAA2F;QAC3F,4BAA4B;QAC5B,MAAM,WAAW,GAAkE;YACjF,IAAI,EAAE,CAAC;YACP,KAAK,EAAE,SAAS;YAChB,IAAI,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE;SACnC,CAAC;QACF,MAAM,MAAM,GAAG,CAAC,MAAM,SAAS,CAAC,IAAI,CAAC,gBAAgB,EAAE,MAAM,EAAE;YAC7D,SAAS,EAAE,IAAI;YACf,2EAA2E;YAC3E,sDAAsD;YACtD,uBAAuB,EAAE,IAAI;YAC7B,WAAW;SACZ,CAAC,CAAiC,CAAC;QAEpC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QAC/B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM;QAE7B,MAAM,gBAAgB,GAAG,MAAM,CAAC;QAEhC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,uFAAuF;YACvF,uFAAuF;YACvF,kFAAkF;YAClF,qFAAqF;YACrF,aAAa;YACb,MAAM,GAAG,GAAG,MAAM,CAAE,GAA0C,CAAC,OAAO;mBAChE,GAAwB,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;YAC1C,IAAI,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YACnC,IAAI,OAAO,CAAC,MAAM,IAAI,sBAAsB,EAAE,CAAC;gBAC7C,SAAS,GAAG,IAAI,CAAC;gBACjB,MAAM;YACR,CAAC;YACD,IAAI,GAAG;gBAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACvB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAElB,sFAAsF;YACtF,2FAA2F;YAC3F,+DAA+D;YAC/D,MAAM,YAAY,GAAG,GAAG,CAAC,SAAS,YAAY,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;YACrG,MAAM,UAAU,GAAI,GAA6B,CAAC,OAAO,CAAC;YAC1D,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;gBAC5E,MAAM,GAAG,EAAE,SAAS,EAAE,YAAY,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;YAC5D,CAAC;QACH,CAAC;QACD,IAAI,SAAS;YAAE,MAAM;QAErB,4FAA4F;QAC5F,2FAA2F;QAC3F,0EAA0E;QAC1E,IACE,MAAM,KAAK,IAAI;YACf,gBAAgB,KAAK,IAAI;YACzB,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,gBAAgB,CAAC,SAAS,CAAC,OAAO,EAAE;YACnE,MAAM,CAAC,OAAO,KAAK,gBAAgB,CAAC,OAAO,EAC3C,CAAC;YACD,MAAM;QACR,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,GAAG,SAAS;YAAE,MAAM;IACrC,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAChC,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,oBAAoB,CAAC,IASnC;IACC,MAAM,EAAE,eAAe,EAAE,gBAAgB,EAAE,aAAa,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;IAC1H,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;IAEhC,MAAM,OAAO,GAAG;QACd,aAAa,EAAE,CAAU;QACzB,IAAI,EAAE,mBAA4B;QAClC,wEAAwE;QACxE,6EAA6E;QAC7E,mEAAmE;QACnE,aAAa,EAAE,aAAa,IAAI,IAAI;QACpC,YAAY,EAAE,GAAG;QACjB,WAAW,EAAE,WAAW,CAAC,WAAW,EAAE;QACtC,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;QAClC,UAAU;QACV,WAAW,EAAE,OAAO,CAAC,MAAM;QAC3B,SAAS;QACT,OAAO;KACR,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;IAE7D,MAAM,eAAe,CAAC,MAAM,CAC1B,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC;IACvB,6EAA6E;IAC7E,2EAA2E;IAC3E,iEAAiE;IACjE,UAAU,EAAE,EACZ,kBAAkB,EAClB,MAAM,CAAC,UAAU,EACjB,gBAAgB,EAChB;QACE,UAAU,EAAE,oBAAoB;QAChC,QAAQ,EAAE,iBAAiB,GAAG,OAAO;QACrC,oBAAoB,EAAE,IAAI;KAC3B,CACF,CAAC;AACJ,CAAC","sourcesContent":["/*\n Audit-Log Archival Batch (audit Phase 5 / F1)\n \n Periodic CRON custom batch that EXPORTS aged audit records to durable off-DB\n * archival artifacts in file storage. It is the operator-tunable retention /\n * archival mechanism for the compliance audit trail.\n \n --------------------------------------------------------------------------\n * Archival, NOT deletion — audit logs are immutable\n * --------------------------------------------------------------------------\n * `AUDIT_LOGS` is immutable by invariant (G5): its `coreOperations` are\n * `READ \| LIST \| SEARCH \| CREATE` — no `UPDATE`, no `DELETE`. This batch\n * therefore NEVER removes audit records. It COPIES records older than the\n * operator-configured horizon (`AppConfiguration.auditTrail.archiveAfterDays`)\n * into durable JSON artifacts in file storage, one artifact per UTC day-window,\n * while the original rows remain in the always-on `AUDIT_LOGS` store (and, when\n * configured, in the append-only immudb tamper-proof ledger). The archive is an\n * additional off-DB compliance/DR copy — a portable artifact an auditor can be\n * handed — not a prune. (The value trade-off is explicit: it does NOT bound DB\n * growth. A future delete-after-archive step, if compliance demands\n * data-minimisation, would build on top of this — but that requires relaxing\n * G5 and is out of scope here.)\n \n --------------------------------------------------------------------------\n * OPT-IN\n * --------------------------------------------------------------------------\n * Setting `auditTrail.archiveAfterDays` IS the opt-in. When it is `undefined`\n * (the compliance-safe default) the batch no-ops: nothing is archived and every\n * record is retained in the primary store indefinitely. The batch is registered\n * unconditionally (like the reconcile / delivery drains) so a mis-set flag can\n * never orphan the schedule; the no-op is decided at TICK time from live config.\n \n --------------------------------------------------------------------------\n * Idempotency — stateless deterministic overwrite (no checkpoint store)\n * --------------------------------------------------------------------------\n * The archive is keyed by UTC day. Each day-window writes to a DETERMINISTIC\n * storage key (`audit-archive/[applicationId/]audit-archive-YYYY-MM-DD.json`)\n * via the `fileName` upload option, which the storage providers use as the blob\n * leaf — so re-uploading a window OVERWRITES it. A fully-past day's audit rows\n * are stable (audit events are created at operation time; nothing back-dates\n * into a closed day), so a re-write produces identical content. This makes the\n * batch idempotent WITHOUT any high-water-mark / checkpoint state: unlike the\n * reconcile batch (which stores its mark in immudb), archival must work even\n * when immudb is not configured, so it deliberately keeps ZERO cross-run state.\n \n Each tick (re)writes only the trailing {@link DEFAULT_LOOKBACK_DAYS} archivable\n * day-windows. On the daily cron exactly one new day crosses the horizon per\n * tick; the small look-back re-writes the last couple of crossed days so a\n * single missed tick self-heals on the next run. The (bounded) cost of the\n * re-write is re-reading a day or two of audit rows — cheap for a nightly sweep.\n \n Missed windows self-heal WITHOUT cross-run state: beyond the look-back, each tick sweeps a\n * bounded trailing span ({@link DEFAULT_BACKFILL_PROBE_DAYS}) and asks storage whether each day's\n * deterministic artifact already exists, archiving only the days that are missing. Progress is\n * therefore DERIVED FROM THE ARTIFACTS — the one durable record that always exists and that does\n * not require immudb, so the \"zero cross-run state\" property above is preserved rather than traded\n * away. A day repaired this way is logged as a warning and counted in `windowsBackfilled`: the\n * sweep fixes the gap, but a recurring count means ticks are being missed and an operator should\n * know. Previously such a day stayed missing forever, because nothing recorded that it was skipped.\n \n Cold-start backlog beyond the probe span: still an explicit operator gesture — trigger the batch\n * once with a `lookbackDaysOverride` wide enough to cover the history (e.g. the full\n * `archiveAfterDays` span). That remains the way to seed archives for an app that enabled archival\n * after it already had aged data.\n \n --------------------------------------------------------------------------\n * Cross-org, anchoring, failure containment\n * --------------------------------------------------------------------------\n * Scope-anchored @ APPLICATION: the batch archives EVERY org's aged rows into a\n * single per-day artifact (each record carries its own `organizationId`), so the\n * read bypasses the contextual org filter (`excludeContextualFilter: true`) —\n * mirroring the reconcile batch. Per-org artifact partitioning is a deliberate\n * future enhancement, not a v1 requirement — see the scaling note on\n * {@link MAX_RECORDS_PER_WINDOW} for WHY (cross-org amplifies the per-artifact\n * size) and HOW to lift the limitation (stream the upload + per-org partitioning).\n \n Never-throws contract: archival must not crash the batch runner (F7 — audit\n * side-channels are independent + non-blocking). A failure (storage outage, DB\n * read error) is LOGGED and yields a partial summary with `error` set; the next\n * scheduled tick retries the same trailing windows (idempotent overwrite makes\n * the retry safe).\n \n @see base-classes/services/batches/engine-custom-batch-manifests.ts\n * (`ENGINE_AUDIT_LOGS_ARCHIVE_BATCH_MANIFEST` — the ref + cron single source).\n * @see compliance/audit-trails/batches/immudb-audit-reconcile.batch.backend.service.ts\n * (the sibling audit cron this mirrors for context creation + cross-org scan).\n /\n\nimport { Readable } from 'stream';\nimport { randomUUID } from 'crypto';\n\nimport { z } from 'zod';\nimport {\n CoreResourceType,\n CoreResourceOperation,\n ResourcePrimaryScope,\n CORE_APP_ROLES,\n} from '@wildo-ai/saas-models';\nimport type {\n AuditableEvent,\n} from '@wildo-ai/saas-models';\nimport {\n describeCaughtError,\n projectCaughtErrorLogFields,\n} from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { FileStorageAccepted } from '@wildo-ai/zod-decorators';\nimport {\n createCustomBatchExecutionService,\n type BatchesCronjobsCustomExecution_Service,\n} from '~wildo-backend-lib/base-classes/services/batches/batches-cronjobs-custom-execution.service';\nimport { ENGINE_AUDIT_LOGS_ARCHIVE_BATCH_MANIFEST } from '~wildo-backend-lib/base-classes/services/batches/engine-custom-batch-manifests';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport type { FileStorageRouterBackendService } from '~wildo-backend-lib/files/storage/file-storage-router.backend.service';\nimport type { RepositoriesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/repositories/repositories-registry-handler.backend.service';\nimport type { ExecutionContextCreatorBackendService } from '~wildo-backend-lib/runtime/services/execution-context-creator.backend.service';\n\n// ═══════════════════════════════════════════════════════════════════════════\n// Tuning constants\n// ═══════════════════════════════════════════════════════════════════════════\n\nconst MS_PER_DAY = 24 60 * 60 * 1000;\n\n/** Folder namespace for archival artifacts within the storage provider. /\nconst AUDIT_ARCHIVE_FOLDER = 'audit-archive';\n\n/\n Per-page limit for the day-window AUDIT_LOGS scan. Hard-capped at 100 by the\n * repository (`_doList` clamps with `Math.min(100, …)`), so a larger value is\n * silently clamped. Paging stops when a page returns fewer than this.\n /\nconst PAGE_SIZE = 100;\n\n/\n Defensive per-window page ceiling — guards against an unbounded loop if a\n * window's row count somehow never decreases. At {@link PAGE_SIZE} = 100 and\n * {@link MAX_RECORDS_PER_WINDOW} = 100_000 the record cap is hit first; this is\n * the belt-and-braces backstop.\n /\nconst MAX_PAGES_PER_WINDOW = 2_000;\n\n/\n Hard cap on records accumulated into a SINGLE day-window artifact.\n \n WHAT IT PROTECTS: the batch holds a whole window's rows in memory (`records[]`)\n * to serialise ONE JSON artifact per day, so without a cap a huge day would OOM\n * the batch process. On the cap being hit we archive the first\n * {@link MAX_RECORDS_PER_WINDOW}, flag the window `truncated`, and emit a\n * `logger.warn` — the day's artifact is then INCOMPLETE, but NO audit data is\n * lost: the authoritative rows always remain in `AUDIT_LOGS` (+ immudb).\n \n ─────────────────────────────────────────────────────────────────────────────\n * KNOWN LIMITATION + HOW TO REMOVE IT (deferred 2026-07-04 — revisit only when a\n * real deployment's volume actually triggers it; do NOT pre-build speculatively)\n * ─────────────────────────────────────────────────────────────────────────────\n * The cross-org design (ONE artifact per day for ALL orgs — see the file header)\n * multiplies what lands in the buffer, so a high-volume multi-tenant deployment\n * can exceed this cap and CHRONICALLY truncate. The cap is a SYMPTOM; the ROOT\n * CAUSE is buffering the whole artifact in memory before a single sized upload.\n * Two orthogonal, COMPOSABLE fixes (do both to eliminate it, not just soften it):\n \n (1) STREAM THE UPLOAD — the true root fix. Replace `records[]` +\n * `Buffer.from(JSON.stringify(...))` + sized `provider.upload(...)` with a\n * `Readable` that pages the repo and emits NDJSON row-by-row into a\n * size-OPTIONAL streaming upload. Memory then stays bounded to one page\n * (~{@link PAGE_SIZE} rows) regardless of window size, and this cap is\n * DROPPED entirely. Enabler: `IFileStorageProvider.upload()` currently\n * requires `size: number`; add a size-optional streaming path —\n * MinIO/S3 `putObject` multiparts automatically when size is unknown, and\n * the local-directory provider just pipes `stream → writeStream` (relax the\n * `validateSize` policy gate for internal system artifacts). This touches\n * shared engine surface (the provider interface + both providers + tests).\n * Cheaper no-interface-change variant: spool the window to a temp file,\n * `stat` its size, then stream-upload from the file (bounded memory via\n * disk instead of RAM, at the cost of a temp-file lifecycle + writable disk).\n \n (2) PER-ORG PARTITIONING — removes the cross-org amplification AND is the\n * compliance-correct shape. Emit one artifact per `(org, day)` (+ an\n * APPLICATION-scoped artifact for no-org / app-level events) instead of one\n * cross-org artifact; enumerate the distinct `organizationId`s in the window\n * via a `distinct`/aggregation, then archive per org. Each artifact becomes\n * one org's day (smaller), and each tenant's trail is an independently\n * retrievable/erasable artifact — what GDPR right-to-erasure + data\n * residency actually want. Cost: more artifacts (org-count × days).\n \n REJECTED as weakest: per-HOUR windowing — only makes cap-hits rarer (24× more\n * files) without addressing the root cause; a pathological hour still truncates.\n \n DONE (2026-08-05), no longer a rider: {@link collectWindowRecords} now uses KEYSET\n * paging on the `(createdAt, eventId)` tuple, closing the boundary-tie SKIP that offset\n * paging over the non-unique `createdAt` could not. The sibling\n * `immudb.audit-reconcile` batch pages the same way. Only the cap below remains.\n /\nconst MAX_RECORDS_PER_WINDOW = 100_000;\n\n/\n Trailing day-windows (re)written each steady-state tick. On a daily cron one\n * new day crosses the horizon per tick; re-writing the last two crossed days\n * self-heals a single missed tick via idempotent overwrite. Overridable per-run\n * (`lookbackDaysOverride`) for cold-start backfills.\n /\nconst DEFAULT_LOOKBACK_DAYS = 2;\n\n/\n Absolute ceiling on day-windows processed in one run — bounds a backfill\n * invocation. Matches the max `archiveAfterDays` (2555 ≈ 7y) so a full-history\n * backfill fits one run; most historical days are empty and skipped cheaply.\n /\nconst MAX_LOOKBACK_DAYS = 2555;\n\n/\n How far BEYOND the look-back the tick probes for MISSING artifacts (the gap-healing sweep).\n \n The look-back above unconditionally re-writes the newest few archivable days. Anything older\n * that a tick missed used to stay missing forever: the batch keeps zero cross-run state, so\n * nothing recorded that a day was skipped, and an operator had to notice and run an explicit\n * `lookbackDaysOverride` backfill.\n \n Progress is instead DERIVED FROM THE ARTIFACTS THEMSELVES — the only durable record that is\n * already guaranteed to exist, and the one that keeps working when immudb is not configured (the\n * reason this batch has no checkpoint store; see the header). For each day in this trailing span\n * the tick asks storage whether the day's deterministic artifact key exists, and archives only the\n * days that are missing.\n \n Bounded on purpose: a probe is one cheap metadata lookup, but an unbounded sweep would grow with\n * the app's whole history on every nightly tick. Gaps older than this span remain an explicit\n * `lookbackDaysOverride` operation, exactly as before.\n /\nconst DEFAULT_BACKFILL_PROBE_DAYS = 90;\n\n// ═══════════════════════════════════════════════════════════════════════════\n// Input / Output schemas\n// ═══════════════════════════════════════════════════════════════════════════\n\n/\n Optional per-tick overrides for manual `runOnce` triggers. Both narrow the\n * batch for one-shot operator gestures without touching app config.\n /\nexport const AuditLogsArchiveBatchInputSchema = z.object({\n /* One-shot archival horizon override (days). Falls back to app config. /\n archiveAfterDaysOverride: z.number().int().min(1).max(2555).optional(),\n /* One-shot look-back width override (days) — for cold-start backfills. /\n lookbackDaysOverride: z.number().int().min(1).max(MAX_LOOKBACK_DAYS).optional(),\n /\n One-shot width override (days) for the missing-artifact probe sweep that runs BEYOND the\n * look-back. `0` disables the sweep for this run (pure look-back behaviour).\n /\n backfillProbeDaysOverride: z.number().int().min(0).max(MAX_LOOKBACK_DAYS).optional(),\n}).strict();\nexport type AuditLogsArchiveBatchInput = z.infer<typeof AuditLogsArchiveBatchInputSchema>;\n\n/\n Run summary covering the happy path, the two no-op paths (disabled / no\n * storage), and the failure path.\n /\nexport const AuditLogsArchiveBatchOutputSchema = z.object({\n /* Wall-clock ISO timestamp when the body started. /\n tickAt: z.string().datetime(),\n /* Whether an archival horizon was configured/overridden (opt-in resolved). /\n enabled: z.boolean(),\n /* Effective archival horizon applied this tick (days), or null when disabled. /\n archiveAfterDays: z.number().int().nullable(),\n /* ISO cutoff — records with `createdAt < horizonAt` were archival-eligible. /\n horizonAt: z.string().datetime().nullable(),\n /* Whether a storage provider was configured (false ⇒ no-op). /\n storageConfigured: z.boolean(),\n /* Trailing day-windows considered this run. /\n lookbackDays: z.number().int().min(0),\n /* Width (days) of the missing-artifact probe sweep beyond the look-back. /\n backfillProbeDays: z.number().int().min(0),\n /\n Days in the probe span whose artifact was ABSENT and were therefore archived by the sweep.\n * A persistently non-zero value means ticks are being missed — surfaced rather than silent.\n /\n windowsBackfilled: z.number().int().min(0),\n /* Day-windows scanned (some may have had zero rows and produced no artifact). /\n windowsScanned: z.number().int().min(0),\n /* Day-windows that produced (overwrote) an archival artifact. /\n windowsArchived: z.number().int().min(0),\n /* Total audit records written across all artifacts this run. /\n recordsArchived: z.number().int().min(0),\n /* Windows that hit {@link MAX_RECORDS_PER_WINDOW} and were archived partial. /\n truncatedWindows: z.number().int().min(0),\n /* Tick-level failure message — non-null only when a scan/upload threw. /\n error: z.string().nullable(),\n durationMs: z.number().int().min(0),\n});\nexport type AuditLogsArchiveBatchOutput = z.infer<typeof AuditLogsArchiveBatchOutputSchema>;\n\n// ═══════════════════════════════════════════════════════════════════════════\n// Internals\n// ═══════════════════════════════════════════════════════════════════════════\n\n/* Shape the paginated AUDIT_LOGS `list` resolves to. /\ninterface AuditLogsListPage {\n data: AuditableEvent[];\n pagination?: { totalPages?: number };\n}\n\n/\n Human-readable one-line message for the batch OUTPUT's `error` field (the\n * output schema types it as a plain `string`).\n \n Delegates to the shared {@link describeCaughtError} rather than an inline\n * `instanceof Error` ternary, which would persist every structured\n * `WildoError_Backend` as the literal `'[object Object]'`. The log line pairs\n * this with {@link projectCaughtErrorLogFields} for the full queryable detail.\n /\nfunction formatError(err: unknown): string {\n return describeCaughtError(err);\n}\n\n/* Midnight-UTC start of the day containing `d`. /\nfunction startOfUtcDay(d: Date): Date {\n return new Date(Date.UTC(d.getUTCFullYear(), d.getUTCMonth(), d.getUTCDate()));\n}\n\nfunction addDays(d: Date, n: number): Date {\n return new Date(d.getTime() + n MS_PER_DAY);\n}\n\n/** `YYYY-MM-DD` key for a midnight-UTC day-start. /\nfunction dayKey(dayStart: Date): string {\n return dayStart.toISOString().slice(0, 10);\n}\n\n/\n Resolve the effective archival horizon (days). First non-undefined wins:\n * per-tick override → `AppConfiguration.auditTrail.archiveAfterDays` → none\n * (undefined ⇒ archival disabled). Read at TICK time so an in-place config\n * change takes effect on the next run without a redeploy.\n /\nfunction resolveArchiveAfterDays(\n override: number \| undefined,\n appConfigService: AppConfigurationService,\n): number \| undefined {\n if (typeof override === 'number') return override;\n const fromConfig = appConfigService.config?.auditTrail?.archiveAfterDays;\n return typeof fromConfig === 'number' ? fromConfig : undefined;\n}\n\n// ═══════════════════════════════════════════════════════════════════════════\n// Batch Service\n// ═══════════════════════════════════════════════════════════════════════════\n\nexport const auditLogsArchiveBatchService: BatchesCronjobsCustomExecution_Service<\n typeof AuditLogsArchiveBatchInputSchema,\n typeof AuditLogsArchiveBatchOutputSchema\n> = createCustomBatchExecutionService({\n input: AuditLogsArchiveBatchInputSchema,\n output: AuditLogsArchiveBatchOutputSchema,\n batchCronjob_Context: {\n // Scope-anchored @ APPLICATION: cross-org archival, no honest single target\n // resource (mirrors the reconcile / SIEM anchoring). `cronJobExpression` is\n // what actually SCHEDULES the run (sourced from the manifest so schedule +\n // spec cross-validation share ONE literal); omitting it would register the\n // batch but never fire it.\n kind: ENGINE_AUDIT_LOGS_ARCHIVE_BATCH_MANIFEST.kind,\n operationIdentifier: ENGINE_AUDIT_LOGS_ARCHIVE_BATCH_MANIFEST.operationIdentifier,\n primaryScope: ENGINE_AUDIT_LOGS_ARCHIVE_BATCH_MANIFEST.primaryScope,\n cronJobExpression: ENGINE_AUDIT_LOGS_ARCHIVE_BATCH_MANIFEST.cronExpression,\n },\n resolveDependencies: ({ get }) => ({\n appConfigService: get<AppConfigurationService>(SAAS_SERVICE_TYPES.AppConfigService),\n fileStorageRouter: get<FileStorageRouterBackendService>(SAAS_SERVICE_TYPES.FileStorageRouter),\n }),\n doHandle: async (\n input,\n {\n logger,\n repositoriesRegistry,\n executionContextCreator,\n dependencies,\n },\n ) => {\n const startTime = Date.now();\n const tickAt = new Date(startTime).toISOString();\n const logDebug = logger.debugByType('AuditLogsArchiveBatch');\n const { appConfigService, fileStorageRouter } = dependencies;\n\n // Mutable run state, hoisted OUT of the try so the never-throws catch reports\n // HONEST partial progress: artifacts uploaded before a mid-loop failure are\n // real (persisted, idempotent), so the failure summary must reflect them —\n // not reset to zero. Mirrors the reconcile batch's \"return what was\n // accumulated\" contract.\n let enabled = false;\n let archiveAfterDays: number \| null = null;\n let horizonAt: string \| null = null;\n let storageConfigured = false;\n let lookbackDays = 0;\n let backfillProbeDays = 0;\n let windowsScanned = 0;\n let windowsArchived = 0;\n let windowsBackfilled = 0;\n let recordsArchived = 0;\n let truncatedWindows = 0;\n\n const summary = (error: string \| null = null): AuditLogsArchiveBatchOutput => ({\n tickAt,\n enabled,\n archiveAfterDays,\n horizonAt,\n storageConfigured,\n lookbackDays,\n backfillProbeDays,\n windowsScanned,\n windowsArchived,\n windowsBackfilled,\n recordsArchived,\n truncatedWindows,\n error,\n durationMs: Date.now() - startTime,\n });\n\n try {\n // 1. Opt-in gate. Undefined horizon ⇒ archival disabled (retain in DB\n // indefinitely). Emit a tick log so the cron's liveness is observable.\n const resolvedArchiveAfterDays = resolveArchiveAfterDays(input.archiveAfterDaysOverride, appConfigService);\n if (resolvedArchiveAfterDays === undefined) {\n logger.info('[audit] archive tick complete (archival disabled — auditTrail.archiveAfterDays unset)', { tickAt });\n return summary();\n }\n enabled = true;\n archiveAfterDays = resolvedArchiveAfterDays;\n\n // 2. Storage gate. Without a configured storage provider there is nowhere\n // to write; warn + no-op (never throw).\n if (!fileStorageRouter.isConfigured()) {\n logger.warn('[audit] archival is enabled but no file-storage provider is configured — skipping archival tick', {\n tickAt,\n archiveAfterDays,\n });\n return summary();\n }\n storageConfigured = true;\n // Prefer Wildo-managed, fall back to local-directory — the first\n // configured of the two the router knows about.\n const storageProvider = fileStorageRouter.resolveProvider([\n FileStorageAccepted.WILDO_MANAGED,\n FileStorageAccepted.LOCAL_DIRECTORY,\n ]);\n\n // 3. Compute the archivable day-window range. `horizon` is the age\n // cutoff; the most-recent FULLY-archivable day is the one ending at\n // the start of the horizon's day (the horizon's own day is only\n // partially older than the cutoff, so it is not archived yet).\n const horizon = new Date(startTime - resolvedArchiveAfterDays MS_PER_DAY);\n horizonAt = horizon.toISOString();\n const dmaxStart = addDays(startOfUtcDay(horizon), -1);\n lookbackDays = Math.min(\n Math.max(input.lookbackDaysOverride ?? DEFAULT_LOOKBACK_DAYS, 1),\n MAX_LOOKBACK_DAYS,\n );\n // The probe sweep sits BEYOND the look-back, and the pair is capped together so a wide\n // `lookbackDaysOverride` backfill cannot also drag a full probe span along behind it.\n backfillProbeDays = Math.min(\n Math.max(input.backfillProbeDaysOverride ?? DEFAULT_BACKFILL_PROBE_DAYS, 0),\n Math.max(MAX_LOOKBACK_DAYS - lookbackDays, 0),\n );\n\n // Internal APP_ADMIN_SUPER_ADMIN @ APPLICATION context for the AUDIT_LOGS\n // read — mirrors the reconcile batch. No org id + `excludeContextualFilter`\n // on the read ⇒ the scan spans EVERY org's rows.\n //\n // Resolved through the canonical repository seam, NOT a hand-rolled\n // `ResourceConfiguration_OperationPath`. Operation defaults are\n // variant-type-LOCAL and AUDIT_LOGS declares its LIST `REPOSITORY_ONLY`\n // variant `isDefault: false`, so a literal\n // `{ variantType: REPOSITORY_ONLY, isOperationDefault: true }` path matches\n // NOTHING and throws. That literal used to sit here and was latent only\n // because the archival opt-in gate above returns before reaching it whenever\n // `auditTrail.archiveAfterDays` is unset — enabling archival would have\n // surfaced it immediately. The sibling reconcile batch (no such gate) threw on\n // every run. See `immudb-audit-reconcile.batch.backend.service.ts`.\n const executionContext = await executionContextCreator.createForInternalRepositoryOperation({\n resourceType: CoreResourceType.AUDIT_LOGS,\n operationIdentifier: CoreResourceOperation.LIST,\n contextResourcesFieldIdentifier: new Map(),\n initiatorIds: null,\n initiatorRoles: [\n { roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], relatedPrimaryScope: ResourcePrimaryScope.APPLICATION },\n ],\n });\n const auditRepo = repositoriesRegistry.getRepositoryOrThrow(CoreResourceType.AUDIT_LOGS, executionContext);\n\n const applicationId = executionContext.applicationId \|\| appConfigService.applicationId;\n\n // The day offsets processed this tick, oldest → newest so partial-run progress covers the\n // oldest un-archived days first.\n //\n // Two bands with DIFFERENT semantics:\n // - look-back band (offsets 0…lookbackDays-1): ALWAYS re-scanned and re-written. Recent\n // days are cheap and this is what self-heals a single missed tick.\n // - probe band (older): re-scanned ONLY when the day's artifact is missing. This is the\n // gap-healing sweep — it derives progress from the artifacts instead of cross-run state,\n // so a tick missed weeks ago is repaired automatically instead of silently persisting.\n const probeBandStart = lookbackDays;\n const probeBandEnd = lookbackDays + backfillProbeDays; // exclusive\n const offsets: number[] = [];\n for (let i = probeBandEnd - 1; i >= probeBandStart; i -= 1) offsets.push(i);\n for (let i = lookbackDays - 1; i >= 0; i -= 1) offsets.push(i);\n\n for (const i of offsets) {\n const windowStart = addDays(dmaxStart, -i);\n const windowEnd = addDays(windowStart, 1);\n const isProbeBand = i >= probeBandStart;\n\n if (isProbeBand) {\n // One cheap metadata lookup decides whether this old day needs any work at all. An\n // already-archived non-empty day costs exactly this probe and nothing more.\n const exists = await archiveArtifactExists({\n storageProvider,\n executionContext,\n day: dayKey(windowStart),\n });\n if (exists) continue;\n }\n\n windowsScanned += 1;\n\n const { records, truncated } = await collectWindowRecords(auditRepo, executionContext, windowStart, windowEnd);\n if (records.length === 0) {\n // Empty day ⇒ no artifact (keeps historical backfill cheap). NOTE this is why the probe\n // cannot distinguish \"never archived\" from \"archived nothing\": an empty day is re-scanned\n // by every sweep. That scan is a single zero-row query, deliberately preferred over\n // writing empty marker artifacts just to satisfy the probe.\n continue;\n }\n if (truncated) {\n truncatedWindows += 1;\n // No silent caps: dropping records from an archive artifact must be\n // loud. The source rows are NOT lost (they stay in AUDIT_LOGS + immudb)\n // — the day's artifact is merely incomplete. An operator seeing this\n // should narrow to per-hour windows (future enhancement).\n logger.warn(\n '[audit] archive day-window hit the per-window record cap — artifact is INCOMPLETE for this day '\n + '(source rows retained in AUDIT_LOGS; the newest rows past the cap are omitted from the artifact)',\n { day: dayKey(windowStart), cap: MAX_RECORDS_PER_WINDOW, archived: records.length },\n );\n }\n\n await uploadWindowArtifact({\n storageProvider,\n executionContext,\n applicationId,\n windowStart,\n windowEnd,\n archivedAt: tickAt,\n records,\n truncated,\n });\n\n windowsArchived += 1;\n recordsArchived += records.length;\n if (isProbeBand) {\n windowsBackfilled += 1;\n // A gap the steady-state look-back could never have reached. Report it: a recurring\n // count here means ticks are being missed, which is worth an operator's attention even\n // though the sweep repaired it.\n logger.warn('[audit] archived a MISSING historical day-window (gap-healing sweep) — ticks may be being missed', {\n day: dayKey(windowStart),\n recordCount: records.length,\n });\n }\n logDebug('Archived audit day-window', {\n day: dayKey(windowStart),\n recordCount: records.length,\n truncated,\n backfilled: isProbeBand,\n });\n }\n\n logger.info('[audit] archive tick complete', {\n tickAt,\n archiveAfterDays,\n horizonAt,\n lookbackDays,\n backfillProbeDays,\n windowsScanned,\n windowsArchived,\n windowsBackfilled,\n recordsArchived,\n truncatedWindows,\n });\n\n return summary();\n } catch (error) {\n // Top-level guard: never throw onto the batch runner. Return the summary\n // with progress accumulated so far (artifacts already uploaded are real);\n // the next tick retries the same trailing windows (idempotent overwrite).\n const message = formatError(error);\n logger.error?.('[audit] audit-logs archive batch failed (non-fatal, returning partial summary)', {\n ...projectCaughtErrorLogFields(error),\n tickAt,\n });\n return summary(message);\n }\n },\n});\n\n// ═══════════════════════════════════════════════════════════════════════════\n// Helpers\n// ═══════════════════════════════════════════════════════════════════════════\n\n/*\n Page through one day-window `[windowStart, windowEnd)` of AUDIT_LOGS and\n * accumulate its rows (cross-org, `createdAt` ASC for deterministic artifact\n * content). Stops at {@link MAX_RECORDS_PER_WINDOW} (flagging `truncated`) so a\n * pathological day can't OOM the batch. Throws on repository failure — the\n * caller's top-level guard records it on `outputData.error`.\n \n Paging is KEYSET on `(createdAt, eventId)` (2026-08-05), not offset-based.\n \n It used to be `skip = (page-1)limit` over the NON-unique `createdAt`. When more rows\n than the page size share one millisecond across a page boundary, the store may order\n * those ties differently between the two page queries — so a boundary row could be\n * served on BOTH pages (duplicated) or on NEITHER (silently dropped from the artifact).\n * Dedupe by `eventId` covered the duplicate half; the dropped half was unrecoverable.\n \n This was previously written off as \"negligible in practice (needs 100+ events in one\n * millisecond)\". That condition is real: an application boot burst wrote 404 audit rows\n * in a single millisecond, which permanently stranded 305 records in the sibling\n * `immudb.audit-reconcile` batch before it was converted to the same keyset scan. Boot,\n * seeding and migration paths emit audit rows in tight loops — that is exactly when a\n * day-window archive matters most.\n \n The `(createdAt, eventId)` tuple is unique and totally ordered, so no row can now fall\n * between two pages in either direction. The `eventId` half depends on it being present\n * in the AUDIT_LOGS LIST `sortFields` (pinned by the resource-config test); a non-empty\n * whitelist makes the repository DROP unlisted sort keys silently, so removing it would\n * restore the defect without any error. The `seen` dedupe and the no-progress guard\n * remain as backstops for exactly that degradation.\n \n Residual (unchanged): a window exceeding {@link MAX_RECORDS_PER_WINDOW} is still\n * truncated, and the source rows always remain in AUDIT_LOGS regardless.\n /\n/\n Does the archival artifact for `day` already exist in storage?\n \n This is how the batch derives progress WITHOUT any cross-run state: the artifacts are the\n * record. It must address the blob exactly as {@link uploadWindowArtifact} wrote it, and it does\n * so WITHOUT re-implementing any provider path logic — the composite\n * `<folderPath>/<fileName>` is handed over as the `fileId` and each provider applies its OWN\n * composition, the same one its `upload` used:\n \n - wildo-managed: `upload` builds `effectiveFileId = folderPath/fileName` and calls\n * `resolveApplicationObjectKey(effectiveFileId, ctx)`; `getMetadata` calls that identical\n * resolver with `file.fileId`.\n * - local-directory: `upload` composes segments `[applicationId, folderPath, leaf]`;\n * `getMetadata` with no `storageRef` resolves `${applicationId}/${file.fileId}`.\n \n Both therefore land on the byte-identical key. The one coupling is\n * `includeApplicationId: true` on the upload — flip that and the probe would address a different\n * blob, so the two must move together (pinned by the key-parity test).\n \n FAIL-SAFE DIRECTION: any failure — genuinely absent, or a transient storage fault — answers\n * `false`, i.e. \"archive it\". Re-archiving is harmless by construction (the artifact key is\n * deterministic and the write overwrites), whereas a false `true` would silently skip a day and\n * recreate the very gap this sweep exists to close.\n /\nasync function archiveArtifactExists(args: {\n storageProvider: ReturnType<FileStorageRouterBackendService['resolveProvider']>;\n executionContext: Awaited<ReturnType<ExecutionContextCreatorBackendService['createForInternalRepositoryOperation']>>;\n day: string;\n}): Promise<boolean> {\n const { storageProvider, executionContext, day } = args;\n try {\n await storageProvider.getMetadata(\n {\n fileId: `${AUDIT_ARCHIVE_FOLDER}/audit-archive-${day}.json`,\n storageProvider: undefined,\n storageRef: undefined,\n } as unknown as Parameters<typeof storageProvider.getMetadata>[0],\n executionContext,\n );\n return true;\n } catch {\n return false;\n }\n}\n\nasync function collectWindowRecords(\n auditRepo: ReturnType<RepositoriesRegistryHandlerBackendService['getRepositoryOrThrow']>,\n executionContext: Awaited<ReturnType<ExecutionContextCreatorBackendService['createForInternalRepositoryOperation']>>,\n windowStart: Date,\n windowEnd: Date,\n): Promise<{ records: AuditableEvent[]; truncated: boolean }> {\n const windowBound = { createdAt: { $gte: windowStart, $lt: windowEnd } };\n const records: AuditableEvent[] = [];\n const seen = new Set<string>();\n let truncated = false;\n /* Keyset position: the `(createdAt, eventId)` of the last row consumed. /\n let cursor: { createdAt: Date; eventId: string } \| null = null;\n\n for (let page = 1; page <= MAX_PAGES_PER_WINDOW; page += 1) {\n // KEYSET lower bound, ANDed with the day window. `$and`/`$or` are both translated by the\n // Mongo and PostgreSQL adapters, so the predicate is portable.\n const filter: Record<string, unknown> = cursor === null\n ? windowBound\n : {\n $and: [\n windowBound,\n {\n $or: [\n { createdAt: { $gt: cursor.createdAt } },\n { createdAt: cursor.createdAt, eventId: { $gt: cursor.eventId } },\n ],\n },\n ],\n };\n\n // Page is pinned to 1: the cursor — not an offset — is what advances. Offset paging over a\n // NON-unique sort key was the defect (see the boundary-tie note above); with `skip`, ties\n // straddling a page boundary could be served on both pages (deduped below) or on NEITHER\n // (unrecoverable). `sort` is honored because AUDIT_LOGS' LIST whitelists BOTH `createdAt`\n // and `eventId` in its sortFields — drop `eventId` there and the tie-break silently\n // disappears, restoring the skip. Typed to the `_doList` contract, structurally compatible\n // with the public overload.\n const listOptions: { page: number; limit: number; sort: Record<string, 1 \| -1> } = {\n page: 1,\n limit: PAGE_SIZE,\n sort: { createdAt: 1, eventId: 1 },\n };\n const result = (await auditRepo.list(executionContext, filter, {\n paginated: true,\n // Cross-org archival: bypass the contextual org filter so EVERY org's rows\n // for this day are captured, not just a caller's org.\n excludeContextualFilter: true,\n listOptions,\n })) as unknown as AuditLogsListPage;\n\n const rows = result.data ?? [];\n if (rows.length === 0) break;\n\n const cursorBeforePage = cursor;\n\n for (const row of rows) {\n // Dedupe by stable identity. Keyset paging makes a cross-page duplicate unreachable in\n // normal operation, so this is now a defensive backstop against a degraded sort rather\n // than the primary protection it used to be. A row with no identity at all (never\n // expected — persisted rows carry `_id`) is treated as distinct rather than silently\n // collapsed.\n const key = String((row as { eventId?: string; _id?: string }).eventId\n ?? (row as { _id?: string })._id ?? '');\n if (key && seen.has(key)) continue;\n if (records.length >= MAX_RECORDS_PER_WINDOW) {\n truncated = true;\n break;\n }\n if (key) seen.add(key);\n records.push(row);\n\n // Advance only on a COMPLETE tuple: a row missing either half cannot express a keyset\n // position, and inventing a partial one would step over its neighbours. Leaving the cursor\n // put means the no-progress guard below ends the scan instead.\n const rowCreatedAt = row.createdAt instanceof Date ? row.createdAt : new Date(String(row.createdAt));\n const rowEventId = (row as { eventId?: unknown }).eventId;\n if (!Number.isNaN(rowCreatedAt.getTime()) && typeof rowEventId === 'string') {\n cursor = { createdAt: rowCreatedAt, eventId: rowEventId };\n }\n }\n if (truncated) break;\n\n // Defensive no-progress guard: with a valid `(createdAt, eventId)` sort every page strictly\n // advances the cursor. Failing to advance means the ordering was degraded or the page held\n // no usable tuple — stop rather than re-issue an identical query forever.\n if (\n cursor !== null &&\n cursorBeforePage !== null &&\n cursor.createdAt.getTime() === cursorBeforePage.createdAt.getTime() &&\n cursor.eventId === cursorBeforePage.eventId\n ) {\n break;\n }\n\n if (rows.length < PAGE_SIZE) break;\n }\n\n return { records, truncated };\n}\n\n/\n Serialise a day-window's records to a self-describing JSON artifact and upload\n * it to the DETERMINISTIC key `audit-archive/[applicationId/]audit-archive-<day>.json`\n * (overwrite = idempotent). JSON (not CSV) is used deliberately: audit events\n * carry nested metadata that CSV would flatten lossily.\n */\nasync function uploadWindowArtifact(args: {\n storageProvider: ReturnType<FileStorageRouterBackendService['resolveProvider']>;\n executionContext: Awaited<ReturnType<ExecutionContextCreatorBackendService['createForInternalRepositoryOperation']>>;\n applicationId: string \| undefined;\n windowStart: Date;\n windowEnd: Date;\n archivedAt: string;\n records: AuditableEvent[];\n truncated: boolean;\n}): Promise<void> {\n const { storageProvider, executionContext, applicationId, windowStart, windowEnd, archivedAt, records, truncated } = args;\n const day = dayKey(windowStart);\n\n const payload = {\n schemaVersion: 1 as const,\n kind: 'audit-log-archive' as const,\n // Self-describing provenance: the artifact is also namespaced under the\n // applicationId in its storage path (includeApplicationId), but embedding it\n // keeps a portable artifact identifiable without parsing the path.\n applicationId: applicationId ?? null,\n dayWindowUtc: day,\n windowStart: windowStart.toISOString(),\n windowEnd: windowEnd.toISOString(),\n archivedAt,\n recordCount: records.length,\n truncated,\n records,\n };\n const buffer = Buffer.from(JSON.stringify(payload), 'utf-8');\n\n await storageProvider.upload(\n Readable.from([buffer]),\n // Random valid resource id satisfies `validateFileId`; the DETERMINISTIC key\n // comes from `fileName` (the providers use it as the blob leaf), so the id\n // never affects the storage location or the overwrite semantics.\n randomUUID(),\n 'application/json',\n buffer.byteLength,\n executionContext,\n {\n folderPath: AUDIT_ARCHIVE_FOLDER,\n fileName: `audit-archive-${day}.json`,\n includeApplicationId: true,\n },\n );\n}\n"]}
1	+ {"version":3,"file":"audit-logs-archive.batch.backend.service.js","sourceRoot":"","sources":["../../../../../src/compliance/audit-trails/batches/audit-logs-archive.batch.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsFG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAEpC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,gBAAgB,EAChB,qBAAqB,EACrB,oBAAoB,EACpB,cAAc,GACf,MAAM,uBAAuB,CAAC;AAI/B,OAAO,EACL,mBAAmB,EACnB,2BAA2B,GAC5B,MAAM,8EAA8E,CAAC;AACtF,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EACL,iCAAiC,GAElC,MAAM,4FAA4F,CAAC;AACpG,OAAO,EAAE,wCAAwC,EAAE,MAAM,gFAAgF,CAAC;AAC1I,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAMpF,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E,MAAM,UAAU,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEvC,2EAA2E;AAC3E,MAAM,oBAAoB,GAAG,eAAe,CAAC;AAE7C;;;;GAIG;AACH,MAAM,SAAS,GAAG,GAAG,CAAC;AAEtB;;;;;GAKG;AACH,MAAM,oBAAoB,GAAG,KAAK,CAAC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,MAAM,sBAAsB,GAAG,OAAO,CAAC;AAEvC;;;;;GAKG;AACH,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAEhC;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAE/B;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,2BAA2B,GAAG,EAAE,CAAC;AAEvC,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,2EAA2E;IAC3E,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IACtE,2EAA2E;IAC3E,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,QAAQ,EAAE;IAC/E;;;OAGG;IACH,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,QAAQ,EAAE;CACrF,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ;;;GAGG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,sDAAsD;IACtD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,+EAA+E;IAC/E,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,kFAAkF;IAClF,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC7C,gFAAgF;IAChF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC3C,iEAAiE;IACjE,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE;IAC9B,gDAAgD;IAChD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,6EAA6E;IAC7E,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C;;;OAGG;IACH,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C,kFAAkF;IAClF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvC,kEAAkE;IAClE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxC,iEAAiE;IACjE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxC,iFAAiF;IACjF,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,2EAA2E;IAC3E,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACpC,CAAC,CAAC;AAaH;;;;;;;;GAQG;AACH,SAAS,WAAW,CAAC,GAAY;IAC/B,OAAO,mBAAmB,CAAC,GAAG,CAAC,CAAC;AAClC,CAAC;AAED,oDAAoD;AACpD,SAAS,aAAa,CAAC,CAAO;IAC5B,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,OAAO,CAAC,CAAO,EAAE,CAAS;IACjC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC;AAChD,CAAC;AAED,qDAAqD;AACrD,SAAS,MAAM,CAAC,QAAc;IAC5B,OAAO,QAAQ,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;GAKG;AACH,SAAS,uBAAuB,CAC9B,QAA4B,EAC5B,gBAAyC;IAEzC,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAClD,MAAM,UAAU,GAAG,gBAAgB,CAAC,MAAM,EAAE,UAAU,EAAE,gBAAgB,CAAC;IACzE,OAAO,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;AACjE,CAAC;AAED,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E,MAAM,CAAC,MAAM,4BAA4B,GAGrC,iCAAiC,CAAC;IACpC,KAAK,EAAE,gCAAgC;IACvC,MAAM,EAAE,iCAAiC;IACzC,oBAAoB,EAAE;QACpB,4EAA4E;QAC5E,4EAA4E;QAC5E,2EAA2E;QAC3E,2EAA2E;QAC3E,2BAA2B;QAC3B,IAAI,EAAE,wCAAwC,CAAC,IAAI;QACnD,mBAAmB,EAAE,wCAAwC,CAAC,mBAAmB;QACjF,YAAY,EAAE,wCAAwC,CAAC,YAAY;QACnE,iBAAiB,EAAE,wCAAwC,CAAC,cAAc;KAC3E;IACD,mBAAmB,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;QACjC,gBAAgB,EAAE,GAAG,CAA0B,kBAAkB,CAAC,gBAAgB,CAAC;QACnF,iBAAiB,EAAE,GAAG,CAAkC,kBAAkB,CAAC,iBAAiB,CAAC;KAC9F,CAAC;IACF,QAAQ,EAAE,KAAK,EACb,KAAK,EACL,EACE,MAAM,EACN,oBAAoB,EACpB,uBAAuB,EACvB,YAAY,GACb,EACD,EAAE;QACF,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;QACjD,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,uBAAuB,CAAC,CAAC;QAC7D,MAAM,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,GAAG,YAAY,CAAC;QAE7D,8EAA8E;QAC9E,4EAA4E;QAC5E,2EAA2E;QAC3E,oEAAoE;QACpE,yBAAyB;QACzB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,gBAAgB,GAAkB,IAAI,CAAC;QAC3C,IAAI,SAAS,GAAkB,IAAI,CAAC;QACpC,IAAI,iBAAiB,GAAG,KAAK,CAAC;QAC9B,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,IAAI,iBAAiB,GAAG,CAAC,CAAC;QAC1B,IAAI,cAAc,GAAG,CAAC,CAAC;QACvB,IAAI,eAAe,GAAG,CAAC,CAAC;QACxB,IAAI,iBAAiB,GAAG,CAAC,CAAC;QAC1B,IAAI,eAAe,GAAG,CAAC,CAAC;QACxB,IAAI,gBAAgB,GAAG,CAAC,CAAC;QAEzB,MAAM,OAAO,GAAG,CAAC,QAAuB,IAAI,EAA+B,EAAE,CAAC,CAAC;YAC7E,MAAM;YACN,OAAO;YACP,gBAAgB;YAChB,SAAS;YACT,iBAAiB;YACjB,YAAY;YACZ,iBAAiB;YACjB,cAAc;YACd,eAAe;YACf,iBAAiB;YACjB,eAAe;YACf,gBAAgB;YAChB,KAAK;YACL,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;SACnC,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,sEAAsE;YACtE,0EAA0E;YAC1E,MAAM,wBAAwB,GAAG,uBAAuB,CAAC,KAAK,CAAC,wBAAwB,EAAE,gBAAgB,CAAC,CAAC;YAC3G,IAAI,wBAAwB,KAAK,SAAS,EAAE,CAAC;gBAC3C,MAAM,CAAC,IAAI,CAAC,uFAAuF,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;gBACjH,OAAO,OAAO,EAAE,CAAC;YACnB,CAAC;YACD,OAAO,GAAG,IAAI,CAAC;YACf,gBAAgB,GAAG,wBAAwB,CAAC;YAE5C,0EAA0E;YAC1E,2CAA2C;YAC3C,IAAI,CAAC,iBAAiB,CAAC,YAAY,EAAE,EAAE,CAAC;gBACtC,MAAM,CAAC,IAAI,CAAC,iGAAiG,EAAE;oBAC7G,MAAM;oBACN,gBAAgB;iBACjB,CAAC,CAAC;gBACH,OAAO,OAAO,EAAE,CAAC;YACnB,CAAC;YACD,iBAAiB,GAAG,IAAI,CAAC;YACzB,iEAAiE;YACjE,gDAAgD;YAChD,MAAM,eAAe,GAAG,iBAAiB,CAAC,eAAe,CAAC;gBACxD,mBAAmB,CAAC,aAAa;gBACjC,mBAAmB,CAAC,eAAe;aACpC,CAAC,CAAC;YAEH,mEAAmE;YACnE,uEAAuE;YACvE,mEAAmE;YACnE,kEAAkE;YAClE,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,SAAS,GAAG,wBAAwB,GAAG,UAAU,CAAC,CAAC;YAC5E,SAAS,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;YAClC,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YACtD,YAAY,GAAG,IAAI,CAAC,GAAG,CACrB,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,oBAAoB,IAAI,qBAAqB,EAAE,CAAC,CAAC,EAChE,iBAAiB,CAClB,CAAC;YACF,uFAAuF;YACvF,sFAAsF;YACtF,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAC1B,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,yBAAyB,IAAI,2BAA2B,EAAE,CAAC,CAAC,EAC3E,IAAI,CAAC,GAAG,CAAC,iBAAiB,GAAG,YAAY,EAAE,CAAC,CAAC,CAC9C,CAAC;YAEF,0EAA0E;YAC1E,4EAA4E;YAC5E,iDAAiD;YACjD,EAAE;YACF,oEAAoE;YACpE,gEAAgE;YAChE,wEAAwE;YACxE,2CAA2C;YAC3C,4EAA4E;YAC5E,wEAAwE;YACxE,6EAA6E;YAC7E,wEAAwE;YACxE,+EAA+E;YAC/E,oEAAoE;YACpE,MAAM,gBAAgB,GAAG,MAAM,uBAAuB,CAAC,oCAAoC,CAAC;gBAC1F,YAAY,EAAE,gBAAgB,CAAC,UAAU;gBACzC,mBAAmB,EAAE,qBAAqB,CAAC,IAAI;gBAC/C,+BAA+B,EAAE,IAAI,GAAG,EAAE;gBAC1C,YAAY,EAAE,IAAI;gBAClB,cAAc,EAAE;oBACd,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,mBAAmB,EAAE,oBAAoB,CAAC,WAAW,EAAE;iBACzG;aACF,CAAC,CAAC;YACH,MAAM,SAAS,GAAG,oBAAoB,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC;YAE3G,MAAM,aAAa,GAAG,gBAAgB,CAAC,aAAa,IAAI,gBAAgB,CAAC,aAAa,CAAC;YAEvF,0FAA0F;YAC1F,iCAAiC;YACjC,EAAE;YACF,sCAAsC;YACtC,yFAAyF;YACzF,sEAAsE;YACtE,yFAAyF;YACzF,4FAA4F;YAC5F,0FAA0F;YAC1F,MAAM,cAAc,GAAG,YAAY,CAAC;YACpC,MAAM,YAAY,GAAG,YAAY,GAAG,iBAAiB,CAAC,CAAC,YAAY;YACnE,MAAM,OAAO,GAAa,EAAE,CAAC;YAC7B,KAAK,IAAI,CAAC,GAAG,YAAY,GAAG,CAAC,EAAE,CAAC,IAAI,cAAc,EAAE,CAAC,IAAI,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC5E,KAAK,IAAI,CAAC,GAAG,YAAY,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAE/D,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACxB,MAAM,WAAW,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC3C,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;gBAC1C,MAAM,WAAW,GAAG,CAAC,IAAI,cAAc,CAAC;gBAExC,IAAI,WAAW,EAAE,CAAC;oBAChB,mFAAmF;oBACnF,4EAA4E;oBAC5E,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC;wBACzC,eAAe;wBACf,gBAAgB;wBAChB,GAAG,EAAE,MAAM,CAAC,WAAW,CAAC;qBACzB,CAAC,CAAC;oBACH,IAAI,MAAM;wBAAE,SAAS;gBACvB,CAAC;gBAED,cAAc,IAAI,CAAC,CAAC;gBAEpB,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,MAAM,oBAAoB,CAAC,SAAS,EAAE,gBAAgB,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;gBAC/G,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACzB,wFAAwF;oBACxF,0FAA0F;oBAC1F,oFAAoF;oBACpF,4DAA4D;oBAC5D,SAAS;gBACX,CAAC;gBACD,IAAI,SAAS,EAAE,CAAC;oBACd,gBAAgB,IAAI,CAAC,CAAC;oBACtB,oEAAoE;oBACpE,wEAAwE;oBACxE,qEAAqE;oBACrE,0DAA0D;oBAC1D,MAAM,CAAC,IAAI,CACT,iGAAiG;0BAC/F,kGAAkG,EACpG,EAAE,GAAG,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,sBAAsB,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE,CACpF,CAAC;gBACJ,CAAC;gBAED,MAAM,oBAAoB,CAAC;oBACzB,eAAe;oBACf,gBAAgB;oBAChB,aAAa;oBACb,WAAW;oBACX,SAAS;oBACT,UAAU,EAAE,MAAM;oBAClB,OAAO;oBACP,SAAS;iBACV,CAAC,CAAC;gBAEH,eAAe,IAAI,CAAC,CAAC;gBACrB,eAAe,IAAI,OAAO,CAAC,MAAM,CAAC;gBAClC,IAAI,WAAW,EAAE,CAAC;oBAChB,iBAAiB,IAAI,CAAC,CAAC;oBACvB,oFAAoF;oBACpF,uFAAuF;oBACvF,gCAAgC;oBAChC,MAAM,CAAC,IAAI,CAAC,kGAAkG,EAAE;wBAC9G,GAAG,EAAE,MAAM,CAAC,WAAW,CAAC;wBACxB,WAAW,EAAE,OAAO,CAAC,MAAM;qBAC5B,CAAC,CAAC;gBACL,CAAC;gBACD,QAAQ,CAAC,2BAA2B,EAAE;oBACpC,GAAG,EAAE,MAAM,CAAC,WAAW,CAAC;oBACxB,WAAW,EAAE,OAAO,CAAC,MAAM;oBAC3B,SAAS;oBACT,UAAU,EAAE,WAAW;iBACxB,CAAC,CAAC;YACL,CAAC;YAED,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE;gBAC3C,MAAM;gBACN,gBAAgB;gBAChB,SAAS;gBACT,YAAY;gBACZ,iBAAiB;gBACjB,cAAc;gBACd,eAAe;gBACf,iBAAiB;gBACjB,eAAe;gBACf,gBAAgB;aACjB,CAAC,CAAC;YAEH,OAAO,OAAO,EAAE,CAAC;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,yEAAyE;YACzE,0EAA0E;YAC1E,0EAA0E;YAC1E,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;YACnC,MAAM,CAAC,KAAK,EAAE,CAAC,gFAAgF,EAAE;gBAC/F,GAAG,2BAA2B,CAAC,KAAK,CAAC;gBACrC,MAAM;aACP,CAAC,CAAC;YACH,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;CACF,CAAC,CAAC;AAEH,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,KAAK,UAAU,qBAAqB,CAAC,IAIpC;IACC,MAAM,EAAE,eAAe,EAAE,gBAAgB,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IACxD,IAAI,CAAC;QACH,MAAM,eAAe,CAAC,WAAW,CAC/B;YACE,MAAM,EAAE,GAAG,oBAAoB,kBAAkB,GAAG,OAAO;YAC3D,eAAe,EAAE,SAAS;YAC1B,UAAU,EAAE,SAAS;SAC0C,EACjE,gBAAgB,CACjB,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,SAAwF,EACxF,gBAAoH,EACpH,WAAiB,EACjB,SAAe;IAEf,MAAM,WAAW,GAAG,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,CAAC;IACzE,MAAM,OAAO,GAAqB,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,4EAA4E;IAC5E,IAAI,MAAM,GAAgD,IAAI,CAAC;IAE/D,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,IAAI,oBAAoB,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC;QAC3D,yFAAyF;QACzF,+DAA+D;QAC/D,MAAM,MAAM,GAA4B,MAAM,KAAK,IAAI;YACrD,CAAC,CAAC,WAAW;YACb,CAAC,CAAC;gBACA,IAAI,EAAE;oBACJ,WAAW;oBACX;wBACE,GAAG,EAAE;4BACH,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,EAAE;4BACxC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE;yBAClE;qBACF;iBACF;aACF,CAAC;QAEJ,2FAA2F;QAC3F,0FAA0F;QAC1F,yFAAyF;QACzF,0FAA0F;QAC1F,oFAAoF;QACpF,2FAA2F;QAC3F,4BAA4B;QAC5B,MAAM,WAAW,GAAkE;YACjF,IAAI,EAAE,CAAC;YACP,KAAK,EAAE,SAAS;YAChB,IAAI,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE;SACnC,CAAC;QACF,MAAM,MAAM,GAAG,CAAC,MAAM,SAAS,CAAC,IAAI,CAAC,gBAAgB,EAAE,MAAM,EAAE;YAC7D,SAAS,EAAE,IAAI;YACf,2EAA2E;YAC3E,sDAAsD;YACtD,uBAAuB,EAAE,IAAI;YAC7B,WAAW;SACZ,CAAC,CAAiC,CAAC;QAEpC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QAC/B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM;QAE7B,MAAM,gBAAgB,GAAG,MAAM,CAAC;QAEhC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,uFAAuF;YACvF,uFAAuF;YACvF,kFAAkF;YAClF,qFAAqF;YACrF,aAAa;YACb,MAAM,GAAG,GAAG,MAAM,CAAE,GAA0C,CAAC,OAAO;mBAChE,GAAwB,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;YAC1C,IAAI,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YACnC,IAAI,OAAO,CAAC,MAAM,IAAI,sBAAsB,EAAE,CAAC;gBAC7C,SAAS,GAAG,IAAI,CAAC;gBACjB,MAAM;YACR,CAAC;YACD,IAAI,GAAG;gBAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACvB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAElB,sFAAsF;YACtF,2FAA2F;YAC3F,+DAA+D;YAC/D,MAAM,YAAY,GAAG,GAAG,CAAC,SAAS,YAAY,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;YACrG,MAAM,UAAU,GAAI,GAA6B,CAAC,OAAO,CAAC;YAC1D,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;gBAC5E,MAAM,GAAG,EAAE,SAAS,EAAE,YAAY,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;YAC5D,CAAC;QACH,CAAC;QACD,IAAI,SAAS;YAAE,MAAM;QAErB,4FAA4F;QAC5F,2FAA2F;QAC3F,0EAA0E;QAC1E,IACE,MAAM,KAAK,IAAI;YACf,gBAAgB,KAAK,IAAI;YACzB,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,gBAAgB,CAAC,SAAS,CAAC,OAAO,EAAE;YACnE,MAAM,CAAC,OAAO,KAAK,gBAAgB,CAAC,OAAO,EAC3C,CAAC;YACD,MAAM;QACR,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,GAAG,SAAS;YAAE,MAAM;IACrC,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAChC,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,oBAAoB,CAAC,IASnC;IACC,MAAM,EAAE,eAAe,EAAE,gBAAgB,EAAE,aAAa,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;IAC1H,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;IAEhC,MAAM,OAAO,GAAG;QACd,aAAa,EAAE,CAAU;QACzB,IAAI,EAAE,mBAA4B;QAClC,wEAAwE;QACxE,6EAA6E;QAC7E,mEAAmE;QACnE,aAAa,EAAE,aAAa,IAAI,IAAI;QACpC,YAAY,EAAE,GAAG;QACjB,WAAW,EAAE,WAAW,CAAC,WAAW,EAAE;QACtC,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;QAClC,UAAU;QACV,WAAW,EAAE,OAAO,CAAC,MAAM;QAC3B,SAAS;QACT,OAAO;KACR,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;IAE7D,MAAM,eAAe,CAAC,MAAM,CAC1B,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC;IACvB,6EAA6E;IAC7E,2EAA2E;IAC3E,iEAAiE;IACjE,UAAU,EAAE,EACZ,kBAAkB,EAClB,MAAM,CAAC,UAAU,EACjB,gBAAgB,EAChB;QACE,UAAU,EAAE,oBAAoB;QAChC,QAAQ,EAAE,iBAAiB,GAAG,OAAO;QACrC,oBAAoB,EAAE,IAAI;KAC3B,CACF,CAAC;AACJ,CAAC","sourcesContent":["/*\n Audit-Log Archival Batch (audit Phase 5 / F1)\n \n Periodic CRON custom batch that EXPORTS aged audit records to durable off-DB\n * archival artifacts in file storage. It is the operator-tunable retention /\n * archival mechanism for the compliance audit trail.\n \n --------------------------------------------------------------------------\n * Archival, NOT deletion — audit logs are immutable\n * --------------------------------------------------------------------------\n * `AUDIT_LOGS` is immutable by invariant (G5): its `coreOperations` are\n * `READ \| LIST \| SEARCH \| CREATE` — no `UPDATE`, no `DELETE`. This batch\n * therefore NEVER removes audit records. It COPIES records older than the\n * operator-configured horizon (`AppConfiguration.auditTrail.archiveAfterDays`)\n * into durable JSON artifacts in file storage, one artifact per UTC day-window,\n * while the original rows remain in the always-on `AUDIT_LOGS` store (and, when\n * configured, in the append-only immudb tamper-proof ledger). The archive is an\n * additional off-DB compliance/DR copy — a portable artifact an auditor can be\n * handed — not a prune. (The value trade-off is explicit: it does NOT bound DB\n * growth. A future delete-after-archive step, if compliance demands\n * data-minimisation, would build on top of this — but that requires relaxing\n * G5 and is out of scope here.)\n \n --------------------------------------------------------------------------\n * OPT-IN\n * --------------------------------------------------------------------------\n * Setting `auditTrail.archiveAfterDays` IS the opt-in. When it is `undefined`\n * (the compliance-safe default) the batch no-ops: nothing is archived and every\n * record is retained in the primary store indefinitely. The batch is registered\n * unconditionally (like the reconcile / delivery drains) so a mis-set flag can\n * never orphan the schedule; the no-op is decided at TICK time from live config.\n \n --------------------------------------------------------------------------\n * Idempotency — stateless deterministic overwrite (no checkpoint store)\n * --------------------------------------------------------------------------\n * The archive is keyed by UTC day. Each day-window writes to a DETERMINISTIC\n * storage key (`audit-archive/[applicationId/]audit-archive-YYYY-MM-DD.json`)\n * via the `fileName` upload option, which the storage providers use as the blob\n * leaf — so re-uploading a window OVERWRITES it. A fully-past day's audit rows\n * are stable (audit events are created at operation time; nothing back-dates\n * into a closed day), so a re-write produces identical content. This makes the\n * batch idempotent WITHOUT any high-water-mark / checkpoint state: unlike the\n * reconcile batch (which stores its mark in immudb), archival must work even\n * when immudb is not configured, so it deliberately keeps ZERO cross-run state.\n \n Each tick (re)writes only the trailing {@link DEFAULT_LOOKBACK_DAYS} archivable\n * day-windows. On the daily cron exactly one new day crosses the horizon per\n * tick; the small look-back re-writes the last couple of crossed days so a\n * single missed tick self-heals on the next run. The (bounded) cost of the\n * re-write is re-reading a day or two of audit rows — cheap for a nightly sweep.\n \n Missed windows self-heal WITHOUT cross-run state: beyond the look-back, each tick sweeps a\n * bounded trailing span ({@link DEFAULT_BACKFILL_PROBE_DAYS}) and asks storage whether each day's\n * deterministic artifact already exists, archiving only the days that are missing. Progress is\n * therefore DERIVED FROM THE ARTIFACTS — the one durable record that always exists and that does\n * not require immudb, so the \"zero cross-run state\" property above is preserved rather than traded\n * away. A day repaired this way is logged as a warning and counted in `windowsBackfilled`: the\n * sweep fixes the gap, but a recurring count means ticks are being missed and an operator should\n * know. Previously such a day stayed missing forever, because nothing recorded that it was skipped.\n \n Cold-start backlog beyond the probe span: still an explicit operator gesture — trigger the batch\n * once with a `lookbackDaysOverride` wide enough to cover the history (e.g. the full\n * `archiveAfterDays` span). That remains the way to seed archives for an app that enabled archival\n * after it already had aged data.\n \n --------------------------------------------------------------------------\n * Cross-org, anchoring, failure containment\n * --------------------------------------------------------------------------\n * Scope-anchored @ APPLICATION: the batch archives EVERY org's aged rows into a\n * single per-day artifact (each record carries its own `organizationId`), so the\n * read bypasses the contextual org filter (`excludeContextualFilter: true`) —\n * mirroring the reconcile batch. Per-org artifact partitioning is a deliberate\n * future enhancement, not a v1 requirement — see the scaling note on\n * {@link MAX_RECORDS_PER_WINDOW} for WHY (cross-org amplifies the per-artifact\n * size) and HOW to lift the limitation (stream the upload + per-org partitioning).\n \n Never-throws contract: archival must not crash the batch runner (F7 — audit\n * side-channels are independent + non-blocking). A failure (storage outage, DB\n * read error) is LOGGED and yields a partial summary with `error` set; the next\n * scheduled tick retries the same trailing windows (idempotent overwrite makes\n * the retry safe).\n \n @see base-classes/services/batches/engine-custom-batch-manifests.ts\n * (`ENGINE_AUDIT_LOGS_ARCHIVE_BATCH_MANIFEST` — the ref + cron single source).\n * @see compliance/audit-trails/batches/immudb-audit-reconcile.batch.backend.service.ts\n * (the sibling audit cron this mirrors for context creation + cross-org scan).\n /\n\nimport { Readable } from 'stream';\nimport { randomUUID } from 'crypto';\n\nimport { z } from 'zod';\nimport {\n CoreResourceType,\n CoreResourceOperation,\n ResourcePrimaryScope,\n CORE_APP_ROLES,\n} from '@wildo-ai/saas-models';\nimport type {\n AuditableEvent,\n} from '@wildo-ai/saas-models';\nimport {\n describeCaughtError,\n projectCaughtErrorLogFields,\n} from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { FileStorageAccepted } from '@wildo-ai/zod-decorators';\nimport {\n createCustomBatchExecutionService,\n type BatchesCronjobsCustomExecution_Service,\n} from '~wildo-backend-lib/base-classes/services/batches/batches-cronjobs-custom-execution.service';\nimport { ENGINE_AUDIT_LOGS_ARCHIVE_BATCH_MANIFEST } from '~wildo-backend-lib/base-classes/services/batches/engine-custom-batch-manifests';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport type { FileStorageRouterBackendService } from '~wildo-backend-lib/files/storage/file-storage-router.backend.service';\nimport type { RepositoriesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/repositories/repositories-registry-handler.backend.service';\nimport type { ExecutionContextCreatorBackendService } from '~wildo-backend-lib/runtime/services/execution-context-creator.backend.service';\n\n// ═══════════════════════════════════════════════════════════════════════════\n// Tuning constants\n// ═══════════════════════════════════════════════════════════════════════════\n\nconst MS_PER_DAY = 24 60 * 60 * 1000;\n\n/** Folder namespace for archival artifacts within the storage provider. /\nconst AUDIT_ARCHIVE_FOLDER = 'audit-archive';\n\n/\n Per-page limit for the day-window AUDIT_LOGS scan. Hard-capped at 100 by the\n * repository (`_doList` clamps with `Math.min(100, …)`), so a larger value is\n * silently clamped. Paging stops when a page returns fewer than this.\n /\nconst PAGE_SIZE = 100;\n\n/\n Defensive per-window page ceiling — guards against an unbounded loop if a\n * window's row count somehow never decreases. At {@link PAGE_SIZE} = 100 and\n * {@link MAX_RECORDS_PER_WINDOW} = 100_000 the record cap is hit first; this is\n * the belt-and-braces backstop.\n /\nconst MAX_PAGES_PER_WINDOW = 2_000;\n\n/\n Hard cap on records accumulated into a SINGLE day-window artifact.\n \n WHAT IT PROTECTS: the batch holds a whole window's rows in memory (`records[]`)\n * to serialise ONE JSON artifact per day, so without a cap a huge day would OOM\n * the batch process. On the cap being hit we archive the first\n * {@link MAX_RECORDS_PER_WINDOW}, flag the window `truncated`, and emit a\n * `logger.warn` — the day's artifact is then INCOMPLETE, but NO audit data is\n * lost: the authoritative rows always remain in `AUDIT_LOGS` (+ immudb).\n \n ─────────────────────────────────────────────────────────────────────────────\n * KNOWN LIMITATION + HOW TO REMOVE IT (deferred 2026-07-04 — revisit only when a\n * real deployment's volume actually triggers it; do NOT pre-build speculatively)\n * ─────────────────────────────────────────────────────────────────────────────\n * The cross-org design (ONE artifact per day for ALL orgs — see the file header)\n * multiplies what lands in the buffer, so a high-volume multi-tenant deployment\n * can exceed this cap and CHRONICALLY truncate. The cap is a SYMPTOM; the ROOT\n * CAUSE is buffering the whole artifact in memory before a single sized upload.\n * Two orthogonal, COMPOSABLE fixes (do both to eliminate it, not just soften it):\n \n (1) STREAM THE UPLOAD — the true root fix. Replace `records[]` +\n * `Buffer.from(JSON.stringify(...))` + sized `provider.upload(...)` with a\n * `Readable` that pages the repo and emits NDJSON row-by-row into a\n * size-OPTIONAL streaming upload. Memory then stays bounded to one page\n * (~{@link PAGE_SIZE} rows) regardless of window size, and this cap is\n * DROPPED entirely. Enabler: `IFileStorageProvider.upload()` currently\n * requires `size: number`; add a size-optional streaming path —\n * MinIO/S3 `putObject` multiparts automatically when size is unknown, and\n * the local-directory provider just pipes `stream → writeStream` (relax the\n * `validateSize` policy gate for internal system artifacts). This touches\n * shared engine surface (the provider interface + both providers + tests).\n * Cheaper no-interface-change variant: spool the window to a temp file,\n * `stat` its size, then stream-upload from the file (bounded memory via\n * disk instead of RAM, at the cost of a temp-file lifecycle + writable disk).\n \n (2) PER-ORG PARTITIONING — removes the cross-org amplification AND is the\n * compliance-correct shape. Emit one artifact per `(org, day)` (+ an\n * APPLICATION-scoped artifact for no-org / app-level events) instead of one\n * cross-org artifact; enumerate the distinct `organizationId`s in the window\n * via a `distinct`/aggregation, then archive per org. Each artifact becomes\n * one org's day (smaller), and each tenant's trail is an independently\n * retrievable/erasable artifact — what GDPR right-to-erasure + data\n * residency actually want. Cost: more artifacts (org-count × days).\n \n REJECTED as weakest: per-HOUR windowing — only makes cap-hits rarer (24× more\n * files) without addressing the root cause; a pathological hour still truncates.\n \n DONE (2026-08-05), no longer a rider: {@link collectWindowRecords} now uses KEYSET\n * paging on the `(createdAt, eventId)` tuple, closing the boundary-tie SKIP that offset\n * paging over the non-unique `createdAt` could not. The sibling\n * `immudb.audit-reconcile` batch pages the same way. Only the cap below remains.\n /\nconst MAX_RECORDS_PER_WINDOW = 100_000;\n\n/\n Trailing day-windows (re)written each steady-state tick. On a daily cron one\n * new day crosses the horizon per tick; re-writing the last two crossed days\n * self-heals a single missed tick via idempotent overwrite. Overridable per-run\n * (`lookbackDaysOverride`) for cold-start backfills.\n /\nconst DEFAULT_LOOKBACK_DAYS = 2;\n\n/\n Absolute ceiling on day-windows processed in one run — bounds a backfill\n * invocation. Matches the max `archiveAfterDays` (2555 ≈ 7y) so a full-history\n * backfill fits one run; most historical days are empty and skipped cheaply.\n /\nconst MAX_LOOKBACK_DAYS = 2555;\n\n/\n How far BEYOND the look-back the tick probes for MISSING artifacts (the gap-healing sweep).\n \n The look-back above unconditionally re-writes the newest few archivable days. Anything older\n * that a tick missed used to stay missing forever: the batch keeps zero cross-run state, so\n * nothing recorded that a day was skipped, and an operator had to notice and run an explicit\n * `lookbackDaysOverride` backfill.\n \n Progress is instead DERIVED FROM THE ARTIFACTS THEMSELVES — the only durable record that is\n * already guaranteed to exist, and the one that keeps working when immudb is not configured (the\n * reason this batch has no checkpoint store; see the header). For each day in this trailing span\n * the tick asks storage whether the day's deterministic artifact key exists, and archives only the\n * days that are missing.\n \n Bounded on purpose: a probe is one cheap metadata lookup, but an unbounded sweep would grow with\n * the app's whole history on every nightly tick. Gaps older than this span remain an explicit\n * `lookbackDaysOverride` operation, exactly as before.\n /\nconst DEFAULT_BACKFILL_PROBE_DAYS = 90;\n\n// ═══════════════════════════════════════════════════════════════════════════\n// Input / Output schemas\n// ═══════════════════════════════════════════════════════════════════════════\n\n/\n Optional per-tick overrides for manual `runOnce` triggers. Both narrow the\n * batch for one-shot operator gestures without touching app config.\n /\nexport const AuditLogsArchiveBatchInputSchema = z.object({\n /* One-shot archival horizon override (days). Falls back to app config. /\n archiveAfterDaysOverride: z.number().int().min(1).max(2555).optional(),\n /* One-shot look-back width override (days) — for cold-start backfills. /\n lookbackDaysOverride: z.number().int().min(1).max(MAX_LOOKBACK_DAYS).optional(),\n /\n One-shot width override (days) for the missing-artifact probe sweep that runs BEYOND the\n * look-back. `0` disables the sweep for this run (pure look-back behaviour).\n /\n backfillProbeDaysOverride: z.number().int().min(0).max(MAX_LOOKBACK_DAYS).optional(),\n}).strict();\nexport type AuditLogsArchiveBatchInput = z.infer<typeof AuditLogsArchiveBatchInputSchema>;\n\n/\n Run summary covering the happy path, the two no-op paths (disabled / no\n * storage), and the failure path.\n /\nexport const AuditLogsArchiveBatchOutputSchema = z.object({\n /* Wall-clock ISO timestamp when the body started. /\n tickAt: z.string().datetime(),\n /* Whether an archival horizon was configured/overridden (opt-in resolved). /\n enabled: z.boolean(),\n /* Effective archival horizon applied this tick (days), or null when disabled. /\n archiveAfterDays: z.number().int().nullable(),\n /* ISO cutoff — records with `createdAt < horizonAt` were archival-eligible. /\n horizonAt: z.string().datetime().nullable(),\n /* Whether a storage provider was configured (false ⇒ no-op). /\n storageConfigured: z.boolean(),\n /* Trailing day-windows considered this run. /\n lookbackDays: z.number().int().min(0),\n /* Width (days) of the missing-artifact probe sweep beyond the look-back. /\n backfillProbeDays: z.number().int().min(0),\n /\n Days in the probe span whose artifact was ABSENT and were therefore archived by the sweep.\n * A persistently non-zero value means ticks are being missed — surfaced rather than silent.\n /\n windowsBackfilled: z.number().int().min(0),\n /* Day-windows scanned (some may have had zero rows and produced no artifact). /\n windowsScanned: z.number().int().min(0),\n /* Day-windows that produced (overwrote) an archival artifact. /\n windowsArchived: z.number().int().min(0),\n /* Total audit records written across all artifacts this run. /\n recordsArchived: z.number().int().min(0),\n /* Windows that hit {@link MAX_RECORDS_PER_WINDOW} and were archived partial. /\n truncatedWindows: z.number().int().min(0),\n /* Tick-level failure message — non-null only when a scan/upload threw. /\n error: z.string().nullable(),\n durationMs: z.number().int().min(0),\n});\nexport type AuditLogsArchiveBatchOutput = z.infer<typeof AuditLogsArchiveBatchOutputSchema>;\n\n// ═══════════════════════════════════════════════════════════════════════════\n// Internals\n// ═══════════════════════════════════════════════════════════════════════════\n\n/* Shape the paginated AUDIT_LOGS `list` resolves to. /\ninterface AuditLogsListPage {\n data: AuditableEvent[];\n pagination?: { totalPages?: number };\n}\n\n/\n Human-readable one-line message for the batch OUTPUT's `error` field (the\n * output schema types it as a plain `string`).\n \n Delegates to the shared {@link describeCaughtError} rather than an inline\n * `instanceof Error` ternary, which would persist every structured\n * `WildoError_Backend` as the literal `'[object Object]'`. The log line pairs\n * this with {@link projectCaughtErrorLogFields} for the full queryable detail.\n /\nfunction formatError(err: unknown): string {\n return describeCaughtError(err);\n}\n\n/* Midnight-UTC start of the day containing `d`. /\nfunction startOfUtcDay(d: Date): Date {\n return new Date(Date.UTC(d.getUTCFullYear(), d.getUTCMonth(), d.getUTCDate()));\n}\n\nfunction addDays(d: Date, n: number): Date {\n return new Date(d.getTime() + n MS_PER_DAY);\n}\n\n/** `YYYY-MM-DD` key for a midnight-UTC day-start. /\nfunction dayKey(dayStart: Date): string {\n return dayStart.toISOString().slice(0, 10);\n}\n\n/\n Resolve the effective archival horizon (days). First non-undefined wins:\n * per-tick override → `AppConfiguration.auditTrail.archiveAfterDays` → none\n * (undefined ⇒ archival disabled). Read at TICK time so an in-place config\n * change takes effect on the next run without a redeploy.\n /\nfunction resolveArchiveAfterDays(\n override: number \| undefined,\n appConfigService: AppConfigurationService,\n): number \| undefined {\n if (typeof override === 'number') return override;\n const fromConfig = appConfigService.config?.auditTrail?.archiveAfterDays;\n return typeof fromConfig === 'number' ? fromConfig : undefined;\n}\n\n// ═══════════════════════════════════════════════════════════════════════════\n// Batch Service\n// ═══════════════════════════════════════════════════════════════════════════\n\nexport const auditLogsArchiveBatchService: BatchesCronjobsCustomExecution_Service<\n typeof AuditLogsArchiveBatchInputSchema,\n typeof AuditLogsArchiveBatchOutputSchema\n> = createCustomBatchExecutionService({\n input: AuditLogsArchiveBatchInputSchema,\n output: AuditLogsArchiveBatchOutputSchema,\n batchCronjob_Context: {\n // Scope-anchored @ APPLICATION: cross-org archival, no honest single target\n // resource (mirrors the reconcile / SIEM anchoring). `cronJobExpression` is\n // what actually SCHEDULES the run (sourced from the manifest so schedule +\n // spec cross-validation share ONE literal); omitting it would register the\n // batch but never fire it.\n kind: ENGINE_AUDIT_LOGS_ARCHIVE_BATCH_MANIFEST.kind,\n operationIdentifier: ENGINE_AUDIT_LOGS_ARCHIVE_BATCH_MANIFEST.operationIdentifier,\n primaryScope: ENGINE_AUDIT_LOGS_ARCHIVE_BATCH_MANIFEST.primaryScope,\n cronJobExpression: ENGINE_AUDIT_LOGS_ARCHIVE_BATCH_MANIFEST.cronExpression,\n },\n resolveDependencies: ({ get }) => ({\n appConfigService: get<AppConfigurationService>(SAAS_SERVICE_TYPES.AppConfigService),\n fileStorageRouter: get<FileStorageRouterBackendService>(SAAS_SERVICE_TYPES.FileStorageRouter),\n }),\n doHandle: async (\n input,\n {\n logger,\n repositoriesRegistry,\n executionContextCreator,\n dependencies,\n },\n ) => {\n const startTime = Date.now();\n const tickAt = new Date(startTime).toISOString();\n const logDebug = logger.debugByType('AuditLogsArchiveBatch');\n const { appConfigService, fileStorageRouter } = dependencies;\n\n // Mutable run state, hoisted OUT of the try so the never-throws catch reports\n // HONEST partial progress: artifacts uploaded before a mid-loop failure are\n // real (persisted, idempotent), so the failure summary must reflect them —\n // not reset to zero. Mirrors the reconcile batch's \"return what was\n // accumulated\" contract.\n let enabled = false;\n let archiveAfterDays: number \| null = null;\n let horizonAt: string \| null = null;\n let storageConfigured = false;\n let lookbackDays = 0;\n let backfillProbeDays = 0;\n let windowsScanned = 0;\n let windowsArchived = 0;\n let windowsBackfilled = 0;\n let recordsArchived = 0;\n let truncatedWindows = 0;\n\n const summary = (error: string \| null = null): AuditLogsArchiveBatchOutput => ({\n tickAt,\n enabled,\n archiveAfterDays,\n horizonAt,\n storageConfigured,\n lookbackDays,\n backfillProbeDays,\n windowsScanned,\n windowsArchived,\n windowsBackfilled,\n recordsArchived,\n truncatedWindows,\n error,\n durationMs: Date.now() - startTime,\n });\n\n try {\n // 1. Opt-in gate. Undefined horizon ⇒ archival disabled (retain in DB\n // indefinitely). Emit a tick log so the cron's liveness is observable.\n const resolvedArchiveAfterDays = resolveArchiveAfterDays(input.archiveAfterDaysOverride, appConfigService);\n if (resolvedArchiveAfterDays === undefined) {\n logger.info('[audit] archive tick complete (archival disabled — auditTrail.archiveAfterDays unset)', { tickAt });\n return summary();\n }\n enabled = true;\n archiveAfterDays = resolvedArchiveAfterDays;\n\n // 2. Storage gate. Without a configured storage provider there is nowhere\n // to write; warn + no-op (never throw).\n if (!fileStorageRouter.isConfigured()) {\n logger.warn('[audit] archival is enabled but no file-storage provider is configured — skipping archival tick', {\n tickAt,\n archiveAfterDays,\n });\n return summary();\n }\n storageConfigured = true;\n // Prefer Wildo-managed, fall back to local-directory — the first\n // configured of the two the router knows about.\n const storageProvider = fileStorageRouter.resolveProvider([\n FileStorageAccepted.WILDO_MANAGED,\n FileStorageAccepted.LOCAL_DIRECTORY,\n ]);\n\n // 3. Compute the archivable day-window range. `horizon` is the age\n // cutoff; the most-recent FULLY-archivable day is the one ending at\n // the start of the horizon's day (the horizon's own day is only\n // partially older than the cutoff, so it is not archived yet).\n const horizon = new Date(startTime - resolvedArchiveAfterDays MS_PER_DAY);\n horizonAt = horizon.toISOString();\n const dmaxStart = addDays(startOfUtcDay(horizon), -1);\n lookbackDays = Math.min(\n Math.max(input.lookbackDaysOverride ?? DEFAULT_LOOKBACK_DAYS, 1),\n MAX_LOOKBACK_DAYS,\n );\n // The probe sweep sits BEYOND the look-back, and the pair is capped together so a wide\n // `lookbackDaysOverride` backfill cannot also drag a full probe span along behind it.\n backfillProbeDays = Math.min(\n Math.max(input.backfillProbeDaysOverride ?? DEFAULT_BACKFILL_PROBE_DAYS, 0),\n Math.max(MAX_LOOKBACK_DAYS - lookbackDays, 0),\n );\n\n // Internal APP_ADMIN_SUPER_ADMIN @ APPLICATION context for the AUDIT_LOGS\n // read — mirrors the reconcile batch. No org id + `excludeContextualFilter`\n // on the read ⇒ the scan spans EVERY org's rows.\n //\n // Resolved through the canonical repository seam, NOT a hand-rolled\n // `ResourceConfiguration_OperationPath`. Operation defaults are\n // variant-type-LOCAL and AUDIT_LOGS declares its LIST `REPOSITORY_ONLY`\n // variant `isDefault: false`, so a literal\n // `{ variantType: REPOSITORY_ONLY, isOperationDefault: true }` path matches\n // NOTHING and throws. That literal used to sit here and was latent only\n // because the archival opt-in gate above returns before reaching it whenever\n // `auditTrail.archiveAfterDays` is unset — enabling archival would have\n // surfaced it immediately. The sibling reconcile batch (no such gate) threw on\n // every run. See `immudb-audit-reconcile.batch.backend.service.ts`.\n const executionContext = await executionContextCreator.createForInternalRepositoryOperation({\n resourceType: CoreResourceType.AUDIT_LOGS,\n operationIdentifier: CoreResourceOperation.LIST,\n contextResourcesFieldIdentifier: new Map(),\n initiatorIds: null,\n initiatorRoles: [\n { roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], relatedPrimaryScope: ResourcePrimaryScope.APPLICATION },\n ],\n });\n const auditRepo = repositoriesRegistry.getRepositoryOrThrow(CoreResourceType.AUDIT_LOGS, executionContext);\n\n const applicationId = executionContext.applicationId \|\| appConfigService.applicationId;\n\n // The day offsets processed this tick, oldest → newest so partial-run progress covers the\n // oldest un-archived days first.\n //\n // Two bands with DIFFERENT semantics:\n // - look-back band (offsets 0…lookbackDays-1): ALWAYS re-scanned and re-written. Recent\n // days are cheap and this is what self-heals a single missed tick.\n // - probe band (older): re-scanned ONLY when the day's artifact is missing. This is the\n // gap-healing sweep — it derives progress from the artifacts instead of cross-run state,\n // so a tick missed weeks ago is repaired automatically instead of silently persisting.\n const probeBandStart = lookbackDays;\n const probeBandEnd = lookbackDays + backfillProbeDays; // exclusive\n const offsets: number[] = [];\n for (let i = probeBandEnd - 1; i >= probeBandStart; i -= 1) offsets.push(i);\n for (let i = lookbackDays - 1; i >= 0; i -= 1) offsets.push(i);\n\n for (const i of offsets) {\n const windowStart = addDays(dmaxStart, -i);\n const windowEnd = addDays(windowStart, 1);\n const isProbeBand = i >= probeBandStart;\n\n if (isProbeBand) {\n // One cheap metadata lookup decides whether this old day needs any work at all. An\n // already-archived non-empty day costs exactly this probe and nothing more.\n const exists = await archiveArtifactExists({\n storageProvider,\n executionContext,\n day: dayKey(windowStart),\n });\n if (exists) continue;\n }\n\n windowsScanned += 1;\n\n const { records, truncated } = await collectWindowRecords(auditRepo, executionContext, windowStart, windowEnd);\n if (records.length === 0) {\n // Empty day ⇒ no artifact (keeps historical backfill cheap). NOTE this is why the probe\n // cannot distinguish \"never archived\" from \"archived nothing\": an empty day is re-scanned\n // by every sweep. That scan is a single zero-row query, deliberately preferred over\n // writing empty marker artifacts just to satisfy the probe.\n continue;\n }\n if (truncated) {\n truncatedWindows += 1;\n // No silent caps: dropping records from an archive artifact must be\n // loud. The source rows are NOT lost (they stay in AUDIT_LOGS + immudb)\n // — the day's artifact is merely incomplete. An operator seeing this\n // should narrow to per-hour windows (future enhancement).\n logger.warn(\n '[audit] archive day-window hit the per-window record cap — artifact is INCOMPLETE for this day '\n + '(source rows retained in AUDIT_LOGS; the newest rows past the cap are omitted from the artifact)',\n { day: dayKey(windowStart), cap: MAX_RECORDS_PER_WINDOW, archived: records.length },\n );\n }\n\n await uploadWindowArtifact({\n storageProvider,\n executionContext,\n applicationId,\n windowStart,\n windowEnd,\n archivedAt: tickAt,\n records,\n truncated,\n });\n\n windowsArchived += 1;\n recordsArchived += records.length;\n if (isProbeBand) {\n windowsBackfilled += 1;\n // A gap the steady-state look-back could never have reached. Report it: a recurring\n // count here means ticks are being missed, which is worth an operator's attention even\n // though the sweep repaired it.\n logger.warn('[audit] archived a MISSING historical day-window (gap-healing sweep) — ticks may be being missed', {\n day: dayKey(windowStart),\n recordCount: records.length,\n });\n }\n logDebug('Archived audit day-window', {\n day: dayKey(windowStart),\n recordCount: records.length,\n truncated,\n backfilled: isProbeBand,\n });\n }\n\n logger.info('[audit] archive tick complete', {\n tickAt,\n archiveAfterDays,\n horizonAt,\n lookbackDays,\n backfillProbeDays,\n windowsScanned,\n windowsArchived,\n windowsBackfilled,\n recordsArchived,\n truncatedWindows,\n });\n\n return summary();\n } catch (error) {\n // Top-level guard: never throw onto the batch runner. Return the summary\n // with progress accumulated so far (artifacts already uploaded are real);\n // the next tick retries the same trailing windows (idempotent overwrite).\n const message = formatError(error);\n logger.error?.('[audit] audit-logs archive batch failed (non-fatal, returning partial summary)', {\n ...projectCaughtErrorLogFields(error),\n tickAt,\n });\n return summary(message);\n }\n },\n});\n\n// ═══════════════════════════════════════════════════════════════════════════\n// Helpers\n// ═══════════════════════════════════════════════════════════════════════════\n\n/*\n Page through one day-window `[windowStart, windowEnd)` of AUDIT_LOGS and\n * accumulate its rows (cross-org, `createdAt` ASC for deterministic artifact\n * content). Stops at {@link MAX_RECORDS_PER_WINDOW} (flagging `truncated`) so a\n * pathological day can't OOM the batch. Throws on repository failure — the\n * caller's top-level guard records it on `outputData.error`.\n \n Paging is KEYSET on `(createdAt, eventId)` (2026-08-05), not offset-based.\n \n It used to be `skip = (page-1)limit` over the NON-unique `createdAt`. When more rows\n than the page size share one millisecond across a page boundary, the store may order\n * those ties differently between the two page queries — so a boundary row could be\n * served on BOTH pages (duplicated) or on NEITHER (silently dropped from the artifact).\n * Dedupe by `eventId` covered the duplicate half; the dropped half was unrecoverable.\n \n This was previously written off as \"negligible in practice (needs 100+ events in one\n * millisecond)\". That condition is real: an application boot burst wrote 404 audit rows\n * in a single millisecond, which permanently stranded 305 records in the sibling\n * `immudb.audit-reconcile` batch before it was converted to the same keyset scan. Boot,\n * seeding and migration paths emit audit rows in tight loops — that is exactly when a\n * day-window archive matters most.\n \n The `(createdAt, eventId)` tuple is unique and totally ordered, so no row can now fall\n * between two pages in either direction. The `eventId` half depends on it being present\n * in the AUDIT_LOGS LIST `sortFields` (pinned by the resource-config test); a non-empty\n * whitelist makes the repository DROP unlisted sort keys silently, so removing it would\n * restore the defect without any error. The `seen` dedupe and the no-progress guard\n * remain as backstops for exactly that degradation.\n \n Residual (unchanged): a window exceeding {@link MAX_RECORDS_PER_WINDOW} is still\n * truncated, and the source rows always remain in AUDIT_LOGS regardless.\n /\n/\n Does the archival artifact for `day` already exist in storage?\n \n This is how the batch derives progress WITHOUT any cross-run state: the artifacts are the\n * record. It must address the blob exactly as {@link uploadWindowArtifact} wrote it, and it does\n * so WITHOUT re-implementing any provider path logic — the composite\n * `<folderPath>/<fileName>` is handed over as the `fileId` and each provider applies its OWN\n * composition, the same one its `upload` used:\n \n - wildo-managed: `upload` builds `effectiveFileId = folderPath/fileName` and calls\n * `resolveApplicationObjectKey(effectiveFileId, ctx)`; `getMetadata` calls that identical\n * resolver with `file.fileId`.\n * - local-directory: `upload` calls `composeStorageKey(fileId, ctx, options)`; `getMetadata` with\n * no `storageRef` calls that same method with `file.fileId` and no options.\n \n Both therefore land on the byte-identical key — and since 2026-09-09 on the SAME key as each\n * other, because both route through `application-storage-key.backend.utils`. The one coupling is\n * `includeApplicationId: true` on the upload — flip that and the probe would address a different\n * blob, so the two must move together.\n \n Parity is pinned in each provider's OWN suite (upload, then `getMetadata` with no ref, against a\n * real store). It is NOT pinned here: this batch's tests drive a fake provider that stores and\n * probes `<folderPath>/<fileName>` by construction, so it agrees with itself whatever the real\n * providers do. An earlier revision of this comment claimed \"pinned by the key-parity test\"; no\n * such test existed.\n \n FAIL-SAFE DIRECTION: any failure — genuinely absent, or a transient storage fault — answers\n * `false`, i.e. \"archive it\". Re-archiving is harmless by construction (the artifact key is\n * deterministic and the write overwrites), whereas a false `true` would silently skip a day and\n * recreate the very gap this sweep exists to close.\n /\nasync function archiveArtifactExists(args: {\n storageProvider: ReturnType<FileStorageRouterBackendService['resolveProvider']>;\n executionContext: Awaited<ReturnType<ExecutionContextCreatorBackendService['createForInternalRepositoryOperation']>>;\n day: string;\n}): Promise<boolean> {\n const { storageProvider, executionContext, day } = args;\n try {\n await storageProvider.getMetadata(\n {\n fileId: `${AUDIT_ARCHIVE_FOLDER}/audit-archive-${day}.json`,\n storageProvider: undefined,\n storageRef: undefined,\n } as unknown as Parameters<typeof storageProvider.getMetadata>[0],\n executionContext,\n );\n return true;\n } catch {\n return false;\n }\n}\n\nasync function collectWindowRecords(\n auditRepo: ReturnType<RepositoriesRegistryHandlerBackendService['getRepositoryOrThrow']>,\n executionContext: Awaited<ReturnType<ExecutionContextCreatorBackendService['createForInternalRepositoryOperation']>>,\n windowStart: Date,\n windowEnd: Date,\n): Promise<{ records: AuditableEvent[]; truncated: boolean }> {\n const windowBound = { createdAt: { $gte: windowStart, $lt: windowEnd } };\n const records: AuditableEvent[] = [];\n const seen = new Set<string>();\n let truncated = false;\n /* Keyset position: the `(createdAt, eventId)` of the last row consumed. /\n let cursor: { createdAt: Date; eventId: string } \| null = null;\n\n for (let page = 1; page <= MAX_PAGES_PER_WINDOW; page += 1) {\n // KEYSET lower bound, ANDed with the day window. `$and`/`$or` are both translated by the\n // Mongo and PostgreSQL adapters, so the predicate is portable.\n const filter: Record<string, unknown> = cursor === null\n ? windowBound\n : {\n $and: [\n windowBound,\n {\n $or: [\n { createdAt: { $gt: cursor.createdAt } },\n { createdAt: cursor.createdAt, eventId: { $gt: cursor.eventId } },\n ],\n },\n ],\n };\n\n // Page is pinned to 1: the cursor — not an offset — is what advances. Offset paging over a\n // NON-unique sort key was the defect (see the boundary-tie note above); with `skip`, ties\n // straddling a page boundary could be served on both pages (deduped below) or on NEITHER\n // (unrecoverable). `sort` is honored because AUDIT_LOGS' LIST whitelists BOTH `createdAt`\n // and `eventId` in its sortFields — drop `eventId` there and the tie-break silently\n // disappears, restoring the skip. Typed to the `_doList` contract, structurally compatible\n // with the public overload.\n const listOptions: { page: number; limit: number; sort: Record<string, 1 \| -1> } = {\n page: 1,\n limit: PAGE_SIZE,\n sort: { createdAt: 1, eventId: 1 },\n };\n const result = (await auditRepo.list(executionContext, filter, {\n paginated: true,\n // Cross-org archival: bypass the contextual org filter so EVERY org's rows\n // for this day are captured, not just a caller's org.\n excludeContextualFilter: true,\n listOptions,\n })) as unknown as AuditLogsListPage;\n\n const rows = result.data ?? [];\n if (rows.length === 0) break;\n\n const cursorBeforePage = cursor;\n\n for (const row of rows) {\n // Dedupe by stable identity. Keyset paging makes a cross-page duplicate unreachable in\n // normal operation, so this is now a defensive backstop against a degraded sort rather\n // than the primary protection it used to be. A row with no identity at all (never\n // expected — persisted rows carry `_id`) is treated as distinct rather than silently\n // collapsed.\n const key = String((row as { eventId?: string; _id?: string }).eventId\n ?? (row as { _id?: string })._id ?? '');\n if (key && seen.has(key)) continue;\n if (records.length >= MAX_RECORDS_PER_WINDOW) {\n truncated = true;\n break;\n }\n if (key) seen.add(key);\n records.push(row);\n\n // Advance only on a COMPLETE tuple: a row missing either half cannot express a keyset\n // position, and inventing a partial one would step over its neighbours. Leaving the cursor\n // put means the no-progress guard below ends the scan instead.\n const rowCreatedAt = row.createdAt instanceof Date ? row.createdAt : new Date(String(row.createdAt));\n const rowEventId = (row as { eventId?: unknown }).eventId;\n if (!Number.isNaN(rowCreatedAt.getTime()) && typeof rowEventId === 'string') {\n cursor = { createdAt: rowCreatedAt, eventId: rowEventId };\n }\n }\n if (truncated) break;\n\n // Defensive no-progress guard: with a valid `(createdAt, eventId)` sort every page strictly\n // advances the cursor. Failing to advance means the ordering was degraded or the page held\n // no usable tuple — stop rather than re-issue an identical query forever.\n if (\n cursor !== null &&\n cursorBeforePage !== null &&\n cursor.createdAt.getTime() === cursorBeforePage.createdAt.getTime() &&\n cursor.eventId === cursorBeforePage.eventId\n ) {\n break;\n }\n\n if (rows.length < PAGE_SIZE) break;\n }\n\n return { records, truncated };\n}\n\n/\n Serialise a day-window's records to a self-describing JSON artifact and upload\n * it to the DETERMINISTIC key `audit-archive/[applicationId/]audit-archive-<day>.json`\n * (overwrite = idempotent). JSON (not CSV) is used deliberately: audit events\n * carry nested metadata that CSV would flatten lossily.\n */\nasync function uploadWindowArtifact(args: {\n storageProvider: ReturnType<FileStorageRouterBackendService['resolveProvider']>;\n executionContext: Awaited<ReturnType<ExecutionContextCreatorBackendService['createForInternalRepositoryOperation']>>;\n applicationId: string \| undefined;\n windowStart: Date;\n windowEnd: Date;\n archivedAt: string;\n records: AuditableEvent[];\n truncated: boolean;\n}): Promise<void> {\n const { storageProvider, executionContext, applicationId, windowStart, windowEnd, archivedAt, records, truncated } = args;\n const day = dayKey(windowStart);\n\n const payload = {\n schemaVersion: 1 as const,\n kind: 'audit-log-archive' as const,\n // Self-describing provenance: the artifact is also namespaced under the\n // applicationId in its storage path (includeApplicationId), but embedding it\n // keeps a portable artifact identifiable without parsing the path.\n applicationId: applicationId ?? null,\n dayWindowUtc: day,\n windowStart: windowStart.toISOString(),\n windowEnd: windowEnd.toISOString(),\n archivedAt,\n recordCount: records.length,\n truncated,\n records,\n };\n const buffer = Buffer.from(JSON.stringify(payload), 'utf-8');\n\n await storageProvider.upload(\n Readable.from([buffer]),\n // Random valid resource id satisfies `validateFileId`; the DETERMINISTIC key\n // comes from `fileName` (the providers use it as the blob leaf), so the id\n // never affects the storage location or the overwrite semantics.\n randomUUID(),\n 'application/json',\n buffer.byteLength,\n executionContext,\n {\n folderPath: AUDIT_ARCHIVE_FOLDER,\n fileName: `audit-archive-${day}.json`,\n includeApplicationId: true,\n },\n );\n}\n"]}

package/dist/esm/compliance/audit-trails/batches/immudb-audit-reconcile.batch.backend.service.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"immudb-audit-reconcile.batch.backend.service.d.ts","sourceRoot":"","sources":["~~../../../../../../~~src/compliance/audit-trails/batches/immudb-audit-reconcile.batch.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAYxB,OAAO,EAEL,KAAK,sCAAsC,EAC5C,MAAM,4FAA4F,CAAC;AA4CpG;;;;GAIG;AACH,eAAO,MAAM,oCAAoC,gCAAe,CAAC;AACjE,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG;;;;;;;GAOG;AACH,eAAO,MAAM,qCAAqC;;;iBAGhD,CAAC;AACH,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AAiIpG,eAAO,MAAM,gCAAgC,EAAE,sCAAsC,CACnF,OAAO,oCAAoC,EAC3C,OAAO,qCAAqC,CAwH5C,CAAC"}
1	+ {"version":3,"file":"immudb-audit-reconcile.batch.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/audit-trails/batches/immudb-audit-reconcile.batch.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAYxB,OAAO,EAEL,KAAK,sCAAsC,EAC5C,MAAM,4FAA4F,CAAC;AA4CpG;;;;GAIG;AACH,eAAO,MAAM,oCAAoC,gCAAe,CAAC;AACjE,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG;;;;;;;GAOG;AACH,eAAO,MAAM,qCAAqC;;;iBAGhD,CAAC;AACH,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AAiIpG,eAAO,MAAM,gCAAgC,EAAE,sCAAsC,CACnF,OAAO,oCAAoC,EAC3C,OAAO,qCAAqC,CAwH5C,CAAC"}

package/dist/esm/compliance/audit-trails/batches/siem-webhook-delivery.batch.backend.service.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"siem-webhook-delivery.batch.backend.service.d.ts","sourceRoot":"","sources":["~~../../../../../../~~src/compliance/audit-trails/batches/siem-webhook-delivery.batch.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,aAAa,EAEd,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAEL,KAAK,sCAAsC,EAC5C,MAAM,4FAA4F,CAAC;AAYpG;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAuB9C,CAAC;AAEH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG;;;;;;GAMG;AACH,eAAO,MAAM,oCAAoC;;;;;;iBAM/C,CAAC;AAEH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAqBlG,eAAO,MAAM,+BAA+B,EAAE,sCAAsC,CAClF,OAAO,mCAAmC,EAC1C,OAAO,oCAAoC,CAsD3C,CAAC"}
1	+ {"version":3,"file":"siem-webhook-delivery.batch.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/audit-trails/batches/siem-webhook-delivery.batch.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,aAAa,EAEd,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAEL,KAAK,sCAAsC,EAC5C,MAAM,4FAA4F,CAAC;AAYpG;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAuB9C,CAAC;AAEH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG;;;;;;GAMG;AACH,eAAO,MAAM,oCAAoC;;;;;;iBAM/C,CAAC;AAEH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAqBlG,eAAO,MAAM,+BAA+B,EAAE,sCAAsC,CAClF,OAAO,mCAAmC,EAC1C,OAAO,oCAAoC,CAsD3C,CAAC"}

package/dist/esm/compliance/audit-trails/services/__tests__/mock-audit-logs.service.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"mock-audit-logs.service.d.ts","sourceRoot":"","sources":["~~../../../../../../../~~src/compliance/audit-trails/services/__tests__/mock-audit-logs.service.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,kBAAkB,CAAC;AAI1B,KAAK,iBAAiB,GAAG;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,EAAE,CAAC;CACjB,CAAC;AAEF,qBACa,oBAAoB;IAC/B,QAAQ,CAAC,KAAK,EAAE,iBAAiB,EAAE,CAAM;IAEzC,OAAO,CAAC,UAAU;IAIlB,YAAY,kDAET;IAEH,eAAe,kDAEZ;IAEH,qBAAqB,kDAElB;IAEH,YAAY,kDAET;IAEH,wBAAwB,kDAErB;IAEH,sBAAsB,kDAEnB;IAEH,KAAK,IAAI,IAAI;CASd"}
1	+ {"version":3,"file":"mock-audit-logs.service.d.ts","sourceRoot":"","sources":["../../../../../../src/compliance/audit-trails/services/__tests__/mock-audit-logs.service.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,kBAAkB,CAAC;AAI1B,KAAK,iBAAiB,GAAG;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,EAAE,CAAC;CACjB,CAAC;AAEF,qBACa,oBAAoB;IAC/B,QAAQ,CAAC,KAAK,EAAE,iBAAiB,EAAE,CAAM;IAEzC,OAAO,CAAC,UAAU;IAIlB,YAAY,kDAET;IAEH,eAAe,kDAEZ;IAEH,qBAAqB,kDAElB;IAEH,YAAY,kDAET;IAEH,wBAAwB,kDAErB;IAEH,sBAAsB,kDAEnB;IAEH,KAAK,IAAI,IAAI;CASd"}

package/dist/esm/compliance/audit-trails/services/audit-event-dispatcher.backend.service.d.ts CHANGED Viewed

@@ -16,6 +16,55 @@ import { RepositoriesRegistryHandlerBackendService } from '../../../base-classes
 import { QueueBackendService } from '../../../queue/queue.backend.service';
 import { type SecurityAuditEventEnvelope, type AuditableEvent, type SiemExportConfigBase, AuthScopeType } from '@wildo-ai/saas-models';
 import type { ExecutionContext } from '../../../runtime/models/execution-context.backend.schemas';
+import type { RedisService } from '../../../databases/services/redis.service';
+/**
+ * **A SIEM export configuration change takes effect on EVERY replica within 60 seconds — and within
+ * milliseconds when the change goes through the engine.**
+ *
+ * That sentence is the guarantee this subsystem makes, and the two halves come from two different
+ * mechanisms, so read both before changing either.
+ *
+ * ## Why the number is 60 seconds, and why it used to be 300
+ *
+ * The lease is the ONLY thing that covers a write no hook can see — a repository-tier write, or a
+ * direct database write. There is a live one: `examples/wonder-todos/e2e/adapter.ts` (`case 'siem'`)
+ * repoints an organization's export config with `upsertOrganizationSingleton(...)`, straight at the
+ * store, bypassing the engine entirely. Its own comment records what the old 300 s cost — *"A freshly
+ * provisioned org has a cold 5-min config cache, so the first login cold-reads this"* — i.e. the lane
+ * is correct only because it is ORDERED to run before the organization's first audited action. A
+ * five-minute convergence bound is not something a scenario, or an operator doing surgery, can wait
+ * for; it is something they have to design around. Sixty seconds is something they can wait for.
+ *
+ * The old 300 s was never chosen for that job — it was chosen to bound READ AMPLIFICATION, because a
+ * miss costs more than a repository read: `AuthOrganizationConfigurationService.loadSiemExportConfig`
+ * reads through `readAsSystem`, which emits its own `system_context_read` audit row to the database
+ * AND to immudb. So shortening the lease multiplies audit-trail plumbing noise, not just queries.
+ * Two properties make 60 s affordable anyway:
+ *
+ * - **Refreshes are LAZY and STALE-WHILE-REVALIDATE** ({@link LeasedValueCache}). A quiet organization
+ *   costs one read per event, not one per minute; only a continuously busy one reaches the ceiling of
+ *   one read per lease per replica. At 60 s that ceiling is 60 reads/hour/replica per ACTIVE
+ *   organization — for an organization emitting 1000 audit events an hour, under 5 % amplification of
+ *   its own audit volume, against 12/hour before.
+ * - **Nothing blocks on it.** Past the lease the cached value is served immediately and the re-read
+ *   runs off the emission path, so shortening it costs read volume and never latency.
+ *
+ * ## The other half: the engine-routed write converges in milliseconds
+ *
+ * {@link AuditEventDispatcherBackendService.invalidateSiemConfig} drops the local entry AND publishes
+ * the organization id on {@link SIEM_CONFIG_INVALIDATION_CHANNEL_SUFFIX}, which every replica
+ * subscribes to. Before that broadcast the invalidation reached exactly ONE process — the one that
+ * happened to handle the write — and every other replica served the stale value for the rest of the
+ * lease, which is the defect this constant's neighbours document.
+ *
+ * **Do not raise this back toward the read-amplification number.** If the amplification ever needs to
+ * come down, the right lever is the `system_context_read` row on the config read itself:
+ * `SystemAccessBackendService.readAsSystem` already takes `suppressSystemAudit`, and its own JSDoc
+ * names this exact read — *"the audit pipeline resolving … an org's SIEM config to ROUTE an audit
+ * event"* — as the case it exists for. `loadSiemExportConfig` is the one such reader that does not
+ * pass it. Fixing that makes a miss cost a single indexed read and removes the constraint entirely.
+ */
+export declare const SIEM_CONFIG_REFRESH_AFTER_MS: number;
 /**
  * The per-org audit sink TYPES an organization can route its authenticated audit
  * events to. Today the only type is the SIEM webhook. Adding a per-org destination
@@ -33,12 +82,48 @@ export declare class AuditEventDispatcherBackendService {
     private readonly orgConfigService;
     private readonly queueService;
     private readonly repositoriesRegistry;
+    /**
+     * `@optional()` and APPENDED LAST — the constructor-parameter discipline.
+     *
+     * Optional because the cross-replica broadcast is an OPTIMISATION over the lease, never a
+     * precondition for routing: a container with no Redis binding (several partial test containers, and
+     * any single-replica deployment) must still dispatch audit events, converging on the lease alone.
+     * Appended last so the five existing construction sites keep compiling unchanged.
+     */
+    private readonly redisService?;
     private readonly logDebug;
-    /** F3: Lightweight org name cache to avoid per-event DB lookups */
+    /**
+     * F3: org NAME cache — a display label on the envelope. See {@link ORG_NAME_REFRESH_AFTER_MS}.
+     *
+     * No `onRefreshFailure`, and it would be dead code if there were one: {@link _resolveOrgName}'s loader
+     * swallows its own error and yields `undefined`, so nothing this cache runs can ever reject. That
+     * swallow is what makes the negative result CACHEABLE, which is the amplification fix described there;
+     * the price is that a persistently unreadable organization row is silent, which is the right trade for
+     * an optional label whose authoritative sibling (`organizationId`) is on the envelope regardless.
+     */
     private readonly _orgNameCache;
-    /** R2: per-org SIEM-config cache — avoids a per-event per-org audited `readAsSystem` config load. */
+    /** R2: per-org SIEM-config cache — the value that decides ROUTING. See {@link SIEM_CONFIG_REFRESH_AFTER_MS}. */
     private readonly _siemConfigCache;
-    constructor(logger: LoggerService, appConfigService: AppConfigurationService, orgConfigService: AuthOrganizationConfigurationService, queueService: QueueBackendService, repositoriesRegistry: RepositoriesRegistryHandlerBackendService);
+    /**
+     * Latch so {@link _ensureInvalidationSubscriber} is idempotent; cleared on `end` so a dropped
+     * subscriber re-arms.
+     *
+     * Deliberately the ONLY subscriber state kept. `A2ATaskCancellationBackendService` also holds the
+     * client itself, because it has a shutdown path that closes it; this service has none, and a field
+     * nothing reads is a field the next reader has to reason about for nothing. The socket keeps the
+     * subscriber alive on its own, and a connection that emitted `end` is already closed.
+     */
+    private _invalidationSubscribeStarted;
+    constructor(logger: LoggerService, appConfigService: AppConfigurationService, orgConfigService: AuthOrganizationConfigurationService, queueService: QueueBackendService, repositoriesRegistry: RepositoriesRegistryHandlerBackendService,
+    /**
+     * `@optional()` and APPENDED LAST — the constructor-parameter discipline.
+     *
+     * Optional because the cross-replica broadcast is an OPTIMISATION over the lease, never a
+     * precondition for routing: a container with no Redis binding (several partial test containers, and
+     * any single-replica deployment) must still dispatch audit events, converging on the lease alone.
+     * Appended last so the five existing construction sites keep compiling unchanged.
+     */
+    redisService?: RedisService);
     /**
      * Dispatch an audit event to the organization's configured per-org audit SINKS.
      *
@@ -104,13 +189,23 @@ export declare class AuditEventDispatcherBackendService {
      */
     private _resolveOrgAuditSinks;
     /**
-     * R2: load the org's SIEM config through a short-TTL cache. Without it,
-     * {@link _resolveOrgAuditSinks} reads the config via a self-elevating `readAsSystem` PER
-     * EVENT PER ORG — and `readAsSystem` ALSO emits a `SYSTEM_CONTEXT_READ` audit — so every
-     * routed audit event (× N orgs on the multi-org fan-out) doubled the audit-write volume to
-     * the DB + immudb. Mirrors {@link _orgNameCache}: an enable/disable/rename takes effect within
-     * the TTL, acceptable for a rarely-changed config. `null` is cached too (an org with no SIEM
-     * config) so a non-configured org is not re-read every event.
+     * R2: load the org's SIEM config through the leased cache.
+     *
+     * Without a cache, {@link _resolveOrgAuditSinks} reads the config via a self-elevating `readAsSystem`
+     * PER EVENT PER ORG — and `readAsSystem` ALSO emits a `SYSTEM_CONTEXT_READ` audit — so every routed
+     * audit event (× N orgs on the multi-org fan-out) doubled the audit-write volume to the DB + immudb.
+     * `null` is cached too (an org whose config load failed) so a non-configured org is not re-read every
+     * event.
+     *
+     * The cache is STALE-WHILE-REVALIDATE ({@link LeasedValueCache}), so only the very first event for an
+     * organization waits on a read; every later one is served from memory while the refresh runs off this
+     * path. That is what lets {@link SIEM_CONFIG_REFRESH_AFTER_MS} be sixty seconds rather than five
+     * minutes — read the guarantee stated there before changing it.
+     *
+     * The loader closes over `ec`, which is the audit service's synthesised super-admin APPLICATION-scoped
+     * temp context (`audit-logs.backend.service.ts:284`, handed here at `:349`) and is therefore equally
+     * privileged on every call — the precondition {@link LeasedValueCache} states for joining an in-flight
+     * load. `loadSiemExportConfig` in fact ignores `ec` entirely (`void ec`) and reads system-context.
      */
     private _loadSiemConfigCached;
     /**
@@ -149,8 +244,55 @@ export declare class AuditEventDispatcherBackendService {
      * organization with no entry — which is the common case, since only organizations that have
      * raised an audit event since the last eviction are in the map at all. Synchronous and
      * infallible on purpose, so the caller needs no error handling.
+     *
+     * ## It reaches EVERY replica, which it did not before
+     *
+     * The local drop above is only ever correct for ONE process — the one that happened to handle the
+     * write. With N replicas behind a load balancer, the other N-1 went on serving the pre-write config
+     * for the rest of the lease, so "the invalidation covers engine-routed writes" was true of a single
+     * instance and false of every real deployment. The broadcast closes that: the organization id goes
+     * out on {@link SIEM_CONFIG_INVALIDATION_CHANNEL_SUFFIX} and every replica's subscriber drops its own
+     * entry within milliseconds.
+     *
+     * The publish is fire-and-forget and cannot fail this call: a broadcast that does not go out degrades
+     * the OTHER replicas to the lease, which is exactly where they were before, and refusing a
+     * configuration write to protect a cache would invert the priority. This method's synchronous,
+     * infallible contract therefore still holds for its caller.
+     *
+     * **What it still does NOT cover, and cannot.** A write that never reaches the service tier — a
+     * repository-tier write, or a direct database write like `examples/wonder-todos/e2e/adapter.ts`'s
+     * `upsertOrganizationSingleton('organizationSiemExportConfig', …)` — raises no postfix hook, so
+     * nothing calls this and nothing is broadcast. For those the lease is the entire guarantee; that is
+     * why it is chosen and argued at {@link SIEM_CONFIG_REFRESH_AFTER_MS} rather than left incidental.
      */
     invalidateSiemConfig(organizationId: string): void;
+    /**
+     * Tell the rest of the fleet to drop this organization's cached SIEM config.
+     *
+     * Returns nothing and awaits nothing — the caller is a postfix write hook whose contract is that it
+     * cannot fail the write it follows.
+     */
+    private _publishSiemConfigInvalidation;
+    /** App-prefixed so two applications sharing one Redis never invalidate each other's caches. */
+    private _invalidationChannel;
+    /**
+     * Arm this replica's single subscriber to the invalidation channel. Idempotent.
+     *
+     * Called (never awaited) from {@link dispatchToOrganizationAuditSinks}, so no startup ordering is
+     * required and nothing has to be wired in `start-application` — the same lazy-arm pattern
+     * `A2ATaskCancellationBackendService.ensureSubscriber` uses, for the same reason.
+     *
+     * Fails OPEN by design: a replica that cannot subscribe still routes audit events, converging on the
+     * lease instead of on the broadcast. The failure is logged at ERROR because a persistent one silently
+     * returns that replica to the per-process behaviour this mechanism exists to remove.
+     *
+     * Two details are copied deliberately rather than reinvented, because each was a recorded defect in
+     * the A2A original: the `end` handler RE-ARMS (a subscriber that connected and then dropped — a Redis
+     * restart, a failover, an idle reap — otherwise stayed dead for the life of the process while every
+     * other signal looked healthy), and the catch DESTROYS a half-built connection (`connect()` can
+     * succeed while `subscribe()` throws, and retrying without destroying leaks one socket per attempt).
+     */
+    private _ensureInvalidationSubscriber;
     /**
      * Deliver one event to an org's SIEM webhook sink: apply the sink's per-event filter,
      * build + HMAC the envelope, and enqueue for async delivery via the SIEM webhook
@@ -206,14 +348,84 @@ export declare class AuditEventDispatcherBackendService {
      * Build a SecurityAuditEventEnvelope from an audit event.
      */
     private _buildEnvelope;
+    /**
+     * The id the DELIVERED envelope carries — the audit row's OWN `eventId`, never a freshly minted one.
+     *
+     * ## Why it must be the audit event's id
+     *
+     * `SecurityAuditEventEnvelope.eventId` is the only identifier that leaves the application on a SIEM
+     * delivery, and it is doing two jobs at once:
+     *
+     *  1. it is what a RECEIVER deduplicates on — the delivery service's own header says "Idempotency via
+     *     eventId", and every wire format carries this one field through to the receiver's dedup key
+     *     (CEF `externalId`, LEEF `eventId`, OCSF `metadata.uid`, and the verbatim `json_structured` body's
+     *     top-level `eventId`); and
+     *  2. it is the only handle an analyst has for joining a record in the customer's SIEM back to the
+     *     audit row it was projected from.
+     *
+     * Minting a fresh uuid here satisfied (1) and silently destroyed (2). The id was ALREADY on the value
+     * being projected: `AuditableEvent.eventId` is minted in `AuditLogsBackendService._createAuditLog`
+     * BEFORE the DB write, is documented on the schema as the "store-agnostic, server-minted correlation
+     * key", and already joins the DB row to its immudb record and to `verifyAuditEvent(eventId)`. It
+     * survives the `Omit` on this method's parameter type, so it was in hand and thrown away — the
+     * envelope replaced it with an id that exists nowhere else in the system, making a delivered SIEM
+     * event deduplicable but unexplainable.
+     *
+     * ## Why the cutover is safe — the risk this looks like it carries, it does not
+     *
+     * Changing what a receiver deduplicates on normally risks re-accepting events at the switch. Not here:
+     * the OLD value was a per-delivery random uuid, never reused and not re-derivable from anything, so
+     * every id crossing the cutover is still one no receiver has ever seen. Nothing is re-delivered and
+     * nothing is newly deduped away.
+     *
+     * What genuinely changes is the FAN-OUT. `AuditLogsBackendService` dispatches one audit event to each
+     * of the user's verified member orgs, so those N deliveries now carry ONE id instead of N. They go to
+     * N different tenants' sinks, so there is no cross-receiver dedup interaction — and one id is the
+     * truthful statement, because it is one event. (The DLQ row records this id too, so a dead letter is
+     * now joinable to its audit row as well; `SiemDeliveryDlqBaseSchema.eventId` carries no unique index,
+     * so the shared id cannot collide there.)
+     *
+     * Per-attempt idempotency is untouched: the envelope is built ONCE, and both the in-process retry loop
+     * in `SIEMWebhookDeliveryBackendService.processDelivery` and the DLQ drain re-send that same stored
+     * object — so one delivery keeps one id across every attempt, which is exactly what a receiver's dedup
+     * needs.
+     *
+     * ## The fallback, and why it is not a hedge
+     *
+     * `eventId` is required on `AuditableEvent` and the sole production caller always sets it, so this
+     * branch should be unreachable. It exists because the two failures are ASYMMETRIC: an absent id is not
+     * merely an unjoinable delivery, it is a delivery with NO dedup key at all — every projection renders
+     * the field only `if (e.eventId)`, so the receiver stores `dedupKey: null` and answers `deduped: false`
+     * forever against a service that retries and drains a DLQ. Losing the join degrades an investigation;
+     * losing idempotency duplicates events inside a customer's SIEM. So an absent id still gets a minted
+     * one, and is logged loudly rather than shipping a blank.
+     */
+    private _resolveEnvelopeEventId;
     /**
      * Infer success/failure outcome from event type.
      */
     private _inferOutcome;
     /**
-     * F3: Resolve organization name with a lightweight in-memory cache.
-     * Cache entries expire after ORG_NAME_CACHE_TTL_MS to pick up renames.
-     * Returns undefined if lookup fails (fire-and-forget context — don't throw).
+     * F3: resolve an organization NAME for SIEM-analyst readability, through the leased cache.
+     *
+     * Renames are picked up within {@link ORG_NAME_REFRESH_AFTER_MS} — read that constant for why this
+     * lease is five minutes while the routing config's is sixty seconds. There is no invalidation hook on
+     * this one, deliberately: a stale label costs a reader nothing (the `organizationId` beside it in the
+     * envelope is authoritative and always current), so the lease alone is a proportionate answer.
+     *
+     * Never throws — a missing name is optional in the envelope, and this runs on a fire-and-forget path.
+     * The loader therefore swallows its own failure and yields `undefined`, which means the COLD path of
+     * {@link LeasedValueCache} can never reject here.
+     *
+     * **`undefined` IS cached, and that is a fix rather than an oversight.** Before this, a lookup that
+     * failed or returned a nameless row cached nothing, so an organization whose read kept failing was
+     * re-read on EVERY exported event — the read amplification a cache exists to prevent, arriving
+     * precisely when the repository is already unhealthy. Caching the negative bounds it to one read per
+     * lease, and a rename or a repaired read still lands within that lease.
+     *
+     * The loader closes over `ec` — the audit service's synthesised super-admin APPLICATION-scoped temp
+     * context (`audit-logs.backend.service.ts:284` → `:349`), identical in privilege on every dispatch —
+     * which is the precondition {@link LeasedValueCache} states for joining an in-flight load.
      */
     private _resolveOrgName;
     /**