@wildo-ai/saas-models 1.0.1 → 1.1.0

package/dist/esm/compliance/audit-trails/auditable-events.shared.schema.d.ts

@@ -1,5 +1,10 @@
 import { z } from "zod";
-import { ResourceOperationRiskLevel } from "../../resources/resources.shared.schemas.js";
+import { ResourceOperationRiskLevel, ResourceOperationVariantType } from "../../resources/resources.shared.schemas";
+import { CoreResourceOperation } from "../../resources/resources.shared.core.definitions";
+import { PlatformAccessGrantAutoApprovalReason, PlatformAccessGrantLifecycleTransition, PlatformAccessGrantStatus } from "../../security/authorizations/platform-access-grants.shared.schemas";
+import { ExecutionContext_ExecutionType } from "../../runtime/execution-context.shared.schemas";
+import { AuthScopeType, SsoConnectionType } from "../../security/authentications/authentication.shared.schemas";
+import { WebhookEndpointProbeOutcome } from "../../notifications/m2m/webhook-config.shared.schemas";
 export declare enum CoreAuditableEventType {
     USER_LOGIN = "user_login",
     USER_LOGOUT = "user_logout",
@@ -9,12 +14,53 @@ export declare enum CoreAuditableEventType {
     USER_MFA_ENABLED = "user_mfa_enabled",
     USER_MFA_DISABLED = "user_mfa_disabled",
     USER_SESSION_EXPIRED = "user_session_expired",
+    MACHINE_AUTH_SUCCESS = "machine_auth_success",
+    MACHINE_AUTH_FAILED = "machine_auth_failed",
+    MACHINE_ACCESS = "machine_access",
     USER_CREATED = "user_created",
     USER_UPDATED = "user_updated",
     USER_DELETED = "user_deleted",
+    USER_APP_ROLES_CHANGED = "user_app_roles_changed",
+    APPLICATION_SUPER_ADMIN_FLOOR_BREACHED = "application_super_admin_floor_breached",
+    /**
+     * A tenant was left with no administratively usable owner by an action that was ALLOWED to proceed.
+     *
+     * The organization-scope twin of {@link APPLICATION_SUPER_ADMIN_FLOOR_BREACHED}, and unlike it this
+     * one HAS an actor: it is emitted when a user lifecycle transition (typically a suspension) removes
+     * the last usable owner of a tenant. That write is deliberately not refused — suspension is usually
+     * incident response, and blocking it would mean an operator cannot lock out a compromised owner
+     * without first transferring ownership using the tenant the attacker controls.
+     *
+     * Because the action proceeds, this record is the ENTIRE control. It is not decoration.
+     */
+    ORGANIZATION_OWNER_FLOOR_BREACHED = "organization_owner_floor_breached",
     ORGANIZATION_CREATED = "organization_created",
     ORGANIZATION_UPDATED = "organization_updated",
     ORGANIZATION_DELETED = "organization_deleted",
+    /** The tenant was MARKED for deletion (soft-delete). Its access dies here; its data dies at the purge. */
+    ORGANIZATION_DELETION_REQUESTED = "organization_deletion_requested",
+    /** A pending tenant deletion was cancelled inside the retention window. */
+    ORGANIZATION_RESTORED = "organization_restored",
+    /** The tenant was administratively HALTED. Confers no authority while suspended. */
+    ORGANIZATION_SUSPENDED = "organization_suspended",
+    /** A halted or expired tenant was returned to normal operation. */
+    ORGANIZATION_ACTIVATED = "organization_activated",
+    /**
+     * A governed lifecycle transition changed a subject's `status` — membership suspension and
+     * reactivation, administrative user suspension, self-service account deactivation.
+     *
+     * ONE event type rather than five near-identical ones, because the five verbs it serves share an
+     * identical data shape: a subject, a from→to status pair, an optional caller reason, and an
+     * optional automatic-reactivation deadline. `resourceType` + `operationIdentifier` fully
+     * discriminate which verb ran, so splitting would produce five schemas differing only in their
+     * literal and force a reviewer asking "show me every suspension" to union five queries.
+     *
+     * Deliberately distinct from {@link ORGANIZATION_SUSPENDED} / {@link ORGANIZATION_ACTIVATED},
+     * which are NOT collapsed into this: tenant transitions carry domain facts these do not
+     * (`revokedUserTypeCount` / `regrantedUserTypeCount` — the platform-wide reach of halting a
+     * tenant), so they are genuinely different events rather than the same event on another resource.
+     */
+    RESOURCE_STATUS_TRANSITION_PERFORMED = "resource_status_transition_performed",
     ORGANIZATION_MEMBER_INVITED = "organization_member_invited",
     ORGANIZATION_MEMBER_JOINED = "organization_member_joined",
     ORGANIZATION_MEMBER_UPDATED = "organization_member_updated",
@@ -25,12 +71,16 @@ export declare enum CoreAuditableEventType {
     ORGANIZATION_PREFERENCES_UPDATED = "organization_preferences_updated",
     ORGANIZATION_PROFILE_UPDATED = "organization_profile_updated",
     ORGANIZATION_UNIT_UPDATED = "organization_unit_updated",
+    ORGANIZATION_UNIT_MEMBER_ROLE_CHANGED = "organization_unit_member_role_changed",
+    ORGANIZATION_UNIT_MEMBER_REMOVED = "organization_unit_member_removed",
     USER_SSO_LOGIN = "user_sso_login",
     USER_SSO_LOGIN_FAILED = "user_sso_login_failed",
     USER_SSO_ENFORCEMENT_BLOCKED = "user_sso_enforcement_blocked",
     USER_TOKEN_REFRESHED = "user_token_refreshed",
     ORGANIZATION_SSO_CONFIGURATION_CHANGED = "organization_sso_configuration_changed",
     ORGANIZATION_SIEM_EXPORT_CONFIGURED = "organization_siem_export_configured",
+    APPLICATION_AUTH_POLICY_CHANGED = "application_auth_policy_changed",
+    WEBHOOK_ENDPOINT_TEST_DISPATCHED = "webhook_endpoint_test_dispatched",
     SCIM_TOKEN_CREATED = "scim_token_created",
     SCIM_TOKEN_REVOKED = "scim_token_revoked",
     SCIM_TOKEN_GENERATED = "scim_token_generated",
@@ -42,6 +92,15 @@ export declare enum CoreAuditableEventType {
     SCIM_USER_DEACTIVATED = "scim_user_deactivated",
     USER_PASSWORD_RESET_REQUESTED = "user_password_reset_requested",
     USER_PASSWORD_RESET_COMPLETED = "user_password_reset_completed",
+    /**
+     * An ADMINISTRATOR compelled a credential reset on another user's account.
+     *
+     * Deliberately distinct from `USER_PASSWORD_RESET_REQUESTED`, which records a SELF-SERVICE
+     * request and carries no actor: reusing it for an admin action would attribute the reset to
+     * the account owner, so the audit trail would name the wrong human for a privileged act. This
+     * event names both the actor and the target, and records the operator's documented reason.
+     */
+    USER_PASSWORD_RESET_FORCED = "user_password_reset_forced",
     USER_REGISTERED = "user_registered",
     USER_EMAIL_VERIFIED = "user_email_verified",
     USER_VERIFICATION_EMAIL_RESENT = "user_verification_email_resent",
@@ -75,8 +134,120 @@ export declare enum CoreAuditableEventType {
     OAUTH2_PROVIDER_BLOCKED = "oauth2_provider_blocked",
     ONE_OFF_TOKEN_CREATED = "one_off_token_created",
     ONE_OFF_TOKEN_EXCHANGED = "one_off_token_exchanged",
+    /** revocation-B1: a super-admin cancelled an un-exchanged one-off (impersonation) session token. */
+    ONE_OFF_TOKEN_REVOKED = "one_off_token_revoked",
+    USER_CROSS_FRONTEND_HANDOFF_ISSUED = "user_cross_frontend_handoff_issued",
     EMERGENCY_ACCESS_USED = "emergency_access_used",
-    FIELD_ACCESS = "field_access"
+    FIELD_ACCESS = "field_access",
+    RESOURCE_OPERATION_PERFORMED = "resource_operation_performed",
+    RESOURCE_OPERATION_DENIED = "resource_operation_denied",
+    CROSS_TENANT_ADMINISTRATIVE_ACCESS = "cross_tenant_administrative_access",
+    PLATFORM_ACCESS_GRANT_LIFECYCLE = "platform_access_grant_lifecycle",
+    /**
+     * An operator enumerated an APPLICATION-WIDE directory — a collection read that is deliberately
+     * not confined to any one tenant.
+     *
+     * ## Why this is not {@link CROSS_TENANT_ADMINISTRATIVE_ACCESS}
+     *
+     * That event answers "an operator reached a ROW belonging to a tenant they are not a member of",
+     * and it is emitted after comparing a FETCHED row's organization against the caller's role
+     * entries. A directory read has no row and no target tenant — the whole point is that it spans
+     * all of them — so there is nothing for that comparison to consume. Merging the two would put
+     * two different questions behind one event type and make the existing one's `targetOrganizationId`
+     * meaningless on half its rows. Closed vocabularies do not merge.
+     *
+     * ## Why it exists at all
+     *
+     * The reach is INTENDED and declared (`users | list | admin` is documented as "admin-gated global
+     * user listing"), and it cannot be governed by the platform-access-grant mechanism: that admission
+     * requires a usable grant for a TARGET tenant, and a collection call has none. So prevention is
+     * structurally unavailable and EVIDENCE is the control that remains — which is exactly what
+     * `.claude/rules/administrative-continuity-floors.md` asks for on a sanctioned reach: "every
+     * crossing is NAMED in the trail". Before this event, an operator could enumerate every user's
+     * email across every tenant and leave nothing behind.
+     *
+     * INFO, not WARNING: unlike its cross-tenant sibling this is an ordinary, expected administrative
+     * read on a surface built for it. The subset worth escalating is selected by a SIEM rule on
+     * `resourceType` + `returnedCount`, both of which ride the payload.
+     *
+     * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT — an unconfined administrative read
+     * of application-wide data is recorded with its actor, surface and size.
+     */
+    PLATFORM_DIRECTORY_ACCESS = "platform_directory_access",
+    SYSTEM_CONTEXT_READ = "system_context_read",
+    SYSTEM_CONTEXT_WRITE = "system_context_write",
+    RETAINED_DATA_ACCESS = "retained_data_access",
+    SUBJECT_DATA_EXPORT = "subject_data_export",
+    COLLECTION_DATA_EXPORT = "collection_data_export",
+    HTTP_API_READ_THROUGH_ACCESS = "http_api_read_through_access",
+    HTTP_API_EXTERNAL_ERASURE = "http_api_external_erasure",
+    HTTP_API_NON_ERASURE_ACKNOWLEDGED = "http_api_non_erasure_acknowledged",
+    /** A user-delegated `authorization_code` access token was minted for a third-party client
+     *  (the client may now act AS the user at the bound A2A/MCP resource) — the flagship grant. */
+    OAUTH_DELEGATED_TOKEN_ISSUED = "oauth_delegated_token_issued",
+    /** A user APPROVED an interactive consent request — the client is authorized for this authorize flow. */
+    OAUTH_CONSENT_GRANTED = "oauth_consent_granted",
+    /** A user DENIED an interactive consent request — access refused (protective, benign). */
+    OAUTH_CONSENT_DENIED = "oauth_consent_denied",
+    /** A durable "remember this app" consent grant was created/updated — persistent delegated authority. */
+    OAUTH_CONSENT_GRANT_PERSISTED = "oauth_consent_grant_persisted",
+    /**
+     * An ANONYMOUS caller created an OAuth client identity through RFC 7591 dynamic registration.
+     * The only write in this application reachable without any credential, so every occurrence is
+     * evidence: the row it creates is durable, and the population of these rows is what an operator
+     * needs to be able to review and revoke.
+     */
+    OAUTH_DYNAMIC_CLIENT_REGISTERED = "oauth_dynamic_client_registered",
+    /**
+     * A URL-formatted `client_id` (CIMD) was REFUSED at the authorize endpoint.
+     *
+     * Auditable because the refusal reasons are not all equal: `HOST_NOT_ALLOWED` is a
+     * misconfiguration, while `SSRF_TARGET_REFUSED` is an unauthenticated stranger trying to make
+     * this server fetch an address only it can reach. Both arrive at the same endpoint from the same
+     * kind of caller, so only the reason distinguishes them — and a spike in either is a thing an
+     * operator must be able to alert on.
+     */
+    OAUTH_CIMD_CLIENT_REFUSED = "oauth_cimd_client_refused",
+    /** A user token was rotated via the provider `refresh_token` grant (`/oauth/token`). */
+    OAUTH_TOKEN_REFRESHED = "oauth_token_refreshed",
+    /** A token was revoked via `/oauth/revoke` (RFC 7009). */
+    OAUTH_TOKEN_REVOKED = "oauth_token_revoked",
+    /** An OIDC RP-Initiated Logout terminated the End-User's OP session at `/oauth/end-session`
+     *  (revocation-C). Distinct from `USER_LOGOUT` (first-party self-logout) and `OAUTH_TOKEN_REVOKED`
+     *  (RFC 7009 token revocation): this ends a SESSION on a relying party's behalf. */
+    OAUTH_RP_INITIATED_LOGOUT = "oauth_rp_initiated_logout",
+    /** An `authorization_code` exchange was REJECTED (replay / PKCE failure / redirect mismatch / …) —
+     *  a potential attack signal. The specific cause rides `eventData.reason`. */
+    OAUTH_CODE_EXCHANGE_FAILED = "oauth_code_exchange_failed",
+    /** A consent DECISION was attempted by a user who is NOT the consent request's bound user (403) —
+     *  a textbook cross-user authorization-abuse signal. */
+    OAUTH_CONSENT_BINDING_VIOLATION = "oauth_consent_binding_violation",
+    /** Refresh-token REUSE detected → the whole token family was revoked (possible theft). Emitted by the
+     *  refresh CALLERS (the token issuer stays audit-free by design — it surfaces a reuse signal instead). */
+    USER_REFRESH_TOKEN_REUSE_DETECTED = "user_refresh_token_reuse_detected"
+}
+/**
+ * Closed vocabulary of `OAUTH_CODE_EXCHANGE_FAILED` failure causes (RFC 6749 / OAuth 2.1 / RFC 7636).
+ * A dedicated enum (not an inline literal union) so the emit sites, the schema, and any SIEM
+ * consumer share one runtime source — the project's closed-vocabulary rule.
+ */
+export declare enum OAuthCodeExchangeFailureReason {
+    /** The single-use code did not atomically consume — replayed, expired, or never issued. */
+    CODE_REPLAY_OR_INVALID = "code_replay_or_invalid",
+    /** The consumed token was of a different consumable-token type (not an authorization code). */
+    NOT_AUTHORIZATION_CODE = "not_authorization_code",
+    /** The decoded code carried no subject (userId). */
+    NO_SUBJECT = "no_subject",
+    /** The redeeming `client_id` differs from the client the code was issued to. */
+    CLIENT_MISMATCH = "client_mismatch",
+    /** The redeeming `redirect_uri` differs from the one bound at authorize. */
+    REDIRECT_URI_MISMATCH = "redirect_uri_mismatch",
+    /** The PKCE `code_verifier` failed the bound S256 challenge (or was malformed). */
+    PKCE_VERIFICATION_FAILED = "pkce_verification_failed",
+    /** The client was deactivated between authorize and redemption (redemption-window re-check). */
+    CLIENT_INACTIVE = "client_inactive",
+    /** The client lost the `authorization_code` grant between authorize and redemption. */
+    GRANT_TYPE_LOST = "grant_type_lost"
 }
 /** Canonical event categories — used by auditable-events, security-envelope, audit-logs. */
 export declare enum AuditEventCategory {
@@ -92,10 +263,66 @@ export declare enum AuditEventSeverity {
     WARNING = "warning",
     CRITICAL = "critical"
 }
-/** SSO connection type — shared with user-identity-links. */
-export declare enum SsoConnectionType {
-    SOCIAL = "social",
-    ENTERPRISE = "enterprise"
+/**
+ * Why the authorizer refused an operation. A CLOSED vocabulary — the authorizer resolves exactly
+ * one of these per refusal, and a SOC dashboard groups by it.
+ *
+ * The distinction that matters most operationally is {@link SUBJECT_NOT_RESOLVABLE} vs. the rest:
+ * every other member is a caller who reached a real, visible row and was refused on roles or scope,
+ * whereas that one is a caller who named a row they cannot see at all — the shape of tenant
+ * enumeration.
+ */
+export declare enum ResourceOperationDenialReason {
+    /**
+     * No initiator identity or roles on the execution context. Fail-closed: the authorizer refuses
+     * rather than assuming an anonymous caller.
+     *
+     * **A backstop, not a live path — verified.** The execution context fails closed earlier and
+     * harder: every execution type that reaches the authorizer refuses to CONSTRUCT without
+     * `initiatorIds`, and the one type that permits null (`WEBHOOK_CALLBACK`) is skipped before the
+     * guard, since signature verification already established trust. The roles half cannot fire
+     * either — the context spreads `initiatorRoles`, so the only accepted value is an array.
+     *
+     * A row carrying this reason therefore means something bypassed context construction. Treat it as
+     * a defect signal, not routine refusal traffic.
+     */
+    MISSING_INITIATOR = "missing_initiator",
+    /**
+     * The caller's organization-wide roles did not satisfy the operation's required role set, after
+     * role-hierarchy expansion. The everyday "you are not an admin" refusal.
+     */
+    INSUFFICIENT_ROLES = "insufficient_roles",
+    /**
+     * The caller was refused against the target row's PRIMARY SCOPE — the row belongs to another
+     * user, organization or application than the caller is entitled to. Distinct from
+     * {@link INSUFFICIENT_ROLES}: the caller may hold the right role, but in the wrong tenant.
+     */
+    SCOPE_MISMATCH = "scope_mismatch",
+    /**
+     * The caller reached the resource through a foreign-key path (`/assigned-to-users/{userId}/todos`)
+     * whose owning entity they do not control.
+     */
+    FK_RELATIONSHIP_DENIED = "fk_relationship_denied",
+    /**
+     * A collection operation was refused on its PARENT scope — the caller has no access to the
+     * organization / application whose collection they addressed.
+     */
+    PARENT_SCOPE_DENIED = "parent_scope_denied",
+    /**
+     * The named row could not be resolved for the caller: it does not exist, OR it exists and is
+     * invisible to the caller's scope. The authorizer **cannot distinguish these two** — and that is
+     * deliberate, because reporting them differently would leak the existence of out-of-scope rows.
+     * The refusal surfaces to the caller as NOT_FOUND (404) and that response is unchanged by this
+     * event; only the audit trail records that a refusal occurred.
+     *
+     * Consequently this reason is AMBIGUOUS BY CONSTRUCTION and a single occurrence proves nothing —
+     * a 404 for a genuinely deleted record lands here too. Its value is in the aggregate: a principal
+     * accumulating these against ids they never successfully read is enumerating.
+     *
+     * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT — refusals are recorded without the record itself
+     * becoming an existence oracle.
+     */
+    SUBJECT_NOT_RESOLVABLE = "subject_not_resolvable"
 }
 /** SSO configuration change type. */
 export declare enum SsoConfigChangeType {
@@ -112,6 +339,55 @@ export declare enum SiemExportChangeType {
     DISABLED = "disabled",
     UPDATED = "updated"
 }
+/**
+ * Normalised MACHINE_ACCESS operation vocabulary. Transport-native method names (A2A JSON-RPC
+ * `message/send`, MCP `tools/call`, …) are mapped to these stable, transport-prefixed audit
+ * identifiers so an org SIEM reads ONE vocabulary across every external resource-server surface.
+ * The `<transport>_<method>` shape keeps A2A and MCP operations disambiguated in a flat stream.
+ */
+export declare enum MachineAccessOperation {
+    A2A_MESSAGE_SEND = "a2a_message_send",
+    A2A_MESSAGE_STREAM = "a2a_message_stream",
+    /** Reading one task's state. Externally triggered and tenant-actionable, so it audits. */
+    A2A_TASKS_GET = "a2a_tasks_get",
+    /** Requesting cancellation of a task — a MUTATION of tenant work, audited as such. */
+    A2A_TASKS_CANCEL = "a2a_tasks_cancel",
+    /**
+     * Re-attaching to a task's update stream after a dropped connection.
+     *
+     * Audited like `A2A_TASKS_GET` and for the same reason: it is a READ of tenant work by an external
+     * principal. It deserves its own member rather than borrowing the get — a resubscribe holds a
+     * connection open for as long as the task runs, so in a trail the two have very different shapes,
+     * and collapsing them would hide a caller camping on a stream behind ordinary polling.
+     */
+    A2A_TASKS_RESUBSCRIBE = "a2a_tasks_resubscribe",
+    /**
+     * Registering a webhook the agent will POST this task's updates to.
+     *
+     * The most security-relevant of the push-notification operations and the reason all four get their
+     * own members: the caller is directing OUR server to make outbound requests to an address IT
+     * chooses, carrying credentials IT supplies. In a trail that is a different act from reading a
+     * task, and an operator reviewing egress needs to find every one of them without inferring it from
+     * a generic access row.
+     */
+    A2A_PUSH_NOTIFICATION_CONFIG_SET = "a2a_push_notification_config_set",
+    /** Reading back one registered webhook target. Secrets are redacted, but the URL is disclosed. */
+    A2A_PUSH_NOTIFICATION_CONFIG_GET = "a2a_push_notification_config_get",
+    /** Enumerating every webhook target registered against a task. */
+    A2A_PUSH_NOTIFICATION_CONFIG_LIST = "a2a_push_notification_config_list",
+    /** Removing a webhook target — a MUTATION, and the act that silently stops an operator's alerting. */
+    A2A_PUSH_NOTIFICATION_CONFIG_DELETE = "a2a_push_notification_config_delete",
+    /**
+     * Enumerating an owner's tasks (A2A 1.0 `ListTasks`).
+     *
+     * Its own member rather than borrowing `A2A_TASKS_GET`: a LIST discloses the existence and shape
+     * of work the caller did not name, which in a trail is a different act from reading one task an
+     * operator already knows about. Collapsing them would hide enumeration behind ordinary polling.
+     */
+    A2A_TASKS_LIST = "a2a_tasks_list",
+    MCP_TOOLS_LIST = "mcp_tools_list",
+    MCP_TOOLS_CALL = "mcp_tools_call"
+}
 export declare const AuditableEventTypeSchema: z.ZodUnion<readonly [z.ZodEnum<typeof CoreAuditableEventType>, z.ZodString]>;
 export declare const AuditableEvent_User_LoginEventDataSchema: z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_LOGIN>;
@@ -121,13 +397,13 @@ export declare const AuditableEvent_User_LoginEventDataSchema: z.ZodObject<{
     authMethod: z.ZodOptional<z.ZodString>;
     email: z.ZodOptional<z.ZodString>;
     sessionId: z.ZodOptional<z.ZodString>;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 export declare const AuditableEvent_User_LogoutEventDataSchema: z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_LOGOUT>;
     userId: z.ZodString;
     ipAddress: z.ZodString;
     userAgent: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 export declare const AuditableEvent_User_LoginFailedEventDataSchema: z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_LOGIN_FAILED>;
     email: z.ZodEmail;
@@ -137,7 +413,18 @@ export declare const AuditableEvent_User_LoginFailedEventDataSchema: z.ZodObject
     userAgent: z.ZodString;
     attemptsRemaining: z.ZodOptional<z.ZodNumber>;
     sessionId: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
+/**
+ * Which lockout mechanism tripped a `USER_ACCOUNT_LOCKED` audit — so a SOC can distinguish the two
+ * sources, which have different remediation: the per-SESSION progressive failed-attempt limit vs the
+ * per-EMAIL global rate-limit. Enum (fixed vocabulary), not a string union, per the project rule.
+ */
+export declare enum AccountLockoutReason {
+    /** The per-session progressive failed-attempt limit tripped (`incrementSessionAttempts`). */
+    SESSION_ATTEMPT_LIMIT = "session_attempt_limit",
+    /** The per-email GLOBAL rate-limit lockout tripped (`checkRateLimit(GLOBAL_LOCKOUT + email)`). */
+    GLOBAL_EMAIL_RATE_LIMIT = "global_email_rate_limit"
+}
 export declare const AuditableEvent_User_AccountLockedEventDataSchema: z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_ACCOUNT_LOCKED>;
     userId: z.ZodString;
@@ -147,14 +434,157 @@ export declare const AuditableEvent_User_AccountLockedEventDataSchema: z.ZodObje
     ipAddress: z.ZodString;
     userAgent: z.ZodString;
     sessionId: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>;
+    reason: z.ZodOptional<z.ZodEnum<typeof AccountLockoutReason>>;
+}, z.core.$strip>;
+/**
+ * A machine principal (api-key / OAuth-client secret / exchanged client-credentials token) that
+ * successfully authenticated. Carries the credential PROVENANCE — never the raw secret. Emitted at
+ * the OAuth token-issuance moment (`/oauth/token`); per-request direct-secret access additionally
+ * carries this provenance into any FIELD_ACCESS audit row (see `audit-access-fields`).
+ */
+export declare const AuditableEvent_MachineAuth_SuccessEventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.MACHINE_AUTH_SUCCESS>;
+    authMethod: z.ZodString;
+    credentialId: z.ZodString;
+    scopeType: z.ZodString;
+    scopeId: z.ZodOptional<z.ZodString>;
+    resourceIdentifier: z.ZodOptional<z.ZodString>;
+    operationIdentifier: z.ZodOptional<z.ZodString>;
+    ipAddress: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * A rejected machine-credential presentation (bad/expired/wrong-audience/wrong-scope secret or
+ * token, or a rate-limited source). Records the ATTEMPT — the presented credential kind + prefix,
+ * the target scope, and the reason — never a `credentialId` (the credential did not resolve). The
+ * per-source-IP brute-force signal (external-access hardening) is exactly this event stream.
+ */
+export declare const AuditableEvent_MachineAuth_FailedEventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.MACHINE_AUTH_FAILED>;
+    credentialKind: z.ZodString;
+    credentialPrefix: z.ZodOptional<z.ZodString>;
+    reason: z.ZodString;
+    scopeType: z.ZodOptional<z.ZodString>;
+    scopeId: z.ZodOptional<z.ZodString>;
+    resourceIdentifier: z.ZodOptional<z.ZodString>;
+    operationIdentifier: z.ZodOptional<z.ZodString>;
+    ipAddress: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * A machine principal (ORGANIZATION_MACHINE / APPLICATION_MACHINE) exercised an external
+ * resource-server surface (A2A `message/send`, MCP `tools/call`, …) with an already-issued,
+ * audience-bound token. The token-USE twin of MACHINE_AUTH_SUCCESS (token-MINT): the mint fires
+ * once, low-volume, at `/oauth/token`; THIS fires per external request so an org SIEM sees WHAT a
+ * machine did, not merely that it authenticated.
+ *
+ * Carries the credential PROVENANCE (authMethod + credentialId — never the raw secret), the ROLE
+ * context that authorized the access (roles are the single authorization axis — there is NO OAuth
+ * authorization-scope vocabulary), and the resource server + operation targeted. Emitted fire-and-
+ * forget at the A2A / MCP controller boundary AFTER the caller is authenticated + authorized; routed
+ * to the org SIEM via `routingOrgIds` (verified org for an ORGANIZATION_MACHINE; an
+ * APPLICATION_MACHINE has no single tenant SIEM ⇒ no per-org dispatch).
+ */
+export declare const AuditableEvent_MachineAccess_EventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.MACHINE_ACCESS>;
+    authMethod: z.ZodString;
+    credentialId: z.ZodString;
+    scopeType: z.ZodString;
+    scopeId: z.ZodOptional<z.ZodString>;
+    roles: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    resourceServer: z.ZodString;
+    resourceIdentifier: z.ZodOptional<z.ZodString>;
+    operationIdentifier: z.ZodString;
+    ipAddress: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
 export declare const AuditableEvent_User_SessionExpiredEventDataSchema: z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_SESSION_EXPIRED>;
     userId: z.ZodString;
     sessionId: z.ZodString;
     sessionDuration: z.ZodNumber;
     lastActivity: z.ZodDate;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
+/**
+ * A `USERS` row was hard-deleted.
+ *
+ * The identity is gone after this event, so the record must carry enough to answer "who was
+ * removed?" without joining back to a row that no longer exists — hence `email` alongside `userId`.
+ * That is a deliberate, narrow retention of an identifier inside the audit trail: an erasure that
+ * left no trace of having happened would defeat the purpose of the trail, and the audit store is
+ * itself immutable and access-controlled. Prefer `RETAIN_AND_IMPERSONALIZE` erasure
+ * (`eraseSubjectAsSystem`) over a hard delete wherever the retention contract allows it — this
+ * event exists to make the hard-delete path, which the framework still exposes to administrators
+ * through `USERS | DELETE`, leave evidence.
+ *
+ * `deletedBy` is the acting principal, which for the admin route is NOT the subject. Mirrors
+ * `AuditableEvent_Organization_DeletedEventDataSchema`.
+ *
+ * assurance-control: WILDO.DATA.SECURE_LIFECYCLE — identity destruction is a
+ * security-relevant event and must be attributable.
+ */
+export declare const AuditableEvent_User_DeletedEventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.USER_DELETED>;
+    userId: z.ZodString;
+    email: z.ZodOptional<z.ZodString>;
+    deletedBy: z.ZodString;
+    appRoles: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+/**
+ * Application-role grant / revocation on a `USERS` row.
+ *
+ * Carries BOTH the before and after arrays rather than only the delta: an auditor reconstructing a
+ * principal's authority at a point in time needs the resulting set, and the delta alone cannot
+ * distinguish "granted a role they already held" (a no-op) from a real widening. `requestedRoles`
+ * is what the administrator ASKED for — for an additive grant it is the delta, for a whole-array
+ * rewrite through the core UPDATE it is the full authored set — which is also exactly the set the
+ * role-ceiling gate measured, so the record shows what was checked, not just what resulted.
+ *
+ * `reason` is the administrator's free-text justification where the operation collects one
+ * (`assign_roles` / `revoke_roles`); the core UPDATE path has no such field and omits it.
+ */
+export declare const AuditableEvent_User_AppRolesChangedEventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.USER_APP_ROLES_CHANGED>;
+    userId: z.ZodString;
+    previousRoles: z.ZodArray<z.ZodString>;
+    newRoles: z.ZodArray<z.ZodString>;
+    requestedRoles: z.ZodArray<z.ZodString>;
+    operation: z.ZodString;
+    changedBy: z.ZodString;
+    reason: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * The application has no administratively usable super-administrator.
+ *
+ * Emitted by the startup floor report, not by a write path — every write that could REACH this state
+ * refuses instead, so an emission here is evidence the state arrived outside the guarded paths.
+ *
+ * `conferringRoles` is recorded because the answer depends on the LIVE role table: an application
+ * that renames or drops a custom role carrying `inheritFrom: APP_ADMIN_SUPER_ADMIN` can breach the
+ * floor without any user row changing, and an auditor reading the event a month later cannot
+ * reconstruct which roles counted at boot without it.
+ */
+export declare const AuditableEvent_Application_SuperAdminFloorBreachedEventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.APPLICATION_SUPER_ADMIN_FLOOR_BREACHED>;
+    usableSuperAdminCount: z.ZodNumber;
+    requiredUsableSuperAdminCount: z.ZodNumber;
+    conferringRoles: z.ZodArray<z.ZodString>;
+    usableStatuses: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * A tenant left unadministrable by an allowed action.
+ *
+ * Carries the tenant, the memberships that stopped counting, and WHY the action was permitted, so an
+ * auditor can tell a deliberate containment decision from an accident. `remainingUsableOwners` is
+ * recorded rather than assumed zero: the floor's minimum is configurable, and an event that hard-codes
+ * the consequence cannot be re-read against a changed policy.
+ */
+export declare const AuditableEvent_Organization_OwnerFloorBreachedEventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_OWNER_FLOOR_BREACHED>;
+    organizationId: z.ZodString;
+    reducedMemberIds: z.ZodArray<z.ZodString>;
+    remainingUsableOwners: z.ZodNumber;
+    operationIdentifier: z.ZodString;
+    subjectUserId: z.ZodString;
+    subjectNextStatus: z.ZodString;
+}, z.core.$strip>;
 export declare const AuditableEvent_OrganizationMember_InvitedEventDataSchema: z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_MEMBER_INVITED>;
     organizationId: z.ZodString;
@@ -162,28 +592,125 @@ export declare const AuditableEvent_OrganizationMember_InvitedEventDataSchema: z
     invitedBy: z.ZodString;
     roles: z.ZodArray<z.ZodString>;
     email: z.ZodOptional<z.ZodEmail>;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 export declare const AuditableEvent_OrganizationMember_JoinedEventDataSchema: z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_MEMBER_JOINED>;
     organizationId: z.ZodString;
     userId: z.ZodString;
     roles: z.ZodArray<z.ZodString>;
     invitationId: z.ZodOptional<z.ZodString>;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 export declare const AuditableEvent_OrganizationMember_UpdatedEventDataSchema: z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_MEMBER_UPDATED>;
     organizationId: z.ZodString;
     memberId: z.ZodString;
     changes: z.ZodRecord<z.ZodString, z.ZodAny>;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
+/**
+ * Organization-wide role grant / revocation on an `ORGANIZATION_MEMBERS` row.
+ *
+ * The ORGANIZATIONS-scope twin of {@link AuditableEvent_User_AppRolesChangedEventDataSchema}, and it
+ * carries the same before/after/requested triple for the same reasons: an auditor reconstructing a
+ * principal's authority at a point in time needs the RESULTING set, and the delta alone cannot
+ * distinguish "granted a role they already held" from a real widening.
+ *
+ * ## Why `requestedRoles` is not redundant with `newRoles` here
+ *
+ * It matters MORE on this resource than on the application twin. Membership CREATE runs the authored
+ * roles through resolution before persisting them — an organization type's `defaultMemberRole` is
+ * injected when the caller authored none — so "what the administrator asked for" and "what the
+ * member ended up holding" genuinely differ on an ordinary invite. `requestedRoles` is also exactly
+ * the set the role-ceiling gate measured, so the record shows what was CHECKED, not only what
+ * resulted. It is optional because "the caller authored no roles at all" (policy supplied them) is a
+ * different fact from "the caller explicitly authored an empty array", and collapsing the two would
+ * lose the distinction the ceiling gate itself draws.
+ *
+ * ## Why both `memberId` and `userId`
+ *
+ * `memberId` addresses the MEMBERSHIP ROW that was written; `userId` is the SUBJECT PRINCIPAL whose
+ * authority changed. "What could this person do on date X" is a question about the principal, and
+ * answering it through the row id alone requires a join that a retention sweep may already have
+ * removed. `AuditableEvent_OrganizationMember_RemovedEventDataSchema` carries the same pair for the
+ * same reason. `userId` stays optional so a degenerate row still leaves the rest of the evidence
+ * rather than suppressing the whole record.
+ */
 export declare const AuditableEvent_OrganizationMember_RoleChangedEventDataSchema: z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_MEMBER_ROLE_CHANGED>;
     organizationId: z.ZodString;
     memberId: z.ZodString;
+    userId: z.ZodOptional<z.ZodString>;
     previousRoles: z.ZodArray<z.ZodString>;
     newRoles: z.ZodArray<z.ZodString>;
+    requestedRoles: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    operation: z.ZodString;
     changedBy: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
+/**
+ * Per-unit role assignment on an `ORGANIZATION_UNIT_MEMBERS` row.
+ *
+ * The NARROWED twin of {@link AuditableEvent_OrganizationMember_RoleChangedEventDataSchema}. A unit
+ * assignment confers authority inside ONE organization unit — `appendUnitScopedRoles` emits it into
+ * `initiatorRoles` carrying an `organizationUnitId` discriminator, and every consumer that unions
+ * those entries partitions on that field first. The narrowing is what makes it not tenant-wide; it
+ * does not make it un-auditable, so the grant leaves evidence on the same terms.
+ *
+ * ## Why singular `role`, not an array
+ *
+ * `OrganizationUnitMember` persists ONE role per (unit, member) — that uniqueness is its business
+ * key. Reshaping it into an array here purely to mirror the organization-wide twin would invent a
+ * cardinality the resource does not have and invite a future reader to assume multiple unit roles
+ * are representable.
+ *
+ * `previousRole` is absent on an initial assignment, which is the honest encoding of "there was no
+ * prior grant" — distinct from a re-assignment away from a role that did exist.
+ */
+export declare const AuditableEvent_OrganizationUnitMember_RoleChangedEventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_UNIT_MEMBER_ROLE_CHANGED>;
+    organizationId: z.ZodOptional<z.ZodString>;
+    organizationUnitId: z.ZodOptional<z.ZodString>;
+    assignmentId: z.ZodString;
+    organizationMemberId: z.ZodOptional<z.ZodString>;
+    previousRole: z.ZodOptional<z.ZodString>;
+    newRole: z.ZodString;
+    requestedRole: z.ZodOptional<z.ZodString>;
+    operation: z.ZodString;
+    changedBy: z.ZodString;
+}, z.core.$strip>;
+/**
+ * Revocation of a per-unit role assignment — the closing half of
+ * {@link AuditableEvent_OrganizationUnitMember_RoleChangedEventDataSchema}.
+ *
+ * ## Why AUTHORIZATION rather than ORG_MANAGEMENT, unlike `ORGANIZATION_MEMBER_REMOVED`
+ *
+ * Removing an organization MEMBER is primarily a directory action — the person leaves the tenant —
+ * and the authority they lose is a consequence of that. An assignment row has no directory aspect
+ * whatsoever: it exists only to confer a role, so deleting it IS the revocation, and it is the exact
+ * counterpart of the CREATE that granted it. Classifying it as record-keeping would leave an
+ * authorization-filtered trail in which unit privileges are granted and never removed.
+ *
+ * ## Why the revoked role is captured
+ *
+ * `revokedRole` is the single field that cannot be recovered after the fact: the row is hard-deleted,
+ * so nothing else in the system can answer "what authority did this person lose". It is deliberately
+ * NOT named `previousRole` — that would imply a successor role, and there is none.
+ *
+ * ## Coverage boundary
+ *
+ * Emitted on the DIRECT assignment DELETE — the targeted revocation an operator performs and an
+ * auditor reviews. Cascade removals (deleting the parent membership, or the whole organization) run
+ * through the raw repository, which by construction does not execute service custom implementations;
+ * those are evidenced by their own parent event, because the semantic act there is losing the
+ * membership or the tenant, not revoking one unit role.
+ */
+export declare const AuditableEvent_OrganizationUnitMember_RemovedEventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_UNIT_MEMBER_REMOVED>;
+    organizationId: z.ZodOptional<z.ZodString>;
+    organizationUnitId: z.ZodOptional<z.ZodString>;
+    assignmentId: z.ZodString;
+    organizationMemberId: z.ZodOptional<z.ZodString>;
+    revokedRole: z.ZodOptional<z.ZodString>;
+    removedBy: z.ZodString;
+}, z.core.$strip>;
 export declare const AuditableEvent_OrganizationMember_StatusChangedEventDataSchema: z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_MEMBER_STATUS_CHANGED>;
     organizationId: z.ZodString;
@@ -192,28 +719,68 @@ export declare const AuditableEvent_OrganizationMember_StatusChangedEventDataSch
     newStatus: z.ZodString;
     changedBy: z.ZodString;
     reason: z.ZodOptional<z.ZodString>;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
+/**
+ * Removal of an organization membership — by administrative DELETE, or by cancelling a pending
+ * invitation through REVOKE.
+ *
+ * ## Why one event covers both, distinguished by `operation`
+ *
+ * They are genuinely different administrative acts — removing someone who works here versus
+ * withdrawing an invitation that was never accepted — and an auditor must never confuse them. But
+ * they are the same KIND of act (a membership ceases to exist) and share every other field, so
+ * splitting them into two event types would fragment "how did this person's membership end?" across
+ * two queries for no gain. `operation` carries the distinction, and `previousStatus` carries the
+ * state the row was actually in, which `operation` alone cannot give: DELETE accepts any
+ * non-`INVITED` status, so ACTIVE, INACTIVE and SUSPENDED removals are otherwise indistinguishable.
+ *
+ * An `INVITED` membership confers NOTHING — `execution-context-creator` builds `initiatorRoles` only
+ * from `ACTIVE` memberships — so a REVOKE removes no live authority. It is still recorded, because
+ * withdrawing someone's pending access is a directory decision an access review needs to see, and
+ * because `ORGANIZATION_MEMBER_INVITED` would otherwise stand unanswered.
+ *
+ * ## Why `roles` is captured
+ *
+ * The row is hard-deleted, so afterwards nothing in the system can answer "what authority did this
+ * person hold when they were removed". Same reasoning — and same shape — as
+ * `AuditableEvent_User_DeletedEventDataSchema.appRoles`. On a REVOKE it records what the invitee
+ * WOULD have received on acceptance.
+ *
+ * ## Category
+ *
+ * Classified ORG_MANAGEMENT rather than AUTHORIZATION, unlike `ORGANIZATION_UNIT_MEMBER_REMOVED`:
+ * removing a MEMBER is a directory-lifecycle action whose authority loss is a consequence, whereas a
+ * unit assignment row exists only to confer a role. The `roles` field is what keeps the authority
+ * question answerable from an ORG_MANAGEMENT record.
+ */
 export declare const AuditableEvent_OrganizationMember_RemovedEventDataSchema: z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_MEMBER_REMOVED>;
     organizationId: z.ZodString;
     memberId: z.ZodString;
     removedUserId: z.ZodString;
+    roles: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    previousStatus: z.ZodOptional<z.ZodString>;
+    operation: z.ZodString;
+    revokedUnitAssignments: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        organizationUnitId: z.ZodString;
+        role: z.ZodString;
+    }, z.core.$strip>>>;
     removedBy: z.ZodString;
     reason: z.ZodOptional<z.ZodString>;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 export declare const AuditableEvent_Organization_CreatedEventDataSchema: z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_CREATED>;
     organizationId: z.ZodString;
     name: z.ZodString;
     slug: z.ZodString;
     createdBy: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 export declare const AuditableEvent_Organization_UpdatedEventDataSchema: z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_UPDATED>;
     organizationId: z.ZodString;
     changes: z.ZodRecord<z.ZodString, z.ZodAny>;
     updatedBy: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 export declare const AuditableEvent_Organization_DeletedEventDataSchema: z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_DELETED>;
     organizationId: z.ZodString;
@@ -221,35 +788,214 @@ export declare const AuditableEvent_Organization_DeletedEventDataSchema: z.ZodOb
     slug: z.ZodString;
     deletedBy: z.ZodString;
     reason: z.ZodOptional<z.ZodString>;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
+/**
+ * A tenant was MARKED for deletion — the soft-delete half of tenant teardown.
+ *
+ * Kept SEPARATE from {@link AuditableEvent_Organization_DeletedEventDataSchema} rather than folded
+ * into it with a flag, because the two record genuinely different facts and an auditor must not
+ * have to infer which one happened. This event says *the tenant's access was revoked and its data
+ * was scheduled for destruction*; `ORGANIZATION_DELETED` says *the data is gone*. Between them sits
+ * a retention window in which the decision is still reversible, and a single merged event would
+ * make "was this tenant's data actually destroyed?" unanswerable without correlating timestamps.
+ *
+ * It is also the evidence for the AUTHORIZATION consequence, which lands here and not at the purge:
+ * user types revoked and tokens invalidated. `revokedUserTypeCount` records the blast radius of that
+ * revocation without naming the users — the per-user detail belongs to the user-type events, and
+ * duplicating identities into a tenant-scoped record would widen the personal data this row holds.
+ *
+ * assurance-control: WILDO.DATA.SECURE_LIFECYCLE — scheduling the destruction
+ * of a tenant is a security-relevant, attributable decision that must leave evidence even when it
+ * is later reversed.
+ */
+export declare const AuditableEvent_Organization_DeletionRequestedEventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_DELETION_REQUESTED>;
+    organizationId: z.ZodString;
+    name: z.ZodString;
+    slug: z.ZodString;
+    requestedBy: z.ZodString;
+    purgeScheduledAt: z.ZodString;
+    revokedUserTypeCount: z.ZodNumber;
+    reason: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * A pending tenant deletion was CANCELLED inside its retention window.
+ *
+ * The closing half of {@link AuditableEvent_Organization_DeletionRequestedEventDataSchema}. Without
+ * it the audit trail records every scheduled destruction and none of the reversals, so a tenant
+ * that was marked and restored a year ago still reads as pending destruction — and an access review
+ * asking "why does this tenant have live members again?" has no answer on record.
+ *
+ * assurance-control: WILDO.ACCESS.LIFECYCLE — restoring access is as attributable as removing it.
+ */
+export declare const AuditableEvent_Organization_RestoredEventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_RESTORED>;
+    organizationId: z.ZodString;
+    name: z.ZodString;
+    slug: z.ZodString;
+    restoredBy: z.ZodString;
+    restoredStatus: z.ZodString;
+    regrantedUserTypeCount: z.ZodNumber;
+    reason: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * The tenant was administratively HALTED — every member loses their organization roles.
+ *
+ * ## Why this is its own event rather than an `ORGANIZATION_UPDATED`
+ *
+ * Suspension is not a field edit. Since the tenant-status authority gate shipped, `SUSPENDED` is a
+ * state in which a membership confers NOTHING — so this single write revokes the access of every
+ * member of the tenant at once. Folding that into the generic update event would bury an
+ * organization-wide access revocation inside a `changes` map, exactly where an access review would
+ * not look for it.
+ *
+ * `suspensionReason` is REQUIRED, mirroring the request contract, because the reason is the whole
+ * evidentiary point: an auditor asking "why was this tenant halted?" must not get a shrug.
+ * `notifiedMembers` records whether the tenant was told — a deliberately quiet suspension is a
+ * legitimate operator choice and one a reviewer needs to be able to see.
+ *
+ * assurance-control: WILDO.AUDIT.SECURITY_EVENT — organization-wide access
+ * revocation must be attributable, justified, and evidenced.
+ */
+export declare const AuditableEvent_Organization_SuspendedEventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_SUSPENDED>;
+    organizationId: z.ZodString;
+    name: z.ZodString;
+    slug: z.ZodString;
+    suspendedBy: z.ZodString;
+    previousStatus: z.ZodString;
+    suspensionReason: z.ZodString;
+    notifiedMembers: z.ZodBoolean;
+    revokedUserTypeCount: z.ZodNumber;
+}, z.core.$strip>;
+/**
+ * A halted or expired tenant was returned to normal operation — the inverse of
+ * {@link AuditableEvent_Organization_SuspendedEventDataSchema}.
+ *
+ * Restoring organization-wide access is as security-relevant as removing it, and without this event
+ * the trail would record every suspension and none of the lifts — leaving a tenant that was halted
+ * and reinstated a year ago still reading as suspended.
+ *
+ * `previousStatus` distinguishes the two journeys this operation serves: lifting a suspension
+ * (`SUSPENDED`) and converting an expired trial (`TRIAL_EXPIRED`). They land on the same state and
+ * are not the same event to a reviewer.
+ *
+ * assurance-control: WILDO.AUDIT.SECURITY_EVENT — reinstatement of access is attributable.
+ */
+export declare const AuditableEvent_Organization_ActivatedEventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_ACTIVATED>;
+    organizationId: z.ZodString;
+    name: z.ZodString;
+    slug: z.ZodString;
+    activatedBy: z.ZodString;
+    previousStatus: z.ZodString;
+    regrantedUserTypeCount: z.ZodNumber;
+    reason: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * One user type's authentication-policy snapshot — the COMPLETE authored `UserTypeAuthPolicy` (MFA,
+ * password, lockout, enabled auth methods, step-up, session duration, …) as recorded in the trail.
+ *
+ * The whole policy is captured, not a hand-picked subset, so no posture axis escapes the record: a
+ * weakening is as easily "disable the MFA auth method" (`authMethodsEnabled`) or "drop step-up"
+ * (`stepUpAuth`) as "turn `requireMFA` off". The policy carries only booleans / numbers / enums —
+ * never a secret — so recording it verbatim discloses nothing sensitive.
+ *
+ * Deliberately STRUCTURAL (an open record) rather than a reference to the live `UserTypeAuthPolicy`
+ * config schema. An audit record is a historical fact: it must keep validating after the config
+ * schema evolves, so it stores the policy as it was at that boot rather than re-validating it against
+ * today's shape. The queryable summary lives in `changedUserTypes` + `snapshotDigest`; this object
+ * carries the human-readable before/after detail.
+ */
+export declare const ApplicationAuthPolicySnapshotSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+/**
+ * The application's authored authentication policy changed between two boots.
+ *
+ * The per-user-type authentication policy (`userTypes.<type>.auth` — MFA, password, and lockout
+ * requirements) is STATIC application configuration authored in code and taken into effect at backend
+ * startup. A change to it — most consequentially a WEAKENING such as turning MFA off — is a
+ * security-posture decision that, before this event, left no product-side record: only the source
+ * history showed it. This event closes that gap.
+ *
+ * It is emitted at boot, by the system, when the resolved policy snapshot differs from the last one
+ * recorded in the trail (detected by comparing against the most recent event of this type for the
+ * application). Because there is no human actor at boot, the "who" is the deployment/source history;
+ * the event records WHAT changed (before → after per user type) so a reviewer sees the posture shift
+ * without reading the codebase.
+ *
+ * Scope note: this is the per-application AUTHORED baseline. It does NOT enumerate per-tenant
+ * `authOverrides` (which are per-(user-type × org-type) and require live tenants to resolve), nor the
+ * authenticate-time `FALLBACK_AUTH_POLICY` (a runtime substitute used only when no user type
+ * resolves, not authored config).
+ *
+ * assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — a change to the authentication assurance
+ * requirements (MFA / password / lockout) must be attributable and evidenced.
+ */
+export declare const AuditableEvent_ApplicationAuthPolicyChanged_EventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.APPLICATION_AUTH_POLICY_CHANGED>;
+    applicationId: z.ZodString;
+    changedUserTypes: z.ZodArray<z.ZodString>;
+    snapshotDigest: z.ZodString;
+    before: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
+    after: z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, z.core.$strip>;
+/**
+ * A governed lifecycle transition changed a subject's `status`.
+ *
+ * Emitted by the shared status-transition implementation, so every verb it serves is trailed by
+ * construction and a future one inherits the trail rather than having to remember it. Before this
+ * existed those verbs emitted NOTHING: suspending a member (CRITICAL) or a user (HIGH) left no
+ * record at all, while suspending a TENANT was fully attributable — an asymmetry an access review
+ * would have to discover the hard way.
+ *
+ * `reason` is where the verbs' long-declared `reason` / `suspensionReason` fields finally land.
+ * They are not persisted on the row: a suspension reason is a compliance artefact nothing reads
+ * back, so the trail is its home rather than a schema column that would have to be scrubbed on
+ * erasure.
+ *
+ * assurance-control: WILDO.AUDIT.SECURITY_EVENT — a change to whether a principal may act must be
+ * attributable, justified and evidenced, on every resource that has such a state.
+ */
+export declare const AuditableEvent_Resource_StatusTransitionPerformedEventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.RESOURCE_STATUS_TRANSITION_PERFORMED>;
+    resourceType: z.ZodString;
+    operationIdentifier: z.ZodString;
+    subjectId: z.ZodString;
+    performedBy: z.ZodString;
+    previousStatus: z.ZodString;
+    newStatus: z.ZodString;
+    reason: z.ZodOptional<z.ZodString>;
+    scheduledReactivationAt: z.ZodOptional<z.ZodString>;
+    organizationId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
 export declare const AuditableEvent_OrganizationNotifications_UpdatedEventDataSchema: z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_NOTIFICATIONS_UPDATED>;
     organizationId: z.ZodString;
     notificationsId: z.ZodString;
     changes: z.ZodRecord<z.ZodString, z.ZodAny>;
     updatedBy: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 export declare const AuditableEvent_OrganizationPreferences_UpdatedEventDataSchema: z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_PREFERENCES_UPDATED>;
     organizationId: z.ZodString;
     preferencesId: z.ZodString;
     changes: z.ZodRecord<z.ZodString, z.ZodAny>;
     updatedBy: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 export declare const AuditableEvent_OrganizationProfile_UpdatedEventDataSchema: z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_PROFILE_UPDATED>;
     organizationId: z.ZodString;
     profileId: z.ZodString;
     changes: z.ZodRecord<z.ZodString, z.ZodAny>;
     updatedBy: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 export declare const AuditableEvent_OrganizationUnit_UpdatedEventDataSchema: z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_UNIT_UPDATED>;
     organizationId: z.ZodString;
     unitId: z.ZodString;
     changes: z.ZodRecord<z.ZodString, z.ZodAny>;
     updatedBy: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 export declare const AuditableEvent_User_SSOLoginEventDataSchema: z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_SSO_LOGIN>;
     userId: z.ZodString;
@@ -257,11 +1003,13 @@ export declare const AuditableEvent_User_SSOLoginEventDataSchema: z.ZodObject<{
     providerRef: z.ZodString;
     connectionType: z.ZodEnum<typeof SsoConnectionType>;
     authSource: z.ZodOptional<z.ZodString>;
+    scopeType: z.ZodOptional<z.ZodEnum<typeof AuthScopeType>>;
     organizationId: z.ZodOptional<z.ZodString>;
+    applicationId: z.ZodOptional<z.ZodString>;
     ipAddress: z.ZodString;
     userAgent: z.ZodString;
     sessionId: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 export declare const AuditableEvent_User_SSOLoginFailedEventDataSchema: z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_SSO_LOGIN_FAILED>;
     email: z.ZodOptional<z.ZodEmail>;
@@ -269,10 +1017,12 @@ export declare const AuditableEvent_User_SSOLoginFailedEventDataSchema: z.ZodObj
     connectionType: z.ZodOptional<z.ZodEnum<typeof SsoConnectionType>>;
     authSource: z.ZodOptional<z.ZodString>;
     failureReason: z.ZodString;
+    scopeType: z.ZodOptional<z.ZodEnum<typeof AuthScopeType>>;
     organizationId: z.ZodOptional<z.ZodString>;
+    applicationId: z.ZodOptional<z.ZodString>;
     ipAddress: z.ZodString;
     userAgent: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 export declare const AuditableEvent_User_SSOEnforcementBlockedEventDataSchema: z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_SSO_ENFORCEMENT_BLOCKED>;
     email: z.ZodEmail;
@@ -282,14 +1032,14 @@ export declare const AuditableEvent_User_SSOEnforcementBlockedEventDataSchema: z
     enforcementPolicy: z.ZodString;
     ipAddress: z.ZodString;
     userAgent: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 export declare const AuditableEvent_User_TokenRefreshedEventDataSchema: z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_TOKEN_REFRESHED>;
     userId: z.ZodString;
     sessionId: z.ZodString;
     ipAddress: z.ZodString;
     userAgent: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 export declare const AuditableEvent_Organization_SSOConfigurationChangedEventDataSchema: z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_SSO_CONFIGURATION_CHANGED>;
     organizationId: z.ZodString;
@@ -297,7 +1047,7 @@ export declare const AuditableEvent_Organization_SSOConfigurationChangedEventDat
     changeType: z.ZodEnum<typeof SsoConfigChangeType>;
     affectedProviderRef: z.ZodOptional<z.ZodString>;
     changes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 export declare const AuditableEvent_Organization_SIEMExportConfiguredEventDataSchema: z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_SIEM_EXPORT_CONFIGURED>;
     organizationId: z.ZodString;
@@ -305,7 +1055,33 @@ export declare const AuditableEvent_Organization_SIEMExportConfiguredEventDataSc
     changeType: z.ZodEnum<typeof SiemExportChangeType>;
     webhookUrlDomain: z.ZodOptional<z.ZodString>;
     eventFormatConfigured: z.ZodOptional<z.ZodString>;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
+/**
+ * One `webhookConfig.testEndpoint` attempt — an admin causing the platform to open an
+ * outbound connection to an operator-supplied URL.
+ *
+ * Recorded for EVERY attempt, not only failures: the security signal here is the pattern
+ * (who probes which hosts, how often), which a SIEM can only derive if successes are
+ * present too. `outcome` distinguishes a refusing endpoint from an unreachable one from a
+ * local signing fault, so the stream stays diagnosable without the response body.
+ *
+ * `destinationHost` carries the host only, never the full URL — mirroring
+ * `AuditableEvent_Organization_SIEMExportConfiguredEventDataSchema.webhookUrlDomain`. Paths
+ * and query strings on customer endpoints routinely embed per-tenant tokens, and an audit
+ * row is replicated to the org SIEM and the immutable store.
+ */
+export declare const AuditableEvent_Webhook_EndpointTestDispatchedEventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.WEBHOOK_ENDPOINT_TEST_DISPATCHED>;
+    organizationId: z.ZodOptional<z.ZodString>;
+    applicationId: z.ZodOptional<z.ZodString>;
+    dispatchedBy: z.ZodString;
+    endpointId: z.ZodString;
+    destinationHost: z.ZodString;
+    outcome: z.ZodEnum<typeof WebhookEndpointProbeOutcome>;
+    responseStatus: z.ZodOptional<z.ZodNumber>;
+    durationMs: z.ZodNumber;
+    signatureJti: z.ZodString;
+}, z.core.$strip>;
 export declare const AuditableEvent_SCIM_TokenCreatedEventDataSchema: z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.SCIM_TOKEN_CREATED>;
     organizationId: z.ZodString;
@@ -314,7 +1090,7 @@ export declare const AuditableEvent_SCIM_TokenCreatedEventDataSchema: z.ZodObjec
     expiresAt: z.ZodOptional<z.ZodString>;
     ipAddress: z.ZodString;
     userAgent: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 export declare const AuditableEvent_SCIM_TokenRevokedEventDataSchema: z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.SCIM_TOKEN_REVOKED>;
     organizationId: z.ZodString;
@@ -322,7 +1098,7 @@ export declare const AuditableEvent_SCIM_TokenRevokedEventDataSchema: z.ZodObjec
     revokedByUserId: z.ZodString;
     ipAddress: z.ZodString;
     userAgent: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 export declare const AuditableEvent_SCIM_UserProvisionedEventDataSchema: z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.SCIM_USER_PROVISIONED>;
     organizationId: z.ZodString;
@@ -331,74 +1107,96 @@ export declare const AuditableEvent_SCIM_UserProvisionedEventDataSchema: z.ZodOb
     isNewUser: z.ZodBoolean;
     provisionedVia: z.ZodString;
     authSource: z.ZodOptional<z.ZodString>;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 export declare const AuditableEvent_SCIM_UserUpdatedEventDataSchema: z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.SCIM_USER_UPDATED>;
     organizationId: z.ZodString;
     userId: z.ZodString;
     operation: z.ZodString;
     updatedAttributes: z.ZodOptional<z.ZodArray<z.ZodString>>;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 export declare const AuditableEvent_SCIM_UserDeactivatedEventDataSchema: z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.SCIM_USER_DEACTIVATED>;
     organizationId: z.ZodString;
     userId: z.ZodString;
     email: z.ZodOptional<z.ZodString>;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 export declare const AuditableEvent_User_PasswordResetRequestedEventDataSchema: z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_PASSWORD_RESET_REQUESTED>;
     email: z.ZodString;
     ipAddress: z.ZodString;
     userAgent: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
+/**
+ * Administrator-compelled credential reset.
+ *
+ * Carries BOTH identities because the actor and the subject differ — that separation is the
+ * whole point of the event. `actorUserId` is read from the authenticated execution context,
+ * never from request input, so it cannot be spoofed by the caller. `reason` is the operator's
+ * mandatory justification; it is what an auditor reads when asking why a credential was reset
+ * out-of-band.
+ *
+ * assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — privileged credential
+ * intervention must be attributable to the acting administrator and carry a justification.
+ */
+export declare const AuditableEvent_User_PasswordResetForcedEventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.USER_PASSWORD_RESET_FORCED>;
+    targetUserId: z.ZodString;
+    targetEmail: z.ZodString;
+    actorUserId: z.ZodString;
+    reason: z.ZodString;
+    sessionsRevoked: z.ZodBoolean;
+    ipAddress: z.ZodOptional<z.ZodString>;
+    userAgent: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
 export declare const AuditableEvent_User_PasswordResetCompletedEventDataSchema: z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_PASSWORD_RESET_COMPLETED>;
     userId: z.ZodString;
     ipAddress: z.ZodString;
     userAgent: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 export declare const AuditableEvent_User_RegisteredEventDataSchema: z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_REGISTERED>;
     userId: z.ZodString;
     email: z.ZodString;
     ipAddress: z.ZodString;
     userAgent: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 export declare const AuditableEvent_User_EmailVerifiedEventDataSchema: z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_EMAIL_VERIFIED>;
     userId: z.ZodString;
     email: z.ZodString;
     ipAddress: z.ZodString;
     userAgent: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 export declare const AuditableEvent_User_VerificationEmailResentEventDataSchema: z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_VERIFICATION_EMAIL_RESENT>;
     userId: z.ZodString;
     email: z.ZodString;
     ipAddress: z.ZodString;
     userAgent: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 export declare const AuditableEvent_User_MFASetupStartedEventDataSchema: z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_MFA_SETUP_STARTED>;
     userId: z.ZodString;
     mfaMethod: z.ZodString;
     ipAddress: z.ZodString;
     userAgent: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 export declare const AuditableEvent_User_MFASetupCompletedEventDataSchema: z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_MFA_SETUP_COMPLETED>;
     userId: z.ZodString;
     mfaMethod: z.ZodString;
     ipAddress: z.ZodString;
     userAgent: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 export declare const AuditableEvent_User_MFAEmailOTPSentEventDataSchema: z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_MFA_EMAIL_OTP_SENT>;
     email: z.ZodString;
     sessionId: z.ZodString;
     ipAddress: z.ZodString;
     userAgent: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 export declare const AuditableEvent_User_PasskeyRegisteredEventDataSchema: z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_PASSKEY_REGISTERED>;
     userId: z.ZodString;
@@ -408,7 +1206,7 @@ export declare const AuditableEvent_User_PasskeyRegisteredEventDataSchema: z.Zod
     credentialDeviceType: z.ZodString;
     ipAddress: z.ZodString;
     userAgent: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 export declare const AuditableEvent_User_PasskeyAuthSuccessEventDataSchema: z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_PASSKEY_AUTHENTICATION_SUCCESS>;
     userId: z.ZodString;
@@ -417,7 +1215,7 @@ export declare const AuditableEvent_User_PasskeyAuthSuccessEventDataSchema: z.Zo
     ipAddress: z.ZodString;
     userAgent: z.ZodString;
     sessionId: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 export declare const AuditableEvent_User_PasskeyAuthFailureEventDataSchema: z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_PASSKEY_AUTHENTICATION_FAILURE>;
     email: z.ZodString;
@@ -425,7 +1223,7 @@ export declare const AuditableEvent_User_PasskeyAuthFailureEventDataSchema: z.Zo
     ipAddress: z.ZodString;
     userAgent: z.ZodString;
     sessionId: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 export declare const AuditableEvent_User_PasskeyRemovedEventDataSchema: z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_PASSKEY_REMOVED>;
     userId: z.ZodString;
@@ -434,13 +1232,13 @@ export declare const AuditableEvent_User_PasskeyRemovedEventDataSchema: z.ZodObj
     credentialName: z.ZodString;
     ipAddress: z.ZodString;
     userAgent: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 export declare const AuditableEvent_User_MagicLinkSentEventDataSchema: z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_MAGIC_LINK_SENT>;
     email: z.ZodString;
     ipAddress: z.ZodString;
     userAgent: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 export declare const AuditableEvent_User_MagicLinkVerifiedEventDataSchema: z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_MAGIC_LINK_VERIFIED>;
     userId: z.ZodString;
@@ -448,14 +1246,14 @@ export declare const AuditableEvent_User_MagicLinkVerifiedEventDataSchema: z.Zod
     ipAddress: z.ZodString;
     userAgent: z.ZodString;
     sessionId: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 export declare const AuditableEvent_User_MagicLinkFailedEventDataSchema: z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_MAGIC_LINK_FAILED>;
     email: z.ZodOptional<z.ZodString>;
     failureReason: z.ZodString;
     ipAddress: z.ZodString;
     userAgent: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 export declare const AuditableEvent_User_SMSOTPSentEventDataSchema: z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_SMS_OTP_SENT>;
     phoneNumber: z.ZodString;
@@ -463,7 +1261,7 @@ export declare const AuditableEvent_User_SMSOTPSentEventDataSchema: z.ZodObject<
     sessionId: z.ZodString;
     ipAddress: z.ZodString;
     userAgent: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 export declare const AuditableEvent_User_SMSOTPVerifiedEventDataSchema: z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_SMS_OTP_VERIFIED>;
     userId: z.ZodString;
@@ -472,7 +1270,7 @@ export declare const AuditableEvent_User_SMSOTPVerifiedEventDataSchema: z.ZodObj
     sessionId: z.ZodString;
     ipAddress: z.ZodString;
     userAgent: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 export declare const AuditableEvent_User_SMSOTPFailedEventDataSchema: z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_SMS_OTP_FAILED>;
     phoneNumber: z.ZodOptional<z.ZodString>;
@@ -481,30 +1279,32 @@ export declare const AuditableEvent_User_SMSOTPFailedEventDataSchema: z.ZodObjec
     sessionId: z.ZodString;
     ipAddress: z.ZodString;
     userAgent: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 export declare const AuditableEvent_User_PhoneVerifiedEventDataSchema: z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_PHONE_VERIFIED>;
     userId: z.ZodString;
     phoneNumber: z.ZodString;
     ipAddress: z.ZodString;
     userAgent: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 export declare const AuditableEvent_User_PhoneVerificationFailedEventDataSchema: z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_PHONE_VERIFICATION_FAILED>;
     phoneNumber: z.ZodString;
     failureReason: z.ZodString;
     ipAddress: z.ZodString;
     userAgent: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 export declare const AuditableEvent_OAuth2ProviderBlockedEventDataSchema: z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.OAUTH2_PROVIDER_BLOCKED>;
     email: z.ZodOptional<z.ZodString>;
     providerRef: z.ZodString;
-    organizationId: z.ZodString;
+    scopeType: z.ZodEnum<typeof AuthScopeType>;
+    organizationId: z.ZodOptional<z.ZodString>;
+    applicationId: z.ZodOptional<z.ZodString>;
     reason: z.ZodString;
     ipAddress: z.ZodString;
     userAgent: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 export type AuditableEvent_OAuth2ProviderBlockedEventData = z.infer<typeof AuditableEvent_OAuth2ProviderBlockedEventDataSchema>;
 export declare const AuditableEvent_EmergencyAccess_UsedEventDataSchema: z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.EMERGENCY_ACCESS_USED>;
@@ -515,7 +1315,7 @@ export declare const AuditableEvent_EmergencyAccess_UsedEventDataSchema: z.ZodOb
     ipAddress: z.ZodString;
     userAgent: z.ZodString;
     sessionId: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 export declare const AuditableEvent_FieldAccess_EventDataSchema: z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.FIELD_ACCESS>;
     fieldName: z.ZodString;
@@ -523,20 +1323,629 @@ export declare const AuditableEvent_FieldAccess_EventDataSchema: z.ZodObject<{
     resourceId: z.ZodOptional<z.ZodString>;
     operationIdentifier: z.ZodString;
     isCreateOperation: z.ZodBoolean;
-}, z.core.$strip, core.$ZodObjectExtra>;
+    machineCredentialAuthMethod: z.ZodOptional<z.ZodString>;
+    machineCredentialId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * **A resource operation took effect.** The operation-triggered counterpart to
+ * {@link AuditableEvent_FieldAccess_EventDataSchema}, which is triggered by a decorated RESPONSE
+ * FIELD and is therefore blind to any operation whose response carries none.
+ *
+ * ## What the existence of this row asserts, and what it does not
+ *
+ * It is emitted from the framework-managed POST-COMMIT effects lane, so the row exists only for an
+ * operation whose mutation is already durable. "Performed" is therefore the whole claim — there is
+ * deliberately no `outcome` discriminator, because this emission point can never observe a failure.
+ *
+ * The absence of a row is NOT evidence that nothing happened; that is what makes audit-pipeline
+ * failure detection (`audit_store_failure_total`, and the operation identity now carried on the
+ * failure log line) a control in its own right rather than an operational nicety.
+ *
+ * **Refusals are a different event and a different chokepoint.** A denied operation never reaches
+ * this lane — the authorization decision happens pre-dispatch, its volume is attacker-drivable, and
+ * it needs rate-limit / dedup treatment this success path does not. Declaring a `DENIED` outcome
+ * here that nothing produces would repeat the very defect this event exists to fix (20 event types
+ * were authored in this enum and wired to nothing). That refusal event now exists and is emitted:
+ * see {@link AuditableEvent_ResourceOperationDenied_EventDataSchema}, raised from the authorizer.
+ * The two events are read together — this one for what happened, that one for what was stopped —
+ * and neither carries an `outcome` discriminator, because each states its whole claim in its name.
+ *
+ * ## Operation identity is a TRIPLE
+ *
+ * `resourceType` + `operationIdentifier` + `variantKey`. Recording only the first two makes an
+ * `admin` variant indistinguishable from a `self` variant — a distinction several polymorphic
+ * resources encode in `variantKey` alone, and precisely the distinction an auditor is checking.
+ *
+ * ## Correlation across a cascade
+ *
+ * Every execution surface emits — API, internal call, and repository-only — so one tenant deletion
+ * produces one row per cascaded child. The top-level `correlationId` is inherited by every sub-call
+ * context and preserved across mid-flight operation corrections, so it groups the whole fan-out to one request;
+ * `subCallDepth` separates the initiating operation (0) from what it cascaded into.
+ *
+ * ## Field evidence is deliberately partial (GDPR Art. 5(1)(c) + Art. 17)
+ *
+ * `changedFields` names every field the write touched — a field NAME is not personal data, so it is
+ * always safe and always recorded. `fieldEvidence` carries before/after VALUES only for fields the
+ * schema marks `.isAuditEvidence()`.
+ *
+ * Values are limited on purpose: audit rows replicate to the per-org SIEM and to the immutable
+ * ledger, and **the immutable ledger cannot be scrubbed** — so copying arbitrary personal data into
+ * this event would manufacture an unerasable duplicate, in direct conflict with Art. 17 and with the
+ * impersonalization/retention capability built to make personal data erasable. Authority-, status-
+ * and scope-bearing values ARE necessary (a role change that does not record the old and new roles
+ * proves nothing), and those are exactly what the marker is for.
+ *
+ * assurance-control: WILDO.AUDIT.EVIDENCE_INTEGRITY
+ */
+export declare const AuditableEvent_ResourceOperationPerformed_EventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.RESOURCE_OPERATION_PERFORMED>;
+    resourceType: z.ZodString;
+    operationIdentifier: z.ZodString;
+    variantType: z.ZodEnum<typeof ResourceOperationVariantType>;
+    variantKey: z.ZodOptional<z.ZodString>;
+    resourceOperationLike: z.ZodOptional<z.ZodEnum<typeof CoreResourceOperation>>;
+    isBulkOperation: z.ZodOptional<z.ZodBoolean>;
+    resourceId: z.ZodOptional<z.ZodString>;
+    affectedRecordCount: z.ZodOptional<z.ZodNumber>;
+    initiatorRoles: z.ZodArray<z.ZodString>;
+    executionType: z.ZodEnum<typeof ExecutionContext_ExecutionType>;
+    machineCredentialAuthMethod: z.ZodOptional<z.ZodString>;
+    machineCredentialId: z.ZodOptional<z.ZodString>;
+    subCallDepth: z.ZodNumber;
+    changedFields: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    fieldEvidence: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        before: z.ZodOptional<z.ZodUnknown>;
+        after: z.ZodOptional<z.ZodUnknown>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+/**
+ * An operation the authorizer REFUSED. The other half of "record access decisions" — the negative
+ * decision, which until now left no trace anywhere in the framework.
+ *
+ * ## Emitted pre-dispatch, from the one funnel
+ *
+ * Every public entry point of `AuthorizationsBackendService` converges on the same two inner phase
+ * runners — `authorizeInController` (HTTP controller, MCP, WebSocket, queue, field validation),
+ * `authorizeInProgrammaticSurface` (a non-controller surface that faces an external caller), and
+ * `authorizeInRepositoryAndService`, which has exactly one caller — `authorizeInController` itself.
+ * So a single instrumentation point observes every refusal THE AUTHORIZER MAKES, with the operation
+ * and execution context both in scope. No mutation has occurred when this row is written; nothing is
+ * rolled back by it.
+ *
+ * **The scope of that claim, stated because an earlier revision overstated it.** It used to read
+ * "the sole production entry point for every execution surface", which asserts something stronger
+ * and false: that every execution surface passes the role gate. A programmatic operation entering at
+ * the SERVICE tier (`ServicesRegistryHandlerBackendService.read` / `list` / …) reaches no authorizer
+ * at all — deliberately, because that population includes the reads that ESTABLISH identity before a
+ * role-bearing principal exists. So the absence of a row here means "the authorizer refused nothing",
+ * never "nothing was read". See `AuthorizationsBackendService.authorizeInProgrammaticSurface` for the
+ * layering decision and the door.
+ *
+ * ## What it is NOT
+ *
+ * - **Not an authentication failure.** `USER_LOGIN_FAILED` / `MACHINE_AUTH_FAILED` say "you are not
+ *   who you claim to be". This says "you are, and you may not do this". Distinct types, distinct
+ *   categories, neither overloaded.
+ * - **Not an `outcome: 'denied'` variant of {@link AuditableEvent_ResourceOperationPerformed_EventDataSchema}.**
+ *   That event is emitted from the post-commit lane, which by construction can only observe
+ *   operations that already took effect. A refusal never reaches it.
+ *
+ * ## Volume: bounded by dedup, NOT by a risk floor
+ *
+ * Denial volume is attacker-drivable in a way the success path's never is. A risk floor was
+ * considered and rejected as the control: it would exclude 100% of denied READS (zero of the
+ * catalogue's HIGH/CRITICAL variants are reads, while 371 of 551 API-reachable variants are) —
+ * discarding the canonical reconnaissance signal — while not capping the adversarial worst case at
+ * all, since the attacker chooses which endpoint to hammer.
+ *
+ * The actual bound is a per-principal / per-operation / per-reason dedup window. Rather than
+ * suppressing repeats outright (which would erase the storm — the very signal a security-operations team wants),
+ * emission escalates on a LOGARITHMIC ladder: the 1st, 10th, 100th, … refusal in the window each
+ * emit one row carrying {@link occurrenceCount}. A burst of 10 000 identical denials therefore
+ * costs 5 rows and remains legible as a burst.
+ *
+ * Dedup is best-effort and FAILS OPEN (emit) when the counter store is unavailable — a fail-closed
+ * cooldown would let an attacker blind the audit trail by taking Redis down.
+ *
+ * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT
+ */
+/**
+ * A platform operator acted on a row belonging to a tenant they are not a member of.
+ *
+ * ## Why this event exists
+ *
+ * Wildo's answer to "may a platform super-administrator administer any tenant?" is YES — the same
+ * answer most mature B2B platforms give, because support and incident response genuinely need it.
+ * What those platforms do NOT do is leave the reach implicit. Support access is a named, logged
+ * event, because the difference between legitimate operator work and quiet snooping is not the
+ * capability — both use the identical capability — it is whether anyone can tell afterwards.
+ *
+ * Until 2026-08-05 Wildo had the capability with none of the visibility, and by accident rather than
+ * declaration: per-instance org-scoped requests are checked by `authorizeOrganizations`, which
+ * compares the fetched row's organization against a scope the SAME REQUEST supplied through its URL.
+ * A non-member operator therefore passed it silently. Measured over real HTTP by
+ * `organization-ownership-grant-hostile.e2e.ts` probe F-1a, which deleted a membership row in
+ * another tenant and got a 200.
+ *
+ * This event is the visibility half. It does NOT refuse — refusing is a separate, much larger change
+ * with a measured blast radius (see the plan) and is a policy decision in its own right. Emission is
+ * best-effort and never blocks the request: an operator action must not fail because the audit sink
+ * is down, and a fail-closed variant would let anyone disable operator support by breaking the sink.
+ *
+ * ## Reading the event
+ *
+ * {@link admissionDeclared} is the field that matters most. `true` means the operation VARIANT
+ * declared `admitsCrossTenantPlatformAdministration` — an intended, reviewed crossing such as
+ * `organizationMembers.grantOwnership`. `false` means the reach came from the structural gap above:
+ * nobody declared it, no spec documents it, and it is the population to watch.
+ *
+ * assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION — platform-tier access to a tenant the
+ * principal does not belong to.
+ * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT
+ */
+/**
+ * One transition in the life of a platform access grant.
+ *
+ * The crossing itself is recorded by {@link CoreAuditableEventType.CROSS_TENANT_ADMINISTRATIVE_ACCESS}.
+ * This is the other half, and a reviewer needs both: that event answers "an operator reached into
+ * this tenant", this one answers "on what authority, asked for when, and who agreed".
+ *
+ * Deliberately two events rather than one enriched one. A grant is requested once and may authorise
+ * many crossings across its window, so folding them together would either duplicate the grant's
+ * details onto every access or lose the request/decision timeline entirely.
+ *
+ * {@link autoApprovalReason} is the field a customer audit turns on. Its ABSENCE on an approved grant
+ * means a human in the tenant said yes. `TENANT_APPROVAL_NOT_REQUIRED` means the tenant had not opted
+ * into approval. `TENANT_CANNOT_APPROVE` means the tenant had no administratively usable owner and
+ * could not consent — the one path where operator access proceeds against a tenant that never agreed
+ * and never could, which is why the emitter carries it at a higher risk level.
+ *
+ * assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION
+ * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — evidence of a privileged assignment's full life.
+ */
+export declare const AuditableEvent_PlatformAccessGrantLifecycle_EventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.PLATFORM_ACCESS_GRANT_LIFECYCLE>;
+    transition: z.ZodEnum<typeof PlatformAccessGrantLifecycleTransition>;
+    grantId: z.ZodString;
+    targetOrganizationId: z.ZodString;
+    operatorUserId: z.ZodString;
+    justification: z.ZodOptional<z.ZodString>;
+    resultingStatus: z.ZodEnum<typeof PlatformAccessGrantStatus>;
+    expiresAt: z.ZodOptional<z.ZodDate>;
+    autoApprovalReason: z.ZodOptional<z.ZodEnum<typeof PlatformAccessGrantAutoApprovalReason>>;
+    decidedByUserId: z.ZodOptional<z.ZodString>;
+    decisionReason: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const AuditableEvent_CrossTenantAdministrativeAccess_EventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.CROSS_TENANT_ADMINISTRATIVE_ACCESS>;
+    targetOrganizationId: z.ZodString;
+    resourceType: z.ZodString;
+    operationIdentifier: z.ZodString;
+    variantType: z.ZodEnum<typeof ResourceOperationVariantType>;
+    variantKey: z.ZodOptional<z.ZodString>;
+    targetResourceIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    authorizingGrantId: z.ZodOptional<z.ZodString>;
+    admissionDeclared: z.ZodBoolean;
+    initiatorRoles: z.ZodArray<z.ZodString>;
+    executionType: z.ZodEnum<typeof ExecutionContext_ExecutionType>;
+}, z.core.$strip>;
+/**
+ * An application-wide directory enumeration.
+ *
+ * See {@link CoreAuditableEventType.PLATFORM_DIRECTORY_ACCESS} for why this is a distinct event
+ * type rather than a shape of the cross-tenant one. The short version: there is no target tenant to
+ * name, because the read deliberately spans them all.
+ */
+export declare const AuditableEvent_PlatformDirectoryAccess_EventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.PLATFORM_DIRECTORY_ACCESS>;
+    resourceType: z.ZodString;
+    operationIdentifier: z.ZodString;
+    variantType: z.ZodEnum<typeof ResourceOperationVariantType>;
+    variantKey: z.ZodOptional<z.ZodString>;
+    returnedCount: z.ZodNumber;
+    initiatorRoles: z.ZodArray<z.ZodString>;
+    executionType: z.ZodEnum<typeof ExecutionContext_ExecutionType>;
+}, z.core.$strip>;
+export declare const AuditableEvent_ResourceOperationDenied_EventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.RESOURCE_OPERATION_DENIED>;
+    denialReason: z.ZodEnum<typeof ResourceOperationDenialReason>;
+    resourceType: z.ZodString;
+    operationIdentifier: z.ZodString;
+    variantType: z.ZodEnum<typeof ResourceOperationVariantType>;
+    variantKey: z.ZodOptional<z.ZodString>;
+    resourceOperationLike: z.ZodOptional<z.ZodEnum<typeof CoreResourceOperation>>;
+    isBulkOperation: z.ZodOptional<z.ZodBoolean>;
+    attemptedResourceIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    requiredRoles: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    initiatorRoles: z.ZodArray<z.ZodString>;
+    executionType: z.ZodEnum<typeof ExecutionContext_ExecutionType>;
+    machineCredentialAuthMethod: z.ZodOptional<z.ZodString>;
+    machineCredentialId: z.ZodOptional<z.ZodString>;
+    subCallDepth: z.ZodNumber;
+    occurrenceCount: z.ZodNumber;
+    occurrenceCountIsExact: z.ZodBoolean;
+}, z.core.$strip>;
+/**
+ * A privileged SEE-THROUGH read that revealed RETAINED (impersonalized-and-retained) records —
+ * rows kept for a legal/audit obligation while their personal data was scrubbed, hidden from
+ * normal callers by the retention hide-predicate. This is the compliance-grade access record over
+ * that scrubbed data, and its two defining properties (vs `SYSTEM_CONTEXT_READ`, which names only the
+ * RUNTIME that acted, never a human) are:
+ *
+ * 1. **Human attribution** — `accessingUserId` names the actual super-admin / `COMPLIANCE_AUDITOR`
+ *    who exercised the see-through, so a retained-data reveal is never anonymous. Non-empty
+ *    (`.trim().min(1)`) — a blank id cannot stand in for a human.
+ * 2. **A required reason** — `reason` is the mandatory justification for revealing scrubbed PII.
+ *    Non-empty (`.trim().min(1)`): a blank OR whitespace-only reason fails validation, so the audit
+ *    trail cannot record a reveal without a real "why". The see-through primitives ALSO fail-closed on
+ *    blank attribution before the read (the schema `.min(1)` is the contract; the primitive guard is
+ *    the enforcement point, since the audit store persists `eventData` as an unparsed record).
+ *
+ * Strictly read-only (the see-through primitive never mutates). Emitted by the see-through read
+ * primitive (`readRetainedAsSystem` / `listRetainedAsSystem`) — wired in a later phase; this is the
+ * contract only.
+ */
+export declare const AuditableEvent_RetainedDataAccess_EventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.RETAINED_DATA_ACCESS>;
+    accessingUserId: z.ZodString;
+    reason: z.ZodString;
+    resourceType: z.ZodString;
+    resourceId: z.ZodOptional<z.ZodString>;
+    retainedRecordCount: z.ZodOptional<z.ZodNumber>;
+    operationIdentifier: z.ZodString;
+    roles: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    organizationId: z.ZodOptional<z.ZodString>;
+    ipAddress: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * A DATA SUBJECT EXPORT — the compliance record of the framework assembling everything it holds
+ * about one person and disclosing it.
+ *
+ * This is the most sensitive READ the framework performs, and the one an access-request audit turns
+ * on. Its defining properties:
+ *
+ * 1. **A named subject** — `subjectResourceType` + `subjectIds`: WHOSE data left the system. An
+ *    export event that cannot name its subject is not an access record.
+ * 2. **A named purpose** — `purpose` is a `SubjectExportPurpose`. Art. 15 and Art. 20 produce
+ *    genuinely different bundles, so an audit trail that recorded only "an export happened" could
+ *    not later establish which right was answered or whether it was answered completely.
+ * 3. **What was actually included** — `includedResourceTypes` + `totalRecordCount`, and
+ *    `fieldsExcludedAsDerived` for the Art. 20 narrowing. The OMISSIONS matter as much as the
+ *    contents: "why was this not in my export?" must have a recorded answer.
+ *
+ * Carries NO personal data — resource types, ids, counts and field NAMES only. Recording the
+ * exported values would turn the record of a disclosure into a second copy of it, in a store with
+ * a longer retention than the export artifact itself.
+ *
+ * assurance-control: WILDO.PRIVACY.SUBJECT_DATA_EXPORT
+ */
+export declare const AuditableEvent_SubjectDataExport_EventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.SUBJECT_DATA_EXPORT>;
+    purpose: z.ZodString;
+    subjectResourceType: z.ZodString;
+    subjectIds: z.ZodArray<z.ZodString>;
+    includedResourceTypes: z.ZodArray<z.ZodString>;
+    totalRecordCount: z.ZodNumber;
+    fieldsExcludedAsDerived: z.ZodArray<z.ZodString>;
+    fieldsWithheldAsNonDisclosable: z.ZodArray<z.ZodString>;
+    organizationId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * A COLLECTION EXPORT — an operator rendered a resource listing to a file and downloaded it.
+ *
+ * ## What it must answer, and what it must never carry
+ *
+ * The reviewer's questions are: which listing, in what shape, and **how much left**. So the row
+ * count is mandatory and the row scope is recorded verbatim — "they exported the page they were
+ * looking at" and "they exported the whole table" are the same action with very different
+ * consequences, and only this field separates them after the fact.
+ *
+ * `filterFieldNames` records WHICH filters narrowed the export, **never their values**. A filter
+ * value is frequently personal data (`?email=…`, `?assigneeId=…`), so recording it would turn the
+ * record of a disclosure into a second copy of it, in a store that outlives the exported file — the
+ * same rule {@link AuditableEvent_SubjectDataExport_EventDataSchema} follows ("resource types, ids,
+ * counts and field NAMES only"). No row content, ever.
+ *
+ * ## Why the severity is static and the risk is not
+ *
+ * `AUDIT_EVENT_CLASSIFICATION_MAP` is keyed by event TYPE, so severity cannot vary per emission.
+ * Classifying every export WARNING would put a routine twenty-row page download beside a whole-table
+ * dump and train reviewers to skim the channel; classifying every export INFO would leave the dump
+ * indistinguishable. The distinction therefore rides on `riskLevel`, which IS per-emission and is an
+ * indexed summary column on the audit row: LOW for a page, HIGH for a full result set.
+ *
+ * *Rejected: two event types.* A page export and a full export are one action with one parameter,
+ * and splitting the vocabulary to vary a field would make every consumer match two types forever.
+ *
+ * assurance-control: WILDO.PRIVACY.COLLECTION_DATA_EXPORT
+ */
+export declare const AuditableEvent_CollectionDataExport_EventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.COLLECTION_DATA_EXPORT>;
+    resourceType: z.ZodString;
+    sourceOperationIdentifier: z.ZodString;
+    format: z.ZodString;
+    rowScope: z.ZodString;
+    rowCount: z.ZodNumber;
+    filterFieldNames: z.ZodArray<z.ZodString>;
+    organizationId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * Rows were read THROUGH an HTTP-API resource binding — the read-through trail for data living in
+ * an EXTERNAL system the platform does not own (ETL plan D8/R6; see the enum member's docstring
+ * for why this is neither SYSTEM_CONTEXT_READ nor COLLECTION_DATA_EXPORT).
+ *
+ * One event per read-family OPERATION execution: a paginated LIST and the count that totals its
+ * envelope are ONE access, not two — the unit a reviewer reasons about is "an operation reached
+ * into the external system", never the transport's call multiplicity. Carries NO row data and no
+ * filter VALUES — the trail must never become a second copy of the external system's content.
+ *
+ * `initiatorUserId` is the REAL initiating user (R12): under a SERVICE_PRINCIPAL binding every
+ * remote call authenticates as one service account, and this field is what keeps attribution
+ * alive through that shared principal. Optional because internal/machine executions genuinely
+ * have no user — absence means "a runtime acted", exactly as `executionType` records.
+ *
+ * assurance-control: WILDO.AUDIT.ATTRIBUTION — read-through access to an external system is
+ * recorded with the real initiating user carried through the shared service principal.
+ */
+export declare const AuditableEvent_HttpApiReadThroughAccess_EventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.HTTP_API_READ_THROUGH_ACCESS>;
+    resourceType: z.ZodString;
+    operationIdentifier: z.ZodString;
+    providerRef: z.ZodString;
+    remoteEntityRef: z.ZodString;
+    dialect: z.ZodString;
+    initiatorUserId: z.ZodOptional<z.ZodString>;
+    executionType: z.ZodOptional<z.ZodString>;
+    organizationId: z.ZodOptional<z.ZodString>;
+    resourceId: z.ZodOptional<z.ZodString>;
+    rowCount: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+/**
+ * A subject erasure invoked the DECLARED external-erasure operation of an HTTP_API binding
+ * (ETL D6 stance 6b) — rows linked to the erased subject were deleted in the external system.
+ *
+ * Carries ids only, never personal fields: by the time this emits, the subject's local row is
+ * scrubbed, and the whole point of the operation was that the remote copies stop existing.
+ *
+ * assurance-control: WILDO.AUDIT.ATTRIBUTION — the outbound deletion names the subject it served
+ * and the external system it reached; the erasure report is the per-request receipt, this row is
+ * the queryable trail.
+ */
+export declare const AuditableEvent_HttpApiExternalErasure_EventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.HTTP_API_EXTERNAL_ERASURE>;
+    subjectResourceType: z.ZodString;
+    subjectIds: z.ZodArray<z.ZodString>;
+    resourceType: z.ZodString;
+    providerRef: z.ZodString;
+    remoteEntityRef: z.ZodString;
+    dialect: z.ZodString;
+    deletedRowCount: z.ZodNumber;
+    organizationId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * A subject erasure COMPLETED while rows linked to the subject remain live in an HTTP_API-bound
+ * external system, on the controller's explicit per-request acknowledgement (ETL D6 stance 6c).
+ *
+ * THE RECORD IS THE CONTROL: the acknowledgement's entire justification is that the hole becomes
+ * VISIBLE rather than prevented (`administrative-continuity-floors.md`), so this event must name
+ * everything a reviewer needs to act — the subject, the resource, the external system, and the
+ * remaining linkage when it could be measured.
+ *
+ * assurance-control: WILDO.AUDIT.ATTRIBUTION — an acknowledged erasure hole is recorded per
+ * resource, per erasure request, never as a standing posture.
+ */
+export declare const AuditableEvent_HttpApiNonErasureAcknowledged_EventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.HTTP_API_NON_ERASURE_ACKNOWLEDGED>;
+    subjectResourceType: z.ZodString;
+    subjectIds: z.ZodArray<z.ZodString>;
+    resourceType: z.ZodString;
+    providerRef: z.ZodString;
+    remoteEntityRef: z.ZodString;
+    dialect: z.ZodString;
+    remainingRowCount: z.ZodOptional<z.ZodNumber>;
+    organizationId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * Audit-log event for cross-frontend session handoff issuance
+ * (cross-app-jwt-propagation Step 2).
+ *
+ * Captures who issued a transferable session credential, where it was bound to,
+ * and a hash of the deep-link target so ops can correlate handoff issuance with
+ * the corresponding `tokenExchange` event WITHOUT leaking the raw deep link
+ * (which can carry org IDs, share codes, or draft IDs).
+ *
+ * `returnPathHash` is hex-encoded `sha256(returnPath)` computed by the audit-log
+ * helper from the validated returnPath. NEVER pass a pre-hashed value at the
+ * call site (defense-in-depth: prevents accidental double-hashing or hash
+ * mismatch with what the schema validated).
+ */
+export declare const AuditableEvent_User_CrossFrontendHandoffIssuedEventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.USER_CROSS_FRONTEND_HANDOFF_ISSUED>;
+    userId: z.ZodString;
+    sourceFrontendServiceName: z.ZodOptional<z.ZodString>;
+    targetServiceKey: z.ZodString;
+    returnPathHash: z.ZodString;
+    consumableTokenId: z.ZodString;
+    ipAddress: z.ZodString;
+    userAgent: z.ZodString;
+}, z.core.$strip>;
+/**
+ * A user-delegated `authorization_code` access token was minted for a third-party client at
+ * `/oauth/token`. This is the most security-sensitive access grant the provider makes: the client
+ * can now act AS the user at the audience-bound A2A/MCP resource. `clientId` is the `azp`
+ * (attribution only — the token carries the USER's authority, not the client's). Never carries the
+ * raw token.
+ */
+export declare const AuditableEvent_OAuth_DelegatedTokenIssuedEventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.OAUTH_DELEGATED_TOKEN_ISSUED>;
+    userId: z.ZodString;
+    clientId: z.ZodString;
+    audience: z.ZodString;
+    scopes: z.ZodArray<z.ZodString>;
+    ttlSeconds: z.ZodNumber;
+    ipAddress: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/** A user APPROVED an interactive consent request — a code is issued and the client may act for them. */
+export declare const AuditableEvent_OAuth_ConsentGrantedEventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.OAUTH_CONSENT_GRANTED>;
+    userId: z.ZodString;
+    clientId: z.ZodString;
+    scopes: z.ZodArray<z.ZodString>;
+    resource: z.ZodOptional<z.ZodString>;
+    remembered: z.ZodBoolean;
+    ipAddress: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/** A user DENIED an interactive consent request — access refused. */
+export declare const AuditableEvent_OAuth_ConsentDeniedEventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.OAUTH_CONSENT_DENIED>;
+    userId: z.ZodString;
+    clientId: z.ZodString;
+    scopes: z.ZodArray<z.ZodString>;
+    resource: z.ZodOptional<z.ZodString>;
+    ipAddress: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * A persistent consent grant (the durable "remember this app" record, keyed on
+ * `(userId, clientId, resource)`) was created or updated — it lets future authorize flows SKIP the
+ * consent prompt, so its lifecycle is a first-class delegated-authority audit concern.
+ */
+export declare const AuditableEvent_OAuth_ConsentGrantPersistedEventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.OAUTH_CONSENT_GRANT_PERSISTED>;
+    userId: z.ZodString;
+    clientId: z.ZodString;
+    resource: z.ZodOptional<z.ZodString>;
+    scopes: z.ZodArray<z.ZodString>;
+    isNewGrant: z.ZodBoolean;
+}, z.core.$strip>;
+/**
+ * A CIMD `client_id` URL was refused. Unauthenticated by construction, so the URL, the reason and
+ * the source of the request ARE the investigation surface.
+ */
+export declare const AuditableEvent_OAuth_CimdClientRefusedEventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.OAUTH_CIMD_CLIENT_REFUSED>;
+    clientId: z.ZodString;
+    reason: z.ZodString;
+    detail: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * A client registered itself at `/oauth/register` (RFC 7591). Unauthenticated by construction, so
+ * the source IP and the self-asserted name/redirects ARE the investigation surface — there is no
+ * principal to attribute it to.
+ */
+export declare const AuditableEvent_OAuth_DynamicClientRegisteredEventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.OAUTH_DYNAMIC_CLIENT_REGISTERED>;
+    clientId: z.ZodString;
+    clientName: z.ZodString;
+    redirectUris: z.ZodArray<z.ZodString>;
+    postLogoutRedirectUris: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    ipAddress: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * A user token was rotated via the provider `refresh_token` grant (`/oauth/token`). Distinct from the
+ * first-party session refresh (`USER_TOKEN_REFRESHED`): this is the OAuth-provider endpoint, which a
+ * confidential client MAY authenticate to. Low-detail INFO — the security-relevant refresh signal is
+ * reuse/theft ({@link CoreAuditableEventType.USER_REFRESH_TOKEN_REUSE_DETECTED}).
+ *
+ * There is deliberately NO `OAUTH_TOKEN_REFRESH_FAILED` counterpart (user-confirmed 2026-07-31): routine
+ * refresh failures (expired / revoked / plain-invalid presented token) are high-volume benign noise from
+ * ended sessions, and auditing them would drown the compliance store. The only refresh-failure worth an
+ * audit record is credential theft, which reuse-detection catches → `USER_REFRESH_TOKEN_REUSE_DETECTED`.
+ */
+export declare const AuditableEvent_OAuth_TokenRefreshedEventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.OAUTH_TOKEN_REFRESHED>;
+    userId: z.ZodOptional<z.ZodString>;
+    clientId: z.ZodOptional<z.ZodString>;
+    clientAuthenticated: z.ZodBoolean;
+    ipAddress: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * A token was revoked via `/oauth/revoke` (RFC 7009). The endpoint is deliberately a no-oracle (200 for
+ * unknown tokens), so this records the ATTEMPT + the authenticated client (if any), never whether the
+ * token existed or whose it was.
+ */
+export declare const AuditableEvent_OAuth_TokenRevokedEventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.OAUTH_TOKEN_REVOKED>;
+    clientId: z.ZodOptional<z.ZodString>;
+    clientAuthenticated: z.ZodBoolean;
+    tokenTypeHint: z.ZodOptional<z.ZodString>;
+    ipAddress: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * An OIDC RP-Initiated Logout (RP-Initiated Logout 1.0) terminated the End-User's OP session at
+ * `/oauth/end-session` (revocation-C). Records WHO logged out WHICH session via WHICH relying party, and
+ * whether a session was actually terminated / a post-logout redirect was refused. `userId`/`sessionId`/
+ * `clientId` are present only when a valid `id_token_hint` identified them — an invalid or absent hint
+ * still lands the user on the OP's page but terminates nothing.
+ */
+export declare const AuditableEvent_OAuth_RpInitiatedLogoutEventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.OAUTH_RP_INITIATED_LOGOUT>;
+    userId: z.ZodOptional<z.ZodString>;
+    sessionId: z.ZodOptional<z.ZodString>;
+    clientId: z.ZodOptional<z.ZodString>;
+    sessionTerminated: z.ZodBoolean;
+    postLogoutRedirectUriRejected: z.ZodBoolean;
+    ipAddress: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * An `authorization_code` exchange was REJECTED at `/oauth/token`. A potential attack signal (code
+ * replay, PKCE downgrade, redirect tampering, cross-client redemption). `reason` names the cause;
+ * `userId`/`resource` are present only for causes detected AFTER the code decodes (never for the
+ * atomic replay/consume failure, which fails before decode).
+ */
+export declare const AuditableEvent_OAuth_CodeExchangeFailedEventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.OAUTH_CODE_EXCHANGE_FAILED>;
+    reason: z.ZodEnum<typeof OAuthCodeExchangeFailureReason>;
+    clientId: z.ZodOptional<z.ZodString>;
+    userId: z.ZodOptional<z.ZodString>;
+    resource: z.ZodOptional<z.ZodString>;
+    ipAddress: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * A consent DECISION was submitted by an authenticated user who is NOT the user the consent request was
+ * bound to (returns 403). A textbook cross-user authorization-abuse signal — user A attempting to act on
+ * user B's pending consent. CRITICAL: records BOTH principals for the SIEM.
+ */
+export declare const AuditableEvent_OAuth_ConsentBindingViolationEventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.OAUTH_CONSENT_BINDING_VIOLATION>;
+    authenticatedUserId: z.ZodString;
+    boundUserId: z.ZodString;
+    clientId: z.ZodOptional<z.ZodString>;
+    consentTokenId: z.ZodOptional<z.ZodString>;
+    ipAddress: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * Refresh-token REUSE was detected → the whole token family was revoked (possible theft). Emitted by the
+ * refresh CALLERS, NOT the token issuer: the issuer stays audit-free by design (it performs the revoke and
+ * surfaces a machine-readable reuse SIGNAL on its thrown error), and each caller decides to audit. Applies
+ * to BOTH the first-party session refresh and the OAuth-provider refresh grant (shared issuer).
+ */
+export declare const AuditableEvent_User_RefreshTokenReuseDetectedEventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.USER_REFRESH_TOKEN_REUSE_DETECTED>;
+    userId: z.ZodString;
+    reusedJti: z.ZodString;
+    sessionId: z.ZodOptional<z.ZodString>;
+    familyRevoked: z.ZodBoolean;
+    ipAddress: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
 export declare const AuditableEvent_DataSchema: z.ZodRecord<z.ZodString, z.ZodAny>;
 export declare const AuditableEvent_BaseSchema: z.ZodObject<{
     _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    eventId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
     userId: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
     organizationId: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    applicationId: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    correlationId: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
+    frontendServiceName: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    clientInstanceId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
     riskLevel: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof ResourceOperationRiskLevel>>;
-    eventType: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
-    eventData: z.ZodRecord<z.ZodString, z.ZodAny>;
+    eventType: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    eventData: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodRecord<z.ZodString, z.ZodAny>>;
     eventCategory: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof AuditEventCategory>>;
     severity: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof AuditEventSeverity>>;
     createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>;
     updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 export declare const AuditableEvent_TypedDataSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_LOGIN>;
     ipAddress: z.ZodString;
@@ -545,12 +1954,12 @@ export declare const AuditableEvent_TypedDataSchema: z.ZodDiscriminatedUnion<[z.
     authMethod: z.ZodOptional<z.ZodString>;
     email: z.ZodOptional<z.ZodString>;
     sessionId: z.ZodOptional<z.ZodString>;
-}, z.core.$strip, core.$ZodObjectExtra>, z.ZodObject<{
+}, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_LOGOUT>;
     userId: z.ZodString;
     ipAddress: z.ZodString;
     userAgent: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>, z.ZodObject<{
+}, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_LOGIN_FAILED>;
     email: z.ZodEmail;
     authMethod: z.ZodString;
@@ -559,7 +1968,7 @@ export declare const AuditableEvent_TypedDataSchema: z.ZodDiscriminatedUnion<[z.
     userAgent: z.ZodString;
     attemptsRemaining: z.ZodOptional<z.ZodNumber>;
     sessionId: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>, z.ZodObject<{
+}, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_ACCOUNT_LOCKED>;
     userId: z.ZodString;
     email: z.ZodEmail;
@@ -568,38 +1977,95 @@ export declare const AuditableEvent_TypedDataSchema: z.ZodDiscriminatedUnion<[z.
     ipAddress: z.ZodString;
     userAgent: z.ZodString;
     sessionId: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>, z.ZodObject<{
+    reason: z.ZodOptional<z.ZodEnum<typeof AccountLockoutReason>>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.MACHINE_AUTH_SUCCESS>;
+    authMethod: z.ZodString;
+    credentialId: z.ZodString;
+    scopeType: z.ZodString;
+    scopeId: z.ZodOptional<z.ZodString>;
+    resourceIdentifier: z.ZodOptional<z.ZodString>;
+    operationIdentifier: z.ZodOptional<z.ZodString>;
+    ipAddress: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.MACHINE_AUTH_FAILED>;
+    credentialKind: z.ZodString;
+    credentialPrefix: z.ZodOptional<z.ZodString>;
+    reason: z.ZodString;
+    scopeType: z.ZodOptional<z.ZodString>;
+    scopeId: z.ZodOptional<z.ZodString>;
+    resourceIdentifier: z.ZodOptional<z.ZodString>;
+    operationIdentifier: z.ZodOptional<z.ZodString>;
+    ipAddress: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.MACHINE_ACCESS>;
+    authMethod: z.ZodString;
+    credentialId: z.ZodString;
+    scopeType: z.ZodString;
+    scopeId: z.ZodOptional<z.ZodString>;
+    roles: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    resourceServer: z.ZodString;
+    resourceIdentifier: z.ZodOptional<z.ZodString>;
+    operationIdentifier: z.ZodString;
+    ipAddress: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_SESSION_EXPIRED>;
     userId: z.ZodString;
     sessionId: z.ZodString;
     sessionDuration: z.ZodNumber;
     lastActivity: z.ZodDate;
-}, z.core.$strip, core.$ZodObjectExtra>, z.ZodObject<{
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.USER_APP_ROLES_CHANGED>;
+    userId: z.ZodString;
+    previousRoles: z.ZodArray<z.ZodString>;
+    newRoles: z.ZodArray<z.ZodString>;
+    requestedRoles: z.ZodArray<z.ZodString>;
+    operation: z.ZodString;
+    changedBy: z.ZodString;
+    reason: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.APPLICATION_SUPER_ADMIN_FLOOR_BREACHED>;
+    usableSuperAdminCount: z.ZodNumber;
+    requiredUsableSuperAdminCount: z.ZodNumber;
+    conferringRoles: z.ZodArray<z.ZodString>;
+    usableStatuses: z.ZodArray<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_OWNER_FLOOR_BREACHED>;
+    organizationId: z.ZodString;
+    reducedMemberIds: z.ZodArray<z.ZodString>;
+    remainingUsableOwners: z.ZodNumber;
+    operationIdentifier: z.ZodString;
+    subjectUserId: z.ZodString;
+    subjectNextStatus: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_MEMBER_INVITED>;
     organizationId: z.ZodString;
     invitedUserId: z.ZodString;
     invitedBy: z.ZodString;
     roles: z.ZodArray<z.ZodString>;
     email: z.ZodOptional<z.ZodEmail>;
-}, z.core.$strip, core.$ZodObjectExtra>, z.ZodObject<{
+}, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_MEMBER_JOINED>;
     organizationId: z.ZodString;
     userId: z.ZodString;
     roles: z.ZodArray<z.ZodString>;
     invitationId: z.ZodOptional<z.ZodString>;
-}, z.core.$strip, core.$ZodObjectExtra>, z.ZodObject<{
+}, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_MEMBER_UPDATED>;
     organizationId: z.ZodString;
     memberId: z.ZodString;
     changes: z.ZodRecord<z.ZodString, z.ZodAny>;
-}, z.core.$strip, core.$ZodObjectExtra>, z.ZodObject<{
+}, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_MEMBER_ROLE_CHANGED>;
     organizationId: z.ZodString;
     memberId: z.ZodString;
+    userId: z.ZodOptional<z.ZodString>;
     previousRoles: z.ZodArray<z.ZodString>;
     newRoles: z.ZodArray<z.ZodString>;
+    requestedRoles: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    operation: z.ZodString;
     changedBy: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>, z.ZodObject<{
+}, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_MEMBER_STATUS_CHANGED>;
     organizationId: z.ZodString;
     memberId: z.ZodString;
@@ -607,77 +2073,161 @@ export declare const AuditableEvent_TypedDataSchema: z.ZodDiscriminatedUnion<[z.
     newStatus: z.ZodString;
     changedBy: z.ZodString;
     reason: z.ZodOptional<z.ZodString>;
-}, z.core.$strip, core.$ZodObjectExtra>, z.ZodObject<{
+}, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_MEMBER_REMOVED>;
     organizationId: z.ZodString;
     memberId: z.ZodString;
     removedUserId: z.ZodString;
+    roles: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    previousStatus: z.ZodOptional<z.ZodString>;
+    operation: z.ZodString;
+    revokedUnitAssignments: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        organizationUnitId: z.ZodString;
+        role: z.ZodString;
+    }, z.core.$strip>>>;
     removedBy: z.ZodString;
     reason: z.ZodOptional<z.ZodString>;
-}, z.core.$strip, core.$ZodObjectExtra>, z.ZodObject<{
+}, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_CREATED>;
     organizationId: z.ZodString;
     name: z.ZodString;
     slug: z.ZodString;
     createdBy: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>, z.ZodObject<{
+}, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_UPDATED>;
     organizationId: z.ZodString;
     changes: z.ZodRecord<z.ZodString, z.ZodAny>;
     updatedBy: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>, z.ZodObject<{
+}, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_DELETED>;
     organizationId: z.ZodString;
     name: z.ZodString;
     slug: z.ZodString;
     deletedBy: z.ZodString;
     reason: z.ZodOptional<z.ZodString>;
-}, z.core.$strip, core.$ZodObjectExtra>, z.ZodObject<{
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_DELETION_REQUESTED>;
+    organizationId: z.ZodString;
+    name: z.ZodString;
+    slug: z.ZodString;
+    requestedBy: z.ZodString;
+    purgeScheduledAt: z.ZodString;
+    revokedUserTypeCount: z.ZodNumber;
+    reason: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_RESTORED>;
+    organizationId: z.ZodString;
+    name: z.ZodString;
+    slug: z.ZodString;
+    restoredBy: z.ZodString;
+    restoredStatus: z.ZodString;
+    regrantedUserTypeCount: z.ZodNumber;
+    reason: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_SUSPENDED>;
+    organizationId: z.ZodString;
+    name: z.ZodString;
+    slug: z.ZodString;
+    suspendedBy: z.ZodString;
+    previousStatus: z.ZodString;
+    suspensionReason: z.ZodString;
+    notifiedMembers: z.ZodBoolean;
+    revokedUserTypeCount: z.ZodNumber;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.RESOURCE_STATUS_TRANSITION_PERFORMED>;
+    resourceType: z.ZodString;
+    operationIdentifier: z.ZodString;
+    subjectId: z.ZodString;
+    performedBy: z.ZodString;
+    previousStatus: z.ZodString;
+    newStatus: z.ZodString;
+    reason: z.ZodOptional<z.ZodString>;
+    scheduledReactivationAt: z.ZodOptional<z.ZodString>;
+    organizationId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_ACTIVATED>;
+    organizationId: z.ZodString;
+    name: z.ZodString;
+    slug: z.ZodString;
+    activatedBy: z.ZodString;
+    previousStatus: z.ZodString;
+    regrantedUserTypeCount: z.ZodNumber;
+    reason: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_NOTIFICATIONS_UPDATED>;
     organizationId: z.ZodString;
     notificationsId: z.ZodString;
     changes: z.ZodRecord<z.ZodString, z.ZodAny>;
     updatedBy: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>, z.ZodObject<{
+}, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_PREFERENCES_UPDATED>;
     organizationId: z.ZodString;
     preferencesId: z.ZodString;
     changes: z.ZodRecord<z.ZodString, z.ZodAny>;
     updatedBy: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>, z.ZodObject<{
+}, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_PROFILE_UPDATED>;
     organizationId: z.ZodString;
     profileId: z.ZodString;
     changes: z.ZodRecord<z.ZodString, z.ZodAny>;
     updatedBy: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>, z.ZodObject<{
+}, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_UNIT_UPDATED>;
     organizationId: z.ZodString;
     unitId: z.ZodString;
     changes: z.ZodRecord<z.ZodString, z.ZodAny>;
     updatedBy: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>, z.ZodObject<{
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_UNIT_MEMBER_ROLE_CHANGED>;
+    organizationId: z.ZodOptional<z.ZodString>;
+    organizationUnitId: z.ZodOptional<z.ZodString>;
+    assignmentId: z.ZodString;
+    organizationMemberId: z.ZodOptional<z.ZodString>;
+    previousRole: z.ZodOptional<z.ZodString>;
+    newRole: z.ZodString;
+    requestedRole: z.ZodOptional<z.ZodString>;
+    operation: z.ZodString;
+    changedBy: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_UNIT_MEMBER_REMOVED>;
+    organizationId: z.ZodOptional<z.ZodString>;
+    organizationUnitId: z.ZodOptional<z.ZodString>;
+    assignmentId: z.ZodString;
+    organizationMemberId: z.ZodOptional<z.ZodString>;
+    revokedRole: z.ZodOptional<z.ZodString>;
+    removedBy: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.USER_DELETED>;
+    userId: z.ZodString;
+    email: z.ZodOptional<z.ZodString>;
+    deletedBy: z.ZodString;
+    appRoles: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_SSO_LOGIN>;
     userId: z.ZodString;
     email: z.ZodEmail;
     providerRef: z.ZodString;
     connectionType: z.ZodEnum<typeof SsoConnectionType>;
     authSource: z.ZodOptional<z.ZodString>;
+    scopeType: z.ZodOptional<z.ZodEnum<typeof AuthScopeType>>;
     organizationId: z.ZodOptional<z.ZodString>;
+    applicationId: z.ZodOptional<z.ZodString>;
     ipAddress: z.ZodString;
     userAgent: z.ZodString;
     sessionId: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>, z.ZodObject<{
+}, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_SSO_LOGIN_FAILED>;
     email: z.ZodOptional<z.ZodEmail>;
     providerRef: z.ZodOptional<z.ZodString>;
     connectionType: z.ZodOptional<z.ZodEnum<typeof SsoConnectionType>>;
     authSource: z.ZodOptional<z.ZodString>;
     failureReason: z.ZodString;
+    scopeType: z.ZodOptional<z.ZodEnum<typeof AuthScopeType>>;
     organizationId: z.ZodOptional<z.ZodString>;
+    applicationId: z.ZodOptional<z.ZodString>;
     ipAddress: z.ZodString;
     userAgent: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>, z.ZodObject<{
+}, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_SSO_ENFORCEMENT_BLOCKED>;
     email: z.ZodEmail;
     attemptedProviderRef: z.ZodString;
@@ -686,27 +2236,45 @@ export declare const AuditableEvent_TypedDataSchema: z.ZodDiscriminatedUnion<[z.
     enforcementPolicy: z.ZodString;
     ipAddress: z.ZodString;
     userAgent: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>, z.ZodObject<{
+}, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_TOKEN_REFRESHED>;
     userId: z.ZodString;
     sessionId: z.ZodString;
     ipAddress: z.ZodString;
     userAgent: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>, z.ZodObject<{
+}, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_SSO_CONFIGURATION_CHANGED>;
     organizationId: z.ZodString;
     changedBy: z.ZodString;
     changeType: z.ZodEnum<typeof SsoConfigChangeType>;
     affectedProviderRef: z.ZodOptional<z.ZodString>;
     changes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
-}, z.core.$strip, core.$ZodObjectExtra>, z.ZodObject<{
+}, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_SIEM_EXPORT_CONFIGURED>;
     organizationId: z.ZodString;
     changedBy: z.ZodString;
     changeType: z.ZodEnum<typeof SiemExportChangeType>;
     webhookUrlDomain: z.ZodOptional<z.ZodString>;
     eventFormatConfigured: z.ZodOptional<z.ZodString>;
-}, z.core.$strip, core.$ZodObjectExtra>, z.ZodObject<{
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.APPLICATION_AUTH_POLICY_CHANGED>;
+    applicationId: z.ZodString;
+    changedUserTypes: z.ZodArray<z.ZodString>;
+    snapshotDigest: z.ZodString;
+    before: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
+    after: z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.WEBHOOK_ENDPOINT_TEST_DISPATCHED>;
+    organizationId: z.ZodOptional<z.ZodString>;
+    applicationId: z.ZodOptional<z.ZodString>;
+    dispatchedBy: z.ZodString;
+    endpointId: z.ZodString;
+    destinationHost: z.ZodString;
+    outcome: z.ZodEnum<typeof WebhookEndpointProbeOutcome>;
+    responseStatus: z.ZodOptional<z.ZodNumber>;
+    durationMs: z.ZodNumber;
+    signatureJti: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.SCIM_TOKEN_CREATED>;
     organizationId: z.ZodString;
     tokenDisplayName: z.ZodString;
@@ -714,14 +2282,14 @@ export declare const AuditableEvent_TypedDataSchema: z.ZodDiscriminatedUnion<[z.
     expiresAt: z.ZodOptional<z.ZodString>;
     ipAddress: z.ZodString;
     userAgent: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>, z.ZodObject<{
+}, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.SCIM_TOKEN_REVOKED>;
     organizationId: z.ZodString;
     tokenDisplayName: z.ZodString;
     revokedByUserId: z.ZodString;
     ipAddress: z.ZodString;
     userAgent: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>, z.ZodObject<{
+}, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.SCIM_USER_PROVISIONED>;
     organizationId: z.ZodString;
     userId: z.ZodString;
@@ -729,64 +2297,73 @@ export declare const AuditableEvent_TypedDataSchema: z.ZodDiscriminatedUnion<[z.
     isNewUser: z.ZodBoolean;
     provisionedVia: z.ZodString;
     authSource: z.ZodOptional<z.ZodString>;
-}, z.core.$strip, core.$ZodObjectExtra>, z.ZodObject<{
+}, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.SCIM_USER_UPDATED>;
     organizationId: z.ZodString;
     userId: z.ZodString;
     operation: z.ZodString;
     updatedAttributes: z.ZodOptional<z.ZodArray<z.ZodString>>;
-}, z.core.$strip, core.$ZodObjectExtra>, z.ZodObject<{
+}, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.SCIM_USER_DEACTIVATED>;
     organizationId: z.ZodString;
     userId: z.ZodString;
     email: z.ZodOptional<z.ZodString>;
-}, z.core.$strip, core.$ZodObjectExtra>, z.ZodObject<{
+}, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_PASSWORD_RESET_REQUESTED>;
     email: z.ZodString;
     ipAddress: z.ZodString;
     userAgent: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>, z.ZodObject<{
+}, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_PASSWORD_RESET_COMPLETED>;
     userId: z.ZodString;
     ipAddress: z.ZodString;
     userAgent: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>, z.ZodObject<{
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.USER_PASSWORD_RESET_FORCED>;
+    targetUserId: z.ZodString;
+    targetEmail: z.ZodString;
+    actorUserId: z.ZodString;
+    reason: z.ZodString;
+    sessionsRevoked: z.ZodBoolean;
+    ipAddress: z.ZodOptional<z.ZodString>;
+    userAgent: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_REGISTERED>;
     userId: z.ZodString;
     email: z.ZodString;
     ipAddress: z.ZodString;
     userAgent: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>, z.ZodObject<{
+}, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_EMAIL_VERIFIED>;
     userId: z.ZodString;
     email: z.ZodString;
     ipAddress: z.ZodString;
     userAgent: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>, z.ZodObject<{
+}, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_VERIFICATION_EMAIL_RESENT>;
     userId: z.ZodString;
     email: z.ZodString;
     ipAddress: z.ZodString;
     userAgent: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>, z.ZodObject<{
+}, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_MFA_SETUP_STARTED>;
     userId: z.ZodString;
     mfaMethod: z.ZodString;
     ipAddress: z.ZodString;
     userAgent: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>, z.ZodObject<{
+}, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_MFA_SETUP_COMPLETED>;
     userId: z.ZodString;
     mfaMethod: z.ZodString;
     ipAddress: z.ZodString;
     userAgent: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>, z.ZodObject<{
+}, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_MFA_EMAIL_OTP_SENT>;
     email: z.ZodString;
     sessionId: z.ZodString;
     ipAddress: z.ZodString;
     userAgent: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>, z.ZodObject<{
+}, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_PASSKEY_REGISTERED>;
     userId: z.ZodString;
     email: z.ZodString;
@@ -795,7 +2372,7 @@ export declare const AuditableEvent_TypedDataSchema: z.ZodDiscriminatedUnion<[z.
     credentialDeviceType: z.ZodString;
     ipAddress: z.ZodString;
     userAgent: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>, z.ZodObject<{
+}, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_PASSKEY_AUTHENTICATION_SUCCESS>;
     userId: z.ZodString;
     email: z.ZodString;
@@ -803,14 +2380,14 @@ export declare const AuditableEvent_TypedDataSchema: z.ZodDiscriminatedUnion<[z.
     ipAddress: z.ZodString;
     userAgent: z.ZodString;
     sessionId: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>, z.ZodObject<{
+}, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_PASSKEY_AUTHENTICATION_FAILURE>;
     email: z.ZodString;
     failureReason: z.ZodString;
     ipAddress: z.ZodString;
     userAgent: z.ZodString;
     sessionId: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>, z.ZodObject<{
+}, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_PASSKEY_REMOVED>;
     userId: z.ZodString;
     email: z.ZodString;
@@ -818,32 +2395,32 @@ export declare const AuditableEvent_TypedDataSchema: z.ZodDiscriminatedUnion<[z.
     credentialName: z.ZodString;
     ipAddress: z.ZodString;
     userAgent: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>, z.ZodObject<{
+}, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_MAGIC_LINK_SENT>;
     email: z.ZodString;
     ipAddress: z.ZodString;
     userAgent: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>, z.ZodObject<{
+}, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_MAGIC_LINK_VERIFIED>;
     userId: z.ZodString;
     email: z.ZodString;
     ipAddress: z.ZodString;
     userAgent: z.ZodString;
     sessionId: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>, z.ZodObject<{
+}, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_MAGIC_LINK_FAILED>;
     email: z.ZodOptional<z.ZodString>;
     failureReason: z.ZodString;
     ipAddress: z.ZodString;
     userAgent: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>, z.ZodObject<{
+}, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_SMS_OTP_SENT>;
     phoneNumber: z.ZodString;
     factorLevel: z.ZodString;
     sessionId: z.ZodString;
     ipAddress: z.ZodString;
     userAgent: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>, z.ZodObject<{
+}, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_SMS_OTP_VERIFIED>;
     userId: z.ZodString;
     phoneNumber: z.ZodString;
@@ -851,7 +2428,7 @@ export declare const AuditableEvent_TypedDataSchema: z.ZodDiscriminatedUnion<[z.
     sessionId: z.ZodString;
     ipAddress: z.ZodString;
     userAgent: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>, z.ZodObject<{
+}, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_SMS_OTP_FAILED>;
     phoneNumber: z.ZodOptional<z.ZodString>;
     factorLevel: z.ZodString;
@@ -859,27 +2436,29 @@ export declare const AuditableEvent_TypedDataSchema: z.ZodDiscriminatedUnion<[z.
     sessionId: z.ZodString;
     ipAddress: z.ZodString;
     userAgent: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>, z.ZodObject<{
+}, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_PHONE_VERIFIED>;
     userId: z.ZodString;
     phoneNumber: z.ZodString;
     ipAddress: z.ZodString;
     userAgent: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>, z.ZodObject<{
+}, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_PHONE_VERIFICATION_FAILED>;
     phoneNumber: z.ZodString;
     failureReason: z.ZodString;
     ipAddress: z.ZodString;
     userAgent: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>, z.ZodObject<{
+}, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.OAUTH2_PROVIDER_BLOCKED>;
     email: z.ZodOptional<z.ZodString>;
     providerRef: z.ZodString;
-    organizationId: z.ZodString;
+    scopeType: z.ZodEnum<typeof AuthScopeType>;
+    organizationId: z.ZodOptional<z.ZodString>;
+    applicationId: z.ZodOptional<z.ZodString>;
     reason: z.ZodString;
     ipAddress: z.ZodString;
     userAgent: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>, z.ZodObject<{
+}, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.EMERGENCY_ACCESS_USED>;
     userId: z.ZodString;
     email: z.ZodEmail;
@@ -888,20 +2467,242 @@ export declare const AuditableEvent_TypedDataSchema: z.ZodDiscriminatedUnion<[z.
     ipAddress: z.ZodString;
     userAgent: z.ZodString;
     sessionId: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>, z.ZodObject<{
+}, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.FIELD_ACCESS>;
     fieldName: z.ZodString;
     resourceType: z.ZodString;
     resourceId: z.ZodOptional<z.ZodString>;
     operationIdentifier: z.ZodString;
     isCreateOperation: z.ZodBoolean;
-}, z.core.$strip, core.$ZodObjectExtra>], "eventType">;
+    machineCredentialAuthMethod: z.ZodOptional<z.ZodString>;
+    machineCredentialId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.RESOURCE_OPERATION_PERFORMED>;
+    resourceType: z.ZodString;
+    operationIdentifier: z.ZodString;
+    variantType: z.ZodEnum<typeof ResourceOperationVariantType>;
+    variantKey: z.ZodOptional<z.ZodString>;
+    resourceOperationLike: z.ZodOptional<z.ZodEnum<typeof CoreResourceOperation>>;
+    isBulkOperation: z.ZodOptional<z.ZodBoolean>;
+    resourceId: z.ZodOptional<z.ZodString>;
+    affectedRecordCount: z.ZodOptional<z.ZodNumber>;
+    initiatorRoles: z.ZodArray<z.ZodString>;
+    executionType: z.ZodEnum<typeof ExecutionContext_ExecutionType>;
+    machineCredentialAuthMethod: z.ZodOptional<z.ZodString>;
+    machineCredentialId: z.ZodOptional<z.ZodString>;
+    subCallDepth: z.ZodNumber;
+    changedFields: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    fieldEvidence: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        before: z.ZodOptional<z.ZodUnknown>;
+        after: z.ZodOptional<z.ZodUnknown>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.RESOURCE_OPERATION_DENIED>;
+    denialReason: z.ZodEnum<typeof ResourceOperationDenialReason>;
+    resourceType: z.ZodString;
+    operationIdentifier: z.ZodString;
+    variantType: z.ZodEnum<typeof ResourceOperationVariantType>;
+    variantKey: z.ZodOptional<z.ZodString>;
+    resourceOperationLike: z.ZodOptional<z.ZodEnum<typeof CoreResourceOperation>>;
+    isBulkOperation: z.ZodOptional<z.ZodBoolean>;
+    attemptedResourceIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    requiredRoles: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    initiatorRoles: z.ZodArray<z.ZodString>;
+    executionType: z.ZodEnum<typeof ExecutionContext_ExecutionType>;
+    machineCredentialAuthMethod: z.ZodOptional<z.ZodString>;
+    machineCredentialId: z.ZodOptional<z.ZodString>;
+    subCallDepth: z.ZodNumber;
+    occurrenceCount: z.ZodNumber;
+    occurrenceCountIsExact: z.ZodBoolean;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.CROSS_TENANT_ADMINISTRATIVE_ACCESS>;
+    targetOrganizationId: z.ZodString;
+    resourceType: z.ZodString;
+    operationIdentifier: z.ZodString;
+    variantType: z.ZodEnum<typeof ResourceOperationVariantType>;
+    variantKey: z.ZodOptional<z.ZodString>;
+    targetResourceIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    authorizingGrantId: z.ZodOptional<z.ZodString>;
+    admissionDeclared: z.ZodBoolean;
+    initiatorRoles: z.ZodArray<z.ZodString>;
+    executionType: z.ZodEnum<typeof ExecutionContext_ExecutionType>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.PLATFORM_DIRECTORY_ACCESS>;
+    resourceType: z.ZodString;
+    operationIdentifier: z.ZodString;
+    variantType: z.ZodEnum<typeof ResourceOperationVariantType>;
+    variantKey: z.ZodOptional<z.ZodString>;
+    returnedCount: z.ZodNumber;
+    initiatorRoles: z.ZodArray<z.ZodString>;
+    executionType: z.ZodEnum<typeof ExecutionContext_ExecutionType>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.PLATFORM_ACCESS_GRANT_LIFECYCLE>;
+    transition: z.ZodEnum<typeof PlatformAccessGrantLifecycleTransition>;
+    grantId: z.ZodString;
+    targetOrganizationId: z.ZodString;
+    operatorUserId: z.ZodString;
+    justification: z.ZodOptional<z.ZodString>;
+    resultingStatus: z.ZodEnum<typeof PlatformAccessGrantStatus>;
+    expiresAt: z.ZodOptional<z.ZodDate>;
+    autoApprovalReason: z.ZodOptional<z.ZodEnum<typeof PlatformAccessGrantAutoApprovalReason>>;
+    decidedByUserId: z.ZodOptional<z.ZodString>;
+    decisionReason: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.RETAINED_DATA_ACCESS>;
+    accessingUserId: z.ZodString;
+    reason: z.ZodString;
+    resourceType: z.ZodString;
+    resourceId: z.ZodOptional<z.ZodString>;
+    retainedRecordCount: z.ZodOptional<z.ZodNumber>;
+    operationIdentifier: z.ZodString;
+    roles: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    organizationId: z.ZodOptional<z.ZodString>;
+    ipAddress: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.SUBJECT_DATA_EXPORT>;
+    purpose: z.ZodString;
+    subjectResourceType: z.ZodString;
+    subjectIds: z.ZodArray<z.ZodString>;
+    includedResourceTypes: z.ZodArray<z.ZodString>;
+    totalRecordCount: z.ZodNumber;
+    fieldsExcludedAsDerived: z.ZodArray<z.ZodString>;
+    fieldsWithheldAsNonDisclosable: z.ZodArray<z.ZodString>;
+    organizationId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.COLLECTION_DATA_EXPORT>;
+    resourceType: z.ZodString;
+    sourceOperationIdentifier: z.ZodString;
+    format: z.ZodString;
+    rowScope: z.ZodString;
+    rowCount: z.ZodNumber;
+    filterFieldNames: z.ZodArray<z.ZodString>;
+    organizationId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.HTTP_API_READ_THROUGH_ACCESS>;
+    resourceType: z.ZodString;
+    operationIdentifier: z.ZodString;
+    providerRef: z.ZodString;
+    remoteEntityRef: z.ZodString;
+    dialect: z.ZodString;
+    initiatorUserId: z.ZodOptional<z.ZodString>;
+    executionType: z.ZodOptional<z.ZodString>;
+    organizationId: z.ZodOptional<z.ZodString>;
+    resourceId: z.ZodOptional<z.ZodString>;
+    rowCount: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.HTTP_API_EXTERNAL_ERASURE>;
+    subjectResourceType: z.ZodString;
+    subjectIds: z.ZodArray<z.ZodString>;
+    resourceType: z.ZodString;
+    providerRef: z.ZodString;
+    remoteEntityRef: z.ZodString;
+    dialect: z.ZodString;
+    deletedRowCount: z.ZodNumber;
+    organizationId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.HTTP_API_NON_ERASURE_ACKNOWLEDGED>;
+    subjectResourceType: z.ZodString;
+    subjectIds: z.ZodArray<z.ZodString>;
+    resourceType: z.ZodString;
+    providerRef: z.ZodString;
+    remoteEntityRef: z.ZodString;
+    dialect: z.ZodString;
+    remainingRowCount: z.ZodOptional<z.ZodNumber>;
+    organizationId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.USER_CROSS_FRONTEND_HANDOFF_ISSUED>;
+    userId: z.ZodString;
+    sourceFrontendServiceName: z.ZodOptional<z.ZodString>;
+    targetServiceKey: z.ZodString;
+    returnPathHash: z.ZodString;
+    consumableTokenId: z.ZodString;
+    ipAddress: z.ZodString;
+    userAgent: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.OAUTH_DELEGATED_TOKEN_ISSUED>;
+    userId: z.ZodString;
+    clientId: z.ZodString;
+    audience: z.ZodString;
+    scopes: z.ZodArray<z.ZodString>;
+    ttlSeconds: z.ZodNumber;
+    ipAddress: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.OAUTH_CONSENT_GRANTED>;
+    userId: z.ZodString;
+    clientId: z.ZodString;
+    scopes: z.ZodArray<z.ZodString>;
+    resource: z.ZodOptional<z.ZodString>;
+    remembered: z.ZodBoolean;
+    ipAddress: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.OAUTH_CONSENT_DENIED>;
+    userId: z.ZodString;
+    clientId: z.ZodString;
+    scopes: z.ZodArray<z.ZodString>;
+    resource: z.ZodOptional<z.ZodString>;
+    ipAddress: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.OAUTH_CONSENT_GRANT_PERSISTED>;
+    userId: z.ZodString;
+    clientId: z.ZodString;
+    resource: z.ZodOptional<z.ZodString>;
+    scopes: z.ZodArray<z.ZodString>;
+    isNewGrant: z.ZodBoolean;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.OAUTH_TOKEN_REFRESHED>;
+    userId: z.ZodOptional<z.ZodString>;
+    clientId: z.ZodOptional<z.ZodString>;
+    clientAuthenticated: z.ZodBoolean;
+    ipAddress: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.OAUTH_TOKEN_REVOKED>;
+    clientId: z.ZodOptional<z.ZodString>;
+    clientAuthenticated: z.ZodBoolean;
+    tokenTypeHint: z.ZodOptional<z.ZodString>;
+    ipAddress: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.OAUTH_RP_INITIATED_LOGOUT>;
+    userId: z.ZodOptional<z.ZodString>;
+    sessionId: z.ZodOptional<z.ZodString>;
+    clientId: z.ZodOptional<z.ZodString>;
+    sessionTerminated: z.ZodBoolean;
+    postLogoutRedirectUriRejected: z.ZodBoolean;
+    ipAddress: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.OAUTH_CODE_EXCHANGE_FAILED>;
+    reason: z.ZodEnum<typeof OAuthCodeExchangeFailureReason>;
+    clientId: z.ZodOptional<z.ZodString>;
+    userId: z.ZodOptional<z.ZodString>;
+    resource: z.ZodOptional<z.ZodString>;
+    ipAddress: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.OAUTH_CONSENT_BINDING_VIOLATION>;
+    authenticatedUserId: z.ZodString;
+    boundUserId: z.ZodString;
+    clientId: z.ZodOptional<z.ZodString>;
+    consentTokenId: z.ZodOptional<z.ZodString>;
+    ipAddress: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.USER_REFRESH_TOKEN_REUSE_DETECTED>;
+    userId: z.ZodString;
+    reusedJti: z.ZodString;
+    sessionId: z.ZodOptional<z.ZodString>;
+    familyRevoked: z.ZodBoolean;
+    ipAddress: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>], "eventType">;
 export type AuditableEvent = z.infer<typeof AuditableEvent_BaseSchema>;
 export type AuditableEvent_User_LoginEventData = z.infer<typeof AuditableEvent_User_LoginEventDataSchema>;
 export type AuditableEvent_User_LogoutEventData = z.infer<typeof AuditableEvent_User_LogoutEventDataSchema>;
 export type AuditableEvent_User_LoginFailedEventData = z.infer<typeof AuditableEvent_User_LoginFailedEventDataSchema>;
+export type AuditableEvent_MachineAuth_SuccessEventData = z.infer<typeof AuditableEvent_MachineAuth_SuccessEventDataSchema>;
+export type AuditableEvent_MachineAuth_FailedEventData = z.infer<typeof AuditableEvent_MachineAuth_FailedEventDataSchema>;
+export type AuditableEvent_MachineAccess_EventData = z.infer<typeof AuditableEvent_MachineAccess_EventDataSchema>;
 export type AuditableEvent_User_AccountLockedEventData = z.infer<typeof AuditableEvent_User_AccountLockedEventDataSchema>;
 export type AuditableEvent_User_SessionExpiredEventData = z.infer<typeof AuditableEvent_User_SessionExpiredEventDataSchema>;
+export type AuditableEvent_User_AppRolesChangedEventData = z.infer<typeof AuditableEvent_User_AppRolesChangedEventDataSchema>;
+export type AuditableEvent_Application_SuperAdminFloorBreachedEventData = z.infer<typeof AuditableEvent_Application_SuperAdminFloorBreachedEventDataSchema>;
+export type AuditableEvent_Organization_OwnerFloorBreachedEventData = z.infer<typeof AuditableEvent_Organization_OwnerFloorBreachedEventDataSchema>;
+export type AuditableEvent_User_DeletedEventData = z.infer<typeof AuditableEvent_User_DeletedEventDataSchema>;
 export type AuditableEvent_OrganizationMember_InvitedEventData = z.infer<typeof AuditableEvent_OrganizationMember_InvitedEventDataSchema>;
 export type AuditableEvent_OrganizationMember_JoinedEventData = z.infer<typeof AuditableEvent_OrganizationMember_JoinedEventDataSchema>;
 export type AuditableEvent_OrganizationMember_UpdatedEventData = z.infer<typeof AuditableEvent_OrganizationMember_UpdatedEventDataSchema>;
@@ -911,16 +2712,26 @@ export type AuditableEvent_OrganizationMember_RemovedEventData = z.infer<typeof
 export type AuditableEvent_Organization_CreatedEventData = z.infer<typeof AuditableEvent_Organization_CreatedEventDataSchema>;
 export type AuditableEvent_Organization_UpdatedEventData = z.infer<typeof AuditableEvent_Organization_UpdatedEventDataSchema>;
 export type AuditableEvent_Organization_DeletedEventData = z.infer<typeof AuditableEvent_Organization_DeletedEventDataSchema>;
+export type AuditableEvent_Organization_DeletionRequestedEventData = z.infer<typeof AuditableEvent_Organization_DeletionRequestedEventDataSchema>;
+export type AuditableEvent_Organization_RestoredEventData = z.infer<typeof AuditableEvent_Organization_RestoredEventDataSchema>;
+export type AuditableEvent_Organization_SuspendedEventData = z.infer<typeof AuditableEvent_Organization_SuspendedEventDataSchema>;
+export type AuditableEvent_Resource_StatusTransitionPerformedEventData = z.infer<typeof AuditableEvent_Resource_StatusTransitionPerformedEventDataSchema>;
+export type AuditableEvent_Organization_ActivatedEventData = z.infer<typeof AuditableEvent_Organization_ActivatedEventDataSchema>;
 export type AuditableEvent_OrganizationNotifications_UpdatedEventData = z.infer<typeof AuditableEvent_OrganizationNotifications_UpdatedEventDataSchema>;
 export type AuditableEvent_OrganizationPreferences_UpdatedEventData = z.infer<typeof AuditableEvent_OrganizationPreferences_UpdatedEventDataSchema>;
 export type AuditableEvent_OrganizationProfile_UpdatedEventData = z.infer<typeof AuditableEvent_OrganizationProfile_UpdatedEventDataSchema>;
 export type AuditableEvent_OrganizationUnit_UpdatedEventData = z.infer<typeof AuditableEvent_OrganizationUnit_UpdatedEventDataSchema>;
+export type AuditableEvent_OrganizationUnitMember_RoleChangedEventData = z.infer<typeof AuditableEvent_OrganizationUnitMember_RoleChangedEventDataSchema>;
+export type AuditableEvent_OrganizationUnitMember_RemovedEventData = z.infer<typeof AuditableEvent_OrganizationUnitMember_RemovedEventDataSchema>;
 export type AuditableEvent_User_SSOLoginEventData = z.infer<typeof AuditableEvent_User_SSOLoginEventDataSchema>;
 export type AuditableEvent_User_SSOLoginFailedEventData = z.infer<typeof AuditableEvent_User_SSOLoginFailedEventDataSchema>;
 export type AuditableEvent_User_SSOEnforcementBlockedEventData = z.infer<typeof AuditableEvent_User_SSOEnforcementBlockedEventDataSchema>;
 export type AuditableEvent_User_TokenRefreshedEventData = z.infer<typeof AuditableEvent_User_TokenRefreshedEventDataSchema>;
 export type AuditableEvent_Organization_SSOConfigurationChangedEventData = z.infer<typeof AuditableEvent_Organization_SSOConfigurationChangedEventDataSchema>;
 export type AuditableEvent_Organization_SIEMExportConfiguredEventData = z.infer<typeof AuditableEvent_Organization_SIEMExportConfiguredEventDataSchema>;
+export type ApplicationAuthPolicySnapshot = z.infer<typeof ApplicationAuthPolicySnapshotSchema>;
+export type AuditableEvent_ApplicationAuthPolicyChanged_EventData = z.infer<typeof AuditableEvent_ApplicationAuthPolicyChanged_EventDataSchema>;
+export type AuditableEvent_Webhook_EndpointTestDispatchedEventData = z.infer<typeof AuditableEvent_Webhook_EndpointTestDispatchedEventDataSchema>;
 export type AuditableEvent_SCIM_TokenCreatedEventData = z.infer<typeof AuditableEvent_SCIM_TokenCreatedEventDataSchema>;
 export type AuditableEvent_SCIM_TokenRevokedEventData = z.infer<typeof AuditableEvent_SCIM_TokenRevokedEventDataSchema>;
 export type AuditableEvent_SCIM_UserProvisionedEventData = z.infer<typeof AuditableEvent_SCIM_UserProvisionedEventDataSchema>;
@@ -928,6 +2739,7 @@ export type AuditableEvent_SCIM_UserUpdatedEventData = z.infer<typeof AuditableE
 export type AuditableEvent_SCIM_UserDeactivatedEventData = z.infer<typeof AuditableEvent_SCIM_UserDeactivatedEventDataSchema>;
 export type AuditableEvent_User_PasswordResetRequestedEventData = z.infer<typeof AuditableEvent_User_PasswordResetRequestedEventDataSchema>;
 export type AuditableEvent_User_PasswordResetCompletedEventData = z.infer<typeof AuditableEvent_User_PasswordResetCompletedEventDataSchema>;
+export type AuditableEvent_User_PasswordResetForcedEventData = z.infer<typeof AuditableEvent_User_PasswordResetForcedEventDataSchema>;
 export type AuditableEvent_User_RegisteredEventData = z.infer<typeof AuditableEvent_User_RegisteredEventDataSchema>;
 export type AuditableEvent_User_EmailVerifiedEventData = z.infer<typeof AuditableEvent_User_EmailVerifiedEventDataSchema>;
 export type AuditableEvent_User_VerificationEmailResentEventData = z.infer<typeof AuditableEvent_User_VerificationEmailResentEventDataSchema>;
@@ -948,4 +2760,26 @@ export type AuditableEvent_User_PhoneVerifiedEventData = z.infer<typeof Auditabl
 export type AuditableEvent_User_PhoneVerificationFailedEventData = z.infer<typeof AuditableEvent_User_PhoneVerificationFailedEventDataSchema>;
 export type AuditableEvent_EmergencyAccess_UsedEventData = z.infer<typeof AuditableEvent_EmergencyAccess_UsedEventDataSchema>;
 export type AuditableEvent_FieldAccess_EventData = z.infer<typeof AuditableEvent_FieldAccess_EventDataSchema>;
+export type AuditableEvent_ResourceOperationPerformed_EventData = z.infer<typeof AuditableEvent_ResourceOperationPerformed_EventDataSchema>;
+export type AuditableEvent_PlatformDirectoryAccess_EventData = z.infer<typeof AuditableEvent_PlatformDirectoryAccess_EventDataSchema>;
+export type AuditableEvent_ResourceOperationDenied_EventData = z.infer<typeof AuditableEvent_ResourceOperationDenied_EventDataSchema>;
+export type AuditableEvent_RetainedDataAccess_EventData = z.infer<typeof AuditableEvent_RetainedDataAccess_EventDataSchema>;
+export type AuditableEvent_SubjectDataExport_EventData = z.infer<typeof AuditableEvent_SubjectDataExport_EventDataSchema>;
+export type AuditableEvent_CollectionDataExport_EventData = z.infer<typeof AuditableEvent_CollectionDataExport_EventDataSchema>;
+export type AuditableEvent_HttpApiReadThroughAccess_EventData = z.infer<typeof AuditableEvent_HttpApiReadThroughAccess_EventDataSchema>;
+export type AuditableEvent_HttpApiExternalErasure_EventData = z.infer<typeof AuditableEvent_HttpApiExternalErasure_EventDataSchema>;
+export type AuditableEvent_HttpApiNonErasureAcknowledged_EventData = z.infer<typeof AuditableEvent_HttpApiNonErasureAcknowledged_EventDataSchema>;
+export type AuditableEvent_User_CrossFrontendHandoffIssuedEventData = z.infer<typeof AuditableEvent_User_CrossFrontendHandoffIssuedEventDataSchema>;
+export type AuditableEvent_OAuth_DelegatedTokenIssuedEventData = z.infer<typeof AuditableEvent_OAuth_DelegatedTokenIssuedEventDataSchema>;
+export type AuditableEvent_OAuth_ConsentGrantedEventData = z.infer<typeof AuditableEvent_OAuth_ConsentGrantedEventDataSchema>;
+export type AuditableEvent_OAuth_ConsentDeniedEventData = z.infer<typeof AuditableEvent_OAuth_ConsentDeniedEventDataSchema>;
+export type AuditableEvent_OAuth_ConsentGrantPersistedEventData = z.infer<typeof AuditableEvent_OAuth_ConsentGrantPersistedEventDataSchema>;
+export type AuditableEvent_OAuth_DynamicClientRegisteredEventData = z.infer<typeof AuditableEvent_OAuth_DynamicClientRegisteredEventDataSchema>;
+export type AuditableEvent_OAuth_CimdClientRefusedEventData = z.infer<typeof AuditableEvent_OAuth_CimdClientRefusedEventDataSchema>;
+export type AuditableEvent_OAuth_TokenRefreshedEventData = z.infer<typeof AuditableEvent_OAuth_TokenRefreshedEventDataSchema>;
+export type AuditableEvent_OAuth_TokenRevokedEventData = z.infer<typeof AuditableEvent_OAuth_TokenRevokedEventDataSchema>;
+export type AuditableEvent_OAuth_RpInitiatedLogoutEventData = z.infer<typeof AuditableEvent_OAuth_RpInitiatedLogoutEventDataSchema>;
+export type AuditableEvent_OAuth_CodeExchangeFailedEventData = z.infer<typeof AuditableEvent_OAuth_CodeExchangeFailedEventDataSchema>;
+export type AuditableEvent_OAuth_ConsentBindingViolationEventData = z.infer<typeof AuditableEvent_OAuth_ConsentBindingViolationEventDataSchema>;
+export type AuditableEvent_User_RefreshTokenReuseDetectedEventData = z.infer<typeof AuditableEvent_User_RefreshTokenReuseDetectedEventDataSchema>;
 //# sourceMappingURL=auditable-events.shared.schema.d.ts.map