Add packaged DLP broker and protected Windows service foundation

tests/broker-siem.test.mjs

@@ -22,6 +22,17 @@ test('ECS retains actual causal UUIDs and marks terminal forwarding failure as e
 test('a durable authorization is not reported as completed delivery',()=>{
  const output=toECS(event('request.authorized'));assert.equal(output.event.outcome,'unknown');assert.deepEqual(output.event.type,['allowed']);
 });
+test('typed download records retain actual file evidence and causal authorization',()=>{
+ for(const blocked of [false,true]){
+  const input=event();input.kind=blocked?'download.block':'download.scan';delete input.metadata.request;
+  input.metadata.file={bytes:617,detectedType:'pdf',sha256:'a'.repeat(64)};
+  input.metadata.broker.phase=blocked?'response.block':'response.scanned';input.metadata.broker.reason=blocked?'broker-download-inspection-block':'broker-download-approved';
+  const output=toECS(input),cef=toCEF(input);
+  assert.equal(output.file.size,617);assert.equal(output.file.hash.sha256,'a'.repeat(64));assert.equal(output.event.outcome,blocked?'failure':'success');
+  assert.equal(output.safetynet.broker.authorized_event_id,input.metadata.broker.authorizedEventId);
+  assert.ok(cef.includes('fileHash='+'a'.repeat(64)));assert.ok(cef.includes('outcome='+(blocked?'failure':'success')));
+ }
+});
 test('CEF standard custom string preserves all causation without overwriting integrity or type',()=>{
  const input=event();input.audit={hash:'synthetic-hash',sequence:3};
  const output=toCEF(input);assert.ok(output.includes('cs2Label=BrokerLifecycle'));