@wildo-ai/saas-backend-lib 1.1.3 → 1.1.4

package/dist/esm/monitoring/observability/audit-observation-emission.backend.js.map

@@ -1 +1 @@
-{"version":3,"file":"audit-observation-emission.backend.js","sourceRoot":"","sources":["../../../../../src/monitoring/observability/audit-observation-emission.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4FG;AAIH;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAN,IAAY,oBA4FX;AA5FD,WAAY,oBAAoB;IAC9B;;;;;;;;;;;;;OAaG;IACH,iGAAyE,CAAA;IAEzE;;;OAGG;IACH,qEAA6C,CAAA;IAE7C;;;OAGG;IACH,2FAAmE,CAAA;IAEnE;;;;;;;OAOG;IACH,+EAAuD,CAAA;IAEvD;;;;;;;;OAQG;IACH,qEAA6C,CAAA;IAE7C;;;;;;;OAOG;IACH,2EAAmD,CAAA;IAEnD;;;;;;;;;;;;;;;OAeG;IACH,2EAAmD,CAAA;IAEnD;;;;;;;;;;;;OAYG;IACH,qFAA6D,CAAA;AAC/D,CAAC,EA5FW,oBAAoB,KAApB,oBAAoB,QA4F/B;AAED;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,0BAOX;AAPD,WAAY,0BAA0B;IACpC,mGAAmG;IACnG,yEAA2C,CAAA;IAC3C,mGAAmG;IACnG,+DAAiC,CAAA;IACjC,0DAA0D;IAC1D,qEAAuC,CAAA;AACzC,CAAC,EAPW,0BAA0B,KAA1B,0BAA0B,QAOrC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AA2BnD,kGAAkG;AAClG,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;AAC7C,sGAAsG;AACtG,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;AAE/C;;;;;;GAMG;AACH,MAAM,UAAU,8BAA8B;IAC5C,OAAO,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;AACxC,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,+BAA+B;IAC7C,UAAU,CAAC,KAAK,EAAE,CAAC;IACnB,YAAY,CAAC,KAAK,EAAE,CAAC;AACvB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,MAe1C;IACC,8FAA8F;IAC9F,mGAAmG;IACnG,yFAAyF;IACzF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QACrD,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAEpD,+FAA+F;QAC/F,0FAA0F;QAC1F,4EAA4E;QAC5E,EAAE;QACF,6FAA6F;QAC7F,8FAA8F;QAC9F,gGAAgG;QAChG,4FAA4F;QAC5F,+FAA+F;QAC/F,0EAA0E;QAC1E,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc,IAAI,0BAA0B,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QACnG,IAAI,OAAO,cAAc,EAAE,6BAA6B,KAAK,UAAU,EAAE,CAAC;YACxE,cAAc,CAAC,6BAA6B,CAAC;gBAC3C,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,MAAM,EAAE,MAAM,CAAC,MAAM;aACtB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,QAAQ,KAAK,SAAS,IAAI,GAAG,GAAG,QAAQ,GAAG,oBAAoB;YAAE,OAAO;QAC5E,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAE3B,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,+EAA+E,EAAE;YACtG,4FAA4F;YAC5F,MAAM,EAAE,2BAA2B;YACnC,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,UAAU,EAAE,MAAM,CAAC,MAAM;YACzB,+FAA+F;YAC/F,4BAA4B,EAAE,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;YACjD,aAAa,EAAE,oBAAoB;YACnC,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACjF,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;SAC1B,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,kFAAkF;IACpF,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAQpC;IACC,MAAM,IAAI,GAAG,CAAC,MAAkC,EAAE,KAAe,EAAQ,EAAE,CACzE,0BAA0B,CAAC;QACzB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,MAAM;QACN,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,KAAK;QACL,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC,CAAC;IAEL,IAAI,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,IAAI,CAAC,0BAA0B,CAAC,mBAAmB,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QAED,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,wFAAwF;YACxF,gGAAgG;YAChG,+FAA+F;YAC/F,IAAI,CAAC,0BAA0B,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;YACvD,OAAO;QACT,CAAC;QAED,6FAA6F;QAC7F,yFAAyF;QACzF,MAAM,QAAQ,GAAG,MAAuF,CAAC;QACzG,IAAI,OAAO,QAAQ,EAAE,KAAK,KAAK,UAAU;YAAE,OAAO;QAClD,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,0BAA0B,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC,CAAC;IACvF,CAAC;IAAC,MAAM,CAAC;QACP,iEAAiE;IACnE,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,0BAA0B,CACjC,QAAyD;IAEzD,IAAI,OAAO,QAAQ,KAAK,UAAU;QAAE,OAAO,SAAS,CAAC;IACrD,IAAI,CAAC;QACH,OAAO,QAAQ,EAAE,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,KAAK,YAAY,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;IAChF,OAAO,EAAE,OAAO,EAAE,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACxE,CAAC","sourcesContent":["/**\n * # The seam every FIRE-AND-FORGET audit observation goes through — and the loss signal behind it\n *\n * assurance-control: WILDO.AUDIT.SECURITY_EVENT — a lost security observation is DETECTABLE, so a\n * period with no recorded operator crossings is distinguishable from a period with a broken sink.\n *\n * ## The gap this closes, stated precisely\n *\n * A handful of security observations — an operator crossing a tenant boundary, an authorization\n * refusal, a platform-access grant transition, a directory read — are emitted WITHOUT `await`, with\n * the audit service FEATURE-DETECTED and the returned promise's rejection SWALLOWED. Every one of\n * those three properties is deliberate and must survive: **an observation must never be able to fail\n * the request it observes.** A fail-closed variant would hand anyone a way to disable operator\n * support, or to convert a correct 403 into a 500, by breaking the audit sink.\n *\n * What was missing is not a refusal — it is a COUNT. With nothing recording the drops, an operator\n * reading the trail cannot tell \"no operator crossed a tenant boundary this week\" from \"the audit\n * service has been unbound since Tuesday\". Those two readings of the same empty result are what make\n * the evidence worthless, and it is the same shape as\n * `.claude/rules/negative-results-require-a-positive-probe.md`: an empty result is evidence about the\n * pipeline, never about the world.\n *\n * ## What the existing control does NOT cover — measured 2026-09-09\n *\n * Three call sites carried the claim that *\"detection of a lost row is the audit pipeline's own\n * control (`audit_store_failure_total`), not this gate's\"*. That claim is **true for one loss shape\n * and false for the three that matter here.** `AuditLogsBackendService._createAuditLog` catches its\n * Layer-1 store write and increments `audit_store_failure_total` — so a store that is DOWN while the\n * service is bound and reachable is already counted. But that counter is inside a method the\n * observer may never reach:\n *\n * | Loss shape | Reaches `_createAuditLog`? | Counted before this seam |\n * |---|---|---|\n * | {@link AuditObservationLossReason.SERVICE_UNAVAILABLE} — the audit service is unbound, or the `log*` method is absent (a partial DI binding, a host binding an older audit service) | no | **nothing at all** |\n * | {@link AuditObservationLossReason.EMISSION_THREW} — the call threw synchronously | no | **nothing at all** |\n * | {@link AuditObservationLossReason.EMISSION_REJECTED} — the returned promise rejected | partially | **nothing at all** at the observer |\n * | the Layer-1 store write itself failed | yes | `audit_store_failure_total` (unchanged, and still the right control for that shape) |\n *\n * So this seam counts the OBSERVER-side drop — the case where the audit pipeline never learned there\n * was anything to record — and leaves the pipeline's own control alone. The two are complementary,\n * not duplicates, and a reviewer needs both: one says \"we tried and the store refused\", the other\n * says \"we never got as far as trying\".\n *\n * ## Why a METRIC and a LOG, and not an audit row\n *\n * The loss signal must survive the audit store being down, so it cannot BE the audit store —\n * recording \"the audit store was unreachable\" in the audit store is the circularity that makes the\n * whole thing worthless. Two channels, deliberately, because neither alone is sufficient:\n *\n * - **`audit_observation_dropped_total`** (via {@link MetricsService.recordAuditObservationDropped})\n *   is the RATE signal, and it is the durable one: the OTLP reader exports it periodically to the\n *   metrics backend, so its value outlives the process and aggregates across instances. Without the\n *   OTLP preload wired the global meter is a no-op and this channel is silently inert — which is\n *   precisely why it is not the only channel.\n * - **One rate-limited `error` log line** is the always-available channel and the WAKE-UP. It fires\n *   at most once per {@link LOSS_LOG_INTERVAL_MS} per `(observation, reason)` pair, so a service\n *   that has been unbound since boot produces one line rather than one per request. Unthrottled it\n *   would flood, and a channel that floods is a channel operators filter out — which would leave the\n *   signal technically present and practically absent.\n *\n * ## The process-local accumulator, argued rather than assumed\n *\n * {@link readAuditObservationLossTotals} is per-process and is **lost on restart**. That is stated\n * here rather than glossed, because a reader could otherwise take it for durable evidence:\n *\n * - It is **not** the evidence. It is a test seam and a door for a future health surface. The\n *   durable record is the exported counter (metrics backend) plus the log line (log store).\n * - Per-instance is the correct granularity for the LOG channel anyway — \"which replica lost\n *   evidence\" is part of the answer — and the metrics backend does the cross-instance aggregation\n *   that a process-local number never could.\n * - Rejected: a durable row for each loss. It is I/O on the observation path, it can fail the\n *   request the whole design forbids failing, and it introduces a second store that can itself be\n *   down. Rejected: a dedicated health endpoint. Still per-instance, adds a surface, and gives an\n *   operator nothing the counter does not already give them.\n *\n * ## Why this is a SEAM and not a helper each site copies\n *\n * `.claude/rules/invariant-call-site-enumeration.md` — the invariant here (\"a dropped observation is\n * counted\") holds at every fire-and-forget security observation in the package, spread across six\n * subtrees, and the recurring defect in this repository is exactly the invariant applied at one of\n * them. Routing every site through one function makes the counting structural rather than\n * remembered: a new fire-and-forget observation that uses this seam is counted the day it lands,\n * with no author having to know this mechanism exists.\n *\n * **Do not quote a call-site count from this file.** An earlier revision named one (\"EIGHT call\n * sites\"), and the very next adoption pass made it wrong — a number in prose is one a reader has to\n * re-measure before believing, which is worse than no number. Measure it:\n *\n * ```bash\n * command grep -rn \"emitAuditObservation(\\|recordAuditObservationLoss(\" engine/saas-backend-lib/src \\\n *   | grep -v __tests__ | grep -v audit-observation-emission.backend.ts\n * ```\n */\n\nimport type { MetricsService } from '~wildo-backend-lib/monitoring/observability/services/metrics.service';\n\n/**\n * WHICH security observation was lost.\n *\n * A closed vocabulary with one named runtime source, per `CLAUDE.md` — the member is what a reviewer\n * reads off the alert, so it has to carry its own explanation rather than being a bare string at\n * every call site. It is also the metric's `observation` label: bounded, low cardinality, and stable\n * across renames of the emitting method.\n *\n * ## A member names the EVIDENCE, never the emitter\n *\n * Two members of this enum are emitted from more than one place, and that is the design rather than\n * an omission. `CROSS_TENANT_ADMINISTRATIVE_ACCESS` is raised by the per-instance tenant gate AND by\n * the APPLICATION-scoped collection read; `HTTP_API_READ_THROUGH_ACCESS` by the per-read adapter AND\n * by the per-run ETL pipeline. Splitting either by emitter would make the one question an operator\n * actually asks — *how much cross-tenant evidence did we lose?* — a sum over labels, and a sum\n * somebody has to remember to widen is a sum that goes quietly wrong the day a third emitter lands.\n * WHICH door dropped it is carried by the log line's `context`, which is the channel with room for\n * it; the metric carries the rate, which is the thing that has to aggregate.\n *\n * The corollary: when you add an emitter for an event a member already names, REUSE the member and\n * extend its JSDoc to name the new emitter. A member whose prose still names one of two emitters is\n * a stale claim in the place a reviewer trusts most.\n */\nexport enum AuditObservationKind {\n  /**\n   * `CROSS_TENANT_ADMINISTRATIVE_ACCESS`, from BOTH doors that can produce one.\n   *\n   * The most consequential member: this is the operator-crossing trail\n   * `.claude/rules/administrative-continuity-floors.md` requires, and the one whose silence is\n   * indistinguishable from \"no operator crossed anything\".\n   *\n   * - `authorizeOrganizations` — the per-instance tenant gate, deciding on ONE fetched row.\n   * - `ServiceResourceBackendService.recordCrossTenantReadAccess` — the APPLICATION-scoped\n   *   collection read, one observation per TENANT reached. The authorizer never sees this half: it\n   *   runs only for ORGANIZATIONS-scoped resources, and an application-scoped door returns a SET\n   *   whose rows belong to many tenants. Losing it silently is the larger of the two exposures,\n   *   because it is the door that can enumerate every tenant at once.\n   */\n  CROSS_TENANT_ADMINISTRATIVE_ACCESS = 'cross_tenant_administrative_access',\n\n  /**\n   * `RESOURCE_OPERATION_DENIED` from the authorizer funnel. A lost refusal is a lost negative access\n   * decision — the record half of \"record access decisions\".\n   */\n  AUTHORIZATION_DENIAL = 'authorization_denial',\n\n  /**\n   * `PLATFORM_ACCESS_GRANT_LIFECYCLE` from the grant custom implementation. A lost transition means\n   * an elevation exists whose request/approval is not in the trail.\n   */\n  PLATFORM_ACCESS_GRANT_LIFECYCLE = 'platform_access_grant_lifecycle',\n\n  /**\n   * `PLATFORM_DIRECTORY_ACCESS` from `ServiceResourceBackendService.recordPlatformDirectoryAccess` —\n   * an APPLICATION-WIDE directory enumeration that no scope confined.\n   *\n   * `returnedCount` is why the row exists at all: it is the only thing separating \"an operator\n   * opened the directory\" from \"an operator exported it\". A lost observation does not merely lose an\n   * access record, it loses the SIZE, which is the half a reviewer reads first.\n   */\n  PLATFORM_DIRECTORY_ACCESS = 'platform_directory_access',\n\n  /**\n   * `USER_SESSION_EVICTED` from the token issuer's concurrent-session cap.\n   *\n   * One observation per RETIRED refresh chain, not per enforcement: the cap bounds the blast radius\n   * of undetected token theft, so a burst of evictions for one principal is among the more\n   * interesting things the trail can carry — and a burst is exactly the case where losing some of\n   * the rows understates it. Counting per chain is what keeps the loss signal proportional to the\n   * evidence actually lost rather than to the number of times the cap ran.\n   */\n  USER_SESSION_EVICTED = 'user_session_evicted',\n\n  /**\n   * `PROVIDER_OPERATION_CALL` from the provider operation executor — one row per OUTBOUND call to a\n   * third party, on both the success and the failure path.\n   *\n   * This is the application's record of what it sent to whom on whose behalf. Its silence is\n   * peculiarly misleading: an empty outbound trail reads as \"this deployment integrates with\n   * nothing\", which is a sentence somebody will believe.\n   */\n  PROVIDER_OPERATION_CALL = 'provider_operation_call',\n\n  /**\n   * The post-call credential-use stamp from the provider operation executor.\n   *\n   * ## Why this is on THIS counter even though its sink is not the audit service\n   *\n   * It writes to the tenant's own credential row rather than to `AuditLogsBackendService`, and it is\n   * still the identical observer-side loss shape: fire-and-forget, sink feature-detected, rejection\n   * swallowed, nothing counting the drops. The counter's subject is the LOSS OF A SECURITY\n   * OBSERVATION, not the identity of the store that was supposed to receive it — so a second counter\n   * for one site would fragment the alert without telling an operator anything the `observation`\n   * label does not already say.\n   *\n   * What it evidences is narrow and worth stating: whether a stored credential was ACCEPTED by the\n   * provider on last use. Losing it leaves a credential whose health is unknown, which surfaces\n   * later as an integration that fails with no record of when it started failing.\n   */\n  PROVIDER_CREDENTIAL_USE = 'provider_credential_use',\n\n  /**\n   * `HTTP_API_READ_THROUGH_ACCESS`, from BOTH emitters — see the enum's naming principle above.\n   *\n   * - `HttpApiResourceRepositoryBackendService.recordReadThroughAccess` — one observation per remote\n   *   round-trip, and the only tier that witnesses every one of them (repository-direct probes never\n   *   reach the services tier at all).\n   * - `ExternalDataPipelineRunBackendService.recordRunReadThroughAccess` — one observation per ETL\n   *   run.\n   *\n   * The evidence at stake is ATTRIBUTION: an HTTP_API read reaches a third party through a SHARED\n   * service principal, so this row is what carries the real initiating user through it. Without it\n   * the external system's own logs show one principal and nothing anywhere resolves it to a person.\n   */\n  HTTP_API_READ_THROUGH_ACCESS = 'http_api_read_through_access',\n}\n\n/**\n * WHY the observation never reached the audit pipeline.\n *\n * Three members, and they are genuinely different diagnoses rather than shades of one — see the\n * table in this module's header. `SERVICE_UNAVAILABLE` is a WIRING fault and is usually total and\n * permanent for the life of the process; the other two are runtime faults and are usually partial.\n * Merging them would leave an operator unable to tell \"this deployment audits nothing\" from \"the\n * audit store hiccupped twice\".\n */\nexport enum AuditObservationLossReason {\n  /** The audit service is unbound, or the specific `log*` method is absent on the bound instance. */\n  SERVICE_UNAVAILABLE = 'service_unavailable',\n  /** The emitting call threw synchronously — before any `.catch()` could make it fire-and-forget. */\n  EMISSION_THREW = 'emission_threw',\n  /** The emitting call returned a promise that rejected. */\n  EMISSION_REJECTED = 'emission_rejected',\n}\n\n/**\n * How often ONE `(observation, reason)` pair may produce a log line.\n *\n * Fifteen minutes: long enough that a permanently broken binding costs four lines an hour rather\n * than one per request, short enough that a NEW outage hours after an earlier one still announces\n * itself instead of being swallowed by a latch that never resets. A permanent latch was rejected for\n * exactly that reason — it makes the second incident invisible.\n */\nexport const LOSS_LOG_INTERVAL_MS = 15 * 60 * 1000;\n\n/** The narrow slice of {@link MetricsService} this seam needs. Structural, so a double is trivial. */\nexport interface AuditObservationLossMetricsRecorder {\n  recordAuditObservationDropped(params: { observation: string; reason: string }): void;\n}\n\n/**\n * A LAZY door to the recorder, for a site that does not hold one.\n *\n * Most emitters here are plain classes built with `new` (repository adapters, the provider executor)\n * or reach the container only through thunks their builder closes over. Each could resolve the\n * recorder itself — and each would then need its own `try`/`catch`, because a container resolving a\n * binding may throw and an observability failure must never reach the request. Five copies of that\n * guard is precisely the shape `.claude/rules/invariant-call-site-enumeration.md` says will be\n * applied at four of them, so the seam takes the thunk and does the wrapping once.\n *\n * Resolution happens ONLY when there is a loss to record. A site on the happy path never touches its\n * container, which is what makes handing this in unconditionally cheap.\n */\nexport type AuditObservationLossMetricsResolver = () => AuditObservationLossMetricsRecorder | undefined;\n\n/** The narrow slice of the logger this seam needs. Optional everywhere — see {@link emitAuditObservation}. */\nexport interface AuditObservationLossLogger {\n  error?: (message: string, context?: Record<string, unknown>) => void;\n}\n\n/** Process-local totals, keyed `<observation>:<reason>`. Not evidence — see the module header. */\nconst lossTotals = new Map<string, number>();\n/** Last log timestamp per `<observation>:<reason>`. Bounded by the enum cross-product (9 entries). */\nconst lastLoggedAt = new Map<string, number>();\n\n/**\n * Every loss recorded since this process started, as `<observation>:<reason>` → count.\n *\n * A COPY, so a caller cannot mutate the accumulator. Exists so the counting can be pinned without an\n * OTLP backend, and so a future health surface has a door that does not require one either. Read the\n * module header before treating the numbers as durable evidence: they are not.\n */\nexport function readAuditObservationLossTotals(): Record<string, number> {\n  return Object.fromEntries(lossTotals);\n}\n\n/** Test isolation only. Never called from production code. */\nexport function resetAuditObservationLossTotals(): void {\n  lossTotals.clear();\n  lastLoggedAt.clear();\n}\n\n/**\n * Record one lost observation. Never throws, under any circumstance.\n *\n * Exported so a site whose emission does not fit {@link emitAuditObservation}'s shape can still\n * contribute to the same counter rather than inventing a second one. Prefer the seam.\n */\nexport function recordAuditObservationLoss(params: {\n  observation: AuditObservationKind;\n  reason: AuditObservationLossReason;\n  /** The recorder itself, when the site already holds one (a container-injected service). */\n  metricsService?: AuditObservationLossMetricsRecorder;\n  /**\n   * A thunk to the recorder, when the site does not. Consulted only if `metricsService` is absent,\n   * and only on a loss — see {@link AuditObservationLossMetricsResolver}. Two fields rather than one\n   * union: a caller reading `metricsService: X | (() => X)` has to work out which one it holds, and\n   * the answer is a property of the CLASS, so it is better spelled at the field.\n   */\n  metricsResolver?: AuditObservationLossMetricsResolver;\n  logger?: AuditObservationLossLogger;\n  error?: unknown;\n  context?: Record<string, unknown>;\n}): void {\n  // The recorder is the LAST thing that may fail the request it observes: a metric backend that\n  // throws, or a logger that throws, would defeat the entire purpose of the fire-and-forget contract\n  // this seam exists to preserve. Everything below is inside one boundary for that reason.\n  try {\n    const key = `${params.observation}:${params.reason}`;\n    lossTotals.set(key, (lossTotals.get(key) ?? 0) + 1);\n\n    // Metrics FIRST. It is the durable, rate-carrying channel, and it must be incremented even for\n    // the drops the throttle below decides not to log — otherwise the throttle would silently\n    // suppress the count as well as the line, which is the defect one layer up.\n    //\n    // Feature-DETECTED rather than optional-chained on the object, and for the reason this whole\n    // module exists: a container that answers every symbol with a stub (the shape several partial\n    // test containers in this package genuinely have) yields a truthy `metricsService` whose method\n    // is absent, so `?.` on the OBJECT still calls `undefined(...)` and throws. The outer catch\n    // would contain it, but a swallowed TypeError looks exactly like a swallowed real defect — and\n    // it would take the log line down with it, leaving the loss silent again.\n    const metricsService = params.metricsService ?? resolveLossMetricsRecorder(params.metricsResolver);\n    if (typeof metricsService?.recordAuditObservationDropped === 'function') {\n      metricsService.recordAuditObservationDropped({\n        observation: params.observation,\n        reason: params.reason,\n      });\n    }\n\n    const now = Date.now();\n    const previous = lastLoggedAt.get(key);\n    if (previous !== undefined && now - previous < LOSS_LOG_INTERVAL_MS) return;\n    lastLoggedAt.set(key, now);\n\n    params.logger?.error?.('A security audit observation was DROPPED before it reached the audit pipeline', {\n      // `reason` is the slug an alert rule and a log query both key on; keep it first and stable.\n      reason: 'audit_observation_dropped',\n      observation: params.observation,\n      lossReason: params.reason,\n      // The running total makes ONE throttled line carry the volume the suppressed lines would have.\n      occurrencesSinceProcessStart: lossTotals.get(key),\n      logIntervalMs: LOSS_LOG_INTERVAL_MS,\n      ...(params.error === undefined ? {} : { error: describeLossError(params.error) }),\n      ...(params.context ?? {}),\n    });\n  } catch {\n    /* An observability failure must never be able to fail the request it observes. */\n  }\n}\n\n/**\n * Emit one fire-and-forget audit observation, counting it if it is lost.\n *\n * ## The contract, which is the whole point\n *\n * **This function never throws and never returns a promise.** Not on an absent service, not on a\n * synchronous throw, not on a rejection, and not on a metrics or logger failure. Callers rely on it\n * to preserve the property their own JSDoc promises: the observation cannot fail the request.\n *\n * @param params.emit The emitting call, or `undefined` when the audit service or its method is\n *   absent. Passing `undefined` is how a site reports {@link AuditObservationLossReason.SERVICE_UNAVAILABLE}\n *   — the feature detection stays at the site because the method name differs per observation, and a\n *   generic reflective lookup here would trade a compile-time error for a runtime one.\n */\nexport function emitAuditObservation(params: {\n  observation: AuditObservationKind;\n  emit: (() => unknown) | undefined;\n  metricsService?: AuditObservationLossMetricsRecorder;\n  /** See {@link recordAuditObservationLoss}. Never called unless there IS a loss. */\n  metricsResolver?: AuditObservationLossMetricsResolver;\n  logger?: AuditObservationLossLogger;\n  context?: Record<string, unknown>;\n}): void {\n  const loss = (reason: AuditObservationLossReason, error?: unknown): void =>\n    recordAuditObservationLoss({\n      observation: params.observation,\n      reason,\n      metricsService: params.metricsService,\n      metricsResolver: params.metricsResolver,\n      logger: params.logger,\n      error,\n      context: params.context,\n    });\n\n  try {\n    if (!params.emit) {\n      loss(AuditObservationLossReason.SERVICE_UNAVAILABLE);\n      return;\n    }\n\n    let result: unknown;\n    try {\n      result = params.emit();\n    } catch (error) {\n      // A `log*` method that is absent on a partially-mocked double throws a TypeError HERE —\n      // synchronously, before any `.catch()` could attach. That is the shape the feature detection at\n      // each site exists to pre-empt; this catch is what keeps a site that forgets it from crashing.\n      loss(AuditObservationLossReason.EMISSION_THREW, error);\n      return;\n    }\n\n    // Optional-chained, because an audit method is free to be synchronous (and every test double\n    // returning `undefined` is). A non-thenable result is a successful emission, not a loss.\n    const thenable = result as { catch?: (handler: (error: unknown) => void) => unknown } | null | undefined;\n    if (typeof thenable?.catch !== 'function') return;\n    thenable.catch((error) => loss(AuditObservationLossReason.EMISSION_REJECTED, error));\n  } catch {\n    /* Belt and braces: nothing in this seam may reach the caller. */\n  }\n}\n\n/**\n * Ask a site's thunk for the recorder, and treat any refusal as \"no recorder\".\n *\n * Its own `try`, INSIDE the caller's: a container that throws while resolving a binding must not be\n * able to take the LOG channel down with it. Degrading a loss to its log-only form is the correct\n * direction — the whole point of this module is that an observability gap is never a reason to\n * refuse — whereas letting the throw escape to the outer `catch` would silence both channels for the\n * one event that most needs saying.\n */\nfunction resolveLossMetricsRecorder(\n  resolver: AuditObservationLossMetricsResolver | undefined,\n): AuditObservationLossMetricsRecorder | undefined {\n  if (typeof resolver !== 'function') return undefined;\n  try {\n    return resolver();\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * A log-safe description of whatever was thrown.\n *\n * Deliberately local rather than routed through `describeCaughtError`: this module sits UNDER the\n * error subsystem in the dependency order (the error builder's own failures are observations this\n * seam records), and importing upward would make an observability module depend on the layer it\n * observes. The shape is a strict subset of what `describeCaughtError` produces, so a log query\n * reading `error.message` works against both.\n */\nfunction describeLossError(error: unknown): { message: string; name?: string } {\n  if (error instanceof Error) return { message: error.message, name: error.name };\n  return { message: typeof error === 'string' ? error : String(error) };\n}\n"]}
+{"version":3,"file":"audit-observation-emission.backend.js","sourceRoot":"","sources":["../../../../src/monitoring/observability/audit-observation-emission.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4FG;AAIH;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAN,IAAY,oBAgGX;AAhGD,WAAY,oBAAoB;IAC9B;;;;;;;;;;;;;OAaG;IACH,iGAAyE,CAAA;IAEzE;;;OAGG;IACH,qEAA6C,CAAA;IAE7C;;;OAGG;IACH,2FAAmE,CAAA;IAEnE;;;;;;;OAOG;IACH,+EAAuD,CAAA;IAEvD;;;;;;;;OAQG;IACH,qEAA6C,CAAA;IAE7C;;;;;;;OAOG;IACH,2EAAmD,CAAA;IAEnD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,2EAAmD,CAAA;IAEnD;;;;;;;;;;;;OAYG;IACH,qFAA6D,CAAA;AAC/D,CAAC,EAhGW,oBAAoB,KAApB,oBAAoB,QAgG/B;AAED;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,0BAOX;AAPD,WAAY,0BAA0B;IACpC,mGAAmG;IACnG,yEAA2C,CAAA;IAC3C,mGAAmG;IACnG,+DAAiC,CAAA;IACjC,0DAA0D;IAC1D,qEAAuC,CAAA;AACzC,CAAC,EAPW,0BAA0B,KAA1B,0BAA0B,QAOrC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AA2BnD,kGAAkG;AAClG,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;AAC7C,sGAAsG;AACtG,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;AAE/C;;;;;;GAMG;AACH,MAAM,UAAU,8BAA8B;IAC5C,OAAO,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;AACxC,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,+BAA+B;IAC7C,UAAU,CAAC,KAAK,EAAE,CAAC;IACnB,YAAY,CAAC,KAAK,EAAE,CAAC;AACvB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,MAe1C;IACC,8FAA8F;IAC9F,mGAAmG;IACnG,yFAAyF;IACzF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QACrD,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAEpD,+FAA+F;QAC/F,0FAA0F;QAC1F,4EAA4E;QAC5E,EAAE;QACF,6FAA6F;QAC7F,8FAA8F;QAC9F,gGAAgG;QAChG,4FAA4F;QAC5F,+FAA+F;QAC/F,0EAA0E;QAC1E,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc,IAAI,0BAA0B,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QACnG,IAAI,OAAO,cAAc,EAAE,6BAA6B,KAAK,UAAU,EAAE,CAAC;YACxE,cAAc,CAAC,6BAA6B,CAAC;gBAC3C,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,MAAM,EAAE,MAAM,CAAC,MAAM;aACtB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,QAAQ,KAAK,SAAS,IAAI,GAAG,GAAG,QAAQ,GAAG,oBAAoB;YAAE,OAAO;QAC5E,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAE3B,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,+EAA+E,EAAE;YACtG,4FAA4F;YAC5F,MAAM,EAAE,2BAA2B;YACnC,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,UAAU,EAAE,MAAM,CAAC,MAAM;YACzB,+FAA+F;YAC/F,4BAA4B,EAAE,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;YACjD,aAAa,EAAE,oBAAoB;YACnC,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACjF,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;SAC1B,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,kFAAkF;IACpF,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAQpC;IACC,MAAM,IAAI,GAAG,CAAC,MAAkC,EAAE,KAAe,EAAQ,EAAE,CACzE,0BAA0B,CAAC;QACzB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,MAAM;QACN,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,KAAK;QACL,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC,CAAC;IAEL,IAAI,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,IAAI,CAAC,0BAA0B,CAAC,mBAAmB,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QAED,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,wFAAwF;YACxF,gGAAgG;YAChG,+FAA+F;YAC/F,IAAI,CAAC,0BAA0B,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;YACvD,OAAO;QACT,CAAC;QAED,6FAA6F;QAC7F,yFAAyF;QACzF,MAAM,QAAQ,GAAG,MAAuF,CAAC;QACzG,IAAI,OAAO,QAAQ,EAAE,KAAK,KAAK,UAAU;YAAE,OAAO;QAClD,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,0BAA0B,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC,CAAC;IACvF,CAAC;IAAC,MAAM,CAAC;QACP,iEAAiE;IACnE,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,0BAA0B,CACjC,QAAyD;IAEzD,IAAI,OAAO,QAAQ,KAAK,UAAU;QAAE,OAAO,SAAS,CAAC;IACrD,IAAI,CAAC;QACH,OAAO,QAAQ,EAAE,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,KAAK,YAAY,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;IAChF,OAAO,EAAE,OAAO,EAAE,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACxE,CAAC","sourcesContent":["/**\n * # The seam every FIRE-AND-FORGET audit observation goes through — and the loss signal behind it\n *\n * assurance-control: WILDO.AUDIT.SECURITY_EVENT — a lost security observation is DETECTABLE, so a\n * period with no recorded operator crossings is distinguishable from a period with a broken sink.\n *\n * ## The gap this closes, stated precisely\n *\n * A handful of security observations — an operator crossing a tenant boundary, an authorization\n * refusal, a platform-access grant transition, a directory read — are emitted WITHOUT `await`, with\n * the audit service FEATURE-DETECTED and the returned promise's rejection SWALLOWED. Every one of\n * those three properties is deliberate and must survive: **an observation must never be able to fail\n * the request it observes.** A fail-closed variant would hand anyone a way to disable operator\n * support, or to convert a correct 403 into a 500, by breaking the audit sink.\n *\n * What was missing is not a refusal — it is a COUNT. With nothing recording the drops, an operator\n * reading the trail cannot tell \"no operator crossed a tenant boundary this week\" from \"the audit\n * service has been unbound since Tuesday\". Those two readings of the same empty result are what make\n * the evidence worthless, and it is the same shape as\n * `.claude/rules/negative-results-require-a-positive-probe.md`: an empty result is evidence about the\n * pipeline, never about the world.\n *\n * ## What the existing control does NOT cover — measured 2026-09-09\n *\n * Three call sites carried the claim that *\"detection of a lost row is the audit pipeline's own\n * control (`audit_store_failure_total`), not this gate's\"*. That claim is **true for one loss shape\n * and false for the three that matter here.** `AuditLogsBackendService._createAuditLog` catches its\n * Layer-1 store write and increments `audit_store_failure_total` — so a store that is DOWN while the\n * service is bound and reachable is already counted. But that counter is inside a method the\n * observer may never reach:\n *\n * | Loss shape | Reaches `_createAuditLog`? | Counted before this seam |\n * |---|---|---|\n * | {@link AuditObservationLossReason.SERVICE_UNAVAILABLE} — the audit service is unbound, or the `log*` method is absent (a partial DI binding, a host binding an older audit service) | no | **nothing at all** |\n * | {@link AuditObservationLossReason.EMISSION_THREW} — the call threw synchronously | no | **nothing at all** |\n * | {@link AuditObservationLossReason.EMISSION_REJECTED} — the returned promise rejected | partially | **nothing at all** at the observer |\n * | the Layer-1 store write itself failed | yes | `audit_store_failure_total` (unchanged, and still the right control for that shape) |\n *\n * So this seam counts the OBSERVER-side drop — the case where the audit pipeline never learned there\n * was anything to record — and leaves the pipeline's own control alone. The two are complementary,\n * not duplicates, and a reviewer needs both: one says \"we tried and the store refused\", the other\n * says \"we never got as far as trying\".\n *\n * ## Why a METRIC and a LOG, and not an audit row\n *\n * The loss signal must survive the audit store being down, so it cannot BE the audit store —\n * recording \"the audit store was unreachable\" in the audit store is the circularity that makes the\n * whole thing worthless. Two channels, deliberately, because neither alone is sufficient:\n *\n * - **`audit_observation_dropped_total`** (via {@link MetricsService.recordAuditObservationDropped})\n *   is the RATE signal, and it is the durable one: the OTLP reader exports it periodically to the\n *   metrics backend, so its value outlives the process and aggregates across instances. Without the\n *   OTLP preload wired the global meter is a no-op and this channel is silently inert — which is\n *   precisely why it is not the only channel.\n * - **One rate-limited `error` log line** is the always-available channel and the WAKE-UP. It fires\n *   at most once per {@link LOSS_LOG_INTERVAL_MS} per `(observation, reason)` pair, so a service\n *   that has been unbound since boot produces one line rather than one per request. Unthrottled it\n *   would flood, and a channel that floods is a channel operators filter out — which would leave the\n *   signal technically present and practically absent.\n *\n * ## The process-local accumulator, argued rather than assumed\n *\n * {@link readAuditObservationLossTotals} is per-process and is **lost on restart**. That is stated\n * here rather than glossed, because a reader could otherwise take it for durable evidence:\n *\n * - It is **not** the evidence. It is a test seam and a door for a future health surface. The\n *   durable record is the exported counter (metrics backend) plus the log line (log store).\n * - Per-instance is the correct granularity for the LOG channel anyway — \"which replica lost\n *   evidence\" is part of the answer — and the metrics backend does the cross-instance aggregation\n *   that a process-local number never could.\n * - Rejected: a durable row for each loss. It is I/O on the observation path, it can fail the\n *   request the whole design forbids failing, and it introduces a second store that can itself be\n *   down. Rejected: a dedicated health endpoint. Still per-instance, adds a surface, and gives an\n *   operator nothing the counter does not already give them.\n *\n * ## Why this is a SEAM and not a helper each site copies\n *\n * `.claude/rules/invariant-call-site-enumeration.md` — the invariant here (\"a dropped observation is\n * counted\") holds at every fire-and-forget security observation in the package, spread across six\n * subtrees, and the recurring defect in this repository is exactly the invariant applied at one of\n * them. Routing every site through one function makes the counting structural rather than\n * remembered: a new fire-and-forget observation that uses this seam is counted the day it lands,\n * with no author having to know this mechanism exists.\n *\n * **Do not quote a call-site count from this file.** An earlier revision named one (\"EIGHT call\n * sites\"), and the very next adoption pass made it wrong — a number in prose is one a reader has to\n * re-measure before believing, which is worse than no number. Measure it:\n *\n * ```bash\n * command grep -rn \"emitAuditObservation(\\|recordAuditObservationLoss(\" engine/saas-backend-lib/src \\\n *   | grep -v __tests__ | grep -v audit-observation-emission.backend.ts\n * ```\n */\n\nimport type { MetricsService } from '~wildo-backend-lib/monitoring/observability/services/metrics.service';\n\n/**\n * WHICH security observation was lost.\n *\n * A closed vocabulary with one named runtime source, per `CLAUDE.md` — the member is what a reviewer\n * reads off the alert, so it has to carry its own explanation rather than being a bare string at\n * every call site. It is also the metric's `observation` label: bounded, low cardinality, and stable\n * across renames of the emitting method.\n *\n * ## A member names the EVIDENCE, never the emitter\n *\n * Two members of this enum are emitted from more than one place, and that is the design rather than\n * an omission. `CROSS_TENANT_ADMINISTRATIVE_ACCESS` is raised by the per-instance tenant gate AND by\n * the APPLICATION-scoped collection read; `HTTP_API_READ_THROUGH_ACCESS` by the per-read adapter AND\n * by the per-run ETL pipeline. Splitting either by emitter would make the one question an operator\n * actually asks — *how much cross-tenant evidence did we lose?* — a sum over labels, and a sum\n * somebody has to remember to widen is a sum that goes quietly wrong the day a third emitter lands.\n * WHICH door dropped it is carried by the log line's `context`, which is the channel with room for\n * it; the metric carries the rate, which is the thing that has to aggregate.\n *\n * The corollary: when you add an emitter for an event a member already names, REUSE the member and\n * extend its JSDoc to name the new emitter. A member whose prose still names one of two emitters is\n * a stale claim in the place a reviewer trusts most.\n */\nexport enum AuditObservationKind {\n  /**\n   * `CROSS_TENANT_ADMINISTRATIVE_ACCESS`, from BOTH doors that can produce one.\n   *\n   * The most consequential member: this is the operator-crossing trail\n   * `.claude/rules/administrative-continuity-floors.md` requires, and the one whose silence is\n   * indistinguishable from \"no operator crossed anything\".\n   *\n   * - `authorizeOrganizations` — the per-instance tenant gate, deciding on ONE fetched row.\n   * - `ServiceResourceBackendService.recordCrossTenantReadAccess` — the APPLICATION-scoped\n   *   collection read, one observation per TENANT reached. The authorizer never sees this half: it\n   *   runs only for ORGANIZATIONS-scoped resources, and an application-scoped door returns a SET\n   *   whose rows belong to many tenants. Losing it silently is the larger of the two exposures,\n   *   because it is the door that can enumerate every tenant at once.\n   */\n  CROSS_TENANT_ADMINISTRATIVE_ACCESS = 'cross_tenant_administrative_access',\n\n  /**\n   * `RESOURCE_OPERATION_DENIED` from the authorizer funnel. A lost refusal is a lost negative access\n   * decision — the record half of \"record access decisions\".\n   */\n  AUTHORIZATION_DENIAL = 'authorization_denial',\n\n  /**\n   * `PLATFORM_ACCESS_GRANT_LIFECYCLE` from the grant custom implementation. A lost transition means\n   * an elevation exists whose request/approval is not in the trail.\n   */\n  PLATFORM_ACCESS_GRANT_LIFECYCLE = 'platform_access_grant_lifecycle',\n\n  /**\n   * `PLATFORM_DIRECTORY_ACCESS` from `ServiceResourceBackendService.recordPlatformDirectoryAccess` —\n   * an APPLICATION-WIDE directory enumeration that no scope confined.\n   *\n   * `returnedCount` is why the row exists at all: it is the only thing separating \"an operator\n   * opened the directory\" from \"an operator exported it\". A lost observation does not merely lose an\n   * access record, it loses the SIZE, which is the half a reviewer reads first.\n   */\n  PLATFORM_DIRECTORY_ACCESS = 'platform_directory_access',\n\n  /**\n   * `USER_SESSION_EVICTED` from the token issuer's concurrent-session cap.\n   *\n   * One observation per RETIRED refresh chain, not per enforcement: the cap bounds the blast radius\n   * of undetected token theft, so a burst of evictions for one principal is among the more\n   * interesting things the trail can carry — and a burst is exactly the case where losing some of\n   * the rows understates it. Counting per chain is what keeps the loss signal proportional to the\n   * evidence actually lost rather than to the number of times the cap ran.\n   */\n  USER_SESSION_EVICTED = 'user_session_evicted',\n\n  /**\n   * `PROVIDER_OPERATION_CALL` from the provider operation executor — one row per OUTBOUND call to a\n   * third party, on both the success and the failure path.\n   *\n   * This is the application's record of what it sent to whom on whose behalf. Its silence is\n   * peculiarly misleading: an empty outbound trail reads as \"this deployment integrates with\n   * nothing\", which is a sentence somebody will believe.\n   */\n  PROVIDER_OPERATION_CALL = 'provider_operation_call',\n\n  /**\n   * The post-call credential-use stamp from the provider operation executor, raised through\n   * `ExternalProvidersRegistryBackendService.recordProviderSecretUseForTarget`.\n   *\n   * ## Why this is on THIS counter even though its PRIMARY sink is not the audit service\n   *\n   * Its main effect is a write to the spent credential's own row — a tenant's or a person's,\n   * whichever the resolution came from — and only its secondary effect is an audit event\n   * (`ORGANIZATION_PROVIDER_CREDENTIAL_USED` / `USER_PROVIDER_CREDENTIAL_USED`, emitted by the store).\n   * The loss shape is identical either way: fire-and-forget, sink feature-detected, rejection\n   * swallowed, nothing counting the drops. The counter's subject is the LOSS OF A SECURITY\n   * OBSERVATION, not the identity of the store that was supposed to receive it — so a second counter\n   * for one site would fragment the alert without telling an operator anything the `observation`\n   * label does not already say.\n   *\n   * What it evidences is narrow and worth stating: whether a stored credential was ACCEPTED by the\n   * provider on last use. Losing it leaves a credential whose health is unknown, which surfaces later\n   * as an integration that fails with no record of when it started failing — which is exactly what\n   * this deployment had, for the whole life of the seam, while nothing was wired behind it.\n   */\n  PROVIDER_CREDENTIAL_USE = 'provider_credential_use',\n\n  /**\n   * `HTTP_API_READ_THROUGH_ACCESS`, from BOTH emitters — see the enum's naming principle above.\n   *\n   * - `HttpApiResourceRepositoryBackendService.recordReadThroughAccess` — one observation per remote\n   *   round-trip, and the only tier that witnesses every one of them (repository-direct probes never\n   *   reach the services tier at all).\n   * - `ExternalDataPipelineRunBackendService.recordRunReadThroughAccess` — one observation per ETL\n   *   run.\n   *\n   * The evidence at stake is ATTRIBUTION: an HTTP_API read reaches a third party through a SHARED\n   * service principal, so this row is what carries the real initiating user through it. Without it\n   * the external system's own logs show one principal and nothing anywhere resolves it to a person.\n   */\n  HTTP_API_READ_THROUGH_ACCESS = 'http_api_read_through_access',\n}\n\n/**\n * WHY the observation never reached the audit pipeline.\n *\n * Three members, and they are genuinely different diagnoses rather than shades of one — see the\n * table in this module's header. `SERVICE_UNAVAILABLE` is a WIRING fault and is usually total and\n * permanent for the life of the process; the other two are runtime faults and are usually partial.\n * Merging them would leave an operator unable to tell \"this deployment audits nothing\" from \"the\n * audit store hiccupped twice\".\n */\nexport enum AuditObservationLossReason {\n  /** The audit service is unbound, or the specific `log*` method is absent on the bound instance. */\n  SERVICE_UNAVAILABLE = 'service_unavailable',\n  /** The emitting call threw synchronously — before any `.catch()` could make it fire-and-forget. */\n  EMISSION_THREW = 'emission_threw',\n  /** The emitting call returned a promise that rejected. */\n  EMISSION_REJECTED = 'emission_rejected',\n}\n\n/**\n * How often ONE `(observation, reason)` pair may produce a log line.\n *\n * Fifteen minutes: long enough that a permanently broken binding costs four lines an hour rather\n * than one per request, short enough that a NEW outage hours after an earlier one still announces\n * itself instead of being swallowed by a latch that never resets. A permanent latch was rejected for\n * exactly that reason — it makes the second incident invisible.\n */\nexport const LOSS_LOG_INTERVAL_MS = 15 * 60 * 1000;\n\n/** The narrow slice of {@link MetricsService} this seam needs. Structural, so a double is trivial. */\nexport interface AuditObservationLossMetricsRecorder {\n  recordAuditObservationDropped(params: { observation: string; reason: string }): void;\n}\n\n/**\n * A LAZY door to the recorder, for a site that does not hold one.\n *\n * Most emitters here are plain classes built with `new` (repository adapters, the provider executor)\n * or reach the container only through thunks their builder closes over. Each could resolve the\n * recorder itself — and each would then need its own `try`/`catch`, because a container resolving a\n * binding may throw and an observability failure must never reach the request. Five copies of that\n * guard is precisely the shape `.claude/rules/invariant-call-site-enumeration.md` says will be\n * applied at four of them, so the seam takes the thunk and does the wrapping once.\n *\n * Resolution happens ONLY when there is a loss to record. A site on the happy path never touches its\n * container, which is what makes handing this in unconditionally cheap.\n */\nexport type AuditObservationLossMetricsResolver = () => AuditObservationLossMetricsRecorder | undefined;\n\n/** The narrow slice of the logger this seam needs. Optional everywhere — see {@link emitAuditObservation}. */\nexport interface AuditObservationLossLogger {\n  error?: (message: string, context?: Record<string, unknown>) => void;\n}\n\n/** Process-local totals, keyed `<observation>:<reason>`. Not evidence — see the module header. */\nconst lossTotals = new Map<string, number>();\n/** Last log timestamp per `<observation>:<reason>`. Bounded by the enum cross-product (9 entries). */\nconst lastLoggedAt = new Map<string, number>();\n\n/**\n * Every loss recorded since this process started, as `<observation>:<reason>` → count.\n *\n * A COPY, so a caller cannot mutate the accumulator. Exists so the counting can be pinned without an\n * OTLP backend, and so a future health surface has a door that does not require one either. Read the\n * module header before treating the numbers as durable evidence: they are not.\n */\nexport function readAuditObservationLossTotals(): Record<string, number> {\n  return Object.fromEntries(lossTotals);\n}\n\n/** Test isolation only. Never called from production code. */\nexport function resetAuditObservationLossTotals(): void {\n  lossTotals.clear();\n  lastLoggedAt.clear();\n}\n\n/**\n * Record one lost observation. Never throws, under any circumstance.\n *\n * Exported so a site whose emission does not fit {@link emitAuditObservation}'s shape can still\n * contribute to the same counter rather than inventing a second one. Prefer the seam.\n */\nexport function recordAuditObservationLoss(params: {\n  observation: AuditObservationKind;\n  reason: AuditObservationLossReason;\n  /** The recorder itself, when the site already holds one (a container-injected service). */\n  metricsService?: AuditObservationLossMetricsRecorder;\n  /**\n   * A thunk to the recorder, when the site does not. Consulted only if `metricsService` is absent,\n   * and only on a loss — see {@link AuditObservationLossMetricsResolver}. Two fields rather than one\n   * union: a caller reading `metricsService: X | (() => X)` has to work out which one it holds, and\n   * the answer is a property of the CLASS, so it is better spelled at the field.\n   */\n  metricsResolver?: AuditObservationLossMetricsResolver;\n  logger?: AuditObservationLossLogger;\n  error?: unknown;\n  context?: Record<string, unknown>;\n}): void {\n  // The recorder is the LAST thing that may fail the request it observes: a metric backend that\n  // throws, or a logger that throws, would defeat the entire purpose of the fire-and-forget contract\n  // this seam exists to preserve. Everything below is inside one boundary for that reason.\n  try {\n    const key = `${params.observation}:${params.reason}`;\n    lossTotals.set(key, (lossTotals.get(key) ?? 0) + 1);\n\n    // Metrics FIRST. It is the durable, rate-carrying channel, and it must be incremented even for\n    // the drops the throttle below decides not to log — otherwise the throttle would silently\n    // suppress the count as well as the line, which is the defect one layer up.\n    //\n    // Feature-DETECTED rather than optional-chained on the object, and for the reason this whole\n    // module exists: a container that answers every symbol with a stub (the shape several partial\n    // test containers in this package genuinely have) yields a truthy `metricsService` whose method\n    // is absent, so `?.` on the OBJECT still calls `undefined(...)` and throws. The outer catch\n    // would contain it, but a swallowed TypeError looks exactly like a swallowed real defect — and\n    // it would take the log line down with it, leaving the loss silent again.\n    const metricsService = params.metricsService ?? resolveLossMetricsRecorder(params.metricsResolver);\n    if (typeof metricsService?.recordAuditObservationDropped === 'function') {\n      metricsService.recordAuditObservationDropped({\n        observation: params.observation,\n        reason: params.reason,\n      });\n    }\n\n    const now = Date.now();\n    const previous = lastLoggedAt.get(key);\n    if (previous !== undefined && now - previous < LOSS_LOG_INTERVAL_MS) return;\n    lastLoggedAt.set(key, now);\n\n    params.logger?.error?.('A security audit observation was DROPPED before it reached the audit pipeline', {\n      // `reason` is the slug an alert rule and a log query both key on; keep it first and stable.\n      reason: 'audit_observation_dropped',\n      observation: params.observation,\n      lossReason: params.reason,\n      // The running total makes ONE throttled line carry the volume the suppressed lines would have.\n      occurrencesSinceProcessStart: lossTotals.get(key),\n      logIntervalMs: LOSS_LOG_INTERVAL_MS,\n      ...(params.error === undefined ? {} : { error: describeLossError(params.error) }),\n      ...(params.context ?? {}),\n    });\n  } catch {\n    /* An observability failure must never be able to fail the request it observes. */\n  }\n}\n\n/**\n * Emit one fire-and-forget audit observation, counting it if it is lost.\n *\n * ## The contract, which is the whole point\n *\n * **This function never throws and never returns a promise.** Not on an absent service, not on a\n * synchronous throw, not on a rejection, and not on a metrics or logger failure. Callers rely on it\n * to preserve the property their own JSDoc promises: the observation cannot fail the request.\n *\n * @param params.emit The emitting call, or `undefined` when the audit service or its method is\n *   absent. Passing `undefined` is how a site reports {@link AuditObservationLossReason.SERVICE_UNAVAILABLE}\n *   — the feature detection stays at the site because the method name differs per observation, and a\n *   generic reflective lookup here would trade a compile-time error for a runtime one.\n */\nexport function emitAuditObservation(params: {\n  observation: AuditObservationKind;\n  emit: (() => unknown) | undefined;\n  metricsService?: AuditObservationLossMetricsRecorder;\n  /** See {@link recordAuditObservationLoss}. Never called unless there IS a loss. */\n  metricsResolver?: AuditObservationLossMetricsResolver;\n  logger?: AuditObservationLossLogger;\n  context?: Record<string, unknown>;\n}): void {\n  const loss = (reason: AuditObservationLossReason, error?: unknown): void =>\n    recordAuditObservationLoss({\n      observation: params.observation,\n      reason,\n      metricsService: params.metricsService,\n      metricsResolver: params.metricsResolver,\n      logger: params.logger,\n      error,\n      context: params.context,\n    });\n\n  try {\n    if (!params.emit) {\n      loss(AuditObservationLossReason.SERVICE_UNAVAILABLE);\n      return;\n    }\n\n    let result: unknown;\n    try {\n      result = params.emit();\n    } catch (error) {\n      // A `log*` method that is absent on a partially-mocked double throws a TypeError HERE —\n      // synchronously, before any `.catch()` could attach. That is the shape the feature detection at\n      // each site exists to pre-empt; this catch is what keeps a site that forgets it from crashing.\n      loss(AuditObservationLossReason.EMISSION_THREW, error);\n      return;\n    }\n\n    // Optional-chained, because an audit method is free to be synchronous (and every test double\n    // returning `undefined` is). A non-thenable result is a successful emission, not a loss.\n    const thenable = result as { catch?: (handler: (error: unknown) => void) => unknown } | null | undefined;\n    if (typeof thenable?.catch !== 'function') return;\n    thenable.catch((error) => loss(AuditObservationLossReason.EMISSION_REJECTED, error));\n  } catch {\n    /* Belt and braces: nothing in this seam may reach the caller. */\n  }\n}\n\n/**\n * Ask a site's thunk for the recorder, and treat any refusal as \"no recorder\".\n *\n * Its own `try`, INSIDE the caller's: a container that throws while resolving a binding must not be\n * able to take the LOG channel down with it. Degrading a loss to its log-only form is the correct\n * direction — the whole point of this module is that an observability gap is never a reason to\n * refuse — whereas letting the throw escape to the outer `catch` would silence both channels for the\n * one event that most needs saying.\n */\nfunction resolveLossMetricsRecorder(\n  resolver: AuditObservationLossMetricsResolver | undefined,\n): AuditObservationLossMetricsRecorder | undefined {\n  if (typeof resolver !== 'function') return undefined;\n  try {\n    return resolver();\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * A log-safe description of whatever was thrown.\n *\n * Deliberately local rather than routed through `describeCaughtError`: this module sits UNDER the\n * error subsystem in the dependency order (the error builder's own failures are observations this\n * seam records), and importing upward would make an observability module depend on the layer it\n * observes. The shape is a strict subset of what `describeCaughtError` produces, so a log query\n * reading `error.message` works against both.\n */\nfunction describeLossError(error: unknown): { message: string; name?: string } {\n  if (error instanceof Error) return { message: error.message, name: error.name };\n  return { message: typeof error === 'string' ? error : String(error) };\n}\n"]}

package/dist/esm/monitoring/observability/models/observability.backend.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"observability.backend.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/monitoring/observability/models/observability.backend.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,iBAAiB;IAGhC,0BAA0B,EAAE,GAAG,CAAC;IAChC,4BAA4B,EAAE,GAAG,CAAC;IAClC,6BAA6B,EAAE,GAAG,CAAC;IACnC,mBAAmB,EAAE,GAAG,CAAC;IACzB,iCAAiC,EAAE,GAAG,CAAC;IAMvC,uBAAuB,EAAE,GAAG,CAAC;IAS7B,qBAAqB,EAAE,GAAG,CAAC;IAU3B,wBAAwB,EAAE,GAAG,CAAC;IAU9B,oCAAoC,EAAE,GAAG,CAAC;IAU1C,sBAAsB,EAAE,GAAG,CAAC;IAW5B,4BAA4B,EAAE,GAAG,CAAC;CACnC"}
+{"version":3,"file":"observability.backend.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/monitoring/observability/models/observability.backend.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,iBAAiB;IAGhC,0BAA0B,EAAE,GAAG,CAAC;IAChC,4BAA4B,EAAE,GAAG,CAAC;IAClC,6BAA6B,EAAE,GAAG,CAAC;IACnC,mBAAmB,EAAE,GAAG,CAAC;IACzB,iCAAiC,EAAE,GAAG,CAAC;IAMvC,uBAAuB,EAAE,GAAG,CAAC;IAS7B,qBAAqB,EAAE,GAAG,CAAC;IAU3B,wBAAwB,EAAE,GAAG,CAAC;IAU9B,oCAAoC,EAAE,GAAG,CAAC;IAU1C,sBAAsB,EAAE,GAAG,CAAC;IAW5B,4BAA4B,EAAE,GAAG,CAAC;CACnC"}

package/dist/esm/monitoring/observability/models/observability.backend.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"observability.backend.schemas.js","sourceRoot":"","sources":["../../../../../../src/monitoring/observability/models/observability.backend.schemas.ts"],"names":[],"mappings":"","sourcesContent":["/**\n * Observability metric definitions consumed by `metrics.service.ts`.\n *\n * Only the metrics with LIVE producers remain: the data-seeding counters\n * (fired by the data-seed dispatcher engines + shared ledger writers) and the\n * M2M outbound-webhook counter (fired by the delivery batch worker). The former\n * HTTP / DB / auth / cache / session / quota / websocket / error definitions\n * were removed in Slice 2 Phase 3 along with the dead, never-registered\n * observability middleware that was their only caller: HTTP traces +\n * `http.server.duration` metrics now come from the OTLP preload's\n * auto-instrumentation (bounded, semconv attributes) rather than a hand-rolled\n * middleware that tagged every series with unbounded `organization_id` /\n * `user_id` labels (edge case E13).\n *\n * History: the self-hosted Jaeger/Prometheus `TelemetryService`,\n * `ObservabilityConfig`, and `TelemetryProviders` were deleted in Phase 1;\n * the Prometheus-era middleware + the dead `TracerService` in Phase 3.\n */\nexport interface MetricDefinitions {\n  // Data Seeding (Phase 6.D / F-17 — Prom-style operator metrics).\n  // See `metrics.service.ts` for descriptions.\n  dataSeedingLazyC1CacheHits: any;\n  dataSeedingLazyC1CacheMisses: any;\n  dataSeedingThunderHerdBowouts: any;\n  dataSeedingRunTotal: any;\n  dataSeedingAdminListSeedsDuration: any;\n\n  // M2M Outbound Webhook Delivery (Phase 5 / Step 17 — Prom-style\n  // operator metrics). Single counter covering every worker outcome\n  // at terminal or intermediate return; see `metrics.service.ts`\n  // (`recordM2MWebhookDeliveryOutcome`) for labels + semantics.\n  m2mWebhookDeliveryTotal: any;\n\n  // Compliance Audit-Log Sink failures (Phase 5 / F6 — Prom-style operator\n  // metric). One counter incremented whenever a Layer-2 provider audit sink\n  // throws while recording an event; the composite (`CompositeAuditLogSink`)\n  // isolates the failure so the business op is unaffected, but this makes the\n  // otherwise-swallowed failure OBSERVABLE. Labelled by `provider` (the provider\n  // ref — immudb, a SIEM, …); bounded, low cardinality. See `metrics.service.ts`\n  // (`recordAuditSinkFailure`).\n  auditSinkFailureTotal: any;\n\n  // Compliance Audit-Log TAMPER detections (Prom-style operator metric). One\n  // counter incremented when a tamper-evident audit provider (immudb) PROVES its\n  // store was rolled back / tampered between restarts (a durable-state consistency\n  // proof failure). DISTINCT from `auditSinkFailureTotal` on purpose: a transient\n  // write miss is backfilled by the reconciler, whereas a proven rollback of the\n  // audit ledger is a compliance incident that must page a human. Labelled by\n  // `provider`; bounded, low cardinality. See `metrics.service.ts`\n  // (`recordAuditTamperDetected`).\n  auditTamperDetectedTotal: any;\n\n  // Compliance Audit-Log assurance DEGRADATIONS. Incremented when a tamper-evident\n  // audit provider drops from full cross-restart tamper-evidence to a weaker level\n  // (ephemeral mode / corrupt anchor / un-pinned identity change / per-op proof\n  // failure). DISTINCT from a PROVEN tamper (`auditTamperDetectedTotal` → page) and a\n  // write hiccup (`auditSinkFailureTotal`): a degradation means a FUTURE tamper may go\n  // undetected, so it is alertable but non-latching. Labelled by `provider` + `reason`\n  // (a small fixed slug set). See `metrics.service.ts`\n  // (`recordAuditIntegrityAssuranceDegraded`).\n  auditIntegrityAssuranceDegradedTotal: any;\n\n  // Compliance Audit-Log LAYER-1 (authoritative DB store) write failures (A-12). One counter\n  // incremented when `AuditLogsBackendService._createAuditLog` throws while persisting the authoritative\n  // audit row. DISTINCT from `auditSinkFailureTotal` (a Layer-2 provider-sink hiccup the reconciler\n  // backfills): a Layer-1 failure means the PRIMARY audit record itself was not persisted — the most\n  // severe \"we think we're auditing but we aren't\" state, otherwise invisible on the fire-and-forget\n  // path. Label-free (the authoritative store has no provider dimension); bounded, single series. See\n  // `metrics.service.ts` (`recordAuditStoreFailure`); the alert rule is specified in\n  // `.claude/plans/alerting-system-design-analysis.md` Appendix D.\n  auditStoreFailureTotal: any;\n\n  // Security audit observations DROPPED before the audit pipeline ever saw them. Incremented by the\n  // shared fire-and-forget seam (`audit-observation-emission.backend.ts`) whenever an observation is\n  // lost because the audit service is unbound / its `log*` method is absent, the call threw\n  // synchronously, or the returned promise rejected. DISTINCT from `auditStoreFailureTotal`, which\n  // counts the Layer-1 STORE refusing a write it did receive: this counts the emission never getting\n  // that far, which is the shape no existing control could see. Without it a period with no recorded\n  // operator crossings is indistinguishable from a period with a broken sink. Labelled by\n  // `observation` (which security event was lost) × `reason` (which of the three loss shapes);\n  // bounded — 3 × 3 series today. See `metrics.service.ts` (`recordAuditObservationDropped`).\n  auditObservationDroppedTotal: any;\n}\n"]}
+{"version":3,"file":"observability.backend.schemas.js","sourceRoot":"","sources":["../../../../../src/monitoring/observability/models/observability.backend.schemas.ts"],"names":[],"mappings":"","sourcesContent":["/**\n * Observability metric definitions consumed by `metrics.service.ts`.\n *\n * Only the metrics with LIVE producers remain: the data-seeding counters\n * (fired by the data-seed dispatcher engines + shared ledger writers) and the\n * M2M outbound-webhook counter (fired by the delivery batch worker). The former\n * HTTP / DB / auth / cache / session / quota / websocket / error definitions\n * were removed in Slice 2 Phase 3 along with the dead, never-registered\n * observability middleware that was their only caller: HTTP traces +\n * `http.server.duration` metrics now come from the OTLP preload's\n * auto-instrumentation (bounded, semconv attributes) rather than a hand-rolled\n * middleware that tagged every series with unbounded `organization_id` /\n * `user_id` labels (edge case E13).\n *\n * History: the self-hosted Jaeger/Prometheus `TelemetryService`,\n * `ObservabilityConfig`, and `TelemetryProviders` were deleted in Phase 1;\n * the Prometheus-era middleware + the dead `TracerService` in Phase 3.\n */\nexport interface MetricDefinitions {\n  // Data Seeding (Phase 6.D / F-17 — Prom-style operator metrics).\n  // See `metrics.service.ts` for descriptions.\n  dataSeedingLazyC1CacheHits: any;\n  dataSeedingLazyC1CacheMisses: any;\n  dataSeedingThunderHerdBowouts: any;\n  dataSeedingRunTotal: any;\n  dataSeedingAdminListSeedsDuration: any;\n\n  // M2M Outbound Webhook Delivery (Phase 5 / Step 17 — Prom-style\n  // operator metrics). Single counter covering every worker outcome\n  // at terminal or intermediate return; see `metrics.service.ts`\n  // (`recordM2MWebhookDeliveryOutcome`) for labels + semantics.\n  m2mWebhookDeliveryTotal: any;\n\n  // Compliance Audit-Log Sink failures (Phase 5 / F6 — Prom-style operator\n  // metric). One counter incremented whenever a Layer-2 provider audit sink\n  // throws while recording an event; the composite (`CompositeAuditLogSink`)\n  // isolates the failure so the business op is unaffected, but this makes the\n  // otherwise-swallowed failure OBSERVABLE. Labelled by `provider` (the provider\n  // ref — immudb, a SIEM, …); bounded, low cardinality. See `metrics.service.ts`\n  // (`recordAuditSinkFailure`).\n  auditSinkFailureTotal: any;\n\n  // Compliance Audit-Log TAMPER detections (Prom-style operator metric). One\n  // counter incremented when a tamper-evident audit provider (immudb) PROVES its\n  // store was rolled back / tampered between restarts (a durable-state consistency\n  // proof failure). DISTINCT from `auditSinkFailureTotal` on purpose: a transient\n  // write miss is backfilled by the reconciler, whereas a proven rollback of the\n  // audit ledger is a compliance incident that must page a human. Labelled by\n  // `provider`; bounded, low cardinality. See `metrics.service.ts`\n  // (`recordAuditTamperDetected`).\n  auditTamperDetectedTotal: any;\n\n  // Compliance Audit-Log assurance DEGRADATIONS. Incremented when a tamper-evident\n  // audit provider drops from full cross-restart tamper-evidence to a weaker level\n  // (ephemeral mode / corrupt anchor / un-pinned identity change / per-op proof\n  // failure). DISTINCT from a PROVEN tamper (`auditTamperDetectedTotal` → page) and a\n  // write hiccup (`auditSinkFailureTotal`): a degradation means a FUTURE tamper may go\n  // undetected, so it is alertable but non-latching. Labelled by `provider` + `reason`\n  // (a small fixed slug set). See `metrics.service.ts`\n  // (`recordAuditIntegrityAssuranceDegraded`).\n  auditIntegrityAssuranceDegradedTotal: any;\n\n  // Compliance Audit-Log LAYER-1 (authoritative DB store) write failures (A-12). One counter\n  // incremented when `AuditLogsBackendService._createAuditLog` throws while persisting the authoritative\n  // audit row. DISTINCT from `auditSinkFailureTotal` (a Layer-2 provider-sink hiccup the reconciler\n  // backfills): a Layer-1 failure means the PRIMARY audit record itself was not persisted — the most\n  // severe \"we think we're auditing but we aren't\" state, otherwise invisible on the fire-and-forget\n  // path. Label-free (the authoritative store has no provider dimension); bounded, single series. See\n  // `metrics.service.ts` (`recordAuditStoreFailure`); the alert rule is specified in\n  // `.claude/plans/alerting-system-design-analysis.md` Appendix D.\n  auditStoreFailureTotal: any;\n\n  // Security audit observations DROPPED before the audit pipeline ever saw them. Incremented by the\n  // shared fire-and-forget seam (`audit-observation-emission.backend.ts`) whenever an observation is\n  // lost because the audit service is unbound / its `log*` method is absent, the call threw\n  // synchronously, or the returned promise rejected. DISTINCT from `auditStoreFailureTotal`, which\n  // counts the Layer-1 STORE refusing a write it did receive: this counts the emission never getting\n  // that far, which is the shape no existing control could see. Without it a period with no recorded\n  // operator crossings is indistinguishable from a period with a broken sink. Labelled by\n  // `observation` (which security event was lost) × `reason` (which of the three loss shapes);\n  // bounded — 3 × 3 series today. See `metrics.service.ts` (`recordAuditObservationDropped`).\n  auditObservationDroppedTotal: any;\n}\n"]}

package/dist/esm/monitoring/observability/otel-preload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"otel-preload.d.ts","sourceRoot":"","sources":["../../../../../src/monitoring/observability/otel-preload.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,OAAO,eAAe,CAAC"}
+{"version":3,"file":"otel-preload.d.ts","sourceRoot":"","sources":["../../../../src/monitoring/observability/otel-preload.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,OAAO,eAAe,CAAC"}

package/dist/esm/monitoring/observability/otel-sdk-global-handle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"otel-sdk-global-handle.d.ts","sourceRoot":"","sources":["../../../../../src/monitoring/observability/otel-sdk-global-handle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,qFAAqF;AACrF,MAAM,WAAW,aAAa;IAC5B,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAID,4EAA4E;AAC5E,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,aAAa,GAAG,IAAI,CAEzD;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,IAAI,aAAa,GAAG,SAAS,CAI5D;AAED,+DAA+D;AAC/D,wBAAgB,kBAAkB,IAAI,IAAI,CAEzC"}
+{"version":3,"file":"otel-sdk-global-handle.d.ts","sourceRoot":"","sources":["../../../../src/monitoring/observability/otel-sdk-global-handle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,qFAAqF;AACrF,MAAM,WAAW,aAAa;IAC5B,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAID,4EAA4E;AAC5E,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,aAAa,GAAG,IAAI,CAEzD;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,IAAI,aAAa,GAAG,SAAS,CAI5D;AAED,+DAA+D;AAC/D,wBAAgB,kBAAkB,IAAI,IAAI,CAEzC"}

package/dist/esm/monitoring/observability/services/__tests__/mock-metrics.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mock-metrics.service.d.ts","sourceRoot":"","sources":["../../../../../../../src/monitoring/observability/services/__tests__/mock-metrics.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,kBAAkB,CAAC;AAI1B,qBACa,kBAAkB;IAM7B,6BAA6B;iBACN,MAAM;mBAAa,MAAM;cAC9C;IACF,8BAA8B;iBACP,MAAM;mBAAa,MAAM;cAC9C;IACF,kCAAkC;iBAErB,MAAM;mBACJ,MAAM;gBACT,sBAAsB,GAAG,oBAAoB;cAEvD;IACF,oBAAoB;iBAEP,MAAM;cACT,MAAM;gBACJ,MAAM;uBACC,MAAM;mBAKV,MAAM;cAEnB;IAEF,uCAAuC;oBACb,MAAM;mBAAa,MAAM;cACjD;IAEF;;;;OAIG;IACH,KAAK;CAON"}
+{"version":3,"file":"mock-metrics.service.d.ts","sourceRoot":"","sources":["../../../../../../src/monitoring/observability/services/__tests__/mock-metrics.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,kBAAkB,CAAC;AAI1B,qBACa,kBAAkB;IAM7B,6BAA6B;iBACN,MAAM;mBAAa,MAAM;cAC9C;IACF,8BAA8B;iBACP,MAAM;mBAAa,MAAM;cAC9C;IACF,kCAAkC;iBAErB,MAAM;mBACJ,MAAM;gBACT,sBAAsB,GAAG,oBAAoB;cAEvD;IACF,oBAAoB;iBAEP,MAAM;cACT,MAAM;gBACJ,MAAM;uBACC,MAAM;mBAKV,MAAM;cAEnB;IAEF,uCAAuC;oBACb,MAAM;mBAAa,MAAM;cACjD;IAEF;;;;OAIG;IACH,KAAK;CAON"}

package/dist/esm/monitoring/observability/services/metrics.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"metrics.service.d.ts","sourceRoot":"","sources":["../../../../../../src/monitoring/observability/services/metrics.service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAG3D;;;;;;;;;;GAUG;AACH,qBACa,cAAc;IACzB,OAAO,CAAC,KAAK,CAAQ;IACrB,OAAO,CAAC,kBAAkB,CAAoB;;IAO9C,OAAO,CAAC,iBAAiB;IAsIzB;;;;OAIG;IACI,6BAA6B,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAO1F;;;;OAIG;IACI,8BAA8B,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAO3F;;;;;;;;OAQG;IACI,kCAAkC,CAAC,MAAM,EAAE;QAChD,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,sBAAsB,GAAG,oBAAoB,CAAC;KACvD,GAAG,IAAI;IAQR;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACI,oBAAoB,CAAC,MAAM,EAAE;QAClC,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,aAAa,EAAE,MAAM,CAAC;QACtB,SAAS,EAAE,MAAM,CAAC;KACnB,GAAG,IAAI;IAUR;;;;;;;;;;;;;;;OAeG;IACI,uCAAuC,CAAC,MAAM,EAAE;QACrD,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC;KACnB,GAAG,IAAI;IAmCR;;;;;;;;;;;;;;OAcG;IACI,+BAA+B,CAAC,MAAM,EAAE;QAC7C,KAAK,EAAE,aAAa,CAAC;QACrB,OAAO,EACH,WAAW,GACX,iBAAiB,GACjB,iBAAiB,GACjB,qBAAqB,GACrB,wBAAwB,CAAC;KAC9B,GAAG,IAAI;IAWR;;;;;;;;OAQG;IACI,sBAAsB,CAAC,MAAM,EAAE;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAMpE;;;;;;;;;OASG;IACI,yBAAyB,CAAC,MAAM,EAAE;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAMvE;;;;;;;;;;OAUG;IACI,qCAAqC,CAAC,MAAM,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAOnG;;;;;;;;OAQG;IACI,uBAAuB,IAAI,IAAI;IAItC;;;;;;;;;;;;;;;;OAgBG;IACI,6BAA6B,CAAC,MAAM,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;CAM5F"}
+{"version":3,"file":"metrics.service.d.ts","sourceRoot":"","sources":["../../../../../src/monitoring/observability/services/metrics.service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAG3D;;;;;;;;;;GAUG;AACH,qBACa,cAAc;IACzB,OAAO,CAAC,KAAK,CAAQ;IACrB,OAAO,CAAC,kBAAkB,CAAoB;;IAO9C,OAAO,CAAC,iBAAiB;IAsIzB;;;;OAIG;IACI,6BAA6B,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAO1F;;;;OAIG;IACI,8BAA8B,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAO3F;;;;;;;;OAQG;IACI,kCAAkC,CAAC,MAAM,EAAE;QAChD,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,sBAAsB,GAAG,oBAAoB,CAAC;KACvD,GAAG,IAAI;IAQR;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACI,oBAAoB,CAAC,MAAM,EAAE;QAClC,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,aAAa,EAAE,MAAM,CAAC;QACtB,SAAS,EAAE,MAAM,CAAC;KACnB,GAAG,IAAI;IAUR;;;;;;;;;;;;;;;OAeG;IACI,uCAAuC,CAAC,MAAM,EAAE;QACrD,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC;KACnB,GAAG,IAAI;IAmCR;;;;;;;;;;;;;;OAcG;IACI,+BAA+B,CAAC,MAAM,EAAE;QAC7C,KAAK,EAAE,aAAa,CAAC;QACrB,OAAO,EACH,WAAW,GACX,iBAAiB,GACjB,iBAAiB,GACjB,qBAAqB,GACrB,wBAAwB,CAAC;KAC9B,GAAG,IAAI;IAWR;;;;;;;;OAQG;IACI,sBAAsB,CAAC,MAAM,EAAE;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAMpE;;;;;;;;;OASG;IACI,yBAAyB,CAAC,MAAM,EAAE;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAMvE;;;;;;;;;;OAUG;IACI,qCAAqC,CAAC,MAAM,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAOnG;;;;;;;;OAQG;IACI,uBAAuB,IAAI,IAAI;IAItC;;;;;;;;;;;;;;;;OAgBG;IACI,6BAA6B,CAAC,MAAM,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;CAM5F"}

package/dist/esm/monitoring/observability/services/metrics.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"metrics.service.js","sourceRoot":"","sources":["../../../../../../src/monitoring/observability/services/metrics.service.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,OAAO,EAAS,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAIvC;;;;;;;;;;GAUG;AAEI,IAAM,cAAc,GAApB,MAAM,cAAc;IACjB,KAAK,CAAQ;IACb,kBAAkB,CAAoB;IAE9C;QACE,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC;QAC7D,IAAI,CAAC,iBAAiB,EAAE,CAAC;IAC3B,CAAC;IAEO,iBAAiB;QACvB,IAAI,CAAC,kBAAkB,GAAG;YACxB,wEAAwE;YACxE,gEAAgE;YAChE,wEAAwE;YACxE,gEAAgE;YAChE,mEAAmE;YACnE,sCAAsC;YACtC,gEAAgE;YAChE,kEAAkE;YAClE,2CAA2C;YAC3C,sEAAsE;YACtE,gEAAgE;YAChE,mEAAmE;YACnE,gDAAgD;YAChD,sEAAsE;YACtE,qEAAqE;YACrE,mEAAmE;YACnE,oCAAoC;YACpC,0BAA0B,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,uCAAuC,EAAE;gBAC5F,WAAW,EAAE,yGAAyG;aACvH,CAAC;YAEF,4BAA4B,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,yCAAyC,EAAE;gBAChG,WAAW,EAAE,2FAA2F;aACzG,CAAC;YAEF,6BAA6B,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,yCAAyC,EAAE;gBACjG,WAAW,EAAE,6GAA6G;aAC3H,CAAC;YAEF,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,wBAAwB,EAAE;gBACtE,WAAW,EAAE,gGAAgG;aAC9G,CAAC;YAEF,iCAAiC,EAAE,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,2CAA2C,EAAE;gBACzG,WAAW,EAAE,oGAAoG;aAClH,CAAC;YAEF,6DAA6D;YAC7D,4DAA4D;YAC5D,4EAA4E;YAC5E,6DAA6D;YAC7D,8DAA8D;YAC9D,6CAA6C;YAC7C,8DAA8D;YAC9D,6CAA6C;YAC7C,2DAA2D;YAC3D,uBAAuB,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,4BAA4B,EAAE;gBAC9E,WAAW,EAAE,qFAAqF;aACnG,CAAC;YAEF,6DAA6D;YAC7D,oEAAoE;YACpE,2EAA2E;YAC3E,uEAAuE;YACvE,yEAAyE;YACzE,iCAAiC;YACjC,2CAA2C;YAC3C,2EAA2E;YAC3E,qBAAqB,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,0BAA0B,EAAE;gBAC1E,WAAW,EAAE,uFAAuF;aACrG,CAAC;YAEF,kDAAkD;YAClD,yEAAyE;YACzE,6EAA6E;YAC7E,0EAA0E;YAC1E,2EAA2E;YAC3E,0EAA0E;YAC1E,UAAU;YACV,kDAAkD;YAClD,yDAAyD;YACzD,wBAAwB,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,6BAA6B,EAAE;gBAChF,WAAW,EAAE,kGAAkG;aAChH,CAAC;YAEF,uDAAuD;YACvD,8FAA8F;YAC9F,kGAAkG;YAClG,iGAAiG;YACjG,kGAAkG;YAClG,qGAAqG;YACrG,qBAAqB;YACrB,mFAAmF;YACnF,uFAAuF;YACvF,oCAAoC,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,0CAA0C,EAAE;gBACzG,WAAW,EACT,mHAAmH;aACtH,CAAC;YAEF,gFAAgF;YAChF,+FAA+F;YAC/F,2FAA2F;YAC3F,+FAA+F;YAC/F,+FAA+F;YAC/F,+FAA+F;YAC/F,4FAA4F;YAC5F,qBAAqB;YACrB,4CAA4C;YAC5C,8FAA8F;YAC9F,4FAA4F;YAC5F,sBAAsB,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,2BAA2B,EAAE;gBAC5E,WAAW,EAAE,4GAA4G;aAC1H,CAAC;YAEF,4EAA4E;YAC5E,wFAAwF;YACxF,+FAA+F;YAC/F,4FAA4F;YAC5F,2FAA2F;YAC3F,4FAA4F;YAC5F,0FAA0F;YAC1F,8FAA8F;YAC9F,4FAA4F;YAC5F,yEAAyE;YACzE,uDAAuD;YACvD,4FAA4F;YAC5F,4BAA4B,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,iCAAiC,EAAE;gBACxF,WAAW,EACT,mIAAmI;aACtI,CAAC;SACH,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,0CAA0C;IAC1C,8EAA8E;IAC9E,yEAAyE;IACzE,uEAAuE;IACvE,kEAAkE;IAClE,sDAAsD;IACtD,8EAA8E;IAE9E;;;;OAIG;IACI,6BAA6B,CAAC,MAA8C;QACjF,IAAI,CAAC,kBAAkB,CAAC,0BAA0B,CAAC,GAAG,CAAC,CAAC,EAAE;YACxD,QAAQ,EAAE,MAAM,CAAC,OAAO;YACxB,UAAU,EAAE,MAAM,CAAC,SAAS;SAC7B,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACI,8BAA8B,CAAC,MAA8C;QAClF,IAAI,CAAC,kBAAkB,CAAC,4BAA4B,CAAC,GAAG,CAAC,CAAC,EAAE;YAC1D,QAAQ,EAAE,MAAM,CAAC,OAAO;YACxB,UAAU,EAAE,MAAM,CAAC,SAAS;SAC7B,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACI,kCAAkC,CAAC,MAIzC;QACC,IAAI,CAAC,kBAAkB,CAAC,6BAA6B,CAAC,GAAG,CAAC,CAAC,EAAE;YAC3D,QAAQ,EAAE,MAAM,CAAC,OAAO;YACxB,UAAU,EAAE,MAAM,CAAC,SAAS;YAC5B,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACI,oBAAoB,CAAC,MAM3B;QACC,IAAI,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,EAAE;YACjD,QAAQ,EAAE,MAAM,CAAC,OAAO;YACxB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,cAAc,EAAE,MAAM,CAAC,aAAa;YACpC,UAAU,EAAE,MAAM,CAAC,SAAS;SAC7B,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACI,uCAAuC,CAAC,MAG9C;QACC,MAAM,MAAM,GAAG,CAAC,GAAG,EAAE;YACnB,IAAI,MAAM,CAAC,SAAS,IAAI,CAAC;gBAAE,OAAO,GAAG,CAAC;YACtC,IAAI,MAAM,CAAC,SAAS,IAAI,EAAE;gBAAE,OAAO,MAAM,CAAC;YAC1C,IAAI,MAAM,CAAC,SAAS,IAAI,EAAE;gBAAE,OAAO,OAAO,CAAC;YAC3C,IAAI,MAAM,CAAC,SAAS,IAAI,GAAG;gBAAE,OAAO,QAAQ,CAAC;YAC7C,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC,EAAE,CAAC;QACL,IAAI,CAAC,kBAAkB,CAAC,iCAAiC,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE;YAClF,iBAAiB,EAAE,MAAM;SAC1B,CAAC,CAAC;IACL,CAAC;IAED,8EAA8E;IAC9E,4DAA4D;IAC5D,8EAA8E;IAC9E,0EAA0E;IAC1E,wEAAwE;IACxE,0EAA0E;IAC1E,2EAA2E;IAC3E,2EAA2E;IAC3E,8DAA8D;IAC9D,2CAA2C;IAC3C,EAAE;IACF,mBAAmB;IACnB,0EAA0E;IAC1E,iEAAiE;IACjE,uEAAuE;IACvE,wEAAwE;IACxE,gEAAgE;IAChE,kBAAkB;IAClB,EAAE;IACF,uEAAuE;IACvE,8EAA8E;IAE9E;;;;;;;;;;;;;;OAcG;IACI,+BAA+B,CAAC,MAQtC;QACC,IAAI,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,EAAE;YACrD,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC,CAAC;IACL,CAAC;IAED,8EAA8E;IAC9E,oDAAoD;IACpD,8EAA8E;IAE9E;;;;;;;;OAQG;IACI,sBAAsB,CAAC,MAA+B;QAC3D,IAAI,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,EAAE;YACnD,QAAQ,EAAE,MAAM,CAAC,WAAW;SAC7B,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;OASG;IACI,yBAAyB,CAAC,MAA+B;QAC9D,IAAI,CAAC,kBAAkB,CAAC,wBAAwB,CAAC,GAAG,CAAC,CAAC,EAAE;YACtD,QAAQ,EAAE,MAAM,CAAC,WAAW;SAC7B,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;OAUG;IACI,qCAAqC,CAAC,MAA+C;QAC1F,IAAI,CAAC,kBAAkB,CAAC,oCAAoC,CAAC,GAAG,CAAC,CAAC,EAAE;YAClE,QAAQ,EAAE,MAAM,CAAC,WAAW;YAC5B,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACI,uBAAuB;QAC5B,IAAI,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACxD,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACI,6BAA6B,CAAC,MAA+C;QAClF,IAAI,CAAC,kBAAkB,CAAC,4BAA4B,CAAC,GAAG,CAAC,CAAC,EAAE;YAC1D,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AAlZY,cAAc;IAD1B,UAAU,EAAE;;GACA,cAAc,CAkZ1B","sourcesContent":["import { metrics, Meter } from '@opentelemetry/api';\nimport { injectable } from 'inversify';\nimport type { AuthScopeType } from '@wildo-ai/saas-models';\nimport { MetricDefinitions } from '~wildo-backend-lib/monitoring/observability/models/observability.backend.schemas';\n\n/**\n * Records the operator-facing metrics that have LIVE producers — the\n * data-seeding counters (dispatcher engines + shared ledger writers) and the\n * M2M outbound-webhook counter (delivery batch worker). All instruments are\n * created on the global meter, which the OTLP preload (`otel-preload.ts`) wires\n * to the OTLP metric exporter; with no preload the global meter is a no-op, so\n * recording is silently inert (never throws). The former HTTP/DB/auth/etc.\n * `record*` helpers were removed in Slice 2 Phase 3 — their only caller was the\n * dead observability middleware, and HTTP metrics now come from the preload's\n * auto-instrumentation (bounded, semconv) instead of unbounded org/user labels.\n */\n@injectable()\nexport class MetricsService {\n  private meter: Meter;\n  private metricsDefinitions: MetricDefinitions;\n\n  constructor() {\n    this.meter = metrics.getMeter('wildo-saas-metrics', '1.0.0');\n    this.initializeMetrics();\n  }\n\n  private initializeMetrics(): void {\n    this.metricsDefinitions = {\n      // ---------------------------------------------------------------------\n      // Data Seeding (Phase 6.D / F-17 — Prom-style operator metrics)\n      // ---------------------------------------------------------------------\n      // The data-seeding dispatcher exposes four observable concerns:\n      //   - LAZY C1 cache hit-rate (first-access bootstrap short-circuit\n      //     effectiveness on the hot path),\n      //   - LAZY thunder-herd bow-outs (concurrent first-access races\n      //     resolved silently, distinguishing the \"winner already done\"\n      //     vs \"winner still running\" branches),\n      //   - DataSeedRun terminal totals (every COMPLETED / PARTIAL / FAILED\n      //     ledger transition, per seed × mode × trigger origin — the\n      //     metric covers ALL engines, current and future, because it is\n      //     fired from the shared lifecycle writers).\n      // Counter names follow the Prometheus convention `_total` suffix; the\n      // OpenTelemetry meter is the existing `wildo-saas-metrics` meter, so\n      // the counters export via the OTLP metric reader configured in the\n      // preload without any extra wiring.\n      dataSeedingLazyC1CacheHits: this.meter.createCounter('data_seeding_lazy_c1_cache_hits_total', {\n        description: 'LAZY engine C1 idempotency-probe cache hits (already-completed scope, skipped without entry resolution)',\n      }),\n\n      dataSeedingLazyC1CacheMisses: this.meter.createCounter('data_seeding_lazy_c1_cache_misses_total', {\n        description: 'LAZY engine C1 idempotency-probe cache misses (cold-start, run-slot acquisition proceeds)',\n      }),\n\n      dataSeedingThunderHerdBowouts: this.meter.createCounter('data_seeding_thunder_herd_bowouts_total', {\n        description: 'LAZY engine concurrent-first-access races where the slot acquisition lost and the caller bowed out silently',\n      }),\n\n      dataSeedingRunTotal: this.meter.createCounter('data_seeding_run_total', {\n        description: 'DataSeedRun terminal-state writes (COMPLETED / PARTIAL / FAILED) across all dispatcher engines',\n      }),\n\n      dataSeedingAdminListSeedsDuration: this.meter.createHistogram('data_seeding_admin_list_seeds_duration_ms', {\n        description: 'Wall-clock duration of GET /internal/admin/data-seeding/seeds (N+1 lastRun lookup) in milliseconds',\n      }),\n\n      // ─── M2M Outbound Webhook Delivery (Phase 5 / Step 17) ────\n      // One counter covering every worker `doHandle` return — the\n      // outcome enum maps 1:1 to the five `M2MWebhookDeliveryBatchOutput.outcome`\n      // values (`delivered`, `retry_scheduled`, `failed_terminal`,\n      // `skipped_missing_row`, `skipped_already_leased`). Operators\n      // answer \"is webhook delivery healthy?\" with\n      //   rate(m2m_webhook_delivery_total{outcome=\"delivered\"}[5m])\n      //     / rate(m2m_webhook_delivery_total[5m])\n      // Cardinality: 2 `scope` × 5 `outcome` = 10 active series.\n      m2mWebhookDeliveryTotal: this.meter.createCounter('m2m_webhook_delivery_total', {\n        description: 'M2M outbound webhook delivery terminal / intermediate outcomes (one per worker run)',\n      }),\n\n      // ─── Compliance Audit-Log Sink Failures (Phase 5 / F6) ────\n      // A Layer-2 provider audit sink threw while recording an event. The\n      // composite (`CompositeAuditLogSink`) isolates the failure so the business\n      // op is unaffected, but a silently-failing audit sink (\"we think we're\n      // auditing but we aren't\") must not go unnoticed — this counter makes it\n      // observable. Operators alert on\n      //   rate(audit_sink_failure_total[5m]) > 0\n      // Cardinality: one series per declared audit `provider` (immudb, SIEM, …).\n      auditSinkFailureTotal: this.meter.createCounter('audit_sink_failure_total', {\n        description: 'Compliance audit-log provider sink failures (one per sink throw during event fan-out)',\n      }),\n\n      // ─── Compliance Audit-Log TAMPER detections ────\n      // A tamper-evident audit provider (immudb) PROVED, via its cryptographic\n      // durable-state consistency proof, that its store was rolled back / tampered\n      // between restarts. DISTINCT from `audit_sink_failure_total`: a transient\n      // write miss is backfilled by the reconciler and needs no human, whereas a\n      // proven rollback of the audit ledger is a compliance incident. Operators\n      // page on\n      //   increase(audit_tamper_detected_total[1h]) > 0\n      // Cardinality: one series per declared audit `provider`.\n      auditTamperDetectedTotal: this.meter.createCounter('audit_tamper_detected_total', {\n        description: 'Compliance audit-log store tamper/rollback detections (durable-state consistency-proof failures)',\n      }),\n\n      // ─── Compliance Audit-Log assurance DEGRADATIONS ────\n      // A tamper-evident audit provider dropped from FULL cross-restart tamper-evidence to a WEAKER\n      // assurance level — ephemeral mode (no durable anchor), a corrupt/unreadable anchor, an un-pinned\n      // server-identity change, or a per-op proof failure. DISTINCT from `audit_tamper_detected_total`\n      // (a PROVEN rollback → page) and `audit_sink_failure_total` (a write hiccup): a degradation means\n      // \"we may not detect a future tamper\" — it should be alerted so the guarantee never lapses silently.\n      // Operators alert on\n      //   increase(audit_integrity_assurance_degraded_total{reason=\"ephemeral\"}[1h]) > 0\n      // Cardinality: one series per (provider, reason) — `reason` is a small fixed slug set.\n      auditIntegrityAssuranceDegradedTotal: this.meter.createCounter('audit_integrity_assurance_degraded_total', {\n        description:\n          'Compliance audit-log assurance degradations (ephemeral / corrupt-anchor / identity-change / per-op proof failure)',\n      }),\n\n      // ─── Compliance Audit-Log LAYER-1 (authoritative DB store) write failures ────\n      // The always-on Layer-1 database audit store (`AuditLogsBackendService._createAuditLog`) threw\n      // while writing the authoritative row. DISTINCT from `audit_sink_failure_total` (a Layer-2\n      // provider sink — immudb/SIEM — hiccup, backfilled by the reconciler): a Layer-1 failure means\n      // the PRIMARY, authoritative audit record itself was NOT persisted — the most severe \"we think\n      // we're auditing but we aren't\" state. Emission is fire-and-forget (audit must never break the\n      // business op), so without this counter the outage is invisible past a swallowed warn line.\n      // Operators alert on\n      //   rate(audit_store_failure_total[5m]) > 0\n      // Cardinality: ONE label-free series (the authoritative store has no provider dimension). The\n      // alert rule is specified in `.claude/plans/alerting-system-design-analysis.md` Appendix D.\n      auditStoreFailureTotal: this.meter.createCounter('audit_store_failure_total', {\n        description: 'Compliance audit-log Layer-1 authoritative DB store write failures (one per _createAuditLog persist throw)',\n      }),\n\n      // ─── Security audit observations DROPPED before the pipeline saw them ────\n      // A fire-and-forget security observation (an operator tenant crossing, an authorization\n      // refusal, a platform-access grant transition) never reached `AuditLogsBackendService` at all:\n      // the service was unbound or its `log*` method absent, the call threw synchronously, or the\n      // returned promise rejected. DISTINCT from `audit_store_failure_total`, which fires INSIDE\n      // `_createAuditLog` and therefore only sees emissions that got that far — the drops counted\n      // here are exactly the ones it structurally cannot see. Fire-and-forget is deliberate and\n      // stays (an observation must never fail the request it observes), so without this counter the\n      // loss is completely silent and \"no operator crossings this week\" is indistinguishable from\n      // \"the audit service has been unbound since Tuesday\". Operators alert on\n      //   increase(audit_observation_dropped_total[15m]) > 0\n      // Cardinality: 3 `observation` × 3 `reason` = 9 series today, both label sets closed enums.\n      auditObservationDroppedTotal: this.meter.createCounter('audit_observation_dropped_total', {\n        description:\n          'Security audit observations dropped before reaching the audit pipeline (service unavailable / emission threw / emission rejected)',\n      }),\n    };\n  }\n\n  // ---------------------------------------------------------------------------\n  // Data Seeding metrics (Phase 6.D / F-17)\n  // ---------------------------------------------------------------------------\n  // Typed wrappers around the four data-seeding counters so the dispatcher\n  // never reaches into the raw OpenTelemetry meter and so all label keys\n  // stay consistent (snake_case to match Prometheus convention; the\n  // dispatcher passes already-stringified enum values).\n  // ---------------------------------------------------------------------------\n\n  /**\n   * LAZY engine — C1 idempotency-probe cache hit. Fired once per\n   * (seed × scope) when `runLazy` short-circuits because a prior\n   * COMPLETED `DataSeedRun` row already covers the scope.\n   */\n  public recordDataSeedingLazyCacheHit(params: { seedKey: string; scopeKind: string }): void {\n    this.metricsDefinitions.dataSeedingLazyC1CacheHits.add(1, {\n      seed_key: params.seedKey,\n      scope_kind: params.scopeKind,\n    });\n  }\n\n  /**\n   * LAZY engine — C1 idempotency-probe cache miss. Fired once per\n   * (seed × scope) when `runLazy` proceeds past the C1 probe and\n   * attempts to acquire a run-slot.\n   */\n  public recordDataSeedingLazyCacheMiss(params: { seedKey: string; scopeKind: string }): void {\n    this.metricsDefinitions.dataSeedingLazyC1CacheMisses.add(1, {\n      seed_key: params.seedKey,\n      scope_kind: params.scopeKind,\n    });\n  }\n\n  /**\n   * LAZY engine — concurrent first-access race resolved by silent\n   * bow-out. `reason` mirrors the dispatcher's\n   * `acquireLazyRunSlotWithRaceGuard` outcome:\n   *   - `concurrent-completed` — a winning concurrent caller already\n   *     wrote a COMPLETED row (data is there);\n   *   - `concurrent-running`   — a winning concurrent caller currently\n   *     owns the RUNNING slot (data is being written).\n   */\n  public recordDataSeedingThunderHerdBowout(params: {\n    seedKey: string;\n    scopeKind: string;\n    reason: 'concurrent-completed' | 'concurrent-running';\n  }): void {\n    this.metricsDefinitions.dataSeedingThunderHerdBowouts.add(1, {\n      seed_key: params.seedKey,\n      scope_kind: params.scopeKind,\n      reason: params.reason,\n    });\n  }\n\n  /**\n   * Terminal `DataSeedRun` write — fired exactly once per row\n   * transition into COMPLETED / PARTIAL / FAILED. The metric is\n   * emitted from the shared lifecycle writers\n   * (`completeDataSeedRun` / `failDataSeedRun` /\n   * `writeFreshFailedDataSeedRun`) so every dispatcher engine —\n   * Level-A application lifecycle, Level-B resource lifecycle, LAZY\n   * first-access, MANUAL re-runs, and the deferred Phase-7 cron —\n   * contributes uniformly without per-engine wiring.\n   *\n   * `mode`, `status`, `triggerOrigin`, and `scopeKind` are passed as\n   * raw enum string values (the dispatcher does the `.toString()`) so\n   * this service stays decoupled from the data-seeding domain enums.\n   *\n   * Phase 5/6 audit H-2 — `scope_kind` was added to align with the\n   * sibling LAZY-engine counters (hit / miss / bow-out) which all\n   * carry it. Without `scope_kind`, operators cannot answer\n   * \"are my org-scoped seeds healthier than my user-scoped seeds?\",\n   * and the deferred Phase-7 cron-scheduler dashboard cannot slice\n   * terminal-run health by scope at all (terminal counts are the\n   * only signal SYNC / ADDITIVE / UPGRADE seeds emit). Cardinality\n   * stays bounded: 5 `DataSeedScopeKind` values × ~200 seeds × 4\n   * modes × 4 statuses × ~6 trigger origins ≈ 96K series upper\n   * bound; in practice <1K active series.\n   */\n  public recordDataSeedingRun(params: {\n    seedKey: string;\n    mode: string;\n    status: string;\n    triggerOrigin: string;\n    scopeKind: string;\n  }): void {\n    this.metricsDefinitions.dataSeedingRunTotal.add(1, {\n      seed_key: params.seedKey,\n      mode: params.mode,\n      status: params.status,\n      trigger_origin: params.triggerOrigin,\n      scope_kind: params.scopeKind,\n    });\n  }\n\n  /**\n   * Wall-clock duration of the admin `GET /internal/admin/data-seeding/seeds`\n   * endpoint in milliseconds. Recorded in the controller around the full\n   * registry walk (which fans out N `lastRun` lookups, one per seed).\n   *\n   * Phase 5/6 audit L-4 — needed because the endpoint is N+1 by design\n   * (single registry-wide aggregate would couple the surface to the\n   * adapter's grammar; see the controller's `lookupLastRunSummary` JSDoc).\n   * The histogram lets operators spot when the seed registry crosses the\n   * \"switch to bulk aggregation\" threshold and surface it as a Phase-7\n   * dashboard SLO alert.\n   *\n   * `seedCount` is bucketed coarsely (0, 1-10, 11-50, 51-200, 201+) so\n   * label cardinality stays bounded across deployments with widely\n   * different seed counts.\n   */\n  public recordDataSeedingAdminListSeedsDuration(params: {\n    durationMs: number;\n    seedCount: number;\n  }): void {\n    const bucket = (() => {\n      if (params.seedCount <= 0) return '0';\n      if (params.seedCount <= 10) return '1-10';\n      if (params.seedCount <= 50) return '11-50';\n      if (params.seedCount <= 200) return '51-200';\n      return '201+';\n    })();\n    this.metricsDefinitions.dataSeedingAdminListSeedsDuration.record(params.durationMs, {\n      seed_count_bucket: bucket,\n    });\n  }\n\n  // ---------------------------------------------------------------------------\n  // M2M Outbound Webhook Delivery metrics (Phase 5 / Step 17)\n  // ---------------------------------------------------------------------------\n  // Typed wrapper around the single `m2m_webhook_delivery_total` counter so\n  // worker call sites never reach into the raw OpenTelemetry meter and so\n  // label keys (`scope` / `outcome`) stay consistent. The `scope` parameter\n  // is locked to the `AuthScopeType` enum (`'organization' | 'application'`)\n  // — passing a typo or a stale string fails type-check rather than silently\n  // creating a parallel time series — and `outcome` maps 1:1 to\n  // `M2MWebhookDeliveryBatchOutput.outcome`.\n  //\n  // Firing contract:\n  //   - Exactly ONCE per worker invocation, at each terminal / intermediate\n  //     return-point in `m2mWebhookDeliveryBatchService.doHandle`.\n  //   - NOT fired from the dispatcher's skip paths (feature off / config\n  //     off / no endpoints) — those never create a delivery row and never\n  //     emit outbound HTTP, so they are not webhook deliveries by\n  //     definition.\n  //\n  // See `.cursor/plans/m2m-webhook-organization-delivery-phase5.md` §D4.\n  // ---------------------------------------------------------------------------\n\n  /**\n   * M2M Outbound Webhook Delivery outcome counter.\n   *\n   * @param params.scope - `AuthScopeType.ORGANIZATION` (`'organization'`)\n   *   or `AuthScopeType.APPLICATION` (`'application'`). Locked to the\n   *   shared `AuthScopeType` enum so a typo or stale literal fails\n   *   type-check rather than silently creating a parallel time series\n   *   under a divergent label.\n   * @param params.outcome - One of the five\n   *   `M2MWebhookDeliveryBatchOutput.outcome` values. `delivered` and\n   *   `failed_terminal` are terminal; `retry_scheduled` is the\n   *   intermediate retry branch; `skipped_missing_row` /\n   *   `skipped_already_leased` cover the two skip branches that still\n   *   consumed a worker slot.\n   */\n  public recordM2MWebhookDeliveryOutcome(params: {\n    scope: AuthScopeType;\n    outcome:\n      | 'delivered'\n      | 'retry_scheduled'\n      | 'failed_terminal'\n      | 'skipped_missing_row'\n      | 'skipped_already_leased';\n  }): void {\n    this.metricsDefinitions.m2mWebhookDeliveryTotal.add(1, {\n      scope: params.scope,\n      outcome: params.outcome,\n    });\n  }\n\n  // ---------------------------------------------------------------------------\n  // Compliance Audit-Log Sink failures (Phase 5 / F6)\n  // ---------------------------------------------------------------------------\n\n  /**\n   * F6 (audit Phase 5) — a Layer-2 provider audit sink threw while recording an\n   * event. Fired by `CompositeAuditLogSink` in its per-sink catch, so an\n   * otherwise-swallowed sink failure is OBSERVABLE (→ alert). Synchronous, never\n   * throws (the global meter is a no-op without the OTLP preload).\n   *\n   * @param params.providerRef - The declared audit provider whose sink failed\n   *   (immudb, a SIEM webhook, …) — the stable, low-cardinality series label.\n   */\n  public recordAuditSinkFailure(params: { providerRef: string }): void {\n    this.metricsDefinitions.auditSinkFailureTotal.add(1, {\n      provider: params.providerRef,\n    });\n  }\n\n  /**\n   * A tamper-evident audit provider PROVED its store was rolled back / tampered between restarts\n   * (its durable-state cryptographic consistency proof failed). Fired by `CompositeAuditLogSink`\n   * via the `onIntegrityViolation` hook it threads into the provider sink factory (the sink cannot\n   * import this service across the dependency wall). DISTINCT from {@link recordAuditSinkFailure}:\n   * this is a compliance incident (page a human), not a backfillable transient miss. Synchronous,\n   * never throws (the global meter is a no-op without the OTLP preload).\n   *\n   * @param params.providerRef - The audit provider whose store proved tampered (immudb, …).\n   */\n  public recordAuditTamperDetected(params: { providerRef: string }): void {\n    this.metricsDefinitions.auditTamperDetectedTotal.add(1, {\n      provider: params.providerRef,\n    });\n  }\n\n  /**\n   * A tamper-evident audit provider DEGRADED from full cross-restart tamper-evidence to a weaker\n   * assurance level (ephemeral mode, a corrupt anchor, an un-pinned server-identity change, or a per-op\n   * proof failure). Fired by `CompositeAuditLogSink` via the `onAssuranceDegraded` hook it threads into\n   * the provider sink factory. DISTINCT from {@link recordAuditTamperDetected}: a degradation is not a\n   * proven tamper, but it means a future tamper may go UNDETECTED — alertable so the guarantee never\n   * lapses silently. Non-latching. Synchronous, never throws.\n   *\n   * @param params.providerRef - The audit provider that degraded (immudb, …).\n   * @param params.reason - Stable snake_case slug (`ephemeral`, `anchor_corrupt`, `anchor_identity_change`, `proof_failure_transient`).\n   */\n  public recordAuditIntegrityAssuranceDegraded(params: { providerRef: string; reason: string }): void {\n    this.metricsDefinitions.auditIntegrityAssuranceDegradedTotal.add(1, {\n      provider: params.providerRef,\n      reason: params.reason,\n    });\n  }\n\n  /**\n   * A-12 — the Layer-1 authoritative DB audit store threw while persisting an event. Fired by\n   * `AuditLogsBackendService._createAuditLog` in its Layer-1 catch, so the \"the primary audit record\n   * itself did not persist\" outage is OBSERVABLE (→ alert) rather than a swallowed warn line on a\n   * fire-and-forget path. DISTINCT from {@link recordAuditSinkFailure}: that is a Layer-2 provider sink\n   * (immudb/SIEM) hiccup the reconciler backfills; THIS is the authoritative store failing. Synchronous,\n   * never throws (the global meter is a no-op without the OTLP preload). Label-free — the authoritative\n   * store has no provider dimension. Alert rule: `alerting-system-design-analysis.md` Appendix D.\n   */\n  public recordAuditStoreFailure(): void {\n    this.metricsDefinitions.auditStoreFailureTotal.add(1);\n  }\n\n  /**\n   * A fire-and-forget security audit observation was DROPPED before it reached the audit pipeline.\n   * Fired by the shared emission seam (`audit-observation-emission.backend.ts`), which every such\n   * observation routes through, so a new observation is counted the day it lands.\n   *\n   * DISTINCT from {@link recordAuditStoreFailure}, and the distinction is the reason this counter\n   * exists: that one fires INSIDE `_createAuditLog`, so it only ever sees an emission that reached\n   * the audit service. The three shapes counted here — an unbound service or absent `log*` method, a\n   * synchronous throw, a rejected promise — never get that far, and were previously invisible.\n   * Merging them into one counter would let a total wiring outage hide behind a store hiccup.\n   *\n   * Synchronous, never throws (the global meter is a no-op without the OTLP preload — which is why\n   * the seam ALSO logs, at a throttled `error`).\n   *\n   * @param params.observation - `AuditObservationKind` member — WHICH security event was lost.\n   * @param params.reason - `AuditObservationLossReason` member — WHICH of the three loss shapes.\n   */\n  public recordAuditObservationDropped(params: { observation: string; reason: string }): void {\n    this.metricsDefinitions.auditObservationDroppedTotal.add(1, {\n      observation: params.observation,\n      reason: params.reason,\n    });\n  }\n}\n"]}
+{"version":3,"file":"metrics.service.js","sourceRoot":"","sources":["../../../../../src/monitoring/observability/services/metrics.service.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,OAAO,EAAS,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAIvC;;;;;;;;;;GAUG;AAEI,IAAM,cAAc,GAApB,MAAM,cAAc;IACjB,KAAK,CAAQ;IACb,kBAAkB,CAAoB;IAE9C;QACE,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC;QAC7D,IAAI,CAAC,iBAAiB,EAAE,CAAC;IAC3B,CAAC;IAEO,iBAAiB;QACvB,IAAI,CAAC,kBAAkB,GAAG;YACxB,wEAAwE;YACxE,gEAAgE;YAChE,wEAAwE;YACxE,gEAAgE;YAChE,mEAAmE;YACnE,sCAAsC;YACtC,gEAAgE;YAChE,kEAAkE;YAClE,2CAA2C;YAC3C,sEAAsE;YACtE,gEAAgE;YAChE,mEAAmE;YACnE,gDAAgD;YAChD,sEAAsE;YACtE,qEAAqE;YACrE,mEAAmE;YACnE,oCAAoC;YACpC,0BAA0B,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,uCAAuC,EAAE;gBAC5F,WAAW,EAAE,yGAAyG;aACvH,CAAC;YAEF,4BAA4B,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,yCAAyC,EAAE;gBAChG,WAAW,EAAE,2FAA2F;aACzG,CAAC;YAEF,6BAA6B,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,yCAAyC,EAAE;gBACjG,WAAW,EAAE,6GAA6G;aAC3H,CAAC;YAEF,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,wBAAwB,EAAE;gBACtE,WAAW,EAAE,gGAAgG;aAC9G,CAAC;YAEF,iCAAiC,EAAE,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,2CAA2C,EAAE;gBACzG,WAAW,EAAE,oGAAoG;aAClH,CAAC;YAEF,6DAA6D;YAC7D,4DAA4D;YAC5D,4EAA4E;YAC5E,6DAA6D;YAC7D,8DAA8D;YAC9D,6CAA6C;YAC7C,8DAA8D;YAC9D,6CAA6C;YAC7C,2DAA2D;YAC3D,uBAAuB,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,4BAA4B,EAAE;gBAC9E,WAAW,EAAE,qFAAqF;aACnG,CAAC;YAEF,6DAA6D;YAC7D,oEAAoE;YACpE,2EAA2E;YAC3E,uEAAuE;YACvE,yEAAyE;YACzE,iCAAiC;YACjC,2CAA2C;YAC3C,2EAA2E;YAC3E,qBAAqB,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,0BAA0B,EAAE;gBAC1E,WAAW,EAAE,uFAAuF;aACrG,CAAC;YAEF,kDAAkD;YAClD,yEAAyE;YACzE,6EAA6E;YAC7E,0EAA0E;YAC1E,2EAA2E;YAC3E,0EAA0E;YAC1E,UAAU;YACV,kDAAkD;YAClD,yDAAyD;YACzD,wBAAwB,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,6BAA6B,EAAE;gBAChF,WAAW,EAAE,kGAAkG;aAChH,CAAC;YAEF,uDAAuD;YACvD,8FAA8F;YAC9F,kGAAkG;YAClG,iGAAiG;YACjG,kGAAkG;YAClG,qGAAqG;YACrG,qBAAqB;YACrB,mFAAmF;YACnF,uFAAuF;YACvF,oCAAoC,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,0CAA0C,EAAE;gBACzG,WAAW,EACT,mHAAmH;aACtH,CAAC;YAEF,gFAAgF;YAChF,+FAA+F;YAC/F,2FAA2F;YAC3F,+FAA+F;YAC/F,+FAA+F;YAC/F,+FAA+F;YAC/F,4FAA4F;YAC5F,qBAAqB;YACrB,4CAA4C;YAC5C,8FAA8F;YAC9F,4FAA4F;YAC5F,sBAAsB,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,2BAA2B,EAAE;gBAC5E,WAAW,EAAE,4GAA4G;aAC1H,CAAC;YAEF,4EAA4E;YAC5E,wFAAwF;YACxF,+FAA+F;YAC/F,4FAA4F;YAC5F,2FAA2F;YAC3F,4FAA4F;YAC5F,0FAA0F;YAC1F,8FAA8F;YAC9F,4FAA4F;YAC5F,yEAAyE;YACzE,uDAAuD;YACvD,4FAA4F;YAC5F,4BAA4B,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,iCAAiC,EAAE;gBACxF,WAAW,EACT,mIAAmI;aACtI,CAAC;SACH,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,0CAA0C;IAC1C,8EAA8E;IAC9E,yEAAyE;IACzE,uEAAuE;IACvE,kEAAkE;IAClE,sDAAsD;IACtD,8EAA8E;IAE9E;;;;OAIG;IACI,6BAA6B,CAAC,MAA8C;QACjF,IAAI,CAAC,kBAAkB,CAAC,0BAA0B,CAAC,GAAG,CAAC,CAAC,EAAE;YACxD,QAAQ,EAAE,MAAM,CAAC,OAAO;YACxB,UAAU,EAAE,MAAM,CAAC,SAAS;SAC7B,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACI,8BAA8B,CAAC,MAA8C;QAClF,IAAI,CAAC,kBAAkB,CAAC,4BAA4B,CAAC,GAAG,CAAC,CAAC,EAAE;YAC1D,QAAQ,EAAE,MAAM,CAAC,OAAO;YACxB,UAAU,EAAE,MAAM,CAAC,SAAS;SAC7B,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACI,kCAAkC,CAAC,MAIzC;QACC,IAAI,CAAC,kBAAkB,CAAC,6BAA6B,CAAC,GAAG,CAAC,CAAC,EAAE;YAC3D,QAAQ,EAAE,MAAM,CAAC,OAAO;YACxB,UAAU,EAAE,MAAM,CAAC,SAAS;YAC5B,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACI,oBAAoB,CAAC,MAM3B;QACC,IAAI,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,EAAE;YACjD,QAAQ,EAAE,MAAM,CAAC,OAAO;YACxB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,cAAc,EAAE,MAAM,CAAC,aAAa;YACpC,UAAU,EAAE,MAAM,CAAC,SAAS;SAC7B,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACI,uCAAuC,CAAC,MAG9C;QACC,MAAM,MAAM,GAAG,CAAC,GAAG,EAAE;YACnB,IAAI,MAAM,CAAC,SAAS,IAAI,CAAC;gBAAE,OAAO,GAAG,CAAC;YACtC,IAAI,MAAM,CAAC,SAAS,IAAI,EAAE;gBAAE,OAAO,MAAM,CAAC;YAC1C,IAAI,MAAM,CAAC,SAAS,IAAI,EAAE;gBAAE,OAAO,OAAO,CAAC;YAC3C,IAAI,MAAM,CAAC,SAAS,IAAI,GAAG;gBAAE,OAAO,QAAQ,CAAC;YAC7C,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC,EAAE,CAAC;QACL,IAAI,CAAC,kBAAkB,CAAC,iCAAiC,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE;YAClF,iBAAiB,EAAE,MAAM;SAC1B,CAAC,CAAC;IACL,CAAC;IAED,8EAA8E;IAC9E,4DAA4D;IAC5D,8EAA8E;IAC9E,0EAA0E;IAC1E,wEAAwE;IACxE,0EAA0E;IAC1E,2EAA2E;IAC3E,2EAA2E;IAC3E,8DAA8D;IAC9D,2CAA2C;IAC3C,EAAE;IACF,mBAAmB;IACnB,0EAA0E;IAC1E,iEAAiE;IACjE,uEAAuE;IACvE,wEAAwE;IACxE,gEAAgE;IAChE,kBAAkB;IAClB,EAAE;IACF,uEAAuE;IACvE,8EAA8E;IAE9E;;;;;;;;;;;;;;OAcG;IACI,+BAA+B,CAAC,MAQtC;QACC,IAAI,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,EAAE;YACrD,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC,CAAC;IACL,CAAC;IAED,8EAA8E;IAC9E,oDAAoD;IACpD,8EAA8E;IAE9E;;;;;;;;OAQG;IACI,sBAAsB,CAAC,MAA+B;QAC3D,IAAI,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,EAAE;YACnD,QAAQ,EAAE,MAAM,CAAC,WAAW;SAC7B,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;OASG;IACI,yBAAyB,CAAC,MAA+B;QAC9D,IAAI,CAAC,kBAAkB,CAAC,wBAAwB,CAAC,GAAG,CAAC,CAAC,EAAE;YACtD,QAAQ,EAAE,MAAM,CAAC,WAAW;SAC7B,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;OAUG;IACI,qCAAqC,CAAC,MAA+C;QAC1F,IAAI,CAAC,kBAAkB,CAAC,oCAAoC,CAAC,GAAG,CAAC,CAAC,EAAE;YAClE,QAAQ,EAAE,MAAM,CAAC,WAAW;YAC5B,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACI,uBAAuB;QAC5B,IAAI,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACxD,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACI,6BAA6B,CAAC,MAA+C;QAClF,IAAI,CAAC,kBAAkB,CAAC,4BAA4B,CAAC,GAAG,CAAC,CAAC,EAAE;YAC1D,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AAlZY,cAAc;IAD1B,UAAU,EAAE;;GACA,cAAc,CAkZ1B","sourcesContent":["import { metrics, Meter } from '@opentelemetry/api';\nimport { injectable } from 'inversify';\nimport type { AuthScopeType } from '@wildo-ai/saas-models';\nimport { MetricDefinitions } from '~wildo-backend-lib/monitoring/observability/models/observability.backend.schemas';\n\n/**\n * Records the operator-facing metrics that have LIVE producers — the\n * data-seeding counters (dispatcher engines + shared ledger writers) and the\n * M2M outbound-webhook counter (delivery batch worker). All instruments are\n * created on the global meter, which the OTLP preload (`otel-preload.ts`) wires\n * to the OTLP metric exporter; with no preload the global meter is a no-op, so\n * recording is silently inert (never throws). The former HTTP/DB/auth/etc.\n * `record*` helpers were removed in Slice 2 Phase 3 — their only caller was the\n * dead observability middleware, and HTTP metrics now come from the preload's\n * auto-instrumentation (bounded, semconv) instead of unbounded org/user labels.\n */\n@injectable()\nexport class MetricsService {\n  private meter: Meter;\n  private metricsDefinitions: MetricDefinitions;\n\n  constructor() {\n    this.meter = metrics.getMeter('wildo-saas-metrics', '1.0.0');\n    this.initializeMetrics();\n  }\n\n  private initializeMetrics(): void {\n    this.metricsDefinitions = {\n      // ---------------------------------------------------------------------\n      // Data Seeding (Phase 6.D / F-17 — Prom-style operator metrics)\n      // ---------------------------------------------------------------------\n      // The data-seeding dispatcher exposes four observable concerns:\n      //   - LAZY C1 cache hit-rate (first-access bootstrap short-circuit\n      //     effectiveness on the hot path),\n      //   - LAZY thunder-herd bow-outs (concurrent first-access races\n      //     resolved silently, distinguishing the \"winner already done\"\n      //     vs \"winner still running\" branches),\n      //   - DataSeedRun terminal totals (every COMPLETED / PARTIAL / FAILED\n      //     ledger transition, per seed × mode × trigger origin — the\n      //     metric covers ALL engines, current and future, because it is\n      //     fired from the shared lifecycle writers).\n      // Counter names follow the Prometheus convention `_total` suffix; the\n      // OpenTelemetry meter is the existing `wildo-saas-metrics` meter, so\n      // the counters export via the OTLP metric reader configured in the\n      // preload without any extra wiring.\n      dataSeedingLazyC1CacheHits: this.meter.createCounter('data_seeding_lazy_c1_cache_hits_total', {\n        description: 'LAZY engine C1 idempotency-probe cache hits (already-completed scope, skipped without entry resolution)',\n      }),\n\n      dataSeedingLazyC1CacheMisses: this.meter.createCounter('data_seeding_lazy_c1_cache_misses_total', {\n        description: 'LAZY engine C1 idempotency-probe cache misses (cold-start, run-slot acquisition proceeds)',\n      }),\n\n      dataSeedingThunderHerdBowouts: this.meter.createCounter('data_seeding_thunder_herd_bowouts_total', {\n        description: 'LAZY engine concurrent-first-access races where the slot acquisition lost and the caller bowed out silently',\n      }),\n\n      dataSeedingRunTotal: this.meter.createCounter('data_seeding_run_total', {\n        description: 'DataSeedRun terminal-state writes (COMPLETED / PARTIAL / FAILED) across all dispatcher engines',\n      }),\n\n      dataSeedingAdminListSeedsDuration: this.meter.createHistogram('data_seeding_admin_list_seeds_duration_ms', {\n        description: 'Wall-clock duration of GET /internal/admin/data-seeding/seeds (N+1 lastRun lookup) in milliseconds',\n      }),\n\n      // ─── M2M Outbound Webhook Delivery (Phase 5 / Step 17) ────\n      // One counter covering every worker `doHandle` return — the\n      // outcome enum maps 1:1 to the five `M2MWebhookDeliveryBatchOutput.outcome`\n      // values (`delivered`, `retry_scheduled`, `failed_terminal`,\n      // `skipped_missing_row`, `skipped_already_leased`). Operators\n      // answer \"is webhook delivery healthy?\" with\n      //   rate(m2m_webhook_delivery_total{outcome=\"delivered\"}[5m])\n      //     / rate(m2m_webhook_delivery_total[5m])\n      // Cardinality: 2 `scope` × 5 `outcome` = 10 active series.\n      m2mWebhookDeliveryTotal: this.meter.createCounter('m2m_webhook_delivery_total', {\n        description: 'M2M outbound webhook delivery terminal / intermediate outcomes (one per worker run)',\n      }),\n\n      // ─── Compliance Audit-Log Sink Failures (Phase 5 / F6) ────\n      // A Layer-2 provider audit sink threw while recording an event. The\n      // composite (`CompositeAuditLogSink`) isolates the failure so the business\n      // op is unaffected, but a silently-failing audit sink (\"we think we're\n      // auditing but we aren't\") must not go unnoticed — this counter makes it\n      // observable. Operators alert on\n      //   rate(audit_sink_failure_total[5m]) > 0\n      // Cardinality: one series per declared audit `provider` (immudb, SIEM, …).\n      auditSinkFailureTotal: this.meter.createCounter('audit_sink_failure_total', {\n        description: 'Compliance audit-log provider sink failures (one per sink throw during event fan-out)',\n      }),\n\n      // ─── Compliance Audit-Log TAMPER detections ────\n      // A tamper-evident audit provider (immudb) PROVED, via its cryptographic\n      // durable-state consistency proof, that its store was rolled back / tampered\n      // between restarts. DISTINCT from `audit_sink_failure_total`: a transient\n      // write miss is backfilled by the reconciler and needs no human, whereas a\n      // proven rollback of the audit ledger is a compliance incident. Operators\n      // page on\n      //   increase(audit_tamper_detected_total[1h]) > 0\n      // Cardinality: one series per declared audit `provider`.\n      auditTamperDetectedTotal: this.meter.createCounter('audit_tamper_detected_total', {\n        description: 'Compliance audit-log store tamper/rollback detections (durable-state consistency-proof failures)',\n      }),\n\n      // ─── Compliance Audit-Log assurance DEGRADATIONS ────\n      // A tamper-evident audit provider dropped from FULL cross-restart tamper-evidence to a WEAKER\n      // assurance level — ephemeral mode (no durable anchor), a corrupt/unreadable anchor, an un-pinned\n      // server-identity change, or a per-op proof failure. DISTINCT from `audit_tamper_detected_total`\n      // (a PROVEN rollback → page) and `audit_sink_failure_total` (a write hiccup): a degradation means\n      // \"we may not detect a future tamper\" — it should be alerted so the guarantee never lapses silently.\n      // Operators alert on\n      //   increase(audit_integrity_assurance_degraded_total{reason=\"ephemeral\"}[1h]) > 0\n      // Cardinality: one series per (provider, reason) — `reason` is a small fixed slug set.\n      auditIntegrityAssuranceDegradedTotal: this.meter.createCounter('audit_integrity_assurance_degraded_total', {\n        description:\n          'Compliance audit-log assurance degradations (ephemeral / corrupt-anchor / identity-change / per-op proof failure)',\n      }),\n\n      // ─── Compliance Audit-Log LAYER-1 (authoritative DB store) write failures ────\n      // The always-on Layer-1 database audit store (`AuditLogsBackendService._createAuditLog`) threw\n      // while writing the authoritative row. DISTINCT from `audit_sink_failure_total` (a Layer-2\n      // provider sink — immudb/SIEM — hiccup, backfilled by the reconciler): a Layer-1 failure means\n      // the PRIMARY, authoritative audit record itself was NOT persisted — the most severe \"we think\n      // we're auditing but we aren't\" state. Emission is fire-and-forget (audit must never break the\n      // business op), so without this counter the outage is invisible past a swallowed warn line.\n      // Operators alert on\n      //   rate(audit_store_failure_total[5m]) > 0\n      // Cardinality: ONE label-free series (the authoritative store has no provider dimension). The\n      // alert rule is specified in `.claude/plans/alerting-system-design-analysis.md` Appendix D.\n      auditStoreFailureTotal: this.meter.createCounter('audit_store_failure_total', {\n        description: 'Compliance audit-log Layer-1 authoritative DB store write failures (one per _createAuditLog persist throw)',\n      }),\n\n      // ─── Security audit observations DROPPED before the pipeline saw them ────\n      // A fire-and-forget security observation (an operator tenant crossing, an authorization\n      // refusal, a platform-access grant transition) never reached `AuditLogsBackendService` at all:\n      // the service was unbound or its `log*` method absent, the call threw synchronously, or the\n      // returned promise rejected. DISTINCT from `audit_store_failure_total`, which fires INSIDE\n      // `_createAuditLog` and therefore only sees emissions that got that far — the drops counted\n      // here are exactly the ones it structurally cannot see. Fire-and-forget is deliberate and\n      // stays (an observation must never fail the request it observes), so without this counter the\n      // loss is completely silent and \"no operator crossings this week\" is indistinguishable from\n      // \"the audit service has been unbound since Tuesday\". Operators alert on\n      //   increase(audit_observation_dropped_total[15m]) > 0\n      // Cardinality: 3 `observation` × 3 `reason` = 9 series today, both label sets closed enums.\n      auditObservationDroppedTotal: this.meter.createCounter('audit_observation_dropped_total', {\n        description:\n          'Security audit observations dropped before reaching the audit pipeline (service unavailable / emission threw / emission rejected)',\n      }),\n    };\n  }\n\n  // ---------------------------------------------------------------------------\n  // Data Seeding metrics (Phase 6.D / F-17)\n  // ---------------------------------------------------------------------------\n  // Typed wrappers around the four data-seeding counters so the dispatcher\n  // never reaches into the raw OpenTelemetry meter and so all label keys\n  // stay consistent (snake_case to match Prometheus convention; the\n  // dispatcher passes already-stringified enum values).\n  // ---------------------------------------------------------------------------\n\n  /**\n   * LAZY engine — C1 idempotency-probe cache hit. Fired once per\n   * (seed × scope) when `runLazy` short-circuits because a prior\n   * COMPLETED `DataSeedRun` row already covers the scope.\n   */\n  public recordDataSeedingLazyCacheHit(params: { seedKey: string; scopeKind: string }): void {\n    this.metricsDefinitions.dataSeedingLazyC1CacheHits.add(1, {\n      seed_key: params.seedKey,\n      scope_kind: params.scopeKind,\n    });\n  }\n\n  /**\n   * LAZY engine — C1 idempotency-probe cache miss. Fired once per\n   * (seed × scope) when `runLazy` proceeds past the C1 probe and\n   * attempts to acquire a run-slot.\n   */\n  public recordDataSeedingLazyCacheMiss(params: { seedKey: string; scopeKind: string }): void {\n    this.metricsDefinitions.dataSeedingLazyC1CacheMisses.add(1, {\n      seed_key: params.seedKey,\n      scope_kind: params.scopeKind,\n    });\n  }\n\n  /**\n   * LAZY engine — concurrent first-access race resolved by silent\n   * bow-out. `reason` mirrors the dispatcher's\n   * `acquireLazyRunSlotWithRaceGuard` outcome:\n   *   - `concurrent-completed` — a winning concurrent caller already\n   *     wrote a COMPLETED row (data is there);\n   *   - `concurrent-running`   — a winning concurrent caller currently\n   *     owns the RUNNING slot (data is being written).\n   */\n  public recordDataSeedingThunderHerdBowout(params: {\n    seedKey: string;\n    scopeKind: string;\n    reason: 'concurrent-completed' | 'concurrent-running';\n  }): void {\n    this.metricsDefinitions.dataSeedingThunderHerdBowouts.add(1, {\n      seed_key: params.seedKey,\n      scope_kind: params.scopeKind,\n      reason: params.reason,\n    });\n  }\n\n  /**\n   * Terminal `DataSeedRun` write — fired exactly once per row\n   * transition into COMPLETED / PARTIAL / FAILED. The metric is\n   * emitted from the shared lifecycle writers\n   * (`completeDataSeedRun` / `failDataSeedRun` /\n   * `writeFreshFailedDataSeedRun`) so every dispatcher engine —\n   * Level-A application lifecycle, Level-B resource lifecycle, LAZY\n   * first-access, MANUAL re-runs, and the deferred Phase-7 cron —\n   * contributes uniformly without per-engine wiring.\n   *\n   * `mode`, `status`, `triggerOrigin`, and `scopeKind` are passed as\n   * raw enum string values (the dispatcher does the `.toString()`) so\n   * this service stays decoupled from the data-seeding domain enums.\n   *\n   * Phase 5/6 audit H-2 — `scope_kind` was added to align with the\n   * sibling LAZY-engine counters (hit / miss / bow-out) which all\n   * carry it. Without `scope_kind`, operators cannot answer\n   * \"are my org-scoped seeds healthier than my user-scoped seeds?\",\n   * and the deferred Phase-7 cron-scheduler dashboard cannot slice\n   * terminal-run health by scope at all (terminal counts are the\n   * only signal SYNC / ADDITIVE / UPGRADE seeds emit). Cardinality\n   * stays bounded: 5 `DataSeedScopeKind` values × ~200 seeds × 4\n   * modes × 4 statuses × ~6 trigger origins ≈ 96K series upper\n   * bound; in practice <1K active series.\n   */\n  public recordDataSeedingRun(params: {\n    seedKey: string;\n    mode: string;\n    status: string;\n    triggerOrigin: string;\n    scopeKind: string;\n  }): void {\n    this.metricsDefinitions.dataSeedingRunTotal.add(1, {\n      seed_key: params.seedKey,\n      mode: params.mode,\n      status: params.status,\n      trigger_origin: params.triggerOrigin,\n      scope_kind: params.scopeKind,\n    });\n  }\n\n  /**\n   * Wall-clock duration of the admin `GET /internal/admin/data-seeding/seeds`\n   * endpoint in milliseconds. Recorded in the controller around the full\n   * registry walk (which fans out N `lastRun` lookups, one per seed).\n   *\n   * Phase 5/6 audit L-4 — needed because the endpoint is N+1 by design\n   * (single registry-wide aggregate would couple the surface to the\n   * adapter's grammar; see the controller's `lookupLastRunSummary` JSDoc).\n   * The histogram lets operators spot when the seed registry crosses the\n   * \"switch to bulk aggregation\" threshold and surface it as a Phase-7\n   * dashboard SLO alert.\n   *\n   * `seedCount` is bucketed coarsely (0, 1-10, 11-50, 51-200, 201+) so\n   * label cardinality stays bounded across deployments with widely\n   * different seed counts.\n   */\n  public recordDataSeedingAdminListSeedsDuration(params: {\n    durationMs: number;\n    seedCount: number;\n  }): void {\n    const bucket = (() => {\n      if (params.seedCount <= 0) return '0';\n      if (params.seedCount <= 10) return '1-10';\n      if (params.seedCount <= 50) return '11-50';\n      if (params.seedCount <= 200) return '51-200';\n      return '201+';\n    })();\n    this.metricsDefinitions.dataSeedingAdminListSeedsDuration.record(params.durationMs, {\n      seed_count_bucket: bucket,\n    });\n  }\n\n  // ---------------------------------------------------------------------------\n  // M2M Outbound Webhook Delivery metrics (Phase 5 / Step 17)\n  // ---------------------------------------------------------------------------\n  // Typed wrapper around the single `m2m_webhook_delivery_total` counter so\n  // worker call sites never reach into the raw OpenTelemetry meter and so\n  // label keys (`scope` / `outcome`) stay consistent. The `scope` parameter\n  // is locked to the `AuthScopeType` enum (`'organization' | 'application'`)\n  // — passing a typo or a stale string fails type-check rather than silently\n  // creating a parallel time series — and `outcome` maps 1:1 to\n  // `M2MWebhookDeliveryBatchOutput.outcome`.\n  //\n  // Firing contract:\n  //   - Exactly ONCE per worker invocation, at each terminal / intermediate\n  //     return-point in `m2mWebhookDeliveryBatchService.doHandle`.\n  //   - NOT fired from the dispatcher's skip paths (feature off / config\n  //     off / no endpoints) — those never create a delivery row and never\n  //     emit outbound HTTP, so they are not webhook deliveries by\n  //     definition.\n  //\n  // See `.cursor/plans/m2m-webhook-organization-delivery-phase5.md` §D4.\n  // ---------------------------------------------------------------------------\n\n  /**\n   * M2M Outbound Webhook Delivery outcome counter.\n   *\n   * @param params.scope - `AuthScopeType.ORGANIZATION` (`'organization'`)\n   *   or `AuthScopeType.APPLICATION` (`'application'`). Locked to the\n   *   shared `AuthScopeType` enum so a typo or stale literal fails\n   *   type-check rather than silently creating a parallel time series\n   *   under a divergent label.\n   * @param params.outcome - One of the five\n   *   `M2MWebhookDeliveryBatchOutput.outcome` values. `delivered` and\n   *   `failed_terminal` are terminal; `retry_scheduled` is the\n   *   intermediate retry branch; `skipped_missing_row` /\n   *   `skipped_already_leased` cover the two skip branches that still\n   *   consumed a worker slot.\n   */\n  public recordM2MWebhookDeliveryOutcome(params: {\n    scope: AuthScopeType;\n    outcome:\n      | 'delivered'\n      | 'retry_scheduled'\n      | 'failed_terminal'\n      | 'skipped_missing_row'\n      | 'skipped_already_leased';\n  }): void {\n    this.metricsDefinitions.m2mWebhookDeliveryTotal.add(1, {\n      scope: params.scope,\n      outcome: params.outcome,\n    });\n  }\n\n  // ---------------------------------------------------------------------------\n  // Compliance Audit-Log Sink failures (Phase 5 / F6)\n  // ---------------------------------------------------------------------------\n\n  /**\n   * F6 (audit Phase 5) — a Layer-2 provider audit sink threw while recording an\n   * event. Fired by `CompositeAuditLogSink` in its per-sink catch, so an\n   * otherwise-swallowed sink failure is OBSERVABLE (→ alert). Synchronous, never\n   * throws (the global meter is a no-op without the OTLP preload).\n   *\n   * @param params.providerRef - The declared audit provider whose sink failed\n   *   (immudb, a SIEM webhook, …) — the stable, low-cardinality series label.\n   */\n  public recordAuditSinkFailure(params: { providerRef: string }): void {\n    this.metricsDefinitions.auditSinkFailureTotal.add(1, {\n      provider: params.providerRef,\n    });\n  }\n\n  /**\n   * A tamper-evident audit provider PROVED its store was rolled back / tampered between restarts\n   * (its durable-state cryptographic consistency proof failed). Fired by `CompositeAuditLogSink`\n   * via the `onIntegrityViolation` hook it threads into the provider sink factory (the sink cannot\n   * import this service across the dependency wall). DISTINCT from {@link recordAuditSinkFailure}:\n   * this is a compliance incident (page a human), not a backfillable transient miss. Synchronous,\n   * never throws (the global meter is a no-op without the OTLP preload).\n   *\n   * @param params.providerRef - The audit provider whose store proved tampered (immudb, …).\n   */\n  public recordAuditTamperDetected(params: { providerRef: string }): void {\n    this.metricsDefinitions.auditTamperDetectedTotal.add(1, {\n      provider: params.providerRef,\n    });\n  }\n\n  /**\n   * A tamper-evident audit provider DEGRADED from full cross-restart tamper-evidence to a weaker\n   * assurance level (ephemeral mode, a corrupt anchor, an un-pinned server-identity change, or a per-op\n   * proof failure). Fired by `CompositeAuditLogSink` via the `onAssuranceDegraded` hook it threads into\n   * the provider sink factory. DISTINCT from {@link recordAuditTamperDetected}: a degradation is not a\n   * proven tamper, but it means a future tamper may go UNDETECTED — alertable so the guarantee never\n   * lapses silently. Non-latching. Synchronous, never throws.\n   *\n   * @param params.providerRef - The audit provider that degraded (immudb, …).\n   * @param params.reason - Stable snake_case slug (`ephemeral`, `anchor_corrupt`, `anchor_identity_change`, `proof_failure_transient`).\n   */\n  public recordAuditIntegrityAssuranceDegraded(params: { providerRef: string; reason: string }): void {\n    this.metricsDefinitions.auditIntegrityAssuranceDegradedTotal.add(1, {\n      provider: params.providerRef,\n      reason: params.reason,\n    });\n  }\n\n  /**\n   * A-12 — the Layer-1 authoritative DB audit store threw while persisting an event. Fired by\n   * `AuditLogsBackendService._createAuditLog` in its Layer-1 catch, so the \"the primary audit record\n   * itself did not persist\" outage is OBSERVABLE (→ alert) rather than a swallowed warn line on a\n   * fire-and-forget path. DISTINCT from {@link recordAuditSinkFailure}: that is a Layer-2 provider sink\n   * (immudb/SIEM) hiccup the reconciler backfills; THIS is the authoritative store failing. Synchronous,\n   * never throws (the global meter is a no-op without the OTLP preload). Label-free — the authoritative\n   * store has no provider dimension. Alert rule: `alerting-system-design-analysis.md` Appendix D.\n   */\n  public recordAuditStoreFailure(): void {\n    this.metricsDefinitions.auditStoreFailureTotal.add(1);\n  }\n\n  /**\n   * A fire-and-forget security audit observation was DROPPED before it reached the audit pipeline.\n   * Fired by the shared emission seam (`audit-observation-emission.backend.ts`), which every such\n   * observation routes through, so a new observation is counted the day it lands.\n   *\n   * DISTINCT from {@link recordAuditStoreFailure}, and the distinction is the reason this counter\n   * exists: that one fires INSIDE `_createAuditLog`, so it only ever sees an emission that reached\n   * the audit service. The three shapes counted here — an unbound service or absent `log*` method, a\n   * synchronous throw, a rejected promise — never get that far, and were previously invisible.\n   * Merging them into one counter would let a total wiring outage hide behind a store hiccup.\n   *\n   * Synchronous, never throws (the global meter is a no-op without the OTLP preload — which is why\n   * the seam ALSO logs, at a throttled `error`).\n   *\n   * @param params.observation - `AuditObservationKind` member — WHICH security event was lost.\n   * @param params.reason - `AuditObservationLossReason` member — WHICH of the three loss shapes.\n   */\n  public recordAuditObservationDropped(params: { observation: string; reason: string }): void {\n    this.metricsDefinitions.auditObservationDroppedTotal.add(1, {\n      observation: params.observation,\n      reason: params.reason,\n    });\n  }\n}\n"]}

package/dist/esm/monitoring/observability/services/observability.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"observability.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/monitoring/observability/services/observability.backend.service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAEhE,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,uCAAuC,EAAE,MAAM,4FAA4F,CAAC;AACrJ,OAAO,EAAE,mCAAmC,EAAE,MAAM,kEAAkE,CAAC;AAGvH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,qBACa,2BAA2B;IAKpC,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,OAAO,CAAC,QAAQ,CAAC,yBAAyB;IAE1C,OAAO,CAAC,QAAQ,CAAC,qBAAqB;IACtC;;;;OAIG;IAEH,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IAftC,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;gBAI9D,MAAM,EAAE,aAAa,EAErB,yBAAyB,EAAE,uCAAuC,EAElE,qBAAqB,EAAE,mCAAmC;IAC3E;;;;OAIG;IAEc,kBAAkB,CAAC,EAAE,kBAAkB;IAM1D;;;OAGG;IACI,UAAU,IAAI,IAAI;IAiBzB,yEAAyE;IACzE,OAAO,CAAC,SAAS;IAkCjB;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;IA4BzB;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,yBAAyB;CAuBlC"}
+{"version":3,"file":"observability.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/monitoring/observability/services/observability.backend.service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAEhE,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,uCAAuC,EAAE,MAAM,4FAA4F,CAAC;AACrJ,OAAO,EAAE,mCAAmC,EAAE,MAAM,kEAAkE,CAAC;AAGvH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,qBACa,2BAA2B;IAKpC,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,OAAO,CAAC,QAAQ,CAAC,yBAAyB;IAE1C,OAAO,CAAC,QAAQ,CAAC,qBAAqB;IACtC;;;;OAIG;IAEH,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IAftC,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;gBAI9D,MAAM,EAAE,aAAa,EAErB,yBAAyB,EAAE,uCAAuC,EAElE,qBAAqB,EAAE,mCAAmC;IAC3E;;;;OAIG;IAEc,kBAAkB,CAAC,EAAE,kBAAkB;IAM1D;;;OAGG;IACI,UAAU,IAAI,IAAI;IAiBzB,yEAAyE;IACzE,OAAO,CAAC,SAAS;IAkCjB;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;IA4BzB;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,yBAAyB;CAuBlC"}

package/dist/esm/notifications/email/components/email-components.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"email-components.d.ts","sourceRoot":"","sources":["../../../../../../src/notifications/email/components/email-components.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAmB/B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAG5G,YAAY,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAM5G,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,KAAK,EAAE,gBAAgB,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IACzB,MAAM,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;CAC1B;AAED;;;GAGG;AACH,eAAO,MAAM,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC,gBAAgB,CA+BlD,CAAC;AAMF,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,KAAK,EAAE,gBAAgB,CAAC;IACxB,KAAK,CAAC,EAAE,KAAK,CAAC,aAAa,CAAC;CAC7B;AAED;;;GAGG;AACH,eAAO,MAAM,aAAa,EAAE,KAAK,CAAC,EAAE,CAAC,WAAW,CAoB/C,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,KAAK,CAAC,EAAE,CAAC,WAAW,CAqBjD,CAAC;AAMF,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,KAAK,EAAE,gBAAgB,CAAC;IACxB,KAAK,CAAC,EAAE,KAAK,CAAC,aAAa,CAAC;CAC7B;AAED;;GAEG;AACH,eAAO,MAAM,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC,SAAS,CAcpC,CAAC;AAMF,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,gBAAgB,CAAC;IACxB,KAAK,CAAC,EAAE,KAAK,CAAC,aAAa,CAAC;CAC7B;AAED;;GAEG;AACH,eAAO,MAAM,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,YAAY,CAY1C,CAAC;AAMF;;;;;;;;;;;;;;GAcG;AACH,oBAAY,iBAAiB;IAC3B,iFAAiF;IACjF,OAAO,YAAY;IACnB,yEAAyE;IACzE,OAAO,YAAY;IACnB,2EAA2E;IAC3E,KAAK,UAAU;IACf,kEAAkE;IAClE,IAAI,SAAS;CACd;AAED;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,GAAG,iBAAiB,EAAE,CAAC;AAElD,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,YAAY,CAAC;IACtB,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,KAAK,EAAE,gBAAgB,CAAC;IACxB,KAAK,CAAC,EAAE,KAAK,CAAC,aAAa,CAAC;CAC7B;AAED;;GAEG;AACH,eAAO,MAAM,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,aAAa,CAgC5C,CAAC;AAMF,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACtB,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,KAAK,EAAE,gBAAgB,CAAC;IACxB,KAAK,CAAC,EAAE,KAAK,CAAC,aAAa,CAAC;CAC7B;AAED;;GAEG;AACH,eAAO,MAAM,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAwBlD,CAAC;AAEF,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,KAAK,EAAE,gBAAgB,CAAC;IACxB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,KAAK,CAAC,EAAE,KAAK,CAAC,aAAa,CAAC;CAC7B;AAED;;GAEG;AACH,eAAO,MAAM,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,aAAa,CAgB5C,CAAC;AAOF,OAAO,EACL,IAAI,EACJ,IAAI,EACJ,IAAI,EACJ,SAAS,EACT,OAAO,EACP,GAAG,EACH,MAAM,EACN,IAAI,EACJ,MAAM,EACN,IAAI,EACJ,GAAG,EACH,EAAE,EACF,OAAO,EACP,OAAO,GACR,MAAM,yBAAyB,CAAC"}
+{"version":3,"file":"email-components.d.ts","sourceRoot":"","sources":["../../../../../src/notifications/email/components/email-components.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAmB/B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAG5G,YAAY,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAM5G,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,KAAK,EAAE,gBAAgB,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IACzB,MAAM,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;CAC1B;AAED;;;GAGG;AACH,eAAO,MAAM,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC,gBAAgB,CA+BlD,CAAC;AAMF,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,KAAK,EAAE,gBAAgB,CAAC;IACxB,KAAK,CAAC,EAAE,KAAK,CAAC,aAAa,CAAC;CAC7B;AAED;;;GAGG;AACH,eAAO,MAAM,aAAa,EAAE,KAAK,CAAC,EAAE,CAAC,WAAW,CAoB/C,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,KAAK,CAAC,EAAE,CAAC,WAAW,CAqBjD,CAAC;AAMF,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,KAAK,EAAE,gBAAgB,CAAC;IACxB,KAAK,CAAC,EAAE,KAAK,CAAC,aAAa,CAAC;CAC7B;AAED;;GAEG;AACH,eAAO,MAAM,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC,SAAS,CAcpC,CAAC;AAMF,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,gBAAgB,CAAC;IACxB,KAAK,CAAC,EAAE,KAAK,CAAC,aAAa,CAAC;CAC7B;AAED;;GAEG;AACH,eAAO,MAAM,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,YAAY,CAY1C,CAAC;AAMF;;;;;;;;;;;;;;GAcG;AACH,oBAAY,iBAAiB;IAC3B,iFAAiF;IACjF,OAAO,YAAY;IACnB,yEAAyE;IACzE,OAAO,YAAY;IACnB,2EAA2E;IAC3E,KAAK,UAAU;IACf,kEAAkE;IAClE,IAAI,SAAS;CACd;AAED;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,GAAG,iBAAiB,EAAE,CAAC;AAElD,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,YAAY,CAAC;IACtB,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,KAAK,EAAE,gBAAgB,CAAC;IACxB,KAAK,CAAC,EAAE,KAAK,CAAC,aAAa,CAAC;CAC7B;AAED;;GAEG;AACH,eAAO,MAAM,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,aAAa,CAgC5C,CAAC;AAMF,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACtB,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,KAAK,EAAE,gBAAgB,CAAC;IACxB,KAAK,CAAC,EAAE,KAAK,CAAC,aAAa,CAAC;CAC7B;AAED;;GAEG;AACH,eAAO,MAAM,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAwBlD,CAAC;AAEF,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,KAAK,EAAE,gBAAgB,CAAC;IACxB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,KAAK,CAAC,EAAE,KAAK,CAAC,aAAa,CAAC;CAC7B;AAED;;GAEG;AACH,eAAO,MAAM,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,aAAa,CAgB5C,CAAC;AAOF,OAAO,EACL,IAAI,EACJ,IAAI,EACJ,IAAI,EACJ,SAAS,EACT,OAAO,EACP,GAAG,EACH,MAAM,EACN,IAAI,EACJ,MAAM,EACN,IAAI,EACJ,GAAG,EACH,EAAE,EACF,OAAO,EACP,OAAO,GACR,MAAM,yBAAyB,CAAC"}

package/dist/esm/notifications/email/models/email-template-definition.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"email-template-definition.d.ts","sourceRoot":"","sources":["../../../../../../src/notifications/email/models/email-template-definition.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,OAAO,CAAC;AAC1C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAC5G,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE1D;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAC5D,OAAO,EAAE,oBAAoB,CAAC;IAC9B,KAAK,EAAE,gBAAgB,CAAC;IACxB,gEAAgE;IAChE,MAAM,EAAE,CAAC,CAAC;CACX;AAED;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IACjE,+CAA+C;IAC/C,OAAO,EAAE,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC;IAClD,mDAAmD;IACnD,IAAI,EAAE,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC,CAAC,KAAK,YAAY,CAAC;IACrD,+DAA+D;IAC/D,IAAI,CAAC,EAAE,iBAAiB,CAAC;IACzB,mDAAmD;IACnD,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAID;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,uBAAuB,CAAC,GAAG,CAAC,CAAC;IACvC,kEAAkE;IAClE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAChD;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,2BAA2B,GAAG,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;AAC7E,oEAAoE"}
+{"version":3,"file":"email-template-definition.d.ts","sourceRoot":"","sources":["../../../../../src/notifications/email/models/email-template-definition.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,OAAO,CAAC;AAC1C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAC5G,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE1D;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAC5D,OAAO,EAAE,oBAAoB,CAAC;IAC9B,KAAK,EAAE,gBAAgB,CAAC;IACxB,gEAAgE;IAChE,MAAM,EAAE,CAAC,CAAC;CACX;AAED;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IACjE,+CAA+C;IAC/C,OAAO,EAAE,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC;IAClD,mDAAmD;IACnD,IAAI,EAAE,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC,CAAC,KAAK,YAAY,CAAC;IACrD,+DAA+D;IAC/D,IAAI,CAAC,EAAE,iBAAiB,CAAC;IACzB,mDAAmD;IACnD,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAID;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,uBAAuB,CAAC,GAAG,CAAC,CAAC;IACvC,kEAAkE;IAClE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAChD;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,2BAA2B,GAAG,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;AAC7E,oEAAoE"}

package/dist/esm/notifications/email/models/email-transport.backend.definitions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"email-transport.backend.definitions.d.ts","sourceRoot":"","sources":["../../../../../../src/notifications/email/models/email-transport.backend.definitions.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,eAAO,MAAM,mCAAmC,QAAS,CAAC"}
+{"version":3,"file":"email-transport.backend.definitions.d.ts","sourceRoot":"","sources":["../../../../../src/notifications/email/models/email-transport.backend.definitions.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,eAAO,MAAM,mCAAmC,QAAS,CAAC"}

package/dist/esm/notifications/email/services/email-batch-send.batch.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"email-batch-send.batch.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/notifications/email/services/email-batch-send.batch.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAEL,KAAK,sCAAsC,EAC5C,MAAM,4FAA4F,CAAC;AAKpG,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AA0CjE;;GAEG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAqBpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAwB5E;;GAEG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;iBASrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAM9E;;GAEG;AACH,eAAO,MAAM,qBAAqB,EAAE,sCAAsC,CACxE,OAAO,yBAAyB,EAChC,OAAO,0BAA0B,CAmKjC,CAAC"}
+{"version":3,"file":"email-batch-send.batch.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/notifications/email/services/email-batch-send.batch.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAEL,KAAK,sCAAsC,EAC5C,MAAM,4FAA4F,CAAC;AAKpG,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AA0CjE;;GAEG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAqBpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAwB5E;;GAEG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;iBASrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAM9E;;GAEG;AACH,eAAO,MAAM,qBAAqB,EAAE,sCAAsC,CACxE,OAAO,yBAAyB,EAChC,OAAO,0BAA0B,CAmKjC,CAAC"}

package/dist/esm/notifications/email/services/email-template-registry.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"email-template-registry.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/notifications/email/services/email-template-registry.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AACnH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAOpH,OAAO,KAAK,EACV,uBAAuB,EACvB,2BAA2B,EAC5B,MAAM,yEAAyE,CAAC;AAEjF,qFAAqF;AACrF,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,uBAAuB,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,cAAc,EAAE,MAAM,CAAC;CACxB;AAOD,qBACa,mCAAmC;IAMT,OAAO,CAAC,QAAQ,CAAC,MAAM;IACV,OAAO,CAAC,QAAQ,CAAC,YAAY;IAE7E,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IARnC,OAAO,CAAC,OAAO,CAAuD;IAEtE,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;gBAG3B,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EAExF,gBAAgB,EAAE,uBAAuB;IAM5D;;;;;OAKG;IACH,UAAU,CAAC,WAAW,EAAE,2BAA2B,GAAG,IAAI;IAgB1D;;;;;;;;OAQG;IACH,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,qBAAqB;IAiCnH;;;;;OAKG;IACH,0BAA0B,CAAC,WAAW,EAAE,MAAM,GAAG,qBAAqB;IAatE,4EAA4E;IAC5E,iBAAiB,IAAI,MAAM,EAAE;IAY7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgDG;IACH,OAAO,CAAC,8BAA8B;IAyCtC;;;;;;;OAOG;IACH,OAAO,CAAC,oBAAoB;IAc5B,OAAO,CAAC,YAAY;IAYpB,OAAO,CAAC,kBAAkB;IAc1B,OAAO,CAAC,0BAA0B;IAIlC;;;;;OAKG;IACH,OAAO,CAAC,2BAA2B;CAGpC"}
+{"version":3,"file":"email-template-registry.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/notifications/email/services/email-template-registry.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AACnH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAOpH,OAAO,KAAK,EACV,uBAAuB,EACvB,2BAA2B,EAC5B,MAAM,yEAAyE,CAAC;AAEjF,qFAAqF;AACrF,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,uBAAuB,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,cAAc,EAAE,MAAM,CAAC;CACxB;AAOD,qBACa,mCAAmC;IAMT,OAAO,CAAC,QAAQ,CAAC,MAAM;IACV,OAAO,CAAC,QAAQ,CAAC,YAAY;IAE7E,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IARnC,OAAO,CAAC,OAAO,CAAuD;IAEtE,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;gBAG3B,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EAExF,gBAAgB,EAAE,uBAAuB;IAM5D;;;;;OAKG;IACH,UAAU,CAAC,WAAW,EAAE,2BAA2B,GAAG,IAAI;IAgB1D;;;;;;;;OAQG;IACH,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,qBAAqB;IAiCnH;;;;;OAKG;IACH,0BAA0B,CAAC,WAAW,EAAE,MAAM,GAAG,qBAAqB;IAatE,4EAA4E;IAC5E,iBAAiB,IAAI,MAAM,EAAE;IAY7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgDG;IACH,OAAO,CAAC,8BAA8B;IAyCtC;;;;;;;OAOG;IACH,OAAO,CAAC,oBAAoB;IAc5B,OAAO,CAAC,YAAY;IAYpB,OAAO,CAAC,kBAAkB;IAc1B,OAAO,CAAC,0BAA0B;IAIlC;;;;;OAKG;IACH,OAAO,CAAC,2BAA2B;CAGpC"}

package/dist/esm/notifications/email/services/email-template-registry.backend.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"email-template-registry.backend.service.js","sourceRoot":"","sources":["../../../../../../src/notifications/email/services/email-template-registry.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;;;;;;;;;;;;;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAIpF,OAAO,EACL,6BAA6B,EAC7B,6BAA6B,EAC7B,4BAA4B,GAC7B,MAAM,oEAAoE,CAAC;AAC5E,OAAO,EAAE,SAAS,EAAE,wBAAwB,EAA2B,MAAM,uBAAuB,CAAC;AAmB9F,IAAM,mCAAmC,GAAzC,MAAM,mCAAmC;IAMQ;IACa;IAEhD;IARX,OAAO,GAAG,IAAI,GAAG,EAA4C,CAAC;IAE5D,QAAQ,CAA+D;IAEjF,YACsD,MAAqB,EACR,YAAwC,EAExF,gBAAyC;QAHN,WAAM,GAAN,MAAM,CAAe;QACR,iBAAY,GAAZ,YAAY,CAA4B;QAExF,qBAAgB,GAAhB,gBAAgB,CAAyB;QAE1D,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,uBAAuB,CAAC,CAAC;QACjE,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,uBAAuB,EAAE,KAAK,CAAC,CAAC;IAClE,CAAC;IAED;;;;;OAKG;IACH,UAAU,CAAC,WAAwC;QACjD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QAErB,KAAK,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/D,MAAM,SAAS,GAAG,IAAI,GAAG,EAA+B,CAAC;YACzD,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5D,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QAC3C,CAAC;QAED,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACvD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,8BAA8B,aAAa,uBAAuB,OAAO,CAAC,IAAI,YAAY,CAAC,CAAC;QAC7G,IAAI,CAAC,8BAA8B,CAAC,OAAO,CAAC,CAAC;IAC/C,CAAC;IAED;;;;;;;;OAQG;IACH,OAAO,CAAC,WAAmB,EAAE,MAAc,EAAE,aAAqB,EAAE,cAAuB;QACzF,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAChD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,kBAAkB,CAAC,WAAW,EAAE,CAAC,MAAM,EAAE,cAAc,EAAE,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QAClI,CAAC;QAED,MAAM,UAAU,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5B,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACxE,IAAI,YAAY,IAAI,YAAY,KAAK,MAAM,EAAE,CAAC;YAC5C,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAChC,CAAC;QACD,IAAI,cAAc,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YAC3D,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAClC,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YACxC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACjC,CAAC;QAED,KAAK,MAAM,eAAe,IAAI,UAAU,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;YAC7C,IAAI,KAAK,EAAE,CAAC;gBACV,IAAI,CAAC,QAAQ,CAAC,mBAAmB,EAAE,EAAE,WAAW,EAAE,cAAc,EAAE,eAAe,EAAE,CAAC,CAAC;gBACrF,OAAO;oBACL,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,cAAc,EAAE,eAAe;iBAChC,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,IAAI,CAAC,kBAAkB,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IACzD,CAAC;IAED;;;;;OAKG;IACH,0BAA0B,CAAC,WAAmB;QAC5C,MAAM,aAAa,GACjB,4BAA4B,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC7D,MAAM,cAAc,GAClB,6BAA6B,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC9D,OAAO,IAAI,CAAC,OAAO,CACjB,WAAW,EACX,aAAa,EACb,aAAa,EACb,cAAc,CACf,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,iBAAiB;QACf,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,KAAK,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACpD,KAAK,MAAM,MAAM,IAAI,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;gBACtC,IAAI,CAAC,IAAI,CAAC,GAAG,WAAW,IAAI,MAAM,EAAE,CAAC,CAAC;YACxC,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,kEAAkE;IAElE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgDG;IACK,8BAA8B,CAAC,iBAA8B;QACnE,MAAM,UAAU,GAAG,wBAAwB,EAAE,CAAC;QAC9C,2FAA2F;QAC3F,wFAAwF;QACxF,6FAA6F;QAC7F,MAAM,uBAAuB,GAAG,IAAI,CAAC,0BAA0B,EAAE,CAAC;QAClE,MAAM,gBAAgB,GAAG,IAAI,CAAC,2BAA2B,EAAE,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,uBAAuB,CAAC,CAAC;QACnH,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAEhD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,uBAAuB,CAAC,EAAE,CAAC;YACpD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mEAAmE,uBAAuB,IAAI,CAAC,CAAC;QACnH,CAAC;QAED,MAAM,iBAAiB,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC,CAAC;QAC/G,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kCAAkC,iBAAiB,CAAC,MAAM,gDAAgD,uBAAuB,MAAM,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1L,CAAC;QAED,KAAK,MAAM,MAAM,IAAI,gBAAgB,EAAE,CAAC;YACtC,MAAM,SAAS,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;YAC1F,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC3B,SAAS;YACX,CAAC;YAED,0FAA0F;YAC1F,6FAA6F;YAC7F,2FAA2F;YAC3F,sDAAsD;YACtD,EAAE;YACF,6FAA6F;YAC7F,6FAA6F;YAC7F,+EAA+E;YAC/E,IAAI,SAAS,CAAC,MAAM,KAAK,cAAc,CAAC,MAAM,EAAE,CAAC;gBAC/C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wDAAwD,MAAM,WAAW,cAAc,CAAC,MAAM,0BAA0B,uBAAuB,2BAA2B,MAAM,4DAA4D,MAAM,2BAA2B,CAAC,CAAC;gBAChS,SAAS;YACX,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kCAAkC,SAAS,CAAC,MAAM,8BAA8B,MAAM,2BAA2B,uBAAuB,YAAY,MAAM,kEAAkE,MAAM,oBAAoB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjS,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACK,oBAAoB,CAAC,WAAmB,EAAE,MAAc;QAC9D,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAChD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACxE,OAAO,OAAO,CAAC,YAAY,IAAI,YAAY,KAAK,MAAM,IAAI,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;IACzF,CAAC;IAED,kEAAkE;IAE1D,YAAY;QAClB,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,IAAI,aAAa,GAAG,CAAC,CAAC;QACtB,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YAC9C,aAAa,IAAI,SAAS,CAAC,IAAI,CAAC;YAChC,KAAK,MAAM,MAAM,IAAI,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;gBACtC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;QACD,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;IACpC,CAAC;IAEO,kBAAkB,CAAC,WAAmB,EAAE,YAAsB;QACpE,OAAO,IAAI,CAAC,YAAY,CAAC,UAAU,CACjC,SAAS,CAAC,aAAa,EACvB,SAAS,EACT;YACE,OAAO,EAAE;gBACP,OAAO,EAAE,mBAAmB,WAAW,+BAA+B,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;gBAChG,WAAW;gBACX,YAAY;aACb;SACF,CACF,CAAC;IACJ,CAAC;IAEO,0BAA0B;QAChC,OAAO,4BAA4B,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACpE,CAAC;IAED;;;;;OAKG;IACK,2BAA2B;QACjC,OAAO,6BAA6B,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACrE,CAAC;CACF,CAAA;AAtQY,mCAAmC;IAD/C,UAAU,EAAE;IAOR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;;GARnC,mCAAmC,CAsQ/C","sourcesContent":["/**\n * Email Template Registry Backend Service\n *\n * In-memory registry for file-based email template definitions.\n * Templates are injected at startup from app-custom via initialize().\n * Resolution uses exact templateRef match with i18n locale fallback.\n *\n * Each template is a locale-agnostic definition (`template.tsx`) paired\n * with co-located per-locale label files (`labels.{locale}.ts`).\n */\n\nimport { injectable, inject } from 'inversify';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport type { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport type { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport {\n  getConfiguredEnabledLanguages,\n  getConfiguredFallbackLanguage,\n  getConfiguredPrimaryLanguage,\n} from '~wildo-backend-lib/config/services/app-configuration.backend.utils';\nimport { ErrorType, getAllSystemTemplateRefs, type WildoError_Backend } from '@wildo-ai/saas-models';\nimport type {\n  EmailTemplateDefinition,\n  EmailTemplateDefinitionsMap,\n} from '~wildo-backend-lib/notifications/email/models/email-template-definition';\n\n/** Resolved template returned by `resolve()`: definition + locale-matched labels. */\nexport interface ResolvedEmailTemplate {\n  definition: EmailTemplateDefinition<any>;\n  labels: Record<string, string>;\n  resolvedLocale: string;\n}\n\ninterface RegistryLocaleEntry {\n  definition: EmailTemplateDefinition<any>;\n  labels: Record<string, string>;\n}\n\n@injectable()\nexport class EmailTemplateRegistryBackendService {\n  private entries = new Map<string, Map<string, RegistryLocaleEntry>>();\n\n  protected logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n    @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private readonly errorBuilder: ErrorBuilderBackendService,\n    @inject(SAAS_SERVICE_TYPES.AppConfigService)\n    private readonly appConfigService: AppConfigurationService,\n  ) {\n    this.logDebug = this.logger.debugByType('EmailTemplateRegistry');\n    this.logger.setDebugTypeLogging('EmailTemplateRegistry', false);\n  }\n\n  /**\n   * Populate the registry from the app-custom template map.\n   *\n   * Keys are bare `templateRef` values. Each entry has a locale-agnostic\n   * template definition + per-locale label objects.\n   */\n  initialize(definitions: EmailTemplateDefinitionsMap): void {\n    this.entries.clear();\n\n    for (const [templateRef, entry] of Object.entries(definitions)) {\n      const localeMap = new Map<string, RegistryLocaleEntry>();\n      for (const [locale, labels] of Object.entries(entry.labels)) {\n        localeMap.set(locale, { definition: entry.template, labels });\n      }\n      this.entries.set(templateRef, localeMap);\n    }\n\n    const { templateCount, locales } = this.computeStats();\n    this.logger.info(`✅ Email template registry: ${templateCount} template(s) across ${locales.size} locale(s)`);\n    this.validateTemplateLocaleCoverage(locales);\n  }\n\n  /**\n   * Resolve a template by ref with i18n locale fallback.\n   *\n   * 1. Exact locale match (e.g. fr-CA)\n   * 2. Base language fallback (e.g. fr)\n   * 3. Configured fallback locale\n   * 4. Configured primary locale\n   * 5. Throw if none found\n   */\n  resolve(templateRef: string, locale: string, primaryLocale: string, fallbackLocale?: string): ResolvedEmailTemplate {\n    const localeMap = this.entries.get(templateRef);\n    if (!localeMap) {\n      throw this.buildNotFoundError(templateRef, [locale, fallbackLocale, primaryLocale].filter((value): value is string => !!value));\n    }\n\n    const candidates = [locale];\n    const baseLanguage = locale.includes('-') ? locale.split('-')[0] : null;\n    if (baseLanguage && baseLanguage !== locale) {\n      candidates.push(baseLanguage);\n    }\n    if (fallbackLocale && !candidates.includes(fallbackLocale)) {\n      candidates.push(fallbackLocale);\n    }\n    if (!candidates.includes(primaryLocale)) {\n      candidates.push(primaryLocale);\n    }\n\n    for (const candidateLocale of candidates) {\n      const entry = localeMap.get(candidateLocale);\n      if (entry) {\n        this.logDebug('Template resolved', { templateRef, resolvedLocale: candidateLocale });\n        return {\n          definition: entry.definition,\n          labels: entry.labels,\n          resolvedLocale: candidateLocale,\n        };\n      }\n    }\n\n    throw this.buildNotFoundError(templateRef, candidates);\n  }\n\n  /**\n   * Resolve exactly as runtime email delivery does for the application's\n   * configured primary/fallback locales. Startup contract validation uses this\n   * seam so template existence is proven against the same locale semantics as\n   * a later send.\n   */\n  resolveForConfiguredLocale(templateRef: string): ResolvedEmailTemplate {\n    const primaryLocale =\n      getConfiguredPrimaryLanguage(this.appConfigService.config);\n    const fallbackLocale =\n      getConfiguredFallbackLanguage(this.appConfigService.config);\n    return this.resolve(\n      templateRef,\n      primaryLocale,\n      primaryLocale,\n      fallbackLocale,\n    );\n  }\n\n  /** Return all registered keys as `{templateRef}/{locale}` (diagnostics). */\n  getRegisteredKeys(): string[] {\n    const keys: string[] = [];\n    for (const [templateRef, localeMap] of this.entries) {\n      for (const locale of localeMap.keys()) {\n        keys.push(`${templateRef}/${locale}`);\n      }\n    }\n    return keys;\n  }\n\n  // ── Validation ─────────────────────────────────────────────────\n\n  /**\n   * Report email-template coverage against EVERY locale the application enables, not only the one\n   * it authors natively.\n   *\n   * ## What was wrong\n   *\n   * This check resolved the configured primary locale once and tested only that. An application\n   * that declares `enabledLanguages: [en, fr]` and ships ninety-five `labels.en.ts` files and zero\n   * `labels.fr.ts` files started with a clean log — Wonder Todos, measured 2026-09-08. Every French\n   * recipient then silently received English, because {@link resolve} falls back through the\n   * configured chain and lands on the primary. Nothing anywhere said so: the frontend reads\n   * `enabledLanguages` and the dev companion reads it, but no backend surface did, so \"the locale\n   * this application owns\" was standing in for \"the locales this application serves\".\n   *\n   * ## Loudness — a WARNING, deliberately, and not an ERROR\n   *\n   * Enabling a language and authoring its email copy are separate acts that happen in that order:\n   * the copy is produced afterwards by the label/translate pipeline. Refusing to boot on the gap\n   * would mean an application cannot start between the two, which is the exact trade the operation\n   * email-template validator already settled in the other direction — \"refusing to START an\n   * application because a notice is unauthored trades a missing email for a total outage, which is\n   * the worse failure\" (`collectOperationEmailTemplateIssues`). A missing SECONDARY locale is\n   * strictly milder than the case that reasoning was written about: the notice is still delivered,\n   * in the wrong language.\n   *\n   * That is also why this stays inside the registry rather than being handed to the startup config\n   * validator, whose token-backed path is an ERROR that crash-loops a boot. Widening\n   * {@link resolveForConfiguredLocale} — the seam that validator resolves through — to demand every\n   * enabled locale would have converted \"ninety-five emails arrive in English\" into \"this\n   * application cannot start\", for the one application the finding came from.\n   *\n   * The warning is not a shrug: it is emitted per non-covered locale, separates the two severities\n   * below, and names the exact `labels.<locale>.ts` file an author has to create — so it is\n   * actionable from the log line alone rather than after an audit.\n   *\n   * ## The two severities it separates\n   *\n   * - **Primary locale** — nothing to fall back TO. A system ref absent here cannot be rendered at\n   *   all, and the send raises `CONFIGURATION`. This is the pre-existing check, unchanged in\n   *   meaning.\n   * - **Any other enabled locale** — the template resolves, in the wrong language. Reported for\n   *   every registered ref rather than only the twelve system ones, because the population that\n   *   goes untranslated is the whole catalog (83 of Wonder Todos' 95 are resource/operation\n   *   templates, which the system-ref loop cannot see).\n   *\n   * Coverage honours the SAME base-language fallback a runtime send uses, so an application that\n   * ships `fr` and enables `fr-CA` is covered rather than reported. It deliberately does NOT accept\n   * a fallback to the primary locale — landing there is the failure being reported.\n   */\n  private validateTemplateLocaleCoverage(registeredLocales: Set<string>): void {\n    const systemRefs = getAllSystemTemplateRefs();\n    // The primary is asked for by name rather than taken off the front of the enabled set: the\n    // helper does put it first, but the two locales carry DIFFERENT severities below, and a\n    // severity split that depends on array order is one refactor away from being silently wrong.\n    const configuredPrimaryLocale = this.getConfiguredPrimaryLocale();\n    const secondaryLocales = this.getConfiguredEnabledLocales().filter((locale) => locale !== configuredPrimaryLocale);\n    const registeredRefs = [...this.entries.keys()];\n\n    if (!registeredLocales.has(configuredPrimaryLocale)) {\n      this.logger.warn(`⚠️ No email templates registered for configured primary locale \"${configuredPrimaryLocale}\".`);\n    }\n\n    const missingSystemRefs = systemRefs.filter((ref) => !this.hasTemplateForLocale(ref, configuredPrimaryLocale));\n    if (missingSystemRefs.length > 0) {\n      this.logger.warn(`⚠️ Missing email templates for ${missingSystemRefs.length} system ref(s) in configured primary locale \"${configuredPrimaryLocale}\": ${missingSystemRefs.join(', ')}`);\n    }\n\n    for (const locale of secondaryLocales) {\n      const uncovered = registeredRefs.filter((ref) => !this.hasTemplateForLocale(ref, locale));\n      if (uncovered.length === 0) {\n        continue;\n      }\n\n      // Two shapes, because \"none of them\" and \"some of them\" have different remedies. When the\n      // whole catalog is uncovered, enumerating it is noise — Wonder Todos would print ninety-five\n      // refs to say \"translate everything\" — so the headline states the total instead. When only\n      // some are, the names ARE the remedy and are printed.\n      //\n      // Note the totality is measured against `uncovered.length`, not against `registeredLocales`:\n      // that set is exact-match only, so an app shipping `fr` while enabling `fr-CA` would read as\n      // having nothing in `fr-CA` when every one of its templates in fact covers it.\n      if (uncovered.length === registeredRefs.length) {\n        this.logger.warn(`⚠️ No email templates registered for enabled locale \"${locale}\" — all ${registeredRefs.length} of them fall back to \"${configuredPrimaryLocale}\", so every email to a \"${locale}\" recipient is sent in the wrong language. Author labels.${locale}.ts beside each template.`);\n        continue;\n      }\n\n      this.logger.warn(`⚠️ Missing email templates for ${uncovered.length} ref(s) in enabled locale \"${locale}\" — these fall back to \"${configuredPrimaryLocale}\", so a \"${locale}\" recipient receives them in the wrong language. Create labels.${locale}.ts beside each: ${uncovered.join(', ')}`);\n    }\n  }\n\n  /**\n   * Does this ref have labels a recipient in `locale` would actually receive?\n   *\n   * Mirrors the first two candidates of {@link resolve} — exact locale, then base language — and\n   * stops there on purpose. The remaining candidates (configured fallback, configured primary) are\n   * what make an uncovered locale silent at runtime, so accepting them here would make the check\n   * agree with the defect instead of reporting it.\n   */\n  private hasTemplateForLocale(templateRef: string, locale: string): boolean {\n    const localeMap = this.entries.get(templateRef);\n    if (!localeMap) {\n      return false;\n    }\n    if (localeMap.has(locale)) {\n      return true;\n    }\n    const baseLanguage = locale.includes('-') ? locale.split('-')[0] : null;\n    return Boolean(baseLanguage && baseLanguage !== locale && localeMap.has(baseLanguage));\n  }\n\n  // ── Helpers ────────────────────────────────────────────────────\n\n  private computeStats(): { templateCount: number; locales: Set<string> } {\n    const locales = new Set<string>();\n    let templateCount = 0;\n    for (const localeMap of this.entries.values()) {\n      templateCount += localeMap.size;\n      for (const locale of localeMap.keys()) {\n        locales.add(locale);\n      }\n    }\n    return { templateCount, locales };\n  }\n\n  private buildNotFoundError(templateRef: string, triedLocales: string[]): WildoError_Backend {\n    return this.errorBuilder.buildError(\n      ErrorType.CONFIGURATION,\n      undefined,\n      {\n        context: {\n          message: `Email template \"${templateRef}\" not found for any locale [${triedLocales.join(', ')}]`,\n          templateRef,\n          triedLocales,\n        },\n      },\n    );\n  }\n\n  private getConfiguredPrimaryLocale(): string {\n    return getConfiguredPrimaryLanguage(this.appConfigService.config);\n  }\n\n  /**\n   * Every locale this application enables, primary first. Delegates to the named config helper so\n   * the registry does not re-derive the enabled set — it is the same question the frontend's\n   * language switcher and the companion's translate pass answer, and three private derivations of\n   * one set is how they come to disagree.\n   */\n  private getConfiguredEnabledLocales(): string[] {\n    return getConfiguredEnabledLanguages(this.appConfigService.config);\n  }\n}\n"]}
+{"version":3,"file":"email-template-registry.backend.service.js","sourceRoot":"","sources":["../../../../../src/notifications/email/services/email-template-registry.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;;;;;;;;;;;;;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAIpF,OAAO,EACL,6BAA6B,EAC7B,6BAA6B,EAC7B,4BAA4B,GAC7B,MAAM,oEAAoE,CAAC;AAC5E,OAAO,EAAE,SAAS,EAAE,wBAAwB,EAA2B,MAAM,uBAAuB,CAAC;AAmB9F,IAAM,mCAAmC,GAAzC,MAAM,mCAAmC;IAMQ;IACa;IAEhD;IARX,OAAO,GAAG,IAAI,GAAG,EAA4C,CAAC;IAE5D,QAAQ,CAA+D;IAEjF,YACsD,MAAqB,EACR,YAAwC,EAExF,gBAAyC;QAHN,WAAM,GAAN,MAAM,CAAe;QACR,iBAAY,GAAZ,YAAY,CAA4B;QAExF,qBAAgB,GAAhB,gBAAgB,CAAyB;QAE1D,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,uBAAuB,CAAC,CAAC;QACjE,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,uBAAuB,EAAE,KAAK,CAAC,CAAC;IAClE,CAAC;IAED;;;;;OAKG;IACH,UAAU,CAAC,WAAwC;QACjD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QAErB,KAAK,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/D,MAAM,SAAS,GAAG,IAAI,GAAG,EAA+B,CAAC;YACzD,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5D,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QAC3C,CAAC;QAED,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACvD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,8BAA8B,aAAa,uBAAuB,OAAO,CAAC,IAAI,YAAY,CAAC,CAAC;QAC7G,IAAI,CAAC,8BAA8B,CAAC,OAAO,CAAC,CAAC;IAC/C,CAAC;IAED;;;;;;;;OAQG;IACH,OAAO,CAAC,WAAmB,EAAE,MAAc,EAAE,aAAqB,EAAE,cAAuB;QACzF,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAChD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,kBAAkB,CAAC,WAAW,EAAE,CAAC,MAAM,EAAE,cAAc,EAAE,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QAClI,CAAC;QAED,MAAM,UAAU,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5B,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACxE,IAAI,YAAY,IAAI,YAAY,KAAK,MAAM,EAAE,CAAC;YAC5C,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAChC,CAAC;QACD,IAAI,cAAc,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YAC3D,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAClC,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YACxC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACjC,CAAC;QAED,KAAK,MAAM,eAAe,IAAI,UAAU,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;YAC7C,IAAI,KAAK,EAAE,CAAC;gBACV,IAAI,CAAC,QAAQ,CAAC,mBAAmB,EAAE,EAAE,WAAW,EAAE,cAAc,EAAE,eAAe,EAAE,CAAC,CAAC;gBACrF,OAAO;oBACL,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,cAAc,EAAE,eAAe;iBAChC,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,IAAI,CAAC,kBAAkB,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IACzD,CAAC;IAED;;;;;OAKG;IACH,0BAA0B,CAAC,WAAmB;QAC5C,MAAM,aAAa,GACjB,4BAA4B,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC7D,MAAM,cAAc,GAClB,6BAA6B,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC9D,OAAO,IAAI,CAAC,OAAO,CACjB,WAAW,EACX,aAAa,EACb,aAAa,EACb,cAAc,CACf,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,iBAAiB;QACf,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,KAAK,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACpD,KAAK,MAAM,MAAM,IAAI,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;gBACtC,IAAI,CAAC,IAAI,CAAC,GAAG,WAAW,IAAI,MAAM,EAAE,CAAC,CAAC;YACxC,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,kEAAkE;IAElE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgDG;IACK,8BAA8B,CAAC,iBAA8B;QACnE,MAAM,UAAU,GAAG,wBAAwB,EAAE,CAAC;QAC9C,2FAA2F;QAC3F,wFAAwF;QACxF,6FAA6F;QAC7F,MAAM,uBAAuB,GAAG,IAAI,CAAC,0BAA0B,EAAE,CAAC;QAClE,MAAM,gBAAgB,GAAG,IAAI,CAAC,2BAA2B,EAAE,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,uBAAuB,CAAC,CAAC;QACnH,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAEhD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,uBAAuB,CAAC,EAAE,CAAC;YACpD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mEAAmE,uBAAuB,IAAI,CAAC,CAAC;QACnH,CAAC;QAED,MAAM,iBAAiB,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC,CAAC;QAC/G,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kCAAkC,iBAAiB,CAAC,MAAM,gDAAgD,uBAAuB,MAAM,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1L,CAAC;QAED,KAAK,MAAM,MAAM,IAAI,gBAAgB,EAAE,CAAC;YACtC,MAAM,SAAS,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;YAC1F,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC3B,SAAS;YACX,CAAC;YAED,0FAA0F;YAC1F,6FAA6F;YAC7F,2FAA2F;YAC3F,sDAAsD;YACtD,EAAE;YACF,6FAA6F;YAC7F,6FAA6F;YAC7F,+EAA+E;YAC/E,IAAI,SAAS,CAAC,MAAM,KAAK,cAAc,CAAC,MAAM,EAAE,CAAC;gBAC/C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wDAAwD,MAAM,WAAW,cAAc,CAAC,MAAM,0BAA0B,uBAAuB,2BAA2B,MAAM,4DAA4D,MAAM,2BAA2B,CAAC,CAAC;gBAChS,SAAS;YACX,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kCAAkC,SAAS,CAAC,MAAM,8BAA8B,MAAM,2BAA2B,uBAAuB,YAAY,MAAM,kEAAkE,MAAM,oBAAoB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjS,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACK,oBAAoB,CAAC,WAAmB,EAAE,MAAc;QAC9D,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAChD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACxE,OAAO,OAAO,CAAC,YAAY,IAAI,YAAY,KAAK,MAAM,IAAI,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;IACzF,CAAC;IAED,kEAAkE;IAE1D,YAAY;QAClB,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,IAAI,aAAa,GAAG,CAAC,CAAC;QACtB,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YAC9C,aAAa,IAAI,SAAS,CAAC,IAAI,CAAC;YAChC,KAAK,MAAM,MAAM,IAAI,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;gBACtC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;QACD,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;IACpC,CAAC;IAEO,kBAAkB,CAAC,WAAmB,EAAE,YAAsB;QACpE,OAAO,IAAI,CAAC,YAAY,CAAC,UAAU,CACjC,SAAS,CAAC,aAAa,EACvB,SAAS,EACT;YACE,OAAO,EAAE;gBACP,OAAO,EAAE,mBAAmB,WAAW,+BAA+B,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;gBAChG,WAAW;gBACX,YAAY;aACb;SACF,CACF,CAAC;IACJ,CAAC;IAEO,0BAA0B;QAChC,OAAO,4BAA4B,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACpE,CAAC;IAED;;;;;OAKG;IACK,2BAA2B;QACjC,OAAO,6BAA6B,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACrE,CAAC;CACF,CAAA;AAtQY,mCAAmC;IAD/C,UAAU,EAAE;IAOR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;;GARnC,mCAAmC,CAsQ/C","sourcesContent":["/**\n * Email Template Registry Backend Service\n *\n * In-memory registry for file-based email template definitions.\n * Templates are injected at startup from app-custom via initialize().\n * Resolution uses exact templateRef match with i18n locale fallback.\n *\n * Each template is a locale-agnostic definition (`template.tsx`) paired\n * with co-located per-locale label files (`labels.{locale}.ts`).\n */\n\nimport { injectable, inject } from 'inversify';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport type { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport type { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport {\n  getConfiguredEnabledLanguages,\n  getConfiguredFallbackLanguage,\n  getConfiguredPrimaryLanguage,\n} from '~wildo-backend-lib/config/services/app-configuration.backend.utils';\nimport { ErrorType, getAllSystemTemplateRefs, type WildoError_Backend } from '@wildo-ai/saas-models';\nimport type {\n  EmailTemplateDefinition,\n  EmailTemplateDefinitionsMap,\n} from '~wildo-backend-lib/notifications/email/models/email-template-definition';\n\n/** Resolved template returned by `resolve()`: definition + locale-matched labels. */\nexport interface ResolvedEmailTemplate {\n  definition: EmailTemplateDefinition<any>;\n  labels: Record<string, string>;\n  resolvedLocale: string;\n}\n\ninterface RegistryLocaleEntry {\n  definition: EmailTemplateDefinition<any>;\n  labels: Record<string, string>;\n}\n\n@injectable()\nexport class EmailTemplateRegistryBackendService {\n  private entries = new Map<string, Map<string, RegistryLocaleEntry>>();\n\n  protected logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n    @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private readonly errorBuilder: ErrorBuilderBackendService,\n    @inject(SAAS_SERVICE_TYPES.AppConfigService)\n    private readonly appConfigService: AppConfigurationService,\n  ) {\n    this.logDebug = this.logger.debugByType('EmailTemplateRegistry');\n    this.logger.setDebugTypeLogging('EmailTemplateRegistry', false);\n  }\n\n  /**\n   * Populate the registry from the app-custom template map.\n   *\n   * Keys are bare `templateRef` values. Each entry has a locale-agnostic\n   * template definition + per-locale label objects.\n   */\n  initialize(definitions: EmailTemplateDefinitionsMap): void {\n    this.entries.clear();\n\n    for (const [templateRef, entry] of Object.entries(definitions)) {\n      const localeMap = new Map<string, RegistryLocaleEntry>();\n      for (const [locale, labels] of Object.entries(entry.labels)) {\n        localeMap.set(locale, { definition: entry.template, labels });\n      }\n      this.entries.set(templateRef, localeMap);\n    }\n\n    const { templateCount, locales } = this.computeStats();\n    this.logger.info(`✅ Email template registry: ${templateCount} template(s) across ${locales.size} locale(s)`);\n    this.validateTemplateLocaleCoverage(locales);\n  }\n\n  /**\n   * Resolve a template by ref with i18n locale fallback.\n   *\n   * 1. Exact locale match (e.g. fr-CA)\n   * 2. Base language fallback (e.g. fr)\n   * 3. Configured fallback locale\n   * 4. Configured primary locale\n   * 5. Throw if none found\n   */\n  resolve(templateRef: string, locale: string, primaryLocale: string, fallbackLocale?: string): ResolvedEmailTemplate {\n    const localeMap = this.entries.get(templateRef);\n    if (!localeMap) {\n      throw this.buildNotFoundError(templateRef, [locale, fallbackLocale, primaryLocale].filter((value): value is string => !!value));\n    }\n\n    const candidates = [locale];\n    const baseLanguage = locale.includes('-') ? locale.split('-')[0] : null;\n    if (baseLanguage && baseLanguage !== locale) {\n      candidates.push(baseLanguage);\n    }\n    if (fallbackLocale && !candidates.includes(fallbackLocale)) {\n      candidates.push(fallbackLocale);\n    }\n    if (!candidates.includes(primaryLocale)) {\n      candidates.push(primaryLocale);\n    }\n\n    for (const candidateLocale of candidates) {\n      const entry = localeMap.get(candidateLocale);\n      if (entry) {\n        this.logDebug('Template resolved', { templateRef, resolvedLocale: candidateLocale });\n        return {\n          definition: entry.definition,\n          labels: entry.labels,\n          resolvedLocale: candidateLocale,\n        };\n      }\n    }\n\n    throw this.buildNotFoundError(templateRef, candidates);\n  }\n\n  /**\n   * Resolve exactly as runtime email delivery does for the application's\n   * configured primary/fallback locales. Startup contract validation uses this\n   * seam so template existence is proven against the same locale semantics as\n   * a later send.\n   */\n  resolveForConfiguredLocale(templateRef: string): ResolvedEmailTemplate {\n    const primaryLocale =\n      getConfiguredPrimaryLanguage(this.appConfigService.config);\n    const fallbackLocale =\n      getConfiguredFallbackLanguage(this.appConfigService.config);\n    return this.resolve(\n      templateRef,\n      primaryLocale,\n      primaryLocale,\n      fallbackLocale,\n    );\n  }\n\n  /** Return all registered keys as `{templateRef}/{locale}` (diagnostics). */\n  getRegisteredKeys(): string[] {\n    const keys: string[] = [];\n    for (const [templateRef, localeMap] of this.entries) {\n      for (const locale of localeMap.keys()) {\n        keys.push(`${templateRef}/${locale}`);\n      }\n    }\n    return keys;\n  }\n\n  // ── Validation ─────────────────────────────────────────────────\n\n  /**\n   * Report email-template coverage against EVERY locale the application enables, not only the one\n   * it authors natively.\n   *\n   * ## What was wrong\n   *\n   * This check resolved the configured primary locale once and tested only that. An application\n   * that declares `enabledLanguages: [en, fr]` and ships ninety-five `labels.en.ts` files and zero\n   * `labels.fr.ts` files started with a clean log — Wonder Todos, measured 2026-09-08. Every French\n   * recipient then silently received English, because {@link resolve} falls back through the\n   * configured chain and lands on the primary. Nothing anywhere said so: the frontend reads\n   * `enabledLanguages` and the dev companion reads it, but no backend surface did, so \"the locale\n   * this application owns\" was standing in for \"the locales this application serves\".\n   *\n   * ## Loudness — a WARNING, deliberately, and not an ERROR\n   *\n   * Enabling a language and authoring its email copy are separate acts that happen in that order:\n   * the copy is produced afterwards by the label/translate pipeline. Refusing to boot on the gap\n   * would mean an application cannot start between the two, which is the exact trade the operation\n   * email-template validator already settled in the other direction — \"refusing to START an\n   * application because a notice is unauthored trades a missing email for a total outage, which is\n   * the worse failure\" (`collectOperationEmailTemplateIssues`). A missing SECONDARY locale is\n   * strictly milder than the case that reasoning was written about: the notice is still delivered,\n   * in the wrong language.\n   *\n   * That is also why this stays inside the registry rather than being handed to the startup config\n   * validator, whose token-backed path is an ERROR that crash-loops a boot. Widening\n   * {@link resolveForConfiguredLocale} — the seam that validator resolves through — to demand every\n   * enabled locale would have converted \"ninety-five emails arrive in English\" into \"this\n   * application cannot start\", for the one application the finding came from.\n   *\n   * The warning is not a shrug: it is emitted per non-covered locale, separates the two severities\n   * below, and names the exact `labels.<locale>.ts` file an author has to create — so it is\n   * actionable from the log line alone rather than after an audit.\n   *\n   * ## The two severities it separates\n   *\n   * - **Primary locale** — nothing to fall back TO. A system ref absent here cannot be rendered at\n   *   all, and the send raises `CONFIGURATION`. This is the pre-existing check, unchanged in\n   *   meaning.\n   * - **Any other enabled locale** — the template resolves, in the wrong language. Reported for\n   *   every registered ref rather than only the twelve system ones, because the population that\n   *   goes untranslated is the whole catalog (83 of Wonder Todos' 95 are resource/operation\n   *   templates, which the system-ref loop cannot see).\n   *\n   * Coverage honours the SAME base-language fallback a runtime send uses, so an application that\n   * ships `fr` and enables `fr-CA` is covered rather than reported. It deliberately does NOT accept\n   * a fallback to the primary locale — landing there is the failure being reported.\n   */\n  private validateTemplateLocaleCoverage(registeredLocales: Set<string>): void {\n    const systemRefs = getAllSystemTemplateRefs();\n    // The primary is asked for by name rather than taken off the front of the enabled set: the\n    // helper does put it first, but the two locales carry DIFFERENT severities below, and a\n    // severity split that depends on array order is one refactor away from being silently wrong.\n    const configuredPrimaryLocale = this.getConfiguredPrimaryLocale();\n    const secondaryLocales = this.getConfiguredEnabledLocales().filter((locale) => locale !== configuredPrimaryLocale);\n    const registeredRefs = [...this.entries.keys()];\n\n    if (!registeredLocales.has(configuredPrimaryLocale)) {\n      this.logger.warn(`⚠️ No email templates registered for configured primary locale \"${configuredPrimaryLocale}\".`);\n    }\n\n    const missingSystemRefs = systemRefs.filter((ref) => !this.hasTemplateForLocale(ref, configuredPrimaryLocale));\n    if (missingSystemRefs.length > 0) {\n      this.logger.warn(`⚠️ Missing email templates for ${missingSystemRefs.length} system ref(s) in configured primary locale \"${configuredPrimaryLocale}\": ${missingSystemRefs.join(', ')}`);\n    }\n\n    for (const locale of secondaryLocales) {\n      const uncovered = registeredRefs.filter((ref) => !this.hasTemplateForLocale(ref, locale));\n      if (uncovered.length === 0) {\n        continue;\n      }\n\n      // Two shapes, because \"none of them\" and \"some of them\" have different remedies. When the\n      // whole catalog is uncovered, enumerating it is noise — Wonder Todos would print ninety-five\n      // refs to say \"translate everything\" — so the headline states the total instead. When only\n      // some are, the names ARE the remedy and are printed.\n      //\n      // Note the totality is measured against `uncovered.length`, not against `registeredLocales`:\n      // that set is exact-match only, so an app shipping `fr` while enabling `fr-CA` would read as\n      // having nothing in `fr-CA` when every one of its templates in fact covers it.\n      if (uncovered.length === registeredRefs.length) {\n        this.logger.warn(`⚠️ No email templates registered for enabled locale \"${locale}\" — all ${registeredRefs.length} of them fall back to \"${configuredPrimaryLocale}\", so every email to a \"${locale}\" recipient is sent in the wrong language. Author labels.${locale}.ts beside each template.`);\n        continue;\n      }\n\n      this.logger.warn(`⚠️ Missing email templates for ${uncovered.length} ref(s) in enabled locale \"${locale}\" — these fall back to \"${configuredPrimaryLocale}\", so a \"${locale}\" recipient receives them in the wrong language. Create labels.${locale}.ts beside each: ${uncovered.join(', ')}`);\n    }\n  }\n\n  /**\n   * Does this ref have labels a recipient in `locale` would actually receive?\n   *\n   * Mirrors the first two candidates of {@link resolve} — exact locale, then base language — and\n   * stops there on purpose. The remaining candidates (configured fallback, configured primary) are\n   * what make an uncovered locale silent at runtime, so accepting them here would make the check\n   * agree with the defect instead of reporting it.\n   */\n  private hasTemplateForLocale(templateRef: string, locale: string): boolean {\n    const localeMap = this.entries.get(templateRef);\n    if (!localeMap) {\n      return false;\n    }\n    if (localeMap.has(locale)) {\n      return true;\n    }\n    const baseLanguage = locale.includes('-') ? locale.split('-')[0] : null;\n    return Boolean(baseLanguage && baseLanguage !== locale && localeMap.has(baseLanguage));\n  }\n\n  // ── Helpers ────────────────────────────────────────────────────\n\n  private computeStats(): { templateCount: number; locales: Set<string> } {\n    const locales = new Set<string>();\n    let templateCount = 0;\n    for (const localeMap of this.entries.values()) {\n      templateCount += localeMap.size;\n      for (const locale of localeMap.keys()) {\n        locales.add(locale);\n      }\n    }\n    return { templateCount, locales };\n  }\n\n  private buildNotFoundError(templateRef: string, triedLocales: string[]): WildoError_Backend {\n    return this.errorBuilder.buildError(\n      ErrorType.CONFIGURATION,\n      undefined,\n      {\n        context: {\n          message: `Email template \"${templateRef}\" not found for any locale [${triedLocales.join(', ')}]`,\n          templateRef,\n          triedLocales,\n        },\n      },\n    );\n  }\n\n  private getConfiguredPrimaryLocale(): string {\n    return getConfiguredPrimaryLanguage(this.appConfigService.config);\n  }\n\n  /**\n   * Every locale this application enables, primary first. Delegates to the named config helper so\n   * the registry does not re-derive the enabled set — it is the same question the frontend's\n   * language switcher and the companion's translate pass answer, and three private derivations of\n   * one set is how they come to disagree.\n   */\n  private getConfiguredEnabledLocales(): string[] {\n    return getConfiguredEnabledLanguages(this.appConfigService.config);\n  }\n}\n"]}

package/dist/esm/notifications/email/services/email-template-validator.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"email-template-validator.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/notifications/email/services/email-template-validator.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAMlG,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAMD;;;GAGG;AACH,eAAO,MAAM,8BAA8B,EAAE,MAAM,EAqBlD,CAAC;AA0CF,qBACa,oCAAoC;IAIV,OAAO,CAAC,QAAQ,CAAC,MAAM;IAH5D,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;gBAG3B,MAAM,EAAE,aAAa;IAM3E;;;;;OAKG;IACG,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAyC/D;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAc9B;;OAEG;IACH,OAAO,CAAC,eAAe;IA2BvB;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IAsBhC;;OAEG;YACW,WAAW;IAwCzB;;OAEG;IACH,iBAAiB,IAAI,MAAM,EAAE;CAG9B"}
+{"version":3,"file":"email-template-validator.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/notifications/email/services/email-template-validator.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAMlG,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAMD;;;GAGG;AACH,eAAO,MAAM,8BAA8B,EAAE,MAAM,EAqBlD,CAAC;AA0CF,qBACa,oCAAoC;IAIV,OAAO,CAAC,QAAQ,CAAC,MAAM;IAH5D,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;gBAG3B,MAAM,EAAE,aAAa;IAM3E;;;;;OAKG;IACG,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAyC/D;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAc9B;;OAEG;IACH,OAAO,CAAC,eAAe;IA2BvB;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IAsBhC;;OAEG;YACW,WAAW;IAwCzB;;OAEG;IACH,iBAAiB,IAAI,MAAM,EAAE;CAG9B"}