@wildo-ai/saas-models 1.1.4 → 1.1.5

package/dist/esm/compliance/audit-trails/audit-export-projection.shared.schemas.d.ts

@@ -0,0 +1,450 @@
+/**
+ * Audit-export projection — what a SIEM destination MAY receive, declared once.
+ *
+ * ## Why this exists at all, and why it is `_core` rather than a SIEM feature
+ *
+ * A tenant sending audit events to a third-party SIEM is sending them to a processor of its own
+ * choosing, in a jurisdiction of its own choosing. Data minimisation is that operator's duty, and
+ * until this contract existed the only place they could discharge it was AT THE RECEIVER — after
+ * the data had already left the building. An export that cannot be trimmed is an export some
+ * customers cannot lawfully switch on.
+ *
+ * The obvious-looking place to put the answer did not exist. The dispatcher assembles the envelope
+ * by hand-picking values off `auditEvent.eventData` (`userEmail: eventData.email`, and its
+ * neighbours), so there was no object to attach a projection to: the contract had to exist FIRST.
+ * Two accepted-and-ignored booleans (`includeRawEventData`, `includeDeviceContext`) had occupied
+ * the space and were removed in `be001548` precisely because a stored flag that changes nothing is
+ * worse than its absence — their own removal note says the capability they named "would be built on
+ * the envelope contract, not on two booleans beside the retry policy". This is that contract.
+ *
+ * ## This is NOT `.isAuditEvidence()`, and the two must never be merged
+ *
+ * `.isAuditEvidence()` decides which FIELD VALUES are copied INTO the immutable audit row. It
+ * answers *what must the application be able to prove to itself*, it is correct as it is, and its
+ * answer is deliberately maximal — the ledger is the evidence.
+ *
+ * This contract answers a different question with a different answer: *what may this application
+ * disclose to a processor of the tenant's choosing*. The two diverge by design. A row the ledger
+ * must retain forever is routinely a row a tenant's DPA forbids exporting, and one decorator
+ * meaning both would force the weaker answer onto the stronger obligation.
+ *
+ * ## Two declarations, and the ORDER between them is the design
+ *
+ * - **The EVENT TYPE declares what MAY leave** ({@link AUDIT_EXPORT_EVENT_DATA_DISCLOSURE}), total
+ *   over `CoreAuditableEventType`, so an event added tomorrow has to answer the question.
+ * - **The DESTINATION narrows it** ({@link AuditExportProjectionDeclaration}), per tenant and per
+ *   agreement, which is what a customer actually negotiates.
+ *
+ * The event-type half is built first and is not optional, because a destination cannot narrow a set
+ * nobody has enumerated: shipping only the destination half would mean the first tenant to
+ * configure one is choosing from an undeclared surface.
+ *
+ * ## The floor cannot be trimmed, and that is structural rather than advisory
+ *
+ * {@link AuditExportDisclosureTier.FLOOR} fields survive whatever a destination declares —
+ * {@link resolveDisclosedEnvelopeFields} unions them in unconditionally, so a declaration of `[]`
+ * still yields a correlatable event. Three independent reasons, and only the first is about
+ * privacy:
+ *
+ *  1. **`eventId` IS the receiver's dedup key** in every wire format (CEF `externalId`, LEEF
+ *     `eventId`, OCSF `metadata.uid`, `json_structured`'s top-level `eventId`), and the DLQ drain
+ *     re-sends a stored envelope. Minimise past it and the feed stops being idempotent against a
+ *     service that retries — a "minimised" export nobody can correlate is not a privacy win, it is
+ *     an unusable feed that still left the building.
+ *  2. **`eventType`, `severity` and `sourceVersion` are CEF/LEEF HEADER slots.** A header field
+ *     cannot be omitted without shifting every field after it, so trimming one does not minimise a
+ *     record — it corrupts it.
+ *  3. **The remaining floor members are the record's own identity** — when, in which tenant, by
+ *     which actor reference, with what outcome. A row that cannot say those things is not a
+ *     shorter audit event; it is not an audit event.
+ *
+ * `sourceEnvironment` is FLOOR and is the one member worth justifying, because it is neither an
+ * identity nor a header slot: it names the deployment environment (`production`), it is not data
+ * about any person, it is REQUIRED on the envelope type, and the CEF contract records it as the
+ * cheapest triage filter a SOC has. Trimming it would cost a receiver real capability and protect
+ * nobody.
+ *
+ * ## Applied ONCE, at the ENQUEUE SEAM — which is what makes every format consistent
+ *
+ * The projection is applied inside `AuditEventDispatcherBackendService.enqueueSiemWebhookDelivery`,
+ * before the F6 HMAC and before the job is enqueued. So the minimised envelope is the ONLY envelope
+ * that exists downstream: it is what is signed, what is queued, what a DLQ row stores, and what a
+ * drain replays.
+ *
+ * **The seam rather than the call site, and the difference is not stylistic.** It landed at the
+ * dispatch call site first, which left that public method able to enqueue an un-minimised envelope
+ * for any producer that found it — the one-of-N shape `invariant-call-site-enumeration.md` exists
+ * for, and live rather than hypothetical, since the batching lane is extending that very seam. The
+ * seam already owned the other two elements of the delivery contract (the HMAC and the batch ref);
+ * the projection is the third.
+ *
+ * Moving it also FIXED the dead-letter retry, which the call-site version could not: a drain
+ * re-enqueues stored bytes with a freshly loaded configuration, so a tenant that narrows its
+ * projection on discovering over-disclosure now has that narrowing reach rows already
+ * dead-lettered. Re-application is safe both ways, because the projection only ever DELETES.
+ *
+ * Four consequences, each of which would have been a separate defect had the projection been
+ * applied per-format instead:
+ *
+ *  - **All four wire formats carry it identically, for free.** Every CEF/LEEF render already guards
+ *    `e.x ? c.pair(...) : undefined` (for the DLQ-replay reason), and every OCSF assignment does the
+ *    same — so a trimmed field emits NO key rather than an empty one. That distinction is not
+ *    cosmetic in CEF: a `csN` slot is emitted as a `csNLabel`/`csN` PAIR, and an empty `cs4=` with
+ *    its label still present would tell a receiver the field exists and is blank. Absent is absent.
+ *  - **The DLQ stores less.** A dead-lettered delivery holds only what the destination was allowed
+ *    to receive, so a queue outage does not park un-minimised personal data.
+ *  - **A retry cannot drift from the attempt it continues** — the same property the single enqueue
+ *    seam already guards.
+ *  - **The HMAC covers the bytes that actually leave.**
+ *
+ * @see `.claude/context/audit-trails.md` — the SIEM wire-format projections this rides on top of.
+ */
+import { z } from 'zod';
+import '@wildo-ai/zod-decorators';
+import { CoreAuditableEventType } from './auditable-events.shared.schema';
+import type { SecurityAuditEventEnvelope } from './security-audit-event-envelope.shared.schema';
+/**
+ * What KIND of thing an envelope field is, for the purpose of deciding whether a destination may
+ * receive it.
+ *
+ * Deliberately a SMALL closed vocabulary rather than per-field switches on the destination. A DPA
+ * is negotiated in these terms — *"we will not send you identifiers of our users"* — and a tenant
+ * choosing from 27 field names would be choosing from an implementation detail that moves. The tiers
+ * are the stable surface; the field-to-tier assignment is the framework's judgement and is
+ * compile-enforced to be total.
+ */
+export declare enum AuditExportDisclosureTier {
+    /**
+     * Never trimmable, whatever a destination declares. The record's identity, its outcome, its
+     * actor reference, and the header slots the text grammars structurally require. See this module's
+     * header for the three independent reasons.
+     */
+    FLOOR = "floor",
+    /**
+     * Who the person is and where they were — the personal-data surface of the envelope. The tier a
+     * tenant exporting to a processor in another jurisdiction most often wants dropped.
+     */
+    ATTRIBUTION = "attribution",
+    /**
+     * Operational context that is not about a person: which request, which surface, which tenant
+     * label, which authentication mechanism, which identity source.
+     *
+     * Note what is NOT here: `outcomeReason`. It reads like context and is DETAIL, because it is
+     * lifted out of the event's own bag — see that tier's note.
+     */
+    CONTEXT = "context",
+    /**
+     * Content that CAME FROM the per-event `eventData` bag — the bag itself, and any envelope field
+     * the dispatcher lifted out of it. Disclosure is decided a second time by the event type's own
+     * {@link AuditExportEventDataDisclosure}.
+     *
+     * **"Came from the bag" rather than "is the bag", and the difference was a real hole.** The
+     * dispatcher PROMOTES values onto the envelope — `outcomeReason` is
+     * `eventData.failureReason || eventData.reason` — so a promoted field classified by what it looks
+     * like (a short reason string, plausibly CONTEXT) outlives the bag it was copied from.
+     *
+     * **The population is defined by those two keys, because they are the only ones the dispatcher
+     * reads.** Measured over the core vocabulary: **27** event schemas declare a top-level
+     * `failureReason` or `reason` and can therefore put text into `outcomeReason`, and **19** of them
+     * carry the operator-typed `reason` — including every organization-lifecycle event whose
+     * `SUBJECT_DETAIL` classification rests on precisely that free text. A destination that withheld
+     * those bags was still receiving their prose.
+     *
+     * An earlier note said "22 … `reason` or `justification`", which is a real count of a population
+     * this field does not have: `justification` is never read here, so three of those 22 could not
+     * reach `outcomeReason` at all while eight schemas that can (`failureReason` only) were left out.
+     * Both numbers were arithmetically right and the denominator was chosen rather than derived —
+     * `derive-before-you-ask.md` Shape 2, inside the very rationale written to fix a leak.
+     *
+     * The operative rule is the general one: **a field's declared tier must be TRUE of every value it
+     * can carry.** `userEmail` is promoted from the bag too and is ATTRIBUTION, because every value it
+     * can hold is an address — the tier is true of all of them. `outcomeReason` is DETAIL because the
+     * tier CONTEXT was not true of the free-text values it can hold, and nothing narrower than the
+     * bag's own class can separate those from the enum-ish ones.
+     *
+     * So the practical test when adding a promoted field is not "where did it come from" alone — it
+     * is "can this field carry something its tier would be a lie about?". Where the answer is yes and
+     * the value comes from the bag, DETAIL is the only tier that can gate it honestly.
+     */
+    DETAIL = "detail"
+}
+/**
+ * What an event type's `eventData` bag CONTAINS — the event-type half of the contract.
+ *
+ * The question this answers is narrow on purpose: *does the bag carry content about a person,
+ * beyond the actor reference the envelope already carries?* It is asked of the EVENT TYPE because
+ * that is the only place it can be answered once — the bag is an open record whose shape is decided
+ * by the emitter, so no property of the envelope can decide it.
+ *
+ * Only TWO members, and the binary is the point: a third "it depends" member would be a place to
+ * put the entries nobody wanted to judge, and every entry that landed there would be read as safe.
+ */
+export declare enum AuditExportEventDataDisclosure {
+    /**
+     * The bag carries data ABOUT a person — an email address, an IP, a name, a value they supplied,
+     * or free text somebody wrote which may name anyone.
+     *
+     * **This is the fail-closed answer and the default for anything not verified.** An event wrongly
+     * marked here costs a minimising tenant a bag they could have had; an event wrongly marked
+     * {@link ADMINISTRATIVE} discloses personal data to a destination that asked not to receive it.
+     * The two errors are not symmetric, so the doubt resolves here.
+     */
+    SUBJECT_DETAIL = "subject-detail",
+    /**
+     * The bag describes CONFIGURATION or SYSTEM STATE. Any identifier in it is an actor or resource
+     * reference the envelope already implies, and it carries no contact data, no supplied values and
+     * no free text.
+     *
+     * Mark an event here only after READING its `eventData` schema. The set is deliberately small;
+     * growing it is a per-event decision with the schema in front of you, not a sweep.
+     */
+    ADMINISTRATIVE = "administrative"
+}
+/**
+ * Every field of the envelope, assigned a disclosure tier.
+ *
+ * **Total over `Required<SecurityAuditEventEnvelope>` with `-?`**, the same construction the CEF and
+ * LEEF projection contracts use and for the same reason: a field added to the envelope is a COMPILE
+ * ERROR here until someone decides what it is. The alternative — a hand-kept list of sensitive
+ * fields — has no way to say what it left out, and what it leaves out is disclosed.
+ *
+ * Declared as a mapped TYPE rather than a `Record<string, …>` so the keys cannot drift from the
+ * envelope, and `as const satisfies` so the assignments keep their literal types for
+ * {@link AUDIT_EXPORT_TRIMMABLE_FIELDS_ARE_OMITTABLE} below.
+ */
+export type AuditExportFieldDisclosureContract = {
+    readonly [F in keyof Required<SecurityAuditEventEnvelope>]-?: AuditExportDisclosureTier;
+};
+export declare const AUDIT_EXPORT_FIELD_DISCLOSURE: {
+    /** The receiver's dedup key AND the only handle joining a SIEM record back to its audit row. */
+    readonly eventId: AuditExportDisclosureTier.FLOOR;
+    /** CEF `Device Event Class ID` + `Name`, LEEF `EventID` — header slots in both text grammars. */
+    readonly eventType: AuditExportDisclosureTier.FLOOR;
+    /** What the record IS. A receiver's own category filter is written against it. */
+    readonly eventCategory: AuditExportDisclosureTier.FLOOR;
+    /** CEF's mandatory `agentSeverity` header slot, and what a SOC alerts on. */
+    readonly severity: AuditExportDisclosureTier.FLOOR;
+    /** When. An audit event without a time is not a shorter audit event. */
+    readonly timestamp: AuditExportDisclosureTier.FLOOR;
+    /** Which tenant. Also the scope the feed is routed on, so a record denying it is unreadable. */
+    readonly organizationId: AuditExportDisclosureTier.FLOOR;
+    /**
+     * The ACTOR REFERENCE — an opaque id, never a name or an address. Deliberately FLOOR while
+     * `userEmail` is ATTRIBUTION: an id lets a receiver correlate one actor's events without learning
+     * who they are, which is exactly the trade a minimising tenant is trying to make. Dropping it
+     * would leave a feed in which nothing can be attributed to anything.
+     */
+    readonly userId: AuditExportDisclosureTier.FLOOR;
+    /** Which application emitted it. Required on the envelope and names no person. */
+    readonly sourceService: AuditExportDisclosureTier.FLOOR;
+    /** CEF `Device Version`, LEEF `Product Version` — header slots in both text grammars. */
+    readonly sourceVersion: AuditExportDisclosureTier.FLOOR;
+    /** See the module header: required, impersonal, and the cheapest triage filter a SOC has. */
+    readonly sourceEnvironment: AuditExportDisclosureTier.FLOOR;
+    /** Success or failure. Half of what an audit record is for. */
+    readonly outcome: AuditExportDisclosureTier.FLOOR;
+    /** A person's address. The single field most DPAs name first. */
+    readonly userEmail: AuditExportDisclosureTier.ATTRIBUTION;
+    /** Personal data in its own right, and the field that places a person geographically. */
+    readonly ipAddress: AuditExportDisclosureTier.ATTRIBUTION;
+    /** Device and software fingerprint of a person's client. */
+    readonly userAgent: AuditExportDisclosureTier.ATTRIBUTION;
+    /** Where a person was. */
+    readonly geoLocation: AuditExportDisclosureTier.ATTRIBUTION;
+    /**
+     * A pseudonymous identifier under GDPR Art. 4(5) by its own schema declaration, and the axis that
+     * groups one person ACROSS sessions and logins — which is precisely what makes it more disclosing
+     * than a per-request id, not less.
+     */
+    readonly clientInstanceId: AuditExportDisclosureTier.ATTRIBUTION;
+    /** Groups the events of one request. About the request, not the person who made it. */
+    readonly correlationId: AuditExportDisclosureTier.CONTEXT;
+    /** Which frontend surface (app / website / docs). */
+    readonly frontendServiceName: AuditExportDisclosureTier.CONTEXT;
+    /** A tenant LABEL. A legal person is not a data subject, but it is still the tenant's to withhold. */
+    readonly organizationName: AuditExportDisclosureTier.CONTEXT;
+    readonly applicationId: AuditExportDisclosureTier.CONTEXT;
+    readonly applicationName: AuditExportDisclosureTier.CONTEXT;
+    /** How the principal authenticated. A mechanism, not an identity. */
+    readonly authMethod: AuditExportDisclosureTier.CONTEXT;
+    /** Which identity source. A configuration reference. */
+    readonly authSource: AuditExportDisclosureTier.CONTEXT;
+    readonly providerRef: AuditExportDisclosureTier.CONTEXT;
+    readonly connectionType: AuditExportDisclosureTier.CONTEXT;
+    /** The open per-event bag. Gated a second time by the event type's own disclosure class. */
+    readonly eventData: AuditExportDisclosureTier.DETAIL;
+    /**
+     * DETAIL, not CONTEXT, because it is not a field of its own — it is a value the dispatcher LIFTED
+     * OUT of the bag (`eventData.failureReason || eventData.reason`), so it travels with the bag it
+     * came from. The operator is `||` rather than `??`, which is not pedantry here: an EMPTY
+     * `failureReason` falls through to `reason`, so an event can reach the free-text branch even when
+     * it declares the enum-ish one.
+     *
+     * It was CONTEXT, classified by its shape: usually an enum-ish failure reason, which reads as
+     * impersonal operational context. That was wrong in the direction that matters. **27** core event
+     * schemas declare a top-level `failureReason` or `reason` — the two keys the dispatcher reads, so
+     * that is the population — and **19** of them carry the operator-typed `reason`: the organization
+     * lifecycle events, `EMERGENCY_ACCESS_USED`, `RETAINED_DATA_ACCESS` (whose `reason` is required
+     * and is the #954 operator justification), `USER_PASSWORD_RESET_FORCED`,
+     * `RESOURCE_OPERATION_PERFORMED`. The organization-lifecycle entries in the event-data map below
+     * give that free text as the WHOLE reason their bags are `SUBJECT_DETAIL`. So the contract
+     * refused those bags and then handed their prose over anyway, through a field labelled context.
+     *
+     * The cost of the correction is real and is the right way round: a tenant that withholds detail
+     * now also loses the ordinary enum-shaped failure reason on, say, `USER_LOGIN_FAILED`. It can get
+     * it back by admitting `DETAIL` with `ADMINISTRATIVE` bags, and a reason it cannot have is one
+     * that may name somebody.
+     */
+    readonly outcomeReason: AuditExportDisclosureTier.DETAIL;
+};
+/** One envelope field name, as the disclosure contract names it. */
+export type AuditExportEnvelopeField = keyof typeof AUDIT_EXPORT_FIELD_DISCLOSURE;
+/** Envelope fields this contract permits a destination to trim. */
+type TrimmableEnvelopeField = {
+    [F in AuditExportEnvelopeField]: (typeof AUDIT_EXPORT_FIELD_DISCLOSURE)[F] extends AuditExportDisclosureTier.FLOOR ? never : F;
+}[AuditExportEnvelopeField];
+/**
+ * Envelope fields the TYPE declares OPTIONAL — the ones `delete` can honestly remove.
+ *
+ * ## `{} extends Pick<T, F>` is the optionality test, and `undefined extends T[F]` is NOT
+ *
+ * **This package compiles with `strict: false`, so `strictNullChecks` is OFF, and under that
+ * setting `undefined` is assignable to every type.** `undefined extends string` is therefore TRUE
+ * here, every field maps to `never`, the intersection below is empty for every input, and a guard
+ * built on it reports success no matter what anyone classifies. That is not a subtlety of the
+ * formulation — it is the whole test collapsing.
+ *
+ * This guard shipped in exactly that state and was caught by mutating it: with `sourceEnvironment`
+ * deliberately mis-declared as trimmable, the `undefined extends` version typechecked clean.
+ *
+ * **Two plausible culprits were proposed for it and BOTH were wrong**, which is why the real cause
+ * is spelled out rather than summarised. It is not `-?` "stripping `undefined` from the property
+ * type", and it is not indexing through `Required<E>` — measured against this very envelope type,
+ * the `-?` form, the `Required<E>` form and a bare form are ALL `never`, because the `undefined
+ * extends` test cannot discriminate under this tsconfig regardless of how it is spelled.
+ *
+ * `Pick` survives because it tests the optional MODIFIER, which exists in the type's syntax and is
+ * unaffected by `strictNullChecks`. The outer `-?` is doing an unrelated job: it stops the indexed
+ * access from adding `undefined` to the result union.
+ *
+ * **Generalise it: in any package here without `strictNullChecks`, a type-level test of the shape
+ * `undefined extends X` is vacuously true and silently useless.** Most engine packages are in that
+ * state. Reach for a modifier-based test, and mutate the guard before believing it.
+ */
+type OmittableEnvelopeField = {
+    [F in keyof SecurityAuditEventEnvelope]-?: Record<never, never> extends Pick<SecurityAuditEventEnvelope, F> ? F : never;
+}[keyof SecurityAuditEventEnvelope];
+/** Envelope fields the TYPE requires — a value that cannot simply be deleted. */
+type RequiredEnvelopeField = Exclude<keyof SecurityAuditEventEnvelope, OmittableEnvelopeField>;
+/**
+ * Any field that is trimmable AND required — i.e. one {@link applyAuditExportProjection} could not
+ * honestly remove. `eventData` is the one legitimate member of that intersection: it is required by
+ * the envelope type and is emptied to `{}` rather than deleted, which every wire format already
+ * reads as "no detail" (both text grammars omit the key for an empty bag, and OCSF omits `unmapped`).
+ */
+type TrimmableFieldThatCannotBeOmitted = Exclude<Extract<TrimmableEnvelopeField, RequiredEnvelopeField>, 'eventData'>;
+/**
+ * COMPILE-TIME GUARD, not a runtime value — the constant is never read.
+ *
+ * It fails to typecheck, naming the offending field, if anyone classifies a REQUIRED envelope field
+ * as trimmable. That is the one way this contract could promise a minimisation it cannot perform:
+ * the applier would leave the field in place and a tenant would receive data it declared it would
+ * not. The failure is silent at runtime and total at compile time, which is the right way round.
+ *
+ * If a new required field genuinely must be trimmable, make it optional on the envelope (every
+ * wire-format render already guards for absence, for the DLQ-replay reason) rather than widening
+ * this guard.
+ */
+export declare const AUDIT_EXPORT_TRIMMABLE_FIELDS_ARE_OMITTABLE: [TrimmableFieldThatCannotBeOmitted] extends [never] ? true : TrimmableFieldThatCannotBeOmitted;
+/**
+ * Every core auditable event's `eventData` disclosure class — the EVENT-TYPE half of the contract.
+ *
+ * **Total over `CoreAuditableEventType`**, so a member added to the vocabulary is a compile error
+ * until its author answers the question. That totality is the whole reason this is a map rather
+ * than a per-destination list: a destination enumerating event types is a hand-kept list against a
+ * vocabulary that moves, and a newly-added event would silently export everything or nothing
+ * depending on which way its default fell.
+ *
+ * **Unverified entries are {@link AuditExportEventDataDisclosure.SUBJECT_DETAIL}, deliberately.**
+ * Only the events below carry `ADMINISTRATIVE`, and each was classified by READING its
+ * `eventData` schema and confirming it holds configuration or counts and no free text. Everything
+ * else takes the fail-closed answer — including events whose bag is very likely harmless — because
+ * the cost of being wrong in that direction is a tenant losing detail it could have had, while the
+ * other direction discloses personal data to a destination that asked not to receive it.
+ *
+ * An application's OWN event types are not in this map and resolve to `SUBJECT_DETAIL` through
+ * {@link resolveEventDataDisclosure}, for the same reason.
+ */
+export declare const AUDIT_EXPORT_EVENT_DATA_DISCLOSURE: Record<CoreAuditableEventType, AuditExportEventDataDisclosure>;
+/**
+ * What one DESTINATION has declared it may receive — the per-tenant, per-agreement half.
+ *
+ * Two arrays rather than one, and the interaction between them is the reason. A tenant that drops
+ * {@link AuditExportDisclosureTier.ATTRIBUTION} while keeping the detail bag would still receive
+ * the email address inside `eventData` for every authentication event — a minimisation that reads
+ * as a control and is not one. {@link disclosedEventDataClasses} is what closes that: declaring
+ * `[ADMINISTRATIVE]` keeps the bags that carry configuration and drops the ones that carry people.
+ */
+export declare const SiemExportProjectionDeclarationSchema: z.ZodObject<{
+    disclosedTiers: z.ZodDefault<z.ZodArray<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<{
+        readonly CONTEXT: AuditExportDisclosureTier.CONTEXT;
+        readonly ATTRIBUTION: AuditExportDisclosureTier.ATTRIBUTION;
+        readonly DETAIL: AuditExportDisclosureTier.DETAIL;
+    }>>>>;
+    disclosedEventDataClasses: z.ZodDefault<z.ZodArray<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof AuditExportEventDataDisclosure>>>>;
+}, z.core.$strip>;
+export type AuditExportProjectionDeclaration = z.infer<typeof SiemExportProjectionDeclarationSchema>;
+/**
+ * The projection a destination that has declared nothing receives: everything.
+ *
+ * FAIL-OPEN, deliberately, and it is the one place in this contract where that is right. An absent
+ * declaration is not a tenant asking for minimisation — it is a tenant that has not configured one,
+ * and every existing destination is in that state. Failing closed here would silently stop
+ * delivering fields to feeds that are working today, which is a bigger and quieter harm than
+ * continuing the current behaviour until an operator narrows it deliberately.
+ */
+export declare const FULL_AUDIT_EXPORT_PROJECTION: AuditExportProjectionDeclaration;
+/**
+ * What an event type's `eventData` bag carries, including for event types an APPLICATION defined.
+ *
+ * An unknown type resolves to {@link AuditExportEventDataDisclosure.SUBJECT_DETAIL} — the opposite
+ * direction from `getAuditEventClassification`, whose fallback exists to give an application event
+ * a usable category. Here the fallback decides a DISCLOSURE, so it takes the safe answer: an
+ * application's own bag is the one this framework knows least about.
+ */
+export declare function resolveEventDataDisclosure(eventType: string): AuditExportEventDataDisclosure;
+/**
+ * The envelope fields one destination may receive for one event.
+ *
+ * The floor is unioned in unconditionally — **this is where "a floor cannot be trimmed" is
+ * enforced**, not in the applier and not in the schema's defaults, so no declaration a tenant can
+ * write and no future caller can produce a feed without it.
+ *
+ * assurance-control: WILDO.PRIVACY.DATA_MINIMIZATION — the destination's declaration decides which
+ * envelope fields may leave for an external processor, and the floor is the part of that decision
+ * the framework keeps: a record that cannot be correlated or de-duplicated is not a minimised
+ * export.
+ */
+export declare function resolveDisclosedEnvelopeFields(eventType: string, declaration: AuditExportProjectionDeclaration): ReadonlySet<AuditExportEnvelopeField>;
+/**
+ * Apply a destination's projection to an envelope, returning the envelope that may actually leave.
+ *
+ * Returns a NEW object — the caller fans one audit event out to several tenants' sinks, each with
+ * its own declaration, so mutating in place would let the first destination's minimisation reach
+ * the second's delivery.
+ *
+ * **Omitted is not empty**, which the CEF `csN` slots make more than a nicety: a trimmed optional
+ * field is DELETED, so a render that guards `e.x ? … : undefined` emits neither the value nor its
+ * `csNLabel` companion. `eventData` is the one exception — it is required by the envelope type, so
+ * it is emptied to `{}`, which every format already reads as "no detail" (both text grammars omit
+ * their detail key for an empty bag; OCSF omits `unmapped` for the same reason). The compile-time
+ * guard {@link AUDIT_EXPORT_TRIMMABLE_FIELDS_ARE_OMITTABLE} is what keeps that exception the only
+ * one.
+ *
+ * assurance-control: WILDO.PRIVACY.DATA_MINIMIZATION — the act itself: only the fields the
+ * destination's declaration admits survive into the envelope that is signed, queued and delivered
+ * to a third-party processor of the tenant's choosing.
+ */
+export declare function applyAuditExportProjection(envelope: SecurityAuditEventEnvelope, declaration: AuditExportProjectionDeclaration): SecurityAuditEventEnvelope;
+export {};
+//# sourceMappingURL=audit-export-projection.shared.schemas.d.ts.map

package/dist/esm/compliance/audit-trails/audit-export-projection.shared.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-export-projection.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/audit-trails/audit-export-projection.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoGG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,0BAA0B,CAAC;AAElC,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAC1E,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,+CAA+C,CAAC;AAEhG;;;;;;;;;GASG;AACH,oBAAY,yBAAyB;IACnC;;;;OAIG;IACH,KAAK,UAAU;IACf;;;OAGG;IACH,WAAW,gBAAgB;IAC3B;;;;;;OAMG;IACH,OAAO,YAAY;IACnB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACH,MAAM,WAAW;CAClB;AAED;;;;;;;;;;GAUG;AACH,oBAAY,8BAA8B;IACxC;;;;;;;;OAQG;IACH,cAAc,mBAAmB;IACjC;;;;;;;OAOG;IACH,cAAc,mBAAmB;CAClC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,kCAAkC,GAAG;IAC/C,QAAQ,EAAE,CAAC,IAAI,MAAM,QAAQ,CAAC,0BAA0B,CAAC,CAAC,CAAC,GAAG,yBAAyB;CACxF,CAAC;AAEF,eAAO,MAAM,6BAA6B;IAExC,gGAAgG;;IAEhG,iGAAiG;;IAEjG,kFAAkF;;IAElF,6EAA6E;;IAE7E,wEAAwE;;IAExE,gGAAgG;;IAEhG;;;;;OAKG;;IAEH,kFAAkF;;IAElF,yFAAyF;;IAEzF,6FAA6F;;IAE7F,+DAA+D;;IAI/D,iEAAiE;;IAEjE,yFAAyF;;IAEzF,4DAA4D;;IAE5D,0BAA0B;;IAE1B;;;;OAIG;;IAIH,uFAAuF;;IAEvF,qDAAqD;;IAErD,sGAAsG;;;;IAItG,qEAAqE;;IAErE,wDAAwD;;;;IAMxD,4FAA4F;;IAE5F;;;;;;;;;;;;;;;;;;;;;OAqBG;;CAEkD,CAAC;AAExD,oEAAoE;AACpE,MAAM,MAAM,wBAAwB,GAAG,MAAM,OAAO,6BAA6B,CAAC;AAElF,mEAAmE;AACnE,KAAK,sBAAsB,GAAG;KAC3B,CAAC,IAAI,wBAAwB,GAAG,CAAC,OAAO,6BAA6B,CAAC,CAAC,CAAC,CAAC,SAAS,yBAAyB,CAAC,KAAK,GAC9G,KAAK,GACL,CAAC;CACN,CAAC,wBAAwB,CAAC,CAAC;AAE5B;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,KAAK,sBAAsB,GAAG;KAC3B,CAAC,IAAI,MAAM,0BAA0B,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,IAAI,CAAC,0BAA0B,EAAE,CAAC,CAAC,GACvG,CAAC,GACD,KAAK;CACV,CAAC,MAAM,0BAA0B,CAAC,CAAC;AAEpC,iFAAiF;AACjF,KAAK,qBAAqB,GAAG,OAAO,CAAC,MAAM,0BAA0B,EAAE,sBAAsB,CAAC,CAAC;AAE/F;;;;;GAKG;AACH,KAAK,iCAAiC,GAAG,OAAO,CAAC,OAAO,CAAC,sBAAsB,EAAE,qBAAqB,CAAC,EAAE,WAAW,CAAC,CAAC;AAEtH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,2CAA2C,EAAE,CAAC,iCAAiC,CAAC,SAAS,CAAC,KAAK,CAAC,GACzG,IAAI,GACJ,iCAAwC,CAAC;AAE7C;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,kCAAkC,EAAE,MAAM,CAAC,sBAAsB,EAAE,8BAA8B,CAgQ7G,CAAC;AAEF;;;;;;;;GAQG;AAWH,eAAO,MAAM,qCAAqC;;;;;;;iBAuChD,CAAC;AAEH,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AAErG;;;;;;;;GAQG;AACH,eAAO,MAAM,4BAA4B,EAAE,gCAU1C,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,GAAG,8BAA8B,CAK5F;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,8BAA8B,CAC5C,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,gCAAgC,GAC5C,WAAW,CAAC,wBAAwB,CAAC,CAsBvC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,0BAA0B,EACpC,WAAW,EAAE,gCAAgC,GAC5C,0BAA0B,CAe5B"}