@wildo-ai/saas-models 1.1.1 → 1.1.3

package/dist/esm/compliance/audit-trails/auditable-events.shared.schema.d.ts

@@ -5,6 +5,7 @@ import { PlatformAccessGrantAutoApprovalReason, PlatformAccessGrantLifecycleTran
 import { ExecutionContext_ExecutionType } from "../../runtime/execution-context.shared.schemas";
 import { AuthScopeType, SsoConnectionType } from "../../security/authentications/authentication.shared.schemas";
 import { WebhookEndpointProbeOutcome } from "../../notifications/m2m/webhook-config.shared.schemas";
+import { ProviderCredentialDeletionReason, ProviderCredentialResolutionSource } from "../../security/connected-accounts/provider-credentials.shared.schemas";
 export declare enum CoreAuditableEventType {
     USER_LOGIN = "user_login",
     USER_LOGOUT = "user_logout",
@@ -14,6 +15,23 @@ export declare enum CoreAuditableEventType {
     USER_MFA_ENABLED = "user_mfa_enabled",
     USER_MFA_DISABLED = "user_mfa_disabled",
     USER_SESSION_EXPIRED = "user_session_expired",
+    /**
+     * A refresh chain was FORCIBLY RETIRED because the principal exceeded its concurrent-session cap.
+     *
+     * DISTINCT from {@link USER_SESSION_EXPIRED}, and the split is semantic rather than cosmetic. An
+     * expiry is time elapsing; an eviction is a cap DISPLACING a live chain, and the two answer
+     * different reviewer questions — "was this user idle?" versus "is somebody's chain being pushed
+     * out?". The second is the one that matters: the cap exists to bound the blast radius of undetected
+     * token theft, so a burst of evictions for one principal is exactly the signal a reviewer wants.
+     *
+     * Before this, the only trace was a debug log — a security-relevant token-lifecycle act with no
+     * durable record, which is what `CLAUDE.md`'s assurance-by-construction rule asks for by name.
+     *
+     * assurance-control: WILDO.IDENTITY.SESSION_CONCURRENCY_LIMIT — the eviction enforcing the
+     * concurrent-session bound leaves a record naming WHICH chain was retired and when it was issued,
+     * so the first-in-first-out property is reviewable rather than merely implemented.
+     */
+    USER_SESSION_EVICTED = "user_session_evicted",
     MACHINE_AUTH_SUCCESS = "machine_auth_success",
     MACHINE_AUTH_FAILED = "machine_auth_failed",
     MACHINE_ACCESS = "machine_access",
@@ -79,6 +97,16 @@ export declare enum CoreAuditableEventType {
     USER_TOKEN_REFRESHED = "user_token_refreshed",
     ORGANIZATION_SSO_CONFIGURATION_CHANGED = "organization_sso_configuration_changed",
     ORGANIZATION_SIEM_EXPORT_CONFIGURED = "organization_siem_export_configured",
+    ORGANIZATION_PROVIDER_CREDENTIAL_SET = "organization_provider_credential_set",
+    ORGANIZATION_PROVIDER_CREDENTIAL_ROTATED = "organization_provider_credential_rotated",
+    ORGANIZATION_PROVIDER_CREDENTIAL_USED = "organization_provider_credential_used",
+    ORGANIZATION_PROVIDER_CREDENTIAL_DELETED = "organization_provider_credential_deleted",
+    USER_PROVIDER_CREDENTIAL_SET = "user_provider_credential_set",
+    USER_PROVIDER_CREDENTIAL_ROTATED = "user_provider_credential_rotated",
+    USER_PROVIDER_CREDENTIAL_USED = "user_provider_credential_used",
+    USER_PROVIDER_CREDENTIAL_DELETED = "user_provider_credential_deleted",
+    ORGANIZATION_PROVIDER_CONNECTION_GRANTED = "organization_provider_connection_granted",
+    USER_PROVIDER_CONNECTION_GRANTED = "user_provider_connection_granted",
     APPLICATION_AUTH_POLICY_CHANGED = "application_auth_policy_changed",
     WEBHOOK_ENDPOINT_TEST_DISPATCHED = "webhook_endpoint_test_dispatched",
     SCIM_TOKEN_CREATED = "scim_token_created",
@@ -114,6 +142,7 @@ export declare enum CoreAuditableEventType {
     USER_PASSKEY_AUTHENTICATION_SUCCESS = "user_passkey_authentication_success",
     USER_PASSKEY_AUTHENTICATION_FAILURE = "user_passkey_authentication_failure",
     USER_PASSKEY_REMOVED = "user_passkey_removed",
+    USER_PASSKEY_CLONE_SUSPECTED = "user_passkey_clone_suspected",
     USER_MAGIC_LINK_SENT = "user_magic_link_sent",
     USER_MAGIC_LINK_VERIFIED = "user_magic_link_verified",
     USER_MAGIC_LINK_FAILED = "user_magic_link_failed",
@@ -132,6 +161,47 @@ export declare enum CoreAuditableEventType {
     SAML_METADATA_PARSED = "saml_metadata_parsed",
     SAML_EMAIL_CHANGED = "saml_email_changed",
     OAUTH2_PROVIDER_BLOCKED = "oauth2_provider_blocked",
+    /**
+     * File upload grant lifecycle (issue #312) — the first FILE-domain audit events. A grant is a
+     * single-use bearer credential that lets whoever holds it perform ONE upload into ONE resource file
+     * field with the MINTER's authority; minting it is a delegated-authorization act and is audited as
+     * one. `ISSUED` at mint (MEDIUM: a credential left the trust boundary), `REDEEMED` when the one
+     * upload landed and the FILES row exists, `REVOKED` when the minter or an administrator cancelled
+     * it. The event data carries the grant's ID — never its value.
+     */
+    FILE_UPLOAD_GRANT_ISSUED = "file_upload_grant_issued",
+    FILE_UPLOAD_GRANT_REDEEMED = "file_upload_grant_redeemed",
+    FILE_UPLOAD_GRANT_REVOKED = "file_upload_grant_revoked",
+    /**
+     * A scanner concluded that an uploaded file is INFECTED, and the file was quarantined.
+     *
+     * Until this existed, the scanner emitted no audit row of any kind: an infection produced a
+     * `SCANNING → INFECTED → QUARANTINED` status transition on the file record and nothing else, so
+     * the only way to learn that malware had reached the application's storage was to NOTICE a row
+     * sitting at `QUARANTINED` — a poll, not a signal. Malware arriving is one of the few things an
+     * operator wants to be alerted on, and one of the few a customer security questionnaire asks about
+     * by name.
+     *
+     * `CRITICAL`, on the same argument as `USER_PASSKEY_CLONE_SUSPECTED`: a conclusion the security
+     * mechanism reached about a real threat, not a routine outcome.
+     *
+     * assurance-control: WILDO.SECURITY.INGESTED_CONTENT_INSPECTION — a detected infection is
+     * attributable and monitorable, not only visible as a row status. This event is the RECORD half of
+     * that objective; the mechanism half is the fail-closed scan gate itself.
+     */
+    FILE_MALWARE_DETECTED = "file_malware_detected",
+    /**
+     * A scan could NOT be completed — the scanner was unreachable, or the pipeline errored.
+     *
+     * Its own event rather than a lower severity on the one above, because the operational stories are
+     * opposite: an infection means the control WORKED, a failure means it DID NOT RUN. From outside
+     * they are indistinguishable today — the file is non-downloadable either way — which is precisely
+     * why the trail has to tell them apart. A run of these means files are arriving unscanned.
+     *
+     * `WARNING`, not `CRITICAL`: nothing was found and nothing was exposed, because the file fails
+     * closed to `FAILED` and stays undownloadable. What is wrong is the control's availability.
+     */
+    FILE_MALWARE_SCAN_FAILED = "file_malware_scan_failed",
     ONE_OFF_TOKEN_CREATED = "one_off_token_created",
     ONE_OFF_TOKEN_EXCHANGED = "one_off_token_exchanged",
     /** revocation-B1: a super-admin cancelled an un-exchanged one-off (impersonation) session token. */
@@ -166,6 +236,13 @@ export declare enum CoreAuditableEventType {
      * crossing is NAMED in the trail". Before this event, an operator could enumerate every user's
      * email across every tenant and leave nothing behind.
      *
+     * ⚠️ "Structurally unavailable" above is exact about the EXISTING grant mechanism — it needs a
+     * target tenant and a collection call names none — and must not be read as "prevention is
+     * impossible". An application-wide grant kind is buildable; what blocks it is the question of who
+     * approves an elevation that names no tenant. See
+     * `ScopeRootConfinementDisposition.UNCONFINED_APPLICATION_TIER_DIRECTORY`, which owns that
+     * reasoning beside the declaration that makes this read unconfined.
+     *
      * INFO, not WARNING: unlike its cross-tenant sibling this is an ordinary, expected administrative
      * read on a surface built for it. The subset worth escalating is selected by a SIEM rule on
      * `resourceType` + `returnedCount`, both of which ride the payload.
@@ -263,6 +340,34 @@ export declare enum AuditEventSeverity {
     WARNING = "warning",
     CRITICAL = "critical"
 }
+/**
+ * What each audit category and severity MEANS to whoever reads the trail.
+ *
+ * The words were authored, correctly, in the technical-documentation catalog that renders the
+ * audit-trail page — and lived only there, so the same vocabularies reached every other surface as
+ * bare tokens. Moved here, beside the enums, because a vocabulary's words belong with the
+ * vocabulary: the catalog now imports them, the schemas describe their own fields from them, and
+ * there is one account of what `data_access` selects rather than two that can disagree.
+ *
+ * `name` is what a reader is shown; `meaning` is what selecting it actually gets them. Exhaustive by
+ * type, so a sixth category cannot ship as a bare value.
+ */
+export declare const AUDIT_EVENT_CATEGORY_MEANINGS: Readonly<Record<AuditEventCategory, {
+    readonly name: string;
+    readonly meaning: string;
+}>>;
+export declare const AUDIT_EVENT_SEVERITY_MEANINGS: Readonly<Record<AuditEventSeverity, {
+    readonly name: string;
+    readonly meaning: string;
+}>>;
+/**
+ * A `Values:` legend in the shape the generated API reference already uses, so a field described
+ * here reads exactly like one described from a resource specification.
+ */
+export declare function describeAuditVocabulary(lead: string, meanings: Readonly<Record<string, {
+    readonly name: string;
+    readonly meaning: string;
+}>>): string;
 /**
  * Why the authorizer refused an operation. A CLOSED vocabulary — the authorizer resolves exactly
  * one of these per refusal, and a SOC dashboard groups by it.
@@ -502,6 +607,31 @@ export declare const AuditableEvent_User_SessionExpiredEventDataSchema: z.ZodObj
     sessionDuration: z.ZodNumber;
     lastActivity: z.ZodDate;
 }, z.core.$strip>;
+/**
+ * One refresh chain retired to keep a principal within its concurrent-session cap.
+ *
+ * `evictedIssuedAt` is the load-bearing field and the reason this event is worth its own type: the
+ * cap's security property is that the OLDEST chain goes, so a record that named only the victim
+ * would prove a session ended without proving the right one did. Carrying the issuance instant makes
+ * the first-in-first-out claim checkable from the trail alone.
+ *
+ * `configuredMaximum` and `retainedCount` are here so a reviewer can tell a correctly-enforced cap
+ * from a misconfigured one without reading the config as it stood at that moment.
+ *
+ * NO token material. The JTI is an opaque identifier, never the token — the trail must not become a
+ * place where a credential can be recovered.
+ *
+ * assurance-control: WILDO.IDENTITY.SESSION_CONCURRENCY_LIMIT — the bound's enforcement is evidenced,
+ * including WHICH chain was retired, so the ordering can be reviewed and not merely trusted.
+ */
+export declare const AuditableEvent_User_SessionEvictedEventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.USER_SESSION_EVICTED>;
+    userId: z.ZodString;
+    evictedJti: z.ZodString;
+    evictedIssuedAt: z.ZodOptional<z.ZodDate>;
+    configuredMaximum: z.ZodNumber;
+    retainedCount: z.ZodNumber;
+}, z.core.$strip>;
 /**
  * A `USERS` row was hard-deleted.
  *
@@ -576,14 +706,46 @@ export declare const AuditableEvent_Application_SuperAdminFloorBreachedEventData
  * recorded rather than assumed zero: the floor's minimum is configurable, and an event that hard-codes
  * the consequence cannot be re-read against a changed policy.
  */
+/**
+ * HOW a tenant's owner-floor breach came to be known.
+ *
+ * The two answers mean genuinely different things to whoever reads the record, and a reader cannot
+ * tell them apart from the rest of the payload — which is why this is a named member rather than an
+ * inference from whether the action fields happen to be present.
+ *
+ * The event type stays SINGLE across both, deliberately. The fact recorded is "this tenant has no
+ * administratively usable owner", and that is the query an operator needs to be one query: splitting
+ * it in two would mean a breach is missed by whichever half somebody alerts on.
+ */
+export declare enum AdministrativeContinuityBreachDetection {
+    /**
+     * A guarded lifecycle write was ALLOWED through and stranded the tenant.
+     *
+     * The permissive branch is deliberate — refusing a suspension would mean an operator cannot lock
+     * out a compromised owner without first transferring ownership using the tenant the attacker
+     * controls — so this record IS the control that makes the trade acceptable. The action fields are
+     * populated here, because there is an action to name.
+     */
+    ALLOWED_LIFECYCLE_ACTION = "allowed_lifecycle_action",
+    /**
+     * The boot report found the tenant ALREADY stranded, by a route no guard ever saw: a direct
+     * database edit, a restore from a backup taken mid-erasure, a seed that authored no owner, or a
+     * role-table change that redefined which roles confer ownership.
+     *
+     * There is no action to name, so the action fields are absent rather than filled with placeholders
+     * — the same reading `logApplicationSuperAdminFloorBreached` takes for its missing `userId`.
+     */
+    BOOT_REPORT = "boot_report"
+}
 export declare const AuditableEvent_Organization_OwnerFloorBreachedEventDataSchema: z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_OWNER_FLOOR_BREACHED>;
     organizationId: z.ZodString;
-    reducedMemberIds: z.ZodArray<z.ZodString>;
+    detectedBy: z.ZodEnum<typeof AdministrativeContinuityBreachDetection>;
     remainingUsableOwners: z.ZodNumber;
-    operationIdentifier: z.ZodString;
-    subjectUserId: z.ZodString;
-    subjectNextStatus: z.ZodString;
+    reducedMemberIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    operationIdentifier: z.ZodOptional<z.ZodString>;
+    subjectUserId: z.ZodOptional<z.ZodString>;
+    subjectNextStatus: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export declare const AuditableEvent_OrganizationMember_InvitedEventDataSchema: z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_MEMBER_INVITED>;
@@ -1056,6 +1218,207 @@ export declare const AuditableEvent_Organization_SIEMExportConfiguredEventDataSc
     webhookUrlDomain: z.ZodOptional<z.ZodString>;
     eventFormatConfigured: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
+/**
+ * A tenant granted this application authority to act as it toward a third party.
+ *
+ * assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — organization authorizes delegated
+ * access to a named third party.
+ */
+export declare const AuditableEvent_OrganizationProviderCredential_SetEventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_SET>;
+    organizationId: z.ZodString;
+    providerRef: z.ZodString;
+    secretSlug: z.ZodString;
+    setBy: z.ZodOptional<z.ZodString>;
+    credentialId: z.ZodString;
+}, z.core.$strip>;
+/**
+ * The stored VALUE changed for a credential that already existed.
+ *
+ * Separate from `_SET` because rotation is the response to a suspected compromise, and "was this
+ * rotated after the incident?" must be answerable without reading every configuration edit.
+ *
+ * assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — the delegated authority's secret is
+ * replaced.
+ */
+export declare const AuditableEvent_OrganizationProviderCredential_RotatedEventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_ROTATED>;
+    organizationId: z.ZodString;
+    providerRef: z.ZodString;
+    secretSlug: z.ZodString;
+    rotatedBy: z.ZodOptional<z.ZodString>;
+    credentialId: z.ZodString;
+    previousSecretSetAt: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * The credential was RESOLVED for an outbound call — the application acted as the tenant.
+ *
+ * The highest-volume of the four and the one that makes the other three worth having: without a
+ * use event, a leaked credential's exploitation is invisible and only its configuration is
+ * recorded. `resolvedFrom` distinguishes a tenant's own credential from the deployment-wide
+ * environment fallback, which is precisely the distinction this whole resource exists to make
+ * visible — a tenant silently acting as the shared principal is the defect, and here it is a
+ * value in a field rather than something nobody can see.
+ *
+ * assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — delegated authority is exercised.
+ */
+export declare const AuditableEvent_OrganizationProviderCredential_UsedEventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_USED>;
+    organizationId: z.ZodString;
+    providerRef: z.ZodString;
+    secretSlug: z.ZodString;
+    resolvedFrom: z.ZodEnum<typeof ProviderCredentialResolutionSource>;
+    credentialId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * The grant ended — by the tenant removing it, or by the tenant itself being purged.
+ *
+ * `reason` separates the two, because "the credential is gone" means different things to an
+ * incident reviewer depending on whether a human revoked it or a cascade removed it.
+ *
+ * assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — evidence that delegated authority
+ * was withdrawn.
+ */
+export declare const AuditableEvent_OrganizationProviderCredential_DeletedEventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_DELETED>;
+    organizationId: z.ZodString;
+    providerRef: z.ZodString;
+    secretSlug: z.ZodString;
+    deletedBy: z.ZodOptional<z.ZodString>;
+    credentialId: z.ZodString;
+    reason: z.ZodEnum<typeof ProviderCredentialDeletionReason>;
+}, z.core.$strip>;
+/**
+ * A PERSON connected their own account at a third party to this application.
+ *
+ * The organization's four events say "this tenant authorized the application". These four say "this
+ * individual did", and the difference is not cosmetic: the vendor will attribute every resulting act
+ * to that person's account, so the trail that answers "who authorized this" has to name them.
+ *
+ * `userId` is the subject, not the actor, and the two are the same here BY CONSTRUCTION — the
+ * resource admits no administrative variant, so nobody but the holder can write one of these rows.
+ * That is why there is no `setBy`: an organization credential needs one because several
+ * administrators can write the tenant's row, and a person's own credential has exactly one possible
+ * author. A `setBy` that could only ever repeat `userId` would invite a future reader to believe the
+ * two can differ.
+ *
+ * assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — a user authorizes third-party
+ * delegated access.
+ */
+export declare const AuditableEvent_UserProviderCredential_SetEventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_SET>;
+    userId: z.ZodString;
+    providerRef: z.ZodString;
+    secretSlug: z.ZodString;
+    credentialId: z.ZodString;
+}, z.core.$strip>;
+/**
+ * A PERSON completed a consent ceremony at a vendor and this application now holds their grant.
+ *
+ * The subject and the actor are the same by construction — the resource admits no administrative
+ * variant, and the connect leg refuses any owner but the caller — so there is no `grantedBy`.
+ *
+ * `grantedScopes` is what the VENDOR said it issued, not what was asked for. The two differ often
+ * enough to matter: a vendor may narrow a request against what the account is permitted, and the
+ * answer to "what could this application actually do as them" is the granted set. Optional because
+ * several vendors return no scope at all on a token response, and an empty array would assert
+ * something stronger than silence.
+ *
+ * assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — a user authorizes third-party
+ * delegated access, and the authorization's extent is recorded with it.
+ */
+export declare const AuditableEvent_UserProviderConnection_GrantedEventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.USER_PROVIDER_CONNECTION_GRANTED>;
+    userId: z.ZodString;
+    providerRef: z.ZodString;
+    secretSlug: z.ZodString;
+    credentialId: z.ZodString;
+    grantedScopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    accountRef: z.ZodOptional<z.ZodString>;
+    replacedExistingConnection: z.ZodBoolean;
+}, z.core.$strip>;
+/**
+ * An ORGANIZATION's delegated authorization toward a vendor was granted.
+ *
+ * Mirrors the person's event and is deliberately not the same event with a nullable user: the
+ * subject is a tenant, the SIEM routing is the tenant's, and the data-protection reading differs —
+ * a tenant's shared integration is not anybody's personal connection.
+ *
+ * `grantedByUserId` exists here and not on the user's, for the reason the `_SET` pair already
+ * records: several administrators can authorize on a tenant's behalf, so WHO did is a real question.
+ *
+ * assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — an organization authorizes this
+ * application to act as it toward a named third party.
+ */
+export declare const AuditableEvent_OrganizationProviderConnection_GrantedEventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_PROVIDER_CONNECTION_GRANTED>;
+    organizationId: z.ZodString;
+    providerRef: z.ZodString;
+    secretSlug: z.ZodString;
+    credentialId: z.ZodString;
+    grantedByUserId: z.ZodOptional<z.ZodString>;
+    grantedScopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    accountRef: z.ZodOptional<z.ZodString>;
+    replacedExistingConnection: z.ZodBoolean;
+}, z.core.$strip>;
+/**
+ * The stored VALUE changed for a person's credential that already existed.
+ *
+ * Separate from `_SET` for the organization's reason — rotation answers "was this replaced after the
+ * incident?" — and for one that is specific to a person: a credential someone rotates on their own
+ * initiative is often the first evidence that they believe their vendor account was compromised.
+ *
+ * assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — the delegated authority's secret is
+ * replaced.
+ */
+export declare const AuditableEvent_UserProviderCredential_RotatedEventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_ROTATED>;
+    userId: z.ZodString;
+    providerRef: z.ZodString;
+    secretSlug: z.ZodString;
+    credentialId: z.ZodString;
+    previousSecretSetAt: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * The credential was RESOLVED for an outbound call — the application acted as that person.
+ *
+ * `resolvedFrom` is present for symmetry with the organization event but carries a narrower range:
+ * a person's credential has NO fallback, because substituting the deployment's shared principal for
+ * someone's own account would attribute the act to the wrong party at the vendor — the very
+ * substitution the whole scope triangle exists to forbid. So this field reads
+ * `USER_CREDENTIAL` on every event, and a reviewer seeing anything else is looking at a defect.
+ *
+ * assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — delegated authority is exercised.
+ */
+export declare const AuditableEvent_UserProviderCredential_UsedEventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_USED>;
+    userId: z.ZodString;
+    providerRef: z.ZodString;
+    secretSlug: z.ZodString;
+    resolvedFrom: z.ZodEnum<typeof ProviderCredentialResolutionSource>;
+    credentialId: z.ZodString;
+}, z.core.$strip>;
+/**
+ * The person's grant ended — by them removing it, or by their own erasure.
+ *
+ * `reason` matters more here than on the organization sibling. A credential removed by a cascade
+ * from a subject-erasure request is EVIDENCE that the erasure reached this store, and it is the
+ * evidence an operator produces when asked whether a person's third-party keys were destroyed. The
+ * row itself is gone by then, so the event is all that remains.
+ *
+ * assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — evidence that delegated authority
+ * was withdrawn.
+ * assurance-control: WILDO.PRIVACY.ERASURE — evidence that erasure destroyed the subject's
+ * third-party credentials.
+ */
+export declare const AuditableEvent_UserProviderCredential_DeletedEventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_DELETED>;
+    userId: z.ZodString;
+    providerRef: z.ZodString;
+    secretSlug: z.ZodString;
+    credentialId: z.ZodString;
+    reason: z.ZodEnum<typeof ProviderCredentialDeletionReason>;
+}, z.core.$strip>;
 /**
  * One `webhookConfig.testEndpoint` attempt — an admin causing the platform to open an
  * outbound connection to an operator-supplied URL.
@@ -1224,6 +1587,82 @@ export declare const AuditableEvent_User_PasskeyAuthFailureEventDataSchema: z.Zo
     userAgent: z.ZodString;
     sessionId: z.ZodString;
 }, z.core.$strip>;
+/**
+ * A passkey assertion whose SIGNATURE VERIFIED and whose signature counter did not advance.
+ *
+ * This is the WebAuthn cloned-authenticator signal (W3C WebAuthn L3 §6.1.1: "The signature
+ * counter's purpose is to aid Relying Parties in detecting cloned authenticators"). It is emitted
+ * on the spec's own predicate — either counter non-zero AND the received value not greater than
+ * the stored one — so a credential that reports 0 permanently, which every synced passkey does,
+ * compares 0-against-0 and never reaches here.
+ *
+ * spec-cite: W3C Web Authentication Level 3, §6.1.1 Signature Counter Considerations
+ * (https://www.w3.org/TR/webauthn-3/#sctn-sign-counter). The spec declines to mandate an outcome
+ * (§7.2 step 22: "whether the Relying Party ... fails the authentication ceremony or not, is
+ * Relying Party-specific"); Wildo refuses, matching what every major implementation does.
+ *
+ * SEPARATE from `USER_PASSKEY_AUTHENTICATION_FAILURE` deliberately. A wrong credential, an absent
+ * challenge and a bad signature are routine noise; this one means a private key may exist in two
+ * places. Recorded as its own type at CRITICAL so it is alertable rather than buried among ordinary
+ * failed logins — which is exactly where it lived until 2026-09-08.
+ *
+ * The device-type, backup and AAGUID fields are carried for TRIAGE, never for a decision: nothing
+ * branches on them. A synced credential that once reported a non-zero counter and then regresses is
+ * still a signal, and exempting by device type would silently disable clone detection for the
+ * growing majority of credentials.
+ */
+/**
+ * One file that a scanner concluded is infected (#506).
+ *
+ * `threatName` is the scanner's own signature or rule name (`Eicar-Test-Signature`, a YARA rule id).
+ * It is carried because it is the first thing a responder needs and it names a THREAT, not a person
+ * — unlike a file name, which is user-supplied content and is deliberately absent: audit rows are
+ * replicated to the organisation's SIEM and to the immutable store, and an uploaded file's name
+ * routinely carries personal data ("Invoice - Jane Doe.pdf"). The file id resolves to the row for
+ * anyone authorised to look.
+ */
+export declare const AuditableEvent_File_MalwareDetectedEventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.FILE_MALWARE_DETECTED>;
+    fileId: z.ZodString;
+    scannerRef: z.ZodString;
+    threatName: z.ZodOptional<z.ZodString>;
+    resourceType: z.ZodOptional<z.ZodString>;
+    resourceId: z.ZodOptional<z.ZodString>;
+    organizationId: z.ZodOptional<z.ZodString>;
+    fileStatus: z.ZodString;
+}, z.core.$strip>;
+/**
+ * One scan that could not be completed (#506).
+ *
+ * Distinct from a detection: the control did not run. `failureReason` is TRUNCATED because a scanner
+ * error routinely embeds a host, a socket path or a temporary file path, and this row reaches the
+ * organisation's SIEM.
+ */
+export declare const AuditableEvent_File_MalwareScanFailedEventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.FILE_MALWARE_SCAN_FAILED>;
+    fileId: z.ZodString;
+    scannerRef: z.ZodString;
+    failureReason: z.ZodOptional<z.ZodString>;
+    resourceType: z.ZodOptional<z.ZodString>;
+    resourceId: z.ZodOptional<z.ZodString>;
+    organizationId: z.ZodOptional<z.ZodString>;
+    fileStatus: z.ZodString;
+}, z.core.$strip>;
+export type AuditableEvent_File_MalwareDetectedEventData = z.infer<typeof AuditableEvent_File_MalwareDetectedEventDataSchema>;
+export type AuditableEvent_File_MalwareScanFailedEventData = z.infer<typeof AuditableEvent_File_MalwareScanFailedEventDataSchema>;
+export declare const AuditableEvent_User_PasskeyCloneSuspectedEventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.USER_PASSKEY_CLONE_SUSPECTED>;
+    userId: z.ZodString;
+    credentialId: z.ZodString;
+    storedCounter: z.ZodNumber;
+    receivedCounter: z.ZodNumber;
+    credentialDeviceType: z.ZodString;
+    credentialBackedUp: z.ZodBoolean;
+    aaguid: z.ZodOptional<z.ZodString>;
+    ceremony: z.ZodString;
+    ipAddress: z.ZodString;
+    userAgent: z.ZodString;
+}, z.core.$strip>;
 export declare const AuditableEvent_User_PasskeyRemovedEventDataSchema: z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_PASSKEY_REMOVED>;
     userId: z.ZodString;
@@ -1306,11 +1745,23 @@ export declare const AuditableEvent_OAuth2ProviderBlockedEventDataSchema: z.ZodO
     userAgent: z.ZodString;
 }, z.core.$strip>;
 export type AuditableEvent_OAuth2ProviderBlockedEventData = z.infer<typeof AuditableEvent_OAuth2ProviderBlockedEventDataSchema>;
+/**
+ * A named break-glass account signed in past its tenant's own SSO requirement (#423).
+ *
+ * `organizationId` was REQUIRED here and is now one of two scopes, because `emergencyAccess` lives
+ * on the POLYMORPHIC SSO config: an application-scope policy carries break-glass accounts for the
+ * application itself, and requiring an organization id would have made the one event that matters
+ * unemittable for exactly that case — a privileged sign-in with no record, which is the opposite of
+ * what this event is for. The exactly-one-scope refinement follows the OAuth2-provider-blocked
+ * event above rather than inventing a second shape.
+ */
 export declare const AuditableEvent_EmergencyAccess_UsedEventDataSchema: z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.EMERGENCY_ACCESS_USED>;
     userId: z.ZodString;
     email: z.ZodEmail;
-    organizationId: z.ZodString;
+    scopeType: z.ZodEnum<typeof AuthScopeType>;
+    organizationId: z.ZodOptional<z.ZodString>;
+    applicationId: z.ZodOptional<z.ZodString>;
     reason: z.ZodOptional<z.ZodString>;
     ipAddress: z.ZodString;
     userAgent: z.ZodString;
@@ -1468,17 +1919,21 @@ export declare const AuditableEvent_ResourceOperationPerformed_EventDataSchema:
  * `organization-ownership-grant-hostile.e2e.ts` probe F-1a, which deleted a membership row in
  * another tenant and got a 200.
  *
- * This event is the visibility half. It does NOT refuse — refusing is a separate, much larger change
- * with a measured blast radius (see the plan) and is a policy decision in its own right. Emission is
+ * This event is the visibility half, and it is NOT the refusal. The refusal shipped separately and
+ * lives in `authorizeOrganizations`: an undeclared crossing is no longer admitted, and the caller is
+ * answered as not-found so the response cannot be used as an existence oracle. Emission here stays
  * best-effort and never blocks the request: an operator action must not fail because the audit sink
  * is down, and a fail-closed variant would let anyone disable operator support by breaking the sink.
+ * The observation is taken BEFORE the admission decision, on purpose, so a sanctioned crossing is
+ * recorded too.
  *
  * ## Reading the event
  *
  * {@link admissionDeclared} is the field that matters most. `true` means the operation VARIANT
  * declared `admitsCrossTenantPlatformAdministration` — an intended, reviewed crossing such as
- * `organizationMembers.grantOwnership`. `false` means the reach came from the structural gap above:
- * nobody declared it, no spec documents it, and it is the population to watch.
+ * `organizationMembers.grantOwnership`, which additionally requires a usable platform access grant.
+ * `false` now means an ATTEMPTED undeclared crossing, which was refused: still the population to
+ * watch, because it is reach nobody declared and no specification describes.
  *
  * assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION — platform-tier access to a tenant the
  * principal does not belong to.
@@ -1573,18 +2028,20 @@ export declare const AuditableEvent_ResourceOperationDenied_EventDataSchema: z.Z
  * that scrubbed data, and its two defining properties (vs `SYSTEM_CONTEXT_READ`, which names only the
  * RUNTIME that acted, never a human) are:
  *
- * 1. **Human attribution** — `accessingUserId` names the actual super-admin / `COMPLIANCE_AUDITOR`
- *    who exercised the see-through, so a retained-data reveal is never anonymous. Non-empty
- *    (`.trim().min(1)`) — a blank id cannot stand in for a human.
+ * 1. **Human attribution** — `accessingUserId` names the actual human who exercised the see-through,
+ *    so a retained-data reveal is never anonymous. Non-empty (`.trim().min(1)`) — a blank id cannot
+ *    stand in for a human. The gate admits `APP_ADMIN_SUPER_ADMIN` and nothing else; a dedicated
+ *    auditor role does not exist yet, and adding one is a purely additive change to that gate.
  * 2. **A required reason** — `reason` is the mandatory justification for revealing scrubbed PII.
  *    Non-empty (`.trim().min(1)`): a blank OR whitespace-only reason fails validation, so the audit
  *    trail cannot record a reveal without a real "why". The see-through primitives ALSO fail-closed on
  *    blank attribution before the read (the schema `.min(1)` is the contract; the primitive guard is
  *    the enforcement point, since the audit store persists `eventData` as an unparsed record).
  *
- * Strictly read-only (the see-through primitive never mutates). Emitted by the see-through read
- * primitive (`readRetainedAsSystem` / `listRetainedAsSystem`) — wired in a later phase; this is the
- * contract only.
+ * Strictly read-only (the see-through primitive never mutates). Emitted TODAY by both see-through
+ * read primitives, `readRetainedAsSystem` and `listRetainedAsSystem`: each calls
+ * `logRetainedDataAccess` after its gates pass, so this is a live event, not a contract awaiting a
+ * producer.
  */
 export declare const AuditableEvent_RetainedDataAccess_EventDataSchema: z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.RETAINED_DATA_ACCESS>;
@@ -2032,11 +2489,12 @@ export declare const AuditableEvent_TypedDataSchema: z.ZodDiscriminatedUnion<[z.
 }, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_OWNER_FLOOR_BREACHED>;
     organizationId: z.ZodString;
-    reducedMemberIds: z.ZodArray<z.ZodString>;
+    detectedBy: z.ZodEnum<typeof AdministrativeContinuityBreachDetection>;
     remainingUsableOwners: z.ZodNumber;
-    operationIdentifier: z.ZodString;
-    subjectUserId: z.ZodString;
-    subjectNextStatus: z.ZodString;
+    reducedMemberIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    operationIdentifier: z.ZodOptional<z.ZodString>;
+    subjectUserId: z.ZodOptional<z.ZodString>;
+    subjectNextStatus: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_MEMBER_INVITED>;
     organizationId: z.ZodString;
@@ -2256,6 +2714,36 @@ export declare const AuditableEvent_TypedDataSchema: z.ZodDiscriminatedUnion<[z.
     changeType: z.ZodEnum<typeof SiemExportChangeType>;
     webhookUrlDomain: z.ZodOptional<z.ZodString>;
     eventFormatConfigured: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_SET>;
+    organizationId: z.ZodString;
+    providerRef: z.ZodString;
+    secretSlug: z.ZodString;
+    setBy: z.ZodOptional<z.ZodString>;
+    credentialId: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_ROTATED>;
+    organizationId: z.ZodString;
+    providerRef: z.ZodString;
+    secretSlug: z.ZodString;
+    rotatedBy: z.ZodOptional<z.ZodString>;
+    credentialId: z.ZodString;
+    previousSecretSetAt: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_USED>;
+    organizationId: z.ZodString;
+    providerRef: z.ZodString;
+    secretSlug: z.ZodString;
+    resolvedFrom: z.ZodEnum<typeof ProviderCredentialResolutionSource>;
+    credentialId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_DELETED>;
+    organizationId: z.ZodString;
+    providerRef: z.ZodString;
+    secretSlug: z.ZodString;
+    deletedBy: z.ZodOptional<z.ZodString>;
+    credentialId: z.ZodString;
+    reason: z.ZodEnum<typeof ProviderCredentialDeletionReason>;
 }, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.APPLICATION_AUTH_POLICY_CHANGED>;
     applicationId: z.ZodString;
@@ -2395,6 +2883,18 @@ export declare const AuditableEvent_TypedDataSchema: z.ZodDiscriminatedUnion<[z.
     credentialName: z.ZodString;
     ipAddress: z.ZodString;
     userAgent: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.USER_PASSKEY_CLONE_SUSPECTED>;
+    userId: z.ZodString;
+    credentialId: z.ZodString;
+    storedCounter: z.ZodNumber;
+    receivedCounter: z.ZodNumber;
+    credentialDeviceType: z.ZodString;
+    credentialBackedUp: z.ZodBoolean;
+    aaguid: z.ZodOptional<z.ZodString>;
+    ceremony: z.ZodString;
+    ipAddress: z.ZodString;
+    userAgent: z.ZodString;
 }, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_MAGIC_LINK_SENT>;
     email: z.ZodString;
@@ -2462,7 +2962,9 @@ export declare const AuditableEvent_TypedDataSchema: z.ZodDiscriminatedUnion<[z.
     eventType: z.ZodLiteral<CoreAuditableEventType.EMERGENCY_ACCESS_USED>;
     userId: z.ZodString;
     email: z.ZodEmail;
-    organizationId: z.ZodString;
+    scopeType: z.ZodEnum<typeof AuthScopeType>;
+    organizationId: z.ZodOptional<z.ZodString>;
+    applicationId: z.ZodOptional<z.ZodString>;
     reason: z.ZodOptional<z.ZodString>;
     ipAddress: z.ZodString;
     userAgent: z.ZodString;
@@ -2577,6 +3079,13 @@ export declare const AuditableEvent_TypedDataSchema: z.ZodDiscriminatedUnion<[z.
     rowCount: z.ZodNumber;
     filterFieldNames: z.ZodArray<z.ZodString>;
     organizationId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.USER_SESSION_EVICTED>;
+    userId: z.ZodString;
+    evictedJti: z.ZodString;
+    evictedIssuedAt: z.ZodOptional<z.ZodDate>;
+    configuredMaximum: z.ZodNumber;
+    retainedCount: z.ZodNumber;
 }, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.HTTP_API_READ_THROUGH_ACCESS>;
     resourceType: z.ZodString;
@@ -2729,6 +3238,16 @@ export type AuditableEvent_User_SSOEnforcementBlockedEventData = z.infer<typeof
 export type AuditableEvent_User_TokenRefreshedEventData = z.infer<typeof AuditableEvent_User_TokenRefreshedEventDataSchema>;
 export type AuditableEvent_Organization_SSOConfigurationChangedEventData = z.infer<typeof AuditableEvent_Organization_SSOConfigurationChangedEventDataSchema>;
 export type AuditableEvent_Organization_SIEMExportConfiguredEventData = z.infer<typeof AuditableEvent_Organization_SIEMExportConfiguredEventDataSchema>;
+export type AuditableEvent_OrganizationProviderCredential_SetEventData = z.infer<typeof AuditableEvent_OrganizationProviderCredential_SetEventDataSchema>;
+export type AuditableEvent_OrganizationProviderCredential_RotatedEventData = z.infer<typeof AuditableEvent_OrganizationProviderCredential_RotatedEventDataSchema>;
+export type AuditableEvent_OrganizationProviderCredential_UsedEventData = z.infer<typeof AuditableEvent_OrganizationProviderCredential_UsedEventDataSchema>;
+export type AuditableEvent_OrganizationProviderCredential_DeletedEventData = z.infer<typeof AuditableEvent_OrganizationProviderCredential_DeletedEventDataSchema>;
+export type AuditableEvent_UserProviderCredential_SetEventData = z.infer<typeof AuditableEvent_UserProviderCredential_SetEventDataSchema>;
+export type AuditableEvent_UserProviderCredential_RotatedEventData = z.infer<typeof AuditableEvent_UserProviderCredential_RotatedEventDataSchema>;
+export type AuditableEvent_UserProviderCredential_UsedEventData = z.infer<typeof AuditableEvent_UserProviderCredential_UsedEventDataSchema>;
+export type AuditableEvent_UserProviderCredential_DeletedEventData = z.infer<typeof AuditableEvent_UserProviderCredential_DeletedEventDataSchema>;
+export type AuditableEvent_UserProviderConnection_GrantedEventData = z.infer<typeof AuditableEvent_UserProviderConnection_GrantedEventDataSchema>;
+export type AuditableEvent_OrganizationProviderConnection_GrantedEventData = z.infer<typeof AuditableEvent_OrganizationProviderConnection_GrantedEventDataSchema>;
 export type ApplicationAuthPolicySnapshot = z.infer<typeof ApplicationAuthPolicySnapshotSchema>;
 export type AuditableEvent_ApplicationAuthPolicyChanged_EventData = z.infer<typeof AuditableEvent_ApplicationAuthPolicyChanged_EventDataSchema>;
 export type AuditableEvent_Webhook_EndpointTestDispatchedEventData = z.infer<typeof AuditableEvent_Webhook_EndpointTestDispatchedEventDataSchema>;
@@ -2749,6 +3268,7 @@ export type AuditableEvent_User_MFAEmailOTPSentEventData = z.infer<typeof Audita
 export type AuditableEvent_User_PasskeyRegisteredEventData = z.infer<typeof AuditableEvent_User_PasskeyRegisteredEventDataSchema>;
 export type AuditableEvent_User_PasskeyAuthSuccessEventData = z.infer<typeof AuditableEvent_User_PasskeyAuthSuccessEventDataSchema>;
 export type AuditableEvent_User_PasskeyAuthFailureEventData = z.infer<typeof AuditableEvent_User_PasskeyAuthFailureEventDataSchema>;
+export type AuditableEvent_User_PasskeyCloneSuspectedEventData = z.infer<typeof AuditableEvent_User_PasskeyCloneSuspectedEventDataSchema>;
 export type AuditableEvent_User_PasskeyRemovedEventData = z.infer<typeof AuditableEvent_User_PasskeyRemovedEventDataSchema>;
 export type AuditableEvent_User_MagicLinkSentEventData = z.infer<typeof AuditableEvent_User_MagicLinkSentEventDataSchema>;
 export type AuditableEvent_User_MagicLinkVerifiedEventData = z.infer<typeof AuditableEvent_User_MagicLinkVerifiedEventDataSchema>;
@@ -2766,6 +3286,7 @@ export type AuditableEvent_ResourceOperationDenied_EventData = z.infer<typeof Au
 export type AuditableEvent_RetainedDataAccess_EventData = z.infer<typeof AuditableEvent_RetainedDataAccess_EventDataSchema>;
 export type AuditableEvent_SubjectDataExport_EventData = z.infer<typeof AuditableEvent_SubjectDataExport_EventDataSchema>;
 export type AuditableEvent_CollectionDataExport_EventData = z.infer<typeof AuditableEvent_CollectionDataExport_EventDataSchema>;
+export type AuditableEvent_User_SessionEvictedEventData = z.infer<typeof AuditableEvent_User_SessionEvictedEventDataSchema>;
 export type AuditableEvent_HttpApiReadThroughAccess_EventData = z.infer<typeof AuditableEvent_HttpApiReadThroughAccess_EventDataSchema>;
 export type AuditableEvent_HttpApiExternalErasure_EventData = z.infer<typeof AuditableEvent_HttpApiExternalErasure_EventDataSchema>;
 export type AuditableEvent_HttpApiNonErasureAcknowledged_EventData = z.infer<typeof AuditableEvent_HttpApiNonErasureAcknowledged_EventDataSchema>;