npm - @wildo-ai/saas-models - Versions diffs - 1.1.4 → 1.1.5 - Mend

@wildo-ai/saas-models 1.1.4 → 1.1.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1032) hide show

package/dist/esm/compliance/audit-trails/audit-export-projection.shared.schemas.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"audit-export-projection.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/audit-trails/audit-export-projection.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoGG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,2FAA2F;AAC3F,kGAAkG;AAClG,iCAAiC;AACjC,OAAO,0BAA0B,CAAC;AAElC,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAG1E;;;;;;;;;GASG;AACH,MAAM,CAAN,IAAY,yBAsDX;AAtDD,WAAY,yBAAyB;IACnC;;;;OAIG;IACH,4CAAe,CAAA;IACf;;;OAGG;IACH,wDAA2B,CAAA;IAC3B;;;;;;OAMG;IACH,gDAAmB,CAAA;IACnB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACH,8CAAiB,CAAA;AACnB,CAAC,EAtDW,yBAAyB,KAAzB,yBAAyB,QAsDpC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAN,IAAY,8BAoBX;AApBD,WAAY,8BAA8B;IACxC;;;;;;;;OAQG;IACH,mEAAiC,CAAA;IACjC;;;;;;;OAOG;IACH,mEAAiC,CAAA;AACnC,CAAC,EApBW,8BAA8B,KAA9B,8BAA8B,QAoBzC;AAkBD,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,gGAAgG;IAChG,gGAAgG;IAChG,OAAO,EAAE,yBAAyB,CAAC,KAAK;IACxC,iGAAiG;IACjG,SAAS,EAAE,yBAAyB,CAAC,KAAK;IAC1C,kFAAkF;IAClF,aAAa,EAAE,yBAAyB,CAAC,KAAK;IAC9C,6EAA6E;IAC7E,QAAQ,EAAE,yBAAyB,CAAC,KAAK;IACzC,wEAAwE;IACxE,SAAS,EAAE,yBAAyB,CAAC,KAAK;IAC1C,gGAAgG;IAChG,cAAc,EAAE,yBAAyB,CAAC,KAAK;IAC/C;;;;;OAKG;IACH,MAAM,EAAE,yBAAyB,CAAC,KAAK;IACvC,kFAAkF;IAClF,aAAa,EAAE,yBAAyB,CAAC,KAAK;IAC9C,yFAAyF;IACzF,aAAa,EAAE,yBAAyB,CAAC,KAAK;IAC9C,6FAA6F;IAC7F,iBAAiB,EAAE,yBAAyB,CAAC,KAAK;IAClD,+DAA+D;IAC/D,OAAO,EAAE,yBAAyB,CAAC,KAAK;IAExC,gGAAgG;IAChG,iEAAiE;IACjE,SAAS,EAAE,yBAAyB,CAAC,WAAW;IAChD,yFAAyF;IACzF,SAAS,EAAE,yBAAyB,CAAC,WAAW;IAChD,4DAA4D;IAC5D,SAAS,EAAE,yBAAyB,CAAC,WAAW;IAChD,0BAA0B;IAC1B,WAAW,EAAE,yBAAyB,CAAC,WAAW;IAClD;;;;OAIG;IACH,gBAAgB,EAAE,yBAAyB,CAAC,WAAW;IAEvD,gGAAgG;IAChG,uFAAuF;IACvF,aAAa,EAAE,yBAAyB,CAAC,OAAO;IAChD,qDAAqD;IACrD,mBAAmB,EAAE,yBAAyB,CAAC,OAAO;IACtD,sGAAsG;IACtG,gBAAgB,EAAE,yBAAyB,CAAC,OAAO;IACnD,aAAa,EAAE,yBAAyB,CAAC,OAAO;IAChD,eAAe,EAAE,yBAAyB,CAAC,OAAO;IAClD,qEAAqE;IACrE,UAAU,EAAE,yBAAyB,CAAC,OAAO;IAC7C,wDAAwD;IACxD,UAAU,EAAE,yBAAyB,CAAC,OAAO;IAC7C,WAAW,EAAE,yBAAyB,CAAC,OAAO;IAC9C,cAAc,EAAE,yBAAyB,CAAC,OAAO;IAEjD,gGAAgG;IAChG,4FAA4F;IAC5F,SAAS,EAAE,yBAAyB,CAAC,MAAM;IAC3C;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,aAAa,EAAE,yBAAyB,CAAC,MAAM;CACM,CAAC;AAyDxD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAEhB,IAAI,CAAC;AAE7C;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAmE;IAChH,gGAAgG;IAChG,mFAAmF;IACnF,CAAC,sBAAsB,CAAC,UAAU,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAClF,CAAC,sBAAsB,CAAC,WAAW,CAAC,EAAE,8BAA8B,CAAC,cAAc;IACnF,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IACzF,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAC3F,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAC7F,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IACxF,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IACzF,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAC5F,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAC5F,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAC5F,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAC3F,CAAC,sBAAsB,CAAC,cAAc,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAEtF,gGAAgG;IAChG,CAAC,sBAAsB,CAAC,YAAY,CAAC,EAAE,8BAA8B,CAAC,cAAc;IACpF,CAAC,sBAAsB,CAAC,YAAY,CAAC,EAAE,8BAA8B,CAAC,cAAc;IACpF,CAAC,sBAAsB,CAAC,YAAY,CAAC,EAAE,8BAA8B,CAAC,cAAc;IACpF,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAE9F;;;OAGG;IACH,CAAC,sBAAsB,CAAC,sCAAsC,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAC9G,sFAAsF;IACtF,gGAAgG;IAChG,CAAC,sBAAsB,CAAC,iCAAiC,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAEzG,gGAAgG;IAChG,iGAAiG;IACjG,6FAA6F;IAC7F,0FAA0F;IAC1F,+FAA+F;IAC/F,6DAA6D;IAC7D,EAAE;IACF,kGAAkG;IAClG,qFAAqF;IACrF,6EAA6E;IAC7E,kGAAkG;IAClG,wFAAwF;IACxF,qDAAqD;IACrD,kGAAkG;IAClG,kGAAkG;IAClG,iGAAiG;IACjG,yBAAyB;IACzB,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAC5F,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAC5F,CAAC,sBAAsB,CAAC,0BAA0B,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAClG,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAC5F,CAAC,sBAAsB,CAAC,+BAA+B,CAAC,EAAE,8BAA8B,CAAC,cAAc;IACvG,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAC7F,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAC9F,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAC9F,CAAC,sBAAsB,CAAC,oCAAoC,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAE5G,gGAAgG;IAChG,mFAAmF;IACnF,CAAC,sBAAsB,CAAC,2BAA2B,CAAC,EAAE,8BAA8B,CAAC,cAAc;IACnG,CAAC,sBAAsB,CAAC,0BAA0B,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAClG,CAAC,sBAAsB,CAAC,2BAA2B,CAAC,EAAE,8BAA8B,CAAC,cAAc;IACnG,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,EAAE,8BAA8B,CAAC,cAAc;IACxG,CAAC,sBAAsB,CAAC,kCAAkC,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAC1G,CAAC,sBAAsB,CAAC,2BAA2B,CAAC,EAAE,8BAA8B,CAAC,cAAc;IACnG,CAAC,sBAAsB,CAAC,kCAAkC,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAC1G,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,EAAE,8BAA8B,CAAC,cAAc;IACxG,CAAC,sBAAsB,CAAC,4BAA4B,CAAC,EAAE,8BAA8B,CAAC,cAAc;IACpG,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IACjG,CAAC,sBAAsB,CAAC,qCAAqC,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAC7G,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAExG,gGAAgG;IAChG,CAAC,sBAAsB,CAAC,cAAc,CAAC,EAAE,8BAA8B,CAAC,cAAc;IACtF,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAC7F,CAAC,sBAAsB,CAAC,4BAA4B,CAAC,EAAE,8BAA8B,CAAC,cAAc;IACpG,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAE5F,gGAAgG;IAChG;;;;;;;;;;;OAWG;IACH,CAAC,sBAAsB,CAAC,sCAAsC,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAC9G;;;;;;;;OAQG;IACH,CAAC,sBAAsB,CAAC,mCAAmC,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAC3G,CAAC,sBAAsB,CAAC,iCAAiC,CAAC,EAAE,8BAA8B,CAAC,cAAc;IACzG,CAAC,sBAAsB,CAAC,4CAA4C,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAEpH,gGAAgG;IAChG,kGAAkG;IAClG,4FAA4F;IAC5F,yEAAyE;IACzE,CAAC,sBAAsB,CAAC,oCAAoC,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAC5G,CAAC,sBAAsB,CAAC,wCAAwC,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAChH,CAAC,sBAAsB,CAAC,qCAAqC,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAC7G,CAAC,sBAAsB,CAAC,wCAAwC,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAChH,CAAC,sBAAsB,CAAC,4BAA4B,CAAC,EAAE,8BAA8B,CAAC,cAAc;IACpG,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,EAAE,8BAA8B,CAAC,cAAc;IACxG,CAAC,sBAAsB,CAAC,6BAA6B,CAAC,EAAE,8BAA8B,CAAC,cAAc;IACrG,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,EAAE,8BAA8B,CAAC,cAAc;IACxG,CAAC,sBAAsB,CAAC,wCAAwC,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAChH,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAExG,gGAAgG;IAChG;;;OAGG;IACH,CAAC,sBAAsB,CAAC,+BAA+B,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAEvG,gGAAgG;IAChG;;;OAGG;IACH,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAExG,gGAAgG;IAChG,8FAA8F;IAC9F,uBAAuB;IACvB,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAC1F,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAC1F,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAC5F,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAC1F,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,EAAE,8BAA8B,CAAC,cAAc;IACxG,CAAC,sBAAsB,CAAC,wBAAwB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAChG,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAC7F,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IACzF,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAE7F,gGAAgG;IAChG,+DAA+D;IAC/D,CAAC,sBAAsB,CAAC,6BAA6B,CAAC,EAAE,8BAA8B,CAAC,cAAc;IACrG,CAAC,sBAAsB,CAAC,6BAA6B,CAAC,EAAE,8BAA8B,CAAC,cAAc;IACrG,CAAC,sBAAsB,CAAC,0BAA0B,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAClG,CAAC,sBAAsB,CAAC,eAAe,CAAC,EAAE,8BAA8B,CAAC,cAAc;IACvF,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAC3F,CAAC,sBAAsB,CAAC,8BAA8B,CAAC,EAAE,8BAA8B,CAAC,cAAc;IACtG,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IACzF,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAC1F,CAAC,sBAAsB,CAAC,0BAA0B,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAClG,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAC9F,CAAC,sBAAsB,CAAC,wBAAwB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAChG,CAAC,sBAAsB,CAAC,uBAAuB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAC/F,CAAC,sBAAsB,CAAC,uBAAuB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAC/F,CAAC,sBAAsB,CAAC,mCAAmC,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAC3G,CAAC,sBAAsB,CAAC,mCAAmC,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAC3G,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAC5F,CAAC,sBAAsB,CAAC,4BAA4B,CAAC,EAAE,8BAA8B,CAAC,cAAc;IACpG,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAC5F,CAAC,sBAAsB,CAAC,wBAAwB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAChG,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAC9F,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IACzF,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAC7F,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAC3F,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAC3F,CAAC,sBAAsB,CAAC,8BAA8B,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAEtG,gGAAgG;IAChG,+FAA+F;IAC/F,8FAA8F;IAC9F,sEAAsE;IACtE,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAC5F,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAC1F,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IACzF,CAAC,sBAAsB,CAAC,8BAA8B,CAAC,EAAE,8BAA8B,CAAC,cAAc;IACtG,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAC1F,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAC1F,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAC1F,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAC5F,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAE1F,gGAAgG;IAChG,CAAC,sBAAsB,CAAC,uBAAuB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAC/F,CAAC,sBAAsB,CAAC,2BAA2B,CAAC,EAAE,8BAA8B,CAAC,cAAc;IACnG,CAAC,sBAAsB,CAAC,4BAA4B,CAAC,EAAE,8BAA8B,CAAC,cAAc;IACpG,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAC7F,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAC5F,CAAC,sBAAsB,CAAC,6BAA6B,CAAC,EAAE,8BAA8B,CAAC,cAAc;IACrG,CAAC,sBAAsB,CAAC,+BAA+B,CAAC,EAAE,8BAA8B,CAAC,cAAc;IACvG,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IACjG,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAC7F,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAC3F,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IACjG,CAAC,sBAAsB,CAAC,0BAA0B,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAClG,CAAC,sBAAsB,CAAC,+BAA+B,CAAC,EAAE,8BAA8B,CAAC,cAAc;IACvG,CAAC,sBAAsB,CAAC,iCAAiC,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAEzG,gGAAgG;IAChG,CAAC,sBAAsB,CAAC,wBAAwB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAChG,CAAC,sBAAsB,CAAC,0BAA0B,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAClG,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IACjG,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAC9F,CAAC,sBAAsB,CAAC,wBAAwB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAChG,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAC7F,CAAC,sBAAsB,CAAC,wBAAwB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAChG,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAC7F,CAAC,sBAAsB,CAAC,uBAAuB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAC/F,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAC7F,CAAC,sBAAsB,CAAC,kCAAkC,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAE1G,gGAAgG;IAChG,wFAAwF;IACxF,4FAA4F;IAC5F,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAC7F,CAAC,sBAAsB,CAAC,YAAY,CAAC,EAAE,8BAA8B,CAAC,cAAc;IACpF,CAAC,sBAAsB,CAAC,4BAA4B,CAAC,EAAE,8BAA8B,CAAC,cAAc;IACpG,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IACjG,CAAC,sBAAsB,CAAC,kCAAkC,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAC1G,CAAC,sBAAsB,CAAC,+BAA+B,CAAC,EAAE,8BAA8B,CAAC,cAAc;IACvG,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IACjG,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAC3F,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAC5F,CAAC,sBAAsB,CAAC,kCAAkC,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAC1G,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAC5F,CAAC,sBAAsB,CAAC,sCAAsC,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAC9G,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAC3F,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAE9F,gGAAgG;IAChG,CAAC,sBAAsB,CAAC,4BAA4B,CAAC,EAAE,8BAA8B,CAAC,cAAc;IACpG,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IACjG,CAAC,sBAAsB,CAAC,iCAAiC,CAAC,EAAE,8BAA8B,CAAC,cAAc;IACzG,CAAC,sBAAsB,CAAC,uBAAuB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IAC/F,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,EAAE,8BAA8B,CAAC,cAAc;IACjG,CAAC,sBAAsB,CAAC,aAAa,CAAC,EAAE,8BAA8B,CAAC,cAAc;IACrF,CAAC,sBAAsB,CAAC,4BAA4B,CAAC,EAAE,8BAA8B,CAAC,cAAc;IACpG;;;;;;;;;OASG;IACH,CAAC,sBAAsB,CAAC,+CAA+C,CAAC,EAAE,8BAA8B,CAAC,cAAc;CACxH,CAAC;AAEF;;;;;;;;GAQG;AACH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5D;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,2BAA2B,CAAC,CAAC,CAAC,OAAO,CAAC;QAC5H,yBAAyB,CAAC,WAAW;QACrC,yBAAyB,CAAC,OAAO;QACjC,yBAAyB,CAAC,MAAM;KACjC,CAAC;IACF;;;;OAIG;IACH,yBAAyB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC,UAAU,CAAC,gCAAgC,CAAC,CAAC,CAAC,OAAO,CAAC;QAC9H,8BAA8B,CAAC,cAAc;QAC7C,8BAA8B,CAAC,cAAc;KAC9C,CAAC;CACH,CAAC,CAAC;AAIH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAqC;IAC5E,cAAc,EAAE;QACd,yBAAyB,CAAC,WAAW;QACrC,yBAAyB,CAAC,OAAO;QACjC,yBAAyB,CAAC,MAAM;KACjC;IACD,yBAAyB,EAAE;QACzB,8BAA8B,CAAC,cAAc;QAC7C,8BAA8B,CAAC,cAAc;KAC9C;CACF,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CAAC,SAAiB;IAC1D,OAAO,CACL,kCAAkC,CAAC,SAAmC,CAAC;WACpE,8BAA8B,CAAC,cAAc,CACjD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,8BAA8B,CAC5C,SAAiB,EACjB,WAA6C;IAE7C,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC;IAC3D,MAAM,iBAAiB,GACrB,cAAc,CAAC,GAAG,CAAC,yBAAyB,CAAC,MAAM,CAAC;WACjD,WAAW,CAAC,yBAAyB,CAAC,QAAQ,CAAC,0BAA0B,CAAC,SAAS,CAAC,CAAC,CAAC;IAE3F,MAAM,SAAS,GAAG,IAAI,GAAG,EAA4B,CAAC;IACtD,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,6BAA6B,CAGrE,EAAE,CAAC;QACJ,IAAI,IAAI,KAAK,yBAAyB,CAAC,KAAK,EAAE,CAAC;YAC7C,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACrB,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,yBAAyB,CAAC,MAAM,EAAE,CAAC;YAC9C,IAAI,iBAAiB;gBAAE,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC5C,SAAS;QACX,CAAC;QACD,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,0BAA0B,CACxC,QAAoC,EACpC,WAA6C;IAE7C,MAAM,SAAS,GAAG,8BAA8B,CAAC,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IAClF,MAAM,SAAS,GAA+B,EAAE,GAAG,QAAQ,EAAE,CAAC;IAE9D,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAwC,EAAE,CAAC;QACtG,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,SAAS;QACnC,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;YAC1B,SAAS,CAAC,SAAS,GAAG,EAAE,CAAC;YACzB,SAAS;QACX,CAAC;QACD,8FAA8F;QAC9F,OAAQ,SAAqC,CAAC,KAAK,CAAC,CAAC;IACvD,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC","sourcesContent":["/**\n * Audit-export projection — what a SIEM destination MAY receive, declared once.\n *\n * ## Why this exists at all, and why it is `_core` rather than a SIEM feature\n *\n * A tenant sending audit events to a third-party SIEM is sending them to a processor of its own\n * choosing, in a jurisdiction of its own choosing. Data minimisation is that operator's duty, and\n * until this contract existed the only place they could discharge it was AT THE RECEIVER — after\n * the data had already left the building. An export that cannot be trimmed is an export some\n * customers cannot lawfully switch on.\n *\n * The obvious-looking place to put the answer did not exist. The dispatcher assembles the envelope\n * by hand-picking values off `auditEvent.eventData` (`userEmail: eventData.email`, and its\n * neighbours), so there was no object to attach a projection to: the contract had to exist FIRST.\n * Two accepted-and-ignored booleans (`includeRawEventData`, `includeDeviceContext`) had occupied\n * the space and were removed in `be001548` precisely because a stored flag that changes nothing is\n * worse than its absence — their own removal note says the capability they named \"would be built on\n * the envelope contract, not on two booleans beside the retry policy\". This is that contract.\n *\n * ## This is NOT `.isAuditEvidence()`, and the two must never be merged\n *\n * `.isAuditEvidence()` decides which FIELD VALUES are copied INTO the immutable audit row. It\n * answers *what must the application be able to prove to itself*, it is correct as it is, and its\n * answer is deliberately maximal — the ledger is the evidence.\n *\n * This contract answers a different question with a different answer: *what may this application\n * disclose to a processor of the tenant's choosing*. The two diverge by design. A row the ledger\n * must retain forever is routinely a row a tenant's DPA forbids exporting, and one decorator\n * meaning both would force the weaker answer onto the stronger obligation.\n *\n * ## Two declarations, and the ORDER between them is the design\n *\n * - **The EVENT TYPE declares what MAY leave** ({@link AUDIT_EXPORT_EVENT_DATA_DISCLOSURE}), total\n * over `CoreAuditableEventType`, so an event added tomorrow has to answer the question.\n * - **The DESTINATION narrows it** ({@link AuditExportProjectionDeclaration}), per tenant and per\n * agreement, which is what a customer actually negotiates.\n *\n * The event-type half is built first and is not optional, because a destination cannot narrow a set\n * nobody has enumerated: shipping only the destination half would mean the first tenant to\n * configure one is choosing from an undeclared surface.\n *\n * ## The floor cannot be trimmed, and that is structural rather than advisory\n *\n * {@link AuditExportDisclosureTier.FLOOR} fields survive whatever a destination declares —\n * {@link resolveDisclosedEnvelopeFields} unions them in unconditionally, so a declaration of `[]`\n * still yields a correlatable event. Three independent reasons, and only the first is about\n * privacy:\n *\n * 1. **`eventId` IS the receiver's dedup key** in every wire format (CEF `externalId`, LEEF\n * `eventId`, OCSF `metadata.uid`, `json_structured`'s top-level `eventId`), and the DLQ drain\n * re-sends a stored envelope. Minimise past it and the feed stops being idempotent against a\n * service that retries — a \"minimised\" export nobody can correlate is not a privacy win, it is\n * an unusable feed that still left the building.\n * 2. **`eventType`, `severity` and `sourceVersion` are CEF/LEEF HEADER slots.** A header field\n * cannot be omitted without shifting every field after it, so trimming one does not minimise a\n * record — it corrupts it.\n * 3. **The remaining floor members are the record's own identity** — when, in which tenant, by\n * which actor reference, with what outcome. A row that cannot say those things is not a\n * shorter audit event; it is not an audit event.\n *\n * `sourceEnvironment` is FLOOR and is the one member worth justifying, because it is neither an\n * identity nor a header slot: it names the deployment environment (`production`), it is not data\n * about any person, it is REQUIRED on the envelope type, and the CEF contract records it as the\n * cheapest triage filter a SOC has. Trimming it would cost a receiver real capability and protect\n * nobody.\n *\n * ## Applied ONCE, at the ENQUEUE SEAM — which is what makes every format consistent\n *\n * The projection is applied inside `AuditEventDispatcherBackendService.enqueueSiemWebhookDelivery`,\n * before the F6 HMAC and before the job is enqueued. So the minimised envelope is the ONLY envelope\n * that exists downstream: it is what is signed, what is queued, what a DLQ row stores, and what a\n * drain replays.\n *\n * **The seam rather than the call site, and the difference is not stylistic.** It landed at the\n * dispatch call site first, which left that public method able to enqueue an un-minimised envelope\n * for any producer that found it — the one-of-N shape `invariant-call-site-enumeration.md` exists\n * for, and live rather than hypothetical, since the batching lane is extending that very seam. The\n * seam already owned the other two elements of the delivery contract (the HMAC and the batch ref);\n * the projection is the third.\n *\n * Moving it also FIXED the dead-letter retry, which the call-site version could not: a drain\n * re-enqueues stored bytes with a freshly loaded configuration, so a tenant that narrows its\n * projection on discovering over-disclosure now has that narrowing reach rows already\n * dead-lettered. Re-application is safe both ways, because the projection only ever DELETES.\n *\n * Four consequences, each of which would have been a separate defect had the projection been\n * applied per-format instead:\n *\n * - **All four wire formats carry it identically, for free.** Every CEF/LEEF render already guards\n * `e.x ? c.pair(...) : undefined` (for the DLQ-replay reason), and every OCSF assignment does the\n * same — so a trimmed field emits NO key rather than an empty one. That distinction is not\n * cosmetic in CEF: a `csN` slot is emitted as a `csNLabel`/`csN` PAIR, and an empty `cs4=` with\n * its label still present would tell a receiver the field exists and is blank. Absent is absent.\n * - **The DLQ stores less.** A dead-lettered delivery holds only what the destination was allowed\n * to receive, so a queue outage does not park un-minimised personal data.\n * - **A retry cannot drift from the attempt it continues** — the same property the single enqueue\n * seam already guards.\n * - **The HMAC covers the bytes that actually leave.**\n *\n * @see `.claude/context/audit-trails.md` — the SIEM wire-format projections this rides on top of.\n */\n\nimport { z } from 'zod';\n// Side-effect import: this module calls `.systemEnum()` at load, so the decorators must be\n// installed first — never by the importer's luck (#966). A named import used only as a type would\n// be elided and install nothing.\nimport '@wildo-ai/zod-decorators';\n\nimport { CoreAuditableEventType } from './auditable-events.shared.schema';\nimport type { SecurityAuditEventEnvelope } from './security-audit-event-envelope.shared.schema';\n\n/**\n * What KIND of thing an envelope field is, for the purpose of deciding whether a destination may\n * receive it.\n *\n * Deliberately a SMALL closed vocabulary rather than per-field switches on the destination. A DPA\n * is negotiated in these terms — *\"we will not send you identifiers of our users\"* — and a tenant\n * choosing from 27 field names would be choosing from an implementation detail that moves. The tiers\n * are the stable surface; the field-to-tier assignment is the framework's judgement and is\n * compile-enforced to be total.\n */\nexport enum AuditExportDisclosureTier {\n /**\n * Never trimmable, whatever a destination declares. The record's identity, its outcome, its\n * actor reference, and the header slots the text grammars structurally require. See this module's\n * header for the three independent reasons.\n */\n FLOOR = 'floor',\n /**\n * Who the person is and where they were — the personal-data surface of the envelope. The tier a\n * tenant exporting to a processor in another jurisdiction most often wants dropped.\n */\n ATTRIBUTION = 'attribution',\n /**\n * Operational context that is not about a person: which request, which surface, which tenant\n * label, which authentication mechanism, which identity source.\n *\n * Note what is NOT here: `outcomeReason`. It reads like context and is DETAIL, because it is\n * lifted out of the event's own bag — see that tier's note.\n */\n CONTEXT = 'context',\n /**\n * Content that CAME FROM the per-event `eventData` bag — the bag itself, and any envelope field\n * the dispatcher lifted out of it. Disclosure is decided a second time by the event type's own\n * {@link AuditExportEventDataDisclosure}.\n *\n * **\"Came from the bag\" rather than \"is the bag\", and the difference was a real hole.** The\n * dispatcher PROMOTES values onto the envelope — `outcomeReason` is\n * `eventData.failureReason || eventData.reason` — so a promoted field classified by what it looks\n * like (a short reason string, plausibly CONTEXT) outlives the bag it was copied from.\n *\n * **The population is defined by those two keys, because they are the only ones the dispatcher\n * reads.** Measured over the core vocabulary: **27** event schemas declare a top-level\n * `failureReason` or `reason` and can therefore put text into `outcomeReason`, and **19** of them\n * carry the operator-typed `reason` — including every organization-lifecycle event whose\n * `SUBJECT_DETAIL` classification rests on precisely that free text. A destination that withheld\n * those bags was still receiving their prose.\n *\n * An earlier note said \"22 … `reason` or `justification`\", which is a real count of a population\n * this field does not have: `justification` is never read here, so three of those 22 could not\n * reach `outcomeReason` at all while eight schemas that can (`failureReason` only) were left out.\n * Both numbers were arithmetically right and the denominator was chosen rather than derived —\n * `derive-before-you-ask.md` Shape 2, inside the very rationale written to fix a leak.\n *\n * The operative rule is the general one: **a field's declared tier must be TRUE of every value it\n * can carry.** `userEmail` is promoted from the bag too and is ATTRIBUTION, because every value it\n * can hold is an address — the tier is true of all of them. `outcomeReason` is DETAIL because the\n * tier CONTEXT was not true of the free-text values it can hold, and nothing narrower than the\n * bag's own class can separate those from the enum-ish ones.\n *\n * So the practical test when adding a promoted field is not \"where did it come from\" alone — it\n * is \"can this field carry something its tier would be a lie about?\". Where the answer is yes and\n * the value comes from the bag, DETAIL is the only tier that can gate it honestly.\n */\n DETAIL = 'detail',\n}\n\n/**\n * What an event type's `eventData` bag CONTAINS — the event-type half of the contract.\n *\n * The question this answers is narrow on purpose: *does the bag carry content about a person,\n * beyond the actor reference the envelope already carries?* It is asked of the EVENT TYPE because\n * that is the only place it can be answered once — the bag is an open record whose shape is decided\n * by the emitter, so no property of the envelope can decide it.\n *\n * Only TWO members, and the binary is the point: a third \"it depends\" member would be a place to\n * put the entries nobody wanted to judge, and every entry that landed there would be read as safe.\n */\nexport enum AuditExportEventDataDisclosure {\n /**\n * The bag carries data ABOUT a person — an email address, an IP, a name, a value they supplied,\n * or free text somebody wrote which may name anyone.\n *\n * **This is the fail-closed answer and the default for anything not verified.** An event wrongly\n * marked here costs a minimising tenant a bag they could have had; an event wrongly marked\n * {@link ADMINISTRATIVE} discloses personal data to a destination that asked not to receive it.\n * The two errors are not symmetric, so the doubt resolves here.\n */\n SUBJECT_DETAIL = 'subject-detail',\n /**\n * The bag describes CONFIGURATION or SYSTEM STATE. Any identifier in it is an actor or resource\n * reference the envelope already implies, and it carries no contact data, no supplied values and\n * no free text.\n *\n * Mark an event here only after READING its `eventData` schema. The set is deliberately small;\n * growing it is a per-event decision with the schema in front of you, not a sweep.\n */\n ADMINISTRATIVE = 'administrative',\n}\n\n/**\n * Every field of the envelope, assigned a disclosure tier.\n *\n * **Total over `Required<SecurityAuditEventEnvelope>` with `-?`**, the same construction the CEF and\n * LEEF projection contracts use and for the same reason: a field added to the envelope is a COMPILE\n * ERROR here until someone decides what it is. The alternative — a hand-kept list of sensitive\n * fields — has no way to say what it left out, and what it leaves out is disclosed.\n *\n * Declared as a mapped TYPE rather than a `Record<string, …>` so the keys cannot drift from the\n * envelope, and `as const satisfies` so the assignments keep their literal types for\n * {@link AUDIT_EXPORT_TRIMMABLE_FIELDS_ARE_OMITTABLE} below.\n */\nexport type AuditExportFieldDisclosureContract = {\n readonly [F in keyof Required<SecurityAuditEventEnvelope>]-?: AuditExportDisclosureTier;\n};\n\nexport const AUDIT_EXPORT_FIELD_DISCLOSURE = {\n // ── FLOOR ────────────────────────────────────────────────────────────────────────────────────\n /** The receiver's dedup key AND the only handle joining a SIEM record back to its audit row. */\n eventId: AuditExportDisclosureTier.FLOOR,\n /** CEF `Device Event Class ID` + `Name`, LEEF `EventID` — header slots in both text grammars. */\n eventType: AuditExportDisclosureTier.FLOOR,\n /** What the record IS. A receiver's own category filter is written against it. */\n eventCategory: AuditExportDisclosureTier.FLOOR,\n /** CEF's mandatory `agentSeverity` header slot, and what a SOC alerts on. */\n severity: AuditExportDisclosureTier.FLOOR,\n /** When. An audit event without a time is not a shorter audit event. */\n timestamp: AuditExportDisclosureTier.FLOOR,\n /** Which tenant. Also the scope the feed is routed on, so a record denying it is unreadable. */\n organizationId: AuditExportDisclosureTier.FLOOR,\n /**\n * The ACTOR REFERENCE — an opaque id, never a name or an address. Deliberately FLOOR while\n * `userEmail` is ATTRIBUTION: an id lets a receiver correlate one actor's events without learning\n * who they are, which is exactly the trade a minimising tenant is trying to make. Dropping it\n * would leave a feed in which nothing can be attributed to anything.\n */\n userId: AuditExportDisclosureTier.FLOOR,\n /** Which application emitted it. Required on the envelope and names no person. */\n sourceService: AuditExportDisclosureTier.FLOOR,\n /** CEF `Device Version`, LEEF `Product Version` — header slots in both text grammars. */\n sourceVersion: AuditExportDisclosureTier.FLOOR,\n /** See the module header: required, impersonal, and the cheapest triage filter a SOC has. */\n sourceEnvironment: AuditExportDisclosureTier.FLOOR,\n /** Success or failure. Half of what an audit record is for. */\n outcome: AuditExportDisclosureTier.FLOOR,\n\n // ── ATTRIBUTION ──────────────────────────────────────────────────────────────────────────────\n /** A person's address. The single field most DPAs name first. */\n userEmail: AuditExportDisclosureTier.ATTRIBUTION,\n /** Personal data in its own right, and the field that places a person geographically. */\n ipAddress: AuditExportDisclosureTier.ATTRIBUTION,\n /** Device and software fingerprint of a person's client. */\n userAgent: AuditExportDisclosureTier.ATTRIBUTION,\n /** Where a person was. */\n geoLocation: AuditExportDisclosureTier.ATTRIBUTION,\n /**\n * A pseudonymous identifier under GDPR Art. 4(5) by its own schema declaration, and the axis that\n * groups one person ACROSS sessions and logins — which is precisely what makes it more disclosing\n * than a per-request id, not less.\n */\n clientInstanceId: AuditExportDisclosureTier.ATTRIBUTION,\n\n // ── CONTEXT ──────────────────────────────────────────────────────────────────────────────────\n /** Groups the events of one request. About the request, not the person who made it. */\n correlationId: AuditExportDisclosureTier.CONTEXT,\n /** Which frontend surface (app / website / docs). */\n frontendServiceName: AuditExportDisclosureTier.CONTEXT,\n /** A tenant LABEL. A legal person is not a data subject, but it is still the tenant's to withhold. */\n organizationName: AuditExportDisclosureTier.CONTEXT,\n applicationId: AuditExportDisclosureTier.CONTEXT,\n applicationName: AuditExportDisclosureTier.CONTEXT,\n /** How the principal authenticated. A mechanism, not an identity. */\n authMethod: AuditExportDisclosureTier.CONTEXT,\n /** Which identity source. A configuration reference. */\n authSource: AuditExportDisclosureTier.CONTEXT,\n providerRef: AuditExportDisclosureTier.CONTEXT,\n connectionType: AuditExportDisclosureTier.CONTEXT,\n\n // ── DETAIL ───────────────────────────────────────────────────────────────────────────────────\n /** The open per-event bag. Gated a second time by the event type's own disclosure class. */\n eventData: AuditExportDisclosureTier.DETAIL,\n /**\n * DETAIL, not CONTEXT, because it is not a field of its own — it is a value the dispatcher LIFTED\n * OUT of the bag (`eventData.failureReason || eventData.reason`), so it travels with the bag it\n * came from. The operator is `||` rather than `??`, which is not pedantry here: an EMPTY\n * `failureReason` falls through to `reason`, so an event can reach the free-text branch even when\n * it declares the enum-ish one.\n *\n * It was CONTEXT, classified by its shape: usually an enum-ish failure reason, which reads as\n * impersonal operational context. That was wrong in the direction that matters. **27** core event\n * schemas declare a top-level `failureReason` or `reason` — the two keys the dispatcher reads, so\n * that is the population — and **19** of them carry the operator-typed `reason`: the organization\n * lifecycle events, `EMERGENCY_ACCESS_USED`, `RETAINED_DATA_ACCESS` (whose `reason` is required\n * and is the #954 operator justification), `USER_PASSWORD_RESET_FORCED`,\n * `RESOURCE_OPERATION_PERFORMED`. The organization-lifecycle entries in the event-data map below\n * give that free text as the WHOLE reason their bags are `SUBJECT_DETAIL`. So the contract\n * refused those bags and then handed their prose over anyway, through a field labelled context.\n *\n * The cost of the correction is real and is the right way round: a tenant that withholds detail\n * now also loses the ordinary enum-shaped failure reason on, say, `USER_LOGIN_FAILED`. It can get\n * it back by admitting `DETAIL` with `ADMINISTRATIVE` bags, and a reason it cannot have is one\n * that may name somebody.\n */\n outcomeReason: AuditExportDisclosureTier.DETAIL,\n} as const satisfies AuditExportFieldDisclosureContract;\n\n/** One envelope field name, as the disclosure contract names it. */\nexport type AuditExportEnvelopeField = keyof typeof AUDIT_EXPORT_FIELD_DISCLOSURE;\n\n/** Envelope fields this contract permits a destination to trim. */\ntype TrimmableEnvelopeField = {\n [F in AuditExportEnvelopeField]: (typeof AUDIT_EXPORT_FIELD_DISCLOSURE)[F] extends AuditExportDisclosureTier.FLOOR\n ? never\n : F;\n}[AuditExportEnvelopeField];\n\n/**\n * Envelope fields the TYPE declares OPTIONAL — the ones `delete` can honestly remove.\n *\n * ## `{} extends Pick<T, F>` is the optionality test, and `undefined extends T[F]` is NOT\n *\n * **This package compiles with `strict: false`, so `strictNullChecks` is OFF, and under that\n * setting `undefined` is assignable to every type.** `undefined extends string` is therefore TRUE\n * here, every field maps to `never`, the intersection below is empty for every input, and a guard\n * built on it reports success no matter what anyone classifies. That is not a subtlety of the\n * formulation — it is the whole test collapsing.\n *\n * This guard shipped in exactly that state and was caught by mutating it: with `sourceEnvironment`\n * deliberately mis-declared as trimmable, the `undefined extends` version typechecked clean.\n *\n * **Two plausible culprits were proposed for it and BOTH were wrong**, which is why the real cause\n * is spelled out rather than summarised. It is not `-?` \"stripping `undefined` from the property\n * type\", and it is not indexing through `Required<E>` — measured against this very envelope type,\n * the `-?` form, the `Required<E>` form and a bare form are ALL `never`, because the `undefined\n * extends` test cannot discriminate under this tsconfig regardless of how it is spelled.\n *\n * `Pick` survives because it tests the optional MODIFIER, which exists in the type's syntax and is\n * unaffected by `strictNullChecks`. The outer `-?` is doing an unrelated job: it stops the indexed\n * access from adding `undefined` to the result union.\n *\n * **Generalise it: in any package here without `strictNullChecks`, a type-level test of the shape\n * `undefined extends X` is vacuously true and silently useless.** Most engine packages are in that\n * state. Reach for a modifier-based test, and mutate the guard before believing it.\n */\ntype OmittableEnvelopeField = {\n [F in keyof SecurityAuditEventEnvelope]-?: Record<never, never> extends Pick<SecurityAuditEventEnvelope, F>\n ? F\n : never;\n}[keyof SecurityAuditEventEnvelope];\n\n/** Envelope fields the TYPE requires — a value that cannot simply be deleted. */\ntype RequiredEnvelopeField = Exclude<keyof SecurityAuditEventEnvelope, OmittableEnvelopeField>;\n\n/**\n * Any field that is trimmable AND required — i.e. one {@link applyAuditExportProjection} could not\n * honestly remove. `eventData` is the one legitimate member of that intersection: it is required by\n * the envelope type and is emptied to `{}` rather than deleted, which every wire format already\n * reads as \"no detail\" (both text grammars omit the key for an empty bag, and OCSF omits `unmapped`).\n */\ntype TrimmableFieldThatCannotBeOmitted = Exclude<Extract<TrimmableEnvelopeField, RequiredEnvelopeField>, 'eventData'>;\n\n/**\n * COMPILE-TIME GUARD, not a runtime value — the constant is never read.\n *\n * It fails to typecheck, naming the offending field, if anyone classifies a REQUIRED envelope field\n * as trimmable. That is the one way this contract could promise a minimisation it cannot perform:\n * the applier would leave the field in place and a tenant would receive data it declared it would\n * not. The failure is silent at runtime and total at compile time, which is the right way round.\n *\n * If a new required field genuinely must be trimmable, make it optional on the envelope (every\n * wire-format render already guards for absence, for the DLQ-replay reason) rather than widening\n * this guard.\n */\nexport const AUDIT_EXPORT_TRIMMABLE_FIELDS_ARE_OMITTABLE: [TrimmableFieldThatCannotBeOmitted] extends [never]\n ? true\n : TrimmableFieldThatCannotBeOmitted = true;\n\n/**\n * Every core auditable event's `eventData` disclosure class — the EVENT-TYPE half of the contract.\n *\n * **Total over `CoreAuditableEventType`**, so a member added to the vocabulary is a compile error\n * until its author answers the question. That totality is the whole reason this is a map rather\n * than a per-destination list: a destination enumerating event types is a hand-kept list against a\n * vocabulary that moves, and a newly-added event would silently export everything or nothing\n * depending on which way its default fell.\n *\n * **Unverified entries are {@link AuditExportEventDataDisclosure.SUBJECT_DETAIL}, deliberately.**\n * Only the events below carry `ADMINISTRATIVE`, and each was classified by READING its\n * `eventData` schema and confirming it holds configuration or counts and no free text. Everything\n * else takes the fail-closed answer — including events whose bag is very likely harmless — because\n * the cost of being wrong in that direction is a tenant losing detail it could have had, while the\n * other direction discloses personal data to a destination that asked not to receive it.\n *\n * An application's OWN event types are not in this map and resolve to `SUBJECT_DETAIL` through\n * {@link resolveEventDataDisclosure}, for the same reason.\n */\nexport const AUDIT_EXPORT_EVENT_DATA_DISCLOSURE: Record<CoreAuditableEventType, AuditExportEventDataDisclosure> = {\n // ── Authentication ───────────────────────────────────────────────────────────────────────────\n // Every bag here carries some combination of email, IP, user-agent and session id.\n [CoreAuditableEventType.USER_LOGIN]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.USER_LOGOUT]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.USER_LOGIN_FAILED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.USER_ACCOUNT_LOCKED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.USER_PASSWORD_CHANGED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.USER_MFA_ENABLED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.USER_MFA_DISABLED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.USER_SESSION_EXPIRED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.USER_SESSION_EVICTED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.MACHINE_AUTH_SUCCESS]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.MACHINE_AUTH_FAILED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.MACHINE_ACCESS]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n\n // ── User lifecycle ───────────────────────────────────────────────────────────────────────────\n [CoreAuditableEventType.USER_CREATED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.USER_UPDATED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.USER_DELETED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.USER_APP_ROLES_CHANGED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n\n /**\n * VERIFIED ADMINISTRATIVE: counts, the conferring role names, and the statuses that count as\n * usable. The event is about the APPLICATION having no administrator; it names no person.\n */\n [CoreAuditableEventType.APPLICATION_SUPER_ADMIN_FLOOR_BREACHED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,\n // Its organization twin is NOT administrative: the bag carries `reducedMemberIds` and\n // `subjectUserId`, which is a list of people rather than the envelope's single actor reference.\n [CoreAuditableEventType.ORGANIZATION_OWNER_FLOOR_BREACHED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n\n // ── Organization lifecycle ───────────────────────────────────────────────────────────────────\n // Read, and NOT administrative — but by THREE different routes, which an earlier version of this\n // comment flattened into one (\"every one of these bags carries an operator-typed `reason`\").\n // Measured, that was false for three of the nine, and a rationale that overstates its own\n // evidence is the invented-denominator shape `derive-before-you-ask.md` warns about — sitting,\n // here, inside the justification that a later fix leaned on.\n //\n // - MOST carry an operator-typed `reason` / `justification` / `suspensionReason`: free text that\n // may name anybody. `_DELETED`, `_DELETION_REQUESTED`, `_RESTORED`, `_ACTIVATED`,\n // `_TYPE_ASSIGNED`, `_SUSPENDED`, `RESOURCE_STATUS_TRANSITION_PERFORMED`.\n // - `ORGANIZATION_UPDATED` carries `changes: z.record(z.string(), z.any())` — an OPEN bag, which\n // cannot be asserted to hold no data about a person. Same argument that reclassified\n // `ORGANIZATION_SSO_CONFIGURATION_CHANGED` below.\n // - `ORGANIZATION_CREATED` carries only `name`, `slug` and `createdBy`, and is SUBJECT_DETAIL on\n // the fail-closed default alone — no free text, no open bag, simply not verified as safe. That\n // is the honest entry, and naming it as such is what stops the next reader assuming the whole\n // group was measured.\n [CoreAuditableEventType.ORGANIZATION_CREATED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.ORGANIZATION_UPDATED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.ORGANIZATION_TYPE_ASSIGNED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.ORGANIZATION_DELETED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.ORGANIZATION_DELETION_REQUESTED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.ORGANIZATION_RESTORED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.ORGANIZATION_SUSPENDED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.ORGANIZATION_ACTIVATED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.RESOURCE_STATUS_TRANSITION_PERFORMED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n\n // ── Organization membership ──────────────────────────────────────────────────────────────────\n // Membership bags name the member, the inviter and the roles — people, throughout.\n [CoreAuditableEventType.ORGANIZATION_MEMBER_INVITED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.ORGANIZATION_MEMBER_JOINED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.ORGANIZATION_MEMBER_UPDATED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.ORGANIZATION_MEMBER_ROLE_CHANGED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.ORGANIZATION_MEMBER_STATUS_CHANGED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.ORGANIZATION_MEMBER_REMOVED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.ORGANIZATION_NOTIFICATIONS_UPDATED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.ORGANIZATION_PREFERENCES_UPDATED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.ORGANIZATION_PROFILE_UPDATED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.ORGANIZATION_UNIT_UPDATED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.ORGANIZATION_UNIT_MEMBER_ROLE_CHANGED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.ORGANIZATION_UNIT_MEMBER_REMOVED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n\n // ── SSO authentication ───────────────────────────────────────────────────────────────────────\n [CoreAuditableEventType.USER_SSO_LOGIN]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.USER_SSO_LOGIN_FAILED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.USER_SSO_ENFORCEMENT_BLOCKED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.USER_TOKEN_REFRESHED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n\n // ── Organization security configuration ──────────────────────────────────────────────────────\n /**\n * SUBJECT_DETAIL, and it was ADMINISTRATIVE for one review cycle on the stated grounds \"a config\n * diff, its change type and the provider ref. No free text.\" The diff is\n * `changes: z.record(z.string(), z.any())` — an UNBOUNDED OPEN BAG, which cannot be asserted to\n * hold no data about a person whatever it happens to contain today. The same source file names\n * that exact shape as the one an audit payload must not have.\n *\n * The reclassification costs nothing measurable and is worth reading as a warning: the event has\n * **no emitter anywhere in production source** (its emit method was removed in #591), so the\n * \"verification\" behind the original entry was a reading of a schema that nothing populates. An\n * open record is unverifiable by construction — fail closed and say so.\n */\n [CoreAuditableEventType.ORGANIZATION_SSO_CONFIGURATION_CHANGED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n /**\n * VERIFIED ADMINISTRATIVE: the three SIEM-export change events carry the tenant, the actor\n * reference, the change type, the destination's DOMAIN (never the full URL, never the\n * credential), the configured format and the names of the changed fields. Configuration\n * throughout, and no free text.\n *\n * They are also the events a retired destination receives as its LAST event (#986), so a\n * minimising tenant keeping them is exactly the intended outcome.\n */\n [CoreAuditableEventType.ORGANIZATION_SIEM_EXPORT_CONFIGURED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,\n [CoreAuditableEventType.ORGANIZATION_SIEM_EXPORT_DISABLED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,\n [CoreAuditableEventType.ORGANIZATION_SIEM_EXPORT_DESTINATION_CHANGED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,\n\n // ── Provider credentials and connections ─────────────────────────────────────────────────────\n // No payload here carries a credential VALUE — that is structural. But the user-scoped half names\n // a person's relationship with a named vendor, and the organization-scoped half carries the\n // account and scopes a principal authorized, so both are subject detail.\n [CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_SET]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_ROTATED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_USED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_DELETED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_SET]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_ROTATED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_USED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_DELETED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.ORGANIZATION_PROVIDER_CONNECTION_GRANTED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.USER_PROVIDER_CONNECTION_GRANTED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n\n // ── Application security configuration ───────────────────────────────────────────────────────\n /**\n * VERIFIED ADMINISTRATIVE: the changed user types, a snapshot digest, and the before/after policy\n * blocks. Authored configuration with no human actor at all — the event is emitted at boot.\n */\n [CoreAuditableEventType.APPLICATION_AUTH_POLICY_CHANGED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,\n\n // ── Outbound webhook ─────────────────────────────────────────────────────────────────────────\n /**\n * VERIFIED ADMINISTRATIVE: the dispatching actor reference, the endpoint id, the destination\n * HOST, the outcome and a duration. An operator-supplied URL is configuration, not a person.\n */\n [CoreAuditableEventType.WEBHOOK_ENDPOINT_TEST_DISPATCHED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,\n\n // ── SCIM directory provisioning ──────────────────────────────────────────────────────────────\n // Provisioning is ABOUT people by definition; the token events ride the same lane and are not\n // separately verified.\n [CoreAuditableEventType.SCIM_TOKEN_CREATED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.SCIM_TOKEN_REVOKED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.SCIM_TOKEN_GENERATED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.SCIM_TOKEN_ROTATED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.SCIM_PROVISIONING_CONFIG_UPDATED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.SCIM_PROVISIONING_FAILED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.SCIM_USER_PROVISIONED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.SCIM_USER_UPDATED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.SCIM_USER_DEACTIVATED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n\n // ── Credential and factor lifecycle ──────────────────────────────────────────────────────────\n // Every bag names the person whose credential or factor moved.\n [CoreAuditableEventType.USER_PASSWORD_RESET_REQUESTED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.USER_PASSWORD_RESET_COMPLETED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.USER_PASSWORD_RESET_FORCED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.USER_REGISTERED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.USER_EMAIL_VERIFIED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.USER_VERIFICATION_EMAIL_RESENT]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.USER_PASSWORD_SET]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.USER_TOTP_DISABLED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.USER_IDENTITY_LINK_REMOVED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.USER_MFA_SETUP_STARTED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.USER_MFA_SETUP_COMPLETED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.USER_MFA_EMAIL_OTP_SENT]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.USER_PASSKEY_REGISTERED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.USER_PASSKEY_AUTHENTICATION_SUCCESS]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.USER_PASSKEY_AUTHENTICATION_FAILURE]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.USER_PASSKEY_REMOVED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.USER_PASSKEY_CLONE_SUSPECTED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.USER_MAGIC_LINK_SENT]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.USER_MAGIC_LINK_VERIFIED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.USER_MAGIC_LINK_FAILED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.USER_SMS_OTP_SENT]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.USER_SMS_OTP_VERIFIED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.USER_SMS_OTP_FAILED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.USER_PHONE_VERIFIED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.USER_PHONE_VERIFICATION_FAILED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n\n // ── SAML ─────────────────────────────────────────────────────────────────────────────────────\n // None of these has a typed eventData schema, so nothing can be verified about their bags. The\n // two that LOOK administrative (`SAML_CERT_EXPIRING`, `SAML_METADATA_PARSED`) are exactly the\n // entries a guess would get wrong, and are fail-closed with the rest.\n [CoreAuditableEventType.SAML_LOGIN_INITIATED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.SAML_LOGIN_SUCCESS]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.SAML_LOGIN_FAILED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.SAML_ASSERTION_REPLAY_DETECTED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.SAML_CERT_EXPIRING]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.SAML_SLO_INITIATED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.SAML_SLO_COMPLETED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.SAML_METADATA_PARSED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.SAML_EMAIL_CHANGED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n\n // ── OAuth / OIDC provider ────────────────────────────────────────────────────────────────────\n [CoreAuditableEventType.OAUTH2_PROVIDER_BLOCKED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.OIDC_ACR_DEMAND_UNSATISFIED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.OAUTH_DELEGATED_TOKEN_ISSUED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.OAUTH_CONSENT_GRANTED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.OAUTH_CONSENT_DENIED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.OAUTH_CONSENT_GRANT_PERSISTED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.OAUTH_DYNAMIC_CLIENT_REGISTERED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.OAUTH_CIMD_CLIENT_REFUSED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.OAUTH_TOKEN_REFRESHED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.OAUTH_TOKEN_REVOKED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.OAUTH_RP_INITIATED_LOGOUT]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.OAUTH_CODE_EXCHANGE_FAILED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.OAUTH_CONSENT_BINDING_VIOLATION]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.USER_REFRESH_TOKEN_REUSE_DETECTED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n\n // ── Files and one-off tokens ─────────────────────────────────────────────────────────────────\n [CoreAuditableEventType.FILE_UPLOAD_GRANT_ISSUED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.FILE_UPLOAD_GRANT_REDEEMED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.FILE_UPLOAD_GRANT_REVOKED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.FILE_SHARE_LINK_ISSUED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.FILE_SHARE_LINKS_REVOKED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.FILE_MALWARE_DETECTED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.FILE_MALWARE_SCAN_FAILED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.ONE_OFF_TOKEN_CREATED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.ONE_OFF_TOKEN_EXCHANGED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.ONE_OFF_TOKEN_REVOKED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.USER_CROSS_FRONTEND_HANDOFF_ISSUED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n\n // ── Access, disclosure and administrative reach ──────────────────────────────────────────────\n // The generic resource and field events carry whatever the operation touched, including\n // before/after values of `.isAuditEvidence()` fields — the broadest bags in the vocabulary.\n [CoreAuditableEventType.EMERGENCY_ACCESS_USED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.FIELD_ACCESS]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.RESOURCE_OPERATION_PERFORMED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.RESOURCE_OPERATION_DENIED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.CROSS_TENANT_ADMINISTRATIVE_ACCESS]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.PLATFORM_ACCESS_GRANT_LIFECYCLE]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.PLATFORM_DIRECTORY_ACCESS]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.SYSTEM_CONTEXT_READ]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.SYSTEM_CONTEXT_WRITE]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.PLATFORM_CONFIGURATION_PUBLICATION]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.RETAINED_DATA_ACCESS]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.GOVERNED_DOCUMENT_INTERACTION_RECORDED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.SUBJECT_DATA_EXPORT]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.COLLECTION_DATA_EXPORT]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n\n // ── External integration ─────────────────────────────────────────────────────────────────────\n [CoreAuditableEventType.HTTP_API_READ_THROUGH_ACCESS]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.HTTP_API_EXTERNAL_ERASURE]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.HTTP_API_NON_ERASURE_ACKNOWLEDGED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.PROVIDER_OPERATION_CALL]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.PROVIDER_OPERATION_DENIED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.MCP_TOOL_CALL]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n [CoreAuditableEventType.AGENT_TOOL_APPROVAL_MODIFIED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n /*\n * Everything else in this bag IS configuration — the transition, the assignment row, the declared\n * instance, the remote partition key, and the units on either side of the move. On those alone it\n * would be ADMINISTRATIVE.\n *\n * `justification` decides it. The operator's stated reason is FREE TEXT a person wrote, recorded on\n * every transition, and free text may name anyone — which is this vocabulary's own criterion for\n * SUBJECT_DETAIL rather than a cautious reading of it. `assignedByUserId` is only the actor the\n * envelope already implies and would not have been enough on its own.\n */\n [CoreAuditableEventType.SYSTEM_OF_RECORD_PARTITION_ASSIGNMENT_LIFECYCLE]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n};\n\n/**\n * What one DESTINATION has declared it may receive — the per-tenant, per-agreement half.\n *\n * Two arrays rather than one, and the interaction between them is the reason. A tenant that drops\n * {@link AuditExportDisclosureTier.ATTRIBUTION} while keeping the detail bag would still receive\n * the email address inside `eventData` for every authentication event — a minimisation that reads\n * as a control and is not one. {@link disclosedEventDataClasses} is what closes that: declaring\n * `[ADMINISTRATIVE]` keeps the bags that carry configuration and drops the ones that carry people.\n */\n/*\n * Both members declare `.systemEnum(...)` ON THE ELEMENT, which is where the decorator goes for an\n * array of enums (`organizationPreferences.supportedLanguages` is the precedent).\n *\n * Without it these two vocabularies would get words authored per FIELD PATH rather than once per\n * enum, and a reader of the SIEM pane would be choosing between raw wire values like\n * `subject-detail` — see `.claude/rules/display-text-comes-from-i18n.md`. A new closed vocabulary\n * reaching a UI is exactly the moment to declare it; the words themselves are authored by the\n * labelling pipeline under `system_enums.<Name>.<value>` and are never hand-written here.\n */\nexport const SiemExportProjectionDeclarationSchema = z.object({\n /**\n * Which tiers, beyond the floor, this destination may receive.\n *\n * **`FLOOR` is not a choice, so it is not offered.** The floor is added unconditionally by\n * {@link resolveDisclosedEnvelopeFields}, and declaring `[]` yields a floor-only feed rather than\n * an empty one.\n *\n * This used to accept the whole vocabulary, on the reasoning that declaring `FLOOR` was\n * \"redundant rather than wrong\". That was true of the API and false of the SCREEN: the settings\n * pane renders one checkbox per member, so it offered a `floor` toggle — and on every destination\n * that had not ticked it, displayed it UNCHECKED. An operator reading \"floor ☐\" believes the event\n * id, type, timestamp and user id are withheld, and none of them is. That is the exact shape this\n * contract exists to remove — a control that renders and does nothing — and it was found by\n * opening the pane in a browser, not by any test (#1395).\n *\n * Derived from the one named vocabulary with `.exclude(['FLOOR'])` rather than declared as a\n * second enum: the tiers a destination may choose are a SUBSET of the tiers a field may have, and\n * a parallel list would be a second copy to keep in step. The key is type-checked against the\n * enum, so renaming the member is a compile error here rather than a silent drift.\n *\n * Defaults to everything: a destination that has declared no minimisation has not asked for one,\n * and silently narrowing an existing tenant's feed would be a worse failure than not narrowing a\n * new one.\n */\n disclosedTiers: z.array(z.enum(AuditExportDisclosureTier).exclude(['FLOOR']).systemEnum('AuditExportDisclosureTier')).default([\n AuditExportDisclosureTier.ATTRIBUTION,\n AuditExportDisclosureTier.CONTEXT,\n AuditExportDisclosureTier.DETAIL,\n ]),\n /**\n * Which `eventData` bags this destination may receive, by the EVENT TYPE's declared class. Read\n * only when {@link AuditExportDisclosureTier.DETAIL} is disclosed; an event type outside the core\n * vocabulary resolves to `SUBJECT_DETAIL`.\n */\n disclosedEventDataClasses: z.array(z.enum(AuditExportEventDataDisclosure).systemEnum('AuditExportEventDataDisclosure')).default([\n AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n AuditExportEventDataDisclosure.ADMINISTRATIVE,\n ]),\n});\n\nexport type AuditExportProjectionDeclaration = z.infer<typeof SiemExportProjectionDeclarationSchema>;\n\n/**\n * The projection a destination that has declared nothing receives: everything.\n *\n * FAIL-OPEN, deliberately, and it is the one place in this contract where that is right. An absent\n * declaration is not a tenant asking for minimisation — it is a tenant that has not configured one,\n * and every existing destination is in that state. Failing closed here would silently stop\n * delivering fields to feeds that are working today, which is a bigger and quieter harm than\n * continuing the current behaviour until an operator narrows it deliberately.\n */\nexport const FULL_AUDIT_EXPORT_PROJECTION: AuditExportProjectionDeclaration = {\n disclosedTiers: [\n AuditExportDisclosureTier.ATTRIBUTION,\n AuditExportDisclosureTier.CONTEXT,\n AuditExportDisclosureTier.DETAIL,\n ],\n disclosedEventDataClasses: [\n AuditExportEventDataDisclosure.SUBJECT_DETAIL,\n AuditExportEventDataDisclosure.ADMINISTRATIVE,\n ],\n};\n\n/**\n * What an event type's `eventData` bag carries, including for event types an APPLICATION defined.\n *\n * An unknown type resolves to {@link AuditExportEventDataDisclosure.SUBJECT_DETAIL} — the opposite\n * direction from `getAuditEventClassification`, whose fallback exists to give an application event\n * a usable category. Here the fallback decides a DISCLOSURE, so it takes the safe answer: an\n * application's own bag is the one this framework knows least about.\n */\nexport function resolveEventDataDisclosure(eventType: string): AuditExportEventDataDisclosure {\n return (\n AUDIT_EXPORT_EVENT_DATA_DISCLOSURE[eventType as CoreAuditableEventType]\n ?? AuditExportEventDataDisclosure.SUBJECT_DETAIL\n );\n}\n\n/**\n * The envelope fields one destination may receive for one event.\n *\n * The floor is unioned in unconditionally — **this is where \"a floor cannot be trimmed\" is\n * enforced**, not in the applier and not in the schema's defaults, so no declaration a tenant can\n * write and no future caller can produce a feed without it.\n *\n * assurance-control: WILDO.PRIVACY.DATA_MINIMIZATION — the destination's declaration decides which\n * envelope fields may leave for an external processor, and the floor is the part of that decision\n * the framework keeps: a record that cannot be correlated or de-duplicated is not a minimised\n * export.\n */\nexport function resolveDisclosedEnvelopeFields(\n eventType: string,\n declaration: AuditExportProjectionDeclaration,\n): ReadonlySet<AuditExportEnvelopeField> {\n const disclosedTiers = new Set(declaration.disclosedTiers);\n const eventDataAdmitted =\n disclosedTiers.has(AuditExportDisclosureTier.DETAIL)\n && declaration.disclosedEventDataClasses.includes(resolveEventDataDisclosure(eventType));\n\n const disclosed = new Set<AuditExportEnvelopeField>();\n for (const [field, tier] of Object.entries(AUDIT_EXPORT_FIELD_DISCLOSURE) as readonly [\n AuditExportEnvelopeField,\n AuditExportDisclosureTier,\n ][]) {\n if (tier === AuditExportDisclosureTier.FLOOR) {\n disclosed.add(field);\n continue;\n }\n if (tier === AuditExportDisclosureTier.DETAIL) {\n if (eventDataAdmitted) disclosed.add(field);\n continue;\n }\n if (disclosedTiers.has(tier)) disclosed.add(field);\n }\n return disclosed;\n}\n\n/**\n * Apply a destination's projection to an envelope, returning the envelope that may actually leave.\n *\n * Returns a NEW object — the caller fans one audit event out to several tenants' sinks, each with\n * its own declaration, so mutating in place would let the first destination's minimisation reach\n * the second's delivery.\n *\n * **Omitted is not empty**, which the CEF `csN` slots make more than a nicety: a trimmed optional\n * field is DELETED, so a render that guards `e.x ? … : undefined` emits neither the value nor its\n * `csNLabel` companion. `eventData` is the one exception — it is required by the envelope type, so\n * it is emptied to `{}`, which every format already reads as \"no detail\" (both text grammars omit\n * their detail key for an empty bag; OCSF omits `unmapped` for the same reason). The compile-time\n * guard {@link AUDIT_EXPORT_TRIMMABLE_FIELDS_ARE_OMITTABLE} is what keeps that exception the only\n * one.\n *\n * assurance-control: WILDO.PRIVACY.DATA_MINIMIZATION — the act itself: only the fields the\n * destination's declaration admits survive into the envelope that is signed, queued and delivered\n * to a third-party processor of the tenant's choosing.\n */\nexport function applyAuditExportProjection(\n envelope: SecurityAuditEventEnvelope,\n declaration: AuditExportProjectionDeclaration,\n): SecurityAuditEventEnvelope {\n const disclosed = resolveDisclosedEnvelopeFields(envelope.eventType, declaration);\n const projected: SecurityAuditEventEnvelope = { ...envelope };\n\n for (const field of Object.keys(AUDIT_EXPORT_FIELD_DISCLOSURE) as readonly AuditExportEnvelopeField[]) {\n if (disclosed.has(field)) continue;\n if (field === 'eventData') {\n projected.eventData = {};\n continue;\n }\n // Every other trimmable field is optional on the envelope — see the compile-time guard above.\n delete (projected as Record<string, unknown>)[field];\n }\n\n return projected;\n}\n"]}

package/dist/esm/compliance/audit-trails/audit-log-sink.shared.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"audit-log-sink.shared.schemas.d.ts","sourceRoot":"","sources":["~~../../../../~~src/compliance/audit-trails/audit-log-sink.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAEvE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAA;CAAE,CAAC;AAE3E;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,qBAAqB,GAAG,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;AAEhE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,WAAW,YAAY;IAC3B;;;;;;;;;;OAUG;IACH,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE;;;;OAIG;IACH,QAAQ,CAAC,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnC;AAED;;;;;;;GAOG;AACH,oBAAY,0BAA0B;IACpC,2EAA2E;IAC3E,QAAQ,aAAa;IACrB,0GAA0G;IAC1G,MAAM,WAAW;IACjB,oGAAoG;IACpG,QAAQ,aAAa;IACrB,yGAAyG;IACzG,YAAY,iBAAiB;CAC9B;AAED;;;;GAIG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,EAAE,OAAO,CAAC;IAClB,4FAA4F;IAC5F,MAAM,EAAE,0BAA0B,CAAC;IACnC,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;OAGG;IACH,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;CACxE;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,6BAA6B;IAC5C,qHAAqH;IACrH,2BAA2B,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACtD,qFAAqF;IACrF,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1D"}
1	+ {"version":3,"file":"audit-log-sink.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/audit-trails/audit-log-sink.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAEvE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAA;CAAE,CAAC;AAE3E;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,qBAAqB,GAAG,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;AAEhE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,WAAW,YAAY;IAC3B;;;;;;;;;;OAUG;IACH,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE;;;;OAIG;IACH,QAAQ,CAAC,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnC;AAED;;;;;;;GAOG;AACH,oBAAY,0BAA0B;IACpC,2EAA2E;IAC3E,QAAQ,aAAa;IACrB,0GAA0G;IAC1G,MAAM,WAAW;IACjB,oGAAoG;IACpG,QAAQ,aAAa;IACrB,yGAAyG;IACzG,YAAY,iBAAiB;CAC9B;AAED;;;;GAIG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,EAAE,OAAO,CAAC;IAClB,4FAA4F;IAC5F,MAAM,EAAE,0BAA0B,CAAC;IACnC,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;OAGG;IACH,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;CACxE;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,6BAA6B;IAC5C,qHAAqH;IACrH,2BAA2B,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACtD,qFAAqF;IACrF,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1D"}

package/dist/esm/compliance/audit-trails/audit-logs.shared.resources-config.schemas.d.ts CHANGED Viewed

@@ -42,7 +42,7 @@ export declare enum AuditLogs_ExportFormat {
 export declare const AuditLogs_ExportResponseDto: z.ZodObject<{
     records: z.ZodArray<z.ZodObject<{
         _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
-        eventId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
+        eventId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
         userId: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
         organizationId: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
         applicationId: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
@@ -69,7 +69,7 @@ export type AuditLogs_ExportResponseDtoType = z.infer<typeof AuditLogs_ExportRes
  */
 export declare const auditLogsResourceConfiguration_InitializationFactory: (resourcesRelationships: ResourceRelationship[]) => import("../..").ResourceConfiguration<typeof AuditLogs_Operations, CoreResourceOperation.READ | CoreResourceOperation.CREATE | CoreResourceOperation.LIST | CoreResourceOperation.SEARCH, z.ZodObject<{
     _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
-    eventId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
+    eventId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
     userId: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
     organizationId: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
     applicationId: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;

package/dist/esm/compliance/audit-trails/audit-logs.shared.resources-config.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"audit-logs.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["~~../../../../~~src/compliance/audit-trails/audit-logs.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAA6B,MAAM,kCAAkC,CAAC;AAErH,OAAO,EAAE,qBAAqB,EAAwD,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EACL,0BAA0B,EAE1B,oBAAoB,EAErB,MAAM,0CAA0C,CAAC;AAOlD,oBAAY,oBAAoB;IAC9B,iBAAiB,oBAAoB;CACtC;AAID,eAAO,MAAM,0BAA0B;;;;;;;;;;kBAa5B,CAAC;AAEZ,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAExF;;;;;;;;;;;GAWG;AACH,oBAAY,sBAAsB;IAChC,IAAI,SAAS;CACd;AAED;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;kBAI7B,CAAC;AAEZ,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAO1F;;;;;GAKG;AACH,eAAO,MAAM,oDAAoD,GAC/D,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;kBA8K9C,CAAC"}
1	+ {"version":3,"file":"audit-logs.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/audit-trails/audit-logs.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAA6B,MAAM,kCAAkC,CAAC;AAErH,OAAO,EAAE,qBAAqB,EAAwD,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EACL,0BAA0B,EAE1B,oBAAoB,EAErB,MAAM,0CAA0C,CAAC;AAOlD,oBAAY,oBAAoB;IAC9B,iBAAiB,oBAAoB;CACtC;AAID,eAAO,MAAM,0BAA0B;;;;;;;;;;kBAa5B,CAAC;AAEZ,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAExF;;;;;;;;;;;GAWG;AACH,oBAAY,sBAAsB;IAChC,IAAI,SAAS;CACd;AAED;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;kBAI7B,CAAC;AAEZ,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAO1F;;;;;GAKG;AACH,eAAO,MAAM,oDAAoD,GAC/D,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;kBA8K9C,CAAC"}

package/dist/esm/compliance/audit-trails/audit-trail-config.shared.schemas.d.ts CHANGED Viewed

@@ -72,7 +72,15 @@ import { z } from 'zod';
  * schema must not read. The schema `.min(1)` is the absolute floor; the runtime
  * validator raises it to 365 outside development.
  */
+/** Access posture for the deployment-wide audit viewer; tenant-scoped audit access is unchanged. */
+export declare enum AuditApplicationReadAccess {
+    /** Ordinary production default: the existing application super-administrator role is sufficient. Every cross-tenant read remains observed. */
+    ROLE_BASED = "role-based",
+    /** Additionally require a live time-bound application-wide grant approved by a different platform administrator. */
+    INDEPENDENT_APPROVAL = "independent-approval"
+}
 export declare const AuditTrailConfigSchema: z.ZodObject<{
+    applicationReadAccess: z.ZodOptional<z.ZodEnum<typeof AuditApplicationReadAccess>>;
     archiveAfterDays: z.ZodOptional<z.ZodNumber>;
     allowPrivateNetworkSiemCollectors: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>;

package/dist/esm/compliance/audit-trails/audit-trail-config.shared.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"audit-trail-config.shared.schemas.d.ts","sourceRoot":"","sources":["~~../../../../~~src/compliance/audit-trails/audit-trail-config.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwEG;AACH,eAAO,MAAM,sBAAsB~~;;;iBAsDjC~~,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,4DAA4D"}
1	+ {"version":3,"file":"audit-trail-config.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/audit-trails/audit-trail-config.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwEG;AACH,oGAAoG;AACpG,oBAAY,0BAA0B;IACpC,8IAA8I;IAC9I,UAAU,eAAe;IACzB,oHAAoH;IACpH,oBAAoB,yBAAyB;CAC9C;AAED,eAAO,MAAM,sBAAsB;;;;iBA6DjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,4DAA4D"}

package/dist/esm/compliance/audit-trails/audit-trail-config.shared.schemas.js CHANGED Viewed

@@ -72,7 +72,22 @@ import { z } from 'zod';
  * schema must not read. The schema `.min(1)` is the absolute floor; the runtime
  * validator raises it to 365 outside development.
  */
+/** Access posture for the deployment-wide audit viewer; tenant-scoped audit access is unchanged. */
+export var AuditApplicationReadAccess;
+(function (AuditApplicationReadAccess) {
+    /** Ordinary production default: the existing application super-administrator role is sufficient. Every cross-tenant read remains observed. */
+    AuditApplicationReadAccess["ROLE_BASED"] = "role-based";
+    /** Additionally require a live time-bound application-wide grant approved by a different platform administrator. */
+    AuditApplicationReadAccess["INDEPENDENT_APPROVAL"] = "independent-approval";
+})(AuditApplicationReadAccess || (AuditApplicationReadAccess = {}));
 export const AuditTrailConfigSchema = z.object({
+    /**
+     * Application audit viewer admission. Omitted means ROLE_BASED in every environment.
+     * INDEPENDENT_APPROVAL adds the existing independently approved elevation; it never substitutes for roles.
+     * Both policies keep immutable records, application/tenant filters and read observations. This does not
+     * change access to other application-wide resources or per-tenant administrative grants.
+     */
+    applicationReadAccess: z.enum(AuditApplicationReadAccess).optional(),
     /**
      * Age (in days) beyond which audit records are EXPORTED to durable archival
      * file-storage artifacts by the `compliance:audit-logs-archive` cron batch.

package/dist/esm/compliance/audit-trails/audit-trail-config.shared.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"audit-trail-config.shared.schemas.js","sourceRoot":"","sources":["../../../../src/compliance/audit-trails/audit-trail-config.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwEG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C;;;;;;;;;;;;;;;;OAgBG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IAE9D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACH,iCAAiC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC1D,CAAC,CAAC;AAGH,4DAA4D","sourcesContent":["import { z } from 'zod';\n\n/*\n @wildo_source:part:start saas.models.audit.trail-config facet:layer:shared facet:audience:app-developer\n \n `AuditTrailConfig` — application-level operator-tunable configuration for the\n * compliance audit-trail subsystem.\n \n ⚠️ `archiveAfterDays` IS the opt-in, and it never deletes anything. While it is unset the\n * archival job still runs and does nothing, and every audit record stays in the primary store\n * indefinitely — so an application that has never set it is accumulating, not rotating.\n \n Setting it does not shrink the primary store either. `AUDIT_LOGS` is immutable by invariant: it\n * has no UPDATE and no DELETE, so records older than the horizon are COPIED to durable archival\n * artifacts in file storage while the originals remain. The field is named `archiveAfterDays` rather\n * than `retentionDays` for exactly that reason — nothing is retained-then-deleted, and an operator\n * expecting the primary store to shrink has misread it.\n \n The decision is taken at each tick from live configuration, so changing the value takes effect\n * without a restart, and a misconfigured value cannot orphan the schedule. An application that turns\n * this on after it already has aged data seeds the archive with a one-off wider look-back run.\n \n Phase 5 / F1 (audit-logging plan). Mirrors {@link DataSeedingConfigSchema} /\n * {@link LifecycleConfigSchema} in shape and intent: a small, OPTIONAL block on\n * the shared application configuration ({@link AppConfiguration_Shared_Schema})\n * that tunes an engine-owned background batch — here the\n * `compliance:audit-logs-archive` cron batch — without forking the factory's\n * built-in defaults.\n \n It also carries the subsystem's one EGRESS posture\n * ({@link allowPrivateNetworkSiemCollectors}), which belongs to the operator rather\n * than to the tenant who authors a SIEM destination — see that field's own JSDoc\n * for why the distinction is the whole control.\n \n --------------------------------------------------------------------------\n * Archival, NOT deletion — audit logs are immutable\n * --------------------------------------------------------------------------\n * The `AUDIT_LOGS` resource is IMMUTABLE by invariant (G5): its\n * `coreOperations` are `READ \| LIST \| SEARCH \| CREATE` — there is NO `UPDATE`\n * and NO `DELETE`. The retention mechanism therefore NEVER removes audit\n * records from the primary store. Instead, records older than\n * {@link archiveAfterDays} are EXPORTED (copied) to durable off-DB archival\n * artifacts in file storage by the archival batch, while the original rows\n * remain in the always-on `AUDIT_LOGS` store (and, when configured, in the\n * append-only immudb tamper-proof ledger). This is why the field is named\n * `archiveAfterDays` and not `retentionDays`: nothing is retained-then-deleted;\n * the value is purely the ARCHIVAL HORIZON. (The distinction mirrors the\n * `archiveAfterDays` vs `retentionDays` split in the general\n * `DataRetentionPolicySchema`.)\n \n --------------------------------------------------------------------------\n * Why the config lives in `saas-models` (not next to the batch)\n * --------------------------------------------------------------------------\n * The runtime wiring (`StartApplicationBackendService.initialize`) and the\n * batch body read operator-tunable configuration EXCLUSIVELY from\n * `appConfigService.config?.` — i.e. the {@link AppConfiguration_Shared_Schema}\n aggregate. Placing the schema here (rather than in `saas-backend-lib` next to\n * the batch) keeps every operator-tunable engine batch symmetric with\n * `dataSeeding` / `lifecycle` and gives one source of truth the batch factory\n * and the startup validator can both import (`saas-models` cannot depend on\n * `saas-backend-lib` — the dependency arrow points the other way).\n \n --------------------------------------------------------------------------\n * Bounds + production floor\n * --------------------------------------------------------------------------\n * {@link archiveAfterDays} bounds mirror the SSO `auditConfig.retentionDays`\n * precedent (min 1 day, max 2555 ≈ 7 years). A stricter PRODUCTION FLOOR (365\n * days) is enforced at boot by\n * `ApplicationStartupConfigValidatorService.validate()` — NOT by a schema-level\n * `.min()` and NOT by a Zod `.superRefine()`, because the environment\n * (development vs staging/production) is a RUNTIME signal\n * (`process.env.APPLICATION_ENV`) that a pure, environment-agnostic shared\n * schema must not read. The schema `.min(1)` is the absolute floor; the runtime\n * validator raises it to 365 outside development.\n /\nexport const AuditTrailConfigSchema = z.object({\n /\n Age (in days) beyond which audit records are EXPORTED to durable archival\n * file-storage artifacts by the `compliance:audit-logs-archive` cron batch.\n \n Records are NEVER deleted from the primary `AUDIT_LOGS` store — this is the\n * archival horizon only (see the block-level JSDoc on why the field is\n * `archiveAfterDays`, not `retentionDays`).\n \n OPTIONAL — when omitted (`undefined`), NO archival runs and audit records\n * are retained in the primary store indefinitely. This is the compliance-safe\n * default: an operator must explicitly opt in before any archival happens.\n \n Bounds: min 1 / max 2555 (≈ 7 years), mirroring the SSO\n * `auditConfig.retentionDays` precedent. A production floor of 365 days is\n * enforced at boot (see block-level JSDoc) — setting a value below 365 in a\n * staging/production environment fails startup with a CONFIGURATION error.\n /\n archiveAfterDays: z.number().int().min(1).max(2555).optional(),\n\n /\n May a SIEM export deliver to a collector on an address the public internet cannot reach?\n \n ── What it is for ─────────────────────────────────────────────────────────\n * A SIEM webhook URL is TENANT-authored (`siemExportConfig.webhookUrl`, written by an organization\n * administrator) and the delivery worker POSTs to it with the deployment's own network position.\n * That is a server-side request forgery primitive by construction, and the classic targets are the\n * ones every guard in `security/ssrf` names: `169.254.169.254`, loopback admin ports, RFC 1918.\n \n But one legitimate deployment shape genuinely lives there: a self-hosted collector (Splunk,\n * QRadar, a syslog bridge) on the same private network as the application. Refusing that\n * unconditionally would not be \"safe\" — it would break a supported topology and push operators to\n * a worse workaround.\n \n ── Why it is an OPERATOR field and not a tenant field ─────────────────────\n * It lives HERE, on the application configuration the deployment operator authors, and NOT on\n * `SiemExportConfigBaseSchema`, which the tenant authors. A tenant-settable \"allow private\n * addresses\" flag would hand the party supplying the attacker-controlled URL the switch that\n * disarms the guard aimed at them — an SSRF bypass with a checkbox. The operator declares the\n * network posture; the tenant chooses a destination within it.\n \n ── Why OPTIONAL rather than `.default(false)` ─────────────────────────────\n * The reader tests for `=== true`, so absent is refuse, and the fail-closed posture is the one you\n * get by doing nothing — the same contract `archiveAfterDays` states one field above. It is left\n * without a Zod default so `AuditTrailConfigSchema.parse({})` still round-trips as `{}`; an\n * always-materialised `false` would make the block non-empty for every application that never\n * authored it, which is what the pin below this schema's tests exists to prevent.\n \n ── What it does NOT relax ─────────────────────────────────────────────────\n * Not the scheme policy, not the credentials-in-URL refusal, and not the PINNING: the delivery\n * still connects only to an address classified at the moment of connection. It widens WHICH\n * addresses are admitted, never whether the admitted address is the one connected to.\n /\n allowPrivateNetworkSiemCollectors: z.boolean().optional(),\n});\n\nexport type AuditTrailConfig = z.infer<typeof AuditTrailConfigSchema>;\n/* @wildo_source:part:end saas.models.audit.trail-config */\n"]}
1	+ {"version":3,"file":"audit-trail-config.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/audit-trails/audit-trail-config.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwEG;AACH,oGAAoG;AACpG,MAAM,CAAN,IAAY,0BAKX;AALD,WAAY,0BAA0B;IACpC,8IAA8I;IAC9I,uDAAyB,CAAA;IACzB,oHAAoH;IACpH,2EAA6C,CAAA;AAC/C,CAAC,EALW,0BAA0B,KAA1B,0BAA0B,QAKrC;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C;;;;;OAKG;IACH,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC,QAAQ,EAAE;IACpE;;;;;;;;;;;;;;;;OAgBG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IAE9D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACH,iCAAiC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC1D,CAAC,CAAC;AAGH,4DAA4D","sourcesContent":["import { z } from 'zod';\n\n/*\n @wildo_source:part:start saas.models.audit.trail-config facet:layer:shared facet:audience:app-developer\n \n `AuditTrailConfig` — application-level operator-tunable configuration for the\n * compliance audit-trail subsystem.\n \n ⚠️ `archiveAfterDays` IS the opt-in, and it never deletes anything. While it is unset the\n * archival job still runs and does nothing, and every audit record stays in the primary store\n * indefinitely — so an application that has never set it is accumulating, not rotating.\n \n Setting it does not shrink the primary store either. `AUDIT_LOGS` is immutable by invariant: it\n * has no UPDATE and no DELETE, so records older than the horizon are COPIED to durable archival\n * artifacts in file storage while the originals remain. The field is named `archiveAfterDays` rather\n * than `retentionDays` for exactly that reason — nothing is retained-then-deleted, and an operator\n * expecting the primary store to shrink has misread it.\n \n The decision is taken at each tick from live configuration, so changing the value takes effect\n * without a restart, and a misconfigured value cannot orphan the schedule. An application that turns\n * this on after it already has aged data seeds the archive with a one-off wider look-back run.\n \n Phase 5 / F1 (audit-logging plan). Mirrors {@link DataSeedingConfigSchema} /\n * {@link LifecycleConfigSchema} in shape and intent: a small, OPTIONAL block on\n * the shared application configuration ({@link AppConfiguration_Shared_Schema})\n * that tunes an engine-owned background batch — here the\n * `compliance:audit-logs-archive` cron batch — without forking the factory's\n * built-in defaults.\n \n It also carries the subsystem's one EGRESS posture\n * ({@link allowPrivateNetworkSiemCollectors}), which belongs to the operator rather\n * than to the tenant who authors a SIEM destination — see that field's own JSDoc\n * for why the distinction is the whole control.\n \n --------------------------------------------------------------------------\n * Archival, NOT deletion — audit logs are immutable\n * --------------------------------------------------------------------------\n * The `AUDIT_LOGS` resource is IMMUTABLE by invariant (G5): its\n * `coreOperations` are `READ \| LIST \| SEARCH \| CREATE` — there is NO `UPDATE`\n * and NO `DELETE`. The retention mechanism therefore NEVER removes audit\n * records from the primary store. Instead, records older than\n * {@link archiveAfterDays} are EXPORTED (copied) to durable off-DB archival\n * artifacts in file storage by the archival batch, while the original rows\n * remain in the always-on `AUDIT_LOGS` store (and, when configured, in the\n * append-only immudb tamper-proof ledger). This is why the field is named\n * `archiveAfterDays` and not `retentionDays`: nothing is retained-then-deleted;\n * the value is purely the ARCHIVAL HORIZON. (The distinction mirrors the\n * `archiveAfterDays` vs `retentionDays` split in the general\n * `DataRetentionPolicySchema`.)\n \n --------------------------------------------------------------------------\n * Why the config lives in `saas-models` (not next to the batch)\n * --------------------------------------------------------------------------\n * The runtime wiring (`StartApplicationBackendService.initialize`) and the\n * batch body read operator-tunable configuration EXCLUSIVELY from\n * `appConfigService.config?.` — i.e. the {@link AppConfiguration_Shared_Schema}\n aggregate. Placing the schema here (rather than in `saas-backend-lib` next to\n * the batch) keeps every operator-tunable engine batch symmetric with\n * `dataSeeding` / `lifecycle` and gives one source of truth the batch factory\n * and the startup validator can both import (`saas-models` cannot depend on\n * `saas-backend-lib` — the dependency arrow points the other way).\n \n --------------------------------------------------------------------------\n * Bounds + production floor\n * --------------------------------------------------------------------------\n * {@link archiveAfterDays} bounds mirror the SSO `auditConfig.retentionDays`\n * precedent (min 1 day, max 2555 ≈ 7 years). A stricter PRODUCTION FLOOR (365\n * days) is enforced at boot by\n * `ApplicationStartupConfigValidatorService.validate()` — NOT by a schema-level\n * `.min()` and NOT by a Zod `.superRefine()`, because the environment\n * (development vs staging/production) is a RUNTIME signal\n * (`process.env.APPLICATION_ENV`) that a pure, environment-agnostic shared\n * schema must not read. The schema `.min(1)` is the absolute floor; the runtime\n * validator raises it to 365 outside development.\n /\n/* Access posture for the deployment-wide audit viewer; tenant-scoped audit access is unchanged. /\nexport enum AuditApplicationReadAccess {\n /* Ordinary production default: the existing application super-administrator role is sufficient. Every cross-tenant read remains observed. /\n ROLE_BASED = 'role-based',\n /* Additionally require a live time-bound application-wide grant approved by a different platform administrator. /\n INDEPENDENT_APPROVAL = 'independent-approval',\n}\n\nexport const AuditTrailConfigSchema = z.object({\n /\n Application audit viewer admission. Omitted means ROLE_BASED in every environment.\n * INDEPENDENT_APPROVAL adds the existing independently approved elevation; it never substitutes for roles.\n * Both policies keep immutable records, application/tenant filters and read observations. This does not\n * change access to other application-wide resources or per-tenant administrative grants.\n /\n applicationReadAccess: z.enum(AuditApplicationReadAccess).optional(),\n /\n Age (in days) beyond which audit records are EXPORTED to durable archival\n * file-storage artifacts by the `compliance:audit-logs-archive` cron batch.\n \n Records are NEVER deleted from the primary `AUDIT_LOGS` store — this is the\n * archival horizon only (see the block-level JSDoc on why the field is\n * `archiveAfterDays`, not `retentionDays`).\n \n OPTIONAL — when omitted (`undefined`), NO archival runs and audit records\n * are retained in the primary store indefinitely. This is the compliance-safe\n * default: an operator must explicitly opt in before any archival happens.\n \n Bounds: min 1 / max 2555 (≈ 7 years), mirroring the SSO\n * `auditConfig.retentionDays` precedent. A production floor of 365 days is\n * enforced at boot (see block-level JSDoc) — setting a value below 365 in a\n * staging/production environment fails startup with a CONFIGURATION error.\n /\n archiveAfterDays: z.number().int().min(1).max(2555).optional(),\n\n /\n May a SIEM export deliver to a collector on an address the public internet cannot reach?\n \n ── What it is for ─────────────────────────────────────────────────────────\n * A SIEM webhook URL is TENANT-authored (`siemExportConfig.webhookUrl`, written by an organization\n * administrator) and the delivery worker POSTs to it with the deployment's own network position.\n * That is a server-side request forgery primitive by construction, and the classic targets are the\n * ones every guard in `security/ssrf` names: `169.254.169.254`, loopback admin ports, RFC 1918.\n \n But one legitimate deployment shape genuinely lives there: a self-hosted collector (Splunk,\n * QRadar, a syslog bridge) on the same private network as the application. Refusing that\n * unconditionally would not be \"safe\" — it would break a supported topology and push operators to\n * a worse workaround.\n \n ── Why it is an OPERATOR field and not a tenant field ─────────────────────\n * It lives HERE, on the application configuration the deployment operator authors, and NOT on\n * `SiemExportConfigBaseSchema`, which the tenant authors. A tenant-settable \"allow private\n * addresses\" flag would hand the party supplying the attacker-controlled URL the switch that\n * disarms the guard aimed at them — an SSRF bypass with a checkbox. The operator declares the\n * network posture; the tenant chooses a destination within it.\n \n ── Why OPTIONAL rather than `.default(false)` ─────────────────────────────\n * The reader tests for `=== true`, so absent is refuse, and the fail-closed posture is the one you\n * get by doing nothing — the same contract `archiveAfterDays` states one field above. It is left\n * without a Zod default so `AuditTrailConfigSchema.parse({})` still round-trips as `{}`; an\n * always-materialised `false` would make the block non-empty for every application that never\n * authored it, which is what the pin below this schema's tests exists to prevent.\n \n ── What it does NOT relax ─────────────────────────────────────────────────\n * Not the scheme policy, not the credentials-in-URL refusal, and not the PINNING: the delivery\n * still connects only to an address classified at the moment of connection. It widens WHICH\n * addresses are admitted, never whether the admitted address is the one connected to.\n /\n allowPrivateNetworkSiemCollectors: z.boolean().optional(),\n});\n\nexport type AuditTrailConfig = z.infer<typeof AuditTrailConfigSchema>;\n/* @wildo_source:part:end saas.models.audit.trail-config */\n"]}