@effect-auth/core 0.1.0-alpha.15 → 0.1.0-alpha.18

package/dist/AuditLog.d.ts

@@ -1,10 +1,13 @@
-import { Context, Effect, Layer } from "effect";
+import { Context, Effect, Layer, Schema } from "effect";
 import type { ApiKeyId } from "./ApiKey.js";
-import type { AuditEventId, ChallengeId, CredentialId, EmailHash, IpHash, OAuthAccountId, OAuthProviderId, PolicyId, SessionId, UnixMillis, UserAgentHash, UserId } from "./Identifiers.js";
+import type { AssuranceLevel, AuthMethodReference } from "./Assurance.js";
+import type { AuditEventId, ChallengeId, CredentialId, EmailHash, IdentityId, IpHash, OAuthAccountId, OAuthProviderId, PermissionId, PolicyId, RoleId, SessionId, UnixMillis, UserAgentHash, UserId } from "./Identifiers.js";
+import type { IdentityKind, IdentityScope } from "./Identity.js";
 import type { IncidentActionResult } from "./IncidentAction.js";
 import type { LoginRiskAssessment } from "./LoginRisk.js";
 import type { PasskeyCredentialId } from "./Passkey.js";
 import type { RefreshTokenFamilyId, RefreshTokenId } from "./RefreshToken.js";
+import type { SessionRequirement } from "./Sessions.js";
 declare const AuditLogError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
     readonly _tag: "AuditLogError";
 } & Readonly<A>;
@@ -13,7 +16,7 @@ export declare class AuditLogError extends AuditLogError_base<{
     readonly cause?: unknown;
 }> {
 }
-export type AuditLogStoreOperation = "insert" | "list" | "deleteBefore";
+export type AuditLogStoreOperation = "insertMany" | "list" | "deleteBefore";
 declare const AuditLogStoreError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
     readonly _tag: "AuditLogStoreError";
 } & Readonly<A>;
@@ -29,6 +32,10 @@ export type AuditActor = {
     readonly type: "user";
     readonly userId: UserId;
     readonly sessionId?: SessionId;
+} | {
+    readonly type: "custom";
+    readonly actorType: string;
+    readonly actorReference?: string;
 };
 export declare const AuditActor: {
     readonly anonymous: () => AuditActor;
@@ -36,7 +43,22 @@ export declare const AuditActor: {
         readonly userId: UserId;
         readonly sessionId?: SessionId;
     }) => AuditActor;
+    readonly custom: (input: {
+        readonly actorType: string;
+        readonly actorReference?: string;
+    }) => AuditActor;
 };
+export declare const AuditActorSchema: Schema.Union<readonly [Schema.Struct<{
+    readonly type: Schema.Literal<"anonymous">;
+}>, Schema.Struct<{
+    readonly type: Schema.Literal<"user">;
+    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+}>, Schema.Struct<{
+    readonly type: Schema.Literal<"custom">;
+    readonly actorType: Schema.String;
+    readonly actorReference: Schema.optional<Schema.String>;
+}>]>;
 export type AuditSubject = {
     readonly type: "anonymous";
 } | {
@@ -51,11 +73,164 @@ export declare const AuditSubject: {
     readonly email: (emailHash: EmailHash) => AuditSubject;
     readonly user: (userId: UserId) => AuditSubject;
 };
+export declare const AuditSubjectSchema: Schema.Union<readonly [Schema.Struct<{
+    readonly type: Schema.Literal<"anonymous">;
+}>, Schema.Struct<{
+    readonly type: Schema.Literal<"email">;
+    readonly emailHash: Schema.brand<Schema.String, "auth/EmailHash">;
+}>, Schema.Struct<{
+    readonly type: Schema.Literal<"user">;
+    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+}>]>;
 export interface AuditRequest {
     readonly ipHash?: IpHash;
     readonly userAgentHash?: UserAgentHash;
 }
-export type AuthAuditEvent = {
+export declare const AuditRequestSchema: Schema.Struct<{
+    readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+    readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+}>;
+export type AuthorizationAuditEventType = "auth.permission_definition.created" | "auth.permission_definition.updated" | "auth.permission_definition.disabled" | "auth.permission_definition.enabled" | "auth.permission_definition.deleted" | "auth.role_definition.created" | "auth.role_definition.updated" | "auth.role_definition.disabled" | "auth.role_definition.enabled" | "auth.role_definition.deleted" | "auth.permission.granted" | "auth.permission.revoked" | "auth.role.granted" | "auth.role.revoked" | "auth.role_permission.assigned" | "auth.role_permission.removed";
+export type AuthorizationAuditSubject = {
+    readonly type: "user";
+    readonly userId: UserId;
+} | {
+    readonly type: "custom";
+    readonly subjectType: string;
+    readonly subjectReference?: string;
+    readonly userId?: never;
+};
+export interface AuthorizationAuditScope {
+    readonly type: string;
+    readonly reference?: string;
+}
+type AuthorizationAuditEventBase<Type extends AuthorizationAuditEventType> = {
+    readonly type: Type;
+    readonly id?: AuditEventId;
+    readonly actor: AuditActor;
+    readonly request?: AuditRequest;
+    readonly occurredAt: UnixMillis;
+};
+type PermissionDefinitionAuditEvent = (AuthorizationAuditEventBase<"auth.permission_definition.created"> & {
+    readonly permissionId: PermissionId;
+    readonly scopeType?: string;
+}) | (AuthorizationAuditEventBase<"auth.permission_definition.updated"> & {
+    readonly permissionId: PermissionId;
+    readonly scopeType?: string;
+    readonly changedFields: readonly ("description" | "scopeType")[];
+}) | {
+    readonly [Type in "auth.permission_definition.disabled" | "auth.permission_definition.enabled" | "auth.permission_definition.deleted"]: AuthorizationAuditEventBase<Type> & {
+        readonly permissionId: PermissionId;
+        readonly scopeType?: string;
+    };
+}["auth.permission_definition.disabled" | "auth.permission_definition.enabled" | "auth.permission_definition.deleted"];
+type RoleDefinitionAuditEvent = (AuthorizationAuditEventBase<"auth.role_definition.created"> & {
+    readonly roleId: RoleId;
+}) | (AuthorizationAuditEventBase<"auth.role_definition.updated"> & {
+    readonly roleId: RoleId;
+    readonly changedFields: readonly "description"[];
+}) | {
+    readonly [Type in "auth.role_definition.disabled" | "auth.role_definition.enabled" | "auth.role_definition.deleted"]: AuthorizationAuditEventBase<Type> & {
+        readonly roleId: RoleId;
+    };
+}["auth.role_definition.disabled" | "auth.role_definition.enabled" | "auth.role_definition.deleted"];
+type PermissionGrantAuditEvent = (AuthorizationAuditEventBase<"auth.permission.granted"> & {
+    readonly subject: AuthorizationAuditSubject;
+    readonly permissionId: PermissionId;
+    readonly scope?: AuthorizationAuditScope;
+    readonly expiresAt?: UnixMillis;
+}) | (AuthorizationAuditEventBase<"auth.permission.revoked"> & {
+    readonly subject: AuthorizationAuditSubject;
+    readonly permissionId: PermissionId;
+    readonly scope?: AuthorizationAuditScope;
+    readonly expiresAt?: never;
+});
+type RoleGrantAuditEvent = (AuthorizationAuditEventBase<"auth.role.granted"> & {
+    readonly subject: AuthorizationAuditSubject;
+    readonly roleId: RoleId;
+    readonly scope?: AuthorizationAuditScope;
+    readonly expiresAt?: UnixMillis;
+}) | (AuthorizationAuditEventBase<"auth.role.revoked"> & {
+    readonly subject: AuthorizationAuditSubject;
+    readonly roleId: RoleId;
+    readonly scope?: AuthorizationAuditScope;
+    readonly expiresAt?: never;
+});
+type RolePermissionAuditEvent = {
+    readonly [Type in "auth.role_permission.assigned" | "auth.role_permission.removed"]: AuthorizationAuditEventBase<Type> & {
+        readonly roleId: RoleId;
+        readonly permissionId: PermissionId;
+        readonly scopeType?: string;
+    };
+}["auth.role_permission.assigned" | "auth.role_permission.removed"];
+export type AuthorizationAuditEvent = PermissionDefinitionAuditEvent | RoleDefinitionAuditEvent | PermissionGrantAuditEvent | RoleGrantAuditEvent | RolePermissionAuditEvent;
+export interface AssuranceTransitionSummary {
+    readonly userId: UserId;
+    readonly sessionId: SessionId;
+    readonly oldAal: AssuranceLevel;
+    readonly newAal: AssuranceLevel;
+    readonly amr: readonly AuthMethodReference[];
+    readonly method: AuthMethodReference;
+    readonly rotatedAt: UnixMillis;
+    readonly requirementsEntered: readonly SessionRequirement[];
+    readonly requirementsCleared: readonly SessionRequirement[];
+}
+export type AssuranceAuditEventType = "auth.session.assurance_changed" | "auth.session.step_up_completed" | "auth.session.primary_reauthenticated" | "auth.session.recovery_remediation.entered" | "auth.session.recovery_remediation.completed";
+export type AssuranceAuditEvent = {
+    readonly [Type in AssuranceAuditEventType]: AssuranceTransitionSummary & {
+        readonly type: Type;
+        readonly id?: AuditEventId;
+        readonly actor: AuditActor;
+        readonly request?: AuditRequest;
+        readonly occurredAt: UnixMillis;
+    };
+}[AssuranceAuditEventType];
+export type AssuranceAuditEventInput = Omit<AssuranceAuditEvent, "type" | "occurredAt"> & {
+    readonly occurredAt?: UnixMillis;
+};
+export type AuthAuditEvent = AssuranceAuditEvent | AuthorizationAuditEvent | {
+    readonly type: "auth.identity.added";
+    readonly id?: AuditEventId;
+    readonly actor: AuditActor;
+    readonly userId: UserId;
+    readonly identityId: IdentityId;
+    readonly kind: IdentityKind;
+    readonly scope: IdentityScope;
+    readonly request?: AuditRequest;
+    readonly occurredAt: UnixMillis;
+} | {
+    readonly type: "auth.identity.primary_changed";
+    readonly id?: AuditEventId;
+    readonly actor: AuditActor;
+    readonly userId: UserId;
+    readonly identityId: IdentityId;
+    readonly kind: IdentityKind;
+    readonly scope: IdentityScope;
+    readonly request?: AuditRequest;
+    readonly occurredAt: UnixMillis;
+} | {
+    readonly type: "auth.identity.replaced";
+    readonly id?: AuditEventId;
+    readonly actor: AuditActor;
+    readonly userId: UserId;
+    readonly identityId: IdentityId;
+    readonly replacementIdentityId: IdentityId;
+    readonly kind: IdentityKind;
+    readonly scope: IdentityScope;
+    readonly request?: AuditRequest;
+    readonly occurredAt: UnixMillis;
+} | {
+    readonly type: "auth.identity.revoked";
+    readonly id?: AuditEventId;
+    readonly actor: AuditActor;
+    readonly userId: UserId;
+    readonly identityId: IdentityId;
+    readonly kind: IdentityKind;
+    readonly scope: IdentityScope;
+    readonly reason?: string;
+    readonly request?: AuditRequest;
+    readonly occurredAt: UnixMillis;
+} | {
     readonly type: "auth.login.succeeded";
     readonly id?: AuditEventId;
     readonly actor: AuditActor;
@@ -327,12 +502,2096 @@ export type AuthAuditEvent = {
     readonly request?: AuditRequest;
     readonly occurredAt: UnixMillis;
 };
+export declare const AuthAuditEventSchema: Schema.Union<readonly [Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literals<readonly ["auth.session.assurance_changed", "auth.session.step_up_completed", "auth.session.primary_reauthenticated", "auth.session.recovery_remediation.entered", "auth.session.recovery_remediation.completed"]>;
+    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    readonly sessionId: Schema.brand<Schema.String, "auth/SessionId">;
+    readonly oldAal: Schema.Literals<readonly ["aal1", "aal2", "aal3"]>;
+    readonly newAal: Schema.Literals<readonly ["aal1", "aal2", "aal3"]>;
+    readonly amr: Schema.$Array<Schema.String>;
+    readonly method: Schema.String;
+    readonly rotatedAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly requirementsEntered: Schema.$Array<Schema.String>;
+    readonly requirementsCleared: Schema.$Array<Schema.String>;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literal<"auth.permission_definition.created">;
+    readonly permissionId: Schema.brand<Schema.String, "auth/PermissionId">;
+    readonly scopeType: Schema.optional<Schema.String>;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literal<"auth.permission_definition.updated">;
+    readonly permissionId: Schema.brand<Schema.String, "auth/PermissionId">;
+    readonly scopeType: Schema.optional<Schema.String>;
+    readonly changedFields: Schema.$Array<Schema.Literals<readonly ["description", "scopeType"]>>;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literals<readonly ["auth.permission_definition.disabled", "auth.permission_definition.enabled", "auth.permission_definition.deleted"]>;
+    readonly permissionId: Schema.brand<Schema.String, "auth/PermissionId">;
+    readonly scopeType: Schema.optional<Schema.String>;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literal<"auth.role_definition.created">;
+    readonly roleId: Schema.brand<Schema.String, "auth/RoleId">;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literal<"auth.role_definition.updated">;
+    readonly roleId: Schema.brand<Schema.String, "auth/RoleId">;
+    readonly changedFields: Schema.$Array<Schema.Literal<"description">>;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literals<readonly ["auth.role_definition.disabled", "auth.role_definition.enabled", "auth.role_definition.deleted"]>;
+    readonly roleId: Schema.brand<Schema.String, "auth/RoleId">;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literal<"auth.permission.granted">;
+    readonly subject: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly subjectType: Schema.String;
+        readonly subjectReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly permissionId: Schema.brand<Schema.String, "auth/PermissionId">;
+    readonly scope: Schema.optional<Schema.Struct<{
+        readonly type: Schema.String;
+        readonly reference: Schema.optional<Schema.String>;
+    }>>;
+    readonly expiresAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literal<"auth.permission.revoked">;
+    readonly subject: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly subjectType: Schema.String;
+        readonly subjectReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly permissionId: Schema.brand<Schema.String, "auth/PermissionId">;
+    readonly scope: Schema.optional<Schema.Struct<{
+        readonly type: Schema.String;
+        readonly reference: Schema.optional<Schema.String>;
+    }>>;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literal<"auth.role.granted">;
+    readonly subject: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly subjectType: Schema.String;
+        readonly subjectReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly roleId: Schema.brand<Schema.String, "auth/RoleId">;
+    readonly scope: Schema.optional<Schema.Struct<{
+        readonly type: Schema.String;
+        readonly reference: Schema.optional<Schema.String>;
+    }>>;
+    readonly expiresAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literal<"auth.role.revoked">;
+    readonly subject: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly subjectType: Schema.String;
+        readonly subjectReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly roleId: Schema.brand<Schema.String, "auth/RoleId">;
+    readonly scope: Schema.optional<Schema.Struct<{
+        readonly type: Schema.String;
+        readonly reference: Schema.optional<Schema.String>;
+    }>>;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literals<readonly ["auth.role_permission.assigned", "auth.role_permission.removed"]>;
+    readonly roleId: Schema.brand<Schema.String, "auth/RoleId">;
+    readonly permissionId: Schema.brand<Schema.String, "auth/PermissionId">;
+    readonly scopeType: Schema.optional<Schema.String>;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literals<readonly ["auth.identity.added", "auth.identity.primary_changed"]>;
+    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    readonly identityId: Schema.brand<Schema.String, "auth/IdentityId">;
+    readonly kind: Schema.String;
+    readonly scope: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"global">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"tenant">;
+        readonly tenantId: Schema.String;
+    }>]>;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literal<"auth.identity.replaced">;
+    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    readonly identityId: Schema.brand<Schema.String, "auth/IdentityId">;
+    readonly replacementIdentityId: Schema.brand<Schema.String, "auth/IdentityId">;
+    readonly kind: Schema.String;
+    readonly scope: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"global">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"tenant">;
+        readonly tenantId: Schema.String;
+    }>]>;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literal<"auth.identity.revoked">;
+    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    readonly identityId: Schema.brand<Schema.String, "auth/IdentityId">;
+    readonly kind: Schema.String;
+    readonly scope: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"global">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"tenant">;
+        readonly tenantId: Schema.String;
+    }>]>;
+    readonly reason: Schema.optional<Schema.String>;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literal<"auth.login.succeeded">;
+    readonly method: Schema.String;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly type: Schema.Literal<"auth.login.failed">;
+    readonly subject: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"email">;
+        readonly emailHash: Schema.brand<Schema.String, "auth/EmailHash">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    }>]>;
+    readonly method: Schema.String;
+    readonly reason: Schema.String;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literal<"auth.session.revoked">;
+    readonly sessionId: Schema.brand<Schema.String, "auth/SessionId">;
+    readonly reason: Schema.String;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literal<"auth.risk.assessed">;
+    readonly assessment: Schema.Struct<{
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly method: Schema.String;
+        readonly amr: Schema.$Array<Schema.String>;
+        readonly aal: Schema.Literals<readonly ["aal1", "aal2", "aal3"]>;
+        readonly device: Schema.Struct<{
+            readonly status: Schema.Literals<readonly ["known", "new", "unknown"]>;
+        }>;
+        readonly risk: Schema.Struct<{
+            readonly level: Schema.Literals<readonly ["unknown", "low", "medium", "high", "critical"]>;
+            readonly signals: Schema.$Array<Schema.Struct<{
+                readonly type: Schema.String;
+                readonly level: Schema.optional<Schema.Literals<readonly ["unknown", "low", "medium", "high", "critical"]>>;
+            }>>;
+        }>;
+        readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+    }>;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literal<"auth.policy.denied">;
+    readonly policyId: Schema.brand<Schema.String, "auth/PolicyId">;
+    readonly reason: Schema.String;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literals<readonly ["auth.oauth.account.linked", "auth.oauth.account.unlinked"]>;
+    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    readonly accountId: Schema.brand<Schema.String, "auth/OAuthAccountId">;
+    readonly providerId: Schema.brand<Schema.String, "auth/OAuthProviderId">;
+    readonly providerAccountId: Schema.String;
+    readonly reason: Schema.String;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literals<readonly ["auth.oauth.link_confirmation.started", "auth.oauth.link_confirmation.confirmed"]>;
+    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
+    readonly providerId: Schema.brand<Schema.String, "auth/OAuthProviderId">;
+    readonly providerAccountId: Schema.String;
+    readonly reason: Schema.String;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literal<"auth.oauth.provider_token.refreshed">;
+    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    readonly accountId: Schema.brand<Schema.String, "auth/OAuthAccountId">;
+    readonly providerId: Schema.brand<Schema.String, "auth/OAuthProviderId">;
+    readonly providerAccountId: Schema.String;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literal<"auth.oauth.provider_token.revoked">;
+    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    readonly accountId: Schema.brand<Schema.String, "auth/OAuthAccountId">;
+    readonly providerId: Schema.brand<Schema.String, "auth/OAuthProviderId">;
+    readonly providerAccountId: Schema.String;
+    readonly reason: Schema.String;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literal<"auth.passkey.credential.revoked">;
+    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    readonly credentialId: Schema.brand<Schema.String, "auth/PasskeyCredentialId">;
+    readonly reason: Schema.String;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literals<readonly ["auth.totp.enrollment.started", "auth.totp.factor.confirmed", "auth.totp.factor.verified"]>;
+    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    readonly factorId: Schema.brand<Schema.String, "auth/CredentialId">;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literal<"auth.totp.factor.revoked">;
+    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    readonly factorId: Schema.brand<Schema.String, "auth/CredentialId">;
+    readonly reason: Schema.String;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literal<"auth.recovery_code.generated">;
+    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    readonly count: Schema.Number;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literal<"auth.recovery_code.verified">;
+    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    readonly codeId: Schema.brand<Schema.String, "auth/CredentialId">;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literal<"auth.recovery_code.revoked">;
+    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    readonly codeId: Schema.brand<Schema.String, "auth/CredentialId">;
+    readonly reason: Schema.String;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literals<readonly ["auth.api_key.created", "auth.api_key.verified"]>;
+    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    readonly keyId: Schema.brand<Schema.String, "auth/ApiKeyId">;
+    readonly scopes: Schema.$Array<Schema.String>;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literal<"auth.api_key.revoked">;
+    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    readonly keyId: Schema.brand<Schema.String, "auth/ApiKeyId">;
+    readonly reason: Schema.String;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literal<"auth.api_key.verification_failed">;
+    readonly reason: Schema.String;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literal<"auth.refresh_token.issued">;
+    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    readonly tokenId: Schema.brand<Schema.String, "auth/RefreshTokenId">;
+    readonly familyId: Schema.brand<Schema.String, "auth/RefreshTokenFamilyId">;
+    readonly expiresAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literal<"auth.refresh_token.rotated">;
+    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    readonly previousTokenId: Schema.brand<Schema.String, "auth/RefreshTokenId">;
+    readonly tokenId: Schema.brand<Schema.String, "auth/RefreshTokenId">;
+    readonly familyId: Schema.brand<Schema.String, "auth/RefreshTokenFamilyId">;
+    readonly expiresAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literal<"auth.refresh_token.reuse_detected">;
+    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    readonly tokenId: Schema.brand<Schema.String, "auth/RefreshTokenId">;
+    readonly familyId: Schema.brand<Schema.String, "auth/RefreshTokenFamilyId">;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literal<"auth.refresh_token.revoked">;
+    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    readonly familyId: Schema.brand<Schema.String, "auth/RefreshTokenFamilyId">;
+    readonly tokenId: Schema.optional<Schema.brand<Schema.String, "auth/RefreshTokenId">>;
+    readonly reason: Schema.String;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literal<"auth.incident_action.executed">;
+    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    readonly result: Schema.Struct<{
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly reason: Schema.optional<Schema.String>;
+        readonly sessions: Schema.optional<Schema.Struct<{
+            readonly revokedAll: Schema.Literal<true>;
+            readonly activeBefore: Schema.Number;
+            readonly sessionIds: Schema.$Array<Schema.brand<Schema.String, "auth/SessionId">>;
+        }>>;
+        readonly trustedDevices: Schema.optional<Schema.Struct<{
+            readonly revoked: Schema.Number;
+            readonly deviceIds: Schema.$Array<Schema.String>;
+        }>>;
+        readonly apiKeys: Schema.optional<Schema.Struct<{
+            readonly revoked: Schema.Number;
+            readonly keyIds: Schema.$Array<Schema.brand<Schema.String, "auth/ApiKeyId">>;
+        }>>;
+        readonly refreshTokens: Schema.optional<Schema.Struct<{
+            readonly revokedFamilies: Schema.Number;
+            readonly activeBefore: Schema.Number;
+            readonly tokenIds: Schema.$Array<Schema.brand<Schema.String, "auth/RefreshTokenId">>;
+            readonly familyIds: Schema.$Array<Schema.brand<Schema.String, "auth/RefreshTokenFamilyId">>;
+        }>>;
+    }>;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literal<"auth.jwt.introspected">;
+    readonly active: Schema.Boolean;
+    readonly jwtId: Schema.optional<Schema.String>;
+    readonly expiresAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+    readonly reason: Schema.optional<Schema.String>;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literal<"auth.jwt.revoked">;
+    readonly jwtId: Schema.String;
+    readonly expiresAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+    readonly reason: Schema.String;
+}>]>;
+declare const CustomAuditEvent_base: Schema.Class<CustomAuditEvent, Schema.Struct<{
+    readonly type: Schema.TemplateLiteral<readonly ["app.", Schema.String]>;
+    readonly version: Schema.Int;
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly subject: Schema.optional<Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"email">;
+        readonly emailHash: Schema.brand<Schema.String, "auth/EmailHash">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    }>]>>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly payload: Schema.$Record<Schema.String, Schema.Unknown>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+}>, {}>;
+export declare class CustomAuditEvent extends CustomAuditEvent_base {
+}
+export declare const CustomAuditEventSchema: Schema.Struct<{
+    readonly type: Schema.TemplateLiteral<readonly ["app.", Schema.String]>;
+    readonly version: Schema.Int;
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly subject: Schema.optional<Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"email">;
+        readonly emailHash: Schema.brand<Schema.String, "auth/EmailHash">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    }>]>>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly payload: Schema.$Record<Schema.String, Schema.Unknown>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+}>;
+export declare const isCustomAuditEvent: <I>(input: I) => input is I & {
+    readonly type: `app.${string}`;
+    readonly version: number;
+    readonly id?: (string & import("effect/Brand").Brand<"auth/AuditEventId">) | undefined;
+    readonly actor: Schema.Struct.ReadonlySide<{
+        readonly type: Schema.Literal<"anonymous">;
+    }, "Type"> | {
+        readonly type: "user";
+        readonly userId: string & import("effect/Brand").Brand<"auth/UserId">;
+        readonly sessionId?: (string & import("effect/Brand").Brand<"auth/SessionId">) | undefined;
+    } | {
+        readonly type: "custom";
+        readonly actorType: string;
+        readonly actorReference?: string | undefined;
+    };
+    readonly subject?: Schema.Struct.ReadonlySide<{
+        readonly type: Schema.Literal<"anonymous">;
+    }, "Type"> | Schema.Struct.ReadonlySide<{
+        readonly type: Schema.Literal<"email">;
+        readonly emailHash: Schema.brand<Schema.String, "auth/EmailHash">;
+    }, "Type"> | Schema.Struct.ReadonlySide<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    }, "Type"> | undefined;
+    readonly request?: {
+        readonly ipHash?: (string & import("effect/Brand").Brand<"auth/IpHash">) | undefined;
+        readonly userAgentHash?: (string & import("effect/Brand").Brand<"auth/UserAgentHash">) | undefined;
+    } | undefined;
+    readonly payload: {
+        readonly [x: string]: unknown;
+    };
+    readonly occurredAt: number & import("effect/Brand").Brand<"auth/UnixMillis">;
+};
+export type AuditEvent = AuthAuditEvent | CustomAuditEvent;
+export declare const AuditEventSchema: Schema.Union<readonly [Schema.Union<readonly [Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literals<readonly ["auth.session.assurance_changed", "auth.session.step_up_completed", "auth.session.primary_reauthenticated", "auth.session.recovery_remediation.entered", "auth.session.recovery_remediation.completed"]>;
+    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    readonly sessionId: Schema.brand<Schema.String, "auth/SessionId">;
+    readonly oldAal: Schema.Literals<readonly ["aal1", "aal2", "aal3"]>;
+    readonly newAal: Schema.Literals<readonly ["aal1", "aal2", "aal3"]>;
+    readonly amr: Schema.$Array<Schema.String>;
+    readonly method: Schema.String;
+    readonly rotatedAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly requirementsEntered: Schema.$Array<Schema.String>;
+    readonly requirementsCleared: Schema.$Array<Schema.String>;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literal<"auth.permission_definition.created">;
+    readonly permissionId: Schema.brand<Schema.String, "auth/PermissionId">;
+    readonly scopeType: Schema.optional<Schema.String>;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literal<"auth.permission_definition.updated">;
+    readonly permissionId: Schema.brand<Schema.String, "auth/PermissionId">;
+    readonly scopeType: Schema.optional<Schema.String>;
+    readonly changedFields: Schema.$Array<Schema.Literals<readonly ["description", "scopeType"]>>;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literals<readonly ["auth.permission_definition.disabled", "auth.permission_definition.enabled", "auth.permission_definition.deleted"]>;
+    readonly permissionId: Schema.brand<Schema.String, "auth/PermissionId">;
+    readonly scopeType: Schema.optional<Schema.String>;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literal<"auth.role_definition.created">;
+    readonly roleId: Schema.brand<Schema.String, "auth/RoleId">;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literal<"auth.role_definition.updated">;
+    readonly roleId: Schema.brand<Schema.String, "auth/RoleId">;
+    readonly changedFields: Schema.$Array<Schema.Literal<"description">>;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literals<readonly ["auth.role_definition.disabled", "auth.role_definition.enabled", "auth.role_definition.deleted"]>;
+    readonly roleId: Schema.brand<Schema.String, "auth/RoleId">;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literal<"auth.permission.granted">;
+    readonly subject: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly subjectType: Schema.String;
+        readonly subjectReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly permissionId: Schema.brand<Schema.String, "auth/PermissionId">;
+    readonly scope: Schema.optional<Schema.Struct<{
+        readonly type: Schema.String;
+        readonly reference: Schema.optional<Schema.String>;
+    }>>;
+    readonly expiresAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literal<"auth.permission.revoked">;
+    readonly subject: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly subjectType: Schema.String;
+        readonly subjectReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly permissionId: Schema.brand<Schema.String, "auth/PermissionId">;
+    readonly scope: Schema.optional<Schema.Struct<{
+        readonly type: Schema.String;
+        readonly reference: Schema.optional<Schema.String>;
+    }>>;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literal<"auth.role.granted">;
+    readonly subject: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly subjectType: Schema.String;
+        readonly subjectReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly roleId: Schema.brand<Schema.String, "auth/RoleId">;
+    readonly scope: Schema.optional<Schema.Struct<{
+        readonly type: Schema.String;
+        readonly reference: Schema.optional<Schema.String>;
+    }>>;
+    readonly expiresAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literal<"auth.role.revoked">;
+    readonly subject: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly subjectType: Schema.String;
+        readonly subjectReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly roleId: Schema.brand<Schema.String, "auth/RoleId">;
+    readonly scope: Schema.optional<Schema.Struct<{
+        readonly type: Schema.String;
+        readonly reference: Schema.optional<Schema.String>;
+    }>>;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literals<readonly ["auth.role_permission.assigned", "auth.role_permission.removed"]>;
+    readonly roleId: Schema.brand<Schema.String, "auth/RoleId">;
+    readonly permissionId: Schema.brand<Schema.String, "auth/PermissionId">;
+    readonly scopeType: Schema.optional<Schema.String>;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literals<readonly ["auth.identity.added", "auth.identity.primary_changed"]>;
+    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    readonly identityId: Schema.brand<Schema.String, "auth/IdentityId">;
+    readonly kind: Schema.String;
+    readonly scope: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"global">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"tenant">;
+        readonly tenantId: Schema.String;
+    }>]>;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literal<"auth.identity.replaced">;
+    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    readonly identityId: Schema.brand<Schema.String, "auth/IdentityId">;
+    readonly replacementIdentityId: Schema.brand<Schema.String, "auth/IdentityId">;
+    readonly kind: Schema.String;
+    readonly scope: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"global">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"tenant">;
+        readonly tenantId: Schema.String;
+    }>]>;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literal<"auth.identity.revoked">;
+    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    readonly identityId: Schema.brand<Schema.String, "auth/IdentityId">;
+    readonly kind: Schema.String;
+    readonly scope: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"global">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"tenant">;
+        readonly tenantId: Schema.String;
+    }>]>;
+    readonly reason: Schema.optional<Schema.String>;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literal<"auth.login.succeeded">;
+    readonly method: Schema.String;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly type: Schema.Literal<"auth.login.failed">;
+    readonly subject: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"email">;
+        readonly emailHash: Schema.brand<Schema.String, "auth/EmailHash">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    }>]>;
+    readonly method: Schema.String;
+    readonly reason: Schema.String;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literal<"auth.session.revoked">;
+    readonly sessionId: Schema.brand<Schema.String, "auth/SessionId">;
+    readonly reason: Schema.String;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literal<"auth.risk.assessed">;
+    readonly assessment: Schema.Struct<{
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly method: Schema.String;
+        readonly amr: Schema.$Array<Schema.String>;
+        readonly aal: Schema.Literals<readonly ["aal1", "aal2", "aal3"]>;
+        readonly device: Schema.Struct<{
+            readonly status: Schema.Literals<readonly ["known", "new", "unknown"]>;
+        }>;
+        readonly risk: Schema.Struct<{
+            readonly level: Schema.Literals<readonly ["unknown", "low", "medium", "high", "critical"]>;
+            readonly signals: Schema.$Array<Schema.Struct<{
+                readonly type: Schema.String;
+                readonly level: Schema.optional<Schema.Literals<readonly ["unknown", "low", "medium", "high", "critical"]>>;
+            }>>;
+        }>;
+        readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+    }>;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literal<"auth.policy.denied">;
+    readonly policyId: Schema.brand<Schema.String, "auth/PolicyId">;
+    readonly reason: Schema.String;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literals<readonly ["auth.oauth.account.linked", "auth.oauth.account.unlinked"]>;
+    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    readonly accountId: Schema.brand<Schema.String, "auth/OAuthAccountId">;
+    readonly providerId: Schema.brand<Schema.String, "auth/OAuthProviderId">;
+    readonly providerAccountId: Schema.String;
+    readonly reason: Schema.String;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literals<readonly ["auth.oauth.link_confirmation.started", "auth.oauth.link_confirmation.confirmed"]>;
+    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    readonly challengeId: Schema.brand<Schema.String, "auth/ChallengeId">;
+    readonly providerId: Schema.brand<Schema.String, "auth/OAuthProviderId">;
+    readonly providerAccountId: Schema.String;
+    readonly reason: Schema.String;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literal<"auth.oauth.provider_token.refreshed">;
+    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    readonly accountId: Schema.brand<Schema.String, "auth/OAuthAccountId">;
+    readonly providerId: Schema.brand<Schema.String, "auth/OAuthProviderId">;
+    readonly providerAccountId: Schema.String;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literal<"auth.oauth.provider_token.revoked">;
+    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    readonly accountId: Schema.brand<Schema.String, "auth/OAuthAccountId">;
+    readonly providerId: Schema.brand<Schema.String, "auth/OAuthProviderId">;
+    readonly providerAccountId: Schema.String;
+    readonly reason: Schema.String;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literal<"auth.passkey.credential.revoked">;
+    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    readonly credentialId: Schema.brand<Schema.String, "auth/PasskeyCredentialId">;
+    readonly reason: Schema.String;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literals<readonly ["auth.totp.enrollment.started", "auth.totp.factor.confirmed", "auth.totp.factor.verified"]>;
+    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    readonly factorId: Schema.brand<Schema.String, "auth/CredentialId">;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literal<"auth.totp.factor.revoked">;
+    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    readonly factorId: Schema.brand<Schema.String, "auth/CredentialId">;
+    readonly reason: Schema.String;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literal<"auth.recovery_code.generated">;
+    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    readonly count: Schema.Number;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literal<"auth.recovery_code.verified">;
+    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    readonly codeId: Schema.brand<Schema.String, "auth/CredentialId">;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literal<"auth.recovery_code.revoked">;
+    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    readonly codeId: Schema.brand<Schema.String, "auth/CredentialId">;
+    readonly reason: Schema.String;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literals<readonly ["auth.api_key.created", "auth.api_key.verified"]>;
+    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    readonly keyId: Schema.brand<Schema.String, "auth/ApiKeyId">;
+    readonly scopes: Schema.$Array<Schema.String>;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literal<"auth.api_key.revoked">;
+    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    readonly keyId: Schema.brand<Schema.String, "auth/ApiKeyId">;
+    readonly reason: Schema.String;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literal<"auth.api_key.verification_failed">;
+    readonly reason: Schema.String;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literal<"auth.refresh_token.issued">;
+    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    readonly tokenId: Schema.brand<Schema.String, "auth/RefreshTokenId">;
+    readonly familyId: Schema.brand<Schema.String, "auth/RefreshTokenFamilyId">;
+    readonly expiresAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literal<"auth.refresh_token.rotated">;
+    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    readonly previousTokenId: Schema.brand<Schema.String, "auth/RefreshTokenId">;
+    readonly tokenId: Schema.brand<Schema.String, "auth/RefreshTokenId">;
+    readonly familyId: Schema.brand<Schema.String, "auth/RefreshTokenFamilyId">;
+    readonly expiresAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literal<"auth.refresh_token.reuse_detected">;
+    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    readonly tokenId: Schema.brand<Schema.String, "auth/RefreshTokenId">;
+    readonly familyId: Schema.brand<Schema.String, "auth/RefreshTokenFamilyId">;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literal<"auth.refresh_token.revoked">;
+    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    readonly familyId: Schema.brand<Schema.String, "auth/RefreshTokenFamilyId">;
+    readonly tokenId: Schema.optional<Schema.brand<Schema.String, "auth/RefreshTokenId">>;
+    readonly reason: Schema.String;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literal<"auth.incident_action.executed">;
+    readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    readonly result: Schema.Struct<{
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly reason: Schema.optional<Schema.String>;
+        readonly sessions: Schema.optional<Schema.Struct<{
+            readonly revokedAll: Schema.Literal<true>;
+            readonly activeBefore: Schema.Number;
+            readonly sessionIds: Schema.$Array<Schema.brand<Schema.String, "auth/SessionId">>;
+        }>>;
+        readonly trustedDevices: Schema.optional<Schema.Struct<{
+            readonly revoked: Schema.Number;
+            readonly deviceIds: Schema.$Array<Schema.String>;
+        }>>;
+        readonly apiKeys: Schema.optional<Schema.Struct<{
+            readonly revoked: Schema.Number;
+            readonly keyIds: Schema.$Array<Schema.brand<Schema.String, "auth/ApiKeyId">>;
+        }>>;
+        readonly refreshTokens: Schema.optional<Schema.Struct<{
+            readonly revokedFamilies: Schema.Number;
+            readonly activeBefore: Schema.Number;
+            readonly tokenIds: Schema.$Array<Schema.brand<Schema.String, "auth/RefreshTokenId">>;
+            readonly familyIds: Schema.$Array<Schema.brand<Schema.String, "auth/RefreshTokenFamilyId">>;
+        }>>;
+    }>;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literal<"auth.jwt.introspected">;
+    readonly active: Schema.Boolean;
+    readonly jwtId: Schema.optional<Schema.String>;
+    readonly expiresAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+    readonly reason: Schema.optional<Schema.String>;
+}>, Schema.Struct<{
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly type: Schema.Literal<"auth.jwt.revoked">;
+    readonly jwtId: Schema.String;
+    readonly expiresAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+    readonly reason: Schema.String;
+}>]>, Schema.Struct<{
+    readonly type: Schema.TemplateLiteral<readonly ["app.", Schema.String]>;
+    readonly version: Schema.Int;
+    readonly id: Schema.optional<Schema.brand<Schema.String, "auth/AuditEventId">>;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+        readonly sessionId: Schema.optional<Schema.brand<Schema.String, "auth/SessionId">>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"custom">;
+        readonly actorType: Schema.String;
+        readonly actorReference: Schema.optional<Schema.String>;
+    }>]>;
+    readonly subject: Schema.optional<Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anonymous">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"email">;
+        readonly emailHash: Schema.brand<Schema.String, "auth/EmailHash">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly userId: Schema.brand<Schema.String, "auth/UserId">;
+    }>]>>;
+    readonly request: Schema.optional<Schema.Struct<{
+        readonly ipHash: Schema.optional<Schema.brand<Schema.String, "auth/IpHash">>;
+        readonly userAgentHash: Schema.optional<Schema.brand<Schema.String, "auth/UserAgentHash">>;
+    }>>;
+    readonly payload: Schema.$Record<Schema.String, Schema.Unknown>;
+    readonly occurredAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+}>]>;
+export declare const decodeAuditEvent: (input: unknown) => AuditEvent;
+export declare const isAuthAuditEvent: (event: AuditEvent) => event is AuthAuditEvent;
 export interface AuditLogService {
-    readonly emit: (event: AuthAuditEvent) => Effect.Effect<void, AuditLogError>;
+    readonly emit: (event: AuditEvent) => Effect.Effect<void, AuditLogError>;
 }
 export interface AuditLogListInput {
     readonly userId?: UserId;
-    readonly types?: readonly AuthAuditEvent["type"][];
+    readonly types?: readonly AuditEvent["type"][];
     readonly beforeOccurredAt?: UnixMillis;
     readonly limit?: number;
 }
@@ -341,68 +2600,71 @@ export interface AuditLogDeleteBeforeInput {
     readonly userId?: UserId;
 }
 export interface AuditLogStoreService {
-    readonly insert: (event: AuthAuditEvent) => Effect.Effect<void, AuditLogStoreError>;
-    readonly list: (input?: AuditLogListInput) => Effect.Effect<readonly AuthAuditEvent[], AuditLogStoreError>;
+    readonly insertMany: (events: readonly AuditEvent[]) => Effect.Effect<void, AuditLogStoreError>;
+    readonly list: (input?: AuditLogListInput) => Effect.Effect<readonly AuditEvent[], AuditLogStoreError>;
     readonly deleteBefore: (input: AuditLogDeleteBeforeInput) => Effect.Effect<number, AuditLogStoreError>;
 }
 declare const AuditLog_base: Context.ServiceClass<AuditLog, "auth/AuditLog", AuditLogService>;
 export declare class AuditLog extends AuditLog_base {
 }
-export declare namespace AuditLog {
-    const make: (service: AuditLogService) => AuditLogService;
-}
 declare const AuditLogStore_base: Context.ServiceClass<AuditLogStore, "auth/AuditLogStore", AuditLogStoreService>;
 export declare class AuditLogStore extends AuditLogStore_base {
 }
-export declare namespace AuditLogStore {
-    const make: (service: AuditLogStoreService) => AuditLogStoreService;
-}
 export type AuditEventInput<Type extends AuthAuditEvent["type"]> = Omit<Extract<AuthAuditEvent, {
     readonly type: Type;
 }>, "type" | "occurredAt"> & {
     readonly occurredAt?: UnixMillis;
 };
-export declare const auditEventUserId: (event: AuthAuditEvent) => UserId | undefined;
-export declare const auditEventActorUserId: (event: AuthAuditEvent) => UserId | undefined;
-export declare const filterAuditLogEvents: (events: Iterable<AuthAuditEvent>, input?: AuditLogListInput) => readonly AuthAuditEvent[];
-export declare const makeAuditLogFromStore: (store: AuditLogStoreService) => AuditLogService;
-export declare const emit: (event: AuthAuditEvent) => Effect.Effect<void, AuditLogError, AuditLog>;
-export declare const insertAuditLogEvent: (event: AuthAuditEvent) => Effect.Effect<void, AuditLogStoreError, AuditLogStore>;
-export declare const listAuditLogEvents: (input?: AuditLogListInput) => Effect.Effect<readonly AuthAuditEvent[], AuditLogStoreError, AuditLogStore>;
+export declare const auditEventUserId: (event: AuditEvent) => UserId | undefined;
+export declare const auditEventActorUserId: (event: AuditEvent) => UserId | undefined;
+export declare const filterAuditLogEvents: (events: Iterable<AuditEvent>, input?: AuditLogListInput) => readonly AuditEvent[];
+export declare const emit: (event: AuditEvent) => Effect.Effect<void>;
+export declare const emitRequired: (event: AuditEvent) => Effect.Effect<void, AuditLogError, AuditLog>;
+export declare const insertAuditLogEvents: (events: readonly AuditEvent[]) => Effect.Effect<void, AuditLogStoreError, AuditLogStore>;
+export declare const listAuditLogEvents: (input?: AuditLogListInput) => Effect.Effect<readonly AuditEvent[], AuditLogStoreError, AuditLogStore>;
 export declare const deleteAuditLogEventsBefore: (input: AuditLogDeleteBeforeInput) => Effect.Effect<number, AuditLogStoreError, AuditLogStore>;
-export declare const loginSucceeded: (input: AuditEventInput<"auth.login.succeeded">) => Effect.Effect<void, AuditLogError, AuditLog>;
-export declare const loginFailed: (input: AuditEventInput<"auth.login.failed">) => Effect.Effect<void, AuditLogError, AuditLog>;
-export declare const sessionRevoked: (input: AuditEventInput<"auth.session.revoked">) => Effect.Effect<void, AuditLogError, AuditLog>;
-export declare const loginRiskAssessed: (input: AuditEventInput<"auth.risk.assessed">) => Effect.Effect<void, AuditLogError, AuditLog>;
-export declare const policyDenied: (input: AuditEventInput<"auth.policy.denied">) => Effect.Effect<void, AuditLogError, AuditLog>;
-export declare const oauthAccountLinked: (input: AuditEventInput<"auth.oauth.account.linked">) => Effect.Effect<void, AuditLogError, AuditLog>;
-export declare const oauthAccountUnlinked: (input: AuditEventInput<"auth.oauth.account.unlinked">) => Effect.Effect<void, AuditLogError, AuditLog>;
-export declare const oauthLinkConfirmationStarted: (input: AuditEventInput<"auth.oauth.link_confirmation.started">) => Effect.Effect<void, AuditLogError, AuditLog>;
-export declare const oauthLinkConfirmationConfirmed: (input: AuditEventInput<"auth.oauth.link_confirmation.confirmed">) => Effect.Effect<void, AuditLogError, AuditLog>;
-export declare const oauthProviderTokenRefreshed: (input: AuditEventInput<"auth.oauth.provider_token.refreshed">) => Effect.Effect<void, AuditLogError, AuditLog>;
-export declare const oauthProviderTokenRevoked: (input: AuditEventInput<"auth.oauth.provider_token.revoked">) => Effect.Effect<void, AuditLogError, AuditLog>;
-export declare const passkeyCredentialRevoked: (input: AuditEventInput<"auth.passkey.credential.revoked">) => Effect.Effect<void, AuditLogError, AuditLog>;
-export declare const totpEnrollmentStarted: (input: AuditEventInput<"auth.totp.enrollment.started">) => Effect.Effect<void, AuditLogError, AuditLog>;
-export declare const totpFactorConfirmed: (input: AuditEventInput<"auth.totp.factor.confirmed">) => Effect.Effect<void, AuditLogError, AuditLog>;
-export declare const totpFactorVerified: (input: AuditEventInput<"auth.totp.factor.verified">) => Effect.Effect<void, AuditLogError, AuditLog>;
-export declare const totpFactorRevoked: (input: AuditEventInput<"auth.totp.factor.revoked">) => Effect.Effect<void, AuditLogError, AuditLog>;
-export declare const recoveryCodeGenerated: (input: AuditEventInput<"auth.recovery_code.generated">) => Effect.Effect<void, AuditLogError, AuditLog>;
-export declare const recoveryCodeVerified: (input: AuditEventInput<"auth.recovery_code.verified">) => Effect.Effect<void, AuditLogError, AuditLog>;
-export declare const recoveryCodeRevoked: (input: AuditEventInput<"auth.recovery_code.revoked">) => Effect.Effect<void, AuditLogError, AuditLog>;
-export declare const apiKeyCreated: (input: AuditEventInput<"auth.api_key.created">) => Effect.Effect<void, AuditLogError, AuditLog>;
-export declare const apiKeyVerified: (input: AuditEventInput<"auth.api_key.verified">) => Effect.Effect<void, AuditLogError, AuditLog>;
-export declare const apiKeyRevoked: (input: AuditEventInput<"auth.api_key.revoked">) => Effect.Effect<void, AuditLogError, AuditLog>;
-export declare const apiKeyVerificationFailed: (input: AuditEventInput<"auth.api_key.verification_failed">) => Effect.Effect<void, AuditLogError, AuditLog>;
-export declare const refreshTokenIssued: (input: AuditEventInput<"auth.refresh_token.issued">) => Effect.Effect<void, AuditLogError, AuditLog>;
-export declare const refreshTokenRotated: (input: AuditEventInput<"auth.refresh_token.rotated">) => Effect.Effect<void, AuditLogError, AuditLog>;
-export declare const refreshTokenReuseDetected: (input: AuditEventInput<"auth.refresh_token.reuse_detected">) => Effect.Effect<void, AuditLogError, AuditLog>;
-export declare const refreshTokenRevoked: (input: AuditEventInput<"auth.refresh_token.revoked">) => Effect.Effect<void, AuditLogError, AuditLog>;
-export declare const incidentActionExecuted: (input: AuditEventInput<"auth.incident_action.executed">) => Effect.Effect<void, AuditLogError, AuditLog>;
-export declare const jwtIntrospected: (input: AuditEventInput<"auth.jwt.introspected">) => Effect.Effect<void, AuditLogError, AuditLog>;
-export declare const jwtRevoked: (input: AuditEventInput<"auth.jwt.revoked">) => Effect.Effect<void, AuditLogError, AuditLog>;
+export declare const loginSucceeded: (input: AuditEventInput<"auth.login.succeeded">) => Effect.Effect<void>;
+export declare const identityAdded: (input: AuditEventInput<"auth.identity.added">) => Effect.Effect<void, never, never>;
+export declare const identityReplaced: (input: AuditEventInput<"auth.identity.replaced">) => Effect.Effect<void, never, never>;
+export declare const identityRevoked: (input: AuditEventInput<"auth.identity.revoked">) => Effect.Effect<void, never, never>;
+export declare const identityPrimaryChanged: (input: AuditEventInput<"auth.identity.primary_changed">) => Effect.Effect<void, never, never>;
+export declare const sessionAssuranceChanged: (input: AssuranceAuditEventInput) => Effect.Effect<void, never, never>;
+export declare const sessionStepUpCompleted: (input: AssuranceAuditEventInput) => Effect.Effect<void, never, never>;
+export declare const sessionPrimaryReauthenticated: (input: AssuranceAuditEventInput) => Effect.Effect<void, never, never>;
+export declare const recoveryRemediationEntered: (input: AssuranceAuditEventInput) => Effect.Effect<void, never, never>;
+export declare const recoveryRemediationCompleted: (input: AssuranceAuditEventInput) => Effect.Effect<void, never, never>;
+export declare const loginFailed: (input: AuditEventInput<"auth.login.failed">) => Effect.Effect<void>;
+export declare const sessionRevoked: (input: AuditEventInput<"auth.session.revoked">) => Effect.Effect<void>;
+export declare const loginRiskAssessed: (input: AuditEventInput<"auth.risk.assessed">) => Effect.Effect<void>;
+export declare const policyDenied: (input: AuditEventInput<"auth.policy.denied">) => Effect.Effect<void>;
+export declare const oauthAccountLinked: (input: AuditEventInput<"auth.oauth.account.linked">) => Effect.Effect<void>;
+export declare const oauthAccountUnlinked: (input: AuditEventInput<"auth.oauth.account.unlinked">) => Effect.Effect<void>;
+export declare const oauthLinkConfirmationStarted: (input: AuditEventInput<"auth.oauth.link_confirmation.started">) => Effect.Effect<void>;
+export declare const oauthLinkConfirmationConfirmed: (input: AuditEventInput<"auth.oauth.link_confirmation.confirmed">) => Effect.Effect<void>;
+export declare const oauthProviderTokenRefreshed: (input: AuditEventInput<"auth.oauth.provider_token.refreshed">) => Effect.Effect<void>;
+export declare const oauthProviderTokenRevoked: (input: AuditEventInput<"auth.oauth.provider_token.revoked">) => Effect.Effect<void>;
+export declare const passkeyCredentialRevoked: (input: AuditEventInput<"auth.passkey.credential.revoked">) => Effect.Effect<void>;
+export declare const totpEnrollmentStarted: (input: AuditEventInput<"auth.totp.enrollment.started">) => Effect.Effect<void>;
+export declare const totpFactorConfirmed: (input: AuditEventInput<"auth.totp.factor.confirmed">) => Effect.Effect<void>;
+export declare const totpFactorVerified: (input: AuditEventInput<"auth.totp.factor.verified">) => Effect.Effect<void>;
+export declare const totpFactorRevoked: (input: AuditEventInput<"auth.totp.factor.revoked">) => Effect.Effect<void>;
+export declare const recoveryCodeGenerated: (input: AuditEventInput<"auth.recovery_code.generated">) => Effect.Effect<void>;
+export declare const recoveryCodeVerified: (input: AuditEventInput<"auth.recovery_code.verified">) => Effect.Effect<void>;
+export declare const recoveryCodeRevoked: (input: AuditEventInput<"auth.recovery_code.revoked">) => Effect.Effect<void>;
+export declare const apiKeyCreated: (input: AuditEventInput<"auth.api_key.created">) => Effect.Effect<void>;
+export declare const apiKeyVerified: (input: AuditEventInput<"auth.api_key.verified">) => Effect.Effect<void>;
+export declare const apiKeyRevoked: (input: AuditEventInput<"auth.api_key.revoked">) => Effect.Effect<void>;
+export declare const apiKeyVerificationFailed: (input: AuditEventInput<"auth.api_key.verification_failed">) => Effect.Effect<void>;
+export declare const refreshTokenIssued: (input: AuditEventInput<"auth.refresh_token.issued">) => Effect.Effect<void>;
+export declare const refreshTokenRotated: (input: AuditEventInput<"auth.refresh_token.rotated">) => Effect.Effect<void>;
+export declare const refreshTokenReuseDetected: (input: AuditEventInput<"auth.refresh_token.reuse_detected">) => Effect.Effect<void>;
+export declare const refreshTokenRevoked: (input: AuditEventInput<"auth.refresh_token.revoked">) => Effect.Effect<void>;
+export declare const incidentActionExecuted: (input: AuditEventInput<"auth.incident_action.executed">) => Effect.Effect<void>;
+export declare const jwtIntrospected: (input: AuditEventInput<"auth.jwt.introspected">) => Effect.Effect<void>;
+export declare const jwtRevoked: (input: AuditEventInput<"auth.jwt.revoked">) => Effect.Effect<void>;
 export declare const makeAuditLogStoreMemory: () => AuditLogStoreService;
 export declare const AuditLogStoreMemoryLive: Layer.Layer<AuditLogStore, never, never>;
-export declare const AuditLogFromStoreLive: Layer.Layer<AuditLog, never, AuditLogStore>;
+export declare const AuditLogLive: Layer.Layer<AuditLog, never, AuditLogStore>;
 export declare const AuditLogNoopLive: Layer.Layer<AuditLog, never, never>;
 export {};
 //# sourceMappingURL=AuditLog.d.ts.map