@wildo-ai/saas-backend-lib 1.1.3 → 1.1.4

package/dist/esm/compliance/audit-trails/services/utils/leased-value-cache.backend.utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"leased-value-cache.backend.utils.js","sourceRoot":"","sources":["../../../../../../../src/compliance/audit-trails/services/utils/leased-value-cache.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAuBH;;;;GAIG;AACH,MAAM,OAAO,gBAAgB;IAOE;IANZ,OAAO,GAAG,IAAI,GAAG,EAA0B,CAAC;IAC7D,0GAA0G;IACzF,QAAQ,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC1D,kFAAkF;IACjE,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEzD,YAA6B,OAAgC;QAAhC,YAAO,GAAP,OAAO,CAAyB;IAAG,CAAC;IAEjE;;;;;;;;OAQG;IACI,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,IAAsB;QAClD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEpC,IAAI,KAAK,EAAE,CAAC;YACV,+FAA+F;YAC/F,+DAA+D;YAC/D,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAE7B,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;gBACtC,2FAA2F;gBAC3F,6FAA6F;gBAC7F,+FAA+F;gBAC/F,6FAA6F;gBAC7F,qBAAqB;gBACrB,EAAE;gBACF,4FAA4F;gBAC5F,6FAA6F;gBAC7F,6FAA6F;gBAC7F,uFAAuF;gBACvF,KAAK,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC;gBAC/D,KAAK,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;oBACxC,wGAAwG;gBAC1G,CAAC,CAAC,CAAC;YACL,CAAC;YACD,OAAO,KAAK,CAAC,KAAK,CAAC;QACrB,CAAC;QAED,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACnC,CAAC;IAED;;;;;;;;;OASG;IACI,UAAU,CAAC,GAAW;QAC3B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClE,CAAC;IAED,6FAA6F;IACtF,IAAI;QACT,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3B,CAAC;IAED,0EAA0E;IACnE,KAAK;QACV,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrB,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;IAC3B,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,MAAM;QACjB,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAED,2GAA2G;IACnG,SAAS,CAAC,GAAW,EAAE,IAAsB;QACnD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAE1B,MAAM,mBAAmB,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC3D,MAAM,OAAO,GAAG,IAAI,EAAE;aACnB,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;YACd,8FAA8F;YAC9F,4FAA4F;YAC5F,+DAA+D;YAC/D,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,mBAAmB,EAAE,CAAC;gBAC7D,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACzB,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACxB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACvC,IAAI,QAAQ,EAAE,CAAC;gBACb,gGAAgG;gBAChG,+DAA+D;gBAC/D,QAAQ,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC;gBAClE,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBAC5C,OAAO,QAAQ,CAAC,KAAK,CAAC;YACxB,CAAC;YACD,oGAAoG;YACpG,8FAA8F;YAC9F,MAAM,KAAK,CAAC;QACd,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,gGAAgG;YAChG,mDAAmD;YACnD,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,OAAO;gBAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACpE,CAAC,CAAC,CAAC;QAEL,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAChC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,sFAAsF;IAC9E,KAAK,CAAC,GAAW,EAAE,KAAQ;QACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,KAAK,GAAG,KAAK,CAAC;YACvB,QAAQ,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC;YAClE,OAAO;QACT,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;YACjD,oGAAoG;YACpG,qBAAqB;YACrB,MAAM,iBAAiB,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YAC3D,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;gBACpC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;gBACvC,iGAAiG;gBACjG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAC5F,CAAC;CACF","sourcesContent":["/**\n * # A leased, stale-while-revalidate, single-flight cache for values read on the AUDIT EMISSION PATH\n *\n * The audit dispatcher holds two per-organization caches — the SIEM export config that decides WHERE\n * an event is routed, and the organization name that decorates the envelope. Both were hand-rolled\n * `Map`s with a 5-minute wall-clock TTL, a copy-pasted FIFO eviction block, and a blocking re-read on\n * expiry. This is the one place those mechanics live now, so a property fixed here is fixed for both\n * — the shape `.claude/rules/invariant-call-site-enumeration.md` exists to force.\n *\n * ## The governing constraint: emission must never fail, and never block, the thing it observes\n *\n * `AuditEventDispatcherBackendService` runs detached (`audit-logs.backend.service.ts:349` calls it\n * without `await`, with a `.catch`), and its whole contract is that a routing failure is logged and\n * never thrown onto the business operation. Every property below follows from that:\n *\n * | Property | Why it is required here specifically |\n * |---|---|\n * | **Stale-while-revalidate** | Past the lease the CACHED value is returned immediately and the re-read runs off the caller's path. Staleness is tolerable (a config changes monthly); a stall is not. It is also what makes a SHORT lease affordable: shortening it now costs read volume only, never latency. |\n * | **Single flight** | A burst of events for one organization must produce ONE read, not one per event. Without it a cold organization under load fires N concurrent reads — and for the SIEM config each of those reads emits its own `system_context_read` audit row and can race the lazy default-row materialisation. |\n * | **Generation-guarded write-back** | An {@link invalidate} that lands WHILE a refresh is in flight must win. Without the guard the in-flight read — started before the write committed — writes the pre-write value back over the invalidation, so the invalidation silently does nothing in exactly the case it exists for. |\n * | **Backoff on failure** | A failed refresh stamps the next attempt one lease ahead rather than retrying per event. A broken repository must not turn into a read storm that scales with audit volume. |\n * | **LRU, not FIFO, eviction** | The evicted entry is the least recently USED. The previous FIFO block (labelled \"simple LRU approximation\", which it was not) evicted by insertion order, so the busiest organization — inserted first, refreshed in place, never re-inserted — was the first one thrown out and forced back onto a blocking cold read. |\n *\n * ## What it deliberately does NOT do\n *\n * - **It does not live in a shared store.** Putting the VALUE in Redis would make routing depend on a\n *   store that can be unavailable, and would put a network round trip on the emission path. Cross-replica\n *   convergence is carried instead by a published invalidation (see the dispatcher's\n *   `_publishSiemConfigInvalidation`) plus the lease — neither of which the emission path touches.\n * - **It does not expire entries out of the map.** An entry is refreshed in place, never dropped on age,\n *   so a warm organization never pays a blocking read again. Only {@link invalidate} and LRU pressure\n *   remove an entry.\n * - **It caches negative results.** `null` / `undefined` is a value like any other. The alternative —\n *   re-reading on every event for a key with no row — is unbounded read amplification precisely for the\n *   keys that are cheapest to get wrong, and it is the shape the org-name cache had before this.\n *\n * ## Precondition on the loader, which is a real constraint and not boilerplate\n *\n * A caller that JOINS an in-flight load receives the value **the first caller's loader produced**. So\n * every loader passed for one key must be equally privileged: a per-request loader whose visibility\n * varies with the caller would leak one caller's view to another. Both current call sites satisfy this\n * because the execution context they close over is the audit service's freshly-synthesised super-admin\n * APPLICATION-scoped temp context (`audit-logs.backend.service.ts:284`, handed to the dispatcher at\n * `:349`) — identical in privilege for every dispatch. **State the equivalent before adding a third.**\n */\n\n/** One cached entry. `nextRefreshAt` — not an age — is what the lease is measured against, so a failed refresh can back off without pretending the value is fresh. */\ninterface LeasedEntry<T> {\n  value: T;\n  /** Wall-clock instant at or after which the next {@link LeasedValueCache.get} triggers a background refresh. */\n  nextRefreshAt: number;\n}\n\n/** Construction options. `refreshAfterMs` is the guarantee the owning subsystem states publicly — see each call site. */\nexport interface LeasedValueCacheOptions {\n  /** How long a value is served without a re-read. The convergence bound for any change no invalidation reaches. */\n  readonly refreshAfterMs: number;\n  /** Hard ceiling on resident keys; the least recently used is evicted on overflow. */\n  readonly maxEntries: number;\n  /**\n   * Reported when a BACKGROUND refresh throws. The cache keeps serving the previous value and backs off\n   * one lease. Optional, but omitting it makes a persistently unreadable source silent, which is the\n   * failure this whole subsystem exists to make visible — pass one.\n   */\n  readonly onRefreshFailure?: (key: string, error: unknown) => void;\n}\n\n/**\n * A per-key leased cache. See the module header for the design and its constraints.\n *\n * @typeParam T The cached value. Nullable members are cached like any other value, deliberately.\n */\nexport class LeasedValueCache<T> {\n  private readonly entries = new Map<string, LeasedEntry<T>>();\n  /** In-flight loads/refreshes, keyed identically. Present ⇒ a read is already on the wire for that key. */\n  private readonly inFlight = new Map<string, Promise<T>>();\n  /** Monotonic per-key generation. A key absent here has never been invalidated. */\n  private readonly generations = new Map<string, number>();\n\n  constructor(private readonly options: LeasedValueCacheOptions) {}\n\n  /**\n   * Serve `key`, loading it when there is nothing to serve.\n   *\n   * Rejects ONLY when a COLD load rejects — there is no cached value to fall back to, so the caller has\n   * to decide. Once a value exists this never rejects and never blocks: a stale entry is returned as it\n   * stands and the refresh runs detached.\n   *\n   * @param load Reads the current value. Must satisfy the loader precondition in the module header.\n   */\n  public async get(key: string, load: () => Promise<T>): Promise<T> {\n    const entry = this.entries.get(key);\n\n    if (entry) {\n      // Touch for LRU on every hit, fresh or stale: \"recently used\" is about READS, so refreshing in\n      // place must not let a busy key drift toward the eviction end.\n      this.entries.delete(key);\n      this.entries.set(key, entry);\n\n      if (Date.now() >= entry.nextRefreshAt) {\n        // An UNOBSERVABLE optimisation, and deliberately unpinned: removing it changes no outcome,\n        // because `inFlight` already collapses the reads. What it saves is that every event arriving\n        // during a slow refresh would otherwise re-enter `startLoad`, join the same promise and attach\n        // its own `.catch` handler — bounded and released on settle, but pointless work per event on\n        // the emission path.\n        //\n        // It is NOT the failure backoff, however much it looks like one. Backing off after a failed\n        // refresh is `startLoad`'s catch, which re-stamps from the moment the failure LANDED; a slow\n        // failure exhausts this stamp while still on the wire. Mistaking the two makes a backoff pin\n        // that passes with the backoff deleted — measured, and the reason the suite pins both.\n        entry.nextRefreshAt = Date.now() + this.options.refreshAfterMs;\n        void this.startLoad(key, load).catch(() => {\n          /* Reported through `onRefreshFailure` inside `startLoad`; nothing may escape onto the emission path. */\n        });\n      }\n      return entry.value;\n    }\n\n    return this.startLoad(key, load);\n  }\n\n  /**\n   * Drop `key`, so the next {@link get} performs a blocking read.\n   *\n   * Synchronous, infallible and idempotent — a caller needs no error handling, which is why the write-path\n   * hook can invoke it inside a postfix handler without a try/catch.\n   *\n   * Bumping the generation is the load-bearing half: it makes any refresh already on the wire discard its\n   * result instead of writing the pre-invalidation value back. Deleting the entry alone would leave the\n   * invalidation defeated by a read that started microseconds earlier.\n   */\n  public invalidate(key: string): void {\n    this.entries.delete(key);\n    this.generations.set(key, (this.generations.get(key) ?? 0) + 1);\n  }\n\n  /** Resident key count. A test and diagnostics seam; nothing branches on it in production. */\n  public size(): number {\n    return this.entries.size;\n  }\n\n  /** Drop everything, including generation history. Test isolation only. */\n  public clear(): void {\n    this.entries.clear();\n    this.inFlight.clear();\n    this.generations.clear();\n  }\n\n  /**\n   * Await every load currently on the wire.\n   *\n   * A TEST seam: stale-while-revalidate means a refresh outlives the `get` that started it, so a pin that\n   * asserts on the refreshed value has no other deterministic join point. Never called from production\n   * code — production must never wait for a refresh, which is the entire point of the design.\n   */\n  public async settle(): Promise<void> {\n    while (this.inFlight.size > 0) {\n      await Promise.allSettled([...this.inFlight.values()]);\n    }\n  }\n\n  /** Start (or join) the single in-flight read for `key`, writing the result back under generation guard. */\n  private startLoad(key: string, load: () => Promise<T>): Promise<T> {\n    const joined = this.inFlight.get(key);\n    if (joined) return joined;\n\n    const startedAtGeneration = this.generations.get(key) ?? 0;\n    const pending = load()\n      .then((value) => {\n        // The generation guard. An `invalidate` that landed while this read was on the wire means the\n        // value we are holding predates a write we already know about — publishing it would restore\n        // exactly the staleness the invalidation was raised to remove.\n        if ((this.generations.get(key) ?? 0) === startedAtGeneration) {\n          this.store(key, value);\n        }\n        return value;\n      })\n      .catch((error: unknown) => {\n        const existing = this.entries.get(key);\n        if (existing) {\n          // Serve the last known value and back off a full lease rather than retrying per event. A source\n          // that is down must not convert audit volume into read volume.\n          existing.nextRefreshAt = Date.now() + this.options.refreshAfterMs;\n          this.options.onRefreshFailure?.(key, error);\n          return existing.value;\n        }\n        // COLD failure: there is nothing to serve, so the caller decides. Deliberately NOT reported through\n        // `onRefreshFailure`, which names the silent case; a cold rejection is visible to the caller.\n        throw error;\n      })\n      .finally(() => {\n        // Only clear the slot if it is still OURS. A `clear()` between start and settle would otherwise\n        // have this delete a newer in-flight read's entry.\n        if (this.inFlight.get(key) === pending) this.inFlight.delete(key);\n      });\n\n    this.inFlight.set(key, pending);\n    return pending;\n  }\n\n  /** Insert or replace, evicting the least recently used key first when at capacity. */\n  private store(key: string, value: T): void {\n    const existing = this.entries.get(key);\n    if (existing) {\n      existing.value = value;\n      existing.nextRefreshAt = Date.now() + this.options.refreshAfterMs;\n      return;\n    }\n\n    if (this.entries.size >= this.options.maxEntries) {\n      // Map iteration is insertion order and `get` re-inserts on every hit, so the first key is the least\n      // recently used one.\n      const leastRecentlyUsed = this.entries.keys().next().value;\n      if (leastRecentlyUsed !== undefined) {\n        this.entries.delete(leastRecentlyUsed);\n        // Its generation goes too: an unbounded generation map would be the leak the entry cap prevents.\n        this.generations.delete(leastRecentlyUsed);\n      }\n    }\n\n    this.entries.set(key, { value, nextRefreshAt: Date.now() + this.options.refreshAfterMs });\n  }\n}\n"]}
+{"version":3,"file":"leased-value-cache.backend.utils.js","sourceRoot":"","sources":["../../../../../../src/compliance/audit-trails/services/utils/leased-value-cache.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAuBH;;;;GAIG;AACH,MAAM,OAAO,gBAAgB;IAOE;IANZ,OAAO,GAAG,IAAI,GAAG,EAA0B,CAAC;IAC7D,0GAA0G;IACzF,QAAQ,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC1D,kFAAkF;IACjE,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEzD,YAA6B,OAAgC;QAAhC,YAAO,GAAP,OAAO,CAAyB;IAAG,CAAC;IAEjE;;;;;;;;OAQG;IACI,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,IAAsB;QAClD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEpC,IAAI,KAAK,EAAE,CAAC;YACV,+FAA+F;YAC/F,+DAA+D;YAC/D,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAE7B,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;gBACtC,2FAA2F;gBAC3F,6FAA6F;gBAC7F,+FAA+F;gBAC/F,6FAA6F;gBAC7F,qBAAqB;gBACrB,EAAE;gBACF,4FAA4F;gBAC5F,6FAA6F;gBAC7F,6FAA6F;gBAC7F,uFAAuF;gBACvF,KAAK,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC;gBAC/D,KAAK,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;oBACxC,wGAAwG;gBAC1G,CAAC,CAAC,CAAC;YACL,CAAC;YACD,OAAO,KAAK,CAAC,KAAK,CAAC;QACrB,CAAC;QAED,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACnC,CAAC;IAED;;;;;;;;;OASG;IACI,UAAU,CAAC,GAAW;QAC3B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClE,CAAC;IAED,6FAA6F;IACtF,IAAI;QACT,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3B,CAAC;IAED,0EAA0E;IACnE,KAAK;QACV,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrB,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;IAC3B,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,MAAM;QACjB,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAED,2GAA2G;IACnG,SAAS,CAAC,GAAW,EAAE,IAAsB;QACnD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAE1B,MAAM,mBAAmB,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC3D,MAAM,OAAO,GAAG,IAAI,EAAE;aACnB,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;YACd,8FAA8F;YAC9F,4FAA4F;YAC5F,+DAA+D;YAC/D,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,mBAAmB,EAAE,CAAC;gBAC7D,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACzB,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACxB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACvC,IAAI,QAAQ,EAAE,CAAC;gBACb,gGAAgG;gBAChG,+DAA+D;gBAC/D,QAAQ,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC;gBAClE,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBAC5C,OAAO,QAAQ,CAAC,KAAK,CAAC;YACxB,CAAC;YACD,oGAAoG;YACpG,8FAA8F;YAC9F,MAAM,KAAK,CAAC;QACd,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,gGAAgG;YAChG,mDAAmD;YACnD,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,OAAO;gBAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACpE,CAAC,CAAC,CAAC;QAEL,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAChC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,sFAAsF;IAC9E,KAAK,CAAC,GAAW,EAAE,KAAQ;QACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,KAAK,GAAG,KAAK,CAAC;YACvB,QAAQ,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC;YAClE,OAAO;QACT,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;YACjD,oGAAoG;YACpG,qBAAqB;YACrB,MAAM,iBAAiB,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YAC3D,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;gBACpC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;gBACvC,iGAAiG;gBACjG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAC5F,CAAC;CACF","sourcesContent":["/**\n * # A leased, stale-while-revalidate, single-flight cache for values read on the AUDIT EMISSION PATH\n *\n * The audit dispatcher holds two per-organization caches — the SIEM export config that decides WHERE\n * an event is routed, and the organization name that decorates the envelope. Both were hand-rolled\n * `Map`s with a 5-minute wall-clock TTL, a copy-pasted FIFO eviction block, and a blocking re-read on\n * expiry. This is the one place those mechanics live now, so a property fixed here is fixed for both\n * — the shape `.claude/rules/invariant-call-site-enumeration.md` exists to force.\n *\n * ## The governing constraint: emission must never fail, and never block, the thing it observes\n *\n * `AuditEventDispatcherBackendService` runs detached (`audit-logs.backend.service.ts:349` calls it\n * without `await`, with a `.catch`), and its whole contract is that a routing failure is logged and\n * never thrown onto the business operation. Every property below follows from that:\n *\n * | Property | Why it is required here specifically |\n * |---|---|\n * | **Stale-while-revalidate** | Past the lease the CACHED value is returned immediately and the re-read runs off the caller's path. Staleness is tolerable (a config changes monthly); a stall is not. It is also what makes a SHORT lease affordable: shortening it now costs read volume only, never latency. |\n * | **Single flight** | A burst of events for one organization must produce ONE read, not one per event. Without it a cold organization under load fires N concurrent reads — and for the SIEM config each of those reads emits its own `system_context_read` audit row and can race the lazy default-row materialisation. |\n * | **Generation-guarded write-back** | An {@link invalidate} that lands WHILE a refresh is in flight must win. Without the guard the in-flight read — started before the write committed — writes the pre-write value back over the invalidation, so the invalidation silently does nothing in exactly the case it exists for. |\n * | **Backoff on failure** | A failed refresh stamps the next attempt one lease ahead rather than retrying per event. A broken repository must not turn into a read storm that scales with audit volume. |\n * | **LRU, not FIFO, eviction** | The evicted entry is the least recently USED. The previous FIFO block (labelled \"simple LRU approximation\", which it was not) evicted by insertion order, so the busiest organization — inserted first, refreshed in place, never re-inserted — was the first one thrown out and forced back onto a blocking cold read. |\n *\n * ## What it deliberately does NOT do\n *\n * - **It does not live in a shared store.** Putting the VALUE in Redis would make routing depend on a\n *   store that can be unavailable, and would put a network round trip on the emission path. Cross-replica\n *   convergence is carried instead by a published invalidation (see the dispatcher's\n *   `_publishSiemConfigInvalidation`) plus the lease — neither of which the emission path touches.\n * - **It does not expire entries out of the map.** An entry is refreshed in place, never dropped on age,\n *   so a warm organization never pays a blocking read again. Only {@link invalidate} and LRU pressure\n *   remove an entry.\n * - **It caches negative results.** `null` / `undefined` is a value like any other. The alternative —\n *   re-reading on every event for a key with no row — is unbounded read amplification precisely for the\n *   keys that are cheapest to get wrong, and it is the shape the org-name cache had before this.\n *\n * ## Precondition on the loader, which is a real constraint and not boilerplate\n *\n * A caller that JOINS an in-flight load receives the value **the first caller's loader produced**. So\n * every loader passed for one key must be equally privileged: a per-request loader whose visibility\n * varies with the caller would leak one caller's view to another. Both current call sites satisfy this\n * because the execution context they close over is the audit service's freshly-synthesised super-admin\n * APPLICATION-scoped temp context (`audit-logs.backend.service.ts:284`, handed to the dispatcher at\n * `:349`) — identical in privilege for every dispatch. **State the equivalent before adding a third.**\n */\n\n/** One cached entry. `nextRefreshAt` — not an age — is what the lease is measured against, so a failed refresh can back off without pretending the value is fresh. */\ninterface LeasedEntry<T> {\n  value: T;\n  /** Wall-clock instant at or after which the next {@link LeasedValueCache.get} triggers a background refresh. */\n  nextRefreshAt: number;\n}\n\n/** Construction options. `refreshAfterMs` is the guarantee the owning subsystem states publicly — see each call site. */\nexport interface LeasedValueCacheOptions {\n  /** How long a value is served without a re-read. The convergence bound for any change no invalidation reaches. */\n  readonly refreshAfterMs: number;\n  /** Hard ceiling on resident keys; the least recently used is evicted on overflow. */\n  readonly maxEntries: number;\n  /**\n   * Reported when a BACKGROUND refresh throws. The cache keeps serving the previous value and backs off\n   * one lease. Optional, but omitting it makes a persistently unreadable source silent, which is the\n   * failure this whole subsystem exists to make visible — pass one.\n   */\n  readonly onRefreshFailure?: (key: string, error: unknown) => void;\n}\n\n/**\n * A per-key leased cache. See the module header for the design and its constraints.\n *\n * @typeParam T The cached value. Nullable members are cached like any other value, deliberately.\n */\nexport class LeasedValueCache<T> {\n  private readonly entries = new Map<string, LeasedEntry<T>>();\n  /** In-flight loads/refreshes, keyed identically. Present ⇒ a read is already on the wire for that key. */\n  private readonly inFlight = new Map<string, Promise<T>>();\n  /** Monotonic per-key generation. A key absent here has never been invalidated. */\n  private readonly generations = new Map<string, number>();\n\n  constructor(private readonly options: LeasedValueCacheOptions) {}\n\n  /**\n   * Serve `key`, loading it when there is nothing to serve.\n   *\n   * Rejects ONLY when a COLD load rejects — there is no cached value to fall back to, so the caller has\n   * to decide. Once a value exists this never rejects and never blocks: a stale entry is returned as it\n   * stands and the refresh runs detached.\n   *\n   * @param load Reads the current value. Must satisfy the loader precondition in the module header.\n   */\n  public async get(key: string, load: () => Promise<T>): Promise<T> {\n    const entry = this.entries.get(key);\n\n    if (entry) {\n      // Touch for LRU on every hit, fresh or stale: \"recently used\" is about READS, so refreshing in\n      // place must not let a busy key drift toward the eviction end.\n      this.entries.delete(key);\n      this.entries.set(key, entry);\n\n      if (Date.now() >= entry.nextRefreshAt) {\n        // An UNOBSERVABLE optimisation, and deliberately unpinned: removing it changes no outcome,\n        // because `inFlight` already collapses the reads. What it saves is that every event arriving\n        // during a slow refresh would otherwise re-enter `startLoad`, join the same promise and attach\n        // its own `.catch` handler — bounded and released on settle, but pointless work per event on\n        // the emission path.\n        //\n        // It is NOT the failure backoff, however much it looks like one. Backing off after a failed\n        // refresh is `startLoad`'s catch, which re-stamps from the moment the failure LANDED; a slow\n        // failure exhausts this stamp while still on the wire. Mistaking the two makes a backoff pin\n        // that passes with the backoff deleted — measured, and the reason the suite pins both.\n        entry.nextRefreshAt = Date.now() + this.options.refreshAfterMs;\n        void this.startLoad(key, load).catch(() => {\n          /* Reported through `onRefreshFailure` inside `startLoad`; nothing may escape onto the emission path. */\n        });\n      }\n      return entry.value;\n    }\n\n    return this.startLoad(key, load);\n  }\n\n  /**\n   * Drop `key`, so the next {@link get} performs a blocking read.\n   *\n   * Synchronous, infallible and idempotent — a caller needs no error handling, which is why the write-path\n   * hook can invoke it inside a postfix handler without a try/catch.\n   *\n   * Bumping the generation is the load-bearing half: it makes any refresh already on the wire discard its\n   * result instead of writing the pre-invalidation value back. Deleting the entry alone would leave the\n   * invalidation defeated by a read that started microseconds earlier.\n   */\n  public invalidate(key: string): void {\n    this.entries.delete(key);\n    this.generations.set(key, (this.generations.get(key) ?? 0) + 1);\n  }\n\n  /** Resident key count. A test and diagnostics seam; nothing branches on it in production. */\n  public size(): number {\n    return this.entries.size;\n  }\n\n  /** Drop everything, including generation history. Test isolation only. */\n  public clear(): void {\n    this.entries.clear();\n    this.inFlight.clear();\n    this.generations.clear();\n  }\n\n  /**\n   * Await every load currently on the wire.\n   *\n   * A TEST seam: stale-while-revalidate means a refresh outlives the `get` that started it, so a pin that\n   * asserts on the refreshed value has no other deterministic join point. Never called from production\n   * code — production must never wait for a refresh, which is the entire point of the design.\n   */\n  public async settle(): Promise<void> {\n    while (this.inFlight.size > 0) {\n      await Promise.allSettled([...this.inFlight.values()]);\n    }\n  }\n\n  /** Start (or join) the single in-flight read for `key`, writing the result back under generation guard. */\n  private startLoad(key: string, load: () => Promise<T>): Promise<T> {\n    const joined = this.inFlight.get(key);\n    if (joined) return joined;\n\n    const startedAtGeneration = this.generations.get(key) ?? 0;\n    const pending = load()\n      .then((value) => {\n        // The generation guard. An `invalidate` that landed while this read was on the wire means the\n        // value we are holding predates a write we already know about — publishing it would restore\n        // exactly the staleness the invalidation was raised to remove.\n        if ((this.generations.get(key) ?? 0) === startedAtGeneration) {\n          this.store(key, value);\n        }\n        return value;\n      })\n      .catch((error: unknown) => {\n        const existing = this.entries.get(key);\n        if (existing) {\n          // Serve the last known value and back off a full lease rather than retrying per event. A source\n          // that is down must not convert audit volume into read volume.\n          existing.nextRefreshAt = Date.now() + this.options.refreshAfterMs;\n          this.options.onRefreshFailure?.(key, error);\n          return existing.value;\n        }\n        // COLD failure: there is nothing to serve, so the caller decides. Deliberately NOT reported through\n        // `onRefreshFailure`, which names the silent case; a cold rejection is visible to the caller.\n        throw error;\n      })\n      .finally(() => {\n        // Only clear the slot if it is still OURS. A `clear()` between start and settle would otherwise\n        // have this delete a newer in-flight read's entry.\n        if (this.inFlight.get(key) === pending) this.inFlight.delete(key);\n      });\n\n    this.inFlight.set(key, pending);\n    return pending;\n  }\n\n  /** Insert or replace, evicting the least recently used key first when at capacity. */\n  private store(key: string, value: T): void {\n    const existing = this.entries.get(key);\n    if (existing) {\n      existing.value = value;\n      existing.nextRefreshAt = Date.now() + this.options.refreshAfterMs;\n      return;\n    }\n\n    if (this.entries.size >= this.options.maxEntries) {\n      // Map iteration is insertion order and `get` re-inserts on every hit, so the first key is the least\n      // recently used one.\n      const leastRecentlyUsed = this.entries.keys().next().value;\n      if (leastRecentlyUsed !== undefined) {\n        this.entries.delete(leastRecentlyUsed);\n        // Its generation goes too: an unbounded generation map would be the leak the entry cap prevents.\n        this.generations.delete(leastRecentlyUsed);\n      }\n    }\n\n    this.entries.set(key, { value, nextRefreshAt: Date.now() + this.options.refreshAfterMs });\n  }\n}\n"]}

package/dist/esm/compliance/audit-trails/services/utils/ocsf-activity-mapping.backend.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ocsf-activity-mapping.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../../../src/compliance/audit-trails/services/utils/ocsf-activity-mapping.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,EAAkC,sBAAsB,EAAsD,MAAM,uBAAuB,CAAC;AAGnJ,oFAAoF;AACpF,oBAAY,kBAAkB;IAC5B,uCAAuC;IACvC,OAAO,IAAI;IACX,6EAA6E;IAC7E,KAAK,KAAK;CACX;AAED,sEAAsE;AACtE,oBAAY,0BAA0B;IACpC,8HAA8H;IAC9H,KAAK,IAAI;IACT,6DAA6D;IAC7D,MAAM,IAAI;IACV,mHAAmH;IACnH,OAAO,IAAI;IACX,KAAK,KAAK;CACX;AAED,oEAAoE;AACpE,oBAAY,eAAe;IACzB,MAAM,IAAI;IACV,uFAAuF;IACvF,IAAI,IAAI;IACR,MAAM,IAAI;IACV,MAAM,IAAI;IACV,KAAK,KAAK;CACX;AAED,yEAAyE;AACzE,oBAAY,4BAA4B;IACtC,MAAM,IAAI;IACV,IAAI,IAAI;IACR,MAAM,IAAI;IACV,MAAM,IAAI;IACV,IAAI,IAAI;IACR,sEAAsE;IACtE,MAAM,IAAI;IACV,QAAQ,IAAI;IACZ,MAAM,IAAI;IACV,OAAO,IAAI;IACX,QAAQ,KAAK;IACb,UAAU,KAAK;IACf,OAAO,KAAK;IACZ,2GAA2G;IAC3G,MAAM,KAAK;IACX,KAAK,KAAK;CACX;AAED,uEAAuE;AACvE,oBAAY,0BAA0B;IACpC,MAAM,IAAI;IACV,MAAM,IAAI;IACV,MAAM,IAAI;IACV,MAAM,IAAI;IACV,OAAO,IAAI;IACX,IAAI,IAAI;IACR,MAAM,IAAI;IACV,eAAe,IAAI;IACnB,cAAc,IAAI;IAClB,eAAe,KAAK;IACpB,eAAe,KAAK;IACpB,kBAAkB,KAAK;IACvB,mBAAmB,KAAK;IACxB,iBAAiB,KAAK;IACtB,iBAAiB,KAAK;IACtB,YAAY,KAAK;IACjB,YAAY,KAAK;IACjB,4BAA4B,KAAK;IACjC,+BAA+B,KAAK;IACpC,KAAK,KAAK;CACX;AAgBD;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,EAAE,QAAQ,CAAC,MAAM,CAAC,sBAAsB,EAAE,MAAM,CAAC,CA0LxF,CAAC;AAwBF;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEjG;AAED;;;;;;GAMG;AACH,oBAAY,kBAAkB;IAC5B,OAAO,IAAI;IACX,IAAI,IAAI;IACR,QAAQ,IAAI;IACZ,MAAM,IAAI;IACV,MAAM,IAAI;IACV,IAAI,IAAI;IACR,SAAS,IAAI;IACb,GAAG,IAAI;IACP,IAAI,IAAI;IACR,GAAG,IAAI;IACP,MAAM,KAAK;IACX,oBAAoB,KAAK;IACzB,IAAI,KAAK;IACT,KAAK,KAAK;CACX;AAyCD,+FAA+F;AAC/F,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,kBAAkB,CAAC;CACzC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG,gBAAgB,CAK5E;AAuCD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAUlF"}
+{"version":3,"file":"ocsf-activity-mapping.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../../src/compliance/audit-trails/services/utils/ocsf-activity-mapping.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,EAAkC,sBAAsB,EAAsD,MAAM,uBAAuB,CAAC;AAGnJ,oFAAoF;AACpF,oBAAY,kBAAkB;IAC5B,uCAAuC;IACvC,OAAO,IAAI;IACX,6EAA6E;IAC7E,KAAK,KAAK;CACX;AAED,sEAAsE;AACtE,oBAAY,0BAA0B;IACpC,8HAA8H;IAC9H,KAAK,IAAI;IACT,6DAA6D;IAC7D,MAAM,IAAI;IACV,mHAAmH;IACnH,OAAO,IAAI;IACX,KAAK,KAAK;CACX;AAED,oEAAoE;AACpE,oBAAY,eAAe;IACzB,MAAM,IAAI;IACV,uFAAuF;IACvF,IAAI,IAAI;IACR,MAAM,IAAI;IACV,MAAM,IAAI;IACV,KAAK,KAAK;CACX;AAED,yEAAyE;AACzE,oBAAY,4BAA4B;IACtC,MAAM,IAAI;IACV,IAAI,IAAI;IACR,MAAM,IAAI;IACV,MAAM,IAAI;IACV,IAAI,IAAI;IACR,sEAAsE;IACtE,MAAM,IAAI;IACV,QAAQ,IAAI;IACZ,MAAM,IAAI;IACV,OAAO,IAAI;IACX,QAAQ,KAAK;IACb,UAAU,KAAK;IACf,OAAO,KAAK;IACZ,2GAA2G;IAC3G,MAAM,KAAK;IACX,KAAK,KAAK;CACX;AAED,uEAAuE;AACvE,oBAAY,0BAA0B;IACpC,MAAM,IAAI;IACV,MAAM,IAAI;IACV,MAAM,IAAI;IACV,MAAM,IAAI;IACV,OAAO,IAAI;IACX,IAAI,IAAI;IACR,MAAM,IAAI;IACV,eAAe,IAAI;IACnB,cAAc,IAAI;IAClB,eAAe,KAAK;IACpB,eAAe,KAAK;IACpB,kBAAkB,KAAK;IACvB,mBAAmB,KAAK;IACxB,iBAAiB,KAAK;IACtB,iBAAiB,KAAK;IACtB,YAAY,KAAK;IACjB,YAAY,KAAK;IACjB,4BAA4B,KAAK;IACjC,+BAA+B,KAAK;IACpC,KAAK,KAAK;CACX;AAgBD;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,EAAE,QAAQ,CAAC,MAAM,CAAC,sBAAsB,EAAE,MAAM,CAAC,CA+MxF,CAAC;AAwBF;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEjG;AAED;;;;;;GAMG;AACH,oBAAY,kBAAkB;IAC5B,OAAO,IAAI;IACX,IAAI,IAAI;IACR,QAAQ,IAAI;IACZ,MAAM,IAAI;IACV,MAAM,IAAI;IACV,IAAI,IAAI;IACR,SAAS,IAAI;IACb,GAAG,IAAI;IACP,IAAI,IAAI;IACR,GAAG,IAAI;IACP,MAAM,KAAK;IACX,oBAAoB,KAAK;IACzB,IAAI,KAAK;IACT,KAAK,KAAK;CACX;AAyCD,+FAA+F;AAC/F,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,kBAAkB,CAAC;CACzC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG,gBAAgB,CAK5E;AAuCD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAUlF"}

package/dist/esm/compliance/audit-trails/services/utils/ocsf-activity-mapping.backend.utils.js

@@ -151,6 +151,10 @@ export const OCSF_ACTIVITY_BY_EVENT_TYPE = {
     // Admin token-lifecycle, not an OCSF user LOGOFF — Other(99) + activity_name, matching the family.
     [CoreAuditableEventType.ONE_OFF_TOKEN_REVOKED]: OcsfAuthenticationActivity.OTHER,
     [CoreAuditableEventType.SAML_ASSERTION_REPLAY_DETECTED]: OcsfAuthenticationActivity.OTHER,
+    // A refused enterprise OIDC login: the provider did not report the authentication context the
+    // connection demanded (`acr`). A logon attempt that failed its step-up, so Logon(1) like the
+    // SAML and SSO failures beside it, not Other(99) like the OAuth CLIENT-side refusals above.
+    [CoreAuditableEventType.OIDC_ACR_DEMAND_UNSATISFIED]: OcsfAuthenticationActivity.LOGON,
     [CoreAuditableEventType.SAML_LOGIN_FAILED]: OcsfAuthenticationActivity.LOGON,
     [CoreAuditableEventType.SAML_LOGIN_INITIATED]: OcsfAuthenticationActivity.LOGON,
     [CoreAuditableEventType.SAML_LOGIN_SUCCESS]: OcsfAuthenticationActivity.LOGON,
@@ -237,6 +241,23 @@ export const OCSF_ACTIVITY_BY_EVENT_TYPE = {
     [CoreAuditableEventType.SUBJECT_DATA_EXPORT]: OcsfApiActivity.READ,
     [CoreAuditableEventType.COLLECTION_DATA_EXPORT]: OcsfApiActivity.READ,
     [CoreAuditableEventType.HTTP_API_READ_THROUGH_ACCESS]: OcsfApiActivity.READ,
+    // OTHER, and it is the positive statement the table's header describes rather than a shrug: the
+    // verb of an outbound provider call is a property of the OPERATION, not of the event type — the
+    // same event carries `classification: READ` for one call and `WRITE` for the next, so no member of
+    // this enum is true of the type. `activity_name` carries our event type, which is what OTHER
+    // obliges, and the payload's `classification` carries the verb for a consumer that wants it.
+    [CoreAuditableEventType.PROVIDER_OPERATION_CALL]: OcsfApiActivity.OTHER,
+    // OTHER for the same reason as its sibling, and more strongly: an MCP tool's effect is not
+    // declared anywhere the framework can read — the tool list is discovered from the server at turn
+    // start and nothing says whether a given tool reads or writes. Mapping to CREATE or READ would be
+    // asserting a verb nobody stated. `activity_name` carries our event type, which is what OTHER
+    // obliges.
+    [CoreAuditableEventType.MCP_TOOL_CALL]: OcsfApiActivity.OTHER,
+    // OTHER, and the alternative was considered: an approval decision is not an API activity at all,
+    // and UPDATE would read as "a record was updated" to every OCSF consumer. What was updated is a
+    // pending tool call held in memory, which no OCSF class models. `activity_name` carries our own
+    // event type, which is precisely what OTHER obliges.
+    [CoreAuditableEventType.AGENT_TOOL_APPROVAL_MODIFIED]: OcsfApiActivity.OTHER,
     // D6 stance 6b: the declared external-erasure operation DELETED remote rows.
     [CoreAuditableEventType.HTTP_API_EXTERNAL_ERASURE]: OcsfApiActivity.DELETE,
     // D6 stance 6c: nothing was deleted — the event records a deliberate non-action.

package/dist/esm/compliance/audit-trails/services/utils/ocsf-activity-mapping.backend.utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"ocsf-activity-mapping.backend.utils.js","sourceRoot":"","sources":["../../../../../../../src/compliance/audit-trails/services/utils/ocsf-activity-mapping.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,EAAsB,UAAU,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AACnJ,OAAO,EAAE,4BAA4B,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAEhG,oFAAoF;AACpF,MAAM,CAAN,IAAY,kBAKX;AALD,WAAY,kBAAkB;IAC5B,uCAAuC;IACvC,iEAAW,CAAA;IACX,6EAA6E;IAC7E,8DAAU,CAAA;AACZ,CAAC,EALW,kBAAkB,KAAlB,kBAAkB,QAK7B;AAED,sEAAsE;AACtE,MAAM,CAAN,IAAY,0BAQX;AARD,WAAY,0BAA0B;IACpC,8HAA8H;IAC9H,6EAAS,CAAA;IACT,6DAA6D;IAC7D,+EAAU,CAAA;IACV,mHAAmH;IACnH,iFAAW,CAAA;IACX,8EAAU,CAAA;AACZ,CAAC,EARW,0BAA0B,KAA1B,0BAA0B,QAQrC;AAED,oEAAoE;AACpE,MAAM,CAAN,IAAY,eAOX;AAPD,WAAY,eAAe;IACzB,yDAAU,CAAA;IACV,uFAAuF;IACvF,qDAAQ,CAAA;IACR,yDAAU,CAAA;IACV,yDAAU,CAAA;IACV,wDAAU,CAAA;AACZ,CAAC,EAPW,eAAe,KAAf,eAAe,QAO1B;AAED,yEAAyE;AACzE,MAAM,CAAN,IAAY,4BAiBX;AAjBD,WAAY,4BAA4B;IACtC,mFAAU,CAAA;IACV,+EAAQ,CAAA;IACR,mFAAU,CAAA;IACV,mFAAU,CAAA;IACV,+EAAQ,CAAA;IACR,sEAAsE;IACtE,mFAAU,CAAA;IACV,uFAAY,CAAA;IACZ,mFAAU,CAAA;IACV,qFAAW,CAAA;IACX,wFAAa,CAAA;IACb,4FAAe,CAAA;IACf,sFAAY,CAAA;IACZ,2GAA2G;IAC3G,oFAAW,CAAA;IACX,kFAAU,CAAA;AACZ,CAAC,EAjBW,4BAA4B,KAA5B,4BAA4B,QAiBvC;AAED,uEAAuE;AACvE,MAAM,CAAN,IAAY,0BAqBX;AArBD,WAAY,0BAA0B;IACpC,+EAAU,CAAA;IACV,+EAAU,CAAA;IACV,+EAAU,CAAA;IACV,+EAAU,CAAA;IACV,iFAAW,CAAA;IACX,2EAAQ,CAAA;IACR,+EAAU,CAAA;IACV,iGAAmB,CAAA;IACnB,+FAAkB,CAAA;IAClB,kGAAoB,CAAA;IACpB,kGAAoB,CAAA;IACpB,wGAAuB,CAAA;IACvB,0GAAwB,CAAA;IACxB,sGAAsB,CAAA;IACtB,sGAAsB,CAAA;IACtB,4FAAiB,CAAA;IACjB,4FAAiB,CAAA;IACjB,4HAAiC,CAAA;IACjC,kIAAoC,CAAA;IACpC,8EAAU,CAAA;AACZ,CAAC,EArBW,0BAA0B,KAA1B,0BAA0B,QAqBrC;AAED;;;;;;GAMG;AACH,MAAM,6BAA6B,GAAwD;IACzF,CAAC,YAAY,CAAC,cAAc,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,0BAA0B,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;IACnI,CAAC,YAAY,CAAC,YAAY,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;IACtH,CAAC,YAAY,CAAC,iBAAiB,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,4BAA4B,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;IACxI,CAAC,YAAY,CAAC,eAAe,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,0BAA0B,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;CACrI,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAqD;IAE3F,uBAAuB;IACvB,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAChF,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAC9E,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAC/E,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IACpF,CAAC,sBAAsB,CAAC,0BAA0B,CAAC,EAAE,0BAA0B,CAAC,KAAK;IACrF,CAAC,sBAAsB,CAAC,+BAA+B,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAC1F,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAChF,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAC9E,uGAAuG;IACvG,8GAA8G;IAC9G,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,0BAA0B,CAAC,MAAM;IACrF,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAChF,CAAC,sBAAsB,CAAC,uBAAuB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAClF,mGAAmG;IACnG,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAChF,CAAC,sBAAsB,CAAC,8BAA8B,CAAC,EAAE,0BAA0B,CAAC,KAAK;IACzF,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAC5E,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAC/E,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAC7E,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,0BAA0B,CAAC,MAAM;IAC9E,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,0BAA0B,CAAC,MAAM;IAC9E,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,0BAA0B,CAAC,KAAK,EAAE,sFAAsF;IACtK,CAAC,sBAAsB,CAAC,kCAAkC,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAC7F,CAAC,sBAAsB,CAAC,0BAA0B,CAAC,EAAE,0BAA0B,CAAC,KAAK;IACrF,CAAC,sBAAsB,CAAC,UAAU,CAAC,EAAE,0BAA0B,CAAC,KAAK;IACrE,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAC5E,CAAC,sBAAsB,CAAC,WAAW,CAAC,EAAE,0BAA0B,CAAC,MAAM;IACvE,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IACjF,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,0BAA0B,CAAC,OAAO;IACjF,CAAC,sBAAsB,CAAC,wBAAwB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IACnF,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,EAAE,0BAA0B,CAAC,KAAK,EAAE,sGAAsG;IACpL,CAAC,sBAAsB,CAAC,uBAAuB,CAAC,EAAE,0BAA0B,CAAC,OAAO;IACpF,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,EAAE,0BAA0B,CAAC,KAAK,EAAE,qGAAqG;IAClL,CAAC,sBAAsB,CAAC,wBAAwB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IACnF,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IACjF,CAAC,sBAAsB,CAAC,mCAAmC,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAC9F,CAAC,sBAAsB,CAAC,mCAAmC,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAC9F,CAAC,sBAAsB,CAAC,4BAA4B,CAAC,EAAE,0BAA0B,CAAC,KAAK;IACvF,CAAC,sBAAsB,CAAC,uBAAuB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAClF,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAC/E,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,0BAA0B,CAAC,KAAK,EAAE,iGAAiG;IACnL,CAAC,sBAAsB,CAAC,6BAA6B,CAAC,EAAE,0BAA0B,CAAC,KAAK,EAAE,gGAAgG;IAC1L,CAAC,sBAAsB,CAAC,0BAA0B,CAAC,EAAE,0BAA0B,CAAC,KAAK,EAAE,gGAAgG;IACvL,CAAC,sBAAsB,CAAC,6BAA6B,CAAC,EAAE,0BAA0B,CAAC,KAAK;IACxF,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAC5E,CAAC,sBAAsB,CAAC,iCAAiC,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAC5F,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,0BAA0B,CAAC,MAAM;IAChF;;;;;OAKG;IACH,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,0BAA0B,CAAC,MAAM;IAChF,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAC9E,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,EAAE,0BAA0B,CAAC,OAAO;IAC9E,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAChF,CAAC,sBAAsB,CAAC,4BAA4B,CAAC,EAAE,0BAA0B,CAAC,KAAK;IACvF,CAAC,sBAAsB,CAAC,cAAc,CAAC,EAAE,0BAA0B,CAAC,KAAK;IACzE,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAChF,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAC/E,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAE7E,sBAAsB;IACtB,oGAAoG;IACpG,0CAA0C;IAC1C,CAAC,sBAAsB,CAAC,wBAAwB,CAAC,EAAE,eAAe,CAAC,KAAK;IACxE,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,eAAe,CAAC,KAAK;IACzE,CAAC,sBAAsB,CAAC,sCAAsC,CAAC,EAAE,eAAe,CAAC,KAAK;IACtF,CAAC,sBAAsB,CAAC,kCAAkC,CAAC,EAAE,eAAe,CAAC,KAAK;IAClF,CAAC,sBAAsB,CAAC,uBAAuB,CAAC,EAAE,eAAe,CAAC,KAAK;IACvE,CAAC,sBAAsB,CAAC,+BAA+B,CAAC,EAAE,eAAe,CAAC,KAAK;IAC/E,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,eAAe,CAAC,KAAK;IACpE,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,eAAe,CAAC,KAAK;IACrE,CAAC,sBAAsB,CAAC,6BAA6B,CAAC,EAAE,eAAe,CAAC,KAAK;IAC7E,CAAC,sBAAsB,CAAC,4BAA4B,CAAC,EAAE,eAAe,CAAC,KAAK;IAC5E,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,EAAE,eAAe,CAAC,KAAK,EAAE,8CAA8C;IAChI,CAAC,sBAAsB,CAAC,iCAAiC,CAAC,EAAE,eAAe,CAAC,KAAK;IACjF,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,EAAE,eAAe,CAAC,KAAK;IAChF,CAAC,sBAAsB,CAAC,qCAAqC,CAAC,EAAE,eAAe,CAAC,KAAK;IACrF,CAAC,sBAAsB,CAAC,+BAA+B,CAAC,EAAE,eAAe,CAAC,KAAK;IAC/E,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,eAAe,CAAC,KAAK,EAAE,mFAAmF;IAC9J,CAAC,sBAAsB,CAAC,4BAA4B,CAAC,EAAE,eAAe,CAAC,KAAK,EAAE,mFAAmF;IACjK,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,EAAE,eAAe,CAAC,KAAK,EAAE,8CAA8C;IAEtH,oBAAoB;IACpB,CAAC,sBAAsB,CAAC,YAAY,CAAC,EAAE,eAAe,CAAC,IAAI;IAC3D,oGAAoG;IACpG,oFAAoF;IACpF,CAAC,sBAAsB,CAAC,0BAA0B,CAAC,EAAE,eAAe,CAAC,MAAM;IAC3E,mGAAmG;IACnG,kGAAkG;IAClG,uFAAuF;IACvF,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,eAAe,CAAC,KAAK;IACrE,CAAC,sBAAsB,CAAC,wBAAwB,CAAC,EAAE,eAAe,CAAC,KAAK;IACxE,CAAC,sBAAsB,CAAC,cAAc,CAAC,EAAE,eAAe,CAAC,KAAK,EAAE,sEAAsE;IACtI,8FAA8F;IAC9F,gGAAgG;IAChG,8CAA8C;IAC9C,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,eAAe,CAAC,IAAI;IACxE,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,eAAe,CAAC,IAAI;IACnE,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,eAAe,CAAC,IAAI;IAClE,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,EAAE,eAAe,CAAC,IAAI;IACrE,CAAC,sBAAsB,CAAC,4BAA4B,CAAC,EAAE,eAAe,CAAC,IAAI;IAC3E,6EAA6E;IAC7E,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,eAAe,CAAC,MAAM;IAC1E,iFAAiF;IACjF,CAAC,sBAAsB,CAAC,iCAAiC,CAAC,EAAE,eAAe,CAAC,KAAK;IACjF,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,eAAe,CAAC,IAAI;IAClE,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,eAAe,CAAC,KAAK,EAAE,uGAAuG;IAE7K,uBAAuB;IACvB,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,EAAE,4BAA4B,CAAC,MAAM;IACpF,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,4BAA4B,CAAC,MAAM;IAClF,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,4BAA4B,CAAC,MAAM;IAClF,CAAC,sBAAsB,CAAC,+BAA+B,CAAC,EAAE,4BAA4B,CAAC,KAAK,EAAE,+FAA+F;IAC7L,CAAC,sBAAsB,CAAC,2BAA2B,CAAC,EAAE,4BAA4B,CAAC,MAAM;IACzF,CAAC,sBAAsB,CAAC,0BAA0B,CAAC,EAAE,4BAA4B,CAAC,MAAM;IACxF,CAAC,sBAAsB,CAAC,2BAA2B,CAAC,EAAE,4BAA4B,CAAC,QAAQ;IAC3F,CAAC,sBAAsB,CAAC,kCAAkC,CAAC,EAAE,4BAA4B,CAAC,MAAM;IAChG,CAAC,sBAAsB,CAAC,2BAA2B,CAAC,EAAE,4BAA4B,CAAC,MAAM;IACzF,CAAC,sBAAsB,CAAC,kCAAkC,CAAC,EAAE,4BAA4B,CAAC,MAAM;IAChG,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,EAAE,4BAA4B,CAAC,MAAM;IAC9F,CAAC,sBAAsB,CAAC,4BAA4B,CAAC,EAAE,4BAA4B,CAAC,MAAM;IAC1F,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,4BAA4B,CAAC,KAAK,EAAE,uGAAuG;IAC3L,CAAC,sBAAsB,CAAC,mCAAmC,CAAC,EAAE,4BAA4B,CAAC,MAAM;IACjG,4FAA4F;IAC5F,gGAAgG;IAChG,iFAAiF;IACjF,CAAC,sBAAsB,CAAC,oCAAoC,CAAC,EAAE,4BAA4B,CAAC,MAAM;IAClG,CAAC,sBAAsB,CAAC,wCAAwC,CAAC,EAAE,4BAA4B,CAAC,MAAM;IACtG,kGAAkG;IAClG,iGAAiG;IACjG,iGAAiG;IACjG,CAAC,sBAAsB,CAAC,qCAAqC,CAAC,EAAE,4BAA4B,CAAC,IAAI;IACjG,CAAC,sBAAsB,CAAC,wCAAwC,CAAC,EAAE,4BAA4B,CAAC,MAAM;IACtG,mGAAmG;IACnG,kGAAkG;IAClG,+FAA+F;IAC/F,mDAAmD;IACnD,CAAC,sBAAsB,CAAC,4BAA4B,CAAC,EAAE,4BAA4B,CAAC,MAAM;IAC1F,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,EAAE,4BAA4B,CAAC,MAAM;IAC9F,CAAC,sBAAsB,CAAC,6BAA6B,CAAC,EAAE,4BAA4B,CAAC,IAAI;IACzF,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,EAAE,4BAA4B,CAAC,MAAM;IAC9F,kGAAkG;IAClG,mGAAmG;IACnG,iGAAiG;IACjG,gGAAgG;IAChG,kDAAkD;IAClD,CAAC,sBAAsB,CAAC,wCAAwC,CAAC,EAAE,4BAA4B,CAAC,MAAM;IACtG,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,EAAE,4BAA4B,CAAC,MAAM;IAC9F,CAAC,sBAAsB,CAAC,sCAAsC,CAAC,EAAE,4BAA4B,CAAC,MAAM;IACpG,iGAAiG;IACjG,iGAAiG;IACjG,kEAAkE;IAClE,CAAC,sBAAsB,CAAC,+BAA+B,CAAC,EAAE,4BAA4B,CAAC,MAAM;IAC7F,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,EAAE,4BAA4B,CAAC,OAAO;IACrF,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,4BAA4B,CAAC,MAAM;IACvF,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,4BAA4B,CAAC,MAAM;IAClF,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,4BAA4B,CAAC,KAAK;IAC/E,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,4BAA4B,CAAC,KAAK;IACjF,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,EAAE,4BAA4B,CAAC,MAAM;IAC9F,CAAC,sBAAsB,CAAC,wBAAwB,CAAC,EAAE,4BAA4B,CAAC,KAAK;IACrF,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,4BAA4B,CAAC,MAAM;IAChF,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,4BAA4B,CAAC,MAAM;IAClF,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,4BAA4B,CAAC,MAAM;IAChF,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,4BAA4B,CAAC,MAAM;IAChF,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,EAAE,4BAA4B,CAAC,KAAK;IAE7F,uBAAuB;IACvB,CAAC,sBAAsB,CAAC,oCAAoC,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAC/F,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,0BAA0B,CAAC,MAAM;IAC9E,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,0BAA0B,CAAC,OAAO;IAClF,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,0BAA0B,CAAC,MAAM;IACjF,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,EAAE,0BAA0B,CAAC,MAAM;IAC7E,CAAC,sBAAsB,CAAC,YAAY,CAAC,EAAE,0BAA0B,CAAC,MAAM;IACxE,CAAC,sBAAsB,CAAC,YAAY,CAAC,EAAE,0BAA0B,CAAC,MAAM;IACxE,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,0BAA0B,CAAC,MAAM;IAC/E,CAAC,sBAAsB,CAAC,8BAA8B,CAAC,EAAE,0BAA0B,CAAC,KAAK;IACzF,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,0BAA0B,CAAC,MAAM;IAC/E,CAAC,sBAAsB,CAAC,eAAe,CAAC,EAAE,0BAA0B,CAAC,MAAM;IAC3E,CAAC,sBAAsB,CAAC,YAAY,CAAC,EAAE,0BAA0B,CAAC,MAAM;IACxE,CAAC,sBAAsB,CAAC,8BAA8B,CAAC,EAAE,0BAA0B,CAAC,KAAK;CAC1F,CAAC;AAEF;;;;;;GAMG;AACH,SAAS,kCAAkC;IACzC,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,KAAK,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,2BAA2B,CAAC,EAAE,CAAC;QAClF,MAAM,QAAQ,GAAG,2BAA2B,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC;QACjE,MAAM,UAAU,GAAG,4BAA4B,CAAC,QAA8B,CAAC,CAAC;QAChF,IAAI,CAAC,6BAA6B,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACxE,SAAS,CAAC,IAAI,CAAC,GAAG,SAAS,eAAe,UAAU,8BAA8B,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC3G,CAAC;IACH,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,6EAA6E,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACzH,CAAC;AACH,CAAC;AACD,kCAAkC,EAAE,CAAC;AAErC;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,SAAiB;IACrD,OAAO,2BAA2B,CAAC,SAAmC,CAAC,IAAI,kBAAkB,CAAC,OAAO,CAAC;AACxG,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,uBAAuB,CAAC,UAAkB,EAAE,SAAiB;IAC3E,OAAO,UAAU,KAAK,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AACzE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,kBAeX;AAfD,WAAY,kBAAkB;IAC5B,iEAAW,CAAA;IACX,2DAAQ,CAAA;IACR,mEAAY,CAAA;IACZ,+DAAU,CAAA;IACV,+DAAU,CAAA;IACV,2DAAQ,CAAA;IACR,qEAAa,CAAA;IACb,yDAAO,CAAA;IACP,2DAAQ,CAAA;IACR,yDAAO,CAAA;IACP,gEAAW,CAAA;IACX,4FAAyB,CAAA;IACzB,4DAAS,CAAA;IACT,8DAAU,CAAA;AACZ,CAAC,EAfW,kBAAkB,KAAlB,kBAAkB,QAe7B;AAED,sGAAsG;AACtG,MAAM,0BAA0B,GAAiD;IAC/E,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,SAAS;IACvC,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,MAAM;IACjC,CAAC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,UAAU;IACzC,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,QAAQ;IACrC,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,QAAQ;IACrC,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,MAAM;IACjC,CAAC,kBAAkB,CAAC,SAAS,CAAC,EAAE,WAAW;IAC3C,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,KAAK;IAC/B,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,MAAM;IACjC,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,KAAK;IAC/B,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,QAAQ;IACrC,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,EAAE,sBAAsB;IACjE,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,MAAM;IACjC,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,OAAO;CACpC,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,MAAM,iCAAiC,GAA8D;IACnG,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,kBAAkB,CAAC,IAAI;IAC9C,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC,MAAM;IAC1D,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,kBAAkB,CAAC,SAAS;CAC3D,CAAC;AAQF;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,uBAAuB,CAAC,UAAkB;IACxD,MAAM,UAAU,GAAG,iCAAiC,CAAC,UAAwB,CAAC,CAAC;IAC/E,OAAO,UAAU,KAAK,SAAS;QAC7B,CAAC,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,kBAAkB,CAAC,KAAK,EAAE;QAChE,CAAC,CAAC,EAAE,QAAQ,EAAE,0BAA0B,CAAC,UAAU,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;AACnF,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,mCAAmC,GAA6D;IACpG,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC,MAAM;IACtD,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE,eAAe,CAAC,MAAM;IAC3D,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,eAAe,CAAC,IAAI;IAClD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,eAAe,CAAC,IAAI;IAClD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC,IAAI;IACpD,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE,eAAe,CAAC,IAAI;IACnD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC,MAAM;IACtD,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE,eAAe,CAAC,MAAM;IAC3D,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC,MAAM;IACtD,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE,eAAe,CAAC,MAAM;CAC5D,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,6BAA6B,GAAG,CAAC,uBAAuB,EAAE,qBAAqB,EAAE,WAAW,CAAU,CAAC;AAE7G;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,qBAAqB,CAAC,SAAkB,EAAE,QAAgB;IACxE,IAAI,SAAS,KAAK,IAAI,IAAI,OAAO,SAAS,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IACzE,MAAM,MAAM,GAAG,SAA8C,CAAC;IAC9D,KAAK,MAAM,GAAG,IAAI,6BAA6B,EAAE,CAAC;QAChD,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,OAAO,SAAS,KAAK,QAAQ;YAAE,SAAS;QAC5C,MAAM,MAAM,GAAG,mCAAmC,CAAC,SAAkC,CAAC,CAAC;QACvF,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC;IAC1C,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["/**\n * OCSF `activity_id` — the normalised verb, resolved per Wildo audit event type.\n *\n * Until this table existed every OCSF document we emitted carried `activity_id: 0` (Unknown), which\n * also pinned `type_uid` to `class_uid * 100`. That is the single largest fidelity loss in the OCSF\n * projection: `activity_id` is the axis OCSF uses to separate events WITHIN a class, so collapsing it\n * makes a logon indistinguishable from a logoff to any consumer that groups by `type_uid`.\n *\n * ## Three values, three different claims\n *\n * | Value | Means | When we use it |\n * |---|---|---|\n * | a specific member | the published description matches this event | the description matched — never the caption alone |\n * | `OTHER` (99) | in the class's domain, absent from its enum | with `activity_name` carrying our event type, which is what the schema asks for |\n * | `UNKNOWN` (0) | we cannot say | application-defined event types the engine cannot enumerate |\n *\n * `OTHER` is not a shrug. The schema defines it as \"the event activity is not mapped. See the\n * `activity_name` attribute, which contains a data source specific value\" — so it is a positive\n * statement plus an obligation, and it strictly beats `UNKNOWN` for any event we understand.\n *\n * ## Read descriptions, not captions\n *\n * Authentication's `Authentication Ticket` (3), `Service Ticket Request` (4) and `Service Ticket\n * Renew` (5) read like a natural home for OAuth token issuance and refresh. Their descriptions are\n * explicitly **Kerberos** (\"A Kerberos service ticket was renewed\"), so every OAuth token event here\n * is `OTHER` instead. Mapping those from the captions would have been a fabrication that validated\n * perfectly.\n *\n * ## A structural observation, deliberately NOT acted on here\n *\n * A Wildo event's audit CATEGORY selects the OCSF class, and for several events the natural activity\n * exists in a DIFFERENT class than the category picks: `USER_PASSWORD_CHANGED`, `USER_MFA_ENABLED`,\n * `USER_ACCOUNT_LOCKED` and friends are `AUTHENTICATION` (class 3002), while `Password Change` (8),\n * `Enable MFA Factors` (12) and `Lock` (6) are published by `user_management` (3007). Those rows are\n * `OTHER` with the mismatch named on each. Re-categorising them would change SIEM category filtering\n * for existing tenants, so it is a product decision, not a mapping fix.\n *\n * spec-cite: OCSF schema 1.9.0 — `schema.ocsf.io/api/1.9.0/classes/{authentication,api_activity,\n * entity_management,user_management}`, the `activity_id` enum and `activity_name` attribute of each.\n */\n\nimport { AuditEventCategory, AuthMethod, CoreAuditableEventType, CoreResourceOperation, getAuditEventClassification } from '@wildo-ai/saas-models';\nimport { OCSF_CLASS_BY_AUDIT_CATEGORY, OcsfClassUid } from './ocsf-class-mapping.backend.utils';\n\n/** `0` and `99` mean the same thing in every OCSF class, so they are named once. */\nexport enum OcsfCommonActivity {\n  /** \"The event activity is unknown.\" */\n  UNKNOWN = 0,\n  /** \"The event activity is not mapped. See the `activity_name` attribute…\" */\n  OTHER = 99,\n}\n\n/** Published `activity_id` members of class 3002 (authentication). */\nexport enum OcsfAuthenticationActivity {\n  /** \"A new logon session was requested.\" Includes FAILED attempts — the verb is the request; the outcome rides `status_id`. */\n  LOGON = 1,\n  /** \"A logon session was terminated and no longer exists.\" */\n  LOGOFF = 2,\n  /** \"A preauthentication stage was engaged.\" Covers issuing an OTP or magic link: a stage BEFORE authentication. */\n  PREAUTH = 6,\n  OTHER = 99,\n}\n\n/** Published `activity_id` members of class 6003 (api_activity). */\nexport enum OcsfApiActivity {\n  CREATE = 1,\n  /** \"Read\" — the only CRUD verb our authorization/data-access events reliably carry. */\n  READ = 2,\n  UPDATE = 3,\n  DELETE = 4,\n  OTHER = 99,\n}\n\n/** Published `activity_id` members of class 3004 (entity_management). */\nexport enum OcsfEntityManagementActivity {\n  CREATE = 1,\n  READ = 2,\n  UPDATE = 3,\n  DELETE = 4,\n  MOVE = 5,\n  /** \"Enroll an existing managed entity.\" A member joining a tenant. */\n  ENROLL = 6,\n  UNENROLL = 7,\n  ENABLE = 8,\n  DISABLE = 9,\n  ACTIVATE = 10,\n  DEACTIVATE = 11,\n  SUSPEND = 12,\n  /** \"Resume (unsuspend) an existing managed entity.\" SUSPENDED is the only state our activate runs from. */\n  RESUME = 13,\n  OTHER = 99,\n}\n\n/** Published `activity_id` members of class 3007 (user_management). */\nexport enum OcsfUserManagementActivity {\n  CREATE = 1,\n  UPDATE = 2,\n  DELETE = 3,\n  ENABLE = 4,\n  DISABLE = 5,\n  LOCK = 6,\n  UNLOCK = 7,\n  PASSWORD_CHANGE = 8,\n  PASSWORD_RESET = 9,\n  ATTACH_POLICIES = 10,\n  DETACH_POLICIES = 11,\n  ENABLE_MFA_FACTORS = 12,\n  DISABLE_MFA_FACTORS = 13,\n  ASSIGN_PRIVILEGES = 14,\n  REMOVE_PRIVILEGES = 15,\n  ASSIGN_ROLES = 16,\n  REMOVE_ROLES = 17,\n  ADD_PROGRAMMATIC_CREDENTIALS = 18,\n  REMOVE_PROGRAMMATIC_CREDENTIALS = 19,\n  OTHER = 99,\n}\n\n/**\n * Every published activity id, per class — the membership check's source of truth.\n *\n * An activity number is only meaningful WITH its class: `1` is `Logon` in 3002 and `Create` in 6003.\n * So a row that assigns the right number under the wrong class is silently wrong, and nothing about\n * the emitted document would look malformed. {@link assertActivitiesBelongToTheirClass} closes that.\n */\nconst PUBLISHED_ACTIVITIES_BY_CLASS: Readonly<Record<OcsfClassUid, ReadonlySet<number>>> = {\n  [OcsfClassUid.AUTHENTICATION]: new Set(Object.values(OcsfAuthenticationActivity).filter((v): v is number => typeof v === 'number')),\n  [OcsfClassUid.API_ACTIVITY]: new Set(Object.values(OcsfApiActivity).filter((v): v is number => typeof v === 'number')),\n  [OcsfClassUid.ENTITY_MANAGEMENT]: new Set(Object.values(OcsfEntityManagementActivity).filter((v): v is number => typeof v === 'number')),\n  [OcsfClassUid.USER_MANAGEMENT]: new Set(Object.values(OcsfUserManagementActivity).filter((v): v is number => typeof v === 'number')),\n};\n\n/**\n * The activity each core audit event resolves to.\n *\n * **Total over `CoreAuditableEventType`**, so a new core event type cannot be added without deciding\n * its activity — the same shape the classification map now has, and for the same reason: an open set\n * silently defaulting is how `activity_id` stayed `Unknown` for every event in the first place.\n */\nexport const OCSF_ACTIVITY_BY_EVENT_TYPE: Readonly<Record<CoreAuditableEventType, number>> = {\n\n  // ── AUTHENTICATION ──\n  [CoreAuditableEventType.EMERGENCY_ACCESS_USED]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.MACHINE_AUTH_FAILED]: OcsfAuthenticationActivity.LOGON,\n  [CoreAuditableEventType.MACHINE_AUTH_SUCCESS]: OcsfAuthenticationActivity.LOGON,\n  [CoreAuditableEventType.OAUTH_CIMD_CLIENT_REFUSED]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.OAUTH_CODE_EXCHANGE_FAILED]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.OAUTH_DYNAMIC_CLIENT_REGISTERED]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.OAUTH_TOKEN_REFRESHED]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.OAUTH_TOKEN_REVOKED]: OcsfAuthenticationActivity.OTHER,\n  // Unlike the token-revoke sibling above (a no-oracle RFC 7009 ATTEMPT → Other), an RP-Initiated Logout\n  // terminates a real user SESSION, so it is a genuine OCSF Logoff — matching USER_LOGOUT / SAML_SLO_COMPLETED.\n  [CoreAuditableEventType.OAUTH_RP_INITIATED_LOGOUT]: OcsfAuthenticationActivity.LOGOFF,\n  [CoreAuditableEventType.ONE_OFF_TOKEN_CREATED]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.ONE_OFF_TOKEN_EXCHANGED]: OcsfAuthenticationActivity.OTHER,\n  // Admin token-lifecycle, not an OCSF user LOGOFF — Other(99) + activity_name, matching the family.\n  [CoreAuditableEventType.ONE_OFF_TOKEN_REVOKED]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.SAML_ASSERTION_REPLAY_DETECTED]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.SAML_LOGIN_FAILED]: OcsfAuthenticationActivity.LOGON,\n  [CoreAuditableEventType.SAML_LOGIN_INITIATED]: OcsfAuthenticationActivity.LOGON,\n  [CoreAuditableEventType.SAML_LOGIN_SUCCESS]: OcsfAuthenticationActivity.LOGON,\n  [CoreAuditableEventType.SAML_SLO_COMPLETED]: OcsfAuthenticationActivity.LOGOFF,\n  [CoreAuditableEventType.SAML_SLO_INITIATED]: OcsfAuthenticationActivity.LOGOFF,\n  [CoreAuditableEventType.USER_ACCOUNT_LOCKED]: OcsfAuthenticationActivity.OTHER, // 3007 publishes Lock(6), but this event's category routes it to 3002, which does not\n  [CoreAuditableEventType.USER_CROSS_FRONTEND_HANDOFF_ISSUED]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.USER_IDENTITY_LINK_REMOVED]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.USER_LOGIN]: OcsfAuthenticationActivity.LOGON,\n  [CoreAuditableEventType.USER_LOGIN_FAILED]: OcsfAuthenticationActivity.LOGON,\n  [CoreAuditableEventType.USER_LOGOUT]: OcsfAuthenticationActivity.LOGOFF,\n  [CoreAuditableEventType.USER_MAGIC_LINK_FAILED]: OcsfAuthenticationActivity.LOGON,\n  [CoreAuditableEventType.USER_MAGIC_LINK_SENT]: OcsfAuthenticationActivity.PREAUTH,\n  [CoreAuditableEventType.USER_MAGIC_LINK_VERIFIED]: OcsfAuthenticationActivity.LOGON,\n  [CoreAuditableEventType.USER_MFA_DISABLED]: OcsfAuthenticationActivity.OTHER, // 3007 publishes Disable MFA Factors(13), but this event's category routes it to 3002, which does not\n  [CoreAuditableEventType.USER_MFA_EMAIL_OTP_SENT]: OcsfAuthenticationActivity.PREAUTH,\n  [CoreAuditableEventType.USER_MFA_ENABLED]: OcsfAuthenticationActivity.OTHER, // 3007 publishes Enable MFA Factors(12), but this event's category routes it to 3002, which does not\n  [CoreAuditableEventType.USER_MFA_SETUP_COMPLETED]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.USER_MFA_SETUP_STARTED]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.USER_PASSKEY_AUTHENTICATION_FAILURE]: OcsfAuthenticationActivity.LOGON,\n  [CoreAuditableEventType.USER_PASSKEY_AUTHENTICATION_SUCCESS]: OcsfAuthenticationActivity.LOGON,\n  [CoreAuditableEventType.USER_PASSKEY_CLONE_SUSPECTED]: OcsfAuthenticationActivity.LOGON,\n  [CoreAuditableEventType.USER_PASSKEY_REGISTERED]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.USER_PASSKEY_REMOVED]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.USER_PASSWORD_CHANGED]: OcsfAuthenticationActivity.OTHER, // 3007 publishes Password Change(8), but this event's category routes it to 3002, which does not\n  [CoreAuditableEventType.USER_PASSWORD_RESET_COMPLETED]: OcsfAuthenticationActivity.OTHER, // 3007 publishes Password Reset(9), but this event's category routes it to 3002, which does not\n  [CoreAuditableEventType.USER_PASSWORD_RESET_FORCED]: OcsfAuthenticationActivity.OTHER, // 3007 publishes Password Reset(9), but this event's category routes it to 3002, which does not\n  [CoreAuditableEventType.USER_PASSWORD_RESET_REQUESTED]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.USER_PASSWORD_SET]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.USER_REFRESH_TOKEN_REUSE_DETECTED]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.USER_SESSION_EXPIRED]: OcsfAuthenticationActivity.LOGOFF,\n  /*\n   * LOGOFF, like the expiry above: the session is terminated and no longer exists, which is what the\n   * OCSF verb states. The DIFFERENCE between the two — time elapsed versus a cap displacing a live\n   * chain — is not expressible in `activity_id`, so it rides the typed eventData and the WARNING\n   * severity instead. Mapping it to OTHER would have lost the one thing a SIEM correlates on.\n   */\n  [CoreAuditableEventType.USER_SESSION_EVICTED]: OcsfAuthenticationActivity.LOGOFF,\n  [CoreAuditableEventType.USER_SMS_OTP_FAILED]: OcsfAuthenticationActivity.LOGON,\n  [CoreAuditableEventType.USER_SMS_OTP_SENT]: OcsfAuthenticationActivity.PREAUTH,\n  [CoreAuditableEventType.USER_SMS_OTP_VERIFIED]: OcsfAuthenticationActivity.LOGON,\n  [CoreAuditableEventType.USER_SSO_ENFORCEMENT_BLOCKED]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.USER_SSO_LOGIN]: OcsfAuthenticationActivity.LOGON,\n  [CoreAuditableEventType.USER_SSO_LOGIN_FAILED]: OcsfAuthenticationActivity.LOGON,\n  [CoreAuditableEventType.USER_TOKEN_REFRESHED]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.USER_TOTP_DISABLED]: OcsfAuthenticationActivity.OTHER,\n\n  // ── AUTHORIZATION ──\n  // A file upload grant delegates one upload under the minter's authority; issuing/revoking it is not\n  // one of 6003's CRUD verbs on a resource.\n  [CoreAuditableEventType.FILE_UPLOAD_GRANT_ISSUED]: OcsfApiActivity.OTHER,\n  [CoreAuditableEventType.FILE_UPLOAD_GRANT_REVOKED]: OcsfApiActivity.OTHER,\n  [CoreAuditableEventType.APPLICATION_SUPER_ADMIN_FLOOR_BREACHED]: OcsfApiActivity.OTHER,\n  [CoreAuditableEventType.CROSS_TENANT_ADMINISTRATIVE_ACCESS]: OcsfApiActivity.OTHER,\n  [CoreAuditableEventType.OAUTH2_PROVIDER_BLOCKED]: OcsfApiActivity.OTHER,\n  [CoreAuditableEventType.OAUTH_CONSENT_BINDING_VIOLATION]: OcsfApiActivity.OTHER,\n  [CoreAuditableEventType.OAUTH_CONSENT_DENIED]: OcsfApiActivity.OTHER,\n  [CoreAuditableEventType.OAUTH_CONSENT_GRANTED]: OcsfApiActivity.OTHER,\n  [CoreAuditableEventType.OAUTH_CONSENT_GRANT_PERSISTED]: OcsfApiActivity.OTHER,\n  [CoreAuditableEventType.OAUTH_DELEGATED_TOKEN_ISSUED]: OcsfApiActivity.OTHER,\n  [CoreAuditableEventType.ORGANIZATION_MEMBER_ROLE_CHANGED]: OcsfApiActivity.OTHER, // a role change is not one of 6003 CRUD verbs\n  [CoreAuditableEventType.ORGANIZATION_OWNER_FLOOR_BREACHED]: OcsfApiActivity.OTHER,\n  [CoreAuditableEventType.ORGANIZATION_UNIT_MEMBER_REMOVED]: OcsfApiActivity.OTHER,\n  [CoreAuditableEventType.ORGANIZATION_UNIT_MEMBER_ROLE_CHANGED]: OcsfApiActivity.OTHER,\n  [CoreAuditableEventType.PLATFORM_ACCESS_GRANT_LIFECYCLE]: OcsfApiActivity.OTHER,\n  [CoreAuditableEventType.RESOURCE_OPERATION_DENIED]: OcsfApiActivity.OTHER, // the CRUD verb is runtime data (the operation), not derivable from the event type\n  [CoreAuditableEventType.RESOURCE_OPERATION_PERFORMED]: OcsfApiActivity.OTHER, // the CRUD verb is runtime data (the operation), not derivable from the event type\n  [CoreAuditableEventType.USER_APP_ROLES_CHANGED]: OcsfApiActivity.OTHER, // a role change is not one of 6003 CRUD verbs\n\n  // ── DATA_ACCESS ──\n  [CoreAuditableEventType.FIELD_ACCESS]: OcsfApiActivity.READ,\n  // CREATE, not OTHER: redeeming a grant IS the creation of one FILES row — the one DATA_ACCESS event\n  // whose CRUD verb is derivable from the type, like PLATFORM_DIRECTORY_ACCESS below.\n  [CoreAuditableEventType.FILE_UPLOAD_GRANT_REDEEMED]: OcsfApiActivity.CREATE,\n  // OTHER for both (#506): a scan CONCLUSION is not one of 6003's CRUD verbs on a resource. The file\n  // row is updated as a consequence, but the event names the finding, not the write — mapping it to\n  // UPDATE would tell a SIEM that a record was modified and lose that malware was found.\n  [CoreAuditableEventType.FILE_MALWARE_DETECTED]: OcsfApiActivity.OTHER,\n  [CoreAuditableEventType.FILE_MALWARE_SCAN_FAILED]: OcsfApiActivity.OTHER,\n  [CoreAuditableEventType.MACHINE_ACCESS]: OcsfApiActivity.OTHER, // names a surface reach (A2A/MCP turn), not a CRUD verb on a resource\n  // READ, not OTHER: enumerating a directory IS a read of resource rows, and it is the one case\n  // where the CRUD verb IS derivable from the event type — the event only ever names a collection\n  // read (list/search/count), never a mutation.\n  [CoreAuditableEventType.PLATFORM_DIRECTORY_ACCESS]: OcsfApiActivity.READ,\n  [CoreAuditableEventType.RETAINED_DATA_ACCESS]: OcsfApiActivity.READ,\n  [CoreAuditableEventType.SUBJECT_DATA_EXPORT]: OcsfApiActivity.READ,\n  [CoreAuditableEventType.COLLECTION_DATA_EXPORT]: OcsfApiActivity.READ,\n  [CoreAuditableEventType.HTTP_API_READ_THROUGH_ACCESS]: OcsfApiActivity.READ,\n  // D6 stance 6b: the declared external-erasure operation DELETED remote rows.\n  [CoreAuditableEventType.HTTP_API_EXTERNAL_ERASURE]: OcsfApiActivity.DELETE,\n  // D6 stance 6c: nothing was deleted — the event records a deliberate non-action.\n  [CoreAuditableEventType.HTTP_API_NON_ERASURE_ACKNOWLEDGED]: OcsfApiActivity.OTHER,\n  [CoreAuditableEventType.SYSTEM_CONTEXT_READ]: OcsfApiActivity.READ,\n  [CoreAuditableEventType.SYSTEM_CONTEXT_WRITE]: OcsfApiActivity.OTHER, // static fallback only — refined per emission from eventData.operation (CREATE | UPDATE | UPDATE_MANY)\n\n  // ── ORG_MANAGEMENT ──\n  [CoreAuditableEventType.ORGANIZATION_ACTIVATED]: OcsfEntityManagementActivity.RESUME,\n  [CoreAuditableEventType.ORGANIZATION_CREATED]: OcsfEntityManagementActivity.CREATE,\n  [CoreAuditableEventType.ORGANIZATION_DELETED]: OcsfEntityManagementActivity.DELETE,\n  [CoreAuditableEventType.ORGANIZATION_DELETION_REQUESTED]: OcsfEntityManagementActivity.OTHER, // marks the tenant and opens a window; nothing is deleted yet, so Delete(4) would overstate it\n  [CoreAuditableEventType.ORGANIZATION_MEMBER_INVITED]: OcsfEntityManagementActivity.CREATE,\n  [CoreAuditableEventType.ORGANIZATION_MEMBER_JOINED]: OcsfEntityManagementActivity.ENROLL,\n  [CoreAuditableEventType.ORGANIZATION_MEMBER_REMOVED]: OcsfEntityManagementActivity.UNENROLL,\n  [CoreAuditableEventType.ORGANIZATION_MEMBER_STATUS_CHANGED]: OcsfEntityManagementActivity.UPDATE,\n  [CoreAuditableEventType.ORGANIZATION_MEMBER_UPDATED]: OcsfEntityManagementActivity.UPDATE,\n  [CoreAuditableEventType.ORGANIZATION_NOTIFICATIONS_UPDATED]: OcsfEntityManagementActivity.UPDATE,\n  [CoreAuditableEventType.ORGANIZATION_PREFERENCES_UPDATED]: OcsfEntityManagementActivity.UPDATE,\n  [CoreAuditableEventType.ORGANIZATION_PROFILE_UPDATED]: OcsfEntityManagementActivity.UPDATE,\n  [CoreAuditableEventType.ORGANIZATION_RESTORED]: OcsfEntityManagementActivity.OTHER, // un-deletion has no 3004 member; Resume(13) is unsuspend and Activate(10) is a transient engine state\n  [CoreAuditableEventType.ORGANIZATION_SIEM_EXPORT_CONFIGURED]: OcsfEntityManagementActivity.UPDATE,\n  // Organization provider credentials. The credential row IS the managed entity, so the three\n  // lifecycle verbs map onto its CRUD members directly — CREATE for the first grant, UPDATE for a\n  // rotation (the entity persists, its secret changes), DELETE for the withdrawal.\n  [CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_SET]: OcsfEntityManagementActivity.CREATE,\n  [CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_ROTATED]: OcsfEntityManagementActivity.UPDATE,\n  // READ(2), not OTHER: resolving the credential for an outbound call reads the managed entity, and\n  // READ is what an OCSF consumer's \"who accessed this secret\" query is written against. Mapping a\n  // spend to OTHER(99) would take the highest-value events in this family out of every stock rule.\n  [CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_USED]: OcsfEntityManagementActivity.READ,\n  [CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_DELETED]: OcsfEntityManagementActivity.DELETE,\n  // A person's own credential maps identically to the tenant's: the OCSF activity describes what was\n  // done to the managed entity, and that is the same verb regardless of who owns it. WHO owns it is\n  // carried by the event data, not by the activity — collapsing the two would make \"who accessed\n  // this secret\" queries miss half their population.\n  [CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_SET]: OcsfEntityManagementActivity.CREATE,\n  [CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_ROTATED]: OcsfEntityManagementActivity.UPDATE,\n  [CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_USED]: OcsfEntityManagementActivity.READ,\n  [CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_DELETED]: OcsfEntityManagementActivity.DELETE,\n  // CREATE, like the `_SET` siblings: what OCSF records is the verb done to the managed entity, and\n  // a connection coming into existence is a creation however it was obtained. The fact that this one\n  // came from a consent ceremony rather than a paste lives in the event DATA — an OCSF activity is\n  // deliberately a small closed vocabulary, and stretching it to carry provenance would make it a\n  // worse index of what happened, not a better one.\n  [CoreAuditableEventType.ORGANIZATION_PROVIDER_CONNECTION_GRANTED]: OcsfEntityManagementActivity.CREATE,\n  [CoreAuditableEventType.USER_PROVIDER_CONNECTION_GRANTED]: OcsfEntityManagementActivity.CREATE,\n  [CoreAuditableEventType.ORGANIZATION_SSO_CONFIGURATION_CHANGED]: OcsfEntityManagementActivity.UPDATE,\n  // An application authentication-policy change is a configuration entity being UPDATED — the same\n  // OCSF shape as the SSO / SIEM / SCIM configuration-change siblings around it. (Confirmed by the\n  // session that added the event: UPDATE is the intended activity.)\n  [CoreAuditableEventType.APPLICATION_AUTH_POLICY_CHANGED]: OcsfEntityManagementActivity.UPDATE,\n  [CoreAuditableEventType.ORGANIZATION_SUSPENDED]: OcsfEntityManagementActivity.SUSPEND,\n  [CoreAuditableEventType.ORGANIZATION_UNIT_UPDATED]: OcsfEntityManagementActivity.UPDATE,\n  [CoreAuditableEventType.ORGANIZATION_UPDATED]: OcsfEntityManagementActivity.UPDATE,\n  [CoreAuditableEventType.SAML_CERT_EXPIRING]: OcsfEntityManagementActivity.OTHER,\n  [CoreAuditableEventType.SAML_METADATA_PARSED]: OcsfEntityManagementActivity.OTHER,\n  [CoreAuditableEventType.SCIM_PROVISIONING_CONFIG_UPDATED]: OcsfEntityManagementActivity.UPDATE,\n  [CoreAuditableEventType.SCIM_PROVISIONING_FAILED]: OcsfEntityManagementActivity.OTHER,\n  [CoreAuditableEventType.SCIM_TOKEN_CREATED]: OcsfEntityManagementActivity.CREATE,\n  [CoreAuditableEventType.SCIM_TOKEN_GENERATED]: OcsfEntityManagementActivity.CREATE,\n  [CoreAuditableEventType.SCIM_TOKEN_REVOKED]: OcsfEntityManagementActivity.DELETE,\n  [CoreAuditableEventType.SCIM_TOKEN_ROTATED]: OcsfEntityManagementActivity.UPDATE,\n  [CoreAuditableEventType.WEBHOOK_ENDPOINT_TEST_DISPATCHED]: OcsfEntityManagementActivity.OTHER,\n\n  // ── USER_LIFECYCLE ──\n  [CoreAuditableEventType.RESOURCE_STATUS_TRANSITION_PERFORMED]: OcsfUserManagementActivity.OTHER,\n  [CoreAuditableEventType.SAML_EMAIL_CHANGED]: OcsfUserManagementActivity.UPDATE,\n  [CoreAuditableEventType.SCIM_USER_DEACTIVATED]: OcsfUserManagementActivity.DISABLE,\n  [CoreAuditableEventType.SCIM_USER_PROVISIONED]: OcsfUserManagementActivity.CREATE,\n  [CoreAuditableEventType.SCIM_USER_UPDATED]: OcsfUserManagementActivity.UPDATE,\n  [CoreAuditableEventType.USER_CREATED]: OcsfUserManagementActivity.CREATE,\n  [CoreAuditableEventType.USER_DELETED]: OcsfUserManagementActivity.DELETE,\n  [CoreAuditableEventType.USER_EMAIL_VERIFIED]: OcsfUserManagementActivity.UPDATE,\n  [CoreAuditableEventType.USER_PHONE_VERIFICATION_FAILED]: OcsfUserManagementActivity.OTHER,\n  [CoreAuditableEventType.USER_PHONE_VERIFIED]: OcsfUserManagementActivity.UPDATE,\n  [CoreAuditableEventType.USER_REGISTERED]: OcsfUserManagementActivity.CREATE,\n  [CoreAuditableEventType.USER_UPDATED]: OcsfUserManagementActivity.UPDATE,\n  [CoreAuditableEventType.USER_VERIFICATION_EMAIL_RESENT]: OcsfUserManagementActivity.OTHER,\n};\n\n/**\n * Fail at module load if any row assigns an activity its own class does not publish.\n *\n * This is the check the table exists to make possible. Activity numbers are class-scoped and collide\n * across classes, so a misfiled row produces a document that is structurally valid, schema-conformant,\n * and semantically wrong — the failure mode nothing downstream can catch.\n */\nfunction assertActivitiesBelongToTheirClass(): void {\n  const offenders: string[] = [];\n  for (const [eventType, activityId] of Object.entries(OCSF_ACTIVITY_BY_EVENT_TYPE)) {\n    const category = getAuditEventClassification(eventType).category;\n    const descriptor = OCSF_CLASS_BY_AUDIT_CATEGORY[category as AuditEventCategory];\n    if (!PUBLISHED_ACTIVITIES_BY_CLASS[descriptor.classUid].has(activityId)) {\n      offenders.push(`${eventType} → activity ${activityId} is not published by class ${descriptor.classUid}`);\n    }\n  }\n  if (offenders.length > 0) {\n    throw new Error(`OCSF activity mapping assigns activities their class does not publish:\\n  ${offenders.join('\\n  ')}`);\n  }\n}\nassertActivitiesBelongToTheirClass();\n\n/**\n * Resolve the OCSF activity for an event type.\n *\n * Application-defined event types are ordinary strings the engine cannot enumerate, so they resolve to\n * `UNKNOWN` — the one case where \"we cannot say\" is the truthful answer.\n */\nexport function resolveOcsfActivityId(eventType: string): number {\n  return OCSF_ACTIVITY_BY_EVENT_TYPE[eventType as CoreAuditableEventType] ?? OcsfCommonActivity.UNKNOWN;\n}\n\n/**\n * The `activity_name` companion for an `OTHER` assignment, or `undefined` when the activity is specific.\n *\n * The schema's own definition of `OTHER` points the reader at `activity_name`, so emitting `OTHER`\n * without it discards the very information the value promises is available.\n *\n * Takes the RESOLVED activity rather than re-deriving it from the event type. That distinction became\n * load-bearing when 6003 gained runtime refinement: an event whose TABLE entry is `Other` but whose\n * refined activity is `Update` must NOT carry `activity_name`, and a version of this that re-derived\n * from the event type would have emitted both — a specific activity plus a companion asserting it was\n * unmapped. Two ways to answer one question is the drift this contract exists to prevent.\n */\nexport function resolveOcsfActivityName(activityId: number, eventType: string): string | undefined {\n  return activityId === OcsfCommonActivity.OTHER ? eventType : undefined;\n}\n\n/**\n * OCSF `auth_protocol_id` — the NORMALISED authentication protocol.\n *\n * spec-cite: OCSF 1.9.0 — `schema.ocsf.io/api/1.9.0/classes/authentication`, the `auth_protocol_id`\n * enum. `auth_protocol` is documented as \"the authentication protocol as defined by the caption of\n * `auth_protocol_id`. In the case of Other, it is defined by the event source.\"\n */\nexport enum OcsfAuthProtocolId {\n  UNKNOWN = 0,\n  NTLM = 1,\n  KERBEROS = 2,\n  DIGEST = 3,\n  OPENID = 4,\n  SAML = 5,\n  OAUTH_2_0 = 6,\n  PAP = 7,\n  CHAP = 8,\n  EAP = 9,\n  RADIUS = 10,\n  BASIC_AUTHENTICATION = 11,\n  LDAP = 12,\n  OTHER = 99,\n}\n\n/** The published CAPTION for each id — what `auth_protocol` must carry when the id is not `Other`. */\nconst OCSF_AUTH_PROTOCOL_CAPTION: Readonly<Record<OcsfAuthProtocolId, string>> = {\n  [OcsfAuthProtocolId.UNKNOWN]: 'Unknown',\n  [OcsfAuthProtocolId.NTLM]: 'NTLM',\n  [OcsfAuthProtocolId.KERBEROS]: 'Kerberos',\n  [OcsfAuthProtocolId.DIGEST]: 'Digest',\n  [OcsfAuthProtocolId.OPENID]: 'OpenID',\n  [OcsfAuthProtocolId.SAML]: 'SAML',\n  [OcsfAuthProtocolId.OAUTH_2_0]: 'OAUTH 2.0',\n  [OcsfAuthProtocolId.PAP]: 'PAP',\n  [OcsfAuthProtocolId.CHAP]: 'CHAP',\n  [OcsfAuthProtocolId.EAP]: 'EAP',\n  [OcsfAuthProtocolId.RADIUS]: 'RADIUS',\n  [OcsfAuthProtocolId.BASIC_AUTHENTICATION]: 'Basic Authentication',\n  [OcsfAuthProtocolId.LDAP]: 'LDAP',\n  [OcsfAuthProtocolId.OTHER]: 'Other',\n};\n\n/**\n * The `AuthMethod` members that ARE a protocol OCSF normalises. Everything else resolves to `Other`.\n *\n * Deliberately partial. Three members are absent for a reason, and each absence is a decision:\n *\n * - `PASSWORD` is NOT `Basic Authentication` (11). Basic Auth is an HTTP transport scheme (RFC 7617);\n *   a user typing a password into a form is not that, and the resemblance is only in the English word.\n * - `MAGIC_LINK`, `TOTP`, `SMS_OTP`, `EMAIL_OTP` and `PASSKEY` name no protocol in the published enum.\n *   WebAuthn/FIDO2 in particular is absent from OCSF 1.9.0 — mapping a passkey to `Other` is the\n *   accurate answer, not a shortfall.\n * - `EXTERNAL_OAUTH2` DOES map: it is OAuth 2.0 by construction.\n *\n * The `ORG_` prefix on the SSO members is SCOPE, not protocol — an organization-restricted SAML login\n * is still SAML — so those normalise cleanly.\n */\nconst OCSF_AUTH_PROTOCOL_BY_AUTH_METHOD: Readonly<Partial<Record<AuthMethod, OcsfAuthProtocolId>>> = {\n  [AuthMethod.ORG_SAML]: OcsfAuthProtocolId.SAML,\n  [AuthMethod.ORG_OPENID_CONNECT]: OcsfAuthProtocolId.OPENID,\n  [AuthMethod.EXTERNAL_OAUTH2]: OcsfAuthProtocolId.OAUTH_2_0,\n};\n\n/** `auth_protocol` + `auth_protocol_id`, resolved together because the schema couples them. */\nexport interface OcsfAuthProtocol {\n  readonly protocol: string;\n  readonly protocolId: OcsfAuthProtocolId;\n}\n\n/**\n * Resolve the OCSF protocol pair for an envelope's `authMethod`.\n *\n * The two attributes are resolved TOGETHER because the schema defines one in terms of the other: when\n * the id is normalised, the string must be that id's published caption; only under `Other` may the\n * string be the producer's own value. Returning them separately invites the pairing to drift, which is\n * exactly how this shipped wrong the first time (`org_saml` with no id at all).\n *\n * `authMethod` is an OPEN string on the envelope — applications define their own — so anything outside\n * the framework's own `AuthMethod` vocabulary lands on `Other` carrying its raw value, which is\n * precisely what `Other` is for.\n */\nexport function resolveOcsfAuthProtocol(authMethod: string): OcsfAuthProtocol {\n  const normalised = OCSF_AUTH_PROTOCOL_BY_AUTH_METHOD[authMethod as AuthMethod];\n  return normalised === undefined\n    ? { protocol: authMethod, protocolId: OcsfAuthProtocolId.OTHER }\n    : { protocol: OCSF_AUTH_PROTOCOL_CAPTION[normalised], protocolId: normalised };\n}\n\n/**\n * The CRUD verb an API Activity (6003) event performed, mapped from the framework's core operation.\n *\n * spec-cite: OCSF 1.9.0 — `api_activity.activity_id` enum: 0 Unknown, 1 Create, 2 Read, 3 Update,\n * 4 Delete, 99 Other.\n *\n * The bulk forms collapse onto their singular verb: OCSF's activity names WHAT was done, and the\n * cardinality is carried separately by the envelope (`isBulkOperation` / `affectedRecordCount`).\n * `COUNT` is a Read — it answers a question about existing rows without changing any.\n */\nconst OCSF_API_ACTIVITY_BY_CORE_OPERATION: Readonly<Record<CoreResourceOperation, OcsfApiActivity>> = {\n  [CoreResourceOperation.CREATE]: OcsfApiActivity.CREATE,\n  [CoreResourceOperation.CREATE_MANY]: OcsfApiActivity.CREATE,\n  [CoreResourceOperation.READ]: OcsfApiActivity.READ,\n  [CoreResourceOperation.LIST]: OcsfApiActivity.READ,\n  [CoreResourceOperation.SEARCH]: OcsfApiActivity.READ,\n  [CoreResourceOperation.COUNT]: OcsfApiActivity.READ,\n  [CoreResourceOperation.UPDATE]: OcsfApiActivity.UPDATE,\n  [CoreResourceOperation.UPDATE_MANY]: OcsfApiActivity.UPDATE,\n  [CoreResourceOperation.DELETE]: OcsfApiActivity.DELETE,\n  [CoreResourceOperation.DELETE_MANY]: OcsfApiActivity.DELETE,\n};\n\n/**\n * The `eventData` keys that can name a 6003 event's CRUD verb, in precedence order.\n *\n * Three keys rather than one because the emitters spell it differently and each is authoritative for\n * its own event: `resourceOperationLike` is the core semantics a CUSTOM verb borrows (a `suspend`\n * behaving as an `update`), `operationIdentifier` is the verb on resource-operation and field-access\n * events, and `operation` is what `logSystemContextWrite` records — typed `CREATE | UPDATE |\n * UPDATE_MANY`, so it always resolves.\n *\n * Enumerated by the QUESTION (\"what names the verb on a 6003 event?\") rather than by one emitter's\n * field name, which is how `operation` was missed on the first pass.\n */\nconst OCSF_API_VERB_EVENT_DATA_KEYS = ['resourceOperationLike', 'operationIdentifier', 'operation'] as const;\n\n/**\n * Refine a 6003 event's `activity_id` from RUNTIME data, when the event type alone cannot say.\n *\n * Class 6003 is organised around the CRUD axis, and the resource-operation events (`performed` /\n * `denied`) are the bulk of what we route there — yet the event TYPE is the same string for a create\n * and a delete. So the table maps them to `Other`, and every authorization event landed in one\n * undifferentiated bucket: the same collapse `activity_id` being pinned to `Unknown` used to cause,\n * surviving one layer down after that was fixed.\n *\n * The verb is in the envelope — under one of {@link OCSF_API_VERB_EVENT_DATA_KEYS}, in that precedence\n * order. Anything else (a custom verb borrowing nothing) keeps `Other`, where `activity_name` already\n * carries the event type.\n *\n * Two consequences that are DECISIONS, not side effects:\n *\n * - **`FIELD_ACCESS` refines away from its static `Read`.** It carries `operationIdentifier`, so a\n *   secret exposed during a create now reads as Create(1). That is correct: 6003's activity names what\n *   the API CALL did, and the field-access nature rides `metadata.event_code`. The static `Read` remains\n *   the fallback for an emission that names no operation.\n * - **`SYSTEM_CONTEXT_WRITE` stops being `Other`.** Its table comment says \"neither Create nor Update is\n *   true of every emission\" — true of a STATIC mapping and not a permanent conclusion, because at\n *   runtime `operation` says exactly which. This matters more than most: it is the ACL-bypass write.\n */\nexport function refineOcsfApiActivity(eventData: unknown, fallback: number): number {\n  if (eventData === null || typeof eventData !== 'object') return fallback;\n  const record = eventData as Readonly<Record<string, unknown>>;\n  for (const key of OCSF_API_VERB_EVENT_DATA_KEYS) {\n    const candidate = record[key];\n    if (typeof candidate !== 'string') continue;\n    const mapped = OCSF_API_ACTIVITY_BY_CORE_OPERATION[candidate as CoreResourceOperation];\n    if (mapped !== undefined) return mapped;\n  }\n  return fallback;\n}\n"]}
+{"version":3,"file":"ocsf-activity-mapping.backend.utils.js","sourceRoot":"","sources":["../../../../../../src/compliance/audit-trails/services/utils/ocsf-activity-mapping.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,EAAsB,UAAU,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AACnJ,OAAO,EAAE,4BAA4B,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAEhG,oFAAoF;AACpF,MAAM,CAAN,IAAY,kBAKX;AALD,WAAY,kBAAkB;IAC5B,uCAAuC;IACvC,iEAAW,CAAA;IACX,6EAA6E;IAC7E,8DAAU,CAAA;AACZ,CAAC,EALW,kBAAkB,KAAlB,kBAAkB,QAK7B;AAED,sEAAsE;AACtE,MAAM,CAAN,IAAY,0BAQX;AARD,WAAY,0BAA0B;IACpC,8HAA8H;IAC9H,6EAAS,CAAA;IACT,6DAA6D;IAC7D,+EAAU,CAAA;IACV,mHAAmH;IACnH,iFAAW,CAAA;IACX,8EAAU,CAAA;AACZ,CAAC,EARW,0BAA0B,KAA1B,0BAA0B,QAQrC;AAED,oEAAoE;AACpE,MAAM,CAAN,IAAY,eAOX;AAPD,WAAY,eAAe;IACzB,yDAAU,CAAA;IACV,uFAAuF;IACvF,qDAAQ,CAAA;IACR,yDAAU,CAAA;IACV,yDAAU,CAAA;IACV,wDAAU,CAAA;AACZ,CAAC,EAPW,eAAe,KAAf,eAAe,QAO1B;AAED,yEAAyE;AACzE,MAAM,CAAN,IAAY,4BAiBX;AAjBD,WAAY,4BAA4B;IACtC,mFAAU,CAAA;IACV,+EAAQ,CAAA;IACR,mFAAU,CAAA;IACV,mFAAU,CAAA;IACV,+EAAQ,CAAA;IACR,sEAAsE;IACtE,mFAAU,CAAA;IACV,uFAAY,CAAA;IACZ,mFAAU,CAAA;IACV,qFAAW,CAAA;IACX,wFAAa,CAAA;IACb,4FAAe,CAAA;IACf,sFAAY,CAAA;IACZ,2GAA2G;IAC3G,oFAAW,CAAA;IACX,kFAAU,CAAA;AACZ,CAAC,EAjBW,4BAA4B,KAA5B,4BAA4B,QAiBvC;AAED,uEAAuE;AACvE,MAAM,CAAN,IAAY,0BAqBX;AArBD,WAAY,0BAA0B;IACpC,+EAAU,CAAA;IACV,+EAAU,CAAA;IACV,+EAAU,CAAA;IACV,+EAAU,CAAA;IACV,iFAAW,CAAA;IACX,2EAAQ,CAAA;IACR,+EAAU,CAAA;IACV,iGAAmB,CAAA;IACnB,+FAAkB,CAAA;IAClB,kGAAoB,CAAA;IACpB,kGAAoB,CAAA;IACpB,wGAAuB,CAAA;IACvB,0GAAwB,CAAA;IACxB,sGAAsB,CAAA;IACtB,sGAAsB,CAAA;IACtB,4FAAiB,CAAA;IACjB,4FAAiB,CAAA;IACjB,4HAAiC,CAAA;IACjC,kIAAoC,CAAA;IACpC,8EAAU,CAAA;AACZ,CAAC,EArBW,0BAA0B,KAA1B,0BAA0B,QAqBrC;AAED;;;;;;GAMG;AACH,MAAM,6BAA6B,GAAwD;IACzF,CAAC,YAAY,CAAC,cAAc,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,0BAA0B,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;IACnI,CAAC,YAAY,CAAC,YAAY,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;IACtH,CAAC,YAAY,CAAC,iBAAiB,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,4BAA4B,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;IACxI,CAAC,YAAY,CAAC,eAAe,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,0BAA0B,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;CACrI,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAqD;IAE3F,uBAAuB;IACvB,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAChF,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAC9E,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAC/E,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IACpF,CAAC,sBAAsB,CAAC,0BAA0B,CAAC,EAAE,0BAA0B,CAAC,KAAK;IACrF,CAAC,sBAAsB,CAAC,+BAA+B,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAC1F,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAChF,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAC9E,uGAAuG;IACvG,8GAA8G;IAC9G,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,0BAA0B,CAAC,MAAM;IACrF,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAChF,CAAC,sBAAsB,CAAC,uBAAuB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAClF,mGAAmG;IACnG,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAChF,CAAC,sBAAsB,CAAC,8BAA8B,CAAC,EAAE,0BAA0B,CAAC,KAAK;IACzF,8FAA8F;IAC9F,6FAA6F;IAC7F,4FAA4F;IAC5F,CAAC,sBAAsB,CAAC,2BAA2B,CAAC,EAAE,0BAA0B,CAAC,KAAK;IACtF,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAC5E,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAC/E,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAC7E,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,0BAA0B,CAAC,MAAM;IAC9E,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,0BAA0B,CAAC,MAAM;IAC9E,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,0BAA0B,CAAC,KAAK,EAAE,sFAAsF;IACtK,CAAC,sBAAsB,CAAC,kCAAkC,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAC7F,CAAC,sBAAsB,CAAC,0BAA0B,CAAC,EAAE,0BAA0B,CAAC,KAAK;IACrF,CAAC,sBAAsB,CAAC,UAAU,CAAC,EAAE,0BAA0B,CAAC,KAAK;IACrE,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAC5E,CAAC,sBAAsB,CAAC,WAAW,CAAC,EAAE,0BAA0B,CAAC,MAAM;IACvE,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IACjF,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,0BAA0B,CAAC,OAAO;IACjF,CAAC,sBAAsB,CAAC,wBAAwB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IACnF,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,EAAE,0BAA0B,CAAC,KAAK,EAAE,sGAAsG;IACpL,CAAC,sBAAsB,CAAC,uBAAuB,CAAC,EAAE,0BAA0B,CAAC,OAAO;IACpF,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,EAAE,0BAA0B,CAAC,KAAK,EAAE,qGAAqG;IAClL,CAAC,sBAAsB,CAAC,wBAAwB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IACnF,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IACjF,CAAC,sBAAsB,CAAC,mCAAmC,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAC9F,CAAC,sBAAsB,CAAC,mCAAmC,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAC9F,CAAC,sBAAsB,CAAC,4BAA4B,CAAC,EAAE,0BAA0B,CAAC,KAAK;IACvF,CAAC,sBAAsB,CAAC,uBAAuB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAClF,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAC/E,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,0BAA0B,CAAC,KAAK,EAAE,iGAAiG;IACnL,CAAC,sBAAsB,CAAC,6BAA6B,CAAC,EAAE,0BAA0B,CAAC,KAAK,EAAE,gGAAgG;IAC1L,CAAC,sBAAsB,CAAC,0BAA0B,CAAC,EAAE,0BAA0B,CAAC,KAAK,EAAE,gGAAgG;IACvL,CAAC,sBAAsB,CAAC,6BAA6B,CAAC,EAAE,0BAA0B,CAAC,KAAK;IACxF,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAC5E,CAAC,sBAAsB,CAAC,iCAAiC,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAC5F,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,0BAA0B,CAAC,MAAM;IAChF;;;;;OAKG;IACH,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,0BAA0B,CAAC,MAAM;IAChF,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAC9E,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,EAAE,0BAA0B,CAAC,OAAO;IAC9E,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAChF,CAAC,sBAAsB,CAAC,4BAA4B,CAAC,EAAE,0BAA0B,CAAC,KAAK;IACvF,CAAC,sBAAsB,CAAC,cAAc,CAAC,EAAE,0BAA0B,CAAC,KAAK;IACzE,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAChF,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAC/E,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAE7E,sBAAsB;IACtB,oGAAoG;IACpG,0CAA0C;IAC1C,CAAC,sBAAsB,CAAC,wBAAwB,CAAC,EAAE,eAAe,CAAC,KAAK;IACxE,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,eAAe,CAAC,KAAK;IACzE,CAAC,sBAAsB,CAAC,sCAAsC,CAAC,EAAE,eAAe,CAAC,KAAK;IACtF,CAAC,sBAAsB,CAAC,kCAAkC,CAAC,EAAE,eAAe,CAAC,KAAK;IAClF,CAAC,sBAAsB,CAAC,uBAAuB,CAAC,EAAE,eAAe,CAAC,KAAK;IACvE,CAAC,sBAAsB,CAAC,+BAA+B,CAAC,EAAE,eAAe,CAAC,KAAK;IAC/E,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,eAAe,CAAC,KAAK;IACpE,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,eAAe,CAAC,KAAK;IACrE,CAAC,sBAAsB,CAAC,6BAA6B,CAAC,EAAE,eAAe,CAAC,KAAK;IAC7E,CAAC,sBAAsB,CAAC,4BAA4B,CAAC,EAAE,eAAe,CAAC,KAAK;IAC5E,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,EAAE,eAAe,CAAC,KAAK,EAAE,8CAA8C;IAChI,CAAC,sBAAsB,CAAC,iCAAiC,CAAC,EAAE,eAAe,CAAC,KAAK;IACjF,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,EAAE,eAAe,CAAC,KAAK;IAChF,CAAC,sBAAsB,CAAC,qCAAqC,CAAC,EAAE,eAAe,CAAC,KAAK;IACrF,CAAC,sBAAsB,CAAC,+BAA+B,CAAC,EAAE,eAAe,CAAC,KAAK;IAC/E,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,eAAe,CAAC,KAAK,EAAE,mFAAmF;IAC9J,CAAC,sBAAsB,CAAC,4BAA4B,CAAC,EAAE,eAAe,CAAC,KAAK,EAAE,mFAAmF;IACjK,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,EAAE,eAAe,CAAC,KAAK,EAAE,8CAA8C;IAEtH,oBAAoB;IACpB,CAAC,sBAAsB,CAAC,YAAY,CAAC,EAAE,eAAe,CAAC,IAAI;IAC3D,oGAAoG;IACpG,oFAAoF;IACpF,CAAC,sBAAsB,CAAC,0BAA0B,CAAC,EAAE,eAAe,CAAC,MAAM;IAC3E,mGAAmG;IACnG,kGAAkG;IAClG,uFAAuF;IACvF,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,eAAe,CAAC,KAAK;IACrE,CAAC,sBAAsB,CAAC,wBAAwB,CAAC,EAAE,eAAe,CAAC,KAAK;IACxE,CAAC,sBAAsB,CAAC,cAAc,CAAC,EAAE,eAAe,CAAC,KAAK,EAAE,sEAAsE;IACtI,8FAA8F;IAC9F,gGAAgG;IAChG,8CAA8C;IAC9C,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,eAAe,CAAC,IAAI;IACxE,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,eAAe,CAAC,IAAI;IACnE,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,eAAe,CAAC,IAAI;IAClE,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,EAAE,eAAe,CAAC,IAAI;IACrE,CAAC,sBAAsB,CAAC,4BAA4B,CAAC,EAAE,eAAe,CAAC,IAAI;IAC3E,gGAAgG;IAChG,gGAAgG;IAChG,mGAAmG;IACnG,6FAA6F;IAC7F,6FAA6F;IAC7F,CAAC,sBAAsB,CAAC,uBAAuB,CAAC,EAAE,eAAe,CAAC,KAAK;IACvE,2FAA2F;IAC3F,iGAAiG;IACjG,kGAAkG;IAClG,8FAA8F;IAC9F,WAAW;IACX,CAAC,sBAAsB,CAAC,aAAa,CAAC,EAAE,eAAe,CAAC,KAAK;IAC7D,iGAAiG;IACjG,gGAAgG;IAChG,gGAAgG;IAChG,qDAAqD;IACrD,CAAC,sBAAsB,CAAC,4BAA4B,CAAC,EAAE,eAAe,CAAC,KAAK;IAC5E,6EAA6E;IAC7E,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,eAAe,CAAC,MAAM;IAC1E,iFAAiF;IACjF,CAAC,sBAAsB,CAAC,iCAAiC,CAAC,EAAE,eAAe,CAAC,KAAK;IACjF,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,eAAe,CAAC,IAAI;IAClE,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,eAAe,CAAC,KAAK,EAAE,uGAAuG;IAE7K,uBAAuB;IACvB,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,EAAE,4BAA4B,CAAC,MAAM;IACpF,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,4BAA4B,CAAC,MAAM;IAClF,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,4BAA4B,CAAC,MAAM;IAClF,CAAC,sBAAsB,CAAC,+BAA+B,CAAC,EAAE,4BAA4B,CAAC,KAAK,EAAE,+FAA+F;IAC7L,CAAC,sBAAsB,CAAC,2BAA2B,CAAC,EAAE,4BAA4B,CAAC,MAAM;IACzF,CAAC,sBAAsB,CAAC,0BAA0B,CAAC,EAAE,4BAA4B,CAAC,MAAM;IACxF,CAAC,sBAAsB,CAAC,2BAA2B,CAAC,EAAE,4BAA4B,CAAC,QAAQ;IAC3F,CAAC,sBAAsB,CAAC,kCAAkC,CAAC,EAAE,4BAA4B,CAAC,MAAM;IAChG,CAAC,sBAAsB,CAAC,2BAA2B,CAAC,EAAE,4BAA4B,CAAC,MAAM;IACzF,CAAC,sBAAsB,CAAC,kCAAkC,CAAC,EAAE,4BAA4B,CAAC,MAAM;IAChG,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,EAAE,4BAA4B,CAAC,MAAM;IAC9F,CAAC,sBAAsB,CAAC,4BAA4B,CAAC,EAAE,4BAA4B,CAAC,MAAM;IAC1F,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,4BAA4B,CAAC,KAAK,EAAE,uGAAuG;IAC3L,CAAC,sBAAsB,CAAC,mCAAmC,CAAC,EAAE,4BAA4B,CAAC,MAAM;IACjG,4FAA4F;IAC5F,gGAAgG;IAChG,iFAAiF;IACjF,CAAC,sBAAsB,CAAC,oCAAoC,CAAC,EAAE,4BAA4B,CAAC,MAAM;IAClG,CAAC,sBAAsB,CAAC,wCAAwC,CAAC,EAAE,4BAA4B,CAAC,MAAM;IACtG,kGAAkG;IAClG,iGAAiG;IACjG,iGAAiG;IACjG,CAAC,sBAAsB,CAAC,qCAAqC,CAAC,EAAE,4BAA4B,CAAC,IAAI;IACjG,CAAC,sBAAsB,CAAC,wCAAwC,CAAC,EAAE,4BAA4B,CAAC,MAAM;IACtG,mGAAmG;IACnG,kGAAkG;IAClG,+FAA+F;IAC/F,mDAAmD;IACnD,CAAC,sBAAsB,CAAC,4BAA4B,CAAC,EAAE,4BAA4B,CAAC,MAAM;IAC1F,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,EAAE,4BAA4B,CAAC,MAAM;IAC9F,CAAC,sBAAsB,CAAC,6BAA6B,CAAC,EAAE,4BAA4B,CAAC,IAAI;IACzF,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,EAAE,4BAA4B,CAAC,MAAM;IAC9F,kGAAkG;IAClG,mGAAmG;IACnG,iGAAiG;IACjG,gGAAgG;IAChG,kDAAkD;IAClD,CAAC,sBAAsB,CAAC,wCAAwC,CAAC,EAAE,4BAA4B,CAAC,MAAM;IACtG,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,EAAE,4BAA4B,CAAC,MAAM;IAC9F,CAAC,sBAAsB,CAAC,sCAAsC,CAAC,EAAE,4BAA4B,CAAC,MAAM;IACpG,iGAAiG;IACjG,iGAAiG;IACjG,kEAAkE;IAClE,CAAC,sBAAsB,CAAC,+BAA+B,CAAC,EAAE,4BAA4B,CAAC,MAAM;IAC7F,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,EAAE,4BAA4B,CAAC,OAAO;IACrF,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,4BAA4B,CAAC,MAAM;IACvF,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,4BAA4B,CAAC,MAAM;IAClF,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,4BAA4B,CAAC,KAAK;IAC/E,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,4BAA4B,CAAC,KAAK;IACjF,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,EAAE,4BAA4B,CAAC,MAAM;IAC9F,CAAC,sBAAsB,CAAC,wBAAwB,CAAC,EAAE,4BAA4B,CAAC,KAAK;IACrF,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,4BAA4B,CAAC,MAAM;IAChF,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,4BAA4B,CAAC,MAAM;IAClF,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,4BAA4B,CAAC,MAAM;IAChF,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,4BAA4B,CAAC,MAAM;IAChF,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,EAAE,4BAA4B,CAAC,KAAK;IAE7F,uBAAuB;IACvB,CAAC,sBAAsB,CAAC,oCAAoC,CAAC,EAAE,0BAA0B,CAAC,KAAK;IAC/F,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,0BAA0B,CAAC,MAAM;IAC9E,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,0BAA0B,CAAC,OAAO;IAClF,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,0BAA0B,CAAC,MAAM;IACjF,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,EAAE,0BAA0B,CAAC,MAAM;IAC7E,CAAC,sBAAsB,CAAC,YAAY,CAAC,EAAE,0BAA0B,CAAC,MAAM;IACxE,CAAC,sBAAsB,CAAC,YAAY,CAAC,EAAE,0BAA0B,CAAC,MAAM;IACxE,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,0BAA0B,CAAC,MAAM;IAC/E,CAAC,sBAAsB,CAAC,8BAA8B,CAAC,EAAE,0BAA0B,CAAC,KAAK;IACzF,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,0BAA0B,CAAC,MAAM;IAC/E,CAAC,sBAAsB,CAAC,eAAe,CAAC,EAAE,0BAA0B,CAAC,MAAM;IAC3E,CAAC,sBAAsB,CAAC,YAAY,CAAC,EAAE,0BAA0B,CAAC,MAAM;IACxE,CAAC,sBAAsB,CAAC,8BAA8B,CAAC,EAAE,0BAA0B,CAAC,KAAK;CAC1F,CAAC;AAEF;;;;;;GAMG;AACH,SAAS,kCAAkC;IACzC,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,KAAK,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,2BAA2B,CAAC,EAAE,CAAC;QAClF,MAAM,QAAQ,GAAG,2BAA2B,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC;QACjE,MAAM,UAAU,GAAG,4BAA4B,CAAC,QAA8B,CAAC,CAAC;QAChF,IAAI,CAAC,6BAA6B,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACxE,SAAS,CAAC,IAAI,CAAC,GAAG,SAAS,eAAe,UAAU,8BAA8B,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC3G,CAAC;IACH,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,6EAA6E,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACzH,CAAC;AACH,CAAC;AACD,kCAAkC,EAAE,CAAC;AAErC;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,SAAiB;IACrD,OAAO,2BAA2B,CAAC,SAAmC,CAAC,IAAI,kBAAkB,CAAC,OAAO,CAAC;AACxG,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,uBAAuB,CAAC,UAAkB,EAAE,SAAiB;IAC3E,OAAO,UAAU,KAAK,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AACzE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,kBAeX;AAfD,WAAY,kBAAkB;IAC5B,iEAAW,CAAA;IACX,2DAAQ,CAAA;IACR,mEAAY,CAAA;IACZ,+DAAU,CAAA;IACV,+DAAU,CAAA;IACV,2DAAQ,CAAA;IACR,qEAAa,CAAA;IACb,yDAAO,CAAA;IACP,2DAAQ,CAAA;IACR,yDAAO,CAAA;IACP,gEAAW,CAAA;IACX,4FAAyB,CAAA;IACzB,4DAAS,CAAA;IACT,8DAAU,CAAA;AACZ,CAAC,EAfW,kBAAkB,KAAlB,kBAAkB,QAe7B;AAED,sGAAsG;AACtG,MAAM,0BAA0B,GAAiD;IAC/E,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,SAAS;IACvC,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,MAAM;IACjC,CAAC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,UAAU;IACzC,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,QAAQ;IACrC,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,QAAQ;IACrC,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,MAAM;IACjC,CAAC,kBAAkB,CAAC,SAAS,CAAC,EAAE,WAAW;IAC3C,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,KAAK;IAC/B,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,MAAM;IACjC,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,KAAK;IAC/B,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,QAAQ;IACrC,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,EAAE,sBAAsB;IACjE,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,MAAM;IACjC,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,OAAO;CACpC,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,MAAM,iCAAiC,GAA8D;IACnG,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,kBAAkB,CAAC,IAAI;IAC9C,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC,MAAM;IAC1D,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,kBAAkB,CAAC,SAAS;CAC3D,CAAC;AAQF;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,uBAAuB,CAAC,UAAkB;IACxD,MAAM,UAAU,GAAG,iCAAiC,CAAC,UAAwB,CAAC,CAAC;IAC/E,OAAO,UAAU,KAAK,SAAS;QAC7B,CAAC,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,kBAAkB,CAAC,KAAK,EAAE;QAChE,CAAC,CAAC,EAAE,QAAQ,EAAE,0BAA0B,CAAC,UAAU,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;AACnF,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,mCAAmC,GAA6D;IACpG,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC,MAAM;IACtD,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE,eAAe,CAAC,MAAM;IAC3D,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,eAAe,CAAC,IAAI;IAClD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,eAAe,CAAC,IAAI;IAClD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC,IAAI;IACpD,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE,eAAe,CAAC,IAAI;IACnD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC,MAAM;IACtD,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE,eAAe,CAAC,MAAM;IAC3D,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC,MAAM;IACtD,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE,eAAe,CAAC,MAAM;CAC5D,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,6BAA6B,GAAG,CAAC,uBAAuB,EAAE,qBAAqB,EAAE,WAAW,CAAU,CAAC;AAE7G;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,qBAAqB,CAAC,SAAkB,EAAE,QAAgB;IACxE,IAAI,SAAS,KAAK,IAAI,IAAI,OAAO,SAAS,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IACzE,MAAM,MAAM,GAAG,SAA8C,CAAC;IAC9D,KAAK,MAAM,GAAG,IAAI,6BAA6B,EAAE,CAAC;QAChD,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,OAAO,SAAS,KAAK,QAAQ;YAAE,SAAS;QAC5C,MAAM,MAAM,GAAG,mCAAmC,CAAC,SAAkC,CAAC,CAAC;QACvF,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC;IAC1C,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["/**\n * OCSF `activity_id` — the normalised verb, resolved per Wildo audit event type.\n *\n * Until this table existed every OCSF document we emitted carried `activity_id: 0` (Unknown), which\n * also pinned `type_uid` to `class_uid * 100`. That is the single largest fidelity loss in the OCSF\n * projection: `activity_id` is the axis OCSF uses to separate events WITHIN a class, so collapsing it\n * makes a logon indistinguishable from a logoff to any consumer that groups by `type_uid`.\n *\n * ## Three values, three different claims\n *\n * | Value | Means | When we use it |\n * |---|---|---|\n * | a specific member | the published description matches this event | the description matched — never the caption alone |\n * | `OTHER` (99) | in the class's domain, absent from its enum | with `activity_name` carrying our event type, which is what the schema asks for |\n * | `UNKNOWN` (0) | we cannot say | application-defined event types the engine cannot enumerate |\n *\n * `OTHER` is not a shrug. The schema defines it as \"the event activity is not mapped. See the\n * `activity_name` attribute, which contains a data source specific value\" — so it is a positive\n * statement plus an obligation, and it strictly beats `UNKNOWN` for any event we understand.\n *\n * ## Read descriptions, not captions\n *\n * Authentication's `Authentication Ticket` (3), `Service Ticket Request` (4) and `Service Ticket\n * Renew` (5) read like a natural home for OAuth token issuance and refresh. Their descriptions are\n * explicitly **Kerberos** (\"A Kerberos service ticket was renewed\"), so every OAuth token event here\n * is `OTHER` instead. Mapping those from the captions would have been a fabrication that validated\n * perfectly.\n *\n * ## A structural observation, deliberately NOT acted on here\n *\n * A Wildo event's audit CATEGORY selects the OCSF class, and for several events the natural activity\n * exists in a DIFFERENT class than the category picks: `USER_PASSWORD_CHANGED`, `USER_MFA_ENABLED`,\n * `USER_ACCOUNT_LOCKED` and friends are `AUTHENTICATION` (class 3002), while `Password Change` (8),\n * `Enable MFA Factors` (12) and `Lock` (6) are published by `user_management` (3007). Those rows are\n * `OTHER` with the mismatch named on each. Re-categorising them would change SIEM category filtering\n * for existing tenants, so it is a product decision, not a mapping fix.\n *\n * spec-cite: OCSF schema 1.9.0 — `schema.ocsf.io/api/1.9.0/classes/{authentication,api_activity,\n * entity_management,user_management}`, the `activity_id` enum and `activity_name` attribute of each.\n */\n\nimport { AuditEventCategory, AuthMethod, CoreAuditableEventType, CoreResourceOperation, getAuditEventClassification } from '@wildo-ai/saas-models';\nimport { OCSF_CLASS_BY_AUDIT_CATEGORY, OcsfClassUid } from './ocsf-class-mapping.backend.utils';\n\n/** `0` and `99` mean the same thing in every OCSF class, so they are named once. */\nexport enum OcsfCommonActivity {\n  /** \"The event activity is unknown.\" */\n  UNKNOWN = 0,\n  /** \"The event activity is not mapped. See the `activity_name` attribute…\" */\n  OTHER = 99,\n}\n\n/** Published `activity_id` members of class 3002 (authentication). */\nexport enum OcsfAuthenticationActivity {\n  /** \"A new logon session was requested.\" Includes FAILED attempts — the verb is the request; the outcome rides `status_id`. */\n  LOGON = 1,\n  /** \"A logon session was terminated and no longer exists.\" */\n  LOGOFF = 2,\n  /** \"A preauthentication stage was engaged.\" Covers issuing an OTP or magic link: a stage BEFORE authentication. */\n  PREAUTH = 6,\n  OTHER = 99,\n}\n\n/** Published `activity_id` members of class 6003 (api_activity). */\nexport enum OcsfApiActivity {\n  CREATE = 1,\n  /** \"Read\" — the only CRUD verb our authorization/data-access events reliably carry. */\n  READ = 2,\n  UPDATE = 3,\n  DELETE = 4,\n  OTHER = 99,\n}\n\n/** Published `activity_id` members of class 3004 (entity_management). */\nexport enum OcsfEntityManagementActivity {\n  CREATE = 1,\n  READ = 2,\n  UPDATE = 3,\n  DELETE = 4,\n  MOVE = 5,\n  /** \"Enroll an existing managed entity.\" A member joining a tenant. */\n  ENROLL = 6,\n  UNENROLL = 7,\n  ENABLE = 8,\n  DISABLE = 9,\n  ACTIVATE = 10,\n  DEACTIVATE = 11,\n  SUSPEND = 12,\n  /** \"Resume (unsuspend) an existing managed entity.\" SUSPENDED is the only state our activate runs from. */\n  RESUME = 13,\n  OTHER = 99,\n}\n\n/** Published `activity_id` members of class 3007 (user_management). */\nexport enum OcsfUserManagementActivity {\n  CREATE = 1,\n  UPDATE = 2,\n  DELETE = 3,\n  ENABLE = 4,\n  DISABLE = 5,\n  LOCK = 6,\n  UNLOCK = 7,\n  PASSWORD_CHANGE = 8,\n  PASSWORD_RESET = 9,\n  ATTACH_POLICIES = 10,\n  DETACH_POLICIES = 11,\n  ENABLE_MFA_FACTORS = 12,\n  DISABLE_MFA_FACTORS = 13,\n  ASSIGN_PRIVILEGES = 14,\n  REMOVE_PRIVILEGES = 15,\n  ASSIGN_ROLES = 16,\n  REMOVE_ROLES = 17,\n  ADD_PROGRAMMATIC_CREDENTIALS = 18,\n  REMOVE_PROGRAMMATIC_CREDENTIALS = 19,\n  OTHER = 99,\n}\n\n/**\n * Every published activity id, per class — the membership check's source of truth.\n *\n * An activity number is only meaningful WITH its class: `1` is `Logon` in 3002 and `Create` in 6003.\n * So a row that assigns the right number under the wrong class is silently wrong, and nothing about\n * the emitted document would look malformed. {@link assertActivitiesBelongToTheirClass} closes that.\n */\nconst PUBLISHED_ACTIVITIES_BY_CLASS: Readonly<Record<OcsfClassUid, ReadonlySet<number>>> = {\n  [OcsfClassUid.AUTHENTICATION]: new Set(Object.values(OcsfAuthenticationActivity).filter((v): v is number => typeof v === 'number')),\n  [OcsfClassUid.API_ACTIVITY]: new Set(Object.values(OcsfApiActivity).filter((v): v is number => typeof v === 'number')),\n  [OcsfClassUid.ENTITY_MANAGEMENT]: new Set(Object.values(OcsfEntityManagementActivity).filter((v): v is number => typeof v === 'number')),\n  [OcsfClassUid.USER_MANAGEMENT]: new Set(Object.values(OcsfUserManagementActivity).filter((v): v is number => typeof v === 'number')),\n};\n\n/**\n * The activity each core audit event resolves to.\n *\n * **Total over `CoreAuditableEventType`**, so a new core event type cannot be added without deciding\n * its activity — the same shape the classification map now has, and for the same reason: an open set\n * silently defaulting is how `activity_id` stayed `Unknown` for every event in the first place.\n */\nexport const OCSF_ACTIVITY_BY_EVENT_TYPE: Readonly<Record<CoreAuditableEventType, number>> = {\n\n  // ── AUTHENTICATION ──\n  [CoreAuditableEventType.EMERGENCY_ACCESS_USED]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.MACHINE_AUTH_FAILED]: OcsfAuthenticationActivity.LOGON,\n  [CoreAuditableEventType.MACHINE_AUTH_SUCCESS]: OcsfAuthenticationActivity.LOGON,\n  [CoreAuditableEventType.OAUTH_CIMD_CLIENT_REFUSED]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.OAUTH_CODE_EXCHANGE_FAILED]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.OAUTH_DYNAMIC_CLIENT_REGISTERED]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.OAUTH_TOKEN_REFRESHED]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.OAUTH_TOKEN_REVOKED]: OcsfAuthenticationActivity.OTHER,\n  // Unlike the token-revoke sibling above (a no-oracle RFC 7009 ATTEMPT → Other), an RP-Initiated Logout\n  // terminates a real user SESSION, so it is a genuine OCSF Logoff — matching USER_LOGOUT / SAML_SLO_COMPLETED.\n  [CoreAuditableEventType.OAUTH_RP_INITIATED_LOGOUT]: OcsfAuthenticationActivity.LOGOFF,\n  [CoreAuditableEventType.ONE_OFF_TOKEN_CREATED]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.ONE_OFF_TOKEN_EXCHANGED]: OcsfAuthenticationActivity.OTHER,\n  // Admin token-lifecycle, not an OCSF user LOGOFF — Other(99) + activity_name, matching the family.\n  [CoreAuditableEventType.ONE_OFF_TOKEN_REVOKED]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.SAML_ASSERTION_REPLAY_DETECTED]: OcsfAuthenticationActivity.OTHER,\n  // A refused enterprise OIDC login: the provider did not report the authentication context the\n  // connection demanded (`acr`). A logon attempt that failed its step-up, so Logon(1) like the\n  // SAML and SSO failures beside it, not Other(99) like the OAuth CLIENT-side refusals above.\n  [CoreAuditableEventType.OIDC_ACR_DEMAND_UNSATISFIED]: OcsfAuthenticationActivity.LOGON,\n  [CoreAuditableEventType.SAML_LOGIN_FAILED]: OcsfAuthenticationActivity.LOGON,\n  [CoreAuditableEventType.SAML_LOGIN_INITIATED]: OcsfAuthenticationActivity.LOGON,\n  [CoreAuditableEventType.SAML_LOGIN_SUCCESS]: OcsfAuthenticationActivity.LOGON,\n  [CoreAuditableEventType.SAML_SLO_COMPLETED]: OcsfAuthenticationActivity.LOGOFF,\n  [CoreAuditableEventType.SAML_SLO_INITIATED]: OcsfAuthenticationActivity.LOGOFF,\n  [CoreAuditableEventType.USER_ACCOUNT_LOCKED]: OcsfAuthenticationActivity.OTHER, // 3007 publishes Lock(6), but this event's category routes it to 3002, which does not\n  [CoreAuditableEventType.USER_CROSS_FRONTEND_HANDOFF_ISSUED]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.USER_IDENTITY_LINK_REMOVED]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.USER_LOGIN]: OcsfAuthenticationActivity.LOGON,\n  [CoreAuditableEventType.USER_LOGIN_FAILED]: OcsfAuthenticationActivity.LOGON,\n  [CoreAuditableEventType.USER_LOGOUT]: OcsfAuthenticationActivity.LOGOFF,\n  [CoreAuditableEventType.USER_MAGIC_LINK_FAILED]: OcsfAuthenticationActivity.LOGON,\n  [CoreAuditableEventType.USER_MAGIC_LINK_SENT]: OcsfAuthenticationActivity.PREAUTH,\n  [CoreAuditableEventType.USER_MAGIC_LINK_VERIFIED]: OcsfAuthenticationActivity.LOGON,\n  [CoreAuditableEventType.USER_MFA_DISABLED]: OcsfAuthenticationActivity.OTHER, // 3007 publishes Disable MFA Factors(13), but this event's category routes it to 3002, which does not\n  [CoreAuditableEventType.USER_MFA_EMAIL_OTP_SENT]: OcsfAuthenticationActivity.PREAUTH,\n  [CoreAuditableEventType.USER_MFA_ENABLED]: OcsfAuthenticationActivity.OTHER, // 3007 publishes Enable MFA Factors(12), but this event's category routes it to 3002, which does not\n  [CoreAuditableEventType.USER_MFA_SETUP_COMPLETED]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.USER_MFA_SETUP_STARTED]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.USER_PASSKEY_AUTHENTICATION_FAILURE]: OcsfAuthenticationActivity.LOGON,\n  [CoreAuditableEventType.USER_PASSKEY_AUTHENTICATION_SUCCESS]: OcsfAuthenticationActivity.LOGON,\n  [CoreAuditableEventType.USER_PASSKEY_CLONE_SUSPECTED]: OcsfAuthenticationActivity.LOGON,\n  [CoreAuditableEventType.USER_PASSKEY_REGISTERED]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.USER_PASSKEY_REMOVED]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.USER_PASSWORD_CHANGED]: OcsfAuthenticationActivity.OTHER, // 3007 publishes Password Change(8), but this event's category routes it to 3002, which does not\n  [CoreAuditableEventType.USER_PASSWORD_RESET_COMPLETED]: OcsfAuthenticationActivity.OTHER, // 3007 publishes Password Reset(9), but this event's category routes it to 3002, which does not\n  [CoreAuditableEventType.USER_PASSWORD_RESET_FORCED]: OcsfAuthenticationActivity.OTHER, // 3007 publishes Password Reset(9), but this event's category routes it to 3002, which does not\n  [CoreAuditableEventType.USER_PASSWORD_RESET_REQUESTED]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.USER_PASSWORD_SET]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.USER_REFRESH_TOKEN_REUSE_DETECTED]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.USER_SESSION_EXPIRED]: OcsfAuthenticationActivity.LOGOFF,\n  /*\n   * LOGOFF, like the expiry above: the session is terminated and no longer exists, which is what the\n   * OCSF verb states. The DIFFERENCE between the two — time elapsed versus a cap displacing a live\n   * chain — is not expressible in `activity_id`, so it rides the typed eventData and the WARNING\n   * severity instead. Mapping it to OTHER would have lost the one thing a SIEM correlates on.\n   */\n  [CoreAuditableEventType.USER_SESSION_EVICTED]: OcsfAuthenticationActivity.LOGOFF,\n  [CoreAuditableEventType.USER_SMS_OTP_FAILED]: OcsfAuthenticationActivity.LOGON,\n  [CoreAuditableEventType.USER_SMS_OTP_SENT]: OcsfAuthenticationActivity.PREAUTH,\n  [CoreAuditableEventType.USER_SMS_OTP_VERIFIED]: OcsfAuthenticationActivity.LOGON,\n  [CoreAuditableEventType.USER_SSO_ENFORCEMENT_BLOCKED]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.USER_SSO_LOGIN]: OcsfAuthenticationActivity.LOGON,\n  [CoreAuditableEventType.USER_SSO_LOGIN_FAILED]: OcsfAuthenticationActivity.LOGON,\n  [CoreAuditableEventType.USER_TOKEN_REFRESHED]: OcsfAuthenticationActivity.OTHER,\n  [CoreAuditableEventType.USER_TOTP_DISABLED]: OcsfAuthenticationActivity.OTHER,\n\n  // ── AUTHORIZATION ──\n  // A file upload grant delegates one upload under the minter's authority; issuing/revoking it is not\n  // one of 6003's CRUD verbs on a resource.\n  [CoreAuditableEventType.FILE_UPLOAD_GRANT_ISSUED]: OcsfApiActivity.OTHER,\n  [CoreAuditableEventType.FILE_UPLOAD_GRANT_REVOKED]: OcsfApiActivity.OTHER,\n  [CoreAuditableEventType.APPLICATION_SUPER_ADMIN_FLOOR_BREACHED]: OcsfApiActivity.OTHER,\n  [CoreAuditableEventType.CROSS_TENANT_ADMINISTRATIVE_ACCESS]: OcsfApiActivity.OTHER,\n  [CoreAuditableEventType.OAUTH2_PROVIDER_BLOCKED]: OcsfApiActivity.OTHER,\n  [CoreAuditableEventType.OAUTH_CONSENT_BINDING_VIOLATION]: OcsfApiActivity.OTHER,\n  [CoreAuditableEventType.OAUTH_CONSENT_DENIED]: OcsfApiActivity.OTHER,\n  [CoreAuditableEventType.OAUTH_CONSENT_GRANTED]: OcsfApiActivity.OTHER,\n  [CoreAuditableEventType.OAUTH_CONSENT_GRANT_PERSISTED]: OcsfApiActivity.OTHER,\n  [CoreAuditableEventType.OAUTH_DELEGATED_TOKEN_ISSUED]: OcsfApiActivity.OTHER,\n  [CoreAuditableEventType.ORGANIZATION_MEMBER_ROLE_CHANGED]: OcsfApiActivity.OTHER, // a role change is not one of 6003 CRUD verbs\n  [CoreAuditableEventType.ORGANIZATION_OWNER_FLOOR_BREACHED]: OcsfApiActivity.OTHER,\n  [CoreAuditableEventType.ORGANIZATION_UNIT_MEMBER_REMOVED]: OcsfApiActivity.OTHER,\n  [CoreAuditableEventType.ORGANIZATION_UNIT_MEMBER_ROLE_CHANGED]: OcsfApiActivity.OTHER,\n  [CoreAuditableEventType.PLATFORM_ACCESS_GRANT_LIFECYCLE]: OcsfApiActivity.OTHER,\n  [CoreAuditableEventType.RESOURCE_OPERATION_DENIED]: OcsfApiActivity.OTHER, // the CRUD verb is runtime data (the operation), not derivable from the event type\n  [CoreAuditableEventType.RESOURCE_OPERATION_PERFORMED]: OcsfApiActivity.OTHER, // the CRUD verb is runtime data (the operation), not derivable from the event type\n  [CoreAuditableEventType.USER_APP_ROLES_CHANGED]: OcsfApiActivity.OTHER, // a role change is not one of 6003 CRUD verbs\n\n  // ── DATA_ACCESS ──\n  [CoreAuditableEventType.FIELD_ACCESS]: OcsfApiActivity.READ,\n  // CREATE, not OTHER: redeeming a grant IS the creation of one FILES row — the one DATA_ACCESS event\n  // whose CRUD verb is derivable from the type, like PLATFORM_DIRECTORY_ACCESS below.\n  [CoreAuditableEventType.FILE_UPLOAD_GRANT_REDEEMED]: OcsfApiActivity.CREATE,\n  // OTHER for both (#506): a scan CONCLUSION is not one of 6003's CRUD verbs on a resource. The file\n  // row is updated as a consequence, but the event names the finding, not the write — mapping it to\n  // UPDATE would tell a SIEM that a record was modified and lose that malware was found.\n  [CoreAuditableEventType.FILE_MALWARE_DETECTED]: OcsfApiActivity.OTHER,\n  [CoreAuditableEventType.FILE_MALWARE_SCAN_FAILED]: OcsfApiActivity.OTHER,\n  [CoreAuditableEventType.MACHINE_ACCESS]: OcsfApiActivity.OTHER, // names a surface reach (A2A/MCP turn), not a CRUD verb on a resource\n  // READ, not OTHER: enumerating a directory IS a read of resource rows, and it is the one case\n  // where the CRUD verb IS derivable from the event type — the event only ever names a collection\n  // read (list/search/count), never a mutation.\n  [CoreAuditableEventType.PLATFORM_DIRECTORY_ACCESS]: OcsfApiActivity.READ,\n  [CoreAuditableEventType.RETAINED_DATA_ACCESS]: OcsfApiActivity.READ,\n  [CoreAuditableEventType.SUBJECT_DATA_EXPORT]: OcsfApiActivity.READ,\n  [CoreAuditableEventType.COLLECTION_DATA_EXPORT]: OcsfApiActivity.READ,\n  [CoreAuditableEventType.HTTP_API_READ_THROUGH_ACCESS]: OcsfApiActivity.READ,\n  // OTHER, and it is the positive statement the table's header describes rather than a shrug: the\n  // verb of an outbound provider call is a property of the OPERATION, not of the event type — the\n  // same event carries `classification: READ` for one call and `WRITE` for the next, so no member of\n  // this enum is true of the type. `activity_name` carries our event type, which is what OTHER\n  // obliges, and the payload's `classification` carries the verb for a consumer that wants it.\n  [CoreAuditableEventType.PROVIDER_OPERATION_CALL]: OcsfApiActivity.OTHER,\n  // OTHER for the same reason as its sibling, and more strongly: an MCP tool's effect is not\n  // declared anywhere the framework can read — the tool list is discovered from the server at turn\n  // start and nothing says whether a given tool reads or writes. Mapping to CREATE or READ would be\n  // asserting a verb nobody stated. `activity_name` carries our event type, which is what OTHER\n  // obliges.\n  [CoreAuditableEventType.MCP_TOOL_CALL]: OcsfApiActivity.OTHER,\n  // OTHER, and the alternative was considered: an approval decision is not an API activity at all,\n  // and UPDATE would read as \"a record was updated\" to every OCSF consumer. What was updated is a\n  // pending tool call held in memory, which no OCSF class models. `activity_name` carries our own\n  // event type, which is precisely what OTHER obliges.\n  [CoreAuditableEventType.AGENT_TOOL_APPROVAL_MODIFIED]: OcsfApiActivity.OTHER,\n  // D6 stance 6b: the declared external-erasure operation DELETED remote rows.\n  [CoreAuditableEventType.HTTP_API_EXTERNAL_ERASURE]: OcsfApiActivity.DELETE,\n  // D6 stance 6c: nothing was deleted — the event records a deliberate non-action.\n  [CoreAuditableEventType.HTTP_API_NON_ERASURE_ACKNOWLEDGED]: OcsfApiActivity.OTHER,\n  [CoreAuditableEventType.SYSTEM_CONTEXT_READ]: OcsfApiActivity.READ,\n  [CoreAuditableEventType.SYSTEM_CONTEXT_WRITE]: OcsfApiActivity.OTHER, // static fallback only — refined per emission from eventData.operation (CREATE | UPDATE | UPDATE_MANY)\n\n  // ── ORG_MANAGEMENT ──\n  [CoreAuditableEventType.ORGANIZATION_ACTIVATED]: OcsfEntityManagementActivity.RESUME,\n  [CoreAuditableEventType.ORGANIZATION_CREATED]: OcsfEntityManagementActivity.CREATE,\n  [CoreAuditableEventType.ORGANIZATION_DELETED]: OcsfEntityManagementActivity.DELETE,\n  [CoreAuditableEventType.ORGANIZATION_DELETION_REQUESTED]: OcsfEntityManagementActivity.OTHER, // marks the tenant and opens a window; nothing is deleted yet, so Delete(4) would overstate it\n  [CoreAuditableEventType.ORGANIZATION_MEMBER_INVITED]: OcsfEntityManagementActivity.CREATE,\n  [CoreAuditableEventType.ORGANIZATION_MEMBER_JOINED]: OcsfEntityManagementActivity.ENROLL,\n  [CoreAuditableEventType.ORGANIZATION_MEMBER_REMOVED]: OcsfEntityManagementActivity.UNENROLL,\n  [CoreAuditableEventType.ORGANIZATION_MEMBER_STATUS_CHANGED]: OcsfEntityManagementActivity.UPDATE,\n  [CoreAuditableEventType.ORGANIZATION_MEMBER_UPDATED]: OcsfEntityManagementActivity.UPDATE,\n  [CoreAuditableEventType.ORGANIZATION_NOTIFICATIONS_UPDATED]: OcsfEntityManagementActivity.UPDATE,\n  [CoreAuditableEventType.ORGANIZATION_PREFERENCES_UPDATED]: OcsfEntityManagementActivity.UPDATE,\n  [CoreAuditableEventType.ORGANIZATION_PROFILE_UPDATED]: OcsfEntityManagementActivity.UPDATE,\n  [CoreAuditableEventType.ORGANIZATION_RESTORED]: OcsfEntityManagementActivity.OTHER, // un-deletion has no 3004 member; Resume(13) is unsuspend and Activate(10) is a transient engine state\n  [CoreAuditableEventType.ORGANIZATION_SIEM_EXPORT_CONFIGURED]: OcsfEntityManagementActivity.UPDATE,\n  // Organization provider credentials. The credential row IS the managed entity, so the three\n  // lifecycle verbs map onto its CRUD members directly — CREATE for the first grant, UPDATE for a\n  // rotation (the entity persists, its secret changes), DELETE for the withdrawal.\n  [CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_SET]: OcsfEntityManagementActivity.CREATE,\n  [CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_ROTATED]: OcsfEntityManagementActivity.UPDATE,\n  // READ(2), not OTHER: resolving the credential for an outbound call reads the managed entity, and\n  // READ is what an OCSF consumer's \"who accessed this secret\" query is written against. Mapping a\n  // spend to OTHER(99) would take the highest-value events in this family out of every stock rule.\n  [CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_USED]: OcsfEntityManagementActivity.READ,\n  [CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_DELETED]: OcsfEntityManagementActivity.DELETE,\n  // A person's own credential maps identically to the tenant's: the OCSF activity describes what was\n  // done to the managed entity, and that is the same verb regardless of who owns it. WHO owns it is\n  // carried by the event data, not by the activity — collapsing the two would make \"who accessed\n  // this secret\" queries miss half their population.\n  [CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_SET]: OcsfEntityManagementActivity.CREATE,\n  [CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_ROTATED]: OcsfEntityManagementActivity.UPDATE,\n  [CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_USED]: OcsfEntityManagementActivity.READ,\n  [CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_DELETED]: OcsfEntityManagementActivity.DELETE,\n  // CREATE, like the `_SET` siblings: what OCSF records is the verb done to the managed entity, and\n  // a connection coming into existence is a creation however it was obtained. The fact that this one\n  // came from a consent ceremony rather than a paste lives in the event DATA — an OCSF activity is\n  // deliberately a small closed vocabulary, and stretching it to carry provenance would make it a\n  // worse index of what happened, not a better one.\n  [CoreAuditableEventType.ORGANIZATION_PROVIDER_CONNECTION_GRANTED]: OcsfEntityManagementActivity.CREATE,\n  [CoreAuditableEventType.USER_PROVIDER_CONNECTION_GRANTED]: OcsfEntityManagementActivity.CREATE,\n  [CoreAuditableEventType.ORGANIZATION_SSO_CONFIGURATION_CHANGED]: OcsfEntityManagementActivity.UPDATE,\n  // An application authentication-policy change is a configuration entity being UPDATED — the same\n  // OCSF shape as the SSO / SIEM / SCIM configuration-change siblings around it. (Confirmed by the\n  // session that added the event: UPDATE is the intended activity.)\n  [CoreAuditableEventType.APPLICATION_AUTH_POLICY_CHANGED]: OcsfEntityManagementActivity.UPDATE,\n  [CoreAuditableEventType.ORGANIZATION_SUSPENDED]: OcsfEntityManagementActivity.SUSPEND,\n  [CoreAuditableEventType.ORGANIZATION_UNIT_UPDATED]: OcsfEntityManagementActivity.UPDATE,\n  [CoreAuditableEventType.ORGANIZATION_UPDATED]: OcsfEntityManagementActivity.UPDATE,\n  [CoreAuditableEventType.SAML_CERT_EXPIRING]: OcsfEntityManagementActivity.OTHER,\n  [CoreAuditableEventType.SAML_METADATA_PARSED]: OcsfEntityManagementActivity.OTHER,\n  [CoreAuditableEventType.SCIM_PROVISIONING_CONFIG_UPDATED]: OcsfEntityManagementActivity.UPDATE,\n  [CoreAuditableEventType.SCIM_PROVISIONING_FAILED]: OcsfEntityManagementActivity.OTHER,\n  [CoreAuditableEventType.SCIM_TOKEN_CREATED]: OcsfEntityManagementActivity.CREATE,\n  [CoreAuditableEventType.SCIM_TOKEN_GENERATED]: OcsfEntityManagementActivity.CREATE,\n  [CoreAuditableEventType.SCIM_TOKEN_REVOKED]: OcsfEntityManagementActivity.DELETE,\n  [CoreAuditableEventType.SCIM_TOKEN_ROTATED]: OcsfEntityManagementActivity.UPDATE,\n  [CoreAuditableEventType.WEBHOOK_ENDPOINT_TEST_DISPATCHED]: OcsfEntityManagementActivity.OTHER,\n\n  // ── USER_LIFECYCLE ──\n  [CoreAuditableEventType.RESOURCE_STATUS_TRANSITION_PERFORMED]: OcsfUserManagementActivity.OTHER,\n  [CoreAuditableEventType.SAML_EMAIL_CHANGED]: OcsfUserManagementActivity.UPDATE,\n  [CoreAuditableEventType.SCIM_USER_DEACTIVATED]: OcsfUserManagementActivity.DISABLE,\n  [CoreAuditableEventType.SCIM_USER_PROVISIONED]: OcsfUserManagementActivity.CREATE,\n  [CoreAuditableEventType.SCIM_USER_UPDATED]: OcsfUserManagementActivity.UPDATE,\n  [CoreAuditableEventType.USER_CREATED]: OcsfUserManagementActivity.CREATE,\n  [CoreAuditableEventType.USER_DELETED]: OcsfUserManagementActivity.DELETE,\n  [CoreAuditableEventType.USER_EMAIL_VERIFIED]: OcsfUserManagementActivity.UPDATE,\n  [CoreAuditableEventType.USER_PHONE_VERIFICATION_FAILED]: OcsfUserManagementActivity.OTHER,\n  [CoreAuditableEventType.USER_PHONE_VERIFIED]: OcsfUserManagementActivity.UPDATE,\n  [CoreAuditableEventType.USER_REGISTERED]: OcsfUserManagementActivity.CREATE,\n  [CoreAuditableEventType.USER_UPDATED]: OcsfUserManagementActivity.UPDATE,\n  [CoreAuditableEventType.USER_VERIFICATION_EMAIL_RESENT]: OcsfUserManagementActivity.OTHER,\n};\n\n/**\n * Fail at module load if any row assigns an activity its own class does not publish.\n *\n * This is the check the table exists to make possible. Activity numbers are class-scoped and collide\n * across classes, so a misfiled row produces a document that is structurally valid, schema-conformant,\n * and semantically wrong — the failure mode nothing downstream can catch.\n */\nfunction assertActivitiesBelongToTheirClass(): void {\n  const offenders: string[] = [];\n  for (const [eventType, activityId] of Object.entries(OCSF_ACTIVITY_BY_EVENT_TYPE)) {\n    const category = getAuditEventClassification(eventType).category;\n    const descriptor = OCSF_CLASS_BY_AUDIT_CATEGORY[category as AuditEventCategory];\n    if (!PUBLISHED_ACTIVITIES_BY_CLASS[descriptor.classUid].has(activityId)) {\n      offenders.push(`${eventType} → activity ${activityId} is not published by class ${descriptor.classUid}`);\n    }\n  }\n  if (offenders.length > 0) {\n    throw new Error(`OCSF activity mapping assigns activities their class does not publish:\\n  ${offenders.join('\\n  ')}`);\n  }\n}\nassertActivitiesBelongToTheirClass();\n\n/**\n * Resolve the OCSF activity for an event type.\n *\n * Application-defined event types are ordinary strings the engine cannot enumerate, so they resolve to\n * `UNKNOWN` — the one case where \"we cannot say\" is the truthful answer.\n */\nexport function resolveOcsfActivityId(eventType: string): number {\n  return OCSF_ACTIVITY_BY_EVENT_TYPE[eventType as CoreAuditableEventType] ?? OcsfCommonActivity.UNKNOWN;\n}\n\n/**\n * The `activity_name` companion for an `OTHER` assignment, or `undefined` when the activity is specific.\n *\n * The schema's own definition of `OTHER` points the reader at `activity_name`, so emitting `OTHER`\n * without it discards the very information the value promises is available.\n *\n * Takes the RESOLVED activity rather than re-deriving it from the event type. That distinction became\n * load-bearing when 6003 gained runtime refinement: an event whose TABLE entry is `Other` but whose\n * refined activity is `Update` must NOT carry `activity_name`, and a version of this that re-derived\n * from the event type would have emitted both — a specific activity plus a companion asserting it was\n * unmapped. Two ways to answer one question is the drift this contract exists to prevent.\n */\nexport function resolveOcsfActivityName(activityId: number, eventType: string): string | undefined {\n  return activityId === OcsfCommonActivity.OTHER ? eventType : undefined;\n}\n\n/**\n * OCSF `auth_protocol_id` — the NORMALISED authentication protocol.\n *\n * spec-cite: OCSF 1.9.0 — `schema.ocsf.io/api/1.9.0/classes/authentication`, the `auth_protocol_id`\n * enum. `auth_protocol` is documented as \"the authentication protocol as defined by the caption of\n * `auth_protocol_id`. In the case of Other, it is defined by the event source.\"\n */\nexport enum OcsfAuthProtocolId {\n  UNKNOWN = 0,\n  NTLM = 1,\n  KERBEROS = 2,\n  DIGEST = 3,\n  OPENID = 4,\n  SAML = 5,\n  OAUTH_2_0 = 6,\n  PAP = 7,\n  CHAP = 8,\n  EAP = 9,\n  RADIUS = 10,\n  BASIC_AUTHENTICATION = 11,\n  LDAP = 12,\n  OTHER = 99,\n}\n\n/** The published CAPTION for each id — what `auth_protocol` must carry when the id is not `Other`. */\nconst OCSF_AUTH_PROTOCOL_CAPTION: Readonly<Record<OcsfAuthProtocolId, string>> = {\n  [OcsfAuthProtocolId.UNKNOWN]: 'Unknown',\n  [OcsfAuthProtocolId.NTLM]: 'NTLM',\n  [OcsfAuthProtocolId.KERBEROS]: 'Kerberos',\n  [OcsfAuthProtocolId.DIGEST]: 'Digest',\n  [OcsfAuthProtocolId.OPENID]: 'OpenID',\n  [OcsfAuthProtocolId.SAML]: 'SAML',\n  [OcsfAuthProtocolId.OAUTH_2_0]: 'OAUTH 2.0',\n  [OcsfAuthProtocolId.PAP]: 'PAP',\n  [OcsfAuthProtocolId.CHAP]: 'CHAP',\n  [OcsfAuthProtocolId.EAP]: 'EAP',\n  [OcsfAuthProtocolId.RADIUS]: 'RADIUS',\n  [OcsfAuthProtocolId.BASIC_AUTHENTICATION]: 'Basic Authentication',\n  [OcsfAuthProtocolId.LDAP]: 'LDAP',\n  [OcsfAuthProtocolId.OTHER]: 'Other',\n};\n\n/**\n * The `AuthMethod` members that ARE a protocol OCSF normalises. Everything else resolves to `Other`.\n *\n * Deliberately partial. Three members are absent for a reason, and each absence is a decision:\n *\n * - `PASSWORD` is NOT `Basic Authentication` (11). Basic Auth is an HTTP transport scheme (RFC 7617);\n *   a user typing a password into a form is not that, and the resemblance is only in the English word.\n * - `MAGIC_LINK`, `TOTP`, `SMS_OTP`, `EMAIL_OTP` and `PASSKEY` name no protocol in the published enum.\n *   WebAuthn/FIDO2 in particular is absent from OCSF 1.9.0 — mapping a passkey to `Other` is the\n *   accurate answer, not a shortfall.\n * - `EXTERNAL_OAUTH2` DOES map: it is OAuth 2.0 by construction.\n *\n * The `ORG_` prefix on the SSO members is SCOPE, not protocol — an organization-restricted SAML login\n * is still SAML — so those normalise cleanly.\n */\nconst OCSF_AUTH_PROTOCOL_BY_AUTH_METHOD: Readonly<Partial<Record<AuthMethod, OcsfAuthProtocolId>>> = {\n  [AuthMethod.ORG_SAML]: OcsfAuthProtocolId.SAML,\n  [AuthMethod.ORG_OPENID_CONNECT]: OcsfAuthProtocolId.OPENID,\n  [AuthMethod.EXTERNAL_OAUTH2]: OcsfAuthProtocolId.OAUTH_2_0,\n};\n\n/** `auth_protocol` + `auth_protocol_id`, resolved together because the schema couples them. */\nexport interface OcsfAuthProtocol {\n  readonly protocol: string;\n  readonly protocolId: OcsfAuthProtocolId;\n}\n\n/**\n * Resolve the OCSF protocol pair for an envelope's `authMethod`.\n *\n * The two attributes are resolved TOGETHER because the schema defines one in terms of the other: when\n * the id is normalised, the string must be that id's published caption; only under `Other` may the\n * string be the producer's own value. Returning them separately invites the pairing to drift, which is\n * exactly how this shipped wrong the first time (`org_saml` with no id at all).\n *\n * `authMethod` is an OPEN string on the envelope — applications define their own — so anything outside\n * the framework's own `AuthMethod` vocabulary lands on `Other` carrying its raw value, which is\n * precisely what `Other` is for.\n */\nexport function resolveOcsfAuthProtocol(authMethod: string): OcsfAuthProtocol {\n  const normalised = OCSF_AUTH_PROTOCOL_BY_AUTH_METHOD[authMethod as AuthMethod];\n  return normalised === undefined\n    ? { protocol: authMethod, protocolId: OcsfAuthProtocolId.OTHER }\n    : { protocol: OCSF_AUTH_PROTOCOL_CAPTION[normalised], protocolId: normalised };\n}\n\n/**\n * The CRUD verb an API Activity (6003) event performed, mapped from the framework's core operation.\n *\n * spec-cite: OCSF 1.9.0 — `api_activity.activity_id` enum: 0 Unknown, 1 Create, 2 Read, 3 Update,\n * 4 Delete, 99 Other.\n *\n * The bulk forms collapse onto their singular verb: OCSF's activity names WHAT was done, and the\n * cardinality is carried separately by the envelope (`isBulkOperation` / `affectedRecordCount`).\n * `COUNT` is a Read — it answers a question about existing rows without changing any.\n */\nconst OCSF_API_ACTIVITY_BY_CORE_OPERATION: Readonly<Record<CoreResourceOperation, OcsfApiActivity>> = {\n  [CoreResourceOperation.CREATE]: OcsfApiActivity.CREATE,\n  [CoreResourceOperation.CREATE_MANY]: OcsfApiActivity.CREATE,\n  [CoreResourceOperation.READ]: OcsfApiActivity.READ,\n  [CoreResourceOperation.LIST]: OcsfApiActivity.READ,\n  [CoreResourceOperation.SEARCH]: OcsfApiActivity.READ,\n  [CoreResourceOperation.COUNT]: OcsfApiActivity.READ,\n  [CoreResourceOperation.UPDATE]: OcsfApiActivity.UPDATE,\n  [CoreResourceOperation.UPDATE_MANY]: OcsfApiActivity.UPDATE,\n  [CoreResourceOperation.DELETE]: OcsfApiActivity.DELETE,\n  [CoreResourceOperation.DELETE_MANY]: OcsfApiActivity.DELETE,\n};\n\n/**\n * The `eventData` keys that can name a 6003 event's CRUD verb, in precedence order.\n *\n * Three keys rather than one because the emitters spell it differently and each is authoritative for\n * its own event: `resourceOperationLike` is the core semantics a CUSTOM verb borrows (a `suspend`\n * behaving as an `update`), `operationIdentifier` is the verb on resource-operation and field-access\n * events, and `operation` is what `logSystemContextWrite` records — typed `CREATE | UPDATE |\n * UPDATE_MANY`, so it always resolves.\n *\n * Enumerated by the QUESTION (\"what names the verb on a 6003 event?\") rather than by one emitter's\n * field name, which is how `operation` was missed on the first pass.\n */\nconst OCSF_API_VERB_EVENT_DATA_KEYS = ['resourceOperationLike', 'operationIdentifier', 'operation'] as const;\n\n/**\n * Refine a 6003 event's `activity_id` from RUNTIME data, when the event type alone cannot say.\n *\n * Class 6003 is organised around the CRUD axis, and the resource-operation events (`performed` /\n * `denied`) are the bulk of what we route there — yet the event TYPE is the same string for a create\n * and a delete. So the table maps them to `Other`, and every authorization event landed in one\n * undifferentiated bucket: the same collapse `activity_id` being pinned to `Unknown` used to cause,\n * surviving one layer down after that was fixed.\n *\n * The verb is in the envelope — under one of {@link OCSF_API_VERB_EVENT_DATA_KEYS}, in that precedence\n * order. Anything else (a custom verb borrowing nothing) keeps `Other`, where `activity_name` already\n * carries the event type.\n *\n * Two consequences that are DECISIONS, not side effects:\n *\n * - **`FIELD_ACCESS` refines away from its static `Read`.** It carries `operationIdentifier`, so a\n *   secret exposed during a create now reads as Create(1). That is correct: 6003's activity names what\n *   the API CALL did, and the field-access nature rides `metadata.event_code`. The static `Read` remains\n *   the fallback for an emission that names no operation.\n * - **`SYSTEM_CONTEXT_WRITE` stops being `Other`.** Its table comment says \"neither Create nor Update is\n *   true of every emission\" — true of a STATIC mapping and not a permanent conclusion, because at\n *   runtime `operation` says exactly which. This matters more than most: it is the ACL-bypass write.\n */\nexport function refineOcsfApiActivity(eventData: unknown, fallback: number): number {\n  if (eventData === null || typeof eventData !== 'object') return fallback;\n  const record = eventData as Readonly<Record<string, unknown>>;\n  for (const key of OCSF_API_VERB_EVENT_DATA_KEYS) {\n    const candidate = record[key];\n    if (typeof candidate !== 'string') continue;\n    const mapped = OCSF_API_ACTIVITY_BY_CORE_OPERATION[candidate as CoreResourceOperation];\n    if (mapped !== undefined) return mapped;\n  }\n  return fallback;\n}\n"]}

package/dist/esm/compliance/audit-trails/services/utils/ocsf-class-mapping.backend.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ocsf-class-mapping.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../../../src/compliance/audit-trails/services/utils/ocsf-class-mapping.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAE3D,8CAA8C;AAC9C,oBAAY,eAAe;IACzB,oCAAoC;IACpC,8BAA8B,IAAI;IAClC,4BAA4B;IAC5B,oBAAoB,IAAI;CACzB;AAED;;;;;;GAMG;AACH,oBAAY,YAAY;IACtB,wEAAwE;IACxE,cAAc,OAAO;IACrB,0HAA0H;IAC1H,iBAAiB,OAAO;IACxB,mGAAmG;IACnG,eAAe,OAAO;IACtB,wFAAwF;IACxF,YAAY,OAAO;CACpB;AAED,wDAAwD;AACxD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,eAAe,CAAC;IACtC,uGAAuG;IACvG,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,4BAA4B,EAAE,QAAQ,CAAC,MAAM,CAAC,kBAAkB,EAAE,mBAAmB,CAAC,CA0BlG,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAE9E;AAED,kFAAkF;AAClF,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,mBAAmB,CAQlF"}
+{"version":3,"file":"ocsf-class-mapping.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../../src/compliance/audit-trails/services/utils/ocsf-class-mapping.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAE3D,8CAA8C;AAC9C,oBAAY,eAAe;IACzB,oCAAoC;IACpC,8BAA8B,IAAI;IAClC,4BAA4B;IAC5B,oBAAoB,IAAI;CACzB;AAED;;;;;;GAMG;AACH,oBAAY,YAAY;IACtB,wEAAwE;IACxE,cAAc,OAAO;IACrB,0HAA0H;IAC1H,iBAAiB,OAAO;IACxB,mGAAmG;IACnG,eAAe,OAAO;IACtB,wFAAwF;IACxF,YAAY,OAAO;CACpB;AAED,wDAAwD;AACxD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,eAAe,CAAC;IACtC,uGAAuG;IACvG,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,4BAA4B,EAAE,QAAQ,CAAC,MAAM,CAAC,kBAAkB,EAAE,mBAAmB,CAAC,CA0BlG,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAE9E;AAED,kFAAkF;AAClF,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,mBAAmB,CAQlF"}

package/dist/esm/compliance/audit-trails/services/utils/siem-dictionary.backend.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"siem-dictionary.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../../../src/compliance/audit-trails/services/utils/siem-dictionary.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH;;;;;;;;;;GAUG;AACH,oBAAY,sBAAsB;IAChC,sFAAsF;IACtF,cAAc,mBAAmB;IACjC,2FAA2F;IAC3F,aAAa,kBAAkB;IAC/B,oEAAoE;IACpE,UAAU,eAAe;CAC1B;AAED,MAAM,MAAM,kBAAkB,GAC1B;IAAE,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC,cAAc,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GACrF;IAAE,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC,aAAa,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACnG;IAAE,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC,UAAU,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AAE7F;;;;;;;;;;;;GAYG;AACH,oBAAY,qBAAqB;IAC/B,sBAAsB;IACtB,MAAM,WAAW;IACjB,sBAAsB;IACtB,OAAO,YAAY;IACnB,sCAAsC;IACtC,UAAU,eAAe;IACzB,+CAA+C;IAC/C,oBAAoB,yBAAyB;IAC7C,sBAAsB;IACtB,WAAW,gBAAgB;IAC3B,oCAAoC;IACpC,UAAU,eAAe;IACzB,wBAAwB;IACxB,IAAI,SAAS;IACb,8CAA8C;IAC9C,cAAc,mBAAmB;IACjC,iDAAiD;IACjD,kBAAkB,uBAAuB;CAC1C;AAED,sHAAsH;AACtH,MAAM,WAAW,mBAAmB;IAClC,uGAAuG;IACvG,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,uCAAuC;IACvC,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;IACzC,0EAA0E;IAC1E,QAAQ,CAAC,KAAK,CAAC,EAAE,kBAAkB,CAAC;IACpC,qGAAqG;IACrG,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkF6B,CAAC;AAEzD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA2C1B;;;;;;;OAOG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAKmD,CAAC;AAEzD;;;;;;;;;;;;;;;;;;;;;GAqBG;AAKH,eAAO,MAAM,gBAAgB;;;;IAE3B;;;;;;;;OAQG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqBwD,CAAC;AAE9D;;;;;;;;GAQG;AACH,MAAM,WAAW,wBAAwB;IACvC,qEAAqE;IACrE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAMtE,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAEvE,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,+BAA+B,QAAQ,CAAC;AAErD,uHAAuH;AACvH,MAAM,MAAM,UAAU,GAAG,MAAM,OAAO,cAAc,CAAC;AACrD,6FAA6F;AAC7F,MAAM,MAAM,WAAW,GAAG,MAAM,OAAO,eAAe,GAAG,MAAM,OAAO,gBAAgB,CAAC;AAEvF;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,mBAAmB,GAAG,MAAM,GAAG,SAAS,CAErF;AAWD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAuC,CAAC;AACxG,eAAO,MAAM,mBAAmB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAwC,CAAC;AAE1G;;;;;;;;;GASG;AACH,wBAAgB,8BAA8B,IAAI,IAAI,CAUrD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAc5F"}
+{"version":3,"file":"siem-dictionary.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../../src/compliance/audit-trails/services/utils/siem-dictionary.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH;;;;;;;;;;GAUG;AACH,oBAAY,sBAAsB;IAChC,sFAAsF;IACtF,cAAc,mBAAmB;IACjC,2FAA2F;IAC3F,aAAa,kBAAkB;IAC/B,oEAAoE;IACpE,UAAU,eAAe;CAC1B;AAED,MAAM,MAAM,kBAAkB,GAC1B;IAAE,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC,cAAc,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GACrF;IAAE,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC,aAAa,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACnG;IAAE,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC,UAAU,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AAE7F;;;;;;;;;;;;GAYG;AACH,oBAAY,qBAAqB;IAC/B,sBAAsB;IACtB,MAAM,WAAW;IACjB,sBAAsB;IACtB,OAAO,YAAY;IACnB,sCAAsC;IACtC,UAAU,eAAe;IACzB,+CAA+C;IAC/C,oBAAoB,yBAAyB;IAC7C,sBAAsB;IACtB,WAAW,gBAAgB;IAC3B,oCAAoC;IACpC,UAAU,eAAe;IACzB,wBAAwB;IACxB,IAAI,SAAS;IACb,8CAA8C;IAC9C,cAAc,mBAAmB;IACjC,iDAAiD;IACjD,kBAAkB,uBAAuB;CAC1C;AAED,sHAAsH;AACtH,MAAM,WAAW,mBAAmB;IAClC,uGAAuG;IACvG,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,uCAAuC;IACvC,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;IACzC,0EAA0E;IAC1E,QAAQ,CAAC,KAAK,CAAC,EAAE,kBAAkB,CAAC;IACpC,qGAAqG;IACrG,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkF6B,CAAC;AAEzD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA2C1B;;;;;;;OAOG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAKmD,CAAC;AAEzD;;;;;;;;;;;;;;;;;;;;;GAqBG;AAKH,eAAO,MAAM,gBAAgB;;;;IAE3B;;;;;;;;OAQG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqBwD,CAAC;AAE9D;;;;;;;;GAQG;AACH,MAAM,WAAW,wBAAwB;IACvC,qEAAqE;IACrE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAMtE,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAEvE,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,+BAA+B,QAAQ,CAAC;AAErD,uHAAuH;AACvH,MAAM,MAAM,UAAU,GAAG,MAAM,OAAO,cAAc,CAAC;AACrD,6FAA6F;AAC7F,MAAM,MAAM,WAAW,GAAG,MAAM,OAAO,eAAe,GAAG,MAAM,OAAO,gBAAgB,CAAC;AAEvF;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,mBAAmB,GAAG,MAAM,GAAG,SAAS,CAErF;AAWD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAuC,CAAC;AACxG,eAAO,MAAM,mBAAmB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAwC,CAAC;AAE1G;;;;;;;;;GASG;AACH,wBAAgB,8BAA8B,IAAI,IAAI,CAUrD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAc5F"}

package/dist/esm/compliance/audit-trails/services/utils/siem-ocsf-projection.backend.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"siem-ocsf-projection.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../../../src/compliance/audit-trails/services/utils/siem-ocsf-projection.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,KAAK,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AAC/G,OAAO,EAAe,YAAY,EAAoB,MAAM,oCAAoC,CAAC;AAGjG,wDAAwD;AACxD,oBAAY,kBAAkB;IAC5B,mDAAmD;IACnD,SAAS,cAAc;IACvB,4FAA4F;IAC5F,cAAc,mBAAmB;IACjC,yFAAyF;IACzF,aAAa,kBAAkB;CAChC;AAED,iGAAiG;AACjG;;;;;;;GAOG;AACH,oBAAY,kBAAkB;IAC5B,GAAG,QAAQ;IACX,MAAM,WAAW;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,yBAAyB;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,kBAAkB,CAAC;CACpC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,aAAa,GACrB;IAAE,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GACvC;IAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC,CAAA;CAAE,CAAC;AAEtF,gGAAgG;AAChG,wBAAgB,aAAa,CAAC,SAAS,EAAE,aAAa,EAAE,QAAQ,EAAE,YAAY,GAAG,SAAS,MAAM,EAAE,CAEjG;AAED,gGAAgG;AAChG,wBAAgB,aAAa,CAAC,SAAS,EAAE,aAAa,GAAG,SAAS,MAAM,EAAE,CAEzE;AAED,MAAM,MAAM,mBAAmB,CAAC,CAAC,IAC7B;IACE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC,SAAS,CAAC;IAC5C,qGAAqG;IACrG,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC;IAClC,gGAAgG;IAChG,QAAQ,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,KAAK,SAAS,cAAc,EAAE,GAAG,SAAS,CAAC;CACnG,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC,cAAc,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC3E;IAAE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC,aAAa,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjF,wGAAwG;AACxG,MAAM,MAAM,sBAAsB,CAAC,CAAC,IAAI;IACtC,QAAQ,EAAE,CAAC,IAAI,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,mBAAmB,CAAC,CAAC,CAAC;CAC5D,CAAC;AAEF,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,mBAAmB,CAAC,0BAA0B,CAAC,CAEhG;AAsBD;;;;GAIG;AACH,oBAAY,cAAc;IACxB,OAAO,IAAI;IACX,aAAa,IAAI;IACjB,MAAM,IAAI;IACV,IAAI,IAAI;CACT;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,kBAAkB,GAAG,cAAc,CAUxF;AAED;;;GAGG;AACH,oBAAY,YAAY;IACtB,OAAO,IAAI;IACX,OAAO,IAAI;IACX,OAAO,IAAI;CACZ;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,iBAAiB,GAAG,YAAY,CASjF;AAED,oGAAoG;AACpG,eAAO,MAAM,gBAAgB,UAAU,CAAC;AAcxC;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,EAAE,sBAAsB,CAAC,0BAA0B,CAgQ9E,CAAC;AAsBF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB,UAAU,CAAC;AAE3C,wBAAgB,cAAc,CAAC,QAAQ,EAAE,0BAA0B,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAwC5F"}
+{"version":3,"file":"siem-ocsf-projection.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../../src/compliance/audit-trails/services/utils/siem-ocsf-projection.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,KAAK,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AAC/G,OAAO,EAAe,YAAY,EAAoB,MAAM,oCAAoC,CAAC;AAGjG,wDAAwD;AACxD,oBAAY,kBAAkB;IAC5B,mDAAmD;IACnD,SAAS,cAAc;IACvB,4FAA4F;IAC5F,cAAc,mBAAmB;IACjC,yFAAyF;IACzF,aAAa,kBAAkB;CAChC;AAED,iGAAiG;AACjG;;;;;;;GAOG;AACH,oBAAY,kBAAkB;IAC5B,GAAG,QAAQ;IACX,MAAM,WAAW;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,yBAAyB;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,kBAAkB,CAAC;CACpC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,aAAa,GACrB;IAAE,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GACvC;IAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC,CAAA;CAAE,CAAC;AAEtF,gGAAgG;AAChG,wBAAgB,aAAa,CAAC,SAAS,EAAE,aAAa,EAAE,QAAQ,EAAE,YAAY,GAAG,SAAS,MAAM,EAAE,CAEjG;AAED,gGAAgG;AAChG,wBAAgB,aAAa,CAAC,SAAS,EAAE,aAAa,GAAG,SAAS,MAAM,EAAE,CAEzE;AAED,MAAM,MAAM,mBAAmB,CAAC,CAAC,IAC7B;IACE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC,SAAS,CAAC;IAC5C,qGAAqG;IACrG,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC;IAClC,gGAAgG;IAChG,QAAQ,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,KAAK,SAAS,cAAc,EAAE,GAAG,SAAS,CAAC;CACnG,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC,cAAc,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC3E;IAAE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC,aAAa,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjF,wGAAwG;AACxG,MAAM,MAAM,sBAAsB,CAAC,CAAC,IAAI;IACtC,QAAQ,EAAE,CAAC,IAAI,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,mBAAmB,CAAC,CAAC,CAAC;CAC5D,CAAC;AAEF,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,mBAAmB,CAAC,0BAA0B,CAAC,CAEhG;AAsBD;;;;GAIG;AACH,oBAAY,cAAc;IACxB,OAAO,IAAI;IACX,aAAa,IAAI;IACjB,MAAM,IAAI;IACV,IAAI,IAAI;CACT;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,kBAAkB,GAAG,cAAc,CAUxF;AAED;;;GAGG;AACH,oBAAY,YAAY;IACtB,OAAO,IAAI;IACX,OAAO,IAAI;IACX,OAAO,IAAI;CACZ;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,iBAAiB,GAAG,YAAY,CASjF;AAED,oGAAoG;AACpG,eAAO,MAAM,gBAAgB,UAAU,CAAC;AAcxC;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,EAAE,sBAAsB,CAAC,0BAA0B,CAgQ9E,CAAC;AAsBF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB,UAAU,CAAC;AAE3C,wBAAgB,cAAc,CAAC,QAAQ,EAAE,0BAA0B,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAwC5F"}

package/dist/esm/compliance/audit-trails/services/utils/siem-projection-contract.backend.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"siem-projection-contract.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../../../src/compliance/audit-trails/services/utils/siem-projection-contract.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,EAAE,kBAAkB,EAAE,KAAK,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AAC5F,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAE/E;;;;;;;;GAQG;AACH,MAAM,WAAW,qBAAqB,CAAC,CAAC,SAAS,MAAM;IACrD,yFAAyF;IACzF,QAAQ,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC;IACjD;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,EAAE,CAAC,GAAG,SAAS,EAAE,SAAS,MAAM,EAAE,KAAK,MAAM,CAAC;IAC3D,iGAAiG;IACjG,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;CAC9C;AAED;;;;;;GAMG;AACH,oBAAY,uBAAuB;IACjC,+EAA+E;IAC/E,SAAS,cAAc;IACvB,oDAAoD;IACpD,MAAM,WAAW;IACjB,2DAA2D;IAC3D,aAAa,kBAAkB;CAChC;AAED,sDAAsD;AACtD,MAAM,MAAM,mBAAmB,CAAC,CAAC,EAAE,CAAC,SAAS,MAAM,IAC/C;IACE,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC,SAAS,CAAC;IACjD;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC;IAC5B,6FAA6F;IAC7F,QAAQ,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,qBAAqB,CAAC,CAAC,CAAC,KAAK,MAAM,GAAG,SAAS,CAAC;CACzF,GACD;IACE;;;;;;;;OAQG;IACH,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC,MAAM,CAAC;IAC9C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC,aAAa,CAAC;IACrD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;AAEN;;;GAGG;AACH,MAAM,MAAM,sBAAsB,CAAC,CAAC,EAAE,CAAC,SAAS,MAAM,GAAG,MAAM,IAAI;IACjE,QAAQ,EAAE,CAAC,IAAI,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,mBAAmB,CAAC,CAAC,EAAE,CAAC,CAAC;CAC/D,CAAC;AAEF,+FAA+F;AAC/F,wBAAgB,YAAY,CAAC,CAAC,SAAS,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,mBAAmB,CAAC,0BAA0B,EAAE,CAAC,CAAC,CAEjH;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,kBAAkB,GAAG,MAAM,CAUlF;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,0BAA0B,YAAY,CAAC;AAEpD,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,kBAAkB,GAAG,SAAS,GAAG,MAAM,CAE5F;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,MAAM,CAUzE;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,4BAA4B,iCAAiC,CAAC;AAE3E;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAGnE;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB,QAGuC,CAAC;AAEvE;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,wBAAwB,QAWe,CAAC;AAErD;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,cAAc,EAAE,sBAAsB,CAAC,0BAA0B,EAAE,UAAU,CA8GzF,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,eAAe,EAAE,sBAAsB,CAAC,0BAA0B,EAAE,WAAW,CAiE3F,CAAC"}
+{"version":3,"file":"siem-projection-contract.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../../src/compliance/audit-trails/services/utils/siem-projection-contract.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,EAAE,kBAAkB,EAAE,KAAK,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AAC5F,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAE/E;;;;;;;;GAQG;AACH,MAAM,WAAW,qBAAqB,CAAC,CAAC,SAAS,MAAM;IACrD,yFAAyF;IACzF,QAAQ,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC;IACjD;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,EAAE,CAAC,GAAG,SAAS,EAAE,SAAS,MAAM,EAAE,KAAK,MAAM,CAAC;IAC3D,iGAAiG;IACjG,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;CAC9C;AAED;;;;;;GAMG;AACH,oBAAY,uBAAuB;IACjC,+EAA+E;IAC/E,SAAS,cAAc;IACvB,oDAAoD;IACpD,MAAM,WAAW;IACjB,2DAA2D;IAC3D,aAAa,kBAAkB;CAChC;AAED,sDAAsD;AACtD,MAAM,MAAM,mBAAmB,CAAC,CAAC,EAAE,CAAC,SAAS,MAAM,IAC/C;IACE,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC,SAAS,CAAC;IACjD;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC;IAC5B,6FAA6F;IAC7F,QAAQ,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,qBAAqB,CAAC,CAAC,CAAC,KAAK,MAAM,GAAG,SAAS,CAAC;CACzF,GACD;IACE;;;;;;;;OAQG;IACH,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC,MAAM,CAAC;IAC9C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC,aAAa,CAAC;IACrD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;AAEN;;;GAGG;AACH,MAAM,MAAM,sBAAsB,CAAC,CAAC,EAAE,CAAC,SAAS,MAAM,GAAG,MAAM,IAAI;IACjE,QAAQ,EAAE,CAAC,IAAI,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,mBAAmB,CAAC,CAAC,EAAE,CAAC,CAAC;CAC/D,CAAC;AAEF,+FAA+F;AAC/F,wBAAgB,YAAY,CAAC,CAAC,SAAS,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,mBAAmB,CAAC,0BAA0B,EAAE,CAAC,CAAC,CAEjH;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,kBAAkB,GAAG,MAAM,CAUlF;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,0BAA0B,YAAY,CAAC;AAEpD,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,kBAAkB,GAAG,SAAS,GAAG,MAAM,CAE5F;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,MAAM,CAUzE;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,4BAA4B,iCAAiC,CAAC;AAE3E;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAGnE;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB,QAGuC,CAAC;AAEvE;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,wBAAwB,QAWe,CAAC;AAErD;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,cAAc,EAAE,sBAAsB,CAAC,0BAA0B,EAAE,UAAU,CA8GzF,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,eAAe,EAAE,sBAAsB,CAAC,0BAA0B,EAAE,WAAW,CAiE3F,CAAC"}

package/dist/esm/compliance/audit-trails/utils/audit-actor.backend.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-actor.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../../src/compliance/audit-trails/utils/audit-actor.backend.utils.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAE5G;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,mBAAmB,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG,SAAS,GAAG,MAAM,CAoB/F"}
+{"version":3,"file":"audit-actor.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/audit-trails/utils/audit-actor.backend.utils.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAE5G;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,mBAAmB,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG,SAAS,GAAG,MAAM,CAoB/F"}

package/dist/esm/compliance/audit-trails/utils/layer2-audit-provider-boot-diagnostic.backend.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"layer2-audit-provider-boot-diagnostic.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../../src/compliance/audit-trails/utils/layer2-audit-provider-boot-diagnostic.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,qCAAqC,CAAC,KAAK,EAAE;IAC3D;;;;;OAKG;IACH,yCAAyC,EAAE,OAAO,CAAC;IACnD;;;OAGG;IACH,2BAA2B,EAAE,OAAO,CAAC;IACrC;;;;OAIG;IACH,6BAA6B,EAAE,MAAM,CAAC;CACvC,GAAG,OAAO,CAMV"}
+{"version":3,"file":"layer2-audit-provider-boot-diagnostic.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/audit-trails/utils/layer2-audit-provider-boot-diagnostic.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,qCAAqC,CAAC,KAAK,EAAE;IAC3D;;;;;OAKG;IACH,yCAAyC,EAAE,OAAO,CAAC;IACnD;;;OAGG;IACH,2BAA2B,EAAE,OAAO,CAAC;IACrC;;;;OAIG;IACH,6BAA6B,EAAE,MAAM,CAAC;CACvC,GAAG,OAAO,CAMV"}

package/dist/esm/compliance/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/compliance/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/compliance/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC"}

package/dist/esm/compliance/privacy/retention-hide-predicate.backend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"retention-hide-predicate.backend.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/retention-hide-predicate.backend.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE/E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DG;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,oBAAoB,CAAC;AAE7D;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,EAAE,eAA0C,CAAC;AAEjF;;;;;;GAMG;AACH,eAAO,MAAM,kDAAkD,EAAE,SAAS,qBAAqB,EAK9F,CAAC;AAEF;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;CACpC;AAED;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;CACnC;AAED;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CACzC,qBAAqB,EAAE,yBAAyB,GAAG,SAAS,GAAG,IAAI,GAClE,OAAO,CAET;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,IAAI,eAAe,EAAE,CAE/D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iCAAiC,IAAI,eAAe,GAAG,SAAS,CAG/E;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,8BAA8B,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAExE;AAED;;;;;;;;;GASG;AACH,wBAAgB,qCAAqC,CACnD,gBAAgB,EAAE,yBAAyB,EAC3C,qBAAqB,EAAE,qBAAqB,GAC3C,OAAO,CAGT;AAED;;;;;;;;;GASG;AACH,wBAAgB,4CAA4C,CAC1D,gBAAgB,EAAE,yBAAyB,GAAG,SAAS,GACtD,OAAO,CAET;AAOD;;;;;;;;;;GAUG;AACH,wBAAgB,gCAAgC,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAE1E;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9E,MAAM,EAAE,OAAO,GACd,OAAO,CAET;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,SAAS,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,IAAI,CAEzF;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,+BAA+B,CAAC,OAAO,SAAS,MAAM,EACpE,MAAM,EAAE,OAAO,EACf,qBAAqB,EAAE,yBAAyB,GAAG,SAAS,GAAG,IAAI,EACnE,gBAAgB,EAAE,yBAAyB,EAC3C,qBAAqB,EAAE,qBAAqB,GAC3C,OAAO,CAKT;AAMD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yCAAyC,CACvD,aAAa,EAAE,eAAe,GAC7B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzB;AAED;;;;;;;GAOG;AACH,wBAAgB,yCAAyC,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEnF;AAED;;;;;;;;;GASG;AACH,wBAAgB,iCAAiC,CAC/C,aAAa,EAAE,eAAe,GAC7B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzB;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,qCAAqC,CACnD,eAAe,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,MAAM,GAC9C,MAAM,CAER"}
+{"version":3,"file":"retention-hide-predicate.backend.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/retention-hide-predicate.backend.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE/E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DG;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,oBAAoB,CAAC;AAE7D;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,EAAE,eAA0C,CAAC;AAEjF;;;;;;GAMG;AACH,eAAO,MAAM,kDAAkD,EAAE,SAAS,qBAAqB,EAK9F,CAAC;AAEF;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;CACpC;AAED;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;CACnC;AAED;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CACzC,qBAAqB,EAAE,yBAAyB,GAAG,SAAS,GAAG,IAAI,GAClE,OAAO,CAET;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,IAAI,eAAe,EAAE,CAE/D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iCAAiC,IAAI,eAAe,GAAG,SAAS,CAG/E;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,8BAA8B,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAExE;AAED;;;;;;;;;GASG;AACH,wBAAgB,qCAAqC,CACnD,gBAAgB,EAAE,yBAAyB,EAC3C,qBAAqB,EAAE,qBAAqB,GAC3C,OAAO,CAGT;AAED;;;;;;;;;GASG;AACH,wBAAgB,4CAA4C,CAC1D,gBAAgB,EAAE,yBAAyB,GAAG,SAAS,GACtD,OAAO,CAET;AAOD;;;;;;;;;;GAUG;AACH,wBAAgB,gCAAgC,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAE1E;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9E,MAAM,EAAE,OAAO,GACd,OAAO,CAET;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,SAAS,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,IAAI,CAEzF;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,+BAA+B,CAAC,OAAO,SAAS,MAAM,EACpE,MAAM,EAAE,OAAO,EACf,qBAAqB,EAAE,yBAAyB,GAAG,SAAS,GAAG,IAAI,EACnE,gBAAgB,EAAE,yBAAyB,EAC3C,qBAAqB,EAAE,qBAAqB,GAC3C,OAAO,CAKT;AAMD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yCAAyC,CACvD,aAAa,EAAE,eAAe,GAC7B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzB;AAED;;;;;;;GAOG;AACH,wBAAgB,yCAAyC,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEnF;AAED;;;;;;;;;GASG;AACH,wBAAgB,iCAAiC,CAC/C,aAAa,EAAE,eAAe,GAC7B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzB;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,qCAAqC,CACnD,eAAe,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,MAAM,GAC9C,MAAM,CAER"}

package/dist/esm/compliance/privacy/services/subject-erasure-external-effects.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"subject-erasure-external-effects.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/compliance/privacy/services/subject-erasure-external-effects.backend.service.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,mCAAmC,EACzC,MAAM,uBAAuB,CAAC;AAE/B;;;;;;;;;GASG;AACH,MAAM,WAAW,mCAAmC;IAClD,mBAAmB,EAAE,YAAY,CAAC;IAClC,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,YAAY,CAAC,EAAE;QAAE,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACrF;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,4BAA4B;IAC3C,6EAA6E;IAC7E,SAAS,EAAE,MAAM,CAAC;IAClB,0DAA0D;IAC1D,SAAS,CAAC,mBAAmB,EAAE,YAAY,GAAG,OAAO,CAAC;IACtD,GAAG,CAAC,OAAO,EAAE,mCAAmC,GAAG,OAAO,CAAC,mCAAmC,CAAC,CAAC;CACjG;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBACa,mDAAmD;IAC9D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAsC;IAE9D;;;OAGG;IACI,QAAQ,CAAC,MAAM,EAAE,4BAA4B,GAAG,IAAI;IAS3D,6FAA6F;IACtF,UAAU,CAAC,mBAAmB,EAAE,YAAY,GAAG,4BAA4B,EAAE;IAIpF;;;;;;OAMG;IACU,MAAM,CACjB,OAAO,EAAE,mCAAmC,EAC5C,WAAW,GAAE,MAAU,GACtB,OAAO,CAAC,mCAAmC,EAAE,CAAC;YAWnC,MAAM;CAgCrB;AAED;;;;;;GAMG;AACH,wBAAgB,+BAA+B,CAC7C,QAAQ,EAAE,SAAS,mCAAmC,EAAE,GACvD,mCAAmC,EAAE,CAEvC"}
+{"version":3,"file":"subject-erasure-external-effects.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/services/subject-erasure-external-effects.backend.service.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,mCAAmC,EACzC,MAAM,uBAAuB,CAAC;AAE/B;;;;;;;;;GASG;AACH,MAAM,WAAW,mCAAmC;IAClD,mBAAmB,EAAE,YAAY,CAAC;IAClC,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,YAAY,CAAC,EAAE;QAAE,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACrF;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,4BAA4B;IAC3C,6EAA6E;IAC7E,SAAS,EAAE,MAAM,CAAC;IAClB,0DAA0D;IAC1D,SAAS,CAAC,mBAAmB,EAAE,YAAY,GAAG,OAAO,CAAC;IACtD,GAAG,CAAC,OAAO,EAAE,mCAAmC,GAAG,OAAO,CAAC,mCAAmC,CAAC,CAAC;CACjG;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBACa,mDAAmD;IAC9D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAsC;IAE9D;;;OAGG;IACI,QAAQ,CAAC,MAAM,EAAE,4BAA4B,GAAG,IAAI;IAS3D,6FAA6F;IACtF,UAAU,CAAC,mBAAmB,EAAE,YAAY,GAAG,4BAA4B,EAAE;IAIpF;;;;;;OAMG;IACU,MAAM,CACjB,OAAO,EAAE,mCAAmC,EAC5C,WAAW,GAAE,MAAU,GACtB,OAAO,CAAC,mCAAmC,EAAE,CAAC;YAWnC,MAAM;CAgCrB;AAED;;;;;;GAMG;AACH,wBAAgB,+BAA+B,CAC7C,QAAQ,EAAE,SAAS,mCAAmC,EAAE,GACvD,mCAAmC,EAAE,CAEvC"}

package/dist/esm/compliance/privacy/services/subject-session-revocation.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"subject-session-revocation.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/compliance/privacy/services/subject-session-revocation.backend.service.ts"],"names":[],"mappings":"AAEA,oHAAoH;AACpH,MAAM,MAAM,qBAAqB,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAEtE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBACa,sCAAsC;IACjD,OAAO,CAAC,OAAO,CAAsC;IAErD;;;;OAIG;IACI,QAAQ,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI;IAIrD,sGAAsG;IACtG,IAAW,YAAY,IAAI,OAAO,CAEjC;IAED;;;;;;OAMG;IACU,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CASrE"}
+{"version":3,"file":"subject-session-revocation.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/services/subject-session-revocation.backend.service.ts"],"names":[],"mappings":"AAEA,oHAAoH;AACpH,MAAM,MAAM,qBAAqB,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAEtE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBACa,sCAAsC;IACjD,OAAO,CAAC,OAAO,CAAsC;IAErD;;;;OAIG;IACI,QAAQ,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI;IAIrD,sGAAsG;IACtG,IAAW,YAAY,IAAI,OAAO,CAEjC;IAED;;;;;;OAMG;IACU,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CASrE"}

package/dist/esm/config/bootstrap/application-runtime-profile.backend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"application-runtime-profile.backend.d.ts","sourceRoot":"","sources":["../../../../../src/config/bootstrap/application-runtime-profile.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,oBAAY,yBAAyB;IACnC;;;;;;;OAOG;IACH,mBAAmB,wBAAwB;IAC3C;;;;;OAKG;IACH,MAAM,WAAW;CAClB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,uCAAuC;IACtD;;;;;;;;OAQG;IACH,2CAA2C,EAAE,OAAO,CAAC;IACrD;;;;;;;;;OASG;IACH,sCAAsC,EAAE,OAAO,CAAC;IAChD;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,kCAAkC,EAAE,OAAO,CAAC;IAC5C;;;OAGG;IACH,oCAAoC,EAAE,OAAO,CAAC;IAC9C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACH,6BAA6B,EAAE,OAAO,CAAC;IAEvC;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,qCAAqC,EAAE,OAAO,CAAC;IAC/C;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,sCAAsC,EAAE,OAAO,CAAC;CACjD;AAED;;;;;;;GAOG;AACH,wBAAgB,8CAA8C,CAC5D,OAAO,EAAE,yBAAyB,GACjC,uCAAuC,CA0DzC;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,8BAA8B;IAC7C;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,+BAA+B,EAAE,OAAO,CAAC;CAC1C;AAED;;;;GAIG;AACH,wBAAgB,qCAAqC,CACnD,OAAO,EAAE,yBAAyB,GACjC,8BAA8B,CAahC"}
+{"version":3,"file":"application-runtime-profile.backend.d.ts","sourceRoot":"","sources":["../../../../src/config/bootstrap/application-runtime-profile.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,oBAAY,yBAAyB;IACnC;;;;;;;OAOG;IACH,mBAAmB,wBAAwB;IAC3C;;;;;OAKG;IACH,MAAM,WAAW;CAClB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,uCAAuC;IACtD;;;;;;;;OAQG;IACH,2CAA2C,EAAE,OAAO,CAAC;IACrD;;;;;;;;;OASG;IACH,sCAAsC,EAAE,OAAO,CAAC;IAChD;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,kCAAkC,EAAE,OAAO,CAAC;IAC5C;;;OAGG;IACH,oCAAoC,EAAE,OAAO,CAAC;IAC9C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACH,6BAA6B,EAAE,OAAO,CAAC;IAEvC;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,qCAAqC,EAAE,OAAO,CAAC;IAC/C;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,sCAAsC,EAAE,OAAO,CAAC;CACjD;AAED;;;;;;;GAOG;AACH,wBAAgB,8CAA8C,CAC5D,OAAO,EAAE,yBAAyB,GACjC,uCAAuC,CA0DzC;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,8BAA8B;IAC7C;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,+BAA+B,EAAE,OAAO,CAAC;CAC1C;AAED;;;;GAIG;AACH,wBAAgB,qCAAqC,CACnD,OAAO,EAAE,yBAAyB,GACjC,8BAA8B,CAahC"}

package/dist/esm/config/bootstrap/application-runtime-profile.backend.js.map

@@ -1 +1 @@
-{"version":3,"file":"application-runtime-profile.backend.js","sourceRoot":"","sources":["../../../../../src/config/bootstrap/application-runtime-profile.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,MAAM,CAAN,IAAY,yBAiBX;AAjBD,WAAY,yBAAyB;IACnC;;;;;;;OAOG;IACH,wEAA2C,CAAA;IAC3C;;;;;OAKG;IACH,8CAAiB,CAAA;AACnB,CAAC,EAjBW,yBAAyB,KAAzB,yBAAyB,QAiBpC;AAoJD;;;;;;;GAOG;AACH,MAAM,UAAU,8CAA8C,CAC5D,OAAkC;IAElC,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,yBAAyB,CAAC,mBAAmB;YAChD,OAAO;gBACL,2CAA2C,EAAE,IAAI;gBACjD,sCAAsC,EAAE,IAAI;gBAC5C,yEAAyE;gBACzE,wEAAwE;gBACxE,0DAA0D;gBAC1D,kCAAkC,EAAE,IAAI;gBACxC,sFAAsF;gBACtF,yEAAyE;gBACzE,oCAAoC,EAAE,IAAI;gBAC1C,sEAAsE;gBACtE,mEAAmE;gBACnE,gBAAgB;gBAChB,6BAA6B,EAAE,IAAI;gBACnC,qCAAqC,EAAE,IAAI;gBAC3C,sCAAsC,EAAE,IAAI;aAC7C,CAAC;QACJ,KAAK,yBAAyB,CAAC,MAAM;YACnC,OAAO;gBACL,8DAA8D;gBAC9D,sEAAsE;gBACtE,qEAAqE;gBACrE,mCAAmC;gBACnC,2CAA2C,EAAE,KAAK;gBAClD,uEAAuE;gBACvE,sEAAsE;gBACtE,qEAAqE;gBACrE,4DAA4D;gBAC5D,sCAAsC,EAAE,KAAK;gBAC7C,uEAAuE;gBACvE,yEAAyE;gBACzE,0EAA0E;gBAC1E,uEAAuE;gBACvE,8BAA8B;gBAC9B,kCAAkC,EAAE,KAAK;gBACzC,wFAAwF;gBACxF,0FAA0F;gBAC1F,oCAAoC,EAAE,KAAK;gBAC3C,oEAAoE;gBACpE,yEAAyE;gBACzE,mEAAmE;gBACnE,mDAAmD;gBACnD,6BAA6B,EAAE,KAAK;gBACpC,qCAAqC,EAAE,KAAK;gBAC5C,yEAAyE;gBACzE,wEAAwE;gBACxE,sCAAsC,EAAE,KAAK;aAC9C,CAAC;QACJ,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,SAAS,GAAU,OAAO,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,wCAAwC,MAAM,CAAC,SAAS,CAAC,gEAAgE,CAC1H,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAyCD;;;;GAIG;AACH,MAAM,UAAU,qCAAqC,CACnD,OAAkC;IAElC,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,yBAAyB,CAAC,mBAAmB;YAChD,OAAO,EAAE,+BAA+B,EAAE,KAAK,EAAE,CAAC;QACpD,KAAK,yBAAyB,CAAC,MAAM;YACnC,OAAO,EAAE,+BAA+B,EAAE,IAAI,EAAE,CAAC;QACnD,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,SAAS,GAAU,OAAO,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,wCAAwC,MAAM,CAAC,SAAS,CAAC,8DAA8D,CACxH,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC","sourcesContent":["/**\n * WHICH RUNTIME is booting the shared application lifecycle, and WHICH BOOT\n * ASSERTIONS therefore apply to it.\n *\n * ## The problem this solves\n *\n * `StartApplicationBackendService` is booted by more than one kind of runtime.\n * Historically it had no notion of which one, so every boot-time validator ran\n * against every runtime — including validators asserting things that are\n * structurally meaningless for that runtime. Each time one fired, the fix was to\n * make the runtime CARRY the declaration it could never use, which pushed the\n * runtime further from its own semantics:\n *\n * - a minion mounts no MCP/A2A transport, yet had to declare every named\n *   resource-server instance or fail closed on `operation.mcp.servers`\n *   membership refs;\n * - a minion had to carry a binding for EVERY generated-PDF field in the whole\n *   application, including resources it can never touch.\n *\n * Both produced production-shaped crash-loops. The root cause is not the\n * individual declaration — it is that the framework had no way to ask *\"does\n * this assertion apply to the runtime I am booting?\"*.\n *\n * ## Not the same concept as the runtime-control flags\n *\n * `headlessMode` / `skipCronSync` / `skipJobConsumers` answer a different\n * question: **\"should I START this subsystem?\"** They are host-authored controls\n * over what gets wired up. A runtime profile answers **\"does this DECLARATION\n * CLASS apply to me at all?\"**. The two are deliberately not merged: a runtime\n * may legitimately skip starting the HTTP server while still wanting its\n * transport declarations validated (a validation-only boot, for instance).\n *\n * ## Not the same concept as `BackgroundRuntimeType`\n *\n * `BackgroundRuntimeType` (`MINION` | `WORKER`) is a *deployable runtime kind* —\n * a docker-compose service, a K8s workload, a provider-runtime scope. This enum\n * is about *boot-assertion applicability* inside a single process. Today the two\n * vocabularies partially overlap, but they answer different questions and must\n * not be collapsed because their members currently coincide. Notably, a WORKER\n * has no member here at all: workers never boot this lifecycle (they are\n * standalone by design, with no backing-service access), so giving them a\n * profile would invent a member with no referent.\n *\n * See `.claude/plans/minion-runtime-scope.md` (Step 2, OQ-2).\n */\nexport enum ApplicationRuntimeProfile {\n  /**\n   * The application's own backend service. Serves the full public surface — HTTP\n   * API, MCP servers, A2A agents, generated-PDF rendering — so every boot\n   * assertion applies to it. This is the default for any host that does not\n   * declare otherwise, which keeps the fail-closed direction correct: a new\n   * runtime that forgets to declare its profile is over-validated, never\n   * under-validated.\n   */\n  APPLICATION_BACKEND = 'application_backend',\n  /**\n   * A minion — a background digital worker of the application owner. Boots the\n   * shared lifecycle to obtain the resource graph, DI container, and provider\n   * bindings, but mounts no externally-addressable transport and serves no\n   * human-facing surface.\n   */\n  MINION = 'minion',\n}\n\n/**\n * Boot assertions whose applicability varies by runtime.\n *\n * Every trait is phrased as an ASSERTION the framework makes, not as a\n * capability the runtime has. That distinction is load-bearing: a minion may\n * well render a PDF, so the honest trait is not \"renders PDFs\" but \"is required\n * to carry a COMPLETE set of PDF bindings for the whole application\". Phrasing\n * these as capabilities would have quietly removed working functionality.\n */\nexport interface ApplicationRuntimeProfileBootAssertions {\n  /**\n   * Whether every `operation.mcp.servers` / agent `actorSystemRefs` membership\n   * ref must resolve to a declared resource-server instance.\n   *\n   * Applies only to runtimes that actually SERVE those transports. For a runtime\n   * that mounts none, an unresolvable ref describes a surface it does not\n   * expose — asserting on it fails a boot over a declaration that could never be\n   * read.\n   */\n  assertsResourceServerMembershipCompleteness: boolean;\n  /**\n   * Whether EVERY generated-PDF file field in the resource graph must have a\n   * backend binding.\n   *\n   * Deliberately narrow: this gates only the COMPLETENESS half of PDF binding\n   * validation. The coherence half — a binding declared for a field that is not\n   * a generated PDF field, or pointing at the wrong template id — always runs,\n   * for every runtime. What you DID declare must always be correct; being\n   * required to declare ALL of it is what varies.\n   */\n  assertsGeneratedPdfBindingCompleteness: boolean;\n  /**\n   * Whether this runtime is EXPECTED to host the Layer-2 audit provider fan-out,\n   * so an ENABLED `COMPLIANCE_AUDIT_TRAIL` capability that resolves NO provider is\n   * a genuine misconfiguration worth a startup warning — as opposed to the\n   * expected, by-design posture of a runtime that is legitimately Layer-1-only.\n   *\n   * Different in KIND from the two completeness assertions above: those gate\n   * fail-CLOSED boot validators that THROW. This gates a fail-OPEN diagnostic — a\n   * `logger.warn`, never a throw — because Layer-1 database audit is unaffected\n   * either way and the runtime still boots. What varies by profile is only whether\n   * \"enabled but nothing serves it\" is a SIGNAL or NOISE for this runtime.\n   *\n   * Only the application backend installs the Layer-2 audit sink — the immudb node\n   * client is present only there — and its `immudb.audit-reconcile` cron backfills\n   * every Layer-1 `AUDIT_LOGS` row, INCLUDING rows emitted by minions, into the\n   * Layer-2 ledger. So an auxiliary runtime resolving no audit provider is correct\n   * by construction; warning there is false-alarm noise on every restart that\n   * trains operators to ignore the channel. The backend resolving no provider is\n   * the real misconfiguration this diagnostic exists to surface — which is why the\n   * fail-closed default profile (`APPLICATION_BACKEND`) asserts it.\n   *\n   * assurance-control: WILDO.AUDIT.SECURITY_EVENT — the absence of the Layer-2\n   * provider audit fan-out is diagnosed on the runtime accountable for hosting it,\n   * and only there.\n   */\n  assertsLayer2AuditProviderPresence: boolean;\n  /**\n   * Whether ENABLED members of `ENGINE_CAPABILITIES_REQUIRING_A_PROVIDER_WHEN_ENABLED` must resolve a\n   * provider on this host (#328). The application's own `required` flags are asserted everywhere.\n   */\n  assertsEngineCapabilityProviderFloor: boolean;\n  /**\n   * Whether this runtime performs boot-time SCHEMA/DATA MAINTENANCE over the\n   * application's collections — the retention-marker backfill and the drifted\n   * unique-index reconciliation.\n   *\n   * Not a capability question (\"could it?\") but an ownership one (\"is it the\n   * runtime accountable for it?\"). Maintenance of this kind is application-WIDE\n   * and belongs to exactly one runtime:\n   *\n   * - it writes to every retention-governed collection, including ones a\n   *   confined runtime has no grant for and no business touching;\n   * - several runtimes doing it concurrently race each other over the same rows\n   *   and indexes for no benefit;\n   * - it is a migration, and a migration wants one owner.\n   *\n   * Covers THREE boot steps, and the third only became visible after the first\n   * two were gated: the retention-marker backfill, the drifted-unique-index\n   * reconciliation, and the declared-unique-index build+verification. The last\n   * one BUILDS as well as asserts — `mongooseModel.init()` creates a declared\n   * index, which is a write — so it belongs on the same side of the gate.\n   *\n   * Discovered the hard way (2026-08-12), twice in a row: once a minion's Mongo\n   * user became collection-scoped, its boot ran `updateMany` on `users` — a\n   * collection it had never declared — and crash-looped on `not authorized`.\n   * Gating that surfaced the next one immediately: `create: \"organizations\"`,\n   * 60 declared indexes it could not build and was not accountable for.\n   *\n   * The containment was right both times; the minion was doing the application\n   * backend's job. Granting `users` to a scraper to \"fix\" it would have inverted\n   * the whole point. The lesson generalises past these three: a boot step that\n   * WRITES to the application's schema belongs to the runtime that owns the\n   * schema, and adding one without asking which runtime owns it is how a\n   * confined runtime acquires an authority nobody intended.\n   */\n  performsBootSchemaMaintenance: boolean;\n\n  /**\n   * Whether this runtime OBSERVES the administrative-continuity floors at boot — the report that\n   * names organizations left without a usable owner, and applications left without a usable\n   * super-administrator.\n   *\n   * A separate assertion from {@link performsBootSchemaMaintenance} rather than a reuse of it,\n   * because the two are different authorities that happen to share a containment argument. One\n   * WRITES the application's schema; this one READS the application's whole administrative\n   * population. Collapsing them would make \"may this runtime repair the schema?\" and \"may this\n   * runtime audit who administers the tenant?\" one switch, and a future profile that wants one\n   * without the other would have nowhere to say so.\n   *\n   * FALSE for a confined runtime, for the reason `performsBootSchemaMaintenance` already generalises:\n   * the report reads `users` and `organizations` across the whole application, which a table-scoped\n   * role has neither the grants nor the accountability for. Observed 2026-08-24 on a clean-room\n   * PostgreSQL boot — `permission denied for table users` / `for table organizations`, twice per\n   * boot, from the marketing-scrapper minion. It never blocked the boot (the report is non-fatal by\n   * design), which is exactly why it survived: a recurring, ignorable error in a healthy startup.\n   *\n   * Note that the sibling's JSDoc had ALREADY named this hazard — \"granting `users` to a scraper to\n   * 'fix' it would have inverted the whole point\" — one boot step before it happened again. The\n   * lesson was recorded; the next step added simply did not consult it.\n   */\n  reportsAdministrativeContinuityFloors: boolean;\n  /**\n   * Whether this runtime PROVES at boot that its persistence adapter can commit\n   * the native transactions the application's authored boundaries require.\n   *\n   * The probe issues a transaction against a synthetic collection\n   * (`__wildo_transaction_readiness_probe`) that no `resourceAccess` declares or\n   * ever could, so a collection-scoped runtime is refused by construction.\n   *\n   * More importantly it proves an INFRASTRUCTURE property — \"does this Mongo\n   * deployment support multi-document transactions?\" — which is identical for\n   * every runtime pointed at that database, and which the application backend\n   * already proves. The boundaries it enumerates are the backend's too\n   * (`authentication.self-registration` is not something a minion serves; a\n   * minion is never a user, D15).\n   *\n   * Stated trade: a minion no longer fails FAST on a deployment whose adapter\n   * cannot do transactions — it would fail on its first transactional write\n   * instead. Acceptable because the backend fails fast on the same deployment,\n   * and because the alternative is granting every confined runtime access to a\n   * probe collection nobody declared.\n   */\n  assertsPersistenceTransactionReadiness: boolean;\n}\n\n/**\n * The single authority mapping a runtime profile to its boot assertions.\n *\n * Exhaustive by construction: the `never` fallthrough makes adding a profile\n * member a COMPILE error until its assertions are decided. That is the point —\n * the failure mode this whole mechanism exists to prevent is a new runtime\n * silently inheriting assertions nobody considered.\n */\nexport function resolveApplicationRuntimeProfileBootAssertions(\n  profile: ApplicationRuntimeProfile,\n): ApplicationRuntimeProfileBootAssertions {\n  switch (profile) {\n    case ApplicationRuntimeProfile.APPLICATION_BACKEND:\n      return {\n        assertsResourceServerMembershipCompleteness: true,\n        assertsGeneratedPdfBindingCompleteness: true,\n        // The backend is the SOLE host of the Layer-2 audit sink (immudb-node is\n        // installed only here), so an enabled audit capability with no resolved\n        // provider is a genuine misconfiguration it must surface.\n        assertsLayer2AuditProviderPresence: true,\n        // The backend is the host that SERVES email, billing and SMS, so an enabled slot with\n        // nothing behind it is a misconfiguration it must refuse at boot (#328).\n        assertsEngineCapabilityProviderFloor: true,\n        // The backend owns application-wide schema maintenance. It is the one\n        // runtime holding database-wide authority, and a migration wants a\n        // single owner.\n        performsBootSchemaMaintenance: true,\n        reportsAdministrativeContinuityFloors: true,\n        assertsPersistenceTransactionReadiness: true,\n      };\n    case ApplicationRuntimeProfile.MINION:\n      return {\n        // A minion mounts no MCP/A2A transport. It does not carry the\n        // declarations at all (they are excluded from the minion projection),\n        // so asserting membership against an empty registry would fail every\n        // ref the resource graph declares.\n        assertsResourceServerMembershipCompleteness: false,\n        // A minion carries the application's PDF bindings and CAN render a PDF\n        // if one is bound. What it is not required to do is account for every\n        // generated-PDF field in the application, including on resources its\n        // `resourceAccess` whitelist forbids it from ever touching.\n        assertsGeneratedPdfBindingCompleteness: false,\n        // A minion is Layer-1-only by design: it never hosts the Layer-2 audit\n        // fan-out, and the backend's `immudb.audit-reconcile` cron backfills the\n        // minion's `AUDIT_LOGS` rows into Layer-2. Resolving no audit provider is\n        // therefore correct, not a misconfiguration — warning on every restart\n        // would be false-alarm noise.\n        assertsLayer2AuditProviderPresence: false,\n        // A minion's registry is filtered to ITS scope; the backend serves the engine flows, so\n        // an enabled email/billing/SMS slot resolving nothing here is the normal topology (#328).\n        assertsEngineCapabilityProviderFloor: false,\n        // A minion must NOT. Its database user is collection-scoped to what\n        // `resourceAccess` declared, so a backfill over every retention-governed\n        // collection is both unauthorised and not its concern. The backend\n        // performs it; the minion simply reads the result.\n        performsBootSchemaMaintenance: false,\n        reportsAdministrativeContinuityFloors: false,\n        // Same reason, one layer up: the probe touches a synthetic collection no\n        // grant covers, and proves a deployment-wide property the backend owns.\n        assertsPersistenceTransactionReadiness: false,\n      };\n    default: {\n      const unhandled: never = profile;\n      throw new Error(\n        `Unhandled ApplicationRuntimeProfile '${String(unhandled)}' — every profile must declare its boot assertions explicitly.`,\n      );\n    }\n  }\n}\n\n/**\n * Runtime access policy — how this runtime's PRIVILEGED accesses behave while it runs.\n *\n * Deliberately separate from {@link ApplicationRuntimeProfileBootAssertions}: boot\n * assertions are evaluated once, at startup, and answer \"is this configuration\n * coherent for me?\". This answers \"what must hold every time I exercise privilege?\",\n * which is a different lifecycle and a different failure mode. Folding them together\n * would mean a boot-time concern and a per-call concern share a shape and drift into\n * each other.\n */\nexport interface ApplicationRuntimeAccessPolicy {\n  /**\n   * Whether a privileged system-access READ must be PROVABLY audited before its data\n   * is handed to the caller — i.e. if the audit cannot be written, the caller does not\n   * get the data.\n   *\n   * This is the fail-closed half of the accountable-bypass doctrine (D9 + OQ-5). The\n   * system-access door legitimately bypasses per-tenant authorization; what makes that\n   * acceptable for a non-human background worker is that every passage leaves evidence.\n   * An accountable bypass that stops being recorded is just a bypass.\n   *\n   * Scoped to the MINION profile ONLY, deliberately. Applying it to the application\n   * backend would make the framework's most common internal read path depend on audit\n   * availability — converting an audit hiccup into an application-wide outage, a\n   * self-inflicted denial of service. A minion's privileged reads are the elevated,\n   * least frequent, least latency-sensitive case, which is exactly where the trade\n   * favours accountability over availability.\n   *\n   * READS only. A write cannot be unwound by refusing to report it — its audit is\n   * already deferred to the transaction's post-commit queue, so failing afterwards\n   * would leave the mutation committed AND the caller erroring, inviting a retry that\n   * duplicates it. See the plan's Step 3b limitations.\n   *\n   * assurance-control: WILDO.AUDIT.SECURITY_EVENT — privileged access by a non-human\n   * runtime is not merely audited, it is audited or refused.\n   */\n  requiresAccountableSystemAccess: boolean;\n}\n\n/**\n * The single authority mapping a runtime profile to its access policy. Exhaustive by\n * construction for the same reason as the boot-assertion resolver: a new runtime must\n * DECIDE this, never inherit it by omission.\n */\nexport function resolveApplicationRuntimeAccessPolicy(\n  profile: ApplicationRuntimeProfile,\n): ApplicationRuntimeAccessPolicy {\n  switch (profile) {\n    case ApplicationRuntimeProfile.APPLICATION_BACKEND:\n      return { requiresAccountableSystemAccess: false };\n    case ApplicationRuntimeProfile.MINION:\n      return { requiresAccountableSystemAccess: true };\n    default: {\n      const unhandled: never = profile;\n      throw new Error(\n        `Unhandled ApplicationRuntimeProfile '${String(unhandled)}' — every profile must declare its access policy explicitly.`,\n      );\n    }\n  }\n}\n"]}
+{"version":3,"file":"application-runtime-profile.backend.js","sourceRoot":"","sources":["../../../../src/config/bootstrap/application-runtime-profile.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,MAAM,CAAN,IAAY,yBAiBX;AAjBD,WAAY,yBAAyB;IACnC;;;;;;;OAOG;IACH,wEAA2C,CAAA;IAC3C;;;;;OAKG;IACH,8CAAiB,CAAA;AACnB,CAAC,EAjBW,yBAAyB,KAAzB,yBAAyB,QAiBpC;AAoJD;;;;;;;GAOG;AACH,MAAM,UAAU,8CAA8C,CAC5D,OAAkC;IAElC,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,yBAAyB,CAAC,mBAAmB;YAChD,OAAO;gBACL,2CAA2C,EAAE,IAAI;gBACjD,sCAAsC,EAAE,IAAI;gBAC5C,yEAAyE;gBACzE,wEAAwE;gBACxE,0DAA0D;gBAC1D,kCAAkC,EAAE,IAAI;gBACxC,sFAAsF;gBACtF,yEAAyE;gBACzE,oCAAoC,EAAE,IAAI;gBAC1C,sEAAsE;gBACtE,mEAAmE;gBACnE,gBAAgB;gBAChB,6BAA6B,EAAE,IAAI;gBACnC,qCAAqC,EAAE,IAAI;gBAC3C,sCAAsC,EAAE,IAAI;aAC7C,CAAC;QACJ,KAAK,yBAAyB,CAAC,MAAM;YACnC,OAAO;gBACL,8DAA8D;gBAC9D,sEAAsE;gBACtE,qEAAqE;gBACrE,mCAAmC;gBACnC,2CAA2C,EAAE,KAAK;gBAClD,uEAAuE;gBACvE,sEAAsE;gBACtE,qEAAqE;gBACrE,4DAA4D;gBAC5D,sCAAsC,EAAE,KAAK;gBAC7C,uEAAuE;gBACvE,yEAAyE;gBACzE,0EAA0E;gBAC1E,uEAAuE;gBACvE,8BAA8B;gBAC9B,kCAAkC,EAAE,KAAK;gBACzC,wFAAwF;gBACxF,0FAA0F;gBAC1F,oCAAoC,EAAE,KAAK;gBAC3C,oEAAoE;gBACpE,yEAAyE;gBACzE,mEAAmE;gBACnE,mDAAmD;gBACnD,6BAA6B,EAAE,KAAK;gBACpC,qCAAqC,EAAE,KAAK;gBAC5C,yEAAyE;gBACzE,wEAAwE;gBACxE,sCAAsC,EAAE,KAAK;aAC9C,CAAC;QACJ,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,SAAS,GAAU,OAAO,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,wCAAwC,MAAM,CAAC,SAAS,CAAC,gEAAgE,CAC1H,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAyCD;;;;GAIG;AACH,MAAM,UAAU,qCAAqC,CACnD,OAAkC;IAElC,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,yBAAyB,CAAC,mBAAmB;YAChD,OAAO,EAAE,+BAA+B,EAAE,KAAK,EAAE,CAAC;QACpD,KAAK,yBAAyB,CAAC,MAAM;YACnC,OAAO,EAAE,+BAA+B,EAAE,IAAI,EAAE,CAAC;QACnD,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,SAAS,GAAU,OAAO,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,wCAAwC,MAAM,CAAC,SAAS,CAAC,8DAA8D,CACxH,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC","sourcesContent":["/**\n * WHICH RUNTIME is booting the shared application lifecycle, and WHICH BOOT\n * ASSERTIONS therefore apply to it.\n *\n * ## The problem this solves\n *\n * `StartApplicationBackendService` is booted by more than one kind of runtime.\n * Historically it had no notion of which one, so every boot-time validator ran\n * against every runtime — including validators asserting things that are\n * structurally meaningless for that runtime. Each time one fired, the fix was to\n * make the runtime CARRY the declaration it could never use, which pushed the\n * runtime further from its own semantics:\n *\n * - a minion mounts no MCP/A2A transport, yet had to declare every named\n *   resource-server instance or fail closed on `operation.mcp.servers`\n *   membership refs;\n * - a minion had to carry a binding for EVERY generated-PDF field in the whole\n *   application, including resources it can never touch.\n *\n * Both produced production-shaped crash-loops. The root cause is not the\n * individual declaration — it is that the framework had no way to ask *\"does\n * this assertion apply to the runtime I am booting?\"*.\n *\n * ## Not the same concept as the runtime-control flags\n *\n * `headlessMode` / `skipCronSync` / `skipJobConsumers` answer a different\n * question: **\"should I START this subsystem?\"** They are host-authored controls\n * over what gets wired up. A runtime profile answers **\"does this DECLARATION\n * CLASS apply to me at all?\"**. The two are deliberately not merged: a runtime\n * may legitimately skip starting the HTTP server while still wanting its\n * transport declarations validated (a validation-only boot, for instance).\n *\n * ## Not the same concept as `BackgroundRuntimeType`\n *\n * `BackgroundRuntimeType` (`MINION` | `WORKER`) is a *deployable runtime kind* —\n * a docker-compose service, a K8s workload, a provider-runtime scope. This enum\n * is about *boot-assertion applicability* inside a single process. Today the two\n * vocabularies partially overlap, but they answer different questions and must\n * not be collapsed because their members currently coincide. Notably, a WORKER\n * has no member here at all: workers never boot this lifecycle (they are\n * standalone by design, with no backing-service access), so giving them a\n * profile would invent a member with no referent.\n *\n * See `.claude/plans/minion-runtime-scope.md` (Step 2, OQ-2).\n */\nexport enum ApplicationRuntimeProfile {\n  /**\n   * The application's own backend service. Serves the full public surface — HTTP\n   * API, MCP servers, A2A agents, generated-PDF rendering — so every boot\n   * assertion applies to it. This is the default for any host that does not\n   * declare otherwise, which keeps the fail-closed direction correct: a new\n   * runtime that forgets to declare its profile is over-validated, never\n   * under-validated.\n   */\n  APPLICATION_BACKEND = 'application_backend',\n  /**\n   * A minion — a background digital worker of the application owner. Boots the\n   * shared lifecycle to obtain the resource graph, DI container, and provider\n   * bindings, but mounts no externally-addressable transport and serves no\n   * human-facing surface.\n   */\n  MINION = 'minion',\n}\n\n/**\n * Boot assertions whose applicability varies by runtime.\n *\n * Every trait is phrased as an ASSERTION the framework makes, not as a\n * capability the runtime has. That distinction is load-bearing: a minion may\n * well render a PDF, so the honest trait is not \"renders PDFs\" but \"is required\n * to carry a COMPLETE set of PDF bindings for the whole application\". Phrasing\n * these as capabilities would have quietly removed working functionality.\n */\nexport interface ApplicationRuntimeProfileBootAssertions {\n  /**\n   * Whether every `operation.mcp.servers` / agent `actorSystemRefs` membership\n   * ref must resolve to a declared resource-server instance.\n   *\n   * Applies only to runtimes that actually SERVE those transports. For a runtime\n   * that mounts none, an unresolvable ref describes a surface it does not\n   * expose — asserting on it fails a boot over a declaration that could never be\n   * read.\n   */\n  assertsResourceServerMembershipCompleteness: boolean;\n  /**\n   * Whether EVERY generated-PDF file field in the resource graph must have a\n   * backend binding.\n   *\n   * Deliberately narrow: this gates only the COMPLETENESS half of PDF binding\n   * validation. The coherence half — a binding declared for a field that is not\n   * a generated PDF field, or pointing at the wrong template id — always runs,\n   * for every runtime. What you DID declare must always be correct; being\n   * required to declare ALL of it is what varies.\n   */\n  assertsGeneratedPdfBindingCompleteness: boolean;\n  /**\n   * Whether this runtime is EXPECTED to host the Layer-2 audit provider fan-out,\n   * so an ENABLED `COMPLIANCE_AUDIT_TRAIL` capability that resolves NO provider is\n   * a genuine misconfiguration worth a startup warning — as opposed to the\n   * expected, by-design posture of a runtime that is legitimately Layer-1-only.\n   *\n   * Different in KIND from the two completeness assertions above: those gate\n   * fail-CLOSED boot validators that THROW. This gates a fail-OPEN diagnostic — a\n   * `logger.warn`, never a throw — because Layer-1 database audit is unaffected\n   * either way and the runtime still boots. What varies by profile is only whether\n   * \"enabled but nothing serves it\" is a SIGNAL or NOISE for this runtime.\n   *\n   * Only the application backend installs the Layer-2 audit sink — the immudb node\n   * client is present only there — and its `immudb.audit-reconcile` cron backfills\n   * every Layer-1 `AUDIT_LOGS` row, INCLUDING rows emitted by minions, into the\n   * Layer-2 ledger. So an auxiliary runtime resolving no audit provider is correct\n   * by construction; warning there is false-alarm noise on every restart that\n   * trains operators to ignore the channel. The backend resolving no provider is\n   * the real misconfiguration this diagnostic exists to surface — which is why the\n   * fail-closed default profile (`APPLICATION_BACKEND`) asserts it.\n   *\n   * assurance-control: WILDO.AUDIT.SECURITY_EVENT — the absence of the Layer-2\n   * provider audit fan-out is diagnosed on the runtime accountable for hosting it,\n   * and only there.\n   */\n  assertsLayer2AuditProviderPresence: boolean;\n  /**\n   * Whether ENABLED members of `ENGINE_CAPABILITIES_REQUIRING_A_PROVIDER_WHEN_ENABLED` must resolve a\n   * provider on this host (#328). The application's own `required` flags are asserted everywhere.\n   */\n  assertsEngineCapabilityProviderFloor: boolean;\n  /**\n   * Whether this runtime performs boot-time SCHEMA/DATA MAINTENANCE over the\n   * application's collections — the retention-marker backfill and the drifted\n   * unique-index reconciliation.\n   *\n   * Not a capability question (\"could it?\") but an ownership one (\"is it the\n   * runtime accountable for it?\"). Maintenance of this kind is application-WIDE\n   * and belongs to exactly one runtime:\n   *\n   * - it writes to every retention-governed collection, including ones a\n   *   confined runtime has no grant for and no business touching;\n   * - several runtimes doing it concurrently race each other over the same rows\n   *   and indexes for no benefit;\n   * - it is a migration, and a migration wants one owner.\n   *\n   * Covers THREE boot steps, and the third only became visible after the first\n   * two were gated: the retention-marker backfill, the drifted-unique-index\n   * reconciliation, and the declared-unique-index build+verification. The last\n   * one BUILDS as well as asserts — `mongooseModel.init()` creates a declared\n   * index, which is a write — so it belongs on the same side of the gate.\n   *\n   * Discovered the hard way (2026-08-12), twice in a row: once a minion's Mongo\n   * user became collection-scoped, its boot ran `updateMany` on `users` — a\n   * collection it had never declared — and crash-looped on `not authorized`.\n   * Gating that surfaced the next one immediately: `create: \"organizations\"`,\n   * 60 declared indexes it could not build and was not accountable for.\n   *\n   * The containment was right both times; the minion was doing the application\n   * backend's job. Granting `users` to a scraper to \"fix\" it would have inverted\n   * the whole point. The lesson generalises past these three: a boot step that\n   * WRITES to the application's schema belongs to the runtime that owns the\n   * schema, and adding one without asking which runtime owns it is how a\n   * confined runtime acquires an authority nobody intended.\n   */\n  performsBootSchemaMaintenance: boolean;\n\n  /**\n   * Whether this runtime OBSERVES the administrative-continuity floors at boot — the report that\n   * names organizations left without a usable owner, and applications left without a usable\n   * super-administrator.\n   *\n   * A separate assertion from {@link performsBootSchemaMaintenance} rather than a reuse of it,\n   * because the two are different authorities that happen to share a containment argument. One\n   * WRITES the application's schema; this one READS the application's whole administrative\n   * population. Collapsing them would make \"may this runtime repair the schema?\" and \"may this\n   * runtime audit who administers the tenant?\" one switch, and a future profile that wants one\n   * without the other would have nowhere to say so.\n   *\n   * FALSE for a confined runtime, for the reason `performsBootSchemaMaintenance` already generalises:\n   * the report reads `users` and `organizations` across the whole application, which a table-scoped\n   * role has neither the grants nor the accountability for. Observed 2026-08-24 on a clean-room\n   * PostgreSQL boot — `permission denied for table users` / `for table organizations`, twice per\n   * boot, from the marketing-scrapper minion. It never blocked the boot (the report is non-fatal by\n   * design), which is exactly why it survived: a recurring, ignorable error in a healthy startup.\n   *\n   * Note that the sibling's JSDoc had ALREADY named this hazard — \"granting `users` to a scraper to\n   * 'fix' it would have inverted the whole point\" — one boot step before it happened again. The\n   * lesson was recorded; the next step added simply did not consult it.\n   */\n  reportsAdministrativeContinuityFloors: boolean;\n  /**\n   * Whether this runtime PROVES at boot that its persistence adapter can commit\n   * the native transactions the application's authored boundaries require.\n   *\n   * The probe issues a transaction against a synthetic collection\n   * (`__wildo_transaction_readiness_probe`) that no `resourceAccess` declares or\n   * ever could, so a collection-scoped runtime is refused by construction.\n   *\n   * More importantly it proves an INFRASTRUCTURE property — \"does this Mongo\n   * deployment support multi-document transactions?\" — which is identical for\n   * every runtime pointed at that database, and which the application backend\n   * already proves. The boundaries it enumerates are the backend's too\n   * (`authentication.self-registration` is not something a minion serves; a\n   * minion is never a user, D15).\n   *\n   * Stated trade: a minion no longer fails FAST on a deployment whose adapter\n   * cannot do transactions — it would fail on its first transactional write\n   * instead. Acceptable because the backend fails fast on the same deployment,\n   * and because the alternative is granting every confined runtime access to a\n   * probe collection nobody declared.\n   */\n  assertsPersistenceTransactionReadiness: boolean;\n}\n\n/**\n * The single authority mapping a runtime profile to its boot assertions.\n *\n * Exhaustive by construction: the `never` fallthrough makes adding a profile\n * member a COMPILE error until its assertions are decided. That is the point —\n * the failure mode this whole mechanism exists to prevent is a new runtime\n * silently inheriting assertions nobody considered.\n */\nexport function resolveApplicationRuntimeProfileBootAssertions(\n  profile: ApplicationRuntimeProfile,\n): ApplicationRuntimeProfileBootAssertions {\n  switch (profile) {\n    case ApplicationRuntimeProfile.APPLICATION_BACKEND:\n      return {\n        assertsResourceServerMembershipCompleteness: true,\n        assertsGeneratedPdfBindingCompleteness: true,\n        // The backend is the SOLE host of the Layer-2 audit sink (immudb-node is\n        // installed only here), so an enabled audit capability with no resolved\n        // provider is a genuine misconfiguration it must surface.\n        assertsLayer2AuditProviderPresence: true,\n        // The backend is the host that SERVES email, billing and SMS, so an enabled slot with\n        // nothing behind it is a misconfiguration it must refuse at boot (#328).\n        assertsEngineCapabilityProviderFloor: true,\n        // The backend owns application-wide schema maintenance. It is the one\n        // runtime holding database-wide authority, and a migration wants a\n        // single owner.\n        performsBootSchemaMaintenance: true,\n        reportsAdministrativeContinuityFloors: true,\n        assertsPersistenceTransactionReadiness: true,\n      };\n    case ApplicationRuntimeProfile.MINION:\n      return {\n        // A minion mounts no MCP/A2A transport. It does not carry the\n        // declarations at all (they are excluded from the minion projection),\n        // so asserting membership against an empty registry would fail every\n        // ref the resource graph declares.\n        assertsResourceServerMembershipCompleteness: false,\n        // A minion carries the application's PDF bindings and CAN render a PDF\n        // if one is bound. What it is not required to do is account for every\n        // generated-PDF field in the application, including on resources its\n        // `resourceAccess` whitelist forbids it from ever touching.\n        assertsGeneratedPdfBindingCompleteness: false,\n        // A minion is Layer-1-only by design: it never hosts the Layer-2 audit\n        // fan-out, and the backend's `immudb.audit-reconcile` cron backfills the\n        // minion's `AUDIT_LOGS` rows into Layer-2. Resolving no audit provider is\n        // therefore correct, not a misconfiguration — warning on every restart\n        // would be false-alarm noise.\n        assertsLayer2AuditProviderPresence: false,\n        // A minion's registry is filtered to ITS scope; the backend serves the engine flows, so\n        // an enabled email/billing/SMS slot resolving nothing here is the normal topology (#328).\n        assertsEngineCapabilityProviderFloor: false,\n        // A minion must NOT. Its database user is collection-scoped to what\n        // `resourceAccess` declared, so a backfill over every retention-governed\n        // collection is both unauthorised and not its concern. The backend\n        // performs it; the minion simply reads the result.\n        performsBootSchemaMaintenance: false,\n        reportsAdministrativeContinuityFloors: false,\n        // Same reason, one layer up: the probe touches a synthetic collection no\n        // grant covers, and proves a deployment-wide property the backend owns.\n        assertsPersistenceTransactionReadiness: false,\n      };\n    default: {\n      const unhandled: never = profile;\n      throw new Error(\n        `Unhandled ApplicationRuntimeProfile '${String(unhandled)}' — every profile must declare its boot assertions explicitly.`,\n      );\n    }\n  }\n}\n\n/**\n * Runtime access policy — how this runtime's PRIVILEGED accesses behave while it runs.\n *\n * Deliberately separate from {@link ApplicationRuntimeProfileBootAssertions}: boot\n * assertions are evaluated once, at startup, and answer \"is this configuration\n * coherent for me?\". This answers \"what must hold every time I exercise privilege?\",\n * which is a different lifecycle and a different failure mode. Folding them together\n * would mean a boot-time concern and a per-call concern share a shape and drift into\n * each other.\n */\nexport interface ApplicationRuntimeAccessPolicy {\n  /**\n   * Whether a privileged system-access READ must be PROVABLY audited before its data\n   * is handed to the caller — i.e. if the audit cannot be written, the caller does not\n   * get the data.\n   *\n   * This is the fail-closed half of the accountable-bypass doctrine (D9 + OQ-5). The\n   * system-access door legitimately bypasses per-tenant authorization; what makes that\n   * acceptable for a non-human background worker is that every passage leaves evidence.\n   * An accountable bypass that stops being recorded is just a bypass.\n   *\n   * Scoped to the MINION profile ONLY, deliberately. Applying it to the application\n   * backend would make the framework's most common internal read path depend on audit\n   * availability — converting an audit hiccup into an application-wide outage, a\n   * self-inflicted denial of service. A minion's privileged reads are the elevated,\n   * least frequent, least latency-sensitive case, which is exactly where the trade\n   * favours accountability over availability.\n   *\n   * READS only. A write cannot be unwound by refusing to report it — its audit is\n   * already deferred to the transaction's post-commit queue, so failing afterwards\n   * would leave the mutation committed AND the caller erroring, inviting a retry that\n   * duplicates it. See the plan's Step 3b limitations.\n   *\n   * assurance-control: WILDO.AUDIT.SECURITY_EVENT — privileged access by a non-human\n   * runtime is not merely audited, it is audited or refused.\n   */\n  requiresAccountableSystemAccess: boolean;\n}\n\n/**\n * The single authority mapping a runtime profile to its access policy. Exhaustive by\n * construction for the same reason as the boot-assertion resolver: a new runtime must\n * DECIDE this, never inherit it by omission.\n */\nexport function resolveApplicationRuntimeAccessPolicy(\n  profile: ApplicationRuntimeProfile,\n): ApplicationRuntimeAccessPolicy {\n  switch (profile) {\n    case ApplicationRuntimeProfile.APPLICATION_BACKEND:\n      return { requiresAccountableSystemAccess: false };\n    case ApplicationRuntimeProfile.MINION:\n      return { requiresAccountableSystemAccess: true };\n    default: {\n      const unhandled: never = profile;\n      throw new Error(\n        `Unhandled ApplicationRuntimeProfile '${String(unhandled)}' — every profile must declare its access policy explicitly.`,\n      );\n    }\n  }\n}\n"]}