npm - @wildo-ai/saas-backend-lib - Versions diffs - 1.1.2 → 1.1.4 - Mend

@wildo-ai/saas-backend-lib 1.1.2 → 1.1.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1358) hide show

package/dist/esm/compliance/audit-trails/services/audit-logs.backend.service.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"audit-logs.backend.service.js","sourceRoot":"","sources":["../../../../../../src/compliance/audit-trails/services/audit-logs.backend.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAC3H,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAChK,OAAO,EAAE,kCAAkC,EAAE,MAAM,0CAA0C,CAAC;AAG9F,OAAO,EACL,2BAA2B,EAmF3B,sBAAsB,EAGtB,8BAA8B,EAG9B,0BAA0B,EAC1B,4BAA4B,EAC5B,oBAAoB,EAGpB,cAAc,EACd,qCAAqC,GAGtC,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,2DAA2D,EAAE,uCAAuC,EAAE,MAAM,uBAAuB,CAAC;AACjN,OAAO,EACL,kCAAkC,EAClC,0CAA0C,EAC1C,yCAAyC,GAC1C,MAAM,qFAAqF,CAAC;AAE7F,OAAO,EAAE,sBAAsB,EAAE,MAAM,+DAA+D,CAAC;AACvG,OAAO,EAAE,qCAAqC,EAAE,MAAM,+EAA+E,CAAC;AAoB/H,IAAM,uBAAuB,GAA7B,MAAM,uBAAuB;IAIoB;IACa;IACe;IACP;IACU;IACb;IAIE;IAZzD,QAAQ,CAA+D;IAExF,YACsD,MAAqB,EACR,YAAwC,EACzB,oBAA+D,EACtE,oBAAwD,EAC9C,uBAA8D,EAC3E,YAA2B,EAIzB,cAA+B;QATnD,WAAM,GAAN,MAAM,CAAe;QACR,iBAAY,GAAZ,YAAY,CAA4B;QACzB,yBAAoB,GAApB,oBAAoB,CAA2C;QACtE,yBAAoB,GAApB,oBAAoB,CAAoC;QAC9C,4BAAuB,GAAvB,uBAAuB,CAAuC;QAC3E,iBAAY,GAAZ,YAAY,CAAe;QAIzB,mBAAc,GAAd,cAAc,CAAiB;QAEvG,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,yBAAyB,CAAC,CAAC;QACnE,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,yBAAyB,EAAE,IAAI,CAAC,CAAC;IACnE,CAAC;IAED;;;;;;;;;OASG;IACK,KAAK,CAAC,wBAAwB;QACpC,MAAM,SAAS,GAAkD;YAC/D,kBAAkB,EAAE,gBAAgB,CAAC,UAAU;YAC/C,mBAAmB,EAAE,qBAAqB,CAAC,MAAM;YACjD,WAAW,EAAE,4BAA4B,CAAC,eAAe;YACzD,kBAAkB,EAAE,IAAI;SACzB,CAAC;QAEF,OAAO,IAAI,CAAC,uBAAuB,CAAC,0BAA0B,CAAC;YAC7D,SAAS;YACT,+BAA+B,EAAE,IAAI,GAAG,EAAE;YAC1C,YAAY,EAAE,IAAI;YAClB,cAAc,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,mBAAmB,EAAE,oBAAoB,CAAC,WAAW,EAAE,CAAC;SAC3H,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACI,KAAK,CAAC,QAAQ,CACnB,UAA8G,EAC9G,uBAA+C;QAE/C,OAAO,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,uBAAuB,CAAC,CAAC;IACnE,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,eAAe,CAC3B,UAA8G,EAC9G,uBAA+C,EAC/C,aAA+B;QAE/B,MAAM,cAAc,GAAG,2BAA2B,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACzE,6EAA6E;QAC7E,+EAA+E;QAC/E,8EAA8E;QAC9E,wEAAwE;QACxE,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;QAC7B,oGAAoG;QACpG,mGAAmG;QACnG,wGAAwG;QACxG,mGAAmG;QACnG,mGAAmG;QACnG,MAAM,YAAY,GAAG,sBAAsB,EAAE,CAAC;QAC9C,MAAM,aAAa,GAAG,uBAAuB,EAAE,aAAa,IAAI,YAAY,EAAE,aAAa,CAAC;QAC5F,MAAM,mBAAmB,GAAG,YAAY,EAAE,mBAAmB,CAAC;QAC9D,sFAAsF;QACtF,mGAAmG;QACnG,sGAAsG;QACtG,qGAAqG;QACrG,MAAM,gBAAgB,GAAG,YAAY,EAAE,gBAAgB,CAAC;QACxD,MAAM,YAAY,GAAG;YACnB,GAAG,UAAU;YACb,OAAO;YACP,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3C,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvD,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,SAAS,EAAE,UAAU,CAAC,SAAgC;YACtD,aAAa,EAAE,cAAc,CAAC,QAAQ;YACtC,QAAQ,EAAE,cAAc,CAAC,QAAQ;YACjC,SAAS,EAAE,IAAI,IAAI,EAAE;YACrB,SAAS,EAAE,IAAI,IAAI,EAAE;SACtB,CAAC;QAEF,8EAA8E;QAC9E,6EAA6E;QAC7E,+EAA+E;QAC/E,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,EAAE,CAAC;YACjD,MAAM,SAAS,GAAG,IAAI,CAAC,oBAAoB,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;YAC9F,6FAA6F;YAC7F,uFAAuF;YACvF,2FAA2F;YAC3F,yFAAyF;YACzF,8FAA8F;YAC9F,6FAA6F;YAC7F,6FAA6F;YAC7F,0FAA0F;YAC1F,+FAA+F;YAC/F,2FAA2F;YAC3F,6FAA6F;YAC7F,qFAAqF;YACrF,+FAA+F;YAC/F,8FAA8F;YAC9F,EAAE;YACF,4FAA4F;YAC5F,6FAA6F;YAC7F,8FAA8F;YAC9F,6FAA6F;YAC7F,8FAA8F;YAC9F,4FAA4F;YAC5F,wEAAwE;YACxE,oGAAoG;YACpG,qDAAqD;YACrD,MAAM,SAAS,CAAC,MAAM,CAAC,EAAE,EAAE,YAAY,EAAE;gBACvC,4BAA4B,EAAE,uCAAuC,CACnE,yBAAyB,EACzB,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EACzB,qBAAqB,CAAC,MAAM,CAC7B;aACF,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,sBAAsB,UAAU,CAAC,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC;YAEjG,sFAAsF;YACtF,2FAA2F;YAC3F,yFAAyF;YACzF,wFAAwF;YACxF,wFAAwF;YACxF,oEAAoE;YACpE,0FAA0F;YAC1F,yFAAyF;YACzF,yCAAyC;YACzC,wFAAwF;YACxF,yFAAyF;YACzF,gGAAgG;YAChG,6FAA6F;YAC7F,4FAA4F;YAC5F,2EAA2E;YAC3E,MAAM,KAAK,GAAG,uBAAuB,EAAE,YAAY,EAAE,cAAc,CAAC;YACpE,MAAM,WAAW,GAAa,aAAa,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACtE,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,IAAI,CAAC,aAAa,IAAI,KAAK,IAAI,UAAU,CAAC,cAAc,IAAI,UAAU,CAAC,cAAc,KAAK,KAAK,EAAE,CAAC;oBAChG,uFAAuF;oBACvF,oFAAoF;oBACpF,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,uIAAuI,EAAE;wBAC1J,SAAS,EAAE,UAAU,CAAC,SAAS;wBAC/B,kBAAkB,EAAE,UAAU,CAAC,cAAc;wBAC7C,2BAA2B,EAAE,KAAK;qBACnC,CAAC,CAAC;gBACL,CAAC;gBACD,wFAAwF;gBACxF,yFAAyF;gBACzF,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;oBAChC,IAAI,CAAC,oBAAoB,CAAC,gCAAgC,CAAC,EAAE,EAAE,YAAY,EAAE,KAAK,CAAC;yBAChF,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,mDAAmD,EAAE,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;gBAC5H,CAAC;YACH,CAAC;YACD,4FAA4F;YAC5F,yFAAyF;YACzF,0FAA0F;YAC1F,2FAA2F;YAC3F,6FAA6F;YAC7F,4FAA4F;YAC5F,+FAA+F;YAC/F,iCAAiC;QACnC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,sDAAsD;YACtD,EAAE;YACF,2FAA2F;YAC3F,qGAAqG;YACrG,2FAA2F;YAC3F,8FAA8F;YAC9F,2BAA2B;YAC3B,EAAE;YACF,kFAAkF;YAClF,0FAA0F;YAC1F,+FAA+F;YAC/F,oFAAoF;YACpF,wFAAwF;YACxF,8FAA8F;YAC9F,4DAA4D;YAC5D,EAAE;YACF,wGAAwG;YACxG,qDAAqD;YACrD,MAAM,UAAU,GAAG,UAAU,CAAC,SAAgD,CAAC;YAC/E,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,iDAAiD,EAAE;gBACrE,KAAK;gBACL,SAAS,EAAE,UAAU,CAAC,SAAS;gBAC/B,OAAO;gBACP,sBAAsB,EAAE,UAAU,EAAE,YAAY;gBAChD,oBAAoB,EAAE,UAAU,EAAE,UAAU;gBAC5C,6BAA6B,EAAE,UAAU,EAAE,mBAAmB;gBAC9D,oBAAoB,EAAE,UAAU,EAAE,UAAU;gBAC5C,+FAA+F;gBAC/F,wGAAwG;gBACxG,WAAW,EAAE,UAAU,CAAC,MAAM;gBAC9B,cAAc,EAAE,UAAU,CAAC,cAAc;gBACzC,aAAa,EAAE,UAAU,CAAC,aAAa;gBACvC,SAAS,EAAE,UAAU,CAAC,SAAS;aAChC,CAAC,CAAC;YACH,oFAAoF;YACpF,yFAAyF;YACzF,6FAA6F;YAC7F,+FAA+F;YAC/F,4FAA4F;YAC5F,gGAAgG;YAChG,uFAAuF;YACvF,IAAI,CAAC,cAAc,EAAE,uBAAuB,EAAE,CAAC;QACjD,CAAC;QAED,2EAA2E;QAC3E,+EAA+E;QAC/E,mEAAmE;QACnE,0EAA0E;QAC1E,6EAA6E;QAC7E,wEAAwE;QACxE,KAAK,IAAI,CAAC,YAAY,EAAE,gBAAgB,CAAC,YAAY,CAAC,CAAC;IACzD,CAAC;IAED,kCAAkC;IAClC,8CAA8C;IAC9C,kCAAkC;IAElC;;;;;;;;;;;;;;OAcG;IACH;;;;;;;;;;;;;;;OAeG;IACI,KAAK,CAAC,oBAAoB,CAAC,IASjC;QACC,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,IAAI;YAC1C,SAAS,EAAE,sBAAsB,CAAC,mBAAmB;YACrD,SAAS,EAAE;gBACT,SAAS,EAAE,sBAAsB,CAAC,mBAAmB;gBACrD,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;gBAC7C,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;gBACjD,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;gBACvC,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;gBACrD,8BAA8B,EAAE,IAAI,CAAC,8BAA8B;gBACnE,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxE;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;OAUG;IACI,KAAK,CAAC,uBAAuB,CAAC,IASpC;QACC,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,0BAA0B,CAAC,GAAG;YAClG,SAAS,EAAE,sBAAsB,CAAC,sBAAsB;YACxD,SAAS,EAAE;gBACT,SAAS,EAAE,sBAAsB,CAAC,sBAAsB;gBACxD,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,yBAAyB,EAAE,IAAI,CAAC,yBAAyB;gBACzD,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;gBACvC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxE;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;OAYG;IACI,KAAK,CAAC,qBAAqB,CAAC,IAMlC;QACC,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,0BAA0B,CAAC,MAAM;YAC5C,SAAS,EAAE,sBAAsB,CAAC,oBAAoB;YACtD,SAAS,EAAE;gBACT,SAAS,EAAE,sBAAsB,CAAC,oBAAoB;gBACtD,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1E,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;gBACzC,aAAa,EAAE,IAAI,CAAC,aAAa;aAClC;SACF,CAAC,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,sBAAsB,CAAC,IAqBnC;QACC,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,GAAG;YACzC,SAAS,EAAE,sBAAsB,CAAC,mBAAmB;YACrD,SAAS,EAAE;gBACT,SAAS,EAAE,sBAAsB,CAAC,mBAAmB;gBACrD,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;aACrB;SACzB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH;;;;;;;;;;;;;;;;;;;;OAoBG;IACH;;;;;;;;;;;;;OAaG;IACI,KAAK,CAAC,+BAA+B,CAAC,IAW5C;QACC,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,cAAc;YAC3B,cAAc,EAAE,IAAI,CAAC,oBAAoB;YACzC,SAAS,EAAE,IAAI,CAAC,kBAAkB,KAAK,qCAAqC,CAAC,qBAAqB;gBAChG,CAAC,CAAC,0BAA0B,CAAC,IAAI;gBACjC,CAAC,CAAC,0BAA0B,CAAC,MAAM;YACrC,SAAS,EAAE,sBAAsB,CAAC,+BAA+B;YACjE,SAAS,EAAE;gBACT,SAAS,EAAE,sBAAsB,CAAC,+BAA+B;gBACjE,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;gBAC/C,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,eAAe,EAAE,IAAI,CAAC,eAAe;gBACrC,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;gBAC3C,eAAe,EAAE,IAAI,CAAC,eAAe;gBACrC,cAAc,EAAE,IAAI,CAAC,cAAc;aACb;SACzB,CAAC,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,kCAAkC,CAAC,IAY/C;QACC,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,cAAc;YAC3B,cAAc,EAAE,IAAI,CAAC,oBAAoB;YACzC,iFAAiF;YACjF,SAAS,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAC,CAAC,0BAA0B,CAAC,IAAI;YACvG,SAAS,EAAE,sBAAsB,CAAC,kCAAkC;YACpE,SAAS,EAAE;gBACT,SAAS,EAAE,sBAAsB,CAAC,kCAAkC;gBACpE,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;gBAC/C,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;gBAC7C,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;gBACzC,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;gBAC3C,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;gBACzC,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,aAAa,EAAE,IAAI,CAAC,aAAa;aACX;SACzB,CAAC,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,qBAAqB,CAAC,IAUlC;QACC,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,eAAe;YAC5B,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,IAAI;YAC1C,SAAS,EAAE,sBAAsB,CAAC,oBAAoB;YACtD,SAAS,EAAE;gBACT,SAAS,EAAE,sBAAsB,CAAC,oBAAoB;gBACtD,eAAe,EAAE,IAAI,CAAC,eAAe;gBACrC,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;gBAC7C,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;gBAC7C,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,SAAS,EAAE,IAAI,CAAC,SAAS;aACH;SACzB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACI,KAAK,CAAC,qBAAqB,CAAC,IAOlC;QACC,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,MAAM;YAC5C,SAAS,EAAE,sBAAsB,CAAC,oBAAoB;YACtD,SAAS,EAAE;gBACT,SAAS,EAAE,sBAAsB,CAAC,oBAAoB;gBACtD,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;aACrB;SACzB,CAAC,CAAC;IACL,CAAC;IAED,kCAAkC;IAClC,oCAAoC;IACpC,kCAAkC;IAElC;;OAEG;IACI,KAAK,CAAC,YAAY,CAAC,IAQzB,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,cAAc,GAAuC;YACzD,SAAS,EAAE,sBAAsB,CAAC,UAAU;YAC5C,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,GAAG;YACzC,SAAS,EAAE,sBAAsB,CAAC,UAAU;YAC5C,SAAS,EAAE,cAAqC,CAAC,wBAAwB;SAC1E,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,aAAa,CAAC,IAK1B;QACC,MAAM,SAAS,GAAwC;YACrD,SAAS,EAAE,sBAAsB,CAAC,WAAW;YAC7C,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,GAAG;YACzC,SAAS,EAAE,sBAAsB,CAAC,WAAW;YAC7C,SAAS,EAAE,SAAgC;SAC5C,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,kBAAkB,CAAC,IAS/B;QACC,mCAAmC;QACnC,MAAM,cAAc,GAA6C;YAC/D,SAAS,EAAE,sBAAsB,CAAC,iBAAiB;YACnD,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,SAAS,EAAE,6DAA6D;YAChF,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,MAAM;YAC5C,SAAS,EAAE,sBAAsB,CAAC,iBAAiB;YACnD,SAAS,EAAE,cAAqC,CAAC,wBAAwB;SAC1E,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,oBAAoB,CAAC,IAWjC,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAA+C;YAC5D,SAAS,EAAE,sBAAsB,CAAC,mBAAmB;YACrD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9D,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,IAAI;YAC1C,SAAS,EAAE,sBAAsB,CAAC,mBAAmB;YACrD,SAAS,EAAE,SAAS;SACrB,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED,kCAAkC;IAClC,uCAAuC;IACvC,kCAAkC;IAElC;;;;;;OAMG;IACI,KAAK,CAAC,qBAAqB,CAAC,IASlC,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAAgD;YAC7D,SAAS,EAAE,sBAAsB,CAAC,oBAAoB;YACtD,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;YAC7C,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,SAAS,EAAE,2CAA2C;YAC9D,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,GAAG;YACzC,SAAS,EAAE,sBAAsB,CAAC,oBAAoB;YACtD,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,oBAAoB,CAAC,IAUjC,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAA+C;YAC5D,SAAS,EAAE,sBAAsB,CAAC,mBAAmB;YACrD,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;YAC7C,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,SAAS;YACjB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,MAAM;YAC5C,SAAS,EAAE,sBAAsB,CAAC,mBAAmB;YACrD,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACI,KAAK,CAAC,gBAAgB,CAAC,IAW7B,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAA2C;YACxD,SAAS,EAAE,sBAAsB,CAAC,cAAc;YAChD,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;YAC7C,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,SAAS,EAAE,2CAA2C;YAC9D,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,GAAG;YACzC,SAAS,EAAE,sBAAsB,CAAC,cAAc;YAChD,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACI,gCAAgC,CACrC,IAAsB,EACtB,UAAgJ;QAEhJ,8FAA8F;QAC9F,6FAA6F;QAC7F,4FAA4F;QAC5F,qFAAqF;QACrF,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,KAAK,8BAA8B,CAAC,oBAAoB,CAAC;YAChG,MAAM,SAAS,GAAG,YAAY,IAAI,IAAI,CAAC,aAAa,KAAK,8BAA8B,CAAC,mBAAmB,CAAC;YAC5G,IAAI,CAAC,SAAS;gBAAE,OAAO,CAAC,wEAAwE;YAEhG,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,EAAE,iBAAiB,CAAC;YACxD,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,wFAAwF,EAAE;oBAC3G,aAAa,EAAE,IAAI,CAAC,aAAa;oBACjC,cAAc,EAAE,UAAU,CAAC,cAAc;iBAC1C,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,MAAM,OAAO,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,EAAE,aAAa,CAAC;YACpG,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAClE,MAAM,aAAa,GACjB,YAAY,IAAI,IAAI,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,cAA+B,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAEtH,KAAK,IAAI,CAAC,gBAAgB,CAAC;gBACzB,UAAU,EAAE,UAAU,CAAC,UAAU;gBACjC,YAAY,EAAE,UAAU,CAAC,YAAY;gBACrC,SAAS,EAAE,IAAI,CAAC,aAAa;gBAC7B,OAAO;gBACP,KAAK;gBACL,cAAc,EAAE,UAAU,CAAC,cAAc;gBACzC,kBAAkB,EAAE,UAAU,CAAC,kBAAkB;gBACjD,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;gBACnD,SAAS,EAAE,UAAU,CAAC,SAAS;gBAC/B,cAAc,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC,CAAC,SAAS;aAC7E,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,8CAA8C,EAAE;gBACpH,cAAc,EAAE,UAAU,CAAC,cAAc;gBACzC,GAAG,2BAA2B,CAAC,UAAU,CAAC;aAC3C,CAAC,CAAC,CAAC;QACN,CAAC;QAAC,OAAO,SAAS,EAAE,CAAC;YACnB,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,+DAA+D,EAAE;gBAClF,cAAc,EAAE,UAAU,CAAC,cAAc;gBACzC,GAAG,2BAA2B,CAAC,SAAS,CAAC;aAC1C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,kCAAkC;IAClC,2EAA2E;IAC3E,kCAAkC;IAClC,EAAE;IACF,4FAA4F;IAC5F,+FAA+F;IAC/F,6EAA6E;IAC7E,EAAE;IACF,kGAAkG;IAClG,qGAAqG;IACrG,kGAAkG;IAClG,qGAAqG;IACrG,kFAAkF;IAElF;;;;OAIG;IACI,KAAK,CAAC,4BAA4B,CAAC,IAQzC,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAAuD;YACpE,SAAS,EAAE,sBAAsB,CAAC,4BAA4B;YAC9D,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QACF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,MAAM;YAC5C,SAAS,EAAE,sBAAsB,CAAC,4BAA4B;YAC9D,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,sBAAsB,CAAC,IAQnC,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAAiD;YAC9D,SAAS,EAAE,sBAAsB,CAAC,qBAAqB;YACvD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QACF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,MAAM;YAC5C,SAAS,EAAE,sBAAsB,CAAC,qBAAqB;YACvD,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,qBAAqB,CAAC,IAOlC,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAAgD;YAC7D,SAAS,EAAE,sBAAsB,CAAC,oBAAoB;YACtD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QACF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,GAAG;YACzC,SAAS,EAAE,sBAAsB,CAAC,oBAAoB;YACtD,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,6BAA6B,CAAC,IAO1C,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAAwD;YACrE,SAAS,EAAE,sBAAsB,CAAC,6BAA6B;YAC/D,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC;QACF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,MAAM;YAC5C,SAAS,EAAE,sBAAsB,CAAC,6BAA6B;YAC/D,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED;;;;;;;;;;OAUG;IACI,KAAK,CAAC,oBAAoB,CAAC,IAIjC,EAAE,uBAA+C;QAChD,MAAM,SAAS,GAAoD;YACjE,SAAS,EAAE,sBAAsB,CAAC,yBAAyB;YAC3D,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC;QACF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,SAAS,EAAE,0BAA0B,CAAC,IAAI;YAC1C,SAAS,EAAE,sBAAsB,CAAC,yBAAyB;YAC3D,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;;;;;;;OAWG;IACI,KAAK,CAAC,0BAA0B,CAAC,IAMvC,EAAE,uBAA+C;QAChD,MAAM,SAAS,GAA0D;YACvE,SAAS,EAAE,sBAAsB,CAAC,+BAA+B;YACjE,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,oGAAoG;YACpG,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;YACnD,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QACF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,SAAS,EAAE,0BAA0B,CAAC,IAAI;YAC1C,SAAS,EAAE,sBAAsB,CAAC,+BAA+B;YACjE,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,CAAC,CAAC;IAC9B,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,sBAAsB,CAAC,IAMnC,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAAiD;YAC9D,SAAS,EAAE,sBAAsB,CAAC,qBAAqB;YACvD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;YAC7C,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QACF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,GAAG;YACzC,SAAS,EAAE,sBAAsB,CAAC,qBAAqB;YACvD,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,oBAAoB,CAAC,IAMjC,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAA+C;YAC5D,SAAS,EAAE,sBAAsB,CAAC,mBAAmB;YACrD,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;YAC7C,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QACF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,SAAS;YACjB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,GAAG;YACzC,SAAS,EAAE,sBAAsB,CAAC,mBAAmB;YACrD,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,yBAAyB,CAAC,IAQtC,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAAoD;YACjE,SAAS,EAAE,sBAAsB,CAAC,yBAAyB;YAC3D,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,6BAA6B,EAAE,IAAI,CAAC,6BAA6B;YACjE,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QACF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,GAAG;YACzC,SAAS,EAAE,sBAAsB,CAAC,yBAAyB;YAC3D,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,0BAA0B,CAAC,IAOvC,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAAqD;YAClE,SAAS,EAAE,sBAAsB,CAAC,0BAA0B;YAC5D,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QACF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,MAAM;YAC5C,SAAS,EAAE,sBAAsB,CAAC,0BAA0B;YAC5D,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,+BAA+B,CAAC,IAO5C,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAA0D;YACvE,SAAS,EAAE,sBAAsB,CAAC,+BAA+B;YACjE,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;YAC7C,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QACF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,+FAA+F;YAC/F,MAAM,EAAE,IAAI,CAAC,mBAAmB;YAChC,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,IAAI;YAC1C,SAAS,EAAE,sBAAsB,CAAC,+BAA+B;YACjE,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,gCAAgC,CAAC,IAO7C,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAA2D;YACxE,SAAS,EAAE,sBAAsB,CAAC,iCAAiC;YACnE,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QACF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,IAAI;YAC1C,SAAS,EAAE,sBAAsB,CAAC,iCAAiC;YACnE,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED,kCAAkC;IAClC,6BAA6B;IAC7B,kCAAkC;IAElC;;;;;;;;;;;;;;;;OAgBG;IACI,KAAK,CAAC,cAAc,CAAC,IAY3B,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAAyC;YACtD,SAAS,EAAE,sBAAsB,CAAC,YAAY;YAC9C,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;YAC7C,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,2BAA2B,EAAE,IAAI,CAAC,2BAA2B;YAC7D,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;SAC9C,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,MAAM,EAAE,8BAA8B;YAC5E,SAAS,EAAE,sBAAsB,CAAC,YAAY;YAC9C,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACI,KAAK,CAAC,6BAA6B,CACxC,IAQC,EACD,uBAA+C;QAE/C,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,cAAc,EAAE,aAAa,EAAE,GAAG,WAAW,EAAE,GAAG,IAAI,CAAC;QAEvF,MAAM,SAAS,GAAwD;YACrE,SAAS,EAAE,sBAAsB,CAAC,4BAA4B;YAC9D,GAAG,WAAW;SACf,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,WAAW;YACnB,cAAc;YACd,aAAa;YACb,SAAS;YACT,SAAS,EAAE,sBAAsB,CAAC,4BAA4B;YAC9D,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;;;;;OASG;IACI,KAAK,CAAC,0BAA0B,CACrC,IAIC,EACD,uBAA+C;QAE/C,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,GAAG,WAAW,EAAE,GAAG,IAAI,CAAC;QAE5D,MAAM,SAAS,GAAqD;YAClE,SAAS,EAAE,sBAAsB,CAAC,yBAAyB;YAC3D,GAAG,WAAW;SACf,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,WAAW;YACnB,aAAa;YACb,SAAS,EAAE,0BAA0B,CAAC,GAAG;YACzC,SAAS,EAAE,sBAAsB,CAAC,yBAAyB;YAC3D,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;;;;;;;;;OAaG;IACI,KAAK,CAAC,2BAA2B,CACtC,IAA0E,EAC1E,uBAA+C;QAE/C,MAAM,SAAS,GAAsD;YACnE,SAAS,EAAE,sBAAsB,CAAC,4BAA4B;YAC9D,GAAG,IAAI;SACR,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,eAAe;YAC5B,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,GAAG;YACzC,SAAS,EAAE,sBAAsB,CAAC,4BAA4B;YAC9D,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;;;;;;;;OAYG;IACI,KAAK,CAAC,yBAAyB,CACpC,IAAwE,EACxE,uBAA+C;QAE/C,MAAM,SAAS,GAAoD;YACjE,SAAS,EAAE,sBAAsB,CAAC,yBAAyB;YAC3D,GAAG,IAAI;SACR,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,MAAM;YAC5C,SAAS,EAAE,sBAAsB,CAAC,yBAAyB;YAC3D,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;;;;;;;OAWG;IACI,KAAK,CAAC,gCAAgC,CAC3C,IAA+E,EAC/E,uBAA+C;QAE/C,MAAM,SAAS,GAA2D;YACxE,SAAS,EAAE,sBAAsB,CAAC,iCAAiC;YACnE,GAAG,IAAI;SACR,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,IAAI;YAC1C,SAAS,EAAE,sBAAsB,CAAC,iCAAiC;YACnE,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACI,KAAK,CAAC,0BAA0B,CACrC,IAQC,EACD,uBAA+C;QAE/C,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,cAAc,EAAE,aAAa,EAAE,GAAG,WAAW,EAAE,GAAG,IAAI,CAAC;QAEvF,MAAM,SAAS,GAAqD;YAClE,SAAS,EAAE,sBAAsB,CAAC,yBAAyB;YAC3D,GAAG,WAAW;SACf,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,WAAW;YACnB,cAAc;YACd,aAAa;YACb,SAAS;YACT,SAAS,EAAE,sBAAsB,CAAC,yBAAyB;YAC3D,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,CAAC,CAAC;IAC9B,CAAC;IAED,kCAAkC;IAClC,6CAA6C;IAC7C,kCAAkC;IAElC;;OAEG;IACI,KAAK,CAAC,eAAe,CAAC,IAY5B,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAA0C;YACvD,SAAS,EAAE,sBAAsB,CAAC,cAAc;YAChD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;YACzC,SAAS,EAAE,sBAAsB,CAAC,cAAc;YAChD,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,qBAAqB,CAAC,IAWlC;QACC,MAAM,SAAS,GAAgD;YAC7D,SAAS,EAAE,sBAAsB,CAAC,qBAAqB;YACvD,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,SAAS;YACjB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,SAAS,EAAE,0BAA0B,CAAC,MAAM;YAC5C,SAAS,EAAE,sBAAsB,CAAC,qBAAqB;YACvD,SAAS,EAAE,SAAgC;SAC5C,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,4BAA4B,CAAC,IAQzC;QACC,MAAM,SAAS,GAAuD;YACpE,SAAS,EAAE,sBAAsB,CAAC,4BAA4B;YAC9D,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;YACrD,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,SAAS;YACjB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,IAAI;YAC1C,SAAS,EAAE,sBAAsB,CAAC,4BAA4B;YAC9D,SAAS,EAAE,SAAgC;SAC5C,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,qBAAqB,CAAC,IAMlC,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAAgD;YAC7D,SAAS,EAAE,sBAAsB,CAAC,oBAAoB;YACtD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,GAAG;YACzC,SAAS,EAAE,sBAAsB,CAAC,oBAAoB;YACtD,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACI,KAAK,CAAC,qCAAqC,CAAC,IAKlD,EAAE,uBAA+C;QAChD,MAAM,SAAS,GAAgE;YAC7E,SAAS,EAAE,sBAAsB,CAAC,sCAAsC;YACxE,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;YACjD,6BAA6B,EAAE,IAAI,CAAC,6BAA6B;YACjE,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,cAAc,EAAE,IAAI,CAAC,cAAc;SACpC,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,SAAS,EAAE,0BAA0B,CAAC,QAAQ;YAC9C,SAAS,EAAE,sBAAsB,CAAC,sCAAsC;YACxE,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACI,KAAK,CAAC,iCAAiC,CAAC,IAO9C,EAAE,uBAA+C;QAChD,MAAM,SAAS,GAA4D;YACzE,SAAS,EAAE,sBAAsB,CAAC,iCAAiC;YACnE,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;YACjD,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;YAC7C,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;SAC1C,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,SAAS,EAAE,0BAA0B,CAAC,QAAQ;YAC9C,SAAS,EAAE,sBAAsB,CAAC,iCAAiC;YACnE,SAAS,EAAE,SAAgC;YAC3C,cAAc,EAAE,IAAI,CAAC,cAAc;SACpC,EAAE,uBAAuB,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACI,KAAK,CAAC,sBAAsB,CAAC,IAQnC,EAAE,uBAA+C;QAChD,MAAM,SAAS,GAAiD;YAC9D,SAAS,EAAE,sBAAsB,CAAC,sBAAsB;YACxD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,SAAS;YACtB,SAAS,EAAE,0BAA0B,CAAC,IAAI;YAC1C,SAAS,EAAE,sBAAsB,CAAC,sBAAsB;YACxD,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACI,KAAK,CAAC,iCAAiC,CAAC,IAS9C,EAAE,uBAA+C;QAChD,MAAM,SAAS,GAA2D;YACxE,SAAS,EAAE,sBAAsB,CAAC,gCAAgC;YAClE,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,SAAS;YACtB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,IAAI;YAC1C,SAAS,EAAE,sBAAsB,CAAC,gCAAgC;YAClE,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;;;;;;;;;OAaG;IACI,KAAK,CAAC,oCAAoC,CAAC,IAUjD,EAAE,uBAA+C;QAChD,MAAM,SAAS,GAA+D;YAC5E,SAAS,EAAE,sBAAsB,CAAC,qCAAqC;YACvE,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,SAAS;YACtB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,IAAI;YAC1C,SAAS,EAAE,sBAAsB,CAAC,qCAAqC;YACvE,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACI,KAAK,CAAC,gCAAgC,CAAC,IAO7C,EAAE,uBAA+C;QAChD,MAAM,SAAS,GAA2D;YACxE,SAAS,EAAE,sBAAsB,CAAC,gCAAgC;YAClE,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,SAAS;YACtB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,IAAI;YAC1C,SAAS,EAAE,sBAAsB,CAAC,gCAAgC;YAClE,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;IACI,KAAK,CAAC,4BAA4B,CAAC,IAWzC,EAAE,uBAA+C;QAChD,MAAM,SAAS,GAAuD;YACpE,SAAS,EAAE,sBAAsB,CAAC,2BAA2B;YAC7D,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;YACnD,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,SAAS;YACtB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,IAAI;YAC1C,SAAS,EAAE,sBAAsB,CAAC,2BAA2B;YAC7D,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACI,KAAK,CAAC,cAAc,CAAC,IAK3B,EAAE,uBAA+C;QAChD,MAAM,SAAS,GAAyC;YACtD,SAAS,EAAE,sBAAsB,CAAC,YAAY;YAC9C,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,SAAS;YACtB,SAAS,EAAE,0BAA0B,CAAC,QAAQ;YAC9C,SAAS,EAAE,sBAAsB,CAAC,YAAY;YAC9C,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAsCG;IACI,KAAK,CAAC,sBAAsB,CAAC,IAMnC,EAAE,uBAA+C;QAChD,MAAM,SAAS,GAAiD;YAC9D,SAAS,EAAE,sBAAsB,CAAC,oBAAoB;YACtD,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,SAAS;YACtB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,QAAQ;YAC9C,SAAS,EAAE,sBAAsB,CAAC,oBAAoB;YACtD,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;;;;OAQG;IACI,KAAK,CAAC,gCAAgC,CAAC,IAQ7C,EAAE,uBAA+C;QAChD,MAAM,SAAS,GAA2D;YACxE,SAAS,EAAE,sBAAsB,CAAC,+BAA+B;YACjE,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,WAAW;YACxB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,QAAQ;YAC9C,SAAS,EAAE,sBAAsB,CAAC,+BAA+B;YACjE,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;;;;OAQG;IACI,KAAK,CAAC,uBAAuB,CAAC,IAQpC,EAAE,uBAA+C;QAChD,MAAM,SAAS,GAAkD;YAC/D,SAAS,EAAE,sBAAsB,CAAC,qBAAqB;YACvD,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;YACnD,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,UAAU;YACvB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,IAAI;YAC1C,SAAS,EAAE,sBAAsB,CAAC,qBAAqB;YACvD,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;;;;OAQG;IACI,KAAK,CAAC,wBAAwB,CAAC,IASrC,EAAE,uBAA+C;QAChD,MAAM,SAAS,GAAmD;YAChE,SAAS,EAAE,sBAAsB,CAAC,sBAAsB;YACxD,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;SAChD,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,WAAW;YACxB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,QAAQ;YAC9C,SAAS,EAAE,sBAAsB,CAAC,sBAAsB;YACxD,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACI,KAAK,CAAC,+BAA+B,CAAC,IAM5C;QACC,MAAM,SAAS,GAA0D;YACvE,SAAS,EAAE,sBAAsB,CAAC,+BAA+B;YACjE,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,SAAS,EAAE,0BAA0B,CAAC,MAAM;YAC5C,SAAS,EAAE,sBAAsB,CAAC,+BAA+B;YACjE,SAAS,EAAE,SAAgC;SAC5C,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACI,KAAK,CAAC,wCAAwC,CAAC,IAGrD;QACC,IAAI,CAAC;YACH,4FAA4F;YAC5F,yFAAyF;YACzF,MAAM,eAAe,GAAG,kCAAkC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC3E,MAAM,aAAa,GAAG,0CAA0C,CAAC,eAAe,CAAC,CAAC;YAClF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,yCAAyC,EAAE,CAAC;YAErE,IAAI,KAAK,IAAI,KAAK,CAAC,cAAc,KAAK,aAAa,EAAE,CAAC;gBACpD,4FAA4F;gBAC5F,OAAO;YACT,CAAC;YAED,MAAM,MAAM,GAAG,KAAK,EAAE,KAAK,IAAI,IAAI,CAAC;YACpC,MAAM,gBAAgB,GAAG,yCAAyC,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;YAE5F,MAAM,IAAI,CAAC,+BAA+B,CAAC;gBACzC,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,gBAAgB;gBAChB,cAAc,EAAE,aAAa;gBAC7B,MAAM;gBACN,KAAK,EAAE,eAAe;aACvB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,wFAAwF;YACxF,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,+DAA+D,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAClG,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACK,KAAK,CAAC,yCAAyC;QACrD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,EAAE,CAAC;QACjD,MAAM,SAAS,GAAG,IAAI,CAAC,oBAAoB,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAC9F,6FAA6F;QAC7F,+FAA+F;QAC/F,MAAM,WAAW,GAAkE;YACjF,IAAI,EAAE,CAAC;YACP,KAAK,EAAE,CAAC;YACR,IAAI,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE;SACxB,CAAC;QACF,MAAM,MAAM,GAAG,CAAC,MAAM,SAAS,CAAC,IAAI,CAClC,EAAE,EACF,EAAE,SAAS,EAAE,sBAAsB,CAAC,+BAA+B,EAAE,EACrE,EAAE,SAAS,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,WAAW,EAAE,CAChE,CAAyD,CAAC;QAE3D,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,2DAA2D,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACpG,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7C,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACI,KAAK,CAAC,oCAAoC,CAAC,IAYjD,EAAE,uBAA+C;QAChD,MAAM,SAAS,GAA+D;YAC5E,SAAS,EAAE,sBAAsB,CAAC,oCAAoC;YACtE,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;YAC7C,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,GAAG,CAAC,IAAI,CAAC,uBAAuB;gBAC9B,CAAC,CAAC,EAAE,uBAAuB,EAAE,IAAI,CAAC,uBAAuB,CAAC,WAAW,EAAE,EAAE;gBACzE,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,IAAI,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtF,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,WAAW;YACxB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,IAAI,CAAC,aAAa;gBAC3B,CAAC,CAAC,0BAA0B,CAAC,IAAI;gBACjC,CAAC,CAAC,0BAA0B,CAAC,MAAM;YACrC,SAAS,EAAE,sBAAsB,CAAC,oCAAoC;YACtE,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;;;;OAQG;IACI,KAAK,CAAC,wBAAwB,CAAC,IAQrC,EAAE,uBAA+C;QAChD,MAAM,SAAS,GAAmD;YAChE,SAAS,EAAE,sBAAsB,CAAC,sBAAsB;YACxD,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;YACnD,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,WAAW;YACxB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,IAAI;YAC1C,SAAS,EAAE,sBAAsB,CAAC,sBAAsB;YACxD,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,CAAC,CAAC;IAC9B,CAAC;IAED,kCAAkC;IAClC,2DAA2D;IAC3D,kCAAkC;IAElC;;OAEG;IACI,KAAK,CAAC,sCAAsC,CAAC,IAMnD;QACC,MAAM,SAAS,GAAiE;YAC9E,SAAS,EAAE,sBAAsB,CAAC,sCAAsC;YACxE,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;YAC7C,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,SAAS;YACtB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,MAAM;YAC5C,SAAS,EAAE,sBAAsB,CAAC,sCAAsC;YACxE,SAAS,EAAE,SAAgC;SAC5C,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,mCAAmC,CAAC,IAMhD;QACC,MAAM,SAAS,GAA8D;YAC3E,SAAS,EAAE,sBAAsB,CAAC,mCAAmC;YACrE,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;SAClD,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,SAAS;YACtB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,GAAG;YACzC,SAAS,EAAE,sBAAsB,CAAC,mCAAmC;YACrE,SAAS,EAAE,SAAgC;SAC5C,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,sBAAsB,CAAC,IAQnC;QACC,MAAM,SAAS,GAAiD;YAC9D,SAAS,EAAE,sBAAsB,CAAC,qBAAqB;YACvD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,IAAI;YAC1C,SAAS,EAAE,sBAAsB,CAAC,qBAAqB;YACvD,SAAS,EAAE,SAAgC;SAC5C,CAAC,CAAC;IACL,CAAC;IAED,kCAAkC;IAClC,oCAAoC;IACpC,kCAAkC;IAElC;;OAEG;IACI,KAAK,CAAC,6BAA6B,CAAC,IAK1C;QACC,MAAM,SAAS,GAAwD;YACrE,SAAS,EAAE,sBAAsB,CAAC,6BAA6B;YAC/D,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,SAAS;YACjB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,GAAG;YACzC,SAAS,EAAE,sBAAsB,CAAC,6BAA6B;YAC/D,SAAS,EAAE,SAAgC;SAC5C,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,6BAA6B,CAAC,IAK1C,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAAwD;YACrE,SAAS,EAAE,sBAAsB,CAAC,6BAA6B;YAC/D,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,MAAM;YAC5C,SAAS,EAAE,sBAAsB,CAAC,6BAA6B;YAC/D,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACI,KAAK,CAAC,0BAA0B,CAAC,IAUvC,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAAqD;YAClE,SAAS,EAAE,sBAAsB,CAAC,0BAA0B;YAC5D,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,YAAY;YACzB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,IAAI;YAC1C,SAAS,EAAE,sBAAsB,CAAC,0BAA0B;YAC5D,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED,kCAAkC;IAClC,iDAAiD;IACjD,kCAAkC;IAElC;;OAEG;IACI,KAAK,CAAC,iBAAiB,CAAC,IAM9B,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAA4C;YACzD,SAAS,EAAE,sBAAsB,CAAC,eAAe;YACjD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,GAAG;YACzC,SAAS,EAAE,sBAAsB,CAAC,eAAe;YACjD,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,oBAAoB,CAAC,IAMjC,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAA+C;YAC5D,SAAS,EAAE,sBAAsB,CAAC,mBAAmB;YACrD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,GAAG;YACzC,SAAS,EAAE,sBAAsB,CAAC,mBAAmB;YACrD,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAEM,KAAK,CAAC,8BAA8B,CAAC,IAK3C;QACC,MAAM,SAAS,GAAyD;YACtE,SAAS,EAAE,sBAAsB,CAAC,8BAA8B;YAChE,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,0BAA0B,CAAC,GAAG;YACzC,SAAS,EAAE,sBAAsB,CAAC,8BAA8B;YAChE,SAAS,EAAE,SAAgC;SAC5C,CAAC,CAAC;IACL,CAAC;IAED,kCAAkC;IAClC,mCAAmC;IACnC,kCAAkC;IAElC;;OAEG;IACI,KAAK,CAAC,sBAAsB,CAAC,IAMnC,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAAiD;YAC9D,SAAS,EAAE,sBAAsB,CAAC,sBAAsB;YACxD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,GAAG;YACzC,SAAS,EAAE,sBAAsB,CAAC,sBAAsB;YACxD,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,wBAAwB,CAAC,IAMrC,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAAmD;YAChE,SAAS,EAAE,sBAAsB,CAAC,wBAAwB;YAC1D,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,MAAM;YAC5C,SAAS,EAAE,sBAAsB,CAAC,wBAAwB;YAC1D,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,sBAAsB,CAAC,IAMnC;QACC,MAAM,SAAS,GAAiD;YAC9D,SAAS,EAAE,sBAAsB,CAAC,uBAAuB;YACzD,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,SAAS;YACjB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,GAAG;YACzC,SAAS,EAAE,sBAAsB,CAAC,uBAAuB;YACzD,SAAS,EAAE,SAAgC;SAC5C,CAAC,CAAC;IACL,CAAC;IAED,kCAAkC;IAClC,4CAA4C;IAC5C,kCAAkC;IAElC;;OAEG;IACI,KAAK,CAAC,wBAAwB,CAAC,IASrC,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAAmD;YAChE,SAAS,EAAE,sBAAsB,CAAC,uBAAuB;YACzD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,MAAM;YAC5C,SAAS,EAAE,sBAAsB,CAAC,uBAAuB;YACzD,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,yBAAyB,CAAC,IAQtC,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAAoD;YACjE,SAAS,EAAE,sBAAsB,CAAC,mCAAmC;YACrE,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,GAAG;YACzC,SAAS,EAAE,sBAAsB,CAAC,mCAAmC;YACrE,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,yBAAyB,CAAC,IAOtC;QACC,MAAM,SAAS,GAAoD;YACjE,SAAS,EAAE,sBAAsB,CAAC,mCAAmC;YACrE,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,SAAS;YACjB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,MAAM;YAC5C,SAAS,EAAE,sBAAsB,CAAC,mCAAmC;YACrE,SAAS,EAAE,SAAgC;SAC5C,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,qBAAqB,CAAC,IAQlC,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAAgD;YAC7D,SAAS,EAAE,sBAAsB,CAAC,oBAAoB;YACtD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,MAAM;YAC5C,SAAS,EAAE,sBAAsB,CAAC,oBAAoB;YACtD,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED,kCAAkC;IAClC,4CAA4C;IAC5C,kCAAkC;IAElC;;OAEG;IACI,KAAK,CAAC,sBAAsB,CAAC,IAOnC,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAAiD;YAC9D,SAAS,EAAE,sBAAsB,CAAC,qBAAqB;YACvD,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,MAAM;YAC5C,SAAS,EAAE,sBAAsB,CAAC,qBAAqB;YACvD,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,kBAAkB,CAAC,IAK/B,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAA6C;YAC1D,SAAS,EAAE,sBAAsB,CAAC,iBAAiB;YACnD,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;SAC1C,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,GAAG;YACzC,SAAS,EAAE,sBAAsB,CAAC,iBAAiB;YACnD,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,sBAAsB,CAAC,IAInC,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAAiD;YAC9D,SAAS,EAAE,sBAAsB,CAAC,qBAAqB;YACvD,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,MAAM;YAC5C,SAAS,EAAE,sBAAsB,CAAC,qBAAqB;YACvD,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED,kCAAkC;IAClC,+BAA+B;IAC/B,kCAAkC;IAE3B,KAAK,CAAC,gBAAgB,CAAC,IAI7B;QACC,MAAM,SAAS,GAA+C;YAC5D,SAAS,EAAE,sBAAsB,CAAC,oBAAoB;YACtD,GAAG,IAAI;SACR,CAAC;QACF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,SAAS,EAAE,0BAA0B,CAAC,GAAG;YACzC,SAAS,EAAE,sBAAsB,CAAC,oBAAoB;YACtD,SAAS,EAAE,SAAgC;SAC5C,CAAC,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,oBAAoB,CAAC,IAMjC,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAAmD;YAChE,SAAS,EAAE,sBAAsB,CAAC,wBAAwB;YAC1D,GAAG,IAAI;SACR,CAAC;QACF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,0BAA0B,CAAC,MAAM;YAC5C,SAAS,EAAE,sBAAsB,CAAC,wBAAwB;YAC1D,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAEM,KAAK,CAAC,kBAAkB,CAAC,IAK/B;QACC,MAAM,SAAS,GAAiD;YAC9D,SAAS,EAAE,sBAAsB,CAAC,sBAAsB;YACxD,GAAG,IAAI;SACR,CAAC;QACF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,SAAS,EAAE,0BAA0B,CAAC,IAAI;YAC1C,SAAS,EAAE,sBAAsB,CAAC,sBAAsB;YACxD,SAAS,EAAE,SAAgC;SAC5C,CAAC,CAAC;IACL,CAAC;IAED,kCAAkC;IAClC,4BAA4B;IAC5B,kCAAkC;IAE3B,KAAK,CAAC,aAAa,CAAC,IAM1B;QACC,MAAM,SAAS,GAA4C;YACzD,SAAS,EAAE,sBAAsB,CAAC,iBAAiB;YACnD,GAAG,IAAI;SACR,CAAC;QACF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,SAAS,EAAE,0BAA0B,CAAC,GAAG;YACzC,SAAS,EAAE,sBAAsB,CAAC,iBAAiB;YACnD,SAAS,EAAE,SAAgC;SAC5C,CAAC,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,iBAAiB,CAAC,IAO9B,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAAgD;YAC7D,SAAS,EAAE,sBAAsB,CAAC,qBAAqB;YACvD,GAAG,IAAI;SACR,CAAC;QACF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,0BAA0B,CAAC,MAAM;YAC5C,SAAS,EAAE,sBAAsB,CAAC,qBAAqB;YACvD,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAEM,KAAK,CAAC,eAAe,CAAC,IAO5B;QACC,MAAM,SAAS,GAA8C;YAC3D,SAAS,EAAE,sBAAsB,CAAC,mBAAmB;YACrD,GAAG,IAAI;SACR,CAAC;QACF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,SAAS,EAAE,0BAA0B,CAAC,IAAI;YAC1C,SAAS,EAAE,sBAAsB,CAAC,mBAAmB;YACrD,SAAS,EAAE,SAAgC;SAC5C,CAAC,CAAC;IACL,CAAC;IAED,kCAAkC;IAClC,uCAAuC;IACvC,kCAAkC;IAE3B,KAAK,CAAC,gBAAgB,CAAC,IAK7B,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAA+C;YAC5D,SAAS,EAAE,sBAAsB,CAAC,mBAAmB;YACrD,GAAG,IAAI;SACR,CAAC;QACF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,0BAA0B,CAAC,MAAM;YAC5C,SAAS,EAAE,sBAAsB,CAAC,mBAAmB;YACrD,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAEM,KAAK,CAAC,0BAA0B,CAAC,IAKvC;QACC,MAAM,SAAS,GAAyD;YACtE,SAAS,EAAE,sBAAsB,CAAC,8BAA8B;YAChE,GAAG,IAAI;SACR,CAAC;QACF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,SAAS,EAAE,0BAA0B,CAAC,IAAI;YAC1C,SAAS,EAAE,sBAAsB,CAAC,8BAA8B;YAChE,SAAS,EAAE,SAAgC;SAC5C,CAAC,CAAC;IACL,CAAC;IAED,kCAAkC;IAClC,gDAAgD;IAChD,kCAAkC;IAElC;;;OAGG;IACI,KAAK,CAAC,wBAAwB,CAAC,IASrC;QACC,MAAM,cAAc,GAAkD;YACpE,SAAS,EAAE,sBAAsB,CAAC,uBAAuB;YACzD,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QACF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,SAAS,EAAE,0BAA0B,CAAC,MAAM;YAC5C,SAAS,EAAE,sBAAsB,CAAC,uBAAuB;YACzD,SAAS,EAAE,cAAqC;SACjD,CAAC,CAAC;IACL,CAAC;IAED,kCAAkC;IAClC,yCAAyC;IACzC,kCAAkC;IAE3B,KAAK,CAAC,sBAAsB,CAAC,IAKnC,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,MAAM;YAC5C,SAAS,EAAE,sBAAsB,CAAC,qBAAqB;YACvD,SAAS,EAAE,EAAE,SAAS,EAAE,sBAAsB,CAAC,qBAAqB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAyB;SACzK,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAEM,KAAK,CAAC,kBAAkB,CAAC,IAK/B,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,MAAM;YAC5C,SAAS,EAAE,sBAAsB,CAAC,iBAAiB;YACnD,SAAS,EAAE,EAAE,SAAS,EAAE,sBAAsB,CAAC,iBAAiB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAyB;SACrK,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAEM,KAAK,CAAC,mBAAmB,CAAC,IAKhC,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,MAAM;YAC5C,SAAS,EAAE,sBAAsB,CAAC,kBAAkB;YACpD,SAAS,EAAE,EAAE,SAAS,EAAE,sBAAsB,CAAC,kBAAkB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAyB;SACtK,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAEM,KAAK,CAAC,0BAA0B,CAAC,IAOvC,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,MAAM;YAC5C,SAAS,EAAE,sBAAsB,CAAC,0BAA0B;YAC5D,SAAS,EAAE,EAAE,SAAS,EAAE,sBAAsB,CAAC,0BAA0B,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAyB;SAClO,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED,kCAAkC;IAClC,wCAAwC;IACxC,kCAAkC;IAE3B,KAAK,CAAC,qBAAqB,CAAC,IAKlC;QACC,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,eAAe;YAC5B,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,MAAM;YAC5C,SAAS,EAAE,sBAAsB,CAAC,oBAAoB;YACtD,SAAS,EAAE,EAAE,SAAS,EAAE,sBAAsB,CAAC,oBAAoB,EAAE,GAAG,IAAI,EAAyB;SACtG,CAAC,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,mBAAmB,CAAC,IAKhC;QACC,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,eAAe;YAC5B,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,MAAM;YAC5C,SAAS,EAAE,sBAAsB,CAAC,kBAAkB;YACpD,SAAS,EAAE,EAAE,SAAS,EAAE,sBAAsB,CAAC,kBAAkB,EAAE,GAAG,IAAI,EAAyB;SACpG,CAAC,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,mBAAmB,CAAC,IAMhC;QACC,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,eAAe;YAC5B,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,MAAM;YAC5C,SAAS,EAAE,sBAAsB,CAAC,kBAAkB;YACpD,SAAS,EAAE,EAAE,SAAS,EAAE,sBAAsB,CAAC,kBAAkB,EAAE,GAAG,IAAI,EAAyB;SACpG,CAAC,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,gCAAgC,CAAC,IAI7C;QACC,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,eAAe;YAC5B,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,GAAG;YACzC,SAAS,EAAE,sBAAsB,CAAC,gCAAgC;YAClE,SAAS,EAAE,EAAE,SAAS,EAAE,sBAAsB,CAAC,gCAAgC,EAAE,GAAG,IAAI,EAAyB;SAClH,CAAC,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,yBAAyB,CAAC,IAKtC;QACC,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,MAAM;YAC5C,SAAS,EAAE,sBAAsB,CAAC,wBAAwB;YAC1D,SAAS,EAAE,EAAE,SAAS,EAAE,sBAAsB,CAAC,wBAAwB,EAAE,GAAG,IAAI,EAAyB;SAC1G,CAAC,CAAC;IACL,CAAC;IAED,kCAAkC;IAClC,yCAAyC;IACzC,kCAAkC;IAE3B,KAAK,CAAC,YAAY,CACvB,SAAiC,EACjC,SAAqC,EACrC,IAIC,EACD,uBAA+C,EAC/C,aAA+B;QAE/B,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,SAAS;YACT,SAAS;YACT,SAAS,EAAE,EAAE,SAAS,EAAE,GAAG,IAAI,EAAyB;SACzD,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED,kCAAkC;IAClC,0EAA0E;IAC1E,kCAAkC;IAElC;;;;;;;;;;;;;;;;;;OAkBG;IACI,KAAK,CAAC,iCAAiC,CAAC,IAU9C,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,cAAc,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAElF,MAAM,SAAS,GAA4D;YACzE,SAAS,EAAE,sBAAsB,CAAC,kCAAkC;YACpE,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,yBAAyB,EAAE,IAAI,CAAC,yBAAyB;YACzD,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,cAAc;YACd,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,IAAI;YAC1C,SAAS,EAAE,sBAAsB,CAAC,kCAAkC;YACpE,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAEM,KAAK,CAAC,eAAe,CAAC,IAM5B,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,SAAS,EAAyB;SACnF,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;CACF,CAAA;AA3+GY,uBAAuB;IADnC,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,kCAAkC,CAAC,CAAA;IAC7D,WAAA,MAAM,CAAC,kBAAkB,CAAC,2BAA2B,CAAC,CAAA;IACtD,WAAA,MAAM,CAAC,kBAAkB,CAAC,qCAAqC,CAAC,CAAA;IAChE,WAAA,MAAM,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAA;IAAE,WAAA,QAAQ,EAAE,CAAA;IAInD,WAAA,MAAM,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAA;IAAE,WAAA,QAAQ,EAAE,CAAA;qCATM,aAAa;QACM,0BAA0B;QACH,yCAAyC;QAChD,kCAAkC;QACrB,qCAAqC;GARxI,uBAAuB,CA2+GnC","sourcesContent":["import 'reflect-metadata';\nimport { createHash, randomUUID } from 'crypto';\nimport { inject, injectable, optional } from 'inversify';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { RepositoriesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/repositories/repositories-registry-handler.backend.service';\nimport { AuditEventDispatcherBackendService } from './audit-event-dispatcher.backend.service';\nimport type { MetricsService } from '~wildo-backend-lib/monitoring/observability/services/metrics.service';\nimport type { AuditLogSink, UserTypesConfig } from '@wildo-ai/saas-models';\nimport {\n getAuditEventClassification,\n SiemExportChangeType,\n SsoConfigChangeType,\n SsoConnectionType,\n AuditableEvent,\n AuditableEvent_User_LoginEventData,\n AuditableEvent_User_LogoutEventData,\n AuditableEvent_User_LoginFailedEventData,\n AuditableEvent_MachineAuth_SuccessEventData,\n AuditableEvent_MachineAuth_FailedEventData,\n AuditableEvent_MachineAccess_EventData,\n AuditableEvent_User_AccountLockedEventData,\n AccountLockoutReason,\n AuditableEvent_User_SessionExpiredEventData,\n AuditableEvent_User_AppRolesChangedEventData,\n AuditableEvent_Application_SuperAdminFloorBreachedEventData,\n AuditableEvent_Organization_OwnerFloorBreachedEventData,\n AuditableEvent_OrganizationMember_RoleChangedEventData,\n AuditableEvent_OrganizationUnitMember_RoleChangedEventData,\n AuditableEvent_OrganizationUnitMember_RemovedEventData,\n AuditableEvent_OrganizationMember_RemovedEventData,\n AuditableEvent_Organization_DeletedEventData,\n AuditableEvent_Organization_DeletionRequestedEventData,\n AuditableEvent_Organization_RestoredEventData,\n AuditableEvent_Organization_SuspendedEventData,\n AuditableEvent_Organization_ActivatedEventData,\n AuditableEvent_ApplicationAuthPolicyChanged_EventData,\n ApplicationAuthPolicySnapshot,\n AuditableEvent_Resource_StatusTransitionPerformedEventData,\n AuditableEvent_User_DeletedEventData,\n AuditableEvent_FieldAccess_EventData,\n AuditableEvent_ResourceOperationPerformed_EventData,\n AuditableEvent_HttpApiReadThroughAccess_EventData,\n AuditableEvent_HttpApiExternalErasure_EventData,\n AuditableEvent_HttpApiNonErasureAcknowledged_EventData,\n AuditableEvent_PlatformDirectoryAccess_EventData,\n AuditableEvent_ResourceOperationDenied_EventData,\n AuditableEvent_User_SSOLoginEventData,\n AuditableEvent_User_SSOLoginFailedEventData,\n AuditableEvent_User_SSOEnforcementBlockedEventData,\n AuditableEvent_User_TokenRefreshedEventData,\n AuditableEvent_Organization_SSOConfigurationChangedEventData,\n AuditableEvent_Organization_SIEMExportConfiguredEventData,\n AuditableEvent_EmergencyAccess_UsedEventData,\n AuditableEvent_User_PasswordResetRequestedEventData,\n AuditableEvent_User_PasswordResetForcedEventData,\n AuditableEvent_User_PasswordResetCompletedEventData,\n AuditableEvent_User_RegisteredEventData,\n AuditableEvent_User_EmailVerifiedEventData,\n AuditableEvent_User_VerificationEmailResentEventData,\n AuditableEvent_User_MFASetupStartedEventData,\n AuditableEvent_User_MFASetupCompletedEventData,\n AuditableEvent_User_MFAEmailOTPSentEventData,\n AuditableEvent_User_PasskeyRegisteredEventData,\n AuditableEvent_User_PasskeyAuthSuccessEventData,\n AuditableEvent_User_PasskeyAuthFailureEventData,\n AuditableEvent_User_PasskeyRemovedEventData,\n AuditableEvent_SCIM_UserProvisionedEventData,\n AuditableEvent_SCIM_UserUpdatedEventData,\n AuditableEvent_SCIM_UserDeactivatedEventData,\n AuditableEvent_User_MagicLinkSentEventData,\n AuditableEvent_User_MagicLinkVerifiedEventData,\n AuditableEvent_User_MagicLinkFailedEventData,\n AuditableEvent_User_SMSOTPSentEventData,\n AuditableEvent_User_SMSOTPVerifiedEventData,\n AuditableEvent_User_SMSOTPFailedEventData,\n AuditableEvent_User_PhoneVerifiedEventData,\n AuditableEvent_User_PhoneVerificationFailedEventData,\n AuditableEvent_OAuth2ProviderBlockedEventData,\n AuditableEvent_User_CrossFrontendHandoffIssuedEventData,\n AuditableEvent_OAuth_DelegatedTokenIssuedEventData,\n AuditableEvent_OAuth_ConsentGrantedEventData,\n AuditableEvent_OAuth_ConsentDeniedEventData,\n AuditableEvent_OAuth_ConsentGrantPersistedEventData,\n AuditableEvent_OAuth_CimdClientRefusedEventData,\n AuditableEvent_OAuth_DynamicClientRegisteredEventData,\n AuditableEvent_OAuth_TokenRefreshedEventData,\n AuditableEvent_OAuth_TokenRevokedEventData,\n AuditableEvent_OAuth_RpInitiatedLogoutEventData,\n AuditableEvent_OAuth_CodeExchangeFailedEventData,\n AuditableEvent_OAuth_ConsentBindingViolationEventData,\n AuditableEvent_User_RefreshTokenReuseDetectedEventData,\n OAuthCodeExchangeFailureReason,\n CoreAuditableEventType,\n ErrorCustomMessageReference,\n ErrorType,\n ExecutionContext_ExecutionType,\n MachineAccessOperation,\n ResourceServerKind,\n ResourceOperationRiskLevel,\n ResourceOperationVariantType,\n ResourcePrimaryScope,\n ResourceType,\n AuthScopeType,\n CORE_APP_ROLES,\n PlatformAccessGrantAutoApprovalReason,\n PlatformAccessGrantLifecycleTransition,\n PlatformAccessGrantStatus,\n} from '@wildo-ai/saas-models';\nimport type { ResourceConfiguration_OperationPath, VerifiedOrgId } from '@wildo-ai/saas-models';\nimport { CoreResourceOperation, CoreResourceType, AuditableEvent_BaseSchema, AuditableEvent_ApplicationAuthPolicyChanged_EventDataSchema, deriveTrustedSystemWritePreservedFields } from '@wildo-ai/saas-models';\nimport {\n buildApplicationAuthPolicySnapshot,\n computeApplicationAuthPolicySnapshotDigest,\n diffChangedApplicationAuthPolicyUserTypes,\n} from '../../../security/authentications/utils/application-auth-policy-audit.backend.utils';\nimport { ExecutionContext, type SocketAuthResult } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport { getRequestContextFrame } from '~wildo-backend-lib/runtime/models/request-context.als.backend';\nimport { ExecutionContextCreatorBackendService } from '~wildo-backend-lib/runtime/services/execution-context-creator.backend.service';\n\n/*\n WHICH RUNTIME performed a privileged system-context access.\n \n Structural twin of `RuntimePrincipalBackendService.describeForAudit()`, declared\n * here rather than imported so the durable audit contract does not silently inherit\n * future fields added to the runtime descriptor. An audit record is a compliance\n * artifact; its shape changes deliberately.\n /\nexport interface SystemContextAuditRuntimeAttribution {\n /* `application_backend` \| `minion` — see `ApplicationRuntimeProfile`. /\n runtimeProfile: string;\n /* The instance within that profile — a minion's name. Absent for the backend. /\n runtimeKey?: string;\n /* Canonical caller id, e.g. `minions.marketingScrapper`. /\n serviceIdentifier?: string;\n}\n\n@injectable()\nexport class AuditLogsBackendService {\n private readonly logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n constructor(\n @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private readonly errorBuilder: ErrorBuilderBackendService,\n @inject(SAAS_SERVICE_TYPES.RepositoriesRegistryHandlerService) private readonly repositoriesRegistry: RepositoriesRegistryHandlerBackendService,\n @inject(SAAS_SERVICE_TYPES.AuditEventDispatcherService) private readonly auditEventDispatcher: AuditEventDispatcherBackendService,\n @inject(SAAS_SERVICE_TYPES.ExecutionContextCreatorBackendService) private readonly executionContextCreator: ExecutionContextCreatorBackendService,\n @inject(SAAS_SERVICE_TYPES.AuditLogSink) @optional() private readonly auditLogSink?: AuditLogSink,\n // A-12: the Layer-1 authoritative-store write failure metric (`audit_store_failure_total`). Optional\n // so partial-container tests can construct this service without wiring the meter; always bound in the\n // real container (the composite sink injects it as required). Guarded with `?.` at the call site.\n @inject(SAAS_SERVICE_TYPES.MetricsService) @optional() private readonly metricsService?: MetricsService,\n ) {\n this.logDebug = this.logger.debugByType('AuditLogsBackendService');\n this.logger.setDebugTypeLogging('AuditLogsBackendService', true);\n }\n\n /\n The write context for one audit row.\n \n Deliberately carries NO tenant/actor context. The subject ids reach the row through\n * `preserveServerInjectedFields` on the write below — a payload-level mechanism — NOT through this\n * context. Putting them here instead was tried and reverted (2026-08-05): an audit context that\n * carries `organizationId` is then reused by `populateApplicationIdIfNeeded` to read APPLICATIONS,\n * whose schema has no such field, and the fail-closed contextual filter turned EVERY audit write\n * into a CONFIGURATION failure. The context stays scope-free; the payload carries the facts.\n /\n private async _getTempExecutionContext(): Promise<ExecutionContext<any>> {\n const operation: ResourceConfiguration_OperationPath<any, any> = {\n resourceIdentifier: CoreResourceType.AUDIT_LOGS,\n operationIdentifier: CoreResourceOperation.CREATE,\n variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n isOperationDefault: true\n };\n\n return this.executionContextCreator.createForInternalOperation({\n operation,\n contextResourcesFieldIdentifier: new Map(),\n initiatorIds: null,\n initiatorRoles: [{ roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], relatedPrimaryScope: ResourcePrimaryScope.APPLICATION }],\n });\n }\n\n /\n Generic audit-event emitter.\n \n Public escape hatch for consumers that need to log domain events\n * outside the per-event-type method catalog above (`logUserLogin`,\n * `logOrganizationCreated`, …). Accepts any `eventType` string;\n * `getAuditEventClassification(eventType)` falls back to\n * `{ category: 'data_access', severity: 'info' }` for types that\n * aren't pre-classified, so platform services can emit registry-\n * private / domain-specific event types without modifying the\n * `CoreAuditableEventType` enum.\n \n Per-org SIEM dispatch fires ONLY when an authenticated request `ExecutionContext`\n * (carrying an org) is passed as `requestExecutionContext` — NEVER on the caller-supplied\n * `organizationId` data field (F4 tenant segregation).\n \n Errors are caught + logged but never thrown — audit emission is\n * fire-and-forget; a logging failure must not affect the request\n * that triggered it.\n /\n public async logEvent(\n auditEvent: Omit<AuditableEvent, '_id' \| 'eventId' \| 'createdAt' \| 'updatedAt' \| 'eventCategory' \| 'severity'>,\n requestExecutionContext?: ExecutionContext<any>,\n ): Promise<void> {\n return this._createAuditLog(auditEvent, requestExecutionContext);\n }\n\n /\n Create an audit log entry.\n * Enriches eventCategory and severity from getAuditEventClassification.\n /\n private async _createAuditLog(\n auditEvent: Omit<AuditableEvent, '_id' \| 'eventId' \| 'createdAt' \| 'updatedAt' \| 'eventCategory' \| 'severity'>,\n requestExecutionContext?: ExecutionContext<any>,\n routingOrgIds?: VerifiedOrgId[],\n ): Promise<void> {\n const classification = getAuditEventClassification(auditEvent.eventType);\n // Store-agnostic correlation key, minted HERE — BEFORE the DB write — so the\n // SAME id lands on the authoritative DB row AND the provider fan-out emission.\n // The Phase-3 completeness reconciler matches DB rows ⇄ immudb records by it,\n // independent of each store's native key. See `AuditableEvent.eventId`.\n const eventId = randomUUID();\n // Hoist the request-correlation + frontend origin onto the row (closes gap 1 for audit). Prefer the\n // explicitly-threaded request EC; fall back to the ambient request-context ALS frame for the ~many\n // emitters that pass no EC — that fallback is what finally populates a top-level `correlationId` on the\n // COMMON audit path. Both are PAYLOAD data (like `userId`/`organizationId`), read from the REQUEST\n // context — NOT from the scope-free super-admin temp write `ec` below (which stays landmine-safe).\n const requestFrame = getRequestContextFrame();\n const correlationId = requestExecutionContext?.correlationId ?? requestFrame?.correlationId;\n const frontendServiceName = requestFrame?.frontendServiceName;\n // `clientInstanceId` needs no policy check HERE: the frame only ever carries one when\n // `setupRequestContext` admitted it, and that ingest is itself gated on the application's authored\n // `compliance.clientInstanceIdScope`. Keeping the single gate at the edge (rather than re-deciding at\n // each consumer) is what makes \"unopted application records nothing\" true by construction — see SD9.\n const clientInstanceId = requestFrame?.clientInstanceId;\n const auditLogData = {\n ...auditEvent,\n eventId,\n ...(correlationId ? { correlationId } : {}),\n ...(frontendServiceName ? { frontendServiceName } : {}),\n ...(clientInstanceId ? { clientInstanceId } : {}),\n eventData: auditEvent.eventData as Record<string, any>,\n eventCategory: classification.category,\n severity: classification.severity,\n createdAt: new Date(),\n updatedAt: new Date()\n };\n\n // Layer 1 — the always-on authoritative DB store (+ the existing per-org SIEM\n // dispatch). Best-effort: a failure here is logged but must NOT suppress the\n // Layer-2 provider fan-out below (F7 — each audit destination is independent).\n try {\n const ec = await this._getTempExecutionContext();\n const auditRepo = this.repositoriesRegistry.getRepositoryOrThrow(CoreResourceType.AUDIT_LOGS);\n // `userId`/`organizationId`/`applicationId` are CONTEXT_AUTO_POPULATED_FIELD_IDENTIFIERS, so\n // the repository's default CREATE request DTO strips them from every write — the strip\n // assumes those fields always describe the WRITER's own scope and re-derives them from the\n // execution context instead. That assumption is backwards here: this write's `ec` is the\n // synthesised super-admin/APPLICATION-scoped temp context (`_getTempExecutionContext`), which\n // has no `userId`/`organizationId` of its own, while `AuditableEvent_BaseSchema`'s own JSDoc\n // is explicit that these three are event DATA — \"the org/user the event is ABOUT\" — authored\n // directly on `auditLogData` above, not derived from the writer's identity. Without this,\n // `applicationId` happens to survive (it is ALSO this resource's declared primary-scope field,\n // so a separate enrichment step re-injects it from the writer's own `initiatorIds` — which\n // coincidentally matches), but `userId`/`organizationId` are silently dropped on every audit\n // row, for every event type — confirmed live on both `resource_operation_denied` and\n // `user_login` rows. `preserveServerInjectedFields` is exactly the trusted-system-write escape\n // hatch this class of gap exists for (see `deriveTrustedSystemWritePreservedFields`'s JSDoc).\n //\n // SECURITY REVIEW OF THIS PRESERVE — `organizationId` is attacker-influenceable on pre-auth\n // paths (a failed login resolves an org from the email domain), and preserving it makes that\n // value both durable and visible on the org-scoped viewer. Both channels were checked and the\n // full analysis lives on `AuditableEvent_BaseSchema.organizationId`'s JSDoc: SIEM routing is\n // unaffected (it keys on the AUTHENTICATED org, F4 — see the routing block below), and viewer\n // visibility is the INTENDED semantics (the targeted tenant should see attempts against its\n // own members). Read that JSDoc before changing what is preserved here.\n // assurance-control: WILDO.AUDIT.CONTEXT_ATTRIBUTION — the actor and tenant an audit row names must\n // survive the trusted-system write that persists it.\n await auditRepo.create(ec, auditLogData, {\n preserveServerInjectedFields: deriveTrustedSystemWritePreservedFields(\n AuditableEvent_BaseSchema,\n Object.keys(auditLogData),\n CoreResourceOperation.CREATE,\n ),\n });\n this.logDebug(`Created audit log: ${auditEvent.eventType}`, { eventData: auditEvent.eventData });\n\n // F4 (tenant segregation) — route the per-org SIEM sink on the AUTHENTICATED org from\n // the originating request EC (`initiatorIds.organizationId`), NEVER on the caller-supplied\n // `auditEvent.organizationId`. That field is event DATA (\"which org the event is ABOUT\")\n // and is attacker-influenceable on pre-auth paths (e.g. an email-domain→org lookup on a\n // failed login), so routing on it leaks one tenant's events into another tenant's SIEM.\n // Mirrors the M2M dispatcher's `resolveScopeFromChannel` (routes on\n // `executionContext.initiatorIds.organizationId`). Fail-closed: no authenticated org ⇒ NO\n // per-org dispatch (the always-on DB store above + the Layer-2 app-level sinks below are\n // unaffected — they are not per-tenant).\n // F4 routing set — the orgs this event delivers to. EITHER an explicit list of VERIFIED\n // member orgs (`routingOrgIds` — e.g. an auth-flow event fanned out to the user's ACTIVE\n // memberships) OR the single AUTHENTICATED org on the request EC (`initiatorIds.organizationId`\n // — e.g. SCIM / SSO-connection sites). NEVER the caller-supplied `auditEvent.organizationId`\n // data field. Fail-closed: an empty set ⇒ NO per-org dispatch (the always-on DB store + the\n // Layer-2 app-level sinks below are unaffected — they are not per-tenant).\n const ecOrg = requestExecutionContext?.initiatorIds?.organizationId;\n const routeToOrgs: string[] = routingOrgIds ?? (ecOrg ? [ecOrg] : []);\n if (routeToOrgs.length > 0) {\n if (!routingOrgIds && ecOrg && auditEvent.organizationId && auditEvent.organizationId !== ecOrg) {\n // Single-EC-org path only: the event's DATA org disagrees with the AUTHENTICATED org —\n // route on the authenticated one (never the data field) and surface the divergence.\n this.logger.warn?.('Audit event organizationId (data) differs from the authenticated request org — routing per-org dispatch on the AUTHENTICATED org (F4)', {\n eventType: auditEvent.eventType,\n dataOrganizationId: auditEvent.organizationId,\n authenticatedOrganizationId: ecOrg,\n });\n }\n // One DB row above; fan the per-org SIEM out to EACH verified org (each dispatch scopes\n // its own config read on the explicit org id — F4-safe; per-sink failures are isolated).\n for (const orgId of routeToOrgs) {\n this.auditEventDispatcher.dispatchToOrganizationAuditSinks(ec, auditLogData, orgId)\n .catch(err => this.logger.error?.('Per-org audit sink dispatch fire-and-forget error', { err, organizationId: orgId }));\n }\n }\n // No `else`: an empty routeToOrgs is the CORRECT, COMMON fail-closed state — every internal\n // `system_context_read`/`_write` audit (which names its scope org in DATA but carries no\n // authenticated routing EC) and every pre-auth-failure event lands here. Routing those on\n // their data org would (a) recurse — a per-org dispatch's own SIEM-config load is itself a\n // `readAsSystem` → another `system_context_read` → dispatch → … — and (b) flood tenant SIEMs\n // with framework plumbing. The fail-close is deliberate + SILENT (no per-event log); the DB\n // store + immudb keep the full forensic record. A data-org≠authenticated-org DIVERGENCE on the\n // EC path is still WARNed above.\n } catch (error) {\n // NAME WHAT WENT UNRECORDED, not just its event type.\n //\n // Audit emission is fire-and-forget by design: refusing the business operation here cannot\n // undo it, and throwing would be actively worse than best-effort (this catch sits POST-COMMIT, so it\n // would report failure for a change that already persisted, corrupting the accuracy of the\n // very record the assurance mechanism protects). The required behavior is that the failure be\n // DETECTED and actionable.\n //\n // `eventType` alone is not actionable: on a resource-operation event it says only\n // \"some operation, somewhere\". The correlation key, the operation identity triple and the\n // subject id let a reviewer name the exact action whose evidence is missing and reconstruct it\n // from the application log — the difference between a known gap and an unknown one.\n // Fail-closed remains reserved for the case where refusing still withholds something: a\n // privileged READ, where `SystemAccessBackendService.emitPrivilegedReadAudit` already refuses\n // to hand a minion data whose access could not be recorded.\n //\n // assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT — audit-pipeline failures are detectable\n // AND attributable to the specific action they lost.\n const unrecorded = auditEvent.eventData as Record<string, unknown> \| undefined;\n this.logger.error?.('Failed to write audit log to the database store', {\n error,\n eventType: auditEvent.eventType,\n eventId,\n unrecordedResourceType: unrecorded?.resourceType,\n unrecordedResourceId: unrecorded?.resourceId,\n unrecordedOperationIdentifier: unrecorded?.operationIdentifier,\n unrecordedVariantKey: unrecorded?.variantKey,\n // The failed row's request-correlation id is already on this log line via the logger's ambient\n // request-context mixin (`correlationId`); no need to re-log it from the (now removed) eventData field.\n actorUserId: auditEvent.userId,\n organizationId: auditEvent.organizationId,\n applicationId: auditEvent.applicationId,\n riskLevel: auditEvent.riskLevel,\n });\n // A-12 — make the Layer-1 authoritative-store outage DETECTABLE. This catch is on a\n // fire-and-forget path (audit must never break the business op), so without a metric the\n // failure is only a swallowed warn line — \"we think we're auditing but we aren't\". Increment\n // the bounded `audit_store_failure_total` counter (label-free — the authoritative store has no\n // provider dimension) so an outage surfaces on the observability layer. The alert RULE that\n // watches it is owned by the alerting workstream (`alerting-system-design-analysis.md` App. D).\n // assurance-control: WILDO.AUDIT.SECURITY_EVENT — audit-pipeline outage detectability.\n this.metricsService?.recordAuditStoreFailure();\n }\n\n // Layer 2 — app-level provider fan-out (immudb, …), resolved lazily by the\n // `CompositeAuditLogSink`. Runs INDEPENDENTLY of the Layer-1 outcome (F7); the\n // composite isolates each sink's failures + never throws onto this\n // fire-and-forget path. The emission carries the store-agnostic `eventId`\n // (minted above) — NOT the DB `_id` (this store's key, possibly not assigned\n // yet) — so the Phase-3 reconciler correlates DB ⇄ immudb by `eventId`.\n void this.auditLogSink?.recordAuditEvent(auditLogData);\n }\n\n // ===============================\n // SYSTEM-CONTEXT (ACL-BYPASSING) ACCESS AUDIT\n // ===============================\n\n /\n Record an ACL-bypassing system-context read (`readAsSystem` /\n * `listAsSystem`). Those primitives run with a synthesised super-admin\n * execution context and skip the caller's scope + role checks, so each call\n * is logged as a privileged-access event for the security trail. Userless by\n * design — the read is server-internal, attributed to no end user. Like every\n * audit method this is fire-and-forget: `_createAuditLog` swallows and logs\n * its own failures, so it can never break the read that triggered it.\n \n @param data.resourceType The resource read via the system context.\n * @param data.operation READ (`readAsSystem`) or LIST (`listAsSystem`).\n * @param data.resultCount Rows returned (1/0 for a read; length for a list).\n * @param data.organizationId Scope org id, when the call carried one.\n * @param data.scopeContext The raw scopeContext seed, for forensic context.\n /\n /\n Record a DATA SUBJECT EXPORT — the framework assembled everything it holds about one person and\n * disclosed it (GDPR Art. 15 access / Art. 20 portability).\n \n Its own emitter rather than a `logSystemContextAccess` call with extra fields: that event is\n * runtime-attributed and carries no subject, purpose, or contents, so it cannot answer \"who\n * exported whose data, when, and what was in it?\" — the only question an access-request audit is\n * for. Emitted at HIGH risk: a completed export is the largest single disclosure of personal data\n * the system can make.\n \n Never receives the exported VALUES — resource types, ids, counts and field names only. The\n * audit store outlives the export artifact, so recording the payload would leave a longer-lived\n * copy of the very data the subject asked to receive once.\n \n assurance-control: WILDO.PRIVACY.SUBJECT_DATA_EXPORT\n /\n public async logSubjectDataExport(data: {\n purpose: string;\n subjectResourceType: string;\n subjectIds: string[];\n includedResourceTypes: string[];\n totalRecordCount: number;\n fieldsExcludedAsDerived: string[];\n fieldsWithheldAsNonDisclosable: string[];\n organizationId?: string;\n }): Promise<void> {\n await this._createAuditLog({\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.HIGH,\n eventType: CoreAuditableEventType.SUBJECT_DATA_EXPORT,\n eventData: {\n eventType: CoreAuditableEventType.SUBJECT_DATA_EXPORT,\n purpose: data.purpose,\n subjectResourceType: data.subjectResourceType,\n subjectIds: data.subjectIds,\n includedResourceTypes: data.includedResourceTypes,\n totalRecordCount: data.totalRecordCount,\n fieldsExcludedAsDerived: data.fieldsExcludedAsDerived,\n fieldsWithheldAsNonDisclosable: data.fieldsWithheldAsNonDisclosable,\n ...(data.organizationId ? { organizationId: data.organizationId } : {}),\n },\n });\n }\n\n /\n A resource LISTING was exported to a file. See\n * {@link AuditableEvent_CollectionDataExport_EventDataSchema} for what this must and must not\n * carry — in short: the row count and row scope always, filter VALUES never.\n \n `riskLevel` is where the page-vs-whole-table distinction lives, because severity is static per\n * event type. A full-result-set export is HIGH: it can carry out far more than was ever on the\n * caller's screen.\n \n assurance-control: WILDO.PRIVACY.COLLECTION_DATA_EXPORT\n /\n public async logCollectionDataExport(data: {\n resourceType: string;\n sourceOperationIdentifier: string;\n format: string;\n rowScope: string;\n rowCount: number;\n filterFieldNames: string[];\n isFullResultSet: boolean;\n organizationId?: string;\n }): Promise<void> {\n await this._createAuditLog({\n organizationId: data.organizationId,\n riskLevel: data.isFullResultSet ? ResourceOperationRiskLevel.HIGH : ResourceOperationRiskLevel.LOW,\n eventType: CoreAuditableEventType.COLLECTION_DATA_EXPORT,\n eventData: {\n eventType: CoreAuditableEventType.COLLECTION_DATA_EXPORT,\n resourceType: data.resourceType,\n sourceOperationIdentifier: data.sourceOperationIdentifier,\n format: data.format,\n rowScope: data.rowScope,\n rowCount: data.rowCount,\n filterFieldNames: data.filterFieldNames,\n ...(data.organizationId ? { organizationId: data.organizationId } : {}),\n },\n });\n }\n\n /\n A refresh chain was retired to keep a principal within its concurrent-session cap.\n \n Best-effort like every other emit here: the eviction has already happened when this is called,\n * and losing the record must never cost the enforcement.\n \n `evictedIssuedAt` is optional because the stored ordering score can be unreadable (a legacy\n * whole-second score, a corrupted member). Absent means \"we could not say when it was issued\",\n * which is honest; a synthesised instant would make the first-in-first-out claim unfalsifiable.\n \n assurance-control: WILDO.IDENTITY.SESSION_CONCURRENCY_LIMIT — evidence that the bound was\n * enforced and WHICH chain it retired.\n /\n public async logUserSessionEvicted(data: {\n userId: string;\n evictedJti: string;\n evictedIssuedAt?: Date;\n configuredMaximum: number;\n retainedCount: number;\n }): Promise<void> {\n await this._createAuditLog({\n userId: data.userId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.USER_SESSION_EVICTED,\n eventData: {\n eventType: CoreAuditableEventType.USER_SESSION_EVICTED,\n userId: data.userId,\n evictedJti: data.evictedJti,\n ...(data.evictedIssuedAt ? { evictedIssuedAt: data.evictedIssuedAt } : {}),\n configuredMaximum: data.configuredMaximum,\n retainedCount: data.retainedCount,\n },\n });\n }\n\n public async logSystemContextAccess(data: {\n resourceType: string;\n operation: CoreResourceOperation.READ \| CoreResourceOperation.LIST;\n resultCount?: number;\n organizationId?: string;\n scopeContext?: Record<string, unknown>;\n /\n WHICH RUNTIME performed this privileged access — the application backend, a\n * named minion, etc.\n \n This event remains USERLESS by design: the system-access door synthesises its\n * own super-admin context, so there is no human to name and pretending otherwise\n * would corrupt the audit trail. Runtime attribution is a strictly weaker,\n * honest claim — it answers \"which runtime did this?\", never \"which user did\n * this?\". Without it, a cross-tenant read by a background digital worker is\n * indistinguishable from a data seed or a lifecycle batch.\n \n assurance-control: WILDO.AUDIT.SECURITY_EVENT — privileged access is attributable\n * to the runtime that exercised it.\n /\n performedByRuntime?: SystemContextAuditRuntimeAttribution;\n }): Promise<void> {\n await this._createAuditLog({\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.LOW,\n eventType: CoreAuditableEventType.SYSTEM_CONTEXT_READ,\n eventData: {\n eventType: CoreAuditableEventType.SYSTEM_CONTEXT_READ,\n resourceType: data.resourceType,\n operation: data.operation,\n resultCount: data.resultCount,\n scopeContext: data.scopeContext,\n performedByRuntime: data.performedByRuntime,\n } as Record<string, any>,\n });\n }\n\n /\n M6 — record a privileged SEE-THROUGH read that revealed RETAINED (impersonalized-and-retained)\n * records (`readRetainedAsSystem` / `listRetainedAsSystem`). Unlike the userless\n * {@link logSystemContextAccess}, this is HUMAN-ATTRIBUTED and carries a required `reason`: the two\n * properties that make a retained-data reveal a compliance-grade access record. The human is set on\n * BOTH the top-level `userId` (queryable) AND the typed `eventData.accessingUserId`. Classified\n * `DATA_ACCESS` / `WARNING` via the classification map (P0.6); `riskLevel` HIGH marks the sensitivity\n * of reading scrubbed PII. Fire-and-forget like every audit method — never breaks the read.\n \n @param data.accessingUserId The HUMAN (super-admin / compliance auditor) who performed the read.\n * @param data.reason REQUIRED justification for revealing the retained records.\n * @param data.resourceType The resource whose retained rows were revealed.\n * @param data.operationIdentifier `readRetainedAsSystem` \| `listRetainedAsSystem`.\n * @param data.resourceId Present for a single-record see-through read.\n * @param data.retainedRecordCount For a list/search reveal: how many retained rows were surfaced.\n * @param data.roles The privileged role(s) that authorized the see-through.\n * @param data.organizationId Tenant scope of the accessed data, when org-scoped.\n * @param data.ipAddress Caller IP, when available.\n /\n /\n A platform operator acted on a row in a tenant they are not a member of.\n \n Wildo's answer to \"may a platform super-administrator administer any tenant?\" is YES, as at most\n * mature B2B platforms — support and incident response need it. What those platforms also do, and\n * what this method exists for, is make the reach NAMED rather than implicit: the difference between\n * legitimate operator work and quiet snooping is not the capability (identical in both cases) but\n * whether anyone can tell afterwards.\n \n Attributed to the human operator on BOTH the queryable top-level `userId` and the typed event\n * data, and scoped to the TARGET organization — not the operator's own — so a tenant's audit view\n * shows who reached into it. Best-effort like every audit method: an operator action must never\n * fail because the sink is down, and a fail-closed variant would let anyone disable operator\n * support by breaking the sink.\n \n @param data.admissionDeclared Did the operation VARIANT declare the crossing\n * (`admitsCrossTenantPlatformAdministration`)? `false` is the subset worth alerting on — reach\n * nobody asked for and no specification documents.\n \n assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION\n /\n /\n One transition in a platform access grant's life — requested, approved, denied or revoked.\n \n Scoped to the TARGET organization so the tenant's own audit view shows elevations raised against\n * it, including ones it never had the chance to decide. Attributed to the OPERATOR on the queryable\n * top-level `userId`, because the operator is the constant across the whole timeline; the tenant\n * administrator who decided is carried separately as `decidedByUserId`.\n \n `TENANT_CANNOT_APPROVE` rides at HIGH risk. It is the one path where operator access proceeds\n * against a tenant that never consented and never could, and it should be separable from routine\n * elevation traffic without parsing prose.\n \n assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE\n /\n public async logPlatformAccessGrantLifecycle(data: {\n transition: PlatformAccessGrantLifecycleTransition;\n grantId: string;\n targetOrganizationId: string;\n operatorUserId: string;\n justification?: string;\n resultingStatus: PlatformAccessGrantStatus;\n expiresAt?: Date;\n autoApprovalReason?: PlatformAccessGrantAutoApprovalReason;\n decidedByUserId?: string;\n decisionReason?: string;\n }): Promise<void> {\n await this._createAuditLog({\n userId: data.operatorUserId,\n organizationId: data.targetOrganizationId,\n riskLevel: data.autoApprovalReason === PlatformAccessGrantAutoApprovalReason.TENANT_CANNOT_APPROVE\n ? ResourceOperationRiskLevel.HIGH\n : ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.PLATFORM_ACCESS_GRANT_LIFECYCLE,\n eventData: {\n eventType: CoreAuditableEventType.PLATFORM_ACCESS_GRANT_LIFECYCLE,\n transition: data.transition,\n grantId: data.grantId,\n targetOrganizationId: data.targetOrganizationId,\n operatorUserId: data.operatorUserId,\n justification: data.justification,\n resultingStatus: data.resultingStatus,\n expiresAt: data.expiresAt,\n autoApprovalReason: data.autoApprovalReason,\n decidedByUserId: data.decidedByUserId,\n decisionReason: data.decisionReason,\n } as Record<string, any>,\n });\n }\n\n public async logCrossTenantAdministrativeAccess(data: {\n operatorUserId?: string;\n targetOrganizationId: string;\n resourceType: string;\n operationIdentifier: string;\n variantType: ResourceOperationVariantType;\n variantKey?: string;\n targetResourceIds?: string[];\n authorizingGrantId?: string;\n admissionDeclared: boolean;\n initiatorRoles: string[];\n executionType: ExecutionContext_ExecutionType;\n }): Promise<void> {\n await this._createAuditLog({\n userId: data.operatorUserId,\n organizationId: data.targetOrganizationId,\n // HIGH when undeclared: that is the structural gap, not sanctioned support work.\n riskLevel: data.admissionDeclared ? ResourceOperationRiskLevel.MEDIUM : ResourceOperationRiskLevel.HIGH,\n eventType: CoreAuditableEventType.CROSS_TENANT_ADMINISTRATIVE_ACCESS,\n eventData: {\n eventType: CoreAuditableEventType.CROSS_TENANT_ADMINISTRATIVE_ACCESS,\n targetOrganizationId: data.targetOrganizationId,\n resourceType: data.resourceType,\n operationIdentifier: data.operationIdentifier,\n variantType: data.variantType,\n variantKey: data.variantKey,\n targetResourceIds: data.targetResourceIds,\n authorizingGrantId: data.authorizingGrantId,\n admissionDeclared: data.admissionDeclared,\n initiatorRoles: data.initiatorRoles,\n executionType: data.executionType,\n } as Record<string, any>,\n });\n }\n\n public async logRetainedDataAccess(data: {\n accessingUserId: string;\n reason: string;\n resourceType: string;\n operationIdentifier: string;\n resourceId?: string;\n retainedRecordCount?: number;\n roles?: string[];\n organizationId?: string;\n ipAddress?: string;\n }): Promise<void> {\n await this._createAuditLog({\n userId: data.accessingUserId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.HIGH,\n eventType: CoreAuditableEventType.RETAINED_DATA_ACCESS,\n eventData: {\n eventType: CoreAuditableEventType.RETAINED_DATA_ACCESS,\n accessingUserId: data.accessingUserId,\n reason: data.reason,\n resourceType: data.resourceType,\n operationIdentifier: data.operationIdentifier,\n resourceId: data.resourceId,\n retainedRecordCount: data.retainedRecordCount,\n roles: data.roles,\n organizationId: data.organizationId,\n ipAddress: data.ipAddress,\n } as Record<string, any>,\n });\n }\n\n /\n The MUTATION twin of {@link logSystemContextAccess}: records an ACL-bypassing\n * `createAsSystem` / `updateAsSystem` / `updateManyAsSystem` write. A super-admin\n * -context mutation is more sensitive than a read, so it is its own event\n * (`SYSTEM_CONTEXT_WRITE`) at MEDIUM risk. Best-effort — never blocks or fails\n * the write that triggered it (the caller `.catch()`es; `_createAuditLog` is\n * fire-and-forget internally).\n /\n public async logSystemContextWrite(data: {\n resourceType: string;\n operation: CoreResourceOperation.CREATE \| CoreResourceOperation.UPDATE \| CoreResourceOperation.UPDATE_MANY;\n organizationId?: string;\n scopeContext?: Record<string, unknown>;\n /* WHICH RUNTIME performed it — see {@link logSystemContextAccess}. /\n performedByRuntime?: SystemContextAuditRuntimeAttribution;\n }): Promise<void> {\n await this._createAuditLog({\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.SYSTEM_CONTEXT_WRITE,\n eventData: {\n eventType: CoreAuditableEventType.SYSTEM_CONTEXT_WRITE,\n resourceType: data.resourceType,\n operation: data.operation,\n scopeContext: data.scopeContext,\n performedByRuntime: data.performedByRuntime,\n } as Record<string, any>,\n });\n }\n\n // ===============================\n // USER AUTHENTICATION AUDIT METHODS\n // ===============================\n\n /\n Log successful user login\n /\n public async logUserLogin(data: {\n userId: string;\n email: string;\n authMethod: string;\n ipAddress: string;\n userAgent: string;\n sessionId: string;\n organizationId?: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const typedEventData: AuditableEvent_User_LoginEventData = {\n eventType: CoreAuditableEventType.USER_LOGIN,\n userId: data.userId,\n ipAddress: data.ipAddress,\n userAgent: data.userAgent,\n authMethod: data.authMethod,\n email: data.email,\n sessionId: data.sessionId,\n };\n\n await this._createAuditLog({\n userId: data.userId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.LOW,\n eventType: CoreAuditableEventType.USER_LOGIN,\n eventData: typedEventData as Record<string, any> // Store as plain object\n }, requestExecutionContext, routingOrgIds);\n }\n\n /\n Log user logout\n /\n public async logUserLogout(data: {\n userId: string;\n ipAddress: string;\n userAgent: string;\n organizationId?: string;\n }): Promise<void> {\n const eventData: AuditableEvent_User_LogoutEventData = {\n eventType: CoreAuditableEventType.USER_LOGOUT,\n userId: data.userId,\n ipAddress: data.ipAddress,\n userAgent: data.userAgent,\n };\n\n await this._createAuditLog({\n userId: data.userId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.LOW,\n eventType: CoreAuditableEventType.USER_LOGOUT,\n eventData: eventData as Record<string, any>,\n });\n }\n\n /\n Log user login failure\n /\n public async logUserLoginFailed(data: {\n email: string;\n authMethod: string;\n failureReason: string;\n ipAddress: string;\n userAgent: string;\n attemptsRemaining?: number;\n sessionId: string;\n organizationId?: string;\n }): Promise<void> {\n // Validate with typed schema first\n const typedEventData: AuditableEvent_User_LoginFailedEventData = {\n eventType: CoreAuditableEventType.USER_LOGIN_FAILED,\n email: data.email,\n authMethod: data.authMethod,\n failureReason: data.failureReason,\n ipAddress: data.ipAddress,\n userAgent: data.userAgent,\n attemptsRemaining: data.attemptsRemaining,\n sessionId: data.sessionId,\n };\n\n await this._createAuditLog({\n userId: undefined, // No userId available for failed login (user not identified)\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.USER_LOGIN_FAILED,\n eventData: typedEventData as Record<string, any> // Store as plain object\n });\n }\n\n /\n Log user account lockout\n /\n public async logUserAccountLocked(data: {\n userId: string;\n email: string;\n authMethod: string;\n lockoutDuration: number;\n ipAddress: string;\n userAgent: string;\n sessionId: string;\n /* Which lockout mechanism tripped (session progressive limit vs global per-email rate limit). /\n reason?: AccountLockoutReason;\n organizationId?: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_User_AccountLockedEventData = {\n eventType: CoreAuditableEventType.USER_ACCOUNT_LOCKED,\n userId: data.userId,\n email: data.email,\n authMethod: data.authMethod,\n lockoutDuration: data.lockoutDuration,\n ipAddress: data.ipAddress,\n userAgent: data.userAgent,\n sessionId: data.sessionId,\n ...(data.reason !== undefined ? { reason: data.reason } : {}),\n };\n\n await this._createAuditLog({\n userId: data.userId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.HIGH,\n eventType: CoreAuditableEventType.USER_ACCOUNT_LOCKED,\n eventData: eventData\n }, requestExecutionContext, routingOrgIds);\n }\n\n // ===============================\n // MACHINE AUTHENTICATION AUDIT METHODS\n // ===============================\n\n /\n Log a SUCCESSFUL machine (non-human) authentication — an api-key / OAuth-client secret /\n * exchanged client-credentials token resolving to an ORGANIZATION_MACHINE / APPLICATION_MACHINE\n * principal. Records the credential PROVENANCE (authMethod + credentialId) + scope; never the raw\n * secret. Emitted at the OAuth token-issuance moment so it stays low-volume (per-request\n * direct-secret access instead carries this provenance onto FIELD_ACCESS rows).\n /\n public async logMachineAuthSuccess(data: {\n authMethod: string;\n credentialId: string;\n scopeType: string;\n scopeId?: string;\n resourceIdentifier?: string;\n operationIdentifier?: string;\n ipAddress?: string;\n organizationId?: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_MachineAuth_SuccessEventData = {\n eventType: CoreAuditableEventType.MACHINE_AUTH_SUCCESS,\n authMethod: data.authMethod,\n credentialId: data.credentialId,\n scopeType: data.scopeType,\n scopeId: data.scopeId,\n resourceIdentifier: data.resourceIdentifier,\n operationIdentifier: data.operationIdentifier,\n ipAddress: data.ipAddress,\n };\n\n await this._createAuditLog({\n userId: undefined, // a machine principal has no user identity\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.LOW,\n eventType: CoreAuditableEventType.MACHINE_AUTH_SUCCESS,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n /\n Log a REJECTED machine-credential presentation (bad/expired/wrong-audience/wrong-scope secret or\n * token, or a rate-limited source). Records the ATTEMPT — credential kind + prefix (never the full\n * secret), target scope, and reason — with no `credentialId` (the credential did not resolve). This\n * event stream is the per-source machine brute-force signal.\n /\n public async logMachineAuthFailed(data: {\n credentialKind: string;\n credentialPrefix?: string;\n reason: string;\n scopeType?: string;\n scopeId?: string;\n resourceIdentifier?: string;\n operationIdentifier?: string;\n ipAddress?: string;\n organizationId?: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_MachineAuth_FailedEventData = {\n eventType: CoreAuditableEventType.MACHINE_AUTH_FAILED,\n credentialKind: data.credentialKind,\n credentialPrefix: data.credentialPrefix,\n reason: data.reason,\n scopeType: data.scopeType,\n scopeId: data.scopeId,\n resourceIdentifier: data.resourceIdentifier,\n operationIdentifier: data.operationIdentifier,\n ipAddress: data.ipAddress,\n };\n\n await this._createAuditLog({\n userId: undefined,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.MACHINE_AUTH_FAILED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n /\n Log a per-request MACHINE_ACCESS — a machine principal (ORGANIZATION_MACHINE / APPLICATION_MACHINE)\n * exercised an external resource-server surface (A2A `message/send`, MCP `tools/call`, …) with an\n * already-issued, audience-bound token. The token-USE twin of {@link logMachineAuthSuccess} (token-\n * MINT): mint fires once at `/oauth/token`; THIS fires per external request so an org SIEM sees WHAT\n * a machine did, not merely that it authenticated. Records the credential PROVENANCE (authMethod +\n * credentialId), the ROLE context that authorized the access (roles are the single authorization\n * axis — there is no OAuth-scope vocabulary), and the resource server + operation targeted.\n \n Call fire-and-forget (`void logMachineAccess(...).catch(warn)`) at the controller boundary AFTER\n * the caller is authenticated + authorized — auditing must never block or fail the request. Pass\n * `routingOrgIds` = the VERIFIED org for an ORGANIZATION_MACHINE (F4 tenant-segregation: routing is\n * on the explicit verified org, never the `organizationId` data field); an APPLICATION_MACHINE has\n * no single tenant SIEM ⇒ omit it (the DB store + Layer-2 app sinks still receive the row).\n /\n public async logMachineAccess(data: {\n authMethod: string;\n credentialId: string;\n scopeType: string;\n scopeId?: string;\n roles?: string[];\n resourceServer: string;\n resourceIdentifier?: string;\n operationIdentifier: string;\n ipAddress?: string;\n organizationId?: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_MachineAccess_EventData = {\n eventType: CoreAuditableEventType.MACHINE_ACCESS,\n authMethod: data.authMethod,\n credentialId: data.credentialId,\n scopeType: data.scopeType,\n scopeId: data.scopeId,\n roles: data.roles,\n resourceServer: data.resourceServer,\n resourceIdentifier: data.resourceIdentifier,\n operationIdentifier: data.operationIdentifier,\n ipAddress: data.ipAddress,\n };\n\n await this._createAuditLog({\n userId: undefined, // a machine principal has no user identity\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.LOW,\n eventType: CoreAuditableEventType.MACHINE_ACCESS,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n /\n SIEM-2 convenience: shape + emit a MACHINE_ACCESS from an authenticated external principal\n * ({@link SocketAuthResult}) — the single source of truth for the principal→audit mapping shared\n * by EVERY external resource-server transport (A2A, MCP, …) so their audit shaping never drifts.\n * Fire-and-forget (returns void, swallows its own emission errors) — auditing must never block or\n * fail the request.\n \n ONLY machine principals (ORGANIZATION_MACHINE / APPLICATION_MACHINE) produce this event: a\n * user-delegated turn is a HUMAN action audited on the human path, so a user principal is a silent\n * no-op. A machine principal with NO credential provenance is an upstream contract violation\n * ({@link ExecutionContextCreatorBackendService.authenticateExternalToken} always sets it) — logged\n * and skipped rather than emitting fabricated attribution.\n \n F4 tenant-segregation: per-org SIEM routing uses the VERIFIED org read off `initiatorIds` (never\n * a caller-supplied data field); an APPLICATION_MACHINE has no single tenant SIEM ⇒ no per-org\n * dispatch (the DB store + Layer-2 app sinks still receive the row).\n /\n public logMachineResourceAccessFromAuth(\n auth: SocketAuthResult,\n descriptor: { resourceServer: ResourceServerKind; resourceIdentifier?: string; operationIdentifier: MachineAccessOperation; ipAddress?: string },\n ): void {\n // Wrap the ENTIRE body: this is the single choke point every external transport (A2A, MCP, …)\n // calls fire-and-forget + un-awaited, so a SYNCHRONOUS throw here (from a future edit) would\n // break every external request. Honor the documented \"auditing must never block or fail the\n // request\" contract by swallowing both the sync prologue AND the async emit failure.\n try {\n const isOrgMachine = auth.executionType === ExecutionContext_ExecutionType.ORGANIZATION_MACHINE;\n const isMachine = isOrgMachine \|\| auth.executionType === ExecutionContext_ExecutionType.APPLICATION_MACHINE;\n if (!isMachine) return; // user-delegated turns are audited as human actions, not machine access\n\n const credential = auth.initiatorIds?.machineCredential;\n if (!credential) {\n this.logger.warn?.('Machine principal missing machineCredential provenance — skipping MACHINE_ACCESS audit', {\n executionType: auth.executionType,\n resourceServer: descriptor.resourceServer,\n });\n return;\n }\n\n const scopeId = isOrgMachine ? auth.initiatorIds?.organizationId : auth.initiatorIds?.applicationId;\n const roles = (auth.initiatorRoles ?? []).flatMap((r) => r.roles);\n const routingOrgIds: VerifiedOrgId[] \| undefined =\n isOrgMachine && auth.initiatorIds?.organizationId ? [auth.initiatorIds.organizationId as VerifiedOrgId] : undefined;\n\n void this.logMachineAccess({\n authMethod: credential.authMethod,\n credentialId: credential.credentialId,\n scopeType: auth.executionType,\n scopeId,\n roles,\n resourceServer: descriptor.resourceServer,\n resourceIdentifier: descriptor.resourceIdentifier,\n operationIdentifier: descriptor.operationIdentifier,\n ipAddress: descriptor.ipAddress,\n organizationId: isOrgMachine ? auth.initiatorIds?.organizationId : undefined,\n }, undefined, routingOrgIds).catch((auditError) => this.logger.warn?.('MACHINE_ACCESS audit emit failed (non-fatal)', {\n resourceServer: descriptor.resourceServer,\n ...projectCaughtErrorLogFields(auditError),\n }));\n } catch (syncError) {\n this.logger.warn?.('MACHINE_ACCESS audit shaping failed synchronously (non-fatal)', {\n resourceServer: descriptor.resourceServer,\n ...projectCaughtErrorLogFields(syncError),\n });\n }\n }\n\n // ===============================\n // OAUTH2 / OIDC PROVIDER AUDIT METHODS (Wildo AS the authorization server)\n // ===============================\n //\n // These record the app-issued OAuth2/OIDC provider surface. Every method is fire-and-forget\n // (`_createAuditLog` swallows + logs its own failures) — auditing must never block or fail the\n // request that triggered it; callers invoke `void logOAuth(…).catch(warn)`.\n //\n // F4 SIEM routing: these provider flows are Bearer/consent-token driven and often carry no single\n // VERIFIED tenant org at the emit site (a user may belong to many orgs; a client may be app-scoped),\n // so per-org SIEM dispatch is opt-in — pass `routingOrgIds`/`requestExecutionContext` ONLY when a\n // verified org is genuinely in scope, else the always-on DB store + Layer-2 immudb sink still record\n // the event (fail-closed on per-org dispatch, never on the authoritative record).\n\n /*\n A-1 — a user-delegated `authorization_code` access token was minted for a third-party client. The\n * flagship provider grant: the client can now act AS the user at the bound A2A/MCP resource.\n * assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — third-party delegated user-acting access.\n /\n public async logOAuthDelegatedTokenIssued(data: {\n userId: string;\n clientId: string;\n audience: string;\n scopes: string[];\n ttlSeconds: number;\n ipAddress?: string;\n organizationId?: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_OAuth_DelegatedTokenIssuedEventData = {\n eventType: CoreAuditableEventType.OAUTH_DELEGATED_TOKEN_ISSUED,\n userId: data.userId,\n clientId: data.clientId,\n audience: data.audience,\n scopes: data.scopes,\n ttlSeconds: data.ttlSeconds,\n ipAddress: data.ipAddress,\n };\n await this._createAuditLog({\n userId: data.userId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.OAUTH_DELEGATED_TOKEN_ISSUED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n /\n A-2 — a user APPROVED an interactive consent request (a code is issued; the client may act for them).\n * assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — user authorizes third-party delegated access.\n /\n public async logOAuthConsentGranted(data: {\n userId: string;\n clientId: string;\n scopes: string[];\n resource?: string;\n remembered: boolean;\n ipAddress?: string;\n organizationId?: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_OAuth_ConsentGrantedEventData = {\n eventType: CoreAuditableEventType.OAUTH_CONSENT_GRANTED,\n userId: data.userId,\n clientId: data.clientId,\n scopes: data.scopes,\n resource: data.resource,\n remembered: data.remembered,\n ipAddress: data.ipAddress,\n };\n await this._createAuditLog({\n userId: data.userId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.OAUTH_CONSENT_GRANTED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n /\n A-2 — a user DENIED an interactive consent request (access refused; protective).\n * assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — user refuses third-party delegated access.\n /\n public async logOAuthConsentDenied(data: {\n userId: string;\n clientId: string;\n scopes: string[];\n resource?: string;\n ipAddress?: string;\n organizationId?: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_OAuth_ConsentDeniedEventData = {\n eventType: CoreAuditableEventType.OAUTH_CONSENT_DENIED,\n userId: data.userId,\n clientId: data.clientId,\n scopes: data.scopes,\n resource: data.resource,\n ipAddress: data.ipAddress,\n };\n await this._createAuditLog({\n userId: data.userId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.LOW,\n eventType: CoreAuditableEventType.OAUTH_CONSENT_DENIED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n /\n A-3 — a persistent \"remember this app\" consent grant was created or its scopes widened. It lets\n * future authorize flows SKIP the consent prompt, so its creation is a durable-authority audit concern.\n * assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — persistent delegated-access authorization.\n /\n public async logOAuthConsentGrantPersisted(data: {\n userId: string;\n clientId: string;\n resource?: string;\n scopes: string[];\n isNewGrant: boolean;\n organizationId?: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_OAuth_ConsentGrantPersistedEventData = {\n eventType: CoreAuditableEventType.OAUTH_CONSENT_GRANT_PERSISTED,\n userId: data.userId,\n clientId: data.clientId,\n resource: data.resource,\n scopes: data.scopes,\n isNewGrant: data.isNewGrant,\n };\n await this._createAuditLog({\n userId: data.userId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.OAUTH_CONSENT_GRANT_PERSISTED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n /\n A URL-formatted (CIMD) `client_id` was refused at the authorize endpoint.\n \n No `userId` and no organization: the refusal happens while resolving the CLIENT, before any\n * user is bound to the request. HIGH risk because the reason vocabulary spans a misconfiguration\n * (`host_not_allowed`) and an active attack (`ssrf_target_refused`), and only the reason tells\n * them apart — an operator watching this event is watching for the second.\n \n assurance-control: WILDO.IDENTITY.CLIENT_IDENTITY_ASSERTION — a client identity assertion was\n * rejected.\n /\n public async logCimdClientRefused(data: {\n clientId: string;\n reason: string;\n detail?: string;\n }, requestExecutionContext?: ExecutionContext<any>): Promise<void> {\n const eventData: AuditableEvent_OAuth_CimdClientRefusedEventData = {\n eventType: CoreAuditableEventType.OAUTH_CIMD_CLIENT_REFUSED,\n clientId: data.clientId,\n reason: data.reason,\n detail: data.detail,\n };\n await this._createAuditLog({\n riskLevel: ResourceOperationRiskLevel.HIGH,\n eventType: CoreAuditableEventType.OAUTH_CIMD_CLIENT_REFUSED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext);\n }\n\n /\n An anonymous caller registered an OAuth client at `/oauth/register` (RFC 7591).\n \n No `userId` and no organization, because there is no principal — that absence IS the finding,\n * and it is why the source IP and the self-asserted metadata are carried instead. HIGH risk not\n * because one registration is dangerous (the client is confined to identity scopes, no roles, and\n * always faces consent) but because this is the only unauthenticated write in the application and\n * an operator must be able to see the population it produces.\n \n assurance-control: WILDO.IDENTITY.CLIENT_IDENTITY_ASSERTION — a client identity was created by\n * a party that authenticated to nothing.\n /\n public async logDynamicClientRegistered(data: {\n clientId: string;\n clientName: string;\n redirectUris: string[];\n postLogoutRedirectUris: string[];\n ipAddress?: string;\n }, requestExecutionContext?: ExecutionContext<any>): Promise<void> {\n const eventData: AuditableEvent_OAuth_DynamicClientRegisteredEventData = {\n eventType: CoreAuditableEventType.OAUTH_DYNAMIC_CLIENT_REGISTERED,\n clientId: data.clientId,\n clientName: data.clientName,\n redirectUris: data.redirectUris,\n // revocation-C: the RP-Initiated Logout post-logout allowlist the client registered (may be empty).\n postLogoutRedirectUris: data.postLogoutRedirectUris,\n ipAddress: data.ipAddress,\n };\n await this._createAuditLog({\n riskLevel: ResourceOperationRiskLevel.HIGH,\n eventType: CoreAuditableEventType.OAUTH_DYNAMIC_CLIENT_REGISTERED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext);\n }\n\n /\n A-4 — a user token was rotated via the provider `refresh_token` grant (`/oauth/token`).\n * assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — token lifecycle (refresh).\n /\n public async logOAuthTokenRefreshed(data: {\n userId?: string;\n clientId?: string;\n clientAuthenticated: boolean;\n ipAddress?: string;\n organizationId?: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_OAuth_TokenRefreshedEventData = {\n eventType: CoreAuditableEventType.OAUTH_TOKEN_REFRESHED,\n userId: data.userId,\n clientId: data.clientId,\n clientAuthenticated: data.clientAuthenticated,\n ipAddress: data.ipAddress,\n };\n await this._createAuditLog({\n userId: data.userId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.LOW,\n eventType: CoreAuditableEventType.OAUTH_TOKEN_REFRESHED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n /\n A-5 — a token was revoked via `/oauth/revoke` (RFC 7009). No-oracle: records the attempt + the\n * authenticated client only, never whether the token existed or whose it was.\n * assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — token lifecycle (revocation).\n /\n public async logOAuthTokenRevoked(data: {\n clientId?: string;\n clientAuthenticated: boolean;\n tokenTypeHint?: string;\n ipAddress?: string;\n organizationId?: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_OAuth_TokenRevokedEventData = {\n eventType: CoreAuditableEventType.OAUTH_TOKEN_REVOKED,\n clientId: data.clientId,\n clientAuthenticated: data.clientAuthenticated,\n tokenTypeHint: data.tokenTypeHint,\n ipAddress: data.ipAddress,\n };\n await this._createAuditLog({\n userId: undefined,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.LOW,\n eventType: CoreAuditableEventType.OAUTH_TOKEN_REVOKED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n /\n revocation-C — an OIDC RP-Initiated Logout terminated the End-User's OP session at\n * `/oauth/end-session`. Unlike the RFC 7009 token-revoke above (a no-oracle attempt), this DOES carry the\n * subject: a valid `id_token_hint` names whose session ended. Records the terminated session, the\n * initiating relying party, and whether a session was actually ended / a post-logout redirect refused.\n * assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — per-session revocation (RP-Initiated Logout).\n /\n public async logOAuthRpInitiatedLogout(data: {\n userId?: string;\n sessionId?: string;\n clientId?: string;\n sessionTerminated: boolean;\n postLogoutRedirectUriRejected: boolean;\n ipAddress?: string;\n organizationId?: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_OAuth_RpInitiatedLogoutEventData = {\n eventType: CoreAuditableEventType.OAUTH_RP_INITIATED_LOGOUT,\n userId: data.userId,\n sessionId: data.sessionId,\n clientId: data.clientId,\n sessionTerminated: data.sessionTerminated,\n postLogoutRedirectUriRejected: data.postLogoutRedirectUriRejected,\n ipAddress: data.ipAddress,\n };\n await this._createAuditLog({\n userId: data.userId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.LOW,\n eventType: CoreAuditableEventType.OAUTH_RP_INITIATED_LOGOUT,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n /\n A-6 — an `authorization_code` exchange was REJECTED (replay / PKCE failure / redirect mismatch / …).\n * A potential attack signal; the specific cause is the closed-vocabulary `reason`.\n * assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — failed delegated-auth exchange / monitoring.\n /\n public async logOAuthCodeExchangeFailed(data: {\n reason: OAuthCodeExchangeFailureReason;\n clientId?: string;\n userId?: string;\n resource?: string;\n ipAddress?: string;\n organizationId?: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_OAuth_CodeExchangeFailedEventData = {\n eventType: CoreAuditableEventType.OAUTH_CODE_EXCHANGE_FAILED,\n reason: data.reason,\n clientId: data.clientId,\n userId: data.userId,\n resource: data.resource,\n ipAddress: data.ipAddress,\n };\n await this._createAuditLog({\n userId: data.userId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.OAUTH_CODE_EXCHANGE_FAILED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n /\n A-8 — a consent DECISION was submitted by an authenticated user who is NOT the consent request's\n * bound user (403). A textbook cross-user authorization-abuse signal (user A acting on user B's consent).\n * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT — authorization-decision violation, fail-closed.\n /\n public async logOAuthConsentBindingViolation(data: {\n authenticatedUserId: string;\n boundUserId: string;\n clientId?: string;\n consentTokenId?: string;\n ipAddress?: string;\n organizationId?: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_OAuth_ConsentBindingViolationEventData = {\n eventType: CoreAuditableEventType.OAUTH_CONSENT_BINDING_VIOLATION,\n authenticatedUserId: data.authenticatedUserId,\n boundUserId: data.boundUserId,\n clientId: data.clientId,\n consentTokenId: data.consentTokenId,\n ipAddress: data.ipAddress,\n };\n await this._createAuditLog({\n // The event is ABOUT the actor (the authenticated user who attempted the cross-user decision).\n userId: data.authenticatedUserId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.HIGH,\n eventType: CoreAuditableEventType.OAUTH_CONSENT_BINDING_VIOLATION,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n /\n A-9 — refresh-token REUSE was detected → the token family was revoked (possible theft). Emitted by the\n * refresh CALLERS (the token issuer stays audit-free by design and surfaces a reuse SIGNAL instead —\n * `extractRefreshTokenReuseSignal`). Applies to both the first-party session refresh and the OAuth\n * provider refresh grant (shared issuer).\n * assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — credential-theft detection + response.\n /\n public async logUserRefreshTokenReuseDetected(data: {\n userId: string;\n reusedJti: string;\n sessionId?: string;\n familyRevoked: boolean;\n ipAddress?: string;\n organizationId?: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_User_RefreshTokenReuseDetectedEventData = {\n eventType: CoreAuditableEventType.USER_REFRESH_TOKEN_REUSE_DETECTED,\n userId: data.userId,\n reusedJti: data.reusedJti,\n sessionId: data.sessionId,\n familyRevoked: data.familyRevoked,\n ipAddress: data.ipAddress,\n };\n await this._createAuditLog({\n userId: data.userId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.HIGH,\n eventType: CoreAuditableEventType.USER_REFRESH_TOKEN_REUSE_DETECTED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n // ===============================\n // FIELD ACCESS AUDIT METHODS\n // ===============================\n\n /\n Log the disclosure of a sensitive field.\n \n Called from `logAuditAccessForFields` for two disjoint markers:\n * `isBackendOnly({ isReturnedAtCreation: true })` on a CREATE response (the stored artifact at\n * first exposure, e.g. `hashedKey`), and `.isEphemeral()` on ANY operation (the secret actually\n * handed to the caller, e.g. `plainKey` on `create` / `rotate` / `regenerate`). Read\n * `isCreateOperation` to tell the two apart on a row.\n \n `fieldName` is a NAME, never a value. This method must never be extended to carry the\n * field's contents: rows replicate to the per-org SIEM and to the immutable ledger, which cannot\n * be scrubbed — recording the secret would turn the record of a disclosure into a second,\n * permanent copy of it.\n \n assurance-control: WILDO.SECRETS.DISCLOSURE_AUDIT — disclosure of server-minted secret\n * material is attributable to a principal.\n /\n public async logFieldAccess(data: {\n fieldName: string;\n resourceType: ResourceType;\n resourceId?: string;\n userId?: string;\n organizationId?: string;\n applicationId?: string;\n operationIdentifier: string;\n isCreateOperation: boolean;\n /* Machine-credential provenance when the accessor is a machine principal (api-key / OAuth client). /\n machineCredentialAuthMethod?: string;\n machineCredentialId?: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_FieldAccess_EventData = {\n eventType: CoreAuditableEventType.FIELD_ACCESS,\n fieldName: data.fieldName,\n resourceType: data.resourceType,\n resourceId: data.resourceId,\n operationIdentifier: data.operationIdentifier,\n isCreateOperation: data.isCreateOperation,\n machineCredentialAuthMethod: data.machineCredentialAuthMethod,\n machineCredentialId: data.machineCredentialId,\n };\n\n await this._createAuditLog({\n userId: data.userId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM, // Field access is medium risk\n eventType: CoreAuditableEventType.FIELD_ACCESS,\n eventData: eventData as Record<string, any>\n }, requestExecutionContext, routingOrgIds);\n }\n\n /\n Record that a resource operation TOOK EFFECT — the operation-triggered counterpart to\n * {@link logFieldAccess}.\n \n ## Why this exists next to `logFieldAccess` rather than inside it\n \n `logFieldAccess` is triggered by a decorated RESPONSE FIELD, so it is structurally blind to any\n * operation whose response carries none. Repo-wide that trigger is declared on FOUR fields (three\n * secret families, CREATE-only), which left an 83-resource catalogue with no evidence for role\n * changes, suspensions, credential deletion or tenant deletion. Folding \"an operation happened\"\n * into \"a field was disclosed\" would merge two genuinely different claims; they stay separate\n * events with separate triggers.\n \n ## Emit AFTER the write commits\n \n Called from the framework-managed POST-COMMIT effects lane. An event recorded ahead of the write\n * would survive a rollback and assert a change that never happened — the same rule\n * {@link logUserAppRolesChanged} states, and the reason this event carries no `outcome`\n * discriminator: this call site can only ever observe success.\n \n ## Attribution splits, like the other admin-action events\n \n The row's `userId` is the ACTOR (what \"who did this\" queries filter on); the SUBJECT rides\n * `eventData.resourceId`. `riskLevel` is the OPERATION's declared risk, carried through unchanged\n * so an auditor can filter the trail by the same danger axis the UI and MCP adapter use.\n \n The request execution context is forwarded so per-org SIEM fan-out routes on the AUTHENTICATED\n * org, never a caller-supplied field (F4 tenant segregation). Internal and repository-only\n * surfaces carry no authenticated org and therefore no per-org dispatch — the always-on DB store\n * and the immutable ledger still receive them, which is the correct fail-closed shape.\n \n assurance-control: WILDO.AUDIT.EVIDENCE_INTEGRITY — privileged actions on\n * resources are attributable, and the authorization effect of each is reconstructable.\n /\n public async logResourceOperationPerformed(\n data: Omit<AuditableEvent_ResourceOperationPerformed_EventData, 'eventType'> & {\n /* The OPERATION's declared risk level, carried onto the row unchanged. /\n riskLevel: ResourceOperationRiskLevel;\n /* The ACTOR. Absent on internal/system paths, which have no human to name. /\n actorUserId?: string;\n /* Tenant scope the event is ABOUT (event data — never a SIEM routing key). /\n organizationId?: string;\n applicationId?: string;\n },\n requestExecutionContext?: ExecutionContext<any>,\n ): Promise<void> {\n const { riskLevel, actorUserId, organizationId, applicationId, ...eventFields } = data;\n\n const eventData: AuditableEvent_ResourceOperationPerformed_EventData = {\n eventType: CoreAuditableEventType.RESOURCE_OPERATION_PERFORMED,\n ...eventFields,\n };\n\n await this._createAuditLog({\n userId: actorUserId,\n organizationId,\n applicationId,\n riskLevel,\n eventType: CoreAuditableEventType.RESOURCE_OPERATION_PERFORMED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext);\n }\n\n /\n Record an APPLICATION-WIDE directory enumeration.\n \n See {@link CoreAuditableEventType.PLATFORM_DIRECTORY_ACCESS} for why this is not the\n * cross-tenant event: there is no target tenant, because the read spans all of them.\n \n No `organizationId` is set, and that absence is meaningful rather than an omission — the SIEM\n * routing key would otherwise claim the read belonged to whichever tenant the operator happened to\n * be acting in, which is the one thing this event exists to contradict.\n /\n public async logPlatformDirectoryAccess(\n data: Omit<AuditableEvent_PlatformDirectoryAccess_EventData, 'eventType'> & {\n /* The ACTOR. Absent on paths with no human to name. /\n actorUserId?: string;\n applicationId?: string;\n },\n requestExecutionContext?: ExecutionContext<any>,\n ): Promise<void> {\n const { actorUserId, applicationId, ...eventFields } = data;\n\n const eventData: AuditableEvent_PlatformDirectoryAccess_EventData = {\n eventType: CoreAuditableEventType.PLATFORM_DIRECTORY_ACCESS,\n ...eventFields,\n };\n\n await this._createAuditLog({\n userId: actorUserId,\n applicationId,\n riskLevel: ResourceOperationRiskLevel.LOW,\n eventType: CoreAuditableEventType.PLATFORM_DIRECTORY_ACCESS,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext);\n }\n\n /\n Record a read THROUGH an HTTP-API resource binding — rows left an EXTERNAL system via the\n * engine's read-through repository (ETL plan D8/R6; see\n * {@link CoreAuditableEventType.HTTP_API_READ_THROUGH_ACCESS} for the vocabulary argument).\n \n The top-level `userId` is the REAL initiating user (R12): every remote call under a\n * SERVICE_PRINCIPAL binding authenticates as one service account, and this row is what keeps\n * attribution alive through that shared principal. `organizationId` rides `eventData` for the\n * queryable trail; the SIEM routing org comes from the authenticated request context inside\n * `_createAuditLog`, as for every other event.\n \n assurance-control: WILDO.AUDIT.ATTRIBUTION — external read-through access recorded with the\n * real initiating user carried through the shared service principal.\n /\n public async logHttpApiReadThroughAccess(\n data: Omit<AuditableEvent_HttpApiReadThroughAccess_EventData, 'eventType'>,\n requestExecutionContext?: ExecutionContext<any>,\n ): Promise<void> {\n const eventData: AuditableEvent_HttpApiReadThroughAccess_EventData = {\n eventType: CoreAuditableEventType.HTTP_API_READ_THROUGH_ACCESS,\n ...data,\n };\n\n await this._createAuditLog({\n userId: data.initiatorUserId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.LOW,\n eventType: CoreAuditableEventType.HTTP_API_READ_THROUGH_ACCESS,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext);\n }\n\n /\n Record that a subject erasure invoked an HTTP_API binding's DECLARED external-erasure\n * operation (ETL D6 stance 6b) — remote rows linked to the erased subject were deleted in a\n * system the platform does not own. The erasure report is the per-request receipt; this row is\n * the queryable trail of the outbound write.\n \n No top-level `userId`: the erasure runs as a system operation, and the SUBJECT is named in\n * `eventData.subjectIds` — writing the subject into `userId` would misattribute the deletion to\n * the person it served.\n \n assurance-control: WILDO.AUDIT.ATTRIBUTION — every outbound deletion on the read-through\n * plane is recorded with the subject it served and the external system it reached.\n /\n public async logHttpApiExternalErasure(\n data: Omit<AuditableEvent_HttpApiExternalErasure_EventData, 'eventType'>,\n requestExecutionContext?: ExecutionContext<any>,\n ): Promise<void> {\n const eventData: AuditableEvent_HttpApiExternalErasure_EventData = {\n eventType: CoreAuditableEventType.HTTP_API_EXTERNAL_ERASURE,\n ...data,\n };\n\n await this._createAuditLog({\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.HTTP_API_EXTERNAL_ERASURE,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext);\n }\n\n /\n Record that a subject erasure COMPLETED while rows linked to the subject remain live in an\n * HTTP_API-bound external system, on the controller's explicit per-request acknowledgement\n * (ETL D6 stance 6c). THE RECORD IS THE CONTROL — the acknowledgement's justification is that\n * the hole becomes visible rather than prevented (`administrative-continuity-floors.md`), so a\n * failure to emit here would remove the control itself; callers still treat it best-effort\n * (the erasure is already committed and correct), but the incomplete-effects report carries the\n * same fact as a second channel.\n \n assurance-control: WILDO.AUDIT.ATTRIBUTION — an acknowledged erasure hole is recorded per\n * resource per erasure request, never as a standing posture.\n /\n public async logHttpApiNonErasureAcknowledged(\n data: Omit<AuditableEvent_HttpApiNonErasureAcknowledged_EventData, 'eventType'>,\n requestExecutionContext?: ExecutionContext<any>,\n ): Promise<void> {\n const eventData: AuditableEvent_HttpApiNonErasureAcknowledged_EventData = {\n eventType: CoreAuditableEventType.HTTP_API_NON_ERASURE_ACKNOWLEDGED,\n ...data,\n };\n\n await this._createAuditLog({\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.HIGH,\n eventType: CoreAuditableEventType.HTTP_API_NON_ERASURE_ACKNOWLEDGED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext);\n }\n\n /\n Record an operation the authorizer REFUSED — the negative access decision.\n \n The twin of {@link logResourceOperationPerformed}, emitted from the opposite side of dispatch:\n * that one fires post-commit for work that happened, this one fires pre-dispatch for work that was\n * stopped. Together they discharge `CLAUDE.md`'s \"record access decisions\" — previously only the\n * fail-closed half of that sentence was implemented, and a refused HIGH/CRITICAL action left no\n * evidence at all.\n \n `riskLevel` is the REFUSED operation's declared level and rides the row for danger grading; it\n * does NOT gate emission (every denial is recorded — see the event-data schema for why a risk\n * floor is the wrong control here) and it does NOT affect the row's `severity`, which is a pure\n * function of the event type.\n \n Best-effort like every other emitter here: `_createAuditLog` swallows its own store failure and\n * increments `audit_store_failure_total`. A failure to record the refusal must never turn a clean\n * 403 into a 500 — the caller was already correctly refused.\n \n assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT — access-control decisions,\n * including refusals, are attributable and reviewable.\n /\n public async logResourceOperationDenied(\n data: Omit<AuditableEvent_ResourceOperationDenied_EventData, 'eventType'> & {\n /* The REFUSED operation's declared risk level, carried onto the row unchanged. /\n riskLevel: ResourceOperationRiskLevel;\n /* The refused ACTOR. Absent when the refusal WAS the absence of an identity. /\n actorUserId?: string;\n /* Tenant scope the event is ABOUT (event data — never a SIEM routing key). /\n organizationId?: string;\n applicationId?: string;\n },\n requestExecutionContext?: ExecutionContext<any>,\n ): Promise<void> {\n const { riskLevel, actorUserId, organizationId, applicationId, ...eventFields } = data;\n\n const eventData: AuditableEvent_ResourceOperationDenied_EventData = {\n eventType: CoreAuditableEventType.RESOURCE_OPERATION_DENIED,\n ...eventFields,\n };\n\n await this._createAuditLog({\n userId: actorUserId,\n organizationId,\n applicationId,\n riskLevel,\n eventType: CoreAuditableEventType.RESOURCE_OPERATION_DENIED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext);\n }\n\n // ===============================\n // SSO AUTHENTICATION AUDIT METHODS (Step 18)\n // ===============================\n\n /\n Log successful SSO login (distinct from USER_LOGIN — captures provider ref, connection type)\n /\n public async logUserSSOLogin(data: {\n userId: string;\n email: string;\n providerRef: string;\n connectionType: SsoConnectionType;\n authSource?: string;\n scopeType?: AuthScopeType;\n organizationId?: string;\n applicationId?: string;\n ipAddress: string;\n userAgent: string;\n sessionId: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_User_SSOLoginEventData = {\n eventType: CoreAuditableEventType.USER_SSO_LOGIN,\n userId: data.userId,\n email: data.email,\n providerRef: data.providerRef,\n connectionType: data.connectionType,\n authSource: data.authSource,\n scopeType: data.scopeType,\n organizationId: data.organizationId,\n applicationId: data.applicationId,\n ipAddress: data.ipAddress,\n userAgent: data.userAgent,\n sessionId: data.sessionId,\n };\n\n await this._createAuditLog({\n userId: data.userId,\n organizationId: data.organizationId,\n applicationId: data.applicationId,\n riskLevel: ResourceOperationRiskLevel.LOW,\n eventType: CoreAuditableEventType.USER_SSO_LOGIN,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n /\n Log SSO login failure (with failure reason: enforcement blocked, IdP error, etc.)\n /\n public async logUserSSOLoginFailed(data: {\n email?: string;\n providerRef?: string;\n connectionType?: SsoConnectionType;\n authSource?: string;\n failureReason: string;\n scopeType?: AuthScopeType;\n organizationId?: string;\n applicationId?: string;\n ipAddress: string;\n userAgent: string;\n }): Promise<void> {\n const eventData: AuditableEvent_User_SSOLoginFailedEventData = {\n eventType: CoreAuditableEventType.USER_SSO_LOGIN_FAILED,\n email: data.email,\n providerRef: data.providerRef,\n connectionType: data.connectionType,\n authSource: data.authSource,\n failureReason: data.failureReason,\n scopeType: data.scopeType,\n organizationId: data.organizationId,\n applicationId: data.applicationId,\n ipAddress: data.ipAddress,\n userAgent: data.userAgent,\n };\n\n await this._createAuditLog({\n userId: undefined,\n organizationId: data.organizationId,\n applicationId: data.applicationId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.USER_SSO_LOGIN_FAILED,\n eventData: eventData as Record<string, any>,\n });\n }\n\n /\n Log SSO enforcement blocked (social SSO rejected due to org enforcement — the C4 scenario)\n /\n public async logUserSSOEnforcementBlocked(data: {\n email: string;\n attemptedProviderRef: string;\n attemptedConnectionType: SsoConnectionType;\n organizationId: string;\n enforcementPolicy: string;\n ipAddress: string;\n userAgent: string;\n }): Promise<void> {\n const eventData: AuditableEvent_User_SSOEnforcementBlockedEventData = {\n eventType: CoreAuditableEventType.USER_SSO_ENFORCEMENT_BLOCKED,\n email: data.email,\n attemptedProviderRef: data.attemptedProviderRef,\n attemptedConnectionType: data.attemptedConnectionType,\n organizationId: data.organizationId,\n enforcementPolicy: data.enforcementPolicy,\n ipAddress: data.ipAddress,\n userAgent: data.userAgent,\n };\n\n await this._createAuditLog({\n userId: undefined,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.HIGH,\n eventType: CoreAuditableEventType.USER_SSO_ENFORCEMENT_BLOCKED,\n eventData: eventData as Record<string, any>,\n });\n }\n\n /\n Log token refresh (security-relevant for enterprise)\n /\n public async logUserTokenRefreshed(data: {\n userId: string;\n sessionId: string;\n organizationId?: string;\n ipAddress: string;\n userAgent: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_User_TokenRefreshedEventData = {\n eventType: CoreAuditableEventType.USER_TOKEN_REFRESHED,\n userId: data.userId,\n sessionId: data.sessionId,\n ipAddress: data.ipAddress,\n userAgent: data.userAgent,\n };\n\n await this._createAuditLog({\n userId: data.userId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.LOW,\n eventType: CoreAuditableEventType.USER_TOKEN_REFRESHED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n /\n Log that the application booted with no administratively usable super-administrator.\n \n Unlike every other event on this service, this one records a STATE rather than an action, and it\n * has no actor: nobody performed it through a guarded path — the write guards refuse to create this\n * state — so its existence means it arrived by a database edit, a restore, a seed that authored no\n * administrator, or a role-table change that redefined which roles confer super-admin. `userId` is\n * therefore deliberately absent rather than filled with a placeholder.\n \n `riskLevel: CRITICAL` because the condition is unrecoverable in-product: every door that could\n * appoint a new administrator is itself gated on the missing role.\n \n assurance-control: WILDO.ACCESS.ADMINISTRATIVE_CONTINUITY — evidence that the application has no\n * accountable administrative principal.\n /\n public async logApplicationSuperAdminFloorBreached(data: {\n usableSuperAdminCount: number;\n requiredUsableSuperAdminCount: number;\n conferringRoles: string[];\n usableStatuses: string[];\n }, requestExecutionContext?: ExecutionContext<any>): Promise<void> {\n const eventData: AuditableEvent_Application_SuperAdminFloorBreachedEventData = {\n eventType: CoreAuditableEventType.APPLICATION_SUPER_ADMIN_FLOOR_BREACHED,\n usableSuperAdminCount: data.usableSuperAdminCount,\n requiredUsableSuperAdminCount: data.requiredUsableSuperAdminCount,\n conferringRoles: data.conferringRoles,\n usableStatuses: data.usableStatuses,\n };\n\n await this._createAuditLog({\n riskLevel: ResourceOperationRiskLevel.CRITICAL,\n eventType: CoreAuditableEventType.APPLICATION_SUPER_ADMIN_FLOOR_BREACHED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext);\n }\n\n /\n Record a tenant left with no administratively usable owner by an action that was ALLOWED.\n \n The organization twin of {@link logApplicationSuperAdminFloorBreached}, and it differs in the way\n * that matters: that one has no actor (the state can only arrive out-of-band, because every guarded\n * path refuses it), whereas this one is emitted precisely BECAUSE a guarded path let the write\n * through. Suspending a user is normally incident response; refusing it would mean an operator\n * cannot lock out a compromised owner without first transferring ownership using the tenant the\n * attacker controls. A stranded tenant is recoverable — the boot report finds it and\n * `organizationMembers.grantOwnership` repairs it — a live hostile owner session is not.\n \n That trade only holds if the consequence is VISIBLE, so this record is the whole control. Emitted\n * one per stranded tenant: a single deactivation can strand several, and an operator who learns\n * about them one at a time cannot plan the remediation.\n \n assurance-control: WILDO.ACCESS.ADMINISTRATIVE_CONTINUITY — evidence that a tenant has no\n * accountable administrative principal, and which allowed action caused it.\n /\n public async logOrganizationOwnerFloorBreached(data: {\n organizationId: string;\n reducedMemberIds: string[];\n remainingUsableOwners: number;\n operationIdentifier: string;\n subjectUserId: string;\n subjectNextStatus: string;\n }, requestExecutionContext?: ExecutionContext<any>): Promise<void> {\n const eventData: AuditableEvent_Organization_OwnerFloorBreachedEventData = {\n eventType: CoreAuditableEventType.ORGANIZATION_OWNER_FLOOR_BREACHED,\n organizationId: data.organizationId,\n reducedMemberIds: data.reducedMemberIds,\n remainingUsableOwners: data.remainingUsableOwners,\n operationIdentifier: data.operationIdentifier,\n subjectUserId: data.subjectUserId,\n subjectNextStatus: data.subjectNextStatus,\n };\n\n await this._createAuditLog({\n riskLevel: ResourceOperationRiskLevel.CRITICAL,\n eventType: CoreAuditableEventType.ORGANIZATION_OWNER_FLOOR_BREACHED,\n eventData: eventData as Record<string, any>,\n organizationId: data.organizationId,\n }, requestExecutionContext);\n }\n\n /\n Log an application-role grant or revocation on a `USERS` row.\n \n `User.appRoles` IS the subject's live application authority — `execution-context-creator` reads\n * it back into `initiatorRoles` on their very next request — so a change to it is an access-control\n * decision, not record maintenance. Emit this AFTER the write has been persisted: an event recorded\n * ahead of the write would survive a rollback and claim authority that was never granted.\n \n `riskLevel: HIGH` matches the risk level the role-administration operations declare. Attribution\n * splits deliberately: the audit row's `userId` is the ACTOR (`changedBy`, consistent with the\n * other admin-action events on this service, which is what \"who did this\" queries filter on), while\n * the SUBJECT rides the typed `eventData.userId`.\n \n The request execution context is forwarded so the per-org SIEM fan-out routes on the\n * AUTHENTICATED org rather than any caller-supplied field (F4 tenant segregation). An\n * application-scope actor simply has no org to route to, and the always-on DB store is unaffected.\n \n assurance-control: WILDO.AUDIT.SECURITY_EVENT — evidence that a privilege change occurred,\n * who made it, what was requested, and the resulting authority.\n /\n public async logUserAppRolesChanged(data: {\n userId: string;\n previousRoles: string[];\n newRoles: string[];\n requestedRoles: string[];\n operation: string;\n changedBy: string;\n reason?: string;\n }, requestExecutionContext?: ExecutionContext<any>): Promise<void> {\n const eventData: AuditableEvent_User_AppRolesChangedEventData = {\n eventType: CoreAuditableEventType.USER_APP_ROLES_CHANGED,\n userId: data.userId,\n previousRoles: data.previousRoles,\n newRoles: data.newRoles,\n requestedRoles: data.requestedRoles,\n operation: data.operation,\n changedBy: data.changedBy,\n reason: data.reason,\n };\n\n await this._createAuditLog({\n userId: data.changedBy,\n riskLevel: ResourceOperationRiskLevel.HIGH,\n eventType: CoreAuditableEventType.USER_APP_ROLES_CHANGED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext);\n }\n\n /\n Log an organization-wide role grant or revocation on an `ORGANIZATION_MEMBERS` row.\n \n The ORGANIZATIONS-scope twin of {@link logUserAppRolesChanged}, and it exists for the identical\n * reason: `OrganizationMember.roles` IS the member's live authority — `execution-context-creator`\n * reads it verbatim into `initiatorRoles` — so changing it is an access-control decision, not\n * record maintenance. `CoreAuditableEventType.ORGANIZATION_MEMBER_ROLE_CHANGED` was declared,\n * typed, and classified from the start but had NO producer until 2026-08-01, which meant every\n * in-tenant privilege change happened with no evidence at all.\n \n ## Emit only after the mutation is durable\n \n Both organization-member write paths declare `transactionalCore: true`, and the audit store does\n * NOT participate in that transaction. So unlike the application twin — whose paths are\n * non-transactional, where a postfix hook already runs after the write — this must be emitted from\n * a transaction POST-COMMIT effect. A postfix emission there would be written inside the\n * transaction and survive a rollback, asserting a grant that never happened. The callers register\n * exactly that effect; see the org-member custom implementations.\n \n ## Attribution and routing\n \n The audit row's `userId` is the ACTOR (`changedBy`, what \"who did this\" queries filter on); the\n * SUBJECT rides `eventData.userId` and the written row rides `eventData.memberId`. `organizationId`\n * is passed as event DATA — which tenant the event is ABOUT — while the per-org SIEM fan-out routes\n * on the AUTHENTICATED org from the forwarded execution context, never on this field (F4 tenant\n * segregation). System provisioning (SSO JIT, SCIM, invite acceptance, seeds) carries no\n * authenticated org and therefore no per-org dispatch; the always-on DB store still receives it,\n * which is the correct fail-closed shape.\n \n `riskLevel: HIGH` matches the application twin — a privilege change is never routine traffic.\n \n assurance-control: WILDO.AUDIT.SECURITY_EVENT — evidence that a privilege change occurred,\n * who made it, what was requested, and the resulting authority.\n /\n public async logOrganizationMemberRolesChanged(data: {\n organizationId: string;\n memberId: string;\n userId?: string;\n previousRoles: string[];\n newRoles: string[];\n requestedRoles?: string[];\n operation: string;\n changedBy: string;\n }, requestExecutionContext?: ExecutionContext<any>): Promise<void> {\n const eventData: AuditableEvent_OrganizationMember_RoleChangedEventData = {\n eventType: CoreAuditableEventType.ORGANIZATION_MEMBER_ROLE_CHANGED,\n organizationId: data.organizationId,\n memberId: data.memberId,\n userId: data.userId,\n previousRoles: data.previousRoles,\n newRoles: data.newRoles,\n requestedRoles: data.requestedRoles,\n operation: data.operation,\n changedBy: data.changedBy,\n };\n\n await this._createAuditLog({\n userId: data.changedBy,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.HIGH,\n eventType: CoreAuditableEventType.ORGANIZATION_MEMBER_ROLE_CHANGED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext);\n }\n\n /\n Log a per-unit role assignment on an `ORGANIZATION_UNIT_MEMBERS` row.\n \n The NARROWED twin of {@link logOrganizationMemberRolesChanged}. `OrganizationUnitMember.role` is\n * live authority: `appendUnitScopedRoles` emits it into `initiatorRoles` carrying an\n * `organizationUnitId` discriminator, which bounds the grant to ONE unit rather than the tenant.\n * Narrower blast radius, same KIND of decision — so it is evidenced on the same terms and at the\n * same `HIGH` risk level rather than being folded into ORG_MANAGEMENT record-keeping.\n \n Singular `role` throughout, mirroring the resource: one role per (unit, member) is its persisted\n * business key, and an array here would invent a cardinality the row cannot hold.\n \n assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — evidence of unit-scoped privilege grant.\n /\n public async logOrganizationUnitMemberRoleChanged(data: {\n assignmentId: string;\n organizationId?: string;\n organizationUnitId?: string;\n organizationMemberId?: string;\n previousRole?: string;\n newRole: string;\n requestedRole?: string;\n operation: string;\n changedBy: string;\n }, requestExecutionContext?: ExecutionContext<any>): Promise<void> {\n const eventData: AuditableEvent_OrganizationUnitMember_RoleChangedEventData = {\n eventType: CoreAuditableEventType.ORGANIZATION_UNIT_MEMBER_ROLE_CHANGED,\n organizationId: data.organizationId,\n organizationUnitId: data.organizationUnitId,\n assignmentId: data.assignmentId,\n organizationMemberId: data.organizationMemberId,\n previousRole: data.previousRole,\n newRole: data.newRole,\n requestedRole: data.requestedRole,\n operation: data.operation,\n changedBy: data.changedBy,\n };\n\n await this._createAuditLog({\n userId: data.changedBy,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.HIGH,\n eventType: CoreAuditableEventType.ORGANIZATION_UNIT_MEMBER_ROLE_CHANGED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext);\n }\n\n /\n Log the revocation of a per-unit role assignment.\n \n The closing half of {@link logOrganizationUnitMemberRoleChanged}. Without it an\n * authorization-filtered trail shows unit privileges being granted and never removed, which is a\n * worse failure than having no trail at all — it reads as an accumulating set of grants.\n \n `revokedRole` is the field that justifies the event's existence: the assignment row is\n * hard-deleted, so after the fact NOTHING else in the system can answer \"what authority did this\n * person lose\". Same `HIGH` risk level as the grant — a revocation is as security-relevant as the\n * grant it undoes, and an access review reads them as one pair.\n \n ## What this does and does not cover\n \n The DIRECT assignment DELETE only. Cascade removals — deleting the parent membership, or the\n * whole organization — run through the raw repository, which by construction does not execute\n * service custom implementations, so no per-assignment hook exists on those paths. That is the\n * correct boundary rather than a gap to work around: the semantic act there is losing the\n * membership or the tenant, and the assignment dying with it is a consequence evidenced by the\n * parent's own event.\n \n assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — evidence of privilege revocation.\n /\n public async logOrganizationUnitMemberRemoved(data: {\n assignmentId: string;\n organizationId?: string;\n organizationUnitId?: string;\n organizationMemberId?: string;\n revokedRole?: string;\n removedBy: string;\n }, requestExecutionContext?: ExecutionContext<any>): Promise<void> {\n const eventData: AuditableEvent_OrganizationUnitMember_RemovedEventData = {\n eventType: CoreAuditableEventType.ORGANIZATION_UNIT_MEMBER_REMOVED,\n organizationId: data.organizationId,\n organizationUnitId: data.organizationUnitId,\n assignmentId: data.assignmentId,\n organizationMemberId: data.organizationMemberId,\n revokedRole: data.revokedRole,\n removedBy: data.removedBy,\n };\n\n await this._createAuditLog({\n userId: data.removedBy,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.HIGH,\n eventType: CoreAuditableEventType.ORGANIZATION_UNIT_MEMBER_REMOVED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext);\n }\n\n /\n Log the removal of an organization membership — administrative DELETE, or REVOKE of a pending\n * invitation.\n \n `CoreAuditableEventType.ORGANIZATION_MEMBER_REMOVED` was declared, typed, and classified from the\n * start but had NO producer until 2026-08-01. That left the two ends of the membership lifecycle\n * asymmetric: joining was evidenced, leaving was not. It also silently discarded the REVOKE\n * `reason` — the resource config declares that field with the explicit note that it \"is captured in\n * the audit payload, not persisted on the deleted row\", and nothing was capturing it.\n \n ## Risk level differs from the operations' own\n \n `HIGH` for both paths, even though REVOKE declares `MEDIUM`. That declared level is the UI axis\n * (whether the roster button gets a danger-zone affordance); the evidence axis is the destruction\n * of a membership record and the roles it carried, which is not routine traffic either way. The\n * organization-member UPDATE already documents exactly this divergence for the same resource.\n \n ## Emit only after the mutation is durable\n \n Both paths are `transactionalCore: true` and both prefixes refuse to run without a transaction,\n * so this is emitted from a transaction POST-COMMIT effect. A postfix emission would sit inside\n * that transaction and survive a rollback, asserting a removal that never happened — and there is a\n * live rollback path here: the owner-floor guard and the user-type revocation both run in the same\n * unit of work and can abort it.\n \n ## What this does and does not cover\n \n The two direct API paths. Deleting the whole ORGANIZATION cascades to its memberships through the\n * raw repository, below the service tier — evidenced by `ORGANIZATION_DELETED`, whose producer\n * exists, because the auditable act there is destroying the tenant. There is deliberately no\n * `USERS -> ORGANIZATION_MEMBERS` relationship, so deleting a user does not cascade here at all.\n \n assurance-control: WILDO.ACCESS.LIFECYCLE — evidence that access was withdrawn,\n * from whom, by whom, and what authority it carried.\n /\n public async logOrganizationMemberRemoved(data: {\n organizationId: string;\n memberId: string;\n removedUserId: string;\n roles?: string[];\n previousStatus?: string;\n operation: string;\n /* Per-unit grants the removal cascaded away — the cascade runs below the service tier and cannot self-evidence. /\n revokedUnitAssignments?: { organizationUnitId: string; role: string }[];\n removedBy: string;\n reason?: string;\n }, requestExecutionContext?: ExecutionContext<any>): Promise<void> {\n const eventData: AuditableEvent_OrganizationMember_RemovedEventData = {\n eventType: CoreAuditableEventType.ORGANIZATION_MEMBER_REMOVED,\n organizationId: data.organizationId,\n memberId: data.memberId,\n removedUserId: data.removedUserId,\n roles: data.roles,\n previousStatus: data.previousStatus,\n operation: data.operation,\n revokedUnitAssignments: data.revokedUnitAssignments,\n removedBy: data.removedBy,\n reason: data.reason,\n };\n\n await this._createAuditLog({\n userId: data.removedBy,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.HIGH,\n eventType: CoreAuditableEventType.ORGANIZATION_MEMBER_REMOVED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext);\n }\n\n /\n Log the hard deletion of a `USERS` row.\n \n `CoreAuditableEventType.USER_DELETED` was declared and classified from the start but had NO\n * producer until 2026-08-01 — every user deletion, self-service or administrative, happened with\n * no evidence. Identity destruction is exactly the kind of event an assurance trail exists for,\n * so the absence was a silent audit gap rather than a missing nicety.\n \n Emit AFTER the delete transaction commits. An event written ahead of it would survive a\n * rollback and assert a destruction that never happened — the mirror of the rule on\n * {@link logUserAppRolesChanged}, and not hypothetical here: the delete cascade throws inside the\n * parent transaction when a child lacks a teardown op.\n \n Attribution splits as elsewhere on this service: the audit row's `userId` is the ACTOR\n * (`deletedBy`), the SUBJECT rides the typed `eventData.userId`. For the administrative\n * `USERS \| DELETE` route those differ; they coincide only if a principal ever deletes itself.\n \n `riskLevel: CRITICAL` matches the risk level `USERS \| DELETE` declares.\n \n assurance-control: WILDO.DATA.SECURE_LIFECYCLE — identity destruction must be\n * attributable and evidenced.\n /\n public async logUserDeleted(data: {\n userId: string;\n email?: string;\n deletedBy: string;\n appRoles?: string[];\n }, requestExecutionContext?: ExecutionContext<any>): Promise<void> {\n const eventData: AuditableEvent_User_DeletedEventData = {\n eventType: CoreAuditableEventType.USER_DELETED,\n userId: data.userId,\n email: data.email,\n deletedBy: data.deletedBy,\n appRoles: data.appRoles,\n };\n\n await this._createAuditLog({\n userId: data.deletedBy,\n riskLevel: ResourceOperationRiskLevel.CRITICAL,\n eventType: CoreAuditableEventType.USER_DELETED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext);\n }\n\n /\n Log the hard deletion of an `ORGANIZATIONS` row.\n \n The exact sibling of {@link logUserDeleted}, and the same class of gap:\n * `CoreAuditableEventType.ORGANIZATION_DELETED` was declared, given a complete event-data schema\n * and a SIEM classification (`ORG_MANAGEMENT` / `WARNING`) from the start, yet NOTHING emitted it\n * until 2026-08-01. Destroying an organization destroys a whole tenant — its members, its\n * configuration and everything the delete cascade reaches — and it did so leaving no evidence that\n * it had happened, by whom, or which tenant it was.\n \n Emit AFTER the delete transaction commits, for the same reason as the user twin: the delete and\n * its `onParentDelete` cascade share one transaction, and the cascade genuinely throws when a child\n * lacks a teardown operation. An event written ahead of that would survive the rollback and assert\n * a destruction that never happened.\n \n `name` and `slug` come from the PRE-deletion snapshot and are required by the event schema (they\n * are what lets an auditor identify the tenant afterwards — the id alone resolves to nothing once\n * the row is gone).\n \n Attribution splits as elsewhere on this service: the audit row's `userId` is the ACTOR\n * (`deletedBy`), the SUBJECT rides the typed `eventData.organizationId`. On the org-admin door the\n * actor is a member of the organization being deleted; on the super-admin door they are not.\n \n `organizationId` is also set on the row itself so the record is queryable per tenant. That is a\n * DATA field only — per-org SIEM routing is decided by `_createAuditLog` from the AUTHENTICATED\n * request org (F4), never from this value. Delivery therefore differs by door and is correct in\n * both cases: the org-admin door carries the deleted org on its execution context and delivers to\n * that org's sink, while the super-admin door carries no org and fail-closes to DB + app-level\n * sinks only. The row survives either way — `ORGANIZATIONS → AUDIT_LOGS` declares\n * `onParentDelete: { enabled: false }`, so the cascade does not take the evidence with the tenant.\n \n `riskLevel: CRITICAL` rather than a per-variant value. The two DELETE variants declare different\n * levels (CRITICAL for the org-admin door, HIGH for the super-admin one), but those grade the\n * authorization surface; this record grades the EVENT, which is the same tenant destruction on\n * either path. Taking the higher of the two avoids under-grading the privileged door.\n \n assurance-control: WILDO.DATA.SECURE_LIFECYCLE — destruction of a tenant and its\n * data is a security-relevant event; it must be attributable and it must leave evidence.\n /\n public async logOrganizationDeleted(data: {\n organizationId: string;\n name: string;\n slug: string;\n deletedBy: string;\n reason?: string;\n }, requestExecutionContext?: ExecutionContext<any>): Promise<void> {\n const eventData: AuditableEvent_Organization_DeletedEventData = {\n eventType: CoreAuditableEventType.ORGANIZATION_DELETED,\n organizationId: data.organizationId,\n name: data.name,\n slug: data.slug,\n deletedBy: data.deletedBy,\n reason: data.reason,\n };\n\n await this._createAuditLog({\n userId: data.deletedBy,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.CRITICAL,\n eventType: CoreAuditableEventType.ORGANIZATION_DELETED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext);\n }\n\n /\n A tenant was MARKED for deletion — the soft-delete half of tenant teardown.\n \n `CRITICAL` on the same footing as `logOrganizationDeleted`, and deliberately not lower: this is\n * the moment the tenant loses its access, and it is the moment a mistaken or malicious teardown\n * is still worth catching. The purge that follows is the mechanical consequence of THIS decision.\n \n assurance-control: WILDO.ACCESS.LIFECYCLE\n /\n public async logOrganizationDeletionRequested(data: {\n organizationId: string;\n name: string;\n slug: string;\n requestedBy: string;\n purgeScheduledAt: string;\n revokedUserTypeCount: number;\n reason?: string;\n }, requestExecutionContext?: ExecutionContext<any>): Promise<void> {\n const eventData: AuditableEvent_Organization_DeletionRequestedEventData = {\n eventType: CoreAuditableEventType.ORGANIZATION_DELETION_REQUESTED,\n organizationId: data.organizationId,\n name: data.name,\n slug: data.slug,\n requestedBy: data.requestedBy,\n purgeScheduledAt: data.purgeScheduledAt,\n revokedUserTypeCount: data.revokedUserTypeCount,\n reason: data.reason,\n };\n\n await this._createAuditLog({\n userId: data.requestedBy,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.CRITICAL,\n eventType: CoreAuditableEventType.ORGANIZATION_DELETION_REQUESTED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext);\n }\n\n /\n A pending tenant deletion was CANCELLED inside its retention window.\n \n `HIGH` rather than `CRITICAL`: restoring re-grants access to a whole tenant, which is\n * materially security-relevant and belongs in an access review, but it destroys nothing and is\n * itself reversible by re-marking.\n \n assurance-control: WILDO.ACCESS.LIFECYCLE\n /\n public async logOrganizationRestored(data: {\n organizationId: string;\n name: string;\n slug: string;\n restoredBy: string;\n restoredStatus: string;\n regrantedUserTypeCount: number;\n reason?: string;\n }, requestExecutionContext?: ExecutionContext<any>): Promise<void> {\n const eventData: AuditableEvent_Organization_RestoredEventData = {\n eventType: CoreAuditableEventType.ORGANIZATION_RESTORED,\n organizationId: data.organizationId,\n name: data.name,\n slug: data.slug,\n restoredBy: data.restoredBy,\n restoredStatus: data.restoredStatus,\n regrantedUserTypeCount: data.regrantedUserTypeCount,\n reason: data.reason,\n };\n\n await this._createAuditLog({\n userId: data.restoredBy,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.HIGH,\n eventType: CoreAuditableEventType.ORGANIZATION_RESTORED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext);\n }\n\n /\n The tenant was administratively HALTED.\n \n `CRITICAL`: since the tenant-status authority gate shipped, this single write revokes the\n * organization access of every member at once. That is the same blast radius as a teardown, even\n * though nothing is destroyed and the action is reversible.\n \n assurance-control: WILDO.ACCESS.LIFECYCLE\n /\n public async logOrganizationSuspended(data: {\n organizationId: string;\n name: string;\n slug: string;\n suspendedBy: string;\n previousStatus: string;\n suspensionReason: string;\n notifiedMembers: boolean;\n revokedUserTypeCount: number;\n }, requestExecutionContext?: ExecutionContext<any>): Promise<void> {\n const eventData: AuditableEvent_Organization_SuspendedEventData = {\n eventType: CoreAuditableEventType.ORGANIZATION_SUSPENDED,\n organizationId: data.organizationId,\n name: data.name,\n slug: data.slug,\n suspendedBy: data.suspendedBy,\n previousStatus: data.previousStatus,\n suspensionReason: data.suspensionReason,\n notifiedMembers: data.notifiedMembers,\n revokedUserTypeCount: data.revokedUserTypeCount,\n };\n\n await this._createAuditLog({\n userId: data.suspendedBy,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.CRITICAL,\n eventType: CoreAuditableEventType.ORGANIZATION_SUSPENDED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext);\n }\n\n /\n Record a change to the application's authored authentication policy — see\n * {@link AuditableEvent_ApplicationAuthPolicyChanged_EventDataSchema} for the full rationale and\n * scope.\n \n USERLESS by design, exactly like {@link logSystemContextAccess}: this is emitted at backend\n * startup, where there is no human actor to name. The honest attribution is \"the running\n * application recorded that its authored policy changed since the last boot\"; the \"who authored the\n * change\" lives in the deployment / source history, and inventing a `userId` here would corrupt the\n * trail. Passing no `requestExecutionContext` is deliberate — the row is system-attributed.\n \n `riskLevel` is MEDIUM: a configuration change worth a durable, reviewable record (its severity is\n * WARNING via the classification map), not an active breach. The before → after payload, not the\n * risk level, is what tells a reviewer whether the change weakened the posture.\n \n assurance-control: WILDO.AUDIT.SECURITY_EVENT — a change to the application's authentication-assurance\n * policy is recorded as an attributable, durable audit event.\n /\n public async logApplicationAuthPolicyChanged(data: {\n applicationId: string;\n changedUserTypes: string[];\n snapshotDigest: string;\n before: Record<string, ApplicationAuthPolicySnapshot> \| null;\n after: Record<string, ApplicationAuthPolicySnapshot>;\n }): Promise<void> {\n const eventData: AuditableEvent_ApplicationAuthPolicyChanged_EventData = {\n eventType: CoreAuditableEventType.APPLICATION_AUTH_POLICY_CHANGED,\n applicationId: data.applicationId,\n changedUserTypes: data.changedUserTypes,\n snapshotDigest: data.snapshotDigest,\n before: data.before,\n after: data.after,\n };\n\n await this._createAuditLog({\n applicationId: data.applicationId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.APPLICATION_AUTH_POLICY_CHANGED,\n eventData: eventData as Record<string, any>,\n });\n }\n\n /\n Boot-time change-detector for the application authentication policy: reconcile the current\n * authored snapshot against the last one the trail recorded, and emit an\n * {@link logApplicationAuthPolicyChanged} event ONLY if it moved.\n \n The audit trail is its OWN change-detection state — there is no separate snapshot store to keep in\n * sync, and (because the read below goes straight to the audit repository rather than through\n * `SystemAccessBackendService`) it costs no extra per-boot `SYSTEM_CONTEXT_READ` row. Behaviour:\n * - no prior event (first boot ever) → emit a BASELINE row (`before: null`);\n * - digest differs → emit `before → after` naming the changed user types;\n * - digest identical → emit NOTHING, so the trail carries one row per genuine\n * change rather than one per boot (the audit-noise rule).\n \n Fully fire-and-forget: any failure is logged and swallowed. A backend must boot whether or not it\n * could record this, exactly like every other audit emission.\n \n assurance-control: WILDO.AUDIT.SECURITY_EVENT WILDO.IDENTITY.SESSION_ASSURANCE — every change to the\n * authored authentication-assurance posture (MFA / password / lockout / methods / step-up / session) is\n * detected at startup and evidenced in the audit trail, once per genuine change.\n /\n public async emitApplicationAuthPolicyChangeIfChanged(data: {\n applicationId: string;\n userTypes: UserTypesConfig;\n }): Promise<void> {\n try {\n // Build → digest → detect → emit is ALL inside this try so the boot caller is a single call\n // that cannot throw: the whole path (including snapshot construction) is swallowed here.\n const currentSnapshot = buildApplicationAuthPolicySnapshot(data.userTypes);\n const currentDigest = computeApplicationAuthPolicySnapshotDigest(currentSnapshot);\n const prior = await this._readMostRecentApplicationAuthPolicyEvent();\n\n if (prior && prior.snapshotDigest === currentDigest) {\n // Unchanged since the last recorded snapshot — the trail already reflects it. Emit nothing.\n return;\n }\n\n const before = prior?.after ?? null;\n const changedUserTypes = diffChangedApplicationAuthPolicyUserTypes(before, currentSnapshot);\n\n await this.logApplicationAuthPolicyChanged({\n applicationId: data.applicationId,\n changedUserTypes,\n snapshotDigest: currentDigest,\n before,\n after: currentSnapshot,\n });\n } catch (error) {\n // Never let a change-detection failure affect boot — audit emission is fire-and-forget.\n this.logger.error?.('Failed to reconcile/emit application auth-policy change audit', { error });\n }\n }\n\n /\n The most recent {@link CoreAuditableEventType.APPLICATION_AUTH_POLICY_CHANGED} event's payload, or\n * null when none exists yet (the first-ever boot).\n \n Keyed on `eventType` ALONE, deliberately: an application's audit store holds only that one\n * application's rows (every runtime of the app — the serving backend and its minions — writes to\n * the same app-scoped store), so every row of this type is this application's, and `eventType` is\n * guaranteed present on the row — unlike the context-populated `applicationId`, which is re-derived\n * from the writer's scope and would be an unreliable filter for the boot-time super-admin context\n * (which carries no application id of its own). Reads through the AUDIT_LOGS LIST path, whose\n * declared `filterFields` include `eventType`,\n * with `excludeContextualFilter` so the org-less boot context still sees the row; newest-first,\n * limit 1. The stored `eventData` is re-validated so a malformed/foreign row degrades to \"no prior\"\n * (→ a harmless baseline re-emit) rather than throwing.\n /\n private async _readMostRecentApplicationAuthPolicyEvent(): Promise<AuditableEvent_ApplicationAuthPolicyChanged_EventData \| null> {\n const ec = await this._getTempExecutionContext();\n const auditRepo = this.repositoriesRegistry.getRepositoryOrThrow(CoreResourceType.AUDIT_LOGS);\n // Typed to the repository's `_doList` contract (`listOptions.sort`), which the public `list`\n // overload's narrower type does not name — see the same pattern in the immudb-reconcile batch.\n const listOptions: { page: number; limit: number; sort: Record<string, 1 \| -1> } = {\n page: 1,\n limit: 1,\n sort: { createdAt: -1 },\n };\n const result = (await auditRepo.list(\n ec,\n { eventType: CoreAuditableEventType.APPLICATION_AUTH_POLICY_CHANGED },\n { paginated: true, excludeContextualFilter: true, listOptions },\n )) as unknown as { data?: Array<{ eventData?: unknown }> };\n\n const row = result.data?.[0];\n if (!row) {\n return null;\n }\n const parsed = AuditableEvent_ApplicationAuthPolicyChanged_EventDataSchema.safeParse(row.eventData);\n return parsed.success ? parsed.data : null;\n }\n\n /\n A governed lifecycle transition changed a subject's `status`.\n \n Called from the shared status-transition implementation, so every verb it serves is trailed by\n * construction — membership suspend/reactivate, administrative user suspend/unsuspend, and\n * self-service account deactivation. Before this those five emitted NOTHING, while the tenant\n * verbs were fully attributable.\n \n Risk is derived from the DIRECTION rather than fixed: a restriction (`isRestricting`) is the\n * event an access review is looking for and carries `HIGH`, while a lift is `MEDIUM`. Grading the\n * pair identically would either inflate routine reinstatements or bury suspensions.\n \n `organizationId` is forwarded when the subject is tenant-scoped so the row routes to that\n * tenant's SIEM; an application-scoped subject (a `USERS` row) legitimately has none.\n \n assurance-control: WILDO.AUDIT.SECURITY_EVENT — a change to whether a principal may act is\n * attributable, justified and evidenced.\n /\n public async logResourceStatusTransitionPerformed(data: {\n resourceType: string;\n operationIdentifier: string;\n subjectId: string;\n performedBy: string;\n previousStatus: string;\n newStatus: string;\n /* True when the transition REMOVES access (suspend / deactivate) rather than restoring it. /\n isRestricting: boolean;\n reason?: string;\n scheduledReactivationAt?: Date \| null;\n organizationId?: string;\n }, requestExecutionContext?: ExecutionContext<any>): Promise<void> {\n const eventData: AuditableEvent_Resource_StatusTransitionPerformedEventData = {\n eventType: CoreAuditableEventType.RESOURCE_STATUS_TRANSITION_PERFORMED,\n resourceType: data.resourceType,\n operationIdentifier: data.operationIdentifier,\n subjectId: data.subjectId,\n performedBy: data.performedBy,\n previousStatus: data.previousStatus,\n newStatus: data.newStatus,\n ...(data.reason !== undefined ? { reason: data.reason } : {}),\n ...(data.scheduledReactivationAt\n ? { scheduledReactivationAt: data.scheduledReactivationAt.toISOString() }\n : {}),\n ...(data.organizationId !== undefined ? { organizationId: data.organizationId } : {}),\n };\n\n await this._createAuditLog({\n userId: data.performedBy,\n organizationId: data.organizationId,\n riskLevel: data.isRestricting\n ? ResourceOperationRiskLevel.HIGH\n : ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.RESOURCE_STATUS_TRANSITION_PERFORMED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext);\n }\n\n /\n A halted or expired tenant was returned to normal operation.\n \n `HIGH` rather than `CRITICAL`: reinstating organization-wide access is materially\n * security-relevant and belongs in an access review, but it destroys nothing and is itself\n * reversible by re-suspending.\n \n assurance-control: WILDO.ACCESS.LIFECYCLE\n /\n public async logOrganizationActivated(data: {\n organizationId: string;\n name: string;\n slug: string;\n activatedBy: string;\n previousStatus: string;\n regrantedUserTypeCount: number;\n reason?: string;\n }, requestExecutionContext?: ExecutionContext<any>): Promise<void> {\n const eventData: AuditableEvent_Organization_ActivatedEventData = {\n eventType: CoreAuditableEventType.ORGANIZATION_ACTIVATED,\n organizationId: data.organizationId,\n name: data.name,\n slug: data.slug,\n activatedBy: data.activatedBy,\n previousStatus: data.previousStatus,\n regrantedUserTypeCount: data.regrantedUserTypeCount,\n reason: data.reason,\n };\n\n await this._createAuditLog({\n userId: data.activatedBy,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.HIGH,\n eventType: CoreAuditableEventType.ORGANIZATION_ACTIVATED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext);\n }\n\n // ===============================\n // ORGANIZATION SECURITY MANAGEMENT AUDIT METHODS (Step 18)\n // ===============================\n\n /\n Log SSO configuration change (admin changed SSO settings)\n /\n public async logOrganizationSSOConfigurationChanged(data: {\n organizationId: string;\n changedBy: string;\n changeType: SsoConfigChangeType;\n affectedProviderRef?: string;\n changes?: Record<string, unknown>;\n }): Promise<void> {\n const eventData: AuditableEvent_Organization_SSOConfigurationChangedEventData = {\n eventType: CoreAuditableEventType.ORGANIZATION_SSO_CONFIGURATION_CHANGED,\n organizationId: data.organizationId,\n changedBy: data.changedBy,\n changeType: data.changeType,\n affectedProviderRef: data.affectedProviderRef,\n changes: data.changes,\n };\n\n await this._createAuditLog({\n userId: data.changedBy,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.ORGANIZATION_SSO_CONFIGURATION_CHANGED,\n eventData: eventData as Record<string, any>,\n });\n }\n\n /\n Log SIEM export configuration change (meta-audit — admin configured SIEM export)\n /\n public async logOrganizationSIEMExportConfigured(data: {\n organizationId: string;\n changedBy: string;\n changeType: SiemExportChangeType;\n webhookUrlDomain?: string;\n eventFormatConfigured?: string;\n }): Promise<void> {\n const eventData: AuditableEvent_Organization_SIEMExportConfiguredEventData = {\n eventType: CoreAuditableEventType.ORGANIZATION_SIEM_EXPORT_CONFIGURED,\n organizationId: data.organizationId,\n changedBy: data.changedBy,\n changeType: data.changeType,\n webhookUrlDomain: data.webhookUrlDomain,\n eventFormatConfigured: data.eventFormatConfigured,\n };\n\n await this._createAuditLog({\n userId: data.changedBy,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.LOW,\n eventType: CoreAuditableEventType.ORGANIZATION_SIEM_EXPORT_CONFIGURED,\n eventData: eventData as Record<string, any>,\n });\n }\n\n /\n Log emergency access used (break-glass account used)\n /\n public async logEmergencyAccessUsed(data: {\n userId: string;\n email: string;\n organizationId: string;\n reason?: string;\n ipAddress: string;\n userAgent: string;\n sessionId: string;\n }): Promise<void> {\n const eventData: AuditableEvent_EmergencyAccess_UsedEventData = {\n eventType: CoreAuditableEventType.EMERGENCY_ACCESS_USED,\n userId: data.userId,\n email: data.email,\n organizationId: data.organizationId,\n reason: data.reason,\n ipAddress: data.ipAddress,\n userAgent: data.userAgent,\n sessionId: data.sessionId,\n };\n\n await this._createAuditLog({\n userId: data.userId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.HIGH,\n eventType: CoreAuditableEventType.EMERGENCY_ACCESS_USED,\n eventData: eventData as Record<string, any>,\n });\n }\n\n // ===============================\n // PASSWORD RESET AUDIT METHODS (H5)\n // ===============================\n\n /\n Log password reset requested\n /\n public async logUserPasswordResetRequested(data: {\n email: string;\n ipAddress: string;\n userAgent: string;\n organizationId?: string;\n }): Promise<void> {\n const eventData: AuditableEvent_User_PasswordResetRequestedEventData = {\n eventType: CoreAuditableEventType.USER_PASSWORD_RESET_REQUESTED,\n email: data.email,\n ipAddress: data.ipAddress,\n userAgent: data.userAgent,\n };\n\n await this._createAuditLog({\n userId: undefined,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.LOW,\n eventType: CoreAuditableEventType.USER_PASSWORD_RESET_REQUESTED,\n eventData: eventData as Record<string, any>,\n });\n }\n\n /\n Log password reset completed\n /\n public async logUserPasswordResetCompleted(data: {\n userId: string;\n ipAddress: string;\n userAgent: string;\n organizationId?: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_User_PasswordResetCompletedEventData = {\n eventType: CoreAuditableEventType.USER_PASSWORD_RESET_COMPLETED,\n userId: data.userId,\n ipAddress: data.ipAddress,\n userAgent: data.userAgent,\n };\n\n await this._createAuditLog({\n userId: data.userId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.USER_PASSWORD_RESET_COMPLETED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n /\n Log an ADMINISTRATOR-compelled credential reset.\n \n Separate from {@link logUserPasswordResetRequested} on purpose: that event models a\n * self-service request and has no actor field, so routing an admin action through it would\n * record the account owner as the person who acted. Here the acting administrator and the\n * target are both named, and `userId` on the log row is the TARGET — the row belongs to the\n * affected account's history, while `actorUserId` inside `eventData` answers \"who did this\".\n \n `riskLevel: HIGH` matches the operation's declared risk and the CRITICAL severity the\n * security envelope assigns the event type.\n \n assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — privileged credential\n * intervention is attributable, justified, and recorded.\n /\n public async logUserPasswordResetForced(data: {\n targetUserId: string;\n targetEmail: string;\n actorUserId: string;\n reason: string;\n sessionsRevoked: boolean;\n /* Optional — the resource-operation producer has no transport metadata. See the event schema. /\n ipAddress?: string;\n userAgent?: string;\n organizationId?: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_User_PasswordResetForcedEventData = {\n eventType: CoreAuditableEventType.USER_PASSWORD_RESET_FORCED,\n targetUserId: data.targetUserId,\n targetEmail: data.targetEmail,\n actorUserId: data.actorUserId,\n reason: data.reason,\n sessionsRevoked: data.sessionsRevoked,\n ipAddress: data.ipAddress,\n userAgent: data.userAgent,\n };\n\n await this._createAuditLog({\n userId: data.targetUserId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.HIGH,\n eventType: CoreAuditableEventType.USER_PASSWORD_RESET_FORCED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n // ===============================\n // REGISTRATION & VERIFICATION AUDIT METHODS (H5)\n // ===============================\n\n /\n Log user registration\n /\n public async logUserRegistered(data: {\n userId: string;\n email: string;\n ipAddress: string;\n userAgent: string;\n organizationId?: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_User_RegisteredEventData = {\n eventType: CoreAuditableEventType.USER_REGISTERED,\n userId: data.userId,\n email: data.email,\n ipAddress: data.ipAddress,\n userAgent: data.userAgent,\n };\n\n await this._createAuditLog({\n userId: data.userId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.LOW,\n eventType: CoreAuditableEventType.USER_REGISTERED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n /\n Log email verified\n /\n public async logUserEmailVerified(data: {\n userId: string;\n email: string;\n ipAddress: string;\n userAgent: string;\n organizationId?: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_User_EmailVerifiedEventData = {\n eventType: CoreAuditableEventType.USER_EMAIL_VERIFIED,\n userId: data.userId,\n email: data.email,\n ipAddress: data.ipAddress,\n userAgent: data.userAgent,\n };\n\n await this._createAuditLog({\n userId: data.userId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.LOW,\n eventType: CoreAuditableEventType.USER_EMAIL_VERIFIED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n public async logUserVerificationEmailResent(data: {\n userId: string;\n email: string;\n ipAddress: string;\n userAgent: string;\n }): Promise<void> {\n const eventData: AuditableEvent_User_VerificationEmailResentEventData = {\n eventType: CoreAuditableEventType.USER_VERIFICATION_EMAIL_RESENT,\n userId: data.userId,\n email: data.email,\n ipAddress: data.ipAddress,\n userAgent: data.userAgent,\n };\n\n await this._createAuditLog({\n userId: data.userId,\n riskLevel: ResourceOperationRiskLevel.LOW,\n eventType: CoreAuditableEventType.USER_VERIFICATION_EMAIL_RESENT,\n eventData: eventData as Record<string, any>,\n });\n }\n\n // ===============================\n // MFA LIFECYCLE AUDIT METHODS (H5)\n // ===============================\n\n /\n Log MFA setup started (TOTP enrollment initiated)\n /\n public async logUserMFASetupStarted(data: {\n userId: string;\n mfaMethod: string;\n ipAddress: string;\n userAgent: string;\n organizationId?: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_User_MFASetupStartedEventData = {\n eventType: CoreAuditableEventType.USER_MFA_SETUP_STARTED,\n userId: data.userId,\n mfaMethod: data.mfaMethod,\n ipAddress: data.ipAddress,\n userAgent: data.userAgent,\n };\n\n await this._createAuditLog({\n userId: data.userId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.LOW,\n eventType: CoreAuditableEventType.USER_MFA_SETUP_STARTED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n /\n Log MFA setup completed (TOTP enrollment verified)\n /\n public async logUserMFASetupCompleted(data: {\n userId: string;\n mfaMethod: string;\n ipAddress: string;\n userAgent: string;\n organizationId?: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_User_MFASetupCompletedEventData = {\n eventType: CoreAuditableEventType.USER_MFA_SETUP_COMPLETED,\n userId: data.userId,\n mfaMethod: data.mfaMethod,\n ipAddress: data.ipAddress,\n userAgent: data.userAgent,\n };\n\n await this._createAuditLog({\n userId: data.userId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.USER_MFA_SETUP_COMPLETED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n /\n Log MFA email OTP sent\n /\n public async logUserMFAEmailOTPSent(data: {\n email: string;\n sessionId: string;\n ipAddress: string;\n userAgent: string;\n organizationId?: string;\n }): Promise<void> {\n const eventData: AuditableEvent_User_MFAEmailOTPSentEventData = {\n eventType: CoreAuditableEventType.USER_MFA_EMAIL_OTP_SENT,\n email: data.email,\n sessionId: data.sessionId,\n ipAddress: data.ipAddress,\n userAgent: data.userAgent,\n };\n\n await this._createAuditLog({\n userId: undefined,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.LOW,\n eventType: CoreAuditableEventType.USER_MFA_EMAIL_OTP_SENT,\n eventData: eventData as Record<string, any>,\n });\n }\n\n // ===============================\n // WEBAUTHN/PASSKEY AUDIT METHODS (Phase G1)\n // ===============================\n\n /\n Log passkey registered\n /\n public async logUserPasskeyRegistered(data: {\n userId: string;\n email: string;\n credentialId: string;\n credentialName: string;\n credentialDeviceType: string;\n ipAddress: string;\n userAgent: string;\n organizationId?: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_User_PasskeyRegisteredEventData = {\n eventType: CoreAuditableEventType.USER_PASSKEY_REGISTERED,\n userId: data.userId,\n email: data.email,\n credentialId: data.credentialId,\n credentialName: data.credentialName,\n credentialDeviceType: data.credentialDeviceType,\n ipAddress: data.ipAddress,\n userAgent: data.userAgent,\n };\n\n await this._createAuditLog({\n userId: data.userId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.USER_PASSKEY_REGISTERED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n /\n Log passkey authentication success\n /\n public async logUserPasskeyAuthSuccess(data: {\n userId: string;\n email: string;\n credentialId: string;\n ipAddress: string;\n userAgent: string;\n sessionId: string;\n organizationId?: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_User_PasskeyAuthSuccessEventData = {\n eventType: CoreAuditableEventType.USER_PASSKEY_AUTHENTICATION_SUCCESS,\n userId: data.userId,\n email: data.email,\n credentialId: data.credentialId,\n ipAddress: data.ipAddress,\n userAgent: data.userAgent,\n sessionId: data.sessionId,\n };\n\n await this._createAuditLog({\n userId: data.userId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.LOW,\n eventType: CoreAuditableEventType.USER_PASSKEY_AUTHENTICATION_SUCCESS,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n /\n Log passkey authentication failure\n /\n public async logUserPasskeyAuthFailure(data: {\n email: string;\n failureReason: string;\n ipAddress: string;\n userAgent: string;\n sessionId: string;\n organizationId?: string;\n }): Promise<void> {\n const eventData: AuditableEvent_User_PasskeyAuthFailureEventData = {\n eventType: CoreAuditableEventType.USER_PASSKEY_AUTHENTICATION_FAILURE,\n email: data.email,\n failureReason: data.failureReason,\n ipAddress: data.ipAddress,\n userAgent: data.userAgent,\n sessionId: data.sessionId,\n };\n\n await this._createAuditLog({\n userId: undefined,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.USER_PASSKEY_AUTHENTICATION_FAILURE,\n eventData: eventData as Record<string, any>,\n });\n }\n\n /\n Log passkey removed\n /\n public async logUserPasskeyRemoved(data: {\n userId: string;\n email: string;\n credentialId: string;\n credentialName: string;\n ipAddress: string;\n userAgent: string;\n organizationId?: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_User_PasskeyRemovedEventData = {\n eventType: CoreAuditableEventType.USER_PASSKEY_REMOVED,\n userId: data.userId,\n email: data.email,\n credentialId: data.credentialId,\n credentialName: data.credentialName,\n ipAddress: data.ipAddress,\n userAgent: data.userAgent,\n };\n\n await this._createAuditLog({\n userId: data.userId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.USER_PASSKEY_REMOVED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n // ===============================\n // SCIM USER PROVISIONING AUDIT METHODS (H8)\n // ===============================\n\n /\n Log SCIM user provisioned (created)\n /\n public async logSCIMUserProvisioned(data: {\n organizationId: string;\n userId: string;\n email: string;\n isNewUser: boolean;\n provisionedVia: string;\n authSource?: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_SCIM_UserProvisionedEventData = {\n eventType: CoreAuditableEventType.SCIM_USER_PROVISIONED,\n organizationId: data.organizationId,\n userId: data.userId,\n email: data.email,\n isNewUser: data.isNewUser,\n provisionedVia: data.provisionedVia,\n authSource: data.authSource,\n };\n\n await this._createAuditLog({\n userId: data.userId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.SCIM_USER_PROVISIONED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n /\n Log SCIM user updated (replace or patch)\n /\n public async logSCIMUserUpdated(data: {\n organizationId: string;\n userId: string;\n operation: string;\n updatedAttributes?: string[];\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_SCIM_UserUpdatedEventData = {\n eventType: CoreAuditableEventType.SCIM_USER_UPDATED,\n organizationId: data.organizationId,\n userId: data.userId,\n operation: data.operation,\n updatedAttributes: data.updatedAttributes,\n };\n\n await this._createAuditLog({\n userId: data.userId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.LOW,\n eventType: CoreAuditableEventType.SCIM_USER_UPDATED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n /\n Log SCIM user deactivated (deleted/deactivated)\n /\n public async logSCIMUserDeactivated(data: {\n organizationId: string;\n userId: string;\n email?: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_SCIM_UserDeactivatedEventData = {\n eventType: CoreAuditableEventType.SCIM_USER_DEACTIVATED,\n organizationId: data.organizationId,\n userId: data.userId,\n email: data.email,\n };\n\n await this._createAuditLog({\n userId: data.userId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.SCIM_USER_DEACTIVATED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n // ===============================\n // Magic Link Events (Phase G2)\n // ===============================\n\n public async logMagicLinkSent(data: {\n email: string;\n ipAddress: string;\n userAgent: string;\n }): Promise<void> {\n const eventData: AuditableEvent_User_MagicLinkSentEventData = {\n eventType: CoreAuditableEventType.USER_MAGIC_LINK_SENT,\n ...data,\n };\n await this._createAuditLog({\n riskLevel: ResourceOperationRiskLevel.LOW,\n eventType: CoreAuditableEventType.USER_MAGIC_LINK_SENT,\n eventData: eventData as Record<string, any>,\n });\n }\n\n public async logMagicLinkVerified(data: {\n userId: string;\n email: string;\n sessionId: string;\n ipAddress: string;\n userAgent: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_User_MagicLinkVerifiedEventData = {\n eventType: CoreAuditableEventType.USER_MAGIC_LINK_VERIFIED,\n ...data,\n };\n await this._createAuditLog({\n userId: data.userId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.USER_MAGIC_LINK_VERIFIED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n public async logMagicLinkFailed(data: {\n email?: string;\n failureReason: string;\n ipAddress: string;\n userAgent: string;\n }): Promise<void> {\n const eventData: AuditableEvent_User_MagicLinkFailedEventData = {\n eventType: CoreAuditableEventType.USER_MAGIC_LINK_FAILED,\n ...data,\n };\n await this._createAuditLog({\n riskLevel: ResourceOperationRiskLevel.HIGH,\n eventType: CoreAuditableEventType.USER_MAGIC_LINK_FAILED,\n eventData: eventData as Record<string, any>,\n });\n }\n\n // ===============================\n // SMS OTP Events (Phase G2)\n // ===============================\n\n public async logSMSOTPSent(data: {\n phoneNumber: string;\n factorLevel: string;\n sessionId: string;\n ipAddress: string;\n userAgent: string;\n }): Promise<void> {\n const eventData: AuditableEvent_User_SMSOTPSentEventData = {\n eventType: CoreAuditableEventType.USER_SMS_OTP_SENT,\n ...data,\n };\n await this._createAuditLog({\n riskLevel: ResourceOperationRiskLevel.LOW,\n eventType: CoreAuditableEventType.USER_SMS_OTP_SENT,\n eventData: eventData as Record<string, any>,\n });\n }\n\n public async logSMSOTPVerified(data: {\n userId: string;\n phoneNumber: string;\n factorLevel: string;\n sessionId: string;\n ipAddress: string;\n userAgent: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_User_SMSOTPVerifiedEventData = {\n eventType: CoreAuditableEventType.USER_SMS_OTP_VERIFIED,\n ...data,\n };\n await this._createAuditLog({\n userId: data.userId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.USER_SMS_OTP_VERIFIED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n public async logSMSOTPFailed(data: {\n phoneNumber?: string;\n factorLevel: string;\n failureReason: string;\n sessionId: string;\n ipAddress: string;\n userAgent: string;\n }): Promise<void> {\n const eventData: AuditableEvent_User_SMSOTPFailedEventData = {\n eventType: CoreAuditableEventType.USER_SMS_OTP_FAILED,\n ...data,\n };\n await this._createAuditLog({\n riskLevel: ResourceOperationRiskLevel.HIGH,\n eventType: CoreAuditableEventType.USER_SMS_OTP_FAILED,\n eventData: eventData as Record<string, any>,\n });\n }\n\n // ===============================\n // Phone Verification Events (Phase G2)\n // ===============================\n\n public async logPhoneVerified(data: {\n userId: string;\n phoneNumber: string;\n ipAddress: string;\n userAgent: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_User_PhoneVerifiedEventData = {\n eventType: CoreAuditableEventType.USER_PHONE_VERIFIED,\n ...data,\n };\n await this._createAuditLog({\n userId: data.userId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.USER_PHONE_VERIFIED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n public async logPhoneVerificationFailed(data: {\n phoneNumber: string;\n failureReason: string;\n ipAddress: string;\n userAgent: string;\n }): Promise<void> {\n const eventData: AuditableEvent_User_PhoneVerificationFailedEventData = {\n eventType: CoreAuditableEventType.USER_PHONE_VERIFICATION_FAILED,\n ...data,\n };\n await this._createAuditLog({\n riskLevel: ResourceOperationRiskLevel.HIGH,\n eventType: CoreAuditableEventType.USER_PHONE_VERIFICATION_FAILED,\n eventData: eventData as Record<string, any>,\n });\n }\n\n // ===============================\n // OAuth2 Provider Restriction Events (Phase G3)\n // ===============================\n\n /\n Log OAuth2 provider blocked by scope-level restrictions.\n * Emitted at initiation (G3-M4) and callback (G3-M5) enforcement points.\n /\n public async logOAuth2ProviderBlocked(data: {\n email?: string;\n providerRef: string;\n scopeType: AuthScopeType;\n organizationId?: string;\n applicationId?: string;\n reason: string;\n ipAddress: string;\n userAgent: string;\n }): Promise<void> {\n const typedEventData: AuditableEvent_OAuth2ProviderBlockedEventData = {\n eventType: CoreAuditableEventType.OAUTH2_PROVIDER_BLOCKED,\n email: data.email,\n providerRef: data.providerRef,\n scopeType: data.scopeType,\n organizationId: data.organizationId,\n applicationId: data.applicationId,\n reason: data.reason,\n ipAddress: data.ipAddress,\n userAgent: data.userAgent,\n };\n await this._createAuditLog({\n organizationId: data.organizationId,\n applicationId: data.applicationId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.OAUTH2_PROVIDER_BLOCKED,\n eventData: typedEventData as Record<string, any>,\n });\n }\n\n // ===============================\n // METHOD MANAGEMENT AUDIT METHODS (#13f)\n // ===============================\n\n public async logUserPasswordChanged(data: {\n userId: string;\n ipAddress: string;\n userAgent: string;\n organizationId?: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n await this._createAuditLog({\n userId: data.userId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.USER_PASSWORD_CHANGED,\n eventData: { eventType: CoreAuditableEventType.USER_PASSWORD_CHANGED, userId: data.userId, ipAddress: data.ipAddress, userAgent: data.userAgent } as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n public async logUserPasswordSet(data: {\n userId: string;\n ipAddress: string;\n userAgent: string;\n organizationId?: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n await this._createAuditLog({\n userId: data.userId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.USER_PASSWORD_SET,\n eventData: { eventType: CoreAuditableEventType.USER_PASSWORD_SET, userId: data.userId, ipAddress: data.ipAddress, userAgent: data.userAgent } as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n public async logUserTOTPDisabled(data: {\n userId: string;\n ipAddress: string;\n userAgent: string;\n organizationId?: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n await this._createAuditLog({\n userId: data.userId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.USER_TOTP_DISABLED,\n eventData: { eventType: CoreAuditableEventType.USER_TOTP_DISABLED, userId: data.userId, ipAddress: data.ipAddress, userAgent: data.userAgent } as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n public async logUserIdentityLinkRemoved(data: {\n userId: string;\n linkId: string;\n providerRef: string;\n ipAddress: string;\n userAgent: string;\n organizationId?: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n await this._createAuditLog({\n userId: data.userId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.USER_IDENTITY_LINK_REMOVED,\n eventData: { eventType: CoreAuditableEventType.USER_IDENTITY_LINK_REMOVED, userId: data.userId, linkId: data.linkId, providerRef: data.providerRef, ipAddress: data.ipAddress, userAgent: data.userAgent } as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n // ===============================\n // SCIM TOKEN LIFECYCLE EVENTS (Phase H)\n // ===============================\n\n public async logSCIMTokenGenerated(data: {\n tokenId: string;\n displayName: string;\n organizationId: string;\n createdByUserId: string;\n }): Promise<void> {\n await this._createAuditLog({\n userId: data.createdByUserId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.SCIM_TOKEN_GENERATED,\n eventData: { eventType: CoreAuditableEventType.SCIM_TOKEN_GENERATED, ...data } as Record<string, any>,\n });\n }\n\n public async logSCIMTokenRevoked(data: {\n tokenId: string;\n displayName: string;\n organizationId: string;\n revokedByUserId: string;\n }): Promise<void> {\n await this._createAuditLog({\n userId: data.revokedByUserId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.SCIM_TOKEN_REVOKED,\n eventData: { eventType: CoreAuditableEventType.SCIM_TOKEN_REVOKED, ...data } as Record<string, any>,\n });\n }\n\n public async logSCIMTokenRotated(data: {\n newTokenId: string;\n oldTokenId: string;\n organizationId: string;\n rotatedByUserId: string;\n overlapHours: number;\n }): Promise<void> {\n await this._createAuditLog({\n userId: data.rotatedByUserId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.SCIM_TOKEN_ROTATED,\n eventData: { eventType: CoreAuditableEventType.SCIM_TOKEN_ROTATED, ...data } as Record<string, any>,\n });\n }\n\n public async logSCIMProvisioningConfigUpdated(data: {\n organizationId: string;\n updatedByUserId: string;\n changes: Record<string, unknown>;\n }): Promise<void> {\n await this._createAuditLog({\n userId: data.updatedByUserId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.LOW,\n eventType: CoreAuditableEventType.SCIM_PROVISIONING_CONFIG_UPDATED,\n eventData: { eventType: CoreAuditableEventType.SCIM_PROVISIONING_CONFIG_UPDATED, ...data } as Record<string, any>,\n });\n }\n\n public async logSCIMProvisioningFailed(data: {\n organizationId: string;\n operation: string;\n errorMessage: string;\n userId?: string;\n }): Promise<void> {\n await this._createAuditLog({\n userId: data.userId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.SCIM_PROVISIONING_FAILED,\n eventData: { eventType: CoreAuditableEventType.SCIM_PROVISIONING_FAILED, ...data } as Record<string, any>,\n });\n }\n\n // ===============================\n // SAML AUDIT METHODS (AUTH-2, D13/D19.4)\n // ===============================\n\n public async logSAMLEvent(\n eventType: CoreAuditableEventType,\n riskLevel: ResourceOperationRiskLevel,\n data: Record<string, unknown> & {\n organizationId?: string;\n applicationId?: string;\n userId?: string;\n },\n requestExecutionContext?: ExecutionContext<any>,\n routingOrgIds?: VerifiedOrgId[],\n ): Promise<void> {\n await this._createAuditLog({\n userId: data.userId,\n organizationId: data.organizationId,\n applicationId: data.applicationId,\n riskLevel,\n eventType,\n eventData: { eventType, ...data } as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n // ===============================\n // CROSS-FRONTEND HANDOFF AUDIT METHODS (cross-app-jwt-propagation Step 2)\n // ===============================\n\n /\n Log issuance of a cross-frontend session handoff token.\n \n This event records that an authenticated user obtained a one-time\n * AUTH_CODE_EXCHANGE token bound to a target frontend (browser-only).\n * The audit row records issuance only. Redeeming the code goes through the\n * generic `/auth/token/exchange` AUTH_CODE_EXCHANGE path, not the W7.3b\n * one-off-session exchange event. The `consumableTokenId` below is the\n * correlation anchor for ops without persisting the raw deep link (which can\n * carry org IDs, share codes, draft IDs, or one-off tokens forwarded as query\n * params).\n \n Hashing happens HERE (not at the call site) so all handoff audit rows use\n * the same SHA-256 computation. Callers MUST pass the validated `returnPath`,\n * never a pre-hashed value.\n \n Risk level: HIGH — issuance mints a transferable session credential. Treated\n * with the same severity as PASSWORD_RESET_COMPLETED + ONE_OFF_TOKEN_CREATED.\n /\n public async logUserCrossFrontendHandoffIssued(data: {\n userId: string;\n sourceFrontendServiceName?: string;\n targetServiceKey: string;\n /* Validated returnPath; helper hashes it with SHA-256 before persisting. */\n returnPath: string;\n consumableTokenId: string;\n ipAddress: string;\n userAgent: string;\n organizationId?: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const returnPathHash = createHash('sha256').update(data.returnPath).digest('hex');\n\n const eventData: AuditableEvent_User_CrossFrontendHandoffIssuedEventData = {\n eventType: CoreAuditableEventType.USER_CROSS_FRONTEND_HANDOFF_ISSUED,\n userId: data.userId,\n sourceFrontendServiceName: data.sourceFrontendServiceName,\n targetServiceKey: data.targetServiceKey,\n returnPathHash,\n consumableTokenId: data.consumableTokenId,\n ipAddress: data.ipAddress,\n userAgent: data.userAgent,\n };\n\n await this._createAuditLog({\n userId: data.userId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.HIGH,\n eventType: CoreAuditableEventType.USER_CROSS_FRONTEND_HANDOFF_ISSUED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n public async logGenericEvent(data: {\n userId?: string;\n organizationId?: string;\n riskLevel: ResourceOperationRiskLevel;\n eventType: CoreAuditableEventType \| string;\n eventData: Record<string, unknown>;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n await this._createAuditLog({\n userId: data.userId,\n organizationId: data.organizationId,\n riskLevel: data.riskLevel,\n eventType: data.eventType,\n eventData: { eventType: data.eventType, ...data.eventData } as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n}\n"]}
1	+ {"version":3,"file":"audit-logs.backend.service.js","sourceRoot":"","sources":["../../../../../src/compliance/audit-trails/services/audit-logs.backend.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAC3H,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAChK,OAAO,EAAE,kCAAkC,EAAE,MAAM,0CAA0C,CAAC;AAG9F,OAAO,EAAE,gCAAgC,EAAE,MAAM,sCAAsC,CAAC;AACxF,OAAO,EACL,2BAA2B,EAuG3B,sBAAsB,EAGtB,8BAA8B,EAG9B,0BAA0B,EAC1B,4BAA4B,EAC5B,oBAAoB,EAGpB,cAAc,EACd,qCAAqC,EACrC,wBAAwB,GAGzB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,2DAA2D,EAAE,uCAAuC,EAAE,MAAM,uBAAuB,CAAC;AACjN,OAAO,EACL,kCAAkC,EAClC,0CAA0C,EAC1C,yCAAyC,GAC1C,MAAM,qFAAqF,CAAC;AAC7F,OAAO,EAAE,cAAc,EAAE,MAAM,uEAAuE,CAAC;AAEvG,OAAO,EAAE,sBAAsB,EAAE,MAAM,+DAA+D,CAAC;AACvG,OAAO,EAAE,qCAAqC,EAAE,MAAM,+EAA+E,CAAC;AAmBtI;;;;;;;GAOG;AACH,MAAM,2CAA2C,GAAG,GAAG,CAAC;AAGjD,IAAM,uBAAuB,GAA7B,MAAM,uBAAuB;IAIoB;IACa;IACe;IACP;IACU;IACb;IAIE;IAZzD,QAAQ,CAA+D;IAExF,YACsD,MAAqB,EACR,YAAwC,EACzB,oBAA+D,EACtE,oBAAwD,EAC9C,uBAA8D,EAC3E,YAA2B,EAIzB,cAA+B;QATnD,WAAM,GAAN,MAAM,CAAe;QACR,iBAAY,GAAZ,YAAY,CAA4B;QACzB,yBAAoB,GAApB,oBAAoB,CAA2C;QACtE,yBAAoB,GAApB,oBAAoB,CAAoC;QAC9C,4BAAuB,GAAvB,uBAAuB,CAAuC;QAC3E,iBAAY,GAAZ,YAAY,CAAe;QAIzB,mBAAc,GAAd,cAAc,CAAiB;QAEvG,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,yBAAyB,CAAC,CAAC;QACnE,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,yBAAyB,EAAE,IAAI,CAAC,CAAC;IACnE,CAAC;IAED;;;;;;;;;OASG;IACK,KAAK,CAAC,wBAAwB;QACpC,MAAM,SAAS,GAAkD;YAC/D,kBAAkB,EAAE,gBAAgB,CAAC,UAAU;YAC/C,mBAAmB,EAAE,qBAAqB,CAAC,MAAM;YACjD,WAAW,EAAE,4BAA4B,CAAC,eAAe;YACzD,kBAAkB,EAAE,IAAI;SACzB,CAAC;QAEF,OAAO,IAAI,CAAC,uBAAuB,CAAC,0BAA0B,CAAC;YAC7D,SAAS;YACT,+BAA+B,EAAE,IAAI,GAAG,EAAE;YAC1C,YAAY,EAAE,IAAI;YAClB,cAAc,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,mBAAmB,EAAE,oBAAoB,CAAC,WAAW,EAAE,CAAC;SAC3H,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACI,KAAK,CAAC,QAAQ,CACnB,UAA8G,EAC9G,uBAA+C;QAE/C,OAAO,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,uBAAuB,CAAC,CAAC;IACnE,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,eAAe,CAC3B,UAA8G,EAC9G,uBAA+C,EAC/C,aAA+B;QAE/B,MAAM,cAAc,GAAG,2BAA2B,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACzE,6EAA6E;QAC7E,+EAA+E;QAC/E,8EAA8E;QAC9E,wEAAwE;QACxE,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;QAC7B,oGAAoG;QACpG,mGAAmG;QACnG,wGAAwG;QACxG,mGAAmG;QACnG,mGAAmG;QACnG,MAAM,YAAY,GAAG,sBAAsB,EAAE,CAAC;QAC9C,MAAM,aAAa,GAAG,uBAAuB,EAAE,aAAa,IAAI,YAAY,EAAE,aAAa,CAAC;QAC5F,MAAM,mBAAmB,GAAG,YAAY,EAAE,mBAAmB,CAAC;QAC9D,sFAAsF;QACtF,mGAAmG;QACnG,sGAAsG;QACtG,qGAAqG;QACrG,MAAM,gBAAgB,GAAG,YAAY,EAAE,gBAAgB,CAAC;QACxD,MAAM,YAAY,GAAG;YACnB,GAAG,UAAU;YACb,OAAO;YACP,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3C,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvD,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,SAAS,EAAE,UAAU,CAAC,SAAgC;YACtD,aAAa,EAAE,cAAc,CAAC,QAAQ;YACtC,QAAQ,EAAE,cAAc,CAAC,QAAQ;YACjC,SAAS,EAAE,IAAI,IAAI,EAAE;YACrB,SAAS,EAAE,IAAI,IAAI,EAAE;SACtB,CAAC;QAEF,8EAA8E;QAC9E,6EAA6E;QAC7E,+EAA+E;QAC/E,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,EAAE,CAAC;YACjD,MAAM,SAAS,GAAG,IAAI,CAAC,oBAAoB,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;YAC9F,6FAA6F;YAC7F,uFAAuF;YACvF,2FAA2F;YAC3F,yFAAyF;YACzF,8FAA8F;YAC9F,6FAA6F;YAC7F,6FAA6F;YAC7F,0FAA0F;YAC1F,+FAA+F;YAC/F,2FAA2F;YAC3F,6FAA6F;YAC7F,qFAAqF;YACrF,+FAA+F;YAC/F,8FAA8F;YAC9F,EAAE;YACF,4FAA4F;YAC5F,6FAA6F;YAC7F,8FAA8F;YAC9F,6FAA6F;YAC7F,8FAA8F;YAC9F,4FAA4F;YAC5F,wEAAwE;YACxE,oGAAoG;YACpG,qDAAqD;YACrD,MAAM,SAAS,CAAC,MAAM,CAAC,EAAE,EAAE,YAAY,EAAE;gBACvC,4BAA4B,EAAE,uCAAuC,CACnE,yBAAyB,EACzB,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EACzB,qBAAqB,CAAC,MAAM,CAC7B;aACF,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,sBAAsB,UAAU,CAAC,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC;YAEjG,sFAAsF;YACtF,2FAA2F;YAC3F,yFAAyF;YACzF,wFAAwF;YACxF,wFAAwF;YACxF,oEAAoE;YACpE,0FAA0F;YAC1F,yFAAyF;YACzF,yCAAyC;YACzC,wFAAwF;YACxF,yFAAyF;YACzF,gGAAgG;YAChG,6FAA6F;YAC7F,4FAA4F;YAC5F,2EAA2E;YAC3E,MAAM,KAAK,GAAG,uBAAuB,EAAE,YAAY,EAAE,cAAc,CAAC;YACpE,MAAM,WAAW,GAAa,aAAa,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACtE,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,IAAI,CAAC,aAAa,IAAI,KAAK,IAAI,UAAU,CAAC,cAAc,IAAI,UAAU,CAAC,cAAc,KAAK,KAAK,EAAE,CAAC;oBAChG,uFAAuF;oBACvF,oFAAoF;oBACpF,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,uIAAuI,EAAE;wBAC1J,SAAS,EAAE,UAAU,CAAC,SAAS;wBAC/B,kBAAkB,EAAE,UAAU,CAAC,cAAc;wBAC7C,2BAA2B,EAAE,KAAK;qBACnC,CAAC,CAAC;gBACL,CAAC;gBACD,wFAAwF;gBACxF,yFAAyF;gBACzF,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;oBAChC,IAAI,CAAC,oBAAoB,CAAC,gCAAgC,CAAC,EAAE,EAAE,YAAY,EAAE,KAAK,CAAC;yBAChF,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,mDAAmD,EAAE,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;gBAC5H,CAAC;YACH,CAAC;YACD,4FAA4F;YAC5F,yFAAyF;YACzF,0FAA0F;YAC1F,2FAA2F;YAC3F,6FAA6F;YAC7F,4FAA4F;YAC5F,+FAA+F;YAC/F,iCAAiC;QACnC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,sDAAsD;YACtD,EAAE;YACF,2FAA2F;YAC3F,qGAAqG;YACrG,2FAA2F;YAC3F,8FAA8F;YAC9F,2BAA2B;YAC3B,EAAE;YACF,kFAAkF;YAClF,0FAA0F;YAC1F,+FAA+F;YAC/F,oFAAoF;YACpF,wFAAwF;YACxF,8FAA8F;YAC9F,4DAA4D;YAC5D,EAAE;YACF,wGAAwG;YACxG,qDAAqD;YACrD,MAAM,UAAU,GAAG,UAAU,CAAC,SAAgD,CAAC;YAC/E,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,iDAAiD,EAAE;gBACrE,KAAK;gBACL,SAAS,EAAE,UAAU,CAAC,SAAS;gBAC/B,OAAO;gBACP,sBAAsB,EAAE,UAAU,EAAE,YAAY;gBAChD,oBAAoB,EAAE,UAAU,EAAE,UAAU;gBAC5C,6BAA6B,EAAE,UAAU,EAAE,mBAAmB;gBAC9D,oBAAoB,EAAE,UAAU,EAAE,UAAU;gBAC5C,+FAA+F;gBAC/F,wGAAwG;gBACxG,WAAW,EAAE,UAAU,CAAC,MAAM;gBAC9B,cAAc,EAAE,UAAU,CAAC,cAAc;gBACzC,aAAa,EAAE,UAAU,CAAC,aAAa;gBACvC,SAAS,EAAE,UAAU,CAAC,SAAS;aAChC,CAAC,CAAC;YACH,oFAAoF;YACpF,yFAAyF;YACzF,6FAA6F;YAC7F,+FAA+F;YAC/F,4FAA4F;YAC5F,gGAAgG;YAChG,uFAAuF;YACvF,IAAI,CAAC,cAAc,EAAE,uBAAuB,EAAE,CAAC;QACjD,CAAC;QAED,2EAA2E;QAC3E,+EAA+E;QAC/E,mEAAmE;QACnE,0EAA0E;QAC1E,6EAA6E;QAC7E,wEAAwE;QACxE,KAAK,IAAI,CAAC,YAAY,EAAE,gBAAgB,CAAC,YAAY,CAAC,CAAC;IACzD,CAAC;IAED,kCAAkC;IAClC,8CAA8C;IAC9C,kCAAkC;IAElC;;;;;;;;;;;;;;OAcG;IACH;;;;;;;;;;;;;;;OAeG;IACI,KAAK,CAAC,oBAAoB,CAAC,IASjC;QACC,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,IAAI;YAC1C,SAAS,EAAE,sBAAsB,CAAC,mBAAmB;YACrD,SAAS,EAAE;gBACT,SAAS,EAAE,sBAAsB,CAAC,mBAAmB;gBACrD,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;gBAC7C,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;gBACjD,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;gBACvC,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;gBACrD,8BAA8B,EAAE,IAAI,CAAC,8BAA8B;gBACnE,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxE;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;OAUG;IACI,KAAK,CAAC,uBAAuB,CAAC,IASpC;QACC,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,0BAA0B,CAAC,GAAG;YAClG,SAAS,EAAE,sBAAsB,CAAC,sBAAsB;YACxD,SAAS,EAAE;gBACT,SAAS,EAAE,sBAAsB,CAAC,sBAAsB;gBACxD,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,yBAAyB,EAAE,IAAI,CAAC,yBAAyB;gBACzD,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;gBACvC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxE;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;OAYG;IACI,KAAK,CAAC,qBAAqB,CAAC,IAMlC;QACC,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,0BAA0B,CAAC,MAAM;YAC5C,SAAS,EAAE,sBAAsB,CAAC,oBAAoB;YACtD,SAAS,EAAE;gBACT,SAAS,EAAE,sBAAsB,CAAC,oBAAoB;gBACtD,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1E,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;gBACzC,aAAa,EAAE,IAAI,CAAC,aAAa;aAClC;SACF,CAAC,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,sBAAsB,CAAC,IAqBnC;QACC,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,GAAG;YACzC,SAAS,EAAE,sBAAsB,CAAC,mBAAmB;YACrD,SAAS,EAAE;gBACT,SAAS,EAAE,sBAAsB,CAAC,mBAAmB;gBACrD,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;aACrB;SACzB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH;;;;;;;;;;;;;;;;;;;;OAoBG;IACH;;;;;;;;;;;;;OAaG;IACH;;;;;;;;;;;;;OAaG;IACI,KAAK,CAAC,+BAA+B,CAAC,IAc5C;QACC,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,wBAAwB,CAAC,MAAM,CAAC;QACtE,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,cAAc;YAC3B,cAAc,EAAE,IAAI,CAAC,oBAAoB;YACzC,SAAS,EAAE,UAAU,KAAK,wBAAwB,CAAC,gBAAgB;mBAC9D,IAAI,CAAC,kBAAkB,KAAK,qCAAqC,CAAC,qBAAqB;gBAC1F,CAAC,CAAC,0BAA0B,CAAC,IAAI;gBACjC,CAAC,CAAC,0BAA0B,CAAC,MAAM;YACrC,SAAS,EAAE,sBAAsB,CAAC,+BAA+B;YACjE,SAAS,EAAE;gBACT,SAAS,EAAE,sBAAsB,CAAC,+BAA+B;gBACjE,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,UAAU;gBACV,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;gBAC/C,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,eAAe,EAAE,IAAI,CAAC,eAAe;gBACrC,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;gBAC3C,eAAe,EAAE,IAAI,CAAC,eAAe;gBACrC,cAAc,EAAE,IAAI,CAAC,cAAc;aACb;SACzB,CAAC,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,kCAAkC,CAAC,IAc/C;QACC,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,cAAc;YAC3B,cAAc,EAAE,IAAI,CAAC,oBAAoB;YACzC,iFAAiF;YACjF,SAAS,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAC,CAAC,0BAA0B,CAAC,IAAI;YACvG,SAAS,EAAE,sBAAsB,CAAC,kCAAkC;YACpE,SAAS,EAAE;gBACT,SAAS,EAAE,sBAAsB,CAAC,kCAAkC;gBACpE,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;gBAC/C,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;gBAC7C,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;gBACzC,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;gBACjD,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;gBAC3C,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;gBACzC,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,aAAa,EAAE,IAAI,CAAC,aAAa;aACX;SACzB,CAAC,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,qBAAqB,CAAC,IAUlC;QACC,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,eAAe;YAC5B,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,IAAI;YAC1C,SAAS,EAAE,sBAAsB,CAAC,oBAAoB;YACtD,SAAS,EAAE;gBACT,SAAS,EAAE,sBAAsB,CAAC,oBAAoB;gBACtD,eAAe,EAAE,IAAI,CAAC,eAAe;gBACrC,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;gBAC7C,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;gBAC7C,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,SAAS,EAAE,IAAI,CAAC,SAAS;aACH;SACzB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACI,KAAK,CAAC,qBAAqB,CAAC,IAOlC;QACC,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,MAAM;YAC5C,SAAS,EAAE,sBAAsB,CAAC,oBAAoB;YACtD,SAAS,EAAE;gBACT,SAAS,EAAE,sBAAsB,CAAC,oBAAoB;gBACtD,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;aACrB;SACzB,CAAC,CAAC;IACL,CAAC;IAED,kCAAkC;IAClC,oCAAoC;IACpC,kCAAkC;IAElC;;OAEG;IACI,KAAK,CAAC,YAAY,CAAC,IAQzB,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,cAAc,GAAuC;YACzD,SAAS,EAAE,sBAAsB,CAAC,UAAU;YAC5C,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,GAAG;YACzC,SAAS,EAAE,sBAAsB,CAAC,UAAU;YAC5C,SAAS,EAAE,cAAqC,CAAC,wBAAwB;SAC1E,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,aAAa,CAAC,IAK1B;QACC,MAAM,SAAS,GAAwC;YACrD,SAAS,EAAE,sBAAsB,CAAC,WAAW;YAC7C,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,GAAG;YACzC,SAAS,EAAE,sBAAsB,CAAC,WAAW;YAC7C,SAAS,EAAE,SAAgC;SAC5C,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,kBAAkB,CAAC,IAS/B;QACC,mCAAmC;QACnC,MAAM,cAAc,GAA6C;YAC/D,SAAS,EAAE,sBAAsB,CAAC,iBAAiB;YACnD,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,SAAS,EAAE,6DAA6D;YAChF,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,MAAM;YAC5C,SAAS,EAAE,sBAAsB,CAAC,iBAAiB;YACnD,SAAS,EAAE,cAAqC,CAAC,wBAAwB;SAC1E,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,oBAAoB,CAAC,IAWjC,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAA+C;YAC5D,SAAS,EAAE,sBAAsB,CAAC,mBAAmB;YACrD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9D,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,IAAI;YAC1C,SAAS,EAAE,sBAAsB,CAAC,mBAAmB;YACrD,SAAS,EAAE,SAAS;SACrB,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED,kCAAkC;IAClC,uCAAuC;IACvC,kCAAkC;IAElC;;;;;;OAMG;IACI,KAAK,CAAC,qBAAqB,CAAC,IASlC,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAAgD;YAC7D,SAAS,EAAE,sBAAsB,CAAC,oBAAoB;YACtD,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;YAC7C,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,SAAS,EAAE,2CAA2C;YAC9D,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,GAAG;YACzC,SAAS,EAAE,sBAAsB,CAAC,oBAAoB;YACtD,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,oBAAoB,CAAC,IAUjC,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAA+C;YAC5D,SAAS,EAAE,sBAAsB,CAAC,mBAAmB;YACrD,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;YAC7C,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,SAAS;YACjB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,MAAM;YAC5C,SAAS,EAAE,sBAAsB,CAAC,mBAAmB;YACrD,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACI,KAAK,CAAC,gBAAgB,CAAC,IAW7B,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAA2C;YACxD,SAAS,EAAE,sBAAsB,CAAC,cAAc;YAChD,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;YAC7C,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,SAAS,EAAE,2CAA2C;YAC9D,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,GAAG;YACzC,SAAS,EAAE,sBAAsB,CAAC,cAAc;YAChD,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACI,gCAAgC,CACrC,IAAsB,EACtB,UAAgJ;QAEhJ,8FAA8F;QAC9F,6FAA6F;QAC7F,4FAA4F;QAC5F,qFAAqF;QACrF,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,KAAK,8BAA8B,CAAC,oBAAoB,CAAC;YAChG,MAAM,SAAS,GAAG,YAAY,IAAI,IAAI,CAAC,aAAa,KAAK,8BAA8B,CAAC,mBAAmB,CAAC;YAC5G,IAAI,CAAC,SAAS;gBAAE,OAAO,CAAC,wEAAwE;YAEhG,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,EAAE,iBAAiB,CAAC;YACxD,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,wFAAwF,EAAE;oBAC3G,aAAa,EAAE,IAAI,CAAC,aAAa;oBACjC,cAAc,EAAE,UAAU,CAAC,cAAc;iBAC1C,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,MAAM,OAAO,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,EAAE,aAAa,CAAC;YACpG,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAClE,MAAM,aAAa,GACjB,YAAY,IAAI,IAAI,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,cAA+B,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAEtH,KAAK,IAAI,CAAC,gBAAgB,CAAC;gBACzB,UAAU,EAAE,UAAU,CAAC,UAAU;gBACjC,YAAY,EAAE,UAAU,CAAC,YAAY;gBACrC,SAAS,EAAE,IAAI,CAAC,aAAa;gBAC7B,OAAO;gBACP,KAAK;gBACL,cAAc,EAAE,UAAU,CAAC,cAAc;gBACzC,kBAAkB,EAAE,UAAU,CAAC,kBAAkB;gBACjD,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;gBACnD,SAAS,EAAE,UAAU,CAAC,SAAS;gBAC/B,cAAc,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC,CAAC,SAAS;aAC7E,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,8CAA8C,EAAE;gBACpH,cAAc,EAAE,UAAU,CAAC,cAAc;gBACzC,GAAG,2BAA2B,CAAC,UAAU,CAAC;aAC3C,CAAC,CAAC,CAAC;QACN,CAAC;QAAC,OAAO,SAAS,EAAE,CAAC;YACnB,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,+DAA+D,EAAE;gBAClF,cAAc,EAAE,UAAU,CAAC,cAAc;gBACzC,GAAG,2BAA2B,CAAC,SAAS,CAAC;aAC1C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,kCAAkC;IAClC,2EAA2E;IAC3E,kCAAkC;IAClC,EAAE;IACF,4FAA4F;IAC5F,+FAA+F;IAC/F,6EAA6E;IAC7E,EAAE;IACF,kGAAkG;IAClG,qGAAqG;IACrG,kGAAkG;IAClG,qGAAqG;IACrG,kFAAkF;IAElF;;;;OAIG;IACI,KAAK,CAAC,4BAA4B,CAAC,IAQzC,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAAuD;YACpE,SAAS,EAAE,sBAAsB,CAAC,4BAA4B;YAC9D,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QACF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,MAAM;YAC5C,SAAS,EAAE,sBAAsB,CAAC,4BAA4B;YAC9D,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,sBAAsB,CAAC,IAQnC,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAAiD;YAC9D,SAAS,EAAE,sBAAsB,CAAC,qBAAqB;YACvD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QACF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,MAAM;YAC5C,SAAS,EAAE,sBAAsB,CAAC,qBAAqB;YACvD,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,qBAAqB,CAAC,IAOlC,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAAgD;YAC7D,SAAS,EAAE,sBAAsB,CAAC,oBAAoB;YACtD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QACF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,GAAG;YACzC,SAAS,EAAE,sBAAsB,CAAC,oBAAoB;YACtD,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,6BAA6B,CAAC,IAO1C,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAAwD;YACrE,SAAS,EAAE,sBAAsB,CAAC,6BAA6B;YAC/D,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC;QACF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,MAAM;YAC5C,SAAS,EAAE,sBAAsB,CAAC,6BAA6B;YAC/D,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED;;;;;;;;;;OAUG;IACI,KAAK,CAAC,oBAAoB,CAAC,IAIjC,EAAE,uBAA+C;QAChD,MAAM,SAAS,GAAoD;YACjE,SAAS,EAAE,sBAAsB,CAAC,yBAAyB;YAC3D,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC;QACF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,SAAS,EAAE,0BAA0B,CAAC,IAAI;YAC1C,SAAS,EAAE,sBAAsB,CAAC,yBAAyB;YAC3D,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;;;;;;;OAWG;IACI,KAAK,CAAC,0BAA0B,CAAC,IAMvC,EAAE,uBAA+C;QAChD,MAAM,SAAS,GAA0D;YACvE,SAAS,EAAE,sBAAsB,CAAC,+BAA+B;YACjE,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,oGAAoG;YACpG,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;YACnD,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QACF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,SAAS,EAAE,0BAA0B,CAAC,IAAI;YAC1C,SAAS,EAAE,sBAAsB,CAAC,+BAA+B;YACjE,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,CAAC,CAAC;IAC9B,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,sBAAsB,CAAC,IAMnC,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAAiD;YAC9D,SAAS,EAAE,sBAAsB,CAAC,qBAAqB;YACvD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;YAC7C,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QACF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,GAAG;YACzC,SAAS,EAAE,sBAAsB,CAAC,qBAAqB;YACvD,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,oBAAoB,CAAC,IAMjC,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAA+C;YAC5D,SAAS,EAAE,sBAAsB,CAAC,mBAAmB;YACrD,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;YAC7C,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QACF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,SAAS;YACjB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,GAAG;YACzC,SAAS,EAAE,sBAAsB,CAAC,mBAAmB;YACrD,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,yBAAyB,CAAC,IAQtC,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAAoD;YACjE,SAAS,EAAE,sBAAsB,CAAC,yBAAyB;YAC3D,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,6BAA6B,EAAE,IAAI,CAAC,6BAA6B;YACjE,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QACF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,GAAG;YACzC,SAAS,EAAE,sBAAsB,CAAC,yBAAyB;YAC3D,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,0BAA0B,CAAC,IAOvC,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAAqD;YAClE,SAAS,EAAE,sBAAsB,CAAC,0BAA0B;YAC5D,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QACF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,MAAM;YAC5C,SAAS,EAAE,sBAAsB,CAAC,0BAA0B;YAC5D,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,+BAA+B,CAAC,IAO5C,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAA0D;YACvE,SAAS,EAAE,sBAAsB,CAAC,+BAA+B;YACjE,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;YAC7C,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QACF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,+FAA+F;YAC/F,MAAM,EAAE,IAAI,CAAC,mBAAmB;YAChC,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,IAAI;YAC1C,SAAS,EAAE,sBAAsB,CAAC,+BAA+B;YACjE,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,gCAAgC,CAAC,IAO7C,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAA2D;YACxE,SAAS,EAAE,sBAAsB,CAAC,iCAAiC;YACnE,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QACF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,IAAI;YAC1C,SAAS,EAAE,sBAAsB,CAAC,iCAAiC;YACnE,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED,kCAAkC;IAClC,6BAA6B;IAC7B,kCAAkC;IAElC;;;;;;;;;;;;;;;;OAgBG;IACI,KAAK,CAAC,cAAc,CAAC,IAY3B,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAAyC;YACtD,SAAS,EAAE,sBAAsB,CAAC,YAAY;YAC9C,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;YAC7C,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,2BAA2B,EAAE,IAAI,CAAC,2BAA2B;YAC7D,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;SAC9C,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,MAAM,EAAE,8BAA8B;YAC5E,SAAS,EAAE,sBAAsB,CAAC,YAAY;YAC9C,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACI,KAAK,CAAC,6BAA6B,CACxC,IAQC,EACD,uBAA+C;QAE/C,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,cAAc,EAAE,aAAa,EAAE,GAAG,WAAW,EAAE,GAAG,IAAI,CAAC;QAEvF,MAAM,SAAS,GAAwD;YACrE,SAAS,EAAE,sBAAsB,CAAC,4BAA4B;YAC9D,GAAG,WAAW;SACf,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,WAAW;YACnB,cAAc;YACd,aAAa;YACb,SAAS;YACT,SAAS,EAAE,sBAAsB,CAAC,4BAA4B;YAC9D,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;;;;;OASG;IACI,KAAK,CAAC,0BAA0B,CACrC,IAIC,EACD,uBAA+C;QAE/C,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,GAAG,WAAW,EAAE,GAAG,IAAI,CAAC;QAE5D,MAAM,SAAS,GAAqD;YAClE,SAAS,EAAE,sBAAsB,CAAC,yBAAyB;YAC3D,GAAG,WAAW;SACf,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,WAAW;YACnB,aAAa;YACb,SAAS,EAAE,0BAA0B,CAAC,GAAG;YACzC,SAAS,EAAE,sBAAsB,CAAC,yBAAyB;YAC3D,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;;;;;;;;;OAaG;IACI,KAAK,CAAC,2BAA2B,CACtC,IAA0E,EAC1E,uBAA+C;QAE/C,MAAM,SAAS,GAAsD;YACnE,SAAS,EAAE,sBAAsB,CAAC,4BAA4B;YAC9D,GAAG,IAAI;SACR,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,eAAe;YAC5B,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,GAAG;YACzC,SAAS,EAAE,sBAAsB,CAAC,4BAA4B;YAC9D,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACI,KAAK,CAAC,wBAAwB,CACnC,IAAuE,EACvE,uBAA+C;QAE/C,MAAM,SAAS,GAAmD;YAChE,SAAS,EAAE,sBAAsB,CAAC,uBAAuB;YACzD,GAAG,IAAI;SACR,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,eAAe;YAC5B,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,IAAI,CAAC,cAAc,KAAK,gCAAgC,CAAC,KAAK;gBACvE,CAAC,CAAC,0BAA0B,CAAC,MAAM;gBACnC,CAAC,CAAC,0BAA0B,CAAC,GAAG;YAClC,SAAS,EAAE,sBAAsB,CAAC,uBAAuB;YACzD,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACI,KAAK,CAAC,cAAc,CACzB,IAA6D,EAC7D,uBAA+C;QAE/C,MAAM,SAAS,GAAyC;YACtD,SAAS,EAAE,sBAAsB,CAAC,aAAa;YAC/C,GAAG,IAAI;SACR,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,eAAe;YAC5B,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,IAAI,CAAC,OAAO,KAAK,cAAc,CAAC,cAAc;gBACvD,CAAC,CAAC,0BAA0B,CAAC,MAAM;gBACnC,CAAC,CAAC,0BAA0B,CAAC,GAAG;YAClC,SAAS,EAAE,sBAAsB,CAAC,aAAa;YAC/C,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACI,KAAK,CAAC,4BAA4B,CACvC,IAA2E,EAC3E,uBAA+C;QAE/C,MAAM,SAAS,GAAuD;YACpE,SAAS,EAAE,sBAAsB,CAAC,4BAA4B;YAC9D,GAAG,IAAI;SACR,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,cAAc;YAC3B,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,IAAI;YAC1C,SAAS,EAAE,sBAAsB,CAAC,4BAA4B;YAC9D,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;;;;;;;;OAYG;IACI,KAAK,CAAC,yBAAyB,CACpC,IAAwE,EACxE,uBAA+C;QAE/C,MAAM,SAAS,GAAoD;YACjE,SAAS,EAAE,sBAAsB,CAAC,yBAAyB;YAC3D,GAAG,IAAI;SACR,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,MAAM;YAC5C,SAAS,EAAE,sBAAsB,CAAC,yBAAyB;YAC3D,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;;;;;;;OAWG;IACI,KAAK,CAAC,gCAAgC,CAC3C,IAA+E,EAC/E,uBAA+C;QAE/C,MAAM,SAAS,GAA2D;YACxE,SAAS,EAAE,sBAAsB,CAAC,iCAAiC;YACnE,GAAG,IAAI;SACR,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,IAAI;YAC1C,SAAS,EAAE,sBAAsB,CAAC,iCAAiC;YACnE,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACI,KAAK,CAAC,0BAA0B,CACrC,IAQC,EACD,uBAA+C;QAE/C,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,cAAc,EAAE,aAAa,EAAE,GAAG,WAAW,EAAE,GAAG,IAAI,CAAC;QAEvF,MAAM,SAAS,GAAqD;YAClE,SAAS,EAAE,sBAAsB,CAAC,yBAAyB;YAC3D,GAAG,WAAW;SACf,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,WAAW;YACnB,cAAc;YACd,aAAa;YACb,SAAS;YACT,SAAS,EAAE,sBAAsB,CAAC,yBAAyB;YAC3D,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,CAAC,CAAC;IAC9B,CAAC;IAED,kCAAkC;IAClC,6CAA6C;IAC7C,kCAAkC;IAElC;;OAEG;IACI,KAAK,CAAC,eAAe,CAAC,IAY5B,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAA0C;YACvD,SAAS,EAAE,sBAAsB,CAAC,cAAc;YAChD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;YACzC,SAAS,EAAE,sBAAsB,CAAC,cAAc;YAChD,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,qBAAqB,CAAC,IAWlC;QACC,MAAM,SAAS,GAAgD;YAC7D,SAAS,EAAE,sBAAsB,CAAC,qBAAqB;YACvD,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,SAAS;YACjB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,SAAS,EAAE,0BAA0B,CAAC,MAAM;YAC5C,SAAS,EAAE,sBAAsB,CAAC,qBAAqB;YACvD,SAAS,EAAE,SAAgC;SAC5C,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,4BAA4B,CAAC,IAQzC;QACC,MAAM,SAAS,GAAuD;YACpE,SAAS,EAAE,sBAAsB,CAAC,4BAA4B;YAC9D,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;YACrD,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,SAAS;YACjB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,IAAI;YAC1C,SAAS,EAAE,sBAAsB,CAAC,4BAA4B;YAC9D,SAAS,EAAE,SAAgC;SAC5C,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,qBAAqB,CAAC,IAMlC,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAAgD;YAC7D,SAAS,EAAE,sBAAsB,CAAC,oBAAoB;YACtD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,GAAG;YACzC,SAAS,EAAE,sBAAsB,CAAC,oBAAoB;YACtD,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACI,KAAK,CAAC,qCAAqC,CAAC,IAKlD,EAAE,uBAA+C;QAChD,MAAM,SAAS,GAAgE;YAC7E,SAAS,EAAE,sBAAsB,CAAC,sCAAsC;YACxE,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;YACjD,6BAA6B,EAAE,IAAI,CAAC,6BAA6B;YACjE,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,cAAc,EAAE,IAAI,CAAC,cAAc;SACpC,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,SAAS,EAAE,0BAA0B,CAAC,QAAQ;YAC9C,SAAS,EAAE,sBAAsB,CAAC,sCAAsC;YACxE,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACI,KAAK,CAAC,iCAAiC,CAAC,IAQ9C,EAAE,uBAA+C;QAChD,MAAM,SAAS,GAA4D;YACzE,SAAS,EAAE,sBAAsB,CAAC,iCAAiC;YACnE,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;YACjD,8FAA8F;YAC9F,+FAA+F;YAC/F,4BAA4B;YAC5B,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7E,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,IAAI,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtF,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjF,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,SAAS,EAAE,0BAA0B,CAAC,QAAQ;YAC9C,SAAS,EAAE,sBAAsB,CAAC,iCAAiC;YACnE,SAAS,EAAE,SAAgC;YAC3C,cAAc,EAAE,IAAI,CAAC,cAAc;SACpC,EAAE,uBAAuB,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACI,KAAK,CAAC,sBAAsB,CAAC,IAQnC,EAAE,uBAA+C;QAChD,MAAM,SAAS,GAAiD;YAC9D,SAAS,EAAE,sBAAsB,CAAC,sBAAsB;YACxD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,SAAS;YACtB,SAAS,EAAE,0BAA0B,CAAC,IAAI;YAC1C,SAAS,EAAE,sBAAsB,CAAC,sBAAsB;YACxD,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACI,KAAK,CAAC,iCAAiC,CAAC,IAS9C,EAAE,uBAA+C;QAChD,MAAM,SAAS,GAA2D;YACxE,SAAS,EAAE,sBAAsB,CAAC,gCAAgC;YAClE,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,SAAS;YACtB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,IAAI;YAC1C,SAAS,EAAE,sBAAsB,CAAC,gCAAgC;YAClE,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;;;;;;;;;OAaG;IACI,KAAK,CAAC,oCAAoC,CAAC,IAUjD,EAAE,uBAA+C;QAChD,MAAM,SAAS,GAA+D;YAC5E,SAAS,EAAE,sBAAsB,CAAC,qCAAqC;YACvE,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,SAAS;YACtB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,IAAI;YAC1C,SAAS,EAAE,sBAAsB,CAAC,qCAAqC;YACvE,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACI,KAAK,CAAC,gCAAgC,CAAC,IAO7C,EAAE,uBAA+C;QAChD,MAAM,SAAS,GAA2D;YACxE,SAAS,EAAE,sBAAsB,CAAC,gCAAgC;YAClE,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,SAAS;YACtB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,IAAI;YAC1C,SAAS,EAAE,sBAAsB,CAAC,gCAAgC;YAClE,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;IACI,KAAK,CAAC,4BAA4B,CAAC,IAWzC,EAAE,uBAA+C;QAChD,MAAM,SAAS,GAAuD;YACpE,SAAS,EAAE,sBAAsB,CAAC,2BAA2B;YAC7D,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;YACnD,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,SAAS;YACtB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,IAAI;YAC1C,SAAS,EAAE,sBAAsB,CAAC,2BAA2B;YAC7D,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACI,KAAK,CAAC,cAAc,CAAC,IAK3B,EAAE,uBAA+C;QAChD,MAAM,SAAS,GAAyC;YACtD,SAAS,EAAE,sBAAsB,CAAC,YAAY;YAC9C,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,SAAS;YACtB,SAAS,EAAE,0BAA0B,CAAC,QAAQ;YAC9C,SAAS,EAAE,sBAAsB,CAAC,YAAY;YAC9C,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAsCG;IACI,KAAK,CAAC,sBAAsB,CAAC,IAMnC,EAAE,uBAA+C;QAChD,MAAM,SAAS,GAAiD;YAC9D,SAAS,EAAE,sBAAsB,CAAC,oBAAoB;YACtD,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,SAAS;YACtB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,QAAQ;YAC9C,SAAS,EAAE,sBAAsB,CAAC,oBAAoB;YACtD,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;;;;OAQG;IACI,KAAK,CAAC,gCAAgC,CAAC,IAQ7C,EAAE,uBAA+C;QAChD,MAAM,SAAS,GAA2D;YACxE,SAAS,EAAE,sBAAsB,CAAC,+BAA+B;YACjE,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,WAAW;YACxB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,QAAQ;YAC9C,SAAS,EAAE,sBAAsB,CAAC,+BAA+B;YACjE,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;;;;OAQG;IACI,KAAK,CAAC,uBAAuB,CAAC,IAQpC,EAAE,uBAA+C;QAChD,MAAM,SAAS,GAAkD;YAC/D,SAAS,EAAE,sBAAsB,CAAC,qBAAqB;YACvD,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;YACnD,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,UAAU;YACvB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,IAAI;YAC1C,SAAS,EAAE,sBAAsB,CAAC,qBAAqB;YACvD,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;;;;OAQG;IACI,KAAK,CAAC,wBAAwB,CAAC,IASrC,EAAE,uBAA+C;QAChD,MAAM,SAAS,GAAmD;YAChE,SAAS,EAAE,sBAAsB,CAAC,sBAAsB;YACxD,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;SAChD,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,WAAW;YACxB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,QAAQ;YAC9C,SAAS,EAAE,sBAAsB,CAAC,sBAAsB;YACxD,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACI,KAAK,CAAC,+BAA+B,CAAC,IAK5C;QACC,MAAM,SAAS,GAA0D;YACvE,SAAS,EAAE,sBAAsB,CAAC,+BAA+B;YACjE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC;QAEF;;;;;;;;;;;;;;;;;;;WAmBG;QACH,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,SAAS,EAAE,0BAA0B,CAAC,MAAM;YAC5C,SAAS,EAAE,sBAAsB,CAAC,+BAA+B;YACjE,SAAS,EAAE,SAAgC;SAC5C,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACI,KAAK,CAAC,wCAAwC,CAAC,IAErD;QACC,IAAI,CAAC;YACH,4FAA4F;YAC5F,yFAAyF;YACzF,MAAM,eAAe,GAAG,kCAAkC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC3E,MAAM,aAAa,GAAG,0CAA0C,CAAC,eAAe,CAAC,CAAC;YAClF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,yCAAyC,EAAE,CAAC;YAErE,IAAI,KAAK,IAAI,KAAK,CAAC,cAAc,KAAK,aAAa,EAAE,CAAC;gBACpD,4FAA4F;gBAC5F,OAAO;YACT,CAAC;YAED,MAAM,MAAM,GAAG,KAAK,EAAE,KAAK,IAAI,IAAI,CAAC;YACpC,MAAM,gBAAgB,GAAG,yCAAyC,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;YAE5F,MAAM,IAAI,CAAC,+BAA+B,CAAC;gBACzC,gBAAgB;gBAChB,cAAc,EAAE,aAAa;gBAC7B,MAAM;gBACN,KAAK,EAAE,eAAe;aACvB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,wFAAwF;YACxF,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,+DAA+D,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAClG,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACK,KAAK,CAAC,yCAAyC;QACrD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,EAAE,CAAC;QACjD,MAAM,SAAS,GAAG,IAAI,CAAC,oBAAoB,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAC9F,6FAA6F;QAC7F,+FAA+F;QAC/F,MAAM,WAAW,GAAkE;YACjF,IAAI,EAAE,CAAC;YACP,KAAK,EAAE,CAAC;YACR,IAAI,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE;SACxB,CAAC;QACF,MAAM,MAAM,GAAG,CAAC,MAAM,SAAS,CAAC,IAAI,CAClC,EAAE,EACF,EAAE,SAAS,EAAE,sBAAsB,CAAC,+BAA+B,EAAE,EACrE,EAAE,SAAS,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,WAAW,EAAE,CAChE,CAAyD,CAAC;QAE3D,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,2DAA2D,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACpG,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7C,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACI,KAAK,CAAC,oCAAoC,CAAC,IAYjD,EAAE,uBAA+C;QAChD,MAAM,SAAS,GAA+D;YAC5E,SAAS,EAAE,sBAAsB,CAAC,oCAAoC;YACtE,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;YAC7C,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,GAAG,CAAC,IAAI,CAAC,uBAAuB;gBAC9B,CAAC,CAAC,EAAE,uBAAuB,EAAE,IAAI,CAAC,uBAAuB,CAAC,WAAW,EAAE,EAAE;gBACzE,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,IAAI,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtF,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,WAAW;YACxB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,IAAI,CAAC,aAAa;gBAC3B,CAAC,CAAC,0BAA0B,CAAC,IAAI;gBACjC,CAAC,CAAC,0BAA0B,CAAC,MAAM;YACrC,SAAS,EAAE,sBAAsB,CAAC,oCAAoC;YACtE,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;;;;OAQG;IACI,KAAK,CAAC,wBAAwB,CAAC,IAQrC,EAAE,uBAA+C;QAChD,MAAM,SAAS,GAAmD;YAChE,SAAS,EAAE,sBAAsB,CAAC,sBAAsB;YACxD,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;YACnD,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,WAAW;YACxB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,IAAI;YAC1C,SAAS,EAAE,sBAAsB,CAAC,sBAAsB;YACxD,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,CAAC,CAAC;IAC9B,CAAC;IAED,kCAAkC;IAClC,2DAA2D;IAC3D,kCAAkC;IAElC;;OAEG;IACI,KAAK,CAAC,sCAAsC,CAAC,IAMnD;QACC,MAAM,SAAS,GAAiE;YAC9E,SAAS,EAAE,sBAAsB,CAAC,sCAAsC;YACxE,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;YAC7C,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,SAAS;YACtB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,MAAM;YAC5C,SAAS,EAAE,sBAAsB,CAAC,sCAAsC;YACxE,SAAS,EAAE,SAAgC;SAC5C,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,mCAAmC,CAAC,IAMhD;QACC,MAAM,SAAS,GAA8D;YAC3E,SAAS,EAAE,sBAAsB,CAAC,mCAAmC;YACrE,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;SAClD,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,SAAS;YACtB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,GAAG;YACzC,SAAS,EAAE,sBAAsB,CAAC,mCAAmC;YACrE,SAAS,EAAE,SAAgC;SAC5C,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACI,KAAK,CAAC,sBAAsB,CAAC,IAUnC;QACC,MAAM,SAAS,GAAiD;YAC9D,SAAS,EAAE,sBAAsB,CAAC,qBAAqB;YACvD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;YAC1C,SAAS,EAAE,sBAAsB,CAAC,qBAAqB;YACvD,SAAS,EAAE,SAAgC;SAC5C,CAAC,CAAC;IACL,CAAC;IAED,kCAAkC;IAClC,oCAAoC;IACpC,kCAAkC;IAElC;;OAEG;IACI,KAAK,CAAC,6BAA6B,CAAC,IAK1C;QACC,MAAM,SAAS,GAAwD;YACrE,SAAS,EAAE,sBAAsB,CAAC,6BAA6B;YAC/D,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,SAAS;YACjB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,GAAG;YACzC,SAAS,EAAE,sBAAsB,CAAC,6BAA6B;YAC/D,SAAS,EAAE,SAAgC;SAC5C,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,6BAA6B,CAAC,IAK1C,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAAwD;YACrE,SAAS,EAAE,sBAAsB,CAAC,6BAA6B;YAC/D,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,MAAM;YAC5C,SAAS,EAAE,sBAAsB,CAAC,6BAA6B;YAC/D,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACI,KAAK,CAAC,0BAA0B,CAAC,IAUvC,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAAqD;YAClE,SAAS,EAAE,sBAAsB,CAAC,0BAA0B;YAC5D,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,YAAY;YACzB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,IAAI;YAC1C,SAAS,EAAE,sBAAsB,CAAC,0BAA0B;YAC5D,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED,kCAAkC;IAClC,iDAAiD;IACjD,kCAAkC;IAElC;;OAEG;IACI,KAAK,CAAC,iBAAiB,CAAC,IAM9B,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAA4C;YACzD,SAAS,EAAE,sBAAsB,CAAC,eAAe;YACjD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,GAAG;YACzC,SAAS,EAAE,sBAAsB,CAAC,eAAe;YACjD,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,oBAAoB,CAAC,IAMjC,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAA+C;YAC5D,SAAS,EAAE,sBAAsB,CAAC,mBAAmB;YACrD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,GAAG;YACzC,SAAS,EAAE,sBAAsB,CAAC,mBAAmB;YACrD,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAEM,KAAK,CAAC,8BAA8B,CAAC,IAK3C;QACC,MAAM,SAAS,GAAyD;YACtE,SAAS,EAAE,sBAAsB,CAAC,8BAA8B;YAChE,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,0BAA0B,CAAC,GAAG;YACzC,SAAS,EAAE,sBAAsB,CAAC,8BAA8B;YAChE,SAAS,EAAE,SAAgC;SAC5C,CAAC,CAAC;IACL,CAAC;IAED,kCAAkC;IAClC,mCAAmC;IACnC,kCAAkC;IAElC;;OAEG;IACI,KAAK,CAAC,sBAAsB,CAAC,IAMnC,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAAiD;YAC9D,SAAS,EAAE,sBAAsB,CAAC,sBAAsB;YACxD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,GAAG;YACzC,SAAS,EAAE,sBAAsB,CAAC,sBAAsB;YACxD,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,wBAAwB,CAAC,IAMrC,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAAmD;YAChE,SAAS,EAAE,sBAAsB,CAAC,wBAAwB;YAC1D,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,MAAM;YAC5C,SAAS,EAAE,sBAAsB,CAAC,wBAAwB;YAC1D,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,sBAAsB,CAAC,IAMnC;QACC,MAAM,SAAS,GAAiD;YAC9D,SAAS,EAAE,sBAAsB,CAAC,uBAAuB;YACzD,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,SAAS;YACjB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,GAAG;YACzC,SAAS,EAAE,sBAAsB,CAAC,uBAAuB;YACzD,SAAS,EAAE,SAAgC;SAC5C,CAAC,CAAC;IACL,CAAC;IAED,kCAAkC;IAClC,4CAA4C;IAC5C,kCAAkC;IAElC;;OAEG;IACI,KAAK,CAAC,wBAAwB,CAAC,IASrC,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAAmD;YAChE,SAAS,EAAE,sBAAsB,CAAC,uBAAuB;YACzD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,MAAM;YAC5C,SAAS,EAAE,sBAAsB,CAAC,uBAAuB;YACzD,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,yBAAyB,CAAC,IAQtC,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAAoD;YACjE,SAAS,EAAE,sBAAsB,CAAC,mCAAmC;YACrE,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,GAAG;YACzC,SAAS,EAAE,sBAAsB,CAAC,mCAAmC;YACrE,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,yBAAyB,CAAC,IAOtC;QACC,MAAM,SAAS,GAAoD;YACjE,SAAS,EAAE,sBAAsB,CAAC,mCAAmC;YACrE,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,SAAS;YACjB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,MAAM;YAC5C,SAAS,EAAE,sBAAsB,CAAC,mCAAmC;YACrE,SAAS,EAAE,SAAgC;SAC5C,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACI,KAAK,CAAC,4BAA4B,CAAC,IAYzC,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAAuD;YACpE,SAAS,EAAE,sBAAsB,CAAC,4BAA4B;YAC9D,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,IAAI;YAC1C,SAAS,EAAE,sBAAsB,CAAC,4BAA4B;YAC9D,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED;;;;;;;OAOG;IACI,KAAK,CAAC,sBAAsB,CAAC,IASnC,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAAiD;YAC9D,SAAS,EAAE,sBAAsB,CAAC,qBAAqB;YACvD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3D,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3D,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,IAAI;YAC1C,SAAS,EAAE,sBAAsB,CAAC,qBAAqB;YACvD,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED;;;;;;;OAOG;IACI,KAAK,CAAC,wBAAwB,CAAC,IASrC,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,eAAe,GAAG,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC,EAAE,2CAA2C,CAAC,CAAC;QAClG,MAAM,SAAS,GAAmD;YAChE,SAAS,EAAE,sBAAsB,CAAC,wBAAwB;YAC1D,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3D,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,MAAM;YAC5C,SAAS,EAAE,sBAAsB,CAAC,wBAAwB;YAC1D,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,qBAAqB,CAAC,IAQlC,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAAgD;YAC7D,SAAS,EAAE,sBAAsB,CAAC,oBAAoB;YACtD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,MAAM;YAC5C,SAAS,EAAE,sBAAsB,CAAC,oBAAoB;YACtD,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED,kCAAkC;IAClC,4CAA4C;IAC5C,kCAAkC;IAElC;;OAEG;IACI,KAAK,CAAC,sBAAsB,CAAC,IAOnC,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAAiD;YAC9D,SAAS,EAAE,sBAAsB,CAAC,qBAAqB;YACvD,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,MAAM;YAC5C,SAAS,EAAE,sBAAsB,CAAC,qBAAqB;YACvD,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,kBAAkB,CAAC,IAK/B,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAA6C;YAC1D,SAAS,EAAE,sBAAsB,CAAC,iBAAiB;YACnD,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;SAC1C,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,GAAG;YACzC,SAAS,EAAE,sBAAsB,CAAC,iBAAiB;YACnD,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,sBAAsB,CAAC,IAInC,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAAiD;YAC9D,SAAS,EAAE,sBAAsB,CAAC,qBAAqB;YACvD,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,MAAM;YAC5C,SAAS,EAAE,sBAAsB,CAAC,qBAAqB;YACvD,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED,kCAAkC;IAClC,+BAA+B;IAC/B,kCAAkC;IAE3B,KAAK,CAAC,gBAAgB,CAAC,IAI7B;QACC,MAAM,SAAS,GAA+C;YAC5D,SAAS,EAAE,sBAAsB,CAAC,oBAAoB;YACtD,GAAG,IAAI;SACR,CAAC;QACF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,SAAS,EAAE,0BAA0B,CAAC,GAAG;YACzC,SAAS,EAAE,sBAAsB,CAAC,oBAAoB;YACtD,SAAS,EAAE,SAAgC;SAC5C,CAAC,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,oBAAoB,CAAC,IAMjC,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAAmD;YAChE,SAAS,EAAE,sBAAsB,CAAC,wBAAwB;YAC1D,GAAG,IAAI;SACR,CAAC;QACF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,0BAA0B,CAAC,MAAM;YAC5C,SAAS,EAAE,sBAAsB,CAAC,wBAAwB;YAC1D,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAEM,KAAK,CAAC,kBAAkB,CAAC,IAK/B;QACC,MAAM,SAAS,GAAiD;YAC9D,SAAS,EAAE,sBAAsB,CAAC,sBAAsB;YACxD,GAAG,IAAI;SACR,CAAC;QACF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,SAAS,EAAE,0BAA0B,CAAC,IAAI;YAC1C,SAAS,EAAE,sBAAsB,CAAC,sBAAsB;YACxD,SAAS,EAAE,SAAgC;SAC5C,CAAC,CAAC;IACL,CAAC;IAED,kCAAkC;IAClC,4BAA4B;IAC5B,kCAAkC;IAE3B,KAAK,CAAC,aAAa,CAAC,IAM1B;QACC,MAAM,SAAS,GAA4C;YACzD,SAAS,EAAE,sBAAsB,CAAC,iBAAiB;YACnD,GAAG,IAAI;SACR,CAAC;QACF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,SAAS,EAAE,0BAA0B,CAAC,GAAG;YACzC,SAAS,EAAE,sBAAsB,CAAC,iBAAiB;YACnD,SAAS,EAAE,SAAgC;SAC5C,CAAC,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,iBAAiB,CAAC,IAO9B,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAAgD;YAC7D,SAAS,EAAE,sBAAsB,CAAC,qBAAqB;YACvD,GAAG,IAAI;SACR,CAAC;QACF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,0BAA0B,CAAC,MAAM;YAC5C,SAAS,EAAE,sBAAsB,CAAC,qBAAqB;YACvD,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAEM,KAAK,CAAC,eAAe,CAAC,IAO5B;QACC,MAAM,SAAS,GAA8C;YAC3D,SAAS,EAAE,sBAAsB,CAAC,mBAAmB;YACrD,GAAG,IAAI;SACR,CAAC;QACF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,SAAS,EAAE,0BAA0B,CAAC,IAAI;YAC1C,SAAS,EAAE,sBAAsB,CAAC,mBAAmB;YACrD,SAAS,EAAE,SAAgC;SAC5C,CAAC,CAAC;IACL,CAAC;IAED,kCAAkC;IAClC,uCAAuC;IACvC,kCAAkC;IAE3B,KAAK,CAAC,gBAAgB,CAAC,IAK7B,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAA+C;YAC5D,SAAS,EAAE,sBAAsB,CAAC,mBAAmB;YACrD,GAAG,IAAI;SACR,CAAC;QACF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,0BAA0B,CAAC,MAAM;YAC5C,SAAS,EAAE,sBAAsB,CAAC,mBAAmB;YACrD,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAEM,KAAK,CAAC,0BAA0B,CAAC,IAKvC;QACC,MAAM,SAAS,GAAyD;YACtE,SAAS,EAAE,sBAAsB,CAAC,8BAA8B;YAChE,GAAG,IAAI;SACR,CAAC;QACF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,SAAS,EAAE,0BAA0B,CAAC,IAAI;YAC1C,SAAS,EAAE,sBAAsB,CAAC,8BAA8B;YAChE,SAAS,EAAE,SAAgC;SAC5C,CAAC,CAAC;IACL,CAAC;IAED,kCAAkC;IAClC,gDAAgD;IAChD,kCAAkC;IAElC;;;OAGG;IACI,KAAK,CAAC,wBAAwB,CAAC,IASrC;QACC,MAAM,cAAc,GAAkD;YACpE,SAAS,EAAE,sBAAsB,CAAC,uBAAuB;YACzD,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QACF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,SAAS,EAAE,0BAA0B,CAAC,MAAM;YAC5C,SAAS,EAAE,sBAAsB,CAAC,uBAAuB;YACzD,SAAS,EAAE,cAAqC;SACjD,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;OAaG;IACI,KAAK,CAAC,2BAA2B,CAAC,IAKxC;QACC,MAAM,cAAc,GAAqD;YACvE,SAAS,EAAE,sBAAsB,CAAC,2BAA2B;YAC7D,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,aAAa,EAAE,IAAI,CAAC,aAAa;SAClC,CAAC;QACF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,SAAS,EAAE,0BAA0B,CAAC,IAAI;YAC1C,SAAS,EAAE,sBAAsB,CAAC,2BAA2B;YAC7D,SAAS,EAAE,cAAqC;SACjD,CAAC,CAAC;IACL,CAAC;IAED,kCAAkC;IAClC,yCAAyC;IACzC,kCAAkC;IAE3B,KAAK,CAAC,sBAAsB,CAAC,IAKnC,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,MAAM;YAC5C,SAAS,EAAE,sBAAsB,CAAC,qBAAqB;YACvD,SAAS,EAAE,EAAE,SAAS,EAAE,sBAAsB,CAAC,qBAAqB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAyB;SACzK,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAEM,KAAK,CAAC,kBAAkB,CAAC,IAK/B,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,MAAM;YAC5C,SAAS,EAAE,sBAAsB,CAAC,iBAAiB;YACnD,SAAS,EAAE,EAAE,SAAS,EAAE,sBAAsB,CAAC,iBAAiB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAyB;SACrK,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAEM,KAAK,CAAC,mBAAmB,CAAC,IAKhC,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,MAAM;YAC5C,SAAS,EAAE,sBAAsB,CAAC,kBAAkB;YACpD,SAAS,EAAE,EAAE,SAAS,EAAE,sBAAsB,CAAC,kBAAkB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAyB;SACtK,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAEM,KAAK,CAAC,0BAA0B,CAAC,IAOvC,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,MAAM;YAC5C,SAAS,EAAE,sBAAsB,CAAC,0BAA0B;YAC5D,SAAS,EAAE,EAAE,SAAS,EAAE,sBAAsB,CAAC,0BAA0B,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAyB;SAClO,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED,kCAAkC;IAClC,wCAAwC;IACxC,kCAAkC;IAE3B,KAAK,CAAC,qBAAqB,CAAC,IAKlC;QACC,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,eAAe;YAC5B,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,MAAM;YAC5C,SAAS,EAAE,sBAAsB,CAAC,oBAAoB;YACtD,SAAS,EAAE,EAAE,SAAS,EAAE,sBAAsB,CAAC,oBAAoB,EAAE,GAAG,IAAI,EAAyB;SACtG,CAAC,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,mBAAmB,CAAC,IAKhC;QACC,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,eAAe;YAC5B,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,MAAM;YAC5C,SAAS,EAAE,sBAAsB,CAAC,kBAAkB;YACpD,SAAS,EAAE,EAAE,SAAS,EAAE,sBAAsB,CAAC,kBAAkB,EAAE,GAAG,IAAI,EAAyB;SACpG,CAAC,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,mBAAmB,CAAC,IAMhC;QACC,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,eAAe;YAC5B,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,MAAM;YAC5C,SAAS,EAAE,sBAAsB,CAAC,kBAAkB;YACpD,SAAS,EAAE,EAAE,SAAS,EAAE,sBAAsB,CAAC,kBAAkB,EAAE,GAAG,IAAI,EAAyB;SACpG,CAAC,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,gCAAgC,CAAC,IAI7C;QACC,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,eAAe;YAC5B,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,GAAG;YACzC,SAAS,EAAE,sBAAsB,CAAC,gCAAgC;YAClE,SAAS,EAAE,EAAE,SAAS,EAAE,sBAAsB,CAAC,gCAAgC,EAAE,GAAG,IAAI,EAAyB;SAClH,CAAC,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,yBAAyB,CAAC,IAKtC;QACC,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,MAAM;YAC5C,SAAS,EAAE,sBAAsB,CAAC,wBAAwB;YAC1D,SAAS,EAAE,EAAE,SAAS,EAAE,sBAAsB,CAAC,wBAAwB,EAAE,GAAG,IAAI,EAAyB;SAC1G,CAAC,CAAC;IACL,CAAC;IAED,kCAAkC;IAClC,yCAAyC;IACzC,kCAAkC;IAE3B,KAAK,CAAC,YAAY,CACvB,SAAiC,EACjC,SAAqC,EACrC,IAIC,EACD,uBAA+C,EAC/C,aAA+B;QAE/B,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,SAAS;YACT,SAAS;YACT,SAAS,EAAE,EAAE,SAAS,EAAE,GAAG,IAAI,EAAyB;SACzD,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED,kCAAkC;IAClC,0EAA0E;IAC1E,kCAAkC;IAElC;;;;;;;;;;;;;;;;;;OAkBG;IACI,KAAK,CAAC,iCAAiC,CAAC,IAU9C,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,cAAc,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAElF,MAAM,SAAS,GAA4D;YACzE,SAAS,EAAE,sBAAsB,CAAC,kCAAkC;YACpE,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,yBAAyB,EAAE,IAAI,CAAC,yBAAyB;YACzD,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,cAAc;YACd,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,IAAI;YAC1C,SAAS,EAAE,sBAAsB,CAAC,kCAAkC;YACpE,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED,8FAA8F;IAC9F,4FAA4F;IAC5F,EAAE;IACF,gGAAgG;IAChG,iGAAiG;IACjG,kGAAkG;IAClG,+DAA+D;IAC/D,kGAAkG;IAElG;;;;;;;;;OASG;IACI,KAAK,CAAC,oCAAoC,CAAC,IAMjD,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAA+D;YAC5E,SAAS,EAAE,sBAAsB,CAAC,oCAAoC;YACtE,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC;QACF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,KAAK;YAClB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,MAAM;YAC5C,SAAS,EAAE,sBAAsB,CAAC,oCAAoC;YACtE,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED;;;;;;;;;;OAUG;IACI,KAAK,CAAC,wCAAwC,CAAC,IAOrD,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAAmE;YAChF,SAAS,EAAE,sBAAsB,CAAC,wCAAwC;YAC1E,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;SAC9C,CAAC;QACF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,SAAS;YACtB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,IAAI;YAC1C,SAAS,EAAE,sBAAsB,CAAC,wCAAwC;YAC1E,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED;;;;;;;;;;OAUG;IACI,KAAK,CAAC,qCAAqC,CAAC,IAMlD,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAAgE;YAC7E,SAAS,EAAE,sBAAsB,CAAC,qCAAqC;YACvE,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,YAAY,EAAE,IAAI,CAAC,YAAY;SAChC,CAAC;QACF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,GAAG;YACzC,SAAS,EAAE,sBAAsB,CAAC,qCAAqC;YACvE,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED;;;;;;;;;OASG;IACI,KAAK,CAAC,wCAAwC,CAAC,IAOrD,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAAmE;YAChF,SAAS,EAAE,sBAAsB,CAAC,wCAAwC;YAC1E,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QACF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,SAAS;YACtB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,IAAI;YAC1C,SAAS,EAAE,sBAAsB,CAAC,wCAAwC;YAC1E,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED;;;;;;;;;;;OAWG;IACI,KAAK,CAAC,4BAA4B,CAAC,IAKzC,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAAuD;YACpE,SAAS,EAAE,sBAAsB,CAAC,4BAA4B;YAC9D,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,YAAY,EAAE,IAAI,CAAC,YAAY;SAChC,CAAC;QACF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,0BAA0B,CAAC,MAAM;YAC5C,SAAS,EAAE,sBAAsB,CAAC,4BAA4B;YAC9D,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED,+EAA+E;IACxE,KAAK,CAAC,gCAAgC,CAAC,IAM7C,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAA2D;YACxE,SAAS,EAAE,sBAAsB,CAAC,gCAAgC;YAClE,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;SAC9C,CAAC;QACF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,0BAA0B,CAAC,MAAM;YAC5C,SAAS,EAAE,sBAAsB,CAAC,gCAAgC;YAClE,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED;;;;;;;OAOG;IACI,KAAK,CAAC,6BAA6B,CAAC,IAM1C,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAAwD;YACrE,SAAS,EAAE,sBAAsB,CAAC,6BAA6B;YAC/D,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,YAAY,EAAE,IAAI,CAAC,YAAY;SAChC,CAAC;QACF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,0BAA0B,CAAC,GAAG;YACzC,SAAS,EAAE,sBAAsB,CAAC,6BAA6B;YAC/D,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED;;;;;;;;OAQG;IACI,KAAK,CAAC,gCAAgC,CAAC,IAM7C,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAA2D;YACxE,SAAS,EAAE,sBAAsB,CAAC,gCAAgC;YAClE,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC;QACF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,0BAA0B,CAAC,IAAI;YAC1C,SAAS,EAAE,sBAAsB,CAAC,gCAAgC;YAClE,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED;;;;;;;OAOG;IACI,KAAK,CAAC,gCAAgC,CAAC,IAQ7C,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAA2D;YACxE,SAAS,EAAE,sBAAsB,CAAC,gCAAgC;YAClE,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,8FAA8F;YAC9F,yFAAyF;YACzF,GAAG,CAAC,IAAI,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;YACvF,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;YACzE,0BAA0B,EAAE,IAAI,CAAC,0BAA0B;SAC5D,CAAC;QACF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,0BAA0B,CAAC,IAAI;YAC1C,SAAS,EAAE,sBAAsB,CAAC,gCAAgC;YAClE,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED,mGAAmG;IAC5F,KAAK,CAAC,wCAAwC,CAAC,IASrD,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,SAAS,GAAmE;YAChF,SAAS,EAAE,sBAAsB,CAAC,wCAAwC;YAC1E,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,GAAG,CAAC,IAAI,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC;YACxF,GAAG,CAAC,IAAI,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;YACvF,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;YACzE,0BAA0B,EAAE,IAAI,CAAC,0BAA0B;SAC5D,CAAC;QACF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,0BAA0B,CAAC,IAAI;YAC1C,SAAS,EAAE,sBAAsB,CAAC,wCAAwC;YAC1E,SAAS,EAAE,SAAgC;SAC5C,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAEM,KAAK,CAAC,eAAe,CAAC,IAM5B,EAAE,uBAA+C,EAAE,aAA+B;QACjF,MAAM,IAAI,CAAC,eAAe,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,SAAS,EAAyB;SACnF,EAAE,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;CACF,CAAA;AAppIY,uBAAuB;IADnC,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,kCAAkC,CAAC,CAAA;IAC7D,WAAA,MAAM,CAAC,kBAAkB,CAAC,2BAA2B,CAAC,CAAA;IACtD,WAAA,MAAM,CAAC,kBAAkB,CAAC,qCAAqC,CAAC,CAAA;IAChE,WAAA,MAAM,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAA;IAAE,WAAA,QAAQ,EAAE,CAAA;IAInD,WAAA,MAAM,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAA;IAAE,WAAA,QAAQ,EAAE,CAAA;qCATM,aAAa;QACM,0BAA0B;QACH,yCAAyC;QAChD,kCAAkC;QACrB,qCAAqC;GARxI,uBAAuB,CAopInC","sourcesContent":["import 'reflect-metadata';\nimport { createHash, randomUUID } from 'crypto';\nimport { inject, injectable, optional } from 'inversify';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { RepositoriesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/repositories/repositories-registry-handler.backend.service';\nimport { AuditEventDispatcherBackendService } from './audit-event-dispatcher.backend.service';\nimport type { MetricsService } from '~wildo-backend-lib/monitoring/observability/services/metrics.service';\nimport type { AuditLogSink, UserTypesConfig } from '@wildo-ai/saas-models';\nimport { ExternalOperation_Classification } from '@wildo-ai/external-connectors-models';\nimport {\n getAuditEventClassification,\n SiemExportChangeType,\n SsoConfigChangeType,\n SsoConnectionType,\n AuditableEvent,\n AuditableEvent_User_LoginEventData,\n AuditableEvent_User_LogoutEventData,\n AuditableEvent_User_LoginFailedEventData,\n AuditableEvent_MachineAuth_SuccessEventData,\n AuditableEvent_MachineAuth_FailedEventData,\n AuditableEvent_MachineAccess_EventData,\n AuditableEvent_User_AccountLockedEventData,\n AccountLockoutReason,\n AuditableEvent_User_SessionExpiredEventData,\n AuditableEvent_User_AppRolesChangedEventData,\n AuditableEvent_Application_SuperAdminFloorBreachedEventData,\n AdministrativeContinuityBreachDetection,\n AuditableEvent_Organization_OwnerFloorBreachedEventData,\n AuditableEvent_OrganizationMember_RoleChangedEventData,\n AuditableEvent_OrganizationUnitMember_RoleChangedEventData,\n AuditableEvent_OrganizationUnitMember_RemovedEventData,\n AuditableEvent_OrganizationMember_RemovedEventData,\n AuditableEvent_Organization_DeletedEventData,\n AuditableEvent_Organization_DeletionRequestedEventData,\n AuditableEvent_Organization_RestoredEventData,\n AuditableEvent_Organization_SuspendedEventData,\n AuditableEvent_Organization_ActivatedEventData,\n AuditableEvent_ApplicationAuthPolicyChanged_EventData,\n ApplicationAuthPolicySnapshot,\n AuditableEvent_Resource_StatusTransitionPerformedEventData,\n AuditableEvent_User_DeletedEventData,\n AuditableEvent_FieldAccess_EventData,\n AuditableEvent_ResourceOperationPerformed_EventData,\n AuditableEvent_HttpApiReadThroughAccess_EventData,\n AuditableEvent_McpToolCall_EventData,\n AuditableEvent_AgentToolApprovalModified_EventData,\n AuditableEvent_ProviderOperationCall_EventData,\n AuditableEvent_HttpApiExternalErasure_EventData,\n AuditableEvent_HttpApiNonErasureAcknowledged_EventData,\n AuditableEvent_PlatformDirectoryAccess_EventData,\n AuditableEvent_ResourceOperationDenied_EventData,\n AuditableEvent_User_SSOLoginEventData,\n AuditableEvent_User_SSOLoginFailedEventData,\n AuditableEvent_User_SSOEnforcementBlockedEventData,\n AuditableEvent_User_TokenRefreshedEventData,\n AuditableEvent_Organization_SSOConfigurationChangedEventData,\n AuditableEvent_Organization_SIEMExportConfiguredEventData,\n AuditableEvent_EmergencyAccess_UsedEventData,\n AuditableEvent_User_PasswordResetRequestedEventData,\n AuditableEvent_User_PasswordResetForcedEventData,\n AuditableEvent_User_PasswordResetCompletedEventData,\n AuditableEvent_User_RegisteredEventData,\n AuditableEvent_User_EmailVerifiedEventData,\n AuditableEvent_User_VerificationEmailResentEventData,\n AuditableEvent_User_MFASetupStartedEventData,\n AuditableEvent_User_MFASetupCompletedEventData,\n AuditableEvent_User_MFAEmailOTPSentEventData,\n AuditableEvent_User_PasskeyRegisteredEventData,\n AuditableEvent_User_PasskeyAuthSuccessEventData,\n AuditableEvent_User_PasskeyAuthFailureEventData,\n AuditableEvent_File_MalwareDetectedEventData,\n AuditableEvent_File_MalwareScanFailedEventData,\n AuditableEvent_User_PasskeyCloneSuspectedEventData,\n AuditableEvent_User_PasskeyRemovedEventData,\n AuditableEvent_SCIM_UserProvisionedEventData,\n AuditableEvent_SCIM_UserUpdatedEventData,\n AuditableEvent_SCIM_UserDeactivatedEventData,\n AuditableEvent_User_MagicLinkSentEventData,\n AuditableEvent_User_MagicLinkVerifiedEventData,\n AuditableEvent_User_MagicLinkFailedEventData,\n AuditableEvent_User_SMSOTPSentEventData,\n AuditableEvent_User_SMSOTPVerifiedEventData,\n AuditableEvent_User_SMSOTPFailedEventData,\n AuditableEvent_User_PhoneVerifiedEventData,\n AuditableEvent_User_PhoneVerificationFailedEventData,\n AuditableEvent_OAuth2ProviderBlockedEventData,\n AuditableEvent_OidcAcrDemandUnsatisfiedEventData,\n AuditableEvent_User_CrossFrontendHandoffIssuedEventData,\n AuditableEvent_OAuth_DelegatedTokenIssuedEventData,\n AuditableEvent_OrganizationProviderCredential_SetEventData,\n AuditableEvent_OrganizationProviderCredential_RotatedEventData,\n AuditableEvent_OrganizationProviderCredential_UsedEventData,\n AuditableEvent_OrganizationProviderCredential_DeletedEventData,\n type AuditableEvent_UserProviderCredential_SetEventData,\n type AuditableEvent_UserProviderCredential_RotatedEventData,\n type AuditableEvent_UserProviderCredential_UsedEventData,\n type AuditableEvent_UserProviderCredential_DeletedEventData,\n type AuditableEvent_UserProviderConnection_GrantedEventData,\n type AuditableEvent_OrganizationProviderConnection_GrantedEventData,\n ProviderCredentialDeletionReason,\n ProviderCredentialResolutionSource,\n AuditableEvent_OAuth_ConsentGrantedEventData,\n AuditableEvent_OAuth_ConsentDeniedEventData,\n AuditableEvent_OAuth_ConsentGrantPersistedEventData,\n AuditableEvent_OAuth_CimdClientRefusedEventData,\n AuditableEvent_OAuth_DynamicClientRegisteredEventData,\n AuditableEvent_OAuth_TokenRefreshedEventData,\n AuditableEvent_OAuth_TokenRevokedEventData,\n AuditableEvent_OAuth_RpInitiatedLogoutEventData,\n AuditableEvent_OAuth_CodeExchangeFailedEventData,\n AuditableEvent_OAuth_ConsentBindingViolationEventData,\n AuditableEvent_User_RefreshTokenReuseDetectedEventData,\n OAuthCodeExchangeFailureReason,\n CoreAuditableEventType,\n ErrorCustomMessageReference,\n ErrorType,\n ExecutionContext_ExecutionType,\n MachineAccessOperation,\n ResourceServerKind,\n ResourceOperationRiskLevel,\n ResourceOperationVariantType,\n ResourcePrimaryScope,\n ResourceType,\n AuthScopeType,\n CORE_APP_ROLES,\n PlatformAccessGrantAutoApprovalReason,\n PlatformAccessGrantScope,\n PlatformAccessGrantLifecycleTransition,\n PlatformAccessGrantStatus,\n} from '@wildo-ai/saas-models';\nimport type { ResourceConfiguration_OperationPath, VerifiedOrgId } from '@wildo-ai/saas-models';\nimport { CoreResourceOperation, CoreResourceType, AuditableEvent_BaseSchema, AuditableEvent_ApplicationAuthPolicyChanged_EventDataSchema, deriveTrustedSystemWritePreservedFields } from '@wildo-ai/saas-models';\nimport {\n buildApplicationAuthPolicySnapshot,\n computeApplicationAuthPolicySnapshotDigest,\n diffChangedApplicationAuthPolicyUserTypes,\n} from '../../../security/authentications/utils/application-auth-policy-audit.backend.utils';\nimport { McpOutcomeKind } from '~wildo-backend-lib/flows-actors/models/mcp-client.backend.definitions';\nimport { ExecutionContext, type SocketAuthResult } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport { getRequestContextFrame } from '~wildo-backend-lib/runtime/models/request-context.als.backend';\nimport { ExecutionContextCreatorBackendService } from '~wildo-backend-lib/runtime/services/execution-context-creator.backend.service';\n\n/*\n WHICH RUNTIME performed a privileged system-context access.\n \n Structural twin of `RuntimePrincipalBackendService.describeForAudit()`, declared\n * here rather than imported so the durable audit contract does not silently inherit\n * future fields added to the runtime descriptor. An audit record is a compliance\n * artifact; its shape changes deliberately.\n /\nexport interface SystemContextAuditRuntimeAttribution {\n /* `application_backend` \| `minion` — see `ApplicationRuntimeProfile`. /\n runtimeProfile: string;\n /* The instance within that profile — a minion's name. Absent for the backend. /\n runtimeKey?: string;\n /* Canonical caller id, e.g. `minions.marketingScrapper`. /\n serviceIdentifier?: string;\n}\n\n/\n How much of a scanner's failure text reaches the audit row (#506).\n \n Bounded rather than omitted: an operator triaging \"why did the scan not run\" needs the scanner's\n * own words, and a bare event type does not distinguish a dead socket from a malformed archive. The\n * bound exists because that text routinely embeds a host, a socket path or a temporary file path,\n * and this row is replicated to the organisation's SIEM and to the immutable store.\n /\nconst FILE_MALWARE_SCAN_FAILURE_REASON_MAX_LENGTH = 300;\n\n@injectable()\nexport class AuditLogsBackendService {\n private readonly logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n constructor(\n @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private readonly errorBuilder: ErrorBuilderBackendService,\n @inject(SAAS_SERVICE_TYPES.RepositoriesRegistryHandlerService) private readonly repositoriesRegistry: RepositoriesRegistryHandlerBackendService,\n @inject(SAAS_SERVICE_TYPES.AuditEventDispatcherService) private readonly auditEventDispatcher: AuditEventDispatcherBackendService,\n @inject(SAAS_SERVICE_TYPES.ExecutionContextCreatorBackendService) private readonly executionContextCreator: ExecutionContextCreatorBackendService,\n @inject(SAAS_SERVICE_TYPES.AuditLogSink) @optional() private readonly auditLogSink?: AuditLogSink,\n // A-12: the Layer-1 authoritative-store write failure metric (`audit_store_failure_total`). Optional\n // so partial-container tests can construct this service without wiring the meter; always bound in the\n // real container (the composite sink injects it as required). Guarded with `?.` at the call site.\n @inject(SAAS_SERVICE_TYPES.MetricsService) @optional() private readonly metricsService?: MetricsService,\n ) {\n this.logDebug = this.logger.debugByType('AuditLogsBackendService');\n this.logger.setDebugTypeLogging('AuditLogsBackendService', true);\n }\n\n /\n The write context for one audit row.\n \n Deliberately carries NO tenant/actor context. The subject ids reach the row through\n * `preserveServerInjectedFields` on the write below — a payload-level mechanism — NOT through this\n * context. Putting them here instead was tried and reverted (2026-08-05): an audit context that\n * carries `organizationId` is then reused by `populateApplicationIdIfNeeded` to read APPLICATIONS,\n * whose schema has no such field, and the fail-closed contextual filter turned EVERY audit write\n * into a CONFIGURATION failure. The context stays scope-free; the payload carries the facts.\n /\n private async _getTempExecutionContext(): Promise<ExecutionContext<any>> {\n const operation: ResourceConfiguration_OperationPath<any, any> = {\n resourceIdentifier: CoreResourceType.AUDIT_LOGS,\n operationIdentifier: CoreResourceOperation.CREATE,\n variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n isOperationDefault: true\n };\n\n return this.executionContextCreator.createForInternalOperation({\n operation,\n contextResourcesFieldIdentifier: new Map(),\n initiatorIds: null,\n initiatorRoles: [{ roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], relatedPrimaryScope: ResourcePrimaryScope.APPLICATION }],\n });\n }\n\n /\n Generic audit-event emitter.\n \n Public escape hatch for consumers that need to log domain events\n * outside the per-event-type method catalog above (`logUserLogin`,\n * `logOrganizationCreated`, …). Accepts any `eventType` string;\n * `getAuditEventClassification(eventType)` falls back to\n * `{ category: 'data_access', severity: 'info' }` for types that\n * aren't pre-classified, so platform services can emit registry-\n * private / domain-specific event types without modifying the\n * `CoreAuditableEventType` enum.\n \n Per-org SIEM dispatch fires ONLY when an authenticated request `ExecutionContext`\n * (carrying an org) is passed as `requestExecutionContext` — NEVER on the caller-supplied\n * `organizationId` data field (F4 tenant segregation).\n \n Errors are caught + logged but never thrown — audit emission is\n * fire-and-forget; a logging failure must not affect the request\n * that triggered it.\n /\n public async logEvent(\n auditEvent: Omit<AuditableEvent, '_id' \| 'eventId' \| 'createdAt' \| 'updatedAt' \| 'eventCategory' \| 'severity'>,\n requestExecutionContext?: ExecutionContext<any>,\n ): Promise<void> {\n return this._createAuditLog(auditEvent, requestExecutionContext);\n }\n\n /\n Create an audit log entry.\n * Enriches eventCategory and severity from getAuditEventClassification.\n /\n private async _createAuditLog(\n auditEvent: Omit<AuditableEvent, '_id' \| 'eventId' \| 'createdAt' \| 'updatedAt' \| 'eventCategory' \| 'severity'>,\n requestExecutionContext?: ExecutionContext<any>,\n routingOrgIds?: VerifiedOrgId[],\n ): Promise<void> {\n const classification = getAuditEventClassification(auditEvent.eventType);\n // Store-agnostic correlation key, minted HERE — BEFORE the DB write — so the\n // SAME id lands on the authoritative DB row AND the provider fan-out emission.\n // The Phase-3 completeness reconciler matches DB rows ⇄ immudb records by it,\n // independent of each store's native key. See `AuditableEvent.eventId`.\n const eventId = randomUUID();\n // Hoist the request-correlation + frontend origin onto the row (closes gap 1 for audit). Prefer the\n // explicitly-threaded request EC; fall back to the ambient request-context ALS frame for the ~many\n // emitters that pass no EC — that fallback is what finally populates a top-level `correlationId` on the\n // COMMON audit path. Both are PAYLOAD data (like `userId`/`organizationId`), read from the REQUEST\n // context — NOT from the scope-free super-admin temp write `ec` below (which stays landmine-safe).\n const requestFrame = getRequestContextFrame();\n const correlationId = requestExecutionContext?.correlationId ?? requestFrame?.correlationId;\n const frontendServiceName = requestFrame?.frontendServiceName;\n // `clientInstanceId` needs no policy check HERE: the frame only ever carries one when\n // `setupRequestContext` admitted it, and that ingest is itself gated on the application's authored\n // `compliance.clientInstanceIdScope`. Keeping the single gate at the edge (rather than re-deciding at\n // each consumer) is what makes \"unopted application records nothing\" true by construction — see SD9.\n const clientInstanceId = requestFrame?.clientInstanceId;\n const auditLogData = {\n ...auditEvent,\n eventId,\n ...(correlationId ? { correlationId } : {}),\n ...(frontendServiceName ? { frontendServiceName } : {}),\n ...(clientInstanceId ? { clientInstanceId } : {}),\n eventData: auditEvent.eventData as Record<string, any>,\n eventCategory: classification.category,\n severity: classification.severity,\n createdAt: new Date(),\n updatedAt: new Date()\n };\n\n // Layer 1 — the always-on authoritative DB store (+ the existing per-org SIEM\n // dispatch). Best-effort: a failure here is logged but must NOT suppress the\n // Layer-2 provider fan-out below (F7 — each audit destination is independent).\n try {\n const ec = await this._getTempExecutionContext();\n const auditRepo = this.repositoriesRegistry.getRepositoryOrThrow(CoreResourceType.AUDIT_LOGS);\n // `userId`/`organizationId`/`applicationId` are CONTEXT_AUTO_POPULATED_FIELD_IDENTIFIERS, so\n // the repository's default CREATE request DTO strips them from every write — the strip\n // assumes those fields always describe the WRITER's own scope and re-derives them from the\n // execution context instead. That assumption is backwards here: this write's `ec` is the\n // synthesised super-admin/APPLICATION-scoped temp context (`_getTempExecutionContext`), which\n // has no `userId`/`organizationId` of its own, while `AuditableEvent_BaseSchema`'s own JSDoc\n // is explicit that these three are event DATA — \"the org/user the event is ABOUT\" — authored\n // directly on `auditLogData` above, not derived from the writer's identity. Without this,\n // `applicationId` happens to survive (it is ALSO this resource's declared primary-scope field,\n // so a separate enrichment step re-injects it from the writer's own `initiatorIds` — which\n // coincidentally matches), but `userId`/`organizationId` are silently dropped on every audit\n // row, for every event type — confirmed live on both `resource_operation_denied` and\n // `user_login` rows. `preserveServerInjectedFields` is exactly the trusted-system-write escape\n // hatch this class of gap exists for (see `deriveTrustedSystemWritePreservedFields`'s JSDoc).\n //\n // SECURITY REVIEW OF THIS PRESERVE — `organizationId` is attacker-influenceable on pre-auth\n // paths (a failed login resolves an org from the email domain), and preserving it makes that\n // value both durable and visible on the org-scoped viewer. Both channels were checked and the\n // full analysis lives on `AuditableEvent_BaseSchema.organizationId`'s JSDoc: SIEM routing is\n // unaffected (it keys on the AUTHENTICATED org, F4 — see the routing block below), and viewer\n // visibility is the INTENDED semantics (the targeted tenant should see attempts against its\n // own members). Read that JSDoc before changing what is preserved here.\n // assurance-control: WILDO.AUDIT.CONTEXT_ATTRIBUTION — the actor and tenant an audit row names must\n // survive the trusted-system write that persists it.\n await auditRepo.create(ec, auditLogData, {\n preserveServerInjectedFields: deriveTrustedSystemWritePreservedFields(\n AuditableEvent_BaseSchema,\n Object.keys(auditLogData),\n CoreResourceOperation.CREATE,\n ),\n });\n this.logDebug(`Created audit log: ${auditEvent.eventType}`, { eventData: auditEvent.eventData });\n\n // F4 (tenant segregation) — route the per-org SIEM sink on the AUTHENTICATED org from\n // the originating request EC (`initiatorIds.organizationId`), NEVER on the caller-supplied\n // `auditEvent.organizationId`. That field is event DATA (\"which org the event is ABOUT\")\n // and is attacker-influenceable on pre-auth paths (e.g. an email-domain→org lookup on a\n // failed login), so routing on it leaks one tenant's events into another tenant's SIEM.\n // Mirrors the M2M dispatcher's `resolveScopeFromChannel` (routes on\n // `executionContext.initiatorIds.organizationId`). Fail-closed: no authenticated org ⇒ NO\n // per-org dispatch (the always-on DB store above + the Layer-2 app-level sinks below are\n // unaffected — they are not per-tenant).\n // F4 routing set — the orgs this event delivers to. EITHER an explicit list of VERIFIED\n // member orgs (`routingOrgIds` — e.g. an auth-flow event fanned out to the user's ACTIVE\n // memberships) OR the single AUTHENTICATED org on the request EC (`initiatorIds.organizationId`\n // — e.g. SCIM / SSO-connection sites). NEVER the caller-supplied `auditEvent.organizationId`\n // data field. Fail-closed: an empty set ⇒ NO per-org dispatch (the always-on DB store + the\n // Layer-2 app-level sinks below are unaffected — they are not per-tenant).\n const ecOrg = requestExecutionContext?.initiatorIds?.organizationId;\n const routeToOrgs: string[] = routingOrgIds ?? (ecOrg ? [ecOrg] : []);\n if (routeToOrgs.length > 0) {\n if (!routingOrgIds && ecOrg && auditEvent.organizationId && auditEvent.organizationId !== ecOrg) {\n // Single-EC-org path only: the event's DATA org disagrees with the AUTHENTICATED org —\n // route on the authenticated one (never the data field) and surface the divergence.\n this.logger.warn?.('Audit event organizationId (data) differs from the authenticated request org — routing per-org dispatch on the AUTHENTICATED org (F4)', {\n eventType: auditEvent.eventType,\n dataOrganizationId: auditEvent.organizationId,\n authenticatedOrganizationId: ecOrg,\n });\n }\n // One DB row above; fan the per-org SIEM out to EACH verified org (each dispatch scopes\n // its own config read on the explicit org id — F4-safe; per-sink failures are isolated).\n for (const orgId of routeToOrgs) {\n this.auditEventDispatcher.dispatchToOrganizationAuditSinks(ec, auditLogData, orgId)\n .catch(err => this.logger.error?.('Per-org audit sink dispatch fire-and-forget error', { err, organizationId: orgId }));\n }\n }\n // No `else`: an empty routeToOrgs is the CORRECT, COMMON fail-closed state — every internal\n // `system_context_read`/`_write` audit (which names its scope org in DATA but carries no\n // authenticated routing EC) and every pre-auth-failure event lands here. Routing those on\n // their data org would (a) recurse — a per-org dispatch's own SIEM-config load is itself a\n // `readAsSystem` → another `system_context_read` → dispatch → … — and (b) flood tenant SIEMs\n // with framework plumbing. The fail-close is deliberate + SILENT (no per-event log); the DB\n // store + immudb keep the full forensic record. A data-org≠authenticated-org DIVERGENCE on the\n // EC path is still WARNed above.\n } catch (error) {\n // NAME WHAT WENT UNRECORDED, not just its event type.\n //\n // Audit emission is fire-and-forget by design: refusing the business operation here cannot\n // undo it, and throwing would be actively worse than best-effort (this catch sits POST-COMMIT, so it\n // would report failure for a change that already persisted, corrupting the accuracy of the\n // very record the assurance mechanism protects). The required behavior is that the failure be\n // DETECTED and actionable.\n //\n // `eventType` alone is not actionable: on a resource-operation event it says only\n // \"some operation, somewhere\". The correlation key, the operation identity triple and the\n // subject id let a reviewer name the exact action whose evidence is missing and reconstruct it\n // from the application log — the difference between a known gap and an unknown one.\n // Fail-closed remains reserved for the case where refusing still withholds something: a\n // privileged READ, where `SystemAccessBackendService.emitPrivilegedReadAudit` already refuses\n // to hand a minion data whose access could not be recorded.\n //\n // assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT — audit-pipeline failures are detectable\n // AND attributable to the specific action they lost.\n const unrecorded = auditEvent.eventData as Record<string, unknown> \| undefined;\n this.logger.error?.('Failed to write audit log to the database store', {\n error,\n eventType: auditEvent.eventType,\n eventId,\n unrecordedResourceType: unrecorded?.resourceType,\n unrecordedResourceId: unrecorded?.resourceId,\n unrecordedOperationIdentifier: unrecorded?.operationIdentifier,\n unrecordedVariantKey: unrecorded?.variantKey,\n // The failed row's request-correlation id is already on this log line via the logger's ambient\n // request-context mixin (`correlationId`); no need to re-log it from the (now removed) eventData field.\n actorUserId: auditEvent.userId,\n organizationId: auditEvent.organizationId,\n applicationId: auditEvent.applicationId,\n riskLevel: auditEvent.riskLevel,\n });\n // A-12 — make the Layer-1 authoritative-store outage DETECTABLE. This catch is on a\n // fire-and-forget path (audit must never break the business op), so without a metric the\n // failure is only a swallowed warn line — \"we think we're auditing but we aren't\". Increment\n // the bounded `audit_store_failure_total` counter (label-free — the authoritative store has no\n // provider dimension) so an outage surfaces on the observability layer. The alert RULE that\n // watches it is owned by the alerting workstream (`alerting-system-design-analysis.md` App. D).\n // assurance-control: WILDO.AUDIT.SECURITY_EVENT — audit-pipeline outage detectability.\n this.metricsService?.recordAuditStoreFailure();\n }\n\n // Layer 2 — app-level provider fan-out (immudb, …), resolved lazily by the\n // `CompositeAuditLogSink`. Runs INDEPENDENTLY of the Layer-1 outcome (F7); the\n // composite isolates each sink's failures + never throws onto this\n // fire-and-forget path. The emission carries the store-agnostic `eventId`\n // (minted above) — NOT the DB `_id` (this store's key, possibly not assigned\n // yet) — so the Phase-3 reconciler correlates DB ⇄ immudb by `eventId`.\n void this.auditLogSink?.recordAuditEvent(auditLogData);\n }\n\n // ===============================\n // SYSTEM-CONTEXT (ACL-BYPASSING) ACCESS AUDIT\n // ===============================\n\n /\n Record an ACL-bypassing system-context read (`readAsSystem` /\n * `listAsSystem`). Those primitives run with a synthesised super-admin\n * execution context and skip the caller's scope + role checks, so each call\n * is logged as a privileged-access event for the security trail. Userless by\n * design — the read is server-internal, attributed to no end user. Like every\n * audit method this is fire-and-forget: `_createAuditLog` swallows and logs\n * its own failures, so it can never break the read that triggered it.\n \n @param data.resourceType The resource read via the system context.\n * @param data.operation READ (`readAsSystem`) or LIST (`listAsSystem`).\n * @param data.resultCount Rows returned (1/0 for a read; length for a list).\n * @param data.organizationId Scope org id, when the call carried one.\n * @param data.scopeContext The raw scopeContext seed, for forensic context.\n /\n /\n Record a DATA SUBJECT EXPORT — the framework assembled everything it holds about one person and\n * disclosed it (GDPR Art. 15 access / Art. 20 portability).\n \n Its own emitter rather than a `logSystemContextAccess` call with extra fields: that event is\n * runtime-attributed and carries no subject, purpose, or contents, so it cannot answer \"who\n * exported whose data, when, and what was in it?\" — the only question an access-request audit is\n * for. Emitted at HIGH risk: a completed export is the largest single disclosure of personal data\n * the system can make.\n \n Never receives the exported VALUES — resource types, ids, counts and field names only. The\n * audit store outlives the export artifact, so recording the payload would leave a longer-lived\n * copy of the very data the subject asked to receive once.\n \n assurance-control: WILDO.PRIVACY.SUBJECT_DATA_EXPORT\n /\n public async logSubjectDataExport(data: {\n purpose: string;\n subjectResourceType: string;\n subjectIds: string[];\n includedResourceTypes: string[];\n totalRecordCount: number;\n fieldsExcludedAsDerived: string[];\n fieldsWithheldAsNonDisclosable: string[];\n organizationId?: string;\n }): Promise<void> {\n await this._createAuditLog({\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.HIGH,\n eventType: CoreAuditableEventType.SUBJECT_DATA_EXPORT,\n eventData: {\n eventType: CoreAuditableEventType.SUBJECT_DATA_EXPORT,\n purpose: data.purpose,\n subjectResourceType: data.subjectResourceType,\n subjectIds: data.subjectIds,\n includedResourceTypes: data.includedResourceTypes,\n totalRecordCount: data.totalRecordCount,\n fieldsExcludedAsDerived: data.fieldsExcludedAsDerived,\n fieldsWithheldAsNonDisclosable: data.fieldsWithheldAsNonDisclosable,\n ...(data.organizationId ? { organizationId: data.organizationId } : {}),\n },\n });\n }\n\n /\n A resource LISTING was exported to a file. See\n * {@link AuditableEvent_CollectionDataExport_EventDataSchema} for what this must and must not\n * carry — in short: the row count and row scope always, filter VALUES never.\n \n `riskLevel` is where the page-vs-whole-table distinction lives, because severity is static per\n * event type. A full-result-set export is HIGH: it can carry out far more than was ever on the\n * caller's screen.\n \n assurance-control: WILDO.PRIVACY.COLLECTION_DATA_EXPORT\n /\n public async logCollectionDataExport(data: {\n resourceType: string;\n sourceOperationIdentifier: string;\n format: string;\n rowScope: string;\n rowCount: number;\n filterFieldNames: string[];\n isFullResultSet: boolean;\n organizationId?: string;\n }): Promise<void> {\n await this._createAuditLog({\n organizationId: data.organizationId,\n riskLevel: data.isFullResultSet ? ResourceOperationRiskLevel.HIGH : ResourceOperationRiskLevel.LOW,\n eventType: CoreAuditableEventType.COLLECTION_DATA_EXPORT,\n eventData: {\n eventType: CoreAuditableEventType.COLLECTION_DATA_EXPORT,\n resourceType: data.resourceType,\n sourceOperationIdentifier: data.sourceOperationIdentifier,\n format: data.format,\n rowScope: data.rowScope,\n rowCount: data.rowCount,\n filterFieldNames: data.filterFieldNames,\n ...(data.organizationId ? { organizationId: data.organizationId } : {}),\n },\n });\n }\n\n /\n A refresh chain was retired to keep a principal within its concurrent-session cap.\n \n Best-effort like every other emit here: the eviction has already happened when this is called,\n * and losing the record must never cost the enforcement.\n \n `evictedIssuedAt` is optional because the stored ordering score can be unreadable (a legacy\n * whole-second score, a corrupted member). Absent means \"we could not say when it was issued\",\n * which is honest; a synthesised instant would make the first-in-first-out claim unfalsifiable.\n \n assurance-control: WILDO.IDENTITY.SESSION_CONCURRENCY_LIMIT — evidence that the bound was\n * enforced and WHICH chain it retired.\n /\n public async logUserSessionEvicted(data: {\n userId: string;\n evictedJti: string;\n evictedIssuedAt?: Date;\n configuredMaximum: number;\n retainedCount: number;\n }): Promise<void> {\n await this._createAuditLog({\n userId: data.userId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.USER_SESSION_EVICTED,\n eventData: {\n eventType: CoreAuditableEventType.USER_SESSION_EVICTED,\n userId: data.userId,\n evictedJti: data.evictedJti,\n ...(data.evictedIssuedAt ? { evictedIssuedAt: data.evictedIssuedAt } : {}),\n configuredMaximum: data.configuredMaximum,\n retainedCount: data.retainedCount,\n },\n });\n }\n\n public async logSystemContextAccess(data: {\n resourceType: string;\n operation: CoreResourceOperation.READ \| CoreResourceOperation.LIST;\n resultCount?: number;\n organizationId?: string;\n scopeContext?: Record<string, unknown>;\n /\n WHICH RUNTIME performed this privileged access — the application backend, a\n * named minion, etc.\n \n This event remains USERLESS by design: the system-access door synthesises its\n * own super-admin context, so there is no human to name and pretending otherwise\n * would corrupt the audit trail. Runtime attribution is a strictly weaker,\n * honest claim — it answers \"which runtime did this?\", never \"which user did\n * this?\". Without it, a cross-tenant read by a background digital worker is\n * indistinguishable from a data seed or a lifecycle batch.\n \n assurance-control: WILDO.AUDIT.SECURITY_EVENT — privileged access is attributable\n * to the runtime that exercised it.\n /\n performedByRuntime?: SystemContextAuditRuntimeAttribution;\n }): Promise<void> {\n await this._createAuditLog({\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.LOW,\n eventType: CoreAuditableEventType.SYSTEM_CONTEXT_READ,\n eventData: {\n eventType: CoreAuditableEventType.SYSTEM_CONTEXT_READ,\n resourceType: data.resourceType,\n operation: data.operation,\n resultCount: data.resultCount,\n scopeContext: data.scopeContext,\n performedByRuntime: data.performedByRuntime,\n } as Record<string, any>,\n });\n }\n\n /\n M6 — record a privileged SEE-THROUGH read that revealed RETAINED (impersonalized-and-retained)\n * records (`readRetainedAsSystem` / `listRetainedAsSystem`). Unlike the userless\n * {@link logSystemContextAccess}, this is HUMAN-ATTRIBUTED and carries a required `reason`: the two\n * properties that make a retained-data reveal a compliance-grade access record. The human is set on\n * BOTH the top-level `userId` (queryable) AND the typed `eventData.accessingUserId`. Classified\n * `DATA_ACCESS` / `WARNING` via the classification map (P0.6); `riskLevel` HIGH marks the sensitivity\n * of reading scrubbed PII. Fire-and-forget like every audit method — never breaks the read.\n \n @param data.accessingUserId The HUMAN (super-admin / compliance auditor) who performed the read.\n * @param data.reason REQUIRED justification for revealing the retained records.\n * @param data.resourceType The resource whose retained rows were revealed.\n * @param data.operationIdentifier `readRetainedAsSystem` \| `listRetainedAsSystem`.\n * @param data.resourceId Present for a single-record see-through read.\n * @param data.retainedRecordCount For a list/search reveal: how many retained rows were surfaced.\n * @param data.roles The privileged role(s) that authorized the see-through.\n * @param data.organizationId Tenant scope of the accessed data, when org-scoped.\n * @param data.ipAddress Caller IP, when available.\n /\n /\n A platform operator acted on a row in a tenant they are not a member of.\n \n Wildo's answer to \"may a platform super-administrator administer any tenant?\" is YES, as at most\n * mature B2B platforms — support and incident response need it. What those platforms also do, and\n * what this method exists for, is make the reach NAMED rather than implicit: the difference between\n * legitimate operator work and quiet snooping is not the capability (identical in both cases) but\n * whether anyone can tell afterwards.\n \n Attributed to the human operator on BOTH the queryable top-level `userId` and the typed event\n * data, and scoped to the TARGET organization — not the operator's own — so a tenant's audit view\n * shows who reached into it. Best-effort like every audit method: an operator action must never\n * fail because the sink is down, and a fail-closed variant would let anyone disable operator\n * support by breaking the sink.\n \n @param data.admissionDeclared Did the operation VARIANT declare the crossing\n * (`admitsCrossTenantPlatformAdministration`)? `false` is the subset worth alerting on — reach\n * nobody asked for and no specification documents.\n \n assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION\n /\n /\n One transition in a platform access grant's life — requested, approved, denied or revoked.\n \n Scoped to the TARGET organization so the tenant's own audit view shows elevations raised against\n * it, including ones it never had the chance to decide. Attributed to the OPERATOR on the queryable\n * top-level `userId`, because the operator is the constant across the whole timeline; the tenant\n * administrator who decided is carried separately as `decidedByUserId`.\n \n `TENANT_CANNOT_APPROVE` rides at HIGH risk. It is the one path where operator access proceeds\n * against a tenant that never consented and never could, and it should be separable from routine\n * elevation traffic without parsing prose.\n \n assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE\n /\n /\n Record one access-grant transition — TENANT or APPLICATION-WIDE, on the same event.\n \n ONE method for both scopes, deliberately. The lifecycle really is the same lifecycle (requested,\n * decided, revoked, expired), and a reviewer's question is \"what elevated access was granted, to\n whom, by whom?\"* — a question that must be answerable with one query, not by remembering to union\n * two event types. `grantScope` is what separates them within the answer, and it is a field rather\n * than an inference from `targetOrganizationId`'s absence: a scrubbed or lost tenant id would\n * otherwise read as an application-wide elevation, which is the more alarming of the two.\n \n The application-wide row is HIGH by default. It is not an exception path like\n * `TENANT_CANNOT_APPROVE`; it is the ordinary shape of the widest elevation the system issues, and\n * a reviewer who filters to HIGH should see every one of them.\n /\n public async logPlatformAccessGrantLifecycle(data: {\n transition: PlatformAccessGrantLifecycleTransition;\n grantId: string;\n /* Absent exactly when `grantScope` is APPLICATION_WIDE — that elevation names no tenant. /\n targetOrganizationId?: string;\n /* Defaults to TENANT so an existing caller keeps its meaning without restating it. /\n grantScope?: PlatformAccessGrantScope;\n operatorUserId: string;\n justification?: string;\n resultingStatus: PlatformAccessGrantStatus;\n expiresAt?: Date;\n autoApprovalReason?: PlatformAccessGrantAutoApprovalReason;\n decidedByUserId?: string;\n decisionReason?: string;\n }): Promise<void> {\n const grantScope = data.grantScope ?? PlatformAccessGrantScope.TENANT;\n await this._createAuditLog({\n userId: data.operatorUserId,\n organizationId: data.targetOrganizationId,\n riskLevel: grantScope === PlatformAccessGrantScope.APPLICATION_WIDE\n \|\| data.autoApprovalReason === PlatformAccessGrantAutoApprovalReason.TENANT_CANNOT_APPROVE\n ? ResourceOperationRiskLevel.HIGH\n : ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.PLATFORM_ACCESS_GRANT_LIFECYCLE,\n eventData: {\n eventType: CoreAuditableEventType.PLATFORM_ACCESS_GRANT_LIFECYCLE,\n transition: data.transition,\n grantId: data.grantId,\n grantScope,\n targetOrganizationId: data.targetOrganizationId,\n operatorUserId: data.operatorUserId,\n justification: data.justification,\n resultingStatus: data.resultingStatus,\n expiresAt: data.expiresAt,\n autoApprovalReason: data.autoApprovalReason,\n decidedByUserId: data.decidedByUserId,\n decisionReason: data.decisionReason,\n } as Record<string, any>,\n });\n }\n\n public async logCrossTenantAdministrativeAccess(data: {\n operatorUserId?: string;\n targetOrganizationId: string;\n resourceType: string;\n operationIdentifier: string;\n variantType: ResourceOperationVariantType;\n variantKey?: string;\n targetResourceIds?: string[];\n authorizingGrantId?: string;\n /* WHICH collection `authorizingGrantId` names — the two grant resources are two collections. /\n authorizingGrantScope?: PlatformAccessGrantScope;\n admissionDeclared: boolean;\n initiatorRoles: string[];\n executionType: ExecutionContext_ExecutionType;\n }): Promise<void> {\n await this._createAuditLog({\n userId: data.operatorUserId,\n organizationId: data.targetOrganizationId,\n // HIGH when undeclared: that is the structural gap, not sanctioned support work.\n riskLevel: data.admissionDeclared ? ResourceOperationRiskLevel.MEDIUM : ResourceOperationRiskLevel.HIGH,\n eventType: CoreAuditableEventType.CROSS_TENANT_ADMINISTRATIVE_ACCESS,\n eventData: {\n eventType: CoreAuditableEventType.CROSS_TENANT_ADMINISTRATIVE_ACCESS,\n targetOrganizationId: data.targetOrganizationId,\n resourceType: data.resourceType,\n operationIdentifier: data.operationIdentifier,\n variantType: data.variantType,\n variantKey: data.variantKey,\n targetResourceIds: data.targetResourceIds,\n authorizingGrantScope: data.authorizingGrantScope,\n authorizingGrantId: data.authorizingGrantId,\n admissionDeclared: data.admissionDeclared,\n initiatorRoles: data.initiatorRoles,\n executionType: data.executionType,\n } as Record<string, any>,\n });\n }\n\n public async logRetainedDataAccess(data: {\n accessingUserId: string;\n reason: string;\n resourceType: string;\n operationIdentifier: string;\n resourceId?: string;\n retainedRecordCount?: number;\n roles?: string[];\n organizationId?: string;\n ipAddress?: string;\n }): Promise<void> {\n await this._createAuditLog({\n userId: data.accessingUserId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.HIGH,\n eventType: CoreAuditableEventType.RETAINED_DATA_ACCESS,\n eventData: {\n eventType: CoreAuditableEventType.RETAINED_DATA_ACCESS,\n accessingUserId: data.accessingUserId,\n reason: data.reason,\n resourceType: data.resourceType,\n operationIdentifier: data.operationIdentifier,\n resourceId: data.resourceId,\n retainedRecordCount: data.retainedRecordCount,\n roles: data.roles,\n organizationId: data.organizationId,\n ipAddress: data.ipAddress,\n } as Record<string, any>,\n });\n }\n\n /\n The MUTATION twin of {@link logSystemContextAccess}: records an ACL-bypassing\n * `createAsSystem` / `updateAsSystem` / `updateManyAsSystem` write. A super-admin\n * -context mutation is more sensitive than a read, so it is its own event\n * (`SYSTEM_CONTEXT_WRITE`) at MEDIUM risk. Best-effort — never blocks or fails\n * the write that triggered it (the caller `.catch()`es; `_createAuditLog` is\n * fire-and-forget internally).\n /\n public async logSystemContextWrite(data: {\n resourceType: string;\n operation: CoreResourceOperation.CREATE \| CoreResourceOperation.UPDATE \| CoreResourceOperation.UPDATE_MANY;\n organizationId?: string;\n scopeContext?: Record<string, unknown>;\n /* WHICH RUNTIME performed it — see {@link logSystemContextAccess}. /\n performedByRuntime?: SystemContextAuditRuntimeAttribution;\n }): Promise<void> {\n await this._createAuditLog({\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.SYSTEM_CONTEXT_WRITE,\n eventData: {\n eventType: CoreAuditableEventType.SYSTEM_CONTEXT_WRITE,\n resourceType: data.resourceType,\n operation: data.operation,\n scopeContext: data.scopeContext,\n performedByRuntime: data.performedByRuntime,\n } as Record<string, any>,\n });\n }\n\n // ===============================\n // USER AUTHENTICATION AUDIT METHODS\n // ===============================\n\n /\n Log successful user login\n /\n public async logUserLogin(data: {\n userId: string;\n email: string;\n authMethod: string;\n ipAddress: string;\n userAgent: string;\n sessionId: string;\n organizationId?: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const typedEventData: AuditableEvent_User_LoginEventData = {\n eventType: CoreAuditableEventType.USER_LOGIN,\n userId: data.userId,\n ipAddress: data.ipAddress,\n userAgent: data.userAgent,\n authMethod: data.authMethod,\n email: data.email,\n sessionId: data.sessionId,\n };\n\n await this._createAuditLog({\n userId: data.userId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.LOW,\n eventType: CoreAuditableEventType.USER_LOGIN,\n eventData: typedEventData as Record<string, any> // Store as plain object\n }, requestExecutionContext, routingOrgIds);\n }\n\n /\n Log user logout\n /\n public async logUserLogout(data: {\n userId: string;\n ipAddress: string;\n userAgent: string;\n organizationId?: string;\n }): Promise<void> {\n const eventData: AuditableEvent_User_LogoutEventData = {\n eventType: CoreAuditableEventType.USER_LOGOUT,\n userId: data.userId,\n ipAddress: data.ipAddress,\n userAgent: data.userAgent,\n };\n\n await this._createAuditLog({\n userId: data.userId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.LOW,\n eventType: CoreAuditableEventType.USER_LOGOUT,\n eventData: eventData as Record<string, any>,\n });\n }\n\n /\n Log user login failure\n /\n public async logUserLoginFailed(data: {\n email: string;\n authMethod: string;\n failureReason: string;\n ipAddress: string;\n userAgent: string;\n attemptsRemaining?: number;\n sessionId: string;\n organizationId?: string;\n }): Promise<void> {\n // Validate with typed schema first\n const typedEventData: AuditableEvent_User_LoginFailedEventData = {\n eventType: CoreAuditableEventType.USER_LOGIN_FAILED,\n email: data.email,\n authMethod: data.authMethod,\n failureReason: data.failureReason,\n ipAddress: data.ipAddress,\n userAgent: data.userAgent,\n attemptsRemaining: data.attemptsRemaining,\n sessionId: data.sessionId,\n };\n\n await this._createAuditLog({\n userId: undefined, // No userId available for failed login (user not identified)\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.USER_LOGIN_FAILED,\n eventData: typedEventData as Record<string, any> // Store as plain object\n });\n }\n\n /\n Log user account lockout\n /\n public async logUserAccountLocked(data: {\n userId: string;\n email: string;\n authMethod: string;\n lockoutDuration: number;\n ipAddress: string;\n userAgent: string;\n sessionId: string;\n /* Which lockout mechanism tripped (session progressive limit vs global per-email rate limit). /\n reason?: AccountLockoutReason;\n organizationId?: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_User_AccountLockedEventData = {\n eventType: CoreAuditableEventType.USER_ACCOUNT_LOCKED,\n userId: data.userId,\n email: data.email,\n authMethod: data.authMethod,\n lockoutDuration: data.lockoutDuration,\n ipAddress: data.ipAddress,\n userAgent: data.userAgent,\n sessionId: data.sessionId,\n ...(data.reason !== undefined ? { reason: data.reason } : {}),\n };\n\n await this._createAuditLog({\n userId: data.userId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.HIGH,\n eventType: CoreAuditableEventType.USER_ACCOUNT_LOCKED,\n eventData: eventData\n }, requestExecutionContext, routingOrgIds);\n }\n\n // ===============================\n // MACHINE AUTHENTICATION AUDIT METHODS\n // ===============================\n\n /\n Log a SUCCESSFUL machine (non-human) authentication — an api-key / OAuth-client secret /\n * exchanged client-credentials token resolving to an ORGANIZATION_MACHINE / APPLICATION_MACHINE\n * principal. Records the credential PROVENANCE (authMethod + credentialId) + scope; never the raw\n * secret. Emitted at the OAuth token-issuance moment so it stays low-volume (per-request\n * direct-secret access instead carries this provenance onto FIELD_ACCESS rows).\n /\n public async logMachineAuthSuccess(data: {\n authMethod: string;\n credentialId: string;\n scopeType: string;\n scopeId?: string;\n resourceIdentifier?: string;\n operationIdentifier?: string;\n ipAddress?: string;\n organizationId?: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_MachineAuth_SuccessEventData = {\n eventType: CoreAuditableEventType.MACHINE_AUTH_SUCCESS,\n authMethod: data.authMethod,\n credentialId: data.credentialId,\n scopeType: data.scopeType,\n scopeId: data.scopeId,\n resourceIdentifier: data.resourceIdentifier,\n operationIdentifier: data.operationIdentifier,\n ipAddress: data.ipAddress,\n };\n\n await this._createAuditLog({\n userId: undefined, // a machine principal has no user identity\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.LOW,\n eventType: CoreAuditableEventType.MACHINE_AUTH_SUCCESS,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n /\n Log a REJECTED machine-credential presentation (bad/expired/wrong-audience/wrong-scope secret or\n * token, or a rate-limited source). Records the ATTEMPT — credential kind + prefix (never the full\n * secret), target scope, and reason — with no `credentialId` (the credential did not resolve). This\n * event stream is the per-source machine brute-force signal.\n /\n public async logMachineAuthFailed(data: {\n credentialKind: string;\n credentialPrefix?: string;\n reason: string;\n scopeType?: string;\n scopeId?: string;\n resourceIdentifier?: string;\n operationIdentifier?: string;\n ipAddress?: string;\n organizationId?: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_MachineAuth_FailedEventData = {\n eventType: CoreAuditableEventType.MACHINE_AUTH_FAILED,\n credentialKind: data.credentialKind,\n credentialPrefix: data.credentialPrefix,\n reason: data.reason,\n scopeType: data.scopeType,\n scopeId: data.scopeId,\n resourceIdentifier: data.resourceIdentifier,\n operationIdentifier: data.operationIdentifier,\n ipAddress: data.ipAddress,\n };\n\n await this._createAuditLog({\n userId: undefined,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.MACHINE_AUTH_FAILED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n /\n Log a per-request MACHINE_ACCESS — a machine principal (ORGANIZATION_MACHINE / APPLICATION_MACHINE)\n * exercised an external resource-server surface (A2A `message/send`, MCP `tools/call`, …) with an\n * already-issued, audience-bound token. The token-USE twin of {@link logMachineAuthSuccess} (token-\n * MINT): mint fires once at `/oauth/token`; THIS fires per external request so an org SIEM sees WHAT\n * a machine did, not merely that it authenticated. Records the credential PROVENANCE (authMethod +\n * credentialId), the ROLE context that authorized the access (roles are the single authorization\n * axis — there is no OAuth-scope vocabulary), and the resource server + operation targeted.\n \n Call fire-and-forget (`void logMachineAccess(...).catch(warn)`) at the controller boundary AFTER\n * the caller is authenticated + authorized — auditing must never block or fail the request. Pass\n * `routingOrgIds` = the VERIFIED org for an ORGANIZATION_MACHINE (F4 tenant-segregation: routing is\n * on the explicit verified org, never the `organizationId` data field); an APPLICATION_MACHINE has\n * no single tenant SIEM ⇒ omit it (the DB store + Layer-2 app sinks still receive the row).\n /\n public async logMachineAccess(data: {\n authMethod: string;\n credentialId: string;\n scopeType: string;\n scopeId?: string;\n roles?: string[];\n resourceServer: string;\n resourceIdentifier?: string;\n operationIdentifier: string;\n ipAddress?: string;\n organizationId?: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_MachineAccess_EventData = {\n eventType: CoreAuditableEventType.MACHINE_ACCESS,\n authMethod: data.authMethod,\n credentialId: data.credentialId,\n scopeType: data.scopeType,\n scopeId: data.scopeId,\n roles: data.roles,\n resourceServer: data.resourceServer,\n resourceIdentifier: data.resourceIdentifier,\n operationIdentifier: data.operationIdentifier,\n ipAddress: data.ipAddress,\n };\n\n await this._createAuditLog({\n userId: undefined, // a machine principal has no user identity\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.LOW,\n eventType: CoreAuditableEventType.MACHINE_ACCESS,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n /\n SIEM-2 convenience: shape + emit a MACHINE_ACCESS from an authenticated external principal\n * ({@link SocketAuthResult}) — the single source of truth for the principal→audit mapping shared\n * by EVERY external resource-server transport (A2A, MCP, …) so their audit shaping never drifts.\n * Fire-and-forget (returns void, swallows its own emission errors) — auditing must never block or\n * fail the request.\n \n ONLY machine principals (ORGANIZATION_MACHINE / APPLICATION_MACHINE) produce this event: a\n * user-delegated turn is a HUMAN action audited on the human path, so a user principal is a silent\n * no-op. A machine principal with NO credential provenance is an upstream contract violation\n * ({@link ExecutionContextCreatorBackendService.authenticateExternalToken} always sets it) — logged\n * and skipped rather than emitting fabricated attribution.\n \n F4 tenant-segregation: per-org SIEM routing uses the VERIFIED org read off `initiatorIds` (never\n * a caller-supplied data field); an APPLICATION_MACHINE has no single tenant SIEM ⇒ no per-org\n * dispatch (the DB store + Layer-2 app sinks still receive the row).\n /\n public logMachineResourceAccessFromAuth(\n auth: SocketAuthResult,\n descriptor: { resourceServer: ResourceServerKind; resourceIdentifier?: string; operationIdentifier: MachineAccessOperation; ipAddress?: string },\n ): void {\n // Wrap the ENTIRE body: this is the single choke point every external transport (A2A, MCP, …)\n // calls fire-and-forget + un-awaited, so a SYNCHRONOUS throw here (from a future edit) would\n // break every external request. Honor the documented \"auditing must never block or fail the\n // request\" contract by swallowing both the sync prologue AND the async emit failure.\n try {\n const isOrgMachine = auth.executionType === ExecutionContext_ExecutionType.ORGANIZATION_MACHINE;\n const isMachine = isOrgMachine \|\| auth.executionType === ExecutionContext_ExecutionType.APPLICATION_MACHINE;\n if (!isMachine) return; // user-delegated turns are audited as human actions, not machine access\n\n const credential = auth.initiatorIds?.machineCredential;\n if (!credential) {\n this.logger.warn?.('Machine principal missing machineCredential provenance — skipping MACHINE_ACCESS audit', {\n executionType: auth.executionType,\n resourceServer: descriptor.resourceServer,\n });\n return;\n }\n\n const scopeId = isOrgMachine ? auth.initiatorIds?.organizationId : auth.initiatorIds?.applicationId;\n const roles = (auth.initiatorRoles ?? []).flatMap((r) => r.roles);\n const routingOrgIds: VerifiedOrgId[] \| undefined =\n isOrgMachine && auth.initiatorIds?.organizationId ? [auth.initiatorIds.organizationId as VerifiedOrgId] : undefined;\n\n void this.logMachineAccess({\n authMethod: credential.authMethod,\n credentialId: credential.credentialId,\n scopeType: auth.executionType,\n scopeId,\n roles,\n resourceServer: descriptor.resourceServer,\n resourceIdentifier: descriptor.resourceIdentifier,\n operationIdentifier: descriptor.operationIdentifier,\n ipAddress: descriptor.ipAddress,\n organizationId: isOrgMachine ? auth.initiatorIds?.organizationId : undefined,\n }, undefined, routingOrgIds).catch((auditError) => this.logger.warn?.('MACHINE_ACCESS audit emit failed (non-fatal)', {\n resourceServer: descriptor.resourceServer,\n ...projectCaughtErrorLogFields(auditError),\n }));\n } catch (syncError) {\n this.logger.warn?.('MACHINE_ACCESS audit shaping failed synchronously (non-fatal)', {\n resourceServer: descriptor.resourceServer,\n ...projectCaughtErrorLogFields(syncError),\n });\n }\n }\n\n // ===============================\n // OAUTH2 / OIDC PROVIDER AUDIT METHODS (Wildo AS the authorization server)\n // ===============================\n //\n // These record the app-issued OAuth2/OIDC provider surface. Every method is fire-and-forget\n // (`_createAuditLog` swallows + logs its own failures) — auditing must never block or fail the\n // request that triggered it; callers invoke `void logOAuth(…).catch(warn)`.\n //\n // F4 SIEM routing: these provider flows are Bearer/consent-token driven and often carry no single\n // VERIFIED tenant org at the emit site (a user may belong to many orgs; a client may be app-scoped),\n // so per-org SIEM dispatch is opt-in — pass `routingOrgIds`/`requestExecutionContext` ONLY when a\n // verified org is genuinely in scope, else the always-on DB store + Layer-2 immudb sink still record\n // the event (fail-closed on per-org dispatch, never on the authoritative record).\n\n /*\n A-1 — a user-delegated `authorization_code` access token was minted for a third-party client. The\n * flagship provider grant: the client can now act AS the user at the bound A2A/MCP resource.\n * assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — third-party delegated user-acting access.\n /\n public async logOAuthDelegatedTokenIssued(data: {\n userId: string;\n clientId: string;\n audience: string;\n scopes: string[];\n ttlSeconds: number;\n ipAddress?: string;\n organizationId?: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_OAuth_DelegatedTokenIssuedEventData = {\n eventType: CoreAuditableEventType.OAUTH_DELEGATED_TOKEN_ISSUED,\n userId: data.userId,\n clientId: data.clientId,\n audience: data.audience,\n scopes: data.scopes,\n ttlSeconds: data.ttlSeconds,\n ipAddress: data.ipAddress,\n };\n await this._createAuditLog({\n userId: data.userId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.OAUTH_DELEGATED_TOKEN_ISSUED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n /\n A-2 — a user APPROVED an interactive consent request (a code is issued; the client may act for them).\n * assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — user authorizes third-party delegated access.\n /\n public async logOAuthConsentGranted(data: {\n userId: string;\n clientId: string;\n scopes: string[];\n resource?: string;\n remembered: boolean;\n ipAddress?: string;\n organizationId?: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_OAuth_ConsentGrantedEventData = {\n eventType: CoreAuditableEventType.OAUTH_CONSENT_GRANTED,\n userId: data.userId,\n clientId: data.clientId,\n scopes: data.scopes,\n resource: data.resource,\n remembered: data.remembered,\n ipAddress: data.ipAddress,\n };\n await this._createAuditLog({\n userId: data.userId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.OAUTH_CONSENT_GRANTED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n /\n A-2 — a user DENIED an interactive consent request (access refused; protective).\n * assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — user refuses third-party delegated access.\n /\n public async logOAuthConsentDenied(data: {\n userId: string;\n clientId: string;\n scopes: string[];\n resource?: string;\n ipAddress?: string;\n organizationId?: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_OAuth_ConsentDeniedEventData = {\n eventType: CoreAuditableEventType.OAUTH_CONSENT_DENIED,\n userId: data.userId,\n clientId: data.clientId,\n scopes: data.scopes,\n resource: data.resource,\n ipAddress: data.ipAddress,\n };\n await this._createAuditLog({\n userId: data.userId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.LOW,\n eventType: CoreAuditableEventType.OAUTH_CONSENT_DENIED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n /\n A-3 — a persistent \"remember this app\" consent grant was created or its scopes widened. It lets\n * future authorize flows SKIP the consent prompt, so its creation is a durable-authority audit concern.\n * assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — persistent delegated-access authorization.\n /\n public async logOAuthConsentGrantPersisted(data: {\n userId: string;\n clientId: string;\n resource?: string;\n scopes: string[];\n isNewGrant: boolean;\n organizationId?: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_OAuth_ConsentGrantPersistedEventData = {\n eventType: CoreAuditableEventType.OAUTH_CONSENT_GRANT_PERSISTED,\n userId: data.userId,\n clientId: data.clientId,\n resource: data.resource,\n scopes: data.scopes,\n isNewGrant: data.isNewGrant,\n };\n await this._createAuditLog({\n userId: data.userId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.OAUTH_CONSENT_GRANT_PERSISTED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n /\n A URL-formatted (CIMD) `client_id` was refused at the authorize endpoint.\n \n No `userId` and no organization: the refusal happens while resolving the CLIENT, before any\n * user is bound to the request. HIGH risk because the reason vocabulary spans a misconfiguration\n * (`host_not_allowed`) and an active attack (`ssrf_target_refused`), and only the reason tells\n * them apart — an operator watching this event is watching for the second.\n \n assurance-control: WILDO.IDENTITY.CLIENT_IDENTITY_ASSERTION — a client identity assertion was\n * rejected.\n /\n public async logCimdClientRefused(data: {\n clientId: string;\n reason: string;\n detail?: string;\n }, requestExecutionContext?: ExecutionContext<any>): Promise<void> {\n const eventData: AuditableEvent_OAuth_CimdClientRefusedEventData = {\n eventType: CoreAuditableEventType.OAUTH_CIMD_CLIENT_REFUSED,\n clientId: data.clientId,\n reason: data.reason,\n detail: data.detail,\n };\n await this._createAuditLog({\n riskLevel: ResourceOperationRiskLevel.HIGH,\n eventType: CoreAuditableEventType.OAUTH_CIMD_CLIENT_REFUSED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext);\n }\n\n /\n An anonymous caller registered an OAuth client at `/oauth/register` (RFC 7591).\n \n No `userId` and no organization, because there is no principal — that absence IS the finding,\n * and it is why the source IP and the self-asserted metadata are carried instead. HIGH risk not\n * because one registration is dangerous (the client is confined to identity scopes, no roles, and\n * always faces consent) but because this is the only unauthenticated write in the application and\n * an operator must be able to see the population it produces.\n \n assurance-control: WILDO.IDENTITY.CLIENT_IDENTITY_ASSERTION — a client identity was created by\n * a party that authenticated to nothing.\n /\n public async logDynamicClientRegistered(data: {\n clientId: string;\n clientName: string;\n redirectUris: string[];\n postLogoutRedirectUris: string[];\n ipAddress?: string;\n }, requestExecutionContext?: ExecutionContext<any>): Promise<void> {\n const eventData: AuditableEvent_OAuth_DynamicClientRegisteredEventData = {\n eventType: CoreAuditableEventType.OAUTH_DYNAMIC_CLIENT_REGISTERED,\n clientId: data.clientId,\n clientName: data.clientName,\n redirectUris: data.redirectUris,\n // revocation-C: the RP-Initiated Logout post-logout allowlist the client registered (may be empty).\n postLogoutRedirectUris: data.postLogoutRedirectUris,\n ipAddress: data.ipAddress,\n };\n await this._createAuditLog({\n riskLevel: ResourceOperationRiskLevel.HIGH,\n eventType: CoreAuditableEventType.OAUTH_DYNAMIC_CLIENT_REGISTERED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext);\n }\n\n /\n A-4 — a user token was rotated via the provider `refresh_token` grant (`/oauth/token`).\n * assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — token lifecycle (refresh).\n /\n public async logOAuthTokenRefreshed(data: {\n userId?: string;\n clientId?: string;\n clientAuthenticated: boolean;\n ipAddress?: string;\n organizationId?: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_OAuth_TokenRefreshedEventData = {\n eventType: CoreAuditableEventType.OAUTH_TOKEN_REFRESHED,\n userId: data.userId,\n clientId: data.clientId,\n clientAuthenticated: data.clientAuthenticated,\n ipAddress: data.ipAddress,\n };\n await this._createAuditLog({\n userId: data.userId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.LOW,\n eventType: CoreAuditableEventType.OAUTH_TOKEN_REFRESHED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n /\n A-5 — a token was revoked via `/oauth/revoke` (RFC 7009). No-oracle: records the attempt + the\n * authenticated client only, never whether the token existed or whose it was.\n * assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — token lifecycle (revocation).\n /\n public async logOAuthTokenRevoked(data: {\n clientId?: string;\n clientAuthenticated: boolean;\n tokenTypeHint?: string;\n ipAddress?: string;\n organizationId?: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_OAuth_TokenRevokedEventData = {\n eventType: CoreAuditableEventType.OAUTH_TOKEN_REVOKED,\n clientId: data.clientId,\n clientAuthenticated: data.clientAuthenticated,\n tokenTypeHint: data.tokenTypeHint,\n ipAddress: data.ipAddress,\n };\n await this._createAuditLog({\n userId: undefined,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.LOW,\n eventType: CoreAuditableEventType.OAUTH_TOKEN_REVOKED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n /\n revocation-C — an OIDC RP-Initiated Logout terminated the End-User's OP session at\n * `/oauth/end-session`. Unlike the RFC 7009 token-revoke above (a no-oracle attempt), this DOES carry the\n * subject: a valid `id_token_hint` names whose session ended. Records the terminated session, the\n * initiating relying party, and whether a session was actually ended / a post-logout redirect refused.\n * assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — per-session revocation (RP-Initiated Logout).\n /\n public async logOAuthRpInitiatedLogout(data: {\n userId?: string;\n sessionId?: string;\n clientId?: string;\n sessionTerminated: boolean;\n postLogoutRedirectUriRejected: boolean;\n ipAddress?: string;\n organizationId?: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_OAuth_RpInitiatedLogoutEventData = {\n eventType: CoreAuditableEventType.OAUTH_RP_INITIATED_LOGOUT,\n userId: data.userId,\n sessionId: data.sessionId,\n clientId: data.clientId,\n sessionTerminated: data.sessionTerminated,\n postLogoutRedirectUriRejected: data.postLogoutRedirectUriRejected,\n ipAddress: data.ipAddress,\n };\n await this._createAuditLog({\n userId: data.userId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.LOW,\n eventType: CoreAuditableEventType.OAUTH_RP_INITIATED_LOGOUT,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n /\n A-6 — an `authorization_code` exchange was REJECTED (replay / PKCE failure / redirect mismatch / …).\n * A potential attack signal; the specific cause is the closed-vocabulary `reason`.\n * assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — failed delegated-auth exchange / monitoring.\n /\n public async logOAuthCodeExchangeFailed(data: {\n reason: OAuthCodeExchangeFailureReason;\n clientId?: string;\n userId?: string;\n resource?: string;\n ipAddress?: string;\n organizationId?: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_OAuth_CodeExchangeFailedEventData = {\n eventType: CoreAuditableEventType.OAUTH_CODE_EXCHANGE_FAILED,\n reason: data.reason,\n clientId: data.clientId,\n userId: data.userId,\n resource: data.resource,\n ipAddress: data.ipAddress,\n };\n await this._createAuditLog({\n userId: data.userId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.OAUTH_CODE_EXCHANGE_FAILED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n /\n A-8 — a consent DECISION was submitted by an authenticated user who is NOT the consent request's\n * bound user (403). A textbook cross-user authorization-abuse signal (user A acting on user B's consent).\n * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT — authorization-decision violation, fail-closed.\n /\n public async logOAuthConsentBindingViolation(data: {\n authenticatedUserId: string;\n boundUserId: string;\n clientId?: string;\n consentTokenId?: string;\n ipAddress?: string;\n organizationId?: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_OAuth_ConsentBindingViolationEventData = {\n eventType: CoreAuditableEventType.OAUTH_CONSENT_BINDING_VIOLATION,\n authenticatedUserId: data.authenticatedUserId,\n boundUserId: data.boundUserId,\n clientId: data.clientId,\n consentTokenId: data.consentTokenId,\n ipAddress: data.ipAddress,\n };\n await this._createAuditLog({\n // The event is ABOUT the actor (the authenticated user who attempted the cross-user decision).\n userId: data.authenticatedUserId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.HIGH,\n eventType: CoreAuditableEventType.OAUTH_CONSENT_BINDING_VIOLATION,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n /\n A-9 — refresh-token REUSE was detected → the token family was revoked (possible theft). Emitted by the\n * refresh CALLERS (the token issuer stays audit-free by design and surfaces a reuse SIGNAL instead —\n * `extractRefreshTokenReuseSignal`). Applies to both the first-party session refresh and the OAuth\n * provider refresh grant (shared issuer).\n * assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — credential-theft detection + response.\n /\n public async logUserRefreshTokenReuseDetected(data: {\n userId: string;\n reusedJti: string;\n sessionId?: string;\n familyRevoked: boolean;\n ipAddress?: string;\n organizationId?: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_User_RefreshTokenReuseDetectedEventData = {\n eventType: CoreAuditableEventType.USER_REFRESH_TOKEN_REUSE_DETECTED,\n userId: data.userId,\n reusedJti: data.reusedJti,\n sessionId: data.sessionId,\n familyRevoked: data.familyRevoked,\n ipAddress: data.ipAddress,\n };\n await this._createAuditLog({\n userId: data.userId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.HIGH,\n eventType: CoreAuditableEventType.USER_REFRESH_TOKEN_REUSE_DETECTED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n // ===============================\n // FIELD ACCESS AUDIT METHODS\n // ===============================\n\n /\n Log the disclosure of a sensitive field.\n \n Called from `logAuditAccessForFields` for two disjoint markers:\n * `isBackendOnly({ isReturnedAtCreation: true })` on a CREATE response (the stored artifact at\n * first exposure, e.g. `hashedKey`), and `.isEphemeral()` on ANY operation (the secret actually\n * handed to the caller, e.g. `plainKey` on `create` / `rotate` / `regenerate`). Read\n * `isCreateOperation` to tell the two apart on a row.\n \n `fieldName` is a NAME, never a value. This method must never be extended to carry the\n * field's contents: rows replicate to the per-org SIEM and to the immutable ledger, which cannot\n * be scrubbed — recording the secret would turn the record of a disclosure into a second,\n * permanent copy of it.\n \n assurance-control: WILDO.SECRETS.DISCLOSURE_AUDIT — disclosure of server-minted secret\n * material is attributable to a principal.\n /\n public async logFieldAccess(data: {\n fieldName: string;\n resourceType: ResourceType;\n resourceId?: string;\n userId?: string;\n organizationId?: string;\n applicationId?: string;\n operationIdentifier: string;\n isCreateOperation: boolean;\n /* Machine-credential provenance when the accessor is a machine principal (api-key / OAuth client). /\n machineCredentialAuthMethod?: string;\n machineCredentialId?: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_FieldAccess_EventData = {\n eventType: CoreAuditableEventType.FIELD_ACCESS,\n fieldName: data.fieldName,\n resourceType: data.resourceType,\n resourceId: data.resourceId,\n operationIdentifier: data.operationIdentifier,\n isCreateOperation: data.isCreateOperation,\n machineCredentialAuthMethod: data.machineCredentialAuthMethod,\n machineCredentialId: data.machineCredentialId,\n };\n\n await this._createAuditLog({\n userId: data.userId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM, // Field access is medium risk\n eventType: CoreAuditableEventType.FIELD_ACCESS,\n eventData: eventData as Record<string, any>\n }, requestExecutionContext, routingOrgIds);\n }\n\n /\n Record that a resource operation TOOK EFFECT — the operation-triggered counterpart to\n * {@link logFieldAccess}.\n \n ## Why this exists next to `logFieldAccess` rather than inside it\n \n `logFieldAccess` is triggered by a decorated RESPONSE FIELD, so it is structurally blind to any\n * operation whose response carries none. Repo-wide that trigger is declared on FOUR fields (three\n * secret families, CREATE-only), which left an 83-resource catalogue with no evidence for role\n * changes, suspensions, credential deletion or tenant deletion. Folding \"an operation happened\"\n * into \"a field was disclosed\" would merge two genuinely different claims; they stay separate\n * events with separate triggers.\n \n ## Emit AFTER the write commits\n \n Called from the framework-managed POST-COMMIT effects lane. An event recorded ahead of the write\n * would survive a rollback and assert a change that never happened — the same rule\n * {@link logUserAppRolesChanged} states, and the reason this event carries no `outcome`\n * discriminator: this call site can only ever observe success.\n \n ## Attribution splits, like the other admin-action events\n \n The row's `userId` is the ACTOR (what \"who did this\" queries filter on); the SUBJECT rides\n * `eventData.resourceId`. `riskLevel` is the OPERATION's declared risk, carried through unchanged\n * so an auditor can filter the trail by the same danger axis the UI and MCP adapter use.\n \n The request execution context is forwarded so per-org SIEM fan-out routes on the AUTHENTICATED\n * org, never a caller-supplied field (F4 tenant segregation). Internal and repository-only\n * surfaces carry no authenticated org and therefore no per-org dispatch — the always-on DB store\n * and the immutable ledger still receive them, which is the correct fail-closed shape.\n \n assurance-control: WILDO.AUDIT.EVIDENCE_INTEGRITY — privileged actions on\n * resources are attributable, and the authorization effect of each is reconstructable.\n /\n public async logResourceOperationPerformed(\n data: Omit<AuditableEvent_ResourceOperationPerformed_EventData, 'eventType'> & {\n /* The OPERATION's declared risk level, carried onto the row unchanged. /\n riskLevel: ResourceOperationRiskLevel;\n /* The ACTOR. Absent on internal/system paths, which have no human to name. /\n actorUserId?: string;\n /* Tenant scope the event is ABOUT (event data — never a SIEM routing key). /\n organizationId?: string;\n applicationId?: string;\n },\n requestExecutionContext?: ExecutionContext<any>,\n ): Promise<void> {\n const { riskLevel, actorUserId, organizationId, applicationId, ...eventFields } = data;\n\n const eventData: AuditableEvent_ResourceOperationPerformed_EventData = {\n eventType: CoreAuditableEventType.RESOURCE_OPERATION_PERFORMED,\n ...eventFields,\n };\n\n await this._createAuditLog({\n userId: actorUserId,\n organizationId,\n applicationId,\n riskLevel,\n eventType: CoreAuditableEventType.RESOURCE_OPERATION_PERFORMED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext);\n }\n\n /\n Record an APPLICATION-WIDE directory enumeration.\n \n See {@link CoreAuditableEventType.PLATFORM_DIRECTORY_ACCESS} for why this is not the\n * cross-tenant event: there is no target tenant, because the read spans all of them.\n \n No `organizationId` is set, and that absence is meaningful rather than an omission — the SIEM\n * routing key would otherwise claim the read belonged to whichever tenant the operator happened to\n * be acting in, which is the one thing this event exists to contradict.\n /\n public async logPlatformDirectoryAccess(\n data: Omit<AuditableEvent_PlatformDirectoryAccess_EventData, 'eventType'> & {\n /* The ACTOR. Absent on paths with no human to name. /\n actorUserId?: string;\n applicationId?: string;\n },\n requestExecutionContext?: ExecutionContext<any>,\n ): Promise<void> {\n const { actorUserId, applicationId, ...eventFields } = data;\n\n const eventData: AuditableEvent_PlatformDirectoryAccess_EventData = {\n eventType: CoreAuditableEventType.PLATFORM_DIRECTORY_ACCESS,\n ...eventFields,\n };\n\n await this._createAuditLog({\n userId: actorUserId,\n applicationId,\n riskLevel: ResourceOperationRiskLevel.LOW,\n eventType: CoreAuditableEventType.PLATFORM_DIRECTORY_ACCESS,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext);\n }\n\n /\n Record a read THROUGH an HTTP-API resource binding — rows left an EXTERNAL system via the\n * engine's read-through repository (ETL plan D8/R6; see\n * {@link CoreAuditableEventType.HTTP_API_READ_THROUGH_ACCESS} for the vocabulary argument).\n \n The top-level `userId` is the REAL initiating user (R12): every remote call under a\n * SERVICE_PRINCIPAL binding authenticates as one service account, and this row is what keeps\n * attribution alive through that shared principal. `organizationId` rides `eventData` for the\n * queryable trail; the SIEM routing org comes from the authenticated request context inside\n * `_createAuditLog`, as for every other event.\n \n assurance-control: WILDO.AUDIT.ATTRIBUTION — external read-through access recorded with the\n * real initiating user carried through the shared service principal.\n /\n public async logHttpApiReadThroughAccess(\n data: Omit<AuditableEvent_HttpApiReadThroughAccess_EventData, 'eventType'>,\n requestExecutionContext?: ExecutionContext<any>,\n ): Promise<void> {\n const eventData: AuditableEvent_HttpApiReadThroughAccess_EventData = {\n eventType: CoreAuditableEventType.HTTP_API_READ_THROUGH_ACCESS,\n ...data,\n };\n\n await this._createAuditLog({\n userId: data.initiatorUserId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.LOW,\n eventType: CoreAuditableEventType.HTTP_API_READ_THROUGH_ACCESS,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext);\n }\n\n /\n Record ONE outbound call to a third-party provider — the trail behind\n * {@link CoreAuditableEventType.PROVIDER_OPERATION_CALL}, emitted by the provider-operation\n * executor on both the success and the failure path.\n \n The top-level `userId` is the REAL initiating user, and `organizationId` is the tenant the\n * REQUEST was scoped to — NOT the tenant whose account was spent. Those two differ exactly where\n * it matters: one user action fanning out to every organization that user belongs to spends N\n * accounts under one initiating scope, and the account actually spent rides\n * `eventData.connectionOwnerScope` / `connectionOwnerId`. Writing the connection owner into the\n * row's `organizationId` would make the fan-out's calls read as if each had been requested by the\n * tenant it reached.\n \n `riskLevel` is per-emission because the static severity cannot be: an outbound WRITE to a third\n * party is a materially different act from a read, and the operation catalogue's own\n * classification vocabulary says so (\"a caller decides retry-safety, an audit decides severity\").\n * MEDIUM for a WRITE, LOW for a READ — the same shape `COLLECTION_DATA_EXPORT` uses to separate a\n * page download from a whole-table dump without splitting the event type.\n \n assurance-control: WILDO.AUDIT.ATTRIBUTION — an outbound provider call made on a user's behalf\n * is recorded with the real initiating user beside the account it spent.\n /\n public async logProviderOperationCall(\n data: Omit<AuditableEvent_ProviderOperationCall_EventData, 'eventType'>,\n requestExecutionContext?: ExecutionContext<any>,\n ): Promise<void> {\n const eventData: AuditableEvent_ProviderOperationCall_EventData = {\n eventType: CoreAuditableEventType.PROVIDER_OPERATION_CALL,\n ...data,\n };\n\n await this._createAuditLog({\n userId: data.initiatorUserId,\n organizationId: data.organizationId,\n riskLevel: data.classification === ExternalOperation_Classification.WRITE\n ? ResourceOperationRiskLevel.MEDIUM\n : ResourceOperationRiskLevel.LOW,\n eventType: CoreAuditableEventType.PROVIDER_OPERATION_CALL,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext);\n }\n\n /\n Record that an AGENT reached an MCP server on somebody's behalf (#491) — the outbound trail for\n * a tool call that leaves the trust boundary.\n \n One row per ATTEMPT, whatever the outcome. Recording only what worked would hide precisely what\n * a reviewer looks for first: the refused targets, the calls that timed out, and the tools that\n * answered with their own error. `outcome` carries the client's own vocabulary so the trail and\n * the logs use the same words for the same thing.\n \n The top-level `userId` is the REAL initiating user and `organizationId` the tenant the TURN was\n * scoped to — never the tenant whose credential was spent, which rides\n * `eventData.connectionOwnerScope`. Same separation as the provider-call sibling above, for the\n * same reason.\n \n `riskLevel` is per-emission and keys on the OUTCOME rather than on a declared verb, because an\n * MCP tool has no declared verb: the tool list is discovered from the server at turn start and\n * nothing says whether a tool reads or writes. MEDIUM for a refused target — an attempted egress a\n * guard blocked is the row a reviewer wants raised — and LOW for everything else, including\n * ordinary failures, which are noise until somebody is looking for them.\n \n assurance-control: WILDO.AUDIT.ATTRIBUTION — an agent's outbound tool call is recorded with the\n * real initiating user beside the account it spent.\n /\n public async logMcpToolCall(\n data: Omit<AuditableEvent_McpToolCall_EventData, 'eventType'>,\n requestExecutionContext?: ExecutionContext<any>,\n ): Promise<void> {\n const eventData: AuditableEvent_McpToolCall_EventData = {\n eventType: CoreAuditableEventType.MCP_TOOL_CALL,\n ...data,\n };\n\n await this._createAuditLog({\n userId: data.initiatorUserId,\n organizationId: data.organizationId,\n riskLevel: data.outcome === McpOutcomeKind.REFUSED_TARGET\n ? ResourceOperationRiskLevel.MEDIUM\n : ResourceOperationRiskLevel.LOW,\n eventType: CoreAuditableEventType.MCP_TOOL_CALL,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext);\n }\n\n /\n Record that a human approver AUTHORED the arguments an approval-gated tool then ran with (#566).\n \n One row per MODIFIED approval. An approval that ran the call as proposed writes nothing here —\n * this event answers \"who wrote the arguments\", and an approval that changed none did not.\n \n The top-level `userId` is the APPROVER, which on this plane is the only identity that can exist:\n * a turn whose principal cannot answer a decision is denied rather than suspended, so nobody but a\n * present, accountable human ever reaches this method.\n \n `riskLevel` is HIGH and does not vary. Every other per-emission risk level in this service keys\n * on something the act might or might not have been; there is no such axis here, because the act\n * itself is the whole finding — a person substituted their own arguments for the model's on a tool\n * an author gated precisely because it was dangerous enough to need a human.\n \n assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT — an authorization decision that\n * REWROTE the act it authorized is recorded with the person who wrote it.\n /\n public async logAgentToolApprovalModified(\n data: Omit<AuditableEvent_AgentToolApprovalModified_EventData, 'eventType'>,\n requestExecutionContext?: ExecutionContext<any>,\n ): Promise<void> {\n const eventData: AuditableEvent_AgentToolApprovalModified_EventData = {\n eventType: CoreAuditableEventType.AGENT_TOOL_APPROVAL_MODIFIED,\n ...data,\n };\n\n await this._createAuditLog({\n userId: data.approverUserId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.HIGH,\n eventType: CoreAuditableEventType.AGENT_TOOL_APPROVAL_MODIFIED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext);\n }\n\n /\n Record that a subject erasure invoked an HTTP_API binding's DECLARED external-erasure\n * operation (ETL D6 stance 6b) — remote rows linked to the erased subject were deleted in a\n * system the platform does not own. The erasure report is the per-request receipt; this row is\n * the queryable trail of the outbound write.\n \n No top-level `userId`: the erasure runs as a system operation, and the SUBJECT is named in\n * `eventData.subjectIds` — writing the subject into `userId` would misattribute the deletion to\n * the person it served.\n \n assurance-control: WILDO.AUDIT.ATTRIBUTION — every outbound deletion on the read-through\n * plane is recorded with the subject it served and the external system it reached.\n /\n public async logHttpApiExternalErasure(\n data: Omit<AuditableEvent_HttpApiExternalErasure_EventData, 'eventType'>,\n requestExecutionContext?: ExecutionContext<any>,\n ): Promise<void> {\n const eventData: AuditableEvent_HttpApiExternalErasure_EventData = {\n eventType: CoreAuditableEventType.HTTP_API_EXTERNAL_ERASURE,\n ...data,\n };\n\n await this._createAuditLog({\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.HTTP_API_EXTERNAL_ERASURE,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext);\n }\n\n /\n Record that a subject erasure COMPLETED while rows linked to the subject remain live in an\n * HTTP_API-bound external system, on the controller's explicit per-request acknowledgement\n * (ETL D6 stance 6c). THE RECORD IS THE CONTROL — the acknowledgement's justification is that\n * the hole becomes visible rather than prevented (`administrative-continuity-floors.md`), so a\n * failure to emit here would remove the control itself; callers still treat it best-effort\n * (the erasure is already committed and correct), but the incomplete-effects report carries the\n * same fact as a second channel.\n \n assurance-control: WILDO.AUDIT.ATTRIBUTION — an acknowledged erasure hole is recorded per\n * resource per erasure request, never as a standing posture.\n /\n public async logHttpApiNonErasureAcknowledged(\n data: Omit<AuditableEvent_HttpApiNonErasureAcknowledged_EventData, 'eventType'>,\n requestExecutionContext?: ExecutionContext<any>,\n ): Promise<void> {\n const eventData: AuditableEvent_HttpApiNonErasureAcknowledged_EventData = {\n eventType: CoreAuditableEventType.HTTP_API_NON_ERASURE_ACKNOWLEDGED,\n ...data,\n };\n\n await this._createAuditLog({\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.HIGH,\n eventType: CoreAuditableEventType.HTTP_API_NON_ERASURE_ACKNOWLEDGED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext);\n }\n\n /\n Record an operation the authorizer REFUSED — the negative access decision.\n \n The twin of {@link logResourceOperationPerformed}, emitted from the opposite side of dispatch:\n * that one fires post-commit for work that happened, this one fires pre-dispatch for work that was\n * stopped. Together they discharge `CLAUDE.md`'s \"record access decisions\" — previously only the\n * fail-closed half of that sentence was implemented, and a refused HIGH/CRITICAL action left no\n * evidence at all.\n \n `riskLevel` is the REFUSED operation's declared level and rides the row for danger grading; it\n * does NOT gate emission (every denial is recorded — see the event-data schema for why a risk\n * floor is the wrong control here) and it does NOT affect the row's `severity`, which is a pure\n * function of the event type.\n \n Best-effort like every other emitter here: `_createAuditLog` swallows its own store failure and\n * increments `audit_store_failure_total`. A failure to record the refusal must never turn a clean\n * 403 into a 500 — the caller was already correctly refused.\n \n assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT — access-control decisions,\n * including refusals, are attributable and reviewable.\n /\n public async logResourceOperationDenied(\n data: Omit<AuditableEvent_ResourceOperationDenied_EventData, 'eventType'> & {\n /* The REFUSED operation's declared risk level, carried onto the row unchanged. /\n riskLevel: ResourceOperationRiskLevel;\n /* The refused ACTOR. Absent when the refusal WAS the absence of an identity. /\n actorUserId?: string;\n /* Tenant scope the event is ABOUT (event data — never a SIEM routing key). /\n organizationId?: string;\n applicationId?: string;\n },\n requestExecutionContext?: ExecutionContext<any>,\n ): Promise<void> {\n const { riskLevel, actorUserId, organizationId, applicationId, ...eventFields } = data;\n\n const eventData: AuditableEvent_ResourceOperationDenied_EventData = {\n eventType: CoreAuditableEventType.RESOURCE_OPERATION_DENIED,\n ...eventFields,\n };\n\n await this._createAuditLog({\n userId: actorUserId,\n organizationId,\n applicationId,\n riskLevel,\n eventType: CoreAuditableEventType.RESOURCE_OPERATION_DENIED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext);\n }\n\n // ===============================\n // SSO AUTHENTICATION AUDIT METHODS (Step 18)\n // ===============================\n\n /\n Log successful SSO login (distinct from USER_LOGIN — captures provider ref, connection type)\n /\n public async logUserSSOLogin(data: {\n userId: string;\n email: string;\n providerRef: string;\n connectionType: SsoConnectionType;\n authSource?: string;\n scopeType?: AuthScopeType;\n organizationId?: string;\n applicationId?: string;\n ipAddress: string;\n userAgent: string;\n sessionId: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_User_SSOLoginEventData = {\n eventType: CoreAuditableEventType.USER_SSO_LOGIN,\n userId: data.userId,\n email: data.email,\n providerRef: data.providerRef,\n connectionType: data.connectionType,\n authSource: data.authSource,\n scopeType: data.scopeType,\n organizationId: data.organizationId,\n applicationId: data.applicationId,\n ipAddress: data.ipAddress,\n userAgent: data.userAgent,\n sessionId: data.sessionId,\n };\n\n await this._createAuditLog({\n userId: data.userId,\n organizationId: data.organizationId,\n applicationId: data.applicationId,\n riskLevel: ResourceOperationRiskLevel.LOW,\n eventType: CoreAuditableEventType.USER_SSO_LOGIN,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n /\n Log SSO login failure (with failure reason: enforcement blocked, IdP error, etc.)\n /\n public async logUserSSOLoginFailed(data: {\n email?: string;\n providerRef?: string;\n connectionType?: SsoConnectionType;\n authSource?: string;\n failureReason: string;\n scopeType?: AuthScopeType;\n organizationId?: string;\n applicationId?: string;\n ipAddress: string;\n userAgent: string;\n }): Promise<void> {\n const eventData: AuditableEvent_User_SSOLoginFailedEventData = {\n eventType: CoreAuditableEventType.USER_SSO_LOGIN_FAILED,\n email: data.email,\n providerRef: data.providerRef,\n connectionType: data.connectionType,\n authSource: data.authSource,\n failureReason: data.failureReason,\n scopeType: data.scopeType,\n organizationId: data.organizationId,\n applicationId: data.applicationId,\n ipAddress: data.ipAddress,\n userAgent: data.userAgent,\n };\n\n await this._createAuditLog({\n userId: undefined,\n organizationId: data.organizationId,\n applicationId: data.applicationId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.USER_SSO_LOGIN_FAILED,\n eventData: eventData as Record<string, any>,\n });\n }\n\n /\n Log SSO enforcement blocked (social SSO rejected due to org enforcement — the C4 scenario)\n /\n public async logUserSSOEnforcementBlocked(data: {\n email: string;\n attemptedProviderRef: string;\n attemptedConnectionType: SsoConnectionType;\n organizationId: string;\n enforcementPolicy: string;\n ipAddress: string;\n userAgent: string;\n }): Promise<void> {\n const eventData: AuditableEvent_User_SSOEnforcementBlockedEventData = {\n eventType: CoreAuditableEventType.USER_SSO_ENFORCEMENT_BLOCKED,\n email: data.email,\n attemptedProviderRef: data.attemptedProviderRef,\n attemptedConnectionType: data.attemptedConnectionType,\n organizationId: data.organizationId,\n enforcementPolicy: data.enforcementPolicy,\n ipAddress: data.ipAddress,\n userAgent: data.userAgent,\n };\n\n await this._createAuditLog({\n userId: undefined,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.HIGH,\n eventType: CoreAuditableEventType.USER_SSO_ENFORCEMENT_BLOCKED,\n eventData: eventData as Record<string, any>,\n });\n }\n\n /\n Log token refresh (security-relevant for enterprise)\n /\n public async logUserTokenRefreshed(data: {\n userId: string;\n sessionId: string;\n organizationId?: string;\n ipAddress: string;\n userAgent: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_User_TokenRefreshedEventData = {\n eventType: CoreAuditableEventType.USER_TOKEN_REFRESHED,\n userId: data.userId,\n sessionId: data.sessionId,\n ipAddress: data.ipAddress,\n userAgent: data.userAgent,\n };\n\n await this._createAuditLog({\n userId: data.userId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.LOW,\n eventType: CoreAuditableEventType.USER_TOKEN_REFRESHED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n /\n Log that the application booted with no administratively usable super-administrator.\n \n Unlike every other event on this service, this one records a STATE rather than an action, and it\n * has no actor: nobody performed it through a guarded path — the write guards refuse to create this\n * state — so its existence means it arrived by a database edit, a restore, a seed that authored no\n * administrator, or a role-table change that redefined which roles confer super-admin. `userId` is\n * therefore deliberately absent rather than filled with a placeholder.\n \n `riskLevel: CRITICAL` because the condition is unrecoverable in-product: every door that could\n * appoint a new administrator is itself gated on the missing role.\n \n assurance-control: WILDO.ACCESS.ADMINISTRATIVE_CONTINUITY — evidence that the application has no\n * accountable administrative principal.\n /\n public async logApplicationSuperAdminFloorBreached(data: {\n usableSuperAdminCount: number;\n requiredUsableSuperAdminCount: number;\n conferringRoles: string[];\n usableStatuses: string[];\n }, requestExecutionContext?: ExecutionContext<any>): Promise<void> {\n const eventData: AuditableEvent_Application_SuperAdminFloorBreachedEventData = {\n eventType: CoreAuditableEventType.APPLICATION_SUPER_ADMIN_FLOOR_BREACHED,\n usableSuperAdminCount: data.usableSuperAdminCount,\n requiredUsableSuperAdminCount: data.requiredUsableSuperAdminCount,\n conferringRoles: data.conferringRoles,\n usableStatuses: data.usableStatuses,\n };\n\n await this._createAuditLog({\n riskLevel: ResourceOperationRiskLevel.CRITICAL,\n eventType: CoreAuditableEventType.APPLICATION_SUPER_ADMIN_FLOOR_BREACHED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext);\n }\n\n /\n Record a tenant left with no administratively usable owner by an action that was ALLOWED.\n \n The organization twin of {@link logApplicationSuperAdminFloorBreached}, and it differs in the way\n * that matters: that one has no actor (the state can only arrive out-of-band, because every guarded\n * path refuses it), whereas this one is emitted precisely BECAUSE a guarded path let the write\n * through. Suspending a user is normally incident response; refusing it would mean an operator\n * cannot lock out a compromised owner without first transferring ownership using the tenant the\n * attacker controls. A stranded tenant is recoverable — the boot report finds it and\n * `organizationMembers.grantOwnership` repairs it — a live hostile owner session is not.\n \n That trade only holds if the consequence is VISIBLE, so this record is the whole control. Emitted\n * one per stranded tenant: a single deactivation can strand several, and an operator who learns\n * about them one at a time cannot plan the remediation.\n \n ALSO emitted by the BOOT report, under `detectedBy: BOOT_REPORT` — see\n * {@link AdministrativeContinuityBreachDetection}. The boot report used to write log lines and\n * nothing else, so a tenant stranded by a route no guard ever saw (a direct database edit, a\n * restore taken mid-erasure, a role-table change) produced no queryable evidence and reached no\n * SIEM, while its APPLICATION twin `logApplicationSuperAdminFloorBreached` had been audited from\n * the start. The action fields are absent on that path because there is no action to name.\n \n assurance-control: WILDO.ACCESS.ADMINISTRATIVE_CONTINUITY — evidence that a tenant has no\n * accountable administrative principal, and which allowed action caused it.\n /\n public async logOrganizationOwnerFloorBreached(data: {\n organizationId: string;\n detectedBy: AdministrativeContinuityBreachDetection;\n remainingUsableOwners: number;\n reducedMemberIds?: string[];\n operationIdentifier?: string;\n subjectUserId?: string;\n subjectNextStatus?: string;\n }, requestExecutionContext?: ExecutionContext<any>): Promise<void> {\n const eventData: AuditableEvent_Organization_OwnerFloorBreachedEventData = {\n eventType: CoreAuditableEventType.ORGANIZATION_OWNER_FLOOR_BREACHED,\n organizationId: data.organizationId,\n detectedBy: data.detectedBy,\n remainingUsableOwners: data.remainingUsableOwners,\n // Omitted rather than emitted as undefined: the boot observation has no action to name, and a\n // key present with no value reads in a SIEM as \"we looked and found nothing\" instead of \"there\n // was nothing to look for\".\n ...(data.reducedMemberIds ? { reducedMemberIds: data.reducedMemberIds } : {}),\n ...(data.operationIdentifier ? { operationIdentifier: data.operationIdentifier } : {}),\n ...(data.subjectUserId ? { subjectUserId: data.subjectUserId } : {}),\n ...(data.subjectNextStatus ? { subjectNextStatus: data.subjectNextStatus } : {}),\n };\n\n await this._createAuditLog({\n riskLevel: ResourceOperationRiskLevel.CRITICAL,\n eventType: CoreAuditableEventType.ORGANIZATION_OWNER_FLOOR_BREACHED,\n eventData: eventData as Record<string, any>,\n organizationId: data.organizationId,\n }, requestExecutionContext);\n }\n\n /\n Log an application-role grant or revocation on a `USERS` row.\n \n `User.appRoles` IS the subject's live application authority — `execution-context-creator` reads\n * it back into `initiatorRoles` on their very next request — so a change to it is an access-control\n * decision, not record maintenance. Emit this AFTER the write has been persisted: an event recorded\n * ahead of the write would survive a rollback and claim authority that was never granted.\n \n `riskLevel: HIGH` matches the risk level the role-administration operations declare. Attribution\n * splits deliberately: the audit row's `userId` is the ACTOR (`changedBy`, consistent with the\n * other admin-action events on this service, which is what \"who did this\" queries filter on), while\n * the SUBJECT rides the typed `eventData.userId`.\n \n The request execution context is forwarded so the per-org SIEM fan-out routes on the\n * AUTHENTICATED org rather than any caller-supplied field (F4 tenant segregation). An\n * application-scope actor simply has no org to route to, and the always-on DB store is unaffected.\n \n assurance-control: WILDO.AUDIT.SECURITY_EVENT — evidence that a privilege change occurred,\n * who made it, what was requested, and the resulting authority.\n /\n public async logUserAppRolesChanged(data: {\n userId: string;\n previousRoles: string[];\n newRoles: string[];\n requestedRoles: string[];\n operation: string;\n changedBy: string;\n reason?: string;\n }, requestExecutionContext?: ExecutionContext<any>): Promise<void> {\n const eventData: AuditableEvent_User_AppRolesChangedEventData = {\n eventType: CoreAuditableEventType.USER_APP_ROLES_CHANGED,\n userId: data.userId,\n previousRoles: data.previousRoles,\n newRoles: data.newRoles,\n requestedRoles: data.requestedRoles,\n operation: data.operation,\n changedBy: data.changedBy,\n reason: data.reason,\n };\n\n await this._createAuditLog({\n userId: data.changedBy,\n riskLevel: ResourceOperationRiskLevel.HIGH,\n eventType: CoreAuditableEventType.USER_APP_ROLES_CHANGED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext);\n }\n\n /\n Log an organization-wide role grant or revocation on an `ORGANIZATION_MEMBERS` row.\n \n The ORGANIZATIONS-scope twin of {@link logUserAppRolesChanged}, and it exists for the identical\n * reason: `OrganizationMember.roles` IS the member's live authority — `execution-context-creator`\n * reads it verbatim into `initiatorRoles` — so changing it is an access-control decision, not\n * record maintenance. `CoreAuditableEventType.ORGANIZATION_MEMBER_ROLE_CHANGED` was declared,\n * typed, and classified from the start but had NO producer until 2026-08-01, which meant every\n * in-tenant privilege change happened with no evidence at all.\n \n ## Emit only after the mutation is durable\n \n Both organization-member write paths declare `transactionalCore: true`, and the audit store does\n * NOT participate in that transaction. So unlike the application twin — whose paths are\n * non-transactional, where a postfix hook already runs after the write — this must be emitted from\n * a transaction POST-COMMIT effect. A postfix emission there would be written inside the\n * transaction and survive a rollback, asserting a grant that never happened. The callers register\n * exactly that effect; see the org-member custom implementations.\n \n ## Attribution and routing\n \n The audit row's `userId` is the ACTOR (`changedBy`, what \"who did this\" queries filter on); the\n * SUBJECT rides `eventData.userId` and the written row rides `eventData.memberId`. `organizationId`\n * is passed as event DATA — which tenant the event is ABOUT — while the per-org SIEM fan-out routes\n * on the AUTHENTICATED org from the forwarded execution context, never on this field (F4 tenant\n * segregation). System provisioning (SSO JIT, SCIM, invite acceptance, seeds) carries no\n * authenticated org and therefore no per-org dispatch; the always-on DB store still receives it,\n * which is the correct fail-closed shape.\n \n `riskLevel: HIGH` matches the application twin — a privilege change is never routine traffic.\n \n assurance-control: WILDO.AUDIT.SECURITY_EVENT — evidence that a privilege change occurred,\n * who made it, what was requested, and the resulting authority.\n /\n public async logOrganizationMemberRolesChanged(data: {\n organizationId: string;\n memberId: string;\n userId?: string;\n previousRoles: string[];\n newRoles: string[];\n requestedRoles?: string[];\n operation: string;\n changedBy: string;\n }, requestExecutionContext?: ExecutionContext<any>): Promise<void> {\n const eventData: AuditableEvent_OrganizationMember_RoleChangedEventData = {\n eventType: CoreAuditableEventType.ORGANIZATION_MEMBER_ROLE_CHANGED,\n organizationId: data.organizationId,\n memberId: data.memberId,\n userId: data.userId,\n previousRoles: data.previousRoles,\n newRoles: data.newRoles,\n requestedRoles: data.requestedRoles,\n operation: data.operation,\n changedBy: data.changedBy,\n };\n\n await this._createAuditLog({\n userId: data.changedBy,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.HIGH,\n eventType: CoreAuditableEventType.ORGANIZATION_MEMBER_ROLE_CHANGED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext);\n }\n\n /\n Log a per-unit role assignment on an `ORGANIZATION_UNIT_MEMBERS` row.\n \n The NARROWED twin of {@link logOrganizationMemberRolesChanged}. `OrganizationUnitMember.role` is\n * live authority: `appendUnitScopedRoles` emits it into `initiatorRoles` carrying an\n * `organizationUnitId` discriminator, which bounds the grant to ONE unit rather than the tenant.\n * Narrower blast radius, same KIND of decision — so it is evidenced on the same terms and at the\n * same `HIGH` risk level rather than being folded into ORG_MANAGEMENT record-keeping.\n \n Singular `role` throughout, mirroring the resource: one role per (unit, member) is its persisted\n * business key, and an array here would invent a cardinality the row cannot hold.\n \n assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — evidence of unit-scoped privilege grant.\n /\n public async logOrganizationUnitMemberRoleChanged(data: {\n assignmentId: string;\n organizationId?: string;\n organizationUnitId?: string;\n organizationMemberId?: string;\n previousRole?: string;\n newRole: string;\n requestedRole?: string;\n operation: string;\n changedBy: string;\n }, requestExecutionContext?: ExecutionContext<any>): Promise<void> {\n const eventData: AuditableEvent_OrganizationUnitMember_RoleChangedEventData = {\n eventType: CoreAuditableEventType.ORGANIZATION_UNIT_MEMBER_ROLE_CHANGED,\n organizationId: data.organizationId,\n organizationUnitId: data.organizationUnitId,\n assignmentId: data.assignmentId,\n organizationMemberId: data.organizationMemberId,\n previousRole: data.previousRole,\n newRole: data.newRole,\n requestedRole: data.requestedRole,\n operation: data.operation,\n changedBy: data.changedBy,\n };\n\n await this._createAuditLog({\n userId: data.changedBy,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.HIGH,\n eventType: CoreAuditableEventType.ORGANIZATION_UNIT_MEMBER_ROLE_CHANGED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext);\n }\n\n /\n Log the revocation of a per-unit role assignment.\n \n The closing half of {@link logOrganizationUnitMemberRoleChanged}. Without it an\n * authorization-filtered trail shows unit privileges being granted and never removed, which is a\n * worse failure than having no trail at all — it reads as an accumulating set of grants.\n \n `revokedRole` is the field that justifies the event's existence: the assignment row is\n * hard-deleted, so after the fact NOTHING else in the system can answer \"what authority did this\n * person lose\". Same `HIGH` risk level as the grant — a revocation is as security-relevant as the\n * grant it undoes, and an access review reads them as one pair.\n \n ## What this does and does not cover\n \n The DIRECT assignment DELETE only. Cascade removals — deleting the parent membership, or the\n * whole organization — run through the raw repository, which by construction does not execute\n * service custom implementations, so no per-assignment hook exists on those paths. That is the\n * correct boundary rather than a gap to work around: the semantic act there is losing the\n * membership or the tenant, and the assignment dying with it is a consequence evidenced by the\n * parent's own event.\n \n assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — evidence of privilege revocation.\n /\n public async logOrganizationUnitMemberRemoved(data: {\n assignmentId: string;\n organizationId?: string;\n organizationUnitId?: string;\n organizationMemberId?: string;\n revokedRole?: string;\n removedBy: string;\n }, requestExecutionContext?: ExecutionContext<any>): Promise<void> {\n const eventData: AuditableEvent_OrganizationUnitMember_RemovedEventData = {\n eventType: CoreAuditableEventType.ORGANIZATION_UNIT_MEMBER_REMOVED,\n organizationId: data.organizationId,\n organizationUnitId: data.organizationUnitId,\n assignmentId: data.assignmentId,\n organizationMemberId: data.organizationMemberId,\n revokedRole: data.revokedRole,\n removedBy: data.removedBy,\n };\n\n await this._createAuditLog({\n userId: data.removedBy,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.HIGH,\n eventType: CoreAuditableEventType.ORGANIZATION_UNIT_MEMBER_REMOVED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext);\n }\n\n /\n Log the removal of an organization membership — administrative DELETE, or REVOKE of a pending\n * invitation.\n \n `CoreAuditableEventType.ORGANIZATION_MEMBER_REMOVED` was declared, typed, and classified from the\n * start but had NO producer until 2026-08-01. That left the two ends of the membership lifecycle\n * asymmetric: joining was evidenced, leaving was not. It also silently discarded the REVOKE\n * `reason` — the resource config declares that field with the explicit note that it \"is captured in\n * the audit payload, not persisted on the deleted row\", and nothing was capturing it.\n \n ## Risk level differs from the operations' own\n \n `HIGH` for both paths, even though REVOKE declares `MEDIUM`. That declared level is the UI axis\n * (whether the roster button gets a danger-zone affordance); the evidence axis is the destruction\n * of a membership record and the roles it carried, which is not routine traffic either way. The\n * organization-member UPDATE already documents exactly this divergence for the same resource.\n \n ## Emit only after the mutation is durable\n \n Both paths are `transactionalCore: true` and both prefixes refuse to run without a transaction,\n * so this is emitted from a transaction POST-COMMIT effect. A postfix emission would sit inside\n * that transaction and survive a rollback, asserting a removal that never happened — and there is a\n * live rollback path here: the owner-floor guard and the user-type revocation both run in the same\n * unit of work and can abort it.\n \n ## What this does and does not cover\n \n The two direct API paths. Deleting the whole ORGANIZATION cascades to its memberships through the\n * raw repository, below the service tier — evidenced by `ORGANIZATION_DELETED`, whose producer\n * exists, because the auditable act there is destroying the tenant. There is deliberately no\n * `USERS -> ORGANIZATION_MEMBERS` relationship, so deleting a user does not cascade here at all.\n \n assurance-control: WILDO.ACCESS.LIFECYCLE — evidence that access was withdrawn,\n * from whom, by whom, and what authority it carried.\n /\n public async logOrganizationMemberRemoved(data: {\n organizationId: string;\n memberId: string;\n removedUserId: string;\n roles?: string[];\n previousStatus?: string;\n operation: string;\n /* Per-unit grants the removal cascaded away — the cascade runs below the service tier and cannot self-evidence. /\n revokedUnitAssignments?: { organizationUnitId: string; role: string }[];\n removedBy: string;\n reason?: string;\n }, requestExecutionContext?: ExecutionContext<any>): Promise<void> {\n const eventData: AuditableEvent_OrganizationMember_RemovedEventData = {\n eventType: CoreAuditableEventType.ORGANIZATION_MEMBER_REMOVED,\n organizationId: data.organizationId,\n memberId: data.memberId,\n removedUserId: data.removedUserId,\n roles: data.roles,\n previousStatus: data.previousStatus,\n operation: data.operation,\n revokedUnitAssignments: data.revokedUnitAssignments,\n removedBy: data.removedBy,\n reason: data.reason,\n };\n\n await this._createAuditLog({\n userId: data.removedBy,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.HIGH,\n eventType: CoreAuditableEventType.ORGANIZATION_MEMBER_REMOVED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext);\n }\n\n /\n Log the hard deletion of a `USERS` row.\n \n `CoreAuditableEventType.USER_DELETED` was declared and classified from the start but had NO\n * producer until 2026-08-01 — every user deletion, self-service or administrative, happened with\n * no evidence. Identity destruction is exactly the kind of event an assurance trail exists for,\n * so the absence was a silent audit gap rather than a missing nicety.\n \n Emit AFTER the delete transaction commits. An event written ahead of it would survive a\n * rollback and assert a destruction that never happened — the mirror of the rule on\n * {@link logUserAppRolesChanged}, and not hypothetical here: the delete cascade throws inside the\n * parent transaction when a child lacks a teardown op.\n \n Attribution splits as elsewhere on this service: the audit row's `userId` is the ACTOR\n * (`deletedBy`), the SUBJECT rides the typed `eventData.userId`. For the administrative\n * `USERS \| DELETE` route those differ; they coincide only if a principal ever deletes itself.\n \n `riskLevel: CRITICAL` matches the risk level `USERS \| DELETE` declares.\n \n assurance-control: WILDO.DATA.SECURE_LIFECYCLE — identity destruction must be\n * attributable and evidenced.\n /\n public async logUserDeleted(data: {\n userId: string;\n email?: string;\n deletedBy: string;\n appRoles?: string[];\n }, requestExecutionContext?: ExecutionContext<any>): Promise<void> {\n const eventData: AuditableEvent_User_DeletedEventData = {\n eventType: CoreAuditableEventType.USER_DELETED,\n userId: data.userId,\n email: data.email,\n deletedBy: data.deletedBy,\n appRoles: data.appRoles,\n };\n\n await this._createAuditLog({\n userId: data.deletedBy,\n riskLevel: ResourceOperationRiskLevel.CRITICAL,\n eventType: CoreAuditableEventType.USER_DELETED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext);\n }\n\n /\n Log the hard deletion of an `ORGANIZATIONS` row.\n \n The exact sibling of {@link logUserDeleted}, and the same class of gap:\n * `CoreAuditableEventType.ORGANIZATION_DELETED` was declared, given a complete event-data schema\n * and a SIEM classification (`ORG_MANAGEMENT` / `WARNING`) from the start, yet NOTHING emitted it\n * until 2026-08-01. Destroying an organization destroys a whole tenant — its members, its\n * configuration and everything the delete cascade reaches — and it did so leaving no evidence that\n * it had happened, by whom, or which tenant it was.\n \n Emit AFTER the delete transaction commits, for the same reason as the user twin: the delete and\n * its `onParentDelete` cascade share one transaction, and the cascade genuinely throws when a child\n * lacks a teardown operation. An event written ahead of that would survive the rollback and assert\n * a destruction that never happened.\n \n `name` and `slug` come from the PRE-deletion snapshot and are required by the event schema (they\n * are what lets an auditor identify the tenant afterwards — the id alone resolves to nothing once\n * the row is gone).\n \n Attribution splits as elsewhere on this service: the audit row's `userId` is the ACTOR\n * (`deletedBy`), the SUBJECT rides the typed `eventData.organizationId`. On the org-admin door the\n * actor is a member of the organization being deleted; on the super-admin door they are not.\n \n `organizationId` is also set on the row itself so the record is queryable per tenant. That is a\n * DATA field only — per-org SIEM routing is decided by `_createAuditLog` from the AUTHENTICATED\n * request org (F4), never from this value. Delivery therefore differs by door and is correct in\n * both cases: the org-admin door carries the deleted org on its execution context and delivers to\n * that org's sink, while the super-admin door carries no org and fail-closes to DB + app-level\n * sinks only. The row survives either way — `ORGANIZATIONS → AUDIT_LOGS` declares\n * `onParentDelete: { enabled: false }`, so the cascade does not take the evidence with the tenant.\n \n `riskLevel: CRITICAL` rather than a per-variant value. The two DELETE variants declare different\n * levels (CRITICAL for the org-admin door, HIGH for the super-admin one), but those grade the\n * authorization surface; this record grades the EVENT, which is the same tenant destruction on\n * either path. Taking the higher of the two avoids under-grading the privileged door.\n \n assurance-control: WILDO.DATA.SECURE_LIFECYCLE — destruction of a tenant and its\n * data is a security-relevant event; it must be attributable and it must leave evidence.\n /\n public async logOrganizationDeleted(data: {\n organizationId: string;\n name: string;\n slug: string;\n deletedBy: string;\n reason?: string;\n }, requestExecutionContext?: ExecutionContext<any>): Promise<void> {\n const eventData: AuditableEvent_Organization_DeletedEventData = {\n eventType: CoreAuditableEventType.ORGANIZATION_DELETED,\n organizationId: data.organizationId,\n name: data.name,\n slug: data.slug,\n deletedBy: data.deletedBy,\n reason: data.reason,\n };\n\n await this._createAuditLog({\n userId: data.deletedBy,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.CRITICAL,\n eventType: CoreAuditableEventType.ORGANIZATION_DELETED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext);\n }\n\n /\n A tenant was MARKED for deletion — the soft-delete half of tenant teardown.\n \n `CRITICAL` on the same footing as `logOrganizationDeleted`, and deliberately not lower: this is\n * the moment the tenant loses its access, and it is the moment a mistaken or malicious teardown\n * is still worth catching. The purge that follows is the mechanical consequence of THIS decision.\n \n assurance-control: WILDO.ACCESS.LIFECYCLE\n /\n public async logOrganizationDeletionRequested(data: {\n organizationId: string;\n name: string;\n slug: string;\n requestedBy: string;\n purgeScheduledAt: string;\n revokedUserTypeCount: number;\n reason?: string;\n }, requestExecutionContext?: ExecutionContext<any>): Promise<void> {\n const eventData: AuditableEvent_Organization_DeletionRequestedEventData = {\n eventType: CoreAuditableEventType.ORGANIZATION_DELETION_REQUESTED,\n organizationId: data.organizationId,\n name: data.name,\n slug: data.slug,\n requestedBy: data.requestedBy,\n purgeScheduledAt: data.purgeScheduledAt,\n revokedUserTypeCount: data.revokedUserTypeCount,\n reason: data.reason,\n };\n\n await this._createAuditLog({\n userId: data.requestedBy,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.CRITICAL,\n eventType: CoreAuditableEventType.ORGANIZATION_DELETION_REQUESTED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext);\n }\n\n /\n A pending tenant deletion was CANCELLED inside its retention window.\n \n `HIGH` rather than `CRITICAL`: restoring re-grants access to a whole tenant, which is\n * materially security-relevant and belongs in an access review, but it destroys nothing and is\n * itself reversible by re-marking.\n \n assurance-control: WILDO.ACCESS.LIFECYCLE\n /\n public async logOrganizationRestored(data: {\n organizationId: string;\n name: string;\n slug: string;\n restoredBy: string;\n restoredStatus: string;\n regrantedUserTypeCount: number;\n reason?: string;\n }, requestExecutionContext?: ExecutionContext<any>): Promise<void> {\n const eventData: AuditableEvent_Organization_RestoredEventData = {\n eventType: CoreAuditableEventType.ORGANIZATION_RESTORED,\n organizationId: data.organizationId,\n name: data.name,\n slug: data.slug,\n restoredBy: data.restoredBy,\n restoredStatus: data.restoredStatus,\n regrantedUserTypeCount: data.regrantedUserTypeCount,\n reason: data.reason,\n };\n\n await this._createAuditLog({\n userId: data.restoredBy,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.HIGH,\n eventType: CoreAuditableEventType.ORGANIZATION_RESTORED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext);\n }\n\n /\n The tenant was administratively HALTED.\n \n `CRITICAL`: since the tenant-status authority gate shipped, this single write revokes the\n * organization access of every member at once. That is the same blast radius as a teardown, even\n * though nothing is destroyed and the action is reversible.\n \n assurance-control: WILDO.ACCESS.LIFECYCLE\n /\n public async logOrganizationSuspended(data: {\n organizationId: string;\n name: string;\n slug: string;\n suspendedBy: string;\n previousStatus: string;\n suspensionReason: string;\n notifiedMembers: boolean;\n revokedUserTypeCount: number;\n }, requestExecutionContext?: ExecutionContext<any>): Promise<void> {\n const eventData: AuditableEvent_Organization_SuspendedEventData = {\n eventType: CoreAuditableEventType.ORGANIZATION_SUSPENDED,\n organizationId: data.organizationId,\n name: data.name,\n slug: data.slug,\n suspendedBy: data.suspendedBy,\n previousStatus: data.previousStatus,\n suspensionReason: data.suspensionReason,\n notifiedMembers: data.notifiedMembers,\n revokedUserTypeCount: data.revokedUserTypeCount,\n };\n\n await this._createAuditLog({\n userId: data.suspendedBy,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.CRITICAL,\n eventType: CoreAuditableEventType.ORGANIZATION_SUSPENDED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext);\n }\n\n /\n Record a change to the application's authored authentication policy — see\n * {@link AuditableEvent_ApplicationAuthPolicyChanged_EventDataSchema} for the full rationale and\n * scope.\n \n USERLESS by design, exactly like {@link logSystemContextAccess}: this is emitted at backend\n * startup, where there is no human actor to name. The honest attribution is \"the running\n * application recorded that its authored policy changed since the last boot\"; the \"who authored the\n * change\" lives in the deployment / source history, and inventing a `userId` here would corrupt the\n * trail. Passing no `requestExecutionContext` is deliberate — the row is system-attributed.\n \n `riskLevel` is MEDIUM: a configuration change worth a durable, reviewable record (its severity is\n * WARNING via the classification map), not an active breach. The before → after payload, not the\n * risk level, is what tells a reviewer whether the change weakened the posture.\n \n assurance-control: WILDO.AUDIT.SECURITY_EVENT — a change to the application's authentication-assurance\n * policy is recorded as an attributable, durable audit event.\n /\n public async logApplicationAuthPolicyChanged(data: {\n changedUserTypes: string[];\n snapshotDigest: string;\n before: Record<string, ApplicationAuthPolicySnapshot> \| null;\n after: Record<string, ApplicationAuthPolicySnapshot>;\n }): Promise<void> {\n const eventData: AuditableEvent_ApplicationAuthPolicyChanged_EventData = {\n eventType: CoreAuditableEventType.APPLICATION_AUTH_POLICY_CHANGED,\n changedUserTypes: data.changedUserTypes,\n snapshotDigest: data.snapshotDigest,\n before: data.before,\n after: data.after,\n };\n\n /\n * NO `applicationId` PASSED — and that is the fix, not an omission (2026-09-09).\n \n `applicationId` is this resource's declared PRIMARY-SCOPE field, so when an emitter does not\n * author it the repository's write-path enrichment injects the writer's own application id.\n * 103 of the 109 emitters in this class rely on exactly that, and the trail proves it works:\n * 2,175 of 2,178 rows on the dogfood application carry the correct id.\n \n Passing one is what broke this event. `deriveTrustedSystemWritePreservedFields` preserves any\n * key present on `auditLogData`, so an authored value SURVIVES the strict re-parse and wins over\n * the enrichment — and the only value this emitter could reach was the app SLUG, because the\n * backend has no application id on `appIdentity` (that field is merged for the frontend\n * projection alone). The row therefore landed under `wonder-todos` and was reachable through no\n * API, on the very door #317 built for unscoped and application-wide security events.\n \n So the rule for this class: author `applicationId` only when the event is genuinely ABOUT a\n * DIFFERENT application from the writer. An application-wide auth-policy change is about the\n * writer's own, so authoring it can only restate what the enrichment already knows — or, as\n * here, contradict it.\n /\n await this._createAuditLog({\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.APPLICATION_AUTH_POLICY_CHANGED,\n eventData: eventData as Record<string, any>,\n });\n }\n\n /\n Boot-time change-detector for the application authentication policy: reconcile the current\n * authored snapshot against the last one the trail recorded, and emit an\n * {@link logApplicationAuthPolicyChanged} event ONLY if it moved.\n \n The audit trail is its OWN change-detection state — there is no separate snapshot store to keep in\n * sync, and (because the read below goes straight to the audit repository rather than through\n * `SystemAccessBackendService`) it costs no extra per-boot `SYSTEM_CONTEXT_READ` row. Behaviour:\n * - no prior event (first boot ever) → emit a BASELINE row (`before: null`);\n * - digest differs → emit `before → after` naming the changed user types;\n * - digest identical → emit NOTHING, so the trail carries one row per genuine\n * change rather than one per boot (the audit-noise rule).\n \n Fully fire-and-forget: any failure is logged and swallowed. A backend must boot whether or not it\n * could record this, exactly like every other audit emission.\n \n assurance-control: WILDO.AUDIT.SECURITY_EVENT WILDO.IDENTITY.SESSION_ASSURANCE — every change to the\n * authored authentication-assurance posture (MFA / password / lockout / methods / step-up / session) is\n * detected at startup and evidenced in the audit trail, once per genuine change.\n /\n public async emitApplicationAuthPolicyChangeIfChanged(data: {\n userTypes: UserTypesConfig;\n }): Promise<void> {\n try {\n // Build → digest → detect → emit is ALL inside this try so the boot caller is a single call\n // that cannot throw: the whole path (including snapshot construction) is swallowed here.\n const currentSnapshot = buildApplicationAuthPolicySnapshot(data.userTypes);\n const currentDigest = computeApplicationAuthPolicySnapshotDigest(currentSnapshot);\n const prior = await this._readMostRecentApplicationAuthPolicyEvent();\n\n if (prior && prior.snapshotDigest === currentDigest) {\n // Unchanged since the last recorded snapshot — the trail already reflects it. Emit nothing.\n return;\n }\n\n const before = prior?.after ?? null;\n const changedUserTypes = diffChangedApplicationAuthPolicyUserTypes(before, currentSnapshot);\n\n await this.logApplicationAuthPolicyChanged({\n changedUserTypes,\n snapshotDigest: currentDigest,\n before,\n after: currentSnapshot,\n });\n } catch (error) {\n // Never let a change-detection failure affect boot — audit emission is fire-and-forget.\n this.logger.error?.('Failed to reconcile/emit application auth-policy change audit', { error });\n }\n }\n\n /\n The most recent {@link CoreAuditableEventType.APPLICATION_AUTH_POLICY_CHANGED} event's payload, or\n * null when none exists yet (the first-ever boot).\n \n Keyed on `eventType` ALONE, deliberately: an application's audit store holds only that one\n * application's rows (every runtime of the app — the serving backend and its minions — writes to\n * the same app-scoped store), so every row of this type is this application's, and `eventType` is\n * guaranteed present on the row — unlike the context-populated `applicationId`, which is re-derived\n * from the writer's scope and would be an unreliable filter for the boot-time super-admin context\n * (which carries no application id of its own). Reads through the AUDIT_LOGS LIST path, whose\n * declared `filterFields` include `eventType`,\n * with `excludeContextualFilter` so the org-less boot context still sees the row; newest-first,\n * limit 1. The stored `eventData` is re-validated so a malformed/foreign row degrades to \"no prior\"\n * (→ a harmless baseline re-emit) rather than throwing.\n /\n private async _readMostRecentApplicationAuthPolicyEvent(): Promise<AuditableEvent_ApplicationAuthPolicyChanged_EventData \| null> {\n const ec = await this._getTempExecutionContext();\n const auditRepo = this.repositoriesRegistry.getRepositoryOrThrow(CoreResourceType.AUDIT_LOGS);\n // Typed to the repository's `_doList` contract (`listOptions.sort`), which the public `list`\n // overload's narrower type does not name — see the same pattern in the immudb-reconcile batch.\n const listOptions: { page: number; limit: number; sort: Record<string, 1 \| -1> } = {\n page: 1,\n limit: 1,\n sort: { createdAt: -1 },\n };\n const result = (await auditRepo.list(\n ec,\n { eventType: CoreAuditableEventType.APPLICATION_AUTH_POLICY_CHANGED },\n { paginated: true, excludeContextualFilter: true, listOptions },\n )) as unknown as { data?: Array<{ eventData?: unknown }> };\n\n const row = result.data?.[0];\n if (!row) {\n return null;\n }\n const parsed = AuditableEvent_ApplicationAuthPolicyChanged_EventDataSchema.safeParse(row.eventData);\n return parsed.success ? parsed.data : null;\n }\n\n /\n A governed lifecycle transition changed a subject's `status`.\n \n Called from the shared status-transition implementation, so every verb it serves is trailed by\n * construction — membership suspend/reactivate, administrative user suspend/unsuspend, and\n * self-service account deactivation. Before this those five emitted NOTHING, while the tenant\n * verbs were fully attributable.\n \n Risk is derived from the DIRECTION rather than fixed: a restriction (`isRestricting`) is the\n * event an access review is looking for and carries `HIGH`, while a lift is `MEDIUM`. Grading the\n * pair identically would either inflate routine reinstatements or bury suspensions.\n \n `organizationId` is forwarded when the subject is tenant-scoped so the row routes to that\n * tenant's SIEM; an application-scoped subject (a `USERS` row) legitimately has none.\n \n assurance-control: WILDO.AUDIT.SECURITY_EVENT — a change to whether a principal may act is\n * attributable, justified and evidenced.\n /\n public async logResourceStatusTransitionPerformed(data: {\n resourceType: string;\n operationIdentifier: string;\n subjectId: string;\n performedBy: string;\n previousStatus: string;\n newStatus: string;\n /* True when the transition REMOVES access (suspend / deactivate) rather than restoring it. /\n isRestricting: boolean;\n reason?: string;\n scheduledReactivationAt?: Date \| null;\n organizationId?: string;\n }, requestExecutionContext?: ExecutionContext<any>): Promise<void> {\n const eventData: AuditableEvent_Resource_StatusTransitionPerformedEventData = {\n eventType: CoreAuditableEventType.RESOURCE_STATUS_TRANSITION_PERFORMED,\n resourceType: data.resourceType,\n operationIdentifier: data.operationIdentifier,\n subjectId: data.subjectId,\n performedBy: data.performedBy,\n previousStatus: data.previousStatus,\n newStatus: data.newStatus,\n ...(data.reason !== undefined ? { reason: data.reason } : {}),\n ...(data.scheduledReactivationAt\n ? { scheduledReactivationAt: data.scheduledReactivationAt.toISOString() }\n : {}),\n ...(data.organizationId !== undefined ? { organizationId: data.organizationId } : {}),\n };\n\n await this._createAuditLog({\n userId: data.performedBy,\n organizationId: data.organizationId,\n riskLevel: data.isRestricting\n ? ResourceOperationRiskLevel.HIGH\n : ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.RESOURCE_STATUS_TRANSITION_PERFORMED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext);\n }\n\n /\n A halted or expired tenant was returned to normal operation.\n \n `HIGH` rather than `CRITICAL`: reinstating organization-wide access is materially\n * security-relevant and belongs in an access review, but it destroys nothing and is itself\n * reversible by re-suspending.\n \n assurance-control: WILDO.ACCESS.LIFECYCLE\n /\n public async logOrganizationActivated(data: {\n organizationId: string;\n name: string;\n slug: string;\n activatedBy: string;\n previousStatus: string;\n regrantedUserTypeCount: number;\n reason?: string;\n }, requestExecutionContext?: ExecutionContext<any>): Promise<void> {\n const eventData: AuditableEvent_Organization_ActivatedEventData = {\n eventType: CoreAuditableEventType.ORGANIZATION_ACTIVATED,\n organizationId: data.organizationId,\n name: data.name,\n slug: data.slug,\n activatedBy: data.activatedBy,\n previousStatus: data.previousStatus,\n regrantedUserTypeCount: data.regrantedUserTypeCount,\n reason: data.reason,\n };\n\n await this._createAuditLog({\n userId: data.activatedBy,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.HIGH,\n eventType: CoreAuditableEventType.ORGANIZATION_ACTIVATED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext);\n }\n\n // ===============================\n // ORGANIZATION SECURITY MANAGEMENT AUDIT METHODS (Step 18)\n // ===============================\n\n /\n Log SSO configuration change (admin changed SSO settings)\n /\n public async logOrganizationSSOConfigurationChanged(data: {\n organizationId: string;\n changedBy: string;\n changeType: SsoConfigChangeType;\n affectedProviderRef?: string;\n changes?: Record<string, unknown>;\n }): Promise<void> {\n const eventData: AuditableEvent_Organization_SSOConfigurationChangedEventData = {\n eventType: CoreAuditableEventType.ORGANIZATION_SSO_CONFIGURATION_CHANGED,\n organizationId: data.organizationId,\n changedBy: data.changedBy,\n changeType: data.changeType,\n affectedProviderRef: data.affectedProviderRef,\n changes: data.changes,\n };\n\n await this._createAuditLog({\n userId: data.changedBy,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.ORGANIZATION_SSO_CONFIGURATION_CHANGED,\n eventData: eventData as Record<string, any>,\n });\n }\n\n /\n Log SIEM export configuration change (meta-audit — admin configured SIEM export)\n /\n public async logOrganizationSIEMExportConfigured(data: {\n organizationId: string;\n changedBy: string;\n changeType: SiemExportChangeType;\n webhookUrlDomain?: string;\n eventFormatConfigured?: string;\n }): Promise<void> {\n const eventData: AuditableEvent_Organization_SIEMExportConfiguredEventData = {\n eventType: CoreAuditableEventType.ORGANIZATION_SIEM_EXPORT_CONFIGURED,\n organizationId: data.organizationId,\n changedBy: data.changedBy,\n changeType: data.changeType,\n webhookUrlDomain: data.webhookUrlDomain,\n eventFormatConfigured: data.eventFormatConfigured,\n };\n\n await this._createAuditLog({\n userId: data.changedBy,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.LOW,\n eventType: CoreAuditableEventType.ORGANIZATION_SIEM_EXPORT_CONFIGURED,\n eventData: eventData as Record<string, any>,\n });\n }\n\n /\n A named break-glass account signed in past its tenant's own SSO requirement (#423).\n \n Scoped to an ORGANIZATION or an APPLICATION, never both — the caller says which.\n \n `emergencyAccess` lives on the POLYMORPHIC SSO config, so an application-scope policy carries\n * break-glass accounts for the application itself and has no organization id. This method was\n * organization-only for one release and the gate REFUSED the other case rather than emit without\n * a record; that was the right fail-closed answer while the event contract could not express it,\n * and it is no longer needed. The schema admits either scope and refuses anything but exactly\n * one, so an unscoped call cannot be written.\n \n `riskLevel` is HIGH — the risk band of the resource operation. The event's own severity is\n * CRITICAL, set once in `SECURITY_AUDIT_EVENT_ENVELOPE` where every consumer reads it; the two\n * are different axes and the envelope is what a SIEM rule keys on.\n /\n public async logEmergencyAccessUsed(data: {\n userId: string;\n email: string;\n scopeType: AuthScopeType;\n organizationId?: string;\n applicationId?: string;\n reason?: string;\n ipAddress: string;\n userAgent: string;\n sessionId: string;\n }): Promise<void> {\n const eventData: AuditableEvent_EmergencyAccess_UsedEventData = {\n eventType: CoreAuditableEventType.EMERGENCY_ACCESS_USED,\n userId: data.userId,\n email: data.email,\n scopeType: data.scopeType,\n organizationId: data.organizationId,\n applicationId: data.applicationId,\n reason: data.reason,\n ipAddress: data.ipAddress,\n userAgent: data.userAgent,\n sessionId: data.sessionId,\n };\n\n await this._createAuditLog({\n userId: data.userId,\n organizationId: data.organizationId,\n applicationId: data.applicationId,\n riskLevel: ResourceOperationRiskLevel.HIGH,\n eventType: CoreAuditableEventType.EMERGENCY_ACCESS_USED,\n eventData: eventData as Record<string, any>,\n });\n }\n\n // ===============================\n // PASSWORD RESET AUDIT METHODS (H5)\n // ===============================\n\n /\n Log password reset requested\n /\n public async logUserPasswordResetRequested(data: {\n email: string;\n ipAddress: string;\n userAgent: string;\n organizationId?: string;\n }): Promise<void> {\n const eventData: AuditableEvent_User_PasswordResetRequestedEventData = {\n eventType: CoreAuditableEventType.USER_PASSWORD_RESET_REQUESTED,\n email: data.email,\n ipAddress: data.ipAddress,\n userAgent: data.userAgent,\n };\n\n await this._createAuditLog({\n userId: undefined,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.LOW,\n eventType: CoreAuditableEventType.USER_PASSWORD_RESET_REQUESTED,\n eventData: eventData as Record<string, any>,\n });\n }\n\n /\n Log password reset completed\n /\n public async logUserPasswordResetCompleted(data: {\n userId: string;\n ipAddress: string;\n userAgent: string;\n organizationId?: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_User_PasswordResetCompletedEventData = {\n eventType: CoreAuditableEventType.USER_PASSWORD_RESET_COMPLETED,\n userId: data.userId,\n ipAddress: data.ipAddress,\n userAgent: data.userAgent,\n };\n\n await this._createAuditLog({\n userId: data.userId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.USER_PASSWORD_RESET_COMPLETED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n /\n Log an ADMINISTRATOR-compelled credential reset.\n \n Separate from {@link logUserPasswordResetRequested} on purpose: that event models a\n * self-service request and has no actor field, so routing an admin action through it would\n * record the account owner as the person who acted. Here the acting administrator and the\n * target are both named, and `userId` on the log row is the TARGET — the row belongs to the\n * affected account's history, while `actorUserId` inside `eventData` answers \"who did this\".\n \n `riskLevel: HIGH` matches the operation's declared risk and the CRITICAL severity the\n * security envelope assigns the event type.\n \n assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — privileged credential\n * intervention is attributable, justified, and recorded.\n /\n public async logUserPasswordResetForced(data: {\n targetUserId: string;\n targetEmail: string;\n actorUserId: string;\n reason: string;\n sessionsRevoked: boolean;\n /* Optional — the resource-operation producer has no transport metadata. See the event schema. /\n ipAddress?: string;\n userAgent?: string;\n organizationId?: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_User_PasswordResetForcedEventData = {\n eventType: CoreAuditableEventType.USER_PASSWORD_RESET_FORCED,\n targetUserId: data.targetUserId,\n targetEmail: data.targetEmail,\n actorUserId: data.actorUserId,\n reason: data.reason,\n sessionsRevoked: data.sessionsRevoked,\n ipAddress: data.ipAddress,\n userAgent: data.userAgent,\n };\n\n await this._createAuditLog({\n userId: data.targetUserId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.HIGH,\n eventType: CoreAuditableEventType.USER_PASSWORD_RESET_FORCED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n // ===============================\n // REGISTRATION & VERIFICATION AUDIT METHODS (H5)\n // ===============================\n\n /\n Log user registration\n /\n public async logUserRegistered(data: {\n userId: string;\n email: string;\n ipAddress: string;\n userAgent: string;\n organizationId?: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_User_RegisteredEventData = {\n eventType: CoreAuditableEventType.USER_REGISTERED,\n userId: data.userId,\n email: data.email,\n ipAddress: data.ipAddress,\n userAgent: data.userAgent,\n };\n\n await this._createAuditLog({\n userId: data.userId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.LOW,\n eventType: CoreAuditableEventType.USER_REGISTERED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n /\n Log email verified\n /\n public async logUserEmailVerified(data: {\n userId: string;\n email: string;\n ipAddress: string;\n userAgent: string;\n organizationId?: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_User_EmailVerifiedEventData = {\n eventType: CoreAuditableEventType.USER_EMAIL_VERIFIED,\n userId: data.userId,\n email: data.email,\n ipAddress: data.ipAddress,\n userAgent: data.userAgent,\n };\n\n await this._createAuditLog({\n userId: data.userId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.LOW,\n eventType: CoreAuditableEventType.USER_EMAIL_VERIFIED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n public async logUserVerificationEmailResent(data: {\n userId: string;\n email: string;\n ipAddress: string;\n userAgent: string;\n }): Promise<void> {\n const eventData: AuditableEvent_User_VerificationEmailResentEventData = {\n eventType: CoreAuditableEventType.USER_VERIFICATION_EMAIL_RESENT,\n userId: data.userId,\n email: data.email,\n ipAddress: data.ipAddress,\n userAgent: data.userAgent,\n };\n\n await this._createAuditLog({\n userId: data.userId,\n riskLevel: ResourceOperationRiskLevel.LOW,\n eventType: CoreAuditableEventType.USER_VERIFICATION_EMAIL_RESENT,\n eventData: eventData as Record<string, any>,\n });\n }\n\n // ===============================\n // MFA LIFECYCLE AUDIT METHODS (H5)\n // ===============================\n\n /\n Log MFA setup started (TOTP enrollment initiated)\n /\n public async logUserMFASetupStarted(data: {\n userId: string;\n mfaMethod: string;\n ipAddress: string;\n userAgent: string;\n organizationId?: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_User_MFASetupStartedEventData = {\n eventType: CoreAuditableEventType.USER_MFA_SETUP_STARTED,\n userId: data.userId,\n mfaMethod: data.mfaMethod,\n ipAddress: data.ipAddress,\n userAgent: data.userAgent,\n };\n\n await this._createAuditLog({\n userId: data.userId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.LOW,\n eventType: CoreAuditableEventType.USER_MFA_SETUP_STARTED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n /\n Log MFA setup completed (TOTP enrollment verified)\n /\n public async logUserMFASetupCompleted(data: {\n userId: string;\n mfaMethod: string;\n ipAddress: string;\n userAgent: string;\n organizationId?: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_User_MFASetupCompletedEventData = {\n eventType: CoreAuditableEventType.USER_MFA_SETUP_COMPLETED,\n userId: data.userId,\n mfaMethod: data.mfaMethod,\n ipAddress: data.ipAddress,\n userAgent: data.userAgent,\n };\n\n await this._createAuditLog({\n userId: data.userId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.USER_MFA_SETUP_COMPLETED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n /\n Log MFA email OTP sent\n /\n public async logUserMFAEmailOTPSent(data: {\n email: string;\n sessionId: string;\n ipAddress: string;\n userAgent: string;\n organizationId?: string;\n }): Promise<void> {\n const eventData: AuditableEvent_User_MFAEmailOTPSentEventData = {\n eventType: CoreAuditableEventType.USER_MFA_EMAIL_OTP_SENT,\n email: data.email,\n sessionId: data.sessionId,\n ipAddress: data.ipAddress,\n userAgent: data.userAgent,\n };\n\n await this._createAuditLog({\n userId: undefined,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.LOW,\n eventType: CoreAuditableEventType.USER_MFA_EMAIL_OTP_SENT,\n eventData: eventData as Record<string, any>,\n });\n }\n\n // ===============================\n // WEBAUTHN/PASSKEY AUDIT METHODS (Phase G1)\n // ===============================\n\n /\n Log passkey registered\n /\n public async logUserPasskeyRegistered(data: {\n userId: string;\n email: string;\n credentialId: string;\n credentialName: string;\n credentialDeviceType: string;\n ipAddress: string;\n userAgent: string;\n organizationId?: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_User_PasskeyRegisteredEventData = {\n eventType: CoreAuditableEventType.USER_PASSKEY_REGISTERED,\n userId: data.userId,\n email: data.email,\n credentialId: data.credentialId,\n credentialName: data.credentialName,\n credentialDeviceType: data.credentialDeviceType,\n ipAddress: data.ipAddress,\n userAgent: data.userAgent,\n };\n\n await this._createAuditLog({\n userId: data.userId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.USER_PASSKEY_REGISTERED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n /\n Log passkey authentication success\n /\n public async logUserPasskeyAuthSuccess(data: {\n userId: string;\n email: string;\n credentialId: string;\n ipAddress: string;\n userAgent: string;\n sessionId: string;\n organizationId?: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_User_PasskeyAuthSuccessEventData = {\n eventType: CoreAuditableEventType.USER_PASSKEY_AUTHENTICATION_SUCCESS,\n userId: data.userId,\n email: data.email,\n credentialId: data.credentialId,\n ipAddress: data.ipAddress,\n userAgent: data.userAgent,\n sessionId: data.sessionId,\n };\n\n await this._createAuditLog({\n userId: data.userId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.LOW,\n eventType: CoreAuditableEventType.USER_PASSKEY_AUTHENTICATION_SUCCESS,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n /\n Log passkey authentication failure\n /\n public async logUserPasskeyAuthFailure(data: {\n email: string;\n failureReason: string;\n ipAddress: string;\n userAgent: string;\n sessionId: string;\n organizationId?: string;\n }): Promise<void> {\n const eventData: AuditableEvent_User_PasskeyAuthFailureEventData = {\n eventType: CoreAuditableEventType.USER_PASSKEY_AUTHENTICATION_FAILURE,\n email: data.email,\n failureReason: data.failureReason,\n ipAddress: data.ipAddress,\n userAgent: data.userAgent,\n sessionId: data.sessionId,\n };\n\n await this._createAuditLog({\n userId: undefined,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.USER_PASSKEY_AUTHENTICATION_FAILURE,\n eventData: eventData as Record<string, any>,\n });\n }\n\n /\n Log a passkey assertion whose signature VERIFIED and whose counter did not advance.\n \n Emitted only AFTER signature verification, which is what makes it worth alerting on: an\n * unauthenticated caller who knows a credential id cannot forge this row. Risk level HIGH and\n * severity CRITICAL — it is the one authentication signal that means a private key may exist in\n * two places, and it used to be indistinguishable from a typo'd credential in the trail.\n /\n public async logUserPasskeyCloneSuspected(data: {\n userId: string;\n credentialId: string;\n storedCounter: number;\n receivedCounter: number;\n credentialDeviceType: string;\n credentialBackedUp: boolean;\n aaguid?: string;\n ceremony: string;\n ipAddress: string;\n userAgent: string;\n organizationId?: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_User_PasskeyCloneSuspectedEventData = {\n eventType: CoreAuditableEventType.USER_PASSKEY_CLONE_SUSPECTED,\n userId: data.userId,\n credentialId: data.credentialId,\n storedCounter: data.storedCounter,\n receivedCounter: data.receivedCounter,\n credentialDeviceType: data.credentialDeviceType,\n credentialBackedUp: data.credentialBackedUp,\n ...(data.aaguid ? { aaguid: data.aaguid } : {}),\n ceremony: data.ceremony,\n ipAddress: data.ipAddress,\n userAgent: data.userAgent,\n };\n\n await this._createAuditLog({\n userId: data.userId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.HIGH,\n eventType: CoreAuditableEventType.USER_PASSKEY_CLONE_SUSPECTED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n /\n Record that a scanner found an uploaded file INFECTED (#506).\n \n Called AFTER the file's terminal transition, so `fileStatus` describes a state the record\n * actually holds rather than one the caller intends. `HIGH` risk — the same level the passkey\n * clone suspicion carries, and for the same reason: a security mechanism reached a conclusion\n * about a real threat.\n /\n public async logFileMalwareDetected(data: {\n fileId: string;\n scannerRef: string;\n threatName?: string;\n resourceType?: string;\n resourceId?: string;\n organizationId?: string;\n fileStatus: string;\n userId?: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_File_MalwareDetectedEventData = {\n eventType: CoreAuditableEventType.FILE_MALWARE_DETECTED,\n fileId: data.fileId,\n scannerRef: data.scannerRef,\n ...(data.threatName ? { threatName: data.threatName } : {}),\n ...(data.resourceType ? { resourceType: data.resourceType } : {}),\n ...(data.resourceId ? { resourceId: data.resourceId } : {}),\n ...(data.organizationId ? { organizationId: data.organizationId } : {}),\n fileStatus: data.fileStatus,\n };\n\n await this._createAuditLog({\n userId: data.userId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.HIGH,\n eventType: CoreAuditableEventType.FILE_MALWARE_DETECTED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n /\n Record that a scan could NOT be completed (#506).\n \n A different story from a detection and therefore a different event: the control did not run.\n * `failureReason` is TRUNCATED here rather than at the call site, so every caller gets the bound\n * — a scanner error routinely embeds a host, a socket path or a temporary file path, and this row\n * is replicated to the organisation's SIEM and to the immutable store.\n /\n public async logFileMalwareScanFailed(data: {\n fileId: string;\n scannerRef: string;\n failureReason?: string;\n resourceType?: string;\n resourceId?: string;\n organizationId?: string;\n fileStatus: string;\n userId?: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const truncatedReason = data.failureReason?.slice(0, FILE_MALWARE_SCAN_FAILURE_REASON_MAX_LENGTH);\n const eventData: AuditableEvent_File_MalwareScanFailedEventData = {\n eventType: CoreAuditableEventType.FILE_MALWARE_SCAN_FAILED,\n fileId: data.fileId,\n scannerRef: data.scannerRef,\n ...(truncatedReason ? { failureReason: truncatedReason } : {}),\n ...(data.resourceType ? { resourceType: data.resourceType } : {}),\n ...(data.resourceId ? { resourceId: data.resourceId } : {}),\n ...(data.organizationId ? { organizationId: data.organizationId } : {}),\n fileStatus: data.fileStatus,\n };\n\n await this._createAuditLog({\n userId: data.userId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.FILE_MALWARE_SCAN_FAILED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n /\n Log passkey removed\n /\n public async logUserPasskeyRemoved(data: {\n userId: string;\n email: string;\n credentialId: string;\n credentialName: string;\n ipAddress: string;\n userAgent: string;\n organizationId?: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_User_PasskeyRemovedEventData = {\n eventType: CoreAuditableEventType.USER_PASSKEY_REMOVED,\n userId: data.userId,\n email: data.email,\n credentialId: data.credentialId,\n credentialName: data.credentialName,\n ipAddress: data.ipAddress,\n userAgent: data.userAgent,\n };\n\n await this._createAuditLog({\n userId: data.userId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.USER_PASSKEY_REMOVED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n // ===============================\n // SCIM USER PROVISIONING AUDIT METHODS (H8)\n // ===============================\n\n /\n Log SCIM user provisioned (created)\n /\n public async logSCIMUserProvisioned(data: {\n organizationId: string;\n userId: string;\n email: string;\n isNewUser: boolean;\n provisionedVia: string;\n authSource?: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_SCIM_UserProvisionedEventData = {\n eventType: CoreAuditableEventType.SCIM_USER_PROVISIONED,\n organizationId: data.organizationId,\n userId: data.userId,\n email: data.email,\n isNewUser: data.isNewUser,\n provisionedVia: data.provisionedVia,\n authSource: data.authSource,\n };\n\n await this._createAuditLog({\n userId: data.userId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.SCIM_USER_PROVISIONED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n /\n Log SCIM user updated (replace or patch)\n /\n public async logSCIMUserUpdated(data: {\n organizationId: string;\n userId: string;\n operation: string;\n updatedAttributes?: string[];\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_SCIM_UserUpdatedEventData = {\n eventType: CoreAuditableEventType.SCIM_USER_UPDATED,\n organizationId: data.organizationId,\n userId: data.userId,\n operation: data.operation,\n updatedAttributes: data.updatedAttributes,\n };\n\n await this._createAuditLog({\n userId: data.userId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.LOW,\n eventType: CoreAuditableEventType.SCIM_USER_UPDATED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n /\n Log SCIM user deactivated (deleted/deactivated)\n /\n public async logSCIMUserDeactivated(data: {\n organizationId: string;\n userId: string;\n email?: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_SCIM_UserDeactivatedEventData = {\n eventType: CoreAuditableEventType.SCIM_USER_DEACTIVATED,\n organizationId: data.organizationId,\n userId: data.userId,\n email: data.email,\n };\n\n await this._createAuditLog({\n userId: data.userId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.SCIM_USER_DEACTIVATED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n // ===============================\n // Magic Link Events (Phase G2)\n // ===============================\n\n public async logMagicLinkSent(data: {\n email: string;\n ipAddress: string;\n userAgent: string;\n }): Promise<void> {\n const eventData: AuditableEvent_User_MagicLinkSentEventData = {\n eventType: CoreAuditableEventType.USER_MAGIC_LINK_SENT,\n ...data,\n };\n await this._createAuditLog({\n riskLevel: ResourceOperationRiskLevel.LOW,\n eventType: CoreAuditableEventType.USER_MAGIC_LINK_SENT,\n eventData: eventData as Record<string, any>,\n });\n }\n\n public async logMagicLinkVerified(data: {\n userId: string;\n email: string;\n sessionId: string;\n ipAddress: string;\n userAgent: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_User_MagicLinkVerifiedEventData = {\n eventType: CoreAuditableEventType.USER_MAGIC_LINK_VERIFIED,\n ...data,\n };\n await this._createAuditLog({\n userId: data.userId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.USER_MAGIC_LINK_VERIFIED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n public async logMagicLinkFailed(data: {\n email?: string;\n failureReason: string;\n ipAddress: string;\n userAgent: string;\n }): Promise<void> {\n const eventData: AuditableEvent_User_MagicLinkFailedEventData = {\n eventType: CoreAuditableEventType.USER_MAGIC_LINK_FAILED,\n ...data,\n };\n await this._createAuditLog({\n riskLevel: ResourceOperationRiskLevel.HIGH,\n eventType: CoreAuditableEventType.USER_MAGIC_LINK_FAILED,\n eventData: eventData as Record<string, any>,\n });\n }\n\n // ===============================\n // SMS OTP Events (Phase G2)\n // ===============================\n\n public async logSMSOTPSent(data: {\n phoneNumber: string;\n factorLevel: string;\n sessionId: string;\n ipAddress: string;\n userAgent: string;\n }): Promise<void> {\n const eventData: AuditableEvent_User_SMSOTPSentEventData = {\n eventType: CoreAuditableEventType.USER_SMS_OTP_SENT,\n ...data,\n };\n await this._createAuditLog({\n riskLevel: ResourceOperationRiskLevel.LOW,\n eventType: CoreAuditableEventType.USER_SMS_OTP_SENT,\n eventData: eventData as Record<string, any>,\n });\n }\n\n public async logSMSOTPVerified(data: {\n userId: string;\n phoneNumber: string;\n factorLevel: string;\n sessionId: string;\n ipAddress: string;\n userAgent: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_User_SMSOTPVerifiedEventData = {\n eventType: CoreAuditableEventType.USER_SMS_OTP_VERIFIED,\n ...data,\n };\n await this._createAuditLog({\n userId: data.userId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.USER_SMS_OTP_VERIFIED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n public async logSMSOTPFailed(data: {\n phoneNumber?: string;\n factorLevel: string;\n failureReason: string;\n sessionId: string;\n ipAddress: string;\n userAgent: string;\n }): Promise<void> {\n const eventData: AuditableEvent_User_SMSOTPFailedEventData = {\n eventType: CoreAuditableEventType.USER_SMS_OTP_FAILED,\n ...data,\n };\n await this._createAuditLog({\n riskLevel: ResourceOperationRiskLevel.HIGH,\n eventType: CoreAuditableEventType.USER_SMS_OTP_FAILED,\n eventData: eventData as Record<string, any>,\n });\n }\n\n // ===============================\n // Phone Verification Events (Phase G2)\n // ===============================\n\n public async logPhoneVerified(data: {\n userId: string;\n phoneNumber: string;\n ipAddress: string;\n userAgent: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_User_PhoneVerifiedEventData = {\n eventType: CoreAuditableEventType.USER_PHONE_VERIFIED,\n ...data,\n };\n await this._createAuditLog({\n userId: data.userId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.USER_PHONE_VERIFIED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n public async logPhoneVerificationFailed(data: {\n phoneNumber: string;\n failureReason: string;\n ipAddress: string;\n userAgent: string;\n }): Promise<void> {\n const eventData: AuditableEvent_User_PhoneVerificationFailedEventData = {\n eventType: CoreAuditableEventType.USER_PHONE_VERIFICATION_FAILED,\n ...data,\n };\n await this._createAuditLog({\n riskLevel: ResourceOperationRiskLevel.HIGH,\n eventType: CoreAuditableEventType.USER_PHONE_VERIFICATION_FAILED,\n eventData: eventData as Record<string, any>,\n });\n }\n\n // ===============================\n // OAuth2 Provider Restriction Events (Phase G3)\n // ===============================\n\n /\n Log OAuth2 provider blocked by scope-level restrictions.\n * Emitted at initiation (G3-M4) and callback (G3-M5) enforcement points.\n /\n public async logOAuth2ProviderBlocked(data: {\n email?: string;\n providerRef: string;\n scopeType: AuthScopeType;\n organizationId?: string;\n applicationId?: string;\n reason: string;\n ipAddress: string;\n userAgent: string;\n }): Promise<void> {\n const typedEventData: AuditableEvent_OAuth2ProviderBlockedEventData = {\n eventType: CoreAuditableEventType.OAUTH2_PROVIDER_BLOCKED,\n email: data.email,\n providerRef: data.providerRef,\n scopeType: data.scopeType,\n organizationId: data.organizationId,\n applicationId: data.applicationId,\n reason: data.reason,\n ipAddress: data.ipAddress,\n userAgent: data.userAgent,\n };\n await this._createAuditLog({\n organizationId: data.organizationId,\n applicationId: data.applicationId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.OAUTH2_PROVIDER_BLOCKED,\n eventData: typedEventData as Record<string, any>,\n });\n }\n\n /\n An enterprise OIDC login refused because the provider did not report the demanded authentication\n * context (issue #444).\n \n NO tenant scope on the payload, and that is deliberate rather than an omission: the refusal\n * happens during the callback, before the claimant is provisioned or linked, so there is no\n * verified organization to attribute it to. Inventing one from an unverified email domain would\n * put an attacker-chosen tenant id on a security event.\n \n HIGH risk, unlike its `OAUTH2_PROVIDER_BLOCKED` neighbour at MEDIUM. That one records a policy\n * that worked; this one records a step-up demand the identity provider did NOT satisfy, which is\n * either a misconfiguration leaving an operator's strongest control inert or a provider behaving\n * differently from what was agreed. Both want a reader.\n /\n public async logOidcAcrDemandUnsatisfied(data: {\n providerRef: string;\n demandedAcrValues: string[];\n receivedAcr?: string;\n failureReason?: string;\n }): Promise<void> {\n const typedEventData: AuditableEvent_OidcAcrDemandUnsatisfiedEventData = {\n eventType: CoreAuditableEventType.OIDC_ACR_DEMAND_UNSATISFIED,\n providerRef: data.providerRef,\n demandedAcrValues: data.demandedAcrValues,\n receivedAcr: data.receivedAcr,\n failureReason: data.failureReason,\n };\n await this._createAuditLog({\n riskLevel: ResourceOperationRiskLevel.HIGH,\n eventType: CoreAuditableEventType.OIDC_ACR_DEMAND_UNSATISFIED,\n eventData: typedEventData as Record<string, any>,\n });\n }\n\n // ===============================\n // METHOD MANAGEMENT AUDIT METHODS (#13f)\n // ===============================\n\n public async logUserPasswordChanged(data: {\n userId: string;\n ipAddress: string;\n userAgent: string;\n organizationId?: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n await this._createAuditLog({\n userId: data.userId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.USER_PASSWORD_CHANGED,\n eventData: { eventType: CoreAuditableEventType.USER_PASSWORD_CHANGED, userId: data.userId, ipAddress: data.ipAddress, userAgent: data.userAgent } as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n public async logUserPasswordSet(data: {\n userId: string;\n ipAddress: string;\n userAgent: string;\n organizationId?: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n await this._createAuditLog({\n userId: data.userId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.USER_PASSWORD_SET,\n eventData: { eventType: CoreAuditableEventType.USER_PASSWORD_SET, userId: data.userId, ipAddress: data.ipAddress, userAgent: data.userAgent } as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n public async logUserTOTPDisabled(data: {\n userId: string;\n ipAddress: string;\n userAgent: string;\n organizationId?: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n await this._createAuditLog({\n userId: data.userId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.USER_TOTP_DISABLED,\n eventData: { eventType: CoreAuditableEventType.USER_TOTP_DISABLED, userId: data.userId, ipAddress: data.ipAddress, userAgent: data.userAgent } as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n public async logUserIdentityLinkRemoved(data: {\n userId: string;\n linkId: string;\n providerRef: string;\n ipAddress: string;\n userAgent: string;\n organizationId?: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n await this._createAuditLog({\n userId: data.userId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.USER_IDENTITY_LINK_REMOVED,\n eventData: { eventType: CoreAuditableEventType.USER_IDENTITY_LINK_REMOVED, userId: data.userId, linkId: data.linkId, providerRef: data.providerRef, ipAddress: data.ipAddress, userAgent: data.userAgent } as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n // ===============================\n // SCIM TOKEN LIFECYCLE EVENTS (Phase H)\n // ===============================\n\n public async logSCIMTokenGenerated(data: {\n tokenId: string;\n displayName: string;\n organizationId: string;\n createdByUserId: string;\n }): Promise<void> {\n await this._createAuditLog({\n userId: data.createdByUserId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.SCIM_TOKEN_GENERATED,\n eventData: { eventType: CoreAuditableEventType.SCIM_TOKEN_GENERATED, ...data } as Record<string, any>,\n });\n }\n\n public async logSCIMTokenRevoked(data: {\n tokenId: string;\n displayName: string;\n organizationId: string;\n revokedByUserId: string;\n }): Promise<void> {\n await this._createAuditLog({\n userId: data.revokedByUserId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.SCIM_TOKEN_REVOKED,\n eventData: { eventType: CoreAuditableEventType.SCIM_TOKEN_REVOKED, ...data } as Record<string, any>,\n });\n }\n\n public async logSCIMTokenRotated(data: {\n newTokenId: string;\n oldTokenId: string;\n organizationId: string;\n rotatedByUserId: string;\n overlapHours: number;\n }): Promise<void> {\n await this._createAuditLog({\n userId: data.rotatedByUserId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.SCIM_TOKEN_ROTATED,\n eventData: { eventType: CoreAuditableEventType.SCIM_TOKEN_ROTATED, ...data } as Record<string, any>,\n });\n }\n\n public async logSCIMProvisioningConfigUpdated(data: {\n organizationId: string;\n updatedByUserId: string;\n changes: Record<string, unknown>;\n }): Promise<void> {\n await this._createAuditLog({\n userId: data.updatedByUserId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.LOW,\n eventType: CoreAuditableEventType.SCIM_PROVISIONING_CONFIG_UPDATED,\n eventData: { eventType: CoreAuditableEventType.SCIM_PROVISIONING_CONFIG_UPDATED, ...data } as Record<string, any>,\n });\n }\n\n public async logSCIMProvisioningFailed(data: {\n organizationId: string;\n operation: string;\n errorMessage: string;\n userId?: string;\n }): Promise<void> {\n await this._createAuditLog({\n userId: data.userId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.SCIM_PROVISIONING_FAILED,\n eventData: { eventType: CoreAuditableEventType.SCIM_PROVISIONING_FAILED, ...data } as Record<string, any>,\n });\n }\n\n // ===============================\n // SAML AUDIT METHODS (AUTH-2, D13/D19.4)\n // ===============================\n\n public async logSAMLEvent(\n eventType: CoreAuditableEventType,\n riskLevel: ResourceOperationRiskLevel,\n data: Record<string, unknown> & {\n organizationId?: string;\n applicationId?: string;\n userId?: string;\n },\n requestExecutionContext?: ExecutionContext<any>,\n routingOrgIds?: VerifiedOrgId[],\n ): Promise<void> {\n await this._createAuditLog({\n userId: data.userId,\n organizationId: data.organizationId,\n applicationId: data.applicationId,\n riskLevel,\n eventType,\n eventData: { eventType, ...data } as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n // ===============================\n // CROSS-FRONTEND HANDOFF AUDIT METHODS (cross-app-jwt-propagation Step 2)\n // ===============================\n\n /\n Log issuance of a cross-frontend session handoff token.\n \n This event records that an authenticated user obtained a one-time\n * AUTH_CODE_EXCHANGE token bound to a target frontend (browser-only).\n * The audit row records issuance only. Redeeming the code goes through the\n * generic `/auth/token/exchange` AUTH_CODE_EXCHANGE path, not the W7.3b\n * one-off-session exchange event. The `consumableTokenId` below is the\n * correlation anchor for ops without persisting the raw deep link (which can\n * carry org IDs, share codes, draft IDs, or one-off tokens forwarded as query\n * params).\n \n Hashing happens HERE (not at the call site) so all handoff audit rows use\n * the same SHA-256 computation. Callers MUST pass the validated `returnPath`,\n * never a pre-hashed value.\n \n Risk level: HIGH — issuance mints a transferable session credential. Treated\n * with the same severity as PASSWORD_RESET_COMPLETED + ONE_OFF_TOKEN_CREATED.\n /\n public async logUserCrossFrontendHandoffIssued(data: {\n userId: string;\n sourceFrontendServiceName?: string;\n targetServiceKey: string;\n /* Validated returnPath; helper hashes it with SHA-256 before persisting. /\n returnPath: string;\n consumableTokenId: string;\n ipAddress: string;\n userAgent: string;\n organizationId?: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const returnPathHash = createHash('sha256').update(data.returnPath).digest('hex');\n\n const eventData: AuditableEvent_User_CrossFrontendHandoffIssuedEventData = {\n eventType: CoreAuditableEventType.USER_CROSS_FRONTEND_HANDOFF_ISSUED,\n userId: data.userId,\n sourceFrontendServiceName: data.sourceFrontendServiceName,\n targetServiceKey: data.targetServiceKey,\n returnPathHash,\n consumableTokenId: data.consumableTokenId,\n ipAddress: data.ipAddress,\n userAgent: data.userAgent,\n };\n\n await this._createAuditLog({\n userId: data.userId,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.HIGH,\n eventType: CoreAuditableEventType.USER_CROSS_FRONTEND_HANDOFF_ISSUED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n // ═══════════════════════════════════════════════════════════════════════════════════════════\n // Organization provider credentials — an organization's OWN authority toward a third party.\n //\n // Four verbs, four methods, and NONE of them takes the credential value as a parameter. That is\n // the enforcement: a caller cannot pass a secret to a method with no parameter to receive it, so\n // the \"value never in an audit payload\" requirement is a property of these signatures rather than\n // a redaction step somebody has to remember at each call site.\n // ═══════════════════════════════════════════════════════════════════════════════════════════════\n\n /\n A tenant granted this application authority to act as it toward a named third party.\n \n MEDIUM rather than HIGH: the act is an administrator deliberately configuring an integration,\n * which is ordinary tenant administration. What makes it worth recording is that it is the moment\n * the application's outbound identity for this tenant STOPS being the deployment's shared one.\n \n assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — organization authorizes delegated\n * access to a named third party.\n /\n public async logOrganizationProviderCredentialSet(data: {\n organizationId: string;\n providerRef: string;\n secretSlug: string;\n credentialId: string;\n setBy?: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_OrganizationProviderCredential_SetEventData = {\n eventType: CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_SET,\n organizationId: data.organizationId,\n providerRef: data.providerRef,\n secretSlug: data.secretSlug,\n credentialId: data.credentialId,\n setBy: data.setBy,\n };\n await this._createAuditLog({\n userId: data.setBy,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_SET,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n /\n The stored VALUE changed for a credential that already existed.\n \n HIGH, unlike its `_SET` sibling, and the difference is the incident question. Rotation is what a\n * tenant does after a suspected compromise — and it is also what an ATTACKER does to lock a tenant\n * out of its own integration while keeping the application acting on their behalf. A first\n * configuration cannot be either of those.\n \n assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — the delegated authority's secret is\n * replaced.\n /\n public async logOrganizationProviderCredentialRotated(data: {\n organizationId: string;\n providerRef: string;\n secretSlug: string;\n credentialId: string;\n rotatedBy?: string;\n previousSecretSetAt?: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_OrganizationProviderCredential_RotatedEventData = {\n eventType: CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_ROTATED,\n organizationId: data.organizationId,\n providerRef: data.providerRef,\n secretSlug: data.secretSlug,\n credentialId: data.credentialId,\n rotatedBy: data.rotatedBy,\n previousSecretSetAt: data.previousSecretSetAt,\n };\n await this._createAuditLog({\n userId: data.rotatedBy,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.HIGH,\n eventType: CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_ROTATED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n /\n The credential was RESOLVED for an outbound call — the application acted as the tenant.\n \n LOW, and high-volume by design. This is the only event that can show a leaked credential being\n * EXERCISED; without it the trail records how an integration was configured and nothing about how\n * it was used. `resolvedFrom` is the field that makes it worth the volume: it distinguishes a\n * tenant acting as itself from a tenant silently falling back to the deployment's shared\n * principal, which is the exact condition this whole subsystem exists to make visible.\n \n assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — delegated authority is exercised.\n /\n public async logOrganizationProviderCredentialUsed(data: {\n organizationId: string;\n providerRef: string;\n secretSlug: string;\n resolvedFrom: ProviderCredentialResolutionSource;\n credentialId?: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_OrganizationProviderCredential_UsedEventData = {\n eventType: CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_USED,\n organizationId: data.organizationId,\n providerRef: data.providerRef,\n secretSlug: data.secretSlug,\n resolvedFrom: data.resolvedFrom,\n credentialId: data.credentialId,\n };\n await this._createAuditLog({\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.LOW,\n eventType: CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_USED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n /\n The grant ended — by an administrator revoking it, or by the tenant itself being purged.\n \n HIGH: a credential disappearing is how a tenant's integration stops working, and the first\n * question afterwards is always whether a human did it. `reason` answers that without the reader\n * having to correlate against the organization lifecycle trail.\n \n assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — evidence that delegated authority\n * was withdrawn.\n /\n public async logOrganizationProviderCredentialDeleted(data: {\n organizationId: string;\n providerRef: string;\n secretSlug: string;\n credentialId: string;\n reason: ProviderCredentialDeletionReason;\n deletedBy?: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_OrganizationProviderCredential_DeletedEventData = {\n eventType: CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_DELETED,\n organizationId: data.organizationId,\n providerRef: data.providerRef,\n secretSlug: data.secretSlug,\n credentialId: data.credentialId,\n reason: data.reason,\n deletedBy: data.deletedBy,\n };\n await this._createAuditLog({\n userId: data.deletedBy,\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.HIGH,\n eventType: CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_DELETED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n /\n A person connected their own account at a third party.\n \n No `organizationId` on any of these four, and that is the substantive difference from the\n * organization siblings rather than an omission. A person's credential belongs to the person, not\n * to whichever tenant they happened to be looking at when they authored it — passing an\n * organization would route the event into that tenant's SIEM stream and tell its administrators\n * about an individual's personal vendor account. `userId` is both the subject and the actor,\n * because the resource admits no administrative variant and nobody else can write the row.\n \n assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — user authorizes delegated access.\n /\n public async logUserProviderCredentialSet(data: {\n userId: string;\n providerRef: string;\n secretSlug: string;\n credentialId: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_UserProviderCredential_SetEventData = {\n eventType: CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_SET,\n userId: data.userId,\n providerRef: data.providerRef,\n secretSlug: data.secretSlug,\n credentialId: data.credentialId,\n };\n await this._createAuditLog({\n userId: data.userId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_SET,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n /* The stored value changed for a person's credential that already existed. /\n public async logUserProviderCredentialRotated(data: {\n userId: string;\n providerRef: string;\n secretSlug: string;\n credentialId: string;\n previousSecretSetAt?: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_UserProviderCredential_RotatedEventData = {\n eventType: CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_ROTATED,\n userId: data.userId,\n providerRef: data.providerRef,\n secretSlug: data.secretSlug,\n credentialId: data.credentialId,\n previousSecretSetAt: data.previousSecretSetAt,\n };\n await this._createAuditLog({\n userId: data.userId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_ROTATED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n /\n The application acted as that person toward the provider.\n \n `credentialId` is REQUIRED here where the organization sibling makes it optional, and the\n * difference is the point: the organization event can describe a deployment-environment fallback,\n * which has no row to name. A person's credential has no fallback at all, so an event without a\n * row would describe something that must never happen.\n /\n public async logUserProviderCredentialUsed(data: {\n userId: string;\n providerRef: string;\n secretSlug: string;\n resolvedFrom: ProviderCredentialResolutionSource;\n credentialId: string;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_UserProviderCredential_UsedEventData = {\n eventType: CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_USED,\n userId: data.userId,\n providerRef: data.providerRef,\n secretSlug: data.secretSlug,\n resolvedFrom: data.resolvedFrom,\n credentialId: data.credentialId,\n };\n await this._createAuditLog({\n userId: data.userId,\n riskLevel: ResourceOperationRiskLevel.LOW,\n eventType: CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_USED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n /\n The person's grant ended — by them removing it, or by their own erasure.\n \n HIGH, matching the organization sibling, and carrying a second reason here: when `reason` names\n * an erasure cascade, this event is the ONLY remaining evidence that the subject's third-party\n * credentials were destroyed. The row it describes no longer exists.\n \n assurance-control: WILDO.PRIVACY.ERASURE — evidence that erasure reached this store.\n /\n public async logUserProviderCredentialDeleted(data: {\n userId: string;\n providerRef: string;\n secretSlug: string;\n credentialId: string;\n reason: ProviderCredentialDeletionReason;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_UserProviderCredential_DeletedEventData = {\n eventType: CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_DELETED,\n userId: data.userId,\n providerRef: data.providerRef,\n secretSlug: data.secretSlug,\n credentialId: data.credentialId,\n reason: data.reason,\n };\n await this._createAuditLog({\n userId: data.userId,\n riskLevel: ResourceOperationRiskLevel.HIGH,\n eventType: CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_DELETED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n /\n A PERSON completed a consent ceremony at a vendor and their grant is now stored.\n \n HIGH risk, matching the deletion beside it rather than the routine `_SET`: what is recorded here\n * is a third party gaining the ability to act as somebody, which is the same magnitude of change\n * as that ability being taken away. The severity an operator sees is the envelope's, which reads\n * this as ordinary user lifecycle; the risk level is the framework's own view of the write.\n /\n public async logUserProviderConnectionGranted(data: {\n userId: string;\n providerRef: string;\n secretSlug: string;\n credentialId: string;\n grantedScopes?: readonly string[];\n accountRef?: string;\n replacedExistingConnection: boolean;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_UserProviderConnection_GrantedEventData = {\n eventType: CoreAuditableEventType.USER_PROVIDER_CONNECTION_GRANTED,\n userId: data.userId,\n providerRef: data.providerRef,\n secretSlug: data.secretSlug,\n credentialId: data.credentialId,\n // Spread rather than assigned, so an absent scope set stays ABSENT. The vendor saying nothing\n // and the vendor granting nothing are different facts, and `[]` would assert the second.\n ...(data.grantedScopes === undefined ? {} : { grantedScopes: [...data.grantedScopes] }),\n ...(data.accountRef === undefined ? {} : { accountRef: data.accountRef }),\n replacedExistingConnection: data.replacedExistingConnection,\n };\n await this._createAuditLog({\n userId: data.userId,\n riskLevel: ResourceOperationRiskLevel.HIGH,\n eventType: CoreAuditableEventType.USER_PROVIDER_CONNECTION_GRANTED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n /* An ORGANIZATION's delegated authorization toward a vendor was granted. See the user sibling. */\n public async logOrganizationProviderConnectionGranted(data: {\n organizationId: string;\n providerRef: string;\n secretSlug: string;\n credentialId: string;\n grantedByUserId?: string;\n grantedScopes?: readonly string[];\n accountRef?: string;\n replacedExistingConnection: boolean;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n const eventData: AuditableEvent_OrganizationProviderConnection_GrantedEventData = {\n eventType: CoreAuditableEventType.ORGANIZATION_PROVIDER_CONNECTION_GRANTED,\n organizationId: data.organizationId,\n providerRef: data.providerRef,\n secretSlug: data.secretSlug,\n credentialId: data.credentialId,\n ...(data.grantedByUserId === undefined ? {} : { grantedByUserId: data.grantedByUserId }),\n ...(data.grantedScopes === undefined ? {} : { grantedScopes: [...data.grantedScopes] }),\n ...(data.accountRef === undefined ? {} : { accountRef: data.accountRef }),\n replacedExistingConnection: data.replacedExistingConnection,\n };\n await this._createAuditLog({\n organizationId: data.organizationId,\n riskLevel: ResourceOperationRiskLevel.HIGH,\n eventType: CoreAuditableEventType.ORGANIZATION_PROVIDER_CONNECTION_GRANTED,\n eventData: eventData as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n\n public async logGenericEvent(data: {\n userId?: string;\n organizationId?: string;\n riskLevel: ResourceOperationRiskLevel;\n eventType: CoreAuditableEventType \| string;\n eventData: Record<string, unknown>;\n }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void> {\n await this._createAuditLog({\n userId: data.userId,\n organizationId: data.organizationId,\n riskLevel: data.riskLevel,\n eventType: data.eventType,\n eventData: { eventType: data.eventType, ...data.eventData } as Record<string, any>,\n }, requestExecutionContext, routingOrgIds);\n }\n}\n"]}