@wildo-ai/saas-models 1.1.8 → 1.1.10

package/dist/esm/compliance/audit-trails/security-audit-event-envelope.shared.schema.d.ts

@@ -6,7 +6,8 @@
  * Org SIEM export ships per-org security events to the customer's own SIEM.
  */
 import { z } from 'zod';
-import { AuditEventCategory, AuditEventSeverity, CoreAuditableEventType } from './auditable-events.shared.schema';
+import { AuditEventCategory, AuditEventSeverity } from './audit-event-classification.shared';
+import { CoreAuditableEventType } from './auditable-events.shared.schema';
 import { AuditActorKind } from './audit-actor.shared.schemas';
 import { FactorSatisfactionSource } from '../../security/authentications/service-provider-client-authentication.shared.schemas';
 /** Outcome for SIEM envelope — success or failure. */
@@ -83,12 +84,24 @@ export interface AuditEventClassification {
  * the fallback covers THOSE, which is what it was for.
  */
 export declare const AUDIT_EVENT_CLASSIFICATION_MAP: Record<CoreAuditableEventType, AuditEventClassification>;
+/**
+ * The keys of an application's `auditTrail.applicationEventTypes` that name a FRAMEWORK event type. The engine
+ * classifies its own event types and `getAuditEventClassification` ignores a declaration for one, so a non-empty
+ * answer is a declaration that would be silently ignored; startup refuses it. Reads the same map the classifier
+ * reads first, so the refusal and the precedence cannot disagree about what a framework type is.
+ */
+export declare function findFrameworkAuditEventTypesDeclaredByApplication(applicationEventTypes: Readonly<Record<string, unknown>> | undefined): string[];
 /**
  * Look up the classification for an audit event type.
  *
  * Every `CoreAuditableEventType` is mapped — enforced by the map's type, not by this comment, which
- * asserted exactly that while two event types went unmapped for months. The fallback exists for
- * APPLICATION-defined event types, which are ordinary strings the engine cannot enumerate.
+ * asserted exactly that while two event types went unmapped for months. An APPLICATION's own event types are
+ * ordinary strings the engine cannot enumerate; the application classifies them in
+ * `auditTrail.applicationEventTypes`, passed here as `applicationEventTypes`.
+ *
+ * Order, and it is the contract: the engine's map first, so a declaration can never reclassify a framework event
+ * (startup refuses one that names a framework type; this order holds even if that check were bypassed); then the
+ * application's declaration; then `data_access` / `info` for a type nobody declared.
  */
-export declare function getAuditEventClassification(eventType: string): AuditEventClassification;
+export declare function getAuditEventClassification(eventType: string, applicationEventTypes?: Readonly<Record<string, AuditEventClassification>>): AuditEventClassification;
 //# sourceMappingURL=security-audit-event-envelope.shared.schema.d.ts.map

package/dist/esm/compliance/audit-trails/security-audit-event-envelope.shared.schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"security-audit-event-envelope.shared.schema.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/audit-trails/security-audit-event-envelope.shared.schema.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAGL,kBAAkB,EAClB,kBAAkB,EAClB,sBAAsB,EAEvB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,wBAAwB,EAAE,MAAM,sFAAsF,CAAC;AAEhI,sDAAsD;AACtD,oBAAY,iBAAiB;IAC3B,OAAO,YAAY;IACnB,OAAO,YAAY;CACpB;AAED;;oEAEoE;AAEpE,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA6G3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F;;;;;oEAKoE;AAEpE,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,QAAQ,EAAE,kBAAkB,CAAC;CAC9B;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,8BAA8B,EAAE,MAAM,CAAC,sBAAsB,EAAE,wBAAwB,CA2iBnG,CAAC;AAIF;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,wBAAwB,CAEvF"}
+{"version":3,"file":"security-audit-event-envelope.shared.schema.d.ts","sourceRoot":"","sources":["../../../../src/compliance/audit-trails/security-audit-event-envelope.shared.schema.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAC7F,OAAO,EAGL,sBAAsB,EAEvB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,wBAAwB,EAAE,MAAM,sFAAsF,CAAC;AAEhI,sDAAsD;AACtD,oBAAY,iBAAiB;IAC3B,OAAO,YAAY;IACnB,OAAO,YAAY;CACpB;AAED;;oEAEoE;AAEpE,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA6G3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F;;;;;oEAKoE;AAEpE,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,QAAQ,EAAE,kBAAkB,CAAC;CAC9B;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,8BAA8B,EAAE,MAAM,CAAC,sBAAsB,EAAE,wBAAwB,CA2iBnG,CAAC;AAIF;;;;;GAKG;AACH,wBAAgB,iDAAiD,CAAC,qBAAqB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,GAAG,MAAM,EAAE,CAEhJ;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,2BAA2B,CACzC,SAAS,EAAE,MAAM,EACjB,qBAAqB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC,GACzE,wBAAwB,CAM1B"}

package/dist/esm/compliance/audit-trails/security-audit-event-envelope.shared.schema.js

@@ -6,7 +6,8 @@
  * Org SIEM export ships per-org security events to the customer's own SIEM.
  */
 import { z } from 'zod';
-import { AUDIT_EVENT_CATEGORY_MEANINGS, AUDIT_EVENT_SEVERITY_MEANINGS, AuditEventCategory, AuditEventSeverity, CoreAuditableEventType, describeAuditVocabulary, } from './auditable-events.shared.schema.js';
+import { AuditEventCategory, AuditEventSeverity } from './audit-event-classification.shared.js';
+import { AUDIT_EVENT_CATEGORY_MEANINGS, AUDIT_EVENT_SEVERITY_MEANINGS, CoreAuditableEventType, describeAuditVocabulary, } from './auditable-events.shared.schema.js';
 import { AuditActorKind } from './audit-actor.shared.schemas.js';
 import { FactorSatisfactionSource } from '../../security/authentications/service-provider-client-authentication.shared.schemas.js';
 /** Outcome for SIEM envelope — success or failure. */
@@ -658,14 +659,33 @@ export const AUDIT_EVENT_CLASSIFICATION_MAP = {
     [CoreAuditableEventType.SYSTEM_CONTEXT_WRITE]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.WARNING },
 };
 const DEFAULT_AUDIT_EVENT_CLASSIFICATION = { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.INFO };
+/**
+ * The keys of an application's `auditTrail.applicationEventTypes` that name a FRAMEWORK event type. The engine
+ * classifies its own event types and `getAuditEventClassification` ignores a declaration for one, so a non-empty
+ * answer is a declaration that would be silently ignored; startup refuses it. Reads the same map the classifier
+ * reads first, so the refusal and the precedence cannot disagree about what a framework type is.
+ */
+export function findFrameworkAuditEventTypesDeclaredByApplication(applicationEventTypes) {
+    return Object.keys(applicationEventTypes ?? {}).filter((eventType) => Object.hasOwn(AUDIT_EVENT_CLASSIFICATION_MAP, eventType));
+}
 /**
  * Look up the classification for an audit event type.
  *
  * Every `CoreAuditableEventType` is mapped — enforced by the map's type, not by this comment, which
- * asserted exactly that while two event types went unmapped for months. The fallback exists for
- * APPLICATION-defined event types, which are ordinary strings the engine cannot enumerate.
+ * asserted exactly that while two event types went unmapped for months. An APPLICATION's own event types are
+ * ordinary strings the engine cannot enumerate; the application classifies them in
+ * `auditTrail.applicationEventTypes`, passed here as `applicationEventTypes`.
+ *
+ * Order, and it is the contract: the engine's map first, so a declaration can never reclassify a framework event
+ * (startup refuses one that names a framework type; this order holds even if that check were bypassed); then the
+ * application's declaration; then `data_access` / `info` for a type nobody declared.
  */
-export function getAuditEventClassification(eventType) {
-    return AUDIT_EVENT_CLASSIFICATION_MAP[eventType] ?? DEFAULT_AUDIT_EVENT_CLASSIFICATION;
+export function getAuditEventClassification(eventType, applicationEventTypes) {
+    // Own properties only, on both maps: `eventType` is an open string, and a plain object answers `toString` or
+    // `constructor` with an inherited function rather than `undefined`.
+    if (Object.hasOwn(AUDIT_EVENT_CLASSIFICATION_MAP, eventType))
+        return AUDIT_EVENT_CLASSIFICATION_MAP[eventType];
+    const declared = applicationEventTypes && Object.hasOwn(applicationEventTypes, eventType) ? applicationEventTypes[eventType] : undefined;
+    return declared ? { category: declared.category, severity: declared.severity } : DEFAULT_AUDIT_EVENT_CLASSIFICATION;
 }
 //# sourceMappingURL=security-audit-event-envelope.shared.schema.js.map

package/dist/esm/compliance/audit-trails/security-audit-event-envelope.shared.schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"security-audit-event-envelope.shared.schema.js","sourceRoot":"","sources":["../../../../../src/compliance/audit-trails/security-audit-event-envelope.shared.schema.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,6BAA6B,EAC7B,6BAA6B,EAC7B,kBAAkB,EAClB,kBAAkB,EAClB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,wBAAwB,EAAE,MAAM,sFAAsF,CAAC;AAEhI,sDAAsD;AACtD,MAAM,CAAN,IAAY,iBAGX;AAHD,WAAY,iBAAiB;IAC3B,wCAAmB,CAAA;IACnB,wCAAmB,CAAA;AACrB,CAAC,EAHW,iBAAiB,KAAjB,iBAAiB,QAG5B;AAED;;oEAEoE;AAEpE,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,mCAAmC;IACnC;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;SACtC,QAAQ,CAAC,uBAAuB,CAAC,2CAA2C,EAAE,6BAA6B,CAAC,CAAC;IAChH,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;SACjC,QAAQ,CAAC,uBAAuB,CAAC,yCAAyC,EAAE,6BAA6B,CAAC,CAAC;IAC9G,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,iGAAiG;IACjG,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC;;;;;OAKG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC;;;;;OAKG;IACH,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE1C,UAAU;IACV,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC;;;;OAIG;IACH,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,QAAQ,EAAE;IAC5C;;;OAGG;IACH,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,wHAAwH;IACxH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,wHAAwH;IACxH,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC;;;OAGG;IACH,sCAAsC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7D,4FAA4F;IAC5F,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7C;;;OAGG;IACH,2BAA2B,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,QAAQ,EAAE;IAExE,SAAS;IACT,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE;IAE7B,0CAA0C;IAC1C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC;;;;OAIG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC9B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC5B,CAAC,CAAC,QAAQ,EAAE;IAEb,sBAAsB;IACtB,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;IAExC,UAAU;IACV,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC;IAClC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC;AAgBH;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAA6D;IACtG,wBAAwB;IACxB,CAAC,sBAAsB,CAAC,UAAU,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACvH,CAAC,sBAAsB,CAAC,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACxH,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACjI,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IACpI,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACjI,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACnI,gGAAgG;IAChG,kGAAkG;IAClG,qDAAqD;IACrD,CAAC,sBAAsB,CAAC,cAAc,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACxH,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACrI,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAChI,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACjI,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACjI;;;;;OAKG;IACH,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAEpI,4BAA4B;IAC5B,CAAC,sBAAsB,CAAC,cAAc,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAC3H,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACrI,CAAC,sBAAsB,CAAC,4BAA4B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAC7I,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAEjI,0BAA0B;IAC1B,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAEtI,wBAAwB;IACxB,CAAC,sBAAsB,CAAC,YAAY,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACzH,CAAC,sBAAsB,CAAC,YAAY,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACzH,CAAC,sBAAsB,CAAC,YAAY,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAEzH,wFAAwF;IACxF,4FAA4F;IAC5F,iGAAiG;IACjG,qFAAqF;IACrF,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAErI,iGAAiG;IACjG,mGAAmG;IACnG,oGAAoG;IACpG,4FAA4F;IAC5F,CAAC,sBAAsB,CAAC,sCAAsC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IACtJ,CAAC,sBAAsB,CAAC,iCAAiC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAEjJ,gCAAgC;IAChC,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACjI,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACjI,qHAAqH;IACrH,CAAC,sBAAsB,CAAC,0BAA0B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAC1I,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACpI,CAAC,sBAAsB,CAAC,+BAA+B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAC/I,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAClI,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACtI,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACnI,4FAA4F;IAC5F,0FAA0F;IAC1F,oFAAoF;IACpF,wFAAwF;IACxF,+FAA+F;IAC/F,gGAAgG;IAChG,6FAA6F;IAC7F,sDAAsD;IACtD,CAAC,sBAAsB,CAAC,oCAAoC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAEpJ,6BAA6B;IAC7B,CAAC,sBAAsB,CAAC,2BAA2B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACxI,CAAC,sBAAsB,CAAC,0BAA0B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACvI,CAAC,sBAAsB,CAAC,2BAA2B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACxI,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAC/I,CAAC,sBAAsB,CAAC,kCAAkC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAC/I,CAAC,sBAAsB,CAAC,2BAA2B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAE3I,6BAA6B;IAC7B,CAAC,sBAAsB,CAAC,kCAAkC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAC/I,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAC7I,CAAC,sBAAsB,CAAC,4BAA4B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACzI,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAEtI,qGAAqG;IACrG,mGAAmG;IACnG,0FAA0F;IAC1F,mGAAmG;IACnG,uEAAuE;IACvE,CAAC,sBAAsB,CAAC,qCAAqC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAEpJ,qGAAqG;IACrG,6FAA6F;IAC7F,2FAA2F;IAC3F,8FAA8F;IAC9F,+DAA+D;IAC/D,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAE/I,0CAA0C;IAC1C,CAAC,sBAAsB,CAAC,sCAAsC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACtJ,CAAC,sBAAsB,CAAC,mCAAmC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAChJ,+FAA+F;IAC/F,oGAAoG;IACpG,gGAAgG;IAChG,kGAAkG;IAClG,8FAA8F;IAC9F,mGAAmG;IACnG,CAAC,sBAAsB,CAAC,iCAAiC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAClJ,CAAC,sBAAsB,CAAC,4CAA4C,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAE5J,4FAA4F;IAC5F,EAAE;IACF,iGAAiG;IACjG,gGAAgG;IAChG,6FAA6F;IAC7F,qFAAqF;IACrF,EAAE;IACF,gGAAgG;IAChG,gGAAgG;IAChG,wDAAwD;IACxD,CAAC,sBAAsB,CAAC,oCAAoC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACpJ,CAAC,sBAAsB,CAAC,wCAAwC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACxJ,gGAAgG;IAChG,kGAAkG;IAClG,gGAAgG;IAChG,4FAA4F;IAC5F,4FAA4F;IAC5F,CAAC,sBAAsB,CAAC,qCAAqC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAClJ,CAAC,sBAAsB,CAAC,wCAAwC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAExJ,iGAAiG;IACjG,kGAAkG;IAClG,kGAAkG;IAClG,iGAAiG;IACjG,0FAA0F;IAC1F,EAAE;IACF,kGAAkG;IAClG,0FAA0F;IAC1F,8FAA8F;IAC9F,gBAAgB;IAChB,CAAC,sBAAsB,CAAC,4BAA4B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACzI,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAC7I,CAAC,sBAAsB,CAAC,6BAA6B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAC1I,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAEhJ,kGAAkG;IAClG,mGAAmG;IACnG,iGAAiG;IACjG,8FAA8F;IAC9F,kGAAkG;IAClG,iFAAiF;IACjF,CAAC,sBAAsB,CAAC,wCAAwC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACxJ,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAE7I,4CAA4C;IAC5C,kGAAkG;IAClG,6FAA6F;IAC7F,gGAAgG;IAChG,oEAAoE;IACpE,CAAC,sBAAsB,CAAC,+BAA+B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAC/I,oHAAoH;IACpH,CAAC,sBAAsB,CAAC,8BAA8B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAExI,8BAA8B;IAC9B,6FAA6F;IAC7F,8FAA8F;IAC9F,qBAAqB;IACrB,EAAE;IACF,2FAA2F;IAC3F,4FAA4F;IAC5F,iGAAiG;IACjG,iGAAiG;IACjG,+FAA+F;IAC/F,gGAAgG;IAChG,2EAA2E;IAC3E,EAAE;IACF,gGAAgG;IAChG,gGAAgG;IAChG,+FAA+F;IAC/F,iGAAiG;IACjG,kGAAkG;IAClG,8FAA8F;IAC9F,kGAAkG;IAClG,6EAA6E;IAC7E,qFAAqF;IACrF,EAAE;IACF,wFAAwF;IACxF,kGAAkG;IAClG,+FAA+F;IAC/F,0CAA0C;IAC1C,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAChJ,yGAAyG;IACzG,uGAAuG;IACvG,kFAAkF;IAClF,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACtI,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACnI,CAAC,sBAAsB,CAAC,2BAA2B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACxI,CAAC,sBAAsB,CAAC,0BAA0B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACpI,CAAC,sBAAsB,CAAC,uBAAuB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACpI,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAClI,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACtI,8GAA8G;IAC9G,wGAAwG;IACxG,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAC7I,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAC5H,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACjI,CAAC,sBAAsB,CAAC,2BAA2B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACrI,CAAC,sBAAsB,CAAC,8BAA8B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAC3I,8GAA8G;IAC9G,iFAAiF;IACjF,CAAC,sBAAsB,CAAC,iCAAiC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAC9I,CAAC,sBAAsB,CAAC,4CAA4C,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAC5J,CAAC,sBAAsB,CAAC,kCAAkC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAC/I,CAAC,sBAAsB,CAAC,mCAAmC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACnJ,CAAC,sBAAsB,CAAC,iCAAiC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACjJ,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACtI,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACnI,CAAC,sBAAsB,CAAC,iCAAiC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAC9I,CAAC,sBAAsB,CAAC,4BAA4B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAEzI,qCAAqC;IACrC,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAClI,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAClI,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAClI,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAC9H,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAErI,6BAA6B;IAC7B,CAAC,sBAAsB,CAAC,6BAA6B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAC1I,CAAC,sBAAsB,CAAC,6BAA6B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAC7I,yFAAyF;IACzF,2FAA2F;IAC3F,2DAA2D;IAC3D,CAAC,sBAAsB,CAAC,0BAA0B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAE3I,0CAA0C;IAC1C,CAAC,sBAAsB,CAAC,eAAe,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAC5H,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAChI,CAAC,sBAAsB,CAAC,sCAAsC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACnJ,CAAC,sBAAsB,CAAC,8BAA8B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAE3I,4BAA4B;IAC5B,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACnI,CAAC,sBAAsB,CAAC,wBAAwB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACxI,CAAC,sBAAsB,CAAC,uBAAuB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAEpI,qCAAqC;IACrC,CAAC,sBAAsB,CAAC,uBAAuB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACvI,CAAC,sBAAsB,CAAC,mCAAmC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAChJ,CAAC,sBAAsB,CAAC,mCAAmC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACnJ,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACpI,mGAAmG;IACnG,2FAA2F;IAC3F,CAAC,sBAAsB,CAAC,4BAA4B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAE7I,+BAA+B;IAC/B,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACjI,CAAC,sBAAsB,CAAC,wBAAwB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACrI,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAEtI,4BAA4B;IAC5B,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAC9H,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAClI,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAEnI,uCAAuC;IACvC,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAChI,CAAC,sBAAsB,CAAC,8BAA8B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAE9I,gDAAgD;IAChD,CAAC,sBAAsB,CAAC,uBAAuB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACtI,iGAAiG;IACjG,8FAA8F;IAC9F,8FAA8F;IAC9F,8FAA8F;IAC9F,kCAAkC;IAClC,CAAC,sBAAsB,CAAC,2BAA2B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAE3I,uBAAuB;IACvB,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACpI,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAClI,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAC7I,CAAC,sBAAsB,CAAC,wBAAwB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAEzI,6CAA6C;IAC7C,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACjI,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAC/H,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACjI,CAAC,sBAAsB,CAAC,8BAA8B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAC/I,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAClI,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAC/H,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAC/H,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACjI,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAElI,kCAAkC;IAClC,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACjI,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAClI,CAAC,sBAAsB,CAAC,0BAA0B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAE1I,iCAAiC;IACjC,oGAAoG;IACpG,qGAAqG;IACrG,sGAAsG;IACtG,yEAAyE;IACzE,CAAC,sBAAsB,CAAC,wBAAwB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACpI,CAAC,sBAAsB,CAAC,0BAA0B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACpI,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACxI,oGAAoG;IACpG,uDAAuD;IACvD,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAClI,CAAC,sBAAsB,CAAC,wBAAwB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACvI;;;;;;;;;;;OAWG;IACH,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IACnI,CAAC,sBAAsB,CAAC,wBAAwB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACrI,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAClI,CAAC,sBAAsB,CAAC,uBAAuB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACpI,iGAAiG;IACjG,qGAAqG;IACrG,+FAA+F;IAC/F,qGAAqG;IACrG,uEAAuE;IACvE,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAErI,mEAAmE;IACnE,qFAAqF;IACrF,8EAA8E;IAC9E,2FAA2F;IAC3F,sFAAsF;IACtF,CAAC,sBAAsB,CAAC,kCAAkC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAElJ,sBAAsB;IACtB,CAAC,sBAAsB,CAAC,YAAY,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAEtH,mFAAmF;IACnF,gGAAgG;IAChG,iGAAiG;IACjG,iGAAiG;IACjG,8FAA8F;IAC9F,wFAAwF;IACxF,8FAA8F;IAC9F,4CAA4C;IAC5C,CAAC,sBAAsB,CAAC,4BAA4B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAE3I,mGAAmG;IACnG,mCAAmC;IACnC,EAAE;IACF,kGAAkG;IAClG,mGAAmG;IACnG,mGAAmG;IACnG,kGAAkG;IAClG,iGAAiG;IACjG,sFAAsF;IACtF,EAAE;IACF,mGAAmG;IACnG,mGAAmG;IACnG,gGAAgG;IAChG,yDAAyD;IACzD,EAAE;IACF,+DAA+D;IAC/D,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACxI,kGAAkG;IAClG,6FAA6F;IAC7F,kGAAkG;IAClG,oGAAoG;IACpG,iDAAiD;IACjD,CAAC,sBAAsB,CAAC,kCAAkC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACjJ,gGAAgG;IAChG,mGAAmG;IACnG,oGAAoG;IACpG,8FAA8F;IAC9F,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACnI,kGAAkG;IAClG,mGAAmG;IACnG,oGAAoG;IACpG,kEAAkE;IAClE,CAAC,sBAAsB,CAAC,+BAA+B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAC9I,6GAA6G;IAC7G,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACjI,4GAA4G;IAC5G,0FAA0F;IAC1F,CAAC,sBAAsB,CAAC,mCAAmC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAChJ,CAAC,sBAAsB,CAAC,kCAAkC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAClJ,CAAC,sBAAsB,CAAC,uCAAuC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACvJ,CAAC,sBAAsB,CAAC,2BAA2B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACxI,CAAC,sBAAsB,CAAC,iCAAiC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAChJ,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACnI,qGAAqG;IACrG,sGAAsG;IACtG,yEAAyE;IACzE,CAAC,sBAAsB,CAAC,uCAAuC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACtJ,CAAC,sBAAsB,CAAC,iDAAiD,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAChK,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAC/I,CAAC,sBAAsB,CAAC,kCAAkC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACjJ,4GAA4G;IAC5G,8GAA8G;IAC9G,CAAC,sBAAsB,CAAC,0CAA0C,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACzJ,CAAC,sBAAsB,CAAC,wCAAwC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACvJ,CAAC,sBAAsB,CAAC,uCAAuC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACtJ,mHAAmH;IACnH,oGAAoG;IACpG,CAAC,sBAAsB,CAAC,kCAAkC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACjJ,qFAAqF;IACrF,CAAC,sBAAsB,CAAC,gDAAgD,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAC7J,gHAAgH;IAChH,yGAAyG;IACzG,CAAC,sBAAsB,CAAC,sCAAsC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACtJ,CAAC,sBAAsB,CAAC,iDAAiD,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACjK,CAAC,sBAAsB,CAAC,uCAAuC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACtJ,iHAAiH;IACjH,mHAAmH;IACnH,8CAA8C;IAC9C,CAAC,sBAAsB,CAAC,mCAAmC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IACnJ,CAAC,sBAAsB,CAAC,mCAAmC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAClJ,+FAA+F;IAC/F,mGAAmG;IACnG,+FAA+F;IAC/F,iGAAiG;IACjG,uEAAuE;IACvE,CAAC,sBAAsB,CAAC,+CAA+C,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAE9J,kDAAkD;IAClD,oGAAoG;IACpG,oGAAoG;IACpG,oGAAoG;IACpG,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACjI,kGAAkG;IAClG,mGAAmG;IACnG,mDAAmD;IACnD,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAChI,oGAAoG;IACpG,oGAAoG;IACpG,oGAAoG;IACpG,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAChI,6FAA6F;IAC7F,0FAA0F;IAC1F,2FAA2F;IAC3F,CAAC,sBAAsB,CAAC,4BAA4B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACtI,yGAAyG;IACzG,oGAAoG;IACpG,qGAAqG;IACrG,gGAAgG;IAChG,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAChI,oHAAoH;IACpH,kHAAkH;IAClH,yDAAyD;IACzD,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAC1I,qHAAqH;IACrH,6FAA6F;IAC7F,EAAE;IACF,+DAA+D;IAC/D,CAAC,sBAAsB,CAAC,+BAA+B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAC9I,oHAAoH;IACpH,CAAC,sBAAsB,CAAC,4BAA4B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAC5I,kGAAkG;IAClG,CAAC,sBAAsB,CAAC,uCAAuC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACvJ,0GAA0G;IAC1G,CAAC,sBAAsB,CAAC,+BAA+B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAC5I,mGAAmG;IACnG,oGAAoG;IACpG,iGAAiG;IACjG,iGAAiG;IACjG,CAAC,sBAAsB,CAAC,uBAAuB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACjI,oGAAoG;IACpG,iGAAiG;IACjG,iEAAiE;IACjE,EAAE;IACF,+DAA+D;IAC/D,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACxI,mGAAmG;IACnG,oGAAoG;IACpG,+EAA+E;IAC/E,CAAC,sBAAsB,CAAC,aAAa,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACvH,CAAC,sBAAsB,CAAC,wBAAwB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAClI,sGAAsG;IACtG,mGAAmG;IACnG,uGAAuG;IACvG,qGAAqG;IACrG,CAAC,sBAAsB,CAAC,wBAAwB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACpI,CAAC,sBAAsB,CAAC,uBAAuB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACnI,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACrI,CAAC,sBAAsB,CAAC,wBAAwB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACpI,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAClI,CAAC,sBAAsB,CAAC,6BAA6B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAC5I,yGAAyG;IACzG,iGAAiG;IACjG,CAAC,sBAAsB,CAAC,8BAA8B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAC1I,CAAC,sBAAsB,CAAC,+BAA+B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAC3I,CAAC,sBAAsB,CAAC,2BAA2B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACvI,CAAC,sBAAsB,CAAC,4BAA4B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACxI,yGAAyG;IACzG,oGAAoG;IACpG,sFAAsF;IACtF,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACrI,CAAC,sBAAsB,CAAC,wBAAwB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACvI,CAAC,sBAAsB,CAAC,6BAA6B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACzI,CAAC,sBAAsB,CAAC,6BAA6B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAC5I,gGAAgG;IAChG,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACtI,gGAAgG;IAChG,sEAAsE;IACtE,CAAC,sBAAsB,CAAC,iCAAiC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAClJ,8GAA8G;IAC9G,CAAC,sBAAsB,CAAC,iCAAiC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAE9I,kGAAkG;IAClG,qGAAqG;IACrG,qGAAqG;IACrG,qGAAqG;IACrG,wDAAwD;IACxD,CAAC,sBAAsB,CAAC,4BAA4B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAC3I,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACpI,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAChI,CAAC,sBAAsB,CAAC,6BAA6B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAC5I,+FAA+F;IAC/F,+FAA+F;IAC/F,oEAAoE;IACpE,8FAA8F;IAC9F,kGAAkG;IAClG,4DAA4D;IAC5D,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACzI,CAAC,sBAAsB,CAAC,+BAA+B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAC/I,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAClI,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAChI,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACtI,CAAC,sBAAsB,CAAC,0BAA0B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAC1I,CAAC,sBAAsB,CAAC,+BAA+B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAC/I,CAAC,sBAAsB,CAAC,iCAAiC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAElJ,gGAAgG;IAChG,wFAAwF;IACxF,kGAAkG;IAClG,2FAA2F;IAC3F,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAC7H,iGAAiG;IACjG,+FAA+F;IAC/F,oGAAoG;IACpG,iGAAiG;IACjG,0FAA0F;IAC1F,+CAA+C;IAC/C,sGAAsG;IACtG,CAAC,sBAAsB,CAAC,kCAAkC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAClJ,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;CAClI,CAAC;AAEF,MAAM,kCAAkC,GAA6B,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE,CAAC;AAErJ;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CAAC,SAAiB;IAC3D,OAAO,8BAA8B,CAAC,SAAmC,CAAC,IAAI,kCAAkC,CAAC;AACnH,CAAC","sourcesContent":["/**\n * Security Audit Event Envelope — the structured JSON payload sent to customer SIEM.\n * \n * This is the canonical format for events exported via the org-level SIEM export pipeline.\n * Different from platform observability (which ships to Axiom/Datadog for platform ops).\n * Org SIEM export ships per-org security events to the customer's own SIEM.\n */\n\nimport { z } from 'zod';\nimport {\n  AUDIT_EVENT_CATEGORY_MEANINGS,\n  AUDIT_EVENT_SEVERITY_MEANINGS,\n  AuditEventCategory,\n  AuditEventSeverity,\n  CoreAuditableEventType,\n  describeAuditVocabulary,\n} from './auditable-events.shared.schema';\nimport { AuditActorKind } from './audit-actor.shared.schemas';\nimport { FactorSatisfactionSource } from '../../security/authentications/service-provider-client-authentication.shared.schemas';\n\n/** Outcome for SIEM envelope — success or failure. */\nexport enum AuditEventOutcome {\n  SUCCESS = 'success',\n  FAILURE = 'failure',\n}\n\n/** ──────────────────────────────────────────────────────────────\n * Security Audit Event Envelope Schema\n * ────────────────────────────────────────────────────────────── */\n\nexport const SecurityAuditEventEnvelopeSchema = z.object({\n  // Standard fields (always present)\n  /**\n   * The AUDIT ROW's own `eventId` (`AuditableEvent.eventId`) — copied here, never minted for the\n   * delivery. It is doing two jobs and both need it to be that value:\n   *\n   *  - it is the receiver's IDEMPOTENCY key. Every wire format carries this one field through:\n   *    CEF `externalId`, LEEF `eventId`, OCSF `metadata.uid`, and the verbatim `json_structured`\n   *    body's top-level `eventId`. It is stable across every retry of a delivery (the envelope is\n   *    built once and re-sent, including from the dead-letter drain).\n   *  - it is the CORRELATION key back into the application. The same value is on the audit row, on\n   *    the immudb record, and is what `AuditLogVerification.verifyAuditEvent(eventId)` resolves —\n   *    so a record in the customer's SIEM can be traced to the event it was projected from.\n   *\n   * The second job was silently absent until 2026-09-09: the dispatcher minted a fresh uuid here,\n   * which deduplicated correctly and named nothing. See `_resolveEnvelopeEventId` in\n   * `audit-event-dispatcher.backend.service.ts` for the cutover reasoning.\n   *\n   * NOTE one audit event fanned out to several member orgs delivers the SAME id to each of those\n   * tenants' sinks. They are different receivers, so dedup is unaffected — and it is one event.\n   */\n  eventId: z.string(),\n  eventType: z.string(),\n  eventCategory: z.enum(AuditEventCategory)\n    .describe(describeAuditVocabulary('What kind of activity this event records.', AUDIT_EVENT_CATEGORY_MEANINGS)),\n  severity: z.enum(AuditEventSeverity)\n    .describe(describeAuditVocabulary('How much attention this event asks for.', AUDIT_EVENT_SEVERITY_MEANINGS)),\n  timestamp: z.string(),\n  /** Request-correlation id (groups every event of one request; matches the app's logs/errors). */\n  correlationId: z.string().optional(),\n  /**\n   * Client-install id — groups an actor's events across sessions and logins, the correlation NIST\n   * SP 800-53 AU-6(3) asks for at review time. Present ONLY for applications that opted into\n   * `compliance.clientInstanceIdScope`; absent (never null-filled) for every other application, so a\n   * SIEM rule keying on it simply never matches rather than seeing an empty field.\n   */\n  clientInstanceId: z.string().optional(),\n  /**\n   * Which frontend SURFACE the request came from (app / website / docs). Carried for the same reason as\n   * the two ids above: an external reviewer correlating in the SIEM needs the same origin axes the audit\n   * row has, and shipping two of the three origin signals was an asymmetry with no rationale behind it.\n   * Absent for non-HTTP (job / cron / internal) events.\n   */\n  frontendServiceName: z.string().optional(),\n\n  // Context\n  organizationId: z.string(),\n  organizationName: z.string().optional(),\n  applicationId: z.string().optional(),\n  applicationName: z.string().optional(),\n  userId: z.string().optional(),\n  userEmail: z.string().optional(),\n  /**\n   * The KIND of principal whose authority was used (`AuditActorKind`) — lets a SIEM rule tell a person\n   * from a delegated client, a machine, or the application itself without joining back. Copied from\n   * the audit row; absent only on a row written before the field existed.\n   */\n  actorKind: z.enum(AuditActorKind).optional(),\n  /**\n   * The AI agent that performed the action (`agentActor.agentRef` on the row) — present only when an\n   * agent acted. A configuration identifier, not personal data. `actorKind` still names the principal.\n   */\n  agentRef: z.string().optional(),\n  /** The agent's conversational execution (`agentActor.agentExecutionId`) — a pseudonymous key, never transcript text. */\n  agentExecutionId: z.string().optional(),\n  /** The external OAuth client a person delegated to (the verified token's `azp`), for `actorKind = DELEGATED_CLIENT`. */\n  delegatingClientId: z.string().optional(),\n  /**\n   * The service-provider relationship the principal acted through (#1597), copied from the row. Present only\n   * on an event in a CLIENT organization caused by a firm's expert or machine client. An identifier, not personal data.\n   */\n  actingViaServiceProviderRelationshipId: z.string().optional(),\n  /** The firm behind `actingViaServiceProviderRelationshipId`; present exactly when it is. */\n  providerOrganizationId: z.string().optional(),\n  /**\n   * Where the factor that satisfied the client organization's authentication policy came from (#1633), copied from\n   * the row: this application, or the firm's trusted identity provider. A source, never a person or a proof.\n   */\n  serviceProviderFactorSource: z.enum(FactorSatisfactionSource).optional(),\n\n  // Source\n  sourceService: z.string(),\n  sourceVersion: z.string(),\n  sourceEnvironment: z.string(),\n\n  // Auth-specific context (when applicable)\n  authMethod: z.string().optional(),\n  authSource: z.string().optional(),\n  providerRef: z.string().optional(),\n  /**\n   * The CONNECTION a stored provider credential belongs to (#1670), copied from `eventData.connectionRef` on\n   * the credential lifecycle events. Beside `providerRef` because the two differ once several refs of one\n   * vendor share a connection (#1725): the ref says which integration acted, the connection which grant.\n   */\n  connectionRef: z.string().optional(),\n  connectionType: z.string().optional(),\n  ipAddress: z.string().optional(),\n  userAgent: z.string().optional(),\n  geoLocation: z.object({\n    country: z.string().optional(),\n    city: z.string().optional(),\n  }).optional(),\n\n  // Event-specific data\n  eventData: z.record(z.string(), z.any()),\n\n  // Outcome\n  outcome: z.enum(AuditEventOutcome),\n  outcomeReason: z.string().optional(),\n});\n\nexport type SecurityAuditEventEnvelope = z.infer<typeof SecurityAuditEventEnvelopeSchema>;\n\n/** ──────────────────────────────────────────────────────────────\n * Event Classification Map\n * \n * Maps each CoreAuditableEventType to its category and severity.\n * Used by the dispatcher to classify events for SIEM filtering.\n * ────────────────────────────────────────────────────────────── */\n\nexport interface AuditEventClassification {\n  category: AuditEventCategory;\n  severity: AuditEventSeverity;\n}\n\n/**\n * Every core auditable event's SIEM category and severity.\n *\n * **Total over `CoreAuditableEventType` on purpose.** It was `Record<string, …>`, which let two\n * emitted event types — `SYSTEM_CONTEXT_READ` and `SYSTEM_CONTEXT_WRITE` — carry no entry at all\n * while the lookup's own JSDoc claimed \"all CoreAuditableEventType values are mapped\". They silently\n * took the fallback below, and because the fallback is one value, the WRITE inherited the READ's\n * classification: the two events exist separately precisely because \"a MUTATION under an ACL bypass is\n * more sensitive than a read\", and the classification erased that. A new core event type is now a\n * compile error rather than a silent `DATA_ACCESS`/`INFO`.\n *\n * The lookup still tolerates unknown strings, because applications may define their own event types —\n * the fallback covers THOSE, which is what it was for.\n */\nexport const AUDIT_EVENT_CLASSIFICATION_MAP: Record<CoreAuditableEventType, AuditEventClassification> = {\n  // Authentication Events\n  [CoreAuditableEventType.USER_LOGIN]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_LOGOUT]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_LOGIN_FAILED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.USER_ACCOUNT_LOCKED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.CRITICAL },\n  [CoreAuditableEventType.MACHINE_AUTH_SUCCESS]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.MACHINE_AUTH_FAILED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n  // Machine RESOURCE-ACCESS (token-USE): an authorized, expected per-request access to an A2A/MCP\n  // surface — DATA_ACCESS/INFO, mirroring FIELD_ACCESS. The security signal is the volume/pattern a\n  // SIEM derives from this stream, not any single row.\n  [CoreAuditableEventType.MACHINE_ACCESS]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_PASSWORD_CHANGED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.USER_MFA_ENABLED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.USER_MFA_DISABLED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.USER_SESSION_EXPIRED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  /*\n   * WARNING, not INFO, and the asymmetry with USER_SESSION_EXPIRED above is the point. An expiry is\n   * routine. An eviction means a live chain was displaced — which is either a user on more devices\n   * than the cap allows, or the cap doing the job it exists for and pushing a stolen chain out. A\n   * reviewer needs to see the second, and INFO is the level nobody reads.\n   */\n  [CoreAuditableEventType.USER_SESSION_EVICTED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n\n  // SSO Authentication Events\n  [CoreAuditableEventType.USER_SSO_LOGIN]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_SSO_LOGIN_FAILED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.USER_SSO_ENFORCEMENT_BLOCKED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.CRITICAL },\n  [CoreAuditableEventType.USER_TOKEN_REFRESHED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n\n  // Emergency Access Events\n  [CoreAuditableEventType.EMERGENCY_ACCESS_USED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.CRITICAL },\n\n  // User Lifecycle Events\n  [CoreAuditableEventType.USER_CREATED]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_UPDATED]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_DELETED]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.INFO },\n\n  // Application-Role Administration — AUTHORIZATION (not USER_LIFECYCLE): the event is an\n  // access-control decision, and an org SIEM filtering on the authorization category must see\n  // application-role grants alongside `ORGANIZATION_MEMBER_ROLE_CHANGED`. Same WARNING severity as\n  // that event for the same reason — a privilege change is never routine INFO traffic.\n  [CoreAuditableEventType.USER_APP_ROLES_CHANGED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n\n  // The application has NO usable super-administrator. CRITICAL rather than WARNING: unlike a role\n  // change (a decision someone made, which an auditor reviews), this is a state nobody can undo from\n  // inside the product — every recovery door is gated on the very role that is missing. AUTHORIZATION\n  // because it is the absence of an authorization principal, not a user-lifecycle transition.\n  [CoreAuditableEventType.APPLICATION_SUPER_ADMIN_FLOOR_BREACHED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.CRITICAL },\n  [CoreAuditableEventType.ORGANIZATION_OWNER_FLOOR_BREACHED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.CRITICAL },\n\n  // Organization Lifecycle Events\n  [CoreAuditableEventType.ORGANIZATION_CREATED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.ORGANIZATION_UPDATED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },\n  // WARNING, not INFO: the assignment decides which authentication policy a tenant's members meet, and nobody made it.\n  [CoreAuditableEventType.ORGANIZATION_TYPE_ASSIGNED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.ORGANIZATION_DELETED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.ORGANIZATION_DELETION_REQUESTED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.ORGANIZATION_RESTORED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.ORGANIZATION_SUSPENDED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.ORGANIZATION_ACTIVATED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },\n  // WARNING rather than INFO: the event covers BOTH directions, and the restricting direction\n  // (suspend / deactivate) is what an access review is looking for. Grading the pair by its\n  // less-serious half would bury suspensions among routine noise; the payload carries\n  // `previousStatus` → `newStatus`, so a consumer that wants only lifts can still filter.\n  // `USER_LIFECYCLE`, not `AUTHORIZATION`: the event records what CHANGED (a subject's lifecycle\n  // status) rather than its consequence. Every subject it covers — a user row, a membership row —\n  // is a person's participation in the product, and grading it by consequence would scatter it\n  // among role grants that answer a different question.\n  [CoreAuditableEventType.RESOURCE_STATUS_TRANSITION_PERFORMED]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.WARNING },\n\n  // Organization Member Events\n  [CoreAuditableEventType.ORGANIZATION_MEMBER_INVITED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.ORGANIZATION_MEMBER_JOINED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.ORGANIZATION_MEMBER_UPDATED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.ORGANIZATION_MEMBER_ROLE_CHANGED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.ORGANIZATION_MEMBER_STATUS_CHANGED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.ORGANIZATION_MEMBER_REMOVED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n\n  // Organization Config Events\n  [CoreAuditableEventType.ORGANIZATION_NOTIFICATIONS_UPDATED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.ORGANIZATION_PREFERENCES_UPDATED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.ORGANIZATION_PROFILE_UPDATED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.ORGANIZATION_UNIT_UPDATED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },\n\n  // Per-unit role assignment — AUTHORIZATION (not ORG_MANAGEMENT, unlike its ORGANIZATION_UNIT_UPDATED\n  // neighbour): the unit's own record-keeping confers nothing, whereas `OrganizationUnitMember.role`\n  // is read back into `initiatorRoles` as a unit-narrowed grant. Narrower blast radius than\n  // ORGANIZATION_MEMBER_ROLE_CHANGED, but the same KIND of decision, so it carries the same category\n  // and severity — an org SIEM filtering on authorization must see both.\n  [CoreAuditableEventType.ORGANIZATION_UNIT_MEMBER_ROLE_CHANGED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n\n  // Revocation of a unit assignment. AUTHORIZATION deliberately, where the ORGANIZATION_MEMBER_REMOVED\n  // above is ORG_MANAGEMENT: removing a MEMBER is a directory action whose authority loss is a\n  // side effect, whereas an assignment row exists ONLY to confer a role — deleting it IS the\n  // revocation. Same category and severity as the grant it closes, so an authorization-filtered\n  // trail never shows unit privileges granted and never removed.\n  [CoreAuditableEventType.ORGANIZATION_UNIT_MEMBER_REMOVED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n\n  // Organization Security Management Events\n  [CoreAuditableEventType.ORGANIZATION_SSO_CONFIGURATION_CHANGED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.ORGANIZATION_SIEM_EXPORT_CONFIGURED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },\n  // The two changes to security-event export that a defender must see (#986), as their own KINDS\n  // because this map is the only severity the SIEM ever reads — the row's `riskLevel` (HIGH for both)\n  // is not on the envelope. Turning export OFF is the change an attacker who reached the tenant's\n  // administration most wants unseen: CRITICAL, above any severity minimum an organization can set.\n  // Re-pointing the destination diverts the trail: WARNING. Both stay ORG_MANAGEMENT — the same\n  // category the enable / edit event carries, so a category filter that admits one admits all three.\n  [CoreAuditableEventType.ORGANIZATION_SIEM_EXPORT_DISABLED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.CRITICAL },\n  [CoreAuditableEventType.ORGANIZATION_SIEM_EXPORT_DESTINATION_CHANGED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n\n  // Organization provider credentials — an organization's own authority toward a third party.\n  //\n  // ORG_MANAGEMENT, not AUTHORIZATION: the AUTHORIZATION category is about what a principal may do\n  // INSIDE this application, and these events are about what the application may do OUTSIDE it as\n  // the tenant. Filing them under authorization would put them in the same SIEM bucket as role\n  // grants, where a reviewer looking for outbound authority would never think to look.\n  //\n  // WARNING on the three lifecycle verbs, mirroring the SSO-configuration sibling: each one MOVES\n  // the authority the application holds toward a third party, and a tenant's credentials changing\n  // outside a change window is the shape of a compromise.\n  [CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_SET]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_ROTATED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  // INFO, and deliberately so despite being the security-relevant one. A use event fires on every\n  // outbound provider call, so WARNING here would flood the channel and train an operator to filter\n  // the whole category out — taking the two verbs above with it. The signal a reviewer wants from\n  // this stream is the PATTERN (which tenant spends which provider, how often, and whether it\n  // resolved from its own credential or fell back to the deployment's), which INFO preserves.\n  [CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_USED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_DELETED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n\n  // A person's own credential. USER_LIFECYCLE rather than ORG_MANAGEMENT, by the same reading that\n  // put the tenant's in ORG_MANAGEMENT: a stored third-party credential is a setting on the account\n  // that owns it, and here that account is a person. Filing these under the tenant's category would\n  // put a person's connections into the view an administrator reads as \"what my organization did\",\n  // which is both the wrong subject and, for a personal vendor account, the wrong audience.\n  //\n  // Severities mirror the organization's exactly and for the same reasons — INFO on the high-volume\n  // spend so the pattern survives without flooding, WARNING on removal because a credential\n  // disappearing is how an integration stops working and the first question is always whether a\n  // human did it.\n  [CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_SET]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_ROTATED]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_USED]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_DELETED]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.WARNING },\n\n  // A delegated authorization being GRANTED. Each mirrors its OWN `_SET` sibling rather than taking\n  // one rule for both, because the two families are already classified differently and deliberately:\n  // a tenant's credential arriving is ORG_MANAGEMENT/WARNING — a shared integration changing under\n  // every member of that tenant — while a person's is USER_LIFECYCLE/INFO, one individual's own\n  // account. A grant carries exactly the same consequence as the set it accompanies, so it inherits\n  // the same reading; what makes it worth having is its payload, not its severity.\n  [CoreAuditableEventType.ORGANIZATION_PROVIDER_CONNECTION_GRANTED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.USER_PROVIDER_CONNECTION_GRANTED]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.INFO },\n\n  // Application Security Configuration Events\n  // WARNING mirrors the SSO-configuration-changed sibling: a change to the authentication assurance\n  // posture (MFA / password / lockout) is more than record-keeping (INFO) yet is not an active\n  // breach (ERROR). Category ORG_MANAGEMENT keeps it in the same security-configuration cluster a\n  // reviewer already queries for SSO/SIEM/SCIM configuration changes.\n  [CoreAuditableEventType.APPLICATION_AUTH_POLICY_CHANGED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  // Routine and hourly: INFO. A failed run is marked by the row's HIGH `riskLevel`, since severity is fixed per type.\n  [CoreAuditableEventType.RETENTION_ENFORCEMENT_RECORDED]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.INFO },\n\n  // Outbound M2M Webhook Events\n  // WARNING rather than INFO, and the choice is externally grounded rather than taste — it was\n  // challenged on the reasonable objection that every LEGITIMATE connectivity test then emits a\n  // warning-level row.\n  //\n  // NIST SP 800-53 does not settle it directly: AU-6 treats what counts as \"inappropriate or\n  // unusual activity\" as an explicit ORGANIZATION-DEFINED assignment and prescribes no INFO /\n  // WARNING / CRITICAL vocabulary at all, so no NIST rule is broken in either direction. What NIST\n  // does settle is the REMEDY for noise: AU-6(1) automated review integration, AU-6(3) correlation\n  // across repositories, and supplemental guidance letting organizations tune review \"frequency,\n  // scope, and/or depth\". Volume is answered by correlating and tuning REVIEW — never by demoting\n  // the record itself, which would destroy the signal rather than manage it.\n  //\n  // OWASP's Logging Vocabulary Cheat Sheet is the concrete industry answer and puts this at WARN:\n  // successful, authorized ADMINISTRATIVE operations sit at WARN (`user_created`, `user_updated`,\n  // `sys_startup` / `sys_shutdown` / `sys_restart`), while INFO is reserved for routine end-user\n  // activity (`authn_login_success`, `session_created`, a user's own `authn_password_change`). The\n  // rationale is that administrative operations are high-risk and abuse-prone regardless of whether\n  // any single instance succeeded. `testEndpoint` is precisely that shape — admin-gated, and it\n  // makes the SYSTEM open an outbound connection to an operator-supplied URL — so it belongs beside\n  // the `sys_*` state changes, not beside a user login. (OWASP likewise grades\n  // `excess_rate_limit_exceeded` at WARN, which is this operation's own refusal mode.)\n  //\n  // The load-bearing property: a burst of probes across many hosts is the shape of egress\n  // reconnaissance, and that pattern is only visible if the individual rows are not filtered out by\n  // default. If a deployment finds the volume genuinely noisy, tune the SIEM's review per AU-6 —\n  // do not silently downgrade this to INFO.\n  [CoreAuditableEventType.WEBHOOK_ENDPOINT_TEST_DISPATCHED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  // Inbound deliveries (#1596) — data entering through the API. A refusal, an unroutable message, a failed\n  // attempt, a dead delivery and a replay are WARNING: each is something an operator may have to act on.\n  // DEAD is not CRITICAL: nothing is compromised, and CRITICAL is the paging floor.\n  [CoreAuditableEventType.INBOUND_DELIVERY_REJECTED]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.INBOUND_DELIVERY_ACCEPTED]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.INBOUND_DELIVERY_UNROUTABLE]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.INBOUND_DELIVERY_PROCESSED]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.INBOUND_DELIVERY_FAILED]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.INBOUND_DELIVERY_DEAD]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.INBOUND_DELIVERY_REPLAYED]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.WARNING },\n  // Inbound channels (#1630). A below-assurance message and a token presented by the wrong sender are WARNING —\n  // each can be the first sign of a spoofed or leaked address; a revocation and a sent reply are routine.\n  [CoreAuditableEventType.INBOUND_DELIVERY_BELOW_ASSURANCE]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.INBOUND_REPLY_SENT]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.INBOUND_REPLY_FAILED]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.INBOUND_REPLY_TOKEN_REVOKED]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.INBOUND_REPLY_TOKEN_DOWNGRADED]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.WARNING },\n  // #1600: a domain decides where a tenant's mail goes, so its lifecycle is organization management; losing one\n  // (suspension) and withholding an attachment are what an operator is alerted on.\n  [CoreAuditableEventType.ORGANIZATION_EMAIL_DOMAIN_CLAIMED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.ORGANIZATION_EMAIL_DOMAIN_OWNERSHIP_VERIFIED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.ORGANIZATION_EMAIL_DOMAIN_VERIFIED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.ORGANIZATION_EMAIL_DOMAIN_SUSPENDED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.ORGANIZATION_EMAIL_DOMAIN_REMOVED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.CLIENT_MAILBOX_CREATED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.CLIENT_MAILBOX_REMOVED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.INBOUND_EMAIL_ATTACHMENT_WITHHELD]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.INBOUND_EMAIL_REJECTED_LIMIT]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.WARNING },\n\n  // SCIM Directory Provisioning Events\n  [CoreAuditableEventType.SCIM_TOKEN_CREATED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.SCIM_TOKEN_REVOKED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.SCIM_USER_PROVISIONED]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.SCIM_USER_UPDATED]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.SCIM_USER_DEACTIVATED]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.WARNING },\n\n  // Password Reset Events (H5)\n  [CoreAuditableEventType.USER_PASSWORD_RESET_REQUESTED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_PASSWORD_RESET_COMPLETED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n  // CRITICAL, one step above the self-service arms: an administrator reaching into another\n  // account's credentials is the shape of both a legitimate incident response AND an insider\n  // takeover, so it must page rather than merely accumulate.\n  [CoreAuditableEventType.USER_PASSWORD_RESET_FORCED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.CRITICAL },\n\n  // Registration & Verification Events (H5)\n  [CoreAuditableEventType.USER_REGISTERED]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_EMAIL_VERIFIED]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.GOVERNED_DOCUMENT_INTERACTION_RECORDED]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_VERIFICATION_EMAIL_RESENT]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.INFO },\n\n  // MFA Lifecycle Events (H5)\n  [CoreAuditableEventType.USER_MFA_SETUP_STARTED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_MFA_SETUP_COMPLETED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.USER_MFA_EMAIL_OTP_SENT]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n\n  // WebAuthn/Passkey Events (Phase G1)\n  [CoreAuditableEventType.USER_PASSKEY_REGISTERED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.USER_PASSKEY_AUTHENTICATION_SUCCESS]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_PASSKEY_AUTHENTICATION_FAILURE]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.USER_PASSKEY_REMOVED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n  // CRITICAL, and the only passkey event that is: a verified assertion whose counter regressed means\n  // a private key may exist in two places. Its siblings are routine authentication outcomes.\n  [CoreAuditableEventType.USER_PASSKEY_CLONE_SUSPECTED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.CRITICAL },\n\n  // Magic Link Events (Phase G2)\n  [CoreAuditableEventType.USER_MAGIC_LINK_SENT]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_MAGIC_LINK_VERIFIED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_MAGIC_LINK_FAILED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n\n  // SMS OTP Events (Phase G2)\n  [CoreAuditableEventType.USER_SMS_OTP_SENT]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_SMS_OTP_VERIFIED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_SMS_OTP_FAILED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n\n  // Phone Verification Events (Phase G2)\n  [CoreAuditableEventType.USER_PHONE_VERIFIED]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_PHONE_VERIFICATION_FAILED]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.WARNING },\n\n  // OAuth2 Provider Restriction Events (Phase G3)\n  [CoreAuditableEventType.OAUTH2_PROVIDER_BLOCKED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n  // AUTHENTICATION, not AUTHORIZATION: the demand is about HOW the person proved who they are, and\n  // the refusal happens before any authorization decision exists. WARNING rather than ERROR — a\n  // provider that will not satisfy a step-up demand is a configuration disagreement between two\n  // parties, expected to recur until an operator changes one of them, and an ERROR channel that\n  // fills with it stops being read.\n  [CoreAuditableEventType.OIDC_ACR_DEMAND_UNSATISFIED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n\n  // SCIM Extended Events\n  [CoreAuditableEventType.SCIM_TOKEN_GENERATED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.SCIM_TOKEN_ROTATED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.SCIM_PROVISIONING_CONFIG_UPDATED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.SCIM_PROVISIONING_FAILED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.CRITICAL },\n\n  // SAML Authentication Events (AUTH-2, D19.4)\n  [CoreAuditableEventType.SAML_LOGIN_INITIATED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.SAML_LOGIN_SUCCESS]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.SAML_LOGIN_FAILED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.SAML_ASSERTION_REPLAY_DETECTED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.CRITICAL },\n  [CoreAuditableEventType.SAML_CERT_EXPIRING]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.SAML_SLO_INITIATED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.SAML_SLO_COMPLETED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.SAML_METADATA_PARSED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.SAML_EMAIL_CHANGED]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.WARNING },\n\n  // Method Management Events (#13f)\n  [CoreAuditableEventType.USER_PASSWORD_SET]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.USER_TOTP_DISABLED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.USER_IDENTITY_LINK_REMOVED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n\n  // One-Off Session Events (W7.3b)\n  // A file upload grant delegates ONE upload under the minter's authority to whoever holds the link —\n  // an AUTHORIZATION artefact, not an authentication one (nobody logs in with it). Issued is INFO like\n  // every other token mint here; revoked is WARNING for the same reason the one-off revoke below is: an\n  // administrative credential termination is what a reviewer wants to see.\n  [CoreAuditableEventType.FILE_UPLOAD_GRANT_ISSUED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.FILE_UPLOAD_GRANT_REDEEMED]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.FILE_UPLOAD_GRANT_REVOKED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n  // A share link delegates READ of one file to anyone holding it: the same AUTHORIZATION split as the\n  // grants above, INFO to mint and WARNING to terminate.\n  [CoreAuditableEventType.FILE_SHARE_LINK_ISSUED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.FILE_SHARE_LINKS_REVOKED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n  /*\n   * DATA_ACCESS for both, and it is the least-wrong of five rather than a good fit (#506). The\n   * category vocabulary has no security-operations member, and the file plane's own precedent splits\n   * the grant events the same way — AUTHORIZATION for issuing and revoking a credential, DATA_ACCESS\n   * for the moment content actually moves. A scan is a conclusion about CONTENT that arrived, so it\n   * belongs on the second side.\n   *\n   * The severities are the substance: an infection is a threat the control CAUGHT (critical, same\n   * argument as a suspected passkey clone), a scan failure is the control not having RUN (warning —\n   * nothing was found and nothing was exposed, because the file fails closed to a non-downloadable\n   * status either way; what is wrong is availability).\n   */\n  [CoreAuditableEventType.FILE_MALWARE_DETECTED]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.CRITICAL },\n  [CoreAuditableEventType.FILE_MALWARE_SCAN_FAILED]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.ONE_OFF_TOKEN_CREATED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.ONE_OFF_TOKEN_EXCHANGED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  // Revocation is an ADMINISTRATIVE credential-termination — a super-admin cancels an un-exchanged\n  // one-off/impersonation token. Per OWASP's Logging Vocabulary, administrative operations are WARNING\n  // even when successful and authorized: a SOC wants one-off-token revocations visible (incident\n  // response, or an abuse burst of cancellations). CREATED/EXCHANGED stay INFO (routine mint/use); the\n  // revoke is the operator intervention, which is the higher-signal row.\n  [CoreAuditableEventType.ONE_OFF_TOKEN_REVOKED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n\n  // Cross-Frontend Handoff Events (cross-app-jwt-propagation Step 2)\n  // Issuance is a credential-minting action (re-issues fresh JWT pair AND a single-use\n  // AUTH_CODE_EXCHANGE token bound to the user). WARNING severity matches other\n  // cross-session credential events (USER_PASSWORD_RESET_COMPLETED, USER_PASSKEY_REGISTERED)\n  // so SOC dashboards flag unusual handoff issuance bursts (e.g. token-issuance abuse).\n  [CoreAuditableEventType.USER_CROSS_FRONTEND_HANDOFF_ISSUED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n\n  // Field Access Events\n  [CoreAuditableEventType.FIELD_ACCESS]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.INFO },\n\n  // Resource-Operation Events — a HIGH/CRITICAL operation took effect on a resource.\n  // AUTHORIZATION rather than DATA_ACCESS: this event exists to evidence that a privileged ACTION\n  // was exercised (role/status/credential/tenant mutations), not that data was read — FIELD_ACCESS\n  // owns the disclosure axis. WARNING rather than INFO because every emission is by construction a\n  // HIGH or CRITICAL verb (or an explicit opt-in), so an INFO floor would hide the whole family\n  // beneath the routine-read noise on a SOC dashboard; and not CRITICAL because these are\n  // AUTHORIZED administrative actions, so reserving CRITICAL for anomalies (binding violations,\n  // token-reuse) keeps that level meaningful.\n  [CoreAuditableEventType.RESOURCE_OPERATION_PERFORMED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n\n  // The REFUSAL twin. AUTHORIZATION for the same reason as the success row — it IS an access-control\n  // decision, just the negative one.\n  //\n  // WARNING, and deliberately NOT graded by the refused operation's `riskLevel`: severity is a pure\n  // function of event type for every other member of this map, AND the SIEM dispatcher re-derives it\n  // from the event type independently (`_passesEventFilter`), so a per-row severity would have to be\n  // threaded through two authorities and would still leave this the only type whose severity is not\n  // a property of its kind. Danger grading rides the row's `riskLevel` field, which is already the\n  // framework's canonical danger axis; burst grading rides `eventData.occurrenceCount`.\n  //\n  // WARNING also matches the AUTHENTICATION twins (USER_LOGIN_FAILED, MACHINE_AUTH_FAILED): a single\n  // refusal is a fail-closed control working correctly, not an incident. CRITICAL stays reserved for\n  // anomalies — and the anomaly here is the PATTERN (many refusals), which a SOC rule builds from\n  // `occurrenceCount` rather than from one row's severity.\n  //\n  // assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT\n  [CoreAuditableEventType.RESOURCE_OPERATION_DENIED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n  // WARNING, not CRITICAL, and the choice is deliberate. A platform operator reaching into a tenant\n  // is SANCTIONED here (see the event's schema JSDoc) — most support work is exactly this — so\n  // CRITICAL would cry wolf on routine activity and train reviewers to filter the category out. The\n  // signal worth escalating on is the `admissionDeclared: false` subset, which a SIEM rule can select\n  // precisely because the field is on the payload.\n  [CoreAuditableEventType.CROSS_TENANT_ADMINISTRATIVE_ACCESS]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n  // INFO, unlike the WARNING sibling above: an application-wide directory read is the sanctioned,\n  // ordinary use of a surface built for it, and grading it WARNING would bury the genuine crossings.\n  // The subset worth escalating is selected on `returnedCount` — an operator paging 40,000 rows is an\n  // export — which is why that field is on the payload rather than inferred from the row count.\n  [CoreAuditableEventType.PLATFORM_DIRECTORY_ACCESS]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.INFO },\n  // WARNING for the same reason as its sibling above: requesting and deciding elevations is routine\n  // operator traffic, and CRITICAL here would train reviewers to filter the category out. The subset\n  // worth escalating is `autoApprovalReason: TENANT_CANNOT_APPROVE`, which a SIEM rule selects on and\n  // which the emitter additionally carries at a higher `riskLevel`.\n  [CoreAuditableEventType.PLATFORM_ACCESS_GRANT_LIFECYCLE]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n  // A hold changes what a tenant's data may become, the way an organization configuration change does (#1634).\n  [CoreAuditableEventType.LEGAL_HOLD_PLACED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  // #1598: linking an aggregate to its invoice decides how long it is kept past its tenant — a record-keeping\n  // decision on the tenant's data, routine billing traffic rather than an anomaly, so INFO.\n  [CoreAuditableEventType.MODEL_COST_AGGREGATE_INVOICE_LINKED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.CORRECTION_CAPTURE_SETTING_CHANGED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.EVALUATION_EXPORT_AUTHORIZATION_CHANGED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.EVALUATION_DATASET_EXPORTED]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.EVALUATION_DATASET_EXPORT_REFUSED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.LEGAL_HOLD_RELEASED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  // AUTHORIZATION / WARNING for all four service-provider events (#1597), matching the grant: each one\n  // changes which people from OUTSIDE an organization can reach it, and a reviewer sweeping for changes\n  // in who can reach what must find them without knowing to look for them.\n  [CoreAuditableEventType.SERVICE_PROVIDER_RELATIONSHIP_LIFECYCLE]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.SERVICE_PROVIDER_MACHINE_CLIENT_ADMISSION_CHANGED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.SERVICE_PROVIDER_EXPERT_ASSIGNED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.SERVICE_PROVIDER_EXPERT_UNASSIGNED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n  // The per-expert approval (#1612) decides whether one more person from outside reaches the client: the same\n  // AUTHORIZATION / WARNING as an assignment, for the same reviewer sweeping for changes in who can reach what.\n  [CoreAuditableEventType.SERVICE_PROVIDER_EXPERT_APPROVAL_REQUESTED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.SERVICE_PROVIDER_EXPERT_APPROVAL_GRANTED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.SERVICE_PROVIDER_EXPERT_APPROVAL_DENIED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n  // Trusting a firm's MFA changes what may satisfy the client's authentication policy for outside staff (#1633): the\n  // same AUTHORIZATION / WARNING a reviewer sweeping for changes in who can reach what already reads.\n  [CoreAuditableEventType.SERVICE_PROVIDER_MFA_TRUST_CHANGED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n  // A factor proven for a client is an authentication outcome, like a step-up (#1633).\n  [CoreAuditableEventType.SERVICE_PROVIDER_CLIENT_AUTHENTICATION_SATISFIED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  // The firm's worker-monitoring decision and the client's disclosure level change who learns what about people's\n  // work (#1632): configuration of an organization, WARNING so a monitoring switch is never routine noise.\n  [CoreAuditableEventType.SERVICE_PROVIDER_ACTIVITY_FEED_DECIDED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.SERVICE_PROVIDER_ACTIVITY_FEED_DISCLOSURE_CHANGED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.SERVICE_PROVIDER_EXPERT_APPROVAL_LAPSED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n  // Delegated administration (#1631) is a privilege change for people outside the organization: AUTHORIZATION, and\n  // CRITICAL — lending administration is the change a reviewer must never miss; the row's `securityCritical` and its\n  // riskLevel say which grants were owner-only.\n  [CoreAuditableEventType.SERVICE_PROVIDER_CAPABILITY_GRANTED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.CRITICAL },\n  [CoreAuditableEventType.SERVICE_PROVIDER_CAPABILITY_REVOKED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n  // AUTHORIZATION / WARNING, matching its grant sibling exactly. The category is not a judgement\n  // call: assigning a partition to a unit decides which members may read a remote company's rows, so\n  // it is an access-control decision whatever it looks like from the configuration side. WARNING\n  // rather than INFO for the same reason the grant carries it — a reviewer sweeping for changes in\n  // who can reach what must find these without knowing to look for them.\n  [CoreAuditableEventType.SYSTEM_OF_RECORD_PARTITION_ASSIGNMENT_LIFECYCLE]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n\n  // Retained-Data (Impersonalization) Access Events\n  // A privileged, human-attributed see-through read over RETAINED (impersonalized) records. WARNING —\n  // elevated vs a normal FIELD_ACCESS/INFO read because it reveals data the retention boundary hides,\n  // so SOC dashboards surface it; but an AUTHORIZED compliance action, not an anomaly ⇒ not CRITICAL.\n  [CoreAuditableEventType.RETAINED_DATA_ACCESS]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.WARNING },\n  // The single most sensitive disclosure the framework performs — everything held about one person,\n  // handed out. Same DATA_ACCESS / WARNING classification as a retained-data see-through: authorized\n  // and expected, but always worth a reviewer's eye.\n  [CoreAuditableEventType.SUBJECT_DATA_EXPORT]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.WARNING },\n  // INFO, with the page-vs-whole-table distinction carried by the per-emission `riskLevel` (LOW/HIGH)\n  // rather than by severity — see AuditableEvent_CollectionDataExport_EventDataSchema. A routine page\n  // download raised to WARNING would train reviewers to skim the channel it shares with real signals.\n  [CoreAuditableEventType.COLLECTION_DATA_EXPORT]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.INFO },\n  // Routine, authorized read-through of an EXTERNAL system's rows — the value is the queryable\n  // trail (who/which provider/which entity/how much), not an alarm. WARNING would put every\n  // ordinary external read beside see-through privileged access and train reviewers to skim.\n  [CoreAuditableEventType.HTTP_API_READ_THROUGH_ACCESS]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.INFO },\n  // A write THROUGH a read-through binding (#1679). INFO like its read twin: an authorized member changing\n  // a row of the company's own ERP is routine, and the value is the queryable trail. What differs per\n  // emission — applied, refused, unknown — rides `eventData.outcome` and the per-emission `riskLevel`;\n  // a static WARNING would put every ordinary remote update beside privileged see-through access.\n  [CoreAuditableEventType.HTTP_API_WRITE_THROUGH]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.INFO },\n  // A declared system-of-record ACTION ran (#1678). DATA_ACCESS/INFO like the write-through row: an authorized member\n  // posting an invoice in the company's own ERP is routine, and the per-emission `riskLevel` carries what differs —\n  // an unknown outcome is HIGH, a performed action MEDIUM.\n  [CoreAuditableEventType.SYSTEM_OF_RECORD_ACTION_EXECUTED]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.INFO },\n  // A declared system-of-record action was REFUSED before sending (#1678): a negative access decision, classified with\n  // PROVIDER_OPERATION_DENIED and RESOURCE_OPERATION_DENIED rather than with the executed row.\n  //\n  // assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT\n  [CoreAuditableEventType.SYSTEM_OF_RECORD_ACTION_REFUSED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n  // #1734 — an operator discarded a pipeline's pass state: administrative, like a platform configuration publication.\n  [CoreAuditableEventType.EXTERNAL_DATA_PIPELINE_RESET]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  // #2039 — an operator's answer about an outbound write: administrative, like the reset beside it.\n  [CoreAuditableEventType.EXTERNAL_DATA_OUTBOUND_UNKNOWN_RESOLVED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  // #1723 — one side's data overwritten by a conflict resolution: data access, and worth a reviewer's look.\n  [CoreAuditableEventType.EXTERNAL_DATA_CONFLICT_RESOLVED]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.WARNING },\n  // The other outbound door: a custom service calling a declared provider operation. Same reading as\n  // the read-through row above — routine, authorized activity whose value is the queryable trail. The\n  // READ/WRITE axis and the failure case ride `classification`, `failureKind` and the per-emission\n  // `riskLevel`; raising the static severity for the write case would raise it for every read too.\n  [CoreAuditableEventType.PROVIDER_OPERATION_CALL]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.INFO },\n  // The browser door REFUSED a provider operation (#367). Classified with `RESOURCE_OPERATION_DENIED`\n  // rather than with the call above, because it records the same kind of thing — a negative access\n  // decision — and not an outbound call: nothing left the process.\n  //\n  // assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT\n  [CoreAuditableEventType.PROVIDER_OPERATION_DENIED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n  // Same classification as its sibling above, for the same reason: routine authorized activity whose\n  // value is the queryable trail rather than an alarm. A refused target rides `failureKind`/`outcome`\n  // on the payload, never the static severity — see the enum member's docstring.\n  [CoreAuditableEventType.MCP_TOOL_CALL]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.PROVIDER_CAPABILITY_CALL]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.INFO },\n  // #1594 — one decision family for both planes. Each row records who may, or did, authorize an agent's\n  // action, so AUTHORIZATION throughout. INFO: an identified person acting within their route is the\n  // system working. The one WARNING is the refusal, because a refused attempt is the evidence a reviewer\n  // looks for. Modified approvals are no longer a separate WARNING type: filter RESOLVED on `outcome`.\n  [CoreAuditableEventType.HUMAN_DECISION_REQUESTED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.HUMAN_DECISION_RESOLVED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.HUMAN_DECISION_REASSIGNED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.HUMAN_DECISION_ESCALATED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.HUMAN_DECISION_CLAIMED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.HUMAN_DECISION_ANSWER_REFUSED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n  // #1628 — a deadline only changes who is asked and who is told, never the outcome, so every row is INFO.\n  // A missed deadline is a service-level fact, not a security warning; WARNING stays for refusals.\n  [CoreAuditableEventType.HUMAN_DECISION_DEADLINE_MISSED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.HUMAN_DECISION_ESCALATION_FIRED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.HUMAN_DECISION_CLOCK_PAUSED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.HUMAN_DECISION_CLOCK_RESUMED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.INFO },\n  // #1611 — a binding grants an agent standing authority to act unattended: AUTHORIZATION at WARNING, as a\n  // machine client's admission into a client organization is. A turn the entry point opens runs under\n  // that authority (INFO); a refused one is evidence of something unexpected (WARNING).\n  [CoreAuditableEventType.AUTONOMOUS_AGENT_BOUND]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.AUTONOMOUS_AGENT_UNBOUND]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.AUTONOMOUS_AGENT_TURN_STARTED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.AUTONOMOUS_AGENT_TURN_REFUSED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n  // The sanctioned mechanics of a data-protection request (D6 stance 6b) — routine, not an alarm.\n  [CoreAuditableEventType.HTTP_API_EXTERNAL_ERASURE]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.INFO },\n  // A deliberate, per-request erasure hole (D6 stance 6c) — the record is the control, so it must\n  // surface in every severity-filtered view an operator actually reads.\n  [CoreAuditableEventType.HTTP_API_NON_ERASURE_ACKNOWLEDGED]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.CRITICAL },\n  // The sanctioned mechanics of a data-protection request; the row's `status` carries whether data stayed live.\n  [CoreAuditableEventType.SUBJECT_ERASURE_RECIPIENT_OUTCOME]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.INFO },\n\n  // OAuth2 / OIDC Provider Events (Wildo AS the authorization server). Delegated-authority grants +\n  // consent decisions are AUTHORIZATION; token lifecycle (refresh/revoke) is AUTHENTICATION. Severity:\n  // a third party gaining/holding user-acting access is WARNING (notable, SOC-dashboard-worthy, but an\n  // authorized/consented action ⇒ not CRITICAL); a cross-user binding violation or refresh-token theft\n  // is CRITICAL; a denial/routine refresh/revoke is INFO.\n  [CoreAuditableEventType.OAUTH_DELEGATED_TOKEN_ISSUED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.OAUTH_CONSENT_GRANTED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.OAUTH_CONSENT_DENIED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.OAUTH_CONSENT_GRANT_PERSISTED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n  // WARNING, not INFO: an unauthenticated party created a durable identity. Individually routine\n  // when the feature is enabled, but the SHAPE an operator must be able to alert on is a spike —\n  // which only reads as a spike if each one is above the noise floor.\n  // AUTHENTICATION/WARNING: a refused client identity is an authentication-front event, and the\n  // SSRF variant is an attack rather than a misconfiguration. WARNING keeps a spike visible without\n  // making an ordinary allow-list miss look like an incident.\n  [CoreAuditableEventType.OAUTH_CIMD_CLIENT_REFUSED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.OAUTH_DYNAMIC_CLIENT_REGISTERED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.OAUTH_TOKEN_REFRESHED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.OAUTH_TOKEN_REVOKED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.OAUTH_RP_INITIATED_LOGOUT]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.OAUTH_CODE_EXCHANGE_FAILED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.OAUTH_CONSENT_BINDING_VIOLATION]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.CRITICAL },\n  [CoreAuditableEventType.USER_REFRESH_TOKEN_REUSE_DETECTED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.CRITICAL },\n\n  // System-context (ACL-bypass) trail. Both were UNMAPPED until 2026-08-11 and took the fallback.\n  // The READ keeps exactly what the fallback gave it — its declaration already documented\n  // `DATA_ACCESS`/`INFO` as intended (\"an expected, authorized internal read — not an anomaly\"), so\n  // this only stops that intent depending on a default nobody had noticed it was relying on.\n  [CoreAuditableEventType.SYSTEM_CONTEXT_READ]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.INFO },\n  // The WRITE is raised to WARNING, following `RETAINED_DATA_ACCESS` — the other privileged-access\n  // event in this file — which reasons that an authorized-but-elevated access is WARNING and not\n  // CRITICAL because it is expected rather than anomalous. Category deliberately UNCHANGED: moving it\n  // to AUTHORIZATION would drop it for every tenant whose export filters on categories, which is a\n  // worse failure than an under-graded severity. This is the classification the event's own\n  // declaration asks for and had never received.\n  // Administrative security posture publication remains WARNING even for authorized changes and no-ops.\n  [CoreAuditableEventType.PLATFORM_CONFIGURATION_PUBLICATION]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.SYSTEM_CONTEXT_WRITE]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.WARNING },\n};\n\nconst DEFAULT_AUDIT_EVENT_CLASSIFICATION: AuditEventClassification = { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.INFO };\n\n/**\n * Look up the classification for an audit event type.\n *\n * Every `CoreAuditableEventType` is mapped — enforced by the map's type, not by this comment, which\n * asserted exactly that while two event types went unmapped for months. The fallback exists for\n * APPLICATION-defined event types, which are ordinary strings the engine cannot enumerate.\n */\nexport function getAuditEventClassification(eventType: string): AuditEventClassification {\n  return AUDIT_EVENT_CLASSIFICATION_MAP[eventType as CoreAuditableEventType] ?? DEFAULT_AUDIT_EVENT_CLASSIFICATION;\n}\n"]}
+{"version":3,"file":"security-audit-event-envelope.shared.schema.js","sourceRoot":"","sources":["../../../../src/compliance/audit-trails/security-audit-event-envelope.shared.schema.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAC7F,OAAO,EACL,6BAA6B,EAC7B,6BAA6B,EAC7B,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,wBAAwB,EAAE,MAAM,sFAAsF,CAAC;AAEhI,sDAAsD;AACtD,MAAM,CAAN,IAAY,iBAGX;AAHD,WAAY,iBAAiB;IAC3B,wCAAmB,CAAA;IACnB,wCAAmB,CAAA;AACrB,CAAC,EAHW,iBAAiB,KAAjB,iBAAiB,QAG5B;AAED;;oEAEoE;AAEpE,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,mCAAmC;IACnC;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;SACtC,QAAQ,CAAC,uBAAuB,CAAC,2CAA2C,EAAE,6BAA6B,CAAC,CAAC;IAChH,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;SACjC,QAAQ,CAAC,uBAAuB,CAAC,yCAAyC,EAAE,6BAA6B,CAAC,CAAC;IAC9G,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,iGAAiG;IACjG,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC;;;;;OAKG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC;;;;;OAKG;IACH,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE1C,UAAU;IACV,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC;;;;OAIG;IACH,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,QAAQ,EAAE;IAC5C;;;OAGG;IACH,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,wHAAwH;IACxH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,wHAAwH;IACxH,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC;;;OAGG;IACH,sCAAsC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7D,4FAA4F;IAC5F,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7C;;;OAGG;IACH,2BAA2B,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,QAAQ,EAAE;IAExE,SAAS;IACT,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE;IAE7B,0CAA0C;IAC1C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC;;;;OAIG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC9B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC5B,CAAC,CAAC,QAAQ,EAAE;IAEb,sBAAsB;IACtB,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;IAExC,UAAU;IACV,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC;IAClC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC;AAgBH;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAA6D;IACtG,wBAAwB;IACxB,CAAC,sBAAsB,CAAC,UAAU,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACvH,CAAC,sBAAsB,CAAC,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACxH,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACjI,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IACpI,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACjI,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACnI,gGAAgG;IAChG,kGAAkG;IAClG,qDAAqD;IACrD,CAAC,sBAAsB,CAAC,cAAc,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACxH,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACrI,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAChI,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACjI,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACjI;;;;;OAKG;IACH,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAEpI,4BAA4B;IAC5B,CAAC,sBAAsB,CAAC,cAAc,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAC3H,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACrI,CAAC,sBAAsB,CAAC,4BAA4B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAC7I,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAEjI,0BAA0B;IAC1B,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAEtI,wBAAwB;IACxB,CAAC,sBAAsB,CAAC,YAAY,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACzH,CAAC,sBAAsB,CAAC,YAAY,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACzH,CAAC,sBAAsB,CAAC,YAAY,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAEzH,wFAAwF;IACxF,4FAA4F;IAC5F,iGAAiG;IACjG,qFAAqF;IACrF,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAErI,iGAAiG;IACjG,mGAAmG;IACnG,oGAAoG;IACpG,4FAA4F;IAC5F,CAAC,sBAAsB,CAAC,sCAAsC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IACtJ,CAAC,sBAAsB,CAAC,iCAAiC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAEjJ,gCAAgC;IAChC,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACjI,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACjI,qHAAqH;IACrH,CAAC,sBAAsB,CAAC,0BAA0B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAC1I,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACpI,CAAC,sBAAsB,CAAC,+BAA+B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAC/I,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAClI,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACtI,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACnI,4FAA4F;IAC5F,0FAA0F;IAC1F,oFAAoF;IACpF,wFAAwF;IACxF,+FAA+F;IAC/F,gGAAgG;IAChG,6FAA6F;IAC7F,sDAAsD;IACtD,CAAC,sBAAsB,CAAC,oCAAoC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAEpJ,6BAA6B;IAC7B,CAAC,sBAAsB,CAAC,2BAA2B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACxI,CAAC,sBAAsB,CAAC,0BAA0B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACvI,CAAC,sBAAsB,CAAC,2BAA2B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACxI,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAC/I,CAAC,sBAAsB,CAAC,kCAAkC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAC/I,CAAC,sBAAsB,CAAC,2BAA2B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAE3I,6BAA6B;IAC7B,CAAC,sBAAsB,CAAC,kCAAkC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAC/I,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAC7I,CAAC,sBAAsB,CAAC,4BAA4B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACzI,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAEtI,qGAAqG;IACrG,mGAAmG;IACnG,0FAA0F;IAC1F,mGAAmG;IACnG,uEAAuE;IACvE,CAAC,sBAAsB,CAAC,qCAAqC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAEpJ,qGAAqG;IACrG,6FAA6F;IAC7F,2FAA2F;IAC3F,8FAA8F;IAC9F,+DAA+D;IAC/D,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAE/I,0CAA0C;IAC1C,CAAC,sBAAsB,CAAC,sCAAsC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACtJ,CAAC,sBAAsB,CAAC,mCAAmC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAChJ,+FAA+F;IAC/F,oGAAoG;IACpG,gGAAgG;IAChG,kGAAkG;IAClG,8FAA8F;IAC9F,mGAAmG;IACnG,CAAC,sBAAsB,CAAC,iCAAiC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAClJ,CAAC,sBAAsB,CAAC,4CAA4C,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAE5J,4FAA4F;IAC5F,EAAE;IACF,iGAAiG;IACjG,gGAAgG;IAChG,6FAA6F;IAC7F,qFAAqF;IACrF,EAAE;IACF,gGAAgG;IAChG,gGAAgG;IAChG,wDAAwD;IACxD,CAAC,sBAAsB,CAAC,oCAAoC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACpJ,CAAC,sBAAsB,CAAC,wCAAwC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACxJ,gGAAgG;IAChG,kGAAkG;IAClG,gGAAgG;IAChG,4FAA4F;IAC5F,4FAA4F;IAC5F,CAAC,sBAAsB,CAAC,qCAAqC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAClJ,CAAC,sBAAsB,CAAC,wCAAwC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAExJ,iGAAiG;IACjG,kGAAkG;IAClG,kGAAkG;IAClG,iGAAiG;IACjG,0FAA0F;IAC1F,EAAE;IACF,kGAAkG;IAClG,0FAA0F;IAC1F,8FAA8F;IAC9F,gBAAgB;IAChB,CAAC,sBAAsB,CAAC,4BAA4B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACzI,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAC7I,CAAC,sBAAsB,CAAC,6BAA6B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAC1I,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAEhJ,kGAAkG;IAClG,mGAAmG;IACnG,iGAAiG;IACjG,8FAA8F;IAC9F,kGAAkG;IAClG,iFAAiF;IACjF,CAAC,sBAAsB,CAAC,wCAAwC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACxJ,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAE7I,4CAA4C;IAC5C,kGAAkG;IAClG,6FAA6F;IAC7F,gGAAgG;IAChG,oEAAoE;IACpE,CAAC,sBAAsB,CAAC,+BAA+B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAC/I,oHAAoH;IACpH,CAAC,sBAAsB,CAAC,8BAA8B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAExI,8BAA8B;IAC9B,6FAA6F;IAC7F,8FAA8F;IAC9F,qBAAqB;IACrB,EAAE;IACF,2FAA2F;IAC3F,4FAA4F;IAC5F,iGAAiG;IACjG,iGAAiG;IACjG,+FAA+F;IAC/F,gGAAgG;IAChG,2EAA2E;IAC3E,EAAE;IACF,gGAAgG;IAChG,gGAAgG;IAChG,+FAA+F;IAC/F,iGAAiG;IACjG,kGAAkG;IAClG,8FAA8F;IAC9F,kGAAkG;IAClG,6EAA6E;IAC7E,qFAAqF;IACrF,EAAE;IACF,wFAAwF;IACxF,kGAAkG;IAClG,+FAA+F;IAC/F,0CAA0C;IAC1C,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAChJ,yGAAyG;IACzG,uGAAuG;IACvG,kFAAkF;IAClF,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACtI,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACnI,CAAC,sBAAsB,CAAC,2BAA2B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACxI,CAAC,sBAAsB,CAAC,0BAA0B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACpI,CAAC,sBAAsB,CAAC,uBAAuB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACpI,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAClI,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACtI,8GAA8G;IAC9G,wGAAwG;IACxG,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAC7I,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAC5H,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACjI,CAAC,sBAAsB,CAAC,2BAA2B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACrI,CAAC,sBAAsB,CAAC,8BAA8B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAC3I,8GAA8G;IAC9G,iFAAiF;IACjF,CAAC,sBAAsB,CAAC,iCAAiC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAC9I,CAAC,sBAAsB,CAAC,4CAA4C,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAC5J,CAAC,sBAAsB,CAAC,kCAAkC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAC/I,CAAC,sBAAsB,CAAC,mCAAmC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACnJ,CAAC,sBAAsB,CAAC,iCAAiC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACjJ,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACtI,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACnI,CAAC,sBAAsB,CAAC,iCAAiC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAC9I,CAAC,sBAAsB,CAAC,4BAA4B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAEzI,qCAAqC;IACrC,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAClI,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAClI,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAClI,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAC9H,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAErI,6BAA6B;IAC7B,CAAC,sBAAsB,CAAC,6BAA6B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAC1I,CAAC,sBAAsB,CAAC,6BAA6B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAC7I,yFAAyF;IACzF,2FAA2F;IAC3F,2DAA2D;IAC3D,CAAC,sBAAsB,CAAC,0BAA0B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAE3I,0CAA0C;IAC1C,CAAC,sBAAsB,CAAC,eAAe,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAC5H,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAChI,CAAC,sBAAsB,CAAC,sCAAsC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACnJ,CAAC,sBAAsB,CAAC,8BAA8B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAE3I,4BAA4B;IAC5B,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACnI,CAAC,sBAAsB,CAAC,wBAAwB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACxI,CAAC,sBAAsB,CAAC,uBAAuB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAEpI,qCAAqC;IACrC,CAAC,sBAAsB,CAAC,uBAAuB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACvI,CAAC,sBAAsB,CAAC,mCAAmC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAChJ,CAAC,sBAAsB,CAAC,mCAAmC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACnJ,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACpI,mGAAmG;IACnG,2FAA2F;IAC3F,CAAC,sBAAsB,CAAC,4BAA4B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAE7I,+BAA+B;IAC/B,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACjI,CAAC,sBAAsB,CAAC,wBAAwB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACrI,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAEtI,4BAA4B;IAC5B,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAC9H,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAClI,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAEnI,uCAAuC;IACvC,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAChI,CAAC,sBAAsB,CAAC,8BAA8B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAE9I,gDAAgD;IAChD,CAAC,sBAAsB,CAAC,uBAAuB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACtI,iGAAiG;IACjG,8FAA8F;IAC9F,8FAA8F;IAC9F,8FAA8F;IAC9F,kCAAkC;IAClC,CAAC,sBAAsB,CAAC,2BAA2B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAE3I,uBAAuB;IACvB,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACpI,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAClI,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAC7I,CAAC,sBAAsB,CAAC,wBAAwB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAEzI,6CAA6C;IAC7C,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACjI,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAC/H,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACjI,CAAC,sBAAsB,CAAC,8BAA8B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAC/I,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAClI,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAC/H,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAC/H,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACjI,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAElI,kCAAkC;IAClC,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACjI,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAClI,CAAC,sBAAsB,CAAC,0BAA0B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAE1I,iCAAiC;IACjC,oGAAoG;IACpG,qGAAqG;IACrG,sGAAsG;IACtG,yEAAyE;IACzE,CAAC,sBAAsB,CAAC,wBAAwB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACpI,CAAC,sBAAsB,CAAC,0BAA0B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACpI,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACxI,oGAAoG;IACpG,uDAAuD;IACvD,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAClI,CAAC,sBAAsB,CAAC,wBAAwB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACvI;;;;;;;;;;;OAWG;IACH,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IACnI,CAAC,sBAAsB,CAAC,wBAAwB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACrI,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAClI,CAAC,sBAAsB,CAAC,uBAAuB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACpI,iGAAiG;IACjG,qGAAqG;IACrG,+FAA+F;IAC/F,qGAAqG;IACrG,uEAAuE;IACvE,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAErI,mEAAmE;IACnE,qFAAqF;IACrF,8EAA8E;IAC9E,2FAA2F;IAC3F,sFAAsF;IACtF,CAAC,sBAAsB,CAAC,kCAAkC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAElJ,sBAAsB;IACtB,CAAC,sBAAsB,CAAC,YAAY,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAEtH,mFAAmF;IACnF,gGAAgG;IAChG,iGAAiG;IACjG,iGAAiG;IACjG,8FAA8F;IAC9F,wFAAwF;IACxF,8FAA8F;IAC9F,4CAA4C;IAC5C,CAAC,sBAAsB,CAAC,4BAA4B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAE3I,mGAAmG;IACnG,mCAAmC;IACnC,EAAE;IACF,kGAAkG;IAClG,mGAAmG;IACnG,mGAAmG;IACnG,kGAAkG;IAClG,iGAAiG;IACjG,sFAAsF;IACtF,EAAE;IACF,mGAAmG;IACnG,mGAAmG;IACnG,gGAAgG;IAChG,yDAAyD;IACzD,EAAE;IACF,+DAA+D;IAC/D,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACxI,kGAAkG;IAClG,6FAA6F;IAC7F,kGAAkG;IAClG,oGAAoG;IACpG,iDAAiD;IACjD,CAAC,sBAAsB,CAAC,kCAAkC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACjJ,gGAAgG;IAChG,mGAAmG;IACnG,oGAAoG;IACpG,8FAA8F;IAC9F,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACnI,kGAAkG;IAClG,mGAAmG;IACnG,oGAAoG;IACpG,kEAAkE;IAClE,CAAC,sBAAsB,CAAC,+BAA+B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAC9I,6GAA6G;IAC7G,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACjI,4GAA4G;IAC5G,0FAA0F;IAC1F,CAAC,sBAAsB,CAAC,mCAAmC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAChJ,CAAC,sBAAsB,CAAC,kCAAkC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAClJ,CAAC,sBAAsB,CAAC,uCAAuC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACvJ,CAAC,sBAAsB,CAAC,2BAA2B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACxI,CAAC,sBAAsB,CAAC,iCAAiC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAChJ,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACnI,qGAAqG;IACrG,sGAAsG;IACtG,yEAAyE;IACzE,CAAC,sBAAsB,CAAC,uCAAuC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACtJ,CAAC,sBAAsB,CAAC,iDAAiD,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAChK,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAC/I,CAAC,sBAAsB,CAAC,kCAAkC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACjJ,4GAA4G;IAC5G,8GAA8G;IAC9G,CAAC,sBAAsB,CAAC,0CAA0C,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACzJ,CAAC,sBAAsB,CAAC,wCAAwC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACvJ,CAAC,sBAAsB,CAAC,uCAAuC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACtJ,mHAAmH;IACnH,oGAAoG;IACpG,CAAC,sBAAsB,CAAC,kCAAkC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACjJ,qFAAqF;IACrF,CAAC,sBAAsB,CAAC,gDAAgD,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAC7J,gHAAgH;IAChH,yGAAyG;IACzG,CAAC,sBAAsB,CAAC,sCAAsC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACtJ,CAAC,sBAAsB,CAAC,iDAAiD,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACjK,CAAC,sBAAsB,CAAC,uCAAuC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACtJ,iHAAiH;IACjH,mHAAmH;IACnH,8CAA8C;IAC9C,CAAC,sBAAsB,CAAC,mCAAmC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IACnJ,CAAC,sBAAsB,CAAC,mCAAmC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAClJ,+FAA+F;IAC/F,mGAAmG;IACnG,+FAA+F;IAC/F,iGAAiG;IACjG,uEAAuE;IACvE,CAAC,sBAAsB,CAAC,+CAA+C,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAE9J,kDAAkD;IAClD,oGAAoG;IACpG,oGAAoG;IACpG,oGAAoG;IACpG,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACjI,kGAAkG;IAClG,mGAAmG;IACnG,mDAAmD;IACnD,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAChI,oGAAoG;IACpG,oGAAoG;IACpG,oGAAoG;IACpG,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAChI,6FAA6F;IAC7F,0FAA0F;IAC1F,2FAA2F;IAC3F,CAAC,sBAAsB,CAAC,4BAA4B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACtI,yGAAyG;IACzG,oGAAoG;IACpG,qGAAqG;IACrG,gGAAgG;IAChG,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAChI,oHAAoH;IACpH,kHAAkH;IAClH,yDAAyD;IACzD,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAC1I,qHAAqH;IACrH,6FAA6F;IAC7F,EAAE;IACF,+DAA+D;IAC/D,CAAC,sBAAsB,CAAC,+BAA+B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAC9I,oHAAoH;IACpH,CAAC,sBAAsB,CAAC,4BAA4B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAC5I,kGAAkG;IAClG,CAAC,sBAAsB,CAAC,uCAAuC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACvJ,0GAA0G;IAC1G,CAAC,sBAAsB,CAAC,+BAA+B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAC5I,mGAAmG;IACnG,oGAAoG;IACpG,iGAAiG;IACjG,iGAAiG;IACjG,CAAC,sBAAsB,CAAC,uBAAuB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACjI,oGAAoG;IACpG,iGAAiG;IACjG,iEAAiE;IACjE,EAAE;IACF,+DAA+D;IAC/D,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACxI,mGAAmG;IACnG,oGAAoG;IACpG,+EAA+E;IAC/E,CAAC,sBAAsB,CAAC,aAAa,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACvH,CAAC,sBAAsB,CAAC,wBAAwB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAClI,sGAAsG;IACtG,mGAAmG;IACnG,uGAAuG;IACvG,qGAAqG;IACrG,CAAC,sBAAsB,CAAC,wBAAwB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACpI,CAAC,sBAAsB,CAAC,uBAAuB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACnI,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACrI,CAAC,sBAAsB,CAAC,wBAAwB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACpI,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAClI,CAAC,sBAAsB,CAAC,6BAA6B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAC5I,yGAAyG;IACzG,iGAAiG;IACjG,CAAC,sBAAsB,CAAC,8BAA8B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAC1I,CAAC,sBAAsB,CAAC,+BAA+B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAC3I,CAAC,sBAAsB,CAAC,2BAA2B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACvI,CAAC,sBAAsB,CAAC,4BAA4B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACxI,yGAAyG;IACzG,oGAAoG;IACpG,sFAAsF;IACtF,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACrI,CAAC,sBAAsB,CAAC,wBAAwB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACvI,CAAC,sBAAsB,CAAC,6BAA6B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACzI,CAAC,sBAAsB,CAAC,6BAA6B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAC5I,gGAAgG;IAChG,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACtI,gGAAgG;IAChG,sEAAsE;IACtE,CAAC,sBAAsB,CAAC,iCAAiC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAClJ,8GAA8G;IAC9G,CAAC,sBAAsB,CAAC,iCAAiC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAE9I,kGAAkG;IAClG,qGAAqG;IACrG,qGAAqG;IACrG,qGAAqG;IACrG,wDAAwD;IACxD,CAAC,sBAAsB,CAAC,4BAA4B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAC3I,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACpI,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAChI,CAAC,sBAAsB,CAAC,6BAA6B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAC5I,+FAA+F;IAC/F,+FAA+F;IAC/F,oEAAoE;IACpE,8FAA8F;IAC9F,kGAAkG;IAClG,4DAA4D;IAC5D,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IACzI,CAAC,sBAAsB,CAAC,+BAA+B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAC/I,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAClI,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAChI,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IACtI,CAAC,sBAAsB,CAAC,0BAA0B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAC1I,CAAC,sBAAsB,CAAC,+BAA+B,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAC/I,CAAC,sBAAsB,CAAC,iCAAiC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAElJ,gGAAgG;IAChG,wFAAwF;IACxF,kGAAkG;IAClG,2FAA2F;IAC3F,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE;IAC7H,iGAAiG;IACjG,+FAA+F;IAC/F,oGAAoG;IACpG,iGAAiG;IACjG,0FAA0F;IAC1F,+CAA+C;IAC/C,sGAAsG;IACtG,CAAC,sBAAsB,CAAC,kCAAkC,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;IAClJ,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE;CAClI,CAAC;AAEF,MAAM,kCAAkC,GAA6B,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,EAAE,CAAC;AAErJ;;;;;GAKG;AACH,MAAM,UAAU,iDAAiD,CAAC,qBAAoE;IACpI,OAAO,MAAM,CAAC,IAAI,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,8BAA8B,EAAE,SAAS,CAAC,CAAC,CAAC;AAClI,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,2BAA2B,CACzC,SAAiB,EACjB,qBAA0E;IAE1E,6GAA6G;IAC7G,oEAAoE;IACpE,IAAI,MAAM,CAAC,MAAM,CAAC,8BAA8B,EAAE,SAAS,CAAC;QAAE,OAAO,8BAA8B,CAAC,SAAmC,CAAC,CAAC;IACzI,MAAM,QAAQ,GAAG,qBAAqB,IAAI,MAAM,CAAC,MAAM,CAAC,qBAAqB,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzI,OAAO,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,kCAAkC,CAAC;AACtH,CAAC","sourcesContent":["/**\n * Security Audit Event Envelope — the structured JSON payload sent to customer SIEM.\n * \n * This is the canonical format for events exported via the org-level SIEM export pipeline.\n * Different from platform observability (which ships to Axiom/Datadog for platform ops).\n * Org SIEM export ships per-org security events to the customer's own SIEM.\n */\n\nimport { z } from 'zod';\nimport { AuditEventCategory, AuditEventSeverity } from './audit-event-classification.shared';\nimport {\n  AUDIT_EVENT_CATEGORY_MEANINGS,\n  AUDIT_EVENT_SEVERITY_MEANINGS,\n  CoreAuditableEventType,\n  describeAuditVocabulary,\n} from './auditable-events.shared.schema';\nimport { AuditActorKind } from './audit-actor.shared.schemas';\nimport { FactorSatisfactionSource } from '../../security/authentications/service-provider-client-authentication.shared.schemas';\n\n/** Outcome for SIEM envelope — success or failure. */\nexport enum AuditEventOutcome {\n  SUCCESS = 'success',\n  FAILURE = 'failure',\n}\n\n/** ──────────────────────────────────────────────────────────────\n * Security Audit Event Envelope Schema\n * ────────────────────────────────────────────────────────────── */\n\nexport const SecurityAuditEventEnvelopeSchema = z.object({\n  // Standard fields (always present)\n  /**\n   * The AUDIT ROW's own `eventId` (`AuditableEvent.eventId`) — copied here, never minted for the\n   * delivery. It is doing two jobs and both need it to be that value:\n   *\n   *  - it is the receiver's IDEMPOTENCY key. Every wire format carries this one field through:\n   *    CEF `externalId`, LEEF `eventId`, OCSF `metadata.uid`, and the verbatim `json_structured`\n   *    body's top-level `eventId`. It is stable across every retry of a delivery (the envelope is\n   *    built once and re-sent, including from the dead-letter drain).\n   *  - it is the CORRELATION key back into the application. The same value is on the audit row, on\n   *    the immudb record, and is what `AuditLogVerification.verifyAuditEvent(eventId)` resolves —\n   *    so a record in the customer's SIEM can be traced to the event it was projected from.\n   *\n   * The second job was silently absent until 2026-09-09: the dispatcher minted a fresh uuid here,\n   * which deduplicated correctly and named nothing. See `_resolveEnvelopeEventId` in\n   * `audit-event-dispatcher.backend.service.ts` for the cutover reasoning.\n   *\n   * NOTE one audit event fanned out to several member orgs delivers the SAME id to each of those\n   * tenants' sinks. They are different receivers, so dedup is unaffected — and it is one event.\n   */\n  eventId: z.string(),\n  eventType: z.string(),\n  eventCategory: z.enum(AuditEventCategory)\n    .describe(describeAuditVocabulary('What kind of activity this event records.', AUDIT_EVENT_CATEGORY_MEANINGS)),\n  severity: z.enum(AuditEventSeverity)\n    .describe(describeAuditVocabulary('How much attention this event asks for.', AUDIT_EVENT_SEVERITY_MEANINGS)),\n  timestamp: z.string(),\n  /** Request-correlation id (groups every event of one request; matches the app's logs/errors). */\n  correlationId: z.string().optional(),\n  /**\n   * Client-install id — groups an actor's events across sessions and logins, the correlation NIST\n   * SP 800-53 AU-6(3) asks for at review time. Present ONLY for applications that opted into\n   * `compliance.clientInstanceIdScope`; absent (never null-filled) for every other application, so a\n   * SIEM rule keying on it simply never matches rather than seeing an empty field.\n   */\n  clientInstanceId: z.string().optional(),\n  /**\n   * Which frontend SURFACE the request came from (app / website / docs). Carried for the same reason as\n   * the two ids above: an external reviewer correlating in the SIEM needs the same origin axes the audit\n   * row has, and shipping two of the three origin signals was an asymmetry with no rationale behind it.\n   * Absent for non-HTTP (job / cron / internal) events.\n   */\n  frontendServiceName: z.string().optional(),\n\n  // Context\n  organizationId: z.string(),\n  organizationName: z.string().optional(),\n  applicationId: z.string().optional(),\n  applicationName: z.string().optional(),\n  userId: z.string().optional(),\n  userEmail: z.string().optional(),\n  /**\n   * The KIND of principal whose authority was used (`AuditActorKind`) — lets a SIEM rule tell a person\n   * from a delegated client, a machine, or the application itself without joining back. Copied from\n   * the audit row; absent only on a row written before the field existed.\n   */\n  actorKind: z.enum(AuditActorKind).optional(),\n  /**\n   * The AI agent that performed the action (`agentActor.agentRef` on the row) — present only when an\n   * agent acted. A configuration identifier, not personal data. `actorKind` still names the principal.\n   */\n  agentRef: z.string().optional(),\n  /** The agent's conversational execution (`agentActor.agentExecutionId`) — a pseudonymous key, never transcript text. */\n  agentExecutionId: z.string().optional(),\n  /** The external OAuth client a person delegated to (the verified token's `azp`), for `actorKind = DELEGATED_CLIENT`. */\n  delegatingClientId: z.string().optional(),\n  /**\n   * The service-provider relationship the principal acted through (#1597), copied from the row. Present only\n   * on an event in a CLIENT organization caused by a firm's expert or machine client. An identifier, not personal data.\n   */\n  actingViaServiceProviderRelationshipId: z.string().optional(),\n  /** The firm behind `actingViaServiceProviderRelationshipId`; present exactly when it is. */\n  providerOrganizationId: z.string().optional(),\n  /**\n   * Where the factor that satisfied the client organization's authentication policy came from (#1633), copied from\n   * the row: this application, or the firm's trusted identity provider. A source, never a person or a proof.\n   */\n  serviceProviderFactorSource: z.enum(FactorSatisfactionSource).optional(),\n\n  // Source\n  sourceService: z.string(),\n  sourceVersion: z.string(),\n  sourceEnvironment: z.string(),\n\n  // Auth-specific context (when applicable)\n  authMethod: z.string().optional(),\n  authSource: z.string().optional(),\n  providerRef: z.string().optional(),\n  /**\n   * The CONNECTION a stored provider credential belongs to (#1670), copied from `eventData.connectionRef` on\n   * the credential lifecycle events. Beside `providerRef` because the two differ once several refs of one\n   * vendor share a connection (#1725): the ref says which integration acted, the connection which grant.\n   */\n  connectionRef: z.string().optional(),\n  connectionType: z.string().optional(),\n  ipAddress: z.string().optional(),\n  userAgent: z.string().optional(),\n  geoLocation: z.object({\n    country: z.string().optional(),\n    city: z.string().optional(),\n  }).optional(),\n\n  // Event-specific data\n  eventData: z.record(z.string(), z.any()),\n\n  // Outcome\n  outcome: z.enum(AuditEventOutcome),\n  outcomeReason: z.string().optional(),\n});\n\nexport type SecurityAuditEventEnvelope = z.infer<typeof SecurityAuditEventEnvelopeSchema>;\n\n/** ──────────────────────────────────────────────────────────────\n * Event Classification Map\n * \n * Maps each CoreAuditableEventType to its category and severity.\n * Used by the dispatcher to classify events for SIEM filtering.\n * ────────────────────────────────────────────────────────────── */\n\nexport interface AuditEventClassification {\n  category: AuditEventCategory;\n  severity: AuditEventSeverity;\n}\n\n/**\n * Every core auditable event's SIEM category and severity.\n *\n * **Total over `CoreAuditableEventType` on purpose.** It was `Record<string, …>`, which let two\n * emitted event types — `SYSTEM_CONTEXT_READ` and `SYSTEM_CONTEXT_WRITE` — carry no entry at all\n * while the lookup's own JSDoc claimed \"all CoreAuditableEventType values are mapped\". They silently\n * took the fallback below, and because the fallback is one value, the WRITE inherited the READ's\n * classification: the two events exist separately precisely because \"a MUTATION under an ACL bypass is\n * more sensitive than a read\", and the classification erased that. A new core event type is now a\n * compile error rather than a silent `DATA_ACCESS`/`INFO`.\n *\n * The lookup still tolerates unknown strings, because applications may define their own event types —\n * the fallback covers THOSE, which is what it was for.\n */\nexport const AUDIT_EVENT_CLASSIFICATION_MAP: Record<CoreAuditableEventType, AuditEventClassification> = {\n  // Authentication Events\n  [CoreAuditableEventType.USER_LOGIN]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_LOGOUT]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_LOGIN_FAILED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.USER_ACCOUNT_LOCKED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.CRITICAL },\n  [CoreAuditableEventType.MACHINE_AUTH_SUCCESS]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.MACHINE_AUTH_FAILED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n  // Machine RESOURCE-ACCESS (token-USE): an authorized, expected per-request access to an A2A/MCP\n  // surface — DATA_ACCESS/INFO, mirroring FIELD_ACCESS. The security signal is the volume/pattern a\n  // SIEM derives from this stream, not any single row.\n  [CoreAuditableEventType.MACHINE_ACCESS]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_PASSWORD_CHANGED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.USER_MFA_ENABLED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.USER_MFA_DISABLED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.USER_SESSION_EXPIRED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  /*\n   * WARNING, not INFO, and the asymmetry with USER_SESSION_EXPIRED above is the point. An expiry is\n   * routine. An eviction means a live chain was displaced — which is either a user on more devices\n   * than the cap allows, or the cap doing the job it exists for and pushing a stolen chain out. A\n   * reviewer needs to see the second, and INFO is the level nobody reads.\n   */\n  [CoreAuditableEventType.USER_SESSION_EVICTED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n\n  // SSO Authentication Events\n  [CoreAuditableEventType.USER_SSO_LOGIN]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_SSO_LOGIN_FAILED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.USER_SSO_ENFORCEMENT_BLOCKED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.CRITICAL },\n  [CoreAuditableEventType.USER_TOKEN_REFRESHED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n\n  // Emergency Access Events\n  [CoreAuditableEventType.EMERGENCY_ACCESS_USED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.CRITICAL },\n\n  // User Lifecycle Events\n  [CoreAuditableEventType.USER_CREATED]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_UPDATED]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_DELETED]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.INFO },\n\n  // Application-Role Administration — AUTHORIZATION (not USER_LIFECYCLE): the event is an\n  // access-control decision, and an org SIEM filtering on the authorization category must see\n  // application-role grants alongside `ORGANIZATION_MEMBER_ROLE_CHANGED`. Same WARNING severity as\n  // that event for the same reason — a privilege change is never routine INFO traffic.\n  [CoreAuditableEventType.USER_APP_ROLES_CHANGED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n\n  // The application has NO usable super-administrator. CRITICAL rather than WARNING: unlike a role\n  // change (a decision someone made, which an auditor reviews), this is a state nobody can undo from\n  // inside the product — every recovery door is gated on the very role that is missing. AUTHORIZATION\n  // because it is the absence of an authorization principal, not a user-lifecycle transition.\n  [CoreAuditableEventType.APPLICATION_SUPER_ADMIN_FLOOR_BREACHED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.CRITICAL },\n  [CoreAuditableEventType.ORGANIZATION_OWNER_FLOOR_BREACHED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.CRITICAL },\n\n  // Organization Lifecycle Events\n  [CoreAuditableEventType.ORGANIZATION_CREATED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.ORGANIZATION_UPDATED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },\n  // WARNING, not INFO: the assignment decides which authentication policy a tenant's members meet, and nobody made it.\n  [CoreAuditableEventType.ORGANIZATION_TYPE_ASSIGNED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.ORGANIZATION_DELETED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.ORGANIZATION_DELETION_REQUESTED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.ORGANIZATION_RESTORED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.ORGANIZATION_SUSPENDED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.ORGANIZATION_ACTIVATED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },\n  // WARNING rather than INFO: the event covers BOTH directions, and the restricting direction\n  // (suspend / deactivate) is what an access review is looking for. Grading the pair by its\n  // less-serious half would bury suspensions among routine noise; the payload carries\n  // `previousStatus` → `newStatus`, so a consumer that wants only lifts can still filter.\n  // `USER_LIFECYCLE`, not `AUTHORIZATION`: the event records what CHANGED (a subject's lifecycle\n  // status) rather than its consequence. Every subject it covers — a user row, a membership row —\n  // is a person's participation in the product, and grading it by consequence would scatter it\n  // among role grants that answer a different question.\n  [CoreAuditableEventType.RESOURCE_STATUS_TRANSITION_PERFORMED]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.WARNING },\n\n  // Organization Member Events\n  [CoreAuditableEventType.ORGANIZATION_MEMBER_INVITED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.ORGANIZATION_MEMBER_JOINED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.ORGANIZATION_MEMBER_UPDATED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.ORGANIZATION_MEMBER_ROLE_CHANGED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.ORGANIZATION_MEMBER_STATUS_CHANGED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.ORGANIZATION_MEMBER_REMOVED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n\n  // Organization Config Events\n  [CoreAuditableEventType.ORGANIZATION_NOTIFICATIONS_UPDATED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.ORGANIZATION_PREFERENCES_UPDATED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.ORGANIZATION_PROFILE_UPDATED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.ORGANIZATION_UNIT_UPDATED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },\n\n  // Per-unit role assignment — AUTHORIZATION (not ORG_MANAGEMENT, unlike its ORGANIZATION_UNIT_UPDATED\n  // neighbour): the unit's own record-keeping confers nothing, whereas `OrganizationUnitMember.role`\n  // is read back into `initiatorRoles` as a unit-narrowed grant. Narrower blast radius than\n  // ORGANIZATION_MEMBER_ROLE_CHANGED, but the same KIND of decision, so it carries the same category\n  // and severity — an org SIEM filtering on authorization must see both.\n  [CoreAuditableEventType.ORGANIZATION_UNIT_MEMBER_ROLE_CHANGED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n\n  // Revocation of a unit assignment. AUTHORIZATION deliberately, where the ORGANIZATION_MEMBER_REMOVED\n  // above is ORG_MANAGEMENT: removing a MEMBER is a directory action whose authority loss is a\n  // side effect, whereas an assignment row exists ONLY to confer a role — deleting it IS the\n  // revocation. Same category and severity as the grant it closes, so an authorization-filtered\n  // trail never shows unit privileges granted and never removed.\n  [CoreAuditableEventType.ORGANIZATION_UNIT_MEMBER_REMOVED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n\n  // Organization Security Management Events\n  [CoreAuditableEventType.ORGANIZATION_SSO_CONFIGURATION_CHANGED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.ORGANIZATION_SIEM_EXPORT_CONFIGURED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },\n  // The two changes to security-event export that a defender must see (#986), as their own KINDS\n  // because this map is the only severity the SIEM ever reads — the row's `riskLevel` (HIGH for both)\n  // is not on the envelope. Turning export OFF is the change an attacker who reached the tenant's\n  // administration most wants unseen: CRITICAL, above any severity minimum an organization can set.\n  // Re-pointing the destination diverts the trail: WARNING. Both stay ORG_MANAGEMENT — the same\n  // category the enable / edit event carries, so a category filter that admits one admits all three.\n  [CoreAuditableEventType.ORGANIZATION_SIEM_EXPORT_DISABLED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.CRITICAL },\n  [CoreAuditableEventType.ORGANIZATION_SIEM_EXPORT_DESTINATION_CHANGED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n\n  // Organization provider credentials — an organization's own authority toward a third party.\n  //\n  // ORG_MANAGEMENT, not AUTHORIZATION: the AUTHORIZATION category is about what a principal may do\n  // INSIDE this application, and these events are about what the application may do OUTSIDE it as\n  // the tenant. Filing them under authorization would put them in the same SIEM bucket as role\n  // grants, where a reviewer looking for outbound authority would never think to look.\n  //\n  // WARNING on the three lifecycle verbs, mirroring the SSO-configuration sibling: each one MOVES\n  // the authority the application holds toward a third party, and a tenant's credentials changing\n  // outside a change window is the shape of a compromise.\n  [CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_SET]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_ROTATED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  // INFO, and deliberately so despite being the security-relevant one. A use event fires on every\n  // outbound provider call, so WARNING here would flood the channel and train an operator to filter\n  // the whole category out — taking the two verbs above with it. The signal a reviewer wants from\n  // this stream is the PATTERN (which tenant spends which provider, how often, and whether it\n  // resolved from its own credential or fell back to the deployment's), which INFO preserves.\n  [CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_USED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_DELETED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n\n  // A person's own credential. USER_LIFECYCLE rather than ORG_MANAGEMENT, by the same reading that\n  // put the tenant's in ORG_MANAGEMENT: a stored third-party credential is a setting on the account\n  // that owns it, and here that account is a person. Filing these under the tenant's category would\n  // put a person's connections into the view an administrator reads as \"what my organization did\",\n  // which is both the wrong subject and, for a personal vendor account, the wrong audience.\n  //\n  // Severities mirror the organization's exactly and for the same reasons — INFO on the high-volume\n  // spend so the pattern survives without flooding, WARNING on removal because a credential\n  // disappearing is how an integration stops working and the first question is always whether a\n  // human did it.\n  [CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_SET]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_ROTATED]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_USED]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_DELETED]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.WARNING },\n\n  // A delegated authorization being GRANTED. Each mirrors its OWN `_SET` sibling rather than taking\n  // one rule for both, because the two families are already classified differently and deliberately:\n  // a tenant's credential arriving is ORG_MANAGEMENT/WARNING — a shared integration changing under\n  // every member of that tenant — while a person's is USER_LIFECYCLE/INFO, one individual's own\n  // account. A grant carries exactly the same consequence as the set it accompanies, so it inherits\n  // the same reading; what makes it worth having is its payload, not its severity.\n  [CoreAuditableEventType.ORGANIZATION_PROVIDER_CONNECTION_GRANTED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.USER_PROVIDER_CONNECTION_GRANTED]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.INFO },\n\n  // Application Security Configuration Events\n  // WARNING mirrors the SSO-configuration-changed sibling: a change to the authentication assurance\n  // posture (MFA / password / lockout) is more than record-keeping (INFO) yet is not an active\n  // breach (ERROR). Category ORG_MANAGEMENT keeps it in the same security-configuration cluster a\n  // reviewer already queries for SSO/SIEM/SCIM configuration changes.\n  [CoreAuditableEventType.APPLICATION_AUTH_POLICY_CHANGED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  // Routine and hourly: INFO. A failed run is marked by the row's HIGH `riskLevel`, since severity is fixed per type.\n  [CoreAuditableEventType.RETENTION_ENFORCEMENT_RECORDED]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.INFO },\n\n  // Outbound M2M Webhook Events\n  // WARNING rather than INFO, and the choice is externally grounded rather than taste — it was\n  // challenged on the reasonable objection that every LEGITIMATE connectivity test then emits a\n  // warning-level row.\n  //\n  // NIST SP 800-53 does not settle it directly: AU-6 treats what counts as \"inappropriate or\n  // unusual activity\" as an explicit ORGANIZATION-DEFINED assignment and prescribes no INFO /\n  // WARNING / CRITICAL vocabulary at all, so no NIST rule is broken in either direction. What NIST\n  // does settle is the REMEDY for noise: AU-6(1) automated review integration, AU-6(3) correlation\n  // across repositories, and supplemental guidance letting organizations tune review \"frequency,\n  // scope, and/or depth\". Volume is answered by correlating and tuning REVIEW — never by demoting\n  // the record itself, which would destroy the signal rather than manage it.\n  //\n  // OWASP's Logging Vocabulary Cheat Sheet is the concrete industry answer and puts this at WARN:\n  // successful, authorized ADMINISTRATIVE operations sit at WARN (`user_created`, `user_updated`,\n  // `sys_startup` / `sys_shutdown` / `sys_restart`), while INFO is reserved for routine end-user\n  // activity (`authn_login_success`, `session_created`, a user's own `authn_password_change`). The\n  // rationale is that administrative operations are high-risk and abuse-prone regardless of whether\n  // any single instance succeeded. `testEndpoint` is precisely that shape — admin-gated, and it\n  // makes the SYSTEM open an outbound connection to an operator-supplied URL — so it belongs beside\n  // the `sys_*` state changes, not beside a user login. (OWASP likewise grades\n  // `excess_rate_limit_exceeded` at WARN, which is this operation's own refusal mode.)\n  //\n  // The load-bearing property: a burst of probes across many hosts is the shape of egress\n  // reconnaissance, and that pattern is only visible if the individual rows are not filtered out by\n  // default. If a deployment finds the volume genuinely noisy, tune the SIEM's review per AU-6 —\n  // do not silently downgrade this to INFO.\n  [CoreAuditableEventType.WEBHOOK_ENDPOINT_TEST_DISPATCHED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  // Inbound deliveries (#1596) — data entering through the API. A refusal, an unroutable message, a failed\n  // attempt, a dead delivery and a replay are WARNING: each is something an operator may have to act on.\n  // DEAD is not CRITICAL: nothing is compromised, and CRITICAL is the paging floor.\n  [CoreAuditableEventType.INBOUND_DELIVERY_REJECTED]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.INBOUND_DELIVERY_ACCEPTED]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.INBOUND_DELIVERY_UNROUTABLE]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.INBOUND_DELIVERY_PROCESSED]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.INBOUND_DELIVERY_FAILED]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.INBOUND_DELIVERY_DEAD]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.INBOUND_DELIVERY_REPLAYED]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.WARNING },\n  // Inbound channels (#1630). A below-assurance message and a token presented by the wrong sender are WARNING —\n  // each can be the first sign of a spoofed or leaked address; a revocation and a sent reply are routine.\n  [CoreAuditableEventType.INBOUND_DELIVERY_BELOW_ASSURANCE]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.INBOUND_REPLY_SENT]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.INBOUND_REPLY_FAILED]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.INBOUND_REPLY_TOKEN_REVOKED]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.INBOUND_REPLY_TOKEN_DOWNGRADED]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.WARNING },\n  // #1600: a domain decides where a tenant's mail goes, so its lifecycle is organization management; losing one\n  // (suspension) and withholding an attachment are what an operator is alerted on.\n  [CoreAuditableEventType.ORGANIZATION_EMAIL_DOMAIN_CLAIMED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.ORGANIZATION_EMAIL_DOMAIN_OWNERSHIP_VERIFIED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.ORGANIZATION_EMAIL_DOMAIN_VERIFIED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.ORGANIZATION_EMAIL_DOMAIN_SUSPENDED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.ORGANIZATION_EMAIL_DOMAIN_REMOVED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.CLIENT_MAILBOX_CREATED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.CLIENT_MAILBOX_REMOVED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.INBOUND_EMAIL_ATTACHMENT_WITHHELD]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.INBOUND_EMAIL_REJECTED_LIMIT]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.WARNING },\n\n  // SCIM Directory Provisioning Events\n  [CoreAuditableEventType.SCIM_TOKEN_CREATED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.SCIM_TOKEN_REVOKED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.SCIM_USER_PROVISIONED]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.SCIM_USER_UPDATED]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.SCIM_USER_DEACTIVATED]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.WARNING },\n\n  // Password Reset Events (H5)\n  [CoreAuditableEventType.USER_PASSWORD_RESET_REQUESTED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_PASSWORD_RESET_COMPLETED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n  // CRITICAL, one step above the self-service arms: an administrator reaching into another\n  // account's credentials is the shape of both a legitimate incident response AND an insider\n  // takeover, so it must page rather than merely accumulate.\n  [CoreAuditableEventType.USER_PASSWORD_RESET_FORCED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.CRITICAL },\n\n  // Registration & Verification Events (H5)\n  [CoreAuditableEventType.USER_REGISTERED]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_EMAIL_VERIFIED]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.GOVERNED_DOCUMENT_INTERACTION_RECORDED]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_VERIFICATION_EMAIL_RESENT]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.INFO },\n\n  // MFA Lifecycle Events (H5)\n  [CoreAuditableEventType.USER_MFA_SETUP_STARTED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_MFA_SETUP_COMPLETED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.USER_MFA_EMAIL_OTP_SENT]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n\n  // WebAuthn/Passkey Events (Phase G1)\n  [CoreAuditableEventType.USER_PASSKEY_REGISTERED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.USER_PASSKEY_AUTHENTICATION_SUCCESS]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_PASSKEY_AUTHENTICATION_FAILURE]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.USER_PASSKEY_REMOVED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n  // CRITICAL, and the only passkey event that is: a verified assertion whose counter regressed means\n  // a private key may exist in two places. Its siblings are routine authentication outcomes.\n  [CoreAuditableEventType.USER_PASSKEY_CLONE_SUSPECTED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.CRITICAL },\n\n  // Magic Link Events (Phase G2)\n  [CoreAuditableEventType.USER_MAGIC_LINK_SENT]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_MAGIC_LINK_VERIFIED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_MAGIC_LINK_FAILED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n\n  // SMS OTP Events (Phase G2)\n  [CoreAuditableEventType.USER_SMS_OTP_SENT]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_SMS_OTP_VERIFIED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_SMS_OTP_FAILED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n\n  // Phone Verification Events (Phase G2)\n  [CoreAuditableEventType.USER_PHONE_VERIFIED]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.USER_PHONE_VERIFICATION_FAILED]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.WARNING },\n\n  // OAuth2 Provider Restriction Events (Phase G3)\n  [CoreAuditableEventType.OAUTH2_PROVIDER_BLOCKED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n  // AUTHENTICATION, not AUTHORIZATION: the demand is about HOW the person proved who they are, and\n  // the refusal happens before any authorization decision exists. WARNING rather than ERROR — a\n  // provider that will not satisfy a step-up demand is a configuration disagreement between two\n  // parties, expected to recur until an operator changes one of them, and an ERROR channel that\n  // fills with it stops being read.\n  [CoreAuditableEventType.OIDC_ACR_DEMAND_UNSATISFIED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n\n  // SCIM Extended Events\n  [CoreAuditableEventType.SCIM_TOKEN_GENERATED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.SCIM_TOKEN_ROTATED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.SCIM_PROVISIONING_CONFIG_UPDATED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.SCIM_PROVISIONING_FAILED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.CRITICAL },\n\n  // SAML Authentication Events (AUTH-2, D19.4)\n  [CoreAuditableEventType.SAML_LOGIN_INITIATED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.SAML_LOGIN_SUCCESS]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.SAML_LOGIN_FAILED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.SAML_ASSERTION_REPLAY_DETECTED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.CRITICAL },\n  [CoreAuditableEventType.SAML_CERT_EXPIRING]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.SAML_SLO_INITIATED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.SAML_SLO_COMPLETED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.SAML_METADATA_PARSED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.SAML_EMAIL_CHANGED]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.WARNING },\n\n  // Method Management Events (#13f)\n  [CoreAuditableEventType.USER_PASSWORD_SET]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.USER_TOTP_DISABLED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.USER_IDENTITY_LINK_REMOVED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n\n  // One-Off Session Events (W7.3b)\n  // A file upload grant delegates ONE upload under the minter's authority to whoever holds the link —\n  // an AUTHORIZATION artefact, not an authentication one (nobody logs in with it). Issued is INFO like\n  // every other token mint here; revoked is WARNING for the same reason the one-off revoke below is: an\n  // administrative credential termination is what a reviewer wants to see.\n  [CoreAuditableEventType.FILE_UPLOAD_GRANT_ISSUED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.FILE_UPLOAD_GRANT_REDEEMED]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.FILE_UPLOAD_GRANT_REVOKED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n  // A share link delegates READ of one file to anyone holding it: the same AUTHORIZATION split as the\n  // grants above, INFO to mint and WARNING to terminate.\n  [CoreAuditableEventType.FILE_SHARE_LINK_ISSUED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.FILE_SHARE_LINKS_REVOKED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n  /*\n   * DATA_ACCESS for both, and it is the least-wrong of five rather than a good fit (#506). The\n   * category vocabulary has no security-operations member, and the file plane's own precedent splits\n   * the grant events the same way — AUTHORIZATION for issuing and revoking a credential, DATA_ACCESS\n   * for the moment content actually moves. A scan is a conclusion about CONTENT that arrived, so it\n   * belongs on the second side.\n   *\n   * The severities are the substance: an infection is a threat the control CAUGHT (critical, same\n   * argument as a suspected passkey clone), a scan failure is the control not having RUN (warning —\n   * nothing was found and nothing was exposed, because the file fails closed to a non-downloadable\n   * status either way; what is wrong is availability).\n   */\n  [CoreAuditableEventType.FILE_MALWARE_DETECTED]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.CRITICAL },\n  [CoreAuditableEventType.FILE_MALWARE_SCAN_FAILED]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.ONE_OFF_TOKEN_CREATED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.ONE_OFF_TOKEN_EXCHANGED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  // Revocation is an ADMINISTRATIVE credential-termination — a super-admin cancels an un-exchanged\n  // one-off/impersonation token. Per OWASP's Logging Vocabulary, administrative operations are WARNING\n  // even when successful and authorized: a SOC wants one-off-token revocations visible (incident\n  // response, or an abuse burst of cancellations). CREATED/EXCHANGED stay INFO (routine mint/use); the\n  // revoke is the operator intervention, which is the higher-signal row.\n  [CoreAuditableEventType.ONE_OFF_TOKEN_REVOKED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n\n  // Cross-Frontend Handoff Events (cross-app-jwt-propagation Step 2)\n  // Issuance is a credential-minting action (re-issues fresh JWT pair AND a single-use\n  // AUTH_CODE_EXCHANGE token bound to the user). WARNING severity matches other\n  // cross-session credential events (USER_PASSWORD_RESET_COMPLETED, USER_PASSKEY_REGISTERED)\n  // so SOC dashboards flag unusual handoff issuance bursts (e.g. token-issuance abuse).\n  [CoreAuditableEventType.USER_CROSS_FRONTEND_HANDOFF_ISSUED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n\n  // Field Access Events\n  [CoreAuditableEventType.FIELD_ACCESS]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.INFO },\n\n  // Resource-Operation Events — a HIGH/CRITICAL operation took effect on a resource.\n  // AUTHORIZATION rather than DATA_ACCESS: this event exists to evidence that a privileged ACTION\n  // was exercised (role/status/credential/tenant mutations), not that data was read — FIELD_ACCESS\n  // owns the disclosure axis. WARNING rather than INFO because every emission is by construction a\n  // HIGH or CRITICAL verb (or an explicit opt-in), so an INFO floor would hide the whole family\n  // beneath the routine-read noise on a SOC dashboard; and not CRITICAL because these are\n  // AUTHORIZED administrative actions, so reserving CRITICAL for anomalies (binding violations,\n  // token-reuse) keeps that level meaningful.\n  [CoreAuditableEventType.RESOURCE_OPERATION_PERFORMED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n\n  // The REFUSAL twin. AUTHORIZATION for the same reason as the success row — it IS an access-control\n  // decision, just the negative one.\n  //\n  // WARNING, and deliberately NOT graded by the refused operation's `riskLevel`: severity is a pure\n  // function of event type for every other member of this map, AND the SIEM dispatcher re-derives it\n  // from the event type independently (`_passesEventFilter`), so a per-row severity would have to be\n  // threaded through two authorities and would still leave this the only type whose severity is not\n  // a property of its kind. Danger grading rides the row's `riskLevel` field, which is already the\n  // framework's canonical danger axis; burst grading rides `eventData.occurrenceCount`.\n  //\n  // WARNING also matches the AUTHENTICATION twins (USER_LOGIN_FAILED, MACHINE_AUTH_FAILED): a single\n  // refusal is a fail-closed control working correctly, not an incident. CRITICAL stays reserved for\n  // anomalies — and the anomaly here is the PATTERN (many refusals), which a SOC rule builds from\n  // `occurrenceCount` rather than from one row's severity.\n  //\n  // assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT\n  [CoreAuditableEventType.RESOURCE_OPERATION_DENIED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n  // WARNING, not CRITICAL, and the choice is deliberate. A platform operator reaching into a tenant\n  // is SANCTIONED here (see the event's schema JSDoc) — most support work is exactly this — so\n  // CRITICAL would cry wolf on routine activity and train reviewers to filter the category out. The\n  // signal worth escalating on is the `admissionDeclared: false` subset, which a SIEM rule can select\n  // precisely because the field is on the payload.\n  [CoreAuditableEventType.CROSS_TENANT_ADMINISTRATIVE_ACCESS]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n  // INFO, unlike the WARNING sibling above: an application-wide directory read is the sanctioned,\n  // ordinary use of a surface built for it, and grading it WARNING would bury the genuine crossings.\n  // The subset worth escalating is selected on `returnedCount` — an operator paging 40,000 rows is an\n  // export — which is why that field is on the payload rather than inferred from the row count.\n  [CoreAuditableEventType.PLATFORM_DIRECTORY_ACCESS]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.INFO },\n  // WARNING for the same reason as its sibling above: requesting and deciding elevations is routine\n  // operator traffic, and CRITICAL here would train reviewers to filter the category out. The subset\n  // worth escalating is `autoApprovalReason: TENANT_CANNOT_APPROVE`, which a SIEM rule selects on and\n  // which the emitter additionally carries at a higher `riskLevel`.\n  [CoreAuditableEventType.PLATFORM_ACCESS_GRANT_LIFECYCLE]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n  // A hold changes what a tenant's data may become, the way an organization configuration change does (#1634).\n  [CoreAuditableEventType.LEGAL_HOLD_PLACED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  // #1598: linking an aggregate to its invoice decides how long it is kept past its tenant — a record-keeping\n  // decision on the tenant's data, routine billing traffic rather than an anomaly, so INFO.\n  [CoreAuditableEventType.MODEL_COST_AGGREGATE_INVOICE_LINKED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.CORRECTION_CAPTURE_SETTING_CHANGED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.EVALUATION_EXPORT_AUTHORIZATION_CHANGED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.EVALUATION_DATASET_EXPORTED]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.EVALUATION_DATASET_EXPORT_REFUSED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.LEGAL_HOLD_RELEASED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  // AUTHORIZATION / WARNING for all four service-provider events (#1597), matching the grant: each one\n  // changes which people from OUTSIDE an organization can reach it, and a reviewer sweeping for changes\n  // in who can reach what must find them without knowing to look for them.\n  [CoreAuditableEventType.SERVICE_PROVIDER_RELATIONSHIP_LIFECYCLE]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.SERVICE_PROVIDER_MACHINE_CLIENT_ADMISSION_CHANGED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.SERVICE_PROVIDER_EXPERT_ASSIGNED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.SERVICE_PROVIDER_EXPERT_UNASSIGNED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n  // The per-expert approval (#1612) decides whether one more person from outside reaches the client: the same\n  // AUTHORIZATION / WARNING as an assignment, for the same reviewer sweeping for changes in who can reach what.\n  [CoreAuditableEventType.SERVICE_PROVIDER_EXPERT_APPROVAL_REQUESTED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.SERVICE_PROVIDER_EXPERT_APPROVAL_GRANTED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.SERVICE_PROVIDER_EXPERT_APPROVAL_DENIED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n  // Trusting a firm's MFA changes what may satisfy the client's authentication policy for outside staff (#1633): the\n  // same AUTHORIZATION / WARNING a reviewer sweeping for changes in who can reach what already reads.\n  [CoreAuditableEventType.SERVICE_PROVIDER_MFA_TRUST_CHANGED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n  // A factor proven for a client is an authentication outcome, like a step-up (#1633).\n  [CoreAuditableEventType.SERVICE_PROVIDER_CLIENT_AUTHENTICATION_SATISFIED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  // The firm's worker-monitoring decision and the client's disclosure level change who learns what about people's\n  // work (#1632): configuration of an organization, WARNING so a monitoring switch is never routine noise.\n  [CoreAuditableEventType.SERVICE_PROVIDER_ACTIVITY_FEED_DECIDED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.SERVICE_PROVIDER_ACTIVITY_FEED_DISCLOSURE_CHANGED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.SERVICE_PROVIDER_EXPERT_APPROVAL_LAPSED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n  // Delegated administration (#1631) is a privilege change for people outside the organization: AUTHORIZATION, and\n  // CRITICAL — lending administration is the change a reviewer must never miss; the row's `securityCritical` and its\n  // riskLevel say which grants were owner-only.\n  [CoreAuditableEventType.SERVICE_PROVIDER_CAPABILITY_GRANTED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.CRITICAL },\n  [CoreAuditableEventType.SERVICE_PROVIDER_CAPABILITY_REVOKED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n  // AUTHORIZATION / WARNING, matching its grant sibling exactly. The category is not a judgement\n  // call: assigning a partition to a unit decides which members may read a remote company's rows, so\n  // it is an access-control decision whatever it looks like from the configuration side. WARNING\n  // rather than INFO for the same reason the grant carries it — a reviewer sweeping for changes in\n  // who can reach what must find these without knowing to look for them.\n  [CoreAuditableEventType.SYSTEM_OF_RECORD_PARTITION_ASSIGNMENT_LIFECYCLE]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n\n  // Retained-Data (Impersonalization) Access Events\n  // A privileged, human-attributed see-through read over RETAINED (impersonalized) records. WARNING —\n  // elevated vs a normal FIELD_ACCESS/INFO read because it reveals data the retention boundary hides,\n  // so SOC dashboards surface it; but an AUTHORIZED compliance action, not an anomaly ⇒ not CRITICAL.\n  [CoreAuditableEventType.RETAINED_DATA_ACCESS]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.WARNING },\n  // The single most sensitive disclosure the framework performs — everything held about one person,\n  // handed out. Same DATA_ACCESS / WARNING classification as a retained-data see-through: authorized\n  // and expected, but always worth a reviewer's eye.\n  [CoreAuditableEventType.SUBJECT_DATA_EXPORT]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.WARNING },\n  // INFO, with the page-vs-whole-table distinction carried by the per-emission `riskLevel` (LOW/HIGH)\n  // rather than by severity — see AuditableEvent_CollectionDataExport_EventDataSchema. A routine page\n  // download raised to WARNING would train reviewers to skim the channel it shares with real signals.\n  [CoreAuditableEventType.COLLECTION_DATA_EXPORT]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.INFO },\n  // Routine, authorized read-through of an EXTERNAL system's rows — the value is the queryable\n  // trail (who/which provider/which entity/how much), not an alarm. WARNING would put every\n  // ordinary external read beside see-through privileged access and train reviewers to skim.\n  [CoreAuditableEventType.HTTP_API_READ_THROUGH_ACCESS]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.INFO },\n  // A write THROUGH a read-through binding (#1679). INFO like its read twin: an authorized member changing\n  // a row of the company's own ERP is routine, and the value is the queryable trail. What differs per\n  // emission — applied, refused, unknown — rides `eventData.outcome` and the per-emission `riskLevel`;\n  // a static WARNING would put every ordinary remote update beside privileged see-through access.\n  [CoreAuditableEventType.HTTP_API_WRITE_THROUGH]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.INFO },\n  // A declared system-of-record ACTION ran (#1678). DATA_ACCESS/INFO like the write-through row: an authorized member\n  // posting an invoice in the company's own ERP is routine, and the per-emission `riskLevel` carries what differs —\n  // an unknown outcome is HIGH, a performed action MEDIUM.\n  [CoreAuditableEventType.SYSTEM_OF_RECORD_ACTION_EXECUTED]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.INFO },\n  // A declared system-of-record action was REFUSED before sending (#1678): a negative access decision, classified with\n  // PROVIDER_OPERATION_DENIED and RESOURCE_OPERATION_DENIED rather than with the executed row.\n  //\n  // assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT\n  [CoreAuditableEventType.SYSTEM_OF_RECORD_ACTION_REFUSED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n  // #1734 — an operator discarded a pipeline's pass state: administrative, like a platform configuration publication.\n  [CoreAuditableEventType.EXTERNAL_DATA_PIPELINE_RESET]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  // #2039 — an operator's answer about an outbound write: administrative, like the reset beside it.\n  [CoreAuditableEventType.EXTERNAL_DATA_OUTBOUND_UNKNOWN_RESOLVED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  // #1723 — one side's data overwritten by a conflict resolution: data access, and worth a reviewer's look.\n  [CoreAuditableEventType.EXTERNAL_DATA_CONFLICT_RESOLVED]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.WARNING },\n  // The other outbound door: a custom service calling a declared provider operation. Same reading as\n  // the read-through row above — routine, authorized activity whose value is the queryable trail. The\n  // READ/WRITE axis and the failure case ride `classification`, `failureKind` and the per-emission\n  // `riskLevel`; raising the static severity for the write case would raise it for every read too.\n  [CoreAuditableEventType.PROVIDER_OPERATION_CALL]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.INFO },\n  // The browser door REFUSED a provider operation (#367). Classified with `RESOURCE_OPERATION_DENIED`\n  // rather than with the call above, because it records the same kind of thing — a negative access\n  // decision — and not an outbound call: nothing left the process.\n  //\n  // assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT\n  [CoreAuditableEventType.PROVIDER_OPERATION_DENIED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n  // Same classification as its sibling above, for the same reason: routine authorized activity whose\n  // value is the queryable trail rather than an alarm. A refused target rides `failureKind`/`outcome`\n  // on the payload, never the static severity — see the enum member's docstring.\n  [CoreAuditableEventType.MCP_TOOL_CALL]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.PROVIDER_CAPABILITY_CALL]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.INFO },\n  // #1594 — one decision family for both planes. Each row records who may, or did, authorize an agent's\n  // action, so AUTHORIZATION throughout. INFO: an identified person acting within their route is the\n  // system working. The one WARNING is the refusal, because a refused attempt is the evidence a reviewer\n  // looks for. Modified approvals are no longer a separate WARNING type: filter RESOLVED on `outcome`.\n  [CoreAuditableEventType.HUMAN_DECISION_REQUESTED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.HUMAN_DECISION_RESOLVED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.HUMAN_DECISION_REASSIGNED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.HUMAN_DECISION_ESCALATED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.HUMAN_DECISION_CLAIMED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.HUMAN_DECISION_ANSWER_REFUSED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n  // #1628 — a deadline only changes who is asked and who is told, never the outcome, so every row is INFO.\n  // A missed deadline is a service-level fact, not a security warning; WARNING stays for refusals.\n  [CoreAuditableEventType.HUMAN_DECISION_DEADLINE_MISSED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.HUMAN_DECISION_ESCALATION_FIRED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.HUMAN_DECISION_CLOCK_PAUSED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.HUMAN_DECISION_CLOCK_RESUMED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.INFO },\n  // #1611 — a binding grants an agent standing authority to act unattended: AUTHORIZATION at WARNING, as a\n  // machine client's admission into a client organization is. A turn the entry point opens runs under\n  // that authority (INFO); a refused one is evidence of something unexpected (WARNING).\n  [CoreAuditableEventType.AUTONOMOUS_AGENT_BOUND]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.AUTONOMOUS_AGENT_UNBOUND]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.AUTONOMOUS_AGENT_TURN_STARTED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.AUTONOMOUS_AGENT_TURN_REFUSED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n  // The sanctioned mechanics of a data-protection request (D6 stance 6b) — routine, not an alarm.\n  [CoreAuditableEventType.HTTP_API_EXTERNAL_ERASURE]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.INFO },\n  // A deliberate, per-request erasure hole (D6 stance 6c) — the record is the control, so it must\n  // surface in every severity-filtered view an operator actually reads.\n  [CoreAuditableEventType.HTTP_API_NON_ERASURE_ACKNOWLEDGED]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.CRITICAL },\n  // The sanctioned mechanics of a data-protection request; the row's `status` carries whether data stayed live.\n  [CoreAuditableEventType.SUBJECT_ERASURE_RECIPIENT_OUTCOME]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.INFO },\n\n  // OAuth2 / OIDC Provider Events (Wildo AS the authorization server). Delegated-authority grants +\n  // consent decisions are AUTHORIZATION; token lifecycle (refresh/revoke) is AUTHENTICATION. Severity:\n  // a third party gaining/holding user-acting access is WARNING (notable, SOC-dashboard-worthy, but an\n  // authorized/consented action ⇒ not CRITICAL); a cross-user binding violation or refresh-token theft\n  // is CRITICAL; a denial/routine refresh/revoke is INFO.\n  [CoreAuditableEventType.OAUTH_DELEGATED_TOKEN_ISSUED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.OAUTH_CONSENT_GRANTED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.OAUTH_CONSENT_DENIED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.OAUTH_CONSENT_GRANT_PERSISTED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },\n  // WARNING, not INFO: an unauthenticated party created a durable identity. Individually routine\n  // when the feature is enabled, but the SHAPE an operator must be able to alert on is a spike —\n  // which only reads as a spike if each one is above the noise floor.\n  // AUTHENTICATION/WARNING: a refused client identity is an authentication-front event, and the\n  // SSRF variant is an attack rather than a misconfiguration. WARNING keeps a spike visible without\n  // making an ordinary allow-list miss look like an incident.\n  [CoreAuditableEventType.OAUTH_CIMD_CLIENT_REFUSED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.OAUTH_DYNAMIC_CLIENT_REGISTERED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.OAUTH_TOKEN_REFRESHED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.OAUTH_TOKEN_REVOKED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.OAUTH_RP_INITIATED_LOGOUT]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },\n  [CoreAuditableEventType.OAUTH_CODE_EXCHANGE_FAILED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.OAUTH_CONSENT_BINDING_VIOLATION]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.CRITICAL },\n  [CoreAuditableEventType.USER_REFRESH_TOKEN_REUSE_DETECTED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.CRITICAL },\n\n  // System-context (ACL-bypass) trail. Both were UNMAPPED until 2026-08-11 and took the fallback.\n  // The READ keeps exactly what the fallback gave it — its declaration already documented\n  // `DATA_ACCESS`/`INFO` as intended (\"an expected, authorized internal read — not an anomaly\"), so\n  // this only stops that intent depending on a default nobody had noticed it was relying on.\n  [CoreAuditableEventType.SYSTEM_CONTEXT_READ]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.INFO },\n  // The WRITE is raised to WARNING, following `RETAINED_DATA_ACCESS` — the other privileged-access\n  // event in this file — which reasons that an authorized-but-elevated access is WARNING and not\n  // CRITICAL because it is expected rather than anomalous. Category deliberately UNCHANGED: moving it\n  // to AUTHORIZATION would drop it for every tenant whose export filters on categories, which is a\n  // worse failure than an under-graded severity. This is the classification the event's own\n  // declaration asks for and had never received.\n  // Administrative security posture publication remains WARNING even for authorized changes and no-ops.\n  [CoreAuditableEventType.PLATFORM_CONFIGURATION_PUBLICATION]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },\n  [CoreAuditableEventType.SYSTEM_CONTEXT_WRITE]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.WARNING },\n};\n\nconst DEFAULT_AUDIT_EVENT_CLASSIFICATION: AuditEventClassification = { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.INFO };\n\n/**\n * The keys of an application's `auditTrail.applicationEventTypes` that name a FRAMEWORK event type. The engine\n * classifies its own event types and `getAuditEventClassification` ignores a declaration for one, so a non-empty\n * answer is a declaration that would be silently ignored; startup refuses it. Reads the same map the classifier\n * reads first, so the refusal and the precedence cannot disagree about what a framework type is.\n */\nexport function findFrameworkAuditEventTypesDeclaredByApplication(applicationEventTypes: Readonly<Record<string, unknown>> | undefined): string[] {\n  return Object.keys(applicationEventTypes ?? {}).filter((eventType) => Object.hasOwn(AUDIT_EVENT_CLASSIFICATION_MAP, eventType));\n}\n\n/**\n * Look up the classification for an audit event type.\n *\n * Every `CoreAuditableEventType` is mapped — enforced by the map's type, not by this comment, which\n * asserted exactly that while two event types went unmapped for months. An APPLICATION's own event types are\n * ordinary strings the engine cannot enumerate; the application classifies them in\n * `auditTrail.applicationEventTypes`, passed here as `applicationEventTypes`.\n *\n * Order, and it is the contract: the engine's map first, so a declaration can never reclassify a framework event\n * (startup refuses one that names a framework type; this order holds even if that check were bypassed); then the\n * application's declaration; then `data_access` / `info` for a type nobody declared.\n */\nexport function getAuditEventClassification(\n  eventType: string,\n  applicationEventTypes?: Readonly<Record<string, AuditEventClassification>>,\n): AuditEventClassification {\n  // Own properties only, on both maps: `eventType` is an open string, and a plain object answers `toString` or\n  // `constructor` with an inherited function rather than `undefined`.\n  if (Object.hasOwn(AUDIT_EVENT_CLASSIFICATION_MAP, eventType)) return AUDIT_EVENT_CLASSIFICATION_MAP[eventType as CoreAuditableEventType];\n  const declared = applicationEventTypes && Object.hasOwn(applicationEventTypes, eventType) ? applicationEventTypes[eventType] : undefined;\n  return declared ? { category: declared.category, severity: declared.severity } : DEFAULT_AUDIT_EVENT_CLASSIFICATION;\n}\n"]}

package/dist/esm/compliance/data-classification/data-classification.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"data-classification.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/data-classification/data-classification.shared.schemas.ts"],"names":[],"mappings":"AAAA,+HAA+H;AAC/H,oBAAY,6BAA6B;IACvC,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,YAAY,iBAAiB;IAC7B,UAAU,eAAe;CAC1B"}
+{"version":3,"file":"data-classification.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/compliance/data-classification/data-classification.shared.schemas.ts"],"names":[],"mappings":"AAAA,+HAA+H;AAC/H,oBAAY,6BAA6B;IACvC,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,YAAY,iBAAiB;IAC7B,UAAU,eAAe;CAC1B"}

package/dist/esm/compliance/data-classification/data-classification.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"data-classification.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/data-classification/data-classification.shared.schemas.ts"],"names":[],"mappings":"AAAA,+HAA+H;AAC/H,MAAM,CAAN,IAAY,6BAKX;AALD,WAAY,6BAA6B;IACvC,kDAAiB,CAAA;IACjB,sDAAqB,CAAA;IACrB,8DAA6B,CAAA;IAC7B,0DAAyB,CAAA;AAC3B,CAAC,EALW,6BAA6B,KAA7B,6BAA6B,QAKxC","sourcesContent":["/** Generic information-sensitivity vocabulary used independently of any assurance source or application compliance program. */\nexport enum Compliance_DataClassification {\n  PUBLIC = \"public\",\n  INTERNAL = \"internal\",\n  CONFIDENTIAL = \"confidential\",\n  RESTRICTED = \"restricted\",\n}\n"]}
+{"version":3,"file":"data-classification.shared.schemas.js","sourceRoot":"","sources":["../../../../src/compliance/data-classification/data-classification.shared.schemas.ts"],"names":[],"mappings":"AAAA,+HAA+H;AAC/H,MAAM,CAAN,IAAY,6BAKX;AALD,WAAY,6BAA6B;IACvC,kDAAiB,CAAA;IACjB,sDAAqB,CAAA;IACrB,8DAA6B,CAAA;IAC7B,0DAAyB,CAAA;AAC3B,CAAC,EALW,6BAA6B,KAA7B,6BAA6B,QAKxC","sourcesContent":["/** Generic information-sensitivity vocabulary used independently of any assurance source or application compliance program. */\nexport enum Compliance_DataClassification {\n  PUBLIC = \"public\",\n  INTERNAL = \"internal\",\n  CONFIDENTIAL = \"confidential\",\n  RESTRICTED = \"restricted\",\n}\n"]}