npm - @wildo-ai/saas-models - Versions diffs - 1.1.0 → 1.1.2 - Mend

@wildo-ai/saas-models 1.1.0 → 1.1.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (292) hide show

package/dist/esm/compliance/audit-trails/auditable-events.shared.schema.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"auditable-events.shared.schema.js","sourceRoot":"","sources":["../../../../../src/compliance/audit-trails/auditable-events.shared.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,kDAAkD,CAAC;AACxF,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAAE,MAAM,0CAA0C,CAAC;AACpH,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC1F,OAAO,EACL,qCAAqC,EACrC,sCAAsC,EACtC,yBAAyB,GAC1B,MAAM,qEAAqE,CAAC;AAC7E,OAAO,EAAE,8BAA8B,EAAE,MAAM,gDAAgD,CAAC;AAChG,OAAO,EACL,aAAa,EACb,iBAAiB,GAClB,MAAM,8DAA8D,CAAC;AACtE,OAAO,EAAE,2BAA2B,EAAE,MAAM,uDAAuD,CAAC;AAGpG,MAAM,CAAN,IAAY,sBA0eX;AA1eD,WAAY,sBAAsB;IAChC,wBAAwB;IACxB,mDAAyB,CAAA;IACzB,qDAA2B,CAAA;IAC3B,iEAAuC,CAAA;IACvC,qEAA2C,CAAA;IAC3C,yEAA+C,CAAA;IAC/C,6FAA6F;IAC7F,yFAAyF;IACzF,gGAAgG;IAChG,+FAA+F;IAC/F,+FAA+F;IAC/F,8FAA8F;IAC9F,+DAAqC,CAAA;IACrC,2FAA2F;IAC3F,iEAAuC,CAAA;IACvC,gGAAgG;IAChG,iGAAiG;IACjG,2FAA2F;IAC3F,iGAAiG;IACjG,mFAAmF;IACnF,iGAAiG;IACjG,kBAAkB;IAClB,uEAA6C,CAAA;IAE7C,oGAAoG;IACpG,6FAA6F;IAC7F,2EAA2E;IAC3E,uEAA6C,CAAA;IAC7C,qEAA2C,CAAA;IAC3C,mGAAmG;IACnG,oGAAoG;IACpG,mGAAmG;IACnG,kGAAkG;IAClG,2DAAiC,CAAA;IAEjC,wBAAwB;IACxB,yEAAyE;IACzE,+FAA+F;IAC/F,iGAAiG;IACjG,uGAAuG;IACvG,8FAA8F;IAC9F,iGAAiG;IACjG,iGAAiG;IACjG,iEAAiE;IACjE,uDAA6B,CAAA;IAC7B,uGAAuG;IACvG,uDAA6B,CAAA;IAC7B,uDAA6B,CAAA;IAE7B,kEAAkE;IAClE,kGAAkG;IAClG,kGAAkG;IAClG,mGAAmG;IACnG,mGAAmG;IACnG,kDAAkD;IAClD,+FAA+F;IAC/F,2EAAiD,CAAA;IAEjD,iGAAiG;IACjG,8FAA8F;IAC9F,+FAA+F;IAC/F,2FAA2F;IAC3F,+FAA+F;IAC/F,uEAAuE;IACvE,mGAAmG;IACnG,wFAAwF;IACxF,2GAAiF,CAAA;IACjF;;;;;;;;;;OAUG;IACH,iGAAuE,CAAA;IAEvE,gCAAgC;IAChC,uGAAuG;IACvG,uEAA6C,CAAA;IAC7C,uGAAuG;IACvG,uEAA6C,CAAA;IAC7C,uEAA6C,CAAA;IAC7C,0GAA0G;IAC1G,6FAAmE,CAAA;IACnE,2EAA2E;IAC3E,yEAA+C,CAAA;IAC/C,oFAAoF;IACpF,2EAAiD,CAAA;IACjD,mEAAmE;IACnE,2EAAiD,CAAA;IACjD;;;;;;;;;;;;;;OAcG;IACH,uGAA6E,CAAA;IAE7E,6BAA6B;IAC7B,uGAAuG;IACvG,qFAA2D,CAAA;IAC3D,uGAAuG;IACvG,mFAAyD,CAAA;IACzD,uGAAuG;IACvG,qFAA2D,CAAA;IAC3D,+FAAqE,CAAA;IACrE,uGAAuG;IACvG,mGAAyE,CAAA;IACzE,qFAA2D,CAAA;IAE3D,uGAAuG;IACvG,mGAAyE,CAAA;IACzE,uGAAuG;IACvG,+FAAqE,CAAA;IACrE,uGAAuG;IACvG,uFAA6D,CAAA;IAC7D,uGAAuG;IACvG,iFAAuD,CAAA;IAEvD,oFAAoF;IACpF,kGAAkG;IAClG,2FAA2F;IAC3F,+FAA+F;IAC/F,mGAAmG;IACnG,2EAA2E;IAC3E,+FAA+F;IAC/F,yGAA+E,CAAA;IAE/E,iEAAiE;IACjE,+FAA+F;IAC/F,mGAAmG;IACnG,6FAA6F;IAC7F,8EAA8E;IAC9E,yFAAyF;IACzF,+FAAqE,CAAA;IAErE,4BAA4B;IAC5B,2DAAiC,CAAA;IACjC,yEAA+C,CAAA;IAC/C,uFAA6D,CAAA;IAC7D,uEAA6C,CAAA;IAE7C,0CAA0C;IAC1C,2GAAiF,CAAA;IACjF,qGAA2E,CAAA;IAE3E,4CAA4C;IAC5C,gGAAgG;IAChG,8FAA8F;IAC9F,kGAAkG;IAClG,kGAAkG;IAClG,kGAAkG;IAClG,kGAAkG;IAClG,gGAAgG;IAChG,qFAAqF;IACrF,iGAAiG;IACjG,8EAA8E;IAC9E,6FAAmE,CAAA;IAEnE,8BAA8B;IAC9B,qFAAqF;IACrF,uFAAuF;IACvF,yFAAyF;IACzF,uDAAuD;IACvD,uGAAuG;IACvG,0DAA0D;IAC1D,+FAAqE,CAAA;IAErE,qCAAqC;IACrC,uGAAuG;IACvG,mEAAyC,CAAA;IACzC,mEAAyC,CAAA;IACzC,uEAA6C,CAAA;IAC7C,mEAAyC,CAAA;IACzC,+FAAqE,CAAA;IACrE,+EAAqD,CAAA;IACrD,yEAA+C,CAAA;IAC/C,iEAAuC,CAAA;IACvC,yEAA+C,CAAA;IAE/C,6BAA6B;IAC7B,yFAA+D,CAAA;IAC/D,yFAA+D,CAAA;IAC/D;;;;;;;OAOG;IACH,mFAAyD,CAAA;IAEzD,0CAA0C;IAC1C,6DAAmC,CAAA;IACnC,qEAA2C,CAAA;IAC3C,2FAAiE,CAAA;IAEjE,kCAAkC;IAClC,iEAAuC,CAAA;IACvC,mEAAyC,CAAA;IACzC,mFAAyD,CAAA;IAEzD,4BAA4B;IAC5B,2EAAiD,CAAA;IACjD,+EAAqD,CAAA;IACrD,6EAAmD,CAAA;IAEnD,qCAAqC;IACrC,6EAAmD,CAAA;IACnD,qGAA2E,CAAA;IAC3E,qGAA2E,CAAA;IAC3E,uEAA6C,CAAA;IAE7C,+BAA+B;IAC/B,uEAA6C,CAAA;IAC7C,+EAAqD,CAAA;IACrD,2EAAiD,CAAA;IAEjD,4BAA4B;IAC5B,iEAAuC,CAAA;IACvC,yEAA+C,CAAA;IAC/C,qEAA2C,CAAA;IAE3C,uCAAuC;IACvC,qEAA2C,CAAA;IAC3C,2FAAiE,CAAA;IAEjE,sCAAsC;IACtC,uEAA6C,CAAA;IAC7C,mEAAyC,CAAA;IACzC,iEAAuC,CAAA;IACvC,2FAAiE,CAAA;IACjE,mEAAyC,CAAA;IACzC,mEAAyC,CAAA;IACzC,mEAAyC,CAAA;IACzC,uEAA6C,CAAA;IAC7C,mEAAyC,CAAA;IAEzC,gDAAgD;IAChD,6EAAmD,CAAA;IAEnD,iCAAiC;IACjC,yEAA+C,CAAA;IAC/C,6EAAmD,CAAA;IACnD,oGAAoG;IACpG,yEAA+C,CAAA;IAE/C,mEAAmE;IACnE,mGAAyE,CAAA;IAEzE,0BAA0B;IAC1B,yEAA+C,CAAA;IAE/C,sBAAsB;IACtB,uDAA6B,CAAA;IAE7B,4EAA4E;IAC5E,EAAE;IACF,iGAAiG;IACjG,gGAAgG;IAChG,kGAAkG;IAClG,0FAA0F;IAC1F,wDAAwD;IACxD,EAAE;IACF,8FAA8F;IAC9F,6FAA6F;IAC7F,4FAA4F;IAC5F,8FAA8F;IAC9F,mDAAmD;IACnD,EAAE;IACF,iGAAiG;IACjG,8FAA8F;IAC9F,8FAA8F;IAC9F,gCAAgC;IAChC,EAAE;IACF,wEAAwE;IACxE,uFAAuF;IACvF,uFAA6D,CAAA;IAE7D,kGAAkG;IAClG,EAAE;IACF,6FAA6F;IAC7F,kGAAkG;IAClG,iGAAiG;IACjG,4FAA4F;IAC5F,8EAA8E;IAC9E,EAAE;IACF,mCAAmC;IACnC,EAAE;IACF,qGAAqG;IACrG,mGAAmG;IACnG,kGAAkG;IAClG,EAAE;IACF,4CAA4C;IAC5C,EAAE;IACF,iGAAiG;IACjG,6FAA6F;IAC7F,+FAA+F;IAC/F,gGAAgG;IAChG,4FAA4F;IAC5F,gFAAgF;IAChF,EAAE;IACF,+FAA+F;IAC/F,sFAAsF;IACtF,8FAA8F;IAC9F,EAAE;IACF,8FAA8F;IAC9F,oFAAoF;IACpF,iFAAuD,CAAA;IACvD,mGAAyE,CAAA;IACzE,6FAAmE,CAAA;IACnE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,iFAAuD,CAAA;IAEvD,+CAA+C;IAC/C,0EAA0E;IAC1E,yEAAyE;IACzE,yEAAyE;IACzE,4DAA4D;IAC5D,gFAAgF;IAChF,wFAAwF;IACxF,mFAAmF;IACnF,wFAAwF;IACxF,uFAAuF;IACvF,oEAAoE;IACpE,qEAA2C,CAAA;IAC3C,2EAA2E;IAC3E,wEAAwE;IACxE,2EAA2E;IAC3E,6EAA6E;IAC7E,4EAA4E;IAC5E,+CAA+C;IAC/C,uEAA6C,CAAA;IAE7C,kDAAkD;IAClD,oGAAoG;IACpG,qGAAqG;IACrG,iHAAiH;IACjH,+FAA+F;IAC/F,uGAAuG;IACvG,uEAA6C,CAAA;IAE7C,gGAAgG;IAChG,wFAAwF;IACxF,4FAA4F;IAC5F,gGAAgG;IAChG,+FAA+F;IAC/F,2FAA2F;IAC3F,gGAAgG;IAChG,sDAAsD;IACtD,qEAA2C,CAAA;IAC3C,qFAAqF;IACrF,iGAAiG;IACjG,mGAAmG;IACnG,iGAAiG;IACjG,kGAAkG;IAClG,2EAA2E;IAC3E,2EAAiD,CAAA;IAEjD,qFAAqF;IACrF,2FAA2F;IAC3F,4FAA4F;IAC5F,yFAAyF;IACzF,4FAA4F;IAC5F,2FAA2F;IAC3F,yFAAyF;IACzF,qFAAqF;IACrF,4FAA4F;IAC5F,8FAA8F;IAC9F,8FAA8F;IAC9F,0FAA0F;IAC1F,8DAA8D;IAC9D,uFAA6D,CAAA;IAE7D,yFAAyF;IACzF,+FAA+F;IAC/F,8FAA8F;IAC9F,4FAA4F;IAC5F,mFAAmF;IACnF,4FAA4F;IAC5F,+FAA+F;IAC/F,yFAAyF;IACzF,4FAA4F;IAC5F,iFAAuD,CAAA;IAEvD,gGAAgG;IAChG,+FAA+F;IAC/F,2FAA2F;IAC3F,+FAA+F;IAC/F,+FAA+F;IAC/F,+FAA+F;IAC/F,+FAA+F;IAC/F,WAAW;IACX,iGAAuE,CAAA;IAEvE,0EAA0E;IAC1E,8EAA8E;IAC9E,mFAAmF;IACnF,4EAA4E;IAC5E,kFAAkF;IAClF,2FAA2F;IAE3F;mGAC+F;IAC/F,uFAA6D,CAAA;IAC7D,yGAAyG;IACzG,yEAA+C,CAAA;IAC/C,0FAA0F;IAC1F,uEAA6C,CAAA;IAC7C,wGAAwG;IACxG,yFAA+D,CAAA;IAC/D;;;;;OAKG;IACH,6FAAmE,CAAA;IACnE;;;;;;;;OAQG;IACH,iFAAuD,CAAA;IACvD,wFAAwF;IACxF,yEAA+C,CAAA;IAC/C,0DAA0D;IAC1D,qEAA2C,CAAA;IAC3C;;wFAEoF;IACpF,iFAAuD,CAAA;IACvD;kFAC8E;IAC9E,mFAAyD,CAAA;IACzD;4DACwD;IACxD,6FAAmE,CAAA;IAEnE;8GAC0G;IAC1G,iGAAuE,CAAA;AACzE,CAAC,EA1eW,sBAAsB,KAAtB,sBAAsB,QA0ejC;AAED;;;;GAIG;AACH,MAAM,CAAN,IAAY,8BAiBX;AAjBD,WAAY,8BAA8B;IACxC,2FAA2F;IAC3F,mFAAiD,CAAA;IACjD,+FAA+F;IAC/F,mFAAiD,CAAA;IACjD,oDAAoD;IACpD,2DAAyB,CAAA;IACzB,gFAAgF;IAChF,qEAAmC,CAAA;IACnC,4EAA4E;IAC5E,iFAA+C,CAAA;IAC/C,mFAAmF;IACnF,uFAAqD,CAAA;IACrD,gGAAgG;IAChG,qEAAmC,CAAA;IACnC,uFAAuF;IACvF,qEAAmC,CAAA;AACrC,CAAC,EAjBW,8BAA8B,KAA9B,8BAA8B,QAiBzC;AAED,4FAA4F;AAC5F,MAAM,CAAN,IAAY,kBAMX;AAND,WAAY,kBAAkB;IAC5B,uDAAiC,CAAA;IACjC,qDAA+B,CAAA;IAC/B,uDAAiC,CAAA;IACjC,uDAAiC,CAAA;IACjC,iDAA2B,CAAA;AAC7B,CAAC,EANW,kBAAkB,KAAlB,kBAAkB,QAM7B;AAED,2FAA2F;AAC3F,MAAM,CAAN,IAAY,kBAIX;AAJD,WAAY,kBAAkB;IAC5B,mCAAa,CAAA;IACb,yCAAmB,CAAA;IACnB,2CAAqB,CAAA;AACvB,CAAC,EAJW,kBAAkB,KAAlB,kBAAkB,QAI7B;AAED;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,6BAwDX;AAxDD,WAAY,6BAA6B;IACvC;;;;;;;;;;;;OAYG;IACH,wEAAuC,CAAA;IAEvC;;;OAGG;IACH,0EAAyC,CAAA;IAEzC;;;;OAIG;IACH,kEAAiC,CAAA;IAEjC;;;OAGG;IACH,kFAAiD,CAAA;IAEjD;;;OAGG;IACH,4EAA2C,CAAA;IAE3C;;;;;;;;;;;;;OAaG;IACH,kFAAiD,CAAA;AACnD,CAAC,EAxDW,6BAA6B,KAA7B,6BAA6B,QAwDxC;AAED,qCAAqC;AACrC,MAAM,CAAN,IAAY,mBAOX;AAPD,WAAY,mBAAmB;IAC7B,0CAAmB,CAAA;IACnB,0CAAmB,CAAA;IACnB,0CAAmB,CAAA;IACnB,wDAAiC,CAAA;IACjC,4DAAqC,CAAA;IACrC,kEAA2C,CAAA;AAC7C,CAAC,EAPW,mBAAmB,KAAnB,mBAAmB,QAO9B;AAED,6CAA6C;AAC7C,MAAM,CAAN,IAAY,oBAIX;AAJD,WAAY,oBAAoB;IAC9B,2CAAmB,CAAA;IACnB,6CAAqB,CAAA;IACrB,2CAAmB,CAAA;AACrB,CAAC,EAJW,oBAAoB,KAApB,oBAAoB,QAI/B;AAED;;;;;GAKG;AACH,MAAM,CAAN,IAAY,sBA0CX;AA1CD,WAAY,sBAAsB;IAChC,+DAAqC,CAAA;IACrC,mEAAyC,CAAA;IACzC,0FAA0F;IAC1F,yDAA+B,CAAA;IAC/B,sFAAsF;IACtF,+DAAqC,CAAA;IACrC;;;;;;;OAOG;IACH,yEAA+C,CAAA;IAC/C;;;;;;;;OAQG;IACH,+FAAqE,CAAA;IACrE,kGAAkG;IAClG,+FAAqE,CAAA;IACrE,kEAAkE;IAClE,iGAAuE,CAAA;IACvE,sGAAsG;IACtG,qGAA2E,CAAA;IAC3E;;;;;;OAMG;IACH,2DAAiC,CAAA;IACjC,2DAAiC,CAAA;IACjC,2DAAiC,CAAA;AACnC,CAAC,EA1CW,sBAAsB,KAAtB,sBAAsB,QA0CjC;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC;IAC9C,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC;IAC9B,CAAC,CAAC,MAAM,EAAE;CACX,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/D,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,UAAU,CAAC;IACvD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,MAAM,CAAC;IAChE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,WAAW,CAAC;IACxD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,8CAA8C,GAAG,CAAC,CAAC,MAAM,CAAC;IACrE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,iBAAiB,CAAC;IAC9D,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;IAChB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAN,IAAY,oBAKX;AALD,WAAY,oBAAoB;IAC9B,6FAA6F;IAC7F,uEAA+C,CAAA;IAC/C,kGAAkG;IAClG,2EAAmD,CAAA;AACrD,CAAC,EALW,oBAAoB,KAApB,oBAAoB,QAK/B;AAED,MAAM,CAAC,MAAM,gDAAgD,GAAG,CAAC,CAAC,MAAM,CAAC;IACvE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,mBAAmB,CAAC;IAChE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;IAChB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,UAAU;IACvC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB;;;;OAIG;IACH,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;CAChD,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iDAAiD,GAAG,CAAC,CAAC,MAAM,CAAC;IACxE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,oBAAoB,CAAC;IACjE,2DAA2D;IAC3D,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,oFAAoF;IACpF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,uFAAuF;IACvF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,mEAAmE;IACnE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gDAAgD,GAAG,CAAC,CAAC,MAAM,CAAC;IACvE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,mBAAmB,CAAC;IAChE,+EAA+E;IAC/E,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,kHAAkH;IAClH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,6GAA6G;IAC7G,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,4CAA4C,GAAG,CAAC,CAAC,MAAM,CAAC;IACnE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,cAAc,CAAC;IAC3D,2DAA2D;IAC3D,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,2FAA2F;IAC3F,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,uFAAuF;IACvF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB;;;;OAIG;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B;;;OAGG;IACH,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrC,iEAAiE;IACjE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,gGAAgG;IAChG,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,2FAA2F;IAC3F,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC/B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iDAAiD,GAAG,CAAC,CAAC,MAAM,CAAC;IACxE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,oBAAoB,CAAC;IACjE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,UAAU;IACvC,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE;CACvB,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,MAAM,CAAC;IACjE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,YAAY,CAAC;IACzD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,0FAA0F;IAC1F,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,kDAAkD,GAAG,CAAC,CAAC,MAAM,CAAC;IACzE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,sBAAsB,CAAC;IACnE,qEAAqE;IACrE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAClC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC7B,gGAAgG;IAChG,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACnC,qGAAqG;IACrG,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,iEAAiE,GAAG,CAAC,CAAC,MAAM,CAAC;IACxF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,sCAAsC,CAAC;IACnF,mGAAmG;IACnG,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE;IACjC,sCAAsC;IACtC,6BAA6B,EAAE,CAAC,CAAC,MAAM,EAAE;IACzC,uGAAuG;IACvG,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACpC,iEAAiE;IACjE,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CACpC,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,6DAA6D,GAAG,CAAC,CAAC,MAAM,CAAC;IACpF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,iCAAiC,CAAC;IAC9E,6DAA6D;IAC7D,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,gFAAgF;IAChF,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACrC,gEAAgE;IAChE,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE;IACjC,+EAA+E;IAC/E,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC/B,mDAAmD;IACnD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,iGAAiG;IACjG,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE;CAC9B,CAAC,CAAC;AAEH,yCAAyC;AACzC,MAAM,CAAC,MAAM,wDAAwD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,2BAA2B,CAAC;IACxE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC1B,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,uDAAuD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,0BAA0B,CAAC;IACvE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC1B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,wDAAwD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,2BAA2B,CAAC;IACxE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;CACvC,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,MAAM,4DAA4D,GAAG,CAAC,CAAC,MAAM,CAAC;IACnF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,gCAAgC,CAAC;IAC7E,wCAAwC;IACxC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,2CAA2C;IAC3C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,qEAAqE;IACrE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAClC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC7B,0HAA0H;IAC1H,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC9C,+FAA+F;IAC/F,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,gEAAgE,GAAG,CAAC,CAAC,MAAM,CAAC;IACvF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,qCAAqC,CAAC;IAClF,wCAAwC;IACxC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,8GAA8G;IAC9G,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,2CAA2C;IAC3C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,qFAAqF;IACrF,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3C,2EAA2E;IAC3E,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,qFAAqF;IACrF,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,4FAA4F;IAC5F,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,MAAM,4DAA4D,GAAG,CAAC,CAAC,MAAM,CAAC;IACnF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,gCAAgC,CAAC;IAC7E,yCAAyC;IACzC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,iDAAiD;IACjD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,2CAA2C;IAC3C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,oFAAoF;IACpF,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3C,4GAA4G;IAC5G,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,8DAA8D,GAAG,CAAC,CAAC,MAAM,CAAC;IACrF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,kCAAkC,CAAC;IAC/E,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,CAAC,MAAM,wDAAwD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,2BAA2B,CAAC;IACxE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,2CAA2C;IAC3C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,qDAAqD;IACrD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB;;;OAGG;IACH,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrC;;;;;;;OAOG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,qGAAqG;IACrG,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB;;;;;;;;;;;;OAYG;IACH,sBAAsB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QACvC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE;QAC9B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;KACjB,CAAC,CAAC,CAAC,QAAQ,EAAE;IACd;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB;;;;OAIG;IACH,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAEH,4CAA4C;AAC5C,MAAM,CAAC,MAAM,kDAAkD,GAAG,CAAC,CAAC,MAAM,CAAC;IACzE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,oBAAoB,CAAC;IACjE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kDAAkD,GAAG,CAAC,CAAC,MAAM,CAAC;IACzE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,oBAAoB,CAAC;IACjE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kDAAkD,GAAG,CAAC,CAAC,MAAM,CAAC;IACzE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,oBAAoB,CAAC;IACjE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,4DAA4D,GAAG,CAAC,CAAC,MAAM,CAAC;IACnF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,+BAA+B,CAAC;IAC5E,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,0FAA0F;IAC1F,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,2FAA2F;IAC3F,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,yFAAyF;IACzF,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAEH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,mDAAmD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,qBAAqB,CAAC;IAClE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,gGAAgG;IAChG,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,6CAA6C;IAC7C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,0FAA0F;IAC1F,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,oDAAoD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,sBAAsB,CAAC;IACnE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,yFAAyF;IACzF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,mGAAmG;IACnG,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,iGAAiG;IACjG,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE;IAC5B;;;;;;;OAOG;IACH,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC9C,CAAC,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,oDAAoD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,sBAAsB,CAAC;IACnE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,yDAAyD;IACzD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,qFAAqF;IACrF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,6FAA6F;IAC7F,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAEH;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;AAErF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,2DAA2D,GAAG,CAAC,CAAC,MAAM,CAAC;IAClF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,+BAA+B,CAAC;IAC5E,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,oGAAoG;IACpG,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACrC;;;;OAIG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B;;;OAGG;IACH,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,mCAAmC,CAAC,CAAC,QAAQ,EAAE;IAC5E,uGAAuG;IACvG,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,mCAAmC,CAAC;CACjE,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,gEAAgE,GAAG,CAAC,CAAC,MAAM,CAAC;IACvF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,oCAAoC,CAAC;IACjF,kFAAkF;IAClF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,gFAAgF;IAChF,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC/B,oCAAoC;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,8FAA8F;IAC9F,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,sFAAsF;IACtF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,kCAAkC;IAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,yEAAyE;IACzE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B;;;;;OAKG;IACH,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9C,4FAA4F;IAC5F,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,+DAA+D,GAAG,CAAC,CAAC,MAAM,CAAC;IACtF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,kCAAkC,CAAC;IAC/E,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,6DAA6D,GAAG,CAAC,CAAC,MAAM,CAAC;IACpF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,gCAAgC,CAAC;IAC7E,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,yDAAyD,GAAG,CAAC,CAAC,MAAM,CAAC;IAChF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,4BAA4B,CAAC;IACzE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sDAAsD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,yBAAyB,CAAC;IACtE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH,wCAAwC;AAExC,MAAM,CAAC,MAAM,2CAA2C,GAAG,CAAC,CAAC,MAAM,CAAC;IAClE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,cAAc,CAAC;IAC3D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;IAChB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC;IACzC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;IAC3C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC5B,IAAI,KAAK,CAAC,cAAc,KAAK,iBAAiB,CAAC,MAAM,EAAE,CAAC;QACtD,IACE,KAAK,CAAC,SAAS,KAAK,SAAS;eAC1B,KAAK,CAAC,cAAc,KAAK,SAAS;eAClC,KAAK,CAAC,aAAa,KAAK,SAAS,EACpC,CAAC;YACD,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,WAAW,CAAC;gBACnB,OAAO,EAAE,yDAAyD;aACnE,CAAC,CAAC;QACL,CAAC;QACD,OAAO;IACT,CAAC;IAED,MAAM,oBAAoB,GACxB,KAAK,CAAC,SAAS,KAAK,aAAa,CAAC,YAAY;WAC3C,KAAK,CAAC,cAAc,KAAK,SAAS;WAClC,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC;IACvC,MAAM,mBAAmB,GACvB,KAAK,CAAC,SAAS,KAAK,aAAa,CAAC,WAAW;WAC1C,KAAK,CAAC,aAAa,KAAK,SAAS;WACjC,KAAK,CAAC,cAAc,KAAK,SAAS,CAAC;IACxC,IAAI,CAAC,oBAAoB,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAClD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,WAAW,CAAC;YACnB,OAAO,EAAE,uEAAuE;SACjF,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iDAAiD,GAAG,CAAC,CAAC,MAAM,CAAC;IACxE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,qBAAqB,CAAC;IAClE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;IAC3B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,QAAQ,EAAE;IACpD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;IAC3C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,wDAAwD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,4BAA4B,CAAC;IACzE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;IAChB,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE;IAChC,uBAAuB,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC;IAClD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iDAAiD,GAAG,CAAC,CAAC,MAAM,CAAC;IACxE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,oBAAoB,CAAC;IACjE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH,sDAAsD;AAEtD,MAAM,CAAC,MAAM,kEAAkE,GAAG,CAAC,CAAC,MAAM,CAAC;IACzF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,sCAAsC,CAAC;IACnF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC;IACvC,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1C,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;CAClD,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,+DAA+D,GAAG,CAAC,CAAC,MAAM,CAAC;IACtF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,mCAAmC,CAAC;IAChF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC;IACxC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7C,CAAC,CAAC;AAIH,0CAA0C;AAE1C;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,4DAA4D,GAAG,CAAC,CAAC,MAAM,CAAC;IACnF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,gCAAgC,CAAC;IAC7E,6FAA6F;IAC7F,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,iCAAiC;IACjC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,mFAAmF;IACnF,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC;IAC5C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC3C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC1C,+EAA+E;IAC/E,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;CACzB,CAAC,CAAC;AAIH,iDAAiD;AAEjD,MAAM,CAAC,MAAM,+CAA+C,GAAG,CAAC,CAAC,MAAM,CAAC;IACtE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,kBAAkB,CAAC;IAC/D,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,+CAA+C,GAAG,CAAC,CAAC,MAAM,CAAC;IACtE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,kBAAkB,CAAC;IAC/D,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,oDAAoD;AAEpD,MAAM,CAAC,MAAM,kDAAkD,GAAG,CAAC,CAAC,MAAM,CAAC;IACzE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,qBAAqB,CAAC;IAClE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IACtB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,8CAA8C,GAAG,CAAC,CAAC,MAAM,CAAC;IACrE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,iBAAiB,CAAC;IAC9D,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAClD,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,kDAAkD,GAAG,CAAC,CAAC,MAAM,CAAC;IACzE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,qBAAqB,CAAC;IAClE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAIH,yCAAyC;AAEzC,MAAM,CAAC,MAAM,yDAAyD,GAAG,CAAC,CAAC,MAAM,CAAC;IAChF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,6BAA6B,CAAC;IAC1E,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,sDAAsD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,0BAA0B,CAAC;IACvE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,8EAA8E;IAC9E,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE;IAC5B;;;;;;;;OAQG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,yDAAyD,GAAG,CAAC,CAAC,MAAM,CAAC;IAChF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,6BAA6B,CAAC;IAC1E,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,sDAAsD;AAEtD,MAAM,CAAC,MAAM,6CAA6C,GAAG,CAAC,CAAC,MAAM,CAAC;IACpE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,eAAe,CAAC;IAC5D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,gDAAgD,GAAG,CAAC,CAAC,MAAM,CAAC;IACvE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,mBAAmB,CAAC;IAChE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,0DAA0D,GAAG,CAAC,CAAC,MAAM,CAAC;IACjF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,8BAA8B,CAAC;IAC3E,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,wCAAwC;AAExC,MAAM,CAAC,MAAM,kDAAkD,GAAG,CAAC,CAAC,MAAM,CAAC;IACzE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,sBAAsB,CAAC;IACnE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,oDAAoD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,wBAAwB,CAAC;IACrE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,kDAAkD,GAAG,CAAC,CAAC,MAAM,CAAC;IACzE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,uBAAuB,CAAC;IACpE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,iDAAiD;AAEjD,MAAM,CAAC,MAAM,oDAAoD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,uBAAuB,CAAC;IACpE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,qDAAqD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,mCAAmC,CAAC;IAChF,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,qDAAqD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,mCAAmC,CAAC;IAChF,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,iDAAiD,GAAG,CAAC,CAAC,MAAM,CAAC;IACxE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,oBAAoB,CAAC;IACjE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,2CAA2C;AAE3C,MAAM,CAAC,MAAM,gDAAgD,GAAG,CAAC,CAAC,MAAM,CAAC;IACvE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,oBAAoB,CAAC;IACjE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,oDAAoD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,wBAAwB,CAAC;IACrE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,kDAAkD,GAAG,CAAC,CAAC,MAAM,CAAC;IACzE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,sBAAsB,CAAC;IACnE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,wCAAwC;AAExC,MAAM,CAAC,MAAM,6CAA6C,GAAG,CAAC,CAAC,MAAM,CAAC;IACpE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,iBAAiB,CAAC;IAC9D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,iDAAiD,GAAG,CAAC,CAAC,MAAM,CAAC;IACxE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,qBAAqB,CAAC;IAClE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,+CAA+C,GAAG,CAAC,CAAC,MAAM,CAAC;IACtE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,mBAAmB,CAAC;IAChE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,mDAAmD;AAEnD,MAAM,CAAC,MAAM,gDAAgD,GAAG,CAAC,CAAC,MAAM,CAAC;IACvE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,mBAAmB,CAAC;IAChE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,0DAA0D,GAAG,CAAC,CAAC,MAAM,CAAC;IACjF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,8BAA8B,CAAC;IAC3E,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,2DAA2D;AAE3D,MAAM,CAAC,MAAM,mDAAmD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,uBAAuB,CAAC;IACpE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC;IAChC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC5B,MAAM,oBAAoB,GACxB,KAAK,CAAC,SAAS,KAAK,aAAa,CAAC,YAAY;WAC3C,KAAK,CAAC,cAAc,KAAK,SAAS;WAClC,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC;IACvC,MAAM,mBAAmB,GACvB,KAAK,CAAC,SAAS,KAAK,aAAa,CAAC,WAAW;WAC1C,KAAK,CAAC,aAAa,KAAK,SAAS;WACjC,KAAK,CAAC,cAAc,KAAK,SAAS,CAAC;IACxC,IAAI,CAAC,oBAAoB,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAClD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,WAAW,CAAC;YACnB,OAAO,EAAE,0EAA0E;SACpF,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAIH,qCAAqC;AAErC,MAAM,CAAC,MAAM,kDAAkD,GAAG,CAAC,CAAC,MAAM,CAAC;IACzE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,qBAAqB,CAAC;IAClE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;IAChB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,MAAM,CAAC;IACjE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,YAAY,CAAC;IACzD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC/B,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE;IAC9B,2FAA2F;IAC3F,+FAA+F;IAC/F,4FAA4F;IAC5F,kGAAkG;IAClG,2BAA2B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClD,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,MAAM,CAAC,MAAM,yDAAyD,GAAG,CAAC,CAAC,MAAM,CAAC;IAChF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,4BAA4B,CAAC;IAEzE,4FAA4F;IAC5F,wDAAwD;IACxD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,2FAA2F;IAC3F,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC/B,wFAAwF;IACxF,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC;IACjD;;;OAGG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,sGAAsG;IACtG,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,QAAQ,EAAE;IAC/D,4EAA4E;IAC5E,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEvC,gBAAgB;IAChB,gFAAgF;IAChF,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,8DAA8D;IAC9D,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE1C,+FAA+F;IAC/F;;;;OAIG;IACH,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACnC,uFAAuF;IACvF,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC;IACrD,yFAAyF;IACzF,2BAA2B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClD,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE1C,yGAAyG;IACzG,kFAAkF;IAClF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IAExB,eAAe;IACf,gFAAgF;IAChF,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC7C;;;;OAIG;IACH,aAAa,EAAE,CAAC;SACb,MAAM,CACL,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,MAAM,CAAC;QACP,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAC9B,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KAC9B,CAAC,CACH;SACA,QAAQ,EAAE;CACd,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,2DAA2D,GAAG,CAAC,CAAC,MAAM,CAAC;IAClF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,+BAA+B,CAAC;IAE5E,yCAAyC;IACzC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,sCAAsC,CAAC;IAC1D,yEAAyE;IACzE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,6DAA6D;IAC7D,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE;IAChC,+EAA+E;IAC/E,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,oGAAoG;IACpG,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,wDAAwD;IACxD,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC;IAClD,oFAAoF;IACpF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC9B,wFAAwF;IACxF,kBAAkB,EAAE,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC,QAAQ,EAAE;IAC5E,4FAA4F;IAC5F,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,+CAA+C;IAC/C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,8DAA8D,GAAG,CAAC,CAAC,MAAM,CAAC;IACrF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,kCAAkC,CAAC;IAE/E,yFAAyF;IACzF,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE;IAChC,oDAAoD;IACpD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,kGAAkG;IAClG,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC/B,uDAAuD;IACvD,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC;IACjD,oGAAoG;IACpG,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,8EAA8E;IAC9E,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAEjD;;;;;;;;;;OAUG;IACH,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEzC;;;;;OAKG;IACH,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE;IAC9B,wDAAwD;IACxD,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACnC,wFAAwF;IACxF,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC;CACtD,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sDAAsD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,yBAAyB,CAAC;IAEtE,wEAAwE;IACxE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,uDAAuD;IACvD,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC/B,mDAAmD;IACnD,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC;IACjD;;;;;;;OAOG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC;;;;;OAKG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC7C,oDAAoD;IACpD,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACnC,wFAAwF;IACxF,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC;CACtD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sDAAsD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,yBAAyB,CAAC;IAEtE,0EAA0E;IAC1E,6CAA6C;IAC7C,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC;IAEnD,yFAAyF;IACzF,gEAAgE;IAChE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,2FAA2F;IAC3F,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC/B,sDAAsD;IACtD,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC;IACjD;;;OAGG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,sGAAsG;IACtG,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,QAAQ,EAAE;IAC/D,4EAA4E;IAC5E,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEvC,kEAAkE;IAClE;;;;OAIG;IACH,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAEpD,wDAAwD;IACxD;;;;OAIG;IACH,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC7C;;;OAGG;IACH,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACnC,uFAAuF;IACvF,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC;IACrD,iGAAiG;IACjG,2BAA2B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClD,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE1C,yGAAyG;IACzG,kFAAkF;IAClF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IAExB,uEAAuE;IACvE;;;;OAIG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B;;;;OAIG;IACH,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE;CACpC,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,iDAAiD,GAAG,CAAC,CAAC,MAAM,CAAC;IACxE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,oBAAoB,CAAC;IACjE,4GAA4G;IAC5G,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,6GAA6G;IAC7G,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,2DAA2D;IAC3D,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,qFAAqF;IACrF,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,gFAAgF;IAChF,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1C,iGAAiG;IACjG,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC/B,wGAAwG;IACxG,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrC,wFAAwF;IACxF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,gDAAgD,GAAG,CAAC,CAAC,MAAM,CAAC;IACvE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,mBAAmB,CAAC;IAChE,yFAAyF;IACzF,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,4CAA4C;IAC5C,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,wFAAwF;IACxF,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,mEAAmE;IACnE,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC1C,oDAAoD;IACpD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B;;;OAGG;IACH,uBAAuB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC5C;;;;OAIG;IACH,8BAA8B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACnD,oDAAoD;IACpD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,MAAM,mDAAmD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,sBAAsB,CAAC;IACnE,6BAA6B;IAC7B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,+DAA+D;IAC/D,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnD,iDAAiD;IACjD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,mGAAmG;IACnG,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,mGAAmG;IACnG,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACxC,yEAAyE;IACzE,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACrC,oDAAoD;IACpD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,uDAAuD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,4BAA4B,CAAC;IACzE,yDAAyD;IACzD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,6EAA6E;IAC7E,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,oFAAoF;IACpF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,iFAAiF;IACjF,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,6EAA6E;IAC7E,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,sFAAsF;IACtF,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,qEAAqE;IACrE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,kDAAkD;IAClD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,gEAAgE;IAChE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,4FAA4F;IAC5F,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;CACpD,CAAC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,qDAAqD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,yBAAyB,CAAC;IACtE,yDAAyD;IACzD,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,yEAAyE;IACzE,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACpD,8EAA8E;IAC9E,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,sEAAsE;IACtE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,iFAAiF;IACjF,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,6EAA6E;IAC7E,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,uFAAuF;IACvF,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC/C,0DAA0D;IAC1D,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,4DAA4D,GAAG,CAAC,CAAC,MAAM,CAAC;IACnF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,iCAAiC,CAAC;IAC9E,yDAAyD;IACzD,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,uEAAuE;IACvE,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACpD,qEAAqE;IACrE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,sEAAsE;IACtE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,iFAAiF;IACjF,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,6EAA6E;IAC7E,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC;;;;OAIG;IACH,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IAC5D,0DAA0D;IAC1D,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,6DAA6D,GAAG,CAAC,CAAC,MAAM,CAAC;IACpF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,kCAAkC,CAAC;IAC/E,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,uFAAuF;IACvF,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChD,qFAAqF;IACrF,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,mEAAmE;IACnE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,mFAAmF;IACnF,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,sFAAsF;AAEtF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,wDAAwD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,4BAA4B,CAAC;IACzE,4DAA4D;IAC5D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,+DAA+D;IAC/D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,qEAAqE;IACrE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,4GAA4G;IAC5G,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3B,qFAAqF;IACrF,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH,yGAAyG;AACzG,MAAM,CAAC,MAAM,kDAAkD,GAAG,CAAC,CAAC,MAAM,CAAC;IACzE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,qBAAqB,CAAC;IAClE,6BAA6B;IAC7B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,6CAA6C;IAC7C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,+BAA+B;IAC/B,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3B,oEAAoE;IACpE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,sGAAsG;IACtG,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;IACvB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH,qEAAqE;AACrE,MAAM,CAAC,MAAM,iDAAiD,GAAG,CAAC,CAAC,MAAM,CAAC;IACxE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,oBAAoB,CAAC;IACjE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,yDAAyD,GAAG,CAAC,CAAC,MAAM,CAAC;IAChF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,6BAA6B,CAAC;IAC1E,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,6FAA6F;IAC7F,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,gEAAgE;IAChE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3B,qGAAqG;IACrG,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;CACxB,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,qDAAqD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,yBAAyB,CAAC;IACtE,qGAAqG;IACrG,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,iFAAiF;IACjF,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,2DAA2D,GAAG,CAAC,CAAC,MAAM,CAAC;IAClF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,+BAA+B,CAAC;IAC5E,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,iGAAiG;IACjG,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,6FAA6F;IAC7F,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACjC;;;;OAIG;IACH,sBAAsB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,kDAAkD,GAAG,CAAC,CAAC,MAAM,CAAC;IACzE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,qBAAqB,CAAC;IAClE,8FAA8F;IAC9F,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,2GAA2G;IAC3G,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,0GAA0G;IAC1G,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,gDAAgD,GAAG,CAAC,CAAC,MAAM,CAAC;IACvE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,mBAAmB,CAAC;IAChE,0EAA0E;IAC1E,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,kEAAkE;IAClE,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE;IAChC,wEAAwE;IACxE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qDAAqD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,yBAAyB,CAAC;IACtE,4GAA4G;IAC5G,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,kGAAkG;IAClG,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,2FAA2F;IAC3F,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,+FAA+F;IAC/F,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE;IAC9B;;+BAE2B;IAC3B,6BAA6B,EAAE,CAAC,CAAC,OAAO,EAAE;IAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sDAAsD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,0BAA0B,CAAC;IACvE,sDAAsD;IACtD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC;IAC9C,2DAA2D;IAC3D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,iEAAiE;IACjE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,wEAAwE;IACxE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,2DAA2D,GAAG,CAAC,CAAC,MAAM,CAAC;IAClF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,+BAA+B,CAAC;IAC5E,qEAAqE;IACrE,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC/B,uEAAuE;IACvE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,0DAA0D;IAC1D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,qEAAqE;IACrE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,4DAA4D,GAAG,CAAC,CAAC,MAAM,CAAC;IACnF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,iCAAiC,CAAC;IAC9E,4DAA4D;IAC5D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,2FAA2F;IAC3F,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,2EAA2E;IAC3E,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,kGAAkG;IAClG,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE;IAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH,8DAA8D;AAC9D,0EAA0E;AAC1E,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;AAKvE,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAC/C;;;;;;;;;OASG;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE;IACjC,oGAAoG;IACpG,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE;IAC9C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAqCG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE;IACtD;;;OAGG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE;IACrD;;;;;;;;OAQG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE;IACnE;;;;OAIG;IACH,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE;IAC3D;;;;;;;;;;;;;;;OAeG;IACH,kGAAkG;IAClG,kGAAkG;IAClG,gCAAgC;IAChC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE;SACnE,cAAc,CAAC,oBAAoB,CAAC,QAAQ,CAAC;IAChD,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC,cAAc,EAAE;IAC9D,iGAAiG;IACjG,mGAAmG;IACnG,iGAAiG;IACjG,EAAE;IACF,kGAAkG;IAClG,iGAAiG;IACjG,mGAAmG;IACnG,+FAA+F;IAC/F,+BAA+B;IAC/B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,cAAc,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,KAAK,CAAC;IACjF,SAAS,EAAE,yBAAyB,CAAC,cAAc,CAAC,oBAAoB,CAAC,KAAK,CAAC;IAC/E,kIAAkI;IAClI,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,cAAc,EAAE;IAC1D,kIAAkI;IAClI,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,cAAc,EAAE;IACrD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACtG,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAIH,kFAAkF;AAClF,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,kBAAkB,CAAC,WAAW,EAAE;IAC9E,wCAAwC;IACxC,yCAAyC;IACzC,8CAA8C;IAC9C,gDAAgD;IAChD,iDAAiD;IACjD,gDAAgD;IAChD,4CAA4C;IAC5C,iDAAiD;IACjD,kDAAkD;IAClD,iEAAiE;IACjE,6DAA6D;IAC7D,wDAAwD;IACxD,uDAAuD;IACvD,wDAAwD;IACxD,4DAA4D;IAC5D,8DAA8D;IAC9D,wDAAwD;IACxD,kDAAkD;IAClD,kDAAkD;IAClD,kDAAkD;IAClD,4DAA4D;IAC5D,mDAAmD;IACnD,oDAAoD;IACpD,gEAAgE;IAChE,oDAAoD;IACpD,+DAA+D;IAC/D,6DAA6D;IAC7D,yDAAyD;IACzD,sDAAsD;IACtD,gEAAgE;IAChE,4DAA4D;IAC5D,0CAA0C;IAC1C,2CAA2C;IAC3C,iDAAiD;IACjD,wDAAwD;IACxD,iDAAiD;IACjD,kEAAkE;IAClE,+DAA+D;IAC/D,2DAA2D;IAC3D,4DAA4D;IAC5D,+CAA+C;IAC/C,+CAA+C;IAC/C,kDAAkD;IAClD,8CAA8C;IAC9C,kDAAkD;IAClD,yDAAyD;IACzD,yDAAyD;IACzD,sDAAsD;IACtD,6CAA6C;IAC7C,gDAAgD;IAChD,0DAA0D;IAC1D,kDAAkD;IAClD,oDAAoD;IACpD,kDAAkD;IAClD,oDAAoD;IACpD,qDAAqD;IACrD,qDAAqD;IACrD,iDAAiD;IACjD,gDAAgD;IAChD,oDAAoD;IACpD,kDAAkD;IAClD,6CAA6C;IAC7C,iDAAiD;IACjD,+CAA+C;IAC/C,gDAAgD;IAChD,0DAA0D;IAC1D,mDAAmD;IACnD,kDAAkD;IAClD,0CAA0C;IAC1C,yDAAyD;IACzD,sDAAsD;IACtD,8DAA8D;IAC9D,sDAAsD;IACtD,2DAA2D;IAC3D,iDAAiD;IACjD,gDAAgD;IAChD,mDAAmD;IACnD,uDAAuD;IACvD,qDAAqD;IACrD,4DAA4D;IAC5D,6DAA6D;IAC7D,wDAAwD;IACxD,kDAAkD;IAClD,iDAAiD;IACjD,yDAAyD;IACzD,kDAAkD;IAClD,gDAAgD;IAChD,qDAAqD;IACrD,sDAAsD;IACtD,2DAA2D;IAC3D,4DAA4D;CAC7D,CAAC,CAAC","sourcesContent":["import { z } from \"zod\";\nimport { PersonalDataCategory } from \"../privacy/personal-data-category.shared.schemas\";\nimport { ResourceOperationRiskLevel, ResourceOperationVariantType } from \"../../resources/resources.shared.schemas\";\nimport { CoreResourceOperation } from \"../../resources/resources.shared.core.definitions\";\nimport {\n PlatformAccessGrantAutoApprovalReason,\n PlatformAccessGrantLifecycleTransition,\n PlatformAccessGrantStatus,\n} from \"../../security/authorizations/platform-access-grants.shared.schemas\";\nimport { ExecutionContext_ExecutionType } from \"../../runtime/execution-context.shared.schemas\";\nimport {\n AuthScopeType,\n SsoConnectionType,\n} from \"../../security/authentications/authentication.shared.schemas\";\nimport { WebhookEndpointProbeOutcome } from \"../../notifications/m2m/webhook-config.shared.schemas\";\n\n\nexport enum CoreAuditableEventType {\n // Authentication Events\n USER_LOGIN = 'user_login',\n USER_LOGOUT = 'user_logout',\n USER_LOGIN_FAILED = 'user_login_failed',\n USER_ACCOUNT_LOCKED = 'user_account_locked',\n USER_PASSWORD_CHANGED = 'user_password_changed',\n // audit-event-unemitted: superseded by the per-METHOD events, which is what the MFA services\n // actually emit — `USER_MFA_SETUP_STARTED` / `USER_MFA_SETUP_COMPLETED` on enrolment and\n // `USER_TOTP_DISABLED` on removal. A coarse \"MFA enabled/disabled\" pair cannot say WHICH factor\n // changed, and a user with TOTP plus a passkey makes that distinction the whole question. Kept\n // rather than deleted because a future factor-agnostic rollup is a plausible SIEM convenience;\n // it must not be emitted ALONGSIDE the per-method events without deciding which is canonical.\n USER_MFA_ENABLED = 'user_mfa_enabled',\n // audit-event-unemitted: see USER_MFA_ENABLED — `USER_TOTP_DISABLED` is the emitted event.\n USER_MFA_DISABLED = 'user_mfa_disabled',\n // audit-event-unemitted: expiry is PASSIVE — a token simply ages out, so there is no moment for\n // anyone to observe. Emitting it would require polling every live session, and would produce one\n // row per session per lifetime: the highest-volume, lowest-signal stream in the trail. The\n // session endings that carry intent are already covered (`USER_LOGOUT`, and the token-revocation\n // events). Deliberately declared-and-unwired rather than deleted, because a future\n // idle-timeout/forced-expiry feature — where expiry IS an act someone triggers — is exactly what\n // it should name.\n USER_SESSION_EXPIRED = 'user_session_expired',\n\n // Machine (non-human) Authentication Events — api-key / OAuth-client / exchanged client-credentials\n // token resolving to an ORGANIZATION_MACHINE / APPLICATION_MACHINE principal. The credential\n // provenance (authMethod + credentialId) + scope ride the typed eventData.\n MACHINE_AUTH_SUCCESS = 'machine_auth_success',\n MACHINE_AUTH_FAILED = 'machine_auth_failed',\n // Machine RESOURCE-ACCESS event — the token-USE twin of MACHINE_AUTH_SUCCESS (token-MINT). Emitted\n // per external request when a machine principal exercises an audience-bound resource-server surface\n // (A2A `message/send`, MCP `tools/call`, …). MACHINE_AUTH_SUCCESS fires once at `/oauth/token` and\n // is low-volume; MACHINE_ACCESS lets an org SIEM see WHAT a machine did, not just that it authed.\n MACHINE_ACCESS = 'machine_access',\n\n // User Lifecycle Events\n // audit-event-unemitted: this operation now leaves evidence as a generic\n // `RESOURCE_OPERATION_PERFORMED` row, which carries strictly MORE than this member could — the\n // operation identity triple, the actor's roles as they stood, the top-level `correlationId` that\n // groups a cascade, and before/after values for `.isAuditEvidence()` fields. Wiring this one too would\n // write two rows for one action. Kept rather than deleted: a purpose-built event is still the\n // right shape if this verb ever needs a payload the generic row cannot reconstruct (the standing\n // precedent is `USER_APP_ROLES_CHANGED`, which carries the `requestedRoles` set the role-ceiling\n // gate measured — something a before/after diff cannot recover).\n USER_CREATED = 'user_created',\n // audit-event-unemitted: covered by the generic `RESOURCE_OPERATION_PERFORMED` row — see USER_CREATED.\n USER_UPDATED = 'user_updated',\n USER_DELETED = 'user_deleted',\n\n // Application-Role Administration — the APPLICATION-scope twin of\n // ORGANIZATION_MEMBER_ROLE_CHANGED. `User.appRoles` IS the principal's live application authority\n // (it is read back into `initiatorRoles` on their very next request), so every change to it is an\n // access-control decision that must leave evidence. Emitted by the USERS role-administration write\n // paths (assign_roles / revoke_roles and the core CREATE/UPDATE that can rewrite the array), never\n // for an update that leaves `appRoles` untouched.\n // assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — evidence of privilege grant/revocation.\n USER_APP_ROLES_CHANGED = 'user_app_roles_changed',\n\n // The application booted with NO administratively usable super-administrator — a state the write\n // guards refuse to create, so its presence means it arrived some other way: a direct database\n // edit, a restore from a backup taken mid-erasure, a seed that authored no administrator, or a\n // role-table reconfiguration that changed which roles confer super-admin under an existing\n // population. Reported at startup, never fatal (a fresh application legitimately boots with no\n // users at all before its first administrator is seeded or registers).\n // assurance-control: WILDO.ACCESS.ADMINISTRATIVE_CONTINUITY — evidence that the application has no\n // accountable administrative principal, which is unrecoverable in-product once reached.\n APPLICATION_SUPER_ADMIN_FLOOR_BREACHED = 'application_super_admin_floor_breached',\n /*\n A tenant was left with no administratively usable owner by an action that was ALLOWED to proceed.\n \n The organization-scope twin of {@link APPLICATION_SUPER_ADMIN_FLOOR_BREACHED}, and unlike it this\n * one HAS an actor: it is emitted when a user lifecycle transition (typically a suspension) removes\n * the last usable owner of a tenant. That write is deliberately not refused — suspension is usually\n * incident response, and blocking it would mean an operator cannot lock out a compromised owner\n * without first transferring ownership using the tenant the attacker controls.\n \n Because the action proceeds, this record is the ENTIRE control. It is not decoration.\n /\n ORGANIZATION_OWNER_FLOOR_BREACHED = 'organization_owner_floor_breached',\n\n // Organization Lifecycle Events\n // audit-event-unemitted: covered by the generic `RESOURCE_OPERATION_PERFORMED` row — see USER_CREATED.\n ORGANIZATION_CREATED = 'organization_created',\n // audit-event-unemitted: covered by the generic `RESOURCE_OPERATION_PERFORMED` row — see USER_CREATED.\n ORGANIZATION_UPDATED = 'organization_updated',\n ORGANIZATION_DELETED = 'organization_deleted',\n /* The tenant was MARKED for deletion (soft-delete). Its access dies here; its data dies at the purge. /\n ORGANIZATION_DELETION_REQUESTED = 'organization_deletion_requested',\n /* A pending tenant deletion was cancelled inside the retention window. /\n ORGANIZATION_RESTORED = 'organization_restored',\n /* The tenant was administratively HALTED. Confers no authority while suspended. /\n ORGANIZATION_SUSPENDED = 'organization_suspended',\n /* A halted or expired tenant was returned to normal operation. /\n ORGANIZATION_ACTIVATED = 'organization_activated',\n /\n A governed lifecycle transition changed a subject's `status` — membership suspension and\n * reactivation, administrative user suspension, self-service account deactivation.\n \n ONE event type rather than five near-identical ones, because the five verbs it serves share an\n * identical data shape: a subject, a from→to status pair, an optional caller reason, and an\n * optional automatic-reactivation deadline. `resourceType` + `operationIdentifier` fully\n * discriminate which verb ran, so splitting would produce five schemas differing only in their\n * literal and force a reviewer asking \"show me every suspension\" to union five queries.\n \n Deliberately distinct from {@link ORGANIZATION_SUSPENDED} / {@link ORGANIZATION_ACTIVATED},\n * which are NOT collapsed into this: tenant transitions carry domain facts these do not\n * (`revokedUserTypeCount` / `regrantedUserTypeCount` — the platform-wide reach of halting a\n * tenant), so they are genuinely different events rather than the same event on another resource.\n /\n RESOURCE_STATUS_TRANSITION_PERFORMED = 'resource_status_transition_performed',\n\n // Organization Member Events\n // audit-event-unemitted: covered by the generic `RESOURCE_OPERATION_PERFORMED` row — see USER_CREATED.\n ORGANIZATION_MEMBER_INVITED = 'organization_member_invited',\n // audit-event-unemitted: covered by the generic `RESOURCE_OPERATION_PERFORMED` row — see USER_CREATED.\n ORGANIZATION_MEMBER_JOINED = 'organization_member_joined',\n // audit-event-unemitted: covered by the generic `RESOURCE_OPERATION_PERFORMED` row — see USER_CREATED.\n ORGANIZATION_MEMBER_UPDATED = 'organization_member_updated',\n ORGANIZATION_MEMBER_ROLE_CHANGED = 'organization_member_role_changed',\n // audit-event-unemitted: covered by the generic `RESOURCE_OPERATION_PERFORMED` row — see USER_CREATED.\n ORGANIZATION_MEMBER_STATUS_CHANGED = 'organization_member_status_changed',\n ORGANIZATION_MEMBER_REMOVED = 'organization_member_removed',\n\n // audit-event-unemitted: covered by the generic `RESOURCE_OPERATION_PERFORMED` row — see USER_CREATED.\n ORGANIZATION_NOTIFICATIONS_UPDATED = 'organization_notifications_updated',\n // audit-event-unemitted: covered by the generic `RESOURCE_OPERATION_PERFORMED` row — see USER_CREATED.\n ORGANIZATION_PREFERENCES_UPDATED = 'organization_preferences_updated',\n // audit-event-unemitted: covered by the generic `RESOURCE_OPERATION_PERFORMED` row — see USER_CREATED.\n ORGANIZATION_PROFILE_UPDATED = 'organization_profile_updated',\n // audit-event-unemitted: covered by the generic `RESOURCE_OPERATION_PERFORMED` row — see USER_CREATED.\n ORGANIZATION_UNIT_UPDATED = 'organization_unit_updated',\n\n // Per-unit role assignment — the NARROWED twin of ORGANIZATION_MEMBER_ROLE_CHANGED.\n // `OrganizationUnitMember.role` became live authority when `appendUnitScopedRoles` began emitting\n // it into `initiatorRoles` as a unit-narrowed entry, so assigning or re-assigning it is an\n // access-control decision on the same footing as the organization-wide array — it just confers\n // inside ONE unit rather than across the tenant. Distinct from ORGANIZATION_UNIT_UPDATED, which is\n // ORG_MANAGEMENT record-keeping about the unit itself and confers nothing.\n // assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — evidence of privilege grant/revocation.\n ORGANIZATION_UNIT_MEMBER_ROLE_CHANGED = 'organization_unit_member_role_changed',\n\n // Revocation of a per-unit role assignment — the closing half of\n // ORGANIZATION_UNIT_MEMBER_ROLE_CHANGED. Deleting an assignment row IS the revocation: the row\n // exists only to confer a role, so unlike ORGANIZATION_MEMBER_REMOVED (where losing authority is a\n // consequence of leaving the directory) there is no non-authorization reading of this event.\n // Without it the trail shows unit privileges being granted and never removed.\n // assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — evidence of privilege revocation.\n ORGANIZATION_UNIT_MEMBER_REMOVED = 'organization_unit_member_removed',\n\n // SSO Authentication Events\n USER_SSO_LOGIN = 'user_sso_login',\n USER_SSO_LOGIN_FAILED = 'user_sso_login_failed',\n USER_SSO_ENFORCEMENT_BLOCKED = 'user_sso_enforcement_blocked',\n USER_TOKEN_REFRESHED = 'user_token_refreshed',\n\n // Organization Security Management Events\n ORGANIZATION_SSO_CONFIGURATION_CHANGED = 'organization_sso_configuration_changed',\n ORGANIZATION_SIEM_EXPORT_CONFIGURED = 'organization_siem_export_configured',\n\n // Application Security Configuration Events\n // The per-user-type authentication policy (`userTypes.<type>.auth` — MFA, password, and lockout\n // requirements) is STATIC application configuration authored in code and taken into effect at\n // backend startup. A change to it — most consequentially a WEAKENING such as turning MFA off — is\n // a security-posture decision that otherwise leaves no product-side record (only source history).\n // Emitted at boot, by the system, when the resolved policy snapshot differs from the last one the\n // trail recorded for the application. Distinct from ORGANIZATION_SSO_CONFIGURATION_CHANGED, which\n // is a per-tenant runtime edit by a human admin; this is the application-wide authored baseline\n // and has no human actor at boot (the \"who\" lives in the deployment/source history).\n // assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — a change to the authentication assurance\n // requirements (MFA / password / lockout) must be attributable and evidenced.\n APPLICATION_AUTH_POLICY_CHANGED = 'application_auth_policy_changed',\n\n // Outbound M2M Webhook Events\n // An admin firing `webhookConfig.testEndpoint` makes the platform emit a signed HTTP\n // request to an operator-supplied URL. That is an outbound-traffic primitive reachable\n // from an authenticated admin surface, so every attempt — reachable or not — is recorded\n // with the actor, the scope, and the destination host.\n // assurance-control: WILDO.INTEGRATION.OUTBOUND_ACTIVITY_AUDIT — outbound connection initiated from an\n // administrative surface is attributable and monitorable.\n WEBHOOK_ENDPOINT_TEST_DISPATCHED = 'webhook_endpoint_test_dispatched',\n\n // SCIM Directory Provisioning Events\n // audit-event-unemitted: covered by the generic `RESOURCE_OPERATION_PERFORMED` row — see USER_CREATED.\n SCIM_TOKEN_CREATED = 'scim_token_created',\n SCIM_TOKEN_REVOKED = 'scim_token_revoked',\n SCIM_TOKEN_GENERATED = 'scim_token_generated',\n SCIM_TOKEN_ROTATED = 'scim_token_rotated',\n SCIM_PROVISIONING_CONFIG_UPDATED = 'scim_provisioning_config_updated',\n SCIM_PROVISIONING_FAILED = 'scim_provisioning_failed',\n SCIM_USER_PROVISIONED = 'scim_user_provisioned',\n SCIM_USER_UPDATED = 'scim_user_updated',\n SCIM_USER_DEACTIVATED = 'scim_user_deactivated',\n\n // Password Reset Events (H5)\n USER_PASSWORD_RESET_REQUESTED = 'user_password_reset_requested',\n USER_PASSWORD_RESET_COMPLETED = 'user_password_reset_completed',\n /\n An ADMINISTRATOR compelled a credential reset on another user's account.\n \n Deliberately distinct from `USER_PASSWORD_RESET_REQUESTED`, which records a SELF-SERVICE\n * request and carries no actor: reusing it for an admin action would attribute the reset to\n * the account owner, so the audit trail would name the wrong human for a privileged act. This\n * event names both the actor and the target, and records the operator's documented reason.\n /\n USER_PASSWORD_RESET_FORCED = 'user_password_reset_forced',\n\n // Registration & Verification Events (H5)\n USER_REGISTERED = 'user_registered',\n USER_EMAIL_VERIFIED = 'user_email_verified',\n USER_VERIFICATION_EMAIL_RESENT = 'user_verification_email_resent',\n\n // Method Management Events (#13f)\n USER_PASSWORD_SET = 'user_password_set',\n USER_TOTP_DISABLED = 'user_totp_disabled',\n USER_IDENTITY_LINK_REMOVED = 'user_identity_link_removed',\n\n // MFA Lifecycle Events (H5)\n USER_MFA_SETUP_STARTED = 'user_mfa_setup_started',\n USER_MFA_SETUP_COMPLETED = 'user_mfa_setup_completed',\n USER_MFA_EMAIL_OTP_SENT = 'user_mfa_email_otp_sent',\n\n // WebAuthn/Passkey Events (Phase G1)\n USER_PASSKEY_REGISTERED = 'user_passkey_registered',\n USER_PASSKEY_AUTHENTICATION_SUCCESS = 'user_passkey_authentication_success',\n USER_PASSKEY_AUTHENTICATION_FAILURE = 'user_passkey_authentication_failure',\n USER_PASSKEY_REMOVED = 'user_passkey_removed',\n\n // Magic Link Events (Phase G2)\n USER_MAGIC_LINK_SENT = 'user_magic_link_sent',\n USER_MAGIC_LINK_VERIFIED = 'user_magic_link_verified',\n USER_MAGIC_LINK_FAILED = 'user_magic_link_failed',\n\n // SMS OTP Events (Phase G2)\n USER_SMS_OTP_SENT = 'user_sms_otp_sent',\n USER_SMS_OTP_VERIFIED = 'user_sms_otp_verified',\n USER_SMS_OTP_FAILED = 'user_sms_otp_failed',\n\n // Phone Verification Events (Phase G2)\n USER_PHONE_VERIFIED = 'user_phone_verified',\n USER_PHONE_VERIFICATION_FAILED = 'user_phone_verification_failed',\n\n // SAML Authentication Events (AUTH-2)\n SAML_LOGIN_INITIATED = 'saml_login_initiated',\n SAML_LOGIN_SUCCESS = 'saml_login_success',\n SAML_LOGIN_FAILED = 'saml_login_failed',\n SAML_ASSERTION_REPLAY_DETECTED = 'saml_assertion_replay_detected',\n SAML_CERT_EXPIRING = 'saml_cert_expiring',\n SAML_SLO_INITIATED = 'saml_slo_initiated',\n SAML_SLO_COMPLETED = 'saml_slo_completed',\n SAML_METADATA_PARSED = 'saml_metadata_parsed',\n SAML_EMAIL_CHANGED = 'saml_email_changed',\n\n // OAuth2 Provider Restriction Events (Phase G3)\n OAUTH2_PROVIDER_BLOCKED = 'oauth2_provider_blocked',\n\n // One-Off Session Events (W7.3b)\n ONE_OFF_TOKEN_CREATED = 'one_off_token_created',\n ONE_OFF_TOKEN_EXCHANGED = 'one_off_token_exchanged',\n /* revocation-B1: a super-admin cancelled an un-exchanged one-off (impersonation) session token. /\n ONE_OFF_TOKEN_REVOKED = 'one_off_token_revoked',\n\n // Cross-Frontend Handoff Events (cross-app-jwt-propagation Step 2)\n USER_CROSS_FRONTEND_HANDOFF_ISSUED = 'user_cross_frontend_handoff_issued',\n\n // Emergency Access Events\n EMERGENCY_ACCESS_USED = 'emergency_access_used',\n\n // Field Access Events\n FIELD_ACCESS = 'field_access',\n\n // Resource-Operation Events — the OPERATION-triggered twin of FIELD_ACCESS.\n //\n // FIELD_ACCESS answers \"a decorated field left the system\"; it is triggered by a RESPONSE FIELD,\n // so an operation whose response carries no decorated field is invisible to it. Repo-wide, that\n // trigger is declared on FOUR fields (three secret families, CREATE-only), which left every other\n // operation in an 83-resource catalogue emitting nothing at all — including role changes,\n // suspensions, credential deletion and tenant deletion.\n //\n // This event answers the different question: \"this OPERATION was performed, by whom, on what,\n // with what effect\". It is emitted for every HIGH / CRITICAL operation variant automatically\n // (`riskLevel` is already the framework's canonical danger axis — it drives MCP destructive\n // hints, frontend danger-zone placement and CRITICAL typed-confirmation), and for any variant\n // that opts in declaratively via `auditableEvent`.\n //\n // It is the FLOOR beneath the purpose-built events, never their replacement: a verb with its own\n // event (e.g. USER_APP_ROLES_CHANGED, which carries the `requestedRoles` set the role-ceiling\n // gate was measured against — something a generic before/after diff cannot reconstruct) emits\n // that one and suppresses this.\n //\n // assurance-control: WILDO.AUDIT.SECURITY_EVENT — privileged actions on\n // resources are attributable, and the authorization effect of each is reconstructable.\n RESOURCE_OPERATION_PERFORMED = 'resource_operation_performed',\n\n // The REFUSAL twin of RESOURCE_OPERATION_PERFORMED — the other half of \"record access decisions\".\n //\n // Emitted PRE-DISPATCH from the authorizer, not from the post-commit lane, because a refused\n // operation never reaches that lane. Without this event a refused HIGH/CRITICAL action — a denied\n // role change, a blocked suspension, a rejected credential rotation — leaves NO evidence at all,\n // so an auditor cannot distinguish \"nobody attempted it\" from \"someone attempted it and was\n // stopped\". Repeated denials are also the signature of an attack in progress.\n //\n // ## Not an authentication failure\n //\n // USER_LOGIN_FAILED / MACHINE_AUTH_FAILED answer \"you are not who you claim to be\" (AUTHENTICATION).\n // This answers \"you are who you claim to be, and you may not do this\" (AUTHORIZATION). The two are\n // deliberately distinct event types in distinct categories; neither is overloaded onto the other.\n //\n // ## No risk floor, unlike the success twin\n //\n // RESOURCE_OPERATION_PERFORMED fires only at HIGH/CRITICAL because a SUCCESSFUL low-risk read is\n // routine business (371 of the 551 API-reachable variants are reads). A DENIED read is never\n // routine — it is the canonical reconnaissance signal. A risk floor here would exclude 100% of\n // denied reads while not bounding attacker volume at all (the attacker picks the endpoint, so a\n // HIGH verb is exactly as cheap to hammer as a LOW one). Volume is bounded by per-principal\n // dedup instead — see `AuditableEvent_ResourceOperationDenied_EventDataSchema`.\n //\n // Severity is WARNING, matching its AUTHENTICATION twins rather than varying with `riskLevel`:\n // severity is a pure function of event type everywhere in this map (and is re-derived\n // independently by the SIEM dispatcher), so danger grading rides the row's `riskLevel` field.\n //\n // assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT — access-control decisions are\n // recorded, including the negative decisions, and repeated refusals are detectable.\n RESOURCE_OPERATION_DENIED = 'resource_operation_denied',\n CROSS_TENANT_ADMINISTRATIVE_ACCESS = 'cross_tenant_administrative_access',\n PLATFORM_ACCESS_GRANT_LIFECYCLE = 'platform_access_grant_lifecycle',\n /\n An operator enumerated an APPLICATION-WIDE directory — a collection read that is deliberately\n * not confined to any one tenant.\n \n ## Why this is not {@link CROSS_TENANT_ADMINISTRATIVE_ACCESS}\n \n That event answers \"an operator reached a ROW belonging to a tenant they are not a member of\",\n * and it is emitted after comparing a FETCHED row's organization against the caller's role\n * entries. A directory read has no row and no target tenant — the whole point is that it spans\n * all of them — so there is nothing for that comparison to consume. Merging the two would put\n * two different questions behind one event type and make the existing one's `targetOrganizationId`\n * meaningless on half its rows. Closed vocabularies do not merge.\n \n ## Why it exists at all\n \n The reach is INTENDED and declared (`users \| list \| admin` is documented as \"admin-gated global\n * user listing\"), and it cannot be governed by the platform-access-grant mechanism: that admission\n * requires a usable grant for a TARGET tenant, and a collection call has none. So prevention is\n * structurally unavailable and EVIDENCE is the control that remains — which is exactly what\n * `.claude/rules/administrative-continuity-floors.md` asks for on a sanctioned reach: \"every\n * crossing is NAMED in the trail\". Before this event, an operator could enumerate every user's\n * email across every tenant and leave nothing behind.\n \n INFO, not WARNING: unlike its cross-tenant sibling this is an ordinary, expected administrative\n * read on a surface built for it. The subset worth escalating is selected by a SIEM rule on\n * `resourceType` + `returnedCount`, both of which ride the payload.\n \n assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT — an unconfined administrative read\n * of application-wide data is recorded with its actor, surface and size.\n /\n PLATFORM_DIRECTORY_ACCESS = 'platform_directory_access',\n\n // System-Context (ACL-bypassing) Access Events\n // Emitted whenever a server-internal `readAsSystem` / `listAsSystem` call\n // reads a resource with a synthesised super-admin context, bypassing the\n // caller's scope + role ACL. Classified by default as DATA_ACCESS / INFO\n // (an expected, authorized internal read — not an anomaly).\n // USERLESS BUT NOT UNATTRIBUTED (since 2026-07-31): there is no human to name —\n // the door synthesises its own super-admin context — but `eventData.performedByRuntime`\n // records WHICH RUNTIME exercised it (the application backend, a named minion, …).\n // Without that, a cross-tenant read by a background digital worker is indistinguishable\n // from a data seed or a lifecycle batch. Runtime attribution is deliberately a weaker,\n // honest claim than user attribution and must never be read as one.\n SYSTEM_CONTEXT_READ = 'system_context_read',\n // The MUTATION twin: emitted whenever a server-internal `createAsSystem` /\n // `updateAsSystem` / `updateManyAsSystem` call writes a resource with a\n // synthesised super-admin context, bypassing the caller's scope + role ACL\n // (e.g. registration persisting credentials). A MUTATION under an ACL bypass\n // is more sensitive than a read, so it is audited as its own distinct event\n // rather than folded into SYSTEM_CONTEXT_READ.\n SYSTEM_CONTEXT_WRITE = 'system_context_write',\n\n // Retained-Data (Impersonalization) Access Events\n // Emitted when a privileged SEE-THROUGH read reveals RETAINED (impersonalized-and-retained) records\n // that the default retention hide-predicate keeps hidden. SYSTEM_CONTEXT_READ names only the RUNTIME\n // that acted; this read is HUMAN-ATTRIBUTED (a super-admin / COMPLIANCE_AUDITOR) and carries a REQUIRED reason —\n // a compliance-grade access record over scrubbed personal data. Strictly read-only. Classified\n // DATA_ACCESS / WARNING (an authorized-but-elevated privileged access, not an anomaly ⇒ not CRITICAL).\n RETAINED_DATA_ACCESS = 'retained_data_access',\n\n // A DATA SUBJECT EXPORT was assembled and handed out — everything the framework holds about one\n // person, gathered across their whole relationship graph (GDPR Art. 15 access / Art. 20\n // portability). Deliberately NOT folded into SYSTEM_CONTEXT_READ: that event names only the\n // RUNTIME that acted and carries no notion of a subject, a purpose, or what a bundle contained,\n // so it cannot answer the question a regulator actually asks — \"who exported whose data, when,\n // and what was in it?\". The four routed export operations this capability replaced emitted\n // NOTHING at all, which is the gap this closes. Classified DATA_ACCESS / WARNING: an authorized\n // but maximally-sensitive disclosure, not an anomaly.\n SUBJECT_DATA_EXPORT = 'subject_data_export',\n // A resource LISTING was exported to a file (CSV/JSON) by an operator. Distinct from\n // SUBJECT_DATA_EXPORT, which answers a data subject's own right over their own data: this one is\n // an authorized operator taking rows they can already read and carrying them OUT of the system, so\n // the questions it must answer are \"which resource, how many rows, and was it the page they were\n // looking at or the whole table\". Classified DATA_ACCESS / INFO with a per-emit `riskLevel` — see\n // the eventData schema for why the severity is static and the risk is not.\n COLLECTION_DATA_EXPORT = 'collection_data_export',\n\n // Rows were read THROUGH an HTTP-API resource binding — data left an EXTERNAL system\n // (an enterprise's Odoo/SAP/…) via the engine's read-through repository (ETL plan, D8/R6).\n // Deliberately NOT folded into the neighbors: SYSTEM_CONTEXT_READ names a runtime acting on\n // WILDO-owned rows and knows nothing of a foreign system; COLLECTION_DATA_EXPORT is rows\n // CARRIED OUT of the system by an operator, while this is rows BROUGHT IN from a system the\n // platform does not own — the question a reviewer asks is \"who reached into which external\n // system, through which provider, for which entity, and how much came back\". Attribution\n // carries the REAL initiating user even under a SERVICE_PRINCIPAL binding (R12 — the\n // credential-sharing-as-a-service failure this vocabulary exists to prevent). One event per\n // read-family OPERATION execution (a paginated list and its count are ONE access), emitted at\n // the adapter — the only tier that witnesses EVERY remote access, including repository-direct\n // probes the services tier never sees. Classified DATA_ACCESS / INFO: routine, authorized\n // operation — the value is the queryable trail, not an alarm.\n HTTP_API_READ_THROUGH_ACCESS = 'http_api_read_through_access',\n\n // A subject erasure INVOKED the declared external-erasure operation of an HTTP_API-bound\n // resource (ETL D6 stance 6b) — rows linked to the erased subject were DELETED in a system the\n // platform does not own (OData canonical DELETE / Odoo `unlink` / a declared REST_JSON call).\n // The first OUTBOUND WRITE on the read-through plane, landing WITH its mechanism per the D8\n // narrowing. Distinct from HTTP_API_READ_THROUGH_ACCESS (rows brought IN) and from\n // SYSTEM_CONTEXT_WRITE (a trusted write to WILDO-owned rows): the reviewer question here is\n // \"which subject's rows were deleted in which external system, through which provider, and how\n // many\". Classified USER_LIFECYCLE / INFO: the sanctioned mechanics of a data-protection\n // request, not an anomaly — the erasure report is the receipt; this is the queryable trail.\n HTTP_API_EXTERNAL_ERASURE = 'http_api_external_erasure',\n\n // A subject erasure COMPLETED while rows linked to the subject remain LIVE in an HTTP_API-bound\n // external system, on the controller's explicit per-request acknowledgement (ETL D6 stance 6c,\n // `acknowledgeHttpApiNonErasure`). The record IS the control (the same doctrine as the two\n // administrative floors): no downstream check can second-guess a controller acting within GDPR\n // Art. 17(3) grounds, so what the framework owes is a loud, queryable record of the hole — the\n // subject, the resource, the provider, and how many rows remained (when countable). Classified\n // USER_LIFECYCLE / CRITICAL: one event per acknowledged resource per erasure, never a standing\n // posture.\n HTTP_API_NON_ERASURE_ACKNOWLEDGED = 'http_api_non_erasure_acknowledged',\n\n // ── OAuth2 / OIDC Provider Events (Wildo AS the authorization server) ──\n // Distinct from the `OAUTH2_` family above, which records Wildo CONSUMING an\n // EXTERNAL social OAuth provider. These record the app-issued OAuth2/OIDC provider\n // surface (`/oauth/authorize`, `/oauth/token`, `/oauth/authorize/decision`,\n // `/oauth/revoke`) — a third party gaining, or being refused, user-acting access.\n // Each maps to a Wildo assurance objective at the emit site (`assurance-control:` marker).\n\n /** A user-delegated `authorization_code` access token was minted for a third-party client\n * (the client may now act AS the user at the bound A2A/MCP resource) — the flagship grant. /\n OAUTH_DELEGATED_TOKEN_ISSUED = 'oauth_delegated_token_issued',\n /* A user APPROVED an interactive consent request — the client is authorized for this authorize flow. /\n OAUTH_CONSENT_GRANTED = 'oauth_consent_granted',\n /* A user DENIED an interactive consent request — access refused (protective, benign). /\n OAUTH_CONSENT_DENIED = 'oauth_consent_denied',\n /* A durable \"remember this app\" consent grant was created/updated — persistent delegated authority. /\n OAUTH_CONSENT_GRANT_PERSISTED = 'oauth_consent_grant_persisted',\n /\n An ANONYMOUS caller created an OAuth client identity through RFC 7591 dynamic registration.\n * The only write in this application reachable without any credential, so every occurrence is\n * evidence: the row it creates is durable, and the population of these rows is what an operator\n * needs to be able to review and revoke.\n /\n OAUTH_DYNAMIC_CLIENT_REGISTERED = 'oauth_dynamic_client_registered',\n /\n A URL-formatted `client_id` (CIMD) was REFUSED at the authorize endpoint.\n \n Auditable because the refusal reasons are not all equal: `HOST_NOT_ALLOWED` is a\n * misconfiguration, while `SSRF_TARGET_REFUSED` is an unauthenticated stranger trying to make\n * this server fetch an address only it can reach. Both arrive at the same endpoint from the same\n * kind of caller, so only the reason distinguishes them — and a spike in either is a thing an\n * operator must be able to alert on.\n /\n OAUTH_CIMD_CLIENT_REFUSED = 'oauth_cimd_client_refused',\n /* A user token was rotated via the provider `refresh_token` grant (`/oauth/token`). /\n OAUTH_TOKEN_REFRESHED = 'oauth_token_refreshed',\n /* A token was revoked via `/oauth/revoke` (RFC 7009). /\n OAUTH_TOKEN_REVOKED = 'oauth_token_revoked',\n /* An OIDC RP-Initiated Logout terminated the End-User's OP session at `/oauth/end-session`\n * (revocation-C). Distinct from `USER_LOGOUT` (first-party self-logout) and `OAUTH_TOKEN_REVOKED`\n * (RFC 7009 token revocation): this ends a SESSION on a relying party's behalf. /\n OAUTH_RP_INITIATED_LOGOUT = 'oauth_rp_initiated_logout',\n /* An `authorization_code` exchange was REJECTED (replay / PKCE failure / redirect mismatch / …) —\n * a potential attack signal. The specific cause rides `eventData.reason`. /\n OAUTH_CODE_EXCHANGE_FAILED = 'oauth_code_exchange_failed',\n /* A consent DECISION was attempted by a user who is NOT the consent request's bound user (403) —\n * a textbook cross-user authorization-abuse signal. /\n OAUTH_CONSENT_BINDING_VIOLATION = 'oauth_consent_binding_violation',\n\n /* Refresh-token REUSE detected → the whole token family was revoked (possible theft). Emitted by the\n * refresh CALLERS (the token issuer stays audit-free by design — it surfaces a reuse signal instead). /\n USER_REFRESH_TOKEN_REUSE_DETECTED = 'user_refresh_token_reuse_detected',\n}\n\n/\n Closed vocabulary of `OAUTH_CODE_EXCHANGE_FAILED` failure causes (RFC 6749 / OAuth 2.1 / RFC 7636).\n * A dedicated enum (not an inline literal union) so the emit sites, the schema, and any SIEM\n * consumer share one runtime source — the project's closed-vocabulary rule.\n /\nexport enum OAuthCodeExchangeFailureReason {\n /* The single-use code did not atomically consume — replayed, expired, or never issued. /\n CODE_REPLAY_OR_INVALID = 'code_replay_or_invalid',\n /* The consumed token was of a different consumable-token type (not an authorization code). /\n NOT_AUTHORIZATION_CODE = 'not_authorization_code',\n /* The decoded code carried no subject (userId). /\n NO_SUBJECT = 'no_subject',\n /* The redeeming `client_id` differs from the client the code was issued to. /\n CLIENT_MISMATCH = 'client_mismatch',\n /* The redeeming `redirect_uri` differs from the one bound at authorize. /\n REDIRECT_URI_MISMATCH = 'redirect_uri_mismatch',\n /* The PKCE `code_verifier` failed the bound S256 challenge (or was malformed). /\n PKCE_VERIFICATION_FAILED = 'pkce_verification_failed',\n /* The client was deactivated between authorize and redemption (redemption-window re-check). /\n CLIENT_INACTIVE = 'client_inactive',\n /* The client lost the `authorization_code` grant between authorize and redemption. /\n GRANT_TYPE_LOST = 'grant_type_lost',\n}\n\n/* Canonical event categories — used by auditable-events, security-envelope, audit-logs. /\nexport enum AuditEventCategory {\n AUTHENTICATION = 'authentication',\n AUTHORIZATION = 'authorization',\n USER_LIFECYCLE = 'user_lifecycle',\n ORG_MANAGEMENT = 'org_management',\n DATA_ACCESS = 'data_access',\n}\n\n/* Canonical severity levels — used by auditable-events, security-envelope, audit-logs. /\nexport enum AuditEventSeverity {\n INFO = 'info',\n WARNING = 'warning',\n CRITICAL = 'critical',\n}\n\n/\n Why the authorizer refused an operation. A CLOSED vocabulary — the authorizer resolves exactly\n * one of these per refusal, and a SOC dashboard groups by it.\n \n The distinction that matters most operationally is {@link SUBJECT_NOT_RESOLVABLE} vs. the rest:\n * every other member is a caller who reached a real, visible row and was refused on roles or scope,\n * whereas that one is a caller who named a row they cannot see at all — the shape of tenant\n * enumeration.\n /\nexport enum ResourceOperationDenialReason {\n /\n No initiator identity or roles on the execution context. Fail-closed: the authorizer refuses\n * rather than assuming an anonymous caller.\n \n A backstop, not a live path — verified. The execution context fails closed earlier and\n * harder: every execution type that reaches the authorizer refuses to CONSTRUCT without\n * `initiatorIds`, and the one type that permits null (`WEBHOOK_CALLBACK`) is skipped before the\n * guard, since signature verification already established trust. The roles half cannot fire\n * either — the context spreads `initiatorRoles`, so the only accepted value is an array.\n \n A row carrying this reason therefore means something bypassed context construction. Treat it as\n * a defect signal, not routine refusal traffic.\n /\n MISSING_INITIATOR = 'missing_initiator',\n\n /\n The caller's organization-wide roles did not satisfy the operation's required role set, after\n * role-hierarchy expansion. The everyday \"you are not an admin\" refusal.\n /\n INSUFFICIENT_ROLES = 'insufficient_roles',\n\n /\n The caller was refused against the target row's PRIMARY SCOPE — the row belongs to another\n * user, organization or application than the caller is entitled to. Distinct from\n * {@link INSUFFICIENT_ROLES}: the caller may hold the right role, but in the wrong tenant.\n /\n SCOPE_MISMATCH = 'scope_mismatch',\n\n /\n The caller reached the resource through a foreign-key path (`/assigned-to-users/{userId}/todos`)\n * whose owning entity they do not control.\n /\n FK_RELATIONSHIP_DENIED = 'fk_relationship_denied',\n\n /\n A collection operation was refused on its PARENT scope — the caller has no access to the\n * organization / application whose collection they addressed.\n /\n PARENT_SCOPE_DENIED = 'parent_scope_denied',\n\n /\n The named row could not be resolved for the caller: it does not exist, OR it exists and is\n * invisible to the caller's scope. The authorizer cannot distinguish these two — and that is\n * deliberate, because reporting them differently would leak the existence of out-of-scope rows.\n * The refusal surfaces to the caller as NOT_FOUND (404) and that response is unchanged by this\n * event; only the audit trail records that a refusal occurred.\n \n Consequently this reason is AMBIGUOUS BY CONSTRUCTION and a single occurrence proves nothing —\n * a 404 for a genuinely deleted record lands here too. Its value is in the aggregate: a principal\n * accumulating these against ids they never successfully read is enumerating.\n \n assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT — refusals are recorded without the record itself\n * becoming an existence oracle.\n /\n SUBJECT_NOT_RESOLVABLE = 'subject_not_resolvable',\n}\n\n/* SSO configuration change type. /\nexport enum SsoConfigChangeType {\n CREATED = 'created',\n UPDATED = 'updated',\n DELETED = 'deleted',\n PROVIDER_ADDED = 'provider_added',\n PROVIDER_REMOVED = 'provider_removed',\n ENFORCEMENT_CHANGED = 'enforcement_changed',\n}\n\n/* SIEM export configuration change type. /\nexport enum SiemExportChangeType {\n ENABLED = 'enabled',\n DISABLED = 'disabled',\n UPDATED = 'updated',\n}\n\n/\n Normalised MACHINE_ACCESS operation vocabulary. Transport-native method names (A2A JSON-RPC\n * `message/send`, MCP `tools/call`, …) are mapped to these stable, transport-prefixed audit\n * identifiers so an org SIEM reads ONE vocabulary across every external resource-server surface.\n * The `<transport>_<method>` shape keeps A2A and MCP operations disambiguated in a flat stream.\n /\nexport enum MachineAccessOperation {\n A2A_MESSAGE_SEND = 'a2a_message_send',\n A2A_MESSAGE_STREAM = 'a2a_message_stream',\n /* Reading one task's state. Externally triggered and tenant-actionable, so it audits. /\n A2A_TASKS_GET = 'a2a_tasks_get',\n /* Requesting cancellation of a task — a MUTATION of tenant work, audited as such. /\n A2A_TASKS_CANCEL = 'a2a_tasks_cancel',\n /\n Re-attaching to a task's update stream after a dropped connection.\n \n Audited like `A2A_TASKS_GET` and for the same reason: it is a READ of tenant work by an external\n * principal. It deserves its own member rather than borrowing the get — a resubscribe holds a\n * connection open for as long as the task runs, so in a trail the two have very different shapes,\n * and collapsing them would hide a caller camping on a stream behind ordinary polling.\n /\n A2A_TASKS_RESUBSCRIBE = 'a2a_tasks_resubscribe',\n /\n Registering a webhook the agent will POST this task's updates to.\n \n The most security-relevant of the push-notification operations and the reason all four get their\n * own members: the caller is directing OUR server to make outbound requests to an address IT\n * chooses, carrying credentials IT supplies. In a trail that is a different act from reading a\n * task, and an operator reviewing egress needs to find every one of them without inferring it from\n * a generic access row.\n /\n A2A_PUSH_NOTIFICATION_CONFIG_SET = 'a2a_push_notification_config_set',\n /* Reading back one registered webhook target. Secrets are redacted, but the URL is disclosed. /\n A2A_PUSH_NOTIFICATION_CONFIG_GET = 'a2a_push_notification_config_get',\n /* Enumerating every webhook target registered against a task. /\n A2A_PUSH_NOTIFICATION_CONFIG_LIST = 'a2a_push_notification_config_list',\n /* Removing a webhook target — a MUTATION, and the act that silently stops an operator's alerting. /\n A2A_PUSH_NOTIFICATION_CONFIG_DELETE = 'a2a_push_notification_config_delete',\n /\n Enumerating an owner's tasks (A2A 1.0 `ListTasks`).\n \n Its own member rather than borrowing `A2A_TASKS_GET`: a LIST discloses the existence and shape\n * of work the caller did not name, which in a trail is a different act from reading one task an\n * operator already knows about. Collapsing them would hide enumeration behind ordinary polling.\n /\n A2A_TASKS_LIST = 'a2a_tasks_list',\n MCP_TOOLS_LIST = 'mcp_tools_list',\n MCP_TOOLS_CALL = 'mcp_tools_call',\n}\n\nexport const AuditableEventTypeSchema = z.union([\n z.enum(CoreAuditableEventType),\n z.string()\n]);\n\nexport const AuditableEvent_User_LoginEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_LOGIN),\n ipAddress: z.string(),\n userAgent: z.string(),\n userId: z.string(),\n authMethod: z.string().optional(),\n email: z.string().optional(),\n sessionId: z.string().optional(),\n});\n\nexport const AuditableEvent_User_LogoutEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_LOGOUT),\n userId: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\nexport const AuditableEvent_User_LoginFailedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_LOGIN_FAILED),\n email: z.email(),\n authMethod: z.string(),\n failureReason: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n attemptsRemaining: z.number().optional(),\n sessionId: z.string(),\n});\n\n/\n Which lockout mechanism tripped a `USER_ACCOUNT_LOCKED` audit — so a SOC can distinguish the two\n * sources, which have different remediation: the per-SESSION progressive failed-attempt limit vs the\n * per-EMAIL global rate-limit. Enum (fixed vocabulary), not a string union, per the project rule.\n /\nexport enum AccountLockoutReason {\n /* The per-session progressive failed-attempt limit tripped (`incrementSessionAttempts`). /\n SESSION_ATTEMPT_LIMIT = 'session_attempt_limit',\n /* The per-email GLOBAL rate-limit lockout tripped (`checkRateLimit(GLOBAL_LOCKOUT + email)`). /\n GLOBAL_EMAIL_RATE_LIMIT = 'global_email_rate_limit',\n}\n\nexport const AuditableEvent_User_AccountLockedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_ACCOUNT_LOCKED),\n userId: z.string(),\n email: z.email(),\n authMethod: z.string(),\n lockoutDuration: z.number(), // minutes\n ipAddress: z.string(),\n userAgent: z.string(),\n sessionId: z.string(),\n /\n Which lockout mechanism tripped this event. OPTIONAL for backward compatibility — pre-existing\n * emitters and already-stored rows may omit it; new emitters set it so SOC tooling can filter\n * session-limit vs global-email-limit lockouts.\n /\n reason: z.enum(AccountLockoutReason).optional(),\n});\n\n/\n A machine principal (api-key / OAuth-client secret / exchanged client-credentials token) that\n * successfully authenticated. Carries the credential PROVENANCE — never the raw secret. Emitted at\n * the OAuth token-issuance moment (`/oauth/token`); per-request direct-secret access additionally\n * carries this provenance into any FIELD_ACCESS audit row (see `audit-access-fields`).\n /\nexport const AuditableEvent_MachineAuth_SuccessEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.MACHINE_AUTH_SUCCESS),\n /* MachineAuthMethod value: `api_key` \| `oauth_client`. /\n authMethod: z.string(),\n /* The ApiKey / OAuthClient row `_id` that authenticated — NEVER the raw secret. /\n credentialId: z.string(),\n /* Resolved machine execution type: `organization_machine` \| `application_machine`. /\n scopeType: z.string(),\n /* organizationId (ORG machine) or applicationId (APP machine). /\n scopeId: z.string().optional(),\n resourceIdentifier: z.string().optional(),\n operationIdentifier: z.string().optional(),\n ipAddress: z.string().optional(),\n});\n\n/\n A rejected machine-credential presentation (bad/expired/wrong-audience/wrong-scope secret or\n * token, or a rate-limited source). Records the ATTEMPT — the presented credential kind + prefix,\n * the target scope, and the reason — never a `credentialId` (the credential did not resolve). The\n * per-source-IP brute-force signal (external-access hardening) is exactly this event stream.\n /\nexport const AuditableEvent_MachineAuth_FailedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.MACHINE_AUTH_FAILED),\n /* Presented credential kind: `api_key` \| `oauth_client` \| `machine_token`. /\n credentialKind: z.string(),\n /* Human-routable secret prefix (e.g. `sk_org_` / `oc_app_`) — NEVER the full secret. Absent for token fronts. /\n credentialPrefix: z.string().optional(),\n /* Failure reason (e.g. `invalid_credential`, `inactive`, `aud_mismatch`, `wrong_scope`, `rate_limited`). /\n reason: z.string(),\n scopeType: z.string().optional(),\n scopeId: z.string().optional(),\n resourceIdentifier: z.string().optional(),\n operationIdentifier: z.string().optional(),\n ipAddress: z.string().optional(),\n});\n\n/\n A machine principal (ORGANIZATION_MACHINE / APPLICATION_MACHINE) exercised an external\n * resource-server surface (A2A `message/send`, MCP `tools/call`, …) with an already-issued,\n * audience-bound token. The token-USE twin of MACHINE_AUTH_SUCCESS (token-MINT): the mint fires\n * once, low-volume, at `/oauth/token`; THIS fires per external request so an org SIEM sees WHAT a\n * machine did, not merely that it authenticated.\n \n Carries the credential PROVENANCE (authMethod + credentialId — never the raw secret), the ROLE\n * context that authorized the access (roles are the single authorization axis — there is NO OAuth\n * authorization-scope vocabulary), and the resource server + operation targeted. Emitted fire-and-\n * forget at the A2A / MCP controller boundary AFTER the caller is authenticated + authorized; routed\n * to the org SIEM via `routingOrgIds` (verified org for an ORGANIZATION_MACHINE; an\n * APPLICATION_MACHINE has no single tenant SIEM ⇒ no per-org dispatch).\n /\nexport const AuditableEvent_MachineAccess_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.MACHINE_ACCESS),\n /* MachineAuthMethod value: `api_key` \| `oauth_client`. /\n authMethod: z.string(),\n /* The ApiKey / OAuthClient row `_id` whose token was presented — NEVER the raw secret. /\n credentialId: z.string(),\n /* Resolved machine execution type: `organization_machine` \| `application_machine`. /\n scopeType: z.string(),\n /\n TENANT scope id: organizationId (ORG machine) or applicationId (APP machine). This is the\n * data-partition scope, NOT an OAuth authorization scope — that vocabulary was removed; roles are\n * the single authorization axis.\n /\n scopeId: z.string().optional(),\n /\n The role context that authorized this access (the machine principal's roles). Roles are the\n * single authorization axis; recorded so a SIEM sees the authority the access ran under.\n /\n roles: z.array(z.string()).optional(),\n /* ResourceServerKind of the surface accessed: `a2a` \| `mcp`. /\n resourceServer: z.string(),\n /* The resource-server audience / agent endpoint / systemRef the token was bound to and hit. /\n resourceIdentifier: z.string().optional(),\n /* Normalised MachineAccessOperation value (e.g. `a2a_message_send`, `mcp_tools_call`). /\n operationIdentifier: z.string(),\n ipAddress: z.string().optional(),\n});\n\nexport const AuditableEvent_User_SessionExpiredEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_SESSION_EXPIRED),\n userId: z.string(),\n sessionId: z.string(),\n sessionDuration: z.number(), // minutes\n lastActivity: z.date(),\n});\n\n/\n A `USERS` row was hard-deleted.\n \n The identity is gone after this event, so the record must carry enough to answer \"who was\n * removed?\" without joining back to a row that no longer exists — hence `email` alongside `userId`.\n * That is a deliberate, narrow retention of an identifier inside the audit trail: an erasure that\n * left no trace of having happened would defeat the purpose of the trail, and the audit store is\n * itself immutable and access-controlled. Prefer `RETAIN_AND_IMPERSONALIZE` erasure\n * (`eraseSubjectAsSystem`) over a hard delete wherever the retention contract allows it — this\n * event exists to make the hard-delete path, which the framework still exposes to administrators\n * through `USERS \| DELETE`, leave evidence.\n \n `deletedBy` is the acting principal, which for the admin route is NOT the subject. Mirrors\n * `AuditableEvent_Organization_DeletedEventDataSchema`.\n \n assurance-control: WILDO.DATA.SECURE_LIFECYCLE — identity destruction is a\n * security-relevant event and must be attributable.\n /\nexport const AuditableEvent_User_DeletedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_DELETED),\n userId: z.string(),\n email: z.string().optional(),\n deletedBy: z.string(),\n /* Roles the deleted principal held, so an auditor can see what authority was removed. /\n appRoles: z.array(z.string()).optional(),\n});\n\n/\n Application-role grant / revocation on a `USERS` row.\n \n Carries BOTH the before and after arrays rather than only the delta: an auditor reconstructing a\n * principal's authority at a point in time needs the resulting set, and the delta alone cannot\n * distinguish \"granted a role they already held\" (a no-op) from a real widening. `requestedRoles`\n * is what the administrator ASKED for — for an additive grant it is the delta, for a whole-array\n * rewrite through the core UPDATE it is the full authored set — which is also exactly the set the\n * role-ceiling gate measured, so the record shows what was checked, not just what resulted.\n \n `reason` is the administrator's free-text justification where the operation collects one\n * (`assign_roles` / `revoke_roles`); the core UPDATE path has no such field and omits it.\n /\nexport const AuditableEvent_User_AppRolesChangedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_APP_ROLES_CHANGED),\n /* The user whose authority changed — the SUBJECT, not the actor. /\n userId: z.string(),\n previousRoles: z.array(z.string()),\n newRoles: z.array(z.string()),\n /* The roles as AUTHORED by the caller (the set the role-ceiling gate was measured against). /\n requestedRoles: z.array(z.string()),\n /* Which write path produced the change — the operation identifier (`assign_roles`, `update`, …). /\n operation: z.string(),\n changedBy: z.string(),\n reason: z.string().optional(),\n});\n\n/\n The application has no administratively usable super-administrator.\n \n Emitted by the startup floor report, not by a write path — every write that could REACH this state\n * refuses instead, so an emission here is evidence the state arrived outside the guarded paths.\n \n `conferringRoles` is recorded because the answer depends on the LIVE role table: an application\n * that renames or drops a custom role carrying `inheritFrom: APP_ADMIN_SUPER_ADMIN` can breach the\n * floor without any user row changing, and an auditor reading the event a month later cannot\n * reconstruct which roles counted at boot without it.\n /\nexport const AuditableEvent_Application_SuperAdminFloorBreachedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.APPLICATION_SUPER_ADMIN_FLOOR_BREACHED),\n /* How many administratively usable super-administrators were found (expected: 0 when emitted). /\n usableSuperAdminCount: z.number(),\n /* The minimum the floor requires. /\n requiredUsableSuperAdminCount: z.number(),\n /* The role keys that conferred super-admin at boot, resolved from the live application role table. /\n conferringRoles: z.array(z.string()),\n /* The user statuses that counted as administratively usable. /\n usableStatuses: z.array(z.string()),\n});\n\n/\n A tenant left unadministrable by an allowed action.\n \n Carries the tenant, the memberships that stopped counting, and WHY the action was permitted, so an\n * auditor can tell a deliberate containment decision from an accident. `remainingUsableOwners` is\n * recorded rather than assumed zero: the floor's minimum is configurable, and an event that hard-codes\n * the consequence cannot be re-read against a changed policy.\n /\nexport const AuditableEvent_Organization_OwnerFloorBreachedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_OWNER_FLOOR_BREACHED),\n /* The tenant left with no administratively usable owner. /\n organizationId: z.string(),\n /* The owner-conferring memberships this action removed from the population. /\n reducedMemberIds: z.array(z.string()),\n /* How many usable owners remain (expected: 0 when emitted). /\n remainingUsableOwners: z.number(),\n /* The lifecycle verb that caused it — the operator-facing \"what did this\". /\n operationIdentifier: z.string(),\n /* The subject whose deactivation triggered it. /\n subjectUserId: z.string(),\n /* The status the subject moved to, so a reader need not infer usability from the verb alone. /\n subjectNextStatus: z.string(),\n});\n\n// Organization Member Event Data Schemas\nexport const AuditableEvent_OrganizationMember_InvitedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_MEMBER_INVITED),\n organizationId: z.string(),\n invitedUserId: z.string(),\n invitedBy: z.string(),\n roles: z.array(z.string()),\n email: z.email().optional(),\n});\n\nexport const AuditableEvent_OrganizationMember_JoinedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_MEMBER_JOINED),\n organizationId: z.string(),\n userId: z.string(),\n roles: z.array(z.string()),\n invitationId: z.string().optional(),\n});\n\nexport const AuditableEvent_OrganizationMember_UpdatedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_MEMBER_UPDATED),\n organizationId: z.string(),\n memberId: z.string(),\n changes: z.record(z.string(), z.any()),\n});\n\n/\n Organization-wide role grant / revocation on an `ORGANIZATION_MEMBERS` row.\n \n The ORGANIZATIONS-scope twin of {@link AuditableEvent_User_AppRolesChangedEventDataSchema}, and it\n * carries the same before/after/requested triple for the same reasons: an auditor reconstructing a\n * principal's authority at a point in time needs the RESULTING set, and the delta alone cannot\n * distinguish \"granted a role they already held\" from a real widening.\n \n ## Why `requestedRoles` is not redundant with `newRoles` here\n \n It matters MORE on this resource than on the application twin. Membership CREATE runs the authored\n * roles through resolution before persisting them — an organization type's `defaultMemberRole` is\n * injected when the caller authored none — so \"what the administrator asked for\" and \"what the\n * member ended up holding\" genuinely differ on an ordinary invite. `requestedRoles` is also exactly\n * the set the role-ceiling gate measured, so the record shows what was CHECKED, not only what\n * resulted. It is optional because \"the caller authored no roles at all\" (policy supplied them) is a\n * different fact from \"the caller explicitly authored an empty array\", and collapsing the two would\n * lose the distinction the ceiling gate itself draws.\n \n ## Why both `memberId` and `userId`\n \n `memberId` addresses the MEMBERSHIP ROW that was written; `userId` is the SUBJECT PRINCIPAL whose\n * authority changed. \"What could this person do on date X\" is a question about the principal, and\n * answering it through the row id alone requires a join that a retention sweep may already have\n * removed. `AuditableEvent_OrganizationMember_RemovedEventDataSchema` carries the same pair for the\n * same reason. `userId` stays optional so a degenerate row still leaves the rest of the evidence\n * rather than suppressing the whole record.\n /\nexport const AuditableEvent_OrganizationMember_RoleChangedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_MEMBER_ROLE_CHANGED),\n /* Tenant the membership belongs to. /\n organizationId: z.string(),\n /* The membership ROW that was written. /\n memberId: z.string(),\n /* The SUBJECT principal whose authority changed — not the actor. /\n userId: z.string().optional(),\n previousRoles: z.array(z.string()),\n newRoles: z.array(z.string()),\n /* The roles as AUTHORED by the caller (the set the role-ceiling gate measured). Absent when the caller authored none. /\n requestedRoles: z.array(z.string()).optional(),\n /* Which write path produced the change — the operation identifier (`create`, `update`, …). /\n operation: z.string(),\n changedBy: z.string(),\n});\n\n/\n Per-unit role assignment on an `ORGANIZATION_UNIT_MEMBERS` row.\n \n The NARROWED twin of {@link AuditableEvent_OrganizationMember_RoleChangedEventDataSchema}. A unit\n * assignment confers authority inside ONE organization unit — `appendUnitScopedRoles` emits it into\n * `initiatorRoles` carrying an `organizationUnitId` discriminator, and every consumer that unions\n * those entries partitions on that field first. The narrowing is what makes it not tenant-wide; it\n * does not make it un-auditable, so the grant leaves evidence on the same terms.\n \n ## Why singular `role`, not an array\n \n `OrganizationUnitMember` persists ONE role per (unit, member) — that uniqueness is its business\n * key. Reshaping it into an array here purely to mirror the organization-wide twin would invent a\n * cardinality the resource does not have and invite a future reader to assume multiple unit roles\n * are representable.\n \n `previousRole` is absent on an initial assignment, which is the honest encoding of \"there was no\n * prior grant\" — distinct from a re-assignment away from a role that did exist.\n /\nexport const AuditableEvent_OrganizationUnitMember_RoleChangedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_UNIT_MEMBER_ROLE_CHANGED),\n /* Tenant the assignment belongs to. /\n organizationId: z.string().optional(),\n /* The unit the role is narrowed to — the discriminator that keeps this grant from reading as tenant-wide. /\n organizationUnitId: z.string().optional(),\n /* The assignment ROW that was written. /\n assignmentId: z.string(),\n /* The membership the assignment hangs off — the bridge to the SUBJECT principal. /\n organizationMemberId: z.string().optional(),\n /* Absent on an initial assignment: there was no prior grant to record. /\n previousRole: z.string().optional(),\n newRole: z.string(),\n /* The role as AUTHORED by the caller (the value the role-ceiling gate measured). /\n requestedRole: z.string().optional(),\n /* Which write path produced the change — the operation identifier (`create`, `update`). /\n operation: z.string(),\n changedBy: z.string(),\n});\n\n/\n Revocation of a per-unit role assignment — the closing half of\n * {@link AuditableEvent_OrganizationUnitMember_RoleChangedEventDataSchema}.\n \n ## Why AUTHORIZATION rather than ORG_MANAGEMENT, unlike `ORGANIZATION_MEMBER_REMOVED`\n \n Removing an organization MEMBER is primarily a directory action — the person leaves the tenant —\n * and the authority they lose is a consequence of that. An assignment row has no directory aspect\n * whatsoever: it exists only to confer a role, so deleting it IS the revocation, and it is the exact\n * counterpart of the CREATE that granted it. Classifying it as record-keeping would leave an\n * authorization-filtered trail in which unit privileges are granted and never removed.\n \n ## Why the revoked role is captured\n \n `revokedRole` is the single field that cannot be recovered after the fact: the row is hard-deleted,\n * so nothing else in the system can answer \"what authority did this person lose\". It is deliberately\n * NOT named `previousRole` — that would imply a successor role, and there is none.\n \n ## Coverage boundary\n \n Emitted on the DIRECT assignment DELETE — the targeted revocation an operator performs and an\n * auditor reviews. Cascade removals (deleting the parent membership, or the whole organization) run\n * through the raw repository, which by construction does not execute service custom implementations;\n * those are evidenced by their own parent event, because the semantic act there is losing the\n * membership or the tenant, not revoking one unit role.\n /\nexport const AuditableEvent_OrganizationUnitMember_RemovedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_UNIT_MEMBER_REMOVED),\n /* Tenant the assignment belonged to. /\n organizationId: z.string().optional(),\n /* The unit the revoked role was narrowed to. /\n organizationUnitId: z.string().optional(),\n /* The assignment ROW that was deleted. /\n assignmentId: z.string(),\n /* The membership the assignment hung off — the bridge to the subject principal. /\n organizationMemberId: z.string().optional(),\n /* The authority that was removed. Unrecoverable once the row is gone, which is why it is recorded here. /\n revokedRole: z.string().optional(),\n removedBy: z.string(),\n});\n\nexport const AuditableEvent_OrganizationMember_StatusChangedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_MEMBER_STATUS_CHANGED),\n organizationId: z.string(),\n memberId: z.string(),\n previousStatus: z.string(),\n newStatus: z.string(),\n changedBy: z.string(),\n reason: z.string().optional(),\n});\n\n/\n Removal of an organization membership — by administrative DELETE, or by cancelling a pending\n * invitation through REVOKE.\n \n ## Why one event covers both, distinguished by `operation`\n \n They are genuinely different administrative acts — removing someone who works here versus\n * withdrawing an invitation that was never accepted — and an auditor must never confuse them. But\n * they are the same KIND of act (a membership ceases to exist) and share every other field, so\n * splitting them into two event types would fragment \"how did this person's membership end?\" across\n * two queries for no gain. `operation` carries the distinction, and `previousStatus` carries the\n * state the row was actually in, which `operation` alone cannot give: DELETE accepts any\n * non-`INVITED` status, so ACTIVE, INACTIVE and SUSPENDED removals are otherwise indistinguishable.\n \n An `INVITED` membership confers NOTHING — `execution-context-creator` builds `initiatorRoles` only\n * from `ACTIVE` memberships — so a REVOKE removes no live authority. It is still recorded, because\n * withdrawing someone's pending access is a directory decision an access review needs to see, and\n * because `ORGANIZATION_MEMBER_INVITED` would otherwise stand unanswered.\n \n ## Why `roles` is captured\n \n The row is hard-deleted, so afterwards nothing in the system can answer \"what authority did this\n * person hold when they were removed\". Same reasoning — and same shape — as\n * `AuditableEvent_User_DeletedEventDataSchema.appRoles`. On a REVOKE it records what the invitee\n * WOULD have received on acceptance.\n \n ## Category\n \n Classified ORG_MANAGEMENT rather than AUTHORIZATION, unlike `ORGANIZATION_UNIT_MEMBER_REMOVED`:\n * removing a MEMBER is a directory-lifecycle action whose authority loss is a consequence, whereas a\n * unit assignment row exists only to confer a role. The `roles` field is what keeps the authority\n * question answerable from an ORG_MANAGEMENT record.\n /\nexport const AuditableEvent_OrganizationMember_RemovedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_MEMBER_REMOVED),\n organizationId: z.string(),\n /* The membership ROW that was deleted. /\n memberId: z.string(),\n /* The SUBJECT principal who lost the membership. /\n removedUserId: z.string(),\n /\n The organization-wide roles the membership carried. Unrecoverable once the row is gone.\n * On a REVOKE these were never in force — they are what acceptance would have conferred.\n /\n roles: z.array(z.string()).optional(),\n /\n The row's status at removal.\n \n Deliberately `z.string()` rather than the `OrganizationMemberStatus` enum, matching\n * `AuditableEvent_OrganizationMember_StatusChangedEventDataSchema`: an audit row is a historical\n * record that must stay readable after the vocabulary evolves, so the strictness belongs at the\n * PRODUCER (which assigns from the enum), not at the record.\n /\n previousStatus: z.string().optional(),\n /* Which path ended the membership — `delete` (a real member) or `revoke` (a pending invitation). /\n operation: z.string(),\n /\n The per-unit grants this removal took with it.\n \n `ORGANIZATION_UNIT_MEMBERS` is a composition child of the membership, so deleting the membership\n * cascades to every assignment — through the RAW REPOSITORY, below the service tier, where no\n * custom implementation runs and therefore no `ORGANIZATION_UNIT_MEMBER_REMOVED` can fire. Without\n * this field the trail would show each unit grant being made and never revoked: the assignment rows\n * are hard-deleted, so the lost authority is not reconstructible from data either.\n \n Carried here rather than emitted per row on purpose — one membership removal is ONE decision, and\n * a teardown that fans out into a dozen revocation events buries it. Captured in the DELETE prefix,\n * which is the last moment the assignments still exist.\n /\n revokedUnitAssignments: z.array(z.object({\n organizationUnitId: z.string(),\n role: z.string(),\n })).optional(),\n /\n Who ended the membership — a user id, or an {@link AuditActorSentinel}.\n \n ## Reading it: `operation: 'revoke'` has THREE causes, told apart HERE\n \n `operation` says a pending invitation ended; it does not say why. Three different acts produce\n * an identical `revoke`, and the distinction between them is exactly what an access review needs:\n \n \| Cause \| How to recognise it \|\n * \|---\|---\|\n * \| The invitee DECLINED \| `removedBy === removedUserId` — the subject is the actor \|\n * \| An administrator CANCELLED it \| `removedBy` is a real user id, and a different one \|\n * \| It EXPIRED unanswered \| `removedBy === AuditActorSentinel.SYSTEM` (the stale-invitation sweep) \|\n \n This is why the decline path supplies an on-behalf-of principal rather than running anonymously.\n * A decline necessarily executes under BORROWED authority — the invitee has no standing to revoke\n * an organization membership — and a borrowed-authority context carries no initiator user id, so\n * the actor previously resolved to `SYSTEM`: an active refusal and a silent expiry wrote\n * byte-identical rows. Recording the acting principal separates all three with no extra event type,\n * which is the same economy `operation` and `previousStatus` already buy above.\n \n A reader must therefore not treat `removedBy === SYSTEM` on a `revoke` as \"unknown actor\". It is\n * a positive statement that no human ended this invitation.\n /\n removedBy: z.string(),\n /\n The justification. Declared by REVOKE for exactly this purpose and supplied by an administrator\n * cancelling an invitation; on a decline it carries the invitee's optional reason, and the expiry\n * sweep supplies none. Absent, therefore, on most declines — do not read its absence as a cause.\n /\n reason: z.string().optional(),\n});\n\n// Organization Lifecycle Event Data Schemas\nexport const AuditableEvent_Organization_CreatedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_CREATED),\n organizationId: z.string(),\n name: z.string(),\n slug: z.string(),\n createdBy: z.string(),\n});\n\nexport const AuditableEvent_Organization_UpdatedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_UPDATED),\n organizationId: z.string(),\n changes: z.record(z.string(), z.any()),\n updatedBy: z.string(),\n});\n\nexport const AuditableEvent_Organization_DeletedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_DELETED),\n organizationId: z.string(),\n name: z.string(),\n slug: z.string(),\n deletedBy: z.string(),\n reason: z.string().optional(),\n});\n\n/\n A tenant was MARKED for deletion — the soft-delete half of tenant teardown.\n \n Kept SEPARATE from {@link AuditableEvent_Organization_DeletedEventDataSchema} rather than folded\n * into it with a flag, because the two record genuinely different facts and an auditor must not\n * have to infer which one happened. This event says the tenant's access was revoked and its data\n was scheduled for destruction; `ORGANIZATION_DELETED` says the data is gone. Between them sits\n a retention window in which the decision is still reversible, and a single merged event would\n * make \"was this tenant's data actually destroyed?\" unanswerable without correlating timestamps.\n \n It is also the evidence for the AUTHORIZATION consequence, which lands here and not at the purge:\n * user types revoked and tokens invalidated. `revokedUserTypeCount` records the blast radius of that\n * revocation without naming the users — the per-user detail belongs to the user-type events, and\n * duplicating identities into a tenant-scoped record would widen the personal data this row holds.\n \n assurance-control: WILDO.DATA.SECURE_LIFECYCLE — scheduling the destruction\n * of a tenant is a security-relevant, attributable decision that must leave evidence even when it\n * is later reversed.\n /\nexport const AuditableEvent_Organization_DeletionRequestedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_DELETION_REQUESTED),\n organizationId: z.string(),\n name: z.string(),\n slug: z.string(),\n /* The ACTOR. On the `admin` variant they are not a member of the tenant being marked. /\n requestedBy: z.string(),\n /* When the purge batch becomes allowed to destroy the tenant — the promise made to it. /\n purgeScheduledAt: z.string(),\n /* How many users lost at least one global `userTypes` grant as a result of the mark. /\n revokedUserTypeCount: z.number().int().min(0),\n reason: z.string().optional(),\n});\n\n/\n A pending tenant deletion was CANCELLED inside its retention window.\n \n The closing half of {@link AuditableEvent_Organization_DeletionRequestedEventDataSchema}. Without\n * it the audit trail records every scheduled destruction and none of the reversals, so a tenant\n * that was marked and restored a year ago still reads as pending destruction — and an access review\n * asking \"why does this tenant have live members again?\" has no answer on record.\n \n assurance-control: WILDO.ACCESS.LIFECYCLE — restoring access is as attributable as removing it.\n /\nexport const AuditableEvent_Organization_RestoredEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_RESTORED),\n organizationId: z.string(),\n name: z.string(),\n slug: z.string(),\n /* The ACTOR — always a platform super-administrator; a marked tenant cannot restore itself. /\n restoredBy: z.string(),\n /* The status the tenant was returned to. /\n restoredStatus: z.string(),\n /* How many users had at least one global `userTypes` grant re-granted by the restore. /\n regrantedUserTypeCount: z.number().int().min(0),\n reason: z.string().optional(),\n});\n\n/\n The tenant was administratively HALTED — every member loses their organization roles.\n \n ## Why this is its own event rather than an `ORGANIZATION_UPDATED`\n \n Suspension is not a field edit. Since the tenant-status authority gate shipped, `SUSPENDED` is a\n * state in which a membership confers NOTHING — so this single write revokes the access of every\n * member of the tenant at once. Folding that into the generic update event would bury an\n * organization-wide access revocation inside a `changes` map, exactly where an access review would\n * not look for it.\n \n `suspensionReason` is REQUIRED, mirroring the request contract, because the reason is the whole\n * evidentiary point: an auditor asking \"why was this tenant halted?\" must not get a shrug.\n * `notifiedMembers` records whether the tenant was told — a deliberately quiet suspension is a\n * legitimate operator choice and one a reviewer needs to be able to see.\n \n assurance-control: WILDO.AUDIT.SECURITY_EVENT — organization-wide access\n * revocation must be attributable, justified, and evidenced.\n /\nexport const AuditableEvent_Organization_SuspendedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_SUSPENDED),\n organizationId: z.string(),\n name: z.string(),\n slug: z.string(),\n /* The ACTOR — always a platform super-administrator; a tenant cannot suspend itself. /\n suspendedBy: z.string(),\n /* The status the tenant was halted FROM, so the transition is legible without a second lookup. /\n previousStatus: z.string(),\n suspensionReason: z.string(),\n /* Whether the tenant's members were emailed. A quiet suspension is a choice worth recording. /\n notifiedMembers: z.boolean(),\n /\n How many users lost at least one GLOBAL `userTypes` grant because this tenant stopped counting.\n \n A suspension does not only halt the tenant: a membership in a non-authority-conferring\n * organization no longer justifies a membership-derived global grant, so suspending an\n * organization can withdraw what it was vouching for platform-wide. That reach is exactly what an\n * access review needs to see, and it is invisible from the status change alone.\n /\n revokedUserTypeCount: z.number().int().min(0),\n});\n\n/\n A halted or expired tenant was returned to normal operation — the inverse of\n * {@link AuditableEvent_Organization_SuspendedEventDataSchema}.\n \n Restoring organization-wide access is as security-relevant as removing it, and without this event\n * the trail would record every suspension and none of the lifts — leaving a tenant that was halted\n * and reinstated a year ago still reading as suspended.\n \n `previousStatus` distinguishes the two journeys this operation serves: lifting a suspension\n * (`SUSPENDED`) and converting an expired trial (`TRIAL_EXPIRED`). They land on the same state and\n * are not the same event to a reviewer.\n \n assurance-control: WILDO.AUDIT.SECURITY_EVENT — reinstatement of access is attributable.\n /\nexport const AuditableEvent_Organization_ActivatedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_ACTIVATED),\n organizationId: z.string(),\n name: z.string(),\n slug: z.string(),\n /* The ACTOR — always a platform super-administrator. /\n activatedBy: z.string(),\n /* `SUSPENDED` (a lift) or `TRIAL_EXPIRED` (a conversion) — not the same journey. /\n previousStatus: z.string(),\n /* How many users had at least one global `userTypes` grant restored by the reactivation. /\n regrantedUserTypeCount: z.number().int().min(0),\n reason: z.string().optional(),\n});\n\n/\n One user type's authentication-policy snapshot — the COMPLETE authored `UserTypeAuthPolicy` (MFA,\n * password, lockout, enabled auth methods, step-up, session duration, …) as recorded in the trail.\n \n The whole policy is captured, not a hand-picked subset, so no posture axis escapes the record: a\n * weakening is as easily \"disable the MFA auth method\" (`authMethodsEnabled`) or \"drop step-up\"\n * (`stepUpAuth`) as \"turn `requireMFA` off\". The policy carries only booleans / numbers / enums —\n * never a secret — so recording it verbatim discloses nothing sensitive.\n \n Deliberately STRUCTURAL (an open record) rather than a reference to the live `UserTypeAuthPolicy`\n * config schema. An audit record is a historical fact: it must keep validating after the config\n * schema evolves, so it stores the policy as it was at that boot rather than re-validating it against\n * today's shape. The queryable summary lives in `changedUserTypes` + `snapshotDigest`; this object\n * carries the human-readable before/after detail.\n /\nexport const ApplicationAuthPolicySnapshotSchema = z.record(z.string(), z.unknown());\n\n/\n The application's authored authentication policy changed between two boots.\n \n The per-user-type authentication policy (`userTypes.<type>.auth` — MFA, password, and lockout\n * requirements) is STATIC application configuration authored in code and taken into effect at backend\n * startup. A change to it — most consequentially a WEAKENING such as turning MFA off — is a\n * security-posture decision that, before this event, left no product-side record: only the source\n * history showed it. This event closes that gap.\n \n It is emitted at boot, by the system, when the resolved policy snapshot differs from the last one\n * recorded in the trail (detected by comparing against the most recent event of this type for the\n * application). Because there is no human actor at boot, the \"who\" is the deployment/source history;\n * the event records WHAT changed (before → after per user type) so a reviewer sees the posture shift\n * without reading the codebase.\n \n Scope note: this is the per-application AUTHORED baseline. It does NOT enumerate per-tenant\n * `authOverrides` (which are per-(user-type × org-type) and require live tenants to resolve), nor the\n * authenticate-time `FALLBACK_AUTH_POLICY` (a runtime substitute used only when no user type\n * resolves, not authored config).\n \n assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — a change to the authentication assurance\n * requirements (MFA / password / lockout) must be attributable and evidenced.\n /\nexport const AuditableEvent_ApplicationAuthPolicyChanged_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.APPLICATION_AUTH_POLICY_CHANGED),\n applicationId: z.string(),\n /* Which user types' policies differed from the previously-recorded snapshot. Sorted, non-empty. /\n changedUserTypes: z.array(z.string()),\n /\n A stable digest of the `after` snapshot. Boot change-detection compares the current digest\n * against the digest carried by the most recent recorded event of this type; equal digests are the\n * signal to emit nothing, so the trail carries one row per genuine change, not one per boot.\n /\n snapshotDigest: z.string(),\n /\n The previously-recorded per-user-type policy snapshot, or `null` when this is the first snapshot\n * ever recorded for the application (the baseline row). Keys are user-type identifiers.\n /\n before: z.record(z.string(), ApplicationAuthPolicySnapshotSchema).nullable(),\n /* The per-user-type policy snapshot that took effect at this boot. Keys are user-type identifiers. /\n after: z.record(z.string(), ApplicationAuthPolicySnapshotSchema),\n});\n\n/\n A governed lifecycle transition changed a subject's `status`.\n \n Emitted by the shared status-transition implementation, so every verb it serves is trailed by\n * construction and a future one inherits the trail rather than having to remember it. Before this\n * existed those verbs emitted NOTHING: suspending a member (CRITICAL) or a user (HIGH) left no\n * record at all, while suspending a TENANT was fully attributable — an asymmetry an access review\n * would have to discover the hard way.\n \n `reason` is where the verbs' long-declared `reason` / `suspensionReason` fields finally land.\n * They are not persisted on the row: a suspension reason is a compliance artefact nothing reads\n * back, so the trail is its home rather than a schema column that would have to be scrubbed on\n * erasure.\n \n assurance-control: WILDO.AUDIT.SECURITY_EVENT — a change to whether a principal may act must be\n * attributable, justified and evidenced, on every resource that has such a state.\n /\nexport const AuditableEvent_Resource_StatusTransitionPerformedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.RESOURCE_STATUS_TRANSITION_PERFORMED),\n /* Which resource the subject row belongs to — half of the verb discriminator. /\n resourceType: z.string(),\n /* The lifecycle verb that ran (`suspend`, `reactivate`, `suspend_user`, …). /\n operationIdentifier: z.string(),\n /* The row whose status changed. /\n subjectId: z.string(),\n /* The ACTOR who performed it, or the system principal when the reactivation sweep ran it. /\n performedBy: z.string(),\n /* The status transitioned FROM, so the change is legible without a second lookup. /\n previousStatus: z.string(),\n /* The status transitioned TO. /\n newStatus: z.string(),\n /* The caller's justification, where the verb's contract accepts one. /\n reason: z.string().optional(),\n /\n When an automated sweep will undo this, if the caller time-boxed it. ISO-8601.\n \n Recorded because \"suspended for 7 days\" and \"suspended indefinitely\" are materially different\n * decisions that would otherwise be indistinguishable in the trail.\n /\n scheduledReactivationAt: z.string().optional(),\n /* Present when the subject is tenant-scoped, so the trail routes to that tenant's SIEM. /\n organizationId: z.string().optional(),\n});\n\nexport const AuditableEvent_OrganizationNotifications_UpdatedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_NOTIFICATIONS_UPDATED),\n organizationId: z.string(),\n notificationsId: z.string(),\n changes: z.record(z.string(), z.any()),\n updatedBy: z.string(),\n});\n\nexport const AuditableEvent_OrganizationPreferences_UpdatedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_PREFERENCES_UPDATED),\n organizationId: z.string(),\n preferencesId: z.string(),\n changes: z.record(z.string(), z.any()),\n updatedBy: z.string(),\n});\n\nexport const AuditableEvent_OrganizationProfile_UpdatedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_PROFILE_UPDATED),\n organizationId: z.string(),\n profileId: z.string(),\n changes: z.record(z.string(), z.any()),\n updatedBy: z.string(),\n});\n\nexport const AuditableEvent_OrganizationUnit_UpdatedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_UNIT_UPDATED),\n organizationId: z.string(),\n unitId: z.string(),\n changes: z.record(z.string(), z.any()),\n updatedBy: z.string(),\n});\n\n// SSO Authentication Event Data Schemas\n\nexport const AuditableEvent_User_SSOLoginEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_SSO_LOGIN),\n userId: z.string(),\n email: z.email(),\n providerRef: z.string(),\n connectionType: z.enum(SsoConnectionType),\n authSource: z.string().optional(),\n scopeType: z.enum(AuthScopeType).optional(),\n organizationId: z.string().optional(),\n applicationId: z.string().optional(),\n ipAddress: z.string(),\n userAgent: z.string(),\n sessionId: z.string(),\n}).superRefine((event, ctx) => {\n if (event.connectionType === SsoConnectionType.SOCIAL) {\n if (\n event.scopeType !== undefined\n \|\| event.organizationId !== undefined\n \|\| event.applicationId !== undefined\n ) {\n ctx.addIssue({\n code: 'custom',\n path: ['scopeType'],\n message: 'Social SSO audit events must not carry enterprise scope',\n });\n }\n return;\n }\n\n const hasOrganizationScope =\n event.scopeType === AuthScopeType.ORGANIZATION\n && event.organizationId !== undefined\n && event.applicationId === undefined;\n const hasApplicationScope =\n event.scopeType === AuthScopeType.APPLICATION\n && event.applicationId !== undefined\n && event.organizationId === undefined;\n if (!hasOrganizationScope && !hasApplicationScope) {\n ctx.addIssue({\n code: 'custom',\n path: ['scopeType'],\n message: 'Enterprise SSO audit events require exactly one explicit tenant scope',\n });\n }\n});\n\nexport const AuditableEvent_User_SSOLoginFailedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_SSO_LOGIN_FAILED),\n email: z.email().optional(),\n providerRef: z.string().optional(),\n connectionType: z.enum(SsoConnectionType).optional(),\n authSource: z.string().optional(),\n failureReason: z.string(),\n scopeType: z.enum(AuthScopeType).optional(),\n organizationId: z.string().optional(),\n applicationId: z.string().optional(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\nexport const AuditableEvent_User_SSOEnforcementBlockedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_SSO_ENFORCEMENT_BLOCKED),\n email: z.email(),\n attemptedProviderRef: z.string(),\n attemptedConnectionType: z.enum(SsoConnectionType),\n organizationId: z.string(),\n enforcementPolicy: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\nexport const AuditableEvent_User_TokenRefreshedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_TOKEN_REFRESHED),\n userId: z.string(),\n sessionId: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n// Organization Security Management Event Data Schemas\n\nexport const AuditableEvent_Organization_SSOConfigurationChangedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_SSO_CONFIGURATION_CHANGED),\n organizationId: z.string(),\n changedBy: z.string(),\n changeType: z.enum(SsoConfigChangeType),\n affectedProviderRef: z.string().optional(),\n changes: z.record(z.string(), z.any()).optional(),\n});\n\n\n\nexport const AuditableEvent_Organization_SIEMExportConfiguredEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_SIEM_EXPORT_CONFIGURED),\n organizationId: z.string(),\n changedBy: z.string(),\n changeType: z.enum(SiemExportChangeType),\n webhookUrlDomain: z.string().optional(),\n eventFormatConfigured: z.string().optional(),\n});\n\n\n\n// Outbound M2M Webhook Event Data Schemas\n\n/\n One `webhookConfig.testEndpoint` attempt — an admin causing the platform to open an\n * outbound connection to an operator-supplied URL.\n \n Recorded for EVERY attempt, not only failures: the security signal here is the pattern\n * (who probes which hosts, how often), which a SIEM can only derive if successes are\n * present too. `outcome` distinguishes a refusing endpoint from an unreachable one from a\n * local signing fault, so the stream stays diagnosable without the response body.\n \n `destinationHost` carries the host only, never the full URL — mirroring\n * `AuditableEvent_Organization_SIEMExportConfiguredEventDataSchema.webhookUrlDomain`. Paths\n * and query strings on customer endpoints routinely embed per-tenant tokens, and an audit\n * row is replicated to the org SIEM and the immutable store.\n /\nexport const AuditableEvent_Webhook_EndpointTestDispatchedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.WEBHOOK_ENDPOINT_TEST_DISPATCHED),\n /* Scope that owns the config — exactly one of these is set, per the polymorphic variant. /\n organizationId: z.string().optional(),\n applicationId: z.string().optional(),\n /* Admin who fired the probe. /\n dispatchedBy: z.string(),\n endpointId: z.string(),\n /* Host component only — see the schema JSDoc for why the full URL is withheld. /\n destinationHost: z.string(),\n outcome: z.enum(WebhookEndpointProbeOutcome),\n responseStatus: z.number().int().optional(),\n durationMs: z.number().int().nonnegative(),\n /* `jti` of the signed probe, for correlation with the consumer's own logs. /\n signatureJti: z.string(),\n});\n\n\n\n// SCIM Directory Provisioning Event Data Schemas\n\nexport const AuditableEvent_SCIM_TokenCreatedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.SCIM_TOKEN_CREATED),\n organizationId: z.string(),\n tokenDisplayName: z.string(),\n createdByUserId: z.string(),\n expiresAt: z.string().optional(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\nexport const AuditableEvent_SCIM_TokenRevokedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.SCIM_TOKEN_REVOKED),\n organizationId: z.string(),\n tokenDisplayName: z.string(),\n revokedByUserId: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\n// SCIM User Provisioning Event Data Schemas (H5+H8)\n\nexport const AuditableEvent_SCIM_UserProvisionedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.SCIM_USER_PROVISIONED),\n organizationId: z.string(),\n userId: z.string(),\n email: z.string(),\n isNewUser: z.boolean(),\n provisionedVia: z.string(),\n authSource: z.string().optional(),\n});\n\n\n\nexport const AuditableEvent_SCIM_UserUpdatedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.SCIM_USER_UPDATED),\n organizationId: z.string(),\n userId: z.string(),\n operation: z.string(),\n updatedAttributes: z.array(z.string()).optional(),\n});\n\n\n\nexport const AuditableEvent_SCIM_UserDeactivatedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.SCIM_USER_DEACTIVATED),\n organizationId: z.string(),\n userId: z.string(),\n email: z.string().optional(),\n});\n\n\n\n// Password Reset Event Data Schemas (H5)\n\nexport const AuditableEvent_User_PasswordResetRequestedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_PASSWORD_RESET_REQUESTED),\n email: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n/\n Administrator-compelled credential reset.\n \n Carries BOTH identities because the actor and the subject differ — that separation is the\n * whole point of the event. `actorUserId` is read from the authenticated execution context,\n * never from request input, so it cannot be spoofed by the caller. `reason` is the operator's\n * mandatory justification; it is what an auditor reads when asking why a credential was reset\n * out-of-band.\n \n assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — privileged credential\n * intervention must be attributable to the acting administrator and carry a justification.\n /\nexport const AuditableEvent_User_PasswordResetForcedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_PASSWORD_RESET_FORCED),\n targetUserId: z.string(),\n targetEmail: z.string(),\n actorUserId: z.string(),\n reason: z.string(),\n /* Whether the target's active sessions were revoked as part of the reset. /\n sessionsRevoked: z.boolean(),\n /\n Transport metadata, OPTIONAL because this event's only producer is a resource operation.\n \n The auth controllers thread `ipAddress` / `userAgent` down from the Express request, but a\n * resource-operation custom implementation receives an `ExecutionContext`, which carries\n * identity and no transport detail. Rather than stamping a fabricated `'unknown'` that reads\n * like a captured value, the fields are omitted and correlation runs through the request log.\n * They become populated if transport metadata is ever threaded onto the execution context.\n /\n ipAddress: z.string().optional(),\n userAgent: z.string().optional(),\n});\n\n\n\nexport const AuditableEvent_User_PasswordResetCompletedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_PASSWORD_RESET_COMPLETED),\n userId: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\n// Registration & Verification Event Data Schemas (H5)\n\nexport const AuditableEvent_User_RegisteredEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_REGISTERED),\n userId: z.string(),\n email: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\nexport const AuditableEvent_User_EmailVerifiedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_EMAIL_VERIFIED),\n userId: z.string(),\n email: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\nexport const AuditableEvent_User_VerificationEmailResentEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_VERIFICATION_EMAIL_RESENT),\n userId: z.string(),\n email: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\n// MFA Lifecycle Event Data Schemas (H5)\n\nexport const AuditableEvent_User_MFASetupStartedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_MFA_SETUP_STARTED),\n userId: z.string(),\n mfaMethod: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\nexport const AuditableEvent_User_MFASetupCompletedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_MFA_SETUP_COMPLETED),\n userId: z.string(),\n mfaMethod: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\nexport const AuditableEvent_User_MFAEmailOTPSentEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_MFA_EMAIL_OTP_SENT),\n email: z.string(),\n sessionId: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\n// WebAuthn/Passkey Event Data Schemas (Phase G1)\n\nexport const AuditableEvent_User_PasskeyRegisteredEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_PASSKEY_REGISTERED),\n userId: z.string(),\n email: z.string(),\n credentialId: z.string(),\n credentialName: z.string(),\n credentialDeviceType: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\nexport const AuditableEvent_User_PasskeyAuthSuccessEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_PASSKEY_AUTHENTICATION_SUCCESS),\n userId: z.string(),\n email: z.string(),\n credentialId: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n sessionId: z.string(),\n});\n\n\n\nexport const AuditableEvent_User_PasskeyAuthFailureEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_PASSKEY_AUTHENTICATION_FAILURE),\n email: z.string(),\n failureReason: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n sessionId: z.string(),\n});\n\n\n\nexport const AuditableEvent_User_PasskeyRemovedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_PASSKEY_REMOVED),\n userId: z.string(),\n email: z.string(),\n credentialId: z.string(),\n credentialName: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\n// Magic Link Event Data Schemas (Phase G2)\n\nexport const AuditableEvent_User_MagicLinkSentEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_MAGIC_LINK_SENT),\n email: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\nexport const AuditableEvent_User_MagicLinkVerifiedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_MAGIC_LINK_VERIFIED),\n userId: z.string(),\n email: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n sessionId: z.string(),\n});\n\n\n\nexport const AuditableEvent_User_MagicLinkFailedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_MAGIC_LINK_FAILED),\n email: z.string().optional(),\n failureReason: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\n// SMS OTP Event Data Schemas (Phase G2)\n\nexport const AuditableEvent_User_SMSOTPSentEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_SMS_OTP_SENT),\n phoneNumber: z.string(),\n factorLevel: z.string(),\n sessionId: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\nexport const AuditableEvent_User_SMSOTPVerifiedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_SMS_OTP_VERIFIED),\n userId: z.string(),\n phoneNumber: z.string(),\n factorLevel: z.string(),\n sessionId: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\nexport const AuditableEvent_User_SMSOTPFailedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_SMS_OTP_FAILED),\n phoneNumber: z.string().optional(),\n factorLevel: z.string(),\n failureReason: z.string(),\n sessionId: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\n// Phone Verification Event Data Schemas (Phase G2)\n\nexport const AuditableEvent_User_PhoneVerifiedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_PHONE_VERIFIED),\n userId: z.string(),\n phoneNumber: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\nexport const AuditableEvent_User_PhoneVerificationFailedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_PHONE_VERIFICATION_FAILED),\n phoneNumber: z.string(),\n failureReason: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\n// OAuth2 Provider Restriction Event Data Schema (Phase G3)\n\nexport const AuditableEvent_OAuth2ProviderBlockedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.OAUTH2_PROVIDER_BLOCKED),\n email: z.string().optional(),\n providerRef: z.string(),\n scopeType: z.enum(AuthScopeType),\n organizationId: z.string().optional(),\n applicationId: z.string().optional(),\n reason: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n}).superRefine((event, ctx) => {\n const hasOrganizationScope =\n event.scopeType === AuthScopeType.ORGANIZATION\n && event.organizationId !== undefined\n && event.applicationId === undefined;\n const hasApplicationScope =\n event.scopeType === AuthScopeType.APPLICATION\n && event.applicationId !== undefined\n && event.organizationId === undefined;\n if (!hasOrganizationScope && !hasApplicationScope) {\n ctx.addIssue({\n code: 'custom',\n path: ['scopeType'],\n message: 'OAuth2 provider-blocked events require exactly one explicit tenant scope',\n });\n }\n});\n\nexport type AuditableEvent_OAuth2ProviderBlockedEventData = z.infer<typeof AuditableEvent_OAuth2ProviderBlockedEventDataSchema>;\n\n// Emergency Access Event Data Schema\n\nexport const AuditableEvent_EmergencyAccess_UsedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.EMERGENCY_ACCESS_USED),\n userId: z.string(),\n email: z.email(),\n organizationId: z.string(),\n reason: z.string().optional(),\n ipAddress: z.string(),\n userAgent: z.string(),\n sessionId: z.string(),\n});\n\n\n\nexport const AuditableEvent_FieldAccess_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.FIELD_ACCESS),\n fieldName: z.string(),\n resourceType: z.string(),\n resourceId: z.string().optional(),\n operationIdentifier: z.string(),\n isCreateOperation: z.boolean(),\n // Machine-credential provenance when the ACCESSING principal is a machine (api-key / OAuth\n // client) rather than a human. Absent for user-authenticated access. Threads the credential id\n // + auth method onto the sensitive-field-access row so machine access is attributable — the\n // per-request counterpart to the dedicated MACHINE_AUTH_ events (machine-auth-hardening item 2).\n machineCredentialAuthMethod: z.string().optional(),\n machineCredentialId: z.string().optional(),\n});\n\n/*\n A resource operation took effect. The operation-triggered counterpart to\n * {@link AuditableEvent_FieldAccess_EventDataSchema}, which is triggered by a decorated RESPONSE\n * FIELD and is therefore blind to any operation whose response carries none.\n \n ## What the existence of this row asserts, and what it does not\n \n It is emitted from the framework-managed POST-COMMIT effects lane, so the row exists only for an\n * operation whose mutation is already durable. \"Performed\" is therefore the whole claim — there is\n * deliberately no `outcome` discriminator, because this emission point can never observe a failure.\n \n The absence of a row is NOT evidence that nothing happened; that is what makes audit-pipeline\n * failure detection (`audit_store_failure_total`, and the operation identity now carried on the\n * failure log line) a control in its own right rather than an operational nicety.\n \n Refusals are a different event and a different chokepoint. A denied operation never reaches\n * this lane — the authorization decision happens pre-dispatch, its volume is attacker-drivable, and\n * it needs rate-limit / dedup treatment this success path does not. Declaring a `DENIED` outcome\n * here that nothing produces would repeat the very defect this event exists to fix (20 event types\n * were authored in this enum and wired to nothing). That refusal event now exists and is emitted:\n * see {@link AuditableEvent_ResourceOperationDenied_EventDataSchema}, raised from the authorizer.\n * The two events are read together — this one for what happened, that one for what was stopped —\n * and neither carries an `outcome` discriminator, because each states its whole claim in its name.\n \n ## Operation identity is a TRIPLE\n \n `resourceType` + `operationIdentifier` + `variantKey`. Recording only the first two makes an\n * `admin` variant indistinguishable from a `self` variant — a distinction several polymorphic\n * resources encode in `variantKey` alone, and precisely the distinction an auditor is checking.\n \n ## Correlation across a cascade\n \n Every execution surface emits — API, internal call, and repository-only — so one tenant deletion\n * produces one row per cascaded child. The top-level `correlationId` is inherited by every sub-call\n * context and preserved across mid-flight operation corrections, so it groups the whole fan-out to one request;\n * `subCallDepth` separates the initiating operation (0) from what it cascaded into.\n \n ## Field evidence is deliberately partial (GDPR Art. 5(1)(c) + Art. 17)\n \n `changedFields` names every field the write touched — a field NAME is not personal data, so it is\n * always safe and always recorded. `fieldEvidence` carries before/after VALUES only for fields the\n * schema marks `.isAuditEvidence()`.\n \n Values are limited on purpose: audit rows replicate to the per-org SIEM and to the immutable\n * ledger, and the immutable ledger cannot be scrubbed — so copying arbitrary personal data into\n * this event would manufacture an unerasable duplicate, in direct conflict with Art. 17 and with the\n * impersonalization/retention capability built to make personal data erasable. Authority-, status-\n * and scope-bearing values ARE necessary (a role change that does not record the old and new roles\n * proves nothing), and those are exactly what the marker is for.\n \n assurance-control: WILDO.AUDIT.EVIDENCE_INTEGRITY\n /\nexport const AuditableEvent_ResourceOperationPerformed_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.RESOURCE_OPERATION_PERFORMED),\n\n // ── Operation identity (the triple + the shape that resolves the persistence semantics) ──\n /* The resource whose row(s) the operation acted on. /\n resourceType: z.string(),\n /* The verb — a core operation (`update`, `delete`) or a custom identifier (`suspend`). /\n operationIdentifier: z.string(),\n /* Which execution surface ran it. API, internal call, repository-only, cron, batch. /\n variantType: z.enum(ResourceOperationVariantType),\n /\n The variant discriminator. Absent on the default variant; REQUIRED to distinguish e.g. the\n * `admin` variant of a verb from its `self` twin, which share `operationIdentifier`.\n /\n variantKey: z.string().optional(),\n /* The core persistence semantics a custom verb borrows. Absent when the verb IS a core operation. /\n resourceOperationLike: z.enum(CoreResourceOperation).optional(),\n /* `true` for the bulk form, whose subject is a set rather than one row. /\n isBulkOperation: z.boolean().optional(),\n\n // ── Subject ──\n /* The row acted on. Absent for bulk operations, which name a count instead. /\n resourceId: z.string().optional(),\n /* Bulk operations only: how many rows the write affected. /\n affectedRecordCount: z.number().optional(),\n\n // ── Principal (the row's `userId` / `organizationId` / `applicationId` carry the identity) ──\n /\n The caller's roles AS THEY WERE at decision time. Roles are the framework's single\n * authorization axis, so without them a reader cannot tell whether the actor was entitled to the\n * action — and the actor's roles today are not the roles they held then.\n /\n initiatorRoles: z.array(z.string()),\n /* How the call was initiated — separates a human request from framework machinery. /\n executionType: z.enum(ExecutionContext_ExecutionType),\n /* Machine-credential provenance when the principal is a machine rather than a human. /\n machineCredentialAuthMethod: z.string().optional(),\n machineCredentialId: z.string().optional(),\n\n // ── Cascade depth (the request that groups the whole cascade is the row's top-level `correlationId`) ──\n /* `0` for the operation the caller invoked; deeper for what it cascaded into. /\n subCallDepth: z.number(),\n\n // ── Effect ──\n /* Every field the write touched. Names only — always safe, always recorded. /\n changedFields: z.array(z.string()).optional(),\n /\n Before/after values, restricted to fields marked `.isAuditEvidence()`. `before` is absent on a\n * CREATE (there was no prior value) and on any bulk write (the framework fetches a pre-image only\n * for a single selected id).\n /\n fieldEvidence: z\n .record(\n z.string(),\n z.object({\n before: z.unknown().optional(),\n after: z.unknown().optional(),\n }),\n )\n .optional(),\n});\n\n/\n An operation the authorizer REFUSED. The other half of \"record access decisions\" — the negative\n * decision, which until now left no trace anywhere in the framework.\n \n ## Emitted pre-dispatch, from the one funnel\n \n Every public entry point of `AuthorizationsBackendService` converges on the same two inner phase\n * runners — `authorizeInController` (HTTP controller, MCP, WebSocket, queue, field validation),\n * `authorizeInProgrammaticSurface` (a non-controller surface that faces an external caller), and\n * `authorizeInRepositoryAndService`, which has exactly one caller — `authorizeInController` itself.\n * So a single instrumentation point observes every refusal THE AUTHORIZER MAKES, with the operation\n * and execution context both in scope. No mutation has occurred when this row is written; nothing is\n * rolled back by it.\n \n The scope of that claim, stated because an earlier revision overstated it. It used to read\n * \"the sole production entry point for every execution surface\", which asserts something stronger\n * and false: that every execution surface passes the role gate. A programmatic operation entering at\n * the SERVICE tier (`ServicesRegistryHandlerBackendService.read` / `list` / …) reaches no authorizer\n * at all — deliberately, because that population includes the reads that ESTABLISH identity before a\n * role-bearing principal exists. So the absence of a row here means \"the authorizer refused nothing\",\n * never \"nothing was read\". See `AuthorizationsBackendService.authorizeInProgrammaticSurface` for the\n * layering decision and the door.\n \n ## What it is NOT\n \n - Not an authentication failure. `USER_LOGIN_FAILED` / `MACHINE_AUTH_FAILED` say \"you are not\n * who you claim to be\". This says \"you are, and you may not do this\". Distinct types, distinct\n * categories, neither overloaded.\n * - Not an `outcome: 'denied'` variant of {@link AuditableEvent_ResourceOperationPerformed_EventDataSchema}.\n * That event is emitted from the post-commit lane, which by construction can only observe\n * operations that already took effect. A refusal never reaches it.\n \n ## Volume: bounded by dedup, NOT by a risk floor\n \n Denial volume is attacker-drivable in a way the success path's never is. A risk floor was\n * considered and rejected as the control: it would exclude 100% of denied READS (zero of the\n * catalogue's HIGH/CRITICAL variants are reads, while 371 of 551 API-reachable variants are) —\n * discarding the canonical reconnaissance signal — while not capping the adversarial worst case at\n * all, since the attacker chooses which endpoint to hammer.\n \n The actual bound is a per-principal / per-operation / per-reason dedup window. Rather than\n * suppressing repeats outright (which would erase the storm — the very signal a security-operations team wants),\n * emission escalates on a LOGARITHMIC ladder: the 1st, 10th, 100th, … refusal in the window each\n * emit one row carrying {@link occurrenceCount}. A burst of 10 000 identical denials therefore\n * costs 5 rows and remains legible as a burst.\n \n Dedup is best-effort and FAILS OPEN (emit) when the counter store is unavailable — a fail-closed\n * cooldown would let an attacker blind the audit trail by taking Redis down.\n \n assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT\n /\n/\n A platform operator acted on a row belonging to a tenant they are not a member of.\n \n ## Why this event exists\n \n Wildo's answer to \"may a platform super-administrator administer any tenant?\" is YES — the same\n * answer most mature B2B platforms give, because support and incident response genuinely need it.\n * What those platforms do NOT do is leave the reach implicit. Support access is a named, logged\n * event, because the difference between legitimate operator work and quiet snooping is not the\n * capability — both use the identical capability — it is whether anyone can tell afterwards.\n \n Until 2026-08-05 Wildo had the capability with none of the visibility, and by accident rather than\n * declaration: per-instance org-scoped requests are checked by `authorizeOrganizations`, which\n * compares the fetched row's organization against a scope the SAME REQUEST supplied through its URL.\n * A non-member operator therefore passed it silently. Measured over real HTTP by\n * `organization-ownership-grant-hostile.e2e.ts` probe F-1a, which deleted a membership row in\n * another tenant and got a 200.\n \n This event is the visibility half. It does NOT refuse — refusing is a separate, much larger change\n * with a measured blast radius (see the plan) and is a policy decision in its own right. Emission is\n * best-effort and never blocks the request: an operator action must not fail because the audit sink\n * is down, and a fail-closed variant would let anyone disable operator support by breaking the sink.\n \n ## Reading the event\n \n {@link admissionDeclared} is the field that matters most. `true` means the operation VARIANT\n * declared `admitsCrossTenantPlatformAdministration` — an intended, reviewed crossing such as\n * `organizationMembers.grantOwnership`. `false` means the reach came from the structural gap above:\n * nobody declared it, no spec documents it, and it is the population to watch.\n \n assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION — platform-tier access to a tenant the\n * principal does not belong to.\n * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT\n /\n/\n One transition in the life of a platform access grant.\n \n The crossing itself is recorded by {@link CoreAuditableEventType.CROSS_TENANT_ADMINISTRATIVE_ACCESS}.\n * This is the other half, and a reviewer needs both: that event answers \"an operator reached into\n * this tenant\", this one answers \"on what authority, asked for when, and who agreed\".\n \n Deliberately two events rather than one enriched one. A grant is requested once and may authorise\n * many crossings across its window, so folding them together would either duplicate the grant's\n * details onto every access or lose the request/decision timeline entirely.\n \n {@link autoApprovalReason} is the field a customer audit turns on. Its ABSENCE on an approved grant\n * means a human in the tenant said yes. `TENANT_APPROVAL_NOT_REQUIRED` means the tenant had not opted\n * into approval. `TENANT_CANNOT_APPROVE` means the tenant had no administratively usable owner and\n * could not consent — the one path where operator access proceeds against a tenant that never agreed\n * and never could, which is why the emitter carries it at a higher risk level.\n \n assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION\n * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — evidence of a privileged assignment's full life.\n /\nexport const AuditableEvent_PlatformAccessGrantLifecycle_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.PLATFORM_ACCESS_GRANT_LIFECYCLE),\n\n /* Which transition this row records. /\n transition: z.enum(PlatformAccessGrantLifecycleTransition),\n /* The grant, so the whole timeline can be reassembled from its rows. /\n grantId: z.string(),\n /* The tenant that was, or would have been, reached into. /\n targetOrganizationId: z.string(),\n /* The operator who asked. Never the decider — see {@link decidedByUserId}. /\n operatorUserId: z.string(),\n /* Why the operator said they needed access. Recorded on every transition, not only the request. /\n justification: z.string().optional(),\n /* The status the grant holds after this transition. /\n resultingStatus: z.enum(PlatformAccessGrantStatus),\n /* When the elevation stops working. Absent on a grant that never became usable. /\n expiresAt: z.date().optional(),\n /* Present exactly when the grant became usable with no tenant administrator acting. /\n autoApprovalReason: z.enum(PlatformAccessGrantAutoApprovalReason).optional(),\n /* The tenant administrator who approved, denied or revoked. Absent on an auto-approval. /\n decidedByUserId: z.string().optional(),\n /* Their stated reason, when they gave one. /\n decisionReason: z.string().optional(),\n});\n\nexport const AuditableEvent_CrossTenantAdministrativeAccess_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.CROSS_TENANT_ADMINISTRATIVE_ACCESS),\n\n /* The tenant that was reached into — the row's organization, never the caller's own. /\n targetOrganizationId: z.string(),\n /* The resource whose row the operator acted on. /\n resourceType: z.string(),\n /* The verb — a core operation (`update`, `delete`) or a custom identifier (`grantOwnership`). /\n operationIdentifier: z.string(),\n /* Which execution surface the crossing arrived on. /\n variantType: z.enum(ResourceOperationVariantType),\n /* The variant discriminator, which is what distinguishes a declared crossing from its siblings. /\n variantKey: z.string().optional(),\n /* The row(s) reached. Absent for collection operations, which name no id. /\n targetResourceIds: z.array(z.string()).optional(),\n\n /\n The elevation that authorised this crossing, when one did.\n \n This is what joins the two operator-access events into one story: the lifecycle event says an\n * elevation was requested, justified and decided; this field says WHICH elevation a given access\n * was exercised under. Without it a reviewer looking at a crossing has to infer the grant from\n * timestamps, which stops working the moment an operator holds two grants in a day.\n \n Absent on the bootstrap verb (`requestAccess` is exempt — it is how a grant comes into existence)\n * and on any crossing admitted before grants were required.\n /\n authorizingGrantId: z.string().optional(),\n\n /\n Did the operation variant DECLARE this crossing (`admitsCrossTenantPlatformAdministration`)?\n \n `false` is the signal worth alerting on: reach that no variant asked for and no specification\n * describes. See this schema's JSDoc.\n /\n admissionDeclared: z.boolean(),\n /* The caller's roles as they were at decision time. /\n initiatorRoles: z.array(z.string()),\n /* How the call was initiated — separates a human operator from framework machinery. /\n executionType: z.enum(ExecutionContext_ExecutionType),\n});\n\n/\n An application-wide directory enumeration.\n \n See {@link CoreAuditableEventType.PLATFORM_DIRECTORY_ACCESS} for why this is a distinct event\n * type rather than a shape of the cross-tenant one. The short version: there is no target tenant to\n * name, because the read deliberately spans them all.\n /\nexport const AuditableEvent_PlatformDirectoryAccess_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.PLATFORM_DIRECTORY_ACCESS),\n\n /* The directory that was enumerated (`users`, `anonymousUsers`, …). /\n resourceType: z.string(),\n /* The collection verb — `list`, `search`, `count`. /\n operationIdentifier: z.string(),\n /* Which execution surface the read arrived on. /\n variantType: z.enum(ResourceOperationVariantType),\n /\n The variant discriminator.\n \n Load-bearing rather than decorative: on `users` the DEFAULT `list` variant is `INTERNAL_CALL`\n * and registers no route, while the HTTP-exposed one is the non-default `admin` variant. A\n * reviewer who cannot tell the two apart cannot tell an internal enumeration from an operator\n * browsing the directory.\n /\n variantKey: z.string().optional(),\n /\n How many rows the caller actually received.\n \n The size is the signal. \"An operator opened the user directory\" is routine; \"an operator paged\n * through 40,000 users\" is the shape of an export, and only this field distinguishes them.\n /\n returnedCount: z.number().int().nonnegative(),\n /* The caller's roles as they were at read time. /\n initiatorRoles: z.array(z.string()),\n /* How the call was initiated — separates a human operator from framework machinery. /\n executionType: z.enum(ExecutionContext_ExecutionType),\n});\n\nexport const AuditableEvent_ResourceOperationDenied_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.RESOURCE_OPERATION_DENIED),\n\n // ── Why (the discriminator a security-operations dashboard groups by) ──\n /* Which refusal the authorizer resolved. /\n denialReason: z.enum(ResourceOperationDenialReason),\n\n // ── Operation identity (the same TRIPLE as the success twin — see its JSDoc for why) ──\n /* The resource whose row(s) the caller attempted to act on. /\n resourceType: z.string(),\n /* The verb — a core operation (`update`, `delete`) or a custom identifier (`suspend`). /\n operationIdentifier: z.string(),\n /* Which execution surface the attempt arrived on. /\n variantType: z.enum(ResourceOperationVariantType),\n /\n The variant discriminator. Absent on the default variant; REQUIRED to distinguish e.g. the\n * `admin` variant of a verb from its `self` twin, which share `operationIdentifier`.\n /\n variantKey: z.string().optional(),\n /* The core persistence semantics a custom verb borrows. Absent when the verb IS a core operation. /\n resourceOperationLike: z.enum(CoreResourceOperation).optional(),\n /* `true` for the bulk form, whose subject is a set rather than one row. /\n isBulkOperation: z.boolean().optional(),\n\n // ── Subject (what was ATTEMPTED — never proof the row exists) ──\n /\n The row id(s) the caller named. Present even for {@link ResourceOperationDenialReason.SUBJECT_NOT_RESOLVABLE},\n * where the id may correspond to nothing at all — this records what was ASKED FOR, not what exists.\n * Absent for collection operations, which name no id.\n /\n attemptedResourceIds: z.array(z.string()).optional(),\n\n // ── Authority (what was required vs. what was held) ──\n /\n The role set the operation demanded. Together with {@link initiatorRoles} this makes the refusal\n * self-explaining: a reviewer sees what was needed and what the caller had, without re-deriving\n * the operation's config as it stood that day.\n /\n requiredRoles: z.array(z.string()).optional(),\n /\n The caller's roles AS THEY WERE at decision time — empty when the refusal WAS the absence of\n * them ({@link ResourceOperationDenialReason.MISSING_INITIATOR}).\n /\n initiatorRoles: z.array(z.string()),\n /* How the call was initiated — separates a human request from framework machinery. /\n executionType: z.enum(ExecutionContext_ExecutionType),\n /* Machine-credential provenance when the refused principal is a machine rather than a human. /\n machineCredentialAuthMethod: z.string().optional(),\n machineCredentialId: z.string().optional(),\n\n // ── Cascade depth (the request that groups the whole cascade is the row's top-level `correlationId`) ──\n /* `0` for the operation the caller invoked; deeper for what it cascaded into. /\n subCallDepth: z.number(),\n\n // ── Burst accounting (see the dedup ladder in this schema's JSDoc) ──\n /\n How many identical refusals (same principal, operation and reason) have accumulated in the\n * current dedup window INCLUDING this one. `1` on the first. A row with a large value is a\n * deliberate escalation checkpoint, not a duplicate.\n /\n occurrenceCount: z.number(),\n /\n `true` when the count is exact (the dedup counter was reachable). `false` when the counter store\n * was unavailable and the emission fell open — the row is then a truthful record of ONE refusal\n * whose burst context is unknown, and {@link occurrenceCount} is not to be trusted as a total.\n /\n occurrenceCountIsExact: z.boolean(),\n});\n\n/\n A privileged SEE-THROUGH read that revealed RETAINED (impersonalized-and-retained) records —\n * rows kept for a legal/audit obligation while their personal data was scrubbed, hidden from\n * normal callers by the retention hide-predicate. This is the compliance-grade access record over\n * that scrubbed data, and its two defining properties (vs `SYSTEM_CONTEXT_READ`, which names only the\n * RUNTIME that acted, never a human) are:\n \n 1. Human attribution — `accessingUserId` names the actual super-admin / `COMPLIANCE_AUDITOR`\n * who exercised the see-through, so a retained-data reveal is never anonymous. Non-empty\n * (`.trim().min(1)`) — a blank id cannot stand in for a human.\n * 2. A required reason — `reason` is the mandatory justification for revealing scrubbed PII.\n * Non-empty (`.trim().min(1)`): a blank OR whitespace-only reason fails validation, so the audit\n * trail cannot record a reveal without a real \"why\". The see-through primitives ALSO fail-closed on\n * blank attribution before the read (the schema `.min(1)` is the contract; the primitive guard is\n * the enforcement point, since the audit store persists `eventData` as an unparsed record).\n \n Strictly read-only (the see-through primitive never mutates). Emitted by the see-through read\n * primitive (`readRetainedAsSystem` / `listRetainedAsSystem`) — wired in a later phase; this is the\n * contract only.\n /\nexport const AuditableEvent_RetainedDataAccess_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.RETAINED_DATA_ACCESS),\n /* The HUMAN principal who performed the see-through read (super-admin / COMPLIANCE_AUDITOR). Non-empty. /\n accessingUserId: z.string().trim().min(1),\n /* REQUIRED non-empty compliance justification for revealing the retained (scrubbed) records — the \"why\". /\n reason: z.string().trim().min(1),\n /* The resource type whose retained rows were revealed. /\n resourceType: z.string(),\n /* Present for a single-record see-through read; absent for a list/search reveal. /\n resourceId: z.string().optional(),\n /* For a list/search see-through: how many retained rows the query revealed. /\n retainedRecordCount: z.number().optional(),\n /* The see-through primitive that ran (e.g. `readRetainedAsSystem` / `listRetainedAsSystem`). /\n operationIdentifier: z.string(),\n /* The privileged role(s) that authorized the see-through (roles are the single authorization axis). /\n roles: z.array(z.string()).optional(),\n /* Tenant scope of the accessed data (organizationId), when the read was org-scoped. /\n organizationId: z.string().optional(),\n ipAddress: z.string().optional(),\n});\n\n/\n A DATA SUBJECT EXPORT — the compliance record of the framework assembling everything it holds\n * about one person and disclosing it.\n \n This is the most sensitive READ the framework performs, and the one an access-request audit turns\n * on. Its defining properties:\n \n 1. A named subject — `subjectResourceType` + `subjectIds`: WHOSE data left the system. An\n * export event that cannot name its subject is not an access record.\n * 2. A named purpose — `purpose` is a `SubjectExportPurpose`. Art. 15 and Art. 20 produce\n * genuinely different bundles, so an audit trail that recorded only \"an export happened\" could\n * not later establish which right was answered or whether it was answered completely.\n * 3. What was actually included — `includedResourceTypes` + `totalRecordCount`, and\n * `fieldsExcludedAsDerived` for the Art. 20 narrowing. The OMISSIONS matter as much as the\n * contents: \"why was this not in my export?\" must have a recorded answer.\n \n Carries NO personal data — resource types, ids, counts and field NAMES only. Recording the\n * exported values would turn the record of a disclosure into a second copy of it, in a store with\n * a longer retention than the export artifact itself.\n \n assurance-control: WILDO.PRIVACY.SUBJECT_DATA_EXPORT\n /\nexport const AuditableEvent_SubjectDataExport_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.SUBJECT_DATA_EXPORT),\n /* WHICH data-subject right this export answered — the two produce different bundles. /\n purpose: z.string().trim().min(1),\n /* The exported subject's resource type. /\n subjectResourceType: z.string().trim().min(1),\n /* The exported subject rows. Non-empty: an export with no subject is not an export. /\n subjectIds: z.array(z.string()).min(1),\n /* Every resource that actually contributed rows to the bundle. /\n includedResourceTypes: z.array(z.string()),\n /* Total rows disclosed across the whole bundle. /\n totalRecordCount: z.number(),\n /\n `resourceType.fieldName` locators omitted from an Art. 20 bundle as controller-derived. Empty\n * for an Art. 15 access export, which discloses every field regardless of provenance.\n /\n fieldsExcludedAsDerived: z.array(z.string()),\n /\n `resourceType.fieldName` locators withheld as NON-DISCLOSABLE regardless of right — secrets and\n * backend-only values the export refuses to hand out. Recorded so a thin bundle reads as a\n * deliberate security floor rather than a missed resource.\n /\n fieldsWithheldAsNonDisclosable: z.array(z.string()),\n /* Tenant scope, when the export ran org-scoped. /\n organizationId: z.string().optional(),\n});\n\n/\n A COLLECTION EXPORT — an operator rendered a resource listing to a file and downloaded it.\n \n ## What it must answer, and what it must never carry\n \n The reviewer's questions are: which listing, in what shape, and how much left. So the row\n * count is mandatory and the row scope is recorded verbatim — \"they exported the page they were\n * looking at\" and \"they exported the whole table\" are the same action with very different\n * consequences, and only this field separates them after the fact.\n \n `filterFieldNames` records WHICH filters narrowed the export, never their values. A filter\n * value is frequently personal data (`?email=…`, `?assigneeId=…`), so recording it would turn the\n * record of a disclosure into a second copy of it, in a store that outlives the exported file — the\n * same rule {@link AuditableEvent_SubjectDataExport_EventDataSchema} follows (\"resource types, ids,\n * counts and field NAMES only\"). No row content, ever.\n \n ## Why the severity is static and the risk is not\n \n `AUDIT_EVENT_CLASSIFICATION_MAP` is keyed by event TYPE, so severity cannot vary per emission.\n * Classifying every export WARNING would put a routine twenty-row page download beside a whole-table\n * dump and train reviewers to skim the channel; classifying every export INFO would leave the dump\n * indistinguishable. The distinction therefore rides on `riskLevel`, which IS per-emission and is an\n * indexed summary column on the audit row: LOW for a page, HIGH for a full result set.\n \n Rejected: two event types. A page export and a full export are one action with one parameter,\n * and splitting the vocabulary to vary a field would make every consumer match two types forever.\n \n assurance-control: WILDO.PRIVACY.COLLECTION_DATA_EXPORT\n /\nexport const AuditableEvent_CollectionDataExport_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.COLLECTION_DATA_EXPORT),\n /* The exported resource. /\n resourceType: z.string().trim().min(1),\n /* The LIST/SEARCH operation whose result set was exported. /\n sourceOperationIdentifier: z.string().trim().min(1),\n /* `csv` \| `json` — the rendered wire format. /\n format: z.string().trim().min(1),\n /* `visible_page` \| `full_result_set` — see the docstring; this is the field that matters most. /\n rowScope: z.string().trim().min(1),\n /* Rows actually written to the file. Mandatory: an export event with no count answers nothing. /\n rowCount: z.number().int().nonnegative(),\n /* Names of the filters that narrowed the export. NEVER their values. /\n filterFieldNames: z.array(z.string()),\n /* Tenant scope, when the export ran org-scoped. /\n organizationId: z.string().optional(),\n});\n\n/\n Rows were read THROUGH an HTTP-API resource binding — the read-through trail for data living in\n * an EXTERNAL system the platform does not own (ETL plan D8/R6; see the enum member's docstring\n * for why this is neither SYSTEM_CONTEXT_READ nor COLLECTION_DATA_EXPORT).\n \n One event per read-family OPERATION execution: a paginated LIST and the count that totals its\n * envelope are ONE access, not two — the unit a reviewer reasons about is \"an operation reached\n * into the external system\", never the transport's call multiplicity. Carries NO row data and no\n * filter VALUES — the trail must never become a second copy of the external system's content.\n \n `initiatorUserId` is the REAL initiating user (R12): under a SERVICE_PRINCIPAL binding every\n * remote call authenticates as one service account, and this field is what keeps attribution\n * alive through that shared principal. Optional because internal/machine executions genuinely\n * have no user — absence means \"a runtime acted\", exactly as `executionType` records.\n \n assurance-control: WILDO.AUDIT.ATTRIBUTION — read-through access to an external system is\n * recorded with the real initiating user carried through the shared service principal.\n /\nexport const AuditableEvent_HttpApiReadThroughAccess_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.HTTP_API_READ_THROUGH_ACCESS),\n /* The Wildo resource whose binding was read through. /\n resourceType: z.string().trim().min(1),\n /* The read-family member executed: `read` \| `list` \| `count` \| `search`. /\n operationIdentifier: z.string().trim().min(1),\n /* The provider the binding resolves credentials/base-URL through (e.g. `odoo`). /\n providerRef: z.string().trim().min(1),\n /* The remote entity (OData entity set / Odoo model / declared REST surface). /\n remoteEntityRef: z.string().trim().min(1),\n /* The transport dialect spoken (`odata` \| `rest-json` \| `odoo-jsonrpc`). /\n dialect: z.string().trim().min(1),\n /* The REAL initiating user — absent only for genuine machine/internal executions. /\n initiatorUserId: z.string().optional(),\n /* The execution type that acted, for the machine/internal cases. /\n executionType: z.string().optional(),\n /* Tenant scope, when the read ran org-scoped. /\n organizationId: z.string().optional(),\n /* The addressed row's synthesized id, for single-row reads. /\n resourceId: z.string().optional(),\n /* Rows returned (list/search), or the count answered (count). Absent for a single READ. /\n rowCount: z.number().int().nonnegative().optional(),\n});\n\n/\n A subject erasure invoked the DECLARED external-erasure operation of an HTTP_API binding\n * (ETL D6 stance 6b) — rows linked to the erased subject were deleted in the external system.\n \n Carries ids only, never personal fields: by the time this emits, the subject's local row is\n * scrubbed, and the whole point of the operation was that the remote copies stop existing.\n \n assurance-control: WILDO.AUDIT.ATTRIBUTION — the outbound deletion names the subject it served\n * and the external system it reached; the erasure report is the per-request receipt, this row is\n * the queryable trail.\n /\nexport const AuditableEvent_HttpApiExternalErasure_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.HTTP_API_EXTERNAL_ERASURE),\n /* The erased subject's resource type (e.g. `users`). /\n subjectResourceType: z.string().trim().min(1),\n /* The erased subject row ids the deleted remote rows were linked to. /\n subjectIds: z.array(z.string().trim().min(1)).min(1),\n /* The HTTP_API-bound Wildo resource whose declared erasure operation ran. /\n resourceType: z.string().trim().min(1),\n /* The provider the binding resolves credentials/base-URL through. /\n providerRef: z.string().trim().min(1),\n /* The remote entity (OData entity set / Odoo model / declared REST surface). /\n remoteEntityRef: z.string().trim().min(1),\n /* The transport dialect spoken (`odata` \| `rest-json` \| `odoo-jsonrpc`). /\n dialect: z.string().trim().min(1),\n /* Remote rows the declared operation deleted (0 is a legitimate nothing-to-erase). /\n deletedRowCount: z.number().int().nonnegative(),\n /* Tenant scope, when the erasure request carried one. /\n organizationId: z.string().optional(),\n});\n\n/\n A subject erasure COMPLETED while rows linked to the subject remain live in an HTTP_API-bound\n * external system, on the controller's explicit per-request acknowledgement (ETL D6 stance 6c).\n \n THE RECORD IS THE CONTROL: the acknowledgement's entire justification is that the hole becomes\n * VISIBLE rather than prevented (`administrative-continuity-floors.md`), so this event must name\n * everything a reviewer needs to act — the subject, the resource, the external system, and the\n * remaining linkage when it could be measured.\n \n assurance-control: WILDO.AUDIT.ATTRIBUTION — an acknowledged erasure hole is recorded per\n * resource, per erasure request, never as a standing posture.\n /\nexport const AuditableEvent_HttpApiNonErasureAcknowledged_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.HTTP_API_NON_ERASURE_ACKNOWLEDGED),\n /* The erased subject's resource type (e.g. `users`). /\n subjectResourceType: z.string().trim().min(1),\n /* The erased subject row ids whose linked remote rows remain live. /\n subjectIds: z.array(z.string().trim().min(1)).min(1),\n /* The HTTP_API-bound Wildo resource whose rows remain un-erased. /\n resourceType: z.string().trim().min(1),\n /* The provider the binding resolves credentials/base-URL through. /\n providerRef: z.string().trim().min(1),\n /* The remote entity (OData entity set / Odoo model / declared REST surface). /\n remoteEntityRef: z.string().trim().min(1),\n /* The transport dialect spoken (`odata` \| `rest-json` \| `odoo-jsonrpc`). /\n dialect: z.string().trim().min(1),\n /\n Remote rows still linked to the subject, when the target answered a count. ABSENT means the\n * count could not be measured (the count read failed or is undeclared for the binding) — never\n * write 0 for \"unknown\": zero is a measured answer.\n /\n remainingRowCount: z.number().int().nonnegative().optional(),\n /* Tenant scope, when the erasure request carried one. /\n organizationId: z.string().optional(),\n});\n\n/\n Audit-log event for cross-frontend session handoff issuance\n * (cross-app-jwt-propagation Step 2).\n \n Captures who issued a transferable session credential, where it was bound to,\n * and a hash of the deep-link target so ops can correlate handoff issuance with\n * the corresponding `tokenExchange` event WITHOUT leaking the raw deep link\n * (which can carry org IDs, share codes, or draft IDs).\n \n `returnPathHash` is hex-encoded `sha256(returnPath)` computed by the audit-log\n * helper from the validated returnPath. NEVER pass a pre-hashed value at the\n * call site (defense-in-depth: prevents accidental double-hashing or hash\n * mismatch with what the schema validated).\n /\nexport const AuditableEvent_User_CrossFrontendHandoffIssuedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_CROSS_FRONTEND_HANDOFF_ISSUED),\n userId: z.string(),\n /* The `X-Frontend-Service-Name` of the source frontend that initiated the handoff. /\n sourceFrontendServiceName: z.string().optional(),\n /* The SaaS-config service key (and runtime `frontendServiceName`) of the target. /\n targetServiceKey: z.string(),\n /* SHA-256 hex of the validated returnPath; NEVER the raw path. /\n returnPathHash: z.string(),\n /* ID of the issued AUTH_CODE_EXCHANGE consumable token (for replay forensics). /\n consumableTokenId: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\n// ── OAuth2 / OIDC Provider Event Data Schemas (Wildo AS the authorization server) ──\n\n/\n A user-delegated `authorization_code` access token was minted for a third-party client at\n * `/oauth/token`. This is the most security-sensitive access grant the provider makes: the client\n * can now act AS the user at the audience-bound A2A/MCP resource. `clientId` is the `azp`\n * (attribution only — the token carries the USER's authority, not the client's). Never carries the\n * raw token.\n /\nexport const AuditableEvent_OAuth_DelegatedTokenIssuedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.OAUTH_DELEGATED_TOKEN_ISSUED),\n /* The delegating (consenting) user — the token subject. /\n userId: z.string(),\n /* The third-party client the token was minted for (`azp`). /\n clientId: z.string(),\n /* The A2A/MCP resource-server audience the token is confined to. /\n audience: z.string(),\n /* Granted identity scopes (openid/…); may be empty. Identity/consent provenance only — no authz weight. /\n scopes: z.array(z.string()),\n /* Delegated-token lifetime in seconds (short-lived; never the full session TTL). /\n ttlSeconds: z.number(),\n ipAddress: z.string().optional(),\n});\n\n/* A user APPROVED an interactive consent request — a code is issued and the client may act for them. /\nexport const AuditableEvent_OAuth_ConsentGrantedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.OAUTH_CONSENT_GRANTED),\n /* The user who approved. /\n userId: z.string(),\n /* The client the consent was granted to. /\n clientId: z.string(),\n /* The scopes consented to. /\n scopes: z.array(z.string()),\n /* The RFC 8707 resource the consent was bound to, when present. /\n resource: z.string().optional(),\n /* Whether the user asked to persist the grant (\"remember this app\") — a durable-authority signal. /\n remembered: z.boolean(),\n ipAddress: z.string().optional(),\n});\n\n/* A user DENIED an interactive consent request — access refused. /\nexport const AuditableEvent_OAuth_ConsentDeniedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.OAUTH_CONSENT_DENIED),\n userId: z.string(),\n clientId: z.string(),\n scopes: z.array(z.string()),\n resource: z.string().optional(),\n ipAddress: z.string().optional(),\n});\n\n/\n A persistent consent grant (the durable \"remember this app\" record, keyed on\n * `(userId, clientId, resource)`) was created or updated — it lets future authorize flows SKIP the\n * consent prompt, so its lifecycle is a first-class delegated-authority audit concern.\n /\nexport const AuditableEvent_OAuth_ConsentGrantPersistedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.OAUTH_CONSENT_GRANT_PERSISTED),\n userId: z.string(),\n clientId: z.string(),\n /* The RFC 8707 resource the grant covers; absent for an OIDC-only (resource-less) grant. /\n resource: z.string().optional(),\n /* The union of scopes the grant now covers after the write. /\n scopes: z.array(z.string()),\n /* `true` when a NEW grant row was created; `false` when an existing grant's scopes were widened. /\n isNewGrant: z.boolean(),\n});\n\n/\n A CIMD `client_id` URL was refused. Unauthenticated by construction, so the URL, the reason and\n * the source of the request ARE the investigation surface.\n /\nexport const AuditableEvent_OAuth_CimdClientRefusedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.OAUTH_CIMD_CLIENT_REFUSED),\n /* The `client_id` URL as presented. Attacker-controlled, so treated as data, never as a locator. /\n clientId: z.string(),\n /* Closed vocabulary — branched on by operators and COUNTED, never free text. /\n reason: z.string(),\n detail: z.string().optional(),\n});\n\n/\n A client registered itself at `/oauth/register` (RFC 7591). Unauthenticated by construction, so\n * the source IP and the self-asserted name/redirects ARE the investigation surface — there is no\n * principal to attribute it to.\n /\nexport const AuditableEvent_OAuth_DynamicClientRegisteredEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.OAUTH_DYNAMIC_CLIENT_REGISTERED),\n clientId: z.string(),\n /* Self-asserted; nobody vetted it. Shown on the consent screen, so worth recording verbatim. /\n clientName: z.string(),\n /* The redirect URIs the client claimed — where an authorization code would be delivered. /\n redirectUris: z.array(z.string()),\n /\n The POST-LOGOUT redirect URIs the client claimed (revocation-C) — where an RP-Initiated Logout would\n * send the browser after the session ends. Optional: absent on rows written before the field existed and\n * for a registration that declared none.\n /\n postLogoutRedirectUris: z.array(z.string()).optional(),\n ipAddress: z.string().optional(),\n});\n\n/\n A user token was rotated via the provider `refresh_token` grant (`/oauth/token`). Distinct from the\n * first-party session refresh (`USER_TOKEN_REFRESHED`): this is the OAuth-provider endpoint, which a\n * confidential client MAY authenticate to. Low-detail INFO — the security-relevant refresh signal is\n * reuse/theft ({@link CoreAuditableEventType.USER_REFRESH_TOKEN_REUSE_DETECTED}).\n \n There is deliberately NO `OAUTH_TOKEN_REFRESH_FAILED` counterpart (user-confirmed 2026-07-31): routine\n * refresh failures (expired / revoked / plain-invalid presented token) are high-volume benign noise from\n * ended sessions, and auditing them would drown the compliance store. The only refresh-failure worth an\n * audit record is credential theft, which reuse-detection catches → `USER_REFRESH_TOKEN_REUSE_DETECTED`.\n /\nexport const AuditableEvent_OAuth_TokenRefreshedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.OAUTH_TOKEN_REFRESHED),\n /* The refreshing user, when resolvable from the freshly-minted access token; else absent. /\n userId: z.string().optional(),\n /* The client that authenticated the refresh (confidential-client id_token re-issue path); else absent. /\n clientId: z.string().optional(),\n /* Whether a confidential client was authenticated on this refresh (vs a first-party session refresh). /\n clientAuthenticated: z.boolean(),\n ipAddress: z.string().optional(),\n});\n\n/\n A token was revoked via `/oauth/revoke` (RFC 7009). The endpoint is deliberately a no-oracle (200 for\n * unknown tokens), so this records the ATTEMPT + the authenticated client (if any), never whether the\n * token existed or whose it was.\n /\nexport const AuditableEvent_OAuth_TokenRevokedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.OAUTH_TOKEN_REVOKED),\n /* The confidential client that authenticated to revoke, when present. /\n clientId: z.string().optional(),\n /* Whether a confidential client authenticated the revocation. /\n clientAuthenticated: z.boolean(),\n /* The RFC 7009 `token_type_hint` the caller supplied, when present. /\n tokenTypeHint: z.string().optional(),\n ipAddress: z.string().optional(),\n});\n\n/\n An OIDC RP-Initiated Logout (RP-Initiated Logout 1.0) terminated the End-User's OP session at\n * `/oauth/end-session` (revocation-C). Records WHO logged out WHICH session via WHICH relying party, and\n * whether a session was actually terminated / a post-logout redirect was refused. `userId`/`sessionId`/\n * `clientId` are present only when a valid `id_token_hint` identified them — an invalid or absent hint\n * still lands the user on the OP's page but terminates nothing.\n /\nexport const AuditableEvent_OAuth_RpInitiatedLogoutEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.OAUTH_RP_INITIATED_LOGOUT),\n /* The user whose OP session was terminated — present only when a valid `id_token_hint` identified them. /\n userId: z.string().optional(),\n /* The terminated login session (the id_token `sid`) — present only when the hint carried one. /\n sessionId: z.string().optional(),\n /* The relying party that initiated the logout (the id_token `azp`), when identifiable. /\n clientId: z.string().optional(),\n /* Whether a session was actually terminated (a valid hint carrying a `sid` was presented). /\n sessionTerminated: z.boolean(),\n /* Whether a presented `post_logout_redirect_uri` was REFUSED because it did not match the client's\n * registered allowlist — a misconfiguration / open-redirect-probe signal worth separating from a\n * plain no-URI logout. /\n postLogoutRedirectUriRejected: z.boolean(),\n ipAddress: z.string().optional(),\n});\n\n/\n An `authorization_code` exchange was REJECTED at `/oauth/token`. A potential attack signal (code\n * replay, PKCE downgrade, redirect tampering, cross-client redemption). `reason` names the cause;\n * `userId`/`resource` are present only for causes detected AFTER the code decodes (never for the\n * atomic replay/consume failure, which fails before decode).\n /\nexport const AuditableEvent_OAuth_CodeExchangeFailedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.OAUTH_CODE_EXCHANGE_FAILED),\n /* The specific failure cause (closed vocabulary). /\n reason: z.enum(OAuthCodeExchangeFailureReason),\n /* The redeeming client, when the request supplied one. /\n clientId: z.string().optional(),\n /* The code's subject, available only for post-decode causes. /\n userId: z.string().optional(),\n /* The code's bound resource, available only for post-decode causes. /\n resource: z.string().optional(),\n ipAddress: z.string().optional(),\n});\n\n/\n A consent DECISION was submitted by an authenticated user who is NOT the user the consent request was\n * bound to (returns 403). A textbook cross-user authorization-abuse signal — user A attempting to act on\n * user B's pending consent. CRITICAL: records BOTH principals for the SIEM.\n /\nexport const AuditableEvent_OAuth_ConsentBindingViolationEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.OAUTH_CONSENT_BINDING_VIOLATION),\n /* The authenticated user who submitted the decision (the actor). /\n authenticatedUserId: z.string(),\n /* The user the consent request was actually bound to (the victim). /\n boundUserId: z.string(),\n /* The client the consent request was for, when known. /\n clientId: z.string().optional(),\n /* The consent-request consumable-token id, for replay forensics. /\n consentTokenId: z.string().optional(),\n ipAddress: z.string().optional(),\n});\n\n/\n Refresh-token REUSE was detected → the whole token family was revoked (possible theft). Emitted by the\n * refresh CALLERS, NOT the token issuer: the issuer stays audit-free by design (it performs the revoke and\n * surfaces a machine-readable reuse SIGNAL on its thrown error), and each caller decides to audit. Applies\n * to BOTH the first-party session refresh and the OAuth-provider refresh grant (shared issuer).\n /\nexport const AuditableEvent_User_RefreshTokenReuseDetectedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_REFRESH_TOKEN_REUSE_DETECTED),\n /* The user whose token family was revoked (the victim). /\n userId: z.string(),\n /* The reused refresh token's `jti` (the replayed credential id) — never the raw token. /\n reusedJti: z.string(),\n /* The session the reused token belonged to, when present on the claim. /\n sessionId: z.string().optional(),\n /* Whether the family-wide revocation (`TOKEN_INVALID_BEFORE`) was written — the action taken. /\n familyRevoked: z.boolean(),\n ipAddress: z.string().optional(),\n});\n\n// MongoDB-compatible schema using simple object for eventData\n// The discriminated union validation will be handled at the service layer\nexport const AuditableEvent_DataSchema = z.record(z.string(), z.any());\n\n\n\n\nexport const AuditableEvent_BaseSchema = z.object({\n _id: z.string().isPrimaryKey().isSummaryField(),\n /\n Store-agnostic, server-minted correlation key (UUID). The Mongo `_id` is\n * THIS store's primary key, but immudb (and any future audit sink) has its\n * own native key — so cross-store correlation needs an id that belongs to the\n * EVENT, not to one store. Minted in `AuditLogsBackendService._createAuditLog`\n * BEFORE the DB write and carried on BOTH the DB row AND the provider fan-out\n * emission, so the Phase-3 completeness reconciler can match DB rows ⇄ immudb\n * records (and `AuditLogVerification.verifyAuditEvent(eventId)` resolves the\n * same key). Not the primary key: `_id` stays the DB PK.\n /\n eventId: z.string().isDBIndexed(),\n // Note: .optional() must come AFTER decorators to preserve optionality in TypeScript type inference\n userId: z.string().isSummaryField().optional(),\n /\n The org the event is ABOUT (event DATA) — e.g. the org whose SSO config changed, or the\n * org resolved from a login email's domain. NEVER a routing key. Per-org SIEM / sink\n * dispatch routes ONLY on the AUTHENTICATED request org\n * (`ExecutionContext.initiatorIds.organizationId`) — this field is attacker-influenceable on\n * pre-auth paths (a failed-login email domain → org lookup), so routing on it would leak one\n * tenant's events into another tenant's SIEM (F4). See `AuditLogsBackendService._createAuditLog`.\n \n ## Why an attacker-influenceable value is nonetheless SAFE to persist here\n \n Recorded 2026-08-05, when this field stopped being silently dropped on write (see\n * `_createAuditLog`'s `preserveServerInjectedFields` call). The change makes a value an\n * unauthenticated caller can influence both durable and, on the org-scoped viewer, VISIBLE — so\n * the two channels it could reach were each checked rather than assumed.\n \n 1. SIEM delivery — unaffected. Per-org dispatch keys on the AUTHENTICATED request org, never\n * on this field (F4, above). Persisting it changes no routing decision, so the cross-tenant\n * SIEM leak F4 exists to prevent is not reachable through it.\n * 2. In-product visibility — intended, not a leak. `ORGANIZATIONS → AUDIT_LOGS` is\n * `REQUIRES_CONTEXT` on `organizationId`, so this value decides which org sees the row in the\n * org-scoped Audit Log Viewer. A failed-login row surfacing in the org whose user was targeted\n * is the CORRECT outcome — a tenant seeing authentication attempts against its own members is\n * the purpose of an audit log, not a disclosure. Nothing about a third org is exposed: the row\n * describes the attempt itself.\n \n Residual, stated rather than hidden: an unauthenticated caller can therefore cause rows to\n * appear in a NAMED org's viewer (log injection / noise) by choosing the email domain it probes.\n * Bounded to rows describing that caller's own attempt against that org, which is the org already\n * being attacked and the party with the strongest reason to see them. Volume abuse is bounded by\n * the authentication rate limiters, not by this field. If a future review wants that noise\n * separated, the fix is a provenance discriminator on the row (authenticated vs. domain-resolved\n * org), NOT dropping the field again — dropping it is what made the viewer's org filter return\n * nothing at all.\n \n assurance-control: WILDO.ACCESS.SCOPE_CONFINEMENT — tenant segregation of the audit trail is\n * enforced on the authenticated scope, while the subject org retains visibility of events\n * concerning it.\n /\n organizationId: z.string().isSummaryField().optional(),\n /\n The application the event is ABOUT when its owning tenant is application-scoped.\n * Like `organizationId`, this is forensic event data and never a per-org SIEM routing key.\n /\n applicationId: z.string().isSummaryField().optional(),\n /\n The request-correlation id (see `ExecutionContext.correlationId`) — groups every audit row produced\n * by ONE request / job / cron tick, and equals the `correlationId` stamped on that request's structured\n * log lines and errors, so an investigator can pivot audit ⇄ logs ⇄ error by a single id. Populated by\n * `_createAuditLog` from the request `ExecutionContext` when threaded, else from the ambient\n * request-context ALS frame — that fallback is what finally populates it on the COMMON emit path (most\n * emitters pass no EC). Indexed for correlation queries. Store-agnostic like `eventId`, but distinct:\n * `eventId` correlates ONE event across audit stores; `correlationId` correlates MANY events to one request.\n /\n correlationId: z.string().isDBIndexed().isSummaryField().optional(),\n /\n Which frontend SURFACE the request originated from (`x-frontend-service-name`: app / website / docs),\n * captured at the HTTP edge into the request-context frame and hoisted here by `_createAuditLog`. Origin\n * attribution — \"where did this action come from\". Absent for non-HTTP (job / cron / internal) events.\n /\n frontendServiceName: z.string().isSummaryField().optional(),\n /\n Which browser/device INSTALL the request came from (`x-client-instance-id`) — the axis that lets a\n * reviewer group one actor's activity ACROSS sessions and logins, which `correlationId` (one request)\n * and `frontendServiceName` (which surface) cannot. Captured at the HTTP edge into the request-context\n * frame and hoisted here by `_createAuditLog`, exactly like `frontendServiceName`.\n \n *Populated ONLY when the application authored a non-`DISABLED` `compliance.clientInstanceIdScope`\n (OPT-IN, default OFF — Fork D / SD9).** Absent for every unopted application, for non-HTTP events\n * (job / cron / internal), and whenever the client sent no id. It is a pseudonymous identifier under\n * GDPR Art 4(5), so it carries obligations the other correlation columns do not — see\n * `ClientInstanceIdScope` and `.claude/plans/traceability-correlation-id.md` (SD9).\n \n Deliberately DISTINCT from (never merged with, per SD8): `anonymousUserId` (an identity the app\n * assigns a pre-auth PERSON), `DeviceInfoSchema.fingerprint` (a derived/probabilistic device\n * signature), and `clientId` (the OAuth `azp` — which SOFTWARE client, already on the row).\n /\n // GDPR Art. 4(5) pseudonymised data by this field's own JSDoc above — so it is personal data, and\n // a notice must enumerate it. IDENTITY: it is an identifier assigned to a person's client, not an\n // observation of what they did.\n clientInstanceId: z.string().isDBIndexed().isSummaryField().optional()\n .dataCategories(PersonalDataCategory.IDENTITY),\n riskLevel: z.enum(ResourceOperationRiskLevel).isSummaryField(),\n // USAGE — an audit row is a record of what a principal DID. The event type and its data together\n // are the observation, so both carry the category; `riskLevel`, `eventCategory` and `severity` are\n // the framework's CLASSIFICATION of the event rather than data about the person, and carry none.\n //\n // ⚠️ The reverse of the `.isAuditEvidence()` rule, and deliberately so. That marker decides which\n // FIELD VALUES get copied INTO an audit row, and personal data must never be marked, because the\n // immutable ledger cannot be scrubbed. This declaration is about the audit row's OWN fields, which\n // hold personal data whether or not anyone wanted them to — and a notice must say so precisely\n // BECAUSE they are unerasable.\n eventType: z.string().isSummaryField().dataCategories(PersonalDataCategory.USAGE),\n eventData: AuditableEvent_DataSchema.dataCategories(PersonalDataCategory.USAGE),\n /* Populated by service layer via getAuditEventClassification(). Required for CREATE (audit logs are REPOSITORY_ONLY, no API). /\n eventCategory: z.enum(AuditEventCategory).isSummaryField(),\n /* Populated by service layer via getAuditEventClassification(). Required for CREATE (audit logs are REPOSITORY_ONLY, no API). */\n severity: z.enum(AuditEventSeverity).isSummaryField(),\n createdAt: z.date().default(() => new Date()).isSummaryField().excludeFromCreate().excludeFromUpdate(),\n updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate()\n});\n\n\n\n// Type-safe discriminated union for TypeScript validation (used in service layer)\nexport const AuditableEvent_TypedDataSchema = z.discriminatedUnion('eventType', [\n AuditableEvent_User_LoginEventDataSchema,\n AuditableEvent_User_LogoutEventDataSchema,\n AuditableEvent_User_LoginFailedEventDataSchema,\n AuditableEvent_User_AccountLockedEventDataSchema,\n AuditableEvent_MachineAuth_SuccessEventDataSchema,\n AuditableEvent_MachineAuth_FailedEventDataSchema,\n AuditableEvent_MachineAccess_EventDataSchema,\n AuditableEvent_User_SessionExpiredEventDataSchema,\n AuditableEvent_User_AppRolesChangedEventDataSchema,\n AuditableEvent_Application_SuperAdminFloorBreachedEventDataSchema,\n AuditableEvent_Organization_OwnerFloorBreachedEventDataSchema,\n AuditableEvent_OrganizationMember_InvitedEventDataSchema,\n AuditableEvent_OrganizationMember_JoinedEventDataSchema,\n AuditableEvent_OrganizationMember_UpdatedEventDataSchema,\n AuditableEvent_OrganizationMember_RoleChangedEventDataSchema,\n AuditableEvent_OrganizationMember_StatusChangedEventDataSchema,\n AuditableEvent_OrganizationMember_RemovedEventDataSchema,\n AuditableEvent_Organization_CreatedEventDataSchema,\n AuditableEvent_Organization_UpdatedEventDataSchema,\n AuditableEvent_Organization_DeletedEventDataSchema,\n AuditableEvent_Organization_DeletionRequestedEventDataSchema,\n AuditableEvent_Organization_RestoredEventDataSchema,\n AuditableEvent_Organization_SuspendedEventDataSchema,\n AuditableEvent_Resource_StatusTransitionPerformedEventDataSchema,\n AuditableEvent_Organization_ActivatedEventDataSchema,\n AuditableEvent_OrganizationNotifications_UpdatedEventDataSchema,\n AuditableEvent_OrganizationPreferences_UpdatedEventDataSchema,\n AuditableEvent_OrganizationProfile_UpdatedEventDataSchema,\n AuditableEvent_OrganizationUnit_UpdatedEventDataSchema,\n AuditableEvent_OrganizationUnitMember_RoleChangedEventDataSchema,\n AuditableEvent_OrganizationUnitMember_RemovedEventDataSchema,\n AuditableEvent_User_DeletedEventDataSchema,\n AuditableEvent_User_SSOLoginEventDataSchema,\n AuditableEvent_User_SSOLoginFailedEventDataSchema,\n AuditableEvent_User_SSOEnforcementBlockedEventDataSchema,\n AuditableEvent_User_TokenRefreshedEventDataSchema,\n AuditableEvent_Organization_SSOConfigurationChangedEventDataSchema,\n AuditableEvent_Organization_SIEMExportConfiguredEventDataSchema,\n AuditableEvent_ApplicationAuthPolicyChanged_EventDataSchema,\n AuditableEvent_Webhook_EndpointTestDispatchedEventDataSchema,\n AuditableEvent_SCIM_TokenCreatedEventDataSchema,\n AuditableEvent_SCIM_TokenRevokedEventDataSchema,\n AuditableEvent_SCIM_UserProvisionedEventDataSchema,\n AuditableEvent_SCIM_UserUpdatedEventDataSchema,\n AuditableEvent_SCIM_UserDeactivatedEventDataSchema,\n AuditableEvent_User_PasswordResetRequestedEventDataSchema,\n AuditableEvent_User_PasswordResetCompletedEventDataSchema,\n AuditableEvent_User_PasswordResetForcedEventDataSchema,\n AuditableEvent_User_RegisteredEventDataSchema,\n AuditableEvent_User_EmailVerifiedEventDataSchema,\n AuditableEvent_User_VerificationEmailResentEventDataSchema,\n AuditableEvent_User_MFASetupStartedEventDataSchema,\n AuditableEvent_User_MFASetupCompletedEventDataSchema,\n AuditableEvent_User_MFAEmailOTPSentEventDataSchema,\n AuditableEvent_User_PasskeyRegisteredEventDataSchema,\n AuditableEvent_User_PasskeyAuthSuccessEventDataSchema,\n AuditableEvent_User_PasskeyAuthFailureEventDataSchema,\n AuditableEvent_User_PasskeyRemovedEventDataSchema,\n AuditableEvent_User_MagicLinkSentEventDataSchema,\n AuditableEvent_User_MagicLinkVerifiedEventDataSchema,\n AuditableEvent_User_MagicLinkFailedEventDataSchema,\n AuditableEvent_User_SMSOTPSentEventDataSchema,\n AuditableEvent_User_SMSOTPVerifiedEventDataSchema,\n AuditableEvent_User_SMSOTPFailedEventDataSchema,\n AuditableEvent_User_PhoneVerifiedEventDataSchema,\n AuditableEvent_User_PhoneVerificationFailedEventDataSchema,\n AuditableEvent_OAuth2ProviderBlockedEventDataSchema,\n AuditableEvent_EmergencyAccess_UsedEventDataSchema,\n AuditableEvent_FieldAccess_EventDataSchema,\n AuditableEvent_ResourceOperationPerformed_EventDataSchema,\n AuditableEvent_ResourceOperationDenied_EventDataSchema,\n AuditableEvent_CrossTenantAdministrativeAccess_EventDataSchema,\n AuditableEvent_PlatformDirectoryAccess_EventDataSchema,\n AuditableEvent_PlatformAccessGrantLifecycle_EventDataSchema,\n AuditableEvent_RetainedDataAccess_EventDataSchema,\n AuditableEvent_SubjectDataExport_EventDataSchema,\n AuditableEvent_CollectionDataExport_EventDataSchema,\n AuditableEvent_HttpApiReadThroughAccess_EventDataSchema,\n AuditableEvent_HttpApiExternalErasure_EventDataSchema,\n AuditableEvent_HttpApiNonErasureAcknowledged_EventDataSchema,\n AuditableEvent_User_CrossFrontendHandoffIssuedEventDataSchema,\n AuditableEvent_OAuth_DelegatedTokenIssuedEventDataSchema,\n AuditableEvent_OAuth_ConsentGrantedEventDataSchema,\n AuditableEvent_OAuth_ConsentDeniedEventDataSchema,\n AuditableEvent_OAuth_ConsentGrantPersistedEventDataSchema,\n AuditableEvent_OAuth_TokenRefreshedEventDataSchema,\n AuditableEvent_OAuth_TokenRevokedEventDataSchema,\n AuditableEvent_OAuth_RpInitiatedLogoutEventDataSchema,\n AuditableEvent_OAuth_CodeExchangeFailedEventDataSchema,\n AuditableEvent_OAuth_ConsentBindingViolationEventDataSchema,\n AuditableEvent_User_RefreshTokenReuseDetectedEventDataSchema,\n]);\n\n\n\n\nexport type AuditableEvent = z.infer<typeof AuditableEvent_BaseSchema>;\nexport type AuditableEvent_User_LoginEventData = z.infer<typeof AuditableEvent_User_LoginEventDataSchema>;\nexport type AuditableEvent_User_LogoutEventData = z.infer<typeof AuditableEvent_User_LogoutEventDataSchema>;\nexport type AuditableEvent_User_LoginFailedEventData = z.infer<typeof AuditableEvent_User_LoginFailedEventDataSchema>;\nexport type AuditableEvent_MachineAuth_SuccessEventData = z.infer<typeof AuditableEvent_MachineAuth_SuccessEventDataSchema>;\nexport type AuditableEvent_MachineAuth_FailedEventData = z.infer<typeof AuditableEvent_MachineAuth_FailedEventDataSchema>;\nexport type AuditableEvent_MachineAccess_EventData = z.infer<typeof AuditableEvent_MachineAccess_EventDataSchema>;\nexport type AuditableEvent_User_AccountLockedEventData = z.infer<typeof AuditableEvent_User_AccountLockedEventDataSchema>;\nexport type AuditableEvent_User_SessionExpiredEventData = z.infer<typeof AuditableEvent_User_SessionExpiredEventDataSchema>;\nexport type AuditableEvent_User_AppRolesChangedEventData = z.infer<typeof AuditableEvent_User_AppRolesChangedEventDataSchema>;\nexport type AuditableEvent_Application_SuperAdminFloorBreachedEventData = z.infer<typeof AuditableEvent_Application_SuperAdminFloorBreachedEventDataSchema>;\nexport type AuditableEvent_Organization_OwnerFloorBreachedEventData = z.infer<typeof AuditableEvent_Organization_OwnerFloorBreachedEventDataSchema>;\nexport type AuditableEvent_User_DeletedEventData = z.infer<typeof AuditableEvent_User_DeletedEventDataSchema>;\nexport type AuditableEvent_OrganizationMember_InvitedEventData = z.infer<typeof AuditableEvent_OrganizationMember_InvitedEventDataSchema>;\nexport type AuditableEvent_OrganizationMember_JoinedEventData = z.infer<typeof AuditableEvent_OrganizationMember_JoinedEventDataSchema>;\nexport type AuditableEvent_OrganizationMember_UpdatedEventData = z.infer<typeof AuditableEvent_OrganizationMember_UpdatedEventDataSchema>;\nexport type AuditableEvent_OrganizationMember_RoleChangedEventData = z.infer<typeof AuditableEvent_OrganizationMember_RoleChangedEventDataSchema>;\nexport type AuditableEvent_OrganizationMember_StatusChangedEventData = z.infer<typeof AuditableEvent_OrganizationMember_StatusChangedEventDataSchema>;\nexport type AuditableEvent_OrganizationMember_RemovedEventData = z.infer<typeof AuditableEvent_OrganizationMember_RemovedEventDataSchema>;\nexport type AuditableEvent_Organization_CreatedEventData = z.infer<typeof AuditableEvent_Organization_CreatedEventDataSchema>;\nexport type AuditableEvent_Organization_UpdatedEventData = z.infer<typeof AuditableEvent_Organization_UpdatedEventDataSchema>;\nexport type AuditableEvent_Organization_DeletedEventData = z.infer<typeof AuditableEvent_Organization_DeletedEventDataSchema>;\nexport type AuditableEvent_Organization_DeletionRequestedEventData = z.infer<typeof AuditableEvent_Organization_DeletionRequestedEventDataSchema>;\nexport type AuditableEvent_Organization_RestoredEventData = z.infer<typeof AuditableEvent_Organization_RestoredEventDataSchema>;\nexport type AuditableEvent_Organization_SuspendedEventData = z.infer<typeof AuditableEvent_Organization_SuspendedEventDataSchema>;\nexport type AuditableEvent_Resource_StatusTransitionPerformedEventData = z.infer<typeof AuditableEvent_Resource_StatusTransitionPerformedEventDataSchema>;\nexport type AuditableEvent_Organization_ActivatedEventData = z.infer<typeof AuditableEvent_Organization_ActivatedEventDataSchema>;\nexport type AuditableEvent_OrganizationNotifications_UpdatedEventData = z.infer<typeof AuditableEvent_OrganizationNotifications_UpdatedEventDataSchema>;\nexport type AuditableEvent_OrganizationPreferences_UpdatedEventData = z.infer<typeof AuditableEvent_OrganizationPreferences_UpdatedEventDataSchema>;\nexport type AuditableEvent_OrganizationProfile_UpdatedEventData = z.infer<typeof AuditableEvent_OrganizationProfile_UpdatedEventDataSchema>;\nexport type AuditableEvent_OrganizationUnit_UpdatedEventData = z.infer<typeof AuditableEvent_OrganizationUnit_UpdatedEventDataSchema>;\nexport type AuditableEvent_OrganizationUnitMember_RoleChangedEventData = z.infer<typeof AuditableEvent_OrganizationUnitMember_RoleChangedEventDataSchema>;\nexport type AuditableEvent_OrganizationUnitMember_RemovedEventData = z.infer<typeof AuditableEvent_OrganizationUnitMember_RemovedEventDataSchema>;\nexport type AuditableEvent_User_SSOLoginEventData = z.infer<typeof AuditableEvent_User_SSOLoginEventDataSchema>;\nexport type AuditableEvent_User_SSOLoginFailedEventData = z.infer<typeof AuditableEvent_User_SSOLoginFailedEventDataSchema>;\nexport type AuditableEvent_User_SSOEnforcementBlockedEventData = z.infer<typeof AuditableEvent_User_SSOEnforcementBlockedEventDataSchema>;\nexport type AuditableEvent_User_TokenRefreshedEventData = z.infer<typeof AuditableEvent_User_TokenRefreshedEventDataSchema>;\nexport type AuditableEvent_Organization_SSOConfigurationChangedEventData = z.infer<typeof AuditableEvent_Organization_SSOConfigurationChangedEventDataSchema>;\nexport type AuditableEvent_Organization_SIEMExportConfiguredEventData = z.infer<typeof AuditableEvent_Organization_SIEMExportConfiguredEventDataSchema>;\nexport type ApplicationAuthPolicySnapshot = z.infer<typeof ApplicationAuthPolicySnapshotSchema>;\nexport type AuditableEvent_ApplicationAuthPolicyChanged_EventData = z.infer<typeof AuditableEvent_ApplicationAuthPolicyChanged_EventDataSchema>;\nexport type AuditableEvent_Webhook_EndpointTestDispatchedEventData = z.infer<typeof AuditableEvent_Webhook_EndpointTestDispatchedEventDataSchema>;\nexport type AuditableEvent_SCIM_TokenCreatedEventData = z.infer<typeof AuditableEvent_SCIM_TokenCreatedEventDataSchema>;\nexport type AuditableEvent_SCIM_TokenRevokedEventData = z.infer<typeof AuditableEvent_SCIM_TokenRevokedEventDataSchema>;\nexport type AuditableEvent_SCIM_UserProvisionedEventData = z.infer<typeof AuditableEvent_SCIM_UserProvisionedEventDataSchema>;\nexport type AuditableEvent_SCIM_UserUpdatedEventData = z.infer<typeof AuditableEvent_SCIM_UserUpdatedEventDataSchema>;\nexport type AuditableEvent_SCIM_UserDeactivatedEventData = z.infer<typeof AuditableEvent_SCIM_UserDeactivatedEventDataSchema>;\nexport type AuditableEvent_User_PasswordResetRequestedEventData = z.infer<typeof AuditableEvent_User_PasswordResetRequestedEventDataSchema>;\nexport type AuditableEvent_User_PasswordResetCompletedEventData = z.infer<typeof AuditableEvent_User_PasswordResetCompletedEventDataSchema>;\nexport type AuditableEvent_User_PasswordResetForcedEventData = z.infer<typeof AuditableEvent_User_PasswordResetForcedEventDataSchema>;\nexport type AuditableEvent_User_RegisteredEventData = z.infer<typeof AuditableEvent_User_RegisteredEventDataSchema>;\nexport type AuditableEvent_User_EmailVerifiedEventData = z.infer<typeof AuditableEvent_User_EmailVerifiedEventDataSchema>;\nexport type AuditableEvent_User_VerificationEmailResentEventData = z.infer<typeof AuditableEvent_User_VerificationEmailResentEventDataSchema>;\nexport type AuditableEvent_User_MFASetupStartedEventData = z.infer<typeof AuditableEvent_User_MFASetupStartedEventDataSchema>;\nexport type AuditableEvent_User_MFASetupCompletedEventData = z.infer<typeof AuditableEvent_User_MFASetupCompletedEventDataSchema>;\nexport type AuditableEvent_User_MFAEmailOTPSentEventData = z.infer<typeof AuditableEvent_User_MFAEmailOTPSentEventDataSchema>;\nexport type AuditableEvent_User_PasskeyRegisteredEventData = z.infer<typeof AuditableEvent_User_PasskeyRegisteredEventDataSchema>;\nexport type AuditableEvent_User_PasskeyAuthSuccessEventData = z.infer<typeof AuditableEvent_User_PasskeyAuthSuccessEventDataSchema>;\nexport type AuditableEvent_User_PasskeyAuthFailureEventData = z.infer<typeof AuditableEvent_User_PasskeyAuthFailureEventDataSchema>;\nexport type AuditableEvent_User_PasskeyRemovedEventData = z.infer<typeof AuditableEvent_User_PasskeyRemovedEventDataSchema>;\nexport type AuditableEvent_User_MagicLinkSentEventData = z.infer<typeof AuditableEvent_User_MagicLinkSentEventDataSchema>;\nexport type AuditableEvent_User_MagicLinkVerifiedEventData = z.infer<typeof AuditableEvent_User_MagicLinkVerifiedEventDataSchema>;\nexport type AuditableEvent_User_MagicLinkFailedEventData = z.infer<typeof AuditableEvent_User_MagicLinkFailedEventDataSchema>;\nexport type AuditableEvent_User_SMSOTPSentEventData = z.infer<typeof AuditableEvent_User_SMSOTPSentEventDataSchema>;\nexport type AuditableEvent_User_SMSOTPVerifiedEventData = z.infer<typeof AuditableEvent_User_SMSOTPVerifiedEventDataSchema>;\nexport type AuditableEvent_User_SMSOTPFailedEventData = z.infer<typeof AuditableEvent_User_SMSOTPFailedEventDataSchema>;\nexport type AuditableEvent_User_PhoneVerifiedEventData = z.infer<typeof AuditableEvent_User_PhoneVerifiedEventDataSchema>;\nexport type AuditableEvent_User_PhoneVerificationFailedEventData = z.infer<typeof AuditableEvent_User_PhoneVerificationFailedEventDataSchema>;\nexport type AuditableEvent_EmergencyAccess_UsedEventData = z.infer<typeof AuditableEvent_EmergencyAccess_UsedEventDataSchema>;\nexport type AuditableEvent_FieldAccess_EventData = z.infer<typeof AuditableEvent_FieldAccess_EventDataSchema>;\nexport type AuditableEvent_ResourceOperationPerformed_EventData = z.infer<typeof AuditableEvent_ResourceOperationPerformed_EventDataSchema>;\nexport type AuditableEvent_PlatformDirectoryAccess_EventData = z.infer<typeof AuditableEvent_PlatformDirectoryAccess_EventDataSchema>;\nexport type AuditableEvent_ResourceOperationDenied_EventData = z.infer<typeof AuditableEvent_ResourceOperationDenied_EventDataSchema>;\nexport type AuditableEvent_RetainedDataAccess_EventData = z.infer<typeof AuditableEvent_RetainedDataAccess_EventDataSchema>;\nexport type AuditableEvent_SubjectDataExport_EventData = z.infer<typeof AuditableEvent_SubjectDataExport_EventDataSchema>;\nexport type AuditableEvent_CollectionDataExport_EventData = z.infer<typeof AuditableEvent_CollectionDataExport_EventDataSchema>;\nexport type AuditableEvent_HttpApiReadThroughAccess_EventData = z.infer<typeof AuditableEvent_HttpApiReadThroughAccess_EventDataSchema>;\nexport type AuditableEvent_HttpApiExternalErasure_EventData = z.infer<typeof AuditableEvent_HttpApiExternalErasure_EventDataSchema>;\nexport type AuditableEvent_HttpApiNonErasureAcknowledged_EventData = z.infer<typeof AuditableEvent_HttpApiNonErasureAcknowledged_EventDataSchema>;\nexport type AuditableEvent_User_CrossFrontendHandoffIssuedEventData = z.infer<typeof AuditableEvent_User_CrossFrontendHandoffIssuedEventDataSchema>;\nexport type AuditableEvent_OAuth_DelegatedTokenIssuedEventData = z.infer<typeof AuditableEvent_OAuth_DelegatedTokenIssuedEventDataSchema>;\nexport type AuditableEvent_OAuth_ConsentGrantedEventData = z.infer<typeof AuditableEvent_OAuth_ConsentGrantedEventDataSchema>;\nexport type AuditableEvent_OAuth_ConsentDeniedEventData = z.infer<typeof AuditableEvent_OAuth_ConsentDeniedEventDataSchema>;\nexport type AuditableEvent_OAuth_ConsentGrantPersistedEventData = z.infer<typeof AuditableEvent_OAuth_ConsentGrantPersistedEventDataSchema>;\nexport type AuditableEvent_OAuth_DynamicClientRegisteredEventData = z.infer<typeof AuditableEvent_OAuth_DynamicClientRegisteredEventDataSchema>;\nexport type AuditableEvent_OAuth_CimdClientRefusedEventData = z.infer<typeof AuditableEvent_OAuth_CimdClientRefusedEventDataSchema>;\nexport type AuditableEvent_OAuth_TokenRefreshedEventData = z.infer<typeof AuditableEvent_OAuth_TokenRefreshedEventDataSchema>;\nexport type AuditableEvent_OAuth_TokenRevokedEventData = z.infer<typeof AuditableEvent_OAuth_TokenRevokedEventDataSchema>;\nexport type AuditableEvent_OAuth_RpInitiatedLogoutEventData = z.infer<typeof AuditableEvent_OAuth_RpInitiatedLogoutEventDataSchema>;\nexport type AuditableEvent_OAuth_CodeExchangeFailedEventData = z.infer<typeof AuditableEvent_OAuth_CodeExchangeFailedEventDataSchema>;\nexport type AuditableEvent_OAuth_ConsentBindingViolationEventData = z.infer<typeof AuditableEvent_OAuth_ConsentBindingViolationEventDataSchema>;\nexport type AuditableEvent_User_RefreshTokenReuseDetectedEventData = z.infer<typeof AuditableEvent_User_RefreshTokenReuseDetectedEventDataSchema>;\n"]}
1	+ {"version":3,"file":"auditable-events.shared.schema.js","sourceRoot":"","sources":["../../../../../src/compliance/audit-trails/auditable-events.shared.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,kDAAkD,CAAC;AACxF,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAAE,MAAM,0CAA0C,CAAC;AACpH,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC1F,OAAO,EACL,qCAAqC,EACrC,sCAAsC,EACtC,yBAAyB,GAC1B,MAAM,qEAAqE,CAAC;AAC7E,OAAO,EAAE,8BAA8B,EAAE,MAAM,gDAAgD,CAAC;AAChG,OAAO,EACL,aAAa,EACb,iBAAiB,GAClB,MAAM,8DAA8D,CAAC;AACtE,OAAO,EAAE,2BAA2B,EAAE,MAAM,uDAAuD,CAAC;AAGpG,MAAM,CAAN,IAAY,sBAugBX;AAvgBD,WAAY,sBAAsB;IAChC,wBAAwB;IACxB,mDAAyB,CAAA;IACzB,qDAA2B,CAAA;IAC3B,iEAAuC,CAAA;IACvC,qEAA2C,CAAA;IAC3C,yEAA+C,CAAA;IAC/C,6FAA6F;IAC7F,yFAAyF;IACzF,gGAAgG;IAChG,+FAA+F;IAC/F,+FAA+F;IAC/F,8FAA8F;IAC9F,+DAAqC,CAAA;IACrC,2FAA2F;IAC3F,iEAAuC,CAAA;IACvC,gGAAgG;IAChG,iGAAiG;IACjG,2FAA2F;IAC3F,iGAAiG;IACjG,mFAAmF;IACnF,iGAAiG;IACjG,kBAAkB;IAClB,uEAA6C,CAAA;IAE7C;;;;;;;;;;;;;;;OAeG;IACH,uEAA6C,CAAA;IAE7C,oGAAoG;IACpG,6FAA6F;IAC7F,2EAA2E;IAC3E,uEAA6C,CAAA;IAC7C,qEAA2C,CAAA;IAC3C,mGAAmG;IACnG,oGAAoG;IACpG,mGAAmG;IACnG,kGAAkG;IAClG,2DAAiC,CAAA;IAEjC,wBAAwB;IACxB,yEAAyE;IACzE,+FAA+F;IAC/F,iGAAiG;IACjG,uGAAuG;IACvG,8FAA8F;IAC9F,iGAAiG;IACjG,iGAAiG;IACjG,iEAAiE;IACjE,uDAA6B,CAAA;IAC7B,uGAAuG;IACvG,uDAA6B,CAAA;IAC7B,uDAA6B,CAAA;IAE7B,kEAAkE;IAClE,kGAAkG;IAClG,kGAAkG;IAClG,mGAAmG;IACnG,mGAAmG;IACnG,kDAAkD;IAClD,+FAA+F;IAC/F,2EAAiD,CAAA;IAEjD,iGAAiG;IACjG,8FAA8F;IAC9F,+FAA+F;IAC/F,2FAA2F;IAC3F,+FAA+F;IAC/F,uEAAuE;IACvE,mGAAmG;IACnG,wFAAwF;IACxF,2GAAiF,CAAA;IACjF;;;;;;;;;;OAUG;IACH,iGAAuE,CAAA;IAEvE,gCAAgC;IAChC,uGAAuG;IACvG,uEAA6C,CAAA;IAC7C,uGAAuG;IACvG,uEAA6C,CAAA;IAC7C,uEAA6C,CAAA;IAC7C,0GAA0G;IAC1G,6FAAmE,CAAA;IACnE,2EAA2E;IAC3E,yEAA+C,CAAA;IAC/C,oFAAoF;IACpF,2EAAiD,CAAA;IACjD,mEAAmE;IACnE,2EAAiD,CAAA;IACjD;;;;;;;;;;;;;;OAcG;IACH,uGAA6E,CAAA;IAE7E,6BAA6B;IAC7B,uGAAuG;IACvG,qFAA2D,CAAA;IAC3D,uGAAuG;IACvG,mFAAyD,CAAA;IACzD,uGAAuG;IACvG,qFAA2D,CAAA;IAC3D,+FAAqE,CAAA;IACrE,uGAAuG;IACvG,mGAAyE,CAAA;IACzE,qFAA2D,CAAA;IAE3D,uGAAuG;IACvG,mGAAyE,CAAA;IACzE,uGAAuG;IACvG,+FAAqE,CAAA;IACrE,uGAAuG;IACvG,uFAA6D,CAAA;IAC7D,uGAAuG;IACvG,iFAAuD,CAAA;IAEvD,oFAAoF;IACpF,kGAAkG;IAClG,2FAA2F;IAC3F,+FAA+F;IAC/F,mGAAmG;IACnG,2EAA2E;IAC3E,+FAA+F;IAC/F,yGAA+E,CAAA;IAE/E,iEAAiE;IACjE,+FAA+F;IAC/F,mGAAmG;IACnG,6FAA6F;IAC7F,8EAA8E;IAC9E,yFAAyF;IACzF,+FAAqE,CAAA;IAErE,4BAA4B;IAC5B,2DAAiC,CAAA;IACjC,yEAA+C,CAAA;IAC/C,uFAA6D,CAAA;IAC7D,uEAA6C,CAAA;IAE7C,0CAA0C;IAC1C,2GAAiF,CAAA;IACjF,qGAA2E,CAAA;IAE3E,4CAA4C;IAC5C,gGAAgG;IAChG,8FAA8F;IAC9F,kGAAkG;IAClG,kGAAkG;IAClG,kGAAkG;IAClG,kGAAkG;IAClG,gGAAgG;IAChG,qFAAqF;IACrF,iGAAiG;IACjG,8EAA8E;IAC9E,6FAAmE,CAAA;IAEnE,8BAA8B;IAC9B,qFAAqF;IACrF,uFAAuF;IACvF,yFAAyF;IACzF,uDAAuD;IACvD,uGAAuG;IACvG,0DAA0D;IAC1D,+FAAqE,CAAA;IAErE,qCAAqC;IACrC,uGAAuG;IACvG,mEAAyC,CAAA;IACzC,mEAAyC,CAAA;IACzC,uEAA6C,CAAA;IAC7C,mEAAyC,CAAA;IACzC,+FAAqE,CAAA;IACrE,+EAAqD,CAAA;IACrD,yEAA+C,CAAA;IAC/C,iEAAuC,CAAA;IACvC,yEAA+C,CAAA;IAE/C,6BAA6B;IAC7B,yFAA+D,CAAA;IAC/D,yFAA+D,CAAA;IAC/D;;;;;;;OAOG;IACH,mFAAyD,CAAA;IAEzD,0CAA0C;IAC1C,6DAAmC,CAAA;IACnC,qEAA2C,CAAA;IAC3C,2FAAiE,CAAA;IAEjE,kCAAkC;IAClC,iEAAuC,CAAA;IACvC,mEAAyC,CAAA;IACzC,mFAAyD,CAAA;IAEzD,4BAA4B;IAC5B,2EAAiD,CAAA;IACjD,+EAAqD,CAAA;IACrD,6EAAmD,CAAA;IAEnD,qCAAqC;IACrC,6EAAmD,CAAA;IACnD,qGAA2E,CAAA;IAC3E,qGAA2E,CAAA;IAC3E,uEAA6C,CAAA;IAE7C,+BAA+B;IAC/B,uEAA6C,CAAA;IAC7C,+EAAqD,CAAA;IACrD,2EAAiD,CAAA;IAEjD,4BAA4B;IAC5B,iEAAuC,CAAA;IACvC,yEAA+C,CAAA;IAC/C,qEAA2C,CAAA;IAE3C,uCAAuC;IACvC,qEAA2C,CAAA;IAC3C,2FAAiE,CAAA;IAEjE,sCAAsC;IACtC,uEAA6C,CAAA;IAC7C,mEAAyC,CAAA;IACzC,iEAAuC,CAAA;IACvC,2FAAiE,CAAA;IACjE,mEAAyC,CAAA;IACzC,mEAAyC,CAAA;IACzC,mEAAyC,CAAA;IACzC,uEAA6C,CAAA;IAC7C,mEAAyC,CAAA;IAEzC,gDAAgD;IAChD,6EAAmD,CAAA;IAEnD,iCAAiC;IACjC;;;;;;;OAOG;IACH,+EAAqD,CAAA;IACrD,mFAAyD,CAAA;IACzD,iFAAuD,CAAA;IACvD,yEAA+C,CAAA;IAC/C,6EAAmD,CAAA;IACnD,oGAAoG;IACpG,yEAA+C,CAAA;IAE/C,mEAAmE;IACnE,mGAAyE,CAAA;IAEzE,0BAA0B;IAC1B,yEAA+C,CAAA;IAE/C,sBAAsB;IACtB,uDAA6B,CAAA;IAE7B,4EAA4E;IAC5E,EAAE;IACF,iGAAiG;IACjG,gGAAgG;IAChG,kGAAkG;IAClG,0FAA0F;IAC1F,wDAAwD;IACxD,EAAE;IACF,8FAA8F;IAC9F,6FAA6F;IAC7F,4FAA4F;IAC5F,8FAA8F;IAC9F,mDAAmD;IACnD,EAAE;IACF,iGAAiG;IACjG,8FAA8F;IAC9F,8FAA8F;IAC9F,gCAAgC;IAChC,EAAE;IACF,wEAAwE;IACxE,uFAAuF;IACvF,uFAA6D,CAAA;IAE7D,kGAAkG;IAClG,EAAE;IACF,6FAA6F;IAC7F,kGAAkG;IAClG,iGAAiG;IACjG,4FAA4F;IAC5F,8EAA8E;IAC9E,EAAE;IACF,mCAAmC;IACnC,EAAE;IACF,qGAAqG;IACrG,mGAAmG;IACnG,kGAAkG;IAClG,EAAE;IACF,4CAA4C;IAC5C,EAAE;IACF,iGAAiG;IACjG,6FAA6F;IAC7F,+FAA+F;IAC/F,gGAAgG;IAChG,4FAA4F;IAC5F,gFAAgF;IAChF,EAAE;IACF,+FAA+F;IAC/F,sFAAsF;IACtF,8FAA8F;IAC9F,EAAE;IACF,8FAA8F;IAC9F,oFAAoF;IACpF,iFAAuD,CAAA;IACvD,mGAAyE,CAAA;IACzE,6FAAmE,CAAA;IACnE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,iFAAuD,CAAA;IAEvD,+CAA+C;IAC/C,0EAA0E;IAC1E,yEAAyE;IACzE,yEAAyE;IACzE,4DAA4D;IAC5D,gFAAgF;IAChF,wFAAwF;IACxF,mFAAmF;IACnF,wFAAwF;IACxF,uFAAuF;IACvF,oEAAoE;IACpE,qEAA2C,CAAA;IAC3C,2EAA2E;IAC3E,wEAAwE;IACxE,2EAA2E;IAC3E,6EAA6E;IAC7E,4EAA4E;IAC5E,+CAA+C;IAC/C,uEAA6C,CAAA;IAE7C,kDAAkD;IAClD,oGAAoG;IACpG,qGAAqG;IACrG,iHAAiH;IACjH,+FAA+F;IAC/F,uGAAuG;IACvG,uEAA6C,CAAA;IAE7C,gGAAgG;IAChG,wFAAwF;IACxF,4FAA4F;IAC5F,gGAAgG;IAChG,+FAA+F;IAC/F,2FAA2F;IAC3F,gGAAgG;IAChG,sDAAsD;IACtD,qEAA2C,CAAA;IAC3C,qFAAqF;IACrF,iGAAiG;IACjG,mGAAmG;IACnG,iGAAiG;IACjG,kGAAkG;IAClG,2EAA2E;IAC3E,2EAAiD,CAAA;IAEjD,qFAAqF;IACrF,2FAA2F;IAC3F,4FAA4F;IAC5F,yFAAyF;IACzF,4FAA4F;IAC5F,2FAA2F;IAC3F,yFAAyF;IACzF,qFAAqF;IACrF,4FAA4F;IAC5F,8FAA8F;IAC9F,8FAA8F;IAC9F,0FAA0F;IAC1F,8DAA8D;IAC9D,uFAA6D,CAAA;IAE7D,yFAAyF;IACzF,+FAA+F;IAC/F,8FAA8F;IAC9F,4FAA4F;IAC5F,mFAAmF;IACnF,4FAA4F;IAC5F,+FAA+F;IAC/F,yFAAyF;IACzF,4FAA4F;IAC5F,iFAAuD,CAAA;IAEvD,gGAAgG;IAChG,+FAA+F;IAC/F,2FAA2F;IAC3F,+FAA+F;IAC/F,+FAA+F;IAC/F,+FAA+F;IAC/F,+FAA+F;IAC/F,WAAW;IACX,iGAAuE,CAAA;IAEvE,0EAA0E;IAC1E,8EAA8E;IAC9E,mFAAmF;IACnF,4EAA4E;IAC5E,kFAAkF;IAClF,2FAA2F;IAE3F;mGAC+F;IAC/F,uFAA6D,CAAA;IAC7D,yGAAyG;IACzG,yEAA+C,CAAA;IAC/C,0FAA0F;IAC1F,uEAA6C,CAAA;IAC7C,wGAAwG;IACxG,yFAA+D,CAAA;IAC/D;;;;;OAKG;IACH,6FAAmE,CAAA;IACnE;;;;;;;;OAQG;IACH,iFAAuD,CAAA;IACvD,wFAAwF;IACxF,yEAA+C,CAAA;IAC/C,0DAA0D;IAC1D,qEAA2C,CAAA;IAC3C;;wFAEoF;IACpF,iFAAuD,CAAA;IACvD;kFAC8E;IAC9E,mFAAyD,CAAA;IACzD;4DACwD;IACxD,6FAAmE,CAAA;IAEnE;8GAC0G;IAC1G,iGAAuE,CAAA;AACzE,CAAC,EAvgBW,sBAAsB,KAAtB,sBAAsB,QAugBjC;AAED;;;;GAIG;AACH,MAAM,CAAN,IAAY,8BAiBX;AAjBD,WAAY,8BAA8B;IACxC,2FAA2F;IAC3F,mFAAiD,CAAA;IACjD,+FAA+F;IAC/F,mFAAiD,CAAA;IACjD,oDAAoD;IACpD,2DAAyB,CAAA;IACzB,gFAAgF;IAChF,qEAAmC,CAAA;IACnC,4EAA4E;IAC5E,iFAA+C,CAAA;IAC/C,mFAAmF;IACnF,uFAAqD,CAAA;IACrD,gGAAgG;IAChG,qEAAmC,CAAA;IACnC,uFAAuF;IACvF,qEAAmC,CAAA;AACrC,CAAC,EAjBW,8BAA8B,KAA9B,8BAA8B,QAiBzC;AAED,4FAA4F;AAC5F,MAAM,CAAN,IAAY,kBAMX;AAND,WAAY,kBAAkB;IAC5B,uDAAiC,CAAA;IACjC,qDAA+B,CAAA;IAC/B,uDAAiC,CAAA;IACjC,uDAAiC,CAAA;IACjC,iDAA2B,CAAA;AAC7B,CAAC,EANW,kBAAkB,KAAlB,kBAAkB,QAM7B;AAED,2FAA2F;AAC3F,MAAM,CAAN,IAAY,kBAIX;AAJD,WAAY,kBAAkB;IAC5B,mCAAa,CAAA;IACb,yCAAmB,CAAA;IACnB,2CAAqB,CAAA;AACvB,CAAC,EAJW,kBAAkB,KAAlB,kBAAkB,QAI7B;AAED;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,6BAwDX;AAxDD,WAAY,6BAA6B;IACvC;;;;;;;;;;;;OAYG;IACH,wEAAuC,CAAA;IAEvC;;;OAGG;IACH,0EAAyC,CAAA;IAEzC;;;;OAIG;IACH,kEAAiC,CAAA;IAEjC;;;OAGG;IACH,kFAAiD,CAAA;IAEjD;;;OAGG;IACH,4EAA2C,CAAA;IAE3C;;;;;;;;;;;;;OAaG;IACH,kFAAiD,CAAA;AACnD,CAAC,EAxDW,6BAA6B,KAA7B,6BAA6B,QAwDxC;AAED,qCAAqC;AACrC,MAAM,CAAN,IAAY,mBAOX;AAPD,WAAY,mBAAmB;IAC7B,0CAAmB,CAAA;IACnB,0CAAmB,CAAA;IACnB,0CAAmB,CAAA;IACnB,wDAAiC,CAAA;IACjC,4DAAqC,CAAA;IACrC,kEAA2C,CAAA;AAC7C,CAAC,EAPW,mBAAmB,KAAnB,mBAAmB,QAO9B;AAED,6CAA6C;AAC7C,MAAM,CAAN,IAAY,oBAIX;AAJD,WAAY,oBAAoB;IAC9B,2CAAmB,CAAA;IACnB,6CAAqB,CAAA;IACrB,2CAAmB,CAAA;AACrB,CAAC,EAJW,oBAAoB,KAApB,oBAAoB,QAI/B;AAED;;;;;GAKG;AACH,MAAM,CAAN,IAAY,sBA0CX;AA1CD,WAAY,sBAAsB;IAChC,+DAAqC,CAAA;IACrC,mEAAyC,CAAA;IACzC,0FAA0F;IAC1F,yDAA+B,CAAA;IAC/B,sFAAsF;IACtF,+DAAqC,CAAA;IACrC;;;;;;;OAOG;IACH,yEAA+C,CAAA;IAC/C;;;;;;;;OAQG;IACH,+FAAqE,CAAA;IACrE,kGAAkG;IAClG,+FAAqE,CAAA;IACrE,kEAAkE;IAClE,iGAAuE,CAAA;IACvE,sGAAsG;IACtG,qGAA2E,CAAA;IAC3E;;;;;;OAMG;IACH,2DAAiC,CAAA;IACjC,2DAAiC,CAAA;IACjC,2DAAiC,CAAA;AACnC,CAAC,EA1CW,sBAAsB,KAAtB,sBAAsB,QA0CjC;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC;IAC9C,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC;IAC9B,CAAC,CAAC,MAAM,EAAE;CACX,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/D,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,UAAU,CAAC;IACvD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,MAAM,CAAC;IAChE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,WAAW,CAAC;IACxD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,8CAA8C,GAAG,CAAC,CAAC,MAAM,CAAC;IACrE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,iBAAiB,CAAC;IAC9D,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;IAChB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAN,IAAY,oBAKX;AALD,WAAY,oBAAoB;IAC9B,6FAA6F;IAC7F,uEAA+C,CAAA;IAC/C,kGAAkG;IAClG,2EAAmD,CAAA;AACrD,CAAC,EALW,oBAAoB,KAApB,oBAAoB,QAK/B;AAED,MAAM,CAAC,MAAM,gDAAgD,GAAG,CAAC,CAAC,MAAM,CAAC;IACvE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,mBAAmB,CAAC;IAChE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;IAChB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,UAAU;IACvC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB;;;;OAIG;IACH,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;CAChD,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iDAAiD,GAAG,CAAC,CAAC,MAAM,CAAC;IACxE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,oBAAoB,CAAC;IACjE,2DAA2D;IAC3D,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,oFAAoF;IACpF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,uFAAuF;IACvF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,mEAAmE;IACnE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gDAAgD,GAAG,CAAC,CAAC,MAAM,CAAC;IACvE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,mBAAmB,CAAC;IAChE,+EAA+E;IAC/E,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,kHAAkH;IAClH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,6GAA6G;IAC7G,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,4CAA4C,GAAG,CAAC,CAAC,MAAM,CAAC;IACnE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,cAAc,CAAC;IAC3D,2DAA2D;IAC3D,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,2FAA2F;IAC3F,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,uFAAuF;IACvF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB;;;;OAIG;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B;;;OAGG;IACH,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrC,iEAAiE;IACjE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,gGAAgG;IAChG,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,2FAA2F;IAC3F,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC/B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iDAAiD,GAAG,CAAC,CAAC,MAAM,CAAC;IACxE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,oBAAoB,CAAC;IACjE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,UAAU;IACvC,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE;CACvB,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,iDAAiD,GAAG,CAAC,CAAC,MAAM,CAAC;IACxE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,oBAAoB,CAAC;IACjE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,8EAA8E;IAC9E,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,uGAAuG;IACvG,eAAe,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACpC,iFAAiF;IACjF,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC9C,kGAAkG;IAClG,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CAC9C,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,MAAM,CAAC;IACjE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,YAAY,CAAC;IACzD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,0FAA0F;IAC1F,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,kDAAkD,GAAG,CAAC,CAAC,MAAM,CAAC;IACzE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,sBAAsB,CAAC;IACnE,qEAAqE;IACrE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAClC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC7B,gGAAgG;IAChG,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACnC,qGAAqG;IACrG,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,iEAAiE,GAAG,CAAC,CAAC,MAAM,CAAC;IACxF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,sCAAsC,CAAC;IACnF,mGAAmG;IACnG,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE;IACjC,sCAAsC;IACtC,6BAA6B,EAAE,CAAC,CAAC,MAAM,EAAE;IACzC,uGAAuG;IACvG,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACpC,iEAAiE;IACjE,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CACpC,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,6DAA6D,GAAG,CAAC,CAAC,MAAM,CAAC;IACpF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,iCAAiC,CAAC;IAC9E,6DAA6D;IAC7D,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,gFAAgF;IAChF,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACrC,gEAAgE;IAChE,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE;IACjC,+EAA+E;IAC/E,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC/B,mDAAmD;IACnD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,iGAAiG;IACjG,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE;CAC9B,CAAC,CAAC;AAEH,yCAAyC;AACzC,MAAM,CAAC,MAAM,wDAAwD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,2BAA2B,CAAC;IACxE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC1B,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,uDAAuD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,0BAA0B,CAAC;IACvE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC1B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,wDAAwD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,2BAA2B,CAAC;IACxE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;CACvC,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,MAAM,4DAA4D,GAAG,CAAC,CAAC,MAAM,CAAC;IACnF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,gCAAgC,CAAC;IAC7E,wCAAwC;IACxC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,2CAA2C;IAC3C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,qEAAqE;IACrE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAClC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC7B,0HAA0H;IAC1H,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC9C,+FAA+F;IAC/F,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,gEAAgE,GAAG,CAAC,CAAC,MAAM,CAAC;IACvF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,qCAAqC,CAAC;IAClF,wCAAwC;IACxC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,8GAA8G;IAC9G,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,2CAA2C;IAC3C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,qFAAqF;IACrF,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3C,2EAA2E;IAC3E,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,qFAAqF;IACrF,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,4FAA4F;IAC5F,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,MAAM,4DAA4D,GAAG,CAAC,CAAC,MAAM,CAAC;IACnF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,gCAAgC,CAAC;IAC7E,yCAAyC;IACzC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,iDAAiD;IACjD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,2CAA2C;IAC3C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,oFAAoF;IACpF,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3C,4GAA4G;IAC5G,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,8DAA8D,GAAG,CAAC,CAAC,MAAM,CAAC;IACrF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,kCAAkC,CAAC;IAC/E,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,CAAC,MAAM,wDAAwD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,2BAA2B,CAAC;IACxE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,2CAA2C;IAC3C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,qDAAqD;IACrD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB;;;OAGG;IACH,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrC;;;;;;;OAOG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,qGAAqG;IACrG,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB;;;;;;;;;;;;OAYG;IACH,sBAAsB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QACvC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE;QAC9B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;KACjB,CAAC,CAAC,CAAC,QAAQ,EAAE;IACd;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB;;;;OAIG;IACH,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAEH,4CAA4C;AAC5C,MAAM,CAAC,MAAM,kDAAkD,GAAG,CAAC,CAAC,MAAM,CAAC;IACzE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,oBAAoB,CAAC;IACjE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kDAAkD,GAAG,CAAC,CAAC,MAAM,CAAC;IACzE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,oBAAoB,CAAC;IACjE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kDAAkD,GAAG,CAAC,CAAC,MAAM,CAAC;IACzE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,oBAAoB,CAAC;IACjE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,4DAA4D,GAAG,CAAC,CAAC,MAAM,CAAC;IACnF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,+BAA+B,CAAC;IAC5E,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,0FAA0F;IAC1F,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,2FAA2F;IAC3F,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,yFAAyF;IACzF,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAEH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,mDAAmD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,qBAAqB,CAAC;IAClE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,gGAAgG;IAChG,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,6CAA6C;IAC7C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,0FAA0F;IAC1F,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,oDAAoD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,sBAAsB,CAAC;IACnE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,yFAAyF;IACzF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,mGAAmG;IACnG,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,iGAAiG;IACjG,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE;IAC5B;;;;;;;OAOG;IACH,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC9C,CAAC,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,oDAAoD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,sBAAsB,CAAC;IACnE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,yDAAyD;IACzD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,qFAAqF;IACrF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,6FAA6F;IAC7F,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAEH;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;AAErF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,2DAA2D,GAAG,CAAC,CAAC,MAAM,CAAC;IAClF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,+BAA+B,CAAC;IAC5E,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,oGAAoG;IACpG,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACrC;;;;OAIG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B;;;OAGG;IACH,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,mCAAmC,CAAC,CAAC,QAAQ,EAAE;IAC5E,uGAAuG;IACvG,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,mCAAmC,CAAC;CACjE,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,gEAAgE,GAAG,CAAC,CAAC,MAAM,CAAC;IACvF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,oCAAoC,CAAC;IACjF,kFAAkF;IAClF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,gFAAgF;IAChF,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC/B,oCAAoC;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,8FAA8F;IAC9F,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,sFAAsF;IACtF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,kCAAkC;IAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,yEAAyE;IACzE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B;;;;;OAKG;IACH,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9C,4FAA4F;IAC5F,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,+DAA+D,GAAG,CAAC,CAAC,MAAM,CAAC;IACtF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,kCAAkC,CAAC;IAC/E,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,6DAA6D,GAAG,CAAC,CAAC,MAAM,CAAC;IACpF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,gCAAgC,CAAC;IAC7E,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,yDAAyD,GAAG,CAAC,CAAC,MAAM,CAAC;IAChF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,4BAA4B,CAAC;IACzE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sDAAsD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,yBAAyB,CAAC;IACtE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH,wCAAwC;AAExC,MAAM,CAAC,MAAM,2CAA2C,GAAG,CAAC,CAAC,MAAM,CAAC;IAClE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,cAAc,CAAC;IAC3D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;IAChB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC;IACzC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;IAC3C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC5B,IAAI,KAAK,CAAC,cAAc,KAAK,iBAAiB,CAAC,MAAM,EAAE,CAAC;QACtD,IACE,KAAK,CAAC,SAAS,KAAK,SAAS;eAC1B,KAAK,CAAC,cAAc,KAAK,SAAS;eAClC,KAAK,CAAC,aAAa,KAAK,SAAS,EACpC,CAAC;YACD,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,WAAW,CAAC;gBACnB,OAAO,EAAE,yDAAyD;aACnE,CAAC,CAAC;QACL,CAAC;QACD,OAAO;IACT,CAAC;IAED,MAAM,oBAAoB,GACxB,KAAK,CAAC,SAAS,KAAK,aAAa,CAAC,YAAY;WAC3C,KAAK,CAAC,cAAc,KAAK,SAAS;WAClC,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC;IACvC,MAAM,mBAAmB,GACvB,KAAK,CAAC,SAAS,KAAK,aAAa,CAAC,WAAW;WAC1C,KAAK,CAAC,aAAa,KAAK,SAAS;WACjC,KAAK,CAAC,cAAc,KAAK,SAAS,CAAC;IACxC,IAAI,CAAC,oBAAoB,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAClD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,WAAW,CAAC;YACnB,OAAO,EAAE,uEAAuE;SACjF,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iDAAiD,GAAG,CAAC,CAAC,MAAM,CAAC;IACxE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,qBAAqB,CAAC;IAClE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;IAC3B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,QAAQ,EAAE;IACpD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;IAC3C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,wDAAwD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,4BAA4B,CAAC;IACzE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;IAChB,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE;IAChC,uBAAuB,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC;IAClD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iDAAiD,GAAG,CAAC,CAAC,MAAM,CAAC;IACxE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,oBAAoB,CAAC;IACjE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH,sDAAsD;AAEtD,MAAM,CAAC,MAAM,kEAAkE,GAAG,CAAC,CAAC,MAAM,CAAC;IACzF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,sCAAsC,CAAC;IACnF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC;IACvC,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1C,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;CAClD,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,+DAA+D,GAAG,CAAC,CAAC,MAAM,CAAC;IACtF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,mCAAmC,CAAC;IAChF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC;IACxC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7C,CAAC,CAAC;AAIH,0CAA0C;AAE1C;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,4DAA4D,GAAG,CAAC,CAAC,MAAM,CAAC;IACnF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,gCAAgC,CAAC;IAC7E,6FAA6F;IAC7F,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,iCAAiC;IACjC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,mFAAmF;IACnF,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC;IAC5C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC3C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC1C,+EAA+E;IAC/E,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;CACzB,CAAC,CAAC;AAIH,iDAAiD;AAEjD,MAAM,CAAC,MAAM,+CAA+C,GAAG,CAAC,CAAC,MAAM,CAAC;IACtE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,kBAAkB,CAAC;IAC/D,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,+CAA+C,GAAG,CAAC,CAAC,MAAM,CAAC;IACtE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,kBAAkB,CAAC;IAC/D,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,oDAAoD;AAEpD,MAAM,CAAC,MAAM,kDAAkD,GAAG,CAAC,CAAC,MAAM,CAAC;IACzE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,qBAAqB,CAAC;IAClE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IACtB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,8CAA8C,GAAG,CAAC,CAAC,MAAM,CAAC;IACrE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,iBAAiB,CAAC;IAC9D,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAClD,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,kDAAkD,GAAG,CAAC,CAAC,MAAM,CAAC;IACzE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,qBAAqB,CAAC;IAClE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAIH,yCAAyC;AAEzC,MAAM,CAAC,MAAM,yDAAyD,GAAG,CAAC,CAAC,MAAM,CAAC;IAChF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,6BAA6B,CAAC;IAC1E,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,sDAAsD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,0BAA0B,CAAC;IACvE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,8EAA8E;IAC9E,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE;IAC5B;;;;;;;;OAQG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,yDAAyD,GAAG,CAAC,CAAC,MAAM,CAAC;IAChF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,6BAA6B,CAAC;IAC1E,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,sDAAsD;AAEtD,MAAM,CAAC,MAAM,6CAA6C,GAAG,CAAC,CAAC,MAAM,CAAC;IACpE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,eAAe,CAAC;IAC5D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,gDAAgD,GAAG,CAAC,CAAC,MAAM,CAAC;IACvE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,mBAAmB,CAAC;IAChE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,0DAA0D,GAAG,CAAC,CAAC,MAAM,CAAC;IACjF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,8BAA8B,CAAC;IAC3E,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,wCAAwC;AAExC,MAAM,CAAC,MAAM,kDAAkD,GAAG,CAAC,CAAC,MAAM,CAAC;IACzE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,sBAAsB,CAAC;IACnE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,oDAAoD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,wBAAwB,CAAC;IACrE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,kDAAkD,GAAG,CAAC,CAAC,MAAM,CAAC;IACzE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,uBAAuB,CAAC;IACpE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,iDAAiD;AAEjD,MAAM,CAAC,MAAM,oDAAoD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,uBAAuB,CAAC;IACpE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,qDAAqD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,mCAAmC,CAAC;IAChF,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,qDAAqD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,mCAAmC,CAAC;IAChF,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,iDAAiD,GAAG,CAAC,CAAC,MAAM,CAAC;IACxE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,oBAAoB,CAAC;IACjE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,2CAA2C;AAE3C,MAAM,CAAC,MAAM,gDAAgD,GAAG,CAAC,CAAC,MAAM,CAAC;IACvE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,oBAAoB,CAAC;IACjE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,oDAAoD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,wBAAwB,CAAC;IACrE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,kDAAkD,GAAG,CAAC,CAAC,MAAM,CAAC;IACzE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,sBAAsB,CAAC;IACnE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,wCAAwC;AAExC,MAAM,CAAC,MAAM,6CAA6C,GAAG,CAAC,CAAC,MAAM,CAAC;IACpE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,iBAAiB,CAAC;IAC9D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,iDAAiD,GAAG,CAAC,CAAC,MAAM,CAAC;IACxE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,qBAAqB,CAAC;IAClE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,+CAA+C,GAAG,CAAC,CAAC,MAAM,CAAC;IACtE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,mBAAmB,CAAC;IAChE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,mDAAmD;AAEnD,MAAM,CAAC,MAAM,gDAAgD,GAAG,CAAC,CAAC,MAAM,CAAC;IACvE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,mBAAmB,CAAC;IAChE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,0DAA0D,GAAG,CAAC,CAAC,MAAM,CAAC;IACjF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,8BAA8B,CAAC;IAC3E,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,2DAA2D;AAE3D,MAAM,CAAC,MAAM,mDAAmD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,uBAAuB,CAAC;IACpE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC;IAChC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC5B,MAAM,oBAAoB,GACxB,KAAK,CAAC,SAAS,KAAK,aAAa,CAAC,YAAY;WAC3C,KAAK,CAAC,cAAc,KAAK,SAAS;WAClC,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC;IACvC,MAAM,mBAAmB,GACvB,KAAK,CAAC,SAAS,KAAK,aAAa,CAAC,WAAW;WAC1C,KAAK,CAAC,aAAa,KAAK,SAAS;WACjC,KAAK,CAAC,cAAc,KAAK,SAAS,CAAC;IACxC,IAAI,CAAC,oBAAoB,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAClD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,WAAW,CAAC;YACnB,OAAO,EAAE,0EAA0E;SACpF,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAIH,qCAAqC;AAErC,MAAM,CAAC,MAAM,kDAAkD,GAAG,CAAC,CAAC,MAAM,CAAC;IACzE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,qBAAqB,CAAC;IAClE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;IAChB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,MAAM,CAAC;IACjE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,YAAY,CAAC;IACzD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC/B,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE;IAC9B,2FAA2F;IAC3F,+FAA+F;IAC/F,4FAA4F;IAC5F,kGAAkG;IAClG,2BAA2B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClD,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,MAAM,CAAC,MAAM,yDAAyD,GAAG,CAAC,CAAC,MAAM,CAAC;IAChF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,4BAA4B,CAAC;IAEzE,4FAA4F;IAC5F,wDAAwD;IACxD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,2FAA2F;IAC3F,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC/B,wFAAwF;IACxF,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC;IACjD;;;OAGG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,sGAAsG;IACtG,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,QAAQ,EAAE;IAC/D,4EAA4E;IAC5E,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEvC,gBAAgB;IAChB,gFAAgF;IAChF,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,8DAA8D;IAC9D,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE1C,+FAA+F;IAC/F;;;;OAIG;IACH,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACnC,uFAAuF;IACvF,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC;IACrD,yFAAyF;IACzF,2BAA2B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClD,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE1C,yGAAyG;IACzG,kFAAkF;IAClF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IAExB,eAAe;IACf,gFAAgF;IAChF,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC7C;;;;OAIG;IACH,aAAa,EAAE,CAAC;SACb,MAAM,CACL,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,MAAM,CAAC;QACP,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAC9B,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KAC9B,CAAC,CACH;SACA,QAAQ,EAAE;CACd,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,2DAA2D,GAAG,CAAC,CAAC,MAAM,CAAC;IAClF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,+BAA+B,CAAC;IAE5E,yCAAyC;IACzC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,sCAAsC,CAAC;IAC1D,yEAAyE;IACzE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,6DAA6D;IAC7D,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE;IAChC,+EAA+E;IAC/E,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,oGAAoG;IACpG,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,wDAAwD;IACxD,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC;IAClD,oFAAoF;IACpF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC9B,wFAAwF;IACxF,kBAAkB,EAAE,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC,QAAQ,EAAE;IAC5E,4FAA4F;IAC5F,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,+CAA+C;IAC/C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,8DAA8D,GAAG,CAAC,CAAC,MAAM,CAAC;IACrF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,kCAAkC,CAAC;IAE/E,yFAAyF;IACzF,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE;IAChC,oDAAoD;IACpD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,kGAAkG;IAClG,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC/B,uDAAuD;IACvD,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC;IACjD,oGAAoG;IACpG,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,8EAA8E;IAC9E,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAEjD;;;;;;;;;;OAUG;IACH,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEzC;;;;;OAKG;IACH,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE;IAC9B,wDAAwD;IACxD,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACnC,wFAAwF;IACxF,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC;CACtD,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sDAAsD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,yBAAyB,CAAC;IAEtE,wEAAwE;IACxE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,uDAAuD;IACvD,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC/B,mDAAmD;IACnD,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC;IACjD;;;;;;;OAOG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC;;;;;OAKG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC7C,oDAAoD;IACpD,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACnC,wFAAwF;IACxF,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC;CACtD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sDAAsD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,yBAAyB,CAAC;IAEtE,0EAA0E;IAC1E,6CAA6C;IAC7C,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC;IAEnD,yFAAyF;IACzF,gEAAgE;IAChE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,2FAA2F;IAC3F,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC/B,sDAAsD;IACtD,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC;IACjD;;;OAGG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,sGAAsG;IACtG,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,QAAQ,EAAE;IAC/D,4EAA4E;IAC5E,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEvC,kEAAkE;IAClE;;;;OAIG;IACH,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAEpD,wDAAwD;IACxD;;;;OAIG;IACH,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC7C;;;OAGG;IACH,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACnC,uFAAuF;IACvF,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC;IACrD,iGAAiG;IACjG,2BAA2B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClD,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE1C,yGAAyG;IACzG,kFAAkF;IAClF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IAExB,uEAAuE;IACvE;;;;OAIG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B;;;;OAIG;IACH,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE;CACpC,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,iDAAiD,GAAG,CAAC,CAAC,MAAM,CAAC;IACxE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,oBAAoB,CAAC;IACjE,4GAA4G;IAC5G,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,6GAA6G;IAC7G,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,2DAA2D;IAC3D,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,qFAAqF;IACrF,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,gFAAgF;IAChF,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1C,iGAAiG;IACjG,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC/B,wGAAwG;IACxG,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrC,wFAAwF;IACxF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,gDAAgD,GAAG,CAAC,CAAC,MAAM,CAAC;IACvE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,mBAAmB,CAAC;IAChE,yFAAyF;IACzF,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,4CAA4C;IAC5C,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,wFAAwF;IACxF,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,mEAAmE;IACnE,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC1C,oDAAoD;IACpD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B;;;OAGG;IACH,uBAAuB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC5C;;;;OAIG;IACH,8BAA8B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACnD,oDAAoD;IACpD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,MAAM,mDAAmD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,sBAAsB,CAAC;IACnE,6BAA6B;IAC7B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,+DAA+D;IAC/D,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnD,iDAAiD;IACjD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,mGAAmG;IACnG,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,mGAAmG;IACnG,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACxC,yEAAyE;IACzE,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACrC,oDAAoD;IACpD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,uDAAuD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,4BAA4B,CAAC;IACzE,yDAAyD;IACzD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,6EAA6E;IAC7E,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,oFAAoF;IACpF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,iFAAiF;IACjF,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,6EAA6E;IAC7E,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,sFAAsF;IACtF,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,qEAAqE;IACrE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,kDAAkD;IAClD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,gEAAgE;IAChE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,4FAA4F;IAC5F,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;CACpD,CAAC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,qDAAqD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,yBAAyB,CAAC;IACtE,yDAAyD;IACzD,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,yEAAyE;IACzE,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACpD,8EAA8E;IAC9E,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,sEAAsE;IACtE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,iFAAiF;IACjF,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,6EAA6E;IAC7E,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,uFAAuF;IACvF,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC/C,0DAA0D;IAC1D,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,4DAA4D,GAAG,CAAC,CAAC,MAAM,CAAC;IACnF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,iCAAiC,CAAC;IAC9E,yDAAyD;IACzD,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,uEAAuE;IACvE,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACpD,qEAAqE;IACrE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,sEAAsE;IACtE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,iFAAiF;IACjF,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,6EAA6E;IAC7E,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC;;;;OAIG;IACH,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IAC5D,0DAA0D;IAC1D,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,6DAA6D,GAAG,CAAC,CAAC,MAAM,CAAC;IACpF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,kCAAkC,CAAC;IAC/E,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,uFAAuF;IACvF,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChD,qFAAqF;IACrF,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,mEAAmE;IACnE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,mFAAmF;IACnF,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,sFAAsF;AAEtF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,wDAAwD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,4BAA4B,CAAC;IACzE,4DAA4D;IAC5D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,+DAA+D;IAC/D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,qEAAqE;IACrE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,4GAA4G;IAC5G,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3B,qFAAqF;IACrF,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH,yGAAyG;AACzG,MAAM,CAAC,MAAM,kDAAkD,GAAG,CAAC,CAAC,MAAM,CAAC;IACzE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,qBAAqB,CAAC;IAClE,6BAA6B;IAC7B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,6CAA6C;IAC7C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,+BAA+B;IAC/B,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3B,oEAAoE;IACpE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,sGAAsG;IACtG,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;IACvB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH,qEAAqE;AACrE,MAAM,CAAC,MAAM,iDAAiD,GAAG,CAAC,CAAC,MAAM,CAAC;IACxE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,oBAAoB,CAAC;IACjE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,yDAAyD,GAAG,CAAC,CAAC,MAAM,CAAC;IAChF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,6BAA6B,CAAC;IAC1E,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,6FAA6F;IAC7F,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,gEAAgE;IAChE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3B,qGAAqG;IACrG,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;CACxB,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,qDAAqD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,yBAAyB,CAAC;IACtE,qGAAqG;IACrG,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,iFAAiF;IACjF,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,2DAA2D,GAAG,CAAC,CAAC,MAAM,CAAC;IAClF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,+BAA+B,CAAC;IAC5E,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,iGAAiG;IACjG,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,6FAA6F;IAC7F,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACjC;;;;OAIG;IACH,sBAAsB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,kDAAkD,GAAG,CAAC,CAAC,MAAM,CAAC;IACzE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,qBAAqB,CAAC;IAClE,8FAA8F;IAC9F,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,2GAA2G;IAC3G,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,0GAA0G;IAC1G,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,gDAAgD,GAAG,CAAC,CAAC,MAAM,CAAC;IACvE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,mBAAmB,CAAC;IAChE,0EAA0E;IAC1E,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,kEAAkE;IAClE,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE;IAChC,wEAAwE;IACxE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qDAAqD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,yBAAyB,CAAC;IACtE,4GAA4G;IAC5G,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,kGAAkG;IAClG,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,2FAA2F;IAC3F,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,+FAA+F;IAC/F,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE;IAC9B;;+BAE2B;IAC3B,6BAA6B,EAAE,CAAC,CAAC,OAAO,EAAE;IAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sDAAsD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,0BAA0B,CAAC;IACvE,sDAAsD;IACtD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC;IAC9C,2DAA2D;IAC3D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,iEAAiE;IACjE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,wEAAwE;IACxE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,2DAA2D,GAAG,CAAC,CAAC,MAAM,CAAC;IAClF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,+BAA+B,CAAC;IAC5E,qEAAqE;IACrE,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC/B,uEAAuE;IACvE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,0DAA0D;IAC1D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,qEAAqE;IACrE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,4DAA4D,GAAG,CAAC,CAAC,MAAM,CAAC;IACnF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,iCAAiC,CAAC;IAC9E,4DAA4D;IAC5D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,2FAA2F;IAC3F,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,2EAA2E;IAC3E,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,kGAAkG;IAClG,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE;IAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH,8DAA8D;AAC9D,0EAA0E;AAC1E,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;AAKvE,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAC/C;;;;;;;;;OASG;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE;IACjC,oGAAoG;IACpG,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE;IAC9C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAqCG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE;IACtD;;;OAGG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE;IACrD;;;;;;;;OAQG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE;IACnE;;;;OAIG;IACH,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE;IAC3D;;;;;;;;;;;;;;;OAeG;IACH,kGAAkG;IAClG,kGAAkG;IAClG,gCAAgC;IAChC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE;SACnE,cAAc,CAAC,oBAAoB,CAAC,QAAQ,CAAC;IAChD,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC,cAAc,EAAE;IAC9D,iGAAiG;IACjG,mGAAmG;IACnG,iGAAiG;IACjG,EAAE;IACF,kGAAkG;IAClG,iGAAiG;IACjG,mGAAmG;IACnG,+FAA+F;IAC/F,+BAA+B;IAC/B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,cAAc,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,KAAK,CAAC;IACjF,SAAS,EAAE,yBAAyB,CAAC,cAAc,CAAC,oBAAoB,CAAC,KAAK,CAAC;IAC/E,kIAAkI;IAClI,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,cAAc,EAAE;IAC1D,kIAAkI;IAClI,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,cAAc,EAAE;IACrD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACtG,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAIH,kFAAkF;AAClF,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,kBAAkB,CAAC,WAAW,EAAE;IAC9E,wCAAwC;IACxC,yCAAyC;IACzC,8CAA8C;IAC9C,gDAAgD;IAChD,iDAAiD;IACjD,gDAAgD;IAChD,4CAA4C;IAC5C,iDAAiD;IACjD,kDAAkD;IAClD,iEAAiE;IACjE,6DAA6D;IAC7D,wDAAwD;IACxD,uDAAuD;IACvD,wDAAwD;IACxD,4DAA4D;IAC5D,8DAA8D;IAC9D,wDAAwD;IACxD,kDAAkD;IAClD,kDAAkD;IAClD,kDAAkD;IAClD,4DAA4D;IAC5D,mDAAmD;IACnD,oDAAoD;IACpD,gEAAgE;IAChE,oDAAoD;IACpD,+DAA+D;IAC/D,6DAA6D;IAC7D,yDAAyD;IACzD,sDAAsD;IACtD,gEAAgE;IAChE,4DAA4D;IAC5D,0CAA0C;IAC1C,2CAA2C;IAC3C,iDAAiD;IACjD,wDAAwD;IACxD,iDAAiD;IACjD,kEAAkE;IAClE,+DAA+D;IAC/D,2DAA2D;IAC3D,4DAA4D;IAC5D,+CAA+C;IAC/C,+CAA+C;IAC/C,kDAAkD;IAClD,8CAA8C;IAC9C,kDAAkD;IAClD,yDAAyD;IACzD,yDAAyD;IACzD,sDAAsD;IACtD,6CAA6C;IAC7C,gDAAgD;IAChD,0DAA0D;IAC1D,kDAAkD;IAClD,oDAAoD;IACpD,kDAAkD;IAClD,oDAAoD;IACpD,qDAAqD;IACrD,qDAAqD;IACrD,iDAAiD;IACjD,gDAAgD;IAChD,oDAAoD;IACpD,kDAAkD;IAClD,6CAA6C;IAC7C,iDAAiD;IACjD,+CAA+C;IAC/C,gDAAgD;IAChD,0DAA0D;IAC1D,mDAAmD;IACnD,kDAAkD;IAClD,0CAA0C;IAC1C,yDAAyD;IACzD,sDAAsD;IACtD,8DAA8D;IAC9D,sDAAsD;IACtD,2DAA2D;IAC3D,iDAAiD;IACjD,gDAAgD;IAChD,mDAAmD;IACnD,iDAAiD;IACjD,uDAAuD;IACvD,qDAAqD;IACrD,4DAA4D;IAC5D,6DAA6D;IAC7D,wDAAwD;IACxD,kDAAkD;IAClD,iDAAiD;IACjD,yDAAyD;IACzD,kDAAkD;IAClD,gDAAgD;IAChD,qDAAqD;IACrD,sDAAsD;IACtD,2DAA2D;IAC3D,4DAA4D;CAC7D,CAAC,CAAC","sourcesContent":["import { z } from \"zod\";\nimport { PersonalDataCategory } from \"../privacy/personal-data-category.shared.schemas\";\nimport { ResourceOperationRiskLevel, ResourceOperationVariantType } from \"../../resources/resources.shared.schemas\";\nimport { CoreResourceOperation } from \"../../resources/resources.shared.core.definitions\";\nimport {\n PlatformAccessGrantAutoApprovalReason,\n PlatformAccessGrantLifecycleTransition,\n PlatformAccessGrantStatus,\n} from \"../../security/authorizations/platform-access-grants.shared.schemas\";\nimport { ExecutionContext_ExecutionType } from \"../../runtime/execution-context.shared.schemas\";\nimport {\n AuthScopeType,\n SsoConnectionType,\n} from \"../../security/authentications/authentication.shared.schemas\";\nimport { WebhookEndpointProbeOutcome } from \"../../notifications/m2m/webhook-config.shared.schemas\";\n\n\nexport enum CoreAuditableEventType {\n // Authentication Events\n USER_LOGIN = 'user_login',\n USER_LOGOUT = 'user_logout',\n USER_LOGIN_FAILED = 'user_login_failed',\n USER_ACCOUNT_LOCKED = 'user_account_locked',\n USER_PASSWORD_CHANGED = 'user_password_changed',\n // audit-event-unemitted: superseded by the per-METHOD events, which is what the MFA services\n // actually emit — `USER_MFA_SETUP_STARTED` / `USER_MFA_SETUP_COMPLETED` on enrolment and\n // `USER_TOTP_DISABLED` on removal. A coarse \"MFA enabled/disabled\" pair cannot say WHICH factor\n // changed, and a user with TOTP plus a passkey makes that distinction the whole question. Kept\n // rather than deleted because a future factor-agnostic rollup is a plausible SIEM convenience;\n // it must not be emitted ALONGSIDE the per-method events without deciding which is canonical.\n USER_MFA_ENABLED = 'user_mfa_enabled',\n // audit-event-unemitted: see USER_MFA_ENABLED — `USER_TOTP_DISABLED` is the emitted event.\n USER_MFA_DISABLED = 'user_mfa_disabled',\n // audit-event-unemitted: expiry is PASSIVE — a token simply ages out, so there is no moment for\n // anyone to observe. Emitting it would require polling every live session, and would produce one\n // row per session per lifetime: the highest-volume, lowest-signal stream in the trail. The\n // session endings that carry intent are already covered (`USER_LOGOUT`, and the token-revocation\n // events). Deliberately declared-and-unwired rather than deleted, because a future\n // idle-timeout/forced-expiry feature — where expiry IS an act someone triggers — is exactly what\n // it should name.\n USER_SESSION_EXPIRED = 'user_session_expired',\n\n /*\n A refresh chain was FORCIBLY RETIRED because the principal exceeded its concurrent-session cap.\n \n DISTINCT from {@link USER_SESSION_EXPIRED}, and the split is semantic rather than cosmetic. An\n * expiry is time elapsing; an eviction is a cap DISPLACING a live chain, and the two answer\n * different reviewer questions — \"was this user idle?\" versus \"is somebody's chain being pushed\n * out?\". The second is the one that matters: the cap exists to bound the blast radius of undetected\n * token theft, so a burst of evictions for one principal is exactly the signal a reviewer wants.\n \n Before this, the only trace was a debug log — a security-relevant token-lifecycle act with no\n * durable record, which is what `CLAUDE.md`'s assurance-by-construction rule asks for by name.\n \n assurance-control: WILDO.IDENTITY.SESSION_CONCURRENCY_LIMIT — the eviction enforcing the\n * concurrent-session bound leaves a record naming WHICH chain was retired and when it was issued,\n * so the first-in-first-out property is reviewable rather than merely implemented.\n /\n USER_SESSION_EVICTED = 'user_session_evicted',\n\n // Machine (non-human) Authentication Events — api-key / OAuth-client / exchanged client-credentials\n // token resolving to an ORGANIZATION_MACHINE / APPLICATION_MACHINE principal. The credential\n // provenance (authMethod + credentialId) + scope ride the typed eventData.\n MACHINE_AUTH_SUCCESS = 'machine_auth_success',\n MACHINE_AUTH_FAILED = 'machine_auth_failed',\n // Machine RESOURCE-ACCESS event — the token-USE twin of MACHINE_AUTH_SUCCESS (token-MINT). Emitted\n // per external request when a machine principal exercises an audience-bound resource-server surface\n // (A2A `message/send`, MCP `tools/call`, …). MACHINE_AUTH_SUCCESS fires once at `/oauth/token` and\n // is low-volume; MACHINE_ACCESS lets an org SIEM see WHAT a machine did, not just that it authed.\n MACHINE_ACCESS = 'machine_access',\n\n // User Lifecycle Events\n // audit-event-unemitted: this operation now leaves evidence as a generic\n // `RESOURCE_OPERATION_PERFORMED` row, which carries strictly MORE than this member could — the\n // operation identity triple, the actor's roles as they stood, the top-level `correlationId` that\n // groups a cascade, and before/after values for `.isAuditEvidence()` fields. Wiring this one too would\n // write two rows for one action. Kept rather than deleted: a purpose-built event is still the\n // right shape if this verb ever needs a payload the generic row cannot reconstruct (the standing\n // precedent is `USER_APP_ROLES_CHANGED`, which carries the `requestedRoles` set the role-ceiling\n // gate measured — something a before/after diff cannot recover).\n USER_CREATED = 'user_created',\n // audit-event-unemitted: covered by the generic `RESOURCE_OPERATION_PERFORMED` row — see USER_CREATED.\n USER_UPDATED = 'user_updated',\n USER_DELETED = 'user_deleted',\n\n // Application-Role Administration — the APPLICATION-scope twin of\n // ORGANIZATION_MEMBER_ROLE_CHANGED. `User.appRoles` IS the principal's live application authority\n // (it is read back into `initiatorRoles` on their very next request), so every change to it is an\n // access-control decision that must leave evidence. Emitted by the USERS role-administration write\n // paths (assign_roles / revoke_roles and the core CREATE/UPDATE that can rewrite the array), never\n // for an update that leaves `appRoles` untouched.\n // assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — evidence of privilege grant/revocation.\n USER_APP_ROLES_CHANGED = 'user_app_roles_changed',\n\n // The application booted with NO administratively usable super-administrator — a state the write\n // guards refuse to create, so its presence means it arrived some other way: a direct database\n // edit, a restore from a backup taken mid-erasure, a seed that authored no administrator, or a\n // role-table reconfiguration that changed which roles confer super-admin under an existing\n // population. Reported at startup, never fatal (a fresh application legitimately boots with no\n // users at all before its first administrator is seeded or registers).\n // assurance-control: WILDO.ACCESS.ADMINISTRATIVE_CONTINUITY — evidence that the application has no\n // accountable administrative principal, which is unrecoverable in-product once reached.\n APPLICATION_SUPER_ADMIN_FLOOR_BREACHED = 'application_super_admin_floor_breached',\n /\n A tenant was left with no administratively usable owner by an action that was ALLOWED to proceed.\n \n The organization-scope twin of {@link APPLICATION_SUPER_ADMIN_FLOOR_BREACHED}, and unlike it this\n * one HAS an actor: it is emitted when a user lifecycle transition (typically a suspension) removes\n * the last usable owner of a tenant. That write is deliberately not refused — suspension is usually\n * incident response, and blocking it would mean an operator cannot lock out a compromised owner\n * without first transferring ownership using the tenant the attacker controls.\n \n Because the action proceeds, this record is the ENTIRE control. It is not decoration.\n /\n ORGANIZATION_OWNER_FLOOR_BREACHED = 'organization_owner_floor_breached',\n\n // Organization Lifecycle Events\n // audit-event-unemitted: covered by the generic `RESOURCE_OPERATION_PERFORMED` row — see USER_CREATED.\n ORGANIZATION_CREATED = 'organization_created',\n // audit-event-unemitted: covered by the generic `RESOURCE_OPERATION_PERFORMED` row — see USER_CREATED.\n ORGANIZATION_UPDATED = 'organization_updated',\n ORGANIZATION_DELETED = 'organization_deleted',\n /* The tenant was MARKED for deletion (soft-delete). Its access dies here; its data dies at the purge. /\n ORGANIZATION_DELETION_REQUESTED = 'organization_deletion_requested',\n /* A pending tenant deletion was cancelled inside the retention window. /\n ORGANIZATION_RESTORED = 'organization_restored',\n /* The tenant was administratively HALTED. Confers no authority while suspended. /\n ORGANIZATION_SUSPENDED = 'organization_suspended',\n /* A halted or expired tenant was returned to normal operation. /\n ORGANIZATION_ACTIVATED = 'organization_activated',\n /\n A governed lifecycle transition changed a subject's `status` — membership suspension and\n * reactivation, administrative user suspension, self-service account deactivation.\n \n ONE event type rather than five near-identical ones, because the five verbs it serves share an\n * identical data shape: a subject, a from→to status pair, an optional caller reason, and an\n * optional automatic-reactivation deadline. `resourceType` + `operationIdentifier` fully\n * discriminate which verb ran, so splitting would produce five schemas differing only in their\n * literal and force a reviewer asking \"show me every suspension\" to union five queries.\n \n Deliberately distinct from {@link ORGANIZATION_SUSPENDED} / {@link ORGANIZATION_ACTIVATED},\n * which are NOT collapsed into this: tenant transitions carry domain facts these do not\n * (`revokedUserTypeCount` / `regrantedUserTypeCount` — the platform-wide reach of halting a\n * tenant), so they are genuinely different events rather than the same event on another resource.\n /\n RESOURCE_STATUS_TRANSITION_PERFORMED = 'resource_status_transition_performed',\n\n // Organization Member Events\n // audit-event-unemitted: covered by the generic `RESOURCE_OPERATION_PERFORMED` row — see USER_CREATED.\n ORGANIZATION_MEMBER_INVITED = 'organization_member_invited',\n // audit-event-unemitted: covered by the generic `RESOURCE_OPERATION_PERFORMED` row — see USER_CREATED.\n ORGANIZATION_MEMBER_JOINED = 'organization_member_joined',\n // audit-event-unemitted: covered by the generic `RESOURCE_OPERATION_PERFORMED` row — see USER_CREATED.\n ORGANIZATION_MEMBER_UPDATED = 'organization_member_updated',\n ORGANIZATION_MEMBER_ROLE_CHANGED = 'organization_member_role_changed',\n // audit-event-unemitted: covered by the generic `RESOURCE_OPERATION_PERFORMED` row — see USER_CREATED.\n ORGANIZATION_MEMBER_STATUS_CHANGED = 'organization_member_status_changed',\n ORGANIZATION_MEMBER_REMOVED = 'organization_member_removed',\n\n // audit-event-unemitted: covered by the generic `RESOURCE_OPERATION_PERFORMED` row — see USER_CREATED.\n ORGANIZATION_NOTIFICATIONS_UPDATED = 'organization_notifications_updated',\n // audit-event-unemitted: covered by the generic `RESOURCE_OPERATION_PERFORMED` row — see USER_CREATED.\n ORGANIZATION_PREFERENCES_UPDATED = 'organization_preferences_updated',\n // audit-event-unemitted: covered by the generic `RESOURCE_OPERATION_PERFORMED` row — see USER_CREATED.\n ORGANIZATION_PROFILE_UPDATED = 'organization_profile_updated',\n // audit-event-unemitted: covered by the generic `RESOURCE_OPERATION_PERFORMED` row — see USER_CREATED.\n ORGANIZATION_UNIT_UPDATED = 'organization_unit_updated',\n\n // Per-unit role assignment — the NARROWED twin of ORGANIZATION_MEMBER_ROLE_CHANGED.\n // `OrganizationUnitMember.role` became live authority when `appendUnitScopedRoles` began emitting\n // it into `initiatorRoles` as a unit-narrowed entry, so assigning or re-assigning it is an\n // access-control decision on the same footing as the organization-wide array — it just confers\n // inside ONE unit rather than across the tenant. Distinct from ORGANIZATION_UNIT_UPDATED, which is\n // ORG_MANAGEMENT record-keeping about the unit itself and confers nothing.\n // assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — evidence of privilege grant/revocation.\n ORGANIZATION_UNIT_MEMBER_ROLE_CHANGED = 'organization_unit_member_role_changed',\n\n // Revocation of a per-unit role assignment — the closing half of\n // ORGANIZATION_UNIT_MEMBER_ROLE_CHANGED. Deleting an assignment row IS the revocation: the row\n // exists only to confer a role, so unlike ORGANIZATION_MEMBER_REMOVED (where losing authority is a\n // consequence of leaving the directory) there is no non-authorization reading of this event.\n // Without it the trail shows unit privileges being granted and never removed.\n // assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — evidence of privilege revocation.\n ORGANIZATION_UNIT_MEMBER_REMOVED = 'organization_unit_member_removed',\n\n // SSO Authentication Events\n USER_SSO_LOGIN = 'user_sso_login',\n USER_SSO_LOGIN_FAILED = 'user_sso_login_failed',\n USER_SSO_ENFORCEMENT_BLOCKED = 'user_sso_enforcement_blocked',\n USER_TOKEN_REFRESHED = 'user_token_refreshed',\n\n // Organization Security Management Events\n ORGANIZATION_SSO_CONFIGURATION_CHANGED = 'organization_sso_configuration_changed',\n ORGANIZATION_SIEM_EXPORT_CONFIGURED = 'organization_siem_export_configured',\n\n // Application Security Configuration Events\n // The per-user-type authentication policy (`userTypes.<type>.auth` — MFA, password, and lockout\n // requirements) is STATIC application configuration authored in code and taken into effect at\n // backend startup. A change to it — most consequentially a WEAKENING such as turning MFA off — is\n // a security-posture decision that otherwise leaves no product-side record (only source history).\n // Emitted at boot, by the system, when the resolved policy snapshot differs from the last one the\n // trail recorded for the application. Distinct from ORGANIZATION_SSO_CONFIGURATION_CHANGED, which\n // is a per-tenant runtime edit by a human admin; this is the application-wide authored baseline\n // and has no human actor at boot (the \"who\" lives in the deployment/source history).\n // assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — a change to the authentication assurance\n // requirements (MFA / password / lockout) must be attributable and evidenced.\n APPLICATION_AUTH_POLICY_CHANGED = 'application_auth_policy_changed',\n\n // Outbound M2M Webhook Events\n // An admin firing `webhookConfig.testEndpoint` makes the platform emit a signed HTTP\n // request to an operator-supplied URL. That is an outbound-traffic primitive reachable\n // from an authenticated admin surface, so every attempt — reachable or not — is recorded\n // with the actor, the scope, and the destination host.\n // assurance-control: WILDO.INTEGRATION.OUTBOUND_ACTIVITY_AUDIT — outbound connection initiated from an\n // administrative surface is attributable and monitorable.\n WEBHOOK_ENDPOINT_TEST_DISPATCHED = 'webhook_endpoint_test_dispatched',\n\n // SCIM Directory Provisioning Events\n // audit-event-unemitted: covered by the generic `RESOURCE_OPERATION_PERFORMED` row — see USER_CREATED.\n SCIM_TOKEN_CREATED = 'scim_token_created',\n SCIM_TOKEN_REVOKED = 'scim_token_revoked',\n SCIM_TOKEN_GENERATED = 'scim_token_generated',\n SCIM_TOKEN_ROTATED = 'scim_token_rotated',\n SCIM_PROVISIONING_CONFIG_UPDATED = 'scim_provisioning_config_updated',\n SCIM_PROVISIONING_FAILED = 'scim_provisioning_failed',\n SCIM_USER_PROVISIONED = 'scim_user_provisioned',\n SCIM_USER_UPDATED = 'scim_user_updated',\n SCIM_USER_DEACTIVATED = 'scim_user_deactivated',\n\n // Password Reset Events (H5)\n USER_PASSWORD_RESET_REQUESTED = 'user_password_reset_requested',\n USER_PASSWORD_RESET_COMPLETED = 'user_password_reset_completed',\n /\n An ADMINISTRATOR compelled a credential reset on another user's account.\n \n Deliberately distinct from `USER_PASSWORD_RESET_REQUESTED`, which records a SELF-SERVICE\n * request and carries no actor: reusing it for an admin action would attribute the reset to\n * the account owner, so the audit trail would name the wrong human for a privileged act. This\n * event names both the actor and the target, and records the operator's documented reason.\n /\n USER_PASSWORD_RESET_FORCED = 'user_password_reset_forced',\n\n // Registration & Verification Events (H5)\n USER_REGISTERED = 'user_registered',\n USER_EMAIL_VERIFIED = 'user_email_verified',\n USER_VERIFICATION_EMAIL_RESENT = 'user_verification_email_resent',\n\n // Method Management Events (#13f)\n USER_PASSWORD_SET = 'user_password_set',\n USER_TOTP_DISABLED = 'user_totp_disabled',\n USER_IDENTITY_LINK_REMOVED = 'user_identity_link_removed',\n\n // MFA Lifecycle Events (H5)\n USER_MFA_SETUP_STARTED = 'user_mfa_setup_started',\n USER_MFA_SETUP_COMPLETED = 'user_mfa_setup_completed',\n USER_MFA_EMAIL_OTP_SENT = 'user_mfa_email_otp_sent',\n\n // WebAuthn/Passkey Events (Phase G1)\n USER_PASSKEY_REGISTERED = 'user_passkey_registered',\n USER_PASSKEY_AUTHENTICATION_SUCCESS = 'user_passkey_authentication_success',\n USER_PASSKEY_AUTHENTICATION_FAILURE = 'user_passkey_authentication_failure',\n USER_PASSKEY_REMOVED = 'user_passkey_removed',\n\n // Magic Link Events (Phase G2)\n USER_MAGIC_LINK_SENT = 'user_magic_link_sent',\n USER_MAGIC_LINK_VERIFIED = 'user_magic_link_verified',\n USER_MAGIC_LINK_FAILED = 'user_magic_link_failed',\n\n // SMS OTP Events (Phase G2)\n USER_SMS_OTP_SENT = 'user_sms_otp_sent',\n USER_SMS_OTP_VERIFIED = 'user_sms_otp_verified',\n USER_SMS_OTP_FAILED = 'user_sms_otp_failed',\n\n // Phone Verification Events (Phase G2)\n USER_PHONE_VERIFIED = 'user_phone_verified',\n USER_PHONE_VERIFICATION_FAILED = 'user_phone_verification_failed',\n\n // SAML Authentication Events (AUTH-2)\n SAML_LOGIN_INITIATED = 'saml_login_initiated',\n SAML_LOGIN_SUCCESS = 'saml_login_success',\n SAML_LOGIN_FAILED = 'saml_login_failed',\n SAML_ASSERTION_REPLAY_DETECTED = 'saml_assertion_replay_detected',\n SAML_CERT_EXPIRING = 'saml_cert_expiring',\n SAML_SLO_INITIATED = 'saml_slo_initiated',\n SAML_SLO_COMPLETED = 'saml_slo_completed',\n SAML_METADATA_PARSED = 'saml_metadata_parsed',\n SAML_EMAIL_CHANGED = 'saml_email_changed',\n\n // OAuth2 Provider Restriction Events (Phase G3)\n OAUTH2_PROVIDER_BLOCKED = 'oauth2_provider_blocked',\n\n // One-Off Session Events (W7.3b)\n /\n File upload grant lifecycle (issue #312) — the first FILE-domain audit events. A grant is a\n * single-use bearer credential that lets whoever holds it perform ONE upload into ONE resource file\n * field with the MINTER's authority; minting it is a delegated-authorization act and is audited as\n * one. `ISSUED` at mint (MEDIUM: a credential left the trust boundary), `REDEEMED` when the one\n * upload landed and the FILES row exists, `REVOKED` when the minter or an administrator cancelled\n * it. The event data carries the grant's ID — never its value.\n /\n FILE_UPLOAD_GRANT_ISSUED = 'file_upload_grant_issued',\n FILE_UPLOAD_GRANT_REDEEMED = 'file_upload_grant_redeemed',\n FILE_UPLOAD_GRANT_REVOKED = 'file_upload_grant_revoked',\n ONE_OFF_TOKEN_CREATED = 'one_off_token_created',\n ONE_OFF_TOKEN_EXCHANGED = 'one_off_token_exchanged',\n /* revocation-B1: a super-admin cancelled an un-exchanged one-off (impersonation) session token. /\n ONE_OFF_TOKEN_REVOKED = 'one_off_token_revoked',\n\n // Cross-Frontend Handoff Events (cross-app-jwt-propagation Step 2)\n USER_CROSS_FRONTEND_HANDOFF_ISSUED = 'user_cross_frontend_handoff_issued',\n\n // Emergency Access Events\n EMERGENCY_ACCESS_USED = 'emergency_access_used',\n\n // Field Access Events\n FIELD_ACCESS = 'field_access',\n\n // Resource-Operation Events — the OPERATION-triggered twin of FIELD_ACCESS.\n //\n // FIELD_ACCESS answers \"a decorated field left the system\"; it is triggered by a RESPONSE FIELD,\n // so an operation whose response carries no decorated field is invisible to it. Repo-wide, that\n // trigger is declared on FOUR fields (three secret families, CREATE-only), which left every other\n // operation in an 83-resource catalogue emitting nothing at all — including role changes,\n // suspensions, credential deletion and tenant deletion.\n //\n // This event answers the different question: \"this OPERATION was performed, by whom, on what,\n // with what effect\". It is emitted for every HIGH / CRITICAL operation variant automatically\n // (`riskLevel` is already the framework's canonical danger axis — it drives MCP destructive\n // hints, frontend danger-zone placement and CRITICAL typed-confirmation), and for any variant\n // that opts in declaratively via `auditableEvent`.\n //\n // It is the FLOOR beneath the purpose-built events, never their replacement: a verb with its own\n // event (e.g. USER_APP_ROLES_CHANGED, which carries the `requestedRoles` set the role-ceiling\n // gate was measured against — something a generic before/after diff cannot reconstruct) emits\n // that one and suppresses this.\n //\n // assurance-control: WILDO.AUDIT.SECURITY_EVENT — privileged actions on\n // resources are attributable, and the authorization effect of each is reconstructable.\n RESOURCE_OPERATION_PERFORMED = 'resource_operation_performed',\n\n // The REFUSAL twin of RESOURCE_OPERATION_PERFORMED — the other half of \"record access decisions\".\n //\n // Emitted PRE-DISPATCH from the authorizer, not from the post-commit lane, because a refused\n // operation never reaches that lane. Without this event a refused HIGH/CRITICAL action — a denied\n // role change, a blocked suspension, a rejected credential rotation — leaves NO evidence at all,\n // so an auditor cannot distinguish \"nobody attempted it\" from \"someone attempted it and was\n // stopped\". Repeated denials are also the signature of an attack in progress.\n //\n // ## Not an authentication failure\n //\n // USER_LOGIN_FAILED / MACHINE_AUTH_FAILED answer \"you are not who you claim to be\" (AUTHENTICATION).\n // This answers \"you are who you claim to be, and you may not do this\" (AUTHORIZATION). The two are\n // deliberately distinct event types in distinct categories; neither is overloaded onto the other.\n //\n // ## No risk floor, unlike the success twin\n //\n // RESOURCE_OPERATION_PERFORMED fires only at HIGH/CRITICAL because a SUCCESSFUL low-risk read is\n // routine business (371 of the 551 API-reachable variants are reads). A DENIED read is never\n // routine — it is the canonical reconnaissance signal. A risk floor here would exclude 100% of\n // denied reads while not bounding attacker volume at all (the attacker picks the endpoint, so a\n // HIGH verb is exactly as cheap to hammer as a LOW one). Volume is bounded by per-principal\n // dedup instead — see `AuditableEvent_ResourceOperationDenied_EventDataSchema`.\n //\n // Severity is WARNING, matching its AUTHENTICATION twins rather than varying with `riskLevel`:\n // severity is a pure function of event type everywhere in this map (and is re-derived\n // independently by the SIEM dispatcher), so danger grading rides the row's `riskLevel` field.\n //\n // assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT — access-control decisions are\n // recorded, including the negative decisions, and repeated refusals are detectable.\n RESOURCE_OPERATION_DENIED = 'resource_operation_denied',\n CROSS_TENANT_ADMINISTRATIVE_ACCESS = 'cross_tenant_administrative_access',\n PLATFORM_ACCESS_GRANT_LIFECYCLE = 'platform_access_grant_lifecycle',\n /\n An operator enumerated an APPLICATION-WIDE directory — a collection read that is deliberately\n * not confined to any one tenant.\n \n ## Why this is not {@link CROSS_TENANT_ADMINISTRATIVE_ACCESS}\n \n That event answers \"an operator reached a ROW belonging to a tenant they are not a member of\",\n * and it is emitted after comparing a FETCHED row's organization against the caller's role\n * entries. A directory read has no row and no target tenant — the whole point is that it spans\n * all of them — so there is nothing for that comparison to consume. Merging the two would put\n * two different questions behind one event type and make the existing one's `targetOrganizationId`\n * meaningless on half its rows. Closed vocabularies do not merge.\n \n ## Why it exists at all\n \n The reach is INTENDED and declared (`users \| list \| admin` is documented as \"admin-gated global\n * user listing\"), and it cannot be governed by the platform-access-grant mechanism: that admission\n * requires a usable grant for a TARGET tenant, and a collection call has none. So prevention is\n * structurally unavailable and EVIDENCE is the control that remains — which is exactly what\n * `.claude/rules/administrative-continuity-floors.md` asks for on a sanctioned reach: \"every\n * crossing is NAMED in the trail\". Before this event, an operator could enumerate every user's\n * email across every tenant and leave nothing behind.\n \n INFO, not WARNING: unlike its cross-tenant sibling this is an ordinary, expected administrative\n * read on a surface built for it. The subset worth escalating is selected by a SIEM rule on\n * `resourceType` + `returnedCount`, both of which ride the payload.\n \n assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT — an unconfined administrative read\n * of application-wide data is recorded with its actor, surface and size.\n /\n PLATFORM_DIRECTORY_ACCESS = 'platform_directory_access',\n\n // System-Context (ACL-bypassing) Access Events\n // Emitted whenever a server-internal `readAsSystem` / `listAsSystem` call\n // reads a resource with a synthesised super-admin context, bypassing the\n // caller's scope + role ACL. Classified by default as DATA_ACCESS / INFO\n // (an expected, authorized internal read — not an anomaly).\n // USERLESS BUT NOT UNATTRIBUTED (since 2026-07-31): there is no human to name —\n // the door synthesises its own super-admin context — but `eventData.performedByRuntime`\n // records WHICH RUNTIME exercised it (the application backend, a named minion, …).\n // Without that, a cross-tenant read by a background digital worker is indistinguishable\n // from a data seed or a lifecycle batch. Runtime attribution is deliberately a weaker,\n // honest claim than user attribution and must never be read as one.\n SYSTEM_CONTEXT_READ = 'system_context_read',\n // The MUTATION twin: emitted whenever a server-internal `createAsSystem` /\n // `updateAsSystem` / `updateManyAsSystem` call writes a resource with a\n // synthesised super-admin context, bypassing the caller's scope + role ACL\n // (e.g. registration persisting credentials). A MUTATION under an ACL bypass\n // is more sensitive than a read, so it is audited as its own distinct event\n // rather than folded into SYSTEM_CONTEXT_READ.\n SYSTEM_CONTEXT_WRITE = 'system_context_write',\n\n // Retained-Data (Impersonalization) Access Events\n // Emitted when a privileged SEE-THROUGH read reveals RETAINED (impersonalized-and-retained) records\n // that the default retention hide-predicate keeps hidden. SYSTEM_CONTEXT_READ names only the RUNTIME\n // that acted; this read is HUMAN-ATTRIBUTED (a super-admin / COMPLIANCE_AUDITOR) and carries a REQUIRED reason —\n // a compliance-grade access record over scrubbed personal data. Strictly read-only. Classified\n // DATA_ACCESS / WARNING (an authorized-but-elevated privileged access, not an anomaly ⇒ not CRITICAL).\n RETAINED_DATA_ACCESS = 'retained_data_access',\n\n // A DATA SUBJECT EXPORT was assembled and handed out — everything the framework holds about one\n // person, gathered across their whole relationship graph (GDPR Art. 15 access / Art. 20\n // portability). Deliberately NOT folded into SYSTEM_CONTEXT_READ: that event names only the\n // RUNTIME that acted and carries no notion of a subject, a purpose, or what a bundle contained,\n // so it cannot answer the question a regulator actually asks — \"who exported whose data, when,\n // and what was in it?\". The four routed export operations this capability replaced emitted\n // NOTHING at all, which is the gap this closes. Classified DATA_ACCESS / WARNING: an authorized\n // but maximally-sensitive disclosure, not an anomaly.\n SUBJECT_DATA_EXPORT = 'subject_data_export',\n // A resource LISTING was exported to a file (CSV/JSON) by an operator. Distinct from\n // SUBJECT_DATA_EXPORT, which answers a data subject's own right over their own data: this one is\n // an authorized operator taking rows they can already read and carrying them OUT of the system, so\n // the questions it must answer are \"which resource, how many rows, and was it the page they were\n // looking at or the whole table\". Classified DATA_ACCESS / INFO with a per-emit `riskLevel` — see\n // the eventData schema for why the severity is static and the risk is not.\n COLLECTION_DATA_EXPORT = 'collection_data_export',\n\n // Rows were read THROUGH an HTTP-API resource binding — data left an EXTERNAL system\n // (an enterprise's Odoo/SAP/…) via the engine's read-through repository (ETL plan, D8/R6).\n // Deliberately NOT folded into the neighbors: SYSTEM_CONTEXT_READ names a runtime acting on\n // WILDO-owned rows and knows nothing of a foreign system; COLLECTION_DATA_EXPORT is rows\n // CARRIED OUT of the system by an operator, while this is rows BROUGHT IN from a system the\n // platform does not own — the question a reviewer asks is \"who reached into which external\n // system, through which provider, for which entity, and how much came back\". Attribution\n // carries the REAL initiating user even under a SERVICE_PRINCIPAL binding (R12 — the\n // credential-sharing-as-a-service failure this vocabulary exists to prevent). One event per\n // read-family OPERATION execution (a paginated list and its count are ONE access), emitted at\n // the adapter — the only tier that witnesses EVERY remote access, including repository-direct\n // probes the services tier never sees. Classified DATA_ACCESS / INFO: routine, authorized\n // operation — the value is the queryable trail, not an alarm.\n HTTP_API_READ_THROUGH_ACCESS = 'http_api_read_through_access',\n\n // A subject erasure INVOKED the declared external-erasure operation of an HTTP_API-bound\n // resource (ETL D6 stance 6b) — rows linked to the erased subject were DELETED in a system the\n // platform does not own (OData canonical DELETE / Odoo `unlink` / a declared REST_JSON call).\n // The first OUTBOUND WRITE on the read-through plane, landing WITH its mechanism per the D8\n // narrowing. Distinct from HTTP_API_READ_THROUGH_ACCESS (rows brought IN) and from\n // SYSTEM_CONTEXT_WRITE (a trusted write to WILDO-owned rows): the reviewer question here is\n // \"which subject's rows were deleted in which external system, through which provider, and how\n // many\". Classified USER_LIFECYCLE / INFO: the sanctioned mechanics of a data-protection\n // request, not an anomaly — the erasure report is the receipt; this is the queryable trail.\n HTTP_API_EXTERNAL_ERASURE = 'http_api_external_erasure',\n\n // A subject erasure COMPLETED while rows linked to the subject remain LIVE in an HTTP_API-bound\n // external system, on the controller's explicit per-request acknowledgement (ETL D6 stance 6c,\n // `acknowledgeHttpApiNonErasure`). The record IS the control (the same doctrine as the two\n // administrative floors): no downstream check can second-guess a controller acting within GDPR\n // Art. 17(3) grounds, so what the framework owes is a loud, queryable record of the hole — the\n // subject, the resource, the provider, and how many rows remained (when countable). Classified\n // USER_LIFECYCLE / CRITICAL: one event per acknowledged resource per erasure, never a standing\n // posture.\n HTTP_API_NON_ERASURE_ACKNOWLEDGED = 'http_api_non_erasure_acknowledged',\n\n // ── OAuth2 / OIDC Provider Events (Wildo AS the authorization server) ──\n // Distinct from the `OAUTH2_` family above, which records Wildo CONSUMING an\n // EXTERNAL social OAuth provider. These record the app-issued OAuth2/OIDC provider\n // surface (`/oauth/authorize`, `/oauth/token`, `/oauth/authorize/decision`,\n // `/oauth/revoke`) — a third party gaining, or being refused, user-acting access.\n // Each maps to a Wildo assurance objective at the emit site (`assurance-control:` marker).\n\n /** A user-delegated `authorization_code` access token was minted for a third-party client\n * (the client may now act AS the user at the bound A2A/MCP resource) — the flagship grant. /\n OAUTH_DELEGATED_TOKEN_ISSUED = 'oauth_delegated_token_issued',\n /* A user APPROVED an interactive consent request — the client is authorized for this authorize flow. /\n OAUTH_CONSENT_GRANTED = 'oauth_consent_granted',\n /* A user DENIED an interactive consent request — access refused (protective, benign). /\n OAUTH_CONSENT_DENIED = 'oauth_consent_denied',\n /* A durable \"remember this app\" consent grant was created/updated — persistent delegated authority. /\n OAUTH_CONSENT_GRANT_PERSISTED = 'oauth_consent_grant_persisted',\n /\n An ANONYMOUS caller created an OAuth client identity through RFC 7591 dynamic registration.\n * The only write in this application reachable without any credential, so every occurrence is\n * evidence: the row it creates is durable, and the population of these rows is what an operator\n * needs to be able to review and revoke.\n /\n OAUTH_DYNAMIC_CLIENT_REGISTERED = 'oauth_dynamic_client_registered',\n /\n A URL-formatted `client_id` (CIMD) was REFUSED at the authorize endpoint.\n \n Auditable because the refusal reasons are not all equal: `HOST_NOT_ALLOWED` is a\n * misconfiguration, while `SSRF_TARGET_REFUSED` is an unauthenticated stranger trying to make\n * this server fetch an address only it can reach. Both arrive at the same endpoint from the same\n * kind of caller, so only the reason distinguishes them — and a spike in either is a thing an\n * operator must be able to alert on.\n /\n OAUTH_CIMD_CLIENT_REFUSED = 'oauth_cimd_client_refused',\n /* A user token was rotated via the provider `refresh_token` grant (`/oauth/token`). /\n OAUTH_TOKEN_REFRESHED = 'oauth_token_refreshed',\n /* A token was revoked via `/oauth/revoke` (RFC 7009). /\n OAUTH_TOKEN_REVOKED = 'oauth_token_revoked',\n /* An OIDC RP-Initiated Logout terminated the End-User's OP session at `/oauth/end-session`\n * (revocation-C). Distinct from `USER_LOGOUT` (first-party self-logout) and `OAUTH_TOKEN_REVOKED`\n * (RFC 7009 token revocation): this ends a SESSION on a relying party's behalf. /\n OAUTH_RP_INITIATED_LOGOUT = 'oauth_rp_initiated_logout',\n /* An `authorization_code` exchange was REJECTED (replay / PKCE failure / redirect mismatch / …) —\n * a potential attack signal. The specific cause rides `eventData.reason`. /\n OAUTH_CODE_EXCHANGE_FAILED = 'oauth_code_exchange_failed',\n /* A consent DECISION was attempted by a user who is NOT the consent request's bound user (403) —\n * a textbook cross-user authorization-abuse signal. /\n OAUTH_CONSENT_BINDING_VIOLATION = 'oauth_consent_binding_violation',\n\n /* Refresh-token REUSE detected → the whole token family was revoked (possible theft). Emitted by the\n * refresh CALLERS (the token issuer stays audit-free by design — it surfaces a reuse signal instead). /\n USER_REFRESH_TOKEN_REUSE_DETECTED = 'user_refresh_token_reuse_detected',\n}\n\n/\n Closed vocabulary of `OAUTH_CODE_EXCHANGE_FAILED` failure causes (RFC 6749 / OAuth 2.1 / RFC 7636).\n * A dedicated enum (not an inline literal union) so the emit sites, the schema, and any SIEM\n * consumer share one runtime source — the project's closed-vocabulary rule.\n /\nexport enum OAuthCodeExchangeFailureReason {\n /* The single-use code did not atomically consume — replayed, expired, or never issued. /\n CODE_REPLAY_OR_INVALID = 'code_replay_or_invalid',\n /* The consumed token was of a different consumable-token type (not an authorization code). /\n NOT_AUTHORIZATION_CODE = 'not_authorization_code',\n /* The decoded code carried no subject (userId). /\n NO_SUBJECT = 'no_subject',\n /* The redeeming `client_id` differs from the client the code was issued to. /\n CLIENT_MISMATCH = 'client_mismatch',\n /* The redeeming `redirect_uri` differs from the one bound at authorize. /\n REDIRECT_URI_MISMATCH = 'redirect_uri_mismatch',\n /* The PKCE `code_verifier` failed the bound S256 challenge (or was malformed). /\n PKCE_VERIFICATION_FAILED = 'pkce_verification_failed',\n /* The client was deactivated between authorize and redemption (redemption-window re-check). /\n CLIENT_INACTIVE = 'client_inactive',\n /* The client lost the `authorization_code` grant between authorize and redemption. /\n GRANT_TYPE_LOST = 'grant_type_lost',\n}\n\n/* Canonical event categories — used by auditable-events, security-envelope, audit-logs. /\nexport enum AuditEventCategory {\n AUTHENTICATION = 'authentication',\n AUTHORIZATION = 'authorization',\n USER_LIFECYCLE = 'user_lifecycle',\n ORG_MANAGEMENT = 'org_management',\n DATA_ACCESS = 'data_access',\n}\n\n/* Canonical severity levels — used by auditable-events, security-envelope, audit-logs. /\nexport enum AuditEventSeverity {\n INFO = 'info',\n WARNING = 'warning',\n CRITICAL = 'critical',\n}\n\n/\n Why the authorizer refused an operation. A CLOSED vocabulary — the authorizer resolves exactly\n * one of these per refusal, and a SOC dashboard groups by it.\n \n The distinction that matters most operationally is {@link SUBJECT_NOT_RESOLVABLE} vs. the rest:\n * every other member is a caller who reached a real, visible row and was refused on roles or scope,\n * whereas that one is a caller who named a row they cannot see at all — the shape of tenant\n * enumeration.\n /\nexport enum ResourceOperationDenialReason {\n /\n No initiator identity or roles on the execution context. Fail-closed: the authorizer refuses\n * rather than assuming an anonymous caller.\n \n A backstop, not a live path — verified. The execution context fails closed earlier and\n * harder: every execution type that reaches the authorizer refuses to CONSTRUCT without\n * `initiatorIds`, and the one type that permits null (`WEBHOOK_CALLBACK`) is skipped before the\n * guard, since signature verification already established trust. The roles half cannot fire\n * either — the context spreads `initiatorRoles`, so the only accepted value is an array.\n \n A row carrying this reason therefore means something bypassed context construction. Treat it as\n * a defect signal, not routine refusal traffic.\n /\n MISSING_INITIATOR = 'missing_initiator',\n\n /\n The caller's organization-wide roles did not satisfy the operation's required role set, after\n * role-hierarchy expansion. The everyday \"you are not an admin\" refusal.\n /\n INSUFFICIENT_ROLES = 'insufficient_roles',\n\n /\n The caller was refused against the target row's PRIMARY SCOPE — the row belongs to another\n * user, organization or application than the caller is entitled to. Distinct from\n * {@link INSUFFICIENT_ROLES}: the caller may hold the right role, but in the wrong tenant.\n /\n SCOPE_MISMATCH = 'scope_mismatch',\n\n /\n The caller reached the resource through a foreign-key path (`/assigned-to-users/{userId}/todos`)\n * whose owning entity they do not control.\n /\n FK_RELATIONSHIP_DENIED = 'fk_relationship_denied',\n\n /\n A collection operation was refused on its PARENT scope — the caller has no access to the\n * organization / application whose collection they addressed.\n /\n PARENT_SCOPE_DENIED = 'parent_scope_denied',\n\n /\n The named row could not be resolved for the caller: it does not exist, OR it exists and is\n * invisible to the caller's scope. The authorizer cannot distinguish these two — and that is\n * deliberate, because reporting them differently would leak the existence of out-of-scope rows.\n * The refusal surfaces to the caller as NOT_FOUND (404) and that response is unchanged by this\n * event; only the audit trail records that a refusal occurred.\n \n Consequently this reason is AMBIGUOUS BY CONSTRUCTION and a single occurrence proves nothing —\n * a 404 for a genuinely deleted record lands here too. Its value is in the aggregate: a principal\n * accumulating these against ids they never successfully read is enumerating.\n \n assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT — refusals are recorded without the record itself\n * becoming an existence oracle.\n /\n SUBJECT_NOT_RESOLVABLE = 'subject_not_resolvable',\n}\n\n/* SSO configuration change type. /\nexport enum SsoConfigChangeType {\n CREATED = 'created',\n UPDATED = 'updated',\n DELETED = 'deleted',\n PROVIDER_ADDED = 'provider_added',\n PROVIDER_REMOVED = 'provider_removed',\n ENFORCEMENT_CHANGED = 'enforcement_changed',\n}\n\n/* SIEM export configuration change type. /\nexport enum SiemExportChangeType {\n ENABLED = 'enabled',\n DISABLED = 'disabled',\n UPDATED = 'updated',\n}\n\n/\n Normalised MACHINE_ACCESS operation vocabulary. Transport-native method names (A2A JSON-RPC\n * `message/send`, MCP `tools/call`, …) are mapped to these stable, transport-prefixed audit\n * identifiers so an org SIEM reads ONE vocabulary across every external resource-server surface.\n * The `<transport>_<method>` shape keeps A2A and MCP operations disambiguated in a flat stream.\n /\nexport enum MachineAccessOperation {\n A2A_MESSAGE_SEND = 'a2a_message_send',\n A2A_MESSAGE_STREAM = 'a2a_message_stream',\n /* Reading one task's state. Externally triggered and tenant-actionable, so it audits. /\n A2A_TASKS_GET = 'a2a_tasks_get',\n /* Requesting cancellation of a task — a MUTATION of tenant work, audited as such. /\n A2A_TASKS_CANCEL = 'a2a_tasks_cancel',\n /\n Re-attaching to a task's update stream after a dropped connection.\n \n Audited like `A2A_TASKS_GET` and for the same reason: it is a READ of tenant work by an external\n * principal. It deserves its own member rather than borrowing the get — a resubscribe holds a\n * connection open for as long as the task runs, so in a trail the two have very different shapes,\n * and collapsing them would hide a caller camping on a stream behind ordinary polling.\n /\n A2A_TASKS_RESUBSCRIBE = 'a2a_tasks_resubscribe',\n /\n Registering a webhook the agent will POST this task's updates to.\n \n The most security-relevant of the push-notification operations and the reason all four get their\n * own members: the caller is directing OUR server to make outbound requests to an address IT\n * chooses, carrying credentials IT supplies. In a trail that is a different act from reading a\n * task, and an operator reviewing egress needs to find every one of them without inferring it from\n * a generic access row.\n /\n A2A_PUSH_NOTIFICATION_CONFIG_SET = 'a2a_push_notification_config_set',\n /* Reading back one registered webhook target. Secrets are redacted, but the URL is disclosed. /\n A2A_PUSH_NOTIFICATION_CONFIG_GET = 'a2a_push_notification_config_get',\n /* Enumerating every webhook target registered against a task. /\n A2A_PUSH_NOTIFICATION_CONFIG_LIST = 'a2a_push_notification_config_list',\n /* Removing a webhook target — a MUTATION, and the act that silently stops an operator's alerting. /\n A2A_PUSH_NOTIFICATION_CONFIG_DELETE = 'a2a_push_notification_config_delete',\n /\n Enumerating an owner's tasks (A2A 1.0 `ListTasks`).\n \n Its own member rather than borrowing `A2A_TASKS_GET`: a LIST discloses the existence and shape\n * of work the caller did not name, which in a trail is a different act from reading one task an\n * operator already knows about. Collapsing them would hide enumeration behind ordinary polling.\n /\n A2A_TASKS_LIST = 'a2a_tasks_list',\n MCP_TOOLS_LIST = 'mcp_tools_list',\n MCP_TOOLS_CALL = 'mcp_tools_call',\n}\n\nexport const AuditableEventTypeSchema = z.union([\n z.enum(CoreAuditableEventType),\n z.string()\n]);\n\nexport const AuditableEvent_User_LoginEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_LOGIN),\n ipAddress: z.string(),\n userAgent: z.string(),\n userId: z.string(),\n authMethod: z.string().optional(),\n email: z.string().optional(),\n sessionId: z.string().optional(),\n});\n\nexport const AuditableEvent_User_LogoutEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_LOGOUT),\n userId: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\nexport const AuditableEvent_User_LoginFailedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_LOGIN_FAILED),\n email: z.email(),\n authMethod: z.string(),\n failureReason: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n attemptsRemaining: z.number().optional(),\n sessionId: z.string(),\n});\n\n/\n Which lockout mechanism tripped a `USER_ACCOUNT_LOCKED` audit — so a SOC can distinguish the two\n * sources, which have different remediation: the per-SESSION progressive failed-attempt limit vs the\n * per-EMAIL global rate-limit. Enum (fixed vocabulary), not a string union, per the project rule.\n /\nexport enum AccountLockoutReason {\n /* The per-session progressive failed-attempt limit tripped (`incrementSessionAttempts`). /\n SESSION_ATTEMPT_LIMIT = 'session_attempt_limit',\n /* The per-email GLOBAL rate-limit lockout tripped (`checkRateLimit(GLOBAL_LOCKOUT + email)`). /\n GLOBAL_EMAIL_RATE_LIMIT = 'global_email_rate_limit',\n}\n\nexport const AuditableEvent_User_AccountLockedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_ACCOUNT_LOCKED),\n userId: z.string(),\n email: z.email(),\n authMethod: z.string(),\n lockoutDuration: z.number(), // minutes\n ipAddress: z.string(),\n userAgent: z.string(),\n sessionId: z.string(),\n /\n Which lockout mechanism tripped this event. OPTIONAL for backward compatibility — pre-existing\n * emitters and already-stored rows may omit it; new emitters set it so SOC tooling can filter\n * session-limit vs global-email-limit lockouts.\n /\n reason: z.enum(AccountLockoutReason).optional(),\n});\n\n/\n A machine principal (api-key / OAuth-client secret / exchanged client-credentials token) that\n * successfully authenticated. Carries the credential PROVENANCE — never the raw secret. Emitted at\n * the OAuth token-issuance moment (`/oauth/token`); per-request direct-secret access additionally\n * carries this provenance into any FIELD_ACCESS audit row (see `audit-access-fields`).\n /\nexport const AuditableEvent_MachineAuth_SuccessEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.MACHINE_AUTH_SUCCESS),\n /* MachineAuthMethod value: `api_key` \| `oauth_client`. /\n authMethod: z.string(),\n /* The ApiKey / OAuthClient row `_id` that authenticated — NEVER the raw secret. /\n credentialId: z.string(),\n /* Resolved machine execution type: `organization_machine` \| `application_machine`. /\n scopeType: z.string(),\n /* organizationId (ORG machine) or applicationId (APP machine). /\n scopeId: z.string().optional(),\n resourceIdentifier: z.string().optional(),\n operationIdentifier: z.string().optional(),\n ipAddress: z.string().optional(),\n});\n\n/\n A rejected machine-credential presentation (bad/expired/wrong-audience/wrong-scope secret or\n * token, or a rate-limited source). Records the ATTEMPT — the presented credential kind + prefix,\n * the target scope, and the reason — never a `credentialId` (the credential did not resolve). The\n * per-source-IP brute-force signal (external-access hardening) is exactly this event stream.\n /\nexport const AuditableEvent_MachineAuth_FailedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.MACHINE_AUTH_FAILED),\n /* Presented credential kind: `api_key` \| `oauth_client` \| `machine_token`. /\n credentialKind: z.string(),\n /* Human-routable secret prefix (e.g. `sk_org_` / `oc_app_`) — NEVER the full secret. Absent for token fronts. /\n credentialPrefix: z.string().optional(),\n /* Failure reason (e.g. `invalid_credential`, `inactive`, `aud_mismatch`, `wrong_scope`, `rate_limited`). /\n reason: z.string(),\n scopeType: z.string().optional(),\n scopeId: z.string().optional(),\n resourceIdentifier: z.string().optional(),\n operationIdentifier: z.string().optional(),\n ipAddress: z.string().optional(),\n});\n\n/\n A machine principal (ORGANIZATION_MACHINE / APPLICATION_MACHINE) exercised an external\n * resource-server surface (A2A `message/send`, MCP `tools/call`, …) with an already-issued,\n * audience-bound token. The token-USE twin of MACHINE_AUTH_SUCCESS (token-MINT): the mint fires\n * once, low-volume, at `/oauth/token`; THIS fires per external request so an org SIEM sees WHAT a\n * machine did, not merely that it authenticated.\n \n Carries the credential PROVENANCE (authMethod + credentialId — never the raw secret), the ROLE\n * context that authorized the access (roles are the single authorization axis — there is NO OAuth\n * authorization-scope vocabulary), and the resource server + operation targeted. Emitted fire-and-\n * forget at the A2A / MCP controller boundary AFTER the caller is authenticated + authorized; routed\n * to the org SIEM via `routingOrgIds` (verified org for an ORGANIZATION_MACHINE; an\n * APPLICATION_MACHINE has no single tenant SIEM ⇒ no per-org dispatch).\n /\nexport const AuditableEvent_MachineAccess_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.MACHINE_ACCESS),\n /* MachineAuthMethod value: `api_key` \| `oauth_client`. /\n authMethod: z.string(),\n /* The ApiKey / OAuthClient row `_id` whose token was presented — NEVER the raw secret. /\n credentialId: z.string(),\n /* Resolved machine execution type: `organization_machine` \| `application_machine`. /\n scopeType: z.string(),\n /\n TENANT scope id: organizationId (ORG machine) or applicationId (APP machine). This is the\n * data-partition scope, NOT an OAuth authorization scope — that vocabulary was removed; roles are\n * the single authorization axis.\n /\n scopeId: z.string().optional(),\n /\n The role context that authorized this access (the machine principal's roles). Roles are the\n * single authorization axis; recorded so a SIEM sees the authority the access ran under.\n /\n roles: z.array(z.string()).optional(),\n /* ResourceServerKind of the surface accessed: `a2a` \| `mcp`. /\n resourceServer: z.string(),\n /* The resource-server audience / agent endpoint / systemRef the token was bound to and hit. /\n resourceIdentifier: z.string().optional(),\n /* Normalised MachineAccessOperation value (e.g. `a2a_message_send`, `mcp_tools_call`). /\n operationIdentifier: z.string(),\n ipAddress: z.string().optional(),\n});\n\nexport const AuditableEvent_User_SessionExpiredEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_SESSION_EXPIRED),\n userId: z.string(),\n sessionId: z.string(),\n sessionDuration: z.number(), // minutes\n lastActivity: z.date(),\n});\n\n/\n One refresh chain retired to keep a principal within its concurrent-session cap.\n \n `evictedIssuedAt` is the load-bearing field and the reason this event is worth its own type: the\n * cap's security property is that the OLDEST chain goes, so a record that named only the victim\n * would prove a session ended without proving the right one did. Carrying the issuance instant makes\n * the first-in-first-out claim checkable from the trail alone.\n \n `configuredMaximum` and `retainedCount` are here so a reviewer can tell a correctly-enforced cap\n * from a misconfigured one without reading the config as it stood at that moment.\n \n NO token material. The JTI is an opaque identifier, never the token — the trail must not become a\n * place where a credential can be recovered.\n \n assurance-control: WILDO.IDENTITY.SESSION_CONCURRENCY_LIMIT — the bound's enforcement is evidenced,\n * including WHICH chain was retired, so the ordering can be reviewed and not merely trusted.\n /\nexport const AuditableEvent_User_SessionEvictedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_SESSION_EVICTED),\n userId: z.string(),\n /* Opaque identifier of the retired refresh chain. Never the token itself. /\n evictedJti: z.string(),\n /* When the retired chain was issued — the evidence that the OLDEST one went. Absent if unreadable. /\n evictedIssuedAt: z.date().optional(),\n /* The cap in force for this principal's user type at the moment of eviction. /\n configuredMaximum: z.number().int().positive(),\n /* How many chains remained after the eviction, so an over- or under-enforcing cap is visible. /\n retainedCount: z.number().int().nonnegative(),\n});\n\n/\n A `USERS` row was hard-deleted.\n \n The identity is gone after this event, so the record must carry enough to answer \"who was\n * removed?\" without joining back to a row that no longer exists — hence `email` alongside `userId`.\n * That is a deliberate, narrow retention of an identifier inside the audit trail: an erasure that\n * left no trace of having happened would defeat the purpose of the trail, and the audit store is\n * itself immutable and access-controlled. Prefer `RETAIN_AND_IMPERSONALIZE` erasure\n * (`eraseSubjectAsSystem`) over a hard delete wherever the retention contract allows it — this\n * event exists to make the hard-delete path, which the framework still exposes to administrators\n * through `USERS \| DELETE`, leave evidence.\n \n `deletedBy` is the acting principal, which for the admin route is NOT the subject. Mirrors\n * `AuditableEvent_Organization_DeletedEventDataSchema`.\n \n assurance-control: WILDO.DATA.SECURE_LIFECYCLE — identity destruction is a\n * security-relevant event and must be attributable.\n /\nexport const AuditableEvent_User_DeletedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_DELETED),\n userId: z.string(),\n email: z.string().optional(),\n deletedBy: z.string(),\n /* Roles the deleted principal held, so an auditor can see what authority was removed. /\n appRoles: z.array(z.string()).optional(),\n});\n\n/\n Application-role grant / revocation on a `USERS` row.\n \n Carries BOTH the before and after arrays rather than only the delta: an auditor reconstructing a\n * principal's authority at a point in time needs the resulting set, and the delta alone cannot\n * distinguish \"granted a role they already held\" (a no-op) from a real widening. `requestedRoles`\n * is what the administrator ASKED for — for an additive grant it is the delta, for a whole-array\n * rewrite through the core UPDATE it is the full authored set — which is also exactly the set the\n * role-ceiling gate measured, so the record shows what was checked, not just what resulted.\n \n `reason` is the administrator's free-text justification where the operation collects one\n * (`assign_roles` / `revoke_roles`); the core UPDATE path has no such field and omits it.\n /\nexport const AuditableEvent_User_AppRolesChangedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_APP_ROLES_CHANGED),\n /* The user whose authority changed — the SUBJECT, not the actor. /\n userId: z.string(),\n previousRoles: z.array(z.string()),\n newRoles: z.array(z.string()),\n /* The roles as AUTHORED by the caller (the set the role-ceiling gate was measured against). /\n requestedRoles: z.array(z.string()),\n /* Which write path produced the change — the operation identifier (`assign_roles`, `update`, …). /\n operation: z.string(),\n changedBy: z.string(),\n reason: z.string().optional(),\n});\n\n/\n The application has no administratively usable super-administrator.\n \n Emitted by the startup floor report, not by a write path — every write that could REACH this state\n * refuses instead, so an emission here is evidence the state arrived outside the guarded paths.\n \n `conferringRoles` is recorded because the answer depends on the LIVE role table: an application\n * that renames or drops a custom role carrying `inheritFrom: APP_ADMIN_SUPER_ADMIN` can breach the\n * floor without any user row changing, and an auditor reading the event a month later cannot\n * reconstruct which roles counted at boot without it.\n /\nexport const AuditableEvent_Application_SuperAdminFloorBreachedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.APPLICATION_SUPER_ADMIN_FLOOR_BREACHED),\n /* How many administratively usable super-administrators were found (expected: 0 when emitted). /\n usableSuperAdminCount: z.number(),\n /* The minimum the floor requires. /\n requiredUsableSuperAdminCount: z.number(),\n /* The role keys that conferred super-admin at boot, resolved from the live application role table. /\n conferringRoles: z.array(z.string()),\n /* The user statuses that counted as administratively usable. /\n usableStatuses: z.array(z.string()),\n});\n\n/\n A tenant left unadministrable by an allowed action.\n \n Carries the tenant, the memberships that stopped counting, and WHY the action was permitted, so an\n * auditor can tell a deliberate containment decision from an accident. `remainingUsableOwners` is\n * recorded rather than assumed zero: the floor's minimum is configurable, and an event that hard-codes\n * the consequence cannot be re-read against a changed policy.\n /\nexport const AuditableEvent_Organization_OwnerFloorBreachedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_OWNER_FLOOR_BREACHED),\n /* The tenant left with no administratively usable owner. /\n organizationId: z.string(),\n /* The owner-conferring memberships this action removed from the population. /\n reducedMemberIds: z.array(z.string()),\n /* How many usable owners remain (expected: 0 when emitted). /\n remainingUsableOwners: z.number(),\n /* The lifecycle verb that caused it — the operator-facing \"what did this\". /\n operationIdentifier: z.string(),\n /* The subject whose deactivation triggered it. /\n subjectUserId: z.string(),\n /* The status the subject moved to, so a reader need not infer usability from the verb alone. /\n subjectNextStatus: z.string(),\n});\n\n// Organization Member Event Data Schemas\nexport const AuditableEvent_OrganizationMember_InvitedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_MEMBER_INVITED),\n organizationId: z.string(),\n invitedUserId: z.string(),\n invitedBy: z.string(),\n roles: z.array(z.string()),\n email: z.email().optional(),\n});\n\nexport const AuditableEvent_OrganizationMember_JoinedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_MEMBER_JOINED),\n organizationId: z.string(),\n userId: z.string(),\n roles: z.array(z.string()),\n invitationId: z.string().optional(),\n});\n\nexport const AuditableEvent_OrganizationMember_UpdatedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_MEMBER_UPDATED),\n organizationId: z.string(),\n memberId: z.string(),\n changes: z.record(z.string(), z.any()),\n});\n\n/\n Organization-wide role grant / revocation on an `ORGANIZATION_MEMBERS` row.\n \n The ORGANIZATIONS-scope twin of {@link AuditableEvent_User_AppRolesChangedEventDataSchema}, and it\n * carries the same before/after/requested triple for the same reasons: an auditor reconstructing a\n * principal's authority at a point in time needs the RESULTING set, and the delta alone cannot\n * distinguish \"granted a role they already held\" from a real widening.\n \n ## Why `requestedRoles` is not redundant with `newRoles` here\n \n It matters MORE on this resource than on the application twin. Membership CREATE runs the authored\n * roles through resolution before persisting them — an organization type's `defaultMemberRole` is\n * injected when the caller authored none — so \"what the administrator asked for\" and \"what the\n * member ended up holding\" genuinely differ on an ordinary invite. `requestedRoles` is also exactly\n * the set the role-ceiling gate measured, so the record shows what was CHECKED, not only what\n * resulted. It is optional because \"the caller authored no roles at all\" (policy supplied them) is a\n * different fact from \"the caller explicitly authored an empty array\", and collapsing the two would\n * lose the distinction the ceiling gate itself draws.\n \n ## Why both `memberId` and `userId`\n \n `memberId` addresses the MEMBERSHIP ROW that was written; `userId` is the SUBJECT PRINCIPAL whose\n * authority changed. \"What could this person do on date X\" is a question about the principal, and\n * answering it through the row id alone requires a join that a retention sweep may already have\n * removed. `AuditableEvent_OrganizationMember_RemovedEventDataSchema` carries the same pair for the\n * same reason. `userId` stays optional so a degenerate row still leaves the rest of the evidence\n * rather than suppressing the whole record.\n /\nexport const AuditableEvent_OrganizationMember_RoleChangedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_MEMBER_ROLE_CHANGED),\n /* Tenant the membership belongs to. /\n organizationId: z.string(),\n /* The membership ROW that was written. /\n memberId: z.string(),\n /* The SUBJECT principal whose authority changed — not the actor. /\n userId: z.string().optional(),\n previousRoles: z.array(z.string()),\n newRoles: z.array(z.string()),\n /* The roles as AUTHORED by the caller (the set the role-ceiling gate measured). Absent when the caller authored none. /\n requestedRoles: z.array(z.string()).optional(),\n /* Which write path produced the change — the operation identifier (`create`, `update`, …). /\n operation: z.string(),\n changedBy: z.string(),\n});\n\n/\n Per-unit role assignment on an `ORGANIZATION_UNIT_MEMBERS` row.\n \n The NARROWED twin of {@link AuditableEvent_OrganizationMember_RoleChangedEventDataSchema}. A unit\n * assignment confers authority inside ONE organization unit — `appendUnitScopedRoles` emits it into\n * `initiatorRoles` carrying an `organizationUnitId` discriminator, and every consumer that unions\n * those entries partitions on that field first. The narrowing is what makes it not tenant-wide; it\n * does not make it un-auditable, so the grant leaves evidence on the same terms.\n \n ## Why singular `role`, not an array\n \n `OrganizationUnitMember` persists ONE role per (unit, member) — that uniqueness is its business\n * key. Reshaping it into an array here purely to mirror the organization-wide twin would invent a\n * cardinality the resource does not have and invite a future reader to assume multiple unit roles\n * are representable.\n \n `previousRole` is absent on an initial assignment, which is the honest encoding of \"there was no\n * prior grant\" — distinct from a re-assignment away from a role that did exist.\n /\nexport const AuditableEvent_OrganizationUnitMember_RoleChangedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_UNIT_MEMBER_ROLE_CHANGED),\n /* Tenant the assignment belongs to. /\n organizationId: z.string().optional(),\n /* The unit the role is narrowed to — the discriminator that keeps this grant from reading as tenant-wide. /\n organizationUnitId: z.string().optional(),\n /* The assignment ROW that was written. /\n assignmentId: z.string(),\n /* The membership the assignment hangs off — the bridge to the SUBJECT principal. /\n organizationMemberId: z.string().optional(),\n /* Absent on an initial assignment: there was no prior grant to record. /\n previousRole: z.string().optional(),\n newRole: z.string(),\n /* The role as AUTHORED by the caller (the value the role-ceiling gate measured). /\n requestedRole: z.string().optional(),\n /* Which write path produced the change — the operation identifier (`create`, `update`). /\n operation: z.string(),\n changedBy: z.string(),\n});\n\n/\n Revocation of a per-unit role assignment — the closing half of\n * {@link AuditableEvent_OrganizationUnitMember_RoleChangedEventDataSchema}.\n \n ## Why AUTHORIZATION rather than ORG_MANAGEMENT, unlike `ORGANIZATION_MEMBER_REMOVED`\n \n Removing an organization MEMBER is primarily a directory action — the person leaves the tenant —\n * and the authority they lose is a consequence of that. An assignment row has no directory aspect\n * whatsoever: it exists only to confer a role, so deleting it IS the revocation, and it is the exact\n * counterpart of the CREATE that granted it. Classifying it as record-keeping would leave an\n * authorization-filtered trail in which unit privileges are granted and never removed.\n \n ## Why the revoked role is captured\n \n `revokedRole` is the single field that cannot be recovered after the fact: the row is hard-deleted,\n * so nothing else in the system can answer \"what authority did this person lose\". It is deliberately\n * NOT named `previousRole` — that would imply a successor role, and there is none.\n \n ## Coverage boundary\n \n Emitted on the DIRECT assignment DELETE — the targeted revocation an operator performs and an\n * auditor reviews. Cascade removals (deleting the parent membership, or the whole organization) run\n * through the raw repository, which by construction does not execute service custom implementations;\n * those are evidenced by their own parent event, because the semantic act there is losing the\n * membership or the tenant, not revoking one unit role.\n /\nexport const AuditableEvent_OrganizationUnitMember_RemovedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_UNIT_MEMBER_REMOVED),\n /* Tenant the assignment belonged to. /\n organizationId: z.string().optional(),\n /* The unit the revoked role was narrowed to. /\n organizationUnitId: z.string().optional(),\n /* The assignment ROW that was deleted. /\n assignmentId: z.string(),\n /* The membership the assignment hung off — the bridge to the subject principal. /\n organizationMemberId: z.string().optional(),\n /* The authority that was removed. Unrecoverable once the row is gone, which is why it is recorded here. /\n revokedRole: z.string().optional(),\n removedBy: z.string(),\n});\n\nexport const AuditableEvent_OrganizationMember_StatusChangedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_MEMBER_STATUS_CHANGED),\n organizationId: z.string(),\n memberId: z.string(),\n previousStatus: z.string(),\n newStatus: z.string(),\n changedBy: z.string(),\n reason: z.string().optional(),\n});\n\n/\n Removal of an organization membership — by administrative DELETE, or by cancelling a pending\n * invitation through REVOKE.\n \n ## Why one event covers both, distinguished by `operation`\n \n They are genuinely different administrative acts — removing someone who works here versus\n * withdrawing an invitation that was never accepted — and an auditor must never confuse them. But\n * they are the same KIND of act (a membership ceases to exist) and share every other field, so\n * splitting them into two event types would fragment \"how did this person's membership end?\" across\n * two queries for no gain. `operation` carries the distinction, and `previousStatus` carries the\n * state the row was actually in, which `operation` alone cannot give: DELETE accepts any\n * non-`INVITED` status, so ACTIVE, INACTIVE and SUSPENDED removals are otherwise indistinguishable.\n \n An `INVITED` membership confers NOTHING — `execution-context-creator` builds `initiatorRoles` only\n * from `ACTIVE` memberships — so a REVOKE removes no live authority. It is still recorded, because\n * withdrawing someone's pending access is a directory decision an access review needs to see, and\n * because `ORGANIZATION_MEMBER_INVITED` would otherwise stand unanswered.\n \n ## Why `roles` is captured\n \n The row is hard-deleted, so afterwards nothing in the system can answer \"what authority did this\n * person hold when they were removed\". Same reasoning — and same shape — as\n * `AuditableEvent_User_DeletedEventDataSchema.appRoles`. On a REVOKE it records what the invitee\n * WOULD have received on acceptance.\n \n ## Category\n \n Classified ORG_MANAGEMENT rather than AUTHORIZATION, unlike `ORGANIZATION_UNIT_MEMBER_REMOVED`:\n * removing a MEMBER is a directory-lifecycle action whose authority loss is a consequence, whereas a\n * unit assignment row exists only to confer a role. The `roles` field is what keeps the authority\n * question answerable from an ORG_MANAGEMENT record.\n /\nexport const AuditableEvent_OrganizationMember_RemovedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_MEMBER_REMOVED),\n organizationId: z.string(),\n /* The membership ROW that was deleted. /\n memberId: z.string(),\n /* The SUBJECT principal who lost the membership. /\n removedUserId: z.string(),\n /\n The organization-wide roles the membership carried. Unrecoverable once the row is gone.\n * On a REVOKE these were never in force — they are what acceptance would have conferred.\n /\n roles: z.array(z.string()).optional(),\n /\n The row's status at removal.\n \n Deliberately `z.string()` rather than the `OrganizationMemberStatus` enum, matching\n * `AuditableEvent_OrganizationMember_StatusChangedEventDataSchema`: an audit row is a historical\n * record that must stay readable after the vocabulary evolves, so the strictness belongs at the\n * PRODUCER (which assigns from the enum), not at the record.\n /\n previousStatus: z.string().optional(),\n /* Which path ended the membership — `delete` (a real member) or `revoke` (a pending invitation). /\n operation: z.string(),\n /\n The per-unit grants this removal took with it.\n \n `ORGANIZATION_UNIT_MEMBERS` is a composition child of the membership, so deleting the membership\n * cascades to every assignment — through the RAW REPOSITORY, below the service tier, where no\n * custom implementation runs and therefore no `ORGANIZATION_UNIT_MEMBER_REMOVED` can fire. Without\n * this field the trail would show each unit grant being made and never revoked: the assignment rows\n * are hard-deleted, so the lost authority is not reconstructible from data either.\n \n Carried here rather than emitted per row on purpose — one membership removal is ONE decision, and\n * a teardown that fans out into a dozen revocation events buries it. Captured in the DELETE prefix,\n * which is the last moment the assignments still exist.\n /\n revokedUnitAssignments: z.array(z.object({\n organizationUnitId: z.string(),\n role: z.string(),\n })).optional(),\n /\n Who ended the membership — a user id, or an {@link AuditActorSentinel}.\n \n ## Reading it: `operation: 'revoke'` has THREE causes, told apart HERE\n \n `operation` says a pending invitation ended; it does not say why. Three different acts produce\n * an identical `revoke`, and the distinction between them is exactly what an access review needs:\n \n \| Cause \| How to recognise it \|\n * \|---\|---\|\n * \| The invitee DECLINED \| `removedBy === removedUserId` — the subject is the actor \|\n * \| An administrator CANCELLED it \| `removedBy` is a real user id, and a different one \|\n * \| It EXPIRED unanswered \| `removedBy === AuditActorSentinel.SYSTEM` (the stale-invitation sweep) \|\n \n This is why the decline path supplies an on-behalf-of principal rather than running anonymously.\n * A decline necessarily executes under BORROWED authority — the invitee has no standing to revoke\n * an organization membership — and a borrowed-authority context carries no initiator user id, so\n * the actor previously resolved to `SYSTEM`: an active refusal and a silent expiry wrote\n * byte-identical rows. Recording the acting principal separates all three with no extra event type,\n * which is the same economy `operation` and `previousStatus` already buy above.\n \n A reader must therefore not treat `removedBy === SYSTEM` on a `revoke` as \"unknown actor\". It is\n * a positive statement that no human ended this invitation.\n /\n removedBy: z.string(),\n /\n The justification. Declared by REVOKE for exactly this purpose and supplied by an administrator\n * cancelling an invitation; on a decline it carries the invitee's optional reason, and the expiry\n * sweep supplies none. Absent, therefore, on most declines — do not read its absence as a cause.\n /\n reason: z.string().optional(),\n});\n\n// Organization Lifecycle Event Data Schemas\nexport const AuditableEvent_Organization_CreatedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_CREATED),\n organizationId: z.string(),\n name: z.string(),\n slug: z.string(),\n createdBy: z.string(),\n});\n\nexport const AuditableEvent_Organization_UpdatedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_UPDATED),\n organizationId: z.string(),\n changes: z.record(z.string(), z.any()),\n updatedBy: z.string(),\n});\n\nexport const AuditableEvent_Organization_DeletedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_DELETED),\n organizationId: z.string(),\n name: z.string(),\n slug: z.string(),\n deletedBy: z.string(),\n reason: z.string().optional(),\n});\n\n/\n A tenant was MARKED for deletion — the soft-delete half of tenant teardown.\n \n Kept SEPARATE from {@link AuditableEvent_Organization_DeletedEventDataSchema} rather than folded\n * into it with a flag, because the two record genuinely different facts and an auditor must not\n * have to infer which one happened. This event says the tenant's access was revoked and its data\n was scheduled for destruction; `ORGANIZATION_DELETED` says the data is gone. Between them sits\n a retention window in which the decision is still reversible, and a single merged event would\n * make \"was this tenant's data actually destroyed?\" unanswerable without correlating timestamps.\n \n It is also the evidence for the AUTHORIZATION consequence, which lands here and not at the purge:\n * user types revoked and tokens invalidated. `revokedUserTypeCount` records the blast radius of that\n * revocation without naming the users — the per-user detail belongs to the user-type events, and\n * duplicating identities into a tenant-scoped record would widen the personal data this row holds.\n \n assurance-control: WILDO.DATA.SECURE_LIFECYCLE — scheduling the destruction\n * of a tenant is a security-relevant, attributable decision that must leave evidence even when it\n * is later reversed.\n /\nexport const AuditableEvent_Organization_DeletionRequestedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_DELETION_REQUESTED),\n organizationId: z.string(),\n name: z.string(),\n slug: z.string(),\n /* The ACTOR. On the `admin` variant they are not a member of the tenant being marked. /\n requestedBy: z.string(),\n /* When the purge batch becomes allowed to destroy the tenant — the promise made to it. /\n purgeScheduledAt: z.string(),\n /* How many users lost at least one global `userTypes` grant as a result of the mark. /\n revokedUserTypeCount: z.number().int().min(0),\n reason: z.string().optional(),\n});\n\n/\n A pending tenant deletion was CANCELLED inside its retention window.\n \n The closing half of {@link AuditableEvent_Organization_DeletionRequestedEventDataSchema}. Without\n * it the audit trail records every scheduled destruction and none of the reversals, so a tenant\n * that was marked and restored a year ago still reads as pending destruction — and an access review\n * asking \"why does this tenant have live members again?\" has no answer on record.\n \n assurance-control: WILDO.ACCESS.LIFECYCLE — restoring access is as attributable as removing it.\n /\nexport const AuditableEvent_Organization_RestoredEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_RESTORED),\n organizationId: z.string(),\n name: z.string(),\n slug: z.string(),\n /* The ACTOR — always a platform super-administrator; a marked tenant cannot restore itself. /\n restoredBy: z.string(),\n /* The status the tenant was returned to. /\n restoredStatus: z.string(),\n /* How many users had at least one global `userTypes` grant re-granted by the restore. /\n regrantedUserTypeCount: z.number().int().min(0),\n reason: z.string().optional(),\n});\n\n/\n The tenant was administratively HALTED — every member loses their organization roles.\n \n ## Why this is its own event rather than an `ORGANIZATION_UPDATED`\n \n Suspension is not a field edit. Since the tenant-status authority gate shipped, `SUSPENDED` is a\n * state in which a membership confers NOTHING — so this single write revokes the access of every\n * member of the tenant at once. Folding that into the generic update event would bury an\n * organization-wide access revocation inside a `changes` map, exactly where an access review would\n * not look for it.\n \n `suspensionReason` is REQUIRED, mirroring the request contract, because the reason is the whole\n * evidentiary point: an auditor asking \"why was this tenant halted?\" must not get a shrug.\n * `notifiedMembers` records whether the tenant was told — a deliberately quiet suspension is a\n * legitimate operator choice and one a reviewer needs to be able to see.\n \n assurance-control: WILDO.AUDIT.SECURITY_EVENT — organization-wide access\n * revocation must be attributable, justified, and evidenced.\n /\nexport const AuditableEvent_Organization_SuspendedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_SUSPENDED),\n organizationId: z.string(),\n name: z.string(),\n slug: z.string(),\n /* The ACTOR — always a platform super-administrator; a tenant cannot suspend itself. /\n suspendedBy: z.string(),\n /* The status the tenant was halted FROM, so the transition is legible without a second lookup. /\n previousStatus: z.string(),\n suspensionReason: z.string(),\n /* Whether the tenant's members were emailed. A quiet suspension is a choice worth recording. /\n notifiedMembers: z.boolean(),\n /\n How many users lost at least one GLOBAL `userTypes` grant because this tenant stopped counting.\n \n A suspension does not only halt the tenant: a membership in a non-authority-conferring\n * organization no longer justifies a membership-derived global grant, so suspending an\n * organization can withdraw what it was vouching for platform-wide. That reach is exactly what an\n * access review needs to see, and it is invisible from the status change alone.\n /\n revokedUserTypeCount: z.number().int().min(0),\n});\n\n/\n A halted or expired tenant was returned to normal operation — the inverse of\n * {@link AuditableEvent_Organization_SuspendedEventDataSchema}.\n \n Restoring organization-wide access is as security-relevant as removing it, and without this event\n * the trail would record every suspension and none of the lifts — leaving a tenant that was halted\n * and reinstated a year ago still reading as suspended.\n \n `previousStatus` distinguishes the two journeys this operation serves: lifting a suspension\n * (`SUSPENDED`) and converting an expired trial (`TRIAL_EXPIRED`). They land on the same state and\n * are not the same event to a reviewer.\n \n assurance-control: WILDO.AUDIT.SECURITY_EVENT — reinstatement of access is attributable.\n /\nexport const AuditableEvent_Organization_ActivatedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_ACTIVATED),\n organizationId: z.string(),\n name: z.string(),\n slug: z.string(),\n /* The ACTOR — always a platform super-administrator. /\n activatedBy: z.string(),\n /* `SUSPENDED` (a lift) or `TRIAL_EXPIRED` (a conversion) — not the same journey. /\n previousStatus: z.string(),\n /* How many users had at least one global `userTypes` grant restored by the reactivation. /\n regrantedUserTypeCount: z.number().int().min(0),\n reason: z.string().optional(),\n});\n\n/\n One user type's authentication-policy snapshot — the COMPLETE authored `UserTypeAuthPolicy` (MFA,\n * password, lockout, enabled auth methods, step-up, session duration, …) as recorded in the trail.\n \n The whole policy is captured, not a hand-picked subset, so no posture axis escapes the record: a\n * weakening is as easily \"disable the MFA auth method\" (`authMethodsEnabled`) or \"drop step-up\"\n * (`stepUpAuth`) as \"turn `requireMFA` off\". The policy carries only booleans / numbers / enums —\n * never a secret — so recording it verbatim discloses nothing sensitive.\n \n Deliberately STRUCTURAL (an open record) rather than a reference to the live `UserTypeAuthPolicy`\n * config schema. An audit record is a historical fact: it must keep validating after the config\n * schema evolves, so it stores the policy as it was at that boot rather than re-validating it against\n * today's shape. The queryable summary lives in `changedUserTypes` + `snapshotDigest`; this object\n * carries the human-readable before/after detail.\n /\nexport const ApplicationAuthPolicySnapshotSchema = z.record(z.string(), z.unknown());\n\n/\n The application's authored authentication policy changed between two boots.\n \n The per-user-type authentication policy (`userTypes.<type>.auth` — MFA, password, and lockout\n * requirements) is STATIC application configuration authored in code and taken into effect at backend\n * startup. A change to it — most consequentially a WEAKENING such as turning MFA off — is a\n * security-posture decision that, before this event, left no product-side record: only the source\n * history showed it. This event closes that gap.\n \n It is emitted at boot, by the system, when the resolved policy snapshot differs from the last one\n * recorded in the trail (detected by comparing against the most recent event of this type for the\n * application). Because there is no human actor at boot, the \"who\" is the deployment/source history;\n * the event records WHAT changed (before → after per user type) so a reviewer sees the posture shift\n * without reading the codebase.\n \n Scope note: this is the per-application AUTHORED baseline. It does NOT enumerate per-tenant\n * `authOverrides` (which are per-(user-type × org-type) and require live tenants to resolve), nor the\n * authenticate-time `FALLBACK_AUTH_POLICY` (a runtime substitute used only when no user type\n * resolves, not authored config).\n \n assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — a change to the authentication assurance\n * requirements (MFA / password / lockout) must be attributable and evidenced.\n /\nexport const AuditableEvent_ApplicationAuthPolicyChanged_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.APPLICATION_AUTH_POLICY_CHANGED),\n applicationId: z.string(),\n /* Which user types' policies differed from the previously-recorded snapshot. Sorted, non-empty. /\n changedUserTypes: z.array(z.string()),\n /\n A stable digest of the `after` snapshot. Boot change-detection compares the current digest\n * against the digest carried by the most recent recorded event of this type; equal digests are the\n * signal to emit nothing, so the trail carries one row per genuine change, not one per boot.\n /\n snapshotDigest: z.string(),\n /\n The previously-recorded per-user-type policy snapshot, or `null` when this is the first snapshot\n * ever recorded for the application (the baseline row). Keys are user-type identifiers.\n /\n before: z.record(z.string(), ApplicationAuthPolicySnapshotSchema).nullable(),\n /* The per-user-type policy snapshot that took effect at this boot. Keys are user-type identifiers. /\n after: z.record(z.string(), ApplicationAuthPolicySnapshotSchema),\n});\n\n/\n A governed lifecycle transition changed a subject's `status`.\n \n Emitted by the shared status-transition implementation, so every verb it serves is trailed by\n * construction and a future one inherits the trail rather than having to remember it. Before this\n * existed those verbs emitted NOTHING: suspending a member (CRITICAL) or a user (HIGH) left no\n * record at all, while suspending a TENANT was fully attributable — an asymmetry an access review\n * would have to discover the hard way.\n \n `reason` is where the verbs' long-declared `reason` / `suspensionReason` fields finally land.\n * They are not persisted on the row: a suspension reason is a compliance artefact nothing reads\n * back, so the trail is its home rather than a schema column that would have to be scrubbed on\n * erasure.\n \n assurance-control: WILDO.AUDIT.SECURITY_EVENT — a change to whether a principal may act must be\n * attributable, justified and evidenced, on every resource that has such a state.\n /\nexport const AuditableEvent_Resource_StatusTransitionPerformedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.RESOURCE_STATUS_TRANSITION_PERFORMED),\n /* Which resource the subject row belongs to — half of the verb discriminator. /\n resourceType: z.string(),\n /* The lifecycle verb that ran (`suspend`, `reactivate`, `suspend_user`, …). /\n operationIdentifier: z.string(),\n /* The row whose status changed. /\n subjectId: z.string(),\n /* The ACTOR who performed it, or the system principal when the reactivation sweep ran it. /\n performedBy: z.string(),\n /* The status transitioned FROM, so the change is legible without a second lookup. /\n previousStatus: z.string(),\n /* The status transitioned TO. /\n newStatus: z.string(),\n /* The caller's justification, where the verb's contract accepts one. /\n reason: z.string().optional(),\n /\n When an automated sweep will undo this, if the caller time-boxed it. ISO-8601.\n \n Recorded because \"suspended for 7 days\" and \"suspended indefinitely\" are materially different\n * decisions that would otherwise be indistinguishable in the trail.\n /\n scheduledReactivationAt: z.string().optional(),\n /* Present when the subject is tenant-scoped, so the trail routes to that tenant's SIEM. /\n organizationId: z.string().optional(),\n});\n\nexport const AuditableEvent_OrganizationNotifications_UpdatedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_NOTIFICATIONS_UPDATED),\n organizationId: z.string(),\n notificationsId: z.string(),\n changes: z.record(z.string(), z.any()),\n updatedBy: z.string(),\n});\n\nexport const AuditableEvent_OrganizationPreferences_UpdatedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_PREFERENCES_UPDATED),\n organizationId: z.string(),\n preferencesId: z.string(),\n changes: z.record(z.string(), z.any()),\n updatedBy: z.string(),\n});\n\nexport const AuditableEvent_OrganizationProfile_UpdatedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_PROFILE_UPDATED),\n organizationId: z.string(),\n profileId: z.string(),\n changes: z.record(z.string(), z.any()),\n updatedBy: z.string(),\n});\n\nexport const AuditableEvent_OrganizationUnit_UpdatedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_UNIT_UPDATED),\n organizationId: z.string(),\n unitId: z.string(),\n changes: z.record(z.string(), z.any()),\n updatedBy: z.string(),\n});\n\n// SSO Authentication Event Data Schemas\n\nexport const AuditableEvent_User_SSOLoginEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_SSO_LOGIN),\n userId: z.string(),\n email: z.email(),\n providerRef: z.string(),\n connectionType: z.enum(SsoConnectionType),\n authSource: z.string().optional(),\n scopeType: z.enum(AuthScopeType).optional(),\n organizationId: z.string().optional(),\n applicationId: z.string().optional(),\n ipAddress: z.string(),\n userAgent: z.string(),\n sessionId: z.string(),\n}).superRefine((event, ctx) => {\n if (event.connectionType === SsoConnectionType.SOCIAL) {\n if (\n event.scopeType !== undefined\n \|\| event.organizationId !== undefined\n \|\| event.applicationId !== undefined\n ) {\n ctx.addIssue({\n code: 'custom',\n path: ['scopeType'],\n message: 'Social SSO audit events must not carry enterprise scope',\n });\n }\n return;\n }\n\n const hasOrganizationScope =\n event.scopeType === AuthScopeType.ORGANIZATION\n && event.organizationId !== undefined\n && event.applicationId === undefined;\n const hasApplicationScope =\n event.scopeType === AuthScopeType.APPLICATION\n && event.applicationId !== undefined\n && event.organizationId === undefined;\n if (!hasOrganizationScope && !hasApplicationScope) {\n ctx.addIssue({\n code: 'custom',\n path: ['scopeType'],\n message: 'Enterprise SSO audit events require exactly one explicit tenant scope',\n });\n }\n});\n\nexport const AuditableEvent_User_SSOLoginFailedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_SSO_LOGIN_FAILED),\n email: z.email().optional(),\n providerRef: z.string().optional(),\n connectionType: z.enum(SsoConnectionType).optional(),\n authSource: z.string().optional(),\n failureReason: z.string(),\n scopeType: z.enum(AuthScopeType).optional(),\n organizationId: z.string().optional(),\n applicationId: z.string().optional(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\nexport const AuditableEvent_User_SSOEnforcementBlockedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_SSO_ENFORCEMENT_BLOCKED),\n email: z.email(),\n attemptedProviderRef: z.string(),\n attemptedConnectionType: z.enum(SsoConnectionType),\n organizationId: z.string(),\n enforcementPolicy: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\nexport const AuditableEvent_User_TokenRefreshedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_TOKEN_REFRESHED),\n userId: z.string(),\n sessionId: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n// Organization Security Management Event Data Schemas\n\nexport const AuditableEvent_Organization_SSOConfigurationChangedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_SSO_CONFIGURATION_CHANGED),\n organizationId: z.string(),\n changedBy: z.string(),\n changeType: z.enum(SsoConfigChangeType),\n affectedProviderRef: z.string().optional(),\n changes: z.record(z.string(), z.any()).optional(),\n});\n\n\n\nexport const AuditableEvent_Organization_SIEMExportConfiguredEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_SIEM_EXPORT_CONFIGURED),\n organizationId: z.string(),\n changedBy: z.string(),\n changeType: z.enum(SiemExportChangeType),\n webhookUrlDomain: z.string().optional(),\n eventFormatConfigured: z.string().optional(),\n});\n\n\n\n// Outbound M2M Webhook Event Data Schemas\n\n/\n One `webhookConfig.testEndpoint` attempt — an admin causing the platform to open an\n * outbound connection to an operator-supplied URL.\n \n Recorded for EVERY attempt, not only failures: the security signal here is the pattern\n * (who probes which hosts, how often), which a SIEM can only derive if successes are\n * present too. `outcome` distinguishes a refusing endpoint from an unreachable one from a\n * local signing fault, so the stream stays diagnosable without the response body.\n \n `destinationHost` carries the host only, never the full URL — mirroring\n * `AuditableEvent_Organization_SIEMExportConfiguredEventDataSchema.webhookUrlDomain`. Paths\n * and query strings on customer endpoints routinely embed per-tenant tokens, and an audit\n * row is replicated to the org SIEM and the immutable store.\n /\nexport const AuditableEvent_Webhook_EndpointTestDispatchedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.WEBHOOK_ENDPOINT_TEST_DISPATCHED),\n /* Scope that owns the config — exactly one of these is set, per the polymorphic variant. /\n organizationId: z.string().optional(),\n applicationId: z.string().optional(),\n /* Admin who fired the probe. /\n dispatchedBy: z.string(),\n endpointId: z.string(),\n /* Host component only — see the schema JSDoc for why the full URL is withheld. /\n destinationHost: z.string(),\n outcome: z.enum(WebhookEndpointProbeOutcome),\n responseStatus: z.number().int().optional(),\n durationMs: z.number().int().nonnegative(),\n /* `jti` of the signed probe, for correlation with the consumer's own logs. /\n signatureJti: z.string(),\n});\n\n\n\n// SCIM Directory Provisioning Event Data Schemas\n\nexport const AuditableEvent_SCIM_TokenCreatedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.SCIM_TOKEN_CREATED),\n organizationId: z.string(),\n tokenDisplayName: z.string(),\n createdByUserId: z.string(),\n expiresAt: z.string().optional(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\nexport const AuditableEvent_SCIM_TokenRevokedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.SCIM_TOKEN_REVOKED),\n organizationId: z.string(),\n tokenDisplayName: z.string(),\n revokedByUserId: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\n// SCIM User Provisioning Event Data Schemas (H5+H8)\n\nexport const AuditableEvent_SCIM_UserProvisionedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.SCIM_USER_PROVISIONED),\n organizationId: z.string(),\n userId: z.string(),\n email: z.string(),\n isNewUser: z.boolean(),\n provisionedVia: z.string(),\n authSource: z.string().optional(),\n});\n\n\n\nexport const AuditableEvent_SCIM_UserUpdatedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.SCIM_USER_UPDATED),\n organizationId: z.string(),\n userId: z.string(),\n operation: z.string(),\n updatedAttributes: z.array(z.string()).optional(),\n});\n\n\n\nexport const AuditableEvent_SCIM_UserDeactivatedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.SCIM_USER_DEACTIVATED),\n organizationId: z.string(),\n userId: z.string(),\n email: z.string().optional(),\n});\n\n\n\n// Password Reset Event Data Schemas (H5)\n\nexport const AuditableEvent_User_PasswordResetRequestedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_PASSWORD_RESET_REQUESTED),\n email: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n/\n Administrator-compelled credential reset.\n \n Carries BOTH identities because the actor and the subject differ — that separation is the\n * whole point of the event. `actorUserId` is read from the authenticated execution context,\n * never from request input, so it cannot be spoofed by the caller. `reason` is the operator's\n * mandatory justification; it is what an auditor reads when asking why a credential was reset\n * out-of-band.\n \n assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — privileged credential\n * intervention must be attributable to the acting administrator and carry a justification.\n /\nexport const AuditableEvent_User_PasswordResetForcedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_PASSWORD_RESET_FORCED),\n targetUserId: z.string(),\n targetEmail: z.string(),\n actorUserId: z.string(),\n reason: z.string(),\n /* Whether the target's active sessions were revoked as part of the reset. /\n sessionsRevoked: z.boolean(),\n /\n Transport metadata, OPTIONAL because this event's only producer is a resource operation.\n \n The auth controllers thread `ipAddress` / `userAgent` down from the Express request, but a\n * resource-operation custom implementation receives an `ExecutionContext`, which carries\n * identity and no transport detail. Rather than stamping a fabricated `'unknown'` that reads\n * like a captured value, the fields are omitted and correlation runs through the request log.\n * They become populated if transport metadata is ever threaded onto the execution context.\n /\n ipAddress: z.string().optional(),\n userAgent: z.string().optional(),\n});\n\n\n\nexport const AuditableEvent_User_PasswordResetCompletedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_PASSWORD_RESET_COMPLETED),\n userId: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\n// Registration & Verification Event Data Schemas (H5)\n\nexport const AuditableEvent_User_RegisteredEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_REGISTERED),\n userId: z.string(),\n email: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\nexport const AuditableEvent_User_EmailVerifiedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_EMAIL_VERIFIED),\n userId: z.string(),\n email: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\nexport const AuditableEvent_User_VerificationEmailResentEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_VERIFICATION_EMAIL_RESENT),\n userId: z.string(),\n email: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\n// MFA Lifecycle Event Data Schemas (H5)\n\nexport const AuditableEvent_User_MFASetupStartedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_MFA_SETUP_STARTED),\n userId: z.string(),\n mfaMethod: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\nexport const AuditableEvent_User_MFASetupCompletedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_MFA_SETUP_COMPLETED),\n userId: z.string(),\n mfaMethod: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\nexport const AuditableEvent_User_MFAEmailOTPSentEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_MFA_EMAIL_OTP_SENT),\n email: z.string(),\n sessionId: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\n// WebAuthn/Passkey Event Data Schemas (Phase G1)\n\nexport const AuditableEvent_User_PasskeyRegisteredEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_PASSKEY_REGISTERED),\n userId: z.string(),\n email: z.string(),\n credentialId: z.string(),\n credentialName: z.string(),\n credentialDeviceType: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\nexport const AuditableEvent_User_PasskeyAuthSuccessEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_PASSKEY_AUTHENTICATION_SUCCESS),\n userId: z.string(),\n email: z.string(),\n credentialId: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n sessionId: z.string(),\n});\n\n\n\nexport const AuditableEvent_User_PasskeyAuthFailureEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_PASSKEY_AUTHENTICATION_FAILURE),\n email: z.string(),\n failureReason: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n sessionId: z.string(),\n});\n\n\n\nexport const AuditableEvent_User_PasskeyRemovedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_PASSKEY_REMOVED),\n userId: z.string(),\n email: z.string(),\n credentialId: z.string(),\n credentialName: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\n// Magic Link Event Data Schemas (Phase G2)\n\nexport const AuditableEvent_User_MagicLinkSentEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_MAGIC_LINK_SENT),\n email: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\nexport const AuditableEvent_User_MagicLinkVerifiedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_MAGIC_LINK_VERIFIED),\n userId: z.string(),\n email: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n sessionId: z.string(),\n});\n\n\n\nexport const AuditableEvent_User_MagicLinkFailedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_MAGIC_LINK_FAILED),\n email: z.string().optional(),\n failureReason: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\n// SMS OTP Event Data Schemas (Phase G2)\n\nexport const AuditableEvent_User_SMSOTPSentEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_SMS_OTP_SENT),\n phoneNumber: z.string(),\n factorLevel: z.string(),\n sessionId: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\nexport const AuditableEvent_User_SMSOTPVerifiedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_SMS_OTP_VERIFIED),\n userId: z.string(),\n phoneNumber: z.string(),\n factorLevel: z.string(),\n sessionId: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\nexport const AuditableEvent_User_SMSOTPFailedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_SMS_OTP_FAILED),\n phoneNumber: z.string().optional(),\n factorLevel: z.string(),\n failureReason: z.string(),\n sessionId: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\n// Phone Verification Event Data Schemas (Phase G2)\n\nexport const AuditableEvent_User_PhoneVerifiedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_PHONE_VERIFIED),\n userId: z.string(),\n phoneNumber: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\nexport const AuditableEvent_User_PhoneVerificationFailedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_PHONE_VERIFICATION_FAILED),\n phoneNumber: z.string(),\n failureReason: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\n// OAuth2 Provider Restriction Event Data Schema (Phase G3)\n\nexport const AuditableEvent_OAuth2ProviderBlockedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.OAUTH2_PROVIDER_BLOCKED),\n email: z.string().optional(),\n providerRef: z.string(),\n scopeType: z.enum(AuthScopeType),\n organizationId: z.string().optional(),\n applicationId: z.string().optional(),\n reason: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n}).superRefine((event, ctx) => {\n const hasOrganizationScope =\n event.scopeType === AuthScopeType.ORGANIZATION\n && event.organizationId !== undefined\n && event.applicationId === undefined;\n const hasApplicationScope =\n event.scopeType === AuthScopeType.APPLICATION\n && event.applicationId !== undefined\n && event.organizationId === undefined;\n if (!hasOrganizationScope && !hasApplicationScope) {\n ctx.addIssue({\n code: 'custom',\n path: ['scopeType'],\n message: 'OAuth2 provider-blocked events require exactly one explicit tenant scope',\n });\n }\n});\n\nexport type AuditableEvent_OAuth2ProviderBlockedEventData = z.infer<typeof AuditableEvent_OAuth2ProviderBlockedEventDataSchema>;\n\n// Emergency Access Event Data Schema\n\nexport const AuditableEvent_EmergencyAccess_UsedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.EMERGENCY_ACCESS_USED),\n userId: z.string(),\n email: z.email(),\n organizationId: z.string(),\n reason: z.string().optional(),\n ipAddress: z.string(),\n userAgent: z.string(),\n sessionId: z.string(),\n});\n\n\n\nexport const AuditableEvent_FieldAccess_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.FIELD_ACCESS),\n fieldName: z.string(),\n resourceType: z.string(),\n resourceId: z.string().optional(),\n operationIdentifier: z.string(),\n isCreateOperation: z.boolean(),\n // Machine-credential provenance when the ACCESSING principal is a machine (api-key / OAuth\n // client) rather than a human. Absent for user-authenticated access. Threads the credential id\n // + auth method onto the sensitive-field-access row so machine access is attributable — the\n // per-request counterpart to the dedicated MACHINE_AUTH_ events (machine-auth-hardening item 2).\n machineCredentialAuthMethod: z.string().optional(),\n machineCredentialId: z.string().optional(),\n});\n\n/*\n A resource operation took effect. The operation-triggered counterpart to\n * {@link AuditableEvent_FieldAccess_EventDataSchema}, which is triggered by a decorated RESPONSE\n * FIELD and is therefore blind to any operation whose response carries none.\n \n ## What the existence of this row asserts, and what it does not\n \n It is emitted from the framework-managed POST-COMMIT effects lane, so the row exists only for an\n * operation whose mutation is already durable. \"Performed\" is therefore the whole claim — there is\n * deliberately no `outcome` discriminator, because this emission point can never observe a failure.\n \n The absence of a row is NOT evidence that nothing happened; that is what makes audit-pipeline\n * failure detection (`audit_store_failure_total`, and the operation identity now carried on the\n * failure log line) a control in its own right rather than an operational nicety.\n \n Refusals are a different event and a different chokepoint. A denied operation never reaches\n * this lane — the authorization decision happens pre-dispatch, its volume is attacker-drivable, and\n * it needs rate-limit / dedup treatment this success path does not. Declaring a `DENIED` outcome\n * here that nothing produces would repeat the very defect this event exists to fix (20 event types\n * were authored in this enum and wired to nothing). That refusal event now exists and is emitted:\n * see {@link AuditableEvent_ResourceOperationDenied_EventDataSchema}, raised from the authorizer.\n * The two events are read together — this one for what happened, that one for what was stopped —\n * and neither carries an `outcome` discriminator, because each states its whole claim in its name.\n \n ## Operation identity is a TRIPLE\n \n `resourceType` + `operationIdentifier` + `variantKey`. Recording only the first two makes an\n * `admin` variant indistinguishable from a `self` variant — a distinction several polymorphic\n * resources encode in `variantKey` alone, and precisely the distinction an auditor is checking.\n \n ## Correlation across a cascade\n \n Every execution surface emits — API, internal call, and repository-only — so one tenant deletion\n * produces one row per cascaded child. The top-level `correlationId` is inherited by every sub-call\n * context and preserved across mid-flight operation corrections, so it groups the whole fan-out to one request;\n * `subCallDepth` separates the initiating operation (0) from what it cascaded into.\n \n ## Field evidence is deliberately partial (GDPR Art. 5(1)(c) + Art. 17)\n \n `changedFields` names every field the write touched — a field NAME is not personal data, so it is\n * always safe and always recorded. `fieldEvidence` carries before/after VALUES only for fields the\n * schema marks `.isAuditEvidence()`.\n \n Values are limited on purpose: audit rows replicate to the per-org SIEM and to the immutable\n * ledger, and the immutable ledger cannot be scrubbed — so copying arbitrary personal data into\n * this event would manufacture an unerasable duplicate, in direct conflict with Art. 17 and with the\n * impersonalization/retention capability built to make personal data erasable. Authority-, status-\n * and scope-bearing values ARE necessary (a role change that does not record the old and new roles\n * proves nothing), and those are exactly what the marker is for.\n \n assurance-control: WILDO.AUDIT.EVIDENCE_INTEGRITY\n /\nexport const AuditableEvent_ResourceOperationPerformed_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.RESOURCE_OPERATION_PERFORMED),\n\n // ── Operation identity (the triple + the shape that resolves the persistence semantics) ──\n /* The resource whose row(s) the operation acted on. /\n resourceType: z.string(),\n /* The verb — a core operation (`update`, `delete`) or a custom identifier (`suspend`). /\n operationIdentifier: z.string(),\n /* Which execution surface ran it. API, internal call, repository-only, cron, batch. /\n variantType: z.enum(ResourceOperationVariantType),\n /\n The variant discriminator. Absent on the default variant; REQUIRED to distinguish e.g. the\n * `admin` variant of a verb from its `self` twin, which share `operationIdentifier`.\n /\n variantKey: z.string().optional(),\n /* The core persistence semantics a custom verb borrows. Absent when the verb IS a core operation. /\n resourceOperationLike: z.enum(CoreResourceOperation).optional(),\n /* `true` for the bulk form, whose subject is a set rather than one row. /\n isBulkOperation: z.boolean().optional(),\n\n // ── Subject ──\n /* The row acted on. Absent for bulk operations, which name a count instead. /\n resourceId: z.string().optional(),\n /* Bulk operations only: how many rows the write affected. /\n affectedRecordCount: z.number().optional(),\n\n // ── Principal (the row's `userId` / `organizationId` / `applicationId` carry the identity) ──\n /\n The caller's roles AS THEY WERE at decision time. Roles are the framework's single\n * authorization axis, so without them a reader cannot tell whether the actor was entitled to the\n * action — and the actor's roles today are not the roles they held then.\n /\n initiatorRoles: z.array(z.string()),\n /* How the call was initiated — separates a human request from framework machinery. /\n executionType: z.enum(ExecutionContext_ExecutionType),\n /* Machine-credential provenance when the principal is a machine rather than a human. /\n machineCredentialAuthMethod: z.string().optional(),\n machineCredentialId: z.string().optional(),\n\n // ── Cascade depth (the request that groups the whole cascade is the row's top-level `correlationId`) ──\n /* `0` for the operation the caller invoked; deeper for what it cascaded into. /\n subCallDepth: z.number(),\n\n // ── Effect ──\n /* Every field the write touched. Names only — always safe, always recorded. /\n changedFields: z.array(z.string()).optional(),\n /\n Before/after values, restricted to fields marked `.isAuditEvidence()`. `before` is absent on a\n * CREATE (there was no prior value) and on any bulk write (the framework fetches a pre-image only\n * for a single selected id).\n /\n fieldEvidence: z\n .record(\n z.string(),\n z.object({\n before: z.unknown().optional(),\n after: z.unknown().optional(),\n }),\n )\n .optional(),\n});\n\n/\n An operation the authorizer REFUSED. The other half of \"record access decisions\" — the negative\n * decision, which until now left no trace anywhere in the framework.\n \n ## Emitted pre-dispatch, from the one funnel\n \n Every public entry point of `AuthorizationsBackendService` converges on the same two inner phase\n * runners — `authorizeInController` (HTTP controller, MCP, WebSocket, queue, field validation),\n * `authorizeInProgrammaticSurface` (a non-controller surface that faces an external caller), and\n * `authorizeInRepositoryAndService`, which has exactly one caller — `authorizeInController` itself.\n * So a single instrumentation point observes every refusal THE AUTHORIZER MAKES, with the operation\n * and execution context both in scope. No mutation has occurred when this row is written; nothing is\n * rolled back by it.\n \n The scope of that claim, stated because an earlier revision overstated it. It used to read\n * \"the sole production entry point for every execution surface\", which asserts something stronger\n * and false: that every execution surface passes the role gate. A programmatic operation entering at\n * the SERVICE tier (`ServicesRegistryHandlerBackendService.read` / `list` / …) reaches no authorizer\n * at all — deliberately, because that population includes the reads that ESTABLISH identity before a\n * role-bearing principal exists. So the absence of a row here means \"the authorizer refused nothing\",\n * never \"nothing was read\". See `AuthorizationsBackendService.authorizeInProgrammaticSurface` for the\n * layering decision and the door.\n \n ## What it is NOT\n \n - Not an authentication failure. `USER_LOGIN_FAILED` / `MACHINE_AUTH_FAILED` say \"you are not\n * who you claim to be\". This says \"you are, and you may not do this\". Distinct types, distinct\n * categories, neither overloaded.\n * - Not an `outcome: 'denied'` variant of {@link AuditableEvent_ResourceOperationPerformed_EventDataSchema}.\n * That event is emitted from the post-commit lane, which by construction can only observe\n * operations that already took effect. A refusal never reaches it.\n \n ## Volume: bounded by dedup, NOT by a risk floor\n \n Denial volume is attacker-drivable in a way the success path's never is. A risk floor was\n * considered and rejected as the control: it would exclude 100% of denied READS (zero of the\n * catalogue's HIGH/CRITICAL variants are reads, while 371 of 551 API-reachable variants are) —\n * discarding the canonical reconnaissance signal — while not capping the adversarial worst case at\n * all, since the attacker chooses which endpoint to hammer.\n \n The actual bound is a per-principal / per-operation / per-reason dedup window. Rather than\n * suppressing repeats outright (which would erase the storm — the very signal a security-operations team wants),\n * emission escalates on a LOGARITHMIC ladder: the 1st, 10th, 100th, … refusal in the window each\n * emit one row carrying {@link occurrenceCount}. A burst of 10 000 identical denials therefore\n * costs 5 rows and remains legible as a burst.\n \n Dedup is best-effort and FAILS OPEN (emit) when the counter store is unavailable — a fail-closed\n * cooldown would let an attacker blind the audit trail by taking Redis down.\n \n assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT\n /\n/\n A platform operator acted on a row belonging to a tenant they are not a member of.\n \n ## Why this event exists\n \n Wildo's answer to \"may a platform super-administrator administer any tenant?\" is YES — the same\n * answer most mature B2B platforms give, because support and incident response genuinely need it.\n * What those platforms do NOT do is leave the reach implicit. Support access is a named, logged\n * event, because the difference between legitimate operator work and quiet snooping is not the\n * capability — both use the identical capability — it is whether anyone can tell afterwards.\n \n Until 2026-08-05 Wildo had the capability with none of the visibility, and by accident rather than\n * declaration: per-instance org-scoped requests are checked by `authorizeOrganizations`, which\n * compares the fetched row's organization against a scope the SAME REQUEST supplied through its URL.\n * A non-member operator therefore passed it silently. Measured over real HTTP by\n * `organization-ownership-grant-hostile.e2e.ts` probe F-1a, which deleted a membership row in\n * another tenant and got a 200.\n \n This event is the visibility half. It does NOT refuse — refusing is a separate, much larger change\n * with a measured blast radius (see the plan) and is a policy decision in its own right. Emission is\n * best-effort and never blocks the request: an operator action must not fail because the audit sink\n * is down, and a fail-closed variant would let anyone disable operator support by breaking the sink.\n \n ## Reading the event\n \n {@link admissionDeclared} is the field that matters most. `true` means the operation VARIANT\n * declared `admitsCrossTenantPlatformAdministration` — an intended, reviewed crossing such as\n * `organizationMembers.grantOwnership`. `false` means the reach came from the structural gap above:\n * nobody declared it, no spec documents it, and it is the population to watch.\n \n assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION — platform-tier access to a tenant the\n * principal does not belong to.\n * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT\n /\n/\n One transition in the life of a platform access grant.\n \n The crossing itself is recorded by {@link CoreAuditableEventType.CROSS_TENANT_ADMINISTRATIVE_ACCESS}.\n * This is the other half, and a reviewer needs both: that event answers \"an operator reached into\n * this tenant\", this one answers \"on what authority, asked for when, and who agreed\".\n \n Deliberately two events rather than one enriched one. A grant is requested once and may authorise\n * many crossings across its window, so folding them together would either duplicate the grant's\n * details onto every access or lose the request/decision timeline entirely.\n \n {@link autoApprovalReason} is the field a customer audit turns on. Its ABSENCE on an approved grant\n * means a human in the tenant said yes. `TENANT_APPROVAL_NOT_REQUIRED` means the tenant had not opted\n * into approval. `TENANT_CANNOT_APPROVE` means the tenant had no administratively usable owner and\n * could not consent — the one path where operator access proceeds against a tenant that never agreed\n * and never could, which is why the emitter carries it at a higher risk level.\n \n assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION\n * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — evidence of a privileged assignment's full life.\n /\nexport const AuditableEvent_PlatformAccessGrantLifecycle_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.PLATFORM_ACCESS_GRANT_LIFECYCLE),\n\n /* Which transition this row records. /\n transition: z.enum(PlatformAccessGrantLifecycleTransition),\n /* The grant, so the whole timeline can be reassembled from its rows. /\n grantId: z.string(),\n /* The tenant that was, or would have been, reached into. /\n targetOrganizationId: z.string(),\n /* The operator who asked. Never the decider — see {@link decidedByUserId}. /\n operatorUserId: z.string(),\n /* Why the operator said they needed access. Recorded on every transition, not only the request. /\n justification: z.string().optional(),\n /* The status the grant holds after this transition. /\n resultingStatus: z.enum(PlatformAccessGrantStatus),\n /* When the elevation stops working. Absent on a grant that never became usable. /\n expiresAt: z.date().optional(),\n /* Present exactly when the grant became usable with no tenant administrator acting. /\n autoApprovalReason: z.enum(PlatformAccessGrantAutoApprovalReason).optional(),\n /* The tenant administrator who approved, denied or revoked. Absent on an auto-approval. /\n decidedByUserId: z.string().optional(),\n /* Their stated reason, when they gave one. /\n decisionReason: z.string().optional(),\n});\n\nexport const AuditableEvent_CrossTenantAdministrativeAccess_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.CROSS_TENANT_ADMINISTRATIVE_ACCESS),\n\n /* The tenant that was reached into — the row's organization, never the caller's own. /\n targetOrganizationId: z.string(),\n /* The resource whose row the operator acted on. /\n resourceType: z.string(),\n /* The verb — a core operation (`update`, `delete`) or a custom identifier (`grantOwnership`). /\n operationIdentifier: z.string(),\n /* Which execution surface the crossing arrived on. /\n variantType: z.enum(ResourceOperationVariantType),\n /* The variant discriminator, which is what distinguishes a declared crossing from its siblings. /\n variantKey: z.string().optional(),\n /* The row(s) reached. Absent for collection operations, which name no id. /\n targetResourceIds: z.array(z.string()).optional(),\n\n /\n The elevation that authorised this crossing, when one did.\n \n This is what joins the two operator-access events into one story: the lifecycle event says an\n * elevation was requested, justified and decided; this field says WHICH elevation a given access\n * was exercised under. Without it a reviewer looking at a crossing has to infer the grant from\n * timestamps, which stops working the moment an operator holds two grants in a day.\n \n Absent on the bootstrap verb (`requestAccess` is exempt — it is how a grant comes into existence)\n * and on any crossing admitted before grants were required.\n /\n authorizingGrantId: z.string().optional(),\n\n /\n Did the operation variant DECLARE this crossing (`admitsCrossTenantPlatformAdministration`)?\n \n `false` is the signal worth alerting on: reach that no variant asked for and no specification\n * describes. See this schema's JSDoc.\n /\n admissionDeclared: z.boolean(),\n /* The caller's roles as they were at decision time. /\n initiatorRoles: z.array(z.string()),\n /* How the call was initiated — separates a human operator from framework machinery. /\n executionType: z.enum(ExecutionContext_ExecutionType),\n});\n\n/\n An application-wide directory enumeration.\n \n See {@link CoreAuditableEventType.PLATFORM_DIRECTORY_ACCESS} for why this is a distinct event\n * type rather than a shape of the cross-tenant one. The short version: there is no target tenant to\n * name, because the read deliberately spans them all.\n /\nexport const AuditableEvent_PlatformDirectoryAccess_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.PLATFORM_DIRECTORY_ACCESS),\n\n /* The directory that was enumerated (`users`, `anonymousUsers`, …). /\n resourceType: z.string(),\n /* The collection verb — `list`, `search`, `count`. /\n operationIdentifier: z.string(),\n /* Which execution surface the read arrived on. /\n variantType: z.enum(ResourceOperationVariantType),\n /\n The variant discriminator.\n \n Load-bearing rather than decorative: on `users` the DEFAULT `list` variant is `INTERNAL_CALL`\n * and registers no route, while the HTTP-exposed one is the non-default `admin` variant. A\n * reviewer who cannot tell the two apart cannot tell an internal enumeration from an operator\n * browsing the directory.\n /\n variantKey: z.string().optional(),\n /\n How many rows the caller actually received.\n \n The size is the signal. \"An operator opened the user directory\" is routine; \"an operator paged\n * through 40,000 users\" is the shape of an export, and only this field distinguishes them.\n /\n returnedCount: z.number().int().nonnegative(),\n /* The caller's roles as they were at read time. /\n initiatorRoles: z.array(z.string()),\n /* How the call was initiated — separates a human operator from framework machinery. /\n executionType: z.enum(ExecutionContext_ExecutionType),\n});\n\nexport const AuditableEvent_ResourceOperationDenied_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.RESOURCE_OPERATION_DENIED),\n\n // ── Why (the discriminator a security-operations dashboard groups by) ──\n /* Which refusal the authorizer resolved. /\n denialReason: z.enum(ResourceOperationDenialReason),\n\n // ── Operation identity (the same TRIPLE as the success twin — see its JSDoc for why) ──\n /* The resource whose row(s) the caller attempted to act on. /\n resourceType: z.string(),\n /* The verb — a core operation (`update`, `delete`) or a custom identifier (`suspend`). /\n operationIdentifier: z.string(),\n /* Which execution surface the attempt arrived on. /\n variantType: z.enum(ResourceOperationVariantType),\n /\n The variant discriminator. Absent on the default variant; REQUIRED to distinguish e.g. the\n * `admin` variant of a verb from its `self` twin, which share `operationIdentifier`.\n /\n variantKey: z.string().optional(),\n /* The core persistence semantics a custom verb borrows. Absent when the verb IS a core operation. /\n resourceOperationLike: z.enum(CoreResourceOperation).optional(),\n /* `true` for the bulk form, whose subject is a set rather than one row. /\n isBulkOperation: z.boolean().optional(),\n\n // ── Subject (what was ATTEMPTED — never proof the row exists) ──\n /\n The row id(s) the caller named. Present even for {@link ResourceOperationDenialReason.SUBJECT_NOT_RESOLVABLE},\n * where the id may correspond to nothing at all — this records what was ASKED FOR, not what exists.\n * Absent for collection operations, which name no id.\n /\n attemptedResourceIds: z.array(z.string()).optional(),\n\n // ── Authority (what was required vs. what was held) ──\n /\n The role set the operation demanded. Together with {@link initiatorRoles} this makes the refusal\n * self-explaining: a reviewer sees what was needed and what the caller had, without re-deriving\n * the operation's config as it stood that day.\n /\n requiredRoles: z.array(z.string()).optional(),\n /\n The caller's roles AS THEY WERE at decision time — empty when the refusal WAS the absence of\n * them ({@link ResourceOperationDenialReason.MISSING_INITIATOR}).\n /\n initiatorRoles: z.array(z.string()),\n /* How the call was initiated — separates a human request from framework machinery. /\n executionType: z.enum(ExecutionContext_ExecutionType),\n /* Machine-credential provenance when the refused principal is a machine rather than a human. /\n machineCredentialAuthMethod: z.string().optional(),\n machineCredentialId: z.string().optional(),\n\n // ── Cascade depth (the request that groups the whole cascade is the row's top-level `correlationId`) ──\n /* `0` for the operation the caller invoked; deeper for what it cascaded into. /\n subCallDepth: z.number(),\n\n // ── Burst accounting (see the dedup ladder in this schema's JSDoc) ──\n /\n How many identical refusals (same principal, operation and reason) have accumulated in the\n * current dedup window INCLUDING this one. `1` on the first. A row with a large value is a\n * deliberate escalation checkpoint, not a duplicate.\n /\n occurrenceCount: z.number(),\n /\n `true` when the count is exact (the dedup counter was reachable). `false` when the counter store\n * was unavailable and the emission fell open — the row is then a truthful record of ONE refusal\n * whose burst context is unknown, and {@link occurrenceCount} is not to be trusted as a total.\n /\n occurrenceCountIsExact: z.boolean(),\n});\n\n/\n A privileged SEE-THROUGH read that revealed RETAINED (impersonalized-and-retained) records —\n * rows kept for a legal/audit obligation while their personal data was scrubbed, hidden from\n * normal callers by the retention hide-predicate. This is the compliance-grade access record over\n * that scrubbed data, and its two defining properties (vs `SYSTEM_CONTEXT_READ`, which names only the\n * RUNTIME that acted, never a human) are:\n \n 1. Human attribution — `accessingUserId` names the actual super-admin / `COMPLIANCE_AUDITOR`\n * who exercised the see-through, so a retained-data reveal is never anonymous. Non-empty\n * (`.trim().min(1)`) — a blank id cannot stand in for a human.\n * 2. A required reason — `reason` is the mandatory justification for revealing scrubbed PII.\n * Non-empty (`.trim().min(1)`): a blank OR whitespace-only reason fails validation, so the audit\n * trail cannot record a reveal without a real \"why\". The see-through primitives ALSO fail-closed on\n * blank attribution before the read (the schema `.min(1)` is the contract; the primitive guard is\n * the enforcement point, since the audit store persists `eventData` as an unparsed record).\n \n Strictly read-only (the see-through primitive never mutates). Emitted by the see-through read\n * primitive (`readRetainedAsSystem` / `listRetainedAsSystem`) — wired in a later phase; this is the\n * contract only.\n /\nexport const AuditableEvent_RetainedDataAccess_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.RETAINED_DATA_ACCESS),\n /* The HUMAN principal who performed the see-through read (super-admin / COMPLIANCE_AUDITOR). Non-empty. /\n accessingUserId: z.string().trim().min(1),\n /* REQUIRED non-empty compliance justification for revealing the retained (scrubbed) records — the \"why\". /\n reason: z.string().trim().min(1),\n /* The resource type whose retained rows were revealed. /\n resourceType: z.string(),\n /* Present for a single-record see-through read; absent for a list/search reveal. /\n resourceId: z.string().optional(),\n /* For a list/search see-through: how many retained rows the query revealed. /\n retainedRecordCount: z.number().optional(),\n /* The see-through primitive that ran (e.g. `readRetainedAsSystem` / `listRetainedAsSystem`). /\n operationIdentifier: z.string(),\n /* The privileged role(s) that authorized the see-through (roles are the single authorization axis). /\n roles: z.array(z.string()).optional(),\n /* Tenant scope of the accessed data (organizationId), when the read was org-scoped. /\n organizationId: z.string().optional(),\n ipAddress: z.string().optional(),\n});\n\n/\n A DATA SUBJECT EXPORT — the compliance record of the framework assembling everything it holds\n * about one person and disclosing it.\n \n This is the most sensitive READ the framework performs, and the one an access-request audit turns\n * on. Its defining properties:\n \n 1. A named subject — `subjectResourceType` + `subjectIds`: WHOSE data left the system. An\n * export event that cannot name its subject is not an access record.\n * 2. A named purpose — `purpose` is a `SubjectExportPurpose`. Art. 15 and Art. 20 produce\n * genuinely different bundles, so an audit trail that recorded only \"an export happened\" could\n * not later establish which right was answered or whether it was answered completely.\n * 3. What was actually included — `includedResourceTypes` + `totalRecordCount`, and\n * `fieldsExcludedAsDerived` for the Art. 20 narrowing. The OMISSIONS matter as much as the\n * contents: \"why was this not in my export?\" must have a recorded answer.\n \n Carries NO personal data — resource types, ids, counts and field NAMES only. Recording the\n * exported values would turn the record of a disclosure into a second copy of it, in a store with\n * a longer retention than the export artifact itself.\n \n assurance-control: WILDO.PRIVACY.SUBJECT_DATA_EXPORT\n /\nexport const AuditableEvent_SubjectDataExport_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.SUBJECT_DATA_EXPORT),\n /* WHICH data-subject right this export answered — the two produce different bundles. /\n purpose: z.string().trim().min(1),\n /* The exported subject's resource type. /\n subjectResourceType: z.string().trim().min(1),\n /* The exported subject rows. Non-empty: an export with no subject is not an export. /\n subjectIds: z.array(z.string()).min(1),\n /* Every resource that actually contributed rows to the bundle. /\n includedResourceTypes: z.array(z.string()),\n /* Total rows disclosed across the whole bundle. /\n totalRecordCount: z.number(),\n /\n `resourceType.fieldName` locators omitted from an Art. 20 bundle as controller-derived. Empty\n * for an Art. 15 access export, which discloses every field regardless of provenance.\n /\n fieldsExcludedAsDerived: z.array(z.string()),\n /\n `resourceType.fieldName` locators withheld as NON-DISCLOSABLE regardless of right — secrets and\n * backend-only values the export refuses to hand out. Recorded so a thin bundle reads as a\n * deliberate security floor rather than a missed resource.\n /\n fieldsWithheldAsNonDisclosable: z.array(z.string()),\n /* Tenant scope, when the export ran org-scoped. /\n organizationId: z.string().optional(),\n});\n\n/\n A COLLECTION EXPORT — an operator rendered a resource listing to a file and downloaded it.\n \n ## What it must answer, and what it must never carry\n \n The reviewer's questions are: which listing, in what shape, and how much left. So the row\n * count is mandatory and the row scope is recorded verbatim — \"they exported the page they were\n * looking at\" and \"they exported the whole table\" are the same action with very different\n * consequences, and only this field separates them after the fact.\n \n `filterFieldNames` records WHICH filters narrowed the export, never their values. A filter\n * value is frequently personal data (`?email=…`, `?assigneeId=…`), so recording it would turn the\n * record of a disclosure into a second copy of it, in a store that outlives the exported file — the\n * same rule {@link AuditableEvent_SubjectDataExport_EventDataSchema} follows (\"resource types, ids,\n * counts and field NAMES only\"). No row content, ever.\n \n ## Why the severity is static and the risk is not\n \n `AUDIT_EVENT_CLASSIFICATION_MAP` is keyed by event TYPE, so severity cannot vary per emission.\n * Classifying every export WARNING would put a routine twenty-row page download beside a whole-table\n * dump and train reviewers to skim the channel; classifying every export INFO would leave the dump\n * indistinguishable. The distinction therefore rides on `riskLevel`, which IS per-emission and is an\n * indexed summary column on the audit row: LOW for a page, HIGH for a full result set.\n \n Rejected: two event types. A page export and a full export are one action with one parameter,\n * and splitting the vocabulary to vary a field would make every consumer match two types forever.\n \n assurance-control: WILDO.PRIVACY.COLLECTION_DATA_EXPORT\n /\nexport const AuditableEvent_CollectionDataExport_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.COLLECTION_DATA_EXPORT),\n /* The exported resource. /\n resourceType: z.string().trim().min(1),\n /* The LIST/SEARCH operation whose result set was exported. /\n sourceOperationIdentifier: z.string().trim().min(1),\n /* `csv` \| `json` — the rendered wire format. /\n format: z.string().trim().min(1),\n /* `visible_page` \| `full_result_set` — see the docstring; this is the field that matters most. /\n rowScope: z.string().trim().min(1),\n /* Rows actually written to the file. Mandatory: an export event with no count answers nothing. /\n rowCount: z.number().int().nonnegative(),\n /* Names of the filters that narrowed the export. NEVER their values. /\n filterFieldNames: z.array(z.string()),\n /* Tenant scope, when the export ran org-scoped. /\n organizationId: z.string().optional(),\n});\n\n/\n Rows were read THROUGH an HTTP-API resource binding — the read-through trail for data living in\n * an EXTERNAL system the platform does not own (ETL plan D8/R6; see the enum member's docstring\n * for why this is neither SYSTEM_CONTEXT_READ nor COLLECTION_DATA_EXPORT).\n \n One event per read-family OPERATION execution: a paginated LIST and the count that totals its\n * envelope are ONE access, not two — the unit a reviewer reasons about is \"an operation reached\n * into the external system\", never the transport's call multiplicity. Carries NO row data and no\n * filter VALUES — the trail must never become a second copy of the external system's content.\n \n `initiatorUserId` is the REAL initiating user (R12): under a SERVICE_PRINCIPAL binding every\n * remote call authenticates as one service account, and this field is what keeps attribution\n * alive through that shared principal. Optional because internal/machine executions genuinely\n * have no user — absence means \"a runtime acted\", exactly as `executionType` records.\n \n assurance-control: WILDO.AUDIT.ATTRIBUTION — read-through access to an external system is\n * recorded with the real initiating user carried through the shared service principal.\n /\nexport const AuditableEvent_HttpApiReadThroughAccess_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.HTTP_API_READ_THROUGH_ACCESS),\n /* The Wildo resource whose binding was read through. /\n resourceType: z.string().trim().min(1),\n /* The read-family member executed: `read` \| `list` \| `count` \| `search`. /\n operationIdentifier: z.string().trim().min(1),\n /* The provider the binding resolves credentials/base-URL through (e.g. `odoo`). /\n providerRef: z.string().trim().min(1),\n /* The remote entity (OData entity set / Odoo model / declared REST surface). /\n remoteEntityRef: z.string().trim().min(1),\n /* The transport dialect spoken (`odata` \| `rest-json` \| `odoo-jsonrpc`). /\n dialect: z.string().trim().min(1),\n /* The REAL initiating user — absent only for genuine machine/internal executions. /\n initiatorUserId: z.string().optional(),\n /* The execution type that acted, for the machine/internal cases. /\n executionType: z.string().optional(),\n /* Tenant scope, when the read ran org-scoped. /\n organizationId: z.string().optional(),\n /* The addressed row's synthesized id, for single-row reads. /\n resourceId: z.string().optional(),\n /* Rows returned (list/search), or the count answered (count). Absent for a single READ. /\n rowCount: z.number().int().nonnegative().optional(),\n});\n\n/\n A subject erasure invoked the DECLARED external-erasure operation of an HTTP_API binding\n * (ETL D6 stance 6b) — rows linked to the erased subject were deleted in the external system.\n \n Carries ids only, never personal fields: by the time this emits, the subject's local row is\n * scrubbed, and the whole point of the operation was that the remote copies stop existing.\n \n assurance-control: WILDO.AUDIT.ATTRIBUTION — the outbound deletion names the subject it served\n * and the external system it reached; the erasure report is the per-request receipt, this row is\n * the queryable trail.\n /\nexport const AuditableEvent_HttpApiExternalErasure_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.HTTP_API_EXTERNAL_ERASURE),\n /* The erased subject's resource type (e.g. `users`). /\n subjectResourceType: z.string().trim().min(1),\n /* The erased subject row ids the deleted remote rows were linked to. /\n subjectIds: z.array(z.string().trim().min(1)).min(1),\n /* The HTTP_API-bound Wildo resource whose declared erasure operation ran. /\n resourceType: z.string().trim().min(1),\n /* The provider the binding resolves credentials/base-URL through. /\n providerRef: z.string().trim().min(1),\n /* The remote entity (OData entity set / Odoo model / declared REST surface). /\n remoteEntityRef: z.string().trim().min(1),\n /* The transport dialect spoken (`odata` \| `rest-json` \| `odoo-jsonrpc`). /\n dialect: z.string().trim().min(1),\n /* Remote rows the declared operation deleted (0 is a legitimate nothing-to-erase). /\n deletedRowCount: z.number().int().nonnegative(),\n /* Tenant scope, when the erasure request carried one. /\n organizationId: z.string().optional(),\n});\n\n/\n A subject erasure COMPLETED while rows linked to the subject remain live in an HTTP_API-bound\n * external system, on the controller's explicit per-request acknowledgement (ETL D6 stance 6c).\n \n THE RECORD IS THE CONTROL: the acknowledgement's entire justification is that the hole becomes\n * VISIBLE rather than prevented (`administrative-continuity-floors.md`), so this event must name\n * everything a reviewer needs to act — the subject, the resource, the external system, and the\n * remaining linkage when it could be measured.\n \n assurance-control: WILDO.AUDIT.ATTRIBUTION — an acknowledged erasure hole is recorded per\n * resource, per erasure request, never as a standing posture.\n /\nexport const AuditableEvent_HttpApiNonErasureAcknowledged_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.HTTP_API_NON_ERASURE_ACKNOWLEDGED),\n /* The erased subject's resource type (e.g. `users`). /\n subjectResourceType: z.string().trim().min(1),\n /* The erased subject row ids whose linked remote rows remain live. /\n subjectIds: z.array(z.string().trim().min(1)).min(1),\n /* The HTTP_API-bound Wildo resource whose rows remain un-erased. /\n resourceType: z.string().trim().min(1),\n /* The provider the binding resolves credentials/base-URL through. /\n providerRef: z.string().trim().min(1),\n /* The remote entity (OData entity set / Odoo model / declared REST surface). /\n remoteEntityRef: z.string().trim().min(1),\n /* The transport dialect spoken (`odata` \| `rest-json` \| `odoo-jsonrpc`). /\n dialect: z.string().trim().min(1),\n /\n Remote rows still linked to the subject, when the target answered a count. ABSENT means the\n * count could not be measured (the count read failed or is undeclared for the binding) — never\n * write 0 for \"unknown\": zero is a measured answer.\n /\n remainingRowCount: z.number().int().nonnegative().optional(),\n /* Tenant scope, when the erasure request carried one. /\n organizationId: z.string().optional(),\n});\n\n/\n Audit-log event for cross-frontend session handoff issuance\n * (cross-app-jwt-propagation Step 2).\n \n Captures who issued a transferable session credential, where it was bound to,\n * and a hash of the deep-link target so ops can correlate handoff issuance with\n * the corresponding `tokenExchange` event WITHOUT leaking the raw deep link\n * (which can carry org IDs, share codes, or draft IDs).\n \n `returnPathHash` is hex-encoded `sha256(returnPath)` computed by the audit-log\n * helper from the validated returnPath. NEVER pass a pre-hashed value at the\n * call site (defense-in-depth: prevents accidental double-hashing or hash\n * mismatch with what the schema validated).\n /\nexport const AuditableEvent_User_CrossFrontendHandoffIssuedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_CROSS_FRONTEND_HANDOFF_ISSUED),\n userId: z.string(),\n /* The `X-Frontend-Service-Name` of the source frontend that initiated the handoff. /\n sourceFrontendServiceName: z.string().optional(),\n /* The SaaS-config service key (and runtime `frontendServiceName`) of the target. /\n targetServiceKey: z.string(),\n /* SHA-256 hex of the validated returnPath; NEVER the raw path. /\n returnPathHash: z.string(),\n /* ID of the issued AUTH_CODE_EXCHANGE consumable token (for replay forensics). /\n consumableTokenId: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\n// ── OAuth2 / OIDC Provider Event Data Schemas (Wildo AS the authorization server) ──\n\n/\n A user-delegated `authorization_code` access token was minted for a third-party client at\n * `/oauth/token`. This is the most security-sensitive access grant the provider makes: the client\n * can now act AS the user at the audience-bound A2A/MCP resource. `clientId` is the `azp`\n * (attribution only — the token carries the USER's authority, not the client's). Never carries the\n * raw token.\n /\nexport const AuditableEvent_OAuth_DelegatedTokenIssuedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.OAUTH_DELEGATED_TOKEN_ISSUED),\n /* The delegating (consenting) user — the token subject. /\n userId: z.string(),\n /* The third-party client the token was minted for (`azp`). /\n clientId: z.string(),\n /* The A2A/MCP resource-server audience the token is confined to. /\n audience: z.string(),\n /* Granted identity scopes (openid/…); may be empty. Identity/consent provenance only — no authz weight. /\n scopes: z.array(z.string()),\n /* Delegated-token lifetime in seconds (short-lived; never the full session TTL). /\n ttlSeconds: z.number(),\n ipAddress: z.string().optional(),\n});\n\n/* A user APPROVED an interactive consent request — a code is issued and the client may act for them. /\nexport const AuditableEvent_OAuth_ConsentGrantedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.OAUTH_CONSENT_GRANTED),\n /* The user who approved. /\n userId: z.string(),\n /* The client the consent was granted to. /\n clientId: z.string(),\n /* The scopes consented to. /\n scopes: z.array(z.string()),\n /* The RFC 8707 resource the consent was bound to, when present. /\n resource: z.string().optional(),\n /* Whether the user asked to persist the grant (\"remember this app\") — a durable-authority signal. /\n remembered: z.boolean(),\n ipAddress: z.string().optional(),\n});\n\n/* A user DENIED an interactive consent request — access refused. /\nexport const AuditableEvent_OAuth_ConsentDeniedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.OAUTH_CONSENT_DENIED),\n userId: z.string(),\n clientId: z.string(),\n scopes: z.array(z.string()),\n resource: z.string().optional(),\n ipAddress: z.string().optional(),\n});\n\n/\n A persistent consent grant (the durable \"remember this app\" record, keyed on\n * `(userId, clientId, resource)`) was created or updated — it lets future authorize flows SKIP the\n * consent prompt, so its lifecycle is a first-class delegated-authority audit concern.\n /\nexport const AuditableEvent_OAuth_ConsentGrantPersistedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.OAUTH_CONSENT_GRANT_PERSISTED),\n userId: z.string(),\n clientId: z.string(),\n /* The RFC 8707 resource the grant covers; absent for an OIDC-only (resource-less) grant. /\n resource: z.string().optional(),\n /* The union of scopes the grant now covers after the write. /\n scopes: z.array(z.string()),\n /* `true` when a NEW grant row was created; `false` when an existing grant's scopes were widened. /\n isNewGrant: z.boolean(),\n});\n\n/\n A CIMD `client_id` URL was refused. Unauthenticated by construction, so the URL, the reason and\n * the source of the request ARE the investigation surface.\n /\nexport const AuditableEvent_OAuth_CimdClientRefusedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.OAUTH_CIMD_CLIENT_REFUSED),\n /* The `client_id` URL as presented. Attacker-controlled, so treated as data, never as a locator. /\n clientId: z.string(),\n /* Closed vocabulary — branched on by operators and COUNTED, never free text. /\n reason: z.string(),\n detail: z.string().optional(),\n});\n\n/\n A client registered itself at `/oauth/register` (RFC 7591). Unauthenticated by construction, so\n * the source IP and the self-asserted name/redirects ARE the investigation surface — there is no\n * principal to attribute it to.\n /\nexport const AuditableEvent_OAuth_DynamicClientRegisteredEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.OAUTH_DYNAMIC_CLIENT_REGISTERED),\n clientId: z.string(),\n /* Self-asserted; nobody vetted it. Shown on the consent screen, so worth recording verbatim. /\n clientName: z.string(),\n /* The redirect URIs the client claimed — where an authorization code would be delivered. /\n redirectUris: z.array(z.string()),\n /\n The POST-LOGOUT redirect URIs the client claimed (revocation-C) — where an RP-Initiated Logout would\n * send the browser after the session ends. Optional: absent on rows written before the field existed and\n * for a registration that declared none.\n /\n postLogoutRedirectUris: z.array(z.string()).optional(),\n ipAddress: z.string().optional(),\n});\n\n/\n A user token was rotated via the provider `refresh_token` grant (`/oauth/token`). Distinct from the\n * first-party session refresh (`USER_TOKEN_REFRESHED`): this is the OAuth-provider endpoint, which a\n * confidential client MAY authenticate to. Low-detail INFO — the security-relevant refresh signal is\n * reuse/theft ({@link CoreAuditableEventType.USER_REFRESH_TOKEN_REUSE_DETECTED}).\n \n There is deliberately NO `OAUTH_TOKEN_REFRESH_FAILED` counterpart (user-confirmed 2026-07-31): routine\n * refresh failures (expired / revoked / plain-invalid presented token) are high-volume benign noise from\n * ended sessions, and auditing them would drown the compliance store. The only refresh-failure worth an\n * audit record is credential theft, which reuse-detection catches → `USER_REFRESH_TOKEN_REUSE_DETECTED`.\n /\nexport const AuditableEvent_OAuth_TokenRefreshedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.OAUTH_TOKEN_REFRESHED),\n /* The refreshing user, when resolvable from the freshly-minted access token; else absent. /\n userId: z.string().optional(),\n /* The client that authenticated the refresh (confidential-client id_token re-issue path); else absent. /\n clientId: z.string().optional(),\n /* Whether a confidential client was authenticated on this refresh (vs a first-party session refresh). /\n clientAuthenticated: z.boolean(),\n ipAddress: z.string().optional(),\n});\n\n/\n A token was revoked via `/oauth/revoke` (RFC 7009). The endpoint is deliberately a no-oracle (200 for\n * unknown tokens), so this records the ATTEMPT + the authenticated client (if any), never whether the\n * token existed or whose it was.\n /\nexport const AuditableEvent_OAuth_TokenRevokedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.OAUTH_TOKEN_REVOKED),\n /* The confidential client that authenticated to revoke, when present. /\n clientId: z.string().optional(),\n /* Whether a confidential client authenticated the revocation. /\n clientAuthenticated: z.boolean(),\n /* The RFC 7009 `token_type_hint` the caller supplied, when present. /\n tokenTypeHint: z.string().optional(),\n ipAddress: z.string().optional(),\n});\n\n/\n An OIDC RP-Initiated Logout (RP-Initiated Logout 1.0) terminated the End-User's OP session at\n * `/oauth/end-session` (revocation-C). Records WHO logged out WHICH session via WHICH relying party, and\n * whether a session was actually terminated / a post-logout redirect was refused. `userId`/`sessionId`/\n * `clientId` are present only when a valid `id_token_hint` identified them — an invalid or absent hint\n * still lands the user on the OP's page but terminates nothing.\n /\nexport const AuditableEvent_OAuth_RpInitiatedLogoutEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.OAUTH_RP_INITIATED_LOGOUT),\n /* The user whose OP session was terminated — present only when a valid `id_token_hint` identified them. /\n userId: z.string().optional(),\n /* The terminated login session (the id_token `sid`) — present only when the hint carried one. /\n sessionId: z.string().optional(),\n /* The relying party that initiated the logout (the id_token `azp`), when identifiable. /\n clientId: z.string().optional(),\n /* Whether a session was actually terminated (a valid hint carrying a `sid` was presented). /\n sessionTerminated: z.boolean(),\n /* Whether a presented `post_logout_redirect_uri` was REFUSED because it did not match the client's\n * registered allowlist — a misconfiguration / open-redirect-probe signal worth separating from a\n * plain no-URI logout. /\n postLogoutRedirectUriRejected: z.boolean(),\n ipAddress: z.string().optional(),\n});\n\n/\n An `authorization_code` exchange was REJECTED at `/oauth/token`. A potential attack signal (code\n * replay, PKCE downgrade, redirect tampering, cross-client redemption). `reason` names the cause;\n * `userId`/`resource` are present only for causes detected AFTER the code decodes (never for the\n * atomic replay/consume failure, which fails before decode).\n /\nexport const AuditableEvent_OAuth_CodeExchangeFailedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.OAUTH_CODE_EXCHANGE_FAILED),\n /* The specific failure cause (closed vocabulary). /\n reason: z.enum(OAuthCodeExchangeFailureReason),\n /* The redeeming client, when the request supplied one. /\n clientId: z.string().optional(),\n /* The code's subject, available only for post-decode causes. /\n userId: z.string().optional(),\n /* The code's bound resource, available only for post-decode causes. /\n resource: z.string().optional(),\n ipAddress: z.string().optional(),\n});\n\n/\n A consent DECISION was submitted by an authenticated user who is NOT the user the consent request was\n * bound to (returns 403). A textbook cross-user authorization-abuse signal — user A attempting to act on\n * user B's pending consent. CRITICAL: records BOTH principals for the SIEM.\n /\nexport const AuditableEvent_OAuth_ConsentBindingViolationEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.OAUTH_CONSENT_BINDING_VIOLATION),\n /* The authenticated user who submitted the decision (the actor). /\n authenticatedUserId: z.string(),\n /* The user the consent request was actually bound to (the victim). /\n boundUserId: z.string(),\n /* The client the consent request was for, when known. /\n clientId: z.string().optional(),\n /* The consent-request consumable-token id, for replay forensics. /\n consentTokenId: z.string().optional(),\n ipAddress: z.string().optional(),\n});\n\n/\n Refresh-token REUSE was detected → the whole token family was revoked (possible theft). Emitted by the\n * refresh CALLERS, NOT the token issuer: the issuer stays audit-free by design (it performs the revoke and\n * surfaces a machine-readable reuse SIGNAL on its thrown error), and each caller decides to audit. Applies\n * to BOTH the first-party session refresh and the OAuth-provider refresh grant (shared issuer).\n /\nexport const AuditableEvent_User_RefreshTokenReuseDetectedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_REFRESH_TOKEN_REUSE_DETECTED),\n /* The user whose token family was revoked (the victim). /\n userId: z.string(),\n /* The reused refresh token's `jti` (the replayed credential id) — never the raw token. /\n reusedJti: z.string(),\n /* The session the reused token belonged to, when present on the claim. /\n sessionId: z.string().optional(),\n /* Whether the family-wide revocation (`TOKEN_INVALID_BEFORE`) was written — the action taken. /\n familyRevoked: z.boolean(),\n ipAddress: z.string().optional(),\n});\n\n// MongoDB-compatible schema using simple object for eventData\n// The discriminated union validation will be handled at the service layer\nexport const AuditableEvent_DataSchema = z.record(z.string(), z.any());\n\n\n\n\nexport const AuditableEvent_BaseSchema = z.object({\n _id: z.string().isPrimaryKey().isSummaryField(),\n /\n Store-agnostic, server-minted correlation key (UUID). The Mongo `_id` is\n * THIS store's primary key, but immudb (and any future audit sink) has its\n * own native key — so cross-store correlation needs an id that belongs to the\n * EVENT, not to one store. Minted in `AuditLogsBackendService._createAuditLog`\n * BEFORE the DB write and carried on BOTH the DB row AND the provider fan-out\n * emission, so the Phase-3 completeness reconciler can match DB rows ⇄ immudb\n * records (and `AuditLogVerification.verifyAuditEvent(eventId)` resolves the\n * same key). Not the primary key: `_id` stays the DB PK.\n /\n eventId: z.string().isDBIndexed(),\n // Note: .optional() must come AFTER decorators to preserve optionality in TypeScript type inference\n userId: z.string().isSummaryField().optional(),\n /\n The org the event is ABOUT (event DATA) — e.g. the org whose SSO config changed, or the\n * org resolved from a login email's domain. NEVER a routing key. Per-org SIEM / sink\n * dispatch routes ONLY on the AUTHENTICATED request org\n * (`ExecutionContext.initiatorIds.organizationId`) — this field is attacker-influenceable on\n * pre-auth paths (a failed-login email domain → org lookup), so routing on it would leak one\n * tenant's events into another tenant's SIEM (F4). See `AuditLogsBackendService._createAuditLog`.\n \n ## Why an attacker-influenceable value is nonetheless SAFE to persist here\n \n Recorded 2026-08-05, when this field stopped being silently dropped on write (see\n * `_createAuditLog`'s `preserveServerInjectedFields` call). The change makes a value an\n * unauthenticated caller can influence both durable and, on the org-scoped viewer, VISIBLE — so\n * the two channels it could reach were each checked rather than assumed.\n \n 1. SIEM delivery — unaffected. Per-org dispatch keys on the AUTHENTICATED request org, never\n * on this field (F4, above). Persisting it changes no routing decision, so the cross-tenant\n * SIEM leak F4 exists to prevent is not reachable through it.\n * 2. In-product visibility — intended, not a leak. `ORGANIZATIONS → AUDIT_LOGS` is\n * `REQUIRES_CONTEXT` on `organizationId`, so this value decides which org sees the row in the\n * org-scoped Audit Log Viewer. A failed-login row surfacing in the org whose user was targeted\n * is the CORRECT outcome — a tenant seeing authentication attempts against its own members is\n * the purpose of an audit log, not a disclosure. Nothing about a third org is exposed: the row\n * describes the attempt itself.\n \n Residual, stated rather than hidden: an unauthenticated caller can therefore cause rows to\n * appear in a NAMED org's viewer (log injection / noise) by choosing the email domain it probes.\n * Bounded to rows describing that caller's own attempt against that org, which is the org already\n * being attacked and the party with the strongest reason to see them. Volume abuse is bounded by\n * the authentication rate limiters, not by this field. If a future review wants that noise\n * separated, the fix is a provenance discriminator on the row (authenticated vs. domain-resolved\n * org), NOT dropping the field again — dropping it is what made the viewer's org filter return\n * nothing at all.\n \n assurance-control: WILDO.ACCESS.SCOPE_CONFINEMENT — tenant segregation of the audit trail is\n * enforced on the authenticated scope, while the subject org retains visibility of events\n * concerning it.\n /\n organizationId: z.string().isSummaryField().optional(),\n /\n The application the event is ABOUT when its owning tenant is application-scoped.\n * Like `organizationId`, this is forensic event data and never a per-org SIEM routing key.\n /\n applicationId: z.string().isSummaryField().optional(),\n /\n The request-correlation id (see `ExecutionContext.correlationId`) — groups every audit row produced\n * by ONE request / job / cron tick, and equals the `correlationId` stamped on that request's structured\n * log lines and errors, so an investigator can pivot audit ⇄ logs ⇄ error by a single id. Populated by\n * `_createAuditLog` from the request `ExecutionContext` when threaded, else from the ambient\n * request-context ALS frame — that fallback is what finally populates it on the COMMON emit path (most\n * emitters pass no EC). Indexed for correlation queries. Store-agnostic like `eventId`, but distinct:\n * `eventId` correlates ONE event across audit stores; `correlationId` correlates MANY events to one request.\n /\n correlationId: z.string().isDBIndexed().isSummaryField().optional(),\n /\n Which frontend SURFACE the request originated from (`x-frontend-service-name`: app / website / docs),\n * captured at the HTTP edge into the request-context frame and hoisted here by `_createAuditLog`. Origin\n * attribution — \"where did this action come from\". Absent for non-HTTP (job / cron / internal) events.\n /\n frontendServiceName: z.string().isSummaryField().optional(),\n /\n Which browser/device INSTALL the request came from (`x-client-instance-id`) — the axis that lets a\n * reviewer group one actor's activity ACROSS sessions and logins, which `correlationId` (one request)\n * and `frontendServiceName` (which surface) cannot. Captured at the HTTP edge into the request-context\n * frame and hoisted here by `_createAuditLog`, exactly like `frontendServiceName`.\n \n *Populated ONLY when the application authored a non-`DISABLED` `compliance.clientInstanceIdScope`\n (OPT-IN, default OFF — Fork D / SD9).** Absent for every unopted application, for non-HTTP events\n * (job / cron / internal), and whenever the client sent no id. It is a pseudonymous identifier under\n * GDPR Art 4(5), so it carries obligations the other correlation columns do not — see\n * `ClientInstanceIdScope` and `.claude/plans/traceability-correlation-id.md` (SD9).\n \n Deliberately DISTINCT from (never merged with, per SD8): `anonymousUserId` (an identity the app\n * assigns a pre-auth PERSON), `DeviceInfoSchema.fingerprint` (a derived/probabilistic device\n * signature), and `clientId` (the OAuth `azp` — which SOFTWARE client, already on the row).\n /\n // GDPR Art. 4(5) pseudonymised data by this field's own JSDoc above — so it is personal data, and\n // a notice must enumerate it. IDENTITY: it is an identifier assigned to a person's client, not an\n // observation of what they did.\n clientInstanceId: z.string().isDBIndexed().isSummaryField().optional()\n .dataCategories(PersonalDataCategory.IDENTITY),\n riskLevel: z.enum(ResourceOperationRiskLevel).isSummaryField(),\n // USAGE — an audit row is a record of what a principal DID. The event type and its data together\n // are the observation, so both carry the category; `riskLevel`, `eventCategory` and `severity` are\n // the framework's CLASSIFICATION of the event rather than data about the person, and carry none.\n //\n // ⚠️ The reverse of the `.isAuditEvidence()` rule, and deliberately so. That marker decides which\n // FIELD VALUES get copied INTO an audit row, and personal data must never be marked, because the\n // immutable ledger cannot be scrubbed. This declaration is about the audit row's OWN fields, which\n // hold personal data whether or not anyone wanted them to — and a notice must say so precisely\n // BECAUSE they are unerasable.\n eventType: z.string().isSummaryField().dataCategories(PersonalDataCategory.USAGE),\n eventData: AuditableEvent_DataSchema.dataCategories(PersonalDataCategory.USAGE),\n /* Populated by service layer via getAuditEventClassification(). Required for CREATE (audit logs are REPOSITORY_ONLY, no API). /\n eventCategory: z.enum(AuditEventCategory).isSummaryField(),\n /* Populated by service layer via getAuditEventClassification(). Required for CREATE (audit logs are REPOSITORY_ONLY, no API). */\n severity: z.enum(AuditEventSeverity).isSummaryField(),\n createdAt: z.date().default(() => new Date()).isSummaryField().excludeFromCreate().excludeFromUpdate(),\n updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate()\n});\n\n\n\n// Type-safe discriminated union for TypeScript validation (used in service layer)\nexport const AuditableEvent_TypedDataSchema = z.discriminatedUnion('eventType', [\n AuditableEvent_User_LoginEventDataSchema,\n AuditableEvent_User_LogoutEventDataSchema,\n AuditableEvent_User_LoginFailedEventDataSchema,\n AuditableEvent_User_AccountLockedEventDataSchema,\n AuditableEvent_MachineAuth_SuccessEventDataSchema,\n AuditableEvent_MachineAuth_FailedEventDataSchema,\n AuditableEvent_MachineAccess_EventDataSchema,\n AuditableEvent_User_SessionExpiredEventDataSchema,\n AuditableEvent_User_AppRolesChangedEventDataSchema,\n AuditableEvent_Application_SuperAdminFloorBreachedEventDataSchema,\n AuditableEvent_Organization_OwnerFloorBreachedEventDataSchema,\n AuditableEvent_OrganizationMember_InvitedEventDataSchema,\n AuditableEvent_OrganizationMember_JoinedEventDataSchema,\n AuditableEvent_OrganizationMember_UpdatedEventDataSchema,\n AuditableEvent_OrganizationMember_RoleChangedEventDataSchema,\n AuditableEvent_OrganizationMember_StatusChangedEventDataSchema,\n AuditableEvent_OrganizationMember_RemovedEventDataSchema,\n AuditableEvent_Organization_CreatedEventDataSchema,\n AuditableEvent_Organization_UpdatedEventDataSchema,\n AuditableEvent_Organization_DeletedEventDataSchema,\n AuditableEvent_Organization_DeletionRequestedEventDataSchema,\n AuditableEvent_Organization_RestoredEventDataSchema,\n AuditableEvent_Organization_SuspendedEventDataSchema,\n AuditableEvent_Resource_StatusTransitionPerformedEventDataSchema,\n AuditableEvent_Organization_ActivatedEventDataSchema,\n AuditableEvent_OrganizationNotifications_UpdatedEventDataSchema,\n AuditableEvent_OrganizationPreferences_UpdatedEventDataSchema,\n AuditableEvent_OrganizationProfile_UpdatedEventDataSchema,\n AuditableEvent_OrganizationUnit_UpdatedEventDataSchema,\n AuditableEvent_OrganizationUnitMember_RoleChangedEventDataSchema,\n AuditableEvent_OrganizationUnitMember_RemovedEventDataSchema,\n AuditableEvent_User_DeletedEventDataSchema,\n AuditableEvent_User_SSOLoginEventDataSchema,\n AuditableEvent_User_SSOLoginFailedEventDataSchema,\n AuditableEvent_User_SSOEnforcementBlockedEventDataSchema,\n AuditableEvent_User_TokenRefreshedEventDataSchema,\n AuditableEvent_Organization_SSOConfigurationChangedEventDataSchema,\n AuditableEvent_Organization_SIEMExportConfiguredEventDataSchema,\n AuditableEvent_ApplicationAuthPolicyChanged_EventDataSchema,\n AuditableEvent_Webhook_EndpointTestDispatchedEventDataSchema,\n AuditableEvent_SCIM_TokenCreatedEventDataSchema,\n AuditableEvent_SCIM_TokenRevokedEventDataSchema,\n AuditableEvent_SCIM_UserProvisionedEventDataSchema,\n AuditableEvent_SCIM_UserUpdatedEventDataSchema,\n AuditableEvent_SCIM_UserDeactivatedEventDataSchema,\n AuditableEvent_User_PasswordResetRequestedEventDataSchema,\n AuditableEvent_User_PasswordResetCompletedEventDataSchema,\n AuditableEvent_User_PasswordResetForcedEventDataSchema,\n AuditableEvent_User_RegisteredEventDataSchema,\n AuditableEvent_User_EmailVerifiedEventDataSchema,\n AuditableEvent_User_VerificationEmailResentEventDataSchema,\n AuditableEvent_User_MFASetupStartedEventDataSchema,\n AuditableEvent_User_MFASetupCompletedEventDataSchema,\n AuditableEvent_User_MFAEmailOTPSentEventDataSchema,\n AuditableEvent_User_PasskeyRegisteredEventDataSchema,\n AuditableEvent_User_PasskeyAuthSuccessEventDataSchema,\n AuditableEvent_User_PasskeyAuthFailureEventDataSchema,\n AuditableEvent_User_PasskeyRemovedEventDataSchema,\n AuditableEvent_User_MagicLinkSentEventDataSchema,\n AuditableEvent_User_MagicLinkVerifiedEventDataSchema,\n AuditableEvent_User_MagicLinkFailedEventDataSchema,\n AuditableEvent_User_SMSOTPSentEventDataSchema,\n AuditableEvent_User_SMSOTPVerifiedEventDataSchema,\n AuditableEvent_User_SMSOTPFailedEventDataSchema,\n AuditableEvent_User_PhoneVerifiedEventDataSchema,\n AuditableEvent_User_PhoneVerificationFailedEventDataSchema,\n AuditableEvent_OAuth2ProviderBlockedEventDataSchema,\n AuditableEvent_EmergencyAccess_UsedEventDataSchema,\n AuditableEvent_FieldAccess_EventDataSchema,\n AuditableEvent_ResourceOperationPerformed_EventDataSchema,\n AuditableEvent_ResourceOperationDenied_EventDataSchema,\n AuditableEvent_CrossTenantAdministrativeAccess_EventDataSchema,\n AuditableEvent_PlatformDirectoryAccess_EventDataSchema,\n AuditableEvent_PlatformAccessGrantLifecycle_EventDataSchema,\n AuditableEvent_RetainedDataAccess_EventDataSchema,\n AuditableEvent_SubjectDataExport_EventDataSchema,\n AuditableEvent_CollectionDataExport_EventDataSchema,\n AuditableEvent_User_SessionEvictedEventDataSchema,\n AuditableEvent_HttpApiReadThroughAccess_EventDataSchema,\n AuditableEvent_HttpApiExternalErasure_EventDataSchema,\n AuditableEvent_HttpApiNonErasureAcknowledged_EventDataSchema,\n AuditableEvent_User_CrossFrontendHandoffIssuedEventDataSchema,\n AuditableEvent_OAuth_DelegatedTokenIssuedEventDataSchema,\n AuditableEvent_OAuth_ConsentGrantedEventDataSchema,\n AuditableEvent_OAuth_ConsentDeniedEventDataSchema,\n AuditableEvent_OAuth_ConsentGrantPersistedEventDataSchema,\n AuditableEvent_OAuth_TokenRefreshedEventDataSchema,\n AuditableEvent_OAuth_TokenRevokedEventDataSchema,\n AuditableEvent_OAuth_RpInitiatedLogoutEventDataSchema,\n AuditableEvent_OAuth_CodeExchangeFailedEventDataSchema,\n AuditableEvent_OAuth_ConsentBindingViolationEventDataSchema,\n AuditableEvent_User_RefreshTokenReuseDetectedEventDataSchema,\n]);\n\n\n\n\nexport type AuditableEvent = z.infer<typeof AuditableEvent_BaseSchema>;\nexport type AuditableEvent_User_LoginEventData = z.infer<typeof AuditableEvent_User_LoginEventDataSchema>;\nexport type AuditableEvent_User_LogoutEventData = z.infer<typeof AuditableEvent_User_LogoutEventDataSchema>;\nexport type AuditableEvent_User_LoginFailedEventData = z.infer<typeof AuditableEvent_User_LoginFailedEventDataSchema>;\nexport type AuditableEvent_MachineAuth_SuccessEventData = z.infer<typeof AuditableEvent_MachineAuth_SuccessEventDataSchema>;\nexport type AuditableEvent_MachineAuth_FailedEventData = z.infer<typeof AuditableEvent_MachineAuth_FailedEventDataSchema>;\nexport type AuditableEvent_MachineAccess_EventData = z.infer<typeof AuditableEvent_MachineAccess_EventDataSchema>;\nexport type AuditableEvent_User_AccountLockedEventData = z.infer<typeof AuditableEvent_User_AccountLockedEventDataSchema>;\nexport type AuditableEvent_User_SessionExpiredEventData = z.infer<typeof AuditableEvent_User_SessionExpiredEventDataSchema>;\nexport type AuditableEvent_User_AppRolesChangedEventData = z.infer<typeof AuditableEvent_User_AppRolesChangedEventDataSchema>;\nexport type AuditableEvent_Application_SuperAdminFloorBreachedEventData = z.infer<typeof AuditableEvent_Application_SuperAdminFloorBreachedEventDataSchema>;\nexport type AuditableEvent_Organization_OwnerFloorBreachedEventData = z.infer<typeof AuditableEvent_Organization_OwnerFloorBreachedEventDataSchema>;\nexport type AuditableEvent_User_DeletedEventData = z.infer<typeof AuditableEvent_User_DeletedEventDataSchema>;\nexport type AuditableEvent_OrganizationMember_InvitedEventData = z.infer<typeof AuditableEvent_OrganizationMember_InvitedEventDataSchema>;\nexport type AuditableEvent_OrganizationMember_JoinedEventData = z.infer<typeof AuditableEvent_OrganizationMember_JoinedEventDataSchema>;\nexport type AuditableEvent_OrganizationMember_UpdatedEventData = z.infer<typeof AuditableEvent_OrganizationMember_UpdatedEventDataSchema>;\nexport type AuditableEvent_OrganizationMember_RoleChangedEventData = z.infer<typeof AuditableEvent_OrganizationMember_RoleChangedEventDataSchema>;\nexport type AuditableEvent_OrganizationMember_StatusChangedEventData = z.infer<typeof AuditableEvent_OrganizationMember_StatusChangedEventDataSchema>;\nexport type AuditableEvent_OrganizationMember_RemovedEventData = z.infer<typeof AuditableEvent_OrganizationMember_RemovedEventDataSchema>;\nexport type AuditableEvent_Organization_CreatedEventData = z.infer<typeof AuditableEvent_Organization_CreatedEventDataSchema>;\nexport type AuditableEvent_Organization_UpdatedEventData = z.infer<typeof AuditableEvent_Organization_UpdatedEventDataSchema>;\nexport type AuditableEvent_Organization_DeletedEventData = z.infer<typeof AuditableEvent_Organization_DeletedEventDataSchema>;\nexport type AuditableEvent_Organization_DeletionRequestedEventData = z.infer<typeof AuditableEvent_Organization_DeletionRequestedEventDataSchema>;\nexport type AuditableEvent_Organization_RestoredEventData = z.infer<typeof AuditableEvent_Organization_RestoredEventDataSchema>;\nexport type AuditableEvent_Organization_SuspendedEventData = z.infer<typeof AuditableEvent_Organization_SuspendedEventDataSchema>;\nexport type AuditableEvent_Resource_StatusTransitionPerformedEventData = z.infer<typeof AuditableEvent_Resource_StatusTransitionPerformedEventDataSchema>;\nexport type AuditableEvent_Organization_ActivatedEventData = z.infer<typeof AuditableEvent_Organization_ActivatedEventDataSchema>;\nexport type AuditableEvent_OrganizationNotifications_UpdatedEventData = z.infer<typeof AuditableEvent_OrganizationNotifications_UpdatedEventDataSchema>;\nexport type AuditableEvent_OrganizationPreferences_UpdatedEventData = z.infer<typeof AuditableEvent_OrganizationPreferences_UpdatedEventDataSchema>;\nexport type AuditableEvent_OrganizationProfile_UpdatedEventData = z.infer<typeof AuditableEvent_OrganizationProfile_UpdatedEventDataSchema>;\nexport type AuditableEvent_OrganizationUnit_UpdatedEventData = z.infer<typeof AuditableEvent_OrganizationUnit_UpdatedEventDataSchema>;\nexport type AuditableEvent_OrganizationUnitMember_RoleChangedEventData = z.infer<typeof AuditableEvent_OrganizationUnitMember_RoleChangedEventDataSchema>;\nexport type AuditableEvent_OrganizationUnitMember_RemovedEventData = z.infer<typeof AuditableEvent_OrganizationUnitMember_RemovedEventDataSchema>;\nexport type AuditableEvent_User_SSOLoginEventData = z.infer<typeof AuditableEvent_User_SSOLoginEventDataSchema>;\nexport type AuditableEvent_User_SSOLoginFailedEventData = z.infer<typeof AuditableEvent_User_SSOLoginFailedEventDataSchema>;\nexport type AuditableEvent_User_SSOEnforcementBlockedEventData = z.infer<typeof AuditableEvent_User_SSOEnforcementBlockedEventDataSchema>;\nexport type AuditableEvent_User_TokenRefreshedEventData = z.infer<typeof AuditableEvent_User_TokenRefreshedEventDataSchema>;\nexport type AuditableEvent_Organization_SSOConfigurationChangedEventData = z.infer<typeof AuditableEvent_Organization_SSOConfigurationChangedEventDataSchema>;\nexport type AuditableEvent_Organization_SIEMExportConfiguredEventData = z.infer<typeof AuditableEvent_Organization_SIEMExportConfiguredEventDataSchema>;\nexport type ApplicationAuthPolicySnapshot = z.infer<typeof ApplicationAuthPolicySnapshotSchema>;\nexport type AuditableEvent_ApplicationAuthPolicyChanged_EventData = z.infer<typeof AuditableEvent_ApplicationAuthPolicyChanged_EventDataSchema>;\nexport type AuditableEvent_Webhook_EndpointTestDispatchedEventData = z.infer<typeof AuditableEvent_Webhook_EndpointTestDispatchedEventDataSchema>;\nexport type AuditableEvent_SCIM_TokenCreatedEventData = z.infer<typeof AuditableEvent_SCIM_TokenCreatedEventDataSchema>;\nexport type AuditableEvent_SCIM_TokenRevokedEventData = z.infer<typeof AuditableEvent_SCIM_TokenRevokedEventDataSchema>;\nexport type AuditableEvent_SCIM_UserProvisionedEventData = z.infer<typeof AuditableEvent_SCIM_UserProvisionedEventDataSchema>;\nexport type AuditableEvent_SCIM_UserUpdatedEventData = z.infer<typeof AuditableEvent_SCIM_UserUpdatedEventDataSchema>;\nexport type AuditableEvent_SCIM_UserDeactivatedEventData = z.infer<typeof AuditableEvent_SCIM_UserDeactivatedEventDataSchema>;\nexport type AuditableEvent_User_PasswordResetRequestedEventData = z.infer<typeof AuditableEvent_User_PasswordResetRequestedEventDataSchema>;\nexport type AuditableEvent_User_PasswordResetCompletedEventData = z.infer<typeof AuditableEvent_User_PasswordResetCompletedEventDataSchema>;\nexport type AuditableEvent_User_PasswordResetForcedEventData = z.infer<typeof AuditableEvent_User_PasswordResetForcedEventDataSchema>;\nexport type AuditableEvent_User_RegisteredEventData = z.infer<typeof AuditableEvent_User_RegisteredEventDataSchema>;\nexport type AuditableEvent_User_EmailVerifiedEventData = z.infer<typeof AuditableEvent_User_EmailVerifiedEventDataSchema>;\nexport type AuditableEvent_User_VerificationEmailResentEventData = z.infer<typeof AuditableEvent_User_VerificationEmailResentEventDataSchema>;\nexport type AuditableEvent_User_MFASetupStartedEventData = z.infer<typeof AuditableEvent_User_MFASetupStartedEventDataSchema>;\nexport type AuditableEvent_User_MFASetupCompletedEventData = z.infer<typeof AuditableEvent_User_MFASetupCompletedEventDataSchema>;\nexport type AuditableEvent_User_MFAEmailOTPSentEventData = z.infer<typeof AuditableEvent_User_MFAEmailOTPSentEventDataSchema>;\nexport type AuditableEvent_User_PasskeyRegisteredEventData = z.infer<typeof AuditableEvent_User_PasskeyRegisteredEventDataSchema>;\nexport type AuditableEvent_User_PasskeyAuthSuccessEventData = z.infer<typeof AuditableEvent_User_PasskeyAuthSuccessEventDataSchema>;\nexport type AuditableEvent_User_PasskeyAuthFailureEventData = z.infer<typeof AuditableEvent_User_PasskeyAuthFailureEventDataSchema>;\nexport type AuditableEvent_User_PasskeyRemovedEventData = z.infer<typeof AuditableEvent_User_PasskeyRemovedEventDataSchema>;\nexport type AuditableEvent_User_MagicLinkSentEventData = z.infer<typeof AuditableEvent_User_MagicLinkSentEventDataSchema>;\nexport type AuditableEvent_User_MagicLinkVerifiedEventData = z.infer<typeof AuditableEvent_User_MagicLinkVerifiedEventDataSchema>;\nexport type AuditableEvent_User_MagicLinkFailedEventData = z.infer<typeof AuditableEvent_User_MagicLinkFailedEventDataSchema>;\nexport type AuditableEvent_User_SMSOTPSentEventData = z.infer<typeof AuditableEvent_User_SMSOTPSentEventDataSchema>;\nexport type AuditableEvent_User_SMSOTPVerifiedEventData = z.infer<typeof AuditableEvent_User_SMSOTPVerifiedEventDataSchema>;\nexport type AuditableEvent_User_SMSOTPFailedEventData = z.infer<typeof AuditableEvent_User_SMSOTPFailedEventDataSchema>;\nexport type AuditableEvent_User_PhoneVerifiedEventData = z.infer<typeof AuditableEvent_User_PhoneVerifiedEventDataSchema>;\nexport type AuditableEvent_User_PhoneVerificationFailedEventData = z.infer<typeof AuditableEvent_User_PhoneVerificationFailedEventDataSchema>;\nexport type AuditableEvent_EmergencyAccess_UsedEventData = z.infer<typeof AuditableEvent_EmergencyAccess_UsedEventDataSchema>;\nexport type AuditableEvent_FieldAccess_EventData = z.infer<typeof AuditableEvent_FieldAccess_EventDataSchema>;\nexport type AuditableEvent_ResourceOperationPerformed_EventData = z.infer<typeof AuditableEvent_ResourceOperationPerformed_EventDataSchema>;\nexport type AuditableEvent_PlatformDirectoryAccess_EventData = z.infer<typeof AuditableEvent_PlatformDirectoryAccess_EventDataSchema>;\nexport type AuditableEvent_ResourceOperationDenied_EventData = z.infer<typeof AuditableEvent_ResourceOperationDenied_EventDataSchema>;\nexport type AuditableEvent_RetainedDataAccess_EventData = z.infer<typeof AuditableEvent_RetainedDataAccess_EventDataSchema>;\nexport type AuditableEvent_SubjectDataExport_EventData = z.infer<typeof AuditableEvent_SubjectDataExport_EventDataSchema>;\nexport type AuditableEvent_CollectionDataExport_EventData = z.infer<typeof AuditableEvent_CollectionDataExport_EventDataSchema>;\nexport type AuditableEvent_User_SessionEvictedEventData = z.infer<typeof AuditableEvent_User_SessionEvictedEventDataSchema>;\nexport type AuditableEvent_HttpApiReadThroughAccess_EventData = z.infer<typeof AuditableEvent_HttpApiReadThroughAccess_EventDataSchema>;\nexport type AuditableEvent_HttpApiExternalErasure_EventData = z.infer<typeof AuditableEvent_HttpApiExternalErasure_EventDataSchema>;\nexport type AuditableEvent_HttpApiNonErasureAcknowledged_EventData = z.infer<typeof AuditableEvent_HttpApiNonErasureAcknowledged_EventDataSchema>;\nexport type AuditableEvent_User_CrossFrontendHandoffIssuedEventData = z.infer<typeof AuditableEvent_User_CrossFrontendHandoffIssuedEventDataSchema>;\nexport type AuditableEvent_OAuth_DelegatedTokenIssuedEventData = z.infer<typeof AuditableEvent_OAuth_DelegatedTokenIssuedEventDataSchema>;\nexport type AuditableEvent_OAuth_ConsentGrantedEventData = z.infer<typeof AuditableEvent_OAuth_ConsentGrantedEventDataSchema>;\nexport type AuditableEvent_OAuth_ConsentDeniedEventData = z.infer<typeof AuditableEvent_OAuth_ConsentDeniedEventDataSchema>;\nexport type AuditableEvent_OAuth_ConsentGrantPersistedEventData = z.infer<typeof AuditableEvent_OAuth_ConsentGrantPersistedEventDataSchema>;\nexport type AuditableEvent_OAuth_DynamicClientRegisteredEventData = z.infer<typeof AuditableEvent_OAuth_DynamicClientRegisteredEventDataSchema>;\nexport type AuditableEvent_OAuth_CimdClientRefusedEventData = z.infer<typeof AuditableEvent_OAuth_CimdClientRefusedEventDataSchema>;\nexport type AuditableEvent_OAuth_TokenRefreshedEventData = z.infer<typeof AuditableEvent_OAuth_TokenRefreshedEventDataSchema>;\nexport type AuditableEvent_OAuth_TokenRevokedEventData = z.infer<typeof AuditableEvent_OAuth_TokenRevokedEventDataSchema>;\nexport type AuditableEvent_OAuth_RpInitiatedLogoutEventData = z.infer<typeof AuditableEvent_OAuth_RpInitiatedLogoutEventDataSchema>;\nexport type AuditableEvent_OAuth_CodeExchangeFailedEventData = z.infer<typeof AuditableEvent_OAuth_CodeExchangeFailedEventDataSchema>;\nexport type AuditableEvent_OAuth_ConsentBindingViolationEventData = z.infer<typeof AuditableEvent_OAuth_ConsentBindingViolationEventDataSchema>;\nexport type AuditableEvent_User_RefreshTokenReuseDetectedEventData = z.infer<typeof AuditableEvent_User_RefreshTokenReuseDetectedEventDataSchema>;\n"]}