npm - @wildo-ai/saas-models - Versions diffs - 1.1.0 → 1.1.2 - Mend

@wildo-ai/saas-models 1.1.0 → 1.1.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (292) hide show

package/dist/esm/billing/usage-record.shared.schemas.d.ts CHANGED Viewed

@@ -20,8 +20,8 @@ import { UsageSourceType } from './billing-enums.shared.schemas';
 export declare const UsageRecordSchema: z.ZodObject<{
     _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
     billingAccountId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
-    productKey: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
-    quantity: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodNumber>>;
+    productKey: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
+    quantity: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodNumber>;
     timestamp: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDate>>>;
     source: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodObject<{
         type: z.ZodEnum<typeof UsageSourceType>;
@@ -38,8 +38,8 @@ export type UsageRecord = z.infer<typeof UsageRecordSchema>;
 export declare const usageRecordsPolymorphicDeclaration: import("..").PolymorphicSchemaDeclaration<z.ZodObject<{
     _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
     billingAccountId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
-    productKey: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
-    quantity: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodNumber>>;
+    productKey: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
+    quantity: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodNumber>;
     timestamp: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDate>>>;
     source: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodObject<{
         type: z.ZodEnum<typeof UsageSourceType>;

package/dist/esm/billing/usage-record.shared.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"usage-record.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/billing/usage-record.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;~~AAIxB~~,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAEjE,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;~~iBA8C5B~~,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAI5D,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;kBAQ7C,CAAC"}
1	+ {"version":3,"file":"usage-record.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/billing/usage-record.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAEjE,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;iBAmD5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAI5D,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;kBAQ7C,CAAC"}

package/dist/esm/billing/usage-record.shared.schemas.js CHANGED Viewed

@@ -16,7 +16,6 @@
  * @see billing-and-features-system.md §6.6 (Usage Records)
  */
 import { z } from 'zod';
-import { PersonalDataCategory } from '../compliance/privacy/personal-data-category.shared.schemas.js';
 import { declarePolymorphicSchemas, optOutPolymorphicAutoBusinessKey } from '../resources/utils/resource-polymorphism.schemas.js';
 import { BILLING_SCOPE_VARIANTS, BILLING_SCOPE_FK_VARIANTS } from './billing-account.shared.schemas.js';
 import { UsageSourceType } from './billing-enums.shared.schemas.js';
@@ -24,11 +23,16 @@ export const UsageRecordSchema = z.object({
     _id: z.string().min(1).isPrimaryKey(),
     billingAccountId: z.string().min(1).isForeignKey({ polymorphicVariants: BILLING_SCOPE_FK_VARIANTS }).isDBIndexed().isSummaryField(),
     /** Product key for grouping/lookup (matches ProductDefinition.key) */
-    productKey: z.string().min(1).isDBIndexed().isSummaryField().isNotEditable().dataCategories(PersonalDataCategory.USAGE),
+    // No `.dataCategories()`: this is an amount/term about the ACCOUNT, not a description of a person.
+    // The person is the scope foreign key, which the never-scrub floor preserves in every mode, and the
+    // value must survive erasure for the tax/audit obligation this family exists to serve — so it can be
+    // neither scrubbed nor honestly declared as personal data the row holds. See `retentionPolicy` on the
+    // resource config (#138).
+    productKey: z.string().min(1).isDBIndexed().isSummaryField().isNotEditable(),
     /** Usage quantity */
     // USAGE, not FINANCIAL. A metered quantity is what the person DID in the product; the money it
     // becomes lives on the invoice. Two different sentences in a notice, and they read differently.
-    quantity: z.number().min(0).isSummaryField().dataCategories(PersonalDataCategory.USAGE),
+    quantity: z.number().min(0).isSummaryField(),
     /** When the usage occurred */
     timestamp: z.date().isDBIndexed().isSummaryField().isNotEditable(),
     /** What generated this usage */

package/dist/esm/billing/usage-record.shared.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"usage-record.shared.schemas.js","sourceRoot":"","sources":["../../../../src/billing/usage-record.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,~~oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AACnG,OAAO,EAAE,~~yBAAyB,EAAE,gCAAgC,EAAE,MAAM,kDAAkD,CAAC;AAC/H,OAAO,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AACrG,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAEjE,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE;IACrC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IACnI,sEAAsE;IACtE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,aAAa,EAAE~~,CAAC,cAAc,CAAC,oBAAoB,CAAC,KAAK,CAAC~~;~~IAEvH~~,qBAAqB;IACrB,+FAA+F;IAC/F,gGAAgG;IAChG,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE~~,CAAC,cAAc,CAAC,oBAAoB,CAAC,KAAK,CAAC~~;~~IACvF~~,8BAA8B;IAC9B,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,aAAa,EAAE;IAElE,gCAAgC;IAChC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;QAC7B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACnC,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC1C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACnC,CAAC,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;IAE7B,6DAA6D;IAC7D,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,aAAa,EAAE;IAC5E,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;IAE/C;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAGH,sEAAsE;AAEtE,MAAM,CAAC,MAAM,kCAAkC,GAAG,yBAAyB,CAAC;IAC1E,gBAAgB,EAAE,cAAc;IAChC,mBAAmB,EAAE,eAAe;IACpC,WAAW,EAAE,eAAe;IAC5B,UAAU,EAAE,iBAAiB;IAC7B,2EAA2E;IAC3E,iDAAiD;IACjD,QAAQ,EAAE,sBAAsB,CAAC,GAAG,CAAC,gCAAgC,CAAC;CACvE,CAAC,CAAC","sourcesContent":["/*\n Usage Record Schema (Shared) — Polymorphic\n \n Tracks metered usage for METERED products. The current metering service groups\n * unreported rows by billing account and product when its scheduled flush runs.\n * `ProductBehaviorPolicy.metering` is an authored policy surface, but the current\n * flush scheduler does not consume its interval, window or retry members; do not\n * present those values as an effective reporting schedule until that runtime join exists.\n \n POLYMORPHIC EXPANSION: Like subscriptions, usage records are scope-expanded.\n * The `billingAccountId` FK is renamed per variant via polymorphic FK transformation:\n * - organizationUsageRecords (with organizationId + organizationBillingAccountId)\n * - userUsageRecords (with userId + userBillingAccountId)\n \n \n * @see billing-and-features-system.md §6.6 (Usage Records)\n /\n\nimport { z } from 'zod';\nimport { ~~PersonalDataCategory } from '../compliance/privacy/personal-data-category.shared.schemas';\nimport {~~ declarePolymorphicSchemas, optOutPolymorphicAutoBusinessKey } from '../resources/utils/resource-polymorphism.schemas';\nimport { BILLING_SCOPE_VARIANTS, BILLING_SCOPE_FK_VARIANTS } from './billing-account.shared.schemas';\nimport { UsageSourceType } from './billing-enums.shared.schemas';\n\nexport const UsageRecordSchema = z.object({\n _id: z.string().min(1).isPrimaryKey(),\n billingAccountId: z.string().min(1).isForeignKey({ polymorphicVariants: BILLING_SCOPE_FK_VARIANTS }).isDBIndexed().isSummaryField(),\n /* Product key for grouping/lookup (matches ProductDefinition.key) /\n productKey: z.string().min(1).isDBIndexed().isSummaryField().isNotEditable()~~.dataCategories(PersonalDataCategory.USAGE)~~,\n\n /* Usage quantity /\n // USAGE, not FINANCIAL. A metered quantity is what the person DID in the product; the money it\n // becomes lives on the invoice. Two different sentences in a notice, and they read differently.\n quantity: z.number().min(0).isSummaryField()~~.dataCategories(PersonalDataCategory.USAGE)~~,\n /* When the usage occurred /\n timestamp: z.date().isDBIndexed().isSummaryField().isNotEditable(),\n\n /* What generated this usage /\n source: z.object({\n type: z.enum(UsageSourceType),\n resourceType: z.string().optional(),\n operationIdentifier: z.string().optional(),\n description: z.string().optional(),\n }).optional().isNotEditable(),\n\n /* Whether this has been reported to the billing provider /\n reportedToProvider: z.boolean().default(false).isDBIndexed().isNotEditable(),\n reportedAt: z.date().optional().isNotEditable(),\n\n /\n Open key-value bag for operational tagging (cost-centre, campaign ref, internal correlation id).\n \n ⚠️ AUTHORING RULE — never store personal data here. This row is RETAINED when its subject is\n * erased: the billing-retention decision keeps the financial record for tax/audit obligations, and\n * subject erasure scrubs the linked USER rather than these rows, because a billing row holds no\n * personal data of its own — the person is a foreign key. An open bag is the one place that\n * assumption can be broken by an app author, and nothing would catch it: the erasure scrub is\n * field-directed (`.impersonalizeWith()`), and it cannot reach inside an arbitrary record whose\n * keys it does not know.\n \n Concretely: no names, emails, phone numbers, addresses, free-text notes about a person, or\n * anything else that identifies one. Personal data written here SURVIVES an erasure — a compliance\n * breach that the retained label makes look intentional.\n \n Enforcement is deliberately NOT built (Q3, 2026-07-31): scrubbing these rows would require\n * hide/freeze to become separable from scrub — a real capability change with no current consumer.\n * Revisit only if an app is found using the bag this way.\n */\n metadata: z.record(z.string(), z.string()).optional(),\n createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\nexport type UsageRecord = z.infer<typeof UsageRecordSchema>;\n\n// ── Polymorphic Declaration ────────────────────────────────────────\n\nexport const usageRecordsPolymorphicDeclaration = declarePolymorphicSchemas({\n baseResourceType: 'usageRecords',\n baseFieldIdentifier: 'usageRecordId',\n baseEnumKey: 'USAGE_RECORDS',\n baseSchema: UsageRecordSchema,\n // Many metered usage rows per scope — opt out of the polymorphism engine's\n // singleton-per-scope business-key auto-default.\n variants: BILLING_SCOPE_VARIANTS.map(optOutPolymorphicAutoBusinessKey),\n});\n"]}
1	+ {"version":3,"file":"usage-record.shared.schemas.js","sourceRoot":"","sources":["../../../../src/billing/usage-record.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,yBAAyB,EAAE,gCAAgC,EAAE,MAAM,kDAAkD,CAAC;AAC/H,OAAO,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AACrG,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAEjE,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE;IACrC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IACnI,sEAAsE;IACtE,mGAAmG;IACnG,oGAAoG;IACpG,qGAAqG;IACrG,sGAAsG;IACtG,0BAA0B;IAC1B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,aAAa,EAAE;IAE5E,qBAAqB;IACrB,+FAA+F;IAC/F,gGAAgG;IAChG,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE;IAC5C,8BAA8B;IAC9B,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,aAAa,EAAE;IAElE,gCAAgC;IAChC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;QAC7B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACnC,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC1C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACnC,CAAC,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;IAE7B,6DAA6D;IAC7D,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,aAAa,EAAE;IAC5E,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;IAE/C;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAGH,sEAAsE;AAEtE,MAAM,CAAC,MAAM,kCAAkC,GAAG,yBAAyB,CAAC;IAC1E,gBAAgB,EAAE,cAAc;IAChC,mBAAmB,EAAE,eAAe;IACpC,WAAW,EAAE,eAAe;IAC5B,UAAU,EAAE,iBAAiB;IAC7B,2EAA2E;IAC3E,iDAAiD;IACjD,QAAQ,EAAE,sBAAsB,CAAC,GAAG,CAAC,gCAAgC,CAAC;CACvE,CAAC,CAAC","sourcesContent":["/*\n Usage Record Schema (Shared) — Polymorphic\n \n Tracks metered usage for METERED products. The current metering service groups\n * unreported rows by billing account and product when its scheduled flush runs.\n * `ProductBehaviorPolicy.metering` is an authored policy surface, but the current\n * flush scheduler does not consume its interval, window or retry members; do not\n * present those values as an effective reporting schedule until that runtime join exists.\n \n POLYMORPHIC EXPANSION: Like subscriptions, usage records are scope-expanded.\n * The `billingAccountId` FK is renamed per variant via polymorphic FK transformation:\n * - organizationUsageRecords (with organizationId + organizationBillingAccountId)\n * - userUsageRecords (with userId + userBillingAccountId)\n \n \n * @see billing-and-features-system.md §6.6 (Usage Records)\n /\n\nimport { z } from 'zod';\nimport { declarePolymorphicSchemas, optOutPolymorphicAutoBusinessKey } from '../resources/utils/resource-polymorphism.schemas';\nimport { BILLING_SCOPE_VARIANTS, BILLING_SCOPE_FK_VARIANTS } from './billing-account.shared.schemas';\nimport { UsageSourceType } from './billing-enums.shared.schemas';\n\nexport const UsageRecordSchema = z.object({\n _id: z.string().min(1).isPrimaryKey(),\n billingAccountId: z.string().min(1).isForeignKey({ polymorphicVariants: BILLING_SCOPE_FK_VARIANTS }).isDBIndexed().isSummaryField(),\n /* Product key for grouping/lookup (matches ProductDefinition.key) /\n // No `.dataCategories()`: this is an amount/term about the ACCOUNT, not a description of a person.\n // The person is the scope foreign key, which the never-scrub floor preserves in every mode, and the\n // value must survive erasure for the tax/audit obligation this family exists to serve — so it can be\n // neither scrubbed nor honestly declared as personal data the row holds. See `retentionPolicy` on the\n // resource config (#138).\n productKey: z.string().min(1).isDBIndexed().isSummaryField().isNotEditable(),\n\n /* Usage quantity /\n // USAGE, not FINANCIAL. A metered quantity is what the person DID in the product; the money it\n // becomes lives on the invoice. Two different sentences in a notice, and they read differently.\n quantity: z.number().min(0).isSummaryField(),\n /* When the usage occurred /\n timestamp: z.date().isDBIndexed().isSummaryField().isNotEditable(),\n\n /* What generated this usage /\n source: z.object({\n type: z.enum(UsageSourceType),\n resourceType: z.string().optional(),\n operationIdentifier: z.string().optional(),\n description: z.string().optional(),\n }).optional().isNotEditable(),\n\n /* Whether this has been reported to the billing provider /\n reportedToProvider: z.boolean().default(false).isDBIndexed().isNotEditable(),\n reportedAt: z.date().optional().isNotEditable(),\n\n /\n Open key-value bag for operational tagging (cost-centre, campaign ref, internal correlation id).\n \n ⚠️ AUTHORING RULE — never store personal data here. This row is RETAINED when its subject is\n * erased: the billing-retention decision keeps the financial record for tax/audit obligations, and\n * subject erasure scrubs the linked USER rather than these rows, because a billing row holds no\n * personal data of its own — the person is a foreign key. An open bag is the one place that\n * assumption can be broken by an app author, and nothing would catch it: the erasure scrub is\n * field-directed (`.impersonalizeWith()`), and it cannot reach inside an arbitrary record whose\n * keys it does not know.\n \n Concretely: no names, emails, phone numbers, addresses, free-text notes about a person, or\n * anything else that identifies one. Personal data written here SURVIVES an erasure — a compliance\n * breach that the retained label makes look intentional.\n \n Enforcement is deliberately NOT built (Q3, 2026-07-31): scrubbing these rows would require\n * hide/freeze to become separable from scrub — a real capability change with no current consumer.\n * Revisit only if an app is found using the bag this way.\n */\n metadata: z.record(z.string(), z.string()).optional(),\n createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\nexport type UsageRecord = z.infer<typeof UsageRecordSchema>;\n\n// ── Polymorphic Declaration ────────────────────────────────────────\n\nexport const usageRecordsPolymorphicDeclaration = declarePolymorphicSchemas({\n baseResourceType: 'usageRecords',\n baseFieldIdentifier: 'usageRecordId',\n baseEnumKey: 'USAGE_RECORDS',\n baseSchema: UsageRecordSchema,\n // Many metered usage rows per scope — opt out of the polymorphism engine's\n // singleton-per-scope business-key auto-default.\n variants: BILLING_SCOPE_VARIANTS.map(optOutPolymorphicAutoBusinessKey),\n});\n"]}

package/dist/esm/compliance/audit-trails/audit-logs.shared.resources-config.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"audit-logs.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/audit-trails/audit-logs.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAA6B,MAAM,kCAAkC,CAAC;AAErH,OAAO,EAAE,qBAAqB,EAAwD,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EACL,0BAA0B,EAE1B,oBAAoB,EAErB,MAAM,0CAA0C,CAAC;AAOlD,oBAAY,oBAAoB;IAC9B,iBAAiB,oBAAoB;CACtC;AAID,eAAO,MAAM,0BAA0B;;;;;;;;;;kBAa5B,CAAC;AAEZ,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAExF;;;;;;;;;;;GAWG;AACH,oBAAY,sBAAsB;IAChC,IAAI,SAAS;CACd;AAED;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;kBAI7B,CAAC;AAEZ,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAO1F;;;;;GAKG;AACH,eAAO,MAAM,oDAAoD,GAC/D,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;~~kBA4I9C~~,CAAC"}
1	+ {"version":3,"file":"audit-logs.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/audit-trails/audit-logs.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAA6B,MAAM,kCAAkC,CAAC;AAErH,OAAO,EAAE,qBAAqB,EAAwD,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EACL,0BAA0B,EAE1B,oBAAoB,EAErB,MAAM,0CAA0C,CAAC;AAOlD,oBAAY,oBAAoB;IAC9B,iBAAiB,oBAAoB;CACtC;AAID,eAAO,MAAM,0BAA0B;;;;;;;;;;kBAa5B,CAAC;AAEZ,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAExF;;;;;;;;;;;GAWG;AACH,oBAAY,sBAAsB;IAChC,IAAI,SAAS;CACd;AAED;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;kBAI7B,CAAC;AAEZ,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAO1F;;;;;GAKG;AACH,eAAO,MAAM,oDAAoD,GAC/D,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;kBA8K9C,CAAC"}

package/dist/esm/compliance/audit-trails/audit-logs.shared.resources-config.schemas.js CHANGED Viewed

@@ -4,7 +4,7 @@ import { createResourceConfiguration_Initialization } from '../../resources/reso
 import { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions.js';
 import { ResourceOperationRiskLevel, ResourceOperationVariantType, ResourceOperation_CustomServiceImplementationMode, } from '../../resources/resources.shared.schemas.js';
 import { CORE_APP_ROLES, CORE_ORG_ROLES } from '../../security/authorizations/roles.shared.schemas.js';
-import { Resouces_Filter_DateRangeSchema } from '../../resources/resources-config.shared.schemas.js';
+import { Resources_Filter_DateRangeSchema } from '../../resources/resources-config.shared.schemas.js';
 import { ResourceSystemAccessMode } from '../../resources/resources-config.shared.schemas.js';
 // ── Custom Operations ────────────────────────────────────────────────
 export var AuditLogs_Operations;
@@ -17,7 +17,7 @@ export const AuditLogs_ExportRequestDto = z.object({
     eventCategory: z.enum(AuditEventCategory).optional(),
     severity: z.enum(AuditEventSeverity).optional(),
     userId: z.string().optional(),
-    createdAt: Resouces_Filter_DateRangeSchema.optional(),
+    createdAt: Resources_Filter_DateRangeSchema.optional(),
     // This is a bounded, synchronous API response, not an archive job. Keep its
     // ceiling aligned with the resource LIST operation so callers cannot request
     // a window that the repository will silently truncate.
@@ -72,6 +72,39 @@ export const auditLogsResourceConfiguration_InitializationFactory = (resourcesRe
     customOperation: AuditLogs_Operations,
     /** Subject-export disclosure. Security/operational record rather than the subject's own data — disclosing the monitoring trail to its subject is self-defeating, and it is already out of Art. 20 scope. A curated sign-in summary, if ever wanted, is a different surface. */
     systemAccessPolicy: { exportSubject: ResourceSystemAccessMode.FORBIDDEN },
+    /*
+     * DELIBERATELY NO `retentionPolicy`, and this comment is the declaration of that (#138).
+     *
+     * The audit trail is the one resource subject erasure must NOT reach. It is the immutable ledger of what
+     * happened, including the erasure itself, and scrubbing it would destroy the evidence that the erasure was
+     * performed correctly — the D4 boundary. `users.email` is deliberately left scrubbable PRECISELY BECAUSE
+     * this ledger is not: the two decisions are a pair.
+     *
+     * Note this resource DOES declare personal-data categories (identity, usage) and that is correct — the
+     * ledger holds personal data and a notice must say so. What follows from the pair above is that neither
+     * mode is right here: `RETAIN_ONLY` would assert it holds none, and `RETAIN_AND_IMPERSONALIZE` would
+     * promise a scrub that must never run. Exemption is the honest third answer, and #138's acceptance allows
+     * it on condition that it is VISIBLE rather than silent — which is what this block is for.
+     *
+     * The retention basis is a legal-obligation one (GDPR Art. 17(3)(b)/(e)), and it is the operator's to state
+     * in their notice; the engine's job is to make the exemption legible rather than to argue it.
+     */
     coreOperations: [
         CoreResourceOperation.READ,
         CoreResourceOperation.LIST,

package/dist/esm/compliance/audit-trails/audit-logs.shared.resources-config.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"audit-logs.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/audit-trails/audit-logs.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AACrH,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,EAE5B,iDAAiD,GAClD,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,oDAAoD,CAAC;AACpG,OAAO,EAAE,+BAA+B,EAAE,MAAM,iDAAiD,CAAC;AAClG,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAE3F,wEAAwE;AAExE,MAAM,CAAN,IAAY,oBAEX;AAFD,WAAY,oBAAoB;IAC9B,6DAAqC,CAAA;AACvC,CAAC,EAFW,oBAAoB,KAApB,oBAAoB,QAE/B;AAED,yEAAyE;AAEzE,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IACpD,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IAC/C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,+BAA+B,CAAC,QAAQ,EAAE;IACrD,4EAA4E;IAC5E,6EAA6E;IAC7E,uDAAuD;IACvD,4EAA4E;IAC5E,4EAA4E;IAC5E,kDAAkD;IAClD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;CAC/E,CAAC,CAAC,MAAM,EAAE,CAAC;AAIZ;;;;;;;;;;;GAWG;AACH,MAAM,CAAN,IAAY,sBAEX;AAFD,WAAY,sBAAsB;IAChC,uCAAa,CAAA;AACf,CAAC,EAFW,sBAAsB,KAAtB,sBAAsB,QAEjC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC;IAC3C,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,IAAI,CAAC;IAC9C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CAC3C,CAAC,CAAC,MAAM,EAAE,CAAC;AAIZ,2EAA2E;AAE3E,MAAM,kCAAkC,GAAG,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;AACtE,MAAM,6BAA6B,GAAG,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;AAEjE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oDAAoD,GAAG,CAClE,sBAA8C,EAC9C,EAAE,CAAC,0CAA0C,CAI7C;IACA,UAAU,EAAE,yBAAyB;IACrC,kBAAkB,EAAE,gBAAgB,CAAC,UAAU;IAC/C,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,UAAU,CAAC;IACxF,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IACtB,eAAe,EAAE,oBAAoB;IACrC,+QAA+Q;IAC/Q,kBAAkB,EAAE,EAAE,aAAa,EAAE,wBAAwB,CAAC,SAAS,EAAE;IAEzE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,uDAAuD;KACxD;IACD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,EAAE,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,qBAAqB,CAAC;oBAClG,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,KAAK;oBAChB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,EAAE,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,qBAAqB,CAAC;oBAClG,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE;wBACZ,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;wBACrB,aAAa,EAAE,kCAAkC;wBACjD,QAAQ,EAAE,6BAA6B;wBACvC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;wBAClB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;wBAC1B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;wBACzB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;wBACzB,wFAAwF;wBACxF,oFAAoF;wBACpF,iGAAiG;wBACjG,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;wBAC5B,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;qBACpB;oBACD,yEAAyE;oBACzE,EAAE;oBACF,uFAAuF;oBACvF,mEAAmE;oBACnE,oEAAoE;oBACpE,qEAAqE;oBACrE,yBAAyB;oBACzB,8BAA8B,EAAE,GAAG;oBACnC,mFAAmF;oBACnF,sFAAsF;oBACtF,gFAAgF;oBAChF,mFAAmF;oBACnF,qFAAqF;oBACrF,qFAAqF;oBACrF,uFAAuF;oBACvF,qFAAqF;oBACrF,0DAA0D;oBAC1D,UAAU,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,CAAU;iBACvE;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,KAAK;oBAChB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,EAAE,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,qBAAqB,CAAC;oBAClG,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,KAAK;oBACnB,gBAAgB,EAAE,EAAE;oBACpB,YAAY,EAAE;wBACZ,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;wBACrB,aAAa,EAAE,kCAAkC;wBACjD,QAAQ,EAAE,6BAA6B;wBACvC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;wBAClB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;wBAC1B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;wBACzB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;wBACzB,wFAAwF;wBACxF,oFAAoF;wBACpF,iGAAiG;wBACjG,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;wBAC5B,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;qBACpB;oBACD,UAAU,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,WAAW,CAAU;oBAC3D,8BAA8B,EAAE,GAAG;iBACpC,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,oBAAoB,CAAC,iBAAiB,CAAC,EAAE;YACxC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,qBAAqB,CAAC;oBACvE,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,iEAAiE;oBACjE,uEAAuE;oBACvE,oEAAoE;oBACpE,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,0BAA0B;oBACtC,iBAAiB,EAAE,2BAA2B;oBAC9C,gCAAgC,EAAE,CAAC,iDAAiD,CAAC,wBAAwB,CAAC;iBAC/G,CAAC;SACH;KACF;CACF,CAAC,CAAC","sourcesContent":["import { z } from 'zod';\nimport { AuditEventCategory, AuditEventSeverity, AuditableEvent_BaseSchema } from './auditable-events.shared.schema';\nimport { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport {\n ResourceOperationRiskLevel,\n ResourceOperationVariantType,\n ResourceRelationship,\n ResourceOperation_CustomServiceImplementationMode,\n} from '../../resources/resources.shared.schemas';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../../security/authorizations/roles.shared.schemas';\nimport { Resouces_Filter_DateRangeSchema } from '../../resources/resources-config.shared.schemas';\nimport { ResourceSystemAccessMode } from '../../resources/resources-config.shared.schemas';\n\n// ── Custom Operations ────────────────────────────────────────────────\n\nexport enum AuditLogs_Operations {\n EXPORT_AUDIT_LOGS = 'exportAuditLogs',\n}\n\n// ── Export Request DTO ────────────────────────────────────────────────\n\nexport const AuditLogs_ExportRequestDto = z.object({\n eventType: z.string().optional(),\n eventCategory: z.enum(AuditEventCategory).optional(),\n severity: z.enum(AuditEventSeverity).optional(),\n userId: z.string().optional(),\n createdAt: Resouces_Filter_DateRangeSchema.optional(),\n // This is a bounded, synchronous API response, not an archive job. Keep its\n // ceiling aligned with the resource LIST operation so callers cannot request\n // a window that the repository will silently truncate.\n // Input stays optional and the backend applies 100 when omitted. Record the\n // default as metadata rather than a Zod output default, which would falsely\n // make the request field required in JSON Schema.\n maxRecords: z.number().int().min(1).max(100).optional().meta({ default: 100 }),\n}).strict();\n\nexport type AuditLogs_ExportRequestDtoType = z.infer<typeof AuditLogs_ExportRequestDto>;\n\n/*\n The named runtime source for the audit-log export-format vocabulary.\n \n Single-member on purpose, and deliberately NOT `ResourceCollectionExportFormat` (which also\n * carries `JSON`): that enum governs listing/collection exports with their CSV option and\n * content-type/extension tables, while this one names what the SYNCHRONOUS audit-log export\n * operation can return — a JSON window in the HTTP 200 response, nothing else. Merging them\n * because the wire value overlaps would silently grant this operation every format the\n * collection-export vocabulary ever gains. A future archival/export delivery mechanism must\n * introduce its own request and response contract (and its own members here) rather than\n * extending this one implicitly.\n /\nexport enum AuditLogs_ExportFormat {\n JSON = 'json',\n}\n\n/\n The complete synchronous audit-log export payload.\n \n There is deliberately no CSV option, download URL, or asynchronous job\n * handle here — see {@link AuditLogs_ExportFormat} for why the format\n * vocabulary is closed at JSON.\n /\nexport const AuditLogs_ExportResponseDto = z.object({\n records: z.array(AuditableEvent_BaseSchema),\n format: z.literal(AuditLogs_ExportFormat.JSON),\n totalCount: z.number().int().nonnegative(),\n}).strict();\n\nexport type AuditLogs_ExportResponseDtoType = z.infer<typeof AuditLogs_ExportResponseDto>;\n\n// ── Filter/Sort Schemas for SEARCH operation ────────────────────────────\n\nconst auditLogsFilterEventCategorySchema = z.enum(AuditEventCategory);\nconst auditLogsFilterSeveritySchema = z.enum(AuditEventSeverity);\n\n/\n Audit Logs Resource Configuration\n * - REPOSITORY_ONLY CREATE for internal writes\n * - API_CALL READ/LIST for org members and app admins (enables frontend routes)\n * - EXPORT_AUDIT_LOGS custom operation for bounded synchronous JSON retrieval\n /\nexport const auditLogsResourceConfiguration_InitializationFactory = (\n resourcesRelationships: ResourceRelationship[]\n) => createResourceConfiguration_Initialization<\n typeof AuditLogs_Operations,\n CoreResourceOperation.READ \| CoreResourceOperation.LIST \| CoreResourceOperation.SEARCH \| CoreResourceOperation.CREATE,\n typeof AuditableEvent_BaseSchema\n>({\n mainSchema: AuditableEvent_BaseSchema,\n resourceIdentifier: CoreResourceType.AUDIT_LOGS,\n resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.AUDIT_LOGS],\n resourceRelationships: resourcesRelationships,\n isSystemResource: true,\n customOperation: AuditLogs_Operations,\n /* Subject-export disclosure. Security/operational record rather than the subject's own data — disclosing the monitoring trail to its subject is self-defeating, and it is already out of Art. 20 scope. A curated sign-in summary, if ever wanted, is a different surface. */\n systemAccessPolicy: { exportSubject: ResourceSystemAccessMode.FORBIDDEN },\n\n coreOperations: [\n CoreResourceOperation.READ,\n CoreResourceOperation.LIST,\n CoreResourceOperation.SEARCH,\n CoreResourceOperation.CREATE,\n // Note: No UPDATE or DELETE - audit logs are immutable\n ],\n operationsConfiguration: {\n [CoreResourceOperation.READ]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_MEMBER, CORE_ORG_ROLES.ORG_ADMIN, CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n riskLevel: ResourceOperationRiskLevel.LOW,\n },\n {\n variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n isDefault: false,\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n riskLevel: ResourceOperationRiskLevel.LOW,\n },\n ],\n },\n [CoreResourceOperation.LIST]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_MEMBER, CORE_ORG_ROLES.ORG_ADMIN, CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n riskLevel: ResourceOperationRiskLevel.LOW,\n filterFields: {\n eventType: z.string(),\n eventCategory: auditLogsFilterEventCategorySchema,\n severity: auditLogsFilterSeveritySchema,\n userId: z.string(),\n organizationId: z.string(),\n applicationId: z.string(),\n correlationId: z.string(),\n // Filterable so an investigator can pull every action from one browser/device install —\n // the cross-session/cross-login question. Only ever populated for applications that\n // opted into `compliance.clientInstanceIdScope`; for every other app the filter matches nothing.\n clientInstanceId: z.string(),\n createdAt: z.date(),\n },\n // DECLARED rather than inherited, and equal to the SEARCH sibling below.\n //\n // The value matches the framework default, so it changes nothing today — it is written\n // down because the audit export uses the same maximum. Keeping the\n // request DTO and this resource operation at 100 makes the contract\n // explicit instead of allowing the repository to silently truncate a\n // larger client request.\n maxPaginatedResultPerPageLimit: 100,\n // `eventId` is LAST on purpose. Sort priority follows key order and the repository\n // falls back to the FIRST configured field, so `createdAt` must stay in front to keep\n // the existing newest-first default intact. `eventId` exists here as the KEYSET\n // TIE-BREAKER the immudb audit-reconcile batch pages on: `createdAt` is not unique\n // (boot/seed bursts write hundreds of rows in one millisecond), and without a unique\n // secondary sort that batch cannot address a position inside a burst — it previously\n // stepped over the remainder and skipped those records permanently. Removing `eventId`\n // silently reintroduces that data-loss path, because a non-empty whitelist makes the\n // repository DROP any unlisted sort key rather than fail.\n sortFields: ['createdAt', 'severity', 'eventType', 'eventId'] as const,\n },\n {\n variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n isDefault: false,\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n riskLevel: ResourceOperationRiskLevel.LOW,\n },\n ],\n },\n\n [CoreResourceOperation.SEARCH]: {\n variants: [{\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_MEMBER, CORE_ORG_ROLES.ORG_ADMIN, CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n riskLevel: ResourceOperationRiskLevel.LOW,\n isSearchable: false,\n searchableFields: [],\n filterFields: {\n eventType: z.string(),\n eventCategory: auditLogsFilterEventCategorySchema,\n severity: auditLogsFilterSeveritySchema,\n userId: z.string(),\n organizationId: z.string(),\n applicationId: z.string(),\n correlationId: z.string(),\n // Filterable so an investigator can pull every action from one browser/device install —\n // the cross-session/cross-login question. Only ever populated for applications that\n // opted into `compliance.clientInstanceIdScope`; for every other app the filter matches nothing.\n clientInstanceId: z.string(),\n createdAt: z.date(),\n },\n sortFields: ['createdAt', 'severity', 'eventType'] as const,\n maxPaginatedResultPerPageLimit: 100,\n }],\n },\n [CoreResourceOperation.CREATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n isDefault: true,\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n riskLevel: ResourceOperationRiskLevel.LOW,\n },\n ],\n },\n [AuditLogs_Operations.EXPORT_AUDIT_LOGS]: {\n variants: [{\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN, CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n // Export filters a tenant-scoped collection. CREATE supplies the\n // collection POST route shape without pretending that one audit row is\n // being updated or requiring a meaningless `auditLogId` path value.\n resourceOperationLike: CoreResourceOperation.CREATE,\n requestDto: AuditLogs_ExportRequestDto,\n customResponseDto: AuditLogs_ExportResponseDto,\n customServiceImplementationModes: [ResourceOperation_CustomServiceImplementationMode.REPLACE_CORE_OPERARTIONS],\n }],\n },\n },\n});\n"]}
1	+ {"version":3,"file":"audit-logs.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/audit-trails/audit-logs.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AACrH,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,EAE5B,iDAAiD,GAClD,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,oDAAoD,CAAC;AACpG,OAAO,EAAE,gCAAgC,EAAE,MAAM,iDAAiD,CAAC;AACnG,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAE3F,wEAAwE;AAExE,MAAM,CAAN,IAAY,oBAEX;AAFD,WAAY,oBAAoB;IAC9B,6DAAqC,CAAA;AACvC,CAAC,EAFW,oBAAoB,KAApB,oBAAoB,QAE/B;AAED,yEAAyE;AAEzE,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IACpD,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IAC/C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,gCAAgC,CAAC,QAAQ,EAAE;IACtD,4EAA4E;IAC5E,6EAA6E;IAC7E,uDAAuD;IACvD,4EAA4E;IAC5E,4EAA4E;IAC5E,kDAAkD;IAClD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;CAC/E,CAAC,CAAC,MAAM,EAAE,CAAC;AAIZ;;;;;;;;;;;GAWG;AACH,MAAM,CAAN,IAAY,sBAEX;AAFD,WAAY,sBAAsB;IAChC,uCAAa,CAAA;AACf,CAAC,EAFW,sBAAsB,KAAtB,sBAAsB,QAEjC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC;IAC3C,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,IAAI,CAAC;IAC9C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CAC3C,CAAC,CAAC,MAAM,EAAE,CAAC;AAIZ,2EAA2E;AAE3E,MAAM,kCAAkC,GAAG,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;AACtE,MAAM,6BAA6B,GAAG,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;AAEjE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oDAAoD,GAAG,CAClE,sBAA8C,EAC9C,EAAE,CAAC,0CAA0C,CAI7C;IACA,UAAU,EAAE,yBAAyB;IACrC,kBAAkB,EAAE,gBAAgB,CAAC,UAAU;IAC/C,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,UAAU,CAAC;IACxF,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IACtB,eAAe,EAAE,oBAAoB;IACrC,+QAA+Q;IAC/Q,kBAAkB,EAAE,EAAE,aAAa,EAAE,wBAAwB,CAAC,SAAS,EAAE;IAEzE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IAEH,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,uDAAuD;KACxD;IACD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,EAAE,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,qBAAqB,CAAC;oBAClG,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,KAAK;oBAChB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,EAAE,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,qBAAqB,CAAC;oBAClG,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE;wBACZ,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;wBACrB,aAAa,EAAE,kCAAkC;wBACjD,QAAQ,EAAE,6BAA6B;wBACvC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;wBAClB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;wBAC1B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;wBACzB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;wBACzB,wFAAwF;wBACxF,oFAAoF;wBACpF,iGAAiG;wBACjG,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;wBAC5B,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;qBACpB;oBACD,yEAAyE;oBACzE,EAAE;oBACF,uFAAuF;oBACvF,mEAAmE;oBACnE,oEAAoE;oBACpE,qEAAqE;oBACrE,yBAAyB;oBACzB,8BAA8B,EAAE,GAAG;oBACnC,mFAAmF;oBACnF,sFAAsF;oBACtF,gFAAgF;oBAChF,mFAAmF;oBACnF,qFAAqF;oBACrF,qFAAqF;oBACrF,uFAAuF;oBACvF,qFAAqF;oBACrF,0DAA0D;oBAC1D,UAAU,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,CAAU;iBACvE;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,KAAK;oBAChB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,EAAE,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,qBAAqB,CAAC;oBAClG,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,KAAK;oBACnB,gBAAgB,EAAE,EAAE;oBACpB,YAAY,EAAE;wBACZ,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;wBACrB,aAAa,EAAE,kCAAkC;wBACjD,QAAQ,EAAE,6BAA6B;wBACvC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;wBAClB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;wBAC1B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;wBACzB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;wBACzB,wFAAwF;wBACxF,oFAAoF;wBACpF,iGAAiG;wBACjG,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;wBAC5B,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;qBACpB;oBACD,UAAU,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,WAAW,CAAU;oBAC3D,8BAA8B,EAAE,GAAG;iBACpC,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,oBAAoB,CAAC,iBAAiB,CAAC,EAAE;YACxC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,qBAAqB,CAAC;oBACvE,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,iEAAiE;oBACjE,uEAAuE;oBACvE,oEAAoE;oBACpE,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,0BAA0B;oBACtC,iBAAiB,EAAE,2BAA2B;oBAC9C,gCAAgC,EAAE,CAAC,iDAAiD,CAAC,wBAAwB,CAAC;iBAC/G,CAAC;SACH;KACF;CACF,CAAC,CAAC","sourcesContent":["import { z } from 'zod';\nimport { AuditEventCategory, AuditEventSeverity, AuditableEvent_BaseSchema } from './auditable-events.shared.schema';\nimport { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport {\n ResourceOperationRiskLevel,\n ResourceOperationVariantType,\n ResourceRelationship,\n ResourceOperation_CustomServiceImplementationMode,\n} from '../../resources/resources.shared.schemas';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../../security/authorizations/roles.shared.schemas';\nimport { Resources_Filter_DateRangeSchema } from '../../resources/resources-config.shared.schemas';\nimport { ResourceSystemAccessMode } from '../../resources/resources-config.shared.schemas';\n\n// ── Custom Operations ────────────────────────────────────────────────\n\nexport enum AuditLogs_Operations {\n EXPORT_AUDIT_LOGS = 'exportAuditLogs',\n}\n\n// ── Export Request DTO ────────────────────────────────────────────────\n\nexport const AuditLogs_ExportRequestDto = z.object({\n eventType: z.string().optional(),\n eventCategory: z.enum(AuditEventCategory).optional(),\n severity: z.enum(AuditEventSeverity).optional(),\n userId: z.string().optional(),\n createdAt: Resources_Filter_DateRangeSchema.optional(),\n // This is a bounded, synchronous API response, not an archive job. Keep its\n // ceiling aligned with the resource LIST operation so callers cannot request\n // a window that the repository will silently truncate.\n // Input stays optional and the backend applies 100 when omitted. Record the\n // default as metadata rather than a Zod output default, which would falsely\n // make the request field required in JSON Schema.\n maxRecords: z.number().int().min(1).max(100).optional().meta({ default: 100 }),\n}).strict();\n\nexport type AuditLogs_ExportRequestDtoType = z.infer<typeof AuditLogs_ExportRequestDto>;\n\n/*\n The named runtime source for the audit-log export-format vocabulary.\n \n Single-member on purpose, and deliberately NOT `ResourceCollectionExportFormat` (which also\n * carries `JSON`): that enum governs listing/collection exports with their CSV option and\n * content-type/extension tables, while this one names what the SYNCHRONOUS audit-log export\n * operation can return — a JSON window in the HTTP 200 response, nothing else. Merging them\n * because the wire value overlaps would silently grant this operation every format the\n * collection-export vocabulary ever gains. A future archival/export delivery mechanism must\n * introduce its own request and response contract (and its own members here) rather than\n * extending this one implicitly.\n /\nexport enum AuditLogs_ExportFormat {\n JSON = 'json',\n}\n\n/\n The complete synchronous audit-log export payload.\n \n There is deliberately no CSV option, download URL, or asynchronous job\n * handle here — see {@link AuditLogs_ExportFormat} for why the format\n * vocabulary is closed at JSON.\n /\nexport const AuditLogs_ExportResponseDto = z.object({\n records: z.array(AuditableEvent_BaseSchema),\n format: z.literal(AuditLogs_ExportFormat.JSON),\n totalCount: z.number().int().nonnegative(),\n}).strict();\n\nexport type AuditLogs_ExportResponseDtoType = z.infer<typeof AuditLogs_ExportResponseDto>;\n\n// ── Filter/Sort Schemas for SEARCH operation ────────────────────────────\n\nconst auditLogsFilterEventCategorySchema = z.enum(AuditEventCategory);\nconst auditLogsFilterSeveritySchema = z.enum(AuditEventSeverity);\n\n/\n Audit Logs Resource Configuration\n * - REPOSITORY_ONLY CREATE for internal writes\n * - API_CALL READ/LIST for org members and app admins (enables frontend routes)\n * - EXPORT_AUDIT_LOGS custom operation for bounded synchronous JSON retrieval\n /\nexport const auditLogsResourceConfiguration_InitializationFactory = (\n resourcesRelationships: ResourceRelationship[]\n) => createResourceConfiguration_Initialization<\n typeof AuditLogs_Operations,\n CoreResourceOperation.READ \| CoreResourceOperation.LIST \| CoreResourceOperation.SEARCH \| CoreResourceOperation.CREATE,\n typeof AuditableEvent_BaseSchema\n>({\n mainSchema: AuditableEvent_BaseSchema,\n resourceIdentifier: CoreResourceType.AUDIT_LOGS,\n resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.AUDIT_LOGS],\n resourceRelationships: resourcesRelationships,\n isSystemResource: true,\n customOperation: AuditLogs_Operations,\n /* Subject-export disclosure. Security/operational record rather than the subject's own data — disclosing the monitoring trail to its subject is self-defeating, and it is already out of Art. 20 scope. A curated sign-in summary, if ever wanted, is a different surface. /\n systemAccessPolicy: { exportSubject: ResourceSystemAccessMode.FORBIDDEN },\n\n /\n\n * DELIBERATELY NO `retentionPolicy`, and this comment is the declaration of that (#138).\n\n \n\n The audit trail is the one resource subject erasure must NOT reach. It is the immutable ledger of what\n\n * happened, including the erasure itself, and scrubbing it would destroy the evidence that the erasure was\n\n * performed correctly — the D4 boundary. `users.email` is deliberately left scrubbable PRECISELY BECAUSE\n\n * this ledger is not: the two decisions are a pair.\n\n \n\n Note this resource DOES declare personal-data categories (identity, usage) and that is correct — the\n\n * ledger holds personal data and a notice must say so. What follows from the pair above is that neither\n\n * mode is right here: `RETAIN_ONLY` would assert it holds none, and `RETAIN_AND_IMPERSONALIZE` would\n\n * promise a scrub that must never run. Exemption is the honest third answer, and #138's acceptance allows\n\n * it on condition that it is VISIBLE rather than silent — which is what this block is for.\n\n \n\n The retention basis is a legal-obligation one (GDPR Art. 17(3)(b)/(e)), and it is the operator's to state\n\n * in their notice; the engine's job is to make the exemption legible rather than to argue it.\n\n */\n\n coreOperations: [\n CoreResourceOperation.READ,\n CoreResourceOperation.LIST,\n CoreResourceOperation.SEARCH,\n CoreResourceOperation.CREATE,\n // Note: No UPDATE or DELETE - audit logs are immutable\n ],\n operationsConfiguration: {\n [CoreResourceOperation.READ]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_MEMBER, CORE_ORG_ROLES.ORG_ADMIN, CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n riskLevel: ResourceOperationRiskLevel.LOW,\n },\n {\n variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n isDefault: false,\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n riskLevel: ResourceOperationRiskLevel.LOW,\n },\n ],\n },\n [CoreResourceOperation.LIST]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_MEMBER, CORE_ORG_ROLES.ORG_ADMIN, CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n riskLevel: ResourceOperationRiskLevel.LOW,\n filterFields: {\n eventType: z.string(),\n eventCategory: auditLogsFilterEventCategorySchema,\n severity: auditLogsFilterSeveritySchema,\n userId: z.string(),\n organizationId: z.string(),\n applicationId: z.string(),\n correlationId: z.string(),\n // Filterable so an investigator can pull every action from one browser/device install —\n // the cross-session/cross-login question. Only ever populated for applications that\n // opted into `compliance.clientInstanceIdScope`; for every other app the filter matches nothing.\n clientInstanceId: z.string(),\n createdAt: z.date(),\n },\n // DECLARED rather than inherited, and equal to the SEARCH sibling below.\n //\n // The value matches the framework default, so it changes nothing today — it is written\n // down because the audit export uses the same maximum. Keeping the\n // request DTO and this resource operation at 100 makes the contract\n // explicit instead of allowing the repository to silently truncate a\n // larger client request.\n maxPaginatedResultPerPageLimit: 100,\n // `eventId` is LAST on purpose. Sort priority follows key order and the repository\n // falls back to the FIRST configured field, so `createdAt` must stay in front to keep\n // the existing newest-first default intact. `eventId` exists here as the KEYSET\n // TIE-BREAKER the immudb audit-reconcile batch pages on: `createdAt` is not unique\n // (boot/seed bursts write hundreds of rows in one millisecond), and without a unique\n // secondary sort that batch cannot address a position inside a burst — it previously\n // stepped over the remainder and skipped those records permanently. Removing `eventId`\n // silently reintroduces that data-loss path, because a non-empty whitelist makes the\n // repository DROP any unlisted sort key rather than fail.\n sortFields: ['createdAt', 'severity', 'eventType', 'eventId'] as const,\n },\n {\n variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n isDefault: false,\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n riskLevel: ResourceOperationRiskLevel.LOW,\n },\n ],\n },\n\n [CoreResourceOperation.SEARCH]: {\n variants: [{\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_MEMBER, CORE_ORG_ROLES.ORG_ADMIN, CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n riskLevel: ResourceOperationRiskLevel.LOW,\n isSearchable: false,\n searchableFields: [],\n filterFields: {\n eventType: z.string(),\n eventCategory: auditLogsFilterEventCategorySchema,\n severity: auditLogsFilterSeveritySchema,\n userId: z.string(),\n organizationId: z.string(),\n applicationId: z.string(),\n correlationId: z.string(),\n // Filterable so an investigator can pull every action from one browser/device install —\n // the cross-session/cross-login question. Only ever populated for applications that\n // opted into `compliance.clientInstanceIdScope`; for every other app the filter matches nothing.\n clientInstanceId: z.string(),\n createdAt: z.date(),\n },\n sortFields: ['createdAt', 'severity', 'eventType'] as const,\n maxPaginatedResultPerPageLimit: 100,\n }],\n },\n [CoreResourceOperation.CREATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n isDefault: true,\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n riskLevel: ResourceOperationRiskLevel.LOW,\n },\n ],\n },\n [AuditLogs_Operations.EXPORT_AUDIT_LOGS]: {\n variants: [{\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN, CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n // Export filters a tenant-scoped collection. CREATE supplies the\n // collection POST route shape without pretending that one audit row is\n // being updated or requiring a meaningless `auditLogId` path value.\n resourceOperationLike: CoreResourceOperation.CREATE,\n requestDto: AuditLogs_ExportRequestDto,\n customResponseDto: AuditLogs_ExportResponseDto,\n customServiceImplementationModes: [ResourceOperation_CustomServiceImplementationMode.REPLACE_CORE_OPERARTIONS],\n }],\n },\n },\n});\n"]}

package/dist/esm/compliance/audit-trails/auditable-events.shared.schema.d.ts CHANGED Viewed

@@ -14,6 +14,23 @@ export declare enum CoreAuditableEventType {
     USER_MFA_ENABLED = "user_mfa_enabled",
     USER_MFA_DISABLED = "user_mfa_disabled",
     USER_SESSION_EXPIRED = "user_session_expired",
+    /**
+     * A refresh chain was FORCIBLY RETIRED because the principal exceeded its concurrent-session cap.
+     *
+     * DISTINCT from {@link USER_SESSION_EXPIRED}, and the split is semantic rather than cosmetic. An
+     * expiry is time elapsing; an eviction is a cap DISPLACING a live chain, and the two answer
+     * different reviewer questions — "was this user idle?" versus "is somebody's chain being pushed
+     * out?". The second is the one that matters: the cap exists to bound the blast radius of undetected
+     * token theft, so a burst of evictions for one principal is exactly the signal a reviewer wants.
+     *
+     * Before this, the only trace was a debug log — a security-relevant token-lifecycle act with no
+     * durable record, which is what `CLAUDE.md`'s assurance-by-construction rule asks for by name.
+     *
+     * assurance-control: WILDO.IDENTITY.SESSION_CONCURRENCY_LIMIT — the eviction enforcing the
+     * concurrent-session bound leaves a record naming WHICH chain was retired and when it was issued,
+     * so the first-in-first-out property is reviewable rather than merely implemented.
+     */
+    USER_SESSION_EVICTED = "user_session_evicted",
     MACHINE_AUTH_SUCCESS = "machine_auth_success",
     MACHINE_AUTH_FAILED = "machine_auth_failed",
     MACHINE_ACCESS = "machine_access",
@@ -132,6 +149,17 @@ export declare enum CoreAuditableEventType {
     SAML_METADATA_PARSED = "saml_metadata_parsed",
     SAML_EMAIL_CHANGED = "saml_email_changed",
     OAUTH2_PROVIDER_BLOCKED = "oauth2_provider_blocked",
+    /**
+     * File upload grant lifecycle (issue #312) — the first FILE-domain audit events. A grant is a
+     * single-use bearer credential that lets whoever holds it perform ONE upload into ONE resource file
+     * field with the MINTER's authority; minting it is a delegated-authorization act and is audited as
+     * one. `ISSUED` at mint (MEDIUM: a credential left the trust boundary), `REDEEMED` when the one
+     * upload landed and the FILES row exists, `REVOKED` when the minter or an administrator cancelled
+     * it. The event data carries the grant's ID — never its value.
+     */
+    FILE_UPLOAD_GRANT_ISSUED = "file_upload_grant_issued",
+    FILE_UPLOAD_GRANT_REDEEMED = "file_upload_grant_redeemed",
+    FILE_UPLOAD_GRANT_REVOKED = "file_upload_grant_revoked",
     ONE_OFF_TOKEN_CREATED = "one_off_token_created",
     ONE_OFF_TOKEN_EXCHANGED = "one_off_token_exchanged",
     /** revocation-B1: a super-admin cancelled an un-exchanged one-off (impersonation) session token. */
@@ -502,6 +530,31 @@ export declare const AuditableEvent_User_SessionExpiredEventDataSchema: z.ZodObj
     sessionDuration: z.ZodNumber;
     lastActivity: z.ZodDate;
 }, z.core.$strip>;
+/**
+ * One refresh chain retired to keep a principal within its concurrent-session cap.
+ *
+ * `evictedIssuedAt` is the load-bearing field and the reason this event is worth its own type: the
+ * cap's security property is that the OLDEST chain goes, so a record that named only the victim
+ * would prove a session ended without proving the right one did. Carrying the issuance instant makes
+ * the first-in-first-out claim checkable from the trail alone.
+ *
+ * `configuredMaximum` and `retainedCount` are here so a reviewer can tell a correctly-enforced cap
+ * from a misconfigured one without reading the config as it stood at that moment.
+ *
+ * NO token material. The JTI is an opaque identifier, never the token — the trail must not become a
+ * place where a credential can be recovered.
+ *
+ * assurance-control: WILDO.IDENTITY.SESSION_CONCURRENCY_LIMIT — the bound's enforcement is evidenced,
+ * including WHICH chain was retired, so the ordering can be reviewed and not merely trusted.
+ */
+export declare const AuditableEvent_User_SessionEvictedEventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.USER_SESSION_EVICTED>;
+    userId: z.ZodString;
+    evictedJti: z.ZodString;
+    evictedIssuedAt: z.ZodOptional<z.ZodDate>;
+    configuredMaximum: z.ZodNumber;
+    retainedCount: z.ZodNumber;
+}, z.core.$strip>;
 /**
  * A `USERS` row was hard-deleted.
  *
@@ -2577,6 +2630,13 @@ export declare const AuditableEvent_TypedDataSchema: z.ZodDiscriminatedUnion<[z.
     rowCount: z.ZodNumber;
     filterFieldNames: z.ZodArray<z.ZodString>;
     organizationId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.USER_SESSION_EVICTED>;
+    userId: z.ZodString;
+    evictedJti: z.ZodString;
+    evictedIssuedAt: z.ZodOptional<z.ZodDate>;
+    configuredMaximum: z.ZodNumber;
+    retainedCount: z.ZodNumber;
 }, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.HTTP_API_READ_THROUGH_ACCESS>;
     resourceType: z.ZodString;
@@ -2766,6 +2826,7 @@ export type AuditableEvent_ResourceOperationDenied_EventData = z.infer<typeof Au
 export type AuditableEvent_RetainedDataAccess_EventData = z.infer<typeof AuditableEvent_RetainedDataAccess_EventDataSchema>;
 export type AuditableEvent_SubjectDataExport_EventData = z.infer<typeof AuditableEvent_SubjectDataExport_EventDataSchema>;
 export type AuditableEvent_CollectionDataExport_EventData = z.infer<typeof AuditableEvent_CollectionDataExport_EventDataSchema>;
+export type AuditableEvent_User_SessionEvictedEventData = z.infer<typeof AuditableEvent_User_SessionEvictedEventDataSchema>;
 export type AuditableEvent_HttpApiReadThroughAccess_EventData = z.infer<typeof AuditableEvent_HttpApiReadThroughAccess_EventDataSchema>;
 export type AuditableEvent_HttpApiExternalErasure_EventData = z.infer<typeof AuditableEvent_HttpApiExternalErasure_EventDataSchema>;
 export type AuditableEvent_HttpApiNonErasureAcknowledged_EventData = z.infer<typeof AuditableEvent_HttpApiNonErasureAcknowledged_EventDataSchema>;

package/dist/esm/compliance/audit-trails/auditable-events.shared.schema.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"auditable-events.shared.schema.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/audit-trails/auditable-events.shared.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAAE,MAAM,0CAA0C,CAAC;AACpH,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC1F,OAAO,EACL,qCAAqC,EACrC,sCAAsC,EACtC,yBAAyB,EAC1B,MAAM,qEAAqE,CAAC;AAC7E,OAAO,EAAE,8BAA8B,EAAE,MAAM,gDAAgD,CAAC;AAChG,OAAO,EACL,aAAa,EACb,iBAAiB,EAClB,MAAM,8DAA8D,CAAC;AACtE,OAAO,EAAE,2BAA2B,EAAE,MAAM,uDAAuD,CAAC;AAGpG,oBAAY,sBAAsB;IAEhC,UAAU,eAAe;IACzB,WAAW,gBAAgB;IAC3B,iBAAiB,sBAAsB;IACvC,mBAAmB,wBAAwB;IAC3C,qBAAqB,0BAA0B;IAO/C,gBAAgB,qBAAqB;IAErC,iBAAiB,sBAAsB;IAQvC,oBAAoB,yBAAyB;IAK7C,oBAAoB,yBAAyB;IAC7C,mBAAmB,wBAAwB;IAK3C,cAAc,mBAAmB;IAWjC,YAAY,iBAAiB;IAE7B,YAAY,iBAAiB;IAC7B,YAAY,iBAAiB;IAS7B,sBAAsB,2BAA2B;IAUjD,sCAAsC,2CAA2C;IACjF;;;;;;;;;;OAUG;IACH,iCAAiC,sCAAsC;IAIvE,oBAAoB,yBAAyB;IAE7C,oBAAoB,yBAAyB;IAC7C,oBAAoB,yBAAyB;IAC7C,0GAA0G;IAC1G,+BAA+B,oCAAoC;IACnE,2EAA2E;IAC3E,qBAAqB,0BAA0B;IAC/C,oFAAoF;IACpF,sBAAsB,2BAA2B;IACjD,mEAAmE;IACnE,sBAAsB,2BAA2B;IACjD;;;;;;;;;;;;;;OAcG;IACH,oCAAoC,yCAAyC;IAI7E,2BAA2B,gCAAgC;IAE3D,0BAA0B,+BAA+B;IAEzD,2BAA2B,gCAAgC;IAC3D,gCAAgC,qCAAqC;IAErE,kCAAkC,uCAAuC;IACzE,2BAA2B,gCAAgC;IAG3D,kCAAkC,uCAAuC;IAEzE,gCAAgC,qCAAqC;IAErE,4BAA4B,iCAAiC;IAE7D,yBAAyB,8BAA8B;IASvD,qCAAqC,0CAA0C;IAQ/E,gCAAgC,qCAAqC;IAGrE,cAAc,mBAAmB;IACjC,qBAAqB,0BAA0B;IAC/C,4BAA4B,iCAAiC;IAC7D,oBAAoB,yBAAyB;IAG7C,sCAAsC,2CAA2C;IACjF,mCAAmC,wCAAwC;IAa3E,+BAA+B,oCAAoC;IASnE,gCAAgC,qCAAqC;IAIrE,kBAAkB,uBAAuB;IACzC,kBAAkB,uBAAuB;IACzC,oBAAoB,yBAAyB;IAC7C,kBAAkB,uBAAuB;IACzC,gCAAgC,qCAAqC;IACrE,wBAAwB,6BAA6B;IACrD,qBAAqB,0BAA0B;IAC/C,iBAAiB,sBAAsB;IACvC,qBAAqB,0BAA0B;IAG/C,6BAA6B,kCAAkC;IAC/D,6BAA6B,kCAAkC;IAC/D;;;;;;;OAOG;IACH,0BAA0B,+BAA+B;IAGzD,eAAe,oBAAoB;IACnC,mBAAmB,wBAAwB;IAC3C,8BAA8B,mCAAmC;IAGjE,iBAAiB,sBAAsB;IACvC,kBAAkB,uBAAuB;IACzC,0BAA0B,+BAA+B;IAGzD,sBAAsB,2BAA2B;IACjD,wBAAwB,6BAA6B;IACrD,uBAAuB,4BAA4B;IAGnD,uBAAuB,4BAA4B;IACnD,mCAAmC,wCAAwC;IAC3E,mCAAmC,wCAAwC;IAC3E,oBAAoB,yBAAyB;IAG7C,oBAAoB,yBAAyB;IAC7C,wBAAwB,6BAA6B;IACrD,sBAAsB,2BAA2B;IAGjD,iBAAiB,sBAAsB;IACvC,qBAAqB,0BAA0B;IAC/C,mBAAmB,wBAAwB;IAG3C,mBAAmB,wBAAwB;IAC3C,8BAA8B,mCAAmC;IAGjE,oBAAoB,yBAAyB;IAC7C,kBAAkB,uBAAuB;IACzC,iBAAiB,sBAAsB;IACvC,8BAA8B,mCAAmC;IACjE,kBAAkB,uBAAuB;IACzC,kBAAkB,uBAAuB;IACzC,kBAAkB,uBAAuB;IACzC,oBAAoB,yBAAyB;IAC7C,kBAAkB,uBAAuB;IAGzC,uBAAuB,4BAA4B;IAGnD,qBAAqB,0BAA0B;IAC/C,uBAAuB,4BAA4B;IACnD,oGAAoG;IACpG,qBAAqB,0BAA0B;IAG/C,kCAAkC,uCAAuC;IAGzE,qBAAqB,0BAA0B;IAG/C,YAAY,iBAAiB;IAuB7B,4BAA4B,iCAAiC;IA+B7D,yBAAyB,8BAA8B;IACvD,kCAAkC,uCAAuC;IACzE,+BAA+B,oCAAoC;IACnE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,yBAAyB,8BAA8B;IAavD,mBAAmB,wBAAwB;IAO3C,oBAAoB,yBAAyB;IAQ7C,oBAAoB,yBAAyB;IAU7C,mBAAmB,wBAAwB;IAO3C,sBAAsB,2BAA2B;IAejD,4BAA4B,iCAAiC;IAW7D,yBAAyB,8BAA8B;IAUvD,iCAAiC,sCAAsC;IASvE;mGAC+F;IAC/F,4BAA4B,iCAAiC;IAC7D,yGAAyG;IACzG,qBAAqB,0BAA0B;IAC/C,0FAA0F;IAC1F,oBAAoB,yBAAyB;IAC7C,wGAAwG;IACxG,6BAA6B,kCAAkC;IAC/D;;;;;OAKG;IACH,+BAA+B,oCAAoC;IACnE;;;;;;;;OAQG;IACH,yBAAyB,8BAA8B;IACvD,wFAAwF;IACxF,qBAAqB,0BAA0B;IAC/C,0DAA0D;IAC1D,mBAAmB,wBAAwB;IAC3C;;wFAEoF;IACpF,yBAAyB,8BAA8B;IACvD;kFAC8E;IAC9E,0BAA0B,+BAA+B;IACzD;4DACwD;IACxD,+BAA+B,oCAAoC;IAEnE;8GAC0G;IAC1G,iCAAiC,sCAAsC;CACxE;AAED;;;;GAIG;AACH,oBAAY,8BAA8B;IACxC,2FAA2F;IAC3F,sBAAsB,2BAA2B;IACjD,+FAA+F;IAC/F,sBAAsB,2BAA2B;IACjD,oDAAoD;IACpD,UAAU,eAAe;IACzB,gFAAgF;IAChF,eAAe,oBAAoB;IACnC,4EAA4E;IAC5E,qBAAqB,0BAA0B;IAC/C,mFAAmF;IACnF,wBAAwB,6BAA6B;IACrD,gGAAgG;IAChG,eAAe,oBAAoB;IACnC,uFAAuF;IACvF,eAAe,oBAAoB;CACpC;AAED,4FAA4F;AAC5F,oBAAY,kBAAkB;IAC5B,cAAc,mBAAmB;IACjC,aAAa,kBAAkB;IAC/B,cAAc,mBAAmB;IACjC,cAAc,mBAAmB;IACjC,WAAW,gBAAgB;CAC5B;AAED,2FAA2F;AAC3F,oBAAY,kBAAkB;IAC5B,IAAI,SAAS;IACb,OAAO,YAAY;IACnB,QAAQ,aAAa;CACtB;AAED;;;;;;;;GAQG;AACH,oBAAY,6BAA6B;IACvC;;;;;;;;;;;;OAYG;IACH,iBAAiB,sBAAsB;IAEvC;;;OAGG;IACH,kBAAkB,uBAAuB;IAEzC;;;;OAIG;IACH,cAAc,mBAAmB;IAEjC;;;OAGG;IACH,sBAAsB,2BAA2B;IAEjD;;;OAGG;IACH,mBAAmB,wBAAwB;IAE3C;;;;;;;;;;;;;OAaG;IACH,sBAAsB,2BAA2B;CAClD;AAED,qCAAqC;AACrC,oBAAY,mBAAmB;IAC7B,OAAO,YAAY;IACnB,OAAO,YAAY;IACnB,OAAO,YAAY;IACnB,cAAc,mBAAmB;IACjC,gBAAgB,qBAAqB;IACrC,mBAAmB,wBAAwB;CAC5C;AAED,6CAA6C;AAC7C,oBAAY,oBAAoB;IAC9B,OAAO,YAAY;IACnB,QAAQ,aAAa;IACrB,OAAO,YAAY;CACpB;AAED;;;;;GAKG;AACH,oBAAY,sBAAsB;IAChC,gBAAgB,qBAAqB;IACrC,kBAAkB,uBAAuB;IACzC,0FAA0F;IAC1F,aAAa,kBAAkB;IAC/B,sFAAsF;IACtF,gBAAgB,qBAAqB;IACrC;;;;;;;OAOG;IACH,qBAAqB,0BAA0B;IAC/C;;;;;;;;OAQG;IACH,gCAAgC,qCAAqC;IACrE,kGAAkG;IAClG,gCAAgC,qCAAqC;IACrE,kEAAkE;IAClE,iCAAiC,sCAAsC;IACvE,sGAAsG;IACtG,mCAAmC,wCAAwC;IAC3E;;;;;;OAMG;IACH,cAAc,mBAAmB;IACjC,cAAc,mBAAmB;IACjC,cAAc,mBAAmB;CAClC;AAED,eAAO,MAAM,wBAAwB,8EAGnC,CAAC;AAEH,eAAO,MAAM,wCAAwC;;;;;;;;iBAQnD,CAAC;AAEH,eAAO,MAAM,yCAAyC;;;;;iBAKpD,CAAC;AAEH,eAAO,MAAM,8CAA8C;;;;;;;;;iBASzD,CAAC;AAEH;;;;GAIG;AACH,oBAAY,oBAAoB;IAC9B,6FAA6F;IAC7F,qBAAqB,0BAA0B;IAC/C,kGAAkG;IAClG,uBAAuB,4BAA4B;CACpD;AAED,eAAO,MAAM,gDAAgD;;;;;;;;;;iBAe3D,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,iDAAiD;;;;;;;;;iBAa5D,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,gDAAgD;;;;;;;;;;iBAa3D,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4CAA4C;;;;;;;;;;;iBA0BvD,CAAC;AAEH,eAAO,MAAM,iDAAiD;;;;;;iBAM5D,CAAC;AAEH;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,0CAA0C;;;;;;iBAOrD,CAAC;AAEH;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,kDAAkD;;;;;;;;;iBAY7D,CAAC;AAEH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iEAAiE;;;;;;iBAU5E,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,6DAA6D;;;;;;;;iBAcxE,CAAC;AAGH,eAAO,MAAM,wDAAwD;;;;;;;iBAOnE,CAAC;AAEH,eAAO,MAAM,uDAAuD;;;;;;iBAMlE,CAAC;AAEH,eAAO,MAAM,wDAAwD;;;;;iBAKnE,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,eAAO,MAAM,4DAA4D;;;;;;;;;;iBAevE,CAAC;AAEH;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,gEAAgE;;;;;;;;;;;iBAkB3E,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,4DAA4D;;;;;;;;iBAavE,CAAC;AAEH,eAAO,MAAM,8DAA8D;;;;;;;;iBAQzE,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,wDAAwD;;;;;;;;;;;;;;iBAuEnE,CAAC;AAGH,eAAO,MAAM,kDAAkD;;;;;;iBAM7D,CAAC;AAEH,eAAO,MAAM,kDAAkD;;;;;iBAK7D,CAAC;AAEH,eAAO,MAAM,kDAAkD;;;;;;;iBAO7D,CAAC;AAEH;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,4DAA4D;;;;;;;;;iBAYvE,CAAC;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,mDAAmD;;;;;;;;;iBAY9D,CAAC;AAEH;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,oDAAoD;;;;;;;;;;iBAqB/D,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,oDAAoD;;;;;;;;;iBAY/D,CAAC;AAEH;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mCAAmC,wCAAoC,CAAC;AAErF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,2DAA2D;;;;;;;iBAkBtE,CAAC;AAEH;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,gEAAgE;;;;;;;;;;;iBAyB3E,CAAC;AAEH,eAAO,MAAM,+DAA+D;;;;;;iBAM1E,CAAC;AAEH,eAAO,MAAM,6DAA6D;;;;;;iBAMxE,CAAC;AAEH,eAAO,MAAM,yDAAyD;;;;;;iBAMpE,CAAC;AAEH,eAAO,MAAM,sDAAsD;;;;;;iBAMjE,CAAC;AAIH,eAAO,MAAM,2CAA2C;;;;;;;;;;;;;iBA4CtD,CAAC;AAEH,eAAO,MAAM,iDAAiD;;;;;;;;;;;;iBAY5D,CAAC;AAEH,eAAO,MAAM,wDAAwD;;;;;;;;;iBASnE,CAAC;AAEH,eAAO,MAAM,iDAAiD;;;;;;iBAM5D,CAAC;AAIH,eAAO,MAAM,kEAAkE;;;;;;;iBAO7E,CAAC;AAIH,eAAO,MAAM,+DAA+D;;;;;;;iBAO1E,CAAC;AAMH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4DAA4D;;;;;;;;;;;iBAevE,CAAC;AAMH,eAAO,MAAM,+CAA+C;;;;;;;;iBAQ1D,CAAC;AAIH,eAAO,MAAM,+CAA+C;;;;;;;iBAO1D,CAAC;AAMH,eAAO,MAAM,kDAAkD;;;;;;;;iBAQ7D,CAAC;AAIH,eAAO,MAAM,8CAA8C;;;;;;iBAMzD,CAAC;AAIH,eAAO,MAAM,kDAAkD;;;;;iBAK7D,CAAC;AAMH,eAAO,MAAM,yDAAyD;;;;;iBAKpE,CAAC;AAEH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sDAAsD;;;;;;;;;iBAmBjE,CAAC;AAIH,eAAO,MAAM,yDAAyD;;;;;iBAKpE,CAAC;AAMH,eAAO,MAAM,6CAA6C;;;;;;iBAMxD,CAAC;AAIH,eAAO,MAAM,gDAAgD;;;;;;iBAM3D,CAAC;AAIH,eAAO,MAAM,0DAA0D;;;;;;iBAMrE,CAAC;AAMH,eAAO,MAAM,kDAAkD;;;;;;iBAM7D,CAAC;AAIH,eAAO,MAAM,oDAAoD;;;;;;iBAM/D,CAAC;AAIH,eAAO,MAAM,kDAAkD;;;;;;iBAM7D,CAAC;AAMH,eAAO,MAAM,oDAAoD;;;;;;;;;iBAS/D,CAAC;AAIH,eAAO,MAAM,qDAAqD;;;;;;;;iBAQhE,CAAC;AAIH,eAAO,MAAM,qDAAqD;;;;;;;iBAOhE,CAAC;AAIH,eAAO,MAAM,iDAAiD;;;;;;;;iBAQ5D,CAAC;AAMH,eAAO,MAAM,gDAAgD;;;;;iBAK3D,CAAC;AAIH,eAAO,MAAM,oDAAoD;;;;;;;iBAO/D,CAAC;AAIH,eAAO,MAAM,kDAAkD;;;;;;iBAM7D,CAAC;AAMH,eAAO,MAAM,6CAA6C;;;;;;;iBAOxD,CAAC;AAIH,eAAO,MAAM,iDAAiD;;;;;;;;iBAQ5D,CAAC;AAIH,eAAO,MAAM,+CAA+C;;;;;;;;iBAQ1D,CAAC;AAMH,eAAO,MAAM,gDAAgD;;;;;;iBAM3D,CAAC;AAIH,eAAO,MAAM,0DAA0D;;;;;;iBAMrE,CAAC;AAMH,eAAO,MAAM,mDAAmD;;;;;;;;;;iBA0B9D,CAAC;AAEH,MAAM,MAAM,6CAA6C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mDAAmD,CAAC,CAAC;AAIhI,eAAO,MAAM,kDAAkD;;;;;;;;;iBAS7D,CAAC;AAIH,eAAO,MAAM,0CAA0C;;;;;;;;;iBAarD,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,eAAO,MAAM,yDAAyD;;;;;;;;;;;;;;;;;;;;iBA4DpE,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,2DAA2D;;;;;;;;;;;;iBAuBtE,CAAC;AAEH,eAAO,MAAM,8DAA8D;;;;;;;;;;;;iBAwCzE,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,sDAAsD;;;;;;;;;iBA6BjE,CAAC;AAEH,eAAO,MAAM,sDAAsD;;;;;;;;;;;;;;;;;;iBAmEjE,CAAC;AAEH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,iDAAiD;;;;;;;;;;;iBAmB5D,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,gDAAgD;;;;;;;;;;iBAyB3D,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,mDAAmD;;;;;;;;;iBAgB9D,CAAC;AAEH;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,uDAAuD;;;;;;;;;;;;iBAsBlE,CAAC;AAEH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qDAAqD;;;;;;;;;;iBAkBhE,CAAC;AAEH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,4DAA4D;;;;;;;;;;iBAsBvE,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,6DAA6D;;;;;;;;;iBAaxE,CAAC;AAMH;;;;;;GAMG;AACH,eAAO,MAAM,wDAAwD;;;;;;;;iBAanE,CAAC;AAEH,yGAAyG;AACzG,eAAO,MAAM,kDAAkD;;;;;;;;iBAa7D,CAAC;AAEH,qEAAqE;AACrE,eAAO,MAAM,iDAAiD;;;;;;;iBAO5D,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,yDAAyD;;;;;;;iBAUpE,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,qDAAqD;;;;;iBAOhE,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,2DAA2D;;;;;;;iBActE,CAAC;AAEH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kDAAkD;;;;;;iBAS7D,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,gDAAgD;;;;;;iBAS3D,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,qDAAqD;;;;;;;;iBAehE,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,sDAAsD;;;;;;;iBAWjE,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,2DAA2D;;;;;;;iBAWtE,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,4DAA4D;;;;;;;iBAWvE,CAAC;AAIH,eAAO,MAAM,yBAAyB,oCAAgC,CAAC;AAKvE,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;iBAkHpC,CAAC;AAKH,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCA4FzC,CAAC;AAKH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AACvE,MAAM,MAAM,kCAAkC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wCAAwC,CAAC,CAAC;AAC1G,MAAM,MAAM,mCAAmC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yCAAyC,CAAC,CAAC;AAC5G,MAAM,MAAM,wCAAwC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8CAA8C,CAAC,CAAC;AACtH,MAAM,MAAM,2CAA2C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iDAAiD,CAAC,CAAC;AAC5H,MAAM,MAAM,0CAA0C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gDAAgD,CAAC,CAAC;AAC1H,MAAM,MAAM,sCAAsC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4CAA4C,CAAC,CAAC;AAClH,MAAM,MAAM,0CAA0C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gDAAgD,CAAC,CAAC;AAC1H,MAAM,MAAM,2CAA2C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iDAAiD,CAAC,CAAC;AAC5H,MAAM,MAAM,4CAA4C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kDAAkD,CAAC,CAAC;AAC9H,MAAM,MAAM,2DAA2D,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iEAAiE,CAAC,CAAC;AAC5J,MAAM,MAAM,uDAAuD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6DAA6D,CAAC,CAAC;AACpJ,MAAM,MAAM,oCAAoC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC;AAC9G,MAAM,MAAM,kDAAkD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wDAAwD,CAAC,CAAC;AAC1I,MAAM,MAAM,iDAAiD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uDAAuD,CAAC,CAAC;AACxI,MAAM,MAAM,kDAAkD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wDAAwD,CAAC,CAAC;AAC1I,MAAM,MAAM,sDAAsD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4DAA4D,CAAC,CAAC;AAClJ,MAAM,MAAM,wDAAwD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8DAA8D,CAAC,CAAC;AACtJ,MAAM,MAAM,kDAAkD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wDAAwD,CAAC,CAAC;AAC1I,MAAM,MAAM,4CAA4C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kDAAkD,CAAC,CAAC;AAC9H,MAAM,MAAM,4CAA4C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kDAAkD,CAAC,CAAC;AAC9H,MAAM,MAAM,4CAA4C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kDAAkD,CAAC,CAAC;AAC9H,MAAM,MAAM,sDAAsD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4DAA4D,CAAC,CAAC;AAClJ,MAAM,MAAM,6CAA6C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mDAAmD,CAAC,CAAC;AAChI,MAAM,MAAM,8CAA8C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oDAAoD,CAAC,CAAC;AAClI,MAAM,MAAM,0DAA0D,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gEAAgE,CAAC,CAAC;AAC1J,MAAM,MAAM,8CAA8C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oDAAoD,CAAC,CAAC;AAClI,MAAM,MAAM,yDAAyD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+DAA+D,CAAC,CAAC;AACxJ,MAAM,MAAM,uDAAuD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6DAA6D,CAAC,CAAC;AACpJ,MAAM,MAAM,mDAAmD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yDAAyD,CAAC,CAAC;AAC5I,MAAM,MAAM,gDAAgD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sDAAsD,CAAC,CAAC;AACtI,MAAM,MAAM,0DAA0D,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gEAAgE,CAAC,CAAC;AAC1J,MAAM,MAAM,sDAAsD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4DAA4D,CAAC,CAAC;AAClJ,MAAM,MAAM,qCAAqC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2CAA2C,CAAC,CAAC;AAChH,MAAM,MAAM,2CAA2C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iDAAiD,CAAC,CAAC;AAC5H,MAAM,MAAM,kDAAkD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wDAAwD,CAAC,CAAC;AAC1I,MAAM,MAAM,2CAA2C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iDAAiD,CAAC,CAAC;AAC5H,MAAM,MAAM,4DAA4D,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kEAAkE,CAAC,CAAC;AAC9J,MAAM,MAAM,yDAAyD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+DAA+D,CAAC,CAAC;AACxJ,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAChG,MAAM,MAAM,qDAAqD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2DAA2D,CAAC,CAAC;AAChJ,MAAM,MAAM,sDAAsD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4DAA4D,CAAC,CAAC;AAClJ,MAAM,MAAM,yCAAyC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+CAA+C,CAAC,CAAC;AACxH,MAAM,MAAM,yCAAyC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+CAA+C,CAAC,CAAC;AACxH,MAAM,MAAM,4CAA4C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kDAAkD,CAAC,CAAC;AAC9H,MAAM,MAAM,wCAAwC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8CAA8C,CAAC,CAAC;AACtH,MAAM,MAAM,4CAA4C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kDAAkD,CAAC,CAAC;AAC9H,MAAM,MAAM,mDAAmD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yDAAyD,CAAC,CAAC;AAC5I,MAAM,MAAM,mDAAmD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yDAAyD,CAAC,CAAC;AAC5I,MAAM,MAAM,gDAAgD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sDAAsD,CAAC,CAAC;AACtI,MAAM,MAAM,uCAAuC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6CAA6C,CAAC,CAAC;AACpH,MAAM,MAAM,0CAA0C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gDAAgD,CAAC,CAAC;AAC1H,MAAM,MAAM,oDAAoD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0DAA0D,CAAC,CAAC;AAC9I,MAAM,MAAM,4CAA4C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kDAAkD,CAAC,CAAC;AAC9H,MAAM,MAAM,8CAA8C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oDAAoD,CAAC,CAAC;AAClI,MAAM,MAAM,4CAA4C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kDAAkD,CAAC,CAAC;AAC9H,MAAM,MAAM,8CAA8C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oDAAoD,CAAC,CAAC;AAClI,MAAM,MAAM,+CAA+C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qDAAqD,CAAC,CAAC;AACpI,MAAM,MAAM,+CAA+C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qDAAqD,CAAC,CAAC;AACpI,MAAM,MAAM,2CAA2C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iDAAiD,CAAC,CAAC;AAC5H,MAAM,MAAM,0CAA0C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gDAAgD,CAAC,CAAC;AAC1H,MAAM,MAAM,8CAA8C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oDAAoD,CAAC,CAAC;AAClI,MAAM,MAAM,4CAA4C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kDAAkD,CAAC,CAAC;AAC9H,MAAM,MAAM,uCAAuC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6CAA6C,CAAC,CAAC;AACpH,MAAM,MAAM,2CAA2C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iDAAiD,CAAC,CAAC;AAC5H,MAAM,MAAM,yCAAyC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+CAA+C,CAAC,CAAC;AACxH,MAAM,MAAM,0CAA0C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gDAAgD,CAAC,CAAC;AAC1H,MAAM,MAAM,oDAAoD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0DAA0D,CAAC,CAAC;AAC9I,MAAM,MAAM,4CAA4C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kDAAkD,CAAC,CAAC;AAC9H,MAAM,MAAM,oCAAoC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC;AAC9G,MAAM,MAAM,mDAAmD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yDAAyD,CAAC,CAAC;AAC5I,MAAM,MAAM,gDAAgD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sDAAsD,CAAC,CAAC;AACtI,MAAM,MAAM,gDAAgD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sDAAsD,CAAC,CAAC;AACtI,MAAM,MAAM,2CAA2C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iDAAiD,CAAC,CAAC;AAC5H,MAAM,MAAM,0CAA0C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gDAAgD,CAAC,CAAC;AAC1H,MAAM,MAAM,6CAA6C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mDAAmD,CAAC,CAAC;AAChI,MAAM,MAAM,iDAAiD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uDAAuD,CAAC,CAAC;AACxI,MAAM,MAAM,+CAA+C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qDAAqD,CAAC,CAAC;AACpI,MAAM,MAAM,sDAAsD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4DAA4D,CAAC,CAAC;AAClJ,MAAM,MAAM,uDAAuD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6DAA6D,CAAC,CAAC;AACpJ,MAAM,MAAM,kDAAkD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wDAAwD,CAAC,CAAC;AAC1I,MAAM,MAAM,4CAA4C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kDAAkD,CAAC,CAAC;AAC9H,MAAM,MAAM,2CAA2C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iDAAiD,CAAC,CAAC;AAC5H,MAAM,MAAM,mDAAmD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yDAAyD,CAAC,CAAC;AAC5I,MAAM,MAAM,qDAAqD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2DAA2D,CAAC,CAAC;AAChJ,MAAM,MAAM,+CAA+C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qDAAqD,CAAC,CAAC;AACpI,MAAM,MAAM,4CAA4C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kDAAkD,CAAC,CAAC;AAC9H,MAAM,MAAM,0CAA0C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gDAAgD,CAAC,CAAC;AAC1H,MAAM,MAAM,+CAA+C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qDAAqD,CAAC,CAAC;AACpI,MAAM,MAAM,gDAAgD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sDAAsD,CAAC,CAAC;AACtI,MAAM,MAAM,qDAAqD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2DAA2D,CAAC,CAAC;AAChJ,MAAM,MAAM,sDAAsD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4DAA4D,CAAC,CAAC"}
1	+ {"version":3,"file":"auditable-events.shared.schema.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/audit-trails/auditable-events.shared.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAAE,MAAM,0CAA0C,CAAC;AACpH,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC1F,OAAO,EACL,qCAAqC,EACrC,sCAAsC,EACtC,yBAAyB,EAC1B,MAAM,qEAAqE,CAAC;AAC7E,OAAO,EAAE,8BAA8B,EAAE,MAAM,gDAAgD,CAAC;AAChG,OAAO,EACL,aAAa,EACb,iBAAiB,EAClB,MAAM,8DAA8D,CAAC;AACtE,OAAO,EAAE,2BAA2B,EAAE,MAAM,uDAAuD,CAAC;AAGpG,oBAAY,sBAAsB;IAEhC,UAAU,eAAe;IACzB,WAAW,gBAAgB;IAC3B,iBAAiB,sBAAsB;IACvC,mBAAmB,wBAAwB;IAC3C,qBAAqB,0BAA0B;IAO/C,gBAAgB,qBAAqB;IAErC,iBAAiB,sBAAsB;IAQvC,oBAAoB,yBAAyB;IAE7C;;;;;;;;;;;;;;;OAeG;IACH,oBAAoB,yBAAyB;IAK7C,oBAAoB,yBAAyB;IAC7C,mBAAmB,wBAAwB;IAK3C,cAAc,mBAAmB;IAWjC,YAAY,iBAAiB;IAE7B,YAAY,iBAAiB;IAC7B,YAAY,iBAAiB;IAS7B,sBAAsB,2BAA2B;IAUjD,sCAAsC,2CAA2C;IACjF;;;;;;;;;;OAUG;IACH,iCAAiC,sCAAsC;IAIvE,oBAAoB,yBAAyB;IAE7C,oBAAoB,yBAAyB;IAC7C,oBAAoB,yBAAyB;IAC7C,0GAA0G;IAC1G,+BAA+B,oCAAoC;IACnE,2EAA2E;IAC3E,qBAAqB,0BAA0B;IAC/C,oFAAoF;IACpF,sBAAsB,2BAA2B;IACjD,mEAAmE;IACnE,sBAAsB,2BAA2B;IACjD;;;;;;;;;;;;;;OAcG;IACH,oCAAoC,yCAAyC;IAI7E,2BAA2B,gCAAgC;IAE3D,0BAA0B,+BAA+B;IAEzD,2BAA2B,gCAAgC;IAC3D,gCAAgC,qCAAqC;IAErE,kCAAkC,uCAAuC;IACzE,2BAA2B,gCAAgC;IAG3D,kCAAkC,uCAAuC;IAEzE,gCAAgC,qCAAqC;IAErE,4BAA4B,iCAAiC;IAE7D,yBAAyB,8BAA8B;IASvD,qCAAqC,0CAA0C;IAQ/E,gCAAgC,qCAAqC;IAGrE,cAAc,mBAAmB;IACjC,qBAAqB,0BAA0B;IAC/C,4BAA4B,iCAAiC;IAC7D,oBAAoB,yBAAyB;IAG7C,sCAAsC,2CAA2C;IACjF,mCAAmC,wCAAwC;IAa3E,+BAA+B,oCAAoC;IASnE,gCAAgC,qCAAqC;IAIrE,kBAAkB,uBAAuB;IACzC,kBAAkB,uBAAuB;IACzC,oBAAoB,yBAAyB;IAC7C,kBAAkB,uBAAuB;IACzC,gCAAgC,qCAAqC;IACrE,wBAAwB,6BAA6B;IACrD,qBAAqB,0BAA0B;IAC/C,iBAAiB,sBAAsB;IACvC,qBAAqB,0BAA0B;IAG/C,6BAA6B,kCAAkC;IAC/D,6BAA6B,kCAAkC;IAC/D;;;;;;;OAOG;IACH,0BAA0B,+BAA+B;IAGzD,eAAe,oBAAoB;IACnC,mBAAmB,wBAAwB;IAC3C,8BAA8B,mCAAmC;IAGjE,iBAAiB,sBAAsB;IACvC,kBAAkB,uBAAuB;IACzC,0BAA0B,+BAA+B;IAGzD,sBAAsB,2BAA2B;IACjD,wBAAwB,6BAA6B;IACrD,uBAAuB,4BAA4B;IAGnD,uBAAuB,4BAA4B;IACnD,mCAAmC,wCAAwC;IAC3E,mCAAmC,wCAAwC;IAC3E,oBAAoB,yBAAyB;IAG7C,oBAAoB,yBAAyB;IAC7C,wBAAwB,6BAA6B;IACrD,sBAAsB,2BAA2B;IAGjD,iBAAiB,sBAAsB;IACvC,qBAAqB,0BAA0B;IAC/C,mBAAmB,wBAAwB;IAG3C,mBAAmB,wBAAwB;IAC3C,8BAA8B,mCAAmC;IAGjE,oBAAoB,yBAAyB;IAC7C,kBAAkB,uBAAuB;IACzC,iBAAiB,sBAAsB;IACvC,8BAA8B,mCAAmC;IACjE,kBAAkB,uBAAuB;IACzC,kBAAkB,uBAAuB;IACzC,kBAAkB,uBAAuB;IACzC,oBAAoB,yBAAyB;IAC7C,kBAAkB,uBAAuB;IAGzC,uBAAuB,4BAA4B;IAGnD;;;;;;;OAOG;IACH,wBAAwB,6BAA6B;IACrD,0BAA0B,+BAA+B;IACzD,yBAAyB,8BAA8B;IACvD,qBAAqB,0BAA0B;IAC/C,uBAAuB,4BAA4B;IACnD,oGAAoG;IACpG,qBAAqB,0BAA0B;IAG/C,kCAAkC,uCAAuC;IAGzE,qBAAqB,0BAA0B;IAG/C,YAAY,iBAAiB;IAuB7B,4BAA4B,iCAAiC;IA+B7D,yBAAyB,8BAA8B;IACvD,kCAAkC,uCAAuC;IACzE,+BAA+B,oCAAoC;IACnE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,yBAAyB,8BAA8B;IAavD,mBAAmB,wBAAwB;IAO3C,oBAAoB,yBAAyB;IAQ7C,oBAAoB,yBAAyB;IAU7C,mBAAmB,wBAAwB;IAO3C,sBAAsB,2BAA2B;IAejD,4BAA4B,iCAAiC;IAW7D,yBAAyB,8BAA8B;IAUvD,iCAAiC,sCAAsC;IASvE;mGAC+F;IAC/F,4BAA4B,iCAAiC;IAC7D,yGAAyG;IACzG,qBAAqB,0BAA0B;IAC/C,0FAA0F;IAC1F,oBAAoB,yBAAyB;IAC7C,wGAAwG;IACxG,6BAA6B,kCAAkC;IAC/D;;;;;OAKG;IACH,+BAA+B,oCAAoC;IACnE;;;;;;;;OAQG;IACH,yBAAyB,8BAA8B;IACvD,wFAAwF;IACxF,qBAAqB,0BAA0B;IAC/C,0DAA0D;IAC1D,mBAAmB,wBAAwB;IAC3C;;wFAEoF;IACpF,yBAAyB,8BAA8B;IACvD;kFAC8E;IAC9E,0BAA0B,+BAA+B;IACzD;4DACwD;IACxD,+BAA+B,oCAAoC;IAEnE;8GAC0G;IAC1G,iCAAiC,sCAAsC;CACxE;AAED;;;;GAIG;AACH,oBAAY,8BAA8B;IACxC,2FAA2F;IAC3F,sBAAsB,2BAA2B;IACjD,+FAA+F;IAC/F,sBAAsB,2BAA2B;IACjD,oDAAoD;IACpD,UAAU,eAAe;IACzB,gFAAgF;IAChF,eAAe,oBAAoB;IACnC,4EAA4E;IAC5E,qBAAqB,0BAA0B;IAC/C,mFAAmF;IACnF,wBAAwB,6BAA6B;IACrD,gGAAgG;IAChG,eAAe,oBAAoB;IACnC,uFAAuF;IACvF,eAAe,oBAAoB;CACpC;AAED,4FAA4F;AAC5F,oBAAY,kBAAkB;IAC5B,cAAc,mBAAmB;IACjC,aAAa,kBAAkB;IAC/B,cAAc,mBAAmB;IACjC,cAAc,mBAAmB;IACjC,WAAW,gBAAgB;CAC5B;AAED,2FAA2F;AAC3F,oBAAY,kBAAkB;IAC5B,IAAI,SAAS;IACb,OAAO,YAAY;IACnB,QAAQ,aAAa;CACtB;AAED;;;;;;;;GAQG;AACH,oBAAY,6BAA6B;IACvC;;;;;;;;;;;;OAYG;IACH,iBAAiB,sBAAsB;IAEvC;;;OAGG;IACH,kBAAkB,uBAAuB;IAEzC;;;;OAIG;IACH,cAAc,mBAAmB;IAEjC;;;OAGG;IACH,sBAAsB,2BAA2B;IAEjD;;;OAGG;IACH,mBAAmB,wBAAwB;IAE3C;;;;;;;;;;;;;OAaG;IACH,sBAAsB,2BAA2B;CAClD;AAED,qCAAqC;AACrC,oBAAY,mBAAmB;IAC7B,OAAO,YAAY;IACnB,OAAO,YAAY;IACnB,OAAO,YAAY;IACnB,cAAc,mBAAmB;IACjC,gBAAgB,qBAAqB;IACrC,mBAAmB,wBAAwB;CAC5C;AAED,6CAA6C;AAC7C,oBAAY,oBAAoB;IAC9B,OAAO,YAAY;IACnB,QAAQ,aAAa;IACrB,OAAO,YAAY;CACpB;AAED;;;;;GAKG;AACH,oBAAY,sBAAsB;IAChC,gBAAgB,qBAAqB;IACrC,kBAAkB,uBAAuB;IACzC,0FAA0F;IAC1F,aAAa,kBAAkB;IAC/B,sFAAsF;IACtF,gBAAgB,qBAAqB;IACrC;;;;;;;OAOG;IACH,qBAAqB,0BAA0B;IAC/C;;;;;;;;OAQG;IACH,gCAAgC,qCAAqC;IACrE,kGAAkG;IAClG,gCAAgC,qCAAqC;IACrE,kEAAkE;IAClE,iCAAiC,sCAAsC;IACvE,sGAAsG;IACtG,mCAAmC,wCAAwC;IAC3E;;;;;;OAMG;IACH,cAAc,mBAAmB;IACjC,cAAc,mBAAmB;IACjC,cAAc,mBAAmB;CAClC;AAED,eAAO,MAAM,wBAAwB,8EAGnC,CAAC;AAEH,eAAO,MAAM,wCAAwC;;;;;;;;iBAQnD,CAAC;AAEH,eAAO,MAAM,yCAAyC;;;;;iBAKpD,CAAC;AAEH,eAAO,MAAM,8CAA8C;;;;;;;;;iBASzD,CAAC;AAEH;;;;GAIG;AACH,oBAAY,oBAAoB;IAC9B,6FAA6F;IAC7F,qBAAqB,0BAA0B;IAC/C,kGAAkG;IAClG,uBAAuB,4BAA4B;CACpD;AAED,eAAO,MAAM,gDAAgD;;;;;;;;;;iBAe3D,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,iDAAiD;;;;;;;;;iBAa5D,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,gDAAgD;;;;;;;;;;iBAa3D,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4CAA4C;;;;;;;;;;;iBA0BvD,CAAC;AAEH,eAAO,MAAM,iDAAiD;;;;;;iBAM5D,CAAC;AAEH;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,iDAAiD;;;;;;;iBAW5D,CAAC;AAEH;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,0CAA0C;;;;;;iBAOrD,CAAC;AAEH;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,kDAAkD;;;;;;;;;iBAY7D,CAAC;AAEH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iEAAiE;;;;;;iBAU5E,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,6DAA6D;;;;;;;;iBAcxE,CAAC;AAGH,eAAO,MAAM,wDAAwD;;;;;;;iBAOnE,CAAC;AAEH,eAAO,MAAM,uDAAuD;;;;;;iBAMlE,CAAC;AAEH,eAAO,MAAM,wDAAwD;;;;;iBAKnE,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,eAAO,MAAM,4DAA4D;;;;;;;;;;iBAevE,CAAC;AAEH;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,gEAAgE;;;;;;;;;;;iBAkB3E,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,4DAA4D;;;;;;;;iBAavE,CAAC;AAEH,eAAO,MAAM,8DAA8D;;;;;;;;iBAQzE,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,wDAAwD;;;;;;;;;;;;;;iBAuEnE,CAAC;AAGH,eAAO,MAAM,kDAAkD;;;;;;iBAM7D,CAAC;AAEH,eAAO,MAAM,kDAAkD;;;;;iBAK7D,CAAC;AAEH,eAAO,MAAM,kDAAkD;;;;;;;iBAO7D,CAAC;AAEH;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,4DAA4D;;;;;;;;;iBAYvE,CAAC;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,mDAAmD;;;;;;;;;iBAY9D,CAAC;AAEH;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,oDAAoD;;;;;;;;;;iBAqB/D,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,oDAAoD;;;;;;;;;iBAY/D,CAAC;AAEH;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mCAAmC,wCAAoC,CAAC;AAErF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,2DAA2D;;;;;;;iBAkBtE,CAAC;AAEH;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,gEAAgE;;;;;;;;;;;iBAyB3E,CAAC;AAEH,eAAO,MAAM,+DAA+D;;;;;;iBAM1E,CAAC;AAEH,eAAO,MAAM,6DAA6D;;;;;;iBAMxE,CAAC;AAEH,eAAO,MAAM,yDAAyD;;;;;;iBAMpE,CAAC;AAEH,eAAO,MAAM,sDAAsD;;;;;;iBAMjE,CAAC;AAIH,eAAO,MAAM,2CAA2C;;;;;;;;;;;;;iBA4CtD,CAAC;AAEH,eAAO,MAAM,iDAAiD;;;;;;;;;;;;iBAY5D,CAAC;AAEH,eAAO,MAAM,wDAAwD;;;;;;;;;iBASnE,CAAC;AAEH,eAAO,MAAM,iDAAiD;;;;;;iBAM5D,CAAC;AAIH,eAAO,MAAM,kEAAkE;;;;;;;iBAO7E,CAAC;AAIH,eAAO,MAAM,+DAA+D;;;;;;;iBAO1E,CAAC;AAMH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4DAA4D;;;;;;;;;;;iBAevE,CAAC;AAMH,eAAO,MAAM,+CAA+C;;;;;;;;iBAQ1D,CAAC;AAIH,eAAO,MAAM,+CAA+C;;;;;;;iBAO1D,CAAC;AAMH,eAAO,MAAM,kDAAkD;;;;;;;;iBAQ7D,CAAC;AAIH,eAAO,MAAM,8CAA8C;;;;;;iBAMzD,CAAC;AAIH,eAAO,MAAM,kDAAkD;;;;;iBAK7D,CAAC;AAMH,eAAO,MAAM,yDAAyD;;;;;iBAKpE,CAAC;AAEH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sDAAsD;;;;;;;;;iBAmBjE,CAAC;AAIH,eAAO,MAAM,yDAAyD;;;;;iBAKpE,CAAC;AAMH,eAAO,MAAM,6CAA6C;;;;;;iBAMxD,CAAC;AAIH,eAAO,MAAM,gDAAgD;;;;;;iBAM3D,CAAC;AAIH,eAAO,MAAM,0DAA0D;;;;;;iBAMrE,CAAC;AAMH,eAAO,MAAM,kDAAkD;;;;;;iBAM7D,CAAC;AAIH,eAAO,MAAM,oDAAoD;;;;;;iBAM/D,CAAC;AAIH,eAAO,MAAM,kDAAkD;;;;;;iBAM7D,CAAC;AAMH,eAAO,MAAM,oDAAoD;;;;;;;;;iBAS/D,CAAC;AAIH,eAAO,MAAM,qDAAqD;;;;;;;;iBAQhE,CAAC;AAIH,eAAO,MAAM,qDAAqD;;;;;;;iBAOhE,CAAC;AAIH,eAAO,MAAM,iDAAiD;;;;;;;;iBAQ5D,CAAC;AAMH,eAAO,MAAM,gDAAgD;;;;;iBAK3D,CAAC;AAIH,eAAO,MAAM,oDAAoD;;;;;;;iBAO/D,CAAC;AAIH,eAAO,MAAM,kDAAkD;;;;;;iBAM7D,CAAC;AAMH,eAAO,MAAM,6CAA6C;;;;;;;iBAOxD,CAAC;AAIH,eAAO,MAAM,iDAAiD;;;;;;;;iBAQ5D,CAAC;AAIH,eAAO,MAAM,+CAA+C;;;;;;;;iBAQ1D,CAAC;AAMH,eAAO,MAAM,gDAAgD;;;;;;iBAM3D,CAAC;AAIH,eAAO,MAAM,0DAA0D;;;;;;iBAMrE,CAAC;AAMH,eAAO,MAAM,mDAAmD;;;;;;;;;;iBA0B9D,CAAC;AAEH,MAAM,MAAM,6CAA6C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mDAAmD,CAAC,CAAC;AAIhI,eAAO,MAAM,kDAAkD;;;;;;;;;iBAS7D,CAAC;AAIH,eAAO,MAAM,0CAA0C;;;;;;;;;iBAarD,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,eAAO,MAAM,yDAAyD;;;;;;;;;;;;;;;;;;;;iBA4DpE,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,2DAA2D;;;;;;;;;;;;iBAuBtE,CAAC;AAEH,eAAO,MAAM,8DAA8D;;;;;;;;;;;;iBAwCzE,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,sDAAsD;;;;;;;;;iBA6BjE,CAAC;AAEH,eAAO,MAAM,sDAAsD;;;;;;;;;;;;;;;;;;iBAmEjE,CAAC;AAEH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,iDAAiD;;;;;;;;;;;iBAmB5D,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,gDAAgD;;;;;;;;;;iBAyB3D,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,mDAAmD;;;;;;;;;iBAgB9D,CAAC;AAEH;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,uDAAuD;;;;;;;;;;;;iBAsBlE,CAAC;AAEH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qDAAqD;;;;;;;;;;iBAkBhE,CAAC;AAEH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,4DAA4D;;;;;;;;;;iBAsBvE,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,6DAA6D;;;;;;;;;iBAaxE,CAAC;AAMH;;;;;;GAMG;AACH,eAAO,MAAM,wDAAwD;;;;;;;;iBAanE,CAAC;AAEH,yGAAyG;AACzG,eAAO,MAAM,kDAAkD;;;;;;;;iBAa7D,CAAC;AAEH,qEAAqE;AACrE,eAAO,MAAM,iDAAiD;;;;;;;iBAO5D,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,yDAAyD;;;;;;;iBAUpE,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,qDAAqD;;;;;iBAOhE,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,2DAA2D;;;;;;;iBActE,CAAC;AAEH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kDAAkD;;;;;;iBAS7D,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,gDAAgD;;;;;;iBAS3D,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,qDAAqD;;;;;;;;iBAehE,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,sDAAsD;;;;;;;iBAWjE,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,2DAA2D;;;;;;;iBAWtE,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,4DAA4D;;;;;;;iBAWvE,CAAC;AAIH,eAAO,MAAM,yBAAyB,oCAAgC,CAAC;AAKvE,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;iBAkHpC,CAAC;AAKH,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCA6FzC,CAAC;AAKH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AACvE,MAAM,MAAM,kCAAkC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wCAAwC,CAAC,CAAC;AAC1G,MAAM,MAAM,mCAAmC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yCAAyC,CAAC,CAAC;AAC5G,MAAM,MAAM,wCAAwC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8CAA8C,CAAC,CAAC;AACtH,MAAM,MAAM,2CAA2C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iDAAiD,CAAC,CAAC;AAC5H,MAAM,MAAM,0CAA0C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gDAAgD,CAAC,CAAC;AAC1H,MAAM,MAAM,sCAAsC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4CAA4C,CAAC,CAAC;AAClH,MAAM,MAAM,0CAA0C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gDAAgD,CAAC,CAAC;AAC1H,MAAM,MAAM,2CAA2C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iDAAiD,CAAC,CAAC;AAC5H,MAAM,MAAM,4CAA4C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kDAAkD,CAAC,CAAC;AAC9H,MAAM,MAAM,2DAA2D,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iEAAiE,CAAC,CAAC;AAC5J,MAAM,MAAM,uDAAuD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6DAA6D,CAAC,CAAC;AACpJ,MAAM,MAAM,oCAAoC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC;AAC9G,MAAM,MAAM,kDAAkD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wDAAwD,CAAC,CAAC;AAC1I,MAAM,MAAM,iDAAiD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uDAAuD,CAAC,CAAC;AACxI,MAAM,MAAM,kDAAkD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wDAAwD,CAAC,CAAC;AAC1I,MAAM,MAAM,sDAAsD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4DAA4D,CAAC,CAAC;AAClJ,MAAM,MAAM,wDAAwD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8DAA8D,CAAC,CAAC;AACtJ,MAAM,MAAM,kDAAkD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wDAAwD,CAAC,CAAC;AAC1I,MAAM,MAAM,4CAA4C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kDAAkD,CAAC,CAAC;AAC9H,MAAM,MAAM,4CAA4C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kDAAkD,CAAC,CAAC;AAC9H,MAAM,MAAM,4CAA4C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kDAAkD,CAAC,CAAC;AAC9H,MAAM,MAAM,sDAAsD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4DAA4D,CAAC,CAAC;AAClJ,MAAM,MAAM,6CAA6C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mDAAmD,CAAC,CAAC;AAChI,MAAM,MAAM,8CAA8C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oDAAoD,CAAC,CAAC;AAClI,MAAM,MAAM,0DAA0D,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gEAAgE,CAAC,CAAC;AAC1J,MAAM,MAAM,8CAA8C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oDAAoD,CAAC,CAAC;AAClI,MAAM,MAAM,yDAAyD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+DAA+D,CAAC,CAAC;AACxJ,MAAM,MAAM,uDAAuD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6DAA6D,CAAC,CAAC;AACpJ,MAAM,MAAM,mDAAmD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yDAAyD,CAAC,CAAC;AAC5I,MAAM,MAAM,gDAAgD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sDAAsD,CAAC,CAAC;AACtI,MAAM,MAAM,0DAA0D,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gEAAgE,CAAC,CAAC;AAC1J,MAAM,MAAM,sDAAsD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4DAA4D,CAAC,CAAC;AAClJ,MAAM,MAAM,qCAAqC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2CAA2C,CAAC,CAAC;AAChH,MAAM,MAAM,2CAA2C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iDAAiD,CAAC,CAAC;AAC5H,MAAM,MAAM,kDAAkD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wDAAwD,CAAC,CAAC;AAC1I,MAAM,MAAM,2CAA2C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iDAAiD,CAAC,CAAC;AAC5H,MAAM,MAAM,4DAA4D,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kEAAkE,CAAC,CAAC;AAC9J,MAAM,MAAM,yDAAyD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+DAA+D,CAAC,CAAC;AACxJ,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAChG,MAAM,MAAM,qDAAqD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2DAA2D,CAAC,CAAC;AAChJ,MAAM,MAAM,sDAAsD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4DAA4D,CAAC,CAAC;AAClJ,MAAM,MAAM,yCAAyC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+CAA+C,CAAC,CAAC;AACxH,MAAM,MAAM,yCAAyC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+CAA+C,CAAC,CAAC;AACxH,MAAM,MAAM,4CAA4C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kDAAkD,CAAC,CAAC;AAC9H,MAAM,MAAM,wCAAwC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8CAA8C,CAAC,CAAC;AACtH,MAAM,MAAM,4CAA4C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kDAAkD,CAAC,CAAC;AAC9H,MAAM,MAAM,mDAAmD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yDAAyD,CAAC,CAAC;AAC5I,MAAM,MAAM,mDAAmD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yDAAyD,CAAC,CAAC;AAC5I,MAAM,MAAM,gDAAgD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sDAAsD,CAAC,CAAC;AACtI,MAAM,MAAM,uCAAuC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6CAA6C,CAAC,CAAC;AACpH,MAAM,MAAM,0CAA0C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gDAAgD,CAAC,CAAC;AAC1H,MAAM,MAAM,oDAAoD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0DAA0D,CAAC,CAAC;AAC9I,MAAM,MAAM,4CAA4C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kDAAkD,CAAC,CAAC;AAC9H,MAAM,MAAM,8CAA8C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oDAAoD,CAAC,CAAC;AAClI,MAAM,MAAM,4CAA4C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kDAAkD,CAAC,CAAC;AAC9H,MAAM,MAAM,8CAA8C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oDAAoD,CAAC,CAAC;AAClI,MAAM,MAAM,+CAA+C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qDAAqD,CAAC,CAAC;AACpI,MAAM,MAAM,+CAA+C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qDAAqD,CAAC,CAAC;AACpI,MAAM,MAAM,2CAA2C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iDAAiD,CAAC,CAAC;AAC5H,MAAM,MAAM,0CAA0C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gDAAgD,CAAC,CAAC;AAC1H,MAAM,MAAM,8CAA8C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oDAAoD,CAAC,CAAC;AAClI,MAAM,MAAM,4CAA4C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kDAAkD,CAAC,CAAC;AAC9H,MAAM,MAAM,uCAAuC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6CAA6C,CAAC,CAAC;AACpH,MAAM,MAAM,2CAA2C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iDAAiD,CAAC,CAAC;AAC5H,MAAM,MAAM,yCAAyC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+CAA+C,CAAC,CAAC;AACxH,MAAM,MAAM,0CAA0C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gDAAgD,CAAC,CAAC;AAC1H,MAAM,MAAM,oDAAoD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0DAA0D,CAAC,CAAC;AAC9I,MAAM,MAAM,4CAA4C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kDAAkD,CAAC,CAAC;AAC9H,MAAM,MAAM,oCAAoC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC;AAC9G,MAAM,MAAM,mDAAmD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yDAAyD,CAAC,CAAC;AAC5I,MAAM,MAAM,gDAAgD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sDAAsD,CAAC,CAAC;AACtI,MAAM,MAAM,gDAAgD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sDAAsD,CAAC,CAAC;AACtI,MAAM,MAAM,2CAA2C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iDAAiD,CAAC,CAAC;AAC5H,MAAM,MAAM,0CAA0C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gDAAgD,CAAC,CAAC;AAC1H,MAAM,MAAM,6CAA6C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mDAAmD,CAAC,CAAC;AAChI,MAAM,MAAM,2CAA2C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iDAAiD,CAAC,CAAC;AAC5H,MAAM,MAAM,iDAAiD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uDAAuD,CAAC,CAAC;AACxI,MAAM,MAAM,+CAA+C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qDAAqD,CAAC,CAAC;AACpI,MAAM,MAAM,sDAAsD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4DAA4D,CAAC,CAAC;AAClJ,MAAM,MAAM,uDAAuD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6DAA6D,CAAC,CAAC;AACpJ,MAAM,MAAM,kDAAkD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wDAAwD,CAAC,CAAC;AAC1I,MAAM,MAAM,4CAA4C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kDAAkD,CAAC,CAAC;AAC9H,MAAM,MAAM,2CAA2C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iDAAiD,CAAC,CAAC;AAC5H,MAAM,MAAM,mDAAmD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yDAAyD,CAAC,CAAC;AAC5I,MAAM,MAAM,qDAAqD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2DAA2D,CAAC,CAAC;AAChJ,MAAM,MAAM,+CAA+C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qDAAqD,CAAC,CAAC;AACpI,MAAM,MAAM,4CAA4C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kDAAkD,CAAC,CAAC;AAC9H,MAAM,MAAM,0CAA0C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gDAAgD,CAAC,CAAC;AAC1H,MAAM,MAAM,+CAA+C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qDAAqD,CAAC,CAAC;AACpI,MAAM,MAAM,gDAAgD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sDAAsD,CAAC,CAAC;AACtI,MAAM,MAAM,qDAAqD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2DAA2D,CAAC,CAAC;AAChJ,MAAM,MAAM,sDAAsD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4DAA4D,CAAC,CAAC"}

package/dist/esm/compliance/audit-trails/auditable-events.shared.schema.js CHANGED Viewed

@@ -31,6 +31,23 @@ export var CoreAuditableEventType;
     // idle-timeout/forced-expiry feature — where expiry IS an act someone triggers — is exactly what
     // it should name.
     CoreAuditableEventType["USER_SESSION_EXPIRED"] = "user_session_expired";
+    /**
+     * A refresh chain was FORCIBLY RETIRED because the principal exceeded its concurrent-session cap.
+     *
+     * DISTINCT from {@link USER_SESSION_EXPIRED}, and the split is semantic rather than cosmetic. An
+     * expiry is time elapsing; an eviction is a cap DISPLACING a live chain, and the two answer
+     * different reviewer questions — "was this user idle?" versus "is somebody's chain being pushed
+     * out?". The second is the one that matters: the cap exists to bound the blast radius of undetected
+     * token theft, so a burst of evictions for one principal is exactly the signal a reviewer wants.
+     *
+     * Before this, the only trace was a debug log — a security-relevant token-lifecycle act with no
+     * durable record, which is what `CLAUDE.md`'s assurance-by-construction rule asks for by name.
+     *
+     * assurance-control: WILDO.IDENTITY.SESSION_CONCURRENCY_LIMIT — the eviction enforcing the
+     * concurrent-session bound leaves a record naming WHICH chain was retired and when it was issued,
+     * so the first-in-first-out property is reviewable rather than merely implemented.
+     */
+    CoreAuditableEventType["USER_SESSION_EVICTED"] = "user_session_evicted";
     // Machine (non-human) Authentication Events — api-key / OAuth-client / exchanged client-credentials
     // token resolving to an ORGANIZATION_MACHINE / APPLICATION_MACHINE principal. The credential
     // provenance (authMethod + credentialId) + scope ride the typed eventData.
@@ -239,6 +256,17 @@ export var CoreAuditableEventType;
     // OAuth2 Provider Restriction Events (Phase G3)
     CoreAuditableEventType["OAUTH2_PROVIDER_BLOCKED"] = "oauth2_provider_blocked";
     // One-Off Session Events (W7.3b)
+    /**
+     * File upload grant lifecycle (issue #312) — the first FILE-domain audit events. A grant is a
+     * single-use bearer credential that lets whoever holds it perform ONE upload into ONE resource file
+     * field with the MINTER's authority; minting it is a delegated-authorization act and is audited as
+     * one. `ISSUED` at mint (MEDIUM: a credential left the trust boundary), `REDEEMED` when the one
+     * upload landed and the FILES row exists, `REVOKED` when the minter or an administrator cancelled
+     * it. The event data carries the grant's ID — never its value.
+     */
+    CoreAuditableEventType["FILE_UPLOAD_GRANT_ISSUED"] = "file_upload_grant_issued";
+    CoreAuditableEventType["FILE_UPLOAD_GRANT_REDEEMED"] = "file_upload_grant_redeemed";
+    CoreAuditableEventType["FILE_UPLOAD_GRANT_REVOKED"] = "file_upload_grant_revoked";
     CoreAuditableEventType["ONE_OFF_TOKEN_CREATED"] = "one_off_token_created";
     CoreAuditableEventType["ONE_OFF_TOKEN_EXCHANGED"] = "one_off_token_exchanged";
     /** revocation-B1: a super-admin cancelled an un-exchanged one-off (impersonation) session token. */
@@ -773,6 +801,35 @@ export const AuditableEvent_User_SessionExpiredEventDataSchema = z.object({
     sessionDuration: z.number(), // minutes
     lastActivity: z.date(),
 });
+/**
+ * One refresh chain retired to keep a principal within its concurrent-session cap.
+ *
+ * `evictedIssuedAt` is the load-bearing field and the reason this event is worth its own type: the
+ * cap's security property is that the OLDEST chain goes, so a record that named only the victim
+ * would prove a session ended without proving the right one did. Carrying the issuance instant makes
+ * the first-in-first-out claim checkable from the trail alone.
+ *
+ * `configuredMaximum` and `retainedCount` are here so a reviewer can tell a correctly-enforced cap
+ * from a misconfigured one without reading the config as it stood at that moment.
+ *
+ * NO token material. The JTI is an opaque identifier, never the token — the trail must not become a
+ * place where a credential can be recovered.
+ *
+ * assurance-control: WILDO.IDENTITY.SESSION_CONCURRENCY_LIMIT — the bound's enforcement is evidenced,
+ * including WHICH chain was retired, so the ordering can be reviewed and not merely trusted.
+ */
+export const AuditableEvent_User_SessionEvictedEventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.USER_SESSION_EVICTED),
+    userId: z.string(),
+    /** Opaque identifier of the retired refresh chain. Never the token itself. */
+    evictedJti: z.string(),
+    /** When the retired chain was issued — the evidence that the OLDEST one went. Absent if unreadable. */
+    evictedIssuedAt: z.date().optional(),
+    /** The cap in force for this principal's user type at the moment of eviction. */
+    configuredMaximum: z.number().int().positive(),
+    /** How many chains remained after the eviction, so an over- or under-enforcing cap is visible. */
+    retainedCount: z.number().int().nonnegative(),
+});
 /**
  * A `USERS` row was hard-deleted.
  *
@@ -2843,6 +2900,7 @@ export const AuditableEvent_TypedDataSchema = z.discriminatedUnion('eventType',
     AuditableEvent_RetainedDataAccess_EventDataSchema,
     AuditableEvent_SubjectDataExport_EventDataSchema,
     AuditableEvent_CollectionDataExport_EventDataSchema,
+    AuditableEvent_User_SessionEvictedEventDataSchema,
     AuditableEvent_HttpApiReadThroughAccess_EventDataSchema,
     AuditableEvent_HttpApiExternalErasure_EventDataSchema,
     AuditableEvent_HttpApiNonErasureAcknowledged_EventDataSchema,