@wildo-ai/saas-backend-lib 1.1.1 → 1.1.3

package/dist/esm/compliance/audit-trails/services/utils/leased-value-cache.backend.utils.js

@@ -0,0 +1,192 @@
+/**
+ * # A leased, stale-while-revalidate, single-flight cache for values read on the AUDIT EMISSION PATH
+ *
+ * The audit dispatcher holds two per-organization caches — the SIEM export config that decides WHERE
+ * an event is routed, and the organization name that decorates the envelope. Both were hand-rolled
+ * `Map`s with a 5-minute wall-clock TTL, a copy-pasted FIFO eviction block, and a blocking re-read on
+ * expiry. This is the one place those mechanics live now, so a property fixed here is fixed for both
+ * — the shape `.claude/rules/invariant-call-site-enumeration.md` exists to force.
+ *
+ * ## The governing constraint: emission must never fail, and never block, the thing it observes
+ *
+ * `AuditEventDispatcherBackendService` runs detached (`audit-logs.backend.service.ts:349` calls it
+ * without `await`, with a `.catch`), and its whole contract is that a routing failure is logged and
+ * never thrown onto the business operation. Every property below follows from that:
+ *
+ * | Property | Why it is required here specifically |
+ * |---|---|
+ * | **Stale-while-revalidate** | Past the lease the CACHED value is returned immediately and the re-read runs off the caller's path. Staleness is tolerable (a config changes monthly); a stall is not. It is also what makes a SHORT lease affordable: shortening it now costs read volume only, never latency. |
+ * | **Single flight** | A burst of events for one organization must produce ONE read, not one per event. Without it a cold organization under load fires N concurrent reads — and for the SIEM config each of those reads emits its own `system_context_read` audit row and can race the lazy default-row materialisation. |
+ * | **Generation-guarded write-back** | An {@link invalidate} that lands WHILE a refresh is in flight must win. Without the guard the in-flight read — started before the write committed — writes the pre-write value back over the invalidation, so the invalidation silently does nothing in exactly the case it exists for. |
+ * | **Backoff on failure** | A failed refresh stamps the next attempt one lease ahead rather than retrying per event. A broken repository must not turn into a read storm that scales with audit volume. |
+ * | **LRU, not FIFO, eviction** | The evicted entry is the least recently USED. The previous FIFO block (labelled "simple LRU approximation", which it was not) evicted by insertion order, so the busiest organization — inserted first, refreshed in place, never re-inserted — was the first one thrown out and forced back onto a blocking cold read. |
+ *
+ * ## What it deliberately does NOT do
+ *
+ * - **It does not live in a shared store.** Putting the VALUE in Redis would make routing depend on a
+ *   store that can be unavailable, and would put a network round trip on the emission path. Cross-replica
+ *   convergence is carried instead by a published invalidation (see the dispatcher's
+ *   `_publishSiemConfigInvalidation`) plus the lease — neither of which the emission path touches.
+ * - **It does not expire entries out of the map.** An entry is refreshed in place, never dropped on age,
+ *   so a warm organization never pays a blocking read again. Only {@link invalidate} and LRU pressure
+ *   remove an entry.
+ * - **It caches negative results.** `null` / `undefined` is a value like any other. The alternative —
+ *   re-reading on every event for a key with no row — is unbounded read amplification precisely for the
+ *   keys that are cheapest to get wrong, and it is the shape the org-name cache had before this.
+ *
+ * ## Precondition on the loader, which is a real constraint and not boilerplate
+ *
+ * A caller that JOINS an in-flight load receives the value **the first caller's loader produced**. So
+ * every loader passed for one key must be equally privileged: a per-request loader whose visibility
+ * varies with the caller would leak one caller's view to another. Both current call sites satisfy this
+ * because the execution context they close over is the audit service's freshly-synthesised super-admin
+ * APPLICATION-scoped temp context (`audit-logs.backend.service.ts:284`, handed to the dispatcher at
+ * `:349`) — identical in privilege for every dispatch. **State the equivalent before adding a third.**
+ */
+/**
+ * A per-key leased cache. See the module header for the design and its constraints.
+ *
+ * @typeParam T The cached value. Nullable members are cached like any other value, deliberately.
+ */
+export class LeasedValueCache {
+    options;
+    entries = new Map();
+    /** In-flight loads/refreshes, keyed identically. Present ⇒ a read is already on the wire for that key. */
+    inFlight = new Map();
+    /** Monotonic per-key generation. A key absent here has never been invalidated. */
+    generations = new Map();
+    constructor(options) {
+        this.options = options;
+    }
+    /**
+     * Serve `key`, loading it when there is nothing to serve.
+     *
+     * Rejects ONLY when a COLD load rejects — there is no cached value to fall back to, so the caller has
+     * to decide. Once a value exists this never rejects and never blocks: a stale entry is returned as it
+     * stands and the refresh runs detached.
+     *
+     * @param load Reads the current value. Must satisfy the loader precondition in the module header.
+     */
+    async get(key, load) {
+        const entry = this.entries.get(key);
+        if (entry) {
+            // Touch for LRU on every hit, fresh or stale: "recently used" is about READS, so refreshing in
+            // place must not let a busy key drift toward the eviction end.
+            this.entries.delete(key);
+            this.entries.set(key, entry);
+            if (Date.now() >= entry.nextRefreshAt) {
+                // An UNOBSERVABLE optimisation, and deliberately unpinned: removing it changes no outcome,
+                // because `inFlight` already collapses the reads. What it saves is that every event arriving
+                // during a slow refresh would otherwise re-enter `startLoad`, join the same promise and attach
+                // its own `.catch` handler — bounded and released on settle, but pointless work per event on
+                // the emission path.
+                //
+                // It is NOT the failure backoff, however much it looks like one. Backing off after a failed
+                // refresh is `startLoad`'s catch, which re-stamps from the moment the failure LANDED; a slow
+                // failure exhausts this stamp while still on the wire. Mistaking the two makes a backoff pin
+                // that passes with the backoff deleted — measured, and the reason the suite pins both.
+                entry.nextRefreshAt = Date.now() + this.options.refreshAfterMs;
+                void this.startLoad(key, load).catch(() => {
+                    /* Reported through `onRefreshFailure` inside `startLoad`; nothing may escape onto the emission path. */
+                });
+            }
+            return entry.value;
+        }
+        return this.startLoad(key, load);
+    }
+    /**
+     * Drop `key`, so the next {@link get} performs a blocking read.
+     *
+     * Synchronous, infallible and idempotent — a caller needs no error handling, which is why the write-path
+     * hook can invoke it inside a postfix handler without a try/catch.
+     *
+     * Bumping the generation is the load-bearing half: it makes any refresh already on the wire discard its
+     * result instead of writing the pre-invalidation value back. Deleting the entry alone would leave the
+     * invalidation defeated by a read that started microseconds earlier.
+     */
+    invalidate(key) {
+        this.entries.delete(key);
+        this.generations.set(key, (this.generations.get(key) ?? 0) + 1);
+    }
+    /** Resident key count. A test and diagnostics seam; nothing branches on it in production. */
+    size() {
+        return this.entries.size;
+    }
+    /** Drop everything, including generation history. Test isolation only. */
+    clear() {
+        this.entries.clear();
+        this.inFlight.clear();
+        this.generations.clear();
+    }
+    /**
+     * Await every load currently on the wire.
+     *
+     * A TEST seam: stale-while-revalidate means a refresh outlives the `get` that started it, so a pin that
+     * asserts on the refreshed value has no other deterministic join point. Never called from production
+     * code — production must never wait for a refresh, which is the entire point of the design.
+     */
+    async settle() {
+        while (this.inFlight.size > 0) {
+            await Promise.allSettled([...this.inFlight.values()]);
+        }
+    }
+    /** Start (or join) the single in-flight read for `key`, writing the result back under generation guard. */
+    startLoad(key, load) {
+        const joined = this.inFlight.get(key);
+        if (joined)
+            return joined;
+        const startedAtGeneration = this.generations.get(key) ?? 0;
+        const pending = load()
+            .then((value) => {
+            // The generation guard. An `invalidate` that landed while this read was on the wire means the
+            // value we are holding predates a write we already know about — publishing it would restore
+            // exactly the staleness the invalidation was raised to remove.
+            if ((this.generations.get(key) ?? 0) === startedAtGeneration) {
+                this.store(key, value);
+            }
+            return value;
+        })
+            .catch((error) => {
+            const existing = this.entries.get(key);
+            if (existing) {
+                // Serve the last known value and back off a full lease rather than retrying per event. A source
+                // that is down must not convert audit volume into read volume.
+                existing.nextRefreshAt = Date.now() + this.options.refreshAfterMs;
+                this.options.onRefreshFailure?.(key, error);
+                return existing.value;
+            }
+            // COLD failure: there is nothing to serve, so the caller decides. Deliberately NOT reported through
+            // `onRefreshFailure`, which names the silent case; a cold rejection is visible to the caller.
+            throw error;
+        })
+            .finally(() => {
+            // Only clear the slot if it is still OURS. A `clear()` between start and settle would otherwise
+            // have this delete a newer in-flight read's entry.
+            if (this.inFlight.get(key) === pending)
+                this.inFlight.delete(key);
+        });
+        this.inFlight.set(key, pending);
+        return pending;
+    }
+    /** Insert or replace, evicting the least recently used key first when at capacity. */
+    store(key, value) {
+        const existing = this.entries.get(key);
+        if (existing) {
+            existing.value = value;
+            existing.nextRefreshAt = Date.now() + this.options.refreshAfterMs;
+            return;
+        }
+        if (this.entries.size >= this.options.maxEntries) {
+            // Map iteration is insertion order and `get` re-inserts on every hit, so the first key is the least
+            // recently used one.
+            const leastRecentlyUsed = this.entries.keys().next().value;
+            if (leastRecentlyUsed !== undefined) {
+                this.entries.delete(leastRecentlyUsed);
+                // Its generation goes too: an unbounded generation map would be the leak the entry cap prevents.
+                this.generations.delete(leastRecentlyUsed);
+            }
+        }
+        this.entries.set(key, { value, nextRefreshAt: Date.now() + this.options.refreshAfterMs });
+    }
+}
+//# sourceMappingURL=leased-value-cache.backend.utils.js.map

package/dist/esm/compliance/audit-trails/services/utils/leased-value-cache.backend.utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"leased-value-cache.backend.utils.js","sourceRoot":"","sources":["../../../../../../../src/compliance/audit-trails/services/utils/leased-value-cache.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAuBH;;;;GAIG;AACH,MAAM,OAAO,gBAAgB;IAOE;IANZ,OAAO,GAAG,IAAI,GAAG,EAA0B,CAAC;IAC7D,0GAA0G;IACzF,QAAQ,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC1D,kFAAkF;IACjE,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEzD,YAA6B,OAAgC;QAAhC,YAAO,GAAP,OAAO,CAAyB;IAAG,CAAC;IAEjE;;;;;;;;OAQG;IACI,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,IAAsB;QAClD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEpC,IAAI,KAAK,EAAE,CAAC;YACV,+FAA+F;YAC/F,+DAA+D;YAC/D,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAE7B,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;gBACtC,2FAA2F;gBAC3F,6FAA6F;gBAC7F,+FAA+F;gBAC/F,6FAA6F;gBAC7F,qBAAqB;gBACrB,EAAE;gBACF,4FAA4F;gBAC5F,6FAA6F;gBAC7F,6FAA6F;gBAC7F,uFAAuF;gBACvF,KAAK,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC;gBAC/D,KAAK,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;oBACxC,wGAAwG;gBAC1G,CAAC,CAAC,CAAC;YACL,CAAC;YACD,OAAO,KAAK,CAAC,KAAK,CAAC;QACrB,CAAC;QAED,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACnC,CAAC;IAED;;;;;;;;;OASG;IACI,UAAU,CAAC,GAAW;QAC3B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClE,CAAC;IAED,6FAA6F;IACtF,IAAI;QACT,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3B,CAAC;IAED,0EAA0E;IACnE,KAAK;QACV,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrB,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;IAC3B,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,MAAM;QACjB,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAED,2GAA2G;IACnG,SAAS,CAAC,GAAW,EAAE,IAAsB;QACnD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAE1B,MAAM,mBAAmB,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC3D,MAAM,OAAO,GAAG,IAAI,EAAE;aACnB,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;YACd,8FAA8F;YAC9F,4FAA4F;YAC5F,+DAA+D;YAC/D,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,mBAAmB,EAAE,CAAC;gBAC7D,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACzB,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACxB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACvC,IAAI,QAAQ,EAAE,CAAC;gBACb,gGAAgG;gBAChG,+DAA+D;gBAC/D,QAAQ,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC;gBAClE,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBAC5C,OAAO,QAAQ,CAAC,KAAK,CAAC;YACxB,CAAC;YACD,oGAAoG;YACpG,8FAA8F;YAC9F,MAAM,KAAK,CAAC;QACd,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,gGAAgG;YAChG,mDAAmD;YACnD,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,OAAO;gBAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACpE,CAAC,CAAC,CAAC;QAEL,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAChC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,sFAAsF;IAC9E,KAAK,CAAC,GAAW,EAAE,KAAQ;QACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,KAAK,GAAG,KAAK,CAAC;YACvB,QAAQ,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC;YAClE,OAAO;QACT,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;YACjD,oGAAoG;YACpG,qBAAqB;YACrB,MAAM,iBAAiB,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YAC3D,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;gBACpC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;gBACvC,iGAAiG;gBACjG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAC5F,CAAC;CACF","sourcesContent":["/**\n * # A leased, stale-while-revalidate, single-flight cache for values read on the AUDIT EMISSION PATH\n *\n * The audit dispatcher holds two per-organization caches — the SIEM export config that decides WHERE\n * an event is routed, and the organization name that decorates the envelope. Both were hand-rolled\n * `Map`s with a 5-minute wall-clock TTL, a copy-pasted FIFO eviction block, and a blocking re-read on\n * expiry. This is the one place those mechanics live now, so a property fixed here is fixed for both\n * — the shape `.claude/rules/invariant-call-site-enumeration.md` exists to force.\n *\n * ## The governing constraint: emission must never fail, and never block, the thing it observes\n *\n * `AuditEventDispatcherBackendService` runs detached (`audit-logs.backend.service.ts:349` calls it\n * without `await`, with a `.catch`), and its whole contract is that a routing failure is logged and\n * never thrown onto the business operation. Every property below follows from that:\n *\n * | Property | Why it is required here specifically |\n * |---|---|\n * | **Stale-while-revalidate** | Past the lease the CACHED value is returned immediately and the re-read runs off the caller's path. Staleness is tolerable (a config changes monthly); a stall is not. It is also what makes a SHORT lease affordable: shortening it now costs read volume only, never latency. |\n * | **Single flight** | A burst of events for one organization must produce ONE read, not one per event. Without it a cold organization under load fires N concurrent reads — and for the SIEM config each of those reads emits its own `system_context_read` audit row and can race the lazy default-row materialisation. |\n * | **Generation-guarded write-back** | An {@link invalidate} that lands WHILE a refresh is in flight must win. Without the guard the in-flight read — started before the write committed — writes the pre-write value back over the invalidation, so the invalidation silently does nothing in exactly the case it exists for. |\n * | **Backoff on failure** | A failed refresh stamps the next attempt one lease ahead rather than retrying per event. A broken repository must not turn into a read storm that scales with audit volume. |\n * | **LRU, not FIFO, eviction** | The evicted entry is the least recently USED. The previous FIFO block (labelled \"simple LRU approximation\", which it was not) evicted by insertion order, so the busiest organization — inserted first, refreshed in place, never re-inserted — was the first one thrown out and forced back onto a blocking cold read. |\n *\n * ## What it deliberately does NOT do\n *\n * - **It does not live in a shared store.** Putting the VALUE in Redis would make routing depend on a\n *   store that can be unavailable, and would put a network round trip on the emission path. Cross-replica\n *   convergence is carried instead by a published invalidation (see the dispatcher's\n *   `_publishSiemConfigInvalidation`) plus the lease — neither of which the emission path touches.\n * - **It does not expire entries out of the map.** An entry is refreshed in place, never dropped on age,\n *   so a warm organization never pays a blocking read again. Only {@link invalidate} and LRU pressure\n *   remove an entry.\n * - **It caches negative results.** `null` / `undefined` is a value like any other. The alternative —\n *   re-reading on every event for a key with no row — is unbounded read amplification precisely for the\n *   keys that are cheapest to get wrong, and it is the shape the org-name cache had before this.\n *\n * ## Precondition on the loader, which is a real constraint and not boilerplate\n *\n * A caller that JOINS an in-flight load receives the value **the first caller's loader produced**. So\n * every loader passed for one key must be equally privileged: a per-request loader whose visibility\n * varies with the caller would leak one caller's view to another. Both current call sites satisfy this\n * because the execution context they close over is the audit service's freshly-synthesised super-admin\n * APPLICATION-scoped temp context (`audit-logs.backend.service.ts:284`, handed to the dispatcher at\n * `:349`) — identical in privilege for every dispatch. **State the equivalent before adding a third.**\n */\n\n/** One cached entry. `nextRefreshAt` — not an age — is what the lease is measured against, so a failed refresh can back off without pretending the value is fresh. */\ninterface LeasedEntry<T> {\n  value: T;\n  /** Wall-clock instant at or after which the next {@link LeasedValueCache.get} triggers a background refresh. */\n  nextRefreshAt: number;\n}\n\n/** Construction options. `refreshAfterMs` is the guarantee the owning subsystem states publicly — see each call site. */\nexport interface LeasedValueCacheOptions {\n  /** How long a value is served without a re-read. The convergence bound for any change no invalidation reaches. */\n  readonly refreshAfterMs: number;\n  /** Hard ceiling on resident keys; the least recently used is evicted on overflow. */\n  readonly maxEntries: number;\n  /**\n   * Reported when a BACKGROUND refresh throws. The cache keeps serving the previous value and backs off\n   * one lease. Optional, but omitting it makes a persistently unreadable source silent, which is the\n   * failure this whole subsystem exists to make visible — pass one.\n   */\n  readonly onRefreshFailure?: (key: string, error: unknown) => void;\n}\n\n/**\n * A per-key leased cache. See the module header for the design and its constraints.\n *\n * @typeParam T The cached value. Nullable members are cached like any other value, deliberately.\n */\nexport class LeasedValueCache<T> {\n  private readonly entries = new Map<string, LeasedEntry<T>>();\n  /** In-flight loads/refreshes, keyed identically. Present ⇒ a read is already on the wire for that key. */\n  private readonly inFlight = new Map<string, Promise<T>>();\n  /** Monotonic per-key generation. A key absent here has never been invalidated. */\n  private readonly generations = new Map<string, number>();\n\n  constructor(private readonly options: LeasedValueCacheOptions) {}\n\n  /**\n   * Serve `key`, loading it when there is nothing to serve.\n   *\n   * Rejects ONLY when a COLD load rejects — there is no cached value to fall back to, so the caller has\n   * to decide. Once a value exists this never rejects and never blocks: a stale entry is returned as it\n   * stands and the refresh runs detached.\n   *\n   * @param load Reads the current value. Must satisfy the loader precondition in the module header.\n   */\n  public async get(key: string, load: () => Promise<T>): Promise<T> {\n    const entry = this.entries.get(key);\n\n    if (entry) {\n      // Touch for LRU on every hit, fresh or stale: \"recently used\" is about READS, so refreshing in\n      // place must not let a busy key drift toward the eviction end.\n      this.entries.delete(key);\n      this.entries.set(key, entry);\n\n      if (Date.now() >= entry.nextRefreshAt) {\n        // An UNOBSERVABLE optimisation, and deliberately unpinned: removing it changes no outcome,\n        // because `inFlight` already collapses the reads. What it saves is that every event arriving\n        // during a slow refresh would otherwise re-enter `startLoad`, join the same promise and attach\n        // its own `.catch` handler — bounded and released on settle, but pointless work per event on\n        // the emission path.\n        //\n        // It is NOT the failure backoff, however much it looks like one. Backing off after a failed\n        // refresh is `startLoad`'s catch, which re-stamps from the moment the failure LANDED; a slow\n        // failure exhausts this stamp while still on the wire. Mistaking the two makes a backoff pin\n        // that passes with the backoff deleted — measured, and the reason the suite pins both.\n        entry.nextRefreshAt = Date.now() + this.options.refreshAfterMs;\n        void this.startLoad(key, load).catch(() => {\n          /* Reported through `onRefreshFailure` inside `startLoad`; nothing may escape onto the emission path. */\n        });\n      }\n      return entry.value;\n    }\n\n    return this.startLoad(key, load);\n  }\n\n  /**\n   * Drop `key`, so the next {@link get} performs a blocking read.\n   *\n   * Synchronous, infallible and idempotent — a caller needs no error handling, which is why the write-path\n   * hook can invoke it inside a postfix handler without a try/catch.\n   *\n   * Bumping the generation is the load-bearing half: it makes any refresh already on the wire discard its\n   * result instead of writing the pre-invalidation value back. Deleting the entry alone would leave the\n   * invalidation defeated by a read that started microseconds earlier.\n   */\n  public invalidate(key: string): void {\n    this.entries.delete(key);\n    this.generations.set(key, (this.generations.get(key) ?? 0) + 1);\n  }\n\n  /** Resident key count. A test and diagnostics seam; nothing branches on it in production. */\n  public size(): number {\n    return this.entries.size;\n  }\n\n  /** Drop everything, including generation history. Test isolation only. */\n  public clear(): void {\n    this.entries.clear();\n    this.inFlight.clear();\n    this.generations.clear();\n  }\n\n  /**\n   * Await every load currently on the wire.\n   *\n   * A TEST seam: stale-while-revalidate means a refresh outlives the `get` that started it, so a pin that\n   * asserts on the refreshed value has no other deterministic join point. Never called from production\n   * code — production must never wait for a refresh, which is the entire point of the design.\n   */\n  public async settle(): Promise<void> {\n    while (this.inFlight.size > 0) {\n      await Promise.allSettled([...this.inFlight.values()]);\n    }\n  }\n\n  /** Start (or join) the single in-flight read for `key`, writing the result back under generation guard. */\n  private startLoad(key: string, load: () => Promise<T>): Promise<T> {\n    const joined = this.inFlight.get(key);\n    if (joined) return joined;\n\n    const startedAtGeneration = this.generations.get(key) ?? 0;\n    const pending = load()\n      .then((value) => {\n        // The generation guard. An `invalidate` that landed while this read was on the wire means the\n        // value we are holding predates a write we already know about — publishing it would restore\n        // exactly the staleness the invalidation was raised to remove.\n        if ((this.generations.get(key) ?? 0) === startedAtGeneration) {\n          this.store(key, value);\n        }\n        return value;\n      })\n      .catch((error: unknown) => {\n        const existing = this.entries.get(key);\n        if (existing) {\n          // Serve the last known value and back off a full lease rather than retrying per event. A source\n          // that is down must not convert audit volume into read volume.\n          existing.nextRefreshAt = Date.now() + this.options.refreshAfterMs;\n          this.options.onRefreshFailure?.(key, error);\n          return existing.value;\n        }\n        // COLD failure: there is nothing to serve, so the caller decides. Deliberately NOT reported through\n        // `onRefreshFailure`, which names the silent case; a cold rejection is visible to the caller.\n        throw error;\n      })\n      .finally(() => {\n        // Only clear the slot if it is still OURS. A `clear()` between start and settle would otherwise\n        // have this delete a newer in-flight read's entry.\n        if (this.inFlight.get(key) === pending) this.inFlight.delete(key);\n      });\n\n    this.inFlight.set(key, pending);\n    return pending;\n  }\n\n  /** Insert or replace, evicting the least recently used key first when at capacity. */\n  private store(key: string, value: T): void {\n    const existing = this.entries.get(key);\n    if (existing) {\n      existing.value = value;\n      existing.nextRefreshAt = Date.now() + this.options.refreshAfterMs;\n      return;\n    }\n\n    if (this.entries.size >= this.options.maxEntries) {\n      // Map iteration is insertion order and `get` re-inserts on every hit, so the first key is the least\n      // recently used one.\n      const leastRecentlyUsed = this.entries.keys().next().value;\n      if (leastRecentlyUsed !== undefined) {\n        this.entries.delete(leastRecentlyUsed);\n        // Its generation goes too: an unbounded generation map would be the leak the entry cap prevents.\n        this.generations.delete(leastRecentlyUsed);\n      }\n    }\n\n    this.entries.set(key, { value, nextRefreshAt: Date.now() + this.options.refreshAfterMs });\n  }\n}\n"]}

package/dist/esm/compliance/audit-trails/services/utils/ocsf-activity-mapping.backend.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ocsf-activity-mapping.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../../../src/compliance/audit-trails/services/utils/ocsf-activity-mapping.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,EAAkC,sBAAsB,EAAsD,MAAM,uBAAuB,CAAC;AAGnJ,oFAAoF;AACpF,oBAAY,kBAAkB;IAC5B,uCAAuC;IACvC,OAAO,IAAI;IACX,6EAA6E;IAC7E,KAAK,KAAK;CACX;AAED,sEAAsE;AACtE,oBAAY,0BAA0B;IACpC,8HAA8H;IAC9H,KAAK,IAAI;IACT,6DAA6D;IAC7D,MAAM,IAAI;IACV,mHAAmH;IACnH,OAAO,IAAI;IACX,KAAK,KAAK;CACX;AAED,oEAAoE;AACpE,oBAAY,eAAe;IACzB,MAAM,IAAI;IACV,uFAAuF;IACvF,IAAI,IAAI;IACR,MAAM,IAAI;IACV,MAAM,IAAI;IACV,KAAK,KAAK;CACX;AAED,yEAAyE;AACzE,oBAAY,4BAA4B;IACtC,MAAM,IAAI;IACV,IAAI,IAAI;IACR,MAAM,IAAI;IACV,MAAM,IAAI;IACV,IAAI,IAAI;IACR,sEAAsE;IACtE,MAAM,IAAI;IACV,QAAQ,IAAI;IACZ,MAAM,IAAI;IACV,OAAO,IAAI;IACX,QAAQ,KAAK;IACb,UAAU,KAAK;IACf,OAAO,KAAK;IACZ,2GAA2G;IAC3G,MAAM,KAAK;IACX,KAAK,KAAK;CACX;AAED,uEAAuE;AACvE,oBAAY,0BAA0B;IACpC,MAAM,IAAI;IACV,MAAM,IAAI;IACV,MAAM,IAAI;IACV,MAAM,IAAI;IACV,OAAO,IAAI;IACX,IAAI,IAAI;IACR,MAAM,IAAI;IACV,eAAe,IAAI;IACnB,cAAc,IAAI;IAClB,eAAe,KAAK;IACpB,eAAe,KAAK;IACpB,kBAAkB,KAAK;IACvB,mBAAmB,KAAK;IACxB,iBAAiB,KAAK;IACtB,iBAAiB,KAAK;IACtB,YAAY,KAAK;IACjB,YAAY,KAAK;IACjB,4BAA4B,KAAK;IACjC,+BAA+B,KAAK;IACpC,KAAK,KAAK;CACX;AAgBD;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,EAAE,QAAQ,CAAC,MAAM,CAAC,sBAAsB,EAAE,MAAM,CAAC,CA6IxF,CAAC;AAwBF;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEjG;AAED;;;;;;GAMG;AACH,oBAAY,kBAAkB;IAC5B,OAAO,IAAI;IACX,IAAI,IAAI;IACR,QAAQ,IAAI;IACZ,MAAM,IAAI;IACV,MAAM,IAAI;IACV,IAAI,IAAI;IACR,SAAS,IAAI;IACb,GAAG,IAAI;IACP,IAAI,IAAI;IACR,GAAG,IAAI;IACP,MAAM,KAAK;IACX,oBAAoB,KAAK;IACzB,IAAI,KAAK;IACT,KAAK,KAAK;CACX;AAyCD,+FAA+F;AAC/F,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,kBAAkB,CAAC;CACzC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG,gBAAgB,CAK5E;AAuCD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAUlF"}
+{"version":3,"file":"ocsf-activity-mapping.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../../../src/compliance/audit-trails/services/utils/ocsf-activity-mapping.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,EAAkC,sBAAsB,EAAsD,MAAM,uBAAuB,CAAC;AAGnJ,oFAAoF;AACpF,oBAAY,kBAAkB;IAC5B,uCAAuC;IACvC,OAAO,IAAI;IACX,6EAA6E;IAC7E,KAAK,KAAK;CACX;AAED,sEAAsE;AACtE,oBAAY,0BAA0B;IACpC,8HAA8H;IAC9H,KAAK,IAAI;IACT,6DAA6D;IAC7D,MAAM,IAAI;IACV,mHAAmH;IACnH,OAAO,IAAI;IACX,KAAK,KAAK;CACX;AAED,oEAAoE;AACpE,oBAAY,eAAe;IACzB,MAAM,IAAI;IACV,uFAAuF;IACvF,IAAI,IAAI;IACR,MAAM,IAAI;IACV,MAAM,IAAI;IACV,KAAK,KAAK;CACX;AAED,yEAAyE;AACzE,oBAAY,4BAA4B;IACtC,MAAM,IAAI;IACV,IAAI,IAAI;IACR,MAAM,IAAI;IACV,MAAM,IAAI;IACV,IAAI,IAAI;IACR,sEAAsE;IACtE,MAAM,IAAI;IACV,QAAQ,IAAI;IACZ,MAAM,IAAI;IACV,OAAO,IAAI;IACX,QAAQ,KAAK;IACb,UAAU,KAAK;IACf,OAAO,KAAK;IACZ,2GAA2G;IAC3G,MAAM,KAAK;IACX,KAAK,KAAK;CACX;AAED,uEAAuE;AACvE,oBAAY,0BAA0B;IACpC,MAAM,IAAI;IACV,MAAM,IAAI;IACV,MAAM,IAAI;IACV,MAAM,IAAI;IACV,OAAO,IAAI;IACX,IAAI,IAAI;IACR,MAAM,IAAI;IACV,eAAe,IAAI;IACnB,cAAc,IAAI;IAClB,eAAe,KAAK;IACpB,eAAe,KAAK;IACpB,kBAAkB,KAAK;IACvB,mBAAmB,KAAK;IACxB,iBAAiB,KAAK;IACtB,iBAAiB,KAAK;IACtB,YAAY,KAAK;IACjB,YAAY,KAAK;IACjB,4BAA4B,KAAK;IACjC,+BAA+B,KAAK;IACpC,KAAK,KAAK;CACX;AAgBD;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,EAAE,QAAQ,CAAC,MAAM,CAAC,sBAAsB,EAAE,MAAM,CAAC,CA0LxF,CAAC;AAwBF;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEjG;AAED;;;;;;GAMG;AACH,oBAAY,kBAAkB;IAC5B,OAAO,IAAI;IACX,IAAI,IAAI;IACR,QAAQ,IAAI;IACZ,MAAM,IAAI;IACV,MAAM,IAAI;IACV,IAAI,IAAI;IACR,SAAS,IAAI;IACb,GAAG,IAAI;IACP,IAAI,IAAI;IACR,GAAG,IAAI;IACP,MAAM,KAAK;IACX,oBAAoB,KAAK;IACzB,IAAI,KAAK;IACT,KAAK,KAAK;CACX;AAyCD,+FAA+F;AAC/F,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,kBAAkB,CAAC;CACzC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG,gBAAgB,CAK5E;AAuCD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAUlF"}

package/dist/esm/compliance/audit-trails/services/utils/ocsf-activity-mapping.backend.utils.js

@@ -172,6 +172,7 @@ export const OCSF_ACTIVITY_BY_EVENT_TYPE = {
     [CoreAuditableEventType.USER_MFA_SETUP_STARTED]: OcsfAuthenticationActivity.OTHER,
     [CoreAuditableEventType.USER_PASSKEY_AUTHENTICATION_FAILURE]: OcsfAuthenticationActivity.LOGON,
     [CoreAuditableEventType.USER_PASSKEY_AUTHENTICATION_SUCCESS]: OcsfAuthenticationActivity.LOGON,
+    [CoreAuditableEventType.USER_PASSKEY_CLONE_SUSPECTED]: OcsfAuthenticationActivity.LOGON,
     [CoreAuditableEventType.USER_PASSKEY_REGISTERED]: OcsfAuthenticationActivity.OTHER,
     [CoreAuditableEventType.USER_PASSKEY_REMOVED]: OcsfAuthenticationActivity.OTHER,
     [CoreAuditableEventType.USER_PASSWORD_CHANGED]: OcsfAuthenticationActivity.OTHER, // 3007 publishes Password Change(8), but this event's category routes it to 3002, which does not
@@ -181,6 +182,13 @@ export const OCSF_ACTIVITY_BY_EVENT_TYPE = {
     [CoreAuditableEventType.USER_PASSWORD_SET]: OcsfAuthenticationActivity.OTHER,
     [CoreAuditableEventType.USER_REFRESH_TOKEN_REUSE_DETECTED]: OcsfAuthenticationActivity.OTHER,
     [CoreAuditableEventType.USER_SESSION_EXPIRED]: OcsfAuthenticationActivity.LOGOFF,
+    /*
+     * LOGOFF, like the expiry above: the session is terminated and no longer exists, which is what the
+     * OCSF verb states. The DIFFERENCE between the two — time elapsed versus a cap displacing a live
+     * chain — is not expressible in `activity_id`, so it rides the typed eventData and the WARNING
+     * severity instead. Mapping it to OTHER would have lost the one thing a SIEM correlates on.
+     */
+    [CoreAuditableEventType.USER_SESSION_EVICTED]: OcsfAuthenticationActivity.LOGOFF,
     [CoreAuditableEventType.USER_SMS_OTP_FAILED]: OcsfAuthenticationActivity.LOGON,
     [CoreAuditableEventType.USER_SMS_OTP_SENT]: OcsfAuthenticationActivity.PREAUTH,
     [CoreAuditableEventType.USER_SMS_OTP_VERIFIED]: OcsfAuthenticationActivity.LOGON,
@@ -190,6 +198,10 @@ export const OCSF_ACTIVITY_BY_EVENT_TYPE = {
     [CoreAuditableEventType.USER_TOKEN_REFRESHED]: OcsfAuthenticationActivity.OTHER,
     [CoreAuditableEventType.USER_TOTP_DISABLED]: OcsfAuthenticationActivity.OTHER,
     // ── AUTHORIZATION ──
+    // A file upload grant delegates one upload under the minter's authority; issuing/revoking it is not
+    // one of 6003's CRUD verbs on a resource.
+    [CoreAuditableEventType.FILE_UPLOAD_GRANT_ISSUED]: OcsfApiActivity.OTHER,
+    [CoreAuditableEventType.FILE_UPLOAD_GRANT_REVOKED]: OcsfApiActivity.OTHER,
     [CoreAuditableEventType.APPLICATION_SUPER_ADMIN_FLOOR_BREACHED]: OcsfApiActivity.OTHER,
     [CoreAuditableEventType.CROSS_TENANT_ADMINISTRATIVE_ACCESS]: OcsfApiActivity.OTHER,
     [CoreAuditableEventType.OAUTH2_PROVIDER_BLOCKED]: OcsfApiActivity.OTHER,
@@ -208,6 +220,14 @@ export const OCSF_ACTIVITY_BY_EVENT_TYPE = {
     [CoreAuditableEventType.USER_APP_ROLES_CHANGED]: OcsfApiActivity.OTHER, // a role change is not one of 6003 CRUD verbs
     // ── DATA_ACCESS ──
     [CoreAuditableEventType.FIELD_ACCESS]: OcsfApiActivity.READ,
+    // CREATE, not OTHER: redeeming a grant IS the creation of one FILES row — the one DATA_ACCESS event
+    // whose CRUD verb is derivable from the type, like PLATFORM_DIRECTORY_ACCESS below.
+    [CoreAuditableEventType.FILE_UPLOAD_GRANT_REDEEMED]: OcsfApiActivity.CREATE,
+    // OTHER for both (#506): a scan CONCLUSION is not one of 6003's CRUD verbs on a resource. The file
+    // row is updated as a consequence, but the event names the finding, not the write — mapping it to
+    // UPDATE would tell a SIEM that a record was modified and lose that malware was found.
+    [CoreAuditableEventType.FILE_MALWARE_DETECTED]: OcsfApiActivity.OTHER,
+    [CoreAuditableEventType.FILE_MALWARE_SCAN_FAILED]: OcsfApiActivity.OTHER,
     [CoreAuditableEventType.MACHINE_ACCESS]: OcsfApiActivity.OTHER, // names a surface reach (A2A/MCP turn), not a CRUD verb on a resource
     // READ, not OTHER: enumerating a directory IS a read of resource rows, and it is the one case
     // where the CRUD verb IS derivable from the event type — the event only ever names a collection
@@ -238,6 +258,31 @@ export const OCSF_ACTIVITY_BY_EVENT_TYPE = {
     [CoreAuditableEventType.ORGANIZATION_PROFILE_UPDATED]: OcsfEntityManagementActivity.UPDATE,
     [CoreAuditableEventType.ORGANIZATION_RESTORED]: OcsfEntityManagementActivity.OTHER, // un-deletion has no 3004 member; Resume(13) is unsuspend and Activate(10) is a transient engine state
     [CoreAuditableEventType.ORGANIZATION_SIEM_EXPORT_CONFIGURED]: OcsfEntityManagementActivity.UPDATE,
+    // Organization provider credentials. The credential row IS the managed entity, so the three
+    // lifecycle verbs map onto its CRUD members directly — CREATE for the first grant, UPDATE for a
+    // rotation (the entity persists, its secret changes), DELETE for the withdrawal.
+    [CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_SET]: OcsfEntityManagementActivity.CREATE,
+    [CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_ROTATED]: OcsfEntityManagementActivity.UPDATE,
+    // READ(2), not OTHER: resolving the credential for an outbound call reads the managed entity, and
+    // READ is what an OCSF consumer's "who accessed this secret" query is written against. Mapping a
+    // spend to OTHER(99) would take the highest-value events in this family out of every stock rule.
+    [CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_USED]: OcsfEntityManagementActivity.READ,
+    [CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_DELETED]: OcsfEntityManagementActivity.DELETE,
+    // A person's own credential maps identically to the tenant's: the OCSF activity describes what was
+    // done to the managed entity, and that is the same verb regardless of who owns it. WHO owns it is
+    // carried by the event data, not by the activity — collapsing the two would make "who accessed
+    // this secret" queries miss half their population.
+    [CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_SET]: OcsfEntityManagementActivity.CREATE,
+    [CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_ROTATED]: OcsfEntityManagementActivity.UPDATE,
+    [CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_USED]: OcsfEntityManagementActivity.READ,
+    [CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_DELETED]: OcsfEntityManagementActivity.DELETE,
+    // CREATE, like the `_SET` siblings: what OCSF records is the verb done to the managed entity, and
+    // a connection coming into existence is a creation however it was obtained. The fact that this one
+    // came from a consent ceremony rather than a paste lives in the event DATA — an OCSF activity is
+    // deliberately a small closed vocabulary, and stretching it to carry provenance would make it a
+    // worse index of what happened, not a better one.
+    [CoreAuditableEventType.ORGANIZATION_PROVIDER_CONNECTION_GRANTED]: OcsfEntityManagementActivity.CREATE,
+    [CoreAuditableEventType.USER_PROVIDER_CONNECTION_GRANTED]: OcsfEntityManagementActivity.CREATE,
     [CoreAuditableEventType.ORGANIZATION_SSO_CONFIGURATION_CHANGED]: OcsfEntityManagementActivity.UPDATE,
     // An application authentication-policy change is a configuration entity being UPDATED — the same
     // OCSF shape as the SSO / SIEM / SCIM configuration-change siblings around it. (Confirmed by the

package/dist/esm/compliance/audit-trails/services/utils/ocsf-activity-mapping.backend.utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"ocsf-activity-mapping.backend.utils.js","sourceRoot":"","sources":["../../../../../../../src/compliance/audit-trails/services/utils/ocsf-activity-mapping.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,EAAsB,UAAU,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AACnJ,OAAO,EAAE,4BAA4B,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAEhG,oFAAoF;AACpF,MAAM,CAAN,IAAY,kBAKX;AALD,WAAY,kBAAkB;IAC5B,uCAAuC;IACvC,iEAAW,CAAA;IACX,6EAA6E;IAC7E,8DAAU,CAAA;AACZ,CAAC,EALW,kBAAkB,KAAlB,kBAAkB,QAK7B;AAED,sEAAsE;AACtE,MAAM,CAAN,IAAY,0BAQX;AARD,WAAY,0BAA0B;IACpC,8HAA8H;IAC9H,6EAAS,CAAA;IACT,6DAA6D;IAC7D,+EAAU,CAAA;IACV,mHAAmH;IACnH,iFAAW,CAAA;IACX,8EAAU,CAAA;AACZ,CAAC,EARW,0BAA0B,KAA1B,0BAA0B,QAQrC;AAED,oEAAoE;AACpE,MAAM,CAAN,IAAY,eAOX;AAPD,WAAY,eAAe;IACzB,yDAAU,CAAA;IACV,uFAAuF;IACvF,qDAAQ,CAAA;IACR,yDAAU,CAAA;IACV,yDAAU,CAAA;IACV,wDAAU,CAAA;AACZ,CAAC,EAPW,eAAe,KAAf,eAAe,QAO1B;AAED,yEAAyE;AACzE,MAAM,CAAN,IAAY,4BAiBX;AAjBD,WAAY,4BAA4B;IACtC,mFAAU,CAAA;IACV,+EAAQ,CAAA;IACR,mFAAU,CAAA;IACV,mFAAU,CAAA;IACV,+EAAQ,CAAA;IACR,sEAAsE;IACtE,mFAAU,CAAA;IACV,uFAAY,CAAA;IACZ,mFAAU,CAAA;IACV,qFAAW,CAAA;IACX,wFAAa,CAAA;IACb,4FAAe,CAAA;IACf,sFAAY,CAAA;IACZ,2GAA2G;IAC3G,oFAAW,CAAA;IACX,kFAAU,CAAA;AACZ,CAAC,EAjBW,4BAA4B,KAA5B,4BAA4B,QAiBvC;AAED,uEAAuE;AACvE,MAAM,CAAN,IAAY,0BAqBX;AArBD,WAAY,0BAA0B;IACpC,+EAAU,CAAA;IACV,+EAAU,CAAA;IACV,+EAAU,CAAA;IACV,+EAAU,CAAA;IACV,iFAAW,CAAA;IACX,2EAAQ,CAAA;IACR,+EAAU,CAAA;IACV,iGAAmB,CAAA;IACnB,+FAAkB,CAAA;IAClB,kGAAoB,CAAA;IACpB,kGAAoB,CAAA;IACpB,wGAAuB,CAAA;IACvB,0GAAwB,CAAA;IACxB,sGAAsB,CAAA;IACtB,sGAAsB,CAAA;IACtB,4FAAiB,CAAA;IACjB,4FAAiB,CAAA;IACjB,4HAAiC,CAAA;IACjC,kIAAoC,CAAA;IACpC,8EAAU,CAAA;AACZ,CAAC,EArBW,0BAA0B,KAA1B,0BAA0B,QAqBrC;AAED;;;;;;GAMG;AACH,MAAM,6BAA6B,GAAwD;IACzF,CAAC,YAAY,CAAC,cAAc,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,0BAA0B,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;IACnI,CAAC,YAAY,CAAC,YAAY,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;IACtH,CAAC,YAAY,CAAC,iBAAiB,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,4BAA4B,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;IACxI,CAAC,YAAY,CAAC,eAAe,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,0BAA0B,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;CACrI,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAqD;IAE3F,uBAAuB;IACvB,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAChF,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAC9E,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAC/E,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IACpF,CAAC,sBAAsB,CAAC,0BAA0B,CAAC,EAAE,0BAA0B,CAAC,KAAK;IACrF,CAAC,sBAAsB,CAAC,+BAA+B,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAC1F,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAChF,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAC9E,uGAAuG;IACvG,8GAA8G;IAC9G,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,0BAA0B,CAAC,MAAM;IACrF,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAChF,CAAC,sBAAsB,CAAC,uBAAuB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAClF,mGAAmG;IACnG,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAChF,CAAC,sBAAsB,CAAC,8BAA8B,CAAC,EAAE,0BAA0B,CAAC,KAAK;IACzF,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAC5E,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAC/E,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAC7E,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,0BAA0B,CAAC,MAAM;IAC9E,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,0BAA0B,CAAC,MAAM;IAC9E,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,0BAA0B,CAAC,KAAK,EAAE,sFAAsF;IACtK,CAAC,sBAAsB,CAAC,kCAAkC,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAC7F,CAAC,sBAAsB,CAAC,0BAA0B,CAAC,EAAE,0BAA0B,CAAC,KAAK;IACrF,CAAC,sBAAsB,CAAC,UAAU,CAAC,EAAE,0BAA0B,CAAC,KAAK;IACrE,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAC5E,CAAC,sBAAsB,CAAC,WAAW,CAAC,EAAE,0BAA0B,CAAC,MAAM;IACvE,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IACjF,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,0BAA0B,CAAC,OAAO;IACjF,CAAC,sBAAsB,CAAC,wBAAwB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IACnF,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,EAAE,0BAA0B,CAAC,KAAK,EAAE,sGAAsG;IACpL,CAAC,sBAAsB,CAAC,uBAAuB,CAAC,EAAE,0BAA0B,CAAC,OAAO;IACpF,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,EAAE,0BAA0B,CAAC,KAAK,EAAE,qGAAqG;IAClL,CAAC,sBAAsB,CAAC,wBAAwB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IACnF,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IACjF,CAAC,sBAAsB,CAAC,mCAAmC,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAC9F,CAAC,sBAAsB,CAAC,mCAAmC,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAC9F,CAAC,sBAAsB,CAAC,uBAAuB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAClF,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAC/E,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,0BAA0B,CAAC,KAAK,EAAE,iGAAiG;IACnL,CAAC,sBAAsB,CAAC,6BAA6B,CAAC,EAAE,0BAA0B,CAAC,KAAK,EAAE,gGAAgG;IAC1L,CAAC,sBAAsB,CAAC,0BAA0B,CAAC,EAAE,0BAA0B,CAAC,KAAK,EAAE,gGAAgG;IACvL,CAAC,sBAAsB,CAAC,6BAA6B,CAAC,EAAE,0BAA0B,CAAC,KAAK;IACxF,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAC5E,CAAC,sBAAsB,CAAC,iCAAiC,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAC5F,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,0BAA0B,CAAC,MAAM;IAChF,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAC9E,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,EAAE,0BAA0B,CAAC,OAAO;IAC9E,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAChF,CAAC,sBAAsB,CAAC,4BAA4B,CAAC,EAAE,0BAA0B,CAAC,KAAK;IACvF,CAAC,sBAAsB,CAAC,cAAc,CAAC,EAAE,0BAA0B,CAAC,KAAK;IACzE,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAChF,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAC/E,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAE7E,sBAAsB;IACtB,CAAC,sBAAsB,CAAC,sCAAsC,CAAC,EAAE,eAAe,CAAC,KAAK;IACtF,CAAC,sBAAsB,CAAC,kCAAkC,CAAC,EAAE,eAAe,CAAC,KAAK;IAClF,CAAC,sBAAsB,CAAC,uBAAuB,CAAC,EAAE,eAAe,CAAC,KAAK;IACvE,CAAC,sBAAsB,CAAC,+BAA+B,CAAC,EAAE,eAAe,CAAC,KAAK;IAC/E,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,eAAe,CAAC,KAAK;IACpE,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,eAAe,CAAC,KAAK;IACrE,CAAC,sBAAsB,CAAC,6BAA6B,CAAC,EAAE,eAAe,CAAC,KAAK;IAC7E,CAAC,sBAAsB,CAAC,4BAA4B,CAAC,EAAE,eAAe,CAAC,KAAK;IAC5E,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,EAAE,eAAe,CAAC,KAAK,EAAE,8CAA8C;IAChI,CAAC,sBAAsB,CAAC,iCAAiC,CAAC,EAAE,eAAe,CAAC,KAAK;IACjF,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,EAAE,eAAe,CAAC,KAAK;IAChF,CAAC,sBAAsB,CAAC,qCAAqC,CAAC,EAAE,eAAe,CAAC,KAAK;IACrF,CAAC,sBAAsB,CAAC,+BAA+B,CAAC,EAAE,eAAe,CAAC,KAAK;IAC/E,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,eAAe,CAAC,KAAK,EAAE,mFAAmF;IAC9J,CAAC,sBAAsB,CAAC,4BAA4B,CAAC,EAAE,eAAe,CAAC,KAAK,EAAE,mFAAmF;IACjK,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,EAAE,eAAe,CAAC,KAAK,EAAE,8CAA8C;IAEtH,oBAAoB;IACpB,CAAC,sBAAsB,CAAC,YAAY,CAAC,EAAE,eAAe,CAAC,IAAI;IAC3D,CAAC,sBAAsB,CAAC,cAAc,CAAC,EAAE,eAAe,CAAC,KAAK,EAAE,sEAAsE;IACtI,8FAA8F;IAC9F,gGAAgG;IAChG,8CAA8C;IAC9C,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,eAAe,CAAC,IAAI;IACxE,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,eAAe,CAAC,IAAI;IACnE,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,eAAe,CAAC,IAAI;IAClE,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,EAAE,eAAe,CAAC,IAAI;IACrE,CAAC,sBAAsB,CAAC,4BAA4B,CAAC,EAAE,eAAe,CAAC,IAAI;IAC3E,6EAA6E;IAC7E,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,eAAe,CAAC,MAAM;IAC1E,iFAAiF;IACjF,CAAC,sBAAsB,CAAC,iCAAiC,CAAC,EAAE,eAAe,CAAC,KAAK;IACjF,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,eAAe,CAAC,IAAI;IAClE,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,eAAe,CAAC,KAAK,EAAE,uGAAuG;IAE7K,uBAAuB;IACvB,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,EAAE,4BAA4B,CAAC,MAAM;IACpF,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,4BAA4B,CAAC,MAAM;IAClF,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,4BAA4B,CAAC,MAAM;IAClF,CAAC,sBAAsB,CAAC,+BAA+B,CAAC,EAAE,4BAA4B,CAAC,KAAK,EAAE,+FAA+F;IAC7L,CAAC,sBAAsB,CAAC,2BAA2B,CAAC,EAAE,4BAA4B,CAAC,MAAM;IACzF,CAAC,sBAAsB,CAAC,0BAA0B,CAAC,EAAE,4BAA4B,CAAC,MAAM;IACxF,CAAC,sBAAsB,CAAC,2BAA2B,CAAC,EAAE,4BAA4B,CAAC,QAAQ;IAC3F,CAAC,sBAAsB,CAAC,kCAAkC,CAAC,EAAE,4BAA4B,CAAC,MAAM;IAChG,CAAC,sBAAsB,CAAC,2BAA2B,CAAC,EAAE,4BAA4B,CAAC,MAAM;IACzF,CAAC,sBAAsB,CAAC,kCAAkC,CAAC,EAAE,4BAA4B,CAAC,MAAM;IAChG,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,EAAE,4BAA4B,CAAC,MAAM;IAC9F,CAAC,sBAAsB,CAAC,4BAA4B,CAAC,EAAE,4BAA4B,CAAC,MAAM;IAC1F,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,4BAA4B,CAAC,KAAK,EAAE,uGAAuG;IAC3L,CAAC,sBAAsB,CAAC,mCAAmC,CAAC,EAAE,4BAA4B,CAAC,MAAM;IACjG,CAAC,sBAAsB,CAAC,sCAAsC,CAAC,EAAE,4BAA4B,CAAC,MAAM;IACpG,iGAAiG;IACjG,iGAAiG;IACjG,kEAAkE;IAClE,CAAC,sBAAsB,CAAC,+BAA+B,CAAC,EAAE,4BAA4B,CAAC,MAAM;IAC7F,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,EAAE,4BAA4B,CAAC,OAAO;IACrF,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,4BAA4B,CAAC,MAAM;IACvF,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,4BAA4B,CAAC,MAAM;IAClF,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,4BAA4B,CAAC,KAAK;IAC/E,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,4BAA4B,CAAC,KAAK;IACjF,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,EAAE,4BAA4B,CAAC,MAAM;IAC9F,CAAC,sBAAsB,CAAC,wBAAwB,CAAC,EAAE,4BAA4B,CAAC,KAAK;IACrF,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,4BAA4B,CAAC,MAAM;IAChF,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,4BAA4B,CAAC,MAAM;IAClF,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,4BAA4B,CAAC,MAAM;IAChF,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,4BAA4B,CAAC,MAAM;IAChF,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,EAAE,4BAA4B,CAAC,KAAK;IAE7F,uBAAuB;IACvB,CAAC,sBAAsB,CAAC,oCAAoC,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAC/F,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,0BAA0B,CAAC,MAAM;IAC9E,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,0BAA0B,CAAC,OAAO;IAClF,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,0BAA0B,CAAC,MAAM;IACjF,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,EAAE,0BAA0B,CAAC,MAAM;IAC7E,CAAC,sBAAsB,CAAC,YAAY,CAAC,EAAE,0BAA0B,CAAC,MAAM;IACxE,CAAC,sBAAsB,CAAC,YAAY,CAAC,EAAE,0BAA0B,CAAC,MAAM;IACxE,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,0BAA0B,CAAC,MAAM;IAC/E,CAAC,sBAAsB,CAAC,8BAA8B,CAAC,EAAE,0BAA0B,CAAC,KAAK;IACzF,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,0BAA0B,CAAC,MAAM;IAC/E,CAAC,sBAAsB,CAAC,eAAe,CAAC,EAAE,0BAA0B,CAAC,MAAM;IAC3E,CAAC,sBAAsB,CAAC,YAAY,CAAC,EAAE,0BAA0B,CAAC,MAAM;IACxE,CAAC,sBAAsB,CAAC,8BAA8B,CAAC,EAAE,0BAA0B,CAAC,KAAK;CAC1F,CAAC;AAEF;;;;;;GAMG;AACH,SAAS,kCAAkC;IACzC,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,KAAK,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,2BAA2B,CAAC,EAAE,CAAC;QAClF,MAAM,QAAQ,GAAG,2BAA2B,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC;QACjE,MAAM,UAAU,GAAG,4BAA4B,CAAC,QAA8B,CAAC,CAAC;QAChF,IAAI,CAAC,6BAA6B,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACxE,SAAS,CAAC,IAAI,CAAC,GAAG,SAAS,eAAe,UAAU,8BAA8B,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC3G,CAAC;IACH,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,6EAA6E,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACzH,CAAC;AACH,CAAC;AACD,kCAAkC,EAAE,CAAC;AAErC;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,SAAiB;IACrD,OAAO,2BAA2B,CAAC,SAAmC,CAAC,IAAI,kBAAkB,CAAC,OAAO,CAAC;AACxG,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,uBAAuB,CAAC,UAAkB,EAAE,SAAiB;IAC3E,OAAO,UAAU,KAAK,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AACzE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,kBAeX;AAfD,WAAY,kBAAkB;IAC5B,iEAAW,CAAA;IACX,2DAAQ,CAAA;IACR,mEAAY,CAAA;IACZ,+DAAU,CAAA;IACV,+DAAU,CAAA;IACV,2DAAQ,CAAA;IACR,qEAAa,CAAA;IACb,yDAAO,CAAA;IACP,2DAAQ,CAAA;IACR,yDAAO,CAAA;IACP,gEAAW,CAAA;IACX,4FAAyB,CAAA;IACzB,4DAAS,CAAA;IACT,8DAAU,CAAA;AACZ,CAAC,EAfW,kBAAkB,KAAlB,kBAAkB,QAe7B;AAED,sGAAsG;AACtG,MAAM,0BAA0B,GAAiD;IAC/E,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,SAAS;IACvC,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,MAAM;IACjC,CAAC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,UAAU;IACzC,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,QAAQ;IACrC,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,QAAQ;IACrC,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,MAAM;IACjC,CAAC,kBAAkB,CAAC,SAAS,CAAC,EAAE,WAAW;IAC3C,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,KAAK;IAC/B,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,MAAM;IACjC,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,KAAK;IAC/B,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,QAAQ;IACrC,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,EAAE,sBAAsB;IACjE,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,MAAM;IACjC,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,OAAO;CACpC,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,MAAM,iCAAiC,GAA8D;IACnG,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,kBAAkB,CAAC,IAAI;IAC9C,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC,MAAM;IAC1D,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,kBAAkB,CAAC,SAAS;CAC3D,CAAC;AAQF;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,uBAAuB,CAAC,UAAkB;IACxD,MAAM,UAAU,GAAG,iCAAiC,CAAC,UAAwB,CAAC,CAAC;IAC/E,OAAO,UAAU,KAAK,SAAS;QAC7B,CAAC,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,kBAAkB,CAAC,KAAK,EAAE;QAChE,CAAC,CAAC,EAAE,QAAQ,EAAE,0BAA0B,CAAC,UAAU,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;AACnF,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,mCAAmC,GAA6D;IACpG,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC,MAAM;IACtD,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE,eAAe,CAAC,MAAM;IAC3D,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,eAAe,CAAC,IAAI;IAClD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,eAAe,CAAC,IAAI;IAClD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC,IAAI;IACpD,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE,eAAe,CAAC,IAAI;IACnD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC,MAAM;IACtD,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE,eAAe,CAAC,MAAM;IAC3D,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC,MAAM;IACtD,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE,eAAe,CAAC,MAAM;CAC5D,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,6BAA6B,GAAG,CAAC,uBAAuB,EAAE,qBAAqB,EAAE,WAAW,CAAU,CAAC;AAE7G;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,qBAAqB,CAAC,SAAkB,EAAE,QAAgB;IACxE,IAAI,SAAS,KAAK,IAAI,IAAI,OAAO,SAAS,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IACzE,MAAM,MAAM,GAAG,SAA8C,CAAC;IAC9D,KAAK,MAAM,GAAG,IAAI,6BAA6B,EAAE,CAAC;QAChD,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,OAAO,SAAS,KAAK,QAAQ;YAAE,SAAS;QAC5C,MAAM,MAAM,GAAG,mCAAmC,CAAC,SAAkC,CAAC,CAAC;QACvF,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC;IAC1C,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["/**\n * OCSF `activity_id` — the normalised verb, resolved per Wildo audit event type.\n *\n * Until this table existed every OCSF document we emitted carried `activity_id: 0` (Unknown), which\n * also pinned `type_uid` to `class_uid * 100`. That is the single largest fidelity loss in the OCSF\n * projection: `activity_id` is the axis OCSF uses to separate events WITHIN a class, so collapsing it\n * makes a logon indistinguishable from a logoff to any consumer that groups by `type_uid`.\n *\n * ## Three values, three different claims\n *\n * | Value | Means | When we use it |\n * |---|---|---|\n * | a specific member | the published description matches this event | the description matched — never the caption alone |\n * | `OTHER` (99) | in the class's domain, absent from its enum | with `activity_name` carrying our event type, which is what the schema asks for |\n * | `UNKNOWN` (0) | we cannot say | application-defined event types the engine cannot enumerate |\n *\n * `OTHER` is not a shrug. The schema defines it as \"the event activity is not mapped. See the\n * `activity_name` attribute, which contains a data source specific value\" — so it is a positive\n * statement plus an obligation, and it strictly beats `UNKNOWN` for any event we understand.\n *\n * ## Read descriptions, not captions\n *\n * Authentication's `Authentication Ticket` (3), `Service Ticket Request` (4) and `Service Ticket\n * Renew` (5) read like a natural home for OAuth token issuance and refresh. Their descriptions are\n * explicitly **Kerberos** (\"A Kerberos service ticket was renewed\"), so every OAuth token event here\n * is `OTHER` instead. Mapping those from the captions would have been a fabrication that validated\n * perfectly.\n *\n * ## A structural observation, deliberately NOT acted on here\n *\n * A Wildo event's audit CATEGORY selects the OCSF class, and for several events the natural activity\n * exists in a DIFFERENT class than the category picks: `USER_PASSWORD_CHANGED`, `USER_MFA_ENABLED`,\n * `USER_ACCOUNT_LOCKED` and friends are `AUTHENTICATION` (class 3002), while `Password Change` (8),\n * `Enable MFA Factors` (12) and `Lock` (6) are published by `user_management` (3007). Those rows are\n * `OTHER` with the mismatch named on each. Re-categorising them would change SIEM category filtering\n * for existing tenants, so it is a product decision, not a mapping fix.\n *\n * spec-cite: OCSF schema 1.9.0 — `schema.ocsf.io/api/1.9.0/classes/{authentication,api_activity,\n * entity_management,user_management}`, the `activity_id` enum and `activity_name` attribute of each.\n */\n\nimport { AuditEventCategory, AuthMethod, CoreAuditableEventType, CoreResourceOperation, getAuditEventClassification } from '@wildo-ai/saas-models';\nimport { OCSF_CLASS_BY_AUDIT_CATEGORY, OcsfClassUid } from './ocsf-class-mapping.backend.utils';\n\n/** `0` and `99` mean the same thing in every OCSF class, so they are named once. */\nexport enum OcsfCommonActivity {\n  /** \"The event activity is unknown.\" */\n  UNKNOWN = 0,\n  /** \"The event activity is not mapped. See the `activity_name` attribute…\" */\n  OTHER = 99,\n}\n\n/** Published `activity_id` members of class 3002 (authentication). */\nexport enum OcsfAuthenticationActivity {\n  /** \"A new logon session was requested.\" Includes FAILED attempts — the verb is the request; the outcome rides `status_id`. */\n  LOGON = 1,\n  /** \"A logon session was terminated and no longer exists.\" */\n  LOGOFF = 2,\n  /** \"A preauthentication stage was engaged.\" Covers issuing an OTP or magic link: a stage BEFORE authentication. */\n  PREAUTH = 6,\n  OTHER = 99,\n}\n\n/** Published `activity_id` members of class 6003 (api_activity). */\nexport enum OcsfApiActivity {\n  CREATE = 1,\n  /** \"Read\" — the only CRUD verb our authorization/data-access events reliably carry. */\n  READ = 2,\n  UPDATE = 3,\n  DELETE = 4,\n  OTHER = 99,\n}\n\n/** Published `activity_id` members of class 3004 (entity_management). */\nexport enum OcsfEntityManagementActivity {\n  CREATE = 1,\n  READ = 2,\n  UPDATE = 3,\n  DELETE = 4,\n  MOVE = 5,\n  /** \"Enroll an existing managed entity.\" A member joining a tenant. */\n  ENROLL = 6,\n  UNENROLL = 7,\n  ENABLE = 8,\n  DISABLE = 9,\n  ACTIVATE = 10,\n  DEACTIVATE = 11,\n  SUSPEND = 12,\n  /** \"Resume (unsuspend) an existing managed entity.\" SUSPENDED is the only state our activate runs from. */\n  RESUME = 13,\n  OTHER = 99,\n}\n\n/** Published `activity_id` members of class 3007 (user_management). */\nexport enum OcsfUserManagementActivity {\n  CREATE = 1,\n  UPDATE = 2,\n  DELETE = 3,\n  ENABLE = 4,\n  DISABLE = 5,\n  LOCK = 6,\n  UNLOCK = 7,\n  PASSWORD_CHANGE = 8,\n  PASSWORD_RESET = 9,\n  ATTACH_POLICIES = 10,\n  DETACH_POLICIES = 11,\n  ENABLE_MFA_FACTORS = 12,\n  DISABLE_MFA_FACTORS = 13,\n  ASSIGN_PRIVILEGES = 14,\n  REMOVE_PRIVILEGES = 15,\n  ASSIGN_ROLES = 16,\n  REMOVE_ROLES = 17,\n  ADD_PROGRAMMATIC_CREDENTIALS = 18,\n  REMOVE_PROGRAMMATIC_CREDENTIALS = 19,\n  OTHER = 99,\n}\n\n/**\n * Every published activity id, per class — the membership check's source of truth.\n *\n * An activity number is only meaningful WITH its class: `1` is `Logon` in 3002 and `Create` in 6003.\n * So a row that assigns the right number under the wrong class is silently wrong, and nothing about\n * the emitted document would look malformed. {@link assertActivitiesBelongToTheirClass} closes that.\n */\nconst PUBLISHED_ACTIVITIES_BY_CLASS: Readonly<Record<OcsfClassUid, ReadonlySet<number>>> = {\n  [OcsfClassUid.AUTHENTICATION]: new Set(Object.values(OcsfAuthenticationActivity).filter((v): v is number => typeof v === 'number')),\n  [OcsfClassUid.API_ACTIVITY]: new Set(Object.values(OcsfApiActivity).filter((v): v is number => typeof v === 'number')),\n  [OcsfClassUid.ENTITY_MANAGEMENT]: new Set(Object.values(OcsfEntityManagementActivity).filter((v): v is number => typeof v === 'number')),\n  [OcsfClassUid.USER_MANAGEMENT]: new Set(Object.values(OcsfUserManagementActivity).filter((v): v is number => typeof v === 'number')),\n};\n\n/**\n * The activity each core audit event resolves to.\n *\n * **Total over `CoreAuditableEventType`**, so a new core event type cannot be added without deciding\n * its activity — the same shape the classification map now has, and for the same reason: an open set\n * silently defaulting is how `activity_id` stayed `Unknown` for every event in the first place.\n */\nexport const OCSF_ACTIVITY_BY_EVENT_TYPE: Readonly<Record<CoreAuditableEventType, number>> = {\n\n  // ── AUTHENTICATION ──\n  [CoreAuditableEventType.EMERGENCY_ACCESS_USED]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.MACHINE_AUTH_FAILED]: OcsfAuthenticationActivity.LOGON,\n  [CoreAuditableEventType.MACHINE_AUTH_SUCCESS]: OcsfAuthenticationActivity.LOGON,\n  [CoreAuditableEventType.OAUTH_CIMD_CLIENT_REFUSED]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.OAUTH_CODE_EXCHANGE_FAILED]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.OAUTH_DYNAMIC_CLIENT_REGISTERED]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.OAUTH_TOKEN_REFRESHED]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.OAUTH_TOKEN_REVOKED]: OcsfAuthenticationActivity.OTHER,\n  // Unlike the token-revoke sibling above (a no-oracle RFC 7009 ATTEMPT → Other), an RP-Initiated Logout\n  // terminates a real user SESSION, so it is a genuine OCSF Logoff — matching USER_LOGOUT / SAML_SLO_COMPLETED.\n  [CoreAuditableEventType.OAUTH_RP_INITIATED_LOGOUT]: OcsfAuthenticationActivity.LOGOFF,\n  [CoreAuditableEventType.ONE_OFF_TOKEN_CREATED]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.ONE_OFF_TOKEN_EXCHANGED]: OcsfAuthenticationActivity.OTHER,\n  // Admin token-lifecycle, not an OCSF user LOGOFF — Other(99) + activity_name, matching the family.\n  [CoreAuditableEventType.ONE_OFF_TOKEN_REVOKED]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.SAML_ASSERTION_REPLAY_DETECTED]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.SAML_LOGIN_FAILED]: OcsfAuthenticationActivity.LOGON,\n  [CoreAuditableEventType.SAML_LOGIN_INITIATED]: OcsfAuthenticationActivity.LOGON,\n  [CoreAuditableEventType.SAML_LOGIN_SUCCESS]: OcsfAuthenticationActivity.LOGON,\n  [CoreAuditableEventType.SAML_SLO_COMPLETED]: OcsfAuthenticationActivity.LOGOFF,\n  [CoreAuditableEventType.SAML_SLO_INITIATED]: OcsfAuthenticationActivity.LOGOFF,\n  [CoreAuditableEventType.USER_ACCOUNT_LOCKED]: OcsfAuthenticationActivity.OTHER, // 3007 publishes Lock(6), but this event's category routes it to 3002, which does not\n  [CoreAuditableEventType.USER_CROSS_FRONTEND_HANDOFF_ISSUED]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.USER_IDENTITY_LINK_REMOVED]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.USER_LOGIN]: OcsfAuthenticationActivity.LOGON,\n  [CoreAuditableEventType.USER_LOGIN_FAILED]: OcsfAuthenticationActivity.LOGON,\n  [CoreAuditableEventType.USER_LOGOUT]: OcsfAuthenticationActivity.LOGOFF,\n  [CoreAuditableEventType.USER_MAGIC_LINK_FAILED]: OcsfAuthenticationActivity.LOGON,\n  [CoreAuditableEventType.USER_MAGIC_LINK_SENT]: OcsfAuthenticationActivity.PREAUTH,\n  [CoreAuditableEventType.USER_MAGIC_LINK_VERIFIED]: OcsfAuthenticationActivity.LOGON,\n  [CoreAuditableEventType.USER_MFA_DISABLED]: OcsfAuthenticationActivity.OTHER, // 3007 publishes Disable MFA Factors(13), but this event's category routes it to 3002, which does not\n  [CoreAuditableEventType.USER_MFA_EMAIL_OTP_SENT]: OcsfAuthenticationActivity.PREAUTH,\n  [CoreAuditableEventType.USER_MFA_ENABLED]: OcsfAuthenticationActivity.OTHER, // 3007 publishes Enable MFA Factors(12), but this event's category routes it to 3002, which does not\n  [CoreAuditableEventType.USER_MFA_SETUP_COMPLETED]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.USER_MFA_SETUP_STARTED]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.USER_PASSKEY_AUTHENTICATION_FAILURE]: OcsfAuthenticationActivity.LOGON,\n  [CoreAuditableEventType.USER_PASSKEY_AUTHENTICATION_SUCCESS]: OcsfAuthenticationActivity.LOGON,\n  [CoreAuditableEventType.USER_PASSKEY_REGISTERED]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.USER_PASSKEY_REMOVED]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.USER_PASSWORD_CHANGED]: OcsfAuthenticationActivity.OTHER, // 3007 publishes Password Change(8), but this event's category routes it to 3002, which does not\n  [CoreAuditableEventType.USER_PASSWORD_RESET_COMPLETED]: OcsfAuthenticationActivity.OTHER, // 3007 publishes Password Reset(9), but this event's category routes it to 3002, which does not\n  [CoreAuditableEventType.USER_PASSWORD_RESET_FORCED]: OcsfAuthenticationActivity.OTHER, // 3007 publishes Password Reset(9), but this event's category routes it to 3002, which does not\n  [CoreAuditableEventType.USER_PASSWORD_RESET_REQUESTED]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.USER_PASSWORD_SET]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.USER_REFRESH_TOKEN_REUSE_DETECTED]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.USER_SESSION_EXPIRED]: OcsfAuthenticationActivity.LOGOFF,\n  [CoreAuditableEventType.USER_SMS_OTP_FAILED]: OcsfAuthenticationActivity.LOGON,\n  [CoreAuditableEventType.USER_SMS_OTP_SENT]: OcsfAuthenticationActivity.PREAUTH,\n  [CoreAuditableEventType.USER_SMS_OTP_VERIFIED]: OcsfAuthenticationActivity.LOGON,\n  [CoreAuditableEventType.USER_SSO_ENFORCEMENT_BLOCKED]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.USER_SSO_LOGIN]: OcsfAuthenticationActivity.LOGON,\n  [CoreAuditableEventType.USER_SSO_LOGIN_FAILED]: OcsfAuthenticationActivity.LOGON,\n  [CoreAuditableEventType.USER_TOKEN_REFRESHED]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.USER_TOTP_DISABLED]: OcsfAuthenticationActivity.OTHER,\n\n  // ── AUTHORIZATION ──\n  [CoreAuditableEventType.APPLICATION_SUPER_ADMIN_FLOOR_BREACHED]: OcsfApiActivity.OTHER,\n  [CoreAuditableEventType.CROSS_TENANT_ADMINISTRATIVE_ACCESS]: OcsfApiActivity.OTHER,\n  [CoreAuditableEventType.OAUTH2_PROVIDER_BLOCKED]: OcsfApiActivity.OTHER,\n  [CoreAuditableEventType.OAUTH_CONSENT_BINDING_VIOLATION]: OcsfApiActivity.OTHER,\n  [CoreAuditableEventType.OAUTH_CONSENT_DENIED]: OcsfApiActivity.OTHER,\n  [CoreAuditableEventType.OAUTH_CONSENT_GRANTED]: OcsfApiActivity.OTHER,\n  [CoreAuditableEventType.OAUTH_CONSENT_GRANT_PERSISTED]: OcsfApiActivity.OTHER,\n  [CoreAuditableEventType.OAUTH_DELEGATED_TOKEN_ISSUED]: OcsfApiActivity.OTHER,\n  [CoreAuditableEventType.ORGANIZATION_MEMBER_ROLE_CHANGED]: OcsfApiActivity.OTHER, // a role change is not one of 6003 CRUD verbs\n  [CoreAuditableEventType.ORGANIZATION_OWNER_FLOOR_BREACHED]: OcsfApiActivity.OTHER,\n  [CoreAuditableEventType.ORGANIZATION_UNIT_MEMBER_REMOVED]: OcsfApiActivity.OTHER,\n  [CoreAuditableEventType.ORGANIZATION_UNIT_MEMBER_ROLE_CHANGED]: OcsfApiActivity.OTHER,\n  [CoreAuditableEventType.PLATFORM_ACCESS_GRANT_LIFECYCLE]: OcsfApiActivity.OTHER,\n  [CoreAuditableEventType.RESOURCE_OPERATION_DENIED]: OcsfApiActivity.OTHER, // the CRUD verb is runtime data (the operation), not derivable from the event type\n  [CoreAuditableEventType.RESOURCE_OPERATION_PERFORMED]: OcsfApiActivity.OTHER, // the CRUD verb is runtime data (the operation), not derivable from the event type\n  [CoreAuditableEventType.USER_APP_ROLES_CHANGED]: OcsfApiActivity.OTHER, // a role change is not one of 6003 CRUD verbs\n\n  // ── DATA_ACCESS ──\n  [CoreAuditableEventType.FIELD_ACCESS]: OcsfApiActivity.READ,\n  [CoreAuditableEventType.MACHINE_ACCESS]: OcsfApiActivity.OTHER, // names a surface reach (A2A/MCP turn), not a CRUD verb on a resource\n  // READ, not OTHER: enumerating a directory IS a read of resource rows, and it is the one case\n  // where the CRUD verb IS derivable from the event type — the event only ever names a collection\n  // read (list/search/count), never a mutation.\n  [CoreAuditableEventType.PLATFORM_DIRECTORY_ACCESS]: OcsfApiActivity.READ,\n  [CoreAuditableEventType.RETAINED_DATA_ACCESS]: OcsfApiActivity.READ,\n  [CoreAuditableEventType.SUBJECT_DATA_EXPORT]: OcsfApiActivity.READ,\n  [CoreAuditableEventType.COLLECTION_DATA_EXPORT]: OcsfApiActivity.READ,\n  [CoreAuditableEventType.HTTP_API_READ_THROUGH_ACCESS]: OcsfApiActivity.READ,\n  // D6 stance 6b: the declared external-erasure operation DELETED remote rows.\n  [CoreAuditableEventType.HTTP_API_EXTERNAL_ERASURE]: OcsfApiActivity.DELETE,\n  // D6 stance 6c: nothing was deleted — the event records a deliberate non-action.\n  [CoreAuditableEventType.HTTP_API_NON_ERASURE_ACKNOWLEDGED]: OcsfApiActivity.OTHER,\n  [CoreAuditableEventType.SYSTEM_CONTEXT_READ]: OcsfApiActivity.READ,\n  [CoreAuditableEventType.SYSTEM_CONTEXT_WRITE]: OcsfApiActivity.OTHER, // static fallback only — refined per emission from eventData.operation (CREATE | UPDATE | UPDATE_MANY)\n\n  // ── ORG_MANAGEMENT ──\n  [CoreAuditableEventType.ORGANIZATION_ACTIVATED]: OcsfEntityManagementActivity.RESUME,\n  [CoreAuditableEventType.ORGANIZATION_CREATED]: OcsfEntityManagementActivity.CREATE,\n  [CoreAuditableEventType.ORGANIZATION_DELETED]: OcsfEntityManagementActivity.DELETE,\n  [CoreAuditableEventType.ORGANIZATION_DELETION_REQUESTED]: OcsfEntityManagementActivity.OTHER, // marks the tenant and opens a window; nothing is deleted yet, so Delete(4) would overstate it\n  [CoreAuditableEventType.ORGANIZATION_MEMBER_INVITED]: OcsfEntityManagementActivity.CREATE,\n  [CoreAuditableEventType.ORGANIZATION_MEMBER_JOINED]: OcsfEntityManagementActivity.ENROLL,\n  [CoreAuditableEventType.ORGANIZATION_MEMBER_REMOVED]: OcsfEntityManagementActivity.UNENROLL,\n  [CoreAuditableEventType.ORGANIZATION_MEMBER_STATUS_CHANGED]: OcsfEntityManagementActivity.UPDATE,\n  [CoreAuditableEventType.ORGANIZATION_MEMBER_UPDATED]: OcsfEntityManagementActivity.UPDATE,\n  [CoreAuditableEventType.ORGANIZATION_NOTIFICATIONS_UPDATED]: OcsfEntityManagementActivity.UPDATE,\n  [CoreAuditableEventType.ORGANIZATION_PREFERENCES_UPDATED]: OcsfEntityManagementActivity.UPDATE,\n  [CoreAuditableEventType.ORGANIZATION_PROFILE_UPDATED]: OcsfEntityManagementActivity.UPDATE,\n  [CoreAuditableEventType.ORGANIZATION_RESTORED]: OcsfEntityManagementActivity.OTHER, // un-deletion has no 3004 member; Resume(13) is unsuspend and Activate(10) is a transient engine state\n  [CoreAuditableEventType.ORGANIZATION_SIEM_EXPORT_CONFIGURED]: OcsfEntityManagementActivity.UPDATE,\n  [CoreAuditableEventType.ORGANIZATION_SSO_CONFIGURATION_CHANGED]: OcsfEntityManagementActivity.UPDATE,\n  // An application authentication-policy change is a configuration entity being UPDATED — the same\n  // OCSF shape as the SSO / SIEM / SCIM configuration-change siblings around it. (Confirmed by the\n  // session that added the event: UPDATE is the intended activity.)\n  [CoreAuditableEventType.APPLICATION_AUTH_POLICY_CHANGED]: OcsfEntityManagementActivity.UPDATE,\n  [CoreAuditableEventType.ORGANIZATION_SUSPENDED]: OcsfEntityManagementActivity.SUSPEND,\n  [CoreAuditableEventType.ORGANIZATION_UNIT_UPDATED]: OcsfEntityManagementActivity.UPDATE,\n  [CoreAuditableEventType.ORGANIZATION_UPDATED]: OcsfEntityManagementActivity.UPDATE,\n  [CoreAuditableEventType.SAML_CERT_EXPIRING]: OcsfEntityManagementActivity.OTHER,\n  [CoreAuditableEventType.SAML_METADATA_PARSED]: OcsfEntityManagementActivity.OTHER,\n  [CoreAuditableEventType.SCIM_PROVISIONING_CONFIG_UPDATED]: OcsfEntityManagementActivity.UPDATE,\n  [CoreAuditableEventType.SCIM_PROVISIONING_FAILED]: OcsfEntityManagementActivity.OTHER,\n  [CoreAuditableEventType.SCIM_TOKEN_CREATED]: OcsfEntityManagementActivity.CREATE,\n  [CoreAuditableEventType.SCIM_TOKEN_GENERATED]: OcsfEntityManagementActivity.CREATE,\n  [CoreAuditableEventType.SCIM_TOKEN_REVOKED]: OcsfEntityManagementActivity.DELETE,\n  [CoreAuditableEventType.SCIM_TOKEN_ROTATED]: OcsfEntityManagementActivity.UPDATE,\n  [CoreAuditableEventType.WEBHOOK_ENDPOINT_TEST_DISPATCHED]: OcsfEntityManagementActivity.OTHER,\n\n  // ── USER_LIFECYCLE ──\n  [CoreAuditableEventType.RESOURCE_STATUS_TRANSITION_PERFORMED]: OcsfUserManagementActivity.OTHER,\n  [CoreAuditableEventType.SAML_EMAIL_CHANGED]: OcsfUserManagementActivity.UPDATE,\n  [CoreAuditableEventType.SCIM_USER_DEACTIVATED]: OcsfUserManagementActivity.DISABLE,\n  [CoreAuditableEventType.SCIM_USER_PROVISIONED]: OcsfUserManagementActivity.CREATE,\n  [CoreAuditableEventType.SCIM_USER_UPDATED]: OcsfUserManagementActivity.UPDATE,\n  [CoreAuditableEventType.USER_CREATED]: OcsfUserManagementActivity.CREATE,\n  [CoreAuditableEventType.USER_DELETED]: OcsfUserManagementActivity.DELETE,\n  [CoreAuditableEventType.USER_EMAIL_VERIFIED]: OcsfUserManagementActivity.UPDATE,\n  [CoreAuditableEventType.USER_PHONE_VERIFICATION_FAILED]: OcsfUserManagementActivity.OTHER,\n  [CoreAuditableEventType.USER_PHONE_VERIFIED]: OcsfUserManagementActivity.UPDATE,\n  [CoreAuditableEventType.USER_REGISTERED]: OcsfUserManagementActivity.CREATE,\n  [CoreAuditableEventType.USER_UPDATED]: OcsfUserManagementActivity.UPDATE,\n  [CoreAuditableEventType.USER_VERIFICATION_EMAIL_RESENT]: OcsfUserManagementActivity.OTHER,\n};\n\n/**\n * Fail at module load if any row assigns an activity its own class does not publish.\n *\n * This is the check the table exists to make possible. Activity numbers are class-scoped and collide\n * across classes, so a misfiled row produces a document that is structurally valid, schema-conformant,\n * and semantically wrong — the failure mode nothing downstream can catch.\n */\nfunction assertActivitiesBelongToTheirClass(): void {\n  const offenders: string[] = [];\n  for (const [eventType, activityId] of Object.entries(OCSF_ACTIVITY_BY_EVENT_TYPE)) {\n    const category = getAuditEventClassification(eventType).category;\n    const descriptor = OCSF_CLASS_BY_AUDIT_CATEGORY[category as AuditEventCategory];\n    if (!PUBLISHED_ACTIVITIES_BY_CLASS[descriptor.classUid].has(activityId)) {\n      offenders.push(`${eventType} → activity ${activityId} is not published by class ${descriptor.classUid}`);\n    }\n  }\n  if (offenders.length > 0) {\n    throw new Error(`OCSF activity mapping assigns activities their class does not publish:\\n  ${offenders.join('\\n  ')}`);\n  }\n}\nassertActivitiesBelongToTheirClass();\n\n/**\n * Resolve the OCSF activity for an event type.\n *\n * Application-defined event types are ordinary strings the engine cannot enumerate, so they resolve to\n * `UNKNOWN` — the one case where \"we cannot say\" is the truthful answer.\n */\nexport function resolveOcsfActivityId(eventType: string): number {\n  return OCSF_ACTIVITY_BY_EVENT_TYPE[eventType as CoreAuditableEventType] ?? OcsfCommonActivity.UNKNOWN;\n}\n\n/**\n * The `activity_name` companion for an `OTHER` assignment, or `undefined` when the activity is specific.\n *\n * The schema's own definition of `OTHER` points the reader at `activity_name`, so emitting `OTHER`\n * without it discards the very information the value promises is available.\n *\n * Takes the RESOLVED activity rather than re-deriving it from the event type. That distinction became\n * load-bearing when 6003 gained runtime refinement: an event whose TABLE entry is `Other` but whose\n * refined activity is `Update` must NOT carry `activity_name`, and a version of this that re-derived\n * from the event type would have emitted both — a specific activity plus a companion asserting it was\n * unmapped. Two ways to answer one question is the drift this contract exists to prevent.\n */\nexport function resolveOcsfActivityName(activityId: number, eventType: string): string | undefined {\n  return activityId === OcsfCommonActivity.OTHER ? eventType : undefined;\n}\n\n/**\n * OCSF `auth_protocol_id` — the NORMALISED authentication protocol.\n *\n * spec-cite: OCSF 1.9.0 — `schema.ocsf.io/api/1.9.0/classes/authentication`, the `auth_protocol_id`\n * enum. `auth_protocol` is documented as \"the authentication protocol as defined by the caption of\n * `auth_protocol_id`. In the case of Other, it is defined by the event source.\"\n */\nexport enum OcsfAuthProtocolId {\n  UNKNOWN = 0,\n  NTLM = 1,\n  KERBEROS = 2,\n  DIGEST = 3,\n  OPENID = 4,\n  SAML = 5,\n  OAUTH_2_0 = 6,\n  PAP = 7,\n  CHAP = 8,\n  EAP = 9,\n  RADIUS = 10,\n  BASIC_AUTHENTICATION = 11,\n  LDAP = 12,\n  OTHER = 99,\n}\n\n/** The published CAPTION for each id — what `auth_protocol` must carry when the id is not `Other`. */\nconst OCSF_AUTH_PROTOCOL_CAPTION: Readonly<Record<OcsfAuthProtocolId, string>> = {\n  [OcsfAuthProtocolId.UNKNOWN]: 'Unknown',\n  [OcsfAuthProtocolId.NTLM]: 'NTLM',\n  [OcsfAuthProtocolId.KERBEROS]: 'Kerberos',\n  [OcsfAuthProtocolId.DIGEST]: 'Digest',\n  [OcsfAuthProtocolId.OPENID]: 'OpenID',\n  [OcsfAuthProtocolId.SAML]: 'SAML',\n  [OcsfAuthProtocolId.OAUTH_2_0]: 'OAUTH 2.0',\n  [OcsfAuthProtocolId.PAP]: 'PAP',\n  [OcsfAuthProtocolId.CHAP]: 'CHAP',\n  [OcsfAuthProtocolId.EAP]: 'EAP',\n  [OcsfAuthProtocolId.RADIUS]: 'RADIUS',\n  [OcsfAuthProtocolId.BASIC_AUTHENTICATION]: 'Basic Authentication',\n  [OcsfAuthProtocolId.LDAP]: 'LDAP',\n  [OcsfAuthProtocolId.OTHER]: 'Other',\n};\n\n/**\n * The `AuthMethod` members that ARE a protocol OCSF normalises. Everything else resolves to `Other`.\n *\n * Deliberately partial. Three members are absent for a reason, and each absence is a decision:\n *\n * - `PASSWORD` is NOT `Basic Authentication` (11). Basic Auth is an HTTP transport scheme (RFC 7617);\n *   a user typing a password into a form is not that, and the resemblance is only in the English word.\n * - `MAGIC_LINK`, `TOTP`, `SMS_OTP`, `EMAIL_OTP` and `PASSKEY` name no protocol in the published enum.\n *   WebAuthn/FIDO2 in particular is absent from OCSF 1.9.0 — mapping a passkey to `Other` is the\n *   accurate answer, not a shortfall.\n * - `EXTERNAL_OAUTH2` DOES map: it is OAuth 2.0 by construction.\n *\n * The `ORG_` prefix on the SSO members is SCOPE, not protocol — an organization-restricted SAML login\n * is still SAML — so those normalise cleanly.\n */\nconst OCSF_AUTH_PROTOCOL_BY_AUTH_METHOD: Readonly<Partial<Record<AuthMethod, OcsfAuthProtocolId>>> = {\n  [AuthMethod.ORG_SAML]: OcsfAuthProtocolId.SAML,\n  [AuthMethod.ORG_OPENID_CONNECT]: OcsfAuthProtocolId.OPENID,\n  [AuthMethod.EXTERNAL_OAUTH2]: OcsfAuthProtocolId.OAUTH_2_0,\n};\n\n/** `auth_protocol` + `auth_protocol_id`, resolved together because the schema couples them. */\nexport interface OcsfAuthProtocol {\n  readonly protocol: string;\n  readonly protocolId: OcsfAuthProtocolId;\n}\n\n/**\n * Resolve the OCSF protocol pair for an envelope's `authMethod`.\n *\n * The two attributes are resolved TOGETHER because the schema defines one in terms of the other: when\n * the id is normalised, the string must be that id's published caption; only under `Other` may the\n * string be the producer's own value. Returning them separately invites the pairing to drift, which is\n * exactly how this shipped wrong the first time (`org_saml` with no id at all).\n *\n * `authMethod` is an OPEN string on the envelope — applications define their own — so anything outside\n * the framework's own `AuthMethod` vocabulary lands on `Other` carrying its raw value, which is\n * precisely what `Other` is for.\n */\nexport function resolveOcsfAuthProtocol(authMethod: string): OcsfAuthProtocol {\n  const normalised = OCSF_AUTH_PROTOCOL_BY_AUTH_METHOD[authMethod as AuthMethod];\n  return normalised === undefined\n    ? { protocol: authMethod, protocolId: OcsfAuthProtocolId.OTHER }\n    : { protocol: OCSF_AUTH_PROTOCOL_CAPTION[normalised], protocolId: normalised };\n}\n\n/**\n * The CRUD verb an API Activity (6003) event performed, mapped from the framework's core operation.\n *\n * spec-cite: OCSF 1.9.0 — `api_activity.activity_id` enum: 0 Unknown, 1 Create, 2 Read, 3 Update,\n * 4 Delete, 99 Other.\n *\n * The bulk forms collapse onto their singular verb: OCSF's activity names WHAT was done, and the\n * cardinality is carried separately by the envelope (`isBulkOperation` / `affectedRecordCount`).\n * `COUNT` is a Read — it answers a question about existing rows without changing any.\n */\nconst OCSF_API_ACTIVITY_BY_CORE_OPERATION: Readonly<Record<CoreResourceOperation, OcsfApiActivity>> = {\n  [CoreResourceOperation.CREATE]: OcsfApiActivity.CREATE,\n  [CoreResourceOperation.CREATE_MANY]: OcsfApiActivity.CREATE,\n  [CoreResourceOperation.READ]: OcsfApiActivity.READ,\n  [CoreResourceOperation.LIST]: OcsfApiActivity.READ,\n  [CoreResourceOperation.SEARCH]: OcsfApiActivity.READ,\n  [CoreResourceOperation.COUNT]: OcsfApiActivity.READ,\n  [CoreResourceOperation.UPDATE]: OcsfApiActivity.UPDATE,\n  [CoreResourceOperation.UPDATE_MANY]: OcsfApiActivity.UPDATE,\n  [CoreResourceOperation.DELETE]: OcsfApiActivity.DELETE,\n  [CoreResourceOperation.DELETE_MANY]: OcsfApiActivity.DELETE,\n};\n\n/**\n * The `eventData` keys that can name a 6003 event's CRUD verb, in precedence order.\n *\n * Three keys rather than one because the emitters spell it differently and each is authoritative for\n * its own event: `resourceOperationLike` is the core semantics a CUSTOM verb borrows (a `suspend`\n * behaving as an `update`), `operationIdentifier` is the verb on resource-operation and field-access\n * events, and `operation` is what `logSystemContextWrite` records — typed `CREATE | UPDATE |\n * UPDATE_MANY`, so it always resolves.\n *\n * Enumerated by the QUESTION (\"what names the verb on a 6003 event?\") rather than by one emitter's\n * field name, which is how `operation` was missed on the first pass.\n */\nconst OCSF_API_VERB_EVENT_DATA_KEYS = ['resourceOperationLike', 'operationIdentifier', 'operation'] as const;\n\n/**\n * Refine a 6003 event's `activity_id` from RUNTIME data, when the event type alone cannot say.\n *\n * Class 6003 is organised around the CRUD axis, and the resource-operation events (`performed` /\n * `denied`) are the bulk of what we route there — yet the event TYPE is the same string for a create\n * and a delete. So the table maps them to `Other`, and every authorization event landed in one\n * undifferentiated bucket: the same collapse `activity_id` being pinned to `Unknown` used to cause,\n * surviving one layer down after that was fixed.\n *\n * The verb is in the envelope — under one of {@link OCSF_API_VERB_EVENT_DATA_KEYS}, in that precedence\n * order. Anything else (a custom verb borrowing nothing) keeps `Other`, where `activity_name` already\n * carries the event type.\n *\n * Two consequences that are DECISIONS, not side effects:\n *\n * - **`FIELD_ACCESS` refines away from its static `Read`.** It carries `operationIdentifier`, so a\n *   secret exposed during a create now reads as Create(1). That is correct: 6003's activity names what\n *   the API CALL did, and the field-access nature rides `metadata.event_code`. The static `Read` remains\n *   the fallback for an emission that names no operation.\n * - **`SYSTEM_CONTEXT_WRITE` stops being `Other`.** Its table comment says \"neither Create nor Update is\n *   true of every emission\" — true of a STATIC mapping and not a permanent conclusion, because at\n *   runtime `operation` says exactly which. This matters more than most: it is the ACL-bypass write.\n */\nexport function refineOcsfApiActivity(eventData: unknown, fallback: number): number {\n  if (eventData === null || typeof eventData !== 'object') return fallback;\n  const record = eventData as Readonly<Record<string, unknown>>;\n  for (const key of OCSF_API_VERB_EVENT_DATA_KEYS) {\n    const candidate = record[key];\n    if (typeof candidate !== 'string') continue;\n    const mapped = OCSF_API_ACTIVITY_BY_CORE_OPERATION[candidate as CoreResourceOperation];\n    if (mapped !== undefined) return mapped;\n  }\n  return fallback;\n}\n"]}
+{"version":3,"file":"ocsf-activity-mapping.backend.utils.js","sourceRoot":"","sources":["../../../../../../../src/compliance/audit-trails/services/utils/ocsf-activity-mapping.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,EAAsB,UAAU,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AACnJ,OAAO,EAAE,4BAA4B,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAEhG,oFAAoF;AACpF,MAAM,CAAN,IAAY,kBAKX;AALD,WAAY,kBAAkB;IAC5B,uCAAuC;IACvC,iEAAW,CAAA;IACX,6EAA6E;IAC7E,8DAAU,CAAA;AACZ,CAAC,EALW,kBAAkB,KAAlB,kBAAkB,QAK7B;AAED,sEAAsE;AACtE,MAAM,CAAN,IAAY,0BAQX;AARD,WAAY,0BAA0B;IACpC,8HAA8H;IAC9H,6EAAS,CAAA;IACT,6DAA6D;IAC7D,+EAAU,CAAA;IACV,mHAAmH;IACnH,iFAAW,CAAA;IACX,8EAAU,CAAA;AACZ,CAAC,EARW,0BAA0B,KAA1B,0BAA0B,QAQrC;AAED,oEAAoE;AACpE,MAAM,CAAN,IAAY,eAOX;AAPD,WAAY,eAAe;IACzB,yDAAU,CAAA;IACV,uFAAuF;IACvF,qDAAQ,CAAA;IACR,yDAAU,CAAA;IACV,yDAAU,CAAA;IACV,wDAAU,CAAA;AACZ,CAAC,EAPW,eAAe,KAAf,eAAe,QAO1B;AAED,yEAAyE;AACzE,MAAM,CAAN,IAAY,4BAiBX;AAjBD,WAAY,4BAA4B;IACtC,mFAAU,CAAA;IACV,+EAAQ,CAAA;IACR,mFAAU,CAAA;IACV,mFAAU,CAAA;IACV,+EAAQ,CAAA;IACR,sEAAsE;IACtE,mFAAU,CAAA;IACV,uFAAY,CAAA;IACZ,mFAAU,CAAA;IACV,qFAAW,CAAA;IACX,wFAAa,CAAA;IACb,4FAAe,CAAA;IACf,sFAAY,CAAA;IACZ,2GAA2G;IAC3G,oFAAW,CAAA;IACX,kFAAU,CAAA;AACZ,CAAC,EAjBW,4BAA4B,KAA5B,4BAA4B,QAiBvC;AAED,uEAAuE;AACvE,MAAM,CAAN,IAAY,0BAqBX;AArBD,WAAY,0BAA0B;IACpC,+EAAU,CAAA;IACV,+EAAU,CAAA;IACV,+EAAU,CAAA;IACV,+EAAU,CAAA;IACV,iFAAW,CAAA;IACX,2EAAQ,CAAA;IACR,+EAAU,CAAA;IACV,iGAAmB,CAAA;IACnB,+FAAkB,CAAA;IAClB,kGAAoB,CAAA;IACpB,kGAAoB,CAAA;IACpB,wGAAuB,CAAA;IACvB,0GAAwB,CAAA;IACxB,sGAAsB,CAAA;IACtB,sGAAsB,CAAA;IACtB,4FAAiB,CAAA;IACjB,4FAAiB,CAAA;IACjB,4HAAiC,CAAA;IACjC,kIAAoC,CAAA;IACpC,8EAAU,CAAA;AACZ,CAAC,EArBW,0BAA0B,KAA1B,0BAA0B,QAqBrC;AAED;;;;;;GAMG;AACH,MAAM,6BAA6B,GAAwD;IACzF,CAAC,YAAY,CAAC,cAAc,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,0BAA0B,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;IACnI,CAAC,YAAY,CAAC,YAAY,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;IACtH,CAAC,YAAY,CAAC,iBAAiB,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,4BAA4B,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;IACxI,CAAC,YAAY,CAAC,eAAe,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,0BAA0B,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;CACrI,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAqD;IAE3F,uBAAuB;IACvB,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAChF,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAC9E,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAC/E,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IACpF,CAAC,sBAAsB,CAAC,0BAA0B,CAAC,EAAE,0BAA0B,CAAC,KAAK;IACrF,CAAC,sBAAsB,CAAC,+BAA+B,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAC1F,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAChF,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAC9E,uGAAuG;IACvG,8GAA8G;IAC9G,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,0BAA0B,CAAC,MAAM;IACrF,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAChF,CAAC,sBAAsB,CAAC,uBAAuB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAClF,mGAAmG;IACnG,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAChF,CAAC,sBAAsB,CAAC,8BAA8B,CAAC,EAAE,0BAA0B,CAAC,KAAK;IACzF,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAC5E,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAC/E,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAC7E,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,0BAA0B,CAAC,MAAM;IAC9E,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,0BAA0B,CAAC,MAAM;IAC9E,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,0BAA0B,CAAC,KAAK,EAAE,sFAAsF;IACtK,CAAC,sBAAsB,CAAC,kCAAkC,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAC7F,CAAC,sBAAsB,CAAC,0BAA0B,CAAC,EAAE,0BAA0B,CAAC,KAAK;IACrF,CAAC,sBAAsB,CAAC,UAAU,CAAC,EAAE,0BAA0B,CAAC,KAAK;IACrE,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAC5E,CAAC,sBAAsB,CAAC,WAAW,CAAC,EAAE,0BAA0B,CAAC,MAAM;IACvE,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IACjF,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,0BAA0B,CAAC,OAAO;IACjF,CAAC,sBAAsB,CAAC,wBAAwB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IACnF,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,EAAE,0BAA0B,CAAC,KAAK,EAAE,sGAAsG;IACpL,CAAC,sBAAsB,CAAC,uBAAuB,CAAC,EAAE,0BAA0B,CAAC,OAAO;IACpF,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,EAAE,0BAA0B,CAAC,KAAK,EAAE,qGAAqG;IAClL,CAAC,sBAAsB,CAAC,wBAAwB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IACnF,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IACjF,CAAC,sBAAsB,CAAC,mCAAmC,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAC9F,CAAC,sBAAsB,CAAC,mCAAmC,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAC9F,CAAC,sBAAsB,CAAC,4BAA4B,CAAC,EAAE,0BAA0B,CAAC,KAAK;IACvF,CAAC,sBAAsB,CAAC,uBAAuB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAClF,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAC/E,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,0BAA0B,CAAC,KAAK,EAAE,iGAAiG;IACnL,CAAC,sBAAsB,CAAC,6BAA6B,CAAC,EAAE,0BAA0B,CAAC,KAAK,EAAE,gGAAgG;IAC1L,CAAC,sBAAsB,CAAC,0BAA0B,CAAC,EAAE,0BAA0B,CAAC,KAAK,EAAE,gGAAgG;IACvL,CAAC,sBAAsB,CAAC,6BAA6B,CAAC,EAAE,0BAA0B,CAAC,KAAK;IACxF,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAC5E,CAAC,sBAAsB,CAAC,iCAAiC,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAC5F,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,0BAA0B,CAAC,MAAM;IAChF;;;;;OAKG;IACH,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,0BAA0B,CAAC,MAAM;IAChF,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAC9E,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,EAAE,0BAA0B,CAAC,OAAO;IAC9E,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAChF,CAAC,sBAAsB,CAAC,4BAA4B,CAAC,EAAE,0BAA0B,CAAC,KAAK;IACvF,CAAC,sBAAsB,CAAC,cAAc,CAAC,EAAE,0BAA0B,CAAC,KAAK;IACzE,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAChF,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAC/E,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAE7E,sBAAsB;IACtB,oGAAoG;IACpG,0CAA0C;IAC1C,CAAC,sBAAsB,CAAC,wBAAwB,CAAC,EAAE,eAAe,CAAC,KAAK;IACxE,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,eAAe,CAAC,KAAK;IACzE,CAAC,sBAAsB,CAAC,sCAAsC,CAAC,EAAE,eAAe,CAAC,KAAK;IACtF,CAAC,sBAAsB,CAAC,kCAAkC,CAAC,EAAE,eAAe,CAAC,KAAK;IAClF,CAAC,sBAAsB,CAAC,uBAAuB,CAAC,EAAE,eAAe,CAAC,KAAK;IACvE,CAAC,sBAAsB,CAAC,+BAA+B,CAAC,EAAE,eAAe,CAAC,KAAK;IAC/E,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,eAAe,CAAC,KAAK;IACpE,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,eAAe,CAAC,KAAK;IACrE,CAAC,sBAAsB,CAAC,6BAA6B,CAAC,EAAE,eAAe,CAAC,KAAK;IAC7E,CAAC,sBAAsB,CAAC,4BAA4B,CAAC,EAAE,eAAe,CAAC,KAAK;IAC5E,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,EAAE,eAAe,CAAC,KAAK,EAAE,8CAA8C;IAChI,CAAC,sBAAsB,CAAC,iCAAiC,CAAC,EAAE,eAAe,CAAC,KAAK;IACjF,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,EAAE,eAAe,CAAC,KAAK;IAChF,CAAC,sBAAsB,CAAC,qCAAqC,CAAC,EAAE,eAAe,CAAC,KAAK;IACrF,CAAC,sBAAsB,CAAC,+BAA+B,CAAC,EAAE,eAAe,CAAC,KAAK;IAC/E,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,eAAe,CAAC,KAAK,EAAE,mFAAmF;IAC9J,CAAC,sBAAsB,CAAC,4BAA4B,CAAC,EAAE,eAAe,CAAC,KAAK,EAAE,mFAAmF;IACjK,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,EAAE,eAAe,CAAC,KAAK,EAAE,8CAA8C;IAEtH,oBAAoB;IACpB,CAAC,sBAAsB,CAAC,YAAY,CAAC,EAAE,eAAe,CAAC,IAAI;IAC3D,oGAAoG;IACpG,oFAAoF;IACpF,CAAC,sBAAsB,CAAC,0BAA0B,CAAC,EAAE,eAAe,CAAC,MAAM;IAC3E,mGAAmG;IACnG,kGAAkG;IAClG,uFAAuF;IACvF,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,eAAe,CAAC,KAAK;IACrE,CAAC,sBAAsB,CAAC,wBAAwB,CAAC,EAAE,eAAe,CAAC,KAAK;IACxE,CAAC,sBAAsB,CAAC,cAAc,CAAC,EAAE,eAAe,CAAC,KAAK,EAAE,sEAAsE;IACtI,8FAA8F;IAC9F,gGAAgG;IAChG,8CAA8C;IAC9C,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,eAAe,CAAC,IAAI;IACxE,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,eAAe,CAAC,IAAI;IACnE,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,eAAe,CAAC,IAAI;IAClE,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,EAAE,eAAe,CAAC,IAAI;IACrE,CAAC,sBAAsB,CAAC,4BAA4B,CAAC,EAAE,eAAe,CAAC,IAAI;IAC3E,6EAA6E;IAC7E,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,eAAe,CAAC,MAAM;IAC1E,iFAAiF;IACjF,CAAC,sBAAsB,CAAC,iCAAiC,CAAC,EAAE,eAAe,CAAC,KAAK;IACjF,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,eAAe,CAAC,IAAI;IAClE,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,eAAe,CAAC,KAAK,EAAE,uGAAuG;IAE7K,uBAAuB;IACvB,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,EAAE,4BAA4B,CAAC,MAAM;IACpF,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,4BAA4B,CAAC,MAAM;IAClF,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,4BAA4B,CAAC,MAAM;IAClF,CAAC,sBAAsB,CAAC,+BAA+B,CAAC,EAAE,4BAA4B,CAAC,KAAK,EAAE,+FAA+F;IAC7L,CAAC,sBAAsB,CAAC,2BAA2B,CAAC,EAAE,4BAA4B,CAAC,MAAM;IACzF,CAAC,sBAAsB,CAAC,0BAA0B,CAAC,EAAE,4BAA4B,CAAC,MAAM;IACxF,CAAC,sBAAsB,CAAC,2BAA2B,CAAC,EAAE,4BAA4B,CAAC,QAAQ;IAC3F,CAAC,sBAAsB,CAAC,kCAAkC,CAAC,EAAE,4BAA4B,CAAC,MAAM;IAChG,CAAC,sBAAsB,CAAC,2BAA2B,CAAC,EAAE,4BAA4B,CAAC,MAAM;IACzF,CAAC,sBAAsB,CAAC,kCAAkC,CAAC,EAAE,4BAA4B,CAAC,MAAM;IAChG,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,EAAE,4BAA4B,CAAC,MAAM;IAC9F,CAAC,sBAAsB,CAAC,4BAA4B,CAAC,EAAE,4BAA4B,CAAC,MAAM;IAC1F,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,4BAA4B,CAAC,KAAK,EAAE,uGAAuG;IAC3L,CAAC,sBAAsB,CAAC,mCAAmC,CAAC,EAAE,4BAA4B,CAAC,MAAM;IACjG,4FAA4F;IAC5F,gGAAgG;IAChG,iFAAiF;IACjF,CAAC,sBAAsB,CAAC,oCAAoC,CAAC,EAAE,4BAA4B,CAAC,MAAM;IAClG,CAAC,sBAAsB,CAAC,wCAAwC,CAAC,EAAE,4BAA4B,CAAC,MAAM;IACtG,kGAAkG;IAClG,iGAAiG;IACjG,iGAAiG;IACjG,CAAC,sBAAsB,CAAC,qCAAqC,CAAC,EAAE,4BAA4B,CAAC,IAAI;IACjG,CAAC,sBAAsB,CAAC,wCAAwC,CAAC,EAAE,4BAA4B,CAAC,MAAM;IACtG,mGAAmG;IACnG,kGAAkG;IAClG,+FAA+F;IAC/F,mDAAmD;IACnD,CAAC,sBAAsB,CAAC,4BAA4B,CAAC,EAAE,4BAA4B,CAAC,MAAM;IAC1F,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,EAAE,4BAA4B,CAAC,MAAM;IAC9F,CAAC,sBAAsB,CAAC,6BAA6B,CAAC,EAAE,4BAA4B,CAAC,IAAI;IACzF,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,EAAE,4BAA4B,CAAC,MAAM;IAC9F,kGAAkG;IAClG,mGAAmG;IACnG,iGAAiG;IACjG,gGAAgG;IAChG,kDAAkD;IAClD,CAAC,sBAAsB,CAAC,wCAAwC,CAAC,EAAE,4BAA4B,CAAC,MAAM;IACtG,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,EAAE,4BAA4B,CAAC,MAAM;IAC9F,CAAC,sBAAsB,CAAC,sCAAsC,CAAC,EAAE,4BAA4B,CAAC,MAAM;IACpG,iGAAiG;IACjG,iGAAiG;IACjG,kEAAkE;IAClE,CAAC,sBAAsB,CAAC,+BAA+B,CAAC,EAAE,4BAA4B,CAAC,MAAM;IAC7F,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,EAAE,4BAA4B,CAAC,OAAO;IACrF,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,4BAA4B,CAAC,MAAM;IACvF,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,4BAA4B,CAAC,MAAM;IAClF,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,4BAA4B,CAAC,KAAK;IAC/E,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,4BAA4B,CAAC,KAAK;IACjF,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,EAAE,4BAA4B,CAAC,MAAM;IAC9F,CAAC,sBAAsB,CAAC,wBAAwB,CAAC,EAAE,4BAA4B,CAAC,KAAK;IACrF,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,4BAA4B,CAAC,MAAM;IAChF,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,4BAA4B,CAAC,MAAM;IAClF,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,4BAA4B,CAAC,MAAM;IAChF,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,4BAA4B,CAAC,MAAM;IAChF,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,EAAE,4BAA4B,CAAC,KAAK;IAE7F,uBAAuB;IACvB,CAAC,sBAAsB,CAAC,oCAAoC,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAC/F,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,0BAA0B,CAAC,MAAM;IAC9E,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,0BAA0B,CAAC,OAAO;IAClF,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,0BAA0B,CAAC,MAAM;IACjF,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,EAAE,0BAA0B,CAAC,MAAM;IAC7E,CAAC,sBAAsB,CAAC,YAAY,CAAC,EAAE,0BAA0B,CAAC,MAAM;IACxE,CAAC,sBAAsB,CAAC,YAAY,CAAC,EAAE,0BAA0B,CAAC,MAAM;IACxE,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,0BAA0B,CAAC,MAAM;IAC/E,CAAC,sBAAsB,CAAC,8BAA8B,CAAC,EAAE,0BAA0B,CAAC,KAAK;IACzF,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,0BAA0B,CAAC,MAAM;IAC/E,CAAC,sBAAsB,CAAC,eAAe,CAAC,EAAE,0BAA0B,CAAC,MAAM;IAC3E,CAAC,sBAAsB,CAAC,YAAY,CAAC,EAAE,0BAA0B,CAAC,MAAM;IACxE,CAAC,sBAAsB,CAAC,8BAA8B,CAAC,EAAE,0BAA0B,CAAC,KAAK;CAC1F,CAAC;AAEF;;;;;;GAMG;AACH,SAAS,kCAAkC;IACzC,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,KAAK,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,2BAA2B,CAAC,EAAE,CAAC;QAClF,MAAM,QAAQ,GAAG,2BAA2B,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC;QACjE,MAAM,UAAU,GAAG,4BAA4B,CAAC,QAA8B,CAAC,CAAC;QAChF,IAAI,CAAC,6BAA6B,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACxE,SAAS,CAAC,IAAI,CAAC,GAAG,SAAS,eAAe,UAAU,8BAA8B,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC3G,CAAC;IACH,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,6EAA6E,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACzH,CAAC;AACH,CAAC;AACD,kCAAkC,EAAE,CAAC;AAErC;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,SAAiB;IACrD,OAAO,2BAA2B,CAAC,SAAmC,CAAC,IAAI,kBAAkB,CAAC,OAAO,CAAC;AACxG,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,uBAAuB,CAAC,UAAkB,EAAE,SAAiB;IAC3E,OAAO,UAAU,KAAK,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AACzE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,kBAeX;AAfD,WAAY,kBAAkB;IAC5B,iEAAW,CAAA;IACX,2DAAQ,CAAA;IACR,mEAAY,CAAA;IACZ,+DAAU,CAAA;IACV,+DAAU,CAAA;IACV,2DAAQ,CAAA;IACR,qEAAa,CAAA;IACb,yDAAO,CAAA;IACP,2DAAQ,CAAA;IACR,yDAAO,CAAA;IACP,gEAAW,CAAA;IACX,4FAAyB,CAAA;IACzB,4DAAS,CAAA;IACT,8DAAU,CAAA;AACZ,CAAC,EAfW,kBAAkB,KAAlB,kBAAkB,QAe7B;AAED,sGAAsG;AACtG,MAAM,0BAA0B,GAAiD;IAC/E,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,SAAS;IACvC,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,MAAM;IACjC,CAAC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,UAAU;IACzC,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,QAAQ;IACrC,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,QAAQ;IACrC,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,MAAM;IACjC,CAAC,kBAAkB,CAAC,SAAS,CAAC,EAAE,WAAW;IAC3C,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,KAAK;IAC/B,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,MAAM;IACjC,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,KAAK;IAC/B,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,QAAQ;IACrC,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,EAAE,sBAAsB;IACjE,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,MAAM;IACjC,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,OAAO;CACpC,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,MAAM,iCAAiC,GAA8D;IACnG,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,kBAAkB,CAAC,IAAI;IAC9C,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC,MAAM;IAC1D,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,kBAAkB,CAAC,SAAS;CAC3D,CAAC;AAQF;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,uBAAuB,CAAC,UAAkB;IACxD,MAAM,UAAU,GAAG,iCAAiC,CAAC,UAAwB,CAAC,CAAC;IAC/E,OAAO,UAAU,KAAK,SAAS;QAC7B,CAAC,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,kBAAkB,CAAC,KAAK,EAAE;QAChE,CAAC,CAAC,EAAE,QAAQ,EAAE,0BAA0B,CAAC,UAAU,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;AACnF,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,mCAAmC,GAA6D;IACpG,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC,MAAM;IACtD,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE,eAAe,CAAC,MAAM;IAC3D,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,eAAe,CAAC,IAAI;IAClD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,eAAe,CAAC,IAAI;IAClD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC,IAAI;IACpD,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE,eAAe,CAAC,IAAI;IACnD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC,MAAM;IACtD,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE,eAAe,CAAC,MAAM;IAC3D,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC,MAAM;IACtD,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE,eAAe,CAAC,MAAM;CAC5D,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,6BAA6B,GAAG,CAAC,uBAAuB,EAAE,qBAAqB,EAAE,WAAW,CAAU,CAAC;AAE7G;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,qBAAqB,CAAC,SAAkB,EAAE,QAAgB;IACxE,IAAI,SAAS,KAAK,IAAI,IAAI,OAAO,SAAS,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IACzE,MAAM,MAAM,GAAG,SAA8C,CAAC;IAC9D,KAAK,MAAM,GAAG,IAAI,6BAA6B,EAAE,CAAC;QAChD,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,OAAO,SAAS,KAAK,QAAQ;YAAE,SAAS;QAC5C,MAAM,MAAM,GAAG,mCAAmC,CAAC,SAAkC,CAAC,CAAC;QACvF,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC;IAC1C,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["/**\n * OCSF `activity_id` — the normalised verb, resolved per Wildo audit event type.\n *\n * Until this table existed every OCSF document we emitted carried `activity_id: 0` (Unknown), which\n * also pinned `type_uid` to `class_uid * 100`. That is the single largest fidelity loss in the OCSF\n * projection: `activity_id` is the axis OCSF uses to separate events WITHIN a class, so collapsing it\n * makes a logon indistinguishable from a logoff to any consumer that groups by `type_uid`.\n *\n * ## Three values, three different claims\n *\n * | Value | Means | When we use it |\n * |---|---|---|\n * | a specific member | the published description matches this event | the description matched — never the caption alone |\n * | `OTHER` (99) | in the class's domain, absent from its enum | with `activity_name` carrying our event type, which is what the schema asks for |\n * | `UNKNOWN` (0) | we cannot say | application-defined event types the engine cannot enumerate |\n *\n * `OTHER` is not a shrug. The schema defines it as \"the event activity is not mapped. See the\n * `activity_name` attribute, which contains a data source specific value\" — so it is a positive\n * statement plus an obligation, and it strictly beats `UNKNOWN` for any event we understand.\n *\n * ## Read descriptions, not captions\n *\n * Authentication's `Authentication Ticket` (3), `Service Ticket Request` (4) and `Service Ticket\n * Renew` (5) read like a natural home for OAuth token issuance and refresh. Their descriptions are\n * explicitly **Kerberos** (\"A Kerberos service ticket was renewed\"), so every OAuth token event here\n * is `OTHER` instead. Mapping those from the captions would have been a fabrication that validated\n * perfectly.\n *\n * ## A structural observation, deliberately NOT acted on here\n *\n * A Wildo event's audit CATEGORY selects the OCSF class, and for several events the natural activity\n * exists in a DIFFERENT class than the category picks: `USER_PASSWORD_CHANGED`, `USER_MFA_ENABLED`,\n * `USER_ACCOUNT_LOCKED` and friends are `AUTHENTICATION` (class 3002), while `Password Change` (8),\n * `Enable MFA Factors` (12) and `Lock` (6) are published by `user_management` (3007). Those rows are\n * `OTHER` with the mismatch named on each. Re-categorising them would change SIEM category filtering\n * for existing tenants, so it is a product decision, not a mapping fix.\n *\n * spec-cite: OCSF schema 1.9.0 — `schema.ocsf.io/api/1.9.0/classes/{authentication,api_activity,\n * entity_management,user_management}`, the `activity_id` enum and `activity_name` attribute of each.\n */\n\nimport { AuditEventCategory, AuthMethod, CoreAuditableEventType, CoreResourceOperation, getAuditEventClassification } from '@wildo-ai/saas-models';\nimport { OCSF_CLASS_BY_AUDIT_CATEGORY, OcsfClassUid } from './ocsf-class-mapping.backend.utils';\n\n/** `0` and `99` mean the same thing in every OCSF class, so they are named once. */\nexport enum OcsfCommonActivity {\n  /** \"The event activity is unknown.\" */\n  UNKNOWN = 0,\n  /** \"The event activity is not mapped. See the `activity_name` attribute…\" */\n  OTHER = 99,\n}\n\n/** Published `activity_id` members of class 3002 (authentication). */\nexport enum OcsfAuthenticationActivity {\n  /** \"A new logon session was requested.\" Includes FAILED attempts — the verb is the request; the outcome rides `status_id`. */\n  LOGON = 1,\n  /** \"A logon session was terminated and no longer exists.\" */\n  LOGOFF = 2,\n  /** \"A preauthentication stage was engaged.\" Covers issuing an OTP or magic link: a stage BEFORE authentication. */\n  PREAUTH = 6,\n  OTHER = 99,\n}\n\n/** Published `activity_id` members of class 6003 (api_activity). */\nexport enum OcsfApiActivity {\n  CREATE = 1,\n  /** \"Read\" — the only CRUD verb our authorization/data-access events reliably carry. */\n  READ = 2,\n  UPDATE = 3,\n  DELETE = 4,\n  OTHER = 99,\n}\n\n/** Published `activity_id` members of class 3004 (entity_management). */\nexport enum OcsfEntityManagementActivity {\n  CREATE = 1,\n  READ = 2,\n  UPDATE = 3,\n  DELETE = 4,\n  MOVE = 5,\n  /** \"Enroll an existing managed entity.\" A member joining a tenant. */\n  ENROLL = 6,\n  UNENROLL = 7,\n  ENABLE = 8,\n  DISABLE = 9,\n  ACTIVATE = 10,\n  DEACTIVATE = 11,\n  SUSPEND = 12,\n  /** \"Resume (unsuspend) an existing managed entity.\" SUSPENDED is the only state our activate runs from. */\n  RESUME = 13,\n  OTHER = 99,\n}\n\n/** Published `activity_id` members of class 3007 (user_management). */\nexport enum OcsfUserManagementActivity {\n  CREATE = 1,\n  UPDATE = 2,\n  DELETE = 3,\n  ENABLE = 4,\n  DISABLE = 5,\n  LOCK = 6,\n  UNLOCK = 7,\n  PASSWORD_CHANGE = 8,\n  PASSWORD_RESET = 9,\n  ATTACH_POLICIES = 10,\n  DETACH_POLICIES = 11,\n  ENABLE_MFA_FACTORS = 12,\n  DISABLE_MFA_FACTORS = 13,\n  ASSIGN_PRIVILEGES = 14,\n  REMOVE_PRIVILEGES = 15,\n  ASSIGN_ROLES = 16,\n  REMOVE_ROLES = 17,\n  ADD_PROGRAMMATIC_CREDENTIALS = 18,\n  REMOVE_PROGRAMMATIC_CREDENTIALS = 19,\n  OTHER = 99,\n}\n\n/**\n * Every published activity id, per class — the membership check's source of truth.\n *\n * An activity number is only meaningful WITH its class: `1` is `Logon` in 3002 and `Create` in 6003.\n * So a row that assigns the right number under the wrong class is silently wrong, and nothing about\n * the emitted document would look malformed. {@link assertActivitiesBelongToTheirClass} closes that.\n */\nconst PUBLISHED_ACTIVITIES_BY_CLASS: Readonly<Record<OcsfClassUid, ReadonlySet<number>>> = {\n  [OcsfClassUid.AUTHENTICATION]: new Set(Object.values(OcsfAuthenticationActivity).filter((v): v is number => typeof v === 'number')),\n  [OcsfClassUid.API_ACTIVITY]: new Set(Object.values(OcsfApiActivity).filter((v): v is number => typeof v === 'number')),\n  [OcsfClassUid.ENTITY_MANAGEMENT]: new Set(Object.values(OcsfEntityManagementActivity).filter((v): v is number => typeof v === 'number')),\n  [OcsfClassUid.USER_MANAGEMENT]: new Set(Object.values(OcsfUserManagementActivity).filter((v): v is number => typeof v === 'number')),\n};\n\n/**\n * The activity each core audit event resolves to.\n *\n * **Total over `CoreAuditableEventType`**, so a new core event type cannot be added without deciding\n * its activity — the same shape the classification map now has, and for the same reason: an open set\n * silently defaulting is how `activity_id` stayed `Unknown` for every event in the first place.\n */\nexport const OCSF_ACTIVITY_BY_EVENT_TYPE: Readonly<Record<CoreAuditableEventType, number>> = {\n\n  // ── AUTHENTICATION ──\n  [CoreAuditableEventType.EMERGENCY_ACCESS_USED]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.MACHINE_AUTH_FAILED]: OcsfAuthenticationActivity.LOGON,\n  [CoreAuditableEventType.MACHINE_AUTH_SUCCESS]: OcsfAuthenticationActivity.LOGON,\n  [CoreAuditableEventType.OAUTH_CIMD_CLIENT_REFUSED]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.OAUTH_CODE_EXCHANGE_FAILED]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.OAUTH_DYNAMIC_CLIENT_REGISTERED]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.OAUTH_TOKEN_REFRESHED]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.OAUTH_TOKEN_REVOKED]: OcsfAuthenticationActivity.OTHER,\n  // Unlike the token-revoke sibling above (a no-oracle RFC 7009 ATTEMPT → Other), an RP-Initiated Logout\n  // terminates a real user SESSION, so it is a genuine OCSF Logoff — matching USER_LOGOUT / SAML_SLO_COMPLETED.\n  [CoreAuditableEventType.OAUTH_RP_INITIATED_LOGOUT]: OcsfAuthenticationActivity.LOGOFF,\n  [CoreAuditableEventType.ONE_OFF_TOKEN_CREATED]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.ONE_OFF_TOKEN_EXCHANGED]: OcsfAuthenticationActivity.OTHER,\n  // Admin token-lifecycle, not an OCSF user LOGOFF — Other(99) + activity_name, matching the family.\n  [CoreAuditableEventType.ONE_OFF_TOKEN_REVOKED]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.SAML_ASSERTION_REPLAY_DETECTED]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.SAML_LOGIN_FAILED]: OcsfAuthenticationActivity.LOGON,\n  [CoreAuditableEventType.SAML_LOGIN_INITIATED]: OcsfAuthenticationActivity.LOGON,\n  [CoreAuditableEventType.SAML_LOGIN_SUCCESS]: OcsfAuthenticationActivity.LOGON,\n  [CoreAuditableEventType.SAML_SLO_COMPLETED]: OcsfAuthenticationActivity.LOGOFF,\n  [CoreAuditableEventType.SAML_SLO_INITIATED]: OcsfAuthenticationActivity.LOGOFF,\n  [CoreAuditableEventType.USER_ACCOUNT_LOCKED]: OcsfAuthenticationActivity.OTHER, // 3007 publishes Lock(6), but this event's category routes it to 3002, which does not\n  [CoreAuditableEventType.USER_CROSS_FRONTEND_HANDOFF_ISSUED]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.USER_IDENTITY_LINK_REMOVED]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.USER_LOGIN]: OcsfAuthenticationActivity.LOGON,\n  [CoreAuditableEventType.USER_LOGIN_FAILED]: OcsfAuthenticationActivity.LOGON,\n  [CoreAuditableEventType.USER_LOGOUT]: OcsfAuthenticationActivity.LOGOFF,\n  [CoreAuditableEventType.USER_MAGIC_LINK_FAILED]: OcsfAuthenticationActivity.LOGON,\n  [CoreAuditableEventType.USER_MAGIC_LINK_SENT]: OcsfAuthenticationActivity.PREAUTH,\n  [CoreAuditableEventType.USER_MAGIC_LINK_VERIFIED]: OcsfAuthenticationActivity.LOGON,\n  [CoreAuditableEventType.USER_MFA_DISABLED]: OcsfAuthenticationActivity.OTHER, // 3007 publishes Disable MFA Factors(13), but this event's category routes it to 3002, which does not\n  [CoreAuditableEventType.USER_MFA_EMAIL_OTP_SENT]: OcsfAuthenticationActivity.PREAUTH,\n  [CoreAuditableEventType.USER_MFA_ENABLED]: OcsfAuthenticationActivity.OTHER, // 3007 publishes Enable MFA Factors(12), but this event's category routes it to 3002, which does not\n  [CoreAuditableEventType.USER_MFA_SETUP_COMPLETED]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.USER_MFA_SETUP_STARTED]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.USER_PASSKEY_AUTHENTICATION_FAILURE]: OcsfAuthenticationActivity.LOGON,\n  [CoreAuditableEventType.USER_PASSKEY_AUTHENTICATION_SUCCESS]: OcsfAuthenticationActivity.LOGON,\n  [CoreAuditableEventType.USER_PASSKEY_CLONE_SUSPECTED]: OcsfAuthenticationActivity.LOGON,\n  [CoreAuditableEventType.USER_PASSKEY_REGISTERED]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.USER_PASSKEY_REMOVED]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.USER_PASSWORD_CHANGED]: OcsfAuthenticationActivity.OTHER, // 3007 publishes Password Change(8), but this event's category routes it to 3002, which does not\n  [CoreAuditableEventType.USER_PASSWORD_RESET_COMPLETED]: OcsfAuthenticationActivity.OTHER, // 3007 publishes Password Reset(9), but this event's category routes it to 3002, which does not\n  [CoreAuditableEventType.USER_PASSWORD_RESET_FORCED]: OcsfAuthenticationActivity.OTHER, // 3007 publishes Password Reset(9), but this event's category routes it to 3002, which does not\n  [CoreAuditableEventType.USER_PASSWORD_RESET_REQUESTED]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.USER_PASSWORD_SET]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.USER_REFRESH_TOKEN_REUSE_DETECTED]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.USER_SESSION_EXPIRED]: OcsfAuthenticationActivity.LOGOFF,\n  /*\n   * LOGOFF, like the expiry above: the session is terminated and no longer exists, which is what the\n   * OCSF verb states. The DIFFERENCE between the two — time elapsed versus a cap displacing a live\n   * chain — is not expressible in `activity_id`, so it rides the typed eventData and the WARNING\n   * severity instead. Mapping it to OTHER would have lost the one thing a SIEM correlates on.\n   */\n  [CoreAuditableEventType.USER_SESSION_EVICTED]: OcsfAuthenticationActivity.LOGOFF,\n  [CoreAuditableEventType.USER_SMS_OTP_FAILED]: OcsfAuthenticationActivity.LOGON,\n  [CoreAuditableEventType.USER_SMS_OTP_SENT]: OcsfAuthenticationActivity.PREAUTH,\n  [CoreAuditableEventType.USER_SMS_OTP_VERIFIED]: OcsfAuthenticationActivity.LOGON,\n  [CoreAuditableEventType.USER_SSO_ENFORCEMENT_BLOCKED]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.USER_SSO_LOGIN]: OcsfAuthenticationActivity.LOGON,\n  [CoreAuditableEventType.USER_SSO_LOGIN_FAILED]: OcsfAuthenticationActivity.LOGON,\n  [CoreAuditableEventType.USER_TOKEN_REFRESHED]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.USER_TOTP_DISABLED]: OcsfAuthenticationActivity.OTHER,\n\n  // ── AUTHORIZATION ──\n  // A file upload grant delegates one upload under the minter's authority; issuing/revoking it is not\n  // one of 6003's CRUD verbs on a resource.\n  [CoreAuditableEventType.FILE_UPLOAD_GRANT_ISSUED]: OcsfApiActivity.OTHER,\n  [CoreAuditableEventType.FILE_UPLOAD_GRANT_REVOKED]: OcsfApiActivity.OTHER,\n  [CoreAuditableEventType.APPLICATION_SUPER_ADMIN_FLOOR_BREACHED]: OcsfApiActivity.OTHER,\n  [CoreAuditableEventType.CROSS_TENANT_ADMINISTRATIVE_ACCESS]: OcsfApiActivity.OTHER,\n  [CoreAuditableEventType.OAUTH2_PROVIDER_BLOCKED]: OcsfApiActivity.OTHER,\n  [CoreAuditableEventType.OAUTH_CONSENT_BINDING_VIOLATION]: OcsfApiActivity.OTHER,\n  [CoreAuditableEventType.OAUTH_CONSENT_DENIED]: OcsfApiActivity.OTHER,\n  [CoreAuditableEventType.OAUTH_CONSENT_GRANTED]: OcsfApiActivity.OTHER,\n  [CoreAuditableEventType.OAUTH_CONSENT_GRANT_PERSISTED]: OcsfApiActivity.OTHER,\n  [CoreAuditableEventType.OAUTH_DELEGATED_TOKEN_ISSUED]: OcsfApiActivity.OTHER,\n  [CoreAuditableEventType.ORGANIZATION_MEMBER_ROLE_CHANGED]: OcsfApiActivity.OTHER, // a role change is not one of 6003 CRUD verbs\n  [CoreAuditableEventType.ORGANIZATION_OWNER_FLOOR_BREACHED]: OcsfApiActivity.OTHER,\n  [CoreAuditableEventType.ORGANIZATION_UNIT_MEMBER_REMOVED]: OcsfApiActivity.OTHER,\n  [CoreAuditableEventType.ORGANIZATION_UNIT_MEMBER_ROLE_CHANGED]: OcsfApiActivity.OTHER,\n  [CoreAuditableEventType.PLATFORM_ACCESS_GRANT_LIFECYCLE]: OcsfApiActivity.OTHER,\n  [CoreAuditableEventType.RESOURCE_OPERATION_DENIED]: OcsfApiActivity.OTHER, // the CRUD verb is runtime data (the operation), not derivable from the event type\n  [CoreAuditableEventType.RESOURCE_OPERATION_PERFORMED]: OcsfApiActivity.OTHER, // the CRUD verb is runtime data (the operation), not derivable from the event type\n  [CoreAuditableEventType.USER_APP_ROLES_CHANGED]: OcsfApiActivity.OTHER, // a role change is not one of 6003 CRUD verbs\n\n  // ── DATA_ACCESS ──\n  [CoreAuditableEventType.FIELD_ACCESS]: OcsfApiActivity.READ,\n  // CREATE, not OTHER: redeeming a grant IS the creation of one FILES row — the one DATA_ACCESS event\n  // whose CRUD verb is derivable from the type, like PLATFORM_DIRECTORY_ACCESS below.\n  [CoreAuditableEventType.FILE_UPLOAD_GRANT_REDEEMED]: OcsfApiActivity.CREATE,\n  // OTHER for both (#506): a scan CONCLUSION is not one of 6003's CRUD verbs on a resource. The file\n  // row is updated as a consequence, but the event names the finding, not the write — mapping it to\n  // UPDATE would tell a SIEM that a record was modified and lose that malware was found.\n  [CoreAuditableEventType.FILE_MALWARE_DETECTED]: OcsfApiActivity.OTHER,\n  [CoreAuditableEventType.FILE_MALWARE_SCAN_FAILED]: OcsfApiActivity.OTHER,\n  [CoreAuditableEventType.MACHINE_ACCESS]: OcsfApiActivity.OTHER, // names a surface reach (A2A/MCP turn), not a CRUD verb on a resource\n  // READ, not OTHER: enumerating a directory IS a read of resource rows, and it is the one case\n  // where the CRUD verb IS derivable from the event type — the event only ever names a collection\n  // read (list/search/count), never a mutation.\n  [CoreAuditableEventType.PLATFORM_DIRECTORY_ACCESS]: OcsfApiActivity.READ,\n  [CoreAuditableEventType.RETAINED_DATA_ACCESS]: OcsfApiActivity.READ,\n  [CoreAuditableEventType.SUBJECT_DATA_EXPORT]: OcsfApiActivity.READ,\n  [CoreAuditableEventType.COLLECTION_DATA_EXPORT]: OcsfApiActivity.READ,\n  [CoreAuditableEventType.HTTP_API_READ_THROUGH_ACCESS]: OcsfApiActivity.READ,\n  // D6 stance 6b: the declared external-erasure operation DELETED remote rows.\n  [CoreAuditableEventType.HTTP_API_EXTERNAL_ERASURE]: OcsfApiActivity.DELETE,\n  // D6 stance 6c: nothing was deleted — the event records a deliberate non-action.\n  [CoreAuditableEventType.HTTP_API_NON_ERASURE_ACKNOWLEDGED]: OcsfApiActivity.OTHER,\n  [CoreAuditableEventType.SYSTEM_CONTEXT_READ]: OcsfApiActivity.READ,\n  [CoreAuditableEventType.SYSTEM_CONTEXT_WRITE]: OcsfApiActivity.OTHER, // static fallback only — refined per emission from eventData.operation (CREATE | UPDATE | UPDATE_MANY)\n\n  // ── ORG_MANAGEMENT ──\n  [CoreAuditableEventType.ORGANIZATION_ACTIVATED]: OcsfEntityManagementActivity.RESUME,\n  [CoreAuditableEventType.ORGANIZATION_CREATED]: OcsfEntityManagementActivity.CREATE,\n  [CoreAuditableEventType.ORGANIZATION_DELETED]: OcsfEntityManagementActivity.DELETE,\n  [CoreAuditableEventType.ORGANIZATION_DELETION_REQUESTED]: OcsfEntityManagementActivity.OTHER, // marks the tenant and opens a window; nothing is deleted yet, so Delete(4) would overstate it\n  [CoreAuditableEventType.ORGANIZATION_MEMBER_INVITED]: OcsfEntityManagementActivity.CREATE,\n  [CoreAuditableEventType.ORGANIZATION_MEMBER_JOINED]: OcsfEntityManagementActivity.ENROLL,\n  [CoreAuditableEventType.ORGANIZATION_MEMBER_REMOVED]: OcsfEntityManagementActivity.UNENROLL,\n  [CoreAuditableEventType.ORGANIZATION_MEMBER_STATUS_CHANGED]: OcsfEntityManagementActivity.UPDATE,\n  [CoreAuditableEventType.ORGANIZATION_MEMBER_UPDATED]: OcsfEntityManagementActivity.UPDATE,\n  [CoreAuditableEventType.ORGANIZATION_NOTIFICATIONS_UPDATED]: OcsfEntityManagementActivity.UPDATE,\n  [CoreAuditableEventType.ORGANIZATION_PREFERENCES_UPDATED]: OcsfEntityManagementActivity.UPDATE,\n  [CoreAuditableEventType.ORGANIZATION_PROFILE_UPDATED]: OcsfEntityManagementActivity.UPDATE,\n  [CoreAuditableEventType.ORGANIZATION_RESTORED]: OcsfEntityManagementActivity.OTHER, // un-deletion has no 3004 member; Resume(13) is unsuspend and Activate(10) is a transient engine state\n  [CoreAuditableEventType.ORGANIZATION_SIEM_EXPORT_CONFIGURED]: OcsfEntityManagementActivity.UPDATE,\n  // Organization provider credentials. The credential row IS the managed entity, so the three\n  // lifecycle verbs map onto its CRUD members directly — CREATE for the first grant, UPDATE for a\n  // rotation (the entity persists, its secret changes), DELETE for the withdrawal.\n  [CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_SET]: OcsfEntityManagementActivity.CREATE,\n  [CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_ROTATED]: OcsfEntityManagementActivity.UPDATE,\n  // READ(2), not OTHER: resolving the credential for an outbound call reads the managed entity, and\n  // READ is what an OCSF consumer's \"who accessed this secret\" query is written against. Mapping a\n  // spend to OTHER(99) would take the highest-value events in this family out of every stock rule.\n  [CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_USED]: OcsfEntityManagementActivity.READ,\n  [CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_DELETED]: OcsfEntityManagementActivity.DELETE,\n  // A person's own credential maps identically to the tenant's: the OCSF activity describes what was\n  // done to the managed entity, and that is the same verb regardless of who owns it. WHO owns it is\n  // carried by the event data, not by the activity — collapsing the two would make \"who accessed\n  // this secret\" queries miss half their population.\n  [CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_SET]: OcsfEntityManagementActivity.CREATE,\n  [CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_ROTATED]: OcsfEntityManagementActivity.UPDATE,\n  [CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_USED]: OcsfEntityManagementActivity.READ,\n  [CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_DELETED]: OcsfEntityManagementActivity.DELETE,\n  // CREATE, like the `_SET` siblings: what OCSF records is the verb done to the managed entity, and\n  // a connection coming into existence is a creation however it was obtained. The fact that this one\n  // came from a consent ceremony rather than a paste lives in the event DATA — an OCSF activity is\n  // deliberately a small closed vocabulary, and stretching it to carry provenance would make it a\n  // worse index of what happened, not a better one.\n  [CoreAuditableEventType.ORGANIZATION_PROVIDER_CONNECTION_GRANTED]: OcsfEntityManagementActivity.CREATE,\n  [CoreAuditableEventType.USER_PROVIDER_CONNECTION_GRANTED]: OcsfEntityManagementActivity.CREATE,\n  [CoreAuditableEventType.ORGANIZATION_SSO_CONFIGURATION_CHANGED]: OcsfEntityManagementActivity.UPDATE,\n  // An application authentication-policy change is a configuration entity being UPDATED — the same\n  // OCSF shape as the SSO / SIEM / SCIM configuration-change siblings around it. (Confirmed by the\n  // session that added the event: UPDATE is the intended activity.)\n  [CoreAuditableEventType.APPLICATION_AUTH_POLICY_CHANGED]: OcsfEntityManagementActivity.UPDATE,\n  [CoreAuditableEventType.ORGANIZATION_SUSPENDED]: OcsfEntityManagementActivity.SUSPEND,\n  [CoreAuditableEventType.ORGANIZATION_UNIT_UPDATED]: OcsfEntityManagementActivity.UPDATE,\n  [CoreAuditableEventType.ORGANIZATION_UPDATED]: OcsfEntityManagementActivity.UPDATE,\n  [CoreAuditableEventType.SAML_CERT_EXPIRING]: OcsfEntityManagementActivity.OTHER,\n  [CoreAuditableEventType.SAML_METADATA_PARSED]: OcsfEntityManagementActivity.OTHER,\n  [CoreAuditableEventType.SCIM_PROVISIONING_CONFIG_UPDATED]: OcsfEntityManagementActivity.UPDATE,\n  [CoreAuditableEventType.SCIM_PROVISIONING_FAILED]: OcsfEntityManagementActivity.OTHER,\n  [CoreAuditableEventType.SCIM_TOKEN_CREATED]: OcsfEntityManagementActivity.CREATE,\n  [CoreAuditableEventType.SCIM_TOKEN_GENERATED]: OcsfEntityManagementActivity.CREATE,\n  [CoreAuditableEventType.SCIM_TOKEN_REVOKED]: OcsfEntityManagementActivity.DELETE,\n  [CoreAuditableEventType.SCIM_TOKEN_ROTATED]: OcsfEntityManagementActivity.UPDATE,\n  [CoreAuditableEventType.WEBHOOK_ENDPOINT_TEST_DISPATCHED]: OcsfEntityManagementActivity.OTHER,\n\n  // ── USER_LIFECYCLE ──\n  [CoreAuditableEventType.RESOURCE_STATUS_TRANSITION_PERFORMED]: OcsfUserManagementActivity.OTHER,\n  [CoreAuditableEventType.SAML_EMAIL_CHANGED]: OcsfUserManagementActivity.UPDATE,\n  [CoreAuditableEventType.SCIM_USER_DEACTIVATED]: OcsfUserManagementActivity.DISABLE,\n  [CoreAuditableEventType.SCIM_USER_PROVISIONED]: OcsfUserManagementActivity.CREATE,\n  [CoreAuditableEventType.SCIM_USER_UPDATED]: OcsfUserManagementActivity.UPDATE,\n  [CoreAuditableEventType.USER_CREATED]: OcsfUserManagementActivity.CREATE,\n  [CoreAuditableEventType.USER_DELETED]: OcsfUserManagementActivity.DELETE,\n  [CoreAuditableEventType.USER_EMAIL_VERIFIED]: OcsfUserManagementActivity.UPDATE,\n  [CoreAuditableEventType.USER_PHONE_VERIFICATION_FAILED]: OcsfUserManagementActivity.OTHER,\n  [CoreAuditableEventType.USER_PHONE_VERIFIED]: OcsfUserManagementActivity.UPDATE,\n  [CoreAuditableEventType.USER_REGISTERED]: OcsfUserManagementActivity.CREATE,\n  [CoreAuditableEventType.USER_UPDATED]: OcsfUserManagementActivity.UPDATE,\n  [CoreAuditableEventType.USER_VERIFICATION_EMAIL_RESENT]: OcsfUserManagementActivity.OTHER,\n};\n\n/**\n * Fail at module load if any row assigns an activity its own class does not publish.\n *\n * This is the check the table exists to make possible. Activity numbers are class-scoped and collide\n * across classes, so a misfiled row produces a document that is structurally valid, schema-conformant,\n * and semantically wrong — the failure mode nothing downstream can catch.\n */\nfunction assertActivitiesBelongToTheirClass(): void {\n  const offenders: string[] = [];\n  for (const [eventType, activityId] of Object.entries(OCSF_ACTIVITY_BY_EVENT_TYPE)) {\n    const category = getAuditEventClassification(eventType).category;\n    const descriptor = OCSF_CLASS_BY_AUDIT_CATEGORY[category as AuditEventCategory];\n    if (!PUBLISHED_ACTIVITIES_BY_CLASS[descriptor.classUid].has(activityId)) {\n      offenders.push(`${eventType} → activity ${activityId} is not published by class ${descriptor.classUid}`);\n    }\n  }\n  if (offenders.length > 0) {\n    throw new Error(`OCSF activity mapping assigns activities their class does not publish:\\n  ${offenders.join('\\n  ')}`);\n  }\n}\nassertActivitiesBelongToTheirClass();\n\n/**\n * Resolve the OCSF activity for an event type.\n *\n * Application-defined event types are ordinary strings the engine cannot enumerate, so they resolve to\n * `UNKNOWN` — the one case where \"we cannot say\" is the truthful answer.\n */\nexport function resolveOcsfActivityId(eventType: string): number {\n  return OCSF_ACTIVITY_BY_EVENT_TYPE[eventType as CoreAuditableEventType] ?? OcsfCommonActivity.UNKNOWN;\n}\n\n/**\n * The `activity_name` companion for an `OTHER` assignment, or `undefined` when the activity is specific.\n *\n * The schema's own definition of `OTHER` points the reader at `activity_name`, so emitting `OTHER`\n * without it discards the very information the value promises is available.\n *\n * Takes the RESOLVED activity rather than re-deriving it from the event type. That distinction became\n * load-bearing when 6003 gained runtime refinement: an event whose TABLE entry is `Other` but whose\n * refined activity is `Update` must NOT carry `activity_name`, and a version of this that re-derived\n * from the event type would have emitted both — a specific activity plus a companion asserting it was\n * unmapped. Two ways to answer one question is the drift this contract exists to prevent.\n */\nexport function resolveOcsfActivityName(activityId: number, eventType: string): string | undefined {\n  return activityId === OcsfCommonActivity.OTHER ? eventType : undefined;\n}\n\n/**\n * OCSF `auth_protocol_id` — the NORMALISED authentication protocol.\n *\n * spec-cite: OCSF 1.9.0 — `schema.ocsf.io/api/1.9.0/classes/authentication`, the `auth_protocol_id`\n * enum. `auth_protocol` is documented as \"the authentication protocol as defined by the caption of\n * `auth_protocol_id`. In the case of Other, it is defined by the event source.\"\n */\nexport enum OcsfAuthProtocolId {\n  UNKNOWN = 0,\n  NTLM = 1,\n  KERBEROS = 2,\n  DIGEST = 3,\n  OPENID = 4,\n  SAML = 5,\n  OAUTH_2_0 = 6,\n  PAP = 7,\n  CHAP = 8,\n  EAP = 9,\n  RADIUS = 10,\n  BASIC_AUTHENTICATION = 11,\n  LDAP = 12,\n  OTHER = 99,\n}\n\n/** The published CAPTION for each id — what `auth_protocol` must carry when the id is not `Other`. */\nconst OCSF_AUTH_PROTOCOL_CAPTION: Readonly<Record<OcsfAuthProtocolId, string>> = {\n  [OcsfAuthProtocolId.UNKNOWN]: 'Unknown',\n  [OcsfAuthProtocolId.NTLM]: 'NTLM',\n  [OcsfAuthProtocolId.KERBEROS]: 'Kerberos',\n  [OcsfAuthProtocolId.DIGEST]: 'Digest',\n  [OcsfAuthProtocolId.OPENID]: 'OpenID',\n  [OcsfAuthProtocolId.SAML]: 'SAML',\n  [OcsfAuthProtocolId.OAUTH_2_0]: 'OAUTH 2.0',\n  [OcsfAuthProtocolId.PAP]: 'PAP',\n  [OcsfAuthProtocolId.CHAP]: 'CHAP',\n  [OcsfAuthProtocolId.EAP]: 'EAP',\n  [OcsfAuthProtocolId.RADIUS]: 'RADIUS',\n  [OcsfAuthProtocolId.BASIC_AUTHENTICATION]: 'Basic Authentication',\n  [OcsfAuthProtocolId.LDAP]: 'LDAP',\n  [OcsfAuthProtocolId.OTHER]: 'Other',\n};\n\n/**\n * The `AuthMethod` members that ARE a protocol OCSF normalises. Everything else resolves to `Other`.\n *\n * Deliberately partial. Three members are absent for a reason, and each absence is a decision:\n *\n * - `PASSWORD` is NOT `Basic Authentication` (11). Basic Auth is an HTTP transport scheme (RFC 7617);\n *   a user typing a password into a form is not that, and the resemblance is only in the English word.\n * - `MAGIC_LINK`, `TOTP`, `SMS_OTP`, `EMAIL_OTP` and `PASSKEY` name no protocol in the published enum.\n *   WebAuthn/FIDO2 in particular is absent from OCSF 1.9.0 — mapping a passkey to `Other` is the\n *   accurate answer, not a shortfall.\n * - `EXTERNAL_OAUTH2` DOES map: it is OAuth 2.0 by construction.\n *\n * The `ORG_` prefix on the SSO members is SCOPE, not protocol — an organization-restricted SAML login\n * is still SAML — so those normalise cleanly.\n */\nconst OCSF_AUTH_PROTOCOL_BY_AUTH_METHOD: Readonly<Partial<Record<AuthMethod, OcsfAuthProtocolId>>> = {\n  [AuthMethod.ORG_SAML]: OcsfAuthProtocolId.SAML,\n  [AuthMethod.ORG_OPENID_CONNECT]: OcsfAuthProtocolId.OPENID,\n  [AuthMethod.EXTERNAL_OAUTH2]: OcsfAuthProtocolId.OAUTH_2_0,\n};\n\n/** `auth_protocol` + `auth_protocol_id`, resolved together because the schema couples them. */\nexport interface OcsfAuthProtocol {\n  readonly protocol: string;\n  readonly protocolId: OcsfAuthProtocolId;\n}\n\n/**\n * Resolve the OCSF protocol pair for an envelope's `authMethod`.\n *\n * The two attributes are resolved TOGETHER because the schema defines one in terms of the other: when\n * the id is normalised, the string must be that id's published caption; only under `Other` may the\n * string be the producer's own value. Returning them separately invites the pairing to drift, which is\n * exactly how this shipped wrong the first time (`org_saml` with no id at all).\n *\n * `authMethod` is an OPEN string on the envelope — applications define their own — so anything outside\n * the framework's own `AuthMethod` vocabulary lands on `Other` carrying its raw value, which is\n * precisely what `Other` is for.\n */\nexport function resolveOcsfAuthProtocol(authMethod: string): OcsfAuthProtocol {\n  const normalised = OCSF_AUTH_PROTOCOL_BY_AUTH_METHOD[authMethod as AuthMethod];\n  return normalised === undefined\n    ? { protocol: authMethod, protocolId: OcsfAuthProtocolId.OTHER }\n    : { protocol: OCSF_AUTH_PROTOCOL_CAPTION[normalised], protocolId: normalised };\n}\n\n/**\n * The CRUD verb an API Activity (6003) event performed, mapped from the framework's core operation.\n *\n * spec-cite: OCSF 1.9.0 — `api_activity.activity_id` enum: 0 Unknown, 1 Create, 2 Read, 3 Update,\n * 4 Delete, 99 Other.\n *\n * The bulk forms collapse onto their singular verb: OCSF's activity names WHAT was done, and the\n * cardinality is carried separately by the envelope (`isBulkOperation` / `affectedRecordCount`).\n * `COUNT` is a Read — it answers a question about existing rows without changing any.\n */\nconst OCSF_API_ACTIVITY_BY_CORE_OPERATION: Readonly<Record<CoreResourceOperation, OcsfApiActivity>> = {\n  [CoreResourceOperation.CREATE]: OcsfApiActivity.CREATE,\n  [CoreResourceOperation.CREATE_MANY]: OcsfApiActivity.CREATE,\n  [CoreResourceOperation.READ]: OcsfApiActivity.READ,\n  [CoreResourceOperation.LIST]: OcsfApiActivity.READ,\n  [CoreResourceOperation.SEARCH]: OcsfApiActivity.READ,\n  [CoreResourceOperation.COUNT]: OcsfApiActivity.READ,\n  [CoreResourceOperation.UPDATE]: OcsfApiActivity.UPDATE,\n  [CoreResourceOperation.UPDATE_MANY]: OcsfApiActivity.UPDATE,\n  [CoreResourceOperation.DELETE]: OcsfApiActivity.DELETE,\n  [CoreResourceOperation.DELETE_MANY]: OcsfApiActivity.DELETE,\n};\n\n/**\n * The `eventData` keys that can name a 6003 event's CRUD verb, in precedence order.\n *\n * Three keys rather than one because the emitters spell it differently and each is authoritative for\n * its own event: `resourceOperationLike` is the core semantics a CUSTOM verb borrows (a `suspend`\n * behaving as an `update`), `operationIdentifier` is the verb on resource-operation and field-access\n * events, and `operation` is what `logSystemContextWrite` records — typed `CREATE | UPDATE |\n * UPDATE_MANY`, so it always resolves.\n *\n * Enumerated by the QUESTION (\"what names the verb on a 6003 event?\") rather than by one emitter's\n * field name, which is how `operation` was missed on the first pass.\n */\nconst OCSF_API_VERB_EVENT_DATA_KEYS = ['resourceOperationLike', 'operationIdentifier', 'operation'] as const;\n\n/**\n * Refine a 6003 event's `activity_id` from RUNTIME data, when the event type alone cannot say.\n *\n * Class 6003 is organised around the CRUD axis, and the resource-operation events (`performed` /\n * `denied`) are the bulk of what we route there — yet the event TYPE is the same string for a create\n * and a delete. So the table maps them to `Other`, and every authorization event landed in one\n * undifferentiated bucket: the same collapse `activity_id` being pinned to `Unknown` used to cause,\n * surviving one layer down after that was fixed.\n *\n * The verb is in the envelope — under one of {@link OCSF_API_VERB_EVENT_DATA_KEYS}, in that precedence\n * order. Anything else (a custom verb borrowing nothing) keeps `Other`, where `activity_name` already\n * carries the event type.\n *\n * Two consequences that are DECISIONS, not side effects:\n *\n * - **`FIELD_ACCESS` refines away from its static `Read`.** It carries `operationIdentifier`, so a\n *   secret exposed during a create now reads as Create(1). That is correct: 6003's activity names what\n *   the API CALL did, and the field-access nature rides `metadata.event_code`. The static `Read` remains\n *   the fallback for an emission that names no operation.\n * - **`SYSTEM_CONTEXT_WRITE` stops being `Other`.** Its table comment says \"neither Create nor Update is\n *   true of every emission\" — true of a STATIC mapping and not a permanent conclusion, because at\n *   runtime `operation` says exactly which. This matters more than most: it is the ACL-bypass write.\n */\nexport function refineOcsfApiActivity(eventData: unknown, fallback: number): number {\n  if (eventData === null || typeof eventData !== 'object') return fallback;\n  const record = eventData as Readonly<Record<string, unknown>>;\n  for (const key of OCSF_API_VERB_EVENT_DATA_KEYS) {\n    const candidate = record[key];\n    if (typeof candidate !== 'string') continue;\n    const mapped = OCSF_API_ACTIVITY_BY_CORE_OPERATION[candidate as CoreResourceOperation];\n    if (mapped !== undefined) return mapped;\n  }\n  return fallback;\n}\n"]}

package/dist/esm/config/bootstrap/application-runtime-profile.backend.d.ts

@@ -118,6 +118,11 @@ export interface ApplicationRuntimeProfileBootAssertions {
      * and only there.
      */
     assertsLayer2AuditProviderPresence: boolean;
+    /**
+     * Whether ENABLED members of `ENGINE_CAPABILITIES_REQUIRING_A_PROVIDER_WHEN_ENABLED` must resolve a
+     * provider on this host (#328). The application's own `required` flags are asserted everywhere.
+     */
+    assertsEngineCapabilityProviderFloor: boolean;
     /**
      * Whether this runtime performs boot-time SCHEMA/DATA MAINTENANCE over the
      * application's collections — the retention-marker backfill and the drifted

package/dist/esm/config/bootstrap/application-runtime-profile.backend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"application-runtime-profile.backend.d.ts","sourceRoot":"","sources":["../../../../../src/config/bootstrap/application-runtime-profile.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,oBAAY,yBAAyB;IACnC;;;;;;;OAOG;IACH,mBAAmB,wBAAwB;IAC3C;;;;;OAKG;IACH,MAAM,WAAW;CAClB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,uCAAuC;IACtD;;;;;;;;OAQG;IACH,2CAA2C,EAAE,OAAO,CAAC;IACrD;;;;;;;;;OASG;IACH,sCAAsC,EAAE,OAAO,CAAC;IAChD;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,kCAAkC,EAAE,OAAO,CAAC;IAC5C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACH,6BAA6B,EAAE,OAAO,CAAC;IAEvC;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,qCAAqC,EAAE,OAAO,CAAC;IAC/C;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,sCAAsC,EAAE,OAAO,CAAC;CACjD;AAED;;;;;;;GAOG;AACH,wBAAgB,8CAA8C,CAC5D,OAAO,EAAE,yBAAyB,GACjC,uCAAuC,CAoDzC;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,8BAA8B;IAC7C;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,+BAA+B,EAAE,OAAO,CAAC;CAC1C;AAED;;;;GAIG;AACH,wBAAgB,qCAAqC,CACnD,OAAO,EAAE,yBAAyB,GACjC,8BAA8B,CAahC"}
+{"version":3,"file":"application-runtime-profile.backend.d.ts","sourceRoot":"","sources":["../../../../../src/config/bootstrap/application-runtime-profile.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,oBAAY,yBAAyB;IACnC;;;;;;;OAOG;IACH,mBAAmB,wBAAwB;IAC3C;;;;;OAKG;IACH,MAAM,WAAW;CAClB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,uCAAuC;IACtD;;;;;;;;OAQG;IACH,2CAA2C,EAAE,OAAO,CAAC;IACrD;;;;;;;;;OASG;IACH,sCAAsC,EAAE,OAAO,CAAC;IAChD;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,kCAAkC,EAAE,OAAO,CAAC;IAC5C;;;OAGG;IACH,oCAAoC,EAAE,OAAO,CAAC;IAC9C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACH,6BAA6B,EAAE,OAAO,CAAC;IAEvC;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,qCAAqC,EAAE,OAAO,CAAC;IAC/C;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,sCAAsC,EAAE,OAAO,CAAC;CACjD;AAED;;;;;;;GAOG;AACH,wBAAgB,8CAA8C,CAC5D,OAAO,EAAE,yBAAyB,GACjC,uCAAuC,CA0DzC;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,8BAA8B;IAC7C;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,+BAA+B,EAAE,OAAO,CAAC;CAC1C;AAED;;;;GAIG;AACH,wBAAgB,qCAAqC,CACnD,OAAO,EAAE,yBAAyB,GACjC,8BAA8B,CAahC"}

package/dist/esm/config/bootstrap/application-runtime-profile.backend.js

@@ -80,6 +80,9 @@ export function resolveApplicationRuntimeProfileBootAssertions(profile) {
                 // installed only here), so an enabled audit capability with no resolved
                 // provider is a genuine misconfiguration it must surface.
                 assertsLayer2AuditProviderPresence: true,
+                // The backend is the host that SERVES email, billing and SMS, so an enabled slot with
+                // nothing behind it is a misconfiguration it must refuse at boot (#328).
+                assertsEngineCapabilityProviderFloor: true,
                 // The backend owns application-wide schema maintenance. It is the one
                 // runtime holding database-wide authority, and a migration wants a
                 // single owner.
@@ -105,6 +108,9 @@ export function resolveApplicationRuntimeProfileBootAssertions(profile) {
                 // therefore correct, not a misconfiguration — warning on every restart
                 // would be false-alarm noise.
                 assertsLayer2AuditProviderPresence: false,
+                // A minion's registry is filtered to ITS scope; the backend serves the engine flows, so
+                // an enabled email/billing/SMS slot resolving nothing here is the normal topology (#328).
+                assertsEngineCapabilityProviderFloor: false,
                 // A minion must NOT. Its database user is collection-scoped to what
                 // `resourceAccess` declared, so a backfill over every retention-governed
                 // collection is both unauthorised and not its concern. The backend