@wildo-ai/saas-models 1.1.3 → 1.1.5

package/dist/esm/compliance/audit-trails/audit-export-projection.shared.schemas.js

@@ -0,0 +1,723 @@
+/**
+ * Audit-export projection — what a SIEM destination MAY receive, declared once.
+ *
+ * ## Why this exists at all, and why it is `_core` rather than a SIEM feature
+ *
+ * A tenant sending audit events to a third-party SIEM is sending them to a processor of its own
+ * choosing, in a jurisdiction of its own choosing. Data minimisation is that operator's duty, and
+ * until this contract existed the only place they could discharge it was AT THE RECEIVER — after
+ * the data had already left the building. An export that cannot be trimmed is an export some
+ * customers cannot lawfully switch on.
+ *
+ * The obvious-looking place to put the answer did not exist. The dispatcher assembles the envelope
+ * by hand-picking values off `auditEvent.eventData` (`userEmail: eventData.email`, and its
+ * neighbours), so there was no object to attach a projection to: the contract had to exist FIRST.
+ * Two accepted-and-ignored booleans (`includeRawEventData`, `includeDeviceContext`) had occupied
+ * the space and were removed in `be001548` precisely because a stored flag that changes nothing is
+ * worse than its absence — their own removal note says the capability they named "would be built on
+ * the envelope contract, not on two booleans beside the retry policy". This is that contract.
+ *
+ * ## This is NOT `.isAuditEvidence()`, and the two must never be merged
+ *
+ * `.isAuditEvidence()` decides which FIELD VALUES are copied INTO the immutable audit row. It
+ * answers *what must the application be able to prove to itself*, it is correct as it is, and its
+ * answer is deliberately maximal — the ledger is the evidence.
+ *
+ * This contract answers a different question with a different answer: *what may this application
+ * disclose to a processor of the tenant's choosing*. The two diverge by design. A row the ledger
+ * must retain forever is routinely a row a tenant's DPA forbids exporting, and one decorator
+ * meaning both would force the weaker answer onto the stronger obligation.
+ *
+ * ## Two declarations, and the ORDER between them is the design
+ *
+ * - **The EVENT TYPE declares what MAY leave** ({@link AUDIT_EXPORT_EVENT_DATA_DISCLOSURE}), total
+ *   over `CoreAuditableEventType`, so an event added tomorrow has to answer the question.
+ * - **The DESTINATION narrows it** ({@link AuditExportProjectionDeclaration}), per tenant and per
+ *   agreement, which is what a customer actually negotiates.
+ *
+ * The event-type half is built first and is not optional, because a destination cannot narrow a set
+ * nobody has enumerated: shipping only the destination half would mean the first tenant to
+ * configure one is choosing from an undeclared surface.
+ *
+ * ## The floor cannot be trimmed, and that is structural rather than advisory
+ *
+ * {@link AuditExportDisclosureTier.FLOOR} fields survive whatever a destination declares —
+ * {@link resolveDisclosedEnvelopeFields} unions them in unconditionally, so a declaration of `[]`
+ * still yields a correlatable event. Three independent reasons, and only the first is about
+ * privacy:
+ *
+ *  1. **`eventId` IS the receiver's dedup key** in every wire format (CEF `externalId`, LEEF
+ *     `eventId`, OCSF `metadata.uid`, `json_structured`'s top-level `eventId`), and the DLQ drain
+ *     re-sends a stored envelope. Minimise past it and the feed stops being idempotent against a
+ *     service that retries — a "minimised" export nobody can correlate is not a privacy win, it is
+ *     an unusable feed that still left the building.
+ *  2. **`eventType`, `severity` and `sourceVersion` are CEF/LEEF HEADER slots.** A header field
+ *     cannot be omitted without shifting every field after it, so trimming one does not minimise a
+ *     record — it corrupts it.
+ *  3. **The remaining floor members are the record's own identity** — when, in which tenant, by
+ *     which actor reference, with what outcome. A row that cannot say those things is not a
+ *     shorter audit event; it is not an audit event.
+ *
+ * `sourceEnvironment` is FLOOR and is the one member worth justifying, because it is neither an
+ * identity nor a header slot: it names the deployment environment (`production`), it is not data
+ * about any person, it is REQUIRED on the envelope type, and the CEF contract records it as the
+ * cheapest triage filter a SOC has. Trimming it would cost a receiver real capability and protect
+ * nobody.
+ *
+ * ## Applied ONCE, at the ENQUEUE SEAM — which is what makes every format consistent
+ *
+ * The projection is applied inside `AuditEventDispatcherBackendService.enqueueSiemWebhookDelivery`,
+ * before the F6 HMAC and before the job is enqueued. So the minimised envelope is the ONLY envelope
+ * that exists downstream: it is what is signed, what is queued, what a DLQ row stores, and what a
+ * drain replays.
+ *
+ * **The seam rather than the call site, and the difference is not stylistic.** It landed at the
+ * dispatch call site first, which left that public method able to enqueue an un-minimised envelope
+ * for any producer that found it — the one-of-N shape `invariant-call-site-enumeration.md` exists
+ * for, and live rather than hypothetical, since the batching lane is extending that very seam. The
+ * seam already owned the other two elements of the delivery contract (the HMAC and the batch ref);
+ * the projection is the third.
+ *
+ * Moving it also FIXED the dead-letter retry, which the call-site version could not: a drain
+ * re-enqueues stored bytes with a freshly loaded configuration, so a tenant that narrows its
+ * projection on discovering over-disclosure now has that narrowing reach rows already
+ * dead-lettered. Re-application is safe both ways, because the projection only ever DELETES.
+ *
+ * Four consequences, each of which would have been a separate defect had the projection been
+ * applied per-format instead:
+ *
+ *  - **All four wire formats carry it identically, for free.** Every CEF/LEEF render already guards
+ *    `e.x ? c.pair(...) : undefined` (for the DLQ-replay reason), and every OCSF assignment does the
+ *    same — so a trimmed field emits NO key rather than an empty one. That distinction is not
+ *    cosmetic in CEF: a `csN` slot is emitted as a `csNLabel`/`csN` PAIR, and an empty `cs4=` with
+ *    its label still present would tell a receiver the field exists and is blank. Absent is absent.
+ *  - **The DLQ stores less.** A dead-lettered delivery holds only what the destination was allowed
+ *    to receive, so a queue outage does not park un-minimised personal data.
+ *  - **A retry cannot drift from the attempt it continues** — the same property the single enqueue
+ *    seam already guards.
+ *  - **The HMAC covers the bytes that actually leave.**
+ *
+ * @see `.claude/context/audit-trails.md` — the SIEM wire-format projections this rides on top of.
+ */
+import { z } from 'zod';
+// Side-effect import: this module calls `.systemEnum()` at load, so the decorators must be
+// installed first — never by the importer's luck (#966). A named import used only as a type would
+// be elided and install nothing.
+import '@wildo-ai/zod-decorators';
+import { CoreAuditableEventType } from './auditable-events.shared.schema.js';
+/**
+ * What KIND of thing an envelope field is, for the purpose of deciding whether a destination may
+ * receive it.
+ *
+ * Deliberately a SMALL closed vocabulary rather than per-field switches on the destination. A DPA
+ * is negotiated in these terms — *"we will not send you identifiers of our users"* — and a tenant
+ * choosing from 27 field names would be choosing from an implementation detail that moves. The tiers
+ * are the stable surface; the field-to-tier assignment is the framework's judgement and is
+ * compile-enforced to be total.
+ */
+export var AuditExportDisclosureTier;
+(function (AuditExportDisclosureTier) {
+    /**
+     * Never trimmable, whatever a destination declares. The record's identity, its outcome, its
+     * actor reference, and the header slots the text grammars structurally require. See this module's
+     * header for the three independent reasons.
+     */
+    AuditExportDisclosureTier["FLOOR"] = "floor";
+    /**
+     * Who the person is and where they were — the personal-data surface of the envelope. The tier a
+     * tenant exporting to a processor in another jurisdiction most often wants dropped.
+     */
+    AuditExportDisclosureTier["ATTRIBUTION"] = "attribution";
+    /**
+     * Operational context that is not about a person: which request, which surface, which tenant
+     * label, which authentication mechanism, which identity source.
+     *
+     * Note what is NOT here: `outcomeReason`. It reads like context and is DETAIL, because it is
+     * lifted out of the event's own bag — see that tier's note.
+     */
+    AuditExportDisclosureTier["CONTEXT"] = "context";
+    /**
+     * Content that CAME FROM the per-event `eventData` bag — the bag itself, and any envelope field
+     * the dispatcher lifted out of it. Disclosure is decided a second time by the event type's own
+     * {@link AuditExportEventDataDisclosure}.
+     *
+     * **"Came from the bag" rather than "is the bag", and the difference was a real hole.** The
+     * dispatcher PROMOTES values onto the envelope — `outcomeReason` is
+     * `eventData.failureReason || eventData.reason` — so a promoted field classified by what it looks
+     * like (a short reason string, plausibly CONTEXT) outlives the bag it was copied from.
+     *
+     * **The population is defined by those two keys, because they are the only ones the dispatcher
+     * reads.** Measured over the core vocabulary: **27** event schemas declare a top-level
+     * `failureReason` or `reason` and can therefore put text into `outcomeReason`, and **19** of them
+     * carry the operator-typed `reason` — including every organization-lifecycle event whose
+     * `SUBJECT_DETAIL` classification rests on precisely that free text. A destination that withheld
+     * those bags was still receiving their prose.
+     *
+     * An earlier note said "22 … `reason` or `justification`", which is a real count of a population
+     * this field does not have: `justification` is never read here, so three of those 22 could not
+     * reach `outcomeReason` at all while eight schemas that can (`failureReason` only) were left out.
+     * Both numbers were arithmetically right and the denominator was chosen rather than derived —
+     * `derive-before-you-ask.md` Shape 2, inside the very rationale written to fix a leak.
+     *
+     * The operative rule is the general one: **a field's declared tier must be TRUE of every value it
+     * can carry.** `userEmail` is promoted from the bag too and is ATTRIBUTION, because every value it
+     * can hold is an address — the tier is true of all of them. `outcomeReason` is DETAIL because the
+     * tier CONTEXT was not true of the free-text values it can hold, and nothing narrower than the
+     * bag's own class can separate those from the enum-ish ones.
+     *
+     * So the practical test when adding a promoted field is not "where did it come from" alone — it
+     * is "can this field carry something its tier would be a lie about?". Where the answer is yes and
+     * the value comes from the bag, DETAIL is the only tier that can gate it honestly.
+     */
+    AuditExportDisclosureTier["DETAIL"] = "detail";
+})(AuditExportDisclosureTier || (AuditExportDisclosureTier = {}));
+/**
+ * What an event type's `eventData` bag CONTAINS — the event-type half of the contract.
+ *
+ * The question this answers is narrow on purpose: *does the bag carry content about a person,
+ * beyond the actor reference the envelope already carries?* It is asked of the EVENT TYPE because
+ * that is the only place it can be answered once — the bag is an open record whose shape is decided
+ * by the emitter, so no property of the envelope can decide it.
+ *
+ * Only TWO members, and the binary is the point: a third "it depends" member would be a place to
+ * put the entries nobody wanted to judge, and every entry that landed there would be read as safe.
+ */
+export var AuditExportEventDataDisclosure;
+(function (AuditExportEventDataDisclosure) {
+    /**
+     * The bag carries data ABOUT a person — an email address, an IP, a name, a value they supplied,
+     * or free text somebody wrote which may name anyone.
+     *
+     * **This is the fail-closed answer and the default for anything not verified.** An event wrongly
+     * marked here costs a minimising tenant a bag they could have had; an event wrongly marked
+     * {@link ADMINISTRATIVE} discloses personal data to a destination that asked not to receive it.
+     * The two errors are not symmetric, so the doubt resolves here.
+     */
+    AuditExportEventDataDisclosure["SUBJECT_DETAIL"] = "subject-detail";
+    /**
+     * The bag describes CONFIGURATION or SYSTEM STATE. Any identifier in it is an actor or resource
+     * reference the envelope already implies, and it carries no contact data, no supplied values and
+     * no free text.
+     *
+     * Mark an event here only after READING its `eventData` schema. The set is deliberately small;
+     * growing it is a per-event decision with the schema in front of you, not a sweep.
+     */
+    AuditExportEventDataDisclosure["ADMINISTRATIVE"] = "administrative";
+})(AuditExportEventDataDisclosure || (AuditExportEventDataDisclosure = {}));
+export const AUDIT_EXPORT_FIELD_DISCLOSURE = {
+    // ── FLOOR ────────────────────────────────────────────────────────────────────────────────────
+    /** The receiver's dedup key AND the only handle joining a SIEM record back to its audit row. */
+    eventId: AuditExportDisclosureTier.FLOOR,
+    /** CEF `Device Event Class ID` + `Name`, LEEF `EventID` — header slots in both text grammars. */
+    eventType: AuditExportDisclosureTier.FLOOR,
+    /** What the record IS. A receiver's own category filter is written against it. */
+    eventCategory: AuditExportDisclosureTier.FLOOR,
+    /** CEF's mandatory `agentSeverity` header slot, and what a SOC alerts on. */
+    severity: AuditExportDisclosureTier.FLOOR,
+    /** When. An audit event without a time is not a shorter audit event. */
+    timestamp: AuditExportDisclosureTier.FLOOR,
+    /** Which tenant. Also the scope the feed is routed on, so a record denying it is unreadable. */
+    organizationId: AuditExportDisclosureTier.FLOOR,
+    /**
+     * The ACTOR REFERENCE — an opaque id, never a name or an address. Deliberately FLOOR while
+     * `userEmail` is ATTRIBUTION: an id lets a receiver correlate one actor's events without learning
+     * who they are, which is exactly the trade a minimising tenant is trying to make. Dropping it
+     * would leave a feed in which nothing can be attributed to anything.
+     */
+    userId: AuditExportDisclosureTier.FLOOR,
+    /** Which application emitted it. Required on the envelope and names no person. */
+    sourceService: AuditExportDisclosureTier.FLOOR,
+    /** CEF `Device Version`, LEEF `Product Version` — header slots in both text grammars. */
+    sourceVersion: AuditExportDisclosureTier.FLOOR,
+    /** See the module header: required, impersonal, and the cheapest triage filter a SOC has. */
+    sourceEnvironment: AuditExportDisclosureTier.FLOOR,
+    /** Success or failure. Half of what an audit record is for. */
+    outcome: AuditExportDisclosureTier.FLOOR,
+    // ── ATTRIBUTION ──────────────────────────────────────────────────────────────────────────────
+    /** A person's address. The single field most DPAs name first. */
+    userEmail: AuditExportDisclosureTier.ATTRIBUTION,
+    /** Personal data in its own right, and the field that places a person geographically. */
+    ipAddress: AuditExportDisclosureTier.ATTRIBUTION,
+    /** Device and software fingerprint of a person's client. */
+    userAgent: AuditExportDisclosureTier.ATTRIBUTION,
+    /** Where a person was. */
+    geoLocation: AuditExportDisclosureTier.ATTRIBUTION,
+    /**
+     * A pseudonymous identifier under GDPR Art. 4(5) by its own schema declaration, and the axis that
+     * groups one person ACROSS sessions and logins — which is precisely what makes it more disclosing
+     * than a per-request id, not less.
+     */
+    clientInstanceId: AuditExportDisclosureTier.ATTRIBUTION,
+    // ── CONTEXT ──────────────────────────────────────────────────────────────────────────────────
+    /** Groups the events of one request. About the request, not the person who made it. */
+    correlationId: AuditExportDisclosureTier.CONTEXT,
+    /** Which frontend surface (app / website / docs). */
+    frontendServiceName: AuditExportDisclosureTier.CONTEXT,
+    /** A tenant LABEL. A legal person is not a data subject, but it is still the tenant's to withhold. */
+    organizationName: AuditExportDisclosureTier.CONTEXT,
+    applicationId: AuditExportDisclosureTier.CONTEXT,
+    applicationName: AuditExportDisclosureTier.CONTEXT,
+    /** How the principal authenticated. A mechanism, not an identity. */
+    authMethod: AuditExportDisclosureTier.CONTEXT,
+    /** Which identity source. A configuration reference. */
+    authSource: AuditExportDisclosureTier.CONTEXT,
+    providerRef: AuditExportDisclosureTier.CONTEXT,
+    connectionType: AuditExportDisclosureTier.CONTEXT,
+    // ── DETAIL ───────────────────────────────────────────────────────────────────────────────────
+    /** The open per-event bag. Gated a second time by the event type's own disclosure class. */
+    eventData: AuditExportDisclosureTier.DETAIL,
+    /**
+     * DETAIL, not CONTEXT, because it is not a field of its own — it is a value the dispatcher LIFTED
+     * OUT of the bag (`eventData.failureReason || eventData.reason`), so it travels with the bag it
+     * came from. The operator is `||` rather than `??`, which is not pedantry here: an EMPTY
+     * `failureReason` falls through to `reason`, so an event can reach the free-text branch even when
+     * it declares the enum-ish one.
+     *
+     * It was CONTEXT, classified by its shape: usually an enum-ish failure reason, which reads as
+     * impersonal operational context. That was wrong in the direction that matters. **27** core event
+     * schemas declare a top-level `failureReason` or `reason` — the two keys the dispatcher reads, so
+     * that is the population — and **19** of them carry the operator-typed `reason`: the organization
+     * lifecycle events, `EMERGENCY_ACCESS_USED`, `RETAINED_DATA_ACCESS` (whose `reason` is required
+     * and is the #954 operator justification), `USER_PASSWORD_RESET_FORCED`,
+     * `RESOURCE_OPERATION_PERFORMED`. The organization-lifecycle entries in the event-data map below
+     * give that free text as the WHOLE reason their bags are `SUBJECT_DETAIL`. So the contract
+     * refused those bags and then handed their prose over anyway, through a field labelled context.
+     *
+     * The cost of the correction is real and is the right way round: a tenant that withholds detail
+     * now also loses the ordinary enum-shaped failure reason on, say, `USER_LOGIN_FAILED`. It can get
+     * it back by admitting `DETAIL` with `ADMINISTRATIVE` bags, and a reason it cannot have is one
+     * that may name somebody.
+     */
+    outcomeReason: AuditExportDisclosureTier.DETAIL,
+};
+/**
+ * COMPILE-TIME GUARD, not a runtime value — the constant is never read.
+ *
+ * It fails to typecheck, naming the offending field, if anyone classifies a REQUIRED envelope field
+ * as trimmable. That is the one way this contract could promise a minimisation it cannot perform:
+ * the applier would leave the field in place and a tenant would receive data it declared it would
+ * not. The failure is silent at runtime and total at compile time, which is the right way round.
+ *
+ * If a new required field genuinely must be trimmable, make it optional on the envelope (every
+ * wire-format render already guards for absence, for the DLQ-replay reason) rather than widening
+ * this guard.
+ */
+export const AUDIT_EXPORT_TRIMMABLE_FIELDS_ARE_OMITTABLE = true;
+/**
+ * Every core auditable event's `eventData` disclosure class — the EVENT-TYPE half of the contract.
+ *
+ * **Total over `CoreAuditableEventType`**, so a member added to the vocabulary is a compile error
+ * until its author answers the question. That totality is the whole reason this is a map rather
+ * than a per-destination list: a destination enumerating event types is a hand-kept list against a
+ * vocabulary that moves, and a newly-added event would silently export everything or nothing
+ * depending on which way its default fell.
+ *
+ * **Unverified entries are {@link AuditExportEventDataDisclosure.SUBJECT_DETAIL}, deliberately.**
+ * Only the events below carry `ADMINISTRATIVE`, and each was classified by READING its
+ * `eventData` schema and confirming it holds configuration or counts and no free text. Everything
+ * else takes the fail-closed answer — including events whose bag is very likely harmless — because
+ * the cost of being wrong in that direction is a tenant losing detail it could have had, while the
+ * other direction discloses personal data to a destination that asked not to receive it.
+ *
+ * An application's OWN event types are not in this map and resolve to `SUBJECT_DETAIL` through
+ * {@link resolveEventDataDisclosure}, for the same reason.
+ */
+export const AUDIT_EXPORT_EVENT_DATA_DISCLOSURE = {
+    // ── Authentication ───────────────────────────────────────────────────────────────────────────
+    // Every bag here carries some combination of email, IP, user-agent and session id.
+    [CoreAuditableEventType.USER_LOGIN]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_LOGOUT]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_LOGIN_FAILED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_ACCOUNT_LOCKED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_PASSWORD_CHANGED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_MFA_ENABLED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_MFA_DISABLED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_SESSION_EXPIRED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_SESSION_EVICTED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.MACHINE_AUTH_SUCCESS]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.MACHINE_AUTH_FAILED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.MACHINE_ACCESS]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    // ── User lifecycle ───────────────────────────────────────────────────────────────────────────
+    [CoreAuditableEventType.USER_CREATED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_UPDATED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_DELETED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_APP_ROLES_CHANGED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    /**
+     * VERIFIED ADMINISTRATIVE: counts, the conferring role names, and the statuses that count as
+     * usable. The event is about the APPLICATION having no administrator; it names no person.
+     */
+    [CoreAuditableEventType.APPLICATION_SUPER_ADMIN_FLOOR_BREACHED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    // Its organization twin is NOT administrative: the bag carries `reducedMemberIds` and
+    // `subjectUserId`, which is a list of people rather than the envelope's single actor reference.
+    [CoreAuditableEventType.ORGANIZATION_OWNER_FLOOR_BREACHED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    // ── Organization lifecycle ───────────────────────────────────────────────────────────────────
+    // Read, and NOT administrative — but by THREE different routes, which an earlier version of this
+    // comment flattened into one ("every one of these bags carries an operator-typed `reason`").
+    // Measured, that was false for three of the nine, and a rationale that overstates its own
+    // evidence is the invented-denominator shape `derive-before-you-ask.md` warns about — sitting,
+    // here, inside the justification that a later fix leaned on.
+    //
+    //  - MOST carry an operator-typed `reason` / `justification` / `suspensionReason`: free text that
+    //    may name anybody. `_DELETED`, `_DELETION_REQUESTED`, `_RESTORED`, `_ACTIVATED`,
+    //    `_TYPE_ASSIGNED`, `_SUSPENDED`, `RESOURCE_STATUS_TRANSITION_PERFORMED`.
+    //  - `ORGANIZATION_UPDATED` carries `changes: z.record(z.string(), z.any())` — an OPEN bag, which
+    //    cannot be asserted to hold no data about a person. Same argument that reclassified
+    //    `ORGANIZATION_SSO_CONFIGURATION_CHANGED` below.
+    //  - `ORGANIZATION_CREATED` carries only `name`, `slug` and `createdBy`, and is SUBJECT_DETAIL on
+    //    the fail-closed default alone — no free text, no open bag, simply not verified as safe. That
+    //    is the honest entry, and naming it as such is what stops the next reader assuming the whole
+    //    group was measured.
+    [CoreAuditableEventType.ORGANIZATION_CREATED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.ORGANIZATION_UPDATED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.ORGANIZATION_TYPE_ASSIGNED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.ORGANIZATION_DELETED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.ORGANIZATION_DELETION_REQUESTED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.ORGANIZATION_RESTORED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.ORGANIZATION_SUSPENDED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.ORGANIZATION_ACTIVATED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.RESOURCE_STATUS_TRANSITION_PERFORMED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    // ── Organization membership ──────────────────────────────────────────────────────────────────
+    // Membership bags name the member, the inviter and the roles — people, throughout.
+    [CoreAuditableEventType.ORGANIZATION_MEMBER_INVITED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.ORGANIZATION_MEMBER_JOINED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.ORGANIZATION_MEMBER_UPDATED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.ORGANIZATION_MEMBER_ROLE_CHANGED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.ORGANIZATION_MEMBER_STATUS_CHANGED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.ORGANIZATION_MEMBER_REMOVED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.ORGANIZATION_NOTIFICATIONS_UPDATED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.ORGANIZATION_PREFERENCES_UPDATED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.ORGANIZATION_PROFILE_UPDATED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.ORGANIZATION_UNIT_UPDATED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.ORGANIZATION_UNIT_MEMBER_ROLE_CHANGED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.ORGANIZATION_UNIT_MEMBER_REMOVED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    // ── SSO authentication ───────────────────────────────────────────────────────────────────────
+    [CoreAuditableEventType.USER_SSO_LOGIN]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_SSO_LOGIN_FAILED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_SSO_ENFORCEMENT_BLOCKED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_TOKEN_REFRESHED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    // ── Organization security configuration ──────────────────────────────────────────────────────
+    /**
+     * SUBJECT_DETAIL, and it was ADMINISTRATIVE for one review cycle on the stated grounds "a config
+     * diff, its change type and the provider ref. No free text." The diff is
+     * `changes: z.record(z.string(), z.any())` — an UNBOUNDED OPEN BAG, which cannot be asserted to
+     * hold no data about a person whatever it happens to contain today. The same source file names
+     * that exact shape as the one an audit payload must not have.
+     *
+     * The reclassification costs nothing measurable and is worth reading as a warning: the event has
+     * **no emitter anywhere in production source** (its emit method was removed in #591), so the
+     * "verification" behind the original entry was a reading of a schema that nothing populates. An
+     * open record is unverifiable by construction — fail closed and say so.
+     */
+    [CoreAuditableEventType.ORGANIZATION_SSO_CONFIGURATION_CHANGED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    /**
+     * VERIFIED ADMINISTRATIVE: the three SIEM-export change events carry the tenant, the actor
+     * reference, the change type, the destination's DOMAIN (never the full URL, never the
+     * credential), the configured format and the names of the changed fields. Configuration
+     * throughout, and no free text.
+     *
+     * They are also the events a retired destination receives as its LAST event (#986), so a
+     * minimising tenant keeping them is exactly the intended outcome.
+     */
+    [CoreAuditableEventType.ORGANIZATION_SIEM_EXPORT_CONFIGURED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    [CoreAuditableEventType.ORGANIZATION_SIEM_EXPORT_DISABLED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    [CoreAuditableEventType.ORGANIZATION_SIEM_EXPORT_DESTINATION_CHANGED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    // ── Provider credentials and connections ─────────────────────────────────────────────────────
+    // No payload here carries a credential VALUE — that is structural. But the user-scoped half names
+    // a person's relationship with a named vendor, and the organization-scoped half carries the
+    // account and scopes a principal authorized, so both are subject detail.
+    [CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_SET]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_ROTATED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_USED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_DELETED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_SET]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_ROTATED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_USED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_DELETED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.ORGANIZATION_PROVIDER_CONNECTION_GRANTED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_PROVIDER_CONNECTION_GRANTED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    // ── Application security configuration ───────────────────────────────────────────────────────
+    /**
+     * VERIFIED ADMINISTRATIVE: the changed user types, a snapshot digest, and the before/after policy
+     * blocks. Authored configuration with no human actor at all — the event is emitted at boot.
+     */
+    [CoreAuditableEventType.APPLICATION_AUTH_POLICY_CHANGED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    // ── Outbound webhook ─────────────────────────────────────────────────────────────────────────
+    /**
+     * VERIFIED ADMINISTRATIVE: the dispatching actor reference, the endpoint id, the destination
+     * HOST, the outcome and a duration. An operator-supplied URL is configuration, not a person.
+     */
+    [CoreAuditableEventType.WEBHOOK_ENDPOINT_TEST_DISPATCHED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    // ── SCIM directory provisioning ──────────────────────────────────────────────────────────────
+    // Provisioning is ABOUT people by definition; the token events ride the same lane and are not
+    // separately verified.
+    [CoreAuditableEventType.SCIM_TOKEN_CREATED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.SCIM_TOKEN_REVOKED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.SCIM_TOKEN_GENERATED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.SCIM_TOKEN_ROTATED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.SCIM_PROVISIONING_CONFIG_UPDATED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.SCIM_PROVISIONING_FAILED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.SCIM_USER_PROVISIONED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.SCIM_USER_UPDATED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.SCIM_USER_DEACTIVATED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    // ── Credential and factor lifecycle ──────────────────────────────────────────────────────────
+    // Every bag names the person whose credential or factor moved.
+    [CoreAuditableEventType.USER_PASSWORD_RESET_REQUESTED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_PASSWORD_RESET_COMPLETED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_PASSWORD_RESET_FORCED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_REGISTERED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_EMAIL_VERIFIED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_VERIFICATION_EMAIL_RESENT]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_PASSWORD_SET]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_TOTP_DISABLED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_IDENTITY_LINK_REMOVED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_MFA_SETUP_STARTED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_MFA_SETUP_COMPLETED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_MFA_EMAIL_OTP_SENT]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_PASSKEY_REGISTERED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_PASSKEY_AUTHENTICATION_SUCCESS]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_PASSKEY_AUTHENTICATION_FAILURE]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_PASSKEY_REMOVED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_PASSKEY_CLONE_SUSPECTED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_MAGIC_LINK_SENT]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_MAGIC_LINK_VERIFIED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_MAGIC_LINK_FAILED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_SMS_OTP_SENT]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_SMS_OTP_VERIFIED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_SMS_OTP_FAILED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_PHONE_VERIFIED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_PHONE_VERIFICATION_FAILED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    // ── SAML ─────────────────────────────────────────────────────────────────────────────────────
+    // None of these has a typed eventData schema, so nothing can be verified about their bags. The
+    // two that LOOK administrative (`SAML_CERT_EXPIRING`, `SAML_METADATA_PARSED`) are exactly the
+    // entries a guess would get wrong, and are fail-closed with the rest.
+    [CoreAuditableEventType.SAML_LOGIN_INITIATED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.SAML_LOGIN_SUCCESS]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.SAML_LOGIN_FAILED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.SAML_ASSERTION_REPLAY_DETECTED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.SAML_CERT_EXPIRING]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.SAML_SLO_INITIATED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.SAML_SLO_COMPLETED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.SAML_METADATA_PARSED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.SAML_EMAIL_CHANGED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    // ── OAuth / OIDC provider ────────────────────────────────────────────────────────────────────
+    [CoreAuditableEventType.OAUTH2_PROVIDER_BLOCKED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.OIDC_ACR_DEMAND_UNSATISFIED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.OAUTH_DELEGATED_TOKEN_ISSUED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.OAUTH_CONSENT_GRANTED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.OAUTH_CONSENT_DENIED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.OAUTH_CONSENT_GRANT_PERSISTED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.OAUTH_DYNAMIC_CLIENT_REGISTERED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.OAUTH_CIMD_CLIENT_REFUSED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.OAUTH_TOKEN_REFRESHED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.OAUTH_TOKEN_REVOKED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.OAUTH_RP_INITIATED_LOGOUT]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.OAUTH_CODE_EXCHANGE_FAILED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.OAUTH_CONSENT_BINDING_VIOLATION]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_REFRESH_TOKEN_REUSE_DETECTED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    // ── Files and one-off tokens ─────────────────────────────────────────────────────────────────
+    [CoreAuditableEventType.FILE_UPLOAD_GRANT_ISSUED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.FILE_UPLOAD_GRANT_REDEEMED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.FILE_UPLOAD_GRANT_REVOKED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.FILE_SHARE_LINK_ISSUED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.FILE_SHARE_LINKS_REVOKED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.FILE_MALWARE_DETECTED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.FILE_MALWARE_SCAN_FAILED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.ONE_OFF_TOKEN_CREATED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.ONE_OFF_TOKEN_EXCHANGED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.ONE_OFF_TOKEN_REVOKED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_CROSS_FRONTEND_HANDOFF_ISSUED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    // ── Access, disclosure and administrative reach ──────────────────────────────────────────────
+    // The generic resource and field events carry whatever the operation touched, including
+    // before/after values of `.isAuditEvidence()` fields — the broadest bags in the vocabulary.
+    [CoreAuditableEventType.EMERGENCY_ACCESS_USED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.FIELD_ACCESS]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.RESOURCE_OPERATION_PERFORMED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.RESOURCE_OPERATION_DENIED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.CROSS_TENANT_ADMINISTRATIVE_ACCESS]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.PLATFORM_ACCESS_GRANT_LIFECYCLE]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.PLATFORM_DIRECTORY_ACCESS]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.SYSTEM_CONTEXT_READ]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.SYSTEM_CONTEXT_WRITE]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.PLATFORM_CONFIGURATION_PUBLICATION]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.RETAINED_DATA_ACCESS]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.GOVERNED_DOCUMENT_INTERACTION_RECORDED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.SUBJECT_DATA_EXPORT]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.COLLECTION_DATA_EXPORT]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    // ── External integration ─────────────────────────────────────────────────────────────────────
+    [CoreAuditableEventType.HTTP_API_READ_THROUGH_ACCESS]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.HTTP_API_EXTERNAL_ERASURE]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.HTTP_API_NON_ERASURE_ACKNOWLEDGED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.PROVIDER_OPERATION_CALL]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.PROVIDER_OPERATION_DENIED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.MCP_TOOL_CALL]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.AGENT_TOOL_APPROVAL_MODIFIED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    /*
+     * Everything else in this bag IS configuration — the transition, the assignment row, the declared
+     * instance, the remote partition key, and the units on either side of the move. On those alone it
+     * would be ADMINISTRATIVE.
+     *
+     * `justification` decides it. The operator's stated reason is FREE TEXT a person wrote, recorded on
+     * every transition, and free text may name anyone — which is this vocabulary's own criterion for
+     * SUBJECT_DETAIL rather than a cautious reading of it. `assignedByUserId` is only the actor the
+     * envelope already implies and would not have been enough on its own.
+     */
+    [CoreAuditableEventType.SYSTEM_OF_RECORD_PARTITION_ASSIGNMENT_LIFECYCLE]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+};
+/**
+ * What one DESTINATION has declared it may receive — the per-tenant, per-agreement half.
+ *
+ * Two arrays rather than one, and the interaction between them is the reason. A tenant that drops
+ * {@link AuditExportDisclosureTier.ATTRIBUTION} while keeping the detail bag would still receive
+ * the email address inside `eventData` for every authentication event — a minimisation that reads
+ * as a control and is not one. {@link disclosedEventDataClasses} is what closes that: declaring
+ * `[ADMINISTRATIVE]` keeps the bags that carry configuration and drops the ones that carry people.
+ */
+/*
+ * Both members declare `.systemEnum(...)` ON THE ELEMENT, which is where the decorator goes for an
+ * array of enums (`organizationPreferences.supportedLanguages` is the precedent).
+ *
+ * Without it these two vocabularies would get words authored per FIELD PATH rather than once per
+ * enum, and a reader of the SIEM pane would be choosing between raw wire values like
+ * `subject-detail` — see `.claude/rules/display-text-comes-from-i18n.md`. A new closed vocabulary
+ * reaching a UI is exactly the moment to declare it; the words themselves are authored by the
+ * labelling pipeline under `system_enums.<Name>.<value>` and are never hand-written here.
+ */
+export const SiemExportProjectionDeclarationSchema = z.object({
+    /**
+     * Which tiers, beyond the floor, this destination may receive.
+     *
+     * **`FLOOR` is not a choice, so it is not offered.** The floor is added unconditionally by
+     * {@link resolveDisclosedEnvelopeFields}, and declaring `[]` yields a floor-only feed rather than
+     * an empty one.
+     *
+     * This used to accept the whole vocabulary, on the reasoning that declaring `FLOOR` was
+     * "redundant rather than wrong". That was true of the API and false of the SCREEN: the settings
+     * pane renders one checkbox per member, so it offered a `floor` toggle — and on every destination
+     * that had not ticked it, displayed it UNCHECKED. An operator reading "floor ☐" believes the event
+     * id, type, timestamp and user id are withheld, and none of them is. That is the exact shape this
+     * contract exists to remove — a control that renders and does nothing — and it was found by
+     * opening the pane in a browser, not by any test (#1395).
+     *
+     * Derived from the one named vocabulary with `.exclude(['FLOOR'])` rather than declared as a
+     * second enum: the tiers a destination may choose are a SUBSET of the tiers a field may have, and
+     * a parallel list would be a second copy to keep in step. The key is type-checked against the
+     * enum, so renaming the member is a compile error here rather than a silent drift.
+     *
+     * Defaults to everything: a destination that has declared no minimisation has not asked for one,
+     * and silently narrowing an existing tenant's feed would be a worse failure than not narrowing a
+     * new one.
+     */
+    disclosedTiers: z.array(z.enum(AuditExportDisclosureTier).exclude(['FLOOR']).systemEnum('AuditExportDisclosureTier')).default([
+        AuditExportDisclosureTier.ATTRIBUTION,
+        AuditExportDisclosureTier.CONTEXT,
+        AuditExportDisclosureTier.DETAIL,
+    ]),
+    /**
+     * Which `eventData` bags this destination may receive, by the EVENT TYPE's declared class. Read
+     * only when {@link AuditExportDisclosureTier.DETAIL} is disclosed; an event type outside the core
+     * vocabulary resolves to `SUBJECT_DETAIL`.
+     */
+    disclosedEventDataClasses: z.array(z.enum(AuditExportEventDataDisclosure).systemEnum('AuditExportEventDataDisclosure')).default([
+        AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+        AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    ]),
+});
+/**
+ * The projection a destination that has declared nothing receives: everything.
+ *
+ * FAIL-OPEN, deliberately, and it is the one place in this contract where that is right. An absent
+ * declaration is not a tenant asking for minimisation — it is a tenant that has not configured one,
+ * and every existing destination is in that state. Failing closed here would silently stop
+ * delivering fields to feeds that are working today, which is a bigger and quieter harm than
+ * continuing the current behaviour until an operator narrows it deliberately.
+ */
+export const FULL_AUDIT_EXPORT_PROJECTION = {
+    disclosedTiers: [
+        AuditExportDisclosureTier.ATTRIBUTION,
+        AuditExportDisclosureTier.CONTEXT,
+        AuditExportDisclosureTier.DETAIL,
+    ],
+    disclosedEventDataClasses: [
+        AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+        AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    ],
+};
+/**
+ * What an event type's `eventData` bag carries, including for event types an APPLICATION defined.
+ *
+ * An unknown type resolves to {@link AuditExportEventDataDisclosure.SUBJECT_DETAIL} — the opposite
+ * direction from `getAuditEventClassification`, whose fallback exists to give an application event
+ * a usable category. Here the fallback decides a DISCLOSURE, so it takes the safe answer: an
+ * application's own bag is the one this framework knows least about.
+ */
+export function resolveEventDataDisclosure(eventType) {
+    return (AUDIT_EXPORT_EVENT_DATA_DISCLOSURE[eventType]
+        ?? AuditExportEventDataDisclosure.SUBJECT_DETAIL);
+}
+/**
+ * The envelope fields one destination may receive for one event.
+ *
+ * The floor is unioned in unconditionally — **this is where "a floor cannot be trimmed" is
+ * enforced**, not in the applier and not in the schema's defaults, so no declaration a tenant can
+ * write and no future caller can produce a feed without it.
+ *
+ * assurance-control: WILDO.PRIVACY.DATA_MINIMIZATION — the destination's declaration decides which
+ * envelope fields may leave for an external processor, and the floor is the part of that decision
+ * the framework keeps: a record that cannot be correlated or de-duplicated is not a minimised
+ * export.
+ */
+export function resolveDisclosedEnvelopeFields(eventType, declaration) {
+    const disclosedTiers = new Set(declaration.disclosedTiers);
+    const eventDataAdmitted = disclosedTiers.has(AuditExportDisclosureTier.DETAIL)
+        && declaration.disclosedEventDataClasses.includes(resolveEventDataDisclosure(eventType));
+    const disclosed = new Set();
+    for (const [field, tier] of Object.entries(AUDIT_EXPORT_FIELD_DISCLOSURE)) {
+        if (tier === AuditExportDisclosureTier.FLOOR) {
+            disclosed.add(field);
+            continue;
+        }
+        if (tier === AuditExportDisclosureTier.DETAIL) {
+            if (eventDataAdmitted)
+                disclosed.add(field);
+            continue;
+        }
+        if (disclosedTiers.has(tier))
+            disclosed.add(field);
+    }
+    return disclosed;
+}
+/**
+ * Apply a destination's projection to an envelope, returning the envelope that may actually leave.
+ *
+ * Returns a NEW object — the caller fans one audit event out to several tenants' sinks, each with
+ * its own declaration, so mutating in place would let the first destination's minimisation reach
+ * the second's delivery.
+ *
+ * **Omitted is not empty**, which the CEF `csN` slots make more than a nicety: a trimmed optional
+ * field is DELETED, so a render that guards `e.x ? … : undefined` emits neither the value nor its
+ * `csNLabel` companion. `eventData` is the one exception — it is required by the envelope type, so
+ * it is emptied to `{}`, which every format already reads as "no detail" (both text grammars omit
+ * their detail key for an empty bag; OCSF omits `unmapped` for the same reason). The compile-time
+ * guard {@link AUDIT_EXPORT_TRIMMABLE_FIELDS_ARE_OMITTABLE} is what keeps that exception the only
+ * one.
+ *
+ * assurance-control: WILDO.PRIVACY.DATA_MINIMIZATION — the act itself: only the fields the
+ * destination's declaration admits survive into the envelope that is signed, queued and delivered
+ * to a third-party processor of the tenant's choosing.
+ */
+export function applyAuditExportProjection(envelope, declaration) {
+    const disclosed = resolveDisclosedEnvelopeFields(envelope.eventType, declaration);
+    const projected = { ...envelope };
+    for (const field of Object.keys(AUDIT_EXPORT_FIELD_DISCLOSURE)) {
+        if (disclosed.has(field))
+            continue;
+        if (field === 'eventData') {
+            projected.eventData = {};
+            continue;
+        }
+        // Every other trimmable field is optional on the envelope — see the compile-time guard above.
+        delete projected[field];
+    }
+    return projected;
+}
+//# sourceMappingURL=audit-export-projection.shared.schemas.js.map