@wildo-ai/saas-models 1.1.2 → 1.1.4

package/dist/esm/compliance/audit-trails/security-audit-event-envelope.shared.schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"security-audit-event-envelope.shared.schema.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/audit-trails/security-audit-event-envelope.shared.schema.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAElH,sDAAsD;AACtD,oBAAY,iBAAiB;IAC3B,OAAO,YAAY;IACnB,OAAO,YAAY;CACpB;AAED;;oEAEoE;AAEpE,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAuD3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F;;;;;oEAKoE;AAEpE,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,QAAQ,EAAE,kBAAkB,CAAC;CAC9B;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,8BAA8B,EAAE,MAAM,CAAC,sBAAsB,EAAE,wBAAwB,CAiVnG,CAAC;AAIF;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,wBAAwB,CAEvF"}
+{"version":3,"file":"security-audit-event-envelope.shared.schema.d.ts","sourceRoot":"","sources":["../../../../src/compliance/audit-trails/security-audit-event-envelope.shared.schema.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAGL,kBAAkB,EAClB,kBAAkB,EAClB,sBAAsB,EAEvB,MAAM,kCAAkC,CAAC;AAE1C,sDAAsD;AACtD,oBAAY,iBAAiB;IAC3B,OAAO,YAAY;IACnB,OAAO,YAAY;CACpB;AAED;;oEAEoE;AAEpE,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA4E3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F;;;;;oEAKoE;AAEpE,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,QAAQ,EAAE,kBAAkB,CAAC;CAC9B;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,8BAA8B,EAAE,MAAM,CAAC,sBAAsB,EAAE,wBAAwB,CAoanG,CAAC;AAIF;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,wBAAwB,CAEvF"}

package/dist/esm/compliance/audit-trails/security-audit-event-envelope.shared.schema.js

@@ -6,7 +6,7 @@
  * Org SIEM export ships per-org security events to the customer's own SIEM.
  */
 import { z } from 'zod';
-import { AuditEventCategory, AuditEventSeverity, CoreAuditableEventType } from './auditable-events.shared.schema.js';
+import { AUDIT_EVENT_CATEGORY_MEANINGS, AUDIT_EVENT_SEVERITY_MEANINGS, AuditEventCategory, AuditEventSeverity, CoreAuditableEventType, describeAuditVocabulary, } from './auditable-events.shared.schema.js';
 /** Outcome for SIEM envelope — success or failure. */
 export var AuditEventOutcome;
 (function (AuditEventOutcome) {
@@ -18,10 +18,31 @@ export var AuditEventOutcome;
  * ────────────────────────────────────────────────────────────── */
 export const SecurityAuditEventEnvelopeSchema = z.object({
     // Standard fields (always present)
+    /**
+     * The AUDIT ROW's own `eventId` (`AuditableEvent.eventId`) — copied here, never minted for the
+     * delivery. It is doing two jobs and both need it to be that value:
+     *
+     *  - it is the receiver's IDEMPOTENCY key. Every wire format carries this one field through:
+     *    CEF `externalId`, LEEF `eventId`, OCSF `metadata.uid`, and the verbatim `json_structured`
+     *    body's top-level `eventId`. It is stable across every retry of a delivery (the envelope is
+     *    built once and re-sent, including from the dead-letter drain).
+     *  - it is the CORRELATION key back into the application. The same value is on the audit row, on
+     *    the immudb record, and is what `AuditLogVerification.verifyAuditEvent(eventId)` resolves —
+     *    so a record in the customer's SIEM can be traced to the event it was projected from.
+     *
+     * The second job was silently absent until 2026-09-09: the dispatcher minted a fresh uuid here,
+     * which deduplicated correctly and named nothing. See `_resolveEnvelopeEventId` in
+     * `audit-event-dispatcher.backend.service.ts` for the cutover reasoning.
+     *
+     * NOTE one audit event fanned out to several member orgs delivers the SAME id to each of those
+     * tenants' sinks. They are different receivers, so dedup is unaffected — and it is one event.
+     */
     eventId: z.string(),
     eventType: z.string(),
-    eventCategory: z.enum(AuditEventCategory),
-    severity: z.enum(AuditEventSeverity),
+    eventCategory: z.enum(AuditEventCategory)
+        .describe(describeAuditVocabulary('What kind of activity this event records.', AUDIT_EVENT_CATEGORY_MEANINGS)),
+    severity: z.enum(AuditEventSeverity)
+        .describe(describeAuditVocabulary('How much attention this event asks for.', AUDIT_EVENT_SEVERITY_MEANINGS)),
     timestamp: z.string(),
     /** Request-correlation id (groups every event of one request; matches the app's logs/errors). */
     correlationId: z.string().optional(),
@@ -170,6 +191,47 @@ export const AUDIT_EVENT_CLASSIFICATION_MAP = {
     // Organization Security Management Events
     [CoreAuditableEventType.ORGANIZATION_SSO_CONFIGURATION_CHANGED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },
     [CoreAuditableEventType.ORGANIZATION_SIEM_EXPORT_CONFIGURED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },
+    // Organization provider credentials — an organization's own authority toward a third party.
+    //
+    // ORG_MANAGEMENT, not AUTHORIZATION: the AUTHORIZATION category is about what a principal may do
+    // INSIDE this application, and these events are about what the application may do OUTSIDE it as
+    // the tenant. Filing them under authorization would put them in the same SIEM bucket as role
+    // grants, where a reviewer looking for outbound authority would never think to look.
+    //
+    // WARNING on the three lifecycle verbs, mirroring the SSO-configuration sibling: each one MOVES
+    // the authority the application holds toward a third party, and a tenant's credentials changing
+    // outside a change window is the shape of a compromise.
+    [CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_SET]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },
+    [CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_ROTATED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },
+    // INFO, and deliberately so despite being the security-relevant one. A use event fires on every
+    // outbound provider call, so WARNING here would flood the channel and train an operator to filter
+    // the whole category out — taking the two verbs above with it. The signal a reviewer wants from
+    // this stream is the PATTERN (which tenant spends which provider, how often, and whether it
+    // resolved from its own credential or fell back to the deployment's), which INFO preserves.
+    [CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_USED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },
+    [CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_DELETED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },
+    // A person's own credential. USER_LIFECYCLE rather than ORG_MANAGEMENT, by the same reading that
+    // put the tenant's in ORG_MANAGEMENT: a stored third-party credential is a setting on the account
+    // that owns it, and here that account is a person. Filing these under the tenant's category would
+    // put a person's connections into the view an administrator reads as "what my organization did",
+    // which is both the wrong subject and, for a personal vendor account, the wrong audience.
+    //
+    // Severities mirror the organization's exactly and for the same reasons — INFO on the high-volume
+    // spend so the pattern survives without flooding, WARNING on removal because a credential
+    // disappearing is how an integration stops working and the first question is always whether a
+    // human did it.
+    [CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_SET]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.INFO },
+    [CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_ROTATED]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.INFO },
+    [CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_USED]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.INFO },
+    [CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_DELETED]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.WARNING },
+    // A delegated authorization being GRANTED. Each mirrors its OWN `_SET` sibling rather than taking
+    // one rule for both, because the two families are already classified differently and deliberately:
+    // a tenant's credential arriving is ORG_MANAGEMENT/WARNING — a shared integration changing under
+    // every member of that tenant — while a person's is USER_LIFECYCLE/INFO, one individual's own
+    // account. A grant carries exactly the same consequence as the set it accompanies, so it inherits
+    // the same reading; what makes it worth having is its payload, not its severity.
+    [CoreAuditableEventType.ORGANIZATION_PROVIDER_CONNECTION_GRANTED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },
+    [CoreAuditableEventType.USER_PROVIDER_CONNECTION_GRANTED]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.INFO },
     // Application Security Configuration Events
     // WARNING mirrors the SSO-configuration-changed sibling: a change to the authentication assurance
     // posture (MFA / password / lockout) is more than record-keeping (INFO) yet is not an active
@@ -230,6 +292,9 @@ export const AUDIT_EVENT_CLASSIFICATION_MAP = {
     [CoreAuditableEventType.USER_PASSKEY_AUTHENTICATION_SUCCESS]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },
     [CoreAuditableEventType.USER_PASSKEY_AUTHENTICATION_FAILURE]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },
     [CoreAuditableEventType.USER_PASSKEY_REMOVED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },
+    // CRITICAL, and the only passkey event that is: a verified assertion whose counter regressed means
+    // a private key may exist in two places. Its siblings are routine authentication outcomes.
+    [CoreAuditableEventType.USER_PASSKEY_CLONE_SUSPECTED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.CRITICAL },
     // Magic Link Events (Phase G2)
     [CoreAuditableEventType.USER_MAGIC_LINK_SENT]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },
     [CoreAuditableEventType.USER_MAGIC_LINK_VERIFIED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },
@@ -243,6 +308,12 @@ export const AUDIT_EVENT_CLASSIFICATION_MAP = {
     [CoreAuditableEventType.USER_PHONE_VERIFICATION_FAILED]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.WARNING },
     // OAuth2 Provider Restriction Events (Phase G3)
     [CoreAuditableEventType.OAUTH2_PROVIDER_BLOCKED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },
+    // AUTHENTICATION, not AUTHORIZATION: the demand is about HOW the person proved who they are, and
+    // the refusal happens before any authorization decision exists. WARNING rather than ERROR — a
+    // provider that will not satisfy a step-up demand is a configuration disagreement between two
+    // parties, expected to recur until an operator changes one of them, and an ERROR channel that
+    // fills with it stops being read.
+    [CoreAuditableEventType.OIDC_ACR_DEMAND_UNSATISFIED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },
     // SCIM Extended Events
     [CoreAuditableEventType.SCIM_TOKEN_GENERATED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },
     [CoreAuditableEventType.SCIM_TOKEN_ROTATED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },
@@ -270,6 +341,20 @@ export const AUDIT_EVENT_CLASSIFICATION_MAP = {
     [CoreAuditableEventType.FILE_UPLOAD_GRANT_ISSUED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.INFO },
     [CoreAuditableEventType.FILE_UPLOAD_GRANT_REDEEMED]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.INFO },
     [CoreAuditableEventType.FILE_UPLOAD_GRANT_REVOKED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },
+    /*
+     * DATA_ACCESS for both, and it is the least-wrong of five rather than a good fit (#506). The
+     * category vocabulary has no security-operations member, and the file plane's own precedent splits
+     * the grant events the same way — AUTHORIZATION for issuing and revoking a credential, DATA_ACCESS
+     * for the moment content actually moves. A scan is a conclusion about CONTENT that arrived, so it
+     * belongs on the second side.
+     *
+     * The severities are the substance: an infection is a threat the control CAUGHT (critical, same
+     * argument as a suspected passkey clone), a scan failure is the control not having RUN (warning —
+     * nothing was found and nothing was exposed, because the file fails closed to a non-downloadable
+     * status either way; what is wrong is availability).
+     */
+    [CoreAuditableEventType.FILE_MALWARE_DETECTED]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.CRITICAL },
+    [CoreAuditableEventType.FILE_MALWARE_SCAN_FAILED]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.WARNING },
     [CoreAuditableEventType.ONE_OFF_TOKEN_CREATED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },
     [CoreAuditableEventType.ONE_OFF_TOKEN_EXCHANGED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },
     // Revocation is an ADMINISTRATIVE credential-termination — a super-admin cancels an un-exchanged
@@ -345,6 +430,22 @@ export const AUDIT_EVENT_CLASSIFICATION_MAP = {
     // trail (who/which provider/which entity/how much), not an alarm. WARNING would put every
     // ordinary external read beside see-through privileged access and train reviewers to skim.
     [CoreAuditableEventType.HTTP_API_READ_THROUGH_ACCESS]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.INFO },
+    // The other outbound door: a custom service calling a declared provider operation. Same reading as
+    // the read-through row above — routine, authorized activity whose value is the queryable trail. The
+    // READ/WRITE axis and the failure case ride `classification`, `failureKind` and the per-emission
+    // `riskLevel`; raising the static severity for the write case would raise it for every read too.
+    [CoreAuditableEventType.PROVIDER_OPERATION_CALL]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.INFO },
+    // Same classification as its sibling above, for the same reason: routine authorized activity whose
+    // value is the queryable trail rather than an alarm. A refused target rides `failureKind`/`outcome`
+    // on the payload, never the static severity — see the enum member's docstring.
+    [CoreAuditableEventType.MCP_TOOL_CALL]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.INFO },
+    // A human approver AUTHORED the arguments a gated tool ran with. AUTHORIZATION rather than
+    // DATA_ACCESS because the recorded act is the DECISION, not the tool's effect — whatever the tool
+    // then touched is recorded by the tool's own operation rows. WARNING rather than CRITICAL for the
+    // same reading as the OAuth grant rows: an identified person taking an authorized action with the
+    // pause in front of them is notable, not wrong, and reserving CRITICAL for rows that mean
+    // something IS wrong is what keeps a severity filter worth reading.
+    [CoreAuditableEventType.AGENT_TOOL_APPROVAL_MODIFIED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },
     // The sanctioned mechanics of a data-protection request (D6 stance 6b) — routine, not an alarm.
     [CoreAuditableEventType.HTTP_API_EXTERNAL_ERASURE]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.INFO },
     // A deliberate, per-request erasure hole (D6 stance 6c) — the record is the control, so it must

package/dist/esm/compliance/audit-trails/security-audit-event-envelope.shared.schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"security-audit-event-envelope.shared.schema.js","sourceRoot":"","sources":["../../../../../src/compliance/audit-trails/security-audit-event-envelope.shared.schema.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAElH,sDAAsD;AACtD,MAAM,CAAN,IAAY,iBAGX;AAHD,WAAY,iBAAiB;IAC3B,wCAAmB,CAAA;IACnB,wCAAmB,CAAA;AACrB,CAAC,EAHW,iBAAiB,KAAjB,iBAAiB,QAG5B;AAED;;oEAEoE;AAEpE,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,mCAAmC;IACnC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;IACzC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,iGAAiG;IACjG,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC;;;;;OAKG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC;;;;;OAKG;IACH,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE1C,UAAU;IACV,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEhC,SAAS;IACT,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE;IAE7B,0CAA0C;IAC1C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC9B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC5B,CAAC,CAAC,QAAQ,EAAE;IAEb,sBAAsB;IACtB,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;IAExC,UAAU;IACV,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC;IAClC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC;AAgBH;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAA6D;IACtG,wBAAwB;IACxB,CAAC,sBAAsB,CAAC,UAAU,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACvH,CAAC,sBAAsB,CAAC,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACxH,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACjI,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IACpI,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACjI,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACnI,gGAAgG;IAChG,kGAAkG;IAClG,qDAAqD;IACrD,CAAC,sBAAsB,CAAC,cAAc,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACxH,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACrI,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAChI,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACjI,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACjI;;;;;OAKG;IACH,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAEpI,4BAA4B;IAC5B,CAAC,sBAAsB,CAAC,cAAc,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAC3H,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACrI,CAAC,sBAAsB,CAAC,4BAA4B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAC7I,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAEjI,0BAA0B;IAC1B,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAEtI,wBAAwB;IACxB,CAAC,sBAAsB,CAAC,YAAY,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACzH,CAAC,sBAAsB,CAAC,YAAY,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACzH,CAAC,sBAAsB,CAAC,YAAY,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAEzH,wFAAwF;IACxF,4FAA4F;IAC5F,iGAAiG;IACjG,qFAAqF;IACrF,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAErI,iGAAiG;IACjG,mGAAmG;IACnG,oGAAoG;IACpG,4FAA4F;IAC5F,CAAC,sBAAsB,CAAC,sCAAsC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IACtJ,CAAC,sBAAsB,CAAC,iCAAiC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAEjJ,gCAAgC;IAChC,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACjI,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACjI,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACpI,CAAC,sBAAsB,CAAC,+BAA+B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAC/I,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAClI,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACtI,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACnI,4FAA4F;IAC5F,0FAA0F;IAC1F,oFAAoF;IACpF,wFAAwF;IACxF,+FAA+F;IAC/F,gGAAgG;IAChG,6FAA6F;IAC7F,sDAAsD;IACtD,CAAC,sBAAsB,CAAC,oCAAoC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAEpJ,6BAA6B;IAC7B,CAAC,sBAAsB,CAAC,2BAA2B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACxI,CAAC,sBAAsB,CAAC,0BAA0B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACvI,CAAC,sBAAsB,CAAC,2BAA2B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACxI,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAC/I,CAAC,sBAAsB,CAAC,kCAAkC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAC/I,CAAC,sBAAsB,CAAC,2BAA2B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAE3I,6BAA6B;IAC7B,CAAC,sBAAsB,CAAC,kCAAkC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAC/I,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAC7I,CAAC,sBAAsB,CAAC,4BAA4B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACzI,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAEtI,qGAAqG;IACrG,mGAAmG;IACnG,0FAA0F;IAC1F,mGAAmG;IACnG,uEAAuE;IACvE,CAAC,sBAAsB,CAAC,qCAAqC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAEpJ,qGAAqG;IACrG,6FAA6F;IAC7F,2FAA2F;IAC3F,8FAA8F;IAC9F,+DAA+D;IAC/D,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAE/I,0CAA0C;IAC1C,CAAC,sBAAsB,CAAC,sCAAsC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACtJ,CAAC,sBAAsB,CAAC,mCAAmC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAEhJ,4CAA4C;IAC5C,kGAAkG;IAClG,6FAA6F;IAC7F,gGAAgG;IAChG,oEAAoE;IACpE,CAAC,sBAAsB,CAAC,+BAA+B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAE/I,8BAA8B;IAC9B,6FAA6F;IAC7F,8FAA8F;IAC9F,qBAAqB;IACrB,EAAE;IACF,2FAA2F;IAC3F,4FAA4F;IAC5F,iGAAiG;IACjG,iGAAiG;IACjG,+FAA+F;IAC/F,gGAAgG;IAChG,2EAA2E;IAC3E,EAAE;IACF,gGAAgG;IAChG,gGAAgG;IAChG,+FAA+F;IAC/F,iGAAiG;IACjG,kGAAkG;IAClG,8FAA8F;IAC9F,kGAAkG;IAClG,6EAA6E;IAC7E,qFAAqF;IACrF,EAAE;IACF,wFAAwF;IACxF,kGAAkG;IAClG,+FAA+F;IAC/F,0CAA0C;IAC1C,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAEhJ,qCAAqC;IACrC,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAClI,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAClI,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAClI,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAC9H,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAErI,6BAA6B;IAC7B,CAAC,sBAAsB,CAAC,6BAA6B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAC1I,CAAC,sBAAsB,CAAC,6BAA6B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAC7I,yFAAyF;IACzF,2FAA2F;IAC3F,2DAA2D;IAC3D,CAAC,sBAAsB,CAAC,0BAA0B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAE3I,0CAA0C;IAC1C,CAAC,sBAAsB,CAAC,eAAe,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAC5H,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAChI,CAAC,sBAAsB,CAAC,8BAA8B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAE3I,4BAA4B;IAC5B,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACnI,CAAC,sBAAsB,CAAC,wBAAwB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACxI,CAAC,sBAAsB,CAAC,uBAAuB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAEpI,qCAAqC;IACrC,CAAC,sBAAsB,CAAC,uBAAuB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACvI,CAAC,sBAAsB,CAAC,mCAAmC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAChJ,CAAC,sBAAsB,CAAC,mCAAmC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACnJ,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAEpI,+BAA+B;IAC/B,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACjI,CAAC,sBAAsB,CAAC,wBAAwB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACrI,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAEtI,4BAA4B;IAC5B,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAC9H,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAClI,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAEnI,uCAAuC;IACvC,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAChI,CAAC,sBAAsB,CAAC,8BAA8B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAE9I,gDAAgD;IAChD,CAAC,sBAAsB,CAAC,uBAAuB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAEtI,uBAAuB;IACvB,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACpI,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAClI,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAC7I,CAAC,sBAAsB,CAAC,wBAAwB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAEzI,6CAA6C;IAC7C,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACjI,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAC/H,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACjI,CAAC,sBAAsB,CAAC,8BAA8B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAC/I,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAClI,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAC/H,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAC/H,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACjI,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAElI,kCAAkC;IAClC,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACjI,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAClI,CAAC,sBAAsB,CAAC,0BAA0B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAE1I,iCAAiC;IACjC,oGAAoG;IACpG,qGAAqG;IACrG,sGAAsG;IACtG,yEAAyE;IACzE,CAAC,sBAAsB,CAAC,wBAAwB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACpI,CAAC,sBAAsB,CAAC,0BAA0B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACpI,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACxI,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAClI,CAAC,sBAAsB,CAAC,uBAAuB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACpI,iGAAiG;IACjG,qGAAqG;IACrG,+FAA+F;IAC/F,qGAAqG;IACrG,uEAAuE;IACvE,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAErI,mEAAmE;IACnE,qFAAqF;IACrF,8EAA8E;IAC9E,2FAA2F;IAC3F,sFAAsF;IACtF,CAAC,sBAAsB,CAAC,kCAAkC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAElJ,sBAAsB;IACtB,CAAC,sBAAsB,CAAC,YAAY,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAEtH,mFAAmF;IACnF,gGAAgG;IAChG,iGAAiG;IACjG,iGAAiG;IACjG,8FAA8F;IAC9F,wFAAwF;IACxF,8FAA8F;IAC9F,4CAA4C;IAC5C,CAAC,sBAAsB,CAAC,4BAA4B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAE3I,mGAAmG;IACnG,mCAAmC;IACnC,EAAE;IACF,kGAAkG;IAClG,mGAAmG;IACnG,mGAAmG;IACnG,kGAAkG;IAClG,iGAAiG;IACjG,sFAAsF;IACtF,EAAE;IACF,mGAAmG;IACnG,mGAAmG;IACnG,gGAAgG;IAChG,yDAAyD;IACzD,EAAE;IACF,+DAA+D;IAC/D,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACxI,kGAAkG;IAClG,6FAA6F;IAC7F,kGAAkG;IAClG,oGAAoG;IACpG,iDAAiD;IACjD,CAAC,sBAAsB,CAAC,kCAAkC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACjJ,gGAAgG;IAChG,mGAAmG;IACnG,oGAAoG;IACpG,8FAA8F;IAC9F,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACnI,kGAAkG;IAClG,mGAAmG;IACnG,oGAAoG;IACpG,kEAAkE;IAClE,CAAC,sBAAsB,CAAC,+BAA+B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAE9I,kDAAkD;IAClD,oGAAoG;IACpG,oGAAoG;IACpG,oGAAoG;IACpG,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACjI,kGAAkG;IAClG,mGAAmG;IACnG,mDAAmD;IACnD,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAChI,oGAAoG;IACpG,oGAAoG;IACpG,oGAAoG;IACpG,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAChI,6FAA6F;IAC7F,0FAA0F;IAC1F,2FAA2F;IAC3F,CAAC,sBAAsB,CAAC,4BAA4B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACtI,gGAAgG;IAChG,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACtI,gGAAgG;IAChG,sEAAsE;IACtE,CAAC,sBAAsB,CAAC,iCAAiC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAElJ,kGAAkG;IAClG,qGAAqG;IACrG,qGAAqG;IACrG,qGAAqG;IACrG,wDAAwD;IACxD,CAAC,sBAAsB,CAAC,4BAA4B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAC3I,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACpI,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAChI,CAAC,sBAAsB,CAAC,6BAA6B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAC5I,+FAA+F;IAC/F,+FAA+F;IAC/F,oEAAoE;IACpE,8FAA8F;IAC9F,kGAAkG;IAClG,4DAA4D;IAC5D,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACzI,CAAC,sBAAsB,CAAC,+BAA+B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAC/I,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAClI,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAChI,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACtI,CAAC,sBAAsB,CAAC,0BAA0B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAC1I,CAAC,sBAAsB,CAAC,+BAA+B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAC/I,CAAC,sBAAsB,CAAC,iCAAiC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAElJ,gGAAgG;IAChG,wFAAwF;IACxF,kGAAkG;IAClG,2FAA2F;IAC3F,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAC7H,iGAAiG;IACjG,+FAA+F;IAC/F,oGAAoG;IACpG,iGAAiG;IACjG,0FAA0F;IAC1F,+CAA+C;IAC/C,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;CAClI,CAAC;AAEF,MAAM,kCAAkC,GAA6B,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE,CAAC;AAErJ;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CAAC,SAAiB;IAC3D,OAAO,8BAA8B,CAAC,SAAmC,CAAC,IAAI,kCAAkC,CAAC;AACnH,CAAC","sourcesContent":["/**\n * Security Audit Event Envelope — the structured JSON payload sent to customer SIEM.\n * \n * This is the canonical format for events exported via the org-level SIEM export pipeline.\n * Different from platform observability (which ships to Axiom/Datadog for platform ops).\n * Org SIEM export ships per-org security events to the customer's own SIEM.\n */\n\nimport { z } from 'zod';\nimport { AuditEventCategory, AuditEventSeverity, CoreAuditableEventType } from './auditable-events.shared.schema';\n\n/** Outcome for SIEM envelope — success or failure. */\nexport enum AuditEventOutcome {\n  SUCCESS = 'success',\n  FAILURE = 'failure',\n}\n\n/** ──────────────────────────────────────────────────────────────\n * Security Audit Event Envelope Schema\n * ────────────────────────────────────────────────────────────── */\n\nexport const SecurityAuditEventEnvelopeSchema = z.object({\n  // Standard fields (always present)\n  eventId: z.string(),\n  eventType: z.string(),\n  eventCategory: z.enum(AuditEventCategory),\n  severity: z.enum(AuditEventSeverity),\n  timestamp: z.string(),\n  /** Request-correlation id (groups every event of one request; matches the app's logs/errors). */\n  correlationId: z.string().optional(),\n  /**\n   * Client-install id — groups an actor's events across sessions and logins, the correlation NIST\n   * SP 800-53 AU-6(3) asks for at review time. Present ONLY for applications that opted into\n   * `compliance.clientInstanceIdScope`; absent (never null-filled) for every other application, so a\n   * SIEM rule keying on it simply never matches rather than seeing an empty field.\n   */\n  clientInstanceId: z.string().optional(),\n  /**\n   * Which frontend SURFACE the request came from (app / website / docs). Carried for the same reason as\n   * the two ids above: an external reviewer correlating in the SIEM needs the same origin axes the audit\n   * row has, and shipping two of the three origin signals was an asymmetry with no rationale behind it.\n   * Absent for non-HTTP (job / cron / internal) events.\n   */\n  frontendServiceName: z.string().optional(),\n\n  // Context\n  organizationId: z.string(),\n  organizationName: z.string().optional(),\n  applicationId: z.string().optional(),\n  applicationName: z.string().optional(),\n  userId: z.string().optional(),\n  userEmail: z.string().optional(),\n\n  // Source\n  sourceService: z.string(),\n  sourceVersion: z.string(),\n  sourceEnvironment: z.string(),\n\n  // Auth-specific context (when applicable)\n  authMethod: z.string().optional(),\n  authSource: z.string().optional(),\n  providerRef: z.string().optional(),\n  connectionType: z.string().optional(),\n  ipAddress: z.string().optional(),\n  userAgent: z.string().optional(),\n  geoLocation: z.object({\n    country: z.string().optional(),\n    city: z.string().optional(),\n  }).optional(),\n\n  // Event-specific data\n  eventData: z.record(z.string(), z.any()),\n\n  // Outcome\n  outcome: z.enum(AuditEventOutcome),\n  outcomeReason: z.string().optional(),\n});\n\nexport type SecurityAuditEventEnvelope = z.infer<typeof SecurityAuditEventEnvelopeSchema>;\n\n/** ──────────────────────────────────────────────────────────────\n * Event Classification Map\n * \n * Maps each CoreAuditableEventType to its category and severity.\n * Used by the dispatcher to classify events for SIEM filtering.\n * ────────────────────────────────────────────────────────────── */\n\nexport interface AuditEventClassification {\n  category: AuditEventCategory;\n  severity: AuditEventSeverity;\n}\n\n/**\n * Every core auditable event's SIEM category and severity.\n *\n * **Total over `CoreAuditableEventType` on purpose.** It was `Record<string, …>`, which let two\n * emitted event types — `SYSTEM_CONTEXT_READ` and `SYSTEM_CONTEXT_WRITE` — carry no entry at all\n * while the lookup's own JSDoc claimed \"all CoreAuditableEventType values are mapped\". They silently\n * took the fallback below, and because the fallback is one value, the WRITE inherited the READ's\n * classification: the two events exist separately precisely because \"a MUTATION under an ACL bypass is\n * more sensitive than a read\", and the classification erased that. A new core event type is now a\n * compile error rather than a silent `DATA_ACCESS`/`INFO`.\n *\n * The lookup still tolerates unknown strings, because applications may define their own event types —\n * the fallback covers THOSE, which is what it was for.\n */\nexport const AUDIT_EVENT_CLASSIFICATION_MAP: Record<CoreAuditableEventType, AuditEventClassification> = {\n  // Authentication Events\n  [CoreAuditableEventType.USER_LOGIN]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_LOGOUT]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_LOGIN_FAILED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.USER_ACCOUNT_LOCKED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.CRITICAL },\n  [CoreAuditableEventType.MACHINE_AUTH_SUCCESS]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.MACHINE_AUTH_FAILED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n  // Machine RESOURCE-ACCESS (token-USE): an authorized, expected per-request access to an A2A/MCP\n  // surface — DATA_ACCESS/INFO, mirroring FIELD_ACCESS. The security signal is the volume/pattern a\n  // SIEM derives from this stream, not any single row.\n  [CoreAuditableEventType.MACHINE_ACCESS]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_PASSWORD_CHANGED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.USER_MFA_ENABLED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.USER_MFA_DISABLED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.USER_SESSION_EXPIRED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  /*\n   * WARNING, not INFO, and the asymmetry with USER_SESSION_EXPIRED above is the point. An expiry is\n   * routine. An eviction means a live chain was displaced — which is either a user on more devices\n   * than the cap allows, or the cap doing the job it exists for and pushing a stolen chain out. A\n   * reviewer needs to see the second, and INFO is the level nobody reads.\n   */\n  [CoreAuditableEventType.USER_SESSION_EVICTED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n\n  // SSO Authentication Events\n  [CoreAuditableEventType.USER_SSO_LOGIN]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_SSO_LOGIN_FAILED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.USER_SSO_ENFORCEMENT_BLOCKED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.CRITICAL },\n  [CoreAuditableEventType.USER_TOKEN_REFRESHED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n\n  // Emergency Access Events\n  [CoreAuditableEventType.EMERGENCY_ACCESS_USED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.CRITICAL },\n\n  // User Lifecycle Events\n  [CoreAuditableEventType.USER_CREATED]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_UPDATED]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_DELETED]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.INFO },\n\n  // Application-Role Administration — AUTHORIZATION (not USER_LIFECYCLE): the event is an\n  // access-control decision, and an org SIEM filtering on the authorization category must see\n  // application-role grants alongside `ORGANIZATION_MEMBER_ROLE_CHANGED`. Same WARNING severity as\n  // that event for the same reason — a privilege change is never routine INFO traffic.\n  [CoreAuditableEventType.USER_APP_ROLES_CHANGED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n\n  // The application has NO usable super-administrator. CRITICAL rather than WARNING: unlike a role\n  // change (a decision someone made, which an auditor reviews), this is a state nobody can undo from\n  // inside the product — every recovery door is gated on the very role that is missing. AUTHORIZATION\n  // because it is the absence of an authorization principal, not a user-lifecycle transition.\n  [CoreAuditableEventType.APPLICATION_SUPER_ADMIN_FLOOR_BREACHED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.CRITICAL },\n  [CoreAuditableEventType.ORGANIZATION_OWNER_FLOOR_BREACHED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.CRITICAL },\n\n  // Organization Lifecycle Events\n  [CoreAuditableEventType.ORGANIZATION_CREATED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.ORGANIZATION_UPDATED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.ORGANIZATION_DELETED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.ORGANIZATION_DELETION_REQUESTED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.ORGANIZATION_RESTORED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.ORGANIZATION_SUSPENDED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.ORGANIZATION_ACTIVATED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },\n  // WARNING rather than INFO: the event covers BOTH directions, and the restricting direction\n  // (suspend / deactivate) is what an access review is looking for. Grading the pair by its\n  // less-serious half would bury suspensions among routine noise; the payload carries\n  // `previousStatus` → `newStatus`, so a consumer that wants only lifts can still filter.\n  // `USER_LIFECYCLE`, not `AUTHORIZATION`: the event records what CHANGED (a subject's lifecycle\n  // status) rather than its consequence. Every subject it covers — a user row, a membership row —\n  // is a person's participation in the product, and grading it by consequence would scatter it\n  // among role grants that answer a different question.\n  [CoreAuditableEventType.RESOURCE_STATUS_TRANSITION_PERFORMED]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.WARNING },\n\n  // Organization Member Events\n  [CoreAuditableEventType.ORGANIZATION_MEMBER_INVITED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.ORGANIZATION_MEMBER_JOINED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.ORGANIZATION_MEMBER_UPDATED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.ORGANIZATION_MEMBER_ROLE_CHANGED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.ORGANIZATION_MEMBER_STATUS_CHANGED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.ORGANIZATION_MEMBER_REMOVED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n\n  // Organization Config Events\n  [CoreAuditableEventType.ORGANIZATION_NOTIFICATIONS_UPDATED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.ORGANIZATION_PREFERENCES_UPDATED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.ORGANIZATION_PROFILE_UPDATED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.ORGANIZATION_UNIT_UPDATED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },\n\n  // Per-unit role assignment — AUTHORIZATION (not ORG_MANAGEMENT, unlike its ORGANIZATION_UNIT_UPDATED\n  // neighbour): the unit's own record-keeping confers nothing, whereas `OrganizationUnitMember.role`\n  // is read back into `initiatorRoles` as a unit-narrowed grant. Narrower blast radius than\n  // ORGANIZATION_MEMBER_ROLE_CHANGED, but the same KIND of decision, so it carries the same category\n  // and severity — an org SIEM filtering on authorization must see both.\n  [CoreAuditableEventType.ORGANIZATION_UNIT_MEMBER_ROLE_CHANGED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n\n  // Revocation of a unit assignment. AUTHORIZATION deliberately, where the ORGANIZATION_MEMBER_REMOVED\n  // above is ORG_MANAGEMENT: removing a MEMBER is a directory action whose authority loss is a\n  // side effect, whereas an assignment row exists ONLY to confer a role — deleting it IS the\n  // revocation. Same category and severity as the grant it closes, so an authorization-filtered\n  // trail never shows unit privileges granted and never removed.\n  [CoreAuditableEventType.ORGANIZATION_UNIT_MEMBER_REMOVED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n\n  // Organization Security Management Events\n  [CoreAuditableEventType.ORGANIZATION_SSO_CONFIGURATION_CHANGED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.ORGANIZATION_SIEM_EXPORT_CONFIGURED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },\n\n  // Application Security Configuration Events\n  // WARNING mirrors the SSO-configuration-changed sibling: a change to the authentication assurance\n  // posture (MFA / password / lockout) is more than record-keeping (INFO) yet is not an active\n  // breach (ERROR). Category ORG_MANAGEMENT keeps it in the same security-configuration cluster a\n  // reviewer already queries for SSO/SIEM/SCIM configuration changes.\n  [CoreAuditableEventType.APPLICATION_AUTH_POLICY_CHANGED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n\n  // Outbound M2M Webhook Events\n  // WARNING rather than INFO, and the choice is externally grounded rather than taste — it was\n  // challenged on the reasonable objection that every LEGITIMATE connectivity test then emits a\n  // warning-level row.\n  //\n  // NIST SP 800-53 does not settle it directly: AU-6 treats what counts as \"inappropriate or\n  // unusual activity\" as an explicit ORGANIZATION-DEFINED assignment and prescribes no INFO /\n  // WARNING / CRITICAL vocabulary at all, so no NIST rule is broken in either direction. What NIST\n  // does settle is the REMEDY for noise: AU-6(1) automated review integration, AU-6(3) correlation\n  // across repositories, and supplemental guidance letting organizations tune review \"frequency,\n  // scope, and/or depth\". Volume is answered by correlating and tuning REVIEW — never by demoting\n  // the record itself, which would destroy the signal rather than manage it.\n  //\n  // OWASP's Logging Vocabulary Cheat Sheet is the concrete industry answer and puts this at WARN:\n  // successful, authorized ADMINISTRATIVE operations sit at WARN (`user_created`, `user_updated`,\n  // `sys_startup` / `sys_shutdown` / `sys_restart`), while INFO is reserved for routine end-user\n  // activity (`authn_login_success`, `session_created`, a user's own `authn_password_change`). The\n  // rationale is that administrative operations are high-risk and abuse-prone regardless of whether\n  // any single instance succeeded. `testEndpoint` is precisely that shape — admin-gated, and it\n  // makes the SYSTEM open an outbound connection to an operator-supplied URL — so it belongs beside\n  // the `sys_*` state changes, not beside a user login. (OWASP likewise grades\n  // `excess_rate_limit_exceeded` at WARN, which is this operation's own refusal mode.)\n  //\n  // The load-bearing property: a burst of probes across many hosts is the shape of egress\n  // reconnaissance, and that pattern is only visible if the individual rows are not filtered out by\n  // default. If a deployment finds the volume genuinely noisy, tune the SIEM's review per AU-6 —\n  // do not silently downgrade this to INFO.\n  [CoreAuditableEventType.WEBHOOK_ENDPOINT_TEST_DISPATCHED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n\n  // SCIM Directory Provisioning Events\n  [CoreAuditableEventType.SCIM_TOKEN_CREATED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.SCIM_TOKEN_REVOKED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.SCIM_USER_PROVISIONED]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.SCIM_USER_UPDATED]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.SCIM_USER_DEACTIVATED]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.WARNING },\n\n  // Password Reset Events (H5)\n  [CoreAuditableEventType.USER_PASSWORD_RESET_REQUESTED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_PASSWORD_RESET_COMPLETED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n  // CRITICAL, one step above the self-service arms: an administrator reaching into another\n  // account's credentials is the shape of both a legitimate incident response AND an insider\n  // takeover, so it must page rather than merely accumulate.\n  [CoreAuditableEventType.USER_PASSWORD_RESET_FORCED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.CRITICAL },\n\n  // Registration & Verification Events (H5)\n  [CoreAuditableEventType.USER_REGISTERED]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_EMAIL_VERIFIED]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_VERIFICATION_EMAIL_RESENT]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.INFO },\n\n  // MFA Lifecycle Events (H5)\n  [CoreAuditableEventType.USER_MFA_SETUP_STARTED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_MFA_SETUP_COMPLETED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.USER_MFA_EMAIL_OTP_SENT]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n\n  // WebAuthn/Passkey Events (Phase G1)\n  [CoreAuditableEventType.USER_PASSKEY_REGISTERED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.USER_PASSKEY_AUTHENTICATION_SUCCESS]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_PASSKEY_AUTHENTICATION_FAILURE]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.USER_PASSKEY_REMOVED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n\n  // Magic Link Events (Phase G2)\n  [CoreAuditableEventType.USER_MAGIC_LINK_SENT]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_MAGIC_LINK_VERIFIED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_MAGIC_LINK_FAILED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n\n  // SMS OTP Events (Phase G2)\n  [CoreAuditableEventType.USER_SMS_OTP_SENT]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_SMS_OTP_VERIFIED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_SMS_OTP_FAILED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n\n  // Phone Verification Events (Phase G2)\n  [CoreAuditableEventType.USER_PHONE_VERIFIED]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_PHONE_VERIFICATION_FAILED]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.WARNING },\n\n  // OAuth2 Provider Restriction Events (Phase G3)\n  [CoreAuditableEventType.OAUTH2_PROVIDER_BLOCKED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n\n  // SCIM Extended Events\n  [CoreAuditableEventType.SCIM_TOKEN_GENERATED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.SCIM_TOKEN_ROTATED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.SCIM_PROVISIONING_CONFIG_UPDATED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.SCIM_PROVISIONING_FAILED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.CRITICAL },\n\n  // SAML Authentication Events (AUTH-2, D19.4)\n  [CoreAuditableEventType.SAML_LOGIN_INITIATED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.SAML_LOGIN_SUCCESS]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.SAML_LOGIN_FAILED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.SAML_ASSERTION_REPLAY_DETECTED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.CRITICAL },\n  [CoreAuditableEventType.SAML_CERT_EXPIRING]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.SAML_SLO_INITIATED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.SAML_SLO_COMPLETED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.SAML_METADATA_PARSED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.SAML_EMAIL_CHANGED]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.WARNING },\n\n  // Method Management Events (#13f)\n  [CoreAuditableEventType.USER_PASSWORD_SET]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.USER_TOTP_DISABLED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.USER_IDENTITY_LINK_REMOVED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n\n  // One-Off Session Events (W7.3b)\n  // A file upload grant delegates ONE upload under the minter's authority to whoever holds the link —\n  // an AUTHORIZATION artefact, not an authentication one (nobody logs in with it). Issued is INFO like\n  // every other token mint here; revoked is WARNING for the same reason the one-off revoke below is: an\n  // administrative credential termination is what a reviewer wants to see.\n  [CoreAuditableEventType.FILE_UPLOAD_GRANT_ISSUED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.FILE_UPLOAD_GRANT_REDEEMED]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.FILE_UPLOAD_GRANT_REVOKED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.ONE_OFF_TOKEN_CREATED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.ONE_OFF_TOKEN_EXCHANGED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  // Revocation is an ADMINISTRATIVE credential-termination — a super-admin cancels an un-exchanged\n  // one-off/impersonation token. Per OWASP's Logging Vocabulary, administrative operations are WARNING\n  // even when successful and authorized: a SOC wants one-off-token revocations visible (incident\n  // response, or an abuse burst of cancellations). CREATED/EXCHANGED stay INFO (routine mint/use); the\n  // revoke is the operator intervention, which is the higher-signal row.\n  [CoreAuditableEventType.ONE_OFF_TOKEN_REVOKED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n\n  // Cross-Frontend Handoff Events (cross-app-jwt-propagation Step 2)\n  // Issuance is a credential-minting action (re-issues fresh JWT pair AND a single-use\n  // AUTH_CODE_EXCHANGE token bound to the user). WARNING severity matches other\n  // cross-session credential events (USER_PASSWORD_RESET_COMPLETED, USER_PASSKEY_REGISTERED)\n  // so SOC dashboards flag unusual handoff issuance bursts (e.g. token-issuance abuse).\n  [CoreAuditableEventType.USER_CROSS_FRONTEND_HANDOFF_ISSUED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n\n  // Field Access Events\n  [CoreAuditableEventType.FIELD_ACCESS]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.INFO },\n\n  // Resource-Operation Events — a HIGH/CRITICAL operation took effect on a resource.\n  // AUTHORIZATION rather than DATA_ACCESS: this event exists to evidence that a privileged ACTION\n  // was exercised (role/status/credential/tenant mutations), not that data was read — FIELD_ACCESS\n  // owns the disclosure axis. WARNING rather than INFO because every emission is by construction a\n  // HIGH or CRITICAL verb (or an explicit opt-in), so an INFO floor would hide the whole family\n  // beneath the routine-read noise on a SOC dashboard; and not CRITICAL because these are\n  // AUTHORIZED administrative actions, so reserving CRITICAL for anomalies (binding violations,\n  // token-reuse) keeps that level meaningful.\n  [CoreAuditableEventType.RESOURCE_OPERATION_PERFORMED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n\n  // The REFUSAL twin. AUTHORIZATION for the same reason as the success row — it IS an access-control\n  // decision, just the negative one.\n  //\n  // WARNING, and deliberately NOT graded by the refused operation's `riskLevel`: severity is a pure\n  // function of event type for every other member of this map, AND the SIEM dispatcher re-derives it\n  // from the event type independently (`_passesEventFilter`), so a per-row severity would have to be\n  // threaded through two authorities and would still leave this the only type whose severity is not\n  // a property of its kind. Danger grading rides the row's `riskLevel` field, which is already the\n  // framework's canonical danger axis; burst grading rides `eventData.occurrenceCount`.\n  //\n  // WARNING also matches the AUTHENTICATION twins (USER_LOGIN_FAILED, MACHINE_AUTH_FAILED): a single\n  // refusal is a fail-closed control working correctly, not an incident. CRITICAL stays reserved for\n  // anomalies — and the anomaly here is the PATTERN (many refusals), which a SOC rule builds from\n  // `occurrenceCount` rather than from one row's severity.\n  //\n  // assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT\n  [CoreAuditableEventType.RESOURCE_OPERATION_DENIED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n  // WARNING, not CRITICAL, and the choice is deliberate. A platform operator reaching into a tenant\n  // is SANCTIONED here (see the event's schema JSDoc) — most support work is exactly this — so\n  // CRITICAL would cry wolf on routine activity and train reviewers to filter the category out. The\n  // signal worth escalating on is the `admissionDeclared: false` subset, which a SIEM rule can select\n  // precisely because the field is on the payload.\n  [CoreAuditableEventType.CROSS_TENANT_ADMINISTRATIVE_ACCESS]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n  // INFO, unlike the WARNING sibling above: an application-wide directory read is the sanctioned,\n  // ordinary use of a surface built for it, and grading it WARNING would bury the genuine crossings.\n  // The subset worth escalating is selected on `returnedCount` — an operator paging 40,000 rows is an\n  // export — which is why that field is on the payload rather than inferred from the row count.\n  [CoreAuditableEventType.PLATFORM_DIRECTORY_ACCESS]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.INFO },\n  // WARNING for the same reason as its sibling above: requesting and deciding elevations is routine\n  // operator traffic, and CRITICAL here would train reviewers to filter the category out. The subset\n  // worth escalating is `autoApprovalReason: TENANT_CANNOT_APPROVE`, which a SIEM rule selects on and\n  // which the emitter additionally carries at a higher `riskLevel`.\n  [CoreAuditableEventType.PLATFORM_ACCESS_GRANT_LIFECYCLE]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n\n  // Retained-Data (Impersonalization) Access Events\n  // A privileged, human-attributed see-through read over RETAINED (impersonalized) records. WARNING —\n  // elevated vs a normal FIELD_ACCESS/INFO read because it reveals data the retention boundary hides,\n  // so SOC dashboards surface it; but an AUTHORIZED compliance action, not an anomaly ⇒ not CRITICAL.\n  [CoreAuditableEventType.RETAINED_DATA_ACCESS]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.WARNING },\n  // The single most sensitive disclosure the framework performs — everything held about one person,\n  // handed out. Same DATA_ACCESS / WARNING classification as a retained-data see-through: authorized\n  // and expected, but always worth a reviewer's eye.\n  [CoreAuditableEventType.SUBJECT_DATA_EXPORT]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.WARNING },\n  // INFO, with the page-vs-whole-table distinction carried by the per-emission `riskLevel` (LOW/HIGH)\n  // rather than by severity — see AuditableEvent_CollectionDataExport_EventDataSchema. A routine page\n  // download raised to WARNING would train reviewers to skim the channel it shares with real signals.\n  [CoreAuditableEventType.COLLECTION_DATA_EXPORT]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.INFO },\n  // Routine, authorized read-through of an EXTERNAL system's rows — the value is the queryable\n  // trail (who/which provider/which entity/how much), not an alarm. WARNING would put every\n  // ordinary external read beside see-through privileged access and train reviewers to skim.\n  [CoreAuditableEventType.HTTP_API_READ_THROUGH_ACCESS]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.INFO },\n  // The sanctioned mechanics of a data-protection request (D6 stance 6b) — routine, not an alarm.\n  [CoreAuditableEventType.HTTP_API_EXTERNAL_ERASURE]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.INFO },\n  // A deliberate, per-request erasure hole (D6 stance 6c) — the record is the control, so it must\n  // surface in every severity-filtered view an operator actually reads.\n  [CoreAuditableEventType.HTTP_API_NON_ERASURE_ACKNOWLEDGED]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.CRITICAL },\n\n  // OAuth2 / OIDC Provider Events (Wildo AS the authorization server). Delegated-authority grants +\n  // consent decisions are AUTHORIZATION; token lifecycle (refresh/revoke) is AUTHENTICATION. Severity:\n  // a third party gaining/holding user-acting access is WARNING (notable, SOC-dashboard-worthy, but an\n  // authorized/consented action ⇒ not CRITICAL); a cross-user binding violation or refresh-token theft\n  // is CRITICAL; a denial/routine refresh/revoke is INFO.\n  [CoreAuditableEventType.OAUTH_DELEGATED_TOKEN_ISSUED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.OAUTH_CONSENT_GRANTED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.OAUTH_CONSENT_DENIED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.OAUTH_CONSENT_GRANT_PERSISTED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n  // WARNING, not INFO: an unauthenticated party created a durable identity. Individually routine\n  // when the feature is enabled, but the SHAPE an operator must be able to alert on is a spike —\n  // which only reads as a spike if each one is above the noise floor.\n  // AUTHENTICATION/WARNING: a refused client identity is an authentication-front event, and the\n  // SSRF variant is an attack rather than a misconfiguration. WARNING keeps a spike visible without\n  // making an ordinary allow-list miss look like an incident.\n  [CoreAuditableEventType.OAUTH_CIMD_CLIENT_REFUSED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.OAUTH_DYNAMIC_CLIENT_REGISTERED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.OAUTH_TOKEN_REFRESHED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.OAUTH_TOKEN_REVOKED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.OAUTH_RP_INITIATED_LOGOUT]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.OAUTH_CODE_EXCHANGE_FAILED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.OAUTH_CONSENT_BINDING_VIOLATION]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.CRITICAL },\n  [CoreAuditableEventType.USER_REFRESH_TOKEN_REUSE_DETECTED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.CRITICAL },\n\n  // System-context (ACL-bypass) trail. Both were UNMAPPED until 2026-08-11 and took the fallback.\n  // The READ keeps exactly what the fallback gave it — its declaration already documented\n  // `DATA_ACCESS`/`INFO` as intended (\"an expected, authorized internal read — not an anomaly\"), so\n  // this only stops that intent depending on a default nobody had noticed it was relying on.\n  [CoreAuditableEventType.SYSTEM_CONTEXT_READ]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.INFO },\n  // The WRITE is raised to WARNING, following `RETAINED_DATA_ACCESS` — the other privileged-access\n  // event in this file — which reasons that an authorized-but-elevated access is WARNING and not\n  // CRITICAL because it is expected rather than anomalous. Category deliberately UNCHANGED: moving it\n  // to AUTHORIZATION would drop it for every tenant whose export filters on categories, which is a\n  // worse failure than an under-graded severity. This is the classification the event's own\n  // declaration asks for and had never received.\n  [CoreAuditableEventType.SYSTEM_CONTEXT_WRITE]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.WARNING },\n};\n\nconst DEFAULT_AUDIT_EVENT_CLASSIFICATION: AuditEventClassification = { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.INFO };\n\n/**\n * Look up the classification for an audit event type.\n *\n * Every `CoreAuditableEventType` is mapped — enforced by the map's type, not by this comment, which\n * asserted exactly that while two event types went unmapped for months. The fallback exists for\n * APPLICATION-defined event types, which are ordinary strings the engine cannot enumerate.\n */\nexport function getAuditEventClassification(eventType: string): AuditEventClassification {\n  return AUDIT_EVENT_CLASSIFICATION_MAP[eventType as CoreAuditableEventType] ?? DEFAULT_AUDIT_EVENT_CLASSIFICATION;\n}\n"]}
+{"version":3,"file":"security-audit-event-envelope.shared.schema.js","sourceRoot":"","sources":["../../../../src/compliance/audit-trails/security-audit-event-envelope.shared.schema.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,6BAA6B,EAC7B,6BAA6B,EAC7B,kBAAkB,EAClB,kBAAkB,EAClB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,kCAAkC,CAAC;AAE1C,sDAAsD;AACtD,MAAM,CAAN,IAAY,iBAGX;AAHD,WAAY,iBAAiB;IAC3B,wCAAmB,CAAA;IACnB,wCAAmB,CAAA;AACrB,CAAC,EAHW,iBAAiB,KAAjB,iBAAiB,QAG5B;AAED;;oEAEoE;AAEpE,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,mCAAmC;IACnC;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;SACtC,QAAQ,CAAC,uBAAuB,CAAC,2CAA2C,EAAE,6BAA6B,CAAC,CAAC;IAChH,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;SACjC,QAAQ,CAAC,uBAAuB,CAAC,yCAAyC,EAAE,6BAA6B,CAAC,CAAC;IAC9G,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,iGAAiG;IACjG,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC;;;;;OAKG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC;;;;;OAKG;IACH,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE1C,UAAU;IACV,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEhC,SAAS;IACT,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE;IAE7B,0CAA0C;IAC1C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC9B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC5B,CAAC,CAAC,QAAQ,EAAE;IAEb,sBAAsB;IACtB,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;IAExC,UAAU;IACV,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC;IAClC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC;AAgBH;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAA6D;IACtG,wBAAwB;IACxB,CAAC,sBAAsB,CAAC,UAAU,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACvH,CAAC,sBAAsB,CAAC,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACxH,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACjI,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IACpI,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACjI,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACnI,gGAAgG;IAChG,kGAAkG;IAClG,qDAAqD;IACrD,CAAC,sBAAsB,CAAC,cAAc,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACxH,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACrI,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAChI,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACjI,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACjI;;;;;OAKG;IACH,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAEpI,4BAA4B;IAC5B,CAAC,sBAAsB,CAAC,cAAc,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAC3H,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACrI,CAAC,sBAAsB,CAAC,4BAA4B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAC7I,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAEjI,0BAA0B;IAC1B,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAEtI,wBAAwB;IACxB,CAAC,sBAAsB,CAAC,YAAY,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACzH,CAAC,sBAAsB,CAAC,YAAY,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACzH,CAAC,sBAAsB,CAAC,YAAY,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAEzH,wFAAwF;IACxF,4FAA4F;IAC5F,iGAAiG;IACjG,qFAAqF;IACrF,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAErI,iGAAiG;IACjG,mGAAmG;IACnG,oGAAoG;IACpG,4FAA4F;IAC5F,CAAC,sBAAsB,CAAC,sCAAsC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IACtJ,CAAC,sBAAsB,CAAC,iCAAiC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAEjJ,gCAAgC;IAChC,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACjI,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACjI,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACpI,CAAC,sBAAsB,CAAC,+BAA+B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAC/I,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAClI,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACtI,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACnI,4FAA4F;IAC5F,0FAA0F;IAC1F,oFAAoF;IACpF,wFAAwF;IACxF,+FAA+F;IAC/F,gGAAgG;IAChG,6FAA6F;IAC7F,sDAAsD;IACtD,CAAC,sBAAsB,CAAC,oCAAoC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAEpJ,6BAA6B;IAC7B,CAAC,sBAAsB,CAAC,2BAA2B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACxI,CAAC,sBAAsB,CAAC,0BAA0B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACvI,CAAC,sBAAsB,CAAC,2BAA2B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACxI,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAC/I,CAAC,sBAAsB,CAAC,kCAAkC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAC/I,CAAC,sBAAsB,CAAC,2BAA2B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAE3I,6BAA6B;IAC7B,CAAC,sBAAsB,CAAC,kCAAkC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAC/I,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAC7I,CAAC,sBAAsB,CAAC,4BAA4B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACzI,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAEtI,qGAAqG;IACrG,mGAAmG;IACnG,0FAA0F;IAC1F,mGAAmG;IACnG,uEAAuE;IACvE,CAAC,sBAAsB,CAAC,qCAAqC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAEpJ,qGAAqG;IACrG,6FAA6F;IAC7F,2FAA2F;IAC3F,8FAA8F;IAC9F,+DAA+D;IAC/D,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAE/I,0CAA0C;IAC1C,CAAC,sBAAsB,CAAC,sCAAsC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACtJ,CAAC,sBAAsB,CAAC,mCAAmC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAEhJ,4FAA4F;IAC5F,EAAE;IACF,iGAAiG;IACjG,gGAAgG;IAChG,6FAA6F;IAC7F,qFAAqF;IACrF,EAAE;IACF,gGAAgG;IAChG,gGAAgG;IAChG,wDAAwD;IACxD,CAAC,sBAAsB,CAAC,oCAAoC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACpJ,CAAC,sBAAsB,CAAC,wCAAwC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACxJ,gGAAgG;IAChG,kGAAkG;IAClG,gGAAgG;IAChG,4FAA4F;IAC5F,4FAA4F;IAC5F,CAAC,sBAAsB,CAAC,qCAAqC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAClJ,CAAC,sBAAsB,CAAC,wCAAwC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAExJ,iGAAiG;IACjG,kGAAkG;IAClG,kGAAkG;IAClG,iGAAiG;IACjG,0FAA0F;IAC1F,EAAE;IACF,kGAAkG;IAClG,0FAA0F;IAC1F,8FAA8F;IAC9F,gBAAgB;IAChB,CAAC,sBAAsB,CAAC,4BAA4B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACzI,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAC7I,CAAC,sBAAsB,CAAC,6BAA6B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAC1I,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAEhJ,kGAAkG;IAClG,mGAAmG;IACnG,iGAAiG;IACjG,8FAA8F;IAC9F,kGAAkG;IAClG,iFAAiF;IACjF,CAAC,sBAAsB,CAAC,wCAAwC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACxJ,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAE7I,4CAA4C;IAC5C,kGAAkG;IAClG,6FAA6F;IAC7F,gGAAgG;IAChG,oEAAoE;IACpE,CAAC,sBAAsB,CAAC,+BAA+B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAE/I,8BAA8B;IAC9B,6FAA6F;IAC7F,8FAA8F;IAC9F,qBAAqB;IACrB,EAAE;IACF,2FAA2F;IAC3F,4FAA4F;IAC5F,iGAAiG;IACjG,iGAAiG;IACjG,+FAA+F;IAC/F,gGAAgG;IAChG,2EAA2E;IAC3E,EAAE;IACF,gGAAgG;IAChG,gGAAgG;IAChG,+FAA+F;IAC/F,iGAAiG;IACjG,kGAAkG;IAClG,8FAA8F;IAC9F,kGAAkG;IAClG,6EAA6E;IAC7E,qFAAqF;IACrF,EAAE;IACF,wFAAwF;IACxF,kGAAkG;IAClG,+FAA+F;IAC/F,0CAA0C;IAC1C,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAEhJ,qCAAqC;IACrC,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAClI,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAClI,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAClI,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAC9H,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAErI,6BAA6B;IAC7B,CAAC,sBAAsB,CAAC,6BAA6B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAC1I,CAAC,sBAAsB,CAAC,6BAA6B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAC7I,yFAAyF;IACzF,2FAA2F;IAC3F,2DAA2D;IAC3D,CAAC,sBAAsB,CAAC,0BAA0B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAE3I,0CAA0C;IAC1C,CAAC,sBAAsB,CAAC,eAAe,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAC5H,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAChI,CAAC,sBAAsB,CAAC,8BAA8B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAE3I,4BAA4B;IAC5B,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACnI,CAAC,sBAAsB,CAAC,wBAAwB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACxI,CAAC,sBAAsB,CAAC,uBAAuB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAEpI,qCAAqC;IACrC,CAAC,sBAAsB,CAAC,uBAAuB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACvI,CAAC,sBAAsB,CAAC,mCAAmC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAChJ,CAAC,sBAAsB,CAAC,mCAAmC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACnJ,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACpI,mGAAmG;IACnG,2FAA2F;IAC3F,CAAC,sBAAsB,CAAC,4BAA4B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAE7I,+BAA+B;IAC/B,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACjI,CAAC,sBAAsB,CAAC,wBAAwB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACrI,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAEtI,4BAA4B;IAC5B,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAC9H,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAClI,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAEnI,uCAAuC;IACvC,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAChI,CAAC,sBAAsB,CAAC,8BAA8B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAE9I,gDAAgD;IAChD,CAAC,sBAAsB,CAAC,uBAAuB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACtI,iGAAiG;IACjG,8FAA8F;IAC9F,8FAA8F;IAC9F,8FAA8F;IAC9F,kCAAkC;IAClC,CAAC,sBAAsB,CAAC,2BAA2B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAE3I,uBAAuB;IACvB,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACpI,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAClI,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAC7I,CAAC,sBAAsB,CAAC,wBAAwB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAEzI,6CAA6C;IAC7C,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACjI,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAC/H,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACjI,CAAC,sBAAsB,CAAC,8BAA8B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAC/I,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAClI,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAC/H,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAC/H,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACjI,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAElI,kCAAkC;IAClC,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACjI,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAClI,CAAC,sBAAsB,CAAC,0BAA0B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAE1I,iCAAiC;IACjC,oGAAoG;IACpG,qGAAqG;IACrG,sGAAsG;IACtG,yEAAyE;IACzE,CAAC,sBAAsB,CAAC,wBAAwB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACpI,CAAC,sBAAsB,CAAC,0BAA0B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACpI,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACxI;;;;;;;;;;;OAWG;IACH,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IACnI,CAAC,sBAAsB,CAAC,wBAAwB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACrI,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAClI,CAAC,sBAAsB,CAAC,uBAAuB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACpI,iGAAiG;IACjG,qGAAqG;IACrG,+FAA+F;IAC/F,qGAAqG;IACrG,uEAAuE;IACvE,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAErI,mEAAmE;IACnE,qFAAqF;IACrF,8EAA8E;IAC9E,2FAA2F;IAC3F,sFAAsF;IACtF,CAAC,sBAAsB,CAAC,kCAAkC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAElJ,sBAAsB;IACtB,CAAC,sBAAsB,CAAC,YAAY,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAEtH,mFAAmF;IACnF,gGAAgG;IAChG,iGAAiG;IACjG,iGAAiG;IACjG,8FAA8F;IAC9F,wFAAwF;IACxF,8FAA8F;IAC9F,4CAA4C;IAC5C,CAAC,sBAAsB,CAAC,4BAA4B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAE3I,mGAAmG;IACnG,mCAAmC;IACnC,EAAE;IACF,kGAAkG;IAClG,mGAAmG;IACnG,mGAAmG;IACnG,kGAAkG;IAClG,iGAAiG;IACjG,sFAAsF;IACtF,EAAE;IACF,mGAAmG;IACnG,mGAAmG;IACnG,gGAAgG;IAChG,yDAAyD;IACzD,EAAE;IACF,+DAA+D;IAC/D,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACxI,kGAAkG;IAClG,6FAA6F;IAC7F,kGAAkG;IAClG,oGAAoG;IACpG,iDAAiD;IACjD,CAAC,sBAAsB,CAAC,kCAAkC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACjJ,gGAAgG;IAChG,mGAAmG;IACnG,oGAAoG;IACpG,8FAA8F;IAC9F,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACnI,kGAAkG;IAClG,mGAAmG;IACnG,oGAAoG;IACpG,kEAAkE;IAClE,CAAC,sBAAsB,CAAC,+BAA+B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAE9I,kDAAkD;IAClD,oGAAoG;IACpG,oGAAoG;IACpG,oGAAoG;IACpG,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACjI,kGAAkG;IAClG,mGAAmG;IACnG,mDAAmD;IACnD,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAChI,oGAAoG;IACpG,oGAAoG;IACpG,oGAAoG;IACpG,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAChI,6FAA6F;IAC7F,0FAA0F;IAC1F,2FAA2F;IAC3F,CAAC,sBAAsB,CAAC,4BAA4B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACtI,mGAAmG;IACnG,oGAAoG;IACpG,iGAAiG;IACjG,iGAAiG;IACjG,CAAC,sBAAsB,CAAC,uBAAuB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACjI,mGAAmG;IACnG,oGAAoG;IACpG,+EAA+E;IAC/E,CAAC,sBAAsB,CAAC,aAAa,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACvH,2FAA2F;IAC3F,kGAAkG;IAClG,kGAAkG;IAClG,kGAAkG;IAClG,0FAA0F;IAC1F,oEAAoE;IACpE,CAAC,sBAAsB,CAAC,4BAA4B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAC3I,gGAAgG;IAChG,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACtI,gGAAgG;IAChG,sEAAsE;IACtE,CAAC,sBAAsB,CAAC,iCAAiC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAElJ,kGAAkG;IAClG,qGAAqG;IACrG,qGAAqG;IACrG,qGAAqG;IACrG,wDAAwD;IACxD,CAAC,sBAAsB,CAAC,4BAA4B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAC3I,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACpI,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAChI,CAAC,sBAAsB,CAAC,6BAA6B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAC5I,+FAA+F;IAC/F,+FAA+F;IAC/F,oEAAoE;IACpE,8FAA8F;IAC9F,kGAAkG;IAClG,4DAA4D;IAC5D,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACzI,CAAC,sBAAsB,CAAC,+BAA+B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAC/I,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAClI,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAChI,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACtI,CAAC,sBAAsB,CAAC,0BAA0B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAC1I,CAAC,sBAAsB,CAAC,+BAA+B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAC/I,CAAC,sBAAsB,CAAC,iCAAiC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAElJ,gGAAgG;IAChG,wFAAwF;IACxF,kGAAkG;IAClG,2FAA2F;IAC3F,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAC7H,iGAAiG;IACjG,+FAA+F;IAC/F,oGAAoG;IACpG,iGAAiG;IACjG,0FAA0F;IAC1F,+CAA+C;IAC/C,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;CAClI,CAAC;AAEF,MAAM,kCAAkC,GAA6B,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE,CAAC;AAErJ;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CAAC,SAAiB;IAC3D,OAAO,8BAA8B,CAAC,SAAmC,CAAC,IAAI,kCAAkC,CAAC;AACnH,CAAC","sourcesContent":["/**\n * Security Audit Event Envelope — the structured JSON payload sent to customer SIEM.\n * \n * This is the canonical format for events exported via the org-level SIEM export pipeline.\n * Different from platform observability (which ships to Axiom/Datadog for platform ops).\n * Org SIEM export ships per-org security events to the customer's own SIEM.\n */\n\nimport { z } from 'zod';\nimport {\n  AUDIT_EVENT_CATEGORY_MEANINGS,\n  AUDIT_EVENT_SEVERITY_MEANINGS,\n  AuditEventCategory,\n  AuditEventSeverity,\n  CoreAuditableEventType,\n  describeAuditVocabulary,\n} from './auditable-events.shared.schema';\n\n/** Outcome for SIEM envelope — success or failure. */\nexport enum AuditEventOutcome {\n  SUCCESS = 'success',\n  FAILURE = 'failure',\n}\n\n/** ──────────────────────────────────────────────────────────────\n * Security Audit Event Envelope Schema\n * ────────────────────────────────────────────────────────────── */\n\nexport const SecurityAuditEventEnvelopeSchema = z.object({\n  // Standard fields (always present)\n  /**\n   * The AUDIT ROW's own `eventId` (`AuditableEvent.eventId`) — copied here, never minted for the\n   * delivery. It is doing two jobs and both need it to be that value:\n   *\n   *  - it is the receiver's IDEMPOTENCY key. Every wire format carries this one field through:\n   *    CEF `externalId`, LEEF `eventId`, OCSF `metadata.uid`, and the verbatim `json_structured`\n   *    body's top-level `eventId`. It is stable across every retry of a delivery (the envelope is\n   *    built once and re-sent, including from the dead-letter drain).\n   *  - it is the CORRELATION key back into the application. The same value is on the audit row, on\n   *    the immudb record, and is what `AuditLogVerification.verifyAuditEvent(eventId)` resolves —\n   *    so a record in the customer's SIEM can be traced to the event it was projected from.\n   *\n   * The second job was silently absent until 2026-09-09: the dispatcher minted a fresh uuid here,\n   * which deduplicated correctly and named nothing. See `_resolveEnvelopeEventId` in\n   * `audit-event-dispatcher.backend.service.ts` for the cutover reasoning.\n   *\n   * NOTE one audit event fanned out to several member orgs delivers the SAME id to each of those\n   * tenants' sinks. They are different receivers, so dedup is unaffected — and it is one event.\n   */\n  eventId: z.string(),\n  eventType: z.string(),\n  eventCategory: z.enum(AuditEventCategory)\n    .describe(describeAuditVocabulary('What kind of activity this event records.', AUDIT_EVENT_CATEGORY_MEANINGS)),\n  severity: z.enum(AuditEventSeverity)\n    .describe(describeAuditVocabulary('How much attention this event asks for.', AUDIT_EVENT_SEVERITY_MEANINGS)),\n  timestamp: z.string(),\n  /** Request-correlation id (groups every event of one request; matches the app's logs/errors). */\n  correlationId: z.string().optional(),\n  /**\n   * Client-install id — groups an actor's events across sessions and logins, the correlation NIST\n   * SP 800-53 AU-6(3) asks for at review time. Present ONLY for applications that opted into\n   * `compliance.clientInstanceIdScope`; absent (never null-filled) for every other application, so a\n   * SIEM rule keying on it simply never matches rather than seeing an empty field.\n   */\n  clientInstanceId: z.string().optional(),\n  /**\n   * Which frontend SURFACE the request came from (app / website / docs). Carried for the same reason as\n   * the two ids above: an external reviewer correlating in the SIEM needs the same origin axes the audit\n   * row has, and shipping two of the three origin signals was an asymmetry with no rationale behind it.\n   * Absent for non-HTTP (job / cron / internal) events.\n   */\n  frontendServiceName: z.string().optional(),\n\n  // Context\n  organizationId: z.string(),\n  organizationName: z.string().optional(),\n  applicationId: z.string().optional(),\n  applicationName: z.string().optional(),\n  userId: z.string().optional(),\n  userEmail: z.string().optional(),\n\n  // Source\n  sourceService: z.string(),\n  sourceVersion: z.string(),\n  sourceEnvironment: z.string(),\n\n  // Auth-specific context (when applicable)\n  authMethod: z.string().optional(),\n  authSource: z.string().optional(),\n  providerRef: z.string().optional(),\n  connectionType: z.string().optional(),\n  ipAddress: z.string().optional(),\n  userAgent: z.string().optional(),\n  geoLocation: z.object({\n    country: z.string().optional(),\n    city: z.string().optional(),\n  }).optional(),\n\n  // Event-specific data\n  eventData: z.record(z.string(), z.any()),\n\n  // Outcome\n  outcome: z.enum(AuditEventOutcome),\n  outcomeReason: z.string().optional(),\n});\n\nexport type SecurityAuditEventEnvelope = z.infer<typeof SecurityAuditEventEnvelopeSchema>;\n\n/** ──────────────────────────────────────────────────────────────\n * Event Classification Map\n * \n * Maps each CoreAuditableEventType to its category and severity.\n * Used by the dispatcher to classify events for SIEM filtering.\n * ────────────────────────────────────────────────────────────── */\n\nexport interface AuditEventClassification {\n  category: AuditEventCategory;\n  severity: AuditEventSeverity;\n}\n\n/**\n * Every core auditable event's SIEM category and severity.\n *\n * **Total over `CoreAuditableEventType` on purpose.** It was `Record<string, …>`, which let two\n * emitted event types — `SYSTEM_CONTEXT_READ` and `SYSTEM_CONTEXT_WRITE` — carry no entry at all\n * while the lookup's own JSDoc claimed \"all CoreAuditableEventType values are mapped\". They silently\n * took the fallback below, and because the fallback is one value, the WRITE inherited the READ's\n * classification: the two events exist separately precisely because \"a MUTATION under an ACL bypass is\n * more sensitive than a read\", and the classification erased that. A new core event type is now a\n * compile error rather than a silent `DATA_ACCESS`/`INFO`.\n *\n * The lookup still tolerates unknown strings, because applications may define their own event types —\n * the fallback covers THOSE, which is what it was for.\n */\nexport const AUDIT_EVENT_CLASSIFICATION_MAP: Record<CoreAuditableEventType, AuditEventClassification> = {\n  // Authentication Events\n  [CoreAuditableEventType.USER_LOGIN]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_LOGOUT]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_LOGIN_FAILED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.USER_ACCOUNT_LOCKED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.CRITICAL },\n  [CoreAuditableEventType.MACHINE_AUTH_SUCCESS]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.MACHINE_AUTH_FAILED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n  // Machine RESOURCE-ACCESS (token-USE): an authorized, expected per-request access to an A2A/MCP\n  // surface — DATA_ACCESS/INFO, mirroring FIELD_ACCESS. The security signal is the volume/pattern a\n  // SIEM derives from this stream, not any single row.\n  [CoreAuditableEventType.MACHINE_ACCESS]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_PASSWORD_CHANGED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.USER_MFA_ENABLED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.USER_MFA_DISABLED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.USER_SESSION_EXPIRED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  /*\n   * WARNING, not INFO, and the asymmetry with USER_SESSION_EXPIRED above is the point. An expiry is\n   * routine. An eviction means a live chain was displaced — which is either a user on more devices\n   * than the cap allows, or the cap doing the job it exists for and pushing a stolen chain out. A\n   * reviewer needs to see the second, and INFO is the level nobody reads.\n   */\n  [CoreAuditableEventType.USER_SESSION_EVICTED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n\n  // SSO Authentication Events\n  [CoreAuditableEventType.USER_SSO_LOGIN]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_SSO_LOGIN_FAILED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.USER_SSO_ENFORCEMENT_BLOCKED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.CRITICAL },\n  [CoreAuditableEventType.USER_TOKEN_REFRESHED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n\n  // Emergency Access Events\n  [CoreAuditableEventType.EMERGENCY_ACCESS_USED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.CRITICAL },\n\n  // User Lifecycle Events\n  [CoreAuditableEventType.USER_CREATED]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_UPDATED]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_DELETED]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.INFO },\n\n  // Application-Role Administration — AUTHORIZATION (not USER_LIFECYCLE): the event is an\n  // access-control decision, and an org SIEM filtering on the authorization category must see\n  // application-role grants alongside `ORGANIZATION_MEMBER_ROLE_CHANGED`. Same WARNING severity as\n  // that event for the same reason — a privilege change is never routine INFO traffic.\n  [CoreAuditableEventType.USER_APP_ROLES_CHANGED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n\n  // The application has NO usable super-administrator. CRITICAL rather than WARNING: unlike a role\n  // change (a decision someone made, which an auditor reviews), this is a state nobody can undo from\n  // inside the product — every recovery door is gated on the very role that is missing. AUTHORIZATION\n  // because it is the absence of an authorization principal, not a user-lifecycle transition.\n  [CoreAuditableEventType.APPLICATION_SUPER_ADMIN_FLOOR_BREACHED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.CRITICAL },\n  [CoreAuditableEventType.ORGANIZATION_OWNER_FLOOR_BREACHED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.CRITICAL },\n\n  // Organization Lifecycle Events\n  [CoreAuditableEventType.ORGANIZATION_CREATED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.ORGANIZATION_UPDATED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.ORGANIZATION_DELETED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.ORGANIZATION_DELETION_REQUESTED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.ORGANIZATION_RESTORED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.ORGANIZATION_SUSPENDED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.ORGANIZATION_ACTIVATED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },\n  // WARNING rather than INFO: the event covers BOTH directions, and the restricting direction\n  // (suspend / deactivate) is what an access review is looking for. Grading the pair by its\n  // less-serious half would bury suspensions among routine noise; the payload carries\n  // `previousStatus` → `newStatus`, so a consumer that wants only lifts can still filter.\n  // `USER_LIFECYCLE`, not `AUTHORIZATION`: the event records what CHANGED (a subject's lifecycle\n  // status) rather than its consequence. Every subject it covers — a user row, a membership row —\n  // is a person's participation in the product, and grading it by consequence would scatter it\n  // among role grants that answer a different question.\n  [CoreAuditableEventType.RESOURCE_STATUS_TRANSITION_PERFORMED]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.WARNING },\n\n  // Organization Member Events\n  [CoreAuditableEventType.ORGANIZATION_MEMBER_INVITED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.ORGANIZATION_MEMBER_JOINED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.ORGANIZATION_MEMBER_UPDATED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.ORGANIZATION_MEMBER_ROLE_CHANGED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.ORGANIZATION_MEMBER_STATUS_CHANGED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.ORGANIZATION_MEMBER_REMOVED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n\n  // Organization Config Events\n  [CoreAuditableEventType.ORGANIZATION_NOTIFICATIONS_UPDATED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.ORGANIZATION_PREFERENCES_UPDATED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.ORGANIZATION_PROFILE_UPDATED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.ORGANIZATION_UNIT_UPDATED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },\n\n  // Per-unit role assignment — AUTHORIZATION (not ORG_MANAGEMENT, unlike its ORGANIZATION_UNIT_UPDATED\n  // neighbour): the unit's own record-keeping confers nothing, whereas `OrganizationUnitMember.role`\n  // is read back into `initiatorRoles` as a unit-narrowed grant. Narrower blast radius than\n  // ORGANIZATION_MEMBER_ROLE_CHANGED, but the same KIND of decision, so it carries the same category\n  // and severity — an org SIEM filtering on authorization must see both.\n  [CoreAuditableEventType.ORGANIZATION_UNIT_MEMBER_ROLE_CHANGED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n\n  // Revocation of a unit assignment. AUTHORIZATION deliberately, where the ORGANIZATION_MEMBER_REMOVED\n  // above is ORG_MANAGEMENT: removing a MEMBER is a directory action whose authority loss is a\n  // side effect, whereas an assignment row exists ONLY to confer a role — deleting it IS the\n  // revocation. Same category and severity as the grant it closes, so an authorization-filtered\n  // trail never shows unit privileges granted and never removed.\n  [CoreAuditableEventType.ORGANIZATION_UNIT_MEMBER_REMOVED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n\n  // Organization Security Management Events\n  [CoreAuditableEventType.ORGANIZATION_SSO_CONFIGURATION_CHANGED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.ORGANIZATION_SIEM_EXPORT_CONFIGURED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },\n\n  // Organization provider credentials — an organization's own authority toward a third party.\n  //\n  // ORG_MANAGEMENT, not AUTHORIZATION: the AUTHORIZATION category is about what a principal may do\n  // INSIDE this application, and these events are about what the application may do OUTSIDE it as\n  // the tenant. Filing them under authorization would put them in the same SIEM bucket as role\n  // grants, where a reviewer looking for outbound authority would never think to look.\n  //\n  // WARNING on the three lifecycle verbs, mirroring the SSO-configuration sibling: each one MOVES\n  // the authority the application holds toward a third party, and a tenant's credentials changing\n  // outside a change window is the shape of a compromise.\n  [CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_SET]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_ROTATED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  // INFO, and deliberately so despite being the security-relevant one. A use event fires on every\n  // outbound provider call, so WARNING here would flood the channel and train an operator to filter\n  // the whole category out — taking the two verbs above with it. The signal a reviewer wants from\n  // this stream is the PATTERN (which tenant spends which provider, how often, and whether it\n  // resolved from its own credential or fell back to the deployment's), which INFO preserves.\n  [CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_USED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_DELETED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n\n  // A person's own credential. USER_LIFECYCLE rather than ORG_MANAGEMENT, by the same reading that\n  // put the tenant's in ORG_MANAGEMENT: a stored third-party credential is a setting on the account\n  // that owns it, and here that account is a person. Filing these under the tenant's category would\n  // put a person's connections into the view an administrator reads as \"what my organization did\",\n  // which is both the wrong subject and, for a personal vendor account, the wrong audience.\n  //\n  // Severities mirror the organization's exactly and for the same reasons — INFO on the high-volume\n  // spend so the pattern survives without flooding, WARNING on removal because a credential\n  // disappearing is how an integration stops working and the first question is always whether a\n  // human did it.\n  [CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_SET]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_ROTATED]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_USED]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_DELETED]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.WARNING },\n\n  // A delegated authorization being GRANTED. Each mirrors its OWN `_SET` sibling rather than taking\n  // one rule for both, because the two families are already classified differently and deliberately:\n  // a tenant's credential arriving is ORG_MANAGEMENT/WARNING — a shared integration changing under\n  // every member of that tenant — while a person's is USER_LIFECYCLE/INFO, one individual's own\n  // account. A grant carries exactly the same consequence as the set it accompanies, so it inherits\n  // the same reading; what makes it worth having is its payload, not its severity.\n  [CoreAuditableEventType.ORGANIZATION_PROVIDER_CONNECTION_GRANTED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.USER_PROVIDER_CONNECTION_GRANTED]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.INFO },\n\n  // Application Security Configuration Events\n  // WARNING mirrors the SSO-configuration-changed sibling: a change to the authentication assurance\n  // posture (MFA / password / lockout) is more than record-keeping (INFO) yet is not an active\n  // breach (ERROR). Category ORG_MANAGEMENT keeps it in the same security-configuration cluster a\n  // reviewer already queries for SSO/SIEM/SCIM configuration changes.\n  [CoreAuditableEventType.APPLICATION_AUTH_POLICY_CHANGED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n\n  // Outbound M2M Webhook Events\n  // WARNING rather than INFO, and the choice is externally grounded rather than taste — it was\n  // challenged on the reasonable objection that every LEGITIMATE connectivity test then emits a\n  // warning-level row.\n  //\n  // NIST SP 800-53 does not settle it directly: AU-6 treats what counts as \"inappropriate or\n  // unusual activity\" as an explicit ORGANIZATION-DEFINED assignment and prescribes no INFO /\n  // WARNING / CRITICAL vocabulary at all, so no NIST rule is broken in either direction. What NIST\n  // does settle is the REMEDY for noise: AU-6(1) automated review integration, AU-6(3) correlation\n  // across repositories, and supplemental guidance letting organizations tune review \"frequency,\n  // scope, and/or depth\". Volume is answered by correlating and tuning REVIEW — never by demoting\n  // the record itself, which would destroy the signal rather than manage it.\n  //\n  // OWASP's Logging Vocabulary Cheat Sheet is the concrete industry answer and puts this at WARN:\n  // successful, authorized ADMINISTRATIVE operations sit at WARN (`user_created`, `user_updated`,\n  // `sys_startup` / `sys_shutdown` / `sys_restart`), while INFO is reserved for routine end-user\n  // activity (`authn_login_success`, `session_created`, a user's own `authn_password_change`). The\n  // rationale is that administrative operations are high-risk and abuse-prone regardless of whether\n  // any single instance succeeded. `testEndpoint` is precisely that shape — admin-gated, and it\n  // makes the SYSTEM open an outbound connection to an operator-supplied URL — so it belongs beside\n  // the `sys_*` state changes, not beside a user login. (OWASP likewise grades\n  // `excess_rate_limit_exceeded` at WARN, which is this operation's own refusal mode.)\n  //\n  // The load-bearing property: a burst of probes across many hosts is the shape of egress\n  // reconnaissance, and that pattern is only visible if the individual rows are not filtered out by\n  // default. If a deployment finds the volume genuinely noisy, tune the SIEM's review per AU-6 —\n  // do not silently downgrade this to INFO.\n  [CoreAuditableEventType.WEBHOOK_ENDPOINT_TEST_DISPATCHED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n\n  // SCIM Directory Provisioning Events\n  [CoreAuditableEventType.SCIM_TOKEN_CREATED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.SCIM_TOKEN_REVOKED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.SCIM_USER_PROVISIONED]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.SCIM_USER_UPDATED]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.SCIM_USER_DEACTIVATED]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.WARNING },\n\n  // Password Reset Events (H5)\n  [CoreAuditableEventType.USER_PASSWORD_RESET_REQUESTED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_PASSWORD_RESET_COMPLETED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n  // CRITICAL, one step above the self-service arms: an administrator reaching into another\n  // account's credentials is the shape of both a legitimate incident response AND an insider\n  // takeover, so it must page rather than merely accumulate.\n  [CoreAuditableEventType.USER_PASSWORD_RESET_FORCED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.CRITICAL },\n\n  // Registration & Verification Events (H5)\n  [CoreAuditableEventType.USER_REGISTERED]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_EMAIL_VERIFIED]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_VERIFICATION_EMAIL_RESENT]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.INFO },\n\n  // MFA Lifecycle Events (H5)\n  [CoreAuditableEventType.USER_MFA_SETUP_STARTED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_MFA_SETUP_COMPLETED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.USER_MFA_EMAIL_OTP_SENT]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n\n  // WebAuthn/Passkey Events (Phase G1)\n  [CoreAuditableEventType.USER_PASSKEY_REGISTERED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.USER_PASSKEY_AUTHENTICATION_SUCCESS]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_PASSKEY_AUTHENTICATION_FAILURE]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.USER_PASSKEY_REMOVED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n  // CRITICAL, and the only passkey event that is: a verified assertion whose counter regressed means\n  // a private key may exist in two places. Its siblings are routine authentication outcomes.\n  [CoreAuditableEventType.USER_PASSKEY_CLONE_SUSPECTED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.CRITICAL },\n\n  // Magic Link Events (Phase G2)\n  [CoreAuditableEventType.USER_MAGIC_LINK_SENT]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_MAGIC_LINK_VERIFIED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_MAGIC_LINK_FAILED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n\n  // SMS OTP Events (Phase G2)\n  [CoreAuditableEventType.USER_SMS_OTP_SENT]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_SMS_OTP_VERIFIED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_SMS_OTP_FAILED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n\n  // Phone Verification Events (Phase G2)\n  [CoreAuditableEventType.USER_PHONE_VERIFIED]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_PHONE_VERIFICATION_FAILED]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.WARNING },\n\n  // OAuth2 Provider Restriction Events (Phase G3)\n  [CoreAuditableEventType.OAUTH2_PROVIDER_BLOCKED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n  // AUTHENTICATION, not AUTHORIZATION: the demand is about HOW the person proved who they are, and\n  // the refusal happens before any authorization decision exists. WARNING rather than ERROR — a\n  // provider that will not satisfy a step-up demand is a configuration disagreement between two\n  // parties, expected to recur until an operator changes one of them, and an ERROR channel that\n  // fills with it stops being read.\n  [CoreAuditableEventType.OIDC_ACR_DEMAND_UNSATISFIED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n\n  // SCIM Extended Events\n  [CoreAuditableEventType.SCIM_TOKEN_GENERATED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.SCIM_TOKEN_ROTATED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.SCIM_PROVISIONING_CONFIG_UPDATED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.SCIM_PROVISIONING_FAILED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.CRITICAL },\n\n  // SAML Authentication Events (AUTH-2, D19.4)\n  [CoreAuditableEventType.SAML_LOGIN_INITIATED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.SAML_LOGIN_SUCCESS]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.SAML_LOGIN_FAILED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.SAML_ASSERTION_REPLAY_DETECTED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.CRITICAL },\n  [CoreAuditableEventType.SAML_CERT_EXPIRING]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.SAML_SLO_INITIATED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.SAML_SLO_COMPLETED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.SAML_METADATA_PARSED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.SAML_EMAIL_CHANGED]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.WARNING },\n\n  // Method Management Events (#13f)\n  [CoreAuditableEventType.USER_PASSWORD_SET]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.USER_TOTP_DISABLED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.USER_IDENTITY_LINK_REMOVED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n\n  // One-Off Session Events (W7.3b)\n  // A file upload grant delegates ONE upload under the minter's authority to whoever holds the link —\n  // an AUTHORIZATION artefact, not an authentication one (nobody logs in with it). Issued is INFO like\n  // every other token mint here; revoked is WARNING for the same reason the one-off revoke below is: an\n  // administrative credential termination is what a reviewer wants to see.\n  [CoreAuditableEventType.FILE_UPLOAD_GRANT_ISSUED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.FILE_UPLOAD_GRANT_REDEEMED]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.FILE_UPLOAD_GRANT_REVOKED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n  /*\n   * DATA_ACCESS for both, and it is the least-wrong of five rather than a good fit (#506). The\n   * category vocabulary has no security-operations member, and the file plane's own precedent splits\n   * the grant events the same way — AUTHORIZATION for issuing and revoking a credential, DATA_ACCESS\n   * for the moment content actually moves. A scan is a conclusion about CONTENT that arrived, so it\n   * belongs on the second side.\n   *\n   * The severities are the substance: an infection is a threat the control CAUGHT (critical, same\n   * argument as a suspected passkey clone), a scan failure is the control not having RUN (warning —\n   * nothing was found and nothing was exposed, because the file fails closed to a non-downloadable\n   * status either way; what is wrong is availability).\n   */\n  [CoreAuditableEventType.FILE_MALWARE_DETECTED]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.CRITICAL },\n  [CoreAuditableEventType.FILE_MALWARE_SCAN_FAILED]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.ONE_OFF_TOKEN_CREATED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.ONE_OFF_TOKEN_EXCHANGED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  // Revocation is an ADMINISTRATIVE credential-termination — a super-admin cancels an un-exchanged\n  // one-off/impersonation token. Per OWASP's Logging Vocabulary, administrative operations are WARNING\n  // even when successful and authorized: a SOC wants one-off-token revocations visible (incident\n  // response, or an abuse burst of cancellations). CREATED/EXCHANGED stay INFO (routine mint/use); the\n  // revoke is the operator intervention, which is the higher-signal row.\n  [CoreAuditableEventType.ONE_OFF_TOKEN_REVOKED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n\n  // Cross-Frontend Handoff Events (cross-app-jwt-propagation Step 2)\n  // Issuance is a credential-minting action (re-issues fresh JWT pair AND a single-use\n  // AUTH_CODE_EXCHANGE token bound to the user). WARNING severity matches other\n  // cross-session credential events (USER_PASSWORD_RESET_COMPLETED, USER_PASSKEY_REGISTERED)\n  // so SOC dashboards flag unusual handoff issuance bursts (e.g. token-issuance abuse).\n  [CoreAuditableEventType.USER_CROSS_FRONTEND_HANDOFF_ISSUED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n\n  // Field Access Events\n  [CoreAuditableEventType.FIELD_ACCESS]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.INFO },\n\n  // Resource-Operation Events — a HIGH/CRITICAL operation took effect on a resource.\n  // AUTHORIZATION rather than DATA_ACCESS: this event exists to evidence that a privileged ACTION\n  // was exercised (role/status/credential/tenant mutations), not that data was read — FIELD_ACCESS\n  // owns the disclosure axis. WARNING rather than INFO because every emission is by construction a\n  // HIGH or CRITICAL verb (or an explicit opt-in), so an INFO floor would hide the whole family\n  // beneath the routine-read noise on a SOC dashboard; and not CRITICAL because these are\n  // AUTHORIZED administrative actions, so reserving CRITICAL for anomalies (binding violations,\n  // token-reuse) keeps that level meaningful.\n  [CoreAuditableEventType.RESOURCE_OPERATION_PERFORMED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n\n  // The REFUSAL twin. AUTHORIZATION for the same reason as the success row — it IS an access-control\n  // decision, just the negative one.\n  //\n  // WARNING, and deliberately NOT graded by the refused operation's `riskLevel`: severity is a pure\n  // function of event type for every other member of this map, AND the SIEM dispatcher re-derives it\n  // from the event type independently (`_passesEventFilter`), so a per-row severity would have to be\n  // threaded through two authorities and would still leave this the only type whose severity is not\n  // a property of its kind. Danger grading rides the row's `riskLevel` field, which is already the\n  // framework's canonical danger axis; burst grading rides `eventData.occurrenceCount`.\n  //\n  // WARNING also matches the AUTHENTICATION twins (USER_LOGIN_FAILED, MACHINE_AUTH_FAILED): a single\n  // refusal is a fail-closed control working correctly, not an incident. CRITICAL stays reserved for\n  // anomalies — and the anomaly here is the PATTERN (many refusals), which a SOC rule builds from\n  // `occurrenceCount` rather than from one row's severity.\n  //\n  // assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT\n  [CoreAuditableEventType.RESOURCE_OPERATION_DENIED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n  // WARNING, not CRITICAL, and the choice is deliberate. A platform operator reaching into a tenant\n  // is SANCTIONED here (see the event's schema JSDoc) — most support work is exactly this — so\n  // CRITICAL would cry wolf on routine activity and train reviewers to filter the category out. The\n  // signal worth escalating on is the `admissionDeclared: false` subset, which a SIEM rule can select\n  // precisely because the field is on the payload.\n  [CoreAuditableEventType.CROSS_TENANT_ADMINISTRATIVE_ACCESS]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n  // INFO, unlike the WARNING sibling above: an application-wide directory read is the sanctioned,\n  // ordinary use of a surface built for it, and grading it WARNING would bury the genuine crossings.\n  // The subset worth escalating is selected on `returnedCount` — an operator paging 40,000 rows is an\n  // export — which is why that field is on the payload rather than inferred from the row count.\n  [CoreAuditableEventType.PLATFORM_DIRECTORY_ACCESS]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.INFO },\n  // WARNING for the same reason as its sibling above: requesting and deciding elevations is routine\n  // operator traffic, and CRITICAL here would train reviewers to filter the category out. The subset\n  // worth escalating is `autoApprovalReason: TENANT_CANNOT_APPROVE`, which a SIEM rule selects on and\n  // which the emitter additionally carries at a higher `riskLevel`.\n  [CoreAuditableEventType.PLATFORM_ACCESS_GRANT_LIFECYCLE]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n\n  // Retained-Data (Impersonalization) Access Events\n  // A privileged, human-attributed see-through read over RETAINED (impersonalized) records. WARNING —\n  // elevated vs a normal FIELD_ACCESS/INFO read because it reveals data the retention boundary hides,\n  // so SOC dashboards surface it; but an AUTHORIZED compliance action, not an anomaly ⇒ not CRITICAL.\n  [CoreAuditableEventType.RETAINED_DATA_ACCESS]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.WARNING },\n  // The single most sensitive disclosure the framework performs — everything held about one person,\n  // handed out. Same DATA_ACCESS / WARNING classification as a retained-data see-through: authorized\n  // and expected, but always worth a reviewer's eye.\n  [CoreAuditableEventType.SUBJECT_DATA_EXPORT]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.WARNING },\n  // INFO, with the page-vs-whole-table distinction carried by the per-emission `riskLevel` (LOW/HIGH)\n  // rather than by severity — see AuditableEvent_CollectionDataExport_EventDataSchema. A routine page\n  // download raised to WARNING would train reviewers to skim the channel it shares with real signals.\n  [CoreAuditableEventType.COLLECTION_DATA_EXPORT]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.INFO },\n  // Routine, authorized read-through of an EXTERNAL system's rows — the value is the queryable\n  // trail (who/which provider/which entity/how much), not an alarm. WARNING would put every\n  // ordinary external read beside see-through privileged access and train reviewers to skim.\n  [CoreAuditableEventType.HTTP_API_READ_THROUGH_ACCESS]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.INFO },\n  // The other outbound door: a custom service calling a declared provider operation. Same reading as\n  // the read-through row above — routine, authorized activity whose value is the queryable trail. The\n  // READ/WRITE axis and the failure case ride `classification`, `failureKind` and the per-emission\n  // `riskLevel`; raising the static severity for the write case would raise it for every read too.\n  [CoreAuditableEventType.PROVIDER_OPERATION_CALL]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.INFO },\n  // Same classification as its sibling above, for the same reason: routine authorized activity whose\n  // value is the queryable trail rather than an alarm. A refused target rides `failureKind`/`outcome`\n  // on the payload, never the static severity — see the enum member's docstring.\n  [CoreAuditableEventType.MCP_TOOL_CALL]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.INFO },\n  // A human approver AUTHORED the arguments a gated tool ran with. AUTHORIZATION rather than\n  // DATA_ACCESS because the recorded act is the DECISION, not the tool's effect — whatever the tool\n  // then touched is recorded by the tool's own operation rows. WARNING rather than CRITICAL for the\n  // same reading as the OAuth grant rows: an identified person taking an authorized action with the\n  // pause in front of them is notable, not wrong, and reserving CRITICAL for rows that mean\n  // something IS wrong is what keeps a severity filter worth reading.\n  [CoreAuditableEventType.AGENT_TOOL_APPROVAL_MODIFIED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n  // The sanctioned mechanics of a data-protection request (D6 stance 6b) — routine, not an alarm.\n  [CoreAuditableEventType.HTTP_API_EXTERNAL_ERASURE]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.INFO },\n  // A deliberate, per-request erasure hole (D6 stance 6c) — the record is the control, so it must\n  // surface in every severity-filtered view an operator actually reads.\n  [CoreAuditableEventType.HTTP_API_NON_ERASURE_ACKNOWLEDGED]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.CRITICAL },\n\n  // OAuth2 / OIDC Provider Events (Wildo AS the authorization server). Delegated-authority grants +\n  // consent decisions are AUTHORIZATION; token lifecycle (refresh/revoke) is AUTHENTICATION. Severity:\n  // a third party gaining/holding user-acting access is WARNING (notable, SOC-dashboard-worthy, but an\n  // authorized/consented action ⇒ not CRITICAL); a cross-user binding violation or refresh-token theft\n  // is CRITICAL; a denial/routine refresh/revoke is INFO.\n  [CoreAuditableEventType.OAUTH_DELEGATED_TOKEN_ISSUED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.OAUTH_CONSENT_GRANTED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.OAUTH_CONSENT_DENIED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.OAUTH_CONSENT_GRANT_PERSISTED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n  // WARNING, not INFO: an unauthenticated party created a durable identity. Individually routine\n  // when the feature is enabled, but the SHAPE an operator must be able to alert on is a spike —\n  // which only reads as a spike if each one is above the noise floor.\n  // AUTHENTICATION/WARNING: a refused client identity is an authentication-front event, and the\n  // SSRF variant is an attack rather than a misconfiguration. WARNING keeps a spike visible without\n  // making an ordinary allow-list miss look like an incident.\n  [CoreAuditableEventType.OAUTH_CIMD_CLIENT_REFUSED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.OAUTH_DYNAMIC_CLIENT_REGISTERED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.OAUTH_TOKEN_REFRESHED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.OAUTH_TOKEN_REVOKED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.OAUTH_RP_INITIATED_LOGOUT]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.OAUTH_CODE_EXCHANGE_FAILED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.OAUTH_CONSENT_BINDING_VIOLATION]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.CRITICAL },\n  [CoreAuditableEventType.USER_REFRESH_TOKEN_REUSE_DETECTED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.CRITICAL },\n\n  // System-context (ACL-bypass) trail. Both were UNMAPPED until 2026-08-11 and took the fallback.\n  // The READ keeps exactly what the fallback gave it — its declaration already documented\n  // `DATA_ACCESS`/`INFO` as intended (\"an expected, authorized internal read — not an anomaly\"), so\n  // this only stops that intent depending on a default nobody had noticed it was relying on.\n  [CoreAuditableEventType.SYSTEM_CONTEXT_READ]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.INFO },\n  // The WRITE is raised to WARNING, following `RETAINED_DATA_ACCESS` — the other privileged-access\n  // event in this file — which reasons that an authorized-but-elevated access is WARNING and not\n  // CRITICAL because it is expected rather than anomalous. Category deliberately UNCHANGED: moving it\n  // to AUTHORIZATION would drop it for every tenant whose export filters on categories, which is a\n  // worse failure than an under-graded severity. This is the classification the event's own\n  // declaration asks for and had never received.\n  [CoreAuditableEventType.SYSTEM_CONTEXT_WRITE]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.WARNING },\n};\n\nconst DEFAULT_AUDIT_EVENT_CLASSIFICATION: AuditEventClassification = { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.INFO };\n\n/**\n * Look up the classification for an audit event type.\n *\n * Every `CoreAuditableEventType` is mapped — enforced by the map's type, not by this comment, which\n * asserted exactly that while two event types went unmapped for months. The fallback exists for\n * APPLICATION-defined event types, which are ordinary strings the engine cannot enumerate.\n */\nexport function getAuditEventClassification(eventType: string): AuditEventClassification {\n  return AUDIT_EVENT_CLASSIFICATION_MAP[eventType as CoreAuditableEventType] ?? DEFAULT_AUDIT_EVENT_CLASSIFICATION;\n}\n"]}

package/dist/esm/compliance/documents/governed-documents.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"governed-documents.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/documents/governed-documents.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,mFAAmF;AACnF,eAAO,MAAM,2CAA2C,kEAAkE,CAAC;AAc3H,eAAO,MAAM,yBAAyB,+DAAqF,CAAC;AAC5H,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,iCAAiC,kBAAmC,CAAC;AAClF,eAAO,MAAM,6BAA6B,cAAe,CAAC;AAC1D,6EAA6E;AAC7E,eAAO,MAAM,yCAAyC,aAA2D,CAAC;AAElH,qIAAqI;AACrI,oBAAY,qBAAqB;IAC/B,aAAa,kBAAkB;IAC/B,iBAAiB,sBAAsB;IACvC,iBAAiB,sBAAsB;IACvC,oBAAoB,yBAAyB;IAC7C,IAAI,SAAS;IACb,QAAQ,aAAa;IACrB,yBAAyB,8BAA8B;IACvD,oBAAoB,yBAAyB;IAC7C,iBAAiB,sBAAsB;CACxC;AAED,qIAAqI;AACrI,oBAAY,qCAAqC;IAC/C,cAAc,mBAAmB;IACjC,oBAAoB,yBAAyB;IAC7C,mBAAmB,wBAAwB;IAC3C,qBAAqB,0BAA0B;CAChD;AAED,oBAAY,4BAA4B;IACtC,cAAc,mBAAmB;IACjC,iBAAiB,sBAAsB;IACvC,QAAQ,aAAa;IACrB,gBAAgB,qBAAqB;IACrC,SAAS,cAAc;IACvB,oBAAoB,yBAAyB;IAC7C,kBAAkB,uBAAuB;CAC1C;AAED,oBAAY,mCAAmC;IAC7C,UAAU,eAAe;IACzB,cAAc,mBAAmB;IACjC,QAAQ,aAAa;CACtB;AAED,oBAAY,oCAAoC;IAC9C,KAAK,UAAU;IACf,OAAO,YAAY;IACnB,WAAW,gBAAgB;IAC3B,KAAK,UAAU;IACf,cAAc,mBAAmB;CAClC;AAED,oBAAY,+BAA+B;IACzC,KAAK,UAAU;IACf,OAAO,YAAY;IACnB,gBAAgB,qBAAqB;IACrC,UAAU,eAAe;CAC1B;AAED,oBAAY,0BAA0B;IACpC,OAAO,YAAY;IACnB,SAAS,cAAc;IACvB,OAAO,YAAY;IACnB,QAAQ,aAAa;IACrB,KAAK,UAAU;IACf,QAAQ,aAAa;IACrB,sBAAsB,2BAA2B;CAClD;AAED,oBAAY,kCAAkC;IAC5C,QAAQ,aAAa;IACrB,gBAAgB,qBAAqB;IACrC,QAAQ,aAAa;IACrB,QAAQ,aAAa;CACtB;AAED,oBAAY,sCAAsC;IAChD,UAAU,eAAe;IACzB,iBAAiB,sBAAsB;IACvC,gBAAgB,qBAAqB;IACrC,eAAe,oBAAoB;IACnC,qBAAqB,0BAA0B;CAChD;AAED,oBAAY,oCAAoC;IAC9C,SAAS,cAAc;IACvB,SAAS,cAAc;CACxB;AAED,0HAA0H;AAC1H,oBAAY,+BAA+B;IACzC,gBAAgB,qBAAqB;IACrC,mBAAmB,wBAAwB;IAC3C,iBAAiB,sBAAsB;IACvC,aAAa,kBAAkB;IAC/B,iBAAiB,sBAAsB;CACxC;AAED,oBAAY,4BAA4B;IACtC,gBAAgB,qBAAqB;IACrC,gBAAgB,qBAAqB;IACrC,SAAS,cAAc;IACvB,MAAM,WAAW;IACjB,yBAAyB,8BAA8B;IACvD,oBAAoB,yBAAyB;IAC7C,QAAQ,aAAa;IACrB,6BAA6B,kCAAkC;CAChE;AAED,eAAO,MAAM,wCAAwC;;;kBAGnD,CAAC;AACH,MAAM,MAAM,kCAAkC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wCAAwC,CAAC,CAAC;AAE1G,eAAO,MAAM,8BAA8B;;;kBAGzC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF,eAAO,MAAM,qCAAqC;;;;;;;kBAIhD,CAAC;AACH,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AAEpG,eAAO,MAAM,kCAAkC,GAAI,UAAU,+BAA+B,KAAG,MAC2B,CAAC;AAE3H,iIAAiI;AACjI,eAAO,MAAM,8CAA8C;;;kBAGzD,CAAC;AACH,MAAM,MAAM,wCAAwC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8CAA8C,CAAC,CAAC;AAEtH;;;;;;GAMG;AACH,eAAO,MAAM,iDAAiD;;;;;;;;;;;;kBAS1D,CAAC;AACL,MAAM,MAAM,2CAA2C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iDAAiD,CAAC,CAAC;AAE5H,8EAA8E;AAC9E,eAAO,MAAM,+CAA+C;;;kBAG1D,CAAC;AACH,MAAM,MAAM,yCAAyC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+CAA+C,CAAC,CAAC;AAExH,8IAA8I;AAC9I,eAAO,MAAM,kDAAkD;;;kBAG7D,CAAC;AACH,MAAM,MAAM,4CAA4C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kDAAkD,CAAC,CAAC;AAE9H;;;;;GAKG;AACH,eAAO,MAAM,qCAAqC;;;;;;;kBA0B9C,CAAC;AACL,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AAEpG;;;;;;GAMG;AACH,eAAO,MAAM,kCAAkC;;;;;kBAK7C,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F,eAAO,MAAM,mCAAmC;;;;;;;;;;;kBAqB5C,CAAC;AACL,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;kBAsB5C,CAAC;AACL,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG;;;;;;;GAOG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAgF5C,CAAC;AAEL,4FAA4F;AAC5F,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAExC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,oFAAoF;AACpF,oBAAY,sCAAsC;IAChD,OAAO,YAAY;IACnB,UAAU,eAAe;CAC1B;AAED,eAAO,MAAM,2CAA2C;;;kBAGtD,CAAC;AACH,eAAO,MAAM,8CAA8C;;;kBAGzD,CAAC;AACH,eAAO,MAAM,wCAAwC;;;;;;4BAGnD,CAAC;AACH,MAAM,MAAM,kCAAkC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wCAAwC,CAAC,CAAC;AA+B1G,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;;;;;;;kBAUS,CAAC;AAC3D,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;;;;;;;;kBAGS,CAAC;AAC3D,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG,eAAO,MAAM,sCAAsC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iCAGjD,CAAC;AACH,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sCAAsC,CAAC,CAAC;AAEtG;;;;;;;GAOG;AACH,eAAO,MAAM,6CAA6C;;;;;;;;;;;;;;;;;;;;;kBAqBtD,CAAC;AACL,MAAM,MAAM,uCAAuC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6CAA6C,CAAC,CAAC;AAEpH,gGAAgG;AAChG,eAAO,MAAM,oCAAoC,GAAI,cAAc,uBAAuB,KAAG,uCAc5F,CAAC"}
+{"version":3,"file":"governed-documents.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/compliance/documents/governed-documents.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,mFAAmF;AACnF,eAAO,MAAM,2CAA2C,kEAAkE,CAAC;AAc3H,eAAO,MAAM,yBAAyB,+DAAqF,CAAC;AAC5H,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,iCAAiC,kBAAmC,CAAC;AAClF,eAAO,MAAM,6BAA6B,cAAe,CAAC;AAC1D,6EAA6E;AAC7E,eAAO,MAAM,yCAAyC,aAA2D,CAAC;AAElH,qIAAqI;AACrI,oBAAY,qBAAqB;IAC/B,aAAa,kBAAkB;IAC/B,iBAAiB,sBAAsB;IACvC,iBAAiB,sBAAsB;IACvC,oBAAoB,yBAAyB;IAC7C,IAAI,SAAS;IACb,QAAQ,aAAa;IACrB,yBAAyB,8BAA8B;IACvD,oBAAoB,yBAAyB;IAC7C,iBAAiB,sBAAsB;CACxC;AAED,qIAAqI;AACrI,oBAAY,qCAAqC;IAC/C,cAAc,mBAAmB;IACjC,oBAAoB,yBAAyB;IAC7C,mBAAmB,wBAAwB;IAC3C,qBAAqB,0BAA0B;CAChD;AAED,oBAAY,4BAA4B;IACtC,cAAc,mBAAmB;IACjC,iBAAiB,sBAAsB;IACvC,QAAQ,aAAa;IACrB,gBAAgB,qBAAqB;IACrC,SAAS,cAAc;IACvB,oBAAoB,yBAAyB;IAC7C,kBAAkB,uBAAuB;CAC1C;AAED,oBAAY,mCAAmC;IAC7C,UAAU,eAAe;IACzB,cAAc,mBAAmB;IACjC,QAAQ,aAAa;CACtB;AAED,oBAAY,oCAAoC;IAC9C,KAAK,UAAU;IACf,OAAO,YAAY;IACnB,WAAW,gBAAgB;IAC3B,KAAK,UAAU;IACf,cAAc,mBAAmB;CAClC;AAED,oBAAY,+BAA+B;IACzC,KAAK,UAAU;IACf,OAAO,YAAY;IACnB,gBAAgB,qBAAqB;IACrC,UAAU,eAAe;CAC1B;AAED,oBAAY,0BAA0B;IACpC,OAAO,YAAY;IACnB,SAAS,cAAc;IACvB,OAAO,YAAY;IACnB,QAAQ,aAAa;IACrB,KAAK,UAAU;IACf,QAAQ,aAAa;IACrB,sBAAsB,2BAA2B;CAClD;AAED,oBAAY,kCAAkC;IAC5C,QAAQ,aAAa;IACrB,gBAAgB,qBAAqB;IACrC,QAAQ,aAAa;IACrB,QAAQ,aAAa;CACtB;AAED,oBAAY,sCAAsC;IAChD,UAAU,eAAe;IACzB,iBAAiB,sBAAsB;IACvC,gBAAgB,qBAAqB;IACrC,eAAe,oBAAoB;IACnC,qBAAqB,0BAA0B;CAChD;AAED,oBAAY,oCAAoC;IAC9C,SAAS,cAAc;IACvB,SAAS,cAAc;CACxB;AAED,0HAA0H;AAC1H,oBAAY,+BAA+B;IACzC,gBAAgB,qBAAqB;IACrC,mBAAmB,wBAAwB;IAC3C,iBAAiB,sBAAsB;IACvC,aAAa,kBAAkB;IAC/B,iBAAiB,sBAAsB;CACxC;AAED,oBAAY,4BAA4B;IACtC,gBAAgB,qBAAqB;IACrC,gBAAgB,qBAAqB;IACrC,SAAS,cAAc;IACvB,MAAM,WAAW;IACjB,yBAAyB,8BAA8B;IACvD,oBAAoB,yBAAyB;IAC7C,QAAQ,aAAa;IACrB,6BAA6B,kCAAkC;CAChE;AAED,eAAO,MAAM,wCAAwC;;;kBAGnD,CAAC;AACH,MAAM,MAAM,kCAAkC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wCAAwC,CAAC,CAAC;AAE1G,eAAO,MAAM,8BAA8B;;;kBAGzC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF,eAAO,MAAM,qCAAqC;;;;;;;kBAIhD,CAAC;AACH,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AAEpG,eAAO,MAAM,kCAAkC,GAAI,UAAU,+BAA+B,KAAG,MAC2B,CAAC;AAE3H,iIAAiI;AACjI,eAAO,MAAM,8CAA8C;;;kBAGzD,CAAC;AACH,MAAM,MAAM,wCAAwC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8CAA8C,CAAC,CAAC;AAEtH;;;;;;GAMG;AACH,eAAO,MAAM,iDAAiD;;;;;;;;;;;;kBAS1D,CAAC;AACL,MAAM,MAAM,2CAA2C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iDAAiD,CAAC,CAAC;AAE5H,8EAA8E;AAC9E,eAAO,MAAM,+CAA+C;;;kBAG1D,CAAC;AACH,MAAM,MAAM,yCAAyC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+CAA+C,CAAC,CAAC;AAExH,8IAA8I;AAC9I,eAAO,MAAM,kDAAkD;;;kBAG7D,CAAC;AACH,MAAM,MAAM,4CAA4C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kDAAkD,CAAC,CAAC;AAE9H;;;;;GAKG;AACH,eAAO,MAAM,qCAAqC;;;;;;;kBA0B9C,CAAC;AACL,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AAEpG;;;;;;GAMG;AACH,eAAO,MAAM,kCAAkC;;;;;kBAK7C,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F,eAAO,MAAM,mCAAmC;;;;;;;;;;;kBAqB5C,CAAC;AACL,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;kBAsB5C,CAAC;AACL,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG;;;;;;;GAOG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAgF5C,CAAC;AAEL,4FAA4F;AAC5F,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAExC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,oFAAoF;AACpF,oBAAY,sCAAsC;IAChD,OAAO,YAAY;IACnB,UAAU,eAAe;CAC1B;AAED,eAAO,MAAM,2CAA2C;;;kBAGtD,CAAC;AACH,eAAO,MAAM,8CAA8C;;;kBAGzD,CAAC;AACH,eAAO,MAAM,wCAAwC;;;;;;4BAGnD,CAAC;AACH,MAAM,MAAM,kCAAkC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wCAAwC,CAAC,CAAC;AA+B1G,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;;;;;;;kBAUS,CAAC;AAC3D,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;;;;;;;;kBAGS,CAAC;AAC3D,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG,eAAO,MAAM,sCAAsC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iCAGjD,CAAC;AACH,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sCAAsC,CAAC,CAAC;AAEtG;;;;;;;GAOG;AACH,eAAO,MAAM,6CAA6C;;;;;;;;;;;;;;;;;;;;;kBAqBtD,CAAC;AACL,MAAM,MAAM,uCAAuC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6CAA6C,CAAC,CAAC;AAEpH,gGAAgG;AAChG,eAAO,MAAM,oCAAoC,GAAI,cAAc,uBAAuB,KAAG,uCAc5F,CAAC"}

package/dist/esm/compliance/privacy/ai-use-posture.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ai-use-posture.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/ai-use-posture.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,MAAM,6DAA6D,CAAC;AAE/F;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,oBAAY,qBAAqB;IAC/B;;;;;;OAMG;IACH,WAAW,gBAAgB;IAC3B;;;;;;;OAOG;IACH,sBAAsB,2BAA2B;IACjD,+FAA+F;IAC/F,oBAAoB,yBAAyB;CAC9C;AAED,4CAA4C;AAC5C,eAAO,MAAM,kBAAkB;;IAG3B;;;;;;OAMG;;IAEH;;;;;;;OAOG;;kBAqBH,CAAC;AACL,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D;;;;;;;;GAQG;AACH,eAAO,MAAM,6BAA6B;;IAhDtC;;;;;;OAMG;;IAEH;;;;;;;OAOG;;mBAiCmG,CAAC;AAC3G,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,EAAE,SAAS,gBAAgB,EAK5D,CAAC;AAEH;;;;;GAKG;AACH,wBAAgB,2BAA2B,CACzC,mBAAmB,EAAE,SAAS,MAAM,EAAE,EACtC,OAAO,EAAE,uBAAuB,GAAG,SAAS,GAC3C,SAAS,gBAAgB,EAAE,CAK7B"}
+{"version":3,"file":"ai-use-posture.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/ai-use-posture.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,MAAM,6DAA6D,CAAC;AAE/F;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,oBAAY,qBAAqB;IAC/B;;;;;;OAMG;IACH,WAAW,gBAAgB;IAC3B;;;;;;;OAOG;IACH,sBAAsB,2BAA2B;IACjD,+FAA+F;IAC/F,oBAAoB,yBAAyB;CAC9C;AAED,4CAA4C;AAC5C,eAAO,MAAM,kBAAkB;;IAG3B;;;;;;OAMG;;IAEH;;;;;;;OAOG;;kBAqBH,CAAC;AACL,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D;;;;;;;;GAQG;AACH,eAAO,MAAM,6BAA6B;;IAhDtC;;;;;;OAMG;;IAEH;;;;;;;OAOG;;mBAiCmG,CAAC;AAC3G,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,EAAE,SAAS,gBAAgB,EAK5D,CAAC;AAEH;;;;;GAKG;AACH,wBAAgB,2BAA2B,CACzC,mBAAmB,EAAE,SAAS,MAAM,EAAE,EACtC,OAAO,EAAE,uBAAuB,GAAG,SAAS,GAC3C,SAAS,gBAAgB,EAAE,CAK7B"}

package/dist/esm/compliance/privacy/client-storage.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client-storage.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/client-storage.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,sHAAsH;AACtH,oBAAY,sBAAsB;IAChC,MAAM,WAAW;IACjB,aAAa,kBAAkB;IAC/B,eAAe,oBAAoB;CACpC;AAED;;;;;;GAMG;AACH,oBAAY,sBAAsB;IAChC,sGAAsG;IACtG,kBAAkB,uBAAuB;IACzC,qGAAqG;IACrG,aAAa,kBAAkB;CAChC;AAED,qEAAqE;AACrE,eAAO,MAAM,wBAAwB;IACnC,kGAAkG;;;IAGlG,mGAAmG;;;IAGnG;;;;;;;OAOG;;IAEH;;;;;;OAMG;;kBAEH,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,6BAA6B,EAAE,SAAS,kBAAkB,EAiBrE,CAAC;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,uCAAuC;IAnElD,kGAAkG;;;IAGlG,mGAAmG;;;IAGnG;;;;;;;OAOG;;IAEH;;;;;;OAMG;;oBAiDJ,CAAC;AACF,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;AAExG;;;;;;GAMG;AACH,wBAAgB,kCAAkC,CAChD,mBAAmB,EAAE,SAAS,MAAM,EAAE,EACtC,SAAS,EAAE,iCAAiC,GAAG,SAAS,GACvD,SAAS,MAAM,EAAE,CAEnB"}
+{"version":3,"file":"client-storage.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/client-storage.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,sHAAsH;AACtH,oBAAY,sBAAsB;IAChC,MAAM,WAAW;IACjB,aAAa,kBAAkB;IAC/B,eAAe,oBAAoB;CACpC;AAED;;;;;;GAMG;AACH,oBAAY,sBAAsB;IAChC,sGAAsG;IACtG,kBAAkB,uBAAuB;IACzC,qGAAqG;IACrG,aAAa,kBAAkB;CAChC;AAED,qEAAqE;AACrE,eAAO,MAAM,wBAAwB;IACnC,kGAAkG;;;IAGlG,mGAAmG;;;IAGnG;;;;;;;OAOG;;IAEH;;;;;;OAMG;;kBAEH,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,6BAA6B,EAAE,SAAS,kBAAkB,EAiBrE,CAAC;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,uCAAuC;IAnElD,kGAAkG;;;IAGlG,mGAAmG;;;IAGnG;;;;;;;OAOG;;IAEH;;;;;;OAMG;;oBAiDJ,CAAC;AACF,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;AAExG;;;;;;GAMG;AACH,wBAAgB,kCAAkC,CAChD,mBAAmB,EAAE,SAAS,MAAM,EAAE,EACtC,SAAS,EAAE,iCAAiC,GAAG,SAAS,GACvD,SAAS,MAAM,EAAE,CAEnB"}

package/dist/esm/compliance/privacy/data-retention.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"data-retention.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/data-retention.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,yBAAyB;;;;iBAIpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC"}
+{"version":3,"file":"data-retention.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/data-retention.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,yBAAyB;;;;iBAIpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC"}

package/dist/esm/compliance/privacy/impersonalization-scrub.shared.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"impersonalization-scrub.shared.utils.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/impersonalization-scrub.shared.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,qDAAa,CAAC;AAEtD;;;;;;;;GAQG;AACH,wBAAgB,6BAA6B,CAAC,WAAW,EAAE,CAAC,CAAC,UAAU,GAAG,MAAM,CAE/E;AAED;;;;;;;;;;GAUG;AACH;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,8BAA8B,CAAC,WAAW,EAAE,CAAC,CAAC,UAAU,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAoEpG;AAED,wBAAgB,mCAAmC,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAM9E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,iCAAiC,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,GAAG,SAAS,MAAM,EAAE,CAS7F;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,4BAA4B,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA8C9F"}
+{"version":3,"file":"impersonalization-scrub.shared.utils.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/impersonalization-scrub.shared.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,qDAAa,CAAC;AAEtD;;;;;;;;GAQG;AACH,wBAAgB,6BAA6B,CAAC,WAAW,EAAE,CAAC,CAAC,UAAU,GAAG,MAAM,CAE/E;AAED;;;;;;;;;;GAUG;AACH;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,8BAA8B,CAAC,WAAW,EAAE,CAAC,CAAC,UAAU,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAoEpG;AAED,wBAAgB,mCAAmC,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAM9E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,iCAAiC,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,GAAG,SAAS,MAAM,EAAE,CAS7F;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,4BAA4B,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA8C9F"}

package/dist/esm/compliance/privacy/impersonalization.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"impersonalization.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/impersonalization.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,oBAAY,eAAe;IACzB,sDAAsD;IACtD,MAAM,WAAW;IACjB;;;;;;;;;;;;;OAaG;IACH,QAAQ,aAAa;CACtB;AAED;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,eAAe,CAC3C,CAAC;AAE1B;;;;;;;;;;;;;;GAcG;AACH,oBAAY,oBAAoB;IAC9B;;;;;;OAMG;IACH,WAAW,gBAAgB;IAC3B;;;;;;OAMG;IACH,wBAAwB,6BAA6B;CACtD;AAED;;;GAGG;AACH,eAAO,MAAM,0BAA0B,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,oBAAoB,CAChD,CAAC;AAE/B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACH,oBAAY,uBAAuB;IACjC;;;;;;;;;;;;;;;;;;OAkBG;IACH,YAAY,iBAAiB;IAC7B;;;;;;;;;OASG;IACH,cAAc,mBAAmB;IACjC;;;;;;;;;;OAUG;IACH,gBAAgB,qBAAqB;CACtC;AAED;;;GAGG;AACH,eAAO,MAAM,6BAA6B,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,uBAAuB,CACnD,CAAC"}
+{"version":3,"file":"impersonalization.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/impersonalization.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,oBAAY,eAAe;IACzB,sDAAsD;IACtD,MAAM,WAAW;IACjB;;;;;;;;;;;;;OAaG;IACH,QAAQ,aAAa;CACtB;AAED;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,eAAe,CAC3C,CAAC;AAE1B;;;;;;;;;;;;;;GAcG;AACH,oBAAY,oBAAoB;IAC9B;;;;;;OAMG;IACH,WAAW,gBAAgB;IAC3B;;;;;;OAMG;IACH,wBAAwB,6BAA6B;CACtD;AAED;;;GAGG;AACH,eAAO,MAAM,0BAA0B,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,oBAAoB,CAChD,CAAC;AAE/B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACH,oBAAY,uBAAuB;IACjC;;;;;;;;;;;;;;;;;;OAkBG;IACH,YAAY,iBAAiB;IAC7B;;;;;;;;;OASG;IACH,cAAc,mBAAmB;IACjC;;;;;;;;;;OAUG;IACH,gBAAgB,qBAAqB;CACtC;AAED;;;GAGG;AACH,eAAO,MAAM,6BAA6B,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,uBAAuB,CACnD,CAAC"}