npm - @wildo-ai/saas-models - Versions diffs - 1.1.5 → 1.1.7 - Mend

@wildo-ai/saas-models 1.1.5 → 1.1.7

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1295) hide show

package/dist/esm/compliance/audit-trails/auditable-events.shared.schema.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"auditable-events.shared.schema.js","sourceRoot":"","sources":["../../../../../src/compliance/audit-trails/auditable-events.shared.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAAE,iCAAiC,EAAE,MAAM,2EAA2E,CAAC;AAC9H,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,0CAA0C,EAAE,MAAM,sCAAsC,CAAC;AAClG,OAAO,EAAE,iCAAiC,EAAE,MAAM,4DAA4D,CAAC;AAC/G,OAAO,EAAE,oBAAoB,EAAE,MAAM,kDAAkD,CAAC;AACxF,OAAO,EAAE,8BAA8B,EAAE,MAAM,oDAAoD,CAAC;AACpG,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAAE,MAAM,0CAA0C,CAAC;AACpH,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC1F,OAAO,EACL,qCAAqC,EACrC,sCAAsC,EACtC,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,qEAAqE,CAAC;AAC7E,OAAO,EAAE,2CAA2C,EAAE,MAAM,+EAA+E,CAAC;AAC5I,OAAO,EAAE,8BAA8B,EAAE,wCAAwC,EAAE,MAAM,gDAAgD,CAAC;AAC1I,OAAO,EACL,aAAa,EACb,iBAAiB,GAClB,MAAM,8DAA8D,CAAC;AACtE,OAAO,EAAE,2BAA2B,EAAE,MAAM,uDAAuD,CAAC;AACpG,OAAO,EACL,gCAAgC,EAChC,qCAAqC,EACrC,kCAAkC,GACnC,MAAM,uEAAuE,CAAC;AAG/E,MAAM,CAAN,IAAY,sBA0zBX;AA1zBD,WAAY,sBAAsB;IAChC,wBAAwB;IACxB,mDAAyB,CAAA;IACzB,qDAA2B,CAAA;IAC3B,iEAAuC,CAAA;IACvC,qEAA2C,CAAA;IAC3C,yEAA+C,CAAA;IAC/C,6FAA6F;IAC7F,yFAAyF;IACzF,gGAAgG;IAChG,+FAA+F;IAC/F,+FAA+F;IAC/F,8FAA8F;IAC9F,+DAAqC,CAAA;IACrC,2FAA2F;IAC3F,iEAAuC,CAAA;IACvC,gGAAgG;IAChG,iGAAiG;IACjG,2FAA2F;IAC3F,iGAAiG;IACjG,mFAAmF;IACnF,iGAAiG;IACjG,kBAAkB;IAClB,uEAA6C,CAAA;IAE7C;;;;;;;;;;;;;;;OAeG;IACH,uEAA6C,CAAA;IAE7C,oGAAoG;IACpG,6FAA6F;IAC7F,2EAA2E;IAC3E,uEAA6C,CAAA;IAC7C,qEAA2C,CAAA;IAC3C,mGAAmG;IACnG,oGAAoG;IACpG,mGAAmG;IACnG,kGAAkG;IAClG,2DAAiC,CAAA;IAEjC,wBAAwB;IACxB,yEAAyE;IACzE,+FAA+F;IAC/F,iGAAiG;IACjG,uGAAuG;IACvG,8FAA8F;IAC9F,iGAAiG;IACjG,iGAAiG;IACjG,iEAAiE;IACjE,uDAA6B,CAAA;IAC7B,uGAAuG;IACvG,uDAA6B,CAAA;IAC7B,uDAA6B,CAAA;IAE7B,kEAAkE;IAClE,kGAAkG;IAClG,kGAAkG;IAClG,mGAAmG;IACnG,mGAAmG;IACnG,kDAAkD;IAClD,+FAA+F;IAC/F,2EAAiD,CAAA;IAEjD,iGAAiG;IACjG,8FAA8F;IAC9F,+FAA+F;IAC/F,2FAA2F;IAC3F,+FAA+F;IAC/F,uEAAuE;IACvE,mGAAmG;IACnG,wFAAwF;IACxF,2GAAiF,CAAA;IACjF;;;;;;;;;;OAUG;IACH,iGAAuE,CAAA;IAEvE,gCAAgC;IAChC,uGAAuG;IACvG,uEAA6C,CAAA;IAC7C,uGAAuG;IACvG,uEAA6C,CAAA;IAC7C;;;OAGG;IACH,mFAAyD,CAAA;IACzD,uEAA6C,CAAA;IAC7C,0GAA0G;IAC1G,6FAAmE,CAAA;IACnE,2EAA2E;IAC3E,yEAA+C,CAAA;IAC/C,oFAAoF;IACpF,2EAAiD,CAAA;IACjD,mEAAmE;IACnE,2EAAiD,CAAA;IACjD;;;;;;;;;;;;;;OAcG;IACH,uGAA6E,CAAA;IAE7E,6BAA6B;IAC7B,uGAAuG;IACvG,qFAA2D,CAAA;IAC3D,uGAAuG;IACvG,mFAAyD,CAAA;IACzD,uGAAuG;IACvG,qFAA2D,CAAA;IAC3D,+FAAqE,CAAA;IACrE,uGAAuG;IACvG,mGAAyE,CAAA;IACzE,qFAA2D,CAAA;IAE3D,uGAAuG;IACvG,mGAAyE,CAAA;IACzE,uGAAuG;IACvG,+FAAqE,CAAA;IACrE,uGAAuG;IACvG,uFAA6D,CAAA;IAC7D,uGAAuG;IACvG,iFAAuD,CAAA;IAEvD,oFAAoF;IACpF,kGAAkG;IAClG,2FAA2F;IAC3F,+FAA+F;IAC/F,mGAAmG;IACnG,2EAA2E;IAC3E,+FAA+F;IAC/F,yGAA+E,CAAA;IAE/E,iEAAiE;IACjE,+FAA+F;IAC/F,mGAAmG;IACnG,6FAA6F;IAC7F,8EAA8E;IAC9E,yFAAyF;IACzF,+FAAqE,CAAA;IAErE,4BAA4B;IAC5B,2DAAiC,CAAA;IACjC,yEAA+C,CAAA;IAE/C;;;;;;;;;;;;;;;;OAgBG;IACH,uFAA6D,CAAA;IAC7D,uEAA6C,CAAA;IAE7C,0CAA0C;IAC1C,uGAAuG;IACvG,qGAAqG;IACrG,oGAAoG;IACpG,qFAAqF;IACrF,2GAAiF,CAAA;IACjF,qIAAqI;IACrI,qGAA2E,CAAA;IAC3E;;;;;;OAMG;IACH,iGAAuE,CAAA;IACvE;;;;OAIG;IACH,uHAA6F,CAAA;IAE7F,0CAA0C;IAC1C,EAAE;IACF,6FAA6F;IAC7F,4FAA4F;IAC5F,gGAAgG;IAChG,6FAA6F;IAC7F,0FAA0F;IAC1F,+BAA+B;IAC/B,EAAE;IACF,+FAA+F;IAC/F,gGAAgG;IAChG,EAAE;IACF,8FAA8F;IAC9F,uDAAuD;IACvD,uGAA6E,CAAA;IAC7E,+GAAqF,CAAA;IACrF,yGAA+E,CAAA;IAC/E,+GAAqF,CAAA;IAErF,6FAA6F;IAC7F,+FAA+F;IAC/F,iGAAiG;IACjG,2FAA2F;IAC3F,kEAAkE;IAClE,uFAA6D,CAAA;IAC7D,+FAAqE,CAAA;IACrE,yFAA+D,CAAA;IAC/D,+FAAqE,CAAA;IAErE,uEAAuE;IACvE,EAAE;IACF,kGAAkG;IAClG,kGAAkG;IAClG,kGAAkG;IAClG,8FAA8F;IAC9F,mGAAmG;IACnG,mGAAmG;IACnG,gGAAgG;IAChG,wFAAwF;IACxF,EAAE;IACF,mGAAmG;IACnG,mGAAmG;IACnG,sEAAsE;IACtE,EAAE;IACF,+FAA+F;IAC/F,mDAAmD;IACnD,EAAE;IACF,iGAAiG;IACjG,uCAAuC;IACvC,+GAAqF,CAAA;IACrF,+FAAqE,CAAA;IAErE,4CAA4C;IAC5C,qHAAqH;IACrH,gGAAgG;IAChG,8FAA8F;IAC9F,kGAAkG;IAClG,kGAAkG;IAClG,kGAAkG;IAClG,kGAAkG;IAClG,gGAAgG;IAChG,qFAAqF;IACrF,iGAAiG;IACjG,8EAA8E;IAC9E,6FAAmE,CAAA;IAEnE,8BAA8B;IAC9B,qFAAqF;IACrF,uFAAuF;IACvF,yFAAyF;IACzF,uDAAuD;IACvD,uGAAuG;IACvG,0DAA0D;IAC1D,+FAAqE,CAAA;IAErE,qCAAqC;IACrC,uGAAuG;IACvG,mEAAyC,CAAA;IACzC,uGAAuG;IACvG,yGAAyG;IACzG,oFAAoF;IACpF,mEAAyC,CAAA;IACzC,wGAAwG;IACxG,uEAA6C,CAAA;IAC7C,sGAAsG;IACtG,mEAAyC,CAAA;IACzC,uGAAuG;IACvG,sGAAsG;IACtG,0GAA0G;IAC1G,+FAAqE,CAAA;IACrE,+EAAqD,CAAA;IACrD,yEAA+C,CAAA;IAC/C,iEAAuC,CAAA;IACvC,yEAA+C,CAAA;IAE/C,6BAA6B;IAC7B,yFAA+D,CAAA;IAC/D,yFAA+D,CAAA;IAC/D;;;;;;;OAOG;IACH,mFAAyD,CAAA;IAEzD,0CAA0C;IAC1C,6DAAmC,CAAA;IACnC,qEAA2C,CAAA;IAC3C,2FAAiE,CAAA;IAEjE,kCAAkC;IAClC,iEAAuC,CAAA;IACvC,mEAAyC,CAAA;IACzC,mFAAyD,CAAA;IAEzD,4BAA4B;IAC5B,2EAAiD,CAAA;IACjD,+EAAqD,CAAA;IACrD,6EAAmD,CAAA;IAEnD,qCAAqC;IACrC,6EAAmD,CAAA;IACnD,qGAA2E,CAAA;IAC3E,qGAA2E,CAAA;IAC3E,uEAA6C,CAAA;IAC7C,uFAA6D,CAAA;IAE7D,+BAA+B;IAC/B,uEAA6C,CAAA;IAC7C,+EAAqD,CAAA;IACrD,2EAAiD,CAAA;IAEjD,4BAA4B;IAC5B,iEAAuC,CAAA;IACvC,yEAA+C,CAAA;IAC/C,qEAA2C,CAAA;IAE3C,uCAAuC;IACvC,qEAA2C,CAAA;IAC3C,2FAAiE,CAAA;IAEjE,sCAAsC;IACtC,uEAA6C,CAAA;IAC7C,mEAAyC,CAAA;IACzC,iEAAuC,CAAA;IACvC,2FAAiE,CAAA;IACjE,mEAAyC,CAAA;IACzC,mEAAyC,CAAA;IACzC,mEAAyC,CAAA;IACzC,uEAA6C,CAAA;IAC7C,mEAAyC,CAAA;IAEzC,gDAAgD;IAChD,6EAAmD,CAAA;IAEnD;;;;;;;;;OASG;IACH,qFAA2D,CAAA;IAE3D,iCAAiC;IACjC;;;;;;;OAOG;IACH,+EAAqD,CAAA;IACrD,mFAAyD,CAAA;IACzD,iFAAuD,CAAA;IACvD;;;;;;OAMG;IACH,2EAAiD,CAAA;IACjD,+EAAqD,CAAA;IAErD,0CAA0C;IAC1C;;;;;;;;;;;;;;;;OAgBG;IACH,yEAA+C,CAAA;IAC/C;;;;;;;;;;OAUG;IACH,+EAAqD,CAAA;IACrD,yEAA+C,CAAA;IAC/C,6EAAmD,CAAA;IACnD,oGAAoG;IACpG,yEAA+C,CAAA;IAE/C,mEAAmE;IACnE,mGAAyE,CAAA;IAEzE,0BAA0B;IAC1B,yEAA+C,CAAA;IAE/C,sBAAsB;IACtB,uDAA6B,CAAA;IAE7B,4EAA4E;IAC5E,EAAE;IACF,iGAAiG;IACjG,gGAAgG;IAChG,kGAAkG;IAClG,0FAA0F;IAC1F,wDAAwD;IACxD,EAAE;IACF,8FAA8F;IAC9F,6FAA6F;IAC7F,4FAA4F;IAC5F,8FAA8F;IAC9F,mDAAmD;IACnD,EAAE;IACF,iGAAiG;IACjG,8FAA8F;IAC9F,8FAA8F;IAC9F,gCAAgC;IAChC,EAAE;IACF,wEAAwE;IACxE,uFAAuF;IACvF,uFAA6D,CAAA;IAE7D,kGAAkG;IAClG,EAAE;IACF,6FAA6F;IAC7F,kGAAkG;IAClG,iGAAiG;IACjG,4FAA4F;IAC5F,8EAA8E;IAC9E,EAAE;IACF,mCAAmC;IACnC,EAAE;IACF,qGAAqG;IACrG,mGAAmG;IACnG,kGAAkG;IAClG,EAAE;IACF,4CAA4C;IAC5C,EAAE;IACF,iGAAiG;IACjG,6FAA6F;IAC7F,+FAA+F;IAC/F,gGAAgG;IAChG,4FAA4F;IAC5F,gFAAgF;IAChF,EAAE;IACF,+FAA+F;IAC/F,sFAAsF;IACtF,8FAA8F;IAC9F,EAAE;IACF,8FAA8F;IAC9F,oFAAoF;IACpF,iFAAuD,CAAA;IACvD,mGAAyE,CAAA;IACzE,6FAAmE,CAAA;IACnE;;;;;;;;;;;;;;;;;;;OAmBG;IACH,6HAAmG,CAAA;IACnG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IACH,iFAAuD,CAAA;IAEvD,+CAA+C;IAC/C,0EAA0E;IAC1E,yEAAyE;IACzE,yEAAyE;IACzE,4DAA4D;IAC5D,gFAAgF;IAChF,wFAAwF;IACxF,mFAAmF;IACnF,wFAAwF;IACxF,uFAAuF;IACvF,oEAAoE;IACpE,qEAA2C,CAAA;IAC3C,2EAA2E;IAC3E,wEAAwE;IACxE,2EAA2E;IAC3E,6EAA6E;IAC7E,4EAA4E;IAC5E,+CAA+C;IAC/C,uEAA6C,CAAA;IAE7C,kHAAkH;IAClH,mGAAyE,CAAA;IAEzE,kDAAkD;IAClD,oGAAoG;IACpG,qGAAqG;IACrG,mGAAmG;IACnG,iEAAiE;IACjE,+FAA+F;IAC/F,uGAAuG;IACvG,uEAA6C,CAAA;IAE7C,gGAAgG;IAChG,wFAAwF;IACxF,4FAA4F;IAC5F,gGAAgG;IAChG,+FAA+F;IAC/F,2FAA2F;IAC3F,gGAAgG;IAChG,sDAAsD;IACtD,2FAA2F;IAC3F,uEAAuE;IACvE,EAAE;IACF,8FAA8F;IAC9F,6FAA6F;IAC7F,0FAA0F;IAC1F,uFAAuF;IACvF,kFAAkF;IAClF,EAAE;IACF,+FAA+F;IAC/F,4FAA4F;IAC5F,kGAAkG;IAClG,iGAAiG;IACjG,+FAA+F;IAC/F,uDAAuD;IACvD,EAAE;IACF,qGAAqG;IACrG,qGAAqG;IACrG,qGAAqG;IACrG,sGAAsG;IACtG,uCAAuC;IACvC,2GAAiF,CAAA;IAEjF,qEAA2C,CAAA;IAC3C,qFAAqF;IACrF,iGAAiG;IACjG,mGAAmG;IACnG,iGAAiG;IACjG,kGAAkG;IAClG,2EAA2E;IAC3E,2EAAiD,CAAA;IAEjD,qFAAqF;IACrF,2FAA2F;IAC3F,4FAA4F;IAC5F,yFAAyF;IACzF,4FAA4F;IAC5F,2FAA2F;IAC3F,yFAAyF;IACzF,qFAAqF;IACrF,4FAA4F;IAC5F,8FAA8F;IAC9F,8FAA8F;IAC9F,0FAA0F;IAC1F,8DAA8D;IAC9D,uFAA6D,CAAA;IAE7D,yFAAyF;IACzF,+FAA+F;IAC/F,8FAA8F;IAC9F,4FAA4F;IAC5F,mFAAmF;IACnF,4FAA4F;IAC5F,+FAA+F;IAC/F,yFAAyF;IACzF,4FAA4F;IAC5F,iFAAuD,CAAA;IAEvD,gGAAgG;IAChG,+FAA+F;IAC/F,2FAA2F;IAC3F,+FAA+F;IAC/F,+FAA+F;IAC/F,+FAA+F;IAC/F,+FAA+F;IAC/F,WAAW;IACX,iGAAuE,CAAA;IAEvE,iGAAiG;IACjG,kDAAkD;IAClD,EAAE;IACF,gGAAgG;IAChG,kGAAkG;IAClG,8FAA8F;IAC9F,gGAAgG;IAChG,gGAAgG;IAChG,+FAA+F;IAC/F,kGAAkG;IAClG,qDAAqD;IACrD,EAAE;IACF,mGAAmG;IACnG,iGAAiG;IACjG,+FAA+F;IAC/F,kGAAkG;IAClG,oBAAoB;IACpB,EAAE;IACF,2FAA2F;IAC3F,uFAAuF;IACvF,+FAA+F;IAC/F,EAAE;IACF,2FAA2F;IAC3F,qFAAqF;IACrF,6EAAmD,CAAA;IAEnD,8FAA8F;IAC9F,EAAE;IACF,oGAAoG;IACpG,gGAAgG;IAChG,mGAAmG;IACnG,oGAAoG;IACpG,qGAAqG;IACrG,8DAA8D;IAC9D,EAAE;IACF,wGAAwG;IACxG,gGAAgG;IAChG,EAAE;IACF,mGAAmG;IACnG,yDAAyD;IACzD,iFAAuD,CAAA;IAEvD,8DAA8D;IAC9D,EAAE;IACF,+FAA+F;IAC/F,2FAA2F;IAC3F,6FAA6F;IAC7F,mGAAmG;IACnG,iGAAiG;IACjG,iGAAiG;IACjG,gEAAgE;IAChE,EAAE;IACF,kGAAkG;IAClG,iFAAiF;IACjF,EAAE;IACF,gGAAgG;IAChG,mGAAmG;IACnG,+FAA+F;IAC/F,yDAAyD;IACzD,EAAE;IACF,kGAAkG;IAClG,mEAAmE;IACnE,yDAA+B,CAAA;IAE/B,kGAAkG;IAClG,EAAE;IACF,gGAAgG;IAChG,6FAA6F;IAC7F,8FAA8F;IAC9F,4FAA4F;IAC5F,kGAAkG;IAClG,EAAE;IACF,kGAAkG;IAClG,iGAAiG;IACjG,gGAAgG;IAChG,iGAAiG;IACjG,gBAAgB;IAChB,EAAE;IACF,yEAAyE;IACzE,iGAAiG;IACjG,+FAA+F;IAC/F,+FAA+F;IAC/F,kGAAkG;IAClG,+DAA+D;IAC/D,EAAE;IACF,6FAA6F;IAC7F,iGAAiG;IACjG,iGAAiG;IACjG,kGAAkG;IAClG,uEAAuE;IACvE,EAAE;IACF,+FAA+F;IAC/F,oFAAoF;IACpF,uFAA6D,CAAA;IAE7D,0EAA0E;IAC1E,8EAA8E;IAC9E,mFAAmF;IACnF,4EAA4E;IAC5E,kFAAkF;IAClF,2FAA2F;IAE3F;mGAC+F;IAC/F,uFAA6D,CAAA;IAC7D,yGAAyG;IACzG,yEAA+C,CAAA;IAC/C,0FAA0F;IAC1F,uEAA6C,CAAA;IAC7C,wGAAwG;IACxG,yFAA+D,CAAA;IAC/D;;;;;OAKG;IACH,6FAAmE,CAAA;IACnE;;;;;;;;OAQG;IACH,iFAAuD,CAAA;IACvD,wFAAwF;IACxF,yEAA+C,CAAA;IAC/C,0DAA0D;IAC1D,qEAA2C,CAAA;IAC3C;;wFAEoF;IACpF,iFAAuD,CAAA;IACvD;kFAC8E;IAC9E,mFAAyD,CAAA;IACzD;4DACwD;IACxD,6FAAmE,CAAA;IAEnE;8GAC0G;IAC1G,iGAAuE,CAAA;AACzE,CAAC,EA1zBW,sBAAsB,KAAtB,sBAAsB,QA0zBjC;AAED;;;;GAIG;AACH,MAAM,CAAN,IAAY,8BAiBX;AAjBD,WAAY,8BAA8B;IACxC,2FAA2F;IAC3F,mFAAiD,CAAA;IACjD,+FAA+F;IAC/F,mFAAiD,CAAA;IACjD,oDAAoD;IACpD,2DAAyB,CAAA;IACzB,gFAAgF;IAChF,qEAAmC,CAAA;IACnC,4EAA4E;IAC5E,iFAA+C,CAAA;IAC/C,mFAAmF;IACnF,uFAAqD,CAAA;IACrD,gGAAgG;IAChG,qEAAmC,CAAA;IACnC,uFAAuF;IACvF,qEAAmC,CAAA;AACrC,CAAC,EAjBW,8BAA8B,KAA9B,8BAA8B,QAiBzC;AAED,4FAA4F;AAC5F,MAAM,CAAN,IAAY,kBAMX;AAND,WAAY,kBAAkB;IAC5B,uDAAiC,CAAA;IACjC,qDAA+B,CAAA;IAC/B,uDAAiC,CAAA;IACjC,uDAAiC,CAAA;IACjC,iDAA2B,CAAA;AAC7B,CAAC,EANW,kBAAkB,KAAlB,kBAAkB,QAM7B;AAED,2FAA2F;AAC3F,MAAM,CAAN,IAAY,kBAIX;AAJD,WAAY,kBAAkB;IAC5B,mCAAa,CAAA;IACb,yCAAmB,CAAA;IACnB,2CAAqB,CAAA;AACvB,CAAC,EAJW,kBAAkB,KAAlB,kBAAkB,QAI7B;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAA8F;IACtI,CAAC,kBAAkB,CAAC,cAAc,CAAC,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,8DAA8D,EAAE;IACxI,CAAC,kBAAkB,CAAC,aAAa,CAAC,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,4DAA4D,EAAE;IACpI,CAAC,kBAAkB,CAAC,cAAc,CAAC,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,4DAA4D,EAAE;IACtI,CAAC,kBAAkB,CAAC,cAAc,CAAC,EAAE,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,qDAAqD,EAAE;IACxI,CAAC,kBAAkB,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,qEAAqE,EAAE;CAC1I,CAAC;AAEF,MAAM,CAAC,MAAM,6BAA6B,GAA8F;IACtI,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,iEAAiE,EAAE;IAC9H,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,yDAAyD,EAAE;IACrH,CAAC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,gEAAgE,EAAE;CAC/H,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CACrC,IAAY,EACZ,QAAuF;IAEvF,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,OAAO,KAAK,OAAO,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/G,OAAO,GAAG,IAAI,gBAAgB,MAAM,EAAE,CAAC;AACzC,CAAC;AAED;;;;;;;;GAQG;AACH;;;;;GAKG;AACH,MAAM,CAAN,IAAY,2BAUX;AAVD,WAAY,2BAA2B;IACrC,8FAA8F;IAC9F,oDAAqB,CAAA;IACrB;;;OAGG;IACH,4DAA6B,CAAA;IAC7B,oHAAoH;IACpH,kDAAmB,CAAA;AACrB,CAAC,EAVW,2BAA2B,KAA3B,2BAA2B,QAUtC;AAED,MAAM,CAAN,IAAY,6BAgCX;AAhCD,WAAY,6BAA6B;IACvC;;;;OAIG;IACH,8EAA6C,CAAA;IAC7C;;;;OAIG;IACH,gFAA+C,CAAA;IAC/C,+GAA+G;IAC/G,oFAAmD,CAAA;IACnD;;;;OAIG;IACH,kGAAiE,CAAA;IACjE;;;OAGG;IACH,gFAA+C,CAAA;IAC/C;;;;OAIG;IACH,0EAAyC,CAAA;AAC3C,CAAC,EAhCW,6BAA6B,KAA7B,6BAA6B,QAgCxC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,6BA2JX;AA3JD,WAAY,6BAA6B;IACvC;;;;;OAKG;IACH,sFAAqD,CAAA;IAErD;;;;;OAKG;IACH,4FAA2D,CAAA;IAE3D;;;;;;;;;;;;OAYG;IACH,wEAAuC,CAAA;IAEvC;;;OAGG;IACH,0EAAyC,CAAA;IAEzC;;;;OAIG;IACH,kEAAiC,CAAA;IAEjC;;;OAGG;IACH,kFAAiD,CAAA;IAEjD;;;OAGG;IACH,4EAA2C,CAAA;IAE3C;;;;;;;;;;;;;OAaG;IACH,kFAAiD,CAAA;IAEjD;;;;;;;;;;;;;;OAcG;IACH,0GAAyE,CAAA;IAEzE;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,gFAA+C,CAAA;IAE/C;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,gGAA+D,CAAA;IAE/D;;;;;;;;;;;OAWG;IACH,gGAA+D,CAAA;AACjE,CAAC,EA3JW,6BAA6B,KAA7B,6BAA6B,QA2JxC;AAED,qCAAqC;AACrC,MAAM,CAAN,IAAY,mBAOX;AAPD,WAAY,mBAAmB;IAC7B,0CAAmB,CAAA;IACnB,0CAAmB,CAAA;IACnB,0CAAmB,CAAA;IACnB,wDAAiC,CAAA;IACjC,4DAAqC,CAAA;IACrC,kEAA2C,CAAA;AAC7C,CAAC,EAPW,mBAAmB,KAAnB,mBAAmB,QAO9B;AAED,6CAA6C;AAC7C,MAAM,CAAN,IAAY,oBAIX;AAJD,WAAY,oBAAoB;IAC9B,2CAAmB,CAAA;IACnB,6CAAqB,CAAA;IACrB,2CAAmB,CAAA;AACrB,CAAC,EAJW,oBAAoB,KAApB,oBAAoB,QAI/B;AAED;;;;;GAKG;AACH,MAAM,CAAN,IAAY,sBAuDX;AAvDD,WAAY,sBAAsB;IAChC,+DAAqC,CAAA;IACrC,mEAAyC,CAAA;IACzC,0FAA0F;IAC1F,yDAA+B,CAAA;IAC/B,sFAAsF;IACtF,+DAAqC,CAAA;IACrC;;;;;;;OAOG;IACH,yEAA+C,CAAA;IAC/C;;;;;;;;OAQG;IACH,+FAAqE,CAAA;IACrE,kGAAkG;IAClG,+FAAqE,CAAA;IACrE,kEAAkE;IAClE,iGAAuE,CAAA;IACvE,sGAAsG;IACtG,qGAA2E,CAAA;IAC3E;;;;;;OAMG;IACH,2DAAiC,CAAA;IACjC,2DAAiC,CAAA;IACjC,2DAAiC,CAAA;IACjC;;;;;;;;;OASG;IACH,+CAAqB,CAAA;IACrB,+CAAqB,CAAA;IACrB,mDAAyB,CAAA;AAC3B,CAAC,EAvDW,sBAAsB,KAAtB,sBAAsB,QAuDjC;AAED,MAAM,kCAAkC,GAA6E;IACnH,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,sBAAsB,CAAC,QAAQ;IAC7D,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,sBAAsB,CAAC,QAAQ;IAC7D,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,sBAAsB,CAAC,UAAU;CAClE,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,oCAAoC,CAAC,SAA4C;IAC/F,OAAO,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,kCAAkC,CAAC,SAAS,CAAC,CAAC;AAC7F,CAAC;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC;IAC9C,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC;IAC9B,CAAC,CAAC,MAAM,EAAE;CACX,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/D,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,UAAU,CAAC;IACvD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,MAAM,CAAC;IAChE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,WAAW,CAAC;IACxD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,8CAA8C,GAAG,CAAC,CAAC,MAAM,CAAC;IACrE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,iBAAiB,CAAC;IAC9D,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;IAChB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAN,IAAY,oBAKX;AALD,WAAY,oBAAoB;IAC9B,6FAA6F;IAC7F,uEAA+C,CAAA;IAC/C,kGAAkG;IAClG,2EAAmD,CAAA;AACrD,CAAC,EALW,oBAAoB,KAApB,oBAAoB,QAK/B;AAED,MAAM,CAAC,MAAM,gDAAgD,GAAG,CAAC,CAAC,MAAM,CAAC;IACvE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,mBAAmB,CAAC;IAChE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;IAChB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,UAAU;IACvC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB;;;;OAIG;IACH,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;CAChD,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iDAAiD,GAAG,CAAC,CAAC,MAAM,CAAC;IACxE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,oBAAoB,CAAC;IACjE,2DAA2D;IAC3D,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,oFAAoF;IACpF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,uFAAuF;IACvF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,mEAAmE;IACnE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gDAAgD,GAAG,CAAC,CAAC,MAAM,CAAC;IACvE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,mBAAmB,CAAC;IAChE,+EAA+E;IAC/E,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,kHAAkH;IAClH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,6GAA6G;IAC7G,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,4CAA4C,GAAG,CAAC,CAAC,MAAM,CAAC;IACnE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,cAAc,CAAC;IAC3D,2DAA2D;IAC3D,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,2FAA2F;IAC3F,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,uFAAuF;IACvF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB;;;;OAIG;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B;;;OAGG;IACH,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrC,6GAA6G;IAC7G,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,6GAA6G;IAC7G,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,2FAA2F;IAC3F,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC/B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iDAAiD,GAAG,CAAC,CAAC,MAAM,CAAC;IACxE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,oBAAoB,CAAC;IACjE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,UAAU;IACvC,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE;CACvB,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,iDAAiD,GAAG,CAAC,CAAC,MAAM,CAAC;IACxE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,oBAAoB,CAAC;IACjE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,8EAA8E;IAC9E,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,uGAAuG;IACvG,eAAe,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACpC,iFAAiF;IACjF,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC9C,kGAAkG;IAClG,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CAC9C,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,MAAM,CAAC;IACjE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,YAAY,CAAC;IACzD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,0FAA0F;IAC1F,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,kDAAkD,GAAG,CAAC,CAAC,MAAM,CAAC;IACzE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,sBAAsB,CAAC;IACnE,qEAAqE;IACrE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAClC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC7B,gGAAgG;IAChG,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACnC,qGAAqG;IACrG,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,iEAAiE,GAAG,CAAC,CAAC,MAAM,CAAC;IACxF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,sCAAsC,CAAC;IACnF,mGAAmG;IACnG,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE;IACjC,sCAAsC;IACtC,6BAA6B,EAAE,CAAC,CAAC,MAAM,EAAE;IACzC,uGAAuG;IACvG,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACpC,iEAAiE;IACjE,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CACpC,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH;;;;;;;;;;GAUG;AACH,MAAM,CAAN,IAAY,uCAmBX;AAnBD,WAAY,uCAAuC;IACjD;;;;;;;OAOG;IACH,gGAAqD,CAAA;IACrD;;;;;;;OAOG;IACH,sEAA2B,CAAA;AAC7B,CAAC,EAnBW,uCAAuC,KAAvC,uCAAuC,QAmBlD;AAED,MAAM,CAAC,MAAM,6DAA6D,GAAG,CAAC,CAAC,MAAM,CAAC;IACpF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,iCAAiC,CAAC;IAC9E,6DAA6D;IAC7D,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B;;;;OAIG;IACH,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,uCAAuC,CAAC;IAC3D,gEAAgE;IAChE,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE;IACjC;;;;;OAKG;IACH,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAChD,2GAA2G;IAC3G,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1C,+EAA+E;IAC/E,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC;;;OAGG;IACH,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC;AAEH,yCAAyC;AACzC,MAAM,CAAC,MAAM,wDAAwD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,2BAA2B,CAAC;IACxE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC1B,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,uDAAuD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,0BAA0B,CAAC;IACvE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC1B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,wDAAwD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,2BAA2B,CAAC;IACxE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;CACvC,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,MAAM,4DAA4D,GAAG,CAAC,CAAC,MAAM,CAAC;IACnF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,gCAAgC,CAAC;IAC7E,wCAAwC;IACxC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,2CAA2C;IAC3C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,qEAAqE;IACrE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAClC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC7B,0HAA0H;IAC1H,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC9C,+FAA+F;IAC/F,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB;;;;;;;OAOG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,gEAAgE,GAAG,CAAC,CAAC,MAAM,CAAC;IACvF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,qCAAqC,CAAC;IAClF,wCAAwC;IACxC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,8GAA8G;IAC9G,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,2CAA2C;IAC3C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,qFAAqF;IACrF,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3C,2EAA2E;IAC3E,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,qFAAqF;IACrF,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,4FAA4F;IAC5F,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,MAAM,4DAA4D,GAAG,CAAC,CAAC,MAAM,CAAC;IACnF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,gCAAgC,CAAC;IAC7E,yCAAyC;IACzC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,iDAAiD;IACjD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,2CAA2C;IAC3C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,oFAAoF;IACpF,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3C,4GAA4G;IAC5G,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,8DAA8D,GAAG,CAAC,CAAC,MAAM,CAAC;IACrF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,kCAAkC,CAAC;IAC/E,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,CAAC,MAAM,wDAAwD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,2BAA2B,CAAC;IACxE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,2CAA2C;IAC3C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,qDAAqD;IACrD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB;;;OAGG;IACH,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrC;;;;;;;OAOG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,qGAAqG;IACrG,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB;;;;;;;;;;;;OAYG;IACH,sBAAsB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QACvC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE;QAC9B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;KACjB,CAAC,CAAC,CAAC,QAAQ,EAAE;IACd;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB;;;;OAIG;IACH,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAEH,4CAA4C;AAC5C,MAAM,CAAC,MAAM,kDAAkD,GAAG,CAAC,CAAC,MAAM,CAAC;IACzE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,oBAAoB,CAAC;IACjE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kDAAkD,GAAG,CAAC,CAAC,MAAM,CAAC;IACzE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,oBAAoB,CAAC;IACjE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,+BAkCX;AAlCD,WAAY,+BAA+B;IACzC;;;;OAIG;IACH,4EAAyC,CAAA;IACzC;;;;;;;;;OASG;IACH,0EAAuC,CAAA;IACvC;;;;;;;;;;;;;;OAcG;IACH,4EAAyC,CAAA;AAC3C,CAAC,EAlCW,+BAA+B,KAA/B,+BAA+B,QAkC1C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,MAAM,uDAAuD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,0BAA0B,CAAC;IACvE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,4DAA4D;IAC5D,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B;;;;OAIG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC;IAC9C;;;;;;;;;;;OAWG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kDAAkD,GAAG,CAAC,CAAC,MAAM,CAAC;IACzE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,oBAAoB,CAAC;IACjE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,4DAA4D,GAAG,CAAC,CAAC,MAAM,CAAC;IACnF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,+BAA+B,CAAC;IAC5E,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,0FAA0F;IAC1F,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,2FAA2F;IAC3F,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,yFAAyF;IACzF,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAEH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,mDAAmD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,qBAAqB,CAAC;IAClE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,gGAAgG;IAChG,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,6CAA6C;IAC7C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,0FAA0F;IAC1F,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,oDAAoD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,sBAAsB,CAAC;IACnE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,yFAAyF;IACzF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,mGAAmG;IACnG,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,iGAAiG;IACjG,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE;IAC5B;;;;;;;OAOG;IACH,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC9C,CAAC,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,oDAAoD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,sBAAsB,CAAC;IACnE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,yDAAyD;IACzD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,qFAAqF;IACrF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,6FAA6F;IAC7F,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAEH;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;AAErF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,MAAM,2DAA2D,GAAG,CAAC,CAAC,MAAM,CAAC;IAClF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,+BAA+B,CAAC;IAC5E,+FAA+F;IAC/F,wFAAwF;IACxF,4GAA4G;IAC5G,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACrC;;;;;OAKG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B;;;OAGG;IACH,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,mCAAmC,CAAC,CAAC,QAAQ,EAAE;IAC5E,uGAAuG;IACvG,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,mCAAmC,CAAC;IAChE;;;;OAIG;IACH,0BAA0B,EAAE,CAAC,CAAC,MAAM,CAAC;QACnC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC,QAAQ,EAAE;QACrD,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC;KAC1C,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,gEAAgE,GAAG,CAAC,CAAC,MAAM,CAAC;IACvF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,oCAAoC,CAAC;IACjF,kFAAkF;IAClF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,gFAAgF;IAChF,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC/B,oCAAoC;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,8FAA8F;IAC9F,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,sFAAsF;IACtF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,kCAAkC;IAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,yEAAyE;IACzE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B;;;;;OAKG;IACH,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9C,4FAA4F;IAC5F,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,+DAA+D,GAAG,CAAC,CAAC,MAAM,CAAC;IACtF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,kCAAkC,CAAC;IAC/E,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,6DAA6D,GAAG,CAAC,CAAC,MAAM,CAAC;IACpF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,gCAAgC,CAAC;IAC7E,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,yDAAyD,GAAG,CAAC,CAAC,MAAM,CAAC;IAChF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,4BAA4B,CAAC;IACzE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sDAAsD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,yBAAyB,CAAC;IACtE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH,wCAAwC;AAExC,MAAM,CAAC,MAAM,2CAA2C,GAAG,CAAC,CAAC,MAAM,CAAC;IAClE,SAAS,EAAE,iCAAiC,CAAC,QAAQ,EAAE;IACvD,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,cAAc,CAAC;IAC3D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;IAChB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC;IACzC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;IAC3C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC5B,IAAI,KAAK,CAAC,cAAc,KAAK,iBAAiB,CAAC,MAAM,EAAE,CAAC;QACtD,IACE,KAAK,CAAC,SAAS,KAAK,SAAS;eAC1B,KAAK,CAAC,cAAc,KAAK,SAAS;eAClC,KAAK,CAAC,aAAa,KAAK,SAAS,EACpC,CAAC;YACD,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,WAAW,CAAC;gBACnB,OAAO,EAAE,yDAAyD;aACnE,CAAC,CAAC;QACL,CAAC;QACD,OAAO;IACT,CAAC;IAED,MAAM,oBAAoB,GACxB,KAAK,CAAC,SAAS,KAAK,aAAa,CAAC,YAAY;WAC3C,KAAK,CAAC,cAAc,KAAK,SAAS;WAClC,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC;IACvC,MAAM,mBAAmB,GACvB,KAAK,CAAC,SAAS,KAAK,aAAa,CAAC,WAAW;WAC1C,KAAK,CAAC,aAAa,KAAK,SAAS;WACjC,KAAK,CAAC,cAAc,KAAK,SAAS,CAAC;IACxC,IAAI,CAAC,oBAAoB,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAClD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,WAAW,CAAC;YACnB,OAAO,EAAE,uEAAuE;SACjF,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iDAAiD,GAAG,CAAC,CAAC,MAAM,CAAC;IACxE,SAAS,EAAE,iCAAiC,CAAC,QAAQ,EAAE;IACvD,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,qBAAqB,CAAC;IAClE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;IAC3B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,QAAQ,EAAE;IACpD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;IAC3C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,wDAAwD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,4BAA4B,CAAC;IACzE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;IAChB,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3C,uBAAuB,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,QAAQ,EAAE;IAC7D,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC;IAChC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC5B,MAAM,oBAAoB,GACxB,KAAK,CAAC,SAAS,KAAK,aAAa,CAAC,YAAY;WAC3C,KAAK,CAAC,cAAc,KAAK,SAAS;WAClC,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC;IACvC,MAAM,mBAAmB,GACvB,KAAK,CAAC,SAAS,KAAK,aAAa,CAAC,WAAW;WAC1C,KAAK,CAAC,aAAa,KAAK,SAAS;WACjC,KAAK,CAAC,cAAc,KAAK,SAAS,CAAC;IACxC,IAAI,CAAC,oBAAoB,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAClD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,WAAW,CAAC;YACnB,OAAO,EAAE,0EAA0E;SACpF,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iDAAiD,GAAG,CAAC,CAAC,MAAM,CAAC;IACxE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,oBAAoB,CAAC;IACjE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH,sDAAsD;AAEtD,MAAM,CAAC,MAAM,kEAAkE,GAAG,CAAC,CAAC,MAAM,CAAC;IACzF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,sCAAsC,CAAC;IACnF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC;IACvC,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1C,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;CAClD,CAAC,CAAC;AAIH;;;GAGG;AACH,MAAM,sCAAsC,GAAG;IAC7C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC;IACxC,0GAA0G;IAC1G,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5C,8GAA8G;IAC9G,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACrC,CAAC;AAEX,MAAM,CAAC,MAAM,+DAA+D,GAAG,CAAC,CAAC,MAAM,CAAC;IACtF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,mCAAmC,CAAC;IAChF,GAAG,sCAAsC;CAC1C,CAAC,CAAC;AAEH,qFAAqF;AACrF,MAAM,CAAC,MAAM,6DAA6D,GAAG,CAAC,CAAC,MAAM,CAAC;IACpF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,iCAAiC,CAAC;IAC9E,GAAG,sCAAsC;CAC1C,CAAC,CAAC;AAEH,2GAA2G;AAC3G,MAAM,CAAC,MAAM,uEAAuE,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9F,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,4CAA4C,CAAC;IACzF,GAAG,sCAAsC;CAC1C,CAAC,CAAC;AAIH,sDAAsD;AACtD,EAAE;AACF,yCAAyC;AACzC,EAAE;AACF,+FAA+F;AAC/F,0FAA0F;AAC1F,gGAAgG;AAChG,kGAAkG;AAClG,yEAAyE;AACzE,EAAE;AACF,gEAAgE;AAChE,EAAE;AACF,kGAAkG;AAClG,iGAAiG;AACjG,6FAA6F;AAC7F,UAAU;AAEV;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gEAAgE,GAAG,CAAC,CAAC,MAAM,CAAC;IACvF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,oCAAoC,CAAC;IACjF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,kGAAkG;IAClG,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;CACzB,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oEAAoE,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3F,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,wCAAwC,CAAC;IACrF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,iFAAiF;IACjF,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,iEAAiE,GAAG,CAAC,CAAC,MAAM,CAAC;IACxF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,qCAAqC,CAAC;IAClF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,kCAAkC,CAAC;IACxD,0FAA0F;IAC1F,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC;;;;;OAKG;IACH,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7C,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oEAAoE,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3F,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,wCAAwC,CAAC;IACrF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC;IAChD;;;;;;;;;;;;OAYG;IACH,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC,QAAQ,EAAE;CAC3E,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,wDAAwD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,4BAA4B,CAAC;IACzE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;CACzB,CAAC,CAAC;AAEH;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,4DAA4D,GAAG,CAAC,CAAC,MAAM,CAAC;IACnF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,gCAAgC,CAAC;IAC7E,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC7C;;;;OAIG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC;;;;;;OAMG;IACH,0BAA0B,EAAE,CAAC,CAAC,OAAO,EAAE;CACxC,CAAC,CAAC;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,oEAAoE,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3F,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,wCAAwC,CAAC;IACrF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC7C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,0BAA0B,EAAE,CAAC,CAAC,OAAO,EAAE;IACvC;;;;OAIG;IACH,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC,QAAQ,EAAE;IACzE,qHAAqH;IACrH,+BAA+B,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACxD,CAAC,CAAC;AAEH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,4DAA4D,GAAG,CAAC,CAAC,MAAM,CAAC;IACnF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,gCAAgC,CAAC;IAC7E,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,iFAAiF;IACjF,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,yDAAyD,GAAG,CAAC,CAAC,MAAM,CAAC;IAChF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,6BAA6B,CAAC;IAC1E,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,kCAAkC,CAAC;IACxD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;CACzB,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,4DAA4D,GAAG,CAAC,CAAC,MAAM,CAAC;IACnF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,gCAAgC,CAAC;IAC7E,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC;IAChD;;;;;;;;;;;;OAYG;IACH,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC,QAAQ,EAAE;CAC3E,CAAC,CAAC;AAIH,0CAA0C;AAE1C;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,4DAA4D,GAAG,CAAC,CAAC,MAAM,CAAC;IACnF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,gCAAgC,CAAC;IAC7E,6FAA6F;IAC7F,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,iCAAiC;IACjC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,mFAAmF;IACnF,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC;IAC5C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC3C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC1C,+EAA+E;IAC/E,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;CACzB,CAAC,CAAC;AAIH,iDAAiD;AAEjD,MAAM,CAAC,MAAM,+CAA+C,GAAG,CAAC,CAAC,MAAM,CAAC;IACtE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,kBAAkB,CAAC;IAC/D,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,+CAA+C,GAAG,CAAC,CAAC,MAAM,CAAC;IACtE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,kBAAkB,CAAC;IAC/D,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,oDAAoD;AAEpD,MAAM,CAAC,MAAM,kDAAkD,GAAG,CAAC,CAAC,MAAM,CAAC;IACzE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,qBAAqB,CAAC;IAClE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IACtB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,8CAA8C,GAAG,CAAC,CAAC,MAAM,CAAC;IACrE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,iBAAiB,CAAC;IAC9D,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAClD,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,kDAAkD,GAAG,CAAC,CAAC,MAAM,CAAC;IACzE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,qBAAqB,CAAC;IAClE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAIH,yCAAyC;AAEzC,MAAM,CAAC,MAAM,yDAAyD,GAAG,CAAC,CAAC,MAAM,CAAC;IAChF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,6BAA6B,CAAC;IAC1E,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,sDAAsD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,0BAA0B,CAAC;IACvE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,8EAA8E;IAC9E,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE;IAC5B;;;;;;;;OAQG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,yDAAyD,GAAG,CAAC,CAAC,MAAM,CAAC;IAChF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,6BAA6B,CAAC;IAC1E,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,sDAAsD;AAEtD,MAAM,CAAC,MAAM,6CAA6C,GAAG,CAAC,CAAC,MAAM,CAAC;IACpE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,eAAe,CAAC;IAC5D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB;;;;;;;;OAQG;IACH,kBAAkB,EAAE,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC,QAAQ,EAAE;IACrE,uGAAuG;IACvG,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,gDAAgD,GAAG,CAAC,CAAC,MAAM,CAAC;IACvE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,mBAAmB,CAAC;IAChE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,0DAA0D,GAAG,CAAC,CAAC,MAAM,CAAC;IACjF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,8BAA8B,CAAC;IAC3E,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,wCAAwC;AAExC,MAAM,CAAC,MAAM,kDAAkD,GAAG,CAAC,CAAC,MAAM,CAAC;IACzE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,sBAAsB,CAAC;IACnE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,oDAAoD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,wBAAwB,CAAC;IACrE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,kDAAkD,GAAG,CAAC,CAAC,MAAM,CAAC;IACzE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,uBAAuB,CAAC;IACpE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,iDAAiD;AAEjD,MAAM,CAAC,MAAM,oDAAoD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,uBAAuB,CAAC;IACpE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,qDAAqD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,mCAAmC,CAAC;IAChF,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,qDAAqD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,mCAAmC,CAAC;IAChF,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,kDAAkD,GAAG,CAAC,CAAC,MAAM,CAAC;IACzE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,qBAAqB,CAAC;IAClE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,+GAA+G;IAC/G,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,sEAAsE;IACtE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,0EAA0E;IAC1E,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,gHAAgH;IAChH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;CACvB,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oDAAoD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,wBAAwB,CAAC;IACrE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,8GAA8G;IAC9G,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;CACvB,CAAC,CAAC;AAQH,MAAM,CAAC,MAAM,wDAAwD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,4BAA4B,CAAC;IACzE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,uEAAuE;IACvE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,qGAAqG;IACrG,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxC,iFAAiF;IACjF,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE;IAChC,8FAA8F;IAC9F,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE;IAC/B,2FAA2F;IAC3F,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,mGAAmG;IACnG,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,iDAAiD,GAAG,CAAC,CAAC,MAAM,CAAC;IACxE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,oBAAoB,CAAC;IACjE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,2CAA2C;AAE3C,MAAM,CAAC,MAAM,gDAAgD,GAAG,CAAC,CAAC,MAAM,CAAC;IACvE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,oBAAoB,CAAC;IACjE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,oDAAoD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,wBAAwB,CAAC;IACrE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,kDAAkD,GAAG,CAAC,CAAC,MAAM,CAAC;IACzE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,sBAAsB,CAAC;IACnE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,wCAAwC;AAExC,MAAM,CAAC,MAAM,6CAA6C,GAAG,CAAC,CAAC,MAAM,CAAC;IACpE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,iBAAiB,CAAC;IAC9D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,iDAAiD,GAAG,CAAC,CAAC,MAAM,CAAC;IACxE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,qBAAqB,CAAC;IAClE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,+CAA+C,GAAG,CAAC,CAAC,MAAM,CAAC;IACtE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,mBAAmB,CAAC;IAChE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,mDAAmD;AAEnD,MAAM,CAAC,MAAM,gDAAgD,GAAG,CAAC,CAAC,MAAM,CAAC;IACvE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,mBAAmB,CAAC;IAChE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,0DAA0D,GAAG,CAAC,CAAC,MAAM,CAAC;IACjF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,8BAA8B,CAAC;IAC3E,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,2DAA2D;AAE3D,MAAM,CAAC,MAAM,mDAAmD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,uBAAuB,CAAC;IACpE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC;IAChC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC5B,MAAM,oBAAoB,GACxB,KAAK,CAAC,SAAS,KAAK,aAAa,CAAC,YAAY;WAC3C,KAAK,CAAC,cAAc,KAAK,SAAS;WAClC,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC;IACvC,MAAM,mBAAmB,GACvB,KAAK,CAAC,SAAS,KAAK,aAAa,CAAC,WAAW;WAC1C,KAAK,CAAC,aAAa,KAAK,SAAS;WACjC,KAAK,CAAC,cAAc,KAAK,SAAS,CAAC;IACxC,IAAI,CAAC,oBAAoB,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAClD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,WAAW,CAAC;YACnB,OAAO,EAAE,0EAA0E;SACpF,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAIH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,sDAAsD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,2BAA2B,CAAC;IACxE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,2HAA2H;IAC3H,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,2FAA2F;IAC3F,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,gHAAgH;IAChH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC;AAGH,qCAAqC;AAErC;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,kDAAkD,GAAG,CAAC,CAAC,MAAM,CAAC;IACzE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,qBAAqB,CAAC;IAClE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;IAChB,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC;IAChC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC5B,MAAM,oBAAoB,GACxB,KAAK,CAAC,SAAS,KAAK,aAAa,CAAC,YAAY;WAC3C,KAAK,CAAC,cAAc,KAAK,SAAS;WAClC,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC;IACvC,MAAM,mBAAmB,GACvB,KAAK,CAAC,SAAS,KAAK,aAAa,CAAC,WAAW;WAC1C,KAAK,CAAC,aAAa,KAAK,SAAS;WACjC,KAAK,CAAC,cAAc,KAAK,SAAS,CAAC;IACxC,IAAI,CAAC,oBAAoB,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAClD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,WAAW,CAAC;YACnB,OAAO,EAAE,mEAAmE;SAC7E,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,MAAM,CAAC;IACjE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,YAAY,CAAC;IACzD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC/B,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE;IAC9B,2FAA2F;IAC3F,+FAA+F;IAC/F,4FAA4F;IAC5F,kGAAkG;IAClG,2BAA2B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClD,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AACH,MAAM,CAAC,MAAM,yDAAyD,GAAG,CAAC,CAAC,MAAM,CAAC;IAChF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,4BAA4B,CAAC;IAEzE,4FAA4F;IAC5F,wDAAwD;IACxD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,2FAA2F;IAC3F,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC/B,wFAAwF;IACxF,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC;IACjD;;;OAGG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,sGAAsG;IACtG,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,QAAQ,EAAE;IAC/D,4EAA4E;IAC5E,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEvC,gBAAgB;IAChB,oFAAoF;IACpF,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,8DAA8D;IAC9D,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1C;;;;;;;;;;;;;;OAcG;IACH,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAEnD,+FAA+F;IAC/F;;;;OAIG;IACH,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACnC,uFAAuF;IACvF,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC;IACrD,yFAAyF;IACzF,2BAA2B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClD,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE1C,yGAAyG;IACzG,kFAAkF;IAClF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IAExB,eAAe;IACf;;;;OAIG;IACH,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,gFAAgF;IAChF,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC7C;;;;OAIG;IACH,aAAa,EAAE,CAAC;SACb,MAAM,CACL,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,MAAM,CAAC;QACP,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAC9B,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KAC9B,CAAC,CACH;SACA,QAAQ,EAAE;CACd,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,2DAA2D,GAAG,CAAC,CAAC,MAAM,CAAC;IAClF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,+BAA+B,CAAC;IAE5E,yCAAyC;IACzC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,sCAAsC,CAAC;IAC1D,yEAAyE;IACzE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB;;;;;;;;;OASG;IACH,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,OAAO,CAAC,wBAAwB,CAAC,MAAM,CAAC;IACrF;;;;;;OAMG;IACH,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3C,+EAA+E;IAC/E,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,oGAAoG;IACpG,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,wDAAwD;IACxD,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC;IAClD,oFAAoF;IACpF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC9B,wFAAwF;IACxF,kBAAkB,EAAE,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC,QAAQ,EAAE;IAC5E,4FAA4F;IAC5F,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,+CAA+C;IAC/C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC;;;;OAIG;IACH,wBAAwB,EAAE,wCAAwC,CAAC,QAAQ,EAAE;CAC9E,CAAC,CAAC;AAEH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,yEAAyE,GAAG,CAAC,CAAC,MAAM,CAAC;IAChG,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,+CAA+C,CAAC;IAE5F,yCAAyC;IACzC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,2CAA2C,CAAC;IAC/D,oEAAoE;IACpE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,iIAAiI;IACjI,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,sEAAsE;IACtE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB;;;;;OAKG;IACH,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC;;;;;OAKG;IACH,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjD,sFAAsF;IACtF,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,wCAAwC;IACxC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,8DAA8D,GAAG,CAAC,CAAC,MAAM,CAAC;IACrF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,kCAAkC,CAAC;IAE/E,yFAAyF;IACzF,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE;IAChC,oDAAoD;IACpD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,kGAAkG;IAClG,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC/B,uDAAuD;IACvD,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC;IACjD,oGAAoG;IACpG,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,8EAA8E;IAC9E,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAEjD;;;;;;;;;;OAUG;IACH,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEzC;;;;;;OAMG;IACH,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,QAAQ,EAAE;IAElE;;;;;;OAMG;IACH,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE;IAC9B,wDAAwD;IACxD,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACnC,wFAAwF;IACxF,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC;IACrD;;;;OAIG;IACH,iBAAiB,EAAE,wCAAwC,CAAC,QAAQ,EAAE;CACvE,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sDAAsD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,yBAAyB,CAAC;IAEtE,wEAAwE;IACxE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,uDAAuD;IACvD,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC/B,mDAAmD;IACnD,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC;IACjD;;;;;;;OAOG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC;;;;;OAKG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC7C,oDAAoD;IACpD,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACnC,wFAAwF;IACxF,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC;IAErD;;;;;;;;;;;OAWG;IACH,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,oFAAoF;IACpF,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,QAAQ,EAAE;CACnE,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sDAAsD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,yBAAyB,CAAC;IAEtE,0EAA0E;IAC1E,6CAA6C;IAC7C,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC;IAEnD,yFAAyF;IACzF,gEAAgE;IAChE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,2FAA2F;IAC3F,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC/B,sDAAsD;IACtD,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC;IACjD;;;OAGG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,sGAAsG;IACtG,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,QAAQ,EAAE;IAC/D,4EAA4E;IAC5E,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEvC,kEAAkE;IAClE;;;;OAIG;IACH,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAEpD,wDAAwD;IACxD;;;;OAIG;IACH,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC7C;;;;;;;;;;;;OAYG;IACH,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC9C;;;;;;;;OAQG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC;;;OAGG;IACH,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACnC,uFAAuF;IACvF,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC;IACrD,iGAAiG;IACjG,2BAA2B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClD,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE1C,yGAAyG;IACzG,kFAAkF;IAClF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IAExB,uEAAuE;IACvE;;;;OAIG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B;;;;OAIG;IACH,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE;CACpC,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,iDAAiD,GAAG,CAAC,CAAC,MAAM,CAAC;IACxE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,oBAAoB,CAAC;IACjE,8GAA8G;IAC9G,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,6GAA6G;IAC7G,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,2DAA2D;IAC3D,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,qFAAqF;IACrF,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,gFAAgF;IAChF,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1C,iGAAiG;IACjG,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC/B,wGAAwG;IACxG,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrC,wFAAwF;IACxF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,kEAAkE,GAAG,CAAC,CAAC,MAAM,CAAC;IACzF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,sCAAsC,CAAC;IACnF;;;;OAIG;IACH,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B;;;;OAIG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,4FAA4F;IAC5F,WAAW,EAAE,iCAAiC;IAC9C;;;;;OAKG;IACH,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IAChC,+FAA+F;IAC/F,mEAAmE;IACnE,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC;IAC3C,MAAM,YAAY,GAAG,KAAK,CAAC,eAAe,KAAK,SAAS,CAAC;IACzD,IAAI,OAAO,KAAK,YAAY,EAAE,CAAC;QAC7B,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;YAChD,OAAO,EAAE,OAAO;gBACd,CAAC,CAAC,8GAA8G;gBAChH,CAAC,CAAC,oHAAoH;SACzH,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,gDAAgD,GAAG,CAAC,CAAC,MAAM,CAAC;IACvE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,mBAAmB,CAAC;IAChE,yFAAyF;IACzF,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,4CAA4C;IAC5C,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,wFAAwF;IACxF,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,mEAAmE;IACnE,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC1C,oDAAoD;IACpD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B;;;OAGG;IACH,uBAAuB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC5C;;;;OAIG;IACH,8BAA8B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACnD,oDAAoD;IACpD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,MAAM,mDAAmD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,sBAAsB,CAAC;IACnE,6BAA6B;IAC7B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,+DAA+D;IAC/D,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnD,iDAAiD;IACjD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,mGAAmG;IACnG,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,mGAAmG;IACnG,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACxC,yEAAyE;IACzE,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACrC,oDAAoD;IACpD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,oDAAoD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,uBAAuB,CAAC;IACpE,0EAA0E;IAC1E,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,qDAAqD;IACrD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,qDAAqD;IACrD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,iDAAiD;IACjD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,qGAAqG;IACrG,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxC;;;;;;;OAOG;IACH,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9C,wFAAwF;IACxF,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,oGAAoG;IACpG,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9C,qEAAqE;IACrE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACnC,4FAA4F;IAC5F,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC;;;OAGG;IACH,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC,QAAQ,EAAE;IAC1D,kHAAkH;IAClH,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC7C,sFAAsF;IACtF,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,qEAAqE;IACrE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,yEAAyE;IACzE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAEH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,sDAAsD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,yBAAyB,CAAC;IACtE,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC;IACnD,sCAAsC;IACtC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,0CAA0C;IAC1C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,uFAAuF;IACvF,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9C,+DAA+D;IAC/D,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,wCAAwC;IACxC,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9C;;;OAGG;IACH,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC7C;;;OAGG;IACH,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACzC,qGAAqG;IACrG,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,4EAA4E;IAC5E,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,4CAA4C;IAC5C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,MAAM,CAAC;IACjE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,aAAa,CAAC;IAC1D,mEAAmE;IACnE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,2DAA2D;IAC3D,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,8FAA8F;IAC9F,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,sHAAsH;IACtH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC;;;;;;OAMG;IACH,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3C,8DAA8D;IAC9D,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC;;;;OAIG;IACH,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5C,sFAAsF;IACtF,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,sEAAsE;IACtE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,oGAAoG;IACpG,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAGH;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,wDAAwD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,4BAA4B,CAAC;IACzE,0DAA0D;IAC1D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,iGAAiG;IACjG,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACpC,4CAA4C;IAC5C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,4FAA4F;IAC5F,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,0DAA0D;IAC1D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,4DAA4D;IAC5D,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,mGAAmG;IACnG,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C;;;OAGG;IACH,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACzC,4HAA4H;IAC5H,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,yCAAyC;IACzC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,uDAAuD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,4BAA4B,CAAC;IACzE,yDAAyD;IACzD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,6EAA6E;IAC7E,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,oFAAoF;IACpF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,iFAAiF;IACjF,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,6EAA6E;IAC7E,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,sFAAsF;IACtF,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,qEAAqE;IACrE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,kDAAkD;IAClD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,gEAAgE;IAChE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,4FAA4F;IAC5F,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;CACpD,CAAC,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,qDAAqD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,yBAAyB,CAAC;IACtE,yDAAyD;IACzD,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,yEAAyE;IACzE,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACpD,8EAA8E;IAC9E,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,sEAAsE;IACtE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,iFAAiF;IACjF,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,6EAA6E;IAC7E,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,uFAAuF;IACvF,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC/C,0DAA0D;IAC1D,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAEH;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,4DAA4D,GAAG,CAAC,CAAC,MAAM,CAAC;IACnF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,iCAAiC,CAAC;IAC9E,yDAAyD;IACzD,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,uEAAuE;IACvE,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACpD,qEAAqE;IACrE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,sEAAsE;IACtE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,iFAAiF;IACjF,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,6EAA6E;IAC7E,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC;;;;OAIG;IACH,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IAC5D,0DAA0D;IAC1D,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,6DAA6D,GAAG,CAAC,CAAC,MAAM,CAAC;IACpF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,kCAAkC,CAAC;IAC/E,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,uFAAuF;IACvF,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChD,qFAAqF;IACrF,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,mEAAmE;IACnE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,mFAAmF;IACnF,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,sFAAsF;AAEtF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,wDAAwD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,4BAA4B,CAAC;IACzE,4DAA4D;IAC5D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,+DAA+D;IAC/D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,qEAAqE;IACrE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,4GAA4G;IAC5G,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3B,qFAAqF;IACrF,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH,yGAAyG;AACzG,MAAM,CAAC,MAAM,kDAAkD,GAAG,CAAC,CAAC,MAAM,CAAC;IACzE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,qBAAqB,CAAC;IAClE,6BAA6B;IAC7B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,6CAA6C;IAC7C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,+BAA+B;IAC/B,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3B,oEAAoE;IACpE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,sGAAsG;IACtG,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;IACvB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH,qEAAqE;AACrE,MAAM,CAAC,MAAM,iDAAiD,GAAG,CAAC,CAAC,MAAM,CAAC;IACxE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,oBAAoB,CAAC;IACjE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,yDAAyD,GAAG,CAAC,CAAC,MAAM,CAAC;IAChF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,6BAA6B,CAAC;IAC1E,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,6FAA6F;IAC7F,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,gEAAgE;IAChE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3B,qGAAqG;IACrG,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;CACxB,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,qDAAqD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,yBAAyB,CAAC;IACtE,qGAAqG;IACrG,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,iFAAiF;IACjF,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,2DAA2D,GAAG,CAAC,CAAC,MAAM,CAAC;IAClF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,+BAA+B,CAAC;IAC5E,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,iGAAiG;IACjG,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,6FAA6F;IAC7F,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACjC;;;;OAIG;IACH,sBAAsB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,kDAAkD,GAAG,CAAC,CAAC,MAAM,CAAC;IACzE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,qBAAqB,CAAC;IAClE,8FAA8F;IAC9F,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,2GAA2G;IAC3G,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,0GAA0G;IAC1G,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,gDAAgD,GAAG,CAAC,CAAC,MAAM,CAAC;IACvE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,mBAAmB,CAAC;IAChE,0EAA0E;IAC1E,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,kEAAkE;IAClE,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE;IAChC,wEAAwE;IACxE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qDAAqD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,yBAAyB,CAAC;IACtE,4GAA4G;IAC5G,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,kGAAkG;IAClG,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,2FAA2F;IAC3F,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,+FAA+F;IAC/F,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE;IAC9B;;+BAE2B;IAC3B,6BAA6B,EAAE,CAAC,CAAC,OAAO,EAAE;IAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sDAAsD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,0BAA0B,CAAC;IACvE,sDAAsD;IACtD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC;IAC9C,2DAA2D;IAC3D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,iEAAiE;IACjE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,wEAAwE;IACxE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,2DAA2D,GAAG,CAAC,CAAC,MAAM,CAAC;IAClF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,+BAA+B,CAAC;IAC5E,qEAAqE;IACrE,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC/B,uEAAuE;IACvE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,0DAA0D;IAC1D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,qEAAqE;IACrE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,4DAA4D,GAAG,CAAC,CAAC,MAAM,CAAC;IACnF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,iCAAiC,CAAC;IAC9E,4DAA4D;IAC5D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,2FAA2F;IAC3F,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,2EAA2E;IAC3E,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,kGAAkG;IAClG,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE;IAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH,8DAA8D;AAC9D,0EAA0E;AAC1E,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;AAKvE,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAC/C;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IAC5C,oGAAoG;IACpG,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE;IAC9C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAqCG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE;IACtD;;;OAGG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE;IACrD;;;;;;;;OAQG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE;IACnE;;;;OAIG;IACH,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE;IAC3D;;;;;;;;;;;;;;;OAeG;IACH,kGAAkG;IAClG,kGAAkG;IAClG,gCAAgC;IAChC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE;SACnE,cAAc,CAAC,oBAAoB,CAAC,QAAQ,CAAC;IAChD,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC,cAAc,EAAE;IAC9D,iGAAiG;IACjG,mGAAmG;IACnG,iGAAiG;IACjG,EAAE;IACF,kGAAkG;IAClG,iGAAiG;IACjG,mGAAmG;IACnG,+FAA+F;IAC/F,+BAA+B;IAC/B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,cAAc,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,KAAK,CAAC;IACjF,SAAS,EAAE,yBAAyB,CAAC,cAAc,CAAC,oBAAoB,CAAC,KAAK,CAAC;IAC/E,kIAAkI;IAClI,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,cAAc,EAAE;IAC1D,kIAAkI;IAClI,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,cAAc,EAAE;IACrD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACtG,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAIH,kFAAkF;AAClF,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,kBAAkB,CAAC,WAAW,EAAE;IAC9E,wCAAwC;IACxC,yCAAyC;IACzC,8CAA8C;IAC9C,gDAAgD;IAChD,iDAAiD;IACjD,gDAAgD;IAChD,4CAA4C;IAC5C,iDAAiD;IACjD,kDAAkD;IAClD,iEAAiE;IACjE,6DAA6D;IAC7D,uDAAuD;IACvD,wDAAwD;IACxD,uDAAuD;IACvD,wDAAwD;IACxD,4DAA4D;IAC5D,8DAA8D;IAC9D,wDAAwD;IACxD,kDAAkD;IAClD,kDAAkD;IAClD,kDAAkD;IAClD,4DAA4D;IAC5D,mDAAmD;IACnD,oDAAoD;IACpD,gEAAgE;IAChE,oDAAoD;IACpD,+DAA+D;IAC/D,6DAA6D;IAC7D,yDAAyD;IACzD,sDAAsD;IACtD,gEAAgE;IAChE,4DAA4D;IAC5D,0CAA0C;IAC1C,2CAA2C;IAC3C,iDAAiD;IACjD,wDAAwD;IACxD,iDAAiD;IACjD,kEAAkE;IAClE,+DAA+D;IAC/D,6DAA6D;IAC7D,uEAAuE;IACvE,gEAAgE;IAChE,oEAAoE;IACpE,iEAAiE;IACjE,oEAAoE;IACpE,2DAA2D;IAC3D,4DAA4D;IAC5D,+CAA+C;IAC/C,+CAA+C;IAC/C,kDAAkD;IAClD,8CAA8C;IAC9C,kDAAkD;IAClD,yDAAyD;IACzD,yDAAyD;IACzD,sDAAsD;IACtD,6CAA6C;IAC7C,gDAAgD;IAChD,0DAA0D;IAC1D,kDAAkD;IAClD,oDAAoD;IACpD,kDAAkD;IAClD,oDAAoD;IACpD,qDAAqD;IACrD,qDAAqD;IACrD,iDAAiD;IACjD,wDAAwD;IACxD,gDAAgD;IAChD,oDAAoD;IACpD,kDAAkD;IAClD,6CAA6C;IAC7C,iDAAiD;IACjD,+CAA+C;IAC/C,gDAAgD;IAChD,0DAA0D;IAC1D,mDAAmD;IACnD,sDAAsD;IACtD,kDAAkD;IAClD,0CAA0C;IAC1C,yDAAyD;IACzD,sDAAsD;IACtD,8DAA8D;IAC9D,sDAAsD;IACtD,2DAA2D;IAC3D,yEAAyE;IACzE,iDAAiD;IACjD,kEAAkE;IAClE,gDAAgD;IAChD,mDAAmD;IACnD,iDAAiD;IACjD,uDAAuD;IACvD,oDAAoD;IACpD,sDAAsD;IACtD,qDAAqD;IACrD,4DAA4D;IAC5D,6DAA6D;IAC7D,wDAAwD;IACxD,kDAAkD;IAClD,iDAAiD;IACjD,yDAAyD;IACzD,kDAAkD;IAClD,gDAAgD;IAChD,qDAAqD;IACrD,sDAAsD;IACtD,2DAA2D;IAC3D,4DAA4D;CAC7D,CAAC,CAAC","sourcesContent":["import { AuditApplicationReadAccess } from './audit-trail-config.shared.schemas';\nimport { ExternalAssuranceAssessmentSchema } from '../../external-providers/provider-authentication-assurance.shared.schemas';\nimport { z } from \"zod\";\nimport { ExternalProvider_Connection_DelegationMode } from \"@wildo-ai/external-connectors-models\";\nimport { GovernedDocumentInteractionSchema } from \"../documents/governed-document-interactions.shared.schemas\";\nimport { PersonalDataCategory } from \"../privacy/personal-data-category.shared.schemas\";\nimport { RegistrationAcquisitionChannel } from \"../../config/entity-identity-config.shared.schemas\";\nimport { ResourceOperationRiskLevel, ResourceOperationVariantType } from \"../../resources/resources.shared.schemas\";\nimport { CoreResourceOperation } from \"../../resources/resources.shared.core.definitions\";\nimport {\n PlatformAccessGrantAutoApprovalReason,\n PlatformAccessGrantLifecycleTransition,\n PlatformAccessGrantScope,\n PlatformAccessGrantStatus,\n} from \"../../security/authorizations/platform-access-grants.shared.schemas\";\nimport { SystemOfRecordPartitionAssignmentTransition } from \"../../systems-of-record/system-of-record-partition-assignments.shared.schemas\";\nimport { ExecutionContext_ExecutionType, ExecutionContext_MachineCredentialSchema } from \"../../runtime/execution-context.shared.schemas\";\nimport {\n AuthScopeType,\n SsoConnectionType,\n} from \"../../security/authentications/authentication.shared.schemas\";\nimport { WebhookEndpointProbeOutcome } from \"../../notifications/m2m/webhook-config.shared.schemas\";\nimport {\n ProviderCredentialDeletionReason,\n ProviderOAuth2RevocationOutcomeValues,\n ProviderCredentialResolutionSource,\n} from \"../../security/connected-accounts/provider-credentials.shared.schemas\";\n\n\nexport enum CoreAuditableEventType {\n // Authentication Events\n USER_LOGIN = 'user_login',\n USER_LOGOUT = 'user_logout',\n USER_LOGIN_FAILED = 'user_login_failed',\n USER_ACCOUNT_LOCKED = 'user_account_locked',\n USER_PASSWORD_CHANGED = 'user_password_changed',\n // audit-event-unemitted: superseded by the per-METHOD events, which is what the MFA services\n // actually emit — `USER_MFA_SETUP_STARTED` / `USER_MFA_SETUP_COMPLETED` on enrolment and\n // `USER_TOTP_DISABLED` on removal. A coarse \"MFA enabled/disabled\" pair cannot say WHICH factor\n // changed, and a user with TOTP plus a passkey makes that distinction the whole question. Kept\n // rather than deleted because a future factor-agnostic rollup is a plausible SIEM convenience;\n // it must not be emitted ALONGSIDE the per-method events without deciding which is canonical.\n USER_MFA_ENABLED = 'user_mfa_enabled',\n // audit-event-unemitted: see USER_MFA_ENABLED — `USER_TOTP_DISABLED` is the emitted event.\n USER_MFA_DISABLED = 'user_mfa_disabled',\n // audit-event-unemitted: expiry is PASSIVE — a token simply ages out, so there is no moment for\n // anyone to observe. Emitting it would require polling every live session, and would produce one\n // row per session per lifetime: the highest-volume, lowest-signal stream in the trail. The\n // session endings that carry intent are already covered (`USER_LOGOUT`, and the token-revocation\n // events). Deliberately declared-and-unwired rather than deleted, because a future\n // idle-timeout/forced-expiry feature — where expiry IS an act someone triggers — is exactly what\n // it should name.\n USER_SESSION_EXPIRED = 'user_session_expired',\n\n /*\n A refresh chain was FORCIBLY RETIRED because the principal exceeded its concurrent-session cap.\n \n DISTINCT from {@link USER_SESSION_EXPIRED}, and the split is semantic rather than cosmetic. An\n * expiry is time elapsing; an eviction is a cap DISPLACING a live chain, and the two answer\n * different reviewer questions — \"was this user idle?\" versus \"is somebody's chain being pushed\n * out?\". The second is the one that matters: the cap exists to bound the blast radius of undetected\n * token theft, so a burst of evictions for one principal is exactly the signal a reviewer wants.\n \n Before this, the only trace was a debug log — a security-relevant token-lifecycle act with no\n * durable record, which is what `CLAUDE.md`'s assurance-by-construction rule asks for by name.\n \n assurance-control: WILDO.IDENTITY.SESSION_CONCURRENCY_LIMIT — the eviction enforcing the\n * concurrent-session bound leaves a record naming WHICH chain was retired and when it was issued,\n * so the first-in-first-out property is reviewable rather than merely implemented.\n /\n USER_SESSION_EVICTED = 'user_session_evicted',\n\n // Machine (non-human) Authentication Events — api-key / OAuth-client / exchanged client-credentials\n // token resolving to an ORGANIZATION_MACHINE / APPLICATION_MACHINE principal. The credential\n // provenance (authMethod + credentialId) + scope ride the typed eventData.\n MACHINE_AUTH_SUCCESS = 'machine_auth_success',\n MACHINE_AUTH_FAILED = 'machine_auth_failed',\n // Machine RESOURCE-ACCESS event — the token-USE twin of MACHINE_AUTH_SUCCESS (token-MINT). Emitted\n // per external request when a machine principal exercises an audience-bound resource-server surface\n // (A2A `message/send`, MCP `tools/call`, …). MACHINE_AUTH_SUCCESS fires once at `/oauth/token` and\n // is low-volume; MACHINE_ACCESS lets an org SIEM see WHAT a machine did, not just that it authed.\n MACHINE_ACCESS = 'machine_access',\n\n // User Lifecycle Events\n // audit-event-unemitted: this operation now leaves evidence as a generic\n // `RESOURCE_OPERATION_PERFORMED` row, which carries strictly MORE than this member could — the\n // operation identity triple, the actor's roles as they stood, the top-level `correlationId` that\n // groups a cascade, and before/after values for `.isAuditEvidence()` fields. Wiring this one too would\n // write two rows for one action. Kept rather than deleted: a purpose-built event is still the\n // right shape if this verb ever needs a payload the generic row cannot reconstruct (the standing\n // precedent is `USER_APP_ROLES_CHANGED`, which carries the `requestedRoles` set the role-ceiling\n // gate measured — something a before/after diff cannot recover).\n USER_CREATED = 'user_created',\n // audit-event-unemitted: covered by the generic `RESOURCE_OPERATION_PERFORMED` row — see USER_CREATED.\n USER_UPDATED = 'user_updated',\n USER_DELETED = 'user_deleted',\n\n // Application-Role Administration — the APPLICATION-scope twin of\n // ORGANIZATION_MEMBER_ROLE_CHANGED. `User.appRoles` IS the principal's live application authority\n // (it is read back into `initiatorRoles` on their very next request), so every change to it is an\n // access-control decision that must leave evidence. Emitted by the USERS role-administration write\n // paths (assign_roles / revoke_roles and the core CREATE/UPDATE that can rewrite the array), never\n // for an update that leaves `appRoles` untouched.\n // assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — evidence of privilege grant/revocation.\n USER_APP_ROLES_CHANGED = 'user_app_roles_changed',\n\n // The application booted with NO administratively usable super-administrator — a state the write\n // guards refuse to create, so its presence means it arrived some other way: a direct database\n // edit, a restore from a backup taken mid-erasure, a seed that authored no administrator, or a\n // role-table reconfiguration that changed which roles confer super-admin under an existing\n // population. Reported at startup, never fatal (a fresh application legitimately boots with no\n // users at all before its first administrator is seeded or registers).\n // assurance-control: WILDO.ACCESS.ADMINISTRATIVE_CONTINUITY — evidence that the application has no\n // accountable administrative principal, which is unrecoverable in-product once reached.\n APPLICATION_SUPER_ADMIN_FLOOR_BREACHED = 'application_super_admin_floor_breached',\n /\n A tenant was left with no administratively usable owner by an action that was ALLOWED to proceed.\n \n The organization-scope twin of {@link APPLICATION_SUPER_ADMIN_FLOOR_BREACHED}, and unlike it this\n * one HAS an actor: it is emitted when a user lifecycle transition (typically a suspension) removes\n * the last usable owner of a tenant. That write is deliberately not refused — suspension is usually\n * incident response, and blocking it would mean an operator cannot lock out a compromised owner\n * without first transferring ownership using the tenant the attacker controls.\n \n Because the action proceeds, this record is the ENTIRE control. It is not decoration.\n /\n ORGANIZATION_OWNER_FLOOR_BREACHED = 'organization_owner_floor_breached',\n\n // Organization Lifecycle Events\n // audit-event-unemitted: covered by the generic `RESOURCE_OPERATION_PERFORMED` row — see USER_CREATED.\n ORGANIZATION_CREATED = 'organization_created',\n // audit-event-unemitted: covered by the generic `RESOURCE_OPERATION_PERFORMED` row — see USER_CREATED.\n ORGANIZATION_UPDATED = 'organization_updated',\n /\n The engine assigned an organization its `type`, at boot, with no actor — see\n * {@link AuditableEvent_Organization_TypeAssignedEventDataSchema} for why this is not an `ORGANIZATION_UPDATED`.\n /\n ORGANIZATION_TYPE_ASSIGNED = 'organization_type_assigned',\n ORGANIZATION_DELETED = 'organization_deleted',\n /* The tenant was MARKED for deletion (soft-delete). Its access dies here; its data dies at the purge. /\n ORGANIZATION_DELETION_REQUESTED = 'organization_deletion_requested',\n /* A pending tenant deletion was cancelled inside the retention window. /\n ORGANIZATION_RESTORED = 'organization_restored',\n /* The tenant was administratively HALTED. Confers no authority while suspended. /\n ORGANIZATION_SUSPENDED = 'organization_suspended',\n /* A halted or expired tenant was returned to normal operation. /\n ORGANIZATION_ACTIVATED = 'organization_activated',\n /\n A governed lifecycle transition changed a subject's `status` — membership suspension and\n * reactivation, administrative user suspension, self-service account deactivation.\n \n ONE event type rather than five near-identical ones, because the five verbs it serves share an\n * identical data shape: a subject, a from→to status pair, an optional caller reason, and an\n * optional automatic-reactivation deadline. `resourceType` + `operationIdentifier` fully\n * discriminate which verb ran, so splitting would produce five schemas differing only in their\n * literal and force a reviewer asking \"show me every suspension\" to union five queries.\n \n Deliberately distinct from {@link ORGANIZATION_SUSPENDED} / {@link ORGANIZATION_ACTIVATED},\n * which are NOT collapsed into this: tenant transitions carry domain facts these do not\n * (`revokedUserTypeCount` / `regrantedUserTypeCount` — the platform-wide reach of halting a\n * tenant), so they are genuinely different events rather than the same event on another resource.\n /\n RESOURCE_STATUS_TRANSITION_PERFORMED = 'resource_status_transition_performed',\n\n // Organization Member Events\n // audit-event-unemitted: covered by the generic `RESOURCE_OPERATION_PERFORMED` row — see USER_CREATED.\n ORGANIZATION_MEMBER_INVITED = 'organization_member_invited',\n // audit-event-unemitted: covered by the generic `RESOURCE_OPERATION_PERFORMED` row — see USER_CREATED.\n ORGANIZATION_MEMBER_JOINED = 'organization_member_joined',\n // audit-event-unemitted: covered by the generic `RESOURCE_OPERATION_PERFORMED` row — see USER_CREATED.\n ORGANIZATION_MEMBER_UPDATED = 'organization_member_updated',\n ORGANIZATION_MEMBER_ROLE_CHANGED = 'organization_member_role_changed',\n // audit-event-unemitted: covered by the generic `RESOURCE_OPERATION_PERFORMED` row — see USER_CREATED.\n ORGANIZATION_MEMBER_STATUS_CHANGED = 'organization_member_status_changed',\n ORGANIZATION_MEMBER_REMOVED = 'organization_member_removed',\n\n // audit-event-unemitted: covered by the generic `RESOURCE_OPERATION_PERFORMED` row — see USER_CREATED.\n ORGANIZATION_NOTIFICATIONS_UPDATED = 'organization_notifications_updated',\n // audit-event-unemitted: covered by the generic `RESOURCE_OPERATION_PERFORMED` row — see USER_CREATED.\n ORGANIZATION_PREFERENCES_UPDATED = 'organization_preferences_updated',\n // audit-event-unemitted: covered by the generic `RESOURCE_OPERATION_PERFORMED` row — see USER_CREATED.\n ORGANIZATION_PROFILE_UPDATED = 'organization_profile_updated',\n // audit-event-unemitted: covered by the generic `RESOURCE_OPERATION_PERFORMED` row — see USER_CREATED.\n ORGANIZATION_UNIT_UPDATED = 'organization_unit_updated',\n\n // Per-unit role assignment — the NARROWED twin of ORGANIZATION_MEMBER_ROLE_CHANGED.\n // `OrganizationUnitMember.role` became live authority when `appendUnitScopedRoles` began emitting\n // it into `initiatorRoles` as a unit-narrowed entry, so assigning or re-assigning it is an\n // access-control decision on the same footing as the organization-wide array — it just confers\n // inside ONE unit rather than across the tenant. Distinct from ORGANIZATION_UNIT_UPDATED, which is\n // ORG_MANAGEMENT record-keeping about the unit itself and confers nothing.\n // assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — evidence of privilege grant/revocation.\n ORGANIZATION_UNIT_MEMBER_ROLE_CHANGED = 'organization_unit_member_role_changed',\n\n // Revocation of a per-unit role assignment — the closing half of\n // ORGANIZATION_UNIT_MEMBER_ROLE_CHANGED. Deleting an assignment row IS the revocation: the row\n // exists only to confer a role, so unlike ORGANIZATION_MEMBER_REMOVED (where losing authority is a\n // consequence of leaving the directory) there is no non-authorization reading of this event.\n // Without it the trail shows unit privileges being granted and never removed.\n // assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — evidence of privilege revocation.\n ORGANIZATION_UNIT_MEMBER_REMOVED = 'organization_unit_member_removed',\n\n // SSO Authentication Events\n USER_SSO_LOGIN = 'user_sso_login',\n USER_SSO_LOGIN_FAILED = 'user_sso_login_failed',\n\n /\n A tenant that mandates its identity provider refused a local sign-in or an acquisition.\n \n Emitted since #1214/#1242 by `_enforceEnterpriseSsoOnLocalFirstFactor` (every local first-factor\n * door), by the grace-login gate's three refusal clauses, and by the registration door's\n * `blockForSSODomains` block. `enforcementPolicy` carries WHICH clause refused, because \"the tenant\n * allows no fallback\" and \"this account has spent its grace logins\" have different remedies and a\n * bare `sso_required` cannot tell them apart.\n \n ONE refusal site remains unwired and is tracked on #1242: the SOCIAL-vs-enforcement refusal in\n * `oauth2-authentication.backend.service.ts`, whose sibling provider-restriction refusal ten lines\n * below it already emits `logOAuth2ProviderBlocked`.\n \n Deliberately NOT emitted by the fail-closed refusals that share the same error — a Redis read\n * that failed, the outer catch. Those are infrastructure outcomes, and recording them as an\n * enforcement decision would assert a policy judgement nobody made.\n /\n USER_SSO_ENFORCEMENT_BLOCKED = 'user_sso_enforcement_blocked',\n USER_TOKEN_REFRESHED = 'user_token_refreshed',\n\n // Organization Security Management Events\n // audit-event-unemitted: covered by the generic `RESOURCE_OPERATION_PERFORMED` row — see USER_CREATED.\n // Every SSO-config write is HIGH or CRITICAL (UPDATE, CREATE, and the three domain-ownership verbs),\n // and its authentication-authority blocks carry `.isAuditEvidence()`, so the row names what changed\n // and its before/after values. Its emit method had no caller and was removed (#591).\n ORGANIZATION_SSO_CONFIGURATION_CHANGED = 'organization_sso_configuration_changed',\n /* A change to where an organization's security events are exported: enabled, or a field other than the destination edited. INFO. /\n ORGANIZATION_SIEM_EXPORT_CONFIGURED = 'organization_siem_export_configured',\n /\n Security-event export was turned OFF (#986). Its own kind, at CRITICAL, because the envelope's rule\n * is that severity is a property of the event TYPE and danger rides the row's `riskLevel` — and\n * `riskLevel` never reaches the SIEM. As one INFO kind, \"export disabled\" was filtered out by any\n * organization that raised its severity minimum, on the one destination that most needed it.\n * Delivered to the destination that STOPPED, as its last event (`dispatchToRetiredSiemSink`).\n /\n ORGANIZATION_SIEM_EXPORT_DISABLED = 'organization_siem_export_disabled',\n /\n Security-event export was re-pointed at another destination (#986). WARNING: a destination move is\n * how an attacker who reached the tenant's administration diverts the trail. Delivered to BOTH the\n * old and the new destination.\n /\n ORGANIZATION_SIEM_EXPORT_DESTINATION_CHANGED = 'organization_siem_export_destination_changed',\n\n // Organization Provider Credential Events\n //\n // An organization's OWN credential toward a third party. The four verbs are separate members\n // rather than one event with a `changeType`, because they answer four different questions a\n // credential incident asks in a different order — when did this tenant grant us authority, when\n // did the value last change, when was it last SPENT, and when did the grant end — and a SIEM\n // rule that alerts on a spend cannot be written against a payload discriminator that also\n // matches configuration edits.\n //\n // NONE of the four payloads carries the credential value. That is a structural property of the\n // schemas below, not a redaction step somebody has to remember: there is no field to put it in.\n //\n // assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — an organization authorizes this\n // application to act as it toward a named third party.\n ORGANIZATION_PROVIDER_CREDENTIAL_SET = 'organization_provider_credential_set',\n ORGANIZATION_PROVIDER_CREDENTIAL_ROTATED = 'organization_provider_credential_rotated',\n ORGANIZATION_PROVIDER_CREDENTIAL_USED = 'organization_provider_credential_used',\n ORGANIZATION_PROVIDER_CREDENTIAL_DELETED = 'organization_provider_credential_deleted',\n\n // A PERSON's own credential toward a third party. Four members mirroring the organization's,\n // and deliberately NOT the same members with a nullable organization: the subject differs, the\n // SIEM routing differs (there is no tenant to route to), and the data-protection reading differs\n // — a person's connection to a vendor is that person's, and an event saying so must not be\n // indistinguishable from one about a tenant's shared integration.\n USER_PROVIDER_CREDENTIAL_SET = 'user_provider_credential_set',\n USER_PROVIDER_CREDENTIAL_ROTATED = 'user_provider_credential_rotated',\n USER_PROVIDER_CREDENTIAL_USED = 'user_provider_credential_used',\n USER_PROVIDER_CREDENTIAL_DELETED = 'user_provider_credential_deleted',\n\n // A delegated authorization GRANTED at a vendor, for each owner scope.\n //\n // Distinct from `_SET` rather than a flag on it, on the same three grounds the vocabulary already\n // uses to separate its members. The ACT differs: `_SET` is a value arriving in a row, and this is\n // a principal completing a consent ceremony at a third party — the only event in this family that\n // records somebody deciding something. The DATA differs: a grant carries the scopes that were\n // authorized and the vendor account they were authorized for, neither of which exists for a pasted\n // secret. And the EMISSION POINT differs, which is what makes a flag impractical as well as wrong:\n // `_SET` is emitted by the resource's write hook, which sees the row after the value is sealed,\n // while the scopes are known only to the store that received the grant, before sealing.\n //\n // The distinction is the one an auditor asks for first. \"Which of our people granted a third party\n // access, to what, and when\" is a different question from \"which credentials were configured\", and\n // a trail that answers them with the same event answers neither well.\n //\n // Neither payload carries a token, and as with the four above that is structural rather than a\n // redaction step: there is no field to put one in.\n //\n // assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — the act of authorizing is recorded\n // as itself, with what was authorized.\n ORGANIZATION_PROVIDER_CONNECTION_GRANTED = 'organization_provider_connection_granted',\n USER_PROVIDER_CONNECTION_GRANTED = 'user_provider_connection_granted',\n\n // Application Security Configuration Events\n // Also records the effective authored audit-viewer admission policy, with independently typed before/after evidence.\n // The per-user-type authentication policy (`userTypes.<type>.auth` — MFA, password, and lockout\n // requirements) is STATIC application configuration authored in code and taken into effect at\n // backend startup. A change to it — most consequentially a WEAKENING such as turning MFA off — is\n // a security-posture decision that otherwise leaves no product-side record (only source history).\n // Emitted at boot, by the system, when the resolved policy snapshot differs from the last one the\n // trail recorded for the application. Distinct from ORGANIZATION_SSO_CONFIGURATION_CHANGED, which\n // is a per-tenant runtime edit by a human admin; this is the application-wide authored baseline\n // and has no human actor at boot (the \"who\" lives in the deployment/source history).\n // assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — a change to the authentication assurance\n // requirements (MFA / password / lockout) must be attributable and evidenced.\n APPLICATION_AUTH_POLICY_CHANGED = 'application_auth_policy_changed',\n\n // Outbound M2M Webhook Events\n // An admin firing `webhookConfig.testEndpoint` makes the platform emit a signed HTTP\n // request to an operator-supplied URL. That is an outbound-traffic primitive reachable\n // from an authenticated admin surface, so every attempt — reachable or not — is recorded\n // with the actor, the scope, and the destination host.\n // assurance-control: WILDO.INTEGRATION.OUTBOUND_ACTIVITY_AUDIT — outbound connection initiated from an\n // administrative surface is attributable and monitorable.\n WEBHOOK_ENDPOINT_TEST_DISPATCHED = 'webhook_endpoint_test_dispatched',\n\n // SCIM Directory Provisioning Events\n // audit-event-unemitted: covered by the generic `RESOURCE_OPERATION_PERFORMED` row — see USER_CREATED.\n SCIM_TOKEN_CREATED = 'scim_token_created',\n // audit-event-unemitted: covered by the generic `RESOURCE_OPERATION_PERFORMED` row — see USER_CREATED.\n // `revoke_token` is a HIGH operation and `isActive` carries `.isAuditEvidence()`. Its emit method had no\n // caller and was removed (#591), so a requirement body must not demand this member.\n SCIM_TOKEN_REVOKED = 'scim_token_revoked',\n // audit-event-unemitted: covered by the generic row — `generate_token` is HIGH. See SCIM_TOKEN_REVOKED.\n SCIM_TOKEN_GENERATED = 'scim_token_generated',\n // audit-event-unemitted: covered by the generic row — `rotate_token` is HIGH. See SCIM_TOKEN_REVOKED.\n SCIM_TOKEN_ROTATED = 'scim_token_rotated',\n // audit-event-unemitted: covered by the generic `RESOURCE_OPERATION_PERFORMED` row — see USER_CREATED.\n // The provisioning-config UPDATE is HIGH and `autoCreateUsers`, `autoDeactivateUsers`, `defaultRole`,\n // `organizationUnitMapping` and `defaultUnitRole` carry `.isAuditEvidence()`. Emit method removed (#591).\n SCIM_PROVISIONING_CONFIG_UPDATED = 'scim_provisioning_config_updated',\n SCIM_PROVISIONING_FAILED = 'scim_provisioning_failed',\n SCIM_USER_PROVISIONED = 'scim_user_provisioned',\n SCIM_USER_UPDATED = 'scim_user_updated',\n SCIM_USER_DEACTIVATED = 'scim_user_deactivated',\n\n // Password Reset Events (H5)\n USER_PASSWORD_RESET_REQUESTED = 'user_password_reset_requested',\n USER_PASSWORD_RESET_COMPLETED = 'user_password_reset_completed',\n /\n An ADMINISTRATOR compelled a credential reset on another user's account.\n \n Deliberately distinct from `USER_PASSWORD_RESET_REQUESTED`, which records a SELF-SERVICE\n * request and carries no actor: reusing it for an admin action would attribute the reset to\n * the account owner, so the audit trail would name the wrong human for a privileged act. This\n * event names both the actor and the target, and records the operator's documented reason.\n /\n USER_PASSWORD_RESET_FORCED = 'user_password_reset_forced',\n\n // Registration & Verification Events (H5)\n USER_REGISTERED = 'user_registered',\n USER_EMAIL_VERIFIED = 'user_email_verified',\n USER_VERIFICATION_EMAIL_RESENT = 'user_verification_email_resent',\n\n // Method Management Events (#13f)\n USER_PASSWORD_SET = 'user_password_set',\n USER_TOTP_DISABLED = 'user_totp_disabled',\n USER_IDENTITY_LINK_REMOVED = 'user_identity_link_removed',\n\n // MFA Lifecycle Events (H5)\n USER_MFA_SETUP_STARTED = 'user_mfa_setup_started',\n USER_MFA_SETUP_COMPLETED = 'user_mfa_setup_completed',\n USER_MFA_EMAIL_OTP_SENT = 'user_mfa_email_otp_sent',\n\n // WebAuthn/Passkey Events (Phase G1)\n USER_PASSKEY_REGISTERED = 'user_passkey_registered',\n USER_PASSKEY_AUTHENTICATION_SUCCESS = 'user_passkey_authentication_success',\n USER_PASSKEY_AUTHENTICATION_FAILURE = 'user_passkey_authentication_failure',\n USER_PASSKEY_REMOVED = 'user_passkey_removed',\n USER_PASSKEY_CLONE_SUSPECTED = 'user_passkey_clone_suspected',\n\n // Magic Link Events (Phase G2)\n USER_MAGIC_LINK_SENT = 'user_magic_link_sent',\n USER_MAGIC_LINK_VERIFIED = 'user_magic_link_verified',\n USER_MAGIC_LINK_FAILED = 'user_magic_link_failed',\n\n // SMS OTP Events (Phase G2)\n USER_SMS_OTP_SENT = 'user_sms_otp_sent',\n USER_SMS_OTP_VERIFIED = 'user_sms_otp_verified',\n USER_SMS_OTP_FAILED = 'user_sms_otp_failed',\n\n // Phone Verification Events (Phase G2)\n USER_PHONE_VERIFIED = 'user_phone_verified',\n USER_PHONE_VERIFICATION_FAILED = 'user_phone_verification_failed',\n\n // SAML Authentication Events (AUTH-2)\n SAML_LOGIN_INITIATED = 'saml_login_initiated',\n SAML_LOGIN_SUCCESS = 'saml_login_success',\n SAML_LOGIN_FAILED = 'saml_login_failed',\n SAML_ASSERTION_REPLAY_DETECTED = 'saml_assertion_replay_detected',\n SAML_CERT_EXPIRING = 'saml_cert_expiring',\n SAML_SLO_INITIATED = 'saml_slo_initiated',\n SAML_SLO_COMPLETED = 'saml_slo_completed',\n SAML_METADATA_PARSED = 'saml_metadata_parsed',\n SAML_EMAIL_CHANGED = 'saml_email_changed',\n\n // OAuth2 Provider Restriction Events (Phase G3)\n OAUTH2_PROVIDER_BLOCKED = 'oauth2_provider_blocked',\n\n /\n An enterprise OIDC login was refused because the identity provider did not report the\n * authentication context the connection DEMANDED (issue #444).\n \n `acr_values` is a REQUEST parameter: the relying party asks, the provider decides, and the ID\n * token's `acr` claim reports what actually happened. So a refusal here is the only evidence that\n * a step-up demand was made and not met — without it an operator debugging \"why can this person\n * not sign in\" sees an ordinary authentication failure and has nothing to distinguish it from a\n * wrong password.\n /\n OIDC_ACR_DEMAND_UNSATISFIED = 'oidc_acr_demand_unsatisfied',\n\n // One-Off Session Events (W7.3b)\n /\n File upload grant lifecycle (issue #312) — the first FILE-domain audit events. A grant is a\n * single-use bearer credential that lets whoever holds it perform ONE upload into ONE resource file\n * field with the MINTER's authority; minting it is a delegated-authorization act and is audited as\n * one. `ISSUED` at mint (MEDIUM: a credential left the trust boundary), `REDEEMED` when the one\n * upload landed and the FILES row exists, `REVOKED` when the minter or an administrator cancelled\n * it. The event data carries the grant's ID — never its value.\n /\n FILE_UPLOAD_GRANT_ISSUED = 'file_upload_grant_issued',\n FILE_UPLOAD_GRANT_REDEEMED = 'file_upload_grant_redeemed',\n FILE_UPLOAD_GRANT_REVOKED = 'file_upload_grant_revoked',\n /\n File share links (#1567). A share is a bearer link that serves ONE file to whoever holds it, with no\n * session at all — the widest disclosure the file plane can make, so minting one is audited like a\n * grant. `ISSUED` carries the file, its owning record/field binding, the expiry and the use budget —\n * never the token value. `REVOKED` is \"stop sharing this file\" (`DELETE /files/:fileId/shares`) and\n * carries how many live links it ended; a revocation that ended none records nothing.\n /\n FILE_SHARE_LINK_ISSUED = 'file_share_link_issued',\n FILE_SHARE_LINKS_REVOKED = 'file_share_links_revoked',\n\n // File content-inspection outcomes (#506)\n /\n A scanner concluded that an uploaded file is INFECTED, and the file was quarantined.\n \n Until this existed, the scanner emitted no audit row of any kind: an infection produced a\n * `SCANNING → INFECTED → QUARANTINED` status transition on the file record and nothing else, so\n * the only way to learn that malware had reached the application's storage was to NOTICE a row\n * sitting at `QUARANTINED` — a poll, not a signal. Malware arriving is one of the few things an\n * operator wants to be alerted on, and one of the few a customer security questionnaire asks about\n * by name.\n \n `CRITICAL`, on the same argument as `USER_PASSKEY_CLONE_SUSPECTED`: a conclusion the security\n * mechanism reached about a real threat, not a routine outcome.\n \n assurance-control: WILDO.SECURITY.INGESTED_CONTENT_INSPECTION — a detected infection is\n * attributable and monitorable, not only visible as a row status. This event is the RECORD half of\n * that objective; the mechanism half is the fail-closed scan gate itself.\n /\n FILE_MALWARE_DETECTED = 'file_malware_detected',\n /\n A scan could NOT be completed — the scanner was unreachable, or the pipeline errored.\n \n Its own event rather than a lower severity on the one above, because the operational stories are\n * opposite: an infection means the control WORKED, a failure means it DID NOT RUN. From outside\n * they are indistinguishable today — the file is non-downloadable either way — which is precisely\n * why the trail has to tell them apart. A run of these means files are arriving unscanned.\n \n `WARNING`, not `CRITICAL`: nothing was found and nothing was exposed, because the file fails\n * closed to `FAILED` and stays undownloadable. What is wrong is the control's availability.\n /\n FILE_MALWARE_SCAN_FAILED = 'file_malware_scan_failed',\n ONE_OFF_TOKEN_CREATED = 'one_off_token_created',\n ONE_OFF_TOKEN_EXCHANGED = 'one_off_token_exchanged',\n /* revocation-B1: a super-admin cancelled an un-exchanged one-off (impersonation) session token. /\n ONE_OFF_TOKEN_REVOKED = 'one_off_token_revoked',\n\n // Cross-Frontend Handoff Events (cross-app-jwt-propagation Step 2)\n USER_CROSS_FRONTEND_HANDOFF_ISSUED = 'user_cross_frontend_handoff_issued',\n\n // Emergency Access Events\n EMERGENCY_ACCESS_USED = 'emergency_access_used',\n\n // Field Access Events\n FIELD_ACCESS = 'field_access',\n\n // Resource-Operation Events — the OPERATION-triggered twin of FIELD_ACCESS.\n //\n // FIELD_ACCESS answers \"a decorated field left the system\"; it is triggered by a RESPONSE FIELD,\n // so an operation whose response carries no decorated field is invisible to it. Repo-wide, that\n // trigger is declared on FOUR fields (three secret families, CREATE-only), which left every other\n // operation in an 83-resource catalogue emitting nothing at all — including role changes,\n // suspensions, credential deletion and tenant deletion.\n //\n // This event answers the different question: \"this OPERATION was performed, by whom, on what,\n // with what effect\". It is emitted for every HIGH / CRITICAL operation variant automatically\n // (`riskLevel` is already the framework's canonical danger axis — it drives MCP destructive\n // hints, frontend danger-zone placement and CRITICAL typed-confirmation), and for any variant\n // that opts in declaratively via `auditableEvent`.\n //\n // It is the FLOOR beneath the purpose-built events, never their replacement: a verb with its own\n // event (e.g. USER_APP_ROLES_CHANGED, which carries the `requestedRoles` set the role-ceiling\n // gate was measured against — something a generic before/after diff cannot reconstruct) emits\n // that one and suppresses this.\n //\n // assurance-control: WILDO.AUDIT.SECURITY_EVENT — privileged actions on\n // resources are attributable, and the authorization effect of each is reconstructable.\n RESOURCE_OPERATION_PERFORMED = 'resource_operation_performed',\n\n // The REFUSAL twin of RESOURCE_OPERATION_PERFORMED — the other half of \"record access decisions\".\n //\n // Emitted PRE-DISPATCH from the authorizer, not from the post-commit lane, because a refused\n // operation never reaches that lane. Without this event a refused HIGH/CRITICAL action — a denied\n // role change, a blocked suspension, a rejected credential rotation — leaves NO evidence at all,\n // so an auditor cannot distinguish \"nobody attempted it\" from \"someone attempted it and was\n // stopped\". Repeated denials are also the signature of an attack in progress.\n //\n // ## Not an authentication failure\n //\n // USER_LOGIN_FAILED / MACHINE_AUTH_FAILED answer \"you are not who you claim to be\" (AUTHENTICATION).\n // This answers \"you are who you claim to be, and you may not do this\" (AUTHORIZATION). The two are\n // deliberately distinct event types in distinct categories; neither is overloaded onto the other.\n //\n // ## No risk floor, unlike the success twin\n //\n // RESOURCE_OPERATION_PERFORMED fires only at HIGH/CRITICAL because a SUCCESSFUL low-risk read is\n // routine business (371 of the 551 API-reachable variants are reads). A DENIED read is never\n // routine — it is the canonical reconnaissance signal. A risk floor here would exclude 100% of\n // denied reads while not bounding attacker volume at all (the attacker picks the endpoint, so a\n // HIGH verb is exactly as cheap to hammer as a LOW one). Volume is bounded by per-principal\n // dedup instead — see `AuditableEvent_ResourceOperationDenied_EventDataSchema`.\n //\n // Severity is WARNING, matching its AUTHENTICATION twins rather than varying with `riskLevel`:\n // severity is a pure function of event type everywhere in this map (and is re-derived\n // independently by the SIEM dispatcher), so danger grading rides the row's `riskLevel` field.\n //\n // assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT — access-control decisions are\n // recorded, including the negative decisions, and repeated refusals are detectable.\n RESOURCE_OPERATION_DENIED = 'resource_operation_denied',\n CROSS_TENANT_ADMINISTRATIVE_ACCESS = 'cross_tenant_administrative_access',\n PLATFORM_ACCESS_GRANT_LIFECYCLE = 'platform_access_grant_lifecycle',\n /\n A remote partition of a system of record was assigned to, moved between, or removed from an\n * organization unit.\n \n ONE event for the whole life of the edge, with a {@link SystemOfRecordPartitionAssignmentTransition}\n * field — the `platformAccessGrants` shape rather than three event types. Three types would put the\n * same row's timeline in three buckets a reviewer has to reassemble, and the questions an auditor\n * actually asks (\"who has been able to see the German company, and since when?\") are answered by\n * reading one bucket in order.\n \n ## Why this exists beside the automatic row\n \n All three write verbs are HIGH, which is inside `AUTOMATIC_AUDIT_RISK_FLOOR`, so\n * `RESOURCE_OPERATION_PERFORMED` already fires for each. What that row cannot carry is the thing a\n * reviewer needs: which unit, and — on a move — which unit it was BEFORE. A generic operation row\n * says an assignment changed; this one says what it changed from and to.\n \n assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — the reach of each remote partition is recorded.\n * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — evidence of the full life of that reach.\n /\n SYSTEM_OF_RECORD_PARTITION_ASSIGNMENT_LIFECYCLE = 'system_of_record_partition_assignment_lifecycle',\n /\n An operator enumerated an APPLICATION-WIDE directory — a collection read that is deliberately\n * not confined to any one tenant.\n \n ## Why this is not {@link CROSS_TENANT_ADMINISTRATIVE_ACCESS}\n \n That event answers \"an operator reached a ROW belonging to a tenant they are not a member of\",\n * and it is emitted after comparing a FETCHED row's organization against the caller's role\n * entries. A directory read has no row and no target tenant — the whole point is that it spans\n * all of them — so there is nothing for that comparison to consume. Merging the two would put\n * two different questions behind one event type and make the existing one's `targetOrganizationId`\n * meaningless on half its rows. Closed vocabularies do not merge.\n \n ## Why it exists at all\n \n The reach is INTENDED and declared (`users \| list \| admin` is documented as \"admin-gated global\n * user listing\"), and it cannot be governed by the platform-access-grant mechanism: that admission\n * requires a usable grant for a TARGET tenant, and a collection call has none. So prevention is\n * structurally unavailable and EVIDENCE is the control that remains — which is exactly what\n * `.claude/rules/administrative-continuity-floors.md` asks for on a sanctioned reach: \"every\n * crossing is NAMED in the trail\". Before this event, an operator could enumerate every user's\n * email across every tenant and leave nothing behind.\n \n ⚠️ \"Structurally unavailable\" above is exact about the EXISTING grant mechanism — it needs a\n * target tenant and a collection call names none — and must not be read as \"prevention is\n * impossible\". An application-wide grant kind is buildable; what blocks it is the question of who\n * approves an elevation that names no tenant. See\n * `ScopeRootConfinementDisposition.UNCONFINED_APPLICATION_TIER_DIRECTORY`, which owns that\n * reasoning beside the declaration that makes this read unconfined.\n \n INFO, not WARNING: unlike its cross-tenant sibling this is an ordinary, expected administrative\n * read on a surface built for it. The subset worth escalating is selected by a SIEM rule on\n * `resourceType` + `returnedCount`, both of which ride the payload.\n \n assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT — an unconfined administrative read\n * of application-wide data is recorded with its actor, surface and size.\n /\n PLATFORM_DIRECTORY_ACCESS = 'platform_directory_access',\n\n // System-Context (ACL-bypassing) Access Events\n // Emitted whenever a server-internal `readAsSystem` / `listAsSystem` call\n // reads a resource with a synthesised super-admin context, bypassing the\n // caller's scope + role ACL. Classified by default as DATA_ACCESS / INFO\n // (an expected, authorized internal read — not an anomaly).\n // USERLESS BUT NOT UNATTRIBUTED (since 2026-07-31): there is no human to name —\n // the door synthesises its own super-admin context — but `eventData.performedByRuntime`\n // records WHICH RUNTIME exercised it (the application backend, a named minion, …).\n // Without that, a cross-tenant read by a background digital worker is indistinguishable\n // from a data seed or a lifecycle batch. Runtime attribution is deliberately a weaker,\n // honest claim than user attribution and must never be read as one.\n SYSTEM_CONTEXT_READ = 'system_context_read',\n // The MUTATION twin: emitted whenever a server-internal `createAsSystem` /\n // `updateAsSystem` / `updateManyAsSystem` call writes a resource with a\n // synthesised super-admin context, bypassing the caller's scope + role ACL\n // (e.g. registration persisting credentials). A MUTATION under an ACL bypass\n // is more sensitive than a read, so it is audited as its own distinct event\n // rather than folded into SYSTEM_CONTEXT_READ.\n SYSTEM_CONTEXT_WRITE = 'system_context_write',\n\n /* Platform owner publication of application/service configuration; safe field names, caller and outcome only. /\n PLATFORM_CONFIGURATION_PUBLICATION = 'platform_configuration_publication',\n\n // Retained-Data (Impersonalization) Access Events\n // Emitted when a privileged SEE-THROUGH read reveals RETAINED (impersonalized-and-retained) records\n // that the default retention hide-predicate keeps hidden. SYSTEM_CONTEXT_READ names only the RUNTIME\n // that acted; this read is HUMAN-ATTRIBUTED (an application super-administrator, the only role the\n // see-through gate admits today) and carries a REQUIRED reason —\n // a compliance-grade access record over scrubbed personal data. Strictly read-only. Classified\n // DATA_ACCESS / WARNING (an authorized-but-elevated privileged access, not an anomaly ⇒ not CRITICAL).\n RETAINED_DATA_ACCESS = 'retained_data_access',\n\n // A DATA SUBJECT EXPORT was assembled and handed out — everything the framework holds about one\n // person, gathered across their whole relationship graph (GDPR Art. 15 access / Art. 20\n // portability). Deliberately NOT folded into SYSTEM_CONTEXT_READ: that event names only the\n // RUNTIME that acted and carries no notion of a subject, a purpose, or what a bundle contained,\n // so it cannot answer the question a regulator actually asks — \"who exported whose data, when,\n // and what was in it?\". The four routed export operations this capability replaced emitted\n // NOTHING at all, which is the gap this closes. Classified DATA_ACCESS / WARNING: an authorized\n // but maximally-sensitive disclosure, not an anomaly.\n // A person MET a governed document — was shown a notice, acknowledged one, accepted terms,\n // gave or withdrew a consent — and WHICH RELEASE they met (issue #54).\n //\n // The identity is the point. `documentRef` + `releaseId` + `releaseVersion` names a file in a\n // commit, so a reviewer asking \"what exactly did this person accept\" reads the terms as they\n // stood rather than as they stand now. Nothing here is digest-sealed: the previous lane's\n // interaction RECEIPTS were removed with the rest of the sealed publication machine on\n // 2026-08-28, and `.claude/rules/one-source-of-truth.md` Rule 0 keeps none of it.\n //\n // Classified USER_LIFECYCLE / INFO, beside USER_REGISTERED, because it records a change in the\n // person's relationship with the OPERATOR rather than a read of data or an access decision.\n // INFO because recording an acceptance is routine expected activity whose whole value is that the\n // trail can be queried years later; an alarm on it would fire on every registration. What is NOT\n // routine rides the payload instead — `releaseApprovalState` says whether anybody had approved\n // the document at the moment a person was bound by it.\n //\n // assurance-control: WILDO.PRIVACY.CONSENT_RECORD — a person's decision about a governed document is\n // recorded against the exact release version in force at that instant, together with the notice they\n // were given before being asked (`acceptanceMode`) — or, when the surface declared none, an advisory\n // saying so. It does NOT claim the document was SHOWN: only `EXPLICIT_AFTER_READING` presents it, and\n // the other two modes link it (#1382).\n GOVERNED_DOCUMENT_INTERACTION_RECORDED = 'governed_document_interaction_recorded',\n\n SUBJECT_DATA_EXPORT = 'subject_data_export',\n // A resource LISTING was exported to a file (CSV/JSON) by an operator. Distinct from\n // SUBJECT_DATA_EXPORT, which answers a data subject's own right over their own data: this one is\n // an authorized operator taking rows they can already read and carrying them OUT of the system, so\n // the questions it must answer are \"which resource, how many rows, and was it the page they were\n // looking at or the whole table\". Classified DATA_ACCESS / INFO with a per-emit `riskLevel` — see\n // the eventData schema for why the severity is static and the risk is not.\n COLLECTION_DATA_EXPORT = 'collection_data_export',\n\n // Rows were read THROUGH an HTTP-API resource binding — data left an EXTERNAL system\n // (an enterprise's Odoo/SAP/…) via the engine's read-through repository (ETL plan, D8/R6).\n // Deliberately NOT folded into the neighbors: SYSTEM_CONTEXT_READ names a runtime acting on\n // WILDO-owned rows and knows nothing of a foreign system; COLLECTION_DATA_EXPORT is rows\n // CARRIED OUT of the system by an operator, while this is rows BROUGHT IN from a system the\n // platform does not own — the question a reviewer asks is \"who reached into which external\n // system, through which provider, for which entity, and how much came back\". Attribution\n // carries the REAL initiating user even under a SERVICE_PRINCIPAL binding (R12 — the\n // credential-sharing-as-a-service failure this vocabulary exists to prevent). One event per\n // read-family OPERATION execution (a paginated list and its count are ONE access), emitted at\n // the adapter — the only tier that witnesses EVERY remote access, including repository-direct\n // probes the services tier never sees. Classified DATA_ACCESS / INFO: routine, authorized\n // operation — the value is the queryable trail, not an alarm.\n HTTP_API_READ_THROUGH_ACCESS = 'http_api_read_through_access',\n\n // A subject erasure INVOKED the declared external-erasure operation of an HTTP_API-bound\n // resource (ETL D6 stance 6b) — rows linked to the erased subject were DELETED in a system the\n // platform does not own (OData canonical DELETE / Odoo `unlink` / a declared REST_JSON call).\n // The first OUTBOUND WRITE on the read-through plane, landing WITH its mechanism per the D8\n // narrowing. Distinct from HTTP_API_READ_THROUGH_ACCESS (rows brought IN) and from\n // SYSTEM_CONTEXT_WRITE (a trusted write to WILDO-owned rows): the reviewer question here is\n // \"which subject's rows were deleted in which external system, through which provider, and how\n // many\". Classified USER_LIFECYCLE / INFO: the sanctioned mechanics of a data-protection\n // request, not an anomaly — the erasure report is the receipt; this is the queryable trail.\n HTTP_API_EXTERNAL_ERASURE = 'http_api_external_erasure',\n\n // A subject erasure COMPLETED while rows linked to the subject remain LIVE in an HTTP_API-bound\n // external system, on the controller's explicit per-request acknowledgement (ETL D6 stance 6c,\n // `acknowledgeHttpApiNonErasure`). The record IS the control (the same doctrine as the two\n // administrative floors): no downstream check can second-guess a controller acting within GDPR\n // Art. 17(3) grounds, so what the framework owes is a loud, queryable record of the hole — the\n // subject, the resource, the provider, and how many rows remained (when countable). Classified\n // USER_LIFECYCLE / CRITICAL: one event per acknowledged resource per erasure, never a standing\n // posture.\n HTTP_API_NON_ERASURE_ACKNOWLEDGED = 'http_api_non_erasure_acknowledged',\n\n // The application CALLED a declared operation on a third-party provider — one event per outbound\n // call, on both the success and the failure path.\n //\n // Distinct from the three HTTP_API_ members above, which are the ETL read-through plane: those\n // record a RESOURCE whose rows live elsewhere being read or erased through a binding. This is the\n // other door — a custom backend service naming a provider and an operation directly — and the\n // question it answers is the first question of any provider incident: WHOSE third-party account\n // did we spend, on whose behalf, and what came back. `connectionOwnerScope`/`connectionOwnerId`\n // are what the initiator's own ids cannot answer, because one execution may legitimately spend\n // several tenants' accounts (a user action fanning out to every organization that user belongs to\n // issues N calls with N owners under ONE initiator).\n //\n // Distinct from `_PROVIDER_CREDENTIAL_USED`, which records that a stored credential was SPENT and\n // what the vendor thought of it. That one is about the CREDENTIAL's health and is emitted by the\n // store; this one is about the ACT and is emitted by the executor. A credential incident reads\n // both, in that order, and folding them would make \"which calls did this credential make\" a query\n // nobody can write.\n //\n // Classified DATA_ACCESS / INFO for the read-through member's reason — routine, authorized\n // activity whose value is the queryable trail, not an alarm. The READ/WRITE axis rides\n // `classification` in the payload and the per-emission `riskLevel`, never the static severity.\n //\n // assurance-control: WILDO.AUDIT.ATTRIBUTION — an outbound call made on a user's behalf is\n // recorded with the real initiating user carried through whichever account it spent.\n PROVIDER_OPERATION_CALL = 'provider_operation_call',\n\n // A signed-in person's BROWSER asked for a provider operation and the door REFUSED it (#367).\n //\n // A sibling of `PROVIDER_OPERATION_CALL`, not a failure case of it, because nothing was called: the\n // refusal happens before any catalogue lookup, credential read or outbound request, so the call\n // member's required `method`, `domain` and `classification` do not exist for it — an operation the\n // application never declared browser-reachable may not even be in the catalogue. What it records is\n // an ACCESS DECISION, which is the other half of \"record access decisions\" for this door, exactly as\n // `RESOURCE_OPERATION_DENIED` is for the resource authorizer.\n //\n // Classified AUTHORIZATION / WARNING for that sibling's reason: a refusal is not routine traffic, and a\n // run of them against one operation is a person probing what a browser can make the backend do.\n //\n // assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT — refusals at the browser door to a\n // third-party operation are attributable and reviewable.\n PROVIDER_OPERATION_DENIED = 'provider_operation_denied',\n\n // An AGENT reached an MCP server on somebody's behalf (#491).\n //\n // A sibling of `PROVIDER_OPERATION_CALL`, not a case of it, and the split is the same one that\n // separates that member from `_PROVIDER_CREDENTIAL_USED`: they identify different acts. A\n // provider operation is a CATALOGUE operation — it has an `operationId`, a `domain`, an HTTP\n // method and a declared READ/WRITE classification. An MCP tool has none of those: the tool list is\n // discovered from the server at turn start, the transport is always a JSON-RPC POST, and nothing\n // declares in advance what a tool does. Folding them would make \"which catalogue operations ran\"\n // a query that returns tools that are not catalogue operations.\n //\n // The ATTRIBUTION fields are deliberately identical, so a reviewer asking \"what did this person's\n // delegated credential do at that vendor\" writes one shape of query across both.\n //\n // Classified DATA_ACCESS / INFO for the same reason as its sibling: routine authorized activity\n // whose value is the queryable trail rather than an alarm. A refused outbound TARGET is carried on\n // the same event through `failureKind`, because an attempted egress a guard blocked is exactly\n // what a reviewer wants beside the calls that succeeded.\n //\n // assurance-control: WILDO.AUDIT.ATTRIBUTION — an agent's outbound tool call is recorded with the\n // real initiating user carried through whichever account it spent.\n MCP_TOOL_CALL = 'mcp_tool_call',\n\n // A human APPROVER changed a proposed tool call's arguments and approved the changed call (#566).\n //\n // The strongest act available on the approval plane, and the reason it is its own member rather\n // than a flag on some broader \"approval decided\" event: on every other decision the approver\n // ASSENTS to a call the model authored, and here they AUTHOR one the model never proposed. An\n // incident reader asking \"who wrote the arguments this tool ran with\" is asking a different\n // question from \"who let it run\", and folding the two would make the first unanswerable by query.\n //\n // Emitted ONLY when the executed input differs from the proposed one. An ordinary approval is not\n // this event and is deliberately not recorded here — the plane has no approval-decision trail at\n // all yet, which is a separate gap with its own issue; adding half of one under this name would\n // make `mcp_tool_call`'s mistake in the other direction, an event that answers two questions and\n // neither well.\n //\n // NAMES AND DIGESTS ONLY — never argument values. Identical reasoning to\n // `RESOURCE_OPERATION_PERFORMED`'s `changedFields` / `fieldEvidence` split: audit rows replicate\n // to the per-org SIEM and to an immutable ledger that cannot be scrubbed, so copying arbitrary\n // tool arguments here would manufacture an unerasable duplicate of whatever a person typed, in\n // direct conflict with GDPR Art. 17. The two digests prove executed ≠ proposed; the key names say\n // WHICH arguments a person authored. Neither can leak content.\n //\n // Classified AUTHORIZATION / WARNING. Authorization because the act IS a human authorization\n // decision, not a data access. WARNING rather than CRITICAL for the same reading the OAuth grant\n // rows take: it is notable, dashboard-worthy and worth reviewing, and it is an AUTHORIZED action\n // taken by an identified person with the pause in front of them — reserving CRITICAL for the rows\n // that mean something is wrong is what keeps a severity filter usable.\n //\n // assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT — the approver who authored the\n // executed arguments is recorded beside proof that they differed from the proposal.\n AGENT_TOOL_APPROVAL_MODIFIED = 'agent_tool_approval_modified',\n\n // ── OAuth2 / OIDC Provider Events (Wildo AS the authorization server) ──\n // Distinct from the `OAUTH2_` family above, which records Wildo CONSUMING an\n // EXTERNAL social OAuth provider. These record the app-issued OAuth2/OIDC provider\n // surface (`/oauth/authorize`, `/oauth/token`, `/oauth/authorize/decision`,\n // `/oauth/revoke`) — a third party gaining, or being refused, user-acting access.\n // Each maps to a Wildo assurance objective at the emit site (`assurance-control:` marker).\n\n /* A user-delegated `authorization_code` access token was minted for a third-party client\n * (the client may now act AS the user at the bound A2A/MCP resource) — the flagship grant. /\n OAUTH_DELEGATED_TOKEN_ISSUED = 'oauth_delegated_token_issued',\n /* A user APPROVED an interactive consent request — the client is authorized for this authorize flow. /\n OAUTH_CONSENT_GRANTED = 'oauth_consent_granted',\n /* A user DENIED an interactive consent request — access refused (protective, benign). /\n OAUTH_CONSENT_DENIED = 'oauth_consent_denied',\n /* A durable \"remember this app\" consent grant was created/updated — persistent delegated authority. /\n OAUTH_CONSENT_GRANT_PERSISTED = 'oauth_consent_grant_persisted',\n /\n An ANONYMOUS caller created an OAuth client identity through RFC 7591 dynamic registration.\n * The only write in this application reachable without any credential, so every occurrence is\n * evidence: the row it creates is durable, and the population of these rows is what an operator\n * needs to be able to review and revoke.\n /\n OAUTH_DYNAMIC_CLIENT_REGISTERED = 'oauth_dynamic_client_registered',\n /\n A URL-formatted `client_id` (CIMD) was REFUSED at the authorize endpoint.\n \n Auditable because the refusal reasons are not all equal: `HOST_NOT_ALLOWED` is a\n * misconfiguration, while `SSRF_TARGET_REFUSED` is an unauthenticated stranger trying to make\n * this server fetch an address only it can reach. Both arrive at the same endpoint from the same\n * kind of caller, so only the reason distinguishes them — and a spike in either is a thing an\n * operator must be able to alert on.\n /\n OAUTH_CIMD_CLIENT_REFUSED = 'oauth_cimd_client_refused',\n /* A user token was rotated via the provider `refresh_token` grant (`/oauth/token`). /\n OAUTH_TOKEN_REFRESHED = 'oauth_token_refreshed',\n /* A token was revoked via `/oauth/revoke` (RFC 7009). /\n OAUTH_TOKEN_REVOKED = 'oauth_token_revoked',\n /* An OIDC RP-Initiated Logout terminated the End-User's OP session at `/oauth/end-session`\n * (revocation-C). Distinct from `USER_LOGOUT` (first-party self-logout) and `OAUTH_TOKEN_REVOKED`\n * (RFC 7009 token revocation): this ends a SESSION on a relying party's behalf. /\n OAUTH_RP_INITIATED_LOGOUT = 'oauth_rp_initiated_logout',\n /* An `authorization_code` exchange was REJECTED (replay / PKCE failure / redirect mismatch / …) —\n * a potential attack signal. The specific cause rides `eventData.reason`. /\n OAUTH_CODE_EXCHANGE_FAILED = 'oauth_code_exchange_failed',\n /* A consent DECISION was attempted by a user who is NOT the consent request's bound user (403) —\n * a textbook cross-user authorization-abuse signal. /\n OAUTH_CONSENT_BINDING_VIOLATION = 'oauth_consent_binding_violation',\n\n /* Refresh-token REUSE detected → the whole token family was revoked (possible theft). Emitted by the\n * refresh CALLERS (the token issuer stays audit-free by design — it surfaces a reuse signal instead). /\n USER_REFRESH_TOKEN_REUSE_DETECTED = 'user_refresh_token_reuse_detected',\n}\n\n/\n Closed vocabulary of `OAUTH_CODE_EXCHANGE_FAILED` failure causes (RFC 6749 / OAuth 2.1 / RFC 7636).\n * A dedicated enum (not an inline literal union) so the emit sites, the schema, and any SIEM\n * consumer share one runtime source — the project's closed-vocabulary rule.\n /\nexport enum OAuthCodeExchangeFailureReason {\n /* The single-use code did not atomically consume — replayed, expired, or never issued. /\n CODE_REPLAY_OR_INVALID = 'code_replay_or_invalid',\n /* The consumed token was of a different consumable-token type (not an authorization code). /\n NOT_AUTHORIZATION_CODE = 'not_authorization_code',\n /* The decoded code carried no subject (userId). /\n NO_SUBJECT = 'no_subject',\n /* The redeeming `client_id` differs from the client the code was issued to. /\n CLIENT_MISMATCH = 'client_mismatch',\n /* The redeeming `redirect_uri` differs from the one bound at authorize. /\n REDIRECT_URI_MISMATCH = 'redirect_uri_mismatch',\n /* The PKCE `code_verifier` failed the bound S256 challenge (or was malformed). /\n PKCE_VERIFICATION_FAILED = 'pkce_verification_failed',\n /* The client was deactivated between authorize and redemption (redemption-window re-check). /\n CLIENT_INACTIVE = 'client_inactive',\n /* The client lost the `authorization_code` grant between authorize and redemption. /\n GRANT_TYPE_LOST = 'grant_type_lost',\n}\n\n/* Canonical event categories — used by auditable-events, security-envelope, audit-logs. /\nexport enum AuditEventCategory {\n AUTHENTICATION = 'authentication',\n AUTHORIZATION = 'authorization',\n USER_LIFECYCLE = 'user_lifecycle',\n ORG_MANAGEMENT = 'org_management',\n DATA_ACCESS = 'data_access',\n}\n\n/* Canonical severity levels — used by auditable-events, security-envelope, audit-logs. /\nexport enum AuditEventSeverity {\n INFO = 'info',\n WARNING = 'warning',\n CRITICAL = 'critical',\n}\n\n/\n What each audit category and severity MEANS to whoever reads the trail.\n \n The words were authored, correctly, in the technical-documentation catalog that renders the\n * audit-trail page — and lived only there, so the same vocabularies reached every other surface as\n * bare tokens. Moved here, beside the enums, because a vocabulary's words belong with the\n * vocabulary: the catalog now imports them, the schemas describe their own fields from them, and\n * there is one account of what `data_access` selects rather than two that can disagree.\n \n `name` is what a reader is shown; `meaning` is what selecting it actually gets them. Exhaustive by\n * type, so a sixth category cannot ship as a bare value.\n /\nexport const AUDIT_EVENT_CATEGORY_MEANINGS: Readonly<Record<AuditEventCategory, { readonly name: string; readonly meaning: string }>> = {\n [AuditEventCategory.AUTHENTICATION]: { name: 'Authentication', meaning: 'Signing in, signing out, second factors and failed attempts.' },\n [AuditEventCategory.AUTHORIZATION]: { name: 'Authorization', meaning: 'Access decisions: what an identity was allowed or refused.' },\n [AuditEventCategory.USER_LIFECYCLE]: { name: 'User lifecycle', meaning: 'Accounts created, changed, suspended, restored or removed.' },\n [AuditEventCategory.ORG_MANAGEMENT]: { name: 'Organization management', meaning: 'Membership, roles, units and organization settings.' },\n [AuditEventCategory.DATA_ACCESS]: { name: 'Data access', meaning: 'Reads and changes of application data that are recorded for review.' },\n};\n\nexport const AUDIT_EVENT_SEVERITY_MEANINGS: Readonly<Record<AuditEventSeverity, { readonly name: string; readonly meaning: string }>> = {\n [AuditEventSeverity.INFO]: { name: 'Information', meaning: 'Expected activity. Useful as evidence, not a signal on its own.' },\n [AuditEventSeverity.WARNING]: { name: 'Warning', meaning: 'Unusual or refused activity worth reviewing in context.' },\n [AuditEventSeverity.CRITICAL]: { name: 'Critical', meaning: 'Activity that should reach whoever handles security incidents.' },\n};\n\n/\n A `Values:` legend in the shape the generated API reference already uses, so a field described\n * here reads exactly like one described from a resource specification.\n /\nexport function describeAuditVocabulary(\n lead: string,\n meanings: Readonly<Record<string, { readonly name: string; readonly meaning: string }>>,\n): string {\n const legend = Object.entries(meanings).map(([value, words]) => `- \\`${value}\\`: ${words.meaning}`).join('\\n');\n return `${lead}\\n\\nValues:\\n${legend}`;\n}\n\n/\n Why the browser door to a provider operation refused a request (#367). A CLOSED vocabulary: the door\n * resolves exactly one of these per refusal, in the order listed, and a reviewer groups by it.\n \n Deliberately NOT a reuse of {@link ResourceOperationDenialReason}. The two doors ask different\n * questions of different declarations — that one checks an operation variant's roles and a row's scope,\n * this one checks an application's browser-reachability policy and whose third-party account is named —\n * and sharing members would make \"insufficient roles\" mean two things in one column.\n /\n/\n What a provider operation's `requiredScopes` check concluded for one call (#979).\n \n Carried on {@link AuditableEvent_ProviderOperationCall_EventDataSchema} only when the operation declares required\n * scopes; an operation declaring none carries no scope field at all, rather than a verdict about nothing.\n /\nexport enum ProviderOperationScopeCheck {\n /* The grant recorded its scopes and every required one is among them. The call proceeded. /\n VERIFIED = 'verified',\n /\n The spent credential records no granted scopes — a pasted key, the application's own credential, or a vendor\n * that did not echo `scope`. The call proceeded UNCHECKED, and this row is what says so.\n /\n NOT_RECORDED = 'not_recorded',\n /* The grant recorded its scopes and lacks at least one required scope. The call was refused before any request. /\n MISSING = 'missing',\n}\n\nexport enum ProviderOperationDenialReason {\n /\n The caller authenticated without a person — an application API key, a machine identity. This door\n * exists for a signed-in person's browser, and the policy's roles and the target-authorization port\n * both reason about a person; a backend caller has the executor and the typed client instead.\n /\n MISSING_USER_SESSION = 'missing_user_session',\n /\n The application's `providers.browserOperations` names no policy for this provider and operation.\n * The fail-closed default: nothing is reachable from a browser unless declared. Also the answer for an\n * operation that does not exist, so a refusal never reveals what a catalogue contains.\n /\n NOT_BROWSER_REACHABLE = 'not_browser_reachable',\n /* The request names a connection shape — owner scope × delegation — the operation's policy does not admit. /\n CONNECTION_NOT_ADMITTED = 'connection_not_admitted',\n /\n The policy declares roles and the target is the caller's OWN user account, over which nobody holds a\n * role. A policy mistake rather than a caller's, recorded as its own reason so it is not read as a\n * person lacking a role they could be granted.\n /\n ROLES_NOT_APPLICABLE_TO_TARGET = 'roles_not_applicable_to_target',\n /\n The target-authorization port refused: the caller named an organization they do not belong to\n * organization-wide, or a user account that is not their own.\n /\n TARGET_NOT_AUTHORIZED = 'target_not_authorized',\n /\n The caller may act for the account, and holds none of the policy's roles — after hierarchy\n * expansion, in the scope of that account. Checked AFTER {@link TARGET_NOT_AUTHORIZED}, so a person\n * naming a tenant they do not belong to is recorded as that, not as a person short of a role.\n /\n INSUFFICIENT_ROLES = 'insufficient_roles',\n}\n\n/\n Why the authorizer refused an operation. A CLOSED vocabulary — the authorizer resolves exactly\n * one of these per refusal, and a SOC dashboard groups by it.\n \n The distinction that matters most operationally is {@link SUBJECT_NOT_RESOLVABLE} vs. the rest:\n * every other member is a caller who reached a real, visible row and was refused on roles or scope,\n * whereas that one is a caller who named a row they cannot see at all — the shape of tenant\n * enumeration.\n /\nexport enum ResourceOperationDenialReason {\n /\n The application requires consent purposes before it may be used\n * (`compliance.serviceConsentRequirement`), and this person has not granted them (#534). The person is\n * authenticated and may hold every role the operation needs; what is missing is their own decision.\n * Distinct from every role/scope reason, because the remedy is the person's choice, not an administrator's.\n /\n SERVICE_CONSENT_REQUIRED = 'service_consent_required',\n\n /\n ONE operation declared the purpose its own processing rests on\n * (`ResourceOperationConsentGateDeclaration`), and this person has not granted it (#1258 Step 3).\n * Distinct from {@link SERVICE_CONSENT_REQUIRED}: only this operation was refused, never the whole\n * application.\n /\n CAPABILITY_CONSENT_REQUIRED = 'capability_consent_required',\n\n /\n No initiator identity or roles on the execution context. Fail-closed: the authorizer refuses\n * rather than assuming an anonymous caller.\n \n A backstop, not a live path — verified. The execution context fails closed earlier and\n * harder: every execution type that reaches the authorizer refuses to CONSTRUCT without\n * `initiatorIds`, and the one type that permits null (`WEBHOOK_CALLBACK`) is skipped before the\n * guard, since signature verification already established trust. The roles half cannot fire\n * either — the context spreads `initiatorRoles`, so the only accepted value is an array.\n \n A row carrying this reason therefore means something bypassed context construction. Treat it as\n * a defect signal, not routine refusal traffic.\n /\n MISSING_INITIATOR = 'missing_initiator',\n\n /\n The caller's organization-wide roles did not satisfy the operation's required role set, after\n * role-hierarchy expansion. The everyday \"you are not an admin\" refusal.\n /\n INSUFFICIENT_ROLES = 'insufficient_roles',\n\n /\n The caller was refused against the target row's PRIMARY SCOPE — the row belongs to another\n * user, organization or application than the caller is entitled to. Distinct from\n * {@link INSUFFICIENT_ROLES}: the caller may hold the right role, but in the wrong tenant.\n /\n SCOPE_MISMATCH = 'scope_mismatch',\n\n /\n The caller reached the resource through a foreign-key path (`/assigned-to-users/{userId}/todos`)\n * whose owning entity they do not control.\n /\n FK_RELATIONSHIP_DENIED = 'fk_relationship_denied',\n\n /\n A collection operation was refused on its PARENT scope — the caller has no access to the\n * organization / application whose collection they addressed.\n /\n PARENT_SCOPE_DENIED = 'parent_scope_denied',\n\n /\n The named row could not be resolved for the caller: it does not exist, OR it exists and is\n * invisible to the caller's scope. The authorizer cannot distinguish these two — and that is\n * deliberate, because reporting them differently would leak the existence of out-of-scope rows.\n * The refusal surfaces to the caller as NOT_FOUND (404) and that response is unchanged by this\n * event; only the audit trail records that a refusal occurred.\n \n Consequently this reason is AMBIGUOUS BY CONSTRUCTION and a single occurrence proves nothing —\n * a 404 for a genuinely deleted record lands here too. Its value is in the aggregate: a principal\n * accumulating these against ids they never successfully read is enumerating.\n \n assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT — refusals are recorded without the record itself\n * becoming an existence oracle.\n /\n SUBJECT_NOT_RESOLVABLE = 'subject_not_resolvable',\n\n /\n The caller holds the ROLE but no usable APPLICATION-WIDE elevation.\n \n Its own member rather than `INSUFFICIENT_ROLES`, and the distinction is the whole point of the\n * grant model: the caller IS an administrator and the refusal is about STANDING privilege, not\n * about authority. Folding it into the roles reason would make the two indistinguishable in the\n * trail — and a reviewer asking \"did zero-standing-privilege actually bite anyone?\" would have no\n * way to count it.\n \n Distinct from a tenant crossing refused for the same shape of reason: that one is refused inside\n * `authorizeOrganizations` and surfaces as `SCOPE_MISMATCH`, because there the caller genuinely is\n * outside the tenant. Here there is no tenant to be outside of.\n \n assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT\n /\n APPLICATION_WIDE_ELEVATION_MISSING = 'application_wide_elevation_missing',\n\n /\n The caller tried to GRANT authority it does not itself hold — a privilege-escalation attempt,\n * refused by the role-ceiling gate (`assertRequestedRolesWithinCallerCeiling`).\n \n Its own member rather than {@link INSUFFICIENT_ROLES}, for the same reason\n * {@link APPLICATION_WIDE_ELEVATION_MISSING} is: the caller PASSED the operation's role check —\n * an `ORG_ADMIN` really may update a membership — and was refused on the CONTENT of the write.\n * Folding the two together would make the single refusal an access review most wants to see\n * indistinguishable from the everyday \"you are not an admin\", and a reviewer asking \"has anyone\n * tried to escalate?\" would have nothing to count.\n \n Uniquely among the members here, the row carries {@link\n * AuditableEvent_ResourceOperationDenied_EventDataSchema.escalatedRoles} — the roles that were\n * actually asked for. `requiredRoles` and `initiatorRoles` cannot express it: neither is the set\n * the caller tried to confer on somebody else.\n \n Raised OUTSIDE the authorization phase — the gate runs in custom-implementation prefixes, after\n * the authorizer has returned — so it does not reach `classifyAuthorizationDenial`. The gate emits\n * it directly through the same chokepoint, keeping the dedup window, the logarithmic escalation\n * ladder and the loss counters.\n \n assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — an attempt to grant authority the caller does\n * not hold is refused AND recorded.\n * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT\n /\n ROLE_CEILING_EXCEEDED = 'role_ceiling_exceeded',\n\n /\n A high-impact action was refused because the operation ITSELF demands a fresh re-proof of\n * identity (`requiresStepUpAuthentication`), and the caller presented none.\n \n The caller is authenticated and may hold every role the operation needs. What is missing is a\n * ceremony, so this belongs with {@link SERVICE_CONSENT_REQUIRED} rather than with\n * {@link INSUFFICIENT_ROLES}: the remedy is an act by the same person, not a grant by an\n * administrator.\n \n Paired with {@link STEP_UP_REQUIRED_BY_FRESHNESS} for the reason the two consent members are\n * paired — the missing thing is the same and the party that DEMANDED it is not, and the two read\n * very differently in a review. A burst of these is somebody repeatedly attempting an action the\n * application has declared dangerous; a burst of the other is sessions ageing out.\n \n Raised OUTSIDE the authorization phase, like {@link ROLE_CEILING_EXCEEDED}: the step-up gate is\n * a private check at the services-registry tier that throws without passing through the\n * authorizer, so it reaches no `classifyAuthorizationDenial`. It emits through the same chokepoint\n * instead, keeping the dedup window, the escalation ladder and the loss counters.\n \n assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — a refused high-impact action is\n * recorded, not merely refused.\n * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT\n /\n STEP_UP_REQUIRED_BY_OPERATION = 'step_up_required_by_operation',\n\n /\n The same refusal, demanded by the USER TYPE's freshness policy (`UserTypeAuthPolicy.stepUpAuth`)\n * rather than by the operation: the caller's authentication is older than the declared maximum age.\n \n Distinct from {@link STEP_UP_REQUIRED_BY_OPERATION} because the two send a reviewer to different\n * places — one to the operation's own declaration, the other to the user-type policy — and because\n * only this one varies with how long a person has been signed in. The refusal's own error context\n * already carried the distinction before either was audited; this keeps it in the durable record.\n \n assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION\n * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT\n /\n STEP_UP_REQUIRED_BY_FRESHNESS = 'step_up_required_by_freshness',\n}\n\n/* SSO configuration change type. /\nexport enum SsoConfigChangeType {\n CREATED = 'created',\n UPDATED = 'updated',\n DELETED = 'deleted',\n PROVIDER_ADDED = 'provider_added',\n PROVIDER_REMOVED = 'provider_removed',\n ENFORCEMENT_CHANGED = 'enforcement_changed',\n}\n\n/* SIEM export configuration change type. /\nexport enum SiemExportChangeType {\n ENABLED = 'enabled',\n DISABLED = 'disabled',\n UPDATED = 'updated',\n}\n\n/\n Normalised MACHINE_ACCESS operation vocabulary. Transport-native method names (A2A JSON-RPC\n * `message/send`, MCP `tools/call`, …) are mapped to these stable, transport-prefixed audit\n * identifiers so an org SIEM reads ONE vocabulary across every external resource-server surface.\n * The `<transport>_<method>` shape keeps A2A and MCP operations disambiguated in a flat stream.\n /\nexport enum MachineAccessOperation {\n A2A_MESSAGE_SEND = 'a2a_message_send',\n A2A_MESSAGE_STREAM = 'a2a_message_stream',\n /* Reading one task's state. Externally triggered and tenant-actionable, so it audits. /\n A2A_TASKS_GET = 'a2a_tasks_get',\n /* Requesting cancellation of a task — a MUTATION of tenant work, audited as such. /\n A2A_TASKS_CANCEL = 'a2a_tasks_cancel',\n /\n Re-attaching to a task's update stream after a dropped connection.\n \n Audited like `A2A_TASKS_GET` and for the same reason: it is a READ of tenant work by an external\n * principal. It deserves its own member rather than borrowing the get — a resubscribe holds a\n * connection open for as long as the task runs, so in a trail the two have very different shapes,\n * and collapsing them would hide a caller camping on a stream behind ordinary polling.\n /\n A2A_TASKS_RESUBSCRIBE = 'a2a_tasks_resubscribe',\n /\n Registering a webhook the agent will POST this task's updates to.\n \n The most security-relevant of the push-notification operations and the reason all four get their\n * own members: the caller is directing OUR server to make outbound requests to an address IT\n * chooses, carrying credentials IT supplies. In a trail that is a different act from reading a\n * task, and an operator reviewing egress needs to find every one of them without inferring it from\n * a generic access row.\n /\n A2A_PUSH_NOTIFICATION_CONFIG_SET = 'a2a_push_notification_config_set',\n /* Reading back one registered webhook target. Secrets are redacted, but the URL is disclosed. /\n A2A_PUSH_NOTIFICATION_CONFIG_GET = 'a2a_push_notification_config_get',\n /* Enumerating every webhook target registered against a task. /\n A2A_PUSH_NOTIFICATION_CONFIG_LIST = 'a2a_push_notification_config_list',\n /* Removing a webhook target — a MUTATION, and the act that silently stops an operator's alerting. /\n A2A_PUSH_NOTIFICATION_CONFIG_DELETE = 'a2a_push_notification_config_delete',\n /\n Enumerating an owner's tasks (A2A 1.0 `ListTasks`).\n \n Its own member rather than borrowing `A2A_TASKS_GET`: a LIST discloses the existence and shape\n * of work the caller did not name, which in a trail is a different act from reading one task an\n * operator already knows about. Collapsing them would hide enumeration behind ordinary polling.\n /\n A2A_TASKS_LIST = 'a2a_tasks_list',\n MCP_TOOLS_LIST = 'mcp_tools_list',\n MCP_TOOLS_CALL = 'mcp_tools_call',\n /\n A MACHINE principal's READ / LIST / SEARCH on a DECLARED cross-tenant REST door\n * (`admitsCrossTenantPlatformAdministration`) — today the application audit-log door.\n \n Deliberately NOT every REST call a machine makes: the plain resource API is audited per operation\n * through `RESOURCE_OPERATION_PERFORMED`, which carries `machineCredentialId`. These three exist because a\n * declared crossing's only other row, `CROSS_TENANT_ADMINISTRATIVE_ACCESS`, is written per TENANT REACHED —\n * so a machine read returning only application-wide rows, or nothing, left no row naming who read (#297).\n * One member per verb, like the A2A task members: a LIST enumerates, a READ fetches a row somebody named.\n /\n API_READ = 'api_read',\n API_LIST = 'api_list',\n API_SEARCH = 'api_search',\n}\n\nconst API_READ_MACHINE_ACCESS_OPERATIONS: Readonly<Partial<Record<CoreResourceOperation, MachineAccessOperation>>> = {\n [CoreResourceOperation.READ]: MachineAccessOperation.API_READ,\n [CoreResourceOperation.LIST]: MachineAccessOperation.API_LIST,\n [CoreResourceOperation.SEARCH]: MachineAccessOperation.API_SEARCH,\n};\n\n/\n The MACHINE_ACCESS identifier for an executed REST read, or `undefined` for any verb that is not one.\n * The one place the core-operation → audit-vocabulary mapping lives, so a recorder never spells it.\n /\nexport function resolveApiReadMachineAccessOperation(operation: CoreResourceOperation \| undefined): MachineAccessOperation \| undefined {\n return operation === undefined ? undefined : API_READ_MACHINE_ACCESS_OPERATIONS[operation];\n}\n\nexport const AuditableEventTypeSchema = z.union([\n z.enum(CoreAuditableEventType),\n z.string()\n]);\n\nexport const AuditableEvent_User_LoginEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_LOGIN),\n ipAddress: z.string(),\n userAgent: z.string(),\n userId: z.string(),\n authMethod: z.string().optional(),\n email: z.string().optional(),\n sessionId: z.string().optional(),\n});\n\nexport const AuditableEvent_User_LogoutEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_LOGOUT),\n userId: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\nexport const AuditableEvent_User_LoginFailedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_LOGIN_FAILED),\n email: z.email(),\n authMethod: z.string(),\n failureReason: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n attemptsRemaining: z.number().optional(),\n sessionId: z.string(),\n});\n\n/\n Which lockout mechanism tripped a `USER_ACCOUNT_LOCKED` audit — so a SOC can distinguish the two\n * sources, which have different remediation: the per-SESSION progressive failed-attempt limit vs the\n * per-EMAIL global rate-limit. Enum (fixed vocabulary), not a string union, per the project rule.\n /\nexport enum AccountLockoutReason {\n /* The per-session progressive failed-attempt limit tripped (`incrementSessionAttempts`). /\n SESSION_ATTEMPT_LIMIT = 'session_attempt_limit',\n /* The per-email GLOBAL rate-limit lockout tripped (`checkRateLimit(GLOBAL_LOCKOUT + email)`). /\n GLOBAL_EMAIL_RATE_LIMIT = 'global_email_rate_limit',\n}\n\nexport const AuditableEvent_User_AccountLockedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_ACCOUNT_LOCKED),\n userId: z.string(),\n email: z.email(),\n authMethod: z.string(),\n lockoutDuration: z.number(), // minutes\n ipAddress: z.string(),\n userAgent: z.string(),\n sessionId: z.string(),\n /\n Which lockout mechanism tripped this event. OPTIONAL for backward compatibility — pre-existing\n * emitters and already-stored rows may omit it; new emitters set it so SOC tooling can filter\n * session-limit vs global-email-limit lockouts.\n /\n reason: z.enum(AccountLockoutReason).optional(),\n});\n\n/\n A machine principal (api-key / OAuth-client secret / exchanged client-credentials token) that\n * successfully authenticated. Carries the credential PROVENANCE — never the raw secret. Emitted at\n * the OAuth token-issuance moment (`/oauth/token`); per-request direct-secret access additionally\n * carries this provenance into any FIELD_ACCESS audit row (see `audit-access-fields`).\n /\nexport const AuditableEvent_MachineAuth_SuccessEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.MACHINE_AUTH_SUCCESS),\n /* MachineAuthMethod value: `api_key` \| `oauth_client`. /\n authMethod: z.string(),\n /* The ApiKey / OAuthClient row `_id` that authenticated — NEVER the raw secret. /\n credentialId: z.string(),\n /* Resolved machine execution type: `organization_machine` \| `application_machine`. /\n scopeType: z.string(),\n /* organizationId (ORG machine) or applicationId (APP machine). /\n scopeId: z.string().optional(),\n resourceIdentifier: z.string().optional(),\n operationIdentifier: z.string().optional(),\n ipAddress: z.string().optional(),\n});\n\n/\n A rejected machine-credential presentation (bad/expired/wrong-audience/wrong-scope secret or\n * token, or a rate-limited source). Records the ATTEMPT — the presented credential kind + prefix,\n * the target scope, and the reason — never a `credentialId` (the credential did not resolve). The\n * per-source-IP brute-force signal (external-access hardening) is exactly this event stream.\n /\nexport const AuditableEvent_MachineAuth_FailedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.MACHINE_AUTH_FAILED),\n /* Presented credential kind: `api_key` \| `oauth_client` \| `machine_token`. /\n credentialKind: z.string(),\n /* Human-routable secret prefix (e.g. `sk_org_` / `oc_app_`) — NEVER the full secret. Absent for token fronts. /\n credentialPrefix: z.string().optional(),\n /* Failure reason (e.g. `invalid_credential`, `inactive`, `aud_mismatch`, `wrong_scope`, `rate_limited`). /\n reason: z.string(),\n scopeType: z.string().optional(),\n scopeId: z.string().optional(),\n resourceIdentifier: z.string().optional(),\n operationIdentifier: z.string().optional(),\n ipAddress: z.string().optional(),\n});\n\n/\n A machine principal (ORGANIZATION_MACHINE / APPLICATION_MACHINE) exercised an external\n * resource-server surface (A2A `message/send`, MCP `tools/call`, …) with an already-issued,\n * audience-bound token. The token-USE twin of MACHINE_AUTH_SUCCESS (token-MINT): the mint fires\n * once, low-volume, at `/oauth/token`; THIS fires per external request so an org SIEM sees WHAT a\n * machine did, not merely that it authenticated.\n \n Carries the credential PROVENANCE (authMethod + credentialId — never the raw secret), the ROLE\n * context that authorized the access (roles are the single authorization axis — there is NO OAuth\n * authorization-scope vocabulary), and the resource server + operation targeted. Emitted fire-and-\n * forget at the A2A / MCP controller boundary AFTER the caller is authenticated + authorized; routed\n * to the org SIEM via `routingOrgIds` (verified org for an ORGANIZATION_MACHINE; an\n * APPLICATION_MACHINE has no single tenant SIEM ⇒ no per-org dispatch).\n /\nexport const AuditableEvent_MachineAccess_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.MACHINE_ACCESS),\n /* MachineAuthMethod value: `api_key` \| `oauth_client`. /\n authMethod: z.string(),\n /* The ApiKey / OAuthClient row `_id` whose token was presented — NEVER the raw secret. /\n credentialId: z.string(),\n /* Resolved machine execution type: `organization_machine` \| `application_machine`. /\n scopeType: z.string(),\n /\n TENANT scope id: organizationId (ORG machine) or applicationId (APP machine). This is the\n * data-partition scope, NOT an OAuth authorization scope — that vocabulary was removed; roles are\n * the single authorization axis.\n /\n scopeId: z.string().optional(),\n /\n The role context that authorized this access (the machine principal's roles). Roles are the\n * single authorization axis; recorded so a SIEM sees the authority the access ran under.\n /\n roles: z.array(z.string()).optional(),\n /* ResourceServerKind of the surface accessed: `a2a` \| `mcp` \| `api` (a declared cross-tenant REST read). /\n resourceServer: z.string(),\n /* A2A/MCP: the resource-server audience / agent endpoint / systemRef hit. `api`: the resource type read. /\n resourceIdentifier: z.string().optional(),\n /* Normalised MachineAccessOperation value (e.g. `a2a_message_send`, `mcp_tools_call`). /\n operationIdentifier: z.string(),\n ipAddress: z.string().optional(),\n});\n\nexport const AuditableEvent_User_SessionExpiredEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_SESSION_EXPIRED),\n userId: z.string(),\n sessionId: z.string(),\n sessionDuration: z.number(), // minutes\n lastActivity: z.date(),\n});\n\n/\n One refresh chain retired to keep a principal within its concurrent-session cap.\n \n `evictedIssuedAt` is the load-bearing field and the reason this event is worth its own type: the\n * cap's security property is that the OLDEST chain goes, so a record that named only the victim\n * would prove a session ended without proving the right one did. Carrying the issuance instant makes\n * the first-in-first-out claim checkable from the trail alone.\n \n `configuredMaximum` and `retainedCount` are here so a reviewer can tell a correctly-enforced cap\n * from a misconfigured one without reading the config as it stood at that moment.\n \n NO token material. The JTI is an opaque identifier, never the token — the trail must not become a\n * place where a credential can be recovered.\n \n assurance-control: WILDO.IDENTITY.SESSION_CONCURRENCY_LIMIT — the bound's enforcement is evidenced,\n * including WHICH chain was retired, so the ordering can be reviewed and not merely trusted.\n /\nexport const AuditableEvent_User_SessionEvictedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_SESSION_EVICTED),\n userId: z.string(),\n /* Opaque identifier of the retired refresh chain. Never the token itself. /\n evictedJti: z.string(),\n /* When the retired chain was issued — the evidence that the OLDEST one went. Absent if unreadable. /\n evictedIssuedAt: z.date().optional(),\n /* The cap in force for this principal's user type at the moment of eviction. /\n configuredMaximum: z.number().int().positive(),\n /* How many chains remained after the eviction, so an over- or under-enforcing cap is visible. /\n retainedCount: z.number().int().nonnegative(),\n});\n\n/\n A `USERS` row was hard-deleted.\n \n The identity is gone after this event, so the record must carry enough to answer \"who was\n * removed?\" without joining back to a row that no longer exists — hence `email` alongside `userId`.\n * That is a deliberate, narrow retention of an identifier inside the audit trail: an erasure that\n * left no trace of having happened would defeat the purpose of the trail, and the audit store is\n * itself immutable and access-controlled. Prefer `RETAIN_AND_IMPERSONALIZE` erasure\n * (`eraseSubjectAsSystem`) over a hard delete wherever the retention contract allows it — this\n * event exists to make the hard-delete path, which the framework still exposes to administrators\n * through `USERS \| DELETE`, leave evidence.\n \n `deletedBy` is the acting principal, which for the admin route is NOT the subject. Mirrors\n * `AuditableEvent_Organization_DeletedEventDataSchema`.\n \n assurance-control: WILDO.DATA.SECURE_LIFECYCLE — identity destruction is a\n * security-relevant event and must be attributable.\n /\nexport const AuditableEvent_User_DeletedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_DELETED),\n userId: z.string(),\n email: z.string().optional(),\n deletedBy: z.string(),\n /* Roles the deleted principal held, so an auditor can see what authority was removed. /\n appRoles: z.array(z.string()).optional(),\n});\n\n/\n Application-role grant / revocation on a `USERS` row.\n \n Carries BOTH the before and after arrays rather than only the delta: an auditor reconstructing a\n * principal's authority at a point in time needs the resulting set, and the delta alone cannot\n * distinguish \"granted a role they already held\" (a no-op) from a real widening. `requestedRoles`\n * is what the administrator ASKED for — for an additive grant it is the delta, for a whole-array\n * rewrite through the core UPDATE it is the full authored set — which is also exactly the set the\n * role-ceiling gate measured, so the record shows what was checked, not just what resulted.\n \n `reason` is the administrator's free-text justification where the operation collects one\n * (`assign_roles` / `revoke_roles`); the core UPDATE path has no such field and omits it.\n /\nexport const AuditableEvent_User_AppRolesChangedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_APP_ROLES_CHANGED),\n /* The user whose authority changed — the SUBJECT, not the actor. /\n userId: z.string(),\n previousRoles: z.array(z.string()),\n newRoles: z.array(z.string()),\n /* The roles as AUTHORED by the caller (the set the role-ceiling gate was measured against). /\n requestedRoles: z.array(z.string()),\n /* Which write path produced the change — the operation identifier (`assign_roles`, `update`, …). /\n operation: z.string(),\n changedBy: z.string(),\n reason: z.string().optional(),\n});\n\n/\n The application has no administratively usable super-administrator.\n \n Emitted by the startup floor report, not by a write path — every write that could REACH this state\n * refuses instead, so an emission here is evidence the state arrived outside the guarded paths.\n \n `conferringRoles` is recorded because the answer depends on the LIVE role table: an application\n * that renames or drops a custom role carrying `inheritFrom: APP_ADMIN_SUPER_ADMIN` can breach the\n * floor without any user row changing, and an auditor reading the event a month later cannot\n * reconstruct which roles counted at boot without it.\n /\nexport const AuditableEvent_Application_SuperAdminFloorBreachedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.APPLICATION_SUPER_ADMIN_FLOOR_BREACHED),\n /* How many administratively usable super-administrators were found (expected: 0 when emitted). /\n usableSuperAdminCount: z.number(),\n /* The minimum the floor requires. /\n requiredUsableSuperAdminCount: z.number(),\n /* The role keys that conferred super-admin at boot, resolved from the live application role table. /\n conferringRoles: z.array(z.string()),\n /* The user statuses that counted as administratively usable. /\n usableStatuses: z.array(z.string()),\n});\n\n/\n A tenant left unadministrable by an allowed action.\n \n Carries the tenant, the memberships that stopped counting, and WHY the action was permitted, so an\n * auditor can tell a deliberate containment decision from an accident. `remainingUsableOwners` is\n * recorded rather than assumed zero: the floor's minimum is configurable, and an event that hard-codes\n * the consequence cannot be re-read against a changed policy.\n /\n/\n HOW a tenant's owner-floor breach came to be known.\n \n The two answers mean genuinely different things to whoever reads the record, and a reader cannot\n * tell them apart from the rest of the payload — which is why this is a named member rather than an\n * inference from whether the action fields happen to be present.\n \n The event type stays SINGLE across both, deliberately. The fact recorded is \"this tenant has no\n * administratively usable owner\", and that is the query an operator needs to be one query: splitting\n * it in two would mean a breach is missed by whichever half somebody alerts on.\n /\nexport enum AdministrativeContinuityBreachDetection {\n /\n A guarded lifecycle write was ALLOWED through and stranded the tenant.\n \n The permissive branch is deliberate — refusing a suspension would mean an operator cannot lock\n * out a compromised owner without first transferring ownership using the tenant the attacker\n * controls — so this record IS the control that makes the trade acceptable. The action fields are\n * populated here, because there is an action to name.\n /\n ALLOWED_LIFECYCLE_ACTION = 'allowed_lifecycle_action',\n /\n The boot report found the tenant ALREADY stranded, by a route no guard ever saw: a direct\n * database edit, a restore from a backup taken mid-erasure, a seed that authored no owner, or a\n * role-table change that redefined which roles confer ownership.\n \n There is no action to name, so the action fields are absent rather than filled with placeholders\n * — the same reading `logApplicationSuperAdminFloorBreached` takes for its missing `userId`.\n /\n BOOT_REPORT = 'boot_report',\n}\n\nexport const AuditableEvent_Organization_OwnerFloorBreachedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_OWNER_FLOOR_BREACHED),\n /* The tenant left with no administratively usable owner. /\n organizationId: z.string(),\n /\n WHICH observation produced this record. Required, so the compiler forces every emitter — present\n * and future — to say which; a reader cannot recover it from the payload, and guessing it from the\n * presence of the action fields would make an emitter's omission look like a boot observation.\n /\n detectedBy: z.enum(AdministrativeContinuityBreachDetection),\n /* How many usable owners remain (expected: 0 when emitted). /\n remainingUsableOwners: z.number(),\n /\n The owner-conferring memberships the action removed from the population.\n \n Absent under `BOOT_REPORT`: nothing was removed within sight of a guard, which is the whole\n * reason the boot report has to look.\n /\n reducedMemberIds: z.array(z.string()).optional(),\n /* The lifecycle verb that caused it — the operator-facing \"what did this\". Absent under `BOOT_REPORT`. /\n operationIdentifier: z.string().optional(),\n /* The subject whose deactivation triggered it. Absent under `BOOT_REPORT`. /\n subjectUserId: z.string().optional(),\n /\n The status the subject moved to, so a reader need not infer usability from the verb alone. Absent\n * under `BOOT_REPORT`.\n /\n subjectNextStatus: z.string().optional(),\n});\n\n// Organization Member Event Data Schemas\nexport const AuditableEvent_OrganizationMember_InvitedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_MEMBER_INVITED),\n organizationId: z.string(),\n invitedUserId: z.string(),\n invitedBy: z.string(),\n roles: z.array(z.string()),\n email: z.email().optional(),\n});\n\nexport const AuditableEvent_OrganizationMember_JoinedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_MEMBER_JOINED),\n organizationId: z.string(),\n userId: z.string(),\n roles: z.array(z.string()),\n invitationId: z.string().optional(),\n});\n\nexport const AuditableEvent_OrganizationMember_UpdatedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_MEMBER_UPDATED),\n organizationId: z.string(),\n memberId: z.string(),\n changes: z.record(z.string(), z.any()),\n});\n\n/\n Organization-wide role grant / revocation on an `ORGANIZATION_MEMBERS` row.\n \n The ORGANIZATIONS-scope twin of {@link AuditableEvent_User_AppRolesChangedEventDataSchema}, and it\n * carries the same before/after/requested triple for the same reasons: an auditor reconstructing a\n * principal's authority at a point in time needs the RESULTING set, and the delta alone cannot\n * distinguish \"granted a role they already held\" from a real widening.\n \n ## Why `requestedRoles` is not redundant with `newRoles` here\n \n It matters MORE on this resource than on the application twin. Membership CREATE runs the authored\n * roles through resolution before persisting them — an organization type's `defaultMemberRole` is\n * injected when the caller authored none — so \"what the administrator asked for\" and \"what the\n * member ended up holding\" genuinely differ on an ordinary invite. `requestedRoles` is also exactly\n * the set the role-ceiling gate measured, so the record shows what was CHECKED, not only what\n * resulted. It is optional because \"the caller authored no roles at all\" (policy supplied them) is a\n * different fact from \"the caller explicitly authored an empty array\", and collapsing the two would\n * lose the distinction the ceiling gate itself draws.\n \n ## Why both `memberId` and `userId`\n \n `memberId` addresses the MEMBERSHIP ROW that was written; `userId` is the SUBJECT PRINCIPAL whose\n * authority changed. \"What could this person do on date X\" is a question about the principal, and\n * answering it through the row id alone requires a join that a retention sweep may already have\n * removed. `AuditableEvent_OrganizationMember_RemovedEventDataSchema` carries the same pair for the\n * same reason. `userId` stays optional so a degenerate row still leaves the rest of the evidence\n * rather than suppressing the whole record.\n /\nexport const AuditableEvent_OrganizationMember_RoleChangedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_MEMBER_ROLE_CHANGED),\n /* Tenant the membership belongs to. /\n organizationId: z.string(),\n /* The membership ROW that was written. /\n memberId: z.string(),\n /* The SUBJECT principal whose authority changed — not the actor. /\n userId: z.string().optional(),\n previousRoles: z.array(z.string()),\n newRoles: z.array(z.string()),\n /* The roles as AUTHORED by the caller (the set the role-ceiling gate measured). Absent when the caller authored none. /\n requestedRoles: z.array(z.string()).optional(),\n /* Which write path produced the change — the operation identifier (`create`, `update`, …). /\n operation: z.string(),\n changedBy: z.string(),\n /\n The actor's stated reason, on the paths that REQUIRE one — today `grantOwnership`, the\n * platform-tier repair door that crosses into a tenant the caller is not a member of. There the\n * justification is the whole control: no downstream check can second-guess an operator acting\n * outside the tenant, so the record of WHY is what makes the crossing accountable. It was required\n * on the request and discarded at the service boundary until #593. Absent on `create` / `update`,\n * which collect none. Bounded by the request DTO (1000 characters).\n /\n justification: z.string().optional(),\n});\n\n/\n Per-unit role assignment on an `ORGANIZATION_UNIT_MEMBERS` row.\n \n The NARROWED twin of {@link AuditableEvent_OrganizationMember_RoleChangedEventDataSchema}. A unit\n * assignment confers authority inside ONE organization unit — `appendUnitScopedRoles` emits it into\n * `initiatorRoles` carrying an `organizationUnitId` discriminator, and every consumer that unions\n * those entries partitions on that field first. The narrowing is what makes it not tenant-wide; it\n * does not make it un-auditable, so the grant leaves evidence on the same terms.\n \n ## Why singular `role`, not an array\n \n `OrganizationUnitMember` persists ONE role per (unit, member) — that uniqueness is its business\n * key. Reshaping it into an array here purely to mirror the organization-wide twin would invent a\n * cardinality the resource does not have and invite a future reader to assume multiple unit roles\n * are representable.\n \n `previousRole` is absent on an initial assignment, which is the honest encoding of \"there was no\n * prior grant\" — distinct from a re-assignment away from a role that did exist.\n /\nexport const AuditableEvent_OrganizationUnitMember_RoleChangedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_UNIT_MEMBER_ROLE_CHANGED),\n /* Tenant the assignment belongs to. /\n organizationId: z.string().optional(),\n /* The unit the role is narrowed to — the discriminator that keeps this grant from reading as tenant-wide. /\n organizationUnitId: z.string().optional(),\n /* The assignment ROW that was written. /\n assignmentId: z.string(),\n /* The membership the assignment hangs off — the bridge to the SUBJECT principal. /\n organizationMemberId: z.string().optional(),\n /* Absent on an initial assignment: there was no prior grant to record. /\n previousRole: z.string().optional(),\n newRole: z.string(),\n /* The role as AUTHORED by the caller (the value the role-ceiling gate measured). /\n requestedRole: z.string().optional(),\n /* Which write path produced the change — the operation identifier (`create`, `update`). /\n operation: z.string(),\n changedBy: z.string(),\n});\n\n/\n Revocation of a per-unit role assignment — the closing half of\n * {@link AuditableEvent_OrganizationUnitMember_RoleChangedEventDataSchema}.\n \n ## Why AUTHORIZATION rather than ORG_MANAGEMENT, unlike `ORGANIZATION_MEMBER_REMOVED`\n \n Removing an organization MEMBER is primarily a directory action — the person leaves the tenant —\n * and the authority they lose is a consequence of that. An assignment row has no directory aspect\n * whatsoever: it exists only to confer a role, so deleting it IS the revocation, and it is the exact\n * counterpart of the CREATE that granted it. Classifying it as record-keeping would leave an\n * authorization-filtered trail in which unit privileges are granted and never removed.\n \n ## Why the revoked role is captured\n \n `revokedRole` is the single field that cannot be recovered after the fact: the row is hard-deleted,\n * so nothing else in the system can answer \"what authority did this person lose\". It is deliberately\n * NOT named `previousRole` — that would imply a successor role, and there is none.\n \n ## Coverage boundary\n \n Emitted on the DIRECT assignment DELETE — the targeted revocation an operator performs and an\n * auditor reviews. Cascade removals (deleting the parent membership, or the whole organization) run\n * through the raw repository, which by construction does not execute service custom implementations;\n * those are evidenced by their own parent event, because the semantic act there is losing the\n * membership or the tenant, not revoking one unit role.\n /\nexport const AuditableEvent_OrganizationUnitMember_RemovedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_UNIT_MEMBER_REMOVED),\n /* Tenant the assignment belonged to. /\n organizationId: z.string().optional(),\n /* The unit the revoked role was narrowed to. /\n organizationUnitId: z.string().optional(),\n /* The assignment ROW that was deleted. /\n assignmentId: z.string(),\n /* The membership the assignment hung off — the bridge to the subject principal. /\n organizationMemberId: z.string().optional(),\n /* The authority that was removed. Unrecoverable once the row is gone, which is why it is recorded here. /\n revokedRole: z.string().optional(),\n removedBy: z.string(),\n});\n\nexport const AuditableEvent_OrganizationMember_StatusChangedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_MEMBER_STATUS_CHANGED),\n organizationId: z.string(),\n memberId: z.string(),\n previousStatus: z.string(),\n newStatus: z.string(),\n changedBy: z.string(),\n reason: z.string().optional(),\n});\n\n/\n Removal of an organization membership — by administrative DELETE, or by cancelling a pending\n * invitation through REVOKE.\n \n ## Why one event covers both, distinguished by `operation`\n \n They are genuinely different administrative acts — removing someone who works here versus\n * withdrawing an invitation that was never accepted — and an auditor must never confuse them. But\n * they are the same KIND of act (a membership ceases to exist) and share every other field, so\n * splitting them into two event types would fragment \"how did this person's membership end?\" across\n * two queries for no gain. `operation` carries the distinction, and `previousStatus` carries the\n * state the row was actually in, which `operation` alone cannot give: DELETE accepts any\n * non-`INVITED` status, so ACTIVE, INACTIVE and SUSPENDED removals are otherwise indistinguishable.\n \n An `INVITED` membership confers NOTHING — `execution-context-creator` builds `initiatorRoles` only\n * from `ACTIVE` memberships — so a REVOKE removes no live authority. It is still recorded, because\n * withdrawing someone's pending access is a directory decision an access review needs to see, and\n * because `ORGANIZATION_MEMBER_INVITED` would otherwise stand unanswered.\n \n ## Why `roles` is captured\n \n The row is hard-deleted, so afterwards nothing in the system can answer \"what authority did this\n * person hold when they were removed\". Same reasoning — and same shape — as\n * `AuditableEvent_User_DeletedEventDataSchema.appRoles`. On a REVOKE it records what the invitee\n * WOULD have received on acceptance.\n \n ## Category\n \n Classified ORG_MANAGEMENT rather than AUTHORIZATION, unlike `ORGANIZATION_UNIT_MEMBER_REMOVED`:\n * removing a MEMBER is a directory-lifecycle action whose authority loss is a consequence, whereas a\n * unit assignment row exists only to confer a role. The `roles` field is what keeps the authority\n * question answerable from an ORG_MANAGEMENT record.\n /\nexport const AuditableEvent_OrganizationMember_RemovedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_MEMBER_REMOVED),\n organizationId: z.string(),\n /* The membership ROW that was deleted. /\n memberId: z.string(),\n /* The SUBJECT principal who lost the membership. /\n removedUserId: z.string(),\n /\n The organization-wide roles the membership carried. Unrecoverable once the row is gone.\n * On a REVOKE these were never in force — they are what acceptance would have conferred.\n /\n roles: z.array(z.string()).optional(),\n /\n The row's status at removal.\n \n Deliberately `z.string()` rather than the `OrganizationMemberStatus` enum, matching\n * `AuditableEvent_OrganizationMember_StatusChangedEventDataSchema`: an audit row is a historical\n * record that must stay readable after the vocabulary evolves, so the strictness belongs at the\n * PRODUCER (which assigns from the enum), not at the record.\n /\n previousStatus: z.string().optional(),\n /* Which path ended the membership — `delete` (a real member) or `revoke` (a pending invitation). /\n operation: z.string(),\n /\n The per-unit grants this removal took with it.\n \n `ORGANIZATION_UNIT_MEMBERS` is a composition child of the membership, so deleting the membership\n * cascades to every assignment — through the RAW REPOSITORY, below the service tier, where no\n * custom implementation runs and therefore no `ORGANIZATION_UNIT_MEMBER_REMOVED` can fire. Without\n * this field the trail would show each unit grant being made and never revoked: the assignment rows\n * are hard-deleted, so the lost authority is not reconstructible from data either.\n \n Carried here rather than emitted per row on purpose — one membership removal is ONE decision, and\n * a teardown that fans out into a dozen revocation events buries it. Captured in the DELETE prefix,\n * which is the last moment the assignments still exist.\n /\n revokedUnitAssignments: z.array(z.object({\n organizationUnitId: z.string(),\n role: z.string(),\n })).optional(),\n /\n Who ended the membership — a user id, or an {@link AuditActorSentinel}.\n \n ## Reading it: `operation: 'revoke'` has THREE causes, told apart HERE\n \n `operation` says a pending invitation ended; it does not say why. Three different acts produce\n * an identical `revoke`, and the distinction between them is exactly what an access review needs:\n \n \| Cause \| How to recognise it \|\n * \|---\|---\|\n * \| The invitee DECLINED \| `removedBy === removedUserId` — the subject is the actor \|\n * \| An administrator CANCELLED it \| `removedBy` is a real user id, and a different one \|\n * \| It EXPIRED unanswered \| `removedBy === AuditActorSentinel.SYSTEM` (the stale-invitation sweep) \|\n \n This is why the decline path supplies an on-behalf-of principal rather than running anonymously.\n * A decline necessarily executes under BORROWED authority — the invitee has no standing to revoke\n * an organization membership — and a borrowed-authority context carries no initiator user id, so\n * the actor previously resolved to `SYSTEM`: an active refusal and a silent expiry wrote\n * byte-identical rows. Recording the acting principal separates all three with no extra event type,\n * which is the same economy `operation` and `previousStatus` already buy above.\n \n A reader must therefore not treat `removedBy === SYSTEM` on a `revoke` as \"unknown actor\". It is\n * a positive statement that no human ended this invitation.\n /\n removedBy: z.string(),\n /\n The justification. Declared by REVOKE for exactly this purpose and supplied by an administrator\n * cancelling an invitation; on a decline it carries the invitee's optional reason, and the expiry\n * sweep supplies none. Absent, therefore, on most declines — do not read its absence as a cause.\n /\n reason: z.string().optional(),\n});\n\n// Organization Lifecycle Event Data Schemas\nexport const AuditableEvent_Organization_CreatedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_CREATED),\n organizationId: z.string(),\n name: z.string(),\n slug: z.string(),\n createdBy: z.string(),\n});\n\nexport const AuditableEvent_Organization_UpdatedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_UPDATED),\n organizationId: z.string(),\n changes: z.record(z.string(), z.any()),\n updatedBy: z.string(),\n});\n\n/\n WHY an organization was assigned the type it now carries, when no person chose it.\n \n A closed vocabulary, deliberately named rather than implied: the assignment is only defensible because the answer\n * was DERIVED, and a reader of the audit row must be able to see which derivation produced it without re-deriving\n * the application's configuration — or its membership rows — as they stood at that boot. The two members answer\n * from different evidence, which is exactly why a single \"derived\" value would not do: one is a fact about the\n * DECLARATION and stays true however the tenant changes, the other is a fact about the ORGANIZATION on one day.\n /\nexport enum OrganizationTypeAssignmentBasis {\n /\n The application declares exactly one organization type, so an organization whose type resolves to nothing —\n * none stored, or one the declaration no longer carries — can only be that type: it is the only policy the\n * application has. Nothing is guessed, and nothing about the organization was read.\n /\n SOLE_DECLARED_TYPE = 'sole_declared_type',\n /\n The application declares several organization types, and exactly one of them covers every user type held by\n * this organization's own members — so the others are types this organization cannot be. Nothing is guessed: it\n * is the coverage test the first-administrator organization's type is already derived by, asked of the members.\n \n Narrower than {@link SOLE_DECLARED_TYPE} in what it proves. It reports the answer for the membership as it\n * stood at that boot; an organization whose members later span two declared types would not derive again. That is\n * why the row records the basis rather than only the outcome — a reviewer asking \"could this have been wrong?\"\n * needs to know which question was answered.\n /\n MEMBER_USER_TYPES = 'member_user_types',\n /\n An operator promoted this organization to the one that OWNS the application, through\n * `organizations.promoteToOwnerOrganization` (#1054).\n \n The odd one out of the three, and deliberately kept in the same event rather than given its own.\n * What the event records is \"this organization's `type` changed, and here is what decided it\" — true\n * of all three — and an access reviewer asking \"how did this tenant come to be typed this way?\" must\n * find one row wherever the answer lies, not two events they have to know to look for separately.\n \n What differs is everything a derivation does not have: there IS an actor (the audit row carries\n * them, and {@link AuditableEvent_Organization_TypeAssignedEventData.justification} carries their\n * stated reason), the previous type is always present, and the decision was a human's. A row\n * carrying this basis is the only one on which `justification` may appear — the other two are\n * derivations, and a derivation has nothing to justify.\n /\n OPERATOR_PROMOTION = 'operator_promotion',\n}\n\n/\n An organization whose type resolved to nothing — none stored, or one no longer declared — was assigned one by the\n * engine at boot.\n \n ## Why this is its own event rather than an `ORGANIZATION_UPDATED`\n \n An organization's type is not a label. It decides which user types its members hold, which authentication\n * methods they may use, and which step-up policy applies to them — so assigning one changes what every member of\n * that tenant can do at sign-in. Folded into a generic `changes` map it would be an authentication-relevant\n * change with no actor, filed where an access review does not look.\n \n ## Who the actor is, per basis\n \n For the two DERIVATIONS there is none, and that is the point: organizations minted before the type was required\n * (the platform's own seeds, the first-administrator bootstrap) were typeless, and the engine repairs them before\n * the first read that would refuse them. `basis` is what makes that repair legible as a derivation instead of a\n * write nobody made, and those rows carry no `userId` because the application-scope repair has no initiator.\n \n For {@link OrganizationTypeAssignmentBasis.OPERATOR_PROMOTION} there IS one. It rides where every other\n * operator action's actor does — on the audit ROW, resolved from the execution context — rather than as a field\n * here, so an access review reads it the same way it reads a suspension or an ownership grant. What this schema\n * adds for that basis is the one thing the row cannot carry: the operator's stated REASON (`RESOURCE_OPERATION_PERFORMED`\n * carries no request payload, which is how `grantOwnership`'s required justification went unrecorded for months — #593).\n \n assurance-control: WILDO.AUDIT.SECURITY_EVENT — an authentication-relevant attribute of a tenant changed, and the\n * record says what decided it and, when a person did, who and why.\n /\nexport const AuditableEvent_Organization_TypeAssignedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_TYPE_ASSIGNED),\n organizationId: z.string(),\n /* The declared organization type now stored on the row. /\n organizationType: z.string(),\n /\n The type the row stored before, when it stored one the configuration no longer declares. Absent for an organization\n * that had no type. Recorded because this assignment REPLACES a value someone once chose: a type removed from the\n * declaration by mistake is recovered from exactly this field.\n /\n previousType: z.string().optional(),\n basis: z.enum(OrganizationTypeAssignmentBasis),\n /\n The operator's stated reason, on the ONE basis that has a person behind it —\n * {@link OrganizationTypeAssignmentBasis.OPERATOR_PROMOTION}, whose `requestDto` requires it.\n \n Optional on the schema because the two derivation bases have nothing to justify: a required field\n * would force the boot repair to invent a sentence, and an invented justification is worse than an\n * absent one — it reads as a decision somebody made.\n \n Recorded HERE rather than left on the request because a required field nothing stores is a promise\n * nobody keeps, and `RESOURCE_OPERATION_PERFORMED` (which the CRITICAL promotion also emits) carries\n * no request payload.\n /\n justification: z.string().optional(),\n});\n\nexport const AuditableEvent_Organization_DeletedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_DELETED),\n organizationId: z.string(),\n name: z.string(),\n slug: z.string(),\n deletedBy: z.string(),\n reason: z.string().optional(),\n});\n\n/\n A tenant was MARKED for deletion — the soft-delete half of tenant teardown.\n \n Kept SEPARATE from {@link AuditableEvent_Organization_DeletedEventDataSchema} rather than folded\n * into it with a flag, because the two record genuinely different facts and an auditor must not\n * have to infer which one happened. This event says the tenant's access was revoked and its data\n was scheduled for destruction; `ORGANIZATION_DELETED` says the data is gone. Between them sits\n a retention window in which the decision is still reversible, and a single merged event would\n * make \"was this tenant's data actually destroyed?\" unanswerable without correlating timestamps.\n \n It is also the evidence for the AUTHORIZATION consequence, which lands here and not at the purge:\n * user types revoked and tokens invalidated. `revokedUserTypeCount` records the blast radius of that\n * revocation without naming the users — the per-user detail belongs to the user-type events, and\n * duplicating identities into a tenant-scoped record would widen the personal data this row holds.\n \n assurance-control: WILDO.DATA.SECURE_LIFECYCLE — scheduling the destruction\n * of a tenant is a security-relevant, attributable decision that must leave evidence even when it\n * is later reversed.\n /\nexport const AuditableEvent_Organization_DeletionRequestedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_DELETION_REQUESTED),\n organizationId: z.string(),\n name: z.string(),\n slug: z.string(),\n /* The ACTOR. On the `admin` variant they are not a member of the tenant being marked. /\n requestedBy: z.string(),\n /* When the purge batch becomes allowed to destroy the tenant — the promise made to it. /\n purgeScheduledAt: z.string(),\n /* How many users lost at least one global `userTypes` grant as a result of the mark. /\n revokedUserTypeCount: z.number().int().min(0),\n reason: z.string().optional(),\n});\n\n/\n A pending tenant deletion was CANCELLED inside its retention window.\n \n The closing half of {@link AuditableEvent_Organization_DeletionRequestedEventDataSchema}. Without\n * it the audit trail records every scheduled destruction and none of the reversals, so a tenant\n * that was marked and restored a year ago still reads as pending destruction — and an access review\n * asking \"why does this tenant have live members again?\" has no answer on record.\n \n assurance-control: WILDO.ACCESS.LIFECYCLE — restoring access is as attributable as removing it.\n /\nexport const AuditableEvent_Organization_RestoredEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_RESTORED),\n organizationId: z.string(),\n name: z.string(),\n slug: z.string(),\n /* The ACTOR — always a platform super-administrator; a marked tenant cannot restore itself. /\n restoredBy: z.string(),\n /* The status the tenant was returned to. /\n restoredStatus: z.string(),\n /* How many users had at least one global `userTypes` grant re-granted by the restore. /\n regrantedUserTypeCount: z.number().int().min(0),\n reason: z.string().optional(),\n});\n\n/\n The tenant was administratively HALTED — every member loses their organization roles.\n \n ## Why this is its own event rather than an `ORGANIZATION_UPDATED`\n \n Suspension is not a field edit. Since the tenant-status authority gate shipped, `SUSPENDED` is a\n * state in which a membership confers NOTHING — so this single write revokes the access of every\n * member of the tenant at once. Folding that into the generic update event would bury an\n * organization-wide access revocation inside a `changes` map, exactly where an access review would\n * not look for it.\n \n `suspensionReason` is REQUIRED, mirroring the request contract, because the reason is the whole\n * evidentiary point: an auditor asking \"why was this tenant halted?\" must not get a shrug.\n * `notifiedMembers` records whether the tenant was told — a deliberately quiet suspension is a\n * legitimate operator choice and one a reviewer needs to be able to see.\n \n assurance-control: WILDO.AUDIT.SECURITY_EVENT — organization-wide access\n * revocation must be attributable, justified, and evidenced.\n /\nexport const AuditableEvent_Organization_SuspendedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_SUSPENDED),\n organizationId: z.string(),\n name: z.string(),\n slug: z.string(),\n /* The ACTOR — always a platform super-administrator; a tenant cannot suspend itself. /\n suspendedBy: z.string(),\n /* The status the tenant was halted FROM, so the transition is legible without a second lookup. /\n previousStatus: z.string(),\n suspensionReason: z.string(),\n /* Whether the tenant's members were emailed. A quiet suspension is a choice worth recording. /\n notifiedMembers: z.boolean(),\n /\n How many users lost at least one GLOBAL `userTypes` grant because this tenant stopped counting.\n \n A suspension does not only halt the tenant: a membership in a non-authority-conferring\n * organization no longer justifies a membership-derived global grant, so suspending an\n * organization can withdraw what it was vouching for platform-wide. That reach is exactly what an\n * access review needs to see, and it is invisible from the status change alone.\n /\n revokedUserTypeCount: z.number().int().min(0),\n});\n\n/\n A halted or expired tenant was returned to normal operation — the inverse of\n * {@link AuditableEvent_Organization_SuspendedEventDataSchema}.\n \n Restoring organization-wide access is as security-relevant as removing it, and without this event\n * the trail would record every suspension and none of the lifts — leaving a tenant that was halted\n * and reinstated a year ago still reading as suspended.\n \n `previousStatus` distinguishes the two journeys this operation serves: lifting a suspension\n * (`SUSPENDED`) and converting an expired trial (`TRIAL_EXPIRED`). They land on the same state and\n * are not the same event to a reviewer.\n \n assurance-control: WILDO.AUDIT.SECURITY_EVENT — reinstatement of access is attributable.\n /\nexport const AuditableEvent_Organization_ActivatedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_ACTIVATED),\n organizationId: z.string(),\n name: z.string(),\n slug: z.string(),\n /* The ACTOR — always a platform super-administrator. /\n activatedBy: z.string(),\n /* `SUSPENDED` (a lift) or `TRIAL_EXPIRED` (a conversion) — not the same journey. /\n previousStatus: z.string(),\n /* How many users had at least one global `userTypes` grant restored by the reactivation. /\n regrantedUserTypeCount: z.number().int().min(0),\n reason: z.string().optional(),\n});\n\n/\n One user type's authentication-policy snapshot — the COMPLETE authored `UserTypeAuthPolicy` (MFA,\n * password, lockout, enabled auth methods, step-up, session duration, …) as recorded in the trail.\n \n The whole policy is captured, not a hand-picked subset, so no posture axis escapes the record: a\n * weakening is as easily \"disable the MFA auth method\" (`authMethodsEnabled`) or \"drop step-up\"\n * (`stepUpAuth`) as \"turn `requireMFA` off\". The policy carries only booleans / numbers / enums —\n * never a secret — so recording it verbatim discloses nothing sensitive.\n \n Deliberately STRUCTURAL (an open record) rather than a reference to the live `UserTypeAuthPolicy`\n * config schema. An audit record is a historical fact: it must keep validating after the config\n * schema evolves, so it stores the policy as it was at that boot rather than re-validating it against\n * today's shape. The queryable summary lives in `changedUserTypes` + `snapshotDigest`; this object\n * carries the human-readable before/after detail.\n /\nexport const ApplicationAuthPolicySnapshotSchema = z.record(z.string(), z.unknown());\n\n/\n The application's authored authentication or audit-viewer admission policy changed between two boots.\n \n The per-user-type authentication policy (`userTypes.<type>.auth` — MFA, password, and lockout\n * requirements) is STATIC application configuration authored in code and taken into effect at backend\n * startup. A change to it — most consequentially a WEAKENING such as turning MFA off — is a\n * security-posture decision that, before this event, left no product-side record: only the source\n * history showed it. This event closes that gap. The effective `auditTrail.applicationReadAccess`\n * posture is recorded separately from the user-type snapshots and compared independently.\n \n It is emitted at boot, by the system, when the resolved policy snapshot differs from the last one\n * recorded in the trail (detected by comparing against the most recent event of this type for the\n * application). Because there is no human actor at boot, the \"who\" is the deployment/source history;\n * the event records WHAT changed (before → after per user type) so a reviewer sees the posture shift\n * without reading the codebase.\n \n Scope note: this is the per-application AUTHORED baseline. It does NOT enumerate per-tenant\n * `authOverrides` (which are per-(user-type × org-type) and require live tenants to resolve), nor the\n * authenticate-time `FALLBACK_AUTH_POLICY` (a runtime substitute used only when no user type\n * resolves, not authored config).\n \n assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — a change to the authentication assurance\n * requirements (MFA / password / lockout) must be attributable and evidenced.\n /\nexport const AuditableEvent_ApplicationAuthPolicyChanged_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.APPLICATION_AUTH_POLICY_CHANGED),\n // The owning application identity lives on the audit row, resolved by the shared writer before\n // database/SIEM/immutable-sink fanout. It is not duplicated inside this policy payload.\n /* Which user types' policies differed. Sorted; empty when only the audit-viewer access posture changed. /\n changedUserTypes: z.array(z.string()),\n /\n A stable digest of the `after` snapshot. Boot change-detection compares the current digest\n * against the digest carried by the most recent recorded event of this type; equal digests are the\n * authentication-policy comparison. Audit-viewer access is compared independently; equal digests\n * alone do not suppress an access-policy change.\n /\n snapshotDigest: z.string(),\n /\n The previously-recorded per-user-type policy snapshot, or `null` when this is the first snapshot\n * ever recorded for the application (the baseline row). Keys are user-type identifiers.\n /\n before: z.record(z.string(), ApplicationAuthPolicySnapshotSchema).nullable(),\n /* The per-user-type policy snapshot that took effect at this boot. Keys are user-type identifiers. /\n after: z.record(z.string(), ApplicationAuthPolicySnapshotSchema),\n /\n Effective audit-viewer access posture, separately typed from authentication user types.\n * Absent on historical events predating this evidence. A null before means no prior recorded\n * policy is known, not that an earlier deployment was strict or role based.\n /\n auditApplicationReadAccess: z.object({\n before: z.enum(AuditApplicationReadAccess).nullable(),\n after: z.enum(AuditApplicationReadAccess),\n }).optional(),\n});\n\n/\n A governed lifecycle transition changed a subject's `status`.\n \n Emitted by the shared status-transition implementation, so every verb it serves is trailed by\n * construction and a future one inherits the trail rather than having to remember it. Before this\n * existed those verbs emitted NOTHING: suspending a member (CRITICAL) or a user (HIGH) left no\n * record at all, while suspending a TENANT was fully attributable — an asymmetry an access review\n * would have to discover the hard way.\n \n `reason` is where the verbs' long-declared `reason` / `suspensionReason` fields finally land.\n * They are not persisted on the row: a suspension reason is a compliance artefact nothing reads\n * back, so the trail is its home rather than a schema column that would have to be scrubbed on\n * erasure.\n \n assurance-control: WILDO.AUDIT.SECURITY_EVENT — a change to whether a principal may act must be\n * attributable, justified and evidenced, on every resource that has such a state.\n /\nexport const AuditableEvent_Resource_StatusTransitionPerformedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.RESOURCE_STATUS_TRANSITION_PERFORMED),\n /* Which resource the subject row belongs to — half of the verb discriminator. /\n resourceType: z.string(),\n /* The lifecycle verb that ran (`suspend`, `reactivate`, `suspend_user`, …). /\n operationIdentifier: z.string(),\n /* The row whose status changed. /\n subjectId: z.string(),\n /* The ACTOR who performed it, or the system principal when the reactivation sweep ran it. /\n performedBy: z.string(),\n /* The status transitioned FROM, so the change is legible without a second lookup. /\n previousStatus: z.string(),\n /* The status transitioned TO. /\n newStatus: z.string(),\n /* The caller's justification, where the verb's contract accepts one. /\n reason: z.string().optional(),\n /\n When an automated sweep will undo this, if the caller time-boxed it. ISO-8601.\n \n Recorded because \"suspended for 7 days\" and \"suspended indefinitely\" are materially different\n * decisions that would otherwise be indistinguishable in the trail.\n /\n scheduledReactivationAt: z.string().optional(),\n /* Present when the subject is tenant-scoped, so the trail routes to that tenant's SIEM. /\n organizationId: z.string().optional(),\n});\n\nexport const AuditableEvent_OrganizationNotifications_UpdatedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_NOTIFICATIONS_UPDATED),\n organizationId: z.string(),\n notificationsId: z.string(),\n changes: z.record(z.string(), z.any()),\n updatedBy: z.string(),\n});\n\nexport const AuditableEvent_OrganizationPreferences_UpdatedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_PREFERENCES_UPDATED),\n organizationId: z.string(),\n preferencesId: z.string(),\n changes: z.record(z.string(), z.any()),\n updatedBy: z.string(),\n});\n\nexport const AuditableEvent_OrganizationProfile_UpdatedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_PROFILE_UPDATED),\n organizationId: z.string(),\n profileId: z.string(),\n changes: z.record(z.string(), z.any()),\n updatedBy: z.string(),\n});\n\nexport const AuditableEvent_OrganizationUnit_UpdatedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_UNIT_UPDATED),\n organizationId: z.string(),\n unitId: z.string(),\n changes: z.record(z.string(), z.any()),\n updatedBy: z.string(),\n});\n\n// SSO Authentication Event Data Schemas\n\nexport const AuditableEvent_User_SSOLoginEventDataSchema = z.object({\n assurance: ExternalAssuranceAssessmentSchema.optional(),\n eventType: z.literal(CoreAuditableEventType.USER_SSO_LOGIN),\n userId: z.string(),\n email: z.email(),\n providerRef: z.string(),\n connectionType: z.enum(SsoConnectionType),\n authSource: z.string().optional(),\n scopeType: z.enum(AuthScopeType).optional(),\n organizationId: z.string().optional(),\n applicationId: z.string().optional(),\n ipAddress: z.string(),\n userAgent: z.string(),\n sessionId: z.string(),\n}).superRefine((event, ctx) => {\n if (event.connectionType === SsoConnectionType.SOCIAL) {\n if (\n event.scopeType !== undefined\n \|\| event.organizationId !== undefined\n \|\| event.applicationId !== undefined\n ) {\n ctx.addIssue({\n code: 'custom',\n path: ['scopeType'],\n message: 'Social SSO audit events must not carry enterprise scope',\n });\n }\n return;\n }\n\n const hasOrganizationScope =\n event.scopeType === AuthScopeType.ORGANIZATION\n && event.organizationId !== undefined\n && event.applicationId === undefined;\n const hasApplicationScope =\n event.scopeType === AuthScopeType.APPLICATION\n && event.applicationId !== undefined\n && event.organizationId === undefined;\n if (!hasOrganizationScope && !hasApplicationScope) {\n ctx.addIssue({\n code: 'custom',\n path: ['scopeType'],\n message: 'Enterprise SSO audit events require exactly one explicit tenant scope',\n });\n }\n});\n\nexport const AuditableEvent_User_SSOLoginFailedEventDataSchema = z.object({\n assurance: ExternalAssuranceAssessmentSchema.optional(),\n eventType: z.literal(CoreAuditableEventType.USER_SSO_LOGIN_FAILED),\n email: z.email().optional(),\n providerRef: z.string().optional(),\n connectionType: z.enum(SsoConnectionType).optional(),\n authSource: z.string().optional(),\n failureReason: z.string(),\n scopeType: z.enum(AuthScopeType).optional(),\n organizationId: z.string().optional(),\n applicationId: z.string().optional(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n/\n A sign-in was refused because the claiming scope requires SSO (#1242).\n \n `organizationId` was REQUIRED here, and that is what made the event unemittable at half its own\n * refusal sites: `enforcement.requireSSO` lives on the POLYMORPHIC SSO config, so an APPLICATION-scope\n * policy refuses sign-ins for the application itself and there is no organization to name. Requiring\n * one would have left exactly those refusals with no trail — the outcome this CRITICAL event exists to\n * prevent. It now carries either scope and refuses anything but exactly one, following\n * `EMERGENCY_ACCESS_USED`, which was widened for the same reason on the same config.\n \n `attemptedProviderRef` and `attemptedConnectionType` are OPTIONAL because two of the four refusal\n * sites have no attempted provider at all: a password sign-in and a registration are refused BECAUSE\n * no SSO was attempted. Requiring them would have forced a placeholder, and a placeholder in an\n * audit row is worse than an absent field — it is a fact nobody can distinguish from a real one.\n /\nexport const AuditableEvent_User_SSOEnforcementBlockedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_SSO_ENFORCEMENT_BLOCKED),\n email: z.email(),\n attemptedProviderRef: z.string().optional(),\n attemptedConnectionType: z.enum(SsoConnectionType).optional(),\n scopeType: z.enum(AuthScopeType),\n organizationId: z.string().optional(),\n applicationId: z.string().optional(),\n enforcementPolicy: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n}).superRefine((event, ctx) => {\n const hasOrganizationScope =\n event.scopeType === AuthScopeType.ORGANIZATION\n && event.organizationId !== undefined\n && event.applicationId === undefined;\n const hasApplicationScope =\n event.scopeType === AuthScopeType.APPLICATION\n && event.applicationId !== undefined\n && event.organizationId === undefined;\n if (!hasOrganizationScope && !hasApplicationScope) {\n ctx.addIssue({\n code: 'custom',\n path: ['scopeType'],\n message: 'SSO-enforcement-blocked events require exactly one explicit tenant scope',\n });\n }\n});\n\nexport const AuditableEvent_User_TokenRefreshedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_TOKEN_REFRESHED),\n userId: z.string(),\n sessionId: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n// Organization Security Management Event Data Schemas\n\nexport const AuditableEvent_Organization_SSOConfigurationChangedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_SSO_CONFIGURATION_CHANGED),\n organizationId: z.string(),\n changedBy: z.string(),\n changeType: z.enum(SsoConfigChangeType),\n affectedProviderRef: z.string().optional(),\n changes: z.record(z.string(), z.any()).optional(),\n});\n\n\n\n/\n The fields every SIEM export-configuration event carries; three kinds share them (#986) and differ\n * only in what they SAY happened, which is what a SIEM rule keys on.\n /\nconst SIEM_EXPORT_CONFIGURATION_EVENT_FIELDS = {\n organizationId: z.string(),\n changedBy: z.string(),\n changeType: z.enum(SiemExportChangeType),\n /* The destination HOST only — a collector secret can live in the URL path, and this row is immutable. /\n webhookUrlDomain: z.string().optional(),\n eventFormatConfigured: z.string().optional(),\n /* NAMES of the configuration fields the write changed; never their values (the credential is among them). /\n changedFields: z.array(z.string()).optional(),\n} as const;\n\nexport const AuditableEvent_Organization_SIEMExportConfiguredEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_SIEM_EXPORT_CONFIGURED),\n ...SIEM_EXPORT_CONFIGURATION_EVENT_FIELDS,\n});\n\n/* Export turned OFF (#986). Same fields; its own kind so it classifies CRITICAL. /\nexport const AuditableEvent_Organization_SIEMExportDisabledEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_SIEM_EXPORT_DISABLED),\n ...SIEM_EXPORT_CONFIGURATION_EVENT_FIELDS,\n});\n\n/* Export re-pointed at another destination (#986). Same fields; its own kind so it classifies WARNING. /\nexport const AuditableEvent_Organization_SIEMExportDestinationChangedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_SIEM_EXPORT_DESTINATION_CHANGED),\n ...SIEM_EXPORT_CONFIGURATION_EVENT_FIELDS,\n});\n\n\n\n// Organization Provider Credential Event Data Schemas\n//\n// ## The value is absent by CONSTRUCTION\n//\n// Every field below is an identifier, a timestamp, a closed vocabulary or a count. There is no\n// free-text field an implementation could put a secret in by accident, and no `changes` /\n// `metadata` record — the shape the SSO event uses (`z.record(z.string(), z.any())`) is exactly\n// what a credential event must not have, because an audit row is replicated to the organization's\n// SIEM and to the immutable store, and neither can be edited afterwards.\n//\n// ## Why a provider ref and a slug, and nothing about the value\n//\n// A reader needs to know WHICH authority moved. `providerRef` + `secretSlug` say that completely.\n// A fingerprint of the value was considered and rejected: it is a stable oracle for confirming a\n// guessed secret, so it would put a verification oracle into the one store designed never to\n// forget.\n\n/\n A tenant granted this application authority to act as it toward a third party.\n \n assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — organization authorizes delegated\n * access to a named third party.\n /\nexport const AuditableEvent_OrganizationProviderCredential_SetEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_SET),\n organizationId: z.string(),\n providerRef: z.string(),\n secretSlug: z.string(),\n /* The acting administrator. Absent only on a system-initiated write, which none exists today. /\n setBy: z.string().optional(),\n credentialId: z.string(),\n});\n\n/\n The stored VALUE changed for a credential that already existed.\n \n Separate from `_SET` because rotation is the response to a suspected compromise, and \"was this\n * rotated after the incident?\" must be answerable without reading every configuration edit.\n \n assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — the delegated authority's secret is\n * replaced.\n /\nexport const AuditableEvent_OrganizationProviderCredential_RotatedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_ROTATED),\n organizationId: z.string(),\n providerRef: z.string(),\n secretSlug: z.string(),\n rotatedBy: z.string().optional(),\n credentialId: z.string(),\n /* When the value it replaced was set — how long the retired secret was live. /\n previousSecretSetAt: z.string().optional(),\n});\n\n/\n The credential was RESOLVED for an outbound call — the application acted as the tenant.\n \n The highest-volume of the four and the one that makes the other three worth having: without a\n * use event, a leaked credential's exploitation is invisible and only its configuration is\n * recorded. `resolvedFrom` distinguishes a tenant's own credential from the deployment-wide\n * environment fallback, which is precisely the distinction this whole resource exists to make\n * visible — a tenant silently acting as the shared principal is the defect, and here it is a\n * value in a field rather than something nobody can see.\n \n assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — delegated authority is exercised.\n /\nexport const AuditableEvent_OrganizationProviderCredential_UsedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_USED),\n organizationId: z.string(),\n providerRef: z.string(),\n secretSlug: z.string(),\n resolvedFrom: z.enum(ProviderCredentialResolutionSource),\n /* Absent when `resolvedFrom` is the deployment environment — there is no row to name. /\n credentialId: z.string().optional(),\n /\n WHOSE credential was spent: the member who set it. For a USER-delegated organization connection\n * that is the person whose own vendor account every member's call acts through — the vendor\n * attributes the act to them, so the trail must too (decision on wildo-ai/wildo-ai#18). Absent for\n * a deployment-environment resolution, and for a row set with no recorded member.\n /\n credentialSetByUserId: z.string().optional(),\n});\n\n/\n The grant ended — by the tenant removing it, or by the tenant itself being purged.\n \n `reason` separates the two, because \"the credential is gone\" means different things to an\n * incident reviewer depending on whether a human revoked it or a cascade removed it.\n \n assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — evidence that delegated authority\n * was withdrawn.\n /\nexport const AuditableEvent_OrganizationProviderCredential_DeletedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_DELETED),\n organizationId: z.string(),\n providerRef: z.string(),\n secretSlug: z.string(),\n deletedBy: z.string().optional(),\n credentialId: z.string(),\n reason: z.enum(ProviderCredentialDeletionReason),\n /\n What telling the VENDOR achieved, when the delete ended an OAuth2 grant (#545).\n \n Deleting our copy stops the application using a token; it does not end the grant at the vendor,\n * and a refresh token frequently never expires on its own. So this field is the difference between\n * a trail that says \"we deleted our copy\" and one that says whether the person's access was\n * actually withdrawn where it lives.\n \n ABSENT rather than a member when nothing was attempted — an organization purge through the raw\n * repository has no token to hand back. `not_declared` is the ordinary answer for a vendor whose\n * revocation is not RFC 7009-shaped, and for a pasted credential that was never a grant; it is a\n * recorded fact, not a failure.\n /\n vendorRevocation: z.enum(ProviderOAuth2RevocationOutcomeValues).optional(),\n});\n\n/\n A PERSON connected their own account at a third party to this application.\n \n The organization's four events say \"this tenant authorized the application\". These four say \"this\n * individual did\", and the difference is not cosmetic: the vendor will attribute every resulting act\n * to that person's account, so the trail that answers \"who authorized this\" has to name them.\n \n `userId` is the subject, not the actor, and the two are the same here BY CONSTRUCTION — the\n * resource admits no administrative variant, so nobody but the holder can write one of these rows.\n * That is why there is no `setBy`: an organization credential needs one because several\n * administrators can write the tenant's row, and a person's own credential has exactly one possible\n * author. A `setBy` that could only ever repeat `userId` would invite a future reader to believe the\n * two can differ.\n \n assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — a user authorizes third-party\n * delegated access.\n /\nexport const AuditableEvent_UserProviderCredential_SetEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_SET),\n userId: z.string(),\n providerRef: z.string(),\n secretSlug: z.string(),\n credentialId: z.string(),\n});\n\n/\n A PERSON completed a consent ceremony at a vendor and this application now holds their grant.\n \n The subject and the actor are the same by construction — the resource admits no administrative\n * variant, and the connect leg refuses any owner but the caller — so there is no `grantedBy`.\n \n `grantedScopes` is what the VENDOR said it issued, not what was asked for. The two differ often\n * enough to matter: a vendor may narrow a request against what the account is permitted, and the\n * answer to \"what could this application actually do as them\" is the granted set. Optional because\n * several vendors return no scope at all on a token response, and an empty array would assert\n * something stronger than silence.\n \n assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — a user authorizes third-party\n * delegated access, and the authorization's extent is recorded with it.\n /\nexport const AuditableEvent_UserProviderConnection_GrantedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_PROVIDER_CONNECTION_GRANTED),\n userId: z.string(),\n providerRef: z.string(),\n secretSlug: z.string(),\n credentialId: z.string(),\n grantedScopes: z.array(z.string()).optional(),\n /\n WHICH account at the vendor — a workspace, a tenant, a directory. Never a secret, and the answer\n * to a question the row alone cannot settle: two people connecting the same provider may be\n * granting access to entirely different organizations of that vendor.\n /\n accountRef: z.string().optional(),\n /\n Whether this replaced a connection that already existed.\n \n A first connection and a re-authorization look identical in the row afterwards, and they are not\n * the same event to an auditor: a re-authorization frequently follows a revocation at the vendor,\n * which is exactly the sequence worth being able to see.\n /\n replacedExistingConnection: z.boolean(),\n});\n\n/\n An ORGANIZATION's delegated authorization toward a vendor was granted.\n \n Mirrors the person's event and is deliberately not the same event with a nullable user: the\n * subject is a tenant, the SIEM routing is the tenant's, and the data-protection reading differs —\n * a tenant's shared integration is not anybody's personal connection.\n \n `grantedByUserId` exists here and not on the user's, for the reason the `_SET` pair already\n * records: several administrators can authorize on a tenant's behalf, so WHO did is a real question.\n \n assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — an organization authorizes this\n * application to act as it toward a named third party.\n /\nexport const AuditableEvent_OrganizationProviderConnection_GrantedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_PROVIDER_CONNECTION_GRANTED),\n organizationId: z.string(),\n providerRef: z.string(),\n secretSlug: z.string(),\n credentialId: z.string(),\n grantedByUserId: z.string().optional(),\n grantedScopes: z.array(z.string()).optional(),\n accountRef: z.string().optional(),\n replacedExistingConnection: z.boolean(),\n /\n On whose behalf the linked account acts. `user` means `grantedByUserId` linked THEIR OWN vendor\n * account for the organization, and every member's call will act through it (decision on\n * wildo-ai/wildo-ai#18) — which is why the grantor is named and the acknowledgement below recorded.\n /\n delegation: z.enum(ExternalProvider_Connection_DelegationMode).optional(),\n /* The grantor acknowledged, before consenting at the vendor, that the whole organization will use their account. /\n organizationWideUseAcknowledged: z.boolean().optional(),\n});\n\n/\n The stored VALUE changed for a person's credential that already existed.\n \n Separate from `_SET` for the organization's reason — rotation answers \"was this replaced after the\n * incident?\" — and for one that is specific to a person: a credential someone rotates on their own\n * initiative is often the first evidence that they believe their vendor account was compromised.\n \n assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — the delegated authority's secret is\n * replaced.\n /\nexport const AuditableEvent_UserProviderCredential_RotatedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_ROTATED),\n userId: z.string(),\n providerRef: z.string(),\n secretSlug: z.string(),\n credentialId: z.string(),\n /* When the value it replaced was set — how long the retired secret was live. /\n previousSecretSetAt: z.string().optional(),\n});\n\n/\n The credential was RESOLVED for an outbound call — the application acted as that person.\n \n `resolvedFrom` is present for symmetry with the organization event but carries a narrower range:\n * a person's credential has NO fallback, because substituting the deployment's shared principal for\n * someone's own account would attribute the act to the wrong party at the vendor — the very\n * substitution the whole scope triangle exists to forbid. So this field reads\n * `USER_CREDENTIAL` on every event, and a reviewer seeing anything else is looking at a defect.\n \n assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — delegated authority is exercised.\n /\nexport const AuditableEvent_UserProviderCredential_UsedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_USED),\n userId: z.string(),\n providerRef: z.string(),\n secretSlug: z.string(),\n resolvedFrom: z.enum(ProviderCredentialResolutionSource),\n credentialId: z.string(),\n});\n\n/\n The person's grant ended — by them removing it, by their own erasure, or by their account being deleted.\n \n `reason` matters more here than on the organization sibling. A credential removed by a cascade\n * from a subject-erasure request is EVIDENCE that the erasure reached this store, and it is the\n * evidence an operator produces when asked whether a person's third-party keys were destroyed. The\n * row itself is gone by then, so the event is all that remains.\n \n `deletedBy` exists for the one reason whose actor is NOT the person: `reason: USER_DELETED`, an\n * account deletion (#1016) — an administrator's hard delete or the invitation sweep reaping a pending\n * user — where it names the deleting principal (the administrator's user id, or the `SYSTEM` sentinel).\n * Absent on the owner's own revoke, whose actor is `userId` by construction.\n \n assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — evidence that delegated authority\n * was withdrawn.\n * assurance-control: WILDO.PRIVACY.ERASURE_PROPAGATION — evidence that erasure destroyed the\n * subject's third-party credentials: one row per destroyed credential with `reason: USER_ERASED`,\n * written by the credential resource's parent-cascade removal observer because the erasure cascade\n * removes these rows through the raw repository (#975).\n /\nexport const AuditableEvent_UserProviderCredential_DeletedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_DELETED),\n userId: z.string(),\n providerRef: z.string(),\n secretSlug: z.string(),\n deletedBy: z.string().optional(),\n credentialId: z.string(),\n reason: z.enum(ProviderCredentialDeletionReason),\n /\n What telling the VENDOR achieved, when the delete ended an OAuth2 grant (#545).\n \n Deleting our copy stops the application using a token; it does not end the grant at the vendor,\n * and a refresh token frequently never expires on its own. So this field is the difference between\n * a trail that says \"we deleted our copy\" and one that says whether the person's access was\n * actually withdrawn where it lives.\n \n ABSENT rather than a member when nothing was attempted — an organization purge through the raw\n * repository has no token to hand back. `not_declared` is the ordinary answer for a vendor whose\n * revocation is not RFC 7009-shaped, and for a pasted credential that was never a grant; it is a\n * recorded fact, not a failure.\n /\n vendorRevocation: z.enum(ProviderOAuth2RevocationOutcomeValues).optional(),\n});\n\n\n\n// Outbound M2M Webhook Event Data Schemas\n\n/\n One `webhookConfig.testEndpoint` attempt — an admin causing the platform to open an\n * outbound connection to an operator-supplied URL.\n \n Recorded for EVERY attempt, not only failures: the security signal here is the pattern\n * (who probes which hosts, how often), which a SIEM can only derive if successes are\n * present too. `outcome` distinguishes a refusing endpoint from an unreachable one from a\n * local signing fault, so the stream stays diagnosable without the response body.\n \n `destinationHost` carries the host only, never the full URL — mirroring\n * `AuditableEvent_Organization_SIEMExportConfiguredEventDataSchema.webhookUrlDomain`. Paths\n * and query strings on customer endpoints routinely embed per-tenant tokens, and an audit\n * row is replicated to the org SIEM and the immutable store.\n /\nexport const AuditableEvent_Webhook_EndpointTestDispatchedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.WEBHOOK_ENDPOINT_TEST_DISPATCHED),\n /* Scope that owns the config — exactly one of these is set, per the polymorphic variant. /\n organizationId: z.string().optional(),\n applicationId: z.string().optional(),\n /* Admin who fired the probe. /\n dispatchedBy: z.string(),\n endpointId: z.string(),\n /* Host component only — see the schema JSDoc for why the full URL is withheld. /\n destinationHost: z.string(),\n outcome: z.enum(WebhookEndpointProbeOutcome),\n responseStatus: z.number().int().optional(),\n durationMs: z.number().int().nonnegative(),\n /* `jti` of the signed probe, for correlation with the consumer's own logs. /\n signatureJti: z.string(),\n});\n\n\n\n// SCIM Directory Provisioning Event Data Schemas\n\nexport const AuditableEvent_SCIM_TokenCreatedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.SCIM_TOKEN_CREATED),\n organizationId: z.string(),\n tokenDisplayName: z.string(),\n createdByUserId: z.string(),\n expiresAt: z.string().optional(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\nexport const AuditableEvent_SCIM_TokenRevokedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.SCIM_TOKEN_REVOKED),\n organizationId: z.string(),\n tokenDisplayName: z.string(),\n revokedByUserId: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\n// SCIM User Provisioning Event Data Schemas (H5+H8)\n\nexport const AuditableEvent_SCIM_UserProvisionedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.SCIM_USER_PROVISIONED),\n organizationId: z.string(),\n userId: z.string(),\n email: z.string(),\n isNewUser: z.boolean(),\n provisionedVia: z.string(),\n authSource: z.string().optional(),\n});\n\n\n\nexport const AuditableEvent_SCIM_UserUpdatedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.SCIM_USER_UPDATED),\n organizationId: z.string(),\n userId: z.string(),\n operation: z.string(),\n updatedAttributes: z.array(z.string()).optional(),\n});\n\n\n\nexport const AuditableEvent_SCIM_UserDeactivatedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.SCIM_USER_DEACTIVATED),\n organizationId: z.string(),\n userId: z.string(),\n email: z.string().optional(),\n});\n\n\n\n// Password Reset Event Data Schemas (H5)\n\nexport const AuditableEvent_User_PasswordResetRequestedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_PASSWORD_RESET_REQUESTED),\n email: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n/\n Administrator-compelled credential reset.\n \n Carries BOTH identities because the actor and the subject differ — that separation is the\n * whole point of the event. `actorUserId` is read from the authenticated execution context,\n * never from request input, so it cannot be spoofed by the caller. `reason` is the operator's\n * mandatory justification; it is what an auditor reads when asking why a credential was reset\n * out-of-band.\n \n assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — privileged credential\n * intervention must be attributable to the acting administrator and carry a justification.\n /\nexport const AuditableEvent_User_PasswordResetForcedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_PASSWORD_RESET_FORCED),\n targetUserId: z.string(),\n targetEmail: z.string(),\n actorUserId: z.string(),\n reason: z.string(),\n /* Whether the target's active sessions were revoked as part of the reset. /\n sessionsRevoked: z.boolean(),\n /\n Transport metadata, OPTIONAL because this event's only producer is a resource operation.\n \n The auth controllers thread `ipAddress` / `userAgent` down from the Express request, but a\n * resource-operation custom implementation receives an `ExecutionContext`, which carries\n * identity and no transport detail. Rather than stamping a fabricated `'unknown'` that reads\n * like a captured value, the fields are omitted and correlation runs through the request log.\n * They become populated if transport metadata is ever threaded onto the execution context.\n /\n ipAddress: z.string().optional(),\n userAgent: z.string().optional(),\n});\n\n\n\nexport const AuditableEvent_User_PasswordResetCompletedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_PASSWORD_RESET_COMPLETED),\n userId: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\n// Registration & Verification Event Data Schemas (H5)\n\nexport const AuditableEvent_User_RegisteredEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_REGISTERED),\n userId: z.string(),\n email: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n /\n HOW the account was acquired — the same vocabulary the registration policy is authored in, so \"who\n * registered through which door\" is answered by the trail rather than reconstructed from neighbouring\n * events. A first social or enterprise sign-in creates an account exactly as `/auth/register` does, and\n * until #1141 only the password door recorded it.\n \n Optional on the schema only because rows written before the field existed carry none; every emitter\n * states it (`logUserRegistered` requires it).\n /\n acquisitionChannel: z.enum(RegistrationAcquisitionChannel).optional(),\n /* The external identity provider that vouched for the account, for a social or enterprise sign-in. /\n providerRef: z.string().optional(),\n});\n\n\n\nexport const AuditableEvent_User_EmailVerifiedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_EMAIL_VERIFIED),\n userId: z.string(),\n email: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\nexport const AuditableEvent_User_VerificationEmailResentEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_VERIFICATION_EMAIL_RESENT),\n userId: z.string(),\n email: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\n// MFA Lifecycle Event Data Schemas (H5)\n\nexport const AuditableEvent_User_MFASetupStartedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_MFA_SETUP_STARTED),\n userId: z.string(),\n mfaMethod: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\nexport const AuditableEvent_User_MFASetupCompletedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_MFA_SETUP_COMPLETED),\n userId: z.string(),\n mfaMethod: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\nexport const AuditableEvent_User_MFAEmailOTPSentEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_MFA_EMAIL_OTP_SENT),\n email: z.string(),\n sessionId: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\n// WebAuthn/Passkey Event Data Schemas (Phase G1)\n\nexport const AuditableEvent_User_PasskeyRegisteredEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_PASSKEY_REGISTERED),\n userId: z.string(),\n email: z.string(),\n credentialId: z.string(),\n credentialName: z.string(),\n credentialDeviceType: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\nexport const AuditableEvent_User_PasskeyAuthSuccessEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_PASSKEY_AUTHENTICATION_SUCCESS),\n userId: z.string(),\n email: z.string(),\n credentialId: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n sessionId: z.string(),\n});\n\n\n\nexport const AuditableEvent_User_PasskeyAuthFailureEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_PASSKEY_AUTHENTICATION_FAILURE),\n email: z.string(),\n failureReason: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n sessionId: z.string(),\n});\n\n\n\n/\n A passkey assertion whose SIGNATURE VERIFIED and whose signature counter did not advance.\n \n This is the WebAuthn cloned-authenticator signal (W3C WebAuthn L3 §6.1.1: \"The signature\n * counter's purpose is to aid Relying Parties in detecting cloned authenticators\"). It is emitted\n * on the spec's own predicate — either counter non-zero AND the received value not greater than\n * the stored one — so a credential that reports 0 permanently, which every synced passkey does,\n * compares 0-against-0 and never reaches here.\n \n spec-cite: W3C Web Authentication Level 3, §6.1.1 Signature Counter Considerations\n * (https://www.w3.org/TR/webauthn-3/#sctn-sign-counter). The spec declines to mandate an outcome\n * (§7.2 step 22: \"whether the Relying Party ... fails the authentication ceremony or not, is\n * Relying Party-specific\"); Wildo refuses, matching what every major implementation does.\n \n SEPARATE from `USER_PASSKEY_AUTHENTICATION_FAILURE` deliberately. A wrong credential, an absent\n * challenge and a bad signature are routine noise; this one means a private key may exist in two\n * places. Recorded as its own type at CRITICAL so it is alertable rather than buried among ordinary\n * failed logins — which is exactly where it lived until 2026-09-08.\n \n The device-type, backup and AAGUID fields are carried for TRIAGE, never for a decision: nothing\n * branches on them. A synced credential that once reported a non-zero counter and then regresses is\n * still a signal, and exempting by device type would silently disable clone detection for the\n * growing majority of credentials.\n /\n/\n One file that a scanner concluded is infected (#506).\n \n `threatName` is the scanner's own signature or rule name (`Eicar-Test-Signature`, a YARA rule id).\n * It is carried because it is the first thing a responder needs and it names a THREAT, not a person\n * — unlike a file name, which is user-supplied content and is deliberately absent: audit rows are\n * replicated to the organisation's SIEM and to the immutable store, and an uploaded file's name\n * routinely carries personal data (\"Invoice - Jane Doe.pdf\"). The file id resolves to the row for\n * anyone authorised to look.\n /\nexport const AuditableEvent_File_MalwareDetectedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.FILE_MALWARE_DETECTED),\n fileId: z.string(),\n /* Which scanner concluded it — ClamAV signature matching and YARA pattern matching are different evidence. /\n scannerRef: z.string(),\n /* The signature or rule the scanner matched, when it reports one. /\n threatName: z.string().optional(),\n /* The resource the file belongs to, when the scan context carries it. /\n resourceType: z.string().optional(),\n resourceId: z.string().optional(),\n organizationId: z.string().optional(),\n /* Terminal status the file was moved to. Recorded so the row cannot claim a state the record does not hold. /\n fileStatus: z.string(),\n});\n\n/\n One scan that could not be completed (#506).\n \n Distinct from a detection: the control did not run. `failureReason` is TRUNCATED because a scanner\n * error routinely embeds a host, a socket path or a temporary file path, and this row reaches the\n * organisation's SIEM.\n /\nexport const AuditableEvent_File_MalwareScanFailedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.FILE_MALWARE_SCAN_FAILED),\n fileId: z.string(),\n scannerRef: z.string(),\n /* Truncated scanner/pipeline error — enough to triage, bounded so a path cannot ride into the SIEM whole. /\n failureReason: z.string().optional(),\n resourceType: z.string().optional(),\n resourceId: z.string().optional(),\n organizationId: z.string().optional(),\n fileStatus: z.string(),\n});\n\nexport type AuditableEvent_File_MalwareDetectedEventData =\n z.infer<typeof AuditableEvent_File_MalwareDetectedEventDataSchema>;\nexport type AuditableEvent_File_MalwareScanFailedEventData =\n z.infer<typeof AuditableEvent_File_MalwareScanFailedEventDataSchema>;\n\n\nexport const AuditableEvent_User_PasskeyCloneSuspectedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_PASSKEY_CLONE_SUSPECTED),\n userId: z.string(),\n credentialId: z.string(),\n /* The counter Wildo held for this credential before the assertion. /\n storedCounter: z.number().int().min(0),\n /* The counter the authenticator reported. Not greater than `storedCounter`, which is the signal. /\n receivedCounter: z.number().int().min(0),\n /* Triage only: `singleDevice` or `multiDevice`, as captured at registration. /\n credentialDeviceType: z.string(),\n /* Triage only: whether the credential is backed up (synced), as captured at registration. /\n credentialBackedUp: z.boolean(),\n /* Triage only: the authenticator model identifier, when the registration reported one. /\n aaguid: z.string().optional(),\n /* Which door the assertion arrived at — a step-up regression is not the same story as a login. /\n ceremony: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\nexport const AuditableEvent_User_PasskeyRemovedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_PASSKEY_REMOVED),\n userId: z.string(),\n email: z.string(),\n credentialId: z.string(),\n credentialName: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\n// Magic Link Event Data Schemas (Phase G2)\n\nexport const AuditableEvent_User_MagicLinkSentEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_MAGIC_LINK_SENT),\n email: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\nexport const AuditableEvent_User_MagicLinkVerifiedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_MAGIC_LINK_VERIFIED),\n userId: z.string(),\n email: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n sessionId: z.string(),\n});\n\n\n\nexport const AuditableEvent_User_MagicLinkFailedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_MAGIC_LINK_FAILED),\n email: z.string().optional(),\n failureReason: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\n// SMS OTP Event Data Schemas (Phase G2)\n\nexport const AuditableEvent_User_SMSOTPSentEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_SMS_OTP_SENT),\n phoneNumber: z.string(),\n factorLevel: z.string(),\n sessionId: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\nexport const AuditableEvent_User_SMSOTPVerifiedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_SMS_OTP_VERIFIED),\n userId: z.string(),\n phoneNumber: z.string(),\n factorLevel: z.string(),\n sessionId: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\nexport const AuditableEvent_User_SMSOTPFailedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_SMS_OTP_FAILED),\n phoneNumber: z.string().optional(),\n factorLevel: z.string(),\n failureReason: z.string(),\n sessionId: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\n// Phone Verification Event Data Schemas (Phase G2)\n\nexport const AuditableEvent_User_PhoneVerifiedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_PHONE_VERIFIED),\n userId: z.string(),\n phoneNumber: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\nexport const AuditableEvent_User_PhoneVerificationFailedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_PHONE_VERIFICATION_FAILED),\n phoneNumber: z.string(),\n failureReason: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\n// OAuth2 Provider Restriction Event Data Schema (Phase G3)\n\nexport const AuditableEvent_OAuth2ProviderBlockedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.OAUTH2_PROVIDER_BLOCKED),\n email: z.string().optional(),\n providerRef: z.string(),\n scopeType: z.enum(AuthScopeType),\n organizationId: z.string().optional(),\n applicationId: z.string().optional(),\n reason: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n}).superRefine((event, ctx) => {\n const hasOrganizationScope =\n event.scopeType === AuthScopeType.ORGANIZATION\n && event.organizationId !== undefined\n && event.applicationId === undefined;\n const hasApplicationScope =\n event.scopeType === AuthScopeType.APPLICATION\n && event.applicationId !== undefined\n && event.organizationId === undefined;\n if (!hasOrganizationScope && !hasApplicationScope) {\n ctx.addIssue({\n code: 'custom',\n path: ['scopeType'],\n message: 'OAuth2 provider-blocked events require exactly one explicit tenant scope',\n });\n }\n});\n\nexport type AuditableEvent_OAuth2ProviderBlockedEventData = z.infer<typeof AuditableEvent_OAuth2ProviderBlockedEventDataSchema>;\n\n/\n Authentication-context demand unsatisfied (issue #444).\n \n Carries BOTH sides of the comparison, because either alone is unactionable: `demandedAcrValues`\n * is what the connection authored, `receivedAcr` is what the provider's ID token reported. The\n * received value is OPTIONAL and its absence is the distinct, common case — a provider that emits\n * no `acr` claim at all — which reads very differently from one that answered with a weaker\n * context, and an operator must be able to tell them apart from the trail alone.\n \n No email field. The refusal happens before any identity is established or trusted, and recording\n * an unauthenticated claimant's address as though it were a subject is the kind of quiet personal\n * data this family avoids; `providerRef` and the two ACR sides are what a reader needs.\n /\nexport const AuditableEvent_OidcAcrDemandUnsatisfiedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.OIDC_ACR_DEMAND_UNSATISFIED),\n providerRef: z.string(),\n /* The ordered list of acceptable values the connection authored. Never empty — an empty demand is not enforced at all. /\n demandedAcrValues: z.array(z.string()).min(1),\n /* What the ID token's `acr` claim reported. ABSENT when the provider emitted no claim. /\n receivedAcr: z.string().optional(),\n /* Present when the ID token itself could not be read, which is a different refusal from a mismatched claim. /\n failureReason: z.string().optional(),\n});\nexport type AuditableEvent_OidcAcrDemandUnsatisfiedEventData = z.infer<typeof AuditableEvent_OidcAcrDemandUnsatisfiedEventDataSchema>;\n\n// Emergency Access Event Data Schema\n\n/\n A named break-glass account signed in past its tenant's own SSO requirement (#423).\n \n `organizationId` was REQUIRED here and is now one of two scopes, because `emergencyAccess` lives\n * on the POLYMORPHIC SSO config: an application-scope policy carries break-glass accounts for the\n * application itself, and requiring an organization id would have made the one event that matters\n * unemittable for exactly that case — a privileged sign-in with no record, which is the opposite of\n * what this event is for. The exactly-one-scope refinement follows the OAuth2-provider-blocked\n * event above rather than inventing a second shape.\n /\nexport const AuditableEvent_EmergencyAccess_UsedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.EMERGENCY_ACCESS_USED),\n userId: z.string(),\n email: z.email(),\n scopeType: z.enum(AuthScopeType),\n organizationId: z.string().optional(),\n applicationId: z.string().optional(),\n reason: z.string().optional(),\n ipAddress: z.string(),\n userAgent: z.string(),\n sessionId: z.string(),\n}).superRefine((event, ctx) => {\n const hasOrganizationScope =\n event.scopeType === AuthScopeType.ORGANIZATION\n && event.organizationId !== undefined\n && event.applicationId === undefined;\n const hasApplicationScope =\n event.scopeType === AuthScopeType.APPLICATION\n && event.applicationId !== undefined\n && event.organizationId === undefined;\n if (!hasOrganizationScope && !hasApplicationScope) {\n ctx.addIssue({\n code: 'custom',\n path: ['scopeType'],\n message: 'Emergency-access events require exactly one explicit tenant scope',\n });\n }\n});\n\n\n\nexport const AuditableEvent_FieldAccess_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.FIELD_ACCESS),\n fieldName: z.string(),\n resourceType: z.string(),\n resourceId: z.string().optional(),\n operationIdentifier: z.string(),\n isCreateOperation: z.boolean(),\n // Machine-credential provenance when the ACCESSING principal is a machine (api-key / OAuth\n // client) rather than a human. Absent for user-authenticated access. Threads the credential id\n // + auth method onto the sensitive-field-access row so machine access is attributable — the\n // per-request counterpart to the dedicated MACHINE_AUTH_ events (machine-auth-hardening item 2).\n machineCredentialAuthMethod: z.string().optional(),\n machineCredentialId: z.string().optional(),\n});\n\n/*\n A resource operation took effect. The operation-triggered counterpart to\n * {@link AuditableEvent_FieldAccess_EventDataSchema}, which is triggered by a decorated RESPONSE\n * FIELD and is therefore blind to any operation whose response carries none.\n \n ## What the existence of this row asserts, and what it does not\n \n It is emitted from the framework-managed POST-COMMIT effects lane, so the row exists only for an\n * operation whose mutation is already durable. \"Performed\" is therefore the whole claim — there is\n * deliberately no `outcome` discriminator, because this emission point can never observe a failure.\n \n The absence of a row is NOT evidence that nothing happened; that is what makes audit-pipeline\n * failure detection (`audit_store_failure_total`, and the operation identity now carried on the\n * failure log line) a control in its own right rather than an operational nicety.\n \n Refusals are a different event and a different chokepoint. A denied operation never reaches\n * this lane — the authorization decision happens pre-dispatch, its volume is attacker-drivable, and\n * it needs rate-limit / dedup treatment this success path does not. Declaring a `DENIED` outcome\n * here that nothing produces would repeat the very defect this event exists to fix (20 event types\n * were authored in this enum and wired to nothing). That refusal event now exists and is emitted:\n * see {@link AuditableEvent_ResourceOperationDenied_EventDataSchema}, raised from the authorizer.\n * The two events are read together — this one for what happened, that one for what was stopped —\n * and neither carries an `outcome` discriminator, because each states its whole claim in its name.\n \n ## Operation identity is a TRIPLE\n \n `resourceType` + `operationIdentifier` + `variantKey`. Recording only the first two makes an\n * `admin` variant indistinguishable from a `self` variant — a distinction several polymorphic\n * resources encode in `variantKey` alone, and precisely the distinction an auditor is checking.\n \n ## Correlation across a cascade\n \n The framework-managed lane covers API, internal call and repository-only writes; OVERRIDE_ALL\n * implementations own their committed emission. A framework-managed tenant deletion\n * produces one row per cascaded child. The top-level `correlationId` is inherited by every sub-call\n * context and preserved across mid-flight operation corrections, so it groups the whole fan-out to one request;\n * `subCallDepth` separates the initiating operation (0) from what it cascaded into.\n \n ## Field evidence is deliberately partial (GDPR Art. 5(1)(c) + Art. 17)\n \n `changedFields` names every field the write touched — a field NAME is not personal data, so it is\n * always safe and always recorded. `fieldEvidence` carries before/after VALUES only for fields the\n * schema marks `.isAuditEvidence()`. The separate `reason` records an explicitly selected operator\n * justification, not an arbitrary request payload or a copy of a mutable resource reason field.\n \n Values are limited on purpose: audit rows replicate to the per-org SIEM and to the immutable\n * ledger, and the immutable ledger cannot be scrubbed — so copying arbitrary personal data into\n * this event would manufacture an unerasable duplicate, in direct conflict with Art. 17 and with the\n * impersonalization/retention capability built to make personal data erasable. Authority-, status-\n * and scope-bearing values ARE necessary (a role change that does not record the old and new roles\n * proves nothing), and those are exactly what the marker is for.\n \n assurance-control: WILDO.AUDIT.EVIDENCE_INTEGRITY\n /\nexport const AuditableEvent_ResourceOperationPerformed_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.RESOURCE_OPERATION_PERFORMED),\n\n // ── Operation identity (the triple + the shape that resolves the persistence semantics) ──\n /* The resource whose row(s) the operation acted on. /\n resourceType: z.string(),\n /* The verb — a core operation (`update`, `delete`) or a custom identifier (`suspend`). /\n operationIdentifier: z.string(),\n /* Which execution surface ran it. API, internal call, repository-only, cron, batch. /\n variantType: z.enum(ResourceOperationVariantType),\n /\n The variant discriminator. Absent on the default variant; REQUIRED to distinguish e.g. the\n * `admin` variant of a verb from its `self` twin, which share `operationIdentifier`.\n /\n variantKey: z.string().optional(),\n /* The core persistence semantics a custom verb borrows. Absent when the verb IS a core operation. /\n resourceOperationLike: z.enum(CoreResourceOperation).optional(),\n /* `true` for the bulk form, whose subject is a set rather than one row. /\n isBulkOperation: z.boolean().optional(),\n\n // ── Subject ──\n /* The row acted on. Absent for bulk operations, whose subject is the set below. /\n resourceId: z.string().optional(),\n /* Bulk operations only: how many rows the write affected. /\n affectedRecordCount: z.number().optional(),\n /\n Bulk operations only: WHICH rows the write affected.\n \n A count answers \"how much\"; a trail has to answer \"what\". Without this, one actor changing\n * forty rows left a single record saying `affectedRecordCount: 40` and naming none of them — so\n * the question an investigator asks first, \"who changed THIS row\", had no answer for any write\n * that was not single-row, which is exactly the case where one actor touches many records at once.\n \n Bounded by the batch maximum a synchronous bulk already enforces, so this is a complete list\n * rather than a sample: the background lane does not produce it at all, because it runs the\n * single-row twin per id and each row audits itself.\n \n Rides `eventData`, which the audit store persists as an unparsed record — so naming the rows\n * costs no column and no migration.\n /\n affectedResourceIds: z.array(z.string()).optional(),\n\n // ── Principal (the row's `userId` / `organizationId` / `applicationId` carry the identity) ──\n /\n The caller's roles AS THEY WERE at decision time. Roles are the framework's single\n * authorization axis, so without them a reader cannot tell whether the actor was entitled to the\n * action — and the actor's roles today are not the roles they held then.\n /\n initiatorRoles: z.array(z.string()),\n /* How the call was initiated — separates a human request from framework machinery. /\n executionType: z.enum(ExecutionContext_ExecutionType),\n /* Machine-credential provenance when the principal is a machine rather than a human. /\n machineCredentialAuthMethod: z.string().optional(),\n machineCredentialId: z.string().optional(),\n\n // ── Cascade depth (the request that groups the whole cascade is the row's top-level `correlationId`) ──\n /* `0` for the operation the caller invoked; deeper for what it cascaded into. /\n subCallDepth: z.number(),\n\n // ── Effect ──\n /\n Operator justification explicitly selected from the request by the operation's audit contract.\n * Historical evidence, independent of mutable resource fields such as cancellationReason.\n * It is not inferred from arbitrary request fields and must not contain secrets.\n /\n reason: z.string().optional(),\n /* Every field the write touched. Names only — always safe, always recorded. /\n changedFields: z.array(z.string()).optional(),\n /\n Before/after values, restricted to fields marked `.isAuditEvidence()`. `before` is absent on a\n * CREATE (there was no prior value) and on any bulk write (the framework fetches a pre-image only\n * for a single selected id).\n /\n fieldEvidence: z\n .record(\n z.string(),\n z.object({\n before: z.unknown().optional(),\n after: z.unknown().optional(),\n }),\n )\n .optional(),\n});\n\n/\n An operation the authorizer REFUSED. The other half of \"record access decisions\" — the negative\n * decision, which until now left no trace anywhere in the framework.\n \n ## Emitted pre-dispatch, from the one funnel\n \n Every public entry point of `AuthorizationsBackendService` converges on the same two inner phase\n * runners — `authorizeInController` (HTTP controller, MCP, WebSocket, queue, field validation),\n * `authorizeInProgrammaticSurface` (a non-controller surface that faces an external caller), and\n * `authorizeInRepositoryAndService`, which has exactly one caller — `authorizeInController` itself.\n * So a single instrumentation point observes every refusal THE AUTHORIZER MAKES, with the operation\n * and execution context both in scope. No mutation has occurred when this row is written; nothing is\n * rolled back by it.\n \n The scope of that claim, stated because an earlier revision overstated it. It used to read\n * \"the sole production entry point for every execution surface\", which asserts something stronger\n * and false: that every execution surface passes the role gate. A programmatic operation entering at\n * the SERVICE tier (`ServicesRegistryHandlerBackendService.read` / `list` / …) reaches no authorizer\n * at all — deliberately, because that population includes the reads that ESTABLISH identity before a\n * role-bearing principal exists. So the absence of a row here means \"the authorizer refused nothing\",\n * never \"nothing was read\". See `AuthorizationsBackendService.authorizeInProgrammaticSurface` for the\n * layering decision and the door.\n \n ## What it is NOT\n \n - Not an authentication failure. `USER_LOGIN_FAILED` / `MACHINE_AUTH_FAILED` say \"you are not\n * who you claim to be\". This says \"you are, and you may not do this\". Distinct types, distinct\n * categories, neither overloaded.\n * - Not an `outcome: 'denied'` variant of {@link AuditableEvent_ResourceOperationPerformed_EventDataSchema}.\n * That event is emitted from the post-commit lane, which by construction can only observe\n * operations that already took effect. A refusal never reaches it.\n \n ## Volume: bounded by dedup, NOT by a risk floor\n \n Denial volume is attacker-drivable in a way the success path's never is. A risk floor was\n * considered and rejected as the control: it would exclude 100% of denied READS (zero of the\n * catalogue's HIGH/CRITICAL variants are reads, while 371 of 551 API-reachable variants are) —\n * discarding the canonical reconnaissance signal — while not capping the adversarial worst case at\n * all, since the attacker chooses which endpoint to hammer.\n \n The actual bound is a per-principal / per-operation / per-reason dedup window. Rather than\n * suppressing repeats outright (which would erase the storm — the very signal a security-operations team wants),\n * emission escalates on a LOGARITHMIC ladder: the 1st, 10th, 100th, … refusal in the window each\n * emit one row carrying {@link occurrenceCount}. A burst of 10 000 identical denials therefore\n * costs 5 rows and remains legible as a burst.\n \n Dedup is best-effort and FAILS OPEN (emit) when the counter store is unavailable — a fail-closed\n * cooldown would let an attacker blind the audit trail by taking Redis down.\n \n assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT\n /\n/\n A platform operator acted on a row belonging to a tenant they are not a member of.\n \n ## Why this event exists\n \n Wildo's answer to \"may a platform super-administrator administer any tenant?\" is YES — the same\n * answer most mature B2B platforms give, because support and incident response genuinely need it.\n * What those platforms do NOT do is leave the reach implicit. Support access is a named, logged\n * event, because the difference between legitimate operator work and quiet snooping is not the\n * capability — both use the identical capability — it is whether anyone can tell afterwards.\n \n Until 2026-08-05 Wildo had the capability with none of the visibility, and by accident rather than\n * declaration: per-instance org-scoped requests are checked by `authorizeOrganizations`, which\n * compares the fetched row's organization against a scope the SAME REQUEST supplied through its URL.\n * A non-member operator therefore passed it silently. Measured over real HTTP by\n * `organization-ownership-grant-hostile.e2e.ts` probe F-1a, which deleted a membership row in\n * another tenant and got a 200.\n \n This event is the visibility half, and it is NOT the refusal. The refusal shipped separately and\n * lives in `authorizeOrganizations`: an undeclared crossing is no longer admitted, and the caller is\n * answered as not-found so the response cannot be used as an existence oracle. Emission here stays\n * best-effort and never blocks the request: an operator action must not fail because the audit sink\n * is down, and a fail-closed variant would let anyone disable operator support by breaking the sink.\n * The observation is taken BEFORE the admission decision, on purpose, so a sanctioned crossing is\n * recorded too.\n \n ## Reading the event\n \n {@link admissionDeclared} is the field that matters most. `true` means the operation VARIANT\n * declared `admitsCrossTenantPlatformAdministration` — an intended, reviewed crossing such as\n * `organizationMembers.grantOwnership`, which additionally requires a usable platform access grant.\n * `false` now means an ATTEMPTED undeclared crossing, which was refused: still the population to\n * watch, because it is reach nobody declared and no specification describes.\n \n assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION — platform-tier access to a tenant the\n * principal does not belong to.\n * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT\n /\n/\n One transition in the life of a platform access grant.\n \n The crossing itself is recorded by {@link CoreAuditableEventType.CROSS_TENANT_ADMINISTRATIVE_ACCESS}.\n * This is the other half, and a reviewer needs both: that event answers \"an operator reached into\n * this tenant\", this one answers \"on what authority, asked for when, and who agreed\".\n \n Deliberately two events rather than one enriched one. A grant is requested once and may authorise\n * many crossings across its window, so folding them together would either duplicate the grant's\n * details onto every access or lose the request/decision timeline entirely.\n \n {@link autoApprovalReason} is the field a customer audit turns on. Its ABSENCE on an approved grant\n * means a human in the tenant said yes. `TENANT_APPROVAL_NOT_REQUIRED` means the tenant had not opted\n * into approval. `TENANT_CANNOT_APPROVE` means the tenant had no administratively usable owner and\n * could not consent — the one path where operator access proceeds against a tenant that never agreed\n * and never could, which is why the emitter carries it at a higher risk level.\n \n assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION\n * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — evidence of a privileged assignment's full life.\n /\nexport const AuditableEvent_PlatformAccessGrantLifecycle_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.PLATFORM_ACCESS_GRANT_LIFECYCLE),\n\n /* Which transition this row records. /\n transition: z.enum(PlatformAccessGrantLifecycleTransition),\n /* The grant, so the whole timeline can be reassembled from its rows. /\n grantId: z.string(),\n /\n WHAT the elevation reaches, and therefore who was entitled to approve it.\n \n Carried explicitly rather than inferred from the presence of `targetOrganizationId`: a reviewer\n * asking \"was this approved by the party the rules require?\" needs the SCOPE, and deriving it from\n * a field's absence would make a lost or scrubbed value read as an application-wide elevation.\n \n `TENANT` is the default so every row written before this axis existed keeps its true meaning —\n * the application-wide grant did not exist then.\n /\n grantScope: z.enum(PlatformAccessGrantScope).default(PlatformAccessGrantScope.TENANT),\n /\n The tenant that was, or would have been, reached into.\n \n OPTIONAL since the application-wide scope arrived: that grant names no tenant, and writing a\n * placeholder would be a lie about which customer an operator reached. Absent ⇔\n * `grantScope === APPLICATION_WIDE`.\n /\n targetOrganizationId: z.string().optional(),\n /* The operator who asked. Never the decider — see {@link decidedByUserId}. /\n operatorUserId: z.string(),\n /* Why the operator said they needed access. Recorded on every transition, not only the request. /\n justification: z.string().optional(),\n /* The status the grant holds after this transition. /\n resultingStatus: z.enum(PlatformAccessGrantStatus),\n /* When the elevation stops working. Absent on a grant that never became usable. /\n expiresAt: z.date().optional(),\n /* Present exactly when the grant became usable with no tenant administrator acting. /\n autoApprovalReason: z.enum(PlatformAccessGrantAutoApprovalReason).optional(),\n /* The tenant administrator who approved, denied or revoked. Absent on an auto-approval. /\n decidedByUserId: z.string().optional(),\n /* Their stated reason, when they gave one. /\n decisionReason: z.string().optional(),\n /\n The machine credential an application-wide grant is bound to, when it is (#297). Present on EVERY transition\n * of such a grant, so the second administrator's signature and every later reader see which credential the\n * elevation reaches — a request naming a machine must never read, in the trail, as the requester's own window.\n /\n grantedMachineCredential: ExecutionContext_MachineCredentialSchema.optional(),\n});\n\n/\n One transition in the life of a system-of-record partition assignment.\n \n Read it to answer \"who could see this remote company, and when did that start or stop\". The row\n * names both units on a move, so a timeline reconstructed from these events is complete without\n * joining anything: each row carries the state it left as well as the state it reached.\n \n assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE\n * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE\n /\nexport const AuditableEvent_SystemOfRecordPartitionAssignmentLifecycle_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.SYSTEM_OF_RECORD_PARTITION_ASSIGNMENT_LIFECYCLE),\n\n /* Which transition this row records. /\n transition: z.enum(SystemOfRecordPartitionAssignmentTransition),\n /* The assignment row, so its whole timeline can be reassembled. /\n assignmentId: z.string(),\n /* The declared instance — `systemsOfRecord.<name>`. Instance, never vendor: two Odoo deployments have unrelated company ids. /\n system: z.string(),\n /* The partition's key as the remote spells it, in canonical text. /\n remoteKey: z.string(),\n /\n The unit the partition belongs to AFTER this transition.\n \n Absent exactly when the transition is `UNASSIGNED` — there is no resulting unit, and writing the\n * departed one here would make an unassignment read as an assignment to the unit that lost it.\n /\n organizationUnitId: z.string().optional(),\n /\n The unit the partition belonged to BEFORE this transition.\n \n Present on `REASSIGNED` and `UNASSIGNED`, absent on `ASSIGNED`. This is the field the automatic\n * `RESOURCE_OPERATION_PERFORMED` row cannot carry, and the reason this event type exists.\n /\n previousOrganizationUnitId: z.string().optional(),\n /* The operator's stated reason. Recorded on every transition, not only the first. /\n justification: z.string().optional(),\n /* The operator who made the change. /\n assignedByUserId: z.string().optional(),\n});\n\nexport const AuditableEvent_CrossTenantAdministrativeAccess_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.CROSS_TENANT_ADMINISTRATIVE_ACCESS),\n\n /* The tenant that was reached into — the row's organization, never the caller's own. /\n targetOrganizationId: z.string(),\n /* The resource whose row the operator acted on. /\n resourceType: z.string(),\n /* The verb — a core operation (`update`, `delete`) or a custom identifier (`grantOwnership`). /\n operationIdentifier: z.string(),\n /* Which execution surface the crossing arrived on. /\n variantType: z.enum(ResourceOperationVariantType),\n /* The variant discriminator, which is what distinguishes a declared crossing from its siblings. /\n variantKey: z.string().optional(),\n /* The row(s) reached. Absent for collection operations, which name no id. /\n targetResourceIds: z.array(z.string()).optional(),\n\n /\n The elevation that authorised this crossing, when one did.\n \n This is what joins the two operator-access events into one story: the lifecycle event says an\n * elevation was requested, justified and decided; this field says WHICH elevation a given access\n * was exercised under. Without it a reviewer looking at a crossing has to infer the grant from\n * timestamps, which stops working the moment an operator holds two grants in a day.\n \n Absent on the bootstrap verb (`requestAccess` is exempt — it is how a grant comes into existence)\n * and on any crossing admitted before grants were required.\n /\n authorizingGrantId: z.string().optional(),\n\n /\n WHICH COLLECTION {@link authorizingGrantId} names.\n \n A grant id alone is not resolvable: `platformAccessGrants` and `applicationAccessGrants` are two\n * resources with two collections, and a reviewer handed only an id has to try both. Absent exactly\n * when `authorizingGrantId` is.\n /\n authorizingGrantScope: z.enum(PlatformAccessGrantScope).optional(),\n\n /\n Did the operation variant DECLARE this crossing (`admitsCrossTenantPlatformAdministration`)?\n \n `false` is the signal worth alerting on: an ATTEMPTED crossing that no variant asked for and no\n * specification describes. It was refused, so the row records an attempt rather than a completed\n * access. See this schema's JSDoc.\n /\n admissionDeclared: z.boolean(),\n /* The caller's roles as they were at decision time. /\n initiatorRoles: z.array(z.string()),\n /* How the call was initiated — separates a human operator from framework machinery. /\n executionType: z.enum(ExecutionContext_ExecutionType),\n /\n The credential that read, when the reader is a MACHINE. A machine has no `userId`, so without this the\n * row names no reader at all — an assurance collector's reads would be unattributable in the very trail it\n * measures, and could not be told apart from its own earlier runs (#297). Absent for a human operator.\n /\n machineCredential: ExecutionContext_MachineCredentialSchema.optional(),\n});\n\n/\n An application-wide directory enumeration.\n \n See {@link CoreAuditableEventType.PLATFORM_DIRECTORY_ACCESS} for why this is a distinct event\n * type rather than a shape of the cross-tenant one. The short version: there is no target tenant to\n * name, because the read deliberately spans them all.\n /\nexport const AuditableEvent_PlatformDirectoryAccess_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.PLATFORM_DIRECTORY_ACCESS),\n\n /* The directory that was enumerated (`users`, `anonymousUsers`, …). /\n resourceType: z.string(),\n /* The collection verb — `list`, `search`, `count`. /\n operationIdentifier: z.string(),\n /* Which execution surface the read arrived on. /\n variantType: z.enum(ResourceOperationVariantType),\n /\n The variant discriminator.\n \n Load-bearing rather than decorative: on `users` the DEFAULT `list` variant is `INTERNAL_CALL`\n * and registers no route, while the HTTP-exposed one is the non-default `admin` variant. A\n * reviewer who cannot tell the two apart cannot tell an internal enumeration from an operator\n * browsing the directory.\n /\n variantKey: z.string().optional(),\n /\n How many rows the caller actually received.\n \n The size is the signal. \"An operator opened the user directory\" is routine; \"an operator paged\n * through 40,000 users\" is the shape of an export, and only this field distinguishes them.\n /\n returnedCount: z.number().int().nonnegative(),\n /* The caller's roles as they were at read time. /\n initiatorRoles: z.array(z.string()),\n /* How the call was initiated — separates a human operator from framework machinery. /\n executionType: z.enum(ExecutionContext_ExecutionType),\n\n /\n The application-wide elevation that authorised this directory read.\n \n Until 2026-09-09 this event named NO elevation, because none was required — the read was gated on\n * an administrator role alone while the far narrower per-row crossing required a usable, time-bound,\n * approved grant. That inversion is what `applicationAccessGrants` closes, and this field is the\n * evidence half of the closure: it is what joins a directory read to the two administrators who\n * signed for it.\n \n Absent on a read the admission does not gate — an exempt execution type (batch, webhook), or a\n * read the confinement authority confined, neither of which is an elevation.\n /\n authorizingGrantId: z.string().optional(),\n /* WHICH collection {@link authorizingGrantId} names. Absent exactly when it is. /\n authorizingGrantScope: z.enum(PlatformAccessGrantScope).optional(),\n});\n\nexport const AuditableEvent_ResourceOperationDenied_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.RESOURCE_OPERATION_DENIED),\n\n // ── Why (the discriminator a security-operations dashboard groups by) ──\n /* Which refusal the authorizer resolved. /\n denialReason: z.enum(ResourceOperationDenialReason),\n\n // ── Operation identity (the same TRIPLE as the success twin — see its JSDoc for why) ──\n /* The resource whose row(s) the caller attempted to act on. /\n resourceType: z.string(),\n /* The verb — a core operation (`update`, `delete`) or a custom identifier (`suspend`). /\n operationIdentifier: z.string(),\n /* Which execution surface the attempt arrived on. /\n variantType: z.enum(ResourceOperationVariantType),\n /\n The variant discriminator. Absent on the default variant; REQUIRED to distinguish e.g. the\n * `admin` variant of a verb from its `self` twin, which share `operationIdentifier`.\n /\n variantKey: z.string().optional(),\n /* The core persistence semantics a custom verb borrows. Absent when the verb IS a core operation. /\n resourceOperationLike: z.enum(CoreResourceOperation).optional(),\n /* `true` for the bulk form, whose subject is a set rather than one row. /\n isBulkOperation: z.boolean().optional(),\n\n // ── Subject (what was ATTEMPTED — never proof the row exists) ──\n /\n The row id(s) the caller named. Present even for {@link ResourceOperationDenialReason.SUBJECT_NOT_RESOLVABLE},\n * where the id may correspond to nothing at all — this records what was ASKED FOR, not what exists.\n * Absent for collection operations, which name no id.\n /\n attemptedResourceIds: z.array(z.string()).optional(),\n\n // ── Authority (what was required vs. what was held) ──\n /\n The role set the operation demanded. Together with {@link initiatorRoles} this makes the refusal\n * self-explaining: a reviewer sees what was needed and what the caller had, without re-deriving\n * the operation's config as it stood that day.\n /\n requiredRoles: z.array(z.string()).optional(),\n /\n The roles the caller tried to GRANT and could not — present only on\n * {@link ResourceOperationDenialReason.ROLE_CEILING_EXCEEDED}.\n \n A third set, distinct from both of its neighbours and not expressible by either: `requiredRoles`\n * is what the OPERATION demanded of the caller, `initiatorRoles` is what the caller HELD, and this\n * is what the caller attempted to confer on somebody else. It is the whole content of an\n * escalation attempt — \"an ORG_ADMIN asked for ORG_OWNER\" — and without it the row says only that\n * a ceiling was hit.\n \n Only the REFUSED subset is recorded, not the whole requested array: the roles the caller was\n * entitled to grant are not evidence of anything, and the difference is what a reviewer reads.\n /\n escalatedRoles: z.array(z.string()).optional(),\n /\n The surface the person called, when the refusal happened on one that is NOT a resource operation — a\n * manual-controller route (`GET /api/v1/charts/:chartId/data`) or a WebSocket event (`badge:get`).\n \n On such a surface the operation fields above name only the context it was authorized under (an\n * application read), which on its own cannot tell a chart from a feature resolution (#534 third review L3).\n * Absent on a resource operation, whose operation fields already ARE the surface. Carries a route TEMPLATE\n * where one is known, so the trail records which door was refused rather than which row was asked for.\n /\n refusedSurface: z.string().optional(),\n /\n The caller's roles AS THEY WERE at decision time — empty when the refusal WAS the absence of\n * them ({@link ResourceOperationDenialReason.MISSING_INITIATOR}).\n /\n initiatorRoles: z.array(z.string()),\n /* How the call was initiated — separates a human request from framework machinery. /\n executionType: z.enum(ExecutionContext_ExecutionType),\n /* Machine-credential provenance when the refused principal is a machine rather than a human. /\n machineCredentialAuthMethod: z.string().optional(),\n machineCredentialId: z.string().optional(),\n\n // ── Cascade depth (the request that groups the whole cascade is the row's top-level `correlationId`) ──\n /* `0` for the operation the caller invoked; deeper for what it cascaded into. /\n subCallDepth: z.number(),\n\n // ── Burst accounting (see the dedup ladder in this schema's JSDoc) ──\n /\n How many identical refusals (same principal, operation and reason) have accumulated in the\n * current dedup window INCLUDING this one. `1` on the first. A row with a large value is a\n * deliberate escalation checkpoint, not a duplicate.\n /\n occurrenceCount: z.number(),\n /\n `true` when the count is exact (the dedup counter was reachable). `false` when the counter store\n * was unavailable and the emission fell open — the row is then a truthful record of ONE refusal\n * whose burst context is unknown, and {@link occurrenceCount} is not to be trusted as a total.\n /\n occurrenceCountIsExact: z.boolean(),\n});\n\n/\n A privileged SEE-THROUGH read that revealed RETAINED (impersonalized-and-retained) records —\n * rows kept for a legal/audit obligation while their personal data was scrubbed, hidden from\n * normal callers by the retention hide-predicate. This is the compliance-grade access record over\n * that scrubbed data, and its two defining properties (vs `SYSTEM_CONTEXT_READ`, which names only the\n * RUNTIME that acted, never a human) are:\n \n 1. Human attribution — `accessingUserId` names the actual human who exercised the see-through,\n * so a retained-data reveal is never anonymous. Non-empty (`.trim().min(1)`) — a blank id cannot\n * stand in for a human. The gate admits `APP_ADMIN_SUPER_ADMIN` and nothing else; a dedicated\n * auditor role does not exist yet, and adding one is a purely additive change to that gate.\n * 2. A required reason — `reason` is the mandatory justification for revealing scrubbed PII.\n * Non-empty (`.trim().min(1)`): a blank OR whitespace-only reason fails validation, so the audit\n * trail cannot record a reveal without a real \"why\". The see-through primitives ALSO fail-closed on\n * blank attribution before the read (the schema `.min(1)` is the contract; the primitive guard is\n * the enforcement point, since the audit store persists `eventData` as an unparsed record).\n \n Strictly read-only (the see-through primitive never mutates). Emitted TODAY by both see-through\n * read primitives, `readRetainedAsSystem` and `listRetainedAsSystem`: each calls\n * `logRetainedDataAccess` after its gates pass, so this is a live event, not a contract awaiting a\n * producer.\n /\nexport const AuditableEvent_RetainedDataAccess_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.RETAINED_DATA_ACCESS),\n /* The HUMAN principal who performed the see-through read (an application super-administrator). Non-empty. /\n accessingUserId: z.string().trim().min(1),\n /* REQUIRED non-empty compliance justification for revealing the retained (scrubbed) records — the \"why\". /\n reason: z.string().trim().min(1),\n /* The resource type whose retained rows were revealed. /\n resourceType: z.string(),\n /* Present for a single-record see-through read; absent for a list/search reveal. /\n resourceId: z.string().optional(),\n /* For a list/search see-through: how many retained rows the query revealed. /\n retainedRecordCount: z.number().optional(),\n /* The see-through primitive that ran (e.g. `readRetainedAsSystem` / `listRetainedAsSystem`). /\n operationIdentifier: z.string(),\n /* The privileged role(s) that authorized the see-through (roles are the single authorization axis). /\n roles: z.array(z.string()).optional(),\n /* Tenant scope of the accessed data (organizationId), when the read was org-scoped. /\n organizationId: z.string().optional(),\n ipAddress: z.string().optional(),\n});\n\n/\n A person met a governed document, and this is the release they met.\n \n `interaction` is the composed record from `composeGovernedDocumentInteraction`, which has already\n * refused anything the release does not permit and marked anything the workflow has not finished.\n * It is nested rather than flattened so there is ONE shape for a governed-document interaction — a\n * second, flatter copy here would be a second thing to keep in step with the release vocabulary.\n \n The SUBJECT is the audit envelope's own actor attribution plus `userId` here, never a third\n * spelling inside the record; see the interaction schema's JSDoc for why.\n \n assurance-control: WILDO.PRIVACY.CONSENT_RECORD\n /\nexport const AuditableEvent_GovernedDocument_InteractionRecordedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.GOVERNED_DOCUMENT_INTERACTION_RECORDED),\n /\n The identified person who met the document. Absent exactly when `anonymousUserId` is present\n * (#1258 Step 5) — a signed-in registrant or an already-identified reader has one; a visitor\n * reading a public notice before ever creating an account does not.\n /\n userId: z.string().optional(),\n /\n The pre-identity visitor who met the document, when nobody is signed in (#1258 Step 5).\n * `AnonymousUser._id` / `ExecutionContext.anonymousUserId` — the same identity Step 1's consent\n * carry is keyed on, never a second visitor-identity concept.\n /\n anonymousUserId: z.string().optional(),\n /* What they did, which release they did it to, and that release's standing at the time. /\n interaction: GovernedDocumentInteractionSchema,\n /\n TRUE-but-unfinished notes carried from composition — today, that the release was UNAPPROVED.\n \n Recorded rather than discarded because an advisory is the only trace that the mechanism\n * proceeded deliberately rather than by omission.\n /\n advisoryKinds: z.array(z.string()),\n ipAddress: z.string().optional(),\n}).superRefine((event, context) => {\n // Exactly one subject, never zero (a record naming nobody is not a record) and never both (two\n // identities for one act is two different claims about who acted).\n const hasUser = event.userId !== undefined;\n const hasAnonymous = event.anonymousUserId !== undefined;\n if (hasUser === hasAnonymous) {\n context.addIssue({\n code: 'custom',\n path: hasUser ? ['anonymousUserId'] : ['userId'],\n message: hasUser\n ? 'a governed-document interaction names both userId and anonymousUserId — exactly one subject met the document'\n : 'a governed-document interaction names neither userId nor anonymousUserId — a record must name who met the document',\n });\n }\n});\n\n/\n A DATA SUBJECT EXPORT — the compliance record of the framework assembling everything it holds\n * about one person and disclosing it.\n \n This is the most sensitive READ the framework performs, and the one an access-request audit turns\n * on. Its defining properties:\n \n 1. A named subject — `subjectResourceType` + `subjectIds`: WHOSE data left the system. An\n * export event that cannot name its subject is not an access record.\n * 2. A named purpose — `purpose` is a `SubjectExportPurpose`. Art. 15 and Art. 20 produce\n * genuinely different bundles, so an audit trail that recorded only \"an export happened\" could\n * not later establish which right was answered or whether it was answered completely.\n * 3. What was actually included — `includedResourceTypes` + `totalRecordCount`, and\n * `fieldsExcludedAsDerived` for the Art. 20 narrowing. The OMISSIONS matter as much as the\n * contents: \"why was this not in my export?\" must have a recorded answer.\n \n Carries NO personal data — resource types, ids, counts and field NAMES only. Recording the\n * exported values would turn the record of a disclosure into a second copy of it, in a store with\n * a longer retention than the export artifact itself.\n \n assurance-control: WILDO.PRIVACY.SUBJECT_DATA_EXPORT\n /\nexport const AuditableEvent_SubjectDataExport_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.SUBJECT_DATA_EXPORT),\n /* WHICH data-subject right this export answered — the two produce different bundles. /\n purpose: z.string().trim().min(1),\n /* The exported subject's resource type. /\n subjectResourceType: z.string().trim().min(1),\n /* The exported subject rows. Non-empty: an export with no subject is not an export. /\n subjectIds: z.array(z.string()).min(1),\n /* Every resource that actually contributed rows to the bundle. /\n includedResourceTypes: z.array(z.string()),\n /* Total rows disclosed across the whole bundle. /\n totalRecordCount: z.number(),\n /\n `resourceType.fieldName` locators omitted from an Art. 20 bundle as controller-derived. Empty\n * for an Art. 15 access export, which discloses every field regardless of provenance.\n /\n fieldsExcludedAsDerived: z.array(z.string()),\n /\n `resourceType.fieldName` locators withheld as NON-DISCLOSABLE regardless of right — secrets and\n * backend-only values the export refuses to hand out. Recorded so a thin bundle reads as a\n * deliberate security floor rather than a missed resource.\n /\n fieldsWithheldAsNonDisclosable: z.array(z.string()),\n /* Tenant scope, when the export ran org-scoped. /\n organizationId: z.string().optional(),\n});\n\n/\n A COLLECTION EXPORT — an operator rendered a resource listing to a file and downloaded it.\n \n ## What it must answer, and what it must never carry\n \n The reviewer's questions are: which listing, in what shape, and how much left. So the row\n * count is mandatory and the row scope is recorded verbatim — \"they exported the page they were\n * looking at\" and \"they exported the whole table\" are the same action with very different\n * consequences, and only this field separates them after the fact.\n \n `filterFieldNames` records WHICH filters narrowed the export, never their values. A filter\n * value is frequently personal data (`?email=…`, `?assigneeId=…`), so recording it would turn the\n * record of a disclosure into a second copy of it, in a store that outlives the exported file — the\n * same rule {@link AuditableEvent_SubjectDataExport_EventDataSchema} follows (\"resource types, ids,\n * counts and field NAMES only\"). No row content, ever.\n \n ## Why the severity is static and the risk is not\n \n `AUDIT_EVENT_CLASSIFICATION_MAP` is keyed by event TYPE, so severity cannot vary per emission.\n * Classifying every export WARNING would put a routine twenty-row page download beside a whole-table\n * dump and train reviewers to skim the channel; classifying every export INFO would leave the dump\n * indistinguishable. The distinction therefore rides on `riskLevel`, which IS per-emission and is an\n * indexed summary column on the audit row: LOW for a page, HIGH for a full result set.\n \n Rejected: two event types. A page export and a full export are one action with one parameter,\n * and splitting the vocabulary to vary a field would make every consumer match two types forever.\n \n assurance-control: WILDO.PRIVACY.COLLECTION_DATA_EXPORT\n /\nexport const AuditableEvent_CollectionDataExport_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.COLLECTION_DATA_EXPORT),\n /* The exported resource. /\n resourceType: z.string().trim().min(1),\n /* The LIST/SEARCH operation whose result set was exported. /\n sourceOperationIdentifier: z.string().trim().min(1),\n /* `csv` \| `json` — the rendered wire format. /\n format: z.string().trim().min(1),\n /* `visible_page` \| `full_result_set` — see the docstring; this is the field that matters most. /\n rowScope: z.string().trim().min(1),\n /* Rows actually written to the file. Mandatory: an export event with no count answers nothing. /\n rowCount: z.number().int().nonnegative(),\n /* Names of the filters that narrowed the export. NEVER their values. /\n filterFieldNames: z.array(z.string()),\n /* Tenant scope, when the export ran org-scoped. /\n organizationId: z.string().optional(),\n});\n\n/\n The application CALLED a declared operation on a third-party provider (S3a/S3b; see the enum\n * member's docstring for why this is neither an HTTP_API read-through nor a credential-use event).\n \n One event per OUTBOUND CALL, emitted on both the success and the failure path. Recording only\n * what worked would hide the attempts, and a refused or failed outbound call is exactly what a\n * reviewer wants to see first.\n \n Ids and SHAPE only, never a payload. There is no field for the request body, the response body or\n * the credential — a structural property of this schema rather than a redaction step somebody has to\n * remember, for the same reason the credential family carries no value field.\n \n assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT — records WHOSE third-party account\n * an outbound call spent, which the initiator's own ids cannot answer once one execution may spend\n * several.\n /\nexport const AuditableEvent_ProviderOperationCall_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.PROVIDER_OPERATION_CALL),\n /* The provider whose catalogue declared the operation (e.g. `slack`). /\n providerRef: z.string().trim().min(1),\n /* The operation id as the catalogue declares it. /\n operationId: z.string().trim().min(1),\n /* The catalogue domain the operation belongs to. /\n domain: z.string().trim().min(1),\n /* The HTTP method the compiled request used. /\n method: z.string().trim().min(1),\n /* `READ` \| `WRITE`, as the operation declares its effect — the axis a reviewer filters on first. /\n classification: z.string().trim().min(1),\n /\n WHOSE ACCOUNT the call spent: `application` \| `organization` \| `user`.\n \n Deliberately separate from `organizationId` below, which records the tenant the REQUEST was\n * scoped to. Those are the same tenant in the ordinary case and different ones exactly where it\n * matters — a trail carrying only the initiator's organization would attribute a fan-out's calls\n * to the wrong tenants.\n /\n connectionOwnerScope: z.string().trim().min(1),\n /* The owner's id, absent for an application-owned call which names no second party. /\n connectionOwnerId: z.string().optional(),\n /* `service` \| `user` — whether the call acted for the owner itself or on a person's delegation. /\n connectionDelegation: z.string().trim().min(1),\n /* HTTP status of the answer; absent when the call never got one. /\n status: z.number().int().optional(),\n /* Present when the call failed, naming the failure KIND rather than the vendor's prose. /\n failureKind: z.string().optional(),\n /\n The `requiredScopes` verdict (#979) — present only when the operation declares required scopes. `not_recorded`\n * is the one to read twice: the call went out without its scopes being checked.\n /\n scopeCheck: z.enum(ProviderOperationScopeCheck).optional(),\n /* The required scopes the grant lacked — present with `scopeCheck: missing`. Scope names only, never a token. /\n missingScopes: z.array(z.string()).optional(),\n /* The REAL initiating user — absent only for genuine machine/internal executions. /\n initiatorUserId: z.string().optional(),\n /* The execution type that acted, for the machine/internal cases. /\n executionType: z.string().optional(),\n /* The tenant the REQUEST was scoped to — see `connectionOwnerScope`. /\n organizationId: z.string().optional(),\n});\n\n/\n The browser door REFUSED a provider operation (#367) — see the enum member for why this is not a\n * failed call.\n \n Ids and shape only, like its call sibling: the request's `input` is never recorded. What the caller\n * ASKED FOR is recorded even when it names nothing real, because a refusal records an attempt rather\n * than proving the provider or operation exists.\n \n assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT\n /\nexport const AuditableEvent_ProviderOperationDenied_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.PROVIDER_OPERATION_DENIED),\n denialReason: z.enum(ProviderOperationDenialReason),\n /* The provider the request named. /\n providerRef: z.string().trim().min(1),\n /* The operation id the request named. /\n operationId: z.string().trim().min(1),\n /* The account the request asked to spend: `application` \| `organization` \| `user`. /\n connectionOwnerScope: z.string().trim().min(1),\n /* The owner's id, absent for an application-owned request. /\n connectionOwnerId: z.string().optional(),\n /* `service` \| `user`, as requested. /\n connectionDelegation: z.string().trim().min(1),\n /\n The roles the policy required — present on {@link ProviderOperationDenialReason.INSUFFICIENT_ROLES}\n * and {@link ProviderOperationDenialReason.ROLES_NOT_APPLICABLE_TO_TARGET}.\n /\n requiredRoles: z.array(z.string()).optional(),\n /\n The roles the caller held IN THE SCOPE THAT WAS CHECKED, at decision time — present on\n * {@link ProviderOperationDenialReason.INSUFFICIENT_ROLES}, so the row explains itself.\n /\n heldRoles: z.array(z.string()).optional(),\n /* The refused person. Absent only on {@link ProviderOperationDenialReason.MISSING_USER_SESSION}. /\n initiatorUserId: z.string().optional(),\n /* The execution type that asked, which is what explains a missing user. /\n executionType: z.string().optional(),\n /* The tenant the REQUEST was scoped to. /\n organizationId: z.string().optional(),\n});\n\n/\n An agent reached an MCP server — the outbound trail for a tool call that leaves the trust\n * boundary (#491).\n \n One event per ATTEMPT, successful or not. Recording only what worked would hide exactly what a\n * reviewer wants first: the refused targets, the calls that timed out, and the tools that answered\n * with their own error. `outcome` names which of those it was, in the client's own vocabulary, so\n * the trail and the logs agree on the words.\n \n Ids, HOST and SHAPE only — never a payload. There is no field for the tool arguments, the tool\n * result or the credential. That is a structural property of this schema rather than a redaction\n * step somebody has to remember, the same choice the provider-call and credential families make.\n * `destinationHost` and not the URL, because an MCP endpoint routinely carries a tenant or session\n * identifier in its path.\n \n assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT — records WHOSE third-party account\n * an agent's tool call spent, which the initiator's own ids cannot answer once one turn may spend\n * either the person's or the tenant's.\n /\nexport const AuditableEvent_McpToolCall_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.MCP_TOOL_CALL),\n /* The server ref the application declared and the agent named. /\n mcpServerRef: z.string().trim().min(1),\n /* HOST only — see the docstring for why never the URL. /\n destinationHost: z.string().trim().min(1),\n /* The tool called. Absent when the attempt failed before any tool was chosen (discovery). /\n toolName: z.string().optional(),\n /* The client's outcome kind — `ok`, `refused_target`, `unreachable`, `timed_out`, `protocol_error`, `tool_error`. /\n outcome: z.string().trim().min(1),\n /\n WHOSE ACCOUNT the call spent: `user` \| `organization`. Absent when no credential was resolved,\n * which is itself the reason the attempt failed.\n \n Separate from `organizationId` for the same reason as the provider-call event: those are the\n * same tenant in the ordinary case, and different ones exactly where it matters.\n /\n connectionOwnerScope: z.string().optional(),\n /* The credential row that was spent, for the audit trail. /\n credentialId: z.string().optional(),\n /\n WHOSE credential it was: the member who set an organization credential. For an organization-lent\n * member account (decision on wildo-ai/wildo-ai#18) that is the person the far server attributes the\n * call to, captured at call time rather than joined later, since a reconnect moves it.\n /\n credentialSetByUserId: z.string().optional(),\n /* The REAL initiating user — absent only for genuine machine/internal executions. /\n initiatorUserId: z.string().optional(),\n /* The tenant the turn was scoped to — see `connectionOwnerScope`. /\n organizationId: z.string().optional(),\n /* The agent whose declaration named the server, so a trail can be read back to a configuration. /\n agentRef: z.string().optional(),\n});\nexport type AuditableEvent_McpToolCall_EventData = z.infer<typeof AuditableEvent_McpToolCall_EventDataSchema>;\n\n/\n A human approver AUTHORED the arguments an approval-gated tool ran with (#566).\n \n One row per MODIFIED approval — never per approval. See the enum member's docstring for why an\n * ordinary approval is not this event, and for why no argument VALUE appears in this schema.\n \n `proposedInputDigest` / `executedInputDigest` are the model SDK's own canonical input digests, the\n * same values its approval signature is computed over. That is what makes them evidence rather than\n * a convenience: a reader holding the executed call can recompute the second and see it match, and\n * the two differing is proof that the call which ran is not the call which was proposed — with no\n * copy of either payload on the trail.\n \n assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT — records that an authorization\n * decision REWROTE the act it authorized, and who made it.\n /\nexport const AuditableEvent_AgentToolApprovalModified_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.AGENT_TOOL_APPROVAL_MODIFIED),\n /* The conversational execution whose turn was paused. /\n executionId: z.string().trim().min(1),\n /* The pending decision's id — correlates this row with the pause and the resume in the logs. /\n approvalId: z.string().trim().min(1),\n /* The actor system the turn belongs to. /\n systemRef: z.string().trim().min(1),\n /* The agent whose declaration gated the tool, so a trail reads back to a configuration. /\n agentRef: z.string().trim().min(1),\n /* The approval-gated tool, as the model was shown it. /\n toolName: z.string().trim().min(1),\n /* Canonical digest of the arguments the MODEL proposed. /\n proposedInputDigest: z.string().trim().min(1),\n /* Canonical digest of the arguments that actually RAN. Differs from the above by construction. /\n executedInputDigest: z.string().trim().min(1),\n /\n The argument NAMES the approver changed, sorted. Names only — a field name is not personal data,\n * which is exactly why it is always safe and always recorded.\n /\n modifiedArgumentKeys: z.array(z.string()),\n /* The approver. Absent never happens on this plane — only a present human can answer — but the envelope owns the field. /\n approverUserId: z.string().optional(),\n /* The tenant the turn was scoped to. /\n organizationId: z.string().optional(),\n});\nexport type AuditableEvent_AgentToolApprovalModified_EventData = z.infer<typeof AuditableEvent_AgentToolApprovalModified_EventDataSchema>;\n\n/\n Rows were read THROUGH an HTTP-API resource binding — the read-through trail for data living in\n * an EXTERNAL system the platform does not own (ETL plan D8/R6; see the enum member's docstring\n * for why this is neither SYSTEM_CONTEXT_READ nor COLLECTION_DATA_EXPORT).\n \n One event per read-family OPERATION execution: a paginated LIST and the count that totals its\n * envelope are ONE access, not two — the unit a reviewer reasons about is \"an operation reached\n * into the external system\", never the transport's call multiplicity. Carries NO row data and no\n * filter VALUES — the trail must never become a second copy of the external system's content.\n \n `initiatorUserId` is the REAL initiating user (R12): under a SERVICE_PRINCIPAL binding every\n * remote call authenticates as one service account, and this field is what keeps attribution\n * alive through that shared principal. Optional because internal/machine executions genuinely\n * have no user — absence means \"a runtime acted\", exactly as `executionType` records.\n \n assurance-control: WILDO.AUDIT.ATTRIBUTION — read-through access to an external system is\n * recorded with the real initiating user carried through the shared service principal.\n /\nexport const AuditableEvent_HttpApiReadThroughAccess_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.HTTP_API_READ_THROUGH_ACCESS),\n /* The Wildo resource whose binding was read through. /\n resourceType: z.string().trim().min(1),\n /* The read-family member executed: `read` \| `list` \| `count` \| `search`. /\n operationIdentifier: z.string().trim().min(1),\n /* The provider the binding resolves credentials/base-URL through (e.g. `odoo`). /\n providerRef: z.string().trim().min(1),\n /* The remote entity (OData entity set / Odoo model / declared REST surface). /\n remoteEntityRef: z.string().trim().min(1),\n /* The transport dialect spoken (`odata` \| `rest-json` \| `odoo-jsonrpc`). /\n dialect: z.string().trim().min(1),\n /* The REAL initiating user — absent only for genuine machine/internal executions. /\n initiatorUserId: z.string().optional(),\n /* The execution type that acted, for the machine/internal cases. /\n executionType: z.string().optional(),\n /* Tenant scope, when the read ran org-scoped. /\n organizationId: z.string().optional(),\n /* The addressed row's synthesized id, for single-row reads. /\n resourceId: z.string().optional(),\n /* Rows returned (list/search), or the count answered (count). Absent for a single READ. /\n rowCount: z.number().int().nonnegative().optional(),\n});\n\n/\n A subject erasure invoked the DECLARED external-erasure operation of an HTTP_API binding\n * (ETL D6 stance 6b) — rows linked to the erased subject were deleted in the external system.\n \n Carries ids only, never personal fields: by the time this emits, the subject's local row is\n * scrubbed, and the whole point of the operation was that the remote copies stop existing.\n \n assurance-control: WILDO.AUDIT.ATTRIBUTION — the outbound deletion names the subject it served\n * and the external system it reached; the erasure report is the per-request receipt, this row is\n * the queryable trail.\n \n assurance-control: WILDO.PRIVACY.ERASURE_PROPAGATION — an erasure that deleted rows in an external\n * system leaves a durable record naming that system and how many rows it deleted there.\n /\nexport const AuditableEvent_HttpApiExternalErasure_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.HTTP_API_EXTERNAL_ERASURE),\n /* The erased subject's resource type (e.g. `users`). /\n subjectResourceType: z.string().trim().min(1),\n /* The erased subject row ids the deleted remote rows were linked to. /\n subjectIds: z.array(z.string().trim().min(1)).min(1),\n /* The HTTP_API-bound Wildo resource whose declared erasure operation ran. /\n resourceType: z.string().trim().min(1),\n /* The provider the binding resolves credentials/base-URL through. /\n providerRef: z.string().trim().min(1),\n /* The remote entity (OData entity set / Odoo model / declared REST surface). /\n remoteEntityRef: z.string().trim().min(1),\n /* The transport dialect spoken (`odata` \| `rest-json` \| `odoo-jsonrpc`). /\n dialect: z.string().trim().min(1),\n /* Remote rows the declared operation deleted (0 is a legitimate nothing-to-erase). /\n deletedRowCount: z.number().int().nonnegative(),\n /* Tenant scope, when the erasure request carried one. /\n organizationId: z.string().optional(),\n});\n\n/\n A subject erasure COMPLETED while rows linked to the subject remain live in an HTTP_API-bound\n * external system, on the controller's explicit per-request acknowledgement (ETL D6 stance 6c).\n \n THE RECORD IS THE CONTROL: the acknowledgement's entire justification is that the hole becomes\n * VISIBLE rather than prevented (`administrative-continuity-floors.md`), so this event must name\n * everything a reviewer needs to act — the subject, the resource, the external system, and the\n * remaining linkage when it could be measured.\n \n assurance-control: WILDO.AUDIT.ATTRIBUTION — an acknowledged erasure hole is recorded per\n * resource, per erasure request, never as a standing posture.\n \n assurance-control: WILDO.PRIVACY.ERASURE_PROPAGATION — a store the erasure deliberately did not\n * reach is recorded as such, so the accounting cannot read as complete.\n /\nexport const AuditableEvent_HttpApiNonErasureAcknowledged_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.HTTP_API_NON_ERASURE_ACKNOWLEDGED),\n /* The erased subject's resource type (e.g. `users`). /\n subjectResourceType: z.string().trim().min(1),\n /* The erased subject row ids whose linked remote rows remain live. /\n subjectIds: z.array(z.string().trim().min(1)).min(1),\n /* The HTTP_API-bound Wildo resource whose rows remain un-erased. /\n resourceType: z.string().trim().min(1),\n /* The provider the binding resolves credentials/base-URL through. /\n providerRef: z.string().trim().min(1),\n /* The remote entity (OData entity set / Odoo model / declared REST surface). /\n remoteEntityRef: z.string().trim().min(1),\n /* The transport dialect spoken (`odata` \| `rest-json` \| `odoo-jsonrpc`). /\n dialect: z.string().trim().min(1),\n /\n Remote rows still linked to the subject, when the target answered a count. ABSENT means the\n * count could not be measured (the count read failed or is undeclared for the binding) — never\n * write 0 for \"unknown\": zero is a measured answer.\n /\n remainingRowCount: z.number().int().nonnegative().optional(),\n /* Tenant scope, when the erasure request carried one. /\n organizationId: z.string().optional(),\n});\n\n/\n Audit-log event for cross-frontend session handoff issuance\n * (cross-app-jwt-propagation Step 2).\n \n Captures who issued a transferable session credential, where it was bound to,\n * and a hash of the deep-link target so ops can correlate handoff issuance with\n * the corresponding `tokenExchange` event WITHOUT leaking the raw deep link\n * (which can carry org IDs, share codes, or draft IDs).\n \n `returnPathHash` is hex-encoded `sha256(returnPath)` computed by the audit-log\n * helper from the validated returnPath. NEVER pass a pre-hashed value at the\n * call site (defense-in-depth: prevents accidental double-hashing or hash\n * mismatch with what the schema validated).\n /\nexport const AuditableEvent_User_CrossFrontendHandoffIssuedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_CROSS_FRONTEND_HANDOFF_ISSUED),\n userId: z.string(),\n /* The `X-Frontend-Service-Name` of the source frontend that initiated the handoff. /\n sourceFrontendServiceName: z.string().optional(),\n /* The SaaS-config service key (and runtime `frontendServiceName`) of the target. /\n targetServiceKey: z.string(),\n /* SHA-256 hex of the validated returnPath; NEVER the raw path. /\n returnPathHash: z.string(),\n /* ID of the issued AUTH_CODE_EXCHANGE consumable token (for replay forensics). /\n consumableTokenId: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\n// ── OAuth2 / OIDC Provider Event Data Schemas (Wildo AS the authorization server) ──\n\n/\n A user-delegated `authorization_code` access token was minted for a third-party client at\n * `/oauth/token`. This is the most security-sensitive access grant the provider makes: the client\n * can now act AS the user at the audience-bound A2A/MCP resource. `clientId` is the `azp`\n * (attribution only — the token carries the USER's authority, not the client's). Never carries the\n * raw token.\n /\nexport const AuditableEvent_OAuth_DelegatedTokenIssuedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.OAUTH_DELEGATED_TOKEN_ISSUED),\n /* The delegating (consenting) user — the token subject. /\n userId: z.string(),\n /* The third-party client the token was minted for (`azp`). /\n clientId: z.string(),\n /* The A2A/MCP resource-server audience the token is confined to. /\n audience: z.string(),\n /* Granted identity scopes (openid/…); may be empty. Identity/consent provenance only — no authz weight. /\n scopes: z.array(z.string()),\n /* Delegated-token lifetime in seconds (short-lived; never the full session TTL). /\n ttlSeconds: z.number(),\n ipAddress: z.string().optional(),\n});\n\n/* A user APPROVED an interactive consent request — a code is issued and the client may act for them. /\nexport const AuditableEvent_OAuth_ConsentGrantedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.OAUTH_CONSENT_GRANTED),\n /* The user who approved. /\n userId: z.string(),\n /* The client the consent was granted to. /\n clientId: z.string(),\n /* The scopes consented to. /\n scopes: z.array(z.string()),\n /* The RFC 8707 resource the consent was bound to, when present. /\n resource: z.string().optional(),\n /* Whether the user asked to persist the grant (\"remember this app\") — a durable-authority signal. /\n remembered: z.boolean(),\n ipAddress: z.string().optional(),\n});\n\n/* A user DENIED an interactive consent request — access refused. /\nexport const AuditableEvent_OAuth_ConsentDeniedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.OAUTH_CONSENT_DENIED),\n userId: z.string(),\n clientId: z.string(),\n scopes: z.array(z.string()),\n resource: z.string().optional(),\n ipAddress: z.string().optional(),\n});\n\n/\n A persistent consent grant (the durable \"remember this app\" record, keyed on\n * `(userId, clientId, resource)`) was created or updated — it lets future authorize flows SKIP the\n * consent prompt, so its lifecycle is a first-class delegated-authority audit concern.\n /\nexport const AuditableEvent_OAuth_ConsentGrantPersistedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.OAUTH_CONSENT_GRANT_PERSISTED),\n userId: z.string(),\n clientId: z.string(),\n /* The RFC 8707 resource the grant covers; absent for an OIDC-only (resource-less) grant. /\n resource: z.string().optional(),\n /* The union of scopes the grant now covers after the write. /\n scopes: z.array(z.string()),\n /* `true` when a NEW grant row was created; `false` when an existing grant's scopes were widened. /\n isNewGrant: z.boolean(),\n});\n\n/\n A CIMD `client_id` URL was refused. Unauthenticated by construction, so the URL, the reason and\n * the source of the request ARE the investigation surface.\n /\nexport const AuditableEvent_OAuth_CimdClientRefusedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.OAUTH_CIMD_CLIENT_REFUSED),\n /* The `client_id` URL as presented. Attacker-controlled, so treated as data, never as a locator. /\n clientId: z.string(),\n /* Closed vocabulary — branched on by operators and COUNTED, never free text. /\n reason: z.string(),\n detail: z.string().optional(),\n});\n\n/\n A client registered itself at `/oauth/register` (RFC 7591). Unauthenticated by construction, so\n * the source IP and the self-asserted name/redirects ARE the investigation surface — there is no\n * principal to attribute it to.\n /\nexport const AuditableEvent_OAuth_DynamicClientRegisteredEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.OAUTH_DYNAMIC_CLIENT_REGISTERED),\n clientId: z.string(),\n /* Self-asserted; nobody vetted it. Shown on the consent screen, so worth recording verbatim. /\n clientName: z.string(),\n /* The redirect URIs the client claimed — where an authorization code would be delivered. /\n redirectUris: z.array(z.string()),\n /\n The POST-LOGOUT redirect URIs the client claimed (revocation-C) — where an RP-Initiated Logout would\n * send the browser after the session ends. Optional: absent on rows written before the field existed and\n * for a registration that declared none.\n /\n postLogoutRedirectUris: z.array(z.string()).optional(),\n ipAddress: z.string().optional(),\n});\n\n/\n A user token was rotated via the provider `refresh_token` grant (`/oauth/token`). Distinct from the\n * first-party session refresh (`USER_TOKEN_REFRESHED`): this is the OAuth-provider endpoint, which a\n * confidential client MAY authenticate to. Low-detail INFO — the security-relevant refresh signal is\n * reuse/theft ({@link CoreAuditableEventType.USER_REFRESH_TOKEN_REUSE_DETECTED}).\n \n There is deliberately NO `OAUTH_TOKEN_REFRESH_FAILED` counterpart (user-confirmed 2026-07-31): routine\n * refresh failures (expired / revoked / plain-invalid presented token) are high-volume benign noise from\n * ended sessions, and auditing them would drown the compliance store. The only refresh-failure worth an\n * audit record is credential theft, which reuse-detection catches → `USER_REFRESH_TOKEN_REUSE_DETECTED`.\n /\nexport const AuditableEvent_OAuth_TokenRefreshedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.OAUTH_TOKEN_REFRESHED),\n /* The refreshing user, when resolvable from the freshly-minted access token; else absent. /\n userId: z.string().optional(),\n /* The client that authenticated the refresh (confidential-client id_token re-issue path); else absent. /\n clientId: z.string().optional(),\n /* Whether a confidential client was authenticated on this refresh (vs a first-party session refresh). /\n clientAuthenticated: z.boolean(),\n ipAddress: z.string().optional(),\n});\n\n/\n A token was revoked via `/oauth/revoke` (RFC 7009). The endpoint is deliberately a no-oracle (200 for\n * unknown tokens), so this records the ATTEMPT + the authenticated client (if any), never whether the\n * token existed or whose it was.\n /\nexport const AuditableEvent_OAuth_TokenRevokedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.OAUTH_TOKEN_REVOKED),\n /* The confidential client that authenticated to revoke, when present. /\n clientId: z.string().optional(),\n /* Whether a confidential client authenticated the revocation. /\n clientAuthenticated: z.boolean(),\n /* The RFC 7009 `token_type_hint` the caller supplied, when present. /\n tokenTypeHint: z.string().optional(),\n ipAddress: z.string().optional(),\n});\n\n/\n An OIDC RP-Initiated Logout (RP-Initiated Logout 1.0) terminated the End-User's OP session at\n * `/oauth/end-session` (revocation-C). Records WHO logged out WHICH session via WHICH relying party, and\n * whether a session was actually terminated / a post-logout redirect was refused. `userId`/`sessionId`/\n * `clientId` are present only when a valid `id_token_hint` identified them — an invalid or absent hint\n * still lands the user on the OP's page but terminates nothing.\n /\nexport const AuditableEvent_OAuth_RpInitiatedLogoutEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.OAUTH_RP_INITIATED_LOGOUT),\n /* The user whose OP session was terminated — present only when a valid `id_token_hint` identified them. /\n userId: z.string().optional(),\n /* The terminated login session (the id_token `sid`) — present only when the hint carried one. /\n sessionId: z.string().optional(),\n /* The relying party that initiated the logout (the id_token `azp`), when identifiable. /\n clientId: z.string().optional(),\n /* Whether a session was actually terminated (a valid hint carrying a `sid` was presented). /\n sessionTerminated: z.boolean(),\n /* Whether a presented `post_logout_redirect_uri` was REFUSED because it did not match the client's\n * registered allowlist — a misconfiguration / open-redirect-probe signal worth separating from a\n * plain no-URI logout. /\n postLogoutRedirectUriRejected: z.boolean(),\n ipAddress: z.string().optional(),\n});\n\n/\n An `authorization_code` exchange was REJECTED at `/oauth/token`. A potential attack signal (code\n * replay, PKCE downgrade, redirect tampering, cross-client redemption). `reason` names the cause;\n * `userId`/`resource` are present only for causes detected AFTER the code decodes (never for the\n * atomic replay/consume failure, which fails before decode).\n /\nexport const AuditableEvent_OAuth_CodeExchangeFailedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.OAUTH_CODE_EXCHANGE_FAILED),\n /* The specific failure cause (closed vocabulary). /\n reason: z.enum(OAuthCodeExchangeFailureReason),\n /* The redeeming client, when the request supplied one. /\n clientId: z.string().optional(),\n /* The code's subject, available only for post-decode causes. /\n userId: z.string().optional(),\n /* The code's bound resource, available only for post-decode causes. /\n resource: z.string().optional(),\n ipAddress: z.string().optional(),\n});\n\n/\n A consent DECISION was submitted by an authenticated user who is NOT the user the consent request was\n * bound to (returns 403). A textbook cross-user authorization-abuse signal — user A attempting to act on\n * user B's pending consent. CRITICAL: records BOTH principals for the SIEM.\n /\nexport const AuditableEvent_OAuth_ConsentBindingViolationEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.OAUTH_CONSENT_BINDING_VIOLATION),\n /* The authenticated user who submitted the decision (the actor). /\n authenticatedUserId: z.string(),\n /* The user the consent request was actually bound to (the victim). /\n boundUserId: z.string(),\n /* The client the consent request was for, when known. /\n clientId: z.string().optional(),\n /* The consent-request consumable-token id, for replay forensics. /\n consentTokenId: z.string().optional(),\n ipAddress: z.string().optional(),\n});\n\n/\n Refresh-token REUSE was detected → the whole token family was revoked (possible theft). Emitted by the\n * refresh CALLERS, NOT the token issuer: the issuer stays audit-free by design (it performs the revoke and\n * surfaces a machine-readable reuse SIGNAL on its thrown error), and each caller decides to audit. Applies\n * to BOTH the first-party session refresh and the OAuth-provider refresh grant (shared issuer).\n /\nexport const AuditableEvent_User_RefreshTokenReuseDetectedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_REFRESH_TOKEN_REUSE_DETECTED),\n /* The user whose token family was revoked (the victim). /\n userId: z.string(),\n /* The reused refresh token's `jti` (the replayed credential id) — never the raw token. /\n reusedJti: z.string(),\n /* The session the reused token belonged to, when present on the claim. /\n sessionId: z.string().optional(),\n /* Whether the family-wide revocation (`TOKEN_INVALID_BEFORE`) was written — the action taken. /\n familyRevoked: z.boolean(),\n ipAddress: z.string().optional(),\n});\n\n// MongoDB-compatible schema using simple object for eventData\n// The discriminated union validation will be handled at the service layer\nexport const AuditableEvent_DataSchema = z.record(z.string(), z.any());\n\n\n\n\nexport const AuditableEvent_BaseSchema = z.object({\n _id: z.string().isPrimaryKey().isSummaryField(),\n /\n Store-agnostic, server-assigned correlation key (UUID). The Mongo `_id` is\n * THIS store's primary key, but immudb (and any future audit sink) has its\n * own native key — so cross-store correlation needs an id that belongs to the\n * EVENT, not to one store. Fixed in `AuditLogsBackendService._createAuditLog`\n * — minted there, or supplied deterministically by a deferred recording (#535) —\n * BEFORE the DB write and carried on BOTH the DB row AND the provider fan-out\n * emission, so the Phase-3 completeness reconciler can match DB rows ⇄ immudb\n * records (and `AuditLogVerification.verifyAuditEvent(eventId)` resolves the\n * same key). Not the primary key: `_id` stays the DB PK.\n \n UNIQUE, because it names ONE event (#535). A caller that delivers an event at least once — an outbox relay replaying\n * an audit record after a crash — supplies a deterministic `eventId`, and a redelivery then collides here instead of\n * writing a second row. immudb (write-if-absent by `eventId`) and every SIEM wire format (whose dedup key is this\n * value) are idempotent on the same id, so all three destinations agree on \"once\". Sparse, as `.isUnique()` defaults:\n * a row written before `eventId` existed carries none and is not a duplicate of another.\n /\n eventId: z.string().isDBIndexed().isUnique(),\n // Note: .optional() must come AFTER decorators to preserve optionality in TypeScript type inference\n userId: z.string().isSummaryField().optional(),\n /\n The org the event is ABOUT (event DATA) — e.g. the org whose SSO config changed, or the\n * org resolved from a login email's domain. NEVER a routing key. Per-org SIEM / sink\n * dispatch routes ONLY on the AUTHENTICATED request org\n * (`ExecutionContext.initiatorIds.organizationId`) — this field is attacker-influenceable on\n * pre-auth paths (a failed-login email domain → org lookup), so routing on it would leak one\n * tenant's events into another tenant's SIEM (F4). See `AuditLogsBackendService._createAuditLog`.\n \n ## Why an attacker-influenceable value is nonetheless SAFE to persist here\n \n Recorded 2026-08-05, when this field stopped being silently dropped on write (see\n * `_createAuditLog`'s `preserveServerInjectedFields` call). The change makes a value an\n * unauthenticated caller can influence both durable and, on the org-scoped viewer, VISIBLE — so\n * the two channels it could reach were each checked rather than assumed.\n \n 1. SIEM delivery — unaffected. Per-org dispatch keys on the AUTHENTICATED request org, never\n * on this field (F4, above). Persisting it changes no routing decision, so the cross-tenant\n * SIEM leak F4 exists to prevent is not reachable through it.\n * 2. In-product visibility — intended, not a leak. `ORGANIZATIONS → AUDIT_LOGS` is\n * `REQUIRES_CONTEXT` on `organizationId`, so this value decides which org sees the row in the\n * org-scoped Audit Log Viewer. A failed-login row surfacing in the org whose user was targeted\n * is the CORRECT outcome — a tenant seeing authentication attempts against its own members is\n * the purpose of an audit log, not a disclosure. Nothing about a third org is exposed: the row\n * describes the attempt itself.\n \n Residual, stated rather than hidden: an unauthenticated caller can therefore cause rows to\n * appear in a NAMED org's viewer (log injection / noise) by choosing the email domain it probes.\n * Bounded to rows describing that caller's own attempt against that org, which is the org already\n * being attacked and the party with the strongest reason to see them. Volume abuse is bounded by\n * the authentication rate limiters, not by this field. If a future review wants that noise\n * separated, the fix is a provenance discriminator on the row (authenticated vs. domain-resolved\n * org), NOT dropping the field again — dropping it is what made the viewer's org filter return\n * nothing at all.\n \n assurance-control: WILDO.ACCESS.SCOPE_CONFINEMENT — tenant segregation of the audit trail is\n * enforced on the authenticated scope, while the subject org retains visibility of events\n * concerning it.\n /\n organizationId: z.string().isSummaryField().optional(),\n /\n The application the event is ABOUT when its owning tenant is application-scoped.\n * Like `organizationId`, this is forensic event data and never a per-org SIEM routing key.\n /\n applicationId: z.string().isSummaryField().optional(),\n /\n The request-correlation id (see `ExecutionContext.correlationId`) — groups every audit row produced\n * by ONE request / job / cron tick, and equals the `correlationId` stamped on that request's structured\n * log lines and errors, so an investigator can pivot audit ⇄ logs ⇄ error by a single id. Populated by\n * `_createAuditLog` from the request `ExecutionContext` when threaded, else from the ambient\n * request-context ALS frame — that fallback is what finally populates it on the COMMON emit path (most\n * emitters pass no EC). Indexed for correlation queries. Store-agnostic like `eventId`, but distinct:\n * `eventId` correlates ONE event across audit stores; `correlationId` correlates MANY events to one request.\n /\n correlationId: z.string().isDBIndexed().isSummaryField().optional(),\n /\n Which frontend SURFACE the request originated from (`x-frontend-service-name`: app / website / docs),\n * captured at the HTTP edge into the request-context frame and hoisted here by `_createAuditLog`. Origin\n * attribution — \"where did this action come from\". Absent for non-HTTP (job / cron / internal) events.\n /\n frontendServiceName: z.string().isSummaryField().optional(),\n /\n Which browser/device INSTALL the request came from (`x-client-instance-id`) — the axis that lets a\n * reviewer group one actor's activity ACROSS sessions and logins, which `correlationId` (one request)\n * and `frontendServiceName` (which surface) cannot. Captured at the HTTP edge into the request-context\n * frame and hoisted here by `_createAuditLog`, exactly like `frontendServiceName`.\n \n *Populated ONLY when the application authored a non-`DISABLED` `compliance.clientInstanceIdScope`\n (OPT-IN, default OFF — Fork D / SD9).** Absent for every unopted application, for non-HTTP events\n * (job / cron / internal), and whenever the client sent no id. It is a pseudonymous identifier under\n * GDPR Art 4(5), so it carries obligations the other correlation columns do not — see\n * `ClientInstanceIdScope` and `.claude/plans/traceability-correlation-id.md` (SD9).\n \n Deliberately DISTINCT from (never merged with, per SD8): `anonymousUserId` (an identity the app\n * assigns a pre-auth PERSON), `DeviceInfoSchema.fingerprint` (a derived/probabilistic device\n * signature), and `clientId` (the OAuth `azp` — which SOFTWARE client, already on the row).\n /\n // GDPR Art. 4(5) pseudonymised data by this field's own JSDoc above — so it is personal data, and\n // a notice must enumerate it. IDENTITY: it is an identifier assigned to a person's client, not an\n // observation of what they did.\n clientInstanceId: z.string().isDBIndexed().isSummaryField().optional()\n .dataCategories(PersonalDataCategory.IDENTITY),\n riskLevel: z.enum(ResourceOperationRiskLevel).isSummaryField(),\n // USAGE — an audit row is a record of what a principal DID. The event type and its data together\n // are the observation, so both carry the category; `riskLevel`, `eventCategory` and `severity` are\n // the framework's CLASSIFICATION of the event rather than data about the person, and carry none.\n //\n // ⚠️ The reverse of the `.isAuditEvidence()` rule, and deliberately so. That marker decides which\n // FIELD VALUES get copied INTO an audit row, and personal data must never be marked, because the\n // immutable ledger cannot be scrubbed. This declaration is about the audit row's OWN fields, which\n // hold personal data whether or not anyone wanted them to — and a notice must say so precisely\n // BECAUSE they are unerasable.\n eventType: z.string().isSummaryField().dataCategories(PersonalDataCategory.USAGE),\n eventData: AuditableEvent_DataSchema.dataCategories(PersonalDataCategory.USAGE),\n /* Populated by service layer via getAuditEventClassification(). Required for CREATE (audit logs are REPOSITORY_ONLY, no API). /\n eventCategory: z.enum(AuditEventCategory).isSummaryField(),\n /* Populated by service layer via getAuditEventClassification(). Required for CREATE (audit logs are REPOSITORY_ONLY, no API). */\n severity: z.enum(AuditEventSeverity).isSummaryField(),\n createdAt: z.date().default(() => new Date()).isSummaryField().excludeFromCreate().excludeFromUpdate(),\n updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate()\n});\n\n\n\n// Type-safe discriminated union for TypeScript validation (used in service layer)\nexport const AuditableEvent_TypedDataSchema = z.discriminatedUnion('eventType', [\n AuditableEvent_User_LoginEventDataSchema,\n AuditableEvent_User_LogoutEventDataSchema,\n AuditableEvent_User_LoginFailedEventDataSchema,\n AuditableEvent_User_AccountLockedEventDataSchema,\n AuditableEvent_MachineAuth_SuccessEventDataSchema,\n AuditableEvent_MachineAuth_FailedEventDataSchema,\n AuditableEvent_MachineAccess_EventDataSchema,\n AuditableEvent_User_SessionExpiredEventDataSchema,\n AuditableEvent_User_AppRolesChangedEventDataSchema,\n AuditableEvent_Application_SuperAdminFloorBreachedEventDataSchema,\n AuditableEvent_Organization_OwnerFloorBreachedEventDataSchema,\n AuditableEvent_Organization_TypeAssignedEventDataSchema,\n AuditableEvent_OrganizationMember_InvitedEventDataSchema,\n AuditableEvent_OrganizationMember_JoinedEventDataSchema,\n AuditableEvent_OrganizationMember_UpdatedEventDataSchema,\n AuditableEvent_OrganizationMember_RoleChangedEventDataSchema,\n AuditableEvent_OrganizationMember_StatusChangedEventDataSchema,\n AuditableEvent_OrganizationMember_RemovedEventDataSchema,\n AuditableEvent_Organization_CreatedEventDataSchema,\n AuditableEvent_Organization_UpdatedEventDataSchema,\n AuditableEvent_Organization_DeletedEventDataSchema,\n AuditableEvent_Organization_DeletionRequestedEventDataSchema,\n AuditableEvent_Organization_RestoredEventDataSchema,\n AuditableEvent_Organization_SuspendedEventDataSchema,\n AuditableEvent_Resource_StatusTransitionPerformedEventDataSchema,\n AuditableEvent_Organization_ActivatedEventDataSchema,\n AuditableEvent_OrganizationNotifications_UpdatedEventDataSchema,\n AuditableEvent_OrganizationPreferences_UpdatedEventDataSchema,\n AuditableEvent_OrganizationProfile_UpdatedEventDataSchema,\n AuditableEvent_OrganizationUnit_UpdatedEventDataSchema,\n AuditableEvent_OrganizationUnitMember_RoleChangedEventDataSchema,\n AuditableEvent_OrganizationUnitMember_RemovedEventDataSchema,\n AuditableEvent_User_DeletedEventDataSchema,\n AuditableEvent_User_SSOLoginEventDataSchema,\n AuditableEvent_User_SSOLoginFailedEventDataSchema,\n AuditableEvent_User_SSOEnforcementBlockedEventDataSchema,\n AuditableEvent_User_TokenRefreshedEventDataSchema,\n AuditableEvent_Organization_SSOConfigurationChangedEventDataSchema,\n AuditableEvent_Organization_SIEMExportConfiguredEventDataSchema,\n AuditableEvent_Organization_SIEMExportDisabledEventDataSchema,\n AuditableEvent_Organization_SIEMExportDestinationChangedEventDataSchema,\n AuditableEvent_OrganizationProviderCredential_SetEventDataSchema,\n AuditableEvent_OrganizationProviderCredential_RotatedEventDataSchema,\n AuditableEvent_OrganizationProviderCredential_UsedEventDataSchema,\n AuditableEvent_OrganizationProviderCredential_DeletedEventDataSchema,\n AuditableEvent_ApplicationAuthPolicyChanged_EventDataSchema,\n AuditableEvent_Webhook_EndpointTestDispatchedEventDataSchema,\n AuditableEvent_SCIM_TokenCreatedEventDataSchema,\n AuditableEvent_SCIM_TokenRevokedEventDataSchema,\n AuditableEvent_SCIM_UserProvisionedEventDataSchema,\n AuditableEvent_SCIM_UserUpdatedEventDataSchema,\n AuditableEvent_SCIM_UserDeactivatedEventDataSchema,\n AuditableEvent_User_PasswordResetRequestedEventDataSchema,\n AuditableEvent_User_PasswordResetCompletedEventDataSchema,\n AuditableEvent_User_PasswordResetForcedEventDataSchema,\n AuditableEvent_User_RegisteredEventDataSchema,\n AuditableEvent_User_EmailVerifiedEventDataSchema,\n AuditableEvent_User_VerificationEmailResentEventDataSchema,\n AuditableEvent_User_MFASetupStartedEventDataSchema,\n AuditableEvent_User_MFASetupCompletedEventDataSchema,\n AuditableEvent_User_MFAEmailOTPSentEventDataSchema,\n AuditableEvent_User_PasskeyRegisteredEventDataSchema,\n AuditableEvent_User_PasskeyAuthSuccessEventDataSchema,\n AuditableEvent_User_PasskeyAuthFailureEventDataSchema,\n AuditableEvent_User_PasskeyRemovedEventDataSchema,\n AuditableEvent_User_PasskeyCloneSuspectedEventDataSchema,\n AuditableEvent_User_MagicLinkSentEventDataSchema,\n AuditableEvent_User_MagicLinkVerifiedEventDataSchema,\n AuditableEvent_User_MagicLinkFailedEventDataSchema,\n AuditableEvent_User_SMSOTPSentEventDataSchema,\n AuditableEvent_User_SMSOTPVerifiedEventDataSchema,\n AuditableEvent_User_SMSOTPFailedEventDataSchema,\n AuditableEvent_User_PhoneVerifiedEventDataSchema,\n AuditableEvent_User_PhoneVerificationFailedEventDataSchema,\n AuditableEvent_OAuth2ProviderBlockedEventDataSchema,\n AuditableEvent_OidcAcrDemandUnsatisfiedEventDataSchema,\n AuditableEvent_EmergencyAccess_UsedEventDataSchema,\n AuditableEvent_FieldAccess_EventDataSchema,\n AuditableEvent_ResourceOperationPerformed_EventDataSchema,\n AuditableEvent_ResourceOperationDenied_EventDataSchema,\n AuditableEvent_CrossTenantAdministrativeAccess_EventDataSchema,\n AuditableEvent_PlatformDirectoryAccess_EventDataSchema,\n AuditableEvent_PlatformAccessGrantLifecycle_EventDataSchema,\n AuditableEvent_SystemOfRecordPartitionAssignmentLifecycle_EventDataSchema,\n AuditableEvent_RetainedDataAccess_EventDataSchema,\n AuditableEvent_GovernedDocument_InteractionRecordedEventDataSchema,\n AuditableEvent_SubjectDataExport_EventDataSchema,\n AuditableEvent_CollectionDataExport_EventDataSchema,\n AuditableEvent_User_SessionEvictedEventDataSchema,\n AuditableEvent_HttpApiReadThroughAccess_EventDataSchema,\n AuditableEvent_ProviderOperationCall_EventDataSchema,\n AuditableEvent_ProviderOperationDenied_EventDataSchema,\n AuditableEvent_HttpApiExternalErasure_EventDataSchema,\n AuditableEvent_HttpApiNonErasureAcknowledged_EventDataSchema,\n AuditableEvent_User_CrossFrontendHandoffIssuedEventDataSchema,\n AuditableEvent_OAuth_DelegatedTokenIssuedEventDataSchema,\n AuditableEvent_OAuth_ConsentGrantedEventDataSchema,\n AuditableEvent_OAuth_ConsentDeniedEventDataSchema,\n AuditableEvent_OAuth_ConsentGrantPersistedEventDataSchema,\n AuditableEvent_OAuth_TokenRefreshedEventDataSchema,\n AuditableEvent_OAuth_TokenRevokedEventDataSchema,\n AuditableEvent_OAuth_RpInitiatedLogoutEventDataSchema,\n AuditableEvent_OAuth_CodeExchangeFailedEventDataSchema,\n AuditableEvent_OAuth_ConsentBindingViolationEventDataSchema,\n AuditableEvent_User_RefreshTokenReuseDetectedEventDataSchema,\n]);\n\n\n\n\nexport type AuditableEvent = z.infer<typeof AuditableEvent_BaseSchema>;\nexport type AuditableEvent_User_LoginEventData = z.infer<typeof AuditableEvent_User_LoginEventDataSchema>;\nexport type AuditableEvent_User_LogoutEventData = z.infer<typeof AuditableEvent_User_LogoutEventDataSchema>;\nexport type AuditableEvent_User_LoginFailedEventData = z.infer<typeof AuditableEvent_User_LoginFailedEventDataSchema>;\nexport type AuditableEvent_MachineAuth_SuccessEventData = z.infer<typeof AuditableEvent_MachineAuth_SuccessEventDataSchema>;\nexport type AuditableEvent_MachineAuth_FailedEventData = z.infer<typeof AuditableEvent_MachineAuth_FailedEventDataSchema>;\nexport type AuditableEvent_MachineAccess_EventData = z.infer<typeof AuditableEvent_MachineAccess_EventDataSchema>;\nexport type AuditableEvent_User_AccountLockedEventData = z.infer<typeof AuditableEvent_User_AccountLockedEventDataSchema>;\nexport type AuditableEvent_User_SessionExpiredEventData = z.infer<typeof AuditableEvent_User_SessionExpiredEventDataSchema>;\nexport type AuditableEvent_User_AppRolesChangedEventData = z.infer<typeof AuditableEvent_User_AppRolesChangedEventDataSchema>;\nexport type AuditableEvent_Application_SuperAdminFloorBreachedEventData = z.infer<typeof AuditableEvent_Application_SuperAdminFloorBreachedEventDataSchema>;\nexport type AuditableEvent_Organization_OwnerFloorBreachedEventData = z.infer<typeof AuditableEvent_Organization_OwnerFloorBreachedEventDataSchema>;\nexport type AuditableEvent_Organization_TypeAssignedEventData = z.infer<typeof AuditableEvent_Organization_TypeAssignedEventDataSchema>;\nexport type AuditableEvent_User_DeletedEventData = z.infer<typeof AuditableEvent_User_DeletedEventDataSchema>;\nexport type AuditableEvent_OrganizationMember_InvitedEventData = z.infer<typeof AuditableEvent_OrganizationMember_InvitedEventDataSchema>;\nexport type AuditableEvent_OrganizationMember_JoinedEventData = z.infer<typeof AuditableEvent_OrganizationMember_JoinedEventDataSchema>;\nexport type AuditableEvent_OrganizationMember_UpdatedEventData = z.infer<typeof AuditableEvent_OrganizationMember_UpdatedEventDataSchema>;\nexport type AuditableEvent_OrganizationMember_RoleChangedEventData = z.infer<typeof AuditableEvent_OrganizationMember_RoleChangedEventDataSchema>;\nexport type AuditableEvent_OrganizationMember_StatusChangedEventData = z.infer<typeof AuditableEvent_OrganizationMember_StatusChangedEventDataSchema>;\nexport type AuditableEvent_OrganizationMember_RemovedEventData = z.infer<typeof AuditableEvent_OrganizationMember_RemovedEventDataSchema>;\nexport type AuditableEvent_Organization_CreatedEventData = z.infer<typeof AuditableEvent_Organization_CreatedEventDataSchema>;\nexport type AuditableEvent_Organization_UpdatedEventData = z.infer<typeof AuditableEvent_Organization_UpdatedEventDataSchema>;\nexport type AuditableEvent_Organization_DeletedEventData = z.infer<typeof AuditableEvent_Organization_DeletedEventDataSchema>;\nexport type AuditableEvent_Organization_DeletionRequestedEventData = z.infer<typeof AuditableEvent_Organization_DeletionRequestedEventDataSchema>;\nexport type AuditableEvent_Organization_RestoredEventData = z.infer<typeof AuditableEvent_Organization_RestoredEventDataSchema>;\nexport type AuditableEvent_Organization_SuspendedEventData = z.infer<typeof AuditableEvent_Organization_SuspendedEventDataSchema>;\nexport type AuditableEvent_Resource_StatusTransitionPerformedEventData = z.infer<typeof AuditableEvent_Resource_StatusTransitionPerformedEventDataSchema>;\nexport type AuditableEvent_Organization_ActivatedEventData = z.infer<typeof AuditableEvent_Organization_ActivatedEventDataSchema>;\nexport type AuditableEvent_OrganizationNotifications_UpdatedEventData = z.infer<typeof AuditableEvent_OrganizationNotifications_UpdatedEventDataSchema>;\nexport type AuditableEvent_OrganizationPreferences_UpdatedEventData = z.infer<typeof AuditableEvent_OrganizationPreferences_UpdatedEventDataSchema>;\nexport type AuditableEvent_OrganizationProfile_UpdatedEventData = z.infer<typeof AuditableEvent_OrganizationProfile_UpdatedEventDataSchema>;\nexport type AuditableEvent_OrganizationUnit_UpdatedEventData = z.infer<typeof AuditableEvent_OrganizationUnit_UpdatedEventDataSchema>;\nexport type AuditableEvent_OrganizationUnitMember_RoleChangedEventData = z.infer<typeof AuditableEvent_OrganizationUnitMember_RoleChangedEventDataSchema>;\nexport type AuditableEvent_OrganizationUnitMember_RemovedEventData = z.infer<typeof AuditableEvent_OrganizationUnitMember_RemovedEventDataSchema>;\nexport type AuditableEvent_User_SSOLoginEventData = z.infer<typeof AuditableEvent_User_SSOLoginEventDataSchema>;\nexport type AuditableEvent_User_SSOLoginFailedEventData = z.infer<typeof AuditableEvent_User_SSOLoginFailedEventDataSchema>;\nexport type AuditableEvent_User_SSOEnforcementBlockedEventData = z.infer<typeof AuditableEvent_User_SSOEnforcementBlockedEventDataSchema>;\nexport type AuditableEvent_User_TokenRefreshedEventData = z.infer<typeof AuditableEvent_User_TokenRefreshedEventDataSchema>;\nexport type AuditableEvent_Organization_SSOConfigurationChangedEventData = z.infer<typeof AuditableEvent_Organization_SSOConfigurationChangedEventDataSchema>;\nexport type AuditableEvent_Organization_SIEMExportConfiguredEventData = z.infer<typeof AuditableEvent_Organization_SIEMExportConfiguredEventDataSchema>;\nexport type AuditableEvent_Organization_SIEMExportDisabledEventData = z.infer<typeof AuditableEvent_Organization_SIEMExportDisabledEventDataSchema>;\nexport type AuditableEvent_Organization_SIEMExportDestinationChangedEventData = z.infer<typeof AuditableEvent_Organization_SIEMExportDestinationChangedEventDataSchema>;\nexport type AuditableEvent_OrganizationProviderCredential_SetEventData = z.infer<typeof AuditableEvent_OrganizationProviderCredential_SetEventDataSchema>;\nexport type AuditableEvent_OrganizationProviderCredential_RotatedEventData = z.infer<typeof AuditableEvent_OrganizationProviderCredential_RotatedEventDataSchema>;\nexport type AuditableEvent_OrganizationProviderCredential_UsedEventData = z.infer<typeof AuditableEvent_OrganizationProviderCredential_UsedEventDataSchema>;\nexport type AuditableEvent_OrganizationProviderCredential_DeletedEventData = z.infer<typeof AuditableEvent_OrganizationProviderCredential_DeletedEventDataSchema>;\nexport type AuditableEvent_UserProviderCredential_SetEventData = z.infer<typeof AuditableEvent_UserProviderCredential_SetEventDataSchema>;\nexport type AuditableEvent_UserProviderCredential_RotatedEventData = z.infer<typeof AuditableEvent_UserProviderCredential_RotatedEventDataSchema>;\nexport type AuditableEvent_UserProviderCredential_UsedEventData = z.infer<typeof AuditableEvent_UserProviderCredential_UsedEventDataSchema>;\nexport type AuditableEvent_UserProviderCredential_DeletedEventData = z.infer<typeof AuditableEvent_UserProviderCredential_DeletedEventDataSchema>;\nexport type AuditableEvent_UserProviderConnection_GrantedEventData = z.infer<typeof AuditableEvent_UserProviderConnection_GrantedEventDataSchema>;\nexport type AuditableEvent_OrganizationProviderConnection_GrantedEventData = z.infer<typeof AuditableEvent_OrganizationProviderConnection_GrantedEventDataSchema>;\nexport type ApplicationAuthPolicySnapshot = z.infer<typeof ApplicationAuthPolicySnapshotSchema>;\nexport type AuditableEvent_ApplicationAuthPolicyChanged_EventData = z.infer<typeof AuditableEvent_ApplicationAuthPolicyChanged_EventDataSchema>;\nexport type AuditableEvent_Webhook_EndpointTestDispatchedEventData = z.infer<typeof AuditableEvent_Webhook_EndpointTestDispatchedEventDataSchema>;\nexport type AuditableEvent_SCIM_TokenCreatedEventData = z.infer<typeof AuditableEvent_SCIM_TokenCreatedEventDataSchema>;\nexport type AuditableEvent_SCIM_TokenRevokedEventData = z.infer<typeof AuditableEvent_SCIM_TokenRevokedEventDataSchema>;\nexport type AuditableEvent_SCIM_UserProvisionedEventData = z.infer<typeof AuditableEvent_SCIM_UserProvisionedEventDataSchema>;\nexport type AuditableEvent_SCIM_UserUpdatedEventData = z.infer<typeof AuditableEvent_SCIM_UserUpdatedEventDataSchema>;\nexport type AuditableEvent_SCIM_UserDeactivatedEventData = z.infer<typeof AuditableEvent_SCIM_UserDeactivatedEventDataSchema>;\nexport type AuditableEvent_User_PasswordResetRequestedEventData = z.infer<typeof AuditableEvent_User_PasswordResetRequestedEventDataSchema>;\nexport type AuditableEvent_User_PasswordResetCompletedEventData = z.infer<typeof AuditableEvent_User_PasswordResetCompletedEventDataSchema>;\nexport type AuditableEvent_User_PasswordResetForcedEventData = z.infer<typeof AuditableEvent_User_PasswordResetForcedEventDataSchema>;\nexport type AuditableEvent_User_RegisteredEventData = z.infer<typeof AuditableEvent_User_RegisteredEventDataSchema>;\nexport type AuditableEvent_User_EmailVerifiedEventData = z.infer<typeof AuditableEvent_User_EmailVerifiedEventDataSchema>;\nexport type AuditableEvent_User_VerificationEmailResentEventData = z.infer<typeof AuditableEvent_User_VerificationEmailResentEventDataSchema>;\nexport type AuditableEvent_User_MFASetupStartedEventData = z.infer<typeof AuditableEvent_User_MFASetupStartedEventDataSchema>;\nexport type AuditableEvent_User_MFASetupCompletedEventData = z.infer<typeof AuditableEvent_User_MFASetupCompletedEventDataSchema>;\nexport type AuditableEvent_User_MFAEmailOTPSentEventData = z.infer<typeof AuditableEvent_User_MFAEmailOTPSentEventDataSchema>;\nexport type AuditableEvent_User_PasskeyRegisteredEventData = z.infer<typeof AuditableEvent_User_PasskeyRegisteredEventDataSchema>;\nexport type AuditableEvent_User_PasskeyAuthSuccessEventData = z.infer<typeof AuditableEvent_User_PasskeyAuthSuccessEventDataSchema>;\nexport type AuditableEvent_User_PasskeyAuthFailureEventData = z.infer<typeof AuditableEvent_User_PasskeyAuthFailureEventDataSchema>;\nexport type AuditableEvent_User_PasskeyCloneSuspectedEventData = z.infer<typeof AuditableEvent_User_PasskeyCloneSuspectedEventDataSchema>;\nexport type AuditableEvent_User_PasskeyRemovedEventData = z.infer<typeof AuditableEvent_User_PasskeyRemovedEventDataSchema>;\nexport type AuditableEvent_User_MagicLinkSentEventData = z.infer<typeof AuditableEvent_User_MagicLinkSentEventDataSchema>;\nexport type AuditableEvent_User_MagicLinkVerifiedEventData = z.infer<typeof AuditableEvent_User_MagicLinkVerifiedEventDataSchema>;\nexport type AuditableEvent_User_MagicLinkFailedEventData = z.infer<typeof AuditableEvent_User_MagicLinkFailedEventDataSchema>;\nexport type AuditableEvent_User_SMSOTPSentEventData = z.infer<typeof AuditableEvent_User_SMSOTPSentEventDataSchema>;\nexport type AuditableEvent_User_SMSOTPVerifiedEventData = z.infer<typeof AuditableEvent_User_SMSOTPVerifiedEventDataSchema>;\nexport type AuditableEvent_User_SMSOTPFailedEventData = z.infer<typeof AuditableEvent_User_SMSOTPFailedEventDataSchema>;\nexport type AuditableEvent_User_PhoneVerifiedEventData = z.infer<typeof AuditableEvent_User_PhoneVerifiedEventDataSchema>;\nexport type AuditableEvent_User_PhoneVerificationFailedEventData = z.infer<typeof AuditableEvent_User_PhoneVerificationFailedEventDataSchema>;\nexport type AuditableEvent_EmergencyAccess_UsedEventData = z.infer<typeof AuditableEvent_EmergencyAccess_UsedEventDataSchema>;\nexport type AuditableEvent_FieldAccess_EventData = z.infer<typeof AuditableEvent_FieldAccess_EventDataSchema>;\nexport type AuditableEvent_ResourceOperationPerformed_EventData = z.infer<typeof AuditableEvent_ResourceOperationPerformed_EventDataSchema>;\nexport type AuditableEvent_PlatformDirectoryAccess_EventData = z.infer<typeof AuditableEvent_PlatformDirectoryAccess_EventDataSchema>;\nexport type AuditableEvent_ResourceOperationDenied_EventData = z.infer<typeof AuditableEvent_ResourceOperationDenied_EventDataSchema>;\nexport type AuditableEvent_RetainedDataAccess_EventData = z.infer<typeof AuditableEvent_RetainedDataAccess_EventDataSchema>;\nexport type AuditableEvent_GovernedDocument_InteractionRecordedEventData = z.infer<typeof AuditableEvent_GovernedDocument_InteractionRecordedEventDataSchema>;\nexport type AuditableEvent_SubjectDataExport_EventData = z.infer<typeof AuditableEvent_SubjectDataExport_EventDataSchema>;\nexport type AuditableEvent_CollectionDataExport_EventData = z.infer<typeof AuditableEvent_CollectionDataExport_EventDataSchema>;\nexport type AuditableEvent_User_SessionEvictedEventData = z.infer<typeof AuditableEvent_User_SessionEvictedEventDataSchema>;\nexport type AuditableEvent_HttpApiReadThroughAccess_EventData = z.infer<typeof AuditableEvent_HttpApiReadThroughAccess_EventDataSchema>;\nexport type AuditableEvent_ProviderOperationCall_EventData = z.infer<typeof AuditableEvent_ProviderOperationCall_EventDataSchema>;\nexport type AuditableEvent_ProviderOperationDenied_EventData = z.infer<typeof AuditableEvent_ProviderOperationDenied_EventDataSchema>;\nexport type AuditableEvent_HttpApiExternalErasure_EventData = z.infer<typeof AuditableEvent_HttpApiExternalErasure_EventDataSchema>;\nexport type AuditableEvent_HttpApiNonErasureAcknowledged_EventData = z.infer<typeof AuditableEvent_HttpApiNonErasureAcknowledged_EventDataSchema>;\nexport type AuditableEvent_User_CrossFrontendHandoffIssuedEventData = z.infer<typeof AuditableEvent_User_CrossFrontendHandoffIssuedEventDataSchema>;\nexport type AuditableEvent_OAuth_DelegatedTokenIssuedEventData = z.infer<typeof AuditableEvent_OAuth_DelegatedTokenIssuedEventDataSchema>;\nexport type AuditableEvent_OAuth_ConsentGrantedEventData = z.infer<typeof AuditableEvent_OAuth_ConsentGrantedEventDataSchema>;\nexport type AuditableEvent_OAuth_ConsentDeniedEventData = z.infer<typeof AuditableEvent_OAuth_ConsentDeniedEventDataSchema>;\nexport type AuditableEvent_OAuth_ConsentGrantPersistedEventData = z.infer<typeof AuditableEvent_OAuth_ConsentGrantPersistedEventDataSchema>;\nexport type AuditableEvent_OAuth_DynamicClientRegisteredEventData = z.infer<typeof AuditableEvent_OAuth_DynamicClientRegisteredEventDataSchema>;\nexport type AuditableEvent_OAuth_CimdClientRefusedEventData = z.infer<typeof AuditableEvent_OAuth_CimdClientRefusedEventDataSchema>;\nexport type AuditableEvent_OAuth_TokenRefreshedEventData = z.infer<typeof AuditableEvent_OAuth_TokenRefreshedEventDataSchema>;\nexport type AuditableEvent_OAuth_TokenRevokedEventData = z.infer<typeof AuditableEvent_OAuth_TokenRevokedEventDataSchema>;\nexport type AuditableEvent_OAuth_RpInitiatedLogoutEventData = z.infer<typeof AuditableEvent_OAuth_RpInitiatedLogoutEventDataSchema>;\nexport type AuditableEvent_OAuth_CodeExchangeFailedEventData = z.infer<typeof AuditableEvent_OAuth_CodeExchangeFailedEventDataSchema>;\nexport type AuditableEvent_OAuth_ConsentBindingViolationEventData = z.infer<typeof AuditableEvent_OAuth_ConsentBindingViolationEventDataSchema>;\nexport type AuditableEvent_User_RefreshTokenReuseDetectedEventData = z.infer<typeof AuditableEvent_User_RefreshTokenReuseDetectedEventDataSchema>;\n"]}
1	+ {"version":3,"file":"auditable-events.shared.schema.js","sourceRoot":"","sources":["../../../../src/compliance/audit-trails/auditable-events.shared.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAChF,OAAO,EAAE,2BAA2B,EAAE,MAAM,iDAAiD,CAAC;AAC9F,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrF,OAAO,EACL,iBAAiB,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,2BAA2B,EAAE,gCAAgC,EACzJ,uBAAuB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,0BAA0B,GACtI,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAAE,yBAAyB,EAAE,2BAA2B,EAAE,qBAAqB,EAAE,MAAM,qDAAqD,CAAC;AACpJ,OAAO,EAAE,oCAAoC,EAAE,MAAM,wDAAwD,CAAC;AAC9G,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EAAE,iCAAiC,EAAE,MAAM,2EAA2E,CAAC;AAC9H,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,0BAA0B,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,MAAM,8DAA8D,CAAC;AAC1F,OAAO,EAAE,wBAAwB,EAAE,MAAM,sFAAsF,CAAC;AAChI,OAAO,EAAE,qCAAqC,EAAE,uBAAuB,EAAE,MAAM,qEAAqE,CAAC;AACrJ,OAAO,EAAE,iCAAiC,EAAE,MAAM,mEAAmE,CAAC;AACtH,OAAO,EAAE,0CAA0C,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AACtH,OAAO,EAAE,iCAAiC,EAAE,MAAM,4DAA4D,CAAC;AAC/G,OAAO,EAAE,oBAAoB,EAAE,MAAM,kDAAkD,CAAC;AACxF,OAAO,EAAE,kCAAkC,EAAE,0BAA0B,EAAE,iCAAiC,EAAE,4BAA4B,EAAE,6BAA6B,EAAE,MAAM,6DAA6D,CAAC;AAC7O,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AACpH,OAAO,EAAE,kBAAkB,EAAE,MAAM,8CAA8C,CAAC;AAClF,OAAO,EAAE,2BAA2B,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,EAAE,kCAAkC,EAAE,MAAM,2CAA2C,CAAC;AAC/F,OAAO,EACL,8BAA8B,EAC9B,yBAAyB,EACzB,6BAA6B,EAC7B,oCAAoC,GACrC,MAAM,mDAAmD,CAAC;AAC3D,OAAO,EAAE,8BAA8B,EAAE,MAAM,oDAAoD,CAAC;AACpG,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAAE,MAAM,0CAA0C,CAAC;AACpH,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC1F,OAAO,EACL,qCAAqC,EACrC,sCAAsC,EACtC,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,qEAAqE,CAAC;AAC7E,OAAO,EAAE,2CAA2C,EAAE,MAAM,+EAA+E,CAAC;AAC5I,OAAO,EAAE,iCAAiC,EAAE,sCAAsC,EAAE,MAAM,uEAAuE,CAAC;AAClK,OAAO,EACL,oCAAoC,EACpC,yCAAyC,EACzC,iCAAiC,EACjC,qCAAqC,GACtC,MAAM,mEAAmE,CAAC;AAC3E,OAAO,EAAE,8BAA8B,EAAE,wCAAwC,EAAE,MAAM,gDAAgD,CAAC;AAC1I,OAAO,EAAE,8BAA8B,EAAE,+BAA+B,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,MAAM,+CAA+C,CAAC;AAC7K,OAAO,EAAE,8BAA8B,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,+CAA+C,CAAC;AACtK,OAAO,EAAE,0BAA0B,EAAE,MAAM,mDAAmD,CAAC;AAC/F,OAAO,EACL,iBAAiB,EACjB,0BAA0B,EAC1B,qCAAqC,EACrC,6BAA6B,EAC7B,uCAAuC,GACxC,MAAM,gEAAgE,CAAC;AACxE,OAAO,EACL,aAAa,EACb,iBAAiB,GAClB,MAAM,8DAA8D,CAAC;AACtE,OAAO,EAAE,2BAA2B,EAAE,MAAM,uDAAuD,CAAC;AACpG,OAAO,EACL,gCAAgC,EAChC,qCAAqC,EACrC,kCAAkC,GACnC,MAAM,uEAAuE,CAAC;AAG/E,MAAM,CAAN,IAAY,sBA8kCX;AA9kCD,WAAY,sBAAsB;IAChC,wBAAwB;IACxB,mDAAyB,CAAA;IACzB,qDAA2B,CAAA;IAC3B,iEAAuC,CAAA;IACvC,qEAA2C,CAAA;IAC3C,yEAA+C,CAAA;IAC/C,6FAA6F;IAC7F,yFAAyF;IACzF,gGAAgG;IAChG,+FAA+F;IAC/F,+FAA+F;IAC/F,8FAA8F;IAC9F,+DAAqC,CAAA;IACrC,2FAA2F;IAC3F,iEAAuC,CAAA;IACvC,gGAAgG;IAChG,iGAAiG;IACjG,2FAA2F;IAC3F,iGAAiG;IACjG,mFAAmF;IACnF,iGAAiG;IACjG,kBAAkB;IAClB,uEAA6C,CAAA;IAE7C;;;;;;;;;;;;;;;OAeG;IACH,uEAA6C,CAAA;IAE7C,oGAAoG;IACpG,6FAA6F;IAC7F,2EAA2E;IAC3E,uEAA6C,CAAA;IAC7C,qEAA2C,CAAA;IAC3C,mGAAmG;IACnG,oGAAoG;IACpG,mGAAmG;IACnG,kGAAkG;IAClG,2DAAiC,CAAA;IAEjC,wBAAwB;IACxB,yEAAyE;IACzE,+FAA+F;IAC/F,iGAAiG;IACjG,uGAAuG;IACvG,8FAA8F;IAC9F,iGAAiG;IACjG,iGAAiG;IACjG,iEAAiE;IACjE,uDAA6B,CAAA;IAC7B,uGAAuG;IACvG,uDAA6B,CAAA;IAC7B,uDAA6B,CAAA;IAE7B,kEAAkE;IAClE,kGAAkG;IAClG,kGAAkG;IAClG,mGAAmG;IACnG,mGAAmG;IACnG,kDAAkD;IAClD,+FAA+F;IAC/F,2EAAiD,CAAA;IAEjD,iGAAiG;IACjG,8FAA8F;IAC9F,+FAA+F;IAC/F,2FAA2F;IAC3F,+FAA+F;IAC/F,uEAAuE;IACvE,mGAAmG;IACnG,wFAAwF;IACxF,2GAAiF,CAAA;IACjF;;;;;;;;;;OAUG;IACH,iGAAuE,CAAA;IAEvE,gCAAgC;IAChC,uGAAuG;IACvG,uEAA6C,CAAA;IAC7C,uGAAuG;IACvG,uEAA6C,CAAA;IAC7C;;;OAGG;IACH,mFAAyD,CAAA;IACzD,uEAA6C,CAAA;IAC7C,0GAA0G;IAC1G,6FAAmE,CAAA;IACnE,2EAA2E;IAC3E,yEAA+C,CAAA;IAC/C,oFAAoF;IACpF,2EAAiD,CAAA;IACjD,mEAAmE;IACnE,2EAAiD,CAAA;IACjD;;;;;;;;;;;;;;OAcG;IACH,uGAA6E,CAAA;IAE7E,6BAA6B;IAC7B,uGAAuG;IACvG,qFAA2D,CAAA;IAC3D,uGAAuG;IACvG,mFAAyD,CAAA;IACzD,uGAAuG;IACvG,qFAA2D,CAAA;IAC3D,+FAAqE,CAAA;IACrE,uGAAuG;IACvG,mGAAyE,CAAA;IACzE,qFAA2D,CAAA;IAE3D,uGAAuG;IACvG,mGAAyE,CAAA;IACzE,uGAAuG;IACvG,+FAAqE,CAAA;IACrE,uGAAuG;IACvG,uFAA6D,CAAA;IAC7D,uGAAuG;IACvG,iFAAuD,CAAA;IAEvD,oFAAoF;IACpF,kGAAkG;IAClG,2FAA2F;IAC3F,+FAA+F;IAC/F,mGAAmG;IACnG,2EAA2E;IAC3E,+FAA+F;IAC/F,yGAA+E,CAAA;IAE/E,iEAAiE;IACjE,+FAA+F;IAC/F,mGAAmG;IACnG,6FAA6F;IAC7F,8EAA8E;IAC9E,yFAAyF;IACzF,+FAAqE,CAAA;IAErE,4BAA4B;IAC5B,2DAAiC,CAAA;IACjC,yEAA+C,CAAA;IAE/C;;;;;;;;;;;;;;;;OAgBG;IACH,uFAA6D,CAAA;IAC7D,uEAA6C,CAAA;IAE7C,0CAA0C;IAC1C,uGAAuG;IACvG,qGAAqG;IACrG,oGAAoG;IACpG,qFAAqF;IACrF,2GAAiF,CAAA;IACjF,qIAAqI;IACrI,qGAA2E,CAAA;IAC3E;;;;;;OAMG;IACH,iGAAuE,CAAA;IACvE;;;;OAIG;IACH,uHAA6F,CAAA;IAE7F,0CAA0C;IAC1C,EAAE;IACF,6FAA6F;IAC7F,4FAA4F;IAC5F,gGAAgG;IAChG,6FAA6F;IAC7F,0FAA0F;IAC1F,+BAA+B;IAC/B,EAAE;IACF,+FAA+F;IAC/F,gGAAgG;IAChG,EAAE;IACF,8FAA8F;IAC9F,uDAAuD;IACvD,uGAA6E,CAAA;IAC7E,+GAAqF,CAAA;IACrF,yGAA+E,CAAA;IAC/E,+GAAqF,CAAA;IAErF,6FAA6F;IAC7F,+FAA+F;IAC/F,iGAAiG;IACjG,2FAA2F;IAC3F,kEAAkE;IAClE,uFAA6D,CAAA;IAC7D,+FAAqE,CAAA;IACrE,yFAA+D,CAAA;IAC/D,+FAAqE,CAAA;IAErE,uEAAuE;IACvE,EAAE;IACF,kGAAkG;IAClG,kGAAkG;IAClG,kGAAkG;IAClG,8FAA8F;IAC9F,mGAAmG;IACnG,mGAAmG;IACnG,gGAAgG;IAChG,wFAAwF;IACxF,EAAE;IACF,mGAAmG;IACnG,mGAAmG;IACnG,sEAAsE;IACtE,EAAE;IACF,+FAA+F;IAC/F,mDAAmD;IACnD,EAAE;IACF,iGAAiG;IACjG,uCAAuC;IACvC,+GAAqF,CAAA;IACrF,+FAAqE,CAAA;IAErE,4CAA4C;IAC5C,qHAAqH;IACrH,gGAAgG;IAChG,8FAA8F;IAC9F,kGAAkG;IAClG,kGAAkG;IAClG,kGAAkG;IAClG,kGAAkG;IAClG,gGAAgG;IAChG,qFAAqF;IACrF,iGAAiG;IACjG,8EAA8E;IAC9E,6FAAmE,CAAA;IAEnE,gCAAgC;IAChC,0GAA0G;IAC1G,4GAA4G;IAC5G,0EAA0E;IAC1E,+GAA+G;IAC/G,2FAAiE,CAAA;IAEjE,8BAA8B;IAC9B,qFAAqF;IACrF,uFAAuF;IACvF,yFAAyF;IACzF,uDAAuD;IACvD,uGAAuG;IACvG,0DAA0D;IAC1D,+FAAqE,CAAA;IAErE,kCAAkC;IAClC,kGAAkG;IAClG,uGAAuG;IACvG,qGAAqG;IACrG,mGAAmG;IACnG,sGAAsG;IACtG,qEAAqE;IACrE,iFAAuD,CAAA;IACvD,+GAA+G;IAC/G,iFAAuD,CAAA;IACvD,8GAA8G;IAC9G,uEAAuE;IACvE,qFAA2D,CAAA;IAC3D,mFAAyD,CAAA;IACzD,6EAAmD,CAAA;IACnD,+GAA+G;IAC/G,kEAAkE;IAClE,yEAA+C,CAAA;IAC/C,0GAA0G;IAC1G,yCAAyC;IACzC,iFAAuD,CAAA;IAEvD,2FAA2F;IAC3F,0GAA0G;IAC1G,mFAAmF;IACnF,+FAAqE,CAAA;IACrE,4GAA4G;IAC5G,uDAAuD;IACvD,mEAAyC,CAAA;IACzC,uEAA6C,CAAA;IAC7C,mIAAmI;IACnI,qFAA2D,CAAA;IAC3D,+GAA+G;IAC/G,4FAA4F;IAC5F,2FAAiE,CAAA;IAEjE,wGAAwG;IACxG,4FAA4F;IAC5F,oIAAoI;IACpI,iGAAuE,CAAA;IACvE,0JAA0J;IAC1J,uHAA6F,CAAA;IAC7F,mGAAyE,CAAA;IACzE,uJAAuJ;IACvJ,qGAA2E,CAAA;IAC3E,iGAAuE,CAAA;IACvE,2KAA2K;IAC3K,2EAAiD,CAAA;IACjD,2EAAiD,CAAA;IACjD,mJAAmJ;IACnJ,iGAAuE,CAAA;IACvE,kIAAkI;IAClI,uFAA6D,CAAA;IAE7D,qCAAqC;IACrC,uGAAuG;IACvG,mEAAyC,CAAA;IACzC,uGAAuG;IACvG,yGAAyG;IACzG,oFAAoF;IACpF,mEAAyC,CAAA;IACzC,wGAAwG;IACxG,uEAA6C,CAAA;IAC7C,sGAAsG;IACtG,mEAAyC,CAAA;IACzC,uGAAuG;IACvG,sGAAsG;IACtG,0GAA0G;IAC1G,+FAAqE,CAAA;IACrE,+EAAqD,CAAA;IACrD,yEAA+C,CAAA;IAC/C,iEAAuC,CAAA;IACvC,yEAA+C,CAAA;IAE/C,6BAA6B;IAC7B,yFAA+D,CAAA;IAC/D,yFAA+D,CAAA;IAC/D;;;;;;;OAOG;IACH,mFAAyD,CAAA;IAEzD,0CAA0C;IAC1C,6DAAmC,CAAA;IACnC,qEAA2C,CAAA;IAC3C,2FAAiE,CAAA;IAEjE,kCAAkC;IAClC,iEAAuC,CAAA;IACvC,mEAAyC,CAAA;IACzC,mFAAyD,CAAA;IAEzD,4BAA4B;IAC5B,2EAAiD,CAAA;IACjD,+EAAqD,CAAA;IACrD,6EAAmD,CAAA;IAEnD,qCAAqC;IACrC,6EAAmD,CAAA;IACnD,qGAA2E,CAAA;IAC3E,qGAA2E,CAAA;IAC3E,uEAA6C,CAAA;IAC7C,uFAA6D,CAAA;IAE7D,+BAA+B;IAC/B,uEAA6C,CAAA;IAC7C,+EAAqD,CAAA;IACrD,2EAAiD,CAAA;IAEjD,4BAA4B;IAC5B,iEAAuC,CAAA;IACvC,yEAA+C,CAAA;IAC/C,qEAA2C,CAAA;IAE3C,uCAAuC;IACvC,qEAA2C,CAAA;IAC3C,2FAAiE,CAAA;IAEjE,sCAAsC;IACtC,uEAA6C,CAAA;IAC7C,mEAAyC,CAAA;IACzC,iEAAuC,CAAA;IACvC,2FAAiE,CAAA;IACjE,mEAAyC,CAAA;IACzC,mEAAyC,CAAA;IACzC,mEAAyC,CAAA;IACzC,uEAA6C,CAAA;IAC7C,mEAAyC,CAAA;IAEzC,gDAAgD;IAChD,6EAAmD,CAAA;IAEnD;;;;;;;;;OASG;IACH,qFAA2D,CAAA;IAE3D,iCAAiC;IACjC;;;;;;;OAOG;IACH,+EAAqD,CAAA;IACrD,mFAAyD,CAAA;IACzD,iFAAuD,CAAA;IACvD;;;;;;OAMG;IACH,2EAAiD,CAAA;IACjD,+EAAqD,CAAA;IAErD,0CAA0C;IAC1C;;;;;;;;;;;;;;;;OAgBG;IACH,yEAA+C,CAAA;IAC/C;;;;;;;;;;OAUG;IACH,+EAAqD,CAAA;IACrD,yEAA+C,CAAA;IAC/C,6EAAmD,CAAA;IACnD,oGAAoG;IACpG,yEAA+C,CAAA;IAE/C,mEAAmE;IACnE,mGAAyE,CAAA;IAEzE,0BAA0B;IAC1B,yEAA+C,CAAA;IAE/C,sBAAsB;IACtB,uDAA6B,CAAA;IAE7B,4EAA4E;IAC5E,EAAE;IACF,iGAAiG;IACjG,gGAAgG;IAChG,kGAAkG;IAClG,0FAA0F;IAC1F,wDAAwD;IACxD,EAAE;IACF,8FAA8F;IAC9F,6FAA6F;IAC7F,4FAA4F;IAC5F,8FAA8F;IAC9F,mDAAmD;IACnD,EAAE;IACF,iGAAiG;IACjG,8FAA8F;IAC9F,8FAA8F;IAC9F,gCAAgC;IAChC,EAAE;IACF,wEAAwE;IACxE,uFAAuF;IACvF,uFAA6D,CAAA;IAE7D,kGAAkG;IAClG,EAAE;IACF,6FAA6F;IAC7F,kGAAkG;IAClG,iGAAiG;IACjG,4FAA4F;IAC5F,8EAA8E;IAC9E,EAAE;IACF,mCAAmC;IACnC,EAAE;IACF,qGAAqG;IACrG,mGAAmG;IACnG,kGAAkG;IAClG,EAAE;IACF,4CAA4C;IAC5C,EAAE;IACF,iGAAiG;IACjG,6FAA6F;IAC7F,+FAA+F;IAC/F,gGAAgG;IAChG,4FAA4F;IAC5F,gFAAgF;IAChF,EAAE;IACF,+FAA+F;IAC/F,sFAAsF;IACtF,8FAA8F;IAC9F,EAAE;IACF,8FAA8F;IAC9F,oFAAoF;IACpF,iFAAuD,CAAA;IACvD,mGAAyE,CAAA;IACzE,6FAAmE,CAAA;IACnE;;;;;OAKG;IACH,iEAAuC,CAAA;IACvC;;;;OAIG;IACH,qEAA2C,CAAA;IAC3C;;;;;OAKG;IACH,qGAA2E,CAAA;IAC3E;;;;;OAKG;IACH,mGAAyE,CAAA;IACzE;;;;;OAKG;IACH,6GAAmF,CAAA;IACnF,8GAA8G;IAC9G,qFAA2D,CAAA;IAC3D;;;;OAIG;IACH,iGAAuE,CAAA;IACvE;;;;;OAKG;IACH,6GAAmF,CAAA;IACnF,uGAAuG;IACvG,iIAAuG,CAAA;IACvG,iFAAiF;IACjF,+FAAqE,CAAA;IACrE,4EAA4E;IAC5E,mGAAyE,CAAA;IACzE;;;;OAIG;IACH,mHAAyF,CAAA;IACzF,0HAA0H;IAC1H,+GAAqF,CAAA;IACrF;;;OAGG;IACH,6GAAmF,CAAA;IACnF,2GAA2G;IAC3G,6GAAmF,CAAA;IACnF;;;OAGG;IACH,qGAA2E,CAAA;IAC3E,mHAAmH;IACnH,qGAA2E,CAAA;IAC3E;;;;OAIG;IACH,mGAAyE,CAAA;IACzE;;;;OAIG;IACH,+HAAqG,CAAA;IACrG;;;OAGG;IACH,2GAAiF,CAAA;IACjF;;;OAGG;IACH,iIAAuG,CAAA;IACvG;;;;;;;;;;;;;;;;;;;OAmBG;IACH,6HAAmG,CAAA;IACnG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IACH,iFAAuD,CAAA;IAEvD,+CAA+C;IAC/C,0EAA0E;IAC1E,yEAAyE;IACzE,yEAAyE;IACzE,4DAA4D;IAC5D,gFAAgF;IAChF,wFAAwF;IACxF,mFAAmF;IACnF,wFAAwF;IACxF,uFAAuF;IACvF,oEAAoE;IACpE,qEAA2C,CAAA;IAC3C,2EAA2E;IAC3E,wEAAwE;IACxE,2EAA2E;IAC3E,6EAA6E;IAC7E,4EAA4E;IAC5E,+CAA+C;IAC/C,uEAA6C,CAAA;IAE7C,kHAAkH;IAClH,mGAAyE,CAAA;IAEzE,kDAAkD;IAClD,oGAAoG;IACpG,qGAAqG;IACrG,mGAAmG;IACnG,iEAAiE;IACjE,+FAA+F;IAC/F,uGAAuG;IACvG,uEAA6C,CAAA;IAE7C,gGAAgG;IAChG,wFAAwF;IACxF,4FAA4F;IAC5F,gGAAgG;IAChG,+FAA+F;IAC/F,2FAA2F;IAC3F,gGAAgG;IAChG,sDAAsD;IACtD,2FAA2F;IAC3F,uEAAuE;IACvE,EAAE;IACF,8FAA8F;IAC9F,6FAA6F;IAC7F,0FAA0F;IAC1F,uFAAuF;IACvF,kFAAkF;IAClF,EAAE;IACF,+FAA+F;IAC/F,4FAA4F;IAC5F,kGAAkG;IAClG,iGAAiG;IACjG,+FAA+F;IAC/F,uDAAuD;IACvD,EAAE;IACF,qGAAqG;IACrG,qGAAqG;IACrG,qGAAqG;IACrG,sGAAsG;IACtG,uCAAuC;IACvC,2GAAiF,CAAA;IAEjF,qEAA2C,CAAA;IAC3C,6FAA6F;IAC7F,iGAAiG;IACjG,mGAAmG;IACnG,iGAAiG;IACjG,kGAAkG;IAClG,2EAA2E;IAC3E,2EAAiD,CAAA;IAEjD,qFAAqF;IACrF,2FAA2F;IAC3F,4FAA4F;IAC5F,yFAAyF;IACzF,4FAA4F;IAC5F,2FAA2F;IAC3F,yFAAyF;IACzF,qFAAqF;IACrF,4FAA4F;IAC5F,8FAA8F;IAC9F,8FAA8F;IAC9F,0FAA0F;IAC1F,8DAA8D;IAC9D,uFAA6D,CAAA;IAE7D,wGAAwG;IACxG,kGAAkG;IAClG,yGAAyG;IACzG,kGAAkG;IAClG,sGAAsG;IACtG,oGAAoG;IACpG,uGAAuG;IACvG,oGAAoG;IACpG,6EAA6E;IAC7E,EAAE;IACF,oGAAoG;IACpG,mGAAmG;IACnG,mGAAmG;IACnG,kGAAkG;IAClG,6DAA6D;IAC7D,2EAAiD,CAAA;IAEjD,mHAAmH;IACnH,uHAAuH;IACvH,sHAAsH;IACtH,sHAAsH;IACtH,+GAA+G;IAC/G,EAAE;IACF,qHAAqH;IACrH,mHAAmH;IACnH,oHAAoH;IACpH,qEAAqE;IACrE,+FAAqE,CAAA;IAErE,qHAAqH;IACrH,oHAAoH;IACpH,sHAAsH;IACtH,oHAAoH;IACpH,iGAAiG;IACjG,6FAAmE,CAAA;IAEnE,uHAAuH;IACvH,sHAAsH;IACtH,oHAAoH;IACpH,wHAAwH;IACxH,kGAAkG;IAClG,uFAA6D,CAAA;IAE7D,kHAAkH;IAClH,kHAAkH;IAClH,qHAAqH;IACrH,iHAAiH;IACjH,6GAAmF,CAAA;IAEnF,uHAAuH;IACvH,yHAAyH;IACzH,kHAAkH;IAClH,uHAAuH;IACvH,6FAAmE,CAAA;IAEnE,yFAAyF;IACzF,+FAA+F;IAC/F,8FAA8F;IAC9F,4FAA4F;IAC5F,mFAAmF;IACnF,4FAA4F;IAC5F,+FAA+F;IAC/F,yFAAyF;IACzF,4FAA4F;IAC5F,iFAAuD,CAAA;IAEvD,gGAAgG;IAChG,+FAA+F;IAC/F,2FAA2F;IAC3F,+FAA+F;IAC/F,+FAA+F;IAC/F,+FAA+F;IAC/F,+FAA+F;IAC/F,WAAW;IACX,iGAAuE,CAAA;IAEvE,sFAAsF;IACtF,6GAA6G;IAC7G,+GAA+G;IAC/G,mHAAmH;IACnH,oHAAoH;IACpH,mHAAmH;IACnH,sHAAsH;IACtH,6CAA6C;IAC7C,iGAAuE,CAAA;IAEvE,iGAAiG;IACjG,kDAAkD;IAClD,EAAE;IACF,gGAAgG;IAChG,kGAAkG;IAClG,8FAA8F;IAC9F,gGAAgG;IAChG,gGAAgG;IAChG,+FAA+F;IAC/F,kGAAkG;IAClG,qDAAqD;IACrD,EAAE;IACF,mGAAmG;IACnG,iGAAiG;IACjG,+FAA+F;IAC/F,kGAAkG;IAClG,oBAAoB;IACpB,EAAE;IACF,2FAA2F;IAC3F,uFAAuF;IACvF,+FAA+F;IAC/F,EAAE;IACF,2FAA2F;IAC3F,qFAAqF;IACrF,6EAAmD,CAAA;IAEnD,8FAA8F;IAC9F,EAAE;IACF,oGAAoG;IACpG,gGAAgG;IAChG,mGAAmG;IACnG,oGAAoG;IACpG,qGAAqG;IACrG,8DAA8D;IAC9D,EAAE;IACF,wGAAwG;IACxG,gGAAgG;IAChG,EAAE;IACF,mGAAmG;IACnG,yDAAyD;IACzD,iFAAuD,CAAA;IAEvD,8DAA8D;IAC9D,EAAE;IACF,+FAA+F;IAC/F,2FAA2F;IAC3F,6FAA6F;IAC7F,mGAAmG;IACnG,iGAAiG;IACjG,iGAAiG;IACjG,gEAAgE;IAChE,EAAE;IACF,kGAAkG;IAClG,iFAAiF;IACjF,EAAE;IACF,gGAAgG;IAChG,mGAAmG;IACnG,+FAA+F;IAC/F,yDAAyD;IACzD,EAAE;IACF,kGAAkG;IAClG,mEAAmE;IACnE,yDAA+B,CAAA;IAE/B,8FAA8F;IAC9F,uGAAuG;IACvG,EAAE;IACF,qGAAqG;IACrG,sGAAsG;IACtG,sGAAsG;IACtG,sGAAsG;IACtG,0GAA0G;IAC1G,EAAE;IACF,gGAAgG;IAChG,sGAAsG;IACtG,mGAAmG;IACnG,4FAA4F;IAC5F,wGAAwG;IACxG,oGAAoG;IACpG,mGAAmG;IACnG,gGAAgG;IAChG,EAAE;IACF,sGAAsG;IACtG,4CAA4C;IAC5C,EAAE;IACF,kGAAkG;IAClG,2EAA2E;IAC3E,+EAAqD,CAAA;IAErD,mDAAmD;IACnD,kGAAkG;IAClG,8FAA8F;IAC9F,sGAAsG;IACtG,gFAAgF;IAChF,8FAA8F;IAC9F,+EAAqD,CAAA;IACrD;;;;;;OAMG;IACH,6EAAmD,CAAA;IACnD,mGAAmG;IACnG,iFAAuD,CAAA;IACvD,yDAAyD;IACzD,+EAAqD,CAAA;IACrD,sGAAsG;IACtG,2EAAiD,CAAA;IACjD,+GAA+G;IAC/G,yFAA+D,CAAA;IAC/D,oGAAoG;IACpG,uFAAuF;IACvF,sHAAsH;IACtH,2FAAiE,CAAA;IACjE;;;;;OAKG;IACH,6FAAmE,CAAA;IACnE,mHAAmH;IACnH,qFAA2D,CAAA;IAC3D,qGAAqG;IACrG,uFAA6D,CAAA;IAE7D,kCAAkC;IAClC,wGAAwG;IACxG,uGAAuG;IACvG,yEAAyE;IACzE;;;;;OAKG;IACH,2EAAiD,CAAA;IACjD,0GAA0G;IAC1G,+EAAqD,CAAA;IACrD,0FAA0F;IAC1F,yFAA+D,CAAA;IAC/D,0GAA0G;IAC1G,yFAA+D,CAAA;IAE/D,0EAA0E;IAC1E,8EAA8E;IAC9E,mFAAmF;IACnF,4EAA4E;IAC5E,kFAAkF;IAClF,2FAA2F;IAE3F;mGAC+F;IAC/F,uFAA6D,CAAA;IAC7D,yGAAyG;IACzG,yEAA+C,CAAA;IAC/C,0FAA0F;IAC1F,uEAA6C,CAAA;IAC7C,wGAAwG;IACxG,yFAA+D,CAAA;IAC/D;;;;;OAKG;IACH,6FAAmE,CAAA;IACnE;;;;;;;;OAQG;IACH,iFAAuD,CAAA;IACvD,wFAAwF;IACxF,yEAA+C,CAAA;IAC/C,0DAA0D;IAC1D,qEAA2C,CAAA;IAC3C;;wFAEoF;IACpF,iFAAuD,CAAA;IACvD;kFAC8E;IAC9E,mFAAyD,CAAA;IACzD;4DACwD;IACxD,6FAAmE,CAAA;IAEnE;8GAC0G;IAC1G,iGAAuE,CAAA;AACzE,CAAC,EA9kCW,sBAAsB,KAAtB,sBAAsB,QA8kCjC;AAED;;;;GAIG;AACH,MAAM,CAAN,IAAY,8BAiBX;AAjBD,WAAY,8BAA8B;IACxC,2FAA2F;IAC3F,mFAAiD,CAAA;IACjD,+FAA+F;IAC/F,mFAAiD,CAAA;IACjD,oDAAoD;IACpD,2DAAyB,CAAA;IACzB,gFAAgF;IAChF,qEAAmC,CAAA;IACnC,4EAA4E;IAC5E,iFAA+C,CAAA;IAC/C,mFAAmF;IACnF,uFAAqD,CAAA;IACrD,gGAAgG;IAChG,qEAAmC,CAAA;IACnC,uFAAuF;IACvF,qEAAmC,CAAA;AACrC,CAAC,EAjBW,8BAA8B,KAA9B,8BAA8B,QAiBzC;AAED,4FAA4F;AAC5F,MAAM,CAAN,IAAY,kBAMX;AAND,WAAY,kBAAkB;IAC5B,uDAAiC,CAAA;IACjC,qDAA+B,CAAA;IAC/B,uDAAiC,CAAA;IACjC,uDAAiC,CAAA;IACjC,iDAA2B,CAAA;AAC7B,CAAC,EANW,kBAAkB,KAAlB,kBAAkB,QAM7B;AAED,2FAA2F;AAC3F,MAAM,CAAN,IAAY,kBAIX;AAJD,WAAY,kBAAkB;IAC5B,mCAAa,CAAA;IACb,yCAAmB,CAAA;IACnB,2CAAqB,CAAA;AACvB,CAAC,EAJW,kBAAkB,KAAlB,kBAAkB,QAI7B;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAA8F;IACtI,CAAC,kBAAkB,CAAC,cAAc,CAAC,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,8DAA8D,EAAE;IACxI,CAAC,kBAAkB,CAAC,aAAa,CAAC,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,4DAA4D,EAAE;IACpI,CAAC,kBAAkB,CAAC,cAAc,CAAC,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,4DAA4D,EAAE;IACtI,CAAC,kBAAkB,CAAC,cAAc,CAAC,EAAE,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,qDAAqD,EAAE;IACxI,CAAC,kBAAkB,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,qEAAqE,EAAE;CAC1I,CAAC;AAEF,MAAM,CAAC,MAAM,6BAA6B,GAA8F;IACtI,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,iEAAiE,EAAE;IAC9H,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,yDAAyD,EAAE;IACrH,CAAC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,gEAAgE,EAAE;CAC/H,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CACrC,IAAY,EACZ,QAAuF;IAEvF,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,OAAO,KAAK,OAAO,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/G,OAAO,GAAG,IAAI,gBAAgB,MAAM,EAAE,CAAC;AACzC,CAAC;AAED;;;;;;;;GAQG;AACH;;;;;GAKG;AACH,MAAM,CAAN,IAAY,2BAUX;AAVD,WAAY,2BAA2B;IACrC,8FAA8F;IAC9F,oDAAqB,CAAA;IACrB;;;OAGG;IACH,4DAA6B,CAAA;IAC7B,oHAAoH;IACpH,kDAAmB,CAAA;AACrB,CAAC,EAVW,2BAA2B,KAA3B,2BAA2B,QAUtC;AAED;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,wBAOX;AAPD,WAAY,wBAAwB;IAClC,2CAAe,CAAA;IACf,uCAAW,CAAA;IACX,+CAAmB,CAAA;IACnB,yDAA6B,CAAA;IAC7B,0FAA0F;IAC1F,+CAAmB,CAAA;AACrB,CAAC,EAPW,wBAAwB,KAAxB,wBAAwB,QAOnC;AAED,0HAA0H;AAC1H,MAAM,CAAN,IAAY,4BAWX;AAXD,WAAY,4BAA4B;IACtC,yDAAyB,CAAA;IACzB,qDAAqB,CAAA;IACrB,uEAAuE;IACvE,uEAAuC,CAAA;IACvC,2EAA2C,CAAA;IAC3C,+EAA+C,CAAA;IAC/C,yFAAyD,CAAA;IACzD,2EAA2C,CAAA;IAC3C,2FAA2F;IAC3F,iEAAiC,CAAA;AACnC,CAAC,EAXW,4BAA4B,KAA5B,4BAA4B,QAWvC;AAED;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,6BAOX;AAPD,WAAY,6BAA6B;IACvC,iDAAiD;IACjD,wDAAuB,CAAA;IACvB,yGAAyG;IACzG,kDAAiB,CAAA;IACjB,sGAAsG;IACtG,oEAAmC,CAAA;AACrC,CAAC,EAPW,6BAA6B,KAA7B,6BAA6B,QAOxC;AAED,MAAM,CAAN,IAAY,6BAgCX;AAhCD,WAAY,6BAA6B;IACvC;;;;OAIG;IACH,8EAA6C,CAAA;IAC7C;;;;OAIG;IACH,gFAA+C,CAAA;IAC/C,+GAA+G;IAC/G,oFAAmD,CAAA;IACnD;;;;OAIG;IACH,kGAAiE,CAAA;IACjE;;;OAGG;IACH,gFAA+C,CAAA;IAC/C;;;;OAIG;IACH,0EAAyC,CAAA;AAC3C,CAAC,EAhCW,6BAA6B,KAA7B,6BAA6B,QAgCxC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,6BAwKX;AAxKD,WAAY,6BAA6B;IACvC;;;;;OAKG;IACH,sFAAqD,CAAA;IAErD;;;;;OAKG;IACH,4FAA2D,CAAA;IAE3D;;;;;;;;;;;;OAYG;IACH,wEAAuC,CAAA;IAEvC;;;OAGG;IACH,0EAAyC,CAAA;IAEzC;;;;OAIG;IACH,kEAAiC,CAAA;IAEjC;;;OAGG;IACH,kFAAiD,CAAA;IAEjD;;;OAGG;IACH,4EAA2C,CAAA;IAE3C;;;;;;;;;;;;;OAaG;IACH,kFAAiD,CAAA;IAEjD;;;;;;;;;;;;;;OAcG;IACH,0GAAyE,CAAA;IAEzE;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,gFAA+C,CAAA;IAE/C;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,gGAA+D,CAAA;IAE/D;;;;;;;;;;;OAWG;IACH,gGAA+D,CAAA;IAE/D;;;;;;;;;;OAUG;IACH,kIAAiG,CAAA;AACnG,CAAC,EAxKW,6BAA6B,KAA7B,6BAA6B,QAwKxC;AAED,qCAAqC;AACrC,MAAM,CAAN,IAAY,mBAOX;AAPD,WAAY,mBAAmB;IAC7B,0CAAmB,CAAA;IACnB,0CAAmB,CAAA;IACnB,0CAAmB,CAAA;IACnB,wDAAiC,CAAA;IACjC,4DAAqC,CAAA;IACrC,kEAA2C,CAAA;AAC7C,CAAC,EAPW,mBAAmB,KAAnB,mBAAmB,QAO9B;AAED,6CAA6C;AAC7C,MAAM,CAAN,IAAY,oBAIX;AAJD,WAAY,oBAAoB;IAC9B,2CAAmB,CAAA;IACnB,6CAAqB,CAAA;IACrB,2CAAmB,CAAA;AACrB,CAAC,EAJW,oBAAoB,KAApB,oBAAoB,QAI/B;AAED;;;;;GAKG;AACH,MAAM,CAAN,IAAY,sBAuDX;AAvDD,WAAY,sBAAsB;IAChC,+DAAqC,CAAA;IACrC,mEAAyC,CAAA;IACzC,0FAA0F;IAC1F,yDAA+B,CAAA;IAC/B,sFAAsF;IACtF,+DAAqC,CAAA;IACrC;;;;;;;OAOG;IACH,yEAA+C,CAAA;IAC/C;;;;;;;;OAQG;IACH,+FAAqE,CAAA;IACrE,kGAAkG;IAClG,+FAAqE,CAAA;IACrE,kEAAkE;IAClE,iGAAuE,CAAA;IACvE,sGAAsG;IACtG,qGAA2E,CAAA;IAC3E;;;;;;OAMG;IACH,2DAAiC,CAAA;IACjC,2DAAiC,CAAA;IACjC,2DAAiC,CAAA;IACjC;;;;;;;;;OASG;IACH,+CAAqB,CAAA;IACrB,+CAAqB,CAAA;IACrB,mDAAyB,CAAA;AAC3B,CAAC,EAvDW,sBAAsB,KAAtB,sBAAsB,QAuDjC;AAED,MAAM,kCAAkC,GAA6E;IACnH,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,sBAAsB,CAAC,QAAQ;IAC7D,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,sBAAsB,CAAC,QAAQ;IAC7D,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,sBAAsB,CAAC,UAAU;CAClE,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,oCAAoC,CAAC,SAA4C;IAC/F,OAAO,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,kCAAkC,CAAC,SAAS,CAAC,CAAC;AAC7F,CAAC;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC;IAC9C,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC;IAC9B,CAAC,CAAC,MAAM,EAAE;CACX,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/D,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,UAAU,CAAC;IACvD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,MAAM,CAAC;IAChE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,WAAW,CAAC;IACxD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,8CAA8C,GAAG,CAAC,CAAC,MAAM,CAAC;IACrE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,iBAAiB,CAAC;IAC9D,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;IAChB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAN,IAAY,oBAKX;AALD,WAAY,oBAAoB;IAC9B,6FAA6F;IAC7F,uEAA+C,CAAA;IAC/C,kGAAkG;IAClG,2EAAmD,CAAA;AACrD,CAAC,EALW,oBAAoB,KAApB,oBAAoB,QAK/B;AAED,MAAM,CAAC,MAAM,gDAAgD,GAAG,CAAC,CAAC,MAAM,CAAC;IACvE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,mBAAmB,CAAC;IAChE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;IAChB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,UAAU;IACvC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB;;;;OAIG;IACH,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;CAChD,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iDAAiD,GAAG,CAAC,CAAC,MAAM,CAAC;IACxE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,oBAAoB,CAAC;IACjE,2DAA2D;IAC3D,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,oFAAoF;IACpF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,uFAAuF;IACvF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,mEAAmE;IACnE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gDAAgD,GAAG,CAAC,CAAC,MAAM,CAAC;IACvE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,mBAAmB,CAAC;IAChE,+EAA+E;IAC/E,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,kHAAkH;IAClH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,6GAA6G;IAC7G,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,4CAA4C,GAAG,CAAC,CAAC,MAAM,CAAC;IACnE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,cAAc,CAAC;IAC3D,2DAA2D;IAC3D,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,2FAA2F;IAC3F,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,uFAAuF;IACvF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB;;;;OAIG;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B;;;OAGG;IACH,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrC,6GAA6G;IAC7G,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,6GAA6G;IAC7G,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,2FAA2F;IAC3F,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC/B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iDAAiD,GAAG,CAAC,CAAC,MAAM,CAAC;IACxE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,oBAAoB,CAAC;IACjE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,UAAU;IACvC,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE;CACvB,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,iDAAiD,GAAG,CAAC,CAAC,MAAM,CAAC;IACxE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,oBAAoB,CAAC;IACjE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,8EAA8E;IAC9E,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,uGAAuG;IACvG,eAAe,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACpC,iFAAiF;IACjF,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC9C,kGAAkG;IAClG,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CAC9C,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,MAAM,CAAC;IACjE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,YAAY,CAAC;IACzD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,0FAA0F;IAC1F,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,kDAAkD,GAAG,CAAC,CAAC,MAAM,CAAC;IACzE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,sBAAsB,CAAC;IACnE,qEAAqE;IACrE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAClC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC7B,gGAAgG;IAChG,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACnC,qGAAqG;IACrG,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,iEAAiE,GAAG,CAAC,CAAC,MAAM,CAAC;IACxF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,sCAAsC,CAAC;IACnF,mGAAmG;IACnG,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE;IACjC,sCAAsC;IACtC,6BAA6B,EAAE,CAAC,CAAC,MAAM,EAAE;IACzC,uGAAuG;IACvG,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACpC,iEAAiE;IACjE,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CACpC,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH;;;;;;;;;;GAUG;AACH,MAAM,CAAN,IAAY,uCAmBX;AAnBD,WAAY,uCAAuC;IACjD;;;;;;;OAOG;IACH,gGAAqD,CAAA;IACrD;;;;;;;OAOG;IACH,sEAA2B,CAAA;AAC7B,CAAC,EAnBW,uCAAuC,KAAvC,uCAAuC,QAmBlD;AAED,MAAM,CAAC,MAAM,6DAA6D,GAAG,CAAC,CAAC,MAAM,CAAC;IACpF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,iCAAiC,CAAC;IAC9E,6DAA6D;IAC7D,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B;;;;OAIG;IACH,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,uCAAuC,CAAC;IAC3D,gEAAgE;IAChE,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE;IACjC;;;;;OAKG;IACH,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAChD,2GAA2G;IAC3G,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1C,+EAA+E;IAC/E,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC;;;OAGG;IACH,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC;AAEH,yCAAyC;AACzC,MAAM,CAAC,MAAM,wDAAwD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,2BAA2B,CAAC;IACxE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC1B,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,uDAAuD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,0BAA0B,CAAC;IACvE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC1B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,wDAAwD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,2BAA2B,CAAC;IACxE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;CACvC,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,MAAM,4DAA4D,GAAG,CAAC,CAAC,MAAM,CAAC;IACnF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,gCAAgC,CAAC;IAC7E,wCAAwC;IACxC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,2CAA2C;IAC3C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,qEAAqE;IACrE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAClC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC7B,0HAA0H;IAC1H,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC9C,+FAA+F;IAC/F,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB;;;;;;;OAOG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,gEAAgE,GAAG,CAAC,CAAC,MAAM,CAAC;IACvF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,qCAAqC,CAAC;IAClF,wCAAwC;IACxC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,8GAA8G;IAC9G,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,2CAA2C;IAC3C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,qFAAqF;IACrF,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3C,2EAA2E;IAC3E,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,qFAAqF;IACrF,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,4FAA4F;IAC5F,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,MAAM,4DAA4D,GAAG,CAAC,CAAC,MAAM,CAAC;IACnF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,gCAAgC,CAAC;IAC7E,yCAAyC;IACzC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,iDAAiD;IACjD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,2CAA2C;IAC3C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,oFAAoF;IACpF,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3C,4GAA4G;IAC5G,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,8DAA8D,GAAG,CAAC,CAAC,MAAM,CAAC;IACrF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,kCAAkC,CAAC;IAC/E,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,CAAC,MAAM,wDAAwD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,2BAA2B,CAAC;IACxE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,2CAA2C;IAC3C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,qDAAqD;IACrD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB;;;OAGG;IACH,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrC;;;;;;;OAOG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,qGAAqG;IACrG,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB;;;;;;;;;;;;OAYG;IACH,sBAAsB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QACvC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE;QAC9B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;KACjB,CAAC,CAAC,CAAC,QAAQ,EAAE;IACd;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB;;;;OAIG;IACH,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAEH,4CAA4C;AAC5C,MAAM,CAAC,MAAM,kDAAkD,GAAG,CAAC,CAAC,MAAM,CAAC;IACzE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,oBAAoB,CAAC;IACjE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kDAAkD,GAAG,CAAC,CAAC,MAAM,CAAC;IACzE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,oBAAoB,CAAC;IACjE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,+BAkCX;AAlCD,WAAY,+BAA+B;IACzC;;;;OAIG;IACH,4EAAyC,CAAA;IACzC;;;;;;;;;OASG;IACH,0EAAuC,CAAA;IACvC;;;;;;;;;;;;;;OAcG;IACH,4EAAyC,CAAA;AAC3C,CAAC,EAlCW,+BAA+B,KAA/B,+BAA+B,QAkC1C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,MAAM,uDAAuD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,0BAA0B,CAAC;IACvE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,wHAAwH;IACxH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,2BAA2B,CAAC,iBAAiB,CAAC;IACtF;;;;OAIG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC;IAC9C;;;;;;;;;;;OAWG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kDAAkD,GAAG,CAAC,CAAC,MAAM,CAAC;IACzE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,oBAAoB,CAAC;IACjE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,4DAA4D,GAAG,CAAC,CAAC,MAAM,CAAC;IACnF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,+BAA+B,CAAC;IAC5E,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,0FAA0F;IAC1F,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,2FAA2F;IAC3F,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,yFAAyF;IACzF,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAEH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,mDAAmD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,qBAAqB,CAAC;IAClE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,gGAAgG;IAChG,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,6CAA6C;IAC7C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,0FAA0F;IAC1F,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,oDAAoD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,sBAAsB,CAAC;IACnE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,yFAAyF;IACzF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,mGAAmG;IACnG,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,iGAAiG;IACjG,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE;IAC5B;;;;;;;OAOG;IACH,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC9C,CAAC,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,oDAAoD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,sBAAsB,CAAC;IACnE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,yDAAyD;IACzD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,qFAAqF;IACrF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,6FAA6F;IAC7F,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAEH;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;AAErF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,MAAM,2DAA2D,GAAG,CAAC,CAAC,MAAM,CAAC;IAClF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,+BAA+B,CAAC;IAC5E,+FAA+F;IAC/F,wFAAwF;IACxF,4GAA4G;IAC5G,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACrC;;;;;OAKG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B;;;OAGG;IACH,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,mCAAmC,CAAC,CAAC,QAAQ,EAAE;IAC5E,uGAAuG;IACvG,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,mCAAmC,CAAC;IAChE;;;;OAIG;IACH,0BAA0B,EAAE,CAAC,CAAC,MAAM,CAAC;QACnC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC,QAAQ,EAAE;QACrD,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC;KAC1C,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,gEAAgE,GAAG,CAAC,CAAC,MAAM,CAAC;IACvF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,oCAAoC,CAAC;IACjF,kFAAkF;IAClF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,gFAAgF;IAChF,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC/B,oCAAoC;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,8FAA8F;IAC9F,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,sFAAsF;IACtF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,kCAAkC;IAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,yEAAyE;IACzE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B;;;;;OAKG;IACH,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9C,4FAA4F;IAC5F,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,+DAA+D,GAAG,CAAC,CAAC,MAAM,CAAC;IACtF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,kCAAkC,CAAC;IAC/E,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,6DAA6D,GAAG,CAAC,CAAC,MAAM,CAAC;IACpF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,gCAAgC,CAAC;IAC7E,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,yDAAyD,GAAG,CAAC,CAAC,MAAM,CAAC;IAChF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,4BAA4B,CAAC;IACzE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sDAAsD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,yBAAyB,CAAC;IACtE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH,wCAAwC;AAExC,MAAM,CAAC,MAAM,2CAA2C,GAAG,CAAC,CAAC,MAAM,CAAC;IAClE,SAAS,EAAE,iCAAiC,CAAC,QAAQ,EAAE;IACvD,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,cAAc,CAAC;IAC3D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;IAChB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC;IACzC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;IAC3C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC5B,IAAI,KAAK,CAAC,cAAc,KAAK,iBAAiB,CAAC,MAAM,EAAE,CAAC;QACtD,IACE,KAAK,CAAC,SAAS,KAAK,SAAS;eAC1B,KAAK,CAAC,cAAc,KAAK,SAAS;eAClC,KAAK,CAAC,aAAa,KAAK,SAAS,EACpC,CAAC;YACD,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,WAAW,CAAC;gBACnB,OAAO,EAAE,yDAAyD;aACnE,CAAC,CAAC;QACL,CAAC;QACD,OAAO;IACT,CAAC;IAED,MAAM,oBAAoB,GACxB,KAAK,CAAC,SAAS,KAAK,aAAa,CAAC,YAAY;WAC3C,KAAK,CAAC,cAAc,KAAK,SAAS;WAClC,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC;IACvC,MAAM,mBAAmB,GACvB,KAAK,CAAC,SAAS,KAAK,aAAa,CAAC,WAAW;WAC1C,KAAK,CAAC,aAAa,KAAK,SAAS;WACjC,KAAK,CAAC,cAAc,KAAK,SAAS,CAAC;IACxC,IAAI,CAAC,oBAAoB,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAClD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,WAAW,CAAC;YACnB,OAAO,EAAE,uEAAuE;SACjF,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iDAAiD,GAAG,CAAC,CAAC,MAAM,CAAC;IACxE,SAAS,EAAE,iCAAiC,CAAC,QAAQ,EAAE;IACvD,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,qBAAqB,CAAC;IAClE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;IAC3B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,QAAQ,EAAE;IACpD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;IAC3C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,wDAAwD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,4BAA4B,CAAC;IACzE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;IAChB,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3C,uBAAuB,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,QAAQ,EAAE;IAC7D,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC;IAChC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC5B,MAAM,oBAAoB,GACxB,KAAK,CAAC,SAAS,KAAK,aAAa,CAAC,YAAY;WAC3C,KAAK,CAAC,cAAc,KAAK,SAAS;WAClC,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC;IACvC,MAAM,mBAAmB,GACvB,KAAK,CAAC,SAAS,KAAK,aAAa,CAAC,WAAW;WAC1C,KAAK,CAAC,aAAa,KAAK,SAAS;WACjC,KAAK,CAAC,cAAc,KAAK,SAAS,CAAC;IACxC,IAAI,CAAC,oBAAoB,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAClD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,WAAW,CAAC;YACnB,OAAO,EAAE,0EAA0E;SACpF,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iDAAiD,GAAG,CAAC,CAAC,MAAM,CAAC;IACxE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,oBAAoB,CAAC;IACjE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH,sDAAsD;AAEtD,MAAM,CAAC,MAAM,kEAAkE,GAAG,CAAC,CAAC,MAAM,CAAC;IACzF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,sCAAsC,CAAC;IACnF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC;IACvC,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1C,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;CAClD,CAAC,CAAC;AAIH;;;GAGG;AACH,MAAM,sCAAsC,GAAG;IAC7C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC;IACxC,0GAA0G;IAC1G,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5C,8GAA8G;IAC9G,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACrC,CAAC;AAEX,MAAM,CAAC,MAAM,+DAA+D,GAAG,CAAC,CAAC,MAAM,CAAC;IACtF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,mCAAmC,CAAC;IAChF,GAAG,sCAAsC;CAC1C,CAAC,CAAC;AAEH,qFAAqF;AACrF,MAAM,CAAC,MAAM,6DAA6D,GAAG,CAAC,CAAC,MAAM,CAAC;IACpF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,iCAAiC,CAAC;IAC9E,GAAG,sCAAsC;CAC1C,CAAC,CAAC;AAEH,2GAA2G;AAC3G,MAAM,CAAC,MAAM,uEAAuE,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9F,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,4CAA4C,CAAC;IACzF,GAAG,sCAAsC;CAC1C,CAAC,CAAC;AAIH,sDAAsD;AACtD,EAAE;AACF,yCAAyC;AACzC,EAAE;AACF,+FAA+F;AAC/F,0FAA0F;AAC1F,gGAAgG;AAChG,kGAAkG;AAClG,yEAAyE;AACzE,EAAE;AACF,gEAAgE;AAChE,EAAE;AACF,yGAAyG;AACzG,2FAA2F;AAC3F,iGAAiG;AACjG,6FAA6F;AAC7F,UAAU;AAEV;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gEAAgE,GAAG,CAAC,CAAC,MAAM,CAAC;IACvF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,oCAAoC,CAAC;IACjF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB;;;;;OAKG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,kGAAkG;IAClG,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;CACzB,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oEAAoE,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3F,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,wCAAwC,CAAC;IACrF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB;;;;;OAKG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,iFAAiF;IACjF,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,iEAAiE,GAAG,CAAC,CAAC,MAAM,CAAC;IACxF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,qCAAqC,CAAC;IAClF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB;;;;;OAKG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC;;;OAGG;IACH,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,kCAAkC,CAAC;IACxD,0FAA0F;IAC1F,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC;;;;;OAKG;IACH,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7C,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oEAAoE,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3F,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,wCAAwC,CAAC;IACrF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB;;;;;OAKG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC;IAChD;;;;;;;;;;;;;;;OAeG;IACH,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC,QAAQ,EAAE;CAC3E,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,wDAAwD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,4BAA4B,CAAC;IACzE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB;;;;;OAKG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;CACzB,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,4DAA4D,GAAG,CAAC,CAAC,MAAM,CAAC;IACnF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,gCAAgC,CAAC;IAC7E,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB;;;;;OAKG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC;;;OAGG;IACH,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC7C;;;;OAIG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC;;;;;;OAMG;IACH,0BAA0B,EAAE,CAAC,CAAC,OAAO,EAAE;IACvC;;;;;;OAMG;IACH,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3C,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1C,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1C,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,oEAAoE,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3F,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,wCAAwC,CAAC;IACrF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB;;;;;OAKG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC;;;OAGG;IACH,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC7C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,0BAA0B,EAAE,CAAC,CAAC,OAAO,EAAE;IACvC;;;;OAIG;IACH,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC,QAAQ,EAAE;IACzE,qHAAqH;IACrH,+BAA+B,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACvD,gFAAgF;IAChF,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3C,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1C,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1C,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAEH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,4DAA4D,GAAG,CAAC,CAAC,MAAM,CAAC;IACnF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,gCAAgC,CAAC;IAC7E,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB;;;;;OAKG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,iFAAiF;IACjF,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,yDAAyD,GAAG,CAAC,CAAC,MAAM,CAAC;IAChF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,6BAA6B,CAAC;IAC1E,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB;;;;;OAKG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC;;;OAGG;IACH,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,kCAAkC,CAAC;IACxD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;CACzB,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,4DAA4D,GAAG,CAAC,CAAC,MAAM,CAAC;IACnF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,gCAAgC,CAAC;IAC7E,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB;;;;;OAKG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC;IAChD;;;;;;;;;;;;;;;OAeG;IACH,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC,QAAQ,EAAE;CAC3E,CAAC,CAAC;AAIH,0CAA0C;AAE1C;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,4DAA4D,GAAG,CAAC,CAAC,MAAM,CAAC;IACnF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,gCAAgC,CAAC;IAC7E,6FAA6F;IAC7F,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,iCAAiC;IACjC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,mFAAmF;IACnF,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC;IAC5C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC3C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC1C,+EAA+E;IAC/E,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;CACzB,CAAC,CAAC;AAIH,8CAA8C;AAC9C,EAAE;AACF,qGAAqG;AACrG,oGAAoG;AACpG,2EAA2E;AAE3E,MAAM,wBAAwB,GAAG;IAC/B,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC;IACrC,wEAAwE;IACxE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC;AAEF,MAAM,CAAC,MAAM,sDAAsD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,yBAAyB,CAAC;IACtE,GAAG,wBAAwB;IAC3B,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC;IAC9C;;;;;;;OAOG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sDAAsD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,yBAAyB,CAAC;IACtE,GAAG,wBAAwB;IAC3B,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC7B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,iBAAiB,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC;IACnD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC;;;;OAIG;IACH,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;IACnC,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC;CAChD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,wDAAwD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,2BAA2B,CAAC;IACxE,GAAG,wBAAwB;IAC3B,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC7B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC;CAChD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,uDAAuD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,0BAA0B,CAAC;IACvE,GAAG,wBAAwB;IAC3B,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC7B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oDAAoD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,uBAAuB,CAAC;IACpE,GAAG,wBAAwB;IAC3B,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC7B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACpC,6EAA6E;IAC7E,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,aAAa,EAAE,CAAC,CAAC,IAAI,EAAE;CACxB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kDAAkD,GAAG,CAAC,CAAC,MAAM,CAAC;IACzE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,qBAAqB,CAAC;IAClE,GAAG,wBAAwB;IAC3B,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC7B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACrC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sDAAsD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,yBAAyB,CAAC;IACtE,GAAG,wBAAwB;IAC3B,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC7B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,mGAAmG;IACnG,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;CAC1B,CAAC,CAAC;AAEH,wGAAwG;AACxG,wFAAwF;AAExF,MAAM,CAAC,MAAM,4DAA4D,GAAG,CAAC,CAAC,MAAM,CAAC;IACnF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,gCAAgC,CAAC;IAC7E,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;IACnC,2EAA2E;IAC3E,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC;IAC/C,sBAAsB,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC;IACtD,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC;IACnD,qGAAqG;IACrG,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7C,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,4EAA4E;IAC5E,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;CAC3B,CAAC,CAAC;AAEH,MAAM,qBAAqB,GAAG;IAC5B,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;IACnC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE;IACjC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;CACzB,CAAC;AAEF,MAAM,CAAC,MAAM,+CAA+C,GAAG,CAAC,CAAC,MAAM,CAAC;IACtE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,kBAAkB,CAAC;IAC/D,GAAG,qBAAqB;IACxB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC3C,oHAAoH;IACpH,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE;CAC1B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iDAAiD,GAAG,CAAC,CAAC,MAAM,CAAC;IACxE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,oBAAoB,CAAC;IACjE,GAAG,qBAAqB;IACxB,gDAAgD;IAChD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;CACxB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,uDAAuD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,2BAA2B,CAAC;IACxE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC;CAC3C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,0DAA0D,GAAG,CAAC,CAAC,MAAM,CAAC;IACjF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,8BAA8B,CAAC;IAC3E,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC;IACzC,uEAAuE;IACvE,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC;CACjD,CAAC,CAAC;AAEH,0GAA0G;AAC1G,0GAA0G;AAC1G,qFAAqF;AAErF,MAAM,gCAAgC,GAAG;IACvC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE;IACrC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;CACnB,CAAC;AAEF,MAAM,CAAC,MAAM,6DAA6D,GAAG,CAAC,CAAC,MAAM,CAAC;IACpF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,iCAAiC,CAAC;IAC9E,GAAG,gCAAgC;IACnC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;CACvB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,uEAAuE,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9F,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,4CAA4C,CAAC;IACzF,GAAG,gCAAgC;IACnC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;CAC7B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,8DAA8D,GAAG,CAAC,CAAC,MAAM,CAAC;IACrF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,kCAAkC,CAAC;IAC/E,GAAG,gCAAgC;IACnC,kHAAkH;IAClH,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC;CAC9C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,+DAA+D,GAAG,CAAC,CAAC,MAAM,CAAC;IACtF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,mCAAmC,CAAC;IAChF,GAAG,gCAAgC;IACnC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,uCAAuC,CAAC;CACxD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,6DAA6D,GAAG,CAAC,CAAC,MAAM,CAAC;IACpF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,iCAAiC,CAAC;IAC9E,GAAG,gCAAgC;IACnC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC;IACtD,+GAA+G;IAC/G,qBAAqB,EAAE,CAAC,CAAC,OAAO,EAAE;CACnC,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,sBAAsB,GAAG;IAC7B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,6BAA6B,EAAE,CAAC,CAAC,MAAM,EAAE;IACzC,qDAAqD;IACrD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC9B,uDAAuD;IACvD,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE;CACjC,CAAC;AAEF,MAAM,CAAC,MAAM,mDAAmD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,sBAAsB,CAAC;IACnE,GAAG,sBAAsB;CAC1B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mDAAmD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,sBAAsB,CAAC;IACnE,GAAG,sBAAsB;CAC1B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,6DAA6D,GAAG,CAAC,CAAC,MAAM,CAAC;IACpF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,iCAAiC,CAAC;IAC9E,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC;IAC1C,0DAA0D;IAC1D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,wDAAwD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,4BAA4B,CAAC;IACzE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACzC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CAChD,CAAC,CAAC;AAEH,iDAAiD;AAEjD,MAAM,CAAC,MAAM,+CAA+C,GAAG,CAAC,CAAC,MAAM,CAAC;IACtE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,kBAAkB,CAAC;IAC/D,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,+CAA+C,GAAG,CAAC,CAAC,MAAM,CAAC;IACtE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,kBAAkB,CAAC;IAC/D,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,oDAAoD;AAEpD,MAAM,CAAC,MAAM,kDAAkD,GAAG,CAAC,CAAC,MAAM,CAAC;IACzE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,qBAAqB,CAAC;IAClE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IACtB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,8CAA8C,GAAG,CAAC,CAAC,MAAM,CAAC;IACrE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,iBAAiB,CAAC;IAC9D,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAClD,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,kDAAkD,GAAG,CAAC,CAAC,MAAM,CAAC;IACzE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,qBAAqB,CAAC;IAClE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAIH,yCAAyC;AAEzC,MAAM,CAAC,MAAM,yDAAyD,GAAG,CAAC,CAAC,MAAM,CAAC;IAChF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,6BAA6B,CAAC;IAC1E,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,sDAAsD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,0BAA0B,CAAC;IACvE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,8EAA8E;IAC9E,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE;IAC5B;;;;;;;;OAQG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,yDAAyD,GAAG,CAAC,CAAC,MAAM,CAAC;IAChF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,6BAA6B,CAAC;IAC1E,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,sDAAsD;AAEtD,MAAM,CAAC,MAAM,6CAA6C,GAAG,CAAC,CAAC,MAAM,CAAC;IACpE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,eAAe,CAAC;IAC5D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB;;;;;;;;OAQG;IACH,kBAAkB,EAAE,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC,QAAQ,EAAE;IACrE,uGAAuG;IACvG,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,gDAAgD,GAAG,CAAC,CAAC,MAAM,CAAC;IACvE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,mBAAmB,CAAC;IAChE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,0DAA0D,GAAG,CAAC,CAAC,MAAM,CAAC;IACjF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,8BAA8B,CAAC;IAC3E,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,wCAAwC;AAExC,MAAM,CAAC,MAAM,kDAAkD,GAAG,CAAC,CAAC,MAAM,CAAC;IACzE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,sBAAsB,CAAC;IACnE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,oDAAoD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,wBAAwB,CAAC;IACrE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,kDAAkD,GAAG,CAAC,CAAC,MAAM,CAAC;IACzE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,uBAAuB,CAAC;IACpE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,iDAAiD;AAEjD,MAAM,CAAC,MAAM,oDAAoD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,uBAAuB,CAAC;IACpE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,qDAAqD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,mCAAmC,CAAC;IAChF,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,qDAAqD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,mCAAmC,CAAC;IAChF,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,kDAAkD,GAAG,CAAC,CAAC,MAAM,CAAC;IACzE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,qBAAqB,CAAC;IAClE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,+GAA+G;IAC/G,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,sEAAsE;IACtE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,0EAA0E;IAC1E,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,gHAAgH;IAChH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;CACvB,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oDAAoD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,wBAAwB,CAAC;IACrE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,8GAA8G;IAC9G,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;CACvB,CAAC,CAAC;AAQH,MAAM,CAAC,MAAM,wDAAwD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,4BAA4B,CAAC;IACzE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,uEAAuE;IACvE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,qGAAqG;IACrG,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxC,iFAAiF;IACjF,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE;IAChC,8FAA8F;IAC9F,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE;IAC/B,2FAA2F;IAC3F,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,mGAAmG;IACnG,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,iDAAiD,GAAG,CAAC,CAAC,MAAM,CAAC;IACxE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,oBAAoB,CAAC;IACjE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,2CAA2C;AAE3C,MAAM,CAAC,MAAM,gDAAgD,GAAG,CAAC,CAAC,MAAM,CAAC;IACvE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,oBAAoB,CAAC;IACjE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,oDAAoD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,wBAAwB,CAAC;IACrE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,kDAAkD,GAAG,CAAC,CAAC,MAAM,CAAC;IACzE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,sBAAsB,CAAC;IACnE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,wCAAwC;AAExC,MAAM,CAAC,MAAM,6CAA6C,GAAG,CAAC,CAAC,MAAM,CAAC;IACpE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,iBAAiB,CAAC;IAC9D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,iDAAiD,GAAG,CAAC,CAAC,MAAM,CAAC;IACxE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,qBAAqB,CAAC;IAClE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,+CAA+C,GAAG,CAAC,CAAC,MAAM,CAAC;IACtE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,mBAAmB,CAAC;IAChE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,mDAAmD;AAEnD,MAAM,CAAC,MAAM,gDAAgD,GAAG,CAAC,CAAC,MAAM,CAAC;IACvE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,mBAAmB,CAAC;IAChE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,0DAA0D,GAAG,CAAC,CAAC,MAAM,CAAC;IACjF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,8BAA8B,CAAC;IAC3E,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,2DAA2D;AAE3D,MAAM,CAAC,MAAM,mDAAmD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,uBAAuB,CAAC;IACpE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC;IAChC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC5B,MAAM,oBAAoB,GACxB,KAAK,CAAC,SAAS,KAAK,aAAa,CAAC,YAAY;WAC3C,KAAK,CAAC,cAAc,KAAK,SAAS;WAClC,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC;IACvC,MAAM,mBAAmB,GACvB,KAAK,CAAC,SAAS,KAAK,aAAa,CAAC,WAAW;WAC1C,KAAK,CAAC,aAAa,KAAK,SAAS;WACjC,KAAK,CAAC,cAAc,KAAK,SAAS,CAAC;IACxC,IAAI,CAAC,oBAAoB,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAClD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,WAAW,CAAC;YACnB,OAAO,EAAE,0EAA0E;SACpF,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAIH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,sDAAsD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,2BAA2B,CAAC;IACxE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,2HAA2H;IAC3H,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,2FAA2F;IAC3F,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,gHAAgH;IAChH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC;AAGH,qCAAqC;AAErC;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,kDAAkD,GAAG,CAAC,CAAC,MAAM,CAAC;IACzE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,qBAAqB,CAAC;IAClE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;IAChB,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC;IAChC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC5B,MAAM,oBAAoB,GACxB,KAAK,CAAC,SAAS,KAAK,aAAa,CAAC,YAAY;WAC3C,KAAK,CAAC,cAAc,KAAK,SAAS;WAClC,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC;IACvC,MAAM,mBAAmB,GACvB,KAAK,CAAC,SAAS,KAAK,aAAa,CAAC,WAAW;WAC1C,KAAK,CAAC,aAAa,KAAK,SAAS;WACjC,KAAK,CAAC,cAAc,KAAK,SAAS,CAAC;IACxC,IAAI,CAAC,oBAAoB,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAClD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,WAAW,CAAC;YACnB,OAAO,EAAE,mEAAmE;SAC7E,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,MAAM,CAAC;IACjE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,YAAY,CAAC;IACzD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC/B,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE;IAC9B,2FAA2F;IAC3F,+FAA+F;IAC/F,4FAA4F;IAC5F,kGAAkG;IAClG,2BAA2B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClD,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AACH,MAAM,CAAC,MAAM,yDAAyD,GAAG,CAAC,CAAC,MAAM,CAAC;IAChF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,4BAA4B,CAAC;IAEzE,4FAA4F;IAC5F,wDAAwD;IACxD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,2FAA2F;IAC3F,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC/B,wFAAwF;IACxF,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC;IACjD;;;OAGG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,sGAAsG;IACtG,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,QAAQ,EAAE;IAC/D,4EAA4E;IAC5E,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEvC,gBAAgB;IAChB,oFAAoF;IACpF,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,8DAA8D;IAC9D,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1C;;;;;;;;;;;;;;OAcG;IACH,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAEnD,+FAA+F;IAC/F;;;;OAIG;IACH,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACnC,uFAAuF;IACvF,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC;IACrD,yFAAyF;IACzF,2BAA2B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClD,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE1C,yGAAyG;IACzG,kFAAkF;IAClF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IAExB,eAAe;IACf;;;;OAIG;IACH,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,gFAAgF;IAChF,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC7C;;;;OAIG;IACH,aAAa,EAAE,CAAC;SACb,MAAM,CACL,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,MAAM,CAAC;QACP,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAC9B,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KAC9B,CAAC,CACH;SACA,QAAQ,EAAE;CACd,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH;;;;;;;;;;;;;;;;;;;GAmBG;AACH;;;;GAIG;AACH,MAAM,yBAAyB,GAAG;IAChC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC9B,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;IACrC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;IACpC,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC;IAC7C,4BAA4B;IAC5B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,oGAAoG;IACpG,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAChD,2BAA2B;IAC3B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC;AAEF,uCAAuC;AACvC,MAAM,CAAC,MAAM,8CAA8C,GAAG,CAAC,CAAC,MAAM,CAAC;IACrE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,iBAAiB,CAAC;IAC9D,GAAG,yBAAyB;IAC5B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;CAC3B,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,8DAA8D,GAAG,CAAC,CAAC,MAAM,CAAC;IACrF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,mCAAmC,CAAC;IAChF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,4EAA4E;IAC5E,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE;IAChC,kEAAkE;IAClE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE;IACpC,yEAAyE;IACzE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAEH,iGAAiG;AACjG,MAAM,CAAC,MAAM,8DAA8D,GAAG,CAAC,CAAC,MAAM,CAAC;IACrF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,kCAAkC,CAAC;IAC/E,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE;IACjC,0DAA0D;IAC1D,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,8FAA8F;IAC9F,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE;IAC1B,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAEH,sHAAsH;AACtH,MAAM,CAAC,MAAM,mEAAmE,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1F,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,uCAAuC,CAAC;IACpF,2BAA2B,EAAE,CAAC,CAAC,MAAM,EAAE;IACvC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,8DAA8D;IAC9D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3C,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAEH,iHAAiH;AACjH,MAAM,CAAC,MAAM,wDAAwD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,2BAA2B,CAAC;IACxE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE;IAChC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACpC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAEH,2DAA2D;AAC3D,MAAM,CAAC,MAAM,6DAA6D,GAAG,CAAC,CAAC,MAAM,CAAC;IACpF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,iCAAiC,CAAC;IAC9E,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE;IAChC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,wDAAwD;IACxD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,oCAAoC,CAAC;IACpD,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC;AAEH,yCAAyC;AACzC,MAAM,CAAC,MAAM,gDAAgD,GAAG,CAAC,CAAC,MAAM,CAAC;IACvE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,mBAAmB,CAAC;IAChE,GAAG,yBAAyB;IAC5B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,+FAA+F;IAC/F,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACxC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,2DAA2D,GAAG,CAAC,CAAC,MAAM,CAAC;IAClF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,+BAA+B,CAAC;IAE5E,yCAAyC;IACzC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,sCAAsC,CAAC;IAC1D,yEAAyE;IACzE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB;;;;;;;;;OASG;IACH,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,OAAO,CAAC,wBAAwB,CAAC,MAAM,CAAC;IACrF;;;;;;OAMG;IACH,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3C,+EAA+E;IAC/E,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,oGAAoG;IACpG,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,wDAAwD;IACxD,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC;IAClD,oFAAoF;IACpF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC9B,wFAAwF;IACxF,kBAAkB,EAAE,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC,QAAQ,EAAE;IAC5E,4FAA4F;IAC5F,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,+CAA+C;IAC/C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC;;;;OAIG;IACH,wBAAwB,EAAE,wCAAwC,CAAC,QAAQ,EAAE;CAC9E,CAAC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,mEAAmE,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1F,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,uCAAuC,CAAC;IACpF,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC;IACzD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE;IAChC,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE;IAClC,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC;IAC1D,+DAA+D;IAC/D,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,kEAAkE;IAClE,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACxC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC3B,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE;IACpC,4EAA4E;IAC5E,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,0HAA0H;IAC1H,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC,QAAQ,EAAE;CAC/E,CAAC,CAAC;AAEH,iHAAiH;AACjH,MAAM,CAAC,MAAM,2EAA2E,GAAG,CAAC,CAAC,MAAM,CAAC;IAClG,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,iDAAiD,CAAC;IAC9F,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IACrB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE;IAChC,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE;IAClC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAEH,yEAAyE;AACzE,MAAM,CAAC,MAAM,4DAA4D,GAAG,CAAC,CAAC,MAAM,CAAC;IACnF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,gCAAgC,CAAC;IAC7E,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE;IAChC,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE;IAClC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAEH,mFAAmF;AACnF,MAAM,CAAC,MAAM,8DAA8D,GAAG,CAAC,CAAC,MAAM,CAAC;IACrF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,kCAAkC,CAAC;IAC/E,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE;IAChC,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE;IAClC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,uCAAuC,GAAG;IAC9C,mFAAmF;IACnF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE;IAChC,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE;IAClC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;CACzB,CAAC;AAEF,mHAAmH;AACnH,MAAM,CAAC,MAAM,qEAAqE,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5F,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,0CAA0C,CAAC;IACvF,GAAG,uCAAuC;IAC1C,wFAAwF;IACxF,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,oCAAoC,CAAC;IACnE,yCAAyC;IACzC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAEH,gEAAgE;AAChE,MAAM,CAAC,MAAM,mEAAmE,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1F,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,wCAAwC,CAAC;IACrF,GAAG,uCAAuC;IAC1C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;CACjB,CAAC,CAAC;AAEH,2CAA2C;AAC3C,MAAM,CAAC,MAAM,kEAAkE,GAAG,CAAC,CAAC,MAAM,CAAC;IACzF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,uCAAuC,CAAC;IACpF,GAAG,uCAAuC;IAC1C,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,yCAAyC,CAAC;CAChE,CAAC,CAAC;AAEH,uCAAuC;AACvC,MAAM,CAAC,MAAM,kEAAkE,GAAG,CAAC,CAAC,MAAM,CAAC;IACzF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,uCAAuC,CAAC;IACpF,GAAG,uCAAuC;CAC3C,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,wCAAwC,GAAG;IAC/C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE;IAChC,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE;IAClC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC;IACrD,+DAA+D;IAC/D,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE;IAC7B,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE;IAChB,qGAAqG;IACrG,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC;AAEF,qCAAqC;AACrC,MAAM,CAAC,MAAM,+DAA+D,GAAG,CAAC,CAAC,MAAM,CAAC;IACtF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,mCAAmC,CAAC;IAChF,GAAG,wCAAwC;CAC5C,CAAC,CAAC;AAEH,6CAA6C;AAC7C,MAAM,CAAC,MAAM,+DAA+D,GAAG,CAAC,CAAC,MAAM,CAAC;IACtF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,mCAAmC,CAAC;IAChF,GAAG,wCAAwC;IAC3C,0FAA0F;IAC1F,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE;IAC9B;;;;OAIG;IACH,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC,QAAQ,EAAE;IACnE,0GAA0G;IAC1G,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;CAC5D,CAAC,CAAC;AAEH,uGAAuG;AACvG,MAAM,CAAC,MAAM,6DAA6D,GAAG,CAAC,CAAC,MAAM,CAAC;IACpF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,kCAAkC,CAAC;IAC/E,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE;IAChC,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE;IAClC,wBAAwB,EAAE,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC;IACzD,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC;IACjD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,2EAA2E,GAAG,CAAC,CAAC,MAAM,CAAC;IAClG,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,gDAAgD,CAAC;IAC7F,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE;IAClC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;IAC1B,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC;IACxC,8BAA8B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACtD,CAAC,CAAC;AAEH,oGAAoG;AACpG,MAAM,CAAC,MAAM,iEAAiE,GAAG,CAAC,CAAC,MAAM,CAAC;IACxF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,sCAAsC,CAAC;IACnF,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE;IAClC,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC;IACzD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC;IACjD,oCAAoC,EAAE,CAAC,CAAC,OAAO,EAAE;IACjD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAEH,kGAAkG;AAClG,MAAM,CAAC,MAAM,2EAA2E,GAAG,CAAC,CAAC,MAAM,CAAC;IAClG,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,iDAAiD,CAAC;IAC9F,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE;IAChC,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE;IAClC,8BAA8B,EAAE,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC;IAC7E,sBAAsB,EAAE,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC;IACrE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAEH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,yEAAyE,GAAG,CAAC,CAAC,MAAM,CAAC;IAChG,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,+CAA+C,CAAC;IAE5F,yCAAyC;IACzC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,2CAA2C,CAAC;IAC/D,oEAAoE;IACpE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,iIAAiI;IACjI,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,sEAAsE;IACtE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB;;;;;OAKG;IACH,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC;;;;;OAKG;IACH,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjD,sFAAsF;IACtF,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,wCAAwC;IACxC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,8DAA8D,GAAG,CAAC,CAAC,MAAM,CAAC;IACrF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,kCAAkC,CAAC;IAE/E,yFAAyF;IACzF,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE;IAChC,oDAAoD;IACpD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,kGAAkG;IAClG,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC/B,uDAAuD;IACvD,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC;IACjD,oGAAoG;IACpG,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,8EAA8E;IAC9E,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAEjD;;;;;;;;;;OAUG;IACH,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEzC;;;;;;OAMG;IACH,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,QAAQ,EAAE;IAElE;;;;;;OAMG;IACH,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE;IAC9B,wDAAwD;IACxD,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACnC,wFAAwF;IACxF,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC;IACrD;;;;OAIG;IACH,iBAAiB,EAAE,wCAAwC,CAAC,QAAQ,EAAE;CACvE,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sDAAsD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,yBAAyB,CAAC;IAEtE,wEAAwE;IACxE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,uDAAuD;IACvD,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC/B,mDAAmD;IACnD,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC;IACjD;;;;;;;OAOG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC;;;;;OAKG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC7C,oDAAoD;IACpD,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACnC,wFAAwF;IACxF,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC;IAErD;;;;;;;;;;;OAWG;IACH,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,oFAAoF;IACpF,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,QAAQ,EAAE;CACnE,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sDAAsD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,yBAAyB,CAAC;IAEtE,0EAA0E;IAC1E,6CAA6C;IAC7C,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC;IAEnD,yFAAyF;IACzF,gEAAgE;IAChE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,2FAA2F;IAC3F,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC/B,sDAAsD;IACtD,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC;IACjD;;;OAGG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,sGAAsG;IACtG,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,QAAQ,EAAE;IAC/D,4EAA4E;IAC5E,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEvC,kEAAkE;IAClE;;;;OAIG;IACH,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAEpD,wDAAwD;IACxD;;;;OAIG;IACH,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC7C;;;;;;;;;;;;OAYG;IACH,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC9C;;;;;;;;OAQG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC;;;OAGG;IACH,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACnC,uFAAuF;IACvF,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC;IACrD,iGAAiG;IACjG,2BAA2B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClD,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE1C,yGAAyG;IACzG,kFAAkF;IAClF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IAExB,uEAAuE;IACvE;;;;OAIG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B;;;;OAIG;IACH,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE;CACpC,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,iDAAiD,GAAG,CAAC,CAAC,MAAM,CAAC;IACxE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,oBAAoB,CAAC;IACjE,8GAA8G;IAC9G,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,6GAA6G;IAC7G,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,2DAA2D;IAC3D,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,qFAAqF;IACrF,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,gFAAgF;IAChF,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1C,iGAAiG;IACjG,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC/B,wGAAwG;IACxG,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrC,wFAAwF;IACxF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,kEAAkE,GAAG,CAAC,CAAC,MAAM,CAAC;IACzF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,sCAAsC,CAAC;IACnF;;;;OAIG;IACH,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B;;;;OAIG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,4FAA4F;IAC5F,WAAW,EAAE,iCAAiC;IAC9C;;;;;OAKG;IACH,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IAChC,+FAA+F;IAC/F,mEAAmE;IACnE,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC;IAC3C,MAAM,YAAY,GAAG,KAAK,CAAC,eAAe,KAAK,SAAS,CAAC;IACzD,IAAI,OAAO,KAAK,YAAY,EAAE,CAAC;QAC7B,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;YAChD,OAAO,EAAE,OAAO;gBACd,CAAC,CAAC,8GAA8G;gBAChH,CAAC,CAAC,oHAAoH;SACzH,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,gDAAgD,GAAG,CAAC,CAAC,MAAM,CAAC;IACvE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,mBAAmB,CAAC;IAChE,yFAAyF;IACzF,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,4CAA4C;IAC5C,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,wFAAwF;IACxF,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,mEAAmE;IACnE,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC1C,oDAAoD;IACpD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B;;;OAGG;IACH,uBAAuB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC5C;;;;OAIG;IACH,8BAA8B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACnD,oDAAoD;IACpD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC;;;OAGG;IACH,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,oCAAoC,CAAC;IAC9D,mIAAmI;IACnI,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;CACjD,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,MAAM,mDAAmD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,sBAAsB,CAAC;IACnE,6BAA6B;IAC7B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,+DAA+D;IAC/D,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnD,oGAAoG;IACpG,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,mGAAmG;IACnG,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,mGAAmG;IACnG,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACxC,yEAAyE;IACzE,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACrC,oDAAoD;IACpD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,oDAAoD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,uBAAuB,CAAC;IACpE,0EAA0E;IAC1E,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,qDAAqD;IACrD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,qDAAqD;IACrD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,iDAAiD;IACjD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,qGAAqG;IACrG,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxC;;;;;;;OAOG;IACH,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9C,wFAAwF;IACxF,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,oGAAoG;IACpG,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9C,qEAAqE;IACrE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACnC,4FAA4F;IAC5F,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC;;;OAGG;IACH,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC,QAAQ,EAAE;IAC1D,kHAAkH;IAClH,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC7C,sFAAsF;IACtF,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,qEAAqE;IACrE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,yEAAyE;IACzE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC;;;;;;;;OAQG;IACH,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1C,gGAAgG;IAChG,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjD;;;OAGG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,gHAAgH;IAChH,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1C;;;OAGG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC;;;;;;OAMG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QAC/B,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;QACpC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE;QAClC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC1C,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC;AAEH;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,qDAAqD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,wBAAwB,CAAC;IACrE,4CAA4C;IAC5C,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC;IAC5C,mBAAmB;IACnB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC;IAC5C;;;OAGG;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,2GAA2G;IAC3G,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,kIAAkI;IAClI,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC;IAC9C,wEAAwE;IACxE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACnC;;;;OAIG;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,+GAA+G;IAC/G,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9C;;;OAGG;IACH,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,8FAA8F;IAC9F,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,sFAAsF;IACtF,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,uGAAuG;IACvG,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAEH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,sDAAsD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,yBAAyB,CAAC;IACtE,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC;IACnD,sCAAsC;IACtC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,0CAA0C;IAC1C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,uFAAuF;IACvF,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9C,+DAA+D;IAC/D,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,wCAAwC;IACxC,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9C;;;OAGG;IACH,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC7C;;;OAGG;IACH,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACzC,qGAAqG;IACrG,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,4EAA4E;IAC5E,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,4CAA4C;IAC5C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,MAAM,CAAC;IACjE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,aAAa,CAAC;IAC1D,mEAAmE;IACnE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,2DAA2D;IAC3D,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,8FAA8F;IAC9F,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B;;;OAGG;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC;;;;;;OAMG;IACH,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3C,8DAA8D;IAC9D,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC;;;;OAIG;IACH,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5C,sFAAsF;IACtF,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,sEAAsE;IACtE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,oGAAoG;IACpG,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAIH;;;GAGG;AACH,MAAM,2BAA2B,GAAG;IAClC,yHAAyH;IACzH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,wGAAwG;IACxG,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC;IAClC,4CAA4C;IAC5C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC9C,gDAAgD;IAChD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC7C,4DAA4D;IAC5D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC7C,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC;IAC1C,sFAAsF;IACtF,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtD,gDAAgD;IAChD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC;AAEF,6BAA6B;AAC7B,MAAM,CAAC,MAAM,qDAAqD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,wBAAwB,CAAC;IACrE,GAAG,2BAA2B;IAC9B,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC;IAClD,kDAAkD;IAClD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,2EAA2E;IAC3E,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,qHAAqH;IACrH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;IACpD,sEAAsE;IACtE,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,kBAAkB,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;CACxD,CAAC,CAAC;AAGH,uDAAuD;AACvD,MAAM,CAAC,MAAM,oDAAoD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,uBAAuB,CAAC;IACpE,GAAG,2BAA2B;IAC9B,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC;IACtC,qFAAqF;IACrF,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,qFAAqF;IACrF,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC5C,2EAA2E;IAC3E,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1C,uGAAuG;IACvG,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACtD,sGAAsG;IACtG,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE;IACxB,iGAAiG;IACjG,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,+GAA+G;IAC/G,gBAAgB,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,QAAQ,EAAE;CACxG,CAAC,CAAC;AAGH,sDAAsD;AACtD,MAAM,sBAAsB,GAAG;IAC7B,GAAG,2BAA2B;IAC9B,6FAA6F;IAC7F,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,wBAAwB;IACxB,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C,qFAAqF;IACrF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC5C,+EAA+E;IAC/E,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE;CACzB,CAAC;AAEF,MAAM,CAAC,MAAM,sDAAsD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,yBAAyB,CAAC;IACtE,GAAG,sBAAsB;IACzB,+GAA+G;IAC/G,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC;IACjD,2DAA2D;IAC3D,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE;CAC9C,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,qDAAqD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,wBAAwB,CAAC;IACrE,GAAG,sBAAsB;IACzB,0GAA0G;IAC1G,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE;CAC9B,CAAC,CAAC;AAGH,yGAAyG;AACzG,MAAM,CAAC,MAAM,mDAAmD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,sBAAsB,CAAC;IACnE,GAAG,2BAA2B;IAC9B,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,mDAAmD;IACnD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CAC7C,CAAC,CAAC;AAGH,qFAAqF;AACrF,MAAM,CAAC,MAAM,yDAAyD,GAAG,CAAC,CAAC,MAAM,CAAC;IAChF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,6BAA6B,CAAC;IAC1E,GAAG,2BAA2B;IAC9B,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC;IAC9B,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC;IAC3C,yFAAyF;IACzF,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC;AAGH,mGAAmG;AACnG,MAAM,CAAC,MAAM,0DAA0D,GAAG,CAAC,CAAC,MAAM,CAAC;IACjF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,8BAA8B,CAAC;IAC3E,GAAG,2BAA2B;IAC9B,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;IAChC,iEAAiE;IACjE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACpC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC;CAChC,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,2DAA2D,GAAG,CAAC,CAAC,MAAM,CAAC;IAClF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,+BAA+B,CAAC;IAC5E,GAAG,2BAA2B;IAC9B,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC;IAClC,4GAA4G;IAC5G,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC;IAC1C,yEAAyE;IACzE,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE;IAC9B,mHAAmH;IACnH,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACtC,yFAAyF;IACzF,mBAAmB,EAAE,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC,QAAQ,EAAE;IACnE,sGAAsG;IACtG,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,0DAA0D;IAC1D,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IACvD,kFAAkF;IAClF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CAC/C,CAAC,CAAC;AAGH,gGAAgG;AAChG,MAAM,CAAC,MAAM,uDAAuD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,2BAA2B,CAAC;IACxE,GAAG,2BAA2B;IAC9B,iFAAiF;IACjF,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACzC,CAAC,CAAC;AAGH,oGAAoG;AACpG,MAAM,CAAC,MAAM,wDAAwD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,4BAA4B,CAAC;IACzE,GAAG,2BAA2B;IAC9B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,8DAA8D;IAC9D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CACzC,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,gCAAgC,GAAG;IACvC,iDAAiD;IACjD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5C,gEAAgE;IAChE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxC,gEAAgE;IAChE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvC,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC;IAClD,wEAAwE;IACxE,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3D,sFAAsF;IACtF,6BAA6B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACnE,CAAC;AAEF,MAAM,CAAC,MAAM,mDAAmD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,sBAAsB,CAAC;IACnE,GAAG,gCAAgC;CACpC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,qDAAqD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,wBAAwB,CAAC;IACrE,GAAG,gCAAgC;CACpC,CAAC,CAAC;AAGH,gHAAgH;AAChH,MAAM,6BAA6B,GAAG;IACpC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxC,iGAAiG;IACjG,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC;IACtC,6DAA6D;IAC7D,OAAO,EAAE,iBAAiB,CAAC,QAAQ,EAAE;CACtC,CAAC;AAEF,MAAM,CAAC,MAAM,yDAAyD,GAAG,CAAC,CAAC,MAAM,CAAC;IAChF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,6BAA6B,CAAC;IAC1E,GAAG,6BAA6B;IAChC,gHAAgH;IAChH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvC,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC;CACnD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,yDAAyD,GAAG,CAAC,CAAC,MAAM,CAAC;IAChF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,6BAA6B,CAAC;IAC1E,GAAG,6BAA6B;IAChC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC;IAC3C,8EAA8E;IAC9E,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvD,iDAAiD;IACjD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACrD,uEAAuE;IACvE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACnD,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,uDAAuD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,4BAA4B,CAAC;IACzE,yDAAyD;IACzD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,6EAA6E;IAC7E,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C;;;;;OAKG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxC,iFAAiF;IACjF,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,6EAA6E;IAC7E,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,sFAAsF;IACtF,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,qEAAqE;IACrE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,kDAAkD;IAClD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,gEAAgE;IAChE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,4FAA4F;IAC5F,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IACnD;;;;;;;OAOG;IACH,uGAAuG;IACvG,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IACvD;;;OAGG;IACH,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACrC,gFAAgF;IAChF,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC,QAAQ,EAAE;IACjE;;;;;OAKG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IACzD;;;OAGG;IACH,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;CAC9D,CAAC,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,qDAAqD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,yBAAyB,CAAC;IACtE,yDAAyD;IACzD,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,yEAAyE;IACzE,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACpD,8EAA8E;IAC9E,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,iIAAiI;IACjI,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxC,iFAAiF;IACjF,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,6EAA6E;IAC7E,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,uFAAuF;IACvF,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC/C,0DAA0D;IAC1D,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAN,IAAY,0BAsBX;AAtBD,WAAY,0BAA0B;IACpC,8CAA8C;IAC9C,iDAAmB,CAAA;IACnB;;;OAGG;IACH,iDAAmB,CAAA;IACnB,4GAA4G;IAC5G,+DAAiC,CAAA;IACjC;;;;OAIG;IACH,iEAAmC,CAAA;IACnC;;;;OAIG;IACH,mDAAqB,CAAA;AACvB,CAAC,EAtBW,0BAA0B,KAA1B,0BAA0B,QAsBrC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,kDAAkD,GAAG,CAAC,CAAC,MAAM,CAAC;IACzE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,sBAAsB,CAAC;IACnE,4DAA4D;IAC5D,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,iHAAiH;IACjH,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,wEAAwE;IACxE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxC,iFAAiF;IACjF,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,oCAAoC;IACpC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC;IAC3C;;;;OAIG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,uGAAuG;IACvG,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACtC,oIAAoI;IACpI,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,sFAAsF;IACtF,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,qCAAqC;IACrC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,8FAA8F;IAC9F,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,kGAAkG;IAClG,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC;;;;OAIG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAN,IAAY,2BAaX;AAbD,WAAY,2BAA2B;IACrC,iDAAiD;IACjD,kDAAmB,CAAA;IACnB,2GAA2G;IAC3G,gEAAiC,CAAA;IACjC;;;;OAIG;IACH,kEAAmC,CAAA;IACnC,0FAA0F;IAC1F,oDAAqB,CAAA;AACvB,CAAC,EAbW,2BAA2B,KAA3B,2BAA2B,QAatC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,2DAA2D,GAAG,CAAC,CAAC,MAAM,CAAC;IAClF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,gCAAgC,CAAC;IAC7E,yEAAyE;IACzE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxC,yFAAyF;IACzF,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,mEAAmE;IACnE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,8GAA8G;IAC9G,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,sJAAsJ;IACtJ,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC;IAC5C,+DAA+D;IAC/D,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;IACnB,+GAA+G;IAC/G,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,wFAAwF;IACxF,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACpC,mHAAmH;IACnH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,gFAAgF;IAChF,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,qCAAqC;IACrC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,uFAAuF;IACvF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,oHAAoH;IACpH,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,0DAA0D,GAAG,CAAC,CAAC,MAAM,CAAC;IACjF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,+BAA+B,CAAC;IAC5E,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,iGAAiG;IACjG,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,iEAAiE;IACjE,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,qDAAqD;IACrD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,gHAAgH;IAChH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,yHAAyH;IACzH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,wDAAwD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,4BAA4B,CAAC;IACzE,yDAAyD;IACzD,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9C,mFAAmF;IACnF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC;IAChD,0DAA0D;IAC1D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IAC1C,kGAAkG;IAClG,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC5D,0GAA0G;IAC1G,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;IACvB,qEAAqE;IACrE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,gHAAgH;IAChH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,+EAA+E;IAC/E,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7C,gHAAgH;IAChH,6BAA6B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpD,mGAAmG;IACnG,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAClD,CAAC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,kEAAkE,GAAG,CAAC,CAAC,MAAM,CAAC;IACzF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,uCAAuC,CAAC;IACpF,oDAAoD;IACpD,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9C,sFAAsF;IACtF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxC,+DAA+D;IAC/D,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,0FAA0F;IAC1F,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC;IACjD,kFAAkF;IAClF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,2GAA2G;IAC3G,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE;IAC7B,oHAAoH;IACpH,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE;IAC5B,0DAA0D;IAC1D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IAC1C,kGAAkG;IAClG,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CAC7D,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,2DAA2D,GAAG,CAAC,CAAC,MAAM,CAAC;IAClF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,+BAA+B,CAAC;IAC5E,yDAAyD;IACzD,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9C,kFAAkF;IAClF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxC,qBAAqB;IACrB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,+BAA+B;IAC/B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC;IAC1C,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,kCAAkC,CAAC;IACrD;;;OAGG;IACH,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACjD,kHAAkH;IAClH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,0EAA0E;IAC1E,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC;AAEH;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,4DAA4D,GAAG,CAAC,CAAC,MAAM,CAAC;IACnF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,iCAAiC,CAAC;IAC9E,yDAAyD;IACzD,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,uEAAuE;IACvE,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACpD,qEAAqE;IACrE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,gIAAgI;IAChI,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxC,iFAAiF;IACjF,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,6EAA6E;IAC7E,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC;;;;OAIG;IACH,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IAC5D,0DAA0D;IAC1D,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,6DAA6D,GAAG,CAAC,CAAC,MAAM,CAAC;IACpF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,iCAAiC,CAAC;IAC9E,0CAA0C;IAC1C,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,+BAA+B;IAC/B,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACpD,qCAAqC;IACrC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,8DAA8D;IAC9D,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC;IACxC,6EAA6E;IAC7E,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC;IAClD,8FAA8F;IAC9F,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC;IAChD,oGAAoG;IACpG,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC,QAAQ,EAAE;IAC7D,mFAAmF;IACnF,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC7C,0DAA0D;IAC1D,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,6DAA6D,GAAG,CAAC,CAAC,MAAM,CAAC;IACpF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,kCAAkC,CAAC;IAC/E,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,uFAAuF;IACvF,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChD,qFAAqF;IACrF,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,mEAAmE;IACnE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,mFAAmF;IACnF,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,sFAAsF;AAEtF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,wDAAwD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,4BAA4B,CAAC;IACzE,4DAA4D;IAC5D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,+DAA+D;IAC/D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,qEAAqE;IACrE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,4GAA4G;IAC5G,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3B,qFAAqF;IACrF,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH,yGAAyG;AACzG,MAAM,CAAC,MAAM,kDAAkD,GAAG,CAAC,CAAC,MAAM,CAAC;IACzE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,qBAAqB,CAAC;IAClE,6BAA6B;IAC7B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,6CAA6C;IAC7C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,+BAA+B;IAC/B,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3B,oEAAoE;IACpE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,sGAAsG;IACtG,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;IACvB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH,qEAAqE;AACrE,MAAM,CAAC,MAAM,iDAAiD,GAAG,CAAC,CAAC,MAAM,CAAC;IACxE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,oBAAoB,CAAC;IACjE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,yDAAyD,GAAG,CAAC,CAAC,MAAM,CAAC;IAChF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,6BAA6B,CAAC;IAC1E,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,6FAA6F;IAC7F,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,gEAAgE;IAChE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3B,qGAAqG;IACrG,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;CACxB,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,qDAAqD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,yBAAyB,CAAC;IACtE,qGAAqG;IACrG,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,iFAAiF;IACjF,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,2DAA2D,GAAG,CAAC,CAAC,MAAM,CAAC;IAClF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,+BAA+B,CAAC;IAC5E,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,iGAAiG;IACjG,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,6FAA6F;IAC7F,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACjC;;;;OAIG;IACH,sBAAsB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,kDAAkD,GAAG,CAAC,CAAC,MAAM,CAAC;IACzE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,qBAAqB,CAAC;IAClE,8FAA8F;IAC9F,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,2GAA2G;IAC3G,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,0GAA0G;IAC1G,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,gDAAgD,GAAG,CAAC,CAAC,MAAM,CAAC;IACvE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,mBAAmB,CAAC;IAChE,0EAA0E;IAC1E,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,kEAAkE;IAClE,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE;IAChC,wEAAwE;IACxE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qDAAqD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,yBAAyB,CAAC;IACtE,4GAA4G;IAC5G,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,kGAAkG;IAClG,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,2FAA2F;IAC3F,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,+FAA+F;IAC/F,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE;IAC9B;;+BAE2B;IAC3B,6BAA6B,EAAE,CAAC,CAAC,OAAO,EAAE;IAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sDAAsD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7E,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,0BAA0B,CAAC;IACvE,sDAAsD;IACtD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC;IAC9C,2DAA2D;IAC3D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,iEAAiE;IACjE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,wEAAwE;IACxE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,2DAA2D,GAAG,CAAC,CAAC,MAAM,CAAC;IAClF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,+BAA+B,CAAC;IAC5E,qEAAqE;IACrE,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC/B,uEAAuE;IACvE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,0DAA0D;IAC1D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,qEAAqE;IACrE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,4DAA4D,GAAG,CAAC,CAAC,MAAM,CAAC;IACnF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,iCAAiC,CAAC;IAC9E,4DAA4D;IAC5D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,2FAA2F;IAC3F,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,2EAA2E;IAC3E,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,kGAAkG;IAClG,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE;IAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH,8DAA8D;AAC9D,0EAA0E;AAC1E,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;AAKvE,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAC/C;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IAC5C,oGAAoG;IACpG,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE;IAC9C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAqCG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE;IACtD;;;OAGG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE;IACrD;;;;;;;;OAQG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE;IACnE;;;;OAIG;IACH,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE;IAC3D;;;;;;;;;;;;;;;OAeG;IACH,kGAAkG;IAClG,kGAAkG;IAClG,gCAAgC;IAChC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE;SACnE,cAAc,CAAC,oBAAoB,CAAC,QAAQ,CAAC;IAChD;;;;;;;;;OASG;IACH,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE;IACxG;;;;;;;;;;OAUG;IACH,UAAU,EAAE,qBAAqB,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,KAAK,CAAC;IACvF;;;;OAIG;IACH,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE;IAC1D;;;;;OAKG;IACH,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE;IAC7D;;;;;OAKG;IACH,sCAAsC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE;IAC5F,iHAAiH;IACjH,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE;IAC9D;;;;;OAKG;IACH,2BAA2B,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,UAAU,CAAC,0BAA0B,CAAC,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE;SAC7H,QAAQ,CAAC,6SAA6S,CAAC;IAC1T,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC,cAAc,EAAE;IAC9D,iGAAiG;IACjG,mGAAmG;IACnG,iGAAiG;IACjG,EAAE;IACF,kGAAkG;IAClG,iGAAiG;IACjG,mGAAmG;IACnG,+FAA+F;IAC/F,+BAA+B;IAC/B,EAAE;IACF,qHAAqH;IACrH,yFAAyF;IACzF,iHAAiH;IACjH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,oBAAoB,CAAC,yBAAyB,CAAC,CAAC,cAAc,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,KAAK,CAAC;IAC5I,SAAS,EAAE,yBAAyB,CAAC,cAAc,CAAC,oBAAoB,CAAC,KAAK,CAAC;IAC/E,kIAAkI;IAClI,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,cAAc,EAAE;IAC1D,kIAAkI;IAClI,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,cAAc,EAAE;IACrD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACtG,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAIH,kFAAkF;AAClF;;;GAGG;AACH,MAAM,CAAC,MAAM,2DAA2D,GAAG,CAAC,CAAC,MAAM,CAAC;IAClF,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,8BAA8B,CAAC;IAC3E,yEAAyE;IACzE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,0DAA0D;IAC1D,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,iHAAiH;IACjH,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC;IAC5C,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,4GAA4G;IAC5G,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QACxB,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;QAC1C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACtC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACrC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACvC,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACpC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACrC,2EAA2E;QAC3E,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;KACrD,CAAC,CAAC;CACJ,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,kBAAkB,CAAC,WAAW,EAAE;IAC9E,wCAAwC;IACxC,yCAAyC;IACzC,8CAA8C;IAC9C,gDAAgD;IAChD,iDAAiD;IACjD,gDAAgD;IAChD,4CAA4C;IAC5C,iDAAiD;IACjD,kDAAkD;IAClD,iEAAiE;IACjE,6DAA6D;IAC7D,uDAAuD;IACvD,wDAAwD;IACxD,uDAAuD;IACvD,wDAAwD;IACxD,4DAA4D;IAC5D,8DAA8D;IAC9D,wDAAwD;IACxD,kDAAkD;IAClD,kDAAkD;IAClD,kDAAkD;IAClD,4DAA4D;IAC5D,mDAAmD;IACnD,oDAAoD;IACpD,gEAAgE;IAChE,oDAAoD;IACpD,+DAA+D;IAC/D,6DAA6D;IAC7D,yDAAyD;IACzD,sDAAsD;IACtD,gEAAgE;IAChE,4DAA4D;IAC5D,0CAA0C;IAC1C,2CAA2C;IAC3C,iDAAiD;IACjD,wDAAwD;IACxD,iDAAiD;IACjD,kEAAkE;IAClE,+DAA+D;IAC/D,6DAA6D;IAC7D,uEAAuE;IACvE,gEAAgE;IAChE,oEAAoE;IACpE,iEAAiE;IACjE,oEAAoE;IACpE,2DAA2D;IAC3D,2DAA2D;IAC3D,4DAA4D;IAC5D,sDAAsD;IACtD,sDAAsD;IACtD,wDAAwD;IACxD,uDAAuD;IACvD,oDAAoD;IACpD,kDAAkD;IAClD,sDAAsD;IACtD,4DAA4D;IAC5D,+CAA+C;IAC/C,iDAAiD;IACjD,uDAAuD;IACvD,0DAA0D;IAC1D,6DAA6D;IAC7D,uEAAuE;IACvE,8DAA8D;IAC9D,+DAA+D;IAC/D,6DAA6D;IAC7D,mDAAmD;IACnD,mDAAmD;IACnD,6DAA6D;IAC7D,wDAAwD;IACxD,mDAAmD;IACnD,qDAAqD;IACrD,yDAAyD;IACzD,yDAAyD;IACzD,+CAA+C;IAC/C,+CAA+C;IAC/C,kDAAkD;IAClD,8CAA8C;IAC9C,kDAAkD;IAClD,yDAAyD;IACzD,yDAAyD;IACzD,sDAAsD;IACtD,6CAA6C;IAC7C,gDAAgD;IAChD,0DAA0D;IAC1D,kDAAkD;IAClD,oDAAoD;IACpD,kDAAkD;IAClD,oDAAoD;IACpD,qDAAqD;IACrD,qDAAqD;IACrD,iDAAiD;IACjD,wDAAwD;IACxD,gDAAgD;IAChD,oDAAoD;IACpD,kDAAkD;IAClD,6CAA6C;IAC7C,iDAAiD;IACjD,+CAA+C;IAC/C,gDAAgD;IAChD,0DAA0D;IAC1D,mDAAmD;IACnD,sDAAsD;IACtD,kDAAkD;IAClD,0CAA0C;IAC1C,yDAAyD;IACzD,sDAAsD;IACtD,8DAA8D;IAC9D,sDAAsD;IACtD,2DAA2D;IAC3D,8CAA8C;IAC9C,gDAAgD;IAChD,8DAA8D;IAC9D,8DAA8D;IAC9D,mEAAmE;IACnE,wDAAwD;IACxD,6DAA6D;IAC7D,mEAAmE;IACnE,2EAA2E;IAC3E,4DAA4D;IAC5D,8DAA8D;IAC9D,qEAAqE;IACrE,mEAAmE;IACnE,kEAAkE;IAClE,kEAAkE;IAClE,+DAA+D;IAC/D,+DAA+D;IAC/D,6DAA6D;IAC7D,2EAA2E;IAC3E,iEAAiE;IACjE,2EAA2E;IAC3E,yEAAyE;IACzE,iDAAiD;IACjD,kEAAkE;IAClE,gDAAgD;IAChD,mDAAmD;IACnD,iDAAiD;IACjD,uDAAuD;IACvD,kDAAkD;IAClD,2DAA2D;IAC3D,0DAA0D;IAC1D,wDAAwD;IACxD,kEAAkE;IAClE,2DAA2D;IAC3D,oDAAoD;IACpD,sDAAsD;IACtD,qDAAqD;IACrD,4DAA4D;IAC5D,6DAA6D;IAC7D,6DAA6D;IAC7D,wDAAwD;IACxD,kDAAkD;IAClD,iDAAiD;IACjD,yDAAyD;IACzD,kDAAkD;IAClD,gDAAgD;IAChD,qDAAqD;IACrD,sDAAsD;IACtD,2DAA2D;IAC3D,4DAA4D;CAC7D,CAAC,CAAC","sourcesContent":["import { AuditApplicationReadAccess } from './audit-trail-config.shared.schemas';\nimport { EngineOpenVocabulary } from '../../i18n/engine-open-vocabulary.shared';\nimport { ApplicationConfigVocabulary } from '../../i18n/application-config-vocabulary.shared';\nimport { AuditActorKind, AuditAgentActorSchema } from './audit-actor.shared.schemas';\nimport {\n HumanDecision_Act, HumanDecision_Outcome, HumanDecision_Plane, HumanDecision_RefusalReason, HumanDecision_RequesterKind, HumanDecision_RouteChangeTrigger,\n HumanDecision_RouteKind, ReviewClockBasis, ReviewDeadlineKind, ReviewDeadlineOutcome, ReviewDeadlineStage, ReviewEscalationActionKind,\n} from '../../flows-actors/human-decision.shared.schemas';\nimport { AutonomousPrincipalSource, AutonomousTurnRefusalReason, AutonomousTurnTrigger } from '../../flows-actors/autonomous-agents.shared.schemas';\nimport { EvaluationDatasetExportRefusalReason } from '../../flows-actors/agent-work-decisions.shared.schemas';\nimport { WorkUnitRefSchema } from '../../resources/work-unit.shared.schemas';\nimport { ExternalAssuranceAssessmentSchema } from '../../external-providers/provider-authentication-assurance.shared.schemas';\nimport { z } from \"zod\";\nimport '@wildo-ai/zod-decorators';\nimport { AuthMethod } from \"../../security/authentications/authentication.shared.schemas\";\nimport { FactorSatisfactionSource } from \"../../security/authentications/service-provider-client-authentication.shared.schemas\";\nimport { ServiceProviderActivityFeedDisclosure, ServiceProviderMfaTrust } from \"../../organizations/service-provider-client-controls.shared.schemas\";\nimport { ServiceProviderActivityFeedStatus } from \"../../organizations/service-provider-activity-feed.shared.schemas\";\nimport { ExternalProvider_Connection_DelegationMode, RateBudgetCounting } from \"@wildo-ai/external-connectors-models\";\nimport { GovernedDocumentInteractionSchema } from \"../documents/governed-document-interactions.shared.schemas\";\nimport { PersonalDataCategory } from \"../privacy/personal-data-category.shared.schemas\";\nimport { ExternalDataConflictDecisionSource, ExternalDataConflictWinner, ExternalDataOutboundUnknownAnswer, ExternalDataPipelinePassMode, ExternalDataPipelineResetMode } from '../../external-data/external-data-pipeline-pass-mode.shared';\nimport { LegalHoldGround, LegalHoldPlacementTier, LegalHoldScopeKind } from \"../privacy/legal-holds.shared.schemas\";\nimport { DataRetentionClass } from \"../privacy/retention-schedule.shared.schemas\";\nimport { RetentionEnforcementOutcome } from \"../privacy/retention-enforcement-records.shared.schemas\";\nimport { SubjectErasureExternalEffectStatus } from \"../privacy/subject-erasure.shared.schemas\";\nimport {\n SubjectDataRecipientObligation,\n SubjectDataRecipientReach,\n SubjectDataRecipientRelevance,\n SubjectDataRecipientsStatementStatus,\n} from \"../privacy/subject-data-recipients.shared.schemas\";\nimport { RegistrationAcquisitionChannel } from \"../../config/entity-identity-config.shared.schemas\";\nimport { ResourceOperationRiskLevel, ResourceOperationVariantType } from \"../../resources/resources.shared.schemas\";\nimport { CoreResourceOperation } from \"../../resources/resources.shared.core.definitions\";\nimport {\n PlatformAccessGrantAutoApprovalReason,\n PlatformAccessGrantLifecycleTransition,\n PlatformAccessGrantScope,\n PlatformAccessGrantStatus,\n} from \"../../security/authorizations/platform-access-grants.shared.schemas\";\nimport { SystemOfRecordPartitionAssignmentTransition } from \"../../systems-of-record/system-of-record-partition-assignments.shared.schemas\";\nimport { DelegatedAdministrativeCapability, ServiceProviderCapabilityGrantEndCause } from \"../../organizations/service-provider-capability-grants.shared.schemas\";\nimport {\n ServiceProviderExpertAdmissionPolicy,\n ServiceProviderExpertApprovalDenialReason,\n ServiceProviderRelationshipStatus,\n ServiceProviderRelationshipTransition,\n} from \"../../organizations/service-provider-relationships.shared.schemas\";\nimport { ExecutionContext_ExecutionType, ExecutionContext_MachineCredentialSchema } from \"../../runtime/execution-context.shared.schemas\";\nimport { InboundDeliveryRejectionReason, InboundDeliveryUnroutableReason, InboundResolvedScopeKind, InboundSourceKind } from \"../../inbound/inbound-delivery.shared.schemas\";\nimport { InboundBelowMinimumDisposition, InboundChannelKind, InboundSenderAssurance, ReplyTokenDowngradeReason } from \"../../inbound/inbound-channels.shared.schemas\";\nimport { ReplyTokenRevocationReason } from \"../../inbound/conversation-threads.shared.schemas\";\nimport {\n InboundEmailLimit,\n InboundEmailWithheldReason,\n OrganizationEmailDomainRemovalTrigger,\n OrganizationEmailDomainStatus,\n OrganizationEmailDomainSuspensionReason,\n} from \"../../notifications/inbound-email/inbound-email.shared.schemas\";\nimport {\n AuthScopeType,\n SsoConnectionType,\n} from \"../../security/authentications/authentication.shared.schemas\";\nimport { WebhookEndpointProbeOutcome } from \"../../notifications/m2m/webhook-config.shared.schemas\";\nimport {\n ProviderCredentialDeletionReason,\n ProviderOAuth2RevocationOutcomeValues,\n ProviderCredentialResolutionSource,\n} from \"../../security/connected-accounts/provider-credentials.shared.schemas\";\n\n\nexport enum CoreAuditableEventType {\n // Authentication Events\n USER_LOGIN = 'user_login',\n USER_LOGOUT = 'user_logout',\n USER_LOGIN_FAILED = 'user_login_failed',\n USER_ACCOUNT_LOCKED = 'user_account_locked',\n USER_PASSWORD_CHANGED = 'user_password_changed',\n // audit-event-unemitted: superseded by the per-METHOD events, which is what the MFA services\n // actually emit — `USER_MFA_SETUP_STARTED` / `USER_MFA_SETUP_COMPLETED` on enrolment and\n // `USER_TOTP_DISABLED` on removal. A coarse \"MFA enabled/disabled\" pair cannot say WHICH factor\n // changed, and a user with TOTP plus a passkey makes that distinction the whole question. Kept\n // rather than deleted because a future factor-agnostic rollup is a plausible SIEM convenience;\n // it must not be emitted ALONGSIDE the per-method events without deciding which is canonical.\n USER_MFA_ENABLED = 'user_mfa_enabled',\n // audit-event-unemitted: see USER_MFA_ENABLED — `USER_TOTP_DISABLED` is the emitted event.\n USER_MFA_DISABLED = 'user_mfa_disabled',\n // audit-event-unemitted: expiry is PASSIVE — a token simply ages out, so there is no moment for\n // anyone to observe. Emitting it would require polling every live session, and would produce one\n // row per session per lifetime: the highest-volume, lowest-signal stream in the trail. The\n // session endings that carry intent are already covered (`USER_LOGOUT`, and the token-revocation\n // events). Deliberately declared-and-unwired rather than deleted, because a future\n // idle-timeout/forced-expiry feature — where expiry IS an act someone triggers — is exactly what\n // it should name.\n USER_SESSION_EXPIRED = 'user_session_expired',\n\n /*\n A refresh chain was FORCIBLY RETIRED because the principal exceeded its concurrent-session cap.\n \n DISTINCT from {@link USER_SESSION_EXPIRED}, and the split is semantic rather than cosmetic. An\n * expiry is time elapsing; an eviction is a cap DISPLACING a live chain, and the two answer\n * different reviewer questions — \"was this user idle?\" versus \"is somebody's chain being pushed\n * out?\". The second is the one that matters: the cap exists to bound the blast radius of undetected\n * token theft, so a burst of evictions for one principal is exactly the signal a reviewer wants.\n \n Before this, the only trace was a debug log — a security-relevant token-lifecycle act with no\n * durable record, which is what `CLAUDE.md`'s assurance-by-construction rule asks for by name.\n \n assurance-control: WILDO.IDENTITY.SESSION_CONCURRENCY_LIMIT — the eviction enforcing the\n * concurrent-session bound leaves a record naming WHICH chain was retired and when it was issued,\n * so the first-in-first-out property is reviewable rather than merely implemented.\n /\n USER_SESSION_EVICTED = 'user_session_evicted',\n\n // Machine (non-human) Authentication Events — api-key / OAuth-client / exchanged client-credentials\n // token resolving to an ORGANIZATION_MACHINE / APPLICATION_MACHINE principal. The credential\n // provenance (authMethod + credentialId) + scope ride the typed eventData.\n MACHINE_AUTH_SUCCESS = 'machine_auth_success',\n MACHINE_AUTH_FAILED = 'machine_auth_failed',\n // Machine RESOURCE-ACCESS event — the token-USE twin of MACHINE_AUTH_SUCCESS (token-MINT). Emitted\n // per external request when a machine principal exercises an audience-bound resource-server surface\n // (A2A `message/send`, MCP `tools/call`, …). MACHINE_AUTH_SUCCESS fires once at `/oauth/token` and\n // is low-volume; MACHINE_ACCESS lets an org SIEM see WHAT a machine did, not just that it authed.\n MACHINE_ACCESS = 'machine_access',\n\n // User Lifecycle Events\n // audit-event-unemitted: this operation now leaves evidence as a generic\n // `RESOURCE_OPERATION_PERFORMED` row, which carries strictly MORE than this member could — the\n // operation identity triple, the actor's roles as they stood, the top-level `correlationId` that\n // groups a cascade, and before/after values for `.isAuditEvidence()` fields. Wiring this one too would\n // write two rows for one action. Kept rather than deleted: a purpose-built event is still the\n // right shape if this verb ever needs a payload the generic row cannot reconstruct (the standing\n // precedent is `USER_APP_ROLES_CHANGED`, which carries the `requestedRoles` set the role-ceiling\n // gate measured — something a before/after diff cannot recover).\n USER_CREATED = 'user_created',\n // audit-event-unemitted: covered by the generic `RESOURCE_OPERATION_PERFORMED` row — see USER_CREATED.\n USER_UPDATED = 'user_updated',\n USER_DELETED = 'user_deleted',\n\n // Application-Role Administration — the APPLICATION-scope twin of\n // ORGANIZATION_MEMBER_ROLE_CHANGED. `User.appRoles` IS the principal's live application authority\n // (it is read back into `initiatorRoles` on their very next request), so every change to it is an\n // access-control decision that must leave evidence. Emitted by the USERS role-administration write\n // paths (assign_roles / revoke_roles and the core CREATE/UPDATE that can rewrite the array), never\n // for an update that leaves `appRoles` untouched.\n // assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — evidence of privilege grant/revocation.\n USER_APP_ROLES_CHANGED = 'user_app_roles_changed',\n\n // The application booted with NO administratively usable super-administrator — a state the write\n // guards refuse to create, so its presence means it arrived some other way: a direct database\n // edit, a restore from a backup taken mid-erasure, a seed that authored no administrator, or a\n // role-table reconfiguration that changed which roles confer super-admin under an existing\n // population. Reported at startup, never fatal (a fresh application legitimately boots with no\n // users at all before its first administrator is seeded or registers).\n // assurance-control: WILDO.ACCESS.ADMINISTRATIVE_CONTINUITY — evidence that the application has no\n // accountable administrative principal, which is unrecoverable in-product once reached.\n APPLICATION_SUPER_ADMIN_FLOOR_BREACHED = 'application_super_admin_floor_breached',\n /\n A tenant was left with no administratively usable owner by an action that was ALLOWED to proceed.\n \n The organization-scope twin of {@link APPLICATION_SUPER_ADMIN_FLOOR_BREACHED}, and unlike it this\n * one HAS an actor: it is emitted when a user lifecycle transition (typically a suspension) removes\n * the last usable owner of a tenant. That write is deliberately not refused — suspension is usually\n * incident response, and blocking it would mean an operator cannot lock out a compromised owner\n * without first transferring ownership using the tenant the attacker controls.\n \n Because the action proceeds, this record is the ENTIRE control. It is not decoration.\n /\n ORGANIZATION_OWNER_FLOOR_BREACHED = 'organization_owner_floor_breached',\n\n // Organization Lifecycle Events\n // audit-event-unemitted: covered by the generic `RESOURCE_OPERATION_PERFORMED` row — see USER_CREATED.\n ORGANIZATION_CREATED = 'organization_created',\n // audit-event-unemitted: covered by the generic `RESOURCE_OPERATION_PERFORMED` row — see USER_CREATED.\n ORGANIZATION_UPDATED = 'organization_updated',\n /\n The engine assigned an organization its `type`, at boot, with no actor — see\n * {@link AuditableEvent_Organization_TypeAssignedEventDataSchema} for why this is not an `ORGANIZATION_UPDATED`.\n /\n ORGANIZATION_TYPE_ASSIGNED = 'organization_type_assigned',\n ORGANIZATION_DELETED = 'organization_deleted',\n /* The tenant was MARKED for deletion (soft-delete). Its access dies here; its data dies at the purge. /\n ORGANIZATION_DELETION_REQUESTED = 'organization_deletion_requested',\n /* A pending tenant deletion was cancelled inside the retention window. /\n ORGANIZATION_RESTORED = 'organization_restored',\n /* The tenant was administratively HALTED. Confers no authority while suspended. /\n ORGANIZATION_SUSPENDED = 'organization_suspended',\n /* A halted or expired tenant was returned to normal operation. /\n ORGANIZATION_ACTIVATED = 'organization_activated',\n /\n A governed lifecycle transition changed a subject's `status` — membership suspension and\n * reactivation, administrative user suspension, self-service account deactivation.\n \n ONE event type rather than five near-identical ones, because the five verbs it serves share an\n * identical data shape: a subject, a from→to status pair, an optional caller reason, and an\n * optional automatic-reactivation deadline. `resourceType` + `operationIdentifier` fully\n * discriminate which verb ran, so splitting would produce five schemas differing only in their\n * literal and force a reviewer asking \"show me every suspension\" to union five queries.\n \n Deliberately distinct from {@link ORGANIZATION_SUSPENDED} / {@link ORGANIZATION_ACTIVATED},\n * which are NOT collapsed into this: tenant transitions carry domain facts these do not\n * (`revokedUserTypeCount` / `regrantedUserTypeCount` — the platform-wide reach of halting a\n * tenant), so they are genuinely different events rather than the same event on another resource.\n /\n RESOURCE_STATUS_TRANSITION_PERFORMED = 'resource_status_transition_performed',\n\n // Organization Member Events\n // audit-event-unemitted: covered by the generic `RESOURCE_OPERATION_PERFORMED` row — see USER_CREATED.\n ORGANIZATION_MEMBER_INVITED = 'organization_member_invited',\n // audit-event-unemitted: covered by the generic `RESOURCE_OPERATION_PERFORMED` row — see USER_CREATED.\n ORGANIZATION_MEMBER_JOINED = 'organization_member_joined',\n // audit-event-unemitted: covered by the generic `RESOURCE_OPERATION_PERFORMED` row — see USER_CREATED.\n ORGANIZATION_MEMBER_UPDATED = 'organization_member_updated',\n ORGANIZATION_MEMBER_ROLE_CHANGED = 'organization_member_role_changed',\n // audit-event-unemitted: covered by the generic `RESOURCE_OPERATION_PERFORMED` row — see USER_CREATED.\n ORGANIZATION_MEMBER_STATUS_CHANGED = 'organization_member_status_changed',\n ORGANIZATION_MEMBER_REMOVED = 'organization_member_removed',\n\n // audit-event-unemitted: covered by the generic `RESOURCE_OPERATION_PERFORMED` row — see USER_CREATED.\n ORGANIZATION_NOTIFICATIONS_UPDATED = 'organization_notifications_updated',\n // audit-event-unemitted: covered by the generic `RESOURCE_OPERATION_PERFORMED` row — see USER_CREATED.\n ORGANIZATION_PREFERENCES_UPDATED = 'organization_preferences_updated',\n // audit-event-unemitted: covered by the generic `RESOURCE_OPERATION_PERFORMED` row — see USER_CREATED.\n ORGANIZATION_PROFILE_UPDATED = 'organization_profile_updated',\n // audit-event-unemitted: covered by the generic `RESOURCE_OPERATION_PERFORMED` row — see USER_CREATED.\n ORGANIZATION_UNIT_UPDATED = 'organization_unit_updated',\n\n // Per-unit role assignment — the NARROWED twin of ORGANIZATION_MEMBER_ROLE_CHANGED.\n // `OrganizationUnitMember.role` became live authority when `appendUnitScopedRoles` began emitting\n // it into `initiatorRoles` as a unit-narrowed entry, so assigning or re-assigning it is an\n // access-control decision on the same footing as the organization-wide array — it just confers\n // inside ONE unit rather than across the tenant. Distinct from ORGANIZATION_UNIT_UPDATED, which is\n // ORG_MANAGEMENT record-keeping about the unit itself and confers nothing.\n // assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — evidence of privilege grant/revocation.\n ORGANIZATION_UNIT_MEMBER_ROLE_CHANGED = 'organization_unit_member_role_changed',\n\n // Revocation of a per-unit role assignment — the closing half of\n // ORGANIZATION_UNIT_MEMBER_ROLE_CHANGED. Deleting an assignment row IS the revocation: the row\n // exists only to confer a role, so unlike ORGANIZATION_MEMBER_REMOVED (where losing authority is a\n // consequence of leaving the directory) there is no non-authorization reading of this event.\n // Without it the trail shows unit privileges being granted and never removed.\n // assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — evidence of privilege revocation.\n ORGANIZATION_UNIT_MEMBER_REMOVED = 'organization_unit_member_removed',\n\n // SSO Authentication Events\n USER_SSO_LOGIN = 'user_sso_login',\n USER_SSO_LOGIN_FAILED = 'user_sso_login_failed',\n\n /\n A tenant that mandates its identity provider refused a local sign-in or an acquisition.\n \n Emitted since #1214/#1242 by `_enforceEnterpriseSsoOnLocalFirstFactor` (every local first-factor\n * door), by the grace-login gate's three refusal clauses, and by the registration door's\n * `blockForSSODomains` block. `enforcementPolicy` carries WHICH clause refused, because \"the tenant\n * allows no fallback\" and \"this account has spent its grace logins\" have different remedies and a\n * bare `sso_required` cannot tell them apart.\n \n ONE refusal site remains unwired and is tracked on #1242: the SOCIAL-vs-enforcement refusal in\n * `oauth2-authentication.backend.service.ts`, whose sibling provider-restriction refusal ten lines\n * below it already emits `logOAuth2ProviderBlocked`.\n \n Deliberately NOT emitted by the fail-closed refusals that share the same error — a Redis read\n * that failed, the outer catch. Those are infrastructure outcomes, and recording them as an\n * enforcement decision would assert a policy judgement nobody made.\n /\n USER_SSO_ENFORCEMENT_BLOCKED = 'user_sso_enforcement_blocked',\n USER_TOKEN_REFRESHED = 'user_token_refreshed',\n\n // Organization Security Management Events\n // audit-event-unemitted: covered by the generic `RESOURCE_OPERATION_PERFORMED` row — see USER_CREATED.\n // Every SSO-config write is HIGH or CRITICAL (UPDATE, CREATE, and the three domain-ownership verbs),\n // and its authentication-authority blocks carry `.isAuditEvidence()`, so the row names what changed\n // and its before/after values. Its emit method had no caller and was removed (#591).\n ORGANIZATION_SSO_CONFIGURATION_CHANGED = 'organization_sso_configuration_changed',\n /* A change to where an organization's security events are exported: enabled, or a field other than the destination edited. INFO. /\n ORGANIZATION_SIEM_EXPORT_CONFIGURED = 'organization_siem_export_configured',\n /\n Security-event export was turned OFF (#986). Its own kind, at CRITICAL, because the envelope's rule\n * is that severity is a property of the event TYPE and danger rides the row's `riskLevel` — and\n * `riskLevel` never reaches the SIEM. As one INFO kind, \"export disabled\" was filtered out by any\n * organization that raised its severity minimum, on the one destination that most needed it.\n * Delivered to the destination that STOPPED, as its last event (`dispatchToRetiredSiemSink`).\n /\n ORGANIZATION_SIEM_EXPORT_DISABLED = 'organization_siem_export_disabled',\n /\n Security-event export was re-pointed at another destination (#986). WARNING: a destination move is\n * how an attacker who reached the tenant's administration diverts the trail. Delivered to BOTH the\n * old and the new destination.\n /\n ORGANIZATION_SIEM_EXPORT_DESTINATION_CHANGED = 'organization_siem_export_destination_changed',\n\n // Organization Provider Credential Events\n //\n // An organization's OWN credential toward a third party. The four verbs are separate members\n // rather than one event with a `changeType`, because they answer four different questions a\n // credential incident asks in a different order — when did this tenant grant us authority, when\n // did the value last change, when was it last SPENT, and when did the grant end — and a SIEM\n // rule that alerts on a spend cannot be written against a payload discriminator that also\n // matches configuration edits.\n //\n // NONE of the four payloads carries the credential value. That is a structural property of the\n // schemas below, not a redaction step somebody has to remember: there is no field to put it in.\n //\n // assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — an organization authorizes this\n // application to act as it toward a named third party.\n ORGANIZATION_PROVIDER_CREDENTIAL_SET = 'organization_provider_credential_set',\n ORGANIZATION_PROVIDER_CREDENTIAL_ROTATED = 'organization_provider_credential_rotated',\n ORGANIZATION_PROVIDER_CREDENTIAL_USED = 'organization_provider_credential_used',\n ORGANIZATION_PROVIDER_CREDENTIAL_DELETED = 'organization_provider_credential_deleted',\n\n // A PERSON's own credential toward a third party. Four members mirroring the organization's,\n // and deliberately NOT the same members with a nullable organization: the subject differs, the\n // SIEM routing differs (there is no tenant to route to), and the data-protection reading differs\n // — a person's connection to a vendor is that person's, and an event saying so must not be\n // indistinguishable from one about a tenant's shared integration.\n USER_PROVIDER_CREDENTIAL_SET = 'user_provider_credential_set',\n USER_PROVIDER_CREDENTIAL_ROTATED = 'user_provider_credential_rotated',\n USER_PROVIDER_CREDENTIAL_USED = 'user_provider_credential_used',\n USER_PROVIDER_CREDENTIAL_DELETED = 'user_provider_credential_deleted',\n\n // A delegated authorization GRANTED at a vendor, for each owner scope.\n //\n // Distinct from `_SET` rather than a flag on it, on the same three grounds the vocabulary already\n // uses to separate its members. The ACT differs: `_SET` is a value arriving in a row, and this is\n // a principal completing a consent ceremony at a third party — the only event in this family that\n // records somebody deciding something. The DATA differs: a grant carries the scopes that were\n // authorized and the vendor account they were authorized for, neither of which exists for a pasted\n // secret. And the EMISSION POINT differs, which is what makes a flag impractical as well as wrong:\n // `_SET` is emitted by the resource's write hook, which sees the row after the value is sealed,\n // while the scopes are known only to the store that received the grant, before sealing.\n //\n // The distinction is the one an auditor asks for first. \"Which of our people granted a third party\n // access, to what, and when\" is a different question from \"which credentials were configured\", and\n // a trail that answers them with the same event answers neither well.\n //\n // Neither payload carries a token, and as with the four above that is structural rather than a\n // redaction step: there is no field to put one in.\n //\n // assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — the act of authorizing is recorded\n // as itself, with what was authorized.\n ORGANIZATION_PROVIDER_CONNECTION_GRANTED = 'organization_provider_connection_granted',\n USER_PROVIDER_CONNECTION_GRANTED = 'user_provider_connection_granted',\n\n // Application Security Configuration Events\n // Also records the effective authored audit-viewer admission policy, with independently typed before/after evidence.\n // The per-user-type authentication policy (`userTypes.<type>.auth` — MFA, password, and lockout\n // requirements) is STATIC application configuration authored in code and taken into effect at\n // backend startup. A change to it — most consequentially a WEAKENING such as turning MFA off — is\n // a security-posture decision that otherwise leaves no product-side record (only source history).\n // Emitted at boot, by the system, when the resolved policy snapshot differs from the last one the\n // trail recorded for the application. Distinct from ORGANIZATION_SSO_CONFIGURATION_CHANGED, which\n // is a per-tenant runtime edit by a human admin; this is the application-wide authored baseline\n // and has no human actor at boot (the \"who\" lives in the deployment/source history).\n // assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — a change to the authentication assurance\n // requirements (MFA / password / lockout) must be attributable and evidenced.\n APPLICATION_AUTH_POLICY_CHANGED = 'application_auth_policy_changed',\n\n // Retention Enforcement (#1636)\n // One per retention-class sweep run, by the system: per-class totals of what the run deleted, skipped and\n // failed on. The queryable per-resource record is `retentionEnforcementRecords`; this event exists to reach\n // the SIEM. Its row risk is HIGH when any resource failed, LOW otherwise.\n // assurance-control: WILDO.PRIVACY.STORAGE_LIMITATION — records evidence that declared retention was enforced.\n RETENTION_ENFORCEMENT_RECORDED = 'retention_enforcement_recorded',\n\n // Outbound M2M Webhook Events\n // An admin firing `webhookConfig.testEndpoint` makes the platform emit a signed HTTP\n // request to an operator-supplied URL. That is an outbound-traffic primitive reachable\n // from an authenticated admin surface, so every attempt — reachable or not — is recorded\n // with the actor, the scope, and the destination host.\n // assurance-control: WILDO.INTEGRATION.OUTBOUND_ACTIVITY_AUDIT — outbound connection initiated from an\n // administrative surface is attributable and monitorable.\n WEBHOOK_ENDPOINT_TEST_DISPATCHED = 'webhook_endpoint_test_dispatched',\n\n // Inbound Delivery Events (#1596)\n // Every verified message another system sends the application leaves a trail from the wire to its\n // outcome: refused at the door, stored, never routable, processed, failed and retried, dead, replayed.\n // The terminal and refused transitions are the ones an operator investigates; ACCEPTED and PROCESSED\n // make the successes countable too, so a SIEM can see a sender's volume and not only its failures.\n // assurance-control: WILDO.SECURITY.FAIL_CLOSED — a message whose signature, timestamp, size or media\n // type does not verify is refused whole and the refusal is recorded.\n INBOUND_DELIVERY_REJECTED = 'inbound_delivery_rejected',\n // assurance-control: WILDO.AUDIT.SECURITY_EVENT — a verified external message entering the system is recorded.\n INBOUND_DELIVERY_ACCEPTED = 'inbound_delivery_accepted',\n // assurance-control: WILDO.OPERATIONS.EXECUTION_INTEGRITY — a message that resolves to no admissible scope is\n // recorded as never run, rather than run somewhere it does not belong.\n INBOUND_DELIVERY_UNROUTABLE = 'inbound_delivery_unroutable',\n INBOUND_DELIVERY_PROCESSED = 'inbound_delivery_processed',\n INBOUND_DELIVERY_FAILED = 'inbound_delivery_failed',\n // assurance-control: WILDO.OPERATIONS.EXECUTION_INTEGRITY — work a sender was told was received and that never\n // completed is recorded as such, so it can be found and replayed.\n INBOUND_DELIVERY_DEAD = 'inbound_delivery_dead',\n // assurance-control: WILDO.AUDIT.EVIDENCE_INTEGRITY — a privileged re-run of stored input is attributable\n // and carries its written justification.\n INBOUND_DELIVERY_REPLAYED = 'inbound_delivery_replayed',\n\n // Inbound Channel Events (#1630) — a message on a channel, and the replies that answer it.\n // assurance-control: WILDO.SECURITY.FAIL_CLOSED — a message whose sender assurance is below the handler's\n // minimum never reaches that handler, and what happened to it instead is recorded.\n INBOUND_DELIVERY_BELOW_ASSURANCE = 'inbound_delivery_below_assurance',\n // assurance-control: WILDO.INTEGRATION.OUTBOUND_ACTIVITY_AUDIT — every reply a handler sends on a thread is\n // attributable to the delivery and thread it answered.\n INBOUND_REPLY_SENT = 'inbound_reply_sent',\n INBOUND_REPLY_FAILED = 'inbound_reply_failed',\n // assurance-control: WILDO.AUDIT.SECURITY_EVENT — a reply address (a bearer secret) stopping to bind replies is recorded with why.\n INBOUND_REPLY_TOKEN_REVOKED = 'inbound_reply_token_revoked',\n // assurance-control: WILDO.AUDIT.SECURITY_EVENT — a live reply address presented by a sender it was not issued\n // to, or on an unauthenticated domain, is recorded: it is what a leaked address looks like.\n INBOUND_REPLY_TOKEN_DOWNGRADED = 'inbound_reply_token_downgraded',\n\n // Receiving Email Events (#1600) — the domains an organization proves, provisions and loses, the client\n // mailboxes a firm keeps, and the parts of a received message that were not made available.\n // assurance-control: WILDO.DATA.TENANT_ISOLATION — a claim on a domain is recorded; nothing routes on it until ownership is proven.\n ORGANIZATION_EMAIL_DOMAIN_CLAIMED = 'organization_email_domain_claimed',\n // assurance-control: WILDO.DATA.TENANT_ISOLATION — the moment an organization proved it controls a domain, which decides where that domain's mail may go.\n ORGANIZATION_EMAIL_DOMAIN_OWNERSHIP_VERIFIED = 'organization_email_domain_ownership_verified',\n ORGANIZATION_EMAIL_DOMAIN_VERIFIED = 'organization_email_domain_verified',\n // assurance-control: WILDO.SECURITY.FAIL_CLOSED — a domain whose ownership or records disappeared stops routing and sending, and the stop is recorded.\n ORGANIZATION_EMAIL_DOMAIN_SUSPENDED = 'organization_email_domain_suspended',\n ORGANIZATION_EMAIL_DOMAIN_REMOVED = 'organization_email_domain_removed',\n // assurance-control: WILDO.DATA.TENANT_ISOLATION — a mailbox routing a firm's domain into a client organization exists only under an active relationship, and is recorded.\n CLIENT_MAILBOX_CREATED = 'client_mailbox_created',\n CLIENT_MAILBOX_REMOVED = 'client_mailbox_removed',\n // assurance-control: WILDO.SECURITY.INGESTED_CONTENT_INSPECTION — an attachment not proven clean is never exposed, and withholding it is recorded.\n INBOUND_EMAIL_ATTACHMENT_WITHHELD = 'inbound_email_attachment_withheld',\n // assurance-control: WILDO.OPERATIONS.RESOURCE_LIMIT — a message over a declared limit is kept as an envelope only, and recorded.\n INBOUND_EMAIL_REJECTED_LIMIT = 'inbound_email_rejected_limit',\n\n // SCIM Directory Provisioning Events\n // audit-event-unemitted: covered by the generic `RESOURCE_OPERATION_PERFORMED` row — see USER_CREATED.\n SCIM_TOKEN_CREATED = 'scim_token_created',\n // audit-event-unemitted: covered by the generic `RESOURCE_OPERATION_PERFORMED` row — see USER_CREATED.\n // `revoke_token` is a HIGH operation and `isActive` carries `.isAuditEvidence()`. Its emit method had no\n // caller and was removed (#591), so a requirement body must not demand this member.\n SCIM_TOKEN_REVOKED = 'scim_token_revoked',\n // audit-event-unemitted: covered by the generic row — `generate_token` is HIGH. See SCIM_TOKEN_REVOKED.\n SCIM_TOKEN_GENERATED = 'scim_token_generated',\n // audit-event-unemitted: covered by the generic row — `rotate_token` is HIGH. See SCIM_TOKEN_REVOKED.\n SCIM_TOKEN_ROTATED = 'scim_token_rotated',\n // audit-event-unemitted: covered by the generic `RESOURCE_OPERATION_PERFORMED` row — see USER_CREATED.\n // The provisioning-config UPDATE is HIGH and `autoCreateUsers`, `autoDeactivateUsers`, `defaultRole`,\n // `organizationUnitMapping` and `defaultUnitRole` carry `.isAuditEvidence()`. Emit method removed (#591).\n SCIM_PROVISIONING_CONFIG_UPDATED = 'scim_provisioning_config_updated',\n SCIM_PROVISIONING_FAILED = 'scim_provisioning_failed',\n SCIM_USER_PROVISIONED = 'scim_user_provisioned',\n SCIM_USER_UPDATED = 'scim_user_updated',\n SCIM_USER_DEACTIVATED = 'scim_user_deactivated',\n\n // Password Reset Events (H5)\n USER_PASSWORD_RESET_REQUESTED = 'user_password_reset_requested',\n USER_PASSWORD_RESET_COMPLETED = 'user_password_reset_completed',\n /\n An ADMINISTRATOR compelled a credential reset on another user's account.\n \n Deliberately distinct from `USER_PASSWORD_RESET_REQUESTED`, which records a SELF-SERVICE\n * request and carries no actor: reusing it for an admin action would attribute the reset to\n * the account owner, so the audit trail would name the wrong human for a privileged act. This\n * event names both the actor and the target, and records the operator's documented reason.\n /\n USER_PASSWORD_RESET_FORCED = 'user_password_reset_forced',\n\n // Registration & Verification Events (H5)\n USER_REGISTERED = 'user_registered',\n USER_EMAIL_VERIFIED = 'user_email_verified',\n USER_VERIFICATION_EMAIL_RESENT = 'user_verification_email_resent',\n\n // Method Management Events (#13f)\n USER_PASSWORD_SET = 'user_password_set',\n USER_TOTP_DISABLED = 'user_totp_disabled',\n USER_IDENTITY_LINK_REMOVED = 'user_identity_link_removed',\n\n // MFA Lifecycle Events (H5)\n USER_MFA_SETUP_STARTED = 'user_mfa_setup_started',\n USER_MFA_SETUP_COMPLETED = 'user_mfa_setup_completed',\n USER_MFA_EMAIL_OTP_SENT = 'user_mfa_email_otp_sent',\n\n // WebAuthn/Passkey Events (Phase G1)\n USER_PASSKEY_REGISTERED = 'user_passkey_registered',\n USER_PASSKEY_AUTHENTICATION_SUCCESS = 'user_passkey_authentication_success',\n USER_PASSKEY_AUTHENTICATION_FAILURE = 'user_passkey_authentication_failure',\n USER_PASSKEY_REMOVED = 'user_passkey_removed',\n USER_PASSKEY_CLONE_SUSPECTED = 'user_passkey_clone_suspected',\n\n // Magic Link Events (Phase G2)\n USER_MAGIC_LINK_SENT = 'user_magic_link_sent',\n USER_MAGIC_LINK_VERIFIED = 'user_magic_link_verified',\n USER_MAGIC_LINK_FAILED = 'user_magic_link_failed',\n\n // SMS OTP Events (Phase G2)\n USER_SMS_OTP_SENT = 'user_sms_otp_sent',\n USER_SMS_OTP_VERIFIED = 'user_sms_otp_verified',\n USER_SMS_OTP_FAILED = 'user_sms_otp_failed',\n\n // Phone Verification Events (Phase G2)\n USER_PHONE_VERIFIED = 'user_phone_verified',\n USER_PHONE_VERIFICATION_FAILED = 'user_phone_verification_failed',\n\n // SAML Authentication Events (AUTH-2)\n SAML_LOGIN_INITIATED = 'saml_login_initiated',\n SAML_LOGIN_SUCCESS = 'saml_login_success',\n SAML_LOGIN_FAILED = 'saml_login_failed',\n SAML_ASSERTION_REPLAY_DETECTED = 'saml_assertion_replay_detected',\n SAML_CERT_EXPIRING = 'saml_cert_expiring',\n SAML_SLO_INITIATED = 'saml_slo_initiated',\n SAML_SLO_COMPLETED = 'saml_slo_completed',\n SAML_METADATA_PARSED = 'saml_metadata_parsed',\n SAML_EMAIL_CHANGED = 'saml_email_changed',\n\n // OAuth2 Provider Restriction Events (Phase G3)\n OAUTH2_PROVIDER_BLOCKED = 'oauth2_provider_blocked',\n\n /\n An enterprise OIDC login was refused because the identity provider did not report the\n * authentication context the connection DEMANDED (issue #444).\n \n `acr_values` is a REQUEST parameter: the relying party asks, the provider decides, and the ID\n * token's `acr` claim reports what actually happened. So a refusal here is the only evidence that\n * a step-up demand was made and not met — without it an operator debugging \"why can this person\n * not sign in\" sees an ordinary authentication failure and has nothing to distinguish it from a\n * wrong password.\n /\n OIDC_ACR_DEMAND_UNSATISFIED = 'oidc_acr_demand_unsatisfied',\n\n // One-Off Session Events (W7.3b)\n /\n File upload grant lifecycle (issue #312) — the first FILE-domain audit events. A grant is a\n * single-use bearer credential that lets whoever holds it perform ONE upload into ONE resource file\n * field with the MINTER's authority; minting it is a delegated-authorization act and is audited as\n * one. `ISSUED` at mint (MEDIUM: a credential left the trust boundary), `REDEEMED` when the one\n * upload landed and the FILES row exists, `REVOKED` when the minter or an administrator cancelled\n * it. The event data carries the grant's ID — never its value.\n /\n FILE_UPLOAD_GRANT_ISSUED = 'file_upload_grant_issued',\n FILE_UPLOAD_GRANT_REDEEMED = 'file_upload_grant_redeemed',\n FILE_UPLOAD_GRANT_REVOKED = 'file_upload_grant_revoked',\n /\n File share links (#1567). A share is a bearer link that serves ONE file to whoever holds it, with no\n * session at all — the widest disclosure the file plane can make, so minting one is audited like a\n * grant. `ISSUED` carries the file, its owning record/field binding, the expiry and the use budget —\n * never the token value. `REVOKED` is \"stop sharing this file\" (`DELETE /files/:fileId/shares`) and\n * carries how many live links it ended; a revocation that ended none records nothing.\n /\n FILE_SHARE_LINK_ISSUED = 'file_share_link_issued',\n FILE_SHARE_LINKS_REVOKED = 'file_share_links_revoked',\n\n // File content-inspection outcomes (#506)\n /\n A scanner concluded that an uploaded file is INFECTED, and the file was quarantined.\n \n Until this existed, the scanner emitted no audit row of any kind: an infection produced a\n * `SCANNING → INFECTED → QUARANTINED` status transition on the file record and nothing else, so\n * the only way to learn that malware had reached the application's storage was to NOTICE a row\n * sitting at `QUARANTINED` — a poll, not a signal. Malware arriving is one of the few things an\n * operator wants to be alerted on, and one of the few a customer security questionnaire asks about\n * by name.\n \n `CRITICAL`, on the same argument as `USER_PASSKEY_CLONE_SUSPECTED`: a conclusion the security\n * mechanism reached about a real threat, not a routine outcome.\n \n assurance-control: WILDO.SECURITY.INGESTED_CONTENT_INSPECTION — a detected infection is\n * attributable and monitorable, not only visible as a row status. This event is the RECORD half of\n * that objective; the mechanism half is the fail-closed scan gate itself.\n /\n FILE_MALWARE_DETECTED = 'file_malware_detected',\n /\n A scan could NOT be completed — the scanner was unreachable, or the pipeline errored.\n \n Its own event rather than a lower severity on the one above, because the operational stories are\n * opposite: an infection means the control WORKED, a failure means it DID NOT RUN. From outside\n * they are indistinguishable today — the file is non-downloadable either way — which is precisely\n * why the trail has to tell them apart. A run of these means files are arriving unscanned.\n \n `WARNING`, not `CRITICAL`: nothing was found and nothing was exposed, because the file fails\n * closed to `FAILED` and stays undownloadable. What is wrong is the control's availability.\n /\n FILE_MALWARE_SCAN_FAILED = 'file_malware_scan_failed',\n ONE_OFF_TOKEN_CREATED = 'one_off_token_created',\n ONE_OFF_TOKEN_EXCHANGED = 'one_off_token_exchanged',\n /* revocation-B1: a super-admin cancelled an un-exchanged one-off (impersonation) session token. /\n ONE_OFF_TOKEN_REVOKED = 'one_off_token_revoked',\n\n // Cross-Frontend Handoff Events (cross-app-jwt-propagation Step 2)\n USER_CROSS_FRONTEND_HANDOFF_ISSUED = 'user_cross_frontend_handoff_issued',\n\n // Emergency Access Events\n EMERGENCY_ACCESS_USED = 'emergency_access_used',\n\n // Field Access Events\n FIELD_ACCESS = 'field_access',\n\n // Resource-Operation Events — the OPERATION-triggered twin of FIELD_ACCESS.\n //\n // FIELD_ACCESS answers \"a decorated field left the system\"; it is triggered by a RESPONSE FIELD,\n // so an operation whose response carries no decorated field is invisible to it. Repo-wide, that\n // trigger is declared on FOUR fields (three secret families, CREATE-only), which left every other\n // operation in an 83-resource catalogue emitting nothing at all — including role changes,\n // suspensions, credential deletion and tenant deletion.\n //\n // This event answers the different question: \"this OPERATION was performed, by whom, on what,\n // with what effect\". It is emitted for every HIGH / CRITICAL operation variant automatically\n // (`riskLevel` is already the framework's canonical danger axis — it drives MCP destructive\n // hints, frontend danger-zone placement and CRITICAL typed-confirmation), and for any variant\n // that opts in declaratively via `auditableEvent`.\n //\n // It is the FLOOR beneath the purpose-built events, never their replacement: a verb with its own\n // event (e.g. USER_APP_ROLES_CHANGED, which carries the `requestedRoles` set the role-ceiling\n // gate was measured against — something a generic before/after diff cannot reconstruct) emits\n // that one and suppresses this.\n //\n // assurance-control: WILDO.AUDIT.SECURITY_EVENT — privileged actions on\n // resources are attributable, and the authorization effect of each is reconstructable.\n RESOURCE_OPERATION_PERFORMED = 'resource_operation_performed',\n\n // The REFUSAL twin of RESOURCE_OPERATION_PERFORMED — the other half of \"record access decisions\".\n //\n // Emitted PRE-DISPATCH from the authorizer, not from the post-commit lane, because a refused\n // operation never reaches that lane. Without this event a refused HIGH/CRITICAL action — a denied\n // role change, a blocked suspension, a rejected credential rotation — leaves NO evidence at all,\n // so an auditor cannot distinguish \"nobody attempted it\" from \"someone attempted it and was\n // stopped\". Repeated denials are also the signature of an attack in progress.\n //\n // ## Not an authentication failure\n //\n // USER_LOGIN_FAILED / MACHINE_AUTH_FAILED answer \"you are not who you claim to be\" (AUTHENTICATION).\n // This answers \"you are who you claim to be, and you may not do this\" (AUTHORIZATION). The two are\n // deliberately distinct event types in distinct categories; neither is overloaded onto the other.\n //\n // ## No risk floor, unlike the success twin\n //\n // RESOURCE_OPERATION_PERFORMED fires only at HIGH/CRITICAL because a SUCCESSFUL low-risk read is\n // routine business (371 of the 551 API-reachable variants are reads). A DENIED read is never\n // routine — it is the canonical reconnaissance signal. A risk floor here would exclude 100% of\n // denied reads while not bounding attacker volume at all (the attacker picks the endpoint, so a\n // HIGH verb is exactly as cheap to hammer as a LOW one). Volume is bounded by per-principal\n // dedup instead — see `AuditableEvent_ResourceOperationDenied_EventDataSchema`.\n //\n // Severity is WARNING, matching its AUTHENTICATION twins rather than varying with `riskLevel`:\n // severity is a pure function of event type everywhere in this map (and is re-derived\n // independently by the SIEM dispatcher), so danger grading rides the row's `riskLevel` field.\n //\n // assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT — access-control decisions are\n // recorded, including the negative decisions, and repeated refusals are detectable.\n RESOURCE_OPERATION_DENIED = 'resource_operation_denied',\n CROSS_TENANT_ADMINISTRATIVE_ACCESS = 'cross_tenant_administrative_access',\n PLATFORM_ACCESS_GRANT_LIFECYCLE = 'platform_access_grant_lifecycle',\n /\n A legal hold was placed (#1634): from this instant every deletion path skips or refuses the held scope.\n * HIGH — it suspends a tenant's retention schedule and its data subjects' erasures.\n \n assurance-control: WILDO.PRIVACY.STORAGE_LIMITATION — deletion suspended under a recorded legal hold.\n /\n LEGAL_HOLD_PLACED = 'legal_hold_placed',\n /\n A legal hold was released (#1634): deletion of its scope resumes on the next sweep, purge or erasure.\n \n assurance-control: WILDO.PRIVACY.STORAGE_LIMITATION — deletion resumes only on a recorded release.\n /\n LEGAL_HOLD_RELEASED = 'legal_hold_released',\n /\n A model-cost period aggregate was linked to the invoice that bills it (#1598). A retention-deciding act: the\n * link is what keeps the aggregate past its tenant's deletion, for the statutory bookkeeping period.\n \n assurance-control: WILDO.PRIVACY.ERASURE_PROPAGATION — only an aggregate an invoice bills outlives its tenant.\n /\n MODEL_COST_AGGREGATE_INVOICE_LINKED = 'model_cost_aggregate_invoice_linked',\n /\n An organization changed whether it keeps the CONTENT of its experts' corrections to agent work (#1599): the\n * opt-in, its purpose, its reader role or its narrowing.\n \n assurance-control: WILDO.PRIVACY.DATA_MINIMIZATION — every change to what the tenant keeps of its client material is recorded.\n /\n CORRECTION_CAPTURE_SETTING_CHANGED = 'correction_capture_setting_changed',\n /\n An organization recorded, changed or revoked its basis for exporting its experts' corrections as evaluation\n * data (#1599).\n \n assurance-control: WILDO.PRIVACY.COLLECTION_DATA_EXPORT — the authorisation an export relies on is recorded.\n /\n EVALUATION_EXPORT_AUTHORIZATION_CHANGED = 'evaluation_export_authorization_changed',\n /* A tenant's corrections were exported as an evaluation dataset under its recorded authorisation (#1599). /\n EVALUATION_DATASET_EXPORTED = 'evaluation_dataset_exported',\n /\n An export of a tenant's corrections was REFUSED: no ACTIVE authorisation of that organization (#1599 I7).\n \n assurance-control: WILDO.PRIVACY.COLLECTION_DATA_EXPORT — a refused export is recorded, not only prevented.\n /\n EVALUATION_DATASET_EXPORT_REFUSED = 'evaluation_dataset_export_refused',\n /\n A service-provider relationship moved (#1597) — proposed, accepted, declined, suspended, resumed,\n * scope amended, terminated, withdrawn or expired. ONE event for the relationship's whole life with a\n * {@link ServiceProviderRelationshipTransition} field (the `platformAccessGrants` shape), written to\n * BOTH the client's and the firm's trail so each reads the relationship's timeline in its own.\n /\n SERVICE_PROVIDER_RELATIONSHIP_LIFECYCLE = 'service_provider_relationship_lifecycle',\n /* A firm-owned OAuth client was admitted into, or removed from, a client organization (#1597, S3). /\n SERVICE_PROVIDER_MACHINE_CLIENT_ADMISSION_CHANGED = 'service_provider_machine_client_admission_changed',\n /* A firm assigned one of its experts to serve a client relationship (#1597). /\n SERVICE_PROVIDER_EXPERT_ASSIGNED = 'service_provider_expert_assigned',\n /* A firm ended an expert's assignment to a client relationship (#1597). /\n SERVICE_PROVIDER_EXPERT_UNASSIGNED = 'service_provider_expert_unassigned',\n /\n A firm assigned an expert under a relationship whose client approves each expert, so the assignment now waits\n * for the client's administrators (#1612). The approval is a human decision; this row carries its `decisionRef`,\n * so it joins that decision's own REQUESTED / RESOLVED rows rather than duplicating them. Both organizations' trails.\n /\n SERVICE_PROVIDER_EXPERT_APPROVAL_REQUESTED = 'service_provider_expert_approval_requested',\n /* The client approved the expert and the expert was admitted — a provider membership now exists (#1612). Both trails. /\n SERVICE_PROVIDER_EXPERT_APPROVAL_GRANTED = 'service_provider_expert_approval_granted',\n /\n The expert was NOT admitted (#1612): the client refused, or approved when the relationship, the expert's firm\n * membership or the (person, client) slot no longer allowed it. `denialReason` says which. Both trails.\n /\n SERVICE_PROVIDER_EXPERT_APPROVAL_DENIED = 'service_provider_expert_approval_denied',\n /* Nobody in the client answered before the approval's lapse; nothing was created (#1612). Both trails. /\n SERVICE_PROVIDER_EXPERT_APPROVAL_LAPSED = 'service_provider_expert_approval_lapsed',\n /\n A client lent a service firm's experts a named administrative capability, until a stated end (#1631). HIGH, CRITICAL\n * for a security-critical capability. Written to both organizations' trails.\n /\n SERVICE_PROVIDER_CAPABILITY_GRANTED = 'service_provider_capability_granted',\n /* A client revoked a lent capability — or the relationship ended, which revokes them all (#1631). Both trails. /\n SERVICE_PROVIDER_CAPABILITY_REVOKED = 'service_provider_capability_revoked',\n /\n A client organization changed whether it trusts the firm's own identity provider's MFA on one relationship\n * (#1633). HIGH: turning it on lets a proof made outside this application satisfy the client's authentication\n * policy for the firm's experts. Written to the client's trail and the firm's.\n /\n SERVICE_PROVIDER_MFA_TRUST_CHANGED = 'service_provider_mfa_trust_changed',\n /\n A firm's expert satisfied a CLIENT organization's authentication policy (#1633): a factor was recorded on the\n * session for that client, with where it came from — a step-up answered here, or the firm's trusted identity\n * provider. The client's answer to \"was this expert's work MFA-protected, and by whom?\". Client trail only.\n /\n SERVICE_PROVIDER_CLIENT_AUTHENTICATION_SATISFIED = 'service_provider_client_authentication_satisfied',\n /\n A firm switched its expert-activity feed on or off (#1632). The record of a worker-monitoring decision: who,\n * when, and whether the consultation notice was acknowledged. Firm trail.\n /\n SERVICE_PROVIDER_ACTIVITY_FEED_DECIDED = 'service_provider_activity_feed_decided',\n /\n A client organization changed how much a firm's activity feed may say about work done in it (#1632). Written to\n * the client's trail and the firm's, so the firm sees why its feed went quiet.\n /\n SERVICE_PROVIDER_ACTIVITY_FEED_DISCLOSURE_CHANGED = 'service_provider_activity_feed_disclosure_changed',\n /\n A remote partition of a system of record was assigned to, moved between, or removed from an\n * organization unit.\n \n ONE event for the whole life of the edge, with a {@link SystemOfRecordPartitionAssignmentTransition}\n * field — the `platformAccessGrants` shape rather than three event types. Three types would put the\n * same row's timeline in three buckets a reviewer has to reassemble, and the questions an auditor\n * actually asks (\"who has been able to see the German company, and since when?\") are answered by\n * reading one bucket in order.\n \n ## Why this exists beside the automatic row\n \n All three write verbs are HIGH, which is inside `AUTOMATIC_AUDIT_RISK_FLOOR`, so\n * `RESOURCE_OPERATION_PERFORMED` already fires for each. What that row cannot carry is the thing a\n * reviewer needs: which unit, and — on a move — which unit it was BEFORE. A generic operation row\n * says an assignment changed; this one says what it changed from and to.\n \n assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — the reach of each remote partition is recorded.\n * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — evidence of the full life of that reach.\n /\n SYSTEM_OF_RECORD_PARTITION_ASSIGNMENT_LIFECYCLE = 'system_of_record_partition_assignment_lifecycle',\n /\n An operator enumerated an APPLICATION-WIDE directory — a collection read that is deliberately\n * not confined to any one tenant.\n \n ## Why this is not {@link CROSS_TENANT_ADMINISTRATIVE_ACCESS}\n \n That event answers \"an operator reached a ROW belonging to a tenant they are not a member of\",\n * and it is emitted after comparing a FETCHED row's organization against the caller's role\n * entries. A directory read has no row and no target tenant — the whole point is that it spans\n * all of them — so there is nothing for that comparison to consume. Merging the two would put\n * two different questions behind one event type and make the existing one's `targetOrganizationId`\n * meaningless on half its rows. Closed vocabularies do not merge.\n \n ## Why it exists at all\n \n The reach is INTENDED and declared (`users \| list \| admin` is documented as \"admin-gated global\n * user listing\"), and it cannot be governed by the platform-access-grant mechanism: that admission\n * requires a usable grant for a TARGET tenant, and a collection call has none. So prevention is\n * structurally unavailable and EVIDENCE is the control that remains — which is exactly what\n * `.claude/rules/administrative-continuity-floors.md` asks for on a sanctioned reach: \"every\n * crossing is NAMED in the trail\". Before this event, an operator could enumerate every user's\n * email across every tenant and leave nothing behind.\n \n ⚠️ \"Structurally unavailable\" above is exact about the EXISTING grant mechanism — it needs a\n * target tenant and a collection call names none — and must not be read as \"prevention is\n * impossible\". An application-wide grant kind is buildable; what blocks it is the question of who\n * approves an elevation that names no tenant. See\n * `ScopeRootConfinementDisposition.UNCONFINED_APPLICATION_TIER_DIRECTORY`, which owns that\n * reasoning beside the declaration that makes this read unconfined.\n \n INFO, not WARNING: unlike its cross-tenant sibling this is an ordinary, expected administrative\n * read on a surface built for it. The subset worth escalating is selected by a SIEM rule on\n * `resourceType` + `returnedCount`, both of which ride the payload.\n \n assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT — an unconfined administrative read\n * of application-wide data is recorded with its actor, surface and size.\n /\n PLATFORM_DIRECTORY_ACCESS = 'platform_directory_access',\n\n // System-Context (ACL-bypassing) Access Events\n // Emitted whenever a server-internal `readAsSystem` / `listAsSystem` call\n // reads a resource with a synthesised super-admin context, bypassing the\n // caller's scope + role ACL. Classified by default as DATA_ACCESS / INFO\n // (an expected, authorized internal read — not an anomaly).\n // USERLESS BUT NOT UNATTRIBUTED (since 2026-07-31): there is no human to name —\n // the door synthesises its own super-admin context — but `eventData.performedByRuntime`\n // records WHICH RUNTIME exercised it (the application backend, a named minion, …).\n // Without that, a cross-tenant read by a background digital worker is indistinguishable\n // from a data seed or a lifecycle batch. Runtime attribution is deliberately a weaker,\n // honest claim than user attribution and must never be read as one.\n SYSTEM_CONTEXT_READ = 'system_context_read',\n // The MUTATION twin: emitted whenever a server-internal `createAsSystem` /\n // `updateAsSystem` / `updateManyAsSystem` call writes a resource with a\n // synthesised super-admin context, bypassing the caller's scope + role ACL\n // (e.g. registration persisting credentials). A MUTATION under an ACL bypass\n // is more sensitive than a read, so it is audited as its own distinct event\n // rather than folded into SYSTEM_CONTEXT_READ.\n SYSTEM_CONTEXT_WRITE = 'system_context_write',\n\n /* Platform owner publication of application/service configuration; safe field names, caller and outcome only. /\n PLATFORM_CONFIGURATION_PUBLICATION = 'platform_configuration_publication',\n\n // Retained-Data (Impersonalization) Access Events\n // Emitted when a privileged SEE-THROUGH read reveals RETAINED (impersonalized-and-retained) records\n // that the default retention hide-predicate keeps hidden. SYSTEM_CONTEXT_READ names only the RUNTIME\n // that acted; this read is HUMAN-ATTRIBUTED (an application super-administrator, the only role the\n // see-through gate admits today) and carries a REQUIRED reason —\n // a compliance-grade access record over scrubbed personal data. Strictly read-only. Classified\n // DATA_ACCESS / WARNING (an authorized-but-elevated privileged access, not an anomaly ⇒ not CRITICAL).\n RETAINED_DATA_ACCESS = 'retained_data_access',\n\n // A DATA SUBJECT EXPORT was assembled and handed out — everything the framework holds about one\n // person, gathered across their whole relationship graph (GDPR Art. 15 access / Art. 20\n // portability). Deliberately NOT folded into SYSTEM_CONTEXT_READ: that event names only the\n // RUNTIME that acted and carries no notion of a subject, a purpose, or what a bundle contained,\n // so it cannot answer the question a regulator actually asks — \"who exported whose data, when,\n // and what was in it?\". The four routed export operations this capability replaced emitted\n // NOTHING at all, which is the gap this closes. Classified DATA_ACCESS / WARNING: an authorized\n // but maximally-sensitive disclosure, not an anomaly.\n // A person MET a governed document — was shown a notice, acknowledged one, accepted terms,\n // gave or withdrew a consent — and WHICH RELEASE they met (issue #54).\n //\n // The identity is the point. `documentRef` + `releaseId` + `releaseVersion` names a file in a\n // commit, so a reviewer asking \"what exactly did this person accept\" reads the terms as they\n // stood rather than as they stand now. Nothing here is digest-sealed: the previous lane's\n // interaction RECEIPTS were removed with the rest of the sealed publication machine on\n // 2026-08-28, and `.claude/rules/one-source-of-truth.md` Rule 0 keeps none of it.\n //\n // Classified USER_LIFECYCLE / INFO, beside USER_REGISTERED, because it records a change in the\n // person's relationship with the OPERATOR rather than a read of data or an access decision.\n // INFO because recording an acceptance is routine expected activity whose whole value is that the\n // trail can be queried years later; an alarm on it would fire on every registration. What is NOT\n // routine rides the payload instead — `releaseApprovalState` says whether anybody had approved\n // the document at the moment a person was bound by it.\n //\n // assurance-control: WILDO.PRIVACY.CONSENT_RECORD — a person's decision about a governed document is\n // recorded against the exact release version in force at that instant, together with the notice they\n // were given before being asked (`acceptanceMode`) — or, when the surface declared none, an advisory\n // saying so. It does NOT claim the document was SHOWN: only `EXPLICIT_AFTER_READING` presents it, and\n // the other two modes link it (#1382).\n GOVERNED_DOCUMENT_INTERACTION_RECORDED = 'governed_document_interaction_recorded',\n\n SUBJECT_DATA_EXPORT = 'subject_data_export',\n // A resource LISTING was exported to a file (CSV, JSON or PDF) by an operator. Distinct from\n // SUBJECT_DATA_EXPORT, which answers a data subject's own right over their own data: this one is\n // an authorized operator taking rows they can already read and carrying them OUT of the system, so\n // the questions it must answer are \"which resource, how many rows, and was it the page they were\n // looking at or the whole table\". Classified DATA_ACCESS / INFO with a per-emit `riskLevel` — see\n // the eventData schema for why the severity is static and the risk is not.\n COLLECTION_DATA_EXPORT = 'collection_data_export',\n\n // Rows were read THROUGH an HTTP-API resource binding — data left an EXTERNAL system\n // (an enterprise's Odoo/SAP/…) via the engine's read-through repository (ETL plan, D8/R6).\n // Deliberately NOT folded into the neighbors: SYSTEM_CONTEXT_READ names a runtime acting on\n // WILDO-owned rows and knows nothing of a foreign system; COLLECTION_DATA_EXPORT is rows\n // CARRIED OUT of the system by an operator, while this is rows BROUGHT IN from a system the\n // platform does not own — the question a reviewer asks is \"who reached into which external\n // system, through which provider, for which entity, and how much came back\". Attribution\n // carries the REAL initiating user even under a SERVICE_PRINCIPAL binding (R12 — the\n // credential-sharing-as-a-service failure this vocabulary exists to prevent). One event per\n // read-family OPERATION execution (a paginated list and its count are ONE access), emitted at\n // the adapter — the only tier that witnesses EVERY remote access, including repository-direct\n // probes the services tier never sees. Classified DATA_ACCESS / INFO: routine, authorized\n // operation — the value is the queryable trail, not an alarm.\n HTTP_API_READ_THROUGH_ACCESS = 'http_api_read_through_access',\n\n // A row was WRITTEN THROUGH an HTTP-API resource binding (#1679) — a create, update or delete sent to a\n // system of record the platform does not own, or refused before it was sent. The outbound twin of\n // HTTP_API_READ_THROUGH_ACCESS and deliberately not folded into it: a read brings rows IN, this pushes a\n // change OUT, and the reviewer's question is different — \"who changed which row of which external\n // system, which FIELDS did they change, and did it land\". One event per write ATTEMPT, emitted at the\n // adapter (the only tier that witnesses every remote write, repository-direct callers included), on\n // every outcome: applied, refused before sending, refused by the remote, UNKNOWN, and replayed from an\n // earlier attempt under the same Idempotency-Key. Carries field NAMES, never values: the trail must\n // never become a second copy of what was written into someone else's system.\n //\n // Beside RESOURCE_OPERATION_PERFORMED, not instead of it, and the two cannot contradict each other:\n // that row records that the OPERATION completed and is emitted only after it did; this one records\n // what happened at the REMOTE and is emitted whatever the operation's fate. An applied write whose\n // follow-up failed therefore shows this row (APPLIED) and no operation row — which is exactly the\n // state the WRITE_APPLIED_FOLLOW_UP_FAILED answer describes.\n HTTP_API_WRITE_THROUGH = 'http_api_write_through',\n\n // A declared ACTION of a system of record was run (#1678) — a vendor operation that is not a row write (posting an\n // invoice, confirming an order, an OData action), sent under the instance's service identity. One row per attempt that\n // reached the remote, or was replayed from an earlier attempt under the same Idempotency-Key: applied, refused by the\n // remote, of unknown outcome, replayed. Not folded into HTTP_API_WRITE_THROUGH: that row names the FIELDS a row write\n // changed, this one names an OPERATION and whether it landed, and a reviewer asks different questions of each.\n //\n // It is also the action's OUTBOUND record, and subject-free in the #1712 sense: the instance, the action, the remote\n // entity, the outcome and the time. No input VALUE (only the input's field names), no payload, no subject id — the\n // record describes the application's egress, not a person. The initiating actor rides the audit row's own `userId`,\n // as it does on every audit row; that is attribution, not a subject.\n SYSTEM_OF_RECORD_ACTION_EXECUTED = 'system_of_record_action_executed',\n\n // A declared ACTION of a system of record was REFUSED before anything was sent (#1678) — a non-owner organization, a\n // role the caller does not hold, a context not admitted to initiate it, a record outside the caller's partition, an\n // invalid input, a reused or missing Idempotency-Key. Its own type rather than an outcome of the row above because it\n // is an AUTHORIZATION decision, classified and alerted on as one; the executed row is data access. Every refusal is\n // recorded, so a probe for records one may not see leaves a trail even though it learns nothing.\n SYSTEM_OF_RECORD_ACTION_REFUSED = 'system_of_record_action_refused',\n\n // An operator RESET a pipeline through the admin door (#1734) — discarded its in-flight full pass (cursor, checkpoint,\n // membership journal) and, for a full resync, its incremental watermark. Its own type because it is an administrative\n // act on how a copy of a system of record is kept, not a read or a write of the records: the next run re-reads what\n // the reset discarded, and the row names what that was, so a reviewer can tell a deliberate resync from a pipeline that\n // lost its place. Classified ORG_MANAGEMENT / WARNING, like a platform configuration publication.\n EXTERNAL_DATA_PIPELINE_RESET = 'external_data_pipeline_reset',\n\n // An operator ANSWERED an outbound write of unknown outcome through the admin door (#2039): it landed (and, for a\n // create, here is the remote key of the record found) or it did not (send it again). Its own type because it is a\n // claim about ANOTHER system that nothing in the engine can check — the answer decides whether a record is linked or\n // sent a second time — so the record is the control. Classified ORG_MANAGEMENT / WARNING, like a pipeline reset.\n EXTERNAL_DATA_OUTBOUND_UNKNOWN_RESOLVED = 'external_data_outbound_unknown_resolved',\n\n // A BIDIRECTIONAL pipeline RESOLVED a row changed on both sides since they last agreed (#1723): the system of record's\n // values were loaded over the local ones, or the local ones were kept to be sent over the remote ones. One side's change\n // to the named fields is discarded, by the declared policy or an operator's choice, so the record is the control.\n // Classified DATA_ACCESS / WARNING: data was overwritten, by design, and a reviewer reads it beside the write-through.\n EXTERNAL_DATA_CONFLICT_RESOLVED = 'external_data_conflict_resolved',\n\n // A subject erasure INVOKED the declared external-erasure operation of an HTTP_API-bound\n // resource (ETL D6 stance 6b) — rows linked to the erased subject were DELETED in a system the\n // platform does not own (OData canonical DELETE / Odoo `unlink` / a declared REST_JSON call).\n // The first OUTBOUND WRITE on the read-through plane, landing WITH its mechanism per the D8\n // narrowing. Distinct from HTTP_API_READ_THROUGH_ACCESS (rows brought IN) and from\n // SYSTEM_CONTEXT_WRITE (a trusted write to WILDO-owned rows): the reviewer question here is\n // \"which subject's rows were deleted in which external system, through which provider, and how\n // many\". Classified USER_LIFECYCLE / INFO: the sanctioned mechanics of a data-protection\n // request, not an anomaly — the erasure report is the receipt; this is the queryable trail.\n HTTP_API_EXTERNAL_ERASURE = 'http_api_external_erasure',\n\n // A subject erasure COMPLETED while rows linked to the subject remain LIVE in an HTTP_API-bound\n // external system, on the controller's explicit per-request acknowledgement (ETL D6 stance 6c,\n // `acknowledgeHttpApiNonErasure`). The record IS the control (the same doctrine as the two\n // administrative floors): no downstream check can second-guess a controller acting within GDPR\n // Art. 17(3) grounds, so what the framework owes is a loud, queryable record of the hole — the\n // subject, the resource, the provider, and how many rows remained (when countable). Classified\n // USER_LIFECYCLE / CRITICAL: one event per acknowledged resource per erasure, never a standing\n // posture.\n HTTP_API_NON_ERASURE_ACKNOWLEDGED = 'http_api_non_erasure_acknowledged',\n\n // A subject erasure's outcome at ONE RECIPIENT of the subject's data — a provider the\n // application's declared flows reach (#1710). One row per recipient per erasure, naming the recipient, whose\n // account reached it, who owes the Art. 19 communication and the outcome (a registered effect's status, or the\n // status the recipient's declared erasure stance decides: UNMEASURED when it declares none). The queryable half of\n // the per-recipient receipt `SubjectErasureReport.recipients` carries, so an evidence collector can read per-vendor\n // outcomes without the application persisting reports. Vendor facts only — no personal data. USER_LIFECYCLE / INFO\n // for every outcome: severity is fixed per event type, so a reader separates the recipients whose data stayed live by\n // the row's `status`, never by its severity.\n SUBJECT_ERASURE_RECIPIENT_OUTCOME = 'subject_erasure_recipient_outcome',\n\n // The application CALLED a declared operation on a third-party provider — one event per outbound\n // call, on both the success and the failure path.\n //\n // Distinct from the three HTTP_API_ members above, which are the ETL read-through plane: those\n // record a RESOURCE whose rows live elsewhere being read or erased through a binding. This is the\n // other door — a custom backend service naming a provider and an operation directly — and the\n // question it answers is the first question of any provider incident: WHOSE third-party account\n // did we spend, on whose behalf, and what came back. `connectionOwnerScope`/`connectionOwnerId`\n // are what the initiator's own ids cannot answer, because one execution may legitimately spend\n // several tenants' accounts (a user action fanning out to every organization that user belongs to\n // issues N calls with N owners under ONE initiator).\n //\n // Distinct from `_PROVIDER_CREDENTIAL_USED`, which records that a stored credential was SPENT and\n // what the vendor thought of it. That one is about the CREDENTIAL's health and is emitted by the\n // store; this one is about the ACT and is emitted by the executor. A credential incident reads\n // both, in that order, and folding them would make \"which calls did this credential make\" a query\n // nobody can write.\n //\n // Classified DATA_ACCESS / INFO for the read-through member's reason — routine, authorized\n // activity whose value is the queryable trail, not an alarm. The READ/WRITE axis rides\n // `classification` in the payload and the per-emission `riskLevel`, never the static severity.\n //\n // assurance-control: WILDO.AUDIT.ATTRIBUTION — an outbound call made on a user's behalf is\n // recorded with the real initiating user carried through whichever account it spent.\n PROVIDER_OPERATION_CALL = 'provider_operation_call',\n\n // A signed-in person's BROWSER asked for a provider operation and the door REFUSED it (#367).\n //\n // A sibling of `PROVIDER_OPERATION_CALL`, not a failure case of it, because nothing was called: the\n // refusal happens before any catalogue lookup, credential read or outbound request, so the call\n // member's required `method`, `domain` and `classification` do not exist for it — an operation the\n // application never declared browser-reachable may not even be in the catalogue. What it records is\n // an ACCESS DECISION, which is the other half of \"record access decisions\" for this door, exactly as\n // `RESOURCE_OPERATION_DENIED` is for the resource authorizer.\n //\n // Classified AUTHORIZATION / WARNING for that sibling's reason: a refusal is not routine traffic, and a\n // run of them against one operation is a person probing what a browser can make the backend do.\n //\n // assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT — refusals at the browser door to a\n // third-party operation are attributable and reviewable.\n PROVIDER_OPERATION_DENIED = 'provider_operation_denied',\n\n // An AGENT reached an MCP server on somebody's behalf (#491).\n //\n // A sibling of `PROVIDER_OPERATION_CALL`, not a case of it, and the split is the same one that\n // separates that member from `_PROVIDER_CREDENTIAL_USED`: they identify different acts. A\n // provider operation is a CATALOGUE operation — it has an `operationId`, a `domain`, an HTTP\n // method and a declared READ/WRITE classification. An MCP tool has none of those: the tool list is\n // discovered from the server at turn start, the transport is always a JSON-RPC POST, and nothing\n // declares in advance what a tool does. Folding them would make \"which catalogue operations ran\"\n // a query that returns tools that are not catalogue operations.\n //\n // The ATTRIBUTION fields are deliberately identical, so a reviewer asking \"what did this person's\n // delegated credential do at that vendor\" writes one shape of query across both.\n //\n // Classified DATA_ACCESS / INFO for the same reason as its sibling: routine authorized activity\n // whose value is the queryable trail rather than an alarm. A refused outbound TARGET is carried on\n // the same event through `failureKind`, because an attempted egress a guard blocked is exactly\n // what a reviewer wants beside the calls that succeeded.\n //\n // assurance-control: WILDO.AUDIT.ATTRIBUTION — an agent's outbound tool call is recorded with the\n // real initiating user carried through whichever account it spent.\n MCP_TOOL_CALL = 'mcp_tool_call',\n\n // The application's BACKEND called a vendor to discharge an engine CAPABILITY (#1712): sent a\n // transactional email or an SMS, called the billing provider, moved bytes to or from a storage vendor.\n //\n // A sibling of `PROVIDER_OPERATION_CALL`, not a case of it, for the reason `MCP_TOOL_CALL` is one: a\n // capability call is not a CATALOGUE operation. It has no `operationId`, no catalogue `domain` and no\n // declared READ/WRITE classification; its act is named by the capability and a closed action instead.\n // Folding them would make \"which catalogue operations ran\" answer with emails. The ATTRIBUTION fields\n // are identical, so \"what did this application send to that vendor\" is one shape of query over all three.\n //\n // NO SUBJECT by construction, and that is a decision rather than an omission. #412 declined any\n // persisted record of a sent email — even metadata-only, recipient and template included — because it\n // would be a new personal-data store owing export, erasure and a retention class. So no field here\n // names a recipient, a phone number, a file, a customer or a payload: the row describes the\n // application's EGRESS, not the person the data is about. It still carries ATTRIBUTION like every audit\n // row — the initiating actor where the egress knows one, and `connectionOwnerId`, whose account was\n // spent (a person, for a file in their Drive) — which is why it exports at SUBJECT_DETAIL like its\n // siblings. Email, SMS and billing are reached without an execution context and carry no actor.\n //\n // Classified DATA_ACCESS / INFO for its siblings' reason: routine, authorized activity whose value is\n // the queryable trail rather than an alarm.\n //\n // assurance-control: WILDO.INTEGRATION.OUTBOUND_ACTIVITY_AUDIT — every physical call a capability\n // makes to a vendor is recorded with its provider, capability and outcome.\n PROVIDER_CAPABILITY_CALL = 'provider_capability_call',\n\n // ── Human decisions on an agent's work (#1594) ──\n // One family for BOTH planes — the conversational tool approval and the actor-system suspension —\n // keyed by one `decisionRef`. Every row carries names and ids only: no argument values and no\n // digests (#1595 D5), because a trail that holds what an agent was about to write cannot be scrubbed.\n // All AUTHORIZATION: each records who may, or did, authorize an agent's action.\n /** A decision was raised and is waiting. Actor: the requester's principal, with the agent. /\n HUMAN_DECISION_REQUESTED = 'human_decision_requested',\n /\n A decision ended — answered, lapsed, withdrawn, or its requester's authority lapsed. Exactly one\n * per `decisionRef`, written only by whoever won the compare-and-swap that released the pause.\n * `outcome` says which; a SIEM that wants modified approvals filters on it.\n \n assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT — every human decision on an agent's action is recorded once, with its decider and outcome.\n /\n HUMAN_DECISION_RESOLVED = 'human_decision_resolved',\n /* A decision was moved to another person (an answerer's handover, or a supervisor's takeover). /\n HUMAN_DECISION_REASSIGNED = 'human_decision_reassigned',\n /* A decision was escalated — moved up, never denied. /\n HUMAN_DECISION_ESCALATED = 'human_decision_escalated',\n /* A role-routed decision was claimed by one holder, or given back to the role (`claimed: false`). /\n HUMAN_DECISION_CLAIMED = 'human_decision_claimed',\n /* Someone tried to act on a decision and the predicate refused them. WARNING: the refusal is the evidence. /\n HUMAN_DECISION_ANSWER_REFUSED = 'human_decision_answer_refused',\n // #1628 — deadlines. A deadline changes who is asked and who is told, never the outcome, so none of\n // these rows is a decision: RESOLVED stays the one row that says how a decision ended.\n /* A decision's CLAIM or DECISION deadline passed with nobody having taken or answered it. Actor: the application. /\n HUMAN_DECISION_DEADLINE_MISSED = 'human_decision_deadline_missed',\n /\n A deadline stage's escalation rule fired: who was notified, and — for a REASSIGN rule — whether its\n * target resolved and could answer. Actor: the application.\n \n assurance-control: WILDO.AUDIT.SECURITY_EVENT — every rule-driven change to who is asked about an agent's action is recorded, including a reassignment refused because its target could not answer.\n /\n HUMAN_DECISION_ESCALATION_FIRED = 'human_decision_escalation_fired',\n /* A person admitted to answer stopped the decision's CLAIM and DECISION clocks, naming a declared pause state. /\n HUMAN_DECISION_CLOCK_PAUSED = 'human_decision_clock_paused',\n /* A person admitted to answer restarted the clocks; the paused time was added to both deadlines. /\n HUMAN_DECISION_CLOCK_RESUMED = 'human_decision_clock_resumed',\n\n // ── Autonomous agents (#1611) ──\n // An agent that runs with nobody on a socket, under a tenant-granted machine credential. The binding is\n // a grant of standing authority, so both directions are recorded; every turn the entry point starts or\n // refuses is recorded too, so an unattended action is never unexplained.\n /\n An autonomous agent may now run in an organization: a client of that organization was bound to it,\n * or a firm's client that runs it was admitted by the organization's service-provider relationship.\n \n assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — granting an agent standing authority to act unattended is recorded.\n /\n AUTONOMOUS_AGENT_BOUND = 'autonomous_agent_bound',\n /* An autonomous agent may no longer run in an organization: its binding or its admission was removed. /\n AUTONOMOUS_AGENT_UNBOUND = 'autonomous_agent_unbound',\n /* The autonomous entry point opened a turn. Actor: the machine principal it resolved. /\n AUTONOMOUS_AGENT_TURN_STARTED = 'autonomous_agent_turn_started',\n /* The autonomous entry point refused to open a turn, and created nothing. WARNING: `reason` says why. /\n AUTONOMOUS_AGENT_TURN_REFUSED = 'autonomous_agent_turn_refused',\n\n // ── OAuth2 / OIDC Provider Events (Wildo AS the authorization server) ──\n // Distinct from the `OAUTH2_` family above, which records Wildo CONSUMING an\n // EXTERNAL social OAuth provider. These record the app-issued OAuth2/OIDC provider\n // surface (`/oauth/authorize`, `/oauth/token`, `/oauth/authorize/decision`,\n // `/oauth/revoke`) — a third party gaining, or being refused, user-acting access.\n // Each maps to a Wildo assurance objective at the emit site (`assurance-control:` marker).\n\n /** A user-delegated `authorization_code` access token was minted for a third-party client\n * (the client may now act AS the user at the bound A2A/MCP resource) — the flagship grant. /\n OAUTH_DELEGATED_TOKEN_ISSUED = 'oauth_delegated_token_issued',\n /* A user APPROVED an interactive consent request — the client is authorized for this authorize flow. /\n OAUTH_CONSENT_GRANTED = 'oauth_consent_granted',\n /* A user DENIED an interactive consent request — access refused (protective, benign). /\n OAUTH_CONSENT_DENIED = 'oauth_consent_denied',\n /* A durable \"remember this app\" consent grant was created/updated — persistent delegated authority. /\n OAUTH_CONSENT_GRANT_PERSISTED = 'oauth_consent_grant_persisted',\n /\n An ANONYMOUS caller created an OAuth client identity through RFC 7591 dynamic registration.\n * The only write in this application reachable without any credential, so every occurrence is\n * evidence: the row it creates is durable, and the population of these rows is what an operator\n * needs to be able to review and revoke.\n /\n OAUTH_DYNAMIC_CLIENT_REGISTERED = 'oauth_dynamic_client_registered',\n /\n A URL-formatted `client_id` (CIMD) was REFUSED at the authorize endpoint.\n \n Auditable because the refusal reasons are not all equal: `HOST_NOT_ALLOWED` is a\n * misconfiguration, while `SSRF_TARGET_REFUSED` is an unauthenticated stranger trying to make\n * this server fetch an address only it can reach. Both arrive at the same endpoint from the same\n * kind of caller, so only the reason distinguishes them — and a spike in either is a thing an\n * operator must be able to alert on.\n /\n OAUTH_CIMD_CLIENT_REFUSED = 'oauth_cimd_client_refused',\n /* A user token was rotated via the provider `refresh_token` grant (`/oauth/token`). /\n OAUTH_TOKEN_REFRESHED = 'oauth_token_refreshed',\n /* A token was revoked via `/oauth/revoke` (RFC 7009). /\n OAUTH_TOKEN_REVOKED = 'oauth_token_revoked',\n /* An OIDC RP-Initiated Logout terminated the End-User's OP session at `/oauth/end-session`\n * (revocation-C). Distinct from `USER_LOGOUT` (first-party self-logout) and `OAUTH_TOKEN_REVOKED`\n * (RFC 7009 token revocation): this ends a SESSION on a relying party's behalf. /\n OAUTH_RP_INITIATED_LOGOUT = 'oauth_rp_initiated_logout',\n /* An `authorization_code` exchange was REJECTED (replay / PKCE failure / redirect mismatch / …) —\n * a potential attack signal. The specific cause rides `eventData.reason`. /\n OAUTH_CODE_EXCHANGE_FAILED = 'oauth_code_exchange_failed',\n /* A consent DECISION was attempted by a user who is NOT the consent request's bound user (403) —\n * a textbook cross-user authorization-abuse signal. /\n OAUTH_CONSENT_BINDING_VIOLATION = 'oauth_consent_binding_violation',\n\n /* Refresh-token REUSE detected → the whole token family was revoked (possible theft). Emitted by the\n * refresh CALLERS (the token issuer stays audit-free by design — it surfaces a reuse signal instead). /\n USER_REFRESH_TOKEN_REUSE_DETECTED = 'user_refresh_token_reuse_detected',\n}\n\n/\n Closed vocabulary of `OAUTH_CODE_EXCHANGE_FAILED` failure causes (RFC 6749 / OAuth 2.1 / RFC 7636).\n * A dedicated enum (not an inline literal union) so the emit sites, the schema, and any SIEM\n * consumer share one runtime source — the project's closed-vocabulary rule.\n /\nexport enum OAuthCodeExchangeFailureReason {\n /* The single-use code did not atomically consume — replayed, expired, or never issued. /\n CODE_REPLAY_OR_INVALID = 'code_replay_or_invalid',\n /* The consumed token was of a different consumable-token type (not an authorization code). /\n NOT_AUTHORIZATION_CODE = 'not_authorization_code',\n /* The decoded code carried no subject (userId). /\n NO_SUBJECT = 'no_subject',\n /* The redeeming `client_id` differs from the client the code was issued to. /\n CLIENT_MISMATCH = 'client_mismatch',\n /* The redeeming `redirect_uri` differs from the one bound at authorize. /\n REDIRECT_URI_MISMATCH = 'redirect_uri_mismatch',\n /* The PKCE `code_verifier` failed the bound S256 challenge (or was malformed). /\n PKCE_VERIFICATION_FAILED = 'pkce_verification_failed',\n /* The client was deactivated between authorize and redemption (redemption-window re-check). /\n CLIENT_INACTIVE = 'client_inactive',\n /* The client lost the `authorization_code` grant between authorize and redemption. /\n GRANT_TYPE_LOST = 'grant_type_lost',\n}\n\n/* Canonical event categories — used by auditable-events, security-envelope, audit-logs. /\nexport enum AuditEventCategory {\n AUTHENTICATION = 'authentication',\n AUTHORIZATION = 'authorization',\n USER_LIFECYCLE = 'user_lifecycle',\n ORG_MANAGEMENT = 'org_management',\n DATA_ACCESS = 'data_access',\n}\n\n/* Canonical severity levels — used by auditable-events, security-envelope, audit-logs. /\nexport enum AuditEventSeverity {\n INFO = 'info',\n WARNING = 'warning',\n CRITICAL = 'critical',\n}\n\n/\n What each audit category and severity MEANS to whoever reads the trail.\n \n The words were authored, correctly, in the technical-documentation catalog that renders the\n * audit-trail page — and lived only there, so the same vocabularies reached every other surface as\n * bare tokens. Moved here, beside the enums, because a vocabulary's words belong with the\n * vocabulary: the catalog now imports them, the schemas describe their own fields from them, and\n * there is one account of what `data_access` selects rather than two that can disagree.\n \n `name` is what a reader is shown; `meaning` is what selecting it actually gets them. Exhaustive by\n * type, so a sixth category cannot ship as a bare value.\n /\nexport const AUDIT_EVENT_CATEGORY_MEANINGS: Readonly<Record<AuditEventCategory, { readonly name: string; readonly meaning: string }>> = {\n [AuditEventCategory.AUTHENTICATION]: { name: 'Authentication', meaning: 'Signing in, signing out, second factors and failed attempts.' },\n [AuditEventCategory.AUTHORIZATION]: { name: 'Authorization', meaning: 'Access decisions: what an identity was allowed or refused.' },\n [AuditEventCategory.USER_LIFECYCLE]: { name: 'User lifecycle', meaning: 'Accounts created, changed, suspended, restored or removed.' },\n [AuditEventCategory.ORG_MANAGEMENT]: { name: 'Organization management', meaning: 'Membership, roles, units and organization settings.' },\n [AuditEventCategory.DATA_ACCESS]: { name: 'Data access', meaning: 'Reads and changes of application data that are recorded for review.' },\n};\n\nexport const AUDIT_EVENT_SEVERITY_MEANINGS: Readonly<Record<AuditEventSeverity, { readonly name: string; readonly meaning: string }>> = {\n [AuditEventSeverity.INFO]: { name: 'Information', meaning: 'Expected activity. Useful as evidence, not a signal on its own.' },\n [AuditEventSeverity.WARNING]: { name: 'Warning', meaning: 'Unusual or refused activity worth reviewing in context.' },\n [AuditEventSeverity.CRITICAL]: { name: 'Critical', meaning: 'Activity that should reach whoever handles security incidents.' },\n};\n\n/\n A `Values:` legend in the shape the generated API reference already uses, so a field described\n * here reads exactly like one described from a resource specification.\n /\nexport function describeAuditVocabulary(\n lead: string,\n meanings: Readonly<Record<string, { readonly name: string; readonly meaning: string }>>,\n): string {\n const legend = Object.entries(meanings).map(([value, words]) => `- \\`${value}\\`: ${words.meaning}`).join('\\n');\n return `${lead}\\n\\nValues:\\n${legend}`;\n}\n\n/\n Why the browser door to a provider operation refused a request (#367). A CLOSED vocabulary: the door\n * resolves exactly one of these per refusal, in the order listed, and a reviewer groups by it.\n \n Deliberately NOT a reuse of {@link ResourceOperationDenialReason}. The two doors ask different\n * questions of different declarations — that one checks an operation variant's roles and a row's scope,\n * this one checks an application's browser-reachability policy and whose third-party account is named —\n * and sharing members would make \"insufficient roles\" mean two things in one column.\n /\n/\n What a provider operation's `requiredScopes` check concluded for one call (#979).\n \n Carried on {@link AuditableEvent_ProviderOperationCall_EventDataSchema} only when the operation declares required\n * scopes; an operation declaring none carries no scope field at all, rather than a verdict about nothing.\n /\nexport enum ProviderOperationScopeCheck {\n /* The grant recorded its scopes and every required one is among them. The call proceeded. /\n VERIFIED = 'verified',\n /\n The spent credential records no granted scopes — a pasted key, the application's own credential, or a vendor\n * that did not echo `scope`. The call proceeded UNCHECKED, and this row is what says so.\n /\n NOT_RECORDED = 'not_recorded',\n /* The grant recorded its scopes and lacks at least one required scope. The call was refused before any request. /\n MISSING = 'missing',\n}\n\n/\n WHICH engine capability an outbound capability call discharged (#1712) — the egress, not the vendor.\n \n Deliberately not {@link EngineCapability}: file storage is not an engine capability (a storage is selected\n * per field, not per application), and email is two capabilities (transactional and marketing) with one\n * egress. The finer engine capability, where one exists, rides `engineCapability` beside it.\n /\nexport enum ProviderCapabilityEgress {\n EMAIL = 'email',\n SMS = 'sms',\n BILLING = 'billing',\n FILE_STORAGE = 'file_storage',\n /* A captcha vendor's backend verification of a token a public form submitted (#1735). /\n CAPTCHA = 'captcha',\n}\n\n/* WHAT a capability call did (#1712). One member per act the egress performs; billing names its adapter method apart. /\nexport enum ProviderCapabilityCallAction {\n EMAIL_SEND = 'email_send',\n SMS_SEND = 'sms_send',\n /* One call of the billing adapter; `billingOperation` names which. /\n BILLING_OPERATION = 'billing_operation',\n FILE_STORAGE_UPLOAD = 'file_storage_upload',\n FILE_STORAGE_DOWNLOAD = 'file_storage_download',\n FILE_STORAGE_READ_METADATA = 'file_storage_read_metadata',\n FILE_STORAGE_DELETE = 'file_storage_delete',\n /* One token sent to a captcha vendor's verification endpoint (reCAPTCHA `siteverify`). /\n CAPTCHA_VERIFY = 'captcha_verify',\n}\n\n/\n How ONE capability call ended, as far as the application can know (#1712).\n \n Three members, not two, because a call can leave and never be answered: an email whose transport timed out after\n * the request was sent may or may not have been accepted. Reporting that as a failure would invite a resend the\n * vendor may already have honoured; reporting it as a success would claim what nobody observed.\n /\nexport enum ProviderCapabilityCallOutcome {\n /* The vendor answered and accepted the call. /\n SUCCEEDED = 'succeeded',\n /* The call was refused — by the vendor, or before it left (a missing credential, a refused request). /\n FAILED = 'failed',\n /* The call left and its result was not observed (a timeout or a broken connection after sending). /\n OUTCOME_UNKNOWN = 'outcome_unknown',\n}\n\nexport enum ProviderOperationDenialReason {\n /\n The caller authenticated without a person — an application API key, a machine identity. This door\n * exists for a signed-in person's browser, and the policy's roles and the target-authorization port\n * both reason about a person; a backend caller has the executor and the typed client instead.\n /\n MISSING_USER_SESSION = 'missing_user_session',\n /\n The application's `providers.browserOperations` names no policy for this provider and operation.\n * The fail-closed default: nothing is reachable from a browser unless declared. Also the answer for an\n * operation that does not exist, so a refusal never reveals what a catalogue contains.\n /\n NOT_BROWSER_REACHABLE = 'not_browser_reachable',\n /* The request names a connection shape — owner scope × delegation — the operation's policy does not admit. /\n CONNECTION_NOT_ADMITTED = 'connection_not_admitted',\n /\n The policy declares roles and the target is the caller's OWN user account, over which nobody holds a\n * role. A policy mistake rather than a caller's, recorded as its own reason so it is not read as a\n * person lacking a role they could be granted.\n /\n ROLES_NOT_APPLICABLE_TO_TARGET = 'roles_not_applicable_to_target',\n /\n The target-authorization port refused: the caller named an organization they do not belong to\n * organization-wide, or a user account that is not their own.\n /\n TARGET_NOT_AUTHORIZED = 'target_not_authorized',\n /\n The caller may act for the account, and holds none of the policy's roles — after hierarchy\n * expansion, in the scope of that account. Checked AFTER {@link TARGET_NOT_AUTHORIZED}, so a person\n * naming a tenant they do not belong to is recorded as that, not as a person short of a role.\n /\n INSUFFICIENT_ROLES = 'insufficient_roles',\n}\n\n/\n Why the authorizer refused an operation. A CLOSED vocabulary — the authorizer resolves exactly\n * one of these per refusal, and a SOC dashboard groups by it.\n \n The distinction that matters most operationally is {@link SUBJECT_NOT_RESOLVABLE} vs. the rest:\n * every other member is a caller who reached a real, visible row and was refused on roles or scope,\n * whereas that one is a caller who named a row they cannot see at all — the shape of tenant\n * enumeration.\n /\nexport enum ResourceOperationDenialReason {\n /\n The application requires consent purposes before it may be used\n * (`compliance.serviceConsentRequirement`), and this person has not granted them (#534). The person is\n * authenticated and may hold every role the operation needs; what is missing is their own decision.\n * Distinct from every role/scope reason, because the remedy is the person's choice, not an administrator's.\n /\n SERVICE_CONSENT_REQUIRED = 'service_consent_required',\n\n /\n ONE operation declared the purpose its own processing rests on\n * (`ResourceOperationConsentGateDeclaration`), and this person has not granted it (#1258 Step 3).\n * Distinct from {@link SERVICE_CONSENT_REQUIRED}: only this operation was refused, never the whole\n * application.\n /\n CAPABILITY_CONSENT_REQUIRED = 'capability_consent_required',\n\n /\n No initiator identity or roles on the execution context. Fail-closed: the authorizer refuses\n * rather than assuming an anonymous caller.\n \n A backstop, not a live path — verified. The execution context fails closed earlier and\n * harder: every execution type that reaches the authorizer refuses to CONSTRUCT without\n * `initiatorIds`, and the one type that permits null (`WEBHOOK_CALLBACK`) is skipped before the\n * guard, since signature verification already established trust. The roles half cannot fire\n * either — the context spreads `initiatorRoles`, so the only accepted value is an array.\n \n A row carrying this reason therefore means something bypassed context construction. Treat it as\n * a defect signal, not routine refusal traffic.\n /\n MISSING_INITIATOR = 'missing_initiator',\n\n /\n The caller's organization-wide roles did not satisfy the operation's required role set, after\n * role-hierarchy expansion. The everyday \"you are not an admin\" refusal.\n /\n INSUFFICIENT_ROLES = 'insufficient_roles',\n\n /\n The caller was refused against the target row's PRIMARY SCOPE — the row belongs to another\n * user, organization or application than the caller is entitled to. Distinct from\n * {@link INSUFFICIENT_ROLES}: the caller may hold the right role, but in the wrong tenant.\n /\n SCOPE_MISMATCH = 'scope_mismatch',\n\n /\n The caller reached the resource through a foreign-key path (`/assigned-to-users/{userId}/todos`)\n * whose owning entity they do not control.\n /\n FK_RELATIONSHIP_DENIED = 'fk_relationship_denied',\n\n /\n A collection operation was refused on its PARENT scope — the caller has no access to the\n * organization / application whose collection they addressed.\n /\n PARENT_SCOPE_DENIED = 'parent_scope_denied',\n\n /\n The named row could not be resolved for the caller: it does not exist, OR it exists and is\n * invisible to the caller's scope. The authorizer cannot distinguish these two — and that is\n * deliberate, because reporting them differently would leak the existence of out-of-scope rows.\n * The refusal surfaces to the caller as NOT_FOUND (404) and that response is unchanged by this\n * event; only the audit trail records that a refusal occurred.\n \n Consequently this reason is AMBIGUOUS BY CONSTRUCTION and a single occurrence proves nothing —\n * a 404 for a genuinely deleted record lands here too. Its value is in the aggregate: a principal\n * accumulating these against ids they never successfully read is enumerating.\n \n assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT — refusals are recorded without the record itself\n * becoming an existence oracle.\n /\n SUBJECT_NOT_RESOLVABLE = 'subject_not_resolvable',\n\n /\n The caller holds the ROLE but no usable APPLICATION-WIDE elevation.\n \n Its own member rather than `INSUFFICIENT_ROLES`, and the distinction is the whole point of the\n * grant model: the caller IS an administrator and the refusal is about STANDING privilege, not\n * about authority. Folding it into the roles reason would make the two indistinguishable in the\n * trail — and a reviewer asking \"did zero-standing-privilege actually bite anyone?\" would have no\n * way to count it.\n \n Distinct from a tenant crossing refused for the same shape of reason: that one is refused inside\n * `authorizeOrganizations` and surfaces as `SCOPE_MISMATCH`, because there the caller genuinely is\n * outside the tenant. Here there is no tenant to be outside of.\n \n assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT\n /\n APPLICATION_WIDE_ELEVATION_MISSING = 'application_wide_elevation_missing',\n\n /\n The caller tried to GRANT authority it does not itself hold — a privilege-escalation attempt,\n * refused by the role-ceiling gate (`assertRequestedRolesWithinCallerCeiling`).\n \n Its own member rather than {@link INSUFFICIENT_ROLES}, for the same reason\n * {@link APPLICATION_WIDE_ELEVATION_MISSING} is: the caller PASSED the operation's role check —\n * an `ORG_ADMIN` really may update a membership — and was refused on the CONTENT of the write.\n * Folding the two together would make the single refusal an access review most wants to see\n * indistinguishable from the everyday \"you are not an admin\", and a reviewer asking \"has anyone\n * tried to escalate?\" would have nothing to count.\n \n Uniquely among the members here, the row carries {@link\n * AuditableEvent_ResourceOperationDenied_EventDataSchema.escalatedRoles} — the roles that were\n * actually asked for. `requiredRoles` and `initiatorRoles` cannot express it: neither is the set\n * the caller tried to confer on somebody else.\n \n Raised OUTSIDE the authorization phase — the gate runs in custom-implementation prefixes, after\n * the authorizer has returned — so it does not reach `classifyAuthorizationDenial`. The gate emits\n * it directly through the same chokepoint, keeping the dedup window, the logarithmic escalation\n * ladder and the loss counters.\n \n assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — an attempt to grant authority the caller does\n * not hold is refused AND recorded.\n * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT\n /\n ROLE_CEILING_EXCEEDED = 'role_ceiling_exceeded',\n\n /\n A high-impact action was refused because the operation ITSELF demands a fresh re-proof of\n * identity (`requiresStepUpAuthentication`), and the caller presented none.\n \n The caller is authenticated and may hold every role the operation needs. What is missing is a\n * ceremony, so this belongs with {@link SERVICE_CONSENT_REQUIRED} rather than with\n * {@link INSUFFICIENT_ROLES}: the remedy is an act by the same person, not a grant by an\n * administrator.\n \n Paired with {@link STEP_UP_REQUIRED_BY_FRESHNESS} for the reason the two consent members are\n * paired — the missing thing is the same and the party that DEMANDED it is not, and the two read\n * very differently in a review. A burst of these is somebody repeatedly attempting an action the\n * application has declared dangerous; a burst of the other is sessions ageing out.\n \n Raised OUTSIDE the authorization phase, like {@link ROLE_CEILING_EXCEEDED}: the step-up gate is\n * a private check at the services-registry tier that throws without passing through the\n * authorizer, so it reaches no `classifyAuthorizationDenial`. It emits through the same chokepoint\n * instead, keeping the dedup window, the escalation ladder and the loss counters.\n \n assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — a refused high-impact action is\n * recorded, not merely refused.\n * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT\n /\n STEP_UP_REQUIRED_BY_OPERATION = 'step_up_required_by_operation',\n\n /\n The same refusal, demanded by the USER TYPE's freshness policy (`UserTypeAuthPolicy.stepUpAuth`)\n * rather than by the operation: the caller's authentication is older than the declared maximum age.\n \n Distinct from {@link STEP_UP_REQUIRED_BY_OPERATION} because the two send a reviewer to different\n * places — one to the operation's own declaration, the other to the user-type policy — and because\n * only this one varies with how long a person has been signed in. The refusal's own error context\n * already carried the distinction before either was audited; this keeps it in the durable record.\n \n assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION\n * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT\n /\n STEP_UP_REQUIRED_BY_FRESHNESS = 'step_up_required_by_freshness',\n\n /\n A service firm's expert was refused in a CLIENT organization because the client organization type's\n * authentication policy asks for a factor the session has not satisfied FOR THAT CLIENT (#1633).\n \n Distinct from the two above because the party that demanded the proof is a third one: not the operation, not the\n * expert's own user type, but the TENANT the expert is working in. A reviewer reading the client's trail sees its\n * own policy being enforced on outside staff; the row carries the relationship through the usual attribution.\n \n assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — the resource tenant's authentication policy is enforced on external experts, per request.\n * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT\n /\n STEP_UP_REQUIRED_BY_CLIENT_ORGANIZATION_POLICY = 'step_up_required_by_client_organization_policy',\n}\n\n/* SSO configuration change type. /\nexport enum SsoConfigChangeType {\n CREATED = 'created',\n UPDATED = 'updated',\n DELETED = 'deleted',\n PROVIDER_ADDED = 'provider_added',\n PROVIDER_REMOVED = 'provider_removed',\n ENFORCEMENT_CHANGED = 'enforcement_changed',\n}\n\n/* SIEM export configuration change type. /\nexport enum SiemExportChangeType {\n ENABLED = 'enabled',\n DISABLED = 'disabled',\n UPDATED = 'updated',\n}\n\n/\n Normalised MACHINE_ACCESS operation vocabulary. Transport-native method names (A2A JSON-RPC\n * `message/send`, MCP `tools/call`, …) are mapped to these stable, transport-prefixed audit\n * identifiers so an org SIEM reads ONE vocabulary across every external resource-server surface.\n * The `<transport>_<method>` shape keeps A2A and MCP operations disambiguated in a flat stream.\n /\nexport enum MachineAccessOperation {\n A2A_MESSAGE_SEND = 'a2a_message_send',\n A2A_MESSAGE_STREAM = 'a2a_message_stream',\n /* Reading one task's state. Externally triggered and tenant-actionable, so it audits. /\n A2A_TASKS_GET = 'a2a_tasks_get',\n /* Requesting cancellation of a task — a MUTATION of tenant work, audited as such. /\n A2A_TASKS_CANCEL = 'a2a_tasks_cancel',\n /\n Re-attaching to a task's update stream after a dropped connection.\n \n Audited like `A2A_TASKS_GET` and for the same reason: it is a READ of tenant work by an external\n * principal. It deserves its own member rather than borrowing the get — a resubscribe holds a\n * connection open for as long as the task runs, so in a trail the two have very different shapes,\n * and collapsing them would hide a caller camping on a stream behind ordinary polling.\n /\n A2A_TASKS_RESUBSCRIBE = 'a2a_tasks_resubscribe',\n /\n Registering a webhook the agent will POST this task's updates to.\n \n The most security-relevant of the push-notification operations and the reason all four get their\n * own members: the caller is directing OUR server to make outbound requests to an address IT\n * chooses, carrying credentials IT supplies. In a trail that is a different act from reading a\n * task, and an operator reviewing egress needs to find every one of them without inferring it from\n * a generic access row.\n /\n A2A_PUSH_NOTIFICATION_CONFIG_SET = 'a2a_push_notification_config_set',\n /* Reading back one registered webhook target. Secrets are redacted, but the URL is disclosed. /\n A2A_PUSH_NOTIFICATION_CONFIG_GET = 'a2a_push_notification_config_get',\n /* Enumerating every webhook target registered against a task. /\n A2A_PUSH_NOTIFICATION_CONFIG_LIST = 'a2a_push_notification_config_list',\n /* Removing a webhook target — a MUTATION, and the act that silently stops an operator's alerting. /\n A2A_PUSH_NOTIFICATION_CONFIG_DELETE = 'a2a_push_notification_config_delete',\n /\n Enumerating an owner's tasks (A2A 1.0 `ListTasks`).\n \n Its own member rather than borrowing `A2A_TASKS_GET`: a LIST discloses the existence and shape\n * of work the caller did not name, which in a trail is a different act from reading one task an\n * operator already knows about. Collapsing them would hide enumeration behind ordinary polling.\n /\n A2A_TASKS_LIST = 'a2a_tasks_list',\n MCP_TOOLS_LIST = 'mcp_tools_list',\n MCP_TOOLS_CALL = 'mcp_tools_call',\n /\n A MACHINE principal's READ / LIST / SEARCH on a DECLARED cross-tenant REST door\n * (`admitsCrossTenantPlatformAdministration`) — today the application audit-log door.\n \n Deliberately NOT every REST call a machine makes: the plain resource API is audited per operation\n * through `RESOURCE_OPERATION_PERFORMED`, which carries `machineCredentialId`. These three exist because a\n * declared crossing's only other row, `CROSS_TENANT_ADMINISTRATIVE_ACCESS`, is written per TENANT REACHED —\n * so a machine read returning only application-wide rows, or nothing, left no row naming who read (#297).\n * One member per verb, like the A2A task members: a LIST enumerates, a READ fetches a row somebody named.\n /\n API_READ = 'api_read',\n API_LIST = 'api_list',\n API_SEARCH = 'api_search',\n}\n\nconst API_READ_MACHINE_ACCESS_OPERATIONS: Readonly<Partial<Record<CoreResourceOperation, MachineAccessOperation>>> = {\n [CoreResourceOperation.READ]: MachineAccessOperation.API_READ,\n [CoreResourceOperation.LIST]: MachineAccessOperation.API_LIST,\n [CoreResourceOperation.SEARCH]: MachineAccessOperation.API_SEARCH,\n};\n\n/\n The MACHINE_ACCESS identifier for an executed REST read, or `undefined` for any verb that is not one.\n * The one place the core-operation → audit-vocabulary mapping lives, so a recorder never spells it.\n /\nexport function resolveApiReadMachineAccessOperation(operation: CoreResourceOperation \| undefined): MachineAccessOperation \| undefined {\n return operation === undefined ? undefined : API_READ_MACHINE_ACCESS_OPERATIONS[operation];\n}\n\nexport const AuditableEventTypeSchema = z.union([\n z.enum(CoreAuditableEventType),\n z.string()\n]);\n\nexport const AuditableEvent_User_LoginEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_LOGIN),\n ipAddress: z.string(),\n userAgent: z.string(),\n userId: z.string(),\n authMethod: z.string().optional(),\n email: z.string().optional(),\n sessionId: z.string().optional(),\n});\n\nexport const AuditableEvent_User_LogoutEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_LOGOUT),\n userId: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\nexport const AuditableEvent_User_LoginFailedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_LOGIN_FAILED),\n email: z.email(),\n authMethod: z.string(),\n failureReason: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n attemptsRemaining: z.number().optional(),\n sessionId: z.string(),\n});\n\n/\n Which lockout mechanism tripped a `USER_ACCOUNT_LOCKED` audit — so a SOC can distinguish the two\n * sources, which have different remediation: the per-SESSION progressive failed-attempt limit vs the\n * per-EMAIL global rate-limit. Enum (fixed vocabulary), not a string union, per the project rule.\n /\nexport enum AccountLockoutReason {\n /* The per-session progressive failed-attempt limit tripped (`incrementSessionAttempts`). /\n SESSION_ATTEMPT_LIMIT = 'session_attempt_limit',\n /* The per-email GLOBAL rate-limit lockout tripped (`checkRateLimit(GLOBAL_LOCKOUT + email)`). /\n GLOBAL_EMAIL_RATE_LIMIT = 'global_email_rate_limit',\n}\n\nexport const AuditableEvent_User_AccountLockedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_ACCOUNT_LOCKED),\n userId: z.string(),\n email: z.email(),\n authMethod: z.string(),\n lockoutDuration: z.number(), // minutes\n ipAddress: z.string(),\n userAgent: z.string(),\n sessionId: z.string(),\n /\n Which lockout mechanism tripped this event. OPTIONAL for backward compatibility — pre-existing\n * emitters and already-stored rows may omit it; new emitters set it so SOC tooling can filter\n * session-limit vs global-email-limit lockouts.\n /\n reason: z.enum(AccountLockoutReason).optional(),\n});\n\n/\n A machine principal (api-key / OAuth-client secret / exchanged client-credentials token) that\n * successfully authenticated. Carries the credential PROVENANCE — never the raw secret. Emitted at\n * the OAuth token-issuance moment (`/oauth/token`); per-request direct-secret access additionally\n * carries this provenance into any FIELD_ACCESS audit row (see `audit-access-fields`).\n /\nexport const AuditableEvent_MachineAuth_SuccessEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.MACHINE_AUTH_SUCCESS),\n /* MachineAuthMethod value: `api_key` \| `oauth_client`. /\n authMethod: z.string(),\n /* The ApiKey / OAuthClient row `_id` that authenticated — NEVER the raw secret. /\n credentialId: z.string(),\n /* Resolved machine execution type: `organization_machine` \| `application_machine`. /\n scopeType: z.string(),\n /* organizationId (ORG machine) or applicationId (APP machine). /\n scopeId: z.string().optional(),\n resourceIdentifier: z.string().optional(),\n operationIdentifier: z.string().optional(),\n ipAddress: z.string().optional(),\n});\n\n/\n A rejected machine-credential presentation (bad/expired/wrong-audience/wrong-scope secret or\n * token, or a rate-limited source). Records the ATTEMPT — the presented credential kind + prefix,\n * the target scope, and the reason — never a `credentialId` (the credential did not resolve). The\n * per-source-IP brute-force signal (external-access hardening) is exactly this event stream.\n /\nexport const AuditableEvent_MachineAuth_FailedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.MACHINE_AUTH_FAILED),\n /* Presented credential kind: `api_key` \| `oauth_client` \| `machine_token`. /\n credentialKind: z.string(),\n /* Human-routable secret prefix (e.g. `sk_org_` / `oc_app_`) — NEVER the full secret. Absent for token fronts. /\n credentialPrefix: z.string().optional(),\n /* Failure reason (e.g. `invalid_credential`, `inactive`, `aud_mismatch`, `wrong_scope`, `rate_limited`). /\n reason: z.string(),\n scopeType: z.string().optional(),\n scopeId: z.string().optional(),\n resourceIdentifier: z.string().optional(),\n operationIdentifier: z.string().optional(),\n ipAddress: z.string().optional(),\n});\n\n/\n A machine principal (ORGANIZATION_MACHINE / APPLICATION_MACHINE) exercised an external\n * resource-server surface (A2A `message/send`, MCP `tools/call`, …) with an already-issued,\n * audience-bound token. The token-USE twin of MACHINE_AUTH_SUCCESS (token-MINT): the mint fires\n * once, low-volume, at `/oauth/token`; THIS fires per external request so an org SIEM sees WHAT a\n * machine did, not merely that it authenticated.\n \n Carries the credential PROVENANCE (authMethod + credentialId — never the raw secret), the ROLE\n * context that authorized the access (roles are the single authorization axis — there is NO OAuth\n * authorization-scope vocabulary), and the resource server + operation targeted. Emitted fire-and-\n * forget at the A2A / MCP controller boundary AFTER the caller is authenticated + authorized; routed\n * to the org SIEM via `routingOrgIds` (verified org for an ORGANIZATION_MACHINE; an\n * APPLICATION_MACHINE has no single tenant SIEM ⇒ no per-org dispatch).\n /\nexport const AuditableEvent_MachineAccess_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.MACHINE_ACCESS),\n /* MachineAuthMethod value: `api_key` \| `oauth_client`. /\n authMethod: z.string(),\n /* The ApiKey / OAuthClient row `_id` whose token was presented — NEVER the raw secret. /\n credentialId: z.string(),\n /* Resolved machine execution type: `organization_machine` \| `application_machine`. /\n scopeType: z.string(),\n /\n TENANT scope id: organizationId (ORG machine) or applicationId (APP machine). This is the\n * data-partition scope, NOT an OAuth authorization scope — that vocabulary was removed; roles are\n * the single authorization axis.\n /\n scopeId: z.string().optional(),\n /\n The role context that authorized this access (the machine principal's roles). Roles are the\n * single authorization axis; recorded so a SIEM sees the authority the access ran under.\n /\n roles: z.array(z.string()).optional(),\n /* ResourceServerKind of the surface accessed: `a2a` \| `mcp` \| `api` (a declared cross-tenant REST read). /\n resourceServer: z.string(),\n /* A2A/MCP: the resource-server audience / agent endpoint / systemRef hit. `api`: the resource type read. /\n resourceIdentifier: z.string().optional(),\n /* Normalised MachineAccessOperation value (e.g. `a2a_message_send`, `mcp_tools_call`). /\n operationIdentifier: z.string(),\n ipAddress: z.string().optional(),\n});\n\nexport const AuditableEvent_User_SessionExpiredEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_SESSION_EXPIRED),\n userId: z.string(),\n sessionId: z.string(),\n sessionDuration: z.number(), // minutes\n lastActivity: z.date(),\n});\n\n/\n One refresh chain retired to keep a principal within its concurrent-session cap.\n \n `evictedIssuedAt` is the load-bearing field and the reason this event is worth its own type: the\n * cap's security property is that the OLDEST chain goes, so a record that named only the victim\n * would prove a session ended without proving the right one did. Carrying the issuance instant makes\n * the first-in-first-out claim checkable from the trail alone.\n \n `configuredMaximum` and `retainedCount` are here so a reviewer can tell a correctly-enforced cap\n * from a misconfigured one without reading the config as it stood at that moment.\n \n NO token material. The JTI is an opaque identifier, never the token — the trail must not become a\n * place where a credential can be recovered.\n \n assurance-control: WILDO.IDENTITY.SESSION_CONCURRENCY_LIMIT — the bound's enforcement is evidenced,\n * including WHICH chain was retired, so the ordering can be reviewed and not merely trusted.\n /\nexport const AuditableEvent_User_SessionEvictedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_SESSION_EVICTED),\n userId: z.string(),\n /* Opaque identifier of the retired refresh chain. Never the token itself. /\n evictedJti: z.string(),\n /* When the retired chain was issued — the evidence that the OLDEST one went. Absent if unreadable. /\n evictedIssuedAt: z.date().optional(),\n /* The cap in force for this principal's user type at the moment of eviction. /\n configuredMaximum: z.number().int().positive(),\n /* How many chains remained after the eviction, so an over- or under-enforcing cap is visible. /\n retainedCount: z.number().int().nonnegative(),\n});\n\n/\n A `USERS` row was hard-deleted.\n \n The identity is gone after this event, so the record must carry enough to answer \"who was\n * removed?\" without joining back to a row that no longer exists — hence `email` alongside `userId`.\n * That is a deliberate, narrow retention of an identifier inside the audit trail: an erasure that\n * left no trace of having happened would defeat the purpose of the trail, and the audit store is\n * itself immutable and access-controlled. Prefer `RETAIN_AND_IMPERSONALIZE` erasure\n * (`eraseSubjectAsSystem`) over a hard delete wherever the retention contract allows it — this\n * event exists to make the hard-delete path, which the framework still exposes to administrators\n * through `USERS \| DELETE`, leave evidence.\n \n `deletedBy` is the acting principal, which for the admin route is NOT the subject. Mirrors\n * `AuditableEvent_Organization_DeletedEventDataSchema`.\n \n assurance-control: WILDO.DATA.SECURE_LIFECYCLE — identity destruction is a\n * security-relevant event and must be attributable.\n /\nexport const AuditableEvent_User_DeletedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_DELETED),\n userId: z.string(),\n email: z.string().optional(),\n deletedBy: z.string(),\n /* Roles the deleted principal held, so an auditor can see what authority was removed. /\n appRoles: z.array(z.string()).optional(),\n});\n\n/\n Application-role grant / revocation on a `USERS` row.\n \n Carries BOTH the before and after arrays rather than only the delta: an auditor reconstructing a\n * principal's authority at a point in time needs the resulting set, and the delta alone cannot\n * distinguish \"granted a role they already held\" (a no-op) from a real widening. `requestedRoles`\n * is what the administrator ASKED for — for an additive grant it is the delta, for a whole-array\n * rewrite through the core UPDATE it is the full authored set — which is also exactly the set the\n * role-ceiling gate measured, so the record shows what was checked, not just what resulted.\n \n `reason` is the administrator's free-text justification where the operation collects one\n * (`assign_roles` / `revoke_roles`); the core UPDATE path has no such field and omits it.\n /\nexport const AuditableEvent_User_AppRolesChangedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_APP_ROLES_CHANGED),\n /* The user whose authority changed — the SUBJECT, not the actor. /\n userId: z.string(),\n previousRoles: z.array(z.string()),\n newRoles: z.array(z.string()),\n /* The roles as AUTHORED by the caller (the set the role-ceiling gate was measured against). /\n requestedRoles: z.array(z.string()),\n /* Which write path produced the change — the operation identifier (`assign_roles`, `update`, …). /\n operation: z.string(),\n changedBy: z.string(),\n reason: z.string().optional(),\n});\n\n/\n The application has no administratively usable super-administrator.\n \n Emitted by the startup floor report, not by a write path — every write that could REACH this state\n * refuses instead, so an emission here is evidence the state arrived outside the guarded paths.\n \n `conferringRoles` is recorded because the answer depends on the LIVE role table: an application\n * that renames or drops a custom role carrying `inheritFrom: APP_ADMIN_SUPER_ADMIN` can breach the\n * floor without any user row changing, and an auditor reading the event a month later cannot\n * reconstruct which roles counted at boot without it.\n /\nexport const AuditableEvent_Application_SuperAdminFloorBreachedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.APPLICATION_SUPER_ADMIN_FLOOR_BREACHED),\n /* How many administratively usable super-administrators were found (expected: 0 when emitted). /\n usableSuperAdminCount: z.number(),\n /* The minimum the floor requires. /\n requiredUsableSuperAdminCount: z.number(),\n /* The role keys that conferred super-admin at boot, resolved from the live application role table. /\n conferringRoles: z.array(z.string()),\n /* The user statuses that counted as administratively usable. /\n usableStatuses: z.array(z.string()),\n});\n\n/\n A tenant left unadministrable by an allowed action.\n \n Carries the tenant, the memberships that stopped counting, and WHY the action was permitted, so an\n * auditor can tell a deliberate containment decision from an accident. `remainingUsableOwners` is\n * recorded rather than assumed zero: the floor's minimum is configurable, and an event that hard-codes\n * the consequence cannot be re-read against a changed policy.\n /\n/\n HOW a tenant's owner-floor breach came to be known.\n \n The two answers mean genuinely different things to whoever reads the record, and a reader cannot\n * tell them apart from the rest of the payload — which is why this is a named member rather than an\n * inference from whether the action fields happen to be present.\n \n The event type stays SINGLE across both, deliberately. The fact recorded is \"this tenant has no\n * administratively usable owner\", and that is the query an operator needs to be one query: splitting\n * it in two would mean a breach is missed by whichever half somebody alerts on.\n /\nexport enum AdministrativeContinuityBreachDetection {\n /\n A guarded lifecycle write was ALLOWED through and stranded the tenant.\n \n The permissive branch is deliberate — refusing a suspension would mean an operator cannot lock\n * out a compromised owner without first transferring ownership using the tenant the attacker\n * controls — so this record IS the control that makes the trade acceptable. The action fields are\n * populated here, because there is an action to name.\n /\n ALLOWED_LIFECYCLE_ACTION = 'allowed_lifecycle_action',\n /\n The boot report found the tenant ALREADY stranded, by a route no guard ever saw: a direct\n * database edit, a restore from a backup taken mid-erasure, a seed that authored no owner, or a\n * role-table change that redefined which roles confer ownership.\n \n There is no action to name, so the action fields are absent rather than filled with placeholders\n * — the same reading `logApplicationSuperAdminFloorBreached` takes for its missing `userId`.\n /\n BOOT_REPORT = 'boot_report',\n}\n\nexport const AuditableEvent_Organization_OwnerFloorBreachedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_OWNER_FLOOR_BREACHED),\n /* The tenant left with no administratively usable owner. /\n organizationId: z.string(),\n /\n WHICH observation produced this record. Required, so the compiler forces every emitter — present\n * and future — to say which; a reader cannot recover it from the payload, and guessing it from the\n * presence of the action fields would make an emitter's omission look like a boot observation.\n /\n detectedBy: z.enum(AdministrativeContinuityBreachDetection),\n /* How many usable owners remain (expected: 0 when emitted). /\n remainingUsableOwners: z.number(),\n /\n The owner-conferring memberships the action removed from the population.\n \n Absent under `BOOT_REPORT`: nothing was removed within sight of a guard, which is the whole\n * reason the boot report has to look.\n /\n reducedMemberIds: z.array(z.string()).optional(),\n /* The lifecycle verb that caused it — the operator-facing \"what did this\". Absent under `BOOT_REPORT`. /\n operationIdentifier: z.string().optional(),\n /* The subject whose deactivation triggered it. Absent under `BOOT_REPORT`. /\n subjectUserId: z.string().optional(),\n /\n The status the subject moved to, so a reader need not infer usability from the verb alone. Absent\n * under `BOOT_REPORT`.\n /\n subjectNextStatus: z.string().optional(),\n});\n\n// Organization Member Event Data Schemas\nexport const AuditableEvent_OrganizationMember_InvitedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_MEMBER_INVITED),\n organizationId: z.string(),\n invitedUserId: z.string(),\n invitedBy: z.string(),\n roles: z.array(z.string()),\n email: z.email().optional(),\n});\n\nexport const AuditableEvent_OrganizationMember_JoinedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_MEMBER_JOINED),\n organizationId: z.string(),\n userId: z.string(),\n roles: z.array(z.string()),\n invitationId: z.string().optional(),\n});\n\nexport const AuditableEvent_OrganizationMember_UpdatedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_MEMBER_UPDATED),\n organizationId: z.string(),\n memberId: z.string(),\n changes: z.record(z.string(), z.any()),\n});\n\n/\n Organization-wide role grant / revocation on an `ORGANIZATION_MEMBERS` row.\n \n The ORGANIZATIONS-scope twin of {@link AuditableEvent_User_AppRolesChangedEventDataSchema}, and it\n * carries the same before/after/requested triple for the same reasons: an auditor reconstructing a\n * principal's authority at a point in time needs the RESULTING set, and the delta alone cannot\n * distinguish \"granted a role they already held\" from a real widening.\n \n ## Why `requestedRoles` is not redundant with `newRoles` here\n \n It matters MORE on this resource than on the application twin. Membership CREATE runs the authored\n * roles through resolution before persisting them — an organization type's `defaultMemberRole` is\n * injected when the caller authored none — so \"what the administrator asked for\" and \"what the\n * member ended up holding\" genuinely differ on an ordinary invite. `requestedRoles` is also exactly\n * the set the role-ceiling gate measured, so the record shows what was CHECKED, not only what\n * resulted. It is optional because \"the caller authored no roles at all\" (policy supplied them) is a\n * different fact from \"the caller explicitly authored an empty array\", and collapsing the two would\n * lose the distinction the ceiling gate itself draws.\n \n ## Why both `memberId` and `userId`\n \n `memberId` addresses the MEMBERSHIP ROW that was written; `userId` is the SUBJECT PRINCIPAL whose\n * authority changed. \"What could this person do on date X\" is a question about the principal, and\n * answering it through the row id alone requires a join that a retention sweep may already have\n * removed. `AuditableEvent_OrganizationMember_RemovedEventDataSchema` carries the same pair for the\n * same reason. `userId` stays optional so a degenerate row still leaves the rest of the evidence\n * rather than suppressing the whole record.\n /\nexport const AuditableEvent_OrganizationMember_RoleChangedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_MEMBER_ROLE_CHANGED),\n /* Tenant the membership belongs to. /\n organizationId: z.string(),\n /* The membership ROW that was written. /\n memberId: z.string(),\n /* The SUBJECT principal whose authority changed — not the actor. /\n userId: z.string().optional(),\n previousRoles: z.array(z.string()),\n newRoles: z.array(z.string()),\n /* The roles as AUTHORED by the caller (the set the role-ceiling gate measured). Absent when the caller authored none. /\n requestedRoles: z.array(z.string()).optional(),\n /* Which write path produced the change — the operation identifier (`create`, `update`, …). /\n operation: z.string(),\n changedBy: z.string(),\n /\n The actor's stated reason, on the paths that REQUIRE one — today `grantOwnership`, the\n * platform-tier repair door that crosses into a tenant the caller is not a member of. There the\n * justification is the whole control: no downstream check can second-guess an operator acting\n * outside the tenant, so the record of WHY is what makes the crossing accountable. It was required\n * on the request and discarded at the service boundary until #593. Absent on `create` / `update`,\n * which collect none. Bounded by the request DTO (1000 characters).\n /\n justification: z.string().optional(),\n});\n\n/\n Per-unit role assignment on an `ORGANIZATION_UNIT_MEMBERS` row.\n \n The NARROWED twin of {@link AuditableEvent_OrganizationMember_RoleChangedEventDataSchema}. A unit\n * assignment confers authority inside ONE organization unit — `appendUnitScopedRoles` emits it into\n * `initiatorRoles` carrying an `organizationUnitId` discriminator, and every consumer that unions\n * those entries partitions on that field first. The narrowing is what makes it not tenant-wide; it\n * does not make it un-auditable, so the grant leaves evidence on the same terms.\n \n ## Why singular `role`, not an array\n \n `OrganizationUnitMember` persists ONE role per (unit, member) — that uniqueness is its business\n * key. Reshaping it into an array here purely to mirror the organization-wide twin would invent a\n * cardinality the resource does not have and invite a future reader to assume multiple unit roles\n * are representable.\n \n `previousRole` is absent on an initial assignment, which is the honest encoding of \"there was no\n * prior grant\" — distinct from a re-assignment away from a role that did exist.\n /\nexport const AuditableEvent_OrganizationUnitMember_RoleChangedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_UNIT_MEMBER_ROLE_CHANGED),\n /* Tenant the assignment belongs to. /\n organizationId: z.string().optional(),\n /* The unit the role is narrowed to — the discriminator that keeps this grant from reading as tenant-wide. /\n organizationUnitId: z.string().optional(),\n /* The assignment ROW that was written. /\n assignmentId: z.string(),\n /* The membership the assignment hangs off — the bridge to the SUBJECT principal. /\n organizationMemberId: z.string().optional(),\n /* Absent on an initial assignment: there was no prior grant to record. /\n previousRole: z.string().optional(),\n newRole: z.string(),\n /* The role as AUTHORED by the caller (the value the role-ceiling gate measured). /\n requestedRole: z.string().optional(),\n /* Which write path produced the change — the operation identifier (`create`, `update`). /\n operation: z.string(),\n changedBy: z.string(),\n});\n\n/\n Revocation of a per-unit role assignment — the closing half of\n * {@link AuditableEvent_OrganizationUnitMember_RoleChangedEventDataSchema}.\n \n ## Why AUTHORIZATION rather than ORG_MANAGEMENT, unlike `ORGANIZATION_MEMBER_REMOVED`\n \n Removing an organization MEMBER is primarily a directory action — the person leaves the tenant —\n * and the authority they lose is a consequence of that. An assignment row has no directory aspect\n * whatsoever: it exists only to confer a role, so deleting it IS the revocation, and it is the exact\n * counterpart of the CREATE that granted it. Classifying it as record-keeping would leave an\n * authorization-filtered trail in which unit privileges are granted and never removed.\n \n ## Why the revoked role is captured\n \n `revokedRole` is the single field that cannot be recovered after the fact: the row is hard-deleted,\n * so nothing else in the system can answer \"what authority did this person lose\". It is deliberately\n * NOT named `previousRole` — that would imply a successor role, and there is none.\n \n ## Coverage boundary\n \n Emitted on the DIRECT assignment DELETE — the targeted revocation an operator performs and an\n * auditor reviews. Cascade removals (deleting the parent membership, or the whole organization) run\n * through the raw repository, which by construction does not execute service custom implementations;\n * those are evidenced by their own parent event, because the semantic act there is losing the\n * membership or the tenant, not revoking one unit role.\n /\nexport const AuditableEvent_OrganizationUnitMember_RemovedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_UNIT_MEMBER_REMOVED),\n /* Tenant the assignment belonged to. /\n organizationId: z.string().optional(),\n /* The unit the revoked role was narrowed to. /\n organizationUnitId: z.string().optional(),\n /* The assignment ROW that was deleted. /\n assignmentId: z.string(),\n /* The membership the assignment hung off — the bridge to the subject principal. /\n organizationMemberId: z.string().optional(),\n /* The authority that was removed. Unrecoverable once the row is gone, which is why it is recorded here. /\n revokedRole: z.string().optional(),\n removedBy: z.string(),\n});\n\nexport const AuditableEvent_OrganizationMember_StatusChangedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_MEMBER_STATUS_CHANGED),\n organizationId: z.string(),\n memberId: z.string(),\n previousStatus: z.string(),\n newStatus: z.string(),\n changedBy: z.string(),\n reason: z.string().optional(),\n});\n\n/\n Removal of an organization membership — by administrative DELETE, or by cancelling a pending\n * invitation through REVOKE.\n \n ## Why one event covers both, distinguished by `operation`\n \n They are genuinely different administrative acts — removing someone who works here versus\n * withdrawing an invitation that was never accepted — and an auditor must never confuse them. But\n * they are the same KIND of act (a membership ceases to exist) and share every other field, so\n * splitting them into two event types would fragment \"how did this person's membership end?\" across\n * two queries for no gain. `operation` carries the distinction, and `previousStatus` carries the\n * state the row was actually in, which `operation` alone cannot give: DELETE accepts any\n * non-`INVITED` status, so ACTIVE, INACTIVE and SUSPENDED removals are otherwise indistinguishable.\n \n An `INVITED` membership confers NOTHING — `execution-context-creator` builds `initiatorRoles` only\n * from `ACTIVE` memberships — so a REVOKE removes no live authority. It is still recorded, because\n * withdrawing someone's pending access is a directory decision an access review needs to see, and\n * because `ORGANIZATION_MEMBER_INVITED` would otherwise stand unanswered.\n \n ## Why `roles` is captured\n \n The row is hard-deleted, so afterwards nothing in the system can answer \"what authority did this\n * person hold when they were removed\". Same reasoning — and same shape — as\n * `AuditableEvent_User_DeletedEventDataSchema.appRoles`. On a REVOKE it records what the invitee\n * WOULD have received on acceptance.\n \n ## Category\n \n Classified ORG_MANAGEMENT rather than AUTHORIZATION, unlike `ORGANIZATION_UNIT_MEMBER_REMOVED`:\n * removing a MEMBER is a directory-lifecycle action whose authority loss is a consequence, whereas a\n * unit assignment row exists only to confer a role. The `roles` field is what keeps the authority\n * question answerable from an ORG_MANAGEMENT record.\n /\nexport const AuditableEvent_OrganizationMember_RemovedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_MEMBER_REMOVED),\n organizationId: z.string(),\n /* The membership ROW that was deleted. /\n memberId: z.string(),\n /* The SUBJECT principal who lost the membership. /\n removedUserId: z.string(),\n /\n The organization-wide roles the membership carried. Unrecoverable once the row is gone.\n * On a REVOKE these were never in force — they are what acceptance would have conferred.\n /\n roles: z.array(z.string()).optional(),\n /\n The row's status at removal.\n \n Deliberately `z.string()` rather than the `OrganizationMemberStatus` enum, matching\n * `AuditableEvent_OrganizationMember_StatusChangedEventDataSchema`: an audit row is a historical\n * record that must stay readable after the vocabulary evolves, so the strictness belongs at the\n * PRODUCER (which assigns from the enum), not at the record.\n /\n previousStatus: z.string().optional(),\n /* Which path ended the membership — `delete` (a real member) or `revoke` (a pending invitation). /\n operation: z.string(),\n /\n The per-unit grants this removal took with it.\n \n `ORGANIZATION_UNIT_MEMBERS` is a composition child of the membership, so deleting the membership\n * cascades to every assignment — through the RAW REPOSITORY, below the service tier, where no\n * custom implementation runs and therefore no `ORGANIZATION_UNIT_MEMBER_REMOVED` can fire. Without\n * this field the trail would show each unit grant being made and never revoked: the assignment rows\n * are hard-deleted, so the lost authority is not reconstructible from data either.\n \n Carried here rather than emitted per row on purpose — one membership removal is ONE decision, and\n * a teardown that fans out into a dozen revocation events buries it. Captured in the DELETE prefix,\n * which is the last moment the assignments still exist.\n /\n revokedUnitAssignments: z.array(z.object({\n organizationUnitId: z.string(),\n role: z.string(),\n })).optional(),\n /\n Who ended the membership — a user id, or an {@link AuditActorSentinel}.\n \n ## Reading it: `operation: 'revoke'` has THREE causes, told apart HERE\n \n `operation` says a pending invitation ended; it does not say why. Three different acts produce\n * an identical `revoke`, and the distinction between them is exactly what an access review needs:\n \n \| Cause \| How to recognise it \|\n * \|---\|---\|\n * \| The invitee DECLINED \| `removedBy === removedUserId` — the subject is the actor \|\n * \| An administrator CANCELLED it \| `removedBy` is a real user id, and a different one \|\n * \| It EXPIRED unanswered \| `removedBy === AuditActorSentinel.SYSTEM` (the stale-invitation sweep) \|\n \n This is why the decline path supplies an on-behalf-of principal rather than running anonymously.\n * A decline necessarily executes under BORROWED authority — the invitee has no standing to revoke\n * an organization membership — and a borrowed-authority context carries no initiator user id, so\n * the actor previously resolved to `SYSTEM`: an active refusal and a silent expiry wrote\n * byte-identical rows. Recording the acting principal separates all three with no extra event type,\n * which is the same economy `operation` and `previousStatus` already buy above.\n \n A reader must therefore not treat `removedBy === SYSTEM` on a `revoke` as \"unknown actor\". It is\n * a positive statement that no human ended this invitation.\n /\n removedBy: z.string(),\n /\n The justification. Declared by REVOKE for exactly this purpose and supplied by an administrator\n * cancelling an invitation; on a decline it carries the invitee's optional reason, and the expiry\n * sweep supplies none. Absent, therefore, on most declines — do not read its absence as a cause.\n /\n reason: z.string().optional(),\n});\n\n// Organization Lifecycle Event Data Schemas\nexport const AuditableEvent_Organization_CreatedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_CREATED),\n organizationId: z.string(),\n name: z.string(),\n slug: z.string(),\n createdBy: z.string(),\n});\n\nexport const AuditableEvent_Organization_UpdatedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_UPDATED),\n organizationId: z.string(),\n changes: z.record(z.string(), z.any()),\n updatedBy: z.string(),\n});\n\n/\n WHY an organization was assigned the type it now carries, when no person chose it.\n \n A closed vocabulary, deliberately named rather than implied: the assignment is only defensible because the answer\n * was DERIVED, and a reader of the audit row must be able to see which derivation produced it without re-deriving\n * the application's configuration — or its membership rows — as they stood at that boot. The two members answer\n * from different evidence, which is exactly why a single \"derived\" value would not do: one is a fact about the\n * DECLARATION and stays true however the tenant changes, the other is a fact about the ORGANIZATION on one day.\n /\nexport enum OrganizationTypeAssignmentBasis {\n /\n The application declares exactly one organization type, so an organization whose type resolves to nothing —\n * none stored, or one the declaration no longer carries — can only be that type: it is the only policy the\n * application has. Nothing is guessed, and nothing about the organization was read.\n /\n SOLE_DECLARED_TYPE = 'sole_declared_type',\n /\n The application declares several organization types, and exactly one of them covers every user type held by\n * this organization's own members — so the others are types this organization cannot be. Nothing is guessed: it\n * is the coverage test the first-administrator organization's type is already derived by, asked of the members.\n \n Narrower than {@link SOLE_DECLARED_TYPE} in what it proves. It reports the answer for the membership as it\n * stood at that boot; an organization whose members later span two declared types would not derive again. That is\n * why the row records the basis rather than only the outcome — a reviewer asking \"could this have been wrong?\"\n * needs to know which question was answered.\n /\n MEMBER_USER_TYPES = 'member_user_types',\n /\n An operator promoted this organization to the one that OWNS the application, through\n * `organizations.promoteToOwnerOrganization` (#1054).\n \n The odd one out of the three, and deliberately kept in the same event rather than given its own.\n * What the event records is \"this organization's `type` changed, and here is what decided it\" — true\n * of all three — and an access reviewer asking \"how did this tenant come to be typed this way?\" must\n * find one row wherever the answer lies, not two events they have to know to look for separately.\n \n What differs is everything a derivation does not have: there IS an actor (the audit row carries\n * them, and {@link AuditableEvent_Organization_TypeAssignedEventData.justification} carries their\n * stated reason), the previous type is always present, and the decision was a human's. A row\n * carrying this basis is the only one on which `justification` may appear — the other two are\n * derivations, and a derivation has nothing to justify.\n /\n OPERATOR_PROMOTION = 'operator_promotion',\n}\n\n/\n An organization whose type resolved to nothing — none stored, or one no longer declared — was assigned one by the\n * engine at boot.\n \n ## Why this is its own event rather than an `ORGANIZATION_UPDATED`\n \n An organization's type is not a label. It decides which user types its members hold, which authentication\n * methods they may use, and which step-up policy applies to them — so assigning one changes what every member of\n * that tenant can do at sign-in. Folded into a generic `changes` map it would be an authentication-relevant\n * change with no actor, filed where an access review does not look.\n \n ## Who the actor is, per basis\n \n For the two DERIVATIONS there is none, and that is the point: organizations minted before the type was required\n * (the platform's own seeds, the first-administrator bootstrap) were typeless, and the engine repairs them before\n * the first read that would refuse them. `basis` is what makes that repair legible as a derivation instead of a\n * write nobody made, and those rows carry no `userId` because the application-scope repair has no initiator.\n \n For {@link OrganizationTypeAssignmentBasis.OPERATOR_PROMOTION} there IS one. It rides where every other\n * operator action's actor does — on the audit ROW, resolved from the execution context — rather than as a field\n * here, so an access review reads it the same way it reads a suspension or an ownership grant. What this schema\n * adds for that basis is the one thing the row cannot carry: the operator's stated REASON (`RESOURCE_OPERATION_PERFORMED`\n * carries no request payload, which is how `grantOwnership`'s required justification went unrecorded for months — #593).\n \n assurance-control: WILDO.AUDIT.SECURITY_EVENT — an authentication-relevant attribute of a tenant changed, and the\n * record says what decided it and, when a person did, who and why.\n /\nexport const AuditableEvent_Organization_TypeAssignedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_TYPE_ASSIGNED),\n organizationId: z.string(),\n /* The declared organization type now stored on the row, shown as its word (`system_enums.OrganizationType.<type>`). /\n organizationType: z.string().systemEnum(ApplicationConfigVocabulary.ORGANIZATION_TYPE),\n /\n The type the row stored before, when it stored one the configuration no longer declares. Absent for an organization\n * that had no type. Recorded because this assignment REPLACES a value someone once chose: a type removed from the\n * declaration by mistake is recovered from exactly this field.\n /\n previousType: z.string().optional(),\n basis: z.enum(OrganizationTypeAssignmentBasis),\n /\n The operator's stated reason, on the ONE basis that has a person behind it —\n * {@link OrganizationTypeAssignmentBasis.OPERATOR_PROMOTION}, whose `requestDto` requires it.\n \n Optional on the schema because the two derivation bases have nothing to justify: a required field\n * would force the boot repair to invent a sentence, and an invented justification is worse than an\n * absent one — it reads as a decision somebody made.\n \n Recorded HERE rather than left on the request because a required field nothing stores is a promise\n * nobody keeps, and `RESOURCE_OPERATION_PERFORMED` (which the CRITICAL promotion also emits) carries\n * no request payload.\n /\n justification: z.string().optional(),\n});\n\nexport const AuditableEvent_Organization_DeletedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_DELETED),\n organizationId: z.string(),\n name: z.string(),\n slug: z.string(),\n deletedBy: z.string(),\n reason: z.string().optional(),\n});\n\n/\n A tenant was MARKED for deletion — the soft-delete half of tenant teardown.\n \n Kept SEPARATE from {@link AuditableEvent_Organization_DeletedEventDataSchema} rather than folded\n * into it with a flag, because the two record genuinely different facts and an auditor must not\n * have to infer which one happened. This event says the tenant's access was revoked and its data\n was scheduled for destruction; `ORGANIZATION_DELETED` says the data is gone. Between them sits\n a retention window in which the decision is still reversible, and a single merged event would\n * make \"was this tenant's data actually destroyed?\" unanswerable without correlating timestamps.\n \n It is also the evidence for the AUTHORIZATION consequence, which lands here and not at the purge:\n * user types revoked and tokens invalidated. `revokedUserTypeCount` records the blast radius of that\n * revocation without naming the users — the per-user detail belongs to the user-type events, and\n * duplicating identities into a tenant-scoped record would widen the personal data this row holds.\n \n assurance-control: WILDO.DATA.SECURE_LIFECYCLE — scheduling the destruction\n * of a tenant is a security-relevant, attributable decision that must leave evidence even when it\n * is later reversed.\n /\nexport const AuditableEvent_Organization_DeletionRequestedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_DELETION_REQUESTED),\n organizationId: z.string(),\n name: z.string(),\n slug: z.string(),\n /* The ACTOR. On the `admin` variant they are not a member of the tenant being marked. /\n requestedBy: z.string(),\n /* When the purge batch becomes allowed to destroy the tenant — the promise made to it. /\n purgeScheduledAt: z.string(),\n /* How many users lost at least one global `userTypes` grant as a result of the mark. /\n revokedUserTypeCount: z.number().int().min(0),\n reason: z.string().optional(),\n});\n\n/\n A pending tenant deletion was CANCELLED inside its retention window.\n \n The closing half of {@link AuditableEvent_Organization_DeletionRequestedEventDataSchema}. Without\n * it the audit trail records every scheduled destruction and none of the reversals, so a tenant\n * that was marked and restored a year ago still reads as pending destruction — and an access review\n * asking \"why does this tenant have live members again?\" has no answer on record.\n \n assurance-control: WILDO.ACCESS.LIFECYCLE — restoring access is as attributable as removing it.\n /\nexport const AuditableEvent_Organization_RestoredEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_RESTORED),\n organizationId: z.string(),\n name: z.string(),\n slug: z.string(),\n /* The ACTOR — always a platform super-administrator; a marked tenant cannot restore itself. /\n restoredBy: z.string(),\n /* The status the tenant was returned to. /\n restoredStatus: z.string(),\n /* How many users had at least one global `userTypes` grant re-granted by the restore. /\n regrantedUserTypeCount: z.number().int().min(0),\n reason: z.string().optional(),\n});\n\n/\n The tenant was administratively HALTED — every member loses their organization roles.\n \n ## Why this is its own event rather than an `ORGANIZATION_UPDATED`\n \n Suspension is not a field edit. Since the tenant-status authority gate shipped, `SUSPENDED` is a\n * state in which a membership confers NOTHING — so this single write revokes the access of every\n * member of the tenant at once. Folding that into the generic update event would bury an\n * organization-wide access revocation inside a `changes` map, exactly where an access review would\n * not look for it.\n \n `suspensionReason` is REQUIRED, mirroring the request contract, because the reason is the whole\n * evidentiary point: an auditor asking \"why was this tenant halted?\" must not get a shrug.\n * `notifiedMembers` records whether the tenant was told — a deliberately quiet suspension is a\n * legitimate operator choice and one a reviewer needs to be able to see.\n \n assurance-control: WILDO.AUDIT.SECURITY_EVENT — organization-wide access\n * revocation must be attributable, justified, and evidenced.\n /\nexport const AuditableEvent_Organization_SuspendedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_SUSPENDED),\n organizationId: z.string(),\n name: z.string(),\n slug: z.string(),\n /* The ACTOR — always a platform super-administrator; a tenant cannot suspend itself. /\n suspendedBy: z.string(),\n /* The status the tenant was halted FROM, so the transition is legible without a second lookup. /\n previousStatus: z.string(),\n suspensionReason: z.string(),\n /* Whether the tenant's members were emailed. A quiet suspension is a choice worth recording. /\n notifiedMembers: z.boolean(),\n /\n How many users lost at least one GLOBAL `userTypes` grant because this tenant stopped counting.\n \n A suspension does not only halt the tenant: a membership in a non-authority-conferring\n * organization no longer justifies a membership-derived global grant, so suspending an\n * organization can withdraw what it was vouching for platform-wide. That reach is exactly what an\n * access review needs to see, and it is invisible from the status change alone.\n /\n revokedUserTypeCount: z.number().int().min(0),\n});\n\n/\n A halted or expired tenant was returned to normal operation — the inverse of\n * {@link AuditableEvent_Organization_SuspendedEventDataSchema}.\n \n Restoring organization-wide access is as security-relevant as removing it, and without this event\n * the trail would record every suspension and none of the lifts — leaving a tenant that was halted\n * and reinstated a year ago still reading as suspended.\n \n `previousStatus` distinguishes the two journeys this operation serves: lifting a suspension\n * (`SUSPENDED`) and converting an expired trial (`TRIAL_EXPIRED`). They land on the same state and\n * are not the same event to a reviewer.\n \n assurance-control: WILDO.AUDIT.SECURITY_EVENT — reinstatement of access is attributable.\n /\nexport const AuditableEvent_Organization_ActivatedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_ACTIVATED),\n organizationId: z.string(),\n name: z.string(),\n slug: z.string(),\n /* The ACTOR — always a platform super-administrator. /\n activatedBy: z.string(),\n /* `SUSPENDED` (a lift) or `TRIAL_EXPIRED` (a conversion) — not the same journey. /\n previousStatus: z.string(),\n /* How many users had at least one global `userTypes` grant restored by the reactivation. /\n regrantedUserTypeCount: z.number().int().min(0),\n reason: z.string().optional(),\n});\n\n/\n One user type's authentication-policy snapshot — the COMPLETE authored `UserTypeAuthPolicy` (MFA,\n * password, lockout, enabled auth methods, step-up, session duration, …) as recorded in the trail.\n \n The whole policy is captured, not a hand-picked subset, so no posture axis escapes the record: a\n * weakening is as easily \"disable the MFA auth method\" (`authMethodsEnabled`) or \"drop step-up\"\n * (`stepUpAuth`) as \"turn `requireMFA` off\". The policy carries only booleans / numbers / enums —\n * never a secret — so recording it verbatim discloses nothing sensitive.\n \n Deliberately STRUCTURAL (an open record) rather than a reference to the live `UserTypeAuthPolicy`\n * config schema. An audit record is a historical fact: it must keep validating after the config\n * schema evolves, so it stores the policy as it was at that boot rather than re-validating it against\n * today's shape. The queryable summary lives in `changedUserTypes` + `snapshotDigest`; this object\n * carries the human-readable before/after detail.\n /\nexport const ApplicationAuthPolicySnapshotSchema = z.record(z.string(), z.unknown());\n\n/\n The application's authored authentication or audit-viewer admission policy changed between two boots.\n \n The per-user-type authentication policy (`userTypes.<type>.auth` — MFA, password, and lockout\n * requirements) is STATIC application configuration authored in code and taken into effect at backend\n * startup. A change to it — most consequentially a WEAKENING such as turning MFA off — is a\n * security-posture decision that, before this event, left no product-side record: only the source\n * history showed it. This event closes that gap. The effective `auditTrail.applicationReadAccess`\n * posture is recorded separately from the user-type snapshots and compared independently.\n \n It is emitted at boot, by the system, when the resolved policy snapshot differs from the last one\n * recorded in the trail (detected by comparing against the most recent event of this type for the\n * application). Because there is no human actor at boot, the \"who\" is the deployment/source history;\n * the event records WHAT changed (before → after per user type) so a reviewer sees the posture shift\n * without reading the codebase.\n \n Scope note: this is the per-application AUTHORED baseline. It does NOT enumerate per-tenant\n * `authOverrides` (which are per-(user-type × org-type) and require live tenants to resolve), nor the\n * authenticate-time `FALLBACK_AUTH_POLICY` (a runtime substitute used only when no user type\n * resolves, not authored config).\n \n assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — a change to the authentication assurance\n * requirements (MFA / password / lockout) must be attributable and evidenced.\n /\nexport const AuditableEvent_ApplicationAuthPolicyChanged_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.APPLICATION_AUTH_POLICY_CHANGED),\n // The owning application identity lives on the audit row, resolved by the shared writer before\n // database/SIEM/immutable-sink fanout. It is not duplicated inside this policy payload.\n /* Which user types' policies differed. Sorted; empty when only the audit-viewer access posture changed. /\n changedUserTypes: z.array(z.string()),\n /\n A stable digest of the `after` snapshot. Boot change-detection compares the current digest\n * against the digest carried by the most recent recorded event of this type; equal digests are the\n * authentication-policy comparison. Audit-viewer access is compared independently; equal digests\n * alone do not suppress an access-policy change.\n /\n snapshotDigest: z.string(),\n /\n The previously-recorded per-user-type policy snapshot, or `null` when this is the first snapshot\n * ever recorded for the application (the baseline row). Keys are user-type identifiers.\n /\n before: z.record(z.string(), ApplicationAuthPolicySnapshotSchema).nullable(),\n /* The per-user-type policy snapshot that took effect at this boot. Keys are user-type identifiers. /\n after: z.record(z.string(), ApplicationAuthPolicySnapshotSchema),\n /\n Effective audit-viewer access posture, separately typed from authentication user types.\n * Absent on historical events predating this evidence. A null before means no prior recorded\n * policy is known, not that an earlier deployment was strict or role based.\n /\n auditApplicationReadAccess: z.object({\n before: z.enum(AuditApplicationReadAccess).nullable(),\n after: z.enum(AuditApplicationReadAccess),\n }).optional(),\n});\n\n/\n A governed lifecycle transition changed a subject's `status`.\n \n Emitted by the shared status-transition implementation, so every verb it serves is trailed by\n * construction and a future one inherits the trail rather than having to remember it. Before this\n * existed those verbs emitted NOTHING: suspending a member (CRITICAL) or a user (HIGH) left no\n * record at all, while suspending a TENANT was fully attributable — an asymmetry an access review\n * would have to discover the hard way.\n \n `reason` is where the verbs' long-declared `reason` / `suspensionReason` fields finally land.\n * They are not persisted on the row: a suspension reason is a compliance artefact nothing reads\n * back, so the trail is its home rather than a schema column that would have to be scrubbed on\n * erasure.\n \n assurance-control: WILDO.AUDIT.SECURITY_EVENT — a change to whether a principal may act must be\n * attributable, justified and evidenced, on every resource that has such a state.\n /\nexport const AuditableEvent_Resource_StatusTransitionPerformedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.RESOURCE_STATUS_TRANSITION_PERFORMED),\n /* Which resource the subject row belongs to — half of the verb discriminator. /\n resourceType: z.string(),\n /* The lifecycle verb that ran (`suspend`, `reactivate`, `suspend_user`, …). /\n operationIdentifier: z.string(),\n /* The row whose status changed. /\n subjectId: z.string(),\n /* The ACTOR who performed it, or the system principal when the reactivation sweep ran it. /\n performedBy: z.string(),\n /* The status transitioned FROM, so the change is legible without a second lookup. /\n previousStatus: z.string(),\n /* The status transitioned TO. /\n newStatus: z.string(),\n /* The caller's justification, where the verb's contract accepts one. /\n reason: z.string().optional(),\n /\n When an automated sweep will undo this, if the caller time-boxed it. ISO-8601.\n \n Recorded because \"suspended for 7 days\" and \"suspended indefinitely\" are materially different\n * decisions that would otherwise be indistinguishable in the trail.\n /\n scheduledReactivationAt: z.string().optional(),\n /* Present when the subject is tenant-scoped, so the trail routes to that tenant's SIEM. /\n organizationId: z.string().optional(),\n});\n\nexport const AuditableEvent_OrganizationNotifications_UpdatedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_NOTIFICATIONS_UPDATED),\n organizationId: z.string(),\n notificationsId: z.string(),\n changes: z.record(z.string(), z.any()),\n updatedBy: z.string(),\n});\n\nexport const AuditableEvent_OrganizationPreferences_UpdatedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_PREFERENCES_UPDATED),\n organizationId: z.string(),\n preferencesId: z.string(),\n changes: z.record(z.string(), z.any()),\n updatedBy: z.string(),\n});\n\nexport const AuditableEvent_OrganizationProfile_UpdatedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_PROFILE_UPDATED),\n organizationId: z.string(),\n profileId: z.string(),\n changes: z.record(z.string(), z.any()),\n updatedBy: z.string(),\n});\n\nexport const AuditableEvent_OrganizationUnit_UpdatedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_UNIT_UPDATED),\n organizationId: z.string(),\n unitId: z.string(),\n changes: z.record(z.string(), z.any()),\n updatedBy: z.string(),\n});\n\n// SSO Authentication Event Data Schemas\n\nexport const AuditableEvent_User_SSOLoginEventDataSchema = z.object({\n assurance: ExternalAssuranceAssessmentSchema.optional(),\n eventType: z.literal(CoreAuditableEventType.USER_SSO_LOGIN),\n userId: z.string(),\n email: z.email(),\n providerRef: z.string(),\n connectionType: z.enum(SsoConnectionType),\n authSource: z.string().optional(),\n scopeType: z.enum(AuthScopeType).optional(),\n organizationId: z.string().optional(),\n applicationId: z.string().optional(),\n ipAddress: z.string(),\n userAgent: z.string(),\n sessionId: z.string(),\n}).superRefine((event, ctx) => {\n if (event.connectionType === SsoConnectionType.SOCIAL) {\n if (\n event.scopeType !== undefined\n \|\| event.organizationId !== undefined\n \|\| event.applicationId !== undefined\n ) {\n ctx.addIssue({\n code: 'custom',\n path: ['scopeType'],\n message: 'Social SSO audit events must not carry enterprise scope',\n });\n }\n return;\n }\n\n const hasOrganizationScope =\n event.scopeType === AuthScopeType.ORGANIZATION\n && event.organizationId !== undefined\n && event.applicationId === undefined;\n const hasApplicationScope =\n event.scopeType === AuthScopeType.APPLICATION\n && event.applicationId !== undefined\n && event.organizationId === undefined;\n if (!hasOrganizationScope && !hasApplicationScope) {\n ctx.addIssue({\n code: 'custom',\n path: ['scopeType'],\n message: 'Enterprise SSO audit events require exactly one explicit tenant scope',\n });\n }\n});\n\nexport const AuditableEvent_User_SSOLoginFailedEventDataSchema = z.object({\n assurance: ExternalAssuranceAssessmentSchema.optional(),\n eventType: z.literal(CoreAuditableEventType.USER_SSO_LOGIN_FAILED),\n email: z.email().optional(),\n providerRef: z.string().optional(),\n connectionType: z.enum(SsoConnectionType).optional(),\n authSource: z.string().optional(),\n failureReason: z.string(),\n scopeType: z.enum(AuthScopeType).optional(),\n organizationId: z.string().optional(),\n applicationId: z.string().optional(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n/\n A sign-in was refused because the claiming scope requires SSO (#1242).\n \n `organizationId` was REQUIRED here, and that is what made the event unemittable at half its own\n * refusal sites: `enforcement.requireSSO` lives on the POLYMORPHIC SSO config, so an APPLICATION-scope\n * policy refuses sign-ins for the application itself and there is no organization to name. Requiring\n * one would have left exactly those refusals with no trail — the outcome this CRITICAL event exists to\n * prevent. It now carries either scope and refuses anything but exactly one, following\n * `EMERGENCY_ACCESS_USED`, which was widened for the same reason on the same config.\n \n `attemptedProviderRef` and `attemptedConnectionType` are OPTIONAL because two of the four refusal\n * sites have no attempted provider at all: a password sign-in and a registration are refused BECAUSE\n * no SSO was attempted. Requiring them would have forced a placeholder, and a placeholder in an\n * audit row is worse than an absent field — it is a fact nobody can distinguish from a real one.\n /\nexport const AuditableEvent_User_SSOEnforcementBlockedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_SSO_ENFORCEMENT_BLOCKED),\n email: z.email(),\n attemptedProviderRef: z.string().optional(),\n attemptedConnectionType: z.enum(SsoConnectionType).optional(),\n scopeType: z.enum(AuthScopeType),\n organizationId: z.string().optional(),\n applicationId: z.string().optional(),\n enforcementPolicy: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n}).superRefine((event, ctx) => {\n const hasOrganizationScope =\n event.scopeType === AuthScopeType.ORGANIZATION\n && event.organizationId !== undefined\n && event.applicationId === undefined;\n const hasApplicationScope =\n event.scopeType === AuthScopeType.APPLICATION\n && event.applicationId !== undefined\n && event.organizationId === undefined;\n if (!hasOrganizationScope && !hasApplicationScope) {\n ctx.addIssue({\n code: 'custom',\n path: ['scopeType'],\n message: 'SSO-enforcement-blocked events require exactly one explicit tenant scope',\n });\n }\n});\n\nexport const AuditableEvent_User_TokenRefreshedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_TOKEN_REFRESHED),\n userId: z.string(),\n sessionId: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n// Organization Security Management Event Data Schemas\n\nexport const AuditableEvent_Organization_SSOConfigurationChangedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_SSO_CONFIGURATION_CHANGED),\n organizationId: z.string(),\n changedBy: z.string(),\n changeType: z.enum(SsoConfigChangeType),\n affectedProviderRef: z.string().optional(),\n changes: z.record(z.string(), z.any()).optional(),\n});\n\n\n\n/\n The fields every SIEM export-configuration event carries; three kinds share them (#986) and differ\n * only in what they SAY happened, which is what a SIEM rule keys on.\n /\nconst SIEM_EXPORT_CONFIGURATION_EVENT_FIELDS = {\n organizationId: z.string(),\n changedBy: z.string(),\n changeType: z.enum(SiemExportChangeType),\n /* The destination HOST only — a collector secret can live in the URL path, and this row is immutable. /\n webhookUrlDomain: z.string().optional(),\n eventFormatConfigured: z.string().optional(),\n /* NAMES of the configuration fields the write changed; never their values (the credential is among them). /\n changedFields: z.array(z.string()).optional(),\n} as const;\n\nexport const AuditableEvent_Organization_SIEMExportConfiguredEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_SIEM_EXPORT_CONFIGURED),\n ...SIEM_EXPORT_CONFIGURATION_EVENT_FIELDS,\n});\n\n/* Export turned OFF (#986). Same fields; its own kind so it classifies CRITICAL. /\nexport const AuditableEvent_Organization_SIEMExportDisabledEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_SIEM_EXPORT_DISABLED),\n ...SIEM_EXPORT_CONFIGURATION_EVENT_FIELDS,\n});\n\n/* Export re-pointed at another destination (#986). Same fields; its own kind so it classifies WARNING. /\nexport const AuditableEvent_Organization_SIEMExportDestinationChangedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_SIEM_EXPORT_DESTINATION_CHANGED),\n ...SIEM_EXPORT_CONFIGURATION_EVENT_FIELDS,\n});\n\n\n\n// Organization Provider Credential Event Data Schemas\n//\n// ## The value is absent by CONSTRUCTION\n//\n// Every field below is an identifier, a timestamp, a closed vocabulary or a count. There is no\n// free-text field an implementation could put a secret in by accident, and no `changes` /\n// `metadata` record — the shape the SSO event uses (`z.record(z.string(), z.any())`) is exactly\n// what a credential event must not have, because an audit row is replicated to the organization's\n// SIEM and to the immutable store, and neither can be edited afterwards.\n//\n// ## Why a provider ref and a slug, and nothing about the value\n//\n// A reader needs to know WHICH authority moved. `connectionRef` + `secretSlug` say that completely — the\n// stored credential's key (#1670) — and `providerRef` says which ref the act went through.\n// A fingerprint of the value was considered and rejected: it is a stable oracle for confirming a\n// guessed secret, so it would put a verification oracle into the one store designed never to\n// forget.\n\n/\n A tenant granted this application authority to act as it toward a third party.\n \n assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — organization authorizes delegated\n * access to a named third party.\n /\nexport const AuditableEvent_OrganizationProviderCredential_SetEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_SET),\n organizationId: z.string(),\n providerRef: z.string(),\n /\n The CONNECTION the credential belongs to (#1670) — the row's key and what its seal binds. `providerRef`\n * beside it names the ref the act went through (or, on a write, the ref that created the row); the two\n * differ once several refs of one vendor share a connection (#1725). Optional only because rows written\n * before #1670 in the immutable trail do not carry it; every emitter since sets it.\n /\n connectionRef: z.string().optional(),\n secretSlug: z.string(),\n /* The acting administrator. Absent only on a system-initiated write, which none exists today. /\n setBy: z.string().optional(),\n credentialId: z.string(),\n});\n\n/\n The stored VALUE changed for a credential that already existed.\n \n Separate from `_SET` because rotation is the response to a suspected compromise, and \"was this\n * rotated after the incident?\" must be answerable without reading every configuration edit.\n \n assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — the delegated authority's secret is\n * replaced.\n /\nexport const AuditableEvent_OrganizationProviderCredential_RotatedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_ROTATED),\n organizationId: z.string(),\n providerRef: z.string(),\n /\n The CONNECTION the credential belongs to (#1670) — the row's key and what its seal binds. `providerRef`\n * beside it names the ref the act went through (or, on a write, the ref that created the row); the two\n * differ once several refs of one vendor share a connection (#1725). Optional only because rows written\n * before #1670 in the immutable trail do not carry it; every emitter since sets it.\n /\n connectionRef: z.string().optional(),\n secretSlug: z.string(),\n rotatedBy: z.string().optional(),\n credentialId: z.string(),\n /* When the value it replaced was set — how long the retired secret was live. /\n previousSecretSetAt: z.string().optional(),\n});\n\n/\n The credential was RESOLVED for an outbound call — the application acted as the tenant.\n \n The highest-volume of the four and the one that makes the other three worth having: without a\n * use event, a leaked credential's exploitation is invisible and only its configuration is\n * recorded. `resolvedFrom` distinguishes a tenant's own credential from the deployment-wide\n * environment fallback, which is precisely the distinction this whole resource exists to make\n * visible — a tenant silently acting as the shared principal is the defect, and here it is a\n * value in a field rather than something nobody can see.\n \n assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — delegated authority is exercised.\n /\nexport const AuditableEvent_OrganizationProviderCredential_UsedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_USED),\n organizationId: z.string(),\n providerRef: z.string(),\n /\n The CONNECTION the credential belongs to (#1670) — the row's key and what its seal binds. `providerRef`\n * beside it names the ref the act went through (or, on a write, the ref that created the row); the two\n * differ once several refs of one vendor share a connection (#1725). Optional only because rows written\n * before #1670 in the immutable trail do not carry it; every emitter since sets it.\n /\n connectionRef: z.string().optional(),\n /\n The npm package that owns the ref the grant was spent or granted through (#1725). On a shared connection several\n * refs — from several packages — spend one grant, so the connection alone does not say whose code acted.\n /\n providerPackageName: z.string().optional(),\n secretSlug: z.string(),\n resolvedFrom: z.enum(ProviderCredentialResolutionSource),\n /* Absent when `resolvedFrom` is the deployment environment — there is no row to name. /\n credentialId: z.string().optional(),\n /\n WHOSE credential was spent: the member who set it. For a USER-delegated organization connection\n * that is the person whose own vendor account every member's call acts through — the vendor\n * attributes the act to them, so the trail must too (decision on wildo-ai/wildo-ai#18). Absent for\n * a deployment-environment resolution, and for a row set with no recorded member.\n /\n credentialSetByUserId: z.string().optional(),\n});\n\n/\n The grant ended — by the tenant removing it, or by the tenant itself being purged.\n \n `reason` separates the two, because \"the credential is gone\" means different things to an\n * incident reviewer depending on whether a human revoked it or a cascade removed it.\n \n assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — evidence that delegated authority\n * was withdrawn.\n /\nexport const AuditableEvent_OrganizationProviderCredential_DeletedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_DELETED),\n organizationId: z.string(),\n providerRef: z.string(),\n /\n The CONNECTION the credential belongs to (#1670) — the row's key and what its seal binds. `providerRef`\n * beside it names the ref the act went through (or, on a write, the ref that created the row); the two\n * differ once several refs of one vendor share a connection (#1725). Optional only because rows written\n * before #1670 in the immutable trail do not carry it; every emitter since sets it.\n /\n connectionRef: z.string().optional(),\n secretSlug: z.string(),\n deletedBy: z.string().optional(),\n credentialId: z.string(),\n reason: z.enum(ProviderCredentialDeletionReason),\n /\n What telling the VENDOR achieved, when the delete ended an OAuth2 grant (#545).\n \n Deleting our copy stops the application using a token; it does not end the grant at the vendor,\n * and a refresh token frequently never expires on its own. So this field is the difference between\n * a trail that says \"we deleted our copy\" and one that says whether the person's access was\n * actually withdrawn where it lives.\n \n Written by EVERY door that destroys a credential: the revoke doors (#545), and since #1711 the\n * cascade observers for a subject erasure, a hard delete of the user row, the invitation sweep and an\n * organization purge — each reads the token out of the pre-deletion row the cascade hands over. ABSENT\n * only on a row written before #1711, when the cascades attempted nothing. `not_declared` is the\n * ordinary answer for a vendor whose revocation is not RFC 7009-shaped, and for a pasted credential that\n * was never a grant; it is a recorded fact, not a failure. There is no retry: the token existed only in\n * the destroyed row, so this value is the whole record.\n /\n vendorRevocation: z.enum(ProviderOAuth2RevocationOutcomeValues).optional(),\n});\n\n/\n A PERSON connected their own account at a third party to this application.\n \n The organization's four events say \"this tenant authorized the application\". These four say \"this\n * individual did\", and the difference is not cosmetic: the vendor will attribute every resulting act\n * to that person's account, so the trail that answers \"who authorized this\" has to name them.\n \n `userId` is the subject, not the actor, and the two are the same here BY CONSTRUCTION — the\n * resource admits no administrative variant, so nobody but the holder can write one of these rows.\n * That is why there is no `setBy`: an organization credential needs one because several\n * administrators can write the tenant's row, and a person's own credential has exactly one possible\n * author. A `setBy` that could only ever repeat `userId` would invite a future reader to believe the\n * two can differ.\n \n assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — a user authorizes third-party\n * delegated access.\n /\nexport const AuditableEvent_UserProviderCredential_SetEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_SET),\n userId: z.string(),\n providerRef: z.string(),\n /\n The CONNECTION the credential belongs to (#1670) — the row's key and what its seal binds. `providerRef`\n * beside it names the ref the act went through (or, on a write, the ref that created the row); the two\n * differ once several refs of one vendor share a connection (#1725). Optional only because rows written\n * before #1670 in the immutable trail do not carry it; every emitter since sets it.\n /\n connectionRef: z.string().optional(),\n secretSlug: z.string(),\n credentialId: z.string(),\n});\n\n/\n A PERSON completed a consent ceremony at a vendor and this application now holds their grant.\n \n The subject and the actor are the same by construction — the resource admits no administrative\n * variant, and the connect leg refuses any owner but the caller — so there is no `grantedBy`.\n \n `grantedScopes` is what the VENDOR said it issued, not what was asked for. The two differ often\n * enough to matter: a vendor may narrow a request against what the account is permitted, and the\n * answer to \"what could this application actually do as them\" is the granted set. Since #1671 it is the\n * set the stored grant RECORDS after this authorization: a token answer without `scope` granted what was\n * requested (RFC 6749 §5.1), and a re-authorization of a vendor that accumulates consent unites the new\n * answer with the previous consent (`consentAccumulated`). Optional because a grant may record none, and an\n * empty array would assert something stronger than silence.\n * spec-cite: RFC 6749 §5.1 (the `scope` row of the access token response).\n \n assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — a user authorizes third-party\n * delegated access, and the authorization's extent is recorded with it.\n /\nexport const AuditableEvent_UserProviderConnection_GrantedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_PROVIDER_CONNECTION_GRANTED),\n userId: z.string(),\n providerRef: z.string(),\n /\n The CONNECTION the credential belongs to (#1670) — the row's key and what its seal binds. `providerRef`\n * beside it names the ref the act went through (or, on a write, the ref that created the row); the two\n * differ once several refs of one vendor share a connection (#1725). Optional only because rows written\n * before #1670 in the immutable trail do not carry it; every emitter since sets it.\n /\n connectionRef: z.string().optional(),\n /\n The npm package that owns the ref the grant was spent or granted through (#1725). On a shared connection several\n * refs — from several packages — spend one grant, so the connection alone does not say whose code acted.\n /\n providerPackageName: z.string().optional(),\n secretSlug: z.string(),\n credentialId: z.string(),\n grantedScopes: z.array(z.string()).optional(),\n /\n WHICH account at the vendor — a workspace, a tenant, a directory. Never a secret, and the answer\n * to a question the row alone cannot settle: two people connecting the same provider may be\n * granting access to entirely different organizations of that vendor.\n /\n accountRef: z.string().optional(),\n /\n Whether this replaced a connection that already existed.\n \n A first connection and a re-authorization look identical in the row afterwards, and they are not\n * the same event to an auditor: a re-authorization frequently follows a revocation at the vendor,\n * which is exactly the sequence worth being able to see.\n /\n replacedExistingConnection: z.boolean(),\n /\n Present when this authorization GREW an existing grant (#1671): the scopes the re-authorization was started to\n * add, the operation whose refusal offered it and the package whose code that operation is (an opted-in\n * augmentation's, or the ref's own). `addedForOperationId` is as the start request named it; the scopes were\n * checked against the connection's ceiling. `consentAccumulated` says whether the stored granted set was united\n * with the previous consent (a vendor that accumulates consent) or replaced by a restated authorization.\n /\n addedScopes: z.array(z.string()).optional(),\n addedForOperationId: z.string().optional(),\n addedForPackageName: z.string().optional(),\n consentAccumulated: z.boolean().optional(),\n});\n\n/\n An ORGANIZATION's delegated authorization toward a vendor was granted.\n \n Mirrors the person's event and is deliberately not the same event with a nullable user: the\n * subject is a tenant, the SIEM routing is the tenant's, and the data-protection reading differs —\n * a tenant's shared integration is not anybody's personal connection.\n \n `grantedByUserId` exists here and not on the user's, for the reason the `_SET` pair already\n * records: several administrators can authorize on a tenant's behalf, so WHO did is a real question.\n \n assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — an organization authorizes this\n * application to act as it toward a named third party.\n /\nexport const AuditableEvent_OrganizationProviderConnection_GrantedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_PROVIDER_CONNECTION_GRANTED),\n organizationId: z.string(),\n providerRef: z.string(),\n /\n The CONNECTION the credential belongs to (#1670) — the row's key and what its seal binds. `providerRef`\n * beside it names the ref the act went through (or, on a write, the ref that created the row); the two\n * differ once several refs of one vendor share a connection (#1725). Optional only because rows written\n * before #1670 in the immutable trail do not carry it; every emitter since sets it.\n /\n connectionRef: z.string().optional(),\n /\n The npm package that owns the ref the grant was spent or granted through (#1725). On a shared connection several\n * refs — from several packages — spend one grant, so the connection alone does not say whose code acted.\n /\n providerPackageName: z.string().optional(),\n secretSlug: z.string(),\n credentialId: z.string(),\n grantedByUserId: z.string().optional(),\n grantedScopes: z.array(z.string()).optional(),\n accountRef: z.string().optional(),\n replacedExistingConnection: z.boolean(),\n /\n On whose behalf the linked account acts. `user` means `grantedByUserId` linked THEIR OWN vendor\n * account for the organization, and every member's call will act through it (decision on\n * wildo-ai/wildo-ai#18) — which is why the grantor is named and the acknowledgement below recorded.\n /\n delegation: z.enum(ExternalProvider_Connection_DelegationMode).optional(),\n /* The grantor acknowledged, before consenting at the vendor, that the whole organization will use their account. /\n organizationWideUseAcknowledged: z.boolean().optional(),\n /* See the person's event: the re-authorization that grew the grant (#1671). /\n addedScopes: z.array(z.string()).optional(),\n addedForOperationId: z.string().optional(),\n addedForPackageName: z.string().optional(),\n consentAccumulated: z.boolean().optional(),\n});\n\n/\n The stored VALUE changed for a person's credential that already existed.\n \n Separate from `_SET` for the organization's reason — rotation answers \"was this replaced after the\n * incident?\" — and for one that is specific to a person: a credential someone rotates on their own\n * initiative is often the first evidence that they believe their vendor account was compromised.\n \n assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — the delegated authority's secret is\n * replaced.\n /\nexport const AuditableEvent_UserProviderCredential_RotatedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_ROTATED),\n userId: z.string(),\n providerRef: z.string(),\n /\n The CONNECTION the credential belongs to (#1670) — the row's key and what its seal binds. `providerRef`\n * beside it names the ref the act went through (or, on a write, the ref that created the row); the two\n * differ once several refs of one vendor share a connection (#1725). Optional only because rows written\n * before #1670 in the immutable trail do not carry it; every emitter since sets it.\n /\n connectionRef: z.string().optional(),\n secretSlug: z.string(),\n credentialId: z.string(),\n /* When the value it replaced was set — how long the retired secret was live. /\n previousSecretSetAt: z.string().optional(),\n});\n\n/\n The credential was RESOLVED for an outbound call — the application acted as that person.\n \n `resolvedFrom` is present for symmetry with the organization event but carries a narrower range:\n * a person's credential has NO fallback, because substituting the deployment's shared principal for\n * someone's own account would attribute the act to the wrong party at the vendor — the very\n * substitution the whole scope triangle exists to forbid. So this field reads\n * `USER_CREDENTIAL` on every event, and a reviewer seeing anything else is looking at a defect.\n \n assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — delegated authority is exercised.\n /\nexport const AuditableEvent_UserProviderCredential_UsedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_USED),\n userId: z.string(),\n providerRef: z.string(),\n /\n The CONNECTION the credential belongs to (#1670) — the row's key and what its seal binds. `providerRef`\n * beside it names the ref the act went through (or, on a write, the ref that created the row); the two\n * differ once several refs of one vendor share a connection (#1725). Optional only because rows written\n * before #1670 in the immutable trail do not carry it; every emitter since sets it.\n /\n connectionRef: z.string().optional(),\n /\n The npm package that owns the ref the grant was spent or granted through (#1725). On a shared connection several\n * refs — from several packages — spend one grant, so the connection alone does not say whose code acted.\n /\n providerPackageName: z.string().optional(),\n secretSlug: z.string(),\n resolvedFrom: z.enum(ProviderCredentialResolutionSource),\n credentialId: z.string(),\n});\n\n/\n The person's grant ended — by them removing it, by their own erasure, or by their account being deleted.\n \n `reason` matters more here than on the organization sibling. A credential removed by a cascade\n * from a subject-erasure request is EVIDENCE that the erasure reached this store, and it is the\n * evidence an operator produces when asked whether a person's third-party keys were destroyed. The\n * row itself is gone by then, so the event is all that remains.\n \n `deletedBy` exists for the one reason whose actor is NOT the person: `reason: USER_DELETED`, an\n * account deletion (#1016) — an administrator's hard delete or the invitation sweep reaping a pending\n * user — where it names the deleting principal (the administrator's user id, or the `SYSTEM` sentinel).\n * Absent on the owner's own revoke, whose actor is `userId` by construction.\n \n assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — evidence that delegated authority\n * was withdrawn.\n * assurance-control: WILDO.PRIVACY.ERASURE_PROPAGATION — evidence that erasure destroyed the\n * subject's third-party credentials: one row per destroyed credential with `reason: USER_ERASED`,\n * written by the credential resource's parent-cascade removal observer because the erasure cascade\n * removes these rows through the raw repository (#975).\n /\nexport const AuditableEvent_UserProviderCredential_DeletedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_DELETED),\n userId: z.string(),\n providerRef: z.string(),\n /\n The CONNECTION the credential belongs to (#1670) — the row's key and what its seal binds. `providerRef`\n * beside it names the ref the act went through (or, on a write, the ref that created the row); the two\n * differ once several refs of one vendor share a connection (#1725). Optional only because rows written\n * before #1670 in the immutable trail do not carry it; every emitter since sets it.\n /\n connectionRef: z.string().optional(),\n secretSlug: z.string(),\n deletedBy: z.string().optional(),\n credentialId: z.string(),\n reason: z.enum(ProviderCredentialDeletionReason),\n /\n What telling the VENDOR achieved, when the delete ended an OAuth2 grant (#545).\n \n Deleting our copy stops the application using a token; it does not end the grant at the vendor,\n * and a refresh token frequently never expires on its own. So this field is the difference between\n * a trail that says \"we deleted our copy\" and one that says whether the person's access was\n * actually withdrawn where it lives.\n \n Written by EVERY door that destroys a credential: the revoke doors (#545), and since #1711 the\n * cascade observers for a subject erasure, a hard delete of the user row, the invitation sweep and an\n * organization purge — each reads the token out of the pre-deletion row the cascade hands over. ABSENT\n * only on a row written before #1711, when the cascades attempted nothing. `not_declared` is the\n * ordinary answer for a vendor whose revocation is not RFC 7009-shaped, and for a pasted credential that\n * was never a grant; it is a recorded fact, not a failure. There is no retry: the token existed only in\n * the destroyed row, so this value is the whole record.\n /\n vendorRevocation: z.enum(ProviderOAuth2RevocationOutcomeValues).optional(),\n});\n\n\n\n// Outbound M2M Webhook Event Data Schemas\n\n/\n One `webhookConfig.testEndpoint` attempt — an admin causing the platform to open an\n * outbound connection to an operator-supplied URL.\n \n Recorded for EVERY attempt, not only failures: the security signal here is the pattern\n * (who probes which hosts, how often), which a SIEM can only derive if successes are\n * present too. `outcome` distinguishes a refusing endpoint from an unreachable one from a\n * local signing fault, so the stream stays diagnosable without the response body.\n \n `destinationHost` carries the host only, never the full URL — mirroring\n * `AuditableEvent_Organization_SIEMExportConfiguredEventDataSchema.webhookUrlDomain`. Paths\n * and query strings on customer endpoints routinely embed per-tenant tokens, and an audit\n * row is replicated to the org SIEM and the immutable store.\n /\nexport const AuditableEvent_Webhook_EndpointTestDispatchedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.WEBHOOK_ENDPOINT_TEST_DISPATCHED),\n /* Scope that owns the config — exactly one of these is set, per the polymorphic variant. /\n organizationId: z.string().optional(),\n applicationId: z.string().optional(),\n /* Admin who fired the probe. /\n dispatchedBy: z.string(),\n endpointId: z.string(),\n /* Host component only — see the schema JSDoc for why the full URL is withheld. /\n destinationHost: z.string(),\n outcome: z.enum(WebhookEndpointProbeOutcome),\n responseStatus: z.number().int().optional(),\n durationMs: z.number().int().nonnegative(),\n /* `jti` of the signed probe, for correlation with the consumer's own logs. /\n signatureJti: z.string(),\n});\n\n\n\n// Inbound Delivery Event Data Schemas (#1596)\n//\n// None of these carries the payload, a header value or an error message: the payload is the sender's\n// data (routinely a client's personal data) and lives on the delivery row, which is erased with its\n// organization. The trail names the delivery and says what happened to it.\n\nconst InboundDeliveryAuditBase = {\n sourceKind: z.enum(InboundSourceKind),\n /* `{providerRef}:{endpointKey}`, `app` for an application endpoint. /\n sourceKey: z.string(),\n};\n\nexport const AuditableEvent_InboundDelivery_RejectedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.INBOUND_DELIVERY_REJECTED),\n ...InboundDeliveryAuditBase,\n reason: z.enum(InboundDeliveryRejectionReason),\n /\n How many identical refusals (same source, same reason) this row records. Refusals are aggregated to\n * one row per source and reason per minute, so a flood of unsigned requests cannot grow the audit trail\n * without bound: the first refusal of a window is written at once (1), and the ones folded after it are\n * written when the window closes, as one row carrying their count. Summing `refusalCount` over the rows\n * gives the number of refusals — no row is counted twice. The one count that can be lost is the window\n * open when the backend process stops.\n /\n refusalCount: z.number().int().positive(),\n});\n\nexport const AuditableEvent_InboundDelivery_AcceptedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.INBOUND_DELIVERY_ACCEPTED),\n ...InboundDeliveryAuditBase,\n inboundDeliveryId: z.string(),\n handlerRef: z.string(),\n resolvedScopeKind: z.enum(InboundResolvedScopeKind),\n organizationId: z.string().optional(),\n /\n The channel and how well the sender was known when the delivery was accepted (#1630, I8) — the record\n * of what a handler's work was triggered by. Identification only: the handler's roles are its declared\n * `actingRoles` whatever this says. Never the sender's address.\n /\n channel: z.enum(InboundChannelKind),\n senderAssurance: z.enum(InboundSenderAssurance),\n});\n\nexport const AuditableEvent_InboundDelivery_UnroutableEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.INBOUND_DELIVERY_UNROUTABLE),\n ...InboundDeliveryAuditBase,\n inboundDeliveryId: z.string(),\n handlerRef: z.string(),\n reason: z.enum(InboundDeliveryUnroutableReason),\n});\n\nexport const AuditableEvent_InboundDelivery_ProcessedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.INBOUND_DELIVERY_PROCESSED),\n ...InboundDeliveryAuditBase,\n inboundDeliveryId: z.string(),\n handlerRef: z.string(),\n attempt: z.number().int().positive(),\n});\n\nexport const AuditableEvent_InboundDelivery_FailedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.INBOUND_DELIVERY_FAILED),\n ...InboundDeliveryAuditBase,\n inboundDeliveryId: z.string(),\n handlerRef: z.string(),\n attempt: z.number().int().positive(),\n /* A classification (an error type or reference), never an error message. /\n errorCode: z.string(),\n nextAttemptAt: z.date(),\n});\n\nexport const AuditableEvent_InboundDelivery_DeadEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.INBOUND_DELIVERY_DEAD),\n ...InboundDeliveryAuditBase,\n inboundDeliveryId: z.string(),\n handlerRef: z.string(),\n attempts: z.number().int().positive(),\n errorCode: z.string(),\n});\n\nexport const AuditableEvent_InboundDelivery_ReplayedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.INBOUND_DELIVERY_REPLAYED),\n ...InboundDeliveryAuditBase,\n inboundDeliveryId: z.string(),\n handlerRef: z.string(),\n replayedBy: z.string(),\n /* The operator's written reason — free text, so this event's bag is SUBJECT_DETAIL for export. /\n justification: z.string(),\n});\n\n// Inbound Channel Event Data Schemas (#1630). Ids and named outcomes only — never an address, a subject\n// or a body: the correspondence lives in its thread and channel record, erasable there.\n\nexport const AuditableEvent_InboundDelivery_BelowAssuranceEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.INBOUND_DELIVERY_BELOW_ASSURANCE),\n channel: z.enum(InboundChannelKind),\n /* The handler selected for the message, whose minimum it did not meet. /\n handlerRef: z.string(),\n senderAssurance: z.enum(InboundSenderAssurance),\n minimumSenderAssurance: z.enum(InboundSenderAssurance),\n disposition: z.enum(InboundBelowMinimumDisposition),\n /* For `ROUTED_TO_BELOW_MINIMUM_HANDLER`: the handler that received it instead, and its delivery. /\n belowMinimumHandlerRef: z.string().optional(),\n inboundDeliveryId: z.string().optional(),\n /* The channel's id for the message (the provider message id for email). /\n channelMessageId: z.string(),\n organizationId: z.string(),\n});\n\nconst InboundReplyAuditBase = {\n channel: z.enum(InboundChannelKind),\n threadId: z.string(),\n conversationMessageId: z.string(),\n submissionId: z.string(),\n};\n\nexport const AuditableEvent_InboundReply_SentEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.INBOUND_REPLY_SENT),\n ...InboundReplyAuditBase,\n templateRef: z.string(),\n recipientCount: z.number().int().positive(),\n /* True when the provider reported it had already accepted this submission — a retried send, not a second email. /\n deduplicated: z.boolean(),\n});\n\nexport const AuditableEvent_InboundReply_FailedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.INBOUND_REPLY_FAILED),\n ...InboundReplyAuditBase,\n /* A classification, never an error message. /\n failureCode: z.string(),\n});\n\nexport const AuditableEvent_InboundReplyToken_RevokedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.INBOUND_REPLY_TOKEN_REVOKED),\n threadId: z.string(),\n replyTokenId: z.string(),\n reason: z.enum(ReplyTokenRevocationReason),\n});\n\nexport const AuditableEvent_InboundReplyToken_DowngradedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.INBOUND_REPLY_TOKEN_DOWNGRADED),\n threadId: z.string(),\n replyTokenId: z.string(),\n reason: z.enum(ReplyTokenDowngradeReason),\n /* The level the message was given instead of `THREAD_TOKEN_BOUND`. /\n derivedAssurance: z.enum(InboundSenderAssurance),\n});\n\n// Receiving Email Event Data Schemas (#1600). A domain and a client mailbox address are an ORGANIZATION's\n// infrastructure, not a person's data, so they are named. A received message is named by its row id only:\n// its sender, subject and filenames live in the `inboundEmails` row, erasable there.\n\nconst OrganizationEmailDomainAuditBase = {\n organizationId: z.string(),\n organizationEmailDomainId: z.string(),\n domain: z.string(),\n};\n\nexport const AuditableEvent_OrganizationEmailDomain_ClaimedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_EMAIL_DOMAIN_CLAIMED),\n ...OrganizationEmailDomainAuditBase,\n sending: z.boolean(),\n receiving: z.boolean(),\n});\n\nexport const AuditableEvent_OrganizationEmailDomain_OwnershipVerifiedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_EMAIL_DOMAIN_OWNERSHIP_VERIFIED),\n ...OrganizationEmailDomainAuditBase,\n providerRef: z.string(),\n providerDomainId: z.string(),\n});\n\nexport const AuditableEvent_OrganizationEmailDomain_VerifiedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_EMAIL_DOMAIN_VERIFIED),\n ...OrganizationEmailDomainAuditBase,\n /* What the provider answered: VERIFIED, FAILED, or still PROVIDER_PENDING (its verification is asynchronous). /\n status: z.enum(OrganizationEmailDomainStatus),\n});\n\nexport const AuditableEvent_OrganizationEmailDomain_SuspendedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_EMAIL_DOMAIN_SUSPENDED),\n ...OrganizationEmailDomainAuditBase,\n reason: z.enum(OrganizationEmailDomainSuspensionReason),\n});\n\nexport const AuditableEvent_OrganizationEmailDomain_RemovedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.ORGANIZATION_EMAIL_DOMAIN_REMOVED),\n ...OrganizationEmailDomainAuditBase,\n trigger: z.enum(OrganizationEmailDomainRemovalTrigger),\n /* Whether a provider domain existed and was deleted there (false for a claim that never proved ownership). /\n providerDomainDeleted: z.boolean(),\n});\n\n/\n A client mailbox links two organizations, so the event is written to BOTH trails: the firm that owns the mailbox,\n * and the client whose organization it routes mail into. `organizationId` is the trail the row is in.\n /\nconst ClientMailboxAuditBase = {\n organizationId: z.string(),\n clientMailboxId: z.string(),\n address: z.string(),\n emailDomainId: z.string(),\n serviceProviderRelationshipId: z.string(),\n /* The firm that owns the domain and the mailbox. /\n firmOrganizationId: z.string(),\n /* The client organization the mailbox routes into. /\n clientOrganizationId: z.string(),\n};\n\nexport const AuditableEvent_ClientMailbox_CreatedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.CLIENT_MAILBOX_CREATED),\n ...ClientMailboxAuditBase,\n});\n\nexport const AuditableEvent_ClientMailbox_RemovedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.CLIENT_MAILBOX_REMOVED),\n ...ClientMailboxAuditBase,\n});\n\nexport const AuditableEvent_InboundEmail_AttachmentWithheldEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.INBOUND_EMAIL_ATTACHMENT_WITHHELD),\n organizationId: z.string(),\n inboundEmailId: z.string(),\n reason: z.enum(InboundEmailWithheldReason),\n /* The stored (quarantined) file, when one was stored. /\n fileId: z.string().optional(),\n});\n\nexport const AuditableEvent_InboundEmail_RejectedLimitEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.INBOUND_EMAIL_REJECTED_LIMIT),\n organizationId: z.string(),\n inboundEmailId: z.string(),\n limit: z.enum(InboundEmailLimit),\n sizeBytes: z.number().int().nonnegative(),\n attachmentCount: z.number().int().nonnegative(),\n});\n\n// SCIM Directory Provisioning Event Data Schemas\n\nexport const AuditableEvent_SCIM_TokenCreatedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.SCIM_TOKEN_CREATED),\n organizationId: z.string(),\n tokenDisplayName: z.string(),\n createdByUserId: z.string(),\n expiresAt: z.string().optional(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\nexport const AuditableEvent_SCIM_TokenRevokedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.SCIM_TOKEN_REVOKED),\n organizationId: z.string(),\n tokenDisplayName: z.string(),\n revokedByUserId: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\n// SCIM User Provisioning Event Data Schemas (H5+H8)\n\nexport const AuditableEvent_SCIM_UserProvisionedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.SCIM_USER_PROVISIONED),\n organizationId: z.string(),\n userId: z.string(),\n email: z.string(),\n isNewUser: z.boolean(),\n provisionedVia: z.string(),\n authSource: z.string().optional(),\n});\n\n\n\nexport const AuditableEvent_SCIM_UserUpdatedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.SCIM_USER_UPDATED),\n organizationId: z.string(),\n userId: z.string(),\n operation: z.string(),\n updatedAttributes: z.array(z.string()).optional(),\n});\n\n\n\nexport const AuditableEvent_SCIM_UserDeactivatedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.SCIM_USER_DEACTIVATED),\n organizationId: z.string(),\n userId: z.string(),\n email: z.string().optional(),\n});\n\n\n\n// Password Reset Event Data Schemas (H5)\n\nexport const AuditableEvent_User_PasswordResetRequestedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_PASSWORD_RESET_REQUESTED),\n email: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n/\n Administrator-compelled credential reset.\n \n Carries BOTH identities because the actor and the subject differ — that separation is the\n * whole point of the event. `actorUserId` is read from the authenticated execution context,\n * never from request input, so it cannot be spoofed by the caller. `reason` is the operator's\n * mandatory justification; it is what an auditor reads when asking why a credential was reset\n * out-of-band.\n \n assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — privileged credential\n * intervention must be attributable to the acting administrator and carry a justification.\n /\nexport const AuditableEvent_User_PasswordResetForcedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_PASSWORD_RESET_FORCED),\n targetUserId: z.string(),\n targetEmail: z.string(),\n actorUserId: z.string(),\n reason: z.string(),\n /* Whether the target's active sessions were revoked as part of the reset. /\n sessionsRevoked: z.boolean(),\n /\n Transport metadata, OPTIONAL because this event's only producer is a resource operation.\n \n The auth controllers thread `ipAddress` / `userAgent` down from the Express request, but a\n * resource-operation custom implementation receives an `ExecutionContext`, which carries\n * identity and no transport detail. Rather than stamping a fabricated `'unknown'` that reads\n * like a captured value, the fields are omitted and correlation runs through the request log.\n * They become populated if transport metadata is ever threaded onto the execution context.\n /\n ipAddress: z.string().optional(),\n userAgent: z.string().optional(),\n});\n\n\n\nexport const AuditableEvent_User_PasswordResetCompletedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_PASSWORD_RESET_COMPLETED),\n userId: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\n// Registration & Verification Event Data Schemas (H5)\n\nexport const AuditableEvent_User_RegisteredEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_REGISTERED),\n userId: z.string(),\n email: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n /\n HOW the account was acquired — the same vocabulary the registration policy is authored in, so \"who\n * registered through which door\" is answered by the trail rather than reconstructed from neighbouring\n * events. A first social or enterprise sign-in creates an account exactly as `/auth/register` does, and\n * until #1141 only the password door recorded it.\n \n Optional on the schema only because rows written before the field existed carry none; every emitter\n * states it (`logUserRegistered` requires it).\n /\n acquisitionChannel: z.enum(RegistrationAcquisitionChannel).optional(),\n /* The external identity provider that vouched for the account, for a social or enterprise sign-in. /\n providerRef: z.string().optional(),\n});\n\n\n\nexport const AuditableEvent_User_EmailVerifiedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_EMAIL_VERIFIED),\n userId: z.string(),\n email: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\nexport const AuditableEvent_User_VerificationEmailResentEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_VERIFICATION_EMAIL_RESENT),\n userId: z.string(),\n email: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\n// MFA Lifecycle Event Data Schemas (H5)\n\nexport const AuditableEvent_User_MFASetupStartedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_MFA_SETUP_STARTED),\n userId: z.string(),\n mfaMethod: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\nexport const AuditableEvent_User_MFASetupCompletedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_MFA_SETUP_COMPLETED),\n userId: z.string(),\n mfaMethod: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\nexport const AuditableEvent_User_MFAEmailOTPSentEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_MFA_EMAIL_OTP_SENT),\n email: z.string(),\n sessionId: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\n// WebAuthn/Passkey Event Data Schemas (Phase G1)\n\nexport const AuditableEvent_User_PasskeyRegisteredEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_PASSKEY_REGISTERED),\n userId: z.string(),\n email: z.string(),\n credentialId: z.string(),\n credentialName: z.string(),\n credentialDeviceType: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\nexport const AuditableEvent_User_PasskeyAuthSuccessEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_PASSKEY_AUTHENTICATION_SUCCESS),\n userId: z.string(),\n email: z.string(),\n credentialId: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n sessionId: z.string(),\n});\n\n\n\nexport const AuditableEvent_User_PasskeyAuthFailureEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_PASSKEY_AUTHENTICATION_FAILURE),\n email: z.string(),\n failureReason: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n sessionId: z.string(),\n});\n\n\n\n/\n A passkey assertion whose SIGNATURE VERIFIED and whose signature counter did not advance.\n \n This is the WebAuthn cloned-authenticator signal (W3C WebAuthn L3 §6.1.1: \"The signature\n * counter's purpose is to aid Relying Parties in detecting cloned authenticators\"). It is emitted\n * on the spec's own predicate — either counter non-zero AND the received value not greater than\n * the stored one — so a credential that reports 0 permanently, which every synced passkey does,\n * compares 0-against-0 and never reaches here.\n \n spec-cite: W3C Web Authentication Level 3, §6.1.1 Signature Counter Considerations\n * (https://www.w3.org/TR/webauthn-3/#sctn-sign-counter). The spec declines to mandate an outcome\n * (§7.2 step 22: \"whether the Relying Party ... fails the authentication ceremony or not, is\n * Relying Party-specific\"); Wildo refuses, matching what every major implementation does.\n \n SEPARATE from `USER_PASSKEY_AUTHENTICATION_FAILURE` deliberately. A wrong credential, an absent\n * challenge and a bad signature are routine noise; this one means a private key may exist in two\n * places. Recorded as its own type at CRITICAL so it is alertable rather than buried among ordinary\n * failed logins — which is exactly where it lived until 2026-09-08.\n \n The device-type, backup and AAGUID fields are carried for TRIAGE, never for a decision: nothing\n * branches on them. A synced credential that once reported a non-zero counter and then regresses is\n * still a signal, and exempting by device type would silently disable clone detection for the\n * growing majority of credentials.\n /\n/\n One file that a scanner concluded is infected (#506).\n \n `threatName` is the scanner's own signature or rule name (`Eicar-Test-Signature`, a YARA rule id).\n * It is carried because it is the first thing a responder needs and it names a THREAT, not a person\n * — unlike a file name, which is user-supplied content and is deliberately absent: audit rows are\n * replicated to the organisation's SIEM and to the immutable store, and an uploaded file's name\n * routinely carries personal data (\"Invoice - Jane Doe.pdf\"). The file id resolves to the row for\n * anyone authorised to look.\n /\nexport const AuditableEvent_File_MalwareDetectedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.FILE_MALWARE_DETECTED),\n fileId: z.string(),\n /* Which scanner concluded it — ClamAV signature matching and YARA pattern matching are different evidence. /\n scannerRef: z.string(),\n /* The signature or rule the scanner matched, when it reports one. /\n threatName: z.string().optional(),\n /* The resource the file belongs to, when the scan context carries it. /\n resourceType: z.string().optional(),\n resourceId: z.string().optional(),\n organizationId: z.string().optional(),\n /* Terminal status the file was moved to. Recorded so the row cannot claim a state the record does not hold. /\n fileStatus: z.string(),\n});\n\n/\n One scan that could not be completed (#506).\n \n Distinct from a detection: the control did not run. `failureReason` is TRUNCATED because a scanner\n * error routinely embeds a host, a socket path or a temporary file path, and this row reaches the\n * organisation's SIEM.\n /\nexport const AuditableEvent_File_MalwareScanFailedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.FILE_MALWARE_SCAN_FAILED),\n fileId: z.string(),\n scannerRef: z.string(),\n /* Truncated scanner/pipeline error — enough to triage, bounded so a path cannot ride into the SIEM whole. /\n failureReason: z.string().optional(),\n resourceType: z.string().optional(),\n resourceId: z.string().optional(),\n organizationId: z.string().optional(),\n fileStatus: z.string(),\n});\n\nexport type AuditableEvent_File_MalwareDetectedEventData =\n z.infer<typeof AuditableEvent_File_MalwareDetectedEventDataSchema>;\nexport type AuditableEvent_File_MalwareScanFailedEventData =\n z.infer<typeof AuditableEvent_File_MalwareScanFailedEventDataSchema>;\n\n\nexport const AuditableEvent_User_PasskeyCloneSuspectedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_PASSKEY_CLONE_SUSPECTED),\n userId: z.string(),\n credentialId: z.string(),\n /* The counter Wildo held for this credential before the assertion. /\n storedCounter: z.number().int().min(0),\n /* The counter the authenticator reported. Not greater than `storedCounter`, which is the signal. /\n receivedCounter: z.number().int().min(0),\n /* Triage only: `singleDevice` or `multiDevice`, as captured at registration. /\n credentialDeviceType: z.string(),\n /* Triage only: whether the credential is backed up (synced), as captured at registration. /\n credentialBackedUp: z.boolean(),\n /* Triage only: the authenticator model identifier, when the registration reported one. /\n aaguid: z.string().optional(),\n /* Which door the assertion arrived at — a step-up regression is not the same story as a login. /\n ceremony: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\nexport const AuditableEvent_User_PasskeyRemovedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_PASSKEY_REMOVED),\n userId: z.string(),\n email: z.string(),\n credentialId: z.string(),\n credentialName: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\n// Magic Link Event Data Schemas (Phase G2)\n\nexport const AuditableEvent_User_MagicLinkSentEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_MAGIC_LINK_SENT),\n email: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\nexport const AuditableEvent_User_MagicLinkVerifiedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_MAGIC_LINK_VERIFIED),\n userId: z.string(),\n email: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n sessionId: z.string(),\n});\n\n\n\nexport const AuditableEvent_User_MagicLinkFailedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_MAGIC_LINK_FAILED),\n email: z.string().optional(),\n failureReason: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\n// SMS OTP Event Data Schemas (Phase G2)\n\nexport const AuditableEvent_User_SMSOTPSentEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_SMS_OTP_SENT),\n phoneNumber: z.string(),\n factorLevel: z.string(),\n sessionId: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\nexport const AuditableEvent_User_SMSOTPVerifiedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_SMS_OTP_VERIFIED),\n userId: z.string(),\n phoneNumber: z.string(),\n factorLevel: z.string(),\n sessionId: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\nexport const AuditableEvent_User_SMSOTPFailedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_SMS_OTP_FAILED),\n phoneNumber: z.string().optional(),\n factorLevel: z.string(),\n failureReason: z.string(),\n sessionId: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\n// Phone Verification Event Data Schemas (Phase G2)\n\nexport const AuditableEvent_User_PhoneVerifiedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_PHONE_VERIFIED),\n userId: z.string(),\n phoneNumber: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\nexport const AuditableEvent_User_PhoneVerificationFailedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_PHONE_VERIFICATION_FAILED),\n phoneNumber: z.string(),\n failureReason: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\n// OAuth2 Provider Restriction Event Data Schema (Phase G3)\n\nexport const AuditableEvent_OAuth2ProviderBlockedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.OAUTH2_PROVIDER_BLOCKED),\n email: z.string().optional(),\n providerRef: z.string(),\n scopeType: z.enum(AuthScopeType),\n organizationId: z.string().optional(),\n applicationId: z.string().optional(),\n reason: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n}).superRefine((event, ctx) => {\n const hasOrganizationScope =\n event.scopeType === AuthScopeType.ORGANIZATION\n && event.organizationId !== undefined\n && event.applicationId === undefined;\n const hasApplicationScope =\n event.scopeType === AuthScopeType.APPLICATION\n && event.applicationId !== undefined\n && event.organizationId === undefined;\n if (!hasOrganizationScope && !hasApplicationScope) {\n ctx.addIssue({\n code: 'custom',\n path: ['scopeType'],\n message: 'OAuth2 provider-blocked events require exactly one explicit tenant scope',\n });\n }\n});\n\nexport type AuditableEvent_OAuth2ProviderBlockedEventData = z.infer<typeof AuditableEvent_OAuth2ProviderBlockedEventDataSchema>;\n\n/\n Authentication-context demand unsatisfied (issue #444).\n \n Carries BOTH sides of the comparison, because either alone is unactionable: `demandedAcrValues`\n * is what the connection authored, `receivedAcr` is what the provider's ID token reported. The\n * received value is OPTIONAL and its absence is the distinct, common case — a provider that emits\n * no `acr` claim at all — which reads very differently from one that answered with a weaker\n * context, and an operator must be able to tell them apart from the trail alone.\n \n No email field. The refusal happens before any identity is established or trusted, and recording\n * an unauthenticated claimant's address as though it were a subject is the kind of quiet personal\n * data this family avoids; `providerRef` and the two ACR sides are what a reader needs.\n /\nexport const AuditableEvent_OidcAcrDemandUnsatisfiedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.OIDC_ACR_DEMAND_UNSATISFIED),\n providerRef: z.string(),\n /* The ordered list of acceptable values the connection authored. Never empty — an empty demand is not enforced at all. /\n demandedAcrValues: z.array(z.string()).min(1),\n /* What the ID token's `acr` claim reported. ABSENT when the provider emitted no claim. /\n receivedAcr: z.string().optional(),\n /* Present when the ID token itself could not be read, which is a different refusal from a mismatched claim. /\n failureReason: z.string().optional(),\n});\nexport type AuditableEvent_OidcAcrDemandUnsatisfiedEventData = z.infer<typeof AuditableEvent_OidcAcrDemandUnsatisfiedEventDataSchema>;\n\n// Emergency Access Event Data Schema\n\n/\n A named break-glass account signed in past its tenant's own SSO requirement (#423).\n \n `organizationId` was REQUIRED here and is now one of two scopes, because `emergencyAccess` lives\n * on the POLYMORPHIC SSO config: an application-scope policy carries break-glass accounts for the\n * application itself, and requiring an organization id would have made the one event that matters\n * unemittable for exactly that case — a privileged sign-in with no record, which is the opposite of\n * what this event is for. The exactly-one-scope refinement follows the OAuth2-provider-blocked\n * event above rather than inventing a second shape.\n /\nexport const AuditableEvent_EmergencyAccess_UsedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.EMERGENCY_ACCESS_USED),\n userId: z.string(),\n email: z.email(),\n scopeType: z.enum(AuthScopeType),\n organizationId: z.string().optional(),\n applicationId: z.string().optional(),\n reason: z.string().optional(),\n ipAddress: z.string(),\n userAgent: z.string(),\n sessionId: z.string(),\n}).superRefine((event, ctx) => {\n const hasOrganizationScope =\n event.scopeType === AuthScopeType.ORGANIZATION\n && event.organizationId !== undefined\n && event.applicationId === undefined;\n const hasApplicationScope =\n event.scopeType === AuthScopeType.APPLICATION\n && event.applicationId !== undefined\n && event.organizationId === undefined;\n if (!hasOrganizationScope && !hasApplicationScope) {\n ctx.addIssue({\n code: 'custom',\n path: ['scopeType'],\n message: 'Emergency-access events require exactly one explicit tenant scope',\n });\n }\n});\n\n\n\nexport const AuditableEvent_FieldAccess_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.FIELD_ACCESS),\n fieldName: z.string(),\n resourceType: z.string(),\n resourceId: z.string().optional(),\n operationIdentifier: z.string(),\n isCreateOperation: z.boolean(),\n // Machine-credential provenance when the ACCESSING principal is a machine (api-key / OAuth\n // client) rather than a human. Absent for user-authenticated access. Threads the credential id\n // + auth method onto the sensitive-field-access row so machine access is attributable — the\n // per-request counterpart to the dedicated MACHINE_AUTH_ events (machine-auth-hardening item 2).\n machineCredentialAuthMethod: z.string().optional(),\n machineCredentialId: z.string().optional(),\n});\n\n/*\n A resource operation took effect. The operation-triggered counterpart to\n * {@link AuditableEvent_FieldAccess_EventDataSchema}, which is triggered by a decorated RESPONSE\n * FIELD and is therefore blind to any operation whose response carries none.\n \n ## What the existence of this row asserts, and what it does not\n \n It is emitted from the framework-managed POST-COMMIT effects lane, so the row exists only for an\n * operation whose mutation is already durable. \"Performed\" is therefore the whole claim — there is\n * deliberately no `outcome` discriminator, because this emission point can never observe a failure.\n \n The absence of a row is NOT evidence that nothing happened; that is what makes audit-pipeline\n * failure detection (`audit_store_failure_total`, and the operation identity now carried on the\n * failure log line) a control in its own right rather than an operational nicety.\n \n Refusals are a different event and a different chokepoint. A denied operation never reaches\n * this lane — the authorization decision happens pre-dispatch, its volume is attacker-drivable, and\n * it needs rate-limit / dedup treatment this success path does not. Declaring a `DENIED` outcome\n * here that nothing produces would repeat the very defect this event exists to fix (20 event types\n * were authored in this enum and wired to nothing). That refusal event now exists and is emitted:\n * see {@link AuditableEvent_ResourceOperationDenied_EventDataSchema}, raised from the authorizer.\n * The two events are read together — this one for what happened, that one for what was stopped —\n * and neither carries an `outcome` discriminator, because each states its whole claim in its name.\n \n ## Operation identity is a TRIPLE\n \n `resourceType` + `operationIdentifier` + `variantKey`. Recording only the first two makes an\n * `admin` variant indistinguishable from a `self` variant — a distinction several polymorphic\n * resources encode in `variantKey` alone, and precisely the distinction an auditor is checking.\n \n ## Correlation across a cascade\n \n The framework-managed lane covers API, internal call and repository-only writes; OVERRIDE_ALL\n * implementations own their committed emission. A framework-managed tenant deletion\n * produces one row per cascaded child. The top-level `correlationId` is inherited by every sub-call\n * context and preserved across mid-flight operation corrections, so it groups the whole fan-out to one request;\n * `subCallDepth` separates the initiating operation (0) from what it cascaded into.\n \n ## Field evidence is deliberately partial (GDPR Art. 5(1)(c) + Art. 17)\n \n `changedFields` names every field the write touched — a field NAME is not personal data, so it is\n * always safe and always recorded. `fieldEvidence` carries before/after VALUES only for fields the\n * schema marks `.isAuditEvidence()`. The separate `reason` records an explicitly selected operator\n * justification, not an arbitrary request payload or a copy of a mutable resource reason field.\n \n Values are limited on purpose: audit rows replicate to the per-org SIEM and to the immutable\n * ledger, and the immutable ledger cannot be scrubbed — so copying arbitrary personal data into\n * this event would manufacture an unerasable duplicate, in direct conflict with Art. 17 and with the\n * impersonalization/retention capability built to make personal data erasable. Authority-, status-\n * and scope-bearing values ARE necessary (a role change that does not record the old and new roles\n * proves nothing), and those are exactly what the marker is for.\n \n assurance-control: WILDO.AUDIT.EVIDENCE_INTEGRITY\n /\nexport const AuditableEvent_ResourceOperationPerformed_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.RESOURCE_OPERATION_PERFORMED),\n\n // ── Operation identity (the triple + the shape that resolves the persistence semantics) ──\n /* The resource whose row(s) the operation acted on. /\n resourceType: z.string(),\n /* The verb — a core operation (`update`, `delete`) or a custom identifier (`suspend`). /\n operationIdentifier: z.string(),\n /* Which execution surface ran it. API, internal call, repository-only, cron, batch. /\n variantType: z.enum(ResourceOperationVariantType),\n /\n The variant discriminator. Absent on the default variant; REQUIRED to distinguish e.g. the\n * `admin` variant of a verb from its `self` twin, which share `operationIdentifier`.\n /\n variantKey: z.string().optional(),\n /* The core persistence semantics a custom verb borrows. Absent when the verb IS a core operation. /\n resourceOperationLike: z.enum(CoreResourceOperation).optional(),\n /* `true` for the bulk form, whose subject is a set rather than one row. /\n isBulkOperation: z.boolean().optional(),\n\n // ── Subject ──\n /* The row acted on. Absent for bulk operations, whose subject is the set below. /\n resourceId: z.string().optional(),\n /* Bulk operations only: how many rows the write affected. /\n affectedRecordCount: z.number().optional(),\n /\n Bulk operations only: WHICH rows the write affected.\n \n A count answers \"how much\"; a trail has to answer \"what\". Without this, one actor changing\n * forty rows left a single record saying `affectedRecordCount: 40` and naming none of them — so\n * the question an investigator asks first, \"who changed THIS row\", had no answer for any write\n * that was not single-row, which is exactly the case where one actor touches many records at once.\n \n Bounded by the batch maximum a synchronous bulk already enforces, so this is a complete list\n * rather than a sample: the background lane does not produce it at all, because it runs the\n * single-row twin per id and each row audits itself.\n \n Rides `eventData`, which the audit store persists as an unparsed record — so naming the rows\n * costs no column and no migration.\n /\n affectedResourceIds: z.array(z.string()).optional(),\n\n // ── Principal (the row's `userId` / `organizationId` / `applicationId` carry the identity) ──\n /\n The caller's roles AS THEY WERE at decision time. Roles are the framework's single\n * authorization axis, so without them a reader cannot tell whether the actor was entitled to the\n * action — and the actor's roles today are not the roles they held then.\n /\n initiatorRoles: z.array(z.string()),\n /* How the call was initiated — separates a human request from framework machinery. /\n executionType: z.enum(ExecutionContext_ExecutionType),\n /* Machine-credential provenance when the principal is a machine rather than a human. /\n machineCredentialAuthMethod: z.string().optional(),\n machineCredentialId: z.string().optional(),\n\n // ── Cascade depth (the request that groups the whole cascade is the row's top-level `correlationId`) ──\n /* `0` for the operation the caller invoked; deeper for what it cascaded into. /\n subCallDepth: z.number(),\n\n // ── Effect ──\n /\n Operator justification explicitly selected from the request by the operation's audit contract.\n * Historical evidence, independent of mutable resource fields such as cancellationReason.\n * It is not inferred from arbitrary request fields and must not contain secrets.\n /\n reason: z.string().optional(),\n /* Every field the write touched. Names only — always safe, always recorded. /\n changedFields: z.array(z.string()).optional(),\n /\n Before/after values, restricted to fields marked `.isAuditEvidence()`. `before` is absent on a\n * CREATE (there was no prior value) and on any bulk write (the framework fetches a pre-image only\n * for a single selected id).\n /\n fieldEvidence: z\n .record(\n z.string(),\n z.object({\n before: z.unknown().optional(),\n after: z.unknown().optional(),\n }),\n )\n .optional(),\n});\n\n/\n An operation the authorizer REFUSED. The other half of \"record access decisions\" — the negative\n * decision, which until now left no trace anywhere in the framework.\n \n ## Emitted pre-dispatch, from the one funnel\n \n Every public entry point of `AuthorizationsBackendService` converges on the same two inner phase\n * runners — `authorizeInController` (HTTP controller, MCP, WebSocket, queue, field validation),\n * `authorizeInProgrammaticSurface` (a non-controller surface that faces an external caller), and\n * `authorizeInRepositoryAndService`, which has exactly one caller — `authorizeInController` itself.\n * So a single instrumentation point observes every refusal THE AUTHORIZER MAKES, with the operation\n * and execution context both in scope. No mutation has occurred when this row is written; nothing is\n * rolled back by it.\n \n The scope of that claim, stated because an earlier revision overstated it. It used to read\n * \"the sole production entry point for every execution surface\", which asserts something stronger\n * and false: that every execution surface passes the role gate. A programmatic operation entering at\n * the SERVICE tier (`ServicesRegistryHandlerBackendService.read` / `list` / …) reaches no authorizer\n * at all — deliberately, because that population includes the reads that ESTABLISH identity before a\n * role-bearing principal exists. So the absence of a row here means \"the authorizer refused nothing\",\n * never \"nothing was read\". See `AuthorizationsBackendService.authorizeInProgrammaticSurface` for the\n * layering decision and the door.\n \n ## What it is NOT\n \n - Not an authentication failure. `USER_LOGIN_FAILED` / `MACHINE_AUTH_FAILED` say \"you are not\n * who you claim to be\". This says \"you are, and you may not do this\". Distinct types, distinct\n * categories, neither overloaded.\n * - Not an `outcome: 'denied'` variant of {@link AuditableEvent_ResourceOperationPerformed_EventDataSchema}.\n * That event is emitted from the post-commit lane, which by construction can only observe\n * operations that already took effect. A refusal never reaches it.\n \n ## Volume: bounded by dedup, NOT by a risk floor\n \n Denial volume is attacker-drivable in a way the success path's never is. A risk floor was\n * considered and rejected as the control: it would exclude 100% of denied READS (zero of the\n * catalogue's HIGH/CRITICAL variants are reads, while 371 of 551 API-reachable variants are) —\n * discarding the canonical reconnaissance signal — while not capping the adversarial worst case at\n * all, since the attacker chooses which endpoint to hammer.\n \n The actual bound is a per-principal / per-operation / per-reason dedup window. Rather than\n * suppressing repeats outright (which would erase the storm — the very signal a security-operations team wants),\n * emission escalates on a LOGARITHMIC ladder: the 1st, 10th, 100th, … refusal in the window each\n * emit one row carrying {@link occurrenceCount}. A burst of 10 000 identical denials therefore\n * costs 5 rows and remains legible as a burst.\n \n Dedup is best-effort and FAILS OPEN (emit) when the counter store is unavailable — a fail-closed\n * cooldown would let an attacker blind the audit trail by taking Redis down.\n \n assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT\n /\n/\n A platform operator acted on a row belonging to a tenant they are not a member of.\n \n ## Why this event exists\n \n Wildo's answer to \"may a platform super-administrator administer any tenant?\" is YES — the same\n * answer most mature B2B platforms give, because support and incident response genuinely need it.\n * What those platforms do NOT do is leave the reach implicit. Support access is a named, logged\n * event, because the difference between legitimate operator work and quiet snooping is not the\n * capability — both use the identical capability — it is whether anyone can tell afterwards.\n \n Until 2026-08-05 Wildo had the capability with none of the visibility, and by accident rather than\n * declaration: per-instance org-scoped requests are checked by `authorizeOrganizations`, which\n * compares the fetched row's organization against a scope the SAME REQUEST supplied through its URL.\n * A non-member operator therefore passed it silently. Measured over real HTTP by\n * `organization-ownership-grant-hostile.e2e.ts` probe F-1a, which deleted a membership row in\n * another tenant and got a 200.\n \n This event is the visibility half, and it is NOT the refusal. The refusal shipped separately and\n * lives in `authorizeOrganizations`: an undeclared crossing is no longer admitted, and the caller is\n * answered as not-found so the response cannot be used as an existence oracle. Emission here stays\n * best-effort and never blocks the request: an operator action must not fail because the audit sink\n * is down, and a fail-closed variant would let anyone disable operator support by breaking the sink.\n * The observation is taken BEFORE the admission decision, on purpose, so a sanctioned crossing is\n * recorded too.\n \n ## Reading the event\n \n {@link admissionDeclared} is the field that matters most. `true` means the operation VARIANT\n * declared `admitsCrossTenantPlatformAdministration` — an intended, reviewed crossing such as\n * `organizationMembers.grantOwnership`, which additionally requires a usable platform access grant.\n * `false` now means an ATTEMPTED undeclared crossing, which was refused: still the population to\n * watch, because it is reach nobody declared and no specification describes.\n \n assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION — platform-tier access to a tenant the\n * principal does not belong to.\n * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT\n /\n/\n One transition in the life of a platform access grant.\n \n The crossing itself is recorded by {@link CoreAuditableEventType.CROSS_TENANT_ADMINISTRATIVE_ACCESS}.\n * This is the other half, and a reviewer needs both: that event answers \"an operator reached into\n * this tenant\", this one answers \"on what authority, asked for when, and who agreed\".\n \n Deliberately two events rather than one enriched one. A grant is requested once and may authorise\n * many crossings across its window, so folding them together would either duplicate the grant's\n * details onto every access or lose the request/decision timeline entirely.\n \n {@link autoApprovalReason} is the field a customer audit turns on. Its ABSENCE on an approved grant\n * means a human in the tenant said yes. `TENANT_APPROVAL_NOT_REQUIRED` means the tenant had not opted\n * into approval. `TENANT_CANNOT_APPROVE` means the tenant had no administratively usable owner and\n * could not consent — the one path where operator access proceeds against a tenant that never agreed\n * and never could, which is why the emitter carries it at a higher risk level.\n \n assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION\n * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — evidence of a privileged assignment's full life.\n /\n/\n The fields both legal-hold events carry: which hold, which tenant, what it covers and on what ground.\n * The `justification` / `releaseReason` prose is NOT carried — it is free text most likely to name a third\n * party, and it stays on the hold row, which the tenant and the operator can read.\n /\nconst LegalHoldAuditEventFields = {\n holdId: z.string(),\n heldOrganizationId: z.string(),\n scopeKind: z.enum(LegalHoldScopeKind),\n legalGround: z.enum(LegalHoldGround),\n placementTier: z.enum(LegalHoldPlacementTier),\n /* `RESOURCE_ROWS` only. /\n heldResourceType: z.string().optional(),\n /* `RESOURCE_ROWS` only: how many rows the hold lists (absent = every row of the resource type). /\n heldRowCount: z.number().int().min(0).optional(),\n /* `DATA_SUBJECT` only. /\n subjectUserId: z.string().optional(),\n};\n\n/* A legal hold was placed (#1634). /\nexport const AuditableEvent_LegalHoldPlaced_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.LEGAL_HOLD_PLACED),\n ...LegalHoldAuditEventFields,\n placedByUserId: z.string(),\n});\n\n/\n A model-cost period aggregate was linked to its invoice (#1598). Identifiers, the period and the currency\n * only: no amount (the aggregate row holds it), no personal data.\n /\nexport const AuditableEvent_ModelCostAggregateInvoiceLinked_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.MODEL_COST_AGGREGATE_INVOICE_LINKED),\n aggregateId: z.string(),\n /* The tenant whose cost the aggregate records, and whose invoice it is. /\n billedOrganizationId: z.string(),\n /* First instant of the aggregate's calendar month (UTC), ISO. /\n periodStart: z.string(),\n currency: z.string(),\n organizationInvoiceRefId: z.string(),\n /* The administrator (or the billing flow's principal) who linked it. /\n linkedByUserId: z.string().optional(),\n});\n\n/* An organization's content-capture setting changed (#1599). The setting, never any content. /\nexport const AuditableEvent_CorrectionCaptureSettingChanged_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.CORRECTION_CAPTURE_SETTING_CHANGED),\n settingOrganizationId: z.string(),\n /* `metadata_only` / `with_content`, before and after. /\n previousContentCapture: z.string().optional(),\n contentCapture: z.string(),\n /* Whether a purpose is stated (the purpose text is on the setting row, not on the trail). /\n purposeStated: z.boolean(),\n contentReaderRole: z.string().optional(),\n narrowedToCaseCount: z.number().int().min(0),\n changedByUserId: z.string().optional(),\n});\n\n/* An organization's evaluation-export authorisation changed (#1599). The basis and counts, never case identities. /\nexport const AuditableEvent_EvaluationExportAuthorizationChanged_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.EVALUATION_EXPORT_AUTHORIZATION_CHANGED),\n authorizationOrganizationId: z.string(),\n status: z.string(),\n previousStatus: z.string().optional(),\n /* Absent when the authorisation holds none (NOT_GRANTED). /\n basis: z.string().optional(),\n clientConsentCount: z.number().int().min(0),\n excludedCaseCount: z.number().int().min(0),\n changedByUserId: z.string().optional(),\n});\n\n/* An evaluation dataset was exported (#1599). The ledger row names every record; the trail names the export. /\nexport const AuditableEvent_EvaluationDatasetExported_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.EVALUATION_DATASET_EXPORTED),\n exportId: z.string(),\n exportOrganizationId: z.string(),\n agentRef: z.string(),\n basis: z.string(),\n recordCount: z.number().int().min(0),\n windowFrom: z.string(),\n windowTo: z.string(),\n destination: z.string(),\n exportedByUserId: z.string().optional(),\n});\n\n/* An evaluation-dataset export was refused (#1599 I7). /\nexport const AuditableEvent_EvaluationDatasetExportRefused_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.EVALUATION_DATASET_EXPORT_REFUSED),\n exportOrganizationId: z.string(),\n agentRef: z.string(),\n /* Why: no authorisation recorded, or it is revoked. /\n reason: z.enum(EvaluationDatasetExportRefusalReason),\n attemptedByUserId: z.string().optional(),\n});\n\n/* A legal hold was released (#1634). /\nexport const AuditableEvent_LegalHoldReleased_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.LEGAL_HOLD_RELEASED),\n ...LegalHoldAuditEventFields,\n releasedByUserId: z.string(),\n /* How long the hold was in force, so a reviewer sees the suspension window without a join. /\n heldForSeconds: z.number().int().min(0),\n});\n\nexport const AuditableEvent_PlatformAccessGrantLifecycle_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.PLATFORM_ACCESS_GRANT_LIFECYCLE),\n\n /* Which transition this row records. /\n transition: z.enum(PlatformAccessGrantLifecycleTransition),\n /* The grant, so the whole timeline can be reassembled from its rows. /\n grantId: z.string(),\n /\n WHAT the elevation reaches, and therefore who was entitled to approve it.\n \n Carried explicitly rather than inferred from the presence of `targetOrganizationId`: a reviewer\n * asking \"was this approved by the party the rules require?\" needs the SCOPE, and deriving it from\n * a field's absence would make a lost or scrubbed value read as an application-wide elevation.\n \n `TENANT` is the default so every row written before this axis existed keeps its true meaning —\n * the application-wide grant did not exist then.\n /\n grantScope: z.enum(PlatformAccessGrantScope).default(PlatformAccessGrantScope.TENANT),\n /\n The tenant that was, or would have been, reached into.\n \n OPTIONAL since the application-wide scope arrived: that grant names no tenant, and writing a\n * placeholder would be a lie about which customer an operator reached. Absent ⇔\n * `grantScope === APPLICATION_WIDE`.\n /\n targetOrganizationId: z.string().optional(),\n /* The operator who asked. Never the decider — see {@link decidedByUserId}. /\n operatorUserId: z.string(),\n /* Why the operator said they needed access. Recorded on every transition, not only the request. /\n justification: z.string().optional(),\n /* The status the grant holds after this transition. /\n resultingStatus: z.enum(PlatformAccessGrantStatus),\n /* When the elevation stops working. Absent on a grant that never became usable. /\n expiresAt: z.date().optional(),\n /* Present exactly when the grant became usable with no tenant administrator acting. /\n autoApprovalReason: z.enum(PlatformAccessGrantAutoApprovalReason).optional(),\n /* The tenant administrator who approved, denied or revoked. Absent on an auto-approval. /\n decidedByUserId: z.string().optional(),\n /* Their stated reason, when they gave one. /\n decisionReason: z.string().optional(),\n /\n The machine credential an application-wide grant is bound to, when it is (#297). Present on EVERY transition\n * of such a grant, so the second administrator's signature and every later reader see which credential the\n * elevation reaches — a request naming a machine must never read, in the trail, as the requester's own window.\n /\n grantedMachineCredential: ExecutionContext_MachineCredentialSchema.optional(),\n});\n\n/\n One transition in the life of a service-provider relationship (#1597).\n \n Read it to answer \"which firm could reach this tenant, under what scope, since when — and who decided\".\n * Written once to the CLIENT's trail and once to the FIRM's: the same facts, each organization reading\n * them in its own tenant. `purpose` and `decisionReason` are free text people typed, so they are carried\n * for the tenants' own trails and are NOT exported to a SIEM by default.\n \n assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE\n * assurance-control: WILDO.PRIVACY.THIRD_PARTY_PROCESSING\n /\nexport const AuditableEvent_ServiceProviderRelationshipLifecycle_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.SERVICE_PROVIDER_RELATIONSHIP_LIFECYCLE),\n transition: z.enum(ServiceProviderRelationshipTransition),\n relationshipId: z.string(),\n clientOrganizationId: z.string(),\n providerOrganizationId: z.string(),\n resultingStatus: z.enum(ServiceProviderRelationshipStatus),\n /* The role the relationship confers after this transition. /\n role: z.string(),\n /* Its scope after this transition; empty ⇒ organization-wide. /\n organizationUnitIds: z.array(z.string()),\n endsAt: z.date().optional(),\n proposedByOrganizationId: z.string(),\n /* The person who acted, and on which side. Absent for the expiry sweep. /\n actorUserId: z.string().optional(),\n actorOrganizationId: z.string().optional(),\n purpose: z.string().optional(),\n decisionReason: z.string().optional(),\n /* How the firm's experts are admitted after this transition (#1612) — what `EXPERT_ADMISSION_POLICY_CHANGED` changed. /\n expertAdmissionPolicy: z.enum(ServiceProviderExpertAdmissionPolicy).optional(),\n});\n\n/* A firm machine client admitted into / removed from a client organization under a relationship (#1597, S3). /\nexport const AuditableEvent_ServiceProviderMachineClientAdmissionChanged_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.SERVICE_PROVIDER_MACHINE_CLIENT_ADMISSION_CHANGED),\n admitted: z.boolean(),\n relationshipId: z.string(),\n clientOrganizationId: z.string(),\n providerOrganizationId: z.string(),\n oauthClientId: z.string(),\n actorUserId: z.string().optional(),\n});\n\n/* An expert assigned to a client relationship by their firm (#1597). /\nexport const AuditableEvent_ServiceProviderExpertAssigned_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.SERVICE_PROVIDER_EXPERT_ASSIGNED),\n assignmentId: z.string(),\n relationshipId: z.string(),\n clientOrganizationId: z.string(),\n providerOrganizationId: z.string(),\n expertUserId: z.string(),\n actorUserId: z.string().optional(),\n});\n\n/* An expert's assignment to a client relationship ended by their firm (#1597). /\nexport const AuditableEvent_ServiceProviderExpertUnassigned_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.SERVICE_PROVIDER_EXPERT_UNASSIGNED),\n assignmentId: z.string(),\n relationshipId: z.string(),\n clientOrganizationId: z.string(),\n providerOrganizationId: z.string(),\n expertUserId: z.string(),\n actorUserId: z.string().optional(),\n});\n\n/\n The facts every per-expert approval event carries (#1612). Identical in the client's and the firm's trail — which\n * is why none of them names the client administrator who answered: the firm reads its copy, and the decider is on\n * the decision's own `human_decision_resolved` row in the CLIENT's trail, joined by `decisionRef`.\n \n assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE\n * assurance-control: WILDO.PRIVACY.THIRD_PARTY_PROCESSING\n /\nconst ServiceProviderExpertApprovalEventShape = {\n /* The human decision this approval is — the key that joins every row about it. /\n decisionRef: z.string().trim().min(1),\n assignmentId: z.string(),\n relationshipId: z.string(),\n clientOrganizationId: z.string(),\n providerOrganizationId: z.string(),\n expertUserId: z.string(),\n};\n\n/* A firm's assignment now waits for the client's approval (#1612). Actor: the firm administrator who assigned. /\nexport const AuditableEvent_ServiceProviderExpertApprovalRequested_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.SERVICE_PROVIDER_EXPERT_APPROVAL_REQUESTED),\n ...ServiceProviderExpertApprovalEventShape,\n /* The policy that made the assignment wait — the client's, read at assignment time. /\n expertAdmissionPolicy: z.enum(ServiceProviderExpertAdmissionPolicy),\n /* The role the expert would receive. /\n role: z.string(),\n actorUserId: z.string().optional(),\n});\n\n/* The client approved, and the expert was admitted (#1612). /\nexport const AuditableEvent_ServiceProviderExpertApprovalGranted_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.SERVICE_PROVIDER_EXPERT_APPROVAL_GRANTED),\n ...ServiceProviderExpertApprovalEventShape,\n role: z.string(),\n});\n\n/* The expert was not admitted (#1612). /\nexport const AuditableEvent_ServiceProviderExpertApprovalDenied_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.SERVICE_PROVIDER_EXPERT_APPROVAL_DENIED),\n ...ServiceProviderExpertApprovalEventShape,\n denialReason: z.enum(ServiceProviderExpertApprovalDenialReason),\n});\n\n/* Nobody answered in time (#1612). /\nexport const AuditableEvent_ServiceProviderExpertApprovalLapsed_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.SERVICE_PROVIDER_EXPERT_APPROVAL_LAPSED),\n ...ServiceProviderExpertApprovalEventShape,\n});\n\n/\n The facts of one delegated capability grant (#1631), identical in the client's and the firm's trail: which\n * capability, lent through which relationship, until when.\n \n assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE\n * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE\n /\nconst ServiceProviderCapabilityGrantEventShape = {\n grantId: z.string(),\n relationshipId: z.string(),\n clientOrganizationId: z.string(),\n providerOrganizationId: z.string(),\n capability: z.enum(DelegatedAdministrativeCapability),\n /* Whether only an owner could lend it — the CRITICAL rows. /\n securityCritical: z.boolean(),\n endsAt: z.date(),\n /* The client person who acted. Absent when the relationship's end revoked it with nobody acting. /\n actorUserId: z.string().optional(),\n};\n\n/* A capability was lent (#1631). /\nexport const AuditableEvent_ServiceProviderCapabilityGranted_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.SERVICE_PROVIDER_CAPABILITY_GRANTED),\n ...ServiceProviderCapabilityGrantEventShape,\n});\n\n/* A lent capability was revoked (#1631). /\nexport const AuditableEvent_ServiceProviderCapabilityRevoked_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.SERVICE_PROVIDER_CAPABILITY_REVOKED),\n ...ServiceProviderCapabilityGrantEventShape,\n /* True when the relationship's ending revoked it, rather than a client administrator. /\n byRelationshipEnd: z.boolean(),\n /\n Why it ended (#1631 review F10): a client administrator revoked it, the relationship ended, or the relationship was\n * narrowed to organization units (which no capability can be carried by). Tells a narrowing apart from a manual\n * revocation, which `byRelationshipEnd` alone cannot.\n /\n endCause: z.enum(ServiceProviderCapabilityGrantEndCause).optional(),\n /* How many standing credentials the firm had obtained under the grant were ended with it (review F2). /\n endedCredentials: z.number().int().nonnegative().optional(),\n});\n\n/* A client's decision about trusting a firm's identity provider's MFA on one relationship (#1633). /\nexport const AuditableEvent_ServiceProviderMfaTrustChanged_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.SERVICE_PROVIDER_MFA_TRUST_CHANGED),\n relationshipId: z.string(),\n clientOrganizationId: z.string(),\n providerOrganizationId: z.string(),\n previousProviderMfaTrust: z.enum(ServiceProviderMfaTrust),\n providerMfaTrust: z.enum(ServiceProviderMfaTrust),\n actorUserId: z.string().optional(),\n});\n\n/\n A factor recorded on an expert's session for one client organization (#1633).\n \n Names the factor and its SOURCE, never the proof itself. `identityProviderOrganizationId` is present exactly when\n * the source is the firm's trusted identity provider.\n \n assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — the resource tenant's authentication policy is enforced on external experts, per request.\n /\nexport const AuditableEvent_ServiceProviderClientAuthenticationSatisfied_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.SERVICE_PROVIDER_CLIENT_AUTHENTICATION_SATISFIED),\n organizationId: z.string(),\n relationshipId: z.string(),\n providerOrganizationId: z.string(),\n expertUserId: z.string(),\n factor: z.enum(AuthMethod),\n source: z.enum(FactorSatisfactionSource),\n identityProviderOrganizationId: z.string().optional(),\n});\n\n/* A firm's decision about collecting activity metadata on its own experts' client work (#1632). /\nexport const AuditableEvent_ServiceProviderActivityFeedDecided_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.SERVICE_PROVIDER_ACTIVITY_FEED_DECIDED),\n providerOrganizationId: z.string(),\n previousStatus: z.enum(ServiceProviderActivityFeedStatus),\n status: z.enum(ServiceProviderActivityFeedStatus),\n acknowledgedWorkerConsultationNotice: z.boolean(),\n actorUserId: z.string().optional(),\n});\n\n/* A client's decision about how much a firm's activity feed may say about work in it (#1632). /\nexport const AuditableEvent_ServiceProviderActivityFeedDisclosureChanged_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.SERVICE_PROVIDER_ACTIVITY_FEED_DISCLOSURE_CHANGED),\n relationshipId: z.string(),\n clientOrganizationId: z.string(),\n providerOrganizationId: z.string(),\n previousActivityFeedDisclosure: z.enum(ServiceProviderActivityFeedDisclosure),\n activityFeedDisclosure: z.enum(ServiceProviderActivityFeedDisclosure),\n actorUserId: z.string().optional(),\n});\n\n/\n One transition in the life of a system-of-record partition assignment.\n \n Read it to answer \"who could see this remote company, and when did that start or stop\". The row\n * names both units on a move, so a timeline reconstructed from these events is complete without\n * joining anything: each row carries the state it left as well as the state it reached.\n \n assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE\n * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE\n /\nexport const AuditableEvent_SystemOfRecordPartitionAssignmentLifecycle_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.SYSTEM_OF_RECORD_PARTITION_ASSIGNMENT_LIFECYCLE),\n\n /* Which transition this row records. /\n transition: z.enum(SystemOfRecordPartitionAssignmentTransition),\n /* The assignment row, so its whole timeline can be reassembled. /\n assignmentId: z.string(),\n /* The declared instance — `systemsOfRecord.<name>`. Instance, never vendor: two Odoo deployments have unrelated company ids. /\n system: z.string(),\n /* The partition's key as the remote spells it, in canonical text. /\n remoteKey: z.string(),\n /\n The unit the partition belongs to AFTER this transition.\n \n Absent exactly when the transition is `UNASSIGNED` — there is no resulting unit, and writing the\n * departed one here would make an unassignment read as an assignment to the unit that lost it.\n /\n organizationUnitId: z.string().optional(),\n /\n The unit the partition belonged to BEFORE this transition.\n \n Present on `REASSIGNED` and `UNASSIGNED`, absent on `ASSIGNED`. This is the field the automatic\n * `RESOURCE_OPERATION_PERFORMED` row cannot carry, and the reason this event type exists.\n /\n previousOrganizationUnitId: z.string().optional(),\n /* The operator's stated reason. Recorded on every transition, not only the first. /\n justification: z.string().optional(),\n /* The operator who made the change. /\n assignedByUserId: z.string().optional(),\n});\n\nexport const AuditableEvent_CrossTenantAdministrativeAccess_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.CROSS_TENANT_ADMINISTRATIVE_ACCESS),\n\n /* The tenant that was reached into — the row's organization, never the caller's own. /\n targetOrganizationId: z.string(),\n /* The resource whose row the operator acted on. /\n resourceType: z.string(),\n /* The verb — a core operation (`update`, `delete`) or a custom identifier (`grantOwnership`). /\n operationIdentifier: z.string(),\n /* Which execution surface the crossing arrived on. /\n variantType: z.enum(ResourceOperationVariantType),\n /* The variant discriminator, which is what distinguishes a declared crossing from its siblings. /\n variantKey: z.string().optional(),\n /* The row(s) reached. Absent for collection operations, which name no id. /\n targetResourceIds: z.array(z.string()).optional(),\n\n /\n The elevation that authorised this crossing, when one did.\n \n This is what joins the two operator-access events into one story: the lifecycle event says an\n * elevation was requested, justified and decided; this field says WHICH elevation a given access\n * was exercised under. Without it a reviewer looking at a crossing has to infer the grant from\n * timestamps, which stops working the moment an operator holds two grants in a day.\n \n Absent on the bootstrap verb (`requestAccess` is exempt — it is how a grant comes into existence)\n * and on any crossing admitted before grants were required.\n /\n authorizingGrantId: z.string().optional(),\n\n /\n WHICH COLLECTION {@link authorizingGrantId} names.\n \n A grant id alone is not resolvable: `platformAccessGrants` and `applicationAccessGrants` are two\n * resources with two collections, and a reviewer handed only an id has to try both. Absent exactly\n * when `authorizingGrantId` is.\n /\n authorizingGrantScope: z.enum(PlatformAccessGrantScope).optional(),\n\n /\n Did the operation variant DECLARE this crossing (`admitsCrossTenantPlatformAdministration`)?\n \n `false` is the signal worth alerting on: an ATTEMPTED crossing that no variant asked for and no\n * specification describes. It was refused, so the row records an attempt rather than a completed\n * access. See this schema's JSDoc.\n /\n admissionDeclared: z.boolean(),\n /* The caller's roles as they were at decision time. /\n initiatorRoles: z.array(z.string()),\n /* How the call was initiated — separates a human operator from framework machinery. /\n executionType: z.enum(ExecutionContext_ExecutionType),\n /\n The credential that read, when the reader is a MACHINE. A machine has no `userId`, so without this the\n * row names no reader at all — an assurance collector's reads would be unattributable in the very trail it\n * measures, and could not be told apart from its own earlier runs (#297). Absent for a human operator.\n /\n machineCredential: ExecutionContext_MachineCredentialSchema.optional(),\n});\n\n/\n An application-wide directory enumeration.\n \n See {@link CoreAuditableEventType.PLATFORM_DIRECTORY_ACCESS} for why this is a distinct event\n * type rather than a shape of the cross-tenant one. The short version: there is no target tenant to\n * name, because the read deliberately spans them all.\n /\nexport const AuditableEvent_PlatformDirectoryAccess_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.PLATFORM_DIRECTORY_ACCESS),\n\n /* The directory that was enumerated (`users`, `anonymousUsers`, …). /\n resourceType: z.string(),\n /* The collection verb — `list`, `search`, `count`. /\n operationIdentifier: z.string(),\n /* Which execution surface the read arrived on. /\n variantType: z.enum(ResourceOperationVariantType),\n /\n The variant discriminator.\n \n Load-bearing rather than decorative: on `users` the DEFAULT `list` variant is `INTERNAL_CALL`\n * and registers no route, while the HTTP-exposed one is the non-default `admin` variant. A\n * reviewer who cannot tell the two apart cannot tell an internal enumeration from an operator\n * browsing the directory.\n /\n variantKey: z.string().optional(),\n /\n How many rows the caller actually received.\n \n The size is the signal. \"An operator opened the user directory\" is routine; \"an operator paged\n * through 40,000 users\" is the shape of an export, and only this field distinguishes them.\n /\n returnedCount: z.number().int().nonnegative(),\n /* The caller's roles as they were at read time. /\n initiatorRoles: z.array(z.string()),\n /* How the call was initiated — separates a human operator from framework machinery. /\n executionType: z.enum(ExecutionContext_ExecutionType),\n\n /\n The application-wide elevation that authorised this directory read.\n \n Until 2026-09-09 this event named NO elevation, because none was required — the read was gated on\n * an administrator role alone while the far narrower per-row crossing required a usable, time-bound,\n * approved grant. That inversion is what `applicationAccessGrants` closes, and this field is the\n * evidence half of the closure: it is what joins a directory read to the two administrators who\n * signed for it.\n \n Absent on a read the admission does not gate — an exempt execution type (batch, webhook), or a\n * read the confinement authority confined, neither of which is an elevation.\n /\n authorizingGrantId: z.string().optional(),\n /* WHICH collection {@link authorizingGrantId} names. Absent exactly when it is. /\n authorizingGrantScope: z.enum(PlatformAccessGrantScope).optional(),\n});\n\nexport const AuditableEvent_ResourceOperationDenied_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.RESOURCE_OPERATION_DENIED),\n\n // ── Why (the discriminator a security-operations dashboard groups by) ──\n /* Which refusal the authorizer resolved. /\n denialReason: z.enum(ResourceOperationDenialReason),\n\n // ── Operation identity (the same TRIPLE as the success twin — see its JSDoc for why) ──\n /* The resource whose row(s) the caller attempted to act on. /\n resourceType: z.string(),\n /* The verb — a core operation (`update`, `delete`) or a custom identifier (`suspend`). /\n operationIdentifier: z.string(),\n /* Which execution surface the attempt arrived on. /\n variantType: z.enum(ResourceOperationVariantType),\n /\n The variant discriminator. Absent on the default variant; REQUIRED to distinguish e.g. the\n * `admin` variant of a verb from its `self` twin, which share `operationIdentifier`.\n /\n variantKey: z.string().optional(),\n /* The core persistence semantics a custom verb borrows. Absent when the verb IS a core operation. /\n resourceOperationLike: z.enum(CoreResourceOperation).optional(),\n /* `true` for the bulk form, whose subject is a set rather than one row. /\n isBulkOperation: z.boolean().optional(),\n\n // ── Subject (what was ATTEMPTED — never proof the row exists) ──\n /\n The row id(s) the caller named. Present even for {@link ResourceOperationDenialReason.SUBJECT_NOT_RESOLVABLE},\n * where the id may correspond to nothing at all — this records what was ASKED FOR, not what exists.\n * Absent for collection operations, which name no id.\n /\n attemptedResourceIds: z.array(z.string()).optional(),\n\n // ── Authority (what was required vs. what was held) ──\n /\n The role set the operation demanded. Together with {@link initiatorRoles} this makes the refusal\n * self-explaining: a reviewer sees what was needed and what the caller had, without re-deriving\n * the operation's config as it stood that day.\n /\n requiredRoles: z.array(z.string()).optional(),\n /\n The roles the caller tried to GRANT and could not — present only on\n * {@link ResourceOperationDenialReason.ROLE_CEILING_EXCEEDED}.\n \n A third set, distinct from both of its neighbours and not expressible by either: `requiredRoles`\n * is what the OPERATION demanded of the caller, `initiatorRoles` is what the caller HELD, and this\n * is what the caller attempted to confer on somebody else. It is the whole content of an\n * escalation attempt — \"an ORG_ADMIN asked for ORG_OWNER\" — and without it the row says only that\n * a ceiling was hit.\n \n Only the REFUSED subset is recorded, not the whole requested array: the roles the caller was\n * entitled to grant are not evidence of anything, and the difference is what a reviewer reads.\n /\n escalatedRoles: z.array(z.string()).optional(),\n /\n The surface the person called, when the refusal happened on one that is NOT a resource operation — a\n * manual-controller route (`GET /api/v1/charts/:chartId/data`) or a WebSocket event (`badge:get`).\n \n On such a surface the operation fields above name only the context it was authorized under (an\n * application read), which on its own cannot tell a chart from a feature resolution (#534 third review L3).\n * Absent on a resource operation, whose operation fields already ARE the surface. Carries a route TEMPLATE\n * where one is known, so the trail records which door was refused rather than which row was asked for.\n /\n refusedSurface: z.string().optional(),\n /\n The caller's roles AS THEY WERE at decision time — empty when the refusal WAS the absence of\n * them ({@link ResourceOperationDenialReason.MISSING_INITIATOR}).\n /\n initiatorRoles: z.array(z.string()),\n /* How the call was initiated — separates a human request from framework machinery. /\n executionType: z.enum(ExecutionContext_ExecutionType),\n /* Machine-credential provenance when the refused principal is a machine rather than a human. /\n machineCredentialAuthMethod: z.string().optional(),\n machineCredentialId: z.string().optional(),\n\n // ── Cascade depth (the request that groups the whole cascade is the row's top-level `correlationId`) ──\n /* `0` for the operation the caller invoked; deeper for what it cascaded into. /\n subCallDepth: z.number(),\n\n // ── Burst accounting (see the dedup ladder in this schema's JSDoc) ──\n /\n How many identical refusals (same principal, operation and reason) have accumulated in the\n * current dedup window INCLUDING this one. `1` on the first. A row with a large value is a\n * deliberate escalation checkpoint, not a duplicate.\n /\n occurrenceCount: z.number(),\n /\n `true` when the count is exact (the dedup counter was reachable). `false` when the counter store\n * was unavailable and the emission fell open — the row is then a truthful record of ONE refusal\n * whose burst context is unknown, and {@link occurrenceCount} is not to be trusted as a total.\n /\n occurrenceCountIsExact: z.boolean(),\n});\n\n/\n A privileged SEE-THROUGH read that revealed RETAINED (impersonalized-and-retained) records —\n * rows kept for a legal/audit obligation while their personal data was scrubbed, hidden from\n * normal callers by the retention hide-predicate. This is the compliance-grade access record over\n * that scrubbed data, and its two defining properties (vs `SYSTEM_CONTEXT_READ`, which names only the\n * RUNTIME that acted, never a human) are:\n \n 1. Human attribution — `accessingUserId` names the actual human who exercised the see-through,\n * so a retained-data reveal is never anonymous. Non-empty (`.trim().min(1)`) — a blank id cannot\n * stand in for a human. The gate admits `APP_ADMIN_SUPER_ADMIN` and nothing else; a dedicated\n * auditor role does not exist yet, and adding one is a purely additive change to that gate.\n * 2. A required reason — `reason` is the mandatory justification for revealing scrubbed PII.\n * Non-empty (`.trim().min(1)`): a blank OR whitespace-only reason fails validation, so the audit\n * trail cannot record a reveal without a real \"why\". The see-through primitives ALSO fail-closed on\n * blank attribution before the read (the schema `.min(1)` is the contract; the primitive guard is\n * the enforcement point, since the audit store persists `eventData` as an unparsed record).\n \n Strictly read-only (the see-through primitive never mutates). Emitted TODAY by both see-through\n * read primitives, `readRetainedAsSystem` and `listRetainedAsSystem`: each calls\n * `logRetainedDataAccess` after its gates pass, so this is a live event, not a contract awaiting a\n * producer.\n /\nexport const AuditableEvent_RetainedDataAccess_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.RETAINED_DATA_ACCESS),\n /* The HUMAN principal who performed the see-through read (an application super-administrator). Non-empty. /\n accessingUserId: z.string().trim().min(1),\n /* REQUIRED non-empty compliance justification for revealing the retained (scrubbed) records — the \"why\". /\n reason: z.string().trim().min(1),\n /* The resource type whose retained rows were revealed. /\n resourceType: z.string(),\n /* Present for a single-record see-through read; absent for a list/search reveal. /\n resourceId: z.string().optional(),\n /* For a list/search see-through: how many retained rows the query revealed. /\n retainedRecordCount: z.number().optional(),\n /* The see-through primitive that ran (e.g. `readRetainedAsSystem` / `listRetainedAsSystem`). /\n operationIdentifier: z.string(),\n /* The privileged role(s) that authorized the see-through (roles are the single authorization axis). /\n roles: z.array(z.string()).optional(),\n /* Tenant scope of the accessed data (organizationId), when the read was org-scoped. /\n organizationId: z.string().optional(),\n ipAddress: z.string().optional(),\n});\n\n/\n A person met a governed document, and this is the release they met.\n \n `interaction` is the composed record from `composeGovernedDocumentInteraction`, which has already\n * refused anything the release does not permit and marked anything the workflow has not finished.\n * It is nested rather than flattened so there is ONE shape for a governed-document interaction — a\n * second, flatter copy here would be a second thing to keep in step with the release vocabulary.\n \n The SUBJECT is the audit envelope's own actor attribution plus `userId` here, never a third\n * spelling inside the record; see the interaction schema's JSDoc for why.\n \n assurance-control: WILDO.PRIVACY.CONSENT_RECORD\n /\nexport const AuditableEvent_GovernedDocument_InteractionRecordedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.GOVERNED_DOCUMENT_INTERACTION_RECORDED),\n /\n The identified person who met the document. Absent exactly when `anonymousUserId` is present\n * (#1258 Step 5) — a signed-in registrant or an already-identified reader has one; a visitor\n * reading a public notice before ever creating an account does not.\n /\n userId: z.string().optional(),\n /\n The pre-identity visitor who met the document, when nobody is signed in (#1258 Step 5).\n * `AnonymousUser._id` / `ExecutionContext.anonymousUserId` — the same identity Step 1's consent\n * carry is keyed on, never a second visitor-identity concept.\n /\n anonymousUserId: z.string().optional(),\n /* What they did, which release they did it to, and that release's standing at the time. /\n interaction: GovernedDocumentInteractionSchema,\n /\n TRUE-but-unfinished notes carried from composition — today, that the release was UNAPPROVED.\n \n Recorded rather than discarded because an advisory is the only trace that the mechanism\n * proceeded deliberately rather than by omission.\n /\n advisoryKinds: z.array(z.string()),\n ipAddress: z.string().optional(),\n}).superRefine((event, context) => {\n // Exactly one subject, never zero (a record naming nobody is not a record) and never both (two\n // identities for one act is two different claims about who acted).\n const hasUser = event.userId !== undefined;\n const hasAnonymous = event.anonymousUserId !== undefined;\n if (hasUser === hasAnonymous) {\n context.addIssue({\n code: 'custom',\n path: hasUser ? ['anonymousUserId'] : ['userId'],\n message: hasUser\n ? 'a governed-document interaction names both userId and anonymousUserId — exactly one subject met the document'\n : 'a governed-document interaction names neither userId nor anonymousUserId — a record must name who met the document',\n });\n }\n});\n\n/\n A DATA SUBJECT EXPORT — the compliance record of the framework assembling everything it holds\n * about one person and disclosing it.\n \n This is the most sensitive READ the framework performs, and the one an access-request audit turns\n * on. Its defining properties:\n \n 1. A named subject — `subjectResourceType` + `subjectIds`: WHOSE data left the system. An\n * export event that cannot name its subject is not an access record.\n * 2. A named purpose — `purpose` is a `SubjectExportPurpose`. Art. 15 and Art. 20 produce\n * genuinely different bundles, so an audit trail that recorded only \"an export happened\" could\n * not later establish which right was answered or whether it was answered completely.\n * 3. What was actually included — `includedResourceTypes` + `totalRecordCount`, and\n * `fieldsExcludedAsDerived` for the Art. 20 narrowing. The OMISSIONS matter as much as the\n * contents: \"why was this not in my export?\" must have a recorded answer.\n \n Carries NO personal data — resource types, ids, counts and field NAMES only. Recording the\n * exported values would turn the record of a disclosure into a second copy of it, in a store with\n * a longer retention than the export artifact itself.\n \n assurance-control: WILDO.PRIVACY.SUBJECT_DATA_EXPORT\n /\nexport const AuditableEvent_SubjectDataExport_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.SUBJECT_DATA_EXPORT),\n /* WHICH data-subject right this export answered — the two produce different bundles. /\n purpose: z.string().trim().min(1),\n /* The exported subject's resource type. /\n subjectResourceType: z.string().trim().min(1),\n /* The exported subject rows. Non-empty: an export with no subject is not an export. /\n subjectIds: z.array(z.string()).min(1),\n /* Every resource that actually contributed rows to the bundle. /\n includedResourceTypes: z.array(z.string()),\n /* Total rows disclosed across the whole bundle. /\n totalRecordCount: z.number(),\n /\n `resourceType.fieldName` locators omitted from an Art. 20 bundle as controller-derived. Empty\n * for an Art. 15 access export, which discloses every field regardless of provenance.\n /\n fieldsExcludedAsDerived: z.array(z.string()),\n /\n `resourceType.fieldName` locators withheld as NON-DISCLOSABLE regardless of right — secrets and\n * backend-only values the export refuses to hand out. Recorded so a thin bundle reads as a\n * deliberate security floor rather than a missed resource.\n /\n fieldsWithheldAsNonDisclosable: z.array(z.string()),\n /* Tenant scope, when the export ran org-scoped. /\n organizationId: z.string().optional(),\n /\n Whether the application declares its subject-data recipients (#1710) — `declared` or `not-declared`. The value an\n * evidence collector tallies: an export answering Art. 15(1)(c) from a declaration, versus one that could not.\n /\n recipientsStatus: z.enum(SubjectDataRecipientsStatementStatus),\n /* The recipients (provider refs) the export named for this subject, sorted. Systems of record are accounted on their own lane. /\n recipientRefs: z.array(z.string().trim().min(1)),\n});\n\n/\n A COLLECTION EXPORT — an operator rendered a resource listing to a file and downloaded it.\n \n ## What it must answer, and what it must never carry\n \n The reviewer's questions are: which listing, in what shape, and how much left. So the row\n * count is mandatory and the row scope is recorded verbatim — \"they exported the page they were\n * looking at\" and \"they exported the whole table\" are the same action with very different\n * consequences, and only this field separates them after the fact.\n \n `filterFieldNames` records WHICH filters narrowed the export, never their values. A filter\n * value is frequently personal data (`?email=…`, `?assigneeId=…`), so recording it would turn the\n * record of a disclosure into a second copy of it, in a store that outlives the exported file — the\n * same rule {@link AuditableEvent_SubjectDataExport_EventDataSchema} follows (\"resource types, ids,\n * counts and field NAMES only\"). No row content, ever.\n \n ## Why the severity is static and the risk is not\n \n `AUDIT_EVENT_CLASSIFICATION_MAP` is keyed by event TYPE, so severity cannot vary per emission.\n * Classifying every export WARNING would put a routine twenty-row page download beside a whole-table\n * dump and train reviewers to skim the channel; classifying every export INFO would leave the dump\n * indistinguishable. The distinction therefore rides on `riskLevel`, which IS per-emission and is an\n * indexed summary column on the audit row: LOW for a page, HIGH for a full result set.\n \n Rejected: two event types. A page export and a full export are one action with one parameter,\n * and splitting the vocabulary to vary a field would make every consumer match two types forever.\n \n assurance-control: WILDO.PRIVACY.COLLECTION_DATA_EXPORT\n /\nexport const AuditableEvent_CollectionDataExport_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.COLLECTION_DATA_EXPORT),\n /* The exported resource. /\n resourceType: z.string().trim().min(1),\n /* The LIST/SEARCH operation whose result set was exported. /\n sourceOperationIdentifier: z.string().trim().min(1),\n /* The rendered wire format — a `ResourceCollectionExportFormat` value (`csv`, `json` or `pdf`). /\n format: z.string().trim().min(1),\n /* `visible_page` \| `full_result_set` — see the docstring; this is the field that matters most. /\n rowScope: z.string().trim().min(1),\n /* Rows actually written to the file. Mandatory: an export event with no count answers nothing. /\n rowCount: z.number().int().nonnegative(),\n /* Names of the filters that narrowed the export. NEVER their values. /\n filterFieldNames: z.array(z.string()),\n /* Tenant scope, when the export ran org-scoped. /\n organizationId: z.string().optional(),\n});\n\n/\n The application CALLED a declared operation on a third-party provider (S3a/S3b; see the enum\n * member's docstring for why this is neither an HTTP_API read-through nor a credential-use event).\n \n One event per OUTBOUND CALL, emitted on both the success and the failure path. Recording only\n * what worked would hide the attempts, and a refused or failed outbound call is exactly what a\n * reviewer wants to see first.\n \n Ids and SHAPE only, never a payload. There is no field for the request body, the response body or\n * the credential — a structural property of this schema rather than a redaction step somebody has to\n * remember, for the same reason the credential family carries no value field.\n \n assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT — records WHOSE third-party account\n * an outbound call spent, which the initiator's own ids cannot answer once one execution may spend\n * several.\n /\nexport const AuditableEvent_ProviderOperationCall_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.PROVIDER_OPERATION_CALL),\n /* The provider whose catalogue declared the operation (e.g. `slack`). /\n providerRef: z.string().trim().min(1),\n /* The operation id as the catalogue declares it. /\n operationId: z.string().trim().min(1),\n /* The catalogue domain the operation belongs to. /\n domain: z.string().trim().min(1),\n /* The HTTP method the compiled request used. /\n method: z.string().trim().min(1),\n /* `READ` \| `WRITE`, as the operation declares its effect — the axis a reviewer filters on first. /\n classification: z.string().trim().min(1),\n /\n WHOSE ACCOUNT the call spent: `application` \| `organization` \| `user`.\n \n Deliberately separate from `organizationId` below, which records the tenant the REQUEST was\n * scoped to. Those are the same tenant in the ordinary case and different ones exactly where it\n * matters — a trail carrying only the initiator's organization would attribute a fan-out's calls\n * to the wrong tenants.\n /\n connectionOwnerScope: z.string().trim().min(1),\n /* The owner's id, absent for an application-owned call which names no second party. /\n connectionOwnerId: z.string().optional(),\n /* `service` \| `user` — whether the call acted for the owner itself or on a person's delegation. /\n connectionDelegation: z.string().trim().min(1),\n /* HTTP status of the answer; absent when the call never got one. /\n status: z.number().int().optional(),\n /* Present when the call failed, naming the failure KIND rather than the vendor's prose. /\n failureKind: z.string().optional(),\n /\n The `requiredScopes` verdict (#979) — present only when the operation declares required scopes. `not_recorded`\n * is the one to read twice: the call went out without its scopes being checked.\n /\n scopeCheck: z.enum(ProviderOperationScopeCheck).optional(),\n /* The required scopes the grant lacked — present with `scopeCheck: missing`. Scope names only, never a token. /\n missingScopes: z.array(z.string()).optional(),\n /* The REAL initiating user — absent only for genuine machine/internal executions. /\n initiatorUserId: z.string().optional(),\n /* The execution type that acted, for the machine/internal cases. /\n executionType: z.string().optional(),\n /* The tenant the REQUEST was scoped to — see `connectionOwnerScope`. /\n organizationId: z.string().optional(),\n /\n The package that CONTRIBUTED this operation when it is not the provider's own (#1672) — an augmentation\n * an application opted into, adding operations to a provider it does not own. Absent for an operation the\n * provider's own module declares.\n \n The question it answers is the one a shared grant raises: when a call spends a connection the base\n * provider owns, whose code wrote the request? Without it a reviewer sees the base ref and cannot tell the\n * base's own operation from a third party's.\n /\n augmentationPackage: z.string().optional(),\n /* The installed version of {@link augmentationPackage}, as `wildo config sync` recorded it. /\n augmentationPackageVersion: z.string().optional(),\n /\n The CONNECTION whose grant the call spent (#1725) — the declared base of a shared connection, or the ref itself.\n * On a shared connection `providerRef` names only the ref the call went THROUGH; this names the grant.\n /\n connectionRef: z.string().optional(),\n /* The npm package that owns `providerRef` — whose code the call ran, when several packages share one grant. /\n providerPackageName: z.string().optional(),\n /\n The resource AUDIENCE whose token was attached (#1725) — `graph`, `dataverse` — when the connection's grant spans\n * several resources. Absent for a provider that mints one token for one resource.\n /\n tokenAudience: z.string().optional(),\n /\n What the call's RATE BUDGETS cost it (#1729). A vendor's allowance belongs to the connection (and, where the vendor\n * counts per account, to the account it spends), so every call names the budgets it drew on — keys only, never a\n * count of anyone's traffic — how long it waited for room, and whether the count was the deployment's SHARED one or\n * this process's alone. On a refusal, `exhaustedBudgetKey` names the budget that was still full: an exhausted\n * allowance is visible here instead of arriving as a vendor `429`.\n /\n rateBudget: z.object({\n budgetKeys: z.array(z.string()),\n counting: z.enum(RateBudgetCounting),\n waitedMs: z.number().nonnegative(),\n exhaustedBudgetKey: z.string().optional(),\n }).optional(),\n});\n\n/\n The backend CALLED a vendor to discharge an engine capability (#1712) — see the enum member for why this is\n * neither a catalogue operation call nor a record about the data's subject.\n \n One event per PHYSICAL call the egress controls, on the success and the failure path. The granularity is the\n * egress's own act: one email submission, one SMS, one storage verb, one billing adapter call. A billing adapter\n * call that pages through a list may make several HTTP requests to the vendor under one row, as an agent turn does\n * under one `providerCallRecords` row; the count is of the application's acts, not of the vendor's requests.\n \n No field names a subject — no recipient, number, file, customer or payload — so the schema, not a redaction\n * step, is what keeps it out of the personal-data population.\n \n assurance-control: WILDO.INTEGRATION.OUTBOUND_ACTIVITY_AUDIT — records which vendor each capability reached,\n * with what outcome, for every call the application made.\n /\nexport const AuditableEvent_ProviderCapabilityCall_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.PROVIDER_CAPABILITY_CALL),\n /* The egress the call went out through. /\n capability: z.enum(ProviderCapabilityEgress),\n /* What it did. /\n action: z.enum(ProviderCapabilityCallAction),\n /\n The vendor: the provider ref the capability resolved (`resend`, `twilio`, `stripe`), or, for file storage, the\n * storage the file is kept in (`wildo_managed`, `google_drive`).\n /\n providerRef: z.string().trim().min(1),\n /* The engine capability the egress served, when it serves several (email: transactional or marketing). /\n engineCapability: z.string().optional(),\n /* The billing adapter method, for {@link ProviderCapabilityCallAction.BILLING_OPERATION}. A method NAME, never its arguments. /\n billingOperation: z.string().optional(),\n outcome: z.enum(ProviderCapabilityCallOutcome),\n /* HTTP status of the vendor's answer, when the egress observes one. /\n status: z.number().int().optional(),\n /\n The failure KIND (an error type or a submission outcome), never the vendor's prose, which may quote the request. The\n * recorder keeps it to an identifier-shaped token and replaces anything else with `unclassified`, so an SDK error\n * that carried text in its code cannot put that text on the trail.\n /\n failureKind: z.string().optional(),\n /* WHOSE account the call spent: `application` \| `organization` \| `user` — the vocabulary its siblings use. /\n connectionOwnerScope: z.string().trim().min(1),\n /\n The owner's id; absent for the application's own account. For a person's Drive this is the file's LINKER, who may\n * not be the reader — the reason this event exports at SUBJECT_DETAIL.\n /\n connectionOwnerId: z.string().optional(),\n /* The REAL initiating user, when the egress runs under an execution context that has one. /\n initiatorUserId: z.string().optional(),\n /* The execution type that acted, when the egress runs under an execution context. /\n executionType: z.string().optional(),\n /* The tenant the call was made for, when the egress knows one (an email sent for an organization). /\n organizationId: z.string().optional(),\n});\n\n/\n The browser door REFUSED a provider operation (#367) — see the enum member for why this is not a\n * failed call.\n \n Ids and shape only, like its call sibling: the request's `input` is never recorded. What the caller\n * ASKED FOR is recorded even when it names nothing real, because a refusal records an attempt rather\n * than proving the provider or operation exists.\n \n assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT\n /\nexport const AuditableEvent_ProviderOperationDenied_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.PROVIDER_OPERATION_DENIED),\n denialReason: z.enum(ProviderOperationDenialReason),\n /* The provider the request named. /\n providerRef: z.string().trim().min(1),\n /* The operation id the request named. /\n operationId: z.string().trim().min(1),\n /* The account the request asked to spend: `application` \| `organization` \| `user`. /\n connectionOwnerScope: z.string().trim().min(1),\n /* The owner's id, absent for an application-owned request. /\n connectionOwnerId: z.string().optional(),\n /* `service` \| `user`, as requested. /\n connectionDelegation: z.string().trim().min(1),\n /\n The roles the policy required — present on {@link ProviderOperationDenialReason.INSUFFICIENT_ROLES}\n * and {@link ProviderOperationDenialReason.ROLES_NOT_APPLICABLE_TO_TARGET}.\n /\n requiredRoles: z.array(z.string()).optional(),\n /\n The roles the caller held IN THE SCOPE THAT WAS CHECKED, at decision time — present on\n * {@link ProviderOperationDenialReason.INSUFFICIENT_ROLES}, so the row explains itself.\n /\n heldRoles: z.array(z.string()).optional(),\n /* The refused person. Absent only on {@link ProviderOperationDenialReason.MISSING_USER_SESSION}. /\n initiatorUserId: z.string().optional(),\n /* The execution type that asked, which is what explains a missing user. /\n executionType: z.string().optional(),\n /* The tenant the REQUEST was scoped to. /\n organizationId: z.string().optional(),\n});\n\n/\n An agent reached an MCP server — the outbound trail for a tool call that leaves the trust\n * boundary (#491).\n \n One event per ATTEMPT, successful or not. Recording only what worked would hide exactly what a\n * reviewer wants first: the refused targets, the calls that timed out, and the tools that answered\n * with their own error. `outcome` names which of those it was, in the client's own vocabulary, so\n * the trail and the logs agree on the words.\n \n Ids, HOST and SHAPE only — never a payload. There is no field for the tool arguments, the tool\n * result or the credential. That is a structural property of this schema rather than a redaction\n * step somebody has to remember, the same choice the provider-call and credential families make.\n * `destinationHost` and not the URL, because an MCP endpoint routinely carries a tenant or session\n * identifier in its path.\n \n assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT — records WHOSE third-party account\n * an agent's tool call spent, which the initiator's own ids cannot answer once one turn may spend\n * either the person's or the tenant's.\n /\nexport const AuditableEvent_McpToolCall_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.MCP_TOOL_CALL),\n /* The server ref the application declared and the agent named. /\n mcpServerRef: z.string().trim().min(1),\n /* HOST only — see the docstring for why never the URL. /\n destinationHost: z.string().trim().min(1),\n /* The tool called. Absent when the attempt failed before any tool was chosen (discovery). /\n toolName: z.string().optional(),\n /\n The client's outcome kind — `ok`, `refused_target`, `unreachable`, `timed_out`, `protocol_error`, `tool_error`, or\n * `rate_budget_exhausted` (the connection's rate budget stayed full; nothing was sent — #1938).\n /\n outcome: z.string().trim().min(1),\n /\n WHOSE ACCOUNT the call spent: `user` \| `organization`. Absent when no credential was resolved,\n * which is itself the reason the attempt failed.\n \n Separate from `organizationId` for the same reason as the provider-call event: those are the\n * same tenant in the ordinary case, and different ones exactly where it matters.\n /\n connectionOwnerScope: z.string().optional(),\n /* The credential row that was spent, for the audit trail. /\n credentialId: z.string().optional(),\n /\n WHOSE credential it was: the member who set an organization credential. For an organization-lent\n * member account (decision on wildo-ai/wildo-ai#18) that is the person the far server attributes the\n * call to, captured at call time rather than joined later, since a reconnect moves it.\n /\n credentialSetByUserId: z.string().optional(),\n /* The REAL initiating user — absent only for genuine machine/internal executions. /\n initiatorUserId: z.string().optional(),\n /* The tenant the turn was scoped to — see `connectionOwnerScope`. /\n organizationId: z.string().optional(),\n /* The agent whose declaration named the server, so a trail can be read back to a configuration. /\n agentRef: z.string().optional(),\n});\nexport type AuditableEvent_McpToolCall_EventData = z.infer<typeof AuditableEvent_McpToolCall_EventDataSchema>;\nexport type AuditableEvent_ProviderCapabilityCall_EventData = z.infer<typeof AuditableEvent_ProviderCapabilityCall_EventDataSchema>;\n\n/\n The fields every human-decision event carries: which decision, on which plane, raised by which\n * agent's work, routed how. Ids and names only (#1595 D5).\n /\nconst HumanDecisionEventBaseShape = {\n /* The one decision id (`HumanDecision_Request.decisionId`), shared by both planes and every row about this decision. /\n decisionRef: z.string().trim().min(1),\n /* The execution whose work is waiting — the conversational execution or the actor-system execution. /\n executionId: z.string().trim().min(1),\n plane: z.enum(HumanDecision_Plane),\n /* The actor system the work belongs to. /\n systemRef: z.string().trim().min(1).optional(),\n /* The agent whose gate raised the decision. /\n agentRef: z.string().trim().min(1).optional(),\n /* The gated tool, when the decision is a tool approval. /\n toolName: z.string().trim().min(1).optional(),\n routeKind: z.enum(HumanDecision_RouteKind),\n /* The route's eligible role — the floor every holder must meet. Absent for OWNER. /\n routeEligibleRole: z.string().trim().min(1).optional(),\n /* The tenant the decision is routed within. /\n organizationId: z.string().optional(),\n};\n\n/* A decision was raised. /\nexport const AuditableEvent_HumanDecisionRequested_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.HUMAN_DECISION_REQUESTED),\n ...HumanDecisionEventBaseShape,\n requesterKind: z.enum(HumanDecision_RequesterKind),\n /* ASSIGNEE routes only: who it was routed to. /\n assigneeUserId: z.string().optional(),\n /* When answering is refused. Absent means the decision does not lapse. /\n expiresAt: z.string().optional(),\n /* #1628: the armed CLAIM deadline, and the clock it counts on. Absent on the actor plane before a host arms one. /\n claimDeadlineAt: z.string().optional(),\n claimClockBasis: z.enum(ReviewClockBasis).optional(),\n /* #1628: the armed DECISION deadline, and the clock it counts on. /\n decisionDeadlineAt: z.string().optional(),\n decisionClockBasis: z.enum(ReviewClockBasis).optional(),\n});\nexport type AuditableEvent_HumanDecisionRequested_EventData = z.infer<typeof AuditableEvent_HumanDecisionRequested_EventDataSchema>;\n\n/* A decision ended. Exactly one per `decisionRef`. /\nexport const AuditableEvent_HumanDecisionResolved_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.HUMAN_DECISION_RESOLVED),\n ...HumanDecisionEventBaseShape,\n outcome: z.enum(HumanDecision_Outcome),\n /* The person who decided. Absent for LAPSED and for a WITHDRAWN nobody answered. /\n decidedByUserId: z.string().optional(),\n /* The decider's roles in the decision's organization at the moment they decided. /\n deciderRoles: z.array(z.string()).optional(),\n /* The route role that admitted the decider (ROLE and ASSIGNEE routes). /\n admittedByRouteRole: z.string().optional(),\n /* ACCEPTED_WITH_MODIFICATIONS: the argument NAMES the decider changed, sorted. Never their values. /\n modifiedArgumentNames: z.array(z.string()).default([]),\n /* Whether the decider gave a reason. The reason itself stays in the transcript, not on the trail. /\n reasonGiven: z.boolean(),\n /* LAPSED only: a person who answered after the deadline, whose answer was therefore refused. /\n lateDecisionUserId: z.string().optional(),\n /* #1628: whether each armed service target was met. A clock that was never armed is absent, never guessed. /\n deadlineOutcomes: z.partialRecord(z.enum(ReviewDeadlineKind), z.enum(ReviewDeadlineOutcome)).optional(),\n});\nexport type AuditableEvent_HumanDecisionResolved_EventData = z.infer<typeof AuditableEvent_HumanDecisionResolved_EventDataSchema>;\n\n/* A decision was moved — reassigned or escalated. /\nconst HumanDecisionMoveShape = {\n ...HumanDecisionEventBaseShape,\n /* Who held it before the move. Absent when it moved off a ROLE route nobody had claimed. /\n fromAssigneeUserId: z.string().optional(),\n /* Who holds it now. /\n toAssigneeUserId: z.string().trim().min(1),\n /* The route version after the move; an answer read under an older version loses. /\n routeVersion: z.number().int().nonnegative(),\n /* Whether the mover gave a reason. The reason itself is not recorded here. /\n reasonGiven: z.boolean(),\n};\n\nexport const AuditableEvent_HumanDecisionReassigned_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.HUMAN_DECISION_REASSIGNED),\n ...HumanDecisionMoveShape,\n /* #1628: a person's move, or a deadline's REASSIGN rule — so a rule-driven move is never read as a choice. /\n trigger: z.enum(HumanDecision_RouteChangeTrigger),\n /* ESCALATION_RULE only: the stage whose rule moved it. /\n stage: z.enum(ReviewDeadlineStage).optional(),\n});\nexport type AuditableEvent_HumanDecisionReassigned_EventData = z.infer<typeof AuditableEvent_HumanDecisionReassigned_EventDataSchema>;\n\nexport const AuditableEvent_HumanDecisionEscalated_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.HUMAN_DECISION_ESCALATED),\n ...HumanDecisionMoveShape,\n /* True when the target came from the gate's declared `escalateTo`, false when the escalator named it. /\n toDeclaredTarget: z.boolean(),\n});\nexport type AuditableEvent_HumanDecisionEscalated_EventData = z.infer<typeof AuditableEvent_HumanDecisionEscalated_EventDataSchema>;\n\n/* A role-routed decision was claimed (`claimed: true`) or given back to its role (`claimed: false`). /\nexport const AuditableEvent_HumanDecisionClaimed_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.HUMAN_DECISION_CLAIMED),\n ...HumanDecisionEventBaseShape,\n claimed: z.boolean(),\n /* The holder who claimed, or who gave it back. /\n assigneeUserId: z.string().trim().min(1),\n routeVersion: z.number().int().nonnegative(),\n});\nexport type AuditableEvent_HumanDecisionClaimed_EventData = z.infer<typeof AuditableEvent_HumanDecisionClaimed_EventDataSchema>;\n\n/* Someone tried to act on a decision and was refused. The decision is unchanged. /\nexport const AuditableEvent_HumanDecisionAnswerRefused_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.HUMAN_DECISION_ANSWER_REFUSED),\n ...HumanDecisionEventBaseShape,\n act: z.enum(HumanDecision_Act),\n reason: z.enum(HumanDecision_RefusalReason),\n /* Who tried. Absent when the attempt carried no person at all (a machine principal). /\n attemptedByUserId: z.string().optional(),\n});\nexport type AuditableEvent_HumanDecisionAnswerRefused_EventData = z.infer<typeof AuditableEvent_HumanDecisionAnswerRefused_EventDataSchema>;\n\n/* A CLAIM or DECISION deadline passed (#1628). The decision is unchanged and still answerable. /\nexport const AuditableEvent_HumanDecisionDeadlineMissed_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.HUMAN_DECISION_DEADLINE_MISSED),\n ...HumanDecisionEventBaseShape,\n kind: z.enum(ReviewDeadlineKind),\n /* The deadline that passed, after any pause was added to it. /\n deadlineAt: z.string().trim().min(1),\n basis: z.enum(ReviewClockBasis),\n});\nexport type AuditableEvent_HumanDecisionDeadlineMissed_EventData = z.infer<typeof AuditableEvent_HumanDecisionDeadlineMissed_EventDataSchema>;\n\n/\n A deadline stage's rule fired (#1628). Ids and counts only: who was told is the route's candidates at\n * that moment, recorded as a count so the row holds no list of people that would need scrubbing.\n /\nexport const AuditableEvent_HumanDecisionEscalationFired_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.HUMAN_DECISION_ESCALATION_FIRED),\n ...HumanDecisionEventBaseShape,\n stage: z.enum(ReviewDeadlineStage),\n /* What the stage did. A REASSIGN whose target did not resolve, or could not answer, did NOTIFY instead. /\n action: z.enum(ReviewEscalationActionKind),\n /* Whether a REASSIGN rule was declared for this stage and attempted. /\n reassignAttempted: z.boolean(),\n /* REASSIGN attempted: whether its target resolved to someone who may answer. False: the decision did not move. /\n targetResolved: z.boolean().optional(),\n /* REASSIGN attempted and refused: why the resolved target may not answer (#1594 I8). /\n targetRefusalReason: z.enum(HumanDecision_RefusalReason).optional(),\n /* REASSIGN applied: who held it before (absent for an unclaimed ROLE route) and who holds it now. /\n fromAssigneeUserId: z.string().optional(),\n toAssigneeUserId: z.string().optional(),\n /* REASSIGN applied: the route version after the move. /\n routeVersion: z.number().int().nonnegative().optional(),\n /* How many people were told. Zero is recorded, not hidden: it is the finding. /\n recipientCount: z.number().int().nonnegative(),\n});\nexport type AuditableEvent_HumanDecisionEscalationFired_EventData = z.infer<typeof AuditableEvent_HumanDecisionEscalationFired_EventDataSchema>;\n\n/* A person stopped a decision's CLAIM and DECISION clocks (#1628). The lapse keeps running. /\nexport const AuditableEvent_HumanDecisionClockPaused_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.HUMAN_DECISION_CLOCK_PAUSED),\n ...HumanDecisionEventBaseShape,\n /* The gate-declared pause state. An application identifier, never free text. /\n pauseStateRef: z.string().trim().min(1),\n pausedByUserId: z.string().trim().min(1),\n});\nexport type AuditableEvent_HumanDecisionClockPaused_EventData = z.infer<typeof AuditableEvent_HumanDecisionClockPaused_EventDataSchema>;\n\n/* A person restarted a decision's clocks (#1628); `pausedMs` was added to both service targets. /\nexport const AuditableEvent_HumanDecisionClockResumed_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.HUMAN_DECISION_CLOCK_RESUMED),\n ...HumanDecisionEventBaseShape,\n pauseStateRef: z.string().trim().min(1),\n resumedByUserId: z.string().trim().min(1),\n /* How long this pause lasted, in wall-clock milliseconds. /\n pausedMs: z.number().int().nonnegative(),\n});\nexport type AuditableEvent_HumanDecisionClockResumed_EventData = z.infer<typeof AuditableEvent_HumanDecisionClockResumed_EventDataSchema>;\n\n/\n The fields every autonomous-agent binding event carries (#1611). Ids and refs only: an agent's\n * instruction lives in the application's code, and a turn's input stays in its transcript.\n /\nconst AutonomousAgentBindingEventShape = {\n /* The application-declared autonomous agent. /\n autonomousAgentRef: z.string().trim().min(1),\n /* The organization the agent may (or may no longer) act in. /\n organizationId: z.string().trim().min(1),\n /* The OAuth client whose authority the agent's turns carry. /\n oauthClientId: z.string().trim().min(1),\n principalSource: z.enum(AutonomousPrincipalSource),\n /* RELATIONSHIP_ADMITTED_CLIENT only: the firm that owns the client. /\n providerOrganizationId: z.string().trim().min(1).optional(),\n /* RELATIONSHIP_ADMITTED_CLIENT only: the relationship whose admission carries it. /\n serviceProviderRelationshipId: z.string().trim().min(1).optional(),\n};\n\nexport const AuditableEvent_AutonomousAgent_BoundEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.AUTONOMOUS_AGENT_BOUND),\n ...AutonomousAgentBindingEventShape,\n});\nexport type AuditableEvent_AutonomousAgent_BoundEventData = z.infer<typeof AuditableEvent_AutonomousAgent_BoundEventDataSchema>;\n\nexport const AuditableEvent_AutonomousAgent_UnboundEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.AUTONOMOUS_AGENT_UNBOUND),\n ...AutonomousAgentBindingEventShape,\n});\nexport type AuditableEvent_AutonomousAgent_UnboundEventData = z.infer<typeof AuditableEvent_AutonomousAgent_UnboundEventDataSchema>;\n\n/* The fields every autonomous-turn event carries: which agent, where, on which occurrence, started by what. /\nconst AutonomousAgentTurnEventShape = {\n autonomousAgentRef: z.string().trim().min(1),\n organizationId: z.string().trim().min(1),\n /* The schedule occurrence or the inbound delivery id. The same occurrence twice is one turn. /\n occurrenceKey: z.string().trim().min(1),\n trigger: z.enum(AutonomousTurnTrigger),\n /* The case the turn was started for, when one was named. /\n caseRef: WorkUnitRefSchema.optional(),\n};\n\nexport const AuditableEvent_AutonomousAgent_TurnStartedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.AUTONOMOUS_AGENT_TURN_STARTED),\n ...AutonomousAgentTurnEventShape,\n /* The conversational execution the turn runs in. Deterministic from the agent, organization and occurrence. /\n executionId: z.string().trim().min(1),\n systemRef: z.string().trim().min(1),\n oauthClientId: z.string().trim().min(1),\n principalSource: z.enum(AutonomousPrincipalSource),\n});\nexport type AuditableEvent_AutonomousAgent_TurnStartedEventData = z.infer<typeof AuditableEvent_AutonomousAgent_TurnStartedEventDataSchema>;\n\nexport const AuditableEvent_AutonomousAgent_TurnRefusedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.AUTONOMOUS_AGENT_TURN_REFUSED),\n ...AutonomousAgentTurnEventShape,\n reason: z.enum(AutonomousTurnRefusalReason),\n /* OVER_BUDGET: the budget gate's own reason (exhausted, or unverifiable). /\n budgetDenialReason: z.string().trim().min(1).optional(),\n /* RUNTIME_REFUSED: the runtime's error code. /\n runtimeErrorCode: z.string().trim().min(1).optional(),\n /* The OAuth client, when one had been resolved before the refusal. /\n oauthClientId: z.string().trim().min(1).optional(),\n});\nexport type AuditableEvent_AutonomousAgent_TurnRefusedEventData = z.infer<typeof AuditableEvent_AutonomousAgent_TurnRefusedEventDataSchema>;\n\n/\n Rows were read THROUGH an HTTP-API resource binding — the read-through trail for data living in\n * an EXTERNAL system the platform does not own (ETL plan D8/R6; see the enum member's docstring\n * for why this is neither SYSTEM_CONTEXT_READ nor COLLECTION_DATA_EXPORT).\n \n One event per read-family OPERATION execution: a paginated LIST and the count that totals its\n * envelope are ONE access, not two — the unit a reviewer reasons about is \"an operation reached\n * into the external system\", never the transport's call multiplicity. Carries NO row data and no\n * filter VALUES — the trail must never become a second copy of the external system's content.\n \n `initiatorUserId` is the REAL initiating user (R12): under a SERVICE_PRINCIPAL binding every\n * remote call authenticates as one service account, and this field is what keeps attribution\n * alive through that shared principal. Optional because internal/machine executions genuinely\n * have no user — absence means \"a runtime acted\", exactly as `executionType` records.\n \n assurance-control: WILDO.AUDIT.ATTRIBUTION — read-through access to an external system is\n * recorded with the real initiating user carried through the shared service principal.\n /\nexport const AuditableEvent_HttpApiReadThroughAccess_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.HTTP_API_READ_THROUGH_ACCESS),\n /* The Wildo resource whose binding was read through. /\n resourceType: z.string().trim().min(1),\n /* The read-family member executed: `read` \| `list` \| `count` \| `search`. /\n operationIdentifier: z.string().trim().min(1),\n /\n The system-of-record INSTANCE the binding reads (`systemsOfRecord.<name>`, #1055). Was `providerRef`\n * until #1679 found the emitters had sent `systemOfRecord` since #1055 while this schema still named the\n * retired provider field — a trail whose declared shape and whose rows disagreed about the one field\n * that says WHICH external system was reached.\n /\n systemOfRecord: z.string().trim().min(1),\n /* The remote entity (OData entity set / Odoo model / declared REST surface). /\n remoteEntityRef: z.string().trim().min(1),\n /* The transport dialect spoken (`odata` \| `rest-json` \| `odoo-jsonrpc`). /\n dialect: z.string().trim().min(1),\n /* The REAL initiating user — absent only for genuine machine/internal executions. /\n initiatorUserId: z.string().optional(),\n /* The execution type that acted, for the machine/internal cases. /\n executionType: z.string().optional(),\n /* Tenant scope, when the read ran org-scoped. /\n organizationId: z.string().optional(),\n /* The addressed row's synthesized id, for single-row reads. /\n resourceId: z.string().optional(),\n /* Rows returned (list/search), or the count answered (count). Absent for a single READ. /\n rowCount: z.number().int().nonnegative().optional(),\n /\n * ── A PIPELINE RUN's extras (`operationIdentifier: 'externalDataPipelineRun'`) ─────────────\n \n The run service has emitted `rejectedRows` and `completedPass` since the pipeline landed, and this\n * schema never declared them — a trail whose rows carried fields its declared shape did not name.\n * Declared together with the pass mode (#1682) and the erasure-suppression count (#1746), all optional\n * because a read-through operation has none.\n /\n /* Rows the pipeline's transform rejected this run (reported per row in the run log; never loaded). /\n rejectedRows: z.number().int().nonnegative().optional(),\n /\n Whether the run finished its pass. Read with `pipelinePassMode`: on a FULL run it means the whole\n * remote population was read; on an INCREMENTAL run, every change since the watermark was.\n /\n completedPass: z.boolean().optional(),\n /* Which track the run advanced (#1682) — a full pass or an incremental one. /\n pipelinePassMode: z.enum(ExternalDataPipelinePassMode).optional(),\n /\n Source rows the run did NOT load because a subject erasure suppresses their remote records (#1746) — the\n * evidence that an erasure survived the next pass. A count, never a key.\n \n assurance-control: WILDO.PRIVACY.ERASURE_PROPAGATION — a pipeline run records how many erased records it declined to re-import.\n /\n suppressedRows: z.number().int().nonnegative().optional(),\n /\n Of those suppressed records, how many still have a LIVE row in the destination — an erasure that committed while an\n * earlier pass was loading, and that pass wrote the row back (#1746). Above zero is an erasure that did not hold.\n /\n liveSuppressedRows: z.number().int().nonnegative().optional(),\n});\n\n/\n A subject erasure invoked the DECLARED external-erasure operation of an HTTP_API binding\n * (ETL D6 stance 6b) — rows linked to the erased subject were deleted in the external system.\n \n Carries ids only, never personal fields: by the time this emits, the subject's local row is\n * scrubbed, and the whole point of the operation was that the remote copies stop existing.\n \n assurance-control: WILDO.AUDIT.ATTRIBUTION — the outbound deletion names the subject it served\n * and the external system it reached; the erasure report is the per-request receipt, this row is\n * the queryable trail.\n \n assurance-control: WILDO.PRIVACY.ERASURE_PROPAGATION — an erasure that deleted rows in an external\n * system leaves a durable record naming that system and how many rows it deleted there.\n /\nexport const AuditableEvent_HttpApiExternalErasure_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.HTTP_API_EXTERNAL_ERASURE),\n /* The erased subject's resource type (e.g. `users`). /\n subjectResourceType: z.string().trim().min(1),\n /* The erased subject row ids the deleted remote rows were linked to. /\n subjectIds: z.array(z.string().trim().min(1)).min(1),\n /* The HTTP_API-bound Wildo resource whose declared erasure operation ran. /\n resourceType: z.string().trim().min(1),\n /* The system-of-record INSTANCE the erasure reached (`systemsOfRecord.<name>`) — see the read-through schema for the rename. /\n systemOfRecord: z.string().trim().min(1),\n /* The remote entity (OData entity set / Odoo model / declared REST surface). /\n remoteEntityRef: z.string().trim().min(1),\n /* The transport dialect spoken (`odata` \| `rest-json` \| `odoo-jsonrpc`). /\n dialect: z.string().trim().min(1),\n /* Remote rows the declared operation deleted (0 is a legitimate nothing-to-erase). /\n deletedRowCount: z.number().int().nonnegative(),\n /* Tenant scope, when the erasure request carried one. /\n organizationId: z.string().optional(),\n});\n\n/\n What became of ONE write sent (or about to be sent) through an HTTP-API binding (#1679).\n \n Distinct members because each one sends a reviewer somewhere different, and two of them are the\n * answers a client must not read as \"not written\".\n /\nexport enum HttpApiWriteThroughOutcome {\n /* The system of record applied the write. /\n APPLIED = 'applied',\n /\n The ENGINE refused before anything was sent — a non-owner organization, a partition outside the\n * caller's grant, an engine-owned field in the payload. Nothing reached the remote.\n /\n REFUSED = 'refused',\n /* The request was sent and the system of record refused it with a definite answer; nothing was applied. /\n REMOTE_REFUSED = 'remote_refused',\n /\n The request was sent and nobody knows whether it was applied — a timeout, a connection dropped after\n * the request left, a gateway answering for the vendor. A retry under the same Idempotency-Key answers\n * this again rather than sending a second write.\n /\n OUTCOME_UNKNOWN = 'outcome_unknown',\n /\n A retry under an Idempotency-Key whose first attempt was APPLIED. Nothing was sent: the outcome was\n * replayed from the first attempt's record. Recorded so the second RESOURCE_OPERATION_PERFORMED row such a\n * retry produces is visibly one that changed nothing remote.\n /\n REPLAYED = 'replayed',\n}\n\n/\n A row was written THROUGH an HTTP-API resource binding, or a write was refused (#1679) — see the enum\n * member's docstring for the vocabulary argument and the relation to RESOURCE_OPERATION_PERFORMED.\n \n MINIMISATION is the shape of this schema: it names the FIELDS written and never their values. The\n * values live in the system of record; a copy here would be a second store of that system's content, one\n * the application's erasure never reaches. `writtenFieldNames` are the LOCAL names the caller sent,\n * because those are the names a reviewer of this application reads.\n \n assurance-control: WILDO.AUDIT.ATTRIBUTION — every write sent into an external system through the shared\n * service identity is recorded with the real initiating user, the row it reached and the fields it changed.\n /\nexport const AuditableEvent_HttpApiWriteThrough_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.HTTP_API_WRITE_THROUGH),\n /* The Wildo resource whose binding was written through. /\n resourceType: z.string().trim().min(1),\n /* The write verb: `create` \| `update` \| `delete` — the core operation, so OCSF refines its activity from it. /\n operationIdentifier: z.string().trim().min(1),\n /* The system-of-record INSTANCE written (`systemsOfRecord.<name>`). /\n systemOfRecord: z.string().trim().min(1),\n /* The remote entity (OData entity set / Odoo model / declared REST surface). /\n remoteEntityRef: z.string().trim().min(1),\n /* The transport dialect spoken. /\n dialect: z.string().trim().min(1),\n outcome: z.enum(HttpApiWriteThroughOutcome),\n /\n The written row's synthesized id — its remote key. Present for an update or delete (addressed by it)\n * and for an applied or replayed create (the remote assigned it). Absent for a create that was refused\n * or whose outcome is unknown, because no key exists that the engine could honestly name.\n /\n resourceId: z.string().optional(),\n /* The LOCAL names of the fields the write carried, sorted. Never their values. Empty for a delete. /\n writtenFieldNames: z.array(z.string()),\n /* The stable refusal code for REFUSED, REMOTE_REFUSED and OUTCOME_UNKNOWN (a `SystemOfRecordErrorCode`, or the transport kind). /\n refusalCode: z.string().optional(),\n /* The REAL initiating user — absent only for genuine machine/internal executions. /\n initiatorUserId: z.string().optional(),\n /* The execution type that acted. /\n executionType: z.string().optional(),\n /* The organization the write was scoped to — the owner organization when it was admitted. /\n organizationId: z.string().optional(),\n /* The organization unit whose partition the row belongs to, when the instance is partitioned. /\n organizationUnitId: z.string().optional(),\n /\n The LOCAL row whose change the write carried — present only for a write an OUTBOUND pipeline sent (#1690), which is\n * how a reviewer tells such a write from a caller's write through a read-through resource. `initiatorUserId` is then\n * the member whose change the pass sent, not whoever triggered the pass.\n /\n localResourceId: z.string().optional(),\n});\n\n/\n What became of ONE declared system-of-record action that was sent, or replayed (#1678). Refusals before sending are a\n * separate event type ({@link CoreAuditableEventType.SYSTEM_OF_RECORD_ACTION_REFUSED}).\n /\nexport enum SystemOfRecordActionOutcome {\n /* The system of record performed the action. /\n APPLIED = 'applied',\n /* The action was sent and the system of record refused it with a definite answer; nothing was applied. /\n REMOTE_REFUSED = 'remote_refused',\n /\n The action was sent and nobody knows whether it was performed — a timeout, a connection dropped after the request\n * left, a gateway answering for the vendor, or an answer the engine could not read after the vendor answered success.\n * A retry under the same Idempotency-Key answers this again rather than acting twice.\n /\n OUTCOME_UNKNOWN = 'outcome_unknown',\n /* A retry under an Idempotency-Key whose first attempt was APPLIED. Nothing was sent. /\n REPLAYED = 'replayed',\n}\n\n/\n A declared system-of-record action was run (#1678) — see the enum member for the vocabulary argument.\n \n MINIMISATION is the shape: the input's field NAMES, never their values, and no result. The values live in the system\n * of record; a copy here would be a second store of that system's content, one no erasure reaches.\n \n assurance-control: WILDO.INTEGRATION.OUTBOUND_ACTIVITY_AUDIT — every physical action call to a system of record is\n * recorded with the instance, the action, the remote entity and its outcome.\n * assurance-control: WILDO.AUDIT.ATTRIBUTION — the real initiating actor is recorded through the shared service identity.\n /\nexport const AuditableEvent_SystemOfRecordActionExecuted_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.SYSTEM_OF_RECORD_ACTION_EXECUTED),\n /* The system-of-record INSTANCE acted on (`systemsOfRecord.<name>`). /\n systemOfRecord: z.string().trim().min(1),\n /* The application's name for the action (`postInvoice`), as the binding declares it. /\n action: z.string().trim().min(1),\n /* The read-through resource whose binding declares the action. /\n resourceType: z.string().trim().min(1),\n /* The remote entity or model the call was made on (`account.move`, an OData entity set or action import). /\n remoteEntityRef: z.string().trim().min(1),\n /* The call shape (`odoo-execute-kw` \| `odata-bound-action` \| `odata-unbound-action`). Spelled as a string: see `dialect` on the read-through row. /\n callShape: z.string().trim().min(1),\n outcome: z.enum(SystemOfRecordActionOutcome),\n /* Whether the action is declared as changing remote state. /\n writes: z.boolean(),\n /* The target record's synthesized id — a remote KEY, never a person's id. Absent for a record-free action. /\n targetResourceId: z.string().optional(),\n /* The LOCAL names of the input fields the call carried, sorted. Never their values. /\n inputFieldNames: z.array(z.string()),\n /* The stable code for REMOTE_REFUSED and OUTCOME_UNKNOWN (a `SystemOfRecordErrorCode`, or the transport kind). /\n failureCode: z.string().optional(),\n /* The REAL initiating user — absent only for machine and system executions. /\n initiatorUserId: z.string().optional(),\n /* The execution type that acted. /\n executionType: z.string().optional(),\n /* The organization the action was run for — the owner organization, once admitted. /\n organizationId: z.string().optional(),\n /* The organization unit whose partition the action landed in, when the instance is partitioned and it is known. /\n organizationUnitId: z.string().optional(),\n});\n\n/\n A declared system-of-record action was REFUSED before anything was sent (#1678).\n \n assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT — every refusal of an action on a system of record is\n * recorded with the caller, the instance, the action and the rule that refused it.\n /\nexport const AuditableEvent_SystemOfRecordActionRefused_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.SYSTEM_OF_RECORD_ACTION_REFUSED),\n systemOfRecord: z.string().trim().min(1),\n action: z.string().trim().min(1),\n /* The declaring resource, when the action was found at all (absent for ACTION_NOT_DECLARED). /\n resourceType: z.string().optional(),\n /* The target the caller named, for a record-targeted action. /\n targetResourceId: z.string().optional(),\n /* The `SystemOfRecordErrorCode` that refused it. /\n refusalCode: z.string().trim().min(1),\n /* The partition rule that refused it, for ACTION_PARTITION_REFUSED (`SystemOfRecordWritePartitionRefusal`). /\n refusalReason: z.string().optional(),\n initiatorUserId: z.string().optional(),\n executionType: z.string().optional(),\n /* The organization the caller initiated the action for — possibly NOT the owner, which is what a reviewer looks for. /\n organizationId: z.string().optional(),\n});\n\n/\n An operator reset a pipeline (#1734) — see {@link CoreAuditableEventType.EXTERNAL_DATA_PIPELINE_RESET}.\n \n The DISCARDED state is the point of the row: the pass id, cursor and watermark are remote POSITIONS (an id, a\n * continuation link, a timestamp), never record content, and they are what lets a reviewer say which part of a sync\n * the reset threw away. The door is authenticated by the application admin secret, which names no person, so the\n * row's `userId` is empty; `statedOperator` is who the operator SAID they are, recorded as a statement, and `reason`\n * is their own words — which is why the event exports at SUBJECT_DETAIL.\n \n assurance-control: WILDO.AUDIT.SECURITY_EVENT — an operator's reset of a pipeline is recorded with what it discarded\n * and why.\n /\nexport const AuditableEvent_ExternalDataPipelineReset_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.EXTERNAL_DATA_PIPELINE_RESET),\n /* The destination resource whose pipeline was reset. /\n pipelineResourceType: z.string().trim().min(1),\n /* The system-of-record instance the pipeline reads (`systemsOfRecord.<name>`). /\n systemOfRecord: z.string().trim().min(1),\n resetMode: z.enum(ExternalDataPipelineResetMode),\n /* Why, in the operator's words. Required by the door. /\n reason: z.string().trim().min(1).max(2000),\n /* Who the operator said they are, when they said. A statement, not an authenticated identity. /\n statedOperator: z.string().trim().min(1).max(200).optional(),\n /* Whether the pipeline had a state row at all. A reset of a pipeline that never ran discards nothing. /\n stateFound: z.boolean(),\n /* The discarded full pass's id; null when no pass was in flight. /\n discardedPassId: z.string().nullable(),\n /* The discarded full pass's cursor — a remote position; null at the start of a pass or with none in flight. /\n discardedCursor: z.string().nullable(),\n /* When the discarded pass started, ISO-8601; null when none was in flight. /\n discardedPassStartedAt: z.string().nullable(),\n /* The discarded incremental watermark (FULL_RESYNC only) — a remote position; null when none was discarded. /\n discardedIncrementalWatermark: z.string().nullable(),\n /* The discarded in-flight incremental cursor (FULL_RESYNC only); null when none was discarded. /\n discardedIncrementalCursor: z.string().nullable(),\n});\n\n/\n An operator answered an outbound write of unknown outcome (#2039) — see\n * {@link CoreAuditableEventType.EXTERNAL_DATA_OUTBOUND_UNKNOWN_RESOLVED}.\n \n Like the reset, the door is authenticated by the application admin secret, which names no person: the row's `userId`\n * is empty, `statedOperator` is who the operator SAID they are, and `reason` is their own words (SUBJECT_DETAIL on\n * export). `remoteKey` is the remote record's identity the operator supplied, never record content.\n \n assurance-control: WILDO.AUDIT.SECURITY_EVENT — an operator's answer about another system's state is recorded with\n * what it changed locally and why.\n /\nexport const AuditableEvent_ExternalDataOutboundUnknownResolved_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.EXTERNAL_DATA_OUTBOUND_UNKNOWN_RESOLVED),\n /* The OUTBOUND pipeline's destination resource. /\n pipelineResourceType: z.string().trim().min(1),\n /* The system-of-record instance the pipeline sends to (`systemsOfRecord.<name>`). /\n systemOfRecord: z.string().trim().min(1),\n /* The destination row whose change was of unknown outcome. /\n localResourceId: z.string().trim().min(1),\n /* The write that was of unknown outcome, as its core operation (`create` / `update`). /\n operationIdentifier: z.string().trim().min(1),\n answer: z.enum(ExternalDataOutboundUnknownAnswer),\n /* The remote key the operator supplied for an applied CREATE; null otherwise. /\n remoteKey: z.string().nullable(),\n /* Whether the answer wrote that key onto the local row (false when the row already held the same key). /\n remoteKeyWritten: z.boolean(),\n /* Whether a change is still owed after the answer: a NOT_APPLIED answer, or a local change made since the send. /\n changeStillOwed: z.boolean(),\n /* Why, in the operator's words. Required by the door. /\n reason: z.string().trim().min(1).max(2000),\n /* Who the operator said they are, when they said. A statement, not an authenticated identity. /\n statedOperator: z.string().trim().min(1).max(200).optional(),\n});\n\n/\n A BIDIRECTIONAL pipeline resolved a conflict on one row (#1723) — see\n * {@link CoreAuditableEventType.EXTERNAL_DATA_CONFLICT_RESOLVED}. Identities and field NAMES only, never a field's\n * value: the row says which side's change to which fields was discarded, and the values are in the two systems.\n \n assurance-control: WILDO.AUDIT.SECURITY_EVENT — a resolution that overwrites one side's data is recorded with the row,\n * the fields, the winning side and who chose it.\n /\nexport const AuditableEvent_ExternalDataConflictResolved_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.EXTERNAL_DATA_CONFLICT_RESOLVED),\n /* The BIDIRECTIONAL pipeline's destination resource. /\n pipelineResourceType: z.string().trim().min(1),\n /* The system-of-record instance on the other side (`systemsOfRecord.<name>`). /\n systemOfRecord: z.string().trim().min(1),\n /* The local row. /\n localResourceId: z.string().trim().min(1),\n /* The remote record's key. /\n remoteKey: z.string().trim().min(1),\n winner: z.enum(ExternalDataConflictWinner),\n decidedBy: z.enum(ExternalDataConflictDecisionSource),\n /\n The local fields whose values differ between the two sides, and so are overwritten on the LOSING side: loaded over\n * now when the remote side wins, sent over by the next outbound pass when the local side wins.\n /\n overwrittenFieldNames: z.array(z.string().min(1)),\n /* The record's row version on the system of record when the conflict was resolved; null when it carried none. /\n remoteVersion: z.string().nullable(),\n /* The version the two sides last agreed on; null when they never had. /\n agreedVersion: z.string().nullable(),\n});\n\n/\n A subject erasure COMPLETED while rows linked to the subject remain live in an HTTP_API-bound\n * external system, on the controller's explicit per-request acknowledgement (ETL D6 stance 6c).\n \n THE RECORD IS THE CONTROL: the acknowledgement's entire justification is that the hole becomes\n * VISIBLE rather than prevented (`administrative-continuity-floors.md`), so this event must name\n * everything a reviewer needs to act — the subject, the resource, the external system, and the\n * remaining linkage when it could be measured.\n \n assurance-control: WILDO.AUDIT.ATTRIBUTION — an acknowledged erasure hole is recorded per\n * resource, per erasure request, never as a standing posture.\n \n assurance-control: WILDO.PRIVACY.ERASURE_PROPAGATION — a store the erasure deliberately did not\n * reach is recorded as such, so the accounting cannot read as complete.\n /\nexport const AuditableEvent_HttpApiNonErasureAcknowledged_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.HTTP_API_NON_ERASURE_ACKNOWLEDGED),\n /* The erased subject's resource type (e.g. `users`). /\n subjectResourceType: z.string().trim().min(1),\n /* The erased subject row ids whose linked remote rows remain live. /\n subjectIds: z.array(z.string().trim().min(1)).min(1),\n /* The HTTP_API-bound Wildo resource whose rows remain un-erased. /\n resourceType: z.string().trim().min(1),\n /* The system-of-record INSTANCE the rows remain in (`systemsOfRecord.<name>`) — see the read-through schema for the rename. /\n systemOfRecord: z.string().trim().min(1),\n /* The remote entity (OData entity set / Odoo model / declared REST surface). /\n remoteEntityRef: z.string().trim().min(1),\n /* The transport dialect spoken (`odata` \| `rest-json` \| `odoo-jsonrpc`). /\n dialect: z.string().trim().min(1),\n /\n Remote rows still linked to the subject, when the target answered a count. ABSENT means the\n * count could not be measured (the count read failed or is undeclared for the binding) — never\n * write 0 for \"unknown\": zero is a measured answer.\n /\n remainingRowCount: z.number().int().nonnegative().optional(),\n /* Tenant scope, when the erasure request carried one. /\n organizationId: z.string().optional(),\n});\n\n/\n A subject erasure's outcome at one RECIPIENT of the subject's data (#1710) — see\n * {@link CoreAuditableEventType.SUBJECT_ERASURE_RECIPIENT_OUTCOME}.\n \n Art. 19 asks the controller to communicate an erasure \"to each recipient to whom the personal data have been\n * disclosed\" and to tell the data subject who they are on request; this row records, per recipient, what the erasure\n * did and who owes that communication. `status` is absent for a recipient reached with the TENANT's account, which is\n * the tenant's to notify and never the operator's effect to run.\n * spec-cite: GDPR Art. 19, https://gdpr-info.eu/art-19-gdpr/ (fetched 2026-09-29)\n \n assurance-control: WILDO.PRIVACY.ERASURE_PROPAGATION — every recipient the application declares is accounted for\n * at every erasure, and one that no effect reached is recorded as unmeasured rather than passing silently.\n /\nexport const AuditableEvent_SubjectErasureRecipientOutcome_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.SUBJECT_ERASURE_RECIPIENT_OUTCOME),\n /* The erased subject's resource type. /\n subjectResourceType: z.string().trim().min(1),\n /* The erased subject rows. /\n subjectIds: z.array(z.string().trim().min(1)).min(1),\n /* The recipient: a provider ref. /\n recipientRef: z.string().trim().min(1),\n /* `SubjectDataRecipientReach` — whose account reached it. /\n reach: z.enum(SubjectDataRecipientReach),\n /* `SubjectDataRecipientObligation` — who owes the Art. 19 communication. /\n obligation: z.enum(SubjectDataRecipientObligation),\n /* `SubjectDataRecipientRelevance` — carries this subject's data, or may have received it. /\n relevance: z.enum(SubjectDataRecipientRelevance),\n /* `SubjectErasureExternalEffectStatus` at the recipient. Absent for a tenant-account recipient. /\n status: z.enum(SubjectErasureExternalEffectStatus).optional(),\n /* The effects that answered for it (`billing-provider`, `recipient:<ref>`, …). /\n effectRefs: z.array(z.string().trim().min(1)),\n /* Tenant scope, when the erasure request carried one. /\n organizationId: z.string().optional(),\n});\n\n/\n Audit-log event for cross-frontend session handoff issuance\n * (cross-app-jwt-propagation Step 2).\n \n Captures who issued a transferable session credential, where it was bound to,\n * and a hash of the deep-link target so ops can correlate handoff issuance with\n * the corresponding `tokenExchange` event WITHOUT leaking the raw deep link\n * (which can carry org IDs, share codes, or draft IDs).\n \n `returnPathHash` is hex-encoded `sha256(returnPath)` computed by the audit-log\n * helper from the validated returnPath. NEVER pass a pre-hashed value at the\n * call site (defense-in-depth: prevents accidental double-hashing or hash\n * mismatch with what the schema validated).\n /\nexport const AuditableEvent_User_CrossFrontendHandoffIssuedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_CROSS_FRONTEND_HANDOFF_ISSUED),\n userId: z.string(),\n /* The `X-Frontend-Service-Name` of the source frontend that initiated the handoff. /\n sourceFrontendServiceName: z.string().optional(),\n /* The SaaS-config service key (and runtime `frontendServiceName`) of the target. /\n targetServiceKey: z.string(),\n /* SHA-256 hex of the validated returnPath; NEVER the raw path. /\n returnPathHash: z.string(),\n /* ID of the issued AUTH_CODE_EXCHANGE consumable token (for replay forensics). /\n consumableTokenId: z.string(),\n ipAddress: z.string(),\n userAgent: z.string(),\n});\n\n\n\n// ── OAuth2 / OIDC Provider Event Data Schemas (Wildo AS the authorization server) ──\n\n/\n A user-delegated `authorization_code` access token was minted for a third-party client at\n * `/oauth/token`. This is the most security-sensitive access grant the provider makes: the client\n * can now act AS the user at the audience-bound A2A/MCP resource. `clientId` is the `azp`\n * (attribution only — the token carries the USER's authority, not the client's). Never carries the\n * raw token.\n /\nexport const AuditableEvent_OAuth_DelegatedTokenIssuedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.OAUTH_DELEGATED_TOKEN_ISSUED),\n /* The delegating (consenting) user — the token subject. /\n userId: z.string(),\n /* The third-party client the token was minted for (`azp`). /\n clientId: z.string(),\n /* The A2A/MCP resource-server audience the token is confined to. /\n audience: z.string(),\n /* Granted identity scopes (openid/…); may be empty. Identity/consent provenance only — no authz weight. /\n scopes: z.array(z.string()),\n /* Delegated-token lifetime in seconds (short-lived; never the full session TTL). /\n ttlSeconds: z.number(),\n ipAddress: z.string().optional(),\n});\n\n/* A user APPROVED an interactive consent request — a code is issued and the client may act for them. /\nexport const AuditableEvent_OAuth_ConsentGrantedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.OAUTH_CONSENT_GRANTED),\n /* The user who approved. /\n userId: z.string(),\n /* The client the consent was granted to. /\n clientId: z.string(),\n /* The scopes consented to. /\n scopes: z.array(z.string()),\n /* The RFC 8707 resource the consent was bound to, when present. /\n resource: z.string().optional(),\n /* Whether the user asked to persist the grant (\"remember this app\") — a durable-authority signal. /\n remembered: z.boolean(),\n ipAddress: z.string().optional(),\n});\n\n/* A user DENIED an interactive consent request — access refused. /\nexport const AuditableEvent_OAuth_ConsentDeniedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.OAUTH_CONSENT_DENIED),\n userId: z.string(),\n clientId: z.string(),\n scopes: z.array(z.string()),\n resource: z.string().optional(),\n ipAddress: z.string().optional(),\n});\n\n/\n A persistent consent grant (the durable \"remember this app\" record, keyed on\n * `(userId, clientId, resource)`) was created or updated — it lets future authorize flows SKIP the\n * consent prompt, so its lifecycle is a first-class delegated-authority audit concern.\n /\nexport const AuditableEvent_OAuth_ConsentGrantPersistedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.OAUTH_CONSENT_GRANT_PERSISTED),\n userId: z.string(),\n clientId: z.string(),\n /* The RFC 8707 resource the grant covers; absent for an OIDC-only (resource-less) grant. /\n resource: z.string().optional(),\n /* The union of scopes the grant now covers after the write. /\n scopes: z.array(z.string()),\n /* `true` when a NEW grant row was created; `false` when an existing grant's scopes were widened. /\n isNewGrant: z.boolean(),\n});\n\n/\n A CIMD `client_id` URL was refused. Unauthenticated by construction, so the URL, the reason and\n * the source of the request ARE the investigation surface.\n /\nexport const AuditableEvent_OAuth_CimdClientRefusedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.OAUTH_CIMD_CLIENT_REFUSED),\n /* The `client_id` URL as presented. Attacker-controlled, so treated as data, never as a locator. /\n clientId: z.string(),\n /* Closed vocabulary — branched on by operators and COUNTED, never free text. /\n reason: z.string(),\n detail: z.string().optional(),\n});\n\n/\n A client registered itself at `/oauth/register` (RFC 7591). Unauthenticated by construction, so\n * the source IP and the self-asserted name/redirects ARE the investigation surface — there is no\n * principal to attribute it to.\n /\nexport const AuditableEvent_OAuth_DynamicClientRegisteredEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.OAUTH_DYNAMIC_CLIENT_REGISTERED),\n clientId: z.string(),\n /* Self-asserted; nobody vetted it. Shown on the consent screen, so worth recording verbatim. /\n clientName: z.string(),\n /* The redirect URIs the client claimed — where an authorization code would be delivered. /\n redirectUris: z.array(z.string()),\n /\n The POST-LOGOUT redirect URIs the client claimed (revocation-C) — where an RP-Initiated Logout would\n * send the browser after the session ends. Optional: absent on rows written before the field existed and\n * for a registration that declared none.\n /\n postLogoutRedirectUris: z.array(z.string()).optional(),\n ipAddress: z.string().optional(),\n});\n\n/\n A user token was rotated via the provider `refresh_token` grant (`/oauth/token`). Distinct from the\n * first-party session refresh (`USER_TOKEN_REFRESHED`): this is the OAuth-provider endpoint, which a\n * confidential client MAY authenticate to. Low-detail INFO — the security-relevant refresh signal is\n * reuse/theft ({@link CoreAuditableEventType.USER_REFRESH_TOKEN_REUSE_DETECTED}).\n \n There is deliberately NO `OAUTH_TOKEN_REFRESH_FAILED` counterpart (user-confirmed 2026-07-31): routine\n * refresh failures (expired / revoked / plain-invalid presented token) are high-volume benign noise from\n * ended sessions, and auditing them would drown the compliance store. The only refresh-failure worth an\n * audit record is credential theft, which reuse-detection catches → `USER_REFRESH_TOKEN_REUSE_DETECTED`.\n /\nexport const AuditableEvent_OAuth_TokenRefreshedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.OAUTH_TOKEN_REFRESHED),\n /* The refreshing user, when resolvable from the freshly-minted access token; else absent. /\n userId: z.string().optional(),\n /* The client that authenticated the refresh (confidential-client id_token re-issue path); else absent. /\n clientId: z.string().optional(),\n /* Whether a confidential client was authenticated on this refresh (vs a first-party session refresh). /\n clientAuthenticated: z.boolean(),\n ipAddress: z.string().optional(),\n});\n\n/\n A token was revoked via `/oauth/revoke` (RFC 7009). The endpoint is deliberately a no-oracle (200 for\n * unknown tokens), so this records the ATTEMPT + the authenticated client (if any), never whether the\n * token existed or whose it was.\n /\nexport const AuditableEvent_OAuth_TokenRevokedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.OAUTH_TOKEN_REVOKED),\n /* The confidential client that authenticated to revoke, when present. /\n clientId: z.string().optional(),\n /* Whether a confidential client authenticated the revocation. /\n clientAuthenticated: z.boolean(),\n /* The RFC 7009 `token_type_hint` the caller supplied, when present. /\n tokenTypeHint: z.string().optional(),\n ipAddress: z.string().optional(),\n});\n\n/\n An OIDC RP-Initiated Logout (RP-Initiated Logout 1.0) terminated the End-User's OP session at\n * `/oauth/end-session` (revocation-C). Records WHO logged out WHICH session via WHICH relying party, and\n * whether a session was actually terminated / a post-logout redirect was refused. `userId`/`sessionId`/\n * `clientId` are present only when a valid `id_token_hint` identified them — an invalid or absent hint\n * still lands the user on the OP's page but terminates nothing.\n /\nexport const AuditableEvent_OAuth_RpInitiatedLogoutEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.OAUTH_RP_INITIATED_LOGOUT),\n /* The user whose OP session was terminated — present only when a valid `id_token_hint` identified them. /\n userId: z.string().optional(),\n /* The terminated login session (the id_token `sid`) — present only when the hint carried one. /\n sessionId: z.string().optional(),\n /* The relying party that initiated the logout (the id_token `azp`), when identifiable. /\n clientId: z.string().optional(),\n /* Whether a session was actually terminated (a valid hint carrying a `sid` was presented). /\n sessionTerminated: z.boolean(),\n /* Whether a presented `post_logout_redirect_uri` was REFUSED because it did not match the client's\n * registered allowlist — a misconfiguration / open-redirect-probe signal worth separating from a\n * plain no-URI logout. /\n postLogoutRedirectUriRejected: z.boolean(),\n ipAddress: z.string().optional(),\n});\n\n/\n An `authorization_code` exchange was REJECTED at `/oauth/token`. A potential attack signal (code\n * replay, PKCE downgrade, redirect tampering, cross-client redemption). `reason` names the cause;\n * `userId`/`resource` are present only for causes detected AFTER the code decodes (never for the\n * atomic replay/consume failure, which fails before decode).\n /\nexport const AuditableEvent_OAuth_CodeExchangeFailedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.OAUTH_CODE_EXCHANGE_FAILED),\n /* The specific failure cause (closed vocabulary). /\n reason: z.enum(OAuthCodeExchangeFailureReason),\n /* The redeeming client, when the request supplied one. /\n clientId: z.string().optional(),\n /* The code's subject, available only for post-decode causes. /\n userId: z.string().optional(),\n /* The code's bound resource, available only for post-decode causes. /\n resource: z.string().optional(),\n ipAddress: z.string().optional(),\n});\n\n/\n A consent DECISION was submitted by an authenticated user who is NOT the user the consent request was\n * bound to (returns 403). A textbook cross-user authorization-abuse signal — user A attempting to act on\n * user B's pending consent. CRITICAL: records BOTH principals for the SIEM.\n /\nexport const AuditableEvent_OAuth_ConsentBindingViolationEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.OAUTH_CONSENT_BINDING_VIOLATION),\n /* The authenticated user who submitted the decision (the actor). /\n authenticatedUserId: z.string(),\n /* The user the consent request was actually bound to (the victim). /\n boundUserId: z.string(),\n /* The client the consent request was for, when known. /\n clientId: z.string().optional(),\n /* The consent-request consumable-token id, for replay forensics. /\n consentTokenId: z.string().optional(),\n ipAddress: z.string().optional(),\n});\n\n/\n Refresh-token REUSE was detected → the whole token family was revoked (possible theft). Emitted by the\n * refresh CALLERS, NOT the token issuer: the issuer stays audit-free by design (it performs the revoke and\n * surfaces a machine-readable reuse SIGNAL on its thrown error), and each caller decides to audit. Applies\n * to BOTH the first-party session refresh and the OAuth-provider refresh grant (shared issuer).\n /\nexport const AuditableEvent_User_RefreshTokenReuseDetectedEventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.USER_REFRESH_TOKEN_REUSE_DETECTED),\n /* The user whose token family was revoked (the victim). /\n userId: z.string(),\n /* The reused refresh token's `jti` (the replayed credential id) — never the raw token. /\n reusedJti: z.string(),\n /* The session the reused token belonged to, when present on the claim. /\n sessionId: z.string().optional(),\n /* Whether the family-wide revocation (`TOKEN_INVALID_BEFORE`) was written — the action taken. /\n familyRevoked: z.boolean(),\n ipAddress: z.string().optional(),\n});\n\n// MongoDB-compatible schema using simple object for eventData\n// The discriminated union validation will be handled at the service layer\nexport const AuditableEvent_DataSchema = z.record(z.string(), z.any());\n\n\n\n\nexport const AuditableEvent_BaseSchema = z.object({\n _id: z.string().isPrimaryKey().isSummaryField(),\n /\n Store-agnostic, server-assigned correlation key (UUID). The Mongo `_id` is\n * THIS store's primary key, but immudb (and any future audit sink) has its\n * own native key — so cross-store correlation needs an id that belongs to the\n * EVENT, not to one store. Fixed in `AuditLogsBackendService._createAuditLog`\n * — minted there, or supplied deterministically by a deferred recording (#535) —\n * BEFORE the DB write and carried on BOTH the DB row AND the provider fan-out\n * emission, so the Phase-3 completeness reconciler can match DB rows ⇄ immudb\n * records (and `AuditLogVerification.verifyAuditEvent(eventId)` resolves the\n * same key). Not the primary key: `_id` stays the DB PK.\n \n UNIQUE, because it names ONE event (#535). A caller that delivers an event at least once — an outbox relay replaying\n * an audit record after a crash — supplies a deterministic `eventId`, and a redelivery then collides here instead of\n * writing a second row. immudb (write-if-absent by `eventId`) and every SIEM wire format (whose dedup key is this\n * value) are idempotent on the same id, so all three destinations agree on \"once\". Sparse, as `.isUnique()` defaults:\n * a row written before `eventId` existed carries none and is not a duplicate of another.\n /\n eventId: z.string().isDBIndexed().isUnique(),\n // Note: .optional() must come AFTER decorators to preserve optionality in TypeScript type inference\n userId: z.string().isSummaryField().optional(),\n /\n The org the event is ABOUT (event DATA) — e.g. the org whose SSO config changed, or the\n * org resolved from a login email's domain. NEVER a routing key. Per-org SIEM / sink\n * dispatch routes ONLY on the AUTHENTICATED request org\n * (`ExecutionContext.initiatorIds.organizationId`) — this field is attacker-influenceable on\n * pre-auth paths (a failed-login email domain → org lookup), so routing on it would leak one\n * tenant's events into another tenant's SIEM (F4). See `AuditLogsBackendService._createAuditLog`.\n \n ## Why an attacker-influenceable value is nonetheless SAFE to persist here\n \n Recorded 2026-08-05, when this field stopped being silently dropped on write (see\n * `_createAuditLog`'s `preserveServerInjectedFields` call). The change makes a value an\n * unauthenticated caller can influence both durable and, on the org-scoped viewer, VISIBLE — so\n * the two channels it could reach were each checked rather than assumed.\n \n 1. SIEM delivery — unaffected. Per-org dispatch keys on the AUTHENTICATED request org, never\n * on this field (F4, above). Persisting it changes no routing decision, so the cross-tenant\n * SIEM leak F4 exists to prevent is not reachable through it.\n * 2. In-product visibility — intended, not a leak. `ORGANIZATIONS → AUDIT_LOGS` is\n * `REQUIRES_CONTEXT` on `organizationId`, so this value decides which org sees the row in the\n * org-scoped Audit Log Viewer. A failed-login row surfacing in the org whose user was targeted\n * is the CORRECT outcome — a tenant seeing authentication attempts against its own members is\n * the purpose of an audit log, not a disclosure. Nothing about a third org is exposed: the row\n * describes the attempt itself.\n \n Residual, stated rather than hidden: an unauthenticated caller can therefore cause rows to\n * appear in a NAMED org's viewer (log injection / noise) by choosing the email domain it probes.\n * Bounded to rows describing that caller's own attempt against that org, which is the org already\n * being attacked and the party with the strongest reason to see them. Volume abuse is bounded by\n * the authentication rate limiters, not by this field. If a future review wants that noise\n * separated, the fix is a provenance discriminator on the row (authenticated vs. domain-resolved\n * org), NOT dropping the field again — dropping it is what made the viewer's org filter return\n * nothing at all.\n \n assurance-control: WILDO.ACCESS.SCOPE_CONFINEMENT — tenant segregation of the audit trail is\n * enforced on the authenticated scope, while the subject org retains visibility of events\n * concerning it.\n /\n organizationId: z.string().isSummaryField().optional(),\n /\n The application the event is ABOUT when its owning tenant is application-scoped.\n * Like `organizationId`, this is forensic event data and never a per-org SIEM routing key.\n /\n applicationId: z.string().isSummaryField().optional(),\n /\n The request-correlation id (see `ExecutionContext.correlationId`) — groups every audit row produced\n * by ONE request / job / cron tick, and equals the `correlationId` stamped on that request's structured\n * log lines and errors, so an investigator can pivot audit ⇄ logs ⇄ error by a single id. Populated by\n * `_createAuditLog` from the request `ExecutionContext` when threaded, else from the ambient\n * request-context ALS frame — that fallback is what finally populates it on the COMMON emit path (most\n * emitters pass no EC). Indexed for correlation queries. Store-agnostic like `eventId`, but distinct:\n * `eventId` correlates ONE event across audit stores; `correlationId` correlates MANY events to one request.\n /\n correlationId: z.string().isDBIndexed().isSummaryField().optional(),\n /\n Which frontend SURFACE the request originated from (`x-frontend-service-name`: app / website / docs),\n * captured at the HTTP edge into the request-context frame and hoisted here by `_createAuditLog`. Origin\n * attribution — \"where did this action come from\". Absent for non-HTTP (job / cron / internal) events.\n /\n frontendServiceName: z.string().isSummaryField().optional(),\n /\n Which browser/device INSTALL the request came from (`x-client-instance-id`) — the axis that lets a\n * reviewer group one actor's activity ACROSS sessions and logins, which `correlationId` (one request)\n * and `frontendServiceName` (which surface) cannot. Captured at the HTTP edge into the request-context\n * frame and hoisted here by `_createAuditLog`, exactly like `frontendServiceName`.\n \n *Populated ONLY when the application authored a non-`DISABLED` `compliance.clientInstanceIdScope`\n (OPT-IN, default OFF — Fork D / SD9).** Absent for every unopted application, for non-HTTP events\n * (job / cron / internal), and whenever the client sent no id. It is a pseudonymous identifier under\n * GDPR Art 4(5), so it carries obligations the other correlation columns do not — see\n * `ClientInstanceIdScope` and `.claude/plans/traceability-correlation-id.md` (SD9).\n \n Deliberately DISTINCT from (never merged with, per SD8): `anonymousUserId` (an identity the app\n * assigns a pre-auth PERSON), `DeviceInfoSchema.fingerprint` (a derived/probabilistic device\n * signature), and `clientId` (the OAuth `azp` — which SOFTWARE client, already on the row).\n /\n // GDPR Art. 4(5) pseudonymised data by this field's own JSDoc above — so it is personal data, and\n // a notice must enumerate it. IDENTITY: it is an identifier assigned to a person's client, not an\n // observation of what they did.\n clientInstanceId: z.string().isDBIndexed().isSummaryField().optional()\n .dataCategories(PersonalDataCategory.IDENTITY),\n /\n The KIND of principal whose authority was used ({@link AuditActorKind}) — `userId` names the\n * principal, this says what kind it is. Filled by `_createAuditLog` on every row it writes, and by\n * nothing else. It resolves from the principal the emitter NAMES when there is one (a sign-in is\n * audited under a pre-auth context, which is true of the request and wrong about who acted), else\n * from the request `ExecutionContext`, else — last resort — from the actor id the emitter wrote.\n * Optional in the schema only because rows written before it existed carry none.\n \n It is the PRINCIPAL's kind and never the agent's: whether an agent acted is `agentActor`'s presence.\n /\n actorKind: z.enum(AuditActorKind).systemEnum('AuditActorKind').isDBIndexed().isSummaryField().optional(),\n /\n Which AI agent performed the action, and in which execution — present ONLY when an agent acted\n * ({@link AuditAgentActorSchema}). Taken from the request `ExecutionContext`, else from the ambient\n * agent frame the framework opens around every tool call, so a tool that builds its own context or\n * writes as the system is attributed without doing anything. Identifiers only: never argument\n * values, never digests of them.\n \n USAGE — its `agentExecutionId` is a pseudonymous key into a transcript the user owns; erasing the\n * transcript leaves the key resolving to nothing, which is what keeps an unscrubbable ledger\n * compatible with erasure.\n /\n agentActor: AuditAgentActorSchema.optional().dataCategories(PersonalDataCategory.USAGE),\n /\n The external OAuth client a person delegated to (`actorKind = DELEGATED_CLIENT`) — the verified\n * token's `azp`, captured after the audience check and never from a header. An opaque string: a\n * client identified by an HTTPS URL has no row to join to. Evidence only.\n /\n delegatingClientId: z.string().isSummaryField().optional(),\n /\n The machine credential a MACHINE principal authenticated with (`actorKind = MACHINE`): an API key's\n * or OAuth client's id, or — for a shared platform secret that has no credential record — its stable\n * name, never its value. Recorded here and never in a `By` field, whose contract is \"a user id or a\n sentinel\".\n /\n principalCredentialId: z.string().isSummaryField().optional(),\n /\n The service-provider relationship the principal acted THROUGH (#1597) — present only on a row written\n * in a CLIENT organization by an expert or firm machine client that a live relationship admitted there.\n * Derived by `_createAuditLog` from the role entry for the row's organization, never supplied by an\n * emitter. Indexed because the client filters its own trail by relationship (\"what did firm X do here?\").\n /\n actingViaServiceProviderRelationshipId: z.string().isDBIndexed().isSummaryField().optional(),\n /* The firm behind {@link actingViaServiceProviderRelationshipId}; present exactly when it is. Evidence only. /\n providerOrganizationId: z.string().isSummaryField().optional(),\n /\n Where the second factor that satisfied the CLIENT organization's authentication policy came from, on a row a\n * firm's expert caused in that client (#1633) — present only when the client's policy required one and the\n * session satisfied it for that client. Derived by `_createAuditLog` from the request's context for the row's own\n * organization, never supplied by an emitter. The client's answer to \"was this action MFA-protected, and by whom?\".\n /\n serviceProviderFactorSource: z.enum(FactorSatisfactionSource).systemEnum('FactorSatisfactionSource').isSummaryField().optional()\n .describe('On an action a service firm\\'s expert took inside a client organization whose policy requires a second factor: where the factor that satisfied that policy came from, a step-up to this application or the firm\\'s own identity provider the client trusts. Absent when the client\\'s policy required none.'),\n riskLevel: z.enum(ResourceOperationRiskLevel).isSummaryField(),\n // USAGE — an audit row is a record of what a principal DID. The event type and its data together\n // are the observation, so both carry the category; `riskLevel`, `eventCategory` and `severity` are\n // the framework's CLASSIFICATION of the event rather than data about the person, and carry none.\n //\n // ⚠️ The reverse of the `.isAuditEvidence()` rule, and deliberately so. That marker decides which\n // FIELD VALUES get copied INTO an audit row, and personal data must never be marked, because the\n // immutable ledger cannot be scrubbed. This declaration is about the audit row's OWN fields, which\n // hold personal data whether or not anyone wanted them to — and a notice must say so precisely\n // BECAUSE they are unerasable.\n //\n // `.systemEnum(CORE_AUDITABLE_EVENT_TYPE)` names the OPEN vocabulary the value belongs to (#1791): the field stays a\n // string (whoever emits an event writes its type), and every trail shows the type's word\n // (`system_enums.CoreAuditableEventType.<value>`) instead of its wire value, the missing word showing the value.\n eventType: z.string().systemEnum(EngineOpenVocabulary.CORE_AUDITABLE_EVENT_TYPE).isSummaryField().dataCategories(PersonalDataCategory.USAGE),\n eventData: AuditableEvent_DataSchema.dataCategories(PersonalDataCategory.USAGE),\n /* Populated by service layer via getAuditEventClassification(). Required for CREATE (audit logs are REPOSITORY_ONLY, no API). /\n eventCategory: z.enum(AuditEventCategory).isSummaryField(),\n /* Populated by service layer via getAuditEventClassification(). Required for CREATE (audit logs are REPOSITORY_ONLY, no API). /\n severity: z.enum(AuditEventSeverity).isSummaryField(),\n createdAt: z.date().default(() => new Date()).isSummaryField().excludeFromCreate().excludeFromUpdate(),\n updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate()\n});\n\n\n\n// Type-safe discriminated union for TypeScript validation (used in service layer)\n/\n One retention-class sweep run, summarised per class (#1636). Counts only — no row id, no field value, no\n * person: the per-resource detail is in the `retentionEnforcementRecords` row the same run wrote.\n /\nexport const AuditableEvent_RetentionEnforcementRecorded_EventDataSchema = z.object({\n eventType: z.literal(CoreAuditableEventType.RETENTION_ENFORCEMENT_RECORDED),\n /* The run's `runRef`, shared with every enforcement record it wrote. /\n runRef: z.string(),\n /* The instant the run computed its cutoffs from, ISO. /\n sweptAt: z.string(),\n /* FAILED when any resource failed; else DEFERRED_BY_CEILING when any stopped at the ceiling; else COMPLETED. /\n outcome: z.enum(RetentionEnforcementOutcome),\n boundResourceCount: z.number().int().min(0),\n deletedCount: z.number().int().min(0),\n /* Enforcement records this run could not write. Non-zero fails the run: its enforcement is unevidenced. /\n recordWriteFailureCount: z.number().int().min(0),\n classes: z.array(z.object({\n retentionClass: z.enum(DataRetentionClass),\n resourceCount: z.number().int().min(0),\n deletedCount: z.number().int().min(0),\n completedCount: z.number().int().min(0),\n deferredByCeilingCount: z.number().int().min(0),\n failedCount: z.number().int().min(0),\n skippedCount: z.number().int().min(0),\n /* Absent when no hold check ran for any resource of the class (#1634). */\n heldSkippedCount: z.number().int().min(0).optional(),\n })),\n});\n\nexport const AuditableEvent_TypedDataSchema = z.discriminatedUnion('eventType', [\n AuditableEvent_User_LoginEventDataSchema,\n AuditableEvent_User_LogoutEventDataSchema,\n AuditableEvent_User_LoginFailedEventDataSchema,\n AuditableEvent_User_AccountLockedEventDataSchema,\n AuditableEvent_MachineAuth_SuccessEventDataSchema,\n AuditableEvent_MachineAuth_FailedEventDataSchema,\n AuditableEvent_MachineAccess_EventDataSchema,\n AuditableEvent_User_SessionExpiredEventDataSchema,\n AuditableEvent_User_AppRolesChangedEventDataSchema,\n AuditableEvent_Application_SuperAdminFloorBreachedEventDataSchema,\n AuditableEvent_Organization_OwnerFloorBreachedEventDataSchema,\n AuditableEvent_Organization_TypeAssignedEventDataSchema,\n AuditableEvent_OrganizationMember_InvitedEventDataSchema,\n AuditableEvent_OrganizationMember_JoinedEventDataSchema,\n AuditableEvent_OrganizationMember_UpdatedEventDataSchema,\n AuditableEvent_OrganizationMember_RoleChangedEventDataSchema,\n AuditableEvent_OrganizationMember_StatusChangedEventDataSchema,\n AuditableEvent_OrganizationMember_RemovedEventDataSchema,\n AuditableEvent_Organization_CreatedEventDataSchema,\n AuditableEvent_Organization_UpdatedEventDataSchema,\n AuditableEvent_Organization_DeletedEventDataSchema,\n AuditableEvent_Organization_DeletionRequestedEventDataSchema,\n AuditableEvent_Organization_RestoredEventDataSchema,\n AuditableEvent_Organization_SuspendedEventDataSchema,\n AuditableEvent_Resource_StatusTransitionPerformedEventDataSchema,\n AuditableEvent_Organization_ActivatedEventDataSchema,\n AuditableEvent_OrganizationNotifications_UpdatedEventDataSchema,\n AuditableEvent_OrganizationPreferences_UpdatedEventDataSchema,\n AuditableEvent_OrganizationProfile_UpdatedEventDataSchema,\n AuditableEvent_OrganizationUnit_UpdatedEventDataSchema,\n AuditableEvent_OrganizationUnitMember_RoleChangedEventDataSchema,\n AuditableEvent_OrganizationUnitMember_RemovedEventDataSchema,\n AuditableEvent_User_DeletedEventDataSchema,\n AuditableEvent_User_SSOLoginEventDataSchema,\n AuditableEvent_User_SSOLoginFailedEventDataSchema,\n AuditableEvent_User_SSOEnforcementBlockedEventDataSchema,\n AuditableEvent_User_TokenRefreshedEventDataSchema,\n AuditableEvent_Organization_SSOConfigurationChangedEventDataSchema,\n AuditableEvent_Organization_SIEMExportConfiguredEventDataSchema,\n AuditableEvent_Organization_SIEMExportDisabledEventDataSchema,\n AuditableEvent_Organization_SIEMExportDestinationChangedEventDataSchema,\n AuditableEvent_OrganizationProviderCredential_SetEventDataSchema,\n AuditableEvent_OrganizationProviderCredential_RotatedEventDataSchema,\n AuditableEvent_OrganizationProviderCredential_UsedEventDataSchema,\n AuditableEvent_OrganizationProviderCredential_DeletedEventDataSchema,\n AuditableEvent_ApplicationAuthPolicyChanged_EventDataSchema,\n AuditableEvent_RetentionEnforcementRecorded_EventDataSchema,\n AuditableEvent_Webhook_EndpointTestDispatchedEventDataSchema,\n AuditableEvent_InboundDelivery_RejectedEventDataSchema,\n AuditableEvent_InboundDelivery_AcceptedEventDataSchema,\n AuditableEvent_InboundDelivery_UnroutableEventDataSchema,\n AuditableEvent_InboundDelivery_ProcessedEventDataSchema,\n AuditableEvent_InboundDelivery_FailedEventDataSchema,\n AuditableEvent_InboundDelivery_DeadEventDataSchema,\n AuditableEvent_InboundDelivery_ReplayedEventDataSchema,\n AuditableEvent_InboundDelivery_BelowAssuranceEventDataSchema,\n AuditableEvent_InboundReply_SentEventDataSchema,\n AuditableEvent_InboundReply_FailedEventDataSchema,\n AuditableEvent_InboundReplyToken_RevokedEventDataSchema,\n AuditableEvent_InboundReplyToken_DowngradedEventDataSchema,\n AuditableEvent_OrganizationEmailDomain_ClaimedEventDataSchema,\n AuditableEvent_OrganizationEmailDomain_OwnershipVerifiedEventDataSchema,\n AuditableEvent_OrganizationEmailDomain_VerifiedEventDataSchema,\n AuditableEvent_OrganizationEmailDomain_SuspendedEventDataSchema,\n AuditableEvent_OrganizationEmailDomain_RemovedEventDataSchema,\n AuditableEvent_ClientMailbox_CreatedEventDataSchema,\n AuditableEvent_ClientMailbox_RemovedEventDataSchema,\n AuditableEvent_InboundEmail_AttachmentWithheldEventDataSchema,\n AuditableEvent_InboundEmail_RejectedLimitEventDataSchema,\n AuditableEvent_AutonomousAgent_BoundEventDataSchema,\n AuditableEvent_AutonomousAgent_UnboundEventDataSchema,\n AuditableEvent_AutonomousAgent_TurnStartedEventDataSchema,\n AuditableEvent_AutonomousAgent_TurnRefusedEventDataSchema,\n AuditableEvent_SCIM_TokenCreatedEventDataSchema,\n AuditableEvent_SCIM_TokenRevokedEventDataSchema,\n AuditableEvent_SCIM_UserProvisionedEventDataSchema,\n AuditableEvent_SCIM_UserUpdatedEventDataSchema,\n AuditableEvent_SCIM_UserDeactivatedEventDataSchema,\n AuditableEvent_User_PasswordResetRequestedEventDataSchema,\n AuditableEvent_User_PasswordResetCompletedEventDataSchema,\n AuditableEvent_User_PasswordResetForcedEventDataSchema,\n AuditableEvent_User_RegisteredEventDataSchema,\n AuditableEvent_User_EmailVerifiedEventDataSchema,\n AuditableEvent_User_VerificationEmailResentEventDataSchema,\n AuditableEvent_User_MFASetupStartedEventDataSchema,\n AuditableEvent_User_MFASetupCompletedEventDataSchema,\n AuditableEvent_User_MFAEmailOTPSentEventDataSchema,\n AuditableEvent_User_PasskeyRegisteredEventDataSchema,\n AuditableEvent_User_PasskeyAuthSuccessEventDataSchema,\n AuditableEvent_User_PasskeyAuthFailureEventDataSchema,\n AuditableEvent_User_PasskeyRemovedEventDataSchema,\n AuditableEvent_User_PasskeyCloneSuspectedEventDataSchema,\n AuditableEvent_User_MagicLinkSentEventDataSchema,\n AuditableEvent_User_MagicLinkVerifiedEventDataSchema,\n AuditableEvent_User_MagicLinkFailedEventDataSchema,\n AuditableEvent_User_SMSOTPSentEventDataSchema,\n AuditableEvent_User_SMSOTPVerifiedEventDataSchema,\n AuditableEvent_User_SMSOTPFailedEventDataSchema,\n AuditableEvent_User_PhoneVerifiedEventDataSchema,\n AuditableEvent_User_PhoneVerificationFailedEventDataSchema,\n AuditableEvent_OAuth2ProviderBlockedEventDataSchema,\n AuditableEvent_OidcAcrDemandUnsatisfiedEventDataSchema,\n AuditableEvent_EmergencyAccess_UsedEventDataSchema,\n AuditableEvent_FieldAccess_EventDataSchema,\n AuditableEvent_ResourceOperationPerformed_EventDataSchema,\n AuditableEvent_ResourceOperationDenied_EventDataSchema,\n AuditableEvent_CrossTenantAdministrativeAccess_EventDataSchema,\n AuditableEvent_PlatformDirectoryAccess_EventDataSchema,\n AuditableEvent_PlatformAccessGrantLifecycle_EventDataSchema,\n AuditableEvent_LegalHoldPlaced_EventDataSchema,\n AuditableEvent_LegalHoldReleased_EventDataSchema,\n AuditableEvent_ModelCostAggregateInvoiceLinked_EventDataSchema,\n AuditableEvent_CorrectionCaptureSettingChanged_EventDataSchema,\n AuditableEvent_EvaluationExportAuthorizationChanged_EventDataSchema,\n AuditableEvent_EvaluationDatasetExported_EventDataSchema,\n AuditableEvent_EvaluationDatasetExportRefused_EventDataSchema,\n AuditableEvent_ServiceProviderRelationshipLifecycle_EventDataSchema,\n AuditableEvent_ServiceProviderMachineClientAdmissionChanged_EventDataSchema,\n AuditableEvent_ServiceProviderExpertAssigned_EventDataSchema,\n AuditableEvent_ServiceProviderExpertUnassigned_EventDataSchema,\n AuditableEvent_ServiceProviderExpertApprovalRequested_EventDataSchema,\n AuditableEvent_ServiceProviderExpertApprovalGranted_EventDataSchema,\n AuditableEvent_ServiceProviderExpertApprovalDenied_EventDataSchema,\n AuditableEvent_ServiceProviderExpertApprovalLapsed_EventDataSchema,\n AuditableEvent_ServiceProviderCapabilityGranted_EventDataSchema,\n AuditableEvent_ServiceProviderCapabilityRevoked_EventDataSchema,\n AuditableEvent_ServiceProviderMfaTrustChanged_EventDataSchema,\n AuditableEvent_ServiceProviderClientAuthenticationSatisfied_EventDataSchema,\n AuditableEvent_ServiceProviderActivityFeedDecided_EventDataSchema,\n AuditableEvent_ServiceProviderActivityFeedDisclosureChanged_EventDataSchema,\n AuditableEvent_SystemOfRecordPartitionAssignmentLifecycle_EventDataSchema,\n AuditableEvent_RetainedDataAccess_EventDataSchema,\n AuditableEvent_GovernedDocument_InteractionRecordedEventDataSchema,\n AuditableEvent_SubjectDataExport_EventDataSchema,\n AuditableEvent_CollectionDataExport_EventDataSchema,\n AuditableEvent_User_SessionEvictedEventDataSchema,\n AuditableEvent_HttpApiReadThroughAccess_EventDataSchema,\n AuditableEvent_HttpApiWriteThrough_EventDataSchema,\n AuditableEvent_SystemOfRecordActionExecuted_EventDataSchema,\n AuditableEvent_SystemOfRecordActionRefused_EventDataSchema,\n AuditableEvent_ExternalDataPipelineReset_EventDataSchema,\n AuditableEvent_ExternalDataOutboundUnknownResolved_EventDataSchema,\n AuditableEvent_ExternalDataConflictResolved_EventDataSchema,\n AuditableEvent_ProviderOperationCall_EventDataSchema,\n AuditableEvent_ProviderOperationDenied_EventDataSchema,\n AuditableEvent_HttpApiExternalErasure_EventDataSchema,\n AuditableEvent_HttpApiNonErasureAcknowledged_EventDataSchema,\n AuditableEvent_SubjectErasureRecipientOutcome_EventDataSchema,\n AuditableEvent_User_CrossFrontendHandoffIssuedEventDataSchema,\n AuditableEvent_OAuth_DelegatedTokenIssuedEventDataSchema,\n AuditableEvent_OAuth_ConsentGrantedEventDataSchema,\n AuditableEvent_OAuth_ConsentDeniedEventDataSchema,\n AuditableEvent_OAuth_ConsentGrantPersistedEventDataSchema,\n AuditableEvent_OAuth_TokenRefreshedEventDataSchema,\n AuditableEvent_OAuth_TokenRevokedEventDataSchema,\n AuditableEvent_OAuth_RpInitiatedLogoutEventDataSchema,\n AuditableEvent_OAuth_CodeExchangeFailedEventDataSchema,\n AuditableEvent_OAuth_ConsentBindingViolationEventDataSchema,\n AuditableEvent_User_RefreshTokenReuseDetectedEventDataSchema,\n]);\n\n\n\n\nexport type AuditableEvent = z.infer<typeof AuditableEvent_BaseSchema>;\nexport type AuditableEvent_User_LoginEventData = z.infer<typeof AuditableEvent_User_LoginEventDataSchema>;\nexport type AuditableEvent_User_LogoutEventData = z.infer<typeof AuditableEvent_User_LogoutEventDataSchema>;\nexport type AuditableEvent_User_LoginFailedEventData = z.infer<typeof AuditableEvent_User_LoginFailedEventDataSchema>;\nexport type AuditableEvent_MachineAuth_SuccessEventData = z.infer<typeof AuditableEvent_MachineAuth_SuccessEventDataSchema>;\nexport type AuditableEvent_MachineAuth_FailedEventData = z.infer<typeof AuditableEvent_MachineAuth_FailedEventDataSchema>;\nexport type AuditableEvent_MachineAccess_EventData = z.infer<typeof AuditableEvent_MachineAccess_EventDataSchema>;\nexport type AuditableEvent_User_AccountLockedEventData = z.infer<typeof AuditableEvent_User_AccountLockedEventDataSchema>;\nexport type AuditableEvent_User_SessionExpiredEventData = z.infer<typeof AuditableEvent_User_SessionExpiredEventDataSchema>;\nexport type AuditableEvent_User_AppRolesChangedEventData = z.infer<typeof AuditableEvent_User_AppRolesChangedEventDataSchema>;\nexport type AuditableEvent_Application_SuperAdminFloorBreachedEventData = z.infer<typeof AuditableEvent_Application_SuperAdminFloorBreachedEventDataSchema>;\nexport type AuditableEvent_Organization_OwnerFloorBreachedEventData = z.infer<typeof AuditableEvent_Organization_OwnerFloorBreachedEventDataSchema>;\nexport type AuditableEvent_Organization_TypeAssignedEventData = z.infer<typeof AuditableEvent_Organization_TypeAssignedEventDataSchema>;\nexport type AuditableEvent_User_DeletedEventData = z.infer<typeof AuditableEvent_User_DeletedEventDataSchema>;\nexport type AuditableEvent_OrganizationMember_InvitedEventData = z.infer<typeof AuditableEvent_OrganizationMember_InvitedEventDataSchema>;\nexport type AuditableEvent_OrganizationMember_JoinedEventData = z.infer<typeof AuditableEvent_OrganizationMember_JoinedEventDataSchema>;\nexport type AuditableEvent_OrganizationMember_UpdatedEventData = z.infer<typeof AuditableEvent_OrganizationMember_UpdatedEventDataSchema>;\nexport type AuditableEvent_OrganizationMember_RoleChangedEventData = z.infer<typeof AuditableEvent_OrganizationMember_RoleChangedEventDataSchema>;\nexport type AuditableEvent_OrganizationMember_StatusChangedEventData = z.infer<typeof AuditableEvent_OrganizationMember_StatusChangedEventDataSchema>;\nexport type AuditableEvent_OrganizationMember_RemovedEventData = z.infer<typeof AuditableEvent_OrganizationMember_RemovedEventDataSchema>;\nexport type AuditableEvent_Organization_CreatedEventData = z.infer<typeof AuditableEvent_Organization_CreatedEventDataSchema>;\nexport type AuditableEvent_Organization_UpdatedEventData = z.infer<typeof AuditableEvent_Organization_UpdatedEventDataSchema>;\nexport type AuditableEvent_Organization_DeletedEventData = z.infer<typeof AuditableEvent_Organization_DeletedEventDataSchema>;\nexport type AuditableEvent_Organization_DeletionRequestedEventData = z.infer<typeof AuditableEvent_Organization_DeletionRequestedEventDataSchema>;\nexport type AuditableEvent_Organization_RestoredEventData = z.infer<typeof AuditableEvent_Organization_RestoredEventDataSchema>;\nexport type AuditableEvent_Organization_SuspendedEventData = z.infer<typeof AuditableEvent_Organization_SuspendedEventDataSchema>;\nexport type AuditableEvent_Resource_StatusTransitionPerformedEventData = z.infer<typeof AuditableEvent_Resource_StatusTransitionPerformedEventDataSchema>;\nexport type AuditableEvent_Organization_ActivatedEventData = z.infer<typeof AuditableEvent_Organization_ActivatedEventDataSchema>;\nexport type AuditableEvent_OrganizationNotifications_UpdatedEventData = z.infer<typeof AuditableEvent_OrganizationNotifications_UpdatedEventDataSchema>;\nexport type AuditableEvent_OrganizationPreferences_UpdatedEventData = z.infer<typeof AuditableEvent_OrganizationPreferences_UpdatedEventDataSchema>;\nexport type AuditableEvent_OrganizationProfile_UpdatedEventData = z.infer<typeof AuditableEvent_OrganizationProfile_UpdatedEventDataSchema>;\nexport type AuditableEvent_OrganizationUnit_UpdatedEventData = z.infer<typeof AuditableEvent_OrganizationUnit_UpdatedEventDataSchema>;\nexport type AuditableEvent_OrganizationUnitMember_RoleChangedEventData = z.infer<typeof AuditableEvent_OrganizationUnitMember_RoleChangedEventDataSchema>;\nexport type AuditableEvent_OrganizationUnitMember_RemovedEventData = z.infer<typeof AuditableEvent_OrganizationUnitMember_RemovedEventDataSchema>;\nexport type AuditableEvent_User_SSOLoginEventData = z.infer<typeof AuditableEvent_User_SSOLoginEventDataSchema>;\nexport type AuditableEvent_User_SSOLoginFailedEventData = z.infer<typeof AuditableEvent_User_SSOLoginFailedEventDataSchema>;\nexport type AuditableEvent_User_SSOEnforcementBlockedEventData = z.infer<typeof AuditableEvent_User_SSOEnforcementBlockedEventDataSchema>;\nexport type AuditableEvent_User_TokenRefreshedEventData = z.infer<typeof AuditableEvent_User_TokenRefreshedEventDataSchema>;\nexport type AuditableEvent_Organization_SSOConfigurationChangedEventData = z.infer<typeof AuditableEvent_Organization_SSOConfigurationChangedEventDataSchema>;\nexport type AuditableEvent_Organization_SIEMExportConfiguredEventData = z.infer<typeof AuditableEvent_Organization_SIEMExportConfiguredEventDataSchema>;\nexport type AuditableEvent_Organization_SIEMExportDisabledEventData = z.infer<typeof AuditableEvent_Organization_SIEMExportDisabledEventDataSchema>;\nexport type AuditableEvent_Organization_SIEMExportDestinationChangedEventData = z.infer<typeof AuditableEvent_Organization_SIEMExportDestinationChangedEventDataSchema>;\nexport type AuditableEvent_OrganizationProviderCredential_SetEventData = z.infer<typeof AuditableEvent_OrganizationProviderCredential_SetEventDataSchema>;\nexport type AuditableEvent_OrganizationProviderCredential_RotatedEventData = z.infer<typeof AuditableEvent_OrganizationProviderCredential_RotatedEventDataSchema>;\nexport type AuditableEvent_OrganizationProviderCredential_UsedEventData = z.infer<typeof AuditableEvent_OrganizationProviderCredential_UsedEventDataSchema>;\nexport type AuditableEvent_OrganizationProviderCredential_DeletedEventData = z.infer<typeof AuditableEvent_OrganizationProviderCredential_DeletedEventDataSchema>;\nexport type AuditableEvent_UserProviderCredential_SetEventData = z.infer<typeof AuditableEvent_UserProviderCredential_SetEventDataSchema>;\nexport type AuditableEvent_UserProviderCredential_RotatedEventData = z.infer<typeof AuditableEvent_UserProviderCredential_RotatedEventDataSchema>;\nexport type AuditableEvent_UserProviderCredential_UsedEventData = z.infer<typeof AuditableEvent_UserProviderCredential_UsedEventDataSchema>;\nexport type AuditableEvent_UserProviderCredential_DeletedEventData = z.infer<typeof AuditableEvent_UserProviderCredential_DeletedEventDataSchema>;\nexport type AuditableEvent_UserProviderConnection_GrantedEventData = z.infer<typeof AuditableEvent_UserProviderConnection_GrantedEventDataSchema>;\nexport type AuditableEvent_OrganizationProviderConnection_GrantedEventData = z.infer<typeof AuditableEvent_OrganizationProviderConnection_GrantedEventDataSchema>;\nexport type ApplicationAuthPolicySnapshot = z.infer<typeof ApplicationAuthPolicySnapshotSchema>;\nexport type AuditableEvent_ApplicationAuthPolicyChanged_EventData = z.infer<typeof AuditableEvent_ApplicationAuthPolicyChanged_EventDataSchema>;\nexport type AuditableEvent_RetentionEnforcementRecorded_EventData = z.infer<typeof AuditableEvent_RetentionEnforcementRecorded_EventDataSchema>;\nexport type AuditableEvent_Webhook_EndpointTestDispatchedEventData = z.infer<typeof AuditableEvent_Webhook_EndpointTestDispatchedEventDataSchema>;\nexport type AuditableEvent_InboundDelivery_RejectedEventData = z.infer<typeof AuditableEvent_InboundDelivery_RejectedEventDataSchema>;\nexport type AuditableEvent_InboundDelivery_AcceptedEventData = z.infer<typeof AuditableEvent_InboundDelivery_AcceptedEventDataSchema>;\nexport type AuditableEvent_InboundDelivery_UnroutableEventData = z.infer<typeof AuditableEvent_InboundDelivery_UnroutableEventDataSchema>;\nexport type AuditableEvent_InboundDelivery_ProcessedEventData = z.infer<typeof AuditableEvent_InboundDelivery_ProcessedEventDataSchema>;\nexport type AuditableEvent_InboundDelivery_FailedEventData = z.infer<typeof AuditableEvent_InboundDelivery_FailedEventDataSchema>;\nexport type AuditableEvent_InboundDelivery_DeadEventData = z.infer<typeof AuditableEvent_InboundDelivery_DeadEventDataSchema>;\nexport type AuditableEvent_InboundDelivery_ReplayedEventData = z.infer<typeof AuditableEvent_InboundDelivery_ReplayedEventDataSchema>;\nexport type AuditableEvent_InboundDelivery_BelowAssuranceEventData = z.infer<typeof AuditableEvent_InboundDelivery_BelowAssuranceEventDataSchema>;\nexport type AuditableEvent_InboundReply_SentEventData = z.infer<typeof AuditableEvent_InboundReply_SentEventDataSchema>;\nexport type AuditableEvent_InboundReply_FailedEventData = z.infer<typeof AuditableEvent_InboundReply_FailedEventDataSchema>;\nexport type AuditableEvent_InboundReplyToken_RevokedEventData = z.infer<typeof AuditableEvent_InboundReplyToken_RevokedEventDataSchema>;\nexport type AuditableEvent_InboundReplyToken_DowngradedEventData = z.infer<typeof AuditableEvent_InboundReplyToken_DowngradedEventDataSchema>;\nexport type AuditableEvent_OrganizationEmailDomain_ClaimedEventData = z.infer<typeof AuditableEvent_OrganizationEmailDomain_ClaimedEventDataSchema>;\nexport type AuditableEvent_OrganizationEmailDomain_OwnershipVerifiedEventData = z.infer<typeof AuditableEvent_OrganizationEmailDomain_OwnershipVerifiedEventDataSchema>;\nexport type AuditableEvent_OrganizationEmailDomain_VerifiedEventData = z.infer<typeof AuditableEvent_OrganizationEmailDomain_VerifiedEventDataSchema>;\nexport type AuditableEvent_OrganizationEmailDomain_SuspendedEventData = z.infer<typeof AuditableEvent_OrganizationEmailDomain_SuspendedEventDataSchema>;\nexport type AuditableEvent_OrganizationEmailDomain_RemovedEventData = z.infer<typeof AuditableEvent_OrganizationEmailDomain_RemovedEventDataSchema>;\nexport type AuditableEvent_ClientMailbox_CreatedEventData = z.infer<typeof AuditableEvent_ClientMailbox_CreatedEventDataSchema>;\nexport type AuditableEvent_ClientMailbox_RemovedEventData = z.infer<typeof AuditableEvent_ClientMailbox_RemovedEventDataSchema>;\nexport type AuditableEvent_InboundEmail_AttachmentWithheldEventData = z.infer<typeof AuditableEvent_InboundEmail_AttachmentWithheldEventDataSchema>;\nexport type AuditableEvent_InboundEmail_RejectedLimitEventData = z.infer<typeof AuditableEvent_InboundEmail_RejectedLimitEventDataSchema>;\nexport type AuditableEvent_SCIM_TokenCreatedEventData = z.infer<typeof AuditableEvent_SCIM_TokenCreatedEventDataSchema>;\nexport type AuditableEvent_SCIM_TokenRevokedEventData = z.infer<typeof AuditableEvent_SCIM_TokenRevokedEventDataSchema>;\nexport type AuditableEvent_SCIM_UserProvisionedEventData = z.infer<typeof AuditableEvent_SCIM_UserProvisionedEventDataSchema>;\nexport type AuditableEvent_SCIM_UserUpdatedEventData = z.infer<typeof AuditableEvent_SCIM_UserUpdatedEventDataSchema>;\nexport type AuditableEvent_SCIM_UserDeactivatedEventData = z.infer<typeof AuditableEvent_SCIM_UserDeactivatedEventDataSchema>;\nexport type AuditableEvent_User_PasswordResetRequestedEventData = z.infer<typeof AuditableEvent_User_PasswordResetRequestedEventDataSchema>;\nexport type AuditableEvent_User_PasswordResetCompletedEventData = z.infer<typeof AuditableEvent_User_PasswordResetCompletedEventDataSchema>;\nexport type AuditableEvent_User_PasswordResetForcedEventData = z.infer<typeof AuditableEvent_User_PasswordResetForcedEventDataSchema>;\nexport type AuditableEvent_User_RegisteredEventData = z.infer<typeof AuditableEvent_User_RegisteredEventDataSchema>;\nexport type AuditableEvent_User_EmailVerifiedEventData = z.infer<typeof AuditableEvent_User_EmailVerifiedEventDataSchema>;\nexport type AuditableEvent_User_VerificationEmailResentEventData = z.infer<typeof AuditableEvent_User_VerificationEmailResentEventDataSchema>;\nexport type AuditableEvent_User_MFASetupStartedEventData = z.infer<typeof AuditableEvent_User_MFASetupStartedEventDataSchema>;\nexport type AuditableEvent_User_MFASetupCompletedEventData = z.infer<typeof AuditableEvent_User_MFASetupCompletedEventDataSchema>;\nexport type AuditableEvent_User_MFAEmailOTPSentEventData = z.infer<typeof AuditableEvent_User_MFAEmailOTPSentEventDataSchema>;\nexport type AuditableEvent_User_PasskeyRegisteredEventData = z.infer<typeof AuditableEvent_User_PasskeyRegisteredEventDataSchema>;\nexport type AuditableEvent_User_PasskeyAuthSuccessEventData = z.infer<typeof AuditableEvent_User_PasskeyAuthSuccessEventDataSchema>;\nexport type AuditableEvent_User_PasskeyAuthFailureEventData = z.infer<typeof AuditableEvent_User_PasskeyAuthFailureEventDataSchema>;\nexport type AuditableEvent_User_PasskeyCloneSuspectedEventData = z.infer<typeof AuditableEvent_User_PasskeyCloneSuspectedEventDataSchema>;\nexport type AuditableEvent_User_PasskeyRemovedEventData = z.infer<typeof AuditableEvent_User_PasskeyRemovedEventDataSchema>;\nexport type AuditableEvent_User_MagicLinkSentEventData = z.infer<typeof AuditableEvent_User_MagicLinkSentEventDataSchema>;\nexport type AuditableEvent_User_MagicLinkVerifiedEventData = z.infer<typeof AuditableEvent_User_MagicLinkVerifiedEventDataSchema>;\nexport type AuditableEvent_User_MagicLinkFailedEventData = z.infer<typeof AuditableEvent_User_MagicLinkFailedEventDataSchema>;\nexport type AuditableEvent_User_SMSOTPSentEventData = z.infer<typeof AuditableEvent_User_SMSOTPSentEventDataSchema>;\nexport type AuditableEvent_User_SMSOTPVerifiedEventData = z.infer<typeof AuditableEvent_User_SMSOTPVerifiedEventDataSchema>;\nexport type AuditableEvent_User_SMSOTPFailedEventData = z.infer<typeof AuditableEvent_User_SMSOTPFailedEventDataSchema>;\nexport type AuditableEvent_User_PhoneVerifiedEventData = z.infer<typeof AuditableEvent_User_PhoneVerifiedEventDataSchema>;\nexport type AuditableEvent_User_PhoneVerificationFailedEventData = z.infer<typeof AuditableEvent_User_PhoneVerificationFailedEventDataSchema>;\nexport type AuditableEvent_EmergencyAccess_UsedEventData = z.infer<typeof AuditableEvent_EmergencyAccess_UsedEventDataSchema>;\nexport type AuditableEvent_FieldAccess_EventData = z.infer<typeof AuditableEvent_FieldAccess_EventDataSchema>;\nexport type AuditableEvent_ResourceOperationPerformed_EventData = z.infer<typeof AuditableEvent_ResourceOperationPerformed_EventDataSchema>;\nexport type AuditableEvent_PlatformDirectoryAccess_EventData = z.infer<typeof AuditableEvent_PlatformDirectoryAccess_EventDataSchema>;\nexport type AuditableEvent_ResourceOperationDenied_EventData = z.infer<typeof AuditableEvent_ResourceOperationDenied_EventDataSchema>;\nexport type AuditableEvent_RetainedDataAccess_EventData = z.infer<typeof AuditableEvent_RetainedDataAccess_EventDataSchema>;\nexport type AuditableEvent_GovernedDocument_InteractionRecordedEventData = z.infer<typeof AuditableEvent_GovernedDocument_InteractionRecordedEventDataSchema>;\nexport type AuditableEvent_SubjectDataExport_EventData = z.infer<typeof AuditableEvent_SubjectDataExport_EventDataSchema>;\nexport type AuditableEvent_CollectionDataExport_EventData = z.infer<typeof AuditableEvent_CollectionDataExport_EventDataSchema>;\nexport type AuditableEvent_User_SessionEvictedEventData = z.infer<typeof AuditableEvent_User_SessionEvictedEventDataSchema>;\nexport type AuditableEvent_HttpApiReadThroughAccess_EventData = z.infer<typeof AuditableEvent_HttpApiReadThroughAccess_EventDataSchema>;\nexport type AuditableEvent_HttpApiWriteThrough_EventData = z.infer<typeof AuditableEvent_HttpApiWriteThrough_EventDataSchema>;\nexport type AuditableEvent_SystemOfRecordActionExecuted_EventData = z.infer<typeof AuditableEvent_SystemOfRecordActionExecuted_EventDataSchema>;\nexport type AuditableEvent_SystemOfRecordActionRefused_EventData = z.infer<typeof AuditableEvent_SystemOfRecordActionRefused_EventDataSchema>;\nexport type AuditableEvent_ExternalDataPipelineReset_EventData = z.infer<typeof AuditableEvent_ExternalDataPipelineReset_EventDataSchema>;\nexport type AuditableEvent_ExternalDataOutboundUnknownResolved_EventData = z.infer<typeof AuditableEvent_ExternalDataOutboundUnknownResolved_EventDataSchema>;\nexport type AuditableEvent_ExternalDataConflictResolved_EventData = z.infer<typeof AuditableEvent_ExternalDataConflictResolved_EventDataSchema>;\nexport type AuditableEvent_ProviderOperationCall_EventData = z.infer<typeof AuditableEvent_ProviderOperationCall_EventDataSchema>;\nexport type AuditableEvent_ProviderOperationDenied_EventData = z.infer<typeof AuditableEvent_ProviderOperationDenied_EventDataSchema>;\nexport type AuditableEvent_HttpApiExternalErasure_EventData = z.infer<typeof AuditableEvent_HttpApiExternalErasure_EventDataSchema>;\nexport type AuditableEvent_HttpApiNonErasureAcknowledged_EventData = z.infer<typeof AuditableEvent_HttpApiNonErasureAcknowledged_EventDataSchema>;\nexport type AuditableEvent_SubjectErasureRecipientOutcome_EventData = z.infer<typeof AuditableEvent_SubjectErasureRecipientOutcome_EventDataSchema>;\nexport type AuditableEvent_User_CrossFrontendHandoffIssuedEventData = z.infer<typeof AuditableEvent_User_CrossFrontendHandoffIssuedEventDataSchema>;\nexport type AuditableEvent_OAuth_DelegatedTokenIssuedEventData = z.infer<typeof AuditableEvent_OAuth_DelegatedTokenIssuedEventDataSchema>;\nexport type AuditableEvent_OAuth_ConsentGrantedEventData = z.infer<typeof AuditableEvent_OAuth_ConsentGrantedEventDataSchema>;\nexport type AuditableEvent_OAuth_ConsentDeniedEventData = z.infer<typeof AuditableEvent_OAuth_ConsentDeniedEventDataSchema>;\nexport type AuditableEvent_OAuth_ConsentGrantPersistedEventData = z.infer<typeof AuditableEvent_OAuth_ConsentGrantPersistedEventDataSchema>;\nexport type AuditableEvent_OAuth_DynamicClientRegisteredEventData = z.infer<typeof AuditableEvent_OAuth_DynamicClientRegisteredEventDataSchema>;\nexport type AuditableEvent_OAuth_CimdClientRefusedEventData = z.infer<typeof AuditableEvent_OAuth_CimdClientRefusedEventDataSchema>;\nexport type AuditableEvent_OAuth_TokenRefreshedEventData = z.infer<typeof AuditableEvent_OAuth_TokenRefreshedEventDataSchema>;\nexport type AuditableEvent_OAuth_TokenRevokedEventData = z.infer<typeof AuditableEvent_OAuth_TokenRevokedEventDataSchema>;\nexport type AuditableEvent_OAuth_RpInitiatedLogoutEventData = z.infer<typeof AuditableEvent_OAuth_RpInitiatedLogoutEventDataSchema>;\nexport type AuditableEvent_OAuth_CodeExchangeFailedEventData = z.infer<typeof AuditableEvent_OAuth_CodeExchangeFailedEventDataSchema>;\nexport type AuditableEvent_OAuth_ConsentBindingViolationEventData = z.infer<typeof AuditableEvent_OAuth_ConsentBindingViolationEventDataSchema>;\nexport type AuditableEvent_User_RefreshTokenReuseDetectedEventData = z.infer<typeof AuditableEvent_User_RefreshTokenReuseDetectedEventDataSchema>;\n"]}