@wildo-ai/saas-models 1.1.3 → 1.1.4

package/dist/esm/compliance/audit-trails/auditable-events.shared.schema.js

@@ -2,7 +2,7 @@ import { z } from "zod";
 import { PersonalDataCategory } from "../privacy/personal-data-category.shared.schemas.js";
 import { ResourceOperationRiskLevel, ResourceOperationVariantType } from "../../resources/resources.shared.schemas.js";
 import { CoreResourceOperation } from "../../resources/resources.shared.core.definitions.js";
-import { PlatformAccessGrantAutoApprovalReason, PlatformAccessGrantLifecycleTransition, PlatformAccessGrantStatus, } from "../../security/authorizations/platform-access-grants.shared.schemas.js";
+import { PlatformAccessGrantAutoApprovalReason, PlatformAccessGrantLifecycleTransition, PlatformAccessGrantScope, PlatformAccessGrantStatus, } from "../../security/authorizations/platform-access-grants.shared.schemas.js";
 import { ExecutionContext_ExecutionType } from "../../runtime/execution-context.shared.schemas.js";
 import { AuthScopeType, SsoConnectionType, } from "../../security/authentications/authentication.shared.schemas.js";
 import { WebhookEndpointProbeOutcome } from "../../notifications/m2m/webhook-config.shared.schemas.js";
@@ -306,6 +306,17 @@ export var CoreAuditableEventType;
     CoreAuditableEventType["SAML_EMAIL_CHANGED"] = "saml_email_changed";
     // OAuth2 Provider Restriction Events (Phase G3)
     CoreAuditableEventType["OAUTH2_PROVIDER_BLOCKED"] = "oauth2_provider_blocked";
+    /**
+     * An enterprise OIDC login was refused because the identity provider did not report the
+     * authentication context the connection DEMANDED (issue #444).
+     *
+     * `acr_values` is a REQUEST parameter: the relying party asks, the provider decides, and the ID
+     * token's `acr` claim reports what actually happened. So a refusal here is the only evidence that
+     * a step-up demand was made and not met — without it an operator debugging "why can this person
+     * not sign in" sees an ordinary authentication failure and has nothing to distinguish it from a
+     * wrong password.
+     */
+    CoreAuditableEventType["OIDC_ACR_DEMAND_UNSATISFIED"] = "oidc_acr_demand_unsatisfied";
     // One-Off Session Events (W7.3b)
     /**
      * File upload grant lifecycle (issue #312) — the first FILE-domain audit events. A grant is a
@@ -527,6 +538,82 @@ export var CoreAuditableEventType;
     // USER_LIFECYCLE / CRITICAL: one event per acknowledged resource per erasure, never a standing
     // posture.
     CoreAuditableEventType["HTTP_API_NON_ERASURE_ACKNOWLEDGED"] = "http_api_non_erasure_acknowledged";
+    // The application CALLED a declared operation on a third-party provider — one event per outbound
+    // call, on both the success and the failure path.
+    //
+    // Distinct from the three HTTP_API_* members above, which are the ETL read-through plane: those
+    // record a RESOURCE whose rows live elsewhere being read or erased through a binding. This is the
+    // other door — a custom backend service naming a provider and an operation directly — and the
+    // question it answers is the first question of any provider incident: WHOSE third-party account
+    // did we spend, on whose behalf, and what came back. `connectionOwnerScope`/`connectionOwnerId`
+    // are what the initiator's own ids cannot answer, because one execution may legitimately spend
+    // several tenants' accounts (a user action fanning out to every organization that user belongs to
+    // issues N calls with N owners under ONE initiator).
+    //
+    // Distinct from `*_PROVIDER_CREDENTIAL_USED`, which records that a stored credential was SPENT and
+    // what the vendor thought of it. That one is about the CREDENTIAL's health and is emitted by the
+    // store; this one is about the ACT and is emitted by the executor. A credential incident reads
+    // both, in that order, and folding them would make "which calls did this credential make" a query
+    // nobody can write.
+    //
+    // Classified DATA_ACCESS / INFO for the read-through member's reason — routine, authorized
+    // activity whose value is the queryable trail, not an alarm. The READ/WRITE axis rides
+    // `classification` in the payload and the per-emission `riskLevel`, never the static severity.
+    //
+    // assurance-control: WILDO.AUDIT.ATTRIBUTION — an outbound call made on a user's behalf is
+    // recorded with the real initiating user carried through whichever account it spent.
+    CoreAuditableEventType["PROVIDER_OPERATION_CALL"] = "provider_operation_call";
+    // An AGENT reached an MCP server on somebody's behalf (#491).
+    //
+    // A sibling of `PROVIDER_OPERATION_CALL`, not a case of it, and the split is the same one that
+    // separates that member from `*_PROVIDER_CREDENTIAL_USED`: they identify different acts. A
+    // provider operation is a CATALOGUE operation — it has an `operationId`, a `domain`, an HTTP
+    // method and a declared READ/WRITE classification. An MCP tool has none of those: the tool list is
+    // discovered from the server at turn start, the transport is always a JSON-RPC POST, and nothing
+    // declares in advance what a tool does. Folding them would make "which catalogue operations ran"
+    // a query that returns tools that are not catalogue operations.
+    //
+    // The ATTRIBUTION fields are deliberately identical, so a reviewer asking "what did this person's
+    // delegated credential do at that vendor" writes one shape of query across both.
+    //
+    // Classified DATA_ACCESS / INFO for the same reason as its sibling: routine authorized activity
+    // whose value is the queryable trail rather than an alarm. A refused outbound TARGET is carried on
+    // the same event through `failureKind`, because an attempted egress a guard blocked is exactly
+    // what a reviewer wants beside the calls that succeeded.
+    //
+    // assurance-control: WILDO.AUDIT.ATTRIBUTION — an agent's outbound tool call is recorded with the
+    // real initiating user carried through whichever account it spent.
+    CoreAuditableEventType["MCP_TOOL_CALL"] = "mcp_tool_call";
+    // A human APPROVER changed a proposed tool call's arguments and approved the changed call (#566).
+    //
+    // The strongest act available on the approval plane, and the reason it is its own member rather
+    // than a flag on some broader "approval decided" event: on every other decision the approver
+    // ASSENTS to a call the model authored, and here they AUTHOR one the model never proposed. An
+    // incident reader asking "who wrote the arguments this tool ran with" is asking a different
+    // question from "who let it run", and folding the two would make the first unanswerable by query.
+    //
+    // Emitted ONLY when the executed input differs from the proposed one. An ordinary approval is not
+    // this event and is deliberately not recorded here — the plane has no approval-decision trail at
+    // all yet, which is a separate gap with its own issue; adding half of one under this name would
+    // make `mcp_tool_call`'s mistake in the other direction, an event that answers two questions and
+    // neither well.
+    //
+    // NAMES AND DIGESTS ONLY — never argument values. Identical reasoning to
+    // `RESOURCE_OPERATION_PERFORMED`'s `changedFields` / `fieldEvidence` split: audit rows replicate
+    // to the per-org SIEM and to an immutable ledger that cannot be scrubbed, so copying arbitrary
+    // tool arguments here would manufacture an unerasable duplicate of whatever a person typed, in
+    // direct conflict with GDPR Art. 17. The two digests prove executed ≠ proposed; the key names say
+    // WHICH arguments a person authored. Neither can leak content.
+    //
+    // Classified AUTHORIZATION / WARNING. Authorization because the act IS a human authorization
+    // decision, not a data access. WARNING rather than CRITICAL for the same reading the OAuth grant
+    // rows take: it is notable, dashboard-worthy and worth reviewing, and it is an AUTHORIZED action
+    // taken by an identified person with the pause in front of them — reserving CRITICAL for the rows
+    // that mean something is wrong is what keeps a severity filter usable.
+    //
+    // assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT — the approver who authored the
+    // executed arguments is recorded beside proof that they differed from the proposal.
+    CoreAuditableEventType["AGENT_TOOL_APPROVAL_MODIFIED"] = "agent_tool_approval_modified";
     // ── OAuth2 / OIDC Provider Events (Wildo AS the authorization server) ──
     // Distinct from the `OAUTH2_*` family above, which records Wildo CONSUMING an
     // EXTERNAL social OAuth provider. These record the app-issued OAuth2/OIDC provider
@@ -710,6 +797,22 @@ export var ResourceOperationDenialReason;
      * becoming an existence oracle.
      */
     ResourceOperationDenialReason["SUBJECT_NOT_RESOLVABLE"] = "subject_not_resolvable";
+    /**
+     * The caller holds the ROLE but no usable APPLICATION-WIDE elevation.
+     *
+     * Its own member rather than `INSUFFICIENT_ROLES`, and the distinction is the whole point of the
+     * grant model: the caller IS an administrator and the refusal is about STANDING privilege, not
+     * about authority. Folding it into the roles reason would make the two indistinguishable in the
+     * trail — and a reviewer asking "did zero-standing-privilege actually bite anyone?" would have no
+     * way to count it.
+     *
+     * Distinct from a tenant crossing refused for the same shape of reason: that one is refused inside
+     * `authorizeOrganizations` and surfaces as `SCOPE_MISMATCH`, because there the caller genuinely is
+     * outside the tenant. Here there is no tenant to be outside of.
+     *
+     * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT
+     */
+    ResourceOperationDenialReason["APPLICATION_WIDE_ELEVATION_MISSING"] = "application_wide_elevation_missing";
 })(ResourceOperationDenialReason || (ResourceOperationDenialReason = {}));
 /** SSO configuration change type. */
 export var SsoConfigChangeType;
@@ -1539,7 +1642,22 @@ export const ApplicationAuthPolicySnapshotSchema = z.record(z.string(), z.unknow
  */
 export const AuditableEvent_ApplicationAuthPolicyChanged_EventDataSchema = z.object({
     eventType: z.literal(CoreAuditableEventType.APPLICATION_AUTH_POLICY_CHANGED),
-    applicationId: z.string(),
+    /*
+     * NO `applicationId` HERE — removed 2026-09-09, and the removal is the fix for a real defect.
+     *
+     * The row this payload rides on ALREADY carries `applicationId` as its scope column, injected by
+     * the repository's write-path enrichment from the writer's own execution context. A second copy in
+     * the payload could only ever agree with it or contradict it, and it contradicted it: the boot
+     * emitter had no application id to hand — `appIdentity.applicationId` is merged in for the FRONTEND
+     * projection only — so it passed `appIdentity.appName`, the SLUG, into both. Measured on the
+     * dogfood trail: 2,175 rows carried the correct id and this event's one row carried `wonder-todos`,
+     * which made it reachable through no API, on the door built for exactly that population (#317).
+     *
+     * Dropping the field is what makes the two-copies question unaskable, rather than answering it
+     * again per emitter. Nothing read it: no SIEM projection, no OCSF mapping, no consumer. Old stored
+     * rows keep parsing — `z.object` strips an unknown key rather than refusing it — so the change is
+     * a shrink with no migration.
+     */
     /** Which user types' policies differed from the previously-recorded snapshot. Sorted, non-empty. */
     changedUserTypes: z.array(z.string()),
     /**
@@ -2321,6 +2439,29 @@ export const AuditableEvent_OAuth2ProviderBlockedEventDataSchema = z.object({
         });
     }
 });
+/**
+ * Authentication-context demand unsatisfied (issue #444).
+ *
+ * Carries BOTH sides of the comparison, because either alone is unactionable: `demandedAcrValues`
+ * is what the connection authored, `receivedAcr` is what the provider's ID token reported. The
+ * received value is OPTIONAL and its absence is the distinct, common case — a provider that emits
+ * no `acr` claim at all — which reads very differently from one that answered with a weaker
+ * context, and an operator must be able to tell them apart from the trail alone.
+ *
+ * No email field. The refusal happens before any identity is established or trusted, and recording
+ * an unauthenticated claimant's address as though it were a subject is the kind of quiet personal
+ * data this family avoids; `providerRef` and the two ACR sides are what a reader needs.
+ */
+export const AuditableEvent_OidcAcrDemandUnsatisfiedEventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.OIDC_ACR_DEMAND_UNSATISFIED),
+    providerRef: z.string(),
+    /** The ordered list of acceptable values the connection authored. Never empty — an empty demand is not enforced at all. */
+    demandedAcrValues: z.array(z.string()).min(1),
+    /** What the ID token's `acr` claim reported. ABSENT when the provider emitted no claim. */
+    receivedAcr: z.string().optional(),
+    /** Present when the ID token itself could not be read, which is a different refusal from a mismatched claim. */
+    failureReason: z.string().optional(),
+});
 // Emergency Access Event Data Schema
 /**
  * A named break-glass account signed in past its tenant's own SSO requirement (#423).
@@ -2592,8 +2733,25 @@ export const AuditableEvent_PlatformAccessGrantLifecycle_EventDataSchema = z.obj
     transition: z.enum(PlatformAccessGrantLifecycleTransition),
     /** The grant, so the whole timeline can be reassembled from its rows. */
     grantId: z.string(),
-    /** The tenant that was, or would have been, reached into. */
-    targetOrganizationId: z.string(),
+    /**
+     * WHAT the elevation reaches, and therefore who was entitled to approve it.
+     *
+     * Carried explicitly rather than inferred from the presence of `targetOrganizationId`: a reviewer
+     * asking "was this approved by the party the rules require?" needs the SCOPE, and deriving it from
+     * a field's absence would make a lost or scrubbed value read as an application-wide elevation.
+     *
+     * `TENANT` is the default so every row written before this axis existed keeps its true meaning —
+     * the application-wide grant did not exist then.
+     */
+    grantScope: z.enum(PlatformAccessGrantScope).default(PlatformAccessGrantScope.TENANT),
+    /**
+     * The tenant that was, or would have been, reached into.
+     *
+     * OPTIONAL since the application-wide scope arrived: that grant names no tenant, and writing a
+     * placeholder would be a lie about which customer an operator reached. Absent ⇔
+     * `grantScope === APPLICATION_WIDE`.
+     */
+    targetOrganizationId: z.string().optional(),
     /** The operator who asked. Never the decider — see {@link decidedByUserId}. */
     operatorUserId: z.string(),
     /** Why the operator said they needed access. Recorded on every transition, not only the request. */
@@ -2635,6 +2793,14 @@ export const AuditableEvent_CrossTenantAdministrativeAccess_EventDataSchema = z.
      * and on any crossing admitted before grants were required.
      */
     authorizingGrantId: z.string().optional(),
+    /**
+     * WHICH COLLECTION {@link authorizingGrantId} names.
+     *
+     * A grant id alone is not resolvable: `platformAccessGrants` and `applicationAccessGrants` are two
+     * resources with two collections, and a reviewer handed only an id has to try both. Absent exactly
+     * when `authorizingGrantId` is.
+     */
+    authorizingGrantScope: z.enum(PlatformAccessGrantScope).optional(),
     /**
      * Did the operation variant DECLARE this crossing (`admitsCrossTenantPlatformAdministration`)?
      *
@@ -2683,6 +2849,21 @@ export const AuditableEvent_PlatformDirectoryAccess_EventDataSchema = z.object({
     initiatorRoles: z.array(z.string()),
     /** How the call was initiated — separates a human operator from framework machinery. */
     executionType: z.enum(ExecutionContext_ExecutionType),
+    /**
+     * The application-wide elevation that authorised this directory read.
+     *
+     * Until 2026-09-09 this event named NO elevation, because none was required — the read was gated on
+     * an administrator role alone while the far narrower per-row crossing required a usable, time-bound,
+     * approved grant. That inversion is what `applicationAccessGrants` closes, and this field is the
+     * evidence half of the closure: it is what joins a directory read to the two administrators who
+     * signed for it.
+     *
+     * Absent on a read the admission does not gate — an exempt execution type (batch, webhook), or a
+     * read the confinement authority confined, neither of which is an elevation.
+     */
+    authorizingGrantId: z.string().optional(),
+    /** WHICH collection {@link authorizingGrantId} names. Absent exactly when it is. */
+    authorizingGrantScope: z.enum(PlatformAccessGrantScope).optional(),
 });
 export const AuditableEvent_ResourceOperationDenied_EventDataSchema = z.object({
     eventType: z.literal(CoreAuditableEventType.RESOURCE_OPERATION_DENIED),
@@ -2882,6 +3063,145 @@ export const AuditableEvent_CollectionDataExport_EventDataSchema = z.object({
     /** Tenant scope, when the export ran org-scoped. */
     organizationId: z.string().optional(),
 });
+/**
+ * The application CALLED a declared operation on a third-party provider (S3a/S3b; see the enum
+ * member's docstring for why this is neither an HTTP_API read-through nor a credential-use event).
+ *
+ * One event per OUTBOUND CALL, emitted on both the success and the failure path. Recording only
+ * what worked would hide the attempts, and a refused or failed outbound call is exactly what a
+ * reviewer wants to see first.
+ *
+ * Ids and SHAPE only, never a payload. There is no field for the request body, the response body or
+ * the credential — a structural property of this schema rather than a redaction step somebody has to
+ * remember, for the same reason the credential family carries no value field.
+ *
+ * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT — records WHOSE third-party account
+ * an outbound call spent, which the initiator's own ids cannot answer once one execution may spend
+ * several.
+ */
+export const AuditableEvent_ProviderOperationCall_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.PROVIDER_OPERATION_CALL),
+    /** The provider whose catalogue declared the operation (e.g. `slack`). */
+    providerRef: z.string().trim().min(1),
+    /** The operation id as the catalogue declares it. */
+    operationId: z.string().trim().min(1),
+    /** The catalogue domain the operation belongs to. */
+    domain: z.string().trim().min(1),
+    /** The HTTP method the compiled request used. */
+    method: z.string().trim().min(1),
+    /** `READ` | `WRITE`, as the operation declares its effect — the axis a reviewer filters on first. */
+    classification: z.string().trim().min(1),
+    /**
+     * WHOSE ACCOUNT the call spent: `application` | `organization` | `user`.
+     *
+     * Deliberately separate from `organizationId` below, which records the tenant the REQUEST was
+     * scoped to. Those are the same tenant in the ordinary case and different ones exactly where it
+     * matters — a trail carrying only the initiator's organization would attribute a fan-out's calls
+     * to the wrong tenants.
+     */
+    connectionOwnerScope: z.string().trim().min(1),
+    /** The owner's id, absent for an application-owned call which names no second party. */
+    connectionOwnerId: z.string().optional(),
+    /** `service` | `user` — whether the call acted for the owner itself or on a person's delegation. */
+    connectionDelegation: z.string().trim().min(1),
+    /** HTTP status of the answer; absent when the call never got one. */
+    status: z.number().int().optional(),
+    /** Present when the call failed, naming the failure KIND rather than the vendor's prose. */
+    failureKind: z.string().optional(),
+    /** The REAL initiating user — absent only for genuine machine/internal executions. */
+    initiatorUserId: z.string().optional(),
+    /** The execution type that acted, for the machine/internal cases. */
+    executionType: z.string().optional(),
+    /** The tenant the REQUEST was scoped to — see `connectionOwnerScope`. */
+    organizationId: z.string().optional(),
+});
+/**
+ * An agent reached an MCP server — the outbound trail for a tool call that leaves the trust
+ * boundary (#491).
+ *
+ * One event per ATTEMPT, successful or not. Recording only what worked would hide exactly what a
+ * reviewer wants first: the refused targets, the calls that timed out, and the tools that answered
+ * with their own error. `outcome` names which of those it was, in the client's own vocabulary, so
+ * the trail and the logs agree on the words.
+ *
+ * Ids, HOST and SHAPE only — never a payload. There is no field for the tool arguments, the tool
+ * result or the credential. That is a structural property of this schema rather than a redaction
+ * step somebody has to remember, the same choice the provider-call and credential families make.
+ * `destinationHost` and not the URL, because an MCP endpoint routinely carries a tenant or session
+ * identifier in its path.
+ *
+ * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT — records WHOSE third-party account
+ * an agent's tool call spent, which the initiator's own ids cannot answer once one turn may spend
+ * either the person's or the tenant's.
+ */
+export const AuditableEvent_McpToolCall_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.MCP_TOOL_CALL),
+    /** The server ref the application declared and the agent named. */
+    mcpServerRef: z.string().trim().min(1),
+    /** HOST only — see the docstring for why never the URL. */
+    destinationHost: z.string().trim().min(1),
+    /** The tool called. Absent when the attempt failed before any tool was chosen (discovery). */
+    toolName: z.string().optional(),
+    /** The client's outcome kind — `ok`, `refused_target`, `unreachable`, `timed_out`, `protocol_error`, `tool_error`. */
+    outcome: z.string().trim().min(1),
+    /**
+     * WHOSE ACCOUNT the call spent: `user` | `organization`. Absent when no credential was resolved,
+     * which is itself the reason the attempt failed.
+     *
+     * Separate from `organizationId` for the same reason as the provider-call event: those are the
+     * same tenant in the ordinary case, and different ones exactly where it matters.
+     */
+    connectionOwnerScope: z.string().optional(),
+    /** The credential row that was spent, for the audit trail. */
+    credentialId: z.string().optional(),
+    /** The REAL initiating user — absent only for genuine machine/internal executions. */
+    initiatorUserId: z.string().optional(),
+    /** The tenant the turn was scoped to — see `connectionOwnerScope`. */
+    organizationId: z.string().optional(),
+    /** The agent whose declaration named the server, so a trail can be read back to a configuration. */
+    agentRef: z.string().optional(),
+});
+/**
+ * A human approver AUTHORED the arguments an approval-gated tool ran with (#566).
+ *
+ * One row per MODIFIED approval — never per approval. See the enum member's docstring for why an
+ * ordinary approval is not this event, and for why no argument VALUE appears in this schema.
+ *
+ * `proposedInputDigest` / `executedInputDigest` are the model SDK's own canonical input digests, the
+ * same values its approval signature is computed over. That is what makes them evidence rather than
+ * a convenience: a reader holding the executed call can recompute the second and see it match, and
+ * the two differing is proof that the call which ran is not the call which was proposed — with no
+ * copy of either payload on the trail.
+ *
+ * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT — records that an authorization
+ * decision REWROTE the act it authorized, and who made it.
+ */
+export const AuditableEvent_AgentToolApprovalModified_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.AGENT_TOOL_APPROVAL_MODIFIED),
+    /** The conversational execution whose turn was paused. */
+    executionId: z.string().trim().min(1),
+    /** The pending decision's id — correlates this row with the pause and the resume in the logs. */
+    approvalId: z.string().trim().min(1),
+    /** The actor system the turn belongs to. */
+    systemRef: z.string().trim().min(1),
+    /** The agent whose declaration gated the tool, so a trail reads back to a configuration. */
+    agentRef: z.string().trim().min(1),
+    /** The approval-gated tool, as the model was shown it. */
+    toolName: z.string().trim().min(1),
+    /** Canonical digest of the arguments the MODEL proposed. */
+    proposedInputDigest: z.string().trim().min(1),
+    /** Canonical digest of the arguments that actually RAN. Differs from the above by construction. */
+    executedInputDigest: z.string().trim().min(1),
+    /**
+     * The argument NAMES the approver changed, sorted. Names only — a field name is not personal data,
+     * which is exactly why it is always safe and always recorded.
+     */
+    modifiedArgumentKeys: z.array(z.string()),
+    /** The approver. Absent never happens on this plane — only a present human can answer — but the envelope owns the field. */
+    approverUserId: z.string().optional(),
+    /** The tenant the turn was scoped to. */
+    organizationId: z.string().optional(),
+});
 /**
  * Rows were read THROUGH an HTTP-API resource binding — the read-through trail for data living in
  * an EXTERNAL system the platform does not own (ETL plan D8/R6; see the enum member's docstring
@@ -3414,6 +3734,7 @@ export const AuditableEvent_TypedDataSchema = z.discriminatedUnion('eventType',
     AuditableEvent_User_PhoneVerifiedEventDataSchema,
     AuditableEvent_User_PhoneVerificationFailedEventDataSchema,
     AuditableEvent_OAuth2ProviderBlockedEventDataSchema,
+    AuditableEvent_OidcAcrDemandUnsatisfiedEventDataSchema,
     AuditableEvent_EmergencyAccess_UsedEventDataSchema,
     AuditableEvent_FieldAccess_EventDataSchema,
     AuditableEvent_ResourceOperationPerformed_EventDataSchema,
@@ -3426,6 +3747,7 @@ export const AuditableEvent_TypedDataSchema = z.discriminatedUnion('eventType',
     AuditableEvent_CollectionDataExport_EventDataSchema,
     AuditableEvent_User_SessionEvictedEventDataSchema,
     AuditableEvent_HttpApiReadThroughAccess_EventDataSchema,
+    AuditableEvent_ProviderOperationCall_EventDataSchema,
     AuditableEvent_HttpApiExternalErasure_EventDataSchema,
     AuditableEvent_HttpApiNonErasureAcknowledged_EventDataSchema,
     AuditableEvent_User_CrossFrontendHandoffIssuedEventDataSchema,