@wildo-ai/saas-models 1.1.4 → 1.1.6

package/dist/esm/compliance/audit-trails/audit-export-projection.shared.schemas.js

@@ -0,0 +1,857 @@
+/**
+ * Audit-export projection — what a SIEM destination MAY receive, declared once.
+ *
+ * ## Why this exists at all, and why it is `_core` rather than a SIEM feature
+ *
+ * A tenant sending audit events to a third-party SIEM is sending them to a processor of its own
+ * choosing, in a jurisdiction of its own choosing. Data minimisation is that operator's duty, and
+ * until this contract existed the only place they could discharge it was AT THE RECEIVER — after
+ * the data had already left the building. An export that cannot be trimmed is an export some
+ * customers cannot lawfully switch on.
+ *
+ * The obvious-looking place to put the answer did not exist. The dispatcher assembles the envelope
+ * by hand-picking values off `auditEvent.eventData` (`userEmail: eventData.email`, and its
+ * neighbours), so there was no object to attach a projection to: the contract had to exist FIRST.
+ * Two accepted-and-ignored booleans (`includeRawEventData`, `includeDeviceContext`) had occupied
+ * the space and were removed in `be001548` precisely because a stored flag that changes nothing is
+ * worse than its absence — their own removal note says the capability they named "would be built on
+ * the envelope contract, not on two booleans beside the retry policy". This is that contract.
+ *
+ * ## This is NOT `.isAuditEvidence()`, and the two must never be merged
+ *
+ * `.isAuditEvidence()` decides which FIELD VALUES are copied INTO the immutable audit row. It
+ * answers *what must the application be able to prove to itself*, it is correct as it is, and its
+ * answer is deliberately maximal — the ledger is the evidence.
+ *
+ * This contract answers a different question with a different answer: *what may this application
+ * disclose to a processor of the tenant's choosing*. The two diverge by design. A row the ledger
+ * must retain forever is routinely a row a tenant's DPA forbids exporting, and one decorator
+ * meaning both would force the weaker answer onto the stronger obligation.
+ *
+ * ## Two declarations, and the ORDER between them is the design
+ *
+ * - **The EVENT TYPE declares what MAY leave** ({@link AUDIT_EXPORT_EVENT_DATA_DISCLOSURE}), total
+ *   over `CoreAuditableEventType`, so an event added tomorrow has to answer the question.
+ * - **The DESTINATION narrows it** ({@link AuditExportProjectionDeclaration}), per tenant and per
+ *   agreement, which is what a customer actually negotiates.
+ *
+ * The event-type half is built first and is not optional, because a destination cannot narrow a set
+ * nobody has enumerated: shipping only the destination half would mean the first tenant to
+ * configure one is choosing from an undeclared surface.
+ *
+ * ## The floor cannot be trimmed, and that is structural rather than advisory
+ *
+ * {@link AuditExportDisclosureTier.FLOOR} fields survive whatever a destination declares —
+ * {@link resolveDisclosedEnvelopeFields} unions them in unconditionally, so a declaration of `[]`
+ * still yields a correlatable event. Three independent reasons, and only the first is about
+ * privacy:
+ *
+ *  1. **`eventId` IS the receiver's dedup key** in every wire format (CEF `externalId`, LEEF
+ *     `eventId`, OCSF `metadata.uid`, `json_structured`'s top-level `eventId`), and the DLQ drain
+ *     re-sends a stored envelope. Minimise past it and the feed stops being idempotent against a
+ *     service that retries — a "minimised" export nobody can correlate is not a privacy win, it is
+ *     an unusable feed that still left the building.
+ *  2. **`eventType`, `severity` and `sourceVersion` are CEF/LEEF HEADER slots.** A header field
+ *     cannot be omitted without shifting every field after it, so trimming one does not minimise a
+ *     record — it corrupts it.
+ *  3. **The remaining floor members are the record's own identity** — when, in which tenant, by
+ *     which actor reference, with what outcome. A row that cannot say those things is not a
+ *     shorter audit event; it is not an audit event.
+ *
+ * `sourceEnvironment` is FLOOR and is the one member worth justifying, because it is neither an
+ * identity nor a header slot: it names the deployment environment (`production`), it is not data
+ * about any person, it is REQUIRED on the envelope type, and the CEF contract records it as the
+ * cheapest triage filter a SOC has. Trimming it would cost a receiver real capability and protect
+ * nobody.
+ *
+ * ## Applied ONCE, at the ENQUEUE SEAM — which is what makes every format consistent
+ *
+ * The projection is applied inside `AuditEventDispatcherBackendService.enqueueSiemWebhookDelivery`,
+ * before the F6 HMAC and before the job is enqueued. So the minimised envelope is the ONLY envelope
+ * that exists downstream: it is what is signed, what is queued, what a DLQ row stores, and what a
+ * drain replays.
+ *
+ * **The seam rather than the call site, and the difference is not stylistic.** It landed at the
+ * dispatch call site first, which left that public method able to enqueue an un-minimised envelope
+ * for any producer that found it — the one-of-N shape `invariant-call-site-enumeration.md` exists
+ * for, and live rather than hypothetical, since the batching lane is extending that very seam. The
+ * seam already owned the other two elements of the delivery contract (the HMAC and the batch ref);
+ * the projection is the third.
+ *
+ * Moving it also FIXED the dead-letter retry, which the call-site version could not: a drain
+ * re-enqueues stored bytes with a freshly loaded configuration, so a tenant that narrows its
+ * projection on discovering over-disclosure now has that narrowing reach rows already
+ * dead-lettered. Re-application is safe both ways, because the projection only ever DELETES.
+ *
+ * Four consequences, each of which would have been a separate defect had the projection been
+ * applied per-format instead:
+ *
+ *  - **All four wire formats carry it identically, for free.** Every CEF/LEEF render already guards
+ *    `e.x ? c.pair(...) : undefined` (for the DLQ-replay reason), and every OCSF assignment does the
+ *    same — so a trimmed field emits NO key rather than an empty one. That distinction is not
+ *    cosmetic in CEF: a `csN` slot is emitted as a `csNLabel`/`csN` PAIR, and an empty `cs4=` with
+ *    its label still present would tell a receiver the field exists and is blank. Absent is absent.
+ *  - **The DLQ stores less.** A dead-lettered delivery holds only what the destination was allowed
+ *    to receive, so a queue outage does not park un-minimised personal data.
+ *  - **A retry cannot drift from the attempt it continues** — the same property the single enqueue
+ *    seam already guards.
+ *  - **The HMAC covers the bytes that actually leave.**
+ *
+ * @see `.claude/context/audit-trails.md` — the SIEM wire-format projections this rides on top of.
+ */
+import { z } from 'zod';
+// Side-effect import: this module calls `.systemEnum()` at load, so the decorators must be
+// installed first — never by the importer's luck (#966). A named import used only as a type would
+// be elided and install nothing.
+import '@wildo-ai/zod-decorators';
+import { CoreAuditableEventType } from './auditable-events.shared.schema.js';
+/**
+ * What KIND of thing an envelope field is, for the purpose of deciding whether a destination may
+ * receive it.
+ *
+ * Deliberately a SMALL closed vocabulary rather than per-field switches on the destination. A DPA
+ * is negotiated in these terms — *"we will not send you identifiers of our users"* — and a tenant
+ * choosing from 27 field names would be choosing from an implementation detail that moves. The tiers
+ * are the stable surface; the field-to-tier assignment is the framework's judgement and is
+ * compile-enforced to be total.
+ */
+export var AuditExportDisclosureTier;
+(function (AuditExportDisclosureTier) {
+    /**
+     * Never trimmable, whatever a destination declares. The record's identity, its outcome, its
+     * actor reference, and the header slots the text grammars structurally require. See this module's
+     * header for the three independent reasons.
+     */
+    AuditExportDisclosureTier["FLOOR"] = "floor";
+    /**
+     * Who the person is and where they were — the personal-data surface of the envelope. The tier a
+     * tenant exporting to a processor in another jurisdiction most often wants dropped.
+     */
+    AuditExportDisclosureTier["ATTRIBUTION"] = "attribution";
+    /**
+     * Operational context that is not about a person: which request, which surface, which tenant
+     * label, which authentication mechanism, which identity source.
+     *
+     * Note what is NOT here: `outcomeReason`. It reads like context and is DETAIL, because it is
+     * lifted out of the event's own bag — see that tier's note.
+     */
+    AuditExportDisclosureTier["CONTEXT"] = "context";
+    /**
+     * Content that CAME FROM the per-event `eventData` bag — the bag itself, and any envelope field
+     * the dispatcher lifted out of it. Disclosure is decided a second time by the event type's own
+     * {@link AuditExportEventDataDisclosure}.
+     *
+     * **"Came from the bag" rather than "is the bag", and the difference was a real hole.** The
+     * dispatcher PROMOTES values onto the envelope — `outcomeReason` is
+     * `eventData.failureReason || eventData.reason` — so a promoted field classified by what it looks
+     * like (a short reason string, plausibly CONTEXT) outlives the bag it was copied from.
+     *
+     * **The population is defined by those two keys, because they are the only ones the dispatcher
+     * reads.** Measured over the core vocabulary: **27** event schemas declare a top-level
+     * `failureReason` or `reason` and can therefore put text into `outcomeReason`, and **19** of them
+     * carry the operator-typed `reason` — including every organization-lifecycle event whose
+     * `SUBJECT_DETAIL` classification rests on precisely that free text. A destination that withheld
+     * those bags was still receiving their prose.
+     *
+     * An earlier note said "22 … `reason` or `justification`", which is a real count of a population
+     * this field does not have: `justification` is never read here, so three of those 22 could not
+     * reach `outcomeReason` at all while eight schemas that can (`failureReason` only) were left out.
+     * Both numbers were arithmetically right and the denominator was chosen rather than derived —
+     * `derive-before-you-ask.md` Shape 2, inside the very rationale written to fix a leak.
+     *
+     * The operative rule is the general one: **a field's declared tier must be TRUE of every value it
+     * can carry.** `userEmail` is promoted from the bag too and is ATTRIBUTION, because every value it
+     * can hold is an address — the tier is true of all of them. `outcomeReason` is DETAIL because the
+     * tier CONTEXT was not true of the free-text values it can hold, and nothing narrower than the
+     * bag's own class can separate those from the enum-ish ones.
+     *
+     * So the practical test when adding a promoted field is not "where did it come from" alone — it
+     * is "can this field carry something its tier would be a lie about?". Where the answer is yes and
+     * the value comes from the bag, DETAIL is the only tier that can gate it honestly.
+     */
+    AuditExportDisclosureTier["DETAIL"] = "detail";
+})(AuditExportDisclosureTier || (AuditExportDisclosureTier = {}));
+/**
+ * What an event type's `eventData` bag CONTAINS — the event-type half of the contract.
+ *
+ * The question this answers is narrow on purpose: *does the bag carry content about a person,
+ * beyond the actor reference the envelope already carries?* It is asked of the EVENT TYPE because
+ * that is the only place it can be answered once — the bag is an open record whose shape is decided
+ * by the emitter, so no property of the envelope can decide it.
+ *
+ * Only TWO members, and the binary is the point: a third "it depends" member would be a place to
+ * put the entries nobody wanted to judge, and every entry that landed there would be read as safe.
+ */
+export var AuditExportEventDataDisclosure;
+(function (AuditExportEventDataDisclosure) {
+    /**
+     * The bag carries data ABOUT a person — an email address, an IP, a name, a value they supplied,
+     * or free text somebody wrote which may name anyone.
+     *
+     * **This is the fail-closed answer and the default for anything not verified.** An event wrongly
+     * marked here costs a minimising tenant a bag they could have had; an event wrongly marked
+     * {@link ADMINISTRATIVE} discloses personal data to a destination that asked not to receive it.
+     * The two errors are not symmetric, so the doubt resolves here.
+     */
+    AuditExportEventDataDisclosure["SUBJECT_DETAIL"] = "subject-detail";
+    /**
+     * The bag describes CONFIGURATION or SYSTEM STATE. Any identifier in it is an actor or resource
+     * reference the envelope already implies, and it carries no contact data, no supplied values and
+     * no free text.
+     *
+     * Mark an event here only after READING its `eventData` schema. The set is deliberately small;
+     * growing it is a per-event decision with the schema in front of you, not a sweep.
+     */
+    AuditExportEventDataDisclosure["ADMINISTRATIVE"] = "administrative";
+})(AuditExportEventDataDisclosure || (AuditExportEventDataDisclosure = {}));
+export const AUDIT_EXPORT_FIELD_DISCLOSURE = {
+    // ── FLOOR ────────────────────────────────────────────────────────────────────────────────────
+    /** The receiver's dedup key AND the only handle joining a SIEM record back to its audit row. */
+    eventId: AuditExportDisclosureTier.FLOOR,
+    /** CEF `Device Event Class ID` + `Name`, LEEF `EventID` — header slots in both text grammars. */
+    eventType: AuditExportDisclosureTier.FLOOR,
+    /** What the record IS. A receiver's own category filter is written against it. */
+    eventCategory: AuditExportDisclosureTier.FLOOR,
+    /** CEF's mandatory `agentSeverity` header slot, and what a SOC alerts on. */
+    severity: AuditExportDisclosureTier.FLOOR,
+    /** When. An audit event without a time is not a shorter audit event. */
+    timestamp: AuditExportDisclosureTier.FLOOR,
+    /** Which tenant. Also the scope the feed is routed on, so a record denying it is unreadable. */
+    organizationId: AuditExportDisclosureTier.FLOOR,
+    /**
+     * The ACTOR REFERENCE — an opaque id, never a name or an address. Deliberately FLOOR while
+     * `userEmail` is ATTRIBUTION: an id lets a receiver correlate one actor's events without learning
+     * who they are, which is exactly the trade a minimising tenant is trying to make. Dropping it
+     * would leave a feed in which nothing can be attributed to anything.
+     */
+    userId: AuditExportDisclosureTier.FLOOR,
+    /** Which application emitted it. Required on the envelope and names no person. */
+    sourceService: AuditExportDisclosureTier.FLOOR,
+    /** CEF `Device Version`, LEEF `Product Version` — header slots in both text grammars. */
+    sourceVersion: AuditExportDisclosureTier.FLOOR,
+    /** See the module header: required, impersonal, and the cheapest triage filter a SOC has. */
+    sourceEnvironment: AuditExportDisclosureTier.FLOOR,
+    /** Success or failure. Half of what an audit record is for. */
+    outcome: AuditExportDisclosureTier.FLOOR,
+    /**
+     * The KIND of principal whose authority was used — a vocabulary value, never an identity. FLOOR
+     * beside `userId` because without it a minimised feed cannot tell a person from a delegated client,
+     * a machine or the application itself, which is the first question asked of any privileged action.
+     */
+    actorKind: AuditExportDisclosureTier.FLOOR,
+    // ── ATTRIBUTION ──────────────────────────────────────────────────────────────────────────────
+    /** A person's address. The single field most DPAs name first. */
+    userEmail: AuditExportDisclosureTier.ATTRIBUTION,
+    /** Personal data in its own right, and the field that places a person geographically. */
+    ipAddress: AuditExportDisclosureTier.ATTRIBUTION,
+    /** Device and software fingerprint of a person's client. */
+    userAgent: AuditExportDisclosureTier.ATTRIBUTION,
+    /** Where a person was. */
+    geoLocation: AuditExportDisclosureTier.ATTRIBUTION,
+    /**
+     * A pseudonymous identifier under GDPR Art. 4(5) by its own schema declaration, and the axis that
+     * groups one person ACROSS sessions and logins — which is precisely what makes it more disclosing
+     * than a per-request id, not less.
+     */
+    clientInstanceId: AuditExportDisclosureTier.ATTRIBUTION,
+    // ── CONTEXT ──────────────────────────────────────────────────────────────────────────────────
+    /** Groups the events of one request. About the request, not the person who made it. */
+    correlationId: AuditExportDisclosureTier.CONTEXT,
+    /** Which frontend surface (app / website / docs). */
+    frontendServiceName: AuditExportDisclosureTier.CONTEXT,
+    /** A tenant LABEL. A legal person is not a data subject, but it is still the tenant's to withhold. */
+    organizationName: AuditExportDisclosureTier.CONTEXT,
+    applicationId: AuditExportDisclosureTier.CONTEXT,
+    applicationName: AuditExportDisclosureTier.CONTEXT,
+    /** How the principal authenticated. A mechanism, not an identity. */
+    authMethod: AuditExportDisclosureTier.CONTEXT,
+    /** Which identity source. A configuration reference. */
+    authSource: AuditExportDisclosureTier.CONTEXT,
+    providerRef: AuditExportDisclosureTier.CONTEXT,
+    /** The connection a stored provider credential belongs to (#1670). A configuration reference, like the ref. */
+    connectionRef: AuditExportDisclosureTier.CONTEXT,
+    connectionType: AuditExportDisclosureTier.CONTEXT,
+    /**
+     * The AI agent that acted — a configuration identifier, beside `authSource` rather than beside the
+     * personal-data fields. A tenant minimising for personal data must still be able to say which agent
+     * did what, so this is deliberately NOT ATTRIBUTION.
+     */
+    agentRef: AuditExportDisclosureTier.CONTEXT,
+    /**
+     * The agent's execution — a pseudonymous key into a transcript the user owns, which resolves to
+     * nothing once that transcript is erased. It names a run, not a person, so it travels with the
+     * agent's identity rather than with the personal-data tier.
+     */
+    agentExecutionId: AuditExportDisclosureTier.CONTEXT,
+    /** The external OAuth client a person delegated to. A software client's id, not a person's. */
+    delegatingClientId: AuditExportDisclosureTier.CONTEXT,
+    /**
+     * #1597 — the relationship a firm's principal acted through, and the firm. Organization and relationship
+     * identifiers, not a person's: CONTEXT, beside the other "under what arrangement did this act?" fields.
+     */
+    actingViaServiceProviderRelationshipId: AuditExportDisclosureTier.CONTEXT,
+    providerOrganizationId: AuditExportDisclosureTier.CONTEXT,
+    /**
+     * #1633 — where the factor that satisfied the client's authentication policy came from. An enum naming a SOURCE
+     * (this application, or the firm's trusted identity provider), never a person or a proof: CONTEXT beside the
+     * relationship it qualifies.
+     */
+    serviceProviderFactorSource: AuditExportDisclosureTier.CONTEXT,
+    // ── DETAIL ───────────────────────────────────────────────────────────────────────────────────
+    /** The open per-event bag. Gated a second time by the event type's own disclosure class. */
+    eventData: AuditExportDisclosureTier.DETAIL,
+    /**
+     * DETAIL, not CONTEXT, because it is not a field of its own — it is a value the dispatcher LIFTED
+     * OUT of the bag (`eventData.failureReason || eventData.reason`), so it travels with the bag it
+     * came from. The operator is `||` rather than `??`, which is not pedantry here: an EMPTY
+     * `failureReason` falls through to `reason`, so an event can reach the free-text branch even when
+     * it declares the enum-ish one.
+     *
+     * It was CONTEXT, classified by its shape: usually an enum-ish failure reason, which reads as
+     * impersonal operational context. That was wrong in the direction that matters. **27** core event
+     * schemas declare a top-level `failureReason` or `reason` — the two keys the dispatcher reads, so
+     * that is the population — and **19** of them carry the operator-typed `reason`: the organization
+     * lifecycle events, `EMERGENCY_ACCESS_USED`, `RETAINED_DATA_ACCESS` (whose `reason` is required
+     * and is the #954 operator justification), `USER_PASSWORD_RESET_FORCED`,
+     * `RESOURCE_OPERATION_PERFORMED`. The organization-lifecycle entries in the event-data map below
+     * give that free text as the WHOLE reason their bags are `SUBJECT_DETAIL`. So the contract
+     * refused those bags and then handed their prose over anyway, through a field labelled context.
+     *
+     * The cost of the correction is real and is the right way round: a tenant that withholds detail
+     * now also loses the ordinary enum-shaped failure reason on, say, `USER_LOGIN_FAILED`. It can get
+     * it back by admitting `DETAIL` with `ADMINISTRATIVE` bags, and a reason it cannot have is one
+     * that may name somebody.
+     */
+    outcomeReason: AuditExportDisclosureTier.DETAIL,
+};
+/**
+ * COMPILE-TIME GUARD, not a runtime value — the constant is never read.
+ *
+ * It fails to typecheck, naming the offending field, if anyone classifies a REQUIRED envelope field
+ * as trimmable. That is the one way this contract could promise a minimisation it cannot perform:
+ * the applier would leave the field in place and a tenant would receive data it declared it would
+ * not. The failure is silent at runtime and total at compile time, which is the right way round.
+ *
+ * If a new required field genuinely must be trimmable, make it optional on the envelope (every
+ * wire-format render already guards for absence, for the DLQ-replay reason) rather than widening
+ * this guard.
+ */
+export const AUDIT_EXPORT_TRIMMABLE_FIELDS_ARE_OMITTABLE = true;
+/**
+ * Every core auditable event's `eventData` disclosure class — the EVENT-TYPE half of the contract.
+ *
+ * **Total over `CoreAuditableEventType`**, so a member added to the vocabulary is a compile error
+ * until its author answers the question. That totality is the whole reason this is a map rather
+ * than a per-destination list: a destination enumerating event types is a hand-kept list against a
+ * vocabulary that moves, and a newly-added event would silently export everything or nothing
+ * depending on which way its default fell.
+ *
+ * **Unverified entries are {@link AuditExportEventDataDisclosure.SUBJECT_DETAIL}, deliberately.**
+ * Only the events below carry `ADMINISTRATIVE`, and each was classified by READING its
+ * `eventData` schema and confirming it holds configuration or counts and no free text. Everything
+ * else takes the fail-closed answer — including events whose bag is very likely harmless — because
+ * the cost of being wrong in that direction is a tenant losing detail it could have had, while the
+ * other direction discloses personal data to a destination that asked not to receive it.
+ *
+ * An application's OWN event types are not in this map and resolve to `SUBJECT_DETAIL` through
+ * {@link resolveEventDataDisclosure}, for the same reason.
+ */
+export const AUDIT_EXPORT_EVENT_DATA_DISCLOSURE = {
+    // ── Authentication ───────────────────────────────────────────────────────────────────────────
+    // Every bag here carries some combination of email, IP, user-agent and session id.
+    [CoreAuditableEventType.USER_LOGIN]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_LOGOUT]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_LOGIN_FAILED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_ACCOUNT_LOCKED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_PASSWORD_CHANGED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_MFA_ENABLED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_MFA_DISABLED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_SESSION_EXPIRED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_SESSION_EVICTED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.MACHINE_AUTH_SUCCESS]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.MACHINE_AUTH_FAILED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.MACHINE_ACCESS]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    // ── User lifecycle ───────────────────────────────────────────────────────────────────────────
+    [CoreAuditableEventType.USER_CREATED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_UPDATED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_DELETED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_APP_ROLES_CHANGED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    /**
+     * VERIFIED ADMINISTRATIVE: counts, the conferring role names, and the statuses that count as
+     * usable. The event is about the APPLICATION having no administrator; it names no person.
+     */
+    [CoreAuditableEventType.APPLICATION_SUPER_ADMIN_FLOOR_BREACHED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    // Its organization twin is NOT administrative: the bag carries `reducedMemberIds` and
+    // `subjectUserId`, which is a list of people rather than the envelope's single actor reference.
+    [CoreAuditableEventType.ORGANIZATION_OWNER_FLOOR_BREACHED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    // ── Organization lifecycle ───────────────────────────────────────────────────────────────────
+    // Read, and NOT administrative — but by THREE different routes, which an earlier version of this
+    // comment flattened into one ("every one of these bags carries an operator-typed `reason`").
+    // Measured, that was false for three of the nine, and a rationale that overstates its own
+    // evidence is the invented-denominator shape `derive-before-you-ask.md` warns about — sitting,
+    // here, inside the justification that a later fix leaned on.
+    //
+    //  - MOST carry an operator-typed `reason` / `justification` / `suspensionReason`: free text that
+    //    may name anybody. `_DELETED`, `_DELETION_REQUESTED`, `_RESTORED`, `_ACTIVATED`,
+    //    `_TYPE_ASSIGNED`, `_SUSPENDED`, `RESOURCE_STATUS_TRANSITION_PERFORMED`.
+    //  - `ORGANIZATION_UPDATED` carries `changes: z.record(z.string(), z.any())` — an OPEN bag, which
+    //    cannot be asserted to hold no data about a person. Same argument that reclassified
+    //    `ORGANIZATION_SSO_CONFIGURATION_CHANGED` below.
+    //  - `ORGANIZATION_CREATED` carries only `name`, `slug` and `createdBy`, and is SUBJECT_DETAIL on
+    //    the fail-closed default alone — no free text, no open bag, simply not verified as safe. That
+    //    is the honest entry, and naming it as such is what stops the next reader assuming the whole
+    //    group was measured.
+    [CoreAuditableEventType.ORGANIZATION_CREATED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.ORGANIZATION_UPDATED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.ORGANIZATION_TYPE_ASSIGNED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.ORGANIZATION_DELETED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.ORGANIZATION_DELETION_REQUESTED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.ORGANIZATION_RESTORED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.ORGANIZATION_SUSPENDED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.ORGANIZATION_ACTIVATED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.RESOURCE_STATUS_TRANSITION_PERFORMED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    // ── Organization membership ──────────────────────────────────────────────────────────────────
+    // Membership bags name the member, the inviter and the roles — people, throughout.
+    [CoreAuditableEventType.ORGANIZATION_MEMBER_INVITED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.ORGANIZATION_MEMBER_JOINED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.ORGANIZATION_MEMBER_UPDATED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.ORGANIZATION_MEMBER_ROLE_CHANGED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.ORGANIZATION_MEMBER_STATUS_CHANGED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.ORGANIZATION_MEMBER_REMOVED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.ORGANIZATION_NOTIFICATIONS_UPDATED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.ORGANIZATION_PREFERENCES_UPDATED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.ORGANIZATION_PROFILE_UPDATED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.ORGANIZATION_UNIT_UPDATED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.ORGANIZATION_UNIT_MEMBER_ROLE_CHANGED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.ORGANIZATION_UNIT_MEMBER_REMOVED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    // ── SSO authentication ───────────────────────────────────────────────────────────────────────
+    [CoreAuditableEventType.USER_SSO_LOGIN]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_SSO_LOGIN_FAILED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_SSO_ENFORCEMENT_BLOCKED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_TOKEN_REFRESHED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    // ── Organization security configuration ──────────────────────────────────────────────────────
+    /**
+     * SUBJECT_DETAIL, and it was ADMINISTRATIVE for one review cycle on the stated grounds "a config
+     * diff, its change type and the provider ref. No free text." The diff is
+     * `changes: z.record(z.string(), z.any())` — an UNBOUNDED OPEN BAG, which cannot be asserted to
+     * hold no data about a person whatever it happens to contain today. The same source file names
+     * that exact shape as the one an audit payload must not have.
+     *
+     * The reclassification costs nothing measurable and is worth reading as a warning: the event has
+     * **no emitter anywhere in production source** (its emit method was removed in #591), so the
+     * "verification" behind the original entry was a reading of a schema that nothing populates. An
+     * open record is unverifiable by construction — fail closed and say so.
+     */
+    [CoreAuditableEventType.ORGANIZATION_SSO_CONFIGURATION_CHANGED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    /**
+     * VERIFIED ADMINISTRATIVE: the three SIEM-export change events carry the tenant, the actor
+     * reference, the change type, the destination's DOMAIN (never the full URL, never the
+     * credential), the configured format and the names of the changed fields. Configuration
+     * throughout, and no free text.
+     *
+     * They are also the events a retired destination receives as its LAST event (#986), so a
+     * minimising tenant keeping them is exactly the intended outcome.
+     */
+    [CoreAuditableEventType.ORGANIZATION_SIEM_EXPORT_CONFIGURED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    [CoreAuditableEventType.ORGANIZATION_SIEM_EXPORT_DISABLED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    [CoreAuditableEventType.ORGANIZATION_SIEM_EXPORT_DESTINATION_CHANGED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    // ── Provider credentials and connections ─────────────────────────────────────────────────────
+    // No payload here carries a credential VALUE — that is structural. But the user-scoped half names
+    // a person's relationship with a named vendor, and the organization-scoped half carries the
+    // account and scopes a principal authorized, so both are subject detail.
+    [CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_SET]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_ROTATED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_USED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_DELETED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_SET]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_ROTATED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_USED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_DELETED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.ORGANIZATION_PROVIDER_CONNECTION_GRANTED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_PROVIDER_CONNECTION_GRANTED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    // ── Application security configuration ───────────────────────────────────────────────────────
+    /**
+     * VERIFIED ADMINISTRATIVE: the changed user types, a snapshot digest, and the before/after policy
+     * blocks. Authored configuration with no human actor at all — the event is emitted at boot.
+     */
+    [CoreAuditableEventType.APPLICATION_AUTH_POLICY_CHANGED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    // Read: run ref, instants, outcome vocabulary and per-class counts. System state, no person, no free text.
+    [CoreAuditableEventType.RETENTION_ENFORCEMENT_RECORDED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    // ── Outbound webhook ─────────────────────────────────────────────────────────────────────────
+    /**
+     * VERIFIED ADMINISTRATIVE: the dispatching actor reference, the endpoint id, the destination
+     * HOST, the outcome and a duration. An operator-supplied URL is configuration, not a person.
+     */
+    [CoreAuditableEventType.WEBHOOK_ENDPOINT_TEST_DISPATCHED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    // Inbound deliveries (#1596): schemas read — ids, source keys, handler refs and classified codes, never
+    // the payload, a header value or an error message. REPLAYED carries the operator's free-text
+    // justification, so it keeps the fail-closed tier.
+    [CoreAuditableEventType.INBOUND_DELIVERY_REJECTED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    [CoreAuditableEventType.INBOUND_DELIVERY_ACCEPTED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    [CoreAuditableEventType.INBOUND_DELIVERY_UNROUTABLE]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    [CoreAuditableEventType.INBOUND_DELIVERY_PROCESSED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    [CoreAuditableEventType.INBOUND_DELIVERY_FAILED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    [CoreAuditableEventType.INBOUND_DELIVERY_DEAD]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    [CoreAuditableEventType.INBOUND_DELIVERY_REPLAYED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    // #1630: ids, channels and named outcomes only — schemas read; no address, subject or free text.
+    [CoreAuditableEventType.INBOUND_DELIVERY_BELOW_ASSURANCE]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    [CoreAuditableEventType.INBOUND_REPLY_SENT]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    [CoreAuditableEventType.INBOUND_REPLY_FAILED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    [CoreAuditableEventType.INBOUND_REPLY_TOKEN_REVOKED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    [CoreAuditableEventType.INBOUND_REPLY_TOKEN_DOWNGRADED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    // #1600: schemas read. A domain and a client mailbox address are an ORGANIZATION's configuration, never a
+    // person's; a received message is named by its row id, a classified reason and counts — no sender, subject
+    // or filename.
+    [CoreAuditableEventType.ORGANIZATION_EMAIL_DOMAIN_CLAIMED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    [CoreAuditableEventType.ORGANIZATION_EMAIL_DOMAIN_OWNERSHIP_VERIFIED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    [CoreAuditableEventType.ORGANIZATION_EMAIL_DOMAIN_VERIFIED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    [CoreAuditableEventType.ORGANIZATION_EMAIL_DOMAIN_SUSPENDED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    [CoreAuditableEventType.ORGANIZATION_EMAIL_DOMAIN_REMOVED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    [CoreAuditableEventType.CLIENT_MAILBOX_CREATED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    [CoreAuditableEventType.CLIENT_MAILBOX_REMOVED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    [CoreAuditableEventType.INBOUND_EMAIL_ATTACHMENT_WITHHELD]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    [CoreAuditableEventType.INBOUND_EMAIL_REJECTED_LIMIT]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    // ── SCIM directory provisioning ──────────────────────────────────────────────────────────────
+    // Provisioning is ABOUT people by definition; the token events ride the same lane and are not
+    // separately verified.
+    [CoreAuditableEventType.SCIM_TOKEN_CREATED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.SCIM_TOKEN_REVOKED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.SCIM_TOKEN_GENERATED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.SCIM_TOKEN_ROTATED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.SCIM_PROVISIONING_CONFIG_UPDATED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.SCIM_PROVISIONING_FAILED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.SCIM_USER_PROVISIONED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.SCIM_USER_UPDATED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.SCIM_USER_DEACTIVATED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    // ── Credential and factor lifecycle ──────────────────────────────────────────────────────────
+    // Every bag names the person whose credential or factor moved.
+    [CoreAuditableEventType.USER_PASSWORD_RESET_REQUESTED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_PASSWORD_RESET_COMPLETED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_PASSWORD_RESET_FORCED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_REGISTERED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_EMAIL_VERIFIED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_VERIFICATION_EMAIL_RESENT]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_PASSWORD_SET]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_TOTP_DISABLED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_IDENTITY_LINK_REMOVED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_MFA_SETUP_STARTED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_MFA_SETUP_COMPLETED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_MFA_EMAIL_OTP_SENT]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_PASSKEY_REGISTERED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_PASSKEY_AUTHENTICATION_SUCCESS]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_PASSKEY_AUTHENTICATION_FAILURE]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_PASSKEY_REMOVED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_PASSKEY_CLONE_SUSPECTED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_MAGIC_LINK_SENT]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_MAGIC_LINK_VERIFIED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_MAGIC_LINK_FAILED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_SMS_OTP_SENT]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_SMS_OTP_VERIFIED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_SMS_OTP_FAILED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_PHONE_VERIFIED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_PHONE_VERIFICATION_FAILED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    // ── SAML ─────────────────────────────────────────────────────────────────────────────────────
+    // None of these has a typed eventData schema, so nothing can be verified about their bags. The
+    // two that LOOK administrative (`SAML_CERT_EXPIRING`, `SAML_METADATA_PARSED`) are exactly the
+    // entries a guess would get wrong, and are fail-closed with the rest.
+    [CoreAuditableEventType.SAML_LOGIN_INITIATED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.SAML_LOGIN_SUCCESS]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.SAML_LOGIN_FAILED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.SAML_ASSERTION_REPLAY_DETECTED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.SAML_CERT_EXPIRING]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.SAML_SLO_INITIATED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.SAML_SLO_COMPLETED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.SAML_METADATA_PARSED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.SAML_EMAIL_CHANGED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    // ── OAuth / OIDC provider ────────────────────────────────────────────────────────────────────
+    [CoreAuditableEventType.OAUTH2_PROVIDER_BLOCKED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.OIDC_ACR_DEMAND_UNSATISFIED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.OAUTH_DELEGATED_TOKEN_ISSUED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.OAUTH_CONSENT_GRANTED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.OAUTH_CONSENT_DENIED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.OAUTH_CONSENT_GRANT_PERSISTED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.OAUTH_DYNAMIC_CLIENT_REGISTERED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.OAUTH_CIMD_CLIENT_REFUSED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.OAUTH_TOKEN_REFRESHED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.OAUTH_TOKEN_REVOKED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.OAUTH_RP_INITIATED_LOGOUT]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.OAUTH_CODE_EXCHANGE_FAILED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.OAUTH_CONSENT_BINDING_VIOLATION]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_REFRESH_TOKEN_REUSE_DETECTED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    // ── Files and one-off tokens ─────────────────────────────────────────────────────────────────
+    [CoreAuditableEventType.FILE_UPLOAD_GRANT_ISSUED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.FILE_UPLOAD_GRANT_REDEEMED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.FILE_UPLOAD_GRANT_REVOKED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.FILE_SHARE_LINK_ISSUED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.FILE_SHARE_LINKS_REVOKED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.FILE_MALWARE_DETECTED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.FILE_MALWARE_SCAN_FAILED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.ONE_OFF_TOKEN_CREATED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.ONE_OFF_TOKEN_EXCHANGED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.ONE_OFF_TOKEN_REVOKED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.USER_CROSS_FRONTEND_HANDOFF_ISSUED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    // ── Access, disclosure and administrative reach ──────────────────────────────────────────────
+    // The generic resource and field events carry whatever the operation touched, including
+    // before/after values of `.isAuditEvidence()` fields — the broadest bags in the vocabulary.
+    [CoreAuditableEventType.EMERGENCY_ACCESS_USED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.FIELD_ACCESS]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.RESOURCE_OPERATION_PERFORMED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.RESOURCE_OPERATION_DENIED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.CROSS_TENANT_ADMINISTRATIVE_ACCESS]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.PLATFORM_ACCESS_GRANT_LIFECYCLE]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    // Names the held person (`subjectUserId`) on a data-subject hold (#1634).
+    [CoreAuditableEventType.LEGAL_HOLD_PLACED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.LEGAL_HOLD_RELEASED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    // Read with the schema in front of it (#1598): an aggregate id, the tenant, a month, a currency code and an
+    // invoice-ref id — configuration of a billing record, no person, no free text, no amount.
+    [CoreAuditableEventType.MODEL_COST_AGGREGATE_INVOICE_LINKED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    [CoreAuditableEventType.CORRECTION_CAPTURE_SETTING_CHANGED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    [CoreAuditableEventType.EVALUATION_EXPORT_AUTHORIZATION_CHANGED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    [CoreAuditableEventType.EVALUATION_DATASET_EXPORTED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    [CoreAuditableEventType.EVALUATION_DATASET_EXPORT_REFUSED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    // The lifecycle carries `purpose` and `decisionReason` (free text people typed); the assignment events
+    // name the expert, who is the SUBJECT rather than the actor. Both fail closed (#1597).
+    [CoreAuditableEventType.SERVICE_PROVIDER_RELATIONSHIP_LIFECYCLE]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.SERVICE_PROVIDER_EXPERT_ASSIGNED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.SERVICE_PROVIDER_EXPERT_UNASSIGNED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    // The per-expert approval events (#1612) name the expert — the SUBJECT, not the actor — like the assignment events.
+    [CoreAuditableEventType.SERVICE_PROVIDER_EXPERT_APPROVAL_REQUESTED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.SERVICE_PROVIDER_EXPERT_APPROVAL_GRANTED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.SERVICE_PROVIDER_EXPERT_APPROVAL_DENIED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.SERVICE_PROVIDER_EXPERT_APPROVAL_LAPSED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    // Read before marking (#1631): organization ids, a relationship and grant id, a capability, a date and the acting
+    // client user — resource and actor references the envelope already implies; no contact data, no free text.
+    [CoreAuditableEventType.SERVICE_PROVIDER_CAPABILITY_GRANTED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    [CoreAuditableEventType.SERVICE_PROVIDER_CAPABILITY_REVOKED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    // Read before marking: organization ids, a relationship id, an OAuth client id and the acting user —
+    // resource and actor references the envelope already implies; no contact data, no free text.
+    [CoreAuditableEventType.SERVICE_PROVIDER_MACHINE_CLIENT_ADMISSION_CHANGED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    // Read before marking (#1633, #1632): organization ids, a relationship id, enum values, a boolean and the acting user —
+    // no contact data and no free text. The satisfied-factor row names the expert as the subject of the proof, so it
+    // fails closed like the assignment events.
+    [CoreAuditableEventType.SERVICE_PROVIDER_MFA_TRUST_CHANGED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    [CoreAuditableEventType.SERVICE_PROVIDER_CLIENT_AUTHENTICATION_SATISFIED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.SERVICE_PROVIDER_ACTIVITY_FEED_DECIDED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    [CoreAuditableEventType.SERVICE_PROVIDER_ACTIVITY_FEED_DISCLOSURE_CHANGED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    [CoreAuditableEventType.PLATFORM_DIRECTORY_ACCESS]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.SYSTEM_CONTEXT_READ]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.SYSTEM_CONTEXT_WRITE]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.PLATFORM_CONFIGURATION_PUBLICATION]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.RETAINED_DATA_ACCESS]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.GOVERNED_DOCUMENT_INTERACTION_RECORDED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.SUBJECT_DATA_EXPORT]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.COLLECTION_DATA_EXPORT]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    // ── External integration ─────────────────────────────────────────────────────────────────────
+    [CoreAuditableEventType.HTTP_API_READ_THROUGH_ACCESS]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.HTTP_API_WRITE_THROUGH]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    // Both name the initiating user and the organization; the executed row names a remote record key (#1678).
+    [CoreAuditableEventType.SYSTEM_OF_RECORD_ACTION_EXECUTED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.SYSTEM_OF_RECORD_ACTION_REFUSED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    // #1734 — `reason` and `statedOperator` are an operator's free text, which may name anyone.
+    [CoreAuditableEventType.EXTERNAL_DATA_PIPELINE_RESET]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    // #2039 — `reason` and `statedOperator` are an operator's free text, as on the reset.
+    [CoreAuditableEventType.EXTERNAL_DATA_OUTBOUND_UNKNOWN_RESOLVED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    // #1723 — a remote record's key and the row it links to identify a record that may be a person's.
+    [CoreAuditableEventType.EXTERNAL_DATA_CONFLICT_RESOLVED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.HTTP_API_EXTERNAL_ERASURE]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.HTTP_API_NON_ERASURE_ACKNOWLEDGED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    // Names the erased subject's ids beside the recipient: the same exposure as the acknowledged-hole row above.
+    [CoreAuditableEventType.SUBJECT_ERASURE_RECIPIENT_OUTCOME]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.PROVIDER_OPERATION_CALL]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.PROVIDER_OPERATION_DENIED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.MCP_TOOL_CALL]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    // SUBJECT_DETAIL like its two siblings, for their reason: `connectionOwnerId` names whose account the call spent, and
+    // for a file read through a person's Drive that is the LINKER — a person the envelope does not imply when someone
+    // else read the file (#1712 review). It names no recipient, number, file, customer or payload (#412), but ADMINISTRATIVE
+    // admits only ids the envelope already implies, and a wrong ADMINISTRATIVE mark is the harmful direction.
+    [CoreAuditableEventType.PROVIDER_CAPABILITY_CALL]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    // #1594: decision rows name the requester, the decider and the people a decision moved between, so
+    // they are subject detail. They carry no argument values, which is what keeps them exportable at all.
+    [CoreAuditableEventType.HUMAN_DECISION_REQUESTED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.HUMAN_DECISION_RESOLVED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.HUMAN_DECISION_REASSIGNED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.HUMAN_DECISION_ESCALATED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.HUMAN_DECISION_CLAIMED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.HUMAN_DECISION_ANSWER_REFUSED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    // #1628 — ids, stages, counts and a pause-state identifier, the same weight as the rest of the family.
+    [CoreAuditableEventType.HUMAN_DECISION_DEADLINE_MISSED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.HUMAN_DECISION_ESCALATION_FIRED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.HUMAN_DECISION_CLOCK_PAUSED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.HUMAN_DECISION_CLOCK_RESUMED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    // #1611 — read against the four schemas: agent refs, organization / client / relationship ids, an
+    // occurrence id, a case reference (resource type and id), enum reasons. No contact data, no supplied
+    // values, no free text: the turn's input and the agent's instruction are never in the bag.
+    [CoreAuditableEventType.AUTONOMOUS_AGENT_BOUND]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    [CoreAuditableEventType.AUTONOMOUS_AGENT_UNBOUND]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    [CoreAuditableEventType.AUTONOMOUS_AGENT_TURN_STARTED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    [CoreAuditableEventType.AUTONOMOUS_AGENT_TURN_REFUSED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    /*
+     * Everything else in this bag IS configuration — the transition, the assignment row, the declared
+     * instance, the remote partition key, and the units on either side of the move. On those alone it
+     * would be ADMINISTRATIVE.
+     *
+     * `justification` decides it. The operator's stated reason is FREE TEXT a person wrote, recorded on
+     * every transition, and free text may name anyone — which is this vocabulary's own criterion for
+     * SUBJECT_DETAIL rather than a cautious reading of it. `assignedByUserId` is only the actor the
+     * envelope already implies and would not have been enough on its own.
+     */
+    [CoreAuditableEventType.SYSTEM_OF_RECORD_PARTITION_ASSIGNMENT_LIFECYCLE]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+};
+/**
+ * What one DESTINATION has declared it may receive — the per-tenant, per-agreement half.
+ *
+ * Two arrays rather than one, and the interaction between them is the reason. A tenant that drops
+ * {@link AuditExportDisclosureTier.ATTRIBUTION} while keeping the detail bag would still receive
+ * the email address inside `eventData` for every authentication event — a minimisation that reads
+ * as a control and is not one. {@link disclosedEventDataClasses} is what closes that: declaring
+ * `[ADMINISTRATIVE]` keeps the bags that carry configuration and drops the ones that carry people.
+ */
+/*
+ * Both members declare `.systemEnum(...)` ON THE ELEMENT, which is where the decorator goes for an
+ * array of enums (`organizationPreferences.supportedLanguages` is the precedent).
+ *
+ * Without it these two vocabularies would get words authored per FIELD PATH rather than once per
+ * enum, and a reader of the SIEM pane would be choosing between raw wire values like
+ * `subject-detail` — see `.claude/rules/display-text-comes-from-i18n.md`. A new closed vocabulary
+ * reaching a UI is exactly the moment to declare it; the words themselves are authored by the
+ * labelling pipeline under `system_enums.<Name>.<value>` and are never hand-written here.
+ */
+export const SiemExportProjectionDeclarationSchema = z.object({
+    /**
+     * Which tiers, beyond the floor, this destination may receive.
+     *
+     * **`FLOOR` is not a choice, so it is not offered.** The floor is added unconditionally by
+     * {@link resolveDisclosedEnvelopeFields}, and declaring `[]` yields a floor-only feed rather than
+     * an empty one.
+     *
+     * This used to accept the whole vocabulary, on the reasoning that declaring `FLOOR` was
+     * "redundant rather than wrong". That was true of the API and false of the SCREEN: the settings
+     * pane renders one checkbox per member, so it offered a `floor` toggle — and on every destination
+     * that had not ticked it, displayed it UNCHECKED. An operator reading "floor ☐" believes the event
+     * id, type, timestamp and user id are withheld, and none of them is. That is the exact shape this
+     * contract exists to remove — a control that renders and does nothing — and it was found by
+     * opening the pane in a browser, not by any test (#1395).
+     *
+     * Derived from the one named vocabulary with `.exclude(['FLOOR'])` rather than declared as a
+     * second enum: the tiers a destination may choose are a SUBSET of the tiers a field may have, and
+     * a parallel list would be a second copy to keep in step. The key is type-checked against the
+     * enum, so renaming the member is a compile error here rather than a silent drift.
+     *
+     * Defaults to everything: a destination that has declared no minimisation has not asked for one,
+     * and silently narrowing an existing tenant's feed would be a worse failure than not narrowing a
+     * new one.
+     */
+    disclosedTiers: z.array(z.enum(AuditExportDisclosureTier).exclude(['FLOOR']).systemEnum('AuditExportDisclosureTier')).default([
+        AuditExportDisclosureTier.ATTRIBUTION,
+        AuditExportDisclosureTier.CONTEXT,
+        AuditExportDisclosureTier.DETAIL,
+    ]).describe("The envelope tiers this destination receives beyond the floor. The floor (the record's identity, its outcome and its actor reference) is always sent, so an empty list sends the floor alone. Defaults to every tier."),
+    /**
+     * Which `eventData` bags this destination may receive, by the EVENT TYPE's declared class. Read
+     * only when {@link AuditExportDisclosureTier.DETAIL} is disclosed; an event type outside the core
+     * vocabulary resolves to `SUBJECT_DETAIL`.
+     */
+    disclosedEventDataClasses: z.array(z.enum(AuditExportEventDataDisclosure).systemEnum('AuditExportEventDataDisclosure')).default([
+        AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+        AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    ]).describe("Which classes of event detail this destination receives, judged by each event type's declared class. Read only when the detail tier is sent. Keeping only the administrative class drops detail that names people."),
+});
+/**
+ * The projection a destination that has declared nothing receives: everything.
+ *
+ * FAIL-OPEN, deliberately, and it is the one place in this contract where that is right. An absent
+ * declaration is not a tenant asking for minimisation — it is a tenant that has not configured one,
+ * and every existing destination is in that state. Failing closed here would silently stop
+ * delivering fields to feeds that are working today, which is a bigger and quieter harm than
+ * continuing the current behaviour until an operator narrows it deliberately.
+ */
+export const FULL_AUDIT_EXPORT_PROJECTION = {
+    disclosedTiers: [
+        AuditExportDisclosureTier.ATTRIBUTION,
+        AuditExportDisclosureTier.CONTEXT,
+        AuditExportDisclosureTier.DETAIL,
+    ],
+    disclosedEventDataClasses: [
+        AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+        AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    ],
+};
+/**
+ * What an event type's `eventData` bag carries, including for event types an APPLICATION defined.
+ *
+ * An unknown type resolves to {@link AuditExportEventDataDisclosure.SUBJECT_DETAIL} — the opposite
+ * direction from `getAuditEventClassification`, whose fallback exists to give an application event
+ * a usable category. Here the fallback decides a DISCLOSURE, so it takes the safe answer: an
+ * application's own bag is the one this framework knows least about.
+ */
+export function resolveEventDataDisclosure(eventType) {
+    return (AUDIT_EXPORT_EVENT_DATA_DISCLOSURE[eventType]
+        ?? AuditExportEventDataDisclosure.SUBJECT_DETAIL);
+}
+/**
+ * The envelope fields one destination may receive for one event.
+ *
+ * The floor is unioned in unconditionally — **this is where "a floor cannot be trimmed" is
+ * enforced**, not in the applier and not in the schema's defaults, so no declaration a tenant can
+ * write and no future caller can produce a feed without it.
+ *
+ * assurance-control: WILDO.PRIVACY.DATA_MINIMIZATION — the destination's declaration decides which
+ * envelope fields may leave for an external processor, and the floor is the part of that decision
+ * the framework keeps: a record that cannot be correlated or de-duplicated is not a minimised
+ * export.
+ */
+export function resolveDisclosedEnvelopeFields(eventType, declaration) {
+    const disclosedTiers = new Set(declaration.disclosedTiers);
+    const eventDataAdmitted = disclosedTiers.has(AuditExportDisclosureTier.DETAIL)
+        && declaration.disclosedEventDataClasses.includes(resolveEventDataDisclosure(eventType));
+    const disclosed = new Set();
+    for (const [field, tier] of Object.entries(AUDIT_EXPORT_FIELD_DISCLOSURE)) {
+        if (tier === AuditExportDisclosureTier.FLOOR) {
+            disclosed.add(field);
+            continue;
+        }
+        if (tier === AuditExportDisclosureTier.DETAIL) {
+            if (eventDataAdmitted)
+                disclosed.add(field);
+            continue;
+        }
+        if (disclosedTiers.has(tier))
+            disclosed.add(field);
+    }
+    return disclosed;
+}
+/**
+ * Apply a destination's projection to an envelope, returning the envelope that may actually leave.
+ *
+ * Returns a NEW object — the caller fans one audit event out to several tenants' sinks, each with
+ * its own declaration, so mutating in place would let the first destination's minimisation reach
+ * the second's delivery.
+ *
+ * **Omitted is not empty**, which the CEF `csN` slots make more than a nicety: a trimmed optional
+ * field is DELETED, so a render that guards `e.x ? … : undefined` emits neither the value nor its
+ * `csNLabel` companion. `eventData` is the one exception — it is required by the envelope type, so
+ * it is emptied to `{}`, which every format already reads as "no detail" (both text grammars omit
+ * their detail key for an empty bag; OCSF omits `unmapped` for the same reason). The compile-time
+ * guard {@link AUDIT_EXPORT_TRIMMABLE_FIELDS_ARE_OMITTABLE} is what keeps that exception the only
+ * one.
+ *
+ * assurance-control: WILDO.PRIVACY.DATA_MINIMIZATION — the act itself: only the fields the
+ * destination's declaration admits survive into the envelope that is signed, queued and delivered
+ * to a third-party processor of the tenant's choosing.
+ */
+export function applyAuditExportProjection(envelope, declaration) {
+    const disclosed = resolveDisclosedEnvelopeFields(envelope.eventType, declaration);
+    const projected = { ...envelope };
+    for (const field of Object.keys(AUDIT_EXPORT_FIELD_DISCLOSURE)) {
+        if (disclosed.has(field))
+            continue;
+        if (field === 'eventData') {
+            projected.eventData = {};
+            continue;
+        }
+        // Every other trimmable field is optional on the envelope — see the compile-time guard above.
+        delete projected[field];
+    }
+    return projected;
+}
+//# sourceMappingURL=audit-export-projection.shared.schemas.js.map