chore(sync): merge beta into alpha preserving validation policy

.nvmrc

@@ -1 +1 @@
-22.14.0
+22

Dockerfile

@@ -1,4 +1,4 @@
-FROM node:22
+FROM node:22 AS base
 
 # Define build arguments
 ARG VERSION=dev
@@ -26,15 +26,27 @@ WORKDIR /usr/src/app
 # where available (npm@5+)
 COPY package*.json ./
 
-# Install the app dependencies
-RUN npm ci --only=production
-
-# Copy app source
-COPY . .
-
 # Set version as environment variable for runtime access
 ENV APP_VERSION=${VERSION} \
     GIT_COMMIT=${REVISION} \
     BUILD_DATE=${BUILDTIME}
 
-CMD [ "npm", "start" ]
+FROM base AS dev
+
+# Install development dependencies.
+RUN npm ci
+
+# Copy app source
+COPY . .
+
+CMD [ "node", "./bin/www" ]
+
+FROM base AS production
+
+# Install the app dependencies
+RUN npm ci --omit=dev
+
+# Copy app source
+COPY . .
+
+CMD [ "npm", "start" ]

app/api/definitions/components/stix-common.yml

@@ -38,12 +38,22 @@ components:
         created:
           type: string
           format: date-time
+          description: >-
+            Creation timestamp. Authoring POSTs for an existing object preserve
+            the value from the latest stored revision and ignore client overrides.
+            Earlier revisions are not consulted for recovery.
+            Bundle imports retain the source value.
         modified:
           type: string
           format: date-time
         created_by_ref:
           type: string
           example: 'identity--6444f546-6900-4456-b3b1-015c88d70dab'
+          description: >-
+            Original creator identity. Authoring revisions preserve the value,
+            including its absence, from the latest stored revision and ignore
+            client overrides. Existing objects are not backfilled with the current
+            organization identity. Bundle imports retain source attribution.
         revoked:
           type: boolean
           example: false

app/config/allowed-values.json

@@ -27,17 +27,7 @@
           },
           {
             "domainName": "ics-attack",
-            "allowedValues": [
-              "Field Controller/RTU/PLC/IED",
-              "Safety Instrumented System/Protection Relay",
-              "Control Server",
-              "Input/Output Server",
-              "Data Historian",
-              "Human-Machine Interface",
-              "Engineering Workstation",
-              "None",
-              "Windows"
-            ]
+            "allowedValues": ["Windows", "Linux", "Network Devices", "Embedded", "None"]
           }
         ]
       }

app/lib/event-constants.js

@@ -174,4 +174,6 @@ module.exports = Object.freeze({
   // Listeners reconcile workspace.release_tracks backrefs on their own documents.
   RELEASE_TRACK_CONTENTS_CHANGED: 'release-track::contents-changed',
   RELEASE_TRACK_OBJECTS_REVIEWED: 'release-track::objects-reviewed',
+  RELEASE_TRACK_OBJECT_DELETION_REQUESTED: 'release-track::object-deletion-requested',
+  RELEASE_TRACK_OBJECT_DELETION_COMPLETED: 'release-track::object-deletion-completed',
 });

app/repository/_base.repository.js

@@ -187,6 +187,16 @@ class BaseRepository extends AbstractRepository {
     }
   }
 
+  async hasOtherVersions(stixId, modified) {
+    try {
+      return Boolean(
+        await this.model.exists({ 'stix.id': stixId, 'stix.modified': { $ne: modified } }).exec(),
+      );
+    } catch (err) {
+      throw new DatabaseError(err);
+    }
+  }
+
   async retrieveAllById(stixId) {
     try {
       // .lean() bypasses Mongoose toJSON/toObject transforms, so .select()
@@ -697,13 +707,15 @@ class BaseRepository extends AbstractRepository {
   }
 
   /**
-   * Return every release-track ID present in denormalized object backrefs.
-   * Used only by administrative full-scan repair so deleted tracks with stale
-   * backrefs are included alongside registry-backed tracks.
+   * Return release-track IDs present in denormalized object backrefs.
+   * An optional STIX ID bounds deletion retry cleanup to the affected object;
+   * administrative full-scan repair omits it to include all stale backrefs.
    */
-  async distinctReleaseTrackIds() {
+  async distinctReleaseTrackIds(stixId) {
     try {
-      return await this.model.distinct('workspace.release_tracks.id').exec();
+      return await this.model
+        .distinct('workspace.release_tracks.id', stixId ? { 'stix.id': stixId } : {})
+        .exec();
     } catch (err) {
       throw new DatabaseError(err);
     }

app/repository/release-tracks/release-track-dynamic.repository.js

@@ -503,6 +503,43 @@ class ReleaseTrackDynamicRepository {
     }
   }
 
+  /**
+   * Workflow selectors are mutable metadata, including on historical snapshots.
+   * Never change snapshot identity, members, or sealed content while retracting
+   * references to an object that is about to be deleted.
+   */
+  async removeWorkflowObjectReferences(trackId, stixId, stixModified, hasSurvivingVersions) {
+    try {
+      const Model = this._getModel(trackId);
+      const pull = {};
+      for (const tier of ['candidates', 'staged', 'quarantine']) {
+        const selector = { object_ref: stixId };
+        if (stixModified !== undefined) {
+          const modified = new Date(stixModified);
+          // Quarantine entries always use exact revisions, unlike the two
+          // standard-track workflow tiers, which also allow dynamic selectors.
+          selector.object_modified =
+            hasSurvivingVersions || tier === 'quarantine'
+              ? modified
+              : { $in: [modified, 'latest'] };
+        }
+        pull[tier] = selector;
+      }
+      return await Model.updateMany(
+        {
+          id: trackId,
+          $or: Object.entries(pull).map(([tier, selector]) => ({
+            [tier]: { $elemMatch: selector },
+          })),
+        },
+        { $pull: pull },
+        { runValidators: true },
+      ).exec();
+    } catch (err) {
+      throw new DatabaseError(err);
+    }
+  }
+
   /**
    * Replace a tagged snapshot's content manifest. Used by administrative
    * source-attested reconstruction, which must name the manifest it expects

app/repository/release-tracks/release-track-registry.repository.js

@@ -128,6 +128,20 @@ class ReleaseTrackRegistryRepository {
     }
   }
 
+  async findTrackBatch(afterTrackId) {
+    try {
+      return await this.model
+        .find(afterTrackId ? { track_id: { $gt: afterTrackId } } : {})
+        .select({ _id: 0, track_id: 1 })
+        .sort({ track_id: 1 })
+        .limit(100)
+        .lean()
+        .exec();
+    } catch (err) {
+      throw new DatabaseError(err);
+    }
+  }
+
   async findVirtualTrackBatch(afterTrackId) {
     return this.model
       .find({

app/services/meta-classes/base.service.js

@@ -39,6 +39,7 @@ const WorkflowResult = require('../../lib/workflow-result');
 const graphWriteLock = require('../../lib/graph-write-lock');
 const lifecycle = require('../stix/lifecycle-service');
 const EventBus = require('../../lib/event-bus');
+const Events = require('../../lib/event-constants');
 // Import required repositories
 const systemConfigurationRepository = require('../../repository/system-configurations-repository');
 const identitiesRepository = require('../../repository/identities-repository');
@@ -107,8 +108,8 @@ class BaseService extends ServiceWithHooks {
   }
 
   /**
-   * Whether create() should stamp created_by_ref and x_mitre_modified_by_ref
-   * with the active organization identity.
+   * Whether create() should stamp brand-new objects' created_by_ref and each
+   * authoring revision's x_mitre_modified_by_ref with the active organization identity.
    *
    * Most ATT&CK objects are attributed to an organization identity. Identity
    * objects themselves opt out so first-time setup can create the placeholder
@@ -365,10 +366,10 @@ class BaseService extends ServiceWithHooks {
    *
    * Note: Fields like `created_by_ref`, `x_mitre_modified_by_ref`, and `object_marking_refs`
    * are intentionally NOT here — they are only server-controlled in certain contexts
-   * (e.g., new objects only, specific STIX types) or use merge semantics (marking definitions).
+   * (e.g., authoring revisions, specific STIX types) or use merge semantics (marking definitions).
    * Their handling remains in the existing composition logic of create() and updateFull().
    *
-   * Future additions: 'id', 'created', 'modified' (when server takes control of these)
+   * Existing-object created timestamps are preserved during create() composition.
    */
   static ALWAYS_STRIPPED_STIX_FIELDS = ['x_mitre_attack_spec_version', 'revoked'];
 
@@ -562,10 +563,8 @@ class BaseService extends ServiceWithHooks {
     // Determine if this is a new object or a new version of an existing object
     let existingVersion = null;
     if (data.stix?.id) {
-      // TODO change this to repository's get latest method - there should be a method for that
-      const existingVersions = await this.repository.retrieveAllById(data.stix.id);
-      if (existingVersions?.length > 0) {
-        existingVersion = existingVersions[0];
+      existingVersion = await this.repository.retrieveLatestByStixIdLean(data.stix.id);
+      if (existingVersion) {
         logger.debug(
           `Found existing version(s) with stix.id: ${data.stix.id}, will reuse attack_id: ${existingVersion.workspace?.attack_id}`,
         );
@@ -668,14 +667,16 @@ class BaseService extends ServiceWithHooks {
       ? await this.retrieveOrganizationIdentityRef()
       : null;
 
-    // Check for an existing object (may differ from existingVersion if stix.id was just generated)
-    let existingObject;
-    if (data.stix.id) {
-      existingObject = await this.repository.retrieveLatestByStixId(data.stix.id);
-    }
-
+    const existingObject = existingVersion;
     if (existingObject) {
-      // New version of an existing object — carry forward revoked status, set modified_by
+      // Preserve latest creation provenance; only an absent creator may be explicitly set.
+      data.stix.created =
+        existingObject.stix.created instanceof Date
+          ? existingObject.stix.created.toISOString()
+          : existingObject.stix.created;
+      if (existingObject.stix.created_by_ref !== undefined) {
+        data.stix.created_by_ref = existingObject.stix.created_by_ref;
+      }
       data.stix.revoked = existingObject.stix.revoked ?? false;
       if (organizationIdentityRef) {
         data.stix.x_mitre_modified_by_ref = organizationIdentityRef;
@@ -1175,6 +1176,30 @@ class BaseService extends ServiceWithHooks {
     }
   }
 
+  async _prepareReleaseTrackDeletion(stixId, stixModified) {
+    // Standalone service callers need the same required listener as HTTP
+    // requests. The listener owns all release-track writes.
+    require('../release-tracks/object-deletion-service');
+    const hasSurvivingVersions =
+      stixModified !== undefined && (await this.repository.hasOtherVersions(stixId, stixModified));
+    const backrefTrackIds = await this.repository.distinctReleaseTrackIds(stixId);
+    const results = await EventBus.emitRequired(
+      Events.RELEASE_TRACK_OBJECT_DELETION_REQUESTED,
+      { stixId, stixModified, hasSurvivingVersions, backrefTrackIds },
+      { minimumListeners: 1 },
+    );
+    return results.flatMap((result) => result.dynamicLatestTrackIds || []);
+  }
+
+  async _completeReleaseTrackDeletion(trackIds) {
+    if (trackIds.length === 0) return;
+    await EventBus.emitRequired(
+      Events.RELEASE_TRACK_OBJECT_DELETION_COMPLETED,
+      { trackIds },
+      { minimumListeners: 1 },
+    );
+  }
+
   // TODO rename to deleteVersionByStixId and repurpose the existing name for deleting by the document's unique _id
   async deleteVersionById(stixId, stixModified) {
     if (!graphWriteLock.isHeld()) {
@@ -1195,13 +1220,16 @@ class BaseService extends ServiceWithHooks {
     // Members-pinned revisions are released content — they must never be
     // deleted (the track's member entry would silently dangle).
     const existing = await this.repository.retrieveOneByVersion(stixId, stixModified);
-    if (!existing) {
-      return null;
+    if (existing) {
+      await BaseService.assertNotMemberPinned(existing, 'deleted');
+      await BaseService.assertNotGraphPinned(existing, 'deleted');
     }
-    await BaseService.assertNotMemberPinned(existing, 'deleted');
-    await BaseService.assertNotGraphPinned(existing, 'deleted');
+    const trackIds = await this._prepareReleaseTrackDeletion(stixId, stixModified);
 
     const document = await this.repository.findOneAndDelete(stixId, stixModified);
+    // Dynamic selectors must move to the surviving latest revision only after
+    // persistence. Also run on retries whose previous delete already succeeded.
+    await this._completeReleaseTrackDeletion(trackIds);
 
     if (!document) {
       //Note: document is null if not found
@@ -1388,6 +1416,8 @@ class BaseService extends ServiceWithHooks {
     await BaseService.assertNoMemberPinnedVersions(stixId, memberPinned, 'deleted');
     await BaseService.assertNoGraphPinnedVersions(stixId, 'deleted');
 
+    await this._prepareReleaseTrackDeletion(stixId);
+
     const result = await this.repository.deleteMany(stixId);
     if (result.deletedCount > 0) {
       await this.afterDeleteById(stixId, result);

app/services/release-tracks/export-service.js

@@ -21,7 +21,7 @@
 // app/lib/release-tracks/export-schemas.js for schema definitions.
 // =============================================================================
 
-const { v5: uuidv5 } = require('uuid');
+const { v4: uuidv4 } = require('uuid');
 const logger = require('../../lib/logger');
 const linkById = require('../../lib/linkById');
 const primaryRevisionService = require('./primary-revision-service');
@@ -33,9 +33,6 @@ const {
   filesystemStoreTransformSchema,
 } = require('../../lib/release-tracks/export-schemas');
 
-// Namespace for deterministic draft bundle identifiers.
-const DRAFT_BUNDLE_NAMESPACE = 'c1d8c0a6-6a3d-4f0a-9c9b-4d9d0c8a5f21';
-
 // =============================================================================
 // Hydration
 // =============================================================================
@@ -91,10 +88,7 @@ function normalizeSourceBundleDefaults(documents, graph) {
 
 function bundleIdFor(snapshot) {
   if (snapshot.bundle_id) return snapshot.bundle_id;
-  return `bundle--${uuidv5(
-    `${snapshot.id}|${new Date(snapshot.modified).toISOString()}`,
-    DRAFT_BUNDLE_NAMESPACE,
-  )}`;
+  return `bundle--${uuidv4()}`;
 }
 
 // =============================================================================