@wildo-ai/saas-backend-lib 1.1.3 → 1.1.4

package/dist/esm/compliance/audit-trails/services/composite-audit-log-sink.backend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"composite-audit-log-sink.backend.d.ts","sourceRoot":"","sources":["../../../../../../src/compliance/audit-trails/services/composite-audit-log-sink.backend.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,YAAY,EACZ,qBAAqB,EACrB,6BAA6B,EAC7B,oBAAoB,EACrB,MAAM,uBAAuB,CAAC;AAS/B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,4FAA4F,CAAC;AAC1J,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,0FAA0F,CAAC;AACtJ,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sEAAsE,CAAC;AAa3G;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,qBACa,qBAAsB,YAAW,YAAY;IAMtD,OAAO,CAAC,QAAQ,CAAC,yBAAyB;IAE1C,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IAExC,OAAO,CAAC,QAAQ,CAAC,cAAc;IATjC,oFAAoF;IACpF,OAAO,CAAC,aAAa,CAA8C;gBAIhD,yBAAyB,EAAE,uCAAuC,EAElE,uBAAuB,EAAE,qCAAqC,EAE9D,cAAc,EAAE,cAAc;IAGjD;;;;OAIG;IACH,OAAO,CAAC,cAAc;IAuDtB,2DAA2D;IACpD,QAAQ,IAAI,OAAO;IAI1B;;;;;;;;OAQG;IACI,oBAAoB,IAAI,KAAK,CAAC,YAAY,GAAG,6BAA6B,CAAC;IAUlF;;;;;;;OAOG;IACI,kBAAkB,IAAI,KAAK,CAAC,YAAY,GAAG,oBAAoB,CAAC;IASvE;;;;OAIG;IACU,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC;IAwB1E,mEAAmE;IACtD,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;CAcvC"}
+{"version":3,"file":"composite-audit-log-sink.backend.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/audit-trails/services/composite-audit-log-sink.backend.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,YAAY,EACZ,qBAAqB,EACrB,6BAA6B,EAC7B,oBAAoB,EACrB,MAAM,uBAAuB,CAAC;AAS/B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,4FAA4F,CAAC;AAC1J,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,0FAA0F,CAAC;AACtJ,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sEAAsE,CAAC;AAa3G;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,qBACa,qBAAsB,YAAW,YAAY;IAMtD,OAAO,CAAC,QAAQ,CAAC,yBAAyB;IAE1C,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IAExC,OAAO,CAAC,QAAQ,CAAC,cAAc;IATjC,oFAAoF;IACpF,OAAO,CAAC,aAAa,CAA8C;gBAIhD,yBAAyB,EAAE,uCAAuC,EAElE,uBAAuB,EAAE,qCAAqC,EAE9D,cAAc,EAAE,cAAc;IAGjD;;;;OAIG;IACH,OAAO,CAAC,cAAc;IAuDtB,2DAA2D;IACpD,QAAQ,IAAI,OAAO;IAI1B;;;;;;;;OAQG;IACI,oBAAoB,IAAI,KAAK,CAAC,YAAY,GAAG,6BAA6B,CAAC;IAUlF;;;;;;;OAOG;IACI,kBAAkB,IAAI,KAAK,CAAC,YAAY,GAAG,oBAAoB,CAAC;IASvE;;;;OAIG;IACU,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC;IAwB1E,mEAAmE;IACtD,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;CAcvC"}

package/dist/esm/compliance/audit-trails/services/composite-audit-log-sink.backend.js.map

@@ -1 +1 @@
-{"version":3,"file":"composite-audit-log-sink.backend.js","sourceRoot":"","sources":["../../../../../../src/compliance/audit-trails/services/composite-audit-log-sink.backend.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAOzD;;;;;GAKG;AACH,OAAO,EAAE,2BAA2B,EAAE,MAAM,uDAAuD,CAAC;AACpG,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAIpF,OAAO,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAY3H;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEI,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;IAMb;IAEA;IAEA;IATnB,oFAAoF;IAC5E,aAAa,GAAoC,SAAS,CAAC;IAEnE,YAEmB,yBAAkE,EAElE,uBAA8D,EAE9D,cAA8B;QAJ9B,8BAAyB,GAAzB,yBAAyB,CAAyC;QAElE,4BAAuB,GAAvB,uBAAuB,CAAuC;QAE9D,mBAAc,GAAd,cAAc,CAAgB;IAC9C,CAAC;IAEJ;;;;OAIG;IACK,cAAc;QACpB,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACrC,OAAO,IAAI,CAAC,aAAa,CAAC;QAC5B,CAAC;QACD,4EAA4E;QAC5E,6EAA6E;QAC7E,uDAAuD;QACvD,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,OAAO,EAAE,EAAE,CAAC;YAC9C,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,IAAI,CAAC,yBAAyB,CAAC,oCAAoC,CACtF,gBAAgB,CAAC,sBAAsB,CACxC,CAAC;YACF,MAAM,KAAK,GAAwB,EAAE,CAAC;YACtC,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;gBACvC,MAAM,MAAM,GAAG,IAAI,CAAC,uBAAuB,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;gBACrE,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,SAAS;gBACX,CAAC;gBACD,2FAA2F;gBAC3F,2FAA2F;gBAC3F,2FAA2F;gBAC3F,+EAA+E;gBAC/E,MAAM,IAAI,GAAG,2BAA2B,CACtC,MAAM,EACN,OAAO,EACP,GAAG,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,yBAAyB,CAAC,EAAE,WAAW,EAAE,CAAC;gBACpE,+FAA+F;gBAC/F,iGAAiG;gBACjG,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,qCAAqC,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAC/F,CAAC;gBACF,IAAI,IAAI,EAAE,CAAC;oBACT,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;gBACzC,CAAC;YACH,CAAC;YACD,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;YAC3B,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,0EAA0E;YAC1E,0EAA0E;YAC1E,sEAAsE;YACtE,wEAAwE;YACxE,kCAAkC;YAClC,sEAAsE;YACtE,+EAA+E;YAC/E,yEAAyE;YACzE,OAAO,CAAC,KAAK,CACX,kEAAkE,EAClE,2BAA2B,CAAC,GAAG,CAAC,CACjC,CAAC;YACF,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,2DAA2D;IACpD,QAAQ;QACb,OAAO,IAAI,CAAC,cAAc,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1C,CAAC;IAED;;;;;;;;OAQG;IACI,oBAAoB;QACzB,OAAO,IAAI,CAAC,cAAc,EAAE;aACzB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;aAC1B,MAAM,CACL,CAAC,IAAI,EAAwD,EAAE,CAC7D,OAAQ,IAA+C,CAAC,2BAA2B,KAAK,UAAU;YAClG,OAAQ,IAA+C,CAAC,2BAA2B,KAAK,UAAU,CACrG,CAAC;IACN,CAAC;IAED;;;;;;;OAOG;IACI,kBAAkB;QACvB,OAAO,IAAI,CAAC,cAAc,EAAE;aACzB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;aAC1B,MAAM,CACL,CAAC,IAAI,EAA+C,EAAE,CACpD,OAAQ,IAAsC,CAAC,gBAAgB,KAAK,UAAU,CACjF,CAAC;IACN,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,gBAAgB,CAAC,KAA4B;QACxD,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACpC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO;QACT,CAAC;QACD,MAAM,OAAO,CAAC,GAAG,CACf,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE;YAChC,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;YACrC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,0EAA0E;gBAC1E,wEAAwE;gBACxE,wEAAwE;gBACxE,gDAAgD;gBAChD,IAAI,CAAC,cAAc,CAAC,sBAAsB,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC;gBACjE,OAAO,CAAC,KAAK,CAAC,0CAA0C,EAAE;oBACxD,WAAW,EAAE,GAAG;oBAChB,GAAG,2BAA2B,CAAC,GAAG,CAAC;iBACpC,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IAED,mEAAmE;IAC5D,KAAK,CAAC,QAAQ;QACnB,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACrC,OAAO;QACT,CAAC;QACD,MAAM,OAAO,CAAC,GAAG,CACf,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;YACxC,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;YAC1B,CAAC;YAAC,MAAM,CAAC;gBACP,oBAAoB;YACtB,CAAC;QACH,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;CACF,CAAA;AA9JY,qBAAqB;IADjC,UAAU,EAAE;IAMR,WAAA,MAAM,CAAC,kBAAkB,CAAC,gCAAgC,CAAC,CAAA;IAE3D,WAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;IAEzD,WAAA,MAAM,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAA;;GATjC,qBAAqB,CA8JjC","sourcesContent":["import { injectable, inject } from 'inversify';\nimport { EngineCapability } from '@wildo-ai/saas-models';\nimport type {\n  AuditLogSink,\n  AuditLogEventEmission,\n  AuditReconcileCheckpointStore,\n  AuditLogVerification,\n} from '@wildo-ai/saas-models';\n/*\n * `/backend-runtime`, not `/backend` (#330). The two barrels expose the same builder; `/backend` also\n * re-exports the engine's EAGERLY composed provider catalogue, and ES module semantics mean that one\n * value import evaluates all twenty-two provider modules — six of them pulling an `@ai-sdk/*` client\n * — into whatever process imports this file. This file is in every backend's boot graph.\n */\nimport { buildAuditLogSinkFromModule } from '@wildo-ai/external-connectors-private/backend-runtime';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { ExternalProvidersRegistryBackendService } from '~wildo-backend-lib/external-providers/services/external-providers-registry.backend.service';\nimport type { BackendProviderRegistryBackendService } from '~wildo-backend-lib/external-providers/services/backend-provider-registry.backend.service';\nimport type { MetricsService } from '~wildo-backend-lib/monitoring/observability/services/metrics.service';\nimport { projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\n\n/**\n * A resolved audit sink paired with the provider ref it was built from. Keeping\n * the ref lets failure metrics + logs name the offending provider (immudb, a\n * SIEM, …) instead of an anonymous index.\n */\ninterface ResolvedAuditSink {\n  ref: string;\n  sink: AuditLogSink;\n}\n\n/**\n * Engine-side `AuditLogSink` that fans EVERY audit event out to ALL providers\n * declaring `EngineCapability.COMPLIANCE_AUDIT_TRAIL` (a FAN_OUT capability),\n * resolved LAZILY from the app's `defineSaaSProviders` config.\n *\n * This is the Layer-2 provider fan-out — layered ON TOP of the always-on Layer-1\n * database audit store (`AuditLogsBackendService`). It is NOT the authoritative\n * store; a backend with zero audit providers keeps this a byte-identical no-op.\n *\n * **Why lazy.** The selection-aware registry only knows the declared providers\n * after `initialize()` (during startup, after the DI container is built), and\n * `AuditLogsBackendService` caches this reference at construction. So this object\n * is bound EAGERLY (a stable reference) but resolves providers on first use — by\n * which point (an actual audit event) the registry is initialized. Mirrors\n * `LlmObservabilityAgentCallTraceSink` / `EmailBackendService`.\n *\n * **Delivery.** Every resolved sink receives every event; a single sink's failure\n * is ISOLATED and never thrown onto the caller (the business-op path — F7). A\n * failure is ALSO made OBSERVABLE via `MetricsService.recordAuditSinkFailure`\n * (F6): fire-and-forget is correct (audit must never break the business op), but\n * a silently-failing sink must not masquerade as a healthy pipeline — the metric\n * lets \"we think we're auditing but we aren't\" surface on the observability layer\n * (→ an alert via the alerting workstream), not just a swallowed log line. This\n * honours the `AuditLogSink` contract (at-least-once per sink, non-blocking) —\n * the sinks own their own durable buffering + retry.\n *\n * Each resolved sink is kept paired with the provider ref it was built from, so\n * the completeness reconciler ({@link getReconcilableSinks}) and external-auditor\n * verification ({@link getVerifiableSinks}) can narrow to the sinks supporting\n * those optional capabilities.\n */\n@injectable()\nexport class CompositeAuditLogSink implements AuditLogSink {\n  /** `undefined` = not yet resolved; else the (possibly empty) resolved sink list. */\n  private resolvedSinks: ResolvedAuditSink[] | undefined = undefined;\n\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.ExternalProvidersRegistryService)\n    private readonly externalProvidersRegistry: ExternalProvidersRegistryBackendService,\n    @inject(SAAS_SERVICE_TYPES.BackendProviderRegistryService)\n    private readonly backendProviderRegistry: BackendProviderRegistryBackendService,\n    @inject(SAAS_SERVICE_TYPES.MetricsService)\n    private readonly metricsService: MetricsService,\n  ) {}\n\n  /**\n   * Resolve (once) every declared audit-provider sink. Caches the result,\n   * including an empty list. If the registry is not yet initialized (a call before\n   * startup completes), the attempt is NOT cached so a later call retries.\n   */\n  private ensureResolved(): ResolvedAuditSink[] {\n    if (this.resolvedSinks !== undefined) {\n      return this.resolvedSinks;\n    }\n    // Expected pre-startup window: the selection-aware registry isn't populated\n    // until initialize() runs. Stay unresolved (retry on the next event) WITHOUT\n    // logging — this is normal boot ordering, not a fault.\n    if (!this.externalProvidersRegistry.isReady()) {\n      return [];\n    }\n    try {\n      const providerRefs = this.externalProvidersRegistry.getResolvedProviderRefsForCapability(\n        EngineCapability.COMPLIANCE_AUDIT_TRAIL,\n      );\n      const sinks: ResolvedAuditSink[] = [];\n      for (const providerRef of providerRefs) {\n        const module = this.backendProviderRegistry.getProvider(providerRef);\n        if (!module) {\n          continue;\n        }\n        // Thread a tamper-metric hook bound to this provider ref: a sink that PROVES its store was\n        // rolled back/tampered (immudb's durable-state consistency proof) surfaces on the distinct\n        // `audit_tamper_detected_total{provider}` counter. The sink cannot import `MetricsService`\n        // (dependency direction), so this callback is how the signal crosses the wall.\n        const sink = buildAuditLogSinkFromModule(\n          module,\n          console,\n          () => this.metricsService.recordAuditTamperDetected({ providerRef }),\n          // Assurance DEGRADATION (ephemeral / corrupt anchor / un-pinned identity change / per-op proof\n          // failure) — distinct `audit_integrity_assurance_degraded_total{provider,reason}`, non-latching.\n          (reason) => this.metricsService.recordAuditIntegrityAssuranceDegraded({ providerRef, reason }),\n        );\n        if (sink) {\n          sinks.push({ ref: providerRef, sink });\n        }\n      }\n      this.resolvedSinks = sinks;\n      return sinks;\n    } catch (err) {\n      // Post-init resolution fault (a mis-projected registry, a throwing module\n      // factory) — NOT the expected pre-init path (guarded above). Do NOT cache\n      // (so a later event retries) and SURFACE it: a silently-failing audit\n      // pipeline masquerading as \"no providers declared\" is exactly the audit\n      // black hole this guards against.\n      // `projectCaughtErrorLogFields`, not an `instanceof Error` ternary: a\n      // `WildoError_Backend` is a plain object, so the ternary would render the very\n      // fault this guard exists to surface as the literal `'[object Object]'`.\n      console.error(\n        '[audit] failed to resolve provider sinks (non-fatal, will retry)',\n        projectCaughtErrorLogFields(err),\n      );\n      return [];\n    }\n  }\n\n  /** Whether any audit provider is declared + configured. */\n  public isActive(): boolean {\n    return this.ensureResolved().length > 0;\n  }\n\n  /**\n   * The resolved audit sinks that ALSO support reconcile-checkpointing\n   * ({@link AuditReconcileCheckpointStore}) — i.e. can persist the completeness\n   * reconciler's high-water mark in their own store (immudb). The reconciler drives\n   * these per-sink (get checkpoint → replay DB events since it → set checkpoint); a\n   * sink that can't checkpoint (a fire-and-forget SIEM webhook) is simply absent.\n   * Returns the SAME sink instances the real-time fan-out uses, so the reconciler\n   * shares ONE immudb connection with the live write path.\n   */\n  public getReconcilableSinks(): Array<AuditLogSink & AuditReconcileCheckpointStore> {\n    return this.ensureResolved()\n      .map((entry) => entry.sink)\n      .filter(\n        (sink): sink is AuditLogSink & AuditReconcileCheckpointStore =>\n          typeof (sink as Partial<AuditReconcileCheckpointStore>).getAuditReconcileCheckpoint === 'function' &&\n          typeof (sink as Partial<AuditReconcileCheckpointStore>).setAuditReconcileCheckpoint === 'function',\n      );\n  }\n\n  /**\n   * The resolved audit sinks that ALSO support cryptographic VERIFICATION\n   * ({@link AuditLogVerification}) — i.e. can prove a recorded event is present +\n   * untampered (immudb inclusion proofs). This is an EXTERNAL-AUDITOR read path,\n   * resolved SEPARATELY from the write fan-out; a sink whose technology can't prove\n   * non-tampering (a fire-and-forget SIEM webhook) is simply absent. Returns the\n   * SAME sink instances the fan-out uses, sharing their live connection.\n   */\n  public getVerifiableSinks(): Array<AuditLogSink & AuditLogVerification> {\n    return this.ensureResolved()\n      .map((entry) => entry.sink)\n      .filter(\n        (sink): sink is AuditLogSink & AuditLogVerification =>\n          typeof (sink as Partial<AuditLogVerification>).verifyAuditEvent === 'function',\n      );\n  }\n\n  /**\n   * Fan the event out to EVERY resolved sink, isolating per-sink failures so one\n   * never affects the others (each destination is independent — F7), and NEVER\n   * throwing onto the caller (fire-and-forget from the business op).\n   */\n  public async recordAuditEvent(event: AuditLogEventEmission): Promise<void> {\n    const sinks = this.ensureResolved();\n    if (sinks.length === 0) {\n      return;\n    }\n    await Promise.all(\n      sinks.map(async ({ ref, sink }) => {\n        try {\n          await sink.recordAuditEvent(event);\n        } catch (err) {\n          // F6 (Phase 5): a sink failing mid-operation must be OBSERVABLE, not just\n          // a swallowed log line — emit a metric so a silently-failing audit sink\n          // surfaces on the observability layer (→ alert). Still fire-and-forget:\n          // the throw never reaches the business-op path.\n          this.metricsService.recordAuditSinkFailure({ providerRef: ref });\n          console.error('[audit] provider sink failed (non-fatal)', {\n            providerRef: ref,\n            ...projectCaughtErrorLogFields(err),\n          });\n        }\n      }),\n    );\n  }\n\n  /** Drain every already-resolved sink on shutdown (best-effort). */\n  public async shutdown(): Promise<void> {\n    if (this.resolvedSinks === undefined) {\n      return;\n    }\n    await Promise.all(\n      this.resolvedSinks.map(async ({ sink }) => {\n        try {\n          await sink.shutdown?.();\n        } catch {\n          // best-effort drain\n        }\n      }),\n    );\n  }\n}\n"]}
+{"version":3,"file":"composite-audit-log-sink.backend.js","sourceRoot":"","sources":["../../../../../src/compliance/audit-trails/services/composite-audit-log-sink.backend.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAOzD;;;;;GAKG;AACH,OAAO,EAAE,2BAA2B,EAAE,MAAM,uDAAuD,CAAC;AACpG,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAIpF,OAAO,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAY3H;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEI,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;IAMb;IAEA;IAEA;IATnB,oFAAoF;IAC5E,aAAa,GAAoC,SAAS,CAAC;IAEnE,YAEmB,yBAAkE,EAElE,uBAA8D,EAE9D,cAA8B;QAJ9B,8BAAyB,GAAzB,yBAAyB,CAAyC;QAElE,4BAAuB,GAAvB,uBAAuB,CAAuC;QAE9D,mBAAc,GAAd,cAAc,CAAgB;IAC9C,CAAC;IAEJ;;;;OAIG;IACK,cAAc;QACpB,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACrC,OAAO,IAAI,CAAC,aAAa,CAAC;QAC5B,CAAC;QACD,4EAA4E;QAC5E,6EAA6E;QAC7E,uDAAuD;QACvD,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,OAAO,EAAE,EAAE,CAAC;YAC9C,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,IAAI,CAAC,yBAAyB,CAAC,oCAAoC,CACtF,gBAAgB,CAAC,sBAAsB,CACxC,CAAC;YACF,MAAM,KAAK,GAAwB,EAAE,CAAC;YACtC,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;gBACvC,MAAM,MAAM,GAAG,IAAI,CAAC,uBAAuB,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;gBACrE,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,SAAS;gBACX,CAAC;gBACD,2FAA2F;gBAC3F,2FAA2F;gBAC3F,2FAA2F;gBAC3F,+EAA+E;gBAC/E,MAAM,IAAI,GAAG,2BAA2B,CACtC,MAAM,EACN,OAAO,EACP,GAAG,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,yBAAyB,CAAC,EAAE,WAAW,EAAE,CAAC;gBACpE,+FAA+F;gBAC/F,iGAAiG;gBACjG,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,qCAAqC,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAC/F,CAAC;gBACF,IAAI,IAAI,EAAE,CAAC;oBACT,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;gBACzC,CAAC;YACH,CAAC;YACD,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;YAC3B,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,0EAA0E;YAC1E,0EAA0E;YAC1E,sEAAsE;YACtE,wEAAwE;YACxE,kCAAkC;YAClC,sEAAsE;YACtE,+EAA+E;YAC/E,yEAAyE;YACzE,OAAO,CAAC,KAAK,CACX,kEAAkE,EAClE,2BAA2B,CAAC,GAAG,CAAC,CACjC,CAAC;YACF,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,2DAA2D;IACpD,QAAQ;QACb,OAAO,IAAI,CAAC,cAAc,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1C,CAAC;IAED;;;;;;;;OAQG;IACI,oBAAoB;QACzB,OAAO,IAAI,CAAC,cAAc,EAAE;aACzB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;aAC1B,MAAM,CACL,CAAC,IAAI,EAAwD,EAAE,CAC7D,OAAQ,IAA+C,CAAC,2BAA2B,KAAK,UAAU;YAClG,OAAQ,IAA+C,CAAC,2BAA2B,KAAK,UAAU,CACrG,CAAC;IACN,CAAC;IAED;;;;;;;OAOG;IACI,kBAAkB;QACvB,OAAO,IAAI,CAAC,cAAc,EAAE;aACzB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;aAC1B,MAAM,CACL,CAAC,IAAI,EAA+C,EAAE,CACpD,OAAQ,IAAsC,CAAC,gBAAgB,KAAK,UAAU,CACjF,CAAC;IACN,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,gBAAgB,CAAC,KAA4B;QACxD,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACpC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO;QACT,CAAC;QACD,MAAM,OAAO,CAAC,GAAG,CACf,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE;YAChC,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;YACrC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,0EAA0E;gBAC1E,wEAAwE;gBACxE,wEAAwE;gBACxE,gDAAgD;gBAChD,IAAI,CAAC,cAAc,CAAC,sBAAsB,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC;gBACjE,OAAO,CAAC,KAAK,CAAC,0CAA0C,EAAE;oBACxD,WAAW,EAAE,GAAG;oBAChB,GAAG,2BAA2B,CAAC,GAAG,CAAC;iBACpC,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IAED,mEAAmE;IAC5D,KAAK,CAAC,QAAQ;QACnB,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACrC,OAAO;QACT,CAAC;QACD,MAAM,OAAO,CAAC,GAAG,CACf,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;YACxC,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;YAC1B,CAAC;YAAC,MAAM,CAAC;gBACP,oBAAoB;YACtB,CAAC;QACH,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;CACF,CAAA;AA9JY,qBAAqB;IADjC,UAAU,EAAE;IAMR,WAAA,MAAM,CAAC,kBAAkB,CAAC,gCAAgC,CAAC,CAAA;IAE3D,WAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;IAEzD,WAAA,MAAM,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAA;;GATjC,qBAAqB,CA8JjC","sourcesContent":["import { injectable, inject } from 'inversify';\nimport { EngineCapability } from '@wildo-ai/saas-models';\nimport type {\n  AuditLogSink,\n  AuditLogEventEmission,\n  AuditReconcileCheckpointStore,\n  AuditLogVerification,\n} from '@wildo-ai/saas-models';\n/*\n * `/backend-runtime`, not `/backend` (#330). The two barrels expose the same builder; `/backend` also\n * re-exports the engine's EAGERLY composed provider catalogue, and ES module semantics mean that one\n * value import evaluates all twenty-two provider modules — six of them pulling an `@ai-sdk/*` client\n * — into whatever process imports this file. This file is in every backend's boot graph.\n */\nimport { buildAuditLogSinkFromModule } from '@wildo-ai/external-connectors-private/backend-runtime';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { ExternalProvidersRegistryBackendService } from '~wildo-backend-lib/external-providers/services/external-providers-registry.backend.service';\nimport type { BackendProviderRegistryBackendService } from '~wildo-backend-lib/external-providers/services/backend-provider-registry.backend.service';\nimport type { MetricsService } from '~wildo-backend-lib/monitoring/observability/services/metrics.service';\nimport { projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\n\n/**\n * A resolved audit sink paired with the provider ref it was built from. Keeping\n * the ref lets failure metrics + logs name the offending provider (immudb, a\n * SIEM, …) instead of an anonymous index.\n */\ninterface ResolvedAuditSink {\n  ref: string;\n  sink: AuditLogSink;\n}\n\n/**\n * Engine-side `AuditLogSink` that fans EVERY audit event out to ALL providers\n * declaring `EngineCapability.COMPLIANCE_AUDIT_TRAIL` (a FAN_OUT capability),\n * resolved LAZILY from the app's `defineSaaSProviders` config.\n *\n * This is the Layer-2 provider fan-out — layered ON TOP of the always-on Layer-1\n * database audit store (`AuditLogsBackendService`). It is NOT the authoritative\n * store; a backend with zero audit providers keeps this a byte-identical no-op.\n *\n * **Why lazy.** The selection-aware registry only knows the declared providers\n * after `initialize()` (during startup, after the DI container is built), and\n * `AuditLogsBackendService` caches this reference at construction. So this object\n * is bound EAGERLY (a stable reference) but resolves providers on first use — by\n * which point (an actual audit event) the registry is initialized. Mirrors\n * `LlmObservabilityAgentCallTraceSink` / `EmailBackendService`.\n *\n * **Delivery.** Every resolved sink receives every event; a single sink's failure\n * is ISOLATED and never thrown onto the caller (the business-op path — F7). A\n * failure is ALSO made OBSERVABLE via `MetricsService.recordAuditSinkFailure`\n * (F6): fire-and-forget is correct (audit must never break the business op), but\n * a silently-failing sink must not masquerade as a healthy pipeline — the metric\n * lets \"we think we're auditing but we aren't\" surface on the observability layer\n * (→ an alert via the alerting workstream), not just a swallowed log line. This\n * honours the `AuditLogSink` contract (at-least-once per sink, non-blocking) —\n * the sinks own their own durable buffering + retry.\n *\n * Each resolved sink is kept paired with the provider ref it was built from, so\n * the completeness reconciler ({@link getReconcilableSinks}) and external-auditor\n * verification ({@link getVerifiableSinks}) can narrow to the sinks supporting\n * those optional capabilities.\n */\n@injectable()\nexport class CompositeAuditLogSink implements AuditLogSink {\n  /** `undefined` = not yet resolved; else the (possibly empty) resolved sink list. */\n  private resolvedSinks: ResolvedAuditSink[] | undefined = undefined;\n\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.ExternalProvidersRegistryService)\n    private readonly externalProvidersRegistry: ExternalProvidersRegistryBackendService,\n    @inject(SAAS_SERVICE_TYPES.BackendProviderRegistryService)\n    private readonly backendProviderRegistry: BackendProviderRegistryBackendService,\n    @inject(SAAS_SERVICE_TYPES.MetricsService)\n    private readonly metricsService: MetricsService,\n  ) {}\n\n  /**\n   * Resolve (once) every declared audit-provider sink. Caches the result,\n   * including an empty list. If the registry is not yet initialized (a call before\n   * startup completes), the attempt is NOT cached so a later call retries.\n   */\n  private ensureResolved(): ResolvedAuditSink[] {\n    if (this.resolvedSinks !== undefined) {\n      return this.resolvedSinks;\n    }\n    // Expected pre-startup window: the selection-aware registry isn't populated\n    // until initialize() runs. Stay unresolved (retry on the next event) WITHOUT\n    // logging — this is normal boot ordering, not a fault.\n    if (!this.externalProvidersRegistry.isReady()) {\n      return [];\n    }\n    try {\n      const providerRefs = this.externalProvidersRegistry.getResolvedProviderRefsForCapability(\n        EngineCapability.COMPLIANCE_AUDIT_TRAIL,\n      );\n      const sinks: ResolvedAuditSink[] = [];\n      for (const providerRef of providerRefs) {\n        const module = this.backendProviderRegistry.getProvider(providerRef);\n        if (!module) {\n          continue;\n        }\n        // Thread a tamper-metric hook bound to this provider ref: a sink that PROVES its store was\n        // rolled back/tampered (immudb's durable-state consistency proof) surfaces on the distinct\n        // `audit_tamper_detected_total{provider}` counter. The sink cannot import `MetricsService`\n        // (dependency direction), so this callback is how the signal crosses the wall.\n        const sink = buildAuditLogSinkFromModule(\n          module,\n          console,\n          () => this.metricsService.recordAuditTamperDetected({ providerRef }),\n          // Assurance DEGRADATION (ephemeral / corrupt anchor / un-pinned identity change / per-op proof\n          // failure) — distinct `audit_integrity_assurance_degraded_total{provider,reason}`, non-latching.\n          (reason) => this.metricsService.recordAuditIntegrityAssuranceDegraded({ providerRef, reason }),\n        );\n        if (sink) {\n          sinks.push({ ref: providerRef, sink });\n        }\n      }\n      this.resolvedSinks = sinks;\n      return sinks;\n    } catch (err) {\n      // Post-init resolution fault (a mis-projected registry, a throwing module\n      // factory) — NOT the expected pre-init path (guarded above). Do NOT cache\n      // (so a later event retries) and SURFACE it: a silently-failing audit\n      // pipeline masquerading as \"no providers declared\" is exactly the audit\n      // black hole this guards against.\n      // `projectCaughtErrorLogFields`, not an `instanceof Error` ternary: a\n      // `WildoError_Backend` is a plain object, so the ternary would render the very\n      // fault this guard exists to surface as the literal `'[object Object]'`.\n      console.error(\n        '[audit] failed to resolve provider sinks (non-fatal, will retry)',\n        projectCaughtErrorLogFields(err),\n      );\n      return [];\n    }\n  }\n\n  /** Whether any audit provider is declared + configured. */\n  public isActive(): boolean {\n    return this.ensureResolved().length > 0;\n  }\n\n  /**\n   * The resolved audit sinks that ALSO support reconcile-checkpointing\n   * ({@link AuditReconcileCheckpointStore}) — i.e. can persist the completeness\n   * reconciler's high-water mark in their own store (immudb). The reconciler drives\n   * these per-sink (get checkpoint → replay DB events since it → set checkpoint); a\n   * sink that can't checkpoint (a fire-and-forget SIEM webhook) is simply absent.\n   * Returns the SAME sink instances the real-time fan-out uses, so the reconciler\n   * shares ONE immudb connection with the live write path.\n   */\n  public getReconcilableSinks(): Array<AuditLogSink & AuditReconcileCheckpointStore> {\n    return this.ensureResolved()\n      .map((entry) => entry.sink)\n      .filter(\n        (sink): sink is AuditLogSink & AuditReconcileCheckpointStore =>\n          typeof (sink as Partial<AuditReconcileCheckpointStore>).getAuditReconcileCheckpoint === 'function' &&\n          typeof (sink as Partial<AuditReconcileCheckpointStore>).setAuditReconcileCheckpoint === 'function',\n      );\n  }\n\n  /**\n   * The resolved audit sinks that ALSO support cryptographic VERIFICATION\n   * ({@link AuditLogVerification}) — i.e. can prove a recorded event is present +\n   * untampered (immudb inclusion proofs). This is an EXTERNAL-AUDITOR read path,\n   * resolved SEPARATELY from the write fan-out; a sink whose technology can't prove\n   * non-tampering (a fire-and-forget SIEM webhook) is simply absent. Returns the\n   * SAME sink instances the fan-out uses, sharing their live connection.\n   */\n  public getVerifiableSinks(): Array<AuditLogSink & AuditLogVerification> {\n    return this.ensureResolved()\n      .map((entry) => entry.sink)\n      .filter(\n        (sink): sink is AuditLogSink & AuditLogVerification =>\n          typeof (sink as Partial<AuditLogVerification>).verifyAuditEvent === 'function',\n      );\n  }\n\n  /**\n   * Fan the event out to EVERY resolved sink, isolating per-sink failures so one\n   * never affects the others (each destination is independent — F7), and NEVER\n   * throwing onto the caller (fire-and-forget from the business op).\n   */\n  public async recordAuditEvent(event: AuditLogEventEmission): Promise<void> {\n    const sinks = this.ensureResolved();\n    if (sinks.length === 0) {\n      return;\n    }\n    await Promise.all(\n      sinks.map(async ({ ref, sink }) => {\n        try {\n          await sink.recordAuditEvent(event);\n        } catch (err) {\n          // F6 (Phase 5): a sink failing mid-operation must be OBSERVABLE, not just\n          // a swallowed log line — emit a metric so a silently-failing audit sink\n          // surfaces on the observability layer (→ alert). Still fire-and-forget:\n          // the throw never reaches the business-op path.\n          this.metricsService.recordAuditSinkFailure({ providerRef: ref });\n          console.error('[audit] provider sink failed (non-fatal)', {\n            providerRef: ref,\n            ...projectCaughtErrorLogFields(err),\n          });\n        }\n      }),\n    );\n  }\n\n  /** Drain every already-resolved sink on shutdown (best-effort). */\n  public async shutdown(): Promise<void> {\n    if (this.resolvedSinks === undefined) {\n      return;\n    }\n    await Promise.all(\n      this.resolvedSinks.map(async ({ sink }) => {\n        try {\n          await sink.shutdown?.();\n        } catch {\n          // best-effort drain\n        }\n      }),\n    );\n  }\n}\n"]}

package/dist/esm/compliance/audit-trails/services/siem-export-config-cache-invalidation.custom-impl.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"siem-export-config-cache-invalidation.custom-impl.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/compliance/audit-trails/services/siem-export-config-cache-invalidation.custom-impl.backend.service.ts"],"names":[],"mappings":"AAoEA,OAAO,EAEL,KAAK,0CAA0C,EAChD,MAAM,4GAA4G,CAAC;AAkDpH;;;;;;;;;;;;GAYG;AACH,wBAAgB,gDAAgD,IAAI,0CAA0C,EAAE,CAuC/G"}
+{"version":3,"file":"siem-export-config-cache-invalidation.custom-impl.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/audit-trails/services/siem-export-config-cache-invalidation.custom-impl.backend.service.ts"],"names":[],"mappings":"AAoEA,OAAO,EAEL,KAAK,0CAA0C,EAChD,MAAM,4GAA4G,CAAC;AAkDpH;;;;;;;;;;;;GAYG;AACH,wBAAgB,gDAAgD,IAAI,0CAA0C,EAAE,CAuC/G"}

package/dist/esm/compliance/audit-trails/services/siem-export-config-cache-invalidation.custom-impl.backend.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"siem-export-config-cache-invalidation.custom-impl.backend.service.js","sourceRoot":"","sources":["../../../../../../src/compliance/audit-trails/services/siem-export-config-cache-invalidation.custom-impl.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;AACH,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAChB,4BAA4B,GAC7B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,yCAAyC,GAE1C,MAAM,4GAA4G,CAAC;AAEpH,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAKpF,mGAAmG;AACnG,MAAM,uBAAuB,GAAG;IAC9B,qBAAqB,CAAC,MAAM;IAC5B,qBAAqB,CAAC,MAAM;CACpB,CAAC;AAEX,MAAM,qBAAqB,GAAG;IAC5B,WAAW,EAAE,4BAA4B,CAAC,aAAa;IACvD,kBAAkB,EAAE,IAAI;CAChB,CAAC;AAIX;;;;;;;;;;;;GAYG;AACH,SAAS,qBAAqB,CAC5B,MAAe,EACf,KAAmD,EACnD,gBAAuC;IAEvC,MAAM,UAAU,GACd,MAAM,IAAI,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,gBAAgB,IAAI,MAAM;QACxE,CAAC,CAAE,MAAgC,CAAC,cAAc;QAClD,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAElC,MAAM,WAAW,GAAI,KAAK,CAAC,aAAmD,EAAE,cAAc,CAAC;IAC/F,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IAEpC,OAAO,gBAAgB,CAAC,cAAc,IAAI,SAAS,CAAC;AACtD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,gDAAgD;IAC9D,OAAO,uBAAuB,CAAC,GAAG,CAChC,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE;QAC1C,MAAM,UAAU,GAAG,SAAS,CAAC,GAAG,CAC9B,kBAAkB,CAAC,2BAA2B,CAC/C,CAAC;QACF,OAAO,yCAAyC,CAAC;YAC/C,aAAa,EAAE;gBACb,kBAAkB,EAAE,gBAAgB,CAAC,+BAA+B;gBACpE,mBAAmB;gBACnB,GAAG,qBAAqB;aACzB;YACD,QAAQ,EAAE;gBACR,qBAAqB,EAAE,KAAK,EAC1B,GAAuB,EACvB,GAAY,EACZ,gBAAuC,EACvC,aAA4D,EAC5D,KAAmD,EACjC,EAAE;oBACpB,MAAM,cAAc,GAAG,qBAAqB,CAAC,GAAG,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAC;oBAC3E,IAAI,CAAC,cAAc,EAAE,CAAC;wBACpB,KAAK,CAAC,MAAM,CAAC,IAAI,CACf,wIAAwI,EACxI;4BACE,mBAAmB,EAAE,MAAM,CAAC,aAAa,CAAC,mBAAmB,CAAC;4BAC9D,kBAAkB,EAAE,aAAa,CAAC,kBAAkB;4BACpD,KAAK,EAAE,GAAG;yBACX,CACF,CAAC;wBACF,OAAO,GAAG,CAAC;oBACb,CAAC;oBACD,UAAU,CAAC,oBAAoB,CAAC,cAAc,CAAC,CAAC;oBAChD,OAAO,GAAG,CAAC;gBACb,CAAC;aACF;SACF,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Postfix-hook custom-service implementation that drops an organization's cached SIEM export\n * config after an engine-routed write to `ORGANIZATION_SIEM_EXPORT_CONFIG`.\n *\n * Without this, `AuditEventDispatcherBackendService` served a stale config for up to\n * `SIEM_CONFIG_REFRESH_AFTER_MS` with no invalidation of any kind, so an organization that ENABLED its\n * SIEM sink kept resolving the cached `null` and had its authenticated audit events routed to no sink\n * for that window. Audit events are not replayed, so those deliveries were lost rather than delayed.\n *\n * **The \"N independent windows\" this file's first revision described is CLOSED.** That revision noted\n * the window was PER PROCESS because the cache is an in-process `Map`, and stopped there — which left\n * the hook correct for exactly one replica and inert for the rest of a real deployment.\n * `invalidateSiemConfig` now drops the local entry AND publishes the organization id on a Redis channel\n * every replica subscribes to, so an engine-routed write converges fleet-wide in milliseconds. Read that\n * method's JSDoc for the broadcast, and `SIEM_CONFIG_REFRESH_AFTER_MS` for the lease that still carries\n * everything the broadcast cannot reach.\n *\n * ## Why the hook sits on the RESOURCE and not on the config service\n *\n * `AuthOrganizationConfigurationService.saveSiemExportConfig` is the obvious call site and is only\n * ONE of the writers: the config is an ordinary resource, so an update also lands through\n * `ServicesRegistryHandler.update` on `organizationSiemExportConfig` directly. Hooking the service\n * would have applied the invariant at one of two sites — the shape\n * `.claude/rules/invariant-call-site-enumeration.md` records twenty-odd times. The resource\n * operation is the chokepoint both writers pass through, because `saveSiemExportConfig` dispatches\n * its own write via `ServicesRegistryHandler`.\n *\n * ## Coverage matrix\n *\n * | Operation | Variant          | Covered | Why |\n * |-----------|------------------|---------|-----|\n * | `CREATE`  | `INTERNAL_CALL`  | ✅      | The lazy `createAsSystem` materialisation on the userless login path, and the first real configuration. Service tier, so a postfix hook is reachable. |\n * | `UPDATE`  | `INTERNAL_CALL`  | ✅      | Every edit, including `saveSiemExportConfig`. Service tier. |\n * | `DELETE`  | `REPOSITORY_ONLY`| ❌      | Deliberate, twice over: `doOperation` throws on `REPOSITORY_ONLY`, so the service tier where custom implementations run is unreachable BY CONSTRUCTION and a registration here would fail startup; and its only caller is the `onParentDelete` cascade, which fires when the owning organization is itself being hard-deleted — nothing dispatches audit events for a deleted tenant, so the entry is moot and TTL-expires. |\n * | `READ`    | `API_CALL`       | ❌      | Reads do not stale a cache. |\n *\n * **`APPLICATION_SIEM_EXPORT_CONFIG` is deliberately NOT registered.** The dispatcher's cache is\n * keyed by `organizationId` and it only ever loads the ORGANIZATION variant\n * (`loadSiemExportConfig(ec, ORGANIZATION, orgId)`), because SIEM fan-out is per authenticated\n * tenant. The APPLICATION variant is settable and inert — no producer emits app-scoped deliveries —\n * so there is no app-scoped cache entry to invalidate. When an app-scoped producer lands, it gets\n * its own cache and its own registration in the same change.\n *\n * **The framework default-seed is also not covered, and does not need to be.**\n * `organizationSiemExportConfigDefaultSeed` writes a DISABLED default at the repository tier during\n * organization creation, before the organization can have raised an audit event, so there is no\n * entry in the map to stale.\n *\n * ## What no hook on this tier can ever cover — and who relies on it today\n *\n * Repository-direct writes and raw database writes never reach the service tier, so they raise no\n * postfix hook and produce no broadcast. This is not hypothetical: `examples/wonder-todos/e2e/adapter.ts`\n * (`case 'siem'`) repoints an organization's export config with\n * `upsertOrganizationSingleton('organizationSiemExportConfig', …)`, straight at the store. Its own\n * comment records the consequence — the lane works *\"because a freshly provisioned org has a cold\n * config cache\"*, i.e. by ORDERING itself before the organization's first audited action rather than by\n * anything invalidating.\n *\n * For that class of write the LEASE is the entire guarantee, which is why\n * `SIEM_CONFIG_REFRESH_AFTER_MS` states its number, its arithmetic and its reason rather than being an\n * incidental five minutes. Do not read this file as \"engine writes are covered, the rest is someone\n * else's problem\": the two mechanisms are one guarantee, and the lease is the half that has no hook.\n */\nimport {\n  CoreResourceOperation,\n  CoreResourceType,\n  ResourceOperationVariantType,\n} from '@wildo-ai/saas-models';\nimport {\n  createResourceCustomServiceImplementation,\n  type ResourceCustomServiceImplementationFactory,\n} from '~wildo-backend-lib/base-classes/services/services/resource-operation-custom-implementation.factory.backend';\nimport { AuditEventDispatcherBackendService } from '~wildo-backend-lib/compliance/audit-trails/services/audit-event-dispatcher.backend.service';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { ResourceOperation_CustomImplementation_Utils } from '~wildo-backend-lib/base-classes/services/services/resource-operation-custom-implementation-base.backend.service';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport type { ResourceConfiguration_OperationPath } from '@wildo-ai/saas-models';\n\n/** The operations whose writes can stale the dispatcher's cache. See the coverage matrix above. */\nconst INVALIDATING_OPERATIONS = [\n  CoreResourceOperation.CREATE,\n  CoreResourceOperation.UPDATE,\n] as const;\n\nconst INTERNAL_DEFAULT_PATH = {\n  variantType: ResourceOperationVariantType.INTERNAL_CALL,\n  isOperationDefault: true,\n} as const;\n\ntype RowWithOrganizationId = { organizationId?: string };\n\n/**\n * Resolve the organization whose cache entry must go, with a three-tier fallback.\n *\n * 1. **The postfix result** — the persisted row. CREATE and UPDATE both return it, and it carries\n *    `organizationId` (injected by the polymorphism engine), so this is the normal path.\n * 2. **`utils.currentObject`** — fetched by the framework before a non-CREATE custom impl runs.\n *    Load-bearing when an implementation returns something other than the row.\n * 3. **`executionContext.organizationId`** — the scope the request runs under.\n *\n * Mirrors `resolveOrgIdsForInvalidation` in\n * `scope-features-cache-invalidation.custom-impl.backend.service.ts`; see that file for the\n * reasoning behind each tier.\n */\nfunction resolveOrganizationId(\n  result: unknown,\n  utils: ResourceOperation_CustomImplementation_Utils,\n  executionContext: ExecutionContext<any>,\n): string | undefined {\n  const fromResult =\n    result != null && typeof result === 'object' && 'organizationId' in result\n      ? (result as RowWithOrganizationId).organizationId\n      : undefined;\n  if (fromResult) return fromResult;\n\n  const fromCurrent = (utils.currentObject as RowWithOrganizationId | undefined)?.organizationId;\n  if (fromCurrent) return fromCurrent;\n\n  return executionContext.organizationId ?? undefined;\n}\n\n/**\n * Registers the postfix invalidation on the ORGANIZATION SIEM-export-config CREATE and UPDATE.\n *\n * The handler is synchronous and cannot fail. `invalidateSiemConfig` drops a map entry and then kicks a\n * fire-and-forget Redis publish that swallows its own error — so unlike the Redis-backed feature-cache\n * equivalent, which awaits its `del`, there is still nothing here to await and no error path. That is a\n * deliberate property of `invalidateSiemConfig`, not an accident of it: a broadcast that fails leaves\n * the other replicas exactly where the lease already puts them, and refusing a configuration write to\n * protect a cache would invert the priority.\n * A `logger.warn` on an unresolvable organization id keeps the gap observable rather than silent:\n * failing the write would be the wrong trade, because refusing a config edit to protect a cache\n * inverts the priority, but a silently un-invalidated entry is the exact defect this file fixes.\n */\nexport function createSiemExportConfigCacheInvalidationFactories(): ResourceCustomServiceImplementationFactory[] {\n  return INVALIDATING_OPERATIONS.map(\n    (operationIdentifier) => (_rr, container) => {\n      const dispatcher = container.get<AuditEventDispatcherBackendService>(\n        SAAS_SERVICE_TYPES.AuditEventDispatcherService,\n      );\n      return createResourceCustomServiceImplementation({\n        operationPath: {\n          resourceIdentifier: CoreResourceType.ORGANIZATION_SIEM_EXPORT_CONFIG,\n          operationIdentifier,\n          ...INTERNAL_DEFAULT_PATH,\n        },\n        handlers: {\n          postfixCoreOperations: async (\n            _id: string | undefined,\n            res: unknown,\n            executionContext: ExecutionContext<any>,\n            operationPath: ResourceConfiguration_OperationPath<any, any>,\n            utils: ResourceOperation_CustomImplementation_Utils,\n          ): Promise<unknown> => {\n            const organizationId = resolveOrganizationId(res, utils, executionContext);\n            if (!organizationId) {\n              utils.logger.warn(\n                'Could not resolve organizationId for SIEM export config cache invalidation — the dispatcher may serve a stale config for up to its TTL',\n                {\n                  operationIdentifier: String(operationPath.operationIdentifier),\n                  resourceIdentifier: operationPath.resourceIdentifier,\n                  rowId: _id,\n                },\n              );\n              return res;\n            }\n            dispatcher.invalidateSiemConfig(organizationId);\n            return res;\n          },\n        },\n      });\n    },\n  );\n}\n"]}
+{"version":3,"file":"siem-export-config-cache-invalidation.custom-impl.backend.service.js","sourceRoot":"","sources":["../../../../../src/compliance/audit-trails/services/siem-export-config-cache-invalidation.custom-impl.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;AACH,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAChB,4BAA4B,GAC7B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,yCAAyC,GAE1C,MAAM,4GAA4G,CAAC;AAEpH,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAKpF,mGAAmG;AACnG,MAAM,uBAAuB,GAAG;IAC9B,qBAAqB,CAAC,MAAM;IAC5B,qBAAqB,CAAC,MAAM;CACpB,CAAC;AAEX,MAAM,qBAAqB,GAAG;IAC5B,WAAW,EAAE,4BAA4B,CAAC,aAAa;IACvD,kBAAkB,EAAE,IAAI;CAChB,CAAC;AAIX;;;;;;;;;;;;GAYG;AACH,SAAS,qBAAqB,CAC5B,MAAe,EACf,KAAmD,EACnD,gBAAuC;IAEvC,MAAM,UAAU,GACd,MAAM,IAAI,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,gBAAgB,IAAI,MAAM;QACxE,CAAC,CAAE,MAAgC,CAAC,cAAc;QAClD,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAElC,MAAM,WAAW,GAAI,KAAK,CAAC,aAAmD,EAAE,cAAc,CAAC;IAC/F,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IAEpC,OAAO,gBAAgB,CAAC,cAAc,IAAI,SAAS,CAAC;AACtD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,gDAAgD;IAC9D,OAAO,uBAAuB,CAAC,GAAG,CAChC,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE;QAC1C,MAAM,UAAU,GAAG,SAAS,CAAC,GAAG,CAC9B,kBAAkB,CAAC,2BAA2B,CAC/C,CAAC;QACF,OAAO,yCAAyC,CAAC;YAC/C,aAAa,EAAE;gBACb,kBAAkB,EAAE,gBAAgB,CAAC,+BAA+B;gBACpE,mBAAmB;gBACnB,GAAG,qBAAqB;aACzB;YACD,QAAQ,EAAE;gBACR,qBAAqB,EAAE,KAAK,EAC1B,GAAuB,EACvB,GAAY,EACZ,gBAAuC,EACvC,aAA4D,EAC5D,KAAmD,EACjC,EAAE;oBACpB,MAAM,cAAc,GAAG,qBAAqB,CAAC,GAAG,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAC;oBAC3E,IAAI,CAAC,cAAc,EAAE,CAAC;wBACpB,KAAK,CAAC,MAAM,CAAC,IAAI,CACf,wIAAwI,EACxI;4BACE,mBAAmB,EAAE,MAAM,CAAC,aAAa,CAAC,mBAAmB,CAAC;4BAC9D,kBAAkB,EAAE,aAAa,CAAC,kBAAkB;4BACpD,KAAK,EAAE,GAAG;yBACX,CACF,CAAC;wBACF,OAAO,GAAG,CAAC;oBACb,CAAC;oBACD,UAAU,CAAC,oBAAoB,CAAC,cAAc,CAAC,CAAC;oBAChD,OAAO,GAAG,CAAC;gBACb,CAAC;aACF;SACF,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Postfix-hook custom-service implementation that drops an organization's cached SIEM export\n * config after an engine-routed write to `ORGANIZATION_SIEM_EXPORT_CONFIG`.\n *\n * Without this, `AuditEventDispatcherBackendService` served a stale config for up to\n * `SIEM_CONFIG_REFRESH_AFTER_MS` with no invalidation of any kind, so an organization that ENABLED its\n * SIEM sink kept resolving the cached `null` and had its authenticated audit events routed to no sink\n * for that window. Audit events are not replayed, so those deliveries were lost rather than delayed.\n *\n * **The \"N independent windows\" this file's first revision described is CLOSED.** That revision noted\n * the window was PER PROCESS because the cache is an in-process `Map`, and stopped there — which left\n * the hook correct for exactly one replica and inert for the rest of a real deployment.\n * `invalidateSiemConfig` now drops the local entry AND publishes the organization id on a Redis channel\n * every replica subscribes to, so an engine-routed write converges fleet-wide in milliseconds. Read that\n * method's JSDoc for the broadcast, and `SIEM_CONFIG_REFRESH_AFTER_MS` for the lease that still carries\n * everything the broadcast cannot reach.\n *\n * ## Why the hook sits on the RESOURCE and not on the config service\n *\n * `AuthOrganizationConfigurationService.saveSiemExportConfig` is the obvious call site and is only\n * ONE of the writers: the config is an ordinary resource, so an update also lands through\n * `ServicesRegistryHandler.update` on `organizationSiemExportConfig` directly. Hooking the service\n * would have applied the invariant at one of two sites — the shape\n * `.claude/rules/invariant-call-site-enumeration.md` records twenty-odd times. The resource\n * operation is the chokepoint both writers pass through, because `saveSiemExportConfig` dispatches\n * its own write via `ServicesRegistryHandler`.\n *\n * ## Coverage matrix\n *\n * | Operation | Variant          | Covered | Why |\n * |-----------|------------------|---------|-----|\n * | `CREATE`  | `INTERNAL_CALL`  | ✅      | The lazy `createAsSystem` materialisation on the userless login path, and the first real configuration. Service tier, so a postfix hook is reachable. |\n * | `UPDATE`  | `INTERNAL_CALL`  | ✅      | Every edit, including `saveSiemExportConfig`. Service tier. |\n * | `DELETE`  | `REPOSITORY_ONLY`| ❌      | Deliberate, twice over: `doOperation` throws on `REPOSITORY_ONLY`, so the service tier where custom implementations run is unreachable BY CONSTRUCTION and a registration here would fail startup; and its only caller is the `onParentDelete` cascade, which fires when the owning organization is itself being hard-deleted — nothing dispatches audit events for a deleted tenant, so the entry is moot and TTL-expires. |\n * | `READ`    | `API_CALL`       | ❌      | Reads do not stale a cache. |\n *\n * **`APPLICATION_SIEM_EXPORT_CONFIG` is deliberately NOT registered.** The dispatcher's cache is\n * keyed by `organizationId` and it only ever loads the ORGANIZATION variant\n * (`loadSiemExportConfig(ec, ORGANIZATION, orgId)`), because SIEM fan-out is per authenticated\n * tenant. The APPLICATION variant is settable and inert — no producer emits app-scoped deliveries —\n * so there is no app-scoped cache entry to invalidate. When an app-scoped producer lands, it gets\n * its own cache and its own registration in the same change.\n *\n * **The framework default-seed is also not covered, and does not need to be.**\n * `organizationSiemExportConfigDefaultSeed` writes a DISABLED default at the repository tier during\n * organization creation, before the organization can have raised an audit event, so there is no\n * entry in the map to stale.\n *\n * ## What no hook on this tier can ever cover — and who relies on it today\n *\n * Repository-direct writes and raw database writes never reach the service tier, so they raise no\n * postfix hook and produce no broadcast. This is not hypothetical: `examples/wonder-todos/e2e/adapter.ts`\n * (`case 'siem'`) repoints an organization's export config with\n * `upsertOrganizationSingleton('organizationSiemExportConfig', …)`, straight at the store. Its own\n * comment records the consequence — the lane works *\"because a freshly provisioned org has a cold\n * config cache\"*, i.e. by ORDERING itself before the organization's first audited action rather than by\n * anything invalidating.\n *\n * For that class of write the LEASE is the entire guarantee, which is why\n * `SIEM_CONFIG_REFRESH_AFTER_MS` states its number, its arithmetic and its reason rather than being an\n * incidental five minutes. Do not read this file as \"engine writes are covered, the rest is someone\n * else's problem\": the two mechanisms are one guarantee, and the lease is the half that has no hook.\n */\nimport {\n  CoreResourceOperation,\n  CoreResourceType,\n  ResourceOperationVariantType,\n} from '@wildo-ai/saas-models';\nimport {\n  createResourceCustomServiceImplementation,\n  type ResourceCustomServiceImplementationFactory,\n} from '~wildo-backend-lib/base-classes/services/services/resource-operation-custom-implementation.factory.backend';\nimport { AuditEventDispatcherBackendService } from '~wildo-backend-lib/compliance/audit-trails/services/audit-event-dispatcher.backend.service';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { ResourceOperation_CustomImplementation_Utils } from '~wildo-backend-lib/base-classes/services/services/resource-operation-custom-implementation-base.backend.service';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport type { ResourceConfiguration_OperationPath } from '@wildo-ai/saas-models';\n\n/** The operations whose writes can stale the dispatcher's cache. See the coverage matrix above. */\nconst INVALIDATING_OPERATIONS = [\n  CoreResourceOperation.CREATE,\n  CoreResourceOperation.UPDATE,\n] as const;\n\nconst INTERNAL_DEFAULT_PATH = {\n  variantType: ResourceOperationVariantType.INTERNAL_CALL,\n  isOperationDefault: true,\n} as const;\n\ntype RowWithOrganizationId = { organizationId?: string };\n\n/**\n * Resolve the organization whose cache entry must go, with a three-tier fallback.\n *\n * 1. **The postfix result** — the persisted row. CREATE and UPDATE both return it, and it carries\n *    `organizationId` (injected by the polymorphism engine), so this is the normal path.\n * 2. **`utils.currentObject`** — fetched by the framework before a non-CREATE custom impl runs.\n *    Load-bearing when an implementation returns something other than the row.\n * 3. **`executionContext.organizationId`** — the scope the request runs under.\n *\n * Mirrors `resolveOrgIdsForInvalidation` in\n * `scope-features-cache-invalidation.custom-impl.backend.service.ts`; see that file for the\n * reasoning behind each tier.\n */\nfunction resolveOrganizationId(\n  result: unknown,\n  utils: ResourceOperation_CustomImplementation_Utils,\n  executionContext: ExecutionContext<any>,\n): string | undefined {\n  const fromResult =\n    result != null && typeof result === 'object' && 'organizationId' in result\n      ? (result as RowWithOrganizationId).organizationId\n      : undefined;\n  if (fromResult) return fromResult;\n\n  const fromCurrent = (utils.currentObject as RowWithOrganizationId | undefined)?.organizationId;\n  if (fromCurrent) return fromCurrent;\n\n  return executionContext.organizationId ?? undefined;\n}\n\n/**\n * Registers the postfix invalidation on the ORGANIZATION SIEM-export-config CREATE and UPDATE.\n *\n * The handler is synchronous and cannot fail. `invalidateSiemConfig` drops a map entry and then kicks a\n * fire-and-forget Redis publish that swallows its own error — so unlike the Redis-backed feature-cache\n * equivalent, which awaits its `del`, there is still nothing here to await and no error path. That is a\n * deliberate property of `invalidateSiemConfig`, not an accident of it: a broadcast that fails leaves\n * the other replicas exactly where the lease already puts them, and refusing a configuration write to\n * protect a cache would invert the priority.\n * A `logger.warn` on an unresolvable organization id keeps the gap observable rather than silent:\n * failing the write would be the wrong trade, because refusing a config edit to protect a cache\n * inverts the priority, but a silently un-invalidated entry is the exact defect this file fixes.\n */\nexport function createSiemExportConfigCacheInvalidationFactories(): ResourceCustomServiceImplementationFactory[] {\n  return INVALIDATING_OPERATIONS.map(\n    (operationIdentifier) => (_rr, container) => {\n      const dispatcher = container.get<AuditEventDispatcherBackendService>(\n        SAAS_SERVICE_TYPES.AuditEventDispatcherService,\n      );\n      return createResourceCustomServiceImplementation({\n        operationPath: {\n          resourceIdentifier: CoreResourceType.ORGANIZATION_SIEM_EXPORT_CONFIG,\n          operationIdentifier,\n          ...INTERNAL_DEFAULT_PATH,\n        },\n        handlers: {\n          postfixCoreOperations: async (\n            _id: string | undefined,\n            res: unknown,\n            executionContext: ExecutionContext<any>,\n            operationPath: ResourceConfiguration_OperationPath<any, any>,\n            utils: ResourceOperation_CustomImplementation_Utils,\n          ): Promise<unknown> => {\n            const organizationId = resolveOrganizationId(res, utils, executionContext);\n            if (!organizationId) {\n              utils.logger.warn(\n                'Could not resolve organizationId for SIEM export config cache invalidation — the dispatcher may serve a stale config for up to its TTL',\n                {\n                  operationIdentifier: String(operationPath.operationIdentifier),\n                  resourceIdentifier: operationPath.resourceIdentifier,\n                  rowId: _id,\n                },\n              );\n              return res;\n            }\n            dispatcher.invalidateSiemConfig(organizationId);\n            return res;\n          },\n        },\n      });\n    },\n  );\n}\n"]}

package/dist/esm/compliance/audit-trails/services/siem-webhook-delivery.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"siem-webhook-delivery.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/compliance/audit-trails/services/siem-webhook-delivery.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,kBAAkB,CAAC;AAI1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,kCAAkC,EAAE,MAAM,0CAA0C,CAAC;AAC9F,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAChK,OAAO,EAAE,qCAAqC,EAAE,MAAM,+EAA+E,CAAC;AACtI,OAAO,EACL,KAAK,0BAA0B,EAU/B,aAAa,EAId,MAAM,uBAAuB,CAAC;AAiC/B,mEAAmE;AACnE,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,0BAA0B,CAAC;IACrC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE;QACV,UAAU,EAAE,MAAM,CAAC;QACnB,UAAU,EAAE,MAAM,CAAC;QACnB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,WAAW,EAAE,MAAM,CAAC;QACpB,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACvC,QAAQ,EAAE;YACR,SAAS,EAAE,MAAM,CAAC;YAClB,kBAAkB,EAAE,MAAM,CAAC;YAC3B,aAAa,EAAE,MAAM,CAAC;YACtB,mBAAmB,EAAE,MAAM,CAAC;YAC5B,cAAc,EAAE,MAAM,CAAC;SACxB,CAAC;KACH,CAAC;CACH;AAoDD,qBACa,iCAAiC;IAKP,OAAO,CAAC,QAAQ,CAAC,MAAM;IACb,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACtB,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IAC9B,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IAClC,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IAR5G,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;IACxF,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA+C;gBAGzB,MAAM,EAAE,aAAa,EACX,gBAAgB,EAAE,uBAAuB,EAC9B,oBAAoB,EAAE,kCAAkC,EACjD,oBAAoB,EAAE,yCAAyC,EAC5D,uBAAuB,EAAE,qCAAqC;IAMnJ;;;OAGG;IACU,eAAe,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC;IA2F5E;;;;;;;;OAQG;IACH,OAAO,CAAC,WAAW;IAgBnB;;;OAGG;IACH,OAAO,CAAC,YAAY;IA0BpB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,aAAa;IA4BrB;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,OAAO,CAAC,yBAAyB;IA4DjC;;;;;;;OAOG;IACH,OAAO,CAAC,eAAe;IAmBvB;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,wBAAwB;IAQhC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,gBAAgB;IAoBxB;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,sBAAsB;IAS9B;;;;;;OAMG;IACH,OAAO,CAAC,iBAAiB;IAczB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,SAAS;IASjB;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,CAAC,uBAAuB;IA6B/B;;;;;;OAMG;IACH,OAAO,CAAC,uBAAuB;IAa/B;;;;;;;;;OASG;IACH,OAAO,CAAC,kBAAkB;IAK1B;;OAEG;IACH,OAAO,CAAC,aAAa;IA0DrB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;YACW,aAAa;IAuC3B;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,+BAA+B;IAQvC,OAAO,CAAC,cAAc;IAYtB,OAAO,CAAC,cAAc;IAItB,OAAO,CAAC,cAAc;IAwBtB;;;;OAIG;YACW,aAAa;IA0D3B;;;;;;;;;;;;;;;;;;OAkBG;YACW,uBAAuB;IAoBrC;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IAOhC;;;OAGG;IACH,OAAO,CAAC,kBAAkB;IAmC1B;;;;;OAKG;IACI,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAWnD;;OAEG;IACH,OAAO,CAAC,MAAM;CAGf"}
+{"version":3,"file":"siem-webhook-delivery.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/audit-trails/services/siem-webhook-delivery.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,kBAAkB,CAAC;AAI1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,kCAAkC,EAAE,MAAM,0CAA0C,CAAC;AAC9F,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAChK,OAAO,EAAE,qCAAqC,EAAE,MAAM,+EAA+E,CAAC;AACtI,OAAO,EACL,KAAK,0BAA0B,EAU/B,aAAa,EAId,MAAM,uBAAuB,CAAC;AAiC/B,mEAAmE;AACnE,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,0BAA0B,CAAC;IACrC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE;QACV,UAAU,EAAE,MAAM,CAAC;QACnB,UAAU,EAAE,MAAM,CAAC;QACnB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,WAAW,EAAE,MAAM,CAAC;QACpB,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACvC,QAAQ,EAAE;YACR,SAAS,EAAE,MAAM,CAAC;YAClB,kBAAkB,EAAE,MAAM,CAAC;YAC3B,aAAa,EAAE,MAAM,CAAC;YACtB,mBAAmB,EAAE,MAAM,CAAC;YAC5B,cAAc,EAAE,MAAM,CAAC;SACxB,CAAC;KACH,CAAC;CACH;AAoDD,qBACa,iCAAiC;IAKP,OAAO,CAAC,QAAQ,CAAC,MAAM;IACb,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACtB,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IAC9B,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IAClC,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IAR5G,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;IACxF,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA+C;gBAGzB,MAAM,EAAE,aAAa,EACX,gBAAgB,EAAE,uBAAuB,EAC9B,oBAAoB,EAAE,kCAAkC,EACjD,oBAAoB,EAAE,yCAAyC,EAC5D,uBAAuB,EAAE,qCAAqC;IAMnJ;;;OAGG;IACU,eAAe,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC;IA2F5E;;;;;;;;OAQG;IACH,OAAO,CAAC,WAAW;IAgBnB;;;OAGG;IACH,OAAO,CAAC,YAAY;IA0BpB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,aAAa;IA4BrB;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,OAAO,CAAC,yBAAyB;IA4DjC;;;;;;;OAOG;IACH,OAAO,CAAC,eAAe;IAmBvB;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,wBAAwB;IAQhC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,gBAAgB;IAoBxB;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,sBAAsB;IAS9B;;;;;;OAMG;IACH,OAAO,CAAC,iBAAiB;IAczB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,SAAS;IASjB;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,CAAC,uBAAuB;IA6B/B;;;;;;OAMG;IACH,OAAO,CAAC,uBAAuB;IAa/B;;;;;;;;;OASG;IACH,OAAO,CAAC,kBAAkB;IAK1B;;OAEG;IACH,OAAO,CAAC,aAAa;IA0DrB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;YACW,aAAa;IAuC3B;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,+BAA+B;IAQvC,OAAO,CAAC,cAAc;IAYtB,OAAO,CAAC,cAAc;IAItB,OAAO,CAAC,cAAc;IAwBtB;;;;OAIG;YACW,aAAa;IA0D3B;;;;;;;;;;;;;;;;;;OAkBG;YACW,uBAAuB;IAoBrC;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IAOhC;;;OAGG;IACH,OAAO,CAAC,kBAAkB;IAmC1B;;;;;OAKG;IACI,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAWnD;;OAEG;IACH,OAAO,CAAC,MAAM;CAGf"}

package/dist/esm/compliance/audit-trails/services/siem-webhook-delivery.backend.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"siem-webhook-delivery.backend.service.js","sourceRoot":"","sources":["../../../../../../src/compliance/audit-trails/services/siem-webhook-delivery.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;;;;;;;;;;;;;AAEH,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AAC/F,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,kCAAkC,EAAE,MAAM,0CAA0C,CAAC;AAC9F,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAChK,OAAO,EAAE,qCAAqC,EAAE,MAAM,+EAA+E,CAAC;AACtI,OAAO,EAIL,gBAAgB,EAChB,qBAAqB,EACrB,cAAc,EACd,oBAAoB,EACpB,eAAe,EACf,qBAAqB,EACrB,eAAe,EACf,aAAa,EACb,kCAAkC,EAClC,kCAAkC,EAClC,gCAAgC,GACjC,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,cAAc,EACd,eAAe,EACf,2BAA2B,EAC3B,uBAAuB,GAGxB,MAAM,gDAAgD,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,4CAA4C,CAAC;AAC5E,OAAO,EACL,yBAAyB,EACzB,kBAAkB,EAClB,0BAA0B,EAC1B,mBAAmB,EACnB,+BAA+B,GAGhC,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,mBAAmB,EACnB,2BAA2B,GAC5B,MAAM,8EAA8E,CAAC;AACtF,OAAO,EAAE,mBAAmB,EAAE,MAAM,sEAAsE,CAAC;AAwC3G;;;;GAIG;AACH,MAAM,yBAAyB,GAAG,kCAAkC,CAAC,8BAA8B,CAAC;AACpG,MAAM,2BAA2B,GAAG,gCAAgC,CAAC;AACrE,4CAA4C;AAC5C,MAAM,2BAA2B,GAAG,wBAAwB,CAAC;AAC7D,oEAAoE;AACpE,MAAM,eAAe,GAAG,0BAA0B,CAAC;AACnD;;;;GAIG;AACH,MAAM,iCAAiC,GAAG,gBAAgB,CAAC;AAC3D;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,gCAAgC,GAAG,IAAI,CAAC;AAE9C,gGAAgG;AAChG,oGAAoG;AACpG,iGAAiG;AACjG,kGAAkG;AAClG,yCAAyC;AACzC,EAAE;AACF,yFAAyF;AAGlF,IAAM,iCAAiC,GAAvC,MAAM,iCAAiC;IAKU;IACU;IACW;IACO;IACG;IARpE,QAAQ,CAA+D;IACvE,eAAe,GAAqC,IAAI,GAAG,EAAE,CAAC;IAE/E,YACsD,MAAqB,EACX,gBAAyC,EAC9B,oBAAwD,EACjD,oBAA+D,EAC5D,uBAA8D;QAJ7F,WAAM,GAAN,MAAM,CAAe;QACX,qBAAgB,GAAhB,gBAAgB,CAAyB;QAC9B,yBAAoB,GAApB,oBAAoB,CAAoC;QACjD,yBAAoB,GAApB,oBAAoB,CAA2C;QAC5D,4BAAuB,GAAvB,uBAAuB,CAAuC;QAEjJ,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,mCAAmC,CAAC,CAAC;QAC7E,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;IAC9E,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,eAAe,CAAC,OAA+B;QAC1D,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,cAAc,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;QACvE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,aAAa,CAAC,YAAY,CAAC;QAClE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,cAAc,CAAC;QAClD,MAAM,UAAU,GAAG,GAAG,SAAS,IAAI,OAAO,EAAE,CAAC;QAE7C,kDAAkD;QAClD,IAAI,YAAY,EAAE,CAAC;YACjB,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,kBAAkB,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,CAAC;gBAC1E,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,6DAA6D,EAAE;oBACjF,SAAS;oBACT,OAAO;oBACP,OAAO,EAAE,QAAQ,CAAC,OAAO;oBACzB,SAAS,EAAE,QAAQ,CAAC,SAAS;iBAC9B,CAAC,CAAC;gBACH,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,0BAA0B,CAAC,CAAC;gBAC9D,OAAO;YACT,CAAC;QACH,CAAC;QAED,0DAA0D;QAC1D,IAAI,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,CAAC;YACpC,IAAI,CAAC,QAAQ,CAAC,gDAAgD,EAAE;gBAC9D,SAAS;gBACT,OAAO;gBACP,OAAO,EAAE,QAAQ,CAAC,OAAO;aAC1B,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QAED,kBAAkB;QAClB,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;QAEhE,gBAAgB;QAChB,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAErD,gCAAgC;QAChC,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC;QACrD,MAAM,aAAa,GAAG,UAAU,CAAC,QAAQ,CAAC,mBAAmB,GAAG,IAAI,CAAC;QACrE,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,cAAc,GAAG,IAAI,CAAC;QAE5D,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,UAAU,EAAE,OAAO,EAAE,EAAE,CAAC;YACvD,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;gBAE1E,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;gBAEhC,IAAI,CAAC,QAAQ,CAAC,qCAAqC,EAAE;oBACnD,SAAS;oBACT,OAAO;oBACP,OAAO,EAAE,QAAQ,CAAC,OAAO;oBACzB,SAAS,EAAE,QAAQ,CAAC,SAAS;oBAC7B,OAAO;iBACR,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,aAAa,GAAG,OAAO,KAAK,UAAU,CAAC;gBAE7C,IAAI,aAAa,EAAE,CAAC;oBAClB,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;oBAEhC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,gDAAgD,EAAE;wBACpE,SAAS;wBACT,OAAO;wBACP,OAAO,EAAE,QAAQ,CAAC,OAAO;wBACzB,SAAS,EAAE,QAAQ,CAAC,SAAS;wBAC7B,QAAQ,EAAE,OAAO,GAAG,CAAC;wBACrB,GAAG,2BAA2B,CAAC,KAAK,CAAC;qBACtC,CAAC,CAAC;oBAEH,2EAA2E;oBAC3E,2EAA2E;oBAC3E,4EAA4E;oBAC5E,iDAAiD;oBACjD,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC;gBACrF,CAAC;qBAAM,CAAC;oBACN,MAAM,SAAS,GAAG,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;oBACvD,IAAI,CAAC,QAAQ,CAAC,wCAAwC,EAAE;wBACtD,SAAS;wBACT,OAAO;wBACP,OAAO,EAAE,QAAQ,CAAC,OAAO;wBACzB,OAAO;wBACP,WAAW,EAAE,SAAS;qBACvB,CAAC,CAAC;oBACH,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBAC/B,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACK,WAAW,CAAC,QAAoC,EAAE,WAAmB;QAC3E,QAAQ,WAAW,EAAE,CAAC;YACpB,KAAK,eAAe,CAAC,GAAG;gBACtB,OAAO,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;YACrC,KAAK,eAAe,CAAC,IAAI;gBACvB,OAAO,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;YACtC,KAAK,eAAe,CAAC,IAAI;gBACvB,uFAAuF;gBACvF,4DAA4D;gBAC5D,OAAO,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;YAClD,KAAK,eAAe,CAAC,eAAe,CAAC;YACrC;gBACE,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,YAAY,CAAC,QAAoC;QACvD,MAAM,WAAW,GAAG,2BAA2B,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACnE,MAAM,GAAG,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,IAAI,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;QAC5E,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,KAAa,EAAU,EAAE,CAAC,IAAI,CAAC,uBAAuB,CAAC,KAAK,EAAE,KAAK,EAAE,yBAAyB,CAAC,CAAC;QAC/H,MAAM,eAAe,GAAG,IAAI,CAAC,yBAAyB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACtE,qFAAqF;QACrF,MAAM,IAAI,GAAG,CAAC,GAAe,EAAE,KAAa,EAAU,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,kBAAkB,CAAC,CAAC;QAC7G,MAAM,IAAI,GAAG,CAAC,GAAG,SAA4B,EAAU,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAE9E,8FAA8F;QAC9F,kGAAkG;QAClG,0FAA0F;QAC1F,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,cAAc,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;aACjG,IAAI,CAAC,GAAG,CAAC,CAAC;QAEb,8FAA8F;QAC9F,mGAAmG;QACnG,mGAAmG;QACnG,6FAA6F;QAC7F,sCAAsC;QACtC,wGAAwG;QACxG,8FAA8F;QAC9F,uGAAuG;QACvG,OAAO,SAAS,MAAM,CAAC,cAAc,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,eAAe,EAAE,eAAe,CAAC,IAAI,MAAM,CAAC,eAAe,EAAE,QAAQ,CAAC,aAAa,CAAC,IAAI,MAAM,CAAC,oBAAoB,EAAE,QAAQ,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,IAAI,WAAW,IAAI,UAAU,EAAE,CAAC;IACnS,CAAC;IAED;;;;;;;;;;OAUG;IACK,aAAa,CAAC,QAAoC;QACxD,MAAM,GAAG,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,KAAa,EAAU,EAAE,CAAC,IAAI,CAAC,uBAAuB,CAAC,KAAK,EAAE,KAAK,EAAE,0BAA0B,CAAC,CAAC;QAChI,MAAM,eAAe,GAAG,IAAI,CAAC,yBAAyB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACtE,+FAA+F;QAC/F,MAAM,IAAI,GAAG,CAAC,GAAgB,EAAE,KAAa,EAAU,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,mBAAmB,CAAC,CAAC;QAC/G,MAAM,IAAI,GAAG,CAAC,GAAG,SAA4B,EAAU,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAE/E,iGAAiG;QACjG,mGAAmG;QACnG,EAAE;QACF,kGAAkG;QAClG,gGAAgG;QAChG,+FAA+F;QAC/F,2DAA2D;QAC3D,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,eAAe,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;aAClG,IAAI,CAAC,IAAI,CAAC,CAAC;QAEd,0FAA0F;QAC1F,gGAAgG;QAChG,2FAA2F;QAC3F,4FAA4F;QAC5F,4FAA4F;QAC5F,gGAAgG;QAChG,kFAAkF;QAClF,OAAO,YAAY,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,SAAS,EAAE,eAAe,CAAC,IAAI,MAAM,CAAC,gBAAgB,EAAE,QAAQ,CAAC,aAAa,CAAC,IAAI,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,IAAI,+BAA+B,IAAI,UAAU,EAAE,CAAC;IACrO,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACK,yBAAyB,CAC/B,QAAoC,EACpC,gBAA2C;QAE3C,uFAAuF;QACvF,qFAAqF;QACrF,uEAAuE;QACvE,MAAM,SAAS,GAAY,QAAQ,CAAC,SAAS,CAAC;QAC9C,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvF,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,UAAkB,CAAC;QACvB,IAAI,CAAC;YACH,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,uFAAuF;YACvF,uEAAuE;YACvE,IAAI,CAAC,QAAQ,CAAC,8DAA8D,EAAE;gBAC5E,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,SAAS,EAAE,QAAQ,CAAC,SAAS;aAC9B,CAAC,CAAC;YACH,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,yFAAyF;QACzF,wFAAwF;QACxF,qCAAqC;QACrC,IAAI,CAAC,UAAU;YAAE,OAAO,SAAS,CAAC;QAElC,IAAI,gBAAgB,CAAC,UAAU,CAAC,CAAC,MAAM,IAAI,gCAAgC;YAAE,OAAO,UAAU,CAAC;QAE/F,4FAA4F;QAC5F,6FAA6F;QAC7F,gGAAgG;QAChG,4FAA4F;QAC5F,uFAAuF;QACvF,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,IAAI,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC;QAChC,OAAO,IAAI,GAAG,OAAO,EAAE,CAAC;YACtB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;YAClD,IAAI,gBAAgB,CAAC,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,gCAAgC,EAAE,CAAC;gBAC7G,IAAI,GAAG,SAAS,CAAC;YACnB,CAAC;iBAAM,CAAC;gBACN,OAAO,GAAG,SAAS,GAAG,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QAEzD,IAAI,CAAC,QAAQ,CAAC,sEAAsE,EAAE;YACpF,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,cAAc,EAAE,UAAU,CAAC,MAAM;YACjC,aAAa,EAAE,SAAS,CAAC,MAAM;YAC/B,aAAa,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC,MAAM;YACjD,QAAQ,EAAE,gCAAgC;SAC3C,CAAC,CAAC;QACH,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;;OAOG;IACK,eAAe,CAAC,UAAkB,EAAE,MAAc;QACxD,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC5C,MAAM,mBAAmB,GAAG,IAAI,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,CAAC;QAC7D,OAAO,GAAG,mBAAmB,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,iCAAiC,EAAE,CAAC;IAC/F,CAAC;IAED,gEAAgE;IAChE,uBAAuB;IACvB,EAAE;IACF,0FAA0F;IAC1F,2FAA2F;IAC3F,8FAA8F;IAC9F,2FAA2F;IAC3F,gGAAgG;IAChG,iGAAiG;IACjG,wDAAwD;IACxD,gEAAgE;IAEhE;;;;;;;;;;;;;;;OAeG;IACK,wBAAwB,CAAC,KAAa;QAC5C,OAAO,KAAK;aACT,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;aACtB,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC;aACpB,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;aACrB,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC3B,CAAC;IAED;;;;;;;;;;OAUG;IACK,gBAAgB,CAAC,KAAa;QACpC,8FAA8F;QAC9F,8FAA8F;QAC9F,gGAAgG;QAChG,+FAA+F;QAC/F,6FAA6F;QAC7F,+FAA+F;QAC/F,iGAAiG;QACjG,+FAA+F;QAC/F,oFAAoF;QACpF,gGAAgG;QAChG,2FAA2F;QAC3F,yFAAyF;QACzF,OAAO,KAAK;aACT,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;aACtB,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;aACrB,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;aACrB,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC3B,CAAC;IAED;;;;;;;;;;;OAWG;IACK,sBAAsB,CAAC,KAAa;QAC1C,OAAO,KAAK;aACT,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;aACtB,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;YACtB,8FAA8F;YAC9F,gFAAgF;aAC/E,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;;OAMG;IACK,iBAAiB,CACvB,QAA+D,EAC/D,QAAoC,EACpC,OAAiC;QAEjC,MAAM,SAAS,GAAa,EAAE,CAAC;QAC/B,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjD,IAAI,UAAU,CAAC,IAAI,KAAK,uBAAuB,CAAC,SAAS;gBAAE,SAAS;YACpE,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACtD,IAAI,QAAQ;gBAAE,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;;;;;OAUG;IACK,SAAS,CACf,GAAM,EACN,QAAgB,EAChB,gBAA2C,EAC3C,QAA0C;QAE1C,OAAO,GAAG,GAAG,IAAI,IAAI,CAAC,uBAAuB,CAAC,GAAG,EAAE,QAAQ,EAAE,gBAAgB,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;IAClG,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACK,uBAAuB,CAC7B,SAAiB,EACjB,QAAgB,EAChB,gBAA2C,EAC3C,GAAuB;QAEvB,MAAM,OAAO,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAC3C,IAAI,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,IAAI,GAAG;YAAE,OAAO,OAAO,CAAC;QAE/D,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,IAAI,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC;QAC9B,OAAO,IAAI,GAAG,OAAO,EAAE,CAAC;YACtB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;YAClD,IAAI,gBAAgB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,GAAG;gBAAE,IAAI,GAAG,SAAS,CAAC;;gBAC9E,OAAO,GAAG,SAAS,GAAG,CAAC,CAAC;QAC/B,CAAC;QACD,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACpC,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,QAAQ,IAAI,MAAM,IAAI,QAAQ,IAAI,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAE/E,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,+CAA+C,EAAE;YAClE,GAAG,EAAE,SAAS;YACd,QAAQ,EAAE,GAAG;YACb,cAAc,EAAE,QAAQ,CAAC,MAAM;YAC/B,aAAa,EAAE,IAAI,CAAC,MAAM;SAC3B,CAAC,CAAC;QACH,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAED;;;;;;OAMG;IACK,uBAAuB,CAC7B,SAAiB,EACjB,QAAgB,EAChB,UAA4C;QAE5C,OAAO,IAAI,CAAC,uBAAuB,CACjC,SAAS,EACT,QAAQ,EACR,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,EAC7C,UAAU,CAAC,SAAS,CAAC,CACtB,CAAC;IACJ,CAAC;IAED;;;;;;;;;OASG;IACK,kBAAkB,CAAC,SAAiB;QAC1C,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACtD,OAAO,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACjF,CAAC;IAED;;OAEG;IACK,aAAa,CACnB,IAAY,EACZ,UAAgD;QAEhD,MAAM,OAAO,GAA2B;YACtC,uFAAuF;YACvF,yFAAyF;YACzF,2FAA2F;YAC3F,iCAAiC;YACjC,0FAA0F;YAC1F,0FAA0F;YAC1F,oFAAoF;YACpF,CAAC,eAAe,CAAC,YAAY,CAAC,EAAE,UAAU,CAAC,WAAW,KAAK,eAAe,CAAC,GAAG,IAAI,UAAU,CAAC,WAAW,KAAK,eAAe,CAAC,IAAI;gBAC/H,CAAC,CAAC,YAAY;gBACd,CAAC,CAAC,kBAAkB;SACvB,CAAC;QAEF,+DAA+D;QAC/D,IAAI,UAAU,CAAC,aAAa,EAAE,CAAC;YAC7B,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,aAAa,CAAC,CAAC;QACnD,CAAC;QAED,kDAAkD;QAClD,MAAM,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;QAE9E,oBAAoB;QACpB,QAAQ,UAAU,CAAC,UAAU,EAAE,CAAC;YAC9B,KAAK,cAAc;gBACjB,IAAI,kBAAkB,EAAE,CAAC;oBACvB,OAAO,CAAC,eAAe,CAAC,aAAa,CAAC,GAAG,UAAU,kBAAkB,EAAE,CAAC;gBAC1E,CAAC;gBACD,MAAM;YAER,KAAK,gBAAgB,CAAC,CAAC,CAAC;gBACtB,MAAM,UAAU,GAAG,UAAU,CAAC,cAAc,IAAI,eAAe,CAAC,OAAO,CAAC;gBACxE,IAAI,kBAAkB,EAAE,CAAC;oBACvB,OAAO,CAAC,UAAU,CAAC,GAAG,kBAAkB,CAAC;gBAC3C,CAAC;gBACD,MAAM;YACR,CAAC;YAED,KAAK,aAAa;gBAChB,IAAI,kBAAkB,EAAE,CAAC;oBACvB,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,EAAE,kBAAkB,CAAC;yBAClD,MAAM,CAAC,IAAI,CAAC;yBACZ,MAAM,CAAC,KAAK,CAAC,CAAC;oBACjB,OAAO,CAAC,eAAe,CAAC,eAAe,CAAC,GAAG,UAAU,IAAI,EAAE,CAAC;gBAC9D,CAAC;gBACD,MAAM;YAER,KAAK,MAAM,CAAC;YACZ;gBACE,MAAM;QACV,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACK,KAAK,CAAC,aAAa,CACzB,GAAW,EACX,IAAY,EACZ,OAA+B,EAC/B,SAAiB;QAEjB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;QAElE,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE;gBAC9C,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,IAAI;gBACJ,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB;;;;;;;;mBAQG;gBACH,iBAAiB,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;gBACtC,qBAAqB,EAAE,IAAI,CAAC,+BAA+B,EAAE;aAC9D,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC3D,MAAM,IAAI,KAAK,CACb,8BAA8B,QAAQ,CAAC,MAAM,KAAK,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAC/E,CAAC;YACJ,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,SAAS,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAED;;;;;;;;;;;OAWG;IACK,+BAA+B;QACrC,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,UAAU,EAAE,iCAAiC,KAAK,IAAI,CAAC;IAC9F,CAAC;IAED,gEAAgE;IAChE,kBAAkB;IAClB,gEAAgE;IAExD,cAAc,CAAC,UAAkB;QACvC,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,gBAAgB;YAAE,OAAO,KAAK,CAAC;QAEpD,IAAI,IAAI,IAAI,EAAE,GAAG,KAAK,CAAC,gBAAgB,EAAE,CAAC;YACxC,KAAK,CAAC,gBAAgB,GAAG,IAAI,CAAC;YAC9B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,cAAc,CAAC,UAAkB;QACvC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC1C,CAAC;IAEO,cAAc,CAAC,UAAkB;QACvC,IAAI,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,EAAE,mBAAmB,EAAE,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC;YAChF,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAC9C,CAAC;QAED,KAAK,CAAC,mBAAmB,EAAE,CAAC;QAC5B,KAAK,CAAC,aAAa,GAAG,IAAI,IAAI,EAAE,CAAC;QAEjC,IAAI,KAAK,CAAC,mBAAmB,IAAI,yBAAyB,EAAE,CAAC;YAC3D,KAAK,CAAC,gBAAgB,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,2BAA2B,CAAC,CAAC;YAC5E,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE;gBAC9C,UAAU;gBACV,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;gBAC9C,UAAU,EAAE,2BAA2B;aACxC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,gEAAgE;IAChE,yBAAyB;IACzB,gEAAgE;IAEhE;;;;OAIG;IACK,KAAK,CAAC,aAAa,CACzB,OAA+B,EAC/B,aAAqB,EACrB,YAAqB;QAErB,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,aAAa,CAAC,YAAY,CAAC;QAClE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,cAAc,CAAC;QAC1D,IAAI,CAAC;YACH,MAAM,eAAe,GAAG,SAAS,KAAK,aAAa,CAAC,WAAW;gBAC7D,CAAC,CAAC,gBAAgB,CAAC,6BAA6B;gBAChD,CAAC,CAAC,gBAAgB,CAAC,8BAA8B,CAAC;YACpD,yEAAyE;YACzE,sFAAsF;YACtF,MAAM,oBAAoB,GAAG,SAAS,KAAK,aAAa,CAAC,WAAW;gBAClE,CAAC,CAAC,kCAAkC,CAAC,gBAAgB,CAAC,WAAW,CAAC;gBAClE,CAAC,CAAC,kCAAkC,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;YAEvE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,eAAe,EAAE,oBAAoB,EAAE,OAAO,CAAC,CAAC;YAC9F,MAAM,OAAO,GAAG,IAAI,CAAC,oBAAoB,CAAC,oBAAoB,CAAC,eAAe,CAAC,CAAC;YAEhF,MAAM,QAAQ,GAAG;gBACf,sEAAsE;gBACtE,mFAAmF;gBACnF,iFAAiF;gBACjF,yEAAyE;gBACzE,mFAAmF;gBACnF,oFAAoF;gBACpF,qFAAqF;gBACrF,uFAAuF;gBACvF,CAAC,oBAAoB,CAAC,EAAE,OAAO;gBAC/B,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,OAAO;gBACjC,YAAY,EAAE,OAAO,CAAC,QAAQ;gBAC9B,aAAa,EAAE,GAAG,aAAa,GAAG,YAAY,CAAC,CAAC,CAAC,KAAK,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;gBAC3E,YAAY,EAAE,CAAC;gBACf,aAAa,EAAE,IAAI,IAAI,EAAE;gBACzB,WAAW,EAAE,aAAa,KAAK,mBAAmB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;gBACrG,MAAM,EAAE,aAAa,KAAK,mBAAmB,CAAC,CAAC,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,aAAa;aACtH,CAAC;YAEF,MAAM,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;YAEnC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sCAAsC,EAAE;gBACvD,SAAS;gBACT,OAAO;gBACP,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,OAAO;gBACjC,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,SAAS;gBACrC,aAAa;aACd,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,QAAQ,EAAE,CAAC;YAClB,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,qCAAqC,EAAE;gBACzD,SAAS;gBACT,OAAO;gBACP,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,OAAO;gBACjC,GAAG,2BAA2B,CAAC,QAAQ,CAAC;aACzC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACK,KAAK,CAAC,uBAAuB,CACnC,eAA6B,EAC7B,oBAA4B,EAC5B,OAAe;QAEf,OAAO,IAAI,CAAC,uBAAuB,CAAC,oCAAoC,CAAC;YACvE,YAAY,EAAE,eAAe;YAC7B,mBAAmB,EAAE,qBAAqB,CAAC,MAAM;YACjD,+BAA+B,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC,CAAC;YAC3E,YAAY,EAAE,IAAI;YAClB,cAAc,EAAE;gBACd,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,mBAAmB,EAAE,oBAAoB,CAAC,WAAW,EAAE;aACzG;SACF,CAAC,CAAC;IACL,CAAC;IAED,gEAAgE;IAChE,4CAA4C;IAC5C,gEAAgE;IAEhE;;;OAGG;IACK,wBAAwB;QAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC;QAC7E,OAAO,UAAU,CAAC,QAAQ,CAAC;aACxB,MAAM,CAAC,GAAG,eAAe,IAAI,OAAO,EAAE,CAAC;aACvC,MAAM,EAAE,CAAC;IACd,CAAC;IAED;;;OAGG;IACK,kBAAkB,CAAC,UAA8B;QACvD,IAAI,CAAC,UAAU;YAAE,OAAO,SAAS,CAAC;QAElC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,2BAA2B,CAAC,EAAE,CAAC;YACxD,8DAA8D;YAC9D,IAAI,CAAC,QAAQ,CAAC,oGAAoG,CAAC,CAAC;YACpH,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,2BAA2B,CAAC,MAAM,CAAC,CAAC;YACrE,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,aAAa,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC9D,IAAI,CAAC,KAAK,IAAI,CAAC,UAAU,IAAI,CAAC,aAAa,EAAE,CAAC;gBAC5C,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;YACzD,CAAC;YAED,MAAM,GAAG,GAAG,IAAI,CAAC,wBAAwB,EAAE,CAAC;YAC5C,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YACrC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;YAC/C,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;YAErD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YAC1D,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YAE7B,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YACjF,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CACjB,mCAAmC,EACnC,2BAA2B,CAAC,KAAK,CAAC,CACnC,CAAC;YACF,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACI,iBAAiB,CAAC,SAAiB;QACxC,MAAM,GAAG,GAAG,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAC5C,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,oBAAoB;QAChD,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAEtD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACpF,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAEpC,OAAO,GAAG,2BAA2B,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IACvH,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,EAAU;QACvB,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IACzD,CAAC;CACF,CAAA;AAh3BY,iCAAiC;IAD7C,UAAU,EAAE;IAMR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,2BAA2B,CAAC,CAAA;IACtD,WAAA,MAAM,CAAC,kBAAkB,CAAC,kCAAkC,CAAC,CAAA;IAC7D,WAAA,MAAM,CAAC,kBAAkB,CAAC,qCAAqC,CAAC,CAAA;qCAJL,aAAa;QACO,uBAAuB;QACR,kCAAkC;QAC3B,yCAAyC;QACnC,qCAAqC;GATxI,iCAAiC,CAg3B7C","sourcesContent":["/**\n * SIEM Webhook Delivery Backend Service\n *\n * Layer 3 of the three-layer audit event pipeline (Step 18).\n * Purpose-built for delivering security audit events to customer SIEM endpoints.\n * NOT a generic M2M webhook sender.\n *\n * Responsibilities:\n * - HTTP POST to webhook URL with configured auth\n * - HMAC-SHA256 signature for hmac_sha256 auth method\n * - Exponential backoff retries\n * - Circuit breaker after N consecutive failures per org\n * - CEF/LEEF format conversion (when eventFormat !== json_structured)\n * - Idempotency via eventId\n */\n\nimport 'reflect-metadata';\nimport { inject, injectable } from 'inversify';\nimport { createHmac, createHash, createCipheriv, createDecipheriv, randomBytes } from 'crypto';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport { AuditEventDispatcherBackendService } from './audit-event-dispatcher.backend.service';\nimport { RepositoriesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/repositories/repositories-registry-handler.backend.service';\nimport { ExecutionContextCreatorBackendService } from '~wildo-backend-lib/runtime/services/execution-context-creator.backend.service';\nimport {\n  type SecurityAuditEventEnvelope,\n  type SiemExportConfigBase,\n  type ResourceType,\n  CoreResourceType,\n  CoreResourceOperation,\n  CORE_APP_ROLES,\n  ResourcePrimaryScope,\n  WildoHeaderKeys,\n  SiemDeliveryDlqStatus,\n  SIEMEventFormat,\n  AuthScopeType,\n  coreResourceShared_FieldIdentifier,\n  SIEM_DELIVERY_RELIABILITY_CONTRACT,\n  SIEM_CIRCUIT_BREAKER_COOLDOWN_MS,\n} from '@wildo-ai/saas-models';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport {\n  CEF_PROJECTION,\n  LEEF_PROJECTION,\n  cefAgentSeverityHeaderValue,\n  SiemFieldProjectionKind,\n  type SiemProjectionContext,\n  type SiemProjectionContract,\n} from './utils/siem-projection-contract.backend.utils';\nimport { buildOcsfEvent } from './utils/siem-ocsf-projection.backend.utils';\nimport {\n  CEF_HEADER_MAX_CHARACTERS,\n  CEF_MAX_CHARACTERS,\n  LEEF_HEADER_MAX_CHARACTERS,\n  LEEF_MAX_CHARACTERS,\n  LEEF_TAB_DELIMITER_HEADER_VALUE,\n  type CefWireKey,\n  type LeefWireKey,\n} from './utils/siem-dictionary.backend.utils';\nimport {\n  describeCaughtError,\n  projectCaughtErrorLogFields,\n} from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { pinnedOutboundFetch } from '~wildo-backend-lib/security/ssrf/pinned-outbound-fetch.backend.utils';\n\n/** Circuit breaker state per organization */\ninterface CircuitBreakerState {\n  consecutiveFailures: number;\n  lastFailureAt: Date | null;\n  circuitOpenUntil: Date | null;\n}\n\n/** Payload shape enqueued by AuditEventDispatcherBackendService */\nexport interface SIEMDeliveryJobPayload {\n  envelope: SecurityAuditEventEnvelope;\n  envelopeHmac?: string; // F6: HMAC integrity signature\n  organizationId: string;\n  /**\n   * Delivery scope. Defaults to {@link AuthScopeType.ORGANIZATION}. The worker is scope-generic (the\n   * circuit-breaker key, DLQ variant, and scope FK all derive from it), but `'application'`\n   * is currently produced ONLY by the SIEM-DLQ retry custom-impl — there is no first-time\n   * app-scoped producer, so the APPLICATION path is reserved / dormant. See\n   * `AuditEventDispatcherBackendService.dispatchToOrganizationAuditSinks`.\n   */\n  scopeType?: AuthScopeType;\n  scopeId?: string;\n  siemConfig: {\n    webhookUrl: string;\n    authMethod: string;\n    authCredential?: string;\n    authHeaderName?: string;\n    eventFormat: string;\n    customHeaders?: Record<string, string>;\n    delivery: {\n      batchSize: number;\n      batchWindowSeconds: number;\n      retryAttempts: number;\n      retryBackoffSeconds: number;\n      timeoutSeconds: number;\n    };\n  };\n}\n\n/**\n * Circuit-breaker bounds come from `SIEM_DELIVERY_RELIABILITY_CONTRACT`, which the customer\n * documentation also projects: what an operator is told about a paused destination is what this\n * service applies.\n */\nconst CIRCUIT_BREAKER_THRESHOLD = SIEM_DELIVERY_RELIABILITY_CONTRACT.circuitBreakerFailureThreshold;\nconst CIRCUIT_BREAKER_COOLDOWN_MS = SIEM_CIRCUIT_BREAKER_COOLDOWN_MS;\n/** Prefix for encrypted credentials (H6) */\nconst ENCRYPTED_CREDENTIAL_PREFIX = 'encrypted:aes-256-gcm:';\n/** HKDF-like domain separator for SIEM encryption key derivation */\nconst SIEM_KEY_DOMAIN = 'wildo:siem:credential:v1';\n/**\n * Appended when the `eventData` detail bag is truncated, so the loss is VISIBLE to the receiver\n * rather than silent. A SOC that sees a JSON fragment ending mid-object cannot tell a truncation\n * from a serializer bug; this marker makes the difference explicit on the wire.\n */\nconst SIEM_EVENT_DATA_TRUNCATION_MARKER = '...[truncated]';\n/**\n * Maximum characters of serialized `eventData` carried in the single CEF/LEEF detail field,\n * INCLUDING {@link SIEM_EVENT_DATA_TRUNCATION_MARKER} when truncation occurs — the emitted value\n * never exceeds this bound.\n *\n * This is the CEF extension dictionary's own published length for `msg`, not a Wildo-invented\n * policy. LEEF publishes no per-attribute ceiling, so the same bound is applied there for\n * cross-format consistency: an unbounded detail bag is the realistic way a CEF/LEEF line grows\n * large enough for a receiver to reject it, which would fail the delivery into the DLQ.\n *\n * spec-cite: Implementing ArcSight CEF v26, Oct 2023 — ArcSight Extension Dictionary, \"CEF Key\n * Names for Event Producers\", `msg` row: full name `message`, data type `String`, length `1023`,\n * \"An arbitrary message giving more details about the event.\"\n *\n * The bound is applied to the ESCAPED value, i.e. to what actually goes on the wire. An earlier\n * revision bounded the value BEFORE escaping, on the reading that the ceiling describes the field's\n * CONTENT and escape sequences are transport encoding a receiver strips before it ever sees the\n * field. That reading is defensible and the document does not settle it — which is precisely why the\n * post-escape bound is the one to hold: escaping only ever expands (`=` → `\\=`, `\\` → `\\\\`), so a\n * value within the ceiling once encoded is necessarily within it once decoded. Bounding the encoded\n * form satisfies BOTH readings; bounding the decoded form satisfies only one, and an escape-heavy\n * bag sitting at the ceiling would have gone out over-long under the other.\n */\nconst SIEM_EVENT_DATA_DETAIL_MAX_CHARS = 1023;\n\n// The per-key ceilings and the `devTimeFormat` pattern used to live here as hand-kept constants\n// beside the formatter. They now live in the dictionary spine (`siem-dictionary.backend.utils.ts`),\n// DERIVED from the transcribed rows, because a ceiling maintained next to a key list is the same\n// artefact as the key list itself: adding a key and forgetting its published maximum was possible\n// right up until the derivation existed.\n//\n// Line comments, not a JSDoc block — a `/** */` here would attach to the class below it.\n\n@injectable()\nexport class SIEMWebhookDeliveryBackendService {\n  private readonly logDebug: (message: string, context?: Record<string, unknown>) => void;\n  private readonly circuitBreakers: Map<string, CircuitBreakerState> = new Map();\n\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n    @inject(SAAS_SERVICE_TYPES.AppConfigService) private readonly appConfigService: AppConfigurationService,\n    @inject(SAAS_SERVICE_TYPES.AuditEventDispatcherService) private readonly auditEventDispatcher: AuditEventDispatcherBackendService,\n    @inject(SAAS_SERVICE_TYPES.RepositoriesRegistryHandlerService) private readonly repositoriesRegistry: RepositoriesRegistryHandlerBackendService,\n    @inject(SAAS_SERVICE_TYPES.ExecutionContextCreatorBackendService) private readonly executionContextCreator: ExecutionContextCreatorBackendService,\n  ) {\n    this.logDebug = this.logger.debugByType('SIEMWebhookDeliveryBackendService');\n    this.logger.setDebugTypeLogging('SIEMWebhookDeliveryBackendService', false);\n  }\n\n  /**\n   * Process a SIEM delivery job from the queue.\n   * Called by the job consumer when a `siem.webhook-delivery` batch job is dequeued.\n   */\n  public async processDelivery(payload: SIEMDeliveryJobPayload): Promise<void> {\n    const { envelope, envelopeHmac, organizationId, siemConfig } = payload;\n    const scopeType = payload.scopeType ?? AuthScopeType.ORGANIZATION;\n    const scopeId = payload.scopeId ?? organizationId;\n    const circuitKey = `${scopeType}:${scopeId}`;\n\n    // F6: Verify envelope integrity before processing\n    if (envelopeHmac) {\n      if (!this.auditEventDispatcher.verifyEnvelopeHmac(envelope, envelopeHmac)) {\n        this.logger.error?.('SIEM envelope HMAC verification failed — possible tampering', {\n          scopeType,\n          scopeId,\n          eventId: envelope.eventId,\n          eventType: envelope.eventType,\n        });\n        await this._enqueueToDLQ(payload, 'hmac_verification_failed');\n        return;\n      }\n    }\n\n    // Circuit breaker check — M11: DLQ instead of silent drop\n    if (this._isCircuitOpen(circuitKey)) {\n      this.logDebug('Circuit breaker open for scope, sending to DLQ', {\n        scopeType,\n        scopeId,\n        eventId: envelope.eventId,\n      });\n      await this._enqueueToDLQ(payload, 'circuit_breaker_open');\n      return;\n    }\n\n    // Format the body\n    const body = this._formatBody(envelope, siemConfig.eventFormat);\n\n    // Build headers\n    const headers = this._buildHeaders(body, siemConfig);\n\n    // Attempt delivery with retries\n    const maxRetries = siemConfig.delivery.retryAttempts;\n    const baseBackoffMs = siemConfig.delivery.retryBackoffSeconds * 1000;\n    const timeoutMs = siemConfig.delivery.timeoutSeconds * 1000;\n\n    for (let attempt = 0; attempt <= maxRetries; attempt++) {\n      try {\n        await this._sendHttpPost(siemConfig.webhookUrl, body, headers, timeoutMs);\n\n        this._recordSuccess(circuitKey);\n\n        this.logDebug('SIEM webhook delivered successfully', {\n          scopeType,\n          scopeId,\n          eventId: envelope.eventId,\n          eventType: envelope.eventType,\n          attempt,\n        });\n        return;\n      } catch (error) {\n        const isLastAttempt = attempt === maxRetries;\n\n        if (isLastAttempt) {\n          this._recordFailure(circuitKey);\n\n          this.logger.error?.('SIEM webhook delivery failed after all retries', {\n            scopeType,\n            scopeId,\n            eventId: envelope.eventId,\n            eventType: envelope.eventType,\n            attempts: attempt + 1,\n            ...projectCaughtErrorLogFields(error),\n          });\n\n          // `describeCaughtError`, not an `instanceof Error` ternary: this string is\n          // PERSISTED as the DLQ record's failure reason, and a `WildoError_Backend`\n          // is a plain object — the ternary would store `'[object Object]'` for every\n          // structured fault, making the DLQ untriageable.\n          await this._enqueueToDLQ(payload, 'retries_exhausted', describeCaughtError(error));\n        } else {\n          const backoffMs = baseBackoffMs * Math.pow(2, attempt);\n          this.logDebug('SIEM webhook delivery failed, retrying', {\n            scopeType,\n            scopeId,\n            eventId: envelope.eventId,\n            attempt,\n            nextRetryMs: backoffMs,\n          });\n          await this._sleep(backoffMs);\n        }\n      }\n    }\n  }\n\n  /**\n   * Format the event body based on the configured event format.\n   *\n   * `json_structured` ships the envelope verbatim. CEF and LEEF are flat, single-line `key=value`\n   * grammars, so they project the envelope in two tiers: the standard/indexed keys each grammar\n   * defines (`cat`, `outcome`, `src`, …), followed by the free-form `eventData` bag serialized\n   * into that grammar's single detail field. Every envelope field therefore reaches all three\n   * formats; only the ENCODING differs.\n   */\n  private _formatBody(envelope: SecurityAuditEventEnvelope, eventFormat: string): string {\n    switch (eventFormat) {\n      case SIEMEventFormat.CEF:\n        return this._formatAsCEF(envelope);\n      case SIEMEventFormat.LEEF:\n        return this._formatAsLEEF(envelope);\n      case SIEMEventFormat.OCSF:\n        // OCSF is JSON, so there is no escaping/bounding layer here — the projection returns a\n        // document and the only transport concern is serialisation.\n        return JSON.stringify(buildOcsfEvent(envelope));\n      case SIEMEventFormat.JSON_STRUCTURED:\n      default:\n        return JSON.stringify(envelope);\n    }\n  }\n\n  /**\n   * Format event as CEF (Common Event Format).\n   * CEF:Version|Device Vendor|Device Product|Device Version|Signature ID|Name|Severity|Extension\n   */\n  private _formatAsCEF(envelope: SecurityAuditEventEnvelope): string {\n    const cefSeverity = cefAgentSeverityHeaderValue(envelope.severity);\n    const ext = (value: string): string => this._escapeCEFExtensionValue(value);\n    const header = (field: string, value: string): string => this._emitBoundedHeaderField(field, value, CEF_HEADER_MAX_CHARACTERS);\n    const eventDataDetail = this._serializeEventDataDetail(envelope, ext);\n    // CEF extensions are SPACE-delimited, so that is what `join` means for this grammar.\n    const pair = (key: CefWireKey, value: string): string => this._emitPair(key, value, ext, CEF_MAX_CHARACTERS);\n    const join = (...fragments: readonly string[]): string => fragments.join(' ');\n\n    // Driven by CEF_PROJECTION, so a field cannot be dropped by being forgotten — the contract is\n    // exhaustive over the envelope type and declaration order is wire order. The per-field reasoning,\n    // citations and the csN-budget decision all live there, next to the mapping they justify.\n    const extensions = this._renderProjection(CEF_PROJECTION, envelope, { pair, join, eventDataDetail })\n      .join(' ');\n\n    // Header fields 5 and 6 are DIFFERENT questions and used to receive the same answer. Field 5,\n    // `Device Event Class ID`, is the stable signature a QID/correlation rule keys on — `eventType` is\n    // exactly that. Field 6, `Name`, is documented as \"a human-readable and understandable description\n    // of the event\", so `user_account_locked` twice gave a SOC a machine token in the column its\n    // console renders as the event title.\n    // spec-cite: Implementing ArcSight CEF v26, Oct 2023 — \"Header Field Definitions\", `deviceEventClassId`\n    // row (\"a unique identifier for each event-type … also known as Signature ID\") and `name` row\n    // (String, 512): \"a string representing a human-readable and understandable description of the event.\"\n    return `CEF:0|${header('deviceVendor', 'Wildo')}|${header('deviceProduct', 'SecurityAudit')}|${header('deviceVersion', envelope.sourceVersion)}|${header('deviceEventClassId', envelope.eventType)}|${header('name', this._humanizeEventType(envelope.eventType))}|${cefSeverity}|${extensions}`;\n  }\n\n  /**\n   * Format event as LEEF (Log Event Extended Format — IBM QRadar).\n   * LEEF:Version|Vendor|Product|Version|EventID|Extension\n   *\n   * The serialized `eventData` bag rides a custom `eventData` attribute. It is deliberately NOT\n   * called `msg` as in the CEF projection: `msg` earns that name in CEF by being a dictionary key\n   * with a defined meaning, whereas LEEF publishes no such key — borrowing CEF's vocabulary here\n   * would imply a standard attribute that does not exist. Each grammar gets the name that is\n   * correct within it.\n   * spec-cite: N/A — `eventData` is a Wildo-chosen custom attribute name, not a LEEF-defined key.\n   */\n  private _formatAsLEEF(envelope: SecurityAuditEventEnvelope): string {\n    const val = (value: string): string => this._escapeLEEFValue(value);\n    const header = (field: string, value: string): string => this._emitBoundedHeaderField(field, value, LEEF_HEADER_MAX_CHARACTERS);\n    const eventDataDetail = this._serializeEventDataDetail(envelope, val);\n    // LEEF attributes are TAB-delimited (we emit no `DelimiterCharacter`), so that is `join` here.\n    const pair = (key: LeefWireKey, value: string): string => this._emitPair(key, value, val, LEEF_MAX_CHARACTERS);\n    const join = (...fragments: readonly string[]): string => fragments.join('\\t');\n\n    // Driven by LEEF_PROJECTION. LEEF reaches ALL 27 envelope fields because a LEEF custom key stays\n    // searchable in QRadar, where a CEF custom extension does not — see the contract for the citation.\n    //\n    // `sev`, `devTime` and `devTimeFormat` are rendered BY the contract now. They used to be appended\n    // here, which looked like a formatter detail and was a hole: a key emitted outside `pair` skips\n    // its published ceiling, the duplicate-key check, and the declared-vs-emitted test — and `sev`\n    // is precisely a key with a published constraint (`1-10`).\n    const extensions = this._renderProjection(LEEF_PROJECTION, envelope, { pair, join, eventDataDetail })\n      .join('\\t');\n\n    // Six header fields, not five. The sixth is the attribute DelimiterCharacter, which every\n    // LEEF 2.0 example in the guide carries and ours omitted — see LEEF_TAB_DELIMITER_HEADER_VALUE:\n    // a parser splitting a 2.0 header into six fields was consuming our first attribute as it.\n    // Vendor and Product go through `header()` too, though they are constants that need neither\n    // escaping nor bounding. The point is that EVERY header field goes through the one door, so\n    // \"is this field covered?\" is answerable by looking rather than by reasoning about each value —\n    // the same reason `rt` was routed through `pair` even though digits never change.\n    return `LEEF:2.0|${header('vendor', 'Wildo')}|${header('product', 'SecurityAudit')}|${header('productVersion', envelope.sourceVersion)}|${header('eventId', envelope.eventType)}|${LEEF_TAB_DELIMITER_HEADER_VALUE}|${extensions}`;\n  }\n\n  /**\n   * Serialize `envelope.eventData` into the single detail field that CEF (`msg`) and LEEF\n   * (`eventData`) each carry, or `undefined` when there is nothing worth saying — the caller's\n   * `.filter(Boolean)` then drops the key entirely instead of emitting an empty one.\n   *\n   * Without this, CEF/LEEF subscribers received ONLY the curated standard keys while\n   * `json_structured` subscribers received the whole bag: a silent capability gap between\n   * formats, not a deliberate reduction.\n   *\n   * REJECTED ALTERNATIVE — flattening each `eventData` entry into its own extension key\n   * (`lockoutDuration=15`, `sessionId=…`). It reads better as SIEM columns, but it is unsound\n   * here. `eventData` is an OPEN, app-extensible bag whose keys routinely collide both with the\n   * CEF/LEEF dictionaries and with the envelope fields already projected above it: the\n   * `USER_LOGIN_FAILED` bag alone carries `failureReason`, `ipAddress` and `email`, which the\n   * dispatcher has already promoted onto the envelope and which this formatter already emits as\n   * `reason`, `src` and `suser`. Flattening would therefore put `src=` on the line TWICE and leave\n   * which one wins to the receiver's parser. Nested objects and arrays have no flat\n   * representation either. One JSON field keeps the standard keys authoritative AND the bag\n   * lossless, at the cost of a second parse step on the receiving end.\n   *\n   * The returned JSON is escaped by the CALLER for its grammar, so a backslash ends up encoded\n   * twice — once by `JSON.stringify`, once by the CEF/LEEF escaper. That is correct and\n   * required: a receiver un-escapes the wire grammar first, then parses the JSON.\n   */\n  private _serializeEventDataDetail(\n    envelope: SecurityAuditEventEnvelope,\n    escapeForGrammar: (value: string) => string,\n  ): string | undefined {\n    // Defensive: the envelope TYPE requires `eventData`, but this formatter also runs over\n    // envelopes replayed from the DLQ, where a stored bag can be absent or malformed. An\n    // unguarded `Object.keys(undefined)` here would throw inside delivery.\n    const eventData: unknown = envelope.eventData;\n    if (!eventData || typeof eventData !== 'object' || Object.keys(eventData).length === 0) {\n      return undefined;\n    }\n\n    let serialized: string;\n    try {\n      serialized = JSON.stringify(eventData);\n    } catch {\n      // A circular / unserializable bag must not fail the whole delivery — the standard keys\n      // above it are still valuable to a SOC, so drop only the detail field.\n      this.logDebug('SIEM eventData detail omitted — bag is not JSON-serializable', {\n        eventId: envelope.eventId,\n        eventType: envelope.eventType,\n      });\n      return undefined;\n    }\n\n    // `JSON.stringify` returns `undefined` for a value it cannot represent at all; the guard\n    // above makes that unreachable for a non-empty plain object, but a `toJSON()` returning\n    // `undefined` would still land here.\n    if (!serialized) return undefined;\n\n    if (escapeForGrammar(serialized).length <= SIEM_EVENT_DATA_DETAIL_MAX_CHARS) return serialized;\n\n    // Largest prefix whose ESCAPED form, marker included, still fits. A prefix length cannot be\n    // computed arithmetically because expansion depends on which characters the prefix contains,\n    // and it is not uniform across the two grammars (CEF escapes `=`, LEEF does not). Binary search\n    // costs O(log n) escape passes and is exact; a fixed safety margin would be a guess that is\n    // simultaneously too small for a delimiter-dense bag and wasteful for an ordinary one.\n    let fits = 0;\n    let tooLong = serialized.length;\n    while (fits < tooLong) {\n      const candidate = Math.ceil((fits + tooLong) / 2);\n      if (escapeForGrammar(this._truncateDetail(serialized, candidate)).length <= SIEM_EVENT_DATA_DETAIL_MAX_CHARS) {\n        fits = candidate;\n      } else {\n        tooLong = candidate - 1;\n      }\n    }\n    const truncated = this._truncateDetail(serialized, fits);\n\n    this.logDebug('SIEM eventData detail truncated to the CEF/LEEF detail-field ceiling', {\n      eventId: envelope.eventId,\n      eventType: envelope.eventType,\n      originalLength: serialized.length,\n      emittedLength: truncated.length,\n      escapedLength: escapeForGrammar(truncated).length,\n      maxChars: SIEM_EVENT_DATA_DETAIL_MAX_CHARS,\n    });\n    return truncated;\n  }\n\n  /**\n   * Cut `serialized` to `length` UTF-16 units and append the truncation marker.\n   *\n   * The marker is counted INSIDE the ceiling by the caller's search, not appended beyond it — a\n   * bound that its own truncation overshoots is not a bound. A cut landing between the halves of a\n   * surrogate pair would emit a lone surrogate, which `JSON.parse` on the receiving end rejects with\n   * a different error than the truncation it actually is, so the trailing half-pair is dropped.\n   */\n  private _truncateDetail(serialized: string, length: number): string {\n    const cut = serialized.slice(0, length);\n    const last = cut.charCodeAt(cut.length - 1);\n    const endsOnHighSurrogate = last >= 0xd800 && last <= 0xdbff;\n    return `${endsOnHighSurrogate ? cut.slice(0, -1) : cut}${SIEM_EVENT_DATA_TRUNCATION_MARKER}`;\n  }\n\n  // ─────────────────────────────────────────────────────────────\n  // Wire-format escaping\n  //\n  // CEF and LEEF are single-line, delimiter-separated grammars with NO quoting construct: a\n  // delimiter appearing raw inside a value does not produce a malformed record that a parser\n  // rejects — it produces a WELL-FORMED record with silently wrong fields. That failure mode is\n  // why these helpers exist and why EVERY interpolated string value goes through one of them\n  // rather than only the fields believed to be risky today. `outcomeReason` in particular is free\n  // text sourced from `eventData.failureReason` / `eventData.reason`, so it is the first projected\n  // field with no vocabulary constraining its characters.\n  // ─────────────────────────────────────────────────────────────\n\n  /**\n   * Escape a value for a CEF *extension* (`key=value`) slot.\n   *\n   * The extension is a space-separated `key=value` list whose parser delimits on the next\n   * `<key>=`, so per the CEF standard:\n   * - `\\` becomes `\\\\` — it is the escape character itself, which is why it MUST be replaced\n   *   first; doing it later would re-escape the backslashes introduced by the rules below.\n   * - `=` becomes `\\=` — an unescaped `=` is read as the start of the next key/value pair.\n   * - CR/LF become the two-character sequences `\\r` / `\\n` — a real newline terminates the\n   *   record and truncates every remaining field.\n   *\n   * Spaces are deliberately NOT escaped: the grammar permits them inside extension values (a\n   * value is delimited by the next `<key>=`, not by whitespace).\n   * spec-cite: Implementing ArcSight CEF v26, Oct 2023 — \"Character Encoding\" / the extension\n   * escaping rules for pipe, backslash and equals in the Extension field.\n   */\n  private _escapeCEFExtensionValue(value: string): string {\n    return value\n      .replace(/\\\\/g, '\\\\\\\\')\n      .replace(/=/g, '\\\\=')\n      .replace(/\\r/g, '\\\\r')\n      .replace(/\\n/g, '\\\\n');\n  }\n\n  /**\n   * Escape a value for a LEEF attribute slot.\n   *\n   * LEEF pairs are TAB-delimited, so a literal tab fabricates an extra attribute and a newline\n   * terminates the record; both are encoded as their escape sequences (`\\` first, for the same\n   * reason as above). `=` needs NO escaping here — a LEEF parser splits each pair on its FIRST\n   * `=`, so subsequent `=` characters remain part of the value.\n   * spec-cite: N/A — LEEF publishes no escaping table for attribute values; these rules are\n   * derived from its tab-delimited, newline-terminated record structure, which is why the `=`\n   * asymmetry with CEF above is deliberate rather than an oversight.\n   */\n  private _escapeLEEFValue(value: string): string {\n    // ⚠️ `|` and `^` are deliberately NOT escaped, and the reasoning is the point rather than the\n    // conclusion. The guide's best practices say to AVOID them in keys and values — it defines no\n    // escape for them, because LEEF 2.0's answer is the header's `DelimiterCharacter`, which lets a\n    // producer CHOOSE the attribute delimiter (caret is a documented choice). Inventing `\\|` would\n    // therefore corrupt the value at every conformant receiver, which is strictly worse than the\n    // mis-parse it guards against — and that mis-parse needs a non-conformant parser splitting the\n    // whole line on `|`, since the header ends at its fifth. We emit no `DelimiterCharacter`, so the\n    // delimiter is TAB and a caret in a value is inert. If a `DelimiterCharacter` is ever emitted,\n    // THAT character becomes escapable-or-forbidden and this decision must be re-taken.\n    // spec-cite: IBM QRadar LEEF Version 2 (© IBM 2013, 2016) — \"Best practices Guidelines for LEEF\n    // events\": \"Use alphanumeric (A-Z, a-z, and 0-9) characters, but avoid tab, pipe, or caret\n    // delimiters in your event payload keys and values\"; Table 2, `Delimiter Character` row.\n    return value\n      .replace(/\\\\/g, '\\\\\\\\')\n      .replace(/\\t/g, '\\\\t')\n      .replace(/\\r/g, '\\\\r')\n      .replace(/\\n/g, '\\\\n');\n  }\n\n  /**\n   * Escape a value for a CEF or LEEF *header* slot (the `|`-delimited prefix shared by both\n   * grammars).\n   *\n   * A literal `|` would fabricate a header field and shift every subsequent one — including the\n   * severity and the entire extension — so it is escaped as `\\|`. Headers cannot span lines at\n   * all (there is no multi-line encoding for them, unlike extension values), so newlines are\n   * folded to a space rather than escaped.\n   *\n   * Applied defensively: `sourceVersion` is read straight from the `APP_VERSION` environment\n   * variable and `eventType` is app-extensible, so neither is guaranteed delimiter-free.\n   */\n  private _escapeSIEMHeaderField(value: string): string {\n    return value\n      .replace(/\\\\/g, '\\\\\\\\')\n      .replace(/\\|/g, '\\\\|')\n      // Any CR or LF, in any combination — not just `\\r?\\n`. A LONE `\\r` slipped through that form,\n      // and a bare CR terminates a record for readers that treat it as a line ending.\n      .replace(/[\\r\\n]+/g, ' ');\n  }\n\n  /**\n   * Render a projection contract into its emitted fragments, in declaration order.\n   *\n   * Only `extension` entries produce wire output. `header` entries are carried by the caller's header\n   * construction and `not-projected` entries deliberately produce nothing — both exist in the contract\n   * so that COVERAGE is a property of the type rather than of anyone's memory.\n   */\n  private _renderProjection<K extends string>(\n    contract: SiemProjectionContract<SecurityAuditEventEnvelope, K>,\n    envelope: SecurityAuditEventEnvelope,\n    context: SiemProjectionContext<K>,\n  ): string[] {\n    const fragments: string[] = [];\n    for (const projection of Object.values(contract)) {\n      if (projection.kind !== SiemFieldProjectionKind.EXTENSION) continue;\n      const fragment = projection.render(envelope, context);\n      if (fragment) fragments.push(fragment);\n    }\n    return fragments;\n  }\n\n  /**\n   * Emit one `key=value` pair, escaped for its grammar and bounded by the key's PUBLISHED ceiling.\n   *\n   * The bound is measured on the ESCAPED value for the same reason as the detail bag: escaping only\n   * expands, so bounding the encoded form is the only bound that holds under both readings of what a\n   * published length governs. A key absent from `maxByKey` has no published limit and is emitted\n   * whole — the table never invents one.\n   *\n   * Truncation is LOUD. Losing the tail of an id or an email is a data defect, not a formatting\n   * detail, and the receiver cannot tell a truncated value from a short one.\n   */\n  private _emitPair<K extends string>(\n    key: K,\n    rawValue: string,\n    escapeForGrammar: (value: string) => string,\n    maxByKey: Readonly<Record<string, number>>,\n  ): string {\n    return `${key}=${this._boundToPublishedLength(key, rawValue, escapeForGrammar, maxByKey[key])}`;\n  }\n\n  /**\n   * Escape a value and bound the ESCAPED result at its published ceiling, or emit it whole when the\n   * document publishes none.\n   *\n   * Shared by the extension path ({@link _emitPair}) and the header path\n   * ({@link _emitBoundedHeaderField}) because both answer the same question and only one of them used\n   * to. Header fields never passed through `_emitPair`, so every published header size — most\n   * pointedly `deviceVersion`'s 31 characters, which carries `APP_VERSION` — was unenforced while the\n   * extension ceilings were being carefully derived from the dictionary one layer away. Two code\n   * paths for one rule is how that happened; there is one now.\n   *\n   * The bound is measured on the escaped form for the reason given at\n   * {@link SIEM_EVENT_DATA_DETAIL_MAX_CHARS}: escaping only expands, so a value within the ceiling\n   * once encoded is within it once decoded, which satisfies both readings of what a published length\n   * governs. Truncation is LOUD — losing the tail of a version or an id is a data defect, and the\n   * receiver cannot tell a truncated value from a short one.\n   */\n  private _boundToPublishedLength(\n    fieldName: string,\n    rawValue: string,\n    escapeForGrammar: (value: string) => string,\n    max: number | undefined,\n  ): string {\n    const escaped = escapeForGrammar(rawValue);\n    if (max === undefined || escaped.length <= max) return escaped;\n\n    let fits = 0;\n    let tooLong = rawValue.length;\n    while (fits < tooLong) {\n      const candidate = Math.ceil((fits + tooLong) / 2);\n      if (escapeForGrammar(rawValue.slice(0, candidate)).length <= max) fits = candidate;\n      else tooLong = candidate - 1;\n    }\n    const cut = rawValue.slice(0, fits);\n    const lastCode = cut.charCodeAt(cut.length - 1);\n    const kept = lastCode >= 0xd800 && lastCode <= 0xdbff ? cut.slice(0, -1) : cut;\n\n    this.logger.warn?.('SIEM field truncated to its published ceiling', {\n      key: fieldName,\n      maxChars: max,\n      originalLength: rawValue.length,\n      emittedLength: kept.length,\n    });\n    return escapeForGrammar(kept);\n  }\n\n  /**\n   * Emit one `|`-delimited header field, escaped for the shared header grammar and bounded by the\n   * size its document publishes for THAT slot.\n   *\n   * A header field cannot be dropped when it misbehaves — an omitted field shifts every field after\n   * it and silently re-interprets the whole record — so the only available degradation is truncation.\n   */\n  private _emitBoundedHeaderField(\n    fieldName: string,\n    rawValue: string,\n    maxByField: Readonly<Record<string, number>>,\n  ): string {\n    return this._boundToPublishedLength(\n      fieldName,\n      rawValue,\n      (value) => this._escapeSIEMHeaderField(value),\n      maxByField[fieldName],\n    );\n  }\n\n  /**\n   * `user_account_locked` → `User account locked`, for CEF's human-readable `Name` header field.\n   *\n   * Derived rather than authored: the envelope carries no display label, and inventing a lookup table\n   * would be a second vocabulary to keep in sync with `CoreAuditableEventType` — the drift shape this\n   * codebase keeps paying for. A derivation cannot go stale.\n   *\n   * Deliberately NOT applied to `Device Event Class ID`, which must stay the machine token: a\n   * correlation rule keyed on a prettified string would break the moment the prettifier changed.\n   */\n  private _humanizeEventType(eventType: string): string {\n    const words = eventType.replace(/[_-]+/g, ' ').trim();\n    return words ? `${words.charAt(0).toUpperCase()}${words.slice(1)}` : eventType;\n  }\n\n  /**\n   * Build HTTP headers for the SIEM webhook request.\n   */\n  private _buildHeaders(\n    body: string,\n    siemConfig: SIEMDeliveryJobPayload['siemConfig'],\n  ): Record<string, string> {\n    const headers: Record<string, string> = {\n      // Second reader of `eventFormat` in this file (the first is `_formatBody`). Both route\n      // through the SIEMEventFormat vocabulary so a future format value cannot be added to the\n      // switch and silently forgotten here, where the wrong Content-Type makes a receiver reject\n      // an otherwise well-formed body.\n      // OCSF is JSON too, so the test is \"is this a TEXT grammar\", not \"is it json_structured\".\n      // Reading it the other way would have shipped OCSF as `text/plain` — a well-formed body a\n      // receiver may refuse to parse, which is this workstream's signature failure shape.\n      [WildoHeaderKeys.CONTENT_TYPE]: siemConfig.eventFormat === SIEMEventFormat.CEF || siemConfig.eventFormat === SIEMEventFormat.LEEF\n        ? 'text/plain'\n        : 'application/json',\n    };\n\n    // Apply custom headers first (auth headers override if needed)\n    if (siemConfig.customHeaders) {\n      Object.assign(headers, siemConfig.customHeaders);\n    }\n\n    // H6: Resolve (decrypt) the credential before use\n    const resolvedCredential = this._resolveCredential(siemConfig.authCredential);\n\n    // Apply auth method\n    switch (siemConfig.authMethod) {\n      case 'bearer_token':\n        if (resolvedCredential) {\n          headers[WildoHeaderKeys.AUTHORIZATION] = `Bearer ${resolvedCredential}`;\n        }\n        break;\n\n      case 'api_key_header': {\n        const headerName = siemConfig.authHeaderName || WildoHeaderKeys.API_KEY;\n        if (resolvedCredential) {\n          headers[headerName] = resolvedCredential;\n        }\n        break;\n      }\n\n      case 'hmac_sha256':\n        if (resolvedCredential) {\n          const hmac = createHmac('sha256', resolvedCredential)\n            .update(body)\n            .digest('hex');\n          headers[WildoHeaderKeys.X_SIGNATURE_256] = `sha256=${hmac}`;\n        }\n        break;\n\n      case 'none':\n      default:\n        break;\n    }\n\n    return headers;\n  }\n\n  /**\n   * Send HTTP POST to the SIEM webhook endpoint.\n   *\n   * ## Why this is not a plain `fetch`\n   *\n   * `webhookUrl` is TENANT-authored: an organization administrator types it, and this worker POSTs\n   * to it holding the deployment's own network position. That is the fifth of the five outbound\n   * target classes `security/ssrf/outbound-target-guard.backend.utils.ts` was written for — its\n   * header names \"SIEM collectors\" explicitly — and it was the one class that never called it. A\n   * `webhookUrl` of `http://169.254.169.254/latest/meta-data/iam/security-credentials/` was\n   * delivered to, with the tenant's own auth headers attached, and the response body came back\n   * inside the thrown error's message.\n   *\n   * {@link pinnedOutboundFetch} closes three separate holes here, not one:\n   *\n   * 1. **No classification at all.** The shape check now refuses a literal internal address and a\n   *    reserved special-use hostname before anything leaves the process.\n   * 2. **Check-then-connect.** The address is classified inside the connection's `lookup` hook, so a\n   *    name that answers public to a validator and private to the socket never gets one.\n   * 3. **Redirects.** The old call omitted `redirect: 'error'`, so even a perfect check would have\n   *    been walked past by a collector answering `302 Location: http://169.254.169.254/`. This\n   *    client cannot follow a redirect at all — a 302 arrives as a 302 and fails the `ok` test\n   *    below, landing in the retry/DLQ path like any other bad response.\n   *\n   * ## The behaviour change, stated rather than discovered\n   *\n   * A collector that today answers a redirect stops being followed and starts failing. That is\n   * deliberate: a redirect is precisely how the guard is bypassed, and a SIEM endpoint that needs\n   * one should be reconfigured to its final address. A collector on a PRIVATE network keeps working\n   * only when the operator has declared\n   * `auditTrail.allowPrivateNetworkSiemCollectors` — see {@link _admitsPrivateNetworkCollectors}.\n   */\n  private async _sendHttpPost(\n    url: string,\n    body: string,\n    headers: Record<string, string>,\n    timeoutMs: number,\n  ): Promise<void> {\n    const controller = new AbortController();\n    const timeoutId = setTimeout(() => controller.abort(), timeoutMs);\n\n    try {\n      const response = await pinnedOutboundFetch(url, {\n        method: 'POST',\n        headers,\n        body,\n        signal: controller.signal,\n        /**\n         * BOTH schemes, unlike CIMD's https-only policy, and the asymmetry is deliberate rather than\n         * an oversight. `webhookUrl` is authored configuration that predates this guard and `http:`\n         * collectors exist in the field on trusted internal networks; refusing plaintext here would\n         * silently stop delivering security events for those deployments, which is a worse security\n         * outcome than the transport weakness it would remove. Narrowing this to `https:` is a\n         * separate, operator-visible decision with its own migration — not a side effect of adding\n         * an SSRF guard.\n         */\n        admittedProtocols: ['https:', 'http:'],\n        admitPrivateAddresses: this._admitsPrivateNetworkCollectors(),\n      });\n\n      if (!response.ok) {\n        const responseText = await response.text().catch(() => '');\n        throw new Error(\n          `SIEM webhook returned HTTP ${response.status}: ${responseText.slice(0, 200)}`\n        );\n      }\n    } finally {\n      clearTimeout(timeoutId);\n    }\n  }\n\n  /**\n   * Has the DEPLOYMENT OPERATOR declared that SIEM collectors may sit on a private network?\n   *\n   * Read from the application configuration, never from the SIEM config row. The row is authored by\n   * an organization administrator — the same party that supplies the URL — so a flag there would let\n   * the attacker disarm the guard aimed at them. The operator declares the network posture; the\n   * tenant chooses a destination within it.\n   *\n   * Absent reads as `false`. The field is deliberately un-defaulted in\n   * {@link AuditTrailConfigSchema} so that an application which never authored the block gets the\n   * refusing posture by doing nothing.\n   */\n  private _admitsPrivateNetworkCollectors(): boolean {\n    return this.appConfigService.config?.auditTrail?.allowPrivateNetworkSiemCollectors === true;\n  }\n\n  // ─────────────────────────────────────────────────────────────\n  // Circuit Breaker\n  // ─────────────────────────────────────────────────────────────\n\n  private _isCircuitOpen(circuitKey: string): boolean {\n    const state = this.circuitBreakers.get(circuitKey);\n    if (!state || !state.circuitOpenUntil) return false;\n\n    if (new Date() > state.circuitOpenUntil) {\n      state.circuitOpenUntil = null;\n      return false;\n    }\n\n    return true;\n  }\n\n  private _recordSuccess(circuitKey: string): void {\n    this.circuitBreakers.delete(circuitKey);\n  }\n\n  private _recordFailure(circuitKey: string): void {\n    let state = this.circuitBreakers.get(circuitKey);\n    if (!state) {\n      state = { consecutiveFailures: 0, lastFailureAt: null, circuitOpenUntil: null };\n      this.circuitBreakers.set(circuitKey, state);\n    }\n\n    state.consecutiveFailures++;\n    state.lastFailureAt = new Date();\n\n    if (state.consecutiveFailures >= CIRCUIT_BREAKER_THRESHOLD) {\n      state.circuitOpenUntil = new Date(Date.now() + CIRCUIT_BREAKER_COOLDOWN_MS);\n      this.logger.warn('SIEM circuit breaker opened', {\n        circuitKey,\n        consecutiveFailures: state.consecutiveFailures,\n        cooldownMs: CIRCUIT_BREAKER_COOLDOWN_MS,\n      });\n    }\n  }\n\n  // ─────────────────────────────────────────────────────────────\n  // M11: Dead Letter Queue\n  // ─────────────────────────────────────────────────────────────\n\n  /**\n   * Persist failed SIEM delivery events to a MongoDB-backed DLQ resource\n   * instead of silently dropping them. DLQ entries conform to SiemDeliveryDlqBase\n   * and are queryable/retryable through the standard resource engine.\n   */\n  private async _enqueueToDLQ(\n    payload: SIEMDeliveryJobPayload,\n    failureReason: string,\n    errorMessage?: string,\n  ): Promise<void> {\n    const scopeType = payload.scopeType ?? AuthScopeType.ORGANIZATION;\n    const scopeId = payload.scopeId ?? payload.organizationId;\n    try {\n      const dlqResourceType = scopeType === AuthScopeType.APPLICATION\n        ? CoreResourceType.APPLICATION_SIEM_DELIVERY_DLQ\n        : CoreResourceType.ORGANIZATION_SIEM_DELIVERY_DLQ;\n      // Polymorphic scope FK field name: `organizationId` for the ORG variant,\n      // `applicationId` for the APP variant (the polymorphism engine's per-variant column).\n      const scopeFieldIdentifier = scopeType === AuthScopeType.APPLICATION\n        ? coreResourceShared_FieldIdentifier[CoreResourceType.APPLICATION]\n        : coreResourceShared_FieldIdentifier[CoreResourceType.ORGANIZATIONS];\n\n      const ec = await this._getDlqExecutionContext(dlqResourceType, scopeFieldIdentifier, scopeId);\n      const dlqRepo = this.repositoriesRegistry.getRepositoryOrThrow(dlqResourceType);\n\n      const dlqEntry = {\n        // The polymorphic scope FK (organizationId / applicationId) is NOT on\n        // SiemDeliveryDlqBaseSchema — the polymorphism engine appends it per variant as an\n        // excludeFromCreate, context-injected column. Its AUTHORITATIVE write comes from\n        // `enrichDataWithContext` reading it off the EC's context map (seeded in\n        // `_getDlqExecutionContext`), because the strict CREATE-DTO strips this field from\n        // the payload. We ALSO set it here — mirroring the M2M webhook-delivery-log sibling\n        // (`buildScopeFkInjection`) — so both delivery-failure paths read identically; it is\n        // harmless (stripped, then re-injected by enrichment) rather than the source of truth.\n        [scopeFieldIdentifier]: scopeId,\n        eventId: payload.envelope.eventId,\n        eventPayload: payload.envelope,\n        failureReason: `${failureReason}${errorMessage ? `: ${errorMessage}` : ''}`,\n        failureCount: 1,\n        lastAttemptAt: new Date(),\n        nextRetryAt: failureReason === 'retries_exhausted' ? undefined : new Date(Date.now() + 5 * 60 * 1000),\n        status: failureReason === 'retries_exhausted' ? SiemDeliveryDlqStatus.EXHAUSTED : SiemDeliveryDlqStatus.PENDING_RETRY,\n      };\n\n      await dlqRepo.create(ec, dlqEntry);\n\n      this.logger.warn('SIEM delivery event persisted to DLQ', {\n        scopeType,\n        scopeId,\n        eventId: payload.envelope.eventId,\n        eventType: payload.envelope.eventType,\n        failureReason,\n      });\n    } catch (dlqError) {\n      this.logger.error?.('Failed to enqueue SIEM event to DLQ', {\n        scopeType,\n        scopeId,\n        eventId: payload.envelope.eventId,\n        ...projectCaughtErrorLogFields(dlqError),\n      });\n    }\n  }\n\n  /**\n   * Create a REPOSITORY-DIRECT internal ExecutionContext for the DLQ create.\n   *\n   * SIEM delivery runs in an async queue worker with no user EC, so this synthesises a\n   * system super-admin context via `createForInternalRepositoryOperation` — the blessed seam\n   * for repository-tier internal writes (shared with FILES / JOB_* / notification-badge) that\n   * resolves the DLQ's `REPOSITORY_ONLY` CREATE variant. It also uses the CORRECT polymorphic\n   * `dlqResourceType` (the prior hand-rolled path hardcoded the ORG variant even for APP-scoped\n   * deliveries).\n   *\n   * CRITICAL — the scope-FK injection channel: the DLQ's scope FK (organizationId /\n   * applicationId) is an excludeFromCreate, context-injected column the polymorphism engine\n   * appends per variant; the strict CREATE-DTO strips it from the payload, so it is persisted\n   * ONLY by `enrichDataWithContext` reading it off THIS context map. An earlier version passed\n   * an EMPTY map → the required scope FK was never injected → Mongoose \"organizationId: Path\n   * required\" → every retries-exhausted SIEM delivery was silently lost instead of\n   * dead-lettered. An INTERNALLY_INITIATED EC fail-closed rejects org/user identity on\n   * `initiatorIds`, so the context map is the ONLY correct channel for the ORGANIZATION scope FK.\n   */\n  private async _getDlqExecutionContext(\n    dlqResourceType: ResourceType,\n    scopeFieldIdentifier: string,\n    scopeId: string,\n  ): Promise<ExecutionContext<any>> {\n    return this.executionContextCreator.createForInternalRepositoryOperation({\n      resourceType: dlqResourceType,\n      operationIdentifier: CoreResourceOperation.CREATE,\n      contextResourcesFieldIdentifier: new Map([[scopeFieldIdentifier, scopeId]]),\n      initiatorIds: null,\n      initiatorRoles: [\n        { roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], relatedPrimaryScope: ResourcePrimaryScope.APPLICATION },\n      ],\n    });\n  }\n\n  // ─────────────────────────────────────────────────────────────\n  // H6: SIEM Credential Encryption/Decryption\n  // ─────────────────────────────────────────────────────────────\n\n  /**\n   * Derive a 32-byte AES-256 key from the app's session encryption key\n   * using a domain-specific separator to avoid key reuse.\n   */\n  private _deriveSIEMEncryptionKey(): Buffer {\n    const baseKey = this.appConfigService.secrets.security.session.encryptionKey;\n    return createHash('sha256')\n      .update(`${SIEM_KEY_DOMAIN}:${baseKey}`)\n      .digest();\n  }\n\n  /**\n   * H6: Resolve a credential value — decrypts if encrypted, returns as-is if plaintext.\n   * Encrypted format: `encrypted:aes-256-gcm:{iv_hex}:{authTag_hex}:{ciphertext_hex}`\n   */\n  private _resolveCredential(credential: string | undefined): string | undefined {\n    if (!credential) return undefined;\n\n    if (!credential.startsWith(ENCRYPTED_CREDENTIAL_PREFIX)) {\n      // Plaintext credential — log a warning for security awareness\n      this.logDebug('SIEM credential is plaintext (not encrypted at rest). Consider re-saving via admin API to encrypt.');\n      return credential;\n    }\n\n    try {\n      const payload = credential.slice(ENCRYPTED_CREDENTIAL_PREFIX.length);\n      const [ivHex, authTagHex, ciphertextHex] = payload.split(':');\n      if (!ivHex || !authTagHex || !ciphertextHex) {\n        throw new Error('Invalid encrypted credential format');\n      }\n\n      const key = this._deriveSIEMEncryptionKey();\n      const iv = Buffer.from(ivHex, 'hex');\n      const authTag = Buffer.from(authTagHex, 'hex');\n      const ciphertext = Buffer.from(ciphertextHex, 'hex');\n\n      const decipher = createDecipheriv('aes-256-gcm', key, iv);\n      decipher.setAuthTag(authTag);\n\n      const decrypted = Buffer.concat([decipher.update(ciphertext), decipher.final()]);\n      return decrypted.toString('utf8');\n    } catch (error) {\n      this.logger.error?.(\n        'Failed to decrypt SIEM credential',\n        projectCaughtErrorLogFields(error),\n      );\n      return undefined;\n    }\n  }\n\n  /**\n   * H6: Encrypt a plaintext credential for storage.\n   * Returns the encrypted string in format: `encrypted:aes-256-gcm:{iv}:{authTag}:{ciphertext}`\n   *\n   * Called by admin API when saving SIEM configuration.\n   */\n  public encryptCredential(plaintext: string): string {\n    const key = this._deriveSIEMEncryptionKey();\n    const iv = randomBytes(12); // 96-bit IV for GCM\n    const cipher = createCipheriv('aes-256-gcm', key, iv);\n\n    const encrypted = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);\n    const authTag = cipher.getAuthTag();\n\n    return `${ENCRYPTED_CREDENTIAL_PREFIX}${iv.toString('hex')}:${authTag.toString('hex')}:${encrypted.toString('hex')}`;\n  }\n\n  /**\n   * Sleep utility for exponential backoff.\n   */\n  private _sleep(ms: number): Promise<void> {\n    return new Promise(resolve => setTimeout(resolve, ms));\n  }\n}\n"]}
+{"version":3,"file":"siem-webhook-delivery.backend.service.js","sourceRoot":"","sources":["../../../../../src/compliance/audit-trails/services/siem-webhook-delivery.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;;;;;;;;;;;;;AAEH,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AAC/F,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,kCAAkC,EAAE,MAAM,0CAA0C,CAAC;AAC9F,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAChK,OAAO,EAAE,qCAAqC,EAAE,MAAM,+EAA+E,CAAC;AACtI,OAAO,EAIL,gBAAgB,EAChB,qBAAqB,EACrB,cAAc,EACd,oBAAoB,EACpB,eAAe,EACf,qBAAqB,EACrB,eAAe,EACf,aAAa,EACb,kCAAkC,EAClC,kCAAkC,EAClC,gCAAgC,GACjC,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,cAAc,EACd,eAAe,EACf,2BAA2B,EAC3B,uBAAuB,GAGxB,MAAM,gDAAgD,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,4CAA4C,CAAC;AAC5E,OAAO,EACL,yBAAyB,EACzB,kBAAkB,EAClB,0BAA0B,EAC1B,mBAAmB,EACnB,+BAA+B,GAGhC,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,mBAAmB,EACnB,2BAA2B,GAC5B,MAAM,8EAA8E,CAAC;AACtF,OAAO,EAAE,mBAAmB,EAAE,MAAM,sEAAsE,CAAC;AAwC3G;;;;GAIG;AACH,MAAM,yBAAyB,GAAG,kCAAkC,CAAC,8BAA8B,CAAC;AACpG,MAAM,2BAA2B,GAAG,gCAAgC,CAAC;AACrE,4CAA4C;AAC5C,MAAM,2BAA2B,GAAG,wBAAwB,CAAC;AAC7D,oEAAoE;AACpE,MAAM,eAAe,GAAG,0BAA0B,CAAC;AACnD;;;;GAIG;AACH,MAAM,iCAAiC,GAAG,gBAAgB,CAAC;AAC3D;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,gCAAgC,GAAG,IAAI,CAAC;AAE9C,gGAAgG;AAChG,oGAAoG;AACpG,iGAAiG;AACjG,kGAAkG;AAClG,yCAAyC;AACzC,EAAE;AACF,yFAAyF;AAGlF,IAAM,iCAAiC,GAAvC,MAAM,iCAAiC;IAKU;IACU;IACW;IACO;IACG;IARpE,QAAQ,CAA+D;IACvE,eAAe,GAAqC,IAAI,GAAG,EAAE,CAAC;IAE/E,YACsD,MAAqB,EACX,gBAAyC,EAC9B,oBAAwD,EACjD,oBAA+D,EAC5D,uBAA8D;QAJ7F,WAAM,GAAN,MAAM,CAAe;QACX,qBAAgB,GAAhB,gBAAgB,CAAyB;QAC9B,yBAAoB,GAApB,oBAAoB,CAAoC;QACjD,yBAAoB,GAApB,oBAAoB,CAA2C;QAC5D,4BAAuB,GAAvB,uBAAuB,CAAuC;QAEjJ,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,mCAAmC,CAAC,CAAC;QAC7E,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;IAC9E,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,eAAe,CAAC,OAA+B;QAC1D,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,cAAc,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;QACvE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,aAAa,CAAC,YAAY,CAAC;QAClE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,cAAc,CAAC;QAClD,MAAM,UAAU,GAAG,GAAG,SAAS,IAAI,OAAO,EAAE,CAAC;QAE7C,kDAAkD;QAClD,IAAI,YAAY,EAAE,CAAC;YACjB,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,kBAAkB,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,CAAC;gBAC1E,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,6DAA6D,EAAE;oBACjF,SAAS;oBACT,OAAO;oBACP,OAAO,EAAE,QAAQ,CAAC,OAAO;oBACzB,SAAS,EAAE,QAAQ,CAAC,SAAS;iBAC9B,CAAC,CAAC;gBACH,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,0BAA0B,CAAC,CAAC;gBAC9D,OAAO;YACT,CAAC;QACH,CAAC;QAED,0DAA0D;QAC1D,IAAI,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,CAAC;YACpC,IAAI,CAAC,QAAQ,CAAC,gDAAgD,EAAE;gBAC9D,SAAS;gBACT,OAAO;gBACP,OAAO,EAAE,QAAQ,CAAC,OAAO;aAC1B,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QAED,kBAAkB;QAClB,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;QAEhE,gBAAgB;QAChB,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAErD,gCAAgC;QAChC,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC;QACrD,MAAM,aAAa,GAAG,UAAU,CAAC,QAAQ,CAAC,mBAAmB,GAAG,IAAI,CAAC;QACrE,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,cAAc,GAAG,IAAI,CAAC;QAE5D,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,UAAU,EAAE,OAAO,EAAE,EAAE,CAAC;YACvD,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;gBAE1E,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;gBAEhC,IAAI,CAAC,QAAQ,CAAC,qCAAqC,EAAE;oBACnD,SAAS;oBACT,OAAO;oBACP,OAAO,EAAE,QAAQ,CAAC,OAAO;oBACzB,SAAS,EAAE,QAAQ,CAAC,SAAS;oBAC7B,OAAO;iBACR,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,aAAa,GAAG,OAAO,KAAK,UAAU,CAAC;gBAE7C,IAAI,aAAa,EAAE,CAAC;oBAClB,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;oBAEhC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,gDAAgD,EAAE;wBACpE,SAAS;wBACT,OAAO;wBACP,OAAO,EAAE,QAAQ,CAAC,OAAO;wBACzB,SAAS,EAAE,QAAQ,CAAC,SAAS;wBAC7B,QAAQ,EAAE,OAAO,GAAG,CAAC;wBACrB,GAAG,2BAA2B,CAAC,KAAK,CAAC;qBACtC,CAAC,CAAC;oBAEH,2EAA2E;oBAC3E,2EAA2E;oBAC3E,4EAA4E;oBAC5E,iDAAiD;oBACjD,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC;gBACrF,CAAC;qBAAM,CAAC;oBACN,MAAM,SAAS,GAAG,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;oBACvD,IAAI,CAAC,QAAQ,CAAC,wCAAwC,EAAE;wBACtD,SAAS;wBACT,OAAO;wBACP,OAAO,EAAE,QAAQ,CAAC,OAAO;wBACzB,OAAO;wBACP,WAAW,EAAE,SAAS;qBACvB,CAAC,CAAC;oBACH,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBAC/B,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACK,WAAW,CAAC,QAAoC,EAAE,WAAmB;QAC3E,QAAQ,WAAW,EAAE,CAAC;YACpB,KAAK,eAAe,CAAC,GAAG;gBACtB,OAAO,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;YACrC,KAAK,eAAe,CAAC,IAAI;gBACvB,OAAO,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;YACtC,KAAK,eAAe,CAAC,IAAI;gBACvB,uFAAuF;gBACvF,4DAA4D;gBAC5D,OAAO,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;YAClD,KAAK,eAAe,CAAC,eAAe,CAAC;YACrC;gBACE,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,YAAY,CAAC,QAAoC;QACvD,MAAM,WAAW,GAAG,2BAA2B,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACnE,MAAM,GAAG,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,IAAI,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;QAC5E,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,KAAa,EAAU,EAAE,CAAC,IAAI,CAAC,uBAAuB,CAAC,KAAK,EAAE,KAAK,EAAE,yBAAyB,CAAC,CAAC;QAC/H,MAAM,eAAe,GAAG,IAAI,CAAC,yBAAyB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACtE,qFAAqF;QACrF,MAAM,IAAI,GAAG,CAAC,GAAe,EAAE,KAAa,EAAU,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,kBAAkB,CAAC,CAAC;QAC7G,MAAM,IAAI,GAAG,CAAC,GAAG,SAA4B,EAAU,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAE9E,8FAA8F;QAC9F,kGAAkG;QAClG,0FAA0F;QAC1F,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,cAAc,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;aACjG,IAAI,CAAC,GAAG,CAAC,CAAC;QAEb,8FAA8F;QAC9F,mGAAmG;QACnG,mGAAmG;QACnG,6FAA6F;QAC7F,sCAAsC;QACtC,wGAAwG;QACxG,8FAA8F;QAC9F,uGAAuG;QACvG,OAAO,SAAS,MAAM,CAAC,cAAc,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,eAAe,EAAE,eAAe,CAAC,IAAI,MAAM,CAAC,eAAe,EAAE,QAAQ,CAAC,aAAa,CAAC,IAAI,MAAM,CAAC,oBAAoB,EAAE,QAAQ,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,IAAI,WAAW,IAAI,UAAU,EAAE,CAAC;IACnS,CAAC;IAED;;;;;;;;;;OAUG;IACK,aAAa,CAAC,QAAoC;QACxD,MAAM,GAAG,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,KAAa,EAAU,EAAE,CAAC,IAAI,CAAC,uBAAuB,CAAC,KAAK,EAAE,KAAK,EAAE,0BAA0B,CAAC,CAAC;QAChI,MAAM,eAAe,GAAG,IAAI,CAAC,yBAAyB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACtE,+FAA+F;QAC/F,MAAM,IAAI,GAAG,CAAC,GAAgB,EAAE,KAAa,EAAU,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,mBAAmB,CAAC,CAAC;QAC/G,MAAM,IAAI,GAAG,CAAC,GAAG,SAA4B,EAAU,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAE/E,iGAAiG;QACjG,mGAAmG;QACnG,EAAE;QACF,kGAAkG;QAClG,gGAAgG;QAChG,+FAA+F;QAC/F,2DAA2D;QAC3D,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,eAAe,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;aAClG,IAAI,CAAC,IAAI,CAAC,CAAC;QAEd,0FAA0F;QAC1F,gGAAgG;QAChG,2FAA2F;QAC3F,4FAA4F;QAC5F,4FAA4F;QAC5F,gGAAgG;QAChG,kFAAkF;QAClF,OAAO,YAAY,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,SAAS,EAAE,eAAe,CAAC,IAAI,MAAM,CAAC,gBAAgB,EAAE,QAAQ,CAAC,aAAa,CAAC,IAAI,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,IAAI,+BAA+B,IAAI,UAAU,EAAE,CAAC;IACrO,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACK,yBAAyB,CAC/B,QAAoC,EACpC,gBAA2C;QAE3C,uFAAuF;QACvF,qFAAqF;QACrF,uEAAuE;QACvE,MAAM,SAAS,GAAY,QAAQ,CAAC,SAAS,CAAC;QAC9C,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvF,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,UAAkB,CAAC;QACvB,IAAI,CAAC;YACH,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,uFAAuF;YACvF,uEAAuE;YACvE,IAAI,CAAC,QAAQ,CAAC,8DAA8D,EAAE;gBAC5E,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,SAAS,EAAE,QAAQ,CAAC,SAAS;aAC9B,CAAC,CAAC;YACH,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,yFAAyF;QACzF,wFAAwF;QACxF,qCAAqC;QACrC,IAAI,CAAC,UAAU;YAAE,OAAO,SAAS,CAAC;QAElC,IAAI,gBAAgB,CAAC,UAAU,CAAC,CAAC,MAAM,IAAI,gCAAgC;YAAE,OAAO,UAAU,CAAC;QAE/F,4FAA4F;QAC5F,6FAA6F;QAC7F,gGAAgG;QAChG,4FAA4F;QAC5F,uFAAuF;QACvF,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,IAAI,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC;QAChC,OAAO,IAAI,GAAG,OAAO,EAAE,CAAC;YACtB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;YAClD,IAAI,gBAAgB,CAAC,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,gCAAgC,EAAE,CAAC;gBAC7G,IAAI,GAAG,SAAS,CAAC;YACnB,CAAC;iBAAM,CAAC;gBACN,OAAO,GAAG,SAAS,GAAG,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QAEzD,IAAI,CAAC,QAAQ,CAAC,sEAAsE,EAAE;YACpF,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,cAAc,EAAE,UAAU,CAAC,MAAM;YACjC,aAAa,EAAE,SAAS,CAAC,MAAM;YAC/B,aAAa,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC,MAAM;YACjD,QAAQ,EAAE,gCAAgC;SAC3C,CAAC,CAAC;QACH,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;;OAOG;IACK,eAAe,CAAC,UAAkB,EAAE,MAAc;QACxD,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC5C,MAAM,mBAAmB,GAAG,IAAI,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,CAAC;QAC7D,OAAO,GAAG,mBAAmB,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,iCAAiC,EAAE,CAAC;IAC/F,CAAC;IAED,gEAAgE;IAChE,uBAAuB;IACvB,EAAE;IACF,0FAA0F;IAC1F,2FAA2F;IAC3F,8FAA8F;IAC9F,2FAA2F;IAC3F,gGAAgG;IAChG,iGAAiG;IACjG,wDAAwD;IACxD,gEAAgE;IAEhE;;;;;;;;;;;;;;;OAeG;IACK,wBAAwB,CAAC,KAAa;QAC5C,OAAO,KAAK;aACT,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;aACtB,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC;aACpB,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;aACrB,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC3B,CAAC;IAED;;;;;;;;;;OAUG;IACK,gBAAgB,CAAC,KAAa;QACpC,8FAA8F;QAC9F,8FAA8F;QAC9F,gGAAgG;QAChG,+FAA+F;QAC/F,6FAA6F;QAC7F,+FAA+F;QAC/F,iGAAiG;QACjG,+FAA+F;QAC/F,oFAAoF;QACpF,gGAAgG;QAChG,2FAA2F;QAC3F,yFAAyF;QACzF,OAAO,KAAK;aACT,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;aACtB,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;aACrB,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;aACrB,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC3B,CAAC;IAED;;;;;;;;;;;OAWG;IACK,sBAAsB,CAAC,KAAa;QAC1C,OAAO,KAAK;aACT,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;aACtB,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;YACtB,8FAA8F;YAC9F,gFAAgF;aAC/E,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;;OAMG;IACK,iBAAiB,CACvB,QAA+D,EAC/D,QAAoC,EACpC,OAAiC;QAEjC,MAAM,SAAS,GAAa,EAAE,CAAC;QAC/B,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjD,IAAI,UAAU,CAAC,IAAI,KAAK,uBAAuB,CAAC,SAAS;gBAAE,SAAS;YACpE,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACtD,IAAI,QAAQ;gBAAE,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;;;;;OAUG;IACK,SAAS,CACf,GAAM,EACN,QAAgB,EAChB,gBAA2C,EAC3C,QAA0C;QAE1C,OAAO,GAAG,GAAG,IAAI,IAAI,CAAC,uBAAuB,CAAC,GAAG,EAAE,QAAQ,EAAE,gBAAgB,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;IAClG,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACK,uBAAuB,CAC7B,SAAiB,EACjB,QAAgB,EAChB,gBAA2C,EAC3C,GAAuB;QAEvB,MAAM,OAAO,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAC3C,IAAI,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,IAAI,GAAG;YAAE,OAAO,OAAO,CAAC;QAE/D,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,IAAI,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC;QAC9B,OAAO,IAAI,GAAG,OAAO,EAAE,CAAC;YACtB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;YAClD,IAAI,gBAAgB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,GAAG;gBAAE,IAAI,GAAG,SAAS,CAAC;;gBAC9E,OAAO,GAAG,SAAS,GAAG,CAAC,CAAC;QAC/B,CAAC;QACD,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACpC,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,QAAQ,IAAI,MAAM,IAAI,QAAQ,IAAI,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAE/E,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,+CAA+C,EAAE;YAClE,GAAG,EAAE,SAAS;YACd,QAAQ,EAAE,GAAG;YACb,cAAc,EAAE,QAAQ,CAAC,MAAM;YAC/B,aAAa,EAAE,IAAI,CAAC,MAAM;SAC3B,CAAC,CAAC;QACH,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAED;;;;;;OAMG;IACK,uBAAuB,CAC7B,SAAiB,EACjB,QAAgB,EAChB,UAA4C;QAE5C,OAAO,IAAI,CAAC,uBAAuB,CACjC,SAAS,EACT,QAAQ,EACR,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,EAC7C,UAAU,CAAC,SAAS,CAAC,CACtB,CAAC;IACJ,CAAC;IAED;;;;;;;;;OASG;IACK,kBAAkB,CAAC,SAAiB;QAC1C,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACtD,OAAO,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACjF,CAAC;IAED;;OAEG;IACK,aAAa,CACnB,IAAY,EACZ,UAAgD;QAEhD,MAAM,OAAO,GAA2B;YACtC,uFAAuF;YACvF,yFAAyF;YACzF,2FAA2F;YAC3F,iCAAiC;YACjC,0FAA0F;YAC1F,0FAA0F;YAC1F,oFAAoF;YACpF,CAAC,eAAe,CAAC,YAAY,CAAC,EAAE,UAAU,CAAC,WAAW,KAAK,eAAe,CAAC,GAAG,IAAI,UAAU,CAAC,WAAW,KAAK,eAAe,CAAC,IAAI;gBAC/H,CAAC,CAAC,YAAY;gBACd,CAAC,CAAC,kBAAkB;SACvB,CAAC;QAEF,+DAA+D;QAC/D,IAAI,UAAU,CAAC,aAAa,EAAE,CAAC;YAC7B,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,aAAa,CAAC,CAAC;QACnD,CAAC;QAED,kDAAkD;QAClD,MAAM,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;QAE9E,oBAAoB;QACpB,QAAQ,UAAU,CAAC,UAAU,EAAE,CAAC;YAC9B,KAAK,cAAc;gBACjB,IAAI,kBAAkB,EAAE,CAAC;oBACvB,OAAO,CAAC,eAAe,CAAC,aAAa,CAAC,GAAG,UAAU,kBAAkB,EAAE,CAAC;gBAC1E,CAAC;gBACD,MAAM;YAER,KAAK,gBAAgB,CAAC,CAAC,CAAC;gBACtB,MAAM,UAAU,GAAG,UAAU,CAAC,cAAc,IAAI,eAAe,CAAC,OAAO,CAAC;gBACxE,IAAI,kBAAkB,EAAE,CAAC;oBACvB,OAAO,CAAC,UAAU,CAAC,GAAG,kBAAkB,CAAC;gBAC3C,CAAC;gBACD,MAAM;YACR,CAAC;YAED,KAAK,aAAa;gBAChB,IAAI,kBAAkB,EAAE,CAAC;oBACvB,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,EAAE,kBAAkB,CAAC;yBAClD,MAAM,CAAC,IAAI,CAAC;yBACZ,MAAM,CAAC,KAAK,CAAC,CAAC;oBACjB,OAAO,CAAC,eAAe,CAAC,eAAe,CAAC,GAAG,UAAU,IAAI,EAAE,CAAC;gBAC9D,CAAC;gBACD,MAAM;YAER,KAAK,MAAM,CAAC;YACZ;gBACE,MAAM;QACV,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACK,KAAK,CAAC,aAAa,CACzB,GAAW,EACX,IAAY,EACZ,OAA+B,EAC/B,SAAiB;QAEjB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;QAElE,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE;gBAC9C,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,IAAI;gBACJ,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB;;;;;;;;mBAQG;gBACH,iBAAiB,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;gBACtC,qBAAqB,EAAE,IAAI,CAAC,+BAA+B,EAAE;aAC9D,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC3D,MAAM,IAAI,KAAK,CACb,8BAA8B,QAAQ,CAAC,MAAM,KAAK,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAC/E,CAAC;YACJ,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,SAAS,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAED;;;;;;;;;;;OAWG;IACK,+BAA+B;QACrC,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,UAAU,EAAE,iCAAiC,KAAK,IAAI,CAAC;IAC9F,CAAC;IAED,gEAAgE;IAChE,kBAAkB;IAClB,gEAAgE;IAExD,cAAc,CAAC,UAAkB;QACvC,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,gBAAgB;YAAE,OAAO,KAAK,CAAC;QAEpD,IAAI,IAAI,IAAI,EAAE,GAAG,KAAK,CAAC,gBAAgB,EAAE,CAAC;YACxC,KAAK,CAAC,gBAAgB,GAAG,IAAI,CAAC;YAC9B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,cAAc,CAAC,UAAkB;QACvC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC1C,CAAC;IAEO,cAAc,CAAC,UAAkB;QACvC,IAAI,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,EAAE,mBAAmB,EAAE,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC;YAChF,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAC9C,CAAC;QAED,KAAK,CAAC,mBAAmB,EAAE,CAAC;QAC5B,KAAK,CAAC,aAAa,GAAG,IAAI,IAAI,EAAE,CAAC;QAEjC,IAAI,KAAK,CAAC,mBAAmB,IAAI,yBAAyB,EAAE,CAAC;YAC3D,KAAK,CAAC,gBAAgB,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,2BAA2B,CAAC,CAAC;YAC5E,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE;gBAC9C,UAAU;gBACV,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;gBAC9C,UAAU,EAAE,2BAA2B;aACxC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,gEAAgE;IAChE,yBAAyB;IACzB,gEAAgE;IAEhE;;;;OAIG;IACK,KAAK,CAAC,aAAa,CACzB,OAA+B,EAC/B,aAAqB,EACrB,YAAqB;QAErB,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,aAAa,CAAC,YAAY,CAAC;QAClE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,cAAc,CAAC;QAC1D,IAAI,CAAC;YACH,MAAM,eAAe,GAAG,SAAS,KAAK,aAAa,CAAC,WAAW;gBAC7D,CAAC,CAAC,gBAAgB,CAAC,6BAA6B;gBAChD,CAAC,CAAC,gBAAgB,CAAC,8BAA8B,CAAC;YACpD,yEAAyE;YACzE,sFAAsF;YACtF,MAAM,oBAAoB,GAAG,SAAS,KAAK,aAAa,CAAC,WAAW;gBAClE,CAAC,CAAC,kCAAkC,CAAC,gBAAgB,CAAC,WAAW,CAAC;gBAClE,CAAC,CAAC,kCAAkC,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;YAEvE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,eAAe,EAAE,oBAAoB,EAAE,OAAO,CAAC,CAAC;YAC9F,MAAM,OAAO,GAAG,IAAI,CAAC,oBAAoB,CAAC,oBAAoB,CAAC,eAAe,CAAC,CAAC;YAEhF,MAAM,QAAQ,GAAG;gBACf,sEAAsE;gBACtE,mFAAmF;gBACnF,iFAAiF;gBACjF,yEAAyE;gBACzE,mFAAmF;gBACnF,oFAAoF;gBACpF,qFAAqF;gBACrF,uFAAuF;gBACvF,CAAC,oBAAoB,CAAC,EAAE,OAAO;gBAC/B,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,OAAO;gBACjC,YAAY,EAAE,OAAO,CAAC,QAAQ;gBAC9B,aAAa,EAAE,GAAG,aAAa,GAAG,YAAY,CAAC,CAAC,CAAC,KAAK,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;gBAC3E,YAAY,EAAE,CAAC;gBACf,aAAa,EAAE,IAAI,IAAI,EAAE;gBACzB,WAAW,EAAE,aAAa,KAAK,mBAAmB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;gBACrG,MAAM,EAAE,aAAa,KAAK,mBAAmB,CAAC,CAAC,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,aAAa;aACtH,CAAC;YAEF,MAAM,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;YAEnC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sCAAsC,EAAE;gBACvD,SAAS;gBACT,OAAO;gBACP,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,OAAO;gBACjC,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,SAAS;gBACrC,aAAa;aACd,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,QAAQ,EAAE,CAAC;YAClB,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,qCAAqC,EAAE;gBACzD,SAAS;gBACT,OAAO;gBACP,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,OAAO;gBACjC,GAAG,2BAA2B,CAAC,QAAQ,CAAC;aACzC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACK,KAAK,CAAC,uBAAuB,CACnC,eAA6B,EAC7B,oBAA4B,EAC5B,OAAe;QAEf,OAAO,IAAI,CAAC,uBAAuB,CAAC,oCAAoC,CAAC;YACvE,YAAY,EAAE,eAAe;YAC7B,mBAAmB,EAAE,qBAAqB,CAAC,MAAM;YACjD,+BAA+B,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC,CAAC;YAC3E,YAAY,EAAE,IAAI;YAClB,cAAc,EAAE;gBACd,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,mBAAmB,EAAE,oBAAoB,CAAC,WAAW,EAAE;aACzG;SACF,CAAC,CAAC;IACL,CAAC;IAED,gEAAgE;IAChE,4CAA4C;IAC5C,gEAAgE;IAEhE;;;OAGG;IACK,wBAAwB;QAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC;QAC7E,OAAO,UAAU,CAAC,QAAQ,CAAC;aACxB,MAAM,CAAC,GAAG,eAAe,IAAI,OAAO,EAAE,CAAC;aACvC,MAAM,EAAE,CAAC;IACd,CAAC;IAED;;;OAGG;IACK,kBAAkB,CAAC,UAA8B;QACvD,IAAI,CAAC,UAAU;YAAE,OAAO,SAAS,CAAC;QAElC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,2BAA2B,CAAC,EAAE,CAAC;YACxD,8DAA8D;YAC9D,IAAI,CAAC,QAAQ,CAAC,oGAAoG,CAAC,CAAC;YACpH,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,2BAA2B,CAAC,MAAM,CAAC,CAAC;YACrE,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,aAAa,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC9D,IAAI,CAAC,KAAK,IAAI,CAAC,UAAU,IAAI,CAAC,aAAa,EAAE,CAAC;gBAC5C,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;YACzD,CAAC;YAED,MAAM,GAAG,GAAG,IAAI,CAAC,wBAAwB,EAAE,CAAC;YAC5C,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YACrC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;YAC/C,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;YAErD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YAC1D,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YAE7B,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YACjF,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CACjB,mCAAmC,EACnC,2BAA2B,CAAC,KAAK,CAAC,CACnC,CAAC;YACF,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACI,iBAAiB,CAAC,SAAiB;QACxC,MAAM,GAAG,GAAG,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAC5C,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,oBAAoB;QAChD,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAEtD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACpF,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAEpC,OAAO,GAAG,2BAA2B,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IACvH,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,EAAU;QACvB,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IACzD,CAAC;CACF,CAAA;AAh3BY,iCAAiC;IAD7C,UAAU,EAAE;IAMR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,2BAA2B,CAAC,CAAA;IACtD,WAAA,MAAM,CAAC,kBAAkB,CAAC,kCAAkC,CAAC,CAAA;IAC7D,WAAA,MAAM,CAAC,kBAAkB,CAAC,qCAAqC,CAAC,CAAA;qCAJL,aAAa;QACO,uBAAuB;QACR,kCAAkC;QAC3B,yCAAyC;QACnC,qCAAqC;GATxI,iCAAiC,CAg3B7C","sourcesContent":["/**\n * SIEM Webhook Delivery Backend Service\n *\n * Layer 3 of the three-layer audit event pipeline (Step 18).\n * Purpose-built for delivering security audit events to customer SIEM endpoints.\n * NOT a generic M2M webhook sender.\n *\n * Responsibilities:\n * - HTTP POST to webhook URL with configured auth\n * - HMAC-SHA256 signature for hmac_sha256 auth method\n * - Exponential backoff retries\n * - Circuit breaker after N consecutive failures per org\n * - CEF/LEEF format conversion (when eventFormat !== json_structured)\n * - Idempotency via eventId\n */\n\nimport 'reflect-metadata';\nimport { inject, injectable } from 'inversify';\nimport { createHmac, createHash, createCipheriv, createDecipheriv, randomBytes } from 'crypto';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport { AuditEventDispatcherBackendService } from './audit-event-dispatcher.backend.service';\nimport { RepositoriesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/repositories/repositories-registry-handler.backend.service';\nimport { ExecutionContextCreatorBackendService } from '~wildo-backend-lib/runtime/services/execution-context-creator.backend.service';\nimport {\n  type SecurityAuditEventEnvelope,\n  type SiemExportConfigBase,\n  type ResourceType,\n  CoreResourceType,\n  CoreResourceOperation,\n  CORE_APP_ROLES,\n  ResourcePrimaryScope,\n  WildoHeaderKeys,\n  SiemDeliveryDlqStatus,\n  SIEMEventFormat,\n  AuthScopeType,\n  coreResourceShared_FieldIdentifier,\n  SIEM_DELIVERY_RELIABILITY_CONTRACT,\n  SIEM_CIRCUIT_BREAKER_COOLDOWN_MS,\n} from '@wildo-ai/saas-models';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport {\n  CEF_PROJECTION,\n  LEEF_PROJECTION,\n  cefAgentSeverityHeaderValue,\n  SiemFieldProjectionKind,\n  type SiemProjectionContext,\n  type SiemProjectionContract,\n} from './utils/siem-projection-contract.backend.utils';\nimport { buildOcsfEvent } from './utils/siem-ocsf-projection.backend.utils';\nimport {\n  CEF_HEADER_MAX_CHARACTERS,\n  CEF_MAX_CHARACTERS,\n  LEEF_HEADER_MAX_CHARACTERS,\n  LEEF_MAX_CHARACTERS,\n  LEEF_TAB_DELIMITER_HEADER_VALUE,\n  type CefWireKey,\n  type LeefWireKey,\n} from './utils/siem-dictionary.backend.utils';\nimport {\n  describeCaughtError,\n  projectCaughtErrorLogFields,\n} from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { pinnedOutboundFetch } from '~wildo-backend-lib/security/ssrf/pinned-outbound-fetch.backend.utils';\n\n/** Circuit breaker state per organization */\ninterface CircuitBreakerState {\n  consecutiveFailures: number;\n  lastFailureAt: Date | null;\n  circuitOpenUntil: Date | null;\n}\n\n/** Payload shape enqueued by AuditEventDispatcherBackendService */\nexport interface SIEMDeliveryJobPayload {\n  envelope: SecurityAuditEventEnvelope;\n  envelopeHmac?: string; // F6: HMAC integrity signature\n  organizationId: string;\n  /**\n   * Delivery scope. Defaults to {@link AuthScopeType.ORGANIZATION}. The worker is scope-generic (the\n   * circuit-breaker key, DLQ variant, and scope FK all derive from it), but `'application'`\n   * is currently produced ONLY by the SIEM-DLQ retry custom-impl — there is no first-time\n   * app-scoped producer, so the APPLICATION path is reserved / dormant. See\n   * `AuditEventDispatcherBackendService.dispatchToOrganizationAuditSinks`.\n   */\n  scopeType?: AuthScopeType;\n  scopeId?: string;\n  siemConfig: {\n    webhookUrl: string;\n    authMethod: string;\n    authCredential?: string;\n    authHeaderName?: string;\n    eventFormat: string;\n    customHeaders?: Record<string, string>;\n    delivery: {\n      batchSize: number;\n      batchWindowSeconds: number;\n      retryAttempts: number;\n      retryBackoffSeconds: number;\n      timeoutSeconds: number;\n    };\n  };\n}\n\n/**\n * Circuit-breaker bounds come from `SIEM_DELIVERY_RELIABILITY_CONTRACT`, which the customer\n * documentation also projects: what an operator is told about a paused destination is what this\n * service applies.\n */\nconst CIRCUIT_BREAKER_THRESHOLD = SIEM_DELIVERY_RELIABILITY_CONTRACT.circuitBreakerFailureThreshold;\nconst CIRCUIT_BREAKER_COOLDOWN_MS = SIEM_CIRCUIT_BREAKER_COOLDOWN_MS;\n/** Prefix for encrypted credentials (H6) */\nconst ENCRYPTED_CREDENTIAL_PREFIX = 'encrypted:aes-256-gcm:';\n/** HKDF-like domain separator for SIEM encryption key derivation */\nconst SIEM_KEY_DOMAIN = 'wildo:siem:credential:v1';\n/**\n * Appended when the `eventData` detail bag is truncated, so the loss is VISIBLE to the receiver\n * rather than silent. A SOC that sees a JSON fragment ending mid-object cannot tell a truncation\n * from a serializer bug; this marker makes the difference explicit on the wire.\n */\nconst SIEM_EVENT_DATA_TRUNCATION_MARKER = '...[truncated]';\n/**\n * Maximum characters of serialized `eventData` carried in the single CEF/LEEF detail field,\n * INCLUDING {@link SIEM_EVENT_DATA_TRUNCATION_MARKER} when truncation occurs — the emitted value\n * never exceeds this bound.\n *\n * This is the CEF extension dictionary's own published length for `msg`, not a Wildo-invented\n * policy. LEEF publishes no per-attribute ceiling, so the same bound is applied there for\n * cross-format consistency: an unbounded detail bag is the realistic way a CEF/LEEF line grows\n * large enough for a receiver to reject it, which would fail the delivery into the DLQ.\n *\n * spec-cite: Implementing ArcSight CEF v26, Oct 2023 — ArcSight Extension Dictionary, \"CEF Key\n * Names for Event Producers\", `msg` row: full name `message`, data type `String`, length `1023`,\n * \"An arbitrary message giving more details about the event.\"\n *\n * The bound is applied to the ESCAPED value, i.e. to what actually goes on the wire. An earlier\n * revision bounded the value BEFORE escaping, on the reading that the ceiling describes the field's\n * CONTENT and escape sequences are transport encoding a receiver strips before it ever sees the\n * field. That reading is defensible and the document does not settle it — which is precisely why the\n * post-escape bound is the one to hold: escaping only ever expands (`=` → `\\=`, `\\` → `\\\\`), so a\n * value within the ceiling once encoded is necessarily within it once decoded. Bounding the encoded\n * form satisfies BOTH readings; bounding the decoded form satisfies only one, and an escape-heavy\n * bag sitting at the ceiling would have gone out over-long under the other.\n */\nconst SIEM_EVENT_DATA_DETAIL_MAX_CHARS = 1023;\n\n// The per-key ceilings and the `devTimeFormat` pattern used to live here as hand-kept constants\n// beside the formatter. They now live in the dictionary spine (`siem-dictionary.backend.utils.ts`),\n// DERIVED from the transcribed rows, because a ceiling maintained next to a key list is the same\n// artefact as the key list itself: adding a key and forgetting its published maximum was possible\n// right up until the derivation existed.\n//\n// Line comments, not a JSDoc block — a `/** */` here would attach to the class below it.\n\n@injectable()\nexport class SIEMWebhookDeliveryBackendService {\n  private readonly logDebug: (message: string, context?: Record<string, unknown>) => void;\n  private readonly circuitBreakers: Map<string, CircuitBreakerState> = new Map();\n\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n    @inject(SAAS_SERVICE_TYPES.AppConfigService) private readonly appConfigService: AppConfigurationService,\n    @inject(SAAS_SERVICE_TYPES.AuditEventDispatcherService) private readonly auditEventDispatcher: AuditEventDispatcherBackendService,\n    @inject(SAAS_SERVICE_TYPES.RepositoriesRegistryHandlerService) private readonly repositoriesRegistry: RepositoriesRegistryHandlerBackendService,\n    @inject(SAAS_SERVICE_TYPES.ExecutionContextCreatorBackendService) private readonly executionContextCreator: ExecutionContextCreatorBackendService,\n  ) {\n    this.logDebug = this.logger.debugByType('SIEMWebhookDeliveryBackendService');\n    this.logger.setDebugTypeLogging('SIEMWebhookDeliveryBackendService', false);\n  }\n\n  /**\n   * Process a SIEM delivery job from the queue.\n   * Called by the job consumer when a `siem.webhook-delivery` batch job is dequeued.\n   */\n  public async processDelivery(payload: SIEMDeliveryJobPayload): Promise<void> {\n    const { envelope, envelopeHmac, organizationId, siemConfig } = payload;\n    const scopeType = payload.scopeType ?? AuthScopeType.ORGANIZATION;\n    const scopeId = payload.scopeId ?? organizationId;\n    const circuitKey = `${scopeType}:${scopeId}`;\n\n    // F6: Verify envelope integrity before processing\n    if (envelopeHmac) {\n      if (!this.auditEventDispatcher.verifyEnvelopeHmac(envelope, envelopeHmac)) {\n        this.logger.error?.('SIEM envelope HMAC verification failed — possible tampering', {\n          scopeType,\n          scopeId,\n          eventId: envelope.eventId,\n          eventType: envelope.eventType,\n        });\n        await this._enqueueToDLQ(payload, 'hmac_verification_failed');\n        return;\n      }\n    }\n\n    // Circuit breaker check — M11: DLQ instead of silent drop\n    if (this._isCircuitOpen(circuitKey)) {\n      this.logDebug('Circuit breaker open for scope, sending to DLQ', {\n        scopeType,\n        scopeId,\n        eventId: envelope.eventId,\n      });\n      await this._enqueueToDLQ(payload, 'circuit_breaker_open');\n      return;\n    }\n\n    // Format the body\n    const body = this._formatBody(envelope, siemConfig.eventFormat);\n\n    // Build headers\n    const headers = this._buildHeaders(body, siemConfig);\n\n    // Attempt delivery with retries\n    const maxRetries = siemConfig.delivery.retryAttempts;\n    const baseBackoffMs = siemConfig.delivery.retryBackoffSeconds * 1000;\n    const timeoutMs = siemConfig.delivery.timeoutSeconds * 1000;\n\n    for (let attempt = 0; attempt <= maxRetries; attempt++) {\n      try {\n        await this._sendHttpPost(siemConfig.webhookUrl, body, headers, timeoutMs);\n\n        this._recordSuccess(circuitKey);\n\n        this.logDebug('SIEM webhook delivered successfully', {\n          scopeType,\n          scopeId,\n          eventId: envelope.eventId,\n          eventType: envelope.eventType,\n          attempt,\n        });\n        return;\n      } catch (error) {\n        const isLastAttempt = attempt === maxRetries;\n\n        if (isLastAttempt) {\n          this._recordFailure(circuitKey);\n\n          this.logger.error?.('SIEM webhook delivery failed after all retries', {\n            scopeType,\n            scopeId,\n            eventId: envelope.eventId,\n            eventType: envelope.eventType,\n            attempts: attempt + 1,\n            ...projectCaughtErrorLogFields(error),\n          });\n\n          // `describeCaughtError`, not an `instanceof Error` ternary: this string is\n          // PERSISTED as the DLQ record's failure reason, and a `WildoError_Backend`\n          // is a plain object — the ternary would store `'[object Object]'` for every\n          // structured fault, making the DLQ untriageable.\n          await this._enqueueToDLQ(payload, 'retries_exhausted', describeCaughtError(error));\n        } else {\n          const backoffMs = baseBackoffMs * Math.pow(2, attempt);\n          this.logDebug('SIEM webhook delivery failed, retrying', {\n            scopeType,\n            scopeId,\n            eventId: envelope.eventId,\n            attempt,\n            nextRetryMs: backoffMs,\n          });\n          await this._sleep(backoffMs);\n        }\n      }\n    }\n  }\n\n  /**\n   * Format the event body based on the configured event format.\n   *\n   * `json_structured` ships the envelope verbatim. CEF and LEEF are flat, single-line `key=value`\n   * grammars, so they project the envelope in two tiers: the standard/indexed keys each grammar\n   * defines (`cat`, `outcome`, `src`, …), followed by the free-form `eventData` bag serialized\n   * into that grammar's single detail field. Every envelope field therefore reaches all three\n   * formats; only the ENCODING differs.\n   */\n  private _formatBody(envelope: SecurityAuditEventEnvelope, eventFormat: string): string {\n    switch (eventFormat) {\n      case SIEMEventFormat.CEF:\n        return this._formatAsCEF(envelope);\n      case SIEMEventFormat.LEEF:\n        return this._formatAsLEEF(envelope);\n      case SIEMEventFormat.OCSF:\n        // OCSF is JSON, so there is no escaping/bounding layer here — the projection returns a\n        // document and the only transport concern is serialisation.\n        return JSON.stringify(buildOcsfEvent(envelope));\n      case SIEMEventFormat.JSON_STRUCTURED:\n      default:\n        return JSON.stringify(envelope);\n    }\n  }\n\n  /**\n   * Format event as CEF (Common Event Format).\n   * CEF:Version|Device Vendor|Device Product|Device Version|Signature ID|Name|Severity|Extension\n   */\n  private _formatAsCEF(envelope: SecurityAuditEventEnvelope): string {\n    const cefSeverity = cefAgentSeverityHeaderValue(envelope.severity);\n    const ext = (value: string): string => this._escapeCEFExtensionValue(value);\n    const header = (field: string, value: string): string => this._emitBoundedHeaderField(field, value, CEF_HEADER_MAX_CHARACTERS);\n    const eventDataDetail = this._serializeEventDataDetail(envelope, ext);\n    // CEF extensions are SPACE-delimited, so that is what `join` means for this grammar.\n    const pair = (key: CefWireKey, value: string): string => this._emitPair(key, value, ext, CEF_MAX_CHARACTERS);\n    const join = (...fragments: readonly string[]): string => fragments.join(' ');\n\n    // Driven by CEF_PROJECTION, so a field cannot be dropped by being forgotten — the contract is\n    // exhaustive over the envelope type and declaration order is wire order. The per-field reasoning,\n    // citations and the csN-budget decision all live there, next to the mapping they justify.\n    const extensions = this._renderProjection(CEF_PROJECTION, envelope, { pair, join, eventDataDetail })\n      .join(' ');\n\n    // Header fields 5 and 6 are DIFFERENT questions and used to receive the same answer. Field 5,\n    // `Device Event Class ID`, is the stable signature a QID/correlation rule keys on — `eventType` is\n    // exactly that. Field 6, `Name`, is documented as \"a human-readable and understandable description\n    // of the event\", so `user_account_locked` twice gave a SOC a machine token in the column its\n    // console renders as the event title.\n    // spec-cite: Implementing ArcSight CEF v26, Oct 2023 — \"Header Field Definitions\", `deviceEventClassId`\n    // row (\"a unique identifier for each event-type … also known as Signature ID\") and `name` row\n    // (String, 512): \"a string representing a human-readable and understandable description of the event.\"\n    return `CEF:0|${header('deviceVendor', 'Wildo')}|${header('deviceProduct', 'SecurityAudit')}|${header('deviceVersion', envelope.sourceVersion)}|${header('deviceEventClassId', envelope.eventType)}|${header('name', this._humanizeEventType(envelope.eventType))}|${cefSeverity}|${extensions}`;\n  }\n\n  /**\n   * Format event as LEEF (Log Event Extended Format — IBM QRadar).\n   * LEEF:Version|Vendor|Product|Version|EventID|Extension\n   *\n   * The serialized `eventData` bag rides a custom `eventData` attribute. It is deliberately NOT\n   * called `msg` as in the CEF projection: `msg` earns that name in CEF by being a dictionary key\n   * with a defined meaning, whereas LEEF publishes no such key — borrowing CEF's vocabulary here\n   * would imply a standard attribute that does not exist. Each grammar gets the name that is\n   * correct within it.\n   * spec-cite: N/A — `eventData` is a Wildo-chosen custom attribute name, not a LEEF-defined key.\n   */\n  private _formatAsLEEF(envelope: SecurityAuditEventEnvelope): string {\n    const val = (value: string): string => this._escapeLEEFValue(value);\n    const header = (field: string, value: string): string => this._emitBoundedHeaderField(field, value, LEEF_HEADER_MAX_CHARACTERS);\n    const eventDataDetail = this._serializeEventDataDetail(envelope, val);\n    // LEEF attributes are TAB-delimited (we emit no `DelimiterCharacter`), so that is `join` here.\n    const pair = (key: LeefWireKey, value: string): string => this._emitPair(key, value, val, LEEF_MAX_CHARACTERS);\n    const join = (...fragments: readonly string[]): string => fragments.join('\\t');\n\n    // Driven by LEEF_PROJECTION. LEEF reaches ALL 27 envelope fields because a LEEF custom key stays\n    // searchable in QRadar, where a CEF custom extension does not — see the contract for the citation.\n    //\n    // `sev`, `devTime` and `devTimeFormat` are rendered BY the contract now. They used to be appended\n    // here, which looked like a formatter detail and was a hole: a key emitted outside `pair` skips\n    // its published ceiling, the duplicate-key check, and the declared-vs-emitted test — and `sev`\n    // is precisely a key with a published constraint (`1-10`).\n    const extensions = this._renderProjection(LEEF_PROJECTION, envelope, { pair, join, eventDataDetail })\n      .join('\\t');\n\n    // Six header fields, not five. The sixth is the attribute DelimiterCharacter, which every\n    // LEEF 2.0 example in the guide carries and ours omitted — see LEEF_TAB_DELIMITER_HEADER_VALUE:\n    // a parser splitting a 2.0 header into six fields was consuming our first attribute as it.\n    // Vendor and Product go through `header()` too, though they are constants that need neither\n    // escaping nor bounding. The point is that EVERY header field goes through the one door, so\n    // \"is this field covered?\" is answerable by looking rather than by reasoning about each value —\n    // the same reason `rt` was routed through `pair` even though digits never change.\n    return `LEEF:2.0|${header('vendor', 'Wildo')}|${header('product', 'SecurityAudit')}|${header('productVersion', envelope.sourceVersion)}|${header('eventId', envelope.eventType)}|${LEEF_TAB_DELIMITER_HEADER_VALUE}|${extensions}`;\n  }\n\n  /**\n   * Serialize `envelope.eventData` into the single detail field that CEF (`msg`) and LEEF\n   * (`eventData`) each carry, or `undefined` when there is nothing worth saying — the caller's\n   * `.filter(Boolean)` then drops the key entirely instead of emitting an empty one.\n   *\n   * Without this, CEF/LEEF subscribers received ONLY the curated standard keys while\n   * `json_structured` subscribers received the whole bag: a silent capability gap between\n   * formats, not a deliberate reduction.\n   *\n   * REJECTED ALTERNATIVE — flattening each `eventData` entry into its own extension key\n   * (`lockoutDuration=15`, `sessionId=…`). It reads better as SIEM columns, but it is unsound\n   * here. `eventData` is an OPEN, app-extensible bag whose keys routinely collide both with the\n   * CEF/LEEF dictionaries and with the envelope fields already projected above it: the\n   * `USER_LOGIN_FAILED` bag alone carries `failureReason`, `ipAddress` and `email`, which the\n   * dispatcher has already promoted onto the envelope and which this formatter already emits as\n   * `reason`, `src` and `suser`. Flattening would therefore put `src=` on the line TWICE and leave\n   * which one wins to the receiver's parser. Nested objects and arrays have no flat\n   * representation either. One JSON field keeps the standard keys authoritative AND the bag\n   * lossless, at the cost of a second parse step on the receiving end.\n   *\n   * The returned JSON is escaped by the CALLER for its grammar, so a backslash ends up encoded\n   * twice — once by `JSON.stringify`, once by the CEF/LEEF escaper. That is correct and\n   * required: a receiver un-escapes the wire grammar first, then parses the JSON.\n   */\n  private _serializeEventDataDetail(\n    envelope: SecurityAuditEventEnvelope,\n    escapeForGrammar: (value: string) => string,\n  ): string | undefined {\n    // Defensive: the envelope TYPE requires `eventData`, but this formatter also runs over\n    // envelopes replayed from the DLQ, where a stored bag can be absent or malformed. An\n    // unguarded `Object.keys(undefined)` here would throw inside delivery.\n    const eventData: unknown = envelope.eventData;\n    if (!eventData || typeof eventData !== 'object' || Object.keys(eventData).length === 0) {\n      return undefined;\n    }\n\n    let serialized: string;\n    try {\n      serialized = JSON.stringify(eventData);\n    } catch {\n      // A circular / unserializable bag must not fail the whole delivery — the standard keys\n      // above it are still valuable to a SOC, so drop only the detail field.\n      this.logDebug('SIEM eventData detail omitted — bag is not JSON-serializable', {\n        eventId: envelope.eventId,\n        eventType: envelope.eventType,\n      });\n      return undefined;\n    }\n\n    // `JSON.stringify` returns `undefined` for a value it cannot represent at all; the guard\n    // above makes that unreachable for a non-empty plain object, but a `toJSON()` returning\n    // `undefined` would still land here.\n    if (!serialized) return undefined;\n\n    if (escapeForGrammar(serialized).length <= SIEM_EVENT_DATA_DETAIL_MAX_CHARS) return serialized;\n\n    // Largest prefix whose ESCAPED form, marker included, still fits. A prefix length cannot be\n    // computed arithmetically because expansion depends on which characters the prefix contains,\n    // and it is not uniform across the two grammars (CEF escapes `=`, LEEF does not). Binary search\n    // costs O(log n) escape passes and is exact; a fixed safety margin would be a guess that is\n    // simultaneously too small for a delimiter-dense bag and wasteful for an ordinary one.\n    let fits = 0;\n    let tooLong = serialized.length;\n    while (fits < tooLong) {\n      const candidate = Math.ceil((fits + tooLong) / 2);\n      if (escapeForGrammar(this._truncateDetail(serialized, candidate)).length <= SIEM_EVENT_DATA_DETAIL_MAX_CHARS) {\n        fits = candidate;\n      } else {\n        tooLong = candidate - 1;\n      }\n    }\n    const truncated = this._truncateDetail(serialized, fits);\n\n    this.logDebug('SIEM eventData detail truncated to the CEF/LEEF detail-field ceiling', {\n      eventId: envelope.eventId,\n      eventType: envelope.eventType,\n      originalLength: serialized.length,\n      emittedLength: truncated.length,\n      escapedLength: escapeForGrammar(truncated).length,\n      maxChars: SIEM_EVENT_DATA_DETAIL_MAX_CHARS,\n    });\n    return truncated;\n  }\n\n  /**\n   * Cut `serialized` to `length` UTF-16 units and append the truncation marker.\n   *\n   * The marker is counted INSIDE the ceiling by the caller's search, not appended beyond it — a\n   * bound that its own truncation overshoots is not a bound. A cut landing between the halves of a\n   * surrogate pair would emit a lone surrogate, which `JSON.parse` on the receiving end rejects with\n   * a different error than the truncation it actually is, so the trailing half-pair is dropped.\n   */\n  private _truncateDetail(serialized: string, length: number): string {\n    const cut = serialized.slice(0, length);\n    const last = cut.charCodeAt(cut.length - 1);\n    const endsOnHighSurrogate = last >= 0xd800 && last <= 0xdbff;\n    return `${endsOnHighSurrogate ? cut.slice(0, -1) : cut}${SIEM_EVENT_DATA_TRUNCATION_MARKER}`;\n  }\n\n  // ─────────────────────────────────────────────────────────────\n  // Wire-format escaping\n  //\n  // CEF and LEEF are single-line, delimiter-separated grammars with NO quoting construct: a\n  // delimiter appearing raw inside a value does not produce a malformed record that a parser\n  // rejects — it produces a WELL-FORMED record with silently wrong fields. That failure mode is\n  // why these helpers exist and why EVERY interpolated string value goes through one of them\n  // rather than only the fields believed to be risky today. `outcomeReason` in particular is free\n  // text sourced from `eventData.failureReason` / `eventData.reason`, so it is the first projected\n  // field with no vocabulary constraining its characters.\n  // ─────────────────────────────────────────────────────────────\n\n  /**\n   * Escape a value for a CEF *extension* (`key=value`) slot.\n   *\n   * The extension is a space-separated `key=value` list whose parser delimits on the next\n   * `<key>=`, so per the CEF standard:\n   * - `\\` becomes `\\\\` — it is the escape character itself, which is why it MUST be replaced\n   *   first; doing it later would re-escape the backslashes introduced by the rules below.\n   * - `=` becomes `\\=` — an unescaped `=` is read as the start of the next key/value pair.\n   * - CR/LF become the two-character sequences `\\r` / `\\n` — a real newline terminates the\n   *   record and truncates every remaining field.\n   *\n   * Spaces are deliberately NOT escaped: the grammar permits them inside extension values (a\n   * value is delimited by the next `<key>=`, not by whitespace).\n   * spec-cite: Implementing ArcSight CEF v26, Oct 2023 — \"Character Encoding\" / the extension\n   * escaping rules for pipe, backslash and equals in the Extension field.\n   */\n  private _escapeCEFExtensionValue(value: string): string {\n    return value\n      .replace(/\\\\/g, '\\\\\\\\')\n      .replace(/=/g, '\\\\=')\n      .replace(/\\r/g, '\\\\r')\n      .replace(/\\n/g, '\\\\n');\n  }\n\n  /**\n   * Escape a value for a LEEF attribute slot.\n   *\n   * LEEF pairs are TAB-delimited, so a literal tab fabricates an extra attribute and a newline\n   * terminates the record; both are encoded as their escape sequences (`\\` first, for the same\n   * reason as above). `=` needs NO escaping here — a LEEF parser splits each pair on its FIRST\n   * `=`, so subsequent `=` characters remain part of the value.\n   * spec-cite: N/A — LEEF publishes no escaping table for attribute values; these rules are\n   * derived from its tab-delimited, newline-terminated record structure, which is why the `=`\n   * asymmetry with CEF above is deliberate rather than an oversight.\n   */\n  private _escapeLEEFValue(value: string): string {\n    // ⚠️ `|` and `^` are deliberately NOT escaped, and the reasoning is the point rather than the\n    // conclusion. The guide's best practices say to AVOID them in keys and values — it defines no\n    // escape for them, because LEEF 2.0's answer is the header's `DelimiterCharacter`, which lets a\n    // producer CHOOSE the attribute delimiter (caret is a documented choice). Inventing `\\|` would\n    // therefore corrupt the value at every conformant receiver, which is strictly worse than the\n    // mis-parse it guards against — and that mis-parse needs a non-conformant parser splitting the\n    // whole line on `|`, since the header ends at its fifth. We emit no `DelimiterCharacter`, so the\n    // delimiter is TAB and a caret in a value is inert. If a `DelimiterCharacter` is ever emitted,\n    // THAT character becomes escapable-or-forbidden and this decision must be re-taken.\n    // spec-cite: IBM QRadar LEEF Version 2 (© IBM 2013, 2016) — \"Best practices Guidelines for LEEF\n    // events\": \"Use alphanumeric (A-Z, a-z, and 0-9) characters, but avoid tab, pipe, or caret\n    // delimiters in your event payload keys and values\"; Table 2, `Delimiter Character` row.\n    return value\n      .replace(/\\\\/g, '\\\\\\\\')\n      .replace(/\\t/g, '\\\\t')\n      .replace(/\\r/g, '\\\\r')\n      .replace(/\\n/g, '\\\\n');\n  }\n\n  /**\n   * Escape a value for a CEF or LEEF *header* slot (the `|`-delimited prefix shared by both\n   * grammars).\n   *\n   * A literal `|` would fabricate a header field and shift every subsequent one — including the\n   * severity and the entire extension — so it is escaped as `\\|`. Headers cannot span lines at\n   * all (there is no multi-line encoding for them, unlike extension values), so newlines are\n   * folded to a space rather than escaped.\n   *\n   * Applied defensively: `sourceVersion` is read straight from the `APP_VERSION` environment\n   * variable and `eventType` is app-extensible, so neither is guaranteed delimiter-free.\n   */\n  private _escapeSIEMHeaderField(value: string): string {\n    return value\n      .replace(/\\\\/g, '\\\\\\\\')\n      .replace(/\\|/g, '\\\\|')\n      // Any CR or LF, in any combination — not just `\\r?\\n`. A LONE `\\r` slipped through that form,\n      // and a bare CR terminates a record for readers that treat it as a line ending.\n      .replace(/[\\r\\n]+/g, ' ');\n  }\n\n  /**\n   * Render a projection contract into its emitted fragments, in declaration order.\n   *\n   * Only `extension` entries produce wire output. `header` entries are carried by the caller's header\n   * construction and `not-projected` entries deliberately produce nothing — both exist in the contract\n   * so that COVERAGE is a property of the type rather than of anyone's memory.\n   */\n  private _renderProjection<K extends string>(\n    contract: SiemProjectionContract<SecurityAuditEventEnvelope, K>,\n    envelope: SecurityAuditEventEnvelope,\n    context: SiemProjectionContext<K>,\n  ): string[] {\n    const fragments: string[] = [];\n    for (const projection of Object.values(contract)) {\n      if (projection.kind !== SiemFieldProjectionKind.EXTENSION) continue;\n      const fragment = projection.render(envelope, context);\n      if (fragment) fragments.push(fragment);\n    }\n    return fragments;\n  }\n\n  /**\n   * Emit one `key=value` pair, escaped for its grammar and bounded by the key's PUBLISHED ceiling.\n   *\n   * The bound is measured on the ESCAPED value for the same reason as the detail bag: escaping only\n   * expands, so bounding the encoded form is the only bound that holds under both readings of what a\n   * published length governs. A key absent from `maxByKey` has no published limit and is emitted\n   * whole — the table never invents one.\n   *\n   * Truncation is LOUD. Losing the tail of an id or an email is a data defect, not a formatting\n   * detail, and the receiver cannot tell a truncated value from a short one.\n   */\n  private _emitPair<K extends string>(\n    key: K,\n    rawValue: string,\n    escapeForGrammar: (value: string) => string,\n    maxByKey: Readonly<Record<string, number>>,\n  ): string {\n    return `${key}=${this._boundToPublishedLength(key, rawValue, escapeForGrammar, maxByKey[key])}`;\n  }\n\n  /**\n   * Escape a value and bound the ESCAPED result at its published ceiling, or emit it whole when the\n   * document publishes none.\n   *\n   * Shared by the extension path ({@link _emitPair}) and the header path\n   * ({@link _emitBoundedHeaderField}) because both answer the same question and only one of them used\n   * to. Header fields never passed through `_emitPair`, so every published header size — most\n   * pointedly `deviceVersion`'s 31 characters, which carries `APP_VERSION` — was unenforced while the\n   * extension ceilings were being carefully derived from the dictionary one layer away. Two code\n   * paths for one rule is how that happened; there is one now.\n   *\n   * The bound is measured on the escaped form for the reason given at\n   * {@link SIEM_EVENT_DATA_DETAIL_MAX_CHARS}: escaping only expands, so a value within the ceiling\n   * once encoded is within it once decoded, which satisfies both readings of what a published length\n   * governs. Truncation is LOUD — losing the tail of a version or an id is a data defect, and the\n   * receiver cannot tell a truncated value from a short one.\n   */\n  private _boundToPublishedLength(\n    fieldName: string,\n    rawValue: string,\n    escapeForGrammar: (value: string) => string,\n    max: number | undefined,\n  ): string {\n    const escaped = escapeForGrammar(rawValue);\n    if (max === undefined || escaped.length <= max) return escaped;\n\n    let fits = 0;\n    let tooLong = rawValue.length;\n    while (fits < tooLong) {\n      const candidate = Math.ceil((fits + tooLong) / 2);\n      if (escapeForGrammar(rawValue.slice(0, candidate)).length <= max) fits = candidate;\n      else tooLong = candidate - 1;\n    }\n    const cut = rawValue.slice(0, fits);\n    const lastCode = cut.charCodeAt(cut.length - 1);\n    const kept = lastCode >= 0xd800 && lastCode <= 0xdbff ? cut.slice(0, -1) : cut;\n\n    this.logger.warn?.('SIEM field truncated to its published ceiling', {\n      key: fieldName,\n      maxChars: max,\n      originalLength: rawValue.length,\n      emittedLength: kept.length,\n    });\n    return escapeForGrammar(kept);\n  }\n\n  /**\n   * Emit one `|`-delimited header field, escaped for the shared header grammar and bounded by the\n   * size its document publishes for THAT slot.\n   *\n   * A header field cannot be dropped when it misbehaves — an omitted field shifts every field after\n   * it and silently re-interprets the whole record — so the only available degradation is truncation.\n   */\n  private _emitBoundedHeaderField(\n    fieldName: string,\n    rawValue: string,\n    maxByField: Readonly<Record<string, number>>,\n  ): string {\n    return this._boundToPublishedLength(\n      fieldName,\n      rawValue,\n      (value) => this._escapeSIEMHeaderField(value),\n      maxByField[fieldName],\n    );\n  }\n\n  /**\n   * `user_account_locked` → `User account locked`, for CEF's human-readable `Name` header field.\n   *\n   * Derived rather than authored: the envelope carries no display label, and inventing a lookup table\n   * would be a second vocabulary to keep in sync with `CoreAuditableEventType` — the drift shape this\n   * codebase keeps paying for. A derivation cannot go stale.\n   *\n   * Deliberately NOT applied to `Device Event Class ID`, which must stay the machine token: a\n   * correlation rule keyed on a prettified string would break the moment the prettifier changed.\n   */\n  private _humanizeEventType(eventType: string): string {\n    const words = eventType.replace(/[_-]+/g, ' ').trim();\n    return words ? `${words.charAt(0).toUpperCase()}${words.slice(1)}` : eventType;\n  }\n\n  /**\n   * Build HTTP headers for the SIEM webhook request.\n   */\n  private _buildHeaders(\n    body: string,\n    siemConfig: SIEMDeliveryJobPayload['siemConfig'],\n  ): Record<string, string> {\n    const headers: Record<string, string> = {\n      // Second reader of `eventFormat` in this file (the first is `_formatBody`). Both route\n      // through the SIEMEventFormat vocabulary so a future format value cannot be added to the\n      // switch and silently forgotten here, where the wrong Content-Type makes a receiver reject\n      // an otherwise well-formed body.\n      // OCSF is JSON too, so the test is \"is this a TEXT grammar\", not \"is it json_structured\".\n      // Reading it the other way would have shipped OCSF as `text/plain` — a well-formed body a\n      // receiver may refuse to parse, which is this workstream's signature failure shape.\n      [WildoHeaderKeys.CONTENT_TYPE]: siemConfig.eventFormat === SIEMEventFormat.CEF || siemConfig.eventFormat === SIEMEventFormat.LEEF\n        ? 'text/plain'\n        : 'application/json',\n    };\n\n    // Apply custom headers first (auth headers override if needed)\n    if (siemConfig.customHeaders) {\n      Object.assign(headers, siemConfig.customHeaders);\n    }\n\n    // H6: Resolve (decrypt) the credential before use\n    const resolvedCredential = this._resolveCredential(siemConfig.authCredential);\n\n    // Apply auth method\n    switch (siemConfig.authMethod) {\n      case 'bearer_token':\n        if (resolvedCredential) {\n          headers[WildoHeaderKeys.AUTHORIZATION] = `Bearer ${resolvedCredential}`;\n        }\n        break;\n\n      case 'api_key_header': {\n        const headerName = siemConfig.authHeaderName || WildoHeaderKeys.API_KEY;\n        if (resolvedCredential) {\n          headers[headerName] = resolvedCredential;\n        }\n        break;\n      }\n\n      case 'hmac_sha256':\n        if (resolvedCredential) {\n          const hmac = createHmac('sha256', resolvedCredential)\n            .update(body)\n            .digest('hex');\n          headers[WildoHeaderKeys.X_SIGNATURE_256] = `sha256=${hmac}`;\n        }\n        break;\n\n      case 'none':\n      default:\n        break;\n    }\n\n    return headers;\n  }\n\n  /**\n   * Send HTTP POST to the SIEM webhook endpoint.\n   *\n   * ## Why this is not a plain `fetch`\n   *\n   * `webhookUrl` is TENANT-authored: an organization administrator types it, and this worker POSTs\n   * to it holding the deployment's own network position. That is the fifth of the five outbound\n   * target classes `security/ssrf/outbound-target-guard.backend.utils.ts` was written for — its\n   * header names \"SIEM collectors\" explicitly — and it was the one class that never called it. A\n   * `webhookUrl` of `http://169.254.169.254/latest/meta-data/iam/security-credentials/` was\n   * delivered to, with the tenant's own auth headers attached, and the response body came back\n   * inside the thrown error's message.\n   *\n   * {@link pinnedOutboundFetch} closes three separate holes here, not one:\n   *\n   * 1. **No classification at all.** The shape check now refuses a literal internal address and a\n   *    reserved special-use hostname before anything leaves the process.\n   * 2. **Check-then-connect.** The address is classified inside the connection's `lookup` hook, so a\n   *    name that answers public to a validator and private to the socket never gets one.\n   * 3. **Redirects.** The old call omitted `redirect: 'error'`, so even a perfect check would have\n   *    been walked past by a collector answering `302 Location: http://169.254.169.254/`. This\n   *    client cannot follow a redirect at all — a 302 arrives as a 302 and fails the `ok` test\n   *    below, landing in the retry/DLQ path like any other bad response.\n   *\n   * ## The behaviour change, stated rather than discovered\n   *\n   * A collector that today answers a redirect stops being followed and starts failing. That is\n   * deliberate: a redirect is precisely how the guard is bypassed, and a SIEM endpoint that needs\n   * one should be reconfigured to its final address. A collector on a PRIVATE network keeps working\n   * only when the operator has declared\n   * `auditTrail.allowPrivateNetworkSiemCollectors` — see {@link _admitsPrivateNetworkCollectors}.\n   */\n  private async _sendHttpPost(\n    url: string,\n    body: string,\n    headers: Record<string, string>,\n    timeoutMs: number,\n  ): Promise<void> {\n    const controller = new AbortController();\n    const timeoutId = setTimeout(() => controller.abort(), timeoutMs);\n\n    try {\n      const response = await pinnedOutboundFetch(url, {\n        method: 'POST',\n        headers,\n        body,\n        signal: controller.signal,\n        /**\n         * BOTH schemes, unlike CIMD's https-only policy, and the asymmetry is deliberate rather than\n         * an oversight. `webhookUrl` is authored configuration that predates this guard and `http:`\n         * collectors exist in the field on trusted internal networks; refusing plaintext here would\n         * silently stop delivering security events for those deployments, which is a worse security\n         * outcome than the transport weakness it would remove. Narrowing this to `https:` is a\n         * separate, operator-visible decision with its own migration — not a side effect of adding\n         * an SSRF guard.\n         */\n        admittedProtocols: ['https:', 'http:'],\n        admitPrivateAddresses: this._admitsPrivateNetworkCollectors(),\n      });\n\n      if (!response.ok) {\n        const responseText = await response.text().catch(() => '');\n        throw new Error(\n          `SIEM webhook returned HTTP ${response.status}: ${responseText.slice(0, 200)}`\n        );\n      }\n    } finally {\n      clearTimeout(timeoutId);\n    }\n  }\n\n  /**\n   * Has the DEPLOYMENT OPERATOR declared that SIEM collectors may sit on a private network?\n   *\n   * Read from the application configuration, never from the SIEM config row. The row is authored by\n   * an organization administrator — the same party that supplies the URL — so a flag there would let\n   * the attacker disarm the guard aimed at them. The operator declares the network posture; the\n   * tenant chooses a destination within it.\n   *\n   * Absent reads as `false`. The field is deliberately un-defaulted in\n   * {@link AuditTrailConfigSchema} so that an application which never authored the block gets the\n   * refusing posture by doing nothing.\n   */\n  private _admitsPrivateNetworkCollectors(): boolean {\n    return this.appConfigService.config?.auditTrail?.allowPrivateNetworkSiemCollectors === true;\n  }\n\n  // ─────────────────────────────────────────────────────────────\n  // Circuit Breaker\n  // ─────────────────────────────────────────────────────────────\n\n  private _isCircuitOpen(circuitKey: string): boolean {\n    const state = this.circuitBreakers.get(circuitKey);\n    if (!state || !state.circuitOpenUntil) return false;\n\n    if (new Date() > state.circuitOpenUntil) {\n      state.circuitOpenUntil = null;\n      return false;\n    }\n\n    return true;\n  }\n\n  private _recordSuccess(circuitKey: string): void {\n    this.circuitBreakers.delete(circuitKey);\n  }\n\n  private _recordFailure(circuitKey: string): void {\n    let state = this.circuitBreakers.get(circuitKey);\n    if (!state) {\n      state = { consecutiveFailures: 0, lastFailureAt: null, circuitOpenUntil: null };\n      this.circuitBreakers.set(circuitKey, state);\n    }\n\n    state.consecutiveFailures++;\n    state.lastFailureAt = new Date();\n\n    if (state.consecutiveFailures >= CIRCUIT_BREAKER_THRESHOLD) {\n      state.circuitOpenUntil = new Date(Date.now() + CIRCUIT_BREAKER_COOLDOWN_MS);\n      this.logger.warn('SIEM circuit breaker opened', {\n        circuitKey,\n        consecutiveFailures: state.consecutiveFailures,\n        cooldownMs: CIRCUIT_BREAKER_COOLDOWN_MS,\n      });\n    }\n  }\n\n  // ─────────────────────────────────────────────────────────────\n  // M11: Dead Letter Queue\n  // ─────────────────────────────────────────────────────────────\n\n  /**\n   * Persist failed SIEM delivery events to a MongoDB-backed DLQ resource\n   * instead of silently dropping them. DLQ entries conform to SiemDeliveryDlqBase\n   * and are queryable/retryable through the standard resource engine.\n   */\n  private async _enqueueToDLQ(\n    payload: SIEMDeliveryJobPayload,\n    failureReason: string,\n    errorMessage?: string,\n  ): Promise<void> {\n    const scopeType = payload.scopeType ?? AuthScopeType.ORGANIZATION;\n    const scopeId = payload.scopeId ?? payload.organizationId;\n    try {\n      const dlqResourceType = scopeType === AuthScopeType.APPLICATION\n        ? CoreResourceType.APPLICATION_SIEM_DELIVERY_DLQ\n        : CoreResourceType.ORGANIZATION_SIEM_DELIVERY_DLQ;\n      // Polymorphic scope FK field name: `organizationId` for the ORG variant,\n      // `applicationId` for the APP variant (the polymorphism engine's per-variant column).\n      const scopeFieldIdentifier = scopeType === AuthScopeType.APPLICATION\n        ? coreResourceShared_FieldIdentifier[CoreResourceType.APPLICATION]\n        : coreResourceShared_FieldIdentifier[CoreResourceType.ORGANIZATIONS];\n\n      const ec = await this._getDlqExecutionContext(dlqResourceType, scopeFieldIdentifier, scopeId);\n      const dlqRepo = this.repositoriesRegistry.getRepositoryOrThrow(dlqResourceType);\n\n      const dlqEntry = {\n        // The polymorphic scope FK (organizationId / applicationId) is NOT on\n        // SiemDeliveryDlqBaseSchema — the polymorphism engine appends it per variant as an\n        // excludeFromCreate, context-injected column. Its AUTHORITATIVE write comes from\n        // `enrichDataWithContext` reading it off the EC's context map (seeded in\n        // `_getDlqExecutionContext`), because the strict CREATE-DTO strips this field from\n        // the payload. We ALSO set it here — mirroring the M2M webhook-delivery-log sibling\n        // (`buildScopeFkInjection`) — so both delivery-failure paths read identically; it is\n        // harmless (stripped, then re-injected by enrichment) rather than the source of truth.\n        [scopeFieldIdentifier]: scopeId,\n        eventId: payload.envelope.eventId,\n        eventPayload: payload.envelope,\n        failureReason: `${failureReason}${errorMessage ? `: ${errorMessage}` : ''}`,\n        failureCount: 1,\n        lastAttemptAt: new Date(),\n        nextRetryAt: failureReason === 'retries_exhausted' ? undefined : new Date(Date.now() + 5 * 60 * 1000),\n        status: failureReason === 'retries_exhausted' ? SiemDeliveryDlqStatus.EXHAUSTED : SiemDeliveryDlqStatus.PENDING_RETRY,\n      };\n\n      await dlqRepo.create(ec, dlqEntry);\n\n      this.logger.warn('SIEM delivery event persisted to DLQ', {\n        scopeType,\n        scopeId,\n        eventId: payload.envelope.eventId,\n        eventType: payload.envelope.eventType,\n        failureReason,\n      });\n    } catch (dlqError) {\n      this.logger.error?.('Failed to enqueue SIEM event to DLQ', {\n        scopeType,\n        scopeId,\n        eventId: payload.envelope.eventId,\n        ...projectCaughtErrorLogFields(dlqError),\n      });\n    }\n  }\n\n  /**\n   * Create a REPOSITORY-DIRECT internal ExecutionContext for the DLQ create.\n   *\n   * SIEM delivery runs in an async queue worker with no user EC, so this synthesises a\n   * system super-admin context via `createForInternalRepositoryOperation` — the blessed seam\n   * for repository-tier internal writes (shared with FILES / JOB_* / notification-badge) that\n   * resolves the DLQ's `REPOSITORY_ONLY` CREATE variant. It also uses the CORRECT polymorphic\n   * `dlqResourceType` (the prior hand-rolled path hardcoded the ORG variant even for APP-scoped\n   * deliveries).\n   *\n   * CRITICAL — the scope-FK injection channel: the DLQ's scope FK (organizationId /\n   * applicationId) is an excludeFromCreate, context-injected column the polymorphism engine\n   * appends per variant; the strict CREATE-DTO strips it from the payload, so it is persisted\n   * ONLY by `enrichDataWithContext` reading it off THIS context map. An earlier version passed\n   * an EMPTY map → the required scope FK was never injected → Mongoose \"organizationId: Path\n   * required\" → every retries-exhausted SIEM delivery was silently lost instead of\n   * dead-lettered. An INTERNALLY_INITIATED EC fail-closed rejects org/user identity on\n   * `initiatorIds`, so the context map is the ONLY correct channel for the ORGANIZATION scope FK.\n   */\n  private async _getDlqExecutionContext(\n    dlqResourceType: ResourceType,\n    scopeFieldIdentifier: string,\n    scopeId: string,\n  ): Promise<ExecutionContext<any>> {\n    return this.executionContextCreator.createForInternalRepositoryOperation({\n      resourceType: dlqResourceType,\n      operationIdentifier: CoreResourceOperation.CREATE,\n      contextResourcesFieldIdentifier: new Map([[scopeFieldIdentifier, scopeId]]),\n      initiatorIds: null,\n      initiatorRoles: [\n        { roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], relatedPrimaryScope: ResourcePrimaryScope.APPLICATION },\n      ],\n    });\n  }\n\n  // ─────────────────────────────────────────────────────────────\n  // H6: SIEM Credential Encryption/Decryption\n  // ─────────────────────────────────────────────────────────────\n\n  /**\n   * Derive a 32-byte AES-256 key from the app's session encryption key\n   * using a domain-specific separator to avoid key reuse.\n   */\n  private _deriveSIEMEncryptionKey(): Buffer {\n    const baseKey = this.appConfigService.secrets.security.session.encryptionKey;\n    return createHash('sha256')\n      .update(`${SIEM_KEY_DOMAIN}:${baseKey}`)\n      .digest();\n  }\n\n  /**\n   * H6: Resolve a credential value — decrypts if encrypted, returns as-is if plaintext.\n   * Encrypted format: `encrypted:aes-256-gcm:{iv_hex}:{authTag_hex}:{ciphertext_hex}`\n   */\n  private _resolveCredential(credential: string | undefined): string | undefined {\n    if (!credential) return undefined;\n\n    if (!credential.startsWith(ENCRYPTED_CREDENTIAL_PREFIX)) {\n      // Plaintext credential — log a warning for security awareness\n      this.logDebug('SIEM credential is plaintext (not encrypted at rest). Consider re-saving via admin API to encrypt.');\n      return credential;\n    }\n\n    try {\n      const payload = credential.slice(ENCRYPTED_CREDENTIAL_PREFIX.length);\n      const [ivHex, authTagHex, ciphertextHex] = payload.split(':');\n      if (!ivHex || !authTagHex || !ciphertextHex) {\n        throw new Error('Invalid encrypted credential format');\n      }\n\n      const key = this._deriveSIEMEncryptionKey();\n      const iv = Buffer.from(ivHex, 'hex');\n      const authTag = Buffer.from(authTagHex, 'hex');\n      const ciphertext = Buffer.from(ciphertextHex, 'hex');\n\n      const decipher = createDecipheriv('aes-256-gcm', key, iv);\n      decipher.setAuthTag(authTag);\n\n      const decrypted = Buffer.concat([decipher.update(ciphertext), decipher.final()]);\n      return decrypted.toString('utf8');\n    } catch (error) {\n      this.logger.error?.(\n        'Failed to decrypt SIEM credential',\n        projectCaughtErrorLogFields(error),\n      );\n      return undefined;\n    }\n  }\n\n  /**\n   * H6: Encrypt a plaintext credential for storage.\n   * Returns the encrypted string in format: `encrypted:aes-256-gcm:{iv}:{authTag}:{ciphertext}`\n   *\n   * Called by admin API when saving SIEM configuration.\n   */\n  public encryptCredential(plaintext: string): string {\n    const key = this._deriveSIEMEncryptionKey();\n    const iv = randomBytes(12); // 96-bit IV for GCM\n    const cipher = createCipheriv('aes-256-gcm', key, iv);\n\n    const encrypted = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);\n    const authTag = cipher.getAuthTag();\n\n    return `${ENCRYPTED_CREDENTIAL_PREFIX}${iv.toString('hex')}:${authTag.toString('hex')}:${encrypted.toString('hex')}`;\n  }\n\n  /**\n   * Sleep utility for exponential backoff.\n   */\n  private _sleep(ms: number): Promise<void> {\n    return new Promise(resolve => setTimeout(resolve, ms));\n  }\n}\n"]}

package/dist/esm/compliance/audit-trails/services/utils/leased-value-cache.backend.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"leased-value-cache.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../../../src/compliance/audit-trails/services/utils/leased-value-cache.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AASH,yHAAyH;AACzH,MAAM,WAAW,uBAAuB;IACtC,kHAAkH;IAClH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,qFAAqF;IACrF,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;CACnE;AAED;;;;GAIG;AACH,qBAAa,gBAAgB,CAAC,CAAC;IAOjB,OAAO,CAAC,QAAQ,CAAC,OAAO;IANpC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqC;IAC7D,0GAA0G;IAC1G,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiC;IAC1D,kFAAkF;IAClF,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6B;gBAE5B,OAAO,EAAE,uBAAuB;IAE7D;;;;;;;;OAQG;IACU,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IA+BjE;;;;;;;;;OASG;IACI,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAKpC,6FAA6F;IACtF,IAAI,IAAI,MAAM;IAIrB,0EAA0E;IACnE,KAAK,IAAI,IAAI;IAMpB;;;;;;OAMG;IACU,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAMpC,2GAA2G;IAC3G,OAAO,CAAC,SAAS;IAsCjB,sFAAsF;IACtF,OAAO,CAAC,KAAK;CAqBd"}
+{"version":3,"file":"leased-value-cache.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../../src/compliance/audit-trails/services/utils/leased-value-cache.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AASH,yHAAyH;AACzH,MAAM,WAAW,uBAAuB;IACtC,kHAAkH;IAClH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,qFAAqF;IACrF,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;CACnE;AAED;;;;GAIG;AACH,qBAAa,gBAAgB,CAAC,CAAC;IAOjB,OAAO,CAAC,QAAQ,CAAC,OAAO;IANpC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqC;IAC7D,0GAA0G;IAC1G,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiC;IAC1D,kFAAkF;IAClF,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6B;gBAE5B,OAAO,EAAE,uBAAuB;IAE7D;;;;;;;;OAQG;IACU,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IA+BjE;;;;;;;;;OASG;IACI,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAKpC,6FAA6F;IACtF,IAAI,IAAI,MAAM;IAIrB,0EAA0E;IACnE,KAAK,IAAI,IAAI;IAMpB;;;;;;OAMG;IACU,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAMpC,2GAA2G;IAC3G,OAAO,CAAC,SAAS;IAsCjB,sFAAsF;IACtF,OAAO,CAAC,KAAK;CAqBd"}